登录接口问题

huimv-employment/fe-api/src/main/java/com/huimv/employment/controller/mp/AuthController.java

@@ -57,6 +57,7 @@ public class AuthController {
     @PostMapping("/sms/login")
     @Operation(summary = "短信验证码登录",
             description = "校验验证码后登录或自动注册，返回 JWT 及用户基本信息。"
+                    + "userType 仅在首次注册时写入，老用户须从对应入口（enterprise/worker）登录。"
                     + "登录成功后建议调用 GET /api/v1/mp/getInfo 查询登记状态。")
     public R<LoginResponse> loginBySms(@Validated @RequestBody SmsLoginRequest request) {
         return R.ok(authService.loginBySms(request));
@@ -65,6 +66,7 @@ public class AuthController {
     @PostMapping("/wechat/login")
     @Operation(summary = "微信小程序 code 登录",
             description = "使用 wx.login 获取的 code 换取 openid 并登录。"
+                    + "userType 仅在首次注册时写入，老用户须从对应入口登录。"
                     + "Mock 模式（fe.wechat.miniapp.mock-enabled=true）下 code 可为任意非空字符串。"
                     + "短信用户与微信用户一期未做账号合并，openid 与手机号分别建号。")
     public R<LoginResponse> loginByWechat(@Validated @RequestBody WechatLoginRequest request) {

huimv-employment/fe-api/src/main/java/com/huimv/employment/controller/mp/ProfileController.java

@@ -69,6 +69,6 @@ public class ProfileController {
     @Operation(summary = "查询当前用户登记状态与详情")
     public R<MpUserInfoResponse> getInfo() {
         LoginUser loginUser = LoginUserHolder.require();
-        return R.ok(profileService.getInfo(loginUser.getUserId(), loginUser.getUserType()));
+        return R.ok(profileService.getInfo(loginUser.getUserId()));
     }
 }

huimv-employment/fe-api/src/main/java/com/huimv/employment/security/JwtAuthFilter.java

@@ -4,6 +4,7 @@ import com.fasterxml.jackson.databind.ObjectMapper;
 import com.huimv.employment.common.exception.BizException;
 import com.huimv.employment.common.exception.ErrorCode;
 import com.huimv.employment.common.web.R;
+import com.huimv.employment.service.auth.AuthUserValidator;
 import com.huimv.employment.service.auth.JwtTokenService;
 import org.springframework.core.Ordered;
 import org.springframework.core.annotation.Order;
@@ -22,6 +23,7 @@ import java.nio.charset.StandardCharsets;
 
 /**
  * JWT 鉴权过滤器：保护 /api/v1/mp/** 接口（auth、health 等匿名路径除外）。
+ * <p>解析 JWT 后查库校验账号状态，并以数据库 {@code user_type} 作为鉴权身份。</p>
  */
 @Component
 @Order(Ordered.HIGHEST_PRECEDENCE + 20)
@@ -40,10 +42,14 @@ public class JwtAuthFilter extends OncePerRequestFilter {
     };
 
     private final JwtTokenService jwtTokenService;
+    private final AuthUserValidator authUserValidator;
     private final ObjectMapper objectMapper;
 
-    public JwtAuthFilter(JwtTokenService jwtTokenService, ObjectMapper objectMapper) {
+    public JwtAuthFilter(JwtTokenService jwtTokenService,
+                         AuthUserValidator authUserValidator,
+                         ObjectMapper objectMapper) {
         this.jwtTokenService = jwtTokenService;
+        this.authUserValidator = authUserValidator;
         this.objectMapper = objectMapper;
     }
 
@@ -72,7 +78,8 @@ public class JwtAuthFilter extends OncePerRequestFilter {
                 return;
             }
             JwtTokenService.TokenClaims claims = jwtTokenService.parseToken(authorization.substring(7));
-            LoginUserHolder.set(new LoginUser(claims.getUserId(), claims.getUserType()));
+            AuthUserValidator.ValidatedUser user = authUserValidator.validate(claims.getUserId());
+            LoginUserHolder.set(new LoginUser(user.getUserId(), user.getUserType()));
             filterChain.doFilter(request, response);
         } catch (BizException ex) {
             writeError(response, ex.getCode(), ex.getMessage());

huimv-employment/fe-api/src/main/java/com/huimv/employment/security/LoginUser.java

@@ -1,7 +1,7 @@
 package com.huimv.employment.security;
 
 /**
- * 当前登录用户上下文，由 JWT 过滤器解析后写入。
+ * 当前登录用户上下文，由 JWT 过滤器解析 Token 后查库写入。
  */
 public class LoginUser {
 

huimv-employment/fe-api/src/main/resources/application.yml

@@ -44,6 +44,7 @@ fe:
     mock-code: "123456"
     code-ttl-seconds: 300
     send-cooldown-seconds: 60
+    max-verify-attempts: 5
     aliyun:
       access-key-id: ${ALIYUN_SMS_ACCESS_KEY_ID:}
       access-key-secret: ${ALIYUN_SMS_ACCESS_KEY_SECRET:}

huimv-employment/fe-common/src/main/java/com/huimv/employment/common/constant/RedisKeys.java

@@ -26,6 +26,9 @@ public final class RedisKeys {
     /** 短信发送冷却 Key 前缀，完整 Key：fe:sms:cd:{mobileHash} */
     public static final String SMS_SEND_COOLDOWN = "fe:sms:cd:";
 
+    /** 短信验证码校验失败计数 Key 前缀，完整 Key：fe:sms:attempts:{mobileHash} */
+    public static final String SMS_VERIFY_ATTEMPTS = "fe:sms:attempts:";
+
     /** 账密登录失败计数 Key 前缀，完整 Key：fe:login:fail:{accountKey} */
     public static final String LOGIN_FAIL = "fe:login:fail:";
 
@@ -49,6 +52,13 @@ public final class RedisKeys {
         return SMS_SEND_COOLDOWN + mobileHash;
     }
 
+    /**
+     * 组装验证码校验失败计数 Redis Key。
+     */
+    public static String smsVerifyAttemptKey(String mobileHash) {
+        return SMS_VERIFY_ATTEMPTS + mobileHash;
+    }
+
     /**
      * 组装账密登录失败计数 Redis Key。
      *

huimv-employment/fe-common/src/main/java/com/huimv/employment/common/exception/ErrorCode.java

@@ -78,6 +78,9 @@ public enum ErrorCode {
     /** 账密：登录失败次数过多已锁定 */
     LOGIN_LOCKED(40304, "登录失败次数过多，请稍后再试"),
 
+    /** 登录：请求身份与账号已绑定类型不一致 */
+    USER_TYPE_MISMATCH(40305, "账号类型不匹配，请从正确的入口登录"),
+
     /** 通用：未预期的系统异常 */
     INTERNAL_ERROR(500, "系统繁忙，请稍后再试");
 

huimv-employment/fe-integration/src/main/java/com/huimv/employment/integration/sms/SmsProperties.java

@@ -45,6 +45,9 @@ public class SmsProperties {
     /** 非 Mock 模式下随机验证码的位数，默认 6 位纯数字 */
     private int codeLength = 6;
 
+    /** 同一验证码允许的最大校验失败次数，超出后作废验证码 */
+    private int maxVerifyAttempts = 5;
+
     /** 阿里云短信配置，仅 mock-enabled=false 时生效 */
     private Aliyun aliyun = new Aliyun();
 
@@ -88,6 +91,14 @@ public class SmsProperties {
         this.codeLength = codeLength;
     }
 
+    public int getMaxVerifyAttempts() {
+        return maxVerifyAttempts;
+    }
+
+    public void setMaxVerifyAttempts(int maxVerifyAttempts) {
+        this.maxVerifyAttempts = maxVerifyAttempts;
+    }
+
     public Aliyun getAliyun() {
         return aliyun;
     }

huimv-employment/fe-service/src/main/java/com/huimv/employment/service/auth/AuthService.java

@@ -67,9 +67,7 @@ public class AuthService {
 
         FeUser user = findOrCreateByMobile(mobileEnc, mobileMask, request.getUserType());
         ensureUserActive(user);
-        if (!request.getUserType().equals(user.getUserType())) {
-            user.setUserType(request.getUserType());
-        }
+        ensureUserTypeMatch(user, request.getUserType());
         user.setMobileMask(mobileMask);
         touchLogin(user);
         feUserMapper.updateById(user);
@@ -83,9 +81,7 @@ public class AuthService {
 
         FeUser user = findOrCreateByOpenid(session, request.getUserType());
         ensureUserActive(user);
-        if (!request.getUserType().equals(user.getUserType())) {
-            user.setUserType(request.getUserType());
-        }
+        ensureUserTypeMatch(user, request.getUserType());
         user.setUnionid(session.getUnionid());
         user.setSessionKey(session.getSessionKey());
         touchLogin(user);
@@ -192,6 +188,15 @@ public class AuthService {
         }
     }
 
+    /**
+     * 用户身份类型仅在首次创建时确定，后续登录不可切换企业主/临时工。
+     */
+    private void ensureUserTypeMatch(FeUser user, String requestedUserType) {
+        if (!requestedUserType.equals(user.getUserType())) {
+            throw new BizException(ErrorCode.USER_TYPE_MISMATCH);
+        }
+    }
+
     private LoginResponse buildLoginResponse(FeUser user) {
         JwtTokenService.TokenIssueResult token = jwtTokenService.issueToken(user.getId(), user.getUserType());
         LoginResponse response = new LoginResponse();

huimv-employment/fe-service/src/main/java/com/huimv/employment/service/auth/PasswordAuthService.java

@@ -23,6 +23,8 @@ import java.util.regex.Pattern;
 public class PasswordAuthService {
 
     private static final String STATUS_DISABLED = "disabled";
+    private static final String RESET_PASSWORD_DENIED_MSG =
+            "无法重置密码，请确认手机号与验证码，或使用验证码登录后在个人中心设置";
     private static final Pattern MOBILE_PATTERN = Pattern.compile("^1[3-9]\\d{9}$");
 
     private final FeUserMapper feUserMapper;
@@ -114,13 +116,10 @@ public class PasswordAuthService {
         FeUser user = feUserMapper.selectOne(new LambdaQueryWrapper<FeUser>()
                 .eq(FeUser::getMobileEnc, mobileEnc)
                 .last("LIMIT 1"));
-        if (user == null) {
-            throw new BizException(ErrorCode.BAD_REQUEST, "该手机号尚未注册，请先使用验证码登录");
+        if (user == null || !StringUtils.hasText(user.getPasswordHash())) {
+            throw new BizException(ErrorCode.BAD_REQUEST, RESET_PASSWORD_DENIED_MSG);
         }
         ensureUserActive(user);
-        if (!StringUtils.hasText(user.getPasswordHash())) {
-            throw new BizException(ErrorCode.PASSWORD_NOT_SET, "您尚未设置登录密码，请先验证码登录后在个人中心设置");
-        }
 
         String rawPassword = decryptPassword(request.getEncryptedPassword());
         String rawConfirm = decryptPassword(request.getEncryptedConfirmPassword());

huimv-employment/fe-service/src/main/java/com/huimv/employment/service/auth/ProfileService.java

@@ -32,12 +32,13 @@ public class ProfileService {
         this.workerService = workerService;
     }
 
-    public MpUserInfoResponse getInfo(Long userId, String userType) {
+    public MpUserInfoResponse getInfo(Long userId) {
         FeUser user = feUserMapper.selectById(userId);
         if (user == null) {
             throw new BizException(ErrorCode.UNAUTHORIZED);
         }
 
+        String userType = user.getUserType();
         MpUserInfoResponse response = new MpUserInfoResponse();
         response.setUserType(userType);
         response.setMobileMask(user.getMobileMask());

huimv-employment/fe-service/src/main/java/com/huimv/employment/service/sms/SmsCodeService.java

@@ -89,12 +89,35 @@ public class SmsCodeService {
 
         String mobileHash = MobileUtils.hash(mobile);
         String codeKey = RedisKeys.smsCodeKey(mobileHash);
+        String attemptKey = RedisKeys.smsVerifyAttemptKey(mobileHash);
+
+        int maxAttempts = Math.max(1, smsProperties.getMaxVerifyAttempts());
+        String attemptValue = redisTemplate.opsForValue().get(attemptKey);
+        int failedAttempts = 0;
+        if (StringUtils.hasText(attemptValue)) {
+            try {
+                failedAttempts = Integer.parseInt(attemptValue);
+            } catch (NumberFormatException ignored) {
+                failedAttempts = 0;
+            }
+        }
+        if (failedAttempts >= maxAttempts) {
+            redisTemplate.delete(codeKey);
+            redisTemplate.delete(attemptKey);
+            throw new BizException(ErrorCode.SMS_CODE_INVALID);
+        }
+
         String cachedCode = redisTemplate.opsForValue().get(codeKey);
         if (!StringUtils.hasText(cachedCode) || !cachedCode.equals(code.trim())) {
+            redisTemplate.opsForValue().set(
+                    attemptKey,
+                    String.valueOf(failedAttempts + 1),
+                    smsProperties.getCodeTtlSeconds(),
+                    TimeUnit.SECONDS);
             throw new BizException(ErrorCode.SMS_CODE_INVALID);
         }
-        // 一次性验证码：校验通过后删除
         redisTemplate.delete(codeKey);
+        redisTemplate.delete(attemptKey);
     }
 
     /**