update：

1、把ota_auth内容合并到auth.py
2、精简auth密钥，简化部署

main/xiaozhi-server/core/websocket_server.py

@@ -3,10 +3,9 @@ import json
 
 import websockets
 from config.logger import setup_logging
-from core.auth import AuthenticationError
 from core.connection import ConnectionHandler
 from config.config_loader import get_config_from_api
-from core.ota_auth import AuthManager
+from core.auth import AuthManager, AuthenticationError
 from core.utils.modules_initialize import initialize_modules
 from core.utils.util import check_vad_update, check_asr_update
 
@@ -39,10 +38,8 @@ class WebSocketServer:
         auth_config = self.config["server"].get("auth", {})
         self.auth_enable = auth_config.get("enabled", False)
         # 设备白名单
-        self.allowed_devices = set(
-            auth_config.get("allowed_devices", [])
-        )
-        secret_key = auth_config.get("signature_key", "")
+        self.allowed_devices = set(auth_config.get("allowed_devices", []))
+        secret_key = self.config["server"]["auth_key"]
         expire_seconds = auth_config.get("expire_seconds", None)
         self.auth = AuthManager(secret_key=secret_key, expire_seconds=expire_seconds)
 
@@ -57,17 +54,38 @@ class WebSocketServer:
             await asyncio.Future()
 
     async def _handle_connection(self, websocket):
+        headers = dict(websocket.request.headers)
+        if headers.get("device-id", None) is None:
+            # 尝试从 URL 的查询参数中获取 device-id
+            from urllib.parse import parse_qs, urlparse
+
+            # 从 WebSocket 请求中获取路径
+            request_path = websocket.request.path
+            if not request_path:
+                self.logger.bind(tag=TAG).error("无法获取请求路径")
+                await websocket.close()
+                return
+            parsed_url = urlparse(request_path)
+            query_params = parse_qs(parsed_url.query)
+            if "device-id" not in query_params:
+                await websocket.send("端口正常，如需测试连接，请使用test_page.html")
+                await websocket.close()
+                return
+            else:
+                websocket.request.headers["device-id"] = query_params["device-id"][0]
+            if "client-id" in query_params:
+                websocket.request.headers["client-id"] = query_params["client-id"][0]
+            if "authorization" in query_params:
+                websocket.request.headers["authorization"] = query_params[
+                    "authorization"
+                ][0]
+
         """处理新连接，每次创建独立的ConnectionHandler"""
         # 先认证，后建立连接
         try:
             await self._handle_auth(websocket)
         except AuthenticationError:
-            await websocket.send(json.dumps({
-                "type": "alert",
-                "status": "ERROR",
-                "message": "认证失败",
-                "emotion": "sad"
-            }))
+            await websocket.send("认证失败")
             await websocket.close()
             return
         # 创建ConnectionHandler时传入当前server实例
@@ -169,17 +187,19 @@ class WebSocketServer:
             headers = dict(websocket.request.headers)
             device_id = headers.get("device-id", None)
             client_id = headers.get("client-id", None)
-            # 如果启用了白名单则优先处理白名单
-            if self.allowed_devices and device_id not in self.allowed_devices:
-                raise AuthenticationError("未经授权的DeviceID")
+            if self.allowed_devices and device_id in self.allowed_devices:
+                # 如果属于白名单内的设备，不校验token，直接放行
+                return
             else:
                 # 否则校验token
                 token = headers.get("authorization", "")
-                if token.startswith('Bearer '):
+                if token.startswith("Bearer "):
                     token = token[7:]  # 移除'Bearer '前缀
                 else:
                     raise AuthenticationError("Missing or invalid Authorization header")
                 # 进行认证
-                auth_success = self.auth.verify_token(token, client_id=client_id, username=device_id)
+                auth_success = self.auth.verify_token(
+                    token, client_id=client_id, username=device_id
+                )
                 if not auth_success:
                     raise AuthenticationError("Invalid token")