diff --git a/.project-docs/30-worklog/tasks/20260902-registration-invalid-params-59f94692.md b/.project-docs/30-worklog/tasks/20260902-registration-invalid-params-59f94692.md index da487df..9ded14d 100644 --- a/.project-docs/30-worklog/tasks/20260902-registration-invalid-params-59f94692.md +++ b/.project-docs/30-worklog/tasks/20260902-registration-invalid-params-59f94692.md @@ -14,31 +14,35 @@ - Diagnose the current account-creation failure reported as “请求参数不符合要求”。 - Correlate the operator form contract, API payload, server-side validation, privacy-safe runtime diagnostics, and account authorization tests. -- Add a narrowly scoped client-side validation and error-feedback fix plus regression coverage. +- Apply the user's superseding product decision: passwords have no length restriction beyond being non-empty, and the first-login forced-password-change flow is removed. +- Update the account UI, API validation, authentication mapping, compatibility writes, documentation, and regression coverage as one coherent change. - Do not create or change a real account, read secrets or request payloads, deploy, restart the service, or modify ERP behavior. ## Intent And Constraints - Preserve the accepted fixed-scope `admin` / `team_lead` / `user` account and authorization model. -- Keep the server-side 12–512-character password boundary unchanged; prevent invalid form input from reaching the API and retain a safe backend-validation fallback. +- Accept any non-empty password for login, account creation, administrator reset, and self-service password change; do not impose a minimum or maximum length in the application contract. +- Remove the first-login forced-password-change behavior while retaining voluntary self-service password changes, administrator resets, and session revocation after password changes. +- Keep the historical `must_change_password` database column as compatibility-only storage; runtime authorization and UI behavior must not depend on it, and password writes clear it to `false`. - Use runtime diagnostics only for validation field names; do not persist account names, passwords, request bodies, or other user data. -- Treat the concurrent compact-dashboard task as a file-level overlap warning only; keep this change limited to the account form and its tests for later reconciliation. +- Reconcile this isolated feature with concurrent main-branch dashboard work only after the main worktree ownership gate is released. ## Outcome - Privacy-safe diagnostics from the running standard service showed the two recent HTTP validation failures both had only `validation_paths=["password"]`; no request content was inspected. -- Confirmed the mismatch: the API requires a 12–512-character password, while the account form used `novalidate` and submitted without an equivalent client-side check, causing a short password to surface only as the generic Zod response. -- Added deterministic account-create validation before any API request. Invalid username, password, or role values now show a Chinese field-specific message, mark and focus the relevant field, and do not send a request. -- Preserved safe backend fallback handling by retaining `error_code` and validation paths from API errors and mapping a server-side password rejection to the same actionable message. -- Added the password requirement beside the form field and added focused regression coverage for short-password rejection, valid request normalization, backend fallback messaging, and visible form guidance. +- Confirmed the original mismatch: the API required 12–512 characters while the form submitted under `novalidate`, so a short password reached Zod validation and surfaced as the generic message. +- The initial length-guidance fix was superseded by the user's explicit direction. Account creation, reset, login, and self-service change now reject only an empty password and accept short non-empty values. +- Removed the “首次登录必须修改密码” option, forced-password-change screen state, forced route/mutation gate, response flag, and account-list badge. The normal voluntary “修改密码” control remains available. +- Existing `must_change_password` values no longer affect sessions or authorization; new account creation and password writes leave or force the compatibility column to `false`. +- Added regression assertions covering one-character account passwords, empty-password rejection, absence of length rules, and absence of the first-login forced-change contract. - No live account, database, service process, deployment, ERP state, or external system was changed. ## Verification -- Focused account-form regression: 4/4 passed. -- Focused account-authorization regression: 8/8 passed. +- Focused account-form regression: 4/4 passed after the superseding product change. +- Focused account-authorization regression: 8/8 passed after the superseding product change. - `node --check LianSyn-platform/app.js`: passed. -- `git diff --check`: passed before the final documentation update. +- `git diff --check`: passed after the final code and documentation update. - `node --run check:repo`: 10/10 passed. - `node --run check`: passed. - `node --run test:control-plane`: 153/153 passed. @@ -50,11 +54,16 @@ ## Follow-ups -- Integrate this isolated feature change with the concurrent dashboard layout work, then restart or redeploy the standard service only under separate explicit authorization before expecting the live `/accounts` page to change. +- Merge this isolated feature into `main` after the concurrent main-worktree task releases ownership; the user explicitly authorized the merge. +- Restart or redeploy the standard service only under separate explicit authorization before expecting backend behavior to change in the running process. ## Promotion Candidates -- None recorded. +- Target documents: `10-project-memory/architecture/system-overview.md`, `10-project-memory/decisions/AUTH-001-fixed-scope-account-isolation.md`, and `20-business-memory/business-rules.md`. +- Proposed durable fact: application passwords are required to be non-empty but have no application-level length restriction; first-login forced password changes are disabled. Voluntary password change, administrator reset, and session revocation remain supported. +- Evidence: this task's focused regressions, full repository verification, and the linked privacy-safe diagnosis record. +- Future-task impact: account UI/API/schema changes must not reintroduce a length rule or `must_change_password`-based gate without a new product decision and migration plan. +- Human confirmation: explicitly provided by the user on 2026-09-02. ## Supporting Records diff --git a/.project-docs/50-evidence/topics/20260902-registration-invalid-params-59f94692__account-registration-password-validation.md b/.project-docs/50-evidence/topics/20260902-registration-invalid-params-59f94692__account-registration-password-validation.md index 8469536..5c1c5b6 100644 --- a/.project-docs/50-evidence/topics/20260902-registration-invalid-params-59f94692__account-registration-password-validation.md +++ b/.project-docs/50-evidence/topics/20260902-registration-invalid-params-59f94692__account-registration-password-validation.md @@ -8,10 +8,17 @@ ## Finding - The two recent `http.request.invalid` events both reported only the validation path `password`. -- The server contract requires an initial password length of 12–512 characters. +- At the inspected base commit, the server contract required an initial password length of 12–512 characters. - The HTML field declared the same `minlength` and `maxlength`, but the account form used `novalidate` and the JavaScript request path did not perform its own validation before calling `/api/accounts`. - Therefore a short initial password reached server-side Zod validation and the UI displayed the generic response “请求参数不符合要求。” instead of the actual password requirement. +## User Decision And Resolution + +- The user explicitly superseded the original password-length contract: all password entry points now require only a non-empty value and impose no application-level minimum or maximum length. +- The user also directed removal of the first-login forced-password-change flow. The UI option, session flag, route gate, account badge, and forced panel state were removed; voluntary password changes remain available. +- The historical `must_change_password` database column is retained only for schema compatibility and is ignored by runtime authorization. Password writes clear it to `false`. +- This change was implemented and verified in an isolated feature worktree. No running service was restarted and no live account or database row was mutated. + ## Privacy And Safety - Only diagnostic event type and validation field paths were extracted. @@ -20,8 +27,8 @@ ## Confidence -- High. Runtime field-path evidence, the active form behavior, and the server schema all identify the same password-length mismatch. +- High. Runtime field-path evidence and the inspected base contract identify the original mismatch; the replacement behavior is directly confirmed by the user's product decision and regression coverage. ## Stale Trigger -- Reassess if the password contract, account form submission flow, or generic API validation response changes. +- Reassess if a future product decision introduces password policy requirements, a forced-password-change lifecycle, or a replacement for the compatibility column. diff --git a/LianSyn-platform/app-account-form.test.mjs b/LianSyn-platform/app-account-form.test.mjs index bebd4fc..4537997 100644 --- a/LianSyn-platform/app-account-form.test.mjs +++ b/LianSyn-platform/app-account-form.test.mjs @@ -32,17 +32,18 @@ function loadNamedFunction(name) { return context.loaded; } -test('account creation rejects a short password before sending the request', () => { +test('account creation accepts any non-empty password and blocks an empty password before the request', () => { const validate = loadNamedFunction('validateAccountCreationValues'); - const result = validate({ + const empty = validate({ username: 'operator', - password: '12345678901', - role: 'user', - mustChangePassword: true + password: '', + role: 'user' }); - assert.equal(result.ok, false); - assert.equal(result.field, 'accountPassword'); - assert.equal(result.message, '初始密码必须为 12—512 个字符。'); + assert.equal(empty.ok, false); + assert.equal(empty.field, 'accountPassword'); + assert.equal(empty.message, '请输入初始密码。'); + const oneCharacter = validate({ username: 'operator', password: '1', role: 'user' }); + assert.equal(oneCharacter.ok, true); const createStart = appSource.indexOf('async function createAccountFromForm()'); const createEnd = appSource.indexOf('\n}\n\nasync function updateManagedAccount', createStart); assert.notEqual(createStart, -1); @@ -56,15 +57,14 @@ test('account creation normalizes valid form values into the server contract', ( const validate = loadNamedFunction('validateAccountCreationValues'); const result = validate({ username: ' TeamLead ', - password: 'correct-horse-battery-staple', - role: 'team_lead', - mustChangePassword: true + password: '123456', + role: 'team_lead' }); assert.equal(result.ok, true); assert.equal(result.body.username, 'TeamLead'); - assert.equal(result.body.password, 'correct-horse-battery-staple'); + assert.equal(result.body.password, '123456'); assert.equal(result.body.role, 'team_lead'); - assert.equal(result.body.must_change_password, true); + assert.equal(Object.hasOwn(result.body, 'must_change_password'), false); assert.equal(Array.isArray(result.body.business_route_ids), true); assert.equal(result.body.business_route_ids.length, 0); }); @@ -76,10 +76,11 @@ test('account creation translates backend password validation into an actionable details: ['password'], message: '请求参数不符合要求。' }); - assert.equal(message, '初始密码必须为 12—512 个字符。'); + assert.equal(message, '请输入初始密码。'); }); -test('account form states the password requirement beside the field', () => { - assert.match(indexSource, /初始密码（12—512 个字符）]+minlength="12"[^>]+maxlength="512"/u); +test('account forms expose no length rule or first-login forced-password flow', () => { + assert.match(indexSource, /初始密码]+required>/u); + assert.doesNotMatch(indexSource, /accountMustChangePassword|首次登录必须修改密码|minlength="12"|12—512/u); + assert.doesNotMatch(appSource, /passwordChangeForced|must_change_password/u); }); diff --git a/LianSyn-platform/app.js b/LianSyn-platform/app.js index 30a278b..97a0e8c 100644 --- a/LianSyn-platform/app.js +++ b/LianSyn-platform/app.js @@ -36,7 +36,6 @@ let remoteSyncInProgress = false; let syncRequested = false; let csrfToken = ''; let authUser = null; -let passwordChangeForced = false; let browserConnectionId = ''; let organizationAutomationEnabled = false; let automationSettingsLoaded = false; @@ -360,7 +359,6 @@ function showAuthChecking() { function showAuthenticatedApp(user) { authUser = user; - passwordChangeForced = Boolean(user?.must_change_password); browserConnectionId = connectionIdForUser(user); if (!isAdministrator() && IS_ADMIN_PAGE) { window.location.replace('/'); @@ -410,23 +408,19 @@ function showAuthenticatedApp(user) { } const submitButton = $('#loginForm button[type="submit"]'); if (submitButton) submitButton.disabled = false; - if (user.must_change_password) showPasswordChangePanel(true); } -function showPasswordChangePanel(forced = false) { +function showPasswordChangePanel() { if (!authUser) return; - passwordChangeForced = forced; for (const selector of ['#loginPanel', '#workbench', '#channelsPage', '#parserRoutingPage', '#accountsPage', '#auditPage', '#operationsDashboardPage']) { const page = $(selector); if (page) page.hidden = true; } const panel = $('#passwordChangePanel'); if (panel) panel.hidden = false; - $('#passwordChangeTitle').textContent = forced ? '请先设置新密码' : '修改密码'; - $('#passwordChangeHint').textContent = forced - ? '管理员已重置你的密码。继续使用平台前，请设置至少 12 个字符的新密码。' - : '新密码至少 12 个字符。修改后，其他已登录会话将失效。'; - $('#passwordChangeCancel').hidden = forced; + $('#passwordChangeTitle').textContent = '修改密码'; + $('#passwordChangeHint').textContent = '修改后，其他已登录会话将失效。'; + $('#passwordChangeCancel').hidden = false; $('#passwordChangeError').textContent = ''; $('#changePasswordButton').hidden = true; $('#automationToggleButton').hidden = true; @@ -435,7 +429,7 @@ function showPasswordChangePanel(forced = false) { function renderAutomationToggle() { const button = $('#automationToggleButton'); if (!button) return; - button.hidden = !isAdministrator() || IS_MANAGEMENT_PAGE || passwordChangeForced; + button.hidden = !isAdministrator() || IS_MANAGEMENT_PAGE; button.disabled = !authUser || automationSettingsBusy || !automationSettingsLoaded || Boolean(automationSettingsError); button.setAttribute('aria-pressed', organizationAutomationEnabled ? 'true' : 'false'); button.classList.toggle('is-enabled', organizationAutomationEnabled); @@ -902,8 +896,8 @@ function validateAccountCreationValues(values = {}) { if (!username || username.length > 160) { return { ok: false, field: 'accountUsername', message: '账号必须为 1—160 个字符。' }; } - if (password.length < 12 || password.length > 512) { - return { ok: false, field: 'accountPassword', message: '初始密码必须为 12—512 个字符。' }; + if (!password) { + return { ok: false, field: 'accountPassword', message: '请输入初始密码。' }; } if (!['admin', 'team_lead', 'user'].includes(role)) { return { ok: false, field: 'accountRole', message: '请选择有效的账号角色。' }; @@ -914,7 +908,6 @@ function validateAccountCreationValues(values = {}) { username, password, role, - must_change_password: values.mustChangePassword === true, business_route_ids: [] } }; @@ -924,7 +917,7 @@ function accountCreationErrorMessage(error) { const details = Array.isArray(error?.details) ? error.details.map((item) => String(item || '')) : []; if (error?.errorCode === 'invalid_request') { if (details.some((path) => path === 'password' || path.startsWith('password.'))) { - return '初始密码必须为 12—512 个字符。'; + return '请输入初始密码。'; } if (details.some((path) => path === 'username' || path.startsWith('username.'))) { return '账号必须为 1—160 个字符。'; @@ -970,7 +963,7 @@ function renderAccounts() { heading.append(el('strong', '', account.username)); heading.append(el('span', `state ${account.is_active ? 'state-ok' : 'state-bad'}`, account.is_active ? '有效' : '已停用')); main.append(heading); - main.append(el('p', 'muted', `${accountRoleLabel(account.role)}${account.must_change_password ? ' · 待修改密码' : ''}`)); + main.append(el('p', 'muted', accountRoleLabel(account.role))); const authorizedCount = Array.isArray(account.authorized_business_route_ids) ? account.authorized_business_route_ids.length : 0; @@ -1112,8 +1105,7 @@ async function createAccountFromForm() { const validation = validateAccountCreationValues({ username: $('#accountUsername').value, password: $('#accountPassword').value, - role: $('#accountRole').value, - mustChangePassword: $('#accountMustChangePassword').checked + role: $('#accountRole').value }); if (!validation.ok) { showAccountCreationValidationError(validation); @@ -1158,14 +1150,19 @@ async function updateManagedAccount(accountId, patch) { async function resetManagedAccountPassword(accountId) { if (!isAdministrator() || accountSettingsBusy) return; - const password = window.prompt('请输入至少 12 个字符的新密码。账号下次登录时必须修改此密码：'); + const password = window.prompt('请输入新密码：'); if (password == null) return; + if (!password) { + const message = $('#accountMessage'); + if (message) message.textContent = '密码不能为空。'; + return; + } accountSettingsBusy = true; renderAccounts(); try { await apiRequest(`/api/accounts/${encodeURIComponent(accountId)}/reset-password`, { method: 'POST', - body: { password, must_change_password: true } + body: { password } }); const message = $('#accountMessage'); if (message) message.textContent = '密码已重置，该账号的现有会话已全部撤销。'; @@ -5219,7 +5216,6 @@ async function initializeSession() { } showAuthenticatedApp(me.user); - if (me.user?.must_change_password) return true; if (isAdministrator()) { try { await syncAutomationSettings(); @@ -5320,7 +5316,6 @@ document.addEventListener('DOMContentLoaded', async () => { csrfToken = result.csrf_token || ''; showAuthenticatedApp(result.user); $('#loginPassword').value = ''; - if (result.user?.must_change_password) return; if (isAdministrator()) { await syncAutomationSettings().catch(() => setTaskState('全自动化设置读取失败')); } @@ -5343,9 +5338,9 @@ document.addEventListener('DOMContentLoaded', async () => { if (submitButton) submitButton.disabled = false; } }); - $('#changePasswordButton').addEventListener('click', () => showPasswordChangePanel(false)); + $('#changePasswordButton').addEventListener('click', showPasswordChangePanel); $('#passwordChangeCancel').addEventListener('click', () => { - if (passwordChangeForced || !authUser) return; + if (!authUser) return; showAuthenticatedApp(authUser); }); $('#passwordChangeForm').addEventListener('submit', async (event) => { @@ -5354,6 +5349,10 @@ document.addEventListener('DOMContentLoaded', async () => { const currentPassword = String($('#currentPassword').value || ''); const newPassword = String($('#newPassword').value || ''); const confirmation = String($('#confirmNewPassword').value || ''); + if (!currentPassword || !newPassword) { + errorNode.textContent = '当前密码和新密码不能为空。'; + return; + } if (newPassword !== confirmation) { errorNode.textContent = '两次输入的新密码不一致。'; return; @@ -5369,7 +5368,6 @@ document.addEventListener('DOMContentLoaded', async () => { $('#currentPassword').value = ''; $('#newPassword').value = ''; $('#confirmNewPassword').value = ''; - passwordChangeForced = false; await initializeSession(); } catch (error) { errorNode.textContent = error.message || String(error); @@ -5773,7 +5771,6 @@ document.addEventListener('DOMContentLoaded', async () => { void copyTaskLifecycle(button); }); if (await initializeSession()) { - if (authUser?.must_change_password) return; if (IS_TASK_PAGE) renderTaskCards(); pingAi().catch(() => {}); pingBridge().catch(() => {}); diff --git a/LianSyn-platform/index.html b/LianSyn-platform/index.html index 864dad1..c396110 100644 --- a/LianSyn-platform/index.html +++ b/LianSyn-platform/index.html @@ -71,11 +71,11 @@

ACCOUNT SECURITY

修改密码

-

新密码至少 12 个字符。修改后，其他已登录会话将失效。

+

修改后，其他已登录会话将失效。

- - + +
@@ -96,9 +96,8 @@
- + -