第 5 阶段：纠纷、通知与后台-2

backend/internal/middleware/auth.go

@@ -10,8 +10,10 @@ import (
 )
 
 const (
-	ContextUserID = "user_id"
-	ContextPhone  = "phone"
+	ContextUserID   = "user_id"
+	ContextPhone    = "phone"
+	ContextAdminID  = "admin_id"
+	ContextUsername = "username"
 )
 
 func Auth(jwtManager *auth.JWTManager) gin.HandlerFunc {
@@ -24,7 +26,7 @@ func Auth(jwtManager *auth.JWTManager) gin.HandlerFunc {
 			return
 		}
 
-		claims, err := jwtManager.Parse(tokenText, "access")
+		claims, err := jwtManager.ParseSubject(tokenText, "access", "user")
 		if err != nil {
 			response.Unauthorized(c, "访问令牌无效或已过期")
 			c.Abort()
@@ -36,3 +38,26 @@ func Auth(jwtManager *auth.JWTManager) gin.HandlerFunc {
 		c.Next()
 	}
 }
+
+func AdminAuth(jwtManager *auth.JWTManager) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		header := c.GetHeader("Authorization")
+		tokenText := strings.TrimSpace(strings.TrimPrefix(header, "Bearer "))
+		if tokenText == "" || tokenText == header {
+			response.Unauthorized(c, "缺少后台访问令牌")
+			c.Abort()
+			return
+		}
+
+		claims, err := jwtManager.ParseSubject(tokenText, "access", "admin")
+		if err != nil {
+			response.Unauthorized(c, "后台访问令牌无效或已过期")
+			c.Abort()
+			return
+		}
+
+		c.Set(ContextAdminID, claims.UserID)
+		c.Set(ContextUsername, claims.Phone)
+		c.Next()
+	}
+}