{/* 邀请码大小写敏感（唯一索引按 ascii_bin 排序），不能像其它字段那样统一大小写 */}
diff --git a/web/src/features/auth/ResetPasswordPage.tsx b/web/src/features/auth/ResetPasswordPage.tsx
index 0b34da67..370db8e0 100644
--- a/web/src/features/auth/ResetPasswordPage.tsx
+++ b/web/src/features/auth/ResetPasswordPage.tsx
@@ -12,6 +12,15 @@ import { useSessionStore } from '@/stores/session';
const PHONE_RE = /^\d{11}$/;
+/** Pasting a number copied as "+86138..."/"86138..." (very common from a contacts app) strips to a
+ * 13-digit all-digit string; naively taking the first 11 keeps "86"+9 real digits and silently
+ * drops the real last 2. Strip a leading 86 first when the digits-only string is longer than 11. */
+function normalizePhoneInput(raw: string): string {
+ const digits = raw.replace(/\D/g, '');
+ const withoutCountryCode = digits.length > 11 && digits.startsWith('86') ? digits.slice(2) : digits;
+ return withoutCountryCode.slice(0, 11);
+}
+
export function ResetPasswordPage() {
const navigate = useNavigate();
const tenant = useSessionStore((s) => s.tenant);
@@ -22,6 +31,10 @@ export function ResetPasswordPage() {
const [confirm, setConfirm] = useState('');
const [challengeId, setChallengeId] = useState('');
const [error, setError] = useState('');
+ // README §10.4's own error example ("密码至少 8 位，需包含字母和数字") is specifically an INLINE
+ // field error under the password input, not just the shared top banner every other validation
+ // failure here uses -- this mirrors that without touching the other (phone/code) failure paths.
+ const [passwordFieldError, setPasswordFieldError] = useState('');
const [submitting, setSubmitting] = useState(false);
const [toast, setToast] = useState('');
@@ -34,15 +47,28 @@ export function ResetPasswordPage() {
}, [phone]);
if (!tenant) return ;
+ // Same real per-tenant policy RegisterPage reads (docs/IM-前后端对接文档.md:534) -- was hardcoded
+ // to 8 here, matching Register's OWN hardcode by coincidence, not because either ever read the
+ // real value; SecuritySettingsPage's in-place change had drifted to a DIFFERENT hardcoded 6.
+ const minPasswordLength = tenant.passwordPolicy?.minLength ?? 8;
const submit = async (e: React.FormEvent) => {
e.preventDefault();
+ setPasswordFieldError('');
+ setError('');
if (!PHONE_RE.test(phone)) return setError('请输入 11 位手机号');
if (!challengeId || !/^\d{6}$/.test(code)) return setError('请先获取并输入 6 位验证码');
- // Matches Register's rule (>= 8, no upper bound -- the backend's checkPasswordPolicy only
- // enforces a minimum length, so the message says exactly that and nothing more).
- if (password.length < 8) return setError('密码至少 8 位');
- if (password !== confirm) return setError('两次输入的密码不一致');
+ // Matches Register's rule (no upper bound enforced client-side -- the backend's checkPasswordPolicy
+ // only enforces a minimum length, so the message says exactly that and nothing more). Inline-only
+ // (no setError) -- these two are the password fields' OWN validation, already shown right under
+ // the relevant input; also raising the shared top banner with the identical text duplicated the
+ // same message on screen twice for no reason phone/code's genuinely-separate failures don't share.
+ if (password.length < minPasswordLength) {
+ return setPasswordFieldError(`密码至少 ${minPasswordLength} 位`);
+ }
+ if (password !== confirm) {
+ return setPasswordFieldError('两次输入的密码不一致');
+ }
setSubmitting(true);
setError('');
@@ -58,12 +84,20 @@ export function ResetPasswordPage() {
};
return (
-
-
+
+ {/* README §10.7: mobile gets its own 48px icon+centered-title bar, not the desktop text link
+ scaled down -- same pattern as RegisterPage's own min-[900px]:hidden header. */}
+