trustbase-seller-backend 0.2.5 → 0.2.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/package.json +1 -1
  2. package/payments/wechat/profitsharing.js +10 -6
  3. package/routes/onboard.html +126 -16
  4. package/routes/onboard.js +133 -2
  5. package/test-onboard-backup.js +198 -0
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "trustbase-seller-backend",
3
- "version": "0.2.5",
3
+ "version": "0.2.6",
4
4
  "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
5
5
  "main": "run-unified.js",
6
6
  "bin": {
package/payments/wechat/profitsharing.js CHANGED
@@ -107,15 +107,19 @@ async function addReceivers(receivers) {
107
107
  return results.length === 1 ? results[0] : results;
108
108
  }
109
109
 
110
- /** 接收方名称加密: 微信支付公钥 RSA-OAEP-SHA256 → base64 (与进件敏感字段同口径) */
110
+ /** 接收方名称加密: 微信支付公钥 RSA-OAEP → base64。
111
+ * ⚠️ 2026-09-26 实测坑: 微信"OAEPWithSHA-256AndMGF1Padding"是 Java 语义 — MGF1 实际用 SHA-1。
112
+ * Node crypto.publicEncrypt 的 oaepHash 会把 OAEP+MGF1 都设成同一 hash → 微信"平台私钥解密失败"。
113
+ * 必须用 openssl 子进程分开指定 (rsa_oaep_md:sha256 + rsa_mgf1_md:sha1)。 */
111
114
  function encryptReceiverName(name) {
112
115
  const p = process.env.WXPAY_SP_PUBLIC_KEY_PATH || process.env.WXPAY_PUBLIC_KEY_PATH;
113
116
  if (!p) throw new Error("WXPAY_(SP_)PUBLIC_KEY_PATH 未配置, 接收方名称无法加密");
114
- const pem = require("fs").readFileSync(p, "utf8");
115
- return crypto.publicEncrypt(
116
- { key: pem, padding: crypto.constants.RSA_PKCS1_OAEP_PADDING, oaepHash: "sha256" },
117
- Buffer.from(name, "utf8")
118
- ).toString("base64");
117
+ const { execSync } = require("child_process");
118
+ const b64 = execSync(
119
+ `openssl pkeyutl -encrypt -pubin -inkey ${JSON.stringify(p)} -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 -pkeyopt rsa_mgf1_md:sha1 | base64 -w0`,
120
+ { input: Buffer.from(name, "utf8"), maxBuffer: 1024 * 1024 }
121
+ ).toString("utf8").trim();
122
+ return b64;
119
123
  }
120
124
 
121
125
  /** 请求分账
package/routes/onboard.html CHANGED
@@ -122,7 +122,7 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
122
122
  <body>
123
123
  <div class="wrap">
124
124
  <h1>TrustBase 商家入驻</h1>
125
- <p class="sub">在你的电脑上完成入驻，密钥永不出门</p>
125
+ <p class="sub">在你的电脑上完成入驻，安全词永不出门</p>
126
126
 
127
127
  <div class="spcard" id="spcard" style="display:none">
128
128
  <div class="spcard-h"><span>🏪</span><span id="sp-name" style="font-weight:600">服务商</span><span class="spbadge" id="sp-rate" style="display:none"></span></div>
@@ -134,14 +134,25 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
134
134
  <h3>入驻进度 <span id="status-meta" style="font-size:12px;color:#8A857B;font-weight:400"></span><button class="sbtn noprint" style="float:right;margin-top:-2px" onclick="loadStatus()">刷新状态</button></h3>
135
135
  <div class="step done" id="st-identity">
136
136
  <span class="mark">✅</span>
137
- <div class="body">① 卖家身份 <span id="p-addr" style="font-family:Consolas,monospace;font-size:12px"></span><div class="desc">密钥只保存在这台电脑</div></div>
137
+ <div class="body">① 卖家身份 <span id="p-addr" style="font-family:Consolas,monospace;font-size:12px"></span><div class="desc">安全卡只保存在这台电脑</div></div>
138
138
  </div>
139
139
  <div class="step" id="st-backup">
140
140
  <span class="mark">⬜</span>
141
- <div class="body">② 备份纸密钥
142
- <div class="ops"><button class="sbtn" onclick="reprintKey()">重新打印纸密钥</button><button class="sbtn" onclick="var h=document.getElementById('hint-recover');h.style.display=h.style.display==='block'?'none':'block'">如何恢复身份</button></div>
143
- <div class="hintbox" id="hint-reprint">出于安全，助记词只在生成时在本页展示一次。<br>重新打印请在你的电脑上运行: <code>npx @trustbase/shopxo-init print-key</code></div>
144
- <div class="hintbox" id="hint-recover">丢了/换电脑: 重新安装后把纸上的助记词存入 seller-backend/tb-keyring/mnemonic.txt 即可恢复身份; 店铺数据用安装器的 restore 命令从备份包恢复。</div>
141
+ <div class="body">② 备份店铺安全卡
142
+ <div class="desc">安全卡 = 店铺的全部资产钥匙。丢了它且电脑坏了，谁也找不回 (服务商也不行)。请抄写或打印收好。</div>
143
+ <div class="ops"><button class="sbtn" onclick="reprintKey()">重新打印安全卡</button><button class="sbtn" onclick="var h=document.getElementById('hint-recover');h.style.display=h.style.display==='block'?'none':'block'">如何恢复店铺</button><button class="sbtn primary" onclick="startBackupVerify()">我已抄好, 验证备份</button></div>
144
+ <div class="hintbox" id="hint-reprint">出于安全，24 个安全词只在生成时在本页展示一次。<br>重新打印请在你的电脑上运行: <code>npx @trustbase/shopxo-init print-key</code></div>
145
+ <div class="hintbox" id="hint-recover">丢了/换电脑，在新机器的入驻页恢复店铺，两种方式:<br>① 扫码: 用手机相机扫安全卡上的二维码，屏幕上会显示 24 个安全词;<br>② 手填: 把安全卡上的 24 个安全词按顺序填到下面。<br>
146
+ <textarea id="restore-words" rows="3" placeholder="24 个安全词, 按顺序, 空格分隔" style="width:100%;margin-top:8px;padding:10px 12px;border:1px solid #D4CDBF;border-radius:8px;font-size:14px"></textarea>
147
+ <button class="sbtn primary" style="margin-top:6px" onclick="restoreIdentity()">恢复店铺</button>
148
+ <div id="restore-msg" style="font-size:13px;margin-top:6px"></div>
149
+ </div>
150
+ <div id="backup-quiz" style="display:none;margin-top:10px;background:#FCFAF4;border:1px solid #EAE3D6;border-radius:12px;padding:14px 16px">
151
+ <div class="desc" style="margin-bottom:4px">确认你真的抄好了 — 请按安全卡上抄写的填写 (答错不会提示正确答案, 可重新抽题):</div>
152
+ <div id="backup-questions"></div>
153
+ <button class="sbtn primary" style="margin-top:10px" onclick="checkBackupVerify()">提交验证</button>
154
+ </div>
155
+ <div id="backup-result"></div>
145
156
  </div>
146
157
  </div>
147
158
  <div class="step" id="st-verification">
@@ -315,16 +326,19 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
315
326
 
316
327
  <div class="keybox" id="keybox">
317
328
  <div id="print-area">
318
- <h3>你的卖家密钥 (这张纸 = 店铺的全部所有权)</h3>
329
+ <h3>你的店铺安全卡 (这张卡 = 店铺的全部资产钥匙)</h3>
319
330
  <div class="warn">
320
- <b>请立即用笔抄写到纸上, 抄两份, 分开放好 (防火防水)。</b><br>
321
- 不要拍照、不要截图、不要发到微信/网盘。谁拿到这串词, 谁就能拿走店铺和里面的资产。
331
+ <b>请立即用笔把 24 个安全词抄写到纸上, 抄两份, 分开放好 (防火防水)。</b><br>
332
+ 不要拍照、不要截图、不要发到微信/网盘。谁拿到这 24 个词, 谁就能拿走店铺和里面的资产。
322
333
  </div>
334
+ <div id="qr-slot" style="text-align:center;margin:10px 0"><img id="qr-img" alt="安全卡二维码" style="width:190px;height:190px;display:none;margin:0 auto;border:1px solid #EAE3D6;border-radius:8px"><div style="font-size:11px;color:#8A857B;margin-top:4px">换新电脑时, 手机相机扫这个码可读出 24 个安全词</div></div>
323
335
  <div class="mn-grid" id="mn-grid"></div>
324
336
  <div class="mn-addr" id="mn-addr"></div>
325
- <div style="font-size:12px;color:#6B655B">丢了/换电脑: 重新安装后用这串助记词恢复身份 (导入 seller-backend/tb-keyring/mnemonic.txt), 或用安装器的 restore 命令恢复。</div>
337
+ <div style="font-size:12px;color:#6B655B">丢了/换电脑: 新机器上点第②步"如何恢复店铺", 扫码或手填 24 个安全词即可找回店铺。</div>
338
+ <div style="font-size:11px;color:#8A857B;margin-top:6px">打印日期: <span id="print-date"></span></div>
326
339
  </div>
327
- <button class="btn noprint" onclick="window.print()">🖨 打印纸密钥</button>
340
+ <button class="btn noprint" onclick="window.print()">🖨 打印安全卡</button>
341
+ <button class="sbtn primary noprint" style="margin-left:8px" onclick="startBackupVerify()">我已抄好, 去验证 →</button>
328
342
  <span class="noprint" style="font-size:12px;color:#8A857B;margin-left:10px">打印后请关闭本页; 正式打印通道: 安装器 print-key 命令</span>
329
343
  </div>
330
344
  </div>
@@ -386,7 +400,7 @@ function renderProgress(s){
386
400
  if(meta){
387
401
  var bits=[];
388
402
  if(s.status_queried_at) bits.push('状态更新于 '+new Date(s.status_queried_at*1000).toLocaleTimeString()+' (每 15 秒自动刷新)');
389
- if(s.sign_mode) bits.push('签名通道 '+s.sign_mode+(s.mnemonic_present?'':' · 未找到本机密钥'));
403
+ if(s.sign_mode) bits.push('签名通道 '+s.sign_mode+(s.mnemonic_present?'':' · 未找到本机安全卡'));
390
404
  if(s.keyring_dir) bits.push('密钥目录 '+s.keyring_dir);
391
405
  meta.textContent=bits.join(' · ');
392
406
  }
@@ -399,8 +413,70 @@ function renderProgress(s){
399
413
  } else if(g.status==='approved_pending_disburse'){
400
414
  document.getElementById('grant-desc').textContent='认证已通过, 等待发放 (自动)';
401
415
  }
402
- // 当前可做项高亮
403
- document.getElementById('st-backup').className='step current';
416
+ // 当前可做项高亮 (备份验证已过 → 持久打勾 (后端 tb_backup_ack 台账); 否则标当前可做)
417
+ if(s.backup_acked){ markStepDone('st-backup'); } else { document.getElementById('st-backup').className='step current'; }
418
+ }
419
+ // ---- 纸密钥备份回填验证 (2026-10-03, MetaMask 式抽词; 原则: mnemonic 不出本机) ----
420
+ // 首次创建 (助记词还在页面内存 _mn) → 纯前端比对, 不调网络;
421
+ // 页面刷新后 → POST /api/onboard/verify-backup 本机后端比对 (只送位置+词, 后端永不返回正确词)。
422
+ var _bqTries=0;
423
+ function startBackupVerify(){
424
+ // 随机抽 3 个词位 (1-24 不重复, 升序展示)
425
+ var pool=[]; for(var i=1;i<=24;i++) pool.push(i);
426
+ var pos=[];
427
+ while(pos.length<3){ pos.push(pool.splice(Math.floor(Math.random()*pool.length),1)[0]); }
428
+ pos.sort(function(a,b){return a-b;});
429
+ var q=document.getElementById('backup-questions');
430
+ q.innerHTML=pos.map(function(p){
431
+ return '<label style="display:block;font-size:13px;color:#6B655B;margin:8px 0 4px">请按安全卡上抄写的填写第 '+p+' 个词</label>'
432
+ +'<input class="bq-word" data-pos="'+p+'" placeholder="第 '+p+' 个词" autocapitalize="off" autocomplete="off" spellcheck="false" style="width:100%;padding:10px 12px;border:1px solid #D4CDBF;border-radius:8px;font-size:15px;background:#fff">';
433
+ }).join('');
434
+ document.getElementById('backup-result').innerHTML='';
435
+ var box=document.getElementById('backup-quiz');
436
+ box.style.display='block';
437
+ box.scrollIntoView({behavior:'smooth',block:'center'});
438
+ }
439
+ async function checkBackupVerify(){
440
+ var inputs=document.querySelectorAll('.bq-word');
441
+ var positions=[], words=[];
442
+ inputs.forEach(function(el){ positions.push(Number(el.getAttribute('data-pos'))); words.push(el.value); });
443
+ if(words.some(function(w){return !w.trim();})) return backupResult(false,'三个词都要填');
444
+ // ① 内存路径: 助记词还在 (_mn) → 纯前端比对 (更快, 零网络)
445
+ if(_mn){
446
+ var real=_mn.split(/\s+/);
447
+ var wrong=[];
448
+ positions.forEach(function(p,i){ if(words[i].trim().toLowerCase()!==real[p-1].toLowerCase()) wrong.push(p); });
449
+ if(!wrong.length){ await persistBackupAck(); return backupOk(); }
450
+ return backupWrong(wrong);
451
+ }
452
+ // ② 后端路径: 刷新后内存没有 → 本机后端比对 (mnemonic 不出本机)
453
+ try{
454
+ var j=await readJson(await fetch('/api/onboard/verify-backup',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({positions:positions,words:words})}));
455
+ if(j.ok) return backupOk();
456
+ if(j.error==='rate_limited') return backupResult(false, j.message||'30 秒内只能验证一次, 请稍后再试');
457
+ if(j.wrong_positions&&j.wrong_positions.length) return backupWrong(j.wrong_positions);
458
+ backupResult(false, j.message||'验证失败, 请稍后再试');
459
+ }catch(e){ backupResult(false,'服务暂时不可用，请刷新重试 ('+e.message+')'); }
460
+ }
461
+ async function persistBackupAck(){
462
+ try{ await fetch('/api/onboard/backup-ack',{method:'POST',headers:{'Content-Type':'application/json'},body:'{}'}); }catch(e){}
463
+ }
464
+ function backupOk(){
465
+ document.getElementById('backup-quiz').style.display='none';
466
+ markStepDone('st-backup'); // 步骤②打勾 (后端台账已持久化, 换浏览器仍绿)
467
+ backupResult(true,'✅ 备份已确认 — 你的店铺安全卡只有这一份, 请收好');
468
+ _bqTries=0;
469
+ }
470
+ function backupWrong(wrong){
471
+ _bqTries++;
472
+ var tip='⚠️ 第 '+wrong.join('、')+' 个词不对 — 请对照安全卡检查 (不会提示正确答案), 已重新抽题';
473
+ if(_bqTries>=3) tip='⚠️ 第 '+wrong.join('、')+' 个词不对; 已错 3 次, 建议点上方"重新打印安全卡"逐词对照后再试';
474
+ startBackupVerify(); // 重新抽题
475
+ backupResult(false, tip);
476
+ }
477
+ function backupResult(ok, text){
478
+ document.getElementById('backup-result').innerHTML=
479
+ '<div style="'+(ok?'background:#F0FDF4;border:1px solid #BBF7D0;color:#166534':'background:#FEF2F2;border:1px solid #FCA5A5;border-left:4px solid #DC2626;color:#991B1B')+';border-radius:10px;padding:10px 14px;font-size:13px;margin-top:8px;line-height:1.8">'+escHtml(text)+'</div>';
404
480
  }
405
481
  function reprintKey(){
406
482
  if(_mn){
@@ -733,19 +809,53 @@ async function submit(){
733
809
  document.getElementById('status').className='status-ok';
734
810
  // 2026-09-26 资产安全: 助记词只在首次创建返回; 已有身份时 j.mnemonic 为空
735
811
  document.getElementById('status').textContent=j.identity_created===false
736
- ? '✅ 卖家身份已存在 (助记词仅首次创建时展示过)'
737
- : '✅ 卖家身份已生成 (密钥已保存在本机 tb-keyring/)';
812
+ ? '✅ 卖家身份已存在 (安全词仅首次创建时展示过)'
813
+ : '✅ 卖家身份已生成 (安全卡已保存在本机)';
738
814
  if(j.mnemonic){
739
815
  _mn=j.mnemonic;
740
816
  var words=j.mnemonic.split(/\s+/);
741
817
  document.getElementById('mn-grid').innerHTML=words.map(function(w,i){return '<div class="mn-word"><span class="n">'+(i+1)+'</span>'+w+'</div>'}).join('');
742
818
  document.getElementById('mn-addr').textContent=j.tb_address;
819
+ document.getElementById('print-date').textContent=new Date().toLocaleDateString('zh-CN');
743
820
  document.getElementById('keybox').style.display='block';
821
+ loadBackupQr(); // 安全卡二维码 (本机 localhost 生成, 不走任何网络)
744
822
  document.getElementById('keybox').scrollIntoView({behavior:'smooth'});
745
823
  }
746
824
  loadStatus(); // 刷新进度面板
747
825
  }catch(e){alert('网络错误: '+e.message);btn.disabled=false}
748
826
  }
827
+ // 安全卡二维码: 本机后端读 tb-keyring 出 dataURL (qrcode 包无浏览器 build, 且安全词不进 script 依赖链);
828
+ // 只在创建会话 (_mn 在内存) 拉取 — 刷新后不再展示 (与"安全词只展示一次"同口径)
829
+ async function loadBackupQr(){
830
+ if(!_mn) return;
831
+ try{
832
+ var j=await readJson(await fetch('/api/onboard/backup-qrcode'));
833
+ if(j&&j.ok&&j.data_url){
834
+ var img=document.getElementById('qr-img');
835
+ img.src=j.data_url; img.style.display='block';
836
+ }
837
+ }catch(e){ /* 二维码失败不挡安全卡展示 */ }
838
+ }
839
+ // 恢复店铺 (换新电脑): 手填 24 安全词 → 本机后端写入 tb-keyring + 派生地址
840
+ async function restoreIdentity(){
841
+ var ta=document.getElementById('restore-words');
842
+ var msg=document.getElementById('restore-msg');
843
+ var mn=(ta.value||'').trim();
844
+ if(!mn){ msg.style.color='#DC2626'; msg.textContent='请先填写 24 个安全词'; return; }
845
+ msg.style.color=''; msg.textContent='恢复中...';
846
+ try{
847
+ var j=await readJson(await fetch('/api/onboard/restore-identity',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({mnemonic:mn})}));
848
+ if(j.ok){
849
+ msg.style.color='#16A34A';
850
+ msg.textContent='✅ 店铺已恢复 ('+j.tb_address+'), 正在刷新...';
851
+ ta.value=''; // 用完即清, 安全词不留页面
852
+ loadStatus();
853
+ }else{
854
+ msg.style.color='#DC2626';
855
+ msg.textContent=j.message||'恢复失败';
856
+ }
857
+ }catch(e){ msg.style.color='#DC2626'; msg.textContent='服务暂时不可用: '+e.message; }
858
+ }
749
859
  </script>
750
860
  <script>
751
861
  /* ===== ③ 进件表单 美化增强 (2026-10-03) —— 纯追加脚本: 不修改/不覆盖任何现有函数,
package/routes/onboard.js CHANGED
@@ -26,7 +26,7 @@
26
26
  const fs = require("fs");
27
27
  const path = require("path");
28
28
  const crypto = require("crypto");
29
- const { ensureSellerIdentity } = require("../core/seller-identity");
29
+ const { ensureSellerIdentity, readSellerIdentity } = require("../core/seller-identity");
30
30
  const basePaths = require("../core/paths");
31
31
  const { isTctAddress } = require("../core/address");
32
32
  const chainWrites = require("./chain-writes");
@@ -163,10 +163,13 @@ function createOnboardRouter(deps) {
163
163
  // 签名通道现状: 页面/客服诊断用 (只回路径与模式, 绝不回助记词/私钥)
164
164
  let signMode = null;
165
165
  try { signMode = chainWrites.signModeInfo(); } catch (_) { signMode = null; }
166
+ let backupOk = false;
167
+ try { backupOk = !!db.prepare("SELECT acked_at FROM tb_backup_ack WHERE id=1").get(); } catch (_) { backupOk = false; }
166
168
  res.json({
167
169
  ok: true,
168
170
  identity_created: !!tbAddress,
169
171
  tb_address: tbAddress,
172
+ backup_acked: backupOk, // 纸密钥备份验证标记 (tb_backup_ack 台账, 换浏览器仍绿)
170
173
  shop_name: shop ? shop.merchant_shortname : null,
171
174
  sub_mchid: (applyment && applyment.sub_mchid) || (shop ? shop.sub_mchid : "none"),
172
175
  verification,
@@ -188,7 +191,7 @@ function createOnboardRouter(deps) {
188
191
  shop_admin_user: (process.env.SHOP_ADMIN_USER || "admin").trim(), // 密码绝不进 API
189
192
  steps: [
190
193
  { key: "identity", label: "卖家身份", done: !!tbAddress },
191
- { key: "backup", label: "备份纸密钥", done: null },
194
+ { key: "backup", label: "备份店铺安全卡", done: backupOk },
192
195
  { key: "verification", label: "微信收款认证", done: applymentDone, kyc_approved: /approved/i.test(verification.status) },
193
196
  { key: "grant", label: "引导金 100 TCT", done: grant.status === "issued" },
194
197
  { key: "listing", label: "上架商品", done: false },
@@ -459,6 +462,134 @@ function createOnboardRouter(deps) {
459
462
  }
460
463
  });
461
464
 
465
+ // ---------- 纸密钥备份回填验证 (2026-10-03 xiaomu: MetaMask 式抽词验证) ----------
466
+ // 原则: mnemonic 永不出本机 — 页面只送 {positions, words}, 本机后端读 tb-keyring 比对,
467
+ // 永不返回正确词; 限流每 30s 一次 (防在线爆破, 虽然攻击面只是 localhost)。
468
+ // 验证通过 → tb_backup_ack 落标记 (sqlite 单行表), /onboard/status 读它让步骤②持久打勾。
469
+ function ensureBackupAckTable() {
470
+ db.prepare("CREATE TABLE IF NOT EXISTS tb_backup_ack (id INTEGER PRIMARY KEY CHECK(id=1), acked_at INTEGER NOT NULL)").run();
471
+ }
472
+ ensureBackupAckTable();
473
+ function backupAcked() {
474
+ try { return !!db.prepare("SELECT acked_at FROM tb_backup_ack WHERE id=1").get(); } catch (_) { return false; }
475
+ }
476
+ function markBackupAcked() {
477
+ ensureBackupAckTable();
478
+ db.prepare("INSERT INTO tb_backup_ack (id, acked_at) VALUES (1, ?) ON CONFLICT(id) DO UPDATE SET acked_at=excluded.acked_at")
479
+ .run(Math.floor(Date.now() / 1000));
480
+ }
481
+ const backupVerifyRate = new Map(); // ip → last attempt ms (单商户本机场景, 内存即可)
482
+ router.post("/verify-backup", (req, res) => {
483
+ try {
484
+ const b = req.body || {};
485
+ const positions = Array.isArray(b.positions) ? b.positions.map(Number) : [];
486
+ const words = Array.isArray(b.words) ? b.words.map((w) => String(w)) : [];
487
+ // 先参数校验 (烂请求不吃限流额度), 再限流, 最后读密钥
488
+ if (!positions.length || positions.length !== words.length || positions.length > 5) {
489
+ return res.status(400).json({ ok: false, error: "invalid_param", message: "positions/words 必填且等长 (≤5 个)" });
490
+ }
491
+ if (positions.some((p) => !Number.isInteger(p) || p < 1 || p > 24)) {
492
+ return res.status(400).json({ ok: false, error: "invalid_param", message: "positions 必须是 1-24 的整数" });
493
+ }
494
+ const ip = req.ip || "local";
495
+ const last = backupVerifyRate.get(ip) || 0;
496
+ if (Date.now() - last < 30000) {
497
+ return res.status(429).json({ ok: false, error: "rate_limited", message: "30 秒内只能验证一次, 请对照纸密钥稍后再试" });
498
+ }
499
+ backupVerifyRate.set(ip, Date.now());
500
+ let realWords;
501
+ try {
502
+ realWords = fs.readFileSync(basePaths.mnemonicFile(), "utf8").trim().split(/\s+/);
503
+ } catch (e) {
504
+ return res.status(404).json({ ok: false, error: "no_key", message: "本机还没有卖家密钥 (先完成第①步生成身份)" });
505
+ }
506
+ if (realWords.length < 24) {
507
+ return res.status(500).json({ ok: false, error: "key_corrupt", message: "本机密钥文件异常, 请联系服务商" });
508
+ }
509
+ const wrong = [];
510
+ positions.forEach((p, i) => {
511
+ if (String(words[i] || "").trim().toLowerCase() !== realWords[p - 1].toLowerCase()) wrong.push(p);
512
+ });
513
+ if (wrong.length === 0) {
514
+ markBackupAcked();
515
+ console.log("[onboard] 纸密钥备份验证通过 (ack 落台账)");
516
+ return res.json({ ok: true });
517
+ }
518
+ // 不泄答案: 只说哪几个位置错了
519
+ return res.json({ ok: false, wrong_positions: wrong, message: "有词不对, 请对照纸上抄写检查 (不会提示正确答案)" });
520
+ } catch (e) {
521
+ console.error("[onboard] verify-backup error:", e && e.message);
522
+ res.status(500).json({ ok: false, error: "internal", message: String(e && e.message).slice(0, 200) });
523
+ }
524
+ });
525
+ /** 纯前端比对路径 (首次创建安全词还在页面内存, 未过后端验证) 的 ack 落账入口 — 不带任何密钥材料 */
526
+ router.post("/backup-ack", (req, res) => {
527
+ markBackupAcked();
528
+ res.json({ ok: true });
529
+ });
530
+
531
+ // ---------- 安全卡二维码 + 恢复店铺 (2026-10-03 xiaomu: 安全卡打印版式升级) ----------
532
+ /** GET /backup-qrcode — 安全卡二维码 (内容 JSON {v:1,type:'tb-backup',mnemonic} 含 24 安全词)。
533
+ * 只在本机 localhost 生成/展示 (qrcode 包服务端 toDataURL; 该包无浏览器 build, 且安全词
534
+ * 不应进页面 script 依赖链)。页面仅在创建会话 (_mn 在内存) 时拉取展示。 */
535
+ router.get("/backup-qrcode", async (req, res) => {
536
+ try {
537
+ const identity = await readSellerIdentity(basePaths.baseDir()); // 只读不生成
538
+ if (!identity) {
539
+ return res.status(404).json({ ok: false, error: "no_key", message: "本机还没有店铺身份 (先完成第①步)" });
540
+ }
541
+ const { toDataURL } = require("qrcode");
542
+ const dataUrl = await toDataURL(JSON.stringify({ v: 1, type: "tb-backup", mnemonic: identity.mnemonic }), { margin: 1, width: 320 });
543
+ res.json({ ok: true, data_url: dataUrl });
544
+ } catch (e) {
545
+ console.error("[onboard] backup-qrcode error:", e && e.message);
546
+ res.status(500).json({ ok: false, error: "internal", message: String(e && e.message).slice(0, 200) });
547
+ }
548
+ });
549
+
550
+ /** POST /restore-identity {mnemonic} — 恢复店铺 (换新电脑): 24 安全词写 tb-keyring/mnemonic.txt
551
+ * (0600) + 派生地址。已有身份 → 409 (防覆盖); BIP39 校验位不过 → 400; 限流 30s。 */
552
+ const restoreRate = new Map();
553
+ router.post("/restore-identity", async (req, res) => {
554
+ try {
555
+ const mn = String((req.body || {}).mnemonic || "").trim().toLowerCase().replace(/\s+/g, " ");
556
+ const words = mn ? mn.split(" ") : [];
557
+ // 先校验 (烂请求不吃限流额度), 再限流, 最后写盘
558
+ if (words.length !== 24) {
559
+ return res.status(400).json({ ok: false, error: "invalid_mnemonic", message: "请填写完整的 24 个安全词 (空格分隔)" });
560
+ }
561
+ // 已有身份 → 拒 (防覆盖别人的店)
562
+ const existing = await readSellerIdentity(basePaths.baseDir());
563
+ if (existing) {
564
+ return res.status(409).json({ ok: false, error: "identity_exists", message: "这台电脑已有店铺身份 (" + existing.address + "), 不能覆盖。如需换店请先备份再联系服务商" });
565
+ }
566
+ // BIP39 校验位验证 (错词/乱序会拒)
567
+ try {
568
+ const { Bip39, EnglishMnemonic } = require("@cosmjs/crypto");
569
+ Bip39.decode(new EnglishMnemonic(mn));
570
+ } catch (e) {
571
+ return res.status(400).json({ ok: false, error: "invalid_mnemonic", message: "安全词校验不过 (有错词或顺序不对), 请对照安全卡逐词检查" });
572
+ }
573
+ const ip = req.ip || "local";
574
+ const last = restoreRate.get(ip) || 0;
575
+ if (Date.now() - last < 30000) {
576
+ return res.status(429).json({ ok: false, error: "rate_limited", message: "30 秒内只能恢复一次, 请稍后再试" });
577
+ }
578
+ restoreRate.set(ip, Date.now());
579
+ fs.mkdirSync(basePaths.keyringDir(), { recursive: true });
580
+ fs.writeFileSync(basePaths.mnemonicFile(), mn + "\n", { encoding: "utf8", mode: 0o600 });
581
+ // 删旧 address.txt 强制按新安全词重新派生 (restore 场景理论上是全新机器没有它,
582
+ // 但测试/异常残留时必须防"新词配旧地址"的错位身份)
583
+ try { fs.unlinkSync(path.join(basePaths.keyringDir(), "address.txt")); } catch (_) { /* 不存在 */ }
584
+ const identity = await ensureSellerIdentity(basePaths.baseDir()); // 读刚写的安全词 → 派生地址补写 address.txt
585
+ console.log("[onboard] restore-identity 恢复成功 addr:", identity.address);
586
+ res.json({ ok: true, tb_address: identity.address, message: "店铺已恢复, 刷新页面即可看到进度" });
587
+ } catch (e) {
588
+ console.error("[onboard] restore-identity error:", e && e.message);
589
+ res.status(500).json({ ok: false, error: "internal", message: String(e && e.message).slice(0, 200) });
590
+ }
591
+ });
592
+
462
593
  // ---------- 微信特约商户进件 (Stage 2, 2026-10-03 架构纠偏: 卖家本机提交 → SP 网关 → 微信) ----------
463
594
  const spApplyment = require("./sp-applyment");
464
595
  /** 在卖家本机就要加密的敏感字段 (与 sp-applyment buildApplymentBody 加密清单一致;
package/test-onboard-backup.js ADDED
@@ -0,0 +1,198 @@
1
+ "use strict";
2
+ /**
3
+ * test-onboard-backup.js — 纸密钥备份回填验证 (MetaMask 式抽词) 离线单测 (2026-10-03)
4
+ * node --test test-onboard-backup.js
5
+ *
6
+ * 覆盖:
7
+ * POST /api/onboard/verify-backup — 正确词 ok+台账落 ack / 错词 wrong_positions (不泄答案)
8
+ * / 限流 30s / 参数校验 / 无密钥 404
9
+ * POST /api/onboard/backup-ack — 纯前端比对路径的 ack 落账
10
+ * GET /onboard/status — backup_acked + steps[1].done 持久化
11
+ * 安全断言: 任何响应体都不得包含真实助记词内容。
12
+ */
13
+ const test = require("node:test");
14
+ const assert = require("node:assert");
15
+ const fs = require("fs");
16
+ const os = require("os");
17
+ const path = require("path");
18
+ const express = require("express");
19
+ const Database = require("better-sqlite3");
20
+
21
+ // 测试助记词 (24 词, 落临时 tb-keyring — 隔离不碰真机)
22
+ // 必须用合法 BIP39 (EnglishMnemonic 会校验 checksum): 直接复用 seller-identity 测试向量
23
+ const VECTOR_MNEMONIC = "economy stock theory fatal elder harbor betray wasp final emotion task crumble siren bottom lizard educate guess current outdoor pair theory focus wife stone";
24
+ const WORDS = VECTOR_MNEMONIC.split(" ");
25
+ // 恢复测试用助记词: 测试运行时真生成 (合法 BIP39 24 词)
26
+ let RESTORE_MNEMONIC = "";
27
+ const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "backup-verify-test-"));
28
+ fs.mkdirSync(path.join(tmpDir, "tb-keyring"), { recursive: true });
29
+ fs.writeFileSync(path.join(tmpDir, "tb-keyring", "mnemonic.txt"), WORDS.join(" "), { mode: 0o600 });
30
+
31
+ // env 必须在 require 前 (core/paths freeze)
32
+ process.env.TB_BASE_DIR = tmpDir;
33
+
34
+ const onboard = require("./routes/onboard");
35
+
36
+ async function startServer() {
37
+ const db = new Database(":memory:");
38
+ const app = express();
39
+ app.use(express.json());
40
+ const router = onboard.createOnboardRouter({ db });
41
+ app.use("/api/onboard", router);
42
+ app.use("/onboard", router);
43
+ const srv = app.listen(0);
44
+ await new Promise((r) => srv.once("listening", r));
45
+ return { db, srv, base: `http://127.0.0.1:${srv.address().port}` };
46
+ }
47
+
48
+ const H = { "Content-Type": "application/json" };
49
+
50
+ test("verify-backup: 正确词 → ok + ack 落台账 + status 步骤② done 持久化", async () => {
51
+ const { srv, base } = await startServer();
52
+ try {
53
+ const r = await fetch(base + "/api/onboard/verify-backup", {
54
+ method: "POST", headers: H,
55
+ body: JSON.stringify({ positions: [3, 7, 24], words: ["theory", "betray", "stone"] }),
56
+ });
57
+ const j = await r.json();
58
+ assert.strictEqual(r.status, 200);
59
+ assert.strictEqual(j.ok, true, JSON.stringify(j));
60
+ // status: backup_acked + steps[1].done
61
+ const st = await (await fetch(base + "/onboard/status")).json();
62
+ assert.strictEqual(st.backup_acked, true);
63
+ assert.strictEqual(st.steps[1].key, "backup");
64
+ assert.strictEqual(st.steps[1].done, true, "步骤②持久打勾 (换浏览器仍绿)");
65
+ } finally { srv.close(); }
66
+ });
67
+
68
+ test("verify-backup: 错词 → wrong_positions (不泄正确答案) + 大小写/空白容忍", async () => {
69
+ const { srv, base } = await startServer();
70
+ try {
71
+ // 第 3 词故意错 (charlie→wrong), 第 7 词大小写+空白混合也对 (容忍)
72
+ const r = await fetch(base + "/api/onboard/verify-backup", {
73
+ method: "POST", headers: H,
74
+ body: JSON.stringify({ positions: [3, 7, 11], words: ["wrongword", " BETRAY ", "Task"] }),
75
+ });
76
+ const j = await r.json();
77
+ assert.strictEqual(r.status, 200);
78
+ assert.strictEqual(j.ok, false);
79
+ assert.deepStrictEqual(j.wrong_positions, [3], "只报第 3 个错 (7/11 大小写空白容忍)");
80
+ // 不泄答案: 响应体不得含任何真实词
81
+ const raw = JSON.stringify(j);
82
+ for (const w of WORDS) assert.ok(!raw.includes(w), "响应泄露了真实词: " + w);
83
+ } finally { srv.close(); }
84
+ });
85
+
86
+ test("verify-backup: 限流 30s (同 IP 连续两次 → 第二次 429)", async () => {
87
+ const { srv, base } = await startServer();
88
+ try {
89
+ const body = JSON.stringify({ positions: [1, 2, 3], words: ["economy", "stock", "theory"] });
90
+ const r1 = await fetch(base + "/api/onboard/verify-backup", { method: "POST", headers: H, body });
91
+ assert.strictEqual(r1.status, 200);
92
+ const r2 = await fetch(base + "/api/onboard/verify-backup", { method: "POST", headers: H, body });
93
+ assert.strictEqual(r2.status, 429);
94
+ assert.strictEqual((await r2.json()).error, "rate_limited");
95
+ } finally { srv.close(); }
96
+ });
97
+
98
+ test("verify-backup: 参数校验 (空 positions / 越界位置 / 不等长 → 400)", async () => {
99
+ const { srv, base } = await startServer();
100
+ try {
101
+ for (const body of [
102
+ { positions: [], words: [] },
103
+ { positions: [0, 25], words: ["a", "b"] }, // 越界 (1-24)
104
+ { positions: [1, 2], words: ["alpha"] }, // 不等长
105
+ ]) {
106
+ const r = await fetch(base + "/api/onboard/verify-backup", { method: "POST", headers: H, body: JSON.stringify(body) });
107
+ assert.strictEqual(r.status, 400, JSON.stringify(body));
108
+ }
109
+ } finally { srv.close(); }
110
+ });
111
+
112
+ test("backup-ack: 纯前端比对路径落账 (不带密钥材料) + status done", async () => {
113
+ const { srv, base } = await startServer();
114
+ try {
115
+ const r = await fetch(base + "/api/onboard/backup-ack", { method: "POST", headers: H, body: "{}" });
116
+ assert.strictEqual((await r.json()).ok, true);
117
+ const st = await (await fetch(base + "/onboard/status")).json();
118
+ assert.strictEqual(st.backup_acked, true);
119
+ assert.strictEqual(st.steps[1].done, true);
120
+ } finally { srv.close(); }
121
+ });
122
+
123
+ test("页面含备份验证 UI (抽题/提交/结果显示) + 内存路径分支", async () => {
124
+ const { srv, base } = await startServer();
125
+ try {
126
+ const html = await (await fetch(base + "/onboard/")).text();
127
+ assert.ok(html.includes("startBackupVerify"), "抽题入口");
128
+ assert.ok(html.includes("backup-quiz") && html.includes("bq-word"), "回填控件");
129
+ assert.ok(html.includes("/api/onboard/verify-backup"), "后端比对路径");
130
+ assert.ok(html.includes("persistBackupAck"), "内存路径 ack 落账");
131
+ assert.ok(html.includes("我已抄好"), "大白话文案");
132
+ } finally { srv.close(); }
133
+ });
134
+
135
+ // ---- 安全卡二维码 + 恢复店铺 (2026-10-03) ----
136
+ const KEYRING = path.join(tmpDir, "tb-keyring");
137
+
138
+ test("backup-qrcode: 本机出二维码 dataURL (安全词只在 localhost 流转)", async () => {
139
+ const { srv, base } = await startServer();
140
+ try {
141
+ const r = await fetch(base + "/api/onboard/backup-qrcode");
142
+ const j = await r.json();
143
+ assert.strictEqual(r.status, 200);
144
+ assert.ok(j.data_url.startsWith("data:image/png;base64,"), "QR dataURL");
145
+ assert.ok(j.data_url.length > 500, "QR 有内容");
146
+ } finally { srv.close(); }
147
+ });
148
+
149
+ test("restore-identity: 写入+派生地址正确 (测试向量) / 已有身份 409 / 烂词 400", async () => {
150
+ const { srv, base } = await startServer();
151
+ const bak = path.join(KEYRING, "mnemonic.txt.bak");
152
+ try {
153
+ // 已有身份 (模块加载时写的向量助记词) → 409
154
+ let r = await fetch(base + "/api/onboard/restore-identity", { method: "POST", headers: H, body: JSON.stringify({ mnemonic: VECTOR_MNEMONIC }) });
155
+ assert.strictEqual(r.status, 409);
156
+ assert.strictEqual((await r.json()).error, "identity_exists");
157
+ // 词数不对 → 400 (词数校验先于身份检查)
158
+ r = await fetch(base + "/api/onboard/restore-identity", { method: "POST", headers: H, body: JSON.stringify({ mnemonic: "alpha bravo charlie" }) });
159
+ assert.strictEqual(r.status, 400);
160
+ // 挪走现有身份 → 24 个合法词但校验位不过 → 400 (abandon×24 校验位非法;
161
+ // 注意 abandon×23+art 恰是 BIP39 全零熵官方合法向量, 别拿它当反例)
162
+ fs.renameSync(path.join(KEYRING, "mnemonic.txt"), bak);
163
+ r = await fetch(base + "/api/onboard/restore-identity", { method: "POST", headers: H, body: JSON.stringify({ mnemonic: "abandon ".repeat(23) + "abandon" }) });
164
+ assert.strictEqual(r.status, 400);
165
+ // 合法助记词恢复 → 地址与独立派生一致
166
+ RESTORE_MNEMONIC = await require("./core/seller-identity").generateMnemonic();
167
+ r = await fetch(base + "/api/onboard/restore-identity", { method: "POST", headers: H, body: JSON.stringify({ mnemonic: RESTORE_MNEMONIC }) });
168
+ const j = await r.json();
169
+ assert.strictEqual(r.status, 200, JSON.stringify(j));
170
+ const expectAddr = await require("./core/seller-identity").mnemonicToAddress(RESTORE_MNEMONIC);
171
+ assert.strictEqual(j.tb_address, expectAddr, "派生地址与独立派生一致");
172
+ assert.strictEqual(fs.readFileSync(path.join(KEYRING, "mnemonic.txt"), "utf8").trim(), RESTORE_MNEMONIC);
173
+ assert.strictEqual(fs.readFileSync(path.join(KEYRING, "address.txt"), "utf8").trim(), expectAddr, "address.txt 补写");
174
+ } finally {
175
+ // 还原原始测试密钥
176
+ try { fs.unlinkSync(path.join(KEYRING, "mnemonic.txt")); } catch (_) {}
177
+ try { fs.unlinkSync(path.join(KEYRING, "address.txt")); } catch (_) {}
178
+ if (fs.existsSync(bak)) fs.renameSync(bak, path.join(KEYRING, "mnemonic.txt"));
179
+ srv.close();
180
+ }
181
+ });
182
+
183
+ test("页面: 安全卡二维码容器 + 打印日期 + 恢复入口 + 打印样式", async () => {
184
+ const { srv, base } = await startServer();
185
+ try {
186
+ const html = await (await fetch(base + "/onboard/")).text();
187
+ assert.ok(html.includes("qr-slot") && html.includes("qr-img"), "二维码容器");
188
+ assert.ok(html.includes("print-date"), "打印日期");
189
+ assert.ok(html.includes("restore-words") && html.includes("/api/onboard/restore-identity"), "恢复入口");
190
+ assert.ok(html.includes("@media print"), "打印样式");
191
+ assert.ok(html.includes("backup-qrcode"), "QR 数据源");
192
+ // 术语红线: 商户可见文案不再有 助记词/纸密钥 (注释/代码除外)
193
+ const visible = html.replace(/\/\/[^\n]*/g, "").replace(/\/\*[\s\S]*?\*\//g, "");
194
+ assert.ok(!visible.includes("纸密钥"), "残留 纸密钥");
195
+ assert.ok(!visible.includes("助记词"), "残留 助记词");
196
+ assert.ok(html.includes("店铺安全卡") && html.includes("安全词"), "新口径");
197
+ } finally { srv.close(); }
198
+ });