feat：对接中心平台，完善接口鉴权

app/services/agent.py

@@ -31,12 +31,12 @@ class AgentService:
         self._active: set[str] = set()
         self._conversation_of: dict[str, str] = {}
 
-    async def prepare_run(self, request: DesignRequest):
+    async def prepare_run(self, request: DesignRequest, user_id: int):
         # 会话 ID 必须由后端签发，不再为缺失的 ID 兜底生成
         conversation_id = request.context.conversation_id
         if conversation_id is None:
             raise BizException(422, "请先创建会话并传入 conversation_id")
-        if not await self.store.exists(conversation_id):
+        if not await self.store.exists(conversation_id, user_id):
             raise BizException(404, "会话不存在或已过期")
 
         # 新请求始终独立建任务，不用 conversation_id 充当检查点 ID
@@ -72,9 +72,10 @@ class AgentService:
                 "message_id": str(uuid4()),
             },
             conversation_id,
+            user_id,
         )
 
-    async def prepare_resume(self, request: ResumeRequest):
+    async def prepare_resume(self, request: ResumeRequest, user_id: int):
         # 在发送流响应头之前完成校验并占用任务
         thread_id = str(request.thread_id)
         # 检查和占用之间没有 await，同一事件循环内不会重复进入
@@ -83,7 +84,10 @@ class AgentService:
             snapshot = await self.graph.aget_state(
                 {"configurable": {"thread_id": thread_id}}
             )
-            if not snapshot.values:
+            # 不属于当前用户的任务与不存在同样处理，先于其余校验，不泄露任务状态
+            if not snapshot.values or not await self.store.exists(
+                snapshot.values["conversation_id"], user_id
+            ):
                 raise BizException(404, "任务不存在或已过期")
             if not any(task.interrupts for task in snapshot.tasks):
                 raise BizException(409, "任务当前未等待用户补充")
@@ -119,6 +123,7 @@ class AgentService:
                     update={"message_id": str(uuid4())},
                 ),
                 conversation_id,
+                user_id,
             )
         except BaseException:
             self.release(thread_id)
@@ -196,13 +201,17 @@ class AgentService:
             failure_reason=state.get("failure_reason"),
         )
 
-    async def stream(self, thread_id, payload, session_id):
+    async def stream(self, thread_id, payload, session_id, user_id=None):
         """消费图事件，完整状态只用于整理最终结果，不直接暴露给客户端"""
         state = None
         with logger.contextualize(thread_id=thread_id):
             async with aclosing(
                 astream_screen(
-                    self.graph, payload, thread_id=thread_id, session_id=session_id
+                    self.graph,
+                    payload,
+                    thread_id=thread_id,
+                    session_id=session_id,
+                    user_id=user_id,
                 )
             ) as events:
                 async for mode, data in events: