update

src/main/java/com/yaoyuan/jiscuss/dto/UserMapper.java

@@ -0,0 +1,44 @@
+package com.yaoyuan.jiscuss.dto;
+
+import com.yaoyuan.jiscuss.entity.User;
+import org.springframework.stereotype.Component;
+
+/**
+ * Manual mapper between {@link User} entity and DTO objects.
+ *
+ * <p>Intentionally excludes the {@code password} field from all output DTOs.
+ * Replace with a generated MapStruct mapper if mapping complexity grows.
+ */
+@Component
+public class UserMapper {
+
+    /** Map a {@link User} entity to a safe {@link UserResponse} (no password). */
+    public UserResponse toResponse(User user) {
+        if (user == null) return null;
+        return new UserResponse(
+                user.getId(),
+                user.getUsername(),
+                user.getRealname(),
+                user.getEmail(),
+                user.getAvatar(),
+                user.getGender(),
+                user.getPhone(),
+                user.getAge(),
+                user.getDiscussionsCount(),
+                user.getCommentsCount(),
+                user.getJoinTime(),
+                user.getLastSeenTime(),
+                user.getLevel()
+        );
+    }
+
+    /** Map a {@link UserCreateRequest} to a new {@link User} entity (password left unset — caller must hash it). */
+    public User fromCreateRequest(UserCreateRequest request) {
+        User user = new User();
+        user.setUsername(request.username());
+        user.setEmail(request.email());
+        user.setRealname(request.realname());
+        // Caller is responsible for BCrypt-hashing the password before calling usersService.insert()
+        return user;
+    }
+}