feat: AI套图分层方案 + Gemini集成 - 4种图案类型处理 + 正片叠底 + 宽高比 + 模型选择

Co-authored-by: Cursor <cursoragent@cursor.com>

Server/app/api/v1/admin.py

@@ -1,6 +1,6 @@
 import os
 import shutil
-from fastapi import APIRouter, Depends, UploadFile, File, HTTPException, status, Form
+from fastapi import APIRouter, Depends, UploadFile, File, HTTPException, status, Form, Header
 from sqlalchemy.orm import Session
 from app.db import get_db
 from app.models.group import PluginGroup as DBPluginGroup
@@ -8,21 +8,21 @@ from app.models.user import User
 from app.schemas.group import PluginGroupCreate, PluginGroupUpdate, PluginGroup
 from app.schemas.admin import UserInfo
 from app.core.config import settings
-from typing import List
+from typing import List, Optional
 
 router = APIRouter()
 
-# Hardcoded admin token for simplicity as per requirements
-ADMIN_TOKEN = "admin-secret-token"
+# 从配置读取管理员令牌
+ADMIN_TOKEN = settings.ADMIN_TOKEN
 
 def verify_admin(token: str = Form(...)):
     if token != ADMIN_TOKEN:
-        raise HTTPException(status_code=403, detail="Admin permission required")
+        raise HTTPException(status_code=403, detail="需要管理员权限")
 
-def get_admin_dep(x_admin_token: str = None):
-    # Alternative using header
+def verify_admin_header(x_admin_token: Optional[str] = Header(None, alias="X-Admin-Token")):
+    """通过 Header 验证管理员身份"""
     if x_admin_token != ADMIN_TOKEN:
-         raise HTTPException(status_code=403, detail="Admin permission required")
+        raise HTTPException(status_code=403, detail="需要管理员权限")
 
 # Ensure archives directory exists
 ARCHIVES_DIR = "archives"
@@ -31,11 +31,11 @@ os.makedirs(ARCHIVES_DIR, exist_ok=True)
 @router.post("/upload_version")
 async def upload_version(
     file: UploadFile = File(...),
-    # token: str = Form(...), # Simple auth
+    token: str = Form(...),
     db: Session = Depends(get_db)
 ):
-    # if token != ADMIN_TOKEN:
-    #     raise HTTPException(status_code=403, detail="Invalid admin token")
+    if token != ADMIN_TOKEN:
+        raise HTTPException(status_code=403, detail="Invalid admin token")
     
     file_location = os.path.join(ARCHIVES_DIR, file.filename)
     with open(file_location, "wb+") as file_object:
@@ -44,7 +44,7 @@ async def upload_version(
     return {"code": 200, "message": f"File '{file.filename}' uploaded successfully", "filename": file.filename}
 
 @router.get("/archives")
-async def list_archives():
+async def list_archives(_: None = Depends(verify_admin_header)):
     if not os.path.exists(ARCHIVES_DIR):
         return []
     files = os.listdir(ARCHIVES_DIR)
@@ -53,7 +53,7 @@ async def list_archives():
     return files
 
 @router.post("/groups", response_model=PluginGroup)
-async def create_group(group: PluginGroupCreate, db: Session = Depends(get_db)):
+async def create_group(group: PluginGroupCreate, db: Session = Depends(get_db), _: None = Depends(verify_admin_header)):
     db_group = DBPluginGroup(**group.model_dump())
     db.add(db_group)
     db.commit()
@@ -61,11 +61,11 @@ async def create_group(group: PluginGroupCreate, db: Session = Depends(get_db)):
     return db_group
 
 @router.get("/groups", response_model=List[PluginGroup])
-async def list_groups(db: Session = Depends(get_db)):
+async def list_groups(db: Session = Depends(get_db), _: None = Depends(verify_admin_header)):
     return db.query(DBPluginGroup).all()
 
 @router.put("/groups/{group_id}", response_model=PluginGroup)
-async def update_group(group_id: int, group_update: PluginGroupUpdate, db: Session = Depends(get_db)):
+async def update_group(group_id: int, group_update: PluginGroupUpdate, db: Session = Depends(get_db), _: None = Depends(verify_admin_header)):
     db_group = db.query(DBPluginGroup).filter(DBPluginGroup.id == group_id).first()
     if not db_group:
         raise HTTPException(status_code=404, detail="Group not found")
@@ -79,11 +79,11 @@ async def update_group(group_id: int, group_update: PluginGroupUpdate, db: Sessi
     return db_group
 
 @router.get("/users", response_model=List[UserInfo])
-async def list_users(db: Session = Depends(get_db)):
+async def list_users(db: Session = Depends(get_db), _: None = Depends(verify_admin_header)):
     return db.query(User).all()
 
 @router.put("/users/{user_id}/group")
-async def update_user_group(user_id: int, group_id: int, db: Session = Depends(get_db)):
+async def update_user_group(user_id: int, group_id: int, db: Session = Depends(get_db), _: None = Depends(verify_admin_header)):
     user = db.query(User).filter(User.id == user_id).first()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")
@@ -97,7 +97,7 @@ async def update_user_group(user_id: int, group_id: int, db: Session = Depends(g
     return {"code": 200, "message": "User group updated"}
 
 @router.put("/users/{user_id}/permissions")
-async def update_user_permissions(user_id: int, permissions: str = Form(...), db: Session = Depends(get_db)):
+async def update_user_permissions(user_id: int, permissions: str = Form(...), db: Session = Depends(get_db), _: None = Depends(verify_admin_header)):
     user = db.query(User).filter(User.id == user_id).first()
     if not user:
         raise HTTPException(status_code=404, detail="User not found")