@sfmc-bds/db-server 0.2.0-beta.1 → 0.2.0-beta.11

package/dist/routes/qq-bind.js

@@ -0,0 +1,179 @@
+import { randomInt } from "node:crypto";
+import { SQL } from "sql-template-strings";
+const CODE_TTL_MS = 5 * 60 * 1e3;
+const CODE_LEN = 6;
+function genCode() {
+  let s = "";
+  for (let i = 0; i < CODE_LEN; i++) s += String(randomInt(0, 10));
+  return s;
+}
+function createQqBindRoutes({ query, body, json }) {
+  return async function handle({
+    path,
+    method,
+    params,
+    req,
+    res
+  }) {
+    if (!path.startsWith("/api/sfmc/qq/bind")) return false;
+    if (path === "/api/sfmc/qq/bind/me" && method === "GET") {
+      const openid = String(params.get("openid") ?? "").trim();
+      const xuid = String(params.get("xuid") ?? "").trim();
+      if (!openid && !xuid) {
+        json(res, { success: false, error: "openid_or_xuid_required" }, 400);
+        return true;
+      }
+      const rows = openid ? query(SQL`SELECT * FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid} LIMIT 1`) : query(SQL`SELECT * FROM sfmc_qq_bindings WHERE player_xuid = ${xuid} LIMIT 1`);
+      const row = rows[0] ?? null;
+      json(res, {
+        success: true,
+        bound: !!row,
+        binding: row ? {
+          qq_user_openid: row.qq_user_openid,
+          player_xuid: row.player_xuid,
+          player_name: row.player_name,
+          qq_backend: row.qq_backend,
+          bound_at: row.bound_at
+        } : null
+      });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/bind/request" && method === "POST") {
+      const data = await body(req);
+      const openid = String(data.openid ?? data.qq_user_openid ?? "").trim();
+      const backend = String(data.qq_backend ?? "official").trim() || "official";
+      if (!openid) {
+        json(res, { success: false, error: "openid_required" }, 400);
+        return true;
+      }
+      const existing = query(
+        SQL`SELECT player_name FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid} LIMIT 1`
+      );
+      if (existing[0]) {
+        json(
+          res,
+          {
+            success: false,
+            error: "already_bound",
+            player_name: existing[0].player_name
+          },
+          409
+        );
+        return true;
+      }
+      const now = Date.now();
+      query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE qq_user_openid = ${openid} OR expires_at < ${now}`);
+      let code = "";
+      for (let attempt = 0; attempt < 8; attempt++) {
+        const candidate = genCode();
+        const clash = query(
+          SQL`SELECT 1 AS ok FROM sfmc_qq_bind_pending WHERE code = ${candidate} LIMIT 1`
+        );
+        if (clash.length === 0) {
+          code = candidate;
+          break;
+        }
+      }
+      if (!code) {
+        json(res, { success: false, error: "code_gen_failed" }, 500);
+        return true;
+      }
+      const expiresAt = now + CODE_TTL_MS;
+      query(
+        SQL`INSERT INTO sfmc_qq_bind_pending (code, qq_user_openid, qq_backend, created_at, expires_at)
+            VALUES (${code}, ${openid}, ${backend}, ${now}, ${expiresAt})`
+      );
+      json(res, { success: true, code, expires_at: expiresAt, ttl_ms: CODE_TTL_MS });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/bind/confirm" && method === "POST") {
+      const data = await body(req);
+      const code = String(data.code ?? "").trim();
+      const xuid = String(data.xuid ?? data.player_xuid ?? "").trim();
+      const name = String(data.name ?? data.player_name ?? "").trim();
+      if (!code || !xuid) {
+        json(res, { success: false, error: "code_and_xuid_required" }, 400);
+        return true;
+      }
+      const now = Date.now();
+      const pending = query(
+        SQL`SELECT * FROM sfmc_qq_bind_pending WHERE code = ${code} LIMIT 1`
+      );
+      const row = pending[0];
+      if (!row) {
+        json(res, { success: false, error: "invalid_code" }, 400);
+        return true;
+      }
+      if (Number(row.expires_at) < now) {
+        query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE code = ${code}`);
+        json(res, { success: false, error: "code_expired" }, 400);
+        return true;
+      }
+      const byOpenid = query(
+        SQL`SELECT player_xuid FROM sfmc_qq_bindings WHERE qq_user_openid = ${row.qq_user_openid} LIMIT 1`
+      );
+      if (byOpenid[0] && byOpenid[0].player_xuid !== xuid) {
+        json(res, { success: false, error: "qq_already_bound", hint: "\u8BF7\u5148\u5728 QQ \u4FA7\u89E3\u7ED1" }, 409);
+        return true;
+      }
+      const byXuid = query(
+        SQL`SELECT qq_user_openid FROM sfmc_qq_bindings WHERE player_xuid = ${xuid} LIMIT 1`
+      );
+      if (byXuid[0] && byXuid[0].qq_user_openid !== row.qq_user_openid) {
+        json(res, { success: false, error: "player_already_bound", hint: "\u8BF7\u5148\u89E3\u7ED1\u5F53\u524D QQ" }, 409);
+        return true;
+      }
+      query(SQL`DELETE FROM sfmc_qq_bindings WHERE qq_user_openid = ${row.qq_user_openid} OR player_xuid = ${xuid}`);
+      query(
+        SQL`INSERT INTO sfmc_qq_bindings (qq_user_openid, player_xuid, player_name, qq_backend, bound_at)
+            VALUES (${row.qq_user_openid}, ${xuid}, ${name}, ${row.qq_backend}, ${now})`
+      );
+      query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE code = ${code}`);
+      json(res, {
+        success: true,
+        binding: {
+          qq_user_openid: row.qq_user_openid,
+          player_xuid: xuid,
+          player_name: name,
+          qq_backend: row.qq_backend,
+          bound_at: now
+        }
+      });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/bind/unbind" && method === "POST") {
+      const data = await body(req);
+      const openid = String(data.openid ?? data.qq_user_openid ?? "").trim();
+      const xuid = String(data.xuid ?? data.player_xuid ?? "").trim();
+      if (!openid && !xuid) {
+        json(res, { success: false, error: "openid_or_xuid_required" }, 400);
+        return true;
+      }
+      let removed = 0;
+      if (openid) {
+        const before = query(
+          SQL`SELECT qq_user_openid FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid}`
+        );
+        query(SQL`DELETE FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid}`);
+        query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE qq_user_openid = ${openid}`);
+        removed += before.length;
+      }
+      if (xuid) {
+        const before = query(
+          SQL`SELECT qq_user_openid FROM sfmc_qq_bindings WHERE player_xuid = ${xuid}`
+        );
+        query(SQL`DELETE FROM sfmc_qq_bindings WHERE player_xuid = ${xuid}`);
+        removed += before.length;
+      }
+      json(res, { success: true, unbound: removed > 0, removed });
+      return true;
+    }
+    json(res, { success: false, error: "not_found" }, 404);
+    return true;
+  };
+}
+export {
+  CODE_TTL_MS,
+  createQqBindRoutes
+};
+//# sourceMappingURL=qq-bind.js.map

package/dist/routes/qq-bind.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/routes/qq-bind.ts"],
+  "sourcesContent": ["/**\n * routes/qq-bind.ts \u2014 QQ\u2194MC \u8EAB\u4EFD\u7ED1\u5B9A\uFF08\u5E73\u53F0 HTTP\uFF09\n *\n *   POST /api/sfmc/qq/bind/request  \u2014 QQ \u4FA7\u7533\u8BF7\u77ED\u7801\n *   POST /api/sfmc/qq/bind/confirm  \u2014 \u6E38\u620F\u4FA7\u786E\u8BA4\n *   POST /api/sfmc/qq/bind/unbind   \u2014 \u89E3\u7ED1\n *   GET  /api/sfmc/qq/bind/me       \u2014 \u67E5\u8BE2\n */\n\nimport { randomInt } from \"node:crypto\";\nimport { SQL } from \"sql-template-strings\";\nimport type { QueryFn } from \"../lib/sqlite.js\";\n\nconst CODE_TTL_MS = 5 * 60 * 1000;\nconst CODE_LEN = 6;\n\ninterface Deps {\n  query: QueryFn;\n  body: (req: import(\"http\").IncomingMessage) => Promise<Record<string, unknown>>;\n  json: (res: import(\"http\").ServerResponse, data: Record<string, unknown>, status?: number) => void;\n}\n\nfunction genCode(): string {\n  let s = \"\";\n  for (let i = 0; i < CODE_LEN; i++) s += String(randomInt(0, 10));\n  return s;\n}\n\nfunction createQqBindRoutes({ query, body, json }: Deps) {\n  return async function handle({\n    path,\n    method,\n    params,\n    req,\n    res,\n  }: {\n    path: string;\n    method: string;\n    params: URLSearchParams;\n    req: import(\"http\").IncomingMessage;\n    res: import(\"http\").ServerResponse;\n  }): Promise<boolean> {\n    if (!path.startsWith(\"/api/sfmc/qq/bind\")) return false;\n\n    if (path === \"/api/sfmc/qq/bind/me\" && method === \"GET\") {\n      const openid = String(params.get(\"openid\") ?? \"\").trim();\n      const xuid = String(params.get(\"xuid\") ?? \"\").trim();\n      if (!openid && !xuid) {\n        json(res, { success: false, error: \"openid_or_xuid_required\" }, 400);\n        return true;\n      }\n      const rows = openid\n        ? (query(SQL`SELECT * FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid} LIMIT 1`) as Array<\n            Record<string, unknown>\n          >)\n        : (query(SQL`SELECT * FROM sfmc_qq_bindings WHERE player_xuid = ${xuid} LIMIT 1`) as Array<\n            Record<string, unknown>\n          >);\n      const row = rows[0] ?? null;\n      json(res, {\n        success: true,\n        bound: !!row,\n        binding: row\n          ? {\n              qq_user_openid: row.qq_user_openid,\n              player_xuid: row.player_xuid,\n              player_name: row.player_name,\n              qq_backend: row.qq_backend,\n              bound_at: row.bound_at,\n            }\n          : null,\n      });\n      return true;\n    }\n\n    if (path === \"/api/sfmc/qq/bind/request\" && method === \"POST\") {\n      const data = await body(req);\n      const openid = String(data.openid ?? data.qq_user_openid ?? \"\").trim();\n      const backend = String(data.qq_backend ?? \"official\").trim() || \"official\";\n      if (!openid) {\n        json(res, { success: false, error: \"openid_required\" }, 400);\n        return true;\n      }\n      // \u5DF2\u7ED1\u5B9A\u5219\u62D2\u7EDD\u518D\u7533\u8BF7\uFF08\u987B\u5148\u89E3\u7ED1\uFF09\n      const existing = query(\n        SQL`SELECT player_name FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid} LIMIT 1`\n      ) as Array<{ player_name: string }>;\n      if (existing[0]) {\n        json(\n          res,\n          {\n            success: false,\n            error: \"already_bound\",\n            player_name: existing[0].player_name,\n          },\n          409\n        );\n        return true;\n      }\n\n      const now = Date.now();\n      query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE qq_user_openid = ${openid} OR expires_at < ${now}`);\n\n      let code = \"\";\n      for (let attempt = 0; attempt < 8; attempt++) {\n        const candidate = genCode();\n        const clash = query(\n          SQL`SELECT 1 AS ok FROM sfmc_qq_bind_pending WHERE code = ${candidate} LIMIT 1`\n        ) as unknown[];\n        if (clash.length === 0) {\n          code = candidate;\n          break;\n        }\n      }\n      if (!code) {\n        json(res, { success: false, error: \"code_gen_failed\" }, 500);\n        return true;\n      }\n\n      const expiresAt = now + CODE_TTL_MS;\n      query(\n        SQL`INSERT INTO sfmc_qq_bind_pending (code, qq_user_openid, qq_backend, created_at, expires_at)\n            VALUES (${code}, ${openid}, ${backend}, ${now}, ${expiresAt})`\n      );\n      json(res, { success: true, code, expires_at: expiresAt, ttl_ms: CODE_TTL_MS });\n      return true;\n    }\n\n    if (path === \"/api/sfmc/qq/bind/confirm\" && method === \"POST\") {\n      const data = await body(req);\n      const code = String(data.code ?? \"\").trim();\n      const xuid = String(data.xuid ?? data.player_xuid ?? \"\").trim();\n      const name = String(data.name ?? data.player_name ?? \"\").trim();\n      if (!code || !xuid) {\n        json(res, { success: false, error: \"code_and_xuid_required\" }, 400);\n        return true;\n      }\n\n      const now = Date.now();\n      const pending = query(\n        SQL`SELECT * FROM sfmc_qq_bind_pending WHERE code = ${code} LIMIT 1`\n      ) as Array<{\n        code: string;\n        qq_user_openid: string;\n        qq_backend: string;\n        expires_at: number;\n      }>;\n      const row = pending[0];\n      if (!row) {\n        json(res, { success: false, error: \"invalid_code\" }, 400);\n        return true;\n      }\n      if (Number(row.expires_at) < now) {\n        query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE code = ${code}`);\n        json(res, { success: false, error: \"code_expired\" }, 400);\n        return true;\n      }\n\n      const byOpenid = query(\n        SQL`SELECT player_xuid FROM sfmc_qq_bindings WHERE qq_user_openid = ${row.qq_user_openid} LIMIT 1`\n      ) as Array<{ player_xuid: string }>;\n      if (byOpenid[0] && byOpenid[0].player_xuid !== xuid) {\n        json(res, { success: false, error: \"qq_already_bound\", hint: \"\u8BF7\u5148\u5728 QQ \u4FA7\u89E3\u7ED1\" }, 409);\n        return true;\n      }\n      const byXuid = query(\n        SQL`SELECT qq_user_openid FROM sfmc_qq_bindings WHERE player_xuid = ${xuid} LIMIT 1`\n      ) as Array<{ qq_user_openid: string }>;\n      if (byXuid[0] && byXuid[0].qq_user_openid !== row.qq_user_openid) {\n        json(res, { success: false, error: \"player_already_bound\", hint: \"\u8BF7\u5148\u89E3\u7ED1\u5F53\u524D QQ\" }, 409);\n        return true;\n      }\n\n      query(SQL`DELETE FROM sfmc_qq_bindings WHERE qq_user_openid = ${row.qq_user_openid} OR player_xuid = ${xuid}`);\n      query(\n        SQL`INSERT INTO sfmc_qq_bindings (qq_user_openid, player_xuid, player_name, qq_backend, bound_at)\n            VALUES (${row.qq_user_openid}, ${xuid}, ${name}, ${row.qq_backend}, ${now})`\n      );\n      query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE code = ${code}`);\n      json(res, {\n        success: true,\n        binding: {\n          qq_user_openid: row.qq_user_openid,\n          player_xuid: xuid,\n          player_name: name,\n          qq_backend: row.qq_backend,\n          bound_at: now,\n        },\n      });\n      return true;\n    }\n\n    if (path === \"/api/sfmc/qq/bind/unbind\" && method === \"POST\") {\n      const data = await body(req);\n      const openid = String(data.openid ?? data.qq_user_openid ?? \"\").trim();\n      const xuid = String(data.xuid ?? data.player_xuid ?? \"\").trim();\n      if (!openid && !xuid) {\n        json(res, { success: false, error: \"openid_or_xuid_required\" }, 400);\n        return true;\n      }\n      let removed = 0;\n      if (openid) {\n        const before = query(\n          SQL`SELECT qq_user_openid FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid}`\n        ) as unknown[];\n        query(SQL`DELETE FROM sfmc_qq_bindings WHERE qq_user_openid = ${openid}`);\n        query(SQL`DELETE FROM sfmc_qq_bind_pending WHERE qq_user_openid = ${openid}`);\n        removed += before.length;\n      }\n      if (xuid) {\n        const before = query(\n          SQL`SELECT qq_user_openid FROM sfmc_qq_bindings WHERE player_xuid = ${xuid}`\n        ) as unknown[];\n        query(SQL`DELETE FROM sfmc_qq_bindings WHERE player_xuid = ${xuid}`);\n        removed += before.length;\n      }\n      json(res, { success: true, unbound: removed > 0, removed });\n      return true;\n    }\n\n    json(res, { success: false, error: \"not_found\" }, 404);\n    return true;\n  };\n}\n\nexport { createQqBindRoutes, CODE_TTL_MS };\n"],
+  "mappings": "AASA,SAAS,iBAAiB;AAC1B,SAAS,WAAW;AAGpB,MAAM,cAAc,IAAI,KAAK;AAC7B,MAAM,WAAW;AAQjB,SAAS,UAAkB;AACzB,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,UAAU,IAAK,MAAK,OAAO,UAAU,GAAG,EAAE,CAAC;AAC/D,SAAO;AACT;AAEA,SAAS,mBAAmB,EAAE,OAAO,MAAM,KAAK,GAAS;AACvD,SAAO,eAAe,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAMqB;AACnB,QAAI,CAAC,KAAK,WAAW,mBAAmB,EAAG,QAAO;AAElD,QAAI,SAAS,0BAA0B,WAAW,OAAO;AACvD,YAAM,SAAS,OAAO,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AACvD,YAAM,OAAO,OAAO,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACnD,UAAI,CAAC,UAAU,CAAC,MAAM;AACpB,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,0BAA0B,GAAG,GAAG;AACnE,eAAO;AAAA,MACT;AACA,YAAM,OAAO,SACR,MAAM,4DAA4D,MAAM,UAAU,IAGlF,MAAM,yDAAyD,IAAI,UAAU;AAGlF,YAAM,MAAM,KAAK,CAAC,KAAK;AACvB,WAAK,KAAK;AAAA,QACR,SAAS;AAAA,QACT,OAAO,CAAC,CAAC;AAAA,QACT,SAAS,MACL;AAAA,UACE,gBAAgB,IAAI;AAAA,UACpB,aAAa,IAAI;AAAA,UACjB,aAAa,IAAI;AAAA,UACjB,YAAY,IAAI;AAAA,UAChB,UAAU,IAAI;AAAA,QAChB,IACA;AAAA,MACN,CAAC;AACD,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,+BAA+B,WAAW,QAAQ;AAC7D,YAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,YAAM,SAAS,OAAO,KAAK,UAAU,KAAK,kBAAkB,EAAE,EAAE,KAAK;AACrE,YAAM,UAAU,OAAO,KAAK,cAAc,UAAU,EAAE,KAAK,KAAK;AAChE,UAAI,CAAC,QAAQ;AACX,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,kBAAkB,GAAG,GAAG;AAC3D,eAAO;AAAA,MACT;AAEA,YAAM,WAAW;AAAA,QACf,sEAAsE,MAAM;AAAA,MAC9E;AACA,UAAI,SAAS,CAAC,GAAG;AACf;AAAA,UACE;AAAA,UACA;AAAA,YACE,SAAS;AAAA,YACT,OAAO;AAAA,YACP,aAAa,SAAS,CAAC,EAAE;AAAA,UAC3B;AAAA,UACA;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAEA,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,8DAA8D,MAAM,oBAAoB,GAAG,EAAE;AAEnG,UAAI,OAAO;AACX,eAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,cAAM,YAAY,QAAQ;AAC1B,cAAM,QAAQ;AAAA,UACZ,4DAA4D,SAAS;AAAA,QACvE;AACA,YAAI,MAAM,WAAW,GAAG;AACtB,iBAAO;AACP;AAAA,QACF;AAAA,MACF;AACA,UAAI,CAAC,MAAM;AACT,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,kBAAkB,GAAG,GAAG;AAC3D,eAAO;AAAA,MACT;AAEA,YAAM,YAAY,MAAM;AACxB;AAAA,QACE;AAAA,sBACc,IAAI,KAAK,MAAM,KAAK,OAAO,KAAK,GAAG,KAAK,SAAS;AAAA,MACjE;AACA,WAAK,KAAK,EAAE,SAAS,MAAM,MAAM,YAAY,WAAW,QAAQ,YAAY,CAAC;AAC7E,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,+BAA+B,WAAW,QAAQ;AAC7D,YAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,YAAM,OAAO,OAAO,KAAK,QAAQ,EAAE,EAAE,KAAK;AAC1C,YAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,eAAe,EAAE,EAAE,KAAK;AAC9D,YAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,eAAe,EAAE,EAAE,KAAK;AAC9D,UAAI,CAAC,QAAQ,CAAC,MAAM;AAClB,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,yBAAyB,GAAG,GAAG;AAClE,eAAO;AAAA,MACT;AAEA,YAAM,MAAM,KAAK,IAAI;AACrB,YAAM,UAAU;AAAA,QACd,sDAAsD,IAAI;AAAA,MAC5D;AAMA,YAAM,MAAM,QAAQ,CAAC;AACrB,UAAI,CAAC,KAAK;AACR,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,eAAe,GAAG,GAAG;AACxD,eAAO;AAAA,MACT;AACA,UAAI,OAAO,IAAI,UAAU,IAAI,KAAK;AAChC,cAAM,oDAAoD,IAAI,EAAE;AAChE,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,eAAe,GAAG,GAAG;AACxD,eAAO;AAAA,MACT;AAEA,YAAM,WAAW;AAAA,QACf,sEAAsE,IAAI,cAAc;AAAA,MAC1F;AACA,UAAI,SAAS,CAAC,KAAK,SAAS,CAAC,EAAE,gBAAgB,MAAM;AACnD,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,oBAAoB,MAAM,2CAAa,GAAG,GAAG;AAChF,eAAO;AAAA,MACT;AACA,YAAM,SAAS;AAAA,QACb,sEAAsE,IAAI;AAAA,MAC5E;AACA,UAAI,OAAO,CAAC,KAAK,OAAO,CAAC,EAAE,mBAAmB,IAAI,gBAAgB;AAChE,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,wBAAwB,MAAM,0CAAY,GAAG,GAAG;AACnF,eAAO;AAAA,MACT;AAEA,YAAM,0DAA0D,IAAI,cAAc,qBAAqB,IAAI,EAAE;AAC7G;AAAA,QACE;AAAA,sBACc,IAAI,cAAc,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,UAAU,KAAK,GAAG;AAAA,MAC/E;AACA,YAAM,oDAAoD,IAAI,EAAE;AAChE,WAAK,KAAK;AAAA,QACR,SAAS;AAAA,QACT,SAAS;AAAA,UACP,gBAAgB,IAAI;AAAA,UACpB,aAAa;AAAA,UACb,aAAa;AAAA,UACb,YAAY,IAAI;AAAA,UAChB,UAAU;AAAA,QACZ;AAAA,MACF,CAAC;AACD,aAAO;AAAA,IACT;AAEA,QAAI,SAAS,8BAA8B,WAAW,QAAQ;AAC5D,YAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,YAAM,SAAS,OAAO,KAAK,UAAU,KAAK,kBAAkB,EAAE,EAAE,KAAK;AACrE,YAAM,OAAO,OAAO,KAAK,QAAQ,KAAK,eAAe,EAAE,EAAE,KAAK;AAC9D,UAAI,CAAC,UAAU,CAAC,MAAM;AACpB,aAAK,KAAK,EAAE,SAAS,OAAO,OAAO,0BAA0B,GAAG,GAAG;AACnE,eAAO;AAAA,MACT;AACA,UAAI,UAAU;AACd,UAAI,QAAQ;AACV,cAAM,SAAS;AAAA,UACb,yEAAyE,MAAM;AAAA,QACjF;AACA,cAAM,0DAA0D,MAAM,EAAE;AACxE,cAAM,8DAA8D,MAAM,EAAE;AAC5E,mBAAW,OAAO;AAAA,MACpB;AACA,UAAI,MAAM;AACR,cAAM,SAAS;AAAA,UACb,sEAAsE,IAAI;AAAA,QAC5E;AACA,cAAM,uDAAuD,IAAI,EAAE;AACnE,mBAAW,OAAO;AAAA,MACpB;AACA,WAAK,KAAK,EAAE,SAAS,MAAM,SAAS,UAAU,GAAG,QAAQ,CAAC;AAC1D,aAAO;AAAA,IACT;AAEA,SAAK,KAAK,EAAE,SAAS,OAAO,OAAO,YAAY,GAAG,GAAG;AACrD,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/routes/qq-events.d.ts

@@ -0,0 +1,20 @@
+/**
+ * routes/qq-events.ts — MC 事件入站
+ *
+ *   POST /api/sfmc/qq/events — 单条或 { events: [...] }（≤100）
+ */
+import type { QqEventsAggregator } from "../domain/qq-events.js";
+interface Deps {
+    body: (req: import("http").IncomingMessage) => Promise<Record<string, unknown>>;
+    json: (res: import("http").ServerResponse, data: Record<string, unknown>, status?: number) => void;
+    aggregator: QqEventsAggregator;
+}
+declare function createQqEventsRoutes({ body, json, aggregator }: Deps): ({ path, method, req, res, }: {
+    path: string;
+    method: string;
+    params: URLSearchParams;
+    req: import("http").IncomingMessage;
+    res: import("http").ServerResponse;
+}) => Promise<boolean>;
+export { createQqEventsRoutes };
+//# sourceMappingURL=qq-events.d.ts.map

package/dist/routes/qq-events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qq-events.d.ts","sourceRoot":"","sources":["../../src/routes/qq-events.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAkB,MAAM,wBAAwB,CAAC;AAGjF,UAAU,IAAI;IACZ,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACnG,UAAU,EAAE,kBAAkB,CAAC;CAChC;AAaD,iBAAS,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,IAAI,iCAMzD;IACD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC;IACxB,GAAG,EAAE,OAAO,MAAM,EAAE,eAAe,CAAC;IACpC,GAAG,EAAE,OAAO,MAAM,EAAE,cAAc,CAAC;CACpC,KAAG,OAAO,CAAC,OAAO,CAAC,CAwBrB;AAED,OAAO,EAAE,oBAAoB,EAAE,CAAC"}

package/dist/routes/qq-events.js

@@ -0,0 +1,39 @@
+import { normalizeEventPayload } from "../domain/qq-events.js";
+function collectPayloads(data) {
+  if (Array.isArray(data.events)) {
+    return data.events.map((x) => normalizeEventPayload(x)).filter((x) => x != null);
+  }
+  const one = normalizeEventPayload(data);
+  return one ? [one] : [];
+}
+function createQqEventsRoutes({ body, json, aggregator }) {
+  return async function handle({
+    path,
+    method,
+    req,
+    res
+  }) {
+    if (path !== "/api/sfmc/qq/events") return false;
+    if (method !== "POST") {
+      json(res, { success: false, error: "not_found" }, 404);
+      return true;
+    }
+    const data = await body(req);
+    if (Array.isArray(data.events) && data.events.length > 100) {
+      json(res, { success: false, error: "too many requests" }, 413);
+      return true;
+    }
+    const payloads = collectPayloads(data);
+    if (payloads.length === 0) {
+      json(res, { success: false, error: "invalid" }, 400);
+      return true;
+    }
+    const result = aggregator.ingestMany(payloads);
+    json(res, { success: true, ...result });
+    return true;
+  };
+}
+export {
+  createQqEventsRoutes
+};
+//# sourceMappingURL=qq-events.js.map

package/dist/routes/qq-events.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/routes/qq-events.ts"],
+  "sourcesContent": ["/**\n * routes/qq-events.ts \u2014 MC \u4E8B\u4EF6\u5165\u7AD9\n *\n *   POST /api/sfmc/qq/events \u2014 \u5355\u6761\u6216 { events: [...] }\uFF08\u2264100\uFF09\n */\n\nimport type { QqEventsAggregator, QqEventPayload } from \"../domain/qq-events.js\";\nimport { normalizeEventPayload } from \"../domain/qq-events.js\";\n\ninterface Deps {\n  body: (req: import(\"http\").IncomingMessage) => Promise<Record<string, unknown>>;\n  json: (res: import(\"http\").ServerResponse, data: Record<string, unknown>, status?: number) => void;\n  aggregator: QqEventsAggregator;\n}\n\nfunction collectPayloads(data: Record<string, unknown>): QqEventPayload[] {\n  if (Array.isArray(data.events)) {\n    return (data.events as unknown[])\n      .map((x) => normalizeEventPayload(x))\n      .filter((x): x is QqEventPayload => x != null);\n  }\n  // \u5355\u6761\uFF1A\u9876\u5C42\u5373\u4E8B\u4EF6\n  const one = normalizeEventPayload(data);\n  return one ? [one] : [];\n}\n\nfunction createQqEventsRoutes({ body, json, aggregator }: Deps) {\n  return async function handle({\n    path,\n    method,\n    req,\n    res,\n  }: {\n    path: string;\n    method: string;\n    params: URLSearchParams;\n    req: import(\"http\").IncomingMessage;\n    res: import(\"http\").ServerResponse;\n  }): Promise<boolean> {\n    if (path !== \"/api/sfmc/qq/events\") return false;\n\n    if (method !== \"POST\") {\n      json(res, { success: false, error: \"not_found\" }, 404);\n      return true;\n    }\n\n    const data = await body(req);\n    if (Array.isArray(data.events) && (data.events as unknown[]).length > 100) {\n      json(res, { success: false, error: \"too many requests\" }, 413);\n      return true;\n    }\n\n    const payloads = collectPayloads(data);\n    if (payloads.length === 0) {\n      json(res, { success: false, error: \"invalid\" }, 400);\n      return true;\n    }\n\n    const result = aggregator.ingestMany(payloads);\n    json(res, { success: true, ...result });\n    return true;\n  };\n}\n\nexport { createQqEventsRoutes };\n"],
+  "mappings": "AAOA,SAAS,6BAA6B;AAQtC,SAAS,gBAAgB,MAAiD;AACxE,MAAI,MAAM,QAAQ,KAAK,MAAM,GAAG;AAC9B,WAAQ,KAAK,OACV,IAAI,CAAC,MAAM,sBAAsB,CAAC,CAAC,EACnC,OAAO,CAAC,MAA2B,KAAK,IAAI;AAAA,EACjD;AAEA,QAAM,MAAM,sBAAsB,IAAI;AACtC,SAAO,MAAM,CAAC,GAAG,IAAI,CAAC;AACxB;AAEA,SAAS,qBAAqB,EAAE,MAAM,MAAM,WAAW,GAAS;AAC9D,SAAO,eAAe,OAAO;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,GAMqB;AACnB,QAAI,SAAS,sBAAuB,QAAO;AAE3C,QAAI,WAAW,QAAQ;AACrB,WAAK,KAAK,EAAE,SAAS,OAAO,OAAO,YAAY,GAAG,GAAG;AACrD,aAAO;AAAA,IACT;AAEA,UAAM,OAAO,MAAM,KAAK,GAAG;AAC3B,QAAI,MAAM,QAAQ,KAAK,MAAM,KAAM,KAAK,OAAqB,SAAS,KAAK;AACzE,WAAK,KAAK,EAAE,SAAS,OAAO,OAAO,oBAAoB,GAAG,GAAG;AAC7D,aAAO;AAAA,IACT;AAEA,UAAM,WAAW,gBAAgB,IAAI;AACrC,QAAI,SAAS,WAAW,GAAG;AACzB,WAAK,KAAK,EAAE,SAAS,OAAO,OAAO,UAAU,GAAG,GAAG;AACnD,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,WAAW,WAAW,QAAQ;AAC7C,SAAK,KAAK,EAAE,SAAS,MAAM,GAAG,OAAO,CAAC;AACtC,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/routes/qq-join.d.ts

@@ -0,0 +1,46 @@
+/**
+ * routes/qq-join.ts — 入服审批状态机 + BDS 生效队列（不写 allowlist 文件）
+ *
+ *   GET  /api/sfmc/qq/join/settings
+ *   POST /api/sfmc/qq/join/settings
+ *   POST /api/sfmc/qq/join/request
+ *   POST /api/sfmc/qq/join/decide
+ *   GET  /api/sfmc/qq/join/pending
+ *   GET  /api/sfmc/qq/join/apply-queue
+ *   POST /api/sfmc/qq/join/applied
+ *   POST /api/sfmc/qq/admin/kick
+ *   GET  /api/sfmc/qq/admin/action-queue
+ *   POST /api/sfmc/qq/admin/action-done
+ */
+import type { QueryFn } from "../lib/sqlite.js";
+export type JoinFeatureFlags = {
+    /** 入服白名单总开关 */
+    allowlistEnabled: boolean;
+    /** 是否需要管理员审批 */
+    requireApproval: boolean;
+    /**
+     * 是否将 QQ 群主/群管理员视作 SFMC 管理员。
+     * 仅 configs/qq_link.json 可改，API/群聊不可写。
+     */
+    treatGroupAdminsAsAdmins: boolean;
+};
+interface Deps {
+    query: QueryFn;
+    body: (req: import("http").IncomingMessage) => Promise<Record<string, unknown>>;
+    json: (res: import("http").ServerResponse, data: Record<string, unknown>, status?: number) => void;
+    /** 当前管理员 openid 列表（来自 qq_config） */
+    getAdminOpenids: () => string[];
+    /** 读取入服开关（应读最新 qq_config） */
+    getJoinFlags: () => JoinFeatureFlags;
+    /** 写回入服开关（持久化 + 内存） */
+    setJoinFlags: (partial: Partial<JoinFeatureFlags>) => JoinFeatureFlags;
+}
+declare function createQqJoinRoutes({ query, body, json, getAdminOpenids, getJoinFlags, setJoinFlags }: Deps): ({ path, method, params, req, res, }: {
+    path: string;
+    method: string;
+    params: URLSearchParams;
+    req: import("http").IncomingMessage;
+    res: import("http").ServerResponse;
+}) => Promise<boolean>;
+export { createQqJoinRoutes };
+//# sourceMappingURL=qq-join.d.ts.map

package/dist/routes/qq-join.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"qq-join.d.ts","sourceRoot":"","sources":["../../src/routes/qq-join.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEhD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,eAAe;IACf,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gBAAgB;IAChB,eAAe,EAAE,OAAO,CAAC;IACzB;;;OAGG;IACH,wBAAwB,EAAE,OAAO,CAAC;CACnC,CAAC;AAEF,UAAU,IAAI;IACZ,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAChF,IAAI,EAAE,CAAC,GAAG,EAAE,OAAO,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;IACnG,oCAAoC;IACpC,eAAe,EAAE,MAAM,MAAM,EAAE,CAAC;IAChC,6BAA6B;IAC7B,YAAY,EAAE,MAAM,gBAAgB,CAAC;IACrC,uBAAuB;IACvB,YAAY,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,KAAK,gBAAgB,CAAC;CACxE;AA4BD,iBAAS,kBAAkB,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,eAAe,EAAE,YAAY,EAAE,YAAY,EAAE,EAAE,IAAI,yCAO/F;IACD,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,eAAe,CAAC;IACxB,GAAG,EAAE,OAAO,MAAM,EAAE,eAAe,CAAC;IACpC,GAAG,EAAE,OAAO,MAAM,EAAE,cAAc,CAAC;CACpC,KAAG,OAAO,CAAC,OAAO,CAAC,CAkRrB;AAED,OAAO,EAAE,kBAAkB,EAAE,CAAC"}

package/dist/routes/qq-join.js

@@ -0,0 +1,277 @@
+import { randomBytes } from "node:crypto";
+import { SQL } from "sql-template-strings";
+function newId(prefix) {
+  return `${prefix}_${Date.now().toString(36)}_${randomBytes(4).toString("hex")}`;
+}
+function isAdmin(getAdminOpenids, openid) {
+  const list = getAdminOpenids();
+  if (!openid || list.length === 0) return false;
+  return list.includes(openid);
+}
+function authorizeAdmin(getAdminOpenids, getJoinFlags, openid, data) {
+  if (isAdmin(getAdminOpenids, openid)) return true;
+  const asGroup = data.as_group_admin === true || data.as_group_admin === "true" || data.is_group_admin === true || data.is_group_admin === "true";
+  return asGroup && getJoinFlags().treatGroupAdminsAsAdmins === true;
+}
+function createQqJoinRoutes({ query, body, json, getAdminOpenids, getJoinFlags, setJoinFlags }) {
+  return async function handle({
+    path,
+    method,
+    params,
+    req,
+    res
+  }) {
+    const isJoin = path.startsWith("/api/sfmc/qq/join");
+    const isAdminPath = path.startsWith("/api/sfmc/qq/admin");
+    if (!isJoin && !isAdminPath) return false;
+    if (path === "/api/sfmc/qq/join/settings" && method === "GET") {
+      const flags = getJoinFlags();
+      json(res, {
+        success: true,
+        allowlist_enabled: flags.allowlistEnabled,
+        require_approval: flags.requireApproval,
+        treat_group_admins_as_admins: flags.treatGroupAdminsAsAdmins
+      });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/join/settings" && method === "POST") {
+      const data = await body(req);
+      const openid = String(data.openid ?? data.decided_by ?? "").trim();
+      if (Object.prototype.hasOwnProperty.call(data, "treat_group_admins_as_admins") || Object.prototype.hasOwnProperty.call(data, "treatGroupAdminsAsAdmins")) {
+        json(
+          res,
+          {
+            success: false,
+            error: "immutable_field",
+            note: "treat_group_admins_as_admins \u53EA\u80FD\u6539 configs/qq_link.json\uFF0C\u7FA4\u804A\u4E0D\u53EF\u6539"
+          },
+          400
+        );
+        return true;
+      }
+      if (!authorizeAdmin(getAdminOpenids, getJoinFlags, openid, data)) {
+        json(res, { success: false, error: "not_admin" }, 403);
+        return true;
+      }
+      const partial = {};
+      if (Object.prototype.hasOwnProperty.call(data, "allowlist_enabled")) {
+        partial.allowlistEnabled = data.allowlist_enabled === true || data.allowlist_enabled === "true";
+      }
+      if (Object.prototype.hasOwnProperty.call(data, "require_approval")) {
+        partial.requireApproval = data.require_approval === true || data.require_approval === "true";
+      }
+      if (partial.allowlistEnabled === void 0 && partial.requireApproval === void 0) {
+        json(res, { success: false, error: "no_settings" }, 400);
+        return true;
+      }
+      const flags = setJoinFlags(partial);
+      json(res, {
+        success: true,
+        allowlist_enabled: flags.allowlistEnabled,
+        require_approval: flags.requireApproval,
+        treat_group_admins_as_admins: flags.treatGroupAdminsAsAdmins
+      });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/join/request" && method === "POST") {
+      const flags = getJoinFlags();
+      if (!flags.allowlistEnabled) {
+        json(res, { success: false, error: "join_allowlist_disabled" }, 403);
+        return true;
+      }
+      const data = await body(req);
+      const openid = String(data.openid ?? data.applicant_openid ?? "").trim();
+      const playerName = String(data.player_name ?? data.name ?? "").trim();
+      const backend = String(data.qq_backend ?? "official").trim() || "official";
+      if (!openid) {
+        json(res, { success: false, error: "openid_required" }, 400);
+        return true;
+      }
+      if (!playerName || playerName.length > 32) {
+        json(res, { success: false, error: "player_name_required" }, 400);
+        return true;
+      }
+      const id = newId("join");
+      const now = Date.now();
+      const autoApproved = !flags.requireApproval;
+      const status = autoApproved ? "approved" : "pending";
+      if (autoApproved) {
+        query(SQL`
+          INSERT INTO sfmc_qq_join_requests
+            (id, applicant_openid, player_name, status, qq_backend, created_at, decided_at, decided_by)
+          VALUES (${id}, ${openid}, ${playerName}, ${status}, ${backend}, ${now}, ${now}, 'auto')
+        `);
+      } else {
+        query(SQL`
+          INSERT INTO sfmc_qq_join_requests
+            (id, applicant_openid, player_name, status, qq_backend, created_at)
+          VALUES (${id}, ${openid}, ${playerName}, ${status}, ${backend}, ${now})
+        `);
+      }
+      const admins = getAdminOpenids();
+      json(res, {
+        success: true,
+        id,
+        player_name: playerName,
+        status,
+        auto_approved: autoApproved,
+        admin_notify: !autoApproved && admins.length > 0,
+        note: autoApproved ? "\u5DF2\u5173\u95ED\u5BA1\u6279\uFF0C\u7533\u8BF7\u5DF2\u81EA\u52A8\u901A\u8FC7\uFF0C\u7B49\u5F85 BDS \u5199\u5165\u767D\u540D\u5355" : admins.length === 0 ? "\u672A\u914D\u7F6E qq_admin_openids\uFF0C\u65E0\u6CD5\u901A\u77E5\u7BA1\u7406\u5458" : void 0
+      });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/join/decide" && method === "POST") {
+      const data = await body(req);
+      const id = String(data.id ?? data.request_id ?? "").trim();
+      const decision = String(data.decision ?? "").trim().toLowerCase();
+      const decidedBy = String(data.decided_by ?? data.openid ?? "").trim();
+      if (!id || decision !== "approve" && decision !== "reject") {
+        json(res, { success: false, error: "id_and_decision_required" }, 400);
+        return true;
+      }
+      if (!authorizeAdmin(getAdminOpenids, getJoinFlags, decidedBy, data)) {
+        json(res, { success: false, error: "not_admin" }, 403);
+        return true;
+      }
+      const rows = query(SQL`SELECT * FROM sfmc_qq_join_requests WHERE id = ${id} LIMIT 1`);
+      const row = rows[0];
+      if (!row) {
+        json(res, { success: false, error: "not_found" }, 404);
+        return true;
+      }
+      if (String(row.status) !== "pending") {
+        json(res, { success: false, error: "already_decided", status: row.status }, 409);
+        return true;
+      }
+      const next = decision === "approve" ? "approved" : "rejected";
+      const now = Date.now();
+      query(SQL`
+        UPDATE sfmc_qq_join_requests
+        SET status = ${next}, decided_at = ${now}, decided_by = ${decidedBy}
+        WHERE id = ${id}
+      `);
+      json(res, {
+        success: true,
+        id,
+        status: next,
+        player_name: row.player_name,
+        applicant_openid: row.applicant_openid
+      });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/join/pending" && method === "GET") {
+      const openid = String(params.get("openid") ?? "").trim();
+      if (openid) {
+        const asGroup = params.get("as_group_admin") === "true" || params.get("is_group_admin") === "true";
+        if (!authorizeAdmin(getAdminOpenids, getJoinFlags, openid, { as_group_admin: asGroup })) {
+          json(res, { success: false, error: "not_admin" }, 403);
+          return true;
+        }
+      }
+      const rows = query(
+        SQL`SELECT id, applicant_openid, player_name, status, created_at
+            FROM sfmc_qq_join_requests WHERE status = 'pending'
+            ORDER BY created_at ASC LIMIT 50`
+      );
+      json(res, { success: true, pending: rows });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/join/apply-queue" && method === "GET") {
+      const flags = getJoinFlags();
+      if (!flags.allowlistEnabled) {
+        json(res, { success: true, queue: [], note: "join_allowlist_disabled" });
+        return true;
+      }
+      const rows = query(
+        SQL`SELECT id, player_name, applicant_openid, decided_at
+            FROM sfmc_qq_join_requests WHERE status = 'approved'
+            ORDER BY decided_at ASC LIMIT 32`
+      );
+      json(res, { success: true, queue: rows });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/join/applied" && method === "POST") {
+      const data = await body(req);
+      const id = String(data.id ?? "").trim();
+      const ok = data.ok !== false && data.error == null;
+      const err = String(data.error ?? "").slice(0, 200);
+      if (!id) {
+        json(res, { success: false, error: "id_required" }, 400);
+        return true;
+      }
+      const now = Date.now();
+      if (ok) {
+        query(SQL`
+          UPDATE sfmc_qq_join_requests
+          SET status = 'applied', applied_at = ${now}, apply_error = NULL
+          WHERE id = ${id} AND status = 'approved'
+        `);
+      } else {
+        query(SQL`
+          UPDATE sfmc_qq_join_requests
+          SET status = 'apply_failed', applied_at = ${now}, apply_error = ${err}
+          WHERE id = ${id} AND status = 'approved'
+        `);
+      }
+      json(res, { success: true });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/admin/kick" && method === "POST") {
+      const data = await body(req);
+      const openid = String(data.openid ?? data.requested_by ?? "").trim();
+      const target = String(data.target_name ?? data.name ?? "").trim();
+      const reason = String(data.reason ?? "QQ \u7BA1\u7406\u5458\u8E22\u51FA").trim().slice(0, 80);
+      if (!authorizeAdmin(getAdminOpenids, getJoinFlags, openid, data)) {
+        json(res, { success: false, error: "not_admin" }, 403);
+        return true;
+      }
+      if (!target) {
+        json(res, { success: false, error: "target_name_required" }, 400);
+        return true;
+      }
+      const id = newId("act");
+      const now = Date.now();
+      query(SQL`
+        INSERT INTO sfmc_qq_admin_actions
+          (id, kind, target_name, reason, requested_by, status, created_at)
+        VALUES (${id}, 'kick', ${target}, ${reason}, ${openid}, 'pending', ${now})
+      `);
+      json(res, { success: true, id });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/admin/action-queue" && method === "GET") {
+      const rows = query(
+        SQL`SELECT id, kind, target_name, reason, created_at
+            FROM sfmc_qq_admin_actions WHERE status = 'pending'
+            ORDER BY created_at ASC LIMIT 32`
+      );
+      json(res, { success: true, queue: rows });
+      return true;
+    }
+    if (path === "/api/sfmc/qq/admin/action-done" && method === "POST") {
+      const data = await body(req);
+      const id = String(data.id ?? "").trim();
+      const ok = data.ok !== false && data.error == null;
+      const err = String(data.error ?? "").slice(0, 200);
+      if (!id) {
+        json(res, { success: false, error: "id_required" }, 400);
+        return true;
+      }
+      const now = Date.now();
+      const status = ok ? "done" : "failed";
+      query(SQL`
+        UPDATE sfmc_qq_admin_actions
+        SET status = ${status}, applied_at = ${now}, apply_error = ${ok ? "" : err}
+        WHERE id = ${id} AND status = 'pending'
+      `);
+      json(res, { success: true });
+      return true;
+    }
+    json(res, { success: false, error: "not_found" }, 404);
+    return true;
+  };
+}
+export {
+  createQqJoinRoutes
+};
+//# sourceMappingURL=qq-join.js.map