Guoguo
b80e872600
Server: - Block startup with default JWT secrets in production - Make subscription verify admin-only (no payment integration yet) - Add device ownership validation on command/result, event, treatment/sync - Remove admin token from request body fallback - Add pageParams boundary protection (pageSize capped at 100) - Fix COS getObjectUrl to use callback-based Promise - Add settings key whitelist matching frontend fields - Add user existence check before subscription creation - Fix firmware always returning has_update:true - Replace hardcoded trial subscription with actual DB query - Extract shared utilities (limitClause, toMysqlDate, formatDate) Miniprogram: - Replace fake PD random data with placeholder - Mark client-timer treatment completions with source field - Disable mock.js - Fix BLE listener leaks (save refs, cleanup in onUnload) - Fix ble.off clearing all listeners (pass specific callback) - Add BLE disconnect detection via onBLEConnectionStateChange - Fix subscription status type consistency (number not string) - Fix scan callback accumulation in ble.js - Fix history stats accumulation across pages - Fix subscribe-success/treatment-done hardcoded values - Fix profile subscription view logic - Replace purchase flow with admin-contact modal - Add error logging in command-sync report Admin console: - Fix AdminLayout logout (require->import, logout->clearToken) - Remove all mock data from production request.js - Replace dashboard fake data with real API calls - Replace monthly_revenue with subscription_count - Fix subscription stats fallback (|| -> ??) - Add token expiry tracking (7 days) - Unify device status map and subscription status text - Fix user page record link navigation - Fix subscription createForm.user_id type handling - Add error feedback in all empty catch blocks - Remove unused remember checkbox and uview-plus dependency - Extract common CSS to shared stylesheet (-900 lines) - Extract formatDate to shared utils/format.js - Show real admin name in layout header
65 行
3.0 KiB
JavaScript
65 行
3.0 KiB
JavaScript
const { one, query } = require('../lib/db')
|
|
const { ok, fail } = require('../lib/response')
|
|
const { requireUser, requireAdmin } = require('../lib/auth')
|
|
const { getObjectUrl } = require('../lib/cos')
|
|
const { writeLog } = require('../lib/log')
|
|
|
|
function register(router) {
|
|
router.get('/api/v1/admin/firmware', async ctx => {
|
|
const admin = await requireAdmin(ctx)
|
|
if (!admin) return fail(1002, '未授权，请重新登录')
|
|
const rows = await query('SELECT firmware_id, version, device_type, cos_key, size_bytes, sha256, status, created_at FROM firmware_files ORDER BY created_at DESC', {})
|
|
return ok({ records: rows, total: rows.length })
|
|
})
|
|
|
|
router.post('/api/v1/admin/firmware', async ctx => {
|
|
const admin = await requireAdmin(ctx)
|
|
if (!admin) return fail(1002, '未授权，请重新登录')
|
|
const version = String(ctx.body.version || '').trim()
|
|
const cosKey = String(ctx.body.cos_key || '').trim()
|
|
if (!version || !cosKey) return fail(2001, 'version and cos_key required')
|
|
const result = await query(
|
|
'INSERT INTO firmware_files (version, device_type, cos_key, size_bytes, sha256, status) VALUES (:version, :device_type, :cos_key, :size_bytes, :sha256, :status)',
|
|
{
|
|
version,
|
|
device_type: ctx.body.device_type || '',
|
|
cos_key: cosKey,
|
|
size_bytes: Number(ctx.body.size_bytes || 0),
|
|
sha256: ctx.body.sha256 || '',
|
|
status: ctx.body.status === 0 ? 0 : 1
|
|
}
|
|
)
|
|
await writeLog({ admin_id: admin.admin_id, action: 'admin_firmware_create', detail: '登记固件: ' + version, ip: ctx.ip })
|
|
return ok({ firmware_id: result.insertId })
|
|
})
|
|
|
|
router.post('/api/v1/admin/firmware/:firmware_id/status', async ctx => {
|
|
const admin = await requireAdmin(ctx)
|
|
if (!admin) return fail(1002, '未授权，请重新登录')
|
|
const firmwareId = parseInt(ctx.params.firmware_id, 10)
|
|
const status = Number(ctx.body.status) === 1 ? 1 : 0
|
|
if (!firmwareId) return fail(2001, 'firmware_id required')
|
|
await query('UPDATE firmware_files SET status = :status WHERE firmware_id = :firmware_id', { status, firmware_id: firmwareId })
|
|
await writeLog({ admin_id: admin.admin_id, action: 'admin_firmware_status', detail: '更新固件状态: ' + firmwareId + ' -> ' + status, ip: ctx.ip })
|
|
return ok({ message: 'success' })
|
|
})
|
|
|
|
router.get('/api/v1/firmware/latest', async ctx => {
|
|
const user = await requireUser(ctx)
|
|
if (!user) return fail(1001, 'invalid_token')
|
|
const firmware = await one('SELECT * FROM firmware_files WHERE status = 1 ORDER BY created_at DESC LIMIT 1', {})
|
|
if (!firmware) return ok({ has_update: false })
|
|
const currentVersion = ctx.query.current_version || ''
|
|
if (currentVersion && currentVersion === firmware.version) return ok({ has_update: false })
|
|
return ok({
|
|
has_update: true,
|
|
version: firmware.version,
|
|
size_bytes: firmware.size_bytes,
|
|
sha256: firmware.sha256,
|
|
download_url: await getObjectUrl(firmware.cos_key, 600)
|
|
})
|
|
})
|
|
}
|
|
|
|
module.exports = register
|