import { accessTokens } from '../state.js'

export function requireAuth(req, res, next) {
  const header = req.headers.authorization || ''
  const token = header.startsWith('Bearer ') ? header.slice(7) : ''
  const record = token ? accessTokens.get(token) : null
  if (!record || record.expireAt < Date.now()) {
    return res.status(401).json({ code: 401, message: '登录已过期', data: null })
  }
  req.userId = record.userId
  next()
}