From 6c5e84d798b117bd4b868768460afb7fb00268f0 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Sun, 30 Aug 2026 23:06:27 +0800
Subject: [PATCH] =?UTF-8?q?=E7=A6=81=E6=AD=A2=E7=9B=B4=E6=8E=A5=E8=AE=A4?=
 =?UTF-8?q?=E8=AF=81=E6=88=AA=E6=96=AD=E5=AE=8C=E6=95=B4=E9=82=AE=E7=AE=B1?=
 =?UTF-8?q?=E6=A0=87=E8=AF=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 server/services/auth/auth.go      |  7 ++-----
 server/services/auth/auth_test.go | 32 +++++++++++++++++++++++++++++++
 2 files changed, 34 insertions(+), 5 deletions(-)

diff --git a/server/services/auth/auth.go b/server/services/auth/auth.go
index e142366..f8d0452 100644
--- a/server/services/auth/auth.go
+++ b/server/services/auth/auth.go
@@ -18,12 +18,9 @@ import (
 )
 
 // Authenticate 统一校验网页、SMTP、IMAP 和 POP3 的用户凭据。
+// NormalizeAccount 只清理外围空白，不再截断完整邮箱标识。
 func NormalizeAccount(account string) string {
-	account = strings.TrimSpace(account)
-	if index := strings.IndexByte(account, '@'); index > 0 {
-		account = account[:index]
-	}
-	return account
+	return strings.TrimSpace(account)
 }
 
 // AuthenticateIdentifier 支持账号和受信主域名邮箱两种登录标识，最终统一到同一账号密码校验。
diff --git a/server/services/auth/auth_test.go b/server/services/auth/auth_test.go
index aac61c1..9e0d9f1 100644
--- a/server/services/auth/auth_test.go
+++ b/server/services/auth/auth_test.go
@@ -149,3 +149,35 @@ func TestProtocolAuthenticationAcceptsConfiguredFullEmailIdentifier(t *testing.T
 		t.Fatal("unconfigured email domain should be rejected")
 	}
 }
+
+func TestAuthenticateDoesNotTruncateFullEmailIdentifier(t *testing.T) {
+	oldConfig := config.Instance
+	oldDB := db.Instance
+	config.Instance = &config.Config{
+		DbType:  config.DBTypeSQLite,
+		DbDSN:   filepath.Join(t.TempDir(), "no-truncation-auth.db"),
+		Domain:  "example.com",
+		Domains: []string{"example.com"},
+	}
+	if err := db.Init(""); err != nil {
+		t.Fatal(err)
+	}
+	t.Cleanup(func() {
+		if db.Instance != nil && db.Instance != oldDB {
+			_ = db.Instance.Close()
+		}
+		db.Instance = oldDB
+		config.Instance = oldConfig
+	})
+
+	user := models.User{Account: "alice", Name: "Alice"}
+	if err := SetPassword(&user, "CorrectP12"); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := db.Instance.Insert(&user); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := Authenticate("alice@example.com", "CorrectP12"); err == nil {
+		t.Fatal("direct account authentication must not truncate a full email identifier")
+	}
+}