diff --git a/README.md b/README.md index 2dc32612..6f05c60c 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,7 @@ - `apps/api` 独立业务 API，后续供 H5、Taro 小程序、管理后台统一调用；已支持 Supabase Auth JWT 和迁移期 `tk_` session 双入口。 - 租户后台能力：品牌、主题模板/草稿/发布、域名、公开设置、支付账户、登录配置、私密密钥掩码、活动内容、考试日期、题目反馈处理、激活码、优惠券规则/核销报表、勋章管理/手动发放/签到积分反馈自动发放、成员权限、自定义角色模板、班级/教师/学生范围权限、学生批量导入、批量分班、学生备注、跟进任务、审计日志。 - 租户内容能力：可配置题库入口、任意深度分类树、考试意向标记、题目集合、顺序/随机/全真模拟蓝图、题目录入/更新、视频绑定、分数线、单词、知识手册、资料资源台账、题目/单词/知识手册/分数线/视频 JSON/CSV/Excel 批量导入。 -- 学生端能力：题库入口、分类树、题目集合、顺序/随机/模考 session 组卷快照、答题、错题本、收藏夹、背单词卡片学习/发音/收藏练习、个人中心、勋章、考试倒计时、签到积分、题目反馈、排行榜、分数线、AI 择校推荐、题目视频、订单详情/状态轮询、优惠券领取/抵扣、权益、激活码预检查/兑换、资料下载；签到、积分阈值和反馈解决可返回自动获得勋章结果。 +- 学生端能力：题库入口、分类树、题目集合、顺序/随机/模考 session 组卷快照、答题、错题本、收藏夹、背单词卡片学习/发音/收藏练习、个人中心、勋章、考试倒计时、签到积分、积分活动任务、积分兑换、题目反馈、排行榜、分数线、AI 择校推荐、题目视频、订单详情/状态轮询、优惠券领取/抵扣、权益、激活码预检查/兑换、资料下载；签到、积分阈值、反馈解决和积分活动可返回自动获得勋章结果。 - 平台后台能力：租户管理、SaaS 套餐、订阅、账单、服务费收款、用量记录、公共题库授权。 - 公共题库商业化能力：租户可采纳平台授权题库为本租户副本，并可手动或由 worker 自动同步平台新增/更新题目；同步会保护租户自改题目，返回冲突而不覆盖，后台可查询冲突明细。 - 题库导出能力：租户内容编辑可按题目集合、内容入口或分类节点导出 JSON、`paper_json`、打印 payload、PDF、Word 和每日一练图片 ZIP 素材包，后端强制租户隔离、答案/解析开关、复合题子题脱敏、导出 job 和审计；PDF/Word/ZIP 由 exports worker 生成水印文件或运营素材并发布到 `content_assets`；`daily_practice` 支持每日一练九宫格 metadata、PDF/Word 版式、9 张 PNG/SVG 卡片和拼图包。 @@ -34,7 +34,7 @@ - Excel/CSV 导入解析已完成并复用 `content_import_jobs/items/issues` 管线；大批量异步导入 worker 基础已接入，支持 queued job 消费、重试和审计；导入后复检、模板下载和字段映射 API 已完成，前端 UI 待接。 - 题库导出已完成服务端结构化 payload、PDF/Word 二进制 worker、每日一练基础导出和每日一练 ZIP 图片素材包；后续还要补更精细试卷模板、多模板排版和导出操作台体验。 - 优惠券复杂规则和核销报表已可联调，包含状态启停、活动分组、最低订单金额、优惠封顶、单用户限次、首单限制、适用套餐/地区、核销明细和活动报表；Taro 租户营销中心已接优惠券规则表单、筛选、核销明细和报表第一版。 -- 勋章管理、手动发放、签到连续天数、积分阈值和反馈解决自动发放已可联调；练习次数、单词掌握、模考成绩、积分兑换/活动任务联动、发放通知、分佣真实打款 provider、发票、批量凭证上传、CRM 富卡片模板、失败告警、死信运营台、销售转化看板、公共题库版本通知和冲突处理操作台还没完成。 +- 勋章管理、手动发放、签到连续天数、积分阈值、反馈解决和积分活动任务自动发放已可联调；积分活动任务、积分兑换商品、兑换订单、优惠券兑换履约和租户后台配置第一阶段已完成。后续还要补连续签到奖励规则、练习次数/单词掌握/模考成绩系统触发勋章、发放通知、积分风控报表、分佣真实打款 provider、发票、批量凭证上传、CRM 富卡片模板、失败告警、死信运营台、销售转化看板、公共题库版本通知和冲突处理操作台。 - `apps/taro` 已建立 Taro 4 React 跨端前端地基，包含 H5 学生端、租户后台、平台后台三套构建入口、租户解析、统一 API client 和 Supabase Auth client 初始化；学生端第一批页面已接入登录、首页、题库、练习、背单词、知识手册、分数线、AI 择校推荐、资料和个人中心，已新增 `RichContent` 安全渲染组件用于题干、选项、解析、知识手册和逐题复盘，H5 端已用 KaTeX 渲染 `$...$`、`$$...$$`、`\(...\)`、`\[...\]` 公式，私有题图可用 `asset:`/`content_asset:` 资源引用走短期预览签名，已升级背单词为今日计划/单元学习/收藏练习、卡片翻转、发音、美/英音切换和本地位置恢复第一版，资料页已补齐预览/下载的短签名、水印 traceId 和强制水印容器第一版，个人中心已接学习报告、14 天趋势、题型表现、最近练习和 7 日答题榜当前排名第一版；租户后台第一批页面已接入工作台、数据看板、学生/班级、题库内容、营销中心、财务运营和租户设置，营销中心已接 CRM、分佣结算、优惠券规则/核销报表，财务运营已接退款状态机、官方账单任务、对账异常、差错工单和调整凭证第一版，设置页已接主题模板、草稿预览/发布、角色模板和成员绑定第一版；平台后台已接入工作台、租户管理、账务中心、公共题库授权，以及创建租户、状态变更、订阅、账单、收款、用量和题库授权第一版写操作。 - 根目录已清理为新 Supabase SaaS monorepo 编排层；旧 PocketBase/React 项目和旧构建产物仅保留在 `参考/` 目录作为迁移参考，不进入 Git 提交。 @@ -430,7 +430,7 @@ git diff --check 优先继续补： 1. 真实云端 Auth/JWKS 回归、RLS 深测和生产环境配置验收。 -2. 继续补 Taro 前端：学生端小程序公式真机验收、题图资源后台字段化、个人中心任务系统、背单词更细统计、小程序支付与分享，租户后台更细导入体验/数据范围 UI/主题素材库/财务复核细节，平台后台租户详情/审计/自动计费增强，小程序兼容验证。 +2. 继续补 Taro 前端：学生端小程序公式真机验收、题图资源后台字段化、个人中心积分任务/兑换 UI、背单词更细统计、小程序支付与分享，租户后台积分任务/兑换操作台、更细导入体验/数据范围 UI/主题素材库/财务复核细节，平台后台租户详情/审计/自动计费增强，小程序兼容验证。 3. 对象存储真实 AV/内容安全扫描服务联调、CDN 防盗链、转码/CDN 级水印和生命周期策略。 4. 题库导出模板精排、导出操作台、真实数据 dry-run、导入字段映射 UI 和复检结果操作台。 -5. 真实 OAuth/短信/支付生产账号联调、真实生产账单抽样验收、真实打款 provider、发票、公共题库版本通知/冲突处理操作台、积分兑换和活动任务深化，以及排行榜防刷/预聚合。 +5. 真实 OAuth/短信/支付生产账号联调、真实生产账单抽样验收、真实打款 provider、发票、公共题库版本通知/冲突处理操作台、积分活动风控和连续签到奖励深化，以及排行榜防刷/预聚合。 diff --git a/apps/api/src/features/profile/badges.ts b/apps/api/src/features/profile/badges.ts index 2d6073da..c6cb60f2 100644 --- a/apps/api/src/features/profile/badges.ts +++ b/apps/api/src/features/profile/badges.ts @@ -2,7 +2,7 @@ import type pg from 'pg'; type JsonMap = Record; -export type BadgeTrigger = 'check_in' | 'score' | 'feedback_resolved'; +export type BadgeTrigger = 'check_in' | 'score' | 'feedback_resolved' | 'activity_reward'; export interface BadgeMetricEvidence { checkInStreak?: number; @@ -55,6 +55,7 @@ const TRIGGER_UNLOCK_TYPES: Record = { check_in: ['check_in'], score: ['score'], feedback_resolved: ['feedback_resolved'], + activity_reward: ['activity_reward'], }; const FIELD_ALIASES: Record = { @@ -63,6 +64,7 @@ const FIELD_ALIASES: Record = { score: ['score', 'user.score', 'profile.score'], feedback_resolved: ['feedbackResolvedCount', 'feedback.resolvedCount', 'reports.resolvedCount'], reward_points: ['rewardPoints', 'feedback.rewardPoints'], + activity_reward: ['activityRewardCount', 'activity.rewardCount', 'tasks.claimCount'], }; function numberValue(value: unknown) { @@ -84,6 +86,7 @@ function metricValueForField(field: string | null, evidence: BadgeMetricEvidence if (trigger === 'check_in') return numberValue(evidence.checkInStreak); if (trigger === 'score') return numberValue(evidence.score); if (trigger === 'feedback_resolved') return numberValue(evidence.feedbackResolvedCount); + if (trigger === 'activity_reward') return numberValue(evidence.activityRewardCount); return null; } @@ -94,6 +97,7 @@ function metricValueForField(field: string | null, evidence: BadgeMetricEvidence if (canonical === 'score') return numberValue(evidence.score); if (canonical === 'feedback_resolved') return numberValue(evidence.feedbackResolvedCount); if (canonical === 'reward_points') return numberValue(evidence.rewardPoints); + if (canonical === 'activity_reward') return numberValue(evidence.activityRewardCount); } } diff --git a/apps/api/src/features/profile/index.ts b/apps/api/src/features/profile/index.ts index e8f920f9..05188b71 100644 --- a/apps/api/src/features/profile/index.ts +++ b/apps/api/src/features/profile/index.ts @@ -9,12 +9,22 @@ import { submitFeedbackRoute, updateProfileMeRoute, } from './routes.js'; +import { + activityTasksRoute, + claimActivityTaskRoute, + exchangeItemsRoute, + redeemExchangeItemRoute, +} from './points.js'; export const profileRoutes: RouteDefinition[] = [ ['GET', '/api/profile/me', profileMeRoute], ['PATCH', '/api/profile/me', updateProfileMeRoute], ['POST', '/api/profile/check-in', checkInRoute], ['GET', '/api/profile/score-events', scoreEventsRoute], + ['GET', '/api/profile/activity-tasks', activityTasksRoute], + ['POST', '/api/profile/activity-tasks/claim', claimActivityTaskRoute], + ['GET', '/api/profile/exchange-items', exchangeItemsRoute], + ['POST', '/api/profile/exchange-items/redeem', redeemExchangeItemRoute], ['GET', '/api/profile/badges', profileBadgesRoute], ['GET', '/api/profile/feedbacks', feedbacksRoute], ['POST', '/api/profile/feedbacks', submitFeedbackRoute], diff --git a/apps/api/src/features/profile/points.ts b/apps/api/src/features/profile/points.ts new file mode 100644 index 00000000..f4d6a4ce --- /dev/null +++ b/apps/api/src/features/profile/points.ts @@ -0,0 +1,789 @@ +import { randomUUID } from 'node:crypto'; +import type pg from 'pg'; +import { HttpError, type RequestContext } from '../../core/http.js'; +import { intParam, readJsonBody, stringParam, tenantIdFrom, userIdFrom } from '../../core/request.js'; +import { query, transaction } from '../../core/db.js'; +import { autoGrantBadges } from './badges.js'; + +type JsonMap = Record; + +const TASK_TYPES = [ + 'daily_check_in', + 'feedback_submit', + 'feedback_resolved', + 'practice_complete', + 'vocabulary_review', + 'mock_exam_submit', + 'manual', +]; +const PERIOD_TYPES = ['once', 'daily', 'weekly', 'monthly', 'unlimited']; +const STUDENT_CLAIMABLE_TASK_TYPES = new Set(['manual', 'practice_complete', 'vocabulary_review', 'mock_exam_submit']); + +function nullableString(value: unknown) { + return typeof value === 'string' && value.trim() ? value.trim() : null; +} + +function objectValue(value: unknown): JsonMap { + return value && typeof value === 'object' && !Array.isArray(value) ? value as JsonMap : {}; +} + +function optionalUuidString(value: unknown, key: string) { + const candidate = nullableString(value); + if (!candidate) return null; + if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(candidate)) { + throw new HttpError(400, `${key} must be a UUID`, 'INVALID_UUID'); + } + return candidate; +} + +function shanghaiDateParts(date = new Date()) { + const formatter = new Intl.DateTimeFormat('en-US', { + timeZone: 'Asia/Shanghai', + year: 'numeric', + month: '2-digit', + day: '2-digit', + }); + return Object.fromEntries(formatter.formatToParts(date).map(part => [part.type, part.value])) as { + year: string; + month: string; + day: string; + }; +} + +function shanghaiDateKey(date = new Date()) { + const parts = shanghaiDateParts(date); + return `${parts.year}-${parts.month}-${parts.day}`; +} + +function shanghaiWeekKey(date = new Date()) { + const current = new Date(`${shanghaiDateKey(date)}T00:00:00.000Z`); + const day = current.getUTCDay() || 7; + current.setUTCDate(current.getUTCDate() + 4 - day); + const yearStart = new Date(Date.UTC(current.getUTCFullYear(), 0, 1)); + const week = Math.ceil((((current.getTime() - yearStart.getTime()) / 86_400_000) + 1) / 7); + return `${current.getUTCFullYear()}-W${String(week).padStart(2, '0')}`; +} + +function safeIdempotencyText(value: unknown) { + const candidate = nullableString(value); + if (!candidate) return null; + if (!/^[a-zA-Z0-9:_-]{8,120}$/.test(candidate)) { + throw new HttpError(400, 'idempotencyKey contains unsupported characters', 'INVALID_IDEMPOTENCY_KEY'); + } + return candidate; +} + +function periodKey(periodType: string, taskId: string, idempotencyKey: string | null = null) { + if (periodType === 'daily') return shanghaiDateKey(); + if (periodType === 'weekly') return shanghaiWeekKey(); + if (periodType === 'monthly') { + const parts = shanghaiDateParts(); + return `${parts.year}-${parts.month}`; + } + if (periodType === 'unlimited') return `claim:${idempotencyKey || randomUUID()}`; + return `once:${taskId}`; +} + +function normalizeTaskType(value: unknown) { + const candidate = nullableString(value) || 'manual'; + if (!TASK_TYPES.includes(candidate)) throw new HttpError(400, `Invalid taskType: ${candidate}`, 'INVALID_TASK_TYPE'); + return candidate; +} + +function normalizePeriodType(value: unknown) { + const candidate = nullableString(value) || 'once'; + if (!PERIOD_TYPES.includes(candidate)) throw new HttpError(400, `Invalid periodType: ${candidate}`, 'INVALID_PERIOD_TYPE'); + return candidate; +} + +function assertActiveWindow(row: { status: string; validFrom: string | null; validTo: string | null }, type: 'task' | 'item') { + if (row.status !== 'active') { + throw new HttpError(409, `${type} is not active`, type === 'task' ? 'POINT_TASK_INACTIVE' : 'POINT_EXCHANGE_ITEM_INACTIVE'); + } + const now = Date.now(); + if (row.validFrom && now < new Date(row.validFrom).getTime()) { + throw new HttpError(409, `${type} is not available yet`, type === 'task' ? 'POINT_TASK_NOT_STARTED' : 'POINT_EXCHANGE_ITEM_NOT_STARTED'); + } + if (row.validTo && now > new Date(row.validTo).getTime()) { + throw new HttpError(409, `${type} is expired`, type === 'task' ? 'POINT_TASK_EXPIRED' : 'POINT_EXCHANGE_ITEM_EXPIRED'); + } +} + +async function loadTaskForClaim(client: pg.PoolClient, tenantId: string, body: JsonMap) { + const taskId = optionalUuidString(body.taskId, 'taskId'); + const code = nullableString(body.code); + if (!taskId && !code) throw new HttpError(400, 'taskId or code is required', 'POINT_TASK_REQUIRED'); + + const result = await client.query<{ + id: string; + code: string; + title: string; + description: string | null; + taskType: string; + rewardPoints: number; + claimLimitPerUser: number; + periodType: string; + validFrom: string | null; + validTo: string | null; + status: string; + metadata: JsonMap; + }>( + ` + select id, code::text, title, description, task_type as "taskType", + reward_points as "rewardPoints", claim_limit_per_user as "claimLimitPerUser", + period_type as "periodType", valid_from as "validFrom", valid_to as "validTo", + status, metadata + from public.point_activity_tasks + where tenant_id = $1 + and (($2::uuid is not null and id = $2::uuid) or ($3::text is not null and code = $3)) + limit 1 + for update + `, + [tenantId, taskId, code], + ); + const task = result.rows[0]; + if (!task) throw new HttpError(404, 'Point activity task not found', 'POINT_TASK_NOT_FOUND'); + assertActiveWindow(task, 'task'); + return task; +} + +async function loadExchangeItemForRedeem(client: pg.PoolClient, tenantId: string, body: JsonMap) { + const itemId = optionalUuidString(body.itemId, 'itemId'); + const code = nullableString(body.code); + if (!itemId && !code) throw new HttpError(400, 'itemId or code is required', 'POINT_EXCHANGE_ITEM_REQUIRED'); + + const result = await client.query<{ + id: string; + code: string; + title: string; + description: string | null; + costPoints: number; + itemType: string; + couponId: string | null; + assetId: string | null; + stockTotal: number | null; + stockUsed: number; + perUserLimit: number; + validFrom: string | null; + validTo: string | null; + status: string; + metadata: JsonMap; + }>( + ` + select id, code::text, title, description, cost_points as "costPoints", + item_type as "itemType", coupon_id as "couponId", asset_id as "assetId", + stock_total as "stockTotal", stock_used as "stockUsed", + per_user_limit as "perUserLimit", valid_from as "validFrom", valid_to as "validTo", + status, metadata + from public.point_exchange_items + where tenant_id = $1 + and (($2::uuid is not null and id = $2::uuid) or ($3::text is not null and code = $3)) + limit 1 + for update + `, + [tenantId, itemId, code], + ); + const item = result.rows[0]; + if (!item) throw new HttpError(404, 'Point exchange item not found', 'POINT_EXCHANGE_ITEM_NOT_FOUND'); + assertActiveWindow(item, 'item'); + return item; +} + +async function userScoreForUpdate(client: pg.PoolClient, userId: string) { + const result = await client.query<{ score: number }>( + ` + select score + from public.platform_users + where id = $1 + limit 1 + for update + `, + [userId], + ); + const row = result.rows[0]; + if (!row) throw new HttpError(404, 'User not found', 'USER_NOT_FOUND'); + return Number(row.score || 0); +} + +async function assertTaskEvidence( + client: pg.PoolClient, + input: { + tenantId: string; + userId: string; + taskType: string; + sourceId: string | null; + }, +) { + if (input.taskType === 'manual') return; + if (!input.sourceId) { + throw new HttpError(400, 'sourceId is required for this activity task', 'POINT_TASK_SOURCE_REQUIRED'); + } + + if (input.taskType === 'practice_complete' || input.taskType === 'mock_exam_submit') { + const result = await client.query( + ` + select id + from public.practice_session_reports + where tenant_id = $1 + and user_id = $2 + and (id = $3::uuid or practice_session_id = $3::uuid) + and ($4::text <> 'mock_exam_submit' or mode = 'mock_exam') + limit 1 + `, + [input.tenantId, input.userId, input.sourceId, input.taskType], + ); + if (!result.rows[0]) { + throw new HttpError(404, 'Practice evidence not found for this student', 'POINT_TASK_SOURCE_NOT_FOUND'); + } + return; + } + + if (input.taskType === 'vocabulary_review') { + const result = await client.query( + ` + select id + from public.user_word_progress + where tenant_id = $1 + and user_id = $2 + and id = $3::uuid + and last_review_date is not null + limit 1 + `, + [input.tenantId, input.userId, input.sourceId], + ); + if (!result.rows[0]) { + throw new HttpError(404, 'Vocabulary review evidence not found for this student', 'POINT_TASK_SOURCE_NOT_FOUND'); + } + } +} + +async function createCouponRedemptionForExchange( + client: pg.PoolClient, + input: { + tenantId: string; + userId: string; + couponId: string; + orderId: string; + metadata: JsonMap; + }, +) { + const couponResult = await client.query<{ + id: string; + code: string; + status: string; + planId: string | null; + validFrom: string | null; + validTo: string | null; + maxUses: number | null; + usedCount: number; + source: string | null; + remark: string | null; + }>( + ` + select id, code::text, status, plan_id as "planId", + valid_from as "validFrom", valid_to as "validTo", + max_uses as "maxUses", used_count as "usedCount", source, remark + from public.coupons + where tenant_id = $1 and id = $2 + limit 1 + for update + `, + [input.tenantId, input.couponId], + ); + const coupon = couponResult.rows[0]; + if (!coupon) throw new HttpError(404, 'Coupon not found for exchange item', 'POINT_EXCHANGE_COUPON_NOT_FOUND'); + assertActiveWindow({ + status: coupon.status, + validFrom: coupon.validFrom, + validTo: coupon.validTo, + }, 'item'); + if (coupon.maxUses !== null && coupon.maxUses > 0 && coupon.usedCount >= coupon.maxUses) { + throw new HttpError(409, 'Coupon stock is exhausted', 'POINT_EXCHANGE_COUPON_EXHAUSTED'); + } + + const redemption = await client.query<{ + id: string; + couponId: string; + couponCode: string; + status: string; + claimedAt: string | null; + }>( + ` + insert into public.coupon_redemptions ( + tenant_id, coupon_id, coupon_code, user_id, plan_id, order_id, status, + discount_applied_cents, source, remark, claimed_at + ) + values ($1, $2, $3, $4, $5::uuid, null, 'claimed', 0, 'points_exchange', $6, now()) + returning id, coupon_id as "couponId", coupon_code as "couponCode", status, claimed_at as "claimedAt" + `, + [ + input.tenantId, + coupon.id, + coupon.code, + input.userId, + coupon.planId, + `积分兑换订单 ${input.orderId}`, + ], + ); + + return redemption.rows[0]; +} + +export async function activityTasksRoute(ctx: RequestContext) { + const tenantId = await tenantIdFrom(ctx); + const userId = await userIdFrom(ctx); + const limit = intParam(ctx, 'limit', 100, 300); + const taskType = stringParam(ctx, 'taskType'); + const params: unknown[] = [tenantId, userId]; + const filters = [ + 't.tenant_id = $1', + "t.status = 'active'", + '(t.valid_from is null or t.valid_from <= now())', + '(t.valid_to is null or t.valid_to >= now())', + ]; + if (taskType) { + normalizeTaskType(taskType); + params.push(taskType); + filters.push(`t.task_type = $${params.length}`); + } + params.push(limit); + + const items = await query( + ` + select t.id, t.code::text, t.title, t.description, t.task_type as "taskType", + t.reward_points as "rewardPoints", t.claim_limit_per_user as "claimLimitPerUser", + t.period_type as "periodType", t.valid_from as "validFrom", t.valid_to as "validTo", + t.status, t.sort_order as "order", t.metadata, + coalesce(c.claim_count, 0)::int as "claimCount", + coalesce(c.current_period_claim_count, 0)::int as "currentPeriodClaimCount", + c.last_claimed_at as "lastClaimedAt", + c.current_period_claim_id as "currentPeriodClaimId", + (c.current_period_claim_id is not null) as "claimedInCurrentPeriod", + case + when t.period_type in ('daily', 'weekly', 'monthly') then + case when coalesce(c.current_period_claim_count, 0) > 0 then 0 else 1 end + else greatest(t.claim_limit_per_user - coalesce(c.claim_count, 0), 0) + end::int as "remainingClaims" + from public.point_activity_tasks t + left join lateral ( + select count(*)::int as claim_count, + count(*) filter ( + where period_key = case + when t.period_type = 'daily' then to_char((now() at time zone 'Asia/Shanghai')::date, 'YYYY-MM-DD') + when t.period_type = 'weekly' then to_char((now() at time zone 'Asia/Shanghai')::date, 'IYYY-"W"IW') + when t.period_type = 'monthly' then to_char((now() at time zone 'Asia/Shanghai')::date, 'YYYY-MM') + when t.period_type = 'unlimited' then '' + else 'once:' || t.id::text + end + )::int as current_period_claim_count, + max(claimed_at) as last_claimed_at, + (array_agg(id order by claimed_at desc) filter ( + where period_key = case + when t.period_type = 'daily' then to_char((now() at time zone 'Asia/Shanghai')::date, 'YYYY-MM-DD') + when t.period_type = 'weekly' then to_char((now() at time zone 'Asia/Shanghai')::date, 'IYYY-"W"IW') + when t.period_type = 'monthly' then to_char((now() at time zone 'Asia/Shanghai')::date, 'YYYY-MM') + when t.period_type = 'unlimited' then '' + else 'once:' || t.id::text + end + ))[1] as current_period_claim_id + from public.user_point_activity_claims c + where c.tenant_id = t.tenant_id + and c.task_id = t.id + and c.user_id = $2 + and c.status = 'claimed' + ) c on true + where ${filters.join(' and ')} + order by t.sort_order asc, t.created_at desc + limit $${params.length} + `, + params, + ); + + return { items }; +} + +export async function claimActivityTaskRoute(ctx: RequestContext) { + const body = await readJsonBody(ctx); + const tenantId = await tenantIdFrom(ctx); + const userId = await userIdFrom(ctx, body); + const sourceType = nullableString(body.sourceType); + const sourceId = optionalUuidString(body.sourceId, 'sourceId'); + + const item = await transaction(async client => { + const task = await loadTaskForClaim(client, tenantId, body); + if (!STUDENT_CLAIMABLE_TASK_TYPES.has(task.taskType)) { + throw new HttpError(403, 'This activity task is granted by system workflow only', 'POINT_TASK_SYSTEM_GRANTED_ONLY'); + } + await assertTaskEvidence(client, { + tenantId, + userId, + taskType: task.taskType, + sourceId, + }); + const requestIdempotencyKey = safeIdempotencyText(body.idempotencyKey); + const currentPeriodKey = periodKey(task.periodType, task.id, requestIdempotencyKey); + + const periodClaims = await client.query<{ count: string }>( + ` + select count(*)::text as count + from public.user_point_activity_claims + where tenant_id = $1 and user_id = $2 and task_id = $3 and status = 'claimed' + and ( + $5::text <> 'period' + or period_key = $4 + ) + `, + [tenantId, userId, task.id, currentPeriodKey, ['daily', 'weekly', 'monthly'].includes(task.periodType) ? 'period' : 'total'], + ); + const currentLimitCount = Number(periodClaims.rows[0]?.count || 0); + const effectiveLimit = ['daily', 'weekly', 'monthly'].includes(task.periodType) ? 1 : task.claimLimitPerUser; + if (currentLimitCount >= effectiveLimit) { + throw new HttpError(409, 'Activity task claim limit reached', 'POINT_TASK_CLAIM_LIMIT_REACHED'); + } + + const totalClaims = await client.query<{ count: string }>( + ` + select count(*)::text as count + from public.user_point_activity_claims + where tenant_id = $1 and user_id = $2 and task_id = $3 and status = 'claimed' + `, + [tenantId, userId, task.id], + ); + const claimCount = Number(totalClaims.rows[0]?.count || 0); + + const scoreBefore = await userScoreForUpdate(client, userId); + const scoreAfter = scoreBefore + task.rewardPoints; + const idempotencyKey = `activity:${task.id}:user:${userId}:period:${currentPeriodKey}`; + + const ledger = await client.query<{ + id: string; + eventType: string; + points: number; + balanceAfter: number; + createdAt: string; + }>( + ` + insert into public.user_score_events ( + tenant_id, user_id, event_type, points, balance_after, + source_type, source_id, idempotency_key, metadata + ) + values ($1, $2, 'activity_reward', $3, $4, 'point_activity_tasks', $5, $6, $7::jsonb) + on conflict (tenant_id, idempotency_key) do nothing + returning id, event_type as "eventType", points, balance_after as "balanceAfter", created_at as "createdAt" + `, + [ + tenantId, + userId, + task.rewardPoints, + scoreAfter, + task.id, + idempotencyKey, + JSON.stringify({ + taskId: task.id, + code: task.code, + taskType: task.taskType, + periodKey: currentPeriodKey, + sourceType, + sourceId, + }), + ], + ); + + if (!ledger.rows[0]) { + throw new HttpError(409, 'Activity task already claimed in this period', 'POINT_TASK_ALREADY_CLAIMED'); + } + + const claim = await client.query( + ` + insert into public.user_point_activity_claims ( + tenant_id, user_id, task_id, period_key, score_event_id, + source_type, source_id, metadata + ) + values ($1, $2, $3, $4, $5, $6, $7::uuid, $8::jsonb) + returning id, task_id as "taskId", period_key as "periodKey", + score_event_id as "scoreEventId", source_type as "sourceType", + source_id as "sourceId", status, metadata, claimed_at as "claimedAt" + `, + [ + tenantId, + userId, + task.id, + currentPeriodKey, + ledger.rows[0].id, + sourceType, + sourceId, + JSON.stringify(objectValue(body.metadata)), + ], + ); + + const updatedUser = await client.query<{ score: number }>( + ` + update public.platform_users + set score = score + $2, + updated_at = now() + where id = $1 + returning score + `, + [userId, task.rewardPoints], + ); + + const nextScore = Number(updatedUser.rows[0]?.score || scoreAfter); + const nextClaimCount = claimCount + 1; + const autoBadges = [ + ...(await autoGrantBadges(client, { + tenantId, + userId, + trigger: 'activity_reward', + evidence: { + activityRewardCount: nextClaimCount, + rewardPoints: task.rewardPoints, + score: nextScore, + taskType: task.taskType, + taskCode: task.code, + }, + })), + ...(await autoGrantBadges(client, { + tenantId, + userId, + trigger: 'score', + evidence: { + source: 'activity_reward', + activityRewardCount: nextClaimCount, + rewardPoints: task.rewardPoints, + score: nextScore, + }, + })), + ]; + + return { + task, + claim: claim.rows[0], + ledger: { + ...ledger.rows[0], + balanceAfter: nextScore, + }, + pointsAdded: task.rewardPoints, + score: nextScore, + claimCount: nextClaimCount, + autoBadges, + }; + }); + + return { item }; +} + +export async function exchangeItemsRoute(ctx: RequestContext) { + const tenantId = await tenantIdFrom(ctx); + const userId = await userIdFrom(ctx); + const limit = intParam(ctx, 'limit', 100, 300); + const params: unknown[] = [tenantId, userId, limit]; + + const items = await query( + ` + select i.id, i.code::text, i.title, i.description, i.cost_points as "costPoints", + i.item_type as "itemType", i.coupon_id as "couponId", i.asset_id as "assetId", + i.stock_total as "stockTotal", i.stock_used as "stockUsed", + case when i.stock_total is null then null else greatest(i.stock_total - i.stock_used, 0) end as "stockRemaining", + i.per_user_limit as "perUserLimit", i.valid_from as "validFrom", i.valid_to as "validTo", + i.status, i.sort_order as "order", i.metadata, + coalesce(o.order_count, 0)::int as "redeemedCount", + o.last_exchanged_at as "lastExchangedAt", + greatest(i.per_user_limit - coalesce(o.order_count, 0), 0)::int as "remainingUserRedemptions" + from public.point_exchange_items i + left join lateral ( + select count(*)::int as order_count, max(exchanged_at) as last_exchanged_at + from public.user_point_exchange_orders o + where o.tenant_id = i.tenant_id + and o.item_id = i.id + and o.user_id = $2 + and o.status <> 'cancelled' + ) o on true + where i.tenant_id = $1 + and i.status = 'active' + and (i.valid_from is null or i.valid_from <= now()) + and (i.valid_to is null or i.valid_to >= now()) + order by i.sort_order asc, i.created_at desc + limit $3 + `, + params, + ); + + return { items }; +} + +export async function redeemExchangeItemRoute(ctx: RequestContext) { + const body = await readJsonBody(ctx); + const tenantId = await tenantIdFrom(ctx); + const userId = await userIdFrom(ctx, body); + const idempotencyKey = safeIdempotencyText(body.idempotencyKey) || `exchange:${randomUUID()}`; + + const item = await transaction(async client => { + const existing = await client.query( + ` + select o.id, o.item_id as "itemId", o.status, o.cost_points as "costPoints", + o.score_event_id as "scoreEventId", o.coupon_redemption_id as "couponRedemptionId", + o.asset_id as "assetId", o.metadata, o.exchanged_at as "exchangedAt" + from public.user_point_exchange_orders o + where o.tenant_id = $1 and o.user_id = $2 and o.idempotency_key = $3 + limit 1 + `, + [tenantId, userId, idempotencyKey], + ); + if (existing.rows[0]) return { order: existing.rows[0], idempotent: true }; + + const exchangeItem = await loadExchangeItemForRedeem(client, tenantId, body); + const userOrders = await client.query<{ count: string }>( + ` + select count(*)::text as count + from public.user_point_exchange_orders + where tenant_id = $1 and user_id = $2 and item_id = $3 and status <> 'cancelled' + `, + [tenantId, userId, exchangeItem.id], + ); + const redeemedCount = Number(userOrders.rows[0]?.count || 0); + if (redeemedCount >= exchangeItem.perUserLimit) { + throw new HttpError(409, 'Point exchange user limit reached', 'POINT_EXCHANGE_USER_LIMIT_REACHED'); + } + if (exchangeItem.stockTotal !== null && exchangeItem.stockUsed >= exchangeItem.stockTotal) { + throw new HttpError(409, 'Point exchange item is out of stock', 'POINT_EXCHANGE_OUT_OF_STOCK'); + } + + const scoreBefore = await userScoreForUpdate(client, userId); + if (scoreBefore < exchangeItem.costPoints) { + throw new HttpError(409, 'Insufficient score balance', 'POINT_EXCHANGE_INSUFFICIENT_SCORE'); + } + const scoreAfter = scoreBefore - exchangeItem.costPoints; + + const ledger = await client.query<{ + id: string; + eventType: string; + points: number; + balanceAfter: number; + createdAt: string; + }>( + ` + insert into public.user_score_events ( + tenant_id, user_id, event_type, points, balance_after, + source_type, source_id, idempotency_key, metadata + ) + values ($1, $2, 'redeem_cost', $3, $4, 'point_exchange_items', $5, $6, $7::jsonb) + returning id, event_type as "eventType", points, balance_after as "balanceAfter", created_at as "createdAt" + `, + [ + tenantId, + userId, + -exchangeItem.costPoints, + scoreAfter, + exchangeItem.id, + `redeem:${idempotencyKey}`, + JSON.stringify({ + itemId: exchangeItem.id, + code: exchangeItem.code, + itemType: exchangeItem.itemType, + }), + ], + ); + + const order = await client.query<{ + id: string; + itemId: string; + status: string; + costPoints: number; + scoreEventId: string; + couponRedemptionId: string | null; + assetId: string | null; + metadata: JsonMap; + exchangedAt: string; + }>( + ` + insert into public.user_point_exchange_orders ( + tenant_id, user_id, item_id, status, cost_points, score_event_id, + asset_id, idempotency_key, metadata + ) + values ($1, $2, $3, $4, $5, $6, $7::uuid, $8, $9::jsonb) + returning id, item_id as "itemId", status, cost_points as "costPoints", + score_event_id as "scoreEventId", coupon_redemption_id as "couponRedemptionId", + asset_id as "assetId", metadata, exchanged_at as "exchangedAt" + `, + [ + tenantId, + userId, + exchangeItem.id, + exchangeItem.itemType === 'manual' || exchangeItem.itemType === 'custom' ? 'pending_fulfillment' : 'completed', + exchangeItem.costPoints, + ledger.rows[0].id, + exchangeItem.assetId, + idempotencyKey, + JSON.stringify(objectValue(body.metadata)), + ], + ); + + let couponRedemption = null; + if (exchangeItem.itemType === 'coupon') { + if (!exchangeItem.couponId) throw new HttpError(409, 'Coupon exchange item is missing couponId', 'POINT_EXCHANGE_COUPON_MISSING'); + couponRedemption = await createCouponRedemptionForExchange(client, { + tenantId, + userId, + couponId: exchangeItem.couponId, + orderId: order.rows[0].id, + metadata: objectValue(body.metadata), + }); + await client.query( + ` + update public.user_point_exchange_orders + set coupon_redemption_id = $3, + status = 'completed', + updated_at = now() + where tenant_id = $1 and id = $2 + `, + [tenantId, order.rows[0].id, couponRedemption.id], + ); + order.rows[0].couponRedemptionId = couponRedemption.id; + order.rows[0].status = 'completed'; + } + + if (exchangeItem.stockTotal !== null) { + const stockUpdate = await client.query( + ` + update public.point_exchange_items + set stock_used = stock_used + 1, + updated_at = now() + where tenant_id = $1 + and id = $2 + and stock_total is not null + and stock_used < stock_total + `, + [tenantId, exchangeItem.id], + ); + if (stockUpdate.rowCount !== 1) { + throw new HttpError(409, 'Point exchange item is out of stock', 'POINT_EXCHANGE_OUT_OF_STOCK'); + } + } + + const updatedUser = await client.query<{ score: number }>( + ` + update public.platform_users + set score = score - $2, + updated_at = now() + where id = $1 + returning score + `, + [userId, exchangeItem.costPoints], + ); + + return { + item: exchangeItem, + order: order.rows[0], + couponRedemption, + ledger: { + ...ledger.rows[0], + balanceAfter: Number(updatedUser.rows[0]?.score || scoreAfter), + }, + pointsSpent: exchangeItem.costPoints, + score: Number(updatedUser.rows[0]?.score || scoreAfter), + idempotent: false, + }; + }); + + return { item }; +} diff --git a/apps/api/src/features/tenant-admin/auth.ts b/apps/api/src/features/tenant-admin/auth.ts index 379ac7b9..5559ef5c 100644 --- a/apps/api/src/features/tenant-admin/auth.ts +++ b/apps/api/src/features/tenant-admin/auth.ts @@ -103,6 +103,8 @@ export function tenantPermissionCatalog() { { key: 'tenant:secrets:write', label: '密钥轮换' }, { key: 'marketing:read', label: '活动内容查看' }, { key: 'marketing:write', label: '活动内容管理' }, + { key: 'marketing:points:read', label: '积分任务/兑换查看' }, + { key: 'marketing:points:write', label: '积分任务/兑换管理' }, { key: 'badges:read', label: '勋章查看' }, { key: 'badges:write', label: '勋章管理' }, { key: 'badges:grant', label: '勋章发放' }, diff --git a/apps/api/src/features/tenant-admin/index.ts b/apps/api/src/features/tenant-admin/index.ts index 16c19b1f..2484a362 100644 --- a/apps/api/src/features/tenant-admin/index.ts +++ b/apps/api/src/features/tenant-admin/index.ts @@ -25,6 +25,14 @@ import { updateTenantFeedbackStatusRoute, upsertTenantExamDateRoute, } from './operations.js'; +import { + pointActivityClaimsRoute, + pointActivityTasksRoute, + pointExchangeItemsRoute, + pointExchangeOrdersRoute, + upsertPointActivityTaskRoute, + upsertPointExchangeItemRoute, +} from './points.js'; import { activationCodesRoute, announcementsAdminRoute, @@ -131,6 +139,12 @@ export const tenantAdminRoutes: RouteDefinition[] = [ ['PUT', '/api/tenant-admin/coupons', upsertCouponRoute], ['GET', '/api/tenant-admin/coupons/redemptions', couponRedemptionsRoute], ['GET', '/api/tenant-admin/coupons/report', couponReportRoute], + ['GET', '/api/tenant-admin/point-activity-tasks', pointActivityTasksRoute], + ['PUT', '/api/tenant-admin/point-activity-tasks', upsertPointActivityTaskRoute], + ['GET', '/api/tenant-admin/point-activity-claims', pointActivityClaimsRoute], + ['GET', '/api/tenant-admin/point-exchange-items', pointExchangeItemsRoute], + ['PUT', '/api/tenant-admin/point-exchange-items', upsertPointExchangeItemRoute], + ['GET', '/api/tenant-admin/point-exchange-orders', pointExchangeOrdersRoute], ['GET', '/api/tenant-admin/members', tenantMembersRoute], ['PUT', '/api/tenant-admin/members', upsertTenantMemberRoute], ['POST', '/api/tenant-admin/members/disable', disableTenantMemberRoute], diff --git a/apps/api/src/features/tenant-admin/points.ts b/apps/api/src/features/tenant-admin/points.ts new file mode 100644 index 00000000..00d8eeab --- /dev/null +++ b/apps/api/src/features/tenant-admin/points.ts @@ -0,0 +1,453 @@ +import { HttpError, type RequestContext } from '../../core/http.js'; +import { intParam, readJsonBody, requiredString, stringParam } from '../../core/request.js'; +import { query, transaction } from '../../core/db.js'; +import { + hasTenantPermission, + requireTenantAdmin, + requireTenantPermission, + type TenantAdminAuth, +} from './auth.js'; + +type JsonBody = Record; + +const TASK_TYPES = [ + 'daily_check_in', + 'feedback_submit', + 'feedback_resolved', + 'practice_complete', + 'vocabulary_review', + 'mock_exam_submit', + 'manual', +]; +const PERIOD_TYPES = ['once', 'daily', 'weekly', 'monthly', 'unlimited']; +const TASK_STATUSES = ['active', 'disabled', 'archived']; +const EXCHANGE_ITEM_TYPES = ['coupon', 'manual', 'asset', 'custom']; +const EXCHANGE_ITEM_STATUSES = ['active', 'disabled', 'archived']; +const EXCHANGE_ORDER_STATUSES = ['completed', 'pending_fulfillment', 'cancelled']; + +function nullableString(value: unknown) { + return typeof value === 'string' && value.trim() ? value.trim() : null; +} + +function objectValue(value: unknown): Record { + return value && typeof value === 'object' && !Array.isArray(value) ? value as Record : {}; +} + +function intValue(value: unknown, fallback: number) { + const parsed = Number(value ?? fallback); + return Number.isFinite(parsed) ? Math.trunc(parsed) : fallback; +} + +function optionalChoice(value: unknown, allowed: string[], fallback: string) { + const candidate = nullableString(value) || fallback; + if (!allowed.includes(candidate)) { + throw new HttpError(400, `Invalid value: ${candidate}`, 'INVALID_FIELD_VALUE'); + } + return candidate; +} + +function optionalUuidString(value: unknown, key: string) { + const candidate = nullableString(value); + if (!candidate) return null; + if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(candidate)) { + throw new HttpError(400, `${key} must be a UUID`, 'INVALID_UUID'); + } + return candidate; +} + +function codeValue(body: JsonBody) { + return requiredString(body, 'code').trim().toLowerCase().replace(/[^a-z0-9_-]+/g, '-').replace(/^-+|-+$/g, ''); +} + +function optionalDateTimeText(value: unknown, key: string) { + const candidate = nullableString(value); + if (!candidate) return null; + const time = new Date(candidate).getTime(); + if (!Number.isFinite(time)) throw new HttpError(400, `${key} must be a valid datetime`, 'INVALID_DATETIME'); + return candidate; +} + +async function recordAudit( + client: { query: (sql: string, params?: unknown[]) => Promise }, + auth: TenantAdminAuth, + action: string, + targetType: string, + targetId: string | null, + details: Record = {}, +) { + await client.query( + ` + insert into public.audit_logs (tenant_id, actor_user_id, action, target_type, target_id, details) + values ($1, $2, $3, $4, $5, $6::jsonb) + `, + [auth.tenantId, auth.userId, action, targetType, targetId, JSON.stringify(details)], + ); +} + +function requirePointMarketingPermission(auth: TenantAdminAuth, permission: 'read' | 'write') { + const specific = `marketing:points:${permission}`; + if (hasTenantPermission(auth, specific) || hasTenantPermission(auth, `marketing:${permission}`)) return; + requireTenantPermission(auth, specific); +} + +export async function pointActivityTasksRoute(ctx: RequestContext) { + const auth = await requireTenantAdmin(ctx); + requirePointMarketingPermission(auth, 'read'); + const limit = intParam(ctx, 'limit', 100, 500); + const status = stringParam(ctx, 'status'); + const taskType = stringParam(ctx, 'taskType'); + const params: unknown[] = [auth.tenantId]; + const filters = ['t.tenant_id = $1']; + if (status) { + if (!TASK_STATUSES.includes(status)) throw new HttpError(400, 'status is invalid', 'INVALID_STATUS'); + params.push(status); + filters.push(`t.status = $${params.length}`); + } + if (taskType) { + if (!TASK_TYPES.includes(taskType)) throw new HttpError(400, 'taskType is invalid', 'INVALID_TASK_TYPE'); + params.push(taskType); + filters.push(`t.task_type = $${params.length}`); + } + params.push(limit); + + const items = await query( + ` + select t.id, t.legacy_id as "legacyId", t.code::text, t.title, t.description, + t.task_type as "taskType", t.reward_points as "rewardPoints", + t.claim_limit_per_user as "claimLimitPerUser", t.period_type as "periodType", + t.valid_from as "validFrom", t.valid_to as "validTo", t.status, + t.sort_order as "order", t.metadata, t.created_by as "createdBy", + count(c.id)::int as "claimCount", + count(distinct c.user_id)::int as "claimUserCount", + t.created_at as "createdAt", t.updated_at as "updatedAt" + from public.point_activity_tasks t + left join public.user_point_activity_claims c + on c.tenant_id = t.tenant_id + and c.task_id = t.id + and c.status = 'claimed' + where ${filters.join(' and ')} + group by t.id + order by t.sort_order asc, t.created_at desc + limit $${params.length} + `, + params, + ); + return { items }; +} + +export async function upsertPointActivityTaskRoute(ctx: RequestContext) { + const auth = await requireTenantAdmin(ctx); + requirePointMarketingPermission(auth, 'write'); + const body = await readJsonBody(ctx); + const taskType = optionalChoice(body.taskType, TASK_TYPES, 'manual'); + const periodType = optionalChoice(body.periodType, PERIOD_TYPES, taskType === 'daily_check_in' ? 'daily' : 'once'); + const status = optionalChoice(body.status, TASK_STATUSES, 'active'); + const rewardPoints = Math.max(1, Math.min(100000, intValue(body.rewardPoints, 1))); + const claimLimitPerUser = Math.max(1, Math.min(100000, intValue(body.claimLimitPerUser, 1))); + const code = codeValue(body); + + const item = await transaction(async client => { + const result = await client.query( + ` + insert into public.point_activity_tasks ( + id, tenant_id, legacy_id, code, title, description, task_type, + reward_points, claim_limit_per_user, period_type, valid_from, valid_to, + status, sort_order, metadata, created_by + ) + values ( + coalesce($2::uuid, gen_random_uuid()), $1, $3, $4, $5, $6, $7, + $8, $9, $10, $11::timestamptz, $12::timestamptz, + $13, $14, $15::jsonb, $16 + ) + on conflict (tenant_id, code) + do update set legacy_id = coalesce(excluded.legacy_id, public.point_activity_tasks.legacy_id), + title = excluded.title, + description = excluded.description, + task_type = excluded.task_type, + reward_points = excluded.reward_points, + claim_limit_per_user = excluded.claim_limit_per_user, + period_type = excluded.period_type, + valid_from = excluded.valid_from, + valid_to = excluded.valid_to, + status = excluded.status, + sort_order = excluded.sort_order, + metadata = excluded.metadata, + updated_at = now() + returning id, legacy_id as "legacyId", code::text, title, description, + task_type as "taskType", reward_points as "rewardPoints", + claim_limit_per_user as "claimLimitPerUser", period_type as "periodType", + valid_from as "validFrom", valid_to as "validTo", status, + sort_order as "order", metadata, created_by as "createdBy", + created_at as "createdAt", updated_at as "updatedAt" + `, + [ + auth.tenantId, + optionalUuidString(body.id, 'id'), + nullableString(body.legacyId), + code, + requiredString(body, 'title'), + nullableString(body.description), + taskType, + rewardPoints, + claimLimitPerUser, + periodType, + optionalDateTimeText(body.validFrom, 'validFrom'), + optionalDateTimeText(body.validTo, 'validTo'), + status, + intValue(body.order ?? body.sortOrder, 0), + JSON.stringify(objectValue(body.metadata)), + auth.userId, + ], + ); + await recordAudit(client, auth, 'tenant.point_activity_task.upserted', 'point_activity_tasks', result.rows[0].id, { + code, + taskType, + rewardPoints, + status, + }); + return result.rows[0]; + }); + + return { item }; +} + +export async function pointActivityClaimsRoute(ctx: RequestContext) { + const auth = await requireTenantAdmin(ctx); + requirePointMarketingPermission(auth, 'read'); + const limit = intParam(ctx, 'limit', 100, 500); + const taskId = optionalUuidString(stringParam(ctx, 'taskId'), 'taskId'); + const userId = optionalUuidString(stringParam(ctx, 'userId'), 'userId'); + const params: unknown[] = [auth.tenantId]; + const filters = ['c.tenant_id = $1']; + if (taskId) { + params.push(taskId); + filters.push(`c.task_id = $${params.length}::uuid`); + } + if (userId) { + params.push(userId); + filters.push(`c.user_id = $${params.length}::uuid`); + } + params.push(limit); + + const items = await query( + ` + select c.id, c.user_id as "userId", u.name as "userName", u.phone as "userPhone", + c.task_id as "taskId", t.code::text as "taskCode", t.title as "taskTitle", + t.reward_points as "rewardPoints", c.period_key as "periodKey", + c.score_event_id as "scoreEventId", c.source_type as "sourceType", + c.source_id as "sourceId", c.status, c.metadata, c.claimed_at as "claimedAt", + c.created_at as "createdAt", c.updated_at as "updatedAt" + from public.user_point_activity_claims c + join public.point_activity_tasks t on t.tenant_id = c.tenant_id and t.id = c.task_id + left join public.platform_users u on u.id = c.user_id + where ${filters.join(' and ')} + order by c.claimed_at desc + limit $${params.length} + `, + params, + ); + return { items }; +} + +export async function pointExchangeItemsRoute(ctx: RequestContext) { + const auth = await requireTenantAdmin(ctx); + requirePointMarketingPermission(auth, 'read'); + const limit = intParam(ctx, 'limit', 100, 500); + const status = stringParam(ctx, 'status'); + const itemType = stringParam(ctx, 'itemType'); + const params: unknown[] = [auth.tenantId]; + const filters = ['i.tenant_id = $1']; + if (status) { + if (!EXCHANGE_ITEM_STATUSES.includes(status)) throw new HttpError(400, 'status is invalid', 'INVALID_STATUS'); + params.push(status); + filters.push(`i.status = $${params.length}`); + } + if (itemType) { + if (!EXCHANGE_ITEM_TYPES.includes(itemType)) throw new HttpError(400, 'itemType is invalid', 'INVALID_EXCHANGE_ITEM_TYPE'); + params.push(itemType); + filters.push(`i.item_type = $${params.length}`); + } + params.push(limit); + + const items = await query( + ` + select i.id, i.legacy_id as "legacyId", i.code::text, i.title, i.description, + i.cost_points as "costPoints", i.item_type as "itemType", + i.coupon_id as "couponId", c.code::text as "couponCode", + i.asset_id as "assetId", i.stock_total as "stockTotal", + i.stock_used as "stockUsed", + case when i.stock_total is null then null else greatest(i.stock_total - i.stock_used, 0) end as "stockRemaining", + i.per_user_limit as "perUserLimit", i.valid_from as "validFrom", + i.valid_to as "validTo", i.status, i.sort_order as "order", + i.metadata, i.created_by as "createdBy", + count(o.id)::int as "orderCount", + i.created_at as "createdAt", i.updated_at as "updatedAt" + from public.point_exchange_items i + left join public.coupons c on c.tenant_id = i.tenant_id and c.id = i.coupon_id + left join public.user_point_exchange_orders o + on o.tenant_id = i.tenant_id + and o.item_id = i.id + and o.status <> 'cancelled' + where ${filters.join(' and ')} + group by i.id, c.code + order by i.sort_order asc, i.created_at desc + limit $${params.length} + `, + params, + ); + return { items }; +} + +export async function upsertPointExchangeItemRoute(ctx: RequestContext) { + const auth = await requireTenantAdmin(ctx); + requirePointMarketingPermission(auth, 'write'); + const body = await readJsonBody(ctx); + const code = codeValue(body); + const itemType = optionalChoice(body.itemType, EXCHANGE_ITEM_TYPES, 'manual'); + const status = optionalChoice(body.status, EXCHANGE_ITEM_STATUSES, 'active'); + const couponId = optionalUuidString(body.couponId, 'couponId'); + const assetId = optionalUuidString(body.assetId, 'assetId'); + const stockTotal = body.stockTotal === undefined || body.stockTotal === null || body.stockTotal === '' + ? null + : Math.max(0, intValue(body.stockTotal, 0)); + const costPoints = Math.max(1, Math.min(10000000, intValue(body.costPoints, 1))); + const perUserLimit = Math.max(1, Math.min(100000, intValue(body.perUserLimit, 1))); + + if (itemType === 'coupon' && !couponId) { + throw new HttpError(400, 'couponId is required for coupon exchange item', 'POINT_EXCHANGE_COUPON_REQUIRED'); + } + if (itemType === 'asset' && !assetId) { + throw new HttpError(400, 'assetId is required for asset exchange item', 'POINT_EXCHANGE_ASSET_REQUIRED'); + } + + const item = await transaction(async client => { + if (couponId) { + const coupon = await client.query( + 'select id from public.coupons where tenant_id = $1 and id = $2 limit 1', + [auth.tenantId, couponId], + ); + if (!coupon.rows[0]) throw new HttpError(404, 'Coupon not found for this tenant', 'COUPON_NOT_FOUND'); + } + if (assetId) { + const asset = await client.query( + 'select id from public.content_assets where tenant_id = $1 and id = $2 limit 1', + [auth.tenantId, assetId], + ); + if (!asset.rows[0]) throw new HttpError(404, 'Asset not found for this tenant', 'ASSET_NOT_FOUND'); + } + + const result = await client.query( + ` + insert into public.point_exchange_items ( + id, tenant_id, legacy_id, code, title, description, cost_points, + item_type, coupon_id, asset_id, stock_total, per_user_limit, + valid_from, valid_to, status, sort_order, metadata, created_by + ) + values ( + coalesce($2::uuid, gen_random_uuid()), $1, $3, $4, $5, $6, $7, + $8, $9::uuid, $10::uuid, $11, $12, + $13::timestamptz, $14::timestamptz, $15, $16, $17::jsonb, $18 + ) + on conflict (tenant_id, code) + do update set legacy_id = coalesce(excluded.legacy_id, public.point_exchange_items.legacy_id), + title = excluded.title, + description = excluded.description, + cost_points = excluded.cost_points, + item_type = excluded.item_type, + coupon_id = excluded.coupon_id, + asset_id = excluded.asset_id, + stock_total = excluded.stock_total, + per_user_limit = excluded.per_user_limit, + valid_from = excluded.valid_from, + valid_to = excluded.valid_to, + status = excluded.status, + sort_order = excluded.sort_order, + metadata = excluded.metadata, + updated_at = now() + returning id, legacy_id as "legacyId", code::text, title, description, + cost_points as "costPoints", item_type as "itemType", + coupon_id as "couponId", asset_id as "assetId", + stock_total as "stockTotal", stock_used as "stockUsed", + per_user_limit as "perUserLimit", valid_from as "validFrom", + valid_to as "validTo", status, sort_order as "order", + metadata, created_by as "createdBy", created_at as "createdAt", + updated_at as "updatedAt" + `, + [ + auth.tenantId, + optionalUuidString(body.id, 'id'), + nullableString(body.legacyId), + code, + requiredString(body, 'title'), + nullableString(body.description), + costPoints, + itemType, + couponId, + assetId, + stockTotal, + perUserLimit, + optionalDateTimeText(body.validFrom, 'validFrom'), + optionalDateTimeText(body.validTo, 'validTo'), + status, + intValue(body.order ?? body.sortOrder, 0), + JSON.stringify(objectValue(body.metadata)), + auth.userId, + ], + ); + await recordAudit(client, auth, 'tenant.point_exchange_item.upserted', 'point_exchange_items', result.rows[0].id, { + code, + itemType, + costPoints, + status, + }); + return result.rows[0]; + }); + + return { item }; +} + +export async function pointExchangeOrdersRoute(ctx: RequestContext) { + const auth = await requireTenantAdmin(ctx); + requirePointMarketingPermission(auth, 'read'); + const limit = intParam(ctx, 'limit', 100, 500); + const itemId = optionalUuidString(stringParam(ctx, 'itemId'), 'itemId'); + const userId = optionalUuidString(stringParam(ctx, 'userId'), 'userId'); + const status = stringParam(ctx, 'status'); + const params: unknown[] = [auth.tenantId]; + const filters = ['o.tenant_id = $1']; + if (itemId) { + params.push(itemId); + filters.push(`o.item_id = $${params.length}::uuid`); + } + if (userId) { + params.push(userId); + filters.push(`o.user_id = $${params.length}::uuid`); + } + if (status) { + if (!EXCHANGE_ORDER_STATUSES.includes(status)) throw new HttpError(400, 'status is invalid', 'INVALID_STATUS'); + params.push(status); + filters.push(`o.status = $${params.length}`); + } + params.push(limit); + + const items = await query( + ` + select o.id, o.user_id as "userId", u.name as "userName", u.phone as "userPhone", + o.item_id as "itemId", i.code::text as "itemCode", i.title as "itemTitle", + i.item_type as "itemType", o.status, o.cost_points as "costPoints", + o.score_event_id as "scoreEventId", o.coupon_redemption_id as "couponRedemptionId", + cr.coupon_code as "couponCode", o.asset_id as "assetId", + o.metadata, o.exchanged_at as "exchangedAt", + o.created_at as "createdAt", o.updated_at as "updatedAt" + from public.user_point_exchange_orders o + join public.point_exchange_items i on i.tenant_id = o.tenant_id and i.id = o.item_id + left join public.platform_users u on u.id = o.user_id + left join public.coupon_redemptions cr on cr.tenant_id = o.tenant_id and cr.id = o.coupon_redemption_id + where ${filters.join(' and ')} + order by o.exchanged_at desc + limit $${params.length} + `, + params, + ); + return { items }; +} diff --git a/apps/api/src/features/tenant-admin/routes.ts b/apps/api/src/features/tenant-admin/routes.ts index 2687dd4f..5c0a9f5d 100644 --- a/apps/api/src/features/tenant-admin/routes.ts +++ b/apps/api/src/features/tenant-admin/routes.ts @@ -24,7 +24,7 @@ const TENANT_MEMBER_ROLES = ['tenant_owner', 'tenant_admin', 'tenant_operator', const TENANT_MEMBER_STATUSES = ['active', 'invited', 'disabled']; const ROLE_TEMPLATE_STATUSES = ['active', 'disabled', 'archived']; const BADGE_CATEGORIES = ['learning', 'practice', 'vocabulary', 'mock_exam', 'activity', 'feedback', 'sales', 'system', 'custom']; -const BADGE_UNLOCK_TYPES = ['manual', 'auto', 'score', 'check_in', 'practice_count', 'vocabulary_mastered', 'mock_exam_score', 'feedback_resolved', 'custom']; +const BADGE_UNLOCK_TYPES = ['manual', 'auto', 'score', 'check_in', 'practice_count', 'vocabulary_mastered', 'mock_exam_score', 'feedback_resolved', 'activity_reward', 'custom']; const BADGE_OPERATORS = ['gte', 'lte', 'eq', 'gt', 'lt']; const THEME_MODES = ['light', 'dark', 'auto']; const THEME_DENSITIES = ['compact', 'comfortable', 'dense']; diff --git a/apps/taro/src/services/profile.ts b/apps/taro/src/services/profile.ts index 7b7f644f..16cab2d6 100644 --- a/apps/taro/src/services/profile.ts +++ b/apps/taro/src/services/profile.ts @@ -21,6 +21,51 @@ export interface StudentProfile { recentPractices?: unknown[]; } +export interface PointActivityTask { + id: string; + code?: string; + title?: string; + description?: string | null; + taskType?: string; + rewardPoints?: number; + claimLimitPerUser?: number; + periodType?: 'once' | 'daily' | 'weekly' | 'monthly' | 'unlimited'; + validFrom?: string | null; + validTo?: string | null; + status?: string; + order?: number; + metadata?: Record; + claimCount?: number; + currentPeriodClaimCount?: number; + currentPeriodClaimId?: string | null; + claimedInCurrentPeriod?: boolean; + remainingClaims?: number; + lastClaimedAt?: string | null; +} + +export interface PointExchangeItem { + id: string; + code?: string; + title?: string; + description?: string | null; + costPoints?: number; + itemType?: 'coupon' | 'manual' | 'asset' | 'custom'; + couponId?: string | null; + assetId?: string | null; + stockTotal?: number | null; + stockUsed?: number; + stockRemaining?: number | null; + perUserLimit?: number; + validFrom?: string | null; + validTo?: string | null; + status?: string; + order?: number; + metadata?: Record; + redeemedCount?: number; + remainingUserRedemptions?: number; + lastExchangedAt?: string | null; +} + export async function loadProfile() { return apiRequest<{ item?: StudentProfile }>('/api/profile/me'); } @@ -42,6 +87,46 @@ export async function checkIn() { return apiRequest<{ item?: Record }>('/api/profile/check-in', { method: 'POST' }); } +export async function loadScoreEvents(limit = 50) { + return apiRequest<{ items?: Record[] }>('/api/profile/score-events', { query: { limit } }); +} + +export async function loadActivityTasks(query: { taskType?: string; limit?: number } = {}) { + return apiRequest<{ items?: PointActivityTask[] }>('/api/profile/activity-tasks', { + query: { ...query, limit: query.limit || 100 }, + }); +} + +export async function claimActivityTask(input: { + taskId?: string; + code?: string; + sourceType?: string; + sourceId?: string; + idempotencyKey?: string; + metadata?: Record; +}) { + return apiRequest<{ item?: Record }>('/api/profile/activity-tasks/claim', { + method: 'POST', + body: input, + }); +} + +export async function loadExchangeItems(limit = 100) { + return apiRequest<{ items?: PointExchangeItem[] }>('/api/profile/exchange-items', { query: { limit } }); +} + +export async function redeemExchangeItem(input: { + itemId?: string; + code?: string; + idempotencyKey?: string; + metadata?: Record; +}) { + return apiRequest<{ item?: Record }>('/api/profile/exchange-items/redeem', { + method: 'POST', + body: input, + }); +} + export async function loadBadges() { return apiRequest<{ items?: Record[] }>('/api/profile/badges'); } diff --git a/apps/taro/src/services/tenantAdmin.ts b/apps/taro/src/services/tenantAdmin.ts index 13192835..f8b31454 100644 --- a/apps/taro/src/services/tenantAdmin.ts +++ b/apps/taro/src/services/tenantAdmin.ts @@ -474,6 +474,88 @@ export interface CouponReport { daily?: Array>; } +export interface PointActivityTaskItem { + id: string; + legacyId?: string | null; + code?: string; + title?: string; + description?: string | null; + taskType?: 'daily_check_in' | 'feedback_submit' | 'feedback_resolved' | 'practice_complete' | 'vocabulary_review' | 'mock_exam_submit' | 'manual'; + rewardPoints?: number; + claimLimitPerUser?: number; + periodType?: 'once' | 'daily' | 'weekly' | 'monthly' | 'unlimited'; + validFrom?: string | null; + validTo?: string | null; + status?: 'active' | 'disabled' | 'archived'; + order?: number; + metadata?: Record; + claimCount?: number; + claimUserCount?: number; + createdAt?: string; + updatedAt?: string; +} + +export interface PointActivityTaskInput { + id?: string; + legacyId?: string | null; + code: string; + title: string; + description?: string | null; + taskType?: PointActivityTaskItem['taskType']; + rewardPoints: number; + claimLimitPerUser?: number; + periodType?: PointActivityTaskItem['periodType']; + validFrom?: string | null; + validTo?: string | null; + status?: PointActivityTaskItem['status']; + order?: number; + metadata?: Record; +} + +export interface PointExchangeItem { + id: string; + legacyId?: string | null; + code?: string; + title?: string; + description?: string | null; + costPoints?: number; + itemType?: 'coupon' | 'manual' | 'asset' | 'custom'; + couponId?: string | null; + couponCode?: string | null; + assetId?: string | null; + stockTotal?: number | null; + stockUsed?: number; + stockRemaining?: number | null; + perUserLimit?: number; + validFrom?: string | null; + validTo?: string | null; + status?: 'active' | 'disabled' | 'archived'; + order?: number; + metadata?: Record; + orderCount?: number; + createdAt?: string; + updatedAt?: string; +} + +export interface PointExchangeItemInput { + id?: string; + legacyId?: string | null; + code: string; + title: string; + description?: string | null; + costPoints: number; + itemType?: PointExchangeItem['itemType']; + couponId?: string | null; + assetId?: string | null; + stockTotal?: number | null; + perUserLimit?: number; + validFrom?: string | null; + validTo?: string | null; + status?: PointExchangeItem['status']; + order?: number; + metadata?: Record; +} + export interface CodeBatchItem { id: string; name?: string | null; @@ -1083,6 +1165,49 @@ export async function loadCouponReport(query: { return apiRequest<{ item?: CouponReport }>('/api/tenant-admin/coupons/report', { query }); } +export async function loadPointActivityTasks(query: { status?: string; taskType?: string; limit?: number } = {}) { + return apiRequest<{ items?: PointActivityTaskItem[] }>('/api/tenant-admin/point-activity-tasks', { + query: { ...query, limit: query.limit || 100 }, + }); +} + +export async function upsertPointActivityTask(input: PointActivityTaskInput) { + return apiRequest<{ item?: PointActivityTaskItem }>('/api/tenant-admin/point-activity-tasks', { + method: 'PUT', + body: input, + }); +} + +export async function loadPointActivityClaims(query: { taskId?: string; userId?: string; limit?: number } = {}) { + return apiRequest<{ items?: Record[] }>('/api/tenant-admin/point-activity-claims', { + query: { ...query, limit: query.limit || 100 }, + }); +} + +export async function loadPointExchangeItems(query: { status?: string; itemType?: string; limit?: number } = {}) { + return apiRequest<{ items?: PointExchangeItem[] }>('/api/tenant-admin/point-exchange-items', { + query: { ...query, limit: query.limit || 100 }, + }); +} + +export async function upsertPointExchangeItem(input: PointExchangeItemInput) { + return apiRequest<{ item?: PointExchangeItem }>('/api/tenant-admin/point-exchange-items', { + method: 'PUT', + body: input, + }); +} + +export async function loadPointExchangeOrders(query: { + itemId?: string; + userId?: string; + status?: 'completed' | 'pending_fulfillment' | 'cancelled'; + limit?: number; +} = {}) { + return apiRequest<{ items?: Record[] }>('/api/tenant-admin/point-exchange-orders', { + query: { ...query, limit: query.limit || 100 }, + }); +} + export async function loadCodeBatches() { return apiRequest<{ items?: CodeBatchItem[] }>('/api/tenant-admin/code-batches'); } diff --git a/docs/refactor/backend-capability-status.md b/docs/refactor/backend-capability-status.md index d08627cf..1a9d9a64 100644 --- a/docs/refactor/backend-capability-status.md +++ b/docs/refactor/backend-capability-status.md @@ -68,6 +68,7 @@ | 考试倒计时 | 可联调 | `GET /api/catalog/exam-dates`、`GET /api/profile/exam-countdowns`；返回租户/地区匹配考试日期和 `daysLeft` | | 题目反馈/纠错 | 可联调 | `GET/POST /api/profile/feedbacks`，题目必须属于当前租户；租户后台可处理状态流转 | | 签到积分 | 可联调 | `POST /api/profile/check-in`、`GET /api/profile/score-events`；积分流水幂等、事务加锁，重复签到不重复加分；真实签到成功会触发 `check_in` 和 `score` 规则勋章自动发放，重复签到不重复发放 | +| 积分活动/兑换 | 可联调 | `GET /api/profile/activity-tasks`、`POST /api/profile/activity-tasks/claim`、`GET /api/profile/exchange-items`、`POST /api/profile/exchange-items/redeem`；复用 `user_score_events` 积分账本，任务领取和兑换均事务加锁；手动/练习/单词/模考类任务有后端证据校验，反馈解决等系统任务禁止学生自领；兑换支持库存、个人限购、余额校验、幂等 key、优惠券履约和兑换订单 | | 学生勋章 | 可联调 | `GET /api/profile/badges`；支持分类筛选、已解锁/未解锁展示，后端只返回当前租户当前用户的勋章状态；签到连续天数、积分阈值、反馈解决规则已支持自动发放 | ## 背单词、知识手册、分数线、视频 @@ -134,7 +135,8 @@ | 登录 provider 配置 | 可联调 | `/api/tenant-admin/auth-providers` | | 密钥掩码/引用 | 迁移期 | API 有掩码，生产前要做 KMS/Vault 或 envelope encryption | | 活动、Banner、FAQ、公告 | 可联调 | `/api/tenant-admin/banners`、`faqs`、`announcements` | -| 勋章管理/发放 | 可联调 | `/api/tenant-admin/badges`、`/api/tenant-admin/badge-grants`；支持后台维护、同 `legacyId` 幂等更新、手动发放、重复发放幂等、租户隔离和权限点 `badges:read/write/grant`；`unlockType=check_in/score/feedback_resolved` 会由签到、积分奖励和反馈解决事件自动发放 | +| 积分任务/兑换配置 | 可联调 | `/api/tenant-admin/point-activity-tasks`、`point-activity-claims`、`point-exchange-items`、`point-exchange-orders`；使用 `marketing:points:read/write` 或兼容 `marketing:read/write` 权限，支持任务配置、兑换商品配置、领取记录、兑换订单、审计、跨租户拒绝 | +| 勋章管理/发放 | 可联调 | `/api/tenant-admin/badges`、`/api/tenant-admin/badge-grants`；支持后台维护、同 `legacyId` 幂等更新、手动发放、重复发放幂等、租户隔离和权限点 `badges:read/write/grant`；`unlockType=check_in/score/feedback_resolved/activity_reward` 会由签到、积分奖励、反馈解决和活动任务事件自动发放 | | 考试日期维护 | 可联调 | `/api/tenant-admin/exam-dates`，支持地区维度维护和公开倒计时展示 | | 题目反馈处理 | 可联调 | `/api/tenant-admin/feedbacks`、`feedbacks/status`、`feedbacks/events`；支持状态流转、处理备注、审计事件和幂等奖励积分 | | 激活码批次/生成/列表 | 可联调 | `/api/tenant-admin/code-batches`、`activation-codes` | diff --git a/docs/refactor/backend-handoff-roadmap.md b/docs/refactor/backend-handoff-roadmap.md index 4aaf3bde..2701a586 100644 --- a/docs/refactor/backend-handoff-roadmap.md +++ b/docs/refactor/backend-handoff-roadmap.md @@ -10,7 +10,7 @@ - 平台侧可以管理租户、SaaS 套餐、订阅、账单、服务费和用量。 - 租户侧可以管理品牌、域名、支付账户、登录配置、私密密钥、活动、兑换码、优惠券、成员权限、审计日志、内容入口、分类树、题目集合、练习蓝图、题目、视频、分数线、单词、知识手册、资料资源和题库导出任务。 -- 学生侧已经有题库入口、分类树、题目集合、顺序/随机/全真模拟组卷、答题、错题、收藏、背单词进度、个人中心、勋章、排行榜、分数线、视频、订单详情/状态轮询、优惠券领取/抵扣、权益、激活码预检查/兑换和资料下载的基础 API；签到、积分阈值和反馈解决可触发自动勋章发放。 +- 学生侧已经有题库入口、分类树、题目集合、顺序/随机/全真模拟组卷、答题、错题、收藏、背单词进度、个人中心、勋章、排行榜、分数线、视频、订单详情/状态轮询、优惠券领取/抵扣、权益、激活码预检查/兑换、资料下载、AI 择校推荐、积分活动任务和积分兑换的基础 API；签到、积分阈值、反馈解决和积分活动可触发自动勋章发放。 - 销售/代理/CRM 已经有邀请码、扫码/分享事件、首绑客资保护、团队关系、统计、CRM 配置、入队、worker 推送和分佣结算基础闭环。 - 旧题库 JSON、单词模板、知识手册嵌套模板、分数线 JSON 和视频绑定 JSON 已经进入后端 preview/import 管线，由后端负责规范化、校验、幂等、审计和租户隔离。 @@ -22,11 +22,11 @@ | --- | --- | --- | --- | | 多租户底座 | 可联调 | 租户、域名、品牌、设置、RLS 基础、审计、Supabase JWT/API 身份映射；`npm run test:rls` 已提供本地动态租户隔离验收；`npm run smoke:auth:remote` 已提供真实云端 Supabase access token 回归脚本 | 真实云端 Auth/JWKS 回归需要在预生产/生产环境执行并留档，生产 RLS 深测继续执行 | | 平台后台 | 基础完成 | 租户、套餐、订阅、账单、服务费、用量、公共题库授权、公共题库自动同步 worker、公共题库冲突单条/批量处理 API、公共题库同步通知第一版 | 自动计费、平台审计、更完整运营消息 | -| 租户后台 | 可联调 | 品牌、域名、支付账户、登录配置、密钥掩码、活动、兑换码、优惠券、勋章管理/手动发放/签到积分反馈自动发放、成员权限、角色模板、菜单/模块/字段权限配置 API、班级/教师/学生范围权限；Taro 工作台已接权限驱动模块入口，学生运营页已接学生创建/更新、禁用/恢复、批量导入、批量分班、备注和跟进任务第一版，租户设置页已接角色模板和成员绑定操作台第一版，营销中心已接 CRM 配置/队列和分佣结算操作台第一版 | 更细的数据范围组合、成员批量运营、真实打款/导出/凭证和完整权限菜单 | +| 租户后台 | 可联调 | 品牌、域名、支付账户、登录配置、密钥掩码、活动、兑换码、优惠券、勋章管理/手动发放/签到/积分/反馈/活动自动发放、积分任务、积分兑换、成员权限、角色模板、菜单/模块/字段权限配置 API、班级/教师/学生范围权限；Taro 工作台已接权限驱动模块入口，学生运营页已接学生创建/更新、禁用/恢复、批量导入、批量分班、备注和跟进任务第一版，租户设置页已接角色模板和成员绑定操作台第一版，营销中心已接 CRM 配置/队列、分佣结算和积分任务/兑换 service 第一版 | 更细的数据范围组合、成员批量运营、积分任务/兑换操作台页面、真实打款/导出/凭证和完整权限菜单 | | 题库与练习 | 可联调 | 内容入口、任意深度分类、题目集合、顺序/随机/全真模拟蓝图、组卷快照、客观题后端判分、主观题 `selfJudgedCorrect` 自评、阅读理解/案例分析 `subAnswers` 多小题判分、答题、错题、收藏、模考报告、排行榜、公共题库采纳快照、手动同步、自动同步 worker、冲突查询/单条和批量处理 API、公共题库同步通知、JSON/试卷 payload 导出、PDF/Word 异步导出 worker、水印和资料发布路径、每日一练九宫格 metadata、PDF/Word 运营版式和 ZIP 图片素材包 | 长题干/公式图片混排体验、导出模板精排、导出操作台、排行榜防刷/预聚合 | | 背单词 | 可联调 | 单元、单词、进度、收藏、统计、每日计划、JSON/CSV/Excel 导入、排行榜 | 更细复习参数 | | 知识手册 | 可联调 | 科目、章节、条目、Markdown 内容、嵌套 JSON/CSV/Excel 导入 | 富文本资源、版本管理、附件/PDF 关联 | -| 分数线 | 可联调 | 院校、专业、动态字段、记录、年份、趋势、后台维护、JSON/CSV/Excel 导入 | 复杂筛选、AI 择校上下文 | +| 分数线 | 可联调 | 院校、专业、动态字段、记录、年份、趋势、后台维护、JSON/CSV/Excel 导入，AI 择校推荐已可读取地区/分数线上下文 | 复杂筛选和更细 AI 推荐运营配置 | | 视频解析 | 可联调 | 单题视频、批量查询、后台视频绑定、JSON/CSV/Excel 导入、会员播放权限、播放次数扣减、签名 URL、播放日志和动态水印上下文 | 深度防盗链、转码级水印、播放统计 | | 资料下载 | 部分完成 | 资源台账、SVIP 权限校验、`local_dev`/阿里云 OSS/腾讯 COS/Supabase Storage 上传下载签名、上传确认、PDF/图片预览签名、访问审计、动态水印上下文、assets worker 复检、内置安全扫描、外部 HTTP scanner 接入层、题库导出 PDF/Word/每日一练 ZIP 可生成可信 `content_assets` 并走签名下载/预览 | CDN 防盗链、真实 AV/内容安全服务联调、转码级水印、资料前端操作体验 | | 会员与订单 | 可联调 | 下单、订单详情/状态轮询、优惠券领取/抵扣、零元订单自动开通、手工确认权限保护、激活码预检查/兑换、微信支付、支付宝、微信/支付宝发起退款、微信/支付宝退款查询确认、微信/支付宝退款通知 webhook、支付/退款补偿 worker、权益发放、资金对账批次/明细/异常查询 API、微信/支付宝官方账单下载 worker、对账差错工单和事件轨迹 | 财务复核报表、异常订单运营台和真实生产账单格式验收 | @@ -34,7 +34,7 @@ | 销售/代理/CRM | 可联调 | 邀请码、首绑保护、团队关系、销售统计、CRM 配置/队列、钉钉/飞书/企微 worker、分佣规则、成员分佣比例、订单/激活码归因、结算生成、审核和打款状态；Taro 营销中心已接第一版操作台 | 小程序码真实生成、CRM 分配策略、结算导出、真实打款、凭证、财务复核和销售转化看板 | | 内容导入 | 可联调 | 题目、单词、知识手册、分数线、视频 JSON/CSV/Excel preview/import、issue、job/detail、审计、幂等、`executionMode=async`、imports worker、导入后复检、模板下载、字段映射 API、字段映射覆盖白名单校验、PocketBase JSON dry-run 报告；Taro 租户内容页已接上传/粘贴预览、模板文件下载、字段别名编辑、同步/异步执行、异步轮询和复检详情第一版 | 真实数据 dry-run 执行验收、抽样校验和导入性能压测 | | 数据看板 | 可联调 | 租户 dashboard 聚合接口，收益、注册、学习、内容、激活码、反馈、趋势、24h 活跃、套餐销量和运营动态 | 预聚合 worker、缓存、慢 SQL 监控和销售转化看板 | -| AI 择校推荐 | 未开始 | 暂无 | 数据上下文、AI JSON schema、报告渲染、PDF 生成 | +| AI 择校推荐 | 可联调 | `ai_recommendation_reports`、SVIP 门禁、学生输入 schema、地区/分数线上下文、`local_rules` 稳定 JSON、报告列表/详情和 Taro 学生端基础页 | 真实 AI provider、prompt 版本管理、租户后台配置、报告 PDF 渲染和人工复核流程 | | Taro 前端 | 地基已建 | `apps/taro` 已有 Taro 4 React 工程、H5 三入口、租户解析、统一 API client、Supabase Auth client 初始化；学生端、租户后台和平台后台均已有第一批真实 API 页面；学生端已接地区选择、刷题答题卡、后端权威断点续练、本地进度恢复、模拟倒计时、主观题后端自评、阅读理解/案例分析多小题作答、错题/收藏复习、题目反馈、视频解析、练习/模考报告、收银台、订单详情和售后入口第一版；平台后台已接关键写操作第一版，租户工作台已接权限驱动模块入口，租户学生运营页已接创建/更新、禁用/恢复、批量导入、批量分班、备注和跟进任务第一版，租户内容页已接公共题库采纳/同步、冲突查看、单条/批量采纳平台或保留本地、导入问题、字段模板预览/下载、上传/粘贴预览、字段别名覆盖、同步/异步导入、异步轮询和复检详情第一版；租户设置页已接角色模板和成员绑定操作台第一版；租户营销中心已接 CRM 配置保存、队列筛选、分佣规则、成员比例、订单明细、结算生成/审核/标记线下打款第一版 | 长题干/公式图片混排体验、更细数据范围 UI、平台后台审计/详情增强、小程序兼容验证和端到端测试 | ## 前端接入建议 @@ -65,7 +65,7 @@ 5. 个人中心 - 调 `GET /api/profile/me`。 - - 接会员权益、订单详情/状态轮询、优惠券、激活码预检查/兑换、错题本、收藏夹、学习统计、排行榜和勋章。 + - 接会员权益、订单详情/状态轮询、优惠券、激活码预检查/兑换、错题本、收藏夹、学习统计、排行榜、勋章、积分活动任务和积分兑换。 6. 资料、视频和支付 - 资料下载、PDF 预览、视频播放必须先请求后端签名或权限检查。 @@ -79,7 +79,7 @@ - 对象存储：上传/下载签名已接入阿里云 OSS、腾讯云 COS、Supabase Storage；上传确认、PDF/图片预览签名、动态水印上下文、assets worker 复检、内置安全扫描、外部 HTTP scanner 接入层和题库导出 PDF/Word/每日一练 ZIP worker 已完成，继续补视频播放防盗链、真实 AV/内容安全服务联调和转码/CDN 级水印。 - 真实数据 dry-run：导出 PocketBase 用户、题库、单词、知识手册、分数线、订单、权益，先跑 `npm run pb:import:dry-run -- --profile=production --json --fail-on-warnings`，确认 `migrationReadiness` 的必需集合和关键字段覆盖率通过，再跑迁移和校验报告。 - 生产环境配置：`.env.example` 和 `npm run readiness:production` / `npm run readiness:production:db` 已补；继续补数据库迁移流程、备份恢复、日志、告警和 API 容器部署说明。 -- Taro scaffold：`apps/taro` 地基已建立；学生端、租户后台、平台后台第一批 H5 页面已接真实 API，学生端已接地区选择、错题/收藏复习、阅读理解/案例分析多小题作答、题目反馈、视频解析、练习/模考报告、收银台、订单详情和售后入口第一版，平台后台关键写操作第一版已接入，租户工作台已接权限驱动模块入口，租户学生运营页已接学生创建/更新、禁用/恢复、批量导入、批量分班、备注和跟进任务第一版，租户内容页已接公共题库采纳/同步、冲突查看、单条/批量采纳平台或保留本地、导入问题、字段模板预览/下载、上传/粘贴预览、字段别名覆盖、同步/异步导入、异步轮询和复检详情第一版，租户设置页已接角色模板创建/编辑/停用、成员绑定模板和权限可见性配置第一版，租户营销中心已接 CRM 配置/队列和分佣结算操作台第一版；下一步补公式图片混排、更细数据范围 UI、平台后台审计增强和小程序兼容验证。 +- Taro scaffold：`apps/taro` 地基已建立；学生端、租户后台、平台后台第一批 H5 页面已接真实 API，学生端已接地区选择、错题/收藏复习、阅读理解/案例分析多小题作答、题目反馈、视频解析、练习/模考报告、收银台、订单详情和售后入口第一版，积分任务/兑换 service 已接；平台后台关键写操作第一版已接入，租户工作台已接权限驱动模块入口，租户学生运营页已接学生创建/更新、禁用/恢复、批量导入、批量分班、备注和跟进任务第一版，租户内容页已接公共题库采纳/同步、冲突查看、单条/批量采纳平台或保留本地、导入问题、字段模板预览/下载、上传/粘贴预览、字段别名覆盖、同步/异步导入、异步轮询和复检详情第一版，租户设置页已接角色模板创建/编辑/停用、成员绑定模板和权限可见性配置第一版，租户营销中心已接 CRM 配置/队列、分佣结算和积分任务/兑换 service 第一版；下一步补积分任务/兑换页面 UI、公式图片混排、更细数据范围 UI、平台后台审计增强和小程序兼容验证。 ### P1：商用收费和运营能力 @@ -97,7 +97,7 @@ - 三套默认主题、租户主题预览、Logo/图标/分享图配置。 - CRM worker：钉钉、飞书、企微机器人发送、签名、失败重试已落地；Taro 营销中心已能配置 CRM 和查看队列；继续补轮询/定向分配、富卡片、失败告警和死信运营台。 - 销售/代理分佣基础闭环已接 Taro 第一版；继续补销售团队看板、客资跟进效果、结算导出、真实打款、凭证和财务复核。 -- AI 择校推荐：地区考试数据、学生输入 schema、AI JSON 输出、PDF 报告生成。 +- AI 择校推荐：`local_rules` JSON 报告地基已完成；继续补真实 AI provider、prompt 版本、租户后台配置、PDF 报告生成和人工复核。 - 性能压测、慢 SQL 审查、备份恢复演练、灰度发布和回滚预案。 ## 后端完成判定 diff --git a/docs/refactor/blueprint-coverage.md b/docs/refactor/blueprint-coverage.md index e221dc55..f163cce2 100644 --- a/docs/refactor/blueprint-coverage.md +++ b/docs/refactor/blueprint-coverage.md @@ -25,7 +25,7 @@ | 分数线 | 可联调 | 字段、院校、专业、记录、趋势、年份、JSON 批量导入 | 复杂动态筛选、AI 择校数据上下文 | | 视频解析会员 | 可联调 | 题目视频、批量查询、后台绑定、视频 JSON 导入、SVIP 权限、播放次数扣减、签名 URL、播放日志、动态水印上下文 | 深度防盗链、转码级水印、播放统计 | | 资料下载/PDF | 可联调 | `content_assets` 资源台账、后台资源管理、OSS/COS/Supabase Storage 上传下载签名、上传确认、PDF/图片预览签名、学生端列表、SVIP 下载权限、动态水印上下文、assets worker 复检、内置安全扫描和外部 HTTP scanner 接入层 | CDN 防盗链、真实 AV/内容安全服务联调、资料前端管理页 | -| 营销中心 | 可联调 | SVIP 套餐、激活码批次、激活码生成、优惠券启停/归档、活动分组、最低金额、优惠封顶、单用户限次、首单限制、适用套餐/地区、核销明细、核销报表、Banner/FAQ/公告、勋章管理、手动发放、签到/积分/反馈自动发放 | 积分兑换、活动任务、练习/单词/模考触发勋章、营销自动化和前端活动操作台 | +| 营销中心 | 可联调 | SVIP 套餐、激活码批次、激活码生成、优惠券启停/归档、活动分组、最低金额、优惠封顶、单用户限次、首单限制、适用套餐/地区、核销明细、核销报表、Banner/FAQ/公告、勋章管理、手动发放、签到/积分/反馈/活动任务自动发放、积分活动任务、积分兑换商品、兑换订单和优惠券兑换履约 | 连续签到奖励配置、练习/单词/模考触发勋章、积分风控报表、营销自动化和前端活动操作台 | | 销售/代理客资 | 可联调 | 邀请码、扫码/分享事件、首绑保护、销售统计、客资明细、团队关系、手动补绑、分佣比例、归因、结算单、审核和打款状态 | 真实微信小程序码、真实打款、结算导出、销售团队看板 | | CRM 系统 | 可联调 | CRM 配置、密钥私密存储、客资入队、队列查询、generic/钉钉/飞书/企微 worker、签名、重试和日志 | 定向/轮询分配、富卡片模板、失败告警、死信运营台 | | 数据看板 | 可联调 | 租户 dashboard 聚合接口，收益、注册、学习、内容、激活码、反馈、趋势、24h 活跃、套餐销量和运营动态 | 预聚合 worker、缓存、慢 SQL 监控和销售转化看板 | diff --git a/docs/refactor/frontend-handoff-index.md b/docs/refactor/frontend-handoff-index.md index fce9d9db..9e9dc7bf 100644 --- a/docs/refactor/frontend-handoff-index.md +++ b/docs/refactor/frontend-handoff-index.md @@ -46,7 +46,7 @@ - 上线前需要把三套 H5 构建、`runtime-config.json` 人工复核、真实 Auth/RLS、迁移 dry-run、对象存储、支付对账和 `@codex-security` 结果写入 `production-launch-evidence.json`，并通过 `npm run launch:gate`。 - 可以接入租户品牌、已发布主题、公开素材、功能开关和域名/小程序参数解析；学生端只读 `/api/tenant/resolve` 的 `branding.theme/publicAssets`，租户后台草稿走 `/api/tenant-admin/theme`。 - 租户后台可以接入角色模板和成员 API：`/api/tenant-admin/role-templates`、`/api/tenant-admin/members`，用于运营、教师、销售、代理等自定义菜单/模块/字段可见性和成员模板绑定。 -- 租户后台可以接入勋章管理和手动发放：`GET/PUT /api/tenant-admin/badges`、`GET/POST /api/tenant-admin/badge-grants`；学生端用 `GET /api/profile/badges` 展示成就。 +- 租户后台可以接入勋章管理、手动发放、积分任务和积分兑换：`GET/PUT /api/tenant-admin/badges`、`GET/POST /api/tenant-admin/badge-grants`、`GET/PUT /api/tenant-admin/point-activity-tasks`、`GET /api/tenant-admin/point-activity-claims`、`GET/PUT /api/tenant-admin/point-exchange-items`、`GET /api/tenant-admin/point-exchange-orders`；学生端用 `GET /api/profile/badges` 展示成就，并通过 `GET /api/profile/activity-tasks`、`POST /api/profile/activity-tasks/claim`、`GET /api/profile/exchange-items`、`POST /api/profile/exchange-items/redeem` 接积分活动和兑换。 ## 不能误认为已商用完成的部分 @@ -55,7 +55,7 @@ - 短信、微信小程序/网页登录、QQ 登录、微信支付、支付宝支付 provider 已有本地 adapter 和测试覆盖；生产账号、回调域名、证书和商户资料仍需正式联调。 - 对象存储已完成签名 provider、上传后校验、PDF/图片预览、动态水印上下文、资源复检 worker、内置安全扫描、外部 HTTP scanner 接入层和租户后台媒体运营报表；Taro 学生资料页已接短期签名、水印 traceId 展示和强制水印容器第一版；CDN 防盗链、转码级视频水印和真实 AV/内容安全服务联调还要补。 - 题目/单词/知识手册/分数线/视频 JSON/CSV/Excel 导入已可联调；大批量导入可传 `executionMode=async` 交给 imports worker；模板下载、字段映射 API、导入任务详情和导入后复检已可用。租户内容页已经可以选择文件或粘贴内容、下载模板、执行后端预览、编辑本次字段别名、同步/异步提交导入、轮询异步 job、查看问题行并触发/查看复检；后续还要补真实数据 dry-run 验收和更完整的目标入口/集合选择。 -- 数据看板、分佣结算、财务运营、勋章手动发放、签到/积分/反馈自动发放和主题模板发布基础 API 已可联调；练习/单词/模考触发勋章、真实打款 provider、发票、真实生产账单抽样验收、AI 择校真实 provider、主题素材库/模板市场等仍是后续商用增强项。 +- 数据看板、分佣结算、财务运营、勋章手动发放、签到/积分/反馈/积分活动自动发放、积分任务/兑换第一阶段和主题模板发布基础 API 已可联调；练习/单词/模考触发勋章、积分风控报表、连续签到奖励配置、真实打款 provider、发票、真实生产账单抽样验收、AI 择校真实 provider、主题素材库/模板市场等仍是后续商用增强项。 ## 前后端协作建议 @@ -83,9 +83,9 @@ | 知识手册 | `apps/taro/src/pages/student/handbook/index.tsx` | `handbook-subjects`、`handbook-chapters`、`handbook-entries`；已接 RichContent 阅读渲染第一版 | | 分数线 | `apps/taro/src/pages/student/scoreline/index.tsx` | `scoreline/records` | | 资料 | `apps/taro/src/pages/student/assets/index.tsx` | `assets`、`assets/preview`、`assets/download`；已接短期签名、过期信息、可见水印覆盖、traceId 展示和强制水印资源外部预览限制 | -| 个人中心 | `apps/taro/src/pages/student/profile/index.tsx` | `profile/me`、`check-in`、`badges`、`exam-countdowns`、`svip-plans`、`orders`、`entitlements`、`activation-codes`、`leaderboard`、`learning/stats`、`learning/trend`、`practice-sessions/history` | +| 个人中心 | `apps/taro/src/pages/student/profile/index.tsx` | `profile/me`、`check-in`、`badges`、`exam-countdowns`、`svip-plans`、`orders`、`entitlements`、`activation-codes`、`leaderboard`、`learning/stats`、`learning/trend`、`practice-sessions/history`；`src/services/profile.ts` 已补积分任务/兑换 service，页面 UI 待接 | -当前页面主要用于打通接口和路由。学生端第一版学习闭环已经覆盖“选地区 -> 进题库 -> 创建 session -> 答题卡/答题/主观题自评/复合题多小题/收藏/反馈/视频 -> 交卷报告逐题复盘 -> 错题/收藏复习”，背单词已经覆盖“单元 -> 今日计划/全单元/收藏练习 -> 卡片翻转 -> 发音 -> 认识/再记上报 -> 本地恢复”，资料页已经覆盖“列表 -> 申请预览/下载短签名 -> 展示水印 traceId -> H5 水印容器预览或确认下载”，个人中心已经覆盖“基础资料 -> 学习报告 -> 14 天趋势 -> 题型表现 -> 最近练习 -> 排名/勋章/签到 -> 会员/订单/激活码”，会员闭环已经覆盖“选套餐 -> 领优惠券 -> 下单 -> 创建支付参数 -> 状态轮询 -> 订单详情/售后入口”。`apps/taro/src/components/RichContent.tsx` 是学生端题干、选项、解析和知识手册的统一安全渲染组件：它只支持受控 Markdown 图片、基础表格、粗体、代码和被 parser 识别出的公式 token；H5 端用 KaTeX 渲染 `$...$`、`$$...$$`、`\(...\)`、`\[...\]`，私有题图可用 `asset:`、`content_asset:` 或 `/asset/` 资源引用向后端申请短期预览签名。组件不执行导入内容中的任意 HTML/JS，也会拒绝 `javascript:`、`data:` 等危险图片地址。后续 UI 需要继续按旧题库视觉和 Taro H5/小程序限制优化，并重点补小程序公式真机验收、题图资源字段化、小程序分享/支付容器体验。 +当前页面主要用于打通接口和路由。学生端第一版学习闭环已经覆盖“选地区 -> 进题库 -> 创建 session -> 答题卡/答题/主观题自评/复合题多小题/收藏/反馈/视频 -> 交卷报告逐题复盘 -> 错题/收藏复习”，背单词已经覆盖“单元 -> 今日计划/全单元/收藏练习 -> 卡片翻转 -> 发音 -> 认识/再记上报 -> 本地恢复”，资料页已经覆盖“列表 -> 申请预览/下载短签名 -> 展示水印 traceId -> H5 水印容器预览或确认下载”，个人中心已经覆盖“基础资料 -> 学习报告 -> 14 天趋势 -> 题型表现 -> 最近练习 -> 排名/勋章/签到 -> 会员/订单/激活码”，积分活动/兑换 service 已具备但页面 UI 待接，会员闭环已经覆盖“选套餐 -> 领优惠券 -> 下单 -> 创建支付参数 -> 状态轮询 -> 订单详情/售后入口”。`apps/taro/src/components/RichContent.tsx` 是学生端题干、选项、解析和知识手册的统一安全渲染组件：它只支持受控 Markdown 图片、基础表格、粗体、代码和被 parser 识别出的公式 token；H5 端用 KaTeX 渲染 `$...$`、`$$...$$`、`\(...\)`、`\[...\]`，私有题图可用 `asset:`、`content_asset:` 或 `/asset/` 资源引用向后端申请短期预览签名。组件不执行导入内容中的任意 HTML/JS，也会拒绝 `javascript:`、`data:` 等危险图片地址。后续 UI 需要继续按旧题库视觉和 Taro H5/小程序限制优化，并重点补积分任务/兑换页面、小程序公式真机验收、题图资源字段化、小程序分享/支付容器体验。 ## 已落地的 Taro 租户后台页面 @@ -95,11 +95,11 @@ | 数据看板 | `apps/taro/src/pages/tenant-admin/dashboard/index.tsx` | `tenant-admin/dashboard` | | 学生运营 | `apps/taro/src/pages/tenant-admin/students/index.tsx` | `tenant-admin/classes`、`tenant-admin/teachers`、`tenant-admin/students`、`students/bulk-upsert`、`students/status`、`classes/members/bulk-assign`、`students/notes`、`students/followups` | | 题库内容 | `apps/taro/src/pages/tenant-admin/content/index.tsx` | `tenant-content/content-entries`、`tenant-content/imports`、`imports/detail`、`imports/issues`、`imports/field-mapping`、`imports/templates`、`imports/post-check`、`tenant-content/exports/questions`、`tenant-content/exports/jobs`、`tenant-content/assets/sign-download`、`tenant-content/assets/sign-preview`、`tenant-content/assets/security-scan-events`、`tenant-content/public-question-banks`、`public-question-banks/adopt`、`public-question-banks/sync`、`public-question-banks/conflicts`、`public-question-banks/conflicts/resolve`、`public-question-banks/conflicts/resolve-batch`、`tenant-content/notifications`、`tenant-content/notifications/status` | -| 营销中心 | `apps/taro/src/pages/tenant-admin/marketing/index.tsx` | `tenant-admin/coupons`、`code-batches`、`activation-codes`、`crm/config`、`crm/queue`、`commission/settings`、`member-rate`、`summary`、`orders`、`settlements`、`settlements/generate`、`settlements/status` | +| 营销中心 | `apps/taro/src/pages/tenant-admin/marketing/index.tsx` | `tenant-admin/coupons`、`code-batches`、`activation-codes`、`crm/config`、`crm/queue`、`commission/settings`、`member-rate`、`summary`、`orders`、`settlements`、`settlements/generate`、`settlements/status`；`src/services/tenantAdmin.ts` 已补积分任务/兑换配置和记录 service，页面 UI 待接 | | 财务运营 | `apps/taro/src/pages/tenant-admin/finance/index.tsx` | `commerce/refunds`、`commerce/refunds/status`、`commerce/operations/anomalies`、`commerce/reconciliation/batches`、`commerce/reconciliation/items`、`commerce/reconciliation/issues/create`、`commerce/reconciliation/issues`、`commerce/reconciliation/issues/status`、`commerce/reconciliation/provider-bills/request`、`commerce/reconciliation/provider-bills/jobs`、`commerce/adjustment-vouchers`、`commerce/adjustment-vouchers/status`、`commerce/adjustment-vouchers/report` | | 租户设置 | `apps/taro/src/pages/tenant-admin/settings/index.tsx` | `tenant-admin/overview`、`domains`、`payment-accounts`、`auth-providers`、`theme-templates`、`theme`、`theme/preview`、`theme/publish`、`permissions`、`GET/PUT role-templates`、`POST role-templates/disable`、`GET/PUT members`、`POST members/disable` | -当前租户后台已有第一批运营操作：工作台按权限矩阵隐藏不可见模块；学生运营页支持学生创建/更新、状态禁用/恢复、批量导入、批量分班、学生备注、跟进任务和完成跟进；题库内容页支持公共题库采纳/同步、同步通知查看与已读/忽略、同步冲突查看、单条/批量采纳平台版本或保留本地版本、导入任务详情、异步 job 轮询、导入问题查看、字段映射/模板预览/下载、JSON/CSV/Excel 导入预览和执行、字段别名覆盖和导入后复检详情，也可接 JSON/试卷 payload 同步导出与 PDF/Word 异步导出 job 轮询，完成后用 `assetId` 走后台资源签名下载/预览；营销中心支持 CRM 配置保存、队列按状态查看、分佣规则、成员分佣比例、分佣订单明细、结算单生成、审核通过/驳回和标记线下打款；财务运营页支持退款状态流、官方账单任务、对账异常、差错工单和调整凭证，且只通过后端命令层写审计与状态；租户设置页支持主题模板选择、草稿预览、发布、角色模板创建、编辑、停用、权限点、菜单、模块、字段、基础数据范围配置、成员搜索/新建、成员绑定模板、成员状态和额外权限覆盖。下一批需要继续补更精细的学生导入模板体验、更细数据范围 UI、主题素材库、真实打款 provider、发票、真实生产账单抽样验收和小程序端兼容。 +当前租户后台已有第一批运营操作：工作台按权限矩阵隐藏不可见模块；学生运营页支持学生创建/更新、状态禁用/恢复、批量导入、批量分班、学生备注、跟进任务和完成跟进；题库内容页支持公共题库采纳/同步、同步通知查看与已读/忽略、同步冲突查看、单条/批量采纳平台版本或保留本地版本、导入任务详情、异步 job 轮询、导入问题查看、字段映射/模板预览/下载、JSON/CSV/Excel 导入预览和执行、字段别名覆盖和导入后复检详情，也可接 JSON/试卷 payload 同步导出与 PDF/Word 异步导出 job 轮询，完成后用 `assetId` 走后台资源签名下载/预览；营销中心支持 CRM 配置保存、队列按状态查看、分佣规则、成员分佣比例、分佣订单明细、结算单生成、审核通过/驳回和标记线下打款，积分任务/兑换 service 已具备但页面 UI 待接；财务运营页支持退款状态流、官方账单任务、对账异常、差错工单和调整凭证，且只通过后端命令层写审计与状态；租户设置页支持主题模板选择、草稿预览、发布、角色模板创建、编辑、停用、权限点、菜单、模块、字段、基础数据范围配置、成员搜索/新建、成员绑定模板、成员状态和额外权限覆盖。下一批需要继续补积分任务/兑换操作台、更精细的学生导入模板体验、更细数据范围 UI、主题素材库、真实打款 provider、发票、真实生产账单抽样验收和小程序端兼容。 ## 已落地的 Taro 平台后台页面 diff --git a/docs/refactor/implementation-status.md b/docs/refactor/implementation-status.md index e5d00816..5749e022 100644 --- a/docs/refactor/implementation-status.md +++ b/docs/refactor/implementation-status.md @@ -33,8 +33,8 @@ | 分数线 | 已建院校、专业、字段、记录表 | 已支持导入映射 | 字段、院校、专业、记录、趋势、年份、租户后台维护 API、JSON 预览导入已实现 | 核心 API 集成测试含导入断言 | 查询、后台维护和批量 JSON 导入基础闭环已实现，复杂动态筛选和 AI 择校上下文待补 | | 题目视频讲解 | 已建 `video_explanations`、`question_videos` | 已支持导入映射 | 单题视频、批量预加载、通用视频搜索、播放签名、视频次数扣减、播放水印上下文、租户后台视频创建绑定 API、JSON 预览导入已实现 | 核心 API 集成测试含播放、水印 traceId 和导入断言 | 播放、权益、后台绑定、动态水印上下文和批量 JSON 导入链路已实现，深度防盗链、转码级水印和播放统计待补 | | 资料下载/PDF | 已扩展 `content_assets`，新增资源台账和导入任务表 | 旧 `app_assets/images` 兼容导入 | 租户后台资源管理、OSS/COS/Supabase Storage 上传/下载签名、上传确认、PDF/图片预览签名、资源访问审计、动态水印上下文、内置安全扫描、外部 HTTP scanner 接入层、题库导出 PDF/Word/每日一练 ZIP 自动发布可信资源、学生端资料列表/下载权限已实现 | 核心 API 集成测试含 SVIP 资料下载、安全扫描门禁、水印 traceId，assets worker 覆盖内置规则与外部 scanner 通过/失败/不可用 fail-closed，exports worker 测试；Taro 类型检查覆盖学生资料水印预览/下载确认 | 资料资源基础闭环可跑，Taro 学生资料页已接短期签名、可见水印覆盖、追踪码展示和强制水印资源外部打开限制第一版；真实 AV/内容安全服务联调、CDN 防盗链、转码/CDN 级水印待补 | -| 个人中心 | 已建 `student_profiles`、会员权益、订单、练习记录、`badges/user_badges` | 已支持部分用户资料和勋章导入 | 个人资料、目标院校/专业、手机号绑定/换绑、会员状态、最近练习、统计聚合、签到积分、题目反馈、考试倒计时、勋章 API 已实现 | API 集成测试、Taro 类型检查 | 学生端个人中心已接学习报告、14 天趋势、题型表现、最近练习、7 日答题榜当前排名、激活码和订单入口第一版；头像上传、账号合并、更细任务系统和学习建议待补 | -| 活动/优惠 | 已建优惠券、激活码、激活码批次、banner、FAQ、公告、勋章等基础表 | 部分支持 | banner/FAQ/公告只读与租户后台维护、激活码预检查/兑换、激活码批次、批量生成激活码、优惠券维护、前台领取/下单抵扣、最低金额、优惠封顶、单用户限次、首单限制、适用套餐/地区、活动分组、核销明细、核销报表、勋章维护、手动发放、签到/积分/反馈自动发放已实现 | 核心 API 集成测试 | 基础运营后台可用，积分兑换、活动任务、练习/单词/模考触发勋章、营销自动化和前端活动操作台继续补 | +| 个人中心 | 已建 `student_profiles`、会员权益、订单、练习记录、`badges/user_badges`、积分任务/兑换表 | 已支持部分用户资料和勋章导入 | 个人资料、目标院校/专业、手机号绑定/换绑、会员状态、最近练习、统计聚合、签到积分、积分任务、积分兑换、题目反馈、考试倒计时、勋章 API 已实现 | API 集成测试、Taro 类型检查 | 学生端个人中心已接学习报告、14 天趋势、题型表现、最近练习、7 日答题榜当前排名、激活码和订单入口第一版；Taro service 已补积分任务/兑换；头像上传、账号合并、更细学习建议待补 | +| 活动/优惠 | 已建优惠券、激活码、激活码批次、banner、FAQ、公告、勋章、积分任务、积分兑换商品和兑换订单表 | 部分支持 | banner/FAQ/公告只读与租户后台维护、激活码预检查/兑换、激活码批次、批量生成激活码、优惠券维护、前台领取/下单抵扣、最低金额、优惠封顶、单用户限次、首单限制、适用套餐/地区、活动分组、核销明细、核销报表、勋章维护、手动发放、签到/积分/反馈/活动任务自动发放、积分任务领取、积分兑换、优惠券兑换履约已实现 | 核心 API 集成测试 | 基础运营后台可用；连续签到奖励配置、练习/单词/模考触发勋章、营销自动化、积分风控报表和前端活动操作台继续补 | | 销售/代理客资追踪 | 已建推荐码、首绑客资、团队关系、小程序码缓存、CRM 队列 | 旧 `referral_tracks` 已有映射基础 | 邀请码、扫码/分享事件、首绑保护、销售统计、客资明细、手动补绑、团队关系、CRM 配置/队列、CRM worker 推送已实现 | 核心 API 集成测试、CRM worker 集成测试 | 增长链路基础可用，真实微信小程序码、CRM 分配策略、富卡片和销售转化看板待补 | | 租户后台 | 已建品牌、域名、设置、支付账户、登录 provider、私密密钥表、成员、审计日志、资源台账、导入台账、内容导航台账 | 不适用 | 概览、品牌、设置、域名、支付账户、登录配置、密钥掩码、活动内容、兑换码/优惠券、成员管理、权限矩阵、审计查询、角色模板权限/菜单/模块/字段/数据范围配置、内容入口/分类树/题目集合/练习蓝图维护、资源管理、题目/单词/知识手册/分数线/视频 JSON/CSV/Excel 同步/异步导入已实现 | 核心 API 集成测试含角色/权限/租户隔离/密钥不泄露/导航/组卷/资源与导入断言 | 租户配置与运营闭环可用；Taro 已接角色模板操作台、字段映射操作台和导入复检结果面板第一版；继续补成员绑定模板、权限驱动菜单和更细数据范围 UI | | 平台后台 | 已建 SaaS 套餐、订阅、账单、服务费、用量 | 不适用 | 租户管理、账单、收款确认、用量记录、平台管理员 Supabase JWT 鉴权已实现 | API 集成测试 | 平台收费链路骨架可用，平台审计报表/自动计费待补 | @@ -309,5 +309,5 @@ platform-admin: 2. 补公共题库生产定时调度/失败告警、租户套餐地区/科目/题库范围限制、主题模板系统。 3. 补学习统计增强：排行榜防刷/预聚合、断点续练、专项练习策略和更细题型分析。 4. 补视频商用控制：深度防盗链、转码级水印和播放统计。 -5. 补 AI 择校推荐报告、排行榜防刷/预聚合、积分兑换、活动任务和更多学习行为触发勋章。 +5. 补 AI 择校推荐报告、排行榜防刷/预聚合、连续签到奖励配置、积分风控报表和更多学习行为触发勋章。 6. 接真实短信/OAuth 生产账号、真实生产账单格式验收和异常订单运营台，并继续推进 Taro scaffold。 diff --git a/docs/refactor/legacy-feature-gap-matrix.md b/docs/refactor/legacy-feature-gap-matrix.md index 8a2ebe05..4c0c3546 100644 --- a/docs/refactor/legacy-feature-gap-matrix.md +++ b/docs/refactor/legacy-feature-gap-matrix.md @@ -31,11 +31,11 @@ | 知识手册 | `Handbook*.tsx` | 已覆盖 | Taro 已接手册科目/章节/条目、RichContent 安全渲染、H5 KaTeX 公式渲染和私有资源 ID 短签名地基第一版；后续补搜索、高亮、目录锚点、小程序公式真机验收和图片资源字段化 | | 分数线 | `ScorelinePage.tsx` | 已覆盖 | 动态字段/趋势、后台维护和 JSON 批量导入已有；后续补复杂筛选优化和 AI 择校数据上下文 | | 商城/SVIP | `Store.tsx`、`SvipModal.tsx` | 部分覆盖 | 套餐、订单、订单详情/状态轮询、权益、激活码预检查/兑换、优惠券领取/下单抵扣、微信支付/支付宝 provider 主链路、内部退款状态机、微信/支付宝发起退款、退款查询确认、退款通知 webhook、支付/退款补偿 worker、全额退款权益撤销、资金对账手工/API 导入比对、微信/支付宝官方账单下载 worker、异常查询、差错工单和事件轨迹、异常订单运营台、人工调整凭证复核报表已有；Taro 学生收银台/订单详情和租户财务运营台第一版已接；仍缺更完整售后体验、真实生产账单抽样验收和生产账号联调 | -| 个人中心 | `Profile.tsx` | 部分覆盖 | 基本资料、手机号绑定/换绑、权益、订单统计、练习历史、学习统计、签到积分、考试倒计时、趋势、勋章展示 API 已有；Taro 已接学习报告、14 天趋势、题型表现、最近练习、7 日答题榜当前排名、激活码和订单入口第一版；继续补任务系统、头像上传、账号合并和更细学习建议 | +| 个人中心 | `Profile.tsx` | 部分覆盖 | 基本资料、手机号绑定/换绑、权益、订单统计、练习历史、学习统计、签到积分、积分活动任务、积分兑换、考试倒计时、趋势、勋章展示 API 已有；Taro service 已补任务/兑换接口，页面 UI 待接；继续补头像上传、账号合并和更细学习建议 | | 资料下载 | `QuestionExporterPublishModal.tsx` 等 | 部分覆盖 | 资源台账、上传确认、签名下载、PDF/图片预览、动态水印上下文、Taro 学生端水印 traceId 预览/下载确认、worker 复检、内置安全扫描和外部 HTTP scanner 接入层已有；仍缺深度防盗链、真实 AV/内容安全服务联调、转码/CDN 级水印和生命周期策略 | | AI 择校推荐 | 业务规划新增 | 部分覆盖 | 已有 SVIP 门禁、学生输入 schema、地区/分数线上下文、稳定 JSON 输出、报告台账、审计和 Taro 学生端基础页；真实 AI provider、prompt 版本管理后台、报告 PDF 渲染和更细推荐算法待补 | | 题目反馈 | `02-API接口.md` 用户反馈 | 部分覆盖 | 学生提交、本人列表、租户后台处理、状态事件、反馈奖励积分已覆盖；缺处理通知、前端消息提醒和批量统计 | -| 签到积分 | `Profile.tsx`、`02-API接口.md` | 部分覆盖 | 每日签到、连续签到基础、积分流水、重复签到幂等、签到/积分阈值自动发放勋章已覆盖；缺积分兑换、活动任务和更完整的运营规则 | +| 签到积分 | `Profile.tsx`、`02-API接口.md` | 部分覆盖 | 每日签到、连续签到基础、积分流水、重复签到幂等、签到/积分阈值自动发放勋章、积分活动任务、积分兑换商品、优惠券兑换履约和租户后台配置已覆盖；后续补连续签到奖励配置、积分风控报表和更多系统触发任务 | | 排行榜 | `leaderboard.pb.js`、`02-API接口.md` | 部分覆盖 | 已有刷题数、积分、背单词、模考最高分排行榜，支持租户/地区/班级范围和当前用户排名；后续补防刷、日/周榜预聚合、运营后台排名看板 | ## 租户后台功能 @@ -57,7 +57,7 @@ | SVIP 套餐 | 部分覆盖 | 地区/科目/题库范围校验已接入练习/资料/视频；后续补分类/专业增项购买和套餐规则 UI | | 优惠券 | 已覆盖 | 后台配置、前台领取、同用户同券未核销幂等、下单抵扣、全额优惠自动开通权益、最低金额、封顶、单用户限次、首单限制、适用套餐/地区、活动分组、核销明细和报表已有；前端营销活动 UI 继续完善 | | 激活码 | 已覆盖 | 批次、生成、预检查、兑换、自用码拒绝、地区校验主链路已有 | -| 勋章管理 | 部分覆盖 | 后台勋章维护、手动发放、重复发放幂等、学生端勋章展示、权限隔离、签到连续天数、积分阈值和反馈解决自动发放已覆盖；练习次数、单词掌握、模考成绩、积分活动联动、发放通知和前端运营 UI 待补 | +| 勋章管理 | 部分覆盖 | 后台勋章维护、手动发放、重复发放幂等、学生端勋章展示、权限隔离、签到连续天数、积分阈值、反馈解决和积分活动自动发放已覆盖；练习次数、单词掌握、模考成绩、发放通知和前端运营 UI 待补 | | 题库录入 | 已覆盖 | 单题创建/更新、题目/单词/知识手册/分数线/视频 JSON/CSV/Excel 同步/异步导入、集合/蓝图、导入后复检、模板下载、字段映射 API 和导入任务详情已有；Taro 租户内容页已接上传/粘贴预览、模板下载、字段别名编辑、同步/异步执行、异步轮询和复检结果详情第一版；真实数据验收待补 | | 题库导出 PDF/Word/JSON/每日一练 ZIP | 部分覆盖 | 服务端 JSON、`paper_json`、打印 payload、PDF、Word 和每日一练 ZIP 图片素材包异步导出已补，含租户内容编辑权限、跨租户拒绝、答案/解析开关、子题脱敏、导出 job、审计、水印、`content_assets` 发布/下载路径和 exports worker；每日一练九宫格 metadata、PDF/Word 基础版式、9 张 PNG/SVG 卡片和拼图包已补；后续补更精细试卷模板和后台操作台体验 | | 题型分组/模拟卷配置 | 部分覆盖 | question_type_groups 表和 blueprint 有基础；后台配置体验待补 | @@ -104,8 +104,8 @@ 7. CRM/销售结算：CRM worker、跟进分配策略、分佣规则、结算单、审核、打款状态、导出和凭证复核基础闭环已完成；仍缺富卡片模板、失败告警、死信运营台、真实打款 provider、发票和销售结算看板。 8. AI 择校推荐增强：后端 `local_rules` 地基、SVIP 门禁、报告列表/详情和 Taro 基础页已完成；仍缺真实 AI provider、prompt 编排、PDF 报告和后台运营配置。 9. 题目反馈增强：处理通知、消息提醒、问题聚合统计和内容修复闭环。 -10. 积分活动增强：积分兑换、活动任务、连续签到奖励配置和风控。 -11. 勋章增强：后台维护、手动发放、签到/积分/反馈自动发放已有；仍缺按练习次数、单词掌握、模考成绩、活动任务自动发放，以及发放通知。 +10. 积分活动增强：积分兑换、活动任务、优惠券兑换履约和后台配置第一阶段已完成；仍缺连续签到奖励配置、积分风控报表、活动效果看板和更细系统任务触发。 +11. 勋章增强：后台维护、手动发放、签到/积分/反馈/活动任务自动发放已有；仍缺按练习次数、单词掌握、模考成绩自动发放，以及发放通知。 ### P0：前端联调到云端前 diff --git a/docs/refactor/next-development-todo.md b/docs/refactor/next-development-todo.md index 2291f7c7..a6471d18 100644 --- a/docs/refactor/next-development-todo.md +++ b/docs/refactor/next-development-todo.md @@ -22,7 +22,8 @@ - 租户组织范围：班级、班级成员、教师/班主任/助教/学生分组，教师按负责班级查看学生，字段权限可脱敏学生手机号。 - 学生运营管理：学生批量 upsert、禁用/恢复、批量分班、备注、跟进任务已完成接口和集成测试；Taro 租户学生运营页已接学生创建/更新、状态切换、批量导入、批量分班、备注和跟进任务第一版；后续补批量 CRM 推送、自动学习督导和更细导入模板体验。 - 旧题库运营缺口已补一批：考试日期/倒计时、题目反馈/纠错处理、每日签到积分和积分流水、学习排行榜已完成接口和集成测试。 -- 勋章管理已完成租户后台维护、手动发放、重复发放幂等、学生个人中心展示、权限点和集成测试；签到连续天数、积分阈值和反馈解决自动发放第一阶段已完成并纳入 API 集成测试；后续补练习次数、单词掌握、模考成绩、活动任务联动和发放通知。 +- 勋章管理已完成租户后台维护、手动发放、重复发放幂等、学生个人中心展示、权限点和集成测试；签到连续天数、积分阈值、反馈解决和积分活动任务自动发放第一阶段已完成并纳入 API 集成测试；后续补练习次数、单词掌握、模考成绩和发放通知。 +- 积分活动和兑换第一阶段已完成：租户后台可配置积分任务/兑换商品并查看领取/兑换记录，学生端可查询任务、领取奖励、查看兑换商品、兑换并生成 `redeem_cost` 积分流水；优惠券兑换会生成 `coupon_redemptions`，手工/自定义商品进入待履约订单；后续补连续签到奖励配置、积分风控报表和前端操作台。 - 旧商城体验已补齐主链路：订单详情、订单状态轮询、激活码预检查、自用激活码拒绝、优惠券前台领取、下单抵扣、零元订单自动支付开通权益，且手工支付确认已限制为租户后台 `tenant:payment:write` 权限。 - 优惠券商用规则已补齐后端和 Taro 租户后台第一版：租户后台可配置启停/归档、活动分组、最低金额、优惠封顶、单用户限次、首单限制、适用套餐/地区和 metadata；学生领取/下单会由后端复核规则，后台可查核销明细和按活动/日期/券聚合的核销报表。 - 公共题库商业化基础闭环已完成：平台公共题库可由平台管理员按 SaaS 套餐/指定租户/全部活跃租户授权；租户内容管理员只能看到自己被授权的公共题库，并可采纳为本租户题库、内容入口、题目集合和题目快照，采纳后可直接进入练习 session；平台题库后续新增/更新题目可通过手动同步 API 或 `public-banks` worker 进入租户副本，并生成租户内容通知；租户自改题目会返回冲突并保留原内容，后台可查询最近一次冲突明细，并可单条或批量选择采纳平台版本/保留本地版本，冲突处理完成后通知自动 resolved。 @@ -128,7 +129,7 @@ 9. 积分和反馈增强 - 已完成每日签到、积分流水、反馈提交、租户后台处理、奖励积分幂等。 - 已完成勋章后台维护、手动发放、学生端展示，以及签到连续天数、积分阈值、反馈解决自动发放第一阶段。 - - 继续补积分兑换、活动任务、连续签到奖励配置、练习/单词/模考触发勋章、处理通知和反馈聚合统计。 + - 积分兑换、活动任务和优惠券兑换履约第一阶段已完成；继续补连续签到奖励配置、练习/单词/模考触发勋章、积分风控报表、处理通知和反馈聚合统计。 10. 数据看板 - 已完成首版实时聚合接口，覆盖收益、注册趋势、答题次数、收入趋势、题型分布、科目数量、题目总量、套餐销量、运营动态、24h 活跃度和激活码使用情况。 @@ -183,7 +184,7 @@ - H5 和小程序共用同一套业务 API client。 - 租户通过域名、小程序配置或启动参数解析。 - 页面主题、品牌、功能开关都从后端租户配置读取；学生端和后台只消费 `/api/tenant/resolve` 的已发布 `branding.theme/publicAssets`，租户后台草稿只通过 `/api/tenant-admin/theme` 查看。 -- 当前已完成 H5 学生端、租户后台、平台后台三套构建入口和统一 API client；学生端、租户后台、平台后台都有第一批真实 API 页面；学生端已补地区选择、刷题答题卡、后端权威断点续练、本地进度恢复、模拟倒计时、主观题后端自评、阅读理解/案例分析多小题、错题/收藏复习、题目反馈、视频解析、练习/模考报告、个人中心学习报告可视化、会员收银台、订单详情、售后入口、题干/选项/解析/知识手册 RichContent 安全渲染、H5 KaTeX 公式渲染、私有资源 ID 题图短签名渲染、逐题复盘、背单词卡片学习/发音/收藏练习第一版；平台后台已接入创建租户、状态变更、订阅、账单、收款、用量和公共题库授权第一版写操作；租户后台已接权限驱动工作台、学生运营操作台、主题模板预览/发布、角色模板、成员绑定和 CRM/分佣操作台第一版；下一步补小程序公式真机验收、题图资源字段化、个人中心任务系统、状态管理、更细数据范围 UI、学生批量运营增强和小程序兼容验证。 +- 当前已完成 H5 学生端、租户后台、平台后台三套构建入口和统一 API client；学生端、租户后台、平台后台都有第一批真实 API 页面；学生端已补地区选择、刷题答题卡、后端权威断点续练、本地进度恢复、模拟倒计时、主观题后端自评、阅读理解/案例分析多小题、错题/收藏复习、题目反馈、视频解析、练习/模考报告、个人中心学习报告可视化、会员收银台、订单详情、售后入口、题干/选项/解析/知识手册 RichContent 安全渲染、H5 KaTeX 公式渲染、私有资源 ID 题图短签名渲染、逐题复盘、背单词卡片学习/发音/收藏练习第一版，积分任务/兑换 service 已补；平台后台已接入创建租户、状态变更、订阅、账单、收款、用量和公共题库授权第一版写操作；租户后台已接权限驱动工作台、学生运营操作台、主题模板预览/发布、角色模板、成员绑定和 CRM/分佣操作台第一版，积分任务/兑换 service 已补；下一步补小程序公式真机验收、题图资源字段化、个人中心积分任务/兑换 UI、状态管理、更细数据范围 UI、学生批量运营增强和小程序兼容验证。 ### 第一批页面 @@ -235,7 +236,7 @@ ## 推荐下一步顺序 1. 补租户后台写操作台：公共题库采纳/同步、冲突查看、单条/批量冲突采纳平台或保留本地、导入问题、模板预览/下载、上传/粘贴 preview/import、字段映射编辑、异步导入轮询、导入后复检详情、权限驱动工作台、学生创建/更新/批量导入/批量分班/备注/跟进、角色模板配置、成员绑定模板、CRM 配置/队列/跟进分配策略、分佣规则/成员比例/结算生成审核打款/导出/凭证复核已接第一版；继续补成员批量运营、更细数据范围 UI、真实打款 provider 和发票。 -2. 继续补 Taro 学生端旧体验：地区选择、刷题答题卡、后端权威断点续练、本地进度恢复、模拟倒计时、主观题后端自评、阅读理解/案例分析多小题、视频播放、反馈、模考报告、逐题复盘、错题/收藏专题、个人中心学习报告、收银台、订单详情、售后入口、题干/解析/知识手册 RichContent 安全渲染、H5 KaTeX 公式渲染、私有资源 ID 题图短签名、背单词卡片学习/发音/收藏练习、资料短签名水印预览/下载确认已接第一版；继续补小程序公式真机验收、题图资源字段化、个人中心任务系统、背单词更细统计、小程序支付容器、分享场景和状态管理。 +2. 继续补 Taro 学生端旧体验：地区选择、刷题答题卡、后端权威断点续练、本地进度恢复、模拟倒计时、主观题后端自评、阅读理解/案例分析多小题、视频播放、反馈、模考报告、逐题复盘、错题/收藏专题、个人中心学习报告、收银台、订单详情、售后入口、题干/解析/知识手册 RichContent 安全渲染、H5 KaTeX 公式渲染、私有资源 ID 题图短签名、背单词卡片学习/发音/收藏练习、资料短签名水印预览/下载确认已接第一版，积分任务/兑换 service 已补；继续补小程序公式真机验收、题图资源字段化、个人中心积分任务/兑换 UI、背单词更细统计、小程序支付容器、分享场景和状态管理。 3. 补平台后台增强：租户详情/编辑、平台审计报表、自动计费、账单批量操作和更细平台权限点。 4. 云服务器部署 Supabase/PostgreSQL 和 API，配置对象存储生产环境变量，跑 `check:refactor` 的远程等价测试。 5. 导出现有 PocketBase 数据，按 `docs/refactor/pocketbase-real-data-migration-runbook.md` 做 production dry-run、导入演练、校验和抽样验收。 diff --git a/docs/refactor/taro-frontend-integration.md b/docs/refactor/taro-frontend-integration.md index 975f7f6b..3db92fc4 100644 --- a/docs/refactor/taro-frontend-integration.md +++ b/docs/refactor/taro-frontend-integration.md @@ -266,7 +266,7 @@ tenant::theme | 商城/收银台 | `/api/catalog/svip-plans`、`POST /api/commerce/coupons/claim`、`POST /api/commerce/orders`、`POST /api/commerce/payments/create` | | 订单/权益 | `/api/commerce/orders`、`/api/commerce/orders/detail`、`/api/commerce/orders/status`、`/api/commerce/entitlements` | | 激活码 | `POST /api/commerce/activation-codes/check`、`POST /api/commerce/activation-codes/redeem` | -| 个人中心 | `GET/PATCH /api/profile/me`、`POST /api/profile/check-in`、`GET /api/profile/score-events`、`GET /api/profile/exam-countdowns`、`GET /api/profile/badges` | +| 个人中心 | `GET/PATCH /api/profile/me`、`POST /api/profile/check-in`、`GET /api/profile/score-events`、`GET /api/profile/exam-countdowns`、`GET /api/profile/badges`、`GET /api/profile/activity-tasks`、`POST /api/profile/activity-tasks/claim`、`GET /api/profile/exchange-items`、`POST /api/profile/exchange-items/redeem` | | 销售分享 | `/api/referral/resolve`、`track-event`、`bind` | | 租户数据看板 | `GET /api/tenant-admin/dashboard?timeRange=30d®ionId=...` | | 租户主题模板 | `GET /api/tenant-admin/theme-templates`、`GET /api/tenant-admin/theme`、`POST /api/tenant-admin/theme/preview`、`POST /api/tenant-admin/theme/publish` | @@ -279,6 +279,7 @@ tenant::theme | 租户考试日期 | `GET/PUT /api/tenant-admin/exam-dates` | | 租户反馈处理 | `GET /api/tenant-admin/feedbacks`、`POST /api/tenant-admin/feedbacks/status`、`GET /api/tenant-admin/feedbacks/events` | | 租户勋章 | `GET/PUT /api/tenant-admin/badges`、`GET/POST /api/tenant-admin/badge-grants` | +| 租户积分任务/兑换 | `GET/PUT /api/tenant-admin/point-activity-tasks`、`GET /api/tenant-admin/point-activity-claims`、`GET/PUT /api/tenant-admin/point-exchange-items`、`GET /api/tenant-admin/point-exchange-orders` | | 公共题库采纳/同步 | `GET /api/tenant-content/public-question-banks`、`POST /api/tenant-content/public-question-banks/adopt`、`POST /api/tenant-content/public-question-banks/sync`、`GET /api/tenant-content/public-question-banks/conflicts?adoptionId=...`、`POST /api/tenant-content/public-question-banks/conflicts/resolve`、`POST /api/tenant-content/public-question-banks/conflicts/resolve-batch` | | 题库导出 | `POST /api/tenant-content/exports/questions`、`GET /api/tenant-content/exports/jobs` | | 资料/视频运营审计 | `GET /api/tenant-content/media-analytics/summary`、`asset-events`、`video-events` | @@ -654,8 +655,9 @@ POST /api/tenant-admin/badge-grants | unlockType | 推荐 conditionField | 触发时机 | | --- | --- | --- | | `check_in` | `checkInStreak` | `POST /api/profile/check-in` 真实签到成功后 | -| `score` | `score` | 签到加分或反馈奖励积分成功后 | +| `score` | `score` | 签到加分、反馈奖励或积分活动奖励成功后 | | `feedback_resolved` | `feedbackResolvedCount` | 租户后台把反馈处理为 `resolved` 后 | +| `activity_reward` | `activityRewardCount` 或 `score` | 学生领取积分活动任务且后端证据校验通过后 | 规则使用 `conditionOperator` 的合法值 `gte`、`gt`、`lte`、`lt`、`eq`；`conditionValue` 为数字。触发成功的接口会返回 `autoBadges`，前端可据此弹出“获得勋章”提示；如果是重复签到、重复处理反馈或已获得过同一勋章，后端不会重复返回同一发放记录。 @@ -1149,6 +1151,43 @@ POST /api/profile/check-in - 积分最终余额以后端 `score` 和流水为准，前端只做展示。 - 如响应包含 `autoBadges`，可展示获得勋章弹层；不要在前端根据连续天数或积分自行判断勋章是否解锁。 +积分活动任务和积分兑换入口： + +```http +GET /api/profile/activity-tasks +POST /api/profile/activity-tasks/claim +GET /api/profile/exchange-items +POST /api/profile/exchange-items/redeem +``` + +`POST /api/profile/activity-tasks/claim` 示例： + +```json +{ + "taskId": "", + "sourceId": "", + "idempotencyKey": "activity-claim-20260629-001" +} +``` + +`POST /api/profile/exchange-items/redeem` 示例： + +```json +{ + "itemId": "", + "quantity": 1, + "idempotencyKey": "exchange-20260629-001" +} +``` + +前端处理规则： + +- 积分任务领取、积分扣减、库存扣减、个人限购、优惠券兑换履约都由后端事务处理。 +- `practice_complete`、`mock_exam_submit`、`vocabulary_review` 等任务需要传 `sourceId`，后端会校验证据属于当前学生当前租户。 +- `feedback_resolved` 等系统流程任务禁止学生自领，前端应展示为“系统发放”或不展示领取按钮。 +- 兑换返回 `order` 和最新积分余额后，再刷新 `profile/me`、`score-events` 和兑换列表；不要在本地先扣积分。 +- 如果响应包含 `autoBadges`，按获得勋章提示处理；重复领取、库存不足、积分不足、限购等错误按后端 `code` 展示业务提示。 + 题目页、资料页或视频页可提交反馈： ```json @@ -2393,11 +2432,11 @@ src/components/RichContent.tsx 安全富文本渲染：题干、选项、解析 src/services/catalog.ts 目录、题库、单词、手册、分数线、资料 src/services/learning.ts 练习 session、答题、收藏、错题/收藏复习、交卷报告、单词复习和单词收藏列表 src/services/commerce.ts 套餐、优惠券、下单、支付参数、订单详情、权益、激活码 -src/services/profile.ts 个人中心、地区目标、签到、反馈、勋章、倒计时 +src/services/profile.ts 个人中心、地区目标、签到、反馈、勋章、倒计时、积分活动任务、积分兑换 src/services/video.ts 题目视频列表、播放签名 src/services/ai.ts AI 择校推荐生成、报告列表、报告详情 src/services/pronunciation.ts H5/小程序单词发音适配 -src/services/tenantAdmin.ts 租户后台看板、权限矩阵、成员、学生创建/批量导入/分班/备注/跟进、内容、营销、设置、角色模板写操作、公共题库采纳/同步/单条和批量冲突处理、导入详情/复检、CRM 配置/队列、分佣规则/成员比例/订单/结算、优惠券规则/核销报表 +src/services/tenantAdmin.ts 租户后台看板、权限矩阵、成员、学生创建/批量导入/分班/备注/跟进、内容、营销、设置、角色模板写操作、公共题库采纳/同步/单条和批量冲突处理、导入详情/复检、CRM 配置/队列、分佣规则/成员比例/订单/结算、优惠券规则/核销报表、积分任务/兑换配置和记录 src/services/tenantFinance.ts 租户财务运营：退款状态机、官方账单任务、对账批次/明细、差错工单、异常订单和人工调整凭证 src/services/platformAdmin.ts 平台后台租户、套餐账单、用量、公共题库授权 ``` @@ -2415,8 +2454,8 @@ npm run build:taro:h5:platform 下一批前端开发重点： -- 学生端：地区选择、题目视频播放、题目反馈、错题/收藏专题页、模考交卷报告、收银台、订单详情、售后入口、题干/解析/知识手册 RichContent 安全渲染、逐题复盘、背单词卡片学习/发音/收藏练习、资料短签名水印预览/下载确认已接第一版；下一批继续补真正 KaTeX/小程序公式方案、私有题图签名资源映射、背单词更细统计、小程序支付容器和分享场景。 -- 租户后台：工作台已接权限驱动模块入口；学生运营页已接学生创建/更新、禁用/恢复、批量导入、批量分班、学生备注、跟进任务和完成跟进第一版；题库内容页已接公共题库采纳/同步、冲突查看、单条/批量采纳平台或保留本地、导入问题、模板预览/下载、异步任务轮询和导入后复检第一版；营销中心已接 CRM 配置保存、CRM 队列按状态查看、分佣默认规则、成员分佣比例、分佣订单明细、结算单生成、审核通过/驳回、标记线下打款、优惠券规则表单、筛选、核销明细和核销报表第一版；财务运营页已接退款申请/审核/供应商提交与查询、官方账单任务、对账批次/异常明细、差错工单处理、人工调整凭证提交/复核和异常订单运营台第一版；租户设置页已接主题模板、草稿预览、发布、角色模板创建、编辑、停用、权限点、菜单、模块、字段、基础数据范围、成员搜索/新建、成员绑定模板、成员状态和额外权限覆盖第一版；下一批继续补更精细的学生导入模板体验、真实生产账单抽样验收、真实打款 provider、发票、更细数据范围 UI 和主题素材库。 +- 学生端：地区选择、题目视频播放、题目反馈、错题/收藏专题页、模考交卷报告、收银台、订单详情、售后入口、题干/解析/知识手册 RichContent 安全渲染、逐题复盘、背单词卡片学习/发音/收藏练习、资料短签名水印预览/下载确认和积分任务/兑换 service 已接第一版；下一批继续补积分任务/兑换页面 UI、真正 KaTeX/小程序公式方案、私有题图签名资源映射、背单词更细统计、小程序支付容器和分享场景。 +- 租户后台：工作台已接权限驱动模块入口；学生运营页已接学生创建/更新、禁用/恢复、批量导入、批量分班、学生备注、跟进任务和完成跟进第一版；题库内容页已接公共题库采纳/同步、冲突查看、单条/批量采纳平台或保留本地、导入问题、模板预览/下载、异步任务轮询和导入后复检第一版；营销中心已接 CRM 配置保存、CRM 队列按状态查看、分佣默认规则、成员分佣比例、分佣订单明细、结算单生成、审核通过/驳回、标记线下打款、优惠券规则表单、筛选、核销明细、核销报表、积分任务和积分兑换 service 第一版；财务运营页已接退款申请/审核/供应商提交与查询、官方账单任务、对账批次/异常明细、差错工单处理、人工调整凭证提交/复核和异常订单运营台第一版；租户设置页已接主题模板、草稿预览、发布、角色模板创建、编辑、停用、权限点、菜单、模块、字段、基础数据范围、成员搜索/新建、成员绑定模板、成员状态和额外权限覆盖第一版；下一批继续补积分任务/兑换操作台页面、更精细的学生导入模板体验、真实生产账单抽样验收、真实打款 provider、发票、更细数据范围 UI 和主题素材库。 - 平台后台：租户创建、状态变更、订阅开通、账单生成、人工收款确认、用量录入、公共题库授权编辑已接第一版；继续补租户详情/编辑、平台审计、自动计费和批量账单操作。 - 小程序：验证 `Taro.login`、微信支付、分享 scene/referral、Supabase client 兼容性；如不稳定，保留 `apps/api/auth/*` 作为小程序登录适配层。 @@ -2516,7 +2555,7 @@ GET /api/ai/school-recommendations/detail?reportId= - 内容入口/分类树/题目集合/练习蓝图 - 题目/单词/知识手册/分数线/视频维护 - 题目/单词/知识手册/分数线/视频 JSON/CSV/Excel 导入 preview/import/issues、字段映射、模板下载和导入后复检 -- Banner/FAQ/公告/激活码/优惠券，当前 Taro 租户营销中心已接 `GET/PUT /api/tenant-admin/coupons`、`GET /api/tenant-admin/coupons/redemptions`、`GET /api/tenant-admin/coupons/report`，用于配置复杂规则、查看核销明细和活动效果。 +- Banner/FAQ/公告/激活码/优惠券/积分任务/积分兑换，当前 Taro 租户营销中心已接 `GET/PUT /api/tenant-admin/coupons`、`GET /api/tenant-admin/coupons/redemptions`、`GET /api/tenant-admin/coupons/report` 以及积分任务/兑换 service 方法，用于配置复杂规则、查看核销明细、活动效果、任务领取和兑换记录。 - 勋章：`GET/PUT /api/tenant-admin/badges`、`GET/POST /api/tenant-admin/badge-grants` - 考试日期：`GET/PUT /api/tenant-admin/exam-dates` - 题目反馈：`GET /api/tenant-admin/feedbacks`、`POST /api/tenant-admin/feedbacks/status`、`GET /api/tenant-admin/feedbacks/events` diff --git a/scripts/api-integration-test.js b/scripts/api-integration-test.js index 4ef80679..1e396add 100644 --- a/scripts/api-integration-test.js +++ b/scripts/api-integration-test.js @@ -55,6 +55,11 @@ const ids = { tenantCheckInBadge: '00000000-0000-0000-0000-000000000873', tenantScoreBadge: '00000000-0000-0000-0000-000000000874', tenantFeedbackBadge: '00000000-0000-0000-0000-000000000875', + tenantActivityBadge: '00000000-0000-0000-0000-000000000876', + pointActivityTask: '00000000-0000-0000-0000-000000000877', + pointSystemTask: '00000000-0000-0000-0000-000000000878', + pointExchangeItem: '00000000-0000-0000-0000-000000000879', + pointExpensiveExchangeItem: '00000000-0000-0000-0000-000000000880', questionBank: '00000000-0000-0000-0000-000000000400', publicQuestionBankGrant: '00000000-0000-0000-0000-000000000906', }; @@ -6811,11 +6816,245 @@ async function testTenantAdminOps() { assert.equal(partnerDenied.code, 'TENANT_ADMIN_REQUIRED', 'tenant admin must not administer another tenant without membership'); } +async function testPointActivitiesAndExchange() { + const activityBadge = await request('/api/tenant-admin/badges', { + userId: TENANT_ADMIN_USER_ID, + method: 'PUT', + body: { + id: ids.tenantActivityBadge, + legacyId: 'integration-badge-activity-auto', + name: '集成测试活动任务勋章', + description: '完成积分活动任务后自动发放', + category: 'activity', + iconUrl: 'https://example.test/badges/activity-auto.png', + level: 1, + unlockType: 'activity_reward', + conditionField: 'activityRewardCount', + conditionOperator: 'gte', + conditionValue: 1, + metadata: { source: 'integration-test', trigger: 'activity_reward' }, + order: 4, + isActive: true, + }, + }); + assert.equal(activityBadge.item?.id, ids.tenantActivityBadge, 'tenant admin should create activity reward badge'); + + const manualTask = await request('/api/tenant-admin/point-activity-tasks', { + userId: TENANT_ADMIN_USER_ID, + method: 'PUT', + body: { + id: ids.pointActivityTask, + legacyId: 'integration-point-task-manual', + code: 'integration-manual-task', + title: '集成测试积分任务', + description: '用于验证学生端领取积分任务', + taskType: 'manual', + rewardPoints: 18, + claimLimitPerUser: 1, + periodType: 'once', + metadata: { source: 'integration-test' }, + order: 1, + status: 'active', + }, + }); + assert.equal(manualTask.item?.id, ids.pointActivityTask, 'tenant admin should upsert point activity task'); + + const systemTask = await request('/api/tenant-admin/point-activity-tasks', { + userId: TENANT_ADMIN_USER_ID, + method: 'PUT', + body: { + id: ids.pointSystemTask, + legacyId: 'integration-point-task-feedback-resolved', + code: 'integration-system-feedback-task', + title: '集成测试系统发放任务', + taskType: 'feedback_resolved', + rewardPoints: 6, + periodType: 'once', + status: 'active', + }, + }); + assert.equal(systemTask.item?.taskType, 'feedback_resolved', 'tenant admin should allow system-granted task config'); + + const tasks = await request('/api/profile/activity-tasks', { query: { limit: 20 } }); + assert.ok(tasks.items?.some(item => item.id === ids.pointActivityTask), 'student should list active point activity task'); + + const systemClaimDenied = await request('/api/profile/activity-tasks/claim', { + method: 'POST', + body: { taskId: ids.pointSystemTask }, + expectStatus: 403, + }); + assert.equal(systemClaimDenied.code, 'POINT_TASK_SYSTEM_GRANTED_ONLY', 'student must not self-claim system workflow tasks'); + + const claimed = await request('/api/profile/activity-tasks/claim', { + method: 'POST', + body: { + taskId: ids.pointActivityTask, + idempotencyKey: 'integration-manual-claim', + metadata: { source: 'integration-test' }, + }, + }); + assert.equal(claimed.item?.pointsAdded, 18, 'claiming activity task should add configured points'); + assert.equal(claimed.item?.ledger?.eventType, 'activity_reward', 'activity task claim should write activity_reward ledger'); + assert.equal(claimed.item?.claim?.taskId, ids.pointActivityTask, 'activity claim should bind task id'); + assert.ok( + claimed.item?.autoBadges?.some(item => item.badgeId === ids.tenantActivityBadge), + 'activity claim should auto grant activity badge', + ); + + const duplicateClaim = await request('/api/profile/activity-tasks/claim', { + method: 'POST', + body: { + taskId: ids.pointActivityTask, + idempotencyKey: 'integration-manual-claim', + }, + expectStatus: 409, + }); + assert.equal(duplicateClaim.code, 'POINT_TASK_CLAIM_LIMIT_REACHED', 'activity task should enforce claim limit'); + + const scoreEventsAfterClaim = await request('/api/profile/score-events', { query: { limit: 80 } }); + assert.ok( + scoreEventsAfterClaim.items?.some(item => item.eventType === 'activity_reward' && item.sourceId === ids.pointActivityTask), + 'score ledger should include activity reward source', + ); + + const activityClaims = await request('/api/tenant-admin/point-activity-claims', { + userId: TENANT_ADMIN_USER_ID, + query: { taskId: ids.pointActivityTask, limit: 20 }, + }); + assert.ok(activityClaims.items?.some(item => item.userId === USER_ID), 'tenant admin should list activity claims'); + + const exchangeCoupon = await request('/api/tenant-admin/coupons', { + userId: TENANT_ADMIN_USER_ID, + method: 'PUT', + body: { + code: 'IT-POINT-EXCHANGE-COUPON', + planId: ids.couponOnlyPlan, + discountType: 'fixed', + discountValue: 100, + maxUses: 10, + perUserLimit: 10, + campaignName: 'integration-point-exchange', + metadata: { source: 'integration-test' }, + source: 'points-exchange', + }, + }); + assert.equal(exchangeCoupon.item?.code, 'IT-POINT-EXCHANGE-COUPON', 'tenant admin should create coupon for point exchange'); + + const exchangeItem = await request('/api/tenant-admin/point-exchange-items', { + userId: TENANT_ADMIN_USER_ID, + method: 'PUT', + body: { + id: ids.pointExchangeItem, + legacyId: 'integration-point-exchange-item', + code: 'integration-coupon-exchange', + title: '集成测试积分兑换券', + description: '用积分兑换优惠券', + costPoints: 12, + itemType: 'coupon', + couponId: exchangeCoupon.item.id, + stockTotal: 1, + perUserLimit: 1, + metadata: { source: 'integration-test' }, + status: 'active', + }, + }); + assert.equal(exchangeItem.item?.id, ids.pointExchangeItem, 'tenant admin should upsert point exchange item'); + + const exchangeList = await request('/api/profile/exchange-items', { query: { limit: 20 } }); + assert.ok(exchangeList.items?.some(item => item.id === ids.pointExchangeItem), 'student should list active exchange item'); + + const redeemed = await request('/api/profile/exchange-items/redeem', { + method: 'POST', + body: { + itemId: ids.pointExchangeItem, + idempotencyKey: 'integration-exchange-redeem', + metadata: { source: 'integration-test' }, + }, + }); + assert.equal(redeemed.item?.pointsSpent, 12, 'exchange should spend configured points'); + assert.equal(redeemed.item?.ledger?.eventType, 'redeem_cost', 'exchange should write redeem_cost ledger'); + assert.equal(redeemed.item?.order?.itemId, ids.pointExchangeItem, 'exchange order should bind item'); + assert.ok(redeemed.item?.couponRedemption?.id, 'coupon exchange should create coupon redemption'); + + const repeatedRedeem = await request('/api/profile/exchange-items/redeem', { + method: 'POST', + body: { + itemId: ids.pointExchangeItem, + idempotencyKey: 'integration-exchange-redeem', + }, + }); + assert.equal(repeatedRedeem.item?.idempotent, true, 'same exchange idempotency key should return existing order'); + + const redeemLimitDenied = await request('/api/profile/exchange-items/redeem', { + method: 'POST', + body: { + itemId: ids.pointExchangeItem, + idempotencyKey: 'integration-exchange-redeem-2', + }, + expectStatus: 409, + }); + assert.equal(redeemLimitDenied.code, 'POINT_EXCHANGE_USER_LIMIT_REACHED', 'exchange should enforce per-user limit'); + + const stockDenied = await request('/api/profile/exchange-items/redeem', { + userId: SECOND_STUDENT_USER_ID, + method: 'POST', + body: { + itemId: ids.pointExchangeItem, + idempotencyKey: 'integration-exchange-second-student', + }, + expectStatus: 409, + }); + assert.equal(stockDenied.code, 'POINT_EXCHANGE_OUT_OF_STOCK', 'exchange should enforce stock before charging another user'); + + const expensiveItem = await request('/api/tenant-admin/point-exchange-items', { + userId: TENANT_ADMIN_USER_ID, + method: 'PUT', + body: { + id: ids.pointExpensiveExchangeItem, + legacyId: 'integration-point-exchange-expensive', + code: 'integration-expensive-exchange', + title: '集成测试高积分兑换', + costPoints: 9999, + itemType: 'manual', + stockTotal: 20, + perUserLimit: 1, + status: 'active', + }, + }); + assert.equal(expensiveItem.item?.id, ids.pointExpensiveExchangeItem, 'tenant admin should create high-cost exchange item'); + + const insufficientScoreDenied = await request('/api/profile/exchange-items/redeem', { + userId: SECOND_STUDENT_USER_ID, + method: 'POST', + body: { + itemId: ids.pointExpensiveExchangeItem, + idempotencyKey: 'integration-expensive-second-student', + }, + expectStatus: 409, + }); + assert.equal(insufficientScoreDenied.code, 'POINT_EXCHANGE_INSUFFICIENT_SCORE', 'exchange should reject insufficient score balance'); + + const exchangeOrders = await request('/api/tenant-admin/point-exchange-orders', { + userId: TENANT_ADMIN_USER_ID, + query: { itemId: ids.pointExchangeItem, limit: 20 }, + }); + assert.ok(exchangeOrders.items?.some(item => item.userId === USER_ID), 'tenant admin should list exchange orders'); + + const partnerExchangeDenied = await request('/api/tenant-admin/point-exchange-items', { + tenantId: PARTNER_TENANT_ID, + userId: TENANT_ADMIN_USER_ID, + expectStatus: 403, + }); + assert.equal(partnerExchangeDenied.code, 'TENANT_ADMIN_REQUIRED', 'point exchange admin must be tenant isolated'); +} + async function testTenantMemberPermissionsAndAudit() { const permissionMatrix = await request('/api/tenant-admin/permissions', { userId: TENANT_ADMIN_USER_ID, }); assert.ok(permissionMatrix.permissions?.some(item => item.key === 'marketing:write'), 'permission matrix should expose marketing permission'); + assert.ok(permissionMatrix.permissions?.some(item => item.key === 'marketing:points:read'), 'permission matrix should expose point marketing read permission'); + assert.ok(permissionMatrix.permissions?.some(item => item.key === 'marketing:points:write'), 'permission matrix should expose point marketing write permission'); assert.ok(permissionMatrix.permissions?.some(item => item.key === 'dashboard:read'), 'permission matrix should expose dashboard read permission'); assert.ok(permissionMatrix.permissions?.some(item => item.key === 'roles:write'), 'permission matrix should expose role template permission'); assert.ok(permissionMatrix.permissions?.some(item => item.key === 'badges:grant'), 'permission matrix should expose badge grant permission'); @@ -7927,6 +8166,7 @@ async function main() { await check('tenant content assets and imports', testTenantContentAssetsAndImports); await check('public question bank adoption', testPublicQuestionBankAdoption); await check('tenant admin operations', testTenantAdminOps); + await check('point activities and exchange', testPointActivitiesAndExchange); await check('tenant member permissions and audit', testTenantMemberPermissionsAndAudit); await check('tenant class and student scopes', testTenantClassStudentScopes); await check('tenant student operations', testTenantStudentOperations); diff --git a/scripts/smoke-seed.js b/scripts/smoke-seed.js index c43ebf1a..3a516aeb 100644 --- a/scripts/smoke-seed.js +++ b/scripts/smoke-seed.js @@ -74,6 +74,11 @@ const ids = { tenantCheckInBadge: '00000000-0000-0000-0000-000000000873', tenantScoreBadge: '00000000-0000-0000-0000-000000000874', tenantFeedbackBadge: '00000000-0000-0000-0000-000000000875', + tenantActivityBadge: '00000000-0000-0000-0000-000000000876', + pointActivityTask: '00000000-0000-0000-0000-000000000877', + pointSystemTask: '00000000-0000-0000-0000-000000000878', + pointExchangeItem: '00000000-0000-0000-0000-000000000879', + pointExpensiveExchangeItem: '00000000-0000-0000-0000-000000000880', partnerTenant: '00000000-0000-0000-0000-000000000901', partnerSubscription: '00000000-0000-0000-0000-000000000902', partnerInvoice: '00000000-0000-0000-0000-000000000903', @@ -222,6 +227,42 @@ async function main() { [tenantId, ids.user, ids.tenantAdminUser, ids.question, ids.questionTwo], ); + await client.query( + ` + delete from public.user_point_exchange_orders + where tenant_id = $1 + and ( + user_id in ($2::uuid, $3::uuid) + or item_id = any($4::uuid[]) + or idempotency_key like 'integration-%' + ) + `, + [ + tenantId, + ids.user, + ids.secondStudentUser, + [ids.pointExchangeItem, ids.pointExpensiveExchangeItem], + ], + ); + + await client.query( + ` + delete from public.user_point_activity_claims + where tenant_id = $1 + and ( + user_id in ($2::uuid, $3::uuid) + or task_id = any($4::uuid[]) + or coalesce(metadata->>'source', '') = 'integration-test' + ) + `, + [ + tenantId, + ids.user, + ids.secondStudentUser, + [ids.pointActivityTask, ids.pointSystemTask], + ], + ); + await client.query( ` delete from public.user_score_events @@ -234,6 +275,32 @@ async function main() { [tenantId, ids.user, ids.tenantAdminUser, ids.secondStudentUser, ids.leaderboardScoreEventSecond], ); + await client.query( + ` + delete from public.point_exchange_items + where tenant_id = $1 + and ( + id = any($2::uuid[]) + or coalesce(legacy_id, '') like 'integration-point-exchange-%' + or code::text like 'integration-%' + ) + `, + [tenantId, [ids.pointExchangeItem, ids.pointExpensiveExchangeItem]], + ); + + await client.query( + ` + delete from public.point_activity_tasks + where tenant_id = $1 + and ( + id = any($2::uuid[]) + or coalesce(legacy_id, '') like 'integration-point-task-%' + or code::text like 'integration-%' + ) + `, + [tenantId, [ids.pointActivityTask, ids.pointSystemTask]], + ); + await client.query( ` delete from public.audit_logs @@ -336,7 +403,12 @@ async function main() { [tenantId, ids.leaderboardSessionUser, ids.leaderboardSessionSecond], ); - const checkoutCouponCodes = ['SMOKE50', 'SMOKEFREE']; + const checkoutCouponCodes = [ + 'SMOKE50', + 'SMOKEFREE', + 'IT-COUPON-001', + 'IT-POINT-EXCHANGE-COUPON', + ]; await client.query( ` @@ -345,14 +417,31 @@ async function main() { and ( coupon_id = any($2::uuid[]) or coupon_code = any($3::text[]) + or coupon_code like any($4::text[]) + or coupon_id in ( + select id from public.coupons + where tenant_id = $1 + and ( + campaign_name in ('integration-coupon-rules', 'integration-point-exchange', 'tenant-admin-coupon-smoke') + or code::text like any($4::text[]) + ) + ) or order_id in ( select id from public.orders where tenant_id = $1 - and (raw_payload->'pricing'->>'couponCode') = any($3::text[]) + and ( + (raw_payload->'pricing'->>'couponCode') = any($3::text[]) + or (raw_payload->'pricing'->>'couponCode') like any($4::text[]) + ) ) ) `, - [tenantId, [ids.checkoutCoupon, ids.freeCheckoutCoupon], checkoutCouponCodes], + [ + tenantId, + [ids.checkoutCoupon, ids.freeCheckoutCoupon], + checkoutCouponCodes, + ['ITMIN%', 'ITDIS%', 'ITREG%', 'ITMULTI%', 'ITFIRST%', 'IT-POINT-%'], + ], ); await client.query( @@ -423,6 +512,25 @@ async function main() { [tenantId, checkoutCouponCodes], ); + await client.query( + ` + delete from public.coupons + where tenant_id = $1 + and ( + id = any($2::uuid[]) + or code::text = any($3::text[]) + or code::text like any($4::text[]) + or campaign_name in ('integration-coupon-rules', 'integration-point-exchange', 'tenant-admin-coupon-smoke') + ) + `, + [ + tenantId, + [ids.checkoutCoupon, ids.freeCheckoutCoupon], + checkoutCouponCodes, + ['ITMIN%', 'ITDIS%', 'ITREG%', 'ITMULTI%', 'ITFIRST%', 'IT-POINT-%'], + ], + ); + await client.query( ` delete from public.commission_settlement_items diff --git a/supabase/migrations/202606290032_points_activities_exchange.sql b/supabase/migrations/202606290032_points_activities_exchange.sql new file mode 100644 index 00000000..3e23b8bf --- /dev/null +++ b/supabase/migrations/202606290032_points_activities_exchange.sql @@ -0,0 +1,178 @@ +create table if not exists public.point_activity_tasks ( + id uuid primary key default gen_random_uuid(), + tenant_id uuid not null references public.tenants(id) on delete cascade, + legacy_id text, + code citext not null, + title text not null, + description text, + task_type text not null default 'manual' + check (task_type in ( + 'daily_check_in', + 'feedback_submit', + 'feedback_resolved', + 'practice_complete', + 'vocabulary_review', + 'mock_exam_submit', + 'manual' + )), + reward_points integer not null default 0 check (reward_points > 0 and reward_points <= 100000), + claim_limit_per_user integer not null default 1 check (claim_limit_per_user > 0 and claim_limit_per_user <= 100000), + period_type text not null default 'once' + check (period_type in ('once', 'daily', 'weekly', 'monthly', 'unlimited')), + valid_from timestamptz, + valid_to timestamptz, + status text not null default 'active' + check (status in ('active', 'disabled', 'archived')), + sort_order integer not null default 0, + metadata jsonb not null default '{}'::jsonb, + created_by uuid references public.platform_users(id) on delete set null, + created_at timestamptz not null default now(), + updated_at timestamptz not null default now(), + unique (tenant_id, code), + unique (tenant_id, legacy_id) +); + +comment on table public.point_activity_tasks is + 'Tenant-scoped score activity tasks configured by marketing/operations teams.'; + +create table if not exists public.user_point_activity_claims ( + id uuid primary key default gen_random_uuid(), + tenant_id uuid not null references public.tenants(id) on delete cascade, + user_id uuid not null references public.platform_users(id) on delete cascade, + task_id uuid not null references public.point_activity_tasks(id) on delete cascade, + period_key text not null, + score_event_id uuid references public.user_score_events(id) on delete set null, + source_type text, + source_id uuid, + status text not null default 'claimed' + check (status in ('claimed', 'cancelled')), + metadata jsonb not null default '{}'::jsonb, + claimed_at timestamptz not null default now(), + created_at timestamptz not null default now(), + updated_at timestamptz not null default now(), + unique (tenant_id, user_id, task_id, period_key) +); + +comment on table public.user_point_activity_claims is + 'Idempotent student claim records for activity rewards.'; + +create table if not exists public.point_exchange_items ( + id uuid primary key default gen_random_uuid(), + tenant_id uuid not null references public.tenants(id) on delete cascade, + legacy_id text, + code citext not null, + title text not null, + description text, + cost_points integer not null check (cost_points > 0 and cost_points <= 10000000), + item_type text not null default 'manual' + check (item_type in ('coupon', 'manual', 'asset', 'custom')), + coupon_id uuid references public.coupons(id) on delete set null, + asset_id uuid references public.content_assets(id) on delete set null, + stock_total integer check (stock_total is null or stock_total >= 0), + stock_used integer not null default 0 check (stock_used >= 0), + per_user_limit integer not null default 1 check (per_user_limit > 0 and per_user_limit <= 100000), + valid_from timestamptz, + valid_to timestamptz, + status text not null default 'active' + check (status in ('active', 'disabled', 'archived')), + sort_order integer not null default 0, + metadata jsonb not null default '{}'::jsonb, + created_by uuid references public.platform_users(id) on delete set null, + created_at timestamptz not null default now(), + updated_at timestamptz not null default now(), + unique (tenant_id, code), + unique (tenant_id, legacy_id), + check (stock_total is null or stock_used <= stock_total) +); + +comment on table public.point_exchange_items is + 'Tenant-scoped score exchange catalog. Coupon fulfillment is supported, activation-code fulfillment is intentionally kept out of the first contract.'; + +create table if not exists public.user_point_exchange_orders ( + id uuid primary key default gen_random_uuid(), + tenant_id uuid not null references public.tenants(id) on delete cascade, + user_id uuid not null references public.platform_users(id) on delete cascade, + item_id uuid not null references public.point_exchange_items(id) on delete restrict, + status text not null default 'completed' + check (status in ('completed', 'pending_fulfillment', 'cancelled')), + cost_points integer not null check (cost_points > 0), + score_event_id uuid references public.user_score_events(id) on delete set null, + coupon_redemption_id uuid references public.coupon_redemptions(id) on delete set null, + asset_id uuid references public.content_assets(id) on delete set null, + idempotency_key text, + metadata jsonb not null default '{}'::jsonb, + exchanged_at timestamptz not null default now(), + created_at timestamptz not null default now(), + updated_at timestamptz not null default now(), + unique (tenant_id, user_id, idempotency_key) +); + +comment on table public.user_point_exchange_orders is + 'Student score exchange orders. Each completed order has a negative redeem_cost ledger event.'; + +create index if not exists idx_point_activity_tasks_tenant_status + on public.point_activity_tasks(tenant_id, status, sort_order, created_at desc); + +create index if not exists idx_point_activity_claims_user + on public.user_point_activity_claims(tenant_id, user_id, claimed_at desc); + +create index if not exists idx_point_activity_claims_task + on public.user_point_activity_claims(tenant_id, task_id, claimed_at desc); + +create index if not exists idx_point_exchange_items_tenant_status + on public.point_exchange_items(tenant_id, status, sort_order, created_at desc); + +create index if not exists idx_point_exchange_orders_user + on public.user_point_exchange_orders(tenant_id, user_id, exchanged_at desc); + +create index if not exists idx_point_exchange_orders_item + on public.user_point_exchange_orders(tenant_id, item_id, exchanged_at desc); + +alter table public.point_activity_tasks enable row level security; +alter table public.user_point_activity_claims enable row level security; +alter table public.point_exchange_items enable row level security; +alter table public.user_point_exchange_orders enable row level security; + +drop policy if exists tenant_isolation on public.point_activity_tasks; +create policy tenant_isolation on public.point_activity_tasks + for all + using (tenant_id = app.current_tenant_id() or app.is_platform_admin()) + with check (tenant_id = app.current_tenant_id() or app.is_platform_admin()); + +drop policy if exists tenant_isolation on public.user_point_activity_claims; +create policy tenant_isolation on public.user_point_activity_claims + for all + using (tenant_id = app.current_tenant_id() or app.is_platform_admin()) + with check (tenant_id = app.current_tenant_id() or app.is_platform_admin()); + +drop policy if exists tenant_isolation on public.point_exchange_items; +create policy tenant_isolation on public.point_exchange_items + for all + using (tenant_id = app.current_tenant_id() or app.is_platform_admin()) + with check (tenant_id = app.current_tenant_id() or app.is_platform_admin()); + +drop policy if exists tenant_isolation on public.user_point_exchange_orders; +create policy tenant_isolation on public.user_point_exchange_orders + for all + using (tenant_id = app.current_tenant_id() or app.is_platform_admin()) + with check (tenant_id = app.current_tenant_id() or app.is_platform_admin()); + +drop trigger if exists set_updated_at on public.point_activity_tasks; +create trigger set_updated_at + before update on public.point_activity_tasks + for each row execute function app.touch_updated_at(); + +drop trigger if exists set_updated_at on public.user_point_activity_claims; +create trigger set_updated_at + before update on public.user_point_activity_claims + for each row execute function app.touch_updated_at(); + +drop trigger if exists set_updated_at on public.point_exchange_items; +create trigger set_updated_at + before update on public.point_exchange_items + for each row execute function app.touch_updated_at(); + +drop trigger if exists set_updated_at on public.user_point_exchange_orders; +create trigger set_updated_at + before update on public.user_point_exchange_orders + for each row execute function app.touch_updated_at(); diff --git a/supabase/migrations/202606290033_badge_activity_reward_unlock.sql b/supabase/migrations/202606290033_badge_activity_reward_unlock.sql new file mode 100644 index 00000000..0f330b55 --- /dev/null +++ b/supabase/migrations/202606290033_badge_activity_reward_unlock.sql @@ -0,0 +1,28 @@ +do $$ +begin + if exists ( + select 1 + from pg_constraint + where conname = 'badges_unlock_type_check' + ) then + alter table public.badges drop constraint badges_unlock_type_check; + end if; + + alter table public.badges + add constraint badges_unlock_type_check + check ( + unlock_type is null + or unlock_type in ( + 'manual', + 'auto', + 'score', + 'check_in', + 'practice_count', + 'vocabulary_mastered', + 'mock_exam_score', + 'feedback_resolved', + 'activity_reward', + 'custom' + ) + ); +end $$;