fix: audit fixes for registration flow

- loadProfile() now returns Promise (was missing return)
- Avatar upload via COS instead of storing WeChat temp path
- Add POST /user/avatar endpoint with multer + COS SDK
- Incomplete registration detection: redirect to register if phone is empty

miniprogram/app.js

@@ -26,9 +26,10 @@ App({
 
   loadProfile: function () {
     var self = this
-    http.get('/api/v1/user/profile').then(function (profile) {
+    return http.get('/api/v1/user/profile').then(function (profile) {
       self.globalData.userInfo = profile
       self.globalData.userId = String(profile.user_id)
+      return profile
     }).catch(function () {
       wx.removeStorageSync('token')
     })

miniprogram/pages/login/login.js

@@ -16,7 +16,7 @@ Page({
 
     app.doLogin().then(function (data) {
       self.setData({ loading: false })
-      if (data && data.is_new_user) {
+      if (data && (data.is_new_user || !data.user_info || !data.user_info.phone)) {
         wx.redirectTo({ url: '/pages/register/register' })
       } else {
         wx.switchTab({ url: '/pages/index/index' })

miniprogram/pages/register/register.js

@@ -1,5 +1,6 @@
 var app = getApp()
 var http = require('../../utils/request')
+var config = require('../../config/env')
 
 var DEFAULT_AVATAR = 'https://mmbiz.qpic.cn/mmbiz/icTdbqWNOwNRna42FI9t2NHfLvvMiaiaCJQn3KP2P0vAHp1QBP0piavhGfhKCARlGd6z1EbR58ibJXKCp5WVlNnojwA/640'
 
@@ -65,6 +66,31 @@ Page({
     })
   },
 
+  uploadAvatar: function (tempPath) {
+    return new Promise(function (resolve, reject) {
+      var token = wx.getStorageSync('token')
+      wx.uploadFile({
+        url: config.API_BASE + '/api/v1/user/avatar',
+        filePath: tempPath,
+        name: 'file',
+        header: { Authorization: 'Bearer ' + token },
+        success: function (res) {
+          try {
+            var data = JSON.parse(res.data)
+            if (data.code === 0 && data.data && data.data.avatar) {
+              resolve(data.data.avatar)
+            } else {
+              reject(new Error(data.message || '上传失败'))
+            }
+          } catch (e) {
+            reject(new Error('上传失败'))
+          }
+        },
+        fail: function () { reject(new Error('上传失败')) }
+      })
+    })
+  },
+
   onSubmit: function () {
     var self = this
     var nickname = (self.data.nickname || '').trim()
@@ -82,9 +108,15 @@ Page({
 
     self.setData({ loading: true })
 
-    http.put('/api/v1/user/profile', {
-      nickname: nickname,
-      avatar: avatarUrl !== DEFAULT_AVATAR ? avatarUrl : ''
+    var avatarPromise = (avatarUrl && avatarUrl !== DEFAULT_AVATAR)
+      ? self.uploadAvatar(avatarUrl)
+      : Promise.resolve('')
+
+    avatarPromise.then(function (permanentUrl) {
+      return http.put('/api/v1/user/profile', {
+        nickname: nickname,
+        avatar: permanentUrl || ''
+      })
     }).then(function () {
       return app.loadProfile()
     }).then(function () {