fix: 开启自助注册须先有 8-64 字符安全码

internal/admin/a3_test.go

@@ -134,6 +134,66 @@ func TestRegistrationToggleAndGenerate(t *testing.T) {
 	}
 }
 
+func TestRegistrationEnableRequiresCode(t *testing.T) {
+	db, srv, client := setupA3(t)
+	base := srv.URL
+
+	res := doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":true}`, csrf())
+	env := decodeEnv(t, res)
+	if res.StatusCode != 400 || env.OK {
+		t.Fatalf("enable without code: %d %+v", res.StatusCode, env)
+	}
+	if env.Error == nil || !strings.Contains(env.Error.Message, "8–64") {
+		t.Fatalf("want 8–64 message, got %+v", env.Error)
+	}
+
+	res = doReq(t, client, http.MethodGet, base+"/api/admin/registration", "", nil)
+	env = decodeEnv(t, res)
+	var got map[string]any
+	_ = json.Unmarshal(env.Data, &got)
+	if got["enabled"] != false {
+		t.Fatalf("switch must stay off after 400: %v", got)
+	}
+	var n int
+	if err := db.Read.QueryRow(`SELECT COUNT(*) FROM settings WHERE key = ? AND value = '1'`, "registration_enabled").Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Fatalf("enabled setting rolled back, count=%d", n)
+	}
+
+	res = doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":true,"generate":true}`, csrf())
+	env = decodeEnv(t, res)
+	if res.StatusCode != 200 || !env.OK {
+		t.Fatalf("enable+generate: %d %+v", res.StatusCode, env)
+	}
+	_ = json.Unmarshal(env.Data, &got)
+	code, _ := got["code"].(string)
+	if got["enabled"] != true || len(code) != 16 {
+		t.Fatalf("after generate: %v", got)
+	}
+
+	res = doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":false}`, csrf())
+	if res.StatusCode != 200 {
+		t.Fatalf("disable: %d", res.StatusCode)
+	}
+	_ = res.Body.Close()
+
+	res = doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":true,"code":"abcdefgh"}`, csrf())
+	env = decodeEnv(t, res)
+	if res.StatusCode != 200 || !env.OK {
+		t.Fatalf("enable+code: %d %+v", res.StatusCode, env)
+	}
+	_ = json.Unmarshal(env.Data, &got)
+	if got["enabled"] != true || got["code"] != "abcdefgh" {
+		t.Fatalf("after enable+code: %v", got)
+	}
+}
+
 func TestMessageDetailHasNoBody(t *testing.T) {
 	db, srv, client := setupA3(t)
 	base := srv.URL

internal/admin/registration.go

@@ -77,9 +77,7 @@ func (h *Handler) handleRegistrationPut(w http.ResponseWriter, r *http.Request)
 			); e != nil {
 				return e
 			}
-			return nil
-		}
-		if req.Code != nil {
+		} else if req.Code != nil {
 			code := *req.Code
 			n := utf8.RuneCountInString(code)
 			if n < minRegistrationCodeLen || n > maxRegistrationCodeLen {
@@ -93,6 +91,18 @@ func (h *Handler) handleRegistrationPut(w http.ResponseWriter, r *http.Request)
 				return e
 			}
 		}
+
+		var enabledVal, codeVal sql.NullString
+		if e := tx.QueryRow(`SELECT value FROM settings WHERE key = ?`, settingRegistrationEnabled).Scan(&enabledVal); e != nil && !errors.Is(e, sql.ErrNoRows) {
+			return e
+		}
+		if e := tx.QueryRow(`SELECT value FROM settings WHERE key = ?`, settingRegistrationCode).Scan(&codeVal); e != nil && !errors.Is(e, sql.ErrNoRows) {
+			return e
+		}
+		n := utf8.RuneCountInString(codeVal.String)
+		if registrationTruthy(enabledVal.String) && (n < minRegistrationCodeLen || n > maxRegistrationCodeLen) {
+			return errBadRequest("开启自助注册前须先设置 8–64 字符的安全码")
+		}
 		return nil
 	})
 	if err != nil {