feat: 支持管理员自助修改密码 (#57)

2026-08-09 16:49:28 +08:00
parent 2cbb98f09c
commit 008bb87620
12 changed files with 446 additions and 19 deletions
@@ -169,3 +169,71 @@ func TestAuthenticate_过期Session被删除(t *testing.T) {
 		t.Fatalf("过期 Session 应被清理，实际剩 %d", count)
 	}
 }
+
+func TestChangeAdminPassword_校验当前密码并撤销全部Session(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
+	if err := SetupInitialAdmin(db, "admin", "old-password", "old-password", now); err != nil {
+		t.Fatal(err)
+	}
+	tokenA, actor, _, err := Login(db, "admin", "old-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tokenB, _, _, err := Login(db, "admin", "old-password", now)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	err = ChangeAdminPassword(db, actor, "wrong-password", "new-password", "new-password", now.Add(time.Minute))
+	if err == nil || ValidationField(err) != "current_password" || !strings.Contains(err.Error(), "当前密码错误") {
+		t.Fatalf("错误当前密码应定位到 current_password，实际 %v", err)
+	}
+	if _, err := Authenticate(db, tokenA, now.Add(2*time.Minute)); err != nil {
+		t.Fatalf("失败改密不应撤销原 Session: %v", err)
+	}
+
+	if err := ChangeAdminPassword(db, actor, "old-password", "new-password", "new-password", now.Add(3*time.Minute)); err != nil {
+		t.Fatalf("修改管理员密码失败: %v", err)
+	}
+	for _, token := range []string{tokenA, tokenB} {
+		if _, err := Authenticate(db, token, now.Add(4*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
+			t.Fatalf("改密后全部旧 Session 都应失效，实际 %v", err)
+		}
+	}
+	if _, _, _, err := Login(db, "admin", "old-password", now.Add(5*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("改密后旧密码不应登录，实际 %v", err)
+	}
+	if _, _, _, err := Login(db, "admin", "new-password", now.Add(5*time.Minute)); err != nil {
+		t.Fatalf("改密后新密码应可登录: %v", err)
+	}
+}
+
+func TestChangeAdminPassword_新密码字段校验与权限(t *testing.T) {
+	db := newSyncTestDB(t)
+	now := time.Now()
+	if err := SetupInitialAdmin(db, "admin", "old-password", "old-password", now); err != nil {
+		t.Fatal(err)
+	}
+	admin, _ := repository.FindUserByUsername(db, "admin")
+	for _, test := range []struct {
+		name         string
+		password     string
+		confirmation string
+		field        string
+	}{
+		{"少于六个字符", "12345", "12345", "new_password"},
+		{"超过七十二字节", strings.Repeat("密", 25), strings.Repeat("密", 25), "new_password"},
+		{"确认不一致", "123456", "654321", "password_confirm"},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			err := ChangeAdminPassword(db, admin, "old-password", test.password, test.confirmation, now)
+			if err == nil || ValidationField(err) != test.field {
+				t.Fatalf("校验错误 = %v，期望字段 %s", err, test.field)
+			}
+		})
+	}
+	if err := ChangeAdminPassword(db, nil, "old-password", "123456", "123456", now); !errors.Is(err, ErrAdminRequired) {
+		t.Fatalf("非管理员应被拒绝，实际 %v", err)
+	}
+}