fix(ai-analysis): 收紧分析接口权限来源

apps/server/src/modules/ai/ai.controller.ts

@@ -1,6 +1,6 @@
-import { Body, Controller, Headers, Post } from '@nestjs/common';
-import { CurrentUser } from '../../common/auth/current-user.decorator';
-import type { CurrentUser as ResolvedCurrentUser } from '../../common/auth/auth-context.service';
+import { Body, Controller, Post, Req } from '@nestjs/common';
+import { AuthContextService, type AuthenticatedRequest } from '../../common/auth/auth-context.service';
+import { PermissionService } from '../../common/auth/permission.service';
 import { AiService } from './ai.service';
 import { BusinessAnalysisService } from './analysis/business-analysis.service';
 import { AnalysisDto } from './dto/analysis.dto';
@@ -19,6 +19,8 @@ export class AiController {
   constructor(
     private readonly aiService: AiService,
     private readonly businessAnalysisService: BusinessAnalysisService,
+    private readonly authContext: AuthContextService,
+    private readonly permissionService: PermissionService,
   ) {}
 
   @Post('decompose')
@@ -34,13 +36,13 @@ export class AiController {
   @Post('analysis')
   async analyze(
     @Body() dto: AnalysisDto,
-    @CurrentUser() user: ResolvedCurrentUser | null,
-    @Headers('x-ftb-user-id') headerUserId?: string,
-    @Headers('x-user-id') legacyHeaderUserId?: string,
+    @Req() request: AuthenticatedRequest,
   ): Promise<AnalysisResponse> {
+    const user = await this.authContext.resolveCurrentUser(request);
+    const permissions = await this.permissionService.resolveUserPermissions(user);
     return this.businessAnalysisService.analyze(dto, {
-      id: user?.id ?? headerUserId ?? legacyHeaderUserId ?? '',
-      permissions: dto.permissions ?? [],
+      id: user?.id ?? '',
+      permissions,
     });
   }
 }