Files
sub2api/backend/internal/service/registration_email_alias_test.go
T
shaw bc3acd6e28 fix(auth): 收紧注册别名查重(根点绕过 / 误拒 / 无界扫描 / 并发竞态)
对 #4814 的审计跟进修复:

- 域名尾随点绕过:user@gmail.com. 的域名不在 gmail 家族名单内,点号折叠与
  googlemail 归一被整体跳过,别名刷号原样可复现。归一化入口统一去掉 FQDN 根点。
- 误拒合法用户:剥 "+后缀" 缺空串守卫,+alice@ 与 +bob@ 都折叠成 @domain,
  该域后续 "+x@" 注册会永久 EMAIL_EXISTS 且无自助恢复。改为仅当 "+" 不在首位时剥离。
- 无界不可索引全表扫描:原实现按 LOWER(email) LIKE '%@domain' 把整域邮箱读进内存,
  且挂在公开未鉴权的 send-verify-code 上。改为按去点邮箱
  REPLACE(LOWER(TRIM(email)), '.', '') 做等值 + "local+%@domain" 前缀探针并带 LIMIT,
  新增同表达式的部分索引(migrations/190)。TRIM 口径与既有精确匹配一致,
  历史带首尾空白的行同样命中;LIKE 元字符转义,% 与 _ 不会扩大匹配面。
- 并发竞态:注册改走 CreateWithEmailAliasGuard,在邮箱唯一性锁上追加收件箱身份锁并在
  锁内复查,避免同一收件箱的多个别名变体同时通过服务层前置查重。管理员建号仍走
  Create,不受别名限制。
- 能力断言静默 fail-open:别名查重方法上提到 UserRepository 端口(编译期强制),
  移除可选接口类型断言与静默降级分支。
- OAuth 邮箱注册的两条建号路径(同样发放注册赠额)纳入同一查重口径;邮箱换绑/绑定
  不纳入,否则用户把邮箱改成自己收件箱的别名会被误拒。
2026-07-25 19:40:53 +08:00

165 lines
5.5 KiB
Go

//go:build unit
package service
import (
"context"
"errors"
"testing"
"github.com/stretchr/testify/require"
)
func TestNormalizeEmailForAliasDedup(t *testing.T) {
cases := []struct {
name string
email string
want string
}{
{"plain", "user@example.com", "user@example.com"},
{"uppercase and spaces", " User@Example.COM ", "user@example.com"},
{"plus alias stripped", "user+tag@example.com", "user@example.com"},
{"gmail plus alias", "someone+bulk294@gmail.com", "someone@gmail.com"},
{"gmail dots removed", "some.one@gmail.com", "someone@gmail.com"},
{"gmail dots and plus", "s.o.m.e+x@gmail.com", "some@gmail.com"},
{"googlemail folded to gmail", "user@googlemail.com", "user@gmail.com"},
{"non-gmail keeps dots", "first.last@qq.com", "first.last@qq.com"},
{"fqdn root dot dropped", "d.axis.2026@gmail.com.", "daxis2026@gmail.com"},
{"fqdn root dot on other domain", "first.last@qq.com.", "first.last@qq.com"},
{"leading plus keeps local part", "+alice@gmail.com", "+alice@gmail.com"},
{"dot-only local part kept", "...@gmail.com", "...@gmail.com"},
{"invalid keeps lowered raw", "not-an-email", "not-an-email"},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
require.Equal(t, tc.want, NormalizeEmailForAliasDedup(tc.email))
})
}
}
func TestNormalizeEmailForAliasDedupKeepsDistinctInboxes(t *testing.T) {
// 剥离 "+后缀" 不能把同域下不同用户折叠成同一身份。
require.NotEqual(t,
NormalizeEmailForAliasDedup("+alice@gmail.com"),
NormalizeEmailForAliasDedup("+bob@gmail.com"),
)
require.NotEqual(t,
NormalizeEmailForAliasDedup("alice@gmail.com"),
NormalizeEmailForAliasDedup("bob@gmail.com"),
)
}
func TestEmailAliasDedupProbes(t *testing.T) {
require.ElementsMatch(t,
[]EmailAliasProbe{{Local: "someone", Domain: "gmailcom"}, {Local: "someone", Domain: "googlemailcom"}},
EmailAliasDedupProbes("Some.One+tag@gmail.com"),
)
require.ElementsMatch(t,
[]EmailAliasProbe{{Local: "daxis2026", Domain: "gmailcom"}, {Local: "daxis2026", Domain: "googlemailcom"}},
EmailAliasDedupProbes("d.axis.2026@googlemail.com."),
)
require.Equal(t,
[]EmailAliasProbe{{Local: "firstlast", Domain: "qqcom"}},
EmailAliasDedupProbes("first.last+tag@qq.com"),
)
require.Nil(t, EmailAliasDedupProbes("not-an-email"))
require.Nil(t, EmailAliasDedupProbes("...@gmail.com"))
}
// aliasDedupRepoStub implements only the methods alias dedup uses; other
// UserRepository methods come from the embedded nil interface (a wrong call
// would panic, failing the test).
type aliasDedupRepoStub struct {
UserRepository
exists bool
existsErr error
stored []string
aliasErr error
aliasChecks []string
}
func (s *aliasDedupRepoStub) ExistsByEmail(context.Context, string) (bool, error) {
return s.exists, s.existsErr
}
func (s *aliasDedupRepoStub) ExistsByEmailAlias(_ context.Context, email string) (bool, error) {
s.aliasChecks = append(s.aliasChecks, email)
if s.aliasErr != nil {
return false, s.aliasErr
}
identity := NormalizeEmailForAliasDedup(email)
for _, candidate := range s.stored {
if NormalizeEmailForAliasDedup(candidate) == identity {
return true, nil
}
}
return false, nil
}
func TestExistsByEmailOrAlias(t *testing.T) {
ctx := context.Background()
t.Run("exact duplicate short-circuits", func(t *testing.T) {
repo := &aliasDedupRepoStub{exists: true}
svc := &AuthService{userRepo: repo}
got, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
require.NoError(t, err)
require.True(t, got)
require.Empty(t, repo.aliasChecks, "no alias probe expected after exact hit")
})
t.Run("plus alias variant detected", func(t *testing.T) {
repo := &aliasDedupRepoStub{stored: []string{"someone+bulk294@gmail.com"}}
svc := &AuthService{userRepo: repo}
got, err := svc.existsByEmailOrAlias(ctx, "Someone@gmail.com")
require.NoError(t, err)
require.True(t, got)
})
t.Run("gmail dot variant detected", func(t *testing.T) {
repo := &aliasDedupRepoStub{stored: []string{"some.one@gmail.com"}}
svc := &AuthService{userRepo: repo}
got, err := svc.existsByEmailOrAlias(ctx, "someone@gmail.com")
require.NoError(t, err)
require.True(t, got)
})
t.Run("fqdn root dot variant detected", func(t *testing.T) {
repo := &aliasDedupRepoStub{stored: []string{"d.axis.2026@gmail.com"}}
svc := &AuthService{userRepo: repo}
got, err := svc.existsByEmailOrAlias(ctx, "da.xis.2026@gmail.com.")
require.NoError(t, err)
require.True(t, got)
})
t.Run("different inbox allowed", func(t *testing.T) {
repo := &aliasDedupRepoStub{stored: []string{"other@gmail.com"}}
svc := &AuthService{userRepo: repo}
got, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
require.NoError(t, err)
require.False(t, got)
})
t.Run("distinct plus-prefixed locals allowed", func(t *testing.T) {
repo := &aliasDedupRepoStub{stored: []string{"+alice@gmail.com"}}
svc := &AuthService{userRepo: repo}
got, err := svc.existsByEmailOrAlias(ctx, "+bob@gmail.com")
require.NoError(t, err)
require.False(t, got)
})
t.Run("alias probe error fails closed", func(t *testing.T) {
repo := &aliasDedupRepoStub{aliasErr: errors.New("db down")}
svc := &AuthService{userRepo: repo}
_, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
require.Error(t, err)
})
t.Run("exact check error propagates", func(t *testing.T) {
repo := &aliasDedupRepoStub{existsErr: errors.New("db down")}
svc := &AuthService{userRepo: repo}
_, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
require.Error(t, err)
})
}