fix: 修复consumableImport.js路由级authMiddleware拦截所有/api请求的问题

consumableImport.js挂载在/api根路径，使用router.use(authMiddleware) 会拦截所有/api/*请求（包括公开路由如/api/auth/login），导致登录等公开接口返回401。修复方案：移除router.use(authMiddleware)，改为在每个具体路由上单独添加authMiddleware中间件。
2026-04-02 03:35:23 +00:00
parent dc20bdba1f
commit 1bda91b93e
6 changed files with 46 additions and 47 deletions
@@ -142,7 +142,6 @@
      "integrity": "sha512-e7jT4DxYvIDLk1ZHmU/m/mB19rex9sv0c2ftBtjSBv+kVM/902eh0fINUzD7UwLLNR+jU585GxUJ8/EBfAM5fw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@babel/code-frame": "^7.27.1",
        "@babel/generator": "^7.28.5",
@@ -1670,7 +1669,6 @@
      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.0.3.tgz",
      "integrity": "sha512-W609buLVRVmeW693xKfzHeIV6nJGGz98uCPfeXI1ELMLXVeKYZ9m15fAMSaUPBHYLGFsVRcMmSCksQOrZV9BYA==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "undici-types": "~7.16.0"
      }
@@ -1737,7 +1735,6 @@
      "integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "bin": {
        "acorn": "bin/acorn"
      },
@@ -2465,7 +2462,6 @@
        }
      ],
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "baseline-browser-mapping": "^2.9.0",
        "caniuse-lite": "^1.0.30001759",
@@ -3782,7 +3778,6 @@
      "integrity": "sha512-LEyamqS7W5HB3ujJyvi0HQK/dtVINZvd5mAAp9eT5S/ujByGjiZLCzPcHVzuXbpJDJF/cxwHlfceVUDZ2lnSTw==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.8.0",
        "@eslint-community/regexpp": "^4.12.1",
@@ -3843,7 +3838,6 @@
      "integrity": "sha512-82GZUjRS0p/jganf6q1rEO25VSoHH0hKPCTrgillPjdI/3bgBhAE1QzHrHTizjpRvy6pGAvKjDJtk2pF9NDq8w==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "bin": {
        "eslint-config-prettier": "bin/cli.js"
      },
@@ -4238,7 +4232,6 @@
      "resolved": "https://registry.npmjs.org/express/-/express-4.22.1.tgz",
      "integrity": "sha512-F2X8g9P1X7uCPZMA3MVf9wcTqlyNp7IhH5qPCI0izhaOIYXaW9L535tGA3qmjRzpH+bZczqq7hVKxTR4NWnu+g==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "accepts": "~1.3.8",
        "array-flatten": "1.1.1",
@@ -8124,7 +8117,6 @@
      "integrity": "sha512-UOnG6LftzbdaHZcKoPFtOcCKztrQ57WkHDeRD9t/PTQtmT0NHSeWWepj6pS0z/N7+08BHFDQVUrfmfMRcZwbMg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "bin": {
        "prettier": "bin/prettier.cjs"
      },
@@ -10327,7 +10319,6 @@
      "resolved": "https://registry.npmjs.org/winston/-/winston-3.19.0.tgz",
      "integrity": "sha512-LZNJgPzfKR+/J3cHkxcpHKpKKvGfDZVPS4hfJCc4cCG0CgYzvlD6yE/S3CIL/Yt91ak327YCpiF/0MyeZHEHKA==",
      "license": "MIT",
-      "peer": true,
      "dependencies": {
        "@colors/colors": "^1.6.0",
        "@dabh/diagnostics": "^2.0.8",
@@ -10576,7 +10567,6 @@
      "integrity": "sha512-rftlrkhHZOcjDwkGlnUtZZkvaPHCsDATp4pGpuOOMDaTdDDXF91wuVDJoWoPsKX/3YPQ5fHuF3STjcYyKr+Qhg==",
      "dev": true,
      "license": "MIT",
-      "peer": true,
      "funding": {
        "url": "https://github.com/sponsors/colinhacks"
      }
@@ -2,6 +2,10 @@ const express = require('express');
 const path = require('path');
 const fs = require('fs');
 const router = express.Router();
+const { authMiddleware } = require('../middleware/auth');
+
+// 所有背景设置路由需要认证
+router.use(authMiddleware);

 const UPLOAD_DIR = path.join(__dirname, '../uploads');
 if (!fs.existsSync(UPLOAD_DIR)) {
@@ -69,6 +69,9 @@ if (!fs.existsSync(tempDir)) {
  fs.mkdirSync(tempDir, { recursive: true });
 }

+// 全局认证保护：所有备份路由需要登录
+router.use(authMiddleware);
+
 router.post('/', async (req, res) => {
  try {
    const { description = '', includeFiles = true } = req.body;
@@ -217,7 +220,7 @@ router.get('/validate/:filename', async (req, res) => {
  }
 });

-router.get('/restore-progress/:filename', authMiddleware, async (req, res) => {
+router.get('/restore-progress/:filename', async (req, res) => {
  const { filename } = req.params;
  const options = req.query.options ? JSON.parse(req.query.options) : {};

@@ -2,11 +2,16 @@ const express = require('express');
 const router = express.Router();
 const { Op } = require('sequelize');
 const { sequelize } = require('../db');
+const { authMiddleware } = require('../middleware/auth');
 const Consumable = require('../models/Consumable');
 const ConsumableLog = require('../models/ConsumableLog');
 const { importJobManager } = require('../utils/importJobManager');
 const { generateId } = require('../utils/idGenerator');

+// 注意：此路由挂载在 /api 根路径，不能使用 router.use(authMiddleware)，
+// 否则会拦截所有 /api 下的请求。认证由 server.js 全局中间件处理。
+// 各路由单独添加 authMiddleware。
+
 const SUPPORTED_FIELDS = [
  'consumableId',
  'name',
@@ -63,7 +68,7 @@ const parseSnList = snStr => {
  return [];
 };

-router.post('/consumables/background', async (req, res) => {
+router.post('/consumables/background', authMiddleware, async (req, res) => {
  const { items, operator = '系统', mode = 'create', fieldMapping = {} } = req.body;

  if (!items || !Array.isArray(items) || items.length === 0) {
@@ -245,7 +250,7 @@ router.post('/consumables/background', async (req, res) => {
  });
 });

-router.get('/consumables/progress/:jobId', async (req, res) => {
+router.get('/consumables/progress/:jobId', authMiddleware, async (req, res) => {
  const { jobId } = req.params;

  const progress = importJobManager.getJobProgress(jobId);
@@ -256,7 +261,7 @@ router.get('/consumables/progress/:jobId', async (req, res) => {
  res.json(progress);
 });

-router.post('/consumables/cancel/:jobId', async (req, res) => {
+router.post('/consumables/cancel/:jobId', authMiddleware, async (req, res) => {
  const { jobId } = req.params;

  const job = importJobManager.getJob(jobId);
@@ -272,7 +277,7 @@ router.post('/consumables/cancel/:jobId', async (req, res) => {
  res.json({ message: '任务已取消' });
 });

-router.get('/consumables/result/:jobId', async (req, res) => {
+router.get('/consumables/result/:jobId', authMiddleware, async (req, res) => {
  const { jobId } = req.params;

  const job = importJobManager.getJob(jobId);
@@ -293,7 +298,7 @@ router.get('/consumables/result/:jobId', async (req, res) => {
  });
 });

-router.get('/consumables/field-mappings', async (req, res) => {
+router.get('/consumables/field-mappings', authMiddleware, async (req, res) => {
  const mappings = [
    { source: '耗材ID', target: 'consumableId', required: false, description: '耗材唯一标识符' },
    { source: '名称', target: 'name', required: true, description: '耗材名称' },
@@ -1,13 +1,14 @@
 const express = require('express');
 const router = express.Router();
 const { Op } = require('sequelize');
+const { authMiddleware } = require('../middleware/auth');
 const Device = require('../models/Device');
 const Rack = require('../models/Rack');
 const Room = require('../models/Room');
 const User = require('../models/User');
 const Ticket = require('../models/Ticket');

-router.get('/', async (req, res) => {
+router.get('/', authMiddleware, async (req, res) => {
  try {
    const now = new Date();
    const oneWeekAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000);