1

server/app/services/admin_service.py

@@ -462,6 +462,26 @@ async def set_user_status(
     return {"user_id": user_id, "status": req.status, "status_text": USER_STATUS_TEXT[req.status]}
 
 
+async def reset_user_password(
+    db: AsyncSession, redis: aioredis.Redis, admin: AdminIdentity,
+    user_id: int, req, ip: str,
+) -> None:
+    """后台重置用户密码【敏感】：重置后全端 Token 立即失效"""
+    user = await db.get(User, user_id)
+    if user is None:
+        raise BizException(errors.NOT_FOUND, "用户不存在")
+    if user.status == 3:
+        raise BizException(errors.PARAM_ERROR, "账号已注销，不可操作")
+
+    user.password_hash = hash_password(req.new_password)
+    # 全端 Token 失效：递增令牌纪元 + 清 refresh 白名单
+    await redis.incr(f"auth:epoch:{user_id}")
+    await redis.delete(f"auth:refresh:{user_id}")
+    await _log(db, admin.admin_id, "user_password_reset", target=str(user_id),
+               detail=req.reason, ip=ip)
+    await db.commit()
+
+
 # ---------- 积分 ----------
 
 async def adjust_points(