文件
fenleixinxi/application/api/controller/Member.php
MiAn 63fdfe87d7 feat(v1.1.0): 支付改由 epay 插件承载、插件纳入版本库,补齐媒体上传/LBS/互动/优惠券/后台看板,并修复余额充值资损
## 一、支付:改由已安装的 epay 插件承载(不再自研签名)
- 下单:\addons\epay\library\Service::submitOrder($amount 元, $orderNo, 'wechat', $body, $notifyUrl, null, 'miniapp', $openid)
- 验签:Service::checkNotify('wechat')(内部 $pay->verify());应答:$pay->success()(v2 = XML)
- 业务编排仍在 application/api/controller/Pay.php,不改插件源码:
  POST /pay/prepay(取调起参数,下发前剔除 appId);POST /pay/notify(公开路由:插件验签 → 金额核对 → 幂等分派)
- 配置真源 = addons/epay/config.php(后台「插件管理 → 微信支付宝整合插件 → 配置」);
  fc_config 的 wx.mchId / wx.apiKey / wx.payNotifyUrl 废弃;后台「系统设置」支付表单改只读并跳插件配置页
- 插件 API 保持 version=v2(PHP 7.4 可跑);certs/* 为 0 字节占位,不含任何真实密钥
- 修复 BUG-015:Pay::notify() 与基类站内信同名且签名不兼容导致 /pay/* 全 500,动作改名 notifyCallback()

## 二、插件纳入 Git 版本管理
- .gitignore 移除 /addons/* 与 /public/assets/addons/*(保留 .gitkeep 占位)
- 入库 addons/epay、addons/wechat、public/assets/addons/*、addons/.htaccess(deny from all)
- config.php 入库为空白模板;服务器请在填好密钥后执行
  git update-index --skip-worktree addons/epay/config.php,避免真实密钥回传仓库

## 三、安全修复:余额充值资损(高危,已实测复现)
- 现象:POST /order/recharge {payType:'balance'} 只加余额不扣款(余额 134.50 → 1022.50),等于凭空增发余额,
  可再去买会员 / 付费发布 / 解锁联系方式
- 修复:/order/recharge 仅接受 payType=wxpay,balance → 「余额充值仅支持微信支付」,其它 → 「支付方式不支持」;
  订单恒为 status=pending、pay_type=wxpay、paytime=null;入账只发生在 /pay/notify 回调(Order::creditRecharge)
  或后台「会员管理 → 余额充值」(fc/userext/recharge)
- 小程序充值页同步为「仅微信支付」+ 防重复提交 + onShow 刷新资产;mock / 用例 / 文档同步

## 四、其他 v1.1.0 能力
- 媒体上传:POST /post/upload(图片 ≤10MB / 视频 ≤50MB,真落盘),发布页 uni.uploadFile 真上传
- LBS:fc_post.lat/lng、首页 sort=nearby(距离升序、无坐标排最后)、卡片 distance、详情页地图
- 互动:举报 POST /report(原因字典)、收藏 / 关注(fc_favorite / fc_follow、/favorite/*、/follow/toggle)
- 交易:余额充值 POST /order/recharge、优惠券 /coupon/list|receive(fc_coupon / fc_user_coupon、我的资产券)
- 发布计费:会员发布折扣(discountRate/discountText)+ 免费发布条数(freeQuota*)
- 后台新增:数据总览 fc/dashboard、系统设置 fc/setting、优惠券管理 fc/coupon(含菜单与权限节点)

## 五、本批审核修复
- 详情页:游客不再请求登录态接口(避免 401 被清 token 踢去登录);微信付费查看改为支付后轮询解锁,
  不再读取 wxpay 分支未返回的 contact;加防重复提交
- 发布页:freeLeftToday → freeQuotaLeft / freeQuotaCycle / freeUnlimited(对齐后端出参);
  上传图预览拼后端域名(新增 format.js#assetUrl,后端返回相对路径)
- 收藏空态「去首页」:switchTab → reLaunch(项目用自绘 fc-tabbar,无 tabBar,switchTab 必然失败)
- 会员券 days=0 显示「永久有效」;manifest.json 补 requiredPrivateInfos(getLocation / chooseLocation)
- 后端:publishConfig 补 discountRate/discountText 与 memberPostDiscountText();优惠券总开关 coupon.enabled
  真生效(关闭后 list/receive 拒绝);后台 fc/Coupon 的 add/edit 补 strip_tags 过滤(防存储型 XSS)、
  补 searchFields='name',列表 name 列再做一次 HTML 转义
- FcInstall:补清理后台菜单缓存 __menu__(否则新菜单要等缓存过期才显示),并同步 README 说明
- 后台语言包 fc/setting.php 按「支付只读 + 跳插件配置」的新页面重写
- 文档同步:uniapp/docs/{01,03,04}、uniapp/README.md、docs/05-后端实现规范.md、后台 README 上线步骤

## 六、校验结果(全部通过)
- 后端端到端:tools/verify-api.mjs 226/226(含新增「拒绝余额充值(资损防护)」用例)
- 小程序:uniapp/tests/run.mjs 167/167;validate.mjs 0 错 0 警;check-scss 19/19
- 后台:check-admin-i18n 0 错 0 警;check-theme 0 错 0 警;9 个页面 HTTP 200 全中文
- php -l 改动/新增 PHP 文件 0 语法错误;探针复测:余额不再增长、epay 插件下单/验签链路通
2026-10-19 10:03:13 +08:00

323 行
12 KiB
PHP

此文件含有模棱两可的 Unicode 字符

此文件含有可能会与其他字符混淆的 Unicode 字符。 如果您是想特意这样的,可以安全地忽略该警告。 使用 Escape 按钮显示他们。

<?php
namespace app\api\controller;
use think\Db;
/**
* 用户端 · 会员中心(Module-MEMBER)
* 路由:
* GET /api/v1/member/plans M1 会员套餐
* GET /api/v1/member/benefits M2 会员权益
* POST /api/v1/member/open M3 开通会员
* GET /api/v1/member/orders M4 我的订单
* GET /api/v1/member/assets M5 我的资产
*/
class Member extends V1
{
/**
* M1 会员套餐
* GET /api/v1/member/plans → [{planId,name,price,originPrice,days,tag}]
* 规则:仅 enabled=1,按 sort asc
*/
public function plans()
{
$rows = Db::name('fc_plan')
->where('enabled', 1)
->order('sort asc')
->select();
$list = [];
foreach ($rows as $row) {
$list[] = [
'planId' => (string)$row['plan_code'],
'name' => (string)$row['name'],
'price' => (float)$row['price'],
'originPrice' => (float)$row['origin_price'],
'days' => (int)$row['days'],
'tag' => (string)$row['tag'],
// 套餐含发布条数(后台「发布与费用配置」同步;0 表示不含发布额度)
'postQuota' => isset($row['post_quota']) ? (int)$row['post_quota'] : 0,
];
}
$this->ok($list);
}
/**
* M2 会员权益
* GET /api/v1/member/benefits → {freeView,postDiscount,distRate,benefits[]}
* 规则:读配置 member.benefit,未配置返回默认
*/
public function benefits()
{
$default = [
'freeView' => 20,
'postDiscount' => '8 折',
'distRate' => '一级 20% / 二级 10%',
'benefits' => ['每日免费查看 20 条联系方式', '发布信息 8 折', '专属会员标识', '分销佣金加速结算'],
];
$cfg = $this->cfg('member.benefit', null);
if (!is_array($cfg)) {
$cfg = $default;
}
$benefits = isset($cfg['benefits']) && is_array($cfg['benefits']) && $cfg['benefits']
? array_values($cfg['benefits'])
: $default['benefits'];
$this->ok([
'freeView' => isset($cfg['freeView']) ? (int)$cfg['freeView'] : $default['freeView'],
'postDiscount' => isset($cfg['postDiscount']) ? (string)$cfg['postDiscount'] : $default['postDiscount'],
'distRate' => isset($cfg['distRate']) ? (string)$cfg['distRate'] : $default['distRate'],
'benefits' => $benefits,
]);
}
/**
* M3 开通会员
* POST /api/v1/member/open {planId,payType}
* → {orderNo,status,order,expireAt,postQuota,quotaLeft,quotaExpireAt}
* - balance:余额支付,下单即扣款并**立即发放会员**(status=paid,order=null)
* - wxpay :订单 pending(order={orderNo,amount,payType,status:'pending'}),
* 前端拿 orderNo 调 POST /pay/prepay 调起收银台,支付成功后由 /pay/notify 发放会员
* 规则 BR-07;套餐按 plan_code 查;金额取 fc_plan.price(服务端计算,忽略客户端传值)
*/
public function open()
{
$user = $this->auth();
$planId = trim((string)$this->input('planId', ''));
if ($planId === '') {
$this->fail('请选择会员套餐');
}
$payType = (string)$this->input('payType', '');
if (!in_array($payType, ['wxpay', 'balance'], true)) {
$this->fail('支付方式不支持');
}
$plan = Db::name('fc_plan')->where('plan_code', $planId)->find();
if (!$plan) {
$this->fail('套餐不存在');
}
$amount = round((float)$plan['price'], 2);
$now = time();
$isBalance = $payType === 'balance';
// 余额校验必须在落订单之前:否则余额不足时已插入一条 status=paid 的假订单
$balance = (float)$user['money'];
if ($isBalance && $balance < $amount) {
$this->fail('余额不足');
}
$orderNo = $this->orderNo('MO');
$orderId = Db::name('fc_order')->insertGetId([
'order_no' => $orderNo,
'user_id' => $user['id'],
'type' => 'member',
'title' => (string)$plan['name'],
'amount' => $amount,
'pay_type' => $payType,
'status' => $isBalance ? 'paid' : 'pending',
'paytime' => $isBalance ? $now : null,
// related_id 存套餐主键:支付回调 /pay/notify 据此复用 grantMembership(),回调可独立完成
'related_id' => (int)$plan['id'],
'createtime' => $now,
'updatetime' => $now,
]);
if ($isBalance) {
$balance = round($balance - $amount, 2);
Db::name('user')->where('id', $user['id'])->update([
'money' => $balance,
'updatetime' => $now,
]);
// 余额支付:立即发放会员(微信支付等待回调发放)
$grant = $this->grantMembership(Db::name('fc_order')->where('id', $orderId)->find());
} else {
$grant = null;
}
$quota = isset($plan['post_quota']) ? max(0, (int)$plan['post_quota']) : 0;
$this->ok([
'orderNo' => $orderNo,
'status' => $isBalance ? 'paid' : 'pending',
// 微信支付:前端拿到 orderNo 后调 /pay/prepay;余额支付无需再支付(order=null)
'order' => $isBalance ? null : [
'orderNo' => $orderNo,
'amount' => $amount,
'payType' => 'wxpay',
'status' => 'pending',
],
'expireAt' => $grant ? $this->iso($grant['expireAt']) : null,
'postQuota' => $quota,
'quotaLeft' => $grant ? $grant['quotaLeft'] : $this->quotaLeft($this->ext($user['id'])),
'quotaExpireAt' => $grant ? $this->iso($grant['expireAt']) : null,
]);
}
/**
* 会员发放(**可复用**:余额支付即时发放 / 微信支付回调 /pay/notify 发放)
* 说明:以 fc_order.related_id(套餐主键)反查 fc_plan 取天数与赠送发布条数;
* 老订单(related_id=0)按订单标题(套餐名)反查,仍失败则按默认 30 天、0 条额度发放;
* 发放同时记「会员开通」资金流水并发站内信。
* @param array $order fc_order 行(需含 user_id / related_id / amount / id / title)
* @return array{expireAt:int,postQuota:int,quotaLeft:int}
*/
public function grantMembership(array $order)
{
$userId = (int)$order['user_id'];
$now = time();
$plan = null;
$planId = (int)(isset($order['related_id']) ? $order['related_id'] : 0);
if ($planId > 0) {
$plan = Db::name('fc_plan')->where('id', $planId)->find();
}
if (!$plan) {
$title = isset($order['title']) ? (string)$order['title'] : '';
if ($title !== '') {
$plan = Db::name('fc_plan')->where('name', $title)->find();
}
}
$days = $plan ? max(0, (int)$plan['days']) : 30;
$quota = $plan && isset($plan['post_quota']) ? max(0, (int)$plan['post_quota']) : 0;
$level = $plan ? (string)$plan['name'] : '会员';
$ext = $this->ext($userId);
$base = (int)$ext['member_expiretime'];
if ($base < $now) {
$base = $now;
}
$expire = $base + $days * 86400;
// 发布套餐额度:月/年卡赠送「含发布条数」,额度随会员有效期(过期后由发布接口自动清零)
$left = (int)(isset($ext['post_quota_left']) ? $ext['post_quota_left'] : 0);
$quotaExpire = (int)(isset($ext['post_quota_expire']) ? $ext['post_quota_expire'] : 0);
if ($quotaExpire > 0 && $quotaExpire < $now) {
$left = 0; // 上一周期额度已过期,不再累计
}
$left += $quota;
Db::name('fc_user_ext')->where('user_id', $userId)->update([
'is_member' => 1,
'member_level' => $level,
'member_expiretime' => $expire,
'post_quota_left' => $left,
'post_quota_expire' => $expire,
'updatetime' => $now,
]);
$amount = round((float)(isset($order['amount']) ? $order['amount'] : 0), 2);
$orderId = (int)(isset($order['id']) ? $order['id'] : 0);
$this->flow('income', '会员开通', $amount, 0, $orderId);
$this->notify(
$userId,
'system',
'会员开通成功',
'您已开通「' . $level . '」,有效期至 ' . date('Y-m-d', $expire) . ',赠送发布条数 ' . $quota . ' 条。'
);
return ['expireAt' => $expire, 'postQuota' => $quota, 'quotaLeft' => $left];
}
/**
* 剩余发布条数(供未开通时回显)
* @param array $ext
* @return int
*/
protected function quotaLeft($ext)
{
$left = (int)(isset($ext['post_quota_left']) ? $ext['post_quota_left'] : 0);
$expire = (int)(isset($ext['post_quota_expire']) ? $ext['post_quota_expire'] : 0);
if ($left > 0 && $expire > 0 && $expire < time()) {
return 0;
}
return $left;
}
/**
* M4 我的订单
* GET /api/v1/member/orders {page,size} → {list,page,size,total,hasMore}
* 规则:按 createtime desc
*/
public function orders()
{
$user = $this->auth();
list($page, $size) = $this->pager();
$total = Db::name('fc_order')->where('user_id', $user['id'])->count();
$rows = Db::name('fc_order')
->where('user_id', $user['id'])
->order('createtime desc')
->page($page, $size)
->select();
$list = [];
foreach ($rows as $row) {
$list[] = [
'id' => (int)$row['id'],
'orderNo' => (string)$row['order_no'],
'type' => (string)$row['type'],
'title' => (string)$row['title'],
'amount' => (float)$row['amount'],
'payType' => (string)$row['pay_type'],
'status' => (string)$row['status'],
'createdAt' => $this->iso($row['createtime']),
];
}
$this->ok($this->paginate($list, $total, $page, $size));
}
/**
* M5 我的资产
* GET /api/v1/member/assets
* → {balance,coupons:[{id,couponId,name,type,amount,minAmount,status,expireAt}],couponCount,points}
* 说明:coupons 来自 fc_user_coupon LEFT JOIN fc_coupon(真实数据);
* status:unused 未使用 / used 已使用 / expired 已过期(有效期为 0 表示永久;
* status=unused 但已过期时**动态判定**为 expired,无需定时任务)。
*/
public function assets()
{
$user = $this->auth();
$now = time();
$rows = Db::name('fc_user_coupon')->alias('uc')
->join('fc_coupon c', 'c.id = uc.coupon_id', 'LEFT')
->where('uc.user_id', $user['id'])
->field('uc.id,uc.coupon_id,uc.status,uc.expiretime,uc.createtime,c.name,c.type,c.amount,c.min_amount')
->order('uc.id desc')
->select();
$coupons = [];
foreach ($rows as $row) {
$status = (string)$row['status'];
$expire = !empty($row['expiretime']) ? (int)$row['expiretime'] : 0;
if ($status === 'unused' && $expire > 0 && $expire < $now) {
$status = 'expired';
}
$coupons[] = [
'id' => (int)$row['id'],
'couponId' => (int)$row['coupon_id'],
'name' => isset($row['name']) ? (string)$row['name'] : '',
'type' => isset($row['type']) ? (string)$row['type'] : '',
'amount' => isset($row['amount']) ? (float)$row['amount'] : 0,
'minAmount' => isset($row['min_amount']) ? (float)$row['min_amount'] : 0,
'status' => $status,
'expireAt' => $expire > 0 ? $this->iso($expire) : null,
];
}
$this->ok([
'balance' => (float)$user['money'],
'coupons' => $coupons,
'couponCount' => count($coupons),
'points' => (int)$user['score'],
]);
}
}