fix(auth): harden WeChat login and explicit identity switching

2026-10-12 10:07:54 +08:00
parent 0ec5e5dc32
commit d68f841f0e
16 changed files with 1484 additions and 735 deletions
@@ -76,6 +76,25 @@ const ReportUI = require('../js/report-ui');
        return (await request('/api/auth/session', null, callback.cookie)).data.user;
      }
      assert.deepEqual(await wechat(), await wechat());
+      for (const scenario of [
+        { data: { errcode: 40029 }, error: 'wechat' },
+        { data: null, error: 'wechat' },
+        { data: { openid: {} }, error: 'wechat' },
+        { data: { openid: 'must-not-login' }, status: 500, error: 'wechat' },
+        { network: true, error: 'network' }
+      ]) {
+        global.fetch = (url, options) => String(url).startsWith('https://api.weixin.qq.com/')
+          ? scenario.network ? Promise.reject(new Error('fixture network failure'))
+            : Promise.resolve({ status: scenario.status || 200, json: async () => scenario.data })
+          : realFetch(url, options);
+        const started = await request('/api/auth/wechat', { consent: true });
+        const state = new URL(started.data.url).searchParams.get('state');
+        const failed = await request('/api/auth/wechat/callback?code=bad&state=' + state, null, started.cookie);
+        assert.equal(failed.location, '/state/?login_error=' + scenario.error);
+        assert(!failed.cookie.includes('juzi_session='));
+        assert.equal((await request('/api/auth/session', null, failed.cookie)).data.user, null);
+        assert((await request('/api/auth/wechat/callback?code=bad&state=' + state, null, started.cookie)).location.includes('login_error=state'));
+      }
    } finally { global.fetch = realFetch; }
    accounts = create(root, { TRUST_LOOPBACK_PROXY: '1' });
    // Malformed credentials exercise the limiter without creating 60 users.