杭州企业知识库对接业务系统的坑 AI

function auth(req, res, next) {
  const h = req.headers.authorization || "";
  const token = h.startsWith("Bearer ") ? h.slice(7) : null;
  if (!token) return res.sendStatus(401);
  const payload = verifyJwt(token); // {sub, brands:[...]}
  const bid = req.query.brandId;
  if (!payload.brands.includes(bid)) return res.sendStatus(403);
  req.user = payload;
  next();
}