feat: migrate from Element Plus to Ant Design Vue and update Vite configuration for better dependency management

- Updated Vite configuration to manually chunk Ant Design Vue for improved dependency management.
- Added a comprehensive migration testing checklist for transitioning from Element Plus 2.13.0 to Ant Design Vue 4.x, covering various components and functionalities.

backend/dependencies.py

@@ -1,9 +1,12 @@
 from datetime import datetime
 from typing import Optional
+import logging
 from fastapi import Depends, HTTPException, Header, status
 from sqlalchemy.orm import Session
 from backend.models import get_db, User
 
+logger = logging.getLogger(__name__)
+
 
 async def get_current_user(
     authorization: Optional[str] = Header(None),
@@ -11,7 +14,9 @@ async def get_current_user(
 ) -> User:
     """
     获取当前用户
-    从 Authorization header 中验证 Token 并返回用户
+    支持两种认证方式：
+    1. Token 认证（QQ 扫码登录）
+    2. User ID 认证（密码登录，格式：user_id:xxx）
     """
     if not authorization:
         raise HTTPException(
@@ -23,6 +28,40 @@ async def get_current_user(
     # 移除 "Bearer " 前缀（如果存在）
     token = authorization.replace("Bearer ", "") if authorization.startswith("Bearer ") else authorization
 
+    # 检查是否为 user_id 格式的认证（用于密码登录）
+    if token.startswith("user_id:"):
+        user_id_str = token.replace("user_id:", "")
+        try:
+            user_id = int(user_id_str)
+            user = db.query(User).filter(User.id == user_id).first()
+
+            if not user:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="用户不存在",
+                    headers={"WWW-Authenticate": "Bearer"},
+                )
+
+            # 用户ID认证成功，检查是否设置了密码
+            has_password = bool(user.password_hash)
+            if not has_password:
+                raise HTTPException(
+                    status_code=status.HTTP_401_UNAUTHORIZED,
+                    detail="该账户未设置密码，请使用扫码登录",
+                    headers={"WWW-Authenticate": "Bearer"},
+                )
+
+            # 密码登录的用户可以访问，无需检查 Token
+            return user
+
+        except ValueError:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="无效的用户ID格式",
+                headers={"WWW-Authenticate": "Bearer"},
+            )
+
+    # Token 认证（原有逻辑）
     # 从数据库查询用户
     user = db.query(User).filter(User.authorization == token).first()
 
@@ -39,13 +78,22 @@ async def get_current_user(
             exp_timestamp = int(user.jwt_exp)
             current_timestamp = int(datetime.now().timestamp())
             if current_timestamp > exp_timestamp:
-                raise HTTPException(
-                    status_code=status.HTTP_401_UNAUTHORIZED,
-                    detail="Token 已过期，请重新登录",
-                    headers={"WWW-Authenticate": "Bearer"},
-                )
-        except ValueError:
-            pass  # jwt_exp 格式不正确，跳过验证
+                # 如果用户设置了密码，允许继续使用（Token 过期但不强制退出）
+                has_password = bool(user.password_hash)
+                if has_password:
+                    # Token 过期但有密码，允许访问，但在响应头中添加警告
+                    # 注意：这里不抛出异常，让用户继续使用
+                    pass
+                else:
+                    # 没有密码的用户，Token 过期必须重新扫码登录
+                    raise HTTPException(
+                        status_code=status.HTTP_401_UNAUTHORIZED,
+                        detail="Token 已过期，请重新扫码登录",
+                        headers={"WWW-Authenticate": "Bearer"},
+                    )
+        except ValueError as e:
+            # jwt_exp 格式不正确，记录警告后跳过 Token 过期验证
+            logger.warning(f"用户 {user.id} ({user.alias}) 的 jwt_exp 格式不正确: {user.jwt_exp}, 错误: {e}")
 
     return user