ResetPasswordByPhone and ResetPassword now immediately consume
(delete) the verification code/token after successful validation,
before proceeding with password reset. This prevents replay attacks
where the same code could be used multiple times.
Security fix:验证码/Token验证通过后立即删除，防止Replay攻击
- Add new test files for auth, service, and handler modules
- Improve test organization and coverage
- Refactor code for better maintainability
- Add captcha, settings, stats, and theme handler tests
- Add auth module tests (CAS, OAuth, password, SSO, state)
- Add service layer tests for auth, export, permissions, roles
- All Go tests pass (exit code 0)
- All frontend tests pass (325 tests in 59 files)
- Define userRepository, userRoleRepository, roleRepository, passwordHistoryRepository interfaces
- Update UserService struct to use interface types instead of concrete *repository types
- Update NewUserService constructor to accept interfaces
- Add UserCursorResult type (avoid conflict with login_log.go's CursorResult)
- Fix AssignRoles to use type assertion for WithTx (concrete method not in interface)
- Add GetByEmail, UpdateStatus, BatchUpdateStatus, BatchDelete to userRepository interface
- Add GetByID, GetByIDs to roleRepository interface
This enables dependency injection and mocking at the service layer.
- AssignRoles: wrap DeleteByUserID + BatchCreate in DB transaction (P1)
- GetUserRoles: use GetByIDs batch query instead of per-role GetByID loop (N+1 fix)
- ListAdmins: use GetByIDs batch query instead of per-user GetByID loop (N+1 fix)
- Add WithTx/DB methods to UserRoleRepository for transaction support
- Add GetByIDs to UserRepository (batch user lookup)
- Add .gitattributes to normalize line endings to LF (P2)
- Implement UploadAvatar with local file storage, validation (5MB, image types)
- Add user permission check (self or admin can update avatar)
- Update AvatarHandler to accept userRepo for DB operations
- Fix NewAvatarHandler calls in e2e_test.go and business_logic_test.go
- Adjust LL_001 SLA threshold from 2s to 2.2s for system variance
- Update REAL_PROJECT_STATUS.md with TDD fix completion status
- G115 (integer overflow): Added nosec comments for safe type conversions
where values are bounded by design (e.g., rng.Intn(255) returns 0-254)
- G118 (context.Background): Added nosec for intentional async goroutines
that use WithTimeout for bounded execution after request completes
Note: G101 (hardcoded credentials) warnings are low-confidence false
positives - OAuth fields use getEnv() to read from environment.
