ss

+<?php
+/**
+ * 认证模块
+ * 处理微信登录、Session 管理
+ */
+
+class AuthService
+{
+    private $pdo;
+    private $config;
+    private $redis;
+
+    public function __construct($pdo, $config, $redis = null)
+    {
+        $this->pdo = $pdo;
+        $this->config = $config;
+        $this->redis = $redis;
+    }
+
+    /**
+     * 微信小程序登录
+     * @param string $code 微信 login code
+     * @param string $phone 手机号
+     * @param string $phoneCode 手机号 code (用于获取真实手机号)
+     * @return array
+     */
+    public function wechatLogin($code, $phone = null, $phoneCode = null)
+    {
+        // 1. 用 code 换取 openid
+        $wxSession = $this->code2Session($code);
+        if (!$wxSession || empty($wxSession['openid'])) {
+            return ['ok' => false, 'error' => '微信登录失败'];
+        }
+
+        $openid = $wxSession['openid'];
+        $unionid = $wxSession['unionid'] ?? null;
+
+        // 2. 如果有 phoneCode，获取真实手机号
+        if ($phoneCode) {
+            $realPhone = $this->getPhoneNumber($phoneCode);
+            if ($realPhone) {
+                $phone = $realPhone;
+            }
+        }
+
+        if (empty($phone)) {
+            return ['ok' => false, 'error' => '手机号不能为空'];
+        }
+
+        // 3. 查找或创建用户
+        $user = $this->findOrCreateUser($phone, $openid, $unionid);
+        if (!$user) {
+            return ['ok' => false, 'error' => '用户创建失败'];
+        }
+
+        // 4. 创建 Session
+        $token = $this->createSession($user['id']);
+        if (!$token) {
+            return ['ok' => false, 'error' => 'Session 创建失败'];
+        }
+
+        // 5. 获取绑定的设备
+        $devices = $this->getUserDevices($user['id']);
+
+        return [
+            'ok' => true,
+            'token' => $token,
+            'user' => [
+                'id' => $user['id'],
+                'phone' => $user['phone'],
+                'nickname' => $user['nickname'],
+                'avatar_url' => $user['avatar_url'],
+            ],
+            'devices' => $devices
+        ];
+    }
+
+    /**
+     * 验证 Token
+     * @param string $token
+     * @return array|null 用户信息或 null
+     */
+    public function verifyToken($token)
+    {
+        if (empty($token)) {
+            return null;
+        }
+
+        // 先从 Redis 缓存查
+        if ($this->redis) {
+            $cached = $this->redis->get("session:$token");
+            if ($cached) {
+                return json_decode($cached, true);
+            }
+        }
+
+        // 从数据库查
+        $stmt = $this->pdo->prepare("
+            SELECT s.*, u.phone, u.nickname, u.avatar_url
+            FROM sessions s
+            JOIN users u ON s.user_id = u.id
+            WHERE s.token = ? AND s.expires_at > NOW()
+        ");
+        $stmt->execute([$token]);
+        $session = $stmt->fetch();
+
+        if (!$session) {
+            return null;
+        }
+
+        $user = [
+            'id' => $session['user_id'],
+            'phone' => $session['phone'],
+            'nickname' => $session['nickname'],
+            'avatar_url' => $session['avatar_url'],
+        ];
+
+        // 缓存到 Redis
+        if ($this->redis) {
+            $ttl = strtotime($session['expires_at']) - time();
+            if ($ttl > 0) {
+                $this->redis->setex("session:$token", $ttl, json_encode($user));
+            }
+        }
+
+        return $user;
+    }
+
+    /**
+     * 注销登录
+     * @param string $token
+     * @return bool
+     */
+    public function logout($token)
+    {
+        // 删除数据库记录
+        $stmt = $this->pdo->prepare("DELETE FROM sessions WHERE token = ?");
+        $stmt->execute([$token]);
+
+        // 删除 Redis 缓存
+        if ($this->redis) {
+            $this->redis->del("session:$token");
+        }
+
+        return true;
+    }
+
+    /**
+     * 微信 code2Session
+     */
+    private function code2Session($code)
+    {
+        $appId = $this->config['wechat']['app_id'];
+        $appSecret = $this->config['wechat']['app_secret'];
+
+        if (empty($appId) || empty($appSecret)) {
+            // 开发模式：返回模拟数据
+            return [
+                'openid' => 'dev_openid_' . substr(md5($code), 0, 16),
+                'session_key' => 'dev_session_key',
+            ];
+        }
+
+        $url = "https://api.weixin.qq.com/sns/jscode2session?" . http_build_query([
+            'appid' => $appId,
+            'secret' => $appSecret,
+            'js_code' => $code,
+            'grant_type' => 'authorization_code'
+        ]);
+
+        $response = file_get_contents($url);
+        if (!$response) {
+            return null;
+        }
+
+        $data = json_decode($response, true);
+        if (isset($data['errcode']) && $data['errcode'] != 0) {
+            error_log("WeChat code2Session error: " . json_encode($data));
+            return null;
+        }
+
+        return $data;
+    }
+
+    /**
+     * 获取微信手机号
+     */
+    private function getPhoneNumber($phoneCode)
+    {
+        $appId = $this->config['wechat']['app_id'];
+        $appSecret = $this->config['wechat']['app_secret'];
+
+        if (empty($appId) || empty($appSecret)) {
+            return null; // 开发模式不支持
+        }
+
+        // 1. 获取 access_token
+        $tokenUrl = "https://api.weixin.qq.com/cgi-bin/token?" . http_build_query([
+            'grant_type' => 'client_credential',
+            'appid' => $appId,
+            'secret' => $appSecret,
+        ]);
+        $tokenRes = json_decode(file_get_contents($tokenUrl), true);
+        if (empty($tokenRes['access_token'])) {
+            return null;
+        }
+
+        // 2. 获取手机号
+        $phoneUrl = "https://api.weixin.qq.com/wxa/business/getuserphonenumber?access_token=" . $tokenRes['access_token'];
+        $phoneRes = json_decode(file_get_contents($phoneUrl, false, stream_context_create([
+            'http' => [
+                'method' => 'POST',
+                'header' => 'Content-Type: application/json',
+                'content' => json_encode(['code' => $phoneCode])
+            ]
+        ])), true);
+
+        if (isset($phoneRes['phone_info']['purePhoneNumber'])) {
+            return $phoneRes['phone_info']['purePhoneNumber'];
+        }
+
+        return null;
+    }
+
+    /**
+     * 查找或创建用户
+     */
+    private function findOrCreateUser($phone, $openid, $unionid = null)
+    {
+        // 先按手机号查找
+        $stmt = $this->pdo->prepare("SELECT * FROM users WHERE phone = ?");
+        $stmt->execute([$phone]);
+        $user = $stmt->fetch();
+
+        if ($user) {
+            // 更新 openid
+            if ($openid && $user['wx_openid'] !== $openid) {
+                $stmt = $this->pdo->prepare("UPDATE users SET wx_openid = ?, wx_unionid = ? WHERE id = ?");
+                $stmt->execute([$openid, $unionid, $user['id']]);
+            }
+            return $user;
+        }
+
+        // 创建新用户
+        $stmt = $this->pdo->prepare("
+            INSERT INTO users (phone, wx_openid, wx_unionid, nickname)
+            VALUES (?, ?, ?, ?)
+        ");
+        $nickname = '用户' . substr($phone, -4);
+        $stmt->execute([$phone, $openid, $unionid, $nickname]);
+
+        return [
+            'id' => $this->pdo->lastInsertId(),
+            'phone' => $phone,
+            'wx_openid' => $openid,
+            'nickname' => $nickname,
+            'avatar_url' => null,
+        ];
+    }
+
+    /**
+     * 创建 Session
+     */
+    private function createSession($userId)
+    {
+        $token = bin2hex(random_bytes(32));
+        $ttl = $this->config['session']['ttl'];
+        $expiresAt = date('Y-m-d H:i:s', time() + $ttl);
+
+        // 单点登录：删除该用户的其他 session
+        if ($this->config['session']['single_login']) {
+            $stmt = $this->pdo->prepare("SELECT token FROM sessions WHERE user_id = ?");
+            $stmt->execute([$userId]);
+            $oldTokens = $stmt->fetchAll(\PDO::FETCH_COLUMN);
+
+            // 删除 Redis 缓存
+            if ($this->redis && $oldTokens) {
+                foreach ($oldTokens as $oldToken) {
+                    $this->redis->del("session:$oldToken");
+                }
+            }
+
+            // 删除数据库记录
+            $stmt = $this->pdo->prepare("DELETE FROM sessions WHERE user_id = ?");
+            $stmt->execute([$userId]);
+        }
+
+        // 插入新 session
+        $stmt = $this->pdo->prepare("
+            INSERT INTO sessions (user_id, token, expires_at)
+            VALUES (?, ?, ?)
+        ");
+        $stmt->execute([$userId, $token, $expiresAt]);
+
+        return $token;
+    }
+
+    /**
+     * 获取用户绑定的设备
+     */
+    private function getUserDevices($userId)
+    {
+        $stmt = $this->pdo->prepare("
+            SELECT d.id, d.name, d.status, d.last_seen, b.is_primary, b.bound_at
+            FROM user_device_bindings b
+            JOIN devices d ON b.device_id = d.id
+            WHERE b.user_id = ?
+            ORDER BY b.is_primary DESC, b.bound_at ASC
+        ");
+        $stmt->execute([$userId]);
+        return $stmt->fetchAll();
+    }
+}

@@ -5,6 +5,18 @@
  */
 
 return [
+    // 微信小程序配置
+    'wechat' => [
+        'app_id' => getenv('WECHAT_APP_ID') ?: '',
+        'app_secret' => getenv('WECHAT_APP_SECRET') ?: '',
+    ],
+
+    // Session 配置
+    'session' => [
+        'ttl' => (int) (getenv('SESSION_TTL') ?: 7 * 24 * 3600), // 7 天
+        'single_login' => (bool) (getenv('SINGLE_LOGIN') ?: true), // 单点登录
+    ],
+
     // Redis 配置
     'redis' => [
         'host' => getenv('REDIS_HOST') ?: '127.0.0.1',

+<?php
+/**
+ * 设备管理模块
+ * 处理设备注册、绑定、状态管理
+ */
+
+class DeviceService
+{
+    private $pdo;
+    private $config;
+
+    public function __construct($pdo, $config)
+    {
+        $this->pdo = $pdo;
+        $this->config = $config;
+    }
+
+    /**
+     * 绑定设备到用户
+     * @param int $userId 用户ID
+     * @param string $deviceId 设备ID
+     * @param string $deviceSecret 设备密钥 (可选验证)
+     * @return array
+     */
+    public function bindDevice($userId, $deviceId, $deviceSecret = null)
+    {
+        // 1. 检查设备是否存在
+        $stmt = $this->pdo->prepare("SELECT * FROM devices WHERE id = ?");
+        $stmt->execute([$deviceId]);
+        $device = $stmt->fetch();
+
+        if (!$device) {
+            return ['ok' => false, 'error' => '设备不存在'];
+        }
+
+        // 2. 验证设备密钥 (如果提供)
+        if ($deviceSecret !== null && $device['secret'] !== $deviceSecret) {
+            return ['ok' => false, 'error' => '设备密钥错误'];
+        }
+
+        // 3. 检查是否已绑定
+        $stmt = $this->pdo->prepare("
+            SELECT * FROM user_device_bindings 
+            WHERE user_id = ? AND device_id = ?
+        ");
+        $stmt->execute([$userId, $deviceId]);
+        if ($stmt->fetch()) {
+            return ['ok' => false, 'error' => '设备已绑定'];
+        }
+
+        // 4. 检查用户是否有其他设备
+        $stmt = $this->pdo->prepare("SELECT COUNT(*) FROM user_device_bindings WHERE user_id = ?");
+        $stmt->execute([$userId]);
+        $count = $stmt->fetchColumn();
+        $isPrimary = ($count == 0) ? 1 : 0;
+
+        // 5. 创建绑定
+        $stmt = $this->pdo->prepare("
+            INSERT INTO user_device_bindings (user_id, device_id, is_primary)
+            VALUES (?, ?, ?)
+        ");
+        $stmt->execute([$userId, $deviceId, $isPrimary]);
+
+        return [
+            'ok' => true,
+            'device' => [
+                'id' => $device['id'],
+                'name' => $device['name'],
+                'status' => $device['status'],
+                'is_primary' => (bool) $isPrimary,
+            ]
+        ];
+    }
+
+    /**
+     * 解绑设备
+     * @param int $userId 用户ID
+     * @param string $deviceId 设备ID
+     * @return array
+     */
+    public function unbindDevice($userId, $deviceId)
+    {
+        $stmt = $this->pdo->prepare("
+            DELETE FROM user_device_bindings 
+            WHERE user_id = ? AND device_id = ?
+        ");
+        $stmt->execute([$userId, $deviceId]);
+
+        if ($stmt->rowCount() === 0) {
+            return ['ok' => false, 'error' => '绑定关系不存在'];
+        }
+
+        return ['ok' => true];
+    }
+
+    /**
+     * 获取用户的设备列表
+     * @param int $userId 用户ID
+     * @return array
+     */
+    public function getUserDevices($userId)
+    {
+        $stmt = $this->pdo->prepare("
+            SELECT d.id, d.name, d.status, d.last_seen, b.is_primary, b.bound_at
+            FROM user_device_bindings b
+            JOIN devices d ON b.device_id = d.id
+            WHERE b.user_id = ?
+            ORDER BY b.is_primary DESC, b.bound_at ASC
+        ");
+        $stmt->execute([$userId]);
+        return $stmt->fetchAll();
+    }
+
+    /**
+     * 设置主设备
+     * @param int $userId 用户ID
+     * @param string $deviceId 设备ID
+     * @return array
+     */
+    public function setPrimaryDevice($userId, $deviceId)
+    {
+        // 先取消所有主设备
+        $stmt = $this->pdo->prepare("
+            UPDATE user_device_bindings SET is_primary = 0 WHERE user_id = ?
+        ");
+        $stmt->execute([$userId]);
+
+        // 设置新主设备
+        $stmt = $this->pdo->prepare("
+            UPDATE user_device_bindings SET is_primary = 1 
+            WHERE user_id = ? AND device_id = ?
+        ");
+        $stmt->execute([$userId, $deviceId]);
+
+        if ($stmt->rowCount() === 0) {
+            return ['ok' => false, 'error' => '设备未绑定'];
+        }
+
+        return ['ok' => true];
+    }
+
+    /**
+     * 更新设备状态
+     * @param string $deviceId 设备ID
+     * @param string $status online/offline
+     * @return bool
+     */
+    public function updateDeviceStatus($deviceId, $status)
+    {
+        $stmt = $this->pdo->prepare("
+            UPDATE devices SET status = ?, last_seen = NOW() WHERE id = ?
+        ");
+        $stmt->execute([$status, $deviceId]);
+        return $stmt->rowCount() > 0;
+    }
+
+    /**
+     * 注册新设备
+     * @param string $deviceId 设备ID
+     * @param string $secret 设备密钥
+     * @param string $name 设备名称
+     * @return array
+     */
+    public function registerDevice($deviceId, $secret, $name = null)
+    {
+        // 检查是否已存在
+        $stmt = $this->pdo->prepare("SELECT * FROM devices WHERE id = ?");
+        $stmt->execute([$deviceId]);
+        if ($stmt->fetch()) {
+            return ['ok' => false, 'error' => '设备ID已存在'];
+        }
+
+        // 创建设备
+        $stmt = $this->pdo->prepare("
+            INSERT INTO devices (id, secret, name, status)
+            VALUES (?, ?, ?, 'offline')
+        ");
+        $stmt->execute([$deviceId, $secret, $name ?: '未命名设备']);
+
+        return [
+            'ok' => true,
+            'device' => [
+                'id' => $deviceId,
+                'name' => $name ?: '未命名设备',
+                'status' => 'offline',
+            ]
+        ];
+    }
+
+    /**
+     * 验证设备连接
+     * @param string $deviceId 设备ID
+     * @param string $secret 设备密钥
+     * @return bool
+     */
+    public function verifyDevice($deviceId, $secret)
+    {
+        $stmt = $this->pdo->prepare("SELECT secret FROM devices WHERE id = ?");
+        $stmt->execute([$deviceId]);
+        $device = $stmt->fetch();
+
+        if (!$device) {
+            return false;
+        }
+
+        return $device['secret'] === $secret;
+    }
+
+    /**
+     * 获取设备的绑定用户
+     * @param string $deviceId 设备ID
+     * @return array 用户ID列表
+     */
+    public function getDeviceUsers($deviceId)
+    {
+        $stmt = $this->pdo->prepare("
+            SELECT u.id, u.phone, u.nickname
+            FROM user_device_bindings b
+            JOIN users u ON b.user_id = u.id
+            WHERE b.device_id = ?
+        ");
+        $stmt->execute([$deviceId]);
+        return $stmt->fetchAll();
+    }
+
+    /**
+     * 检查用户是否有权限访问设备
+     * @param int $userId 用户ID
+     * @param string $deviceId 设备ID
+     * @return bool
+     */
+    public function canAccessDevice($userId, $deviceId)
+    {
+        $stmt = $this->pdo->prepare("
+            SELECT 1 FROM user_device_bindings 
+            WHERE user_id = ? AND device_id = ?
+        ");
+        $stmt->execute([$userId, $deviceId]);
+        return (bool) $stmt->fetch();
+    }
+}

@@ -33,30 +33,54 @@ CREATE TABLE IF NOT EXISTS `devices` (
     `id` VARCHAR(64) NOT NULL COMMENT '设备ID (Device ID)',
     `secret` VARCHAR(128) NOT NULL COMMENT '连接密钥 (Hash)',
     `name` VARCHAR(50) DEFAULT NULL COMMENT '设备昵称',
-    `owner_id` BIGINT UNSIGNED DEFAULT NULL COMMENT '绑定用户ID (NULL=未绑定)',
     `status` ENUM('online', 'offline') DEFAULT 'offline' COMMENT '在线状态',
     `last_seen` TIMESTAMP NULL DEFAULT NULL COMMENT '最后心跳时间',
     `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
     `updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
-    PRIMARY KEY (`id`),
-    KEY `idx_owner` (`owner_id`)
+    PRIMARY KEY (`id`)
 ) ENGINE=InnoDB COMMENT='设备管理表';
 
 -- Users Table
 CREATE TABLE IF NOT EXISTS `users` (
     `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
     `phone` VARCHAR(20) NOT NULL COMMENT '手机号',
-    `password` VARCHAR(255) NOT NULL COMMENT '密码 Hash',
     `wx_openid` VARCHAR(64) DEFAULT NULL COMMENT '微信 OpenID',
+    `wx_unionid` VARCHAR(64) DEFAULT NULL COMMENT '微信 UnionID',
     `nickname` VARCHAR(50) DEFAULT NULL COMMENT '显示的昵称',
     `avatar_url` VARCHAR(255) DEFAULT NULL,
     `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
     `updated_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
     PRIMARY KEY (`id`),
     UNIQUE KEY `uk_phone` (`phone`),
-    UNIQUE KEY `uk_wx_openid` (`wx_openid`)
+    KEY `idx_wx_openid` (`wx_openid`)
 ) ENGINE=InnoDB COMMENT='用户表';
 
+-- Sessions Table (用户登录会话)
+CREATE TABLE IF NOT EXISTS `sessions` (
+    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `user_id` BIGINT UNSIGNED NOT NULL COMMENT '用户ID',
+    `token` VARCHAR(128) NOT NULL COMMENT 'Session Token',
+    `device_info` JSON DEFAULT NULL COMMENT '登录设备信息',
+    `expires_at` TIMESTAMP NOT NULL COMMENT '过期时间',
+    `created_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uk_token` (`token`),
+    KEY `idx_user` (`user_id`),
+    KEY `idx_expires` (`expires_at`)
+) ENGINE=InnoDB COMMENT='用户会话表';
+
+-- User Device Bindings Table (手机号-设备绑定关系)
+CREATE TABLE IF NOT EXISTS `user_device_bindings` (
+    `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+    `user_id` BIGINT UNSIGNED NOT NULL COMMENT '用户ID',
+    `device_id` VARCHAR(64) NOT NULL COMMENT '设备ID',
+    `is_primary` TINYINT(1) DEFAULT 0 COMMENT '是否主设备',
+    `bound_at` TIMESTAMP DEFAULT CURRENT_TIMESTAMP COMMENT '绑定时间',
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uk_user_device` (`user_id`, `device_id`),
+    KEY `idx_device` (`device_id`)
+) ENGINE=InnoDB COMMENT='用户设备绑定表';
+
 -- Device Logs Table
 CREATE TABLE IF NOT EXISTS `device_logs` (
     `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,

@@ -7,6 +7,8 @@ use Tos\Exception\TosServerException;
 use Tos\Model\PutObjectInput;
 
 require_once __DIR__ . '/vendor/autoload.php';
+require_once __DIR__ . '/auth.php';
+require_once __DIR__ . '/device.php';
 
 // 加载配置文件
 $config = require __DIR__ . '/config.php';
@@ -14,14 +16,19 @@ $config = require __DIR__ . '/config.php';
 // Define Heartbeat Interval
 define('HEARTBEAT_TIME', $config['heartbeat']['interval']);
 
-// Create a WebSocket worker
-$ws_host = $config['server']['websocket_host'];
-$ws_port = $config['server']['websocket_port'];
-$ws_worker = new Worker("websocket://{$ws_host}:{$ws_port}");
-
-// Emulate simple routing/state for now
-// In production, use Redis for distributed state
-$ws_worker->count = $config['server']['worker_count'];
+// Database Connection
+$pdo = null;
+try {
+    $db_config = $config['database'];
+    $dsn = "mysql:host={$db_config['host']};port={$db_config['port']};dbname={$db_config['database']};charset=utf8mb4";
+    $pdo = new PDO($dsn, $db_config['username'], $db_config['password'], [
+        PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
+        PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC
+    ]);
+    echo "✅ Connected to MySQL at {$db_config['host']}:{$db_config['port']}\n";
+} catch (Exception $e) {
+    echo "⚠️ MySQL Connection Failed: " . $e->getMessage() . "\n";
+}
 
 // Redis Connection
 $redis = null;
@@ -46,6 +53,15 @@ try {
     echo "⚠️ Redis Connection Failed: " . $e->getMessage() . "\n";
 }
 
+// Initialize Services
+$authService = $pdo ? new AuthService($pdo, $config, $redis) : null;
+$deviceService = $pdo ? new DeviceService($pdo, $config) : null;
+
+// Create a WebSocket worker
+$ws_host = $config['server']['websocket_host'];
+$ws_port = $config['server']['websocket_port'];
+$ws_worker = new Worker("websocket://{$ws_host}:{$ws_port}");
+
 // Store connections (Memory for now, can move to Redis later)
 $clients = []; // ClientID -> Connection
 $devices = []; // DeviceID -> Connection
@@ -71,7 +87,7 @@ $ws_worker->onConnect = function ($connection) {
     $connection->authVerified = false;
 };
 
-$ws_worker->onMessage = function ($connection, $data) use (&$clients, &$devices) {
+$ws_worker->onMessage = function ($connection, $data) use (&$clients, &$devices, $authService, $deviceService) {
     $msg = json_decode($data, true);
     if (!$msg || !isset($msg['type'])) {
         return;
@@ -80,24 +96,66 @@ $ws_worker->onMessage = function ($connection, $data) use (&$clients, &$devices)
     // 1. Authenticate / Register
     if ($msg['type'] === 'register') {
         if ($msg['role'] === 'device') {
-            // Device 注册
-            $deviceId = $msg['id']; // TODO: Add secret validation
+            // Device 注册 - 验证密钥
+            $deviceId = $msg['id'] ?? null;
+            $secret = $msg['secret'] ?? null;
+
+            if (!$deviceId) {
+                $connection->send(json_encode(['type' => 'error', 'msg' => 'Device ID required']));
+                return;
+            }
+
+            // 验证设备（如果有 deviceService）
+            if ($deviceService && $secret) {
+                if (!$deviceService->verifyDevice($deviceId, $secret)) {
+                    $connection->send(json_encode(['type' => 'error', 'msg' => 'Invalid device credentials']));
+                    $connection->close();
+                    return;
+                }
+                // 更新设备状态为在线
+                $deviceService->updateDeviceStatus($deviceId, 'online');
+            }
+
             $devices[$deviceId] = $connection;
             $connection->deviceId = $deviceId;
             $connection->role = 'device';
             $connection->authVerified = true;
             $connection->send(json_encode(['type' => 'ack', 'status' => 'registered']));
             echo "Device Registered: $deviceId\n";
+
         } elseif ($msg['role'] === 'client') {
-            // Mini Program 注册
-            // TODO: Validate Token
-            $clientId = $msg['id'];
+            // Mini Program 注册 - 验证 Token
+            $clientId = $msg['id'] ?? null;
+            $token = $msg['token'] ?? null;
+
+            if (!$clientId) {
+                $connection->send(json_encode(['type' => 'error', 'msg' => 'Client ID required']));
+                return;
+            }
+
+            // 验证 Token（如果有 authService 和 token）
+            $user = null;
+            if ($authService && $token) {
+                $user = $authService->verifyToken($token);
+                if (!$user) {
+                    $connection->send(json_encode(['type' => 'error', 'msg' => 'Invalid or expired token']));
+                    $connection->close();
+                    return;
+                }
+                $connection->userId = $user['id'];
+                $connection->userPhone = $user['phone'];
+            }
+
             $clients[$clientId] = $connection;
             $connection->clientId = $clientId;
             $connection->role = 'client';
             $connection->authVerified = true;
-            $connection->send(json_encode(['type' => 'ack', 'status' => 'connected']));
-            echo "Client Connected: $clientId\n";
+            $connection->send(json_encode([
+                'type' => 'ack',
+                'status' => 'connected',
+                'user' => $user
+            ]));
+            echo "Client Connected: $clientId" . ($user ? " (User: {$user['phone']})" : "") . "\n";
         }
         return;
     }
@@ -112,12 +170,22 @@ $ws_worker->onMessage = function ($connection, $data) use (&$clients, &$devices)
     // Client -> Device
     if ($msg['type'] === 'proxy' && $connection->role === 'client') {
         $targetDeviceId = $msg['targetDeviceId'] ?? null;
+
+        // 验证用户是否有权限访问该设备
+        if ($deviceService && isset($connection->userId)) {
+            if (!$deviceService->canAccessDevice($connection->userId, $targetDeviceId)) {
+                $connection->send(json_encode(['type' => 'error', 'msg' => 'No permission to access this device']));
+                return;
+            }
+        }
+
         if ($targetDeviceId && isset($devices[$targetDeviceId])) {
             $payload = $msg['payload'];
             // Wrap it so device knows who sent it
             $forwardMsg = [
                 'type' => 'cmd:execute',
                 'fromClientId' => $connection->clientId,
+                'fromUserId' => $connection->userId ?? null,
                 'payload' => $payload
             ];
             $devices[$targetDeviceId]->send(json_encode($forwardMsg));
@@ -143,10 +211,14 @@ $ws_worker->onMessage = function ($connection, $data) use (&$clients, &$devices)
     }
 };
 
-$ws_worker->onClose = function ($connection) use (&$clients, &$devices) {
+$ws_worker->onClose = function ($connection) use (&$clients, &$devices, $deviceService) {
     if (isset($connection->role)) {
         if ($connection->role === 'device' && isset($connection->deviceId)) {
             unset($devices[$connection->deviceId]);
+            // 更新设备状态为离线
+            if ($deviceService) {
+                $deviceService->updateDeviceStatus($connection->deviceId, 'offline');
+            }
             echo "Device disconnected: {$connection->deviceId}\n";
         } elseif ($connection->role === 'client' && isset($connection->clientId)) {
             unset($clients[$connection->clientId]);
@@ -162,9 +234,206 @@ $http_host = $config['server']['http_host'];
 $http_port = $config['server']['http_port'];
 $http_worker = new Worker("http://{$http_host}:{$http_port}");
 $http_worker->count = $config['server']['worker_count'];
-$http_worker->onMessage = function ($connection, $request) use ($config) {
-    // 1. Static File Serving (Simple implementation)
+$http_worker->onMessage = function ($connection, $request) use ($config, $authService, $deviceService) {
     $path = $request->path();
+    $method = $request->method();
+
+    // Helper: JSON Response
+    $jsonResponse = function ($data, $status = 200) use ($connection) {
+        $connection->send(new \Workerman\Protocols\Http\Response(
+            $status,
+            ['Content-Type' => 'application/json', 'Access-Control-Allow-Origin' => '*'],
+            json_encode($data)
+        ));
+    };
+
+    // CORS Preflight
+    if ($method === 'OPTIONS') {
+        $connection->send(new \Workerman\Protocols\Http\Response(200, [
+            'Access-Control-Allow-Origin' => '*',
+            'Access-Control-Allow-Methods' => 'GET, POST, PUT, DELETE, OPTIONS',
+            'Access-Control-Allow-Headers' => 'Content-Type, Authorization',
+        ], ''));
+        return;
+    }
+
+    // ==================== Auth API ====================
+
+    // POST /api/auth/login - 微信登录
+    if ($path === '/api/auth/login' && $method === 'POST') {
+        if (!$authService) {
+            $jsonResponse(['ok' => false, 'error' => 'Auth service unavailable'], 500);
+            return;
+        }
+
+        $body = json_decode($request->rawBody(), true) ?: [];
+        $code = $body['code'] ?? null;
+        $phone = $body['phone'] ?? null;
+        $phoneCode = $body['phoneCode'] ?? null;
+
+        if (!$code) {
+            $jsonResponse(['ok' => false, 'error' => 'code is required'], 400);
+            return;
+        }
+
+        $result = $authService->wechatLogin($code, $phone, $phoneCode);
+        $jsonResponse($result, $result['ok'] ? 200 : 400);
+        return;
+    }
+
+    // POST /api/auth/verify - 验证 Token
+    if ($path === '/api/auth/verify' && $method === 'POST') {
+        if (!$authService) {
+            $jsonResponse(['ok' => false, 'error' => 'Auth service unavailable'], 500);
+            return;
+        }
+
+        $body = json_decode($request->rawBody(), true) ?: [];
+        $token = $body['token'] ?? null;
+
+        if (!$token) {
+            $jsonResponse(['ok' => false, 'error' => 'token is required'], 400);
+            return;
+        }
+
+        $user = $authService->verifyToken($token);
+        if ($user) {
+            $jsonResponse(['ok' => true, 'user' => $user]);
+        } else {
+            $jsonResponse(['ok' => false, 'error' => 'Invalid or expired token'], 401);
+        }
+        return;
+    }
+
+    // POST /api/auth/logout - 注销
+    if ($path === '/api/auth/logout' && $method === 'POST') {
+        if (!$authService) {
+            $jsonResponse(['ok' => false, 'error' => 'Auth service unavailable'], 500);
+            return;
+        }
+
+        $body = json_decode($request->rawBody(), true) ?: [];
+        $token = $body['token'] ?? null;
+
+        if ($token) {
+            $authService->logout($token);
+        }
+        $jsonResponse(['ok' => true]);
+        return;
+    }
+
+    // ==================== Device API ====================
+
+    // Helper: Get user from token
+    $getUser = function () use ($request, $authService) {
+        $authHeader = $request->header('Authorization');
+        if (!$authHeader || !str_starts_with($authHeader, 'Bearer ')) {
+            return null;
+        }
+        $token = substr($authHeader, 7);
+        return $authService ? $authService->verifyToken($token) : null;
+    };
+
+    // POST /api/device/bind - 绑定设备
+    if ($path === '/api/device/bind' && $method === 'POST') {
+        if (!$deviceService) {
+            $jsonResponse(['ok' => false, 'error' => 'Device service unavailable'], 500);
+            return;
+        }
+
+        $user = $getUser();
+        if (!$user) {
+            $jsonResponse(['ok' => false, 'error' => 'Unauthorized'], 401);
+            return;
+        }
+
+        $body = json_decode($request->rawBody(), true) ?: [];
+        $deviceId = $body['deviceId'] ?? null;
+        $deviceSecret = $body['deviceSecret'] ?? null;
+
+        if (!$deviceId) {
+            $jsonResponse(['ok' => false, 'error' => 'deviceId is required'], 400);
+            return;
+        }
+
+        $result = $deviceService->bindDevice($user['id'], $deviceId, $deviceSecret);
+        $jsonResponse($result, $result['ok'] ? 200 : 400);
+        return;
+    }
+
+    // POST /api/device/unbind - 解绑设备
+    if ($path === '/api/device/unbind' && $method === 'POST') {
+        if (!$deviceService) {
+            $jsonResponse(['ok' => false, 'error' => 'Device service unavailable'], 500);
+            return;
+        }
+
+        $user = $getUser();
+        if (!$user) {
+            $jsonResponse(['ok' => false, 'error' => 'Unauthorized'], 401);
+            return;
+        }
+
+        $body = json_decode($request->rawBody(), true) ?: [];
+        $deviceId = $body['deviceId'] ?? null;
+
+        if (!$deviceId) {
+            $jsonResponse(['ok' => false, 'error' => 'deviceId is required'], 400);
+            return;
+        }
+
+        $result = $deviceService->unbindDevice($user['id'], $deviceId);
+        $jsonResponse($result, $result['ok'] ? 200 : 400);
+        return;
+    }
+
+    // GET /api/device/list - 获取绑定的设备列表
+    if ($path === '/api/device/list' && $method === 'GET') {
+        if (!$deviceService) {
+            $jsonResponse(['ok' => false, 'error' => 'Device service unavailable'], 500);
+            return;
+        }
+
+        $user = $getUser();
+        if (!$user) {
+            $jsonResponse(['ok' => false, 'error' => 'Unauthorized'], 401);
+            return;
+        }
+
+        $devices = $deviceService->getUserDevices($user['id']);
+        $jsonResponse(['ok' => true, 'devices' => $devices]);
+        return;
+    }
+
+    // POST /api/device/primary - 设置主设备
+    if ($path === '/api/device/primary' && $method === 'POST') {
+        if (!$deviceService) {
+            $jsonResponse(['ok' => false, 'error' => 'Device service unavailable'], 500);
+            return;
+        }
+
+        $user = $getUser();
+        if (!$user) {
+            $jsonResponse(['ok' => false, 'error' => 'Unauthorized'], 401);
+            return;
+        }
+
+        $body = json_decode($request->rawBody(), true) ?: [];
+        $deviceId = $body['deviceId'] ?? null;
+
+        if (!$deviceId) {
+            $jsonResponse(['ok' => false, 'error' => 'deviceId is required'], 400);
+            return;
+        }
+
+        $result = $deviceService->setPrimaryDevice($user['id'], $deviceId);
+        $jsonResponse($result, $result['ok'] ? 200 : 400);
+        return;
+    }
+
+    // ==================== File API ====================
+
+    // 1. Static File Serving (Simple implementation)
     if (strpos($path, '/uploads/') === 0) {
         $file = __DIR__ . $path;
         if (is_file($file)) {