fix: audit fixes — treatment sync, avatar upload, code consistency

- Always sync treatment end (not just early stop), pass start/end times
- treatment-done uses api.syncTreatment instead of raw http.post
- Move getApp() from module level to onLoad in treatment-done
- Avatar upload only returns URL, no longer updates profile directly
- COS CDN domain configurable via COS_CDN_DOMAIN env var
- Fix operator precedence in request.js token expiry check
- Remove unused result variable from COS putObject

miniprogram/pages/treating/treating.js

@@ -175,14 +175,14 @@ Page({
 
   finishAsComplete: function () {
     var elapsed = Math.min(this.data.duration, Date.now() - this.data.startedAt)
-    if (elapsed < this.data.duration) {
-      this.syncTreatmentEnd(elapsed)
-    }
+    this.syncTreatmentEnd(elapsed)
     this.onComplete({
       session_id: this._sessionId,
       regions: this.data.regions,
       total_duration_ms: elapsed,
       avg_pd: 0,
+      start_time: new Date(this.data.startedAt).toISOString(),
+      end_time: new Date(this.data.startedAt + elapsed).toISOString(),
       source: 'client_timer'
     })
   },

miniprogram/pages/treatment-done/treatment-done.js

@@ -1,6 +1,5 @@
-var http = require('../../utils/request')
+var api = require('../../utils/api')
 var ble = require('../../services/ble')
-var app = getApp()
 
 Page({
   data: {
@@ -21,25 +20,20 @@ Page({
   },
 
   onLoad: function (options) {
+    var app = getApp()
     this.setData({ statusBarHeight: app.globalData.statusBarHeight })
     this._deviceId = options.device_id || (app.globalData.currentDevice && app.globalData.currentDevice.device_id) || ble.getDeviceId() || ''
+    this._treatment = app.globalData.currentTreatment || {}
     var durationMs = parseInt(options.duration) || 0
     var mins = Math.floor(durationMs / 60000)
     var secs = Math.floor((durationMs % 60000) / 1000)
 
-    var durationText = ''
-    if (mins > 0) {
-      durationText = mins + '分钟'
-    } else {
-      durationText = secs + '秒'
-    }
-
     this.setData({
       sessionId: options.session_id || '',
       regions: parseInt(options.regions) || 0,
       duration: durationMs,
       avgPd: options.avg_pd || 0,
-      durationText: durationText,
+      durationText: mins > 0 ? mins + '分钟' : secs + '秒',
       mode: parseInt(options.mode) || 0,
       regionNames: ble.getRegionName(parseInt(options.regions) || 0)
     })
@@ -49,19 +43,19 @@ Page({
 
   syncRecord: function () {
     var self = this
-    var treatment = (app.globalData.currentTreatment) || {}
+    var t = self._treatment
     self.setData({ syncing: true })
 
-    http.post('/api/v1/treatment/sync', {
+    api.syncTreatment({
       session_id: self.data.sessionId,
       device_id: self._deviceId || '',
-      start_time: treatment.start_time || new Date(Date.now() - self.data.duration).toISOString(),
-      end_time: treatment.end_time || new Date().toISOString(),
+      start_time: t.start_time || new Date(Date.now() - self.data.duration).toISOString(),
+      end_time: t.end_time || new Date().toISOString(),
       regions: self.data.regions,
       total_duration_ms: self.data.duration,
       mode: self.data.mode,
       avg_pd: self.data.avgPd,
-      source: treatment.source || 'device'
+      source: t.source || 'device'
     }).then(function () {
       self.setData({ syncing: false, synced: true })
     }).catch(function () {

miniprogram/utils/request.js

@@ -68,7 +68,7 @@ function httpRequest(options) {
         success: function (res) {
           if (res.data && res.data.code === 0) {
             resolve(res.data.data)
-          } else if (res.data && res.data.code === 1001 || res.data && res.data.code === 1002) {
+          } else if (res.data && (res.data.code === 1001 || res.data.code === 1002)) {
             wx.removeStorageSync('token')
             wx.removeStorageSync('token_expiry')
             wx.reLaunch({ url: '/pages/login/login' })

server/src/config.js

@@ -15,7 +15,8 @@ const config = {
     secretId: process.env.TENCENT_SECRET_ID,
     secretKey: process.env.TENCENT_SECRET_KEY,
     bucket: process.env.COS_BUCKET || 'jw-bucket-1426323813',
-    region: process.env.COS_REGION || process.env.TENCENT_REGION || 'ap-guangzhou'
+    region: process.env.COS_REGION || process.env.TENCENT_REGION || 'ap-guangzhou',
+    cdnDomain: process.env.COS_CDN_DOMAIN || 'tx.vsai.net.cn'
   },
   wechat: {
     appid: process.env.WECHAT_APPID,

server/src/routes/user.js

@@ -41,7 +41,7 @@ router.post('/user/avatar', requireUser, upload.single('file'), wrap(async (req,
   const ext = (req.file.originalname || '').split('.').pop() || 'jpg'
   const key = 'avatars/' + req.user.user_id + '_' + Date.now() + '.' + ext
   const cos = new COS({ SecretId: config.cos.secretId, SecretKey: config.cos.secretKey })
-  const result = await new Promise((resolve, reject) => {
+  await new Promise((resolve, reject) => {
     cos.putObject({
       Bucket: config.cos.bucket,
       Region: config.cos.region,
@@ -50,8 +50,7 @@ router.post('/user/avatar', requireUser, upload.single('file'), wrap(async (req,
       ContentType: req.file.mimetype
     }, (err, data) => err ? reject(err) : resolve(data))
   })
-  const avatarUrl = 'https://tx.vsai.net.cn/' + key
-  await userDao.updateProfile(req.user.user_id, { nickname: null, avatar: avatarUrl, gender: null })
+  const avatarUrl = 'https://' + (config.cos.cdnDomain || 'tx.vsai.net.cn') + '/' + key
   res.json(ok({ avatar: avatarUrl }))
 }))