From 2bed09eccdb285e5e61ae4872ca286e7a1d45c58 Mon Sep 17 00:00:00 2001
From: QiuSW <105186638@qq.com>
Date: Mon, 27 Jul 2026 15:02:44 +0800
Subject: [PATCH] chore(auth): allow six-byte internal passwords

---
 README.md                                             | 4 ++--
 backend-api/README.md                                 | 4 ++--
 backend-api/cmd/authctl/main_test.go                  | 2 +-
 backend-api/internal/domain/auth.go                   | 2 +-
 backend-api/internal/platform/password/bcrypt_test.go | 5 ++++-
 docs/00-ai-start-here.md                              | 2 +-
 docs/current-state.md                                 | 2 +-
 7 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/README.md b/README.md
index 5355edb..7b00d9a 100644
--- a/README.md
+++ b/README.md
@@ -78,10 +78,10 @@ fixture，默认 APK 不携带真实订单资料。
 Set-Location backend-api
 $env:GOTOOLCHAIN = "local"
 go run ./cmd/migrate up
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
-$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user BUYER buyer01
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/authctl create-device buyer-phone-01
diff --git a/backend-api/README.md b/backend-api/README.md
index 6b8e229..26119d8 100644
--- a/backend-api/README.md
+++ b/backend-api/README.md
@@ -39,11 +39,11 @@ go build -o bin/cmroubao-authctl.exe ./cmd/authctl
 go run ./cmd/migrate up
 go run ./cmd/migrate status
 
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 
-$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "采购员独立强密码，至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user BUYER buyer01
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/authctl create-device buyer-phone-01
diff --git a/backend-api/cmd/authctl/main_test.go b/backend-api/cmd/authctl/main_test.go
index 533a8d6..5e0338c 100644
--- a/backend-api/cmd/authctl/main_test.go
+++ b/backend-api/cmd/authctl/main_test.go
@@ -177,7 +177,7 @@ func TestRunRejectsWeakPasswordAndInvalidCommands(t *testing.T) {
 	databasePath := migratedDatabase(t)
 	err := run(
 		[]string{"create-user", "BUYER", "buyer"},
-		testLookup(databasePath, "too-short"),
+		testLookup(databasePath, "short"),
 		&bytes.Buffer{},
 	)
 	if err == nil || err.Error() != "authentication input is invalid" {
diff --git a/backend-api/internal/domain/auth.go b/backend-api/internal/domain/auth.go
index c016169..badfe50 100644
--- a/backend-api/internal/domain/auth.go
+++ b/backend-api/internal/domain/auth.go
@@ -17,7 +17,7 @@ const (
 	MaxUsernameBytes   = 128
 	MaxDeviceNameBytes = 128
 	MaxVersionBytes    = 128
-	MinPasswordBytes   = 12
+	MinPasswordBytes   = 6
 	MaxPasswordBytes   = 72
 )
 
diff --git a/backend-api/internal/platform/password/bcrypt_test.go b/backend-api/internal/platform/password/bcrypt_test.go
index 62e80f9..0150280 100644
--- a/backend-api/internal/platform/password/bcrypt_test.go
+++ b/backend-api/internal/platform/password/bcrypt_test.go
@@ -40,12 +40,15 @@ func TestBcryptRejectsInvalidCostAndOversizedPasswords(t *testing.T) {
 		t.Fatalf("NewBcrypt() error = %v", err)
 	}
 	oversized := strings.Repeat("x", 73)
-	if _, err := manager.Hash("too-short"); !errors.Is(
+	if _, err := manager.Hash("short"); !errors.Is(
 		err,
 		ErrInvalidPassword,
 	) {
 		t.Fatalf("Hash(short) error = %v", err)
 	}
+	if _, err := manager.Hash("sixsix"); err != nil {
+		t.Fatalf("Hash(six-byte password) error = %v", err)
+	}
 	if _, err := manager.Hash(oversized); !errors.Is(
 		err,
 		ErrInvalidPassword,
diff --git a/docs/00-ai-start-here.md b/docs/00-ai-start-here.md
index 40c8ee0..a698675 100644
--- a/docs/00-ai-start-here.md
+++ b/docs/00-ai-start-here.md
@@ -117,7 +117,7 @@ $env:RUN_START_COMMAND = "1"
 Set-Location backend-api
 $env:GOTOOLCHAIN = "local"
 go run ./cmd/migrate up
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/api
diff --git a/docs/current-state.md b/docs/current-state.md
index 39f980f..efeceac 100644
--- a/docs/current-state.md
+++ b/docs/current-state.md
@@ -117,7 +117,7 @@ $env:RUN_START_COMMAND = "1"
 Set-Location backend-api
 $env:GOTOOLCHAIN = "local"
 go run ./cmd/migrate up
-$env:CMROUBAO_AUTH_PASSWORD = "至少 12 个 UTF-8 字节"
+$env:CMROUBAO_AUTH_PASSWORD = "至少 6 个 UTF-8 字节"
 go run ./cmd/authctl create-user ADMIN admin
 Remove-Item Env:CMROUBAO_AUTH_PASSWORD
 go run ./cmd/api