fix: audit fixes — treatment sync, avatar upload, code consistency

- Always sync treatment end (not just early stop), pass start/end times
- treatment-done uses api.syncTreatment instead of raw http.post
- Move getApp() from module level to onLoad in treatment-done
- Avatar upload only returns URL, no longer updates profile directly
- COS CDN domain configurable via COS_CDN_DOMAIN env var
- Fix operator precedence in request.js token expiry check
- Remove unused result variable from COS putObject

miniprogram/pages/treating/treating.js

@@ -175,14 +175,14 @@ Page({
 
   finishAsComplete: function () {
     var elapsed = Math.min(this.data.duration, Date.now() - this.data.startedAt)
-    if (elapsed < this.data.duration) {
-      this.syncTreatmentEnd(elapsed)
-    }
+    this.syncTreatmentEnd(elapsed)
     this.onComplete({
       session_id: this._sessionId,
       regions: this.data.regions,
       total_duration_ms: elapsed,
       avg_pd: 0,
+      start_time: new Date(this.data.startedAt).toISOString(),
+      end_time: new Date(this.data.startedAt + elapsed).toISOString(),
       source: 'client_timer'
     })
   },

miniprogram/pages/treatment-done/treatment-done.js

@@ -1,6 +1,5 @@
-var http = require('../../utils/request')
+var api = require('../../utils/api')
 var ble = require('../../services/ble')
-var app = getApp()
 
 Page({
   data: {
@@ -21,25 +20,20 @@ Page({
   },
 
   onLoad: function (options) {
+    var app = getApp()
     this.setData({ statusBarHeight: app.globalData.statusBarHeight })
     this._deviceId = options.device_id || (app.globalData.currentDevice && app.globalData.currentDevice.device_id) || ble.getDeviceId() || ''
+    this._treatment = app.globalData.currentTreatment || {}
     var durationMs = parseInt(options.duration) || 0
     var mins = Math.floor(durationMs / 60000)
     var secs = Math.floor((durationMs % 60000) / 1000)
 
-    var durationText = ''
-    if (mins > 0) {
-      durationText = mins + '分钟'
-    } else {
-      durationText = secs + '秒'
-    }
-
     this.setData({
       sessionId: options.session_id || '',
       regions: parseInt(options.regions) || 0,
       duration: durationMs,
       avgPd: options.avg_pd || 0,
-      durationText: durationText,
+      durationText: mins > 0 ? mins + '分钟' : secs + '秒',
       mode: parseInt(options.mode) || 0,
       regionNames: ble.getRegionName(parseInt(options.regions) || 0)
     })
@@ -49,19 +43,19 @@ Page({
 
   syncRecord: function () {
     var self = this
-    var treatment = (app.globalData.currentTreatment) || {}
+    var t = self._treatment
     self.setData({ syncing: true })
 
-    http.post('/api/v1/treatment/sync', {
+    api.syncTreatment({
       session_id: self.data.sessionId,
       device_id: self._deviceId || '',
-      start_time: treatment.start_time || new Date(Date.now() - self.data.duration).toISOString(),
-      end_time: treatment.end_time || new Date().toISOString(),
+      start_time: t.start_time || new Date(Date.now() - self.data.duration).toISOString(),
+      end_time: t.end_time || new Date().toISOString(),
       regions: self.data.regions,
       total_duration_ms: self.data.duration,
       mode: self.data.mode,
       avg_pd: self.data.avgPd,
-      source: treatment.source || 'device'
+      source: t.source || 'device'
     }).then(function () {
       self.setData({ syncing: false, synced: true })
     }).catch(function () {

miniprogram/utils/request.js

@@ -68,7 +68,7 @@ function httpRequest(options) {
         success: function (res) {
           if (res.data && res.data.code === 0) {
             resolve(res.data.data)
-          } else if (res.data && res.data.code === 1001 || res.data && res.data.code === 1002) {
+          } else if (res.data && (res.data.code === 1001 || res.data.code === 1002)) {
             wx.removeStorageSync('token')
             wx.removeStorageSync('token_expiry')
             wx.reLaunch({ url: '/pages/login/login' })