From 5417c747aa224003fdc076b18e4fdca1c0ac4d87 Mon Sep 17 00:00:00 2001
From: Yunling Zhang <zhangyunlingzh@gmail.com>
Date: Mon, 28 Sep 2026 17:38:16 +0800
Subject: [PATCH] =?UTF-8?q?fix(server):=20=E4=B8=8D=E5=AD=98=E5=9C=A8?=
 =?UTF-8?q?=E7=9A=84=E8=B4=A6=E5=8F=B7=E8=BF=94=E5=9B=9E=20401=20=E8=80=8C?=
 =?UTF-8?q?=E9=9D=9E=20404=EF=BC=8C=E9=81=BF=E5=85=8D=E6=B3=84=E6=BC=8F?=
 =?UTF-8?q?=E8=B4=A6=E5=8F=B7=E5=AD=98=E5=9C=A8=E6=80=A7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

未知账号与未认证/停用账号统一返回 401 + WWW-Authenticate。
新增 account_test.go 验证带/不带凭据均为 401。
---
 internal/server/account_test.go | 25 +++++++++++++++++++++++++
 internal/server/server.go       |  3 +++
 2 files changed, 28 insertions(+)
 create mode 100644 internal/server/account_test.go

diff --git a/internal/server/account_test.go b/internal/server/account_test.go
new file mode 100644
index 0000000..06e7b93
--- /dev/null
+++ b/internal/server/account_test.go
@@ -0,0 +1,25 @@
+package server
+
+import (
+	"net/http"
+	"testing"
+)
+
+func TestDAVUnknownAccountChallenge(t *testing.T) {
+	s, _, _ := newTestServer(t)
+
+	// 未带任何凭据的未知账号，与“账号存在但未认证”一致：401 + WWW-Authenticate。
+	rec := request(s, "PROPFIND", "/ghost/", "", "", nil, map[string]string{"Depth": "0"})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("未知账号应为 401，实际 %d", rec.Code)
+	}
+	if got := rec.Header().Get("WWW-Authenticate"); got != `Basic realm="davbox"` {
+		t.Fatalf("未知账号应带 WWW-Authenticate，实际 %q", got)
+	}
+
+	// 带任意凭据结果一样，不泄漏账号是否存在。
+	rec = request(s, "PROPFIND", "/ghost/", "ghost", "whatever", nil, map[string]string{"Depth": "0"})
+	if rec.Code != http.StatusUnauthorized {
+		t.Fatalf("未知账号（带凭据）应为 401，实际 %d", rec.Code)
+	}
+}
diff --git a/internal/server/server.go b/internal/server/server.go
index a73978b..67b8102 100644
--- a/internal/server/server.go
+++ b/internal/server/server.go
@@ -75,6 +75,9 @@ func (s *Server) route(w http.ResponseWriter, r *http.Request) {
 				s.handleDAV(w, r, seg)
 				return
 			}
+			// 账号不存在时返回与未认证一致的 401，避免泄漏账号是否存在。
+			writeAuthChallenge(w)
+			return
 		}
 		writeError(w, http.StatusNotFound, "未找到")
 	}