feat(auth): POST /wechat-login(openid 命中即登入,否则发绑号令牌)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_wechat_login.py

@@ -42,3 +42,25 @@ def test_bind_ticket_expired_rejected(monkeypatch) -> None:
     token = security.create_bind_ticket(openid="oid", wechat_nickname=None, wechat_avatar_url=None)
     with pytest.raises(security.TokenError):
         security.decode_bind_ticket(token)
+
+
+# ===== Task 2: wechat-login =====
+
+def test_wechat_login_new_openid_returns_bind_ticket(client, monkeypatch) -> None:
+    monkeypatch.setattr(wxpay, "code_to_userinfo", _fake_userinfo("openid_new_1", "小明", "http://x/m.png"))
+    r = client.post("/api/v1/auth/wechat-login", json={"code": "wxcode1", "device_id": "devA"})
+    assert r.status_code == 200, r.text
+    body = r.json()
+    assert body["status"] == "need_bind_phone"
+    assert body["bind_ticket"]
+    assert body["wechat_nickname"] == "小明"
+    assert body["wechat_avatar_url"] == "http://x/m.png"
+    assert body["token"] is None
+
+
+def test_wechat_login_invalid_code_returns_400(client, monkeypatch) -> None:
+    def _raise(code: str) -> dict:
+        raise ValueError("微信授权失败: invalid code")
+    monkeypatch.setattr(wxpay, "code_to_userinfo", _raise)
+    r = client.post("/api/v1/auth/wechat-login", json={"code": "bad", "device_id": "devA"})
+    assert r.status_code == 400, r.text