fix(backend): 后端身份参数改从JWT推导，不再信任客户端传入

- DanAssessmentController：my-results/child-results/appointment/create/order/create
  改为 @RequestAttribute("userId") 获取当前用户，移除 body.userId 读取
- record/current 标记为已废弃（无前端调用方，familyId 参数不再被信任）
- FamilyController：guide-bind 的 @RequestHeader("X-User-Id") 改为 @RequestAttribute("userId")；
  两个已废弃端点移除 X-User-Id 参数
- AdminController：/api/admin/families/** 及 /families/count 增加 admin 角色校验
- HealthReportController：parse-preview 的 familyId 由 @RequestParam 改为 @RequestAttribute

cfc-backend/src/main/java/com/etotem/cfc/controller/DanAssessmentController.java

@@ -143,7 +143,10 @@ public class DanAssessmentController {
         return Result.success(assessmentService.getFamilyRecords(familyId));
     }
 
-@Operation(summary = "获取当前测评")
+/**
+     * 获取当前测评（已废弃，仅兼容保留；无前端调用方，familyId 参数已不再被信任）
+     */
+    @Operation(summary = "获取当前测评（已废弃）")
     @PostMapping("/record/current")
     public Result<AssessmentRecord> getCurrentAssessment(@RequestParam Long familyId) {
         return Result.success(assessmentService.getCurrentAssessment(familyId));
@@ -159,21 +162,16 @@ public class DanAssessmentController {
 
     @Operation(summary = "获取我的测评报告列表")
     @PostMapping("/my-results")
-    public Result<List<DanAssessmentResult>> getMyResults(@RequestBody Map<String, Object> body) {
-        Long userId = body.get("userId") != null ? Long.valueOf(body.get("userId").toString()) : null;
-        if (userId == null) {
-            return Result.success(assessmentService.getAccessibleResults(0L, "teacher"));
-        }
-        // 这里简化为返回该用户相关的报告，实际可根据角色判断
-        return Result.success(assessmentService.getAccessibleResults(userId, "teacher"));
+    public Result<List<DanAssessmentResult>> getMyResults(@RequestAttribute("userId") Long userId,
+                                                          @RequestAttribute("role") String role) {
+        return Result.success(assessmentService.getAccessibleResults(userId, role));
     }
 
     @Operation(summary = "获取下级成长规划师的测评报告")
     @PostMapping("/child-results")
-    public Result<List<DanAssessmentResult>> getChildResults(@RequestBody Map<String, Object> body) {
-        Long userId = body.get("userId") != null ? Long.valueOf(body.get("userId").toString()) : null;
-        List<DanAssessmentResult> results = assessmentService.getAccessibleResults(
-                userId != null ? userId : 0L, "teacher");
+    public Result<List<DanAssessmentResult>> getChildResults(@RequestAttribute("userId") Long userId,
+                                                             @RequestAttribute("role") String role) {
+        List<DanAssessmentResult> results = assessmentService.getAccessibleResults(userId, role);
         return Result.success(results);
     }
 
@@ -188,8 +186,8 @@ public class DanAssessmentController {
     @Operation(summary = "创建测评预约")
     @PostMapping("/appointment/create")
     public Result<AssessmentAppointment> createAppointment(@RequestBody Map<String, Object> body,
-                                                           @RequestAttribute(value = "currentMemberId", required = false) Long currentMemberId) {
-        Long userId = body.get("userId") != null ? Long.valueOf(body.get("userId").toString()) : null;
+                                                           @RequestAttribute(value = "currentMemberId", required = false) Long currentMemberId,
+                                                           @RequestAttribute("userId") Long userId) {
         Long memberId = body.get("memberId") != null ? Long.valueOf(body.get("memberId").toString()) : currentMemberId;
         Long guideId = Long.valueOf(body.get("guideId").toString());
         Long packageId = body.get("packageId") != null ? Long.valueOf(body.get("packageId").toString()) : null;
@@ -275,11 +273,11 @@ public class DanAssessmentController {
     @PostMapping("/order/create")
     public Result<AssessmentOrder> createOrder(@RequestBody Map<String, Object> body,
                                                @RequestAttribute(value = "familyId", required = false) Long familyId,
-                                               @RequestAttribute(value = "currentMemberId", required = false) Long currentMemberId) {
+                                               @RequestAttribute(value = "currentMemberId", required = false) Long currentMemberId,
+                                               @RequestAttribute("userId") Long userId) {
         if (familyId == null) {
             return Result.noFamily("请先创建或加入家庭");
         }
-        Long userId = body.get("userId") != null ? Long.valueOf(body.get("userId").toString()) : null;
         Long memberId = body.get("memberId") != null ? Long.valueOf(body.get("memberId").toString()) : currentMemberId;
         Long guideId = Long.valueOf(body.get("guideId").toString());
         Long packageId = body.get("packageId") != null ? Long.valueOf(body.get("packageId").toString()) : null;

cfc-backend/src/main/java/com/etotem/cfc/controller/HealthReportController.java

@@ -442,7 +442,7 @@ public class HealthReportController {
     public Result<Map<String, Object>> parsePreview(
             @RequestParam("file") MultipartFile file,
             @RequestParam(value = "type", defaultValue = "auto") String type,
-            @RequestParam(value = "familyId", required = false) Long familyId,
+            @RequestAttribute(value = "familyId", required = false) Long familyId,
             @RequestParam(value = "memberId", required = false) Long memberId,
             @RequestAttribute("userId") Long userId) {
 

cfc-backend/src/main/java/com/etotem/cfc/controller/admin/AdminController.java

@@ -464,7 +464,11 @@ public class AdminController {
 
     // 家庭管理
     @PostMapping("/families")
-    public Result<Page<Family>> getFamilies(@RequestBody Map<String, Object> params) {
+    public Result<Page<Family>> getFamilies(@RequestBody Map<String, Object> params,
+                                            @RequestAttribute("role") String role) {
+        if (!"admin".equals(role)) {
+            return Result.error("无权限");
+        }
         int page = params.get("page") != null ? ((Number) params.get("page")).intValue() : 1;
         int size = params.get("size") != null ? ((Number) params.get("size")).intValue() : 10;
         String name = (String) params.get("name");
@@ -480,12 +484,20 @@ public class AdminController {
     }
 
     @PostMapping("/families/{id}")
-    public Result<Family> getFamily(@PathVariable Long id) {
+    public Result<Family> getFamily(@PathVariable Long id,
+                                    @RequestAttribute("role") String role) {
+        if (!"admin".equals(role)) {
+            return Result.error("无权限");
+        }
         return Result.success(familyMapper.selectById(id));
     }
 
     @PostMapping("/families/{id}/members")
-    public Result<Map<String, Object>> getFamilyMembers(@PathVariable Long id) {
+    public Result<Map<String, Object>> getFamilyMembers(@PathVariable Long id,
+                                                        @RequestAttribute("role") String role) {
+        if (!"admin".equals(role)) {
+            return Result.error("无权限");
+        }
         Family family = familyMapper.selectById(id);
         if (family == null) {
             return Result.error("家庭不存在");
@@ -510,7 +522,11 @@ public class AdminController {
     }
 
     @PostMapping("/families/{id}/update")
-    public Result<Boolean> updateFamily(@PathVariable Long id, @RequestBody Family family) {
+    public Result<Boolean> updateFamily(@PathVariable Long id, @RequestBody Family family,
+                                        @RequestAttribute("role") String role) {
+        if (!"admin".equals(role)) {
+            return Result.error("无权限");
+        }
         family.setId(id);
         family.setUpdatedAt(new Date());
         familyMapper.updateById(family);
@@ -518,7 +534,11 @@ public class AdminController {
     }
 
     @PostMapping("/families/{id}/delete")
-    public Result<Boolean> deleteFamily(@PathVariable Long id) {
+    public Result<Boolean> deleteFamily(@PathVariable Long id,
+                                        @RequestAttribute("role") String role) {
+        if (!"admin".equals(role)) {
+            return Result.error("无权限");
+        }
         familyMapper.deleteById(id);
         return Result.success(true);
     }
@@ -528,7 +548,11 @@ public class AdminController {
      */
     @Operation(summary = "按街道ID列表统计家庭数量")
     @PostMapping("/families/count")
-    public Result<Long> countFamiliesByStreetIds(@RequestBody Map<String, Object> params) {
+    public Result<Long> countFamiliesByStreetIds(@RequestBody Map<String, Object> params,
+                                                  @RequestAttribute("role") String role) {
+        if (!"admin".equals(role)) {
+            return Result.error("无权限");
+        }
         List<Long> streetIds = parseStreetIds(params);
         if (streetIds.isEmpty()) {
             return Result.success(0L);

cfc-backend/src/main/java/com/etotem/cfc/controller/family/FamilyController.java

@@ -37,7 +37,7 @@ public class FamilyController {
      */
     @Operation(summary = "获取邀请码（已废弃）")
     @PostMapping("/invite-code")
-    public Result<String> getInviteCode(@RequestHeader("X-User-Id") Long userId) {
+    public Result<String> getInviteCode() {
         return Result.error(410, "该接口已废弃，请使用 /api/family/invite/generate 生成邀请令牌");
     }
 
@@ -46,7 +46,7 @@ public class FamilyController {
      */
     @Operation(summary = "生成邀请码（已废弃）")
     @PostMapping("/invite-code/generate")
-    public Result<String> generateInviteCode(@RequestHeader("X-User-Id") Long userId) {
+    public Result<String> generateInviteCode() {
         return Result.error(410, "该接口已废弃，请使用 /api/family/invite/generate 生成邀请令牌");
     }
 
@@ -55,7 +55,7 @@ public class FamilyController {
      */
     @Operation(summary = "成长规划师申请绑定家庭（需家长审批）")
     @PostMapping("/guide-bind")
-    public Result<String> guideBindFamily(@RequestHeader("X-User-Id") Long userId,
+    public Result<String> guideBindFamily(@RequestAttribute("userId") Long userId,
                                           @RequestBody Map<String, String> params) {
         String inviteCode = params.get("inviteCode");
         if (inviteCode == null || inviteCode.isEmpty()) {