feat(auth): 支持多渠道登录态管理并新增webview重定向功能

- 修改get_current_user函数同时支持Authorization header和cookie获取token
- 在logout接口中添加JSONResponse并清除webview cookie登录态
- 新增webview模块实现URL token到cookie的转换和安全重定向功能
- 实现域名白名单校验防止开放重定向漏洞
- 在main.py中注册webview路由

routes/auth.py

@@ -24,10 +24,20 @@ class BindPhoneRequest(BaseModel):
 
 
 def get_current_user(request: Request):
+    token = ""
+
+    # 1. 优先从 Authorization header 取（小程序 API 调用方式）
     auth = request.headers.get("Authorization", "")
-    if not auth.startswith("Bearer "):
+    if auth.startswith("Bearer "):
+        token = auth[7:]
+
+    # 2. header 没有则从 cookie 取（webview H5 页面内请求方式）
+    if not token:
+        token = request.cookies.get("auth_token", "")
+
+    if not token:
         raise HTTPException(status_code=401, detail="缺少 token")
-    token = auth[7:]
+
     session = db.fetch_one(
         "SELECT s.user_id AS id FROM auth_sessions s "
         "WHERE s.token=%s AND s.expires_at>NOW()",
@@ -98,6 +108,8 @@ def verify(user=Depends(get_current_user)):
 
 @router.post("/logout")
 def logout(request: Request, user=Depends(get_current_user)):
+    from fastapi.responses import JSONResponse
+
     auth = request.headers.get("Authorization", "")
     if auth.startswith("Bearer "):
         db.execute("DELETE FROM auth_sessions WHERE token=%s", (auth[7:],))
@@ -106,4 +118,8 @@ def logout(request: Request, user=Depends(get_current_user)):
         "UPDATE auth_users SET wechat_openid=NULL WHERE id=%s",
         (user["id"],),
     )
-    return {"success": True}
+    resp = JSONResponse(content={"success": True})
+    # 同时清除 webview cookie 登录态
+    resp.delete_cookie(key="auth_token", path="/")
+    return resp
+