feat: idCardHash匹配、Roster分页过滤、社保基数调整修复、Modal size支持、Termination版本对比、UI优化

backend/src/routes/auth.routes.ts

@@ -1,10 +1,14 @@
 import { Router } from 'express'
-import { registerSchema, loginSchema, refreshSchema, resetPasswordSchema } from '../schemas/auth.schema'
+import { registerSchema, loginSchema, refreshSchema, resetPasswordSchema, forgotPasswordSchema, verifyCodeSchema } from '../schemas/auth.schema'
 import { register, login, refresh, resetPassword } from '../services/auth.service'
 import { authLimiter, loginLimiter } from '../middleware/rateLimit'
+import prisma from '../lib/prisma'
+import bcrypt from 'bcryptjs'
 
 const router = Router()
 
+const codeStore = new Map<string, { code: string; expiresAt: number }>()
+
 router.post('/register', authLimiter, async (req, res, next) => {
   try {
     const data = registerSchema.parse(req.body)
@@ -35,6 +39,45 @@ router.post('/refresh', async (req, res, next) => {
   }
 })
 
+// 发送重置验证码
+router.post('/forgot-password/send-code', authLimiter, async (req, res, next) => {
+  try {
+    const data = forgotPasswordSchema.parse(req.body)
+    const user = await prisma.user.findUnique({ where: { phone: data.phone } })
+    if (!user) {
+      return res.status(400).json({ success: false, error: { code: 'NOT_FOUND', message: '该手机号未注册' } })
+    }
+    const code = Math.random().toString().slice(2, 8)
+    codeStore.set(data.phone, { code, expiresAt: Date.now() + 5 * 60 * 1000 })
+    res.json({ success: true, data: { code, message: '验证码已生成（开发阶段直接返回，生产环境将发送短信）' } })
+  } catch (err) {
+    next(err)
+  }
+})
+
+// 验证码重置密码
+router.post('/forgot-password/verify', authLimiter, async (req, res, next) => {
+  try {
+    const data = verifyCodeSchema.parse(req.body)
+    const stored = codeStore.get(data.phone)
+    if (!stored || stored.expiresAt < Date.now()) {
+      return res.status(400).json({ success: false, error: { code: 'CODE_EXPIRED', message: '验证码已过期，请重新获取' } })
+    }
+    if (stored.code !== data.code) {
+      return res.status(400).json({ success: false, error: { code: 'CODE_WRONG', message: '验证码错误' } })
+    }
+    codeStore.delete(data.phone)
+    const passwordHash = await bcrypt.hash(data.newPassword, 10)
+    await prisma.user.updateMany({
+      where: { phone: data.phone },
+      data: { passwordHash },
+    })
+    res.json({ success: true, data: { message: '密码重置成功' } })
+  } catch (err) {
+    next(err)
+  }
+})
+
 router.post('/reset-password', authLimiter, async (req, res, next) => {
   try {
     const data = resetPasswordSchema.parse(req.body)