Function apiAuthMiddleware

src/routes/openapi.ts:72–91

* 鉴权 + 限流中间件 * 将当前用户挂到 c.set("apiUser", user)

(c: Context, next: Next)

 * 将当前用户挂到 c.set("apiUser", user)
 */
async function apiAuthMiddleware(c: Context, next: Next): Promise<Response | void> {
    const parsed = parseAuth(c);
    if (!parsed) {
        return c.json({code: "UNAUTHORIZED", message: "缺少鉴权头 X-API-Mail / X-API-Token"}, 401);
    }
    const dao = await ensureDao(c.env as any);
    const user = await dao.getUser(parsed.mail);
    if (!user || !user.apis || user.apis !== parsed.token) {
        return c.json({code: "UNAUTHORIZED", message: "鉴权失败"}, 401);
    }
    if (Number(user.flag) !== 1) {
        return c.json({code: "ACCOUNT_INACTIVE", message: "账号未激活或已禁用"}, 403);
    }
    const limit = await readInt(c.env as any, "API_RATE_LIMIT", 60);
    if (!rateLimit(user.mail, Math.max(1, limit))) {
        return c.json({code: "RATE_LIMITED", message: "请求过于频繁，请稍后重试"}, 429);
    }
    c.set("apiUser", user);
    await next();
}

/** 对订单进行所有权校验（管理员默认可读） */
async function ownsApply(dao: any, user: UserRow, uuid: string): Promise<ApplyRow | null> {