trustbase-seller-backend 0.2.6 → 0.2.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/onboard.html

@@ -148,9 +148,8 @@ img.auprev{display:none;width:100%;max-height:140px;object-fit:cover;border-radi
       <div id="restore-msg" style="font-size:13px;margin-top:6px"></div>
     </div>
     <div id="backup-quiz" style="display:none;margin-top:10px;background:#FCFAF4;border:1px solid #EAE3D6;border-radius:12px;padding:14px 16px">
-      <div class="desc" style="margin-bottom:4px">确认你真的抄好了 — 请按安全卡上抄写的填写 (答错不会提示正确答案, 可重新抽题):</div>
+      <div class="desc" style="margin-bottom:4px">确认你真的抄好了 — 分 3 步, 一次填一个词 (答错不会提示正确答案):</div>
       <div id="backup-questions"></div>
-      <button class="sbtn primary" style="margin-top:10px" onclick="checkBackupVerify()">提交验证</button>
     </div>
     <div id="backup-result"></div>
   </div>
@@ -416,47 +415,74 @@ function renderProgress(s){
   // 当前可做项高亮 (备份验证已过 → 持久打勾 (后端 tb_backup_ack 台账); 否则标当前可做)
   if(s.backup_acked){ markStepDone('st-backup'); } else { document.getElementById('st-backup').className='step current'; }
 }
-// ---- 纸密钥备份回填验证 (2026-10-03, MetaMask 式抽词; 原则: mnemonic 不出本机) ----
-// 首次创建 (助记词还在页面内存 _mn) → 纯前端比对, 不调网络;
-// 页面刷新后 → POST /api/onboard/verify-backup 本机后端比对 (只送位置+词, 后端永不返回正确词)。
-var _bqTries=0;
+// ---- 店铺安全卡回填验证 (2026-10-03, MetaMask 式抽词; 原则: 安全词不出本机) ----
+// 分步式 (xiaomu 拍板): 抽 3 词位, 一次只问一个词, 每步单独验证 (即时反馈, 答错不累积)。
+// 首次创建 (安全词还在页面内存 _mn) → 纯前端比对, 不调网络;
+// 页面刷新后 → POST /api/onboard/verify-backup 单元素 positions (端点 ≤5 支持), 本机后端比对。
+var _bq={positions:[],idx:0,wrong:0};
 function startBackupVerify(){
   // 随机抽 3 个词位 (1-24 不重复, 升序展示)
   var pool=[]; for(var i=1;i<=24;i++) pool.push(i);
   var pos=[];
   while(pos.length<3){ pos.push(pool.splice(Math.floor(Math.random()*pool.length),1)[0]); }
   pos.sort(function(a,b){return a-b;});
-  var q=document.getElementById('backup-questions');
-  q.innerHTML=pos.map(function(p){
-    return '<label style="display:block;font-size:13px;color:#6B655B;margin:8px 0 4px">请按安全卡上抄写的填写第 '+p+' 个词</label>'
-      +'<input class="bq-word" data-pos="'+p+'" placeholder="第 '+p+' 个词" autocapitalize="off" autocomplete="off" spellcheck="false" style="width:100%;padding:10px 12px;border:1px solid #D4CDBF;border-radius:8px;font-size:15px;background:#fff">';
-  }).join('');
+  _bq={positions:pos,idx:0,wrong:0};
   document.getElementById('backup-result').innerHTML='';
-  var box=document.getElementById('backup-quiz');
-  box.style.display='block';
-  box.scrollIntoView({behavior:'smooth',block:'center'});
+  document.getElementById('backup-quiz').style.display='block';
+  renderBqStep();
+}
+function renderBqStep(){
+  var p=_bq.positions[_bq.idx];
+  var q=document.getElementById('backup-questions');
+  q.innerHTML='<div style="font-size:12px;color:#8A857B;margin-bottom:6px">第 '+(_bq.idx+1)+'/3 步</div>'
+    +'<label style="display:block;font-size:13px;color:#6B655B;margin:0 0 4px">请按安全卡上抄写的填写第 '+p+' 个词</label>'
+    +'<input class="bq-word" id="bq-input" data-pos="'+p+'" placeholder="第 '+p+' 个词" autocapitalize="off" autocomplete="off" spellcheck="false" style="width:100%;padding:12px;font-size:16px;border:1px solid #D4CDBF;border-radius:8px;background:#fff">'
+    +'<div style="display:flex;gap:8px;margin-top:10px">'
+    +'<button class="sbtn primary" style="flex:1;padding:12px;font-size:15px" onclick="checkBqStep()">'+(_bq.idx<2?'下一步':'完成验证')+'</button>'
+    +'<button class="sbtn" onclick="startBackupVerify()">返回重抽</button></div>'
+    +(_bq.wrong>=3?'<div style="margin-top:8px"><button class="sbtn" onclick="swapBqPosition()">这个词位填不对? 换一个词位</button></div>':'');
+  var inp=document.getElementById('bq-input');
+  inp.focus();
+  inp.onkeydown=function(e){ if(e.key==='Enter') checkBqStep(); };
 }
-async function checkBackupVerify(){
-  var inputs=document.querySelectorAll('.bq-word');
-  var positions=[], words=[];
-  inputs.forEach(function(el){ positions.push(Number(el.getAttribute('data-pos'))); words.push(el.value); });
-  if(words.some(function(w){return !w.trim();})) return backupResult(false,'三个词都要填');
-  // ① 内存路径: 助记词还在 (_mn) → 纯前端比对 (更快, 零网络)
+async function checkBqStep(){
+  var inp=document.getElementById('bq-input');
+  var w=(inp.value||'').trim();
+  if(!w) return backupResult(false,'请先填写这个词');
+  var p=Number(inp.getAttribute('data-pos'));
+  var correct=false;
+  // ① 内存路径: 安全词还在 (_mn) → 纯前端比对 (更快, 零网络)
   if(_mn){
-    var real=_mn.split(/\s+/);
-    var wrong=[];
-    positions.forEach(function(p,i){ if(words[i].trim().toLowerCase()!==real[p-1].toLowerCase()) wrong.push(p); });
-    if(!wrong.length){ await persistBackupAck(); return backupOk(); }
-    return backupWrong(wrong);
+    correct = _mn.split(/\s+/)[p-1].toLowerCase()===w.toLowerCase();
+  }else{
+    // ② 后端路径: 刷新后内存没有 → 本机后端比对 (安全词不出本机, 只送位置+词)
+    try{
+      var j=await readJson(await fetch('/api/onboard/verify-backup',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({positions:[p],words:[w]})}));
+      if(j.ok) correct=true;
+      else if(j.error==='rate_limited') return backupResult(false, j.message||'操作太频繁, 请稍后再试');
+      else if(j.wrong_positions&&j.wrong_positions.length) correct=false;
+      else return backupResult(false, j.message||'验证失败, 请稍后再试');
+    }catch(e){ return backupResult(false,'服务暂时不可用，请刷新重试 ('+e.message+')'); }
+  }
+  if(correct){
+    _bq.idx++; _bq.wrong=0;
+    document.getElementById('backup-result').innerHTML='';
+    if(_bq.idx>=3){ await persistBackupAck(); return backupOk(); }
+    renderBqStep();
+  }else{
+    _bq.wrong++;
+    backupResult(false,'⚠️ 这个词不对 (不会提示正确答案), 请对照安全卡重新填');
+    if(_bq.wrong>=3) renderBqStep(); // 同一词位错 3 次 → 出现"换一个词位"
+    else { inp.value=''; inp.focus(); }
   }
-  // ② 后端路径: 刷新后内存没有 → 本机后端比对 (mnemonic 不出本机)
-  try{
-    var j=await readJson(await fetch('/api/onboard/verify-backup',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify({positions:positions,words:words})}));
-    if(j.ok) return backupOk();
-    if(j.error==='rate_limited') return backupResult(false, j.message||'30 秒内只能验证一次, 请稍后再试');
-    if(j.wrong_positions&&j.wrong_positions.length) return backupWrong(j.wrong_positions);
-    backupResult(false, j.message||'验证失败, 请稍后再试');
-  }catch(e){ backupResult(false,'服务暂时不可用，请刷新重试 ('+e.message+')'); }
+}
+function swapBqPosition(){
+  // 换掉当前词位 (与其他 2 个不重复), 错次清零
+  var cand;
+  do{ cand=1+Math.floor(Math.random()*24); }while(_bq.positions.indexOf(cand)>=0);
+  _bq.positions[_bq.idx]=cand; _bq.wrong=0;
+  document.getElementById('backup-result').innerHTML='';
+  renderBqStep();
 }
 async function persistBackupAck(){
   try{ await fetch('/api/onboard/backup-ack',{method:'POST',headers:{'Content-Type':'application/json'},body:'{}'}); }catch(e){}
@@ -465,14 +491,7 @@ function backupOk(){
   document.getElementById('backup-quiz').style.display='none';
   markStepDone('st-backup'); // 步骤②打勾 (后端台账已持久化, 换浏览器仍绿)
   backupResult(true,'✅ 备份已确认 — 你的店铺安全卡只有这一份, 请收好');
-  _bqTries=0;
-}
-function backupWrong(wrong){
-  _bqTries++;
-  var tip='⚠️ 第 '+wrong.join('、')+' 个词不对 — 请对照安全卡检查 (不会提示正确答案), 已重新抽题';
-  if(_bqTries>=3) tip='⚠️ 第 '+wrong.join('、')+' 个词不对; 已错 3 次, 建议点上方"重新打印安全卡"逐词对照后再试';
-  startBackupVerify(); // 重新抽题
-  backupResult(false, tip);
+  _bq={positions:[],idx:0,wrong:0};
 }
 function backupResult(ok, text){
   document.getElementById('backup-result').innerHTML=

package/routes/onboard.js

@@ -478,7 +478,7 @@ function createOnboardRouter(deps) {
         db.prepare("INSERT INTO tb_backup_ack (id, acked_at) VALUES (1, ?) ON CONFLICT(id) DO UPDATE SET acked_at=excluded.acked_at")
             .run(Math.floor(Date.now() / 1000));
     }
-    const backupVerifyRate = new Map(); // ip → last attempt ms (单商户本机场景, 内存即可)
+    const backupVerifyRate = new Map(); // ip → 30s 窗口内的尝试时间戳[] (分步式验证一步一调, 6 次/30s 足够 3 步 + 重试)
     router.post("/verify-backup", (req, res) => {
         try {
             const b = req.body || {};
@@ -492,11 +492,13 @@ function createOnboardRouter(deps) {
                 return res.status(400).json({ ok: false, error: "invalid_param", message: "positions 必须是 1-24 的整数" });
             }
             const ip = req.ip || "local";
-            const last = backupVerifyRate.get(ip) || 0;
-            if (Date.now() - last < 30000) {
-                return res.status(429).json({ ok: false, error: "rate_limited", message: "30 秒内只能验证一次, 请对照纸密钥稍后再试" });
+            const nowMs = Date.now();
+            const arr = (backupVerifyRate.get(ip) || []).filter((t) => nowMs - t < 30000);
+            if (arr.length >= 6) {
+                return res.status(429).json({ ok: false, error: "rate_limited", message: "验证太频繁 (30 秒内最多 6 次), 请对照安全卡稍后再试" });
             }
-            backupVerifyRate.set(ip, Date.now());
+            arr.push(nowMs);
+            backupVerifyRate.set(ip, arr);
             let realWords;
             try {
                 realWords = fs.readFileSync(basePaths.mnemonicFile(), "utf8").trim().split(/\s+/);

package/test-onboard-backup.js

@@ -83,15 +83,18 @@ test("verify-backup: 错词 → wrong_positions (不泄正确答案) + 大小写
     } finally { srv.close(); }
 });
 
-test("verify-backup: 限流 30s (同 IP 连续两次 → 第二次 429)", async () => {
+test("verify-backup: 限流滑动窗口 6 次/30s (分步验证一步一调, 3 步+重试够用)", async () => {
     const { srv, base } = await startServer();
     try {
-        const body = JSON.stringify({ positions: [1, 2, 3], words: ["economy", "stock", "theory"] });
-        const r1 = await fetch(base + "/api/onboard/verify-backup", { method: "POST", headers: H, body });
-        assert.strictEqual(r1.status, 200);
-        const r2 = await fetch(base + "/api/onboard/verify-backup", { method: "POST", headers: H, body });
-        assert.strictEqual(r2.status, 429);
-        assert.strictEqual((await r2.json()).error, "rate_limited");
+        // 单元素 positions (分步式每步一词)
+        const body = JSON.stringify({ positions: [1], words: ["economy"] });
+        for (let i = 0; i < 6; i++) {
+            const r = await fetch(base + "/api/onboard/verify-backup", { method: "POST", headers: H, body });
+            assert.strictEqual(r.status, 200, "第 " + (i + 1) + " 次放行");
+        }
+        const r7 = await fetch(base + "/api/onboard/verify-backup", { method: "POST", headers: H, body });
+        assert.strictEqual(r7.status, 429, "第 7 次 (30s 窗口内) 拒");
+        assert.strictEqual((await r7.json()).error, "rate_limited");
     } finally { srv.close(); }
 });
 
@@ -120,7 +123,7 @@ test("backup-ack: 纯前端比对路径落账 (不带密钥材料) + status done
     } finally { srv.close(); }
 });
 
-test("页面含备份验证 UI (抽题/提交/结果显示) + 内存路径分支", async () => {
+test("页面含备份验证 UI (分步式: 单词位输入框/下一步/进度提示/换词位) + 内存路径分支", async () => {
     const { srv, base } = await startServer();
     try {
         const html = await (await fetch(base + "/onboard/")).text();
@@ -129,6 +132,13 @@ test("页面含备份验证 UI (抽题/提交/结果显示) + 内存路径分支
         assert.ok(html.includes("/api/onboard/verify-backup"), "后端比对路径");
         assert.ok(html.includes("persistBackupAck"), "内存路径 ack 落账");
         assert.ok(html.includes("我已抄好"), "大白话文案");
+        // 分步式 (2026-10-03): 一次一词 + 下一步 + 进度 + 重抽/换词位
+        assert.ok(html.includes("checkBqStep"), "单步验证函数");
+        assert.ok(html.includes("下一步"), "下一步按钮");
+        assert.ok(html.includes("/3 步"), "进度提示");
+        assert.ok(html.includes("返回重抽"), "返回重抽");
+        assert.ok(html.includes("swapBqPosition"), "换一个词位");
+        assert.ok(!html.includes("checkBackupVerify"), "旧一次性提交函数已移除");
     } finally { srv.close(); }
 });