R88 贯通企微直登设备指纹

server/tests/unit/routes/wecomAuth.test.js

@@ -159,6 +159,26 @@ describe("wecom auth routes R27", () => {
     expect(verified.ok).toBe(true);
     expect(verified.payload.returnTo).toBe("/portal");
     expect(verified.payload.mode).toBe("login");
+    expect(String(verified.payload.deviceFingerprint ?? "")).toMatch(/^wecom:/);
+
+    await app.close();
+  });
+
+  it("keeps frontend device fingerprint in wecom login state", async () => {
+    const app = await buildApp();
+
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/auth/wecom/login?returnTo=%2Fportal&deviceFingerprint=browser-device-1",
+    });
+
+    expect(response.statusCode).toBe(302);
+    const state = new URL(response.headers.location).searchParams.get("state");
+    const verified = verifyToken(state, JWT_SECRET);
+    expect(verified.ok).toBe(true);
+    expect(verified.payload.returnTo).toBe("/portal");
+    expect(verified.payload.mode).toBe("login");
+    expect(verified.payload.deviceFingerprint).toBe("browser-device-1");
 
     await app.close();
   });
@@ -252,6 +272,7 @@ describe("wecom auth routes R27", () => {
       nonce: "nonce-login-success",
       returnTo: "/portal",
       mode: "login",
+      deviceFingerprint: "browser-device-1",
     }, JWT_SECRET);
 
     const response = await app.inject({
@@ -264,7 +285,13 @@ describe("wecom auth routes R27", () => {
     const setCookieHeader = String(response.headers["set-cookie"] ?? "");
     expect(setCookieHeader).toContain("refresh_token=");
     expect(setCookieHeader).toContain("has_session=1");
-    expect(authSession.create).toHaveBeenCalled();
+    expect(setCookieHeader).toContain("hyb_oa_device_fingerprint=browser-device-1");
+    expect(authSession.create).toHaveBeenCalledWith({
+      data: expect.objectContaining({
+        employee_id: EMPLOYEE_ID,
+        device_fingerprint: "browser-device-1",
+      }),
+    });
     expect(prisma.auditLog.create).toHaveBeenCalledWith(expect.objectContaining({
       data: expect.objectContaining({
         actor_id: EMPLOYEE_ID,