fix: 完善管理后台密码修改逻辑

internal/api/auth.go

@@ -10,6 +10,7 @@ import (
 
 	"home-vue-go/internal/config"
 	"home-vue-go/internal/database"
+	"home-vue-go/internal/ent"
 	"home-vue-go/internal/ent/user"
 
 	"github.com/gin-gonic/gin"
@@ -84,11 +85,11 @@ func ChangePassword(db *database.Database) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		var req struct {
 			OldPassword string `json:"oldPassword" binding:"required"`
-			NewPassword string `json:"newPassword" binding:"required,min=8"`
+			NewPassword string `json:"newPassword" binding:"required"`
 		}
 
 		if err := c.ShouldBindJSON(&req); err != nil {
-			c.JSON(http.StatusBadRequest, gin.H{"error": "旧密码和新密码不能为空，且新密码至少8位"})
+			c.JSON(http.StatusBadRequest, gin.H{"error": "当前密码和新密码不能为空"})
 			return
 		}
 
@@ -99,19 +100,32 @@ func ChangePassword(db *database.Database) gin.HandlerFunc {
 			return
 		}
 
-		usernameStr := username.(string)
+		usernameStr, ok := username.(string)
+		if !ok || strings.TrimSpace(usernameStr) == "" {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "用户信息无效"})
+			return
+		}
 		ctx := c.Request.Context()
 
 		// 查询用户
 		user, err := db.Client.User.Query().Where(user.UsernameEQ(usernameStr)).First(ctx)
 		if err != nil {
-			c.JSON(http.StatusUnauthorized, gin.H{"error": "用户不存在"})
+			if ent.IsNotFound(err) {
+				c.JSON(http.StatusUnauthorized, gin.H{"error": "用户不存在"})
+			} else {
+				c.JSON(http.StatusInternalServerError, gin.H{"error": "查询用户失败"})
+			}
 			return
 		}
 
 		// 验证旧密码
 		if err := bcrypt.CompareHashAndPassword([]byte(user.Password), []byte(req.OldPassword)); err != nil {
-			c.JSON(http.StatusUnauthorized, gin.H{"error": "旧密码错误"})
+			c.JSON(http.StatusUnprocessableEntity, gin.H{"error": "当前密码错误"})
+			return
+		}
+
+		if err := validateNewPassword(usernameStr, req.OldPassword, req.NewPassword); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
 
@@ -123,15 +137,14 @@ func ChangePassword(db *database.Database) gin.HandlerFunc {
 		}
 
 		// 更新密码到数据库
-		updatedUser, err := db.Client.User.UpdateOneID(user.ID).SetPassword(string(hashedPassword)).Save(ctx)
-		if err != nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "密码更新失败: " + err.Error()})
+		updatedUser, err := db.Client.User.UpdateOneID(user.ID).SetPassword(string(hashedPassword)).Save(ctx)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "密码更新失败"})
 			return
 		}
 
-		// 验证密码已保存（可选，用于调试）
-		if updatedUser == nil {
-			c.JSON(http.StatusInternalServerError, gin.H{"error": "密码更新失败: 未返回更新后的用户"})
+		if err := bcrypt.CompareHashAndPassword([]byte(updatedUser.Password), []byte(req.NewPassword)); err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "密码更新校验失败"})
 			return
 		}
 
@@ -165,7 +178,7 @@ func JWTAuthMiddleware(secret string) gin.HandlerFunc {
 			location := queryIPLocation(ip)
 			// 记录为失败的登录尝试（token失效）
 			addLoginHistory("", ip, location, userAgent, false)
-			
+
 			c.JSON(http.StatusUnauthorized, gin.H{"error": "无效的token"})
 			c.Abort()
 			return
@@ -280,7 +293,7 @@ func GetLoginHistory(db *database.Database) gin.HandlerFunc {
 
 		// 从内存获取登录历史
 		histories := getLoginHistoryRecords(limitInt)
-		
+
 		result := make([]gin.H, 0, len(histories))
 		for _, h := range histories {
 			result = append(result, gin.H{