fix: harden tenant auth and quality gates

api/src/auth/auth.controller.ts

@@ -1,7 +1,9 @@
-import { Body, Controller, Get, Post, Req, Res, UnauthorizedException } from '@nestjs/common';
+import { Body, Controller, Get, Post, Req, Res, UnauthorizedException, UsePipes } from '@nestjs/common';
 import { ApiTags } from '@nestjs/swagger';
 import { CurrentSessionUserId } from './current-session-user.decorator';
-import { AuthService, LoginDto } from './auth.service';
+import { AuthService } from './auth.service';
+import { ChangeOwnPasswordDto, LoginDto, PasswordVerificationDto } from './auth.dto';
+import { strictValidationPipe } from '../common/strict-validation.pipe';
 import { DEVELOPMENT_SESSION_COOKIE_NAME, SESSION_COOKIE_NAME, SessionPortal, SessionService } from './session.service';
 import type { SessionRequest } from './session-validation.middleware';
 import { UsersService } from '../users/users.service';
@@ -26,6 +28,7 @@ export class AuthController {
   }
 
   @Post('admin/auth/login')
+  @UsePipes(strictValidationPipe)
   async adminLogin(@Body() body: LoginDto, @Req() request: SessionRequest, @Res({ passthrough: true }) response: CookieResponse) {
     let result: Awaited<ReturnType<AuthService['login']>>;
     try {
@@ -43,6 +46,7 @@ export class AuthController {
   }
 
   @Post('client/auth/login')
+  @UsePipes(strictValidationPipe)
   async clientLogin(@Body() body: LoginDto, @Req() request: SessionRequest, @Res({ passthrough: true }) response: CookieResponse) {
     let result: Awaited<ReturnType<AuthService['login']>>;
     try {
@@ -95,7 +99,9 @@ export class AuthController {
   }
 
   @Post(['admin/auth/session/unlock', 'client/auth/session/unlock'])
-  async unlock(@Req() request: SessionRequest, @Body('password') password: string, @Res({ passthrough: true }) response: CookieResponse) {
+  @UsePipes(strictValidationPipe)
+  async unlock(@Req() request: SessionRequest, @Body() body: PasswordVerificationDto, @Res({ passthrough: true }) response: CookieResponse) {
+    const { password } = body;
     this.assertSession(request);
     const result = await this.auth.unlock(request.sessionToken!, request.sessionUserId!, password);
     if (result.status !== 'active' || !('token' in result)) throw new UnauthorizedException({ code: 'SESSION_LOCK_TIMEOUT', message: '锁定时间过长，请重新登录' });
@@ -105,7 +111,9 @@ export class AuthController {
   }
 
   @Post(['admin/auth/reauthenticate', 'client/auth/reauthenticate'])
-  async reauthenticate(@Req() request: SessionRequest, @Body('password') password: string) {
+  @UsePipes(strictValidationPipe)
+  async reauthenticate(@Req() request: SessionRequest, @Body() body: PasswordVerificationDto) {
+    const { password } = body;
     this.assertSession(request);
     const result = await this.auth.reauthenticate(request.sessionToken!, request.sessionUserId!, password);
     if (result.status !== 'active') throw new UnauthorizedException({ code: 'SESSION_LOCKED', message: '会话已锁定' });
@@ -122,9 +130,10 @@ export class AuthController {
   }
 
   @Post(['admin/auth/password', 'client/auth/password'])
-  changeOwnPassword(@CurrentSessionUserId() userId: string | undefined, @Body() body: { currentPassword?: string; password?: string }) {
+  @UsePipes(strictValidationPipe)
+  changeOwnPassword(@CurrentSessionUserId() userId: string | undefined, @Body() body: ChangeOwnPasswordDto) {
     if (!userId) throw new UnauthorizedException('登录会话无效，请重新登录');
-    return this.users.changeOwnPassword(userId, body.currentPassword ?? '', body.password ?? '');
+    return this.users.changeOwnPassword(userId, body.currentPassword, body.password);
   }
 
   private async finishLogin(result: Awaited<ReturnType<AuthService['login']>>, request: SessionRequest, response: CookieResponse) {