用户系统

art-agent/backend/app/api/admin.py

@@ -0,0 +1,95 @@
+"""
+管理员路由：创建用户 / 用户列表 / 禁用或删除用户。
+"""
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from sqlmodel import Session, select
+
+from app.auth import hash_password, require_admin
+from app.db import User, get_session
+
+router = APIRouter(prefix="/admin", tags=["admin"])
+
+
+class CreateUserRequest(BaseModel):
+    username: str
+    password: str
+    display_name: str = ""
+    is_admin: bool = False
+
+
+class UserOut(BaseModel):
+    id: str
+    username: str
+    display_name: str
+    is_admin: bool
+    is_active: bool
+    created_at: str
+
+
+@router.post("/users", response_model=UserOut)
+def create_user(
+    body: CreateUserRequest,
+    _admin: User = Depends(require_admin),
+    session: Session = Depends(get_session),
+):
+    existing = session.exec(select(User).where(User.username == body.username)).first()
+    if existing:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="用户名已存在")
+    if len(body.password) < 6:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="密码至少 6 位")
+
+    user = User(
+        username=body.username,
+        hashed_password=hash_password(body.password),
+        display_name=body.display_name or body.username,
+        is_admin=body.is_admin,
+    )
+    session.add(user)
+    session.commit()
+    session.refresh(user)
+    return UserOut(
+        id=user.id,
+        username=user.username,
+        display_name=user.display_name,
+        is_admin=user.is_admin,
+        is_active=user.is_active,
+        created_at=user.created_at.isoformat(),
+    )
+
+
+@router.get("/users", response_model=list[UserOut])
+def list_users(
+    _admin: User = Depends(require_admin),
+    session: Session = Depends(get_session),
+):
+    users = session.exec(select(User)).all()
+    return [
+        UserOut(
+            id=u.id,
+            username=u.username,
+            display_name=u.display_name,
+            is_admin=u.is_admin,
+            is_active=u.is_active,
+            created_at=u.created_at.isoformat(),
+        )
+        for u in users
+    ]
+
+
+@router.delete("/users/{user_id}")
+def disable_user(
+    user_id: str,
+    _admin: User = Depends(require_admin),
+    session: Session = Depends(get_session),
+):
+    user = session.exec(select(User).where(User.id == user_id)).first()
+    if not user:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
+    if user.id == _admin.id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="不能禁用自己")
+    user.is_active = False
+    session.add(user)
+    session.commit()
+    return {"message": f"用户 {user.username} 已禁用"}

art-agent/backend/app/api/auth.py

@@ -0,0 +1,99 @@
+"""
+认证路由：登录 / 刷新令牌 / 修改密码 / 当前用户信息。
+"""
+
+from fastapi import APIRouter, Depends, HTTPException, status
+from pydantic import BaseModel
+from sqlmodel import Session, select
+
+from app.auth import (
+    create_access_token,
+    create_refresh_token,
+    decode_token,
+    get_current_user,
+    hash_password,
+    verify_password,
+)
+from app.db import User, get_session
+
+router = APIRouter(prefix="/auth", tags=["auth"])
+
+
+class LoginRequest(BaseModel):
+    username: str
+    password: str
+
+
+class TokenResponse(BaseModel):
+    access_token: str
+    refresh_token: str
+    token_type: str = "bearer"
+    user: dict
+
+
+class RefreshRequest(BaseModel):
+    refresh_token: str
+
+
+class ChangePasswordRequest(BaseModel):
+    old_password: str
+    new_password: str
+
+
+def _user_dict(u: User) -> dict:
+    return {
+        "id": u.id,
+        "username": u.username,
+        "display_name": u.display_name,
+        "is_admin": u.is_admin,
+    }
+
+
+@router.post("/login", response_model=TokenResponse)
+def login(body: LoginRequest, session: Session = Depends(get_session)):
+    user = session.exec(select(User).where(User.username == body.username)).first()
+    if not user or not verify_password(body.password, user.hashed_password):
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="用户名或密码错误")
+    if not user.is_active:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="账号已禁用")
+    return TokenResponse(
+        access_token=create_access_token(user.id),
+        refresh_token=create_refresh_token(user.id),
+        user=_user_dict(user),
+    )
+
+
+@router.post("/refresh")
+def refresh(body: RefreshRequest, session: Session = Depends(get_session)):
+    user_id = decode_token(body.refresh_token, expected_type="refresh")
+    user = session.exec(select(User).where(User.id == user_id)).first()
+    if not user or not user.is_active:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="用户不存在或已禁用")
+    return {
+        "access_token": create_access_token(user.id),
+        "token_type": "bearer",
+    }
+
+
+@router.post("/change-password")
+def change_password(
+    body: ChangePasswordRequest,
+    current_user: User = Depends(get_current_user),
+    session: Session = Depends(get_session),
+):
+    if not verify_password(body.old_password, current_user.hashed_password):
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="旧密码错误")
+    if len(body.new_password) < 6:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="新密码至少 6 位")
+    # 重新获取以确保在同一 session 中
+    user = session.exec(select(User).where(User.id == current_user.id)).first()
+    if user:
+        user.hashed_password = hash_password(body.new_password)
+        session.add(user)
+        session.commit()
+    return {"message": "密码已修改"}
+
+
+@router.get("/me")
+def me(current_user: User = Depends(get_current_user)):
+    return _user_dict(current_user)

art-agent/backend/app/api/chat.py

@@ -3,11 +3,13 @@ import uuid
 from pathlib import Path
 from typing import Optional
 
-from fastapi import APIRouter, File, Form, UploadFile
+from fastapi import APIRouter, Depends, File, Form, UploadFile
 from sse_starlette.sse import EventSourceResponse
 
 from app.agent.loop import run_agent_loop
+from app.auth import get_current_user
 from app.config import get_image_models_list, get_default_image_model_id
+from app.db import User
 
 router = APIRouter()
 
@@ -27,6 +29,7 @@ async def _save_upload(file: UploadFile) -> str:
 @router.post("/upload-ref-image")
 async def upload_ref_image(
     file: UploadFile = File(...),
+    current_user: User = Depends(get_current_user),
 ):
     """
     独立的参考图上传端点。
@@ -38,7 +41,7 @@ async def upload_ref_image(
 
 
 @router.get("/models")
-async def list_models():
+async def list_models(current_user: User = Depends(get_current_user)):
     """返回可用的图像生成模型列表。"""
     return {
         "models": get_image_models_list(),
@@ -53,6 +56,7 @@ async def chat(
     ref_image_url: Optional[str] = Form(None),
     image_model: Optional[str] = Form(None),
     session_id: Optional[str] = Form(None),
+    current_user: User = Depends(get_current_user),
 ):
     """
     主对话端点。
@@ -78,6 +82,7 @@ async def chat(
             resolved_ref_url,
             image_model=image_model,
             session_id=session_id,
+            user_id=current_user.id,
         ):
             yield {
                 "event": event["type"],