Add user authentication and role management

app/api/bootstrap/route.ts

@@ -12,12 +12,13 @@ import {
   getRawDb,
   seedIfEmpty,
 } from "../../../lib/mvp-db";
-import { adminForbidden, isAdminRequest } from "../../../lib/admin-auth";
+import { authForbidden, getRequestPrincipal } from "../../../lib/user-auth";
 
 export const runtime = "edge";
 
 export async function GET(request: Request) {
-  if (!isAdminRequest(request)) return adminForbidden();
+  const principal = await getRequestPrincipal(request);
+  if (!principal) return authForbidden();
   try {
     await ensureSchema();
     await seedIfEmpty();
@@ -60,7 +61,12 @@ export async function GET(request: Request) {
     } else {
       await catchup;
     }
-    return Response.json(await getDashboardData());
+    const dashboard = await getDashboardData();
+    return Response.json(
+      principal.kind === "user" && principal.user.role === "user"
+        ? { ...dashboard, accounts: [] }
+        : dashboard,
+    );
   } catch (error) {
     return Response.json(
       { error: error instanceof Error ? error.message : "加载失败" },