Authorization: Bearer YOUR_TOKEN_HERE

X-API-Key: YOUR_API_KEY_HERE

?token=YOUR_TOKEN_HERE

# Registry authentication token (可选)
# 如果不设置，注册表将是公开的
REGISTRY_TOKEN=your_secret_token_here

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

openssl rand -hex 32

uuidgen

import { NextRequest, NextResponse } from "next/server";

export function middleware(request: NextRequest) {
  // 只拦截 /r/ 路径下的请求（registry 静态文件）
  if (request.nextUrl.pathname.startsWith("/r/")) {
    // 检查是否配置了认证令牌
    const validToken = process.env.REGISTRY_TOKEN;

    // 如果未配置 REGISTRY_TOKEN，则不需要认证，直接放行
    if (!validToken) {
      return NextResponse.next();
    }

    // 如果配置了 REGISTRY_TOKEN，则需要进行认证
    // 获取认证令牌
    const authHeader = request.headers.get("authorization");
    const bearerToken = authHeader?.replace("Bearer ", "");
    const apiKey = request.headers.get("x-api-key");
    const queryToken = request.nextUrl.searchParams.get("token");

    const token = bearerToken || apiKey || queryToken;

    // 检查令牌是否提供
    if (!token) {
      return NextResponse.json(
        {
          error: "Unauthorized",
          message: "认证令牌缺失"
        },
        { status: 401 }
      );
    }

    // 验证令牌
    if (token !== validToken) {
      return NextResponse.json(
        {
          error: "Unauthorized",
          message: "令牌无效"
        },
        { status: 401 }
      );
    }

    // 令牌有效，允许访问
    return NextResponse.next();
  }

  // 其他路径不需要认证
  return NextResponse.next();
}

export const config = {
  matcher: ["/r/:path*"], // 匹配所有 /r/ 开头的路径
};

import { NextRequest, NextResponse } from "next/server";

export async function GET(
  request: NextRequest,
  { params }: { params: { name: string } }
) {
  // 从 Authorization 请求头获取 Bearer token
  const authHeader = request.headers.get("authorization");
  const bearerToken = authHeader?.replace("Bearer ", "");

  // 或从 X-API-Key 请求头获取
  const apiKey = request.headers.get("x-api-key");

  // 或从查询参数获取
  const queryToken = request.nextUrl.searchParams.get("token");

  const token = bearerToken || apiKey || queryToken;

  // 验证令牌
  if (!token) {
    return NextResponse.json(
      { error: "Unauthorized", message: "未提供认证令牌" },
      { status: 401 }
    );
  }

  if (!isValidToken(token)) {
    return NextResponse.json(
      { error: "Unauthorized", message: "无效的认证令牌" },
      { status: 401 }
    );
  }

  // 检查访问权限
  if (!hasAccessToComponent(token, params.name)) {
    return NextResponse.json(
      { error: "Forbidden", message: "您没有权限访问此组件" },
      { status: 403 }
    );
  }

  // 返回组件内容
  const component = await getComponent(params.name);
  return NextResponse.json(component);
}

function isValidToken(token: string): boolean {
  return token === process.env.REGISTRY_TOKEN;
}

{
  "registries": {
    "@secure": "https://registry.example.com/{name}.json" // ✅ 推荐
    // "@insecure": "http://registry.example.com/{name}.json" // ❌ 避免
  }
}

import { ratelimit } from '@/lib/ratelimit';

export async function GET(request: NextRequest) {
  const ip = request.ip || 'anonymous';
  const { success, limit, reset, remaining } = await ratelimit.limit(ip);

  if (!success) {
    return NextResponse.json(
      { error: "Too Many Requests" },
      {
        status: 429,
        headers: {
          'X-RateLimit-Limit': limit.toString(),
          'X-RateLimit-Remaining': remaining.toString(),
          'X-RateLimit-Reset': reset.toString(),
        }
      }
    );
  }

  // 继续处理请求...
}

function logAuthFailure(token: string, componentName: string, ip: string) {
  console.warn('Authentication failed', {
    component: componentName,
    ip,
    timestamp: new Date().toISOString(),
    // 不要记录完整令牌
    tokenPrefix: token.substring(0, 8) + '...'
  });
}