Initial project import

backend/MiaoJiZhang.Api/Services/AdminAuthAttribute.cs

@@ -0,0 +1,24 @@
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace MiaoJiZhang.Api.Services;
+
+/// <summary>
+/// 管理后台鉴权：请求头 X-Admin-Key 与 appsettings.Admin:Key 匹配即可。
+/// 仅内部使用，不依赖 JWT/用户体系。
+/// </summary>
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+public class AdminAuthAttribute : Attribute, IAuthorizationFilter
+{
+    public void OnAuthorization(AuthorizationFilterContext context)
+    {
+        var config = context.HttpContext.RequestServices.GetRequiredService<IConfiguration>();
+        var key = config["Admin:Key"];
+        if (string.IsNullOrWhiteSpace(key) ||
+            !context.HttpContext.Request.Headers.TryGetValue("X-Admin-Key", out var provided) ||
+            provided != key)
+        {
+            context.Result = new UnauthorizedObjectResult(new { error = "admin_key_required", message = "请在 Header 中提供 X-Admin-Key" });
+        }
+    }
+}