From e1348f57f26aafb530544c8f23a87fb1097c7b27 Mon Sep 17 00:00:00 2001
From: bujinyuan <bujinyuan@qianxin.com>
Date: Mon, 2 Mar 2026 14:05:03 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E7=BB=9F=E4=B8=80=E5=89=8D=E5=90=8E?=
 =?UTF-8?q?=E7=AB=AF=E9=94=99=E8=AF=AF=E6=8F=90=E7=A4=BA=E5=A4=84=E7=90=86?=
 =?UTF-8?q?=EF=BC=8C=E4=BF=AE=E5=A4=8D3=E4=B8=AA=E9=97=AE=E9=A2=98?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. 管理端 request.js: 所有401均优先显示后端实际message，
   非登录页才清除Token并跳转
2. 前台用户端 request.js: 区分登录/注册请求与已认证请求，
   登录失败时只显示后端message，不清Token不跳转
3. 后端 auth_service: 登录时用户不存在统一返回"账号或密码错误"
   （防止用户枚举攻击，不再返回404"用户不存在"）

Made-with: Cursor
---
 admin/src/utils/request.js                    |  6 ++---
 .../app/auth/service/auth_service.go          |  4 ++--
 frontend/src/utils/request.js                 | 22 +++++++++----------
 3 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/admin/src/utils/request.js b/admin/src/utils/request.js
index 3ded21b..0db322f 100644
--- a/admin/src/utils/request.js
+++ b/admin/src/utils/request.js
@@ -52,10 +52,8 @@ service.interceptors.response.use(
       const { status, data } = error.response
       if (status === 401) {
         const isOnLoginPage = router.currentRoute.value.path === '/login'
-        if (isOnLoginPage) {
-          ElMessage.error(data?.message || '账号或密码错误')
-        } else {
-          ElMessage.error('登录已过期，请重新登录')
+        ElMessage.error(data?.message || '登录已过期，请重新登录')
+        if (!isOnLoginPage) {
           localStorage.removeItem('admin_token')
           localStorage.removeItem('admin_user')
           router.push('/login')
diff --git a/backend/go-service/app/auth/service/auth_service.go b/backend/go-service/app/auth/service/auth_service.go
index c199b04..3451bb8 100644
--- a/backend/go-service/app/auth/service/auth_service.go
+++ b/backend/go-service/app/auth/service/auth_service.go
@@ -139,11 +139,11 @@ func (s *AuthService) Login(ctx context.Context, req *dto.LoginRequest, clientIP
 		}
 	}()
 
-	// 按用户名或邮箱查找用户
+	// 按用户名或邮箱查找用户（用户不存在时统一返回密码错误，防止枚举攻击）
 	user, findErr := s.userDAO.FindByAccount(ctx, req.Account)
 	if findErr != nil {
 		if errors.Is(findErr, gorm.ErrRecordNotFound) {
-			err = ErrUserNotFound
+			err = ErrPasswordWrong
 		} else {
 			err = findErr
 		}
diff --git a/frontend/src/utils/request.js b/frontend/src/utils/request.js
index b9f7410..5767deb 100644
--- a/frontend/src/utils/request.js
+++ b/frontend/src/utils/request.js
@@ -73,18 +73,16 @@ const request = (options) => {
             reject(data)
           }
         } else if (statusCode === 401) {
-          // Token 过期或无效，清除本地 Token 并跳转登录页
-          removeToken()
-          uni.showToast({
-            title: '登录已过期，请重新登录',
-            icon: 'none',
-            duration: 2000
-          })
-          // 延迟跳转，让 Toast 有时间显示
-          setTimeout(() => {
-            uni.reLaunch({ url: '/pages/auth/login' })
-          }, 1500)
-          reject({ code: 401, message: '认证已失效' })
+          const isAuthEndpoint = /\/auth\/(login|register)$/.test(options.url)
+          const message = data?.message || '登录已过期，请重新登录'
+          uni.showToast({ title: message, icon: 'none', duration: 2000 })
+          if (!isAuthEndpoint) {
+            removeToken()
+            setTimeout(() => {
+              uni.reLaunch({ url: '/pages/auth/login' })
+            }, 1500)
+          }
+          reject({ code: 401, message })
         } else if (statusCode === 403) {
           uni.showToast({
             title: data.message || '没有访问权限',