From b59de7c476271b7219e11ef05e09811f2277950c Mon Sep 17 00:00:00 2001
From: Hermes CI Fix <hermes-ci@sxbh.ltd>
Date: Tue, 11 Aug 2026 11:29:43 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E8=B4=A6=E5=A5=97=E6=A8=A1=E5=BC=8FAPI?=
 =?UTF-8?q?=E7=BB=9F=E4=B8=80=20=E2=80=94=20entity=5Fid=E5=8F=82=E6=95=B0?=
 =?UTF-8?q?=E5=85=A8=E9=83=A8=E8=B5=B0get=5Fentity=5Fid=20+=20=E7=99=BB?=
 =?UTF-8?q?=E5=BD=95=E9=A1=B5/=E5=88=87=E6=8D=A2=E5=99=A8=E6=8E=A5?=
 =?UTF-8?q?=E5=8F=A3=E6=89=93=E9=80=9A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- kpis/cash/bsc_layers/growth_quality/tax_compliance/data/predict: entity_id参数统一为Depends(get_entity_id)，token优先隔离（原Query(1)/None会被前端显式传参覆盖，存在越权面）
- auth: 新增GET /auth/login-entities(公开,登录页按用户名查授权企业) + /auth/my-entities(切换器) + /me带当前账套
- 前端: 拦截器删除自动附加X-Entity-Id/entity_id; Login公司选择器; MainLayout/ReportCenter切换器改switch-entity重新签发token+整页刷新
---
 backend/app/api/auth.py | 36 ++++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/backend/app/api/auth.py b/backend/app/api/auth.py
index d37dccc0..6ac573f9 100644
--- a/backend/app/api/auth.py
+++ b/backend/app/api/auth.py
@@ -85,9 +85,13 @@ def register(data: dict, db: Session = Depends(get_db)):
 
 
 @router.get("/me")
-def get_me(current_user: User = Depends(require_auth)):
+def get_me(request: Request, current_user: User = Depends(require_auth), db: Session = Depends(get_db)):
     """获取当前用户信息（含当前账套）"""
-    return {
+    from app.auth_middleware import extract_bearer_token, get_token_entity_id
+    token = extract_bearer_token(request)
+    eid = get_token_entity_id(token) if token else None
+    ent = db.query(Entity).filter(Entity.id == eid).first() if eid else None
+    d = {
         "id": current_user.id,
         "username": current_user.username,
         "name": current_user.name,
@@ -95,6 +99,11 @@ def get_me(current_user: User = Depends(require_auth)):
         "role_name": ROLES.get(current_user.role, {}).get("name", current_user.role),
         "phone": current_user.phone,
     }
+    if ent:
+        d["entity_id"] = ent.id
+        d["entity_name"] = ent.name
+        d["entity_short_name"] = ent.short_name
+    return d
 
 
 @router.get("/roles")
@@ -125,6 +134,29 @@ def my_entities(current_user: User = Depends(require_auth), db: Session = Depend
     }
 
 
+@router.get("/my-entities")
+def my_entities_alias(current_user: User = Depends(require_auth), db: Session = Depends(get_db)):
+    """别名：/auth/my-entities（前端切换器调用）"""
+    return my_entities(current_user, db)
+
+
+@router.get("/login-entities")
+def login_entities_options(username: str = None, db: Session = Depends(get_db)):
+    """登录页公司选择器：按用户名返回授权企业（无鉴权，登录前调用；不暴露用户名是否存在）"""
+    if not username:
+        return {"data": []}
+    user = db.query(User).filter(User.username == username).first()
+    if not user:
+        return {"data": []}
+    _ensure_default_grants(db, user.id)
+    ids = _user_entity_ids(db, user.id)
+    ents = db.query(Entity).filter(
+        Entity.id.in_(ids),
+        Entity.status == "active",
+    ).order_by(Entity.id).all()
+    return {"data": [{"id": e.id, "name": e.name, "short_name": e.short_name} for e in ents]}
+
+
 @router.post("/switch-entity")
 def switch_entity(
     data: dict,