调整部分前端布局和后端增删改逻辑

shierfeng-fastapi-backend/tests/test_log_sanitize_util.py

@@ -7,6 +7,7 @@ from datetime import datetime
 from types import SimpleNamespace
 from unittest.mock import patch
 
+import bcrypt
 import pytest
 from fastapi import Request
 from loguru import logger as _logger
@@ -16,6 +17,8 @@ sys.path.insert(0, os.path.dirname(os.path.dirname(__file__)))
 from common.annotation.log_annotation import Log, RequestLogFieldRoot, ResponseLogFieldRoot
 from common.enums import BusinessType
 from config.env import LogConfig
+from exceptions.exception import LoginException
+from module_admin.service import login_service
 from utils.log_util import LoggerInitializer, LogSanitizer, _build_text_assignment_patterns, _build_text_key_pattern
 
 
@@ -47,6 +50,50 @@ def test_sanitize_nested_log_payload() -> None:
     assert sanitized['jsonBody']['ipaddr'] == '192.168.1.10'
 
 
+def test_failed_login_does_not_log_password_hash() -> None:
+    password_hash = bcrypt.hashpw(b'expected-password', bcrypt.gensalt()).decode('utf-8')
+
+    class FakeRedis:
+        async def get(self, key: str) -> None:
+            return None
+
+        async def set(self, key: str, value: object, ex: object) -> None:
+            return None
+
+        async def delete(self, key: str) -> None:
+            return None
+
+    async def fake_login_by_account(query_db: object, user_name: str) -> list[SimpleNamespace]:
+        return [SimpleNamespace(password=password_hash, status='0')]
+
+    request = SimpleNamespace(
+        app=SimpleNamespace(state=SimpleNamespace(redis=FakeRedis())),
+        client=SimpleNamespace(host='127.0.0.1'),
+        headers={},
+    )
+    login_user = SimpleNamespace(user_name='admin', password='wrong-password', captcha_enabled=False)
+    log_messages: list[str] = []
+    sink_id = login_service.logger.add(
+        lambda message: log_messages.append(str(message)),
+        format='{message}',
+        level='WARNING',
+    )
+
+    try:
+        with (
+            patch.object(login_service, 'login_by_account', fake_login_by_account),
+            pytest.raises(LoginException) as exception_info,
+        ):
+            asyncio.run(login_service.LoginService.authenticate_user(request, None, login_user))
+    finally:
+        login_service.logger.remove(sink_id)
+
+    output = ''.join(log_messages)
+    assert exception_info.value.message == '密码错误'
+    assert '密码错误' in output
+    assert password_hash not in output
+
+
 def test_ip_masking_can_be_enabled_by_partial_mask_field_configuration() -> None:
     payload = {
         'jsonBody': {