改用mysql

backend/app/services/auth_service.py

@@ -19,9 +19,12 @@ class AuthService:
         self._user_repo = UserRepository(session)
         self._plan_repo = PlanRepository(session)
 
-    def register(self, username: str, email: str, password: str) -> tuple[User, str]:
+    def register(self, username: str, email: str, password: str, role: str = "customer") -> tuple[User, str]:
         """注册新用户。返回 (user, session_token)。
 
+        Args:
+            role: "customer"（默认）或 "internal"
+
         Raises:
             ConflictError: 用户名或邮箱已存在
         """
@@ -37,6 +40,7 @@ class AuthService:
             email=email,
             password_hash=hash_password(password),
             plan_id=plan.id,
+            role=role,
         )
         self._session.commit()
 
@@ -44,7 +48,7 @@ class AuthService:
         return user, token
 
     def login(self, username_or_email: str, password: str) -> tuple[User, str]:
-        """登录。返回 (user, session_token)。
+        """普通登录（所有用户可用）。返回 (user, session_token)。
 
         Raises:
             InvalidCredentialsError: 用户名/邮箱或密码错误
@@ -60,6 +64,25 @@ class AuthService:
         token = create_session(user.id)
         return user, token
 
+    def internal_login(self, username_or_email: str, password: str) -> tuple[User, str]:
+        """内部登录（仅 internal 角色可用）。返回 (user, session_token)。
+
+        Raises:
+            InvalidCredentialsError: 用户名/邮箱或密码错误，或非内部用户
+        """
+        user = self._user_repo.get_by_username_or_email(username_or_email)
+        if user is None:
+            raise InvalidCredentialsError()
+        if not verify_password(password, user.password_hash):
+            raise InvalidCredentialsError()
+        if user.status != "active":
+            raise InvalidCredentialsError("账户已被禁用。")
+        if user.role != "internal":
+            raise InvalidCredentialsError("此入口仅限内部员工使用。")
+
+        token = create_session(user.id)
+        return user, token
+
     def logout(self, session_token: str) -> None:
         """登出：删除 session。"""
         delete_session(session_token)