更新

backend/app/modules/auth/router.py

@@ -1,30 +1,32 @@
 """
 认证 API：注册、登录、登出、修改密码
 """
-from fastapi import APIRouter, HTTPException, Response, status, Request, Depends
+from fastapi import APIRouter, HTTPException, Response, status, Request, Depends
+from fastapi.responses import JSONResponse
 from pydantic import BaseModel, field_validator
-from app.core.security import (
-    get_password_hash,
-    verify_password,
-    create_access_token,
-    generate_session_token,
-    set_auth_cookie,
-    clear_auth_cookie,
-    decode_access_token
-)
-from app.repositories.sessions import create_session, delete_sessions
-from app.repositories.users import (
-    create_user,
-    get_user_by_id,
-    get_user_by_phone,
-    user_exists_by_phone,
-    update_user,
-    deactivate_user_if_expired,
-)
-from app.core.deps import get_current_user
-from app.core.response import success_response
+from app.core.security import (
+    get_password_hash,
+    verify_password,
+    create_access_token,
+    generate_session_token,
+    set_auth_cookie,
+    clear_auth_cookie,
+    decode_access_token,
+    create_payment_token,
+)
+from app.repositories.sessions import create_session, delete_sessions
+from app.repositories.users import (
+    create_user,
+    get_user_by_id,
+    get_user_by_phone,
+    user_exists_by_phone,
+    update_user,
+    deactivate_user_if_expired,
+)
+from app.core.deps import get_current_user
+from app.core.response import success_response
 from loguru import logger
-from typing import Optional, Any, cast
+from typing import Optional, Any, cast
 import re
 
 router = APIRouter(prefix="/api/auth", tags=["认证"])
@@ -84,26 +86,26 @@ async def register(request: RegisterRequest):
     注册后状态为 pending，需要管理员激活
     """
     try:
-        if user_exists_by_phone(request.phone):
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail="该手机号已注册"
-            )
+        if user_exists_by_phone(request.phone):
+            raise HTTPException(
+                status_code=status.HTTP_400_BAD_REQUEST,
+                detail="该手机号已注册"
+            )
         
         # 创建用户
         password_hash = get_password_hash(request.password)
         
-        create_user({
-            "phone": request.phone,
-            "password_hash": password_hash,
-            "username": request.username or f"用户{request.phone[-4:]}",
-            "role": "pending",
-            "is_active": False
-        })
+        create_user({
+            "phone": request.phone,
+            "password_hash": password_hash,
+            "username": request.username or f"用户{request.phone[-4:]}",
+            "role": "pending",
+            "is_active": False
+        })
         
         logger.info(f"新用户注册: {request.phone}")
         
-        return success_response(message="注册成功，请等待管理员审核激活")
+        return success_response(message="注册成功，请等待管理员审核激活")
     except HTTPException:
         raise
     except Exception as e:
@@ -124,12 +126,12 @@ async def login(request: LoginRequest, response: Response):
     - 实现"后踢前"单设备登录
     """
     try:
-        user = cast(dict[str, Any], get_user_by_phone(request.phone) or {})
-        if not user:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail="手机号或密码错误"
-            )
+        user = cast(dict[str, Any], get_user_by_phone(request.phone) or {})
+        if not user:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="手机号或密码错误"
+            )
         
         # 验证密码
         if not verify_password(request.password, user["password_hash"]):
@@ -138,27 +140,33 @@ async def login(request: LoginRequest, response: Response):
                 detail="手机号或密码错误"
             )
         
-        # 授权过期时自动停用账号
-        if deactivate_user_if_expired(user):
-            delete_sessions(user["id"])
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="会员已到期，请续费"
-            )
-
-        # 检查是否激活
-        if not user["is_active"]:
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="账号未激活，请等待管理员审核"
-            )
+        # 过期自动停用（注意：只更新 DB，不修改内存中的 user 字典）
+        expired = deactivate_user_if_expired(user)
+        if expired:
+            delete_sessions(user["id"])
+
+        # 过期 或 未激活（新注册）→ 返回付费指引
+        if expired or not user["is_active"]:
+            payment_token = create_payment_token(user["id"])
+            return JSONResponse(
+                status_code=403,
+                content={
+                    "success": False,
+                    "message": "请付费开通会员",
+                    "code": 403,
+                    "data": {
+                        "reason": "PAYMENT_REQUIRED",
+                        "payment_token": payment_token,
+                    }
+                }
+            )
         
         # 生成新的 session_token (后踢前)
         session_token = generate_session_token()
         
         # 删除旧 session，插入新 session
-        delete_sessions(user["id"])
-        create_session(user["id"], session_token, None)
+        delete_sessions(user["id"])
+        create_session(user["id"], session_token, None)
         
         # 生成 JWT Token
         token = create_access_token(user["id"], session_token)
@@ -168,19 +176,19 @@ async def login(request: LoginRequest, response: Response):
         
         logger.info(f"用户登录: {request.phone}")
         
-        return success_response(
-            data={
-                "user": UserResponse(
-                    id=user["id"],
-                    phone=user["phone"],
-                    username=user.get("username"),
-                    role=user["role"],
-                    is_active=user["is_active"],
-                    expires_at=user.get("expires_at")
-                ).model_dump()
-            },
-            message="登录成功",
-        )
+        return success_response(
+            data={
+                "user": UserResponse(
+                    id=user["id"],
+                    phone=user["phone"],
+                    username=user.get("username"),
+                    role=user["role"],
+                    is_active=user["is_active"],
+                    expires_at=user.get("expires_at")
+                ).model_dump()
+            },
+            message="登录成功",
+        )
     except HTTPException:
         raise
     except Exception as e:
@@ -192,10 +200,10 @@ async def login(request: LoginRequest, response: Response):
 
 
 @router.post("/logout")
-async def logout(response: Response):
-    """用户登出"""
-    clear_auth_cookie(response)
-    return success_response(message="已登出")
+async def logout(response: Response):
+    """用户登出"""
+    clear_auth_cookie(response)
+    return success_response(message="已登出")
 
 
 @router.post("/change-password")
@@ -223,12 +231,12 @@ async def change_password(request: ChangePasswordRequest, req: Request, response
         )
     
     try:
-        user = cast(dict[str, Any], get_user_by_id(token_data.user_id) or {})
-        if not user:
-            raise HTTPException(
-                status_code=status.HTTP_401_UNAUTHORIZED,
-                detail="用户不存在"
-            )
+        user = cast(dict[str, Any], get_user_by_id(token_data.user_id) or {})
+        if not user:
+            raise HTTPException(
+                status_code=status.HTTP_401_UNAUTHORIZED,
+                detail="用户不存在"
+            )
         
         # 验证当前密码
         if not verify_password(request.old_password, user["password_hash"]):
@@ -239,13 +247,13 @@ async def change_password(request: ChangePasswordRequest, req: Request, response
         
         # 更新密码
         new_password_hash = get_password_hash(request.new_password)
-        update_user(user["id"], {"password_hash": new_password_hash})
+        update_user(user["id"], {"password_hash": new_password_hash})
         
         # 生成新的 session token，使旧 token 失效
         new_session_token = generate_session_token()
         
-        delete_sessions(user["id"])
-        create_session(user["id"], new_session_token, None)
+        delete_sessions(user["id"])
+        create_session(user["id"], new_session_token, None)
         
         # 生成新的 JWT Token
         new_token = create_access_token(user["id"], new_session_token)
@@ -253,7 +261,7 @@ async def change_password(request: ChangePasswordRequest, req: Request, response
         
         logger.info(f"用户修改密码: {user['phone']}")
         
-        return success_response(message="密码修改成功")
+        return success_response(message="密码修改成功")
     except HTTPException:
         raise
     except Exception as e:
@@ -264,14 +272,14 @@ async def change_password(request: ChangePasswordRequest, req: Request, response
         )
 
 
-@router.get("/me")
-async def get_me(user: dict = Depends(get_current_user)):
-    """获取当前用户信息"""
-    return success_response(UserResponse(
-        id=user["id"],
-        phone=user["phone"],
-        username=user.get("username"),
-        role=user["role"],
-        is_active=user["is_active"],
-        expires_at=user.get("expires_at")
-    ).model_dump())
+@router.get("/me")
+async def get_me(user: dict = Depends(get_current_user)):
+    """获取当前用户信息"""
+    return success_response(UserResponse(
+        id=user["id"],
+        phone=user["phone"],
+        username=user.get("username"),
+        role=user["role"],
+        is_active=user["is_active"],
+        expires_at=user.get("expires_at")
+    ).model_dump())

backend/app/modules/payment/router.py

@@ -0,0 +1,52 @@
+"""
+支付 API：创建订单、异步通知、状态查询
+
+遵循 BACKEND_DEV.md 规范：router 只做参数校验、调用 service、返回统一响应
+"""
+from fastapi import APIRouter, HTTPException, Request, status
+from fastapi.responses import PlainTextResponse
+
+from app.core.response import success_response
+from .schemas import CreateOrderRequest, CreateOrderResponse, OrderStatusResponse
+from . import service
+
+router = APIRouter(prefix="/api/payment", tags=["支付"])
+
+
+@router.post("/create-order")
+async def create_payment_order(request: CreateOrderRequest):
+    """创建支付宝电脑网站支付订单，返回收银台 URL"""
+    try:
+        result = service.create_payment_order(request.payment_token)
+    except ValueError as e:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail=str(e))
+    except RuntimeError as e:
+        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail=str(e))
+
+    return success_response(
+        CreateOrderResponse(**result).model_dump()
+    )
+
+
+@router.post("/notify")
+async def payment_notify(request: Request):
+    """
+    支付宝异步通知回调
+
+    必须返回纯文本 "success"（不是 JSON），否则支付宝会重复推送。
+    """
+    form_data = await request.form()
+    verified = service.handle_payment_notify(dict(form_data))
+    return PlainTextResponse("success" if verified else "fail")
+
+
+@router.get("/status/{out_trade_no}")
+async def check_payment_status(out_trade_no: str):
+    """查询订单支付状态（前端轮询）"""
+    order_status = service.get_order_status(out_trade_no)
+    if order_status is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="订单不存在")
+
+    return success_response(
+        OrderStatusResponse(status=order_status).model_dump()
+    )

backend/app/modules/payment/schemas.py

@@ -0,0 +1,15 @@
+from pydantic import BaseModel
+
+
+class CreateOrderRequest(BaseModel):
+    payment_token: str
+
+
+class CreateOrderResponse(BaseModel):
+    pay_url: str
+    out_trade_no: str
+    amount: float
+
+
+class OrderStatusResponse(BaseModel):
+    status: str

backend/app/modules/payment/service.py

@@ -0,0 +1,137 @@
+"""
+支付业务服务
+
+职责：Alipay SDK 封装、创建订单、处理支付通知、查询状态
+遵循 BACKEND_DEV.md "薄路由 + 厚服务" 原则
+"""
+from datetime import datetime, timezone, timedelta
+import uuid
+
+from alipay import AliPay
+from loguru import logger
+
+from app.core.config import settings
+from app.core.security import decode_payment_token
+from app.repositories.orders import create_order, get_order_by_trade_no, update_order_status
+from app.repositories.users import update_user
+
+# 支付宝网关地址
+ALIPAY_GATEWAY = "https://openapi.alipay.com/gateway.do"
+ALIPAY_GATEWAY_SANDBOX = "https://openapi-sandbox.dl.alipaydev.com/gateway.do"
+
+
+def _get_alipay_client() -> AliPay:
+    """延迟初始化 Alipay 客户端"""
+    return AliPay(
+        appid=settings.ALIPAY_APP_ID,
+        app_notify_url=settings.ALIPAY_NOTIFY_URL,
+        app_private_key_string=open(settings.ALIPAY_PRIVATE_KEY_PATH).read(),
+        alipay_public_key_string=open(settings.ALIPAY_PUBLIC_KEY_PATH).read(),
+        sign_type="RSA2",
+        debug=settings.ALIPAY_SANDBOX,
+    )
+
+
+def _create_page_pay_url(out_trade_no: str, amount: float, subject: str) -> str | None:
+    """调用 alipay.trade.page.pay，返回支付宝收银台 URL"""
+    client = _get_alipay_client()
+    order_string = client.api_alipay_trade_page_pay(
+        subject=subject,
+        out_trade_no=out_trade_no,
+        total_amount=amount,
+        return_url=settings.ALIPAY_RETURN_URL,
+    )
+    if not order_string:
+        logger.error(f"电脑网站支付下单失败: {out_trade_no}")
+        return None
+
+    gateway = ALIPAY_GATEWAY_SANDBOX if settings.ALIPAY_SANDBOX else ALIPAY_GATEWAY
+    pay_url = f"{gateway}?{order_string}"
+    logger.info(f"电脑网站支付下单成功: {out_trade_no}")
+    return pay_url
+
+
+def _verify_signature(data: dict, signature: str) -> bool:
+    """验证支付宝异步通知签名"""
+    client = _get_alipay_client()
+    return client.verify(data, signature)
+
+
+def create_payment_order(payment_token: str) -> dict:
+    """
+    创建支付订单完整流程
+
+    Returns: {"pay_url": str, "out_trade_no": str, "amount": float}
+    Raises: ValueError (token 无效), RuntimeError (API 失败)
+    """
+    user_id = decode_payment_token(payment_token)
+    if not user_id:
+        raise ValueError("付费凭证无效或已过期，请重新登录")
+
+    out_trade_no = f"VG_{int(datetime.now().timestamp())}_{uuid.uuid4().hex[:8]}"
+    amount = settings.PAYMENT_AMOUNT
+
+    create_order(user_id, out_trade_no, amount)
+
+    pay_url = _create_page_pay_url(out_trade_no, amount, "IPAgent 会员开通")
+    if not pay_url:
+        raise RuntimeError("创建支付订单失败，请稍后重试")
+
+    logger.info(f"用户 {user_id} 创建支付订单: {out_trade_no}")
+
+    return {"pay_url": pay_url, "out_trade_no": out_trade_no, "amount": amount}
+
+
+def handle_payment_notify(form_data: dict) -> bool:
+    """
+    处理支付宝异步通知完整流程
+
+    Returns: True=验签通过, False=验签失败
+    """
+    data = dict(form_data)
+
+    signature = data.pop("sign", "")
+    data.pop("sign_type", None)
+
+    if not _verify_signature(data, signature):
+        logger.warning(f"支付宝通知验签失败: {data.get('out_trade_no')}")
+        return False
+
+    out_trade_no = data.get("out_trade_no", "")
+    trade_status = data.get("trade_status", "")
+    trade_no = data.get("trade_no", "")
+
+    logger.info(f"收到支付宝通知: {out_trade_no}, status={trade_status}, trade_no={trade_no}")
+
+    if trade_status not in ("TRADE_SUCCESS", "TRADE_FINISHED"):
+        return True
+
+    order = get_order_by_trade_no(out_trade_no)
+    if not order:
+        logger.warning(f"订单不存在: {out_trade_no}")
+        return True
+
+    if order["status"] == "paid":
+        logger.info(f"订单已处理过: {out_trade_no}")
+        return True
+
+    update_order_status(out_trade_no, "paid", trade_no)
+
+    user_id = order["user_id"]
+    expires_at = (datetime.now(timezone.utc) + timedelta(days=settings.PAYMENT_EXPIRE_DAYS)).isoformat()
+    update_user(user_id, {
+        "is_active": True,
+        "role": "user",
+        "expires_at": expires_at,
+    })
+
+    logger.success(f"用户 {user_id} 支付成功，已激活，有效期至 {expires_at}")
+    return True
+
+
+def get_order_status(out_trade_no: str) -> str | None:
+    """查询订单支付状态"""
+    order = get_order_by_trade_no(out_trade_no)
+    if not order:
+        return None
+    return order["status"]