feat: 多用户系统改造（数据模型 + 认证 API）

backend/diary/views.py

@@ -1,6 +1,7 @@
 from rest_framework import viewsets
 from rest_framework.decorators import action
 from rest_framework.response import Response
+from rest_framework import permissions
 from django.utils import timezone
 from .models import DiaryEntry, DailyProgress, Experience, Task, Comment
 from .serializers import (
@@ -9,21 +10,24 @@ from .serializers import (
 )
 
 class DiaryEntryViewSet(viewsets.ModelViewSet):
-    queryset = DiaryEntry.objects.all()
     serializer_class = DiaryEntrySerializer
+    permission_classes = [permissions.IsAuthenticated]
+    
+    def get_queryset(self):
+        return DiaryEntry.objects.filter(user=self.request.user)
 
     @action(detail=False, methods=['get'])
     def today(self, request):
         """获取今天的日记"""
         today = timezone.now().date()
-        entry, created = DiaryEntry.objects.get_or_create(date=today)
+        entry, created = DiaryEntry.objects.get_or_create(user=request.user, date=today)
         serializer = self.get_serializer(entry)
         return Response(serializer.data)
 
     @action(detail=False, methods=['get'])
     def recent(self, request):
         """获取最近 7 天的日记"""
-        entries = DiaryEntry.objects.order_by('-date')[:7]
+        entries = DiaryEntry.objects.filter(user=request.user).order_by('-date')[:7]
         serializer = self.get_serializer(entries, many=True)
         return Response(serializer.data)
 
@@ -73,8 +77,11 @@ class DailyProgressViewSet(viewsets.ModelViewSet):
 
 
 class ExperienceViewSet(viewsets.ModelViewSet):
-    queryset = Experience.objects.all()
     serializer_class = ExperienceSerializer
+    permission_classes = [permissions.IsAuthenticated]
+    
+    def get_queryset(self):
+        return Experience.objects.filter(user=self.request.user)
 
     @action(detail=False, methods=['get'])
     def by_category(self, request):
@@ -96,8 +103,11 @@ class ExperienceViewSet(viewsets.ModelViewSet):
 
 
 class TaskViewSet(viewsets.ModelViewSet):
-    queryset = Task.objects.all()
     serializer_class = TaskSerializer
+    permission_classes = [permissions.IsAuthenticated]
+    
+    def get_queryset(self):
+        return Task.objects.filter(user=self.request.user)
 
     @action(detail=False, methods=['get'])
     def by_status(self, request):