From 0fccfcd181b2265d1cfcac2642bacacf817916bb Mon Sep 17 00:00:00 2001
From: CI Bot <ci-bot@xiaoxiajianji.com>
Date: Wed, 22 Jul 2026 20:58:49 +0800
Subject: [PATCH] =?UTF-8?q?fix(test):=20=E4=BF=AE=E5=A4=8Dtest=5Fverify=5F?=
 =?UTF-8?q?token=5Ftampered=5Fsignature=E5=81=B6=E5=8F=91=E5=A4=B1?=
 =?UTF-8?q?=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

原测试仅篡改token最后一个字符，在某些PyJWT/环境下可能因
base64填充位或签名末尾字节对齐问题导致验证仍通过。
改为篡改payload内容（修改sub字段），确保签名必然不匹配。
---
 tests/unit/test_auth_service.py | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/tests/unit/test_auth_service.py b/tests/unit/test_auth_service.py
index 42d1c64bc..b0ffa5477 100755
--- a/tests/unit/test_auth_service.py
+++ b/tests/unit/test_auth_service.py
@@ -456,10 +456,25 @@ class TestJWTService:
             service.verify_token(token)
 
     def test_verify_token_tampered_signature(self, service):
-        """篡改签名的token无法验证"""
+        """篡改payload的token无法验证（签名不匹配）"""
+        import base64
+        import json
+
         token = service.create_access_token(user_id="user_123")
-        # 篡改最后一个字符
-        tampered = token[:-1] + ("A" if token[-1] != "A" else "B")
+        parts = token.split(".")
+        assert len(parts) == 3
+        # 篡改 payload 部分（改用户ID），会导致签名不匹配
+        payload_b64 = parts[1]
+        # 补 padding 以便解码
+        padding = 4 - len(payload_b64) % 4
+        if padding != 4:
+            payload_b64 += "=" * padding
+        payload_bytes = base64.urlsafe_b64decode(payload_b64)
+        payload = json.loads(payload_bytes)
+        payload["sub"] = "hacked_user"
+        new_payload_bytes = json.dumps(payload).encode()
+        new_payload_b64 = base64.urlsafe_b64encode(new_payload_bytes).rstrip(b"=").decode()
+        tampered = f"{parts[0]}.{new_payload_b64}.{parts[2]}"
         with pytest.raises(InvalidTokenError):
             service.verify_token(tampered)