R81 增加企微回调身份诊断

server/tests/unit/routes/wecomAuth.test.js

@@ -177,6 +177,35 @@ describe("wecom auth routes R27", () => {
     await app.close();
   });
 
+  it("returns structured diagnostics when wecom callback has only open id", async () => {
+    mockWecomFetch({ userId: "", openId: "wecom-open-only" });
+    const app = await buildApp();
+    const state = signPayload({
+      exp: Date.now() + 60_000,
+      nonce: "nonce-openid-only",
+      returnTo: "/portal",
+      mode: "login",
+    }, JWT_SECRET);
+
+    const response = await app.inject({
+      method: "GET",
+      url: `/api/auth/wecom/callback?state=${encodeURIComponent(state)}&code=test-code`,
+    });
+
+    expect(response.statusCode).toBe(401);
+    expect(response.json().error).toEqual(expect.objectContaining({
+      code: "AUTH_003",
+      message: "企业微信认证失败",
+      details: expect.objectContaining({
+        wecom: "missing_user_id",
+        hasOpenId: true,
+        mode: "login",
+      }),
+    }));
+
+    await app.close();
+  });
+
   it("creates bind audit log on successful wecom bind callback", async () => {
     mockWecomFetch({ userId: "wecom-bind-1" });
     const prisma = buildPrisma();