feat: Multi-user system with PostgreSQL - WIP temporary save

backend_api_python/app/routes/settings.py

@@ -1,11 +1,14 @@
 """
 Settings API - 读取和保存 .env 配置
+
+Admin-only endpoints for system configuration management.
 """
 import os
 import re
 from flask import Blueprint, request, jsonify
 from app.utils.logger import get_logger
 from app.utils.config_loader import clear_config_cache
+from app.utils.auth import login_required, admin_required
 
 logger = get_logger(__name__)
 
@@ -791,8 +794,10 @@ def write_env_file(env_values):
 
 
 @settings_bp.route('/schema', methods=['GET'])
+@login_required
+@admin_required
 def get_settings_schema():
-    """获取配置项定义"""
+    """获取配置项定义 (admin only)"""
     return jsonify({
         'code': 1,
         'msg': 'success',
@@ -801,8 +806,10 @@ def get_settings_schema():
 
 
 @settings_bp.route('/values', methods=['GET'])
+@login_required
+@admin_required
 def get_settings_values():
-    """获取当前配置值 - 包括敏感信息（真实值）"""
+    """获取当前配置值 - 包括敏感信息（真实值）(admin only)"""
     env_values = read_env_file()
     
     # 构建返回数据，返回真实值
@@ -825,8 +832,10 @@ def get_settings_values():
 
 
 @settings_bp.route('/save', methods=['POST'])
+@login_required
+@admin_required
 def save_settings():
-    """保存配置"""
+    """保存配置 (admin only)"""
     try:
         data = request.get_json()
         if not data:
@@ -878,8 +887,10 @@ def save_settings():
 
 
 @settings_bp.route('/openrouter-balance', methods=['GET'])
+@login_required
+@admin_required
 def get_openrouter_balance():
-    """查询 OpenRouter 账户余额"""
+    """查询 OpenRouter 账户余额 (admin only)"""
     try:
         import requests
         from app.config.api_keys import APIKeys
@@ -954,8 +965,10 @@ def get_openrouter_balance():
 
 
 @settings_bp.route('/test-connection', methods=['POST'])
+@login_required
+@admin_required
 def test_connection():
-    """测试API连接"""
+    """测试API连接 (admin only)"""
     try:
         data = request.get_json()
         service = data.get('service')