Initial commit: Happy Up monorepo through Sprint 5.

Document-driven MVP with FastAPI backend, Vue H5, WeChat mini shell, product demo, and Docker dev stack.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/app/core/security.py

@@ -0,0 +1,28 @@
+import hashlib
+from datetime import datetime, timedelta, timezone
+
+import jwt
+
+from app.config import settings
+
+
+def hash_phone(phone: str) -> str:
+    normalized = "".join(ch for ch in phone if ch.isdigit())
+    return hashlib.sha256(normalized.encode("utf-8")).hexdigest()
+
+
+def mask_phone(phone: str) -> str:
+    digits = "".join(ch for ch in phone if ch.isdigit())
+    if len(digits) < 7:
+        return phone
+    return f"{digits[:3]}****{digits[-4:]}"
+
+
+def create_access_token(user_id: int, role: str) -> str:
+    expire = datetime.now(timezone.utc) + timedelta(minutes=settings.jwt_expire_minutes)
+    payload = {"sub": str(user_id), "role": role, "exp": expire}
+    return jwt.encode(payload, settings.jwt_secret, algorithm="HS256")
+
+
+def decode_access_token(token: str) -> dict:
+    return jwt.decode(token, settings.jwt_secret, algorithms=["HS256"])