fix: auth 畸形body防御/字段校验信封/用户名校验/429 测试

Co-Authored-By: Claude Code <noreply@anthropic.com>

server/tracker/tests/test_auth.py

@@ -85,3 +85,44 @@ def test_user_create_validates_input(client, admin_user):
         {"username": "x", "password": "short"}, format="json").status_code == 400
     assert client.post("/api/admin/users",
         {"username": "admin", "password": "longenough1"}, format="json").status_code == 409
+
+
+# ---- 审查修复锁定测试 ----
+
+def test_user_create_malformed_body_400_not_500(client, admin_user):
+    """探针证实：JSON 数组 body / 非字符串 username/password 直接 500——入口统一 400 invalid_input。"""
+    _auth(client, admin_user)
+    assert client.post("/api/admin/users", ["arr"], format="json").status_code == 400
+    assert client.post("/api/admin/users",
+        {"username": 123, "password": "longenough1"}, format="json").status_code == 400
+    assert client.post("/api/admin/users",
+        {"username": "okname", "password": 12345678}, format="json").status_code == 400
+
+def test_login_missing_password_field_envelope(client, admin_user):
+    """simplejwt 缺 password 的 400 是 {"password":[...]} 字段校验形状——信封统一，前端单条解析路径。"""
+    r = client.post("/api/admin/auth/token", {"username": "admin"}, format="json")
+    assert r.status_code == 400
+    body = r.json()
+    assert body["code"] == 400 and body["message"] == "invalid_input" and body["data"]
+
+def test_user_create_username_charset_and_length(client, admin_user):
+    """字符集对齐 UnicodeUsernameValidator（create_user 不跑校验器）；>150 防 MySQL DataError（sqlite 不报错须入口拦）。"""
+    _auth(client, admin_user)
+    assert client.post("/api/admin/users",
+        {"username": "bad name", "password": "longenough1"}, format="json").status_code == 400
+    assert client.post("/api/admin/users",
+        {"username": "x" * 151, "password": "longenough1"}, format="json").status_code == 400
+    assert client.post("/api/admin/users",
+        {"username": "ok.name+1", "password": "longenough1"}, format="json").status_code == 200
+
+def test_login_throttle_429_envelope(client, admin_user):
+    """直接打默认 10/min（THROTTLE_RATES import 时固化为类属性，override_settings 提速无效，
+    同 collect.py CollectThrottle.get_rate 注释）——第 11 次 429 且带信封。"""
+    for _ in range(10):
+        assert client.post("/api/admin/auth/token",
+            {"username": "admin", "password": "wrongpass"}, format="json").status_code == 401
+    r = client.post("/api/admin/auth/token",
+                    {"username": "admin", "password": "wrongpass"}, format="json")
+    assert r.status_code == 429
+    body = r.json()
+    assert body["code"] == 429 and body["data"] is None and body["message"]