add manage student password

group_system/http/api.py

@@ -183,6 +183,17 @@ class GroupRequestHandler:
             status = HTTPStatus.OK if ok else HTTPStatus.BAD_REQUEST
             return json_response(status, {"ok": ok, "message": message})
 
+        if action == "teacher/student-password" and method == "POST":
+            session, error = self.require_teacher()
+            if error:
+                return error
+            data = self.read_json()
+            ok, message = self.store.teacher_set_student_password(
+                int(data.get("student_id", 0)), data.get("new_password", "")
+            )
+            status = HTTPStatus.OK if ok else HTTPStatus.BAD_REQUEST
+            return json_response(status, {"ok": ok, "message": message})
+
         if action == "teacher/group-limit" and method == "POST":
             _, error = self.require_teacher()
             if error:

group_system/storage/accounts.py

@@ -136,6 +136,30 @@ class AccountStoreMixin:
                 )
         return True, "密码修改成功"
 
+    def teacher_set_student_password(
+        self, student_id: int, new_password: str
+    ) -> tuple[bool, str]:
+        """教师后台重置指定学生的登录密码。"""
+        new_password = new_password or ""
+        if len(new_password) < 8:
+            return False, "新密码至少 8 位"
+        with self.lock, self.connection:
+            student = self.connection.execute(
+                "SELECT student_no FROM students WHERE id=?", (student_id,)
+            ).fetchone()
+            if student is None:
+                return False, "学生不存在"
+            if new_password == student["student_no"]:
+                return False, "新密码不能设置为学号"
+            self.connection.execute(
+                "UPDATE students SET password_hash=?, must_change_password=0 WHERE id=?",
+                (hash_password(new_password), student_id),
+            )
+            self.connection.execute(
+                "DELETE FROM sessions WHERE student_id=?", (student_id,)
+            )
+        return True, f"已修改 {student['student_no']} 的密码"
+
     def get_student(self, student_id: int) -> dict[str, Any] | None:
         with self.lock:
             row = self.connection.execute("SELECT * FROM students WHERE id=?", (student_id,)).fetchone()