feat: harden account security flows

tests/test_email.py

@@ -6,10 +6,35 @@ from unittest.mock import patch
 
 from app import create_app
 from app.config import Config
-from app.email import EmailConfigurationError, send_transactional_email
+from app.email import (
+    EmailConfigurationError,
+    password_reset_notice_email,
+    send_transactional_email,
+    verification_code_email,
+)
 
 
 class TransactionalEmailTest(unittest.TestCase):
+    def test_verification_email_has_branded_code_and_escapes_purpose(self):
+        html = verification_code_email(
+            code="123456",
+            minutes=10,
+            purpose="登录<script>",
+        )
+
+        self.assertIn("供水管道健康评估系统", html)
+        self.assertIn("123456", html)
+        self.assertIn("登录&lt;script&gt;", html)
+        self.assertNotIn("登录<script>", html)
+
+    def test_reset_notice_escapes_username_and_url(self):
+        html = password_reset_notice_email(
+            username="<管理员>",
+            reset_url="https://example.com/reset?x=1&y=2",
+        )
+
+        self.assertIn("&lt;管理员&gt;", html)
+        self.assertIn("x=1&amp;y=2", html)
     def create_test_app(self, temp_dir: str, *, configured: bool):
         class TestConfig(Config):
             TESTING = True