From 873a85d1adfac980e2447b87c4380667412a9092 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=B1=A4=E5=AD=A6=E4=BC=9A?= <tangxuehui@wondersgroup.com>
Date: Mon, 6 Jul 2026 11:22:57 +0800
Subject: [PATCH] =?UTF-8?q?=E9=99=90=E5=88=B6=E6=89=AB=E7=A0=81=E7=99=BB?=
 =?UTF-8?q?=E5=BD=95=E5=9C=BA=E6=99=AF=E5=80=BC=E9=95=BF=E5=BA=A6?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/routers/erp_login.py |  6 +++++-
 app/schemas.py           |  2 +-
 tests/test_erp_login.py  | 23 +++++++++++++++++++++++
 3 files changed, 29 insertions(+), 2 deletions(-)

diff --git a/app/routers/erp_login.py b/app/routers/erp_login.py
index 9d29c94..1f63234 100644
--- a/app/routers/erp_login.py
+++ b/app/routers/erp_login.py
@@ -28,6 +28,7 @@ from app.timezone import now
 router = APIRouter(prefix="/api/erp-login", tags=["erp-login"])
 
 ERP_LOGIN_PAGE = "pages/erpLoginConfirm/erpLoginConfirm"
+WECHAT_SCENE_MAX_LENGTH = 32
 
 
 def _json_body(payload: dict[str, Any]) -> bytes:
@@ -45,7 +46,10 @@ def _require_session_id(session_id: int | None) -> int:
 
 
 def _scene(ticket: str, session_id: int) -> str:
-    return f"t={ticket}&s={session_id}"
+    scene = f"t={ticket}&s={session_id}"
+    if len(scene) > WECHAT_SCENE_MAX_LENGTH:
+        raise HTTPException(status_code=422, detail="ERP扫码登录二维码参数过长")
+    return scene
 
 
 def _action_response(data: dict[str, Any]) -> ErpLoginActionResponse:
diff --git a/app/schemas.py b/app/schemas.py
index f9283ed..9ee1590 100644
--- a/app/schemas.py
+++ b/app/schemas.py
@@ -779,7 +779,7 @@ class ReconciliationEntryUpdate(BaseModel):
 
 
 class ErpLoginQrcodeRequest(BaseModel):
-    ticket: str = Field(min_length=1, max_length=256)
+    ticket: str = Field(min_length=1, max_length=16)
     session_id: int = Field(ge=1)
 
 
diff --git a/tests/test_erp_login.py b/tests/test_erp_login.py
index 4ef8114..cdbad2f 100644
--- a/tests/test_erp_login.py
+++ b/tests/test_erp_login.py
@@ -151,6 +151,29 @@ def test_qrcode_requires_session_id(monkeypatch):
     assert calls == []
 
 
+def test_qrcode_rejects_scene_values_over_wechat_limit(monkeypatch):
+    from app.routers import erp_login
+
+    calls = []
+
+    async def fake_create_miniapp_qrcode(**kwargs):
+        calls.append(kwargs)
+        return "https://miniapp.example.com/uploads/erp-login-qrcodes/erp-login-long.png"
+
+    monkeypatch.setattr(erp_login, "create_miniapp_qrcode", fake_create_miniapp_qrcode)
+    client = _client(monkeypatch)
+    body = _json_bytes({"ticket": "x" * 17, "session_id": 123456789})
+
+    response = client.post(
+        "/api/erp-login/qrcode",
+        content=body,
+        headers=_signed_headers("POST", "/api/erp-login/qrcode", body),
+    )
+
+    assert response.status_code == 422
+    assert calls == []
+
+
 def test_preview_requires_session_id(monkeypatch):
     client = _client(monkeypatch)