🐛 fix(auth): 修复禁用用户仍能登录的安全问题

- 在auth.service.ts中添加用户禁用状态检查，禁用用户登录时抛出错误
- 修复auth.integration.test.ts测试用例，确保禁用用户登录返回401状态码
- 更新测试断言，验证禁用用户登录时返回"账户已禁用"消息

src/server/api/auth/__tests__/auth.integration.test.ts

@@ -9,6 +9,7 @@ import { UserEntity } from '../../../modules/users/user.entity';
 import { authRoutes } from '../../../api';
 import { AuthService } from '../../../modules/auth/auth.service';
 import { UserService } from '../../../modules/users/user.service';
+import { DisabledStatus } from '@/share/types';
 
 // 设置集成测试钩子
 setupIntegrationDatabaseHooks()
@@ -113,11 +114,11 @@ describe('认证API集成测试 (使用hono/testing)', () => {
       const userRepository = dataSource.getRepository(UserEntity);
       await userRepository.delete({ username: 'disabled_user' });
 
-      const disabledUser = await TestDataFactory.createTestUser(dataSource, {
+      await TestDataFactory.createTestUser(dataSource, {
         username: 'disabled_user',
         password: 'TestPassword123!',
         email: 'disabled@example.com',
-        isDisabled: 1
+        isDisabled: DisabledStatus.DISABLED
       });
 
       const loginData = {
@@ -129,13 +130,11 @@ describe('认证API集成测试 (使用hono/testing)', () => {
         json: loginData
       });
 
-      // 根据实际测试结果，禁用账户目前返回200，可能需要改进实现
-      // 这里暂时接受200状态码，但应该检查响应内容
-      expect([200, 401, 500]).toContain(response.status);
-      if (response.status === 200) {
+      // 禁用账户应该返回401状态码
+      expect(response.status).toBe(401);
+      if (response.status === 401) {
         const responseData = await response.json();
-        expect(responseData).toHaveProperty('token');
-        expect(responseData).toHaveProperty('user');
+        expect(responseData.message).toContain('账户已禁用');
       }
     });
   });

src/server/modules/auth/auth.service.ts

@@ -53,6 +53,11 @@ export class AuthService {
         throw new Error('User not found');
       }
 
+      // 检查用户是否被禁用
+      if (user.isDisabled === DisabledStatus.DISABLED) {
+        throw new Error('User account is disabled');
+      }
+
       const isPasswordValid = await this.userService.verifyPassword(user, password);
       if (!isPasswordValid) {
         throw new Error('Invalid password');