From 8c4a6cd12a3cd8c706498fab67088c210edec442 Mon Sep 17 00:00:00 2001
From: super <2903208875@qq.com>
Date: Wed, 22 Apr 2026 01:09:47 +0800
Subject: [PATCH] =?UTF-8?q?=E5=A4=84=E7=90=86=E5=90=8E=E5=8F=B0=E8=B7=B3?=
 =?UTF-8?q?=E8=BD=AC=E9=94=99=E8=AF=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/.env                                      |   4 +-
 backend/__pycache__/config.cpython-312.pyc    | Bin 1510 -> 1513 bytes
 .../__pycache__/auth.cpython-312.pyc          | Bin 4403 -> 4782 bytes
 .../__pycache__/main.cpython-312.pyc          | Bin 2506 -> 2543 bytes
 backend/blueprints/auth.py                    |  11 ++--
 backend/blueprints/main.py                    |   4 +-
 backend/config.py                             |   4 +-
 .../utils/__pycache__/auth.cpython-312.pyc    | Bin 4805 -> 4546 bytes
 backend/utils/auth.py                         |  51 +++++++++++-------
 9 files changed, 45 insertions(+), 29 deletions(-)

diff --git a/app/.env b/app/.env
index 991dfad..8a4270d 100644
--- a/app/.env
+++ b/app/.env
@@ -12,8 +12,8 @@ zn_username=%E8%87%AA%E5%8A%A8%E5%8C%96_Robot
 client_name=ShuFuAI
 
 
-java_api_base=http://47.111.163.154:18080
+# java_api_base=http://47.111.163.154:18080
 # java_api_base=http://127.0.0.1:18080
-# java_api_base=http://8.136.19.173:18080
+java_api_base=http://8.136.19.173:18080
 
 
diff --git a/backend/__pycache__/config.cpython-312.pyc b/backend/__pycache__/config.cpython-312.pyc
index 8a02d24c8df3cd8ab635c7c3caa642aafd4bd0b3..a42abffa378f1cdf4de15a070cf5b66ad77759cc 100644
GIT binary patch
delta 87
zcmaFH{gRveG%qg~0}#lqdA^bRJClfHMoCG5mA<}(o}saso}s0lp}Fy9Vdg+4l?M`1
r^SNen&F7oRcR}6mf<yFWiJ0pW$rmM(FQlYjmdLokAbMkR2WuPvf4dya

delta 84
zcmaFK{fwLYG%qg~0}!;&d$^JNJCmSTMoCG5mA<~Ak-44$5E^b4V-93exgjAnpKB)9
ne7>1{7u4-8I7D2Qh`cV5a8V-RLSo8giPQ@Wq7No_v&I1cR0AAf

diff --git a/backend/blueprints/__pycache__/auth.cpython-312.pyc b/backend/blueprints/__pycache__/auth.cpython-312.pyc
index cd1faab95330b71acbeb106c13912eb5b4e2ed94..20f60815dc563949051293eace5d4a62b2f0ccbd 100644
GIT binary patch
delta 1624
zcmZWpZA@EL7(VBIm)_pCw58BOOZY0~Ta=Ho!Ni74a7dK-W6Z2+xYw<GE~mF)x=yy3
z=%4+d9y3_nl*Pno*l?4-#za_jY?_p;$xOxUj}y1Vgk>g+F;UNH*ADa~_qp%Kd7ty1
z^S<Y-R4i93w@ju2K!)YYR>WpXD8;Za;Tvk0G>@1eP@yVJSSGC_RtOlNF{-E)s?ue{
z5=%n>7_n)#F+big+7j11yd$q{mGeb81$$u;bmDfn2w8jw`kZM;BpMoxA*4;|p;%Ny
zp|Cm`nZkd=Lrg7?2aOHws8;8*D*&+cL_i*0{GZLP8*(<?h{yR-MwjtEp;T7c@mc`p
zAo__IOl+xw?7As8b*vD7VRR`|W?jyk?06sBP4XlTJkPelOcaL{y#)Wxx}h5zIJdJb
zH$9isDK^fIc}Y+i<nSz4gr_+htjv&H<Q$D(>D9T2IIo&Yh!SU(n5+$5Q58Ms1|b{1
z%e8WGevGB(>9j1ttS{QDKal_!tEJQ&1ldjXAd5~pGeZ?st7^Ew<l@xAH<)3dyYv16
z)q2^OTby_@JKT$$J17+0n4kWX$o7<!gzY|XFRb5{QWrh3Jcp<{cBb^7bR4_VapQmZ
zD$g7|tDImDff-l{^oAT!6+ppLLN;RyD&4t)-i*hEdehEr+VLlX4;JBDLaD_@DAE$`
zvZ?T-hAjB8Fhq*EUmR^rOQa7otrv5US@$oT{_WE<Tg#WW=H9)RSorngJNM7eMKC#g
zKZ9I&S?n(?MzjOd>`_fev~!RNbJFur!F^H(tA!ChA(aco)KP*zk}9DKZ%P%uXNf@}
zUsNWAKMj5nmG@4bIXM?diDjvZj#Nb;)ia#xc@29F7#8Cd!*uVDPS^ZQVrJp3l(TNr
z?w%h^41O@Q>GaIczCXL^t-0Ek432F04&U~^o;(sxdc(=$@TR+FF`nG>YRWyFv=8Ho
zf^kC|DD)=E{`#W^pDWmN<S@x#t;yBTgX>b&i=FKChTd+Xd|M||?5H95oySJ8)k5$_
zC*RMAH@YPvuk(fhE4!}L49M*IbCAkiGLdfzRK6+m16EvVtc9y92aF;VkTuR^n;2hZ
z4fsu?w=#d3RZ*uE$qZG>w<>8{Y!KY=6?{$J2Mh2+xsTMZ!xWrF9y0eJauOtEXd^#F
z$@~SGQXnriNEGNJhUjfWH57al>L}Dx5D55L)I{ZG3M~Yp^c5>FFGsE9pH{-hBcX6i
zKNcE2rj3rHc47?BwW2@ZKTXHW7b-vYo%b!)rCg1hHrK*SpE;85=G(TGq};O20(TRB
zTiIV7<iXeVF9g_c{2fGG4e&umT<sBwyv7#=J?vT;40`Yb<*Xn133X;KndCkPkBAPk
zsR$F(N2g;t>LQi{_>#Fw3=rvMe=+{vJU)x)JC>GXdSoKnL>^I9Lx}cQS_*||lZQgc
zOjRBc4h_-v%WNh?hdQZB>9R{ndnc#W*o4-Dg2YB2n&^iFwpj?_LxzFeV*$Vccn9?V
m44%0M+;;&tya9&smlnU-2df{kfN9=lh_rnWKd|(1l=)va=W2!k

delta 1433
zcmah}%}*Og6rb7kdcFQwFE%y-+c6kBw&l2n;FOXgLO>MSN=0g_R-{Ol<=qk+V_V~~
zf)r4bQ&ovWtar(Q1L`R$Q4g(pY85HahDfDS)N-iY9P<Yt(OadeGfNj}RVjOT^P4yC
z{ocpC*{>4c#MGZW9w%boyzp)LOIKSxht+m+K82Bvb$ivjqTSFi5|AP2veBhG9x2-*
zH%I7(&+t`}?JtI<ZWH`AA_X`A4X1GsuHY>!!0$K-y~2V}v%y_0c2URM_}H7Ar_wP(
zX!{>Px~XjGr~(uAu$!8>ab?8~e+i+%&(CO7%lLF<6fOvhVYnkXY&9=+!Z_cE861GN
z)(20;%LAvB|3{$G9thh)BfS=>?qpTFwuR&Ub)+B~vd*l`*Tprl65$aXm(jXy%~pxR
zhAn{y%%J<WK(;~$EvGd}_i*+#!6GFe>ngR5QNahQbm?sADjZ6Iu^!8U87n7PusW)1
zn<w}>`cEgL>>k=$<fB*Ce!?s3K3(}2<Jpe*&US?M!Y}st+{SmS;sUyb2N6wKG;u_x
z*X^&kvoJj^O{N)`lrv_7OcK`qE?AY5*biHBSo1Mu$I)sUq*h!ph!^(ddE5tKN6D5J
zNH08cyzL1RK1LmJ$)LmyvNDN1FsF>h>P@4g%&eA-1})cX9kEGCTJG5NA}tc00XYW`
zl)+H`tt*QSQm+^#x>zE`TUCQ(8`aiQxwZ)VN^D?=nexeL{>Wze4tgo8pWVKD``*}r
z965-M9>m5V-~^WLLuVZpT+2!Z`J(qCfBq4MpIvXhKhHdO<9)L!v^x=>4U0d-u0`4A
zso>`_s4=-0mSz+3-hj+;N}0=xd&3vza^kZd%<!{_o8z>JbJAQMK5?gnEzBPneC>V-
z-@BuOCvQu)Q$LGne!6@zD~?S8UfBDDjY$ZqSFr*gsx$0~Y^u|ren5iEnl<whTL>pg
zJI#iY2v<0`;A2GiK$AEZ2`-Xc@QWvQCek9waD0)AEE7%s+vxA_Cporu)MBGtD7NU$
zLg}VaS|%e*ndeqJQ1UhcFZ_M?-+d5x9?JddAA0T{Iuw!Sha>N7Vk(awXQoo(lk^1!
zcT&>Su)LF%InD>CJ>sq#PkW%CZDcx9scIC7S%I0-Lv+L<pyLGW)%sGsMadgXGYj2a
zae0)X_tHIZwQG5?<8IM%wfPz`YPvy)haGhsg#sVBLV@th??{BX8-x#onZ3zGUgulR
xbR5MozEam)Rbzr&V><rpYu*Q!?>rudtS{}2;lz=MgxsOP(BV5^_-1U}`EU2C7wG^1

diff --git a/backend/blueprints/__pycache__/main.cpython-312.pyc b/backend/blueprints/__pycache__/main.cpython-312.pyc
index bc4d2caacb37c676179ec0f807aabb30fc67741b..35db3ff5c3d8245748582e2115ce42bbb7650ce3 100644
GIT binary patch
delta 711
zcmZWm&x_MQ6rRbCCT)|pvaPYZTCrQ`c3Bq$7Y}Mg(G?F~Tm;EwEXlZ}H0|<|co3mp
zye^ixdG;dRi+J*1(96Ou9&+*r=uuEXSv)wC>_XWF^1bhU?|Yf|ChzBd%$Xldvw-;X
zXXm^Bd2H74$8r1GN?<q!MjrOmz8RF95=IiDvX`S}PutNavgkm_sZiW&j=!|!ER1-_
zD%03&PiGmY)d|kn@#xgVH)lI~=Vvuq^YRlZ(;bUeq}~Pg5O>r%t#G!Dud4GY+r=Hc
zzz*;TE9{AM$x3Q|NZc5J4k8kV6iC+#`~iC-t>ahhue7?h6sbqYO%4e(B5g*iM)@Nx
zDze-1nc{Rll-HMXAi5HHlSUve8j1oG0pf_)=od$HFwcI<%|e~i3V*}Ptf5%BeS2fy
zzR%W_CbrlE<*se;8k`hh2{^?eDWtQLt?nj;1ulq6Smy8y{nn9Ty?DA;Z0#y7u-<-E
z{$X5ZpK>p&X{*6ke@sajbtB(}Wwxz7KOx#XrxT43Z|D*N4c5}_Q95;E#F5_*SNXMh
z6u{)pL?>j>4JbF3cnW8Qrg=UH5f%>}kNiG&B>Ii(8@I^KJNMw6@QR<Ds4$Ep3S#ke
idRP|h*ou1LN-*@|KDFT@`=&1{?jCZPnSZB<Y5xNq^p!IJ

delta 712
zcmZ{g&1(}u7{+Jz!`(EyiIR^t)s{3ZltonVgHmZCN(~4V!RjRhmL)TW4V!FuccVhZ
z)`NIWItRgncZql@9t8ga^-wjZJ$v_{ClPUG(|{GaFwZ>m%<p|?X1`}XWXzAIIfeLl
zOM2_>4a@@mGFZN{h7rL;^^CSzGcl47mB}%hBHC+xC<_{)TAJckF}8=KwK&+%<&N6G
z#lib!oM9<kC})poaQaZcctNuyF_gx6El<;}bBth1or&EpE~|yujj)Ah*&n=(W%gKF
zVV|U`-se@%QHYtZp1MQu5RbdSe5j5cLc;?C*-)EgVPfKlG^v@)o9JJTy_BnE6+~qu
zH)#mscY-2BobU?$;EH}-tX{5n!Eez<SZ{#yz@u=c>-Cy$r_Kzev@pY=<9q~{xa^>B
zTI$)>ldb;hNShm#Rz{^&c2_CkJbS3ztRy)CIU#u=(_Eq{hqT>}-F2E2W_cjOAkAe5
z{nU{$-GB5oxwNk=L4HqGe`B25)m~)dN+Y0fpV~p_gl+>Y_C|YpLiDvxMw)FCzhT=j
z$JX`Ac4YKI*9*=9?GOrJa46DkyW_MeXH33?d68+v1rb8&fVk&+oQU*mS2wTQ>o;yg
vQLqbQR|UTpQV`FN?+uo4|2<A$Yx|_9db9!;STeDwY<xx=?0n*#A};zDe3FyW

diff --git a/backend/blueprints/auth.py b/backend/blueprints/auth.py
index 5a459c1..479918b 100644
--- a/backend/blueprints/auth.py
+++ b/backend/blueprints/auth.py
@@ -5,7 +5,7 @@ from flask import Blueprint, request, redirect, url_for, session, jsonify
 from werkzeug.security import check_password_hash
 
 from utils.db import get_db
-from utils.auth import login_required, is_session_user_valid
+from utils.auth import login_required, is_session_user_valid, is_current_user_admin
 from utils.render import render_html
 
 auth = Blueprint('auth', __name__, url_prefix='')
@@ -13,7 +13,7 @@ auth = Blueprint('auth', __name__, url_prefix='')
 
 @auth.route('/login', methods=['GET', 'POST'])
 def login():
-    if session.get('user_id') and is_session_user_valid():
+    if session.get('user_id') and is_session_user_valid() and is_current_user_admin():
         return redirect(url_for('main.admin_page'))
     if request.method == 'POST':
         data = request.get_json() if request.is_json else request.form
@@ -35,6 +35,11 @@ def login():
                 session.permanent = True
                 session['user_id'] = row['id']
                 session['username'] = username
+                if not row.get('is_admin'):
+                    session.clear()
+                    if request.is_json:
+                        return jsonify({'success': False, 'error': '需要管理员权限'}), 403
+                    return render_html('login.html', error='需要管理员权限')
                 if request.is_json:
                     return jsonify({'success': True, 'redirect': url_for('main.admin_page')})
                 return redirect(url_for('main.admin_page'))
@@ -61,7 +66,7 @@ def api_auth_check():
             cur.execute("SELECT machine, is_admin FROM users WHERE id = %s", (session['user_id'],))
             row = cur.fetchone()
         conn.close()
-        if not row:
+        if not row or not row.get('is_admin'):
             return jsonify({'logged_in': False})
     except Exception:
         return jsonify({'logged_in': False})
diff --git a/backend/blueprints/main.py b/backend/blueprints/main.py
index 7bbcdfc..1781403 100644
--- a/backend/blueprints/main.py
+++ b/backend/blueprints/main.py
@@ -4,7 +4,7 @@
 import os
 from flask import Blueprint, redirect, url_for, send_file, session
 
-from utils.auth import login_required, admin_required, is_session_user_valid
+from utils.auth import login_required, admin_required, is_session_user_valid, is_current_user_admin
 from utils.render import render_html
 
 main = Blueprint('main', __name__, url_prefix='')
@@ -15,7 +15,7 @@ STATIC_DIR = os.path.join(BASE_DIR, 'static')
 
 @main.route('/')
 def index():
-    if session.get('user_id') and is_session_user_valid():
+    if session.get('user_id') and is_session_user_valid() and is_current_user_admin():
         return redirect(url_for('main.admin_page'))
     return redirect(url_for('auth.login'))
 
diff --git a/backend/config.py b/backend/config.py
index 97a3eb7..6692838 100644
--- a/backend/config.py
+++ b/backend/config.py
@@ -23,8 +23,8 @@ bucket_path = "nanri-image/"
 file_url_pre = f"https://{bucket}.oss-cn-hangzhou.aliyuncs.com/"
 
 import os
-backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://127.0.0.1:18080').rstrip('/')
-# backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://8.136.19.173:18080').rstrip('/')
+# backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://127.0.0.1:18080').rstrip('/')
+backend_java_base_url = os.environ.get('BACKEND_JAVA_BASE_URL', 'http://8.136.19.173:18080').rstrip('/')
 os.environ['OSS_ACCESS_KEY_ID'] = accessKeyId
 os.environ['OSS_ACCESS_KEY_SECRET'] = accessKeySecret
 os.environ['SECRET_KEY'] = "ddffc7c1d02121d9554d7b080b2511b6"
diff --git a/backend/utils/__pycache__/auth.cpython-312.pyc b/backend/utils/__pycache__/auth.cpython-312.pyc
index 680ff014258a5115d1e032abbd34d7e430e03e16..b681092da185760b7a6dc0207062ff1ab1bb3ea8 100644
GIT binary patch
delta 1890
zcmbtUYitx%6ux&}yR)<H%rf1+)9!9xY+D=KZ3`;2Nn5*-K-DZJKp?etmROJy?`$8y
z*476}8x=~fQIJM4F$Mw}Nla`6(Y7)E!06P4SZfobQsI}Dwnl_Mo;%w`h$Q~-PUgGk
zo^v1P{YA-SQQF0{G#7&L^O>t%Wk=F-@RLW%p3n^WCA3X7T!7j>CFnjobPMB6G|rU;
zubg{z{{5r#V<&$<fBee$3Ozr3?AP&wS5JN7Goz;2wYU41p%>^i?se>?$M|Zj(2M-6
zFoqGL6V7s4i^m1xiSx8j_IkzBz-Ge~3?a_%<RU03@kl92KQ_I1g-gE@T}7PX?8b&X
zAjDTr6rpNl;yw<etq8;S%69sfn3u`*p?-cV>cc@-PZ*xK_StLm$KRsmQiB^5ByL~@
zxwbaCU)rR!%{sfx_6}oDS2z7Zs+61{Bx&@Z>JJ1(lEGG92AK@97~}((B7o0FTO1`)
zAzNRd7N0HUEO6;!F8z(qan5KvW;_|A5<TIl8O%DWk3L|z^Jmmmhx<nQMtff#{8oMH
z!{(2}XT#%<CTcfYwVU5rZ*A)s7G_j^G%~!;a%TVOMd^9NJ8ms!BDZ%DVKMi6HD`f`
z`KDO~Z@!t^)QCPRZVK@e*;PPJIw}~3#HMwQ$+ZqfH_FWlKjj+4Fm=L_+k*p&hkvOU
z;0+X8i3LKZSGH`29Rp|p$B}`1QH1&H6h{g`N|?PtOnhwOY;Vlsc9Y%c^O0<rX1(Ci
z&K^Rd-Ldu_GfEy$`j@cB>fkqX0fx|AdT}DX^!e~m%dme&Q7yf~QYtK=VhN<^E_Ioz
zwz{oAfVzmL<9u$HNd2--zfokj!R=m+n3{ase)^v5H-bE2A)0kO9qllp#3X63I)z9H
zOi3lRb{6+t9sTVj`fN|sjFEDXJqW+a%mnq6Rfii#8oyHtrj-J#usWgCSoN*bN~<Nb
z+V{|H&JO$mJ@0G@RmB`|#vUmT5-ldDcm`+ihA_sZGTRV$a`aGo7MAD%xya#YvvZPu
zDTllclFUFjN^%%5t!TDuhtvp!`4~Om$`uMPseXFKRi`KIVXlGbFxQfLy6p0aYk_Q_
zIZC;}3<gEF(6<$tyM*bd&gTE2?Phmrlbsse03YWJM=vJ-ZMyR=)8(Y;gSX2(<&+4L
z5r;;^IO;-i{4PF(Bd7?)G%&y(#fY>H2={Pw!JUqd>8bs3A$9Xz@4I$#o!nL=8E8Ow
zPGC{k_%Bu1hNL{QGWX%zJw-`ItCidbFA-LWq?$nug8;2i1G~GHp`e1Udxes)q#zOl
zmNIr35vKDj4=EUwNQiN38L&n}ifmD|ztaw{$qxG17_ze%!u^w4Ds2F+`Qx3bQQ}(=
zWH~gKS((VJ8VL`#jQXLoSb3poH8iIeUD8YF*INGINq53mm&mHOwE6`H(rT}3Nb`&q
zTdMzP>9p#%oc<fjGSYGu5f7KCEbr#B3QpFY4~?7W)=n3;B(fg<+_bVbT-G+s>3L(}
z6B`rx)d{`kvb*Nif&&iSH17xHCbaUVY&7wZ4mg=DH<$5~{y=lU$4~JX7E`j`9N?$&
zZ8{(Vhp?O`Yv=`!uYNs{k1z}U05_m8Mb~iki(8gBO$;pYNJ?K|)ItE-q$On7CD9i2
z(2P})Ue<B!3L>l`2)l^{8T``+oa^@NHF}<jHjpL|utsRE0f0t}@pX>F!XFaC`BzcH
mWz;Z_@)jiz_Aaj0aqeOzhbtFd7>Dtq(}}%HnL75`7yk{C^Q#{K

delta 2233
zcmb_dTTB#J7(QoaXZFVK>@qCtvRoFH+X`Mlxrh}aB3Ntj0jtt@+cGQNEjMSD;sv_4
zO$?+~*c=s1snx^>jj5N1R$EQ1L`~Y7W^gqkA#Iw7mxo3Kt*!K-=gc~Y8q=4aNxt*X
z|Nrx!^IvDceL2JQv&m!tc&((q@m~m=9B@@Q>mAKDy~l8R_auaV)JbJ=qy0zk>^pVm
z^An@rquXb{Mkgt!^ZtP&F3BfJ{^lmv=y%`VyRdiki-WF8Z-eARL)3ofoXV1QEn;)P
zR~KAYCwki&eB!K@hSqw2(>l~l=RpHHOb@$)5P)8w2V{?~<InaE&<+ALT1O@53P1;J
zhXDqK89o&TSyfe_9GKh;k5f?&1XxQ?K8fp~1e!e4L;zWtL>&YnO0>39XfYFK5j4l2
zoh!j@Oq3Zbuqtyal<e51qKkfHj3$ksYo|6-H9*i~?(d8(zjiBK3)-L?1kLKL(t$`r
zPz$y(Z6GT37+P0j>AgK?M!WZ;Y_>G^!THYnUmm=B;_%&`U8CW?2j{zx$i5vX#$dJT
zVVz&v=oK3MO&+Sc8vVrPE+Q!s$q6DyKu5qrz)HYGfXCpWMH`{x3D_}6GzL_r%`hjE
zx04ulf-#K=?b0S2N31jY9D`Q3Y{@{!wE3Z=AuhJNt*fo)!_Pw3xc5#iIa77I>g>wM
z{1x*2RfiVILcPq@%es2`UGEhAga>A4=laP<aUjMv4j_|oi*t<8cz-I*$ESUgP@V(&
zbIMcbi`pDaUYwVOallCvOkv8iwFBu|Lg(o9<wf*BA;gFt>%Hu+`0ITTg)}qKE`u$l
z@_E_=#Qm2R>Sk<Jl$tn!{vaDiz!Eg7YJx^!1h)UVhL)r;NFt}KAc?E81Rc6#aO?Ed
zN;00J7JVwR80RJHqET03P0CJWFbr$o_jv`MD515+^=uyINOkC(F~J_+9qJ0*<kAMY
zG}&Dc;R@xF<=437=$5g7pCIRmBs0e-aW<jnpwt)_laI-{s4`|IoQt-^2y7-+iAKOB
zRR%R!s;t0N{i__DV(k8`=gz6_>s5_c-A7jq4yZ#uQzqL%wNnAB+G%t<9pIHt(+Abh
zfdF6WG&*1-pTu`)1VEl?okj)hSd_?yG`Q0=<Zd2=nwtN?6XOesj3J&hnpFGhUW11U
z1-jUF;Kx(p2;2i}fE(li3ARzBJ0X5{@0jY|8LF$edpC42{~hhOUXFHha9Xs3PSsvJ
zqu%I+TbnmibyO`5TL<$IgMKmCp$UC#w%6b{JY5uS8=RUST(lTPH?}IKW2h7}2$@O1
zLtrL`?Xzo^u2{Ncl}jBTxh}D}!H52!9F*upSIud~+qp)sziGBITsF3N>wW%5cmR6L
z(`uWPwU|SI_#={H6Se3cHg(}JEd@o7R?H==Sp;4jHp9@Tl(VG8GMBP;iX^bOzH7P6
zyf-i@)#CI1+6iuR@!dPRcJwW{&Si{X`gPrs5gMaR`r;AZfr>jThOD+;XV|$n>5zNK
z!uJ}(MmcfC)i!y}rook7xw`JUMHq^A^frVWP*V^6gaNTBV=ORPyO(z@-@W1%AKzE^
zRsDhbLxJnbc_Vy6Z&|qPCZ9RTXUbU%B7BKlT78YL9&x4}ZI#Pb54zVxoNLjaoH-<C
zFNnBGBKC!{W#O0>q~t%e0E@LJUFK5zG6%U-S(p06fe-6RntX&Mj&VTaJHO7Y5qt8{
zg7fpvZaG&tm{K0GFZrQHwlBM3SvJBu`>W*if=FUvgfF@gQ#3iI#fF}Sq&IQsE+!{b
zc)-QtoQfoRz`ZyTzgz-5!6c?4Q+p{*OK6Y2(n4R#FR3)rmvbSeFX!`^zQPdtijl#n
zj2=-LR^-RI$)zM|*c`12(YK}5FZu+r2+J0dl%<k{<D88!hR(cC*G^D8lQuyE);vb2
zv1~l~Wlfwo7i(2}IP|xrW&;^zih*N5;YUx<z0ue#v^Mxk#YI?7{=5<~jei#qKBOq9
ldCUTs_!}s_0ZK=KbDXt8+juqy6UNhZ&^8et4{eIIe*xAG3n2gi

diff --git a/backend/utils/auth.py b/backend/utils/auth.py
index efe8eb3..d81fff1 100644
--- a/backend/utils/auth.py
+++ b/backend/utils/auth.py
@@ -2,13 +2,14 @@
 认证装饰器与 session 校验
 """
 from functools import wraps
+
 from flask import request, redirect, url_for, session, jsonify
 
 from utils.db import get_db
 
 
 def is_session_user_valid():
-    """校验 session 中的 user_id 是否在数据库中仍存在；不存在则清除 session 并返回 False"""
+    """校验 session 中的 user_id 是否仍存在；不存在则清空 session。"""
     uid = session.get('user_id')
     if not uid:
         return False
@@ -28,28 +29,41 @@ def is_session_user_valid():
 
 
 def get_current_admin_role():
-    """获取当前登录用户的管理角色：super_admin / admin / None（非管理员）"""
+    """返回当前登录用户的管理角色：super_admin / admin / None。"""
+    uid = session.get('user_id')
+    if not uid:
+        return None, None
     try:
         conn = get_db()
         with conn.cursor() as cur:
             cur.execute(
                 "SELECT id, username, is_admin, role, created_by_id FROM users WHERE id = %s",
-                (session['user_id'],)
+                (uid,)
             )
             row = cur.fetchone()
         conn.close()
         if not row or not row.get('is_admin'):
-            return None, None
-        return row.get('role') or ('super_admin' if row.get('created_by_id') is None else 'admin'), row
+            return None, row
+        role = row.get('role') or ('super_admin' if row.get('created_by_id') is None else 'admin')
+        return role, row
     except Exception:
         return None, None
 
 
+def is_current_user_admin():
+    role, _ = get_current_admin_role()
+    return role in ('super_admin', 'admin')
+
+
+def _is_ajax_request():
+    return request.headers.get('X-Requested-With') == 'XMLHttpRequest'
+
+
 def login_required(f):
     @wraps(f)
     def decorated(*args, **kwargs):
         if not session.get('user_id') or not is_session_user_valid():
-            if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+            if _is_ajax_request():
                 return jsonify({'success': False, 'error': '未登录'}), 401
             return redirect(url_for('auth.login'))
         return f(*args, **kwargs)
@@ -59,23 +73,20 @@ def login_required(f):
 def admin_required(f):
     @wraps(f)
     def decorated(*args, **kwargs):
-        if not session.get('user_id'):
-            if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+        if not session.get('user_id') or not is_session_user_valid():
+            if _is_ajax_request():
                 return jsonify({'success': False, 'error': '未登录'}), 401
             return redirect(url_for('auth.login'))
+
         try:
-            conn = get_db()
-            with conn.cursor() as cur:
-                cur.execute("SELECT is_admin, role FROM users WHERE id = %s", (session['user_id'],))
-                row = cur.fetchone()
-            conn.close()
-            if not row or not row.get('is_admin'):
-                if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
+            role, _ = get_current_admin_role()
+            if role not in ('super_admin', 'admin'):
+                if _is_ajax_request():
                     return jsonify({'success': False, 'error': '需要管理员权限'}), 403
-                return redirect(url_for('main.admin_page'))
-        except Exception as e:
-            if request.headers.get('X-Requested-With') == 'XMLHttpRequest':
-                return jsonify({'success': False, 'error': str(e)}), 500
-            return redirect(url_for('main.admin_page'))
+                return redirect(url_for('auth.login'))
+        except Exception as exc:
+            if _is_ajax_request():
+                return jsonify({'success': False, 'error': str(exc)}), 500
+            return redirect(url_for('auth.login'))
         return f(*args, **kwargs)
     return decorated