1

server-node/src/middleware/auth.ts

@@ -1,5 +1,6 @@
 import type { NextFunction, Request, Response } from 'express';
 
+import { readAccessSessionToken } from '../auth/accessSessionCookie.js';
 import { verifyAccessToken } from '../auth/token.js';
 import type { AppConfig } from '../config.js';
 import { unauthorized } from '../errors.js';
@@ -16,9 +17,10 @@ function readBearerToken(request: Request) {
 export function requireJwtAuth(config: AppConfig, userRepository: UserRepository) {
   return async (request: Request, _response: Response, next: NextFunction) => {
     try {
-      const token = readBearerToken(request);
+      const token =
+        readBearerToken(request) || readAccessSessionToken(request, config);
       if (!token) {
-        throw unauthorized('缺少 Authorization Bearer Token');
+        throw unauthorized('缺少登录凭证');
       }
 
       const claims = await verifyAccessToken(token, config);