feat(settings): support dual-mode wechat oauth defaults

frontend/src/api/__tests__/settings.authSourceDefaults.spec.ts

@@ -1,13 +1,13 @@
-import { describe, expect, it } from 'vitest'
+import { describe, expect, it } from "vitest";
 
 import {
   appendAuthSourceDefaultsToUpdateRequest,
   buildAuthSourceDefaultsState,
   type UpdateSettingsRequest,
-} from '@/api/admin/settings'
+} from "@/api/admin/settings";
 
-describe('admin settings auth source defaults helpers', () => {
-  it('builds auth source defaults state from flat settings fields', () => {
+describe("admin settings auth source defaults helpers", () => {
+  it("builds auth source defaults state from flat settings fields", () => {
     const state = buildAuthSourceDefaultsState({
       auth_source_default_email_balance: 9.5,
       auth_source_default_email_concurrency: 3,
@@ -23,7 +23,7 @@ describe('admin settings auth source defaults helpers', () => {
       ],
       auth_source_default_linuxdo_grant_on_signup: true,
       auth_source_default_linuxdo_grant_on_first_bind: false,
-    })
+    });
 
     expect(state.email).toEqual({
       balance: 9.5,
@@ -31,34 +31,43 @@ describe('admin settings auth source defaults helpers', () => {
       subscriptions: [{ group_id: 1, validity_days: 30 }],
       grant_on_signup: false,
       grant_on_first_bind: true,
-    })
+    });
     expect(state.linuxdo).toEqual({
       balance: 6,
       concurrency: 8,
       subscriptions: [{ group_id: 2, validity_days: 60 }],
       grant_on_signup: true,
       grant_on_first_bind: false,
-    })
+    });
     expect(state.oidc).toEqual({
       balance: 0,
       concurrency: 5,
       subscriptions: [],
-      grant_on_signup: true,
+      grant_on_signup: false,
       grant_on_first_bind: false,
-    })
+    });
     expect(state.wechat).toEqual({
       balance: 0,
       concurrency: 5,
       subscriptions: [],
-      grant_on_signup: true,
+      grant_on_signup: false,
       grant_on_first_bind: false,
-    })
-  })
+    });
+  });
 
-  it('appends auth source defaults back onto update payload', () => {
+  it("defaults grant-on-signup to disabled when settings are missing", () => {
+    const state = buildAuthSourceDefaultsState({});
+
+    expect(state.email.grant_on_signup).toBe(false);
+    expect(state.linuxdo.grant_on_signup).toBe(false);
+    expect(state.oidc.grant_on_signup).toBe(false);
+    expect(state.wechat.grant_on_signup).toBe(false);
+  });
+
+  it("appends auth source defaults back onto update payload", () => {
     const payload: UpdateSettingsRequest = {
-      site_name: 'Sub2API',
-    }
+      site_name: "Sub2API",
+    };
 
     appendAuthSourceDefaultsToUpdateRequest(payload, {
       email: {
@@ -89,13 +98,15 @@ describe('admin settings auth source defaults helpers', () => {
         grant_on_signup: false,
         grant_on_first_bind: false,
       },
-    })
+    });
 
     expect(payload).toMatchObject({
-      site_name: 'Sub2API',
+      site_name: "Sub2API",
       auth_source_default_email_balance: 1.25,
       auth_source_default_email_concurrency: 2,
-      auth_source_default_email_subscriptions: [{ group_id: 3, validity_days: 7 }],
+      auth_source_default_email_subscriptions: [
+        { group_id: 3, validity_days: 7 },
+      ],
       auth_source_default_email_grant_on_signup: true,
       auth_source_default_email_grant_on_first_bind: false,
       auth_source_default_linuxdo_balance: 0,
@@ -105,7 +116,9 @@ describe('admin settings auth source defaults helpers', () => {
       auth_source_default_linuxdo_grant_on_first_bind: true,
       auth_source_default_oidc_balance: 4,
       auth_source_default_oidc_concurrency: 9,
-      auth_source_default_oidc_subscriptions: [{ group_id: 9, validity_days: 90 }],
+      auth_source_default_oidc_subscriptions: [
+        { group_id: 9, validity_days: 90 },
+      ],
       auth_source_default_oidc_grant_on_signup: true,
       auth_source_default_oidc_grant_on_first_bind: true,
       auth_source_default_wechat_balance: 2,
@@ -113,6 +126,6 @@ describe('admin settings auth source defaults helpers', () => {
       auth_source_default_wechat_subscriptions: [],
       auth_source_default_wechat_grant_on_signup: false,
       auth_source_default_wechat_grant_on_first_bind: false,
-    })
-  })
-})
+    });
+  });
+});

frontend/src/api/admin/settings.ts

@@ -167,7 +167,7 @@ export function buildAuthSourceDefaultsState(
           : [],
       ),
       grant_on_signup:
-        raw[`auth_source_default_${source}_grant_on_signup`] !== false,
+        raw[`auth_source_default_${source}_grant_on_signup`] === true,
       grant_on_first_bind:
         raw[`auth_source_default_${source}_grant_on_first_bind`] === true,
     };
@@ -239,6 +239,33 @@ export function defaultWeChatConnectScopesForMode(mode: unknown): string {
     : "snsapi_login";
 }
 
+export function resolveWeChatConnectModeCapabilities(
+  openEnabled: unknown,
+  mpEnabled: unknown,
+  legacyMode: unknown,
+): { openEnabled: boolean; mpEnabled: boolean } {
+  if (typeof openEnabled === "boolean" || typeof mpEnabled === "boolean") {
+    return {
+      openEnabled: openEnabled === true,
+      mpEnabled: mpEnabled === true,
+    };
+  }
+
+  return normalizeWeChatConnectMode(legacyMode) === "mp"
+    ? { openEnabled: false, mpEnabled: true }
+    : { openEnabled: true, mpEnabled: false };
+}
+
+export function deriveWeChatConnectStoredMode(
+  openEnabled: boolean,
+  mpEnabled: boolean,
+  legacyMode: unknown,
+): WeChatConnectMode {
+  if (mpEnabled) return "mp";
+  if (openEnabled) return "open";
+  return normalizeWeChatConnectMode(legacyMode);
+}
+
 /**
  * System settings interface
  */
@@ -315,6 +342,8 @@ export interface SystemSettings {
   wechat_connect_enabled: boolean;
   wechat_connect_app_id: string;
   wechat_connect_app_secret_configured: boolean;
+  wechat_connect_open_enabled?: boolean;
+  wechat_connect_mp_enabled?: boolean;
   wechat_connect_mode: string;
   wechat_connect_scopes: string;
   wechat_connect_redirect_url: string;
@@ -472,6 +501,8 @@ export interface UpdateSettingsRequest {
   wechat_connect_enabled?: boolean;
   wechat_connect_app_id?: string;
   wechat_connect_app_secret?: string;
+  wechat_connect_open_enabled?: boolean;
+  wechat_connect_mp_enabled?: boolean;
   wechat_connect_mode?: string;
   wechat_connect_scopes?: string;
   wechat_connect_redirect_url?: string;