feat: add mini auth web-qr scanned and confirm endpoints

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/test_wx_qr_api.py

@@ -1,5 +1,6 @@
 """web wx-qr create/status API。"""
-from unittest.mock import patch
+from types import SimpleNamespace
+from unittest.mock import AsyncMock, patch
 
 from fastapi.testclient import TestClient
 
@@ -28,3 +29,33 @@ def test_wx_qr_create_and_poll_pending():
         st = client.get("/api/web/auth/wx-qr/status", params={"sessionId": sid})
     assert st.status_code == 200
     assert st.json()["data"]["status"] == "pending"
+
+
+def test_web_qr_confirm_success_sets_session():
+    fake_user = SimpleNamespace(
+        id="u1", phone_no="13800138000", wx_openid=None, wx_unionid=None, status="1"
+    )
+    tokens = {
+        "token": "access",
+        "refreshToken": "refresh",
+        "expiresIn": 3600,
+        "userInfo": {"id": "u1"},
+    }
+    with patch("app.services.wx_qr_session._redis", return_value=None):
+        wx_qr_session._memory_clear_for_tests()
+        sid, _short = wx_qr_session.create_session(ttl_sec=60)
+        with patch("app.api.mini_auth.code2session", return_value={"openid": "oid1", "unionid": ""}), \
+             patch("app.api.mini_auth.get_phone_number", return_value="13800138000"), \
+             patch("app.api.mini_auth.resolve_wechat_login_user", return_value=(fake_user, None, None)), \
+             patch("app.api.mini_auth.issue_tokens_for_user", new=AsyncMock(return_value=tokens)):
+            r = client.post(
+                "/api/mini/auth/web-qr-confirm",
+                json={"sessionId": sid, "loginCode": "lc", "phoneCode": "pc"},
+            )
+        assert r.status_code == 200
+        body = r.json()
+        assert body.get("code") == 200
+        assert body["data"].get("ok") is True
+        assert "token" not in (body.get("data") or {})
+        consumed = wx_qr_session.consume_success(sid)
+        assert consumed and consumed["token"] == "access"