Skip to content

fix(user): verify current pay key before update - #254

Open
Aether-254 wants to merge 2 commits into
linux-do:masterfrom
Aether-254:fix/verify-current-pay-key
Open

Aether-254 wants to merge 2 commits into
linux-do:masterfrom
Aether-254:fix/verify-current-pay-key

Conversation

@Aether-254

Copy link
Copy Markdown

例行检查

  • 我已阅读并理解 贡献者公约
  • 我已阅读并同意 贡献者许可协议 (CLA),确认我的贡献将根据项目的 Apache2.0 许可证进行许可
  • 我知晓如果此 PR 并不做出实质性更改,或可被认为是为了PR被合并而提交PR的,则可能不会被合并

关联信息

resolves #253

变更内容

  • 已设置安全密码的用户更新密码时,后端强制校验 6 位原安全密码
  • 保留未设置密码用户的首次设置流程
  • 安全设置页面改为“验证原密码 → 设置新密码 → 确认新密码”三步流程
  • 更新用户服务类型与 Swagger 文档
  • 增加回归测试,覆盖缺失/错误/正确原密码、首次设置及格式校验

变更原因

现有 PUT /api/v1/user/pay-key 只接收新密码并直接覆盖数据库中的安全密码,前端也无需输入原密码。仅修改前端仍可通过直接请求 API 绕过,因此需要由后端执行强制校验。

验证

  • go test ./...
  • go vet ./internal/apps/user
  • pnpm lint
  • pnpm build
  • git diff --check

@Aether-254
Aether-254 marked this pull request as draft October 6, 2026 02:10
@Aether-254
Aether-254 force-pushed the fix/verify-current-pay-key branch from 3a12370 to d10bdc1 Compare October 6, 2026 02:16
@Aether-254
Aether-254 force-pushed the fix/verify-current-pay-key branch from d10bdc1 to ee22a66 Compare October 6, 2026 02:17
@Aether-254
Aether-254 marked this pull request as ready for review October 6, 2026 02:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

bug: 修改安全密码时未验证原密码

1 participant