From 9a7c82a71e3ca00f8cdd61f9b854e87464982ba1 Mon Sep 17 00:00:00 2001
From: okatu-loli <CN_QianShi@hotmail.com>
Date: Fri, 29 Aug 2025 13:31:44 +0800
Subject: [PATCH] feat(auth): Optimized device session handling logic

- Introduced middleware to handle device sessions
- Changed `handleSession` to `HandleSession` in multiple places in `auth.go` to maintain consistent naming
- Updated response structure to return `device_key` and `token`
---
 server/handles/auth.go     | 8 +++++++-
 server/middlewares/auth.go | 9 +++++----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/server/handles/auth.go b/server/handles/auth.go
index 30714f65..8c7d7d9f 100644
--- a/server/handles/auth.go
+++ b/server/handles/auth.go
@@ -15,6 +15,7 @@ import (
 	"github.com/alist-org/alist/v3/internal/session"
 	"github.com/alist-org/alist/v3/internal/setting"
 	"github.com/alist-org/alist/v3/server/common"
+	"github.com/alist-org/alist/v3/server/middlewares"
 	"github.com/gin-gonic/gin"
 	"github.com/pquerna/otp/totp"
 )
@@ -82,13 +83,18 @@ func loginHash(c *gin.Context, req *LoginReq) {
 			return
 		}
 	}
+	// generate device session
+	if !middlewares.HandleSession(c, user) {
+		return
+	}
 	// generate token
 	token, err := common.GenerateToken(user)
 	if err != nil {
 		common.ErrorResp(c, err, 400, true)
 		return
 	}
-	common.SuccessResp(c, gin.H{"token": token})
+	key := c.GetString("device_key")
+	common.SuccessResp(c, gin.H{"token": token, "device_key": key})
 	loginCache.Del(ip)
 }
 
diff --git a/server/middlewares/auth.go b/server/middlewares/auth.go
index 72eaefe6..714c1154 100644
--- a/server/middlewares/auth.go
+++ b/server/middlewares/auth.go
@@ -26,7 +26,7 @@ func Auth(c *gin.Context) {
 			c.Abort()
 			return
 		}
-		if !handleSession(c, admin) {
+		if !HandleSession(c, admin) {
 			return
 		}
 		log.Debugf("use admin token: %+v", admin)
@@ -54,7 +54,7 @@ func Auth(c *gin.Context) {
 			}
 			guest.RolesDetail = roles
 		}
-		if !handleSession(c, guest) {
+		if !HandleSession(c, guest) {
 			return
 		}
 		log.Debugf("use empty token: %+v", guest)
@@ -93,14 +93,15 @@ func Auth(c *gin.Context) {
 		}
 		user.RolesDetail = roles
 	}
-	if !handleSession(c, user) {
+	if !HandleSession(c, user) {
 		return
 	}
 	log.Debugf("use login token: %+v", user)
 	c.Next()
 }
 
-func handleSession(c *gin.Context, user *model.User) bool {
+// HandleSession verifies device sessions and stores context values.
+func HandleSession(c *gin.Context, user *model.User) bool {
 	clientID := c.GetHeader("Client-Id")
 	if clientID == "" {
 		clientID = c.Query("client_id")