fix version 1

module/base/passport/internal/logic/forget/reset.go

@@ -11,6 +11,7 @@ import (
 	"git.apinb.com/bsm-sdk/core/errcode"
 	"git.apinb.com/bsm-sdk/core/printer"
 	"git.apinb.com/bsm-sdk/core/utils"
+	"golang.org/x/crypto/bcrypt"
 )
 
 // 重罢密码
@@ -19,6 +20,13 @@ func Reset(ctx context.Context, in *pb.ForgetResetRequest) (reply *pb.StatusRepl
 		return nil, errcode.ErrInvalidArgument
 	}
 
+	// 必须先通过 Verify 写入一次性重置票据，否则拒绝改密
+	resetKey := vars.ForgetResetTokenPrefix + in.Identity
+	if err := impl.RedisService.Client.Get(impl.RedisService.Ctx, resetKey).Err(); err != nil {
+		printer.Error("Forget reset token not found by identity %v error:%v", in.Identity, err)
+		return nil, errcode.ErrPermissionDenied
+	}
+
 	pa, err := models.GetPassportAccountByField("identity", in.Identity)
 	if err != nil {
 		return nil, err
@@ -28,12 +36,26 @@ func Reset(ctx context.Context, in *pb.ForgetResetRequest) (reply *pb.StatusRepl
 		return nil, errcode.ErrPermissionDenied
 	}
 
-	err = impl.DBService.Model(&models.PassportAccount{}).Where("identity = ? ", pa.Identity).Update("password", utils.Md5(in.Password)).Error
+	salt := utils.UUID()
+	hashedPassword, err := bcrypt.GenerateFromPassword([]byte(in.Password+salt), bcrypt.DefaultCost)
+	if err != nil {
+		return nil, errcode.ErrInternal
+	}
+
+	err = impl.DBService.Model(&models.PassportAccount{}).Where("identity = ? ", pa.Identity).Updates(map[string]any{
+		"password": string(hashedPassword),
+		"salt":     salt,
+	}).Error
 	if err != nil {
 		printer.Error("Update passport account password by identity %+v error:%v", in.Identity, err)
 		return nil, errcode.ErrDB
 	}
 
+	// 改密成功后删除票据（一次性，防重放）
+	if err := impl.RedisService.Client.Del(impl.RedisService.Ctx, resetKey).Err(); err != nil {
+		printer.Error("Del forget reset token by identity %v error:%v", in.Identity, err)
+	}
+
 	return &pb.StatusReply{
 		Message: "OK",
 		Timeseq: time.Now().UnixMilli(),

module/base/passport/internal/logic/forget/verify.go

@@ -4,10 +4,12 @@ import (
 	"context"
 	"time"
 
+	"bsm/full/module/base/passport/internal/impl"
 	"bsm/full/module/base/passport/internal/models"
 	"bsm/full/module/base/passport/internal/vars"
 	pb "bsm/full/module/base/passport/pb"
 	"git.apinb.com/bsm-sdk/core/errcode"
+	"git.apinb.com/bsm-sdk/core/printer"
 )
 
 // 验证手机号和验证码
@@ -25,6 +27,18 @@ func Verify(ctx context.Context, in *pb.ForgetVerifyRequest) (reply *pb.StatusRe
 		return nil, errcode.ErrPermissionDenied
 	}
 
+	// 真实校验短信验证码（一次性）
+	if err := models.VerifySmsCode(ctx, in.Phone, in.Code); err != nil {
+		return nil, err
+	}
+
+	// 校验通过后写入一次性重置票据，供 Reset 改密前校验，10 分钟有效
+	resetKey := vars.ForgetResetTokenPrefix + pa.Identity
+	if err := impl.RedisService.Client.Set(impl.RedisService.Ctx, resetKey, "1", 10*time.Minute).Err(); err != nil {
+		printer.Error("Set forget reset token by identity %v error:%v", pa.Identity, err)
+		return nil, errcode.ErrInternal
+	}
+
 	return &pb.StatusReply{
 		Timeseq: time.Now().UnixMilli(),
 	}, nil