feat: allow temporary intranet no-login mode

backend/app/config.py

@@ -11,6 +11,7 @@ LEGACY_DEFAULT_SECRET = "change-me-to-a-long-random-string"
 class Settings(BaseSettings):
     # ---------- 运行环境 ----------
     environment: Literal["development", "test", "production"] = "development"
+    auth_enabled: bool = False
 
     # ---------- 数据库 ----------
     DATABASE_URL: str = "sqlite+aiosqlite:///./pingwatch.db"

backend/app/core/auth.py

@@ -27,7 +27,7 @@ from app.models.user import User, UserRoleEnum
 from app.core.deps import get_db
 
 logger = logging.getLogger("pingwatch.auth")
-security = HTTPBearer()
+security = HTTPBearer(auto_error=False)
 
 
 def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
@@ -99,10 +99,22 @@ async def exchange_code_for_user(code: str) -> Optional[dict]:
 
 
 async def get_current_user(
-    credentials: HTTPAuthorizationCredentials = Depends(security),
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
     db: AsyncSession = Depends(get_db),
 ) -> User:
     """从 PingWatch JWT 中解析当前登录用户"""
+    if not settings.auth_enabled:
+        return User(
+            id=0,
+            casdoor_uid="local-anonymous-admin",
+            username="local-admin",
+            display_name="本地管理员",
+            role=UserRoleEnum.admin,
+            is_active=True,
+        )
+
+    if credentials is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="缺少认证信息")
     token = credentials.credentials
     try:
         payload = jwt.decode(token, settings.SECRET_KEY, algorithms=["HS256"])

backend/tests/test_auth_disabled.py

@@ -0,0 +1,29 @@
+"""Authentication switch behavior."""
+
+import pytest
+from fastapi import HTTPException
+
+from app.config import settings
+from app.core.auth import get_current_user
+from app.models.user import UserRoleEnum
+
+
+@pytest.mark.asyncio
+async def test_auth_disabled_provides_local_admin_without_token(monkeypatch):
+    monkeypatch.setattr(settings, "auth_enabled", False)
+
+    user = await get_current_user(credentials=None, db=None)
+
+    assert user.id == 0
+    assert user.username == "local-admin"
+    assert user.role == UserRoleEnum.admin
+
+
+@pytest.mark.asyncio
+async def test_auth_enabled_still_requires_a_token(monkeypatch):
+    monkeypatch.setattr(settings, "auth_enabled", True)
+
+    with pytest.raises(HTTPException) as exc_info:
+        await get_current_user(credentials=None, db=None)
+
+    assert exc_info.value.status_code == 401