feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用

安全（P0）
- 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签
  （ywxapp.framework_package_verify，默认开启）
- JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive
- 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php）
- 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）

addon/docs/Addon.php

@@ -3,8 +3,8 @@
  * @Author: YwxApp <ywx@ywxapp.cn>
  * @Date: 2026-08-01 23:18:56
  * @LastEditors: YwxApp <ywx@ywxapp.cn>
- * @LastEditTime: 2026-08-17 00:31:35
- * @Description: 
+ * @LastEditTime: 2026-09-23 09:30:00
+ * @Description:
  * @FilePath: \ywxapp_dev\addon\docs\Addon.php
  * @CustomString: Copyright (c) 2026 YwxApp
  */
@@ -19,6 +19,7 @@ declare (strict_types = 1);
 
 namespace addon\docs;
 
+use think\facade\Cache;
 use think\facade\Db;
 use ywxapp\AddonBase;
 
@@ -29,15 +30,32 @@ use ywxapp\AddonBase;
  *  - 菜单：addon/docs/menu.json
  *  - 数据：addon/docs/install.sql（框架 importsql 白名单执行 CREATE TABLE / INSERT）
  *
+ * 插件自愈：
+ *  - install / upgrade：检测 docs_doc 关键列是否齐全，缺则 ALTER TABLE 补齐（避免老库升 500）
+ *  - enabled / disabled：清理目录树缓存
+ *  - uninstall：物理删除 user_rule / admin_power 中的本插件记录（采用 Db::name 自动加前缀）
+ *
  * @author ywxapp <admin@ywxapp.cn>
  */
 class Addon extends AddonBase
 {
     /**
-     * 安装钩子
+     * 安装钩子：新装也跑一遍自愈，防止 importsql 部分失败导致缺列
      */
     public function install()
     {
+        $this->repairSchema();
+        return true;
+    }
+
+    /**
+     * 升级钩子：框架 AddonService::upgrade() 通过 callAddonHook 回调
+     */
+    
+    public function upgrade($currentVersion = '')
+    {
+        $this->repairSchema();
+        Cache::tag('docs_tree')->clear();
         return true;
     }
 
@@ -47,21 +65,24 @@ class Addon extends AddonBase
      * 框架 AddonService::deleteMenu() 只清理 admin_power，
      * 这里补清 user_rule 中本插件的前端菜单（按 name 前缀），避免残留。
      * 采用物理删除，防止软删除后唯一键 name 冲突导致重装失败。
+     *
+     * Db::name() 自动按 config/database.prefix 拼接表名，避免硬编码 'wxapp_' 部署陷阱。
      */
     public function uninstall()
     {
-        Db::execute("DELETE FROM wxapp_user_rule WHERE name LIKE 'docs:%'");
-        Db::execute("DELETE FROM wxapp_user_rule WHERE name LIKE 'docs/%'");
-        Db::execute("DELETE FROM wxapp_admin_power WHERE addon='docs'");
+        Db::name('user_rule')->whereLike('name', 'docs:%')->delete();
+        Db::name('user_rule')->whereLike('name', 'docs/%')->delete();
+        Db::name('admin_power')->where('addon', 'docs')->delete();
         return true;
     }
 
     /**
-     * 启用钩子：清理目录树缓存
+     * 启用钩子：清理目录树缓存 + 兜底自愈
      */
     public function enabled()
     {
-        \think\facade\Cache::tag('docs_tree')->clear();
+        $this->repairSchema();
+        Cache::tag('docs_tree')->clear();
         return true;
     }
 
@@ -70,7 +91,57 @@ class Addon extends AddonBase
      */
     public function disabled()
     {
-        \think\facade\Cache::tag('docs_tree')->clear();
+        Cache::tag('docs_tree')->clear();
         return true;
     }
-}
+
+    /**
+     * 表结构自愈：按 docs_doc 关键列补齐（幂等）
+     *
+     * 为什么需要：
+     *   框架 importsql 白名单（AddonService::importsql）只允许 CREATE TABLE / INSERT，
+     *   跳过 ALTER。已安装的 1.0.x 老库若缺 seo_* / content_md / editor_uid / audit_status
+     *   等列，首次访问新增/编辑/导入接口会直接 500。这里在 install/upgrade/enabled
+     *   三处兜底跑一遍 SHOW COLUMNS 比对，缺的补上。
+     *
+     * 注意：使用配置前缀而非硬编码 'wxapp_'
+     */
+    protected function repairSchema(): void
+    {
+        $prefix = (string) (config('database.connections.mysql.prefix') ?? '');
+        $tbl    = $prefix . 'docs_doc';
+
+        // 防御：表不存在（首次安装 importsql 还未跑）直接跳过
+        try {
+            $existing = Db::query("SHOW COLUMNS FROM `{$tbl}`");
+        } catch (\Throwable $e) {
+            return;
+        }
+        $have = [];
+        foreach ((array) $existing as $row) {
+            if (isset($row['Field'])) {
+                $have[(string) $row['Field']] = true;
+            }
+        }
+
+        $needs = [
+            'content_md'    => "longtext COMMENT 'Markdown源码'",
+            'editor_type'   => "tinyint(1) NOT NULL DEFAULT '1' COMMENT '编辑器类型:1富文本 2Markdown'",
+            'seo_title'     => "varchar(200) NOT NULL DEFAULT '' COMMENT 'SEO标题'",
+            'seo_keywords'  => "varchar(255) NOT NULL DEFAULT '' COMMENT 'SEO关键词'",
+            'seo_desc'      => "varchar(500) NOT NULL DEFAULT '' COMMENT 'SEO描述'",
+            'editor_uid'    => "int unsigned NOT NULL DEFAULT '0' COMMENT '最后编辑者UID'",
+            'audit_status'  => "tinyint(1) NOT NULL DEFAULT '1' COMMENT '审核状态:0待审 1通过 2驳回'",
+        ];
+
+        foreach ($needs as $col => $spec) {
+            if (!isset($have[$col])) {
+                try {
+                    Db::execute("ALTER TABLE `{$tbl}` ADD COLUMN `{$col}` {$spec}");
+                } catch (\Throwable $e) {
+                    // 静默：首次 install 时表尚未 importsql 创建，异常可忽略
+                }
+            }
+        }
+    }
+}

addon/docs/common.php

@@ -0,0 +1,52 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types=1);
+
+/**
+ * docs 插件全局助手函数（被前后台共用）
+ *
+ * docs_base_url()：当前请求对应的前台路由前缀。
+ *   - 独立入口 public/docs.php → ''
+ *   - 域名绑定命中 docs（config/app.php:16 domain_bind 的 docs / addon:docs / *）→ ''
+ *   - 普通路径模式 → '/docs'
+ *
+ * DocsFrontend 控制器 trait 与后台模板都通过本函数获取前缀，
+ * 避免在多个类里重复 host/subDomain/domain_bind 判断逻辑。
+ */
+
+if (!function_exists('docs_base_url')) {
+    function docs_base_url(): string
+    {
+        // 1) 独立入口
+        $script = pathinfo((string) ($_SERVER['SCRIPT_FILENAME'] ?? ''), PATHINFO_FILENAME);
+        if ($script === 'docs') {
+            return '';
+        }
+
+        // 2) 域名绑定
+        $bind = app()->config->get('app.domain_bind', []);
+        if (!empty($bind) && is_array($bind)) {
+            $host = request()->host(true);
+            $sub  = request()->subDomain();
+            foreach ([$host, $sub, '*'] as $key) {
+                if (!isset($bind[$key]) || !is_string($bind[$key]) || $bind[$key] === '') {
+                    continue;
+                }
+                $target = str_contains($bind[$key], ':')
+                    ? substr($bind[$key], strpos($bind[$key], ':') + 1)
+                    : $bind[$key];
+                if ($target === 'docs') {
+                    return '';
+                }
+            }
+        }
+
+        return '/docs';
+    }
+}

addon/docs/controller/DocsFrontend.php

@@ -45,9 +45,22 @@ class DocsFrontend extends FrontendBase
             'docsTitle'    => $this->docsConfig['site_title'] ?? 'YwxApp 文档中心',
             'projectList'  => DocsProject::enabledList(),
             'currentYear'  => date('Y'),
+            // 前台路由前缀：域名绑定/独立入口模式下为空串，路径模式下为 /docs。
+            // 模板统一用 {$docsBase}/xxx 生成链接，两种访问方式自适应。
+            'docsBase'     => $this->docsBase(),
         ]);
     }
 
+    /**
+     * 当前访问是否已把 docs 插件"独立成站"。逻辑统一在 docs_base_url() 全局助手。
+     *
+     * @see addon/docs/common.php
+     */
+    protected function docsBase(): string
+    {
+        return docs_base_url();
+    }
+
     /**
      * 模板变量赋值
      *

addon/docs/controller/Read.php

@@ -14,6 +14,7 @@ use addon\docs\model\DocsDoc;
 use addon\docs\model\DocsProject;
 use addon\docs\model\DocsVersion;
 use addon\docs\service\DocTreeService;
+use think\facade\Cache;
 
 /**
  * 文档阅读页（三栏布局）
@@ -44,7 +45,7 @@ class Read extends DocsFrontend
             return $this->notFound('该项目暂无可阅读的文档');
         }
 
-        return redirect('/docs/' . $projectModel->name . '/' . $first['name']);
+        return redirect($this->docsBase() . '/' . $projectModel->name . '/' . $first['name']);
     }
 
     /**
@@ -91,7 +92,8 @@ class Read extends DocsFrontend
             }
         }
 
-        DocsDoc::addViews((int) $doc->id);
+        // 阅读量去重：同一会话同一文档 5 分钟内不计，避免刷新/刷新/刷新刷虚高
+        $this->bumpViews((int) $doc->id);
 
         $tree     = DocTreeService::buildTree($projectId, $versionId);
         $siblings = DocTreeService::siblings($projectId, $versionId, (int) $doc->id);
@@ -101,7 +103,7 @@ class Read extends DocsFrontend
         [$content, $toc] = $this->buildToc((string) $doc->content);
 
         // 默认版本用短地址，非默认版本地址里带版本段
-        $baseUrl = '/docs/' . $projectModel->name;
+        $baseUrl = $this->docsBase() . '/' . $projectModel->name;
         if ((int) $versionModel->is_default !== 1) {
             $baseUrl .= '/' . $versionModel->name;
         }
@@ -260,21 +262,51 @@ class Read extends DocsFrontend
      */
     protected function docUrl(DocsProject $project, DocsVersion $version, string $name): string
     {
+        $base = $this->docsBase();
         // 默认版本走短地址，非默认版本带上版本段
         if ((int) $version->is_default === 1) {
-            return '/docs/' . $project->name . '/' . $name;
+            return $base . '/' . $project->name . '/' . $name;
         }
-        return '/docs/' . $project->name . '/' . $version->name . '/' . $name;
+        return $base . '/' . $project->name . '/' . $version->name . '/' . $name;
     }
 
     /**
-     * 渲染 404 提示页
+     * 渲染 404 提示页（同时返回 HTTP 404 状态码，避免被索引收录）
      *
      * @param string $message 提示语
      */
     protected function notFound(string $message)
     {
         $this->assign('message', $message);
-        return $this->fetch('read/notfound');
+        // 关键：使用 HTTP 404 而非 200，搜索引擎不会收录软性 404 页。
+        // 注意：$this->fetch() 返回的是渲染后的 HTML 字符串（不是 Response 对象），
+        // 因此不能链式调用 ->code()，必须用 response($html, 404) 包装成响应。
+        return response($this->fetch('read/notfound'), 404);
+    }
+
+    /**
+     * 阅读量计数（同一访客同一文档 5 分钟内只算 1 次）
+     *
+     * 采用缓存节流而非 Session：前台文档对游客开放，游客请求未必启动 Session
+     * （$this->request->session() 在本框架返回数组而非 Store 对象），
+     * 且阅读量属于统计类数据，不应强依赖会话。
+     *
+     * @param int $docId 文档ID
+     */
+    protected function bumpViews(int $docId): void
+    {
+        if ($docId <= 0) {
+            return;
+        }
+
+        $fingerprint = md5($this->request->ip() . '|' . (string) $this->request->header('user-agent', ''));
+        $key         = 'docs_view:' . $docId . ':' . $fingerprint;
+
+        if (Cache::get($key, 0)) {
+            return; // 5 分钟内已计过
+        }
+
+        DocsDoc::addViews($docId);
+        Cache::set($key, 1, 300);
     }
 }

addon/docs/controller/Search.php

@@ -38,13 +38,18 @@ class Search extends DocsFrontend
             $list    = DocSearchService::search($keyword, $projectId, $limit);
         }
 
+        // 关键词转义：搜索关键词原样输出到模板（input value、正文、提示等），
+        // 不在控制器转义就会形成反射型 XSS（如 ?kw="><script>）。
+        $keywordEsc = htmlspecialchars($keyword, ENT_QUOTES, 'UTF-8');
+
         $this->assign([
-            'keyword'   => $keyword,
-            'projectId' => $projectId,
-            'list'      => $list,
-            'total'     => count($list),
-            'projects'  => DocsProject::enabledList(),
-            'pageTitle' => $keyword !== '' ? '搜索：' . $keyword : '文档搜索',
+            'keyword'    => $keyword,
+            'keywordEsc' => $keywordEsc,
+            'projectId'  => $projectId,
+            'list'       => $list,
+            'total'      => count($list),
+            'projects'   => DocsProject::enabledList(),
+            'pageTitle'  => $keyword !== '' ? '搜索：' . $keywordEsc : '文档搜索',
         ]);
 
         return $this->fetch('search/index');

addon/docs/controller/Sitemap.php

@@ -0,0 +1,101 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\docs\controller;
+
+use addon\docs\model\DocsDoc;
+use addon\docs\model\DocsProject;
+use addon\docs\model\DocsVersion;
+
+/**
+ * 站点地图（前台 SEO 用）
+ *
+ * 输出最简版 sitemap.xml：
+ *   - 首页 / 文档中心首页
+ *   - 所有启用项目的入口
+ *   - 所有启用项目下「默认版本」且 status=1 的文档（非默认版本不收录，避免长短 URL 双内容）
+ *
+ * 内容量大可后续改成分片/分项目，本版本供搜索引擎基本覆盖即可。
+ *
+ * @author ywxapp <admin@ywxapp.cn>
+ */
+class Sitemap extends DocsFrontend
+{
+    /**
+     * GET /sitemap.xml
+     */
+    public function index()
+    {
+        $base = docs_base_url();
+
+        $urls = [];
+        // 首页
+        $urls[] = ['loc' => $base . '/', 'priority' => '1.0'];
+        // 各项目入口
+        $projects = DocsProject::enabledList();
+        foreach ($projects as $project) {
+            $urls[] = [
+                'loc'      => $base . '/' . $project['name'],
+                'priority' => '0.8',
+                'lastmod'  => $this->dateOf((int) ($project['update_at'] ?? 0)),
+            ];
+
+            // 该项目默认版本的可阅读文档（避免短/长地址双内容）
+            $version = DocsVersion::resolve((int) $project['id'], (string) ($project['default_version'] ?? ''));
+            if (!$version) {
+                continue;
+            }
+            $docs = DocsDoc::where('project_id', $project['id'])
+                ->where('version_id', $version->id)
+                ->where('status', 1)
+                ->where('is_dir', 0)
+                ->field('name,update_at')
+                ->order('update_at', 'desc')
+                ->limit(5000)
+                ->select()
+                ->toArray();
+            foreach ($docs as $doc) {
+                $urls[] = [
+                    'loc'      => $base . '/' . $project['name'] . '/' . rawurlencode($doc['name']),
+                    'priority' => '0.6',
+                    'lastmod'  => $this->dateOf((int) ($doc['update_at'] ?? 0)),
+                ];
+            }
+        }
+
+        $xml = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n";
+        $xml .= '<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">';
+        foreach ($urls as $u) {
+            $xml .= '<url>';
+            $xml .= '<loc>' . htmlspecialchars((string) $u['loc'], ENT_XML1, 'UTF-8') . '</loc>';
+            if (!empty($u['lastmod'])) {
+                $xml .= '<lastmod>' . $u['lastmod'] . '</lastmod>';
+            }
+            if (isset($u['priority'])) {
+                $xml .= '<priority>' . $u['priority'] . '</priority>';
+            }
+            $xml .= '</url>';
+        }
+        $xml .= '</urlset>';
+
+        return response($xml, 200, ['Content-Type' => 'application/xml; charset=utf-8']);
+    }
+
+    /**
+     * 时间戳 → W3C 日期（空值返回 null）
+     */
+    protected function dateOf(int $ts): ?string
+    {
+        if ($ts <= 0) {
+            return null;
+        }
+        return date('Y-m-d', $ts);
+    }
+}

addon/docs/controller/backend/Doc.php

@@ -206,10 +206,17 @@ class Doc extends BackendBase
         $ids = $this->descendantIds((int) $doc->id);
         $ids[] = (int) $doc->id;
 
-        foreach ($ids as $docId) {
-            DocSearchService::remove((int) $docId);
+        // 事务化：文档表 + 搜索索引，任何一步失败回滚
+        try {
+            Db::transaction(function () use ($ids) {
+                foreach ($ids as $docId) {
+                    DocSearchService::remove((int) $docId);
+                }
+                DocsDoc::whereIn('id', $ids)->delete();
+            });
+        } catch (\Throwable $e) {
+            return $this->result->error('删除失败：' . $e->getMessage());
         }
-        DocsDoc::whereIn('id', $ids)->delete();
 
         DocTreeService::clearCache();
         return $this->result->success(null, '删除成功，共移除 ' . count($ids) . ' 篇');
@@ -217,6 +224,11 @@ class Doc extends BackendBase
 
     /**
      * 拖拽排序：接收有序的 id 数组与父级关系
+     *
+     * 安全要点：
+     *   1. 校验节点归属（project/version），防止前端把任意文档塞进别人的树
+     *   2. 禁止自身成环（pid = self 或 pid 命中后代），避免树渲染栈溢出
+     *   3. 操作整体事务：中间失败回滚
      */
     public function sort()
     {
@@ -227,15 +239,55 @@ class Doc extends BackendBase
             return $this->result->error('排序数据为空');
         }
 
-        foreach ($nodes as $index => $node) {
-            $docId = (int) ($node['id'] ?? 0);
-            if ($docId <= 0) {
-                continue;
+        // 取第一个有效节点的项目/版本作为作用域（前端应保证 nodes 同源）
+        $first = null;
+        foreach ($nodes as $n) {
+            if ((int) ($n['id'] ?? 0) > 0) {
+                $first = DocsDoc::find((int) $n['id']);
+                if ($first) {
+                    break;
+                }
             }
-            DocsDoc::where('id', $docId)->update([
-                'pid'  => (int) ($node['pid'] ?? 0),
-                'sort' => (int) ($node['sort'] ?? $index),
-            ]);
+        }
+        if (!$first) {
+            return $this->result->error('排序数据无效，找不到对应文档');
+        }
+
+        $projectId = (int) $first->project_id;
+        $versionId = (int) $first->version_id;
+
+        try {
+            Db::transaction(function () use ($nodes, $projectId, $versionId) {
+                foreach ($nodes as $index => $node) {
+                    $docId = (int) ($node['id'] ?? 0);
+                    if ($docId <= 0) {
+                        continue;
+                    }
+
+                    $doc = DocsDoc::where('id', $docId)
+                        ->where('project_id', $projectId)
+                        ->where('version_id', $versionId)
+                        ->find();
+                    if (!$doc) {
+                        throw new \RuntimeException('文档 #' . $docId . ' 不在指定项目/版本范围内');
+                    }
+
+                    $newPid = (int) ($node['pid'] ?? 0);
+                    if ($newPid === $docId) {
+                        throw new \RuntimeException('文档 #' . $docId . ' 不能把自己设为父级');
+                    }
+                    if ($newPid > 0 && $this->isDescendant($docId, $newPid)) {
+                        throw new \RuntimeException('文档 #' . $docId . ' 的新父级属于其后代，会形成环');
+                    }
+
+                    DocsDoc::where('id', $docId)->update([
+                        'pid'  => $newPid,
+                        'sort' => (int) ($node['sort'] ?? $index),
+                    ]);
+                }
+            });
+        } catch (\Throwable $e) {
+            return $this->result->error($e->getMessage());
         }
 
         DocTreeService::clearCache();
@@ -273,6 +325,14 @@ class Doc extends BackendBase
             return $this->result->error('请选择目标项目与版本');
         }
 
+        // 校验：version_id 必须属于 project_id，防止前端篡改导入到无关项目
+        $version = DocsVersion::where('id', $versionId)
+            ->where('project_id', $projectId)
+            ->find();
+        if (!$version) {
+            return $this->result->error('所选版本不属于该项目');
+        }
+
         $file = $this->request->file('file');
         if (!$file) {
             return $this->result->error('请选择要导入的文件');

addon/docs/controller/backend/Project.php

@@ -15,6 +15,7 @@ use addon\docs\model\DocsProject;
 use addon\docs\model\DocsVersion;
 use addon\docs\service\DocSearchService;
 use addon\docs\service\DocTreeService;
+use think\facade\Db;
 use ywxapp\controller\BackendBase;
 
 /**
@@ -149,14 +150,21 @@ class Project extends BackendBase
             return $this->result->error('项目不存在');
         }
 
-        $docIds = DocsDoc::where('project_id', $id)->column('id');
-        foreach ($docIds as $docId) {
-            DocSearchService::remove((int) $docId);
-        }
+        // 事务化级联：项目 / 版本 / 文档 / 搜索索引，任何一步失败整体回滚
+        try {
+            Db::transaction(function () use ($id) {
+                $docIds = DocsDoc::where('project_id', $id)->column('id');
+                foreach ($docIds as $docId) {
+                    DocSearchService::remove((int) $docId);
+                }
 
-        DocsDoc::where('project_id', $id)->delete();
-        DocsVersion::where('project_id', $id)->delete();
-        $project->delete();
+                DocsDoc::where('project_id', $id)->delete();
+                DocsVersion::where('project_id', $id)->delete();
+                DocsProject::where('id', $id)->delete();
+            });
+        } catch (\Throwable $e) {
+            return $this->result->error('删除失败：' . $e->getMessage());
+        }
 
         DocTreeService::clearCache();
         return $this->result->success(null, '删除成功');

addon/docs/controller/backend/Version.php

@@ -15,6 +15,7 @@ use addon\docs\model\DocsProject;
 use addon\docs\model\DocsVersion;
 use addon\docs\service\DocSearchService;
 use addon\docs\service\DocTreeService;
+use think\facade\Db;
 use ywxapp\controller\BackendBase;
 
 /**
@@ -156,13 +157,20 @@ class Version extends BackendBase
             return $this->result->error('该项目仅剩一个版本，不能删除');
         }
 
-        $docIds = DocsDoc::where('version_id', $id)->column('id');
-        foreach ($docIds as $docId) {
-            DocSearchService::remove((int) $docId);
-        }
+        // 事务化级联：版本 / 文档 / 搜索索引
+        try {
+            Db::transaction(function () use ($id, $version) {
+                $docIds = DocsDoc::where('version_id', $id)->column('id');
+                foreach ($docIds as $docId) {
+                    DocSearchService::remove((int) $docId);
+                }
 
-        DocsDoc::where('version_id', $id)->delete();
-        $version->delete();
+                DocsDoc::where('version_id', $id)->delete();
+                DocsVersion::where('id', $id)->delete();
+            });
+        } catch (\Throwable $e) {
+            return $this->result->error('删除失败：' . $e->getMessage());
+        }
 
         DocTreeService::clearCache();
         return $this->result->success(null, '删除成功');

addon/docs/install.sql

@@ -6,8 +6,10 @@
 -- 说明：owner_uid / uid / audit_status 为多用户预留字段，
 --       当前版本仅站长后台管理，全部保持默认值即可。
 -- ============================================================
-SET NAMES utf8mb4;
-SET FOREIGN_KEY_CHECKS = 0;
+-- 注意：不要写 SET NAMES / SET FOREIGN_KEY_CHECKS 等会话语句，
+--       框架 importsql 白名单会直接跳过并日志告警（且部分 MySQL
+--       驱动会让后续 INSERT 错乱），建表后 charset 已在表定义里。
+-- ============================================================
 
 CREATE TABLE IF NOT EXISTS `__PREFIX__docs_project` (
   `id` int unsigned NOT NULL AUTO_INCREMENT,
@@ -88,24 +90,41 @@ CREATE TABLE IF NOT EXISTS `__PREFIX__docs_search` (
   KEY `idx_project_version` (`project_id`,`version_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_0900_ai_ci COMMENT='文档搜索索引表';
 
-INSERT INTO `__PREFIX__docs_project` (`id`, `name`, `title`, `intro`, `addon`, `owner_uid`, `default_version`, `sort`, `status`, `create_at`, `update_at`)
-SELECT 1, 'framework', 'YwxApp 框架文档', '框架安装、目录结构、插件机制与命令行工具的完整说明', '', 0, 'v1', 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
+-- ============================================================
+-- 种子数据：按 name 唯一性判重，不写死 id
+--   之前版本硬编码 id=1/2/3，脏库重装（外键/触发器/视图占 id）时 INSERT IGNORE
+--   会静默失败，导致后续版本/文档引用错乱。改为按 name 条件，id 由 AUTO_INCREMENT 自增。
+-- ============================================================
+
+INSERT INTO `__PREFIX__docs_project` (`name`, `title`, `intro`, `addon`, `owner_uid`, `default_version`, `sort`, `status`, `create_at`, `update_at`)
+SELECT 'framework', 'YwxApp 框架文档', '框架安装、目录结构、插件机制与命令行工具的完整说明', '', 0, 'v1', 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
 FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_project` WHERE `name` = 'framework');
 
-INSERT INTO `__PREFIX__docs_version` (`id`, `project_id`, `name`, `title`, `intro`, `is_default`, `sort`, `status`, `create_at`, `update_at`)
-SELECT 1, 1, 'v1', '1.0 版本', '当前稳定版本', 1, 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
-FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_version` WHERE `project_id` = 1 AND `name` = 'v1');
+INSERT INTO `__PREFIX__docs_version` (`project_id`, `name`, `title`, `intro`, `is_default`, `sort`, `status`, `create_at`, `update_at`)
+SELECT (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1), 'v1', '1.0 版本', '当前稳定版本', 1, 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
+FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_version` WHERE `name` = 'v1' AND `project_id` = (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1));
 
-INSERT INTO `__PREFIX__docs_doc` (`id`, `project_id`, `version_id`, `pid`, `name`, `title`, `content`, `editor_type`, `is_dir`, `sort`, `status`, `create_at`, `update_at`)
-SELECT 1, 1, 1, 0, 'guide', '入门指南', '', 1, 1, 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
-FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_doc` WHERE `project_id` = 1 AND `version_id` = 1 AND `name` = 'guide');
+INSERT INTO `__PREFIX__docs_doc` (`project_id`, `version_id`, `pid`, `name`, `title`, `content`, `editor_type`, `is_dir`, `sort`, `status`, `create_at`, `update_at`)
+SELECT
+    (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1),
+    (SELECT `id` FROM `__PREFIX__docs_version` WHERE `name` = 'v1' AND `project_id` = (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1) LIMIT 1),
+    0, 'guide', '入门指南', '', 1, 1, 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
+FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_doc` WHERE `name` = 'guide');
 
-INSERT INTO `__PREFIX__docs_doc` (`id`, `project_id`, `version_id`, `pid`, `name`, `title`, `content`, `editor_type`, `is_dir`, `sort`, `status`, `create_at`, `update_at`)
-SELECT 2, 1, 1, 1, 'introduction', '框架介绍', '<h2>YwxApp 是什么</h2><p>YwxApp 是一套基于 ThinkPHP 的事件驱动插件化开发框架，内置插件市场、会员体系、支付与模板机制。</p><h2>核心特性</h2><p>多应用架构、插件热插拔、事件钩子、可视化后台。</p>', 1, 0, 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
-FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_doc` WHERE `project_id` = 1 AND `version_id` = 1 AND `name` = 'introduction');
+INSERT INTO `__PREFIX__docs_doc` (`project_id`, `version_id`, `pid`, `name`, `title`, `content`, `editor_type`, `is_dir`, `sort`, `status`, `create_at`, `update_at`)
+SELECT
+    (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1),
+    (SELECT `id` FROM `__PREFIX__docs_version` WHERE `name` = 'v1' AND `project_id` = (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1) LIMIT 1),
+    (SELECT `id` FROM `__PREFIX__docs_doc` WHERE `name` = 'guide' LIMIT 1),
+    'introduction', '框架介绍', '<h2>YwxApp 是什么</h2><p>YwxApp 是一套基于 ThinkPHP 的事件驱动插件化开发框架，内置插件市场、会员体系、支付与模板机制。</p><h2>核心特性</h2><p>多应用架构、插件热插拔、事件钩子、可视化后台。</p>',
+    1, 0, 1, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
+FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_doc` WHERE `name` = 'introduction');
 
-INSERT INTO `__PREFIX__docs_doc` (`id`, `project_id`, `version_id`, `pid`, `name`, `title`, `content`, `editor_type`, `is_dir`, `sort`, `status`, `create_at`, `update_at`)
-SELECT 3, 1, 1, 1, 'installation', '安装部署', '<h2>环境要求</h2><p>PHP 8.0 以上，MySQL 5.7 以上，开启 pdo_mysql 与 fileinfo 扩展。</p><h2>安装步骤</h2><p>上传源码后访问安装向导，按提示填写数据库信息即可完成部署。</p>', 1, 0, 2, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
-FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_doc` WHERE `project_id` = 1 AND `version_id` = 1 AND `name` = 'installation');
-
-SET FOREIGN_KEY_CHECKS = 1;
+INSERT INTO `__PREFIX__docs_doc` (`project_id`, `version_id`, `pid`, `name`, `title`, `content`, `editor_type`, `is_dir`, `sort`, `status`, `create_at`, `update_at`)
+SELECT
+    (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1),
+    (SELECT `id` FROM `__PREFIX__docs_version` WHERE `name` = 'v1' AND `project_id` = (SELECT `id` FROM `__PREFIX__docs_project` WHERE `name` = 'framework' LIMIT 1) LIMIT 1),
+    (SELECT `id` FROM `__PREFIX__docs_doc` WHERE `name` = 'guide' LIMIT 1),
+    'installation', '安装部署', '<h2>环境要求</h2><p>PHP 8.0 以上，MySQL 5.7 以上，开启 pdo_mysql 与 fileinfo 扩展。</p><h2>安装步骤</h2><p>上传源码后访问安装向导，按提示填写数据库信息即可完成部署。</p>',
+    1, 0, 2, 1, UNIX_TIMESTAMP(), UNIX_TIMESTAMP()
+FROM DUAL WHERE NOT EXISTS (SELECT 1 FROM `__PREFIX__docs_doc` WHERE `name` = 'installation');

addon/docs/middleware.php

@@ -0,0 +1,17 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+return [
+    // docs 插件前台 + 后台均走会话（站点用户登录态），
+    // 启用 CSRF 同源校验（VerifyCsrfToken 默认行为）。
+    // 注意：必须同时把 'docs' 加入 config/csrf.php 的 session_apps 白名单，
+    // 否则中间件不会对 docs 应用做校验。
+    \ywxapp\middleware\VerifyCsrfToken::class,
+];

addon/docs/route/app.php

@@ -54,6 +54,7 @@ Route::group('backend', function () {
 // ==================== 前台阅读 ====================
 // 顺序敏感：固定路径 -> 三段 -> 两段 -> 一段 -> 首页
 Route::get('search', 'Search/index');
+Route::get('sitemap.xml', 'Sitemap/index');
 
 // /docs/<项目>/<版本>/<文档>
 Route::get(':project/:version/:name', 'Read/index')

addon/docs/service/DocSearchService.php

@@ -129,6 +129,8 @@ class DocSearchService
             ->field('s.doc_id,s.title,s.plain_text,d.name as doc_name,p.name as project_name,p.title as project_title,v.name as version_name')
             ->where('d.status', 1)
             ->where('p.status', 1)
+            // 补：禁用版本下的内容不应被搜到（之前漏查会导致隐藏内容曝光）
+            ->where('v.status', 1)
             ->where(function ($q) use ($like) {
                 $q->whereLike('s.title', $like)
                     ->whereOr('s.keywords', 'like', $like)

addon/docs/view/backend/doc/add.html

@@ -123,11 +123,12 @@ var docEditor = UE.getEditor('docContent', {
         'simpleupload', 'insertimage', 'attachment', 'insertvideo', '|',
         'inserttable', 'deletetable', 'insertrow', 'deleterow', 'insertcol', 'deletecol', 'mergecells', '|',
         'horizontal', 'insertcode', 'pasteplain', '|',
-        'searchreplace', 'preview', 'fullscreen', 'source'
+        'searchreplace', 'preview', 'fullscreen', 'source','contentimport'
     ]]
 });
 
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -144,7 +145,7 @@ layui.use(['form', 'layer', 'jquery'], function () {
         post.content = post.is_dir === 1 ? '' : docEditor.getContent();
 
         var loading = layer.load(1);
-        $.post('/docs/backend/doc/save', post, function (res) {
+        http.post('/docs/backend/doc/save', post).then(function (res) {
             layer.close(loading);
             if (res.code === 0) {
                 layer.msg(res.message, { icon: 1 }, function () {
@@ -153,7 +154,7 @@ layui.use(['form', 'layer', 'jquery'], function () {
             } else {
                 layer.msg(res.message || '保存失败', { icon: 2 });
             }
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.close(loading);
             layer.msg('请求失败，请重试', { icon: 2 });
         });

addon/docs/view/backend/doc/edit.html

@@ -11,7 +11,7 @@
         <span>编辑文档：{$item.title}</span>
         <div class="layui-inline" style="float:right;">
             {if condition="$project && $item['is_dir'] neq 1"}
-            <a class="layui-btn layui-btn-sm layui-btn-primary" href="/docs/{$project.name}/{$item.name}" target="_blank">预览</a>
+            <a class="layui-btn layui-btn-sm layui-btn-primary" href="{:docs_base_url()}/{$project.name}/{if condition='$version.is_default eq 1'}{$item.name}{else}{$version.name}/{$item.name}{/if}" target="_blank">预览</a>
             {/if}
             <a class="layui-btn layui-btn-sm layui-btn-primary"
                href="/docs/backend/doc?project_id={$item.project_id}&version_id={$item.version_id}">返回列表</a>
@@ -129,11 +129,12 @@ var docEditor = UE.getEditor('docContent', {
         'simpleupload', 'insertimage', 'attachment', 'insertvideo', '|',
         'inserttable', 'deletetable', 'insertrow', 'deleterow', 'insertcol', 'deletecol', 'mergecells', '|',
         'horizontal', 'insertcode', 'pasteplain', '|',
-        'searchreplace', 'preview', 'fullscreen', 'source'
+        'searchreplace', 'preview', 'fullscreen', 'source','contentimport'
     ]]
 });
 
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -149,10 +150,10 @@ layui.use(['form', 'layer', 'jquery'], function () {
         post.content = post.is_dir === 1 ? '' : docEditor.getContent();
 
         var loading = layer.load(1);
-        $.post('/docs/backend/doc/update/{$item.id}', post, function (res) {
+        http.post('/docs/backend/doc/update/{$item.id}', post).then(function (res) {
             layer.close(loading);
             layer.msg(res.message || (res.code === 0 ? '保存成功' : '保存失败'), { icon: res.code === 0 ? 1 : 2 });
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.close(loading);
             layer.msg('请求失败，请重试', { icon: 2 });
         });

addon/docs/view/backend/doc/import.html

@@ -134,7 +134,8 @@
 </div>
 
 <script>
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'ywxapp', 'http'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -180,27 +181,19 @@ layui.use(['form', 'layer', 'jquery'], function () {
         });
 
         var loading = layer.load(1);
-        $.ajax({
-            url: '/docs/backend/doc/import',
-            type: 'POST',
-            data: fd,
-            processData: false,
-            contentType: false,
-            dataType: 'json',
-            success: function (res) {
-                layer.close(loading);
-                if (res.code === 0) {
-                    layer.msg(res.message, { icon: 1 }, function () {
-                        location.href = '/docs/backend/doc/edit/' + res.data.id;
-                    });
-                } else {
-                    layer.msg(res.message || '导入失败', { icon: 2 });
-                }
-            },
-            error: function () {
-                layer.close(loading);
-                layer.msg('请求失败，请检查文件大小与服务器配置', { icon: 2 });
+        // http 识别 FormData：自动去掉 Content-Type 让浏览器带上 boundary
+        http.post('/docs/backend/doc/import', fd).then(function (res) {
+            layer.close(loading);
+            if (res.code === 0) {
+                layer.msg(res.message, { icon: 1 }, function () {
+                    location.href = '/docs/backend/doc/edit/' + res.data.id;
+                });
+            } else {
+                layer.msg(res.message || '导入失败', { icon: 2 });
             }
+        }).catch(function () {
+            layer.close(loading);
+            layer.msg('请求失败，请检查文件大小与服务器配置', { icon: 2 });
         });
     });
 });

addon/docs/view/backend/doc/index.html

@@ -124,7 +124,8 @@
 </div>
 
 <script>
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -149,13 +150,13 @@ layui.use(['form', 'layer', 'jquery'], function () {
             icon: 3, title: '确认删除'
         }, function (index) {
             layer.close(index);
-            $.post('/docs/backend/doc/delete/' + id, {}, function (res) {
+            http.post('/docs/backend/doc/delete/' + id, {}).then(function (res) {
                 if (res.code === 0) {
                     layer.msg(res.message, { icon: 1 }, function () { location.reload(); });
                 } else {
                     layer.msg(res.message || '删除失败', { icon: 2 });
                 }
-            }, 'json').fail(function () {
+            }).fail(function () {
                 layer.msg('请求失败，请重试', { icon: 2 });
             });
         });
@@ -179,14 +180,14 @@ layui.use(['form', 'layer', 'jquery'], function () {
         }
 
         var loading = layer.load(1);
-        $.post('/docs/backend/doc/sort', { nodes: JSON.stringify(nodes) }, function (res) {
+        http.post('/docs/backend/doc/sort', { nodes: JSON.stringify(nodes) }).then(function (res) {
             layer.close(loading);
             if (res.code === 0) {
                 layer.msg(res.message, { icon: 1 }, function () { location.reload(); });
             } else {
                 layer.msg(res.message || '保存失败', { icon: 2 });
             }
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.close(loading);
             layer.msg('请求失败，请重试', { icon: 2 });
         });
@@ -195,10 +196,10 @@ layui.use(['form', 'layer', 'jquery'], function () {
     // 重建搜索索引
     $('#btnRebuild').on('click', function () {
         var loading = layer.load(1);
-        $.post('/docs/backend/doc/rebuild-index', { project_id: projectId }, function (res) {
+        http.post('/docs/backend/doc/rebuild-index', { project_id: projectId }).then(function (res) {
             layer.close(loading);
             layer.msg(res.message || '完成', { icon: res.code === 0 ? 1 : 2 });
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.close(loading);
             layer.msg('请求失败，请重试', { icon: 2 });
         });

addon/docs/view/backend/project/add.html

@@ -65,7 +65,8 @@
 </div>
 
 <script>
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -74,7 +75,7 @@ layui.use(['form', 'layer', 'jquery'], function () {
         var post = $.extend({}, data.field);
         post.status = data.field.status ? 1 : 0;
 
-        $.post('/docs/backend/project/save', post, function (res) {
+        http.post('/docs/backend/project/save', post).then(function (res) {
             if (res.code === 0) {
                 layer.msg(res.message, { icon: 1 }, function () {
                     location.href = '/docs/backend/project';
@@ -82,7 +83,7 @@ layui.use(['form', 'layer', 'jquery'], function () {
             } else {
                 layer.msg(res.message || '保存失败', { icon: 2 });
             }
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.msg('请求失败，请重试', { icon: 2 });
         });
         return false;

addon/docs/view/backend/project/edit.html

@@ -78,7 +78,8 @@
 </div>
 
 <script>
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -87,13 +88,13 @@ layui.use(['form', 'layer', 'jquery'], function () {
         var post = $.extend({}, data.field);
         post.status = data.field.status ? 1 : 0;
 
-        $.post('/docs/backend/project/update/{$item.id}', post, function (res) {
+        http.post('/docs/backend/project/update/{$item.id}', post).then(function (res) {
             if (res.code === 0) {
                 layer.msg(res.message, { icon: 1 });
             } else {
                 layer.msg(res.message || '保存失败', { icon: 2 });
             }
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.msg('请求失败，请重试', { icon: 2 });
         });
         return false;

addon/docs/view/backend/project/index.html

@@ -3,7 +3,7 @@
         <span>文档项目</span>
         <div class="layui-inline" style="float:right;">
             <a class="layui-btn layui-btn-sm" href="/docs/backend/project/add">新增项目</a>
-            <a class="layui-btn layui-btn-sm layui-btn-primary" href="/docs" target="_blank">查看前台</a>
+            <a class="layui-btn layui-btn-sm layui-btn-primary" href="{:docs_base_url()}" target="_blank">查看前台</a>
         </div>
     </div>
     <div class="layui-card-body">
@@ -62,7 +62,8 @@
 </div>
 
 <script>
-layui.use(['layer', 'jquery'], function () {
+layui.use(['layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var layer = layui.layer;
     var $ = layui.$;
 
@@ -73,13 +74,13 @@ layui.use(['layer', 'jquery'], function () {
             icon: 3, title: '确认删除'
         }, function (index) {
             layer.close(index);
-            $.post('/docs/backend/project/delete/' + id, {}, function (res) {
+            http.post('/docs/backend/project/delete/' + id, {}).then(function (res) {
                 if (res.code === 0) {
                     layer.msg(res.message, { icon: 1 }, function () { location.reload(); });
                 } else {
                     layer.msg(res.message || '删除失败', { icon: 2 });
                 }
-            }, 'json').fail(function () {
+            }).fail(function () {
                 layer.msg('请求失败，请重试', { icon: 2 });
             });
         });

addon/docs/view/backend/version/add.html

@@ -64,7 +64,8 @@
 </div>
 
 <script>
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -74,7 +75,7 @@ layui.use(['form', 'layer', 'jquery'], function () {
         post.status = data.field.status ? 1 : 0;
         post.is_default = data.field.is_default ? 1 : 0;
 
-        $.post('/docs/backend/version/save', post, function (res) {
+        http.post('/docs/backend/version/save', post).then(function (res) {
             if (res.code === 0) {
                 layer.msg(res.message, { icon: 1 }, function () {
                     location.href = '/docs/backend/version?project_id=' + post.project_id;
@@ -82,7 +83,7 @@ layui.use(['form', 'layer', 'jquery'], function () {
             } else {
                 layer.msg(res.message || '保存失败', { icon: 2 });
             }
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.msg('请求失败，请重试', { icon: 2 });
         });
         return false;

addon/docs/view/backend/version/edit.html

@@ -62,7 +62,8 @@
 </div>
 
 <script>
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -72,13 +73,13 @@ layui.use(['form', 'layer', 'jquery'], function () {
         post.status = data.field.status ? 1 : 0;
         post.is_default = data.field.is_default ? 1 : 0;
 
-        $.post('/docs/backend/version/update/{$item.id}', post, function (res) {
+        http.post('/docs/backend/version/update/{$item.id}', post).then(function (res) {
             if (res.code === 0) {
                 layer.msg(res.message, { icon: 1 });
             } else {
                 layer.msg(res.message || '保存失败', { icon: 2 });
             }
-        }, 'json').fail(function () {
+        }).fail(function () {
             layer.msg('请求失败，请重试', { icon: 2 });
         });
         return false;

addon/docs/view/backend/version/index.html

@@ -67,7 +67,8 @@
 </div>
 
 <script>
-layui.use(['form', 'layer', 'jquery'], function () {
+layui.use(['form', 'layer', 'jquery', 'http', 'ywxapp'], function () {
+    var http = layui.http;
     var form = layui.form;
     var layer = layui.layer;
     var $ = layui.$;
@@ -83,13 +84,13 @@ layui.use(['form', 'layer', 'jquery'], function () {
             icon: 3, title: '确认删除'
         }, function (index) {
             layer.close(index);
-            $.post('/docs/backend/version/delete/' + id, {}, function (res) {
+            http.post('/docs/backend/version/delete/' + id, {}).then(function (res) {
                 if (res.code === 0) {
                     layer.msg(res.message, { icon: 1 }, function () { location.reload(); });
                 } else {
                     layer.msg(res.message || '删除失败', { icon: 2 });
                 }
-            }, 'json').fail(function () {
+            }).fail(function () {
                 layer.msg('请求失败，请重试', { icon: 2 });
             });
         });

addon/docs/view/frontend/index/index.html

@@ -7,7 +7,7 @@
     <div class="dc-hero-inner">
         <h1>{$docsTitle}</h1>
         <p>框架架构、插件开发、会员支付与命令行工具的完整说明，共收录 {$totalDocs} 篇文档</p>
-        <form class="dc-hero-search" action="/docs/search" method="get">
+        <form class="dc-hero-search" action="{$docsBase}/search" method="get">
             <input type="text" name="kw" placeholder="搜索你想了解的内容..." autocomplete="off">
             <button type="submit">搜索</button>
         </form>
@@ -33,7 +33,7 @@
                     {/if}
                 </div>
                 <div class="dc-project-info">
-                    <h2><a href="/docs/{$p.name}">{$p.title}</a></h2>
+                    <h2><a href="{$docsBase}/{$p.name}">{$p.title}</a></h2>
                     <p>{$p.intro|default='暂无简介'}</p>
                 </div>
             </div>
@@ -50,12 +50,12 @@
             {if condition="!empty($p.recent)"}
             <ul class="dc-project-recent">
                 {volist name="p.recent" id="r"}
-                <li><a href="/docs/{$p.name}/{$r.name}">{$r.title}</a></li>
+                <li><a href="{$docsBase}/{$p.name}/{$r.name}">{$r.title}</a></li>
                 {/volist}
             </ul>
             {/if}
 
-            <a class="dc-project-enter" href="/docs/{$p.name}">进入文档 →</a>
+            <a class="dc-project-enter" href="{$docsBase}/{$p.name}">进入文档 →</a>
         </div>
         {/volist}
     </div>

addon/docs/view/frontend/layout.html

@@ -6,6 +6,8 @@
     <meta name="viewport" content="width=device-width, initial-scale=1">
     <meta name="keywords" content="{block name="keywords"}YwxApp,文档中心{/block}">
     <meta name="description" content="{block name="description"}{$docsTitle}{/block}">
+    <link rel="canonical" href="{block name="canonical"}{$docsBase}{/block}">
+    <meta name="robots" content="{block name="robots"}index,follow{/block}">
     <link rel="stylesheet" href="/static/docs/css/docs.css">
     {block name="css"}{/block}
 </head>
@@ -13,21 +15,21 @@
 
 <header class="dc-header">
     <div class="dc-header-inner">
-        <a class="dc-logo" href="/docs">
+        <a class="dc-logo" href="{$docsBase}">
             <span class="dc-logo-mark">Y</span>
             <span class="dc-logo-text">{$docsTitle}</span>
         </a>
 
         <nav class="dc-nav">
-            <a href="/docs">文档首页</a>
+            <a href="{$docsBase}">文档首页</a>
             {volist name="projectList" id="p" offset="0" length="5"}
-            <a href="/docs/{$p.name}">{$p.title}</a>
+            <a href="{$docsBase}/{$p.name}">{$p.title}</a>
             {/volist}
             <a href="/" target="_blank">返回官网</a>
         </nav>
 
-        <form class="dc-search" action="/docs/search" method="get">
-            <input type="text" name="kw" value="{$keyword|default=''}" placeholder="搜索文档..." autocomplete="off">
+        <form class="dc-search" action="{$docsBase}/search" method="get">
+            <input type="text" name="kw" value="{$keyword|default=''|htmlspecialchars}" placeholder="搜索文档..." autocomplete="off">
             <button type="submit" aria-label="搜索">
                 <svg viewBox="0 0 24 24" width="16" height="16"><path fill="currentColor" d="M15.5 14h-.79l-.28-.27a6.5 6.5 0 1 0-.7.7l.27.28v.79l5 4.99L20.49 19l-4.99-5Zm-6 0A4.5 4.5 0 1 1 14 9.5 4.5 4.5 0 0 1 9.5 14Z"/></svg>
             </button>
@@ -41,6 +43,7 @@
 
 {block name="body"}{/block}
 
+<script>window.DOCS_BASE = '{$docsBase}';</script>
 <script src="/static/docs/js/docs.js"></script>
 {block name="js"}{/block}
 </body>

addon/docs/view/frontend/read/index.html

@@ -2,6 +2,8 @@
 {block name="title"}{$pageTitle}{/block}
 {block name="keywords"}{$seoKeywords}{/block}
 {block name="description"}{$seoDesc}{/block}
+{* 默认版本用短地址作为 canonical，避免与版本段长地址被搜索引擎视为双内容 *}
+{block name="canonical"}{$docsBase}/{$project.name}/{if condition="$version.is_default eq 1"}{$doc.name}{else}{$version.name}/{$doc.name}{/if}{/block}
 
 {block name="body"}
 <div class="dc-layout">
@@ -25,9 +27,9 @@
 
     <main class="dc-main">
         <div class="dc-crumbs">
-            <a href="/docs">文档中心</a>
+            <a href="{$docsBase}">文档中心</a>
             <span class="dc-crumb-sep">/</span>
-            <a href="/docs/{$project.name}">{$project.title}</a>
+            <a href="{$docsBase}/{$project.name}">{$project.title}</a>
             {volist name="crumbs" id="crumb"}
             <span class="dc-crumb-sep">/</span>
             {if condition="$crumb.id eq $activeId"}

addon/docs/view/frontend/read/notfound.html

@@ -7,7 +7,7 @@
     <h1>{$message}</h1>
     <p>该地址可能已变更或对应内容已下线</p>
     <div class="dc-notfound-ops">
-        <a class="dc-btn dc-btn-primary" href="/docs">返回文档中心</a>
+        <a class="dc-btn dc-btn-primary" href="{$docsBase}">返回文档中心</a>
         <a class="dc-btn" href="/">返回官网首页</a>
     </div>
 </section>

addon/docs/view/frontend/search/index.html

@@ -1,10 +1,12 @@
 {extend name="layout"}
 {block name="title"}{$pageTitle} - {$docsTitle}{/block}
+{* 搜索结果页千变万化，避免被搜索引擎收录 *}
+{block name="robots"}noindex,follow{/block}
 
 {block name="body"}
 <section class="dc-search-page">
-    <form class="dc-search-form" action="/docs/search" method="get">
-        <input type="text" name="kw" value="{$keyword}" placeholder="输入关键词搜索文档..." autocomplete="off" autofocus>
+    <form class="dc-search-form" action="{$docsBase}/search" method="get">
+        <input type="text" name="kw" value="{$keywordEsc}" placeholder="输入关键词搜索文档..." autocomplete="off" autofocus>
         <select name="project_id">
             <option value="0">全部项目</option>
             {volist name="projects" id="p"}
@@ -21,7 +23,7 @@
     </div>
     {else/}
     <div class="dc-search-summary">
-        找到 <b>{$total}</b> 条与「{$keyword}」相关的结果
+        找到 <b>{$total}</b> 条与「{$keywordEsc}」相关的结果
     </div>
 
     {if condition="empty($list)"}
@@ -33,7 +35,7 @@
     <ul class="dc-search-list">
         {volist name="list" id="r"}
         <li>
-            <a class="dc-search-title" href="/docs/{$r.project_name}/{$r.doc_name}">{$r.title}</a>
+            <a class="dc-search-title" href="{$docsBase}/{$r.project_name}/{$r.doc_name}">{$r.title}</a>
             <div class="dc-search-path">{$r.project_title} / {$r.version_name}</div>
             <p class="dc-search-snippet">{$r.snippet}</p>
         </li>