C7/C8: employees.last_login_ip 列补全（ALTER TABLE 迁移）+ redis decode 兼容修复 7 处（wecom_service×2/employee_directory×3/auth_wecom_sso×2，统一 isinstance 保护模式）

backend/app/api/auth_wecom_sso.py

@@ -224,12 +224,14 @@ async def sso_callback(
         # 解析 state 数据（添加异常处理）
         import ast
         import json
+        # v4.0 C8 修复：decode_responses=True 时 state_raw 已是 str
+        state_raw = state_raw if isinstance(state_raw, str) else state_raw.decode("utf-8")
         try:
-            state_data = json.loads(state_raw.decode("utf-8"))
+            state_data = json.loads(state_raw)
         except (json.JSONDecodeError, AttributeError) as e:
             # 兼容旧格式（使用 ast.literal_eval）
             try:
-                state_data = ast.literal_eval(state_raw.decode("utf-8"))
+                state_data = ast.literal_eval(state_raw)
             except (ValueError, SyntaxError) as e2:
                 logger.error(f"SSO callback state 解析失败: {e2}")
                 return RedirectResponse(url=_get_error_redirect_url("state_invalid", "授权信息无效，请重新进入", next_path), status_code=302)
@@ -368,7 +370,9 @@ async def sso_verify(
     # 一次性 token(防止泄漏后被滥用)
     await redis_client.delete(f"wecom_sso:token:{sso_token}")
 
-    payload = json.loads(token_raw.decode("utf-8"))
+    # v4.0 C8 修复：兼容 str/bytes
+    token_raw = token_raw if isinstance(token_raw, str) else token_raw.decode("utf-8")
+    payload = json.loads(token_raw)
     return success_response(data=payload)
 
 

backend/app/services/employee_directory.py

@@ -62,7 +62,9 @@ async def get_org_directory(
             raw = await redis.get(ORG_DIRECTORY_CACHE_KEY)
             if raw:
                 logger.debug("命中组织目录缓存")
-                return json.loads(raw.decode("utf-8")), True
+                # v4.0 C8 修复：兼容 str/bytes
+                raw = raw if isinstance(raw, str) else raw.decode("utf-8")
+                return json.loads(raw), True
         except Exception as e:
             logger.warning(f"读取组织目录缓存失败（降级）: {e}")
 
@@ -306,7 +308,9 @@ async def get_cached_dept_list(
         try:
             raw = await redis.get(DEPT_LIST_CACHE_KEY)
             if raw:
-                return json.loads(raw.decode("utf-8"))
+                # v4.0 C8 修复：兼容 str/bytes
+                raw = raw if isinstance(raw, str) else raw.decode("utf-8")
+                return json.loads(raw)
         except Exception as e:
             logger.warning(f"读取部门列表缓存失败: {e}")
 
@@ -607,7 +611,9 @@ async def get_org_tree_cached(
         try:
             raw = await redis.get(cache_key)
             if raw:
-                tree = json.loads(raw.decode("utf-8"))
+                # v4.0 C8 修复：兼容 str/bytes
+                raw = raw if isinstance(raw, str) else raw.decode("utf-8")
+                tree = json.loads(raw)
                 logger.debug(f"命中组织架构树缓存: {endpoint}")
         except Exception as e:
             logger.warning(f"读取组织架构树缓存失败: {e}")

backend/app/services/wecom_service.py

@@ -78,7 +78,8 @@ class WecomService:
                 cached_token = await self.redis.get(cache_key)
                 if cached_token:
                     logger.debug("从缓存获取 access_token")
-                    return cached_token.decode("utf-8")
+                    # v4.0 C8 修复：decode_responses=True 时返回 str，兼容 bytes
+                    return cached_token if isinstance(cached_token, str) else cached_token.decode("utf-8")
             except Exception as e:
                 logger.warning(f"Redis 读取失败（降级）: {e}")
 
@@ -1134,7 +1135,8 @@ class WecomService:
                 cached = await self.redis.get(cache_key)
                 if cached:
                     logger.debug("从缓存获取 jsapi_ticket")
-                    return cached.decode("utf-8")
+                    # v4.0 C8 修复：兼容 str/bytes
+                    return cached if isinstance(cached, str) else cached.decode("utf-8")
             except Exception as e:
                 logger.warning(f"Redis 读取 jsapi_ticket 失败（降级）: {e}")