Commit Graph

11 Commits

Author SHA1 Message Date
TradeMate Dev 13e3992d4c fix: security and code quality improvements
Security fixes:
- Add file upload size limits (10MB) for customer and product imports
- Add XLSX file validation with row limits and magic byte checking
- Implement password validation (min 6 chars) in registration
- Add rate limiting for guest login (5 per IP per 15 minutes)
- Sanitize error messages to prevent information leakage
- Fix XSS vulnerability by removing unsafe v-html usage
- Enforce WhatsApp webhook signature verification
- Add SSRF protection with URL validation and IP blocking
- Fix marketing endpoints to use proper authentication

Code quality improvements:
- Create shared utility functions for UUID validation and string sanitization
- Remove duplicate UUID validation code from admin modules
- Remove dead code (pass statement in translation.py)
- Fix aliyun SDK import compatibility
2026-06-11 17:54:07 +08:00
TradeMate Dev d2736d1ef6 feat: AI routing DB-driven, payment gateway full integration, WeChat mini-program CI/CD
- AI routing rules now stored in system_configs DB table instead of hardcoded config
- Multi-model support via name|model composite key for same-provider routing
- UnifiedPayService with HMAC-SHA256 gateway integration (alipay/wechat)
- Admin payment panel: list, stats, search, filter, refund
- WeChat mini-program CI/CD via miniprogram-ci (v1.0.9)
- Translation quota extended to LLM provider tier
- SearchService with DB-driven provider config (bing/google_cse/searxng)
- Footer cleanup across admin/workspace/uni-app
- Private key excluded from git tracking
2026-06-09 17:19:45 +08:00
TradeMate Dev f17a6ccbac chore: post-deployment cleanup and docs update
- Make AI routing rules DB-driven (read from system_configs, removed from config.py)
- Add translation quota tracking to LLM translation (OpenAIProvider)
- Add Alibaba MT ECS RAM role support (STS token, no AccessKey needed)
- Fix admin sidebar link for AI模型配置 page
- Fix Quota.vue API path (quotas → translation-quotas)
- Fix login auto-redirect to dashboard
- Add provider dropdown selects to AI routing config UI
- Clean up stale ai_provider_* system_configs records
- Remove OpencodeGo, Spark providers (code + DB)
- Update deploy config: nginx port 8000, systemd cwd
2026-06-02 15:40:02 +08:00
TradeMate Dev 4122571f86 fix: friendly Chinese error messages on login/register pages
Map backend English error details to user-facing Chinese text on all
3 frontends (uni-app, user-frontend, admin-frontend). Previously raw
English like 'Invalid credentials' was shown directly to users.
2026-05-30 09:06:01 +08:00
TradeMate Dev 3e39cf0170 refactor: replace direct WeChat/Alipay with unified pay-api gateway
Switch from direct WeChat Pay / Alipay integrations to the unified
宇之然 pay-api gateway (HMAC-SHA256 auth). Removes wechat_pay.py,
keeps PaymentGateway abstraction, adds UnifiedPayService. Simplifies
payment.py create_order to {plan, pay_type} params. Single webhook
endpoint replaces separate WeChat/Alipay notify handlers.
2026-05-29 18:36:50 +08:00
TradeMate Dev bc48c220a0 Add user-friendly loading feedback for all AI/long-running operations
- Discovery: show '搜索中约需30-60秒' message, auto-save to history, timeout hint
- Discovery extract/outreach: show '正在分析网站/生成文案' loading message
- Translate: inline '翻译中...' placeholder while waiting
- Marketing: inline 'AI 生成中...' placeholder, success feedback
- Quotations AI: inline progress text + ElMessage.info during generation
- Analytics: add v-loading skeleton with '加载数据分析中...'
- Notifications: add v-loading skeleton with '加载通知中...'
- Followup: wire up '扫描跟进提醒' button with AI progress indicator
2026-05-27 16:22:07 +08:00
TradeMate Dev c1638db6b2 Add discovery search history with auto-save, fix timeout causing search failure
- Save every search result to DB for later review
- Add '搜索历史' tab with timeline view, load/delete records
- Raise discovery search timeout from 30s to 120s (Bing Puppeteer needs ~40s)
- Reduce search queries from 4 to 3 for faster response
- New model: DiscoveryRecord (user_id, product, market, companies JSON)
- API: POST/GET/DELETE /api/v1/discovery/records
- Migration: discovery_records table
2026-05-27 15:54:50 +08:00
TradeMate Dev 6f0d8b0fb4 Add contact extraction for discovery results: click to scrape email/phone/WhatsApp/WeChat from company website 2026-05-27 11:24:03 +08:00
TradeMate Dev ab06990e73 Fix API errors and improve customer discovery with real web results
- Fix usage/stats 500: use Date() not datetime.date() for SQL cast
- Fix customers 422: raise size limit to 1000
- Replace unreliable MCP client with direct Bing batch search for discovery
- Batch all search queries in one browser session (faster)
- Show real company names/URLs from Bing, not generic templates
- Smart filter for non-business results (news, blogs, forums)
- Fallback suggestions when search results are insufficient
- Frontend: clickable contact URLs, provider indicator, better layout
2026-05-27 10:29:23 +08:00
TradeMate Dev bed5c7abef Add landing page, referral system, usage quotas, search API management, and yearly pricing
- Separate workspace landing from login for better UX
- Referral system rewards both parties with Pro days
- Quota enforcement prevents abuse without breaking endpoints
- 7-day free trial with auto-downgrade on expiry
- Admin-managed search provider config (SearXNG, Bing)
- 15% discount on annual subscriptions
- MCP search server wrapping opencode search
- Fix discovery module field name mismatch causing 422
2026-05-26 11:40:13 +08:00
TradeMate Dev 52dba37f22 Add admin-frontend and user-frontend standalone projects, certification/invoice/discovery features, fix auth header and theme consistency 2026-05-22 18:35:30 +08:00