用户资料/重置密码/用户管理

server/api/auth/login.post.ts

@@ -9,7 +9,7 @@ import {
   rowToAuthUser,
   verifyPassword
 } from '../../utils/auth'
-import { findUserByUsername } from '../../utils/db'
+import { findUserByUsername, isPasswordResetRequired } from '../../utils/db'
 import { getAdminSecret } from '../../utils/env'
 import { verifyLoginVerification, type VerificationBody } from '../../utils/login-verification'
 import { logActivity } from '../../utils/activity-log'
@@ -56,6 +56,12 @@ export default defineEventHandler(async (event) => {
   }
 
   const user = findUserByUsername(username)
+
+  // 管理员已清除密码：下次登录时直接进入设置新密码流程
+  if (user && isPasswordResetRequired(user.id)) {
+    return { success: false, requiresPasswordReset: true, username: user.username }
+  }
+
   if (!user || !verifyPassword(password, user.password_hash)) {
     logWarn('login failed: invalid credentials', { ip, username })
     createApiError(event, 'UNAUTHORIZED', '用户名或密码错误', 401)

server/api/auth/reset-password.post.ts

@@ -0,0 +1,34 @@
+import { createApiError } from '../../utils/api-error'
+import { createSession, hashPassword } from '../../utils/auth'
+import {
+  findUserByUsername,
+  isPasswordResetRequired,
+  setUserPassword
+} from '../../utils/db'
+import { logInfo } from '../../utils/logger'
+
+interface ResetBody {
+  username?: string
+  password?: string
+}
+
+export default defineEventHandler(async (event) => {
+  const body = await readBody<ResetBody>(event).catch((): ResetBody => ({}))
+  const username = body.username?.trim() ?? ''
+  const password = body.password ?? ''
+
+  if (!username || password.length < 6) {
+    createApiError(event, 'INVALID_REQUEST', '请输入用户名和至少 6 位的新密码', 400)
+  }
+
+  const user = findUserByUsername(username)
+  if (!user || !isPasswordResetRequired(user.id)) {
+    createApiError(event, 'UNAUTHORIZED', '该账号无需重置密码', 401)
+  }
+
+  setUserPassword(user.id, await hashPassword(password))
+  await createSession(event, user.id)
+  logInfo('password reset completed', { username })
+
+  return { success: true }
+})