feat: 支持从 Cloudflare Access JWT 令牌中解析用户邮箱

src/hooks.server.ts

@@ -4,8 +4,26 @@ import { dev } from '$app/environment';
 export const handle: Handle = async ({ event, resolve }) => {
 	// 拦截 /admin 路由
 	if (event.url.pathname.startsWith('/admin')) {
-		// 读取 Cloudflare Access 提供的 Header
+		// 优先尝试读取常规 Header (旧版或回源时存在)
-		const userEmail = event.request.headers.get('cf-access-authenticated-user-email');
+		let userEmail = event.request.headers.get('cf-access-authenticated-user-email');
+
+		// 针对 Cloudflare Pages，从 JWT Assertion 中解析邮箱
+		const jwt = event.request.headers.get('cf-access-jwt-assertion');
+		if (!userEmail && jwt) {
+			try {
+				const payloadBase64Url = jwt.split('.')[1];
+				// Base64URL 转 Base64
+				const base64 = payloadBase64Url.replace(/-/g, '+').replace(/_/g, '/');
+				// atob 在 Cloudflare Workers/Pages 中原生支持
+				const payloadString = atob(base64);
+				const payload = JSON.parse(payloadString);
+				if (payload && payload.email) {
+					userEmail = payload.email;
+				}
+			} catch (e) {
+				console.error('Failed to parse CF Access JWT', e);
+			}
+		}
 
 		// 本地开发环境通过 $app/environment 的 dev 变量来判断
 		const isLocalDev = dev;