fix: validate signatures and restore report metrics

api/src/sms-config/sms-config.service.spec.ts

@@ -1071,7 +1071,7 @@ describe('SmsConfigService', () => {
     expect(prisma.auditRecord.create).toHaveBeenCalledWith({ data: expect.objectContaining({ action: 'admin_create_approved', statusAfter: 'approved' }) });
   });
 
-  it.each(['未带括号', '[英文括号]', '【【重复括号】】', '【 】'])(
+  it.each(['未带括号', '[英文括号]', '【【重复括号】】'])(
     'rejects a signature name without exactly one complete Chinese black bracket pair: %s',
     async (name) => {
       const prisma = createPrismaMock();
@@ -1092,6 +1092,23 @@ describe('SmsConfigService', () => {
     expect(prisma.smsSignature.update).not.toHaveBeenCalled();
   });
 
+  it.each([
+    '【带 空格】',
+    ' 【外部空格】',
+    '【不换\n行】',
+    '【零宽\u200B字符】',
+    '【不换行空格\u00A0】',
+    '【字节顺序标记\uFEFF】',
+    '【变体选择符\uFE0F】',
+  ])('rejects spaces, controls, and invisible characters in signature names: %s', async (name) => {
+    const prisma = createPrismaMock();
+    const service = new SmsConfigService(prisma as never);
+
+    await expect(service.createSignature({ tenantId: 'tenant-1', name }))
+      .rejects.toThrow('短信签名不能包含空格、换行或不可见字符');
+    expect(prisma.smsSignature.create).not.toHaveBeenCalled();
+  });
+
   it('updates enterprise signature drainage info through the admin API path', async () => {
     const prisma = createPrismaMock();
     const service = new SmsConfigService(prisma as never);