fix: harden api authentication and validation

apps/api/src/main.ts

@@ -18,28 +18,9 @@ import { PrismaService } from "./prisma.service.js";
 import { WechatAuthService } from "./wechat-auth.js";
 import { BookingService } from "./booking.service.js";
 import { CreateBookingDto } from "./booking.dto.js";
+import { UpdateBookingStatusDto } from "./admin.dto.js";
 import type { FastifyRequest } from "fastify";
-import { createHmac } from "node:crypto";
-
-function signIdentity(identity: { brandId: string; openid: string }): string {
-  const payload = Buffer.from(JSON.stringify(identity)).toString("base64url");
-  const signature = createHmac("sha256", process.env.SESSION_SECRET ?? "development-only-secret")
-    .update(payload)
-    .digest("base64url");
-  return `${payload}.${signature}`;
-}
-
-function readIdentity(token: string): { brandId: string; openid: string } {
-  const [payload, signature] = token.split(".");
-  const expected = createHmac("sha256", process.env.SESSION_SECRET ?? "development-only-secret")
-    .update(payload ?? "")
-    .digest("base64url");
-  if (!payload || signature !== expected) throw new BadRequestException("客户登录态无效");
-  return JSON.parse(Buffer.from(payload, "base64url").toString("utf8")) as {
-    brandId: string;
-    openid: string;
-  };
-}
+import { readIdentity, signIdentity } from "./auth.js";
 
 @Controller("health")
 export class HealthController {
@@ -105,7 +86,9 @@ export class CustomerSessionController {
       update: { lastLoginAt: new Date() },
       create: { brandId: brand.id, openid: session.openid },
     });
-    return { token: signIdentity({ brandId: brand.id, openid: session.openid }) };
+    return {
+      token: signIdentity({ subject: session.openid, brandId: brand.id, role: "customer" }),
+    };
   }
 }
 
@@ -153,7 +136,9 @@ export class CustomerBookingController {
     const token = request.headers.authorization?.replace(/^Bearer\s+/i, "");
     if (!token) throw new BadRequestException("缺少客户登录态");
     try {
-      return readIdentity(token);
+      const identity = readIdentity(token);
+      if (identity.role !== "customer") throw new BadRequestException("客户登录态无效");
+      return { brandId: identity.brandId, openid: identity.subject };
     } catch (error) {
       if (error instanceof BadRequestException) throw error;
       throw new BadRequestException("客户登录态无效");
@@ -165,20 +150,20 @@ export class CustomerBookingController {
 export class AdminBookingController {
   constructor(private readonly bookings: BookingService) {}
   @Get()
-  list(): Promise<unknown> {
+  list(@Req() request: FastifyRequest): Promise<unknown> {
+    this.requireAdmin(request);
     return this.bookings.listForAdmin(
       process.env.DEFAULT_BRAND_ID ?? "00000000-0000-0000-0000-000000000001",
     );
   }
   @Post(":id/status")
   update(
+    @Req() request: FastifyRequest,
     @Param("id") id: string,
     @Body()
-    body: {
-      status: "received" | "contacting" | "confirmed" | "completed" | "cancelled";
-      adminNote?: string;
-    },
+    body: UpdateBookingStatusDto,
   ): Promise<unknown> {
+    this.requireAdmin(request);
     return this.bookings.updateStatus(
       process.env.DEFAULT_BRAND_ID ?? "00000000-0000-0000-0000-000000000001",
       id,
@@ -186,6 +171,13 @@ export class AdminBookingController {
       body.adminNote,
     );
   }
+
+  private requireAdmin(request: FastifyRequest): void {
+    const token = request.headers.authorization?.replace(/^Bearer\s+/i, "");
+    if (!token) throw new BadRequestException("缺少管理员登录态");
+    const identity = readIdentity(token);
+    if (identity.role !== "admin") throw new BadRequestException("无管理员权限");
+  }
 }
 
 @Module({