feat: 集成 Keycloak 认证 — 前后端 + K8s 配置

backend/main.py

@@ -9,11 +9,12 @@ from pathlib import Path
 sys.path.insert(0, str(Path(__file__).parent))
 
 from dotenv import load_dotenv
-from fastapi import FastAPI
+from fastapi import Depends, FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
 load_dotenv(Path(__file__).parent / ".env", override=True)
 
+from middleware.auth import get_current_user
 from routers import documents, indexing, kg, query, search, system
 
 app = FastAPI(
@@ -40,11 +41,16 @@ app.add_middleware(
 # search.router     prefix="/search"    → /api/v1/search
 # system.router     no prefix           → /api/v1/health, /api/v1/system/...
 PREFIX = "/api/v1"
-app.include_router(documents.router, prefix=PREFIX)
-app.include_router(indexing.router,  prefix=PREFIX)
-app.include_router(kg.router,        prefix=PREFIX)
-app.include_router(query.router,     prefix=PREFIX)
-app.include_router(search.router,    prefix=PREFIX)
+_auth = [Depends(get_current_user)]
+
+# Protected routes (require Keycloak authentication)
+app.include_router(documents.router, prefix=PREFIX, dependencies=_auth)
+app.include_router(indexing.router,  prefix=PREFIX, dependencies=_auth)
+app.include_router(kg.router,        prefix=PREFIX, dependencies=_auth)
+app.include_router(query.router,     prefix=PREFIX, dependencies=_auth)
+app.include_router(search.router,    prefix=PREFIX, dependencies=_auth)
+
+# Public routes (no authentication required)
 app.include_router(system.router,    prefix=PREFIX)