feat(backend): 注册限流阈值改为可配置

fruitshorts-app-api/src/main/resources/application-prod.yml

@@ -17,6 +17,9 @@ spring:
     timeout-per-shutdown-phase: 30s
 
 fruitshorts:
+  auth:
+    register-max-per-ip-per-day: 5
+    register-max-per-device-per-day: 3
   media:
     # 生产必须开启播放地址签名（docs/12-上线检查清单）
     signature-required: true

fruitshorts-app-api/src/main/resources/application.yml

@@ -43,6 +43,10 @@ springdoc:
     path: /v3/api-docs
 
 fruitshorts:
+  auth:
+    # 注册频控；小于等于 0 表示不限制。开发环境默认关闭，生产建议 5 / 3。
+    register-max-per-ip-per-day: 0
+    register-max-per-device-per-day: 0
   interaction:
     # MACHINE_FIRST：机审通过即发布，命中 REVIEW 级敏感词才转人工
     # PRE_REVIEW   ：全部先审后发（生产建议）

fruitshorts-app-api/src/test/java/com/fruitshorts/app/service/AppAuthServiceTest.java

@@ -25,6 +25,7 @@ import com.fruitshorts.user.vo.TokenRespVO;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.springframework.security.crypto.password.PasswordEncoder;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import java.time.Duration;
 import java.time.LocalDateTime;
@@ -164,6 +165,7 @@ class AppAuthServiceTest {
 
     @Test
     void should_reject_register_when_ip_reaches_the_daily_limit() {
+        setRegisterLimits(5, 3);
         given(userMapper.selectCount(any())).willReturn(5L);
 
         assertThatThrownBy(() -> authService.register(emailRegister("abcd1234", null), "203.0.113.8"))
@@ -173,6 +175,38 @@ class AppAuthServiceTest {
                 .hasMessageContaining("当前网络注册过于频繁");
     }
 
+    @Test
+    void should_reject_register_when_device_reaches_the_daily_limit() {
+        setRegisterLimits(5, 3);
+        given(userMapper.selectCount(any())).willReturn(3L);
+
+        assertThatThrownBy(() -> authService.register(emailRegister("abcd1234", null), "203.0.113.8"))
+                .isInstanceOf(ServiceException.class)
+                .satisfies(ex -> assertThat(((ServiceException) ex).getCode())
+                        .isEqualTo(ErrorCode.TOO_MANY_REQUESTS.getCode()))
+                .hasMessage("该设备注册过于频繁，请稍后再试");
+    }
+
+    @Test
+    void should_not_limit_by_ip_when_ip_limit_is_zero() {
+        stubHappyRegister();
+        setRegisterLimits(0, 3);
+        given(userMapper.selectCount(any())).willReturn(2L);
+
+        assertThat(authService.register(emailRegister("abcd1234", null), "203.0.113.8").getAccessToken())
+                .isEqualTo("access-1");
+    }
+
+    @Test
+    void should_not_limit_by_device_when_device_limit_is_zero() {
+        stubHappyRegister();
+        setRegisterLimits(5, 0);
+        given(userMapper.selectCount(any())).willReturn(4L);
+
+        assertThat(authService.register(emailRegister("abcd1234", null), "203.0.113.8").getAccessToken())
+                .isEqualTo("access-1");
+    }
+
     @Test
     void should_return_tokens_when_password_matches() {
         stubLogin(credential("bcrypt-hash"), user(AppUserStatus.NORMAL));
@@ -268,6 +302,11 @@ class AppAuthServiceTest {
                 deviceMapper, realOtpService, hasher, tokenProvider, passwordEncoder);
     }
 
+    private void setRegisterLimits(int perIp, int perDevice) {
+        ReflectionTestUtils.setField(authService, "maxRegisterPerIpPerDay", perIp);
+        ReflectionTestUtils.setField(authService, "maxRegisterPerDevicePerDay", perDevice);
+    }
+
     private RegisterReqVO emailRegister(String password, String code) {
         RegisterReqVO req = new RegisterReqVO();
         req.setTargetType("EMAIL");