完成10%

tests/security-upload-scope.test.js

@@ -1,12 +1,14 @@
 const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
 const test = require('node:test');
 
 const SecurityPages = require('../public/js/security-pages.js');
 const UploadPages = require('../public/js/upload-pages.js');
 
-test('security forms use dedicated captcha scenes and carry the returned ticket', () => {
-  assert.equal(SecurityPages.getCaptchaScene('password'), 'WEB_H5_CHANGE_PASSWORD');
-  assert.equal(SecurityPages.getCaptchaScene('phone'), 'WEB_H5_CHANGE_PHONE');
+test('security forms use SMS captcha scenes and submit only documented business fields', () => {
+  assert.equal(SecurityPages.getCaptchaScene('phone'), 'PC_PHONE_CHANGE');
+  assert.equal(SecurityPages.getCaptchaScene('deactivate'), 'PC_ACCOUNT_DEACTIVATE');
   assert.deepEqual(
     SecurityPages.buildPasswordChangeBody({
       oldPassword: 'old',
@@ -15,10 +17,21 @@ test('security forms use dedicated captcha scenes and carry the returned ticket'
     }, (value) => 'md5-' + value),
     {
       oldPassword: 'md5-old',
-      newPassword: 'md5-new',
-      validToken: 'captcha-ticket'
+      newPassword: 'md5-new'
     }
   );
+  assert.deepEqual(
+    SecurityPages.buildPhoneChangeBody({
+      phone: '13800000000',
+      smsCode: '123456',
+      validToken: 'captcha-ticket'
+    }),
+    {
+      phone: '13800000000',
+      smsCode: '123456'
+    }
+  );
+  assert.deepEqual(SecurityPages.buildDeactivateBody({ smsCode: '654321' }), { smsCode: '654321' });
 });
 
 test('upload helper exposes only single-file upload support', () => {
@@ -26,3 +39,12 @@ test('upload helper exposes only single-file upload support', () => {
   assert.equal('buildResumableInitBody' in UploadPages, false);
   assert.equal(UploadPages.getUploadMode(5 * 1024 * 1024), 'single');
 });
+
+test('security page field names match phone-change and account-deactivation DTOs', () => {
+  const source = fs.readFileSync(path.join(__dirname, '..', 'profile-security.html'), 'utf8');
+
+  assert.match(source, /id="newPhone"\s+name="phone"/);
+  assert.match(source, /data-security-form="deactivate"/);
+  assert.match(source, /id="deactivateSmsCode"\s+name="smsCode"/);
+  assert.match(source, /data-security-send-deactivate-code/);
+});