实现企微首次免密自动绑定（07-28-all-account-login-readiness）

server/src/routes/auth.js

@@ -628,7 +628,6 @@ async function authRoutes(fastify, options = {}) {
 
     const now = new Date();
     const pendingWecomBindToken = request.cookies?.[PENDING_WECOM_BIND_COOKIE_NAME];
-    const pendingWecomBind = verifyToken(pendingWecomBindToken, fastify.config.jwtSecret);
     if (employee.login_locked_until && employee.login_locked_until > now) {
       throw new AppError({
         code: "AUTH_002",
@@ -728,7 +727,7 @@ async function authRoutes(fastify, options = {}) {
     const refreshToken = randomRefreshToken();
     const refreshTokenHash = sha256Hex(refreshToken);
     const expiresAt = new Date(now.getTime() + fastify.config.refreshTtlSeconds * 1000);
-    let wecomBindingStatus = null;
+    const wecomBindingStatus = null;
 
     await fastify.prisma.$transaction(async (tx) => {
       const guardedEmployee = await tx.employee.updateMany({
@@ -765,63 +764,6 @@ async function authRoutes(fastify, options = {}) {
         expiresAt,
       });
 
-      if (pendingWecomBind.ok) {
-        const payload = pendingWecomBind.payload ?? {};
-        const externalUserId =
-          typeof payload.externalUserId === "string" && payload.externalUserId.trim()
-            ? payload.externalUserId.trim()
-            : null;
-        const externalOpenUserId =
-          typeof payload.externalOpenUserId === "string" && payload.externalOpenUserId.trim()
-            ? payload.externalOpenUserId.trim()
-            : null;
-        const isExpired = typeof payload.exp !== "number" || payload.exp <= Date.now();
-
-        if (!externalUserId || isExpired) {
-          wecomBindingStatus = "invalid";
-        } else {
-          const conflictingBinding = await tx.wecomIdentityBinding.findFirst({
-            where: {
-              external_user_id: externalUserId,
-              NOT: { employee_id: employee.id },
-            },
-            select: { employee_id: true },
-          });
-
-          if (conflictingBinding) {
-            wecomBindingStatus = "conflict";
-          } else {
-            await tx.wecomIdentityBinding.upsert({
-              where: { employee_id: employee.id },
-              update: {
-                external_user_id: externalUserId,
-                external_open_user_id: externalOpenUserId,
-                updated_by: employee.id,
-              },
-              create: {
-                employee_id: employee.id,
-                external_user_id: externalUserId,
-                external_open_user_id: externalOpenUserId,
-                created_by: employee.id,
-                updated_by: employee.id,
-              },
-            });
-            await tx.auditLog.create({
-              data: buildAuditLogData(request, {
-                actorId: employee.id,
-                action: "AUTH_WECOM_BIND",
-                targetType: "employee",
-                targetId: employee.id,
-                extra: { externalUserId },
-              }),
-            });
-            wecomBindingStatus = "bound";
-          }
-        }
-      } else if (typeof pendingWecomBindToken === "string" && pendingWecomBindToken) {
-        wecomBindingStatus = "invalid";
-      }
-
       await tx.auditLog.create({
         data: buildAuditLogData(request, {
           actorId: employee.id,