安全(P0) - 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签 (ywxapp.framework_package_verify,默认开启) - JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive - 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php) - 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
235 lines
8.3 KiB
PHP
235 lines
8.3 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
namespace app\backend\controller;
|
|
|
|
use think\Request;
|
|
use think\facade\Db;
|
|
use think\db\exception\DbException;
|
|
use think\exception\ValidateException;
|
|
use ywxapp\controller\BackendBase;
|
|
use ywxapp\model\MebmberScore as ScoreModel;
|
|
use ywxapp\service\ScoreService;
|
|
use app\backend\validate\Score as ScoreValidate;
|
|
|
|
/**
|
|
* 积分规则 & 流水管理
|
|
*/
|
|
class Score extends BackendBase
|
|
{
|
|
protected $noNeedLogin = [];
|
|
protected $noNeedVerify = [];
|
|
|
|
protected function initialize()
|
|
{
|
|
$this->model = new ScoreModel();
|
|
// 触发 score_rule / score_log 自愈
|
|
ScoreModel::ensureSchema();
|
|
}
|
|
|
|
// ============ 积分规则 ============
|
|
public function index()
|
|
{
|
|
$page = $this->request->param('page/d', 1);
|
|
$limit = $this->request->param('limit/d', 15);
|
|
$title = $this->request->param('title', '');
|
|
$action = $this->request->param('action', '');
|
|
|
|
if ($this->request->isAjax()) {
|
|
$query = $this->model->newQuery();
|
|
if ($title !== '') {
|
|
$query->where('title', 'like', '%' . $title . '%');
|
|
}
|
|
if ($action !== '') {
|
|
$query->where('action', $action);
|
|
}
|
|
$list = $query->order('sort', 'desc')
|
|
->paginate(['page' => $page, 'list_rows' => $limit]);
|
|
$typeList = ScoreModel::typeList();
|
|
$limitTypeList = ScoreService::limitTypeList();
|
|
$items = $list->items();
|
|
foreach ($items as &$item) {
|
|
$item['type_text'] = $typeList[$item['type']] ?? '-';
|
|
$item['limit_text'] = self::limitText($item, $limitTypeList);
|
|
$item['addon_text'] = empty($item['addon']) ? '核心' : $item['addon'];
|
|
}
|
|
$this->result->setCount($list->total())->success($items);
|
|
}
|
|
$this->assign('typeList', ScoreModel::typeList());
|
|
$this->assign('limitTypeList', ScoreService::limitTypeList());
|
|
$this->assign('uniqueTypeList', ScoreService::uniqueTypeList());
|
|
$this->assign('actionList', ScoreService::actions());
|
|
return $this->fetch();
|
|
}
|
|
|
|
/**
|
|
* 可用动作下拉数据(核心预置 + 插件注册 + 规则表已使用)
|
|
*/
|
|
public function actions()
|
|
{
|
|
$list = ScoreService::actions();
|
|
$data = [];
|
|
foreach ($list as $key => $item) {
|
|
$data[] = [
|
|
'action' => $key,
|
|
'title' => $item['title'],
|
|
'addon' => $item['addon'],
|
|
];
|
|
}
|
|
$this->result->success($data);
|
|
}
|
|
|
|
/**
|
|
* 限次文案:不限 / 每日 N 次 ...
|
|
*/
|
|
protected static function limitText(array $item, array $limitTypeList): string
|
|
{
|
|
$type = (int) ($item['limit_type'] ?? 0);
|
|
$times = (int) ($item['limit_times'] ?? 0);
|
|
if ($type === 0 || $times <= 0) {
|
|
return '不限';
|
|
}
|
|
return ($limitTypeList[$type] ?? '-') . ' ' . $times . ' 次';
|
|
}
|
|
|
|
public function save()
|
|
{
|
|
if (! $this->request->isPost()) {
|
|
$this->result->error('请求方式错误', 405);
|
|
}
|
|
$params = $this->request->only(
|
|
['title', 'action', 'type', 'value', 'addon', 'limit_type', 'limit_times', 'unique_type', 'remark', 'sort', 'status'],
|
|
'post'
|
|
);
|
|
try {
|
|
validate(ScoreValidate::class)->check($params);
|
|
$this->model->create($params);
|
|
$this->result->success('', '添加成功');
|
|
} catch (ValidateException $e) {
|
|
$this->result->error($e->getMessage());
|
|
} catch (DbException $e) {
|
|
$this->result->error('添加失败: ' . $e->getMessage(), 2);
|
|
}
|
|
}
|
|
|
|
public function edit($id = null)
|
|
{
|
|
$id = $id ?: $this->request->param('id');
|
|
$info = $this->model->find($id);
|
|
if (! $info) {
|
|
$this->result->error('记录不存在', 404);
|
|
}
|
|
$this->result->success(['info' => $info]);
|
|
}
|
|
|
|
public function update()
|
|
{
|
|
if (! ($this->request->isAjax() && $this->request->isPut())) {
|
|
$this->result->error('请求方式错误', 405);
|
|
}
|
|
$params = $this->request->only(
|
|
['id', 'title', 'action', 'type', 'value', 'addon', 'limit_type', 'limit_times', 'unique_type', 'remark', 'sort', 'status'],
|
|
'param'
|
|
);
|
|
$id = $params['id'] ?? null;
|
|
$info = $this->model->find($id);
|
|
if (! $info) {
|
|
$this->result->error('记录不存在', 404);
|
|
}
|
|
$statusOnly = isset($params['status'])
|
|
&& count(array_diff(array_keys($params), ['id', 'status'])) === 0;
|
|
if (! $statusOnly) {
|
|
try {
|
|
validate(ScoreValidate::class)->check($params);
|
|
} catch (ValidateException $e) {
|
|
$this->result->error($e->getMessage());
|
|
}
|
|
}
|
|
$info->save($params);
|
|
$this->result->success($info, '更新成功');
|
|
}
|
|
|
|
public function recyclebin()
|
|
{
|
|
$page = $this->request->param('page/d', 1);
|
|
$limit = $this->request->param('limit/d', 15);
|
|
if ($this->request->isAjax()) {
|
|
$list = $this->model->onlyTrashed()
|
|
->order('sort', 'desc')
|
|
->paginate(['page' => $page, 'list_rows' => $limit]);
|
|
$this->result->setCount($list->total())->success($list->items());
|
|
}
|
|
return $this->fetch('score/index');
|
|
}
|
|
|
|
public function delete()
|
|
{
|
|
if ($this->request->isAjax() && $this->request->isDelete()) {
|
|
$ids = $this->request->param('ids', '');
|
|
$force = $this->request->param('force', false);
|
|
if (empty($ids)) {
|
|
$this->result->error('请选择要删除的数据');
|
|
}
|
|
$idsArray = array_filter(explode(',', $ids), 'is_numeric');
|
|
if (empty($idsArray)) {
|
|
$this->result->error('参数错误');
|
|
}
|
|
try {
|
|
Db::transaction(function () use ($idsArray, $force) {
|
|
if ($force) {
|
|
$this->model->onlyTrashed()->whereIn('id', $idsArray)->select()
|
|
->each(function ($item) { $item->force()->delete(); });
|
|
} else {
|
|
$this->model->destroy($idsArray);
|
|
}
|
|
});
|
|
$this->result->success();
|
|
} catch (\think\exception\HttpResponseException $e) {
|
|
throw $e;
|
|
} catch (\Exception $e) {
|
|
$this->result->error('删除失败: ' . ($e->getMessage() ?: $e->__toString()), 500);
|
|
}
|
|
}
|
|
}
|
|
|
|
public function restore($ids = '')
|
|
{
|
|
if ($this->request->isAjax() && $this->request->isPost()) {
|
|
$ids = $this->request->param('ids', '');
|
|
if (empty($ids)) {
|
|
$this->result->error('请选择要恢复的数据');
|
|
}
|
|
$idsArray = array_filter(explode(',', $ids), 'is_numeric');
|
|
Db::startTrans();
|
|
try {
|
|
$this->model->withTrashed()->where('id', 'in', $idsArray)->select()
|
|
->each(function ($item) { $item->restore(); });
|
|
Db::commit();
|
|
$this->result->success('恢复成功');
|
|
} catch (DbException $e) {
|
|
Db::rollback();
|
|
$this->result->error('恢复失败: ' . $e->getMessage());
|
|
}
|
|
}
|
|
}
|
|
|
|
// ============ 积分流水 ============
|
|
public function log()
|
|
{
|
|
$page = $this->request->param('page/d', 1);
|
|
$limit = $this->request->param('limit/d', 15);
|
|
$uid = $this->request->param('uid/d', 0);
|
|
$action = $this->request->param('action', '');
|
|
$source = $this->request->param('source', '');
|
|
|
|
if ($this->request->isAjax()) {
|
|
$res = ScoreModel::logList($uid, $page, $limit, ['action' => $action, 'source' => $source]);
|
|
$typeList = ScoreModel::typeList();
|
|
foreach ($res['list'] as &$item) {
|
|
$item['type_text'] = $item['type'] == 2 ? '支出' : '收入';
|
|
}
|
|
$this->result->setCount($res['count'])->success($res['list']);
|
|
}
|
|
return $this->fetch('score/log');
|
|
}
|
|
}
|