对接

internal/server/gin.go

@@ -79,20 +79,21 @@ func NewGinEngineWithRuntime(runtime *config.Store, access *systemservice.Access
 			c.Status(http.StatusNotFound)
 			return
 		}
-		if !middleware.AuthenticateWebSocket(c, auth) {
-			if wsLogger != nil {
-				wsLogger.WarnContext(c.Request.Context(), "websocket handshake rejected: authentication failed",
-					"mod", "websocket", "path", c.Request.URL.Path, "status", c.Writer.Status(),
-					"has_token", hasToken, "origin", c.GetHeader("Origin"))
-			}
-			return
-		}
-		claims := middleware.Claims(c)
 		keys := map[string]any{
-			"request_id": contextString(c, "request_id"),
+			"request_id":    contextString(c, "request_id"),
+			"authenticated": false,
 		}
-		if claims != nil {
-			keys["user_id"] = claims.ID
+		// Watching is public. A valid token enriches the connection; a stale
+		// token is cleared and continues as anonymous so it cannot block video.
+		if hasToken {
+			if authenticated := middleware.AuthenticateWebSocketOptional(c, auth); !authenticated && wsLogger != nil {
+				wsLogger.InfoContext(c.Request.Context(), "websocket token unavailable; continuing anonymously",
+					"mod", "websocket", "path", c.Request.URL.Path, "origin", c.GetHeader("Origin"))
+			}
+			if claims := middleware.Claims(c); claims != nil {
+				keys["user_id"] = claims.ID
+				keys["authenticated"] = true
+			}
 		}
 		if wsLogger != nil {
 			wsLogger.InfoContext(c.Request.Context(), "websocket authentication accepted; upgrading connection",