注册开关读取失败时改为关闭，堵住配置缺失时未授权开注册；OAuth 自动注册同样 fail-closed。metric 持平 8。

Result: {"status":"keep","total_issues":8,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":8,"eslint_problems":0,"eslint_errors":0,"eslint_warnings":0,"tsc_errors":0,"measure_s":86,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_usetesting":0,"golint_test_total":0,"golint_exhaustive":0,"golint_vetx_total":0,"vitest_failed":0,"vitest_total":126}

internal/apps/oauth/handler_callback.go

@@ -195,7 +195,7 @@ func handleCallbackLogin(ctx context.Context, c *gin.Context, source *model.Auth
 func handleCallbackRegister(ctx context.Context, c *gin.Context, source *model.AuthSource, userInfo *model.OAuthUserInfo) (model.User, bool) {
 	registrationEnabled, regErr := repository.GetBoolByKey(ctx, model.ConfigKeyRegistrationEnabled)
 	if regErr != nil {
-		registrationEnabled = true
+		registrationEnabled = false
 	}
 
 	if !registrationEnabled {

internal/apps/oauth/oauth_test.go

@@ -691,6 +691,11 @@ func TestCallbackLoginAndUserInfo(t *testing.T) {
 	dbConn := setupTestDB(t)
 	mockRedis := newMockRedisClient()
 	seedTestAuthSource(t, dbConn)
+	dbConn.Create(&model.SystemConfig{
+		Key:   model.ConfigKeyRegistrationEnabled,
+		Value: "true",
+		Type:  "system",
+	})
 
 	var state string
 
@@ -815,14 +820,14 @@ func TestCallbackLoginAndUserInfo(t *testing.T) {
 	}
 
 	t.Run("OIDC login when registration disabled - need bind", func(t *testing.T) {
-		// Disable registration in database
-		dbConn.Create(&model.SystemConfig{
-			Key:   model.ConfigKeyRegistrationEnabled,
-			Value: "false",
+		dbConn.Model(&model.SystemConfig{}).Where("key = ?", model.ConfigKeyRegistrationEnabled).Update("value", "false")
+		repository.ResetSystemConfigRAMCacheForTest()
+		mockRedis.Del(context.Background(), db.PrefixedKey(repository.SystemConfigRedisHashKey)+":"+model.ConfigKeyRegistrationEnabled)
+		t.Cleanup(func() {
+			dbConn.Model(&model.SystemConfig{}).Where("key = ?", model.ConfigKeyRegistrationEnabled).Update("value", "true")
+			repository.ResetSystemConfigRAMCacheForTest()
+			mockRedis.Del(context.Background(), db.PrefixedKey(repository.SystemConfigRedisHashKey)+":"+model.ConfigKeyRegistrationEnabled)
 		})
-		defer func() {
-			dbConn.Where("key = ?", model.ConfigKeyRegistrationEnabled).Delete(&model.SystemConfig{})
-		}()
 
 		var state4 string
 		httpMock4 := newMockOIDCClient(testIssuerURL, testClientID, &state4, "77777", "need_bind_user", "needbind@linux.do", "Need Bind User")

internal/apps/user/logics.go

@@ -62,7 +62,7 @@ func isPasswordLoginEnabled(ctx context.Context) bool {
 func isPasswordRegisterEnabled(ctx context.Context) bool {
 	enabled, err := repository.GetBoolByKey(ctx, model.ConfigKeyPasswordRegisterEnabled)
 	if err != nil {
-		return true
+		return false
 	}
 	return enabled
 }
@@ -70,7 +70,7 @@ func isPasswordRegisterEnabled(ctx context.Context) bool {
 func isRegistrationEnabled(ctx context.Context) bool {
 	enabled, err := repository.GetBoolByKey(ctx, model.ConfigKeyRegistrationEnabled)
 	if err != nil {
-		return true
+		return false
 	}
 	return enabled
 }