修复登录报错问题

tests/auth-password-route.test.ts

@@ -80,6 +80,57 @@ describe("password auth route AgentBus compatibility", () => {
     expect(seenBodies[0].has("randomStr")).toBe(false);
   });
 
+  it("passes the organization tenant id to platform password login", async () => {
+    for (const [key, value] of Object.entries(baseEnv)) vi.stubEnv(key, value);
+    vi.stubEnv("ZHINIAN_ORG_TENANT_ID", "999");
+    const { publicKey, privateKey } = generateKeyPairSync("rsa", { modulusLength: 2048 });
+    const jwk = publicKey.export({ format: "jwk" }) as TestJwk;
+    jwk.kid = "tenant-key";
+    const accessToken = signJwt({
+      iss: baseEnv.ZHINIAN_AUTH_ISSUER,
+      sub: "platform-user",
+      user_id: "platform-user",
+      username: "platform@example.com",
+      client_id: baseEnv.ZHINIAN_AUTH_CLIENT_ID,
+      scope: baseEnv.ZHINIAN_AUTH_SCOPE,
+      tenant_id: "999",
+      exp: Math.floor(Date.now() / 1000) + 600,
+      iat: Math.floor(Date.now() / 1000) - 10,
+      nbf: Math.floor(Date.now() / 1000) - 10
+    }, privateKey, "tenant-key");
+    const seenBodies: URLSearchParams[] = [];
+    const seenTenantHeaders: Array<string | null> = [];
+
+    vi.stubGlobal("fetch", async (input: RequestInfo | URL, init?: RequestInit) => {
+      const url = String(input);
+      if (url.endsWith("/oauth2/jwks")) {
+        return new Response(JSON.stringify({ keys: [jwk] }), { status: 200 });
+      }
+      if (url.endsWith("/oauth2/token")) {
+        seenBodies.push(new URLSearchParams(String(init?.body)));
+        seenTenantHeaders.push(headerValue(init?.headers, "tenantId"));
+        return new Response(JSON.stringify({
+          access_token: accessToken,
+          token_type: "bearer",
+          expires_in: "3600"
+        }), { status: 200 });
+      }
+      return new Response("not found", { status: 404 });
+    });
+
+    const response = await POST(new Request("https://app.example.com/api/auth/password", {
+      method: "POST",
+      body: JSON.stringify({
+        username: "platform@example.com",
+        password: "123456"
+      })
+    }));
+
+    expect(response.status).toBe(200);
+    expect(seenBodies[0].get("tenantId")).toBe("999");
+    expect(seenTenantHeaders).toEqual(["999"]);
+  });
+
   it("uses the admin OAuth client for admin password login", async () => {
     for (const [key, value] of Object.entries(baseEnv)) vi.stubEnv(key, value);
     vi.stubEnv("ZHINIAN_ADMIN_AUTH_CLIENT_ID", "app");
@@ -134,6 +185,17 @@ describe("password auth route AgentBus compatibility", () => {
   });
 });
 
+function headerValue(headers: HeadersInit | undefined, name: string): string | null {
+  if (!headers) return null;
+  if (headers instanceof Headers) return headers.get(name);
+  if (Array.isArray(headers)) {
+    const found = headers.find(([key]) => key.toLowerCase() === name.toLowerCase());
+    return found?.[1] ?? null;
+  }
+  const record = headers as Record<string, string>;
+  return record[name] ?? record[name.toLowerCase()] ?? null;
+}
+
 function signJwt(payload: Record<string, unknown>, privateKey: KeyObject, kid: string): string {
   const header = base64UrlJson({ alg: "RS256", typ: "JWT", kid });
   const body = base64UrlJson(payload);