feat: 实现用户登录认证与权限控制系统

- 新增用户登录页面与API端点（/api/auth/login、/api/auth/logout、/api/auth/me）
- 引入基于密码哈希的认证机制，支持默认管理员账号登录
- 创建访问控制模块（lib/access-control.ts），实现基于角色的权限验证
- 在现有API端点中集成权限检查，限制非管理员用户只能访问其所属项目数据
- 更新应用布局，要求用户登录后才能访问主界面
- 扩展用户表结构，增加用户名和密码哈希字段
- 调整项目、KR、目标、会议记录等资源的查询逻辑，根据用户权限过滤数据
- 改进管理页面（指标、模板）的删除操作，使用确认对话框替代直接确认
- 优化“我的KR”页面，为管理员提供全员KR概览视图
- 修复.gitignore文件中的拼写错误（.trae → .travis）
- 添加数据库迁移脚本，支持任务直接关联项目、禁用RLS、添加求助字段等
- 配置Next.js以支持独立输出和子路径部署

app/api/meetings/[id]/route.ts

@@ -1,10 +1,17 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';
 
 export async function GET(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
   const { data, error } = await supabase
     .from('meetings')
     .select(`
@@ -23,6 +30,10 @@ export async function GET(
     return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
   }
 
+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, data.project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
   return NextResponse.json(data);
 }
 
@@ -30,6 +41,25 @@ export async function PATCH(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  if (!ctx!.isAdmin) {
+    const { data: meeting, error: mErr } = await supabase
+      .from('meetings')
+      .select('id,project_id')
+      .eq('id', params.id)
+      .maybeSingle();
+    if (mErr) return NextResponse.json({ error: mErr.message }, { status: 500 });
+    if (!meeting) return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
+    if (!hasProjectAccess(ctx!, meeting.project_id)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+  }
+
   const body = await request.json();
   const { summary, decisions, risks, next_period_commitments } = body;
 
@@ -57,6 +87,25 @@ export async function DELETE(
   request: NextRequest,
   { params }: { params: { id: string } }
 ) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
+  if (!ctx!.isAdmin) {
+    const { data: meeting, error: mErr } = await supabase
+      .from('meetings')
+      .select('id,project_id')
+      .eq('id', params.id)
+      .maybeSingle();
+    if (mErr) return NextResponse.json({ error: mErr.message }, { status: 500 });
+    if (!meeting) return NextResponse.json({ error: '会议记录不存在' }, { status: 404 });
+    if (!hasProjectAccess(ctx!, meeting.project_id)) {
+      return NextResponse.json({ error: '无权限' }, { status: 403 });
+    }
+  }
+
   const { error } = await supabase
     .from('meetings')
     .delete()

app/api/meetings/route.ts

@@ -1,7 +1,14 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { supabase } from '@/lib/supabase';
+import { ensureAuthenticated, getAuthContext, hasProjectAccess } from '@/lib/access-control';
 
 export async function GET(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
   const { searchParams } = new URL(request.url);
   const projectId = searchParams.get('project_id');
 
@@ -14,6 +21,19 @@ export async function GET(request: NextRequest) {
     `)
     .order('created_at', { ascending: false });
 
+  if (!ctx!.isAdmin) {
+    if (projectId) {
+      if (!hasProjectAccess(ctx!, projectId)) {
+        return NextResponse.json({ error: '无权限' }, { status: 403 });
+      }
+    } else {
+      if (ctx!.accessibleProjectIds.length === 0) {
+        return NextResponse.json([]);
+      }
+      query = query.in('project_id', ctx!.accessibleProjectIds);
+    }
+  }
+
   if (projectId) query = query.eq('project_id', projectId);
 
   const { data, error } = await query;
@@ -26,6 +46,12 @@ export async function GET(request: NextRequest) {
 }
 
 export async function POST(request: NextRequest) {
+  const ctx = await getAuthContext(request);
+  const auth = ensureAuthenticated(ctx);
+  if (!auth.ok) {
+    return NextResponse.json({ error: auth.error }, { status: auth.status });
+  }
+
   const body = await request.json();
   const { project_id, period_start, period_end, summary, decisions, risks, next_period_commitments, created_by } = body;
 
@@ -36,6 +62,10 @@ export async function POST(request: NextRequest) {
     );
   }
 
+  if (!ctx!.isAdmin && !hasProjectAccess(ctx!, project_id)) {
+    return NextResponse.json({ error: '无权限' }, { status: 403 });
+  }
+
   const { data, error } = await supabase
     .from('meetings')
     .insert({
@@ -46,7 +76,7 @@ export async function POST(request: NextRequest) {
       decisions,
       risks,
       next_period_commitments,
-      created_by,
+      created_by: ctx!.isAdmin ? created_by : ctx!.user.id,
     })
     .select()
     .single();