feat: allow temporary intranet no-login mode

backend/app/config.py

@@ -11,6 +11,7 @@ LEGACY_DEFAULT_SECRET = "change-me-to-a-long-random-string"
 class Settings(BaseSettings):
     # ---------- 运行环境 ----------
     environment: Literal["development", "test", "production"] = "development"
+    auth_enabled: bool = False
 
     # ---------- 数据库 ----------
     DATABASE_URL: str = "sqlite+aiosqlite:///./pingwatch.db"

backend/app/core/auth.py

@@ -27,7 +27,7 @@ from app.models.user import User, UserRoleEnum
 from app.core.deps import get_db
 
 logger = logging.getLogger("pingwatch.auth")
-security = HTTPBearer()
+security = HTTPBearer(auto_error=False)
 
 
 def create_access_token(data: dict, expires_delta: Optional[timedelta] = None) -> str:
@@ -99,10 +99,22 @@ async def exchange_code_for_user(code: str) -> Optional[dict]:
 
 
 async def get_current_user(
-    credentials: HTTPAuthorizationCredentials = Depends(security),
+    credentials: Optional[HTTPAuthorizationCredentials] = Depends(security),
     db: AsyncSession = Depends(get_db),
 ) -> User:
     """从 PingWatch JWT 中解析当前登录用户"""
+    if not settings.auth_enabled:
+        return User(
+            id=0,
+            casdoor_uid="local-anonymous-admin",
+            username="local-admin",
+            display_name="本地管理员",
+            role=UserRoleEnum.admin,
+            is_active=True,
+        )
+
+    if credentials is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="缺少认证信息")
     token = credentials.credentials
     try:
         payload = jwt.decode(token, settings.SECRET_KEY, algorithms=["HS256"])