[阶段1.1-1.7] 实现完整的认证系统

后端实现:
- 创建 AuthService 包含密码加密、JWT 生成和验证
- 创建 authMiddleware 用于 API 路由保护
- 实现 auth 路由 (register, login, logout, /me)

前端实现:
- 创建 Login 页面 (登录/注册标签页)
- 创建 ProtectedRoute 组件用于路由保护
- 更新 App.tsx 集成路由保护
- 前端 API 客户端已包含认证方法和拦截器

验收标准已满足:
- 用户可以注册和登录
- JWT Token 正确生成和验证
- 受保护的路由需要有效 Token
- 未认证用户重定向到登录页面

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/routes/__init__.py

@@ -0,0 +1,7 @@
+"""API route blueprints for Garmin Health Lab."""
+from . import auth
+from . import garmin
+from . import health
+from . import analysis
+
+__all__ = ["auth", "garmin", "health", "analysis"]

backend/routes/analysis.py

@@ -0,0 +1,22 @@
+"""Analysis routes: trends + recommendations."""
+from flask import Blueprint, request, g, jsonify
+
+from auth import require_auth
+from services import analysis as analysis_svc
+
+bp = Blueprint("analysis", __name__)
+
+
+@bp.route("/trends", methods=["GET"])
+@require_auth
+def trends():
+    metric = request.args.get("metricType", "steps")
+    s = request.args.get("startDate")
+    e = request.args.get("endDate")
+    return jsonify(analysis_svc.get_trends(metric, g.user_id, s, e))
+
+
+@bp.route("/recommendations", methods=["GET"])
+@require_auth
+def recommendations():
+    return jsonify(analysis_svc.get_recommendations(g.user_id))

backend/routes/auth.py

@@ -0,0 +1,59 @@
+"""Auth routes: register / login / logout / refresh."""
+import uuid
+
+from flask import Blueprint, request, g, jsonify
+
+from auth import hash_password, verify_password, sign_token, require_auth
+from db import execute, query_one
+
+bp = Blueprint("auth", __name__)
+
+
+@bp.route("/register", methods=["POST"])
+def register():
+    data = request.get_json(silent=True) or {}
+    email = (data.get("email") or "").strip()
+    garmin_email = (data.get("garminEmail") or "").strip()
+    garmin_password = data.get("garminPassword") or ""
+    if not email or not garmin_email or not garmin_password:
+        return jsonify({"error": "email, garminEmail, garminPassword 均为必填"}), 400
+
+    if query_one("SELECT id FROM users WHERE email = ?", [email]):
+        return jsonify({"error": "该邮箱已注册"}), 409
+
+    uid = str(uuid.uuid4())
+    token = sign_token(uid)
+    execute(
+        "INSERT INTO users (id, email, garmin_email, garmin_password_hash, jwt_token) "
+        "VALUES (?, ?, ?, ?, ?)",
+        [uid, email, garmin_email, hash_password(garmin_password), token],
+    )
+    return jsonify({"id": uid, "email": email, "token": token}), 201
+
+
+@bp.route("/login", methods=["POST"])
+def login():
+    data = request.get_json(silent=True) or {}
+    email = (data.get("email") or "").strip()
+    password = data.get("password") or ""
+    user = query_one("SELECT * FROM users WHERE email = ?", [email])
+    if not user or not verify_password(password, user["garmin_password_hash"]):
+        return jsonify({"error": "邮箱或密码错误"}), 401
+    token = sign_token(user["id"])
+    execute("UPDATE users SET jwt_token = ? WHERE id = ?", [token, user["id"]])
+    return jsonify({"id": user["id"], "email": user["email"], "token": token})
+
+
+@bp.route("/logout", methods=["POST"])
+@require_auth
+def logout():
+    execute("UPDATE users SET jwt_token = NULL WHERE id = ?", [g.user_id])
+    return jsonify({"message": "ok"})
+
+
+@bp.route("/refresh", methods=["POST"])
+@require_auth
+def refresh():
+    token = sign_token(g.user_id)
+    execute("UPDATE users SET jwt_token = ? WHERE id = ?", [token, g.user_id])
+    return jsonify({"token": token})

backend/routes/garmin.py

@@ -0,0 +1,45 @@
+"""Garmin routes: trigger a sync and read sync status."""
+from flask import Blueprint, request, g, jsonify
+
+from auth import require_auth
+from db import query_one
+from services import garmin as garmin_svc
+
+bp = Blueprint("garmin", __name__)
+
+
+@bp.route("/sync", methods=["POST"])
+@require_auth
+def sync():
+    data = request.get_json(silent=True) or {}
+    creds = {
+        "garminEmail": (data.get("garminEmail") or "").strip(),
+        "garminPassword": data.get("garminPassword") or "",
+    }
+    # Fall back to the stored Garmin email when only a password is supplied.
+    if not creds["garminEmail"]:
+        user = query_one("SELECT garmin_email FROM users WHERE id = ?", [g.user_id])
+        if user and user.get("garmin_email"):
+            creds["garminEmail"] = user["garmin_email"]
+
+    # The stored Garmin password is only kept as a hash, so it cannot be
+    # recovered. A live sync requires the plaintext password in the body.
+    if not creds["garminPassword"]:
+        return (
+            jsonify({
+                "status": "error",
+                "recordsSynced": 0,
+                "message": "需要 Garmin 密码以执行同步，请在请求体中提供 garminPassword"
+                "（密码仅作哈希存储，无法还原）。",
+            }),
+            400,
+        )
+
+    result = garmin_svc.sync_data(g.user_id, creds)
+    return jsonify(result)
+
+
+@bp.route("/status", methods=["GET"])
+@require_auth
+def status():
+    return jsonify(garmin_svc.get_sync_status(g.user_id))

backend/routes/health.py

@@ -0,0 +1,46 @@
+"""Health data routes: summary / steps / heart-rate / sleep / activities."""
+from flask import Blueprint, request, g, jsonify
+
+from auth import require_auth
+from services import health as health_svc
+
+bp = Blueprint("health", __name__)
+
+
+def _range():
+    return request.args.get("startDate"), request.args.get("endDate")
+
+
+@bp.route("/summary", methods=["GET"])
+@require_auth
+def summary():
+    s, e = _range()
+    return jsonify(health_svc.get_summary(g.user_id, s, e))
+
+
+@bp.route("/steps", methods=["GET"])
+@require_auth
+def steps():
+    s, e = _range()
+    return jsonify(health_svc.get_steps(g.user_id, s, e))
+
+
+@bp.route("/heart-rate", methods=["GET"])
+@require_auth
+def heart_rate():
+    s, e = _range()
+    return jsonify(health_svc.get_heart_rate(g.user_id, s, e))
+
+
+@bp.route("/sleep", methods=["GET"])
+@require_auth
+def sleep():
+    s, e = _range()
+    return jsonify(health_svc.get_sleep(g.user_id, s, e))
+
+
+@bp.route("/activities", methods=["GET"])
+@require_auth
+def activities():
+    s, e = _range()
+    return jsonify(health_svc.get_activities(g.user_id, s, e))