server: Go 服务器（REST+WSS 网关+JWT+Argon2+配对+素材直链+任务状态机）；修复并发下线 send-on-closed-channel、下发查询 SQL 优先级、配对码原子占用、上传体积上限、JWT 默认密钥告警

server/internal/api/middleware/auth.go

@@ -0,0 +1,47 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"everypublish/server/internal/api/response"
+	"everypublish/server/internal/auth"
+	"everypublish/server/internal/config"
+)
+
+// AuthRequired 校验访问令牌并把声明写入上下文
+func AuthRequired(cfg *config.Config) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		header := c.GetHeader("Authorization")
+		if !strings.HasPrefix(header, "Bearer ") {
+			response.Fail(c, http.StatusUnauthorized, 1002, "未登录或令牌缺失")
+			c.Abort()
+			return
+		}
+		claims, err := auth.ParseAccess(cfg.JWTSecret, strings.TrimPrefix(header, "Bearer "))
+		if err != nil {
+			response.Fail(c, http.StatusUnauthorized, 1002, "令牌无效或已过期")
+			c.Abort()
+			return
+		}
+		c.Set("uid", claims.UID)
+		c.Set("wsid", claims.WorkspaceID)
+		c.Set("role", claims.Role)
+		c.Set("mrole", claims.MemberRole)
+		c.Next()
+	}
+}
+
+// AdminRequired 平台管理员守卫（D7 挂载 admin 路由）
+func AdminRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if c.GetString("role") != "admin" {
+			response.Fail(c, http.StatusForbidden, 1003, "无平台管理权限")
+			c.Abort()
+			return
+		}
+		c.Next()
+	}
+}