yangwx
18101cf11a
安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签 （ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
107 lines
3.5 KiB
PHP
107 lines
3.5 KiB
PHP
<?php
|
||
// +----------------------------------------------------------------------
|
||
// | YwxApp [ WE CAN DO IT JUST THINK ]
|
||
// +----------------------------------------------------------------------
|
||
// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
|
||
// +----------------------------------------------------------------------
|
||
// | Author: ywxapp<admin@ywxapp.cn>
|
||
// +----------------------------------------------------------------------
|
||
declare(strict_types=1);
|
||
|
||
namespace app\member\controller;
|
||
|
||
use think\facade\Db;
|
||
use think\facade\Log;
|
||
use ywxapp\controller\MemberBase;
|
||
use ywxapp\model\CommonCard as CardModel;
|
||
use app\member\validate\Card as CardValidate;
|
||
|
||
/**
|
||
* 会员卡密充值（充值中心 -> 卡密充值）
|
||
*
|
||
* 业务闭环：
|
||
* 1) 会员在「卡密充值」页输入卡号 + 密码
|
||
* 2) redeem() 校验：卡密存在 / status=0或1（未用）/ 未删除
|
||
* 3) 事务内：钱包余额 += 面值、累计充值 += 面值；user_bill 记充值流水；卡密标记 status=2、use_time=now、绑定 uid
|
||
* 4) 一次性用完即焚，重复兑换同一卡密会提示已使用
|
||
*/
|
||
class Card extends MemberBase
|
||
{
|
||
protected $noNeedLogin = [];
|
||
protected $noNeedVerify = ['*'];
|
||
|
||
protected function initialize()
|
||
{
|
||
// 卡密表自愈（补齐 batch_no 等扩展列）
|
||
\ywxapp\model\CommonCard::ensureSchema();
|
||
}
|
||
|
||
/**
|
||
* 卡密充值页
|
||
*/
|
||
public function exchange()
|
||
{
|
||
return $this->view->fetch();
|
||
}
|
||
|
||
/**
|
||
* 兑换卡密（Ajax POST）
|
||
*/
|
||
public function redeem()
|
||
{
|
||
if (!($this->request->isAjax() && $this->request->isPost())) {
|
||
$this->result->error('访问错误');
|
||
}
|
||
$user = $this->auth->model;
|
||
if (empty($user)) {
|
||
$this->result->error('请先登录', 401);
|
||
}
|
||
|
||
$post = $this->request->only(['cardno', 'password'], 'post');
|
||
$validate = new CardValidate();
|
||
if (!$validate->scene('redeem')->check($post)) {
|
||
$this->result->error($validate->getError());
|
||
}
|
||
|
||
try {
|
||
$result = CardModel::redeem((int)$user->uid, trim($post['cardno']), trim($post['password']));
|
||
} catch (\Throwable $e) {
|
||
Log::error('[Card] redeem failed: ' . $e->getMessage());
|
||
$this->result->error('兑换失败：' . $e->getMessage());
|
||
}
|
||
|
||
if ($result['success']) {
|
||
$this->result->success($result['data'] ?? [], $result['msg']);
|
||
}
|
||
$this->result->error($result['msg']);
|
||
}
|
||
|
||
/**
|
||
* 我的兑换记录（Ajax GET，会员中心内页）
|
||
*/
|
||
public function records()
|
||
{
|
||
$user = $this->auth->model;
|
||
if (empty($user)) {
|
||
$this->result->error('请先登录', 401);
|
||
}
|
||
$page = $this->request->param('page/d', 1);
|
||
$limit = $this->request->param('limit/d', 15);
|
||
|
||
if ($this->request->isAjax()) {
|
||
$list = CardModel::where('uid', (int)$user->uid)
|
||
->where('status', CardModel::STATUS_USED)
|
||
->where('delete_at', 0)
|
||
->order('use_time', 'desc')
|
||
->paginate(['page' => $page, 'list_rows' => $limit]);
|
||
$items = $list->items();
|
||
foreach ($items as &$row) {
|
||
$row['use_time_text'] = $row['use_time'] > 0 ? date('Y-m-d H:i:s', $row['use_time']) : '';
|
||
}
|
||
unset($row);
|
||
$this->result->setCount($list->total())->success($items);
|
||
}
|
||
return $this->view->fetch();
|
||
}
|
||
}
|