feat(admin): add device credential isolation

admin/internal/server/router.go

@@ -14,6 +14,7 @@ import (
 	"unicode/utf8"
 
 	"cmbuyer/admin/internal/auth"
+	"cmbuyer/admin/internal/deviceauth"
 	"cmbuyer/admin/internal/evidence"
 	"cmbuyer/admin/internal/taskdetail"
 	"cmbuyer/admin/internal/tasks"
@@ -34,7 +35,7 @@ type Options struct {
 	Tasks               tasks.Store
 	TaskDetails         taskdetail.Store
 	Evidence            evidence.Store
-	DeviceAuthenticator evidence.DeviceAuthenticator
+	DeviceAuthenticator deviceauth.Authenticator
 }
 
 // NewRouter 返回当前服务范围内的完整 HTTP 路由。
@@ -266,6 +267,10 @@ func newTaskPage(options Options) gin.HandlerFunc {
 }
 func createTask(options Options) gin.HandlerFunc {
 	return func(context *gin.Context) {
+		if !options.Sessions.IsAuthenticated(context.Request) {
+			context.Status(http.StatusUnauthorized)
+			return
+		}
 		if !parseForm(context) {
 			return
 		}