改用mysql

backend/app/api/auth.py

@@ -21,22 +21,48 @@ router = APIRouter(prefix="/auth", tags=["auth"])
 
 @router.post("/register", response_model=UserResponse, status_code=201)
 def register(body: RegisterRequest, response: Response, db: Session = Depends(get_db)) -> UserResponse:
-    """注册新用户并自动登录。"""
+    """注册新用户（默认 role=customer）并自动登录。"""
     auth_service = AuthService(db)
-    user, token = auth_service.register(body.username, body.email, body.password)
+    user, token = auth_service.register(body.username, body.email, body.password, role="customer")
+    response.set_cookie(value=token, **get_cookie_params())
+    return _user_response(user)
+
+
+@router.post("/register-internal", response_model=UserResponse, status_code=201)
+def register_internal(
+    body: RegisterRequest,
+    response: Response,
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+) -> UserResponse:
+    """注册内部员工账号（仅已登录的内部用户可调用）。"""
+    if current_user.role != "internal":
+        from app.core.errors import PermissionDeniedError
+        raise PermissionDeniedError("仅内部员工可创建内部账号。")
+    auth_service = AuthService(db)
+    user, token = auth_service.register(body.username, body.email, body.password, role="internal")
     response.set_cookie(value=token, **get_cookie_params())
     return _user_response(user)
 
 
 @router.post("/login", response_model=UserResponse)
 def login(body: LoginRequest, response: Response, db: Session = Depends(get_db)) -> UserResponse:
-    """登录。"""
+    """普通登录（所有用户可用）。"""
     auth_service = AuthService(db)
     user, token = auth_service.login(body.username_or_email, body.password)
     response.set_cookie(value=token, **get_cookie_params())
     return _user_response(user)
 
 
+@router.post("/internal-login", response_model=UserResponse)
+def internal_login(body: LoginRequest, response: Response, db: Session = Depends(get_db)) -> UserResponse:
+    """内部登录（仅 role=internal 用户可用）。"""
+    auth_service = AuthService(db)
+    user, token = auth_service.internal_login(body.username_or_email, body.password)
+    response.set_cookie(value=token, **get_cookie_params())
+    return _user_response(user)
+
+
 @router.post("/logout", status_code=204)
 def logout(
     response: Response,
@@ -70,6 +96,7 @@ def get_me(user: User = Depends(get_current_user)) -> MeResponse:
         username=user.username,
         email=user.email,
         status=user.status,
+        role=user.role,
         storage_used=user.storage_used,
         storage_quota=settings.default_storage_quota,
         created_at=user.created_at,
@@ -94,6 +121,7 @@ def update_me(
         username=user.username,
         email=user.email,
         status=user.status,
+        role=user.role,
         storage_used=user.storage_used,
         storage_quota=settings.default_storage_quota,
         created_at=user.created_at,
@@ -123,6 +151,7 @@ def _user_response(user: User) -> UserResponse:
         username=user.username,
         email=user.email,
         status=user.status,
+        role=user.role,
         storage_used=user.storage_used,
         storage_quota=settings.default_storage_quota,
         created_at=user.created_at,