xcbyy
|
40e601e345
|
fix(security): 鉴权签名密钥 fail-closed，禁用仓库内置默认密钥
- ADMIN_TOKEN_SECRET 的随机化闸门由 NODE_ENV 改为 SECURE_MODE：线上以 development 运行时不再使用公开默认密钥（该密钥可伪造管理员/用户 token）
- 运行模式与安全开关常量前移到模块顶部，避免鉴权常量初始化顺序问题
- 启动自检与回归用例同步（109 套件/720 用例全绿）
|
2026-10-21 12:14:16 +08:00 |
|
xcbyy
|
dd836b674e
|
fix(security): 安全闸门与 NODE_ENV 解耦，支付/提现 fail-closed
- 新增 SECURE_MODE（仅 ALLOW_INSECURE_DEV_AUTH=1 时放开）：后台登录口令、上传、内容检测、核销码归属全部改为默认收紧，修复线上以 NODE_ENV=development 运行时闸门失效
- 提现审核：未开通真实转账且未显式 ALLOW_SANDBOX_PAY=1 时一律 503，杜绝只改状态不打款
- 预支付：未开启沙箱时不再下发沙箱参数；小程序删除预支付失败伪造沙箱成功的兜底，改为抛错
- 订阅消息支持 MINIPROGRAM_STATE=formal|trial|developer 显式配置，避免真实用户收不到通知
- 动态列表/点赞身份统一 normalizeUserId；文档补充安全闸门与订阅消息环境变量
- 109 套件/720 用例全绿，tsc 构建通过
|
2026-10-21 11:50:11 +08:00 |
|
xcbyy
|
ae62f2b805
|
feat(voice): 入驻页录音 + 后台审核真实试听
- 入驻申请页新增「语音自我介绍（可选，≤60s）」录音/试听，申请成功拿到大神档案 id 后自动上传，失败不影响入驻结果
- 管理端审核「真人语音包核听」由 3 秒假播放改为按 voiceIntroUrl 真实播放，未上传显示灰色标记
- 清理小程序审核敏感词（语音房/连麦/开麦），入驻页身份改用 normalizeUserId 与 token 保持一致
- 新增 voice-intro-consistency.spec.ts（107 套件/709 用例全绿）
|
2026-10-21 11:12:42 +08:00 |
|
xcbyy
|
ee4fe9d7c4
|
chore(clean): 清理残留连麦与私信文案(设计文档/动态规则/大厅需求/mock)
|
2026-10-20 15:55:20 +08:00 |
|
xcbyy
|
2599dce315
|
feat(security): 三端闭环加固 + 微信提现打款/订阅消息落地
后端: 身份与归属鉴权收口; 资金安全(结算闸门/支付防篡改/报名费真实扣款/赠金/结算唯一入账/提现打款); 数据泄露与隐私; 登录与密钥安全(默认密钥闸门/登录限流); 可观测性; 启动自检.
微信: 商家转账到零钱提现打款闭环(含回调/查单/失败退回佣金); 订阅消息真实下发闭环与后台模板字段对齐.
后台: 财务/微信支付配置读取失败锁定; 看板/待办/走势去假数据; 打款与测试推送文案修正.
小程序: 请求层错误透传与登录过期提示; 多页失败反馈与乐观回滚; 帮助中心FAQ页面化.
测试: 新增 40+ 回归护栏与真实 MySQL 冒烟(75 套件/599 用例全绿).
|
2026-10-17 18:00:09 +08:00 |
|
xcbyy
|
78117bb4e1
|
feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop
|
2026-10-16 17:38:17 +08:00 |
|
xcbyy
|
51c19d6063
|
feat(closed-loop): complete end-to-end closed loops across miniapp, backend, and admin
|
2026-10-14 10:13:50 +08:00 |
|
xcbyy
|
f8e81d2df4
|
fix(mp-weixin): 全量修复22个页面及组件因增量编译scoped哈希不一致导致的样式失效问题
|
2026-10-14 09:21:03 +08:00 |
|
xcbyy
|
56e672219e
|
fix(modal): resolve premature modal closing caused by unsupported click.self in wechat miniprogram
|
2026-10-13 16:54:55 +08:00 |
|
xcbyy
|
d08acc052a
|
feat(community): combine marquee scroll with detail modal for pinned notice
|
2026-10-13 16:35:35 +08:00 |
|
xcbyy
|
1853e653fb
|
fix(core): comprehensive fix for state loss across activity, ticket, workspace, favorites and community
|
2026-10-13 16:01:19 +08:00 |
|
xcbyy
|
497fb65359
|
fix(community): persist post liked status in MySQL and local storage to prevent state loss on page switch
|
2026-10-13 15:46:04 +08:00 |
|
xcbyy
|
3d895a1a0a
|
fix(community): add missing heart and heartFilled icons to restore like button rendering
|
2026-10-13 15:37:07 +08:00 |
|
xcbyy
|
e867488d0d
|
feat(expert): full closure of expert revenue trends, multichannel withdrawals, service manage, review reply and post manage
|
2026-10-13 09:13:06 +08:00 |
|
xcbyy
|
314bcece55
|
fix(tabbar): import AppTabBar explicitly and use AppTabBar in templates for reliable rendering
|
2026-10-10 16:37:24 +08:00 |
|
xcbyy
|
ac20bf1c5f
|
fix(uniapp): resolve css syntax error in create order and rename custom-tab-bar to app-tab-bar
|
2026-10-10 16:34:12 +08:00 |
|
xcbyy
|
e18f81b82b
|
fix(community): optimize notice bar text color and contrast in warm and cool themes
|
2026-10-10 10:21:48 +08:00 |
|
xcbyy
|
8845fbe7cb
|
feat(community,faq): support dynamic community topics, notice, and FAQ center
|
2026-10-10 10:04:49 +08:00 |
|
xcbyy
|
c6049f64d9
|
feat(compliance): 完善微信内容安全检测、用户隐私保护指引弹窗与主包分包加载架构
|
2026-10-09 19:09:40 +08:00 |
|
xcbyy
|
d0f4050cdc
|
feat: 完善对象存储上传与真实条码二维码引擎，彻底剥离保底Mock数据
|
2026-10-09 17:18:14 +08:00 |
|