refactor(auth): move authentication params to headers and simplify validation

- Move token and timestamp validation to HTTP headers
- Simplify ValidateTimeStamp to return boolean
- Update AddUser to use default "visitor" type
- Remove redundant timestamp and token fields from request structs
- Update API documentation to reflect header-based authentication

frpc.go

@@ -10,7 +10,6 @@ import (
 	"os"
 	"os/exec"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"super-frpc/postLog"
 	"time"
@@ -27,8 +26,6 @@ type InstanceInfo struct {
 }
 
 type CreateInstanceRequest struct {
-	Token        string                 `json:"token"`
-	TimeStamp    int64                  `json:"timeStamp"`
 	InstanceInfo InstanceInfo           `json:"instanceInfo"`
 	BootAtStart  bool                   `json:"bootAtStart"`
 	RunUser      string                 `json:"runUser"`
@@ -80,21 +77,6 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// 处理timeStamp字段
-	timeStamp := int64(0)
-	if ts, ok := reqMap["timeStamp"]; ok {
-		switch v := ts.(type) {
-		case float64:
-			timeStamp = int64(v)
-		case string:
-			if v != "" {
-				if parsed, err := strconv.ParseInt(v, 10, 64); err == nil {
-					timeStamp = parsed
-				}
-			}
-		}
-	}
-
 	// 处理bootAtStart字段
 	bootAtStart := false
 	if bas, ok := reqMap["bootAtStart"]; ok {
@@ -128,31 +110,22 @@ func CreateInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		instanceInfo.Additional = additional
 	}
 
+	// 从Header中验证token和timeStamp
+	userID, _, err := ValidateRequestWithHeader(w, r)
+	if err != nil {
+		postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to validate request header: %v", err))
+		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
+		return
+	}
+
 	// 构建请求结构体
 	req := CreateInstanceRequest{
-		Token:        getStringFromMap(reqMap, "token"),
-		TimeStamp:    timeStamp,
 		InstanceInfo: instanceInfo,
 		BootAtStart:  bootAtStart,
 		RunUser:      instanceInfo.RunUser,
 		Additional:   instanceInfo.Additional,
 	}
 
-	// 重新序列化为JSON，用于ValidateRequestWithBody
-	reqBody, err := json.Marshal(req)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to marshal request body: %v", err))
-		SendErrorResponse(w, http.StatusBadRequest, "Invalid request format")
-		return
-	}
-
-	userID, _, err := ValidateRequestWithBody(w, r, reqBody)
-	if err != nil {
-		postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to validate request body: %v", err))
-		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
-		return
-	}
-
 	if err := CheckPermission(userID, "superuser", "admin"); err != nil {
 		postLog.Error(fmt.Sprintf("[CreateInstanceHandler] Failed to check permission: %v", err))
 		SendErrorResponse(w, http.StatusForbidden, err.Error())
@@ -251,9 +224,10 @@ func DeleteInstanceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	userID, _, err := ValidateRequestWithBody(w, r, body)
+	// 从Header中验证token和timeStamp
+	userID, _, err := ValidateRequestWithHeader(w, r)
 	if err != nil {
-		postLog.Error(fmt.Sprintf("[DeleteInstanceHandler] Failed to validate request body: %v", err))
+		postLog.Error(fmt.Sprintf("[DeleteInstanceHandler] Failed to validate request header: %v", err))
 		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
 		return
 	}
@@ -345,9 +319,10 @@ func ModifyInstanceHandler(w http.ResponseWriter, r *http.Request, field string)
 		return
 	}
 
-	userID, _, err := ValidateRequestWithBody(w, r, body)
+	// 从Header中验证token和timeStamp
+	userID, _, err := ValidateRequestWithHeader(w, r)
 	if err != nil {
-		postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Failed to validate request body: %v", err))
+		postLog.Error(fmt.Sprintf("[ModifyInstanceHandler] Failed to validate request header: %v", err))
 		SendErrorResponse(w, http.StatusUnauthorized, err.Error())
 		return
 	}