fix(auth): secure passkey challenge transactions (#6178)

tests/test_cache_system.py

@@ -15,7 +15,7 @@ from app.core.cache import (
     cached,
 )
 from app.core.config import settings
-from app.helper.redis import AsyncRedisHelper, RedisHelper
+from app.helper.redis import AsyncRedisHelper, RedisHelper, serialize
 
 def test_file_backend_items_keep_relative_keys_and_bytes(tmp_path):
     """
@@ -548,6 +548,27 @@ def test_redis_helper_uses_blocking_pool_settings(monkeypatch):
 
     helper.close()
 
+
+def test_redis_helper_pop_uses_atomic_getdel():
+    """Redis 缓存领取必须通过单条 GETDEL 命令完成。"""
+    calls = []
+
+    class FakeClient:
+        def getdel(self, key):
+            calls.append(key)
+            return serialize({"challenge": "value"})
+
+    helper = RedisHelper()
+    helper.client = FakeClient()
+    try:
+        value = helper.pop("token", region="passkey_challenge")
+    finally:
+        helper.client = None
+
+    assert value == {"challenge": "value"}
+    assert calls == ["region:passkey_challenge:key:token"]
+
+
 def test_async_redis_helper_uses_blocking_pool_settings(monkeypatch):
     """
     Redis 异步客户端应使用阻塞连接池，避免高并发缓存读取立刻抛出连接耗尽错误。