update backend p20.1 p20.2

backend/app/Middleware/AuthMiddleware.php

@@ -77,6 +77,11 @@ class AuthMiddleware implements MiddlewareInterface
             ])->withStatus(500);
         }
 
+        // 统一存入 request attribute
+        $request = $request->withAttribute('auth_user', $user);
+        $request = $request->withAttribute('auth_type', 'jwt');
+        \Hyperf\Context\Context::set(ServerRequestInterface::class, $request);
+
         return $handler->handle($request);
     }
 
@@ -121,11 +126,9 @@ class AuthMiddleware implements MiddlewareInterface
         $api_key->last_used_at = \Carbon\Carbon::now();
         $api_key->save();
 
-        // 通过 JWT guard 登录用户，生成 token 并注入请求头，使后续代码可通过 auth->guard('jwt')->user() 获取用户
-        $token = $this->auth->guard('jwt')->login($user);
-        $request = $request->withHeader('Authorization', 'Bearer ' . $token);
-
-        // 将带 Authorization 头的新请求写回协程 Context，确保 JwtGuard 代理对象能读到
+        // 将用户存入 request attribute（不再生成临时 JWT）
+        $request = $request->withAttribute('auth_user', $user);
+        $request = $request->withAttribute('auth_type', 'api_key');
         \Hyperf\Context\Context::set(ServerRequestInterface::class, $request);
 
         return $handler->handle($request);

backend/app/Middleware/PermissionMiddleware.php

@@ -31,8 +31,8 @@ class PermissionMiddleware implements MiddlewareInterface
 
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
-        // 获取已认证用户（由 AuthMiddleware 预先认证）
-        $user = $this->auth->guard('jwt')->user();
+        // 获取已认证用户（优先从 attribute 获取，兼容 JWT guard）
+        $user = $request->getAttribute('auth_user') ?? $this->auth->guard('jwt')->user();
         if (!$user) {
             return $this->forbiddenResponse('用户认证异常');
         }

backend/app/Middleware/RequestLogMiddleware.php

@@ -32,7 +32,9 @@ class RequestLogMiddleware implements MiddlewareInterface
         // 在父协程中提取 user_id（子协程不继承 Swoole Context）
         $user_id = null;
         try {
-            $user_id = $this->auth->guard('jwt')->user()?->getId();
+            $ctx_request = \Hyperf\Context\Context::get(\Psr\Http\Message\ServerRequestInterface::class);
+            $auth_user = $ctx_request?->getAttribute('auth_user');
+            $user_id = $auth_user?->getId() ?? $this->auth->guard('jwt')->user()?->getId();
         } catch (\Throwable) {
             // 未认证请求，user_id 保持 null
         }