feat: 添加微信授权登录和修改昵称功能

server/app/config.py

@@ -36,6 +36,13 @@ class Settings(BaseSettings):
     wx_appid: str = ""
     wx_secret: str = ""
     
+    # JWT 配置
+    jwt_secret_key: str = "your-super-secret-key-change-in-production"
+    jwt_expire_hours: int = 168  # 7天
+    
+    # 文件上传配置
+    upload_path: str = "./uploads"
+    
     @property
     def database_url(self) -> str:
         return f"mysql+aiomysql://{self.db_user}:{self.db_password}@{self.db_host}:{self.db_port}/{self.db_name}"

server/app/main.py

@@ -1,12 +1,14 @@
 """
 星域故事汇 - Python后端服务
 """
+import os
 import uvicorn
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.staticfiles import StaticFiles
 
 from app.config import get_settings
-from app.routers import story, user, drafts
+from app.routers import story, user, drafts, upload
 
 settings = get_settings()
 
@@ -30,6 +32,11 @@ app.add_middleware(
 app.include_router(story.router, prefix="/api/stories", tags=["故事"])
 app.include_router(user.router, prefix="/api/user", tags=["用户"])
 app.include_router(drafts.router, prefix="/api", tags=["草稿箱"])
+app.include_router(upload.router, prefix="/api", tags=["上传"])
+
+# 静态文件服务（用于访问上传的图片）
+os.makedirs(settings.upload_path, exist_ok=True)
+app.mount("/uploads", StaticFiles(directory=settings.upload_path), name="uploads")
 
 
 @app.get("/")

server/app/routers/upload.py

@@ -0,0 +1,108 @@
+"""
+文件上传路由
+"""
+import os
+import uuid
+from datetime import datetime
+from fastapi import APIRouter, UploadFile, File, Depends, HTTPException
+from ..config import get_settings
+from ..utils.jwt_utils import get_current_user_id
+
+router = APIRouter(prefix="/upload", tags=["上传"])
+
+# 允许的图片格式
+ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'webp'}
+# 最大文件大小 (5MB)
+MAX_FILE_SIZE = 5 * 1024 * 1024
+
+def allowed_file(filename: str) -> bool:
+    """检查文件扩展名是否允许"""
+    return '.' in filename and filename.rsplit('.', 1)[1].lower() in ALLOWED_EXTENSIONS
+
+@router.post("/avatar")
+async def upload_avatar(
+    file: UploadFile = File(...),
+    user_id: int = Depends(get_current_user_id)
+):
+    """上传用户头像"""
+    # 检查文件类型
+    if not file.filename or not allowed_file(file.filename):
+        raise HTTPException(status_code=400, detail="不支持的文件格式")
+    
+    # 读取文件内容
+    content = await file.read()
+    
+    # 检查文件大小
+    if len(content) > MAX_FILE_SIZE:
+        raise HTTPException(status_code=400, detail="文件大小超过限制(5MB)")
+    
+    # 生成唯一文件名
+    ext = file.filename.rsplit('.', 1)[1].lower()
+    filename = f"{user_id}_{uuid.uuid4().hex[:8]}.{ext}"
+    
+    # 创建上传目录
+    settings = get_settings()
+    upload_dir = os.path.join(settings.upload_path, "avatars")
+    os.makedirs(upload_dir, exist_ok=True)
+    
+    # 保存文件
+    file_path = os.path.join(upload_dir, filename)
+    with open(file_path, "wb") as f:
+        f.write(content)
+    
+    # 返回访问URL
+    # 使用相对路径，前端拼接 baseUrl
+    avatar_url = f"/uploads/avatars/{filename}"
+    
+    return {
+        "code": 0,
+        "data": {
+            "url": avatar_url,
+            "filename": filename
+        },
+        "message": "上传成功"
+    }
+
+@router.post("/image")
+async def upload_image(
+    file: UploadFile = File(...),
+    user_id: int = Depends(get_current_user_id)
+):
+    """上传通用图片"""
+    # 检查文件类型
+    if not file.filename or not allowed_file(file.filename):
+        raise HTTPException(status_code=400, detail="不支持的文件格式")
+    
+    # 读取文件内容
+    content = await file.read()
+    
+    # 检查文件大小
+    if len(content) > MAX_FILE_SIZE:
+        raise HTTPException(status_code=400, detail="文件大小超过限制(5MB)")
+    
+    # 生成唯一文件名
+    ext = file.filename.rsplit('.', 1)[1].lower()
+    date_str = datetime.now().strftime("%Y%m%d")
+    filename = f"{date_str}_{uuid.uuid4().hex[:8]}.{ext}"
+    
+    # 创建上传目录
+    settings = get_settings()
+    upload_dir = os.path.join(settings.upload_path, "images")
+    os.makedirs(upload_dir, exist_ok=True)
+    
+    # 保存文件
+    file_path = os.path.join(upload_dir, filename)
+    with open(file_path, "wb") as f:
+        f.write(content)
+    
+    # 返回访问URL
+    image_url = f"/uploads/images/{filename}"
+    
+    return {
+        "code": 0,
+        "data": {
+            "url": image_url,
+            "filename": filename
+        },
+        "message": "上传成功"
+    }

server/app/routers/user.py

@@ -6,10 +6,13 @@ from sqlalchemy.ext.asyncio import AsyncSession
 from sqlalchemy import select, update, func, text, delete
 from typing import Optional
 from pydantic import BaseModel
+import httpx
 
 from app.database import get_db
 from app.models.user import User, UserProgress, UserEnding, PlayRecord
 from app.models.story import Story
+from app.config import get_settings
+from app.utils.jwt_utils import create_token, get_current_user_id, get_optional_user_id
 
 router = APIRouter()
 
@@ -59,9 +62,28 @@ class PlayRecordRequest(BaseModel):
 @router.post("/login")
 async def login(request: LoginRequest, db: AsyncSession = Depends(get_db)):
     """微信登录"""
-    # 实际部署时需要调用微信API获取openid
-    # 这里简化处理：用code作为openid
-    openid = request.code
+    settings = get_settings()
+    
+    # 调用微信API获取openid
+    if settings.wx_appid and settings.wx_secret:
+        try:
+            url = f"https://api.weixin.qq.com/sns/jscode2session?appid={settings.wx_appid}&secret={settings.wx_secret}&js_code={request.code}&grant_type=authorization_code"
+            async with httpx.AsyncClient() as client:
+                resp = await client.get(url, timeout=10.0)
+                data = resp.json()
+                
+                if "errcode" in data and data["errcode"] != 0:
+                    # 微信API返回错误，使用code作为openid（开发模式）
+                    print(f"[Login] 微信API错误: {data}")
+                    openid = request.code
+                else:
+                    openid = data.get("openid", request.code)
+        except Exception as e:
+            print(f"[Login] 调用微信API失败: {e}")
+            openid = request.code
+    else:
+        # 未配置微信密钥，开发模式：用code作为openid
+        openid = request.code
     
     # 查找或创建用户
     result = await db.execute(select(User).where(User.openid == openid))
@@ -79,6 +101,55 @@ async def login(request: LoginRequest, db: AsyncSession = Depends(get_db)):
         await db.commit()
         await db.refresh(user)
     
+    # 生成 JWT Token
+    token = create_token(user.id, user.openid)
+    
+    return {
+        "code": 0,
+        "data": {
+            "userId": user.id,
+            "openid": user.openid,
+            "nickname": user.nickname,
+            "avatarUrl": user.avatar_url,
+            "gender": user.gender,
+            "total_play_count": user.total_play_count,
+            "total_endings": user.total_endings,
+            "token": token
+        }
+    }
+
+
+@router.post("/refresh-token")
+async def refresh_token(user_id: int = Depends(get_current_user_id), db: AsyncSession = Depends(get_db)):
+    """刷新 Token"""
+    # 查找用户
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    
+    if not user:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    
+    # 生成新 Token
+    new_token = create_token(user.id, user.openid)
+    
+    return {
+        "code": 0,
+        "data": {
+            "token": new_token,
+            "userId": user.id
+        }
+    }
+
+
+@router.get("/me")
+async def get_current_user(user_id: int = Depends(get_current_user_id), db: AsyncSession = Depends(get_db)):
+    """获取当前用户信息（通过 Token 验证）"""
+    result = await db.execute(select(User).where(User.id == user_id))
+    user = result.scalar_one_or_none()
+    
+    if not user:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    
     return {
         "code": 0,
         "data": {

server/app/utils/__init__.py

@@ -0,0 +1,6 @@
+"""
+工具模块
+"""
+from .jwt_utils import create_token, verify_token, get_current_user_id, get_optional_user_id
+
+__all__ = ["create_token", "verify_token", "get_current_user_id", "get_optional_user_id"]

server/app/utils/jwt_utils.py

@@ -0,0 +1,78 @@
+"""
+JWT 工具函数
+"""
+import jwt
+from datetime import datetime, timedelta
+from typing import Optional
+from fastapi import HTTPException, Depends, Header
+from app.config import get_settings
+
+
+def create_token(user_id: int, openid: str) -> str:
+    """
+    创建 JWT Token
+    """
+    settings = get_settings()
+    expire = datetime.utcnow() + timedelta(hours=settings.jwt_expire_hours)
+    
+    payload = {
+        "user_id": user_id,
+        "openid": openid,
+        "exp": expire,
+        "iat": datetime.utcnow()
+    }
+    
+    token = jwt.encode(payload, settings.jwt_secret_key, algorithm="HS256")
+    return token
+
+
+def verify_token(token: str) -> dict:
+    """
+    验证 JWT Token
+    返回 payload 或抛出异常
+    """
+    settings = get_settings()
+    
+    try:
+        payload = jwt.decode(token, settings.jwt_secret_key, algorithms=["HS256"])
+        return payload
+    except jwt.ExpiredSignatureError:
+        raise HTTPException(status_code=401, detail="Token已过期，请重新登录")
+    except jwt.InvalidTokenError:
+        raise HTTPException(status_code=401, detail="无效的Token")
+
+
+def get_current_user_id(authorization: Optional[str] = Header(None, alias="Authorization")) -> int:
+    """
+    从 Header 中获取并验证 Token，返回 user_id
+    用作 FastAPI 依赖注入
+    """
+    if not authorization:
+        raise HTTPException(status_code=401, detail="未提供身份令牌")
+    
+    # 支持 "Bearer xxx" 格式
+    token = authorization
+    if authorization.startswith("Bearer "):
+        token = authorization[7:]
+    
+    payload = verify_token(token)
+    return payload.get("user_id")
+
+
+def get_optional_user_id(authorization: Optional[str] = Header(None, alias="Authorization")) -> Optional[int]:
+    """
+    可选的用户验证，未提供 Token 时返回 None
+    用于不强制要求登录的接口
+    """
+    if not authorization:
+        return None
+    
+    try:
+        token = authorization
+        if authorization.startswith("Bearer "):
+            token = authorization[7:]
+        
+        payload = verify_token(token)
+        return payload.get("user_id")
+    except HTTPException:
+        return None