- H1: 支付宝响应验签 (verifyResponseSign + bracket-matching 提取签名内容) - H2/H3: EasyPay queryOrder 从 GET 改 POST,PKEY 不再暴露于 URL - H5: users/[id] IDOR 修复,校验当前用户只能查询自身信息 - H6: 限额校验移入 prisma.$transaction() 防止 TOCTOU 竞态 - C1: access_token 增加 24h 过期、userId 绑定、派生密钥分离 - M1: EasyPay 回调增加 pid 校验防跨商户注入 - M4: 充值码增加 crypto.randomBytes 随机后缀 - M5: 过期订单批量处理增加 BATCH_SIZE 限制 - M6: 退款失败增加 [CRITICAL] 日志和余额补偿标记 - M7: admin channels PUT 增加 Zod schema 校验 - M8: admin subscriptions 分页参数增加上限 - M9: orders src_url 限制 HTTP/HTTPS 协议 - L1: 微信支付回调时间戳 NaN 检查 - L9: WXPAY_API_V3_KEY 长度校验
56 lines
2.0 KiB
TypeScript
56 lines
2.0 KiB
TypeScript
import { NextRequest, NextResponse } from 'next/server';
|
|
import { verifyAdminToken, unauthorizedResponse } from '@/lib/admin-auth';
|
|
import { getUserSubscriptions, getUser, listSubscriptions } from '@/lib/sub2api/client';
|
|
|
|
export async function GET(request: NextRequest) {
|
|
if (!(await verifyAdminToken(request))) return unauthorizedResponse(request);
|
|
|
|
try {
|
|
const searchParams = request.nextUrl.searchParams;
|
|
const userId = searchParams.get('user_id');
|
|
const groupId = searchParams.get('group_id');
|
|
const status = searchParams.get('status');
|
|
const page = searchParams.get('page');
|
|
const pageSize = searchParams.get('page_size');
|
|
|
|
if (userId) {
|
|
// 按用户查询(原有逻辑)
|
|
const parsedUserId = Number(userId);
|
|
if (!Number.isFinite(parsedUserId) || parsedUserId <= 0) {
|
|
return NextResponse.json({ error: '无效的 user_id' }, { status: 400 });
|
|
}
|
|
|
|
const [subscriptions, user] = await Promise.all([
|
|
getUserSubscriptions(parsedUserId),
|
|
getUser(parsedUserId).catch(() => null),
|
|
]);
|
|
|
|
const filtered = groupId ? subscriptions.filter((s) => s.group_id === Number(groupId)) : subscriptions;
|
|
|
|
return NextResponse.json({
|
|
subscriptions: filtered,
|
|
user: user ? { id: user.id, username: user.username, email: user.email } : null,
|
|
});
|
|
}
|
|
|
|
// 无 user_id 时列出所有订阅
|
|
const result = await listSubscriptions({
|
|
group_id: groupId ? Number(groupId) : undefined,
|
|
status: status || undefined,
|
|
page: page ? Math.max(1, Number(page)) : undefined,
|
|
page_size: pageSize ? Math.min(200, Math.max(1, Number(pageSize))) : undefined,
|
|
});
|
|
|
|
return NextResponse.json({
|
|
subscriptions: result.subscriptions,
|
|
total: result.total,
|
|
page: result.page,
|
|
page_size: result.page_size,
|
|
user: null,
|
|
});
|
|
} catch (error) {
|
|
console.error('Failed to query subscriptions:', error);
|
|
return NextResponse.json({ error: '查询订阅信息失败' }, { status: 500 });
|
|
}
|
|
}
|