取消游客模式，强制登录后使用

backend/internal/handlers/admin.go

@@ -20,9 +20,9 @@ type AdminHandler struct {
 func allowedRolesForCreation(actor models.RoleName) []models.RoleName {
 	switch actor {
 	case models.RoleSystemAdmin:
-		return []models.RoleName{models.RoleAdmin, models.RoleUser, models.RoleGuest}
+		return []models.RoleName{models.RoleAdmin, models.RoleUser}
 	case models.RoleAdmin:
-		return []models.RoleName{models.RoleUser, models.RoleGuest}
+		return []models.RoleName{models.RoleUser}
 	default:
 		return nil
 	}

backend/internal/handlers/auth.go

@@ -153,13 +153,6 @@ func (h *AuthHandler) Logout(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"message": "登出成功"})
 }
 
-func (h *AuthHandler) PublicInfo(c *gin.Context) {
-	c.JSON(http.StatusOK, gin.H{
-		"message":       "欢迎访问 A股工具公开信息",
-		"guest_allowed": true,
-	})
-}
-
 func hashPassword(password string) (string, error) {
 	bytes, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
 	return string(bytes), err

backend/internal/middleware/auth.go

@@ -19,6 +19,11 @@ type CurrentUser struct {
 	Role     models.RoleName
 }
 
+var publicPaths = map[string]struct{}{
+	"/api/auth/register": {},
+	"/api/auth/login":    {},
+}
+
 func AuthMiddleware(cfg *config.Config, db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		authHeader := c.GetHeader("Authorization")
@@ -41,6 +46,17 @@ func AuthMiddleware(cfg *config.Config, db *gorm.DB) gin.HandlerFunc {
 			}
 		}
 
+		if _, exists := c.Get("currentUser"); !exists {
+			if c.Request.Method == "OPTIONS" {
+				c.Next()
+				return
+			}
+			if _, ok := publicPaths[c.Request.URL.Path]; !ok {
+				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"success": false, "error": "访问令牌无效或已过期"})
+				return
+			}
+		}
+
 		c.Next()
 	}
 }

backend/internal/models/user.go

@@ -13,7 +13,6 @@ const (
 	RoleSystemAdmin RoleName = "system_admin"
 	RoleAdmin       RoleName = "admin"
 	RoleUser        RoleName = "user"
-	RoleGuest       RoleName = "guest"
 )
 
 func (r RoleName) String() string { return string(r) }
@@ -43,10 +42,8 @@ func ParseRoleName(s string) (RoleName, error) {
 		return RoleAdmin, nil
 	case "user":
 		return RoleUser, nil
-	case "guest":
-		return RoleGuest, nil
 	default:
-		return RoleGuest, fmt.Errorf("unknown role: %s", s)
+		return "", fmt.Errorf("unknown role: %s", s)
 	}
 }
 
@@ -105,7 +102,6 @@ func SeedRoles(db *gorm.DB) error {
 		{Name: string(RoleSystemAdmin), Description: strPtr("系统管理员，可管理管理员与系统配置"), Permissions: `["*"]`},
 		{Name: string(RoleAdmin), Description: strPtr("管理员，可管理普通用户"), Permissions: `["users.read", "users.write", "users.create"]`},
 		{Name: string(RoleUser), Description: strPtr("普通用户，可访问业务功能"), Permissions: `["dashboard.read", "profile.write"]`},
-		{Name: string(RoleGuest), Description: strPtr("游客，仅可查看公开内容"), Permissions: `["public.read"]`},
 	}
 	for _, role := range roles {
 		var existing Role

backend/internal/routes/routes.go

@@ -30,8 +30,7 @@ func Setup(cfg *config.Config, db *gorm.DB) *gin.Engine {
 
 	r.Use(middleware.AuthMiddleware(cfg, db))
 
-	// 公开接口
-	r.GET("/api/public", authHandler.PublicInfo)
+	// 公开接口（仅登录/注册）
 	r.POST("/api/auth/register", authHandler.Register)
 	r.POST("/api/auth/login", authHandler.Login)