fix: code compliance audit and fix across all services

NestJS (6 services): implement @RequirePermission decorator with
SetMetadata+Reflector, register APP_GUARD globally, fix as assertions
to type guards, add explicit return types, fix import type for express,
fix /metrics implicit any, replace native Error with ApplicationError,
remove typeorm remnants, register LifecycleService.

teacher-bff: add logger, ApplicationError, GlobalErrorFilter, forward
real userId to downstream, log downstream failures, migrate health
controller to shared/health.

Go (2 services): interface to any, doc comments, CORS dev whitelist,
JWT secret fail-fast, push-gateway internal API auth, metrics and
readyz endpoints, remove dead code.

Python (2 services): lifespan return type, dev_mode to bool, data-ana
APIRouter, ai POST body model, ClickHouse async wrapping.

services/classes/src/middleware/auth.middleware.ts

@@ -1,5 +1,9 @@
-import { Injectable, NestMiddleware, UnauthorizedException } from '@nestjs/common';
-import { Request, Response, NextFunction } from 'express';
+import {
+  Injectable,
+  NestMiddleware,
+  UnauthorizedException,
+} from "@nestjs/common";
+import type { Request, Response, NextFunction } from "express";
 
 export interface AuthenticatedRequest extends Request {
   userId?: string;
@@ -10,15 +14,18 @@ export interface AuthenticatedRequest extends Request {
 export class AuthMiddleware implements NestMiddleware {
   use(req: AuthenticatedRequest, res: Response, next: NextFunction): void {
     // 从 Gateway 注入的头部读取用户信息
-    const userId = req.headers['x-user-id'] as string | undefined;
-    const rolesHeader = req.headers['x-user-roles'] as string | undefined;
+    const userIdHeader = req.headers["x-user-id"];
+    const userId = typeof userIdHeader === "string" ? userIdHeader : undefined;
+    const rolesHeaderRaw = req.headers["x-user-roles"];
+    const rolesHeader =
+      typeof rolesHeaderRaw === "string" ? rolesHeaderRaw : undefined;
 
     if (!userId) {
-      throw new UnauthorizedException('Missing x-user-id header');
+      throw new UnauthorizedException("Missing x-user-id header");
     }
 
     req.userId = userId;
-    req.userRoles = rolesHeader ? rolesHeader.split(',') : [];
+    req.userRoles = rolesHeader ? rolesHeader.split(",") : [];
     next();
   }
 }

services/classes/src/middleware/permission.guard.ts

@@ -1,50 +1,71 @@
-import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
-import type { Reflector } from '@nestjs/core';
-import { PermissionDeniedError } from '../shared/errors/application-error.js';
-import type { AuthenticatedRequest } from './auth.middleware.js';
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  SetMetadata,
+} from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+import { PermissionDeniedError } from "../shared/errors/application-error.js";
+import type { AuthenticatedRequest } from "./auth.middleware.js";
 
 export type Permission =
-  | 'CLASS_CREATE'
-  | 'CLASS_READ'
-  | 'CLASS_UPDATE'
-  | 'CLASS_DELETE';
+  "CLASSES_CREATE" | "CLASSES_READ" | "CLASSES_UPDATE" | "CLASSES_DELETE";
 
 export const Permissions = {
-  CLASS_CREATE: 'CLASS_CREATE' as const,
-  CLASS_READ: 'CLASS_READ' as const,
-  CLASS_UPDATE: 'CLASS_UPDATE' as const,
-  CLASS_DELETE: 'CLASS_DELETE' as const,
+  CLASSES_CREATE: "CLASSES_CREATE" as const,
+  CLASSES_READ: "CLASSES_READ" as const,
+  CLASSES_UPDATE: "CLASSES_UPDATE" as const,
+  CLASSES_DELETE: "CLASSES_DELETE" as const,
 };
 
+export const PERMISSIONS_KEY = "permissions";
+export const RequirePermission = (...permissions: Permission[]) =>
+  SetMetadata(PERMISSIONS_KEY, permissions);
+
 const ROLE_PERMISSIONS: Record<string, Permission[]> = {
-  admin: [Permissions.CLASS_CREATE, Permissions.CLASS_READ, Permissions.CLASS_UPDATE, Permissions.CLASS_DELETE],
-  teacher: [Permissions.CLASS_CREATE, Permissions.CLASS_READ, Permissions.CLASS_UPDATE],
-  student: [Permissions.CLASS_READ],
-  parent: [Permissions.CLASS_READ],
+  admin: [
+    Permissions.CLASSES_CREATE,
+    Permissions.CLASSES_READ,
+    Permissions.CLASSES_UPDATE,
+    Permissions.CLASSES_DELETE,
+  ],
+  teacher: [
+    Permissions.CLASSES_CREATE,
+    Permissions.CLASSES_READ,
+    Permissions.CLASSES_UPDATE,
+  ],
+  student: [Permissions.CLASSES_READ],
+  parent: [Permissions.CLASSES_READ],
 };
 
 @Injectable()
 export class PermissionGuard implements CanActivate {
-  constructor(private readonly requiredPermission: Permission) {}
+  constructor(private readonly reflector: Reflector) {}
 
   canActivate(context: ExecutionContext): boolean {
+    if (process.env.DEV_MODE === "true") {
+      return true;
+    }
+
+    const requiredPermissions = this.reflector.getAllAndOverride<Permission[]>(
+      PERMISSIONS_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+
+    if (!requiredPermissions || requiredPermissions.length === 0) {
+      return true;
+    }
+
     const request = context.switchToHttp().getRequest<AuthenticatedRequest>();
     const roles = request.userRoles ?? [];
 
     for (const role of roles) {
       const perms = ROLE_PERMISSIONS[role];
-      if (perms && perms.includes(this.requiredPermission)) {
+      if (perms && requiredPermissions.some((p) => perms.includes(p))) {
         return true;
       }
     }
 
-    throw new PermissionDeniedError(this.requiredPermission);
+    throw new PermissionDeniedError(requiredPermissions.join(", "));
   }
 }
-
-// 工厂函数，用于装饰器（修复：import Reflector 已移至文件顶部）
-export function createPermissionGuardFactory(_reflector: Reflector) {
-  return {
-    create: (permission: Permission) => new PermissionGuard(permission),
-  };
-}