feat: 全站登录保护，管理后台仅管理员可访问

- tasks 路由级认证保护，所有 API 需登录 - 未登录时显示登录页面，不暴露导航和功能 - ConfigView 仅管理员可访问，普通用户显示权限提示 - BuildView/HistoryView 所有 API 请求携带 token
2026-06-08 20:59:13 +08:00 · 2026-06-08 20:59:13 +08:00 · 1cecf66d94
commit 1cecf66d94
parent a0c857f3c2
5 changed files with 66 additions and 33 deletions
--- a/backend/routers/tasks.py
+++ b/backend/routers/tasks.py
@ -15,7 +15,7 @@ from ..models import Task
 from ..schemas import TaskCreate, TaskResponse
 from ..deps import get_current_user

-router = APIRouter(prefix="/api/tasks", tags=["tasks"])
+router = APIRouter(prefix="/api/tasks", tags=["tasks"], dependencies=[Depends(get_current_user)])


@router.post("", response_model=TaskResponse)
@ -106,7 +106,7 @@ async def get_task(task_id: str, db: Session = Depends(get_db)):
    return _enrich_tasks([task])[0]


-@router.delete("/{task_id}", dependencies=[Depends(get_current_user)])
+@router.delete("/{task_id}")
 async def cancel_task(task_id: str, db: Session = Depends(get_db)):
    """取消任务"""
    task = db.query(Task).filter(Task.id == task_id).first()
@ -137,7 +137,7 @@ async def cancel_task(task_id: str, db: Session = Depends(get_db)):
    return {"message": "任务已取消"}


-@router.delete("/{task_id}/delete", dependencies=[Depends(get_current_user)])
+@router.delete("/{task_id}/delete")
 async def delete_task(task_id: str, db: Session = Depends(get_db)):
    """删除打包记录"""
    import shutil
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@ -3,35 +3,46 @@
    <header class="header">
      <h1>iOS 自动打包服务</h1>
      <div class="header-right">
-        <nav class="nav">
+        <nav v-if="isLoggedIn" class="nav">
          <router-link to="/build">打包</router-link>
          <router-link to="/history">历史</router-link>
-          <router-link v-if="isLoggedIn" to="/admin">管理</router-link>
+          <router-link v-if="isAdmin" to="/admin">管理</router-link>
        </nav>
        <div v-if="!isLoggedIn" class="user-info">
          <button class="btn-login" @click="showLogin = true">登录</button>
        </div>
        <div v-else class="user-info">
-          <div class="user-avatar">A</div>
-          <span class="user-name">管理员</span>
+          <div class="user-avatar">{{ isAdmin ? 'A' : 'U' }}</div>
+          <span class="user-name">{{ isAdmin ? '管理员' : '用户' }}</span>
          <button class="btn-logout" @click="logout">退出</button>
        </div>
      </div>
    </header>

-    <router-view />
+    <template v-if="isLoggedIn">
+      <router-view />
+    </template>
+    <template v-else>
+      <div class="login-required">
+        <div class="login-card">
+          <h2>请先登录</h2>
+          <p>使用此服务需要登录账号</p>
+          <button class="login-btn" @click="showLogin = true">立即登录</button>
+        </div>
+      </div>
+    </template>

    <!-- 登录弹窗 -->
    <div v-if="showLogin" class="modal-overlay" @click.self="showLogin = false">
      <div class="login-modal">
-        <h2>管理员登录</h2>
+        <h2>用户登录</h2>
        <div class="form-group">
          <label>用户名</label>
-          <input v-model="loginForm.username" type="text" placeholder="请输入用户名">
+          <input v-model="loginForm.username" type="text" placeholder="请输入用户名" @keyup.enter="login">
        </div>
        <div class="form-group">
          <label>密码</label>
-          <input v-model="loginForm.password" type="password" placeholder="请输入密码">
+          <input v-model="loginForm.password" type="password" placeholder="请输入密码" @keyup.enter="login">
        </div>
        <button class="login-btn" @click="login">登录</button>
        <div class="login-hint">默认账号: admin / admin123</div>
@ -44,12 +55,14 @@
 import { ref, onMounted, provide } from 'vue'

 const isLoggedIn = ref(false)
+const isAdmin = ref(false)
 const showLogin = ref(false)
 const loginForm = ref({ username: '', password: '' })

 // 提供给子组件使用
 provide('showLogin', showLogin)
 provide('isLoggedIn', isLoggedIn)
+provide('isAdmin', isAdmin)

 // 获取存储的 token
 const getToken = () => localStorage.getItem('authToken') || ''
@ -67,9 +80,9 @@ const login = async () => {
    if (res.ok) {
      const data = await res.json()
      isLoggedIn.value = true
+      isAdmin.value = data.is_admin
      showLogin.value = false
      localStorage.setItem('authToken', data.token)
-      localStorage.setItem('isAdmin', 'true')
    } else {
      alert('用户名或密码错误')
    }
@ -80,27 +93,31 @@ const login = async () => {

 const logout = () => {
  isLoggedIn.value = false
+  isAdmin.value = false
  localStorage.removeItem('authToken')
-  localStorage.removeItem('isAdmin')
 }

 // 检查登录状态（验证 token 有效性）
 onMounted(async () => {
  const token = localStorage.getItem('authToken')
-  if (!token) return
+  if (!token) {
+    showLogin.value = true
+    return
+  }
  try {
    const res = await fetch('/api/auth/me', {
      headers: { 'Authorization': `Bearer ${token}` },
    })
    if (res.ok) {
+      const data = await res.json()
      isLoggedIn.value = true
+      isAdmin.value = data.is_admin
    } else {
-      // token 无效或过期，清除
      localStorage.removeItem('authToken')
-      localStorage.removeItem('isAdmin')
+      showLogin.value = true
    }
  } catch {
-    // 网络错误时不清除，保持登录状态
+    // 网络错误时保持当前状态
  }
 })
 </script>
@ -116,12 +133,17 @@ body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; b
 .nav a.router-link-active { background: #16213e; color: white; }
 .nav a:hover { color: white; }
 .user-info { display: flex; align-items: center; gap: 10px; }
-.user-avatar { width: 32px; height: 32px; background: #1890ff; border-radius: 50%; display: flex; align-items: center; justify-content: center; font-size: 14px; }
+.user-avatar { width: 32px; height: 32px; background: #1890ff; border-radius: 50%; display: flex; align-items: center; justify-content: center; font-size: 14px; font-weight: 600; }
 .user-name { font-size: 14px; }
 .btn-login { background: #1890ff; color: white; border: none; padding: 6px 16px; border-radius: 4px; cursor: pointer; font-size: 13px; }
 .btn-logout { background: transparent; color: #a0a0a0; border: 1px solid #444; padding: 6px 16px; border-radius: 4px; cursor: pointer; font-size: 13px; }
 .btn-logout:hover { border-color: #ff4d4f; color: #ff4d4f; }

+.login-required { display: flex; align-items: center; justify-content: center; min-height: calc(100vh - 64px); }
+.login-card { background: white; border-radius: 12px; padding: 48px; text-align: center; box-shadow: 0 2px 12px rgba(0,0,0,0.08); }
+.login-card h2 { font-size: 20px; color: #1a1a2e; margin-bottom: 8px; }
+.login-card p { color: #999; margin-bottom: 24px; }
+
 .modal-overlay { position: fixed; top: 0; left: 0; right: 0; bottom: 0; background: rgba(0,0,0,0.5); display: flex; align-items: center; justify-content: center; z-index: 1000; }
 .login-modal { background: white; border-radius: 12px; padding: 32px; width: 400px; }
 .login-modal h2 { font-size: 20px; margin-bottom: 24px; text-align: center; color: #1a1a2e; }
--- a/frontend/src/views/BuildView.vue
+++ b/frontend/src/views/BuildView.vue
@ -138,9 +138,19 @@
 </template>

 <script setup>
-import { ref, onMounted, nextTick, watch, onUnmounted } from 'vue'
+import { ref, onMounted, nextTick, watch, onUnmounted, inject } from 'vue'
 import { useRoute } from 'vue-router'

+const getToken = inject('getToken')
+
+const authFetch = (url, options = {}) => {
+  const token = getToken()
+  if (token) {
+    options.headers = { ...options.headers, 'Authorization': `Bearer ${token}` }
+  }
+  return fetch(url, options)
+}
+
 const apps = ref({})
 const schemes = ref({})
 const branches = ref(['main'])
@ -164,7 +174,7 @@ let skipNextConnect = false

 const fetchTaskDetail = async (taskId) => {
  try {
-    const res = await fetch(`/api/tasks/${taskId}`)
+    const res = await authFetch(`/api/tasks/${taskId}`)
    if (res.ok) {
      completedTask.value = await res.json()
    }
@ -175,7 +185,7 @@ const fetchTaskDetail = async (taskId) => {

 const fetchBuildLog = async (taskId) => {
  try {
-    const res = await fetch(`/api/tasks/${taskId}/log`)
+    const res = await authFetch(`/api/tasks/${taskId}/log`)
    if (res.ok) {
      const data = await res.json()
      if (data.log) {
@ -257,10 +267,10 @@ onUnmounted(() => {

 onMounted(async () => {
  const [appsRes, schemesRes, branchesRes, tasksRes] = await Promise.all([
-    fetch('/api/apps'),
-    fetch('/api/schemes'),
-    fetch('/api/branches'),
-    fetch('/api/tasks'),
+    authFetch('/api/apps'),
+    authFetch('/api/schemes'),
+    authFetch('/api/branches'),
+    authFetch('/api/tasks'),
  ])
  apps.value = await appsRes.json()
  schemes.value = await schemesRes.json()
@ -302,7 +312,7 @@ const submitTask = async () => {
  }
  submitting.value = true
  try {
-    const res = await fetch('/api/tasks', {
+    const res = await authFetch('/api/tasks', {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
      body: JSON.stringify(form.value),
@ -329,7 +339,7 @@ const selectTask = (taskId) => {
 const cancelTask = async () => {
  if (!currentTaskId.value) return
  if (!confirm('确定取消当前任务？')) return
-  const res = await fetch(`/api/tasks/${currentTaskId.value}`, { method: 'DELETE' })
+  const res = await authFetch(`/api/tasks/${currentTaskId.value}`, { method: 'DELETE' })
  if (!res.ok) {
    const err = await res.json().catch(() => ({}))
    alert(err.detail || '取消失败')
@ -342,7 +352,7 @@ const cancelTask = async () => {
 }

 const refreshTasks = async () => {
-  const res = await fetch('/api/tasks?limit=50')
+  const res = await authFetch('/api/tasks?limit=50')
  const all = await res.json()
  // 显示未完成的任务 + 当前选中的任务
  tasks.value = all.filter(t =>
--- a/frontend/src/views/ConfigView.vue
+++ b/frontend/src/views/ConfigView.vue
@ -1,9 +1,9 @@
 <template>
  <div class="container">
-    <div v-if="!isLoggedIn" class="access-denied">
+    <div v-if="!isAdmin" class="access-denied">
      <h3>需要管理员权限</h3>
-      <p>请先登录管理员账号以访问配置管理页面</p>
-      <button class="btn-login" @click="showLogin = true">登录管理员账号</button>
+      <p>{{ isLoggedIn ? '当前账号无管理员权限' : '请先登录管理员账号' }}</p>
+      <button v-if="!isLoggedIn" class="btn-login" @click="showLogin = true">登录管理员账号</button>
    </div>
    <div v-else class="admin-page">
      <div class="sidebar">
@ -448,6 +448,7 @@ import { ref, onMounted, inject } from 'vue'
 const showLogin = inject('showLogin')
 const getToken = inject('getToken')
 const isLoggedIn = inject('isLoggedIn')
+const isAdmin = inject('isAdmin')
 const tab = ref('servers')

 // 带认证的 fetch 封装
--- a/frontend/src/views/HistoryView.vue
+++ b/frontend/src/views/HistoryView.vue
@ -176,7 +176,7 @@ const filteredTasks = computed(() => {
 })

 onMounted(async () => {
-  const res = await fetch('/api/tasks?limit=100')
+  const res = await authFetch('/api/tasks?limit=100')
  tasks.value = await res.json()
 })

@ -194,7 +194,7 @@ const viewLogs = async (taskId) => {
  } else {
    // 已完成/失败的任务，先从 REST API 获取完整日志
    try {
-      const res = await fetch(`/api/tasks/${taskId}/log`)
+      const res = await authFetch(`/api/tasks/${taskId}/log`)
      if (res.ok) {
        const data = await res.json()
        if (data.log) {