我正在处理一个需要实现身份验证和授权的项目。现在，我目前陷入了从一个普通的API授权，而不是为每个API编写公共代码。
例如，我正在获取一些数据，如下所示：

import prisma from '@/lib/prisma';
import { NextRequest, NextResponse } from 'next/server';
import { verifyJwt } from '../../../lib/jwt';

export async function GET(request: NextRequest) {
  const accessToken = request.headers.get("authorization")?.split(' ')[1];

  if (!accessToken || !verifyJwt(accessToken)) {
    return NextResponse.json(
      {
        message: "Unauthorized",
      },
      {
        status: 401,
      }
    );
  }

  try {
    const posts = await prisma.post.findMany();
    return NextResponse.json({ data: posts }, { status: 200 });
  } catch (error: any) {
    return NextResponse.json({ message: error.toString() }, { status: 500 });
  }
}

正如你在上面的代码中看到的，在获取一些博客文章之前，我需要检查授权。那么，我如何从一个普通的API编写下面的代码呢？

const accessToken = request.headers.get("authorization")?.split(' ')[1];

if (!accessToken || !verifyJwt(accessToken)) {
  return NextResponse.json(
    {
      message: "Unauthorized",
    },
    {
      status: 401, // token not found
    }
  );
}

next-auth.ts

import { NextAuthOptions } from "next-auth";
import CredentialsProvider from "next-auth/providers/credentials";

export const authConfig: NextAuthOptions = {
  providers: [
    CredentialsProvider({
      id: 'credentials',
      name: 'Credentials',
      credentials: {
        email: { label: "Email", type: "text", placeholder: "jsmith@email.com" },
        password: { label: "Password", type: "password" }
      },
      async authorize(credentials, req) {
        if (!credentials
          || !credentials.email
          || !credentials.password
        ) {
          return null;
        }

        const res = await fetch("http://localhost:3000/api/auth/token", {
          method: "POST",
          headers: {
            "Content-Type": "application/json",
          },
          body: JSON.stringify({
            username: credentials?.email,
            password: credentials?.password,
          }),
        });

        const user = await res.json();

        if (user && user?.data) {
          return user.data;
        } else {
          return null;
        }
      }
    }),
  ],
  session: {
    strategy: "jwt",
    maxAge: 60 * 60 * 24 * 7, // 7 days
  },
  pages: {
    signIn: '/login',
    error: '/login',
  },
  callbacks: {
    async jwt({ token, user }) {
      if (user) {
        return { ...token, ...user };
      }
      return token;
    },

    async session({ session, token }) {
      if (token) {
        session.user = token;
      }
      return session;
    },
  },
}

jwt.ts

import jwt, { JwtPayload } from "jsonwebtoken";

const secretKey = process.env.JWT_SECRET || "";

interface SignOption {
  expiresIn?: string | number;
  issuer?: string;
}

const ACCESS_TOKEN_SIGN_OPTION = {
  expiresIn: "1h",
  issuer: 'abcsoftware',
};

const REFRESH_TOKEN_SIGN_OPTION = {
  expiresIn: "7d",
  issuer: 'abcsoftware',
};

export function signJwtAccessToken(
  payload: JwtPayload,
  options: SignOption = ACCESS_TOKEN_SIGN_OPTION
) {
  const token = jwt.sign(payload, secretKey, options);
  return token;
}

export function signJwtRefreshToken(
  payload: JwtPayload,
  options: SignOption = REFRESH_TOKEN_SIGN_OPTION
) {
  const token = jwt.sign(payload, secretKey, options);
  return token;
}

// Verify authorization
export function verifyJwt(token: string) {
  try {
    const decoded = jwt.verify(token, secretKey!);
    return decoded as JwtPayload;
  } catch (error: any) {
    console.log(error);
    return null;
  }
}

下一个版本是
13.4.6
下一个验证版本为
4.22.1
我用的是Next.js的App Router
先谢谢你了！