限制扫码登录场景值长度

tests/test_erp_login.py

@@ -151,6 +151,29 @@ def test_qrcode_requires_session_id(monkeypatch):
     assert calls == []
 
 
+def test_qrcode_rejects_scene_values_over_wechat_limit(monkeypatch):
+    from app.routers import erp_login
+
+    calls = []
+
+    async def fake_create_miniapp_qrcode(**kwargs):
+        calls.append(kwargs)
+        return "https://miniapp.example.com/uploads/erp-login-qrcodes/erp-login-long.png"
+
+    monkeypatch.setattr(erp_login, "create_miniapp_qrcode", fake_create_miniapp_qrcode)
+    client = _client(monkeypatch)
+    body = _json_bytes({"ticket": "x" * 17, "session_id": 123456789})
+
+    response = client.post(
+        "/api/erp-login/qrcode",
+        content=body,
+        headers=_signed_headers("POST", "/api/erp-login/qrcode", body),
+    )
+
+    assert response.status_code == 422
+    assert calls == []
+
+
 def test_preview_requires_session_id(monkeypatch):
     client = _client(monkeypatch)