增强关键接口幂等与限流保护

apps/backend/src/routes/admin/auth.ts

@@ -1,11 +1,17 @@
 import { Router } from 'express'
 
+import { createRateLimitMiddleware, getBodyFieldRateLimitKey } from '../../middleware/rate-limit.js'
 import { getAdminSessionSummary, loginAdmin } from '../../services/admin/admin-auth-service.js'
 import { createJsonHandler, extractBearerToken } from './shared.js'
 
 const router = Router()
 
-router.post('/auth/login', createJsonHandler(
+router.post('/auth/login', createRateLimitMiddleware({
+  scope: 'admin:login',
+  windowMs: 60_000,
+  max: 10,
+  key: getBodyFieldRateLimitKey('username'),
+}), createJsonHandler(
   (req) => loginAdmin(req.body?.username, req.body?.password),
   {
     successMessage: '登录成功',