推进活动系统最小成品闭环与游客体验

backend/internal/platform/assets/publisher.go

@@ -78,6 +78,38 @@ func (p *OSSUtilPublisher) UploadJSON(ctx context.Context, publicURL string, pay
 	return nil
 }
 
+func (p *OSSUtilPublisher) UploadFile(ctx context.Context, publicURL string, localPath string) error {
+	if !p.Enabled() {
+		return fmt.Errorf("asset publisher is not configured")
+	}
+	if strings.TrimSpace(localPath) == "" {
+		return fmt.Errorf("local path is required")
+	}
+
+	objectKey, err := p.objectKeyFromPublicURL(publicURL)
+	if err != nil {
+		return err
+	}
+
+	if _, err := os.Stat(p.ossutilPath); err != nil {
+		return fmt.Errorf("ossutil not found: %w", err)
+	}
+	if _, err := os.Stat(p.configFile); err != nil {
+		return fmt.Errorf("ossutil config not found: %w", err)
+	}
+	if _, err := os.Stat(localPath); err != nil {
+		return fmt.Errorf("upload file not found: %w", err)
+	}
+
+	target := p.bucketRoot + "/" + objectKey
+	cmd := exec.CommandContext(ctx, p.ossutilPath, "cp", "-f", localPath, target, "--config-file", p.configFile)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		return fmt.Errorf("upload object %s failed: %w: %s", objectKey, err, strings.TrimSpace(string(output)))
+	}
+	return nil
+}
+
 func (p *OSSUtilPublisher) objectKeyFromPublicURL(publicURL string) (string, error) {
 	publicURL = strings.TrimSpace(publicURL)
 	if publicURL == "" {

backend/internal/platform/jwtx/jwt.go

@@ -16,6 +16,8 @@ type Manager struct {
 type AccessClaims struct {
 	UserID       string `json:"uid"`
 	UserPublicID string `json:"upub"`
+	ActorType    string `json:"actorType,omitempty"`
+	RoleCode     string `json:"roleCode,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -28,10 +30,16 @@ func NewManager(issuer, secret string, ttl time.Duration) *Manager {
 }
 
 func (m *Manager) IssueAccessToken(userID, userPublicID string) (string, time.Time, error) {
+	return m.IssueActorAccessToken(userID, userPublicID, "user", "")
+}
+
+func (m *Manager) IssueActorAccessToken(userID, userPublicID, actorType, roleCode string) (string, time.Time, error) {
 	expiresAt := time.Now().UTC().Add(m.ttl)
 	claims := AccessClaims{
 		UserID:       userID,
 		UserPublicID: userPublicID,
+		ActorType:    actorType,
+		RoleCode:     roleCode,
 		RegisteredClaims: jwt.RegisteredClaims{
 			Issuer:    m.issuer,
 			Subject:   userID,