feat: add cookie sessions and backend role authorization

backend/app/manage.py

@@ -0,0 +1,47 @@
+"""Local-only administrator provisioning. Passwords are read from the terminal, never argv."""
+
+import argparse
+import getpass
+
+from pydantic import ValidationError
+from sqlalchemy import select
+from sqlalchemy.exc import IntegrityError
+
+from app.db.session import SessionLocal
+from app.models.auth import User
+from app.schemas.auth import RegisterInput
+from app.services.auth import PASSWORD_HASHER
+
+
+def main():
+    parser = argparse.ArgumentParser(description="本机管理员初始化（须先完成数据库迁移）")
+    parser.add_argument("command", choices=["create-admin"])
+    parser.add_argument("--username", required=True)
+    args = parser.parse_args()
+    password = getpass.getpass("管理员密码（至少 15 字符）：")
+    if password != getpass.getpass("再次输入密码："):
+        parser.exit(1, "两次密码不一致\n")
+    try:
+        payload = RegisterInput(username=args.username, password=password)
+    except ValidationError:
+        parser.exit(1, "用户名须为 3–32 位字母开头的小写字母/数字/下划线；密码须为 15–128 字符\n")
+    with SessionLocal() as db:
+        if db.scalar(select(User.id).where(User.username == payload.username)) is not None:
+            parser.exit(1, "用户已存在，未修改原有用户或权限\n")
+        db.add(
+            User(
+                username=payload.username,
+                password_hash=PASSWORD_HASHER.hash(password),
+                role="admin",
+            )
+        )
+        try:
+            db.commit()
+        except IntegrityError:
+            db.rollback()
+            parser.exit(1, "用户已存在，未修改原有用户或权限\n")
+    print("管理员已创建；请通过登录接口建立会话。")
+
+
+if __name__ == "__main__":
+    main()