wear-check:
- Send weak pulse light (brightness=26) to trigger FFE4 fitting report
- Timeout degrades to pass (backward compat with 17-byte firmware)
- Sync _resolved flag prevents double-resolve
treating:
- Only treat run_state=0x00 as completion after seeing run_state=0x02
(prevents false completion on startup)
- Sync _finishing flag replaces async data.completed for race prevention
- onStatus preserves paused state during fitting loss (|| fittingLost)
- Remove dead _fittingTimer reference from onUnload
auto-scan:
- Sync _completed flag in _scanComplete prevents double-build
- Listen for 'fitting' event: detect skin detachment, pause on loss,
resume on re-attach
- Listen for 'run_state' event: detect device fault (0xFF) and IDLE
completion (0x00)
- Low battery warnings: toast at <=10%, force stop at <=5%
- Guard finishAsComplete against double-completion
- Proper cleanup of all new event listeners on unload
Firmware does R→UV→Y→IR sequential scan autonomously. Miniprogram
now listens for 4 consecutive ADC notifications, storing each as a
separate spectrum group. Also listens for run_state=IDLE as scan
completion signal. Displays all 4 spectrum groups with PD1-PD7 bars.
Stores full scan data in globalData.lastScanData for diagnosis phase.
Listen for 'fitting' event from FFE4 Byte17 (0=not fitted, 1=fitted).
10s timeout if no fitting signal received. Removes vendor_33 bypass
that always returned ok.
- parseVendorStatus: add checksum_ok verification for 34-byte and 33-byte params
- command-sync.js: passthrough control, current_gain, hold_time from server payload
- Mark buildVendorCommand33 as deprecated alias
Per 协议简述(3): FFE4 now 19 bytes — adds Byte17 fitting status
(0=not fitted, 1=fitted) and Byte18 run state (0=IDLE, 1=scanning,
2=treating, FF=fault). Maintains backward compat with 17-byte format.
- Extract _cleanup() to properly unregister ADC listener + clear timers
- ADC callback unregisters itself on first receive (prevent duplicates)
- setParams failure now stops scanning and clears all state
- Timeout handler unregisters ADC listener
- Add BLE connection check before scan
- SCAN_TIMEOUT 8s → 12s (must exceed hold_time 10s)
- Pre-compute barWidth in JS instead of float math in WXML
- Error only shows when scanning is false
- Send scan command: all 5 regions LED on, brightness 128
- Listen for ADC notify (17 bytes) instead of broken queryStatus
- Parse and display PD1-PD7 values with visual bars
- Show VBAT/battery info
- Store scan PD data in globalData for Phase 3 smart adjustment
- 8s timeout fallback, stop LED on page unload
Region name mapping corrected to match actual hardware IO positions:
- 0x01: 左区→右区, 0x02: 右区→左区
- 0x08: 下区→中区, 0x10: 中区→下区
Auto-scan no longer shows timeout error, proceeds to next step instead.
Fixes timeout during binding when targetDeviceId is set but exact
string match fails due to encoding differences. Also skips devices
with no name, and logs match result for every candidate.
- parseDeviceId accepts hex with spaces (e.g. "672B6D5A 4DCD861")
- BLE scan does exact match on "JW_<device_id>" when target is known
- Manual input placeholder updated to show new format
Replace '光子美容仪' with '智美'/'智能面膜'/'我的设备' throughout.
Replace '护理' with '使用' in all UI text.
Replace '皮肤' with '检测'/'智能' where applicable.
Replace 🌸 with 💎 for brand identity.
Internal code (variable names, API paths, file names) unchanged.
- New grantTrialIfEligible() in subscription.dao.js with SELECT FOR UPDATE
to prevent concurrent bind race condition granting double trials
- confirmBind + mockBind now call the shared function (was duplicated)
- Trial days no longer hardcoded to 7 in binding — respects settings
confirmBind and mockBind now check trial history before granting trial.
Previously only checked for active subscriptions — if trial expired,
rebinding would create a new 7-day trial, allowing infinite free usage.
Now checks if user ever had a trial (any status), skips if so.
- ADC (17-byte) now emits 'adc' + 'battery' events, not 'status'
- Fixes CRITICAL timer jump: remaining_ms:0 was resetting countdown
- Drop ADC packets with bad XOR checksum
- treating.js + index.js subscribe to 'battery' for live battery updates
- onStatus only updates remaining_ms when > 0
Protocol update adds FFE4 Status format: 7×PD sensors (little-endian)
+ VBAT battery voltage (mV) + XOR checksum = 17 bytes.
- parseVendorStatus: handles 1-byte heartbeat, 17-byte ADC, 33-byte params
- handleValueChange: ADC type extracts PD array + battery % from VBAT
- Battery calculated as linear 3000mV(0%) to 4200mV(100%)
- PD data passed through status event for treatment pages
- Updated protocol doc with full byte table and old/new comparison
- 01-快速开始: local setup for all 3 modules, common issues
- 02-配置说明: all env vars, WeChat/Pay/DB/COS config details
- 03-架构说明: system overview, directory structure, data flows
- 04-部署指南: Tencent Cloud SCF/COS deployment, launch checklist
- 05-API接口文档: all 42 endpoints with params and response format
- README index with audience guide and quick links
- Loading animation only shows on first visit, subsequent onShow updates silently
- Subscription row always navigates to plans page (was no-op when active)
- Move devMode init to onLoad (only needs to run once)
- Device card: top row with icon+name+badge, reconnect button below
- Action buttons wrapped in flex column with 20rpx gap
- Removed inline device-battery, now part of device-meta row
- httpsRequest: 15s timeout, prevents hanging on WeChat API outage
- fetchPlatformCertificates: keeps old certs if refresh fails,
only throws if no certs at all (first time failure)
- Replace literal '\n' with real newlines when reading private key from env
- Add PEM header validation to catch format errors early
- File-based key (privateKeyPath) unaffected
- closeStaleOrders: marks payment orders older than 24h as 'closed'
- closeExpiredPending: marks expired binding requests (bind_status=3) as cancelled
- Both run on app startup (SCF cold start), no cron needed
- countPendingByUser already filters to 2h window (previous commit)
CRITICAL fixes:
- C1: Notify amount validation now unconditional (was skippable if amount field missing)
- C2: Sync endpoint validates payer_total against order amount before activation
- C3: Order ID uses crypto.randomBytes(6) instead of Math.random (collision-safe)
HIGH fixes:
- H1: Payment endpoints rate limited to 5/min per IP
- H2: Max 5 pending orders per user, reject new ones until completed/cancelled
- H3: Purchase endpoint returns error (not mock) when wxpay unconfigured in production
Also fixed:
- Notify handler asserts Buffer body, rejects non-Buffer (L3)
- Notify error response is generic, no internal message leak (M1)
- Private key cached in memory after first read (L2)
- Fixed duplicate paymentOrderDao const declaration
1. Move notify route before authMiddleware (WeChat callback has no JWT)
2. Add await to verifyNotifySignature call (was fire-and-forget)
3. Remove dangerous verify fallback — all signature failures now throw
4. Payment sync polls 3x before giving up, never redirects to success
page unless confirmed paid
5. Production guard enforces all WX_MCH_* env vars on startup
Server:
- New lib/wxpay.js: native crypto RSA-SHA256 signing, JSAPI prepay,
AES-256-GCM notify decryption, order query (no npm deps)
- New dao/payment-order.dao.js: createOrder, markPrepay,
markPaidAndActivateSubscription (idempotent + transactional)
- New routes/payment.js: GET order status, POST order sync
- New routes/payment-notify.js: WeChat async callback handler with
signature verification, amount/appid/mchid validation
- Modified subscription/purchase: auto-detects wxpay config, returns
real payment_params or mock fallback
- Schema: payment_orders table with out_trade_no unique key
- app.js: express.raw() for notify path, payment routes mounted
- config.js: wxpay block with 7 env vars
- .env.example: all WeChat Pay fields documented
- .gitignore: certs/, *.pem, *.p12
Miniprogram:
- subscribe-plans doPurchase: calls real purchase API, falls back to
mockPurchase only when server returns mock:true
- Added syncAndRedirect for post-payment order confirmation
- api.js: getPaymentOrder, syncPaymentOrder
- Removed "模拟支付"/"测试环境" from UI text
Miniprogram:
- Add BLE reconnect button on home page when disconnected
- Add loading states to index, profile, subscribe-plans pages
- Add profile editing (avatar + nickname) with COS upload
- Enable pull-to-refresh on history page
- Fix auto-scan self.options → self.data inconsistency
- Add console.error to silent catch blocks
- Gate 'Simple Peripheral' BLE scan behind __DEV__ flag
- Add production config comment to env.js
Admin console:
- Add empty state '暂无数据' to all 5 list views
- Replace plain text plan input with select dropdown
- Add type="date" to record date filters
- Add production config comment
Server:
- CORS origin restricted in production (env CORS_ORIGIN)
- DB pool size configurable via DB_POOL_SIZE env var
- .env.example updated with WeChat Pay + production fields
- Retry button disconnects then re-scans for device (no page navigation)
- Prevents duplicate scan with checking guard
- Disconnect before scan with 500ms delay for adapter recovery
- Clears reconnect timer on success/error/unload
- Error text updated to guide user to retry button
Guoguo