fix(pdd-extension): 增强 MMS Cookie 多维嗅探与 PASS_ID 校验，新增插件运行日志与升级 v1.1.0

apps/backend/src/routes/pdd-extension.ts

@@ -97,7 +97,27 @@ router.post('/sync-cookie', async (req, res, next) => {
       })
     }
 
-    // 3. 实测 Cookie 有效性（轻量探测）
+    // 3. 诊断与实测 Cookie 有效性（轻量探测）
+    const cookieKeys = decrypted.cookie
+      .split(';')
+      .map((part) => part.trim().split('=')[0]?.trim())
+      .filter((k): k is string => Boolean(k))
+    const hasPassId = cookieKeys.includes('PASS_ID')
+    const hasRckk = cookieKeys.includes('rckk')
+
+    logInfo(
+      '[pdd-extension]',
+      `插件上报店铺 [${store.shopName}(${store.shopId})] Cookie，开始验证`,
+      {
+        shopId: store.shopId,
+        cookieLen: decrypted.cookie.length,
+        cookieKeyCount: cookieKeys.length,
+        hasPassId,
+        hasRckk,
+        cookieKeys: cookieKeys.slice(0, 15),
+      },
+    )
+
     const testResult = await PddClient.testCookie({
       cookie: decrypted.cookie,
       userAgent: decrypted.userAgent || store.userAgent,
@@ -106,14 +126,31 @@ router.post('/sync-cookie', async (req, res, next) => {
     if (!testResult.valid) {
       logWarn('[pdd-extension]', `插件上报的 Cookie 实测未通过: ${testResult.message}`, {
         shopId: store.shopId,
+        hasPassId,
+        hasRckk,
+        cookieLen: decrypted.cookie.length,
       })
+
+      const isSessionExpired =
+        testResult.message.includes('43001') ||
+        testResult.message.includes('会话已过期') ||
+        !hasPassId
+
+      const userGuidance = !hasPassId
+        ? 'Cookie 中未包含拼多多核心会话标识 (PASS_ID)。请在当前浏览器打开并登录 mms.pinduoduo.com 商家后台，再点击插件上传。'
+        : isSessionExpired
+          ? '拼多多商家会话已过期或失效 (43001)。请在浏览器刷新 mms.pinduoduo.com 页面重新登录，然后点击插件重新同步。'
+          : `Cookie 校验失败: ${testResult.message}`
+
       res.status(400).json({
         code: 400,
-        message: `Cookie 校验失败: ${testResult.message}`,
+        message: userGuidance,
         data: {
           valid: false,
           shopId: store.shopId,
           shopName: store.shopName,
+          hasPassId,
+          detail: testResult.message,
         },
       })
       return

apps/backend/src/services/platforms/pdd/pdd-crypto-service.test.ts

@@ -40,12 +40,12 @@ test('decryptPddExtensionPayload successfully decrypts valid envelope', () => {
   assert.equal(decrypted.nonce, payload.nonce)
 })
 
-test('decryptPddExtensionPayload rejects expired timestamp (> 60s)', () => {
+test('decryptPddExtensionPayload rejects expired timestamp (> 300s)', () => {
   const kp = getOrCreatePddRsaKeyPair()
   const payload = {
     shopId: 'store_test_01',
     cookie: 'PASS_ID=test_pass;',
-    timestamp: Date.now() - 120_000, // 2 minutes ago
+    timestamp: Date.now() - 600_000, // 10 minutes ago (> 300s)
     nonce: 'nonce-expired-' + Math.random().toString(36).slice(2),
   }
 

apps/backend/src/services/platforms/pdd/pdd-crypto-service.ts

@@ -52,10 +52,10 @@ export interface PddDecryptedCookiePayload {
   nonce: string
 }
 
-// In-memory Nonce cache for anti-replay attacks (TTL: 3 minutes)
+// In-memory Nonce cache for anti-replay attacks (TTL: 6 minutes)
 const seenNonces = new Map<string, number>()
-const NONCE_TTL_MS = 180_000
-const MAX_TIMESTAMP_SKEW_MS = 60_000
+const NONCE_TTL_MS = 360_000
+const MAX_TIMESTAMP_SKEW_MS = 300_000
 
 function cleanupExpiredNonces() {
   const now = Date.now()