trustbase-seller-backend 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/routes/onboard.html

@@ -590,7 +590,7 @@ function mountApplyUpload(slotId,field,label){
     stat.textContent=o.stat||'';
   }
   _aSlots[field]={
-    prefill:function(mediaId){ _aMedia[field]=mediaId; toFilled({stat:'✓ 已上传过, 无需重传'}); },
+    prefill:function(mediaId){ _aMedia[field]=mediaId; toFilled({stat:'✓ 已上传过, 无需重传'}); saveApplyDraft(); },
     clear:toEmpty
   };
   function onFile(input){
@@ -603,14 +603,14 @@ function mountApplyUpload(slotId,field,label){
       toFilled({previewUrl:previewUrl,name:file.name,stat:'上传中...'});
       fetch('/api/onboard/applyment/upload',{method:'POST',headers:{'Content-Type':'application/json'},body:JSON.stringify(payload)})
         .then(readJson).then(function(j){
-          if(j.ok&&j.media_id){ _aMedia[field]=j.media_id; toFilled({previewUrl:previewUrl,name:file.name,stat:'✓ 已上传'}); }
+          if(j.ok&&j.media_id){ _aMedia[field]=j.media_id; toFilled({previewUrl:previewUrl,name:file.name,stat:'✓ 已上传'}); saveApplyDraft(); }
           else toFilled({previewUrl:previewUrl,name:file.name,stat:'上传失败: '+(j.message||j.error||'未知错误'),err:true});
         }).catch(function(e){ toFilled({previewUrl:previewUrl,name:file.name,stat:'网络错误: '+e.message,err:true}); });
     });
   }
   zone.querySelector('input[type=file]').addEventListener('change',function(){ onFile(this); });
   filled.querySelector('.upops input[type=file]').addEventListener('change',function(){ onFile(this); });
-  filled.querySelector('.updel').addEventListener('click',toEmpty);
+  filled.querySelector('.updel').addEventListener('click',function(){ toEmpty(); saveApplyDraft(); });
 }
 mountApplyUpload('a_up_license','license_media_id','营业执照照片 (必传)');
 mountApplyUpload('a_up_idfront','legal_id_front_media_id','身份证人像面 (必传)');
@@ -753,7 +753,7 @@ async function submitApplyment(){
     clearTimeout(timer);
     if(j.ok){
       msg.style.display='block';
-      msg.textContent='✅ 已提交微信审核 (敏感字段已在本机加密)'+(j.idempotent?' — 此前已提交过, 幂等忽略':'');
+      msg.textContent='✅ 已提交微信审核 (敏感字段已在本机加密)'+(j.idempotent?' — 此前已提交过, 幂等忽略':'')+'; 填写内容已保留在本机, 修改后可直接重提';
       document.getElementById('apply-form').style.display='none';
       queryApplyment();
     } else {
@@ -781,15 +781,75 @@ async function queryApplyment(){
   try{
     var j=await readJson(await fetch('/api/onboard/applyment/status'));
     renderApplyment(j);
-    if(j && j.form_snapshot) prefillApplyForm(j.form_snapshot); // F1: 驳回/暂存后预填
+    // 草稿生命周期: FINISHED (业务完成) → 清草稿, 不再恢复
+    if(j&&j.status==='APPLYMENT_STATE_FINISHED'){ clearApplyDraft(); return; }
+    // 恢复优先级: 本机草稿 (未提交编辑态, 含敏感明文) > form_snapshot (已提交脱敏快照) > 空表单
+    var d=await readJson(await fetch('/api/onboard/applyment/draft'));
+    if(d&&d.ok&&d.fields){ restoreApplyDraft(d.fields); return; }
+    if(j&&j.form_snapshot) prefillApplyForm(j.form_snapshot);
   }catch(e){}
 }
+// ---- 本机自动草稿 (2026-10-03 xiaomu: 重进重填敏感字段) ----
+// 隐私口径: 明文只存本机 sqlite (证件原件本来就在本机); 发出时照旧本机加密 (草稿不直接外发)。
+var _draftRestored=false, _draftTimer=null;
+function saveApplyDraft(){
+  clearTimeout(_draftTimer);
+  _draftTimer=setTimeout(async function(){ // 防抖 800ms
+    try{
+      await fetch('/api/onboard/applyment/draft',{method:'POST',headers:{'Content-Type':'application/json'},
+        body:JSON.stringify({fields:applyFormBody()})}); // 场景切换不丢: 按当前场景存全量字段
+    }catch(e){ /* 草稿失败静默, 不挡表单 */ }
+  },800);
+}
+async function clearApplyDraft(){
+  try{ await fetch('/api/onboard/applyment/draft',{method:'DELETE'}); }catch(e){}
+}
+function restoreApplyDraft(f){
+  if(_draftRestored||!f||typeof f!=='object') return;
+  _draftRestored=true;
+  // 场景先切 (setScene 重挂场景字段/上传槽)
+  if(f.sales_scene){
+    var r=document.querySelector('input[name="sales_scene"][value="'+f.sales_scene+'"]');
+    if(r){r.checked=true;setScene(f.sales_scene);}
+  }
+  // 主体联动先触发 (居住地址/UBO 显示 + 结算规则/类目默认), 再写草稿值
+  var subj=document.getElementById('a_subject_type');
+  if(subj&&f.subject_type){subj.value=f.subject_type;subj.dispatchEvent(new Event('change'));}
+  for(var k in PREFILL_MAP){
+    if(k==='subject_type') continue;
+    var v=f[k];
+    if(!v||String(v).indexOf('***')===0) continue;
+    var e=document.getElementById(PREFILL_MAP[k]);
+    if(e&&!e.value) e.value=v;
+  }
+  // 照片 media_id 复用 → 槽位已传双态
+  PREFILL_MEDIA.forEach(function(k){
+    if(f[k]&&_aSlots[k]) _aSlots[k].prefill(f[k]);
+    else if(f[k]) _aMedia[k]=f[k];
+  });
+  var msg=document.getElementById('apply-msg');
+  msg.style.display='block';
+  msg.textContent='ℹ️ 已恢复上次填写 (自动保存于本机)';
+  // 草稿恢复了编辑态 → 展开表单
+  document.getElementById('apply-form').style.display='block';
+}
+// 任何字段 input/change → 防抖自动保存 (含场景切换时的字段集; file 选择也走 change)
+(function(){
+  var form=document.getElementById('apply-form');
+  if(form){
+    form.addEventListener('input',saveApplyDraft);
+    form.addEventListener('change',saveApplyDraft);
+  }
+})();
 // F1 预填: 台账快照回填非敏感字段 + 照片 media_id 复用 (敏感字段是密文/脱敏, 需重填)
 var PREFILL_MAP={subject_type:'a_subject_type',merchant_shortname:'a_shortname',merchant_name:'a_merchant_name',
   license_number:'a_license_number',service_phone:'a_service_phone',
-  contact_email:'a_contact_email',legal_name:'a_legal_name',
+  contact_name:'a_contact_name',contact_mobile:'a_contact_mobile',contact_email:'a_contact_email',
+  legal_name:'a_legal_name',legal_id_number:'a_legal_id_number',legal_id_address:'a_legal_id_address',
   legal_id_period_begin:'a_period_begin',legal_id_period_end:'a_period_end',
-  account_type:'a_account_type',account_bank:'a_account_bank',bank_name:'a_bank_name',bank_address_code:'a_bank_address_code',
+  account_type:'a_account_type',account_name:'a_account_name',account_number:'a_account_number',
+  account_bank:'a_account_bank',bank_name:'a_bank_name',bank_address_code:'a_bank_address_code',
+  qualification_type:'a_settlement_id', // 行业类目 MCC (draft 路径用; snapshot 路径走 mcc 兼容段)
   store_name:'a_store_name',store_address_code:'a_store_address_code',store_address:'a_store_address',
   website_url:'a_website_url',appid:'a_appid',appid_type:'a_appid_type'};
 var PREFILL_MEDIA=['license_media_id','legal_id_front_media_id','legal_id_back_media_id',

package/routes/onboard.js

@@ -699,6 +699,55 @@ CREATE TABLE IF NOT EXISTS onboard_applyments (
         }
     });
 
+    // ---------- 进件表单本机草稿 (2026-10-03 xiaomu 实测: 每次重进重填敏感字段) ----------
+    // 隐私口径: 商户资料只存本机 (证件原件本来就在本机 materials 目录), 本机明文存草稿合理;
+    // 发出时照旧本机加密 (加密边界不变, 草稿明文永不直接外发)。
+    db.exec(`
+CREATE TABLE IF NOT EXISTS onboard_draft (
+  id INTEGER PRIMARY KEY CHECK(id=1),   -- 单行 (一台机器一个卖家)
+  fields TEXT NOT NULL DEFAULT '{}',    -- 整表单字段 JSON (含敏感字段明文, 刻意)
+  updated_at INTEGER NOT NULL
+);
+`);
+    /** POST /applyment/draft {fields:{...}} — 保存草稿 (单行 upsert; 敏感字段明文是本机刻意口径) */
+    router.post("/applyment/draft", (req, res) => {
+        try {
+            const b = req.body || {};
+            if (!b.fields || typeof b.fields !== "object" || Array.isArray(b.fields)) {
+                return res.status(400).json({ ok: false, error: "invalid_param", message: "fields 必填且为对象" });
+            }
+            const raw = JSON.stringify(b.fields);
+            if (raw.length > 200 * 1024) {
+                return res.status(413).json({ ok: false, error: "draft_too_large", message: "草稿超过 200KB" });
+            }
+            const now = Math.floor(Date.now() / 1000);
+            db.prepare("INSERT INTO onboard_draft (id, fields, updated_at) VALUES (1, ?, ?) ON CONFLICT(id) DO UPDATE SET fields=excluded.fields, updated_at=excluded.updated_at")
+                .run(raw, now);
+            res.json({ ok: true, updated_at: now });
+        } catch (e) {
+            console.error("[onboard] draft save error:", e && e.message);
+            res.status(500).json({ ok: false, error: "internal", message: String(e && e.message).slice(0, 200) });
+        }
+    });
+    /** GET /applyment/draft — 读草稿 (无缓存; 没有草稿返回 fields:null) */
+    router.get("/applyment/draft", (req, res) => {
+        try {
+            const row = db.prepare("SELECT fields, updated_at FROM onboard_draft WHERE id=1").get();
+            res.json({ ok: true, fields: row ? JSON.parse(row.fields) : null, updated_at: row ? row.updated_at : null });
+        } catch (e) {
+            res.status(500).json({ ok: false, error: "internal", message: String(e && e.message).slice(0, 200) });
+        }
+    });
+    /** DELETE /applyment/draft — 清除草稿 (FINISHED 后业务完成; 或商户想重来) */
+    router.delete("/applyment/draft", (req, res) => {
+        try {
+            db.prepare("DELETE FROM onboard_draft WHERE id=1").run();
+            res.json({ ok: true });
+        } catch (e) {
+            res.status(500).json({ ok: false, error: "internal", message: String(e && e.message).slice(0, 200) });
+        }
+    });
+
     /** POST /applyment/upload — 证件照片转发 SP 网关 media/upload (base64 JSON 同款) */
     router.post("/applyment/upload", async (req, res) => {
         try {

package/test-onboard-applyment.js

@@ -619,3 +619,55 @@ test("sp-info 代理: 全新实例 SP 不可达 → 200 降级 offline (不报
         assert.ok(html.includes("可随时更换"), "迁移保障卖点文案");
     } finally { srv.close(); process.env.SP_GATEWAY_URL = spBase; }
 });
+
+test("草稿: POST 保存 → GET 读取 (含敏感字段明文, 本机刻意口径) → DELETE 清除", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        // 空草稿
+        let j = await (await fetch(base + "/api/onboard/applyment/draft")).json();
+        assert.strictEqual(j.fields, null);
+        // 保存 (含敏感字段明文 — 本机=商户自己电脑, 刻意)
+        const fields = { contact_name: "张三", legal_id_number: "440300199001011234", account_number: "6225880212345678", qualification_type: "5311", sales_scene: "SALES_SCENES_STORE" };
+        let r = await fetch(base + "/api/onboard/applyment/draft", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: JSON.stringify({ fields }),
+        });
+        assert.strictEqual(r.status, 200);
+        // 读回 (无缓存, upsert 覆盖)
+        j = await (await fetch(base + "/api/onboard/applyment/draft")).json();
+        assert.deepStrictEqual(j.fields.legal_id_number, "440300199001011234");
+        assert.ok(j.updated_at > 0);
+        // upsert 覆盖 (单行)
+        await fetch(base + "/api/onboard/applyment/draft", {
+            method: "POST", headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ fields: { contact_name: "李四" } }),
+        });
+        j = await (await fetch(base + "/api/onboard/applyment/draft")).json();
+        assert.strictEqual(j.fields.contact_name, "李四");
+        assert.strictEqual(j.fields.legal_id_number, undefined, "upsert 整行覆盖");
+        // 删除
+        r = await fetch(base + "/api/onboard/applyment/draft", { method: "DELETE" });
+        assert.strictEqual((await r.json()).ok, true);
+        j = await (await fetch(base + "/api/onboard/applyment/draft")).json();
+        assert.strictEqual(j.fields, null, "删除后为空");
+        // 参数校验
+        r = await fetch(base + "/api/onboard/applyment/draft", {
+            method: "POST", headers: { "Content-Type": "application/json" }, body: "{}",
+        });
+        assert.strictEqual(r.status, 400);
+    } finally { srv.close(); }
+});
+
+test("草稿页面逻辑: 自动保存/恢复优先级/FINISHED 清除/提交保留 元素齐", async () => {
+    const { srv, base } = await startSeller();
+    try {
+        const html = await (await fetch(base + "/onboard/")).text();
+        assert.ok(html.includes("/api/onboard/applyment/draft"), "草稿端点调用");
+        assert.ok(html.includes("saveApplyDraft") && html.includes("800"), "防抖 800ms 自动保存");
+        assert.ok(html.includes("restoreApplyDraft"), "草稿恢复函数");
+        assert.ok(html.includes("clearApplyDraft"), "FINISHED 清除草稿");
+        assert.ok(html.includes("已恢复上次填写"), "恢复提示文案");
+        assert.ok(html.includes("修改后可直接重提"), "提交后保留草稿提示");
+        // 恢复优先级注释: 草稿 > form_snapshot > 空表单
+        assert.ok(html.indexOf("applyment/draft") < html.indexOf("form_snapshot") || html.includes("恢复优先级"), "草稿优先于快照");
+    } finally { srv.close(); }
+});