fix: 新增学习账号密码最少六字节 (#2)

admin/tests/session.test.mjs

@@ -15,6 +15,23 @@ test('normalizes account names and enforces UTF-8 password byte limits', () => {
   assert.equal(validPassword('短'), false)
   assert.equal(validPassword('虚'.repeat(25)), false)
 })
+test('creation accepts six bytes but rejects five and over 72; reset retains its minimum', async () => {
+  const writes = []
+  const { session } = setup(async (url, options) => {
+    if (url.endsWith('/login')) return response({ token: 'fictional-admin-token', user: admin })
+    writes.push(JSON.parse(options.body))
+    return response(learner)
+  })
+  await session.login(admin.username, 'fictional-password')
+  await assert.rejects(session.createAccount('fixture.new', 'z'.repeat(5)))
+  await assert.rejects(session.createAccount('fixture.new', 'z'.repeat(73)))
+  await session.createAccount('fixture.new', 'z'.repeat(6))
+  await session.createAccount('fixture.unicode', '虚构')
+  await session.createAccount('fixture.maximum', 'z'.repeat(72))
+  assert.equal(writes.length, 3)
+  await assert.rejects(session.updateAccount(learner.id, { password: 'z'.repeat(6) }))
+})
+
 test('learner login is rejected, revoked, and never stored in admin session', async () => {
   const requests = []
   const { session, data } = setup(async (url, options) => {