nuxt4-demo/server/utils/auth-api-routes.ts

type RouteRule = {
  path: string;
  methods?: string[];
};

const API_ALLOWLIST: RouteRule[] = [
  { path: "/api/auth/login", methods: ["POST"] },
  { path: "/api/auth/register", methods: ["POST"] },
  { path: "/api/config/global", methods: ["GET"] },
];

/** 公开 API 只读，避免未认证写操作 */
export function isPublicApiPath(path: string, method?: string) {
  if (!path.startsWith("/api/public/")) {
    return false;
  }
  const requestMethod = method?.toUpperCase() ?? "GET";
  return requestMethod === "GET";
}

export function isAllowlistedApiPath(path: string, method?: string) {
  if (isPublicApiPath(path, method)) {
    return true;
  }
  const requestMethod = method?.toUpperCase() ?? "GET";
  return API_ALLOWLIST.some((rule) => {
    if (rule.path !== path) {
      return false;
    }
    if (!rule.methods || rule.methods.length === 0) {
      return true;
    }
    return rule.methods.includes(requestMethod);
  });
}