chore: sync local updates

mengyaping-backend/middleware/admin.go

@@ -0,0 +1,43 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"mengyaping-backend/models"
+	"mengyaping-backend/storage"
+)
+
+// AdminAuth 校验管理员令牌：环境变量 ADMIN_TOKEN 优先，否则使用 MySQL monitor_kv 中的 admin_token（请求头 X-Admin-Token 或 Authorization: Bearer）
+func AdminAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		expected := storage.GetStorage().EffectiveAdminToken()
+		if expected == "" {
+			c.AbortWithStatusJSON(http.StatusServiceUnavailable, models.APIResponse{
+				Code:    503,
+				Message: "未配置管理员令牌：请在数据库 monitor_kv 写入 admin_token，或设置环境变量 ADMIN_TOKEN",
+			})
+			return
+		}
+
+		got := strings.TrimSpace(c.GetHeader("X-Admin-Token"))
+		if got == "" {
+			auth := c.GetHeader("Authorization")
+			const prefix = "Bearer "
+			if len(auth) >= len(prefix) && strings.EqualFold(auth[:len(prefix)], prefix) {
+				got = strings.TrimSpace(auth[len(prefix):])
+			}
+		}
+
+		if got == "" || got != expected {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, models.APIResponse{
+				Code:    401,
+				Message: "无效的管理员令牌",
+			})
+			return
+		}
+		c.Next()
+	}
+}