guanwei 1.3.2 → 1.3.5

package/server/src/routes/ai.ts

@@ -1,8 +1,7 @@
 // AI 解读路由：/api/ai/interpret（非流式）+ /api/ai/interpret/stream（SSE）
 import { Router } from 'express';
-import fs from 'fs';
+import { resolveTokenUser } from '../services/auth.js';
 import path from 'path';
-import crypto from 'crypto';
 import { fileURLToPath } from 'url';
 import { buildMessages, buildReportMessages, buildStep1Messages, buildStep2Messages } from '../services/promptBuilder.js';
 import { chatOnce, chatStream, activeProvider, providerStatus, lastFinishReason } from '../services/llmProvider.js';
@@ -13,29 +12,18 @@ import { MINGPAN_TEMPLATE } from '../services/promptBuilder.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
-// 请求 token → 用户名（与 divine.ts 同策略：有 token 以 token 为准，防 body 自报他人名）
+// 请求 token → 用户名（统一走 services/auth：含 tokenExpires 校验，2026-09 修 P1-1）
 function authedUsername(req: any): string | null {
-  const tk = String(req.headers['x-guanwei-token'] || '');
-  if (!tk) return null;
-  try {
-    const db = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'data', 'db.json'), 'utf-8'));
-    const user = db.users.find((u: any) => u.token && u.token.length === tk.length && crypto.timingSafeEqual(Buffer.from(u.token), Buffer.from(tk)));
-    return user ? user.username : null;
-  } catch { return null; }
+  return resolveTokenUser(req)?.username ?? null;
 }
 
 
-// 解读归属校验（与 divine.resolveOwner 同策略）：正式账号须本人 token，占位账号兼容无 token
-function canReadChart(req: any, recUsername: string, fallbackUsername: string): boolean {
+// 解读归属校验：正式账号须本人 token；占位账号仅限「可信内网来源」无 token 访问
+// （2026-09 修 P0-2：原实现 catch 分支 fail-open，读库失败即放行，配合无鉴权建档可跨用户读档案/耗 AI 额度）
+function canReadChart(req: any, recUsername: string): boolean {
+  // 解读 = 读取排盘记录 + 消耗 owner 的 LLM 额度：一律须持凭据（2026-09 W38 收紧）
   const authed = authedUsername(req);
-  if (authed) return authed === recUsername;
-  // 无 token：仅当目标是占位账号（未正式注册）时允许 fallback username
-  if (fallbackUsername && fallbackUsername !== recUsername) return false;
-  try {
-    const db = JSON.parse(fs.readFileSync(path.join(__dirname, '..', 'data', 'db.json'), 'utf-8'));
-    const user = db.users.find((u: any) => u.username === recUsername);
-    return !user || !user.passHash;  // 占位账号放行
-  } catch { return true; }
+  return !!authed && authed === recUsername;
 }
 
 // 非流式：token 优先归属
@@ -57,7 +45,7 @@ router.post('/interpret', async (req, res) => {
     if (divineId) {
       const rec = getDivination(divineId);
       if (!rec) return res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
-      if (!canReadChart(req, rec.username, String(username || ''))) return res.status(403).json({ error: 'FORBIDDEN' });
+      if (!canReadChart(req, rec.username)) return res.status(403).json({ error: 'FORBIDDEN' });
       resultRaw = rec.resultRaw;
       recProfile = rec.profile;
     } else {
@@ -138,7 +126,7 @@ router.post('/interpret/stream', async (req, res) => {
     res.status(400).json({ error: 'DIVINE_NOT_FOUND', message: '起占记录不存在，请重新起占' });
     return;
   }
-  if (!canReadChart(req, rec.username, String(username || ''))) {
+  if (!canReadChart(req, rec.username)) {
     res.status(403).json({ error: 'FORBIDDEN' });
     return;
   }

package/server/src/routes/divine.ts

@@ -2,28 +2,24 @@
 import { Router } from 'express';
 import { chartCalc } from '../../../shared/core/engine/chart.js';
 import { createDivination, listDivinations, getDivination, deleteDivination } from '../services/divineStore.js';
-import fs from 'fs';
-import path from 'path';
-import crypto from 'crypto';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const DB_FILE = path.join(__dirname, '..', 'data', 'db.json');
+import { resolveTokenUser, allowAnonymous } from '../services/auth.js';
+import { getUser, createUserIfAbsent, newToken } from '../services/usersStore.js';
 
 const router = Router();
 const MINGPAN_ARTS = ['bazi', 'ziwei', 'astrology'];
 
-// 宽松建档：前端本地注册的用户在此同步建档（与 users.ts upsert 同策略；建档即发 claimToken 防抢占）
-// 返回 null=失败；否则 { existed: 是否已存在, claimToken: 该账号当前 token（新建时返回，供前端保存用于后续注册升级）}
+// 宽松建档：前端本地注册的用户在此同步建档（与 users.ts register 同策略；新建时发 claimToken 防抢占）
+// 返回 null=失败；否则 { existed, claimToken }
+// 安全（2026-09 修 P0-1）：claimToken 只在「本次新建」时返回，绝不回吐已存在账号的 token——
+// 否则任何人只要知道 username 即可取走占位账号凭据并 register 抢占（含档案/起占历史）。
+// 存储（W38 #4）：INSERT OR IGNORE 原子建档，并发请求只有一个拿到 claimToken。
 function ensureUser(username: string): { existed: boolean; claimToken: string } | null {
   if (!username || typeof username !== 'string') return null;
   try {
-    const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
-    const exist = db.users.find((u: any) => u.username === username);
-    if (exist) return { existed: true, claimToken: exist.token || '' };
-    const token = crypto.randomBytes(32).toString('hex');
-    db.users.push({ username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token, tokenExpires: Date.now() + 30 * 24 * 3600 * 1000 });
-    fs.writeFileSync(DB_FILE, JSON.stringify(db, null, 2));
+    if (getUser(username)) return { existed: true, claimToken: '' };   // 已存在账号绝不回吐 token（P0-1）
+    const token = newToken();
+    const created = createUserIfAbsent({ username, token, tokenExpires: Date.now() + 30 * 24 * 3600 * 1000 });
+    if (!created) return { existed: true, claimToken: '' };
     console.log('[divine] 自动建档:', username);
     return { existed: false, claimToken: token };
   } catch (e: any) {
@@ -34,13 +30,7 @@ function ensureUser(username: string): { existed: boolean; claimToken: string }
 
 // 请求携带的 token → 对应用户名（有 token 则以其为准，堵「query/body 自报 username」越权）
 function authedUsername(req: any): string | null {
-  const tk = String(req.headers['x-guanwei-token'] || '');
-  if (!tk) return null;
-  try {
-    const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
-    const user = db.users.find((u: any) => u.token && u.token.length === tk.length && crypto.timingSafeEqual(Buffer.from(u.token), Buffer.from(tk)));
-    return user ? user.username : null;
-  } catch { return null; }
+  return resolveTokenUser(req)?.username ?? null;
 }
 
 // 归属校验统一入口：
@@ -49,14 +39,24 @@ function authedUsername(req: any): string | null {
 //   · 目标为占位账号（passHash 空，自动建档/未正式注册）→ 允许（本地单机流程）
 //   · 目标为正式账号（注册过，passHash 非空）→ 401（必须持本人 token，H-NEW1~3）
 // 返回 { owner, isPlaceholder }；null = 校验失败（已 res 响应）
-function resolveOwner(req: any, res: any, fallbackUsername: string): { owner: string; isPlaceholder: boolean } | null {
+function resolveOwner(req: any, res: any, fallbackUsername: string, opts: { requireToken?: boolean } = {}): { owner: string; isPlaceholder: boolean } | null {
   const authed = authedUsername(req);
+  // 读/删类操作（历史、详情、删除）一律须持凭据——占位账号亦然（2026-09 W38 收紧 #3 残余：
+  // 原实现允许同内网凭 username 匿名读他人起占历史）。本地流程由前端携带起占时下发的 claimToken。
+  if (!authed && opts.requireToken) {
+    res.status(401).json({ error: 'AUTH_REQUIRED', message: '读取档案/记录需携带本人凭据（本地流程请携带起占时下发的 claimToken）' });
+    return null;
+  }
+  // 匿名来源限制（P0-3）：公网来源必须持 token；仅回环/内网允许无 token 的本地流程
+  if (!authed && !allowAnonymous(req)) {
+    res.status(401).json({ error: 'AUTH_REQUIRED', message: '请先入馆（登录）后操作（公网访问不开放匿名起占）' });
+    return null;
+  }
   let owner = authed || String(fallbackUsername || '');
   if (!owner) { res.status(401).json({ error: 'UNAUTHORIZED', message: '请先入馆（登录）' }); return null; }
   let user: any = null;
   try {
-    const db = JSON.parse(fs.readFileSync(DB_FILE, 'utf-8'));
-    user = db.users.find((u: any) => u.username === owner) || null;
+    user = getUser(owner);
   } catch { /* 读失败按占位处理 */ }
   const isPlaceholder = !user || !user.passHash;
   if (!authed && !isPlaceholder) {
@@ -68,7 +68,7 @@ function resolveOwner(req: any, res: any, fallbackUsername: string): { owner: st
 }
 
 // POST /api/divine —— 起占入库
-router.post('/', (req, res) => {
+router.post('/', async (req, res) => {
   const { artId, inputs, profile, question, username, profileId } = req.body || {};
   const resolved = resolveOwner(req, res, String(username || ''));
   if (!resolved) return;
@@ -77,7 +77,7 @@ router.post('/', (req, res) => {
   if (!ensured) {
     return res.status(401).json({ error: 'UNAUTHORIZED', message: '请先入馆（登录）再起占' });
   }
-  const claimToken = ensured.claimToken;  // 新建占位账号时返回，供前端保存（L-NEW1）
+  const claimToken = ensured.claimToken;  // 仅「本次新建」时非空（P0-1）
   if (!artId || !inputs) return res.status(400).json({ error: '缺少必要参数' });
 
   let resultRaw: unknown;
@@ -101,17 +101,17 @@ router.post('/', (req, res) => {
   const authed = authedUsername(req);
   res.json({
     ok: true, divineId: rec.id, resultRaw, display: rec.display,
-    // L-NEW1：请求未带 token（本地占位流程）→ 返回 claimToken，前端保存后注册可升级；带 token 则无需
-    claimToken: authed ? undefined : ensured.claimToken,
+    // L-NEW1：仅未鉴权 + 本次新建占位账号时返回 claimToken（前端保存后注册可升级）；已存在账号一律不回吐
+    claimToken: (!authed && !ensured.existed && claimToken) ? claimToken : undefined,
   });
 });
 
 // GET /api/divine?username=&page=&pageSize= —— 占卜历史（H-NEW2：正式账号须本人 token）
-router.get('/', (req, res) => {
+router.get('/', async (req, res) => {
   const username = String(req.query.username || '');
   const page = Number(req.query.page || 1);
   const pageSize = Number(req.query.pageSize || 20);
-  const resolved = resolveOwner(req, res, username);
+  const resolved = resolveOwner(req, res, username, { requireToken: true });
   if (!resolved) return;
   if (!ensureUser(resolved.owner)) return res.status(401).json({ error: 'UNAUTHORIZED' });
   res.json(listDivinations(resolved.owner, page, pageSize, String(req.query.profileId || '')));
@@ -122,9 +122,10 @@ router.get('/:id', (req, res) => {
   const rec = getDivination(req.params.id);
   if (!rec) return res.status(404).json({ error: 'DIVINE_NOT_FOUND' });
   // 归属校验：token 优先；无 token 仅占位账号可经 query username 访问
-  const resolved = resolveOwner(req, res, String(req.query.username || ''));
+  const resolved = resolveOwner(req, res, String(req.query.username || ''), { requireToken: true });
   if (!resolved) return;
-  if (resolved.owner !== rec.username) return res.status(403).json({ error: 'FORBIDDEN' });
+  // 归属不符统一返回 404（原 403/404 差异可枚举 divineId 存在性，2026-09 修 P1-7）
+  if (resolved.owner !== rec.username) return res.status(404).json({ error: 'DIVINE_NOT_FOUND' });
   res.json({ ...rec, resultRaw: rec.resultRaw, display: rec.display, report: rec.report || null });
 });
 

package/server/src/routes/hour.ts

@@ -12,6 +12,10 @@ router.post('/hour-infer', (req, res) => {
   if (!Array.isArray(events) || events.length === 0) {
     return res.status(400).json({ error: '请至少提供一条关键人生事件' });
   }
+  // 条数上限（2026-09 修 P2-7）：每条事件会触发 12 候选 × baziCalc，原无上限可被放大
+  if (events.length > 50) {
+    return res.status(400).json({ error: 'TOO_MANY_EVENTS', message: '关键事件请控制在 50 条以内' });
+  }
   const cleanEvents: HourInferEvent[] = events
     .map((e: any) => ({
       year: Number(e?.year),

package/server/src/routes/tarot.ts

@@ -21,7 +21,12 @@ router.post('/draw', (req, res) => {
   let spread: Spread | undefined;
   
   if (customSpread) {
-    spread = customSpread;
+    // 自定义牌阵限长（2026-09 修 P0-5）：原实现按 positions.length 无上限循环，可被 10 万项拖死
+    const pos = Array.isArray(customSpread?.positions) ? customSpread.positions : [];
+    if (pos.length === 0 || pos.length > 20) {
+      return res.status(400).json({ error: 'BAD_SPREAD', message: '自定义牌阵位数为 1-20' });
+    }
+    spread = { ...customSpread, positions: pos.slice(0, 20) } as Spread;
   } else {
     spread = defaultSpreads.find(s => s.id === spreadId);
   }
@@ -41,10 +46,17 @@ router.post('/interpret', (req, res) => {
     return res.status(400).json({ error: '缺少必要参数' });
   }
   
+  // 抽牌/解读入参限长（同上）
+  if (!Array.isArray(cards) || cards.length === 0 || cards.length > 20) {
+    return res.status(400).json({ error: 'BAD_CARDS', message: '牌数需为 1-20' });
+  }
+  if (String(question).length > 300) {
+    return res.status(400).json({ error: 'BAD_QUESTION', message: '所问之事请控制在 300 字以内' });
+  }
   const result = generateInterpretation(
-    cards,
-    spread,
-    question,
+    cards.slice(0, 20),
+    { ...spread, positions: (spread.positions || []).slice(0, 20) },
+    String(question).slice(0, 300),
     category as QuestionCategory
   );
   
@@ -69,13 +81,22 @@ router.post('/interpret/stream', (req, res) => {
     return res.status(400).json({ error: '缺少必要参数' });
   }
   
+  // 抽牌/解读入参限长（同上）
+  if (!Array.isArray(cards) || cards.length === 0 || cards.length > 20) {
+    return res.status(400).json({ error: 'BAD_CARDS', message: '牌数需为 1-20' });
+  }
+  if (String(question).length > 300) {
+    return res.status(400).json({ error: 'BAD_QUESTION', message: '所问之事请控制在 300 字以内' });
+  }
   const result = generateInterpretation(
-    cards,
-    spread,
-    question,
+    cards.slice(0, 20),
+    { ...spread, positions: (spread.positions || []).slice(0, 20) },
+    String(question).slice(0, 300),
     category as QuestionCategory
   );
   
+  let closed = false;
+  req.on('close', () => { closed = true; });   // 客户端断开 → 停止逐字推送（修 P3-2）
   res.setHeader('Content-Type', 'text/event-stream');
   res.setHeader('Cache-Control', 'no-cache');
   res.setHeader('Connection', 'keep-alive');
@@ -83,6 +104,7 @@ router.post('/interpret/stream', (req, res) => {
   let sectionIndex = 0;
   
   const sendSection = () => {
+    if (closed) return;                              // 客户端已断开：停止计时器链
     if (sectionIndex >= result.sections.length) {
       res.write('event: done\n');
       res.write('data: [DONE]\n\n');
@@ -95,6 +117,7 @@ router.post('/interpret/stream', (req, res) => {
     let charIndex = 0;
     
     const typeChar = () => {
+      if (closed) return;                            // 同上
       if (charIndex >= chars.length) {
         sectionIndex++;
         setTimeout(sendSection, 300);

package/server/src/routes/users.ts

@@ -1,12 +1,11 @@
-// 用户/档案/记录 API（本地 JSON 文件存储，供前后端联调）
+// 用户/档案/记录 API（存储：统一 SQLite users 表，见 services/usersStore）
 import { Router } from 'express';
-import fs from 'fs';
-import path from 'path';
 import crypto from 'crypto';
-import { fileURLToPath } from 'url';
-
-const __dirname = path.dirname(fileURLToPath(import.meta.url));
-const DB_FILE = path.join(__dirname, '..', 'data', 'db.json');
+import {
+  getUser, createUserIfAbsent, upgradePlaceholder, rotateToken, setPassHash,
+  mergeProfile, addSample, removeSample, setRecords,
+  newToken, tokenMatches, type UserRow,
+} from '../services/usersStore.js';
 
 function scryptAsync(pw: string, salt: Buffer, keylen: number): Promise<Buffer> {
   return new Promise((resolve, reject) => {
@@ -14,29 +13,49 @@ function scryptAsync(pw: string, salt: Buffer, keylen: number): Promise<Buffer>
   });
 }
 
-interface DbUser {
-  username: string;
-  passHash: string;
-  createdAt: number;
-  profile: Record<string, unknown>;
-  samples: { id: string; name: string; profile: Record<string, unknown> }[];
-  records: Record<string, unknown>[];
-  /** 登录态 token（注册/登录时签发，云同步写接口须携带校验归属） */
-  token?: string;
-  /** token 过期时间（ms；30 天滚动，登录时轮换续期） */
-  tokenExpires?: number;
-}
-
-interface Db { users: DbUser[] }
+// ─── 输入校验（2026-09 安全修复）───
+// profile/records 原样入库会被后续注入 AI prompt 并落盘；此处白名单化 + 拒绝原型污染键
+const DANGEROUS_KEYS = ['__proto__', 'constructor', 'prototype'];
 
-function loadDb(): Db {
-  try { return JSON.parse(fs.readFileSync(DB_FILE, 'utf-8')); }
-  catch { return { users: [] }; }
+function isSafeKey(k: string): boolean { return !DANGEROUS_KEYS.includes(k); }
+function cleanString(v: unknown, max = 200): string {
+  return typeof v === 'string' ? v.slice(0, max) : '';
 }
-
-function saveDb(db: Db): void {
-  fs.mkdirSync(path.dirname(DB_FILE), { recursive: true });
-  fs.writeFileSync(DB_FILE, JSON.stringify(db, null, 2));
+/** 出生档案白名单校验：仅保留已知字段，限制长度/数值范围 */
+function sanitizeProfile(input: any): Record<string, unknown> | null {
+  if (!input || typeof input !== 'object' || Array.isArray(input)) return null;
+  const p = input as Record<string, any>;
+  const out: Record<string, unknown> = {};
+  if (typeof p.birthDate === 'string' && /^\d{4}-\d{1,2}-\d{1,2}$/.test(p.birthDate)) out.birthDate = p.birthDate.slice(0, 10);
+  if (typeof p.birthTime === 'string' && /^\d{1,2}:\d{2}$/.test(p.birthTime)) out.birthTime = p.birthTime.slice(0, 5);
+  if (Number.isInteger(p.birthHourIndex) && p.birthHourIndex >= -1 && p.birthHourIndex <= 11) out.birthHourIndex = p.birthHourIndex;
+  if (typeof p.birthTimeUnknown === 'boolean') out.birthTimeUnknown = p.birthTimeUnknown;
+  if (p.gender === '男' || p.gender === '女') out.gender = p.gender;
+  if (p.location && typeof p.location === 'object' && !Array.isArray(p.location)) {
+    const l = p.location as Record<string, any>;
+    const lng = Number(l.lng), lat = Number(l.lat);
+    if (Number.isFinite(lng) && lng >= -180 && lng <= 180 && Number.isFinite(lat) && lat >= -90 && lat <= 90) {
+      out.location = { province: cleanString(l.province, 40), city: cleanString(l.city, 40), district: cleanString(l.district, 40), lng, lat };
+    }
+  }
+  if (Array.isArray(p.lifeEvents)) {
+    out.lifeEvents = p.lifeEvents.slice(0, 50)
+      .filter((e: any) => e && typeof e === 'object' && Number.isInteger(e.year) && e.year >= 1900 && e.year <= 2200)
+      .map((e: any) => ({ year: e.year, text: cleanString(e.text, 200) }));
+  }
+  for (const k of Object.keys(out)) if (!isSafeKey(k)) delete out[k];
+  if (JSON.stringify(out).length > 20000) return null;
+  return out;
+}
+/** 记录同步校验：整表覆盖须限条数与单条体积 */
+function sanitizeRecords(input: any): Record<string, unknown>[] | null {
+  if (!Array.isArray(input)) return null;
+  if (input.length > 2000) return null;
+  for (const item of input) {
+    if (item && typeof item === 'object' && JSON.stringify(item).length > 20000) return null;
+    if (item && typeof item === 'object' && Object.keys(item).some(k => !isSafeKey(k))) return null;
+  }
+  return input;
 }
 
 // 密码哈希：scrypt（带随机盐，防彩虹表/暴力破解）。
@@ -51,18 +70,6 @@ async function hashPassword(pw: string): Promise<string> {
 
 const TOKEN_TTL = 30 * 24 * 3600 * 1000;  // 30 天
 
-function newToken(): string {
-  return crypto.randomBytes(32).toString('hex');
-}
-
-function tokenMatches(user: DbUser, token: string | undefined): boolean {
-  if (!token || !user.token) return false;
-  if (user.tokenExpires && Date.now() > user.tokenExpires) return false;  // 过期即失效
-  // 恒时比较，防时序侧信道
-  const a = Buffer.from(token), b = Buffer.from(user.token);
-  return a.length === b.length && crypto.timingSafeEqual(a, b);
-}
-
 async function verifyPassword(pw: string, stored: string): Promise<boolean> {
   if (!stored) return false;
   if (stored.startsWith('scrypt$')) {
@@ -80,136 +87,124 @@ async function verifyPassword(pw: string, stored: string): Promise<boolean> {
   return 'h' + h.toString(16) === stored;
 }
 
-const router = Router();
-
-// 注册
-// 云同步 upsert：本地账号（无密语）不存在时自动建档，避免因数据清理导致 404
-function upsertUser(username: string): DbUser {
-  const db = loadDb();
-  let user = db.users.find((x: any) => x.username === username);
-  if (!user) {
-    user = { username, passHash: '', createdAt: Date.now(), profile: {}, samples: [], records: [], token: newToken(), tokenExpires: Date.now() + TOKEN_TTL };
-    db.users.push(user);
-    saveDb(db);
-    console.log(`[users] 自动建档: ${username}`);
-  }
-  return user;
+/** 登录响应体里的用户视图（不含 token/密语） */
+function publicUser(user: UserRow) {
+  return { username: user.username, profile: user.profile, samples: user.samples };
 }
 
+const router = Router();
+
+// 注册（正式注册 / 占位账号凭 claimToken 升级）
 router.post('/register', async (req, res) => {
   const { username, password, profile } = req.body;
   const name = String(username || '').trim();
   if (name.length < 2) return res.status(400).json({ error: '名号至少二字' });
-  if (!password || String(password).length < 4) return res.status(400).json({ error: '密语至少四位' });
-  const db = loadDb();
-  const existing = db.users.find(u => u.username === name);
+  if (name.length > 24) return res.status(400).json({ error: '名号至多二十四字' });
+  if (!password || String(password).length < 8) return res.status(400).json({ error: '密语至少八位' });
+  const cleanProfile = sanitizeProfile(profile) || undefined;
+
+  const existing = getUser(name);
   if (existing) {
+    if (existing.passHash) return res.status(400).json({ error: '此名号已有人用' });
     // 占位账号（自动建档、无密语）：升级须持有建档时发放的 claimToken，防任意抢占
-    if (!existing.passHash) {
-      const claimToken = String(req.body.claimToken || '');
-      if (!tokenMatches(existing, claimToken)) {
-        return res.status(409).json({ error: 'ACCOUNT_CLAIMED', message: '此名号已被自动建档占用，需持有建档凭据方可注册（或更换名号）' });
-      }
-      existing.passHash = await hashPassword(String(password));
-      existing.token = newToken();
-      existing.tokenExpires = Date.now() + TOKEN_TTL;
-      if (profile) existing.profile = { ...existing.profile, ...profile };
-      saveDb(db);
-      return res.json({ ok: true, upgraded: true, token: existing.token, user: { username: existing.username, profile: existing.profile, samples: existing.samples } });
+    if (!tokenMatches(existing, String(req.body.claimToken || ''))) {
+      return res.status(409).json({ error: 'ACCOUNT_CLAIMED', message: '此名号已被自动建档占用，需持有建档凭据方可注册（或更换名号）' });
+    }
+    const passHash = await hashPassword(String(password));   // 异步哈希在事务外完成
+    const token = newToken();
+    const expires = Date.now() + TOKEN_TTL;
+    const profileMerged = { ...existing.profile, ...(cleanProfile || {}) };
+    try {
+      upgradePlaceholder(name, passHash, token, expires, cleanProfile);
+    } catch (e: any) {
+      console.error('[users] 占位账号升级失败:', e?.message || e);
+      return res.status(500).json({ error: 'UPGRADE_FAILED' });
     }
-    return res.status(400).json({ error: '此名号已有人用' });
+    console.log(`[users] 占位账号已升级: ${name}`);
+    return res.json({ ok: true, upgraded: true, token, user: { username: name, profile: profileMerged, samples: existing.samples } });
   }
-  const user: DbUser = { username: name, passHash: await hashPassword(String(password)), createdAt: Date.now(), profile: profile || {}, samples: [], records: [], token: newToken(), tokenExpires: Date.now() + TOKEN_TTL };
-  db.users.push(user);
-  saveDb(db);
-  res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
+
+  const passHash = await hashPassword(String(password));
+  const token = newToken();
+  const expires = Date.now() + TOKEN_TTL;
+  const created = createUserIfAbsent({ username: name, passHash, profile: cleanProfile || {}, token, tokenExpires: expires });
+  if (!created) return res.status(400).json({ error: '此名号已有人用' });   // 并发下被抢先
+  res.json({ ok: true, token, user: { username: name, profile: cleanProfile || {}, samples: [] } });
 });
 
 // 登录
 router.post('/login', async (req, res) => {
   const { username, password } = req.body;
-  const db = loadDb();
-  const user = db.users.find(u => u.username === String(username || '').trim());
-  if (!user) return res.status(401).json({ error: '名号或密语未合' });
-  const ok = await verifyPassword(String(password || ''), user.passHash);
-  if (!ok) return res.status(401).json({ error: '名号或密语未合' });
-  // 旧哈希命中 → 升级为 scrypt 存储
-  if (user.passHash && !user.passHash.startsWith('scrypt$')) {
-    user.passHash = await hashPassword(String(password));
-    saveDb(db);
-    console.log(`[users] 密码哈希已升级为 scrypt: ${user.username}`);
-  }
-  // 登录成功 → 轮换 token（旧 token 即失效；防泄露长期有效）
-  user.token = newToken();
-  user.tokenExpires = Date.now() + TOKEN_TTL;
-  saveDb(db);
-  res.json({ ok: true, token: user.token, user: { username: user.username, profile: user.profile, samples: user.samples } });
+  const name = String(username || '').trim();
+  const user = getUser(name);
+  // 名号不存在也走一次等价 scrypt，避免时序差异泄露账号是否存在（P2-2）
+  const ok = await verifyPassword(String(password || ''), user ? user.passHash : 'scrypt$' + '0'.repeat(32) + '$' + '0'.repeat(128));
+  if (!user || !ok) return res.status(401).json({ error: '名号或密语未合' });
+  // 旧格式哈希命中后升级（哈希在事务外算，避免事务内 await）
+  const upgraded = user.passHash && !user.passHash.startsWith('scrypt$') ? await hashPassword(String(password)) : null;
+  if (upgraded) console.log(`[users] 密码哈希已升级为 scrypt: ${name}`);
+  // 登录成功 → 轮换 token（旧 token 即失效）
+  const token = newToken();
+  const expires = Date.now() + TOKEN_TTL;
+  const fresh = getUser(name);
+  if (upgraded) setPassHash(name, upgraded);
+  rotateToken(name, token, expires);
+  res.json({ ok: true, token, user: publicUser(fresh || user) });
 });
 
 // ─── 写接口鉴权中间件：云同步写操作须携带本人 token（堵「知道 username 即可写任意档案」）───
 function requireOwner(req: any, res: any, next: any): void {
   const username = req.params.username;
   const token = String(req.headers['x-guanwei-token'] || '');
-  const db = loadDb();
-  const user = db.users.find(u => u.username === username);
+  const user = getUser(username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
   if (!tokenMatches(user, token)) return res.status(401).json({ error: 'AUTH_REQUIRED', message: '请先入馆（登录）后再同步档案' });
-  (req as any)._dbUser = user;
+  req._dbUser = user;
   next();
 }
 
 // 档案读取/更新（读他人档案也须本人 token——防止知道 username 即可窥探）
 router.get('/:username/profile', requireOwner, (req, res) => {
-  const db = loadDb();
-  const user = db.users.find(u => u.username === req.params.username);
+  const user = getUser(req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
   res.json({ profile: user.profile, samples: user.samples });
 });
 
 router.put('/:username/profile', requireOwner, (req, res) => {
-  const db = loadDb();
-  const user = db.users.find(u => u.username === req.params.username);
-  if (!user) return res.status(404).json({ error: '馆中无此人' });
-  user.profile = req.body.profile || user.profile;
-  saveDb(db);
-  res.json({ ok: true, profile: user.profile });
+  const clean = sanitizeProfile(req.body.profile);
+  if (!clean) return res.status(400).json({ error: 'BAD_PROFILE', message: '档案格式不合法（字段白名单/长度/数值范围校验未通过）' });
+  const profile = mergeProfile(req.params.username, clean);
+  if (!profile) return res.status(404).json({ error: '馆中无此人' });
+  res.json({ ok: true, profile });
 });
 
-// 示例档案增删/提升
+// 示例档案增删
 router.post('/:username/samples', requireOwner, (req, res) => {
-  const db = loadDb();
-  const user = db.users.find(u => u.username === req.params.username);
-  if (!user) return res.status(404).json({ error: '馆中无此人' });
-  const sample = { id: 's' + Date.now(), name: String(req.body.name || '未名档案'), profile: req.body.profile || {} };
-  user.samples.push(sample);
-  saveDb(db);
-  res.json({ ok: true, samples: user.samples });
+  const sample = { id: 's' + Date.now(), name: String(req.body.name || '未名档案').slice(0, 40), profile: sanitizeProfile(req.body.profile) || {} };
+  const samples = addSample(req.params.username, sample);
+  if (!samples) return res.status(404).json({ error: '馆中无此人' });
+  res.json({ ok: true, samples });
 });
 
 router.delete('/:username/samples/:id', requireOwner, (req, res) => {
-  const db = loadDb();
-  const user = db.users.find(u => u.username === req.params.username);
-  if (!user) return res.status(404).json({ error: '馆中无此人' });
-  user.samples = user.samples.filter(s => s.id !== req.params.id);
-  saveDb(db);
-  res.json({ ok: true, samples: user.samples });
+  const samples = removeSample(req.params.username, req.params.id);
+  if (!samples) return res.status(404).json({ error: '馆中无此人' });
+  res.json({ ok: true, samples });
 });
 
 // 记录同步（按用户整表覆盖）
 router.put('/:username/records', requireOwner, (req, res) => {
-  const db = loadDb();
-  const user = db.users.find(u => u.username === req.params.username);
-  if (!user) return res.status(404).json({ error: '馆中无此人' });
-  user.records = Array.isArray(req.body.records) ? req.body.records : [];
-  saveDb(db);
-  res.json({ ok: true, count: user.records.length });
+  const recs = sanitizeRecords(req.body.records);
+  if (!recs) return res.status(400).json({ error: 'BAD_RECORDS', message: '记录格式不合法（条数上限 2000 / 单条 20KB / 禁止危险键）' });
+  const count = setRecords(req.params.username, recs);
+  if (count === null) return res.status(404).json({ error: '馆中无此人' });
+  res.json({ ok: true, count });
 });
 
 router.get('/:username/records', requireOwner, (req, res) => {
-  const db = loadDb();
-  const user = db.users.find(u => u.username === req.params.username);
+  const user = getUser(req.params.username);
   if (!user) return res.status(404).json({ error: '馆中无此人' });
   res.json({ records: user.records });
 });
 
-export default router;
+export default router;