feat：对接中心平台，完善接口鉴权

app/services/conversation.py

@@ -11,9 +11,11 @@ from app.schemas.conversation import Turn
 class ConversationStore(Protocol):
     """内存和 MongoDB 实现同一组方法，业务代码不需要关心具体存储"""
 
-    async def create(self) -> str: ...
+    async def create(self, user_id: int) -> str: ...
 
-    async def exists(self, conversation_id: str) -> bool: ...
+    async def exists(self, conversation_id: str, user_id: int) -> bool:
+        """会话已签发、未过期且属于该用户；不属于时与不存在同样返回 False"""
+        ...
 
     async def load_turns(
         self, conversation_id: str, limit: int | None
@@ -32,6 +34,7 @@ class InMemoryConversationStore:
         self._empty_ttl = timedelta(seconds=ttl)
         # 会话 ID -> 创建时间；轮次按 thread_id 去重并保持首次写入顺序
         self._created: dict[str, datetime] = {}
+        self._owner: dict[str, int] = {}
         self._turns: dict[str, dict[str, Turn]] = {}
 
     def _purge_expired(self) -> None:
@@ -43,17 +46,22 @@ class InMemoryConversationStore:
             if created < deadline and not self._turns.get(key)
         ]:
             del self._created[conversation_id]
+            self._owner.pop(conversation_id, None)
             self._turns.pop(conversation_id, None)
 
-    async def create(self) -> str:
+    async def create(self, user_id: int) -> str:
         self._purge_expired()
         conversation_id = str(uuid4())
         self._created[conversation_id] = _now()
+        self._owner[conversation_id] = user_id
         return conversation_id
 
-    async def exists(self, conversation_id: str) -> bool:
+    async def exists(self, conversation_id: str, user_id: int) -> bool:
         self._purge_expired()
-        return conversation_id in self._created
+        return (
+            conversation_id in self._created
+            and self._owner.get(conversation_id) == user_id
+        )
 
     async def load_turns(self, conversation_id: str, limit: int | None) -> list[Turn]:
         turns = list(self._turns.get(conversation_id, {}).values())