feat(auth): implement user and device authentication

backend-api/internal/transport/httpapi/admin_handlers.go

@@ -11,6 +11,7 @@ import (
 	"time"
 
 	"cmroubao/backend-api/internal/domain"
+	"cmroubao/backend-api/internal/transport/authcommon"
 	"cmroubao/backend-api/internal/usecase"
 
 	"github.com/gin-gonic/gin"
@@ -209,6 +210,7 @@ func (h *adminHandlers) createTask(ctx *gin.Context) {
 		ctx.Request.Context(),
 		usecase.CreateTaskCommand{
 			CreatorSubject: localAdminSubject,
+			ActorUserID:    adminActorUserID(ctx),
 			IdempotencyKey: ctx.GetHeader("Idempotency-Key"),
 			SourceRef:      request.SourceRef,
 			Title:          request.Title,
@@ -226,6 +228,14 @@ func (h *adminHandlers) createTask(ctx *gin.Context) {
 	ctx.JSON(http.StatusCreated, taskSummaryResponse(result.Task))
 }
 
+func adminActorUserID(ctx *gin.Context) string {
+	principal, ok := authcommon.Principal(ctx.Request.Context())
+	if !ok || principal.Role != domain.UserRoleAdmin {
+		return ""
+	}
+	return principal.UserID
+}
+
 func (h *adminHandlers) listTasks(ctx *gin.Context) {
 	query := usecase.ListTasksQuery{
 		CreatorSubject: localAdminSubject,
@@ -292,10 +302,11 @@ func (h *adminHandlers) taskDetail(ctx *gin.Context) {
 	events := make([]gin.H, 0, len(detail.Events))
 	for _, event := range detail.Events {
 		events = append(events, gin.H{
-			"id":          event.ID,
-			"type":        event.Type,
-			"message":     event.Message,
-			"occurred_at": formatTime(event.OccurredAt),
+			"id":            event.ID,
+			"actor_user_id": event.ActorUserID,
+			"type":          event.Type,
+			"message":       event.Message,
+			"occurred_at":   formatTime(event.OccurredAt),
 		})
 	}
 	ctx.Header("Cache-Control", "no-store")
@@ -355,6 +366,7 @@ func (h *adminHandlers) cancelTask(ctx *gin.Context) {
 		ctx.Request.Context(),
 		usecase.CancelTaskCommand{
 			CreatorSubject: localAdminSubject,
+			ActorUserID:    adminActorUserID(ctx),
 			TaskID:         ctx.Param("id"),
 			Reason:         request.Reason,
 		},