Step 2：用户 CRUD + bcrypt + JWT 真实鉴权 + RBAC 依赖

backend/app/api/v1/auth.py

@@ -1,11 +1,11 @@
-from datetime import timedelta
-
-from fastapi import APIRouter, HTTPException, status
+from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel, Field
+from sqlalchemy.ext.asyncio import AsyncSession
 
-from app.core.config import settings
-from app.core.security import create_access_token
-from app.schemas.user import Token
+from app.core.security import create_access_token, verify_password
+from app.core.deps import get_current_user, get_db_session
+from app.crud import user as user_crud
+from app.schemas.user import Token, UserRead
 
 
 class LoginRequest(BaseModel):
@@ -17,16 +17,29 @@ router = APIRouter()
 
 
 @router.post("/login", response_model=Token)
-async def login_for_access_token(payload: LoginRequest) -> Token:
-    if not (payload.username == "admin" and payload.password == "admin"):
+async def login_for_access_token(
+    payload: LoginRequest, db: AsyncSession = Depends(get_db_session)
+) -> Token:
+    db_user = await user_crud.get_by_username(db, payload.username)
+    if not db_user or not verify_password(payload.password, db_user.hashed_password):
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
             detail="Incorrect username or password",
         )
+    if not db_user.is_active:
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Inactive user",
+        )
 
     access_token = create_access_token(
-        subject="00000000-0000-0000-0000-000000000001",
-        role="PM",
-        expires_delta=timedelta(minutes=settings.JWT_EXPIRE_MINUTES),
+        user_id=str(db_user.id),
+        role=db_user.role,
+        expires_minutes=None,
     )
     return Token(access_token=access_token, token_type="bearer")
+
+
+@router.get("/me", response_model=UserRead)
+async def read_me(current_user=Depends(get_current_user)) -> UserRead:
+    return current_user