From b749a50dc01a0c12d05dc305ee8c36c1b60df63e Mon Sep 17 00:00:00 2001
From: seaHi <me@seahi.me>
Date: Wed, 29 Jul 2026 11:21:38 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E6=94=AF=E6=8C=81=E4=BB=8E=20Cloudflar?=
 =?UTF-8?q?e=20Access=20JWT=20=E4=BB=A4=E7=89=8C=E4=B8=AD=E8=A7=A3?=
 =?UTF-8?q?=E6=9E=90=E7=94=A8=E6=88=B7=E9=82=AE=E7=AE=B1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/hooks.server.ts | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/hooks.server.ts b/src/hooks.server.ts
index d9cfcc7..e26f36b 100644
--- a/src/hooks.server.ts
+++ b/src/hooks.server.ts
@@ -4,8 +4,26 @@ import { dev } from '$app/environment';
 export const handle: Handle = async ({ event, resolve }) => {
 	// 拦截 /admin 路由
 	if (event.url.pathname.startsWith('/admin')) {
-		// 读取 Cloudflare Access 提供的 Header
-		const userEmail = event.request.headers.get('cf-access-authenticated-user-email');
+		// 优先尝试读取常规 Header (旧版或回源时存在)
+		let userEmail = event.request.headers.get('cf-access-authenticated-user-email');
+
+		// 针对 Cloudflare Pages，从 JWT Assertion 中解析邮箱
+		const jwt = event.request.headers.get('cf-access-jwt-assertion');
+		if (!userEmail && jwt) {
+			try {
+				const payloadBase64Url = jwt.split('.')[1];
+				// Base64URL 转 Base64
+				const base64 = payloadBase64Url.replace(/-/g, '+').replace(/_/g, '/');
+				// atob 在 Cloudflare Workers/Pages 中原生支持
+				const payloadString = atob(base64);
+				const payload = JSON.parse(payloadString);
+				if (payload && payload.email) {
+					userEmail = payload.email;
+				}
+			} catch (e) {
+				console.error('Failed to parse CF Access JWT', e);
+			}
+		}
 
 		// 本地开发环境通过 $app/environment 的 dev 变量来判断
 		const isLocalDev = dev;