java-project/baiyue-firstleg
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(auth): reject placeholder mobile numbers

Browse Source
This commit is contained in:
ouyangxq
2026-09-01 19:27:46 +08:00
parent caffcb90a9
commit 405d6b94d7
11 changed files with 72 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
auth/src/main/java/com/baiyue/auth/dto/AccountManagementDtos.java
+3 -3
View File
@@ -22,7 +22,7 @@ public final class AccountManagementDtos {
String newPassword) { }
public record CreateAccountRequest(@NotNull Long accountId,
@NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
@Pattern(regexp = "^1\\d{10}$") String phone,
@Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
@NotBlank @Size(min = 8, max = 64)
@Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\\d).+$", message = "密码必须同时包含字母和数字") String password,
@NotBlank String displayName, @NotNull Long tenantId,
@@ -42,10 +42,10 @@ public final class AccountManagementDtos {
}
public record ChangeLoginIdentifiersRequest(
@NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
@NotBlank @Pattern(regexp = "^1\\d{10}$") String phone,
@NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
@NotBlank String currentPassword) { }
public record UpdateAccountPhoneRequest(
@NotBlank @Pattern(regexp = "^1\\d{10}$") String phone) { }
@NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone) { }
public record UpdateAccountProfileRequest(@NotBlank @Size(max = 64) String displayName) { }
public record UpdateAccountStatusRequest(@NotBlank String status) { }
public record RevokeAccountSessionsRequest(
auth/src/main/java/com/baiyue/auth/dto/MerchantRegisterRequest.java
+1 -1
View File
@@ -13,7 +13,7 @@ public record MerchantRegisterRequest(
@NotBlank @Size(max = 64) String displayName,
@NotBlank @Size(max = 128) String companyName,
@NotBlank @Size(max = 64) String legalPerson,
@NotBlank @Pattern(regexp = "^1\\d{10}$") String legalPhone,
@NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String legalPhone,
@Email @Size(max = 128) String contactEmail,
@Size(min = 2, max = 2) String countryCode,
@Size(max = 255) String address
auth/src/main/java/com/baiyue/auth/service/AuthService.java
+1 -1
View File
@@ -61,7 +61,7 @@ public class AuthService {
description = "User login / 用户登录", captureAfter = false)
public TokenResponse login(LoginRequest request) {
String loginId = request.loginId().trim();
AuthAccount account = loginId.matches("^1\\d{10}$")
AuthAccount account = loginId.matches("^1[3-9]\\d{9}$")
? accountRepository.findByPhone(loginId)
: accountRepository.findByUsername(loginId);
if (account == null) throw invalidCredentials();
auth/src/main/resources/db/auth-login-identifiers.sql
+2 -2
View File
@@ -23,14 +23,14 @@ BEGIN
IF EXISTS (
SELECT user.phone
FROM baiyue_iam.iam_user user
WHERE user.deleted = 0 AND user.phone REGEXP '^1[0-9]{10}$'
WHERE user.deleted = 0 AND user.phone REGEXP '^1[3-9][0-9]{9}$'
GROUP BY user.phone HAVING COUNT(DISTINCT user.auth_user_id) > 1) THEN
SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'IAM 存在重复手机号，禁止建立 Auth 唯一登录索引';
END IF;
UPDATE auth_account account
JOIN baiyue_iam.iam_user user ON user.auth_user_id = account.id AND user.deleted = 0
SET account.phone = user.phone
WHERE account.phone IS NULL AND user.phone REGEXP '^1[0-9]{10}$';
WHERE account.phone IS NULL AND user.phone REGEXP '^1[3-9][0-9]{9}$';
IF NOT EXISTS (
SELECT 1 FROM information_schema.statistics
WHERE table_schema = 'baiyue_auth' AND table_name = 'auth_account'
auth/src/test/java/com/baiyue/auth/repository/LoginIdentifierContractTest.java
+38
View File
@@ -0,0 +1,38 @@
package com.baiyue.auth.repository;
import com.baiyue.auth.dto.AccountManagementDtos.ChangeLoginIdentifiersRequest;
import com.baiyue.auth.dto.MerchantRegisterRequest;
import jakarta.validation.Validation;
import org.junit.jupiter.api.Test;
import org.springframework.core.io.ClassPathResource;
import java.nio.charset.StandardCharsets;
import static org.assertj.core.api.Assertions.assertThat;
class LoginIdentifierContractTest {
@Test
void mainlandMobileRuleRejectsPlaceholderNumbersAcrossJavaAndSql() throws Exception {
try (var factory = Validation.buildDefaultValidatorFactory()) {
var validator = factory.getValidator();
var invalidRegistration = new MerchantRegisterRequest(
"merchant.user", "Password1", "测试用户", "测试企业", "张三",
"11111111111", null, "CN", null);
var validChange = new ChangeLoginIdentifiersRequest(
"merchant.user", "13800138000", "Password1");
var invalidChange = new ChangeLoginIdentifiersRequest(
"merchant.user", "11111111111", "Password1");
assertThat(validator.validate(invalidRegistration)).isNotEmpty();
assertThat(validator.validate(validChange)).isEmpty();
assertThat(validator.validate(invalidChange)).isNotEmpty();
}
String sql = new ClassPathResource("db/auth-login-identifiers.sql")
.getContentAsString(StandardCharsets.UTF_8);
assertThat(sql)
.contains("REGEXP '^1[3-9][0-9]{9}$'")
.doesNotContain("REGEXP '^1[0-9]{10}$'");
}
}
auth/src/test/java/com/baiyue/auth/service/AuthServiceSmallJwtTest.java
+12
View File
@@ -128,6 +128,18 @@ class AuthServiceSmallJwtTest {
verify(repository, never()).findByUsername("13800138000");
}
@Test
void placeholderNumberIsNeverResolvedAsAMobileLoginIdentifier() {
when(repository.findByUsername("11111111111")).thenReturn(null);
assertThatThrownBy(() -> service.login(new LoginRequest("11111111111", "secret")))
.isInstanceOf(com.baiyue.common.core.exception.BizException.class)
.hasMessageContaining("登录标识或密码错误");
verify(repository).findByUsername("11111111111");
verify(repository, never()).findByPhone("11111111111");
}
@Test
void refreshRotatesDomesticAndOverseasTokensFromOneAuthorizationSnapshot() {
AuthAccount account = new AuthAccount();
iam/src/main/java/com/baiyue/iam/dto/MemberDtos.java
+2 -2
View File
@@ -18,7 +18,7 @@ public final class MemberDtos {
@NotBlank @Size(min = 8, max = 64)
@Pattern(regexp = "^(?=.*[A-Za-z])(?=.*\\d).+$", message = "密码必须同时包含字母和数字") String password,
@NotBlank @Size(max = 64) String displayName,
@Pattern(regexp = "^1\\d{10}$") String phone,
@Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
@Email @Size(max = 128) String email,
@NotBlank String memberType,
@Size(max = 64) String memberNo,
@@ -30,7 +30,7 @@ public final class MemberDtos {
public record UpdateMemberRequest(
@NotBlank @Size(max = 64) String displayName,
@Pattern(regexp = "^1\\d{10}$") String phone,
@Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
@Email @Size(max = 128) String email,
@NotBlank String memberType,
@Size(max = 64) String memberNo,
iam/src/main/java/com/baiyue/iam/dto/PlatformInternalUserDtos.java
+2 -2
View File
@@ -20,7 +20,7 @@ public final class PlatformInternalUserDtos {
Long authUserId,
String userType,
@NotBlank @Size(max = 64) String displayName,
@Pattern(regexp = "^1\\d{10}$") String phone,
@Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
@Email @Size(max = 128) String email,
@Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
@Size(min = 8, max = 64)
@@ -31,7 +31,7 @@ public final class PlatformInternalUserDtos {
public record UpdateInternalUserRequest(
@NotBlank @Size(max = 64) String displayName,
@Pattern(regexp = "^1\\d{10}$") String phone,
@Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
@Email @Size(max = 128) String email,
@NotBlank @Size(max = 64) String memberNo,
@NotNull List<Long> roleIds) { }
iam/src/main/java/com/baiyue/iam/dto/PlatformUserManagementDtos.java
+2 -2
View File
@@ -16,7 +16,7 @@ public final class PlatformUserManagementDtos {
public record CreateUserRequest(
@NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
@NotBlank @Size(max = 64) String displayName,
@NotBlank @Pattern(regexp = "^1\\d{10}$", message = "手机号格式不正确") String phone,
@NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$", message = "手机号格式不正确") String phone,
@Email @Size(max = 128) String email,
@NotNull Long tenantId,
@NotNull List<Long> roleIds,
@@ -32,7 +32,7 @@ public final class PlatformUserManagementDtos {
public record UpdateUserRequest(
@NotBlank @Size(max = 64) String displayName,
@NotBlank @Pattern(regexp = "^1\\d{10}$", message = "手机号格式不正确") String phone,
@NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$", message = "手机号格式不正确") String phone,
@Email @Size(max = 128) String email,
@NotNull Long tenantId,
@NotNull List<Long> roleIds,
iam/src/main/java/com/baiyue/iam/dto/ProfileDtos.java
+1 -1
View File
@@ -17,7 +17,7 @@ public final class ProfileDtos {
public record ChangeLoginIdentifiersRequest(
@NotBlank @Pattern(regexp = "^[A-Za-z][A-Za-z0-9_.@-]{3,63}$") String username,
@NotBlank @Pattern(regexp = "^1\\d{10}$") String phone,
@NotBlank @Pattern(regexp = "^1[3-9]\\d{9}$") String phone,
@NotBlank String currentPassword) { }
public record AddressRequest(@NotBlank String addressType, String countryCode, String province,
iam/src/main/resources/openapi/iam-v1.yaml
+8 -8
View File
@@ -982,7 +982,7 @@ components:
authUserId: {type: string, pattern: '^\d+$'}
username: {type: string, pattern: '^[A-Za-z][A-Za-z0-9_.@-]{3,63}$'}
displayName: {type: string, maxLength: 64}
phone: {type: string, pattern: '^1\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\d{9}$'}
email: {type: string, format: email, nullable: true}
UpdatePersonalProfileRequest:
type: object
@@ -995,7 +995,7 @@ components:
required: [username, phone, currentPassword]
properties:
username: {type: string, pattern: '^[A-Za-z][A-Za-z0-9_.@-]{3,63}$'}
phone: {type: string, pattern: '^1\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\d{9}$'}
currentPassword: {type: string, format: password, writeOnly: true}
PersonalProfileApiResponse:
allOf:
@@ -1398,7 +1398,7 @@ components:
properties:
username: {type: string, pattern: '^[A-Za-z][A-Za-z0-9_.@-]{3,63}$'}
displayName: {type: string, maxLength: 64}
phone: {type: string, pattern: '^1\\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\\d{9}$'}
email: {type: string, format: email, maxLength: 128}
tenantId: {type: integer, format: int64, enum: [0], description: 保留的兼容字段，只允许平台技术作用域 0}
roleIds: {type: array, minItems: 1, items: {type: integer, format: int64}}
@@ -1410,7 +1410,7 @@ components:
required: [displayName, phone, tenantId, roleIds]
properties:
displayName: {type: string, maxLength: 64}
phone: {type: string, pattern: '^1\\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\\d{9}$'}
email: {type: string, format: email, maxLength: 128}
tenantId: {type: integer, format: int64, enum: [0], description: 保留的兼容字段，只允许平台技术作用域 0}
roleIds: {type: array, minItems: 1, items: {type: integer, format: int64}}
@@ -1424,7 +1424,7 @@ components:
username: {type: string, pattern: '^[A-Za-z][A-Za-z0-9_.@-]{3,63}$'}
password: {type: string, format: password, minLength: 8, maxLength: 64, writeOnly: true}
displayName: {type: string, maxLength: 64}
phone: {type: string, pattern: '^1\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\d{9}$'}
email: {type: string, format: email, maxLength: 128}
memberNo: {type: string, maxLength: 64}
roleIds: {type: array, items: {type: integer, format: int64}}
@@ -1433,7 +1433,7 @@ components:
required: [displayName, memberNo, roleIds]
properties:
displayName: {type: string, maxLength: 64}
phone: {type: string, pattern: '^1\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\d{9}$'}
email: {type: string, format: email, maxLength: 128}
memberNo: {type: string, maxLength: 64}
roleIds: {type: array, items: {type: integer, format: int64}}
@@ -1495,7 +1495,7 @@ components:
username: {type: string, pattern: '^[A-Za-z][A-Za-z0-9_.@-]{3,63}$'}
password: {type: string, format: password, minLength: 8, maxLength: 64}
displayName: {type: string, maxLength: 64}
phone: {type: string, pattern: '^1\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\d{9}$'}
email: {type: string, format: email, maxLength: 128}
memberType: {type: string, enum: [EMPLOYEE]}
memberNo: {type: string}
@@ -1508,7 +1508,7 @@ components:
required: [displayName, memberType]
properties:
displayName: {type: string, maxLength: 64}
phone: {type: string, pattern: '^1\d{10}$'}
phone: {type: string, pattern: '^1[3-9]\d{9}$'}
email: {type: string, format: email, maxLength: 128}
memberType: {type: string, enum: [EMPLOYEE]}
memberNo: {type: string, maxLength: 64}