初始化2

server/middleware/auth.go

@@ -10,25 +10,32 @@ import (
 )
 
 // JWTAuth JWT认证中间件
-// 从请求头 Authorization: Bearer <token> 中提取并验证JWT
+// 从请求头 token 中提取并验证JWT
 // 验证通过后将用户信息存入上下文
 func JWTAuth(secret string) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		authHeader := c.GetHeader("Authorization")
-		if authHeader == "" {
-			utils.Unauthorized(c, "缺少Authorization请求头")
+		token := c.GetHeader("token")
+		if token == "" {
+			// 兼容查询参数 ?token=xxx (用于浏览器直接访问预览/下载链接)
+			token = c.Query("token")
+		}
+		if token == "" {
+			// 兼容 Authorization: Bearer xxx
+			authHeader := c.GetHeader("Authorization")
+			if authHeader != "" {
+				parts := strings.SplitN(authHeader, " ", 2)
+				if len(parts) == 2 && parts[0] == "Bearer" {
+					token = parts[1]
+				}
+			}
+		}
+		if token == "" {
+			utils.Unauthorized(c, "缺少token请求头")
 			c.Abort()
 			return
 		}
 
-		parts := strings.SplitN(authHeader, " ", 2)
-		if len(parts) != 2 || parts[0] != "Bearer" {
-			utils.Unauthorized(c, "Authorization格式错误, 应为: Bearer <token>")
-			c.Abort()
-			return
-		}
-
-		claims, err := utils.ParseToken(parts[1], secret)
+		claims, err := utils.ParseToken(token, secret)
 		if err != nil {
 			utils.Unauthorized(c, "Token无效或已过期: "+err.Error())
 			c.Abort()