From e3bed34a3aff5d78b260b9bcbc6c7378b6c10cf1 Mon Sep 17 00:00:00 2001
From: Pine <wwork.wss@icloud.com>
Date: Sun, 13 Sep 2026 23:33:36 +0800
Subject: [PATCH] =?UTF-8?q?refactor:=20=E8=BA=AB=E4=BB=BD=E5=88=87?=
 =?UTF-8?q?=E6=8D=A2=E6=94=B9=E4=B8=BA=E7=BA=AF=E5=89=8D=E7=AB=AF=E7=8A=B6?=
 =?UTF-8?q?=E6=80=81=EF=BC=8C=E4=B8=8D=E9=87=8D=E6=96=B0=E7=AD=BE=E5=8F=91?=
 =?UTF-8?q?JWT?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

JWT始终包含所有身份的叠加能力（capabilities），权限判断基于所有能力。
移除/auth/select-identity接口，身份切换仅在前端状态中管理。
---
 app/api/routers/auth.py | 43 -----------------------------------------
 app/api/schemas/auth.py |  4 ----
 2 files changed, 47 deletions(-)

diff --git a/app/api/routers/auth.py b/app/api/routers/auth.py
index 3dc335c..cf66d66 100644
--- a/app/api/routers/auth.py
+++ b/app/api/routers/auth.py
@@ -28,7 +28,6 @@ from ..schemas.auth import (
     RevokeTokenRequest,
     SendCodeRequest,
     SendCodeResponse,
-    SelectIdentityRequest,
     UpdateProfileRequest,
     VerifyResponse,
     WxLoginRequest,
@@ -353,48 +352,6 @@ async def login(req: LoginRequest, db: Database = Depends(get_db)):
     return resp
 
 
-@router.post("/select-identity", response_model=LoginResponse, summary="切换当前身份")
-async def select_identity(
-    req: SelectIdentityRequest,
-    db: Database = Depends(get_db),
-    user: dict = Depends(get_current_user),
-):
-    """切换当前身份（运营方/园区管理员/企业管理员/个人），重新签发 JWT。
-
-    identity_id 格式：
-    - operator：平台运营方
-    - carrier:<park_id>：园区管理员
-    - enterprise:<company_id>：企业管理员
-    - opc_member：个人用户
-    """
-    identities = await _compute_identities(db, user)
-    identity = next((i for i in identities if i["id"] == req.identity_id), None)
-    if identity is None:
-        raise HTTPException(status_code=400, detail="无效的身份 ID")
-
-    # 构建身份字典供 _issue_token 使用
-    identity_dict = {
-        "id": identity["id"],
-        "port": identity["port"],
-        "role": identity["role"],
-        "sub_role": identity.get("sub_role"),
-        "name": identity["name"],
-        "org_id": identity.get("org_id"),
-        "region_id": identity.get("region_id"),
-    }
-
-    token_record = await _issue_token(db, user, None, identity=identity_dict)
-    profile = await _profile_for(user, identity_dict, db)
-
-    resp = LoginResponse(
-        token=token_record["token"],
-        identities=identities,
-        **profile,
-    )
-    await _inject_mqtt_credentials(resp, user["id"])
-    return resp
-
-
 @router.post("/register", response_model=LoginResponse, summary="注册")
 async def register(req: RegisterRequest, request: Request, db: Database = Depends(get_db)):
     """注册唯一账户（演示端已存在 pine，故返回 403）。"""
diff --git a/app/api/schemas/auth.py b/app/api/schemas/auth.py
index adf31a3..9955350 100644
--- a/app/api/schemas/auth.py
+++ b/app/api/schemas/auth.py
@@ -47,10 +47,6 @@ class UpdateProfileRequest(BaseModel):
     company: str | None = None
     room: str | None = None
     avatar: str | None = None
-
-class SelectIdentityRequest(BaseModel):
-    """切换当前身份（运营方/园区管理员/企业管理员/个人）。"""
-    identity_id: str
     company_avatar: str | None = None
 
 class RevokeTokenRequest(BaseModel):