fix: comprehensive security, quality and consistency fixes
Server: - Block startup with default JWT secrets in production - Make subscription verify admin-only (no payment integration yet) - Add device ownership validation on command/result, event, treatment/sync - Remove admin token from request body fallback - Add pageParams boundary protection (pageSize capped at 100) - Fix COS getObjectUrl to use callback-based Promise - Add settings key whitelist matching frontend fields - Add user existence check before subscription creation - Fix firmware always returning has_update:true - Replace hardcoded trial subscription with actual DB query - Extract shared utilities (limitClause, toMysqlDate, formatDate) Miniprogram: - Replace fake PD random data with placeholder - Mark client-timer treatment completions with source field - Disable mock.js - Fix BLE listener leaks (save refs, cleanup in onUnload) - Fix ble.off clearing all listeners (pass specific callback) - Add BLE disconnect detection via onBLEConnectionStateChange - Fix subscription status type consistency (number not string) - Fix scan callback accumulation in ble.js - Fix history stats accumulation across pages - Fix subscribe-success/treatment-done hardcoded values - Fix profile subscription view logic - Replace purchase flow with admin-contact modal - Add error logging in command-sync report Admin console: - Fix AdminLayout logout (require->import, logout->clearToken) - Remove all mock data from production request.js - Replace dashboard fake data with real API calls - Replace monthly_revenue with subscription_count - Fix subscription stats fallback (|| -> ??) - Add token expiry tracking (7 days) - Unify device status map and subscription status text - Fix user page record link navigation - Fix subscription createForm.user_id type handling - Add error feedback in all empty catch blocks - Remove unused remember checkbox and uview-plus dependency - Extract common CSS to shared stylesheet (-900 lines) - Extract formatDate to shared utils/format.js - Show real admin name in layout header
这个提交包含在：
Guoguo
+33
-34
@@ -1,23 +1,14 @@
|
||||
const { one, query } = require('../lib/db')
|
||||
const { one, query, limitClause } = require('../lib/db')
|
||||
const { ok, fail } = require('../lib/response')
|
||||
const { hashPassword, signAdmin, requireAdmin } = require('../lib/auth')
|
||||
const { writeLog } = require('../lib/log')
|
||||
|
||||
function pageParams(ctx) {
|
||||
const page = Math.max(1, parseInt(ctx.query.page || ctx.body.page, 10) || 1)
|
||||
const pageSize = Math.min(Math.max(1, parseInt(ctx.query.page_size || ctx.body.page_size, 10) || 20), 100)
|
||||
const page = Math.max(1, parseInt(ctx.query.page, 10) || 1)
|
||||
const pageSize = Math.min(Math.max(1, parseInt(ctx.query.page_size, 10) || 20), 100)
|
||||
return { page, pageSize, offset: (page - 1) * pageSize }
|
||||
}
|
||||
|
||||
function limitClause(p) {
|
||||
return ' LIMIT ' + Number(p.pageSize) + ' OFFSET ' + Number(p.offset)
|
||||
}
|
||||
|
||||
async function adminOnly(ctx) {
|
||||
const admin = await requireAdmin(ctx)
|
||||
return admin
|
||||
}
|
||||
|
||||
function register(router) {
|
||||
router.post('/api/v1/admin/login', async ctx => {
|
||||
const username = ctx.body.username || ''
|
||||
@@ -30,7 +21,7 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/dashboard', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const rows = await Promise.all([
|
||||
query('SELECT COUNT(*) AS total FROM devices', {}),
|
||||
@@ -42,16 +33,16 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/devices', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const p = pageParams(ctx)
|
||||
const total = await query('SELECT COUNT(*) AS total FROM devices', {})
|
||||
const records = await query('SELECT d.*, b.user_id AS bound_user, b.bind_time AS activated_at FROM devices d LEFT JOIN bindings b ON b.device_id = d.device_id AND b.bind_status = 1 ORDER BY d.created_at DESC' + limitClause(p), {})
|
||||
const records = await query('SELECT d.*, b.user_id AS bound_user, b.bind_time AS activated_at FROM devices d LEFT JOIN bindings b ON b.device_id = d.device_id AND b.bind_status = 1 ORDER BY d.created_at DESC' + limitClause(p.pageSize, p.offset), {})
|
||||
return ok({ records, total: total[0].total })
|
||||
})
|
||||
|
||||
router.post('/api/v1/admin/devices', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const deviceId = String(ctx.body.device_id || '').trim()
|
||||
if (!deviceId) return fail(2001, 'device_id required')
|
||||
@@ -70,7 +61,7 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/devices/:device_id', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const device = await one('SELECT d.*, b.user_id AS bound_user, b.bind_time AS activated_at FROM devices d LEFT JOIN bindings b ON b.device_id = d.device_id AND b.bind_status = 1 WHERE d.device_id = :device_id', { device_id: ctx.params.device_id })
|
||||
if (!device) return fail(1005, 'DEVICE_NOT_FOUND')
|
||||
@@ -78,7 +69,7 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.post('/api/v1/admin/devices/:device_id/unbind', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
await query('UPDATE bindings SET bind_status = 2, unbind_time = NOW() WHERE device_id = :device_id AND bind_status = 1', { device_id: ctx.params.device_id })
|
||||
await writeLog({ admin_id: admin.admin_id, action: 'admin_device_unbind', detail: '后台解绑设备: ' + ctx.params.device_id, ip: ctx.ip })
|
||||
@@ -86,7 +77,7 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.post('/api/v1/admin/devices/:device_id/command', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const opcode = parseInt(ctx.body.opcode, 10)
|
||||
if (!opcode) return fail(2001, 'opcode required')
|
||||
@@ -99,28 +90,28 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/devices/:device_id/commands', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const p = pageParams(ctx)
|
||||
const total = await query('SELECT COUNT(*) AS total FROM device_commands WHERE device_id = :device_id', { device_id: ctx.params.device_id })
|
||||
const records = await query(
|
||||
'SELECT command_id, device_id, admin_id, opcode, payload_json, status, created_at, pulled_at, finished_at, result_json FROM device_commands WHERE device_id = :device_id ORDER BY created_at DESC' + limitClause(p),
|
||||
'SELECT command_id, device_id, admin_id, opcode, payload_json, status, created_at, pulled_at, finished_at, result_json FROM device_commands WHERE device_id = :device_id ORDER BY created_at DESC' + limitClause(p.pageSize, p.offset),
|
||||
{ device_id: ctx.params.device_id }
|
||||
)
|
||||
return ok({ records, total: total[0].total })
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/users', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const p = pageParams(ctx)
|
||||
const total = await query('SELECT COUNT(*) AS total FROM users', {})
|
||||
const records = await query('SELECT * FROM users ORDER BY created_at DESC' + limitClause(p), {})
|
||||
const records = await query('SELECT * FROM users ORDER BY created_at DESC' + limitClause(p.pageSize, p.offset), {})
|
||||
return ok({ records, total: total[0].total })
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/users/:user_id', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const user = await one('SELECT * FROM users WHERE user_id = :user_id', { user_id: ctx.params.user_id })
|
||||
if (!user) return fail(1004, 'USER_NOT_FOUND')
|
||||
@@ -130,17 +121,19 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/subscriptions', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const p = pageParams(ctx)
|
||||
const total = await query('SELECT COUNT(*) AS total FROM subscriptions', {})
|
||||
const records = await query('SELECT * FROM subscriptions ORDER BY created_at DESC' + limitClause(p), {})
|
||||
const records = await query('SELECT * FROM subscriptions ORDER BY created_at DESC' + limitClause(p.pageSize, p.offset), {})
|
||||
return ok({ records, total: total[0].total })
|
||||
})
|
||||
|
||||
router.post('/api/v1/admin/subscriptions', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const targetUser = await one('SELECT user_id FROM users WHERE user_id = :user_id', { user_id: ctx.body.user_id })
|
||||
if (!targetUser) return fail(1004, 'user_not_found')
|
||||
await query('INSERT INTO subscriptions (user_id, plan, status, amount, order_id, start_time, expire_time) VALUES (:user_id, :plan, 1, :amount, :order_id, NOW(), DATE_ADD(NOW(), INTERVAL :days DAY))', {
|
||||
user_id: ctx.body.user_id,
|
||||
plan: ctx.body.plan || 'monthly',
|
||||
@@ -152,38 +145,44 @@ function register(router) {
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/records', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const p = pageParams(ctx)
|
||||
const total = await query('SELECT COUNT(*) AS total FROM treatment_records', {})
|
||||
const records = await query('SELECT * FROM treatment_records ORDER BY created_at DESC' + limitClause(p), {})
|
||||
const records = await query('SELECT * FROM treatment_records ORDER BY created_at DESC' + limitClause(p.pageSize, p.offset), {})
|
||||
return ok({ records, total: total[0].total })
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/logs', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const p = pageParams(ctx)
|
||||
const total = await query('SELECT COUNT(*) AS total FROM operation_logs', {})
|
||||
const records = await query('SELECT * FROM operation_logs ORDER BY created_at DESC' + limitClause(p), {})
|
||||
const records = await query('SELECT * FROM operation_logs ORDER BY created_at DESC' + limitClause(p.pageSize, p.offset), {})
|
||||
return ok({ records, total: total[0].total })
|
||||
})
|
||||
|
||||
router.get('/api/v1/admin/settings', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const rows = await query('SELECT setting_key, setting_value FROM system_settings', {})
|
||||
const settings = {}
|
||||
rows.forEach(row => {
|
||||
settings[row.setting_key] = typeof row.setting_value === 'string' ? JSON.parse(row.setting_value) : row.setting_value
|
||||
if (typeof row.setting_value === 'string') {
|
||||
try { settings[row.setting_key] = JSON.parse(row.setting_value) } catch (_) { settings[row.setting_key] = row.setting_value }
|
||||
} else {
|
||||
settings[row.setting_key] = row.setting_value
|
||||
}
|
||||
})
|
||||
return ok(settings)
|
||||
})
|
||||
|
||||
router.post('/api/v1/admin/settings', async ctx => {
|
||||
const admin = await adminOnly(ctx)
|
||||
const admin = await requireAdmin(ctx)
|
||||
if (!admin) return fail(1002, '未授权，请重新登录')
|
||||
const ALLOWED_KEYS = ['system_name', 'admin_email', 'timezone', 'monthly_price', 'yearly_price', 'trial_days', 'enable_register', 'enable_binding', 'enable_free_mode', 'enable_smart_mode', 'maintenance_mode']
|
||||
for (const key of Object.keys(ctx.body || {})) {
|
||||
if (!ALLOWED_KEYS.includes(key)) continue
|
||||
await query('REPLACE INTO system_settings (setting_key, setting_value) VALUES (:setting_key, :setting_value)', { setting_key: key, setting_value: JSON.stringify(ctx.body[key]) })
|
||||
}
|
||||
return ok({ message: 'success' })
|
||||
|
||||
在新工单中引用
屏蔽一个用户