fix(api): 消费 op-login 请求时要求已审批，fake 同步

internal/api/api_test.go

@@ -1734,13 +1734,13 @@ func (f *fakeRepo) OpLoginRequestByID(_ context.Context, id string) (*OpLoginReq
 	}, nil
 }
 
-// ConsumeOpLoginRequest stamps consumed on an unconsumed, unexpired request (the
-// finish path's single-use guard), mirroring the PG zero-rows-else UPDATE. The
-// approval gate is read by the handler BEFORE this call, so consume only checks
-// consumed_at and expiry (exactly as PG does).
+// ConsumeOpLoginRequest stamps consumed on an approved, unconsumed, unexpired
+// request (the finish path's single-use guard), mirroring the PG zero-rows-else
+// UPDATE. The handler reads the approval first too; the store refuses a pending
+// request on its own so the single-use guard never depends on that read.
 func (f *fakeRepo) ConsumeOpLoginRequest(_ context.Context, id string, now time.Time) error {
 	r, ok := f.opLogins[id]
-	if !ok || r.consumed || !r.expiresAt.After(now) {
+	if !ok || r.status != "approved" || r.consumed || !r.expiresAt.After(now) {
 		return ErrNotFound
 	}
 	r.consumed = true

internal/api/pgrepo.go

@@ -2948,7 +2948,7 @@ func (p *PGRepo) ApproveOpLogin(ctx context.Context, id, approverUserID string,
 func (p *PGRepo) ConsumeOpLoginRequest(ctx context.Context, id string, now time.Time) error {
 	res, err := p.db.ExecContext(ctx,
 		`UPDATE op_login_requests SET consumed_at = $2
-		 WHERE id = $1 AND consumed_at IS NULL AND expires_at > $2`,
+		 WHERE id = $1 AND approved_at IS NOT NULL AND consumed_at IS NULL AND expires_at > $2`,
 		id, now)
 	if err != nil {
 		return err