保险前后端，养殖端和保险端小程序

insurance_backend/middleware/auth.js

@@ -0,0 +1,70 @@
+const jwt = require('jsonwebtoken');
+const responseFormat = require('../utils/response');
+
+// JWT认证中间件
+const jwtAuth = (req, res, next) => {
+  const token = req.headers.authorization?.replace('Bearer ', '');
+  
+  if (!token) {
+    return res.status(401).json(responseFormat.error('未提供认证令牌'));
+  }
+  
+  try {
+    const decoded = jwt.verify(token, process.env.JWT_SECRET);
+    req.user = decoded;
+    next();
+  } catch (error) {
+    return res.status(401).json(responseFormat.error('认证令牌无效或已过期'));
+  }
+};
+
+// 权限检查中间件
+const checkPermission = (resource, action) => {
+  return async (req, res, next) => {
+    try {
+      const { Role } = require('../models');
+      const user = req.user;
+      
+      if (!user || !user.role_id) {
+        return res.status(403).json(responseFormat.error('用户角色信息缺失'));
+      }
+      
+      const userRole = await Role.findByPk(user.role_id);
+      
+      if (!userRole) {
+        return res.status(403).json(responseFormat.error('用户角色不存在'));
+      }
+      
+      const permissions = userRole.permissions || [];
+      const requiredPermission = `${resource}:${action}`;
+      
+      // 检查权限或超级管理员权限
+      if (!permissions.includes(requiredPermission) && !permissions.includes('*:*')) {
+        return res.status(403).json(responseFormat.error('权限不足'));
+      }
+      
+      next();
+    } catch (error) {
+      return res.status(500).json(responseFormat.error('权限验证失败'));
+    }
+  };
+};
+
+// 可选认证中间件（不强制要求认证）
+const optionalAuth = (req, res, next) => {
+  const token = req.headers.authorization?.replace('Bearer ', '');
+  
+  if (token) {
+    try {
+      const decoded = jwt.verify(token, process.env.JWT_SECRET);
+      req.user = decoded;
+    } catch (error) {
+      // 令牌无效，但不阻止请求
+      console.warn('可选认证令牌无效:', error.message);
+    }
+  }
+  
+  next();
+};
+
+module.exports = { jwtAuth, checkPermission, optionalAuth };