订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计
- 用户 token 增加版本控制，冻结/改密/退出即时撤销会话
- 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie
- 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属
- 公开商品接口返回最小字段，隐藏号主身份与内部状态
- 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象

frontend/src/features/listings/api/listings.ts

@@ -34,6 +34,32 @@ export interface Listing {
   updated_at: string
 }
 
+// 公开商品卡片的最小字段，对应后端 PublicListingListItemDTO。
+export interface PublicListingItem {
+  id: number
+  listing_no: string
+  title: string
+  game_name: string
+  server_region: string
+  login_platform: string
+  rank_level: string
+  haf_coin_amount: number
+  asset_summary?: Record<string, unknown>
+  screenshot_urls?: string[]
+  cover_url: string
+  price_cent: number
+  deposit_amount_cent: number
+  is_accelerated_sale?: boolean
+  published_at?: string
+  created_at: string
+}
+
+// 公开商品详情，对应后端 PublicListingDetailDTO。
+export interface PublicListingDetail extends PublicListingItem {
+  description: string
+  screenshot_urls: string[]
+}
+
 export interface ListingPayload {
   title: string
   description: string
@@ -85,7 +111,7 @@ export interface PublicListingQuery {
 }
 
 export interface PublicListingPage {
-  items: Listing[]
+  items: PublicListingItem[]
   total: number
   page: number
   page_size: number
@@ -126,7 +152,7 @@ function normalizePublicListingPage(
 }
 
 export async function fetchListing(id: string | number) {
-  const { data } = await apiClient.get<ApiResponse<Listing>>(`/listings/${id}`)
+  const { data } = await apiClient.get<ApiResponse<PublicListingDetail>>(`/listings/${id}`)
   return data.data
 }
 

frontend/src/features/listings/components/ListingCard.vue

@@ -1,7 +1,7 @@
 <script setup lang="ts">
 import { computed } from 'vue'
 import { RouterLink } from 'vue-router'
-import type { Listing } from '@/features/listings'
+import type { PublicListingItem } from '@/features/listings'
 import { formatCent, formatMoney } from '@/shared/utils/money'
 import {
   formatEstimatedRentalDuration,
@@ -22,7 +22,7 @@ import {
 } from '@/shared/utils/listingDisplay'
 
 interface Props {
-  listing: Listing
+  listing: PublicListingItem
 }
 
 const props = defineProps<Props>()

frontend/src/features/listings/composables/useHomeFilters.ts

@@ -1,6 +1,6 @@
 import { reactive, ref, computed, type Ref } from 'vue'
 import type { ListingPublishOptions } from '../api/listingOptions'
-import type { Listing } from '../api/listings'
+import type { PublicListingItem } from '../api/listings'
 import { assetRegions } from '@/shared/utils/listingDisplay'
 
 /** PC 默认区优先展示的皮肤组：刀皮 / 红皮 */
@@ -68,7 +68,7 @@ export interface SkinFilterGroup {
 
 export function useHomeFilters(
   publishOptions: Ref<ListingPublishOptions>,
-  listings: Ref<Listing[]>
+  listings: Ref<PublicListingItem[]>
 ) {
   const filters = reactive<HomeFilters>({
     keyword: '',

frontend/src/features/listings/composables/useListingCollections.ts

@@ -1,13 +1,13 @@
 import { computed, ref } from 'vue'
 
-import type { Listing } from '@/features/listings/api/listings'
+import type { PublicListingItem } from '@/features/listings/api/listings'
 
 const historyKey = 'hfb.listing.view.history'
 const favoriteKey = 'hfb.listing.favorites'
 const maxHistoryItems = 80
 
 export interface ListingCollectionItem {
-  listing: Listing
+  listing: PublicListingItem
   viewed_at?: string
   favorited_at?: string
 }
@@ -20,7 +20,7 @@ export function useListingCollections() {
   const favorites = computed(() => favoriteItems.value)
   const favoriteIDs = computed(() => new Set(favoriteItems.value.map(item => item.listing.id)))
 
-  function recordListingView(listing: Listing) {
+  function recordListingView(listing: PublicListingItem) {
     const nextItem: ListingCollectionItem = {
       listing: snapshotListing(listing),
       viewed_at: new Date().toISOString(),
@@ -36,7 +36,7 @@ export function useListingCollections() {
     return favoriteIDs.value.has(listingID)
   }
 
-  function toggleFavorite(listing: Listing) {
+  function toggleFavorite(listing: PublicListingItem) {
     if (isFavorite(listing.id)) {
       favoriteItems.value = favoriteItems.value.filter(item => item.listing.id !== listing.id)
       writeItems(favoriteKey, favoriteItems.value)
@@ -100,7 +100,7 @@ function normalizeItem(value: unknown): ListingCollectionItem | null {
   const id = Number(value.listing.id)
   if (!Number.isFinite(id) || id <= 0) return null
   return {
-    listing: value.listing as unknown as Listing,
+    listing: value.listing as unknown as PublicListingItem,
     viewed_at: typeof value.viewed_at === 'string' ? value.viewed_at : undefined,
     favorited_at: typeof value.favorited_at === 'string' ? value.favorited_at : undefined,
   }
@@ -111,8 +111,8 @@ function writeItems(key: string, items: ListingCollectionItem[]) {
   localStorage.setItem(key, JSON.stringify(items))
 }
 
-function snapshotListing(listing: Listing): Listing {
-  return JSON.parse(JSON.stringify(listing)) as Listing
+function snapshotListing(listing: PublicListingItem): PublicListingItem {
+  return JSON.parse(JSON.stringify(listing)) as PublicListingItem
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {

frontend/src/features/listings/composables/useListingQuery.ts

@@ -1,5 +1,5 @@
 import { ref, onMounted, onBeforeUnmount, watch, type Ref } from 'vue'
-import { fetchListingsPage, type Listing, type PublicListingQuery } from '../api/listings'
+import { fetchListingsPage, type PublicListingItem, type PublicListingQuery } from '../api/listings'
 import type { HomeFilters } from './useHomeFilters'
 
 const homePageSize = 12
@@ -11,7 +11,7 @@ export function useListingQuery(
 ) {
   const loading = ref(false)
   const loadingMore = ref(false)
-  const listings = ref<Listing[]>([])
+  const listings = ref<PublicListingItem[]>([])
   const totalListings = ref(0)
   const zoneCounts = ref<Record<string, number>>({})
   const currentPage = ref(1)

frontend/src/features/listings/views/ListingDetailView.vue

@@ -6,7 +6,7 @@ import { useRoute, useRouter } from 'vue-router'
 import { ShoppingCart, Star, StarFilled, ArrowLeft } from '@element-plus/icons-vue'
 import { goBackOrHome } from '@/shared/utils/routerBack'
 
-import { fetchListing, type Listing } from '@/features/listings/api/listings'
+import { fetchListing, type PublicListingDetail } from '@/features/listings/api/listings'
 import { useListingCollections } from '@/features/listings/composables/useListingCollections'
 import {
   createOrder,
@@ -63,7 +63,7 @@ const canCreateOrderAfterAgreement = computed(
     virtualAgreementChecked.value &&
     renterAgreementChecked.value
 )
-const listing = ref<Listing | null>(null)
+const listing = ref<PublicListingDetail | null>(null)
 
 onMounted(async () => {
   loading.value = true
@@ -135,7 +135,7 @@ const detailScreenshots = computed(() => {
 })
 const detailScreenshotUrls = computed(() => detailScreenshots.value.map(shot => shot.url))
 
-function readGroupedScreenshots(item: Listing) {
+function readGroupedScreenshots(item: PublicListingDetail) {
   const groups = item.asset_summary?.screenshot_groups
   if (typeof groups !== 'object' || groups === null) return []
   const slots = [
@@ -337,7 +337,7 @@ watch(agreementVisible, visible => {
   }
 })
 
-function listingPrice(item: Listing) {
+function listingPrice(item: PublicListingDetail) {
   return formatMoney(getListingDisplayPrice(item))
 }
 
@@ -505,9 +505,7 @@ function goBack() {
             <span class="order-eyebrow">平台担保</span>
             <h2>立即下单</h2>
           </div>
-          <span class="order-state" :class="{ 'is-busy': listing.in_transaction }">
-            {{ listing.in_transaction ? '交易中' : '可租' }}
-          </span>
+          <span class="order-state">可租</span>
         </div>
         <p class="order-safe-text">平台托管订单与押金，按平台交接流程完成账号使用。</p>
 
@@ -553,12 +551,11 @@ function goBack() {
               type="warning"
               size="large"
               :loading="ordering || agreementsLoading"
-              :disabled="listing.in_transaction"
               class="full-control order-primary-btn"
               @click="handleCreateOrder"
             >
               <el-icon><ShoppingCart /></el-icon>
-              {{ listing.in_transaction ? '交易中' : '立即下单' }}
+              立即下单
             </el-button>
             <el-button
               class="full-control favorite-order-btn"

frontend/src/features/listings/views/MobileHomeView.vue

@@ -10,7 +10,7 @@ import {
 } from '@/features/listings/api/listingOptions'
 import {
   fetchListingsPage,
-  type Listing,
+  type PublicListingItem,
   type PublicListingQuery,
 } from '@/features/listings/api/listings'
 import {
@@ -65,7 +65,7 @@ const scrollEl = ref<HTMLElement | null>(null)
 const loading = ref(false)
 const loadingMore = ref(false)
 const loadFailed = ref(false)
-const listings = ref<Listing[]>([])
+const listings = ref<PublicListingItem[]>([])
 const totalListings = ref(0)
 const zoneCounts = ref<Record<string, number>>({})
 const currentPage = ref(1)
@@ -772,7 +772,7 @@ function getAccessBadgeMeta(value: string) {
   return { icon: 'bookmark-o', tone: 'default' }
 }
 
-function getMobileRatioText(item: Listing) {
+function getMobileRatioText(item: PublicListingItem) {
   const ratio = getRatioValue(item)
   if (ratio <= 0) return ''
   const formatted = Number.isInteger(ratio) ? String(ratio) : ratio.toFixed(1)

frontend/src/features/listings/views/MobileListingDetailView.vue

@@ -4,7 +4,7 @@ import { computed, nextTick, onMounted, ref } from 'vue'
 import { useRoute, useRouter } from 'vue-router'
 import { showToast, showDialog } from 'vant'
 
-import { fetchListing, type Listing } from '@/features/listings/api/listings'
+import { fetchListing, type PublicListingDetail } from '@/features/listings/api/listings'
 import { useListingCollections } from '@/features/listings/composables/useListingCollections'
 import {
   createOrder,
@@ -43,7 +43,7 @@ const loading = ref(false)
 const ordering = ref(false)
 const agreementsLoading = ref(false)
 const agreementVisible = ref(false)
-const listing = ref<Listing | null>(null)
+const listing = ref<PublicListingDetail | null>(null)
 const agreements = ref<OrderAgreements | null>(null)
 const virtualAgreementRead = ref(false)
 const renterAgreementRead = ref(false)
@@ -135,7 +135,7 @@ const detailScreenshots = computed(() => {
 })
 const detailScreenshotUrls = computed(() => detailScreenshots.value.map(shot => shot.url))
 
-function readGroupedScreenshots(item: Listing) {
+function readGroupedScreenshots(item: PublicListingDetail) {
   const groups = item.asset_summary?.screenshot_groups
   if (typeof groups !== 'object' || groups === null) return []
   const slots = [
@@ -493,11 +493,10 @@ function handleToggleFavorite() {
           round
           class="order-btn"
           :loading="ordering || agreementsLoading"
-          :disabled="listing.in_transaction"
           loading-text="下单中..."
           @click="handleCreateOrder"
         >
-          {{ listing.in_transaction ? '交易中' : '立即下单' }}
+          立即下单
         </van-button>
       </div>