From d26996350ee6b777cd8877f9081ef4f6a99c84e6 Mon Sep 17 00:00:00 2001
From: HenryDu8133 <813367384@qq.com>
Date: Sun, 27 Sep 2026 14:17:20 +0800
Subject: [PATCH] =?UTF-8?q?feat(auth):=20=E6=B3=A8=E5=86=8C=E6=97=B6?=
 =?UTF-8?q?=E5=8F=AF=E9=A1=BA=E5=B8=A6=E7=BB=91=E5=AE=9A=E5=BE=AE=E4=BF=A1?=
 =?UTF-8?q?=EF=BC=88=E5=BE=AE=E4=BF=A1=E7=99=BB=E5=BD=95=E5=8F=91=E7=8E=B0?=
 =?UTF-8?q?=E6=9C=AA=E7=BB=91=E8=B4=A6=E5=8F=B7=20=E2=86=92=20=E5=BC=95?=
 =?UTF-8?q?=E5=AF=BC=E6=B3=A8=E5=86=8C=EF=BC=89?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- register.post.ts 接受可选 bindToken：注册成功后把该第三方身份插到新账号上
  · 绑不上**不影响注册**（账号已建好），返回 wechatBound=false + wechatBindError
  · 令牌无效/过期只记日志；唯一约束冲突按已绑定处理
  · 顺便把 token 返回给非浏览器客户端（小程序省掉一次重复登录）
---
 server/api/auth/register.post.ts | 47 +++++++++++++++++++++++++++++++-
 1 file changed, 46 insertions(+), 1 deletion(-)

diff --git a/server/api/auth/register.post.ts b/server/api/auth/register.post.ts
index 7369928..32c2f34 100644
--- a/server/api/auth/register.post.ts
+++ b/server/api/auth/register.post.ts
@@ -1,7 +1,8 @@
 import bcrypt from 'bcryptjs'
-import { db, eq, users } from '~/drizzle/db'
+import { db, eq, users, userIdentities } from '~/drizzle/db'
 import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
 import { createAuthSession } from '~~/server/utils/create-auth-session'
+import { verifyBindingToken } from '~~/server/utils/oauth-token'
 import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'
 
 export default defineEventHandler(async (event) => {
@@ -113,6 +114,46 @@ export default defineEventHandler(async (event) => {
   const { token, jti } = JWTEnhanced.generateTokenWithJti(newUser.id, newUser.role)
   await createAuthSession(event, { userId: newUser.id, jti, loginMethod: 'password' })
 
+  /*
+   * 可选：注册的同时把这个微信绑到新账号上。
+   *
+   * 场景（小程序）：微信一键登录 → 服务端说「这个微信还没绑过账号」→ 前端跳到注册页 →
+   * 注册成功后应当**顺手绑定**，而不是让用户注册完再自己去绑一次。
+   *
+   * 设计取舍：
+   *   · 绑不上**不能让注册失败**（账号已经建好了，回滚更糟）——
+   *     只返回 wechatBound=false + 原因，前端提示「可稍后在账号管理里绑定」；
+   *   · 令牌无效/过期同理；
+   *   · 唯一约束冲突（同一个微信已绑过别的账号）也放过，按"已绑定"处理。
+   */
+  let wechatBound = false
+  let wechatBindError = ''
+  const bindToken = typeof body.bindToken === 'string' ? body.bindToken : ''
+  if (bindToken) {
+    try {
+      const payload = verifyBindingToken(bindToken)
+      try {
+        await db.insert(userIdentities).values({
+          userId: newUser.id,
+          provider: payload.provider,
+          providerUserId: payload.providerUserId,
+          providerUsername: payload.providerUsername
+        })
+        wechatBound = true
+      } catch (e: any) {
+        // 23505 = Postgres 唯一约束冲突：这个第三方身份已经绑过了
+        if (e?.code === '23505') {
+          wechatBound = true
+        } else {
+          throw e
+        }
+      }
+    } catch (e: any) {
+      wechatBindError = '微信绑定会话已过期，可稍后在「账号管理」里重新绑定'
+      console.error('[register] 注册时绑定第三方身份失败:', e?.message || e)
+    }
+  }
+
   const isSecure =
     getRequestURL(event).protocol === 'https:' ||
     getRequestHeader(event, 'x-forwarded-proto') === 'https'
@@ -127,6 +168,10 @@ export default defineEventHandler(async (event) => {
 
   return {
     success: true,
+    // 供小程序等非浏览器客户端使用：后续请求带 Authorization: Bearer <token>
+    token,
+    wechatBound,
+    wechatBindError,
     user: {
       id: newUser.id,
       username: newUser.username,