学生管理系统代码提交

api/auth.py

@@ -0,0 +1,52 @@
+# api/auth.py
+# 认证模块：登录（签发 JWT）、创建用户（仅管理员）、获取当前用户信息
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy.orm import Session
+
+from core.security import verify_password, create_access_token
+from core.deps import get_current_user, require_roles
+from dao.users_dao import UserDAO
+from database import get_db
+from model.user import User
+from scheme.users import UserAdd, UserLogin, UserResponse, TokenResponse
+
+router = APIRouter()
+
+
+# ---------- 登录 ----------
+@router.post("/login", response_model=TokenResponse, summary="登录获取 JWT token")
+async def login(body: UserLogin, db: Session = Depends(get_db)):
+    user = UserDAO.get_by_username(db, body.username)
+    # 用户不存在 / 已被软删除 / 密码错误，统一返回 401（避免暴露用户是否存在）
+    if (user is None) or user.is_deleted == 1 or not verify_password(body.password, user.password_hash):
+        raise HTTPException(status_code=401, detail="用户名或密码错误")
+    token = create_access_token(user.user_id, user.role)
+    return TokenResponse(
+        access_token=token,
+        user=UserResponse.model_validate(user),
+    )
+
+
+# ---------- 创建用户（仅管理员） ----------
+@router.post("/register", response_model=UserResponse, summary="创建用户（仅管理员）")
+async def register(
+    body: UserAdd,
+    db: Session = Depends(get_db),
+    current_user: User = Depends(require_roles("admin")),
+):
+    existing = UserDAO.get_by_username(db, body.username)
+    if existing:
+        raise HTTPException(status_code=409, detail="用户名已存在")
+    # 绑定业务身份的合法性校验
+    if body.role == "student" and body.stu_id is None:
+        raise HTTPException(status_code=400, detail="student 角色必须提供 stu_id")
+    if body.role == "teacher" and body.teacher_id is None:
+        raise HTTPException(status_code=400, detail="teacher 角色必须提供 teacher_id")
+    user = UserDAO.add_user(db, body)
+    return user
+
+
+# ---------- 获取当前登录用户 ----------
+@router.get("/me", response_model=UserResponse, summary="获取当前登录用户信息")
+async def me(current_user: User = Depends(get_current_user)):
+    return current_user