fix(auth): allow non-empty short access passwords

Co-authored-by: HiFox Agent <agents-noreply@hifox.com>

src/server/auth/config.ts

@@ -11,7 +11,7 @@ export function authMode() {
 export function passwordConfig() {
   const password = process.env.BI_AUTH_PASSWORD || '';
   const secret = process.env.JWT_SECRET || '';
-  if (password.length < 16 || secret.length < 32) throw new Error('Password authentication is not configured securely');
+  if (!password.trim() || secret.length < 32) throw new Error('Password authentication is not configured securely');
   return { password, key: createHmac('sha256', secret).update(`bi-password:${password}`).digest('hex') };
 }
 

src/server/auth/password.test.ts

@@ -12,7 +12,7 @@ test('固定密码模式默认关闭、失败限流、只读权限及换密失
   try {
     delete process.env.BI_AUTH_MODE;
     process.env.JWT_SECRET = 'test-signing-secret-with-at-least-32-characters';
-    process.env.BI_AUTH_PASSWORD = 'test-password-only-123456';
+    process.env.BI_AUTH_PASSWORD = 'short';
     process.env.DEV_BYPASS_AUTH = '0';
     const app = new Hono();
     app.use('/api/*', readOnlyMiddleware);
@@ -48,6 +48,8 @@ test('固定密码模式默认关闭、失败限流、只读权限及换密失
     process.env.BI_AUTH_MODE = 'password';
     delete process.env.BI_AUTH_PASSWORD;
     assert.equal((await login('')).status, 503);
+    process.env.BI_AUTH_PASSWORD = '   ';
+    assert.equal((await login('   ')).status, 503);
     process.env.BI_AUTH_PASSWORD = 'a-different-password-123456';
     for (let i = 0; i < 20; i++) await login('wrong');
     assert.equal((await login(process.env.BI_AUTH_PASSWORD)).status, 429);