trustbase-seller-backend 0.7.5 → 0.7.7

package/core/chain-reconcile.js

@@ -49,12 +49,21 @@ async function fetchSlots(lcdUrl, seller) {
     const res = await fetch(url, { signal: AbortSignal.timeout(10000) });
     if (!res.ok) throw new Error(`LCD ${res.status} ${url}`);
     const body = await res.json();
-    const list = body && body.slots && Array.isArray(body.slots.slots) ? body.slots.slots : [];
-    return list;
+    // 2026-10-18 fix: 200 + 错误形状不能再被当成“零 slot 成功”。
+    // 只接受 {slots:{slots:[...]}}，其余一律视为上游异常并进入 degraded。
+    if (!body || !body.slots || !Array.isArray(body.slots.slots)) {
+        throw new Error(`LCD slots 响应形状错误 ${url}`);
+    }
+    return body.slots.slots;
 }
 
 function updateLocalFromSlot(db, product, slot) {
     const createdMs = Number(slot.created_at) > 0 ? Number(slot.created_at) * 1000 : Date.now();
+    // 2026-10-18 fix: 本地已有 chain_stake_per_unit 时保留卖家原始快照，
+    // 不能用链上声誉调整后的值覆盖。只有本地为空时才用链上值补齐。
+    const stake = (product.chain_stake_per_unit === null || product.chain_stake_per_unit === undefined || product.chain_stake_per_unit === "")
+        ? String(slot.stake_per_unit || "")
+        : product.chain_stake_per_unit;
     db.prepare(`UPDATE store_products SET
       chain_listed = 1,
       chain_sku_id = ?,
@@ -62,7 +71,7 @@ function updateLocalFromSlot(db, product, slot) {
       chain_stake_per_unit = ?,
       chain_listed_at = ?
       WHERE id = ?`)
-        .run(slot.sku_id, Number(slot.slot_index), String(slot.stake_per_unit || ""), createdMs, product.id);
+        .run(slot.sku_id, Number(slot.slot_index), stake, createdMs, product.id);
 }
 
 /**
@@ -132,6 +141,8 @@ function startChainReconcile({ db, lcdUrl }) {
             console.log(`[ChainReconcile] ${r.status}: recovered=${r.recovered} warnings=${r.warnings} errors=${r.errors} checked=${r.checked}`);
         } catch (e) {
             console.error("[ChainReconcile] failed:", e.message);
+            // 2026-10-18: 启动/定时失败也必须留下 degraded 状态，不能沿用旧状态或为空。
+            try { saveState(db, "degraded", e.message); } catch (_) { /* 审计不阻塞业务 */ }
         } finally {
             running = false;
         }

package/middleware/api-key-auth.js

@@ -160,10 +160,14 @@ function listAPIKeys() {
  */
 /** 隧道买家面放行判定 (2026-10-03, T2/Lane B)
  *  三条同时成立才放行: ① 来源回环  ② X-TB-Tunnel: 1 头  ③ 买家只读路径 */
-const TUNNEL_BUYER_PATHS = ['/api/products', '/api/orders'];
+const TUNNEL_BUYER_PATHS = ['/api/products', '/api/orders', '/api/qr'];
 function isTunnelBuyerRequest(req, clientIP) {
     const fromLoopback = clientIP === '127.0.0.1' || clientIP === '::1' || /^127\./.test(clientIP);
     if (!fromLoopback) return false;
+    // 2026-10-18 security: 隧道放行只允许只读请求。
+    // 原实现未检查方法，带 X-TB-Tunnel 的 POST /api/products 等写操作会连续绕过
+    // requireAPIKey 与 sensitiveOpGuard 两层鉴权，形成真实写操作绕过。
+    if (req.method !== 'GET' && req.method !== 'HEAD') return false;
     if (String(req.headers['x-tb-tunnel'] || '') !== '1') return false;
     // 注意: 本中间件挂在 '/api' 上, req.path 是挂载后路径 ('/products'), req.originalUrl 才带 '/api'
     // → 两种前缀都要判, 否则放行条件恒为假 (2026-10-03 .211 实测 401 才发现)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "trustbase-seller-backend",
-  "version": "0.7.5",
+  "version": "0.7.7",
   "description": "TrustBase Seller Backend (merchant edition) — 商品上链/订单/支付/质押 write API for TrustBase 保障链生态. 单卖家自托管形态: 签名 key 即卖家身份, 私钥不出门.",
   "main": "run-unified.js",
   "bin": {

package/plugins/sqlite.js

@@ -871,11 +871,24 @@ class SQLitePlugin {
             }
             if (this.storeProductsReady) {
                 const imgArr = Array.isArray(product.images) ? product.images : [];
+                // 2026-10-18 fix: 不再 INSERT OR REPLACE。
+                // REPLACE 会删旧行重插，未提供的 product_type 会被重置成默认 physical。
+                // 改为 ON CONFLICT 只更新链同步负责的列，明确保留本地 product_type。
                 this.db.prepare(`
-          INSERT OR REPLACE INTO store_products (
+          INSERT INTO store_products (
             id, seller_address, title, description, price_utct, stock, status,
             category, image_url, tags, featured, sales_count, created_at, updated_at
           ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, '[]', 0, 0, ?, ?)
+          ON CONFLICT(id) DO UPDATE SET
+            seller_address = excluded.seller_address,
+            title = excluded.title,
+            description = excluded.description,
+            price_utct = excluded.price_utct,
+            stock = excluded.stock,
+            status = excluded.status,
+            category = excluded.category,
+            image_url = excluded.image_url,
+            updated_at = excluded.updated_at
         `).run(product.skuId, product.seller, product.title, product.description, Math.round(Number(product.priceTct || 0) * 1_000_000), // price_tct(TCT 字符串) → utct
                 product.stock, product.status === 'active' ? 'active' : 'archived', product.category.level1 || 'general', imgArr[0] || null, product.createdAt, product.updatedAt);
             }

package/routes/buyer-shop.js

@@ -282,10 +282,14 @@ function createBuyerShopRouter(deps) {
             const c = db.prepare("SELECT txhash FROM chain_write_log WHERE order_id = ?").get(row.chain_order_id);
             if (c && c.txhash) txHash = String(c.txhash);
         }
+        const status = mapStatus(row.state);
+        // 2026-10-18 security: 交付凭据只能在支付成功后公开。
+        // 原实现创建订单 pending 时就返回 delivery_credential，买家可不付款直接取走。
+        const canDeliver = status === "paid" || status === "completed";
         return {
             id: row.order_ref,
             product_id: row.sku_id, // Pi 复核 P2: 前端详情页跳转要 product_id (契约补齐)
-            status: mapStatus(row.state),
+            status,
             amount: fenToYuan(row.amount_total),
             product_name: productName,
             quantity: row.qty,
@@ -293,7 +297,7 @@ function createBuyerShopRouter(deps) {
             code_url: row.psp_code_url || "",
             // A1: 收货地址 / 交付凭据 (老订单两列为空 → 空串)
             shipping_address: String(row.shipping_address || ""),
-            delivery_credential: String(row.delivery_credential || ""),
+            delivery_credential: canDeliver ? String(row.delivery_credential || "") : "",
         };
     }
 

package/routes/chain-writes.js

@@ -208,7 +208,7 @@ async function queryAccount(c, addr) {
     if (!acct || acct.account_number === undefined || acct.sequence === undefined) {
         throw new HttpError(502, 'lcd_upstream_error', `LCD 账户响应缺 account_number/sequence: ${addr}`);
     }
-    return { accountNumber: String(acct.account_number), sequence: String(acct.sequence) };
+    return { accountNumber: String(acct.account_number), sequence: String(acct.sequence), address: addr };
 }
 /** 手写 unsigned tx JSON (cosmos proto JSON 格式, snake_case 原名 + uint64 字符串)
  *  memo: v3.9.4 起下单走 "tb-auth:<sha256(整批订单意愿)>" (见 core/order-intent.js);
@@ -415,30 +415,36 @@ function tryParseBroadcast(out) {
  */
 exports.sendTxAs = sendTxAs;
 async function sendTxAs(c, messages, addr, opts) {
-    const run = async () => {
-        let account;
-        try {
-            account = await queryAccount(c, addr);
-        }
-        catch (e) {
-            // N15: 0 余额新商户 (auth 账户都不存在) + feegrant 代付 → 首笔 tx 以账户号 0/0 发起
-            const isNotFound = (e && e.code === 'account_not_found') || /account_not_found/.test(String(e && e.message));
-            if (!isNotFound || !c.feeGranter)
-                throw e;
-            console.log(`[chain-writes] 地址未上链 + feegrant 代付, 以 account 0/0 发起首笔 tx: ${addr}`);
-            account = { accountNumber: '0', sequence: '0' };
-        }
-        try {
-            return await signAndBroadcastInner(c, messages, account, opts);
-        }
-        catch (e) {
-            if (!(e instanceof SequenceMismatchError))
-                throw e;
-            console.warn('[chain-writes] account sequence mismatch, 重查序号重试一次');
-            account = await queryAccount(c, addr);
-            return await signAndBroadcastInner(c, messages, account, opts);
-        }
-    };
+    // 2026-10-18 fix: sendTxAs 也必须经过上链审计。
+    // 原实现直接调 signAndBroadcastInner，订单/支付/入驻等主要写路径全部绕过审计。
+    const run = () => chain_write_log_1.withChainWriteLog({
+        messages,
+        account: { address: addr },
+        run: async () => {
+            let account;
+            try {
+                account = await queryAccount(c, addr);
+            }
+            catch (e) {
+                // N15: 0 余额新商户 (auth 账户都不存在) + feegrant 代付 → 首笔 tx 以账户号 0/0 发起
+                const isNotFound = (e && e.code === 'account_not_found') || /account_not_found/.test(String(e && e.message));
+                if (!isNotFound || !c.feeGranter)
+                    throw e;
+                console.log(`[chain-writes] 地址未上链 + feegrant 代付, 以 account 0/0 发起首笔 tx: ${addr}`);
+                account = { accountNumber: '0', sequence: '0' };
+            }
+            try {
+                return await signAndBroadcastInner(c, messages, account, opts);
+            }
+            catch (e) {
+                if (!(e instanceof SequenceMismatchError))
+                    throw e;
+                console.warn('[chain-writes] account sequence mismatch, 重查序号重试一次');
+                account = await queryAccount(c, addr);
+                return await signAndBroadcastInner(c, messages, account, opts);
+            }
+        },
+    });
     const p = sendQueue.then(run, run);
     sendQueue = p.then(() => undefined, () => undefined);
     return p;

package/run-unified.js

@@ -296,11 +296,6 @@ async function startUnifiedServer() {
     await indexer.start();
     // 2026-10-17 kimi: 初始化上链尝试审计（append-only，独立于幂等表 chain_write_log）。
     chain_write_log_1.initChainWriteLogger(sqliteIndexer.getRawDb());
-    // 2026-10-17 kimi: 启动时 + 定时对账；链上读失败显式 degraded，不静默返回缓存。
-    chain_reconcile_1.startChainReconcile({
-        db: sqliteIndexer.getRawDb(),
-        lcdUrl: process.env.CHAIN_LCD_URL || process.env.LCD_URL || 'http://localhost:1317',
-    });
     // ── F-01 fix: ChainListener 接回 run-unified ──
     // SQLitePlugin.start() 本身不 wire ChainListener (只有 TrustCoinIndexer.start() wire).
     // 原来 run.ts 走 TrustCoinIndexer 所以 listener 自动起来, run-unified 直用
@@ -443,7 +438,7 @@ async function startUnifiedServer() {
     // (pwa-shop-demo 契约) 无账号无 api key。写路径仍受下方 sensitiveOpGuard 保护:
     // POST /api/products (卖家上架) 强制 key 不变; POST /api/orders 由 buyer-shop 按 body 形状
     // 接管买家单 (buyer_card+product_id), 其余形状落回 guard + chain-writes 老路径。
-    app.use('/api', (0, api_key_auth_1.requireAPIKey)(skipLAN, ['/api/p2p/mcp', '/api/p2p/oauth', '/api/products', '/api/orders']));
+    app.use('/api', (0, api_key_auth_1.requireAPIKey)(skipLAN, ['/api/p2p/mcp', '/api/p2p/oauth', '/api/products', '/api/orders', '/api/qr']));
     // v0.17.1 安全修复 (H2): 以下三族路由此前挂载在 requireAPIKey 之前，
     // 任意外网 IP 都能无认证调用 —— 特别是 POST /api/api-keys/create
     // 允许任何人给自己签发任意权限的 key。现已挪到鉴权中间件之后。
@@ -483,6 +478,11 @@ async function startUnifiedServer() {
     if (sqliteDb) {
         (0, social_migrate_1.runSocialMigrations)(sqliteDb); // kimi 8/26: 私田 4 表 (幂等), 不修会 no such table (实测)
         (0, store_migrate_1.runStoreMigrations)(sqliteIndexer.getRawDb()); // kimi 9/6: storefront store_products 等表 (幂等), 不修 storefront 查询炸 no such table
+        // 2026-10-18 fix: 首次对账必须在 store_products 建表之后，避免新库 no such table。
+        chain_reconcile_1.startChainReconcile({
+            db: sqliteIndexer.getRawDb(),
+            lcdUrl: process.env.CHAIN_LCD_URL || process.env.LCD_URL || 'http://localhost:1317',
+        });
         app.use('/api/social', (0, social_router_1.createSocialFieldRouter)({ db: sqliteDb }));
         console.log('   ✅ SocialField router mounted at /api/social/{posts,shares,whitelist,feed}');
     }

package/test-api-key-auth-exempt.js

@@ -54,7 +54,7 @@ CREATE TABLE store_products (
 
     const app = express();
     app.use(express.json());
-    app.use("/api", requireAPIKey(false, ["/api/p2p/mcp", "/api/p2p/oauth", "/api/products", "/api/orders"]));
+    app.use("/api", requireAPIKey(false, ["/api/p2p/mcp", "/api/p2p/oauth", "/api/products", "/api/orders", "/api/qr"]));
     app.use("/api", buyerShop.createBuyerShopRouter({ db }));
     app.use("/api/orders", sensitiveOpGuard);
     app.use("/api/products", sensitiveOpGuard);
@@ -74,6 +74,7 @@ async function closeServer(ctx) {
 
 const cases = [
     { name: "GET /api/products 公开 200", method: "GET", path: "/api/products", status: 200 },
+    { name: "GET /api/qr 支付二维码不再 401", method: "GET", path: "/api/qr?text=weixin%3A%2F%2Fwxpay%2Fexample", status: 200 },
     { name: "GET /api/products?limit=1 query 不影响豁免", method: "GET", path: "/api/products?limit=1", status: 200 },
     { name: "GET /api/products/p1?expand=1 子路径与 query 公开", method: "GET", path: "/api/products/p1?expand=1", status: 200 },
     { name: "GET /api/status 仍 401", method: "GET", path: "/api/status", status: 401 },
@@ -89,7 +90,30 @@ const cases = [
         status: 401,
     },
     { name: "POST /api/products 豁免后仍受 sensitiveOpGuard 拦截", method: "POST", path: "/api/products", body: {}, status: 401 },
+    {
+        name: "POST /api/products 带隧道头也不能绕过写操作鉴权",
+        method: "POST",
+        path: "/api/products",
+        headers: { "X-TB-Tunnel": "1" },
+        body: {},
+        status: 401,
+    },
     { name: "POST /api/orders 非买家形状仍受 sensitiveOpGuard 拦截", method: "POST", path: "/api/orders", body: { woo_order_id: 1 }, status: 401 },
+    {
+        name: "POST /api/orders 非买家形状带隧道头也不能绕过写操作鉴权",
+        method: "POST",
+        path: "/api/orders",
+        headers: { "X-TB-Tunnel": "1" },
+        body: { woo_order_id: 1 },
+        status: 401,
+    },
+    {
+        name: "GET /api/products 带隧道头仍只读放行",
+        method: "GET",
+        path: "/api/products",
+        headers: { "X-TB-Tunnel": "1" },
+        status: 200,
+    },
     {
         name: "POST /api/orders 买家形状仍由公开路由处理",
         method: "POST",
@@ -110,10 +134,16 @@ for (const c of cases) {
                 headers,
                 body: c.body === undefined ? undefined : JSON.stringify(c.body),
             });
-            const payload = await r.json();
-            assert.strictEqual(r.status, c.status, JSON.stringify(payload));
-            if (c.status === 401) assert.strictEqual(payload.error, "API Key Required");
-            if (c.status === 400) assert.strictEqual(payload.error, "INVALID_PARAM");
+            if (c.path.startsWith("/api/qr")) {
+                const svg = await r.text();
+                assert.strictEqual(r.status, c.status, svg.slice(0, 200));
+                assert.ok(svg.includes("<svg"), "二维码应返回 SVG 而不是 401/JSON");
+            } else {
+                const payload = await r.json();
+                assert.strictEqual(r.status, c.status, JSON.stringify(payload));
+                if (c.status === 401) assert.strictEqual(payload.error, "API Key Required");
+                if (c.status === 400) assert.strictEqual(payload.error, "INVALID_PARAM");
+            }
         } finally {
             await closeServer(ctx);
         }

package/test-chain-reconcile.js

@@ -38,6 +38,7 @@ async function startLcd(handler) {
             const out = handler(req.url);
             if (out.error) { res.writeHead(500); return res.end(out.error); }
             res.writeHead(200, { "Content-Type": "application/json" });
+            if (Object.prototype.hasOwnProperty.call(out, "raw")) return res.end(JSON.stringify(out.raw));
             return res.end(JSON.stringify({ slots: { slots: out.slots || [] } }));
         }
         res.writeHead(404); res.end();
@@ -99,6 +100,28 @@ test("链上孤儿 slot → 只记录，不自动创建商品", async () => {
     } finally { srv.close(); db.close(); }
 });
 
+test("本地已有质押快照时，不被链上调整值覆盖", async () => {
+    const db = makeDb();
+    db.prepare("INSERT INTO store_products (id, seller_address, title, chain_listed, chain_sku_id, chain_slot_index, chain_stake_per_unit) VALUES (?, ?, ?, ?, ?, ?, ?)")
+        .run("sku-1", SELLER, "sku-1", 1, "sku-1", 0, "2500000");
+    const { srv, url } = await startLcd(() => ({ slots: [{ ...activeSlot("sku-1"), stake_per_unit: "5000000" }] }));
+    try {
+        await runChainReconcile({ db, lcdUrl: url });
+        const p = db.prepare("SELECT chain_stake_per_unit FROM store_products WHERE id = 'sku-1'").get();
+        assert.strictEqual(p.chain_stake_per_unit, "2500000", "必须保留卖家原始质押快照");
+    } finally { srv.close(); db.close(); }
+});
+
+test("LCD 返回 200 但形状错误 → degraded，不当成零 slot 成功", async () => {
+    const db = makeDb(); insertProduct(db, "sku-1", 1);
+    const { srv, url } = await startLcd(() => ({ raw: {} }));
+    try {
+        const r = await runChainReconcile({ db, lcdUrl: url });
+        assert.strictEqual(r.status, "degraded");
+        assert.strictEqual(r.errors, 1);
+    } finally { srv.close(); db.close(); }
+});
+
 test("已经一致 → 不重复 recover", async () => {
     const db = makeDb(); insertProduct(db, "sku-1", 1);
     const { srv, url } = await startLcd(() => ({ slots: [activeSlot("sku-1")] }));

package/test-chain-writes-audit-integration.js

@@ -7,7 +7,7 @@ const test = require("node:test");
 const assert = require("node:assert");
 const Database = require("better-sqlite3");
 const { initChainWriteLogger } = require("./core/chain-write-log");
-const { signAndBroadcast } = require("./routes/chain-writes");
+const { signAndBroadcast, sendTxAs } = require("./routes/chain-writes");
 
 test("signAndBroadcast 失败时 chain_write_attempts 也有记录", async () => {
     const db = new Database(":memory:");
@@ -34,3 +34,29 @@ test("signAndBroadcast 失败时 chain_write_attempts 也有记录", async () =>
     assert.ok(row.error.length > 0, "必须保留失败原因");
     db.close();
 });
+
+test("sendTxAs 失败时也落审计且 signer 为调用方地址", async () => {
+    const db = new Database(":memory:");
+    initChainWriteLogger(db);
+    const c = {
+        signMode: "js",
+        feeGranter: "",
+        rpcUrl: "http://127.0.0.1:1",
+        lcdUrl: "http://127.0.0.1:1",
+        home: "/tmp/definitely-not-a-chain-home",
+        keyName: "missing-key",
+        bin: "definitely-not-a-binary",
+        chainId: "test-chain",
+    };
+    const messages = [{ "@type": "/trustchain.order.v1.MsgCreateOrder", order_id: "order-1" }];
+
+    await assert.rejects(sendTxAs(c, messages, "tct1seller"), /.*/);
+
+    const row = db.prepare("SELECT * FROM chain_write_attempts").get();
+    assert.ok(row, "sendTxAs 失败也必须有审计记录");
+    assert.strictEqual(row.status, "failed");
+    assert.strictEqual(row.msg_types, "/trustchain.order.v1.MsgCreateOrder");
+    assert.strictEqual(row.signer, "tct1seller");
+    assert.ok(row.error.length > 0);
+    db.close();
+});

package/test-product-type.js

@@ -100,28 +100,32 @@ test("① physical 商品: 缺 shipping_address → 400 SHIPPING_ADDRESS_REQUIRE
     } finally { srv.close(); }
 });
 
-test("② virtual 商品: 不要地址, 返回 delivery_credential (license 格式), 幂等重放凭据不变", async () => {
+test("② virtual 商品: pending 不交付凭据, paid 后才返回且幂等不变", async () => {
     const { db, srv, base } = await startServer(seedProductsWithType);
     try {
         let r = await post(base, { product_id: "p-virt-1", quantity: 1, buyer_card: "card_pt2", client_order_no: "V-ORDER-1" });
         const j = await r.json();
         assert.strictEqual(r.status, 200, JSON.stringify(j));
-        assert.match(j.delivery_credential, /^tb-license-tb-[0-9a-f]{16}-[0-9a-f]{4}$/, "license 格式 tb-license-{order_ref}-{random4}");
-        assert.ok(j.delivery_credential.includes(j.id), "凭据与订单绑定");
+        assert.strictEqual(j.status, "pending");
+        assert.strictEqual(j.delivery_credential, "", "待支付不得提前交付凭据");
         assert.strictEqual(j.shipping_address, "", "虚拟单地址为空");
         const row = db.prepare("SELECT * FROM agent_pay_sessions WHERE order_ref = ?").get(j.id);
-        assert.strictEqual(row.delivery_credential, j.delivery_credential, "凭据落库");
-        // 幂等重放 → 同一凭据 (不重新生成)
+        assert.match(row.delivery_credential, /^tb-license-tb-[0-9a-f]{16}-[0-9a-f]{4}$/, "license 已在库中生成");
+        assert.ok(row.delivery_credential.includes(j.id), "凭据与订单绑定");
+        // 幂等重放仍不得提前交付
         r = await post(base, { product_id: "p-virt-1", quantity: 1, buyer_card: "card_pt2", client_order_no: "V-ORDER-1" });
         const j2 = await r.json();
         assert.strictEqual(j2.id, j.id);
-        assert.strictEqual(j2.delivery_credential, j.delivery_credential);
-        // 查单带凭据
+        assert.strictEqual(j2.delivery_credential, "", "幂等重放也不提前交付");
+        // 支付成功后才公开同一凭据
+        db.prepare("UPDATE agent_pay_sessions SET state = 'PAID' WHERE order_ref = ?").run(j.id);
         const o = await (await fetch(base + "/api/orders/" + j.id)).json();
-        assert.strictEqual(o.delivery_credential, j.delivery_credential);
-        // 两个虚拟单凭据不同
+        assert.strictEqual(o.status, "paid");
+        assert.strictEqual(o.delivery_credential, row.delivery_credential, "支付后返回同一凭据");
+        // 第二个虚拟单凭据不同
         const j3 = await (await post(base, { product_id: "p-virt-1", quantity: 1, buyer_card: "card_pt2", client_order_no: "V-ORDER-2" })).json();
-        assert.notStrictEqual(j3.delivery_credential, j.delivery_credential);
+        assert.notStrictEqual(j3.delivery_credential, row.delivery_credential);
+        assert.strictEqual(j3.delivery_credential, "", "新单待支付同样不交付");
     } finally { srv.close(); }
 });
 

package/test-sqlite-product-type-preserve.js

@@ -0,0 +1,64 @@
+"use strict";
+/**
+ * test-sqlite-product-type-preserve.js — 链事件双写不得重置 product_type
+ * node --test test-sqlite-product-type-preserve.js
+ */
+const test = require("node:test");
+const assert = require("node:assert");
+const Database = require("better-sqlite3");
+const { SQLitePlugin } = require("./plugins/sqlite");
+
+function makeDb() {
+    const db = new Database(":memory:");
+    db.exec(`CREATE TABLE products (
+      sku_id TEXT PRIMARY KEY, seller TEXT, title TEXT, description TEXT, content_hash TEXT,
+      price_cny REAL, price_tct TEXT, category_l1 TEXT, category_l2 TEXT, category_l3 TEXT,
+      latitude REAL, longitude REAL, city TEXT, stock INTEGER, stake_per_unit TEXT,
+      images TEXT, shipping_method TEXT, shipping_fee REAL, delivery_days INTEGER,
+      created_at INTEGER, updated_at INTEGER, status TEXT, brand_auth_type INTEGER, insurance_seller TEXT
+    )`);
+    db.exec(`CREATE TABLE products_fts (rowid INTEGER, title TEXT, description TEXT, category_l1 TEXT, category_l2 TEXT, category_l3 TEXT)`);
+    db.exec(`CREATE TABLE store_products (
+      id TEXT PRIMARY KEY, seller_address TEXT, title TEXT, description TEXT,
+      price_utct INTEGER, stock INTEGER, status TEXT, category TEXT, image_url TEXT,
+      tags TEXT, featured INTEGER, sales_count INTEGER, created_at INTEGER, updated_at INTEGER,
+      product_type TEXT NOT NULL DEFAULT 'physical'
+    )`);
+    return db;
+}
+function sampleProduct() {
+    return {
+        skuId: "sku-virtual", seller: "tct1seller", title: "虚拟商品", description: "",
+        contentHash: "hash", priceCny: 1, priceTct: "1",
+        category: { level1: "general", level2: "", level3: "" },
+        location: { latitude: 0, longitude: 0, city: "" },
+        stock: 1, stakePerUnit: "1000000", images: [],
+        shipping: { method: "none", fee: 0, deliveryDays: 0 },
+        createdAt: 1, updatedAt: 2, status: "active",
+        brand: { authType: 0 }, insurance: { insurer: "" },
+    };
+}
+
+test("已有 virtual 商品经过链事件双写后仍是 virtual", async () => {
+    const db = makeDb();
+    db.prepare("INSERT INTO store_products (id, seller_address, title, product_type) VALUES (?, ?, ?, ?)")
+        .run("sku-virtual", "tct1seller", "虚拟商品", "virtual");
+    const plugin = Object.create(SQLitePlugin.prototype);
+    plugin.db = db;
+    plugin.storeProductsReady = true;
+    await plugin.indexProduct(sampleProduct());
+    const row = db.prepare("SELECT product_type FROM store_products WHERE id = 'sku-virtual'").get();
+    assert.strictEqual(row.product_type, "virtual", "双写不得把 virtual 重置为 physical");
+    db.close();
+});
+
+test("新商品没有 product_type 时仍按默认 physical 插入", async () => {
+    const db = makeDb();
+    const plugin = Object.create(SQLitePlugin.prototype);
+    plugin.db = db;
+    plugin.storeProductsReady = true;
+    await plugin.indexProduct(sampleProduct());
+    const row = db.prepare("SELECT product_type FROM store_products WHERE id = 'sku-virtual'").get();
+    assert.strictEqual(row.product_type, "physical");
+    db.close();
+});

package/web/dist/app.js

@@ -97,7 +97,7 @@ function renderList() {
         <div class="product-grid">
           ${products.map(p => `
             <div class="product-card" onclick="location.hash='#product/${p.id}'">
-              <img class="product-img" src="${p.image_url || '/placeholder.svg'}" alt="${esc(p.name)}" loading="lazy">
+              <img class="product-img" src="${safeImageUrl(p.image_url)}" alt="${esc(p.name)}" loading="lazy">
               <div class="product-info">
                 <div class="product-name">${esc(p.name)}</div>
                 <div class="product-price">¥${fmt(p.price)}</div>
@@ -126,7 +126,7 @@ function renderDetail(productId) {
         <div style="padding:12px 0">
           <button class="btn btn-secondary" style="width:auto;padding:8px 16px;font-size:14px" onclick="location.hash=''">← 返回</button>
         </div>
-        <img class="detail-img" src="${p.image_url || '/placeholder.svg'}" alt="${esc(p.name)}">
+        <img class="detail-img" src="${safeImageUrl(p.image_url)}" alt="${esc(p.name)}">
         <div class="detail-name">${esc(p.name)}</div>
         <div class="detail-desc">${esc(p.description || '')}</div>
         <div class="detail-price">¥${fmt(p.price)}</div>
@@ -258,6 +258,12 @@ function renderOrder(orderId) {
             </div>
           </div>
         </div>
+        ${(order.status === 'paid' || order.status === 'completed') && order.delivery_credential ? `
+          <div class="product-card" style="cursor:default;margin-top:16px">
+            <div style="font-size:12px;color:var(--muted);margin-bottom:6px">交付凭据</div>
+            <code style="word-break:break-all;user-select:all">${esc(order.delivery_credential)}</code>
+          </div>
+        ` : ''}
         <button class="btn btn-secondary" style="margin-top:24px" onclick="location.hash=''">返回首页</button>
       `;
     })
@@ -377,6 +383,14 @@ function esc(s) {
   return String(s || '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');
 }
 
+// 2026-10-18 security: 图片 URL 只允许 https 或站内相对路径，且做属性转义。
+// 防止卖家把 image_url 写成 x" onerror="..." 或 javascript: 形成存储型 XSS。
+function safeImageUrl(url) {
+  const s = String(url || '').trim();
+  if (/^https:\/\//i.test(s) || /^\/(?!\/)/.test(s)) return esc(s);
+  return '/icon.svg';
+}
+
 function fmt(n) {
   return Number(n || 0).toFixed(2);
 }

package/web/dist/index.html

@@ -121,6 +121,6 @@
   <div class="offline-bar" id="offline-bar">⚠ 网络已断开，显示缓存内容</div>
   <div class="container" id="app"></div>
 
-  <script type="module" src="/app.js?v=20261017a"></script>
+  <script src="/app.js?v=20261018a"></script>
 </body>
 </html>

package/web/dist/sw.js

@@ -1,5 +1,5 @@
 // TrustBase 示例店铺 Service Worker (pwa-kit 生成风格的手写版)
-const CACHE = 'shop-demo-v5'; // 2026-10-17 pi: A1 physical/virtual 收货地址 conditional (18578)
+const CACHE = 'shop-demo-v6'; // 2026-10-18: 普通 script + 错误边界 + 图片 XSS 修复，强制刷新旧缓存
 const CORE = ['/', '/app.js', '/manifest.json', '/icon.svg'];
 
 self.addEventListener('install', (e) => {