chore(auth): allow six-byte internal passwords

README.md

@@ -78,10 +78,10 @@ fixture，默认 APK 不携带真实订单资料。
 Set-Location backend-api
 $env:GOTOOLCHAIN = "local"
 go run ./cmd/migrate up
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
-$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user BUYER buyer01
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/authctl create-device buyer-phone-01

backend-api/README.md

@@ -39,11 +39,11 @@ go build -o bin/cmroubao-authctl.exe ./cmd/authctl
 go run ./cmd/migrate up
 go run ./cmd/migrate status
 
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 
-$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user BUYER buyer01
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/authctl create-device buyer-phone-01

backend-api/cmd/authctl/main_test.go

@@ -177,7 +177,7 @@ func TestRunRejectsWeakPasswordAndInvalidCommands(t *testing.T) {
 	databasePath := migratedDatabase(t)
 	err := run(
 		[]string{"create-user", "BUYER", "buyer"},
-		testLookup(databasePath, "too-short"),
+		testLookup(databasePath, "short"),
 		&bytes.Buffer{},
 	)
 	if err == nil || err.Error() != "authentication input is invalid" {

backend-api/internal/domain/auth.go

@@ -17,7 +17,7 @@ const (
 	MaxUsernameBytes   = 128
 	MaxDeviceNameBytes = 128
 	MaxVersionBytes    = 128
-	MinPasswordBytes   = 12
+	MinPasswordBytes   = 6
 	MaxPasswordBytes   = 72
 )
 

backend-api/internal/platform/password/bcrypt_test.go

@@ -40,12 +40,15 @@ func TestBcryptRejectsInvalidCostAndOversizedPasswords(t *testing.T) {
 		t.Fatalf("NewBcrypt() error = %v", err)
 	}
 	oversized := strings.Repeat("x", 73)
-	if _, err := manager.Hash("too-short"); !errors.Is(
+	if _, err := manager.Hash("short"); !errors.Is(
 		err,
 		ErrInvalidPassword,
 	) {
 		t.Fatalf("Hash(short) error = %v", err)
 	}
+	if _, err := manager.Hash("sixsix"); err != nil {
+		t.Fatalf("Hash(six-byte password) error = %v", err)
+	}
 	if _, err := manager.Hash(oversized); !errors.Is(
 		err,
 		ErrInvalidPassword,

docs/00-ai-start-here.md

@@ -117,7 +117,7 @@ $env:RUN_START_COMMAND = "1"
 Set-Location backend-api
 $env:GOTOOLCHAIN = "local"
 go run ./cmd/migrate up
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/api

docs/current-state.md

@@ -117,7 +117,7 @@ $env:RUN_START_COMMAND = "1"
 Set-Location backend-api
 $env:GOTOOLCHAIN = "local"
 go run ./cmd/migrate up
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/api