main: 用户管理和会话功能初始实现

- 添加用户管理功能的测试，包括创建、更新、停用、激活用户及用户登录 JWT 测试
- 提供用户管理相关的请求验证类与控制器
- 引入 CORS 配置信息，支持跨域请求
- 添加数据库播种器以便创建根用户
- 配置 API 默认使用 JWT 认证
- 添加聊天会话和消息的模型、迁移文件及关联功能

app/Enums/ChatSessionStatus.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Enums;
+
+class ChatSessionStatus
+{
+    public const OPEN = 'OPEN';
+    public const LOCKED = 'LOCKED';
+    public const CLOSED = 'CLOSED';
+
+    public static function all(): array
+    {
+        return [self::OPEN, self::LOCKED, self::CLOSED];
+    }
+}

app/Exceptions/ChatSessionStatusException.php

@@ -0,0 +1,9 @@
+<?php
+
+namespace App\Exceptions;
+
+use RuntimeException;
+
+class ChatSessionStatusException extends RuntimeException
+{
+}

app/Http/Controllers/AuthController.php

@@ -0,0 +1,40 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\LoginRequest;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Hash;
+
+class AuthController extends Controller
+{
+    public function login(LoginRequest $request): JsonResponse
+    {
+        $credentials = $request->validated();
+
+        $user = User::whereEmail($credentials['email'])->first();
+
+        if (! $user || ! Hash::check($credentials['password'], $user->password)) {
+            return response()->json(['message' => '凭证无效'], 401);
+        }
+
+        if (! $user->is_active) {
+            return response()->json(['message' => '用户已停用'], 403);
+        }
+
+        $token = auth('api')->login($user);
+
+        return response()->json([
+            'token' => $token,
+            'token_type' => 'bearer',
+            'expires_in' => auth('api')->factory()->getTTL() * 60,
+            'user' => [
+                'id' => $user->id,
+                'name' => $user->name,
+                'email' => $user->email,
+                'is_active' => $user->is_active,
+            ],
+        ]);
+    }
+}

app/Http/Controllers/ChatSessionController.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Exceptions\ChatSessionStatusException;
+use App\Http\Requests\AppendMessageRequest;
+use App\Http\Requests\CreateSessionRequest;
+use App\Http\Resources\MessageResource;
+use App\Models\Message;
+use App\Services\ChatService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class ChatSessionController extends Controller
+{
+    public function __construct(private readonly ChatService $service)
+    {
+    }
+
+    public function store(CreateSessionRequest $request): JsonResponse
+    {
+        $session = $this->service->createSession($request->input('session_name'));
+
+        return response()->json($session, 201);
+    }
+
+    public function append(string $sessionId, AppendMessageRequest $request): JsonResponse
+    {
+        try {
+            $message = $this->service->appendMessage([
+                'session_id' => $sessionId,
+                ...$request->validated(),
+            ]);
+        } catch (ChatSessionStatusException $e) {
+            return response()->json(['message' => $e->getMessage()], 403);
+        }
+
+        return (new MessageResource($message))->response()->setStatusCode(201);
+    }
+
+    public function listMessages(Request $request, string $sessionId): JsonResponse
+    {
+        $afterSeq = (int) $request->query('after_seq', 0);
+        $limit = (int) $request->query('limit', 50);
+        $limit = $limit > 0 && $limit <= 200 ? $limit : 50;
+
+        $messages = $this->service->listMessagesBySeq($sessionId, $afterSeq, $limit);
+
+        return MessageResource::collection($messages)->response();
+    }
+}

app/Http/Controllers/UserController.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\Http\Requests\StoreUserRequest;
+use App\Http\Requests\UpdateUserRequest;
+use App\Http\Resources\UserResource;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class UserController extends Controller
+{
+    public function index(Request $request): JsonResponse
+    {
+        $perPage = (int) $request->query('per_page', 15);
+        $perPage = $perPage > 0 && $perPage <= 100 ? $perPage : 15;
+
+        $users = User::orderBy('id')->paginate($perPage);
+
+        return UserResource::collection($users)->response();
+    }
+
+    public function store(StoreUserRequest $request): JsonResponse
+    {
+        $payload = $request->validated();
+        $payload['is_active'] = true;
+
+        $user = User::create($payload);
+
+        return (new UserResource($user))->response()->setStatusCode(201);
+    }
+
+    public function update(UpdateUserRequest $request, User $user): JsonResponse
+    {
+        $user->update($request->validated());
+
+        return (new UserResource($user))->response();
+    }
+
+    public function deactivate(User $user): JsonResponse
+    {
+        $user->update(['is_active' => false]);
+
+        return (new UserResource($user))->response();
+    }
+
+    public function activate(User $user): JsonResponse
+    {
+        $user->update(['is_active' => true]);
+
+        return (new UserResource($user))->response();
+    }
+}

app/Http/Requests/AppendMessageRequest.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Http\Requests;
+
+use App\Models\Message;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class AppendMessageRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'role' => ['required', 'string', Rule::in([
+                Message::ROLE_USER,
+                Message::ROLE_AGENT,
+                Message::ROLE_TOOL,
+                Message::ROLE_SYSTEM,
+            ])],
+            'type' => ['required', 'string', 'max:64'],
+            'content' => ['nullable', 'string'],
+            'payload' => ['nullable', 'array'],
+            'reply_to' => ['nullable', 'uuid'],
+            'dedupe_key' => ['nullable', 'string', 'max:128'],
+        ];
+    }
+}

app/Http/Requests/CreateSessionRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class CreateSessionRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'session_name' => ['nullable', 'string', 'max:255'],
+        ];
+    }
+}

app/Http/Requests/LoginRequest.php

@@ -0,0 +1,24 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class LoginRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'email' => ['required', 'email'],
+            'password' => ['required', 'string'],
+        ];
+    }
+}

app/Http/Requests/StoreUserRequest.php

@@ -0,0 +1,25 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class StoreUserRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+            'email' => ['required', 'email', 'max:255', 'unique:users,email'],
+            'password' => ['required', 'string', 'min:8'],
+        ];
+    }
+}

app/Http/Requests/UpdateUserRequest.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateUserRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['sometimes', 'required', 'string', 'max:255'],
+            'email' => [
+                'sometimes',
+                'required',
+                'email',
+                'max:255',
+                Rule::unique('users', 'email')->ignore($this->route('user')),
+            ],
+            'password' => ['sometimes', 'required', 'string', 'min:8'],
+        ];
+    }
+}

app/Http/Resources/MessageResource.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin \App\Models\Message */
+class MessageResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'message_id' => $this->message_id,
+            'session_id' => $this->session_id,
+            'seq' => $this->seq,
+            'role' => $this->role,
+            'type' => $this->type,
+            'content' => $this->content,
+            'payload' => $this->payload,
+            'reply_to' => $this->reply_to,
+            'dedupe_key' => $this->dedupe_key,
+            'created_at' => $this->created_at,
+        ];
+    }
+}

app/Http/Resources/UserResource.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+/** @mixin \App\Models\User */
+class UserResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'name' => $this->name,
+            'email' => $this->email,
+            'is_active' => $this->is_active,
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+        ];
+    }
+}

app/Models/ChatSession.php

@@ -0,0 +1,48 @@
+<?php
+
+namespace App\Models;
+
+use App\Enums\ChatSessionStatus;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+
+class ChatSession extends Model
+{
+    use HasFactory;
+
+    protected $primaryKey = 'session_id';
+
+    public $incrementing = false;
+
+    protected $keyType = 'string';
+
+    protected $fillable = [
+        'session_id',
+        'session_name',
+        'status',
+        'last_seq',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'last_seq' => 'integer',
+        ];
+    }
+
+    public function messages(): HasMany
+    {
+        return $this->hasMany(Message::class, 'session_id', 'session_id');
+    }
+
+    public function isClosed(): bool
+    {
+        return $this->status === ChatSessionStatus::CLOSED;
+    }
+
+    public function isLocked(): bool
+    {
+        return $this->status === ChatSessionStatus::LOCKED;
+    }
+}

app/Models/Message.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class Message extends Model
+{
+    use HasFactory;
+
+    public const ROLE_USER = 'USER';
+    public const ROLE_AGENT = 'AGENT';
+    public const ROLE_TOOL = 'TOOL';
+    public const ROLE_SYSTEM = 'SYSTEM';
+
+    protected $primaryKey = 'message_id';
+
+    public $incrementing = false;
+
+    protected $keyType = 'string';
+
+    public $timestamps = false;
+
+    protected $fillable = [
+        'message_id',
+        'session_id',
+        'role',
+        'type',
+        'content',
+        'payload',
+        'seq',
+        'reply_to',
+        'dedupe_key',
+        'created_at',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'payload' => 'array',
+            'seq' => 'integer',
+            'created_at' => 'datetime',
+        ];
+    }
+
+    public function session(): BelongsTo
+    {
+        return $this->belongsTo(ChatSession::class, 'session_id', 'session_id');
+    }
+}

app/Models/User.php

@@ -6,8 +6,9 @@ namespace App\Models;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Foundation\Auth\User as Authenticatable;
 use Illuminate\Notifications\Notifiable;
+use PHPOpenSourceSaver\JWTAuth\Contracts\JWTSubject;
 
-class User extends Authenticatable
+class User extends Authenticatable implements JWTSubject
 {
     /** @use HasFactory<\Database\Factories\UserFactory> */
     use HasFactory, Notifiable;
@@ -21,6 +22,7 @@ class User extends Authenticatable
         'name',
         'email',
         'password',
+        'is_active',
     ];
 
     /**
@@ -43,6 +45,17 @@ class User extends Authenticatable
         return [
             'email_verified_at' => 'datetime',
             'password' => 'hashed',
+            'is_active' => 'boolean',
         ];
     }
+
+    public function getJWTIdentifier(): mixed
+    {
+        return $this->getKey();
+    }
+
+    public function getJWTCustomClaims(): array
+    {
+        return [];
+    }
 }

app/Services/ChatService.php

@@ -0,0 +1,132 @@
+<?php
+
+namespace App\Services;
+
+use App\Enums\ChatSessionStatus;
+use App\Exceptions\ChatSessionStatusException;
+use App\Models\ChatSession;
+use App\Models\Message;
+use Illuminate\Database\QueryException;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Str;
+
+class ChatService
+{
+    public function createSession(string $name = null): ChatSession
+    {
+        return ChatSession::create([
+            'session_id' => (string) Str::uuid(),
+            'session_name' => $name,
+            'status' => ChatSessionStatus::OPEN,
+            'last_seq' => 0,
+        ]);
+    }
+
+    public function getSession(string $sessionId): ChatSession
+    {
+        return ChatSession::query()->whereKey($sessionId)->firstOrFail();
+    }
+
+    /**
+     * @param array<string, mixed> $dto
+     */
+    public function appendMessage(array $dto): Message
+    {
+        return DB::transaction(function () use ($dto) {
+            /** @var ChatSession $session */
+            $session = ChatSession::query()
+                ->whereKey($dto['session_id'])
+                ->lockForUpdate()
+                ->firstOrFail();
+
+            $this->ensureCanAppend($session, $dto['role'], $dto['type']);
+
+            $dedupeKey = $dto['dedupe_key'] ?? null;
+            if ($dedupeKey) {
+                $existing = Message::query()
+                    ->where('session_id', $session->session_id)
+                    ->where('dedupe_key', $dedupeKey)
+                    ->first();
+
+                if ($existing) {
+                    return $existing;
+                }
+            }
+
+            $newSeq = $session->last_seq + 1;
+
+            $message = new Message([
+                'message_id' => (string) Str::uuid(),
+                'session_id' => $session->session_id,
+                'role' => $dto['role'],
+                'type' => $dto['type'],
+                'content' => $dto['content'] ?? null,
+                'payload' => $dto['payload'] ?? null,
+                'reply_to' => $dto['reply_to'] ?? null,
+                'dedupe_key' => $dedupeKey,
+                'seq' => $newSeq,
+                'created_at' => now(),
+            ]);
+
+            try {
+                $message->save();
+            } catch (QueryException $e) {
+                if ($this->isUniqueConstraint($e) && $dedupeKey) {
+                    $existing = Message::query()
+                        ->where('session_id', $session->session_id)
+                        ->where('dedupe_key', $dedupeKey)
+                        ->first();
+
+                    if ($existing) {
+                        return $existing;
+                    }
+                }
+
+                throw $e;
+            }
+
+            $session->update([
+                'last_seq' => $newSeq,
+                'updated_at' => now(),
+            ]);
+
+            return $message;
+        });
+    }
+
+    public function listMessagesBySeq(string $sessionId, int $afterSeq, int $limit = 50): Collection
+    {
+        $this->getSession($sessionId); // ensure exists
+
+        return Message::query()
+            ->where('session_id', $sessionId)
+            ->where('seq', '>', $afterSeq)
+            ->orderBy('seq')
+            ->limit($limit)
+            ->get();
+    }
+
+    private function ensureCanAppend(ChatSession $session, string $role, string $type): void
+    {
+        if ($session->status === ChatSessionStatus::CLOSED) {
+            $allowed = $role === Message::ROLE_SYSTEM && in_array($type, ['run.status', 'error'], true);
+            if (! $allowed) {
+                throw new ChatSessionStatusException('Session is closed');
+            }
+        }
+
+        if ($session->status === ChatSessionStatus::LOCKED) {
+            if ($role === Message::ROLE_USER && $type === 'user.prompt') {
+                throw new ChatSessionStatusException('Session is locked');
+            }
+        }
+    }
+
+    private function isUniqueConstraint(QueryException $e): bool
+    {
+        $sqlState = $e->getCode() ?: ($e->errorInfo[0] ?? null);
+
+        return $sqlState === '23505';
+    }
+}