fix: polish authentication and responsive controls

tests/test_auth_registration.py

@@ -160,7 +160,7 @@ class EmailAuthenticationTest(unittest.TestCase):
             app = self.create_app(directory); client = app.test_client()
             page = client.get("/register")
             with client.session_transaction() as state: captcha = state["captcha"]
-            response = client.post("/register", data={"csrf_token": self.csrf(page), "username": "Alice", "email": "Alice@example.com", "password": "Password-1234!", "captcha": captcha})
+            response = client.post("/register", data={"csrf_token": self.csrf(page), "username": "Alice", "email": "Alice@example.com", "password": "Password-1234!", "password_confirm": "Password-1234!", "captcha": captcha})
             self.assertEqual(response.status_code, 302)
             with app.app_context():
                 user = User.query.filter_by(email="alice@example.com").one()
@@ -175,6 +175,31 @@ class EmailAuthenticationTest(unittest.TestCase):
                 self.assertTrue(User.query.filter_by(email="alice@example.com").one().is_active_account)
                 self.assertEqual(TrustedDevice.query.count(), 0)
 
+    def test_registration_rejects_mismatched_password_confirmation(self):
+        with TemporaryDirectory() as directory:
+            app = self.create_app(directory)
+            client = app.test_client()
+            page = client.get("/register")
+            with client.session_transaction() as state:
+                captcha = state["captcha"]
+
+            response = client.post(
+                "/register",
+                data={
+                    "csrf_token": self.csrf(page),
+                    "username": "Alice",
+                    "email": "alice@example.com",
+                    "password": "Password-1234!",
+                    "password_confirm": "Different-password-1234!",
+                    "captcha": captcha,
+                },
+            )
+
+            self.assertEqual(response.status_code, 400)
+            self.assertIn("两次密码输入不一致", response.get_data(as_text=True))
+            with app.app_context():
+                self.assertEqual(User.query.count(), 0)
+
     @patch("app.routes.send_transactional_email")
     @patch("app.routes.secrets.randbelow", return_value=123456)
     def test_login_accepts_username_or_email(self, _random, _send):
@@ -312,6 +337,7 @@ class EmailAuthenticationTest(unittest.TestCase):
             html = send.call_args.kwargs["html"]
             reset_path = urlparse(re.search(r'href="([^"]+)"', html).group(1)).path
             page = client.get(reset_path)
+            self.assertNotIn(b"<header", page.data)
             response = client.post(reset_path, data={"csrf_token": self.csrf(page), "password": "New-password-1234!", "password_confirm": "New-password-1234!"})
             self.assertEqual(response.status_code, 302)
             with app.app_context():