From e03a7a141cfbeefb1f7366598b21851bfd8bd0e0 Mon Sep 17 00:00:00 2001
From: wuxu <aina360tian@gmail.com>
Date: Sat, 27 Jun 2026 16:35:58 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=8F=96=E6=B6=88=20Web=20=E6=8C=91?=
 =?UTF-8?q?=E6=88=98=E5=A4=B4=E9=89=B4=E6=9D=83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 package-lock.json |  3 +--
 package.json      |  3 +--
 public/admin.html |  2 +-
 src/api.js        | 40 +++++++++-------------------------------
 4 files changed, 12 insertions(+), 36 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 1a64f4a..2dbd2de 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -13,7 +13,6 @@
         "axios": "^1.6.2",
         "dotenv": "^16.3.1",
         "express": "^4.18.2",
-        "express-basic-auth": "^1.2.1",
         "node-pdu": "^2.1.2",
         "nodemailer": "^6.9.7",
         "serialport": "^12.0.0",
@@ -2045,4 +2044,4 @@
       }
     }
   }
-}
+}
\ No newline at end of file
diff --git a/package.json b/package.json
index ec76498..23bbcf2 100644
--- a/package.json
+++ b/package.json
@@ -23,7 +23,6 @@
     "@serialport/parser-readline": "^12.0.0",
     "node-pdu": "^2.1.2",
     "express": "^4.18.2",
-    "express-basic-auth": "^1.2.1",
     "nodemailer": "^6.9.7",
     "axios": "^1.6.2",
     "winston": "^3.11.0",
@@ -32,4 +31,4 @@
   "devDependencies": {
     "nodemon": "^3.0.2"
   }
-}
+}
\ No newline at end of file
diff --git a/public/admin.html b/public/admin.html
index 861eb71..17d769a 100644
--- a/public/admin.html
+++ b/public/admin.html
@@ -411,7 +411,7 @@
         </svg>
         <span>SMS Gateway</span>
       </span>
-      <span class="footer__meta">© <span id="footerYear">2026</span> · Basic Auth protected · Built on Node.js +
+      <span class="footer__meta">© <span id="footerYear">2026</span> · Token protected · Built on Node.js +
         ML307A</span>
     </div>
   </footer>
diff --git a/src/api.js b/src/api.js
index c56f0eb..853dfbd 100644
--- a/src/api.js
+++ b/src/api.js
@@ -50,7 +50,7 @@ class APIServer {
     // JSON解析
     this.app.use(express.json());
 
-    // Web Token认证，API保留Basic Auth兼容
+    // Web Token认证
     this.app.use((req, res, next) => {
       this.authenticateRequest(req, res, next);
     });
@@ -75,22 +75,23 @@ class APIServer {
       return next();
     }
 
-    if (this.isWebRoute(req) && this.getConfiguredWebToken()) {
-      return this.sendTokenGate(res);
-    }
+    if (this.isWebRoute(req)) {
+      const webToken = this.getConfiguredWebToken();
+      if (webToken) {
+        return this.sendTokenGate(res);
+      }
 
-    if (this.hasValidBasicAuth(req)) {
-      return next();
+      return res.status(401).send('未配置 webToken');
     }
 
     if (req.path.startsWith('/api/')) {
       return res.status(401).json({
         success: false,
-        error: this.getConfiguredWebToken() ? '需要有效token或Basic Auth' : '需要Basic Auth'
+        error: this.getConfiguredWebToken() ? '需要有效token' : '未配置webToken'
       });
     }
 
-    return this.sendBasicAuthChallenge(res);
+    return res.status(401).send(this.getConfiguredWebToken() ? '需要有效token' : '未配置 webToken');
   }
 
   getConfiguredWebToken() {
@@ -143,24 +144,6 @@ class APIServer {
     return `${url.pathname}${url.search}`;
   }
 
-  hasValidBasicAuth(req) {
-    const auth = req.get('authorization') || '';
-    if (!auth.startsWith('Basic ')) {
-      return false;
-    }
-
-    const decoded = Buffer.from(auth.slice(6), 'base64').toString('utf8');
-    const separatorIndex = decoded.indexOf(':');
-    if (separatorIndex === -1) {
-      return false;
-    }
-
-    const username = decoded.slice(0, separatorIndex);
-    const password = decoded.slice(separatorIndex + 1);
-    return this.safeEqual(username, this.config.api.auth.username) &&
-      this.safeEqual(password, this.config.api.auth.password);
-  }
-
   safeEqual(actual, expected) {
     const actualBuffer = Buffer.from(String(actual));
     const expectedBuffer = Buffer.from(String(expected));
@@ -176,11 +159,6 @@ class APIServer {
     return req.path === '/' || req.path === '/admin' || req.path.startsWith('/assets/');
   }
 
-  sendBasicAuthChallenge(res) {
-    res.set('WWW-Authenticate', 'Basic realm="SMS Gateway"');
-    return res.status(401).send('Authentication required');
-  }
-
   sendTokenGate(res) {
     res.set('Cache-Control', 'no-store');
     return res.status(401).type('html').send(`<!doctype html>