feat: 实现后端核心业务逻辑 (Auth鉴权、二维码服务、看板与产品端点)

backend/app/services/auth_service.py

@@ -0,0 +1,98 @@
+"""认证服务 — 对接 MOM 系统 sys_user 表 + Track 自有 JWT"""
+from fastapi import HTTPException, status, Depends
+from fastapi.security import HTTPBearer, HTTPAuthorizationCredentials
+from jose import JWTError, jwt
+from werkzeug.security import check_password_hash
+
+from app.core.config import settings
+from app.core.security import create_access_token, ALGORITHM
+from app.core.mom_database import MomSessionLocal
+from app.schemas.user import LoginResponse, UserResponse
+
+security = HTTPBearer()
+
+
+def login(username: str, password: str) -> LoginResponse:
+    """登录 — 查询 MOM 数据库 sys_user 表验证"""
+    db = MomSessionLocal()
+    try:
+        # 1. 超级管理员硬编码（和 MOM 系统一致）
+        if username == "IRIS" and password == "123321":
+            return LoginResponse(
+                access_token=create_access_token(
+                    data={"sub": "0", "role": "SUPER_ADMIN"}
+                ),
+                user=UserResponse(
+                    id="0",
+                    username="IRIS",
+                    display_name="超级管理员",
+                    role="SUPER_ADMIN",
+                ),
+            )
+
+        # 2. 普通用户：LIKE '%/username' 模糊匹配 MOM sys_user 表
+        from sqlalchemy import text
+        result = db.execute(
+            text(
+                "SELECT id, username, department, role, password_hash "
+                "FROM sys_user "
+                "WHERE username LIKE :pattern"
+            ),
+            {"pattern": f"%/{username}"},
+        )
+        row = result.fetchone()
+
+        if not row:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="用户名或密码错误",
+            )
+
+        user_id, full_username, department, role, password_hash = row
+
+        # 3. Werkzeug scrypt 密码验证
+        if not check_password_hash(password_hash, password):
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="用户名或密码错误",
+            )
+
+        # 4. 解析 display_name（"张三/zhangsan01" → "张三"）
+        display_name = full_username.split("/")[0] if "/" in full_username else full_username
+
+        token = create_access_token(
+            data={
+                "sub": str(user_id),
+                "role": role or "operator",
+                "username": username,
+                "display_name": display_name,
+            }
+        )
+
+        return LoginResponse(
+            access_token=token,
+            user=UserResponse(
+                id=str(user_id),
+                username=username,
+                display_name=display_name,
+                role=role or "operator",
+            ),
+        )
+
+    finally:
+        db.close()
+
+
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials = Depends(security),
+) -> dict:
+    """从 Bearer Token 解析当前用户（不查数据库，直接解 JWT）"""
+    token = credentials.credentials
+    try:
+        payload = jwt.decode(token, settings.SECRET_KEY, algorithms=[ALGORITHM])
+        user_id = payload.get("sub")
+        if not user_id:
+            raise HTTPException(status_code=401, detail="无效的 Token")
+        return payload
+    except JWTError:
+        raise HTTPException(status_code=401, detail="无效的 Token")

backend/app/services/dashboard_service.py

@@ -0,0 +1,41 @@
+"""Dashboard 统计服务"""
+from sqlalchemy import select, func
+from sqlalchemy.ext.asyncio import AsyncSession
+from pydantic import BaseModel
+
+
+class DashboardStats(BaseModel):
+    products_total: int
+    products_pending: int
+    products_in_progress: int
+    products_completed: int
+    tasks_total: int
+    tasks_pending: int
+    tasks_in_progress: int
+    tasks_completed: int
+
+
+async def get_dashboard_stats(db: AsyncSession) -> DashboardStats:
+    from app.models.product import Product
+    from app.models.task import Task
+
+    p_total = await db.scalar(select(func.count(Product.id)))
+    p_pending = await db.scalar(select(func.count(Product.id)).where(Product.status == "pending"))
+    p_progress = await db.scalar(select(func.count(Product.id)).where(Product.status == "in_progress"))
+    p_done = await db.scalar(select(func.count(Product.id)).where(Product.status == "completed"))
+
+    t_total = await db.scalar(select(func.count(Task.id)))
+    t_pending = await db.scalar(select(func.count(Task.id)).where(Task.status == "pending"))
+    t_progress = await db.scalar(select(func.count(Task.id)).where(Task.status == "in_progress"))
+    t_done = await db.scalar(select(func.count(Task.id)).where(Task.status == "completed"))
+
+    return DashboardStats(
+        products_total=p_total or 0,
+        products_pending=p_pending or 0,
+        products_in_progress=p_progress or 0,
+        products_completed=p_done or 0,
+        tasks_total=t_total or 0,
+        tasks_pending=t_pending or 0,
+        tasks_in_progress=t_progress or 0,
+        tasks_completed=t_done or 0,
+    )

backend/app/services/qrcode_service.py

@@ -0,0 +1,34 @@
+"""二维码生成服务 — 参考 MOM 系统 label_service.py 的 QR 生成逻辑"""
+import io
+import qrcode
+from qrcode.image.pil import PilImage
+
+
+def generate_qrcode_png(content: str, size_px: int = 300) -> io.BytesIO:
+    """
+    生成二维码 PNG 图片，返回 BytesIO 流。
+
+    参数:
+        content: 二维码内容（如 16 位序列号）
+        size_px: 输出图片尺寸（像素），默认 300×300
+
+    返回:
+        io.BytesIO: PNG 格式的图片字节流
+    """
+    qr = qrcode.QRCode(
+        version=1,
+        error_correction=qrcode.constants.ERROR_CORRECT_M,
+        box_size=10,
+        border=2,
+    )
+    qr.add_data(content)
+    qr.make(fit=True)
+
+    img: PilImage = qr.make_image(fill_color="black", back_color="white")
+    img = img.convert("RGB")
+    img = img.resize((size_px, size_px))
+
+    buf = io.BytesIO()
+    img.save(buf, format="PNG")
+    buf.seek(0)
+    return buf