feat: 强化打包配置与服务安全

backend/routers/config.py

@@ -6,7 +6,7 @@ import shutil
 import zipfile
 from datetime import datetime
 from pathlib import Path
-from fastapi import APIRouter, Depends, HTTPException, UploadFile, File
+from fastapi import APIRouter, Depends, HTTPException, Request, UploadFile, File
 from sqlalchemy.orm import Session
 
 from ..database import get_db
@@ -21,9 +21,18 @@ from ..config import (
     DEFAULT_BUILD_DIR_RETENTION_HOURS,
     SKINS_DIR,
 )
-from ..deps import get_current_user
+from ..deps import get_current_user, require_admin
 
-router = APIRouter(prefix="/api/config", tags=["config"], dependencies=[Depends(get_current_user)])
+
+def _require_config_permission(request: Request, user: dict = Depends(get_current_user)) -> dict:
+    """普通用户仅可管理 Apps；其余配置及凭据只允许管理员访问。"""
+    path = request.url.path.rstrip("/")
+    if path == "/api/config/apps" or path.startswith("/api/config/apps/"):
+        return user
+    return require_admin(user)
+
+
+router = APIRouter(prefix="/api/config", tags=["config"], dependencies=[Depends(_require_config_permission)])
 
 _config_lock = asyncio.Lock()