pro/im_server
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use fixed code for registration verification

Browse Source
This commit is contained in:
richjohnrambo
2026-08-19 16:52:20 +08:00
parent 219ecadf4c
commit 405dad2eef
2 changed files with 20 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/im_http.go
+8 -5
View File
@@ -664,12 +664,15 @@ func serveIMVerificationCodes(wrt http.ResponseWriter, req *http.Request) {
writeIMError(wrt, req, http.StatusInternalServerError, 90000, imReasonInternal, "internal error", nil)
return
}
code, err := randomIMNumericCode(imVerificationCodeLength)
if err != nil {
writeIMError(wrt, req, http.StatusInternalServerError, 90000, imReasonInternal, "internal error", nil)
return
code := "123456"
if scene != "register" {
code, err = randomIMNumericCode(imVerificationCodeLength)
if err != nil {
writeIMError(wrt, req, http.StatusInternalServerError, 90000, imReasonInternal, "internal error", nil)
return
}
}
deliveryEnabled := scene != "register" || registrationSMSEnabled(now)
deliveryEnabled := scene != "register" && registrationSMSEnabled(now)
vc := &types.VerificationCode{
TenantID: tenant.ID,
ChallengeID: challengeID,
server/im_http_test.go
+12 -10
View File
@@ -1251,12 +1251,8 @@ func TestServeIMVerificationCodesCreatesChallenge(t *testing.T) {
verifications := &testVerificationStore{}
store.Verifications = verifications
setRegistrationSMSConfigForTest(true)
var deliveredCode string
sendIMVerificationCode = func(_ types.TenantID, recipient, _, scene, code string) error {
if recipient != "+8613800138000" || scene != "register" {
t.Fatalf("unexpected delivery: recipient=%q scene=%q", recipient, scene)
}
deliveredCode = code
t.Fatalf("registration SMS sender must not be called before SMS integration: recipient=%q scene=%q code=%q", recipient, scene, code)
return nil
}
defer func() {
@@ -1286,10 +1282,9 @@ func TestServeIMVerificationCodesCreatesChallenge(t *testing.T) {
if verifications.created.CodeHash == "" || strings.Contains(rec.Body.String(), verifications.created.CodeHash) {
t.Fatalf("code hash missing or leaked: %#v body=%s", verifications.created, rec.Body.String())
}
if len(deliveredCode) != imVerificationCodeLength ||
verifications.created.CodeHash != hashIMSecret(7, "register", verifications.created.ChallengeID,
verifications.created.PhoneHash, deliveredCode) {
t.Fatalf("stored challenge does not match delivered code %q", deliveredCode)
if verifications.created.CodeHash != hashIMSecret(7, "register", verifications.created.ChallengeID,
verifications.created.PhoneHash, "123456") {
t.Fatalf("stored challenge does not match fixed registration code")
}
resp := decodeIMHTTPResponse(t, rec)
data := resp.Data.(map[string]any)
@@ -1376,21 +1371,28 @@ func TestServeIMPasswordResetCodeFindsPhoneWithoutTelCredential(t *testing.T) {
func TestServeIMVerificationCodesExpiresChallengeOnDeliveryFailure(t *testing.T) {
oldTenants := store.Tenants
oldVerifications := store.Verifications
oldUsers := store.Users
oldSender := sendIMVerificationCode
store.Tenants = testTenantStore{tenant: &types.Tenant{ID: 7, Code: "acme", State: types.TenantStateActive}}
verifications := &testVerificationStore{}
store.Verifications = verifications
setRegistrationSMSConfigForTest(true)
ctrl := gomock.NewController(t)
defer ctrl.Finish()
users := mock_store.NewMockUsersPersistenceInterface(ctrl)
users.EXPECT().GetByPhone(types.TenantID(7), "+8613800138000").Return(types.Uid(42), nil)
store.Users = users
sendIMVerificationCode = func(_ types.TenantID, _, _, _, _ string) error { return types.ErrInternal }
defer func() {
store.Tenants = oldTenants
store.Verifications = oldVerifications
store.Users = oldUsers
sendIMVerificationCode = oldSender
resetRegistrationSMSConfigForTest()
}()
req := httptest.NewRequest(http.MethodPost, "/v1/im/auth/verification-codes",
bytes.NewBufferString(`{"scene":"register","phone":"+8613800138000"}`))
bytes.NewBufferString(`{"scene":"reset_password","phone":"+8613800138000"}`))
req.Header.Set("X-Tinode-APIKey", makeTestAPIKey(t))
req.Header.Set("X-Tenant-Code", "acme")
rec := httptest.NewRecorder()