fix: complete first version issue remediation

api/src/users/users.service.ts

@@ -154,6 +154,7 @@ export class UsersService {
           phone: data.phone === undefined ? undefined : normalizeOptional(data.phone),
           displayName: data.displayName ?? current.displayName,
           status: data.status ?? current.status,
+          ...(data.status === 'disabled' && current.status !== 'disabled' ? { sessionVersion: { increment: 1 } } : {}),
         },
         include: { tenant: true, roles: { include: { role: true } } },
       });
@@ -166,7 +167,7 @@ export class UsersService {
     const current = await this.getExisting(id, scopeTenantId);
     const updated = await this.prisma.user.update({
       where: { id },
-      data: { status: data.status },
+      data: { status: data.status, ...(data.status === 'disabled' && current.status !== 'disabled' ? { sessionVersion: { increment: 1 } } : {}) },
       include: { tenant: true, roles: { include: { role: true } } },
     });
     await this.writeLog(current.tenantId, data.operatorId, `user.${data.status}`, id, { username: current.username });
@@ -180,7 +181,7 @@ export class UsersService {
     const current = await this.getExisting(id, scopeTenantId);
     const updated = await this.prisma.user.update({
       where: { id },
-      data: { passwordHash: hashPassword(data.password), failedLoginCount: 0, lockedUntil: null },
+      data: { passwordHash: hashPassword(data.password), failedLoginCount: 0, lockedUntil: null, sessionVersion: { increment: 1 } },
       include: { tenant: true, roles: { include: { role: true } } },
     });
     await this.writeLog(current.tenantId, data.operatorId, 'user.password_changed', id, { username: current.username });
@@ -191,7 +192,7 @@ export class UsersService {
     const current = await this.getExisting(id, scopeTenantId);
     const updated = await this.prisma.user.update({
       where: { id },
-      data: { status: 'deleted', deletedAt: new Date() },
+      data: { status: 'deleted', deletedAt: new Date(), sessionVersion: { increment: 1 } },
       include: { tenant: true, roles: { include: { role: true } } },
     });
     await this.writeLog(current.tenantId, operatorId, 'user.deleted', id, { username: current.username });
@@ -218,6 +219,23 @@ export class UsersService {
     });
   }
 
+  async changeOwnPassword(id: string, currentPassword: string, password: string) {
+    if (!currentPassword || !password || password.length < 6) {
+      throw new BadRequestException('currentPassword and a password of at least 6 characters are required');
+    }
+    const current = await this.getExisting(id);
+    if (current.passwordHash !== hashPassword(currentPassword)) {
+      throw new BadRequestException('当前密码不正确');
+    }
+    const updated = await this.prisma.user.update({
+      where: { id },
+      data: { passwordHash: hashPassword(password), failedLoginCount: 0, lockedUntil: null, sessionVersion: { increment: 1 } },
+      include: { tenant: true, roles: { include: { role: true } } },
+    });
+    await this.writeLog(current.tenantId, id, 'user.password_changed_self', id, { username: current.username });
+    return updated;
+  }
+
   listRoles() {
     return this.prisma.role.findMany({
       include: { permissions: { include: { permission: true } } },