diff --git a/apps/backend/src/services/worker-platform/index.ts b/apps/backend/src/services/worker-platform/index.ts
index da20bcaa..0cb58bc7 100644
--- a/apps/backend/src/services/worker-platform/index.ts
+++ b/apps/backend/src/services/worker-platform/index.ts
@@ -1,6 +1,7 @@
 export * from './mappers.js'
 export * from './worker-session-context-service.js'
 export * from './worker-service.js'
+export * from './worker-auth-policy.js'
 export * from './worker-platform-defaults.js'
 export * from './work-order-timeout-policy.js'
 export * from './after-sales-service.js'
diff --git a/apps/backend/src/services/worker-platform/worker-auth-policy.ts b/apps/backend/src/services/worker-platform/worker-auth-policy.ts
new file mode 100644
index 00000000..2698a7b4
--- /dev/null
+++ b/apps/backend/src/services/worker-platform/worker-auth-policy.ts
@@ -0,0 +1,42 @@
+import type { WorkerUserRow } from '../../repositories/worker-platform/index.js'
+import { createHttpError } from '../../utils/http.js'
+
+export function assertWorkerLoginAllowed(worker: WorkerUserRow) {
+  if (worker.status === 'active') return
+
+  if (worker.status === 'rejected') {
+    throw createHttpError('接单账号已被冻结，无法登录', {
+      statusCode: 403,
+      errorCode: 'worker_rejected',
+    })
+  }
+
+  if (worker.status === 'pending_review') {
+    throw createHttpError('接单账号待处理，暂无法登录', {
+      statusCode: 403,
+      errorCode: 'worker_pending_review',
+    })
+  }
+
+  throw createHttpError('接单账号已停用', {
+    statusCode: 403,
+    errorCode: 'worker_disabled',
+  })
+}
+
+export function normalizeWorkerDeviceType(value: unknown): string {
+  const type = String(value || '')
+    .trim()
+    .toLowerCase()
+  return type === 'mobile' || type === 'tablet' ? type : 'pc'
+}
+
+export function normalizeWorkerDeviceId(value: unknown, fallback: string): string {
+  const deviceId = String(value || '').trim()
+  return (deviceId || fallback).slice(0, 200)
+}
+
+export function normalizeWorkerDeviceName(value: unknown, deviceType: string): string {
+  const name = String(value || '').trim()
+  return (name || (deviceType === 'pc' ? 'PC 浏览器' : '移动设备')).slice(0, 100)
+}
diff --git a/apps/backend/src/services/worker-platform/worker-service.ts b/apps/backend/src/services/worker-platform/worker-service.ts
index f6a3db24..11813f0f 100644
--- a/apps/backend/src/services/worker-platform/worker-service.ts
+++ b/apps/backend/src/services/worker-platform/worker-service.ts
@@ -152,6 +152,12 @@ import {
   isWorkerPasswordStrong,
   verifyWorkerPassword,
 } from './mappers.js'
+import {
+  assertWorkerLoginAllowed,
+  normalizeWorkerDeviceId,
+  normalizeWorkerDeviceName,
+  normalizeWorkerDeviceType,
+} from './worker-auth-policy.js'
 import { ensureWorkerPlatformDefaults } from './worker-platform-defaults.js'
 import { normalizeWorkOrderTimeoutPolicy } from './work-order-timeout-policy.js'
 
@@ -165,6 +171,7 @@ export {
   requireActiveWorkerSession,
 } from './worker-session-context-service.js'
 export type { WorkerSession } from './worker-session-context-service.js'
+export { assertWorkerLoginAllowed } from './worker-auth-policy.js'
 export { ensureWorkerPlatformDefaults } from './worker-platform-defaults.js'
 export {
   isWorkOrderTimeoutPolicy,
@@ -719,31 +726,6 @@ async function authenticateWorkerCredentials(
   return worker
 }
 
-export function assertWorkerLoginAllowed(worker: WorkerUserRow) {
-  if (worker.status === 'active') {
-    return
-  }
-
-  if (worker.status === 'rejected') {
-    throw createHttpError('接单账号已被冻结，无法登录', {
-      statusCode: 403,
-      errorCode: 'worker_rejected',
-    })
-  }
-
-  if (worker.status === 'pending_review') {
-    throw createHttpError('接单账号待处理，暂无法登录', {
-      statusCode: 403,
-      errorCode: 'worker_pending_review',
-    })
-  }
-
-  throw createHttpError('接单账号已停用', {
-    statusCode: 403,
-    errorCode: 'worker_disabled',
-  })
-}
-
 export async function logoutWorkerSession(token: unknown) {
   const normalizedToken = String(token || '').trim()
   if (!normalizedToken) {
@@ -892,23 +874,6 @@ function mapWorkerSession(session: WorkerSessionRow, currentSessionId: string) {
   }
 }
 
-function normalizeWorkerDeviceType(value: unknown): string {
-  const type = String(value || '')
-    .trim()
-    .toLowerCase()
-  return type === 'mobile' || type === 'tablet' ? type : 'pc'
-}
-
-function normalizeWorkerDeviceId(value: unknown, fallback: string): string {
-  const deviceId = String(value || '').trim()
-  return (deviceId || fallback).slice(0, 200)
-}
-
-function normalizeWorkerDeviceName(value: unknown, deviceType: string): string {
-  const name = String(value || '').trim()
-  return (name || (deviceType === 'pc' ? 'PC 浏览器' : '移动设备')).slice(0, 100)
-}
-
 export async function getWorkerSessionSummary(token: unknown) {
   const session = await verifyWorkerSessionToken(token)
   const worker = await getRequiredWorker(session.workerId)