fix: 开启自助注册须先有 8-64 字符安全码

2026-09-30 16:21:51 +08:00
parent 659373e142
commit 8c20b76df5
9 changed files with 230 additions and 8 deletions
@@ -134,6 +134,66 @@ func TestRegistrationToggleAndGenerate(t *testing.T) {
 	}
 }

+func TestRegistrationEnableRequiresCode(t *testing.T) {
+	db, srv, client := setupA3(t)
+	base := srv.URL
+
+	res := doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":true}`, csrf())
+	env := decodeEnv(t, res)
+	if res.StatusCode != 400 || env.OK {
+		t.Fatalf("enable without code: %d %+v", res.StatusCode, env)
+	}
+	if env.Error == nil || !strings.Contains(env.Error.Message, "8–64") {
+		t.Fatalf("want 8–64 message, got %+v", env.Error)
+	}
+
+	res = doReq(t, client, http.MethodGet, base+"/api/admin/registration", "", nil)
+	env = decodeEnv(t, res)
+	var got map[string]any
+	_ = json.Unmarshal(env.Data, &got)
+	if got["enabled"] != false {
+		t.Fatalf("switch must stay off after 400: %v", got)
+	}
+	var n int
+	if err := db.Read.QueryRow(`SELECT COUNT(*) FROM settings WHERE key = ? AND value = '1'`, "registration_enabled").Scan(&n); err != nil {
+		t.Fatal(err)
+	}
+	if n != 0 {
+		t.Fatalf("enabled setting rolled back, count=%d", n)
+	}
+
+	res = doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":true,"generate":true}`, csrf())
+	env = decodeEnv(t, res)
+	if res.StatusCode != 200 || !env.OK {
+		t.Fatalf("enable+generate: %d %+v", res.StatusCode, env)
+	}
+	_ = json.Unmarshal(env.Data, &got)
+	code, _ := got["code"].(string)
+	if got["enabled"] != true || len(code) != 16 {
+		t.Fatalf("after generate: %v", got)
+	}
+
+	res = doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":false}`, csrf())
+	if res.StatusCode != 200 {
+		t.Fatalf("disable: %d", res.StatusCode)
+	}
+	_ = res.Body.Close()
+
+	res = doReq(t, client, http.MethodPut, base+"/api/admin/registration",
+		`{"enabled":true,"code":"abcdefgh"}`, csrf())
+	env = decodeEnv(t, res)
+	if res.StatusCode != 200 || !env.OK {
+		t.Fatalf("enable+code: %d %+v", res.StatusCode, env)
+	}
+	_ = json.Unmarshal(env.Data, &got)
+	if got["enabled"] != true || got["code"] != "abcdefgh" {
+		t.Fatalf("after enable+code: %v", got)
+	}
+}
+
 func TestMessageDetailHasNoBody(t *testing.T) {
 	db, srv, client := setupA3(t)
 	base := srv.URL