Allow anonymous jump-hop recommend play

server-rs/crates/api-server/src/auth.rs

@@ -59,17 +59,44 @@ pub async fn require_bearer_auth(
     mut request: Request,
     next: Next,
 ) -> Result<Response, AppError> {
+    let Some(authenticated) = authenticate_request(&state, &request)? else {
+        return Err(AppError::from_status(StatusCode::UNAUTHORIZED));
+    };
+    request.extensions_mut().insert(authenticated.clone());
+
+    let mut response = next.run(request).await;
+    response.extensions_mut().insert(authenticated);
+
+    Ok(response)
+}
+
+pub async fn attach_optional_bearer_auth(
+    State(state): State<AppState>,
+    mut request: Request,
+    next: Next,
+) -> Result<Response, AppError> {
+    if let Some(authenticated) = authenticate_request(&state, &request)? {
+        request.extensions_mut().insert(authenticated.clone());
+        let mut response = next.run(request).await;
+        response.extensions_mut().insert(authenticated);
+        return Ok(response);
+    }
+
+    Ok(next.run(request).await)
+}
+
+fn authenticate_request(
+    state: &AppState,
+    request: &Request,
+) -> Result<Option<AuthenticatedAccessToken>, AppError> {
     if allows_internal_forwarded_auth(request.uri().path())
         && let Some(claims) = try_build_internal_forwarded_claims(&state, request.headers())
     {
-        request
-            .extensions_mut()
-            .insert(AuthenticatedAccessToken::new(claims.clone()));
-        let mut response = next.run(request).await;
-        response
-            .extensions_mut()
-            .insert(AuthenticatedAccessToken::new(claims));
-        return Ok(response);
+        return Ok(Some(AuthenticatedAccessToken::new(claims)));
+    }
+
+    if !request.headers().contains_key(AUTHORIZATION) {
+        return Ok(None);
     }
 
     let bearer_token = extract_bearer_token(request.headers())?;
@@ -145,16 +172,7 @@ pub async fn require_bearer_auth(
             .with_message("当前登录态已失效，请重新登录"));
     }
 
-    request
-        .extensions_mut()
-        .insert(AuthenticatedAccessToken::new(claims.clone()));
-
-    let mut response = next.run(request).await;
-    response
-        .extensions_mut()
-        .insert(AuthenticatedAccessToken::new(claims));
-
-    Ok(response)
+    Ok(Some(AuthenticatedAccessToken::new(claims)))
 }
 
 pub async fn inspect_auth_claims(