feat(gateway): 新增消息网关及apikey功能

api/user/tool.go

@@ -1,6 +1,8 @@
 package user
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -48,11 +50,44 @@ func createUser(u *model.User) error {
 		return err
 	}
 	u.Password = hashedPassword
+	if u.APIKey == "" {
+		u.APIKey, err = generateAPIKey()
+		if err != nil {
+			return err
+		}
+	}
 	u.CreateAt = time.Now().Unix()
 
 	return gormDB.Create(u).Error
 }
 
+func generateAPIKey() (string, error) {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return "gb_" + hex.EncodeToString(b), nil
+}
+
+func ensureAPIKey(user *model.User) error {
+	if user.APIKey != "" {
+		return nil
+	}
+	key, err := generateAPIKey()
+	if err != nil {
+		return err
+	}
+	gormDB, err := db.GetGormDB()
+	if err != nil {
+		return err
+	}
+	if err := gormDB.Model(&model.User{}).Where("id = ? AND (api_key IS NULL OR api_key = '')", user.ID).Update("api_key", key).Error; err != nil {
+		return err
+	}
+	user.APIKey = key
+	return nil
+}
+
 // IsUsernameTaken 用户名是否已被占用
 func IsUsernameTaken(username string) (bool, error) {
 	gormDB, err := db.GetGormDB()
@@ -134,6 +169,9 @@ func GetUserByID(id uint) (*model.User, error) {
 		}
 		return nil, err
 	}
+	if err := ensureAPIKey(&user); err != nil {
+		return nil, err
+	}
 	return &user, nil
 }
 

api/user/user.go

@@ -210,6 +210,27 @@ func HandleUpdateNotifyConfig(c *gin.Context) {
 // AuthMiddleware 认证中间件，同时把当前用户放进 context 供后续 handler 复用
 func AuthMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
+		apiKey := c.GetHeader("X-API-Key")
+		if apiKey == "" {
+			auth := c.GetHeader("Authorization")
+			const prefix = "Bearer "
+			if len(auth) > len(prefix) && auth[:len(prefix)] == prefix {
+				apiKey = auth[len(prefix):]
+			}
+		}
+		if apiKey != "" {
+			gormDB, err := db.GetGormDB()
+			if err == nil {
+				var user model.User
+				if gormDB.Where("api_key = ?", apiKey).First(&user).Error == nil {
+					c.Set(contextKey, &user)
+					c.Next()
+					return
+				}
+			}
+			response.AbortWith(c, http.StatusUnauthorized, "API Key 无效")
+			return
+		}
 		session := sessions.Default(c)
 		uid, ok := session.Get("uid").(uint)
 		if !ok {