限制初始密码强制范围并修复后台图片加载

backend/internal/modules/adminauth/repository.go

@@ -133,6 +133,13 @@ func (r *Repository) FindByID(ctx context.Context, id uint64) (*AdminDTO, error)
 	return &dto, nil
 }
 
+func (r *Repository) FindActiveForPasswordGate(ctx context.Context, id uint64, tokenVersion int64) (*AdminDTO, error) {
+	if _, err := r.FindActiveForToken(ctx, id, tokenVersion); err != nil {
+		return nil, err
+	}
+	return r.FindByID(ctx, id)
+}
+
 func (r *Repository) UpdateSupportStatus(ctx context.Context, adminID uint64, status string) error {
 	if r.db == nil {
 		return ErrDependencyUnavailable
@@ -168,6 +175,7 @@ func (r *Repository) loadRolesAndPerms(ctx context.Context, dto *AdminDTO) {
 		Where("aur.admin_user_id = ?", dto.ID).
 		Find(&roles)
 	dto.Roles = roles
+	dto.PasswordMustChange = dto.PasswordMustChange && rolesRequireInitialPasswordChange(roles)
 
 	// 加载权限
 	for _, role := range roles {
@@ -191,6 +199,15 @@ func (r *Repository) loadRolesAndPerms(ctx context.Context, dto *AdminDTO) {
 	cachePermissions(ctx, r, dto.ID, permCodes)
 }
 
+func rolesRequireInitialPasswordChange(roles []RoleDTO) bool {
+	for _, role := range roles {
+		if role.Code == "super_admin" {
+			return true
+		}
+	}
+	return false
+}
+
 func cachePermissions(ctx context.Context, r *Repository, adminID uint64, permCodes []string) {
 	if r.redis == nil || len(permCodes) == 0 {
 		return

backend/internal/modules/adminauth/repository_test.go

@@ -0,0 +1,35 @@
+package adminauth
+
+import "testing"
+
+func TestRolesRequireInitialPasswordChange(t *testing.T) {
+	tests := []struct {
+		name  string
+		roles []RoleDTO
+		want  bool
+	}{
+		{
+			name:  "超级管理员需要修改初始密码",
+			roles: []RoleDTO{{Code: "super_admin", Name: "超级管理员"}},
+			want:  true,
+		},
+		{
+			name:  "客服不强制修改初始密码",
+			roles: []RoleDTO{{Code: "cs", Name: "客服"}},
+			want:  false,
+		},
+		{
+			name:  "运营不强制修改初始密码",
+			roles: []RoleDTO{{Code: "ops", Name: "运营"}},
+			want:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := rolesRequireInitialPasswordChange(tt.roles); got != tt.want {
+				t.Fatalf("rolesRequireInitialPasswordChange() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

backend/internal/router/router.go

@@ -315,7 +315,7 @@ func New(cfg config.Config, deps Dependencies, logger *zap.Logger) *gin.Engine {
 	var validateAdminToken middleware.AdminTokenValidatorFunc
 	if adminAuthRepo != nil {
 		validateAdminToken = func(ctx context.Context, adminID uint64, tokenVersion int64) (middleware.AdminTokenContext, error) {
-			admin, err := adminAuthRepo.FindActiveForToken(ctx, adminID, tokenVersion)
+			admin, err := adminAuthRepo.FindActiveForPasswordGate(ctx, adminID, tokenVersion)
 			if err != nil {
 				return middleware.AdminTokenContext{}, err
 			}

frontend/src/components/ChatAttachmentImage.vue

@@ -1,6 +1,7 @@
 <script setup lang="ts">
-import { onBeforeUnmount, ref, watch } from 'vue'
+import { computed, onBeforeUnmount, ref, watch } from 'vue'
 import { fetchAdminFileBlob, fetchFileBlobByURL } from '@/shared/api/files'
+import { isAdminPath } from '@/shared/utils/adminPath'
 
 const props = defineProps<{
   source: string
@@ -9,6 +10,7 @@ const props = defineProps<{
 
 const objectURL = ref('')
 const failed = ref(false)
+const effectiveAdmin = computed(() => props.admin || isAdminPath(window.location.pathname))
 
 function extractObjectKey(value: string) {
   try {
@@ -35,7 +37,9 @@ async function loadImage() {
   try {
     const key = extractObjectKey(props.source)
     const blob =
-      props.admin && key ? await fetchAdminFileBlob(key) : await fetchFileBlobByURL(props.source)
+      effectiveAdmin.value && key
+        ? await fetchAdminFileBlob(key)
+        : await fetchFileBlobByURL(props.source)
     objectURL.value = URL.createObjectURL(blob)
   } catch {
     failed.value = true
@@ -47,7 +51,7 @@ function openImage() {
   window.open(objectURL.value, '_blank')
 }
 
-watch(() => [props.source, props.admin] as const, loadImage, { immediate: true })
+watch(() => [props.source, effectiveAdmin.value] as const, loadImage, { immediate: true })
 
 onBeforeUnmount(revokeCurrentURL)
 </script>

frontend/src/layouts/AdminLayout.vue

@@ -47,6 +47,9 @@ const passwordForm = reactive({
   new_password: '',
   confirm_password: '',
 })
+const shouldForcePasswordChange = computed(
+  () => adminSession.passwordMustChange && adminSession.isSuperAdmin
+)
 
 interface NavItem {
   label: string
@@ -394,7 +397,7 @@ async function handleForcedPasswordChange() {
     </section>
 
     <el-dialog
-      :model-value="adminSession.passwordMustChange"
+      :model-value="shouldForcePasswordChange"
       title="修改初始密码"
       width="420px"
       :close-on-click-modal="false"

frontend/src/shared/components/business/AuthImage.vue

@@ -1,6 +1,7 @@
 <script setup lang="ts">
 import { computed, onBeforeUnmount, ref, watch } from 'vue'
 import { fetchAdminFileBlob, fetchFileBlobByURL } from '@/shared/api/files'
+import { isAdminPath } from '@/shared/utils/adminPath'
 
 const props = withDefaults(
   defineProps<{
@@ -33,6 +34,7 @@ const failed = ref(false)
 const createdURLs: string[] = []
 
 const usePreview = computed(() => !!props.previewSrcList?.length)
+const effectiveAdmin = computed(() => props.admin || isAdminPath(window.location.pathname))
 const fallbackText = computed(() => (failed.value ? '图片加载失败' : '图片加载中'))
 const imageStyleValue = computed(() => {
   if (!props.fit) return props.imageStyle
@@ -52,18 +54,22 @@ function shouldFetchWithAuth(value: string) {
   return value.includes('/api/files/object') || value.includes('/api/admin/files/object')
 }
 
+function shouldFetchAsAdmin(value: string) {
+  return effectiveAdmin.value || value.includes('/api/admin/files/object')
+}
+
 async function resolveURL(url: string): Promise<string> {
   if (!url || !shouldFetchWithAuth(url)) return url
   const key = extractObjectKey(url)
   const blob =
-    props.admin && key ? await fetchAdminFileBlob(key) : await fetchFileBlobByURL(url)
+    shouldFetchAsAdmin(url) && key ? await fetchAdminFileBlob(key) : await fetchFileBlobByURL(url)
   const blobURL = URL.createObjectURL(blob)
   createdURLs.push(blobURL)
   return blobURL
 }
 
 function cleanup() {
-  createdURLs.forEach((u) => URL.revokeObjectURL(u))
+  createdURLs.forEach(u => URL.revokeObjectURL(u))
   createdURLs.length = 0
 }
 
@@ -88,7 +94,7 @@ async function loadImage() {
   }
 }
 
-watch(() => [props.source, props.admin, props.previewSrcList] as const, loadImage, {
+watch(() => [props.source, effectiveAdmin.value, props.previewSrcList] as const, loadImage, {
   immediate: true,
   deep: true,
 })