feat: 强化打包配置与服务安全

backend/deps.py

@@ -8,9 +8,8 @@ from .config import JWT_SECRET, JWT_ALGORITHM
 security = HTTPBearer()
 
 
-def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(security)) -> dict:
-    """验证 JWT token，返回用户信息"""
-    token = credentials.credentials
+def decode_current_user(token: str) -> dict:
+    """验证 JWT token，返回用户身份。"""
     try:
         payload = jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGORITHM])
         return {"username": payload["sub"], "is_admin": payload.get("is_admin", False)}
@@ -18,3 +17,15 @@ def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(securit
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="登录已过期，请重新登录")
     except jwt.InvalidTokenError:
         raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="无效的认证凭据")
+
+
+def get_current_user(credentials: HTTPAuthorizationCredentials = Depends(security)) -> dict:
+    """验证 HTTP Bearer JWT token，返回用户信息。"""
+    return decode_current_user(credentials.credentials)
+
+
+def require_admin(user: dict = Depends(get_current_user)) -> dict:
+    """限制仅管理员可访问的管理和敏感配置接口。"""
+    if not user.get("is_admin"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="需要管理员权限")
+    return user