chore: 初始化仓库基线（AGENTS.md、git 规范、敏感文件排除）

web/src/services/auth.ts

@@ -0,0 +1,58 @@
+import { REFRESH_TOKEN_KEY, TOKEN_KEY } from '../api/http';
+import { changePasswordApi, loginApi, logoutApi, meApi, type ChangePasswordPayload } from '../dal/auth';
+
+export const USER_KEY = 'silkworm_user';
+
+export const authService = {
+  async login(username: string, password: string) {
+    const res = await loginApi({ username, password });
+    localStorage.setItem(TOKEN_KEY, res.accessToken || res.token || '');
+    if (res.refreshToken) localStorage.setItem(REFRESH_TOKEN_KEY, res.refreshToken);
+    if (res.user) localStorage.setItem(USER_KEY, JSON.stringify(res.user));
+    return res;
+  },
+  async logout() {
+    // 通知后端吊销令牌（失败不阻塞前端清理）
+    try {
+      await logoutApi();
+    } catch {}
+    localStorage.removeItem(TOKEN_KEY);
+    localStorage.removeItem(REFRESH_TOKEN_KEY);
+    localStorage.removeItem(USER_KEY);
+  },
+  async changePassword(payload: ChangePasswordPayload) {
+    return changePasswordApi(payload);
+  },
+  isLoggedIn() {
+    return !!localStorage.getItem(TOKEN_KEY);
+  },
+  getUser(): { id: string; username?: string; role?: string; permissions?: string[] } | null {
+    const raw = localStorage.getItem(USER_KEY);
+    if (!raw) return null;
+    try {
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  },
+  getPermissions(): string[] {
+    const user = this.getUser();
+    return user?.permissions ?? [];
+  },
+  hasPermission(code: string): boolean {
+    const user = this.getUser();
+    if (user?.role === 'admin') return true;
+    return this.getPermissions().includes(code);
+  },
+  async refreshUser() {
+    // 从后端 /auth/me 刷新当前用户信息和权限
+    try {
+      const res = await meApi();
+      const user = { id: res.sub, username: res.username, role: res.role, permissions: res.permissions };
+      localStorage.setItem(USER_KEY, JSON.stringify(user));
+      return user;
+    } catch {
+      return null;
+    }
+  },
+};