Files
YwxAppThink/ywxapp/model/CommonTask.php
T
yangwx 18101cf11a feat: 上线前安全加固与发布工程化;appmall 由插件迁移为独立应用
安全(P0)
- 发布包签名:新增 scripts/package_keygen.php、scripts/package_verify.php、
  ywxapp\service\PackageVerifier;FrameworkService::apply() 解压前强制验签
  (ywxapp.framework_package_verify,默认开启)
- JWT 收紧:config/jwt.php 移除公开默认密钥,JwtService::assertStrongSecret()
  校验非空 / 长度≥32 / 已知弱值;.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET
- /api/v1/Article:免登录白名单收窄为只读接口,写操作字段白名单 + assertOwner() 越权校验
- 开发者令牌:查找接口不再回显明文、统一失败文案 + 限流
- TemplateInstaller:文件名白名单 + realpath 归一化 + 目录内断言,修复 Zip Slip;补 use ZipArchive
- 后台登录:接入验证码、失败锁定与登录限流(config/ratelimit.php)
- 缓存 / Session 驱动可由 .env 覆盖(CACHE_DRIVER / SESSION_TYPE),集群部署改 redis
- paycenter 支付日志开关改为 PAY_LOG,不再跟随 APP_DEBUG

工程化 / 交付
- 新增 CHANGELOG.md 与 .env.production.example;composer.lock 入库锁定依赖版本
- 插件离线安装 CLI 增加 --uid,后台上传安装透传 uid,付费插件授权校验可通过
- 授权拒绝文案区分「未携带 uid」与「未找到有效授权」,便于排障
- .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess

结构
- appmall 由 addon/appmall 迁移为独立应用 app/appmall(市场 / 开发者中心 / 审核 / 分润)
2026-10-22 00:53:39 +08:00

191 lines
6.8 KiB
PHP

<?php
declare(strict_types=1);
namespace ywxapp\model;
use ywxapp\model\BaseModel;
use ywxapp\model\CommonMedal;
use think\facade\Db;
use think\model\concern\SoftDelete;
/**
* 站点任务
*/
class CommonTask extends BaseModel
{
use SoftDelete;
/**
* 模型配置(BaseModel::applyOptions 约定)
*/
protected function getOptions(): array
{
return [
'strict' => true,
'autoWriteTimestamp' => 'int',
'createTime' => 'create_at',
'updateTime' => 'update_at',
'deleteTime' => 'delete_at',
'defaultSoftDelete' => 0,
'readonly' => ['view_count']
];
}
// 奖励类型
const REWARD_SCORE = 1; // 积分
const REWARD_COIN = 2; // 金币
const REWARD_PROP = 3; // 道具
const REWARD_MEDAL = 4; // 勋章
/**
* 奖励类型列表(后台下拉 / 前台展示)
*/
public static function rewardTypeList(): array
{
return [
self::REWARD_SCORE => '积分',
self::REWARD_COIN => '金币',
self::REWARD_PROP => '道具',
self::REWARD_MEDAL => '勋章',
];
}
public static function getRewardTypeText(int $type): string
{
return self::rewardTypeList()[$type] ?? '未知';
}
/**
* 启用中的任务(前台展示)
*/
public static function getEnabledList()
{
return self::where('status', 1)->order('sort', 'asc')->select();
}
/**
* 取某用户已领取的任务ID集合
*/
public static function getClaimedTaskIds(int $uid): array
{
self::ensureSchema(); // 确保 member_task / member_prop 关联表已就绪(静态入口可能未实例化模型)
if ($uid <= 0) {
return [];
}
return Db::name('member_task')->where('uid', $uid)->column('task_id') ?: [];
}
/**
* 领取任务并发放奖励(幂等:同一任务仅可领取一次)
* @return array [bool $ok, string $msg]
*/
public static function claim(int $uid, int $taskId): array
{
self::ensureSchema(); // 确保 user_task / user_prop 等关联表已就绪(静态入口可能未实例化模型)
if ($uid <= 0) {
return [false, '请先登录'];
}
$task = self::where('id', $taskId)->where('status', 1)->find();
if (!$task) {
return [false, '任务不存在或未启用'];
}
$task = $task->toArray();
// 是否已领取
$exists = Db::name('member_task')->where('uid', $uid)->where('task_id', $taskId)->find();
if ($exists) {
return [false, '该任务已领取'];
}
$num = (int) $task['reward_num'];
if ($num <= 0) {
return [false, '奖励数量无效'];
}
Db::startTrans();
try {
// 发放奖励
switch ((int) $task['reward_type']) {
case self::REWARD_SCORE:
// 走积分规则引擎:分值沿用任务配置的奖励数量,规则表可再叠加额外奖励
$res = \ywxapp\service\ScoreService::trigger('task.complete', $uid, [
'task_id' => $taskId,
'title' => $task['title'],
], [
'source' => 'task',
'source_id' => (string) $taskId,
'value' => $num,
'remark' => '完成任务:' . $task['title'],
]);
if (! $res['ok']) {
throw new \Exception($res['msg']);
}
// 未配置 task.complete 规则时退化为原行为,保证老数据不受影响
if ($res['rules'] === 0) {
[$ok, $msg] = \ywxapp\model\MebmberScore::change($uid, \ywxapp\model\MebmberScore::TYPE_GAIN, $num, '完成任务:' . $task['title']);
if (! $ok) {
throw new \Exception($msg);
}
}
break;
case self::REWARD_COIN:
Db::name('member_wallet')->where('uid', $uid)->inc('coins', $num)->update();
Db::name('member_bill')->insert([
'uid' => $uid,
'currency' => 2, // 2=金币
'type' => 1, // 1=收入
'amount' => $num,
'balance' => Db::name('member_wallet')->where('uid', $uid)->value('coins') ?: $num,
'remark' => '完成任务:' . $task['title'],
'create_at' => time(),
]);
break;
case self::REWARD_PROP:
Db::name('member_prop')->insert([
'uid' => $uid,
'prop_id' => $num, // reward_num 存道具ID
'num' => (int) ($task['prop_num'] ?: 1),
'create_at' => time(),
]);
break;
case self::REWARD_MEDAL:
// reward_num 存勋章ID
$grant = CommonMedal::grant($uid, $num);
if (!$grant[0]) {
throw new \Exception($grant[1]);
}
break;
default:
throw new \Exception('未知奖励类型');
}
// 领取记录
Db::name('member_task')->insert([
'uid' => $uid,
'task_id' => $taskId,
'reward_type' => $task['reward_type'],
'reward_num' => $num,
'create_at' => time(),
]);
Db::commit();
return [true, '领取成功'];
} catch (\Throwable $e) {
Db::rollback();
return [false, '领取失败:' . $e->getMessage()];
}
}
/**
* 表自愈:确保任务相关表(member_prop / member_task)与扩展列已就绪。
*/
public static function ensureSchema(): void
{
$prefix = BaseModel::currentPrefix();
BaseModel::ensureTableFromInstall($prefix, 'common_task');
BaseModel::ensureTableFromInstall($prefix, 'member_prop');
BaseModel::ensureTableFromInstall($prefix, 'member_task');
BaseModel::ensureColumn("{$prefix}member_user", 'score', "int unsigned NOT NULL DEFAULT 0 COMMENT '积分(做任务/互动获得)'");
BaseModel::ensureColumn("{$prefix}common_task", 'prop_num', "int NOT NULL DEFAULT 1 COMMENT '道具数量(奖励类型为道具时生效)'");
}
}