fix: 用户密码最小长度调整为六位 (#55)

admin/auth_integration_test.go

@@ -29,6 +29,10 @@ func TestAdmin首次初始化登录退出完整流程(t *testing.T) {
 	if setupPage.Code != http.StatusOK || !strings.Contains(setupPage.Body.String(), "初始化管理员") {
 		t.Fatalf("GET /setup = %d，响应：%s", setupPage.Code, setupPage.Body.String())
 	}
+	if strings.Count(setupPage.Body.String(), `minlength="6"`) != 2 ||
+		!strings.Contains(setupPage.Body.String(), "至少 6 个字符") {
+		t.Fatalf("初始化表单密码规则未同步为 6 个字符：%s", setupPage.Body.String())
+	}
 	csrfCookie := findResponseCookie(t, setupPage, "cmautobuy_csrf")
 	if csrfCookie.HttpOnly || csrfCookie.Value == "" {
 		t.Fatalf("CSRF Cookie 应可供双提交表单使用: %#v", csrfCookie)

admin/service/auth.go

@@ -20,7 +20,7 @@ import (
 
 const (
 	WebSessionDuration = 12 * time.Hour
-	minimumPasswordLen = 8
+	minimumPasswordLen = 6
 	maxUsernameLen     = 64
 )
 

admin/service/auth_test.go

@@ -39,7 +39,7 @@ func TestSetupInitialAdmin_校验密码字符数和Bcrypt字节上限(t *testing
 		password string
 		want     string
 	}{
-		{"少于八个字符", "1234567", "至少需要 8 个字符"},
+		{"少于六个字符", "12345", "至少需要 6 个字符"},
 		{"超过bcrypt字节上限", strings.Repeat("密", 25), "不能超过 72 个字节"},
 	} {
 		t.Run(test.name, func(t *testing.T) {
@@ -52,6 +52,13 @@ func TestSetupInitialAdmin_校验密码字符数和Bcrypt字节上限(t *testing
 	}
 }
 
+func TestSetupInitialAdmin_六个字符密码可用(t *testing.T) {
+	db := newSyncTestDB(t)
+	if err := SetupInitialAdmin(db, "admin", "123456", "123456", time.Now()); err != nil {
+		t.Fatalf("六个字符应达到最小密码长度，实际 %v", err)
+	}
+}
+
 func TestSetupInitialAdmin_并发最多一个成功(t *testing.T) {
 	db := newSyncTestDB(t)
 	start := make(chan struct{})

admin/service/user_test.go

@@ -16,7 +16,7 @@ func TestCreatePurchaser_固定角色且用户名不区分大小写唯一(t *tes
 	db := newSyncTestDB(t)
 	now := time.Date(2026, 8, 9, 8, 0, 0, 0, time.UTC)
 	admin := prepareAdminUser(t, db, now)
-	if err := CreatePurchaser(db, admin, "buyer", "buyer-password", "buyer-password", now); err != nil {
+	if err := CreatePurchaser(db, admin, "buyer", "123456", "123456", now); err != nil {
 		t.Fatalf("创建采购员失败: %v", err)
 	}
 	buyer, err := repository.FindUserByUsername(db, "BUYER")
@@ -26,8 +26,8 @@ func TestCreatePurchaser_固定角色且用户名不区分大小写唯一(t *tes
 	if buyer.Role != model.RolePurchaser || buyer.Status != model.UserActive {
 		t.Fatalf("新账号角色或状态错误: %+v", buyer)
 	}
-	if buyer.PasswordHash == "buyer-password" ||
-		bcrypt.CompareHashAndPassword([]byte(buyer.PasswordHash), []byte("buyer-password")) != nil {
+	if buyer.PasswordHash == "123456" ||
+		bcrypt.CompareHashAndPassword([]byte(buyer.PasswordHash), []byte("123456")) != nil {
 		t.Fatal("采购员密码必须保存为可验证的 bcrypt 哈希")
 	}
 	if err := CreatePurchaser(db, admin, "BUYER", "other-password", "other-password", now); !errors.Is(err, repository.ErrUsernameExists) {
@@ -73,7 +73,7 @@ func TestResetUserPassword_原子撤销Session并更换凭据(t *testing.T) {
 	}
 	buyer, _ := repository.FindUserByUsername(db, "buyer")
 	token, _, _, _ := Login(db, "buyer", "old-password", now)
-	if err := ResetUserPassword(db, admin, buyer.UserID, "new-password", "new-password", now.Add(time.Minute)); err != nil {
+	if err := ResetUserPassword(db, admin, buyer.UserID, "654321", "654321", now.Add(time.Minute)); err != nil {
 		t.Fatal(err)
 	}
 	if _, err := Authenticate(db, token, now.Add(2*time.Minute)); !errors.Is(err, ErrUnauthenticated) {
@@ -82,7 +82,7 @@ func TestResetUserPassword_原子撤销Session并更换凭据(t *testing.T) {
 	if _, _, _, err := Login(db, "buyer", "old-password", now.Add(2*time.Minute)); !errors.Is(err, ErrInvalidCredentials) {
 		t.Fatalf("旧密码应失效，实际 %v", err)
 	}
-	if _, _, _, err := Login(db, "buyer", "new-password", now.Add(2*time.Minute)); err != nil {
+	if _, _, _, err := Login(db, "buyer", "654321", now.Add(2*time.Minute)); err != nil {
 		t.Fatalf("新密码应可登录: %v", err)
 	}
 }

admin/templates/auth/setup.html

@@ -20,14 +20,14 @@
     </div>
     <div class="field">
       <label for="setup-password">密码</label>
-      <input id="setup-password" type="password" name="password" minlength="8"
+      <input id="setup-password" type="password" name="password" minlength="6"
              maxlength="72" required autocomplete="new-password">
-      <small>至少 8 个字符；请使用只有你知道的密码。</small>
+      <small>至少 6 个字符；请使用只有你知道的密码。</small>
     </div>
     <div class="field">
       <label for="setup-password-confirm">确认密码</label>
       <input id="setup-password-confirm" type="password" name="password_confirm"
-             minlength="8" maxlength="72" required autocomplete="new-password">
+             minlength="6" maxlength="72" required autocomplete="new-password">
     </div>
     <button type="submit" class="primary auth-submit">创建管理员</button>
   </form>

admin/templates/user/list.html

@@ -86,14 +86,14 @@
         </div>
         <div class="field">
           <label for="new-password">初始密码</label>
-          <input id="new-password" type="password" name="password" minlength="8"
+          <input id="new-password" type="password" name="password" minlength="6"
                  maxlength="72" required autocomplete="new-password">
-          <small>至少 8 个字符。密码不会显示在列表或日志中。</small>
+          <small>至少 6 个字符。密码不会显示在列表或日志中。</small>
         </div>
         <div class="field">
           <label for="new-password-confirm">确认密码</label>
           <input id="new-password-confirm" type="password" name="password_confirm"
-                 minlength="8" maxlength="72" required autocomplete="new-password">
+                 minlength="6" maxlength="72" required autocomplete="new-password">
         </div>
         <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">
       </div>
@@ -117,13 +117,14 @@
         <p>账号：<strong data-reset-username-label></strong></p>
         <div class="field">
           <label for="reset-password">新密码</label>
-          <input id="reset-password" type="password" name="password" minlength="8"
+          <input id="reset-password" type="password" name="password" minlength="6"
                  maxlength="72" required autocomplete="new-password" autofocus>
+          <small>至少 6 个字符。重置成功后原有登录会立即失效。</small>
         </div>
         <div class="field">
           <label for="reset-password-confirm">确认新密码</label>
           <input id="reset-password-confirm" type="password" name="password_confirm"
-                 minlength="8" maxlength="72" required autocomplete="new-password">
+                 minlength="6" maxlength="72" required autocomplete="new-password">
         </div>
         <input type="hidden" name="user_id" data-reset-user-id-input>
         <input type="hidden" name="csrf_token" value="{{.CSRFToken}}">

admin/user_integration_test.go

@@ -50,6 +50,10 @@ func Test用户管理管理员与采购员权限边界(t *testing.T) {
 			t.Errorf("用户管理页缺少 %q", want)
 		}
 	}
+	if strings.Count(adminPage.Body.String(), `minlength="6"`) != 4 ||
+		strings.Count(adminPage.Body.String(), "至少 6 个字符") != 2 {
+		t.Fatalf("创建和重置密码表单没有统一使用 6 个字符规则")
+	}
 	for _, secret := range []string{"admin-password", "buyer-password"} {
 		if strings.Contains(adminPage.Body.String(), secret) {
 			t.Fatalf("用户管理页泄露密码 %q", secret)