fix: validate signatures and restore report metrics

api/src/sms-config/sms-config.service.spec.ts

@@ -1071,7 +1071,7 @@ describe('SmsConfigService', () => {
     expect(prisma.auditRecord.create).toHaveBeenCalledWith({ data: expect.objectContaining({ action: 'admin_create_approved', statusAfter: 'approved' }) });
   });
 
-  it.each(['未带括号', '[英文括号]', '【【重复括号】】', '【 】'])(
+  it.each(['未带括号', '[英文括号]', '【【重复括号】】'])(
     'rejects a signature name without exactly one complete Chinese black bracket pair: %s',
     async (name) => {
       const prisma = createPrismaMock();
@@ -1092,6 +1092,23 @@ describe('SmsConfigService', () => {
     expect(prisma.smsSignature.update).not.toHaveBeenCalled();
   });
 
+  it.each([
+    '【带 空格】',
+    ' 【外部空格】',
+    '【不换\n行】',
+    '【零宽\u200B字符】',
+    '【不换行空格\u00A0】',
+    '【字节顺序标记\uFEFF】',
+    '【变体选择符\uFE0F】',
+  ])('rejects spaces, controls, and invisible characters in signature names: %s', async (name) => {
+    const prisma = createPrismaMock();
+    const service = new SmsConfigService(prisma as never);
+
+    await expect(service.createSignature({ tenantId: 'tenant-1', name }))
+      .rejects.toThrow('短信签名不能包含空格、换行或不可见字符');
+    expect(prisma.smsSignature.create).not.toHaveBeenCalled();
+  });
+
   it('updates enterprise signature drainage info through the admin API path', async () => {
     const prisma = createPrismaMock();
     const service = new SmsConfigService(prisma as never);

api/src/sms-config/sms-config.service.ts

@@ -1990,9 +1990,12 @@ function normalizeSmsSignature(name: string) {
 }
 
 function validateCompleteSmsSignature(name: string) {
-  const value = name.trim();
+  const value = name;
+  if (/[\p{White_Space}\p{Cc}\p{Default_Ignorable_Code_Point}]/u.test(value)) {
+    throw new BadRequestException('短信签名不能包含空格、换行或不可见字符');
+  }
   const match = value.match(/^【([^【】]+)】$/);
-  if (!match || match[1] !== match[1].trim()) {
+  if (!match) {
     throw new BadRequestException('短信签名必须包含完整中文黑括号，例如：【某某科技】');
   }
   return value;