用户登录功能

backend/app.py

@@ -6,16 +6,21 @@ import os
 
 def create_app():
     app = Flask(__name__)
-    
+
     # 配置
-    app.config['SECRET_KEY'] = 'your-secret-key-here'
+    app.config['SECRET_KEY'] = 'your-secret-key-here-change-in-production'
     app.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:///worklist.db'
     app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
-    
+
+    # Session配置
+    app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
+    app.config['SESSION_COOKIE_HTTPONLY'] = True
+    app.config['PERMANENT_SESSION_LIFETIME'] = 86400  # 24小时
+
     # 初始化扩展
     db.init_app(app)
-    CORS(app)  # 允许跨域请求
-    
+    CORS(app, supports_credentials=True)  # 允许跨域请求并支持凭证
+
     # 注册蓝图
     app.register_blueprint(api, url_prefix='/api')
     

backend/models.py

@@ -1,9 +1,34 @@
 from flask_sqlalchemy import SQLAlchemy
 from datetime import datetime
 from sqlalchemy import func
+from werkzeug.security import generate_password_hash, check_password_hash
 
 db = SQLAlchemy()
 
+class User(db.Model):
+    """用户模型"""
+    __tablename__ = 'users'
+
+    id = db.Column(db.Integer, primary_key=True)
+    username = db.Column(db.String(80), unique=True, nullable=False)
+    password_hash = db.Column(db.String(200), nullable=False)
+    created_at = db.Column(db.DateTime, default=datetime.utcnow)
+
+    def set_password(self, password):
+        """设置密码（哈希加密）"""
+        self.password_hash = generate_password_hash(password)
+
+    def check_password(self, password):
+        """验证密码"""
+        return check_password_hash(self.password_hash, password)
+
+    def to_dict(self):
+        return {
+            'id': self.id,
+            'username': self.username,
+            'created_at': self.created_at.isoformat() if self.created_at else None
+        }
+
 class Task(db.Model):
     """任务模型"""
     __tablename__ = 'tasks'

backend/routes.py

@@ -1,11 +1,81 @@
-from flask import Blueprint, request, jsonify
+from flask import Blueprint, request, jsonify, session
 from datetime import datetime, timedelta
-from models import db, Task, TimeRecord
+from models import db, Task, TimeRecord, User
 from ai_service import ai_service
 import json
 
 api = Blueprint('api', __name__)
 
+# 认证API
+@api.route('/auth/login', methods=['POST'])
+def login():
+    """用户登录"""
+    data = request.get_json()
+
+    if not data or 'username' not in data or 'password' not in data:
+        return jsonify({'error': '用户名和密码不能为空'}), 400
+
+    username = data['username']
+    password = data['password']
+
+    user = User.query.filter_by(username=username).first()
+
+    if user and user.check_password(password):
+        # 登录成功，设置session
+        session['user_id'] = user.id
+        session['username'] = user.username
+        return jsonify({
+            'message': '登录成功',
+            'user': user.to_dict()
+        })
+    else:
+        return jsonify({'error': '用户名或密码错误'}), 401
+
+@api.route('/auth/logout', methods=['POST'])
+def logout():
+    """用户登出"""
+    session.clear()
+    return jsonify({'message': '登出成功'})
+
+@api.route('/auth/check', methods=['GET'])
+def check_auth():
+    """检查登录状态"""
+    if 'user_id' in session:
+        user = User.query.get(session['user_id'])
+        if user:
+            return jsonify({
+                'authenticated': True,
+                'user': user.to_dict()
+            })
+    return jsonify({'authenticated': False}), 401
+
+@api.route('/auth/register', methods=['POST'])
+def register():
+    """用户注册（可选，用于创建初始用户）"""
+    data = request.get_json()
+
+    if not data or 'username' not in data or 'password' not in data:
+        return jsonify({'error': '用户名和密码不能为空'}), 400
+
+    username = data['username']
+    password = data['password']
+
+    # 检查用户是否已存在
+    if User.query.filter_by(username=username).first():
+        return jsonify({'error': '用户名已存在'}), 400
+
+    # 创建新用户
+    user = User(username=username)
+    user.set_password(password)
+
+    db.session.add(user)
+    db.session.commit()
+
+    return jsonify({
+        'message': '注册成功',
+        'user': user.to_dict()
+    }), 201
+
 # 任务管理API
 @api.route('/tasks', methods=['GET'])
 def get_tasks():