feat: 班级小助手 阶段1-3（monorepo + 后端 REST/Socket.IO + Web 管理端）

packages/server/src/modules/auth/auth.module.ts

@@ -0,0 +1,48 @@
+import { Router } from 'express';
+import type { LoginResponse } from '@classhelper/shared';
+import { sendOk } from '../../lib/http.js';
+import { authenticate, getAuthUser } from '../../middleware/auth.js';
+import { validate } from '../../middleware/validate.js';
+import { defineModule } from '../module.types.js';
+import {
+  changePasswordSchema,
+  loginSchema,
+  type ChangePasswordInput,
+  type LoginInput,
+} from './auth.schemas.js';
+import * as authService from './auth.service.js';
+
+const router = Router();
+
+/** POST /api/auth/login - 登录（公开） */
+router.post('/login', validate({ body: loginSchema }), async (req, res) => {
+  const result: LoginResponse = await authService.login(req.body as LoginInput);
+  sendOk(res, result, '登录成功');
+});
+
+/** GET /api/auth/me - 当前用户信息 */
+router.get('/me', authenticate(), async (req, res) => {
+  const user = getAuthUser(req);
+  sendOk(res, await authService.getProfile(user.sub), '获取当前用户成功');
+});
+
+/** PATCH /api/auth/password - 修改密码 */
+router.patch('/password', authenticate(), validate({ body: changePasswordSchema }), async (req, res) => {
+  const user = getAuthUser(req);
+  await authService.changePassword(user.sub, req.body as ChangePasswordInput);
+  sendOk(res, { changed: true }, '密码修改成功，请重新登录');
+});
+
+/**
+ * POST /api/auth/logout - 退出登录。
+ * JWT 为无状态凭证，服务端不做黑名单，客户端丢弃 token 即可。
+ */
+router.post('/logout', authenticate(), (_req, res) => {
+  sendOk(res, { loggedOut: true }, '已退出登录');
+});
+
+export const authModule = defineModule({
+  name: 'auth',
+  basePath: '/auth',
+  router,
+});

packages/server/src/modules/auth/auth.schemas.ts

@@ -0,0 +1,14 @@
+import { z } from 'zod';
+
+export const loginSchema = z.object({
+  username: z.string().trim().min(1, '请输入用户名').max(64),
+  password: z.string().min(1, '请输入密码').max(128),
+});
+
+export const changePasswordSchema = z.object({
+  currentPassword: z.string().min(1, '请输入当前密码'),
+  newPassword: z.string().min(6, '新密码至少 6 位').max(128),
+});
+
+export type LoginInput = z.infer<typeof loginSchema>;
+export type ChangePasswordInput = z.infer<typeof changePasswordSchema>;

packages/server/src/modules/auth/auth.service.ts

@@ -0,0 +1,50 @@
+import type { LoginResponse, StudentDto, UserRole } from '@classhelper/shared';
+import { prisma } from '../../lib/db.js';
+import { ApiError } from '../../lib/http.js';
+import { signToken } from '../../lib/jwt.js';
+import { toStudentDto, toUserDto } from '../../lib/mappers.js';
+import { hashPassword, verifyPassword } from '../../lib/password.js';
+import type { ChangePasswordInput, LoginInput } from './auth.schemas.js';
+
+/** 登录：校验用户名密码并签发 JWT */
+export async function login(input: LoginInput): Promise<LoginResponse> {
+  const user = await prisma.user.findUnique({ where: { username: input.username } });
+  if (!user) throw ApiError.unauthorized('用户名或密码错误');
+
+  const passwordMatched = await verifyPassword(input.password, user.passwordHash);
+  if (!passwordMatched) throw ApiError.unauthorized('用户名或密码错误');
+
+  const token = signToken({
+    sub: user.id,
+    username: user.username,
+    name: user.name,
+    role: user.role as UserRole,
+    classId: user.classId,
+  });
+
+  return { token, user: toUserDto(user) };
+}
+
+/** 当前用户信息（学生额外带班级名与年级） */
+export async function getProfile(userId: string): Promise<StudentDto> {
+  const user = await prisma.user.findUnique({
+    where: { id: userId },
+    include: { class: { select: { name: true, grade: true } } },
+  });
+  if (!user) throw ApiError.unauthorized('账号不存在或已被删除');
+  return toStudentDto(user);
+}
+
+/** 修改自己的密码 */
+export async function changePassword(userId: string, input: ChangePasswordInput): Promise<void> {
+  const user = await prisma.user.findUnique({ where: { id: userId } });
+  if (!user) throw ApiError.unauthorized('账号不存在或已被删除');
+
+  const matched = await verifyPassword(input.currentPassword, user.passwordHash);
+  if (!matched) throw ApiError.badRequest('当前密码不正确');
+
+  await prisma.user.update({
+    where: { id: userId },
+    data: { passwordHash: await hashPassword(input.newPassword) },
+  });
+}