feat(M02-B): 实现微信登录与可撤销会话

backend/tests/mysql-migration-roundtrip.test.mjs

@@ -10,6 +10,7 @@ import {
   AmbiguousAppTenantError,
   PlatformConfigRepository
 } from '../dist/tenancy/platform-config-repository.js';
+import { AuthRepository } from '../dist/auth/auth-repository.js';
 import {
   executeMigrationPlan,
   loadMigrationPlan,
@@ -19,6 +20,7 @@ import {
 const expectedTables = [
   'qipai_async_tasks',
   'qipai_audit_logs',
+  'qipai_auth_sessions',
   'qipai_devices',
   'qipai_legacy_table_mappings',
   'qipai_members',
@@ -31,7 +33,9 @@ const expectedTables = [
   'qipai_stores',
   'qipai_tenant_apps',
   'qipai_tenant_configs',
-  'qipai_tenants'
+  'qipai_tenants',
+  'qipai_user_identities',
+  'qipai_users'
 ];
 const repoRoot = resolve(dirname(fileURLToPath(import.meta.url)), '../..');
 
@@ -52,9 +56,9 @@ async function readMigrationVersions(pool) {
   const [rows] = await pool.query(
     `SELECT version, name
      FROM qipai_schema_migrations
-     WHERE version IN (?, ?, ?)
+     WHERE version IN (?, ?, ?, ?)
      ORDER BY version`,
-    ['2026061601', '2026061802', '2026061803']
+    ['2026061601', '2026061802', '2026061803', '2026061804']
   );
   return rows;
 }
@@ -167,6 +171,55 @@ async function assertPlatformTenantIsolation(pool) {
     () => repository.resolveBootstrap('wx-m02a-shared'),
     AmbiguousAppTenantError
   );
+  return {
+    tenantId: String(firstTenantId),
+    platformAppId: String(platformAppId),
+    appId: 'wx-m02a-shared'
+  };
+}
+
+async function assertRevocableAuthSession(pool, context) {
+  const repository = new AuthRepository(pool);
+  const resolved = await repository.resolveLoginContext(context.appId, context.tenantId);
+  assert.deepEqual(resolved, context);
+  const sessionId = '9c47fdb5-0c38-463a-858f-e1d85ce9b3fd';
+  const session = await repository.loginWithWechat({
+    context,
+    openid: 'm02b-openid-a',
+    unionid: 'm02b-unionid',
+    sessionId,
+    expiresAt: new Date(Date.now() + 60_000),
+    ip: '127.0.0.1',
+    userAgent: 'M02-B test'
+  });
+  assert.equal(session.user.userType, 'CUSTOMER');
+  assert.equal((await repository.loginWithWechat({
+    context,
+    openid: 'm02b-openid-a',
+    unionid: 'm02b-unionid',
+    sessionId: 'c07df18c-a90d-4fa6-bea2-640d9710c84e',
+    expiresAt: new Date(Date.now() + 60_000),
+    ip: '127.0.0.1',
+    userAgent: 'M02-B repeat login'
+  })).user.id, session.user.id);
+  assert.ok(await repository.validateSession(sessionId, context.tenantId, session.user.id));
+  assert.equal(await repository.revokeSession(sessionId), true);
+  assert.equal(await repository.validateSession(sessionId, context.tenantId, session.user.id), null);
+
+  const roleSessionId = 'd8eb245b-e513-401e-9046-f574447909ad';
+  await repository.loginWithWechat({
+    context,
+    openid: 'm02b-openid-a',
+    sessionId: roleSessionId,
+    expiresAt: new Date(Date.now() + 60_000),
+    ip: '127.0.0.1',
+    userAgent: 'M02-B role test'
+  });
+  await pool.query(
+    'UPDATE qipai_users SET role_version = role_version + 1 WHERE tenant_id = ? AND id = ?',
+    [context.tenantId, session.user.id]
+  );
+  assert.equal(await repository.validateSession(roleSessionId, context.tenantId, session.user.id), null);
 }
 
 const config = loadConfig();
@@ -195,12 +248,14 @@ try {
   assert.deepEqual(await readMigrationVersions(pool), [
     { version: '2026061601', name: 'm01b_core_schema' },
     { version: '2026061802', name: 'm01c_async_tasks' },
-    { version: '2026061803', name: 'm02a_tenant_apps' }
+    { version: '2026061803', name: 'm02a_tenant_apps' },
+    { version: '2026061804', name: 'm02b_wechat_auth' }
   ]);
   await assertTaskDurability(pool);
-  await assertPlatformTenantIsolation(pool);
+  const loginContext = await assertPlatformTenantIsolation(pool);
+  await assertRevocableAuthSession(pool, loginContext);
   await assertLegacyCompatibility(pool);
-  console.log('PASS: first up, verify, durable task and tenant isolation checks completed.');
+  console.log('PASS: first up, verify, tenant isolation and revocable auth checks completed.');
 
   await executeMigrationPlan(pool, plans.down);
   assert.deepEqual(await readCoreTables(pool), []);
@@ -213,7 +268,8 @@ try {
   assert.deepEqual(await readMigrationVersions(pool), [
     { version: '2026061601', name: 'm01b_core_schema' },
     { version: '2026061802', name: 'm01c_async_tasks' },
-    { version: '2026061803', name: 'm02a_tenant_apps' }
+    { version: '2026061803', name: 'm02a_tenant_apps' },
+    { version: '2026061804', name: 'm02b_wechat_auth' }
   ]);
   await assertLegacyCompatibility(pool);
   console.log('PASS: second up and verify restored the schema.');
@@ -241,7 +297,10 @@ try {
       'tenant isolation',
       'decimal cents',
       'app-to-tenant binding',
-      'cross-tenant bootstrap rejection'
+      'cross-tenant bootstrap rejection',
+      'openid identity reuse',
+      'session revocation',
+      'role-version invalidation'
     ]
   }, null, 2));
 } finally {