feat: 安全增强 + 删除密码重置申请功能 + 登录提醒开关

安全增强:
- 新增 SSRF、XXE、模板注入、敏感路径探测检测规则
- security/constants.py: 添加新的威胁类型和检测模式
- security/threat_detector.py: 实现新检测逻辑

删除密码重置申请功能:
- 移除 /api/password_resets 相关API
- 删除 password_reset_requests 数据库表
- 前端移除密码重置申请页面和菜单
- 用户只能通过邮��找回密码，未绑定邮箱需联系管理员

登录提醒全局开关:
- email_service.py: 添加 login_alert_enabled 字段
- routes/api_auth.py: 检查开关状态再发送登录提醒
- EmailPage.vue: 添加新设备登录提醒开关

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

admin-frontend/src/api/passwordResets.js

@@ -1,17 +0,0 @@
-import { api } from './client'
-
-export async function fetchPasswordResets() {
-  const { data } = await api.get('/password_resets')
-  return data
-}
-
-export async function approvePasswordReset(requestId) {
-  const { data } = await api.post(`/password_resets/${requestId}/approve`)
-  return data
-}
-
-export async function rejectPasswordReset(requestId) {
-  const { data } = await api.post(`/password_resets/${requestId}/reject`)
-  return data
-}
-

admin-frontend/src/layouts/AdminLayout.vue

@@ -16,7 +16,6 @@ import {
 
 import { api } from '../api/client'
 import { fetchFeedbackStats } from '../api/feedbacks'
-import { fetchPasswordResets } from '../api/passwordResets'
 import { fetchSystemStats } from '../api/stats'
 
 const route = useRoute()
@@ -34,15 +33,11 @@ async function refreshStats() {
 }
 
 const loadingBadges = ref(false)
-const pendingResetsCount = ref(0)
 const pendingFeedbackCount = ref(0)
 let badgeTimer
 
 async function refreshNavBadges(partial = null) {
   if (partial && typeof partial === 'object') {
-    if (Object.prototype.hasOwnProperty.call(partial, 'pendingResets')) {
-      pendingResetsCount.value = Number(partial.pendingResets || 0)
-    }
     if (Object.prototype.hasOwnProperty.call(partial, 'pendingFeedbacks')) {
       pendingFeedbackCount.value = Number(partial.pendingFeedbacks || 0)
     }
@@ -53,18 +48,8 @@ async function refreshNavBadges(partial = null) {
   loadingBadges.value = true
 
   try {
-    const [resetsResult, feedbackResult] = await Promise.allSettled([
-      fetchPasswordResets(),
-      fetchFeedbackStats(),
-    ])
-
-    if (resetsResult.status === 'fulfilled') {
-      pendingResetsCount.value = Array.isArray(resetsResult.value) ? resetsResult.value.length : 0
-    }
-
-    if (feedbackResult.status === 'fulfilled') {
-      pendingFeedbackCount.value = Number(feedbackResult.value?.pending || 0)
-    }
+    const feedbackResult = await fetchFeedbackStats()
+    pendingFeedbackCount.value = Number(feedbackResult?.pending || 0)
   } finally {
     loadingBadges.value = false
   }
@@ -100,7 +85,7 @@ onBeforeUnmount(() => {
 
 const menuItems = [
   { path: '/reports', label: '报表', icon: Document },
-  { path: '/users', label: '用户', icon: User, badgeKey: 'resets' },
+  { path: '/users', label: '用户', icon: User },
   { path: '/feedbacks', label: '反馈', icon: ChatLineSquare, badgeKey: 'feedbacks' },
   { path: '/logs', label: '任务日志', icon: List },
   { path: '/announcements', label: '公告', icon: Bell },
@@ -114,7 +99,6 @@ const activeMenu = computed(() => route.path)
 
 function badgeFor(item) {
   if (!item?.badgeKey) return 0
-  if (item.badgeKey === 'resets') return Number(pendingResetsCount.value || 0)
   if (item.badgeKey === 'feedbacks') {
     return Number(pendingFeedbackCount.value || 0)
   }

admin-frontend/src/pages/EmailPage.vue

@@ -21,6 +21,7 @@ const settings = reactive({
   enabled: false,
   failover_enabled: true,
   register_verify_enabled: false,
+  login_alert_enabled: true,
   task_notify_enabled: false,
   base_url: '',
   updated_at: null,
@@ -35,6 +36,7 @@ async function loadEmailSettings() {
     settings.enabled = Boolean(data.enabled)
     settings.failover_enabled = Boolean(data.failover_enabled)
     settings.register_verify_enabled = Boolean(data.register_verify_enabled)
+    settings.login_alert_enabled = data.login_alert_enabled === undefined ? true : Boolean(data.login_alert_enabled)
     settings.task_notify_enabled = Boolean(data.task_notify_enabled)
     settings.base_url = data.base_url || ''
     settings.updated_at = data.updated_at || null
@@ -53,6 +55,7 @@ async function saveEmailSettings() {
       enabled: settings.enabled,
       failover_enabled: settings.failover_enabled,
       register_verify_enabled: settings.register_verify_enabled,
+      login_alert_enabled: settings.login_alert_enabled,
       task_notify_enabled: settings.task_notify_enabled,
       base_url: (settings.base_url || '').trim(),
     })
@@ -597,6 +600,8 @@ onMounted(refreshAll)
             @change="scheduleSaveEmailSettings"
           />
         </el-form-item>
+
+        <el-divider content-position="left">通知设置</el-divider>
         <el-form-item label="启用任务完成通知">
           <el-switch
             v-model="settings.task_notify_enabled"
@@ -604,6 +609,14 @@ onMounted(refreshAll)
             @change="scheduleSaveEmailSettings"
           />
         </el-form-item>
+        <el-form-item label="新设备登录提醒">
+          <el-switch
+            v-model="settings.login_alert_enabled"
+            :disabled="emailSettingsSaving"
+            @change="scheduleSaveEmailSettings"
+          />
+          <div class="help">当检测到新设备或新IP登录时，发送邮件提醒用户</div>
+        </el-form-item>
         <el-form-item label="网站基础URL">
           <el-input
             v-model="settings.base_url"

admin-frontend/src/pages/ReportPage.vue

@@ -6,7 +6,6 @@ import {
   Clock,
   Cpu,
   Key,
-  Lock,
   Loading,
   Message,
   Star,
@@ -18,14 +17,12 @@ import {
 
 import { fetchFeedbackStats } from '../api/feedbacks'
 import { fetchEmailStats } from '../api/email'
-import { fetchPasswordResets } from '../api/passwordResets'
 import { fetchDockerStats, fetchRunningTasks, fetchServerInfo, fetchTaskStats } from '../api/tasks'
 import { fetchSystemConfig } from '../api/system'
 import { fetchUpdateResult, fetchUpdateStatus } from '../api/update'
 
 const refreshStats = inject('refreshStats', null)
 const adminStats = inject('adminStats', null)
-const refreshNavBadges = inject('refreshNavBadges', null)
 
 const loading = ref(false)
 const lastUpdatedAt = ref('')
@@ -40,7 +37,6 @@ const systemConfig = ref(null)
 const updateStatus = ref(null)
 const updateStatusError = ref('')
 const updateResult = ref(null)
-const passwordResetsCount = ref(0)
 const queueTab = ref('running')
 
 function recordUpdatedAt() {
@@ -101,7 +97,6 @@ const overviewCards = computed(() => {
       sub: liveMax ? `并发上限 ${liveMax}` : '',
     },
     { label: '排队任务', value: normalizeCount(runningTasks.value?.queuing_count), icon: Clock, tone: 'purple' },
-    { label: '密码重置待处理', value: normalizeCount(passwordResetsCount.value), icon: Lock, tone: 'red' },
   ]
 })
 
@@ -172,7 +167,6 @@ async function refreshAll() {
       runningResult,
       emailResult,
       feedbackResult,
-      resetsResult,
       serverResult,
       dockerResult,
       configResult,
@@ -183,7 +177,6 @@ async function refreshAll() {
       fetchRunningTasks(),
       fetchEmailStats(),
       fetchFeedbackStats(),
-      fetchPasswordResets(),
       fetchServerInfo(),
       fetchDockerStats(),
       fetchSystemConfig(),
@@ -195,7 +188,6 @@ async function refreshAll() {
     runningTasks.value = runningResult.status === 'fulfilled' ? runningResult.value : null
     emailStats.value = emailResult.status === 'fulfilled' ? emailResult.value : null
     feedbackStats.value = feedbackResult.status === 'fulfilled' ? feedbackResult.value : null
-    passwordResetsCount.value = resetsResult.status === 'fulfilled' ? (Array.isArray(resetsResult.value) ? resetsResult.value.length : 0) : 0
     serverInfo.value = serverResult.status === 'fulfilled' ? serverResult.value : null
     dockerStats.value = dockerResult.status === 'fulfilled' ? dockerResult.value : null
     systemConfig.value = configResult.status === 'fulfilled' ? configResult.value : null
@@ -216,7 +208,6 @@ async function refreshAll() {
 
     updateResult.value = updateResultResult.status === 'fulfilled' && updateResultResult.value?.ok ? updateResultResult.value.data : null
 
-    await refreshNavBadges?.({ pendingResets: passwordResetsCount.value })
     await refreshStats?.()
     recordUpdatedAt()
   } finally {

admin-frontend/src/pages/UsersPage.vue

@@ -11,19 +11,14 @@ import {
   removeUserVip,
   setUserVip,
 } from '../api/users'
-import { approvePasswordReset, fetchPasswordResets, rejectPasswordReset } from '../api/passwordResets'
 import { parseSqliteDateTime } from '../utils/datetime'
 import { validatePasswordStrength } from '../utils/password'
 
 const refreshStats = inject('refreshStats', null)
-const refreshNavBadges = inject('refreshNavBadges', null)
 
 const loading = ref(false)
 const users = ref([])
 
-const resetLoading = ref(false)
-const passwordResets = ref([])
-
 function isVip(user) {
   const expire = user?.vip_expire_time
   if (!expire) return false
@@ -58,21 +53,8 @@ async function loadUsers() {
   }
 }
 
-async function loadResets() {
-  resetLoading.value = true
-  try {
-    const list = await fetchPasswordResets()
-    passwordResets.value = Array.isArray(list) ? list : []
-  } catch {
-    passwordResets.value = []
-  } finally {
-    resetLoading.value = false
-  }
-}
-
 async function refreshAll() {
-  await Promise.all([loadUsers(), loadResets()])
-  await refreshNavBadges?.({ pendingResets: passwordResets.value.length })
+  await loadUsers()
 }
 
 async function onEnableUser(row) {
@@ -117,48 +99,6 @@ async function onDisableUser(row) {
   }
 }
 
-async function onApproveReset(row) {
-  try {
-    await ElMessageBox.confirm(`确定批准「${row.username}」的密码重置申请吗？`, '批准重置', {
-      confirmButtonText: '批准',
-      cancelButtonText: '取消',
-      type: 'success',
-    })
-  } catch {
-    return
-  }
-
-  try {
-    const res = await approvePasswordReset(row.id)
-    ElMessage.success(res?.message || '密码重置申请已批准')
-    await loadResets()
-    await refreshNavBadges?.({ pendingResets: passwordResets.value.length })
-  } catch {
-    // handled by interceptor
-  }
-}
-
-async function onRejectReset(row) {
-  try {
-    await ElMessageBox.confirm(`确定拒绝「${row.username}」的密码重置申请吗？`, '拒绝重置', {
-      confirmButtonText: '拒绝',
-      cancelButtonText: '取消',
-      type: 'warning',
-    })
-  } catch {
-    return
-  }
-
-  try {
-    const res = await rejectPasswordReset(row.id)
-    ElMessage.success(res?.message || '密码重置申请已拒绝')
-    await loadResets()
-    await refreshNavBadges?.({ pendingResets: passwordResets.value.length })
-  } catch {
-    // handled by interceptor
-  }
-}
-
 async function onDelete(row) {
   try {
     await ElMessageBox.confirm(
@@ -338,27 +278,6 @@ onMounted(refreshAll)
         </el-table>
       </div>
     </el-card>
-
-    <el-card shadow="never" :body-style="{ padding: '16px' }" class="card">
-      <h3 class="section-title">密码重置申请</h3>
-      <div class="table-wrap">
-        <el-table :data="passwordResets" v-loading="resetLoading" style="width: 100%">
-          <el-table-column prop="id" label="申请ID" width="90" />
-          <el-table-column prop="username" label="用户名" min-width="200" />
-          <el-table-column prop="email" label="邮箱" min-width="220">
-            <template #default="{ row }">{{ row.email || '-' }}</template>
-          </el-table-column>
-          <el-table-column prop="created_at" label="申请时间" min-width="180" />
-          <el-table-column label="操作" width="180" fixed="right">
-            <template #default="{ row }">
-              <el-button type="success" size="small" @click="onApproveReset(row)">批准</el-button>
-              <el-button type="danger" size="small" @click="onRejectReset(row)">拒绝</el-button>
-            </template>
-          </el-table-column>
-        </el-table>
-      </div>
-      <div class="help app-muted">当未启用邮件找回密码时，用户会提交申请，由管理员在此处处理。</div>
-    </el-card>
   </div>
 </template>