feat: align with upstream 1.5.9.9

server/utils/system-settings-helper.ts

@@ -0,0 +1,40 @@
+import { db } from '~/drizzle/db'
+import { systemSettings } from '~/drizzle/schema'
+import type { SystemSettings } from '~/drizzle/schema'
+
+/**
+ * 统一读取系统设置，读取失败时返回 null，由调用方按安全默认值降级。
+ * 说明：随主分支 minimize-Redis 重构，此处直接查询数据库，不再经过缓存层。
+ */
+export async function getSystemSettingsCached(): Promise<SystemSettings | null> {
+  try {
+    const [settings] = await db.select().from(systemSettings).limit(1)
+    return settings ?? null
+  } catch (error) {
+    console.warn('[SystemSettings] 读取系统设置失败:', error)
+    return null
+  }
+}
+
+export async function getForcePasswordChangeOnFirstLogin(): Promise<boolean> {
+  const settings = await getSystemSettingsCached()
+  return settings && typeof settings.forcePasswordChangeOnFirstLogin === 'boolean'
+    ? settings.forcePasswordChangeOnFirstLogin
+    : false
+}
+
+export function computeRequirePasswordChange(
+  user: { forcePasswordChange?: boolean | null; passwordChangedAt?: Date | string | null },
+  forcePasswordChangeOnFirstLogin: boolean
+): boolean {
+  return !!user.forcePasswordChange || (forcePasswordChangeOnFirstLogin && !user.passwordChangedAt)
+}
+
+export async function resolveRequirePasswordChange(user: {
+  forcePasswordChange?: boolean | null
+  passwordChangedAt?: Date | string | null
+}): Promise<boolean> {
+  if (user.forcePasswordChange) return true
+  if (user.passwordChangedAt) return false
+  return computeRequirePasswordChange(user, await getForcePasswordChangeOnFirstLogin())
+}