fix: Optimise Password Change Interface

[JWWTSL]

log: Within the password modification window of the account plugin, ensure that when the ‘New Password / Confirm Password’ fields are non-compliant and receive focus, the blue focus border no longer obscures the red error state. Instead, maintain the red colour (the focus border turns red during error state and reverts to blue upon compliance), whilst retaining the red background and prompt.

pms: bug-300203

[sourcery-ai]

Sorry @JWWTSL, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[deepin-ci-robot]

deepin pr auto review

代码审查意见

1. 语法与逻辑问题

1.1 拼写错误

在 PasswordLayout.qml 中存在多处拼写错误：

• pwdContainter.eidtItems 应为 pwdContainer.editItems
• edit0 和 edit1 的变量名拼写不一致，建议统一使用 editItem0 和 editItem1 或其他一致的命名

1.2 QML 代码结构

在 PasswordLayout.qml 中，onTextChanged 和 onEditingFinished 事件处理器嵌套过深，建议将验证逻辑提取为单独的函数：

function validatePrimaryPassword(text) {
    let editItem0 = pwdContainer.editItems[0]
    if (!editItem0) return

    if (text.length === 0) {
        editItem0.showAlert = false
        editItem0.alertText = ""
        editItem0.hasErrorBorder = false
        return
    }

    // username match
    if (pwdLayout.currentName.length > 0 && text === pwdLayout.currentName) {
        editItem0.showAlert = true
        editItem0.alertText = ""
        editItem0.hasErrorBorder = true
        return
    }

    let err = dccData.checkPasswordSilently(pwdLayout.currentName, text)
    editItem0.showAlert = (err.length > 0)
    editItem0.alertText = ""
    editItem0.hasErrorBorder = (err.length > 0)
}

function validateRepeatPassword(text) {
    let editItem0 = pwdContainer.editItems[0]
    let editItem1 = pwdContainer.editItems[1]
    if (!editItem0 || !editItem1) return

    if (text.length === 0) {
        editItem1.showAlert = false
        editItem1.alertText = ""
        editItem1.hasErrorBorder = false
        return
    }

    if (editItem0.text.length > 0 && text !== editItem0.text) {
        editItem1.showAlert = true
        editItem1.alertText = ""
        editItem1.hasErrorBorder = true
    } else {
        editItem1.showAlert = false
        editItem1.alertText = ""
        editItem1.hasErrorBorder = false
    }
}

2. 代码质量

2.1 代码重复

在 PasswordLayout.qml 中，密码验证逻辑在 onTextChanged 和 onEditingFinished 中重复出现，建议提取为公共函数：

function validatePassword(editItem, password, isRepeat = false) {
    // 实现公共验证逻辑
}

2.2 注释不足

虽然添加了注释，但部分关键逻辑仍需更详细的解释，特别是关于实时验证和焦点失焦验证的区别。

3. 代码性能

3.1 实时验证频率

在 onTextChanged 中进行实时验证可能会导致频繁的密码强度检查，建议添加防抖机制：

property var validateTimer: Timer {
    interval: 300
    onTriggered: {
        // 执行验证逻辑
    }
}

onTextChanged: {
    validateTimer.restart()
}

3.2 QML 绑定优化

在 D.PasswordEdit 中，palette.highlight 的绑定可能导致不必要的更新，建议使用条件绑定：

palette.highlight: hasErrorBorder || showAlert ? "#FF5736" : normalHighlight

4. 代码安全

4.1 密码处理

在 checkPasswordSilently 函数中，密码以明文形式传递，建议考虑使用安全字符串处理方式：

QString AccountsController::checkPasswordSilently(const QString &name, const QString &pwd)
{
    // 考虑使用 std::string 或安全容器处理密码
    auto error = PwqualityManager::instance()->verifyPassword(name, pwd);
    if (error != PwqualityManager::ERROR_TYPE::PW_NO_ERR) {
        return PwqualityManager::instance()->getErrorTips(error);
    }
    
    // 清除密码内存
    std::fill(pwd.begin(), pwd.end(), 0);
    
    return QString();
}

4.2 错误信息泄露

错误信息可能包含系统内部信息，建议在返回错误信息前进行过滤或使用通用错误消息：

QString AccountsController::checkPasswordSilently(const QString &name, const QString &pwd)
{
    auto error = PwqualityManager::instance()->verifyPassword(name, pwd);
    if (error != PwqualityManager::ERROR_TYPE::PW_NO_ERR) {
        // 考虑返回通用错误消息而非具体错误
        return qsTr("Password does not meet security requirements");
    }
    
    return QString();
}

5. 其他建议

5.1 用户体验改进

在密码验证失败时，除了红色边框外，可以考虑添加密码强度指示器，帮助用户理解密码要求：

PasswordStrengthIndicator {
    strength: calculatePasswordStrength(text)
}

5.2 单元测试

建议为 checkPasswordSilently 函数添加单元测试，确保各种边界情况得到正确处理：

void TestAccountsController::testCheckPasswordSilently()
{
    AccountsController controller;
    
    // 测试空密码
    QVERIFY(!controller.checkPasswordSilently("user", "").isEmpty());
    
    // 测试弱密码
    QVERIFY(!controller.checkPasswordSilently("user", "123").isEmpty());
    
    // 测试强密码
    QVERIFY(controller.checkPasswordSilently("user", "Str0ngP@ssw0rd!").isEmpty());
}

总结

整体而言，这段代码实现了密码的实时验证功能，但在代码结构、性能优化和安全性方面还有改进空间。建议重构代码以减少重复，添加防抖机制优化性能，并考虑密码处理的安全性。

[deepin-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: caixr23, JWWTSL

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• debian/deepin/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[JWWTSL]

/forcemerge

[deepin-bot]

This pr force merged! (status: blocked)