add creation

自由创作：新增 Creation 模型（继承 Task，display 自动递增）与
/api/creation/ 路由，支持增删改和代码保存，只有创作者本人和超管可访问。
自由创作不进入提交/评分体系；prompt 的两个 WebSocket consumer
连接时校验 can_access_task。补充 task/tests.py 覆盖上述行为。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

prompt/consumers.py

@@ -2,7 +2,7 @@ import json
 from channels.generic.websocket import AsyncWebsocketConsumer
 from channels.db import database_sync_to_async
 from .models import Message
-from .utils import get_or_create_active_conversation
+from .utils import can_access_task, get_or_create_active_conversation
 from .llm import stream_chat, extract_code, stream_guidance, parse_guidance_response
 
 
@@ -14,6 +14,10 @@ class PromptConsumer(AsyncWebsocketConsumer):
             return
 
         self.task_id = int(self.scope["url_route"]["kwargs"]["task_id"])
+        if not await self.check_access():
+            await self.close()
+            return
+
         self.current_user_message = None
         await self.accept()
 
@@ -77,6 +81,10 @@ class PromptConsumer(AsyncWebsocketConsumer):
                 await self.delete_message(self.current_user_message)
                 self.current_user_message = None
 
+    @database_sync_to_async
+    def check_access(self):
+        return can_access_task(self.user, self.task_id)
+
     @database_sync_to_async
     def get_or_create_conversation(self):
         return get_or_create_active_conversation(self.user, self.task_id)
@@ -129,6 +137,10 @@ class GuidanceConsumer(AsyncWebsocketConsumer):
             return
 
         self.task_id = int(self.scope["url_route"]["kwargs"]["task_id"])
+        if not await self.check_access():
+            await self.close()
+            return
+
         self.current_user_message = None
         self.session_messages = []
         await self.accept()
@@ -185,6 +197,10 @@ class GuidanceConsumer(AsyncWebsocketConsumer):
                 await self.delete_message(self.current_user_message)
                 self.current_user_message = None
 
+    @database_sync_to_async
+    def check_access(self):
+        return can_access_task(self.user, self.task_id)
+
     @database_sync_to_async
     def get_or_create_conversation(self):
         return get_or_create_active_conversation(self.user, self.task_id)

prompt/utils.py

@@ -2,6 +2,19 @@ from django.db.models import Count, Q
 from .models import Conversation
 
 
+def can_access_task(user, task_id):
+    """自由创作只有创作者本人（和超管）能对话，其他任务对所有登录用户开放。"""
+    from account.models import RoleChoices
+    from task.models import Creation
+
+    owner_id = (
+        Creation.objects.filter(pk=task_id).values_list("owner_id", flat=True).first()
+    )
+    if owner_id is None:
+        return True
+    return owner_id == user.id or user.role == RoleChoices.SUPER
+
+
 def get_active_conversation(user, task_id):
     """Return the conversation with the most messages for this user+task, or None."""
     return (