fix: 小程序服务号绑定先打开门户域名再跳转微信授权。

web-view 不能直接打开 open.weixin.qq.com，移动端改为打开已配置的业务域名中转页。

Co-authored-by: Cursor <cursoragent@cursor.com>

miniprogram/api/wechat-notices.js

@@ -1,5 +1,13 @@
+import { resolveApiBase, resolveWebOrigin } from '@/config/api'
 import { request, parseResponseJson } from '@/utils/request'
 
+const LAUNCH_PATH = '/api/public/wechat-notices/oauth/launch'
+
+function httpsHost(raw) {
+  const match = String(raw || '').match(/^https:\/\/([^/?#]+)/i)
+  return match ? match[1].toLowerCase() : ''
+}
+
 export async function fetchWechatNoticeStatus() {
   const response = await request({
     url: '/web/wechat-notices/binding',
@@ -27,7 +35,12 @@ async function bindingRequest(method, path, data) {
 }
 
 export function isWechatAuthorizeUrl(value) {
-  return typeof value === 'string' && /^https:\/\/open\.weixin\.qq\.com\/connect\/oauth2\/authorize\?[^\s]+$/.test(value)
+  // web-view 只能打开业务域名。这里只接受门户上的授权中转页，不直接打开 open.weixin.qq.com。
+  if (typeof value !== 'string' || value.length > 300) return false
+  const match = value.match(/^https:\/\/([^/?#@]+)(\/[^?#]*)\?state=([A-Za-z0-9_-]{20,100})$/)
+  if (!match || match[2] !== LAUNCH_PATH) return false
+  const allowed = new Set([httpsHost(resolveWebOrigin()), httpsHost(resolveApiBase())].filter(Boolean))
+  return allowed.has(match[1].toLowerCase())
 }
 
 export async function startWechatBinding() {