fix: show scannable login QR on mobile

DouYinSparkFlow/tests/test_deployment_contract.py

@@ -111,6 +111,12 @@ class DeploymentContractTests(unittest.TestCase):
         for entry in ("logs/", "config.json", "usersData.json", "webui_settings.json"):
             self.assertIn(entry, dockerignore)
 
+    def test_login_desktop_exposes_cropped_qr_endpoint(self):
+        server = (SOURCE_ROOT / "login_desktop_server.py").read_text(encoding="utf-8")
+        self.assertIn('@app.get("/qr")', server)
+        self.assertIn('img[class*="qrcode"]', server)
+        self.assertIn('Cache-Control": "no-store, max-age=0', server)
+
     def test_legacy_unused_entrypoints_are_removed(self):
         self.assertFalse((SOURCE_ROOT / "webui" / "login_sessions.py").exists())
         self.assertFalse((SOURCE_ROOT / "relogin_worker.py").exists())

DouYinSparkFlow/tests/test_webui_safety.py

@@ -4,7 +4,7 @@ import tempfile
 import time
 import unittest
 from pathlib import Path
-from unittest.mock import patch
+from unittest.mock import Mock, patch
 
 from fastapi.testclient import TestClient
 
@@ -163,6 +163,30 @@ class WebUiSafetyTests(unittest.TestCase):
         self.assertIn("noVNC", response.text)
         fetch_asset.assert_called_once_with("vnc.html", "autoconnect=1")
 
+    def test_login_qr_proxy_requires_auth_and_returns_png(self):
+        client = TestClient(app_module.app)
+        unauthenticated = client.get("/login-desktop/qr", follow_redirects=False)
+        self.assertEqual(303, unauthenticated.status_code)
+
+        upstream = Mock()
+        upstream.read.return_value = b"fake-png"
+        with (
+            patch.object(app_module, "current_user", return_value="admin"),
+            patch.object(app_module.urllib.request, "urlopen", return_value=upstream),
+        ):
+            response = client.get("/login-desktop/qr")
+
+        self.assertEqual(200, response.status_code)
+        self.assertEqual("image/png", response.headers["content-type"])
+        self.assertEqual("no-store, max-age=0", response.headers["cache-control"])
+        self.assertEqual(b"fake-png", response.content)
+
+    def test_dashboard_contains_mobile_qr_controls(self):
+        dashboard = (Path(app_module.TEMPLATES_DIR) / "dashboard.html").read_text(encoding="utf-8")
+        self.assertIn("data-login-qr", dashboard)
+        self.assertIn("data-refresh-login-qr", dashboard)
+        self.assertIn("/login-desktop/qr", dashboard)
+
     def test_mobile_login_popup_opens_before_async_request(self):
         script = (Path(app_module.STATIC_DIR) / "app.js").read_text(encoding="utf-8")
         block_start = script.index('document.querySelectorAll(".login-desktop-open")')