68 lines
2.5 KiB
TypeScript
68 lines
2.5 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import type { NextRequest } from 'next/server'
|
|
import { getToken } from 'next-auth/jwt'
|
|
|
|
// 允许的来源列表（内网和公网） - 支持通过环境变量配置，逗号分隔
|
|
const ALLOWED_ORIGINS = (() => {
|
|
const fromEnv = process.env.ALLOWED_ORIGINS || ''
|
|
const list = fromEnv.split(',').map(s => s.trim()).filter(Boolean)
|
|
const defaults = ['http://localhost:3000', 'http://localhost:4320']
|
|
return Array.from(new Set([...defaults, ...list]))
|
|
})()
|
|
|
|
export async function middleware(request: NextRequest) {
|
|
const { pathname, origin } = request.nextUrl
|
|
const requestOrigin = request.headers.get('origin')
|
|
|
|
// 处理API路由的CORS
|
|
if (pathname.startsWith('/api/')) {
|
|
// 处理OPTIONS预检请求
|
|
if (request.method === 'OPTIONS') {
|
|
return new NextResponse(null, {
|
|
status: 204,
|
|
headers: {
|
|
'Access-Control-Allow-Credentials': 'true',
|
|
'Access-Control-Allow-Origin': requestOrigin || origin,
|
|
'Access-Control-Allow-Methods': 'GET,DELETE,PATCH,POST,PUT,OPTIONS',
|
|
'Access-Control-Allow-Headers': 'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, Authorization, Cookie',
|
|
'Access-Control-Max-Age': '86400',
|
|
},
|
|
})
|
|
}
|
|
|
|
// 为所有API响应添加CORS头
|
|
const response = NextResponse.next()
|
|
response.headers.set('Access-Control-Allow-Credentials', 'true')
|
|
response.headers.set('Access-Control-Allow-Origin', requestOrigin || origin)
|
|
response.headers.set('Access-Control-Allow-Methods', 'GET,DELETE,PATCH,POST,PUT,OPTIONS')
|
|
response.headers.set('Access-Control-Allow-Headers', 'X-CSRF-Token, X-Requested-With, Accept, Accept-Version, Content-Length, Content-MD5, Content-Type, Date, X-Api-Version, Authorization, Cookie')
|
|
|
|
return response
|
|
}
|
|
|
|
// 处理需要认证的页面
|
|
if (pathname === '/' || pathname.startsWith('/admin')) {
|
|
const token = await getToken({ req: request, secret: process.env.NEXTAUTH_SECRET })
|
|
|
|
if (!token) {
|
|
const url = new URL('/login', request.url)
|
|
return NextResponse.redirect(url)
|
|
}
|
|
|
|
// 管理员页面需要管理员权限
|
|
if (pathname.startsWith('/admin')) {
|
|
if (token.role !== 'ADMIN') {
|
|
const url = new URL('/', request.url)
|
|
return NextResponse.redirect(url)
|
|
}
|
|
}
|
|
}
|
|
|
|
return NextResponse.next()
|
|
}
|
|
|
|
export const config = {
|
|
matcher: ['/', '/admin/:path*', '/api/:path*'],
|
|
}
|
|
|