feat(auth): add configurable password login with SSO default

Co-authored-by: HiFox Agent <agents-noreply@hifox.com>

src/server/auth/middleware.ts

@@ -1,8 +1,7 @@
 import type { Context, Next } from 'hono';
-import jwt from 'jsonwebtoken';
-import type { JwtPayload, AuthUser } from './types.js';
+import type { AuthUser } from './types.js';
+import { authMode, verifyAuthToken } from './config.js';
 
-const JWT_SECRET = process.env.JWT_SECRET || 'ln-bi-default-secret';
 
 // 临时：跳过所有认证（保留完整逻辑便于快速恢复）
 const BYPASS_AUTH = false;
@@ -15,7 +14,7 @@ export async function authMiddleware(c: Context, next: Next) {
   }
 
   // 本地开发免登录开关：.env 里设 DEV_BYPASS_AUTH=1 启用
-  if (process.env.DEV_BYPASS_AUTH === '1') {
+  if (process.env.NODE_ENV !== 'production' && process.env.DEV_BYPASS_AUTH === '1' && authMode() === 'sso') {
     const devUser: AuthUser = {
       userId: 'dev-local',
       userName: '本地开发',
@@ -42,7 +41,10 @@ export async function authMiddleware(c: Context, next: Next) {
   const token = authHeader.slice(7);
 
   try {
-    const payload = jwt.verify(token, JWT_SECRET) as JwtPayload;
+    const payload = verifyAuthToken(token);
+    if (payload.authMethod === 'password' && !['GET', 'HEAD', 'OPTIONS'].includes(c.req.method)) {
+      return c.json({ error: 'Password account is read-only' }, 403);
+    }
     const user: AuthUser = {
       userId: payload.userId,
       userName: payload.userName,