feat: 实现用户登录认证与权限控制系统

- 新增用户登录页面与API端点（/api/auth/login、/api/auth/logout、/api/auth/me） - 引入基于密码哈希的认证机制，支持默认管理员账号登录 - 创建访问控制模块（lib/access-control.ts），实现基于角色的权限验证 - 在现有API端点中集成权限检查，限制非管理员用户只能访问其所属项目数据 - 更新应用布局，要求用户登录后才能访问主界面 - 扩展用户表结构，增加用户名和密码哈希字段 - 调整项目、KR、目标、会议记录等资源的查询逻辑，根据用户权限过滤数据 - 改进管理页面（指标、模板）的删除操作，使用确认对话框替代直接确认 - 优化“我的KR”页面，为管理员提供全员KR概览视图 - 修复.gitignore文件中的拼写错误（.trae → .travis） - 添加数据库迁移脚本，支持任务直接关联项目、禁用RLS、添加求助字段等 - 配置Next.js以支持独立输出和子路径部署
2026-01-28 12:57:36 +08:00
parent e3e5e89df6
commit 7948b1afc7
50 changed files with 9506 additions and 150 deletions
--- a/app/api/auth/login/route.ts
+++ b/app/api/auth/login/route.ts
@@ -0,0 +1,117 @@
+export const dynamic = 'force-dynamic';
+export const runtime = 'nodejs';
+
+import { NextRequest, NextResponse } from 'next/server';
+import { supabase } from '@/lib/supabase';
+import { hashPassword, verifyPassword } from '@/lib/password';
+
+const DEFAULT_OWNER_USERNAME = 'baicaimiao';
+const DEFAULT_OWNER_PASSWORD = 'baicaimiao123';
+const DEFAULT_OWNER_NAME = '兜爸';
+
+export async function POST(request: NextRequest) {
+  const body = await request.json().catch(() => ({}));
+  const username = typeof body.username === 'string' ? body.username.trim() : '';
+  const password = typeof body.password === 'string' ? body.password : '';
+
+  if (!username || !password) {
+    return NextResponse.json({ error: '请输入账号和密码' }, { status: 400 });
+  }
+
+  const { data: userByUsername, error: usernameError } = await supabase
+    .from('users')
+    .select('id,name,role,avatar_url,username,password_hash,created_at,updated_at')
+    .eq('username', username)
+    .maybeSingle();
+
+  if (usernameError) {
+    return NextResponse.json({ error: usernameError.message }, { status: 500 });
+  }
+
+  if (userByUsername?.password_hash) {
+    const ok = verifyPassword(password, userByUsername.password_hash);
+    if (!ok) {
+      return NextResponse.json({ error: '账号或密码错误' }, { status: 401 });
+    }
+    const { password_hash, ...safeUser } = userByUsername as any;
+    const res = NextResponse.json({ user: safeUser });
+    res.cookies.set('okr_user_id', safeUser.id, {
+      httpOnly: true,
+      sameSite: 'lax',
+      secure: process.env.NODE_ENV === 'production',
+      path: '/',
+    });
+    return res;
+  }
+
+  if (username === DEFAULT_OWNER_USERNAME && password === DEFAULT_OWNER_PASSWORD) {
+    const { data: ownerUser, error: ownerError } = await supabase
+      .from('users')
+      .select('id,name,role,avatar_url,username,password_hash,created_at,updated_at')
+      .eq('role', 'owner')
+      .order('created_at', { ascending: true })
+      .limit(1)
+      .maybeSingle();
+
+    if (ownerError) {
+      return NextResponse.json({ error: ownerError.message }, { status: 500 });
+    }
+
+    const passwordHash = hashPassword(DEFAULT_OWNER_PASSWORD);
+
+    if (ownerUser) {
+      const { data: updated, error: updateError } = await supabase
+        .from('users')
+        .update({
+          name: DEFAULT_OWNER_NAME,
+          username: DEFAULT_OWNER_USERNAME,
+          password_hash: passwordHash,
+          role: 'owner',
+          updated_at: new Date().toISOString(),
+        })
+        .eq('id', ownerUser.id)
+        .select('id,name,role,avatar_url,username,created_at,updated_at')
+        .single();
+
+      if (updateError) {
+        return NextResponse.json({ error: updateError.message }, { status: 500 });
+      }
+
+      const res = NextResponse.json({ user: updated });
+      res.cookies.set('okr_user_id', updated.id, {
+        httpOnly: true,
+        sameSite: 'lax',
+        secure: process.env.NODE_ENV === 'production',
+        path: '/',
+      });
+      return res;
+    }
+
+    const { data: created, error: createError } = await supabase
+      .from('users')
+      .insert({
+        name: DEFAULT_OWNER_NAME,
+        role: 'owner',
+        avatar_url: null,
+        username: DEFAULT_OWNER_USERNAME,
+        password_hash: passwordHash,
+      })
+      .select('id,name,role,avatar_url,username,created_at,updated_at')
+      .single();
+
+    if (createError) {
+      return NextResponse.json({ error: createError.message }, { status: 500 });
+    }
+
+    const res = NextResponse.json({ user: created });
+    res.cookies.set('okr_user_id', created.id, {
+      httpOnly: true,
+      sameSite: 'lax',
+      secure: process.env.NODE_ENV === 'production',
+      path: '/',
+    });
+    return res;
+  }
+
+  return NextResponse.json({ error: '账号或密码错误' }, { status: 401 });
+}
--- a/app/api/auth/logout/route.ts
+++ b/app/api/auth/logout/route.ts
@@ -0,0 +1,15 @@
+export const dynamic = 'force-dynamic';
+
+import { NextResponse } from 'next/server';
+
+export async function POST() {
+  const res = NextResponse.json({ success: true });
+  res.cookies.set('okr_user_id', '', {
+    httpOnly: true,
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    path: '/',
+    expires: new Date(0),
+  });
+  return res;
+}
--- a/app/api/auth/me/route.ts
+++ b/app/api/auth/me/route.ts
@@ -0,0 +1,27 @@
+export const dynamic = 'force-dynamic';
+
+import { NextRequest, NextResponse } from 'next/server';
+import { supabase } from '@/lib/supabase';
+
+export async function GET(request: NextRequest) {
+  const userId = request.cookies.get('okr_user_id')?.value;
+  if (!userId) {
+    return NextResponse.json({ user: null }, { status: 200 });
+  }
+
+  const { data, error } = await supabase
+    .from('users')
+    .select('id,name,role,avatar_url,username,created_at,updated_at')
+    .eq('id', userId)
+    .maybeSingle();
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  if (!data) {
+    return NextResponse.json({ user: null }, { status: 200 });
+  }
+
+  return NextResponse.json({ user: data }, { status: 200 });
+}
--- a/app/api/checkins/route.ts
+++ b/app/api/checkins/route.ts
@@ -4,8 +4,15 @@ import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
 import { determineKRStatus, determineProjectStatus } from '@/lib/kr-utils';
 import type { KR, Checkin } from '@/types/database';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { searchParams } = new URL(request.url);
  const krId = searchParams.get('kr_id');
  const projectId = searchParams.get('project_id');
@@ -21,6 +28,34 @@ export async function GET(request: NextRequest) {
    `)
    .order('created_at', { ascending: false });

+  if (!ctx!.isAdmin) {
+    if (userId && userId !== ctx!.user.id) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (projectId && !hasProjectAccess(ctx!, projectId)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (krId) {
+      const { data: kr, error: krErr } = await supabase
+        .from('krs')
+        .select('id,project_id')
+        .eq('id', krId)
+        .maybeSingle();
+      if (krErr) return NextResponse.json({ error: krErr.message }, { status: 500 });
+      if (!kr) return NextResponse.json({ error: 'KR不存在' }, { status: 404 });
+      if (!hasProjectAccess(ctx!, kr.project_id)) {
+        return NextResponse.json({ error: '无权限' }, { status: 403 });
+      }
+    }
+
+    if (!projectId && !krId) {
+      if (ctx!.accessibleProjectIds.length === 0) {
+        return NextResponse.json([]);
+      }
+      query = query.in('project_id', ctx!.accessibleProjectIds);
+    }
+  }
+
  if (krId) query = query.eq('kr_id', krId);
  if (projectId) query = query.eq('project_id', projectId);
  if (userId) query = query.eq('user_id', userId);
@@ -36,6 +71,12 @@ export async function GET(request: NextRequest) {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { kr_id, project_id, user_id, date, current_value, confidence, reason_code, note } = body;

@@ -58,6 +99,19 @@ export async function POST(request: NextRequest) {

  const kr = krData as KR;

+  if (kr.project_id !== project_id) {
+    return NextResponse.json({ error: '项目与 KR 不匹配' }, { status: 400 });
+  }
+
+  if (!ctx!.isAdmin) {
+    if (!hasProjectAccess(ctx!, project_id)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (user_id && user_id !== ctx!.user.id) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+  }
+
  const { data: recentCheckins } = await supabase
    .from('checkins')
    .select('*')
@@ -91,7 +145,7 @@ export async function POST(request: NextRequest) {
    .insert({
      kr_id,
      project_id,
-      user_id,
+      user_id: ctx!.isAdmin ? user_id : ctx!.user.id,
      date: checkinDate,
      current_value,
      delta_value,
--- a/app/api/krs/[id]/route.ts
+++ b/app/api/krs/[id]/route.ts
@@ -2,11 +2,18 @@ export const dynamic = 'force-dynamic';

 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { data, error } = await supabase
    .from('krs')
    .select(`
@@ -26,6 +33,10 @@ export async function GET(
    return NextResponse.json({ error: 'KR不存在' }, { status: 404 });
  }

+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, data.project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  return NextResponse.json(data);
 }

@@ -33,6 +44,12 @@ export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const {
    title,
@@ -96,6 +113,12 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { error } = await supabase
    .from('krs')
    .delete()
--- a/app/api/krs/route.ts
+++ b/app/api/krs/route.ts
@@ -2,8 +2,15 @@ export const dynamic = 'force-dynamic';

 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { searchParams } = new URL(request.url);
  const projectId = searchParams.get('project_id');
  const objectiveId = searchParams.get('objective_id');
@@ -19,6 +26,19 @@ export async function GET(request: NextRequest) {
    `)
    .order('period_start', { ascending: false });

+  if (!ctx!.isAdmin) {
+    if (projectId) {
+      if (!hasProjectAccess(ctx!, projectId)) {
+        return NextResponse.json({ error: '无权限' }, { status: 403 });
+      }
+    } else {
+      if (ctx!.accessibleProjectIds.length === 0) {
+        return NextResponse.json([]);
+      }
+      query = query.in('project_id', ctx!.accessibleProjectIds);
+    }
+  }
+
  if (projectId) query = query.eq('project_id', projectId);
  if (objectiveId) query = query.eq('objective_id', objectiveId);
  if (ownerUserId) query = query.eq('owner_user_id', ownerUserId);
@@ -34,6 +54,12 @@ export async function GET(request: NextRequest) {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const {
    project_id,
@@ -59,6 +85,10 @@ export async function POST(request: NextRequest) {
    );
  }

+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  if (target_value <= 0) {
    return NextResponse.json({ error: '目标值必须大于0' }, { status: 400 });
  }
--- a/app/api/meetings/[id]/route.ts
+++ b/app/api/meetings/[id]/route.ts
@@ -1,10 +1,17 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { data, error } = await supabase
    .from('meetings')
    .select(`
@@ -23,6 +30,10 @@ export async function GET(
    return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
  }

+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, data.project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  return NextResponse.json(data);
 }

@@ -30,6 +41,25 @@ export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  if (!ctx!.isAdmin) {
+    const { data: meeting, error: mErr } = await supabase
+      .from('meetings')
+      .select('id,project_id')
+      .eq('id', params.id)
+      .maybeSingle();
+    if (mErr) return NextResponse.json({ error: mErr.message }, { status: 500 });
+    if (!meeting) return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
+    if (!hasProjectAccess(ctx!, meeting.project_id)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+  }
+
  const body = await request.json();
  const { summary, decisions, risks, next_period_commitments } = body;

@@ -57,6 +87,25 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  if (!ctx!.isAdmin) {
+    const { data: meeting, error: mErr } = await supabase
+      .from('meetings')
+      .select('id,project_id')
+      .eq('id', params.id)
+      .maybeSingle();
+    if (mErr) return NextResponse.json({ error: mErr.message }, { status: 500 });
+    if (!meeting) return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
+    if (!hasProjectAccess(ctx!, meeting.project_id)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+  }
+
  const { error } = await supabase
    .from('meetings')
    .delete()
--- a/app/api/meetings/route.ts
+++ b/app/api/meetings/route.ts
@@ -1,7 +1,14 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { searchParams } = new URL(request.url);
  const projectId = searchParams.get('project_id');

@@ -14,6 +21,19 @@ export async function GET(request: NextRequest) {
    `)
    .order('created_at', { ascending: false });

+  if (!ctx!.isAdmin) {
+    if (projectId) {
+      if (!hasProjectAccess(ctx!, projectId)) {
+        return NextResponse.json({ error: '无权限' }, { status: 403 });
+      }
+    } else {
+      if (ctx!.accessibleProjectIds.length === 0) {
+        return NextResponse.json([]);
+      }
+      query = query.in('project_id', ctx!.accessibleProjectIds);
+    }
+  }
+
  if (projectId) query = query.eq('project_id', projectId);

  const { data, error } = await query;
@@ -26,6 +46,12 @@ export async function GET(request: NextRequest) {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { project_id, period_start, period_end, summary, decisions, risks, next_period_commitments, created_by } = body;

@@ -36,6 +62,10 @@ export async function POST(request: NextRequest) {
    );
  }

+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  const { data, error } = await supabase
    .from('meetings')
    .insert({
@@ -46,7 +76,7 @@ export async function POST(request: NextRequest) {
      decisions,
      risks,
      next_period_commitments,
-      created_by,
+      created_by: ctx!.isAdmin ? created_by : ctx!.user.id,
    })
    .select()
    .single();
--- a/app/api/metrics/[id]/route.ts
+++ b/app/api/metrics/[id]/route.ts
@@ -1,15 +1,25 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
-  const { data, error } = await supabase
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  let query = supabase
    .from('metrics')
    .select('*')
-    .eq('id', params.id)
-    .maybeSingle();
+    .eq('id', params.id);
+
+  if (!ctx!.isAdmin) query = query.eq('is_active', true);
+
+  const { data, error } = await query.maybeSingle();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
@@ -26,6 +36,12 @@ export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { name, unit, direction, category, is_active } = body;

@@ -54,6 +70,12 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { error } = await supabase
    .from('metrics')
    .delete()
--- a/app/api/metrics/route.ts
+++ b/app/api/metrics/route.ts
@@ -1,14 +1,21 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

 export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { searchParams } = new URL(request.url);
  const activeOnly = searchParams.get('active_only') === 'true';
  const category = searchParams.get('category');

  let query = supabase.from('metrics').select('*').order('name', { ascending: true });

-  if (activeOnly) query = query.eq('is_active', true);
+  if (!ctx!.isAdmin || activeOnly) query = query.eq('is_active', true);
  if (category) query = query.eq('category', category);

  const { data, error } = await query;
@@ -21,6 +28,12 @@ export async function GET(request: NextRequest) {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { name, unit, direction, category } = body;

--- a/app/api/objectives/[id]/route.ts
+++ b/app/api/objectives/[id]/route.ts
@@ -2,11 +2,18 @@ export const dynamic = 'force-dynamic';

 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { data, error } = await supabase
    .from('objectives')
    .select('*')
@@ -21,6 +28,10 @@ export async function GET(
    return NextResponse.json({ error: '目标不存在' }, { status: 404 });
  }

+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, data.project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  return NextResponse.json(data);
 }

@@ -28,6 +39,12 @@ export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { title, description, period_start, period_end } = body;

@@ -55,6 +72,12 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { error } = await supabase
    .from('objectives')
    .delete()
--- a/app/api/objectives/route.ts
+++ b/app/api/objectives/route.ts
@@ -2,17 +2,35 @@ export const dynamic = 'force-dynamic';

 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { searchParams } = new URL(request.url);
  const projectId = searchParams.get('project_id');

  let query = supabase.from('objectives').select('*').order('period_start', { ascending: false });

-  if (projectId) {
-    query = query.eq('project_id', projectId);
+  if (!ctx!.isAdmin) {
+    if (projectId) {
+      if (!hasProjectAccess(ctx!, projectId)) {
+        return NextResponse.json({ error: '无权限' }, { status: 403 });
+      }
+    } else {
+      if (ctx!.accessibleProjectIds.length === 0) {
+        return NextResponse.json([]);
+      }
+      query = query.in('project_id', ctx!.accessibleProjectIds);
+    }
  }

+  if (projectId) query = query.eq('project_id', projectId);
+
  const { data, error } = await query;

  if (error) {
@@ -23,6 +41,12 @@ export async function GET(request: NextRequest) {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { project_id, title, description, period_start, period_end, created_by } = body;

@@ -34,6 +58,10 @@ export async function POST(request: NextRequest) {
    return NextResponse.json({ error: '结束日期不能早于开始日期' }, { status: 400 });
  }

+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  const { data, error } = await supabase
    .from('objectives')
    .insert({ project_id, title, description, period_start, period_end, created_by })
--- a/app/api/projects/[id]/members/route.ts
+++ b/app/api/projects/[id]/members/route.ts
@@ -1,10 +1,20 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+  if (!hasProjectAccess(ctx!, params.id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  const { data, error } = await supabase
    .from('project_members')
    .select('user_id, users(id, name, role, avatar_url)')
@@ -21,6 +31,12 @@ export async function POST(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { user_id } = body;

@@ -45,6 +61,12 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { searchParams } = new URL(request.url);
  const userId = searchParams.get('user_id');

--- a/app/api/projects/[id]/route.ts
+++ b/app/api/projects/[id]/route.ts
@@ -2,11 +2,21 @@ export const dynamic = 'force-dynamic';

 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+  if (!hasProjectAccess(ctx!, params.id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  const { data, error } = await supabase
    .from('projects')
    .select(`
@@ -37,6 +47,12 @@ export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { name, description, owner_id, pm_id, project_type, status, member_ids } = body;

@@ -78,6 +94,12 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { error } = await supabase
    .from('projects')
    .delete()
--- a/app/api/projects/route.ts
+++ b/app/api/projects/route.ts
@@ -2,9 +2,15 @@ export const dynamic = 'force-dynamic';

 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { getAuthContext } from '@/lib/access-control';

-export async function GET() {
-  const { data, error } = await supabase
+export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  if (!ctx) {
+    return NextResponse.json({ error: '未登录' }, { status: 401 });
+  }
+
+  let query = supabase
    .from('projects')
    .select(`
      *,
@@ -13,6 +19,15 @@ export async function GET() {
    `)
    .order('created_at', { ascending: false });

+  if (!ctx.isAdmin) {
+    if (ctx.accessibleProjectIds.length === 0) {
+      return NextResponse.json([]);
+    }
+    query = query.in('id', ctx.accessibleProjectIds);
+  }
+
+  const { data, error } = await query;
+
  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
  }
@@ -21,6 +36,14 @@ export async function GET() {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  if (!ctx) {
+    return NextResponse.json({ error: '未登录' }, { status: 401 });
+  }
+  if (!ctx.isAdmin) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  const body = await request.json();
  const { name, description, owner_id, pm_id, project_type, member_ids } = body;

--- a/app/api/task-steps/route.ts
+++ b/app/api/task-steps/route.ts
@@ -0,0 +1,240 @@
+export const dynamic = 'force-dynamic';
+
+import { NextRequest, NextResponse } from 'next/server';
+import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext } from '@/lib/access-control';
+
+async function canAccessTask(userId: string, isAdmin: boolean, accessibleProjectIds: string[], taskId: string) {
+  if (isAdmin) return { ok: true as const };
+  const { data: task, error } = await supabase
+    .from('tasks')
+    .select('id,project_id,owner_user_id,executor_ids,help_requested_to_user_id')
+    .eq('id', taskId)
+    .maybeSingle();
+  if (error) return { ok: false as const, status: 500, error: error.message };
+  if (!task) return { ok: false as const, status: 404, error: '计划不存在' };
+  if (task.project_id && accessibleProjectIds.includes(task.project_id)) return { ok: true as const };
+  if (task.owner_user_id === userId) return { ok: true as const };
+  if (task.help_requested_to_user_id === userId) return { ok: true as const };
+  if (Array.isArray(task.executor_ids) && task.executor_ids.includes(userId)) return { ok: true as const };
+  return { ok: false as const, status: 403, error: '无权限' };
+}
+
+export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const searchParams = request.nextUrl.searchParams;
+  const task_id = searchParams.get('task_id');
+  const help_requested_to_user_id = searchParams.get('help_requested_to_user_id');
+
+  let query = supabase
+    .from('task_steps')
+    .select(`
+      *,
+      task:tasks(
+        id,
+        title,
+        project_id,
+        kr_id,
+        owner_user_id,
+        help_requested_to_user_id,
+        help_requested_by_user_id,
+        help_requested_at
+      )
+    `)
+    .order('created_at', { ascending: false });
+
+  if (!ctx!.isAdmin) {
+    if (help_requested_to_user_id && help_requested_to_user_id !== ctx!.user.id) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (task_id) {
+      const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, task_id);
+      if (!access.ok) {
+        return NextResponse.json({ error: access.error }, { status: access.status });
+      }
+    }
+    if (!task_id && !help_requested_to_user_id) {
+      query = query.or(`executor_id.eq.${ctx!.user.id},help_requested_to_user_id.eq.${ctx!.user.id}`);
+    }
+  }
+
+  if (task_id) query = query.eq('task_id', task_id);
+  if (help_requested_to_user_id) query = query.eq('help_requested_to_user_id', help_requested_to_user_id);
+
+  const { data, error } = await query;
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json(data);
+}
+
+export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const body = await request.json();
+  const {
+    task_id,
+    content,
+    note,
+    executor_id,
+    start_date,
+    end_date,
+    is_completed,
+    help_requested_to_user_id,
+    help_requested_by_user_id,
+  } = body;
+
+  const isHelpRequested = Boolean(help_requested_to_user_id);
+
+  if (!task_id) {
+    return NextResponse.json({ error: '计划ID为必填项' }, { status: 400 });
+  }
+
+  const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, task_id);
+  if (!access.ok) {
+    return NextResponse.json({ error: access.error }, { status: access.status });
+  }
+
+  const { data, error } = await supabase
+    .from('task_steps')
+    .insert({
+      task_id,
+      content,
+      note,
+      executor_id,
+      start_date,
+      end_date,
+      is_completed,
+      help_requested_to_user_id: help_requested_to_user_id || null,
+      help_requested_by_user_id: isHelpRequested ? (ctx!.isAdmin ? (help_requested_by_user_id || null) : ctx!.user.id) : null,
+      help_requested_at: isHelpRequested ? new Date().toISOString() : null,
+    })
+    .select()
+    .single();
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json(data);
+}
+
+export async function PATCH(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const body = await request.json();
+  const {
+    id,
+    content,
+    note,
+    executor_id,
+    start_date,
+    end_date,
+    is_completed,
+    help_requested_to_user_id,
+    help_requested_by_user_id,
+  } = body;
+
+  if (!id) {
+    return NextResponse.json({ error: 'Missing step id' }, { status: 400 });
+  }
+
+  const { data: stepRow, error: stepErr } = await supabase
+    .from('task_steps')
+    .select('id,task_id')
+    .eq('id', id)
+    .maybeSingle();
+  if (stepErr) return NextResponse.json({ error: stepErr.message }, { status: 500 });
+  if (!stepRow) return NextResponse.json({ error: '步骤不存在' }, { status: 404 });
+
+  const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, stepRow.task_id);
+  if (!access.ok) {
+    return NextResponse.json({ error: access.error }, { status: access.status });
+  }
+
+  const updateData: Record<string, unknown> = {};
+  if (content !== undefined) updateData.content = content;
+  if (note !== undefined) updateData.note = note;
+  if (executor_id !== undefined) updateData.executor_id = executor_id;
+  if (start_date !== undefined) updateData.start_date = start_date;
+  if (end_date !== undefined) updateData.end_date = end_date;
+  if (is_completed !== undefined) updateData.is_completed = is_completed;
+
+  if (help_requested_to_user_id !== undefined) {
+    updateData.help_requested_to_user_id = help_requested_to_user_id;
+    if (help_requested_to_user_id) {
+      updateData.help_requested_by_user_id = ctx!.isAdmin ? (help_requested_by_user_id || null) : ctx!.user.id;
+      updateData.help_requested_at = new Date().toISOString();
+    } else {
+      updateData.help_requested_by_user_id = null;
+      updateData.help_requested_at = null;
+    }
+  }
+
+  const { data, error } = await supabase
+    .from('task_steps')
+    .update(updateData)
+    .eq('id', id)
+    .select()
+    .single();
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json(data);
+}
+
+export async function DELETE(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const searchParams = request.nextUrl.searchParams;
+  const id = searchParams.get('id');
+
+  if (!id) {
+    return NextResponse.json({ error: 'Missing id' }, { status: 400 });
+  }
+
+  const { data: stepRow, error: stepErr } = await supabase
+    .from('task_steps')
+    .select('id,task_id')
+    .eq('id', id)
+    .maybeSingle();
+  if (stepErr) return NextResponse.json({ error: stepErr.message }, { status: 500 });
+  if (!stepRow) return NextResponse.json({ error: '步骤不存在' }, { status: 404 });
+
+  const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, stepRow.task_id);
+  if (!access.ok) {
+    return NextResponse.json({ error: access.error }, { status: access.status });
+  }
+
+  const { error } = await supabase
+    .from('task_steps')
+    .delete()
+    .eq('id', id);
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json({ success: true });
+}
--- a/app/api/tasks/[id]/route.ts
+++ b/app/api/tasks/[id]/route.ts
@@ -0,0 +1,118 @@
+export const dynamic = 'force-dynamic';
+
+import { NextRequest, NextResponse } from 'next/server';
+import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext } from '@/lib/access-control';
+
+async function canAccessTask(userId: string, isAdmin: boolean, accessibleProjectIds: string[], taskId: string) {
+  if (isAdmin) return { ok: true as const };
+
+  const { data: task, error } = await supabase
+    .from('tasks')
+    .select('id,project_id,owner_user_id,executor_ids,help_requested_to_user_id')
+    .eq('id', taskId)
+    .maybeSingle();
+
+  if (error) return { ok: false as const, status: 500, error: error.message };
+  if (!task) return { ok: false as const, status: 404, error: '计划不存在' };
+
+  if (task.project_id && accessibleProjectIds.includes(task.project_id)) return { ok: true as const };
+  if (task.owner_user_id === userId) return { ok: true as const };
+  if (task.help_requested_to_user_id === userId) return { ok: true as const };
+  if (Array.isArray(task.executor_ids) && task.executor_ids.includes(userId)) return { ok: true as const };
+
+  return { ok: false as const, status: 403, error: '无权限' };
+}
+
+export async function PATCH(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, params.id);
+  if (!access.ok) {
+    return NextResponse.json({ error: access.error }, { status: access.status });
+  }
+
+  const body = await request.json();
+  const {
+    title,
+    description,
+    status,
+    priority,
+    urgency,
+    owner_user_id,
+    executor_ids,
+    start_date,
+    end_date,
+    help_requested_to_user_id,
+    help_requested_by_user_id,
+  } = body;
+
+  const updateData: Record<string, unknown> = { updated_at: new Date().toISOString() };
+  if (title !== undefined) updateData.title = title;
+  if (description !== undefined) updateData.description = description;
+  if (status !== undefined) updateData.status = status;
+  if (priority !== undefined) updateData.priority = priority;
+  if (urgency !== undefined) updateData.urgency = urgency;
+  if (owner_user_id !== undefined) updateData.owner_user_id = owner_user_id;
+  if (executor_ids !== undefined) updateData.executor_ids = executor_ids;
+  if (start_date !== undefined) updateData.start_date = start_date;
+  if (end_date !== undefined) updateData.end_date = end_date;
+
+  if (help_requested_to_user_id !== undefined) {
+    updateData.help_requested_to_user_id = help_requested_to_user_id;
+    if (help_requested_to_user_id) {
+      updateData.help_requested_by_user_id = help_requested_by_user_id || null;
+      updateData.help_requested_at = new Date().toISOString();
+    } else {
+      updateData.help_requested_by_user_id = null;
+      updateData.help_requested_at = null;
+    }
+  }
+
+  const { data, error } = await supabase
+    .from('tasks')
+    .update(updateData)
+    .eq('id', params.id)
+    .select()
+    .single();
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json(data);
+}
+
+export async function DELETE(
+  request: NextRequest,
+  { params }: { params: { id: string } }
+) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const access = await canAccessTask(ctx!.user.id, ctx!.isAdmin, ctx!.accessibleProjectIds, params.id);
+  if (!access.ok) {
+    return NextResponse.json({ error: access.error }, { status: access.status });
+  }
+
+  const { error } = await supabase
+    .from('tasks')
+    .delete()
+    .eq('id', params.id);
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json({ success: true });
+}
--- a/app/api/tasks/route.ts
+++ b/app/api/tasks/route.ts
@@ -0,0 +1,189 @@
+export const dynamic = 'force-dynamic';
+
+import { NextRequest, NextResponse } from 'next/server';
+import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';
+
+export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const searchParams = request.nextUrl.searchParams;
+  const kr_id = searchParams.get('kr_id');
+  const project_id = searchParams.get('project_id');
+  const user_id = searchParams.get('user_id');
+  const help_requested_to_user_id = searchParams.get('help_requested_to_user_id');
+  const include_help = searchParams.get('include_help') === 'true';
+
+  if (!ctx!.isAdmin) {
+    if (user_id && user_id !== ctx!.user.id) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (help_requested_to_user_id && help_requested_to_user_id !== ctx!.user.id) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (project_id && !hasProjectAccess(ctx!, project_id)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (kr_id) {
+      const { data: kr, error: krErr } = await supabase
+        .from('krs')
+        .select('id,project_id')
+        .eq('id', kr_id)
+        .maybeSingle();
+      if (krErr) return NextResponse.json({ error: krErr.message }, { status: 500 });
+      if (!kr) return NextResponse.json({ error: 'KR不存在' }, { status: 404 });
+      if (!hasProjectAccess(ctx!, kr.project_id)) {
+        return NextResponse.json({ error: '无权限' }, { status: 403 });
+      }
+    }
+  }
+
+  const baseQuery = () =>
+    supabase
+    .from('tasks')
+    .select(`
+      *,
+      steps:task_steps(*)
+    `)
+    .order('created_at', { ascending: false });
+
+  const applyParams = (query: ReturnType<typeof baseQuery>) => {
+    let q = query;
+    if (kr_id) {
+      q = q.eq('kr_id', kr_id);
+    } else if (project_id) {
+      q = q.eq('project_id', project_id).is('kr_id', null);
+    }
+
+    if (help_requested_to_user_id) {
+      q = q.eq('help_requested_to_user_id', help_requested_to_user_id);
+    } else if (user_id) {
+      if (include_help) {
+        q = q.or(`owner_user_id.eq.${user_id},help_requested_to_user_id.eq.${user_id}`);
+      } else {
+        q = q.eq('owner_user_id', user_id);
+      }
+    }
+
+    return q;
+  };
+
+  if (ctx!.isAdmin) {
+    const { data, error } = await applyParams(baseQuery());
+    if (error) {
+      return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+    return NextResponse.json(data);
+  }
+
+  if (project_id || kr_id) {
+    const { data, error } = await applyParams(baseQuery());
+    if (error) {
+      return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+    return NextResponse.json(data);
+  }
+
+  const relatedTasks = new Map<string, any>();
+  const addRows = (rows: any[] | null) => {
+    if (!rows) return;
+    for (const row of rows) {
+      relatedTasks.set(row.id, row);
+    }
+  };
+
+  const projectIds = ctx!.accessibleProjectIds;
+
+  const builders: any[] = [];
+  if (projectIds.length > 0) {
+    builders.push(applyParams(baseQuery().in('project_id', projectIds)));
+  }
+  builders.push(applyParams(baseQuery().or(`owner_user_id.eq.${ctx!.user.id},help_requested_to_user_id.eq.${ctx!.user.id}`)));
+  builders.push(applyParams(baseQuery().contains('executor_ids', [ctx!.user.id])));
+
+  const results = await Promise.all(builders.map(b => b));
+  for (const r of results) {
+    if (r.error) {
+      return NextResponse.json({ error: r.error.message }, { status: 500 });
+    }
+    addRows(r.data);
+  }
+
+  return NextResponse.json(Array.from(relatedTasks.values()));
+}
+
+export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const body = await request.json();
+  const {
+    kr_id,
+    project_id,
+    title,
+    description,
+    status,
+    priority,
+    urgency,
+    owner_user_id,
+    executor_ids,
+    start_date,
+    end_date,
+    help_requested_to_user_id,
+    help_requested_by_user_id,
+  } = body;
+
+  const isHelpRequested = Boolean(help_requested_to_user_id);
+
+  if (!ctx!.isAdmin) {
+    if (project_id && !hasProjectAccess(ctx!, project_id)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+    if (kr_id) {
+      const { data: kr, error: krErr } = await supabase
+        .from('krs')
+        .select('id,project_id')
+        .eq('id', kr_id)
+        .maybeSingle();
+      if (krErr) return NextResponse.json({ error: krErr.message }, { status: 500 });
+      if (!kr) return NextResponse.json({ error: 'KR不存在' }, { status: 404 });
+      if (!hasProjectAccess(ctx!, kr.project_id)) {
+        return NextResponse.json({ error: '无权限' }, { status: 403 });
+      }
+    }
+  }
+
+  const { data, error } = await supabase
+    .from('tasks')
+    .insert({
+      kr_id: kr_id || null,
+      project_id: project_id || null,
+      title,
+      description,
+      status: status || 'todo',
+      priority: priority || 3,
+      urgency: urgency || 3,
+      owner_user_id,
+      executor_ids: executor_ids || [],
+      start_date,
+      end_date,
+      help_requested_to_user_id: help_requested_to_user_id || null,
+      help_requested_by_user_id: help_requested_by_user_id || null,
+      help_requested_at: isHelpRequested ? new Date().toISOString() : null,
+    })
+    .select()
+    .single();
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 });
+  }
+
+  return NextResponse.json(data);
+}
--- a/app/api/templates/[id]/route.ts
+++ b/app/api/templates/[id]/route.ts
@@ -1,15 +1,25 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
-  const { data, error } = await supabase
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  let query = supabase
    .from('templates')
    .select('*')
-    .eq('id', params.id)
-    .maybeSingle();
+    .eq('id', params.id);
+
+  if (!ctx!.isAdmin) query = query.eq('is_active', true);
+
+  const { data, error } = await query.maybeSingle();

  if (error) {
    return NextResponse.json({ error: error.message }, { status: 500 });
@@ -26,6 +36,12 @@ export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { name, description, project_type, tags, items, is_active } = body;

@@ -55,6 +71,12 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { error } = await supabase
    .from('templates')
    .delete()
--- a/app/api/templates/route.ts
+++ b/app/api/templates/route.ts
@@ -1,14 +1,21 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

 export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const { searchParams } = new URL(request.url);
  const activeOnly = searchParams.get('active_only') === 'true';
  const projectType = searchParams.get('project_type');

  let query = supabase.from('templates').select('*').order('name', { ascending: true });

-  if (activeOnly) query = query.eq('is_active', true);
+  if (!ctx!.isAdmin || activeOnly) query = query.eq('is_active', true);
  if (projectType) query = query.eq('project_type', projectType);

  const { data, error } = await query;
@@ -21,6 +28,12 @@ export async function GET(request: NextRequest) {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
  const { name, description, project_type, tags, items } = body;

--- a/app/api/users/[id]/route.ts
+++ b/app/api/users/[id]/route.ts
@@ -1,13 +1,23 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

 export async function GET(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+  if (!ctx!.isAdmin && ctx!.user.id !== params.id) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
  const { data, error } = await supabase
    .from('users')
-    .select('*')
+    .select('id,name,role,avatar_url,username,created_at,updated_at')
    .eq('id', params.id)
    .maybeSingle();

@@ -26,14 +36,30 @@ export async function PATCH(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
-  const { name, role, avatar_url } = body;
+  const { name, role, avatar_url, username, password } = body;
+
+  const updateData: Record<string, unknown> = { updated_at: new Date().toISOString() };
+  if (name !== undefined) updateData.name = name;
+  if (role !== undefined) updateData.role = role;
+  if (avatar_url !== undefined) updateData.avatar_url = avatar_url;
+  if (username !== undefined) updateData.username = username || null;
+  if (password) {
+    const { hashPassword } = await import('@/lib/password');
+    updateData.password_hash = hashPassword(String(password));
+  }

  const { data, error } = await supabase
    .from('users')
-    .update({ name, role, avatar_url, updated_at: new Date().toISOString() })
+    .update(updateData)
    .eq('id', params.id)
-    .select()
+    .select('id,name,role,avatar_url,username,created_at,updated_at')
    .single();

  if (error) {
@@ -47,6 +73,30 @@ export async function DELETE(
  request: NextRequest,
  { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  const { data: user, error: userError } = await supabase
+    .from('users')
+    .select('id,role')
+    .eq('id', params.id)
+    .maybeSingle();
+
+  if (userError) {
+    return NextResponse.json({ error: userError.message }, { status: 500 });
+  }
+
+  if (!user) {
+    return NextResponse.json({ error: '用户不存在' }, { status: 404 });
+  }
+
+  if (user.role === 'owner') {
+    return NextResponse.json({ error: '不能删除老板账号' }, { status: 400 });
+  }
+
  const { error } = await supabase
    .from('users')
    .delete()
--- a/app/api/users/route.ts
+++ b/app/api/users/route.ts
@@ -2,11 +2,54 @@ export const dynamic = 'force-dynamic';

 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAdmin, ensureAuthenticated, getAuthContext } from '@/lib/access-control';

-export async function GET() {
+export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  if (ctx!.isAdmin) {
+    const { data, error } = await supabase
+      .from('users')
+      .select('id,name,role,avatar_url,username,created_at,updated_at')
+      .order('created_at', { ascending: true });
+
+    if (error) {
+      return NextResponse.json({ error: error.message }, { status: 500 });
+    }
+    return NextResponse.json(data);
+  }
+
+  const projectIds = ctx!.accessibleProjectIds;
+  const allowedUserIds = new Set<string>([ctx!.user.id]);
+
+  if (projectIds.length > 0) {
+    const [membersRes, projectsRes] = await Promise.all([
+      supabase.from('project_members').select('user_id').in('project_id', projectIds),
+      supabase.from('projects').select('owner_id,pm_id').in('id', projectIds),
+    ]);
+
+    if (membersRes.data) {
+      for (const row of membersRes.data as Array<{ user_id: string }>) {
+        allowedUserIds.add(row.user_id);
+      }
+    }
+    if (projectsRes.data) {
+      for (const row of projectsRes.data as Array<{ owner_id: string | null; pm_id: string | null }>) {
+        if (row.owner_id) allowedUserIds.add(row.owner_id);
+        if (row.pm_id) allowedUserIds.add(row.pm_id);
+      }
+    }
+  }
+
+  const ids = Array.from(allowedUserIds);
  const { data, error } = await supabase
    .from('users')
-    .select('*')
+    .select('id,name,role,avatar_url,username,created_at,updated_at')
+    .in('id', ids)
    .order('created_at', { ascending: true });

  if (error) {
@@ -17,17 +60,35 @@ export async function GET() {
 }

 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAdmin(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
  const body = await request.json();
-  const { name, role, avatar_url } = body;
+  const { name, role, avatar_url, username, password } = body;

  if (!name || !role) {
    return NextResponse.json({ error: '名称和角色为必填项' }, { status: 400 });
  }

+  let password_hash: string | null = null;
+  if (password) {
+    const { hashPassword } = await import('@/lib/password');
+    password_hash = hashPassword(String(password));
+  }
+
  const { data, error } = await supabase
    .from('users')
-    .insert({ name, role, avatar_url })
-    .select()
+    .insert({
+      name,
+      role,
+      avatar_url,
+      username: username || null,
+      password_hash,
+    })
+    .select('id,name,role,avatar_url,username,created_at,updated_at')
    .single();

  if (error) {