guke
061f6baaf1
## 背景 / 需求 新增「微信登录」链路:用户用微信授权登录 App。openid 已绑账号即直接登入; 未绑则走「绑手机号」建号,并处理「手机号已被别的账号占用」的冲突(M2), 以及绑微信后展示昵称/头像的替换策略(M3 §10)。 关键取舍:微信登录**不套用**钱包提现里 bind-wechat 的「撞号即 409」逻辑 ——登录场景 openid 命中就应登入,不能因撞号把用户挡在门外。 ## 改动概览:新增 5 个端点(前缀 `/api/v1/auth`) | 方法 | 路径 | 作用 | |---|---|---| | POST | `/wechat-login` | code→openid。命中已绑用户→直接登入;未命中→签发 `bind_ticket`,返回 `need_bind_phone`(**此刻不建号**);未配 APP_ID/SECRET→503 | | POST | `/wechat/bind-phone/sms` | 持 `bind_ticket` + 手机号 + 短信码绑号 | | POST | `/wechat/bind-phone/jverify` | 持 `bind_ticket` + 极光本机号一键取号绑号 | | POST | `/wechat/conflict/continue` | 占用冲突·继续绑定=**登录老账号**(老号没绑微信则把 openid 绑上;已绑别的微信则只登入、丢弃本次 openid) | | POST | `/wechat/conflict/rebind` | 占用冲突·换绑=**单事务**注销老账号 X(腾号)+ 用该号重建新账号 Y + 写换绑台账;受 30 天限制 | 绑号两条取号路径(sms / jverify)尾段共用 `_finish_wechat_bind`: 手机号未注册→建微信账号(channel=wechat,昵称头像取微信)登入; 已被占用→返回 `phone_occupied`(带占用账号昵称/头像/注册时间/`has_wechat`、 `conflict_ticket`、`rebind_available`、`rebind_blocked_days`),交前端冲突页。 冲突页三选一,后端提供 continue / rebind 两个动作(「取消」为前端本地行为)。 ## 关键设计 **两种短时令牌(`core/security.py`,复用 `JWT_SECRET_KEY`,靠 `typ` 区分):** - `bind_ticket`(typ=wechat_bind,sub=openid,附微信昵称/头像,TTL 10min): openid 未命中时下发,覆盖「授权→输手机号→收码→验码」整个绑定流程。 - `conflict_ticket`(typ=wechat_conflict):比 bind_ticket **多编码已验证的手机号**; 换绑 / 继续绑定只认票里的 phone,堵住「拿别人手机号去夺号」的接管漏洞。 **30 天换绑限制:** 新增台账表 `phone_rebind_log`(手机号级、渠道无关), 记录「腾号重建」这一破坏性事件,靠 `rebound_at` 算窗口; 阈值走配置 `PHONE_REBIND_LIMIT_DAYS`。命中限制的换绑请求返回 409。 **M3 §10 昵称/头像替换:** 绑微信默认用微信昵称/头像替换展示, 抽成共享 helper,登录绑号路径与钱包绑微信路径两处共用 (故 `wallet.py`、`tests/test_withdraw.py` 一并有改动)。 --------- Co-authored-by: guke <guke@autohome.com.cn> Reviewed-on: #139
52 lines
2.6 KiB
Python
52 lines
2.6 KiB
Python
"""所有 ORM model 必须在这里 import 一次,Alembic / metadata 才能扫到。"""
|
|
from app.models.ad_ecpm import AdEcpmRecord # noqa: F401
|
|
from app.models.ad_feed_reward import AdFeedRewardRecord # noqa: F401
|
|
from app.models.ad_pangle_revenue import AdPangleDailyRevenue # noqa: F401
|
|
from app.models.ad_reward import AdRewardRecord # noqa: F401
|
|
from app.models.ad_watch_log import AdWatchLog # noqa: F401
|
|
from app.models.admin import AdminAuditLog, AdminUser # noqa: F401
|
|
from app.models.admin_role import AdminRole # noqa: F401
|
|
from app.models.analytics_event import AnalyticsEvent # noqa: F401
|
|
from app.models.analytics_selfstat import ( # noqa: F401
|
|
AnalyticsSelfStat,
|
|
AnalyticsSelfStatEvent,
|
|
)
|
|
from app.models.app_config import AppConfig # noqa: F401
|
|
from app.models.comparison import ComparisonRecord # noqa: F401
|
|
from app.models.cps_activity import CpsActivity # noqa: F401
|
|
from app.models.cps_group import CpsGroup # noqa: F401
|
|
from app.models.cps_link import CpsClick, CpsLink # noqa: F401
|
|
from app.models.cps_order import CpsOrder # noqa: F401
|
|
from app.models.cps_wx_user import CpsWxUser # noqa: F401
|
|
from app.models.comparison_milestone import ComparisonMilestoneClaim # noqa: F401
|
|
from app.models.device import DeviceLiveness # noqa: F401
|
|
from app.models.coupon_state import ( # noqa: F401
|
|
CouponClaimRecord,
|
|
CouponDailyCompletion,
|
|
CouponPromptEngagement,
|
|
CouponSession,
|
|
)
|
|
from app.models.feedback import Feedback # noqa: F401
|
|
from app.models.invite import InviteRelation # noqa: F401
|
|
from app.models.invite_fingerprint import InviteFingerprint # noqa: F401
|
|
from app.models.launch_confirm_sample import LaunchConfirmSample # noqa: F401
|
|
from app.models.meituan_coupon import MeituanCoupon # noqa: F401
|
|
from app.models.onboarding import OnboardingCompletion # noqa: F401
|
|
from app.models.phone_rebind_log import PhoneRebindLog # noqa: F401
|
|
from app.models.ops_marquee_seed import OpsMarqueeSeed # noqa: F401
|
|
from app.models.ops_stat_config import OpsStatConfig # noqa: F401
|
|
from app.models.price_observation import PriceObservation # noqa: F401
|
|
from app.models.price_report import PriceReport # noqa: F401
|
|
from app.models.savings import SavingsRecord # noqa: F401
|
|
from app.models.signin import SigninBoostRecord, SigninRecord # noqa: F401
|
|
from app.models.store_mapping import StoreMapping # noqa: F401
|
|
from app.models.task import UserTask # noqa: F401
|
|
from app.models.user import User # noqa: F401
|
|
from app.models.wallet import ( # noqa: F401
|
|
CashTransaction,
|
|
CoinAccount,
|
|
CoinTransaction,
|
|
InviteCashTransaction,
|
|
WithdrawOrder,
|
|
)
|