增加打手密码强度校验

apps/backend/src/services/worker-platform/mappers.ts

@@ -973,14 +973,24 @@ export function validateWorkerUsername(username: string) {
 }
 
 export function validateWorkerPassword(password: string) {
-  if (password.length < 6) {
-    throw createHttpError('接单密码至少 6 位', {
+  if (!isWorkerPasswordStrong(password)) {
+    throw createHttpError('接单密码至少 6 位，且必须包含大写字母、小写字母、数字和标点符号', {
       statusCode: 400,
       errorCode: 'worker_password_invalid',
     })
   }
 }
 
+export function isWorkerPasswordStrong(password: string): boolean {
+  return (
+    password.length >= 6 &&
+    /[A-Z]/.test(password) &&
+    /[a-z]/.test(password) &&
+    /\d/.test(password) &&
+    /[\p{P}\p{S}]/u.test(password)
+  )
+}
+
 export function normalizeSessionVersion(value: unknown): number {
   const parsed = Number(value)
   return Number.isInteger(parsed) && parsed > 0 ? parsed : 1

apps/backend/src/services/worker-platform/worker-platform-service.test.ts

@@ -5,11 +5,13 @@ import type { WorkOrderRow, WorkerUserRow } from '../../repositories/worker-plat
 import {
   assertWithdrawChannelAllowedForAmount,
   assertWorkerLoginAllowed,
+  isWorkerPasswordStrong,
   normalizeWithdrawChannel,
   normalizeRequirementFields,
   resolveCollectSubmitTargetWorkOrder,
   resolveWorkerPermissions,
   resolveSkuNameQuantity,
+  validateWorkerPassword,
 } from './index.js'
 
 function buildWorkerUserRow(overrides: Partial<WorkerUserRow> = {}): WorkerUserRow {
@@ -36,6 +38,16 @@ test('assertWorkerLoginAllowed allows active workers', () => {
   assert.doesNotThrow(() => assertWorkerLoginAllowed(buildWorkerUserRow()))
 })
 
+test('接单密码必须包含大小写字母、数字和标点符号', () => {
+  assert.equal(isWorkerPasswordStrong('Aa1234!'), true)
+  assert.equal(isWorkerPasswordStrong('aa1234!'), false)
+  assert.equal(isWorkerPasswordStrong('AA1234!'), false)
+  assert.equal(isWorkerPasswordStrong('Aaabcd!'), false)
+  assert.equal(isWorkerPasswordStrong('Aa123456'), false)
+  assert.equal(isWorkerPasswordStrong('Aa1!'), false)
+  assert.throws(() => validateWorkerPassword('Aa123456'), { errorCode: 'worker_password_invalid' })
+})
+
 test('assertWorkerLoginAllowed blocks rejected (frozen) workers with worker_rejected', () => {
   assert.throws(
     () => assertWorkerLoginAllowed(buildWorkerUserRow({ status: 'rejected' })),

apps/backend/src/services/worker-platform/worker-service.ts

@@ -126,6 +126,7 @@ import {
   signWorkerPayload,
   throwGrabWorkOrderFailure,
   validateWorkerPassword,
+  isWorkerPasswordStrong,
   verifyWorkerPassword,
 } from './mappers.js'
 
@@ -386,7 +387,10 @@ export async function loginWorker(username: unknown, password: unknown) {
 
   assertWorkerLoginAllowed(worker)
 
-  return createWorkerSession(worker)
+  return {
+    ...createWorkerSession(worker),
+    passwordWeak: !isWorkerPasswordStrong(normalizedPassword),
+  }
 }
 
 export function assertWorkerLoginAllowed(worker: WorkerUserRow) {