feat(M02-D): 完成用户与员工权限管理

backend/src/auth/authenticate.ts

@@ -0,0 +1,25 @@
+import type { AuthRepository, AuthSession } from './auth-repository.js';
+import { verifyAccessToken } from './jwt.js';
+
+export interface AuthenticatedRequest {
+  sessionId: string;
+  session: AuthSession;
+}
+
+export async function authenticateAccessToken(
+  authorization: string | undefined,
+  repository: Pick<AuthRepository, 'validateSession'>,
+  jwtSecret: string
+): Promise<AuthenticatedRequest | null> {
+  if (!authorization?.startsWith('Bearer ')) return null;
+  try {
+    const claims = verifyAccessToken(authorization.slice(7), jwtSecret);
+    const session = await repository.validateSession(claims.sid, claims.tid, claims.sub);
+    if (!session || session.platformAppId !== claims.aid || session.user.roleVersion !== claims.rv) {
+      return null;
+    }
+    return { sessionId: claims.sid, session };
+  } catch {
+    return null;
+  }
+}