feat(interaction): 支持游客互动与登录合并

fruitshorts-framework/src/main/java/com/fruitshorts/framework/interaction/InteractionIdentityResolver.java

@@ -0,0 +1,33 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.framework.interaction;
+
+import com.fruitshorts.common.exception.ErrorCode;
+import com.fruitshorts.common.exception.ServiceException;
+import com.fruitshorts.common.interaction.InteractionIdentity;
+import org.springframework.stereotype.Component;
+
+/** 点赞、收藏、评论共用的身份解析入口。 */
+@Component
+public class InteractionIdentityResolver {
+
+    public InteractionIdentity resolve(Long userId, String headerDeviceId, String bodyDeviceId) {
+        if (userId != null) {
+            return new InteractionIdentity(userId, "");
+        }
+        String deviceId = normalize(headerDeviceId);
+        if (deviceId.isEmpty()) {
+            deviceId = normalize(bodyDeviceId);
+        }
+        if (deviceId.isEmpty()) {
+            throw new ServiceException(
+                    ErrorCode.INTERACTION_IDENTITY_REQUIRED,
+                    ErrorCode.INTERACTION_IDENTITY_REQUIRED.getMessage());
+        }
+        return new InteractionIdentity(null, deviceId);
+    }
+
+    private String normalize(String value) {
+        return value == null ? "" : value.trim();
+    }
+}

fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java

@@ -45,6 +45,7 @@ public class SecurityConfig {
             "/app/dramas/**",
             "/app/search",
             "/app/episodes/*/play",
+            "/app/episodes/*/stats",
             "/app/config/**",
             /* 启动配置与公告：客户端登录前就要拿（POST /app/creator/apply 等仍要登录） */
             "/app/config",
@@ -80,7 +81,12 @@ public class SecurityConfig {
                 .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
                 .authorizeHttpRequests(registry -> registry
                         .requestMatchers(HttpMethod.OPTIONS, "/**").permitAll()
-                        /* 评论列表允许匿名浏览；发布/删除仍需登录（未列入白名单即需鉴权） */
+                        /* 非付费互动允许设备身份；解锁、钱包与权益接口仍只允许登录用户。 */
+                        .requestMatchers(HttpMethod.POST, "/app/likes/toggle").permitAll()
+                        .requestMatchers(HttpMethod.POST, "/app/favorites/toggle").permitAll()
+                        .requestMatchers(HttpMethod.DELETE, "/app/favorites/*").permitAll()
+                        .requestMatchers(HttpMethod.POST, "/app/comments").permitAll()
+                        .requestMatchers(HttpMethod.DELETE, "/app/comments/*").permitAll()
                         .requestMatchers(HttpMethod.GET, "/app/comments").permitAll()
                         .requestMatchers(HttpMethod.GET, "/app/comments/count").permitAll()
                         .requestMatchers(PUBLIC_PATHS).permitAll()