快速问答调整

backend-java/src/main/java/com/pharmacopoeia/controller/AdminKnowledgeController.java

@@ -208,10 +208,10 @@ public class AdminKnowledgeController {
         return ResponseEntity.ok(service.knowledgeStats());
     }
 
-    // ==================== 快捷提问标签管理 ====================
+    // ==================== 快捷提问标签管理（管理端，需要 JWT） ====================
 
     @GetMapping("/quick-asks")
-    public ResponseEntity<List<Map<String, Object>>> listQuickAsks() {
+    public ResponseEntity<List<Map<String, Object>>> listAllQuickAsks() {
         return ResponseEntity.ok(service.listAllQuickAsks());
     }
 

backend-java/src/main/java/com/pharmacopoeia/controller/YaodianQuickAskController.java

@@ -0,0 +1,28 @@
+package com.pharmacopoeia.controller;
+
+import com.pharmacopoeia.service.AdminKnowledgeService;
+import org.springframework.http.ResponseEntity;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * 药典快捷提问标签 公开查询端点（不需要 JWT 鉴权）。
+ * 管理端的 CRUD 在 AdminKnowledgeController 中（/api/v1/admin/knowledge/quick-asks）。
+ */
+@RestController
+@RequestMapping("/api/v1/yaodian")
+public class YaodianQuickAskController {
+
+    private final AdminKnowledgeService service;
+
+    public YaodianQuickAskController(AdminKnowledgeService service) {
+        this.service = service;
+    }
+
+    @GetMapping("/quick-asks")
+    public ResponseEntity<List<Map<String, Object>>> listQuickAsks() {
+        return ResponseEntity.ok(service.listQuickAsks());
+    }
+}

backend-java/src/main/java/com/pharmacopoeia/security/SecurityConfig.java

@@ -39,7 +39,7 @@ public class SecurityConfig {
         if (authProperties.isEnabled()) {
             // 生产模式：所有 /api/** 需要鉴权，公开路径仅限登录和静态资源
             http.authorizeHttpRequests(auth -> auth
-                    .requestMatchers("/health", "/api/v1/auth/**").permitAll()
+                    .requestMatchers("/health", "/api/v1/auth/**", "/api/v1/quick-asks").permitAll()
                     .requestMatchers("/static/**", "/").permitAll()
                     .requestMatchers("/api/**").authenticated()
                     .anyRequest().permitAll()

static/index.html

@@ -160,7 +160,11 @@
   // 退出页面即失效，重新进入必须再次通过 URL 传入
   var TOKEN = (function(){
     var p = new URLSearchParams(window.location.search);
-    return p.get('token') || '';
+    var t = p.get('token') || '';
+    // 兼容外部系统可能传入额外前缀或引号的情况
+    t = t.replace(/^["']+/, '').replace(/["']+$/, ''); // 去掉首尾引号
+    if (t.startsWith('Bearer ')) t = t.substring(7);     // 去掉多余 Bearer 前缀
+    return t;
   })();
 
   function syncAppHeight(){
@@ -667,7 +671,7 @@
 
   async function loadQuickAsks(){
     try {
-      var r = await fetch(API_BASE + '/api/v1/quick-asks');
+      var r = await fetch(API_BASE + '/api/v1/yaodian/quick-asks');
       if (!r.ok) return;
       var items = await r.json();
       var container = document.getElementById('quickTags');