Merge branch 'dev'

apps/backend/src/routes/admin/worker-platform/config.ts

@@ -13,7 +13,6 @@ import {
   getAdminWorkerPlatformNotificationConfig,
   getAdminWorkerPlatformSummary,
   getAdminWorkerProductMatchConfig,
-  getWorkerMaterialLinkConfig,
   listAdminKuaishouMatchSources,
   listAdminWorkCategories,
   listAdminWorkProductMatchLogs,
@@ -30,7 +29,6 @@ import {
   saveAdminWorkerLevel,
   saveAdminWorkerPlatformNotificationConfig,
   saveAdminWorkerProductMatchConfig,
-  saveWorkerMaterialLinkConfig,
   syncAdminWorkProductRulePrice,
   testAdminKuaishouProductMatch,
   testAdminProductMatchByOrderItem,
@@ -295,32 +293,6 @@ router.post(
   }),
 )
 
-router.get(
-  '/worker-platform/material-link-config',
-  requireAdminRoles(['admin', 'operator']),
-  createJsonHandler(() => getWorkerMaterialLinkConfig(), {
-    successMessage: 'ok',
-    errorMessage: '读取补资料链接配置失败',
-    scope: '[admin/worker-platform/material-link-config]',
-  }),
-)
-
-router.post(
-  '/worker-platform/material-link-config',
-  requireAdminRoles(['admin', 'operator']),
-  createJsonHandler((req) => saveWorkerMaterialLinkConfig(req.body || {}), {
-    successMessage: '补资料链接配置已保存',
-    errorMessage: '保存补资料链接配置失败',
-    scope: '[admin/worker-platform/material-link-config]',
-    audit: (_req, data) => ({
-      action: 'worker_material_link_config_saved',
-      targetType: 'work_order_material_link_config',
-      targetId: 'work_order_material_link',
-      data: data && typeof data === 'object' ? (data as Record<string, unknown>) : {},
-    }),
-  }),
-)
-
 router.post(
   '/worker-platform/announcement',
   requireAdminRoles(['admin']),

apps/backend/src/routes/admin/worker-platform/orders.ts

@@ -9,7 +9,6 @@ import {
   completeAdminWorkOrderGiftCooldown,
   confirmAdminWorkOrderFriendAdded,
   createAdminMockWorkOrder,
-  createAdminWorkOrderMaterialLink,
   deleteAdminMockCustomShop,
   deleteAdminWorkOrder,
   getAdminWorkOrderEvents,
@@ -23,6 +22,7 @@ import {
   reopenAdminCancelledWorkOrder,
   reprocessAdminKuaishouSendCodeWorkOrders,
   resetAdminWorkOrderGiftMaterial,
+  resetAdminWorkOrderMaterialStatus,
   submitAdminWorkOrderMaterial,
   unassignAdminWorkOrder,
   unpublishAdminWorkOrder,
@@ -187,30 +187,23 @@ router.post(
 )
 
 router.post(
-  '/worker-platform/orders/:workOrderId/material-link',
+  '/worker-platform/orders/:workOrderId/reset-material',
   requireAdminPermission('worker_order.update_material'),
   createJsonHandler(
     (req) =>
-      createAdminWorkOrderMaterialLink(
+      resetAdminWorkOrderMaterialStatus(
         String(req.params.workOrderId || ''),
         req.adminSession?.displayName || req.adminSession?.username || '',
       ),
     {
-      successMessage: '补资料链接已生成',
-      errorMessage: '生成补资料链接失败',
-      scope: '[admin/worker-platform/orders/:workOrderId/material-link]',
-      audit: (req, data) => ({
-        action: 'work_order_material_link_created',
+      successMessage: '补资料状态已重置为待完善',
+      errorMessage: '重置补资料状态失败',
+      scope: '[admin/worker-platform/orders/:workOrderId/reset-material]',
+      audit: (req) => ({
+        action: 'work_order_material_reset',
         targetType: 'work_order',
         targetId: String(req.params.workOrderId || ''),
-        // 审计只记录有效期与是否复用，绝不落 token。
-        data:
-          data && typeof data === 'object'
-            ? {
-                expiresAt: (data as Record<string, unknown>).expiresAt,
-                reused: (data as Record<string, unknown>).reused,
-              }
-            : {},
+        data: {},
       }),
     },
   ),

apps/backend/src/routes/collect.ts

@@ -1,6 +1,7 @@
 import { Router } from 'express'
 
 import {
+  createFailureCooldownMiddleware,
   createRateLimitMiddleware,
   getBodyFieldRateLimitKey,
   getParamRateLimitKey,
@@ -29,21 +30,46 @@ const materialLinkReadRateLimit = createRateLimitMiddleware({
   scope: 'collect:link:read',
   windowMs: 60_000,
   max: 120,
-  key: getParamRateLimitKey('token'),
+  key: getParamRateLimitKey('code'),
+})
+
+/** 平台订单号可被枚举，额外加一层只按 IP 的总限流，避免换 code 绕过单链接限流。 */
+const materialLinkReadIpRateLimit = createRateLimitMiddleware({
+  scope: 'collect:link:read:ip',
+  windowMs: 60_000,
+  max: 300,
+})
+
+/** 查询失败（404）后按 IP 冷却 2 秒；正常查询不计数，避免误伤用户。 */
+const materialLinkReadFailureCooldown = createFailureCooldownMiddleware({
+  scope: 'collect:link:read:fail:ip',
+  cooldownMs: 2_000,
 })
 
 const materialLinkWriteRateLimit = createRateLimitMiddleware({
   scope: 'collect:link:write',
   windowMs: 60_000,
   max: 20,
-  key: getParamRateLimitKey('token'),
+  key: getParamRateLimitKey('code'),
+})
+
+const materialLinkWriteIpRateLimit = createRateLimitMiddleware({
+  scope: 'collect:link:write:ip',
+  windowMs: 60_000,
+  max: 40,
 })
 
 const materialLinkUploadRateLimit = createRateLimitMiddleware({
   scope: 'collect:link:upload',
   windowMs: 60_000,
   max: 30,
-  key: getParamRateLimitKey('token'),
+  key: getParamRateLimitKey('code'),
+})
+
+const materialLinkUploadIpRateLimit = createRateLimitMiddleware({
+  scope: 'collect:link:upload:ip',
+  windowMs: 60_000,
+  max: 60,
 })
 
 router.post(
@@ -88,35 +114,40 @@ router.post(
 )
 
 router.get(
-  '/link/:token',
+  '/link/:code',
+  materialLinkReadFailureCooldown,
+  materialLinkReadIpRateLimit,
   materialLinkReadRateLimit,
-  createRouteHandler((req) => getPublicWorkOrderMaterialLink(String(req.params.token || '')), {
+  createRouteHandler((req) => getPublicWorkOrderMaterialLink(String(req.params.code || '')), {
     errorMessage: '读取补资料链接失败',
-    scope: '[collect/link/:token]',
+    scope: '[collect/link/:code]',
   }),
 )
 
 router.post(
-  '/link/:token/submit',
+  '/link/:code/submit',
+  materialLinkWriteIpRateLimit,
   materialLinkWriteRateLimit,
   createRouteHandler(
-    (req) => submitPublicWorkOrderMaterialLink(String(req.params.token || ''), req.body || {}),
+    (req) => submitPublicWorkOrderMaterialLink(String(req.params.code || ''), req.body || {}),
     {
       successMessage: '资料已提交',
       errorMessage: '提交补资料失败',
-      scope: '[collect/link/:token/submit]',
+      scope: '[collect/link/:code/submit]',
     },
   ),
 )
 
 router.post(
-  '/link/:token/upload',
+  '/link/:code/upload',
+  materialLinkUploadIpRateLimit,
   materialLinkUploadRateLimit,
   uploadSingleFile,
   createRouteHandler(
     async (req) => {
       const { order } = await getPublicWorkOrderMaterialLinkUploadContext(
-        String(req.params.token || ''),
+        String(req.params.code || ''),
+        req.query.workOrderId,
       )
       return uploadFileAsset({
         file: req.file,
@@ -128,7 +159,7 @@ router.post(
     {
       successMessage: '文件已上传',
       errorMessage: '文件上传失败',
-      scope: '[collect/link/:token/upload]',
+      scope: '[collect/link/:code/upload]',
     },
   ),
 )