Add user authentication and role management

README.md

@@ -22,6 +22,14 @@ npm run build
 飞书自建应用需开通电子表格读取、知识库节点读取和云文档素材下载权限，
 并将应用添加到目标知识库或电子表格的文档应用中。
 
+后台登录首次启动还需要配置：
+
+- `SUPER_ADMIN_USERNAME`：唯一的超级管理员登录账号
+- `SUPER_ADMIN_PASSWORD`：超级管理员初始密码，至少 8 位
+- `ADMIN_INTERNAL_TOKEN`：自动采集等内部任务使用的服务密钥
+
+系统首次登录时创建唯一的超级管理员。后续管理员和普通用户均由“用户管理”页面创建，普通用户不能访问 KOC 资源库。
+
 This starter does not use `wrangler.jsonc`.
 
 ## Included Shape
@@ -33,63 +41,13 @@ This starter does not use `wrangler.jsonc`.
 - `examples/d1/` contains an optional D1 example surface
 - `drizzle.config.ts` supports local migration generation when needed
 
-## Workspace Auth Headers
+## 后台账号与角色
 
-OpenAI workspace sites can read the current user's email from
-`oai-authenticated-user-email`.
+- 超级管理员：唯一系统管理员，可管理管理员和普通用户。
+- 管理员：可访问全部业务模块，可创建和重置普通用户账号。
+- 普通用户：可使用工作台、任务、内容分发和数据回收，不可查看或导出 KOC 资源库。
 
-SIWC-authenticated workspace sites may also receive
-`oai-authenticated-user-full-name` when the user's SIWC profile has a non-empty
-`name` claim. The full-name value is percent-encoded UTF-8 and is accompanied by
-`oai-authenticated-user-full-name-encoding: percent-encoded-utf-8`.
-
-Treat the full name as optional and fall back to email when it is absent:
-
-```tsx
-import { headers } from "next/headers";
-
-export default async function Home() {
-  const requestHeaders = await headers();
-  const email = requestHeaders.get("oai-authenticated-user-email");
-  const encodedFullName = requestHeaders.get("oai-authenticated-user-full-name");
-  const fullName =
-    encodedFullName &&
-    requestHeaders.get("oai-authenticated-user-full-name-encoding") ===
-      "percent-encoded-utf-8"
-      ? decodeURIComponent(encodedFullName)
-      : null;
-
-  const displayName = fullName ?? email;
-  // ...
-}
-```
-
-## Optional Dispatch-Owned ChatGPT Sign-In
-
-Import the ready-to-use helpers from `app/chatgpt-auth.ts` when the site needs
-optional or required ChatGPT sign-in:
-
-- Use `getChatGPTUser()` for optional signed-in UI.
-- Use `requireChatGPTUser(returnTo)` for server-rendered pages that should send
-  anonymous visitors through Sign in with ChatGPT.
-- Use `chatGPTSignInPath(returnTo)` and `chatGPTSignOutPath(returnTo)` for
-  browser links or actions.
-- Pass a same-origin relative `returnTo` path for the destination after sign-in
-  or sign-out. The helper validates and safely encodes it.
-- Mark protected pages with `export const dynamic = "force-dynamic"` because
-  they depend on per-request identity headers.
-
-Dispatch owns `/signin-with-chatgpt`, `/signout-with-chatgpt`, `/callback`, the
-OAuth cookies, and identity header injection. Do not implement app routes for
-those reserved paths. Routes that do not import and call the helper remain
-anonymous-compatible.
-
-SIWC establishes identity only; it does not prove workspace membership. Use the
-Sites hosting platform's access policy controls for workspace-wide restrictions,
-or enforce explicit server-side membership or allowlist checks.
-
-Use SIWC for account pages, user-specific dashboards, saved records, and write
-actions tied to the current ChatGPT user. Leave public content anonymous.
+后台不提供注册、找回密码和普通用户个人改密。密码重置统一由管理员在后台完成。
 
 ## Useful Commands