wangjia
77ce809d48
两个真问题,前者被后者掩盖: 1. mailer.go 把带显示名的 SMTP_FROM(「穿山甲 <noreply@x>」)直接当 SMTP 信封发件人(MAIL FROM)传给 smtp.SendMail,Resend 报 501 Bad sender address syntax → 验证码发不出。改用 net/mail 解析出裸地址作信封发件人,From: 头 仍保留完整显示名。 2. service.go 两处异步发信把错误静默吞了(_ = SendCode/SendAlreadyRegistered), 导致 SMTP 故障日志无痕、难排查(本次端口被封+501 都被吞)。改为失败时 slog.Error 记日志,邮箱经 maskEmail 打码,绝不记验证码(守 no-secret-in-logs)。 测试:TestEnvelopeFrom(显示名/裸址/unicode → 裸址)守 501 回归;TestMaskEmail 守日志脱敏。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
1.3 KiB
Go
43 lines
1.3 KiB
Go
package auth
|
|
|
|
import "testing"
|
|
|
|
// TestEnvelopeFrom guards the "501 Bad sender address syntax" regression:
|
|
// SMTP_FROM may carry a display name for the From: header, but the SMTP
|
|
// envelope sender (MAIL FROM) must be a bare address.
|
|
func TestEnvelopeFrom(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
from string
|
|
want string
|
|
}{
|
|
{"display name + unicode", "穿山甲 <noreply@mail.51yanmei.com>", "noreply@mail.51yanmei.com"},
|
|
{"display name ascii", "Pangolin <no-reply@pangolin.app>", "no-reply@pangolin.app"},
|
|
{"bare address", "no-reply@pangolin.app", "no-reply@pangolin.app"},
|
|
{"angle only", "<noreply@mail.51yanmei.com>", "noreply@mail.51yanmei.com"},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
m := NewSMTPMailer(SMTPConfig{From: tc.from})
|
|
if got := m.envelopeFrom(); got != tc.want {
|
|
t.Fatalf("envelopeFrom(%q) = %q, want %q", tc.from, got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestMaskEmail verifies error-log masking never leaks a full address.
|
|
func TestMaskEmail(t *testing.T) {
|
|
cases := map[string]string{
|
|
"chenxin880812@gmail.com": "ch***@gmail.com",
|
|
"ab@x.com": "***@x.com",
|
|
"a@x.com": "***@x.com",
|
|
"not-an-email": "***",
|
|
}
|
|
for in, want := range cases {
|
|
if got := maskEmail(in); got != want {
|
|
t.Errorf("maskEmail(%q) = %q, want %q", in, got, want)
|
|
}
|
|
}
|
|
}
|