限制扫码登录场景值长度

app/routers/erp_login.py

@@ -28,6 +28,7 @@ from app.timezone import now
 router = APIRouter(prefix="/api/erp-login", tags=["erp-login"])
 
 ERP_LOGIN_PAGE = "pages/erpLoginConfirm/erpLoginConfirm"
+WECHAT_SCENE_MAX_LENGTH = 32
 
 
 def _json_body(payload: dict[str, Any]) -> bytes:
@@ -45,7 +46,10 @@ def _require_session_id(session_id: int | None) -> int:
 
 
 def _scene(ticket: str, session_id: int) -> str:
-    return f"t={ticket}&s={session_id}"
+    scene = f"t={ticket}&s={session_id}"
+    if len(scene) > WECHAT_SCENE_MAX_LENGTH:
+        raise HTTPException(status_code=422, detail="ERP扫码登录二维码参数过长")
+    return scene
 
 
 def _action_response(data: dict[str, Any]) -> ErpLoginActionResponse:

app/schemas.py

@@ -779,7 +779,7 @@ class ReconciliationEntryUpdate(BaseModel):
 
 
 class ErpLoginQrcodeRequest(BaseModel):
-    ticket: str = Field(min_length=1, max_length=256)
+    ticket: str = Field(min_length=1, max_length=16)
     session_id: int = Field(ge=1)