2 Commits

Author	SHA1	Message	Date
erio	c41933db70	security: 隐私接口全面加固，统一 token 鉴权 ... - /api/orders/[id] 只返回 id/status/expiresAt，移除 user_name/pay_url 等隐私字段 - /api/orders/[id]/cancel 改为 token 鉴权，服务端验证用户身份后执行取消 - /api/orders (POST 响应) 过滤 userName/userBalance，不向客户端暴露 - /api/user 移除 username/email/balance，只返回 id/status 和 config - /api/users/[id] 只返回 {id, exists}，不暴露任何隐私信息 - pay/page.tsx 恢复从服务端动态获取 config，无 token 时只显示用户 ID - pay/orders/page.tsx 无 token 时不查询隐私接口，统一按钮样式 - PaymentQRCode 新增 token prop，无 token 时隐藏取消按钮 - 创建订单失败改为中文错误提示	2026-03-01 19:25:14 +08:00
erio	d5719bf213	feat: migrate payment provider to easy-pay, add order history and refund support ... - Replace zpay with easy-pay payment provider (new lib/easy-pay/ module) - Add order history page for users (pay/orders) - Add GET /api/orders/my endpoint to list user's own orders - Add GET /api/users/[id] endpoint for sub2api user lookup - Add order status tracking module (lib/order/status.ts) - Update config to support easy-pay credentials (merchant ID, key, gateway) - Update PaymentForm and PaymentQRCode components for easy-pay flow - Update pay page and admin page with new order management UI - Update order service to support easy-pay, cancellation, and refund	2026-03-01 03:04:24 +08:00