feat: 实现用户登录认证与权限控制系统

- 新增用户登录页面与API端点（/api/auth/login、/api/auth/logout、/api/auth/me）
- 引入基于密码哈希的认证机制，支持默认管理员账号登录
- 创建访问控制模块（lib/access-control.ts），实现基于角色的权限验证
- 在现有API端点中集成权限检查，限制非管理员用户只能访问其所属项目数据
- 更新应用布局，要求用户登录后才能访问主界面
- 扩展用户表结构，增加用户名和密码哈希字段
- 调整项目、KR、目标、会议记录等资源的查询逻辑，根据用户权限过滤数据
- 改进管理页面（指标、模板）的删除操作，使用确认对话框替代直接确认
- 优化“我的KR”页面，为管理员提供全员KR概览视图
- 修复.gitignore文件中的拼写错误（.trae → .travis）
- 添加数据库迁移脚本，支持任务直接关联项目、禁用RLS、添加求助字段等
- 配置Next.js以支持独立输出和子路径部署

lib/access-control.ts

@@ -0,0 +1,73 @@
+import type { NextRequest } from 'next/server';
+import { supabase } from '@/lib/supabase';
+import type { User } from '@/types/database';
+
+export type AuthContext = {
+  user: User;
+  isAdmin: boolean;
+  accessibleProjectIds: string[];
+};
+
+export async function getAuthContext(request: NextRequest): Promise<AuthContext | null> {
+  const userId = request.cookies.get('okr_user_id')?.value;
+  if (!userId) return null;
+
+  const { data: user, error: userError } = await supabase
+    .from('users')
+    .select('id,name,role,avatar_url,username,created_at,updated_at')
+    .eq('id', userId)
+    .maybeSingle();
+
+  if (userError || !user) return null;
+
+  const isAdmin = user.role === 'owner';
+  const accessibleProjectIds = await getAccessibleProjectIds(user.id, isAdmin);
+  return { user, isAdmin, accessibleProjectIds };
+}
+
+export async function getAccessibleProjectIds(userId: string, isAdmin: boolean) {
+  if (isAdmin) return [];
+
+  const [projectsRes, memberRes] = await Promise.all([
+    supabase
+      .from('projects')
+      .select('id')
+      .or(`owner_id.eq.${userId},pm_id.eq.${userId}`),
+    supabase
+      .from('project_members')
+      .select('project_id')
+      .eq('user_id', userId),
+  ]);
+
+  const ids = new Set<string>();
+  if (projectsRes.data) {
+    for (const row of projectsRes.data as Array<{ id: string }>) ids.add(row.id);
+  }
+  if (memberRes.data) {
+    for (const row of memberRes.data as Array<{ project_id: string }>) ids.add(row.project_id);
+  }
+  return Array.from(ids);
+}
+
+export function ensureAuthenticated(ctx: AuthContext | null) {
+  if (!ctx) {
+    return { ok: false as const, status: 401, error: '未登录' };
+  }
+  return { ok: true as const };
+}
+
+export function ensureAdmin(ctx: AuthContext | null) {
+  if (!ctx) {
+    return { ok: false as const, status: 401, error: '未登录' };
+  }
+  if (!ctx.isAdmin) {
+    return { ok: false as const, status: 403, error: '无权限' };
+  }
+  return { ok: true as const };
+}
+
+export function hasProjectAccess(ctx: AuthContext, projectId: string | null | undefined) {
+  if (ctx.isAdmin) return true;
+  if (!projectId) return false;
+  return ctx.accessibleProjectIds.includes(projectId);
+}

lib/password.ts

@@ -0,0 +1,25 @@
+import crypto from 'crypto';
+
+export function hashPassword(password: string) {
+  const salt = crypto.randomBytes(16).toString('hex');
+  const iterations = 120000;
+  const keylen = 32;
+  const digest = 'sha256';
+  const derivedKey = crypto.pbkdf2Sync(password, salt, iterations, keylen, digest).toString('hex');
+  return `${iterations}:${salt}:${derivedKey}`;
+}
+
+export function verifyPassword(password: string, stored: string) {
+  const parts = stored.split(':');
+  if (parts.length !== 3) return false;
+  const iterations = Number(parts[0]);
+  const salt = parts[1];
+  const expectedHex = parts[2];
+  if (!Number.isFinite(iterations) || iterations <= 0) return false;
+  const keylen = Buffer.from(expectedHex, 'hex').length;
+  if (keylen <= 0) return false;
+  const actual = crypto.pbkdf2Sync(password, salt, iterations, keylen, 'sha256');
+  const expected = Buffer.from(expectedHex, 'hex');
+  if (actual.length !== expected.length) return false;
+  return crypto.timingSafeEqual(actual, expected);
+}