fix: lower admin password minimum

2026-08-22 21:13:57 +08:00
parent 716c2917d4
commit 78c42eff53
7 changed files with 32 additions and 16 deletions
@@ -53,8 +53,9 @@ public sealed class AdminAuthController(
        AdminChangePasswordRequest request,
        CancellationToken ct)
    {
-        if (request.NewPassword.Length < 12 || request.NewPassword.Length > 128)
-            return BadRequest(new ApiError("ADMIN_PASSWORD_INVALID", "新密码长度必须为 12 到 128 位"));
+        if (request.NewPassword.Length < AdminPasswordPolicy.MinLength ||
+            request.NewPassword.Length > AdminPasswordPolicy.MaxLength)
+            return BadRequest(new ApiError("ADMIN_PASSWORD_INVALID", "新密码长度必须为 6 到 128 位"));
        var principal = AdminRequestContext.Principal(HttpContext)!;
        var user = await db.AdminUsers.FirstAsync(item => item.Id == principal.UserId, ct);
        if (!BCrypt.Net.BCrypt.Verify(request.CurrentPassword, user.PasswordHash))