feat(t227): query ERP directly from Go

backend-api/internal/platform/shunyunbao/session.go

@@ -212,6 +212,7 @@ func (manager *SessionManager) Login(
 		LoginPath,
 		payload,
 		true,
+		false,
 	)
 	if err != nil {
 		return manager.statusLocked(), err
@@ -251,6 +252,7 @@ func (manager *SessionManager) validateLocked(ctx context.Context) (any, error)
 		UserPath,
 		nil,
 		false,
+		true,
 	)
 	if err != nil {
 		return nil, err
@@ -266,6 +268,7 @@ func (manager *SessionManager) requestJSONLocked(
 	method, path string,
 	body []byte,
 	loginRequest bool,
+	requireSession bool,
 ) (any, error) {
 	var content io.Reader
 	if body != nil {
@@ -300,19 +303,28 @@ func (manager *SessionManager) requestJSONLocked(
 		return nil, domain.ErrFreightSourceUnavailable
 	}
 	var envelope struct {
-		Status bool            `json:"status"`
+		Status *bool           `json:"status"`
+		Code   json.RawMessage `json:"code"`
 		Data   json.RawMessage `json:"data"`
 	}
 	decoder := json.NewDecoder(bytes.NewReader(contentBytes))
-	if err := decoder.Decode(&envelope); err != nil || len(envelope.Data) == 0 {
+	if err := decoder.Decode(&envelope); err != nil || envelope.Status == nil ||
+		len(envelope.Data) == 0 {
 		return nil, domain.ErrFreightSourceProtocol
 	}
-	if !envelope.Status {
+	var extra any
+	if err := decoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		return nil, domain.ErrFreightSourceProtocol
+	}
+	if !*envelope.Status {
 		if loginRequest {
 			return nil, ErrLoginRejected
 		}
-		manager.authenticated = false
-		return nil, domain.ErrFreightSourceSessionNeeded
+		if requireSession || unauthenticatedCode(envelope.Code) {
+			manager.authenticated = false
+			return nil, domain.ErrFreightSourceSessionNeeded
+		}
+		return nil, domain.ErrFreightSourceProtocol
 	}
 	var data any
 	dataDecoder := json.NewDecoder(bytes.NewReader(envelope.Data))
@@ -320,9 +332,29 @@ func (manager *SessionManager) requestJSONLocked(
 	if err := dataDecoder.Decode(&data); err != nil {
 		return nil, domain.ErrFreightSourceProtocol
 	}
+	if err := dataDecoder.Decode(&extra); !errors.Is(err, io.EOF) {
+		return nil, domain.ErrFreightSourceProtocol
+	}
 	return data, nil
 }
 
+func unauthenticatedCode(raw json.RawMessage) bool {
+	var value any
+	decoder := json.NewDecoder(bytes.NewReader(raw))
+	decoder.UseNumber()
+	if len(raw) == 0 || decoder.Decode(&value) != nil {
+		return false
+	}
+	switch typed := value.(type) {
+	case json.Number:
+		return typed == "-2"
+	case string:
+		return strings.TrimSpace(typed) == "-2"
+	default:
+		return false
+	}
+}
+
 func (manager *SessionManager) applyHeaders(request *http.Request) {
 	for name, values := range manager.headers {
 		request.Header[name] = append([]string(nil), values...)