feat: auto complete stock change

flower/settings.py

@@ -49,6 +49,28 @@ DEBUG = env('DEBUG', default=False)
 ALLOWED_HOSTS = env.list('ALLOWED_HOSTS', default=[])
 
 
+# CORS 配置
+CORS_ALLOW_ALL_ORIGINS = DEBUG  # 开发环境允许所有源，生产环境需要配置白名单
+CORS_ALLOWED_ORIGINS = env.list('CORS_ALLOWED_ORIGINS', default=[
+    'http://localhost:3000',
+    'http://localhost:5173',
+    'http://127.0.0.1:3000',
+    'http://127.0.0.1:5173',
+])
+CORS_ALLOW_CREDENTIALS = True  # 允许携带凭证（如 Cookie、认证头）
+CORS_ALLOW_HEADERS = [
+    'accept',
+    'accept-encoding',
+    'authorization',
+    'content-type',
+    'dnt',
+    'origin',
+    'user-agent',
+    'x-csrftoken',
+    'x-requested-with',
+]
+
+
 # Application definition
 
 INSTALLED_APPS = [
@@ -59,6 +81,7 @@ INSTALLED_APPS = [
     'django.contrib.sessions',
     'django.contrib.messages',
     'django.contrib.staticfiles',  # 使用七牛云存储，不需要staticfiles app
+    'corsheaders',  # CORS 支持
     'rest_framework',
     'drf_spectacular',
     'basic_info',
@@ -70,6 +93,7 @@ INSTALLED_APPS = [
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',
+    'corsheaders.middleware.CorsMiddleware',  # CORS 中间件，必须放在 CommonMiddleware 之前
     'django.middleware.common.CommonMiddleware',
     'django.middleware.csrf.CsrfViewMiddleware',
     'django.contrib.auth.middleware.AuthenticationMiddleware',

flower/urls.py

@@ -17,16 +17,37 @@ Including another URLconf
 from django.contrib import admin
 from django.urls import path, include
 from stock.views import router
+from rest_framework.response import Response
+from drf_spectacular.views import SpectacularAPIView, SpectacularSwaggerView
+from sse.views import create_sse_event, push_sse_event
 from rest_framework_simplejwt.views import (
     TokenObtainPairView,
-    TokenRefreshView,
+    # TokenRefreshView,
 )
-from drf_spectacular.views import SpectacularAPIView, SpectacularSwaggerView
+
+class CustomTokenObtainPairView(TokenObtainPairView):
+    """自定义登录视图"""
+
+    def post(self, request, *args, **kwargs):
+        try:
+            resp = super().post(request, *args, **kwargs)
+            if resp.status_code == 200:
+                srz = self.get_serializer(data=request.data)
+                srz.is_valid()
+                user = srz.user
+
+                if not hasattr(user, 'employee'):
+                    # 非员工用户，直接返回登录失败
+                    return Response({'detail': '无绑定的员工身份'}, status=401)
+
+            return resp
+        except Exception as e:
+            return Response({'detail': '无法登录'}, status=400)
+
 
 urlpatterns = [
-
     # JWT 登录
-    path('api/auth/login/', TokenObtainPairView.as_view(), name='token_obtain_pair'),
+    path('api/auth/login/', CustomTokenObtainPairView.as_view(), name='token_obtain_pair'),
     # path('api/auth/refresh/', TokenRefreshView.as_view(), name='token_refresh'),
 
     # API 文档
@@ -37,4 +58,6 @@ urlpatterns = [
     path('stock/', router.urls),
     path('api/v1/', include('api_v1.urls')),
     path('api/backend/', include('api_man.urls')),
+    path('sse/', create_sse_event, name='sse_event'),
+    path('sse/push/', push_sse_event, name='push_sse_event'),
 ]