Guoguo
b80e872600
Server: - Block startup with default JWT secrets in production - Make subscription verify admin-only (no payment integration yet) - Add device ownership validation on command/result, event, treatment/sync - Remove admin token from request body fallback - Add pageParams boundary protection (pageSize capped at 100) - Fix COS getObjectUrl to use callback-based Promise - Add settings key whitelist matching frontend fields - Add user existence check before subscription creation - Fix firmware always returning has_update:true - Replace hardcoded trial subscription with actual DB query - Extract shared utilities (limitClause, toMysqlDate, formatDate) Miniprogram: - Replace fake PD random data with placeholder - Mark client-timer treatment completions with source field - Disable mock.js - Fix BLE listener leaks (save refs, cleanup in onUnload) - Fix ble.off clearing all listeners (pass specific callback) - Add BLE disconnect detection via onBLEConnectionStateChange - Fix subscription status type consistency (number not string) - Fix scan callback accumulation in ble.js - Fix history stats accumulation across pages - Fix subscribe-success/treatment-done hardcoded values - Fix profile subscription view logic - Replace purchase flow with admin-contact modal - Add error logging in command-sync report Admin console: - Fix AdminLayout logout (require->import, logout->clearToken) - Remove all mock data from production request.js - Replace dashboard fake data with real API calls - Replace monthly_revenue with subscription_count - Fix subscription stats fallback (|| -> ??) - Add token expiry tracking (7 days) - Unify device status map and subscription status text - Fix user page record link navigation - Fix subscription createForm.user_id type handling - Add error feedback in all empty catch blocks - Remove unused remember checkbox and uview-plus dependency - Extract common CSS to shared stylesheet (-900 lines) - Extract formatDate to shared utils/format.js - Show real admin name in layout header
Hox 腾讯云函数后端
本目录是 Hox 项目的腾讯云后端骨架，目标架构为：腾讯云函数 SCF Node.js + 腾讯云数据库 MySQL + 腾讯云 COS。
配置
本地配置文件为 .env，不会提交到 Git。提交用模板为 .env.example。
当前已按项目默认值预置：
| 配置 | 值 |
|---|---|
| COS Bucket | jw-bucket-1426323813 |
| 地域 | ap-guangzhou |
| 数据库 | jw_beauty |
| 数据库用户 | root |
| 临时后台账号 | admin |
| 临时后台密码 | admin |
你需要补充 .env 中的真实值：
TENCENT_SECRET_IDTENCENT_SECRET_KEYDB_HOSTDB_PASSWORDWECHAT_APPIDWECHAT_SECRETJWT_SECRETADMIN_JWT_SECRET
本地运行
cd server
npm install
npm run db:init
npm start
健康检查：
curl http://localhost:3000/health
SCF 入口
腾讯云函数入口：
index.main_handler
HTTP 触发器或函数 URL 需要透传：
- HTTP method
- path
- headers
- queryStringParameters
- body
已实现接口
小程序接口：
POST /api/v1/auth/loginPOST /api/v1/auth/refreshGET /api/v1/user/profilePUT /api/v1/user/profilePOST /api/v1/user/phonePOST /api/v1/device/bindPOST /api/v1/device/unbindGET /api/v1/device/listGET /api/v1/device/:device_idGET /api/v1/device/command/pendingPOST /api/v1/device/eventGET /api/v1/subscriptionPOST /api/v1/subscription/purchasePOST /api/v1/subscription/verifyGET /api/v1/treatment/historyPOST /api/v1/treatment/syncGET /api/v1/firmware/latest
管理后台接口：
POST /api/v1/admin/loginGET /api/v1/admin/dashboardGET /api/v1/admin/devicesGET /api/v1/admin/devices/:device_idPOST /api/v1/admin/devices/:device_id/commandPOST /api/v1/admin/devices/:device_id/unbindGET /api/v1/admin/usersGET /api/v1/admin/users/:user_idGET /api/v1/admin/subscriptionsPOST /api/v1/admin/subscriptionsGET /api/v1/admin/recordsGET /api/v1/admin/logsGET /api/v1/admin/settingsPOST /api/v1/admin/settingsGET /api/v1/admin/devices/:device_id/commandsGET /api/v1/admin/firmwarePOST /api/v1/admin/firmwarePOST /api/v1/admin/firmware/:firmware_id/status
数据库
表结构在：
sql/schema.sql
初始化脚本会创建表并插入临时管理员账号。
重要说明
- 当前微信支付只保留接口骨架，未接入真实微信支付回调。
/api/v1/device/command/pending已接入device_commands，小程序拉取后执行 BLE 指令并回传结果。/api/v1/firmware/latest会读取firmware_files并生成 COS 签名 URL，后台可通过固件接口登记 COS 对象 key。- 生产环境必须替换
admin/admin和所有默认 secret。