修复全量审查问题;设置接口PATCH化;回传指纹加固

internal/service/totp_oauth_test.go

@@ -224,7 +224,7 @@ func TestOAuthProvidersListsConfigured(t *testing.T) {
 		t.Fatalf("未配置时 providers = %v", got)
 	}
 	secret := "gh-secret"
-	err := o.settings.UpdateOAuth(ctx, UpdateOAuthInput{GithubClientID: "cid", GithubClientSecret: &secret})
+	err := o.settings.UpdateOAuth(ctx, UpdateOAuthInput{GithubClientID: strPtr("cid"), GithubClientSecret: &secret})
 	if err != nil {
 		t.Fatalf("UpdateOAuth: %v", err)
 	}
@@ -249,7 +249,7 @@ func TestOAuthAuthorizeConfigErrors(t *testing.T) {
 		t.Errorf("无 clientID err = %v, want ErrOAuthNotConfigured", err)
 	}
 	// clientID 已配但面板地址未设置
-	if err := o.settings.UpdateOAuth(ctx, UpdateOAuthInput{GithubClientID: "Iv1.test"}); err != nil {
+	if err := o.settings.UpdateOAuth(ctx, UpdateOAuthInput{GithubClientID: strPtr("Iv1.test")}); err != nil {
 		t.Fatalf("UpdateOAuth: %v", err)
 	}
 	if _, err := o.AuthorizeURL(ctx, "github", "login", ""); !errors.Is(err, ErrOAuthNoAppURL) {
@@ -273,7 +273,7 @@ func TestOAuthProvidersAndDisabled(t *testing.T) {
 		t.Fatalf("Providers = %v, want empty", got)
 	}
 	// 配置 github(无显示名称)→ 默认名 GitHub
-	in := UpdateOAuthInput{GithubClientID: "Iv1.test"}
+	in := UpdateOAuthInput{GithubClientID: strPtr("Iv1.test")}
 	if err := o.settings.UpdateOAuth(ctx, in); err != nil {
 		t.Fatalf("UpdateOAuth: %v", err)
 	}
@@ -282,7 +282,7 @@ func TestOAuthProvidersAndDisabled(t *testing.T) {
 		t.Fatalf("Providers = %+v, want [github/GitHub]", got)
 	}
 	// 自定义显示名称
-	in.GithubDisplayName = "公司账号"
+	in.GithubDisplayName = strPtr("公司账号")
 	if err := o.settings.UpdateOAuth(ctx, in); err != nil {
 		t.Fatalf("UpdateOAuth: %v", err)
 	}
@@ -290,7 +290,7 @@ func TestOAuthProvidersAndDisabled(t *testing.T) {
 		t.Fatalf("DisplayName = %q, want 公司账号", got[0].DisplayName)
 	}
 	// 禁用后:列表隐藏,login 模式 409,bind 模式仍可发起
-	in.GithubDisabled = true
+	in.GithubDisabled = boolPtr(true)
 	if err := o.settings.UpdateOAuth(ctx, in); err != nil {
 		t.Fatalf("UpdateOAuth: %v", err)
 	}
@@ -309,3 +309,71 @@ func TestOAuthProvidersAndDisabled(t *testing.T) {
 		t.Fatalf("OAuthView = %+v, %v", view, err)
 	}
 }
+
+// TestUpdateOAuthPartialPatch 锁定 provider 配置的部分更新语义:
+// 只写出现字段,另一 provider 与未出现字段不回滚,secret nil 沿用空串清除。
+func TestUpdateOAuthPartialPatch(t *testing.T) {
+	o, _ := newOAuthEnv(t)
+	ctx := context.Background()
+	secret := "gh-secret"
+	seed := UpdateOAuthInput{GithubClientID: strPtr("cid"), GithubClientSecret: &secret, GithubDisplayName: strPtr("公司账号")}
+	if err := o.settings.UpdateOAuth(ctx, seed); err != nil {
+		t.Fatalf("seed: %v", err)
+	}
+	steps := []struct {
+		name  string
+		patch UpdateOAuthInput
+		check func(v OAuthProvidersView) string
+	}{
+		{
+			name:  "只更新 oidc 不动 github",
+			patch: UpdateOAuthInput{OidcIssuer: strPtr("https://sso.example.com/"), OidcClientID: strPtr("oidc-cid")},
+			check: func(v OAuthProvidersView) string {
+				if v.OidcIssuer != "https://sso.example.com" || v.OidcClientID != "oidc-cid" {
+					return "oidc 字段未生效或未规范化"
+				}
+				if v.GithubClientID != "cid" || !v.GithubSecretSet || v.GithubDisplayName != "公司账号" {
+					return "github 字段被回滚"
+				}
+				return ""
+			},
+		},
+		{
+			name:  "单开关启停,secret nil 沿用",
+			patch: UpdateOAuthInput{GithubDisabled: boolPtr(true)},
+			check: func(v OAuthProvidersView) string {
+				if !v.GithubDisabled || v.GithubClientID != "cid" || !v.GithubSecretSet {
+					return "启停外字段被动到或 secret 丢失"
+				}
+				return ""
+			},
+		},
+		{
+			name:  "secret 空串清除",
+			patch: UpdateOAuthInput{GithubClientSecret: strPtr("")},
+			check: func(v OAuthProvidersView) string {
+				if v.GithubSecretSet {
+					return "空串未清除 secret"
+				}
+				if v.GithubClientID != "cid" {
+					return "clientID 被动到"
+				}
+				return ""
+			},
+		},
+	}
+	for _, st := range steps {
+		t.Run(st.name, func(t *testing.T) {
+			if err := o.settings.UpdateOAuth(ctx, st.patch); err != nil {
+				t.Fatalf("UpdateOAuth: %v", err)
+			}
+			view, err := o.settings.OAuthView(ctx)
+			if err != nil {
+				t.Fatalf("OAuthView: %v", err)
+			}
+			if msg := st.check(view); msg != "" {
+				t.Error(msg)
+			}
+		})
+	}
+}