精简: 去掉 Telegram 机器人+通知: tgbot 包/stats-notify 与 hash 清理 job/登录通知/backuptotgbot/testTgBot/全部 tg* 设置/locale Bot 本地化/SecretClears 机制; 连带清理 Swagger/外部流量/邮件/2FA 的残留测试

internal/web/controller/setting_test.go

@@ -1,7 +1,6 @@
 package controller
 
 import (
-	"encoding/json"
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
@@ -14,7 +13,6 @@ import (
 	"github.com/mhsanaei/3x-ui/v3/internal/database"
 	"github.com/mhsanaei/3x-ui/v3/internal/database/model"
 	"github.com/mhsanaei/3x-ui/v3/internal/util/crypto"
-	"github.com/mhsanaei/3x-ui/v3/internal/web/service"
 )
 
 func TestValidateRegex(t *testing.T) {
@@ -89,84 +87,3 @@ func TestAPITokenMutationRoutesEnforceExpectedScope(t *testing.T) {
 	}
 }
 
-// GHSA-xqqw-jqqv-99h6: a save that keeps 2FA enabled must not be able to
-// rebind the authenticator without presenting a current code.
-func TestUpdateSettingRequiresCodeToReplaceTwoFactorToken(t *testing.T) {
-	t.Setenv("XUI_DB_FOLDER", t.TempDir())
-	if err := database.InitDB(filepath.Join(t.TempDir(), "x-ui.db")); err != nil {
-		t.Fatalf("InitDB: %v", err)
-	}
-	t.Cleanup(func() { _ = database.CloseDB() })
-
-	settingService := service.SettingService{}
-	if err := settingService.SetTwoFactorToken("ORIGINALSECRET234567"); err != nil {
-		t.Fatalf("seed token: %v", err)
-	}
-	if err := settingService.SetTwoFactorEnable(true); err != nil {
-		t.Fatalf("seed enable: %v", err)
-	}
-
-	post := func(t *testing.T, mutate func(map[string]any)) string {
-		t.Helper()
-		base, err := settingService.GetAllSetting()
-		if err != nil {
-			t.Fatalf("GetAllSetting: %v", err)
-		}
-		raw, err := json.Marshal(base)
-		if err != nil {
-			t.Fatalf("marshal: %v", err)
-		}
-		body := map[string]any{}
-		if err := json.Unmarshal(raw, &body); err != nil {
-			t.Fatalf("unmarshal: %v", err)
-		}
-		mutate(body)
-		payload, err := json.Marshal(body)
-		if err != nil {
-			t.Fatalf("marshal payload: %v", err)
-		}
-
-		gin.SetMode(gin.TestMode)
-		router := gin.New()
-		NewSettingController(router.Group("/panel/api"))
-		req := httptest.NewRequest(http.MethodPost, "/panel/api/setting/update", strings.NewReader(string(payload)))
-		req.Header.Set("Content-Type", "application/json")
-		resp := httptest.NewRecorder()
-		router.ServeHTTP(resp, req)
-		return resp.Body.String()
-	}
-
-	t.Run("rebind without code is rejected", func(t *testing.T) {
-		got := post(t, func(body map[string]any) {
-			body["twoFactorEnable"] = true
-			body["twoFactorToken"] = "ATTACKERSECRET567890"
-		})
-		if !strings.Contains(got, `"success":false`) {
-			t.Fatalf("rebind without a 2FA code was accepted: %s", got)
-		}
-		stored, err := settingService.GetTwoFactorToken()
-		if err != nil {
-			t.Fatalf("GetTwoFactorToken: %v", err)
-		}
-		if stored != "ORIGINALSECRET234567" {
-			t.Fatalf("stored 2FA secret = %q, want it unchanged", stored)
-		}
-	})
-
-	t.Run("ordinary save with redacted token still succeeds", func(t *testing.T) {
-		got := post(t, func(body map[string]any) {
-			body["twoFactorEnable"] = true
-			body["twoFactorToken"] = ""
-		})
-		if !strings.Contains(got, `"success":true`) {
-			t.Fatalf("normal settings save was rejected: %s", got)
-		}
-		stored, err := settingService.GetTwoFactorToken()
-		if err != nil {
-			t.Fatalf("GetTwoFactorToken: %v", err)
-		}
-		if stored != "ORIGINALSECRET234567" {
-			t.Fatalf("stored 2FA secret = %q, want it preserved", stored)
-		}
-	})
-}