功能：完善登录安全与客服手动下单

backend/internal/service/merchant_test.go

@@ -6,6 +6,8 @@ import (
 	"testing"
 
 	"affiliate_dash/internal/model"
+
+	"golang.org/x/crypto/bcrypt"
 )
 
 func TestCreateAPIClientEnforcesPerMerchantLimit(t *testing.T) {
@@ -174,3 +176,29 @@ func TestMemberCanBeUpdatedOrRemovedWithoutDeletingAccount(t *testing.T) {
 		t.Fatalf("member relationship should be removed, count=%d err=%v", count, err)
 	}
 }
+
+func TestAuthServiceChangePasswordVerifiesCurrentPassword(t *testing.T) {
+	db := newServiceTestDB(t)
+	tenant := NewTenantService(db)
+	auth := NewAuthService(db, nil, tenant)
+	user, err := NewUserService(db, tenant).Create("password-owner", "old-password", "密码管理员", model.RoleAdmin, 0)
+	if err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	if err := auth.ChangePassword(user.ID, "wrong-password", "new-password"); err == nil {
+		t.Fatal("expected current password validation error")
+	}
+	if err := auth.ChangePassword(user.ID, "old-password", "new-password"); err != nil {
+		t.Fatalf("change password: %v", err)
+	}
+	var saved model.User
+	if err := db.First(&saved, user.ID).Error; err != nil {
+		t.Fatalf("load updated user: %v", err)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(saved.PasswordHash), []byte("new-password")); err != nil {
+		t.Fatalf("new password should match: %v", err)
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(saved.PasswordHash), []byte("old-password")); err == nil {
+		t.Fatal("old password should no longer match")
+	}
+}