feat: 强化打包配置与服务安全

backend/routers/users.py

@@ -1,12 +1,12 @@
 """用户管理 API（仅管理员）"""
 import uuid
-import hashlib
 from fastapi import APIRouter, Depends, HTTPException
 from sqlalchemy.orm import Session
 
 from ..database import get_db
 from ..models import User
 from ..deps import get_current_user
+from ..security import hash_password
 
 router = APIRouter(prefix="/api/users", tags=["users"], dependencies=[Depends(get_current_user)])
 
@@ -16,10 +16,6 @@ def _require_admin(user: dict):
         raise HTTPException(status_code=403, detail="需要管理员权限")
 
 
-def _hash_password(password: str) -> str:
-    return hashlib.sha256(password.encode()).hexdigest()
-
-
 @router.get("")
 async def list_users(user: dict = Depends(get_current_user), db: Session = Depends(get_db)):
     """获取用户列表"""
@@ -39,15 +35,15 @@ async def create_user(data: dict, user: dict = Depends(get_current_user), db: Se
 
     if not username or not password:
         raise HTTPException(status_code=400, detail="用户名和密码不能为空")
-    if len(password) < 6:
-        raise HTTPException(status_code=400, detail="密码至少 6 位")
+    if len(password) < 12:
+        raise HTTPException(status_code=400, detail="密码至少 12 位")
     if db.query(User).filter(User.username == username).first():
         raise HTTPException(status_code=400, detail="用户名已存在")
 
     new_user = User(
         id=str(uuid.uuid4()),
         username=username,
-        password_hash=_hash_password(password),
+        password_hash=hash_password(password),
         is_admin=is_admin,
     )
     db.add(new_user)
@@ -65,10 +61,10 @@ async def change_password(user_id: str, data: dict, user: dict = Depends(get_cur
         raise HTTPException(status_code=404, detail="用户不存在")
 
     new_password = data.get("password", "").strip()
-    if not new_password or len(new_password) < 6:
-        raise HTTPException(status_code=400, detail="密码至少 6 位")
+    if not new_password or len(new_password) < 12:
+        raise HTTPException(status_code=400, detail="密码至少 12 位")
 
-    target.password_hash = _hash_password(new_password)
+    target.password_hash = hash_password(new_password)
     db.commit()
     return {"message": "密码已更新"}