browser/openspec/changes/fix-platform-auth-session-api/tasks.md

1. OpenSpec And Contracts

• 1.1 Add auth/session requirements covering login, registration, logout, current-user, profile/theme updates, user update, and local fallback limits.

2. Platform Implementation

• 2.1 Extend user domain, DTO, model, validation, and service contracts for password hashes, profile, theme, and controlled user updates.
• 2.2 Implement in-memory platform auth sessions and route handlers for /api/v1/auth/* and /api/v1/users/current*.
• 2.3 Implement PUT /api/v1/users/{id} for the 用户管理 page.

3. Frontend Implementation

• 3.1 Send bearer session tokens on API calls and persist only the API session token, not a privileged local user.
• 3.2 Gate local fallback behind an explicit dev/demo env flag and ensure fallback never grants platform administrator privileges.
• 3.3 Keep metrics/config/AI suggestion gaps in graceful page-local fallback behavior.

4. Verification

• 4.1 Add backend API/service tests for login/register/current-user/logout/pending/disabled/user-update behavior.
• 4.2 Add frontend session tests for API login, failed auth, refresh session restoration, and fallback gating.
• 4.3 Run platform tests, platform_web tests/typecheck/build, scripts/check-structure.sh, and openspec validate fix-platform-auth-session-api --strict.