feat: 支持按需触发短信图形验证

ai_knowledge_base_v2/apps/backend/tests/test_production_readiness.py

@@ -21,6 +21,7 @@ from app.services.chat_queue_service import ChatQueueConfig, QueueRequest
 from app.services.chat_service import ChatService
 from app.services.secret_service import ENCRYPTED_PREFIX, MASKED_SECRET, SecretService
 from app.services.security_state_service import SecurityStateService
+from app.services.auth_service import AuthService
 from app.core.observability import RequestObservabilityMiddleware
 
 
@@ -145,3 +146,22 @@ def test_readiness_reports_dependency_state(monkeypatch):
     result = health.ready()
     assert result["data"]["status"] == "ready"
     assert result["data"]["checks"] == {"database": True, "redis": True}
+
+
+def test_sms_captcha_is_required_only_after_first_send(monkeypatch):
+    engine = create_engine(
+        "sqlite:///:memory:",
+        connect_args={"check_same_thread": False},
+        poolclass=StaticPool,
+    )
+    Base.metadata.create_all(engine)
+    monkeypatch.setattr("app.services.auth_service.SmsCodeService.send_code", lambda *_args: None)
+    monkeypatch.setattr("app.services.auth_service.CaptchaService.verify", lambda *_args: None)
+
+    with Session(engine) as db:
+        db.add(User(id=2, phone="13800000002", name="按需验证用户", daily_chat_limit=10, daily_chat_used=0))
+        db.commit()
+        AuthService.send_sms_code(db, "13800000002", None, None, "127.0.0.1")
+        with pytest.raises(HTTPException) as exc:
+            AuthService.send_sms_code(db, "13800000002", None, None, "127.0.0.1")
+        assert exc.value.status_code == 428