feat: support mini program phone authorization binding

server-rs/crates/api-server/src/app.rs

@@ -3801,6 +3801,113 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn wechat_miniprogram_bind_phone_code_activates_pending_user() {
+        let config = AppConfig {
+            wechat_auth_enabled: true,
+            ..AppConfig::default()
+        };
+        let app = build_router(AppState::new(config).expect("state should build"));
+
+        let login_response = app
+            .clone()
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/api/auth/wechat/miniprogram-login")
+                    .header("content-type", "application/json")
+                    .header("x-client-type", "mini_program")
+                    .header("x-client-runtime", "wechat_mini_program")
+                    .header("x-client-platform", "ios")
+                    .header("x-client-instance-id", "mini-bind-instance-001")
+                    .header("x-mini-program-app-id", "wx-mini-test")
+                    .header("x-mini-program-env", "develop")
+                    .body(Body::from(
+                        serde_json::json!({
+                            "code": "wx-mini-code-bind-001"
+                        })
+                        .to_string(),
+                    ))
+                    .expect("mini program login request should build"),
+            )
+            .await
+            .expect("mini program login request should succeed");
+
+        assert_eq!(login_response.status(), StatusCode::OK);
+        let login_body = login_response
+            .into_body()
+            .collect()
+            .await
+            .expect("mini program login body should collect")
+            .to_bytes();
+        let login_payload: Value =
+            serde_json::from_slice(&login_body).expect("mini program login payload should be json");
+        let token = login_payload["token"]
+            .as_str()
+            .expect("system token should exist")
+            .to_string();
+        assert_eq!(
+            login_payload["bindingStatus"],
+            Value::String("pending_bind_phone".to_string())
+        );
+
+        let bind_response = app
+            .oneshot(
+                Request::builder()
+                    .method("POST")
+                    .uri("/api/auth/wechat/bind-phone")
+                    .header("authorization", format!("Bearer {token}"))
+                    .header("content-type", "application/json")
+                    .header("x-client-type", "mini_program")
+                    .header("x-client-runtime", "wechat_mini_program")
+                    .header("x-client-platform", "ios")
+                    .header("x-client-instance-id", "mini-bind-instance-001")
+                    .header("x-mini-program-app-id", "wx-mini-test")
+                    .header("x-mini-program-env", "develop")
+                    .body(Body::from(
+                        serde_json::json!({
+                            "wechatPhoneCode": "13800138000"
+                        })
+                        .to_string(),
+                    ))
+                    .expect("bind request should build"),
+            )
+            .await
+            .expect("bind request should succeed");
+
+        assert_eq!(bind_response.status(), StatusCode::OK);
+        assert!(
+            bind_response
+                .headers()
+                .get("set-cookie")
+                .and_then(|value| value.to_str().ok())
+                .is_some_and(|value| value.contains("genarrative_refresh_session="))
+        );
+        let bind_body = bind_response
+            .into_body()
+            .collect()
+            .await
+            .expect("bind body should collect")
+            .to_bytes();
+        let bind_payload: Value =
+            serde_json::from_slice(&bind_body).expect("bind payload should be json");
+
+        assert_eq!(
+            bind_payload["user"]["bindingStatus"],
+            Value::String("active".to_string())
+        );
+        assert_eq!(bind_payload["user"]["wechatBound"], Value::Bool(true));
+        assert_eq!(
+            bind_payload["user"]["phoneNumberMasked"],
+            Value::String("138****8000".to_string())
+        );
+        assert!(
+            bind_payload["token"]
+                .as_str()
+                .is_some_and(|value| !value.is_empty())
+        );
+    }
+
     #[tokio::test]
     async fn wechat_bind_phone_merges_into_existing_phone_user() {
         let config = AppConfig {