加固后台管理安全

frontend/src/features/admin/views/AdminLoginView.vue

@@ -3,19 +3,20 @@ import { readError } from '@/shared/utils/error'
 import { ElMessage } from 'element-plus'
 import { Lock, User } from '@element-plus/icons-vue'
 import { onMounted, reactive, ref } from 'vue'
-import { useRouter } from 'vue-router'
+import { useRoute, useRouter } from 'vue-router'
 
 import { fetchAdminCaptcha, type AdminCaptcha } from '@/features/admin'
 import { useAdminSessionStore } from '@/stores/adminSession'
 
 const router = useRouter()
+const route = useRoute()
 const adminSession = useAdminSessionStore()
 const loading = ref(false)
 const captchaLoading = ref(false)
 const captcha = ref<AdminCaptcha | null>(null)
 const form = reactive({
-  username: 'admin',
-  password: 'admin123456',
+  username: '',
+  password: '',
   captchaCode: '',
 })
 
@@ -43,7 +44,8 @@ async function handleLogin() {
       form.captchaCode
     )
     ElMessage.success('后台登录成功')
-    await router.push('/admin/dashboard')
+    const redirect = typeof route.query.redirect === 'string' ? route.query.redirect : ''
+    await router.push(redirect.startsWith('/admin') ? redirect : '/admin/dashboard')
   } catch (error) {
     ElMessage.error(readError(error, '后台登录失败'))
     await loadCaptcha()

frontend/src/features/admin/views/AdminMgrUsersView.vue

@@ -6,7 +6,7 @@ import { ref } from 'vue'
 import {
   fetchAdminMgrUsers,
   deleteAdminMgrUser,
-  changeAdminPassword,
+  resetAdminPassword,
   type AdminMgrUser,
 } from '@/features/admin/api/adminMgr'
 import { useAdminPaginatedTable } from '@/features/admin/composables/useAdminPaginatedTable'
@@ -22,7 +22,7 @@ const showRolesDialog = ref(false)
 const rolesAdmin = ref<AdminMgrUser | null>(null)
 const showPasswordDialog = ref(false)
 const passwordAdmin = ref<AdminMgrUser | null>(null)
-const passwordForm = ref({ old_password: '', new_password: '' })
+const passwordForm = ref({ new_password: '' })
 const passwordSubmitting = ref(false)
 
 const {
@@ -53,7 +53,7 @@ function openRoles(row: AdminMgrUser) {
 
 function openPassword(row: AdminMgrUser) {
   passwordAdmin.value = row
-  passwordForm.value = { old_password: '', new_password: '' }
+  passwordForm.value = { new_password: '' }
   showPasswordDialog.value = true
 }
 
@@ -78,17 +78,17 @@ async function handleDelete(row: AdminMgrUser) {
 
 async function handleChangePassword() {
   if (!passwordAdmin.value) return
-  if (!passwordForm.value.old_password || !passwordForm.value.new_password) {
-    ElMessage.warning('请填写完整')
+  if (!passwordForm.value.new_password) {
+    ElMessage.warning('请填写新密码')
     return
   }
   passwordSubmitting.value = true
   try {
-    await changeAdminPassword(passwordAdmin.value.id, passwordForm.value)
-    ElMessage.success('密码已修改')
+    await resetAdminPassword(passwordAdmin.value.id, passwordForm.value)
+    ElMessage.success('密码已重置，目标账号需要重新登录')
     showPasswordDialog.value = false
   } catch (error) {
-    ElMessage.error(readError(error, '修改失败'))
+    ElMessage.error(readError(error, '重置失败'))
   } finally {
     passwordSubmitting.value = false
   }
@@ -169,35 +169,27 @@ const statusLabel: Record<string, string> = {
     <!-- 角色分配对话框 -->
     <AssignRolesDialog v-model="showRolesDialog" :admin="rolesAdmin" @saved="loadAdmins" />
 
-    <!-- 修改密码对话框 -->
+    <!-- 重置密码对话框 -->
     <el-dialog
       :model-value="showPasswordDialog"
-      :title="`修改密码 - ${passwordAdmin?.username || ''}`"
+      :title="`重置密码 - ${passwordAdmin?.username || ''}`"
       width="460px"
       @update:model-value="showPasswordDialog = $event"
     >
       <div class="dialog-body">
-        <el-form-item label="原密码" class="full-control">
-          <el-input
-            v-model="passwordForm.old_password"
-            type="password"
-            show-password
-            placeholder="请输入原密码"
-          />
-        </el-form-item>
         <el-form-item label="新密码" class="full-control">
           <el-input
             v-model="passwordForm.new_password"
             type="password"
             show-password
-            placeholder="请输入新密码（至少6位）"
+            placeholder="至少 8 位，包含字母和数字"
           />
         </el-form-item>
       </div>
       <template #footer>
         <el-button @click="showPasswordDialog = false">取消</el-button>
         <el-button type="primary" :loading="passwordSubmitting" @click="handleChangePassword"
-          >确认修改</el-button
+          >确认重置</el-button
         >
       </template>
     </el-dialog>