加固后台管理安全

frontend/src/features/admin/api/adminAuth.ts

@@ -2,7 +2,6 @@ import axios from 'axios'
 
 import { apiClient } from '@/shared/api/client'
 import type { ApiResponse } from '@/shared/types/types'
-import { getRefreshToken, setAuthTokens } from '@/shared/utils/authStorage'
 import type { UserStatus } from '@/shared/types/status'
 
 export interface AdminRole {
@@ -17,21 +16,19 @@ export interface AdminUser {
   nickname: string
   status: UserStatus
   support_status: 'online' | 'offline' | 'busy'
+  password_must_change: boolean
   roles: AdminRole[]
   permissions: string[]
   last_login_at?: string
 }
 
-export interface AdminTokenPair {
-  access_token: string
-  refresh_token: string
-  token_type: string
+export interface AdminRefreshData {
+  refreshed: boolean
   expires_in: number
 }
 
 export interface AdminLoginData {
   admin: AdminUser
-  tokens: AdminTokenPair
 }
 
 export interface AdminCaptcha {
@@ -82,13 +79,10 @@ export async function updateSupportStatus(status: 'online' | 'offline' | 'busy')
 
 /** Manually refresh admin token (uses raw axios to avoid interceptor recursion) */
 export async function refreshAdminSession() {
-  const refreshToken = getRefreshToken('admin')
-  if (!refreshToken) throw new Error('no refresh token')
-  const { data } = await axios.post<ApiResponse<AdminTokenPair>>(
+  const { data } = await axios.post<ApiResponse<AdminRefreshData>>(
     '/api/admin/auth/refresh',
-    { refresh_token: refreshToken },
-    { timeout: 10000 }
+    {},
+    { timeout: 10000, withCredentials: true }
   )
-  setAuthTokens('admin', data.data)
   return data.data
 }

frontend/src/features/admin/api/adminMgr.ts

@@ -36,6 +36,10 @@ export interface ChangePasswordRequest {
   new_password: string
 }
 
+export interface ResetPasswordRequest {
+  new_password: string
+}
+
 export async function fetchAdminMgrUsers(page = 1, pageSize = 20) {
   const { data } = await apiClient.get<ApiResponse<PaginatedResult<AdminMgrUser>>>(
     '/admin/admin-users',
@@ -78,7 +82,15 @@ export async function assignAdminRoles(id: number, roleIds: number[]) {
   return data.data
 }
 
-export async function changeAdminPassword(id: number, req: ChangePasswordRequest) {
+export async function changeAdminPassword(req: ChangePasswordRequest) {
+  const { data } = await apiClient.put<ApiResponse<{ updated: boolean }>>(
+    '/admin/admin-users/me/password',
+    req
+  )
+  return data.data
+}
+
+export async function resetAdminPassword(id: number, req: ResetPasswordRequest) {
   const { data } = await apiClient.put<ApiResponse<{ updated: boolean }>>(
     `/admin/admin-users/${id}/password`,
     req