限制扫码登录场景值长度

app/routers/erp_login.py

@@ -28,6 +28,7 @@ from app.timezone import now
 router = APIRouter(prefix="/api/erp-login", tags=["erp-login"])
 
 ERP_LOGIN_PAGE = "pages/erpLoginConfirm/erpLoginConfirm"
+WECHAT_SCENE_MAX_LENGTH = 32
 
 
 def _json_body(payload: dict[str, Any]) -> bytes:
@@ -45,7 +46,10 @@ def _require_session_id(session_id: int | None) -> int:
 
 
 def _scene(ticket: str, session_id: int) -> str:
-    return f"t={ticket}&s={session_id}"
+    scene = f"t={ticket}&s={session_id}"
+    if len(scene) > WECHAT_SCENE_MAX_LENGTH:
+        raise HTTPException(status_code=422, detail="ERP扫码登录二维码参数过长")
+    return scene
 
 
 def _action_response(data: dict[str, Any]) -> ErpLoginActionResponse:

app/schemas.py

@@ -779,7 +779,7 @@ class ReconciliationEntryUpdate(BaseModel):
 
 
 class ErpLoginQrcodeRequest(BaseModel):
-    ticket: str = Field(min_length=1, max_length=256)
+    ticket: str = Field(min_length=1, max_length=16)
     session_id: int = Field(ge=1)
 
 

tests/test_erp_login.py

@@ -151,6 +151,29 @@ def test_qrcode_requires_session_id(monkeypatch):
     assert calls == []
 
 
+def test_qrcode_rejects_scene_values_over_wechat_limit(monkeypatch):
+    from app.routers import erp_login
+
+    calls = []
+
+    async def fake_create_miniapp_qrcode(**kwargs):
+        calls.append(kwargs)
+        return "https://miniapp.example.com/uploads/erp-login-qrcodes/erp-login-long.png"
+
+    monkeypatch.setattr(erp_login, "create_miniapp_qrcode", fake_create_miniapp_qrcode)
+    client = _client(monkeypatch)
+    body = _json_bytes({"ticket": "x" * 17, "session_id": 123456789})
+
+    response = client.post(
+        "/api/erp-login/qrcode",
+        content=body,
+        headers=_signed_headers("POST", "/api/erp-login/qrcode", body),
+    )
+
+    assert response.status_code == 422
+    assert calls == []
+
+
 def test_preview_requires_session_id(monkeypatch):
     client = _client(monkeypatch)