Update verify.js

verify.js

@@ -1,16 +1,14 @@
 // verify.js
 
-const manager = require('../lib/manager'); // 假设 ../lib/manager 路径相对于此文件是正确的
+const manager = require('../lib/manager');
 
 const verify = async (req, res, next) => {
   console.log('[AUTH_MIDDLEWARE] Received request. Verifying API key...');
-  console.log(`[AUTH_MIDDLEWARE] Request Headers: ${JSON.stringify(req.headers)}`); // 打印所有请求头，方便调试
+  console.log(`[AUTH_MIDDLEWARE] Request Headers: ${JSON.stringify(req.headers)}`);
 
-  // 从 x-api-key 请求头获取 token
-  // HTTP headers are case-insensitive, but Node.js's req.headers object keys are lowercased.
-  const apiKey = req.headers['x-api-key'];
+  const apiKeyHeaderValue = req.headers['x-api-key']; // Get the raw header value
 
-  if (!apiKey) {
+  if (!apiKeyHeaderValue) {
     console.log('[AUTH_MIDDLEWARE] Unauthorized: x-api-key header is missing.');
     return res.status(401).json({
       error: {
@@ -21,9 +19,19 @@ const verify = async (req, res, next) => {
     });
   }
 
-  console.log(`[AUTH_MIDDLEWARE] Received x-api-key: "${apiKey}"`);
+  let apiKey = apiKeyHeaderValue; // Initialize apiKey with the full header value
+
+  // Check if the header value starts with "Bearer " (case-insensitive) and remove it
+  if (apiKeyHeaderValue.toLowerCase().startsWith('bearer ')) {
+    apiKey = apiKeyHeaderValue.substring(7); // "Bearer " is 7 characters long
+    console.log(`[AUTH_MIDDLEWARE] "Bearer " prefix found and stripped from x-api-key. Effective API key: "${apiKey}"`);
+  } else {
+    console.log(`[AUTH_MIDDLEWARE] No "Bearer " prefix found in x-api-key. Using as is: "${apiKeyHeaderValue}"`);
+    // apiKey remains apiKeyHeaderValue
+  }
+
+  console.log(`[AUTH_MIDDLEWARE] Processed x-api-key for comparison: "${apiKey}"`);
 
-  // 从环境变量获取预期的 AUTH_TOKEN
   const expectedToken = process.env.AUTH_TOKEN;
 
   if (!expectedToken) {
@@ -65,9 +73,7 @@ const verify = async (req, res, next) => {
       });
     }
   } else {
-    // 为了安全，不要在日志中直接打印预期的 token，除非在非常受控的调试环境中
-    // 可以打印接收到的 token 和预期 token 的部分信息（例如长度或哈希值）进行比较
-    console.warn(`[AUTH_MIDDLEWARE] Unauthorized: Invalid API key. Received: "${apiKey}", Expected token (length): ${expectedToken.length}`);
+    console.warn(`[AUTH_MIDDLEWARE] Unauthorized: Invalid API key. Received for comparison: "${apiKey}", Expected token (from env, length): ${expectedToken.length}`);
     return res.status(401).json({
       error: {
         message: 'Unauthorized: Invalid API Key.',