fix(security): remediate telecom compliance findings

backend/app/api/auth.py

@@ -58,36 +58,16 @@ async def wecom_login(req: WecomLoginRequest, db: AsyncSession = Depends(get_db)
             role=user.role,
         )
 
-    # Not bound yet — return a redirect URL to Casdoor for binding
-    casdoor_auth_url = (
-        f"{settings.CASDOOR_ENDPOINT}/login/oauth/authorize"
-        f"?client_id={settings.CASDOOR_CLIENT_ID}"
-        f"&response_type=code"
-        f"&redirect_uri={settings.CORS_ORIGINS[0]}/bind-wecom"
-        f"&scope=openid+profile"
-        f"&state={wecom_userid}"
+    raise HTTPException(
+        status_code=403,
+        detail="企业微信账号尚未绑定。请在企业微信内使用一次性绑定链接完成绑定。",
     )
-    return {"need_bind": True, "casdoor_url": casdoor_auth_url, "wecom_userid": wecom_userid}
 
 
 @router.post("/bind-wecom")
 async def bind_wecom(req: WecomBindRequest, db: AsyncSession = Depends(get_db)):
-    """Bind Casdoor account with WeChat Work userid after OIDC redirect."""
-    userinfo = await exchange_casdoor_code(req.casdoor_code)
-    if not userinfo:
-        raise HTTPException(status_code=400, detail="Failed to exchange casdoor code")
-
-    casdoor_id = userinfo.get("sub") or userinfo.get("id")
-    wecom_userid = req.wecom_userid or userinfo.get("state", "")
-
-    user = await bind_wecom_user(db, casdoor_id, wecom_userid)
-    if not user:
-        raise HTTPException(status_code=404, detail="User not found")
-
-    token = build_token_for_user(user)
-    return TokenResponse(
-        access_token=token,
-        user_id=str(user.id),
-        name=user.name,
-        role=user.role,
+    """Deprecated unsafe binding flow. Use /wecom/bind-confirm with a one-time token."""
+    raise HTTPException(
+        status_code=410,
+        detail="该绑定接口已停用，请使用企业微信一次性绑定链接。",
     )