R85 企微未绑定登录后自动补绑定

server/src/routes/wecomAuth.js

@@ -8,6 +8,7 @@ const { signPayload, verifyToken } = require("../utils/signedUrl");
 const { sendData } = require("../utils/reply");
 
 const BIND_COOKIE_NAME = "wecom_bind";
+const PENDING_LOGIN_BIND_COOKIE_NAME = "wecom_login_bind";
 const DATE_WINDOW_MS = 10 * 60 * 1000;
 const DEFAULT_RETURN_TO = "/portal";
 const DISABLED_STATUS_REASONS = new Set(["wecom_disabled", "entry_disabled", "oauth_disabled"]);
@@ -37,6 +38,16 @@ function bindCookieOptions(config) {
   };
 }
 
+function pendingLoginBindCookieOptions(config) {
+  return {
+    httpOnly: true,
+    sameSite: "lax",
+    secure: config.cookieSecure,
+    path: "/api/auth",
+    maxAge: DATE_WINDOW_MS / 1000,
+  };
+}
+
 function resolvePrimaryAppOrigin(config, request) {
   const configured = typeof config.appOrigin === "string" ? config.appOrigin : "";
   const first = configured
@@ -481,6 +492,17 @@ async function wecomAuthRoutes(fastify) {
       select: { employee_id: true, employee: { select: { id: true, status: true, token_version: true } } },
     });
     if (!binding?.employee || binding.employee.status !== "active") {
+      const pendingBindToken = signPayload({
+        exp: Date.now() + DATE_WINDOW_MS,
+        externalUserId: profile.externalUserId,
+        externalOpenUserId: profile.externalOpenUserId,
+        returnTo,
+      }, fastify.config.jwtSecret);
+      reply.setCookie(
+        PENDING_LOGIN_BIND_COOKIE_NAME,
+        pendingBindToken,
+        pendingLoginBindCookieOptions(fastify.config),
+      );
       return reply.redirect(`${origin}/login?redirect=${encodeURIComponent(returnTo)}&wecom=unbound`);
     }