Initial commit: Memind H5 portal with MindSpace, Plaza, and agent jobs.

Track application source and tests; exclude local env, user workspaces, and runtime data via .gitignore.

Co-authored-by: Cursor <cursoragent@cursor.com>

wechat-oauth.test.mjs

@@ -0,0 +1,23 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  loadWechatOAuthConfig,
+  sanitizeWechatReturnTo,
+} from './wechat-oauth.mjs';
+
+test('loadWechatOAuthConfig requires app secret and callback url', () => {
+  const config = loadWechatOAuthConfig({
+    H5_WECHAT_OAUTH_ENABLED: '1',
+    H5_WECHAT_APP_ID: 'wxtest',
+    H5_WECHAT_APP_SECRET: 'secret',
+    H5_PUBLIC_BASE_URL: 'https://example.com',
+  });
+  assert.equal(config.enabled, true);
+  assert.equal(config.callbackUrl, 'https://example.com/auth/wechat/callback');
+});
+
+test('sanitizeWechatReturnTo rejects external urls', () => {
+  const req = { get: (name) => (name === 'host' ? 'example.com' : null) };
+  assert.equal(sanitizeWechatReturnTo('https://evil.com/phish', req), '/');
+  assert.equal(sanitizeWechatReturnTo('/space?page=1', req), '/space?page=1');
+});