禁止直接认证截断完整邮箱标识

server/services/auth/auth.go

@@ -18,12 +18,9 @@ import (
 )
 
 // Authenticate 统一校验网页、SMTP、IMAP 和 POP3 的用户凭据。
+// NormalizeAccount 只清理外围空白，不再截断完整邮箱标识。
 func NormalizeAccount(account string) string {
-	account = strings.TrimSpace(account)
-	if index := strings.IndexByte(account, '@'); index > 0 {
-		account = account[:index]
-	}
-	return account
+	return strings.TrimSpace(account)
 }
 
 // AuthenticateIdentifier 支持账号和受信主域名邮箱两种登录标识，最终统一到同一账号密码校验。

server/services/auth/auth_test.go

@@ -149,3 +149,35 @@ func TestProtocolAuthenticationAcceptsConfiguredFullEmailIdentifier(t *testing.T
 		t.Fatal("unconfigured email domain should be rejected")
 	}
 }
+
+func TestAuthenticateDoesNotTruncateFullEmailIdentifier(t *testing.T) {
+	oldConfig := config.Instance
+	oldDB := db.Instance
+	config.Instance = &config.Config{
+		DbType:  config.DBTypeSQLite,
+		DbDSN:   filepath.Join(t.TempDir(), "no-truncation-auth.db"),
+		Domain:  "example.com",
+		Domains: []string{"example.com"},
+	}
+	if err := db.Init(""); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if db.Instance != nil && db.Instance != oldDB {
+			_ = db.Instance.Close()
+		}
+		db.Instance = oldDB
+		config.Instance = oldConfig
+	})
+
+	user := models.User{Account: "alice", Name: "Alice"}
+	if err := SetPassword(&user, "CorrectP12"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Instance.Insert(&user); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate("alice@example.com", "CorrectP12"); err == nil {
+		t.Fatal("direct account authentication must not truncate a full email identifier")
+	}
+}