diff --git a/mobile-h5/utils/auth-mock.js b/mobile-h5/utils/auth-mock.js
new file mode 100644
index 00000000..da552c93
--- /dev/null
+++ b/mobile-h5/utils/auth-mock.js
@@ -0,0 +1,59 @@
+import { validateCredentials } from './validate-credentials.js'
+
+export { validateCredentials }
+
+const TOKEN_KEY = 'zkxw_mobile_token'
+const USER_KEY = 'zkxw_mobile_user'
+
+export function getToken() {
+  try {
+    return uni.getStorageSync(TOKEN_KEY) || ''
+  } catch (e) {
+    return ''
+  }
+}
+
+export function isLoggedIn() {
+  return !!getToken()
+}
+
+export function getUser() {
+  try {
+    const raw = uni.getStorageSync(USER_KEY)
+    return raw ? JSON.parse(raw) : null
+  } catch (e) {
+    return null
+  }
+}
+
+export function clearSession() {
+  try {
+    uni.removeStorageSync(TOKEN_KEY)
+    uni.removeStorageSync(USER_KEY)
+  } catch (e) {
+    /* ignore */
+  }
+}
+
+export function mockPasswordLogin({ username, password }) {
+  const v = validateCredentials(username, password)
+  if (!v.ok) {
+    const err = new Error(v.message)
+    err.code = v.code
+    throw err
+  }
+  const u = (username || '').trim()
+  const token = 'mock_' + Date.now()
+  const user = { username: u, displayName: u }
+  uni.setStorageSync(TOKEN_KEY, token)
+  uni.setStorageSync(USER_KEY, JSON.stringify(user))
+  return { token, user }
+}
+
+export function mockWechatLogin() {
+  const token = 'mock_wx_' + Date.now()
+  const user = { username: 'wx_user', displayName: '微信用户' }
+  uni.setStorageSync(TOKEN_KEY, token)
+  uni.setStorageSync(USER_KEY, JSON.stringify(user))
+  return { token, user }
+}
diff --git a/mobile-h5/utils/validate-credentials.js b/mobile-h5/utils/validate-credentials.js
new file mode 100644
index 00000000..03e11913
--- /dev/null
+++ b/mobile-h5/utils/validate-credentials.js
@@ -0,0 +1,7 @@
+export function validateCredentials(username, password) {
+  const u = (username || '').trim()
+  const p = password || ''
+  if (!u) return { ok: false, code: 'EMPTY_USERNAME', message: '请输入用户名 / 工号' }
+  if (!p) return { ok: false, code: 'EMPTY_PASSWORD', message: '请输入密码' }
+  return { ok: true }
+}
diff --git a/mobile-h5/utils/validate-credentials.test.mjs b/mobile-h5/utils/validate-credentials.test.mjs
new file mode 100644
index 00000000..ea2023ab
--- /dev/null
+++ b/mobile-h5/utils/validate-credentials.test.mjs
@@ -0,0 +1,8 @@
+import assert from 'node:assert/strict'
+import { validateCredentials } from './validate-credentials.js'
+
+assert.equal(validateCredentials('', 'x').code, 'EMPTY_USERNAME')
+assert.equal(validateCredentials('  ', 'x').code, 'EMPTY_USERNAME')
+assert.equal(validateCredentials('admin', '').code, 'EMPTY_PASSWORD')
+assert.equal(validateCredentials('admin', '111111').ok, true)
+console.log('validate-credentials: all passed')