v4.2 冲刺版+每日推送+支付修复+全量代码评审

## 新增功能 - 冲刺版 ¥49.9/月：完整支付→激活→权益扣减链路 - 每日一题定时推送（@nestjs/schedule，早8点微信订阅消息） - miniprogram-ci 编译上传脚本（scripts/upload-mp.js） ## Bug修复 - 套餐值统一：vip→growth/sprint（interview轮次限制、analyze次数检查） - member/pay 移除开发绕过：改为订单校验后激活 - progress→report 参数名不匹配：id→interviewId - result.vue resume.create() 参数传错（对象→独立参数） - resume.vue analyze请求缺少Authorization header - bank.vue contribution请求缺少Authorization header - member.vue startPay() 缺少try/catch导致网络错误崩溃 - login.vue 调试面板 v-if="true" 生产泄漏 ## 配置 - 微信支付生产证书就位（商户号1113760598） - .env 清理冗余文件（删除.example/.production） - WX_NOTIFY_URL 更新为 zhiyinwx.yzrcloud.cn ## 文档 - PROJECT-STATUS.md v4.1→v4.2，状态全面更新 - DEPLOYMENT.md 新增小程序编译上传章节、清理检查清单
2026-06-09 20:03:05 +08:00
parent 37cfdfe93c
commit 9276ab9028
44 changed files with 15205 additions and 2062 deletions
@@ -1,4 +1,4 @@
-import { Controller, Post, Get, Query, Body, UseGuards, HttpException, HttpStatus } from '@nestjs/common'
+import { Controller, Post, Get, Param, Query, Body, UseGuards, HttpException, HttpStatus, Logger, Req } from '@nestjs/common'
 import { InjectModel } from '@nestjs/mongoose'
 import { Model } from 'mongoose'
 import { User, UserDocument } from '../user/user.schema'
@@ -8,11 +8,14 @@ import { CurrentUser } from '../../common/decorators/current-user.decorator'
 import { WechatPayService } from './wechat-pay.service'
 import { Public } from '../../common/decorators/public.decorator'

-const VIP_AMOUNT = 1990 // 19.9 元（分）
+const GROWTH_AMOUNT = 1990  // 19.9 元（分）
+const SPRINT_AMOUNT = 4990  // 49.9 元（分）
 const VIP_DURATION_DAYS = 30

@Controller('payment')
 export class PaymentController {
+  private readonly logger = new Logger(PaymentController.name)
+
  constructor(
    @InjectModel(User.name) private userModel: Model<UserDocument>,
    @InjectModel(PaymentOrder.name) private orderModel: Model<PaymentOrderDocument>,
@@ -22,73 +25,68 @@ export class PaymentController {
  /** 创建订单（H5：Native 扫码支付） */
  @UseGuards(JwtAuthGuard)
  @Post('create')
-  async create(@CurrentUser('userId') userId: string) {
+  async create(@CurrentUser('userId') userId: string, @Body('plan') plan: string = 'growth') {
+    if (!['growth', 'sprint'].includes(plan)) throw new HttpException('无效套餐', HttpStatus.BAD_REQUEST)
    const user = await this.userModel.findById(userId).exec()
    if (!user) throw new HttpException('用户不存在', HttpStatus.NOT_FOUND)
-    if (user.plan === 'vip') throw new HttpException('已是会员', HttpStatus.BAD_REQUEST)
+    if (user.plan !== 'free') throw new HttpException('已是会员', HttpStatus.BAD_REQUEST)

-    const outTradeNo = `VIP${Date.now()}${userId.slice(-6)}`
-    const result = await this.wechatPay.nativePay('AI磁场月度会员', outTradeNo, VIP_AMOUNT)
+    const amount = plan === 'sprint' ? SPRINT_AMOUNT : GROWTH_AMOUNT
+    const title = plan === 'sprint' ? '职引冲刺版月度会员' : '职引成长版月度会员'
+    const outTradeNo = `${plan === 'sprint' ? 'SPR' : 'VIP'}${Date.now()}${userId.slice(-6)}`
+    const result = await this.wechatPay.nativePay(title, outTradeNo, amount)

-    // 保存订单
-    await this.orderModel.create({
-      outTradeNo,
-      userId,
-      userPhone: user.phone || '',
-      amount: VIP_AMOUNT,
-      title: 'AI磁场月度会员',
-      status: 'pending',
-      channel: 'native',
-    })
+    await this.orderModel.create({ outTradeNo, userId, userPhone: user.phone || '', amount, title, status: 'pending', channel: 'native', plan })

-    return {
-      outTradeNo,
-      codeUrl: result.codeUrl,
-      amount: VIP_AMOUNT,
-      title: 'AI磁场月度会员',
-    }
+    return { outTradeNo, codeUrl: result.codeUrl, amount, title }
  }

  /** JSAPI 支付（微信小程序） */
  @UseGuards(JwtAuthGuard)
  @Post('jsapi')
-  async jsapi(@CurrentUser('userId') userId: string, @Body('openid') openid: string) {
+  async jsapi(@CurrentUser('userId') userId: string, @Body('plan') plan: string = 'growth') {
+    if (!['growth', 'sprint'].includes(plan)) throw new HttpException('无效套餐', HttpStatus.BAD_REQUEST)
    const user = await this.userModel.findById(userId).exec()
    if (!user) throw new HttpException('用户不存在', HttpStatus.NOT_FOUND)
-    if (!openid) throw new HttpException('缺少 openid', HttpStatus.BAD_REQUEST)
-    if (user.plan === 'vip') throw new HttpException('已是会员', HttpStatus.BAD_REQUEST)
+    if (user.plan !== 'free') throw new HttpException('已是会员', HttpStatus.BAD_REQUEST)
+    const openid = user.wxOpenid
+    if (!openid) throw new HttpException('未绑定微信', HttpStatus.BAD_REQUEST)

-    const outTradeNo = `VIP${Date.now()}${userId.slice(-6)}`
-    const result = await this.wechatPay.jsapiPay('AI磁场月度会员', outTradeNo, VIP_AMOUNT, openid)
+    const amount = plan === 'sprint' ? SPRINT_AMOUNT : GROWTH_AMOUNT
+    const title = plan === 'sprint' ? '职引冲刺版月度会员' : '职引成长版月度会员'
+    const outTradeNo = `${plan === 'sprint' ? 'SPR' : 'VIP'}${Date.now()}${userId.slice(-6)}`
+    const result = await this.wechatPay.jsapiPay(title, outTradeNo, amount, openid)

-    // 保存订单
-    await this.orderModel.create({
-      outTradeNo,
-      userId,
-      userPhone: user.phone || '',
-      amount: VIP_AMOUNT,
-      title: 'AI磁场月度会员',
-      status: 'pending',
-      channel: 'jsapi',
-    })
+    await this.orderModel.create({ outTradeNo, userId, userPhone: user.phone || '', amount, title, status: 'pending', channel: 'jsapi', plan })

-    return result
+    return { ...result, outTradeNo }
  }

  /** 支付回调通知 */
  @Public()
  @Post('notify')
-  async notify(@Body() body: any) {
+  async notify(
+    @Body() body: any,
+    @Req() req: any,
+  ) {
    try {
-      const decrypted = this.wechatPay.verifyAndDecrypt(body, '', '', '')
+      const wechatSignature = req.headers['wechatpay-signature'] || ''
+      const wechatTimestamp = req.headers['wechatpay-timestamp'] || ''
+      const wechatNonce = req.headers['wechatpay-nonce'] || ''
+      const decrypted = this.wechatPay.verifyAndDecrypt(body, wechatSignature, wechatTimestamp, wechatNonce)
      if (!decrypted) return { code: 'FAIL', message: '验签失败' }

      const outTradeNo = decrypted.out_trade_no
      const wxTransactionId = decrypted.transaction_id

-      // 更新订单状态
+      // 从数据库订单查找 userId，而非从 outTradeNo 解析
      const order = await this.orderModel.findOne({ outTradeNo }).exec()
-      if (order && order.status === 'pending') {
+      if (!order) {
+        this.logger.warn(`支付回调：订单不存在 ${outTradeNo}`)
+        return { code: 'FAIL', message: '订单不存在' }
+      }
+
+      if (order.status === 'pending') {
        order.status = 'success'
        order.paidAt = new Date()
        order.wxTransactionId = wxTransactionId
@@ -96,19 +94,25 @@ export class PaymentController {
        await order.save()
      }

-      // 开通会员
-      const userId = outTradeNo.slice(-6)
-      const user = await this.userModel.findOne({ _id: { $regex: userId + '$' } }).exec()
-      if (user && user.plan !== 'vip') {
+      // 根据订单 plan 激活对应套餐
+      const user = await this.userModel.findById(order.userId).exec()
+      if (user && user.plan === 'free') {
        const expireAt = new Date()
        expireAt.setDate(expireAt.getDate() + VIP_DURATION_DAYS)
-        user.plan = 'vip'
-        user.vipExpireAt = expireAt
+        if (order.plan === 'sprint') {
+          user.plan = 'sprint'
+          user.sprintExpireAt = expireAt
+          user.sprintRemaining = 10   // 每月 10 次冲刺权益（语音分析+缺口分析）
+        } else {
+          user.plan = 'growth'
+          user.vipExpireAt = expireAt
+        }
        user.remaining = 999
        await user.save()
      }
      return { code: 'SUCCESS', message: '成功' }
-    } catch {
+    } catch (e) {
+      this.logger.error(`支付回调处理失败: ${e.message}`)
      return { code: 'FAIL', message: '处理失败' }
    }
  }
@@ -119,4 +123,39 @@ export class PaymentController {
  async query(@Body('outTradeNo') outTradeNo: string) {
    return this.wechatPay.queryOrder(outTradeNo)
  }
+
+  /** 检查本地订单状态（前端轮询） */
+  @UseGuards(JwtAuthGuard)
+  @Get('check/:outTradeNo')
+  async checkOrder(@Param('outTradeNo') outTradeNo: string, @CurrentUser('userId') userId: string) {
+    const order = await this.orderModel.findOne({ outTradeNo, userId }).exec()
+    if (!order) throw new HttpException('订单不存在', HttpStatus.NOT_FOUND)
+    return { status: order.status, plan: order.plan }
+  }
+
+  /** 凭订单号激活套餐（前端支付成功后调用，兜底） */
+  @UseGuards(JwtAuthGuard)
+  @Post('activate')
+  async activate(@CurrentUser('userId') userId: string, @Body('outTradeNo') outTradeNo: string) {
+    const order = await this.orderModel.findOne({ outTradeNo, userId }).exec()
+    if (!order) throw new HttpException('订单不存在', HttpStatus.NOT_FOUND)
+    if (order.status !== 'success') throw new HttpException('支付未完成', HttpStatus.BAD_REQUEST)
+    const user = await this.userModel.findById(userId).exec()
+    if (!user) throw new HttpException('用户不存在', HttpStatus.NOT_FOUND)
+    if (user.plan !== 'free') return { success: true, plan: user.plan, message: '已是会员' }
+
+    const expireAt = new Date()
+    expireAt.setDate(expireAt.getDate() + VIP_DURATION_DAYS)
+    if (order.plan === 'sprint') {
+      user.plan = 'sprint'
+      user.sprintExpireAt = expireAt
+      user.sprintRemaining = 10
+    } else {
+      user.plan = 'growth'
+      user.vipExpireAt = expireAt
+    }
+    user.remaining = 999
+    await user.save()
+    return { success: true, plan: user.plan }
+  }
 }