R91 A3-A4 收口企微移动默认入口

client/src/api/auth.ts

@@ -27,7 +27,7 @@ export type WecomEntryConfig = {
   agentId: string;
   loginUrl: string | null;
   bindEnabled: boolean;
-  defaultReturnTo: "/portal";
+  defaultReturnTo: string;
   status: "ready" | "disabled" | "misconfigured";
   statusReasons: string[];
 };

issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv

@@ -1,7 +1,7 @@
 "ID","Title","Description","Acceptance","Test_Method","Tools","Dev_Status","Review1_Status","Regression_Status","Files","Dependencies","Notes"
 "A1","R90/R91 执行合同冻结","建立本轮试运行收口执行合同，范围限定为事实源刷新、公网部署/企微移动闭环、测试账号核对与自动化回归，不新增横向业务模块。","Issue CSV 字段完整且通过校验；后续实施均能回写到本合同。","命令：`python3 /home/shunli/.codex/skills/plan/scripts/validate_issues_csv.py issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv`。业务：确认本轮不把 ERP、复杂财务、高级考勤、采购差旅扩展纳入试运行主线。","manual","DONE","DONE","DONE","issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv","[]","2026-05-05：CSV 已创建并通过 validate_issues_csv；回滚路径：删除本轮新增 CSV；不影响业务代码。"
 "A2","治理事实源刷新","刷新当前权威事实源，修正 R80-R89 后文档中关于企微、移动入口、feature flag、试运行状态的过期描述，并保留旧 CSV superseded 处理原则。","`docs/feature-matrix.md`、`docs/admin-handbook.md`、`deploy/trialrun/checklist.md`、`artifacts/r70/manual-trialrun-checklist.md` 与 R89/R80-R86 当前结论一致；旧 Issue 残留不再被误判为当前待办。","命令：`rg -n 'returnTo=%2Fportal|WECOM_ENABLED=false|WECOM_ENTRY_ENABLED=false|blocked_external' docs/admin-handbook.md deploy/trialrun/checklist.md docs/feature-matrix.md artifacts/r70/manual-trialrun-checklist.md artifacts/r75/coverage-matrix.csv || true`。业务：管理员按文档配置企微入口时默认手机进入 `/mobile`，且能理解哪些历史 TODO 已由后续 R77-R89 替代。","manual|rg","DONE","DONE","DONE","docs/feature-matrix.md|docs/admin-handbook.md|deploy/trialrun/checklist.md|artifacts/r70/manual-trialrun-checklist.md|artifacts/r70/manual-trialrun-report.md|artifacts/r75/coverage-matrix.csv|issues/README.md","[""A1""]","2026-05-05：事实源已刷新；旧 R79 企微关闭诊断已标为历史，不批量伪造旧 CSV 状态；回滚路径：恢复文档变更。"
-"A3","公网部署与测试账号核对","核对 `https://oa.hyinda.com` 当前部署版本、运行时配置、已有测试账号/smoke 账号是否可用于 live smoke，必要时只做配置级修正，不写入密钥到仓库。","公网 `/ready` 正常；远端版本与本地最新提交差异明确；至少确认一组可自动化 smoke 的测试账号存在或记录缺口；敏感值不进入 git。","命令：`curl -fsS https://oa.hyinda.com/ready`；SSH 只读核对远端部署目录、容器状态和测试账号清单。业务：用测试账号登录后能进入 Portal 或 mobile 工作台。","ssh|curl|manual","TODO","TODO","TODO","external|deploy/trialrun/checklist.md","[""A2""]","回滚路径：如做配置修正，先备份远端 `.env` 或 DB flag；不提交任何 secret。"
+"A3","公网部署与测试账号核对","核对 `https://oa.hyinda.com` 当前部署版本、运行时配置、已有测试账号/smoke 账号是否可用于 live smoke，必要时只做配置级修正，不写入密钥到仓库。","公网 `/ready` 正常；远端版本与本地最新提交差异明确；至少确认一组可自动化 smoke 的测试账号存在或记录缺口；敏感值不进入 git。","命令：`curl -fsS https://oa.hyinda.com/ready`；SSH 只读核对远端部署目录、容器状态和测试账号清单。业务：用测试账号登录后能进入 Portal 或 mobile 工作台。","ssh|curl|manual","DONE","DONE","DONE","external|deploy/trialrun/checklist.md|artifacts/r70/manual-trialrun-report.md","[""A2""]","2026-05-05：`/ready` 通过；root/deploy 均可 SSH；远端 server/db 正常；已确认 `SMOKE001`/`SMOKE002` 独立 smoke 账号存在且 active，但本地/远端未配置 LIVE_SMOKE_* 密码变量。回滚路径：本项只读核对，不改变业务数据。"
 "A4","真实企微移动闭环与自动化辅助","把公网企业微信入口按移动优先口径收口，并用 Playwright/curl 压榨自动化验证；真实企业微信客户端只保留必须由用户点击的一次确认。","企微配置接口 ready；OAuth login 302 正确；移动 UA/小屏访问默认落到 `/mobile`；已记录真机企业微信验证结果或明确唯一剩余人工动作。","命令：`curl -I 'https://oa.hyinda.com/api/auth/wecom/login?returnTo=%2Fmobile'`；Playwright 用移动视口验证登录页 CTA 与 `/mobile` 导航。业务：手机企业微信工作台进入 OA 后已绑定用户不再停留在登录页。","playwright|curl|manual","DOING","TODO","TODO","server/src/routes/wecomAuth.js|server/tests/unit/routes/wecomAuth.test.js|client/src/api/auth.ts|client/tests/e2e/r89-mobile-login-navigation.spec.ts|external|artifacts/r70/manual-trialrun-report.md","[""A3""]","涉及真实企微容器时需要用户手机确认；回滚路径：企业微信后台入口改回上一 URL 或关闭 wecom_entry_v1。"
 "A5","发布门禁与备份恢复准备","执行可用的本地/公网门禁，补齐备份恢复演练的当前状态，区分已自动化完成、可远端执行和仍需人工确认的部分。","本地 typecheck/build 或相关 release gate 通过；公网 live smoke 结果清晰；DB/storage 备份恢复状态有记录，未完成项有可操作步骤。","命令：`cd client && npm run typecheck && npm run build`；可用时执行 `bash scripts/qa/run-web-gates.sh smoke-live`。业务：发布前知道是否可以回滚到上个版本，且 smoke 不使用真实业务账号。","bash|playwright|manual","TODO","TODO","TODO","client|server|deploy/trialrun/checklist.md|artifacts/r70/manual-trialrun-report.md","[""A4""]","若运行全量回归成本过高，记录原因并保留最小门禁；回滚路径：不改变业务数据。"
 "A6","状态回填与中文分批提交","按完成情况回填本轮 CSV，分批中文 commit，并汇报后续必须人工配合的精确操作。","A1-A5 状态与实测一致；git 工作区干净或仅剩明确忽略/不提交产物；commit message 使用中文并引用 R90/R91 Issue ID。","命令：`git status --short`；`git log --oneline -3`。业务：用户能按报告继续完成手机企微或备份恢复等人工步骤。","git|manual","TODO","TODO","TODO","issues/2026-05-05_20-01-18-r90-r91-trialrun-closeout.csv|N/A","[""A5""]","按用户要求中文分批提交；若有外部环境未闭环，不伪造 DONE。"

server/src/routes/wecomAuth.js

@@ -11,7 +11,7 @@ const BIND_COOKIE_NAME = "wecom_bind";
 const PENDING_LOGIN_BIND_COOKIE_NAME = "wecom_login_bind";
 const DEVICE_FINGERPRINT_COOKIE_NAME = "hyb_oa_device_fingerprint";
 const DATE_WINDOW_MS = 10 * 60 * 1000;
-const DEFAULT_RETURN_TO = "/portal";
+const DEFAULT_RETURN_TO = "/mobile";
 const DISABLED_STATUS_REASONS = new Set(["wecom_disabled", "entry_disabled", "oauth_disabled"]);
 const QUERY_SCHEMA = z.object({
   returnTo: z.string().optional(),

server/tests/unit/routes/wecomAuth.test.js

@@ -117,7 +117,7 @@ describe("wecom auth routes R27", () => {
       bindEnabled: true,
       oauthEnabled: true,
       status: "disabled",
-      defaultReturnTo: "/portal",
+      defaultReturnTo: "/mobile",
       loginUrl: null,
       statusReasons: expect.arrayContaining(["entry_disabled"]),
     }));
@@ -125,6 +125,23 @@ describe("wecom auth routes R27", () => {
     await app.close();
   });
 
+  it("returns mobile-first login url when entry is ready", async () => {
+    const app = await buildApp();
+
+    const response = await app.inject({ method: "GET", url: "/api/auth/wecom/config" });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().data).toEqual(expect.objectContaining({
+      enabled: true,
+      entryEnabled: true,
+      status: "ready",
+      defaultReturnTo: "/mobile",
+      loginUrl: "/api/auth/wecom/login?returnTo=%2Fmobile",
+    }));
+
+    await app.close();
+  });
+
   it("returns misconfigured status when corp id is missing", async () => {
     const app = await buildApp({ config: { wecomCorpId: "" } });
 
@@ -157,7 +174,7 @@ describe("wecom auth routes R27", () => {
     const state = new URL(location).searchParams.get("state");
     const verified = verifyToken(state, JWT_SECRET);
     expect(verified.ok).toBe(true);
-    expect(verified.payload.returnTo).toBe("/portal");
+    expect(verified.payload.returnTo).toBe("/mobile");
     expect(verified.payload.mode).toBe("login");
     expect(String(verified.payload.deviceFingerprint ?? "")).toMatch(/^wecom:/);