chore: establish local platform baseline

internal/httpapi/device_auth.go

@@ -0,0 +1,33 @@
+package httpapi
+
+import (
+	"errors"
+	"net/http"
+
+	"data-terminal-cloud/internal/deviceauth"
+)
+
+type DeviceRequestVerifier interface {
+	Verify(*http.Request) (deviceauth.Identity, error)
+}
+
+func DeviceAuth(verifier DeviceRequestVerifier, next http.Handler) http.Handler {
+	return http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+		identity, err := verifier.Verify(request)
+		if err != nil {
+			if errors.Is(err, deviceauth.ErrCredentialsMissing) ||
+				errors.Is(err, deviceauth.ErrCredentialInvalid) ||
+				errors.Is(err, deviceauth.ErrDeviceInactive) ||
+				errors.Is(err, deviceauth.ErrRequestExpired) ||
+				errors.Is(err, deviceauth.ErrReplayDetected) {
+				WriteError(writer, request, http.StatusUnauthorized, "DEVICE_AUTHENTICATION_FAILED", "设备身份验证失败")
+				return
+			}
+			WriteAPIError(writer, request, http.StatusServiceUnavailable, Error{
+				Code: "DEVICE_AUTHENTICATION_UNAVAILABLE", Message: "设备身份服务暂时不可用", Retryable: true,
+			})
+			return
+		}
+		next.ServeHTTP(writer, request.WithContext(deviceauth.WithIdentity(request.Context(), identity)))
+	})
+}