feat(auth): add configurable password login with SSO default

Co-authored-by: HiFox Agent <agents-noreply@hifox.com>

src/server/auth/login.ts

@@ -3,14 +3,18 @@ import jwt from 'jsonwebtoken';
 import pool from '../db.js';
 import type { AuthUser, JwtPayload, PermissionLevel } from './types.js';
 import { FULL_ACCESS_ROLES, DEPT_ACCESS_ROLES } from './types.js';
+import { authMode, verifyAuthToken } from './config.js';
+import { passwordRouter } from './password.js';
 
 const app = new Hono();
+app.route('/', passwordRouter());
 
 const EXTERNAL_API_BASE = process.env.EXTERNAL_API_BASE || 'https://beta.lnh2e.com';
 const JWT_SECRET = process.env.JWT_SECRET || 'ln-bi-default-secret';
 
 /** GET /api/auth/exchange?jumpToken=xxx — 一步完成：换取用户信息 + 签发 JWT */
 app.get('/exchange', async (c) => {
+  if (authMode() !== 'sso') return c.json({ message: '当前使用固定密码登录' }, 403);
   const jumpToken = c.req.query('jumpToken');
   if (!jumpToken) return c.json({ error: 'Missing jumpToken' }, 400);
 
@@ -90,7 +94,7 @@ app.get('/me', async (c) => {
     return c.json({ error: 'No token' }, 401);
   }
   try {
-    const payload = jwt.verify(authHeader.slice(7), JWT_SECRET) as JwtPayload;
+    const payload = verifyAuthToken(authHeader.slice(7));
     return c.json(payload);
   } catch {
     return c.json({ error: 'Invalid token' }, 401);