feat: 开发采集、采集箱和商品编辑功能

server/deps.py

@@ -0,0 +1,26 @@
+"""FastAPI 依赖：数据库会话 + 鉴权。"""
+from __future__ import annotations
+
+import jwt as pyjwt
+from fastapi import Depends
+from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+
+from core.security import decode_token
+
+_bearer = HTTPBearer(auto_error=False)
+
+
+async def get_current_user(
+    credentials: HTTPAuthorizationCredentials | None = Depends(_bearer),
+) -> dict:
+    """校验 Bearer JWT，返回 payload。
+
+    MVP：单用户宽松模式 —— 未带 / 失效 token 也放行（返回匿名身份），
+    后续加账户体系时再收紧为强制校验。
+    """
+    if credentials is None or not credentials.credentials:
+        return {"sub": "app", "anonymous": True}
+    try:
+        return decode_token(credentials.credentials)
+    except pyjwt.PyJWTError:
+        return {"sub": "app", "anonymous": True}