7 次代码提交

包含重命名

作者	SHA1	备注	提交日期
Guoguo	0c65ef95f8	fix: cross-audit fixes — file validation, type safety, dedup ... - Avatar upload: whitelist image MIME types and extensions (jpg/png/gif/webp) - Normalize device_id to String for strict comparison in treatment sync - Add ORDER BY expire_time DESC to purchase/adminCreate subscription queries - Deduplicate readBearer: middleware imports from lib/auth.js - Parameterize createTrial INTERVAL instead of string concatenation - Add rate limiting (20/15min) to avatar upload and phone auth endpoints	2026-05-11 06:22:24 -07:00
Guoguo	c95d47e0c1	fix: audit fixes — treatment sync, avatar upload, code consistency ... - Always sync treatment end (not just early stop), pass start/end times - treatment-done uses api.syncTreatment instead of raw http.post - Move getApp() from module level to onLoad in treatment-done - Avatar upload only returns URL, no longer updates profile directly - COS CDN domain configurable via COS_CDN_DOMAIN env var - Fix operator precedence in request.js token expiry check - Remove unused result variable from COS putObject	2026-05-07 06:36:28 -07:00
Guoguo	06b6ee6b02	fix: avatar picker uses chooseMedia, COS domain to tx.vsai.net.cn ... - Replace chooseAvatar button with chooseMedia (more reliable, works on all versions) - COS avatar URL uses tx.vsai.net.cn instead of generated bucket domain - Phone shows '已授权' only (no actual number displayed)	2026-05-07 06:23:42 -07:00
Guoguo	52456d850e	fix: audit fixes for registration flow ... - loadProfile() now returns Promise (was missing return) - Avatar upload via COS instead of storing WeChat temp path - Add POST /user/avatar endpoint with multer + COS SDK - Incomplete registration detection: redirect to register if phone is empty	2026-05-06 06:18:21 -07:00
Guoguo	bb4b80f867	refactor: restructure entire project for human maintainability ... Server: - Add Express framework, replace custom router/request parser - Create DAO layer (12 files) centralizing all 73 SQL queries - Rewrite 7 route files as thin Express controllers calling DAOs - Add SCF-to-Express adapter (lib/serverless.js) - Add auth middleware (middleware/auth.js) - Remove dead code from lib/auth.js Admin console: - Extract DataTable component (table + pagination) - Extract ConfirmModal component (modal + form styles) - Create listMixin for paginated list pages - Move form styles to common.css for slot compatibility - Refactor device + subscription pages as examples Miniprogram: - Split 734-line BLE monolith into 4 focused modules (protocol, connection, commands, barrel index) - Create API module (utils/api.js) with named functions - Create page utilities (utils/page.js) - Refactor index + profile pages to use API module	2026-04-29 05:58:20 -07:00
Guoguo	a1b189483f	fix: use WeChat profile authorization login	2026-04-28 23:00:13 +08:00
Guoguo	444c91c0b0	refactor: migrate to Tencent Cloud backend	2026-04-28 22:56:47 +08:00