// 统一的权限验证模式
const payload = await verifyHeaderCookie(request)
if (!payload) {
  return NextResponse.json({ code: 401, message: '请先登录' })
}
if (payload.role < requiredRole) {
  return NextResponse.json({ code: 403, message: '权限不足' })
}

// 在 middleware.ts 中配置
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Content-Security-Policy: [详细CSP策略]

// 平衡安全性和功能性的CSP配置
script-src: 'self' 'unsafe-inline' 'unsafe-eval' https://www.clarity.ms https://*.clarity.ms
script-src-elem: 'self' 'unsafe-inline' https://www.clarity.ms https://*.clarity.ms
connect-src: 'self' https://api.vndb.org https://*.vndb.org https://www.clarity.ms https://*.clarity.ms wss:
img-src: 'self' data: https: blob:
media-src: 'self' data: blob:
worker-src: 'self' blob:
child-src: 'self' blob:

Access-Control-Allow-Origin: [配置的域名]
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Headers: Content-Type, Authorization, Cookie
Access-Control-Allow-Credentials: true

console.log(`用户 ${payload.name}(ID:${payload.uid}) 执行了 ${action} 操作`)

// config/rateLimit.ts
LOGIN: { windowMs: 15min, maxAttempts: 10, blockDuration: 15min }
REGISTER: { windowMs: 1hour, maxAttempts: 3, blockDuration: 1hour }
CAPTCHA: { windowMs: 5min, maxAttempts: 10, blockDuration: 10min }