商品白名单

server/dukang-api/src/common/guards/optional-jwt-auth.guard.ts

@@ -7,6 +7,15 @@ import { JwtService } from '@nestjs/jwt';
 import { CLIENT_APP_ACTOR_MAP, ClientApp } from '@dukang/shared-types';
 import type { AuthUser } from './jwt-auth.guard';
 
+/** C 端 H5 / 小程序同属 USER，目录白名单只认 actorId→手机号，允许端间 token 兼容 */
+const USER_CLIENT_APPS = new Set<ClientApp>([ClientApp.USER_MINI, ClientApp.USER_H5]);
+
+function clientAppCompatible(headerApp: ClientApp | undefined, payloadApp: unknown): boolean {
+  if (!headerApp || payloadApp == null) return false;
+  if (headerApp === payloadApp) return true;
+  return USER_CLIENT_APPS.has(headerApp) && USER_CLIENT_APPS.has(payloadApp as ClientApp);
+}
+
 @Injectable()
 export class OptionalJwtAuthGuard implements CanActivate {
   constructor(private readonly jwtService: JwtService) {}
@@ -20,7 +29,7 @@ export class OptionalJwtAuthGuard implements CanActivate {
     try {
       const payload = this.jwtService.verify(auth.slice(7));
       const clientApp = req.headers['x-client-app'] as ClientApp;
-      if (!clientApp || payload.clientApp !== clientApp) return true;
+      if (!clientAppCompatible(clientApp, payload.clientApp)) return true;
       const expectedActor = CLIENT_APP_ACTOR_MAP[clientApp];
       if (payload.actorType !== expectedActor) return true;
       req.user = {