认证与授权的区别

// 认证中间件
app.use('*', async (c, next) => {
  const token = c.req.header('Authorization')?.replace('Bearer ', '')
 
  if (!token) {
    return c.json({ error: 'Unauthorized' }, 401)
  }
 
  try {
    const payload = await verifyJWT(token)
    c.set('user', payload)  // 把身份放到上下文
  } catch {
    return c.json({ error: 'Invalid token' }, 401)
  }
 
  await next()
})

// 授权中间件
function requireRole(role: string) {
  return async (c: Context, next: Next) => {
    const user = c.get('user')
 
    if (user.role !== role) {
      return c.json({ error: 'Forbidden' }, 403)
    }
 
    await next()
  }
}
 
// 使用
app.post('/admin/delete', requireRole('admin'), async (c) => {
  // 只有 admin 角色能访问
})

// ❌ 耦合：认证和授权写在一起
app.use('*', async (c, next) => {
  // 从 cookie 里读 session
  const session = await getSession(c.req.header('Cookie'))
 
  if (!session) return c.json({ error: 'Unauthorized' }, 401)
 
  // 直接检查权限
  if (session.role !== 'admin') {
    return c.json({ error: 'Forbidden' }, 403)
  }
 
  await next()
})

// ❌ 硬编码权限
if (user.role === 'admin' || user.role === 'editor') {
  // 允许编辑
}

// 第一层：认证（只负责身份）
app.use('*', authMiddleware())
 
// 第二层：授权（只负责权限）
app.post('/articles', requirePermission('article:create'), async (c) => {
  // ...
})
 
// 第三层：资源级授权
app.put('/articles/:id', requireOwnership('article'), async (c) => {
  // ...
})

// 多维度授权
async function checkQuota(userId: string, model: string) {
  const usage = await getUsage(userId, model)
  const quota = await getQuota(userId, model)
 
  if (usage.count >= quota.maxCount) {
    throw new QuotaExceededError('Monthly limit reached')
  }
 
  if (usage.tokens >= quota.maxTokens) {
    throw new QuotaExceededError('Token limit reached')
  }
}

// 租户隔离
app.use('/api/*', tenantMiddleware())
 
app.get('/conversations', async (c) => {
  const tenantId = c.get('tenantId')
 
  // 只能查自己的数据
  const conversations = await db
    .select()
    .from(conversations)
    .where(eq(conversations.tenantId, tenantId))
})

import { Hono } from 'hono'
import { jwt } from 'hono/jwt'
import { HTTPException } from 'hono/http-exception'
 
const app = new Hono()
 
// 第一层：认证
app.use('/api/*', jwt({ secret: process.env.JWT_SECRET! }))
 
// 第二层：角色授权
const requireRole = (role: string) =>
  async (c: Context, next: Next) => {
    const user = c.get('jwtPayload')
    if (user.role !== role) {
      throw new HTTPException(403, { message: 'Forbidden' })
    }
    await next()
  }
 
// 第三层：权限检查
const requirePermission = (permission: string) =>
  async (c: Context, next: Next) => {
    const user = c.get('jwtPayload')
    const hasPermission = await checkPermission(user.id, permission)
    if (!hasPermission) {
      throw new HTTPException(403, { message: 'No permission' })
    }
    await next()
  }
 
// 使用
app.post('/articles',
  requireRole('editor'),
  requirePermission('article:create'),
  async (c) => {
    // 创建文章
  }
)

// ❌ 错误
if (!token) return c.json({ error: 'Forbidden' }, 403)
 
// ✅ 正确
if (!token) return c.json({ error: 'Unauthorized' }, 401)

// ❌ 授权和业务逻辑混在一起
app.post('/articles', async (c) => {
  const user = c.get('user')
 
  // 先检查权限
  if (user.role !== 'editor') {
    return c.json({ error: 'Forbidden' }, 403)
  }
 
  // 再执行业务
  await createArticle(...)
})

// ✅ 授权和业务分离
app.post('/articles', requireRole('editor'), async (c) => {
  await createArticle(...)
})

// ❌ 没有租户隔离
app.get('/conversations', async (c) => {
  const conversations = await db.select().from(conversations)
  // 返回所有租户的数据！
})
 
// ✅ 租户隔离
app.get('/conversations', async (c) => {
  const tenantId = c.get('tenantId')
  const conversations = await db
    .select()
    .from(conversations)
    .where(eq(conversations.tenantId, tenantId))
})