From f8a5e274eeda1f3b5fd5d1d4e3ab5015cac593aa Mon Sep 17 00:00:00 2001
From: renzhiyuan <465386466@qq.com>
Date: Fri, 24 Jul 2026 18:13:54 +0800
Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E6=96=87=E4=BB=B6:=20xy=5Fsh?=
 =?UTF-8?q?/internal/middleware/middleware.go?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 xy_sh/internal/middleware/middleware.go | 54 +++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 xy_sh/internal/middleware/middleware.go

diff --git a/xy_sh/internal/middleware/middleware.go b/xy_sh/internal/middleware/middleware.go
new file mode 100644
index 0000000..6678e7e
--- /dev/null
+++ b/xy_sh/internal/middleware/middleware.go
@@ -0,0 +1,54 @@
+package middleware
+
+import (
+	"log"
+
+	"github.com/gofiber/fiber/v2"
+
+	"xy_sh/pkg/crypto"
+)
+
+// SM3Salt 全局SM3盐值（由config初始化时注入）
+var SM3Salt []byte
+
+// SM4Key 全局SM4密钥（由config初始化时注入）
+var SM4Key []byte
+
+// AuthMiddleware 签名验证中间件
+// 验证请求头中的 timestamp 和 sign
+func AuthMiddleware() fiber.Handler {
+	return func(c *fiber.Ctx) error {
+		timestamp := c.Get("timestamp")
+		sign := c.Get("sign")
+
+		if timestamp == "" || sign == "" {
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+				"code": -1,
+				"msg":  "缺少timestamp或sign请求头",
+			})
+		}
+
+		// 读取请求体中的 encryptedData
+		var body struct {
+			EncryptedData string `json:"encryptedData"`
+		}
+		if err := c.BodyParser(&body); err != nil {
+			return c.Status(fiber.StatusBadRequest).JSON(fiber.Map{
+				"code": -1,
+				"msg":  "请求体解析失败",
+			})
+		}
+
+		// 验证签名
+		if !crypto.VerifySign(timestamp, body.EncryptedData, sign, SM3Salt) {
+			log.Printf("[中间件] 签名验证失败: timestamp=%s, sign=%s", timestamp, sign)
+			return c.Status(fiber.StatusUnauthorized).JSON(fiber.Map{
+				"code": -1,
+				"msg":  "签名验证失败",
+			})
+		}
+
+		log.Printf("[中间件] 签名验证通过: timestamp=%s", timestamp)
+		return c.Next()
+	}
+}
\ No newline at end of file