nuxt-app/server/utils/auth-api-routes.ts

type RouteRule = {
  path: string;
  methods?: string[];
};

const API_ALLOWLIST: RouteRule[] = [
  { path: "/api/auth/captcha", methods: ["GET"] },
  { path: "/api/auth/login", methods: ["POST"] },
  { path: "/api/auth/register", methods: ["POST"] },
  /** 访客可读：无 Cookie 时不查库，用于客户端与 SSR 会话对齐 */
  { path: "/api/auth/session", methods: ["GET"] },
  { path: "/api/config/global", methods: ["GET"] },
];

/** 公开 API 以只读为主，需配合服务端校验与限流 */
export function isPublicApiPath(path: string, method?: string) {
  if (!path.startsWith("/api/public/")) {
    return false;
  }
  const requestMethod = method?.toUpperCase() ?? "GET";
  if (requestMethod === "GET") {
    return true;
  }
  return false;
}

export function isAllowlistedApiPath(path: string, method?: string) {
  if (isPublicApiPath(path, method)) {
    return true;
  }
  const requestMethod = method?.toUpperCase() ?? "GET";
  return API_ALLOWLIST.some((rule) => {
    if (rule.path !== path) {
      return false;
    }
    if (!rule.methods || rule.methods.length === 0) {
      return true;
    }
    return rule.methods.includes(requestMethod);
  });
}