feat: add wechat miniprogram webview login

server-rs/crates/api-server/src/app.rs

@@ -123,7 +123,9 @@ use crate::{
         begin_story_runtime_session, begin_story_session, continue_story,
         get_story_runtime_projection, get_story_session_state, resolve_story_runtime_action,
     },
-    wechat_auth::{bind_wechat_phone, handle_wechat_callback, start_wechat_login},
+    wechat_auth::{
+        bind_wechat_phone, handle_wechat_callback, login_wechat_mini_program, start_wechat_login,
+    },
 };
 
 const PUZZLE_REFERENCE_IMAGE_BODY_LIMIT_BYTES: usize = 12 * 1024 * 1024;
@@ -241,6 +243,10 @@ pub fn build_router(state: AppState) -> Router {
         .route("/api/auth/phone/login", post(phone_login))
         .route("/api/auth/wechat/start", get(start_wechat_login))
         .route("/api/auth/wechat/callback", get(handle_wechat_callback))
+        .route(
+            "/api/auth/wechat/miniprogram-login",
+            post(login_wechat_mini_program),
+        )
         .route(
             "/api/auth/wechat/bind-phone",
             post(bind_wechat_phone).route_layer(middleware::from_fn_with_state(
@@ -2716,6 +2722,103 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn wechat_miniprogram_login_returns_system_token_and_marks_session_source() {
+        let config = AppConfig {
+            wechat_auth_enabled: true,
+            ..AppConfig::default()
+        };
+        let app = build_router(AppState::new(config).expect("state should build"));
+
+        let login_response = app
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/api/auth/wechat/miniprogram-login")
+                    .header("content-type", "application/json")
+                    .header("x-client-type", "mini_program")
+                    .header("x-client-runtime", "wechat_mini_program")
+                    .header("x-client-platform", "ios")
+                    .header("x-client-instance-id", "mini-instance-001")
+                    .header("x-mini-program-app-id", "wx-mini-test")
+                    .header("x-mini-program-env", "develop")
+                    .body(Body::from(
+                        serde_json::json!({
+                            "code": "wx-mini-code-001"
+                        })
+                        .to_string(),
+                    ))
+                    .expect("mini program login request should build"),
+            )
+            .await
+            .expect("mini program login request should succeed");
+
+        assert_eq!(login_response.status(), StatusCode::OK);
+        let refresh_cookie = login_response
+            .headers()
+            .get("set-cookie")
+            .and_then(|value| value.to_str().ok())
+            .expect("refresh cookie should exist")
+            .to_string();
+        let login_body = login_response
+            .into_body()
+            .collect()
+            .await
+            .expect("mini program login body should collect")
+            .to_bytes();
+        let login_payload: Value =
+            serde_json::from_slice(&login_body).expect("mini program login payload should be json");
+        let token = login_payload["token"]
+            .as_str()
+            .expect("system token should exist")
+            .to_string();
+
+        assert_eq!(
+            login_payload["bindingStatus"],
+            Value::String("pending_bind_phone".to_string())
+        );
+        assert_eq!(
+            login_payload["user"]["loginMethod"],
+            Value::String("wechat".to_string())
+        );
+        assert!(refresh_cookie.contains("genarrative_refresh_session="));
+
+        let sessions_response = app
+            .oneshot(
+                Request::builder()
+                    .uri("/api/auth/sessions")
+                    .header("authorization", format!("Bearer {token}"))
+                    .header("cookie", refresh_cookie)
+                    .body(Body::empty())
+                    .expect("sessions request should build"),
+            )
+            .await
+            .expect("sessions request should succeed");
+
+        assert_eq!(sessions_response.status(), StatusCode::OK);
+        let sessions_body = sessions_response
+            .into_body()
+            .collect()
+            .await
+            .expect("sessions body should collect")
+            .to_bytes();
+        let sessions_payload: Value =
+            serde_json::from_slice(&sessions_body).expect("sessions payload should be json");
+        assert_eq!(
+            sessions_payload["sessions"][0]["clientType"],
+            Value::String("mini_program".to_string())
+        );
+        assert_eq!(
+            sessions_payload["sessions"][0]["clientRuntime"],
+            Value::String("wechat_mini_program".to_string())
+        );
+        assert_eq!(
+            sessions_payload["sessions"][0]["miniProgramAppId"],
+            Value::String("wx-mini-test".to_string())
+        );
+    }
+
     #[tokio::test]
     async fn wechat_bind_phone_merges_into_existing_phone_user() {
         let config = AppConfig {