changes for email signup

internal/app/account/email_signup_phone_change_test.go

@@ -0,0 +1,93 @@
+package account
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"telesrv/internal/domain"
+	"telesrv/internal/store"
+	"telesrv/internal/store/memory"
+)
+
+func newEmailSignupPhoneChangeFixture(t *testing.T) (phoneChangeFixture, *captureMailSender) {
+	t.Helper()
+	ctx := context.Background()
+	users := memory.NewUserStore()
+	auths := memory.NewAuthorizationStore()
+	codes := memory.NewCodeStore()
+	events := memory.NewUpdateEventStore()
+	phone, ok := domain.EncodeEmailPhone("alice@owpengram.local")
+	if !ok {
+		t.Fatalf("EncodeEmailPhone: ok=false")
+	}
+	u, err := users.Create(ctx, domain.User{AccessHash: 101, Phone: phone, FirstName: "Alice"})
+	if err != nil {
+		t.Fatalf("create user: %v", err)
+	}
+	authKeyID := [8]byte{1, 2, 3, 4}
+	if err := auths.Bind(ctx, domain.Authorization{AuthKeyID: authKeyID, UserID: u.ID, CreatedAt: time.Now().Add(-48 * time.Hour)}); err != nil {
+		t.Fatalf("bind auth: %v", err)
+	}
+	changes := &recordingPhoneChangeStore{inner: memory.NewPhoneChangeStore(users, events)}
+	sender := &captureMailSender{}
+	service := NewService(
+		memory.NewPasswordStore(),
+		WithUsers(users),
+		WithPhoneChange(changes, auths, codes, nil, "12345", time.Minute, 3),
+		WithLoginEmailVerification(codes, sender, time.Minute, 3, 6),
+		WithEmailSignup(true),
+	)
+	return phoneChangeFixture{ctx: ctx, service: service, users: users, auths: auths, codes: codes, events: events, user: u, authKeyID: authKeyID, changes: changes}, sender
+}
+
+func TestEmailSignupChangePhoneRoutesCodeToDecodedEmail(t *testing.T) {
+	f, sender := newEmailSignupPhoneChangeFixture(t)
+	newPhone, ok := domain.EncodeEmailPhone("newmail@owpengram.local")
+	if !ok {
+		t.Fatalf("EncodeEmailPhone: ok=false")
+	}
+
+	hash, delivery, err := f.service.SendChangePhoneCode(f.ctx, f.user.ID, f.authKeyID, 77, newPhone)
+	if err != nil {
+		t.Fatalf("SendChangePhoneCode: %v", err)
+	}
+	if delivery.Kind != domain.AuthCodeDeliveryEmail {
+		t.Fatalf("delivery.Kind = %v, want AuthCodeDeliveryEmail", delivery.Kind)
+	}
+	if sender.to != "newmail@owpengram.local" {
+		t.Fatalf("sender.to = %q, want newmail@owpengram.local", sender.to)
+	}
+	if len(sender.code) != 6 {
+		t.Fatalf("sender.code = %q, want 6 digits", sender.code)
+	}
+
+	rec, found, err := f.codes.Get(f.ctx, hash)
+	if err != nil || !found {
+		t.Fatalf("load code found=%v err=%v", found, err)
+	}
+	if rec.Channel != store.PhoneCodeChannelEmailLogin || rec.Email != "newmail@owpengram.local" {
+		t.Fatalf("stored code = %+v", rec)
+	}
+
+	rawAuthKeyID := [8]byte{8, 8, 8, 8}
+	result, err := f.service.ChangePhone(f.ctx, f.user.ID, f.authKeyID, rawAuthKeyID, 88, newPhone, hash, sender.code, 1700000000)
+	if err != nil {
+		t.Fatalf("ChangePhone: %v", err)
+	}
+	if result.User.Phone != newPhone {
+		t.Fatalf("result.User.Phone = %q, want %q", result.User.Phone, newPhone)
+	}
+}
+
+func TestEmailSignupChangePhoneRejectsRealPhoneNumber(t *testing.T) {
+	f, sender := newEmailSignupPhoneChangeFixture(t)
+
+	_, _, err := f.service.SendChangePhoneCode(f.ctx, f.user.ID, f.authKeyID, 77, "+15550019999")
+	if err != domain.ErrPhoneNumberInvalid {
+		t.Fatalf("SendChangePhoneCode err = %v, want ErrPhoneNumberInvalid", err)
+	}
+	if sender.to != "" {
+		t.Fatalf("sender.to = %q, want empty (no email should have been sent)", sender.to)
+	}
+}

internal/app/account/phone_change.go

@@ -42,7 +42,17 @@ func (s *Service) SendChangePhoneCode(ctx context.Context, userID int64, authKey
 	} else if found && existing.ID != 0 {
 		return "", domain.AuthCodeDelivery{}, domain.ErrPhoneNumberOccupied
 	}
-	if s.codes == nil || strings.TrimSpace(s.phoneChangeCode) == "" {
+	if s.codes == nil {
+		return "", domain.AuthCodeDelivery{}, fmt.Errorf("phone change code service is not configured")
+	}
+	// Email-as-identity mode: this server has no real SMS delivery at all, so
+	// letting an account switch to an arbitrary non-encoded number would just
+	// hand out the universal dev code with no real verification. Only numbers
+	// that decode back to an email are accepted; the code goes to that inbox.
+	if s.emailSignupEnabled {
+		return s.sendChangePhoneCodeByEmail(ctx, userID, authKeyID, sessionID, phone)
+	}
+	if strings.TrimSpace(s.phoneChangeCode) == "" {
 		return "", domain.AuthCodeDelivery{}, fmt.Errorf("phone change code service is not configured")
 	}
 	hash, err := phoneChangeHash()
@@ -66,6 +76,44 @@ func (s *Service) SendChangePhoneCode(ctx context.Context, userID int64, authKey
 	return hash, domain.AuthCodeDelivery{Kind: domain.AuthCodeDeliverySMS, Length: len(rec.Code)}, nil
 }
 
+func (s *Service) sendChangePhoneCodeByEmail(ctx context.Context, userID int64, authKeyID [8]byte, sessionID int64, phone string) (string, domain.AuthCodeDelivery, error) {
+	email, ok := domain.DecodeEmailPhone(phone)
+	if !ok {
+		return "", domain.AuthCodeDelivery{}, domain.ErrPhoneNumberInvalid
+	}
+	if s.loginEmailSender == nil {
+		return "", domain.AuthCodeDelivery{}, fmt.Errorf("email signup sender is not configured")
+	}
+	code, err := randomDigits(6)
+	if err != nil {
+		return "", domain.AuthCodeDelivery{}, err
+	}
+	hash, err := phoneChangeHash()
+	if err != nil {
+		return "", domain.AuthCodeDelivery{}, err
+	}
+	ttl := s.phoneChangeCodeTTL
+	rec := store.PhoneCode{
+		Version:     store.PhoneCodeVersionCurrent,
+		Phone:       phone,
+		Code:        code,
+		Channel:     store.PhoneCodeChannelEmailLogin,
+		Purpose:     store.PhoneCodePurposeChangePhone,
+		Email:       email,
+		UserID:      userID,
+		AuthKeyID:   authKeyID,
+		SessionID:   sessionID,
+		MaxAttempts: s.phoneChangeMaxAttempts,
+	}
+	if err := s.codes.Set(ctx, hash, rec, ttl); err != nil {
+		return "", domain.AuthCodeDelivery{}, fmt.Errorf("store phone change code: %w", err)
+	}
+	if err := s.loginEmailSender.SendLoginCode(ctx, email, code, ttl); err != nil {
+		return "", domain.AuthCodeDelivery{}, fmt.Errorf("send phone change email code: %w", err)
+	}
+	return hash, domain.AuthCodeDelivery{Kind: domain.AuthCodeDeliveryEmail, EmailPattern: emailPattern(email), Length: len(code)}, nil
+}
+
 // ChangePhone 验证作用域和验证码后执行原子改号。返回事件用于当前 session 的
 // pts 簿记；其它 session 由 transactional outbox 投递 updateUserPhone。
 func (s *Service) ChangePhone(ctx context.Context, userID int64, authKeyID, originRawAuthKeyID [8]byte, sessionID int64, phone, phoneCodeHash, code string, date int) (domain.PhoneChangeResult, error) {
@@ -107,7 +155,8 @@ func (s *Service) ChangePhone(ctx context.Context, userID int64, authKeyID, orig
 		return domain.PhoneChangeResult{}, domain.ErrPhoneNumberOccupied
 	}
 	consumed := verified.Record
-	if consumed.Version != store.PhoneCodeVersionCurrent || consumed.Scope() != scope || consumed.Channel != store.PhoneCodeChannelPhone {
+	channelOK := consumed.Channel == store.PhoneCodeChannelPhone || consumed.Channel == store.PhoneCodeChannelEmailLogin
+	if consumed.Version != store.PhoneCodeVersionCurrent || consumed.Scope() != scope || !channelOK {
 		return domain.PhoneChangeResult{}, domain.ErrPhoneCodeInvalid
 	}
 	if date == 0 {

internal/app/account/service.go

@@ -51,6 +51,10 @@ type Service struct {
 	loginEmailCodeTTL         time.Duration
 	loginEmailCodeMaxAttempts int
 	loginEmailCodeLength      int
+	// emailSignupEnabled 打开后，SendChangePhoneCode 只接受 888 前缀（邮箱编码）目标号码，
+	// 验证码走 loginEmailSender 发到解码出的邮箱；非 888 号码一律拒绝——本服务器没有真实
+	// 短信通道，放行会让账号的邮箱身份绑定被绕过（见迁移前的密码找回验证码漏洞教训）。
+	emailSignupEnabled bool
 }
 
 // ServiceOption 调整 account 服务依赖。
@@ -152,6 +156,13 @@ func WithLoginEmailVerification(codes store.CodeStore, sender mail.Sender, ttl t
 	}
 }
 
+// WithEmailSignup 打开「邮箱即身份」模式下的改号限制：见 emailSignupEnabled 字段注释。
+func WithEmailSignup(enabled bool) ServiceOption {
+	return func(s *Service) {
+		s.emailSignupEnabled = enabled
+	}
+}
+
 // NewService 创建 account 服务。
 func NewService(passwords store.PasswordStore, opts ...ServiceOption) *Service {
 	s := &Service{