feat: Implement OpenAPI with API Key authentication and role-based access control

middleware.ts

@@ -3,18 +3,28 @@ import { NextResponse } from "next/server"
 import { PERMISSIONS } from "@/lib/permissions"
 import { checkPermission } from "@/lib/auth"
 import { Permission } from "@/lib/permissions"
+import { handleApiKeyAuth } from "@/lib/apiKey"
 
 const API_PERMISSIONS: Record<string, Permission> = {
   '/api/emails': PERMISSIONS.MANAGE_EMAIL,
   '/api/webhook': PERMISSIONS.MANAGE_WEBHOOK,
   '/api/roles/promote': PERMISSIONS.PROMOTE_USER,
   '/api/config': PERMISSIONS.MANAGE_CONFIG,
+  '/api/api-keys': PERMISSIONS.MANAGE_API_KEY,
 }
 
 export async function middleware(request: Request) {
-  const session = await auth()
   const pathname = new URL(request.url).pathname
 
+  // API Key 认证
+  request.headers.delete("X-User-Id")
+  const apiKey = request.headers.get("X-API-Key")
+  if (apiKey) {
+    return handleApiKeyAuth(apiKey, pathname)
+  }
+
+  // Session 认证
+  const session = await auth()
   if (!session?.user) {
     return NextResponse.json(
       { error: "未授权" },
@@ -25,7 +35,7 @@ export async function middleware(request: Request) {
   for (const [route, permission] of Object.entries(API_PERMISSIONS)) {
     if (pathname.startsWith(route)) {
       const hasAccess = await checkPermission(permission)
-      
+
       if (!hasAccess) {
         return NextResponse.json(
           { error: "权限不足" },
@@ -45,5 +55,7 @@ export const config = {
     '/api/webhook/:path*',
     '/api/roles/:path*',
     '/api/config/:path*',
+    '/api/api-keys/:path*',
+    '/api/admin-contact',
   ]
 }