feat(registration): 支持邮箱白名单后缀通配符

frontend/src/i18n/locales/en.ts

@@ -423,6 +423,7 @@ export default {
     emailSuffixNotAllowed: 'This email domain is not allowed for registration.',
     emailSuffixNotAllowedWithAllowed:
       'This email domain is not allowed. Allowed domains: {suffixes}',
+    emailSuffixAllowedMore: 'and {count} more',
     loginSuccess: 'Login successful! Welcome back.',
     accountCreatedSuccess: 'Account created successfully! Welcome to {siteName}.',
     reloginRequired: 'Session expired. Please log in again.',
@@ -5282,9 +5283,9 @@ export default {
         emailVerificationHint: 'Require email verification for new registrations',
         emailSuffixWhitelist: 'Email Domain Whitelist',
         emailSuffixWhitelistHint:
-          "Only email addresses from the specified domains can register (for example, {'@'}qq.com, {'@'}gmail.com)",
-        emailSuffixWhitelistPlaceholder: 'example.com',
-        emailSuffixWhitelistInputHint: 'Leave empty for no restriction',
+          "Only email addresses from the specified domains can register (for example, {'@'}qq.com, {'@'}gmail.com, *.edu.cn)",
+        emailSuffixWhitelistPlaceholder: '@example.com, *.edu.cn',
+        emailSuffixWhitelistInputHint: 'Leave empty for no restriction. Use *.edu.cn to match edu.cn and its subdomains.',
         promoCode: 'Promo Code',
         promoCodeHint: 'Allow users to use promo codes during registration',
         invitationCode: 'Invitation Code Registration',

frontend/src/i18n/locales/zh.ts

@@ -422,6 +422,7 @@ export default {
     registrationFailed: '注册失败，请重试。',
     emailSuffixNotAllowed: '该邮箱域名不在允许注册范围内。',
     emailSuffixNotAllowedWithAllowed: '该邮箱域名不被允许。可用域名：{suffixes}',
+    emailSuffixAllowedMore: '等 {count} 项',
     loginSuccess: '登录成功！欢迎回来。',
     accountCreatedSuccess: '账户创建成功！欢迎使用 {siteName}。',
     reloginRequired: '会话已过期，请重新登录。',
@@ -5445,9 +5446,9 @@ export default {
         emailVerificationHint: '新用户注册时需要验证邮箱',
         emailSuffixWhitelist: '邮箱域名白名单',
         emailSuffixWhitelistHint:
-          "仅允许使用指定域名的邮箱注册账号（例如 {'@'}qq.com, {'@'}gmail.com）",
-        emailSuffixWhitelistPlaceholder: 'example.com',
-        emailSuffixWhitelistInputHint: '留空则不限制',
+          "仅允许使用指定域名的邮箱注册账号（例如 {'@'}qq.com, {'@'}gmail.com, *.edu.cn）",
+        emailSuffixWhitelistPlaceholder: '@example.com, *.edu.cn',
+        emailSuffixWhitelistInputHint: '留空则不限制。使用 *.edu.cn 可匹配 edu.cn 及其子域名。',
         promoCode: '优惠码',
         promoCodeHint: '允许用户在注册时使用优惠码',
         invitationCode: '邀请码注册',

frontend/src/utils/__tests__/registrationEmailPolicy.spec.ts

@@ -1,5 +1,6 @@
 import { describe, expect, it } from 'vitest'
 import {
+  formatRegistrationEmailSuffixWhitelistForMessage,
   isRegistrationEmailSuffixAllowed,
   isRegistrationEmailSuffixDomainValid,
   normalizeRegistrationEmailSuffixDomain,
@@ -11,6 +12,7 @@ import {
 describe('registrationEmailPolicy utils', () => {
   it('normalizeRegistrationEmailSuffixDomain lowercases, strips @, and ignores invalid chars', () => {
     expect(normalizeRegistrationEmailSuffixDomain(' @Exa!mple.COM ')).toBe('example.com')
+    expect(normalizeRegistrationEmailSuffixDomain(' *.EDU!.CN ')).toBe('*.edu.cn')
   })
 
   it('normalizeRegistrationEmailSuffixDomains deduplicates normalized domains', () => {
@@ -22,14 +24,20 @@ describe('registrationEmailPolicy utils', () => {
         '-invalid.com',
         'foo..bar.com',
         ' @foo.bar ',
-        '@foo.bar'
+        '@foo.bar',
+        '*.EDU.CN',
+        '*.edu.cn'
       ])
-    ).toEqual(['example.com', 'foo.bar'])
+    ).toEqual(['example.com', 'foo.bar', '*.edu.cn'])
   })
 
   it('parseRegistrationEmailSuffixWhitelistInput supports separators and deduplicates', () => {
-    const input = '\n  @example.com,example.com，@foo.bar\t@FOO.bar  '
-    expect(parseRegistrationEmailSuffixWhitelistInput(input)).toEqual(['example.com', 'foo.bar'])
+    const input = '\n  @example.com,example.com，@foo.bar\t@FOO.bar *.EDU.CN  '
+    expect(parseRegistrationEmailSuffixWhitelistInput(input)).toEqual([
+      'example.com',
+      'foo.bar',
+      '*.edu.cn'
+    ])
   })
 
   it('parseRegistrationEmailSuffixWhitelistInput drops tokens containing invalid chars', () => {
@@ -38,7 +46,7 @@ describe('registrationEmailPolicy utils', () => {
   })
 
   it('parseRegistrationEmailSuffixWhitelistInput drops structurally invalid domains', () => {
-    const input = '@-bad.com, @foo..bar.com, @foo.bar, @xn--ok.com'
+    const input = '@-bad.com, @foo..bar.com, @foo.bar, @xn--ok.com, *., *, *.@, *.foo'
     expect(parseRegistrationEmailSuffixWhitelistInput(input)).toEqual(['foo.bar', 'xn--ok.com'])
   })
 
@@ -53,17 +61,22 @@ describe('registrationEmailPolicy utils', () => {
         'foo.bar',
         '',
         '-invalid.com',
-        ' @foo.bar '
+        ' @foo.bar ',
+        '*.EDU.CN'
       ])
-    ).toEqual(['@example.com', '@foo.bar'])
+    ).toEqual(['@example.com', '@foo.bar', '*.edu.cn'])
   })
 
   it('isRegistrationEmailSuffixDomainValid matches backend-compatible domain rules', () => {
     expect(isRegistrationEmailSuffixDomainValid('example.com')).toBe(true)
     expect(isRegistrationEmailSuffixDomainValid('foo-bar.example.com')).toBe(true)
+    expect(isRegistrationEmailSuffixDomainValid('*.edu.cn')).toBe(true)
     expect(isRegistrationEmailSuffixDomainValid('-bad.com')).toBe(false)
     expect(isRegistrationEmailSuffixDomainValid('foo..bar.com')).toBe(false)
     expect(isRegistrationEmailSuffixDomainValid('localhost')).toBe(false)
+    expect(isRegistrationEmailSuffixDomainValid('*.foo')).toBe(false)
+    expect(isRegistrationEmailSuffixDomainValid('*')).toBe(false)
+    expect(isRegistrationEmailSuffixDomainValid('*.@')).toBe(false)
   })
 
   it('isRegistrationEmailSuffixAllowed allows any email when whitelist is empty', () => {
@@ -73,5 +86,36 @@ describe('registrationEmailPolicy utils', () => {
   it('isRegistrationEmailSuffixAllowed applies exact suffix matching', () => {
     expect(isRegistrationEmailSuffixAllowed('user@example.com', ['@example.com'])).toBe(true)
     expect(isRegistrationEmailSuffixAllowed('user@sub.example.com', ['@example.com'])).toBe(false)
+    expect(isRegistrationEmailSuffixAllowed('user@qq.com', ['@qq.com'])).toBe(true)
+    expect(isRegistrationEmailSuffixAllowed('user@sub.qq.com', ['@qq.com'])).toBe(false)
+  })
+
+  it('isRegistrationEmailSuffixAllowed applies wildcard suffix matching', () => {
+    expect(isRegistrationEmailSuffixAllowed('student@cs.edu.cn', ['*.edu.cn'])).toBe(true)
+    expect(isRegistrationEmailSuffixAllowed('student@edu.cn', ['*.edu.cn'])).toBe(true)
+    expect(isRegistrationEmailSuffixAllowed('student@foo.cn', ['*.edu.cn'])).toBe(false)
+  })
+
+  it('isRegistrationEmailSuffixAllowed supports mixed exact and wildcard entries', () => {
+    const whitelist = ['@a.com', '*.b.cn']
+    expect(isRegistrationEmailSuffixAllowed('user@a.com', whitelist)).toBe(true)
+    expect(isRegistrationEmailSuffixAllowed('user@school.b.cn', whitelist)).toBe(true)
+    expect(isRegistrationEmailSuffixAllowed('user@b.cn', whitelist)).toBe(true)
+    expect(isRegistrationEmailSuffixAllowed('user@c.cn', whitelist)).toBe(false)
+  })
+
+  it('formatRegistrationEmailSuffixWhitelistForMessage lists up to five entries', () => {
+    expect(
+      formatRegistrationEmailSuffixWhitelistForMessage(
+        ['@a.com', '@b.com', '@c.com', '@d.com', '@e.com'],
+        { separator: ', ', more: (count) => `and ${count} more` }
+      )
+    ).toBe('@a.com, @b.com, @c.com, @d.com, @e.com')
+    expect(
+      formatRegistrationEmailSuffixWhitelistForMessage(
+        ['@a.com', '@b.com', '@c.com', '@d.com', '@e.com', '*.edu.cn', '@f.com'],
+        { separator: ', ', more: (count) => `and ${count} more` }
+      )
+    ).toBe('@a.com, @b.com, @c.com, @d.com, @e.com, and 2 more')
   })
 })

frontend/src/utils/registrationEmailPolicy.ts

@@ -2,19 +2,21 @@ const EMAIL_SUFFIX_TOKEN_SPLIT_RE = /[\s,，]+/
 const EMAIL_SUFFIX_INVALID_CHAR_RE = /[^a-z0-9.-]/g
 const EMAIL_SUFFIX_INVALID_CHAR_CHECK_RE = /[^a-z0-9.-]/
 const EMAIL_SUFFIX_PREFIX_RE = /^@+/
+const EMAIL_SUFFIX_WILDCARD_PREFIX = '*.'
+const EMAIL_SUFFIX_MESSAGE_VISIBLE_LIMIT = 5
 const EMAIL_SUFFIX_DOMAIN_PATTERN =
   /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)+$/
 
 // normalizeRegistrationEmailSuffixDomain converts raw input into a canonical domain token.
-// It removes leading "@", lowercases input, and strips all invalid characters.
+// Exact domains are returned without "@"; wildcard domains keep the "*." prefix.
 export function normalizeRegistrationEmailSuffixDomain(raw: string): string {
   let value = String(raw || '').trim().toLowerCase()
   if (!value) {
     return ''
   }
+
   value = value.replace(EMAIL_SUFFIX_PREFIX_RE, '')
-  value = value.replace(EMAIL_SUFFIX_INVALID_CHAR_RE, '')
-  return value
+  return normalizeRegistrationEmailSuffixToken(value, false)
 }
 
 export function normalizeRegistrationEmailSuffixDomains(
@@ -60,7 +62,7 @@ export function parseRegistrationEmailSuffixWhitelistInput(input: string): strin
 export function normalizeRegistrationEmailSuffixWhitelist(
   items: string[] | null | undefined
 ): string[] {
-  return normalizeRegistrationEmailSuffixDomains(items).map((domain) => `@${domain}`)
+  return normalizeRegistrationEmailSuffixDomains(items).map(toCanonicalRegistrationEmailSuffix)
 }
 
 function extractRegistrationEmailDomain(email: string): string {
@@ -91,7 +93,32 @@ export function isRegistrationEmailSuffixAllowed(
     return false
   }
   const emailSuffix = `@${emailDomain}`
-  return normalizedWhitelist.includes(emailSuffix)
+  return normalizedWhitelist.some((allowed) => {
+    if (allowed.startsWith('@')) {
+      return allowed === emailSuffix
+    }
+    if (allowed.startsWith(EMAIL_SUFFIX_WILDCARD_PREFIX)) {
+      const base = allowed.slice(EMAIL_SUFFIX_WILDCARD_PREFIX.length)
+      return emailDomain === base || emailDomain.endsWith(`.${base}`)
+    }
+    return false
+  })
+}
+
+export function formatRegistrationEmailSuffixWhitelistForMessage(
+  whitelist: string[] | null | undefined,
+  options: {
+    separator: string
+    more: (count: number) => string
+  }
+): string {
+  const normalizedWhitelist = normalizeRegistrationEmailSuffixWhitelist(whitelist)
+  const visible = normalizedWhitelist.slice(0, EMAIL_SUFFIX_MESSAGE_VISIBLE_LIMIT)
+  const hiddenCount = normalizedWhitelist.length - visible.length
+  if (hiddenCount > 0) {
+    visible.push(options.more(hiddenCount))
+  }
+  return visible.join(options.separator)
 }
 
 // Pasted domains should be strict: any invalid character drops the whole token.
@@ -101,15 +128,38 @@ function normalizeRegistrationEmailSuffixDomainStrict(raw: string): string {
     return ''
   }
   value = value.replace(EMAIL_SUFFIX_PREFIX_RE, '')
-  if (!value || EMAIL_SUFFIX_INVALID_CHAR_CHECK_RE.test(value)) {
-    return ''
-  }
-  return value
+  return normalizeRegistrationEmailSuffixToken(value, true)
 }
 
 export function isRegistrationEmailSuffixDomainValid(domain: string): boolean {
   if (!domain) {
     return false
   }
-  return EMAIL_SUFFIX_DOMAIN_PATTERN.test(domain)
+  if (domain.startsWith(EMAIL_SUFFIX_WILDCARD_PREFIX)) {
+    return EMAIL_SUFFIX_DOMAIN_PATTERN.test(domain.slice(EMAIL_SUFFIX_WILDCARD_PREFIX.length))
+  }
+  return !domain.includes('*') && EMAIL_SUFFIX_DOMAIN_PATTERN.test(domain)
+}
+
+function normalizeRegistrationEmailSuffixToken(value: string, strict: boolean): string {
+  if (value.startsWith(EMAIL_SUFFIX_WILDCARD_PREFIX)) {
+    const domain = value.slice(EMAIL_SUFFIX_WILDCARD_PREFIX.length)
+    if (strict && (!domain || EMAIL_SUFFIX_INVALID_CHAR_CHECK_RE.test(domain))) {
+      return ''
+    }
+    return `${EMAIL_SUFFIX_WILDCARD_PREFIX}${domain.replace(EMAIL_SUFFIX_INVALID_CHAR_RE, '')}`
+  }
+
+  if (value === '*') {
+    return strict ? '' : value
+  }
+
+  if (strict && EMAIL_SUFFIX_INVALID_CHAR_CHECK_RE.test(value)) {
+    return ''
+  }
+  return value.replace(/[*]/g, '').replace(EMAIL_SUFFIX_INVALID_CHAR_RE, '')
+}
+
+function toCanonicalRegistrationEmailSuffix(domain: string): string {
+  return domain.startsWith(EMAIL_SUFFIX_WILDCARD_PREFIX) ? domain : `@${domain}`
 }

frontend/src/views/admin/SettingsView.vue

@@ -1415,7 +1415,6 @@
                       :key="suffix"
                       class="inline-flex items-center gap-1 rounded bg-gray-100 px-2 py-1 text-xs font-mono text-gray-700 dark:bg-dark-600 dark:text-gray-200"
                     >
-                      <span class="text-gray-400 dark:text-gray-500">@</span>
                       <span>{{ suffix }}</span>
                       <button
                         type="button"
@@ -1436,10 +1435,6 @@
                     <div
                       class="flex min-w-[220px] flex-1 items-center gap-1 rounded border border-transparent px-2 py-1 focus-within:border-primary-300 dark:focus-within:border-primary-700"
                     >
-                      <span
-                        class="font-mono text-sm text-gray-400 dark:text-gray-500"
-                        >@</span
-                      >
                       <input
                         v-model="registrationEmailSuffixWhitelistDraft"
                         type="text"
@@ -7983,8 +7978,8 @@ async function saveSettings() {
       registration_enabled: form.registration_enabled,
       email_verify_enabled: form.email_verify_enabled,
       registration_email_suffix_whitelist:
-        registrationEmailSuffixWhitelistTags.value.map(
-          (suffix) => `@${suffix}`,
+        registrationEmailSuffixWhitelistTags.value.map((suffix) =>
+          suffix.startsWith("*.") ? suffix : `@${suffix}`,
         ),
       promo_code_enabled: form.promo_code_enabled,
       invitation_code_enabled: form.invitation_code_enabled,

frontend/src/views/auth/EmailVerifyView.vue

@@ -164,6 +164,7 @@ import {
 import { apiClient } from '@/api/client'
 import { buildAuthErrorMessage } from '@/utils/authError'
 import {
+  formatRegistrationEmailSuffixWhitelistForMessage,
   isRegistrationEmailSuffixAllowed,
   normalizeRegistrationEmailSuffixWhitelist
 } from '@/utils/registrationEmailPolicy'
@@ -574,7 +575,10 @@ function buildEmailSuffixNotAllowedMessage(): string {
   }
   const separator = String(locale.value || '').toLowerCase().startsWith('zh') ? '、' : ', '
   return t('auth.emailSuffixNotAllowedWithAllowed', {
-    suffixes: normalizedWhitelist.join(separator)
+    suffixes: formatRegistrationEmailSuffixWhitelistForMessage(normalizedWhitelist, {
+      separator,
+      more: (count) => t('auth.emailSuffixAllowedMore', { count })
+    })
   })
 }
 </script>

frontend/src/views/auth/RegisterView.vue

@@ -318,6 +318,7 @@ import {
 } from '@/api/auth'
 import { buildAuthErrorMessage } from '@/utils/authError'
 import {
+  formatRegistrationEmailSuffixWhitelistForMessage,
   isRegistrationEmailSuffixAllowed,
   normalizeRegistrationEmailSuffixWhitelist
 } from '@/utils/registrationEmailPolicy'
@@ -739,7 +740,10 @@ function buildEmailSuffixNotAllowedMessage(): string {
   }
   const separator = String(locale.value || '').toLowerCase().startsWith('zh') ? '、' : ', '
   return t('auth.emailSuffixNotAllowedWithAllowed', {
-    suffixes: normalizedWhitelist.join(separator)
+    suffixes: formatRegistrationEmailSuffixWhitelistForMessage(normalizedWhitelist, {
+      separator,
+      more: (count) => t('auth.emailSuffixAllowedMore', { count })
+    })
   })
 }