ordloom-wechat 0.1.0__tar.gz

ordloom_wechat-0.1.0/PKG-INFO

@@ -0,0 +1,27 @@
+Metadata-Version: 2.4
+Name: ordloom-wechat
+Version: 0.1.0
+Summary: Ordloom 微信公众号、小程序接入与会员绑定子应用
+Project-URL: Homepage, https://neekin.github.io/ordloom-docs/
+Project-URL: Documentation, https://neekin.github.io/ordloom-docs/guides/wechat.html
+Project-URL: Repository, https://github.com/neekin/simpleui-antd
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+Requires-Dist: ordloom<2,>=1.1.0
+Requires-Dist: ordloom-members<0.2,>=0.1.0
+Requires-Dist: cryptography<51,>=43
+Requires-Dist: defusedxml<0.8,>=0.7
+
+# ordloom-wechat
+
+基于 Ordloom 子应用 SDK 和 ordloom-members 的微信接入 MVP：公众号/小程序渠道、消息回调验签与 AES 解密、去重收件记录、公众号 OAuth、小程序 code2Session、显式会员绑定/解绑及已绑定会员登录。
+
+版本 0.1.0，依赖 Ordloom 1.1.0+ 的 SDK v1。独立安装：
+
+```bash
+python -m pip install ordloom-wechat==0.1.0
+```
+
+注册 `ordloom_members.apps.ExtensionConfig` 与 `ordloom_wechat.apps.ExtensionConfig`，挂载应用 URLs，执行迁移与静态收集。模块及渠道默认关闭；AppSecret、回调 Token、AES 密钥仅从宿主服务端设置读取，不通过后台下发。
+
+不包含微信支付、群发/客服发送、自动会员注册、UnionID 自动合并、第三方代授权或完整小程序前端。接入及真实平台联调要求见 [微信指南](https://neekin.github.io/ordloom-docs/guides/wechat.html)。

ordloom_wechat-0.1.0/README.md

@@ -0,0 +1,13 @@
+# ordloom-wechat
+
+基于 Ordloom 子应用 SDK 和 ordloom-members 的微信接入 MVP：公众号/小程序渠道、消息回调验签与 AES 解密、去重收件记录、公众号 OAuth、小程序 code2Session、显式会员绑定/解绑及已绑定会员登录。
+
+版本 0.1.0，依赖 Ordloom 1.1.0+ 的 SDK v1。独立安装：
+
+```bash
+python -m pip install ordloom-wechat==0.1.0
+```
+
+注册 `ordloom_members.apps.ExtensionConfig` 与 `ordloom_wechat.apps.ExtensionConfig`，挂载应用 URLs，执行迁移与静态收集。模块及渠道默认关闭；AppSecret、回调 Token、AES 密钥仅从宿主服务端设置读取，不通过后台下发。
+
+不包含微信支付、群发/客服发送、自动会员注册、UnionID 自动合并、第三方代授权或完整小程序前端。接入及真实平台联调要求见 [微信指南](https://neekin.github.io/ordloom-docs/guides/wechat.html)。

ordloom_wechat-0.1.0/ordloom_wechat/__init__.py

@@ -0,0 +1 @@
+"""Optional WeChat application for Ordloom."""

ordloom_wechat-0.1.0/ordloom_wechat/admin.py

@@ -0,0 +1,94 @@
+from django.contrib import admin,messages
+from django.core.exceptions import ValidationError
+from django.db import transaction
+from .configuration import enabled,WechatError
+from .models import Channel,IdentityBinding,BindingEvent,CallbackReceipt
+from .services import unlink,database_guard
+
+
+class EnabledAdmin(admin.ModelAdmin):
+    def has_module_permission(self,request):
+        return enabled() and super().has_module_permission(request)
+    def has_view_permission(self,request,obj=None):
+        return self.has_module_permission(request) and super().has_view_permission(request,obj)
+    def has_change_permission(self,request,obj=None):
+        return self.has_module_permission(request) and super().has_change_permission(request,obj)
+    def has_add_permission(self,request):
+        return self.has_module_permission(request) and super().has_add_permission(request)
+    def has_delete_permission(self,request,obj=None):
+        return self.has_module_permission(request) and super().has_delete_permission(request,obj)
+
+
+@admin.register(Channel)
+class ChannelAdmin(EnabledAdmin):
+    fields=('name','kind','appid','original_id','credential_ref','enabled','callbacks_enabled','binding_enabled','login_enabled','encryption')
+    list_display=('name','kind','appid','enabled','callbacks_enabled','binding_enabled','login_enabled')
+    search_fields=('name','appid')
+    list_filter=('kind','enabled')
+    def has_add_permission(self,request):
+        return super().has_add_permission(request) and request.user.has_perm('ordloom_wechat.configure_channel')
+    def get_readonly_fields(self,request,obj=None):
+        fields=('kind','appid') if obj else ()
+        if not request.user.has_perm('ordloom_wechat.configure_channel'):
+            fields=tuple(name for name in self.fields if name!='name')
+        return fields
+    def save_model(self,request,obj,form,change):
+        database_guard()
+        with transaction.atomic():
+            if change and not request.user.has_perm('ordloom_wechat.configure_channel'):
+                old=Channel.objects.select_for_update().get(pk=obj.pk)
+                for field in self.fields:
+                    if field!='name':setattr(obj,field,getattr(old,field))
+            super().save_model(request,obj,form,change)
+
+
+class ReadonlyAdmin(EnabledAdmin):
+    def has_add_permission(self,request):return False
+    def has_change_permission(self,request,obj=None):return False
+    def has_delete_permission(self,request,obj=None):return False
+    def get_readonly_fields(self,request,obj=None):return tuple(field.name for field in self.model._meta.fields)
+
+
+class ChannelChildAdmin(ReadonlyAdmin):
+    def get_queryset(self,request):
+        rows=super().get_queryset(request);manager=admin.site._registry[Channel]
+        return rows.filter(channel__in=manager.get_queryset(request)) if manager.has_view_permission(request) else rows.none()
+    def has_view_permission(self,request,obj=None):
+        manager=admin.site._registry[Channel]
+        return super().has_view_permission(request,obj) and (obj is None or manager.has_view_permission(request,obj.channel) and manager.get_queryset(request).filter(pk=obj.channel_id).exists())
+
+
+@admin.register(IdentityBinding)
+class IdentityBindingAdmin(ChannelChildAdmin):
+    list_display=('public_id','channel','member','bound_at')
+    search_fields=('public_id','openid')
+    list_filter=('channel',)
+    actions=('revoke_bindings',)
+    def has_revoke_permission(self,request,obj=None):
+        return self.has_view_permission(request,obj) and request.user.has_perm('ordloom_wechat.revoke_identitybinding')
+    @admin.action(description='撤销微信会员绑定',permissions=['revoke'])
+    def revoke_bindings(self,request,queryset):
+        try:
+            with transaction.atomic():
+                for binding in queryset.order_by('channel_id','pk'):
+                    unlink(request,binding.public_id,staff=True)
+        except WechatError as error:raise ValidationError(error.message) from None
+        self.message_user(request,'绑定已撤销，微信来源会员会话下次访问时失效',level=messages.SUCCESS)
+
+
+@admin.register(CallbackReceipt)
+class CallbackReceiptAdmin(ChannelChildAdmin):
+    list_display=('channel','message_type','event','message_id','encrypted','received_at')
+    list_filter=('channel','message_type','encrypted')
+    search_fields=('message_id','event','content')
+
+
+@admin.register(BindingEvent)
+class BindingEventAdmin(ReadonlyAdmin):
+    list_display=('binding','member','action','created_at')
+    def get_queryset(self,request):
+        rows=super().get_queryset(request);manager=admin.site._registry[IdentityBinding]
+        return rows.filter(binding__in=manager.get_queryset(request)) if manager.has_view_permission(request) else rows.none()
+    def has_view_permission(self,request,obj=None):
+        manager=admin.site._registry[IdentityBinding]
+        return super().has_view_permission(request,obj) and (obj is None or manager.has_view_permission(request,obj.binding) and manager.get_queryset(request).filter(pk=obj.binding_id).exists())

ordloom_wechat-0.1.0/ordloom_wechat/apps.py

@@ -0,0 +1,21 @@
+from django.apps import AppConfig
+from django.conf import settings
+
+
+class ExtensionConfig(AppConfig):
+    name = 'ordloom_wechat'
+    verbose_name = '微信接入'
+    default_auto_field = 'django.db.models.BigAutoField'
+    ordloom_catalog_application = 'ordloom_wechat.extension.application'
+
+    @property
+    def ordloom_application(self):
+        from .configuration import enabled
+        if not enabled():
+            return None
+        return 'ordloom_wechat.extension.application'
+
+    def ready(self):
+        from ordloom_members.sessions import register_session_provider
+        from .services import session_valid
+        register_session_provider('wechat', session_valid)

ordloom_wechat-0.1.0/ordloom_wechat/configuration.py

@@ -0,0 +1,81 @@
+import base64
+import re
+from urllib.parse import urlsplit
+from django.conf import settings
+from django.utils.crypto import salted_hmac
+
+DEFAULTS = {'enabled': False, 'public_origin': '', 'credentials': {}, 'per_minute': 20,
+    'callback_per_minute': 600, 'timestamp_skew': 300, 'receipt_days': 7}
+
+
+class WechatError(Exception):
+    def __init__(self, message, status=400):
+        self.message = message
+        self.status = status
+        super().__init__(message)
+
+
+def options():
+    raw = getattr(settings, 'ORDLOOM_WECHAT', {})
+    if not isinstance(raw, dict) or set(raw) - set(DEFAULTS):
+        raise WechatError('微信接入配置无效', 503)
+    value = {**DEFAULTS, **raw}
+    if type(value['enabled']) is not bool or not isinstance(value['credentials'], dict):
+        raise WechatError('微信接入配置无效', 503)
+    for key, low, high in [('per_minute', 1, 120), ('callback_per_minute', 1, 10000), ('timestamp_skew', 60, 600), ('receipt_days', 1, 90)]:
+        if type(value[key]) is not int or not low <= value[key] <= high:
+            raise WechatError('微信接入预算配置无效', 503)
+    return value
+
+
+def enabled():
+    from django.apps import apps
+    return apps.is_installed('ordloom_wechat') and not {'wechat', 'members'} & set(getattr(settings, 'ORDLOOM_DISABLED_APPS', [])) and options()['enabled']
+
+
+def require_enabled():
+    if not enabled():
+        raise WechatError('微信接入未启用', 404)
+
+
+def public_origin():
+    value = options()['public_origin']
+    if not isinstance(value, str):
+        raise WechatError('请配置微信接入公开地址', 503)
+    parts = urlsplit(value)
+    local = getattr(settings, 'DEBUG', False) and parts.hostname in ('localhost', '127.0.0.1', '::1')
+    if parts.scheme not in (('https', 'http') if local else ('https',)) or not parts.netloc or parts.username or parts.password or parts.path not in ('', '/') or parts.query or parts.fragment:
+        raise WechatError('微信接入公开地址须为可信 HTTPS 源站', 503)
+    return value.rstrip('/')
+
+
+def credentials_for(channel):
+    data = options()['credentials'].get(channel.credential_ref)
+    if not isinstance(data, dict) or data.get('appid') != channel.appid:
+        raise WechatError('渠道服务端凭据未配置或不匹配', 503)
+    cleaned = {'appid': channel.appid}
+    for name in ('app_secret', 'token', 'aes_key'):
+        value = data.get(name, '')
+        if not isinstance(value, str) or len(value) > 256 or any(ord(c) <= 32 for c in value):
+            raise WechatError('渠道服务端凭据格式无效', 503)
+        cleaned[name] = value
+    if (channel.binding_enabled or channel.login_enabled) and not cleaned['app_secret']:
+        raise WechatError('渠道身份接入凭据未配置', 503)
+    if channel.callbacks_enabled:
+        if not re.fullmatch(r'[A-Za-z0-9]{3,32}', cleaned['token']) or not re.fullmatch(r'[A-Za-z0-9_-]{3,128}', channel.original_id):
+            raise WechatError('渠道回调凭据或原始 ID 无效', 503)
+        if channel.encryption == 'aes':
+            try:
+                if len(cleaned['aes_key']) != 43 or len(base64.b64decode(cleaned['aes_key']+'=', validate=True)) != 32:
+                    raise ValueError()
+            except Exception:
+                raise WechatError('渠道 AES 密钥格式无效', 503) from None
+    return cleaned
+
+
+def config_stamp(channel):
+    import json
+    values = {key: getattr(channel, key) for key in ('appid', 'kind', 'credential_ref', 'enabled', 'callbacks_enabled', 'binding_enabled', 'login_enabled', 'encryption', 'original_id')}
+    values['credentials'] = credentials_for(channel)
+    values['public_origin'] = options()['public_origin']
+    return salted_hmac('ordloom-wechat-config', json.dumps(values, sort_keys=True)).hexdigest()

ordloom_wechat-0.1.0/ordloom_wechat/extension.py

@@ -0,0 +1,29 @@
+from django.contrib import admin
+from django.contrib.admin.utils import flatten_fieldsets
+from django.core.exceptions import PermissionDenied
+from django.urls import reverse,NoReverseMatch
+from ordloom.sdk import Application,AppPage,CanvasWidget,AppTask,visible_objects
+from .models import Channel
+from .services import maintenance
+
+
+def overview(request):
+    items=[];manager=admin.site._registry[Channel]
+    for row in visible_objects(request,Channel):
+        if not {'name','appid','kind','enabled','callbacks_enabled','binding_enabled','login_enabled'}<=set(flatten_fieldsets(manager.get_fieldsets(request,row))):
+            raise PermissionDenied('渠道字段当前不可读取')
+        try:callback=reverse('ordloom_wechat:callback',kwargs={'channel_id':row.public_id})
+        except NoReverseMatch:callback=None
+        items.append({'id':str(row.public_id),'name':row.name,'appid':row.appid,'kind':row.get_kind_display(),'enabled':row.enabled,
+            'callbacks_enabled':row.callbacks_enabled,'binding_enabled':row.binding_enabled,'login_enabled':row.login_enabled,'callback_url':callback})
+    try:portal=reverse('ordloom_wechat:portal')
+    except NoReverseMatch:portal=None
+    return {'title':'微信接入概览','items':items,'portal_url':portal}
+
+
+application=Application(id='wechat',label='微信接入',version='0.1.0',asset='ordloom_wechat/extension.js', description='公众号与小程序身份接入、消息回调验签和会员绑定。', category='channel', distribution='ordloom-wechat', documentation_url='https://neekin.github.io/ordloom-docs/guides/wechat.html',requires=('members',), requires_versions={'members':'>=0.1.0,<0.2.0'},
+    pages=(AppPage('overview','微信接入概览',overview,('ordloom_wechat.view_channel',),model='ordloom_wechat.channel'),),
+    widgets=(CanvasWidget('identitylink','微信会员入口',('ordloom_wechat.view_channel',),model='ordloom_wechat.channel',public=True,
+        fields={'title':{'type':'text','label':'入口标题','required':True,'max_length':100},'path':{'type':'text','label':'身份管理路径','required':True,'max_length':1000}},
+        defaults={'title':'管理微信会员身份','path':'/wechat/'}),),
+    tasks=(AppTask('cleanup','微信授权与收件留存维护',maintenance,('ordloom_wechat.view_channel','ordloom_wechat.view_callbackreceipt','ordloom_wechat.purge_callbackreceipt'),model='ordloom_wechat.channel'),))

ordloom_wechat-0.1.0/ordloom_wechat/migrations/0001_initial.py

@@ -0,0 +1,135 @@
+# Generated by Django 5.2.19 on 2026-11-11 21:12
+
+import django.core.validators
+import django.db.models.deletion
+import uuid
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+        ('ordloom_members', '0001_initial'),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='Channel',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('public_id', models.UUIDField(default=uuid.uuid4, editable=False, unique=True)),
+                ('name', models.CharField(max_length=100, verbose_name='渠道名称')),
+                ('kind', models.CharField(choices=[('official', '公众号'), ('mini', '小程序')], max_length=12, verbose_name='类型')),
+                ('appid', models.CharField(max_length=32, unique=True, validators=[django.core.validators.RegexValidator('^wx[A-Za-z0-9]{16}$')], verbose_name='AppID')),
+                ('original_id', models.CharField(blank=True, max_length=128, verbose_name='微信原始 ID')),
+                ('credential_ref', models.SlugField(verbose_name='服务端凭据引用')),
+                ('enabled', models.BooleanField(default=False, verbose_name='启用')),
+                ('callbacks_enabled', models.BooleanField(default=False, verbose_name='消息回调')),
+                ('binding_enabled', models.BooleanField(default=False, verbose_name='允许新绑定')),
+                ('login_enabled', models.BooleanField(default=False, verbose_name='允许绑定会员登录')),
+                ('encryption', models.CharField(choices=[('aes', 'AES 安全模式'), ('plain', '明文模式')], default='aes', max_length=8, verbose_name='回调模式')),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+            ],
+            options={
+                'verbose_name': '微信渠道',
+                'verbose_name_plural': '微信渠道',
+                'permissions': [('configure_channel', '可配置微信渠道与接入开关')],
+            },
+        ),
+        migrations.CreateModel(
+            name='AuthFlow',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('state_hash', models.CharField(max_length=64, unique=True)),
+                ('session_hash', models.CharField(db_index=True, max_length=64)),
+                ('config_stamp', models.CharField(max_length=64)),
+                ('intent', models.CharField(max_length=8)),
+                ('member_auth_hash', models.CharField(blank=True, max_length=128)),
+                ('expires_at', models.DateTimeField(db_index=True)),
+                ('used_at', models.DateTimeField(null=True)),
+                ('member', models.ForeignKey(null=True, on_delete=django.db.models.deletion.CASCADE, to='ordloom_members.member')),
+                ('channel', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='ordloom_wechat.channel')),
+            ],
+        ),
+        migrations.CreateModel(
+            name='IdentityBinding',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('public_id', models.UUIDField(default=uuid.uuid4, editable=False, unique=True)),
+                ('openid', models.CharField(editable=False, max_length=128, verbose_name='OpenID')),
+                ('unionid', models.CharField(blank=True, editable=False, max_length=128, verbose_name='UnionID（不自动合并）')),
+                ('session_version', models.PositiveIntegerField(default=1, editable=False)),
+                ('bound_at', models.DateTimeField(editable=False, null=True, verbose_name='最近绑定时间')),
+                ('updated_at', models.DateTimeField(auto_now=True)),
+                ('channel', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='bindings', to='ordloom_wechat.channel', verbose_name='渠道')),
+                ('member', models.ForeignKey(blank=True, null=True, on_delete=django.db.models.deletion.PROTECT, related_name='wechat_bindings', to='ordloom_members.member', verbose_name='会员')),
+            ],
+            options={
+                'verbose_name': '微信会员绑定',
+                'verbose_name_plural': '微信会员绑定',
+                'permissions': [('revoke_identitybinding', '可撤销微信会员绑定')],
+            },
+        ),
+        migrations.CreateModel(
+            name='BindingEvent',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('action', models.CharField(choices=[('bind', '绑定'), ('unbind', '会员解绑'), ('revoke', '后台撤销')], max_length=12, verbose_name='操作')),
+                ('created_at', models.DateTimeField(auto_now_add=True, verbose_name='发生时间')),
+                ('actor', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, to=settings.AUTH_USER_MODEL)),
+                ('member', models.ForeignKey(null=True, on_delete=django.db.models.deletion.SET_NULL, to='ordloom_members.member')),
+                ('binding', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='events', to='ordloom_wechat.identitybinding')),
+            ],
+            options={
+                'verbose_name': '微信绑定记录',
+                'verbose_name_plural': '微信绑定记录',
+            },
+        ),
+        migrations.CreateModel(
+            name='CallbackReceipt',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('public_id', models.UUIDField(default=uuid.uuid4, editable=False, unique=True)),
+                ('dedupe_key', models.CharField(editable=False, max_length=64)),
+                ('body_digest', models.CharField(editable=False, max_length=64, verbose_name='内容摘要')),
+                ('sender', models.CharField(editable=False, max_length=128, verbose_name='发送方 OpenID')),
+                ('message_id', models.CharField(blank=True, editable=False, max_length=128, verbose_name='消息编号')),
+                ('message_type', models.CharField(editable=False, max_length=40, verbose_name='消息类型')),
+                ('event', models.CharField(blank=True, editable=False, max_length=64, verbose_name='事件类型')),
+                ('content', models.TextField(blank=True, editable=False, max_length=4096, verbose_name='文本内容')),
+                ('encrypted', models.BooleanField(editable=False, verbose_name='已通过密文验签')),
+                ('received_at', models.DateTimeField(auto_now_add=True, db_index=True, verbose_name='接收时间')),
+                ('channel', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, related_name='receipts', to='ordloom_wechat.channel', verbose_name='渠道')),
+            ],
+            options={
+                'verbose_name': '微信回调收件',
+                'verbose_name_plural': '微信回调收件',
+                'permissions': [('purge_callbackreceipt', '可执行微信临时记录与收件留存清理')],
+                'constraints': [models.UniqueConstraint(fields=('channel', 'dedupe_key'), name='ordloom_wx_callback_once')],
+            },
+        ),
+        migrations.CreateModel(
+            name='CodeUse',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('code_hash', models.CharField(max_length=64)),
+                ('expires_at', models.DateTimeField(db_index=True)),
+                ('channel', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to='ordloom_wechat.channel')),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(fields=('channel', 'code_hash'), name='ordloom_wx_code_once')],
+            },
+        ),
+        migrations.AddConstraint(
+            model_name='identitybinding',
+            constraint=models.UniqueConstraint(fields=('channel', 'openid'), name='ordloom_wx_openid'),
+        ),
+        migrations.AddConstraint(
+            model_name='identitybinding',
+            constraint=models.UniqueConstraint(fields=('channel', 'member'), name='ordloom_wx_member'),
+        ),
+    ]

ordloom_wechat-0.1.0/ordloom_wechat/models.py

@@ -0,0 +1,118 @@
+import uuid
+from django.conf import settings
+from django.core.exceptions import ValidationError
+from django.core.validators import RegexValidator
+from django.db import models, transaction
+
+
+class Channel(models.Model):
+    public_id = models.UUIDField(default=uuid.uuid4, unique=True, editable=False)
+    name = models.CharField('渠道名称', max_length=100)
+    kind = models.CharField('类型', max_length=12, choices=[('official', '公众号'), ('mini', '小程序')])
+    appid = models.CharField('AppID', max_length=32, unique=True, validators=[RegexValidator(r'^wx[A-Za-z0-9]{16}$')])
+    original_id = models.CharField('微信原始 ID', max_length=128, blank=True)
+    credential_ref = models.SlugField('服务端凭据引用', max_length=50)
+    enabled = models.BooleanField('启用', default=False)
+    callbacks_enabled = models.BooleanField('消息回调', default=False)
+    binding_enabled = models.BooleanField('允许新绑定', default=False)
+    login_enabled = models.BooleanField('允许绑定会员登录', default=False)
+    encryption = models.CharField('回调模式', max_length=8, choices=[('aes', 'AES 安全模式'), ('plain', '明文模式')], default='aes')
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name = '微信渠道'
+        verbose_name_plural = verbose_name
+        permissions = [('configure_channel', '可配置微信渠道与接入开关')]
+
+    def __str__(self):
+        return self.name
+
+    def clean(self):
+        super().clean()
+        if self.enabled:
+            from .configuration import credentials_for, WechatError
+            try:
+                credentials_for(self)
+            except WechatError as error:
+                raise ValidationError(error.message) from None
+
+    def save(self, *args, **kwargs):
+        with transaction.atomic():
+            old = type(self).objects.select_for_update().filter(pk=self.pk).first() if self.pk else None
+            if old and (old.appid != self.appid or old.kind != self.kind):
+                raise ValidationError('已有渠道的 AppID 和类型固定，请新建渠道')
+            return super().save(*args, **kwargs)
+
+
+class IdentityBinding(models.Model):
+    public_id = models.UUIDField(default=uuid.uuid4, unique=True, editable=False)
+    channel = models.ForeignKey(Channel, on_delete=models.PROTECT, related_name='bindings', verbose_name='渠道')
+    openid = models.CharField('OpenID', max_length=128, editable=False)
+    unionid = models.CharField('UnionID（不自动合并）', max_length=128, blank=True, editable=False)
+    member = models.ForeignKey('ordloom_members.Member', on_delete=models.PROTECT, null=True, blank=True, related_name='wechat_bindings', verbose_name='会员')
+    session_version = models.PositiveIntegerField(default=1, editable=False)
+    bound_at = models.DateTimeField('最近绑定时间', null=True, editable=False)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    class Meta:
+        verbose_name = '微信会员绑定'
+        verbose_name_plural = verbose_name
+        constraints = [models.UniqueConstraint(fields=['channel', 'openid'], name='ordloom_wx_openid'),
+            models.UniqueConstraint(fields=['channel', 'member'], name='ordloom_wx_member')]
+        permissions = [('revoke_identitybinding', '可撤销微信会员绑定')]
+
+    def __str__(self):
+        return str(self.public_id)
+
+
+class BindingEvent(models.Model):
+    binding = models.ForeignKey(IdentityBinding, on_delete=models.PROTECT, related_name='events')
+    member = models.ForeignKey('ordloom_members.Member', on_delete=models.SET_NULL, null=True)
+    actor = models.ForeignKey(settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True)
+    action = models.CharField('操作', max_length=12, choices=[('bind', '绑定'), ('unbind', '会员解绑'), ('revoke', '后台撤销')])
+    created_at = models.DateTimeField('发生时间', auto_now_add=True)
+
+    class Meta:
+        verbose_name = '微信绑定记录'
+        verbose_name_plural = verbose_name
+
+
+class AuthFlow(models.Model):
+    channel = models.ForeignKey(Channel, on_delete=models.CASCADE)
+    state_hash = models.CharField(max_length=64, unique=True)
+    session_hash = models.CharField(max_length=64, db_index=True)
+    config_stamp = models.CharField(max_length=64)
+    intent = models.CharField(max_length=8)
+    member = models.ForeignKey('ordloom_members.Member', on_delete=models.CASCADE, null=True)
+    member_auth_hash = models.CharField(max_length=128, blank=True)
+    expires_at = models.DateTimeField(db_index=True)
+    used_at = models.DateTimeField(null=True)
+
+
+class CodeUse(models.Model):
+    channel = models.ForeignKey(Channel, on_delete=models.CASCADE)
+    code_hash = models.CharField(max_length=64)
+    expires_at = models.DateTimeField(db_index=True)
+
+    class Meta:
+        constraints = [models.UniqueConstraint(fields=['channel', 'code_hash'], name='ordloom_wx_code_once')]
+
+
+class CallbackReceipt(models.Model):
+    public_id = models.UUIDField(default=uuid.uuid4, unique=True, editable=False)
+    channel = models.ForeignKey(Channel, on_delete=models.PROTECT, related_name='receipts', verbose_name='渠道')
+    dedupe_key = models.CharField(max_length=64, editable=False)
+    body_digest = models.CharField('内容摘要', max_length=64, editable=False)
+    sender = models.CharField('发送方 OpenID', max_length=128, editable=False)
+    message_id = models.CharField('消息编号', max_length=128, blank=True, editable=False)
+    message_type = models.CharField('消息类型', max_length=40, editable=False)
+    event = models.CharField('事件类型', max_length=64, blank=True, editable=False)
+    content = models.TextField('文本内容', blank=True, max_length=4096, editable=False)
+    encrypted = models.BooleanField('已通过密文验签', editable=False)
+    received_at = models.DateTimeField('接收时间', auto_now_add=True, db_index=True)
+
+    class Meta:
+        verbose_name = '微信回调收件'
+        verbose_name_plural = verbose_name
+        constraints = [models.UniqueConstraint(fields=['channel', 'dedupe_key'], name='ordloom_wx_callback_once')]
+        permissions = [('purge_callbackreceipt', '可执行微信临时记录与收件留存清理')]