限制初始密码强制范围并修复后台图片加载

backend/internal/modules/adminauth/repository.go

@@ -133,6 +133,13 @@ func (r *Repository) FindByID(ctx context.Context, id uint64) (*AdminDTO, error)
 	return &dto, nil
 }
 
+func (r *Repository) FindActiveForPasswordGate(ctx context.Context, id uint64, tokenVersion int64) (*AdminDTO, error) {
+	if _, err := r.FindActiveForToken(ctx, id, tokenVersion); err != nil {
+		return nil, err
+	}
+	return r.FindByID(ctx, id)
+}
+
 func (r *Repository) UpdateSupportStatus(ctx context.Context, adminID uint64, status string) error {
 	if r.db == nil {
 		return ErrDependencyUnavailable
@@ -168,6 +175,7 @@ func (r *Repository) loadRolesAndPerms(ctx context.Context, dto *AdminDTO) {
 		Where("aur.admin_user_id = ?", dto.ID).
 		Find(&roles)
 	dto.Roles = roles
+	dto.PasswordMustChange = dto.PasswordMustChange && rolesRequireInitialPasswordChange(roles)
 
 	// 加载权限
 	for _, role := range roles {
@@ -191,6 +199,15 @@ func (r *Repository) loadRolesAndPerms(ctx context.Context, dto *AdminDTO) {
 	cachePermissions(ctx, r, dto.ID, permCodes)
 }
 
+func rolesRequireInitialPasswordChange(roles []RoleDTO) bool {
+	for _, role := range roles {
+		if role.Code == "super_admin" {
+			return true
+		}
+	}
+	return false
+}
+
 func cachePermissions(ctx context.Context, r *Repository, adminID uint64, permCodes []string) {
 	if r.redis == nil || len(permCodes) == 0 {
 		return

backend/internal/modules/adminauth/repository_test.go

@@ -0,0 +1,35 @@
+package adminauth
+
+import "testing"
+
+func TestRolesRequireInitialPasswordChange(t *testing.T) {
+	tests := []struct {
+		name  string
+		roles []RoleDTO
+		want  bool
+	}{
+		{
+			name:  "超级管理员需要修改初始密码",
+			roles: []RoleDTO{{Code: "super_admin", Name: "超级管理员"}},
+			want:  true,
+		},
+		{
+			name:  "客服不强制修改初始密码",
+			roles: []RoleDTO{{Code: "cs", Name: "客服"}},
+			want:  false,
+		},
+		{
+			name:  "运营不强制修改初始密码",
+			roles: []RoleDTO{{Code: "ops", Name: "运营"}},
+			want:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := rolesRequireInitialPasswordChange(tt.roles); got != tt.want {
+				t.Fatalf("rolesRequireInitialPasswordChange() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}