From 4b08cb455ed9b448f1d95bb4a71ea096bdead049 Mon Sep 17 00:00:00 2001 From: shunli Date: Tue, 5 May 2026 20:15:16 +0800 Subject: [PATCH] =?UTF-8?q?R91=20A3-A4=20=E6=94=B6=E5=8F=A3=E4=BC=81?= =?UTF-8?q?=E5=BE=AE=E7=A7=BB=E5=8A=A8=E9=BB=98=E8=AE=A4=E5=85=A5=E5=8F=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- client/src/api/auth.ts | 2 +- ...-05_20-01-18-r90-r91-trialrun-closeout.csv | 2 +- server/src/routes/wecomAuth.js | 2 +- server/tests/unit/routes/wecomAuth.test.js | 21 +++++++++++++++++-- 4 files changed, 22 insertions(+), 5 deletions(-) diff --git a/client/src/api/auth.ts b/client/src/api/auth.ts index 0901c4fd..5a4aa3dc 100644 --- a/client/src/api/auth.ts +++ b/client/src/api/auth.ts @@ -27,7 +27,7 @@ export type WecomEntryConfig = { agentId: string; loginUrl: string | null; bindEnabled: boolean; - defaultReturnTo: "/portal"; + defaultReturnTo: string; status: "ready" | "disabled" | "misconfigured"; statusReasons: string[]; }; diff --git a/issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv b/issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv index 6abc5b1e..4fc70688 100644 --- a/issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv +++ b/issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv @@ -1,7 +1,7 @@ "ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes" "A1","R90/R91 执行合同冻结","建立本轮试运行收口执行合同，范围限定为事实源刷新、公网部署/企微移动闭环、测试账号核对与自动化回归，不新增横向业务模块。","Issue CSV 字段完整且通过校验；后续实施均能回写到本合同。","命令：`python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv`。业务：确认本轮不把 ERP、复杂财务、高级考勤、采购差旅扩展纳入试运行主线。","manual","DONE","DONE","DONE","issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv","[]","2026-05-05：CSV 已创建并通过 validate_issues_csv；回滚路径：删除本轮新增 CSV；不影响业务代码。" "A2","治理事实源刷新","刷新当前权威事实源，修正 R80-R89 后文档中关于企微、移动入口、feature flag、试运行状态的过期描述，并保留旧 CSV superseded 处理原则。","`docs/feature-matrix.md`、`docs/admin-handbook.md`、`deploy/trialrun/checklist.md`、`artifacts/r70/manual-trialrun-checklist.md` 与 R89/R80-R86 当前结论一致；旧 Issue 残留不再被误判为当前待办。","命令：`rg -n 'returnTo=%2Fportal|WECOM_ENABLED=false|WECOM_ENTRY_ENABLED=false|blocked_external' docs/admin-handbook.md deploy/trialrun/checklist.md docs/feature-matrix.md artifacts/r70/manual-trialrun-checklist.md artifacts/r75/coverage-matrix.csv || true`。业务：管理员按文档配置企微入口时默认手机进入 `/mobile`，且能理解哪些历史 TODO 已由后续 R77-R89 替代。","manual|rg","DONE","DONE","DONE","docs/feature-matrix.md|docs/admin-handbook.md|deploy/trialrun/checklist.md|artifacts/r70/manual-trialrun-checklist.md|artifacts/r70/manual-trialrun-report.md|artifacts/r75/coverage-matrix.csv|issues/README.md","[""A1""]","2026-05-05：事实源已刷新；旧 R79 企微关闭诊断已标为历史，不批量伪造旧 CSV 状态；回滚路径：恢复文档变更。" -"A3","公网部署与测试账号核对","核对 `https://oa.hyinda.com` 当前部署版本、运行时配置、已有测试账号/smoke 账号是否可用于 live smoke，必要时只做配置级修正，不写入密钥到仓库。","公网 `/ready` 正常；远端版本与本地最新提交差异明确；至少确认一组可自动化 smoke 的测试账号存在或记录缺口；敏感值不进入 git。","命令：`curl -fsS https://oa.hyinda.com/ready`；SSH 只读核对远端部署目录、容器状态和测试账号清单。业务：用测试账号登录后能进入 Portal 或 mobile 工作台。","ssh|curl|manual","TODO","TODO","TODO","external|deploy/trialrun/checklist.md","[""A2""]","回滚路径：如做配置修正，先备份远端 `.env` 或 DB flag；不提交任何 secret。" +"A3","公网部署与测试账号核对","核对 `https://oa.hyinda.com` 当前部署版本、运行时配置、已有测试账号/smoke 账号是否可用于 live smoke，必要时只做配置级修正，不写入密钥到仓库。","公网 `/ready` 正常；远端版本与本地最新提交差异明确；至少确认一组可自动化 smoke 的测试账号存在或记录缺口；敏感值不进入 git。","命令：`curl -fsS https://oa.hyinda.com/ready`；SSH 只读核对远端部署目录、容器状态和测试账号清单。业务：用测试账号登录后能进入 Portal 或 mobile 工作台。","ssh|curl|manual","DONE","DONE","DONE","external|deploy/trialrun/checklist.md|artifacts/r70/manual-trialrun-report.md","[""A2""]","2026-05-05：`/ready` 通过；root/deploy 均可 SSH；远端 server/db 正常；已确认 `SMOKE001`/`SMOKE002` 独立 smoke 账号存在且 active，但本地/远端未配置 LIVE_SMOKE_* 密码变量。回滚路径：本项只读核对，不改变业务数据。" "A4","真实企微移动闭环与自动化辅助","把公网企业微信入口按移动优先口径收口，并用 Playwright/curl 压榨自动化验证；真实企业微信客户端只保留必须由用户点击的一次确认。","企微配置接口 ready；OAuth login 302 正确；移动 UA/小屏访问默认落到 `/mobile`；已记录真机企业微信验证结果或明确唯一剩余人工动作。","命令：`curl -I 'https://oa.hyinda.com/api/auth/wecom/login?returnTo=%2Fmobile'`；Playwright 用移动视口验证登录页 CTA 与 `/mobile` 导航。业务：手机企业微信工作台进入 OA 后已绑定用户不再停留在登录页。","playwright|curl|manual","DOING","TODO","TODO","server/src/routes/wecomAuth.js|server/tests/unit/routes/wecomAuth.test.js|client/src/api/auth.ts|client/tests/e2e/r89-mobile-login-navigation.spec.ts|external|artifacts/r70/manual-trialrun-report.md","[""A3""]","涉及真实企微容器时需要用户手机确认；回滚路径：企业微信后台入口改回上一 URL 或关闭 wecom_entry_v1。" "A5","发布门禁与备份恢复准备","执行可用的本地/公网门禁，补齐备份恢复演练的当前状态，区分已自动化完成、可远端执行和仍需人工确认的部分。","本地 typecheck/build 或相关 release gate 通过；公网 live smoke 结果清晰；DB/storage 备份恢复状态有记录，未完成项有可操作步骤。","命令：`cd client && npm run typecheck && npm run build`；可用时执行 `bash scripts/qa/run-web-gates.sh smoke-live`。业务：发布前知道是否可以回滚到上个版本，且 smoke 不使用真实业务账号。","bash|playwright|manual","TODO","TODO","TODO","client|server|deploy/trialrun/checklist.md|artifacts/r70/manual-trialrun-report.md","[""A4""]","若运行全量回归成本过高，记录原因并保留最小门禁；回滚路径：不改变业务数据。" "A6","状态回填与中文分批提交","按完成情况回填本轮 CSV，分批中文 commit，并汇报后续必须人工配合的精确操作。","A1-A5 状态与实测一致；git 工作区干净或仅剩明确忽略/不提交产物；commit message 使用中文并引用 R90/R91 Issue ID。","命令：`git status --short`；`git log --oneline -3`。业务：用户能按报告继续完成手机企微或备份恢复等人工步骤。","git|manual","TODO","TODO","TODO","issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv|N/A","[""A5""]","按用户要求中文分批提交；若有外部环境未闭环，不伪造 DONE。" diff --git a/server/src/routes/wecomAuth.js b/server/src/routes/wecomAuth.js index a58649ad..80443883 100644 --- a/server/src/routes/wecomAuth.js +++ b/server/src/routes/wecomAuth.js @@ -11,7 +11,7 @@ const BIND_COOKIE_NAME = "wecom_bind"; const PENDING_LOGIN_BIND_COOKIE_NAME = "wecom_login_bind"; const DEVICE_FINGERPRINT_COOKIE_NAME = "hyb_oa_device_fingerprint"; const DATE_WINDOW_MS = 10 * 60 * 1000; -const DEFAULT_RETURN_TO = "/portal"; +const DEFAULT_RETURN_TO = "/mobile"; const DISABLED_STATUS_REASONS = new Set(["wecom_disabled", "entry_disabled", "oauth_disabled"]); const QUERY_SCHEMA = z.object({ returnTo: z.string().optional(), diff --git a/server/tests/unit/routes/wecomAuth.test.js b/server/tests/unit/routes/wecomAuth.test.js index 921e497d..e532089d 100644 --- a/server/tests/unit/routes/wecomAuth.test.js +++ b/server/tests/unit/routes/wecomAuth.test.js @@ -117,7 +117,7 @@ describe("wecom auth routes R27", () => { bindEnabled: true, oauthEnabled: true, status: "disabled", - defaultReturnTo: "/portal", + defaultReturnTo: "/mobile", loginUrl: null, statusReasons: expect.arrayContaining(["entry_disabled"]), })); @@ -125,6 +125,23 @@ describe("wecom auth routes R27", () => { await app.close(); }); + it("returns mobile-first login url when entry is ready", async () => { + const app = await buildApp(); + + const response = await app.inject({ method: "GET", url: "/api/auth/wecom/config" }); + + expect(response.statusCode).toBe(200); + expect(response.json().data).toEqual(expect.objectContaining({ + enabled: true, + entryEnabled: true, + status: "ready", + defaultReturnTo: "/mobile", + loginUrl: "/api/auth/wecom/login?returnTo=%2Fmobile", + })); + + await app.close(); + }); + it("returns misconfigured status when corp id is missing", async () => { const app = await buildApp({ config: { wecomCorpId: "" } }); @@ -157,7 +174,7 @@ describe("wecom auth routes R27", () => { const state = new URL(location).searchParams.get("state"); const verified = verifyToken(state, JWT_SECRET); expect(verified.ok).toBe(true); - expect(verified.payload.returnTo).toBe("/portal"); + expect(verified.payload.returnTo).toBe("/mobile"); expect(verified.payload.mode).toBe("login"); expect(String(verified.payload.deviceFingerprint ?? "")).toMatch(/^wecom:/);