fix: 新增学习账号密码最少六字节 (#2)

server/app/lexgo/integration_test.go

@@ -117,10 +117,22 @@ func TestMySQLLoginUsesStoredPasswordWithoutChangingCreationPolicy(t *testing.T)
 			t.Fatalf("incorrect stored password status %d, want 401", code)
 		}
 	}
-	code, _ := callAPI(t, r, "POST", "/api/v1/accounts", token, map[string]string{"username": randomName("new"), "password": legacyPassword})
+	code, _ := callAPI(t, r, "POST", "/api/v1/accounts", token, map[string]string{"username": randomName("new"), "password": strings.Repeat("z", 5)})
 	if code != 400 {
 		t.Fatalf("short new password status %d, want 400", code)
 	}
+	for _, password := range []string{strings.Repeat("z", 6), "虚构", strings.Repeat("z", 72)} {
+		name := randomName("six")
+		code, _ = callAPI(t, r, "POST", "/api/v1/accounts", token, map[string]string{"username": name, "password": password})
+		if code != 201 {
+			t.Fatalf("valid new password status %d, want 201", code)
+		}
+		loginToken(t, r, name, password)
+	}
+	code, _ = callAPI(t, r, "POST", "/api/v1/accounts", token, map[string]string{"username": randomName("long"), "password": strings.Repeat("z", 73)})
+	if code != 400 {
+		t.Fatalf("long new password status %d, want 400", code)
+	}
 	learner, err := createAccount(db, randomName("reset"), fixturePassword, 2, u.UserId)
 	if err != nil {
 		t.Fatal(err)

server/app/lexgo/service.go

@@ -87,10 +87,13 @@ func loginCredentials(username, password string) (string, error) {
 func digest(token string) string { v := sha256.Sum256([]byte(token)); return hex.EncodeToString(v[:]) }
 
 func createAccount(tx *gorm.DB, username, password string, role, actor int) (Account, error) {
-	name, err := credentials(username, password)
+	name, err := loginCredentials(username, password)
 	if err != nil {
 		return Account{}, err
 	}
+	if len(password) < 6 {
+		return Account{}, failure(400, "密码须为 6～72 字节")
+	}
 	u := admin.SysUser{Username: name, Password: password, RoleId: role, Status: "2"}
 	u.CreateBy = actor
 	// Keep the upstream bcrypt BeforeCreate hook; never use BeforeUpdate for status changes.