fix frontend wechat oauth capability recovery

frontend/src/api/auth.ts

@@ -352,6 +352,7 @@ export async function getPublicSettings(): Promise<PublicSettings> {
 export type WeChatOAuthMode = 'open' | 'mp'
 export type WeChatOAuthUnavailableReason =
   | 'not_configured'
+  | 'capability_unknown'
   | 'external_browser_required'
   | 'wechat_browser_required'
 
@@ -369,6 +370,16 @@ export type WeChatOAuthPublicSettings = {
   wechat_oauth_mp_enabled?: boolean
 }
 
+export function hasExplicitWeChatOAuthCapabilities(
+  settings: WeChatOAuthPublicSettings | null | undefined,
+): settings is WeChatOAuthPublicSettings & {
+  wechat_oauth_open_enabled: boolean
+  wechat_oauth_mp_enabled: boolean
+} {
+  return typeof settings?.wechat_oauth_open_enabled === 'boolean'
+    && typeof settings?.wechat_oauth_mp_enabled === 'boolean'
+}
+
 export function resolveWeChatOAuthStart(
   settings: WeChatOAuthPublicSettings | null | undefined,
   userAgent?: string
@@ -404,6 +415,28 @@ export function resolveWeChatOAuthStart(
   return { mode: null, openEnabled, mpEnabled, isWeChatBrowser, unavailableReason: 'not_configured' }
 }
 
+export function resolveWeChatOAuthStartStrict(
+  settings: WeChatOAuthPublicSettings | null | undefined,
+  userAgent?: string,
+): ResolvedWeChatOAuthStart {
+  const normalizedUserAgent = (userAgent
+    ?? (typeof navigator !== 'undefined' ? navigator.userAgent : '')
+    ?? '').trim()
+  const isWeChatBrowser = /MicroMessenger/i.test(normalizedUserAgent)
+
+  if (!hasExplicitWeChatOAuthCapabilities(settings)) {
+    return {
+      mode: null,
+      openEnabled: false,
+      mpEnabled: false,
+      isWeChatBrowser,
+      unavailableReason: 'capability_unknown',
+    }
+  }
+
+  return resolveWeChatOAuthStart(settings, normalizedUserAgent)
+}
+
 /**
  * Send verification code to email
  * @param request - Email and optional Turnstile token

frontend/src/api/user.ts

@@ -5,8 +5,8 @@
 
 import { apiClient } from './client'
 import {
+  resolveWeChatOAuthStartStrict,
   prepareOAuthBindAccessTokenCookie,
-  resolveWeChatOAuthStart,
   type WeChatOAuthPublicSettings,
 } from './auth'
 import type { User, ChangePasswordRequest, NotifyEmailEntry, UserAuthProvider } from '@/types'
@@ -107,7 +107,7 @@ function resolveWeChatOAuthBindingMode(
   settings?: WeChatOAuthPublicSettings | null
 ): 'open' | 'mp' | null {
   if (settings) {
-    return resolveWeChatOAuthStart(settings).mode
+    return resolveWeChatOAuthStartStrict(settings).mode
   }
   return resolveWeChatOAuthMode()
 }