Feature/dev

.env.example

@@ -252,6 +252,8 @@ AGENT_SKILLS=
 # EMAIL_SENDER=
 # EMAIL_PASSWORD=
 # EMAIL_RECEIVERS=receiver@example.com  # 可选，留空则发给自己
+# EMAIL_SMTP_HOST=smtp.qq.com           # 可选，默认 smtp.qq.com（支持 QQ/163/Gmail 等）
+# EMAIL_SMTP_PORT=465                   # 可选，默认 465（SMTP_SSL）
 #
 # 【方式四扩展】股票分组发往不同邮箱（Issue #268，可选）
 # STOCK_LIST 决定实际分析范围；STOCK_GROUP_N 仅决定邮件发给谁，建议始终写成 STOCK_LIST 的子集
@@ -458,12 +460,15 @@ WEBUI_AUTO_BUILD=true
 # TRUST_X_FORWARDED_FOR=false
 
 # ===================================
-# Web 登录认证（可选）
+# Web 登录认证
 # ===================================
-# 设为 true 启用密码保护；首次访问时在网页设置初始密码，可在「系统设置 > 修改密码」中修改
-# 忘记密码可在服务器执行: python -m src.auth reset_password
-ADMIN_AUTH_ENABLED=false
+# 多用户模式：用户通过邮箱注册/登录，第一个注册用户自动继承旧数据。
+# 认证在首个用户注册后自动生效，无需手动配置。
+# ADMIN_AUTH_ENABLED 已废弃，保留仅供向后兼容。
+# ADMIN_AUTH_ENABLED=false
 # ADMIN_SESSION_MAX_AGE_HOURS=24  # Session 有效期（小时）
+# 应用外部访问地址（用于密码重置邮件中的链接，留空时自动从请求头推断）
+# APP_BASE_URL=https://your-domain.com
 
 # ===========================================
 # 图片识别股票代码（设置页「从图片添加」）

.gitignore

@@ -78,3 +78,6 @@ verify_*.py
 static/
 /apps/dsa-desktop/dist/
 /apps/dsa-desktop/node_modules/
+.python-version
+.gstack/
+.server.pid

AGENTS.md

@@ -243,3 +243,12 @@ gh run view <run_id> --log-failed
 - 自动 tag 默认不触发，只有 commit title 包含 `#patch`、`#minor`、`#major` 才会触发版本号更新。
 - 手动打 tag 必须使用 annotated tag。
 - 用户可见变更优先通过 PR 合入，并补齐 label 与验证说明。
+
+## graphify
+
+This project has a graphify knowledge graph at graphify-out/.
+
+Rules:
+- Before answering architecture or codebase questions, read graphify-out/GRAPH_REPORT.md for god nodes and community structure
+- If graphify-out/wiki/index.md exists, navigate it instead of reading raw files
+- After modifying code files in this session, run `python3 -c "from graphify.watch import _rebuild_code; from pathlib import Path; _rebuild_code(Path('.'))"` to keep the graph current

README.md

@@ -102,6 +102,18 @@
 
 `Settings` → `Secrets and variables` → `Actions` → `New repository secret`
 
+> **🎯 最小化可运行配置（~5 分钟）**
+>
+> 只要配好下面 3 个 Secret，系统就能跑起来。其它所有字段都是可选增强：
+>
+> | Secret | 示例值 | 作用 |
+> |---|---|---|
+> | `STOCK_LIST` | `600519,hk00700,AAPL` | 你的自选股（逗号分隔） |
+> | `GEMINI_API_KEY` | `AIza...`（[免费申请](https://aistudio.google.com/)） | 任意一个 AI Key 即可；替换为 `AIHUBMIX_KEY` / `ANTHROPIC_API_KEY` / `OPENAI_API_KEY` 等也可 |
+> | `TELEGRAM_BOT_TOKEN` + `TELEGRAM_CHAT_ID` | — | 任选一个推送渠道；也可替换为 `WECHAT_WEBHOOK_URL` / `FEISHU_WEBHOOK_URL` / `EMAIL_SENDER` 等 |
+>
+> 配好这 3 项后直接跳到 [第 3 步：启用 Actions](#3-启用-actions)。下方的完整表格只在你需要多数据源、多模型负载均衡、多通知渠道等进阶能力时再查。
+
 **AI 模型配置（至少配置一个）**
 
 > 详细配置说明见 [LLM 配置指南](docs/LLM_CONFIG_GUIDE.md)（极简接入、渠道模式、高级 YAML 路由、Vision、Agent、排错）。默认推荐先选服务商并填写 API Key；需要多模型时再启用渠道模式；只有高级用户才需要 YAML 路由配置。

api/deps.py

@@ -63,9 +63,26 @@ def get_database_manager() -> DatabaseManager:
 
 
 def get_system_config_service(request: Request) -> SystemConfigService:
-    """Get app-lifecycle shared SystemConfigService instance."""
+    """Get app-lifecycle shared SystemConfigService instance (fallback for non-user contexts)."""
     service = getattr(request.app.state, "system_config_service", None)
     if service is None:
         service = SystemConfigService()
         request.app.state.system_config_service = service
     return service
+
+
+def get_user_config_service(request: Request) -> SystemConfigService:
+    """Create a SystemConfigService backed by the current user's DB settings.
+
+    Falls back to the global .env-backed service when no authenticated user
+    is available (e.g. CLI, unauthenticated request).
+    """
+    user_id = getattr(request.state, "user_id", None)
+    if user_id:
+        from src.core.user_config_manager import UserConfigManager
+
+        db = DatabaseManager.get_instance()
+        manager = UserConfigManager(db._SessionLocal, user_id)
+        return SystemConfigService(manager=manager)
+    # Fallback to global .env for unauthenticated or CLI
+    return get_system_config_service(request)

api/middlewares/auth.py

@@ -1,6 +1,7 @@
 # -*- coding: utf-8 -*-
 """
-Auth middleware: protect /api/v1/* when admin auth is enabled.
+Auth middleware: protect /api/v1/* when users exist in the system.
+When no users have registered yet, all endpoints are open.
 """
 
 from __future__ import annotations
@@ -12,63 +13,76 @@
 from fastapi.responses import JSONResponse
 from starlette.middleware.base import BaseHTTPMiddleware
 
-from src.auth import COOKIE_NAME, is_auth_enabled, verify_session
+from src.auth import COOKIE_NAME, verify_session_user
 
 logger = logging.getLogger(__name__)
 
 EXEMPT_PATHS = frozenset({
     "/api/v1/auth/login",
+    "/api/v1/auth/register",
     "/api/v1/auth/status",
+    "/api/v1/auth/logout",
+    "/api/v1/auth/forgot-password",
+    "/api/v1/auth/reset-password",
     "/api/health",
     "/health",
     "/docs",
     "/redoc",
     "/openapi.json",
 })
 
+EXEMPT_PREFIXES = (
+    "/api/v1/share/",  # public share links
+)
+
 
 def _path_exempt(path: str) -> bool:
-    """Check if path is exempt from auth."""
     normalized = path.rstrip("/") or "/"
-    return normalized in EXEMPT_PATHS
+    if normalized in EXEMPT_PATHS:
+        return True
+    for prefix in EXEMPT_PREFIXES:
+        if normalized.startswith(prefix):
+            return True
+    return False
+
+
+def has_users() -> bool:
+    """Check if any users are registered. Lazy import to avoid circular deps."""
+    from src.storage import DatabaseManager, User
+    try:
+        db = DatabaseManager.get_instance()
+        with db.get_session() as session:
+            return session.query(User.id).first() is not None
+    except Exception:
+        return False
 
 
 class AuthMiddleware(BaseHTTPMiddleware):
-    """Require valid session for /api/v1/* when auth is enabled."""
-
-    async def dispatch(
-        self,
-        request: Request,
-        call_next: Callable,
-    ):
-        if not is_auth_enabled():
-            return await call_next(request)
+    """Require valid user session for /api/v1/* when users exist."""
 
+    async def dispatch(self, request: Request, call_next: Callable):
         path = request.url.path
+
+        if not path.startswith("/api/v1/"):
+            return await call_next(request)
+
         if _path_exempt(path):
             return await call_next(request)
 
-        if not path.startswith("/api/v1/"):
+        if not has_users():
             return await call_next(request)
 
         cookie_val = request.cookies.get(COOKIE_NAME)
-        if not cookie_val or not verify_session(cookie_val):
+        user_id = verify_session_user(cookie_val) if cookie_val else None
+        if not user_id:
             return JSONResponse(
                 status_code=401,
-                content={
-                    "error": "unauthorized",
-                    "message": "Login required",
-                },
+                content={"error": "unauthorized", "message": "Login required"},
             )
 
+        request.state.user_id = user_id
         return await call_next(request)
 
 
 def add_auth_middleware(app):
-    """Add auth middleware to protect API routes.
-
-    The middleware is always registered; whether auth is enforced is determined
-    at request time by is_auth_enabled() so the decision stays consistent across
-    any runtime configuration reload.
-    """
     app.add_middleware(AuthMiddleware)

api/middlewares/error_handler.py

@@ -17,6 +17,7 @@
 from fastapi import Request, Response
 from fastapi.responses import JSONResponse
 from starlette.middleware.base import BaseHTTPMiddleware
+from src.services.stock_identity_service import StockIdentityNotFound
 
 logger = logging.getLogger(__name__)
 
@@ -110,6 +111,18 @@ async def validation_exception_handler(request: Request, exc: RequestValidationE
             }
         )
 
+    @app.exception_handler(StockIdentityNotFound)
+    async def stock_identity_not_found_handler(request: Request, exc: StockIdentityNotFound):
+        """处理股票代码未找到异常（安全网）"""
+        return JSONResponse(
+            status_code=400,
+            content={
+                "error": "stock.identity_not_found",
+                "message": str(exc),
+                "detail": None
+            }
+        )
+
     @app.exception_handler(Exception)
     async def general_exception_handler(request: Request, exc: Exception):
         """处理通用异常"""

api/v1/endpoints/agent.py

@@ -9,7 +9,7 @@
 import uuid
 from typing import Any, Dict, List, Optional
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, Request
 from fastapi.responses import StreamingResponse
 from pydantic import AliasChoices, BaseModel, ConfigDict, Field
 
@@ -205,10 +205,11 @@ class SessionMessagesResponse(BaseModel):
 
 
 @router.get("/chat/sessions", response_model=SessionsResponse)
-async def list_chat_sessions(limit: int = 50, user_id: Optional[str] = None):
+async def list_chat_sessions(request: Request, limit: int = 50, user_id: Optional[str] = None):
     """获取聊天会话列表
 
     Args:
+        request: HTTP request (used to extract authenticated user_id).
         limit: Maximum number of sessions to return.
         user_id: Optional platform-prefixed user identifier for session
             isolation.  When provided, only sessions whose session_id
@@ -217,27 +218,31 @@ async def list_chat_sessions(limit: int = 50, user_id: Optional[str] = None):
             ``feishu_ou_abc``.
     """
     from src.storage import get_db
+    auth_user_id = getattr(request.state, "user_id", None)
     sessions = get_db().get_chat_sessions(
         limit=limit,
         session_prefix=user_id,
         extra_session_ids=[user_id] if user_id else None,
+        user_id=auth_user_id,
     )
     return SessionsResponse(sessions=sessions)
 
 
 @router.get("/chat/sessions/{session_id}", response_model=SessionMessagesResponse)
-async def get_chat_session_messages(session_id: str, limit: int = 100):
+async def get_chat_session_messages(request: Request, session_id: str, limit: int = 100):
     """获取单个会话的完整消息"""
     from src.storage import get_db
-    messages = get_db().get_conversation_messages(session_id, limit=limit)
+    auth_user_id = getattr(request.state, "user_id", None)
+    messages = get_db().get_conversation_messages(session_id, limit=limit, user_id=auth_user_id)
     return SessionMessagesResponse(session_id=session_id, messages=messages)
 
 
 @router.delete("/chat/sessions/{session_id}")
-async def delete_chat_session(session_id: str):
+async def delete_chat_session(request: Request, session_id: str):
     """删除指定会话"""
     from src.storage import get_db
-    count = get_db().delete_conversation_session(session_id)
+    auth_user_id = getattr(request.state, "user_id", None)
+    count = get_db().delete_conversation_session(session_id, user_id=auth_user_id)
     return {"deleted": count}