添加用户鉴权

mini-program/app/routers/messages.py

@@ -9,6 +9,7 @@ from sqlalchemy.orm import Session
 try:
     # For module mode: `uvicorn app.main:app`
     from app.db import get_db
+    from app.security import get_current_user_id
     from app.schemas.message import (
         MessageCreateRequest,
         MessageCreateResponse,
@@ -18,6 +19,7 @@ try:
 except ModuleNotFoundError:
     # For script mode: `python app/main.py` or VS Code "Run Python File"
     from db import get_db
+    from security import get_current_user_id
     from schemas.message import (
         MessageCreateRequest,
         MessageCreateResponse,
@@ -106,14 +108,48 @@ def _get_existing_message(
     )
 
 
+def _assert_conversation_access(
+    db: Session,
+    conversation_id: int,
+    current_user_id: int,
+) -> None:
+    conversation_row = (
+        db.execute(
+            text(
+                """
+                SELECT id, user_low_id, user_high_id
+                FROM chat_conversation
+                WHERE id = :conversation_id
+                LIMIT 1
+                """
+            ),
+            {"conversation_id": conversation_id},
+        )
+        .mappings()
+        .first()
+    )
+    if not conversation_row:
+        raise HTTPException(status_code=404, detail="conversation not found")
+
+    if current_user_id not in (
+        int(conversation_row["user_low_id"]),
+        int(conversation_row["user_high_id"]),
+    ):
+        raise HTTPException(status_code=403, detail="no permission for this conversation")
+
+
 @router.post("", response_model=MessageCreateResponse, status_code=status.HTTP_201_CREATED)
 def create_message(
     payload: MessageCreateRequest,
     response: Response,
+    current_user_id: int = Depends(get_current_user_id),
     db: Session = Depends(get_db),
 ) -> MessageCreateResponse:
-    sender_user_id = payload.sender_user_id
+    sender_user_id = current_user_id
     peer_user_id = payload.peer_user_id
+    if sender_user_id == peer_user_id:
+        raise HTTPException(status_code=422, detail="peer_user_id cannot be same as current user")
+
     user_low_id = min(sender_user_id, peer_user_id)
     user_high_id = max(sender_user_id, peer_user_id)
 
@@ -303,17 +339,14 @@ def list_messages(
     conversation_id: int = Query(gt=0),
     cursor_seq: int | None = Query(default=None, ge=1),
     limit: int = Query(default=20, ge=1, le=100),
+    current_user_id: int = Depends(get_current_user_id),
     db: Session = Depends(get_db),
 ) -> MessageListResponse:
-    conversation_exists = (
-        db.execute(
-            text("SELECT 1 FROM chat_conversation WHERE id = :conversation_id LIMIT 1"),
-            {"conversation_id": conversation_id},
-        ).first()
-        is not None
+    _assert_conversation_access(
+        db=db,
+        conversation_id=conversation_id,
+        current_user_id=current_user_id,
     )
-    if not conversation_exists:
-        raise HTTPException(status_code=404, detail="conversation not found")
 
     sql = """
         SELECT