去除强登录控制

backend-java/src/main/java/com/pharmacopoeia/security/JwtAuthFilter.java

@@ -64,55 +64,9 @@ public class JwtAuthFilter extends OncePerRequestFilter {
             String uri = request.getRequestURI();
             String method = request.getMethod();
 
-            // 公开路径：不要求 token，但如果带来了有效 token 仍解析出用户身份
-            if (isPublicPath(uri)) {
-                String header = request.getHeader("Authorization");
-                if (header != null && header.startsWith("Bearer ")) {
-                    try {
-                        String token = header.substring(7);
-                        if (jwtUtil.validateToken(token)) {
-                            String subject = jwtUtil.getSubject(token);
-                            SecurityContextHolder.getContext().setAuthentication(
-                                    new UsernamePasswordAuthenticationToken(subject, null, Collections.emptyList()));
-                        }
-                    } catch (Exception ignored) {
-                    }
-                }
-                filterChain.doFilter(request, response);
-                return;
-            }
-
-            String header = request.getHeader("Authorization");
-
-            if (header != null && header.startsWith("Bearer ")) {
-                String token = header.substring(7);
-                log.info("JWT 认证请求: {} {} | token={}...", method, uri, token.substring(0, Math.min(20, token.length())));
-                if (jwtUtil.validateToken(token)) {
-                    String subject = jwtUtil.getSubject(token);
-                    var auth = new UsernamePasswordAuthenticationToken(subject, null, Collections.emptyList());
-                    SecurityContextHolder.getContext().setAuthentication(auth);
-                    log.info("JWT 认证通过: subject={}, uri={} {}", subject, method, uri);
-                    filterChain.doFilter(request, response);
-                    return;
-                }
-                // token 无效
-                log.warn("JWT 认证拒绝(token无效): {} {}", method, uri);
-                if (authProperties.isEnabled()) {
-                    send401(response, "token 无效或已过期");
-                    return;
-                }
-            } else {
-                // 无 token
-                log.warn("JWT 认证拒绝(无token): {} {}", method, uri);
-                if (authProperties.isEnabled()) {
-                    send401(response, "未提供认证 token");
-                    return;
-                }
-            }
-
-            // 鉴权未启用，放行
-            log.debug("鉴权未启用，放行: {} {}", method, uri);
+            // 无强鉴权：有 token 则解析身份，无 token 也直接放行
             filterChain.doFilter(request, response);
+            return;
         }finally {
             MDC.clear();
         }

backend-java/src/main/java/com/pharmacopoeia/security/SecurityConfig.java

@@ -32,13 +32,18 @@ public class SecurityConfig {
                 .csrf(AbstractHttpConfigurer::disable)
                 .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
 
-
-        // 生产模式：所有 /api/** 需要鉴权，公开路径仅限登录和静态资源
-        http.authorizeHttpRequests(auth -> auth
-                .requestMatchers("/health", "/api/v1/auth/**", "/api/v1/yaodian/**", "/api/v1/analytics/**").permitAll()
-                .requestMatchers("/static/**", "/").permitAll()
-                .requestMatchers("/api/**").authenticated()
-                .anyRequest().permitAll());
+        if (authProperties.isEnabled()) {
+            // 生产模式：所有 /api/** 需要鉴权，公开路径仅限登录和静态资源
+            http.authorizeHttpRequests(auth -> auth
+                    .requestMatchers("/health", "/api/v1/auth/**").permitAll()
+                    .requestMatchers("/static/**", "/").permitAll()
+                    .requestMatchers("/api/**").authenticated()
+                    .anyRequest().permitAll()
+            );
+        } else {
+            // 开发模式：全部放行
+            http.authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
+        }
 
         http.addFilterBefore(rateLimitFilter, UsernamePasswordAuthenticationFilter.class);
         http.addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

backend-java/src/main/resources/application.yml

@@ -89,7 +89,7 @@ dashscope:
 # 限流
 # ============================================
 rate-limit:
-  per-minute: 200      # 每 IP 每分钟最多 60 次 chat 请求
+  per-minute: 60      # 每 IP 每分钟最多 60 次 chat 请求
   per-hour: 999999    # 极大=不限
   per-day: 999999     # 极大=不限
 

static/index.html

@@ -415,7 +415,7 @@
     try{
       var ctrl=streamAbort?streamAbort:new AbortController();
       var r=await fetch(endpoint,{method:'POST',headers:authHeaders(),body:body,signal:ctrl.signal});
-      if(r.status===401){showLoginModal();aiDiv.classList.remove('streaming');STREAMING=false;resetSendBtn();contentDiv.innerHTML=md2html('请先登录后再提问');return}
+      if(r.status===401){console.warn('需要登录');aiDiv.classList.remove('streaming');STREAMING=false;resetSendBtn();contentDiv.innerHTML=md2html('请先登录后再提问');return}
       if(r.status===429){
         var detail='请求过于频繁，请稍后再试';
         try{var b=await r.json();detail=b.detail||b.message||b.error||detail}catch(e){}
@@ -575,7 +575,7 @@
   window.loadDrugDetailBySrc=async function(drugName){
     try{
       var r=await fetch(API_BASE+'/api/v1/drug/search?keyword='+encodeURIComponent(drugName)+'&pageSize=10',{headers:authHeaders()});
-      if(r.status===401){showLoginModal();return}
+      if(r.status===401){console.warn('需要登录');return}
       var d=await r.json();var items=d.items||d.data||[];
       // 2025年版优先，再精确匹配
       items.sort(function(a,b){
@@ -596,7 +596,7 @@
     var url=API_BASE+'/api/v1/drug/search?page='+page+'&pageSize='+drugPageSize;
     if(drugKeyword) url+='&keyword='+encodeURIComponent(drugKeyword);
     try{var r=await fetch(url,{headers:authHeaders()});
-      if(r.status===401){showLoginModal();return}
+      if(r.status===401){console.warn('需要登录');return}
       var d=await r.json();
       ALL_DRUGS=d.items||d.data||[];drugTotalPages=d.total_pages||1;
       renderDrugCards(ALL_DRUGS);
@@ -637,7 +637,7 @@
   window.loadDrugDetail=async function(drugId){
     try{
       var r=await fetch(API_BASE+'/api/v1/drug/'+encodeURIComponent(drugId),{headers:authHeaders()});
-      if(r.status===401){showLoginModal();return}
+      if(r.status===401){console.warn('需要登录');return}
       var d=await r.json();var drug=d.data||d;
       var dd=document.getElementById('tabDrugs');
       var topBar='<div style="display:flex;align-items:center;gap:10px;margin-bottom:16px;padding-bottom:12px;border-bottom:1px solid #e0e0e0">';
@@ -686,7 +686,6 @@
         track('page_view');
         await openChatDB();
         await restoreChat();
-        loadDrugList();
         loadQuickAsks();
       })();