fix(auth): 固定验证码改为显式 AUTH_EMAIL_DEV_CODE 环境开关（安全评审反馈）

不再从 mailer 运行时类型推导认证材料：固定码仅当显式设置 AUTH_EMAIL_DEV_CODE 时生效（run-dev.sh 设 888888，生产部署不经该脚本即为随机码），设置时启动打印醒目告警。 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-07-11 20:42:11 +08:00
parent 7dccd694e0
commit 8266c575aa
6 changed files with 16 additions and 6 deletions
@@ -94,7 +94,10 @@ func Register(r *gin.Engine, d *Deps) {
 		"asr_provider", providerKind, "wechat", wechatKind, "pay", payKind,
 		"storage", storageKind, "mailer", mailerKind)

-	authH := &auth.Handlers{DB: d.DB, RDB: d.RDB, JWT: d.JWT, Wechat: wechat, Mailer: mailer}
+	if d.Cfg.EmailDevCode != "" {
+		slog.Warn("⚠️ AUTH_EMAIL_DEV_CODE 已设置：邮箱验证码为固定值，任何人可登录任意邮箱账号——生产环境严禁")
+	}
+	authH := &auth.Handlers{DB: d.DB, RDB: d.RDB, JWT: d.JWT, Wechat: wechat, Mailer: mailer, DevCode: d.Cfg.EmailDevCode}
 	billH := &billing.Handlers{DB: d.DB, Pay: pay, Quota: d.Quota}
 	userH := &user.Handlers{DB: d.DB, Quota: d.Quota, AppVersions: d.Cfg.AppLatest}
 	fbH := &feedback.Handlers{DB: d.DB, RDB: d.RDB, Storage: storage}