fix: lower admin password minimum length

src/lib/cms-api.ts

@@ -246,7 +246,7 @@ export async function handleCmsApi(request: Request, routeValue: string, clientA
       const currentPassword = String(body.currentPassword || "");
       const newPassword = String(body.newPassword || "");
       if (!await verifyPassword(currentPassword)) throw new StoreError("当前密码错误", 401);
-      if (newPassword.length < 10) throw new StoreError("新密码至少需要 10 个字符");
+      if (newPassword.length < 5) throw new StoreError("新密码至少需要 5 个字符");
       if (newPassword.length > 128) throw new StoreError("新密码不能超过 128 个字符");
       if (safeEqual(currentPassword, newPassword)) throw new StoreError("新密码不能与当前密码相同");
       await savePassword(newPassword);

src/pages/admin/index.astro

@@ -107,9 +107,9 @@
       <div class="modal-head"><div><strong>修改后台密码</strong><small>修改成功后需要使用新密码重新登录</small></div><button id="close-password-modal" class="ghost small" type="button">关闭</button></div>
       <form id="password-form" class="password-form">
         <label>当前密码<input id="current-password" type="password" autocomplete="current-password" required /></label>
-        <label>新密码<input id="new-password" type="password" autocomplete="new-password" minlength="10" maxlength="128" required /></label>
-        <label>确认新密码<input id="confirm-password" type="password" autocomplete="new-password" minlength="10" maxlength="128" required /></label>
-        <p class="password-hint">新密码至少 10 个字符。.env 中的管理密码仍可用于登录和找回。</p>
+        <label>新密码<input id="new-password" type="password" autocomplete="new-password" minlength="5" maxlength="128" required /></label>
+        <label>确认新密码<input id="confirm-password" type="password" autocomplete="new-password" minlength="5" maxlength="128" required /></label>
+        <p class="password-hint">新密码至少 5 个字符。</p>
         <p id="password-error" class="error"></p>
         <div class="password-actions"><button id="cancel-password" class="ghost" type="button">取消</button><button class="primary" type="submit">确认修改</button></div>
       </form>

tests/auth.test.ts

@@ -69,6 +69,11 @@ test("users can change the persisted password while the .env password remains va
   assert.equal(initialLogin.response.status, 200);
   assert.ok(initialLogin.cookie);
 
+  const tooShort = await changePassword(initialLogin.cookie, "environment-master-password", "abcd");
+  assert.equal(tooShort.status, 400);
+  assert.match((await tooShort.json()).error, /至少需要 5 个字符/);
+  assert.equal(await sessionStatus(initialLogin.cookie), true);
+
   const firstPassword = "first-user-password";
   const changed = await changePassword(initialLogin.cookie, "environment-master-password", firstPassword);
   assert.equal(changed.status, 200);
@@ -84,7 +89,7 @@ test("users can change the persisted password while the .env password remains va
   assert.ok(userLogin.cookie);
   assert.equal((await login("environment-master-password")).response.status, 200);
 
-  const secondPassword = "second-user-password";
+  const secondPassword = "abcde";
   const changedAgain = await changePassword(userLogin.cookie, firstPassword, secondPassword);
   assert.equal(changedAgain.status, 200);
   assert.equal(await sessionStatus(userLogin.cookie), false);