fix(security): 安全闸门与 NODE_ENV 解耦，支付/提现 fail-closed
- 新增 SECURE_MODE（仅 ALLOW_INSECURE_DEV_AUTH=1 时放开）：后台登录口令、上传、内容检测、核销码归属全部改为默认收紧，修复线上以 NODE_ENV=development 运行时闸门失效 - 提现审核：未开通真实转账且未显式 ALLOW_SANDBOX_PAY=1 时一律 503，杜绝只改状态不打款 - 预支付：未开启沙箱时不再下发沙箱参数；小程序删除预支付失败伪造沙箱成功的兜底，改为抛错 - 订阅消息支持 MINIPROGRAM_STATE=formal|trial|developer 显式配置，避免真实用户收不到通知 - 动态列表/点赞身份统一 normalizeUserId；文档补充安全闸门与订阅消息环境变量 - 109 套件/720 用例全绿，tsc 构建通过
这个提交包含在：
xcbyy
@@ -451,7 +451,7 @@ export async function universalVerifyCheckin(code, operatorId) {
|
||||
*/
|
||||
export async function getPosts(category, userId) {
|
||||
try {
|
||||
const uid = userId || uni.getStorageSync('userId') || 1001;
|
||||
const uid = normalizeUserId(userId);
|
||||
let query = `?userId=${uid}`;
|
||||
if (category && category !== 'all') {
|
||||
query += `&category=${encodeURIComponent(category)}`;
|
||||
@@ -519,7 +519,7 @@ export async function createPost(payload) {
|
||||
*/
|
||||
export async function likePost(id, action, userId) {
|
||||
try {
|
||||
const uid = userId || uni.getStorageSync('userId') || 1001;
|
||||
const uid = normalizeUserId(userId);
|
||||
const payload = { userId: uid };
|
||||
if (action) {
|
||||
payload.action = action;
|
||||
@@ -1437,16 +1437,12 @@ export async function requestWechatPayment({ amount, title = '同城陪伴担保
|
||||
userId: uid,
|
||||
wxCode
|
||||
});
|
||||
} catch (_) {
|
||||
prepayData = {
|
||||
mode: 'SANDBOX',
|
||||
timeStamp: String(Math.floor(Date.now() / 1000)),
|
||||
nonceStr: `pw_${Date.now()}`,
|
||||
package: `prepay_id=wx${Date.now()}`,
|
||||
signType: 'RSA',
|
||||
paySign: 'SANDBOX_FALLBACK',
|
||||
outTradeNo: orderId || `WX_${Date.now()}`
|
||||
};
|
||||
} catch (err) {
|
||||
// 预支付失败必须向上抛出：绝不能伪造"沙箱支付成功"，否则用户以为付款成功、订单却未支付。
|
||||
const e = new Error((err && err.message) || '微信支付发起失败，请稍后重试');
|
||||
e.code = err && err.code;
|
||||
e.statusCode = err && err.statusCode;
|
||||
throw e;
|
||||
}
|
||||
|
||||
return new Promise((resolve, reject) => {
|
||||
|
||||
@@ -18,8 +18,12 @@ const BASE_URL = (() => {
|
||||
*/
|
||||
// 登录过期提示仅一次，避免并发请求重复弹窗
|
||||
let authExpiredNotified = false;
|
||||
function handleAuthExpired() {
|
||||
function handleAuthExpired(hadSession = false) {
|
||||
let hadLocalAuth = Boolean(hadSession);
|
||||
try {
|
||||
if (!hadLocalAuth) {
|
||||
hadLocalAuth = Boolean(uni.getStorageSync('userToken') || uni.getStorageSync('userId'));
|
||||
}
|
||||
uni.removeStorageSync('userToken');
|
||||
uni.removeStorageSync('userId');
|
||||
uni.removeStorageSync('userInfo');
|
||||
@@ -27,7 +31,8 @@ function handleAuthExpired() {
|
||||
} catch (_) {
|
||||
// 忽略本地存储清理异常
|
||||
}
|
||||
if (!authExpiredNotified) {
|
||||
// 仅当本地原本存在登录会话却被服务端判定失效时才提示“登录已过期”；未登录游客静默忽略
|
||||
if (hadLocalAuth && !authExpiredNotified) {
|
||||
authExpiredNotified = true;
|
||||
try {
|
||||
uni.showToast({ title: '登录已过期，请重新登录', icon: 'none' });
|
||||
@@ -46,8 +51,10 @@ export function request(options = {}) {
|
||||
|
||||
const method = (options.method || 'GET').toUpperCase();
|
||||
let sessionToken = '';
|
||||
let hadSession = false;
|
||||
try {
|
||||
sessionToken = uni.getStorageSync('userToken') || '';
|
||||
hadSession = Boolean(sessionToken || uni.getStorageSync('userId'));
|
||||
} catch (_) {
|
||||
sessionToken = '';
|
||||
}
|
||||
@@ -69,13 +76,14 @@ export function request(options = {}) {
|
||||
// 适配标准的业务封装 { code: 20000, data: ... }
|
||||
if (res.data && typeof res.data === 'object' && 'code' in res.data) {
|
||||
if (res.data.code === 20000) {
|
||||
if (sessionToken) authExpiredNotified = false;
|
||||
resolve(res.data.data);
|
||||
} else {
|
||||
const bizErr = new Error(res.data.message || '业务请求失败');
|
||||
bizErr.code = res.data.code;
|
||||
bizErr.statusCode = res.statusCode;
|
||||
if (res.data.code === 40100) handleAuthExpired();
|
||||
else if (res.data.code === 40300 && /身份校验失败|无权以他人身份/.test(res.data.message || '')) handleAuthExpired();
|
||||
if (res.data.code === 40100) handleAuthExpired(hadSession);
|
||||
else if (res.data.code === 40300 && /身份校验失败|无权以他人身份/.test(res.data.message || '')) handleAuthExpired(hadSession);
|
||||
reject(bizErr);
|
||||
}
|
||||
} else {
|
||||
@@ -86,8 +94,8 @@ export function request(options = {}) {
|
||||
const httpErr = new Error(errMsg);
|
||||
httpErr.statusCode = res.statusCode;
|
||||
httpErr.code = (res.data && res.data.code) || res.statusCode;
|
||||
if (res.statusCode === 401) handleAuthExpired();
|
||||
else if (res.statusCode === 403 && /身份校验失败|无权以他人身份/.test(errMsg)) handleAuthExpired();
|
||||
if (res.statusCode === 401) handleAuthExpired(hadSession);
|
||||
else if (res.statusCode === 403 && /身份校验失败|无权以他人身份/.test(errMsg)) handleAuthExpired(hadSession);
|
||||
reject(httpErr);
|
||||
}
|
||||
},
|
||||
|
||||
@@ -427,8 +427,10 @@ const syncCurrentUserProfile = async () => {
|
||||
...currentUserProfile.value,
|
||||
...cached
|
||||
};
|
||||
const storedUid = Number(uni.getStorageSync('userId'));
|
||||
if (!storedUid) return currentUserProfile.value;
|
||||
try {
|
||||
const remote = await getUserProfile(cached.id || 1001);
|
||||
const remote = await getUserProfile(storedUid);
|
||||
if (remote && remote.nickname) {
|
||||
const merged = {
|
||||
...cached,
|
||||
|
||||
@@ -368,7 +368,8 @@ import { preloadSubscribeTemplates, requestSubscribeAll } from '@/common/subscri
|
||||
|
||||
const DEFAULT_GUEST_AVATAR = 'https://images.unsplash.com/photo-1535713875002-d1d0cf377fde?w=200';
|
||||
const initialUserId = typeof uni !== 'undefined' ? (uni.getStorageSync('userId') || null) : null;
|
||||
const isLoggedIn = ref(Boolean(initialUserId));
|
||||
const initialLoggedOut = typeof uni !== 'undefined' ? (uni.getStorageSync('user_has_logged_out') === '1') : false;
|
||||
const isLoggedIn = ref(Boolean(initialUserId && !initialLoggedOut));
|
||||
const showLoginModal = ref(false);
|
||||
|
||||
// 我的收藏与我的举报反馈
|
||||
@@ -377,7 +378,12 @@ const loadingFavorites = ref(false);
|
||||
const myReportsList = ref([]);
|
||||
|
||||
const loadMyReports = async () => {
|
||||
const uid = user.value.id || uni.getStorageSync('userId') || 1001;
|
||||
if (!isLoggedIn.value) {
|
||||
myReportsList.value = [];
|
||||
return;
|
||||
}
|
||||
const uid = user.value.id || uni.getStorageSync('userId');
|
||||
if (!uid) return;
|
||||
try {
|
||||
const list = await getMyReports(uid);
|
||||
if (Array.isArray(list)) {
|
||||
@@ -409,7 +415,11 @@ const openCoupons = () => {
|
||||
};
|
||||
|
||||
const loadCouponUsable = async () => {
|
||||
const uid = uni.getStorageSync('userId') || 0;
|
||||
if (!isLoggedIn.value) {
|
||||
couponUsable.value = 0;
|
||||
return;
|
||||
}
|
||||
const uid = user.value.id || uni.getStorageSync('userId') || 0;
|
||||
if (!uid) return;
|
||||
try {
|
||||
const res = await getMyCoupons(uid, 'UNUSED');
|
||||
@@ -663,7 +673,9 @@ onMounted(() => {
|
||||
uni.$on('login-success', onLoginSuccess);
|
||||
loadUserProfile();
|
||||
loadPlatformConfigs();
|
||||
loadMyReports();
|
||||
if (isLoggedIn.value) {
|
||||
loadMyReports();
|
||||
}
|
||||
// 预加载订阅消息模板ID，确保点击授权时无需等待网络（保留点击手势）
|
||||
preloadSubscribeTemplates();
|
||||
});
|
||||
@@ -678,11 +690,16 @@ onShow(() => {
|
||||
loadPlatformConfigs();
|
||||
privacyHidePhone.value = uni.getStorageSync('privacy_hide_phone') === '1';
|
||||
noticeSubscribe.value = uni.getStorageSync('notice_subscribe') === '1';
|
||||
loadNoticeUnread();
|
||||
loadCouponUsable();
|
||||
if (isLoggedIn.value) {
|
||||
loadNoticeUnread();
|
||||
loadCouponUsable();
|
||||
loadFavorites();
|
||||
loadMyReports();
|
||||
} else {
|
||||
noticeUnread.value = 0;
|
||||
couponUsable.value = 0;
|
||||
favoriteList.value = [];
|
||||
myReportsList.value = [];
|
||||
}
|
||||
});
|
||||
|
||||
@@ -1030,9 +1047,15 @@ const openFavoritesModal = () => {
|
||||
};
|
||||
|
||||
const loadFavorites = async () => {
|
||||
if (!isLoggedIn.value) {
|
||||
favoriteList.value = [];
|
||||
return;
|
||||
}
|
||||
const uid = user.value.id || uni.getStorageSync('userId');
|
||||
if (!uid) return;
|
||||
loadingFavorites.value = true;
|
||||
try {
|
||||
const list = await getFavorites(user.value.id || 1001);
|
||||
const list = await getFavorites(uid);
|
||||
favoriteList.value = Array.isArray(list) ? list : [];
|
||||
} catch (_) {
|
||||
favoriteList.value = [];
|
||||
@@ -1261,7 +1284,11 @@ const openNotifications = () => {
|
||||
};
|
||||
|
||||
const loadNoticeUnread = async () => {
|
||||
const uid = uni.getStorageSync('userId') || 0;
|
||||
if (!isLoggedIn.value) {
|
||||
noticeUnread.value = 0;
|
||||
return;
|
||||
}
|
||||
const uid = user.value.id || uni.getStorageSync('userId') || 0;
|
||||
if (!uid) return;
|
||||
try {
|
||||
const res = await getNotifications(uid, 1);
|
||||
|
||||
在新工单中引用
屏蔽一个用户