2025-09-18

app后端搭建

routes/auth.js

@@ -0,0 +1,346 @@
+const express = require('express');
+const bcrypt = require('bcryptjs');
+const jwt = require('jsonwebtoken');
+const {getDB} = require('../database');
+
+const router = express.Router();
+const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';
+router.post('/register', async (req, res) => {
+    try {
+        const db = getDB();
+        await db.query('START TRANSACTION');
+
+        const {
+            username,
+            phone,
+            password,
+            city,
+            district_id: district,
+            province,
+            inviter = null,
+            captchaId,
+            captchaText,
+            smsCode, // 短信验证码
+            role = 'user'
+        } = req.body;
+
+        if (!username || !phone || !password || !city || !district || !province) {
+            return res.status(400).json({success: false, message: '用户名、手机号、密码、城市和区域不能为空'});
+        }
+
+        if (!captchaId || !captchaText) {
+            return res.status(400).json({success: false, message: '图形验证码不能为空'});
+        }
+        const storedCaptcha = global.captchaStore.get(captchaId);
+        console.log(storedCaptcha);
+
+        if (!storedCaptcha) {
+            return res.status(400).json({
+                success: false,
+                message: '验证码不存在或已过期'
+            });
+        }
+
+        // 检查是否过期
+        if (Date.now() > storedCaptcha.expires) {
+            global.captchaStore.delete(captchaId);
+            return res.status(400).json({
+                success: false,
+                message: '验证码已过期'
+            });
+        }
+
+        // 验证验证码（不区分大小写）
+        const isValid = storedCaptcha.text === captchaText.toLowerCase();
+
+        // 删除已验证的验证码
+        global.captchaStore.delete(captchaId);
+
+        if (!isValid) {
+            return res.status(400).json({
+                success: false,
+                message: '验证码错误'
+            });
+        }
+        if (!smsCode) {
+            return res.status(400).json({success: false, message: '短信验证码不能为空'});
+        }
+        // 验证短信验证码
+        const smsAPI = require('./sms');
+        const smsValid = smsAPI.verifySMSCode(phone, smsCode);
+        if (!smsValid) {
+            return res.status(400).json({success: false, message: '短信验证码错误或已过期'});
+        }
+
+        // 验证手机号格式
+        const phoneRegex = /^1[3-9]\d{9}$/;
+        if (!phoneRegex.test(phone)) {
+            return res.status(400).json({success: false, message: '手机号格式不正确'});
+        }
+
+
+        // 检查用户是否已存在
+        const [existingUsers] = await db.execute(
+            'SELECT id, payment_status FROM users WHERE username = ? OR phone = ?',
+            [username, phone]
+        );
+
+        if (existingUsers.length > 0) {
+            return res.status(400).json({success: false, message: '用户名或手机号已存在'});
+        }
+
+        // 加密密码
+        const hashedPassword = await bcrypt.hash(password, 10);
+
+        // 创建用户（初始状态为未支付）
+        const [result] = await db.execute(
+            'INSERT INTO users (username, phone, password, role, points, audit_status, city, district_id, payment_status, province, inviter) VALUES (?, ?, ?, ?, ?, ?, ?, ?, "unpaid", ?, ?)',
+            [username, phone, hashedPassword, role, 0, 'pending', city, district, province, inviter]
+        );
+
+        const userId = result.insertId;
+        await db.query('COMMIT');
+
+        // 生成JWT token（用于支付流程）
+        const token = jwt.sign(
+            {userId: userId, username, role},
+            JWT_SECRET,
+            {expiresIn: '24h'}
+        );
+
+        res.status(201).json({
+            success: true,
+            message: '用户信息创建成功，请完成支付以激活账户',
+            token,
+            user: {
+                id: userId,
+                username,
+                phone,
+                role,
+                points: 0,
+                audit_status: 'pending',
+                city,
+                district,
+                paymentStatus: 'unpaid'
+            },
+            needPayment: true
+        });
+    } catch (error) {
+        try {
+            // await getDB().query('ROLLBACK');
+        } catch (rollbackError) {
+            console.error('回滚错误:', rollbackError);
+        }
+        console.error('注册错误详情:', error);
+        console.error('错误堆栈:', error.stack);
+        res.status(500).json({
+            success: false,
+            message: '注册失败',
+            error: process.env.NODE_ENV === 'development' ? error.message : undefined
+        });
+    }
+});
+
+
+router.post('/login', async (req, res) => {
+    console.log(123456)
+    try {
+        const db = getDB();
+        const {username, password, captchaId, captchaText} = req.body;
+
+        if (!username || !password) {
+            return res.status(400).json({success: false, message: '用户名和密码不能为空'});
+        }
+
+        if (!captchaId || !captchaText) {
+            return res.status(400).json({success: false, message: '验证码不能为空'});
+        }
+        // 获取存储的验证码
+        const storedCaptcha = global.captchaStore.get(captchaId);
+        console.log(storedCaptcha);
+
+        if (!storedCaptcha) {
+            return res.status(400).json({
+                success: false,
+                message: '验证码不存在或已过期'
+            });
+        }
+
+        // 检查是否过期
+        if (Date.now() > storedCaptcha.expires) {
+            global.captchaStore.delete(captchaId);
+            return res.status(400).json({
+                success: false,
+                message: '验证码已过期'
+            });
+        }
+
+        // 验证验证码（不区分大小写）
+        const isValid = storedCaptcha.text === captchaText.toLowerCase();
+
+        // 删除已验证的验证码
+        global.captchaStore.delete(captchaId);
+
+        if (!isValid) {
+            return res.status(400).json({
+                success: false,
+                message: '验证码错误'
+            });
+        }
+
+        // 注意：验证码已在前端通过 /captcha/verify 接口验证过，这里不再重复验证
+
+        // 查找用户（包含支付状态）
+        console.log('登录尝试 - 用户名:', username);
+        const [users] = await db.execute(
+            'SELECT * FROM users WHERE username = ?',
+            [username]
+        );
+
+        console.log('查找到的用户数量:', users.length);
+        if (users.length === 0) {
+            console.log('用户不存在:', username);
+            return res.status(401).json({success: false, message: '用户名或密码错误'});
+        }
+
+        const user = users[0];
+        console.log('找到用户:', user.username, '密码长度:', user.password ? user.password.length : 'null');
+
+        // 验证密码
+        console.log('验证密码 - 输入密码:', password, '数据库密码前10位:', user.password ? user.password.substring(0, 10) : 'null');
+        const isValidPassword = await bcrypt.compare(password, user.password);
+        console.log('密码验证结果:', isValidPassword);
+
+        if (!isValidPassword) {
+            console.log('密码验证失败');
+            return res.status(401).json({success: false, message: '用户名或密码错误'});
+        }
+
+        // 检查支付状态（管理员除外）
+        if (user.role !== 'admin' && user.payment_status === 'unpaid') {
+            const token = jwt.sign(
+                {userId: user.id, username: user.username, role: user.role},
+                JWT_SECRET,
+                {expiresIn: '5m'}
+            );
+            return res.status(200).json({
+                success: false,
+                message: '您的账户尚未激活，请完成支付后再登录',
+                needPayment: true,
+                user: user[0],
+                token
+            });
+        }
+
+        // 检查用户审核状态（管理员除外，只阻止被拒绝的用户）
+        if (user.role !== 'admin' && user.audit_status === 'rejected') {
+            return res.status(403).json({success: false, message: '您的账户审核未通过，请联系管理员'});
+        }
+        // 待审核用户可以正常登录使用系统，但匹配功能会有限制
+
+        // 生成JWT token
+        const token = jwt.sign(
+            {userId: user.id, username: user.username, role: user.role},
+            JWT_SECRET,
+            {expiresIn: '24h'}
+        );
+        const [is_distribution] = await db.execute(`
+            SELECT *
+            FROM distribution
+            WHERE user_id = ?`, [user.id]);
+        user.distribution = is_distribution.length > 0 ? true : false;
+        res.json({
+            success: true,
+            message: '登录成功',
+            token,
+            user
+        });
+    } catch (error) {
+        console.error('登录错误:', error);
+        res.status(500).json({success: false, message: '登录失败'});
+    }
+});
+
+// 验证token中间件
+const authenticateToken = (req, res, next) => {
+    const authHeader = req.headers['authorization'];
+    const token = authHeader && authHeader.split(' ')[1];
+
+    if (!token) {
+        return res.status(401).json({success: false, message: '访问令牌缺失'});
+    }
+
+    jwt.verify(token, JWT_SECRET, (err, user) => {
+        if (err) {
+            return res.status(403).json({success: false, message: '访问令牌无效'});
+        }
+        req.user = user;
+        next();
+    });
+};
+
+// 获取当前用户信息
+router.get('/me', authenticateToken, async (req, res) => {
+    try {
+        const db = getDB();
+        const [users] = await db.execute(
+            'SELECT id, username, role, avatar, points, created_at FROM users WHERE id = ?',
+            [req.user.userId]
+        );
+
+        if (users.length === 0) {
+            return res.status(404).json({success: false, message: '用户不存在'});
+        }
+
+        res.json({success: true, user: users[0]});
+    } catch (error) {
+        console.error('获取用户信息错误:', error);
+        res.status(500).json({success: false, message: '获取用户信息失败'});
+    }
+});
+
+// 修改密码
+router.put('/change-password', authenticateToken, async (req, res) => {
+    try {
+        const db = getDB();
+        const {currentPassword, newPassword} = req.body;
+
+        if (!currentPassword || !newPassword) {
+            return res.status(400).json({success: false, message: '旧密码和新密码不能为空'});
+        }
+
+        // 获取用户当前密码
+        const [users] = await db.execute(
+            'SELECT password FROM users WHERE id = ?',
+            [req.user.userId]
+        );
+
+        if (users.length === 0) {
+            return res.status(404).json({success: false, message: '用户不存在'});
+        }
+
+        // 验证旧密码
+        const isValidPassword = await bcrypt.compare(currentPassword, users[0].password);
+
+        if (!isValidPassword) {
+            return res.status(400).json({success: false, message: '旧密码错误'});
+        }
+
+        // 加密新密码
+        const hashedNewPassword = await bcrypt.hash(newPassword, 10);
+
+        // 更新密码
+        await db.execute(
+            'UPDATE users SET password = ? WHERE id = ?',
+            [hashedNewPassword, req.user.userId]
+        );
+
+        res.json({success: true, message: '密码修改成功'});
+    } catch (error) {
+        console.error('修改密码错误:', error);
+        res.status(500).json({success: false, message: '修改密码失败'});
+    }
+});
+
+module.exports = router;
+module.exports.authenticateToken = authenticateToken;

routes/captcha.js

@@ -0,0 +1,220 @@
+const express = require('express');
+const crypto = require('crypto');
+const router = express.Router();
+
+
+
+// 内存存储验证码（生产环境建议使用Redis）
+
+
+/**
+ * 生成随机验证码字符串
+ * @param {number} length 验证码长度
+ * @returns {string} 验证码字符串
+ */
+function generateCaptchaText(length = 4) {
+  const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+  let result = '';
+  for (let i = 0; i < length; i++) {
+    result += chars.charAt(Math.floor(Math.random() * chars.length));
+  }
+  return result;
+}
+
+/**
+ * 生成SVG验证码图片
+ * @param {string} text 验证码文本
+ * @returns {string} SVG字符串
+ */
+function generateCaptchaSVG(text) {
+  const width = 120;
+  const height = 40;
+  const fontSize = 18;
+  
+  // 生成随机颜色
+  const getRandomColor = () => {
+    const colors = ['#FF6B6B', '#4ECDC4', '#45B7D1', '#96CEB4', '#FFEAA7', '#DDA0DD', '#98D8C8'];
+    return colors[Math.floor(Math.random() * colors.length)];
+  };
+  
+  // 生成干扰线
+  const generateNoise = () => {
+    let noise = '';
+    for (let i = 0; i < 3; i++) {
+      const x1 = Math.random() * width;
+      const y1 = Math.random() * height;
+      const x2 = Math.random() * width;
+      const y2 = Math.random() * height;
+      noise += `<line x1="${x1}" y1="${y1}" x2="${x2}" y2="${y2}" stroke="${getRandomColor()}" stroke-width="1" opacity="0.3"/>`;
+    }
+    return noise;
+  };
+  
+  // 生成干扰点
+  const generateDots = () => {
+    let dots = '';
+    for (let i = 0; i < 20; i++) {
+      const x = Math.random() * width;
+      const y = Math.random() * height;
+      const r = Math.random() * 2 + 1;
+      dots += `<circle cx="${x}" cy="${y}" r="${r}" fill="${getRandomColor()}" opacity="0.4"/>`;
+    }
+    return dots;
+  };
+  
+  // 生成文字
+  let textElements = '';
+  const charWidth = width / text.length;
+  
+  for (let i = 0; i < text.length; i++) {
+    const char = text[i];
+    const x = charWidth * i + charWidth / 2;
+    const y = height / 2 + fontSize / 3;
+    const rotation = (Math.random() - 0.5) * 30; // 随机旋转角度
+    const color = getRandomColor();
+    
+    textElements += `
+      <text x="${x}" y="${y}" 
+            font-family="Arial, sans-serif" 
+            font-size="${fontSize}" 
+            font-weight="bold" 
+            fill="${color}" 
+            text-anchor="middle" 
+            transform="rotate(${rotation} ${x} ${y})">
+        ${char}
+      </text>`;
+  }
+  
+  const svg = `
+    <svg width="${width}" height="${height}" xmlns="http://www.w3.org/2000/svg">
+      <defs>
+        <linearGradient id="bg" x1="0%" y1="0%" x2="100%" y2="100%">
+          <stop offset="0%" style="stop-color:#f8f9fa;stop-opacity:1" />
+          <stop offset="100%" style="stop-color:#e9ecef;stop-opacity:1" />
+        </linearGradient>
+      </defs>
+      <rect width="${width}" height="${height}" fill="url(#bg)" stroke="#dee2e6" stroke-width="1"/>
+      ${generateNoise()}
+      ${generateDots()}
+      ${textElements}
+    </svg>`;
+  
+  return svg;
+}
+
+
+router.get('/generate', (req, res) => {
+  try {
+    // 生成验证码文本
+    const captchaText = generateCaptchaText();
+    
+    // 生成唯一ID
+    const captchaId = crypto.randomUUID();
+    
+    // 存储验证码（5分钟过期）
+    global.captchaStore.set(captchaId, {
+      text: captchaText.toLowerCase(), // 存储小写用于比较
+      expires: Date.now() + 5 * 60 * 1000 // 5分钟过期
+    });
+    
+    // 生成SVG图片
+    const svgImage = generateCaptchaSVG(captchaText);
+    res.json({
+      success: true,
+      data: {
+        captchaId,
+        image: `data:image/svg+xml;base64,${Buffer.from(svgImage).toString('base64')}`
+      }
+    });
+  } catch (error) {
+    console.error('生成验证码失败:', error);
+    res.status(500).json({
+      success: false,
+      message: '生成验证码失败'
+    });
+  }
+});
+
+
+router.post('/verify', (req, res) => {
+  try {
+    const { captchaId, captchaText } = req.body;
+    
+    if (!captchaId || !captchaText) {
+      return res.status(400).json({
+        success: false,
+        message: '验证码ID和验证码不能为空'
+      });
+    }
+    
+    // 获取存储的验证码
+    const storedCaptcha = global.captchaStore.get(captchaId);
+    
+    if (!storedCaptcha) {
+      return res.status(400).json({
+        success: false,
+        message: '验证码不存在或已过期'
+      });
+    }
+    
+    // 检查是否过期
+    if (Date.now() > storedCaptcha.expires) {
+      global.captchaStore.delete(captchaId);
+      return res.status(400).json({
+        success: false,
+        message: '验证码已过期'
+      });
+    }
+    
+    // 验证验证码（不区分大小写）
+    const isValid = storedCaptcha.text === captchaText.toLowerCase();
+    
+    // 验证后删除验证码（无论成功失败）
+    global.captchaStore.delete(captchaId);
+    
+    if (isValid) {
+      res.json({
+        success: true,
+        message: '验证码验证成功'
+      });
+    } else {
+      res.status(400).json({
+        success: false,
+        message: '验证码错误'
+      });
+    }
+  } catch (error) {
+    console.error('验证验证码失败:', error);
+    res.status(500).json({
+      success: false,
+      message: '验证验证码失败'
+    });
+  }
+});
+
+// 清理过期验证码的定时任务
+setInterval(() => {
+  const now = Date.now();
+  for (const [id, captcha] of global.captchaStore.entries()) {
+    if (now > captcha.expires) {
+      global.captchaStore.delete(id);
+    }
+  }
+}, 60 * 1000); // 每分钟清理一次
+
+// 导出验证函数供其他模块使用
+module.exports = router;
+module.exports.verifyCaptcha = (captchaId, captchaText) => {
+  const captcha = global.captchaStore.get(captchaId);
+  if (!captcha) {
+    return false; // 验证码不存在或已过期
+  }
+  
+  if (captcha.text.toLowerCase() !== captchaText.toLowerCase()) {
+    return false; // 验证码错误
+  }
+  
+  // 验证成功后删除验证码（一次性使用）
+  global.captchaStore.delete(captchaId);
+  return true;
+};

routes/common.js

@@ -0,0 +1,77 @@
+const express = require('express')
+const router = express.Router()
+const {getDB} = require('../database')
+
+/**
+ * @swagger
+ * /api/common/provinces:
+ * get:
+ *   summary: 获取省份列表
+ *   description: 获取省份列表
+ *   responses:
+ *     '200':
+ *         description: 成功获取分类列表
+ */
+router.get('/provinces', async (req, res) => {
+    try {
+        // 按level分组数据
+        const regionsByLevel = {
+            1: [], // 省份
+            2: [], // 城市
+            3: []  // 区县
+        };
+        if (!global.provinces) {
+            // 一次性获取所有区域数据（省、市、区县）
+            const [allRegions] = await getDB().execute(
+                `SELECT code, name as label, level, parent_code
+                 FROM china_regions
+                 WHERE level <= 3
+                 ORDER BY level, code`
+            );
+
+
+            // 创建code到region的映射，便于快速查找
+            const regionMap = {};
+
+            // 分组并建立映射
+            allRegions.forEach(region => {
+                region.children = []; // 初始化children数组
+                regionsByLevel[region.level].push(region);
+                regionMap[region.code] = region;
+            });
+
+            // 构建层级关系：先处理区县到城市的关系
+            regionsByLevel[3].forEach(district => {
+                const parentCity = regionMap[district.parent_code];
+                if (parentCity) {
+                    parentCity.children.push(district);
+                }
+            });
+
+            // 再处理城市到省份的关系
+            regionsByLevel[2].forEach(city => {
+                const parentProvince = regionMap[city.parent_code];
+                if (parentProvince) {
+                    parentProvince.children.push(city);
+                }
+            });
+            global.provinces = regionsByLevel[1];
+        } else {
+            console.log('1111')
+            regionsByLevel[1] = global.provinces;
+        }
+
+
+        // 返回省份数据（已包含完整的层级结构）
+        res.json({
+            success: true,
+            data: regionsByLevel[1]
+        });
+    } catch (error) {
+        console.error('获取省份列表错误:', error);
+        res.status(500).json({message: '获取省份列表失败'});
+    }
+});
+
+
+module.exports = router

routes/index.js

@@ -0,0 +1,6 @@
+var express = require('express');
+var router = express.Router();
+
+
+
+module.exports = router;

routes/users.js

@@ -0,0 +1,9 @@
+var express = require('express');
+var router = express.Router();
+
+/* GET users listing. */
+router.get('/',function(req, res, next) {
+  res.send('respond with a resource');
+});
+
+module.exports = router;