ai review

routes/index.js

@@ -2,6 +2,28 @@ import Router from "koa-router";
 import { HandlerEscortRecord } from "../handler/escort_record.js";
 import { HandlerHealthProfile } from "../handler/health_profile.js";
 import { HandlerResource } from "../handler/resource.js";
+import ResponseUtil from "../utils/responseUtil.js";
+import { getUserByToken } from "../utils/user_service.js";
+
+/**
+ * 鉴权中间件：校验 token 并将用户信息挂到 ctx.state.user
+ * token→user 结果带 5 分钟进程内缓存（见 utils/user_service.js）
+ */
+async function requireAuth(ctx, next) {
+  const token = ctx.header["token"] || ctx.header["authorization"] || ctx.request.query?.token;
+  if (!token) {
+    ResponseUtil.unauthorized(ctx, "缺少token");
+    return;
+  }
+
+  const user = await getUserByToken(token);
+  if (!user) {
+    ResponseUtil.unauthorized(ctx, "登录已失效");
+    return;
+  }
+  ctx.state.user = user;
+  await next();
+}
 
 function printRoutes(stack) {
   for (const layer of stack) {
@@ -19,19 +41,21 @@ function registerRoutes(app) {
   const handlerHealthProfile = new HandlerHealthProfile();
   const handlerResource = new HandlerResource();
 
-  router.get("/escort-record/my", handlerEscortRecord.getRecords.bind(handlerEscortRecord));
-  router.get("/escort-record/attendant", handlerEscortRecord.getAttendantRecords.bind(handlerEscortRecord));
-  router.get("/escort-record/:id", handlerEscortRecord.getRecordById.bind(handlerEscortRecord));
-  router.post("/escort-record", handlerEscortRecord.createRecord.bind(handlerEscortRecord));
-  router.put("/escort-record/:id", handlerEscortRecord.updateRecord.bind(handlerEscortRecord));
-  router.patch("/escort-record/:id/status", handlerEscortRecord.updateStatus.bind(handlerEscortRecord));
-  router.delete("/escort-record/:id", handlerEscortRecord.deleteRecord.bind(handlerEscortRecord));
+  // 敏感数据路由需要登录后访问
+  router.get("/escort-record/my", requireAuth, handlerEscortRecord.getMyRecords.bind(handlerEscortRecord));
+  router.get("/escort-record/attendant", requireAuth, handlerEscortRecord.getAttendantRecords.bind(handlerEscortRecord));
+  router.get("/escort-record", requireAuth, handlerEscortRecord.getRecords.bind(handlerEscortRecord));
+  router.get("/escort-record/:id", requireAuth, handlerEscortRecord.getRecordById.bind(handlerEscortRecord));
+  router.post("/escort-record", requireAuth, handlerEscortRecord.createRecord.bind(handlerEscortRecord));
+  router.put("/escort-record/:id", requireAuth, handlerEscortRecord.updateRecord.bind(handlerEscortRecord));
+  router.patch("/escort-record/:id/status", requireAuth, handlerEscortRecord.updateStatus.bind(handlerEscortRecord));
+  router.delete("/escort-record/:id", requireAuth, handlerEscortRecord.deleteRecord.bind(handlerEscortRecord));
 
-  router.get("/health-profile", handlerHealthProfile.getProfiles.bind(handlerHealthProfile));
-  router.get("/health-profile/:id", handlerHealthProfile.getProfileById.bind(handlerHealthProfile));
-  router.post("/health-profile", handlerHealthProfile.createProfile.bind(handlerHealthProfile));
-  router.put("/health-profile/:id", handlerHealthProfile.updateProfile.bind(handlerHealthProfile));
-  router.delete("/health-profile/:id", handlerHealthProfile.deleteProfile.bind(handlerHealthProfile));
+  router.get("/health-profile", requireAuth, handlerHealthProfile.getProfiles.bind(handlerHealthProfile));
+  router.get("/health-profile/:id", requireAuth, handlerHealthProfile.getProfileById.bind(handlerHealthProfile));
+  router.post("/health-profile", requireAuth, handlerHealthProfile.createProfile.bind(handlerHealthProfile));
+  router.put("/health-profile/:id", requireAuth, handlerHealthProfile.updateProfile.bind(handlerHealthProfile));
+  router.delete("/health-profile/:id", requireAuth, handlerHealthProfile.deleteProfile.bind(handlerHealthProfile));
 
   router.get("/service", handlerResource.getServices.bind(handlerResource));
   router.get("/agreement", handlerResource.getAgreement.bind(handlerResource));