trustbase-seller-backend 0.2.0 → 0.2.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/onboard.html

@@ -103,6 +103,14 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
   #apply-form .auploads{grid-template-columns:1fr}
   #apply-form .ascene-row{grid-template-columns:1fr}
 }
+/* ===== 服务商名片卡 (2026-10-03 xiaomu: 入驻页显示服务商是谁) ===== */
+.spcard{background:#FCFAF4;border:1px solid #EAE3D6;border-radius:14px;padding:16px 18px;margin-bottom:18px}
+.spcard.offline{opacity:.65;background:#F4F1EA}
+.spcard-h{display:flex;align-items:center;gap:8px;font-size:15px;color:#33302B}
+.spbadge{background:#C4633C;color:#fff;font-size:11px;border-radius:999px;padding:2px 10px;margin-left:auto}
+.spcard-desc{font-size:13px;color:#6B655B;margin-top:6px;line-height:1.7}
+.spcard-foot{font-size:12px;color:#8A857B;margin-top:8px;line-height:1.9}
+.spcard-foot a{color:#C4633C;text-decoration:none}
 @media print{
   body *{visibility:hidden}
   #print-area,#print-area *{visibility:visible}
@@ -116,6 +124,12 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
 <h1>TrustBase 商家入驻</h1>
 <p class="sub">在你的电脑上完成入驻，密钥永不出门</p>
 
+<div class="spcard" id="spcard" style="display:none">
+  <div class="spcard-h"><span>🏪</span><span id="sp-name" style="font-weight:600">服务商</span><span class="spbadge" id="sp-rate" style="display:none"></span></div>
+  <div class="spcard-desc" id="sp-desc"></div>
+  <div class="spcard-foot" id="sp-foot"></div>
+</div>
+
 <div class="progress" id="progress">
 <h3>入驻进度 <span id="status-meta" style="font-size:12px;color:#8A857B;font-weight:400"></span><button class="sbtn noprint" style="float:right;margin-top:-2px" onclick="loadStatus()">刷新状态</button></h3>
 <div class="step done" id="st-identity">
@@ -133,7 +147,6 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
 <div class="step" id="st-verification">
   <span class="mark">⬜</span>
   <div class="body">③ 微信收款认证
-    <div class="ops"><button class="sbtn" id="btn-verify" onclick="submitVerification()" title="链上身份认证由服务商在进件审核通过后自动完成, 一般无需手动">提交实名认证 (一般无需手动)</button></div>
     <div class="desc" id="verify-desc">提交后由服务商审核微信特约商户收款账户; 审核通过后自动发放 100 TCT 引导金 (无需重复提交)</div>
     <div class="hintbox" id="verify-msg"></div>
     <div class="ops noprint"><button class="sbtn" id="btn-apply-toggle" onclick="toggleApplyForm()">填写进件资料并上传证件</button></div>
@@ -351,7 +364,7 @@ function renderProgress(s){
   //   其余 → 引导提交
   var vs=s.verification||{submitted:false,status:'none'};
   var qat=vs.queried_at?(' · 查询于 '+new Date(vs.queried_at*1000).toLocaleTimeString()):'';
-  var chainTxt=vs.raw_status?('链上状态 '+vs.raw_status):'链上状态未知';
+  var chainTxt=vs.raw_status?('审核状态 '+vs.raw_status):'审核状态未知';
   var vStep=document.getElementById('st-verification');
   var ap=s.applyment||null;
   var apDone=!!(ap&&ap.done);
@@ -359,11 +372,10 @@ function renderProgress(s){
   var applyForm=document.getElementById('apply-form');
   if(apDone){
     vStep.className='step done'; vStep.querySelector('.mark').textContent='✅';
-    document.getElementById('btn-verify').style.display='none';
     if(applyForm) applyForm.style.display='none';
     document.getElementById('verify-desc').textContent='微信收款进件已完成 (sub_mchid='+(ap.sub_mchid||'')+'), 收款通道就绪'+qat;
   } else if(kycOk){
-    document.getElementById('verify-desc').textContent='链上身份认证已过 ✅ · 微信收款进件未完成 — 请填写下方进件资料, 微信审核通过后收款通道才开通'+qat;
+    document.getElementById('verify-desc').textContent='身份认证已通过 ✅ · 微信收款进件未完成 — 请填写下方进件资料, 微信审核通过后收款通道才开通'+qat;
   } else if(vs.submitted){
     document.getElementById('verify-desc').textContent='实名已提交, 等待服务商审核 ('+chainTxt+qat+')';
   } else {
@@ -646,22 +658,33 @@ function markStepDone(id){
   var el=document.getElementById(id);
   if(el){el.className='step done';var m=el.querySelector('.mark');if(m)m.textContent='✅'}
 }
-async function submitVerification(){
-  var btn=document.getElementById('btn-verify');btn.disabled=true;btn.textContent='提交中...';
-  var msg=document.getElementById('verify-msg');
+// 服务商名片卡 (2026-10-03): /api/onboard/sp-info 代理 SP 网关公开名片; 离线降级灰色态
+function escHtml(s){return String(s||'').replace(/&/g,'&amp;').replace(/</g,'&lt;').replace(/>/g,'&gt;').replace(/"/g,'&quot;')}
+async function loadSpInfo(){
+  var card=document.getElementById('spcard');
+  if(!card) return;
   try{
-    var j=await readJson(await fetch('/onboard/submit-verification',{method:'POST',headers:{'Content-Type':'application/json'},body:'{}'}));
-    if(j.ok){
-      msg.style.display='block';msg.textContent='✅ 实名已提交, 等待服务商审核, 通过后自动发放引导金'+(j.duplicate?' (此前已提交过, 幂等忽略'+(j.txhash?', tx '+String(j.txhash).slice(0,12)+'…':'')+')':'');
-      loadStatus(); // 立刻拉一次链上状态, 不等 15s 轮询
-    } else if(j.error==='module_not_live'){
-      msg.style.display='block';msg.textContent='ℹ️ '+(j.message||'链上实名模块未上线')+' — 自动通道将在集群升级后开放, 当前请由服务商协助办理微信特约商户认证';
-    } else {
-      msg.style.display='block';msg.textContent='提交失败: '+(j.message||j.error||'未知错误');
-    }
-  }catch(e){msg.style.display='block';msg.textContent='提交失败: 服务暂时不可用，请刷新重试 ('+e.message+')'}
-  btn.disabled=false;btn.textContent='提交实名认证';
+    var j=await readJson(await fetch('/api/onboard/sp-info'));
+    if(!j||!j.name) return;
+    card.style.display='block';
+    card.classList.toggle('offline', !!j.offline);
+    document.getElementById('sp-name').textContent=j.offline&&!j.stale?'服务商暂时不可达':j.name;
+    var rb=document.getElementById('sp-rate');
+    if(j.rate_pct){rb.style.display='';rb.textContent='抽佣 '+j.rate_pct;}else{rb.style.display='none';}
+    document.getElementById('sp-desc').textContent=j.offline&&!j.stale
+      ?'资料仍可填写，提交时会加密暂存本机，服务商恢复后可重试'
+      :(j.desc||'');
+    var foot=[];
+    if(j.official_url) foot.push('<a href="'+escHtml(j.official_url)+'" target="_blank">官网</a>');
+    if(j.contact) foot.push('客服: '+escHtml(j.contact));
+    if(j.chain_address) foot.push('服务商账号: <span style="font-family:Consolas,monospace;font-size:11px">'+escHtml(j.chain_address)+'</span>');
+    // 迁移保障 (核心卖点, 必须写; 面向商户禁用"链上"术语, 用大白话)
+    foot.push('服务商由你安装时选定，可随时更换 (你的资产保存在你自己的电脑上，不被锁定)');
+    if(j.offline&&j.stale) foot.push('当前离线, 展示缓存信息');
+    document.getElementById('sp-foot').innerHTML=foot.join(' · ');
+  }catch(e){ /* 名片接口挂了就保持隐藏, 不挡入驻主流程 */ }
 }
+window.addEventListener('load',loadSpInfo);
 async function loadStatus(){
   var meta=document.getElementById('status-meta');
   try{
@@ -685,7 +708,10 @@ async function submit(){
     document.getElementById('r-addr').textContent=j.tb_address;
     document.getElementById('result').style.display='block';
     document.getElementById('status').className='status-ok';
-    document.getElementById('status').textContent='✅ 卖家身份已生成 (密钥已保存在本机 tb-keyring/)';
+    // 2026-09-26 资产安全: 助记词只在首次创建返回; 已有身份时 j.mnemonic 为空
+    document.getElementById('status').textContent=j.identity_created===false
+      ? '✅ 卖家身份已存在 (助记词仅首次创建时展示过)'
+      : '✅ 卖家身份已生成 (密钥已保存在本机 tb-keyring/)';
     if(j.mnemonic){
       _mn=j.mnemonic;
       var words=j.mnemonic.split(/\s+/);

package/routes/onboard.js

@@ -211,17 +211,21 @@ function createOnboardRouter(deps) {
             db.prepare("INSERT INTO onboard_merchants (merchant_shortname, mobile_phone, category, tb_address, sub_mchid, created_at) VALUES (?,?,?,?,?,?)")
                 .run(String(b.merchant_shortname), String(b.mobile_phone || ""), String(b.category || ""), identity.address, subMchid, Math.floor(Date.now() / 1000));
             console.log("[onboard] merchant:", b.merchant_shortname, "addr:", identity.address, identity.created ? "(新身份)" : "(已有身份)");
-            // mnemonic 只经本机 localhost 返回给页面展示一次, 勿加进任何日志/远程调用
+            // 助记词只在首次创建身份时返回一次 (2026-09-26 资产安全修复):
+            // 已有身份时绝不回吐 — 本端点无鉴权, 重复调用返助记词 = LAN 任何人可拿走商户资产。
+            // 已有身份后重复提交幂等返回 (不含任何敏感信息)。
             res.json({
                 ok: true,
                 sub_mchid: subMchid,
                 tb_address: identity.address,
-                mnemonic: identity.mnemonic,
+                ...(identity.created ? { mnemonic: identity.mnemonic } : {}),
                 identity_created: identity.created,
                 grant_tct: 100,
                 shop_base_url: shopBaseUrl(req),
-                next_step: "下一步: 上架商品 (进入店铺后台), 或在认证完成后领取 100 TCT 引导金",
-                message: "卖家身份已生成，完成微信认证后发放引导金",
+                next_step: identity.created
+                    ? "下一步: 抄下助记词 (纸密钥), 然后上架商品或完成微信认证领 100 TCT 引导金"
+                    : "身份已存在 (助记词仅创建时展示过一次), 继续入驻流程即可",
+                message: identity.created ? "卖家身份已生成，完成微信认证后发放引导金" : "卖家身份已存在",
             });
         } catch (e) {
             console.error("[onboard] error:", e && e.message);
@@ -537,6 +541,29 @@ CREATE TABLE IF NOT EXISTS onboard_applyments (
         return s.length <= 4 ? "***" : "***" + s.slice(-4);
     }
 
+    /** GET /sp-info — 服务商名片代理 (2026-10-03): fetch SP 网关 /api/sp/info 透传,
+     *  60s 内存缓存 (页面 15s 轮询不刷 SP); SP 不可达 → 200 降级 offline 卡片 (不报错) */
+    let spInfoCache = { at: 0, data: null };
+    router.get("/sp-info", async (req, res) => {
+        const now = Date.now();
+        const ttl = Number(process.env.SP_INFO_CACHE_MS || 60000); // 默认 60s (测试可调)
+        if (spInfoCache.data && now - spInfoCache.at < ttl) return res.json(spInfoCache.data);
+        try {
+            const fetcher = deps.fetcher || globalThis.fetch;
+            const r = await fetcher(spGatewayUrl() + "/api/sp/info", { signal: AbortSignal.timeout(10000) });
+            const j = await r.json().catch(() => null);
+            if (r.ok && j && j.name) {
+                spInfoCache = { at: now, data: j };
+                return res.json(j);
+            }
+            throw new Error("bad_sp_info " + r.status);
+        } catch (e) {
+            // SP 不可达: 降级 offline (200 不报错, 页面显示灰色离线态; 有旧缓存先用旧的)
+            if (spInfoCache.data) return res.json({ ...spInfoCache.data, offline: true, stale: true });
+            return res.json({ name: "服务商暂时不可达", offline: true });
+        }
+    });
+
     /** POST /applyment/upload — 证件照片转发 SP 网关 media/upload (base64 JSON 同款) */
     router.post("/applyment/upload", async (req, res) => {
         try {

package/routes/sp-applyment.js

@@ -581,6 +581,23 @@ function createSpApplymentRouter(deps) {
         return true;
     }
 
+    /** GET /info — 服务商公开名片 (2026-10-03 xiaomu: 卖家入驻页要显示服务商是谁)
+     *  公开只读, 不要 admin key — 名片本来就是给商户看的公开信息 */
+    router.get("/info", (req, res) => {
+        const rateBp = Number(process.env.SP_DEFAULT_COMMISSION_BP || 100); // 默认 1%
+        const bp = Number.isInteger(rateBp) && rateBp >= 0 ? rateBp : 100;
+        res.json({
+            name: process.env.SP_NAME || "TrustBase 官方服务商",
+            desc: process.env.SP_DESC || "",
+            official_url: process.env.SP_OFFICIAL_URL || "",
+            contact: process.env.SP_CONTACT || "",
+            commission_rate_bp: bp,
+            rate_pct: (bp / 100).toFixed(2) + "%",
+            chain_address: process.env.SP_CHAIN_ADDR || "",
+            gateway: String(req.headers.host || ""), // 本网关域名 (从请求 host 推断)
+        });
+    });
+
     /** GET /apply — 手机单页表单 (页面本身不鉴权, API 全部要 key) */
     router.get("/apply", (req, res) => {
         res.setHeader("Content-Type", "text/html; charset=utf-8");

package/test-onboard-applyment.js

@@ -41,11 +41,16 @@ async function startFakeSp() {
     app.use(express.json());
     // 凭证校验 (卖家带 x-sp-admin-key = SP_MERCHANT_TOKEN)
     app.use((req, res, next) => {
+        if (req.path === "/api/sp/info") return next();
         if (req.headers["x-sp-admin-key"] !== MERCHANT_TOKEN) {
             return res.status(401).json({ error: "unauthorized", message: "x-sp-admin-key 无效" });
         }
         next();
     });
+    app.get("/api/sp/info", (req, res) => {
+        spCapture.infoQueries = (spCapture.infoQueries || 0) + 1;
+        res.json({ name: "无锡小播鼠网络科技", desc: "TrustBase 官方支付服务商", commission_rate_bp: 100, rate_pct: "1.00%", gateway: "fake-sp" });
+    });
     app.post("/api/sp/applyment/upload", (req, res) => {
         spCapture.uploads.push(req.body);
         res.json({ media_id: "FAKE_MEDIA_" + crypto.randomBytes(6).toString("hex") });
@@ -521,3 +526,41 @@ test("F4: 企业主体 id_card_address 必填 + 本机加密 + SP 组装进 id_c
         assert.ok(!("id_card_address" in wxBodyInd.subject_info.identity_info.id_card_info), "个体户无 id_card_address");
     } finally { srv.close(); }
 });
+
+test("sp-info 代理: 透传 SP 名片 + 60s 缓存 + SP 不可达降级", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        // 透传
+        let j = await (await fetch(base + "/api/onboard/sp-info")).json();
+        assert.strictEqual(j.name, "无锡小播鼠网络科技");
+        assert.strictEqual(j.rate_pct, "1.00%");
+        const q1 = spCapture.infoQueries;
+        // 缓存: 第二次不打 SP
+        j = await (await fetch(base + "/api/onboard/sp-info")).json();
+        assert.strictEqual(spCapture.infoQueries, q1, "60s 缓存生效, 不重复打 SP");
+        // SP 挂了: 缓存已过期 (测试把 TTL 调成 1ms) → offline+stale 展示缓存
+        process.env.SP_INFO_CACHE_MS = "1";
+        await new Promise((r) => setTimeout(r, 5));
+        process.env.SP_GATEWAY_URL = "http://127.0.0.1:1";
+        j = await (await fetch(base + "/api/onboard/sp-info")).json();
+        assert.strictEqual(j.offline, true);
+        assert.strictEqual(j.stale, true);
+        assert.strictEqual(j.name, "无锡小播鼠网络科技", "stale 缓存仍给名字");
+    } finally { srv.close(); process.env.SP_GATEWAY_URL = spBase; delete process.env.SP_INFO_CACHE_MS; }
+});
+
+test("sp-info 代理: 全新实例 SP 不可达 → 200 降级 offline (不报错)", async () => {
+    process.env.SP_GATEWAY_URL = "http://127.0.0.1:1";
+    const { srv, base } = await startSeller();
+    try {
+        const r = await fetch(base + "/api/onboard/sp-info");
+        const j = await r.json();
+        assert.strictEqual(r.status, 200, "降级不报错");
+        assert.strictEqual(j.offline, true);
+        assert.ok(j.name.includes("不可达"), j.name);
+        // 页面含服务商卡片元素
+        const html = await (await fetch(base + "/onboard/")).text();
+        assert.ok(html.includes("spcard") && html.includes("sp-info"), "服务商卡片 + 数据源");
+        assert.ok(html.includes("可随时更换"), "迁移保障卖点文案");
+    } finally { srv.close(); process.env.SP_GATEWAY_URL = spBase; }
+});

package/test-sp-applyment.js

@@ -219,6 +219,38 @@ test("status 查询 mock: FINISHED + sign_url + sub_mchid, 台账同步", async
     } finally { srv.close(); }
 });
 
+test("GET /api/sp/info 公开名片: 无 admin key 200 + env 覆盖生效", async () => {
+    const { srv, base } = await startServer();
+    try {
+        // 默认 (无 key 也要 200 — 名片是公开信息)
+        let r = await fetch(base + "/api/sp/info");
+        let j = await r.json();
+        assert.strictEqual(r.status, 200, "公开端点不要 admin key");
+        assert.strictEqual(j.name, "TrustBase 官方服务商");
+        assert.strictEqual(j.commission_rate_bp, 100, "默认 1%");
+        assert.strictEqual(j.rate_pct, "1.00%");
+        assert.ok(j.gateway.includes("127.0.0.1"), "gateway 从 req host 推断");
+        // env 覆盖
+        process.env.SP_NAME = "无锡小播鼠网络科技";
+        process.env.SP_DESC = "TrustBase 官方支付服务商";
+        process.env.SP_OFFICIAL_URL = "https://trustbase.example.com";
+        process.env.SP_CONTACT = "微信: xiaomu";
+        process.env.SP_DEFAULT_COMMISSION_BP = "150";
+        process.env.SP_CHAIN_ADDR = "tct1zg7wa9v2gkwp3yvmxrjlmwgfu0tw9vwcuhwwg7";
+        r = await fetch(base + "/api/sp/info");
+        j = await r.json();
+        assert.strictEqual(j.name, "无锡小播鼠网络科技");
+        assert.strictEqual(j.contact, "微信: xiaomu");
+        assert.strictEqual(j.commission_rate_bp, 150);
+        assert.strictEqual(j.rate_pct, "1.50%");
+        assert.strictEqual(j.chain_address, "tct1zg7wa9v2gkwp3yvmxrjlmwgfu0tw9vwcuhwwg7");
+    } finally {
+        srv.close();
+        delete process.env.SP_NAME; delete process.env.SP_DESC; delete process.env.SP_OFFICIAL_URL;
+        delete process.env.SP_CONTACT; delete process.env.SP_DEFAULT_COMMISSION_BP; delete process.env.SP_CHAIN_ADDR;
+    }
+});
+
 test("business_code 直通: 调用方带号 (卖家侧生成) → SP 不新生成; REJECTED 同号重提", async () => {
     const { db, srv, base } = await startServer();
     try {