fix(auth): disable fixed SMS codes in prod

backend/ruoyi-admin/src/main/java/org/dromara/web/controller/CaptchaController.java

@@ -62,14 +62,11 @@ public class CaptchaController {
 
     /**
      * 演示/开发兜底：配置后不真发短信，验证码固定为该值，把短信通道从演示关键路径摘掉。
-     * prod profile 仅在 aihr.sms.demo-fixed-code-enabled=true 时临时放行。
+     * prod profile 代码级禁用固定验证码，不接受配置开关绕过。
      */
     @Value("${aihr.sms.dev-fixed-code:}")
     private String smsDevFixedCode;
 
-    @Value("${aihr.sms.demo-fixed-code-enabled:false}")
-    private boolean smsDemoFixedCodeEnabled;
-
     private final Environment environment;
 
     /**
@@ -84,7 +81,7 @@ public class CaptchaController {
         @Pattern(regexp = RegexConstants.MOBILE, message = "{user.mobile.phone.number.not.valid}") String phonenumber) {
         String key = GlobalConstants.CAPTCHA_CODE_KEY + phonenumber;
         boolean fixedCodeEnabled = StringUtils.isNotBlank(smsDevFixedCode)
-            && (!environment.acceptsProfiles(Profiles.of("prod")) || smsDemoFixedCodeEnabled);
+            && !environment.acceptsProfiles(Profiles.of("prod"));
         if (fixedCodeEnabled) {
             log.warn("aihr.sms.dev-fixed-code 已启用，短信验证码走固定码，未真实发送短信");
             RedisUtils.setCacheObject(key, smsDevFixedCode, Duration.ofMinutes(Constants.CAPTCHA_EXPIRATION));

backend/ruoyi-admin/src/test/java/org/dromara/web/controller/CaptchaControllerSecurityTest.java

@@ -0,0 +1,27 @@
+package org.dromara.web.controller;
+
+import org.junit.jupiter.api.Tag;
+import org.junit.jupiter.api.Test;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+@Tag("dev")
+class CaptchaControllerSecurityTest {
+
+    @Test
+    void fixedSmsCodeIsDisabledInProdWithoutOverride() throws Exception {
+        Path source = Path.of("src/main/java/org/dromara/web/controller/CaptchaController.java");
+        if (!Files.exists(source)) {
+            source = Path.of("ruoyi-admin/src/main/java/org/dromara/web/controller/CaptchaController.java");
+        }
+        String code = Files.readString(source);
+
+        assertTrue(code.contains("!environment.acceptsProfiles(Profiles.of(\"prod\"))"));
+        assertFalse(code.contains("smsDemoFixedCodeEnabled"));
+        assertFalse(code.contains("demo-fixed-code-enabled"));
+    }
+}

docs/BRD_IMPLEMENTATION_AUDIT.md

@@ -2,6 +2,8 @@
 
 更新时间：2026-07-14
 
+- 2026-07-14 BRD G3/G6 生产验证码安全边界修复：`CaptchaController` 原先允许通过 `aihr.sms.demo-fixed-code-enabled=true` 在 `prod` profile 放行固定短信验证码，和项目要求的“生产代码级禁用”冲突；现仅允许非 `prod` profile 使用 `aihr.sms.dev-fixed-code`，删除生产覆盖开关，并新增源码契约回归与 `demo-check` marker。未修改线上配置或生产数据。
+
 ## 1. 审查口径
 
 本记录以 [物业AI人力资源系统业务需求文档BRD.md](物业AI人力资源系统业务需求文档BRD.md) 为业务事实源，以 [FIGMA_IMPLEMENTATION_MATRIX.md](FIGMA_IMPLEMENTATION_MATRIX.md) 判断页面与视觉落地，以 [API_INTEGRATION.md](API_INTEGRATION.md) 和真实接口/浏览器结果判断运行闭环。

scripts/demo-check.sh

@@ -611,6 +611,8 @@ contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/control
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java "仅支持 txt/md/markdown/pdf/doc/docx/xls/xlsx/ppt/pptx/图片文件"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java "/embeddings"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java "aihr_knowledge_gap"
+contains backend/ruoyi-admin/src/main/java/org/dromara/web/controller/CaptchaController.java '!environment.acceptsProfiles(Profiles.of("prod"))'
+contains backend/ruoyi-admin/src/test/java/org/dromara/web/controller/CaptchaControllerSecurityTest.java "CaptchaControllerSecurityTest"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java "requester_ext_party_id"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/controller/AihrSopController.java "currentRequesterExtPartyId"
 contains backend/ruoyi-modules/ruoyi-aihr/src/main/java/org/dromara/aihr/service/AihrSopSeedService.java "hasExplicitSopReviewDecision"