fix: restrict password login to existing phone accounts

2026-04-26 01:11:45 +08:00
parent c4b9b8173f
commit 0a0f3f1bd8
33 changed files with 489 additions and 778 deletions
--- a/src/services/apiClient.ts
+++ b/src/services/apiClient.ts
@@ -10,8 +10,6 @@ import {
 } from '../../packages/shared/src/http';

 const ACCESS_TOKEN_KEY = 'genarrative.auth.access-token.v1';
-const AUTO_AUTH_USERNAME_KEY = 'genarrative.auth.auto-username.v1';
-const AUTO_AUTH_PASSWORD_KEY = 'genarrative.auth.auto-password.v1';
 export const AUTH_STATE_EVENT = 'genarrative-auth-state-changed';
 const REQUEST_ID_HEADER = 'x-request-id';
 const API_VERSION_HEADER = 'x-api-version';
@@ -184,7 +182,9 @@ function composeAbortSignal(
  timeoutMs: number | undefined,
 ) {
  const shouldUseTimeout =
-    typeof timeoutMs === 'number' && Number.isFinite(timeoutMs) && timeoutMs > 0;
+    typeof timeoutMs === 'number' &&
+    Number.isFinite(timeoutMs) &&
+    timeoutMs > 0;

  if (!shouldUseTimeout) {
    return {
@@ -324,7 +324,11 @@ export function isTimeoutError(error: unknown) {
  return error instanceof Error && error.name === 'TimeoutError';
 }

-function shouldRetryError(error: unknown, attempt: number, retry: ResolvedRetryOptions) {
+function shouldRetryError(
+  error: unknown,
+  attempt: number,
+  retry: ResolvedRetryOptions,
+) {
  if (attempt >= retry.maxRetries || isAbortError(error)) {
    return false;
  }
@@ -369,7 +373,9 @@ export class ApiClientError extends Error {
 }

 function canUseLocalStorage() {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined';
+  return (
+    typeof window !== 'undefined' && typeof window.localStorage !== 'undefined'
+  );
 }

 export function emitAuthStateChange() {
@@ -437,52 +443,6 @@ export function clearStoredAccessToken(
  }
 }

-export function getStoredAutoAuthCredentials() {
-  if (!canUseLocalStorage()) {
-    return null;
-  }
-
-  const username = window.localStorage.getItem(AUTO_AUTH_USERNAME_KEY)?.trim() || '';
-  const password = window.localStorage.getItem(AUTO_AUTH_PASSWORD_KEY)?.trim() || '';
-
-  if (!username || !password) {
-    return null;
-  }
-
-  return {
-    username,
-    password,
-  };
-}
-
-export function setStoredAutoAuthCredentials(credentials: {
-  username: string;
-  password: string;
-}) {
-  if (!canUseLocalStorage()) {
-    return;
-  }
-
-  window.localStorage.setItem(AUTO_AUTH_USERNAME_KEY, credentials.username.trim());
-  window.localStorage.setItem(AUTO_AUTH_PASSWORD_KEY, credentials.password.trim());
-}
-
-export function clearStoredAutoAuthCredentials(
-  options: {
-    emit?: boolean;
-  } = {},
-) {
-  if (!canUseLocalStorage()) {
-    return;
-  }
-
-  window.localStorage.removeItem(AUTO_AUTH_USERNAME_KEY);
-  window.localStorage.removeItem(AUTO_AUTH_PASSWORD_KEY);
-  if (options.emit !== false) {
-    emitAuthStateChange();
-  }
-}
-
 function withAuthorizationHeaders(
  headers?: HeadersInit,
  options: Pick<ApiRequestOptions, 'omitEnvelopeHeader' | 'skipAuth'> = {},
@@ -588,10 +548,7 @@ export async function fetchWithApiAuth(
        }
      }

-      const timedRequest = composeAbortSignal(
-        requestSignal,
-        options.timeoutMs,
-      );
+      const timedRequest = composeAbortSignal(requestSignal, options.timeoutMs);
      let response: Response;
      try {
        response = await fetch(input, {
@@ -648,10 +605,7 @@ export async function fetchWithApiAuth(
    }

    attempt += 1;
-    await waitForRetry(
-      buildRetryDelayMs(attempt, retry),
-      requestSignal,
-    );
+    await waitForRetry(buildRetryDelayMs(attempt, retry), requestSignal);
  }
 }

--- a/src/services/authService.test.ts
+++ b/src/services/authService.test.ts
@@ -6,7 +6,8 @@ const apiClientMocks = vi.hoisted(() => ({
 }));

 vi.mock('./apiClient', async () => {
-  const actual = await vi.importActual<typeof import('./apiClient')>('./apiClient');
+  const actual =
+    await vi.importActual<typeof import('./apiClient')>('./apiClient');
  return {
    ...actual,
    emitAuthStateChange: apiClientMocks.emitAuthStateChange,
@@ -17,12 +18,10 @@ vi.mock('./apiClient', async () => {
 import { ApiClientError } from './apiClient';
 import { clearStoredAccessToken, getStoredAccessToken } from './apiClient';
 import {
-  authEntryWithStoredCredentials,
+  authEntry,
  bindWechatPhone,
  changePhoneNumber,
  consumeAuthCallbackResult,
-  createAutoAuthCredentials,
-  ensureAutoAuthUser,
  getAuthAuditLogs,
  getAuthLoginOptions,
  getAuthRiskBlocks,
@@ -80,41 +79,30 @@ describe('authService', () => {
    clearStoredAccessToken({ emit: false });
  });

-  it('creates credentials that match current username/password constraints', () => {
-    const credentials = createAutoAuthCredentials();
-
-    expect(credentials.username).toMatch(/^guest_[a-z0-9]{12}$/u);
-    expect(credentials.password).toMatch(/^auto_[a-z0-9]{24}_[a-z0-9]{8}$/u);
-    expect(credentials.password.length).toBeGreaterThanOrEqual(6);
-  });
-
-  it('auth entry trims guest credentials and写入 access token', async () => {
+  it('auth entry posts phone password credentials and 写入 access token', async () => {
    apiClientMocks.requestJson.mockResolvedValue({
      token: 'jwt-entry-token',
      user: {
        id: 'user_1',
        publicUserCode: 'SY-00000001',
-        username: 'guest_abc123abc123',
-        displayName: 'guest_abc123abc123',
-        phoneNumberMasked: null,
+        username: 'phone_00000001',
+        displayName: '138****8000',
+        phoneNumberMasked: '138****8000',
        loginMethod: 'password',
        bindingStatus: 'active',
        wechatBound: false,
      },
    });

-    const user = await authEntryWithStoredCredentials({
-      username: '  guest_abc123abc123  ',
-      password: '  auto_secret_password  ',
-    });
+    const user = await authEntry(' 138 0013 8000 ', '  secret123  ');

-    expect(user.username).toBe('guest_abc123abc123');
+    expect(user.phoneNumberMasked).toBe('138****8000');
    expect(apiClientMocks.requestJson).toHaveBeenCalledWith(
      '/api/auth/entry',
      expect.objectContaining({
        body: JSON.stringify({
-          username: 'guest_abc123abc123',
-          password: 'auto_secret_password',
+          phone: '13800138000',
+          password: 'secret123',
        }),
      }),
      '登录失败',
@@ -127,62 +115,6 @@ describe('authService', () => {
    expect(window.dispatchEvent).not.toHaveBeenCalled();
  });

-  it('creates a fresh guest credential pair for auto auth when a session is missing', async () => {
-    apiClientMocks.requestJson.mockResolvedValue({
-      token: 'jwt-auto-token',
-      user: {
-        id: 'user_saved',
-        publicUserCode: 'SY-00000002',
-        username: 'guest_saveduser01',
-        displayName: 'guest_saveduser01',
-        phoneNumberMasked: null,
-        loginMethod: 'password',
-        bindingStatus: 'active',
-        wechatBound: false,
-      },
-    });
-
-    const result = await ensureAutoAuthUser();
-    const authEntryBody = JSON.parse(
-      apiClientMocks.requestJson.mock.calls[0]?.[1]?.body as string,
-    ) as {
-      username: string;
-      password: string;
-    };
-
-    expect(result.user.username).toBe('guest_saveduser01');
-    expect(result.credentials.username).toMatch(/^guest_[a-z0-9]{12}$/u);
-    expect(result.credentials.password).toMatch(
-      /^auto_[a-z0-9]{24}_[a-z0-9]{8}$/u,
-    );
-    expect(authEntryBody).toEqual(result.credentials);
-    expect(apiClientMocks.requestJson).toHaveBeenCalledTimes(1);
-  });
-
-  it('deduplicates concurrent auto auth requests', async () => {
-    apiClientMocks.requestJson.mockResolvedValue({
-      token: 'jwt-auto-shared-token',
-      user: {
-        id: 'user_auto',
-        publicUserCode: 'SY-00000003',
-        username: 'guest_auto',
-        displayName: 'guest_auto',
-        phoneNumberMasked: null,
-        loginMethod: 'password',
-        bindingStatus: 'active',
-        wechatBound: false,
-      },
-    });
-
-    const [firstResult, secondResult] = await Promise.all([
-      ensureAutoAuthUser(),
-      ensureAutoAuthUser(),
-    ]);
-
-    expect(apiClientMocks.requestJson).toHaveBeenCalledTimes(1);
-    expect(firstResult).toEqual(secondResult);
-  });
-
  it('sends phone login code through the auth endpoint', async () => {
    apiClientMocks.requestJson.mockResolvedValue({
      ok: true,
@@ -327,7 +259,8 @@ describe('authService', () => {
      }),
    );
    apiClientMocks.requestJson.mockResolvedValue({
-      authorizationUrl: '/api/auth/wechat/callback?mock_code=wx-user&state=state123',
+      authorizationUrl:
+        '/api/auth/wechat/callback?mock_code=wx-user&state=state123',
    });

    await startWechatLogin();
--- a/src/services/authService.ts
+++ b/src/services/authService.ts
@@ -28,22 +28,14 @@ import {
  ApiClientError,
  type ApiRequestOptions,
  clearStoredAccessToken,
-  clearStoredAutoAuthCredentials,
  emitAuthStateChange,
-  getStoredAutoAuthCredentials,
  requestJson,
  setStoredAccessToken,
-  setStoredAutoAuthCredentials,
 } from './apiClient';

 export type { AuthUser } from '../../packages/shared/src/contracts/auth';
 export type { AuthLoginMethod } from '../../packages/shared/src/contracts/auth';

-export type AutoAuthCredentials = {
-  username: string;
-  password: string;
-};
-
 export type AuthSessionSnapshot = {
  user: import('../../packages/shared/src/contracts/auth').AuthUser | null;
  availableLoginMethods: AuthLoginMethod[];
@@ -59,11 +51,6 @@ export type ConsumedAuthCallback = {
  error: string | null;
 };

-let pendingAutoAuthUser: Promise<{
-  user: AuthUser;
-  credentials: AutoAuthCredentials;
-}> | null = null;
-
 // 登录前公开认证入口不能误带旧 token，也不能先触发 refresh 探测，
 // 否则无会话用户点击“获取验证码”时会先打出一条无意义的 /auth/refresh 401。
 const PUBLIC_AUTH_REQUEST_OPTIONS = {
@@ -108,7 +95,8 @@ export function getCaptchaChallengeFromError(
    typeof error.details === 'object' &&
    'captchaChallenge' in error.details
  ) {
-    const challenge = (error.details as { captchaChallenge?: unknown }).captchaChallenge;
+    const challenge = (error.details as { captchaChallenge?: unknown })
+      .captchaChallenge;
    if (
      challenge &&
      typeof challenge === 'object' &&
@@ -124,39 +112,8 @@ export function getCaptchaChallengeFromError(
  return null;
 }

-function normalizeCredentials(credentials: AutoAuthCredentials): AutoAuthCredentials {
-  return {
-    username: credentials.username.trim(),
-    password: credentials.password.trim(),
-  };
-}
-
-function buildRandomSegment(length: number) {
-  const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789';
-  const cryptoApi = globalThis.crypto;
-
-  if (!cryptoApi?.getRandomValues) {
-    return Array.from(
-      {length},
-      () => alphabet[Math.floor(Math.random() * alphabet.length)],
-    ).join('');
-  }
-
-  const bytes = cryptoApi.getRandomValues(new Uint8Array(length));
-
-  return Array.from(bytes, (value) => alphabet[value % alphabet.length]).join('');
-}
-
-export function createAutoAuthCredentials(): AutoAuthCredentials {
-  return {
-    username: `guest_${buildRandomSegment(12)}`,
-    password: `auto_${buildRandomSegment(24)}_${buildRandomSegment(8)}`,
-  };
-}
-
 export function clearAuthSession() {
  clearStoredAccessToken({ emit: false });
-  clearStoredAutoAuthCredentials({ emit: false });
  emitAuthStateChange();
 }

@@ -265,14 +222,16 @@ export async function getAuthLoginOptions() {
  );
 }

-export async function authEntry(username: string, password: string) {
-  const credentials = normalizeCredentials({ username, password });
+export async function authEntry(phone: string, password: string) {
  const response = await requestJson<AuthEntryResponse>(
    '/api/auth/entry',
    {
      method: 'POST',
      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify(credentials),
+      body: JSON.stringify({
+        phone: normalizePhoneInput(phone),
+        password: password.trim(),
+      }),
    },
    '登录失败',
    PUBLIC_AUTH_REQUEST_OPTIONS,
@@ -326,37 +285,6 @@ export async function resetPassword(
  return response.user;
 }

-export async function authEntryWithStoredCredentials(
-  credentials: AutoAuthCredentials,
-) {
-  const normalizedCredentials = normalizeCredentials(credentials);
-  const user = await authEntry(
-    normalizedCredentials.username,
-    normalizedCredentials.password,
-  );
-  setStoredAutoAuthCredentials(normalizedCredentials);
-  return user;
-}
-
-export async function ensureAutoAuthUser() {
-  pendingAutoAuthUser ??= (async () => {
-    const credentials =
-      getStoredAutoAuthCredentials() ?? createAutoAuthCredentials();
-    const user = await authEntryWithStoredCredentials(credentials);
-
-    return {
-      user,
-      credentials,
-    };
-  })();
-
-  try {
-    return await pendingAutoAuthUser;
-  } finally {
-    pendingAutoAuthUser = null;
-  }
-}
-
 export function consumeAuthCallbackResult(): ConsumedAuthCallback | null {
  if (typeof window === 'undefined') {
    return null;