fix(page-data): isolate owner API from public pages

server.mjs

@@ -203,7 +203,7 @@ import { createSkillRuntimeAdminConfigService } from './skill-runtime-admin-conf
 import { createWechatScheduleLlmConfigService } from './wechat-schedule-llm-config.mjs';
 import { createExperienceService } from './experience-service.mjs';
 import { attachAsrRoutes } from './asr-proxy.mjs';
-import { attachPageDataRoutes } from './page-data-routes.mjs';
+import { attachPageDataRoutes, isLegacyPageDataApiPath } from './page-data-routes.mjs';
 import { createPageDataService } from './page-data-service.mjs';
 import { createPageDataPublicService, isPageDataPublicPath } from './page-data-public-service.mjs';
 import { syncPageDataPolicyAccessMode } from './page-data-publish-sync.mjs';
@@ -2035,10 +2035,14 @@ api.use(async (req, res, next) => {
 
   const plazaPublic = isPlazaPublicRead(req.path, req.method);
   const pageDataPublic = isPageDataPublicPath(req.path, req.method);
+  // Let the retired namespace reach its explicit 410 handler below.  Without
+  // this exception the outer auth middleware turns an old public HTML request
+  // into a misleading 401/403 before the legacy-endpoint block can run.
+  const legacyPageDataApi = isLegacyPageDataApiPath(req.path);
 
   if (userAuth && tkmindProxy) {
     if (req.userSessionError) {
-      if (plazaPublic || pageDataPublic) return next();
+      if (plazaPublic || pageDataPublic || legacyPageDataApi) return next();
       return res.status(503).json({ message: '用户认证服务不可用，请稍后重试' });
     }
     try {
@@ -2046,7 +2050,7 @@ api.use(async (req, res, next) => {
         const me = await userAuth.getMe(req.userToken);
         if (me) req.currentUser = me;
       }
-      if (plazaPublic || pageDataPublic) return next();
+      if (plazaPublic || pageDataPublic || legacyPageDataApi) return next();
       if (!req.userSession) {
         return res.status(401).json({ message: '未授权，请重新登录' });
       }