fix(ipsec): требовать пароль .p12 не короче 8 символов

Co-authored-by: Cursor <[email protected]>

backend/src/routes/ipsec.ts

@@ -1,6 +1,7 @@
 import type { FastifyPluginAsyncZod } from "@fastify/type-provider-zod"
 import type { FastifyReply } from "fastify"
 import {
+  IPSEC_MIN_PASSPHRASE,
   ipsecCertDeleteRequestSchema,
   ipsecCertExportByNameRequestSchema,
   ipsecCertExportRequestSchema,
@@ -97,6 +98,22 @@ function errReply(reply: FastifyReply, e: unknown) {
   return reply.status(502).send({ error: `RouterOS: ${msg}` })
 }
 
+/**
+ * 400 по невалидному телу. Для короткого пароля .p12 — понятный текст вместо generic-сообщения:
+ * RouterOS отклоняет `export-passphrase` короче 8 символов.
+ */
+function badBodyReply(reply: FastifyReply, error: z.ZodError) {
+  const shortPassphrase = error.issues.some(
+    (issue) => issue.path[0] === "passphrase" && issue.code === "too_small",
+  )
+  if (shortPassphrase) {
+    return reply.status(400).send({
+      error: `Пароль архива .p12 должен быть не короче ${IPSEC_MIN_PASSPHRASE} символов (требование RouterOS)`,
+    })
+  }
+  return reply.status(400).send({ error: "Некорректное тело запроса", details: error.flatten() })
+}
+
 async function recordIpsec(
   server: NonNullable<Awaited<ReturnType<typeof getEnabledIpsecServerById>>>,
   source: ConfigRevisionSource,
@@ -243,7 +260,7 @@ const ipsecRoutes: FastifyPluginAsyncZod = async (app) => {
   app.post("/ipsec/users", async (req, reply) => {
     const parsed = ipsecUserCreateRequestSchema.safeParse(req.body ?? {})
     if (!parsed.success) {
-      return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+      return badBodyReply(reply, parsed.error)
     }
     const body = parsed.data
     const server = await getEnabledIpsecServerById(body.serverId)
@@ -608,7 +625,7 @@ const ipsecRoutes: FastifyPluginAsyncZod = async (app) => {
     const { serverId, rosId } = req.params as { serverId: string; rosId: string }
     const parsed = ipsecCertExportRequestSchema.safeParse({ ...(req.body as object), serverId, clientId: rosId })
     if (!parsed.success) {
-      return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+      return badBodyReply(reply, parsed.error)
     }
     const body = parsed.data
     const server = await getEnabledIpsecServerById(serverIdParam(serverId))
@@ -667,7 +684,7 @@ const ipsecRoutes: FastifyPluginAsyncZod = async (app) => {
     const { serverId } = req.params as { serverId: string }
     const parsed = ipsecCertExportByNameRequestSchema.safeParse(req.body ?? {})
     if (!parsed.success) {
-      return reply.status(400).send({ error: "Некорректное тело запроса", details: parsed.error.flatten() })
+      return badBodyReply(reply, parsed.error)
     }
     const { name, passphrase } = parsed.data
     const server = await getEnabledIpsecServerById(serverIdParam(serverId))