张翔
d9c0e5f2c1
修复 CMS / Admin 后台 dogfood 专项测试发现的阻塞性与体验性问题： - 登录后无限重定向（Secure Cookie + Edge Runtime JWT 兼容） - 内容新增/编辑保存 400/500（默认不加密请求体、自动生成唯一 slug） - 编辑时提交 status 导致验证错误 - 原生 confirm 阻塞自动化测试，改为 AlertDialog - 表单字段可访问性（id/htmlFor/fieldset） - JSON 数组标签字段新增 TagInput 组件 - 操作反馈统一使用 Sonner Toast - 后台隐藏营销 Cookie 横幅 - 媒体库空状态优化 添加 dogfood-cms-regression 与 dogfood-cms-output 报告、截图及工作流路由测试。
105 lines
3.2 KiB
TypeScript
105 lines
3.2 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
|
|
interface JwtPayload {
|
|
userId: string;
|
|
username: string;
|
|
role: string;
|
|
exp?: number;
|
|
}
|
|
|
|
// ============ Edge-compatible JWT 验证 ============
|
|
// Next.js Middleware 运行在 Edge Runtime，不能依赖 jsonwebtoken 的 Node crypto。
|
|
// 这里使用 Web Crypto API 实现 HS256 签名验证，与 API 路由中的 jsonwebtoken 共享同一密钥。
|
|
|
|
function base64urlToBuffer(value: string): Uint8Array {
|
|
const base64 = value.replace(/-/g, '+').replace(/_/g, '/').padEnd(value.length + ((4 - (value.length % 4)) % 4), '=');
|
|
const binary = atob(base64);
|
|
const bytes = new Uint8Array(binary.length);
|
|
for (let i = 0; i < binary.length; i++) {
|
|
bytes[i] = binary.charCodeAt(i);
|
|
}
|
|
return bytes;
|
|
}
|
|
|
|
function bufferToBase64url(buffer: ArrayBuffer): string {
|
|
const bytes = new Uint8Array(buffer);
|
|
let binary = '';
|
|
for (let i = 0; i < bytes.byteLength; i++) {
|
|
binary += String.fromCharCode(bytes[i]!);
|
|
}
|
|
return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
|
|
}
|
|
|
|
async function verifyAccessTokenEdge(token: string): Promise<JwtPayload> {
|
|
const secret = process.env.JWT_SECRET;
|
|
if (!secret) {
|
|
throw new Error('JWT_SECRET is not configured');
|
|
}
|
|
|
|
const [headerB64, payloadB64, signatureB64] = token.split('.');
|
|
if (!headerB64 || !payloadB64 || !signatureB64) {
|
|
throw new Error('Malformed token');
|
|
}
|
|
|
|
const encoder = new TextEncoder();
|
|
const key = await crypto.subtle.importKey(
|
|
'raw',
|
|
encoder.encode(secret),
|
|
{ name: 'HMAC', hash: 'SHA-256' },
|
|
false,
|
|
['sign'],
|
|
);
|
|
|
|
const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(`${headerB64}.${payloadB64}`));
|
|
const expectedSignature = bufferToBase64url(signature);
|
|
|
|
if (expectedSignature !== signatureB64) {
|
|
throw new Error('Invalid token signature');
|
|
}
|
|
|
|
const payload = JSON.parse(new TextDecoder().decode(base64urlToBuffer(payloadB64))) as JwtPayload & { exp?: number };
|
|
if (payload.exp && payload.exp * 1000 < Date.now()) {
|
|
throw new Error('Token expired');
|
|
}
|
|
|
|
return payload;
|
|
}
|
|
|
|
// ============ Middleware ============
|
|
|
|
function redirectToLogin(request: NextRequest, pathname: string): NextResponse {
|
|
const loginUrl = new URL('/admin/login', request.url);
|
|
loginUrl.searchParams.set('redirect', pathname);
|
|
return NextResponse.redirect(loginUrl);
|
|
}
|
|
|
|
export async function middleware(request: NextRequest) {
|
|
const { pathname } = request.nextUrl;
|
|
|
|
// 只处理 /admin 路由（除了登录页和 API 路由）
|
|
if (pathname.startsWith('/admin') && !pathname.startsWith('/admin/login') && !pathname.startsWith('/api/')) {
|
|
const token = request.cookies.get('novalon_token')?.value;
|
|
const authHeader = request.headers.get('authorization');
|
|
const bearerToken = authHeader?.startsWith('Bearer ') ? authHeader.slice(7) : null;
|
|
const accessToken = token || bearerToken;
|
|
|
|
// 未提供令牌时重定向到登录页
|
|
if (!accessToken) {
|
|
return redirectToLogin(request, pathname);
|
|
}
|
|
|
|
// 验证令牌有效性
|
|
try {
|
|
await verifyAccessTokenEdge(accessToken);
|
|
} catch {
|
|
return redirectToLogin(request, pathname);
|
|
}
|
|
}
|
|
|
|
return NextResponse.next();
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ['/admin/:path*'],
|
|
};
|