feat: Implement Supabase authentication, account management UI, and entitlement services.

src/bot/command_guard.py

@@ -25,12 +25,27 @@ class CommandGuard:
         if decision.allowed:
             return True
 
-        self.io_layer.bot.reply_to(
-            message,
-            (
+        if decision.reason == "bind_required":
+            denial_text = (
+                "🔒 当前指令需要订阅权限。\n"
+                "请先绑定账号后再试：\n"
+                "<code>/bind &lt;supabase_user_id&gt; [email]</code>"
+            )
+        elif decision.reason in {"supabase_subscription_required", "premium_required"}:
+            denial_text = (
                 "🔒 当前指令需要高级权限。\n"
                 "请先开通订阅后再使用。"
-            ),
+            )
+        else:
+            denial_text = (
+                "🔒 当前指令需要高级权限。\n"
+                "请先开通订阅后再使用。"
+            )
+
+        self.io_layer.bot.reply_to(
+            message,
+            denial_text,
+            parse_mode="HTML",
         )
         logger.info(
             "bot entitlement blocked command={} user_id={} reason={}",
@@ -44,4 +59,3 @@ class CommandGuard:
         if not self.ensure_entitled(message, command_label):
             return False
         return self.io_layer.ensure_query_points(message, cost, command_label)
-

src/bot/handlers/basic.py

@@ -36,6 +36,10 @@ class BasicCommandHandler:
         def _diag(message):
             self.handle_diag(message)
 
+        @self.bot.message_handler(commands=["bind"])
+        def _bind(message):
+            self.handle_bind(message)
+
     def handle_start_help(self, message: Any) -> None:
         trace = CommandTrace("/start", message)
         try:
@@ -73,3 +77,46 @@ class BasicCommandHandler:
             trace.set_status("ok")
         finally:
             trace.emit()
+
+    def handle_bind(self, message: Any) -> None:
+        trace = CommandTrace("/bind", message)
+        try:
+            parts = (message.text or "").split(maxsplit=2)
+            if len(parts) < 2:
+                self.bot.reply_to(
+                    message,
+                    (
+                        "❌ 用法:\n"
+                        "<code>/bind &lt;supabase_user_id&gt; [email]</code>\n\n"
+                        "示例:\n"
+                        "<code>/bind 11111111-2222-3333-4444-555555555555 user@example.com</code>"
+                    ),
+                    parse_mode="HTML",
+                )
+                trace.set_status("bad_request", "missing_supabase_user_id")
+                return
+
+            supabase_user_id = str(parts[1] or "").strip()
+            if len(supabase_user_id) < 8:
+                self.bot.reply_to(message, "❌ supabase_user_id 格式不正确。")
+                trace.set_status("bad_request", "invalid_supabase_user_id")
+                return
+            supabase_email = str(parts[2] or "").strip() if len(parts) >= 3 else ""
+            user = message.from_user
+            self.io_layer.db.upsert_user(user.id, self.io_layer.display_name(user))
+            self.io_layer.db.bind_supabase_identity(
+                telegram_id=user.id,
+                supabase_user_id=supabase_user_id,
+                supabase_email=supabase_email,
+            )
+            self.bot.reply_to(
+                message,
+                (
+                    "✅ 账号绑定完成。\n"
+                    f"supabase_user_id: <code>{supabase_user_id}</code>"
+                ),
+                parse_mode="HTML",
+            )
+            trace.set_status("ok")
+        finally:
+            trace.emit()

src/bot/io_layer.py

@@ -59,6 +59,7 @@ class BotIOLayer:
             "/top - 查看积分排行榜\n"
             "/id - 获取当前聊天的 Chat ID\n\n"
             "/diag - 查看 Bot 启动诊断\n\n"
+            "/bind - 绑定 Supabase 账号（可选）\n\n"
             "示例: <code>/city 伦敦</code>\n"
             f"💡 <i>提示: 每日签到(有效发言满 {MESSAGE_MIN_LENGTH} 字)获得 <b>{MESSAGE_POINTS}</b> 积分，"
             f"每日上限 {MESSAGE_DAILY_CAP} 分。</i>"

src/bot/services/entitlement_service.py

@@ -4,6 +4,7 @@ import os
 from dataclasses import dataclass
 from typing import Iterable, Set
 
+from src.auth.supabase_entitlement import SUPABASE_ENTITLEMENT
 from src.database.db_manager import DBManager
 
 
@@ -36,6 +37,10 @@ class BotEntitlementService:
     ):
         self.db = db
         self.enabled = _env_bool("POLYWEATHER_BOT_REQUIRE_ENTITLEMENT", False) if enabled is None else enabled
+        self.use_supabase = _env_bool(
+            "POLYWEATHER_BOT_USE_SUPABASE_ENTITLEMENT",
+            SUPABASE_ENTITLEMENT.enabled,
+        )
         commands = protected_commands or ("/city", "/deb")
         self.protected_commands: Set[str] = {str(c).strip().lower() for c in commands if str(c).strip()}
 
@@ -47,8 +52,15 @@ class BotEntitlementService:
             return EntitlementDecision(True, "command_not_protected")
 
         user = self.db.get_user(user_id) or {}
+        if self.use_supabase:
+            supabase_user_id = str(user.get("supabase_user_id") or "").strip()
+            if not supabase_user_id:
+                return EntitlementDecision(False, "bind_required")
+            if SUPABASE_ENTITLEMENT.has_active_subscription(supabase_user_id):
+                return EntitlementDecision(True, "supabase_subscription_active")
+            return EntitlementDecision(False, "supabase_subscription_required")
+
         has_premium = bool(user.get("is_web_premium") or user.get("is_group_premium"))
         if has_premium:
             return EntitlementDecision(True, "premium_user")
         return EntitlementDecision(False, "premium_required")
-