Merge remote-tracking branch 'origin/test' into dev

auth/src/main/java/com/baiyue/auth/dto/AccountManagementDtos.java

@@ -22,7 +22,7 @@ public final class AccountManagementDtos {
             String newPassword) { }
     public record CreateAccountRequest(@NotNull Long accountId,
                                        @NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
-                                       @Pattern(regexp = "^1\\d{10}$") String phone,
+                                       @Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
                                        @NotBlank @Size(min = 8, max = 64)
                                        @Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\\d).+$", message = "密码必须同时包含字母和数字") String password,
                                        @NotBlank String displayName, @NotNull Long tenantId,
@@ -42,10 +42,10 @@ public final class AccountManagementDtos {
     }
     public record ChangeLoginIdentifiersRequest(
             @NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
-            @NotBlank @Pattern(regexp = "^1\\d{10}$") String phone,
+            @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
             @NotBlank String currentPassword) { }
     public record UpdateAccountPhoneRequest(
-            @NotBlank @Pattern(regexp = "^1\\d{10}$") String phone) { }
+            @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone) { }
     public record UpdateAccountProfileRequest(@NotBlank @Size(max = 64) String displayName) { }
     public record UpdateAccountStatusRequest(@NotBlank String status) { }
     public record RevokeAccountSessionsRequest(

auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterRequest.java

@@ -13,7 +13,7 @@ public record MerchantRegisterRequest(
         @NotBlank @Size(max = 64) String displayName,
         @NotBlank @Size(max = 128) String companyName,
         @NotBlank @Size(max = 64) String legalPerson,
-        @NotBlank @Pattern(regexp = "^1\\d{10}$") String legalPhone,
+        @NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String legalPhone,
         @Email @Size(max = 128) String contactEmail,
         @Size(min = 2, max = 2) String countryCode,
         @Size(max = 255) String address

auth/src/main/java/com/baiyue/auth/service/AuthService.java

@@ -61,7 +61,7 @@ public class AuthService {
         description = "User login / 用户登录", captureAfter = false)
     public TokenResponse login(LoginRequest request) {
         String loginId = request.loginId().trim();
-        AuthAccount account = loginId.matches("^1\\d{10}$")
+        AuthAccount account = loginId.matches("^1[3-9]\\d{9}$")
                 ? accountRepository.findByPhone(loginId)
                 : accountRepository.findByUsername(loginId);
         if (account == null) throw invalidCredentials();

auth/src/main/resources/db/auth-login-identifiers.sql

@@ -23,14 +23,14 @@ BEGIN
   IF EXISTS (
       SELECT user.phone
         FROM baiyue_iam.iam_user user
-       WHERE user.deleted = 0 AND user.phone REGEXP '^1[0-9]{10}$'
+       WHERE user.deleted = 0 AND user.phone REGEXP '^1[3-9][0-9]{9}$'
        GROUP BY user.phone HAVING COUNT(DISTINCT user.auth_user_id) > 1) THEN
     SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'IAM 存在重复手机号，禁止建立 Auth 唯一登录索引';
   END IF;
   UPDATE auth_account account
   JOIN baiyue_iam.iam_user user ON user.auth_user_id = account.id AND user.deleted = 0
      SET account.phone = user.phone
-   WHERE account.phone IS NULL AND user.phone REGEXP '^1[0-9]{10}$';
+   WHERE account.phone IS NULL AND user.phone REGEXP '^1[3-9][0-9]{9}$';
   IF NOT EXISTS (
       SELECT 1 FROM information_schema.statistics
        WHERE table_schema = 'baiyue_auth' AND table_name = 'auth_account'

auth/src/test/java/com/baiyue/auth/repository/LoginIdentifierContractTest.java

@@ -0,0 +1,38 @@
+package com.baiyue.auth.repository;
+
+import com.baiyue.auth.dto.AccountManagementDtos.ChangeLoginIdentifiersRequest;
+import com.baiyue.auth.dto.MerchantRegisterRequest;
+import jakarta.validation.Validation;
+import org.junit.jupiter.api.Test;
+import org.springframework.core.io.ClassPathResource;
+
+import java.nio.charset.StandardCharsets;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+class LoginIdentifierContractTest {
+
+    @Test
+    void mainlandMobileRuleRejectsPlaceholderNumbersAcrossJavaAndSql() throws Exception {
+        try (var factory = Validation.buildDefaultValidatorFactory()) {
+            var validator = factory.getValidator();
+            var invalidRegistration = new MerchantRegisterRequest(
+                    "merchant.user", "Password1", "测试用户", "测试企业", "张三",
+                    "11111111111", null, "CN", null);
+            var validChange = new ChangeLoginIdentifiersRequest(
+                    "merchant.user", "13800138000", "Password1");
+            var invalidChange = new ChangeLoginIdentifiersRequest(
+                    "merchant.user", "11111111111", "Password1");
+
+            assertThat(validator.validate(invalidRegistration)).isNotEmpty();
+            assertThat(validator.validate(validChange)).isEmpty();
+            assertThat(validator.validate(invalidChange)).isNotEmpty();
+        }
+
+        String sql = new ClassPathResource("db/auth-login-identifiers.sql")
+                .getContentAsString(StandardCharsets.UTF_8);
+        assertThat(sql)
+                .contains("REGEXP '^1[3-9][0-9]{9}$'")
+                .doesNotContain("REGEXP '^1[0-9]{10}$'");
+    }
+}

auth/src/test/java/com/baiyue/auth/service/AuthServiceSmallJwtTest.java

@@ -128,6 +128,18 @@ class AuthServiceSmallJwtTest {
         verify(repository, never()).findByUsername("13800138000");
     }
 
+    @Test
+    void placeholderNumberIsNeverResolvedAsAMobileLoginIdentifier() {
+        when(repository.findByUsername("11111111111")).thenReturn(null);
+
+        assertThatThrownBy(() -> service.login(new LoginRequest("11111111111", "secret")))
+                .isInstanceOf(com.baiyue.common.core.exception.BizException.class)
+                .hasMessageContaining("登录标识或密码错误");
+
+        verify(repository).findByUsername("11111111111");
+        verify(repository, never()).findByPhone("11111111111");
+    }
+
     @Test
     void refreshRotatesDomesticAndOverseasTokensFromOneAuthorizationSnapshot() {
         AuthAccount account = new AuthAccount();