Round6: 前台图片缩略图+下载/视频修复; 后台连接测试单次+自动消失; 导航重组; 存储中文化; 自动化去掉创建按钮; 短信验证码(注册/重置/充值通知)

backend/python/app/api/auth.py

@@ -4,15 +4,18 @@ from sqlalchemy import and_
 from pydantic import BaseModel, Field
 from typing import Optional
 import uuid
-from datetime import datetime
+import random
+import re
+from datetime import datetime, timedelta
 
 from ..database import get_db
 from ..models import (
-    User, LoginLog, RegisterSetting,
+    User, LoginLog, RegisterSetting, SmsConfig, SmsVerificationCode,
     gen_uuid
 )
 from ..auth import get_current_user, hash_password, verify_password, create_access_token
 from ..middleware.log_service import LogService
+from ..sms_client import send_sms_code
 
 router = APIRouter()
 
@@ -27,6 +30,18 @@ class RegisterRequest(BaseModel):
     password: str = Field(min_length=6, max_length=100)
     email: Optional[str] = None
     phone: Optional[str] = None
+    sms_code: Optional[str] = None
+
+
+class SendCodeRequest(BaseModel):
+    phone: str
+    purpose: str = "register"  # register / reset_password
+
+
+class ResetPasswordRequest(BaseModel):
+    phone: str
+    code: str
+    new_password: str = Field(min_length=6, max_length=100)
 
 
 @router.post("/login")
@@ -117,6 +132,20 @@ def register(req: RegisterRequest, db: Session = Depends(get_db)):
         if existing_phone:
             raise HTTPException(status_code=400, detail="手机号已被注册")
 
+    # 短信验证码校验（手机号注册且开启短信验证）
+    if req.phone and reg_setting and reg_setting.phone_sms_required:
+        if not req.sms_code:
+            raise HTTPException(status_code=400, detail="请先获取并填写短信验证码")
+        vrec = db.query(SmsVerificationCode).filter(
+            SmsVerificationCode.phone == req.phone,
+            SmsVerificationCode.purpose == "register",
+            SmsVerificationCode.used == False,
+            SmsVerificationCode.expires_at > datetime.now(),
+        ).order_by(SmsVerificationCode.created_at.desc()).first()
+        if not vrec or vrec.code != req.sms_code:
+            raise HTTPException(status_code=400, detail="短信验证码错误或已过期")
+        vrec.used = True
+
     user = User(
         id=gen_uuid(),
         username=req.username,
@@ -179,6 +208,88 @@ def register(req: RegisterRequest, db: Session = Depends(get_db)):
     }
 
 
+@router.post("/send-code")
+def send_code(req: SendCodeRequest, db: Session = Depends(get_db)):
+    """发送短信验证码（注册 / 重置密码）。公开接口。"""
+    if not re.match(r'^1[3-9]\d{9}$', req.phone or ''):
+        raise HTTPException(status_code=400, detail="手机号格式不正确")
+    purpose = req.purpose or "register"
+    if purpose not in ("register", "reset_password"):
+        raise HTTPException(status_code=400, detail="不支持的验证码类型")
+
+    config = db.query(SmsConfig).first()
+    if not config or not config.provider:
+        raise HTTPException(status_code=400, detail="短信服务未配置，请联系管理员")
+
+    # 注册场景：手机号已注册则直接提示，避免浪费短信
+    if purpose == "register":
+        existing = db.query(User).filter(User.phone == req.phone).first()
+        if existing:
+            raise HTTPException(status_code=400, detail="该手机号已注册，请直接登录")
+
+    # 频率限制：同一手机号+用途 60 秒内不重复下发
+    recent = db.query(SmsVerificationCode).filter(
+        SmsVerificationCode.phone == req.phone,
+        SmsVerificationCode.purpose == purpose,
+        SmsVerificationCode.used == False,
+        SmsVerificationCode.expires_at > datetime.now(),
+    ).order_by(SmsVerificationCode.created_at.desc()).first()
+    if recent:
+        age = (datetime.now() - recent.created_at).total_seconds()
+        if age < 60:
+            raise HTTPException(status_code=429, detail=f"验证码发送过于频繁，请{int(60 - age)}秒后再试")
+
+    code = f"{random.randint(100000, 999999)}"
+    rec = SmsVerificationCode(
+        id=gen_uuid(),
+        phone=req.phone,
+        code=code,
+        purpose=purpose,
+        expires_at=datetime.now() + timedelta(minutes=5),
+        used=False,
+    )
+    db.add(rec)
+    db.commit()
+
+    ok, msg, _ = send_sms_code(config, req.phone, code, purpose)
+    if not ok:
+        raise HTTPException(status_code=400, detail=f"短信发送失败：{msg}")
+
+    return {"code": 0, "data": {"sent": True}, "message": "验证码已发送"}
+
+
+@router.post("/reset-password")
+def reset_password(req: ResetPasswordRequest, db: Session = Depends(get_db)):
+    """通过短信验证码重置密码（公开接口）。"""
+    user = db.query(User).filter(User.phone == req.phone).first()
+    if not user:
+        raise HTTPException(status_code=400, detail="该手机号未注册")
+
+    vrec = db.query(SmsVerificationCode).filter(
+        SmsVerificationCode.phone == req.phone,
+        SmsVerificationCode.purpose == "reset_password",
+        SmsVerificationCode.used == False,
+        SmsVerificationCode.expires_at > datetime.now(),
+    ).order_by(SmsVerificationCode.created_at.desc()).first()
+    if not vrec or vrec.code != req.code:
+        raise HTTPException(status_code=400, detail="验证码错误或已过期")
+
+    user.password_hash = hash_password(req.new_password)
+    user.updated_at = datetime.now()
+    vrec.used = True
+
+    LogService.log_operation(
+        user_id=user.id,
+        username=user.username,
+        action="reset_password",
+        target="user",
+        detail=f"用户 {user.username} 通过短信验证码重置了密码",
+    )
+    db.commit()
+
+    return {"code": 0, "message": "密码重置成功"}
+
+
 @router.get("/me")
 def get_me(current_user: User = Depends(get_current_user)):
     return {