feat: complete huihui square avatar workflows

digital-avatar-app/backend/routers/authorizations.py

@@ -0,0 +1,32 @@
+from fastapi import APIRouter, Depends, Body
+from sqlalchemy.orm import Session
+
+from database import get_db
+from models import Authorization
+from responses import ok, fail
+
+router = APIRouter(tags=["授权"])
+
+
+@router.get("/avatar/{avatar_id}/authorizations")
+def list_auth(avatar_id: str, db: Session = Depends(get_db)):
+    # demo：返回全部授权（忽略具体 avatar 绑定，便于联调）
+    items = db.query(Authorization).order_by(Authorization.created_at.desc()).all()
+    return ok([a.to_dict() for a in items])
+
+
+@router.put("/avatar/{avatar_id}/authorizations")
+def update_auth(avatar_id: str, payload: dict = Body(...), db: Session = Depends(get_db)):
+    auth_id = payload.get("id")
+    if not auth_id:
+        return fail("缺少授权 id", 400)
+    a = db.query(Authorization).filter(Authorization.id == auth_id).first()
+    if not a:
+        return fail("授权不存在", 404)
+    if "status" in payload:
+        a.status = payload["status"]
+    if "permissions" in payload:
+        a.permissions = payload["permissions"]
+    db.commit()
+    items = db.query(Authorization).order_by(Authorization.created_at.desc()).all()
+    return ok([x.to_dict() for x in items])