From f9c8c429be90a118a2d9433cc64d76ffc00ec1a6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= <kvtodev@outlook.com>
Date: Thu, 1 Oct 2026 21:17:11 +0800
Subject: [PATCH] =?UTF-8?q?=E8=A1=A5=20Rust=20=E7=94=A8=E4=BE=8B=E9=92=89?=
 =?UTF-8?q?=E4=BD=8F=E5=8F=91=E7=A0=81=20401/403=20=E5=B1=9E=E7=B3=BB?=
 =?UTF-8?q?=E7=BB=9F=E5=8F=98=E4=BD=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- map_auth_failure 对 AuthRoute::SendCode 的 401/403 仍归 UnexpectedRejection（不是权威失效、不是业务输入）
- 依据：api-server 的 send_phone_code 只返回 400 与 5xx，401/403 出现即为契约异常，应带上文进上报池
---
 .../src-tauri/src/auth_session.rs             | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs b/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs
index 592f5ef95..08f192e1f 100644
--- a/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs
+++ b/apps/ai-game-creator-shell/src-tauri/src/auth_session.rs
@@ -1350,6 +1350,28 @@ mod tests {
         assert_eq!(missing_reason.message(), "登录失败");
     }
 
+    /// 发码端点不带凭据：401/403 不是「用户可改的输入」，而是协议异常，属系统变体（带上文上报）。
+    ///
+    /// api-server 的 `send_phone_code` 只会返回 400（手机号登录未启用）与 5xx；401/403 真出现时
+    /// 说明契约破了，不该被当成业务提示吞掉。
+    #[test]
+    fn send_code_401_403_stay_system_rejections() {
+        for status in [StatusCode::UNAUTHORIZED, StatusCode::FORBIDDEN] {
+            let error = map_auth_failure(
+                status,
+                r#"{"error":{"message":"手机号登录暂未启用"}}"#,
+                "发送验证码失败",
+                AuthRoute::SendCode,
+            );
+            assert!(matches!(
+                error,
+                ClientAuthError::UnexpectedRejection(UnexpectedRejection { .. })
+            ));
+            assert!(!error.is_authority_failure());
+            assert_eq!(error.message(), "手机号登录暂未启用");
+        }
+    }
+
     #[test]
     fn input_rejections_and_throttling_keep_the_server_text() {
         let password_length = map_auth_failure(