fix(images): 私有图片支持 Bearer 鉴权，画布节点改为带鉴权 blob 加载

backend/internal/service/auth.go

@@ -100,6 +100,11 @@ func ownsImageDir(user *model.User, owner string) bool {
 	return false
 }
 
+// OwnsImageDir is the exported alias used by other services (image access, etc.)
+func (s *AuthService) OwnsImageDir(user *model.User, owner string) bool {
+	return ownsImageDir(user, owner)
+}
+
 // checkOwnerDirCollision rejects a signup whose sanitized username or email
 // local-part collides with any existing user's directory candidates. Media
 // authorization (ownsImageDir) matches on those candidates, so without this
@@ -481,21 +486,21 @@ func (s *AuthService) PublicUser(ctx context.Context, user *model.User) (map[str
 		}
 	}
 	return map[string]any{
-		"id":             user.ID,
-		"email":          user.Email,
-		"name":           user.Name,
-		"role":           user.Role,
-		"status":         user.Status,
-		"credits":        user.Credits,
-		"recharge_total": user.RechargeTotal,
+		"id":                user.ID,
+		"email":             user.Email,
+		"name":              user.Name,
+		"role":              user.Role,
+		"status":            user.Status,
+		"credits":           user.Credits,
+		"recharge_total":    user.RechargeTotal,
 		"concurrency_group": concName,
 		"concurrency_limit": concMax,
-		"checkin_last":   user.CheckinLast,
-		"checkin_streak": user.CheckinStreak,
-		"checkin_today":  user.CheckinLast == time.Now().Format("2006-01-02"),
-		"invite_code":    user.InviteCode,
-		"invite_count":   stats.InviteCount,
-		"invite_earned":  stats.InviteEarned,
+		"checkin_last":      user.CheckinLast,
+		"checkin_streak":    user.CheckinStreak,
+		"checkin_today":     user.CheckinLast == time.Now().Format("2006-01-02"),
+		"invite_code":       user.InviteCode,
+		"invite_count":      stats.InviteCount,
+		"invite_earned":     stats.InviteEarned,
 	}, nil
 }
 

backend/internal/service/image_access.go

@@ -48,6 +48,21 @@ func (s *ImageAccessService) IsPublic(ctx context.Context, rel string) (bool, er
 	return s.showcase.IsPublicFile(ctx, rel)
 }
 
-func (s *ImageAccessService) IsAuthorized(ctx context.Context, sessionCookie, owner string) (bool, error) {
+func (s *ImageAccessService) IsAuthorized(ctx context.Context, authHeader, sessionCookie, owner string) (bool, error) {
+	// Private images may be requested by an <img> tag with the session cookie
+	// OR by the SPA via a Bearer token. Admins may view anyone's images.
+	if authHeader != "" {
+		user, _, err := s.auth.CurrentUserFromBearer(ctx, authHeader)
+		if err != nil {
+			return false, err
+		}
+		if user == nil {
+			return false, nil
+		}
+		if user.Role == "admin" {
+			return true, nil
+		}
+		return s.auth.OwnsImageDir(user, owner), nil
+	}
 	return s.auth.IsAuthorizedForPrivateImage(ctx, sessionCookie, owner)
 }