Upload 30 files

app.py

@@ -1,676 +1,708 @@
-# ⚙️ 后端逻辑/核心服务端.py (Hugging Face Spaces app.py)
-from runtime_log_privacy import install_uvicorn_privacy_filters, route_label, RequestTraceMiddleware
-install_uvicorn_privacy_filters()
-
-from fastapi import FastAPI, File, UploadFile, Form, Depends, HTTPException, Request
-from rate_limit import shared_limit
-from response_privacy import requires_no_store
-from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import Response, JSONResponse, FileResponse 
-from sqlalchemy.orm import Session
-from pydantic import BaseModel
-from huggingface_hub import hf_hub_download, HfApi
-import uuid
-import urllib.parse
-import urllib.request
-import urllib.error
-import os
-import json
-import logging
-import time
-import datetime
-import threading
-import 数据库连接 as db
-import asyncio
-from 安全认证 import require_auth
-from profile_io import start_profile_io, close_profile_io
-from script_execution import start_admin_scripts, stop_admin_scripts, close_admin_scripts
-from comment_store import start_comment_reads, stop_comment_reads, close_comment_reads
-from periodic_tasks import start_periodic_task, request_periodic_stop, wait_periodic_tasks
-from owned_thread import run_owned_thread
-
-
-# ==========================================
-# 📝 P2优化：日志配置
-# ==========================================
-logging.basicConfig(
-    level=logging.INFO,
-    format='%(asctime)s | %(levelname)s | %(name)s | %(message)s',
-    datefmt='%Y-%m-%d %H:%M:%S'
-)
-logger = logging.getLogger("ComfyUI-Ranking")
-_UPLOAD_CONCURRENCY = max(1, min(int(os.environ.get("MAX_CONCURRENT_UPLOADS", "4")), 16))
-_UPLOAD_SEMAPHORE = threading.BoundedSemaphore(_UPLOAD_CONCURRENCY)
-
-
-from 云端_定时版本检测引擎 import daily_version_check_task, reset_daily_views_task
-
-# ==========================================
-# 👥 用户模块 (拆分为3个子模块)
-# ==========================================
-# router_users_auth.py    - 🔐 登录/注册/密码重置/验证码
-# router_users_profile.py - 👤 获取/更新用户资料
-# router_users_social.py  - 🤝 关注/隐私设置
-from router_users_auth import router as users_auth_router
-from router_users_profile import router as users_profile_router
-from router_users_social import router as users_social_router
-
-# ==========================================
-# 其他业务模块
-# ==========================================
-from router_items import router as items_router       # 📦 内容管理(工具/Skill/应用/推荐)
-from router_comments import router as comments_router # 💬 评论系统
-from router_messages import router as messages_router # ✉️ 私信系统
-from router_wallet import router as wallet_router     # 💰 钱包/提现
-from router_proxy import router as proxy_router       # 🔗 代理下载
-from router_posts import router as posts_router       # 💬 讨论区
-from router_prompts import router as prompts_router   # ✨ 提示词市场
-from router_tasks import router as tasks_router       # 📝 任务榜
-from router_open_api import router as open_api_router  # 🌐 通用开放API（第三方插件）
-from router_admin_plugins import router as admin_plugins_router  # 🔒 管理后台 - 第三方插件管理API
-
-from database_sql import init_sql_db, get_db, SessionLocal
-from models_sql import SystemConfig  # 🧹 P2清理：Ownership 在本文件无引用
-
-from fastapi.exceptions import RequestValidationError
-from starlette.exceptions import HTTPException as StarletteHTTPException
-
-app = FastAPI(
-    title="ComfyUI Ranking API",
-    description="ComfyUI 社区排名系统 API",
-    version="2.0.0",
-    docs_url="/api/docs",
-    redoc_url="/api/redoc"
-)
-
-
-# ==========================================
-# 🛡️ 稳定性优化：全局异常处理器
-# ==========================================
-# 作用：捕获所有未处理异常，防止单个请求崩溃整个服务
-# 🚀 P3优化：统一错误响应格式
-
-def create_error_response(status_code: int, detail: str, error_type: str = None, error_id: str = None, extra: dict = None):
-    """🚀 P3优化：统一错误响应构造器"""
-    response = {
-        "success": False,
-        "status": "error",
-        "code": status_code,
-        "detail": detail,
-    }
-    if error_type:
-        response["type"] = error_type
-    if error_id:
-        response["error_id"] = error_id
-    if extra:
-        response.update(extra)
-    return response
-
-@app.exception_handler(StarletteHTTPException)
-async def http_exception_handler(request, exc):
-    """🚀 P3优化：HTTP 异常处理，返回统一格式"""
-    logger.warning(f"HTTP {exc.status_code} | {route_label(request)} | detail_type={type(exc.detail).__name__}")
-    
-    # 根据状态码确定错误类型
-    error_type_map = {
-        400: "bad_request",
-        401: "unauthorized",
-        403: "forbidden",
-        404: "not_found",
-        409: "conflict",
-        429: "rate_limited",
-        502: "upstream_error",
-    }
-    error_type = error_type_map.get(exc.status_code, "http_error")
-    
-    return JSONResponse(
-        status_code=exc.status_code,
-        content=create_error_response(exc.status_code, str(exc.detail), error_type),
-        headers={"X-Ranking-Error-Scope": "endpoint"} if exc.status_code == 503 else None,
-    )
-
-from upload_body_guard import UploadBodyGuard
-app.add_middleware(UploadBodyGuard, capacity=_UPLOAD_CONCURRENCY, error_response=create_error_response)
-
-from public_list_etag import PublicListETag
-app.add_middleware(PublicListETag)
-
-@app.middleware("http")
-async def private_response_cache_control(request: Request, call_next):
-    response = await call_next(request)
-    if requires_no_store(request.url.path, request.headers.get("Authorization")):
-        response.headers["Cache-Control"] = "no-store"
-        vary = [name.strip() for name in response.headers.get("Vary", "").split(",") if name.strip()]
-        if not any(name.lower() in {"authorization", "*"} for name in vary):
-            vary.append("Authorization")
-        response.headers["Vary"] = ", ".join(vary)
-    return response
-
-
-@app.exception_handler(RequestValidationError)
-async def validation_exception_handler(request, exc):
-    """🚀 P3优化：请求参数校验失败处理"""
-    logger.warning("Validation Error | %s | count=%d", route_label(request), len(exc.errors()))
-    
-    # 提取简洁的错误信息
-    errors = []
-    for err in exc.errors():
-        field = ".".join(str(loc) for loc in err["loc"][1:])  # 跳过 'body'
-        errors.append({"field": field, "message": "该字段格式不正确", "type": err["type"]})
-    
-    return JSONResponse(
-        status_code=422,
-        content=create_error_response(
-            422, 
-            "请求参数格式错误", 
-            "validation_error",
-            extra={"errors": errors}
-        )
-    )
-
-@app.exception_handler(Exception)
-async def global_exception_handler(request, exc):
-    """🚀 P3优化：全局异常处理，捕获所有未预期异常"""
-    error_id = getattr(request.state, 'ranking_request_id', None) or uuid.uuid4().hex
-    logger.error(f"Unhandled Exception [{error_id}] | {route_label(request)} | error_type={type(exc).__name__}")
-    return JSONResponse(
-        status_code=500,
-        content=create_error_response(
-            500,
-            "服务器内部错误，请稍后重试",
-            "internal_error",
-            error_id=error_id
-        ),
-        headers={"X-Ranking-Request-Id": error_id}
-    )
-
-
-# ==========================================
-# ❤️ 健康检查接口 (增强版)
-# ==========================================
-@app.get("/")
-def health_check():
-    return {"status": "ok", "message": "ComfyUI Ranking API is running perfectly!"}
-
-@app.get("/health")
-def detailed_health_check():
-    """详细健康检查，含依赖状态"""
-    health_status = {
-        "status": "ok",
-        "components": {}
-    }
-    
-    # 检查 SQL 数据库
-    try:
-        from database_sql import check_db_connection
-        if check_db_connection():
-            health_status["components"]["sql_database"] = "ok"
-        else:
-            health_status["components"]["sql_database"] = "error: connection failed"
-            health_status["status"] = "degraded"
-    except Exception as e:
-        logger.warning(f"健康检查 SQL 数据库异常: error_type={type(e).__name__}")
-        health_status["components"]["sql_database"] = "error: connection failed"
-        health_status["status"] = "degraded"
-    
-    # 检查 JSON 文件访问
-    try:
-        import 数据库连接 as json_db
-        json_db.load_data("users.json", default_data={})
-        health_status["components"]["json_storage"] = "ok"
-    except Exception as e:
-        logger.warning(f"健康检查 JSON 存储异常: error_type={type(e).__name__}")
-        health_status["components"]["json_storage"] = "error: storage unavailable"
-        health_status["status"] = "degraded"
-    
-    return health_status
-
-# ==========================================
-# 🚀 应用启动事件
-# ==========================================
-# 作用：初始化数据库 + 启动定时版本检测后台任务 + 预热检查
-@app.on_event("startup")
-async def on_startup():
-    logger.info("🚀 ComfyUI-Ranking API 启动中...")
-    if getattr(app.state, "_ranking_starting", False) or getattr(app.state, "_ranking_closers", 0):
-        raise RuntimeError("application lifecycle is already in progress")
-    if getattr(app.state, "_ranking_started", False):
-        return
-    app.state._ranking_starting = True
-    try:
-        start_profile_io()
-        try:
-            start_comment_reads()
-            start_admin_scripts()
-
-            # ========== 预热检查：SQL 数据库 ==========
-            try:
-                init_sql_db()
-                logger.info("✅ SQL 数据库初始化完成")
-            except Exception as e:
-                logger.error(f"❌ SQL 数据库初始化失败: error_type={type(e).__name__}")
-                # 不抛出异常，允许降级运行
-
-            # ========== 加载第三方插件注册表（依赖 SQL 数据库） ==========
-            try:
-                from router_open_api import load_plugins_from_db
-                load_plugins_from_db()
-                logger.info("✅ 第三方插件注册表已加载")
-            except Exception as e:
-                logger.warning(f"⚠️ 第三方插件注册表加载失败: error_type={type(e).__name__}")
-
-            # ========== 预热检查：JSON 数据库 ==========
-            try:
-                db.load_data("users.json", default_data={})
-                db.load_data("items.json", default_data=[])
-                logger.info("✅ JSON 数据库访问正常")
-            except Exception as e:
-                logger.warning(f"⚠️ JSON 数据库访问异常: error_type={type(e).__name__}")
-
-            # SQL资金已冻结但JSON发布失败的任务，重启后继续投影；持有句柄供停机收尾。
-            from task_publication import publication_worker
-            from database_sql import engine
-            from db_utils import sort_cache
-            start_periodic_task(app.state, "task_publication",
-                lambda stop: publication_worker(engine, db, sort_cache.invalidate, stop))
-
-            from resource_publication import publication_worker as resource_publication_worker
-            start_periodic_task(app.state, "resource_publication",
-                lambda stop: resource_publication_worker(engine, db, sort_cache.invalidate, stop))
-
-            from resource_deletion import resource_deletion_worker
-            start_periodic_task(app.state, "resource_deletion",
-                lambda stop: resource_deletion_worker(db, stop, sort_cache.invalidate))
-
-            # ========== 启动后台任务 ==========
-            start_periodic_task(app.state, "daily_version", daily_version_check_task)
-            logger.info("✅ 定时版本检测任务已挂载")
-
-            start_periodic_task(app.state, "daily_views", reset_daily_views_task)
-            logger.info("✅ daily_views 每日重置任务已挂载")
-
-            # ========== 启动 HF 批量同步定时器 ==========
-            db.start_batch_sync()
-            logger.info("✅ HF 同步调度初始化已完成")
-
-            app.state._ranking_started = True
-            logger.info("🎉 ComfyUI-Ranking API 启动完成!")
-        except BaseException:
-            # 启动可能只登记了部分句柄；正常关闭按已登记对象收尾。
-            try:
-                await on_shutdown()
-            except BaseException as error:
-                logger.error("启动收尾失败: error_type=%s", type(error).__name__)
-            raise
-    finally:
-        app.state._ranking_starting = False
-
-
-@app.on_event("shutdown")
-async def on_shutdown():
-    """优雅关闭，清理资源"""
-    logger.info("🛑 ComfyUI-Ranking API 正在关闭...")
-
-    app.state._ranking_closers = getattr(app.state, "_ranking_closers", 0) + 1
-    try:
-        app.state._ranking_started = False
-        stop_admin_scripts()
-        stop_comment_reads()
-        workers = request_periodic_stop(app.state, (
-            "daily_version", "daily_views", "task_publication", "resource_publication", "resource_deletion"))
-
-        # 关闭等待被取消也先收尾全部所属工作，之后传播取消；不提前最终同步。
-        cancelled = None
-        try:
-            await close_profile_io()
-        except asyncio.CancelledError as error:
-            cancelled = error
-        try:
-            await close_admin_scripts()
-        except asyncio.CancelledError as error:
-            cancelled = error
-        try:
-            await close_comment_reads()
-        except asyncio.CancelledError as error:
-            cancelled = error
-        try:
-            await wait_periodic_tasks(workers)
-        except asyncio.CancelledError as error:
-            cancelled = error
-        if cancelled is not None:
-            raise cancelled
-
-        # ========== 关闭前同步所有脏文件 ==========
-        await run_owned_thread(db.flush_sync)
-        logger.info("✅ HF 关闭前同步尝试已结束")
-
-        # 这里可以添加其他清理逻辑（如关闭连接池等）
-        logger.info("✅ 关闭完成")
-    finally:
-        app.state._ranking_closers -= 1
-
-# 🛡️ CORS 配置：默认通配符（插件前端运行于用户本地 ComfyUI 页面，origin 为
-# 127.0.0.1/localhost/局域网 IP/自定义端口等无法穷举；本 API 通过 Authorization 头
-# 传递 Token 且 allow_credentials=False 不依赖 Cookie���通配风险可控）。
-# 如需收紧可在环境变量 ALLOWED_ORIGINS 中逗号分隔指定域名。
-ALLOWED_ORIGINS = os.environ.get("ALLOWED_ORIGINS", "*").split(",")
-logger.info(
-    f"CORS 配置已加载: origin_count={len(ALLOWED_ORIGINS)} | "
-    f"wildcard={len(ALLOWED_ORIGINS) == 1 and ALLOWED_ORIGINS[0] == '*'}"
-)
-
-app.add_middleware(
-    CORSMiddleware,
-    allow_origins=ALLOWED_ORIGINS,
-    allow_credentials=False, 
-    allow_methods=["*"],
-    allow_headers=["*"],
-    expose_headers=["ETag", "X-Ranking-Error-Scope", "X-Ranking-Request-Id"],
-)
-app.add_middleware(RequestTraceMiddleware)
-
-# ==========================================
-# 路由挂载
-# ==========================================
-# 用户模块 (3个子模块)
-app.include_router(users_auth_router)     # 🔐 登录/注册/密码重置
-app.include_router(users_profile_router)  # 👤 用户资料
-app.include_router(users_social_router)   # 🤝 关注/隐私
-
-# 其他业务模块
-app.include_router(items_router)          # 📦 内容管理
-app.include_router(comments_router)       # 💬 评论系统
-app.include_router(messages_router)       # ✉️ 私信系统
-app.include_router(wallet_router)         # 💰 钱包/提现
-app.include_router(proxy_router)          # 🔗 代理下载
-app.include_router(posts_router)          # 💬 讨论区
-app.include_router(prompts_router)        # ✨ 提示词市场
-app.include_router(tasks_router)          # 📝 任务榜
-app.include_router(open_api_router)       # 🌐 通用开放API（供第三方插件调用）
-app.include_router(admin_plugins_router)  # 🔒 管理后台 - 第三方插件管理API
-
-# ==========================================
-# 🟢 私有图床代理中心 (Image Proxy)
-# 解决 Private 仓库下，本地客户端报 401 Unauthorized 的终极方案
-# ==========================================
-from media_proxy_service import read_public_media
-
-@app.get("/api/image_proxy")
-def proxy_hf_image(url: str = None, path: str = None):
-    return read_public_media(url, path, store=db, download=hf_hub_download,
-                             file_response=FileResponse, error_response=create_error_response)
-
-# ==========================================
-# 上传接口 (将返回的 URL 替换为 Proxy 代理链接)
-# 🔒 P0安全优化：集成图片内容审核
-# ==========================================
-from image_moderation import moderate_image_sync, ModerationResult
-
-# ==========================================
-# 🎵 音频安全净化：重编码压缩，剥离元数据与隐藏附加信息
-# ==========================================
-from upload_service import process_upload
-
-@app.post("/api/upload")
-@shared_limit(30)
-def upload_file(request: Request, file: UploadFile = File(...), file_type: str = Form(...), current_user: str = Depends(require_auth)):
-    return process_upload(file, file_type, current_user, store=db, storage_factory=HfApi,
-                          moderate=moderate_image_sync, limiter=_UPLOAD_SEMAPHORE,
-                          error_response=create_error_response)
-
-
-
-from github_source import select_github_token
-
-
-class ValidateResourceRequest(BaseModel):
-    url: str
-    item_id: str
-    account: str
-
-from resource_probe_service import probe_resource
-from github_probe_transport import open_github_probe
-from skill_preflight import verify_skill_repository
-from router_proxy import _send_with_validated_redirects
-from safe_http_transport import ValidatedAsyncHTTPTransport
-import httpx
-
-
-def _probe_skill_repository(item, token):
-    return verify_skill_repository(item, token, send=_send_with_validated_redirects,
-        client_factory=httpx.AsyncClient, transport_factory=ValidatedAsyncHTTPTransport)
-
-@app.post("/api/validate_resource")
-@shared_limit(30)
-def validate_resource(req_data: ValidateResourceRequest, request: Request, sql_db: Session = Depends(get_db), current_user: str = Depends(require_auth)):
-    return probe_resource(req_data.item_id, store=db, download=hf_hub_download,
-                          open_url=open_github_probe, token_selector=select_github_token,
-                          error_response=create_error_response, skill_probe=_probe_skill_repository)
-
-# ==========================================
-# 🔒 管理员：系统配置 API
-# ==========================================
-from 安全认证 import require_auth, ADMIN_ACCOUNTS
-
-def _is_admin(account: str) -> bool:
-    """检查账号是否为管理员"""
-    from 安全认证 import is_admin as _check_admin
-    return _check_admin(account)
-
-# 配置存储文件
-SYSTEM_CONFIG_FILE = "/tmp/system_config.json"  # 保留作为降级方案
-
-def _load_system_config_from_db(db: Session, *, strict: bool = False) -> dict:
-    """从数据库加载所有系统配置"""
-    try:
-        configs = db.query(SystemConfig).all()
-        result = {}
-        for cfg in configs:
-            try:
-                result[cfg.config_key] = json.loads(cfg.config_value)
-            except (json.JSONDecodeError, TypeError):
-                result[cfg.config_key] = cfg.config_value
-        return result
-    except Exception as e:
-        logger.warning(f"从数据库加载系统配置失败，降级到文件: error_type={type(e).__name__}")
-        if strict:
-            return _load_system_config_from_file(strict=True)
-        return _load_system_config_from_file()
-
-def _load_system_config_from_file(*, strict: bool = False) -> dict:
-    """降级方案；严格读取不把故障或缺失文件冒充空配置。"""
-    if strict:
-        with open(SYSTEM_CONFIG_FILE, "r", encoding="utf-8") as stream:
-            config = json.load(stream)
-        if not isinstance(config, dict):
-            raise ValueError("invalid system configuration root")
-        return config
-    try:
-        if os.path.exists(SYSTEM_CONFIG_FILE):
-            with open(SYSTEM_CONFIG_FILE, "r") as f:
-                return json.load(f)
-    except Exception as e:
-        logger.debug(f"加载系统配置文件失败: error_type={type(e).__name__}")
-    return {}
-
-def _save_system_config_to_db(db: Session, config_key: str, value, updated_by: str = None, *, strict: bool = False):
-    """保存单个配置项到数据库"""
-    try:
-        cfg = db.query(SystemConfig).filter(SystemConfig.config_key == config_key).first()
-        if not cfg:
-            cfg = SystemConfig(config_key=config_key)
-            db.add(cfg)
-        cfg.config_value = json.dumps(value, ensure_ascii=False, allow_nan=not strict)
-        cfg.updated_by = updated_by
-        cfg.updated_at = datetime.datetime.utcnow()
-        db.commit()
-    except Exception as e:
-        if strict:
-            # commit异常可能发生在真实提交之后；回滚不能证明尚未保存。
-            try:
-                db.rollback()
-            except Exception:
-                logger.warning("SYSTEM_CONFIG_ROLLBACK_UNCONFIRMED")
-            raise
-        db.rollback()
-        logger.warning(f"保存系统配置到数据库失败，降级到文件: error_type={type(e).__name__}")
-        # 降级：保存到文件
-        config = _load_system_config_from_file()
-        config[config_key] = value
-        try:
-            with open(SYSTEM_CONFIG_FILE, "w") as f:
-                json.dump(config, f, ensure_ascii=False)
-        except Exception as fe:
-            logger.warning(f"降级保存系统配置文件也失败: error_type={type(fe).__name__}")
-
-# 兼容旧调用的包装函数
-def _load_system_config(db: Session = None, *, strict: bool = False) -> dict:
-    """加载系统配置（优先数据库，降级文件）；严格模式保留故障。"""
-    if strict:
-        if db is not None:
-            return _load_system_config_from_db(db, strict=True)
-        temp_db = SessionLocal()
-        try:
-            return _load_system_config_from_db(temp_db, strict=True)
-        finally:
-            temp_db.close()
-    if db:
-        return _load_system_config_from_db(db)
-    # 无 db session 时（如公开端点），创建临时 session
-    temp_db = SessionLocal()
-    try:
-        return _load_system_config_from_db(temp_db)
-    except Exception:
-        return _load_system_config_from_file()
-    finally:
-        temp_db.close()
-
-def _save_system_config(config: dict, db: Session = None, updated_by: str = None):
-    """保存系统配置（优先数据库，降级文件）"""
-    if db:
-        for key, value in config.items():
-            _save_system_config_to_db(db, key, value, updated_by)
-        return
-    # 无 db session 时，创建临时 session
-    temp_db = SessionLocal()
-    try:
-        for key, value in config.items():
-            _save_system_config_to_db(temp_db, key, value, updated_by)
-    except Exception:
-        pass
-    finally:
-        temp_db.close()
-
-
-@app.get("/api/admin/config/{config_key}")
-async def get_system_config(config_key: str, current_user: str = Depends(require_auth), db: Session = Depends(get_db)):
-    """ 🔒 获取系统配置（仅管理员） """
-    # 🔒 权限验证
-    if not _is_admin(current_user):
-        raise HTTPException(status_code=403, detail="无权访问系统配置，仅管理员可操作")
-    
-    def reject_constant(_value):
-        raise ValueError("invalid configuration constant")
-    try:
-        # 管理回读用于确认SQL保存结果，不能用另一个来源的旧值代替。
-        storage_key = "image_moderation_enabled" if config_key == "image_moderation" else config_key
-        row = db.query(SystemConfig).filter(SystemConfig.config_key == storage_key).first()
-        value = None if row is None else json.loads(row.config_value, parse_constant=reject_constant)
-        if config_key == "image_moderation":
-            if row is None:
-                from image_moderation import _is_moderation_enabled
-                value = _is_moderation_enabled()
-            if type(value) is not bool:
-                raise ValueError("invalid moderation configuration")
-            value = {"enabled": value}
-    except Exception:
-        raise HTTPException(status_code=503, detail="config_read_unavailable") from None
-    return {"status": "success", "data": value}
-
-
-# 🏷️ 版本配置默认值
-DEFAULT_VERSION_CONFIG = {
-    "stage": "beta",
-    "major": 2,
-    "minor": 0,
-    "patch": 0
-}
-
-
-@app.get("/api/public/project-version")
-async def get_public_project_version(db: Session = Depends(get_db)):
-    """获取项目版本信息（公开接口，无需认证）"""
-    config = _load_system_config(db)
-    version_data = config.get("project_version", DEFAULT_VERSION_CONFIG)
-    return {"status": "success", "data": version_data}
-
-
-@app.get("/api/public/banner_config")
-async def get_public_banner_config(db: Session = Depends(get_db)):
-    """公开接口：获取广告横幅配置（所有已登录/未登录用户均可访问）"""
-    try:
-        config = _load_system_config(db, strict=True)
-        if not isinstance(config, dict):
-            raise ValueError("invalid system configuration root")
-        banner = config.get("banner_config")
-        if banner is None:
-            return {"status": "success", "data": None}
-        if not isinstance(banner, dict) or type(banner.get("enabled")) is not bool:
-            raise ValueError("invalid banner configuration")
-        if not banner["enabled"]:
-            return {"status": "success", "data": None}
-        # 只投影展示字段，异常配置不能触发浏览器清除旧横幅。
-        result = {"enabled": True}
-        for field in ("bannerImage", "title", "description", "detailImage", "detailContent", "link"):
-            value = banner.get(field, "")
-            if not isinstance(value, str):
-                raise ValueError("invalid banner display field")
-            result[field] = value
-        if not result["bannerImage"].strip():
-            raise ValueError("missing banner image")
-        return {"status": "success", "data": result}
-    except Exception:
-        raise HTTPException(status_code=503, detail="banner_config_unavailable") from None
-
-
-@app.put("/api/admin/config/{config_key}")
-async def set_system_config(config_key: str, value: dict, current_user: str = Depends(require_auth), db: Session = Depends(get_db)):
-    """ 🔒 设置系统配置（仅管理员） """
-    # 🔒 权限验证
-    if not _is_admin(current_user):
-        raise HTTPException(status_code=403, detail="无权修改系统配置，仅管理员可操作")
-    storage_key = config_key
-    storage_value = value
-    if config_key == "image_moderation":
-        if set(value) != {"enabled"} or type(value["enabled"]) is not bool:
-            raise HTTPException(status_code=400, detail="invalid_moderation_configuration")
-        storage_key = "image_moderation_enabled"
-        storage_value = value["enabled"]
-    try:
-        _save_system_config_to_db(db, storage_key, storage_value, updated_by=current_user, strict=True)
-    except Exception:
-        raise HTTPException(status_code=503, detail="config_save_unconfirmed") from None
-    return {"status": "success", "message": "配置已更新"}
-
-
-# ==========================================
-# 🖥️ 管理界面静态文件挂载
-# ⚠️ 必须放在所有 API 路由注册之后，避免拦截 API
-# 访问 /admin/ 会自动返回 管理界面/index.html
-# ==========================================
-from fastapi.staticfiles import StaticFiles
-app.mount("/admin", StaticFiles(directory="管理界面", html=True), name="admin")
-
-# ==========================================
-# 📱 移动端网页静态挂载（复用前端的 Web 版）
-# 部署约定：同步 HF Space 时，除本目录内容外，
-# 须将仓库根目录的 前端页面/ 整个目录一并复制到 Space 仓库根目录
-# /m/assets 提供共享前端模块；/m 返回 移动端网页/index.html
-# ⚠️ 必须放在所有 API 路由之后；先挂载更具体的 /m/assets，再挂载 /m
-# 容错：目录缺失时仅跳过挂载并警告，不阻断 API 服务启动（移动端页面将 404）
-# ==========================================
-if os.path.isdir("前端页面"):
-    app.mount("/m/assets", StaticFiles(directory="前端页面"), name="web_assets")
-    app.mount("/m", StaticFiles(directory="移动端网页", html=True), name="mobile_web")
-else:
-    logger.warning("⚠️ 未找到 前端页面/ 目录，移动端网页 /m/ 未挂载（部署时须将仓库根目录的 前端页面/ 复制到 Space 仓库根目录），API 服务不受影响")
+# ⚙️ 后端逻辑/核心服务端.py (Hugging Face Spaces app.py)
+from runtime_log_privacy import install_uvicorn_privacy_filters, route_label, RequestTraceMiddleware
+install_uvicorn_privacy_filters()
+
+from fastapi import FastAPI, File, UploadFile, Form, Depends, HTTPException, Request
+from rate_limit import shared_limit
+from response_privacy import requires_no_store
+from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import Response, JSONResponse, FileResponse 
+from sqlalchemy.orm import Session
+from pydantic import BaseModel
+from huggingface_hub import hf_hub_download, HfApi
+import uuid
+import urllib.parse
+import urllib.request
+import urllib.error
+import os
+import json
+import logging
+import time
+import datetime
+import threading
+import 数据库连接 as db
+import asyncio
+from 安全认证 import require_auth
+from profile_io import start_profile_io, close_profile_io
+from verification_io import start_verification_io, stop_verification_io, close_verification_io
+from auth_io import start_auth_io, stop_auth_io, close_auth_io
+from auth_io import start_identity_io, stop_identity_io, close_identity_io
+from rate_limit import start_shared_work, stop_shared_work, close_shared_work
+from script_execution import start_admin_scripts, stop_admin_scripts, close_admin_scripts
+from comment_store import start_comment_reads, stop_comment_reads, close_comment_reads
+from periodic_tasks import start_periodic_task, request_periodic_stop, wait_periodic_tasks
+from owned_thread import run_owned_thread
+from resource_work import start_resource_work, stop_resource_work, close_resource_work
+from shutdown_lifecycle import (prepare_application_shutdown, run_application_shutdown,
+                                shutdown_cancel_requested, ShutdownFailures)
+from startup_warmup import (prepare_startup_warmup, run_startup_warmup, stop_startup_warmup,
+                            wait_startup_warmup, startup_warmup_stopped, startup_shutdown_requested)
+
+
+# ==========================================
+# 📝 P2优化：日志配置
+# ==========================================
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s | %(levelname)s | %(name)s | %(message)s',
+    datefmt='%Y-%m-%d %H:%M:%S'
+)
+logger = logging.getLogger("ComfyUI-Ranking")
+_UPLOAD_CONCURRENCY = max(1, min(int(os.environ.get("MAX_CONCURRENT_UPLOADS", "4")), 16))
+_UPLOAD_SEMAPHORE = threading.BoundedSemaphore(_UPLOAD_CONCURRENCY)
+
+
+from 云端_定时版本检测引擎 import daily_version_check_task, reset_daily_views_task
+
+# ==========================================
+# 👥 用户模块 (拆分为3个子模块)
+# ==========================================
+# router_users_auth.py    - 🔐 登录/注册/密码重置/验证码
+# router_users_profile.py - 👤 获取/更新用户资料
+# router_users_social.py  - 🤝 关注/隐私设置
+from router_users_auth import router as users_auth_router
+from router_users_profile import router as users_profile_router
+from router_users_social import router as users_social_router
+
+# ==========================================
+# 其他业务模块
+# ==========================================
+from router_items import router as items_router       # 📦 内容管理(工具/Skill/应用/推荐)
+from router_comments import router as comments_router # 💬 评论系统
+from router_messages import (router as messages_router, start_message_io, stop_message_io, close_message_io) # ✉️ 私信系统
+from router_wallet import router as wallet_router     # 💰 钱包/提现
+from router_proxy import router as proxy_router       # 🔗 代理下载
+from router_posts import router as posts_router       # 💬 讨论区
+from router_prompts import router as prompts_router   # ✨ 提示词市场
+from router_tasks import router as tasks_router       # 📝 任务榜
+from router_open_api import start_open_sql, stop_open_sql, close_open_sql
+from router_open_api import router as open_api_router  # 🌐 通用开放API（第三方插件）
+from router_admin_plugins import router as admin_plugins_router  # 🔒 管理后台 - 第三方插件管理API
+
+from database_sql import init_sql_db, get_db, SessionLocal
+from models_sql import SystemConfig  # 🧹 P2清理：Ownership 在本文件无引用
+
+from fastapi.exceptions import RequestValidationError
+from starlette.exceptions import HTTPException as StarletteHTTPException
+
+app = FastAPI(
+    title="ComfyUI Ranking API",
+    description="ComfyUI 社区排名系统 API",
+    version="2.0.0",
+    docs_url="/api/docs",
+    redoc_url="/api/redoc"
+)
+
+
+# ==========================================
+# 🛡️ 稳定性优化：全局异常处理器
+# ==========================================
+# 作用：捕获所有未处理异常，防止单个请求崩溃整个服务
+# 🚀 P3优化：统一错误响应格式
+
+def create_error_response(status_code: int, detail: str, error_type: str = None, error_id: str = None, extra: dict = None):
+    """🚀 P3优化：统一错误响应构造器"""
+    response = {
+        "success": False,
+        "status": "error",
+        "code": status_code,
+        "detail": detail,
+    }
+    if error_type:
+        response["type"] = error_type
+    if error_id:
+        response["error_id"] = error_id
+    if extra:
+        response.update(extra)
+    return response
+
+@app.exception_handler(StarletteHTTPException)
+async def http_exception_handler(request, exc):
+    """🚀 P3优化：HTTP 异常处理，返回统一格式"""
+    logger.warning(f"HTTP {exc.status_code} | {route_label(request)} | detail_type={type(exc.detail).__name__}")
+    
+    # 根据状态码确定错误类型
+    error_type_map = {
+        400: "bad_request",
+        401: "unauthorized",
+        403: "forbidden",
+        404: "not_found",
+        409: "conflict",
+        429: "rate_limited",
+        502: "upstream_error",
+    }
+    error_type = error_type_map.get(exc.status_code, "http_error")
+    
+    return JSONResponse(
+        status_code=exc.status_code,
+        content=create_error_response(exc.status_code, str(exc.detail), error_type),
+        headers={"X-Ranking-Error-Scope": "endpoint"} if exc.status_code == 503 else None,
+    )
+
+from request_body_guard import RequestBodyGuard
+app.add_middleware(RequestBodyGuard, error_response=create_error_response)
+
+from upload_body_guard import UploadBodyGuard
+app.add_middleware(UploadBodyGuard, capacity=_UPLOAD_CONCURRENCY, error_response=create_error_response)
+
+from public_list_etag import PublicListETag
+app.add_middleware(PublicListETag)
+
+@app.middleware("http")
+async def private_response_cache_control(request: Request, call_next):
+    response = await call_next(request)
+    if requires_no_store(request.url.path, request.headers.get("Authorization")):
+        response.headers["Cache-Control"] = "no-store"
+        vary = [name.strip() for name in response.headers.get("Vary", "").split(",") if name.strip()]
+        if not any(name.lower() in {"authorization", "*"} for name in vary):
+            vary.append("Authorization")
+        response.headers["Vary"] = ", ".join(vary)
+    return response
+
+
+@app.exception_handler(RequestValidationError)
+async def validation_exception_handler(request, exc):
+    """🚀 P3优化：请求参数校验失败处理"""
+    logger.warning("Validation Error | %s | count=%d", route_label(request), len(exc.errors()))
+    
+    # 提取简洁的错误信息
+    errors = []
+    for err in exc.errors():
+        field = ".".join(str(loc) for loc in err["loc"][1:])  # 跳过 'body'
+        errors.append({"field": field, "message": "该字段格式不正确", "type": err["type"]})
+    
+    return JSONResponse(
+        status_code=422,
+        content=create_error_response(
+            422, 
+            "请求参数格式错误", 
+            "validation_error",
+            extra={"errors": errors}
+        )
+    )
+
+@app.exception_handler(Exception)
+async def global_exception_handler(request, exc):
+    """🚀 P3优化：全局异常处理，捕获所有未预期异常"""
+    error_id = getattr(request.state, 'ranking_request_id', None) or uuid.uuid4().hex
+    logger.error(f"Unhandled Exception [{error_id}] | {route_label(request)} | error_type={type(exc).__name__}")
+    return JSONResponse(
+        status_code=500,
+        content=create_error_response(
+            500,
+            "服务器内部错误，请稍后重试",
+            "internal_error",
+            error_id=error_id
+        ),
+        headers={"X-Ranking-Request-Id": error_id}
+    )
+
+
+# ==========================================
+# ❤️ 健康检查接口 (增强版)
+# ==========================================
+@app.get("/")
+def health_check():
+    return {"status": "ok", "message": "ComfyUI Ranking API is running perfectly!"}
+
+@app.get("/health")
+def detailed_health_check():
+    """详细健康检查，含依赖状态"""
+    health_status = {
+        "status": "ok",
+        "components": {}
+    }
+    
+    # 检查 SQL 数据库
+    try:
+        from database_sql import check_db_connection
+        if check_db_connection():
+            health_status["components"]["sql_database"] = "ok"
+        else:
+            health_status["components"]["sql_database"] = "error: connection failed"
+            health_status["status"] = "degraded"
+    except Exception as e:
+        logger.warning(f"健康检查 SQL 数据库异常: error_type={type(e).__name__}")
+        health_status["components"]["sql_database"] = "error: connection failed"
+        health_status["status"] = "degraded"
+    
+    # 检查 JSON 文件访问
+    try:
+        import 数据库连接 as json_db
+        json_db.load_data("users.json", default_data={})
+        health_status["components"]["json_storage"] = "ok"
+    except Exception as e:
+        logger.warning(f"健康检查 JSON 存储异常: error_type={type(e).__name__}")
+        health_status["components"]["json_storage"] = "error: storage unavailable"
+        health_status["status"] = "degraded"
+    
+    return health_status
+
+def _warmup_dependencies():
+    if startup_warmup_stopped(app.state):
+        return
+    # ========== 预热检查：SQL 数据库 ==========
+    try:
+        init_sql_db()
+        logger.info("✅ SQL 数据库初始化完成")
+    except Exception as e:
+        logger.error(f"❌ SQL 数据库初始化失败: error_type={type(e).__name__}")
+        # 不抛出异常，允许降级运行
+
+    if startup_warmup_stopped(app.state):
+        return
+    # ========== 加载第三方插件注册表（依赖 SQL 数据库） ==========
+    try:
+        from router_open_api import load_plugins_from_db
+        load_plugins_from_db()
+        logger.info("✅ 第三方插件注册表已加载")
+    except Exception as e:
+        logger.warning(f"⚠️ 第三方插件注册表加载失败: error_type={type(e).__name__}")
+
+    if startup_warmup_stopped(app.state):
+        return
+    # ========== 预热检查：JSON 数据库 ==========
+    try:
+        db.load_data("users.json", default_data={})
+        if startup_warmup_stopped(app.state):
+            return
+        db.load_data("items.json", default_data=[])
+        logger.info("✅ JSON 数据库访问正常")
+    except Exception as e:
+        logger.warning(f"⚠️ JSON 数据库访问异常: error_type={type(e).__name__}")
+
+
+# ==========================================
+# 🚀 应用启动事件
+# ==========================================
+# 作用：初始化数据库 + 启动定时版本检测后台任务 + 预热检查
+@app.on_event("startup")
+async def on_startup():
+    logger.info("🚀 ComfyUI-Ranking API 启动中...")
+    if getattr(app.state, "_ranking_starting", False) or getattr(app.state, "_ranking_closers", 0):
+        raise RuntimeError("application lifecycle is already in progress")
+    if getattr(app.state, "_ranking_started", False):
+        return
+    app.state._ranking_starting = True
+    try:
+        prepare_startup_warmup(app.state)
+        prepare_application_shutdown(app.state)
+        start_profile_io()
+        try:
+            start_verification_io()
+            start_auth_io()
+            start_identity_io()
+            start_shared_work()
+            start_open_sql()
+            start_resource_work()
+            start_message_io()
+            start_comment_reads()
+            start_admin_scripts()
+
+            await run_startup_warmup(app.state, _warmup_dependencies)
+
+            # SQL资金已冻结但JSON发布失败的任务，重启后继续投影；持有句柄供停机收尾。
+            from task_publication import publication_worker
+            from database_sql import engine
+            from db_utils import sort_cache
+            start_periodic_task(app.state, "task_publication",
+                lambda stop: publication_worker(engine, db, sort_cache.invalidate, stop))
+
+            from resource_publication import publication_worker as resource_publication_worker
+            start_periodic_task(app.state, "resource_publication",
+                lambda stop: resource_publication_worker(engine, db, sort_cache.invalidate, stop))
+
+            from resource_deletion import resource_deletion_worker
+            start_periodic_task(app.state, "resource_deletion",
+                lambda stop: resource_deletion_worker(db, stop, sort_cache.invalidate))
+
+            # ========== 启动后台任务 ==========
+            start_periodic_task(app.state, "daily_version", daily_version_check_task)
+            logger.info("✅ 定时版本检测任务已挂载")
+
+            start_periodic_task(app.state, "daily_views", reset_daily_views_task)
+            logger.info("✅ daily_views 每日重置任务已挂载")
+
+            # ========== 启动 HF 批量同步定时器 ==========
+            db.start_batch_sync()
+            logger.info("✅ HF 同步调度初始化已完成")
+
+            app.state._ranking_started = True
+            logger.info("🎉 ComfyUI-Ranking API 启动完成!")
+        except BaseException:
+            # 启动可能只登记了部分句柄；正常关闭按已登记对象收尾。
+            if not startup_shutdown_requested(app.state):
+                try:
+                    await on_shutdown()
+                except BaseException as error:
+                    logger.error("启动收尾失败: error_type=%s", type(error).__name__)
+            raise
+    finally:
+        app.state._ranking_starting = False
+
+
+@app.on_event("shutdown")
+async def on_shutdown():
+    return await run_application_shutdown(app.state, _shutdown_resources)
+
+
+async def _shutdown_resources():
+    """逐项收尾，错误在其它组件得到关闭机会后传播。"""
+    app.state._ranking_started = False
+    app.state._ranking_shutdown_incomplete = True
+    failures = ShutdownFailures(logger)
+    failures.call('log_start', logger.info, "🛑 ComfyUI-Ranking API 正在关闭...")
+    failures.call('stop_warmup', stop_startup_warmup, app.state)
+    for stage, stop in (
+        ('stop_messages', stop_message_io), ('stop_resources', stop_resource_work), ('stop_open_sql', stop_open_sql), ('stop_shared', stop_shared_work),
+        ('stop_identity', stop_identity_io), ('stop_auth', stop_auth_io),
+        ('stop_verification', stop_verification_io), ('stop_scripts', stop_admin_scripts),
+        ('stop_comments', stop_comment_reads),
+    ):
+        failures.call(stage, stop)
+    workers = []
+    for name in ('daily_version', 'daily_views', 'task_publication', 'resource_publication', 'resource_deletion'):
+        worker = failures.call('capture_' + name, getattr, app.state, name + '_worker', None)
+        if worker is not None:
+            workers.append(worker)
+        failures.call('stop_' + name, request_periodic_stop, app.state, (name,))
+    for stage, close, args in (
+        ('wait_warmup', wait_startup_warmup, (app.state,)),
+        ('close_messages', close_message_io, ()), ('close_resources', close_resource_work, ()), ('close_open_sql', close_open_sql, ()), ('close_shared', close_shared_work, ()),
+        ('close_identity', close_identity_io, ()), ('close_auth', close_auth_io, ()),
+        ('close_verification', close_verification_io, ()), ('close_profile', close_profile_io, ()),
+        ('close_scripts', close_admin_scripts, ()), ('close_comments', close_comment_reads, ()),
+        ('wait_periodic', wait_periodic_tasks, (workers,)),
+    ):
+        await failures.wait(stage, close, *args)
+    app.state._ranking_shutdown_incomplete = failures.incomplete
+    failures.raise_if_failed(cancel_requested=shutdown_cancel_requested(app.state))
+    await run_owned_thread(db.flush_sync)
+    logger.info("✅ HF 关闭前同步尝试已结束")
+    logger.info("✅ 关闭完成")
+
+# 🛡️ CORS 配置：默认通配符（插件前端运行于用户本地 ComfyUI 页面，origin 为
+# 127.0.0.1/localhost/局域网 IP/自定义端口等无法穷举；本 API 通过 Authorization 头
+# 传递 Token 且 allow_credentials=False 不依赖 Cookie，通配风险可控）。
+# 如需收紧可在环境变量 ALLOWED_ORIGINS 中逗号分隔指定域名。
+ALLOWED_ORIGINS = os.environ.get("ALLOWED_ORIGINS", "*").split(",")
+logger.info(
+    f"CORS 配置已加载: origin_count={len(ALLOWED_ORIGINS)} | "
+    f"wildcard={len(ALLOWED_ORIGINS) == 1 and ALLOWED_ORIGINS[0] == '*'}"
+)
+
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=ALLOWED_ORIGINS,
+    allow_credentials=False, 
+    allow_methods=["*"],
+    allow_headers=["*"],
+    expose_headers=["ETag", "X-Ranking-Error-Scope", "X-Ranking-Request-Id"],
+)
+app.add_middleware(RequestTraceMiddleware)
+
+# ==========================================
+# 路由挂载
+# ==========================================
+# 用户模块 (3个子模块)
+app.include_router(users_auth_router)     # 🔐 登录/注册/密码重置
+app.include_router(users_profile_router)  # 👤 用户资料
+app.include_router(users_social_router)   # 🤝 关注/隐私
+
+# 其他业务模块
+app.include_router(items_router)          # 📦 内容管理
+app.include_router(comments_router)       # 💬 评论系统
+app.include_router(messages_router)       # ✉️ 私信系统
+app.include_router(wallet_router)         # 💰 钱包/提现
+app.include_router(proxy_router)          # 🔗 代理下载
+app.include_router(posts_router)          # 💬 讨论区
+app.include_router(prompts_router)        # ✨ 提示词市场
+app.include_router(tasks_router)          # 📝 任务榜
+app.include_router(open_api_router)       # 🌐 通用开放API（供第三方插件调用）
+app.include_router(admin_plugins_router)  # 🔒 管理后台 - 第三方插件管理API
+
+# ==========================================
+# 🟢 私有图床代理中心 (Image Proxy)
+# 解决 Private 仓库下，本地客户端报 401 Unauthorized 的终极方案
+# ==========================================
+from media_proxy_service import read_public_media
+
+@app.get("/api/image_proxy")
+def proxy_hf_image(url: str = None, path: str = None):
+    return read_public_media(url, path, store=db, download=hf_hub_download,
+                             file_response=FileResponse, error_response=create_error_response)
+
+# ==========================================
+# 上传接口 (将返回的 URL 替换为 Proxy 代理链接)
+# 🔒 P0安全优化：集成图片内容审核
+# ==========================================
+from image_moderation import moderate_image_sync, ModerationResult
+
+# ==========================================
+# 🎵 音频安全净化：重编码压缩，剥离元数据与隐藏附加信息
+# ==========================================
+from upload_service import process_upload
+
+@app.post("/api/upload")
+@shared_limit(30)
+def upload_file(request: Request, file: UploadFile = File(...), file_type: str = Form(...), current_user: str = Depends(require_auth)):
+    return process_upload(file, file_type, current_user, store=db, storage_factory=HfApi,
+                          moderate=moderate_image_sync, limiter=_UPLOAD_SEMAPHORE,
+                          error_response=create_error_response)
+
+
+
+from github_source import select_github_token
+
+
+class ValidateResourceRequest(BaseModel):
+    url: str
+    item_id: str
+    account: str
+
+from resource_probe_service import probe_resource
+from github_probe_transport import open_github_probe
+from skill_preflight import verify_skill_repository
+from router_proxy import _send_with_validated_redirects
+from safe_http_transport import ValidatedAsyncHTTPTransport
+import httpx
+
+
+def _probe_skill_repository(item, token):
+    return verify_skill_repository(item, token, send=_send_with_validated_redirects,
+        client_factory=httpx.AsyncClient, transport_factory=ValidatedAsyncHTTPTransport)
+
+@app.post("/api/validate_resource")
+@shared_limit(30)
+def validate_resource(req_data: ValidateResourceRequest, request: Request, sql_db: Session = Depends(get_db), current_user: str = Depends(require_auth)):
+    return probe_resource(req_data.item_id, store=db, download=hf_hub_download,
+                          open_url=open_github_probe, token_selector=select_github_token,
+                          error_response=create_error_response, skill_probe=_probe_skill_repository)
+
+# ==========================================
+# 🔒 管理员：系统配置 API
+# ==========================================
+from 安全认证 import require_auth, ADMIN_ACCOUNTS
+
+def _is_admin(account: str) -> bool:
+    """检查账号是否为管理员"""
+    from 安全认证 import is_admin as _check_admin
+    return _check_admin(account)
+
+# 配置存储文件
+SYSTEM_CONFIG_FILE = "/tmp/system_config.json"  # 保留作为降级方案
+
+def _load_system_config_from_db(db: Session, *, strict: bool = False) -> dict:
+    """从数据库加载所有系统配置"""
+    try:
+        configs = db.query(SystemConfig).all()
+        result = {}
+        for cfg in configs:
+            try:
+                result[cfg.config_key] = json.loads(cfg.config_value)
+            except (json.JSONDecodeError, TypeError):
+                result[cfg.config_key] = cfg.config_value
+        return result
+    except Exception as e:
+        logger.warning(f"从数据库加载系统配置失败，降级到文件: error_type={type(e).__name__}")
+        if strict:
+            return _load_system_config_from_file(strict=True)
+        return _load_system_config_from_file()
+
+def _load_system_config_from_file(*, strict: bool = False) -> dict:
+    """降级方案；严格读取不把故障或缺失文件冒充空配置。"""
+    if strict:
+        with open(SYSTEM_CONFIG_FILE, "r", encoding="utf-8") as stream:
+            config = json.load(stream)
+        if not isinstance(config, dict):
+            raise ValueError("invalid system configuration root")
+        return config
+    try:
+        if os.path.exists(SYSTEM_CONFIG_FILE):
+            with open(SYSTEM_CONFIG_FILE, "r") as f:
+                return json.load(f)
+    except Exception as e:
+        logger.debug(f"加载系统配置文件失败: error_type={type(e).__name__}")
+    return {}
+
+def _save_system_config_to_db(db: Session, config_key: str, value, updated_by: str = None, *, strict: bool = False):
+    """保存单个配置项到数据库"""
+    try:
+        cfg = db.query(SystemConfig).filter(SystemConfig.config_key == config_key).first()
+        if not cfg:
+            cfg = SystemConfig(config_key=config_key)
+            db.add(cfg)
+        cfg.config_value = json.dumps(value, ensure_ascii=False, allow_nan=not strict)
+        cfg.updated_by = updated_by
+        cfg.updated_at = datetime.datetime.utcnow()
+        db.commit()
+    except Exception as e:
+        if strict:
+            # commit异常可能发生在真实提交之后；回滚不能证明尚未保存。
+            try:
+                db.rollback()
+            except Exception:
+                logger.warning("SYSTEM_CONFIG_ROLLBACK_UNCONFIRMED")
+            raise
+        db.rollback()
+        logger.warning(f"保存系统配置到数据库失败，降级到文件: error_type={type(e).__name__}")
+        # 降级：保存到文件
+        config = _load_system_config_from_file()
+        config[config_key] = value
+        try:
+            with open(SYSTEM_CONFIG_FILE, "w") as f:
+                json.dump(config, f, ensure_ascii=False)
+        except Exception as fe:
+            logger.warning(f"降级保存系统配置文件也失败: error_type={type(fe).__name__}")
+
+# 兼容旧调用的包装函数
+def _load_system_config(db: Session = None, *, strict: bool = False) -> dict:
+    """加载系统配置（优先数据库，降级文件）；严格模式保留故障。"""
+    if strict:
+        if db is not None:
+            return _load_system_config_from_db(db, strict=True)
+        temp_db = SessionLocal()
+        try:
+            return _load_system_config_from_db(temp_db, strict=True)
+        finally:
+            temp_db.close()
+    if db:
+        return _load_system_config_from_db(db)
+    # 无 db session 时（如公开端点），创建临时 session
+    temp_db = SessionLocal()
+    try:
+        return _load_system_config_from_db(temp_db)
+    except Exception:
+        return _load_system_config_from_file()
+    finally:
+        temp_db.close()
+
+def _save_system_config(config: dict, db: Session = None, updated_by: str = None):
+    """保存系统配置（优先数据库，降级文件）"""
+    if db:
+        for key, value in config.items():
+            _save_system_config_to_db(db, key, value, updated_by)
+        return
+    # 无 db session 时，创建临时 session
+    temp_db = SessionLocal()
+    try:
+        for key, value in config.items():
+            _save_system_config_to_db(temp_db, key, value, updated_by)
+    except Exception:
+        pass
+    finally:
+        temp_db.close()
+
+
+@app.get("/api/admin/config/{config_key}")
+async def get_system_config(config_key: str, current_user: str = Depends(require_auth), db: Session = Depends(get_db)):
+    """ 🔒 获取系统配置（仅管理员） """
+    # 🔒 权限验证
+    if not _is_admin(current_user):
+        raise HTTPException(status_code=403, detail="无权访问系统配置，仅管理员可操作")
+    
+    def reject_constant(_value):
+        raise ValueError("invalid configuration constant")
+    try:
+        # 管理回读用于确认SQL保存结果，不能用另一个来源的旧值代替。
+        storage_key = "image_moderation_enabled" if config_key == "image_moderation" else config_key
+        row = db.query(SystemConfig).filter(SystemConfig.config_key == storage_key).first()
+        value = None if row is None else json.loads(row.config_value, parse_constant=reject_constant)
+        if config_key == "image_moderation":
+            if row is None:
+                from image_moderation import _is_moderation_enabled
+                value = _is_moderation_enabled()
+            if type(value) is not bool:
+                raise ValueError("invalid moderation configuration")
+            value = {"enabled": value}
+    except Exception:
+        raise HTTPException(status_code=503, detail="config_read_unavailable") from None
+    return {"status": "success", "data": value}
+
+
+# 🏷️ 版本配置默认值
+DEFAULT_VERSION_CONFIG = {
+    "stage": "beta",
+    "major": 2,
+    "minor": 0,
+    "patch": 0
+}
+
+
+@app.get("/api/public/project-version")
+async def get_public_project_version(db: Session = Depends(get_db)):
+    """获取项目版本信息（公开接口，无需认证）"""
+    config = _load_system_config(db)
+    version_data = config.get("project_version", DEFAULT_VERSION_CONFIG)
+    return {"status": "success", "data": version_data}
+
+
+@app.get("/api/public/banner_config")
+async def get_public_banner_config(db: Session = Depends(get_db)):
+    """公开接口：获取广告横幅配置（所有已登录/未登录用户均可访问）"""
+    try:
+        config = _load_system_config(db, strict=True)
+        if not isinstance(config, dict):
+            raise ValueError("invalid system configuration root")
+        banner = config.get("banner_config")
+        if banner is None:
+            return {"status": "success", "data": None}
+        if not isinstance(banner, dict) or type(banner.get("enabled")) is not bool:
+            raise ValueError("invalid banner configuration")
+        if not banner["enabled"]:
+            return {"status": "success", "data": None}
+        # 只投影展示字段，异常配置不能触发浏览器清除旧横幅。
+        result = {"enabled": True}
+        for field in ("bannerImage", "title", "description", "detailImage", "detailContent", "link"):
+            value = banner.get(field, "")
+            if not isinstance(value, str):
+                raise ValueError("invalid banner display field")
+            result[field] = value
+        if not result["bannerImage"].strip():
+            raise ValueError("missing banner image")
+        return {"status": "success", "data": result}
+    except Exception:
+        raise HTTPException(status_code=503, detail="banner_config_unavailable") from None
+
+
+@app.put("/api/admin/config/{config_key}")
+async def set_system_config(config_key: str, value: dict, current_user: str = Depends(require_auth), db: Session = Depends(get_db)):
+    """ 🔒 设置系统配置（仅管理员） """
+    # 🔒 权限验证
+    if not _is_admin(current_user):
+        raise HTTPException(status_code=403, detail="无权修改系统配置，仅管理员可操作")
+    storage_key = config_key
+    storage_value = value
+    if config_key == "image_moderation":
+        if set(value) != {"enabled"} or type(value["enabled"]) is not bool:
+            raise HTTPException(status_code=400, detail="invalid_moderation_configuration")
+        storage_key = "image_moderation_enabled"
+        storage_value = value["enabled"]
+    try:
+        _save_system_config_to_db(db, storage_key, storage_value, updated_by=current_user, strict=True)
+    except Exception:
+        raise HTTPException(status_code=503, detail="config_save_unconfirmed") from None
+    return {"status": "success", "message": "配置已更新"}
+
+
+# ==========================================
+# 🖥️ 管理界面静态文件挂载
+# ⚠️ 必须放在所有 API 路由注册之后，避免拦截 API
+# 访问 /admin/ 会自动返回 管理界面/index.html
+# ==========================================
+from fastapi.staticfiles import StaticFiles
+app.mount("/admin", StaticFiles(directory="管理界面", html=True), name="admin")
+
+# ==========================================
+# 📱 移动端网页静态挂载（复用前端的 Web 版）
+# 部署约定：同步 HF Space 时，除本目录内容外，
+# 须将仓库根目录的 前端页面/ 整个目录一并复制到 Space 仓库根目录
+# /m/assets 提供共享前端模块；/m 返回 移动端网页/index.html
+# ⚠️ 必须放在所有 API 路由之后；先挂载更具体的 /m/assets，再挂载 /m
+# 容错：目录缺失时仅跳过挂载并警告，不阻断 API 服务启动（移动端页面将 404）
+# ==========================================
+if os.path.isdir("前端页面"):
+    app.mount("/m/assets", StaticFiles(directory="前端页面"), name="web_assets")
+    app.mount("/m", StaticFiles(directory="移动端网页", html=True), name="mobile_web")
+else:
+    logger.warning("⚠️ 未找到 前端页面/ 目录，移动端网页 /m/ 未挂载（部署时须将仓库根目录的 前端页面/ 复制到 Space 仓库根目录），API 服务不受影响")

auth_io.py

@@ -0,0 +1,24 @@
+"""账号同步工作的有界准入与关闭等待。"""
+from fastapi import HTTPException
+from owned_thread import OwnedThreadGroup
+
+MAX_AUTH_IO = 8
+MAX_IDENTITY_IO = 32
+
+
+class AuthIO(OwnedThreadGroup):
+    def __init__(self, capacity=MAX_AUTH_IO):
+        super().__init__(capacity, lambda: HTTPException(status_code=503, detail='用户数据暂不可用'))
+
+
+_auth_io = AuthIO()
+run_auth_io = _auth_io.run
+start_auth_io = _auth_io.start
+stop_auth_io = _auth_io.stop
+close_auth_io = _auth_io.close
+
+_identity_io = AuthIO(MAX_IDENTITY_IO)
+run_identity_io = _identity_io.run
+start_identity_io = _identity_io.start
+stop_identity_io = _identity_io.stop
+close_identity_io = _identity_io.close

github_versions.py

@@ -1,89 +1,89 @@
-"""每资源版本检测票据和局部发布；拒绝较早检测的迟到结果。"""
-import asyncio
-import uuid
-from github_archive import commit_sha, source_signature
-from github_source import select_github_token
-from proxy_access import read_proxy_item
-
-
-def _entry(versions, item_id):
-    if not isinstance(versions, dict):
-        raise ValueError('invalid version source')
-    entry = versions.get(item_id)
-    if entry is None:
-        return {}
-    if isinstance(entry, str):
-        return {'hash': entry}
-    if not isinstance(entry, dict):
-        raise ValueError('invalid version record')
-    return dict(entry)
-
-
-def _without_cache(entry):
-    return {key: value for key, value in entry.items()
-            if key not in ('cached_at', 'zip_size') and not key.startswith('archive_')}
-
-
-def begin_probe(store, item_id):
-    item = read_proxy_item(store, item_id)
-    token = select_github_token(item)
-    source = source_signature(item, token)
-    ticket = uuid.uuid4().hex
-    def update(versions):
-        entry = _entry(versions, item_id)
-        entry['_probe_ticket'] = ticket
-        entry['_probe_source'] = source
-        versions[item_id] = entry
-    store.atomic_update('versions.json', update, default_data={})
-    return dict(item=item, token=token, source=source, ticket=ticket)
-
-
-def finish_probe(store, operation, sha):
-    sha = commit_sha(sha)
-    item_id = operation['item']['id']
-    current = read_proxy_item(store, item_id)
-    if source_signature(current, select_github_token(current)) != operation['source']:
-        return None
-    def update(versions):
-        entry = _entry(versions, item_id)
-        if entry.get('_probe_ticket') != operation['ticket'] or entry.get('_probe_source') != operation['source']:
-            return None
-        changed = entry.get('hash') != sha[:7]
-        if (changed or entry.get('version_source') not in (None, operation['source'])
-                or entry.get('version_commit') not in (None, sha)
-                or entry.get('archive_commit') not in (None, sha)):
-            entry = _without_cache(entry)
-        entry.update(hash=sha[:7], version_commit=sha, version_source=operation['source'])
-        entry.pop('_probe_ticket', None); entry.pop('_probe_source', None)
-        versions[item_id] = entry
-        return dict(item=current, token=operation['token'], commit=sha, changed=changed)
-    return store.atomic_update('versions.json', update, default_data={})
-
-
-def invalidate_source(store, item_id):
-    """旧编辑回调也读取最新资源；已属于最新来源的确认记录保持。"""
-    current = read_proxy_item(store, item_id)
-    try:
-        source = source_signature(current, select_github_token(current))
-    except ValueError:
-        source = None
-    def update(versions):
-        entry = _entry(versions, item_id)
-        if source is not None and entry.get('version_source') == source:
-            return False
-        entry = _without_cache(entry)
-        for key in ('version_commit', '_probe_ticket', '_probe_source'):
-            entry.pop(key, None)
-        entry.update(hash='', version_source=source)
-        versions[item_id] = entry
-        return True
-    return store.atomic_update('versions.json', update, default_data={})
-
-
-async def refresh_resource_version(store, item_id):
-    from 云端_定时版本检测引擎 import fetch_github_commit
-    operation = await asyncio.to_thread(begin_probe, store, item_id)
-    sha = await fetch_github_commit(operation['item']['link'], operation['token'])
-    if not sha:
-        return None
-    return await asyncio.to_thread(finish_probe, store, operation, sha)
+"""每资源版本检测票据和局部发布；拒绝较早检测的迟到结果。"""
+from owned_thread import run_owned_thread
+import uuid
+from github_archive import commit_sha, source_signature
+from github_source import select_github_token
+from proxy_access import read_proxy_item
+
+
+def _entry(versions, item_id):
+    if not isinstance(versions, dict):
+        raise ValueError('invalid version source')
+    entry = versions.get(item_id)
+    if entry is None:
+        return {}
+    if isinstance(entry, str):
+        return {'hash': entry}
+    if not isinstance(entry, dict):
+        raise ValueError('invalid version record')
+    return dict(entry)
+
+
+def _without_cache(entry):
+    return {key: value for key, value in entry.items()
+            if key not in ('cached_at', 'zip_size') and not key.startswith('archive_')}
+
+
+def begin_probe(store, item_id):
+    item = read_proxy_item(store, item_id)
+    token = select_github_token(item)
+    source = source_signature(item, token)
+    ticket = uuid.uuid4().hex
+    def update(versions):
+        entry = _entry(versions, item_id)
+        entry['_probe_ticket'] = ticket
+        entry['_probe_source'] = source
+        versions[item_id] = entry
+    store.atomic_update('versions.json', update, default_data={})
+    return dict(item=item, token=token, source=source, ticket=ticket)
+
+
+def finish_probe(store, operation, sha):
+    sha = commit_sha(sha)
+    item_id = operation['item']['id']
+    current = read_proxy_item(store, item_id)
+    if source_signature(current, select_github_token(current)) != operation['source']:
+        return None
+    def update(versions):
+        entry = _entry(versions, item_id)
+        if entry.get('_probe_ticket') != operation['ticket'] or entry.get('_probe_source') != operation['source']:
+            return None
+        changed = entry.get('hash') != sha[:7]
+        if (changed or entry.get('version_source') not in (None, operation['source'])
+                or entry.get('version_commit') not in (None, sha)
+                or entry.get('archive_commit') not in (None, sha)):
+            entry = _without_cache(entry)
+        entry.update(hash=sha[:7], version_commit=sha, version_source=operation['source'])
+        entry.pop('_probe_ticket', None); entry.pop('_probe_source', None)
+        versions[item_id] = entry
+        return dict(item=current, token=operation['token'], commit=sha, changed=changed)
+    return store.atomic_update('versions.json', update, default_data={})
+
+
+def invalidate_source(store, item_id):
+    """旧编辑回调也读取最新资源；已属于最新来源的确认记录保持。"""
+    current = read_proxy_item(store, item_id)
+    try:
+        source = source_signature(current, select_github_token(current))
+    except ValueError:
+        source = None
+    def update(versions):
+        entry = _entry(versions, item_id)
+        if source is not None and entry.get('version_source') == source:
+            return False
+        entry = _without_cache(entry)
+        for key in ('version_commit', '_probe_ticket', '_probe_source'):
+            entry.pop(key, None)
+        entry.update(hash='', version_source=source)
+        versions[item_id] = entry
+        return True
+    return store.atomic_update('versions.json', update, default_data={})
+
+
+async def refresh_resource_version(store, item_id):
+    from 云端_定时版本检测引擎 import fetch_github_commit
+    operation = await run_owned_thread(begin_probe, store, item_id)
+    sha = await fetch_github_commit(operation['item']['link'], operation['token'])
+    if not sha:
+        return None
+    return await run_owned_thread(finish_probe, store, operation, sha)

models_sql.py

@@ -5,13 +5,38 @@
 # 🚀 P1性能优化：添加复合索引加速查询
 # ==========================================
 
-from sqlalchemy import Column, Integer, String, DateTime, Boolean, Index, func, Text
+from sqlalchemy import Column, Integer, String, DateTime, Boolean, Index, func, Text, DDL, event
 from sqlalchemy.orm import declarative_base
 import datetime
 
 Base = declarative_base()
 
 
+class OpenApiOperation(Base):
+    __tablename__ = "open_api_operations"
+    request_key = Column(String(64), primary_key=True)
+    request_hash = Column(String(64), nullable=False)
+    transaction_id = Column(String(100), nullable=False, unique=True)
+    response_payload = Column(Text, nullable=False)
+    created_at = Column(DateTime, default=datetime.datetime.utcnow, nullable=False)
+
+
+event.listen(OpenApiOperation.__table__, "after_create",
+    DDL("ALTER TABLE %(fullname)s ENABLE ROW LEVEL SECURITY").execute_if(dialect="postgresql"))
+event.listen(OpenApiOperation.__table__, "after_create",
+    DDL("REVOKE ALL ON TABLE %(fullname)s FROM PUBLIC").execute_if(dialect="postgresql"))
+event.listen(OpenApiOperation.__table__, "after_create", DDL("""
+DO $$ BEGIN
+    IF EXISTS (SELECT FROM pg_roles WHERE rolname = 'anon') THEN
+        REVOKE ALL ON TABLE %(fullname)s FROM anon;
+    END IF;
+    IF EXISTS (SELECT FROM pg_roles WHERE rolname = 'authenticated') THEN
+        REVOKE ALL ON TABLE %(fullname)s FROM authenticated;
+    END IF;
+END; $$
+""").execute_if(dialect="postgresql"))
+
+
 class ResourcePublication(Base):
     """同次资源发布的持久原始请求和恢复内容；不参与资金变更。"""
     __tablename__ = "resource_publications"

open_transaction.py

@@ -1,9 +1,12 @@
 """开放资金接口的实时插件授权与钱包写锁；事务由调用方提交/回滚。"""
 import hmac
+import hashlib
+import json
+import re
 from decimal import Decimal
 
 from fastapi import HTTPException
-from models_sql import RegisteredPlugin
+from models_sql import RegisteredPlugin, OpenApiOperation, Transaction
 from plugin_permissions import parse_permissions
 from tip_transaction import lock_wallet_accounts
 
@@ -43,3 +46,52 @@ def quota_total(value):
     if isinstance(value, bool) or not isinstance(value, int) or value < 0:
         raise ValueError("invalid quota history")
     return value
+
+
+def open_operation_identity(request_id, account, plugin_id, kind, payload):
+    if request_id is None:
+        return None
+    if not isinstance(request_id, str) or re.fullmatch(r"[A-Za-z0-9][A-Za-z0-9._:-]{7,127}", request_id) is None:
+        raise HTTPException(status_code=422, detail="OPEN_REQUEST_ID_INVALID")
+    encode = lambda value: json.dumps(value, ensure_ascii=False, separators=(',', ':'), allow_nan=False).encode('utf-8')
+    key = hashlib.sha256(encode([plugin_id, account, kind, request_id])).hexdigest()
+    fingerprint = hashlib.sha256(encode(payload)).hexdigest()
+    return key, fingerprint
+
+
+def read_open_operation(db, identity, account, plugin_id, kind, amount, reference_id):
+    if identity is None:
+        return None
+    key, fingerprint = identity
+    row = db.get(OpenApiOperation, key)
+    if row is None:
+        if db.get(Transaction, f'{kind}_{key}') is not None:
+            raise HTTPException(status_code=503, detail="OPEN_OPERATION_UNAVAILABLE")
+        return None
+    if row.request_hash != fingerprint:
+        raise HTTPException(status_code=409, detail="OPEN_REQUEST_CONFLICT")
+    try:
+        response = json.loads(row.response_payload)
+        transaction = db.get(Transaction, row.transaction_id)
+        if (not isinstance(response, dict) or set(response) != {'success', 'remaining_balance', 'transaction_id'}
+                or response['success'] is not True or type(response['remaining_balance']) is not int
+                or response['transaction_id'] != row.transaction_id or row.transaction_id != f'{kind}_{key}'
+                or transaction is None or transaction.account != account or transaction.tx_type != kind
+                or transaction.source_plugin != plugin_id or transaction.related_account != plugin_id
+                or type(transaction.amount) is not int or transaction.amount != amount
+                or transaction.item_id != reference_id
+                or not isinstance(transaction.prev_hash, str)
+                or transaction.tx_hash != hashlib.sha256(
+                    f"{transaction.tx_id}{account}{kind}{amount}{transaction.prev_hash}".encode()).hexdigest()):
+            raise ValueError('invalid open operation')
+    except Exception:
+        raise HTTPException(status_code=503, detail="OPEN_OPERATION_UNAVAILABLE")
+    return response
+
+
+def save_open_operation(db, identity, response):
+    if identity is not None:
+        key, fingerprint = identity
+        db.add(OpenApiOperation(request_key=key, request_hash=fingerprint,
+            transaction_id=response['transaction_id'],
+            response_payload=json.dumps(response, ensure_ascii=False, separators=(',', ':'), allow_nan=False)))

owned_thread.py

@@ -73,3 +73,59 @@ async def run_owned_thread(function, *args, **kwargs):
     if not succeeded:
         raise result
     return result
+
+
+class OwnedThreadGroup:
+    def __init__(self, capacity, unavailable):
+        if type(capacity) is not int or capacity < 1:
+            raise ValueError('invalid owned thread capacity')
+        self._capacity = threading.BoundedSemaphore(capacity)
+        self._unavailable = unavailable
+        self._gate = threading.Lock()
+        self._accepting = True
+        self._pending = 0
+        self._closers = 0
+        self._drained = threading.Event()
+        self._drained.set()
+
+    def start(self):
+        with self._gate:
+            if self._pending or self._closers:
+                raise RuntimeError('owned work is still pending')
+            self._accepting = True
+
+    def stop(self):
+        with self._gate:
+            self._accepting = False
+
+    async def close(self):
+        with self._gate:
+            self._accepting = False
+            self._closers += 1
+        try:
+            cancelled = False
+            while not self._drained.is_set():
+                try:
+                    await asyncio.sleep(.01)
+                except asyncio.CancelledError:
+                    cancelled = True
+            if cancelled:
+                raise asyncio.CancelledError
+        finally:
+            with self._gate:
+                self._closers -= 1
+
+    async def run(self, function, *args, **kwargs):
+        with self._gate:
+            if not self._accepting or not self._capacity.acquire(blocking=False):
+                raise self._unavailable()
+            self._pending += 1
+            self._drained.clear()
+        try:
+            return await run_owned_thread(function, *args, **kwargs)
+        finally:
+            with self._gate:
+                self._capacity.release()
+                self._pending -= 1
+                if not self._pending:
+                    self._drained.set()

rate_limit.py

@@ -11,7 +11,8 @@ import time
 
 from fastapi import Request
 from fastapi import HTTPException
-from starlette.concurrency import run_in_threadpool
+from auth_io import run_identity_io
+from owned_thread import OwnedThreadGroup
 from sqlalchemy import case, delete
 from sqlalchemy.dialects.mysql import insert as mysql_insert
 from sqlalchemy.dialects.postgresql import insert as postgresql_insert
@@ -26,6 +27,14 @@ logger = logging.getLogger("ComfyUI-Ranking.RateLimit")
 _cleanup_lock = threading.Lock()
 _last_cleanup_at = 0.0
 
+MAX_SHARED_WORK = 40
+_shared_work = OwnedThreadGroup(MAX_SHARED_WORK,
+    lambda: HTTPException(status_code=503, detail='限流服务暂不可用'))
+run_shared_work = _shared_work.run
+start_shared_work = _shared_work.start
+stop_shared_work = _shared_work.stop
+close_shared_work = _shared_work.close
+
 
 def get_remote_address(request: Request) -> str:
     """仅信任 ASGI transport 提供的客户端地址，不直接信任可伪造的代理头。"""
@@ -181,11 +190,11 @@ def shared_limit(limit: int):
                 request = next((arg for arg in args if isinstance(arg, Request)), None)
             if request is None:
                 raise RuntimeError(f"{scope} requires a FastAPI Request parameter")
-            identity = await run_in_threadpool(get_rate_limit_key, request)
-            await run_in_threadpool(_consume_shared_limit, identity, scope, limit)
+            identity = await run_identity_io(get_rate_limit_key, request)
+            await run_shared_work(_consume_shared_limit, identity, scope, limit)
             if is_async:
                 return await endpoint(*args, **kwargs)
-            return await run_in_threadpool(endpoint, *args, **kwargs)
+            return await run_shared_work(endpoint, *args, **kwargs)
 
         return wrapped
 

request_body_guard.py

@@ -0,0 +1,127 @@
+"""普通API提交在解析前有界接收，原始字节由请求持有到应用结束。"""
+import asyncio
+import math
+import re
+import threading
+import time
+
+from starlette.responses import JSONResponse
+
+REQUEST_BODY_MAX_BYTES = 2 * 1024 * 1024
+REQUEST_BODY_CAPACITY = 32
+REQUEST_BODY_IDLE_SECONDS = 10
+REQUEST_BODY_TOTAL_SECONDS = 30
+
+
+async def _receive_owned(receive, timeout):
+    owner = asyncio.current_task()
+    initial_cancels = owner.cancelling()
+    task = asyncio.create_task(receive())
+    cancelled = None
+    expired = False
+    try:
+        done, _ = await asyncio.wait((task,), timeout=timeout)
+        if not done:
+            expired = True
+            task.cancel()
+    except asyncio.CancelledError as error:
+        cancelled = error
+        task.cancel()
+    while not task.done():
+        try:
+            await asyncio.shield(task)
+        except asyncio.CancelledError as error:
+            if owner.cancelling() > initial_cancels:
+                cancelled = error
+        except BaseException:
+            break
+    if not task.cancelled():
+        task.exception()
+    if cancelled is not None:
+        raise cancelled
+    if expired:
+        raise TimeoutError
+    return task.result()
+
+
+class RequestBodyGuard:
+    def __init__(self, app, *, capacity=REQUEST_BODY_CAPACITY, max_bytes=REQUEST_BODY_MAX_BYTES,
+                 idle_seconds=REQUEST_BODY_IDLE_SECONDS, total_seconds=REQUEST_BODY_TOTAL_SECONDS,
+                 error_response=None):
+        if (type(capacity) is not int or not 1 <= capacity <= 128
+                or type(max_bytes) is not int or max_bytes <= 0
+                or any(type(value) not in (int, float) or not math.isfinite(value) or value <= 0
+                       for value in (idle_seconds, total_seconds))):
+            raise ValueError('invalid request body budget')
+        self.app, self.max_bytes = app, max_bytes
+        self.idle_seconds, self.total_seconds = idle_seconds, total_seconds
+        self.slots = threading.BoundedSemaphore(capacity)
+        self.error_response = error_response
+
+    async def reject(self, scope, receive, send, status, detail, category):
+        content = (self.error_response(status, detail, category) if self.error_response else
+                   {'success': False, 'status': 'error', 'code': status, 'detail': detail, 'type': category})
+        await JSONResponse(content, status_code=status, headers={
+            'Cache-Control': 'no-store', 'Vary': 'Authorization'})(scope, receive, send)
+
+    async def __call__(self, scope, receive, send):
+        path = scope.get('path', '')
+        if (scope['type'] != 'http' or scope.get('method') not in {'POST', 'PUT', 'PATCH', 'DELETE'}
+                or not path.startswith('/api/') or path.rstrip('/') == '/api/upload'):
+            return await self.app(scope, receive, send)
+        headers = scope.get('headers', ())
+        lengths = [value.strip() for name, value in headers if name.lower() == b'content-length']
+        transfers = [value.strip().lower() for name, value in headers if name.lower() == b'transfer-encoding']
+        encodings = [value.strip().lower() for name, value in headers if name.lower() == b'content-encoding']
+        if (len(lengths) > 1 or lengths and (re.fullmatch(rb'[0-9]{1,20}', lengths[0]) is None or transfers)
+                or len(transfers) > 1 or transfers and transfers[0] != b'chunked'):
+            return await self.reject(scope, receive, send, 400, 'request_body_invalid', 'bad_request')
+        if len(encodings) > 1 or encodings and encodings[0] != b'identity':
+            return await self.reject(scope, receive, send, 415, 'request_body_encoding', 'unsupported_media_type')
+        declared = int(lengths[0]) if lengths else None
+        if declared is not None and declared > self.max_bytes:
+            return await self.reject(scope, receive, send, 413, 'request_body_too_large', 'payload_too_large')
+        if not self.slots.acquire(blocking=False):
+            return await self.reject(scope, receive, send, 429, 'request_body_busy', 'rate_limited')
+        try:
+            buffer = bytearray()
+            deadline = time.monotonic() + self.total_seconds
+            while True:
+                remaining = deadline - time.monotonic()
+                if remaining <= 0:
+                    return await self.reject(scope, receive, send, 408, 'request_body_timeout', 'request_timeout')
+                try:
+                    message = await _receive_owned(receive, min(remaining, self.idle_seconds))
+                except TimeoutError:
+                    return await self.reject(scope, receive, send, 408, 'request_body_timeout', 'request_timeout')
+                except ConnectionError:
+                    return await self.reject(scope, receive, send, 400, 'request_body_disconnected', 'bad_request')
+                if time.monotonic() > deadline:
+                    return await self.reject(scope, receive, send, 408, 'request_body_timeout', 'request_timeout')
+                if message.get('type') == 'http.disconnect':
+                    return await self.reject(scope, receive, send, 400, 'request_body_disconnected', 'bad_request')
+                chunk = message.get('body', b'')
+                more = message.get('more_body', False)
+                if message.get('type') != 'http.request' or type(chunk) is not bytes or type(more) is not bool:
+                    return await self.reject(scope, receive, send, 400, 'request_body_invalid', 'bad_request')
+                if len(buffer) + len(chunk) > self.max_bytes:
+                    return await self.reject(scope, receive, send, 413, 'request_body_too_large', 'payload_too_large')
+                if declared is not None and len(buffer) + len(chunk) > declared:
+                    return await self.reject(scope, receive, send, 400, 'request_body_invalid', 'bad_request')
+                buffer.extend(chunk)
+                if not more:
+                    break
+            if declared is not None and len(buffer) != declared:
+                return await self.reject(scope, receive, send, 400, 'request_body_invalid', 'bad_request')
+            raw = bytes(buffer)
+            buffer.clear()
+            delivered = False
+            async def buffered_receive():
+                nonlocal delivered
+                if not delivered:
+                    delivered = True
+                    return {'type': 'http.request', 'body': raw, 'more_body': False}
+                return await receive()
+            return await self.app(scope, buffered_receive, send)
+        finally:
+            self.slots.release()

resource_work.py

@@ -0,0 +1,88 @@
+"""资源写入与可选预缓存的准入和关闭归属。"""
+import asyncio
+import logging
+
+from fastapi import HTTPException
+from owned_thread import OwnedThreadGroup
+
+MAX_RESOURCE_WRITES = 8
+MAX_RESOURCE_BACKGROUND = 2
+logger = logging.getLogger('ComfyUI-Ranking.ResourceWork')
+
+
+class ResourceWork:
+    def __init__(self, capacity=MAX_RESOURCE_WRITES, background_capacity=MAX_RESOURCE_BACKGROUND):
+        if type(background_capacity) is not int or background_capacity < 1:
+            raise ValueError('invalid resource background capacity')
+        self.writes = OwnedThreadGroup(capacity,
+            lambda: HTTPException(status_code=503, detail='资源保存暂时无法核实，请稍后核对'))
+        self.background_capacity = background_capacity
+        self._tasks = set()
+        self._accepting = True
+        self._closers = 0
+
+    def start(self):
+        if self._tasks or self._closers:
+            raise RuntimeError('resource work is still pending')
+        self.writes.start()
+        self._accepting = True
+
+    def stop(self):
+        self._accepting = False
+        self.writes.stop()
+
+    async def run(self, function, *args, **kwargs):
+        return await self.writes.run(function, *args, **kwargs)
+
+    def background(self, factory):
+        if not self._accepting or len(self._tasks) >= self.background_capacity:
+            return False
+        coroutine = None
+        try:
+            coroutine = factory()
+            task = asyncio.create_task(coroutine)
+        except BaseException:
+            if coroutine is not None:
+                coroutine.close()
+            raise
+        self._tasks.add(task)
+        task.add_done_callback(self._completed)
+        return True
+
+    def _completed(self, task):
+        self._tasks.discard(task)
+        if task.cancelled():
+            return
+        error = task.exception()
+        if error is not None:
+            try:
+                logger.error('RESOURCE_BACKGROUND_FAILED | error_type=%s', type(error).__name__)
+            except Exception:
+                pass
+
+    async def close(self):
+        self.stop()
+        self._closers += 1
+        cancelled = False
+        try:
+            try:
+                await self.writes.close()
+            except asyncio.CancelledError:
+                cancelled = True
+            while self._tasks:
+                try:
+                    await asyncio.sleep(.01)
+                except asyncio.CancelledError:
+                    cancelled = True
+            if cancelled:
+                raise asyncio.CancelledError
+        finally:
+            self._closers -= 1
+
+
+_resource_work = ResourceWork()
+run_resource_write = _resource_work.run
+start_resource_background = _resource_work.background
+start_resource_work = _resource_work.start
+stop_resource_work = _resource_work.stop
+close_resource_work = _resource_work.close

router_items.py

@@ -1,786 +1,807 @@
-# router_items.py
-from fastapi import APIRouter, HTTPException, Depends, Request
-from rate_limit import shared_limit
-import time
-import uuid
-import datetime
-import os
-import re
-import urllib.request
-import urllib.error
-import json
-import asyncio
-import 数据库连接 as db
-from models import ItemCreate, ItemUpdate, RatingRequest
-from 安全认证 import require_auth, check_ownership, is_admin
-from 数据库连接 import invalidate_cache
-from db_utils import read_public_source, record_view, sort_cache
-from github_source import repository_parts, select_github_token
-from github_versions import refresh_resource_version, invalidate_source
-from resource_store import publish_resource, published_response, edit_resource, ResourceStoreError
-from purchase_transaction import effective_resource_price
-from resource_deletion import delete_resource
-
-router = APIRouter()
-
-def safe_str(val):
-    """安全转换为字符串"""
-    if val is None:
-        return ""
-    return str(val).lower()
-
-def _get_version_str(versions_db: dict, item_id: str) -> str:
-    """兼容新旧格式获取版本hash字符串"""
-    val = versions_db.get(item_id, "")
-    if isinstance(val, dict):
-        return val.get("hash", "") or ""
-    return val or ""
-
-def _apply_effective_price(item: dict) -> None:
-    """计算当前有效价格；调用者须传响应副本或处于编辑锁内。"""
-    try:
-        price = effective_resource_price(item)
-        pending = item.get('pending_price')
-        effective = item.get('pending_price_effective_at')
-        if type(pending) in (int, float) and pending == price and effective:
-            when = datetime.datetime.fromisoformat(effective)
-            now = datetime.datetime.now(when.tzinfo) if when.tzinfo else datetime.datetime.now()
-            if now >= when:
-                item['pending_price'] = None
-                item['pending_price_effective_at'] = None
-        item['price'] = price
-    except (ValueError, TypeError) as error:
-        import logging
-        kinds = {type(None): 'null', bool: 'boolean', int: 'integer', float: 'number',
-                 str: 'string', list: 'array', dict: 'object'}
-        reason = ('invalid_effective_price' if len(error.args) == 1
-                  and type(error.args[0]) is str and error.args[0] == 'invalid resource price'
-                  else 'invalid_effective_time')
-        try:
-            logging.getLogger('ComfyUI-Ranking.Items').warning(
-                'RESOURCE_PRICE_INVALID | reason=%s | price_type=%s | pending_price_type=%s | effective_time_type=%s',
-                reason, kinds.get(type(item.get('price', 0)), 'unknown'),
-                kinds.get(type(item.get('pending_price')), 'unknown'),
-                kinds.get(type(item.get('pending_price_effective_at')), 'unknown'))
-        except Exception:
-            pass
-        raise HTTPException(status_code=503, detail="资源价格暂时无法核实") from None
-
-
-def get_last_6_months():
-    res = []
-    today = datetime.date.today()
-    for i in range(5, -1, -1):
-        m = today.month - i
-        y = today.year
-        while m <= 0:
-            m += 12
-            y -= 1
-        res.append(f"{y}-{m:02d}")
-    return res
-
-# 数据文件标识，用于排序缓存
-data_file = "items.json"
-
-@router.get("/api/items")
-async def get_items(type: str = "tool", sort: str = "time", limit: int = 50): # 优化：默认限制调大至 50，提升前端列表体验
-    read_epoch = sort_cache.capture_read_epoch()
-    items_db = read_public_source(db, "items.json", default_data=[])
-    comments_db = read_public_source(db, "comments.json", default_data={})
-    versions_db = read_public_source(db, "versions.json", default_data={}) # 读取版本库
-    
-    # 如果是推荐榜，匹配所有 recommend 开头的子类型
-    if type == "recommend":
-        filtered_items = [item for item in items_db if item.get("type", "").startswith("recommend")]
-    else:
-        filtered_items = [item for item in items_db if item.get("type") == type]
-    
-    # 🗂️ 使用排序缓存优化排序性能
-    cache_sort = sort if sort in ("time", "likes", "favorites", "downloads", "tips", "views", "daily_views", "rating") else "time"
-    cache_key = f"items:{type}:{cache_sort}"
-    
-    current_month = datetime.date.today().strftime("%Y-%m") if sort == "tips" else None
-    def order_key(item):
-        if sort == "likes":
-            return item.get("likes", 0)
-        elif sort == "favorites":
-            return item.get("favorites", 0)
-        elif sort == "downloads":
-            return item.get("uses", 0)
-        elif sort == "tips": # 🚀 按近期打赏排序
-            return item.get("tip_history", {}).get(current_month, 0)
-        elif sort == "views": # 👁️ 按总访问量排序
-            return item.get("views", 0)
-        elif sort == "daily_views": # 👁️ 按日访问量排序
-            return item.get("daily_views", 0)
-        elif sort == "rating": # ⭐ 按评分排序
-            return (item.get("rating_avg", 0), item.get("rating_count", 0))
-        else: # time 或其他默认
-            return item.get("created_at", 0)
-
-    def sort_fn(data):
-        data.sort(key=order_key, reverse=True)
-    
-    filtered_items = sort_cache.get_sorted(cache_key, filtered_items, sort_fn, read_epoch=read_epoch, fresh=True)
-        
-    result_items = []
-    for item in filtered_items:
-        item_data = {**item}
-        _apply_effective_price(item_data)
-        item_data["commentsData"] = comments_db.get(item_data["id"], [])
-        item_data["comments"] = len(item_data["commentsData"])
-        item_data["latest_version"] = _get_version_str(versions_db, item_data["id"])
-
-        # 🔴 【绝对核心防线】：在下发给前端前，强行在内存中抹除敏感信息！
-        item_data["has_private_token"] = bool(item_data.get("github_token"))
-        item_data.pop("github_token", None)
-        item_data.pop("netdisk_password", None)  # ☁️ 网盘密码不在列表中显示
-        item_data.pop("viewed_by", None)  # 👁️ 访问者列表不暴露给前端
-        result_items.append(item_data)
-    
-    return {"status": "success", "data": result_items[:limit]}
-
-def _build_creator_trend_data(account: str, u_items: list, months: list) -> dict:
-    """
-    构建创作者趋势数据
-    提取为独立函数供列表接口和详情接口复用
-    """
-    trend_tools = {m: 0 for m in months}
-    trend_skills = {m: 0 for m in months}
-    trend_apps = {m: 0 for m in months}
-    trend_recommends = {m: 0 for m in months}
-    
-    for i in u_items:
-        itype = i.get("type", "")
-        history = i.get("use_history", {})
-        if itype == "tool" or itype == "recommend_tool": 
-            for m, v in history.items():
-                if m in trend_tools: trend_tools[m] += v
-        elif itype == "skill" or itype == "recommend_skill":
-            for m, v in history.items():
-                if m in trend_skills: trend_skills[m] += v
-        elif itype == "app" or itype == "recommend_app": 
-            for m, v in history.items():
-                if m in trend_apps: trend_apps[m] += v
-        elif itype.startswith("recommend"):
-            for m, v in history.items():
-                if m in trend_recommends: trend_recommends[m] += v
-    
-    return {
-        "months": months,
-        "tools": [trend_tools[m] for m in months],
-        "skills": [trend_skills[m] for m in months],
-        "apps": [trend_apps[m] for m in months],
-        "recommends": [trend_recommends[m] for m in months]
-    }
-
-
-@router.get("/api/creators/search")
-async def search_creators(keyword: str, sort: str = "downloads", limit: int = 50):
-    """
-    搜索创作者
-    根据关键词搜索创作者（name、account、shortDesc 不区分大小写子串匹配）
-    """
-    users_db = read_public_source(db, "users.json", default_data={})
-    items_db = read_public_source(db, "items.json", default_data=[])
-    
-    # 🚀 P1性能优化：预构建 author->items 索引
-    author_items_index = {}
-    for item in items_db:
-        author = item.get("author")
-        if author:
-            if author not in author_items_index:
-                author_items_index[author] = []
-            author_items_index[author].append(item)
-    
-    creators = []
-    months = get_last_6_months()
-    keyword_lower = keyword.lower()
-    
-    for account, u in users_db.items():
-        # 🚀 P1性能优化：直接从索引获取
-        u_items = author_items_index.get(account, [])
-        
-        # 获取搜索字段并转为小写
-        name = u.get("name", account)
-        short_desc = u.get("shortDesc") or u.get("intro") or ""
-        
-        # 不区分大小写的子串匹配（同时覆盖 shortDesc 和 intro 两个字段）
-        search_text = f"{safe_str(name)} {safe_str(account)} {safe_str(short_desc)} {safe_str(u.get('intro'))} {safe_str(u.get('shortDesc'))}"
-        if keyword_lower not in search_text:
-            continue
-        
-        tools_count = 0
-        skills_count = 0
-        apps_count = 0
-        
-        for i in u_items:
-            itype = i.get("type", "")
-            if itype == "tool": 
-                tools_count += 1
-            elif itype == "skill":
-                skills_count += 1
-            elif itype == "app": 
-                apps_count += 1
-
-        creators.append({
-            "account": account, "name": name, "avatar": u.get("avatarDataUrl", ""),
-            "bannerUrl": u.get("bannerUrl"),
-            "shortDesc": short_desc, "fullDesc": short_desc,
-            "likes": sum(i.get("likes", 0) for i in u_items), "favorites": sum(i.get("favorites", 0) for i in u_items), 
-            "downloads": sum(i.get("uses", 0) for i in u_items), 
-            "views": sum(i.get("views", 0) for i in u_items),
-            "daily_views": sum(i.get("daily_views", 0) for i in u_items), 
-            "toolsCount": tools_count, "skillsCount": skills_count, "appsCount": apps_count, "followers": len(u.get("followers", [])), "created_at": u.get("created_at", 0),
-            "recent_tips": u.get("tip_history", {}).get(datetime.date.today().strftime("%Y-%m"), 0),
-        })
-    
-    # 排序逻辑与 /api/creators 保持一致
-    if sort == "likes": creators.sort(key=lambda x: x.get("likes", 0), reverse=True)
-    elif sort == "favorites": creators.sort(key=lambda x: x.get("favorites", 0), reverse=True)
-    elif sort == "downloads": creators.sort(key=lambda x: x.get("downloads", 0), reverse=True)
-    elif sort == "tips": creators.sort(key=lambda x: x.get("recent_tips", 0), reverse=True)
-    elif sort == "views": creators.sort(key=lambda x: x.get("views", 0), reverse=True)
-    elif sort == "daily_views": creators.sort(key=lambda x: x.get("daily_views", 0), reverse=True)
-    else: creators.sort(key=lambda x: x.get("created_at", 0), reverse=True)
-    
-    return {"status": "success", "data": creators[:limit]}
-
-
-@router.get("/api/creators")
-async def get_creators(sort: str = "downloads", limit: int = 100):
-    """
-    获取创作者列表
-    🚀 P1性能优化：预构建 author->items 索引，避免 N+1 查询
-    ⚡ P2性能优化：移除大字段（trendData、commentsData、tip_board），移至详情接口按需加载
-    """
-    users_db = read_public_source(db, "users.json", default_data={})
-    items_db = read_public_source(db, "items.json", default_data=[])
-    
-    # 🚀 P1性能优化：预构建 author->items 索引，复杂度从 O(n*m) 降到 O(n+m)
-    author_items_index = {}
-    for item in items_db:
-        author = item.get("author")
-        if author:
-            if author not in author_items_index:
-                author_items_index[author] = []
-            author_items_index[author].append(item)
-    
-    creators = []
-    months = get_last_6_months()
-    
-    for account, u in users_db.items():
-        # 🚀 P1性能优化：直接从索引获取，而非遍历全表
-        u_items = author_items_index.get(account, [])
-        
-        tools_count = 0
-        skills_count = 0
-        apps_count = 0
-        
-        for i in u_items:
-            itype = i.get("type", "")
-            if itype == "tool": 
-                tools_count += 1
-            elif itype == "skill":
-                skills_count += 1
-            elif itype == "app": 
-                apps_count += 1
-
-        creators.append({
-            "account": account, "name": u.get("name", account), "avatar": u.get("avatarDataUrl", ""),
-            "bannerUrl": u.get("bannerUrl"),  # 🖼️ 个人资料卡背景图
-            "shortDesc": u.get("shortDesc") or u.get("intro") or "", "fullDesc": u.get("shortDesc") or u.get("intro") or "",
-            "likes": sum(i.get("likes", 0) for i in u_items), "favorites": sum(i.get("favorites", 0) for i in u_items), 
-            "downloads": sum(i.get("uses", 0) for i in u_items), 
-            "views": sum(i.get("views", 0) for i in u_items),
-            "daily_views": sum(i.get("daily_views", 0) for i in u_items), 
-            "toolsCount": tools_count, "skillsCount": skills_count, "appsCount": apps_count, "followers": len(u.get("followers", [])), "created_at": u.get("created_at", 0),
-            "recent_tips": u.get("tip_history", {}).get(datetime.date.today().strftime("%Y-%m"), 0), # 🚀 新增：本月收益统计
-        })
-        
-    if sort == "likes": creators.sort(key=lambda x: x.get("likes", 0), reverse=True)
-    elif sort == "favorites": creators.sort(key=lambda x: x.get("favorites", 0), reverse=True)
-    elif sort == "downloads": creators.sort(key=lambda x: x.get("downloads", 0), reverse=True)
-    elif sort == "tips": creators.sort(key=lambda x: x.get("recent_tips", 0), reverse=True) # 🚀 新增：按近期打赏排序
-    elif sort == "views": creators.sort(key=lambda x: x.get("views", 0), reverse=True)
-    elif sort == "daily_views": creators.sort(key=lambda x: x.get("daily_views", 0), reverse=True)
-    else: creators.sort(key=lambda x: x.get("created_at", 0), reverse=True)
-    
-    return {"status": "success", "data": creators[:limit]}
-
-
-@router.get("/api/creators/{account}/details")
-async def get_creator_details(account: str):
-    """
-    获取单个创作者的详细数据
-    供前端展开卡片时按需加载
-    包含：trendData、commentsData、tip_board
-    """
-    users_db = read_public_source(db, "users.json", default_data={})
-    items_db = read_public_source(db, "items.json", default_data=[])
-    comments_db = read_public_source(db, "comments.json", default_data={})
-    
-    # 检查用户是否存在
-    if account not in users_db:
-        raise HTTPException(status_code=404, detail="创作者不存在")
-    
-    u = users_db[account]
-    
-    # 获取该用��的所有作品
-    u_items = [item for item in items_db if item.get("author") == account]
-    
-    # 构建趋势数据
-    months = get_last_6_months()
-    trend_data = _build_creator_trend_data(account, u_items, months)
-    
-    return {
-        "status": "success",
-        "data": {
-            "account": account,
-            "trendData": trend_data,
-            "commentsData": comments_db.get(account, []),
-            "tip_board": u.get("tip_board", [])
-        }
-    }
-
-@router.post("/api/items")
-@shared_limit(5)
-async def create_item(request: Request, item: ItemCreate, current_user: str = Depends(require_auth)):
-    # 🔒 P0安全修复：使用 JWT 认证的用户账号作为作者，防止伪造
-    item.author = current_user
-    if not re.fullmatch(r'[A-Za-z0-9_-]{1,50}', item.type or ''):
-        raise HTTPException(status_code=400, detail="资源类型无效")
-    new_item = {
-        "id": f"{item.type}_{int(time.time())}_{uuid.uuid4().hex}", "type": item.type, "title": item.title, "author": item.author,
-        "shortDesc": item.shortDesc, "fullDesc": item.fullDesc, "link": item.link, "coverUrl": item.coverUrl, 
-        "imageUrls": item.imageUrls or [],  # 🖼️ 效果展示图列表
-        "price": item.price, 
-        "github_token": item.github_token,
-        "netdisk_password": item.netdisk_password,  # ☁️ 网盘密码
-        "is_netdisk": item.is_netdisk,              # ☁️ 是否网盘资源
-        "is_original": item.is_original,            # 🎨 是否为原创作品
-        "allow_refund": item.allow_refund,          # 💸 是否支持退款
-        "likes": 0, "favorites": 0, "comments": 0, "uses": 0, "use_history": {}, "created_at": int(time.time()), "liked_by": [], "favorited_by": [],
-        "views": 0,
-        "daily_views": 0,
-        "viewed_by": [],
-        "daily_views_date": "",
-        "rating_avg": 0.0,
-        "rating_count": 0,
-        "rating_dist": {"1": 0, "2": 0, "3": 0, "4": 0, "5": 0},
-        "rated_by": {}
-    }
-    try:
-        if item.request_id is not None:
-            from database_sql import engine
-            from resource_publication import publish_once
-            payload = {key: new_item[key] for key in item.model_dump(exclude={'request_id'})}
-            new_item = await asyncio.to_thread(publish_once, engine, db, new_item, item.request_id, payload)
-        else:
-            new_item = await asyncio.to_thread(publish_resource, db, new_item)
-    except ResourceStoreError as error:
-        raise HTTPException(status_code=error.status_code, detail=error.message) from None
-    # 已提交内容不因派生排序缓存故障而误报发布失败。
-    try:
-        sort_cache.invalidate("items:")
-    except Exception as error:
-        print(f"[资源发布] 缓存失效失败: error_type={type(error).__name__}")
-    
-    # 🚀 首次发布立即触发版本检测与预缓存
-    try:
-        link = item.link or ""
-        if "github.com" in link:
-            from 云端_定时版本检测引擎 import precache_github_zip
-            
-            async def _first_publish_precache():
-                try:
-                    refreshed = await refresh_resource_version(db, new_item['id'])
-                    if refreshed:
-                        await precache_github_zip(refreshed['item']['link'], refreshed['token'], new_item['id'], refreshed['commit'])
-                except Exception as e:
-                    print(f"[缓存刷新] 首次发布预缓存失败（不影响发布）: item_id={new_item['id']}, error_type={type(e).__name__}")
-            
-            asyncio.create_task(_first_publish_precache())
-    except Exception as e:
-        print(f"[缓存刷新] 触发首次发布缓存异常（不影响发布）: item_id={new_item['id']}, error_type={type(e).__name__}")
-    
-    return {"status": "success", "data": published_response(new_item)}
-
-@router.put("/api/items/{item_id}")
-@shared_limit(10)
-async def update_item(request: Request, item_id: str, update_data: ItemUpdate, current_user: str = Depends(require_auth)):
-    """
-    更新内容接口
-    🔒 P0安全修复：使用 JWT Token 验证用户身份，而非前端传入的 author 参数
-    🔄 P7后悔模式：价格修改延迟24小时生效
-    🔧 Bug修复：使用 atomic_update 避免并发竞态条件
-    """
-    try:
-        result_holder = await asyncio.to_thread(edit_resource, db, item_id, current_user,
-            update_data.model_dump(exclude_unset=True))
-    except ResourceStoreError as error:
-        raise HTTPException(status_code=error.status_code, detail=error.message) from None
-    # 编辑已经提交，派生缓存故障不改写主操作的成功结果。
-    for invalidate, key in ((sort_cache.invalidate, "items:"), (invalidate_cache, "items.json")):
-        try:
-            invalidate(key)
-        except Exception as error:
-            print(f"[资源编辑] 缓存失效失败: error_type={type(error).__name__}")
-
-    # 来源变更撤销旧版本；后台重新检测当前资源，绝不用旧仓库hash请求新仓库。
-    if result_holder.get('source_changed'):
-        try:
-            await asyncio.to_thread(invalidate_source, db, item_id)
-            async def refresh_changed_source():
-                try:
-                    refreshed = await refresh_resource_version(db, item_id)
-                    if refreshed:
-                        from 云端_定时版本检测引擎 import precache_github_zip
-                        await precache_github_zip(refreshed['item']['link'], refreshed['token'], item_id, refreshed['commit'])
-                except Exception as error:
-                    print(f"[缓存刷新] 来源检测失败: error_type={type(error).__name__}")
-            asyncio.create_task(refresh_changed_source())
-        except Exception as error:
-            print(f"[缓存刷新] 来源撤销失败: error_type={type(error).__name__}")
-
-    result = {"status": "success", "edit_revision": result_holder["edit_revision"]}
-    if result_holder.get("price_change_info"):
-        price_change_info = result_holder["price_change_info"]
-        result["price_change"] = price_change_info
-        result["message"] = f"价格将于24小时后从{price_change_info['current_price']}调整为{price_change_info['new_price']}积分"
-    return result
-
-# ==========================================
-# 🚀 定时任务接口：检查 GitHub 仓库最新版本
-# 可通过外部调度器 (cron-job.org / GitHub Actions) 每日 02:00 触发
-# ==========================================
-@router.post("/api/check_updates")
-@shared_limit(30)
-async def check_github_updates(request: Request, current_user: str = Depends(require_auth)):
-    """
-    遍历所有 GitHub 类型的工具，获取最新 commit hash，存入 versions.json
-    """
-    if not is_admin(current_user):
-        raise HTTPException(status_code=403, detail="无权限")
-    items_db = await asyncio.to_thread(db.load_data, "items.json", default_data=[], strict=True, skip_cache=True)
-    updated_count = 0
-    for item in items_db:
-        if not item.get('link', '').startswith('https://github.com/'):
-            continue
-        try:
-            refreshed = await refresh_resource_version(db, item['id'])
-            if refreshed and refreshed['changed']:
-                updated_count += 1
-        except Exception as error:
-            print(f"[版本检查异常] error_type={type(error).__name__}")
-
-    return {
-        "status": "success", 
-        "message": f"版本检查完成，共更新 {updated_count} 个工具的版本号",
-        "updated_count": updated_count
-    }
-
-@router.get("/api/items/{item_id}")
-async def get_item_by_id(item_id: str):
-    """根据ID获取单个资源的详细信息"""
-    items_db = read_public_source(db, "items.json", default_data=[])
-    comments_db = read_public_source(db, "comments.json", default_data={})
-    versions_db = read_public_source(db, "versions.json", default_data={})
-    
-    for item in items_db:
-        if item["id"] == item_id:
-            item_data = {**item}
-            _apply_effective_price(item_data)
-            # 添加关联数据
-            item_data["commentsData"] = comments_db.get(item_id, [])
-            item_data["comments"] = len(item_data["commentsData"])
-            item_data["latest_version"] = _get_version_str(versions_db, item_id)
-            
-            # 🔴 【安全防线】：抹除敏感信息（在拷贝上操作）
-            item_data["has_private_token"] = bool(item_data.get("github_token"))
-            item_data.pop("github_token", None)
-            item_data.pop("netdisk_password", None)
-            item_data.pop("viewed_by", None)
-            
-            return {"status": "success", "data": item_data}
-    
-    raise HTTPException(status_code=404, detail="资源不存在")
-
-@router.get("/api/item/{item_id}/version")
-async def get_item_version(item_id: str):
-    """获取单个资源的最新版本号"""
-    versions_db = read_public_source(db, "versions.json", default_data={})
-    return {"status": "success", "version": _get_version_str(versions_db, item_id)}
-
-@router.delete("/api/items/{item_id}")
-@shared_limit(10)
-async def delete_item(request: Request, item_id: str, current_user: str = Depends(require_auth)):
-    """
-    删除内容（仅作者或管理员可操作）
-    🔧 Bug修复：使用 atomic_update 避免并发竞态条件
-    """
-    try:
-        result = await asyncio.to_thread(delete_resource, db, item_id, current_user, is_admin(current_user))
-    except ResourceStoreError as error:
-        raise HTTPException(status_code=error.status_code, detail=error.message) from None
-    for invalidate, key in ((invalidate_cache, "items.json"), (invalidate_cache, "comments.json"),
-                            (invalidate_cache, "versions.json"), (sort_cache.invalidate, "items:")):
-        try:
-            invalidate(key)
-        except Exception as error:
-            print(f"[资源删除] 缓存失效失败: error_type={type(error).__name__}")
-    return {"status": "success", "message": "内容已删除", **result}
-
-
-@router.post("/api/items/{item_id}/view")
-@shared_limit(60)
-async def record_item_view(request: Request, item_id: str, current_user: str = Depends(require_auth)):
-    """
-    记录资源访问量
-    👁️ 需要用户认证，每个用户只计算一次总访问量，日访问量每次调用都增加
-    """
-    result = record_view("items.json", item_id, current_user)
-    
-    if result is None:
-        raise HTTPException(status_code=404, detail="找不到该内容记录")
-    
-    # 🗂️ 清除排序缓存（浏览量变化可能影响排序）
-    sort_cache.invalidate("items:")
-    
-    return {"status": "success", "views": result["views"], "daily_views": result["daily_views"]}
-
-
-@router.post("/api/items/{item_id}/use")
-@shared_limit(30)
-async def record_item_use(request: Request, item_id: str, current_user: str = Depends(require_auth)):
-    """
-    记录资源使用量/下载量（原子操作，并发安全）
-    📥 每个用户对同一资源只计一次，防止重复计数
-    """
-    result_container = [None]
-    current_month = datetime.date.today().strftime("%Y-%m")
-    
-    def updater(data):
-        for item in data:
-            if item["id"] == item_id:
-                used_by = item.get("used_by", [])
-                if current_user in used_by:
-                    # 用户已使用过，不重复计数
-                    result_container[0] = {"status": "success", "action": "already_used", "uses": item.get("uses", 0)}
-                    return
-                # 首次使用，增加计数
-                used_by.append(current_user)
-                item["uses"] = item.get("uses", 0) + 1
-                # 更新月度使用历史
-                use_history = item.get("use_history", {})
-                use_history[current_month] = use_history.get(current_month, 0) + 1
-                item["use_history"] = use_history
-                item["used_by"] = used_by
-                result_container[0] = {"status": "success", "action": "recorded", "uses": item["uses"]}
-                return
-        result_container[0] = None  # 未找到资源
-    
-    db.atomic_update("items.json", updater, default_data=[])
-    
-    if result_container[0] is None:
-        raise HTTPException(status_code=404, detail="资源不存在")
-    
-    # 🗂️ 清除排序缓存（使用数变化可能影响排序）
-    sort_cache.invalidate("items:")
-    
-    return result_container[0]
-
-
-# ==========================================
-# ❤️ 互动接口（点赞/收藏）
-# ==========================================
-
-@router.post("/api/items/{item_id}/rating")
-@shared_limit(20)
-async def rate_item(request: Request, item_id: str, payload: RatingRequest, current_user: str = Depends(require_auth)):
-    """
-    为资源评分（原子操作，并发安全）
-    ⭐ score: 1-5
-    """
-    score = payload.score
-    if score < 1 or score > 5:
-        raise HTTPException(status_code=400, detail="评分必须在1-5之间")
-    
-    result_container = [None]
-    
-    def updater(data):
-        for item in data:
-            if item["id"] == item_id:
-                # 禁止自评
-                if item.get("author") == current_user:
-                    result_container[0] = {"error": "self_rating"}
-                    return
-                # 初始化评分字段
-                if "rating_avg" not in item:
-                    item["rating_avg"] = 0.0
-                if "rating_count" not in item:
-                    item["rating_count"] = 0
-                if "rating_dist" not in item:
-                    item["rating_dist"] = {"1": 0, "2": 0, "3": 0, "4": 0, "5": 0}
-                if "rated_by" not in item:
-                    item["rated_by"] = {}
-                
-                rated_by = item["rated_by"]
-                rating_dist = item["rating_dist"]
-                old_score = None
-                if current_user in rated_by:
-                    old_score = rated_by[current_user]["score"]
-                
-                if old_score is not None:
-                    # 已评分，先减去旧分数分布
-                    rating_dist[str(old_score)] = max(0, rating_dist.get(str(old_score), 0) - 1)
-                    rating_dist[str(score)] = rating_dist.get(str(score), 0) + 1
-                else:
-                    # 未评分，增加计数
-                    item["rating_count"] = item.get("rating_count", 0) + 1
-                    rating_dist[str(score)] = rating_dist.get(str(score), 0) + 1
-                
-                rated_by[current_user] = {"score": score, "time": int(time.time())}
-                
-                # ��新计算平均分
-                total = sum(int(k) * v for k, v in rating_dist.items())
-                count = item["rating_count"]
-                item["rating_avg"] = round(total / count, 2) if count > 0 else 0.0
-                
-                result_container[0] = {
-                    "status": "success",
-                    "rating_avg": item["rating_avg"],
-                    "rating_count": item["rating_count"],
-                    "rating_dist": item["rating_dist"],
-                    "user_score": score
-                }
-                return
-        result_container[0] = None  # 未找到资源
-    
-    db.atomic_update("items.json", updater, default_data=[])
-    
-    if result_container[0] is None:
-        raise HTTPException(status_code=404, detail="资源不存在")
-    if result_container[0].get("error") == "self_rating":
-        raise HTTPException(status_code=400, detail="不能给自己发布的资源评分")
-    
-    # 🗂️ 清除排序缓存（评分变化可能影响排序）
-    sort_cache.invalidate("items:")
-    
-    return result_container[0]
-
-
-@router.post("/api/items/{item_id}/like")
-@shared_limit(30)
-async def toggle_item_like(request: Request, item_id: str, current_user: str = Depends(require_auth)):
-    """
-    点赞/取消点赞（原子操作，并发安全）
-    """
-    result_container = [None]
-    
-    def updater(data):
-        for item in data:
-            if item["id"] == item_id:
-                liked_by = item.get("liked_by", [])
-                if current_user in liked_by:
-                    liked_by.remove(current_user)
-                    item["likes"] = max(0, item.get("likes", 0) - 1)
-                    action = "unliked"
-                else:
-                    liked_by.append(current_user)
-                    item["likes"] = item.get("likes", 0) + 1
-                    action = "liked"
-                item["liked_by"] = liked_by
-                result_container[0] = {"status": "success", "action": action, "likes": item["likes"]}
-                return
-        result_container[0] = None  # 未找到资源
-    
-    db.atomic_update("items.json", updater, default_data=[])
-    
-    if result_container[0] is None:
-        raise HTTPException(status_code=404, detail="资源不存在")
-    
-    # 🗂️ 清除排序缓存（点赞数变化可能影响排序）
-    sort_cache.invalidate("items:")
-    
-    return result_container[0]
-
-
-@router.post("/api/items/{item_id}/favorite")
-@shared_limit(30)
-async def toggle_item_favorite(request: Request, item_id: str, current_user: str = Depends(require_auth)):
-    """
-    收藏/取消收藏（原子操作，并发安全）
-    """
-    result_container = [None]
-    
-    def updater(data):
-        for item in data:
-            if item["id"] == item_id:
-                favorited_by = item.get("favorited_by", [])
-                if current_user in favorited_by:
-                    favorited_by.remove(current_user)
-                    item["favorites"] = max(0, item.get("favorites", 0) - 1)
-                    action = "unfavorited"
-                else:
-                    favorited_by.append(current_user)
-                    item["favorites"] = item.get("favorites", 0) + 1
-                    action = "favorited"
-                item["favorited_by"] = favorited_by
-                result_container[0] = {"status": "success", "action": action, "favorites": item["favorites"]}
-                return
-        result_container[0] = None  # 未找到资源
-    
-    db.atomic_update("items.json", updater, default_data=[])
-    
-    if result_container[0] is None:
-        raise HTTPException(status_code=404, detail="资源不存在")
-    
-    # 🗂️ 清除排序缓存（收藏数变化可能影响排序）
-    sort_cache.invalidate("items:")
-    
-    return result_container[0]
-
-
-# ==========================================
-# 🔄 手动触发预缓存刷新接口
-# ==========================================
-@router.post("/api/items/{item_id}/refresh_cache")
-@shared_limit(3)
-async def refresh_item_cache(request: Request, item_id: str, current_user: str = Depends(require_auth)):
-    """手动触发指定资源的 ZIP 预缓存刷新，仅限作者调用"""
-    items_db = db.load_data("items.json", default_data=[])
-    
-    # 查找目标 item
-    target_item = None
-    for item in items_db:
-        if item["id"] == item_id:
-            target_item = item
-            break
-    
-    if not target_item:
-        raise HTTPException(status_code=404, detail="资源不存在")
-    
-    # 权限校验：仅作者可操作
-    if target_item.get("author") != current_user:
-        raise HTTPException(status_code=403, detail="仅作者可触发缓存刷新")
-    
-    # 仅支持 GitHub 仓库类型
-    link = target_item.get("link", "")
-    if "github.com" not in link:
-        raise HTTPException(status_code=400, detail="仅支持 GitHub 仓库类型的资源")
-    
-    try:
-        from 云端_定时版本检测引擎 import precache_github_zip
-    except ImportError:
-        raise HTTPException(status_code=500, detail="预缓存模块不可用")
-    
-    refreshed = await refresh_resource_version(db, item_id)
-    if not refreshed:
-        raise HTTPException(status_code=503, detail="资源版本暂时无法核实，请稍后重试")
-    success = await precache_github_zip(refreshed['item']['link'], refreshed['token'], item_id, refreshed['commit'])
-
-    if success:
-        return {"status": "success", "message": "缓存刷新完成"}
-    else:
-        return {"status": "error", "message": "缓存刷新失败，请查看云端日志获取详细信息"}
+from resource_work import run_resource_write, start_resource_background
+# router_items.py
+from fastapi import APIRouter, HTTPException, Depends, Request
+from rate_limit import shared_limit
+import time
+import uuid
+import datetime
+import os
+import re
+import urllib.request
+import urllib.error
+import json
+import asyncio
+import 数据库连接 as db
+from models import ItemCreate, ItemUpdate, RatingRequest
+from 安全认证 import require_auth, check_ownership, is_admin
+from 数据库连接 import invalidate_cache
+from db_utils import read_public_source, record_view, sort_cache
+from github_source import repository_parts, select_github_token
+from github_versions import refresh_resource_version, invalidate_source
+from resource_store import publish_resource, published_response, edit_resource, ResourceStoreError
+from purchase_transaction import effective_resource_price
+from resource_deletion import delete_resource
+
+router = APIRouter()
+
+def safe_str(val):
+    """安全转换为字符串"""
+    if val is None:
+        return ""
+    return str(val).lower()
+
+def _get_version_str(versions_db: dict, item_id: str) -> str:
+    """兼容新旧格式获取版本hash字符串"""
+    val = versions_db.get(item_id, "")
+    if isinstance(val, dict):
+        return val.get("hash", "") or ""
+    return val or ""
+
+def _apply_effective_price(item: dict) -> None:
+    """计算当前有效价格；调用者须传响应副本或处于编辑锁内。"""
+    try:
+        price = effective_resource_price(item)
+        pending = item.get('pending_price')
+        effective = item.get('pending_price_effective_at')
+        if type(pending) in (int, float) and pending == price and effective:
+            when = datetime.datetime.fromisoformat(effective)
+            now = datetime.datetime.now(when.tzinfo) if when.tzinfo else datetime.datetime.now()
+            if now >= when:
+                item['pending_price'] = None
+                item['pending_price_effective_at'] = None
+        item['price'] = price
+    except (ValueError, TypeError) as error:
+        import logging
+        kinds = {type(None): 'null', bool: 'boolean', int: 'integer', float: 'number',
+                 str: 'string', list: 'array', dict: 'object'}
+        reason = ('invalid_effective_price' if len(error.args) == 1
+                  and type(error.args[0]) is str and error.args[0] == 'invalid resource price'
+                  else 'invalid_effective_time')
+        try:
+            logging.getLogger('ComfyUI-Ranking.Items').warning(
+                'RESOURCE_PRICE_INVALID | reason=%s | price_type=%s | pending_price_type=%s | effective_time_type=%s',
+                reason, kinds.get(type(item.get('price', 0)), 'unknown'),
+                kinds.get(type(item.get('pending_price')), 'unknown'),
+                kinds.get(type(item.get('pending_price_effective_at')), 'unknown'))
+        except Exception:
+            pass
+        raise HTTPException(status_code=503, detail="资源价格暂时无法核实") from None
+
+
+def get_last_6_months():
+    res = []
+    today = datetime.date.today()
+    for i in range(5, -1, -1):
+        m = today.month - i
+        y = today.year
+        while m <= 0:
+            m += 12
+            y -= 1
+        res.append(f"{y}-{m:02d}")
+    return res
+
+# 数据文件标识，用于排序缓存
+data_file = "items.json"
+
+@router.get("/api/items")
+async def get_items(type: str = "tool", sort: str = "time", limit: int = 50): # 优化：默认限制调大至 50，提升前端列表体验
+    read_epoch = sort_cache.capture_read_epoch()
+    items_db = read_public_source(db, "items.json", default_data=[])
+    comments_db = read_public_source(db, "comments.json", default_data={})
+    versions_db = read_public_source(db, "versions.json", default_data={}) # 读取版本库
+    
+    # 如果是推荐榜，匹配所有 recommend 开头的子类型
+    if type == "recommend":
+        filtered_items = [item for item in items_db if item.get("type", "").startswith("recommend")]
+    else:
+        filtered_items = [item for item in items_db if item.get("type") == type]
+    
+    # 🗂️ 使用排序缓存优化排序性能
+    cache_sort = sort if sort in ("time", "likes", "favorites", "downloads", "tips", "views", "daily_views", "rating") else "time"
+    cache_key = f"items:{type}:{cache_sort}"
+    
+    current_month = datetime.date.today().strftime("%Y-%m") if sort == "tips" else None
+    def order_key(item):
+        if sort == "likes":
+            return item.get("likes", 0)
+        elif sort == "favorites":
+            return item.get("favorites", 0)
+        elif sort == "downloads":
+            return item.get("uses", 0)
+        elif sort == "tips": # 🚀 按近期打赏排序
+            return item.get("tip_history", {}).get(current_month, 0)
+        elif sort == "views": # 👁️ 按总访问量排序
+            return item.get("views", 0)
+        elif sort == "daily_views": # 👁️ 按日访问量排序
+            return item.get("daily_views", 0)
+        elif sort == "rating": # ⭐ 按评分排序
+            return (item.get("rating_avg", 0), item.get("rating_count", 0))
+        else: # time 或其他默认
+            return item.get("created_at", 0)
+
+    def sort_fn(data):
+        data.sort(key=order_key, reverse=True)
+    
+    filtered_items = sort_cache.get_sorted(cache_key, filtered_items, sort_fn, read_epoch=read_epoch, fresh=True)
+        
+    result_items = []
+    for item in filtered_items:
+        item_data = {**item}
+        _apply_effective_price(item_data)
+        item_data["commentsData"] = comments_db.get(item_data["id"], [])
+        item_data["comments"] = len(item_data["commentsData"])
+        item_data["latest_version"] = _get_version_str(versions_db, item_data["id"])
+
+        # 🔴 【绝对核心防线】：在下发给前端前，强行在内存中抹除敏感信息！
+        item_data["has_private_token"] = bool(item_data.get("github_token"))
+        item_data.pop("github_token", None)
+        item_data.pop("netdisk_password", None)  # ☁️ 网盘密码不在列表中显示
+        item_data.pop("viewed_by", None)  # 👁️ 访问者列表不暴露给前端
+        result_items.append(item_data)
+    
+    return {"status": "success", "data": result_items[:limit]}
+
+def _build_creator_trend_data(account: str, u_items: list, months: list) -> dict:
+    """
+    构建创作者趋势数据
+    提取为独立函数供列表接口和详情接口复用
+    """
+    trend_tools = {m: 0 for m in months}
+    trend_skills = {m: 0 for m in months}
+    trend_apps = {m: 0 for m in months}
+    trend_recommends = {m: 0 for m in months}
+    
+    for i in u_items:
+        itype = i.get("type", "")
+        history = i.get("use_history", {})
+        if itype == "tool" or itype == "recommend_tool": 
+            for m, v in history.items():
+                if m in trend_tools: trend_tools[m] += v
+        elif itype == "skill" or itype == "recommend_skill":
+            for m, v in history.items():
+                if m in trend_skills: trend_skills[m] += v
+        elif itype == "app" or itype == "recommend_app": 
+            for m, v in history.items():
+                if m in trend_apps: trend_apps[m] += v
+        elif itype.startswith("recommend"):
+            for m, v in history.items():
+                if m in trend_recommends: trend_recommends[m] += v
+    
+    return {
+        "months": months,
+        "tools": [trend_tools[m] for m in months],
+        "skills": [trend_skills[m] for m in months],
+        "apps": [trend_apps[m] for m in months],
+        "recommends": [trend_recommends[m] for m in months]
+    }
+
+
+@router.get("/api/creators/search")
+async def search_creators(keyword: str, sort: str = "downloads", limit: int = 50):
+    """
+    搜索创作者
+    根据关键词搜索创作者（name、account、shortDesc 不区分大小写子串匹配）
+    """
+    users_db = read_public_source(db, "users.json", default_data={})
+    items_db = read_public_source(db, "items.json", default_data=[])
+    
+    # 🚀 P1性能优化：预构建 author->items 索引
+    author_items_index = {}
+    for item in items_db:
+        author = item.get("author")
+        if author:
+            if author not in author_items_index:
+                author_items_index[author] = []
+            author_items_index[author].append(item)
+    
+    creators = []
+    months = get_last_6_months()
+    keyword_lower = keyword.lower()
+    
+    for account, u in users_db.items():
+        # 🚀 P1性能优化：直接从索引获取
+        u_items = author_items_index.get(account, [])
+        
+        # 获取搜索字段并转为小写
+        name = u.get("name", account)
+        short_desc = u.get("shortDesc") or u.get("intro") or ""
+        
+        # 不区分大小写的子串匹配（同时覆盖 shortDesc 和 intro 两个字段）
+        search_text = f"{safe_str(name)} {safe_str(account)} {safe_str(short_desc)} {safe_str(u.get('intro'))} {safe_str(u.get('shortDesc'))}"
+        if keyword_lower not in search_text:
+            continue
+        
+        tools_count = 0
+        skills_count = 0
+        apps_count = 0
+        
+        for i in u_items:
+            itype = i.get("type", "")
+            if itype == "tool": 
+                tools_count += 1
+            elif itype == "skill":
+                skills_count += 1
+            elif itype == "app": 
+                apps_count += 1
+
+        creators.append({
+            "account": account, "name": name, "avatar": u.get("avatarDataUrl", ""),
+            "bannerUrl": u.get("bannerUrl"),
+            "shortDesc": short_desc, "fullDesc": short_desc,
+            "likes": sum(i.get("likes", 0) for i in u_items), "favorites": sum(i.get("favorites", 0) for i in u_items), 
+            "downloads": sum(i.get("uses", 0) for i in u_items), 
+            "views": sum(i.get("views", 0) for i in u_items),
+            "daily_views": sum(i.get("daily_views", 0) for i in u_items), 
+            "toolsCount": tools_count, "skillsCount": skills_count, "appsCount": apps_count, "followers": len(u.get("followers", [])), "created_at": u.get("created_at", 0),
+            "recent_tips": u.get("tip_history", {}).get(datetime.date.today().strftime("%Y-%m"), 0),
+        })
+    
+    # 排序逻辑与 /api/creators 保持一致
+    if sort == "likes": creators.sort(key=lambda x: x.get("likes", 0), reverse=True)
+    elif sort == "favorites": creators.sort(key=lambda x: x.get("favorites", 0), reverse=True)
+    elif sort == "downloads": creators.sort(key=lambda x: x.get("downloads", 0), reverse=True)
+    elif sort == "tips": creators.sort(key=lambda x: x.get("recent_tips", 0), reverse=True)
+    elif sort == "views": creators.sort(key=lambda x: x.get("views", 0), reverse=True)
+    elif sort == "daily_views": creators.sort(key=lambda x: x.get("daily_views", 0), reverse=True)
+    else: creators.sort(key=lambda x: x.get("created_at", 0), reverse=True)
+    
+    return {"status": "success", "data": creators[:limit]}
+
+
+@router.get("/api/creators")
+async def get_creators(sort: str = "downloads", limit: int = 100):
+    """
+    获取创作者列表
+    🚀 P1性能优化：预构建 author->items 索引，避免 N+1 查询
+    ⚡ P2性能优化：移除大字段（trendData、commentsData、tip_board），移至详情接口按需加载
+    """
+    users_db = read_public_source(db, "users.json", default_data={})
+    items_db = read_public_source(db, "items.json", default_data=[])
+    
+    # 🚀 P1性能优化：预构建 author->items 索引，复杂度从 O(n*m) 降到 O(n+m)
+    author_items_index = {}
+    for item in items_db:
+        author = item.get("author")
+        if author:
+            if author not in author_items_index:
+                author_items_index[author] = []
+            author_items_index[author].append(item)
+    
+    creators = []
+    months = get_last_6_months()
+    
+    for account, u in users_db.items():
+        # 🚀 P1性能优化：直接从索引获取，而非遍历全表
+        u_items = author_items_index.get(account, [])
+        
+        tools_count = 0
+        skills_count = 0
+        apps_count = 0
+        
+        for i in u_items:
+            itype = i.get("type", "")
+            if itype == "tool": 
+                tools_count += 1
+            elif itype == "skill":
+                skills_count += 1
+            elif itype == "app": 
+                apps_count += 1
+
+        creators.append({
+            "account": account, "name": u.get("name", account), "avatar": u.get("avatarDataUrl", ""),
+            "bannerUrl": u.get("bannerUrl"),  # 🖼️ 个人资料卡背景图
+            "shortDesc": u.get("shortDesc") or u.get("intro") or "", "fullDesc": u.get("shortDesc") or u.get("intro") or "",
+            "likes": sum(i.get("likes", 0) for i in u_items), "favorites": sum(i.get("favorites", 0) for i in u_items), 
+            "downloads": sum(i.get("uses", 0) for i in u_items), 
+            "views": sum(i.get("views", 0) for i in u_items),
+            "daily_views": sum(i.get("daily_views", 0) for i in u_items), 
+            "toolsCount": tools_count, "skillsCount": skills_count, "appsCount": apps_count, "followers": len(u.get("followers", [])), "created_at": u.get("created_at", 0),
+            "recent_tips": u.get("tip_history", {}).get(datetime.date.today().strftime("%Y-%m"), 0), # 🚀 新增：本月收益统计
+        })
+        
+    if sort == "likes": creators.sort(key=lambda x: x.get("likes", 0), reverse=True)
+    elif sort == "favorites": creators.sort(key=lambda x: x.get("favorites", 0), reverse=True)
+    elif sort == "downloads": creators.sort(key=lambda x: x.get("downloads", 0), reverse=True)
+    elif sort == "tips": creators.sort(key=lambda x: x.get("recent_tips", 0), reverse=True) # 🚀 新增：按近期打赏排序
+    elif sort == "views": creators.sort(key=lambda x: x.get("views", 0), reverse=True)
+    elif sort == "daily_views": creators.sort(key=lambda x: x.get("daily_views", 0), reverse=True)
+    else: creators.sort(key=lambda x: x.get("created_at", 0), reverse=True)
+    
+    return {"status": "success", "data": creators[:limit]}
+
+
+@router.get("/api/creators/{account}/details")
+async def get_creator_details(account: str):
+    """
+    获取单个创作者的详细数据
+    供前端展开卡片时按需加载
+    包含：trendData、commentsData、tip_board
+    """
+    users_db = read_public_source(db, "users.json", default_data={})
+    items_db = read_public_source(db, "items.json", default_data=[])
+    comments_db = read_public_source(db, "comments.json", default_data={})
+    
+    # 检查用户是否存在
+    if account not in users_db:
+        raise HTTPException(status_code=404, detail="创作者不存在")
+    
+    u = users_db[account]
+    
+    # 获取该用户的所有作品
+    u_items = [item for item in items_db if item.get("author") == account]
+    
+    # 构建趋势数据
+    months = get_last_6_months()
+    trend_data = _build_creator_trend_data(account, u_items, months)
+    
+    return {
+        "status": "success",
+        "data": {
+            "account": account,
+            "trendData": trend_data,
+            "commentsData": comments_db.get(account, []),
+            "tip_board": u.get("tip_board", [])
+        }
+    }
+
+def _publish_item_record(new_item, request_id, payload_fields):
+    if request_id is not None:
+        from database_sql import engine
+        from resource_publication import publish_once
+        payload = {key: new_item[key] for key in payload_fields}
+        new_item = publish_once(engine, db, new_item, request_id, payload)
+    else:
+        new_item = publish_resource(db, new_item)
+    # 已提交内容不因派生排序缓存故障而误报发布失败。
+    try:
+        sort_cache.invalidate("items:")
+    except Exception as error:
+        print(f"[资源发布] 缓存失效失败: error_type={type(error).__name__}")
+    return new_item
+
+
+def _edit_item_record(item_id, current_user, changes):
+    result_holder = edit_resource(db, item_id, current_user, changes)
+    # 编辑已经提交，派生缓存故障不改写主操作的成功结果。
+    for invalidate, key in ((sort_cache.invalidate, "items:"), (invalidate_cache, "items.json")):
+        try:
+            invalidate(key)
+        except Exception as error:
+            print(f"[资源编辑] 缓存失效失败: error_type={type(error).__name__}")
+    refresh_source = False
+    if result_holder.get('source_changed'):
+        try:
+            invalidate_source(db, item_id)
+            refresh_source = True
+        except Exception as error:
+            print(f"[缓存刷新] 来源撤销失败: error_type={type(error).__name__}")
+    return result_holder, refresh_source
+
+
+def _delete_item_record(item_id, current_user, administrator):
+    result = delete_resource(db, item_id, current_user, administrator)
+    for invalidate, key in ((invalidate_cache, "items.json"), (invalidate_cache, "comments.json"),
+                            (invalidate_cache, "versions.json"), (sort_cache.invalidate, "items:")):
+        try:
+            invalidate(key)
+        except Exception as error:
+            print(f"[资源删除] 缓存失效失败: error_type={type(error).__name__}")
+    return result
+
+
+@router.post("/api/items")
+@shared_limit(5)
+async def create_item(request: Request, item: ItemCreate, current_user: str = Depends(require_auth)):
+    # 🔒 P0安全修复：使用 JWT 认证的用户账号作为作者，防止伪造
+    item.author = current_user
+    if not re.fullmatch(r'[A-Za-z0-9_-]{1,50}', item.type or ''):
+        raise HTTPException(status_code=400, detail="资源类型无效")
+    new_item = {
+        "id": f"{item.type}_{int(time.time())}_{uuid.uuid4().hex}", "type": item.type, "title": item.title, "author": item.author,
+        "shortDesc": item.shortDesc, "fullDesc": item.fullDesc, "link": item.link, "coverUrl": item.coverUrl, 
+        "imageUrls": item.imageUrls or [],  # 🖼️ 效果展示图列表
+        "price": item.price, 
+        "github_token": item.github_token,
+        "netdisk_password": item.netdisk_password,  # ☁️ 网盘密码
+        "is_netdisk": item.is_netdisk,              # ☁️ 是否网盘资源
+        "is_original": item.is_original,            # 🎨 是否为原创作品
+        "allow_refund": item.allow_refund,          # 💸 是否支持退款
+        "likes": 0, "favorites": 0, "comments": 0, "uses": 0, "use_history": {}, "created_at": int(time.time()), "liked_by": [], "favorited_by": [],
+        "views": 0,
+        "daily_views": 0,
+        "viewed_by": [],
+        "daily_views_date": "",
+        "rating_avg": 0.0,
+        "rating_count": 0,
+        "rating_dist": {"1": 0, "2": 0, "3": 0, "4": 0, "5": 0},
+        "rated_by": {}
+    }
+    try:
+        new_item = await run_resource_write(_publish_item_record, new_item, item.request_id,
+            item.model_dump(exclude={'request_id'}))
+    except ResourceStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+
+    # 🚀 首次发布立即触发版本检测与预缓存
+    try:
+        link = item.link or ""
+        if "github.com" in link:
+            from 云端_定时版本检测引擎 import precache_github_zip
+            
+            async def _first_publish_precache():
+                try:
+                    refreshed = await refresh_resource_version(db, new_item['id'])
+                    if refreshed:
+                        await precache_github_zip(refreshed['item']['link'], refreshed['token'], new_item['id'], refreshed['commit'])
+                except Exception as e:
+                    print(f"[缓存刷新] 首次发布预缓存失败（不影响发布）: item_id={new_item['id']}, error_type={type(e).__name__}")
+            
+            start_resource_background(_first_publish_precache)
+    except Exception as e:
+        print(f"[缓存刷新] 触发首次发布缓存异常（不影响发布）: item_id={new_item['id']}, error_type={type(e).__name__}")
+    
+    return {"status": "success", "data": published_response(new_item)}
+
+@router.put("/api/items/{item_id}")
+@shared_limit(10)
+async def update_item(request: Request, item_id: str, update_data: ItemUpdate, current_user: str = Depends(require_auth)):
+    """
+    更新内容接口
+    🔒 P0安全修复：使用 JWT Token 验证用户身份，而非前端传入的 author 参数
+    🔄 P7后悔模式：价格修改延迟24小时生效
+    🔧 Bug修复：使用 atomic_update 避免并发竞态条件
+    """
+    try:
+        result_holder, refresh_source = await run_resource_write(_edit_item_record, item_id, current_user,
+            update_data.model_dump(exclude_unset=True))
+    except ResourceStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+    if refresh_source:
+        try:
+            async def refresh_changed_source():
+                try:
+                    refreshed = await refresh_resource_version(db, item_id)
+                    if refreshed:
+                        from 云端_定时版本检测引擎 import precache_github_zip
+                        await precache_github_zip(refreshed['item']['link'], refreshed['token'], item_id, refreshed['commit'])
+                except Exception as error:
+                    print(f"[缓存刷新] 来源检测失败: error_type={type(error).__name__}")
+            start_resource_background(refresh_changed_source)
+        except Exception as error:
+            print(f"[缓存刷新] 来源撤销失败: error_type={type(error).__name__}")
+
+    result = {"status": "success", "edit_revision": result_holder["edit_revision"]}
+    if result_holder.get("price_change_info"):
+        price_change_info = result_holder["price_change_info"]
+        result["price_change"] = price_change_info
+        result["message"] = f"价格将于24小时后从{price_change_info['current_price']}调整为{price_change_info['new_price']}积分"
+    return result
+
+# ==========================================
+# 🚀 定时任务接口：检查 GitHub 仓库最新版本
+# 可通过外部调度器 (cron-job.org / GitHub Actions) 每日 02:00 触发
+# ==========================================
+@router.post("/api/check_updates")
+@shared_limit(30)
+async def check_github_updates(request: Request, current_user: str = Depends(require_auth)):
+    """
+    遍历所有 GitHub 类型的工具，获取最新 commit hash，存入 versions.json
+    """
+    if not is_admin(current_user):
+        raise HTTPException(status_code=403, detail="无权限")
+    items_db = await asyncio.to_thread(db.load_data, "items.json", default_data=[], strict=True, skip_cache=True)
+    updated_count = 0
+    for item in items_db:
+        if not item.get('link', '').startswith('https://github.com/'):
+            continue
+        try:
+            refreshed = await refresh_resource_version(db, item['id'])
+            if refreshed and refreshed['changed']:
+                updated_count += 1
+        except Exception as error:
+            print(f"[版本检查异常] error_type={type(error).__name__}")
+
+    return {
+        "status": "success", 
+        "message": f"版本检查完成，共更新 {updated_count} 个工具的版本号",
+        "updated_count": updated_count
+    }
+
+@router.get("/api/items/{item_id}")
+async def get_item_by_id(item_id: str):
+    """根据ID获取单个资源的详细信息"""
+    items_db = read_public_source(db, "items.json", default_data=[])
+    comments_db = read_public_source(db, "comments.json", default_data={})
+    versions_db = read_public_source(db, "versions.json", default_data={})
+    
+    for item in items_db:
+        if item["id"] == item_id:
+            item_data = {**item}
+            _apply_effective_price(item_data)
+            # 添加关联数据
+            item_data["commentsData"] = comments_db.get(item_id, [])
+            item_data["comments"] = len(item_data["commentsData"])
+            item_data["latest_version"] = _get_version_str(versions_db, item_id)
+            
+            # 🔴 【安全防线】：抹除敏感信息（在拷贝上操作）
+            item_data["has_private_token"] = bool(item_data.get("github_token"))
+            item_data.pop("github_token", None)
+            item_data.pop("netdisk_password", None)
+            item_data.pop("viewed_by", None)
+            
+            return {"status": "success", "data": item_data}
+    
+    raise HTTPException(status_code=404, detail="资源不存在")
+
+@router.get("/api/item/{item_id}/version")
+async def get_item_version(item_id: str):
+    """获取单个资源的最新版本号"""
+    versions_db = read_public_source(db, "versions.json", default_data={})
+    return {"status": "success", "version": _get_version_str(versions_db, item_id)}
+
+@router.delete("/api/items/{item_id}")
+@shared_limit(10)
+async def delete_item(request: Request, item_id: str, current_user: str = Depends(require_auth)):
+    """
+    删除内容（仅作者或管理员可操作）
+    🔧 Bug修复：使用 atomic_update 避免并发竞态条件
+    """
+    try:
+        result = await run_resource_write(_delete_item_record, item_id, current_user, is_admin(current_user))
+    except ResourceStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+    return {"status": "success", "message": "内容已删除", **result}
+
+
+@router.post("/api/items/{item_id}/view")
+@shared_limit(60)
+async def record_item_view(request: Request, item_id: str, current_user: str = Depends(require_auth)):
+    """
+    记录资源访问量
+    👁️ 需要用户认证，每个用户只计算一次总访问量，日访问量每次调用都增加
+    """
+    result = record_view("items.json", item_id, current_user)
+    
+    if result is None:
+        raise HTTPException(status_code=404, detail="找不到该内容记录")
+    
+    # 🗂️ 清除排序缓存（浏览量变化可能影响排序）
+    sort_cache.invalidate("items:")
+    
+    return {"status": "success", "views": result["views"], "daily_views": result["daily_views"]}
+
+
+@router.post("/api/items/{item_id}/use")
+@shared_limit(30)
+async def record_item_use(request: Request, item_id: str, current_user: str = Depends(require_auth)):
+    """
+    记录资源使用量/下载量（原子操作，并发安全）
+    📥 每个用户对同一资源只计一次，防止重复计数
+    """
+    result_container = [None]
+    current_month = datetime.date.today().strftime("%Y-%m")
+    
+    def updater(data):
+        for item in data:
+            if item["id"] == item_id:
+                used_by = item.get("used_by", [])
+                if current_user in used_by:
+                    # 用户已使用过，不重复计数
+                    result_container[0] = {"status": "success", "action": "already_used", "uses": item.get("uses", 0)}
+                    return
+                # 首次使用，增加计数
+                used_by.append(current_user)
+                item["uses"] = item.get("uses", 0) + 1
+                # 更新月度使用历史
+                use_history = item.get("use_history", {})
+                use_history[current_month] = use_history.get(current_month, 0) + 1
+                item["use_history"] = use_history
+                item["used_by"] = used_by
+                result_container[0] = {"status": "success", "action": "recorded", "uses": item["uses"]}
+                return
+        result_container[0] = None  # 未找到资源
+    
+    db.atomic_update("items.json", updater, default_data=[])
+    
+    if result_container[0] is None:
+        raise HTTPException(status_code=404, detail="资源不存在")
+    
+    # 🗂️ 清除排序缓存（使用数变化可能影响排序）
+    sort_cache.invalidate("items:")
+    
+    return result_container[0]
+
+
+# ==========================================
+# ❤️ 互动接口（点赞/收藏）
+# ==========================================
+
+@router.post("/api/items/{item_id}/rating")
+@shared_limit(20)
+async def rate_item(request: Request, item_id: str, payload: RatingRequest, current_user: str = Depends(require_auth)):
+    """
+    为资源评分（原子操作，并发安全）
+    ⭐ score: 1-5
+    """
+    score = payload.score
+    if score < 1 or score > 5:
+        raise HTTPException(status_code=400, detail="评分必须在1-5之间")
+    
+    result_container = [None]
+    
+    def updater(data):
+        for item in data:
+            if item["id"] == item_id:
+                # 禁止自评
+                if item.get("author") == current_user:
+                    result_container[0] = {"error": "self_rating"}
+                    return
+                # 初始化评分字段
+                if "rating_avg" not in item:
+                    item["rating_avg"] = 0.0
+                if "rating_count" not in item:
+                    item["rating_count"] = 0
+                if "rating_dist" not in item:
+                    item["rating_dist"] = {"1": 0, "2": 0, "3": 0, "4": 0, "5": 0}
+                if "rated_by" not in item:
+                    item["rated_by"] = {}
+                
+                rated_by = item["rated_by"]
+                rating_dist = item["rating_dist"]
+                old_score = None
+                if current_user in rated_by:
+                    old_score = rated_by[current_user]["score"]
+                
+                if old_score is not None:
+                    # 已评分，先减去旧分数分布
+                    rating_dist[str(old_score)] = max(0, rating_dist.get(str(old_score), 0) - 1)
+                    rating_dist[str(score)] = rating_dist.get(str(score), 0) + 1
+                else:
+                    # 未评分，增加计数
+                    item["rating_count"] = item.get("rating_count", 0) + 1
+                    rating_dist[str(score)] = rating_dist.get(str(score), 0) + 1
+                
+                rated_by[current_user] = {"score": score, "time": int(time.time())}
+                
+                # 重新计算平均分
+                total = sum(int(k) * v for k, v in rating_dist.items())
+                count = item["rating_count"]
+                item["rating_avg"] = round(total / count, 2) if count > 0 else 0.0
+                
+                result_container[0] = {
+                    "status": "success",
+                    "rating_avg": item["rating_avg"],
+                    "rating_count": item["rating_count"],
+                    "rating_dist": item["rating_dist"],
+                    "user_score": score
+                }
+                return
+        result_container[0] = None  # 未找到资源
+    
+    db.atomic_update("items.json", updater, default_data=[])
+    
+    if result_container[0] is None:
+        raise HTTPException(status_code=404, detail="资源不存在")
+    if result_container[0].get("error") == "self_rating":
+        raise HTTPException(status_code=400, detail="不能给自己发布的资源评分")
+    
+    # 🗂️ 清除排序缓存（评分变化可能影响排序）
+    sort_cache.invalidate("items:")
+    
+    return result_container[0]
+
+
+@router.post("/api/items/{item_id}/like")
+@shared_limit(30)
+async def toggle_item_like(request: Request, item_id: str, current_user: str = Depends(require_auth)):
+    """
+    点赞/取消点赞（原子操作，并发安全）
+    """
+    result_container = [None]
+    
+    def updater(data):
+        for item in data:
+            if item["id"] == item_id:
+                liked_by = item.get("liked_by", [])
+                if current_user in liked_by:
+                    liked_by.remove(current_user)
+                    item["likes"] = max(0, item.get("likes", 0) - 1)
+                    action = "unliked"
+                else:
+                    liked_by.append(current_user)
+                    item["likes"] = item.get("likes", 0) + 1
+                    action = "liked"
+                item["liked_by"] = liked_by
+                result_container[0] = {"status": "success", "action": action, "likes": item["likes"]}
+                return
+        result_container[0] = None  # 未找到资源
+    
+    db.atomic_update("items.json", updater, default_data=[])
+    
+    if result_container[0] is None:
+        raise HTTPException(status_code=404, detail="资源不存在")
+    
+    # 🗂️ 清除排序缓存（点赞数变化可能影响排序）
+    sort_cache.invalidate("items:")
+    
+    return result_container[0]
+
+
+@router.post("/api/items/{item_id}/favorite")
+@shared_limit(30)
+async def toggle_item_favorite(request: Request, item_id: str, current_user: str = Depends(require_auth)):
+    """
+    收藏/取消收藏（原子操作，并发安全）
+    """
+    result_container = [None]
+    
+    def updater(data):
+        for item in data:
+            if item["id"] == item_id:
+                favorited_by = item.get("favorited_by", [])
+                if current_user in favorited_by:
+                    favorited_by.remove(current_user)
+                    item["favorites"] = max(0, item.get("favorites", 0) - 1)
+                    action = "unfavorited"
+                else:
+                    favorited_by.append(current_user)
+                    item["favorites"] = item.get("favorites", 0) + 1
+                    action = "favorited"
+                item["favorited_by"] = favorited_by
+                result_container[0] = {"status": "success", "action": action, "favorites": item["favorites"]}
+                return
+        result_container[0] = None  # 未找到资源
+    
+    db.atomic_update("items.json", updater, default_data=[])
+    
+    if result_container[0] is None:
+        raise HTTPException(status_code=404, detail="资源不存在")
+    
+    # 🗂️ 清除排序缓存（收藏数变化可能影响排序）
+    sort_cache.invalidate("items:")
+    
+    return result_container[0]
+
+
+# ==========================================
+# 🔄 手动触发预缓存刷新接口
+# ==========================================
+@router.post("/api/items/{item_id}/refresh_cache")
+@shared_limit(3)
+async def refresh_item_cache(request: Request, item_id: str, current_user: str = Depends(require_auth)):
+    """手动触发指定资源的 ZIP 预缓存刷新，仅限作者调用"""
+    items_db = db.load_data("items.json", default_data=[])
+    
+    # 查找目标 item
+    target_item = None
+    for item in items_db:
+        if item["id"] == item_id:
+            target_item = item
+            break
+    
+    if not target_item:
+        raise HTTPException(status_code=404, detail="资源不存在")
+    
+    # 权限校验：仅作者可操作
+    if target_item.get("author") != current_user:
+        raise HTTPException(status_code=403, detail="仅作者可触发缓存刷新")
+    
+    # 仅支持 GitHub 仓库类型
+    link = target_item.get("link", "")
+    if "github.com" not in link:
+        raise HTTPException(status_code=400, detail="仅支持 GitHub 仓库类型的资源")
+    
+    try:
+        from 云端_定时版本检测引擎 import precache_github_zip
+    except ImportError:
+        raise HTTPException(status_code=500, detail="预缓存模块不可用")
+    
+    refreshed = await refresh_resource_version(db, item_id)
+    if not refreshed:
+        raise HTTPException(status_code=503, detail="资源版本暂时无法核实，请稍后重试")
+    success = await precache_github_zip(refreshed['item']['link'], refreshed['token'], item_id, refreshed['commit'])
+
+    if success:
+        return {"status": "success", "message": "缓存刷新完成"}
+    else:
+        return {"status": "error", "message": "缓存刷新失败，请查看云端日志获取详细信息"}

router_messages.py

@@ -1,188 +1,196 @@
-# router_messages.py
-from fastapi import APIRouter, HTTPException, Depends, Request
-from rate_limit import shared_limit
-from pydantic import BaseModel
-import asyncio
-import time
-import uuid
-import subprocess
-import logging
-from script_execution import run_admin_script_process, ScriptExecutionBusy
-import os
-import 数据库连接 as db
-import chat_store
-import notification_store
-from models import PrivateMessage, IdempotentPrivateMessage
-from 安全认证 import require_auth, is_admin
-
-# 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
-
-logger = logging.getLogger("ComfyUI-Ranking.AdminScripts")
-router = APIRouter()
-
-# ==========================================
-# 新增：系统公告请求体模型
-# ==========================================
-class SystemAnnouncement(BaseModel):
-    admin_account: str
-    content: str
-
-# ==========================================
-# 新增：发布系统公告接口 (仅限管理员，使用JWT验证)
-# ==========================================
-@router.post("/api/system/announcement")
-@shared_limit(5)
-async def publish_announcement(request: Request, ann: SystemAnnouncement, current_user: str = Depends(require_auth)):
-    # 🔒 P0安全修复：使用环境变量配置的管理员列表
-    if not is_admin(current_user):
-        raise HTTPException(status_code=403, detail="无权发布系统公告，仅管理员可操作")
-    
-    await asyncio.to_thread(notification_store.publish_announcement, current_user, ann.content)
-    return {"status": "success"}
-
-
-# ==========================================
-# 管理员调试：执行 Python 脚本
-# ==========================================
-class AdminScriptRequest(BaseModel):
-    admin_account: str
-    script_name: str
-
-# 🔒 P0安全修复：脚本白名单（仅允许执行指定的脚本）
-# 警告：添加新脚本前请确保其安全性
-ALLOWED_SCRIPTS = {
-    "密码迁移.py",          # 用户密码哈希化迁移
-    "测试脚本.py",          # 接口测试工具
-    "迁移_余额合并.py",      # 一次性余额合并迁移（执行后可移除）
-    "迁移_补全历史SALE记录.py",  # 补全历史SALE记录迁移
-}
-
-@router.post("/api/admin/run-script")
-@shared_limit(3)
-async def run_admin_script(request: Request, req: AdminScriptRequest, current_user: str = Depends(require_auth)):
-    """
-    管理员专属：执行指定的 Python 脚本
-    🔒 P0安全修复：白名单 + 路径穿越防护
-    """
-    # 🔒 P0安全修复：使用环境变量配置的管理员列表
-    if not is_admin(current_user):
-        raise HTTPException(status_code=403, detail="无权执行此操作，仅管理员可操作")
-    
-    script_name = req.script_name.strip()
-    if not script_name:
-        raise HTTPException(status_code=400, detail="脚本名称不能为空")
-    
-    # 🔒 P0安全修复：路径穿越攻击防护
-    if ".." in script_name or "/" in script_name or "\\" in script_name:
-        raise HTTPException(status_code=400, detail="🚨 安全拦截：脚本名称包含非法字符")
-    
-    # 🔒 P0安全修复：白名单检查
-    if script_name not in ALLOWED_SCRIPTS:
-        raise HTTPException(
-            status_code=403, 
-            detail=f"🚨 安全拦截：脚本 [{script_name}] 不在白名单中。允许的脚本: {list(ALLOWED_SCRIPTS)}"
-        )
-    
-    # 获取当前工作目录
-    current_dir = os.path.dirname(os.path.abspath(__file__))
-    script_path = os.path.join(current_dir, script_name)
-    
-    # 检查文件是否存在
-    if not os.path.exists(script_path):
-        return {
-            "status": "error",
-            "output": f"❌ 脚本文件不存在: {script_name}\n\n白名单脚本: {list(ALLOWED_SCRIPTS)}"
-        }
-    
-    try:
-        # 清理敏感环境变量，防止泄露到子进程
-        sensitive_prefixes = ('GITHUB', 'JWT', 'HF_', 'DATABASE', 'ALIPAY', 'PASSWORD')
-        clean_env = {k: v for k, v in os.environ.items()
-                     if not any(k.startswith(prefix) for prefix in sensitive_prefixes)}
-        result = await run_admin_script_process(script_path, cwd=current_dir, env=clean_env)
-        
-        output = ""
-        if result.stdout:
-            output += f"📝 标准输出:\n{result.stdout}\n"
-        if result.stderr:
-            output += f"\n⚠️ 错误输出:\n{result.stderr}"
-        if not output:
-            output = "✅ 脚本执行完成，无输出"
-        
-        # 限制输出大小防止返回大量数据
-        if len(output) > 1000:
-            output = output[:1000] + "\n...（输出已截断）"
-            
-        return {
-            "status": "success" if result.returncode == 0 else "error",
-            "return_code": result.returncode,
-            "output": output
-        }
-        
-    except ScriptExecutionBusy:
-        raise HTTPException(status_code=503, detail="脚本执行繁忙，请先确认当前执行状态") from None
-    except subprocess.TimeoutExpired:
-        return {
-            "status": "error",
-            "output": "❌ 脚本执行超时 (30秒)"
-        }
-    except Exception as error:
-        logger.error("ADMIN_SCRIPT_ERROR | error_type=%s", type(error).__name__)
-        return {
-            "status": "error",
-            "output": "脚本执行暂不可用，请先确认当前状态"
-        }
-
-# ==========================================
-# 原有功能：私信与聊天
-# ==========================================
-@router.post("/api/messages/private")
-@shared_limit(30)  # 🔒 安全限流：防止私信骚扰/刷屏（聊天节奏快，阈值比发帖宽松）
-async def send_private_message(request: Request, msg: PrivateMessage, current_user: str = Depends(require_auth)):
-    await asyncio.to_thread(chat_store.send_message, current_user, msg.receiver, msg.content)
-    return {"status": "success"}
-
-@router.post("/api/messages/private/idempotent")
-@shared_limit(30)
-async def send_idempotent_private_message(request: Request, msg: IdempotentPrivateMessage, current_user: str = Depends(require_auth)):
-    receipt = await asyncio.to_thread(chat_store.send_message, current_user, msg.receiver, msg.content, msg.client_request_id)
-    return {"status": "success", "data": receipt}
-
-
-@router.get("/api/chats/{account}")
-async def get_chat_list(account: str, current_user: str = Depends(require_auth)):
-    if account != current_user:
-        raise HTTPException(status_code=403, detail="无权访问他人私信")
-    data = await asyncio.to_thread(chat_store.chat_list, account)
-    return {"status": "success", "data": data}
-
-@router.get("/api/chats/{account}/{target_account}")
-async def get_chat_history(account: str, target_account: str, current_user: str = Depends(require_auth)):
-    if account != current_user:
-        raise HTTPException(status_code=403, detail="无权访问他人聊天记录")
-    data = await asyncio.to_thread(chat_store.chat_history, account, target_account)
-    return {"status": "success", "data": data}
-
-# ==========================================
-# 改造：获取通知列表 (加入系统公告懒加载注入)
-# 使用 atomic_update 避免并发覆盖问题
-# 🔥 性能优化：先用只读方式检查是否有实际变更，避免无意义的写入和HF上传
-# ==========================================
-@router.get("/api/messages/{account}")
-async def get_messages(account: str, count_only: bool = False, current_user: str = Depends(require_auth)):
-    # 🔒 P0安全加固：拦截越权读取他人消息（含 count_only 轮询）
-    if account != current_user:
-        raise HTTPException(status_code=403, detail="无权访问他人消息")
-    return await asyncio.to_thread(notification_store.get_messages, account, count_only)
-
-@router.post("/api/messages/{account}/read")
-@shared_limit(60)
-async def mark_messages_read(request: Request, account: str, current_user: str = Depends(require_auth)):
-    """
-    标记消息为已读（原子操作，并发安全）
-    """
-    # 🔒 P0安全加固：补全鉴权，防止任意用户篡改他人消息已读状态
-    if account != current_user:
-        raise HTTPException(status_code=403, detail="无权操作他人消息")
-    await asyncio.to_thread(notification_store.mark_messages_read, account)
-    return {"status": "success"}
+# router_messages.py
+from fastapi import APIRouter, HTTPException, Depends, Request
+from rate_limit import shared_limit
+from pydantic import BaseModel
+from owned_thread import OwnedThreadGroup
+import time
+import uuid
+import subprocess
+import logging
+from script_execution import run_admin_script_process, ScriptExecutionBusy
+import os
+import 数据库连接 as db
+import chat_store
+import notification_store
+from models import PrivateMessage, IdempotentPrivateMessage
+from 安全认证 import require_auth, is_admin
+
+# 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
+
+logger = logging.getLogger("ComfyUI-Ranking.AdminScripts")
+MAX_MESSAGE_IO = 16
+_message_io = OwnedThreadGroup(MAX_MESSAGE_IO,
+    lambda: HTTPException(status_code=503, detail="消息服务暂不可用"))
+run_message_io = _message_io.run
+start_message_io = _message_io.start
+stop_message_io = _message_io.stop
+close_message_io = _message_io.close
+
+router = APIRouter()
+
+# ==========================================
+# 新增：系统公告请求体模型
+# ==========================================
+class SystemAnnouncement(BaseModel):
+    admin_account: str
+    content: str
+
+# ==========================================
+# 新增：发布系统公告接口 (仅限管理员，使用JWT验证)
+# ==========================================
+@router.post("/api/system/announcement")
+@shared_limit(5)
+async def publish_announcement(request: Request, ann: SystemAnnouncement, current_user: str = Depends(require_auth)):
+    # 🔒 P0安全修复：使用环境变量配置的管理员列表
+    if not is_admin(current_user):
+        raise HTTPException(status_code=403, detail="无权发布系统公告，仅管理员可操作")
+    
+    await run_message_io(notification_store.publish_announcement, current_user, ann.content)
+    return {"status": "success"}
+
+
+# ==========================================
+# 管理员调试：执行 Python 脚本
+# ==========================================
+class AdminScriptRequest(BaseModel):
+    admin_account: str
+    script_name: str
+
+# 🔒 P0安全修复：脚本白名单（仅允许执行指定的脚本）
+# 警告：添加新脚本前请确保其安全性
+ALLOWED_SCRIPTS = {
+    "密码迁移.py",          # 用户密码哈希化迁移
+    "测试脚本.py",          # 接口测试工具
+    "迁移_余额合并.py",      # 一次性余额合并迁移（执行后可移除）
+    "迁移_补全历史SALE记录.py",  # 补全历史SALE记录迁移
+}
+
+@router.post("/api/admin/run-script")
+@shared_limit(3)
+async def run_admin_script(request: Request, req: AdminScriptRequest, current_user: str = Depends(require_auth)):
+    """
+    管理员专属：执行指定的 Python 脚本
+    🔒 P0安全修复：白名单 + 路径穿越防护
+    """
+    # 🔒 P0安全修复：使用环境变量配置的管理员列表
+    if not is_admin(current_user):
+        raise HTTPException(status_code=403, detail="无权执行此操作，仅管理员可操作")
+    
+    script_name = req.script_name.strip()
+    if not script_name:
+        raise HTTPException(status_code=400, detail="脚本名称不能为空")
+    
+    # 🔒 P0安全修复：路径穿越攻击防护
+    if ".." in script_name or "/" in script_name or "\\" in script_name:
+        raise HTTPException(status_code=400, detail="🚨 安全拦截：脚本名称包含非法字符")
+    
+    # 🔒 P0安全修复：白名单检查
+    if script_name not in ALLOWED_SCRIPTS:
+        raise HTTPException(
+            status_code=403, 
+            detail=f"🚨 安全拦截：脚本 [{script_name}] 不在白名单中。允许的脚本: {list(ALLOWED_SCRIPTS)}"
+        )
+    
+    # 获取当前工作目录
+    current_dir = os.path.dirname(os.path.abspath(__file__))
+    script_path = os.path.join(current_dir, script_name)
+    
+    # 检查文件是否存在
+    if not os.path.exists(script_path):
+        return {
+            "status": "error",
+            "output": f"❌ 脚本文件不存在: {script_name}\n\n白名单脚本: {list(ALLOWED_SCRIPTS)}"
+        }
+    
+    try:
+        # 清理敏感环境变量，防止泄露到子进程
+        sensitive_prefixes = ('GITHUB', 'JWT', 'HF_', 'DATABASE', 'ALIPAY', 'PASSWORD')
+        clean_env = {k: v for k, v in os.environ.items()
+                     if not any(k.startswith(prefix) for prefix in sensitive_prefixes)}
+        result = await run_admin_script_process(script_path, cwd=current_dir, env=clean_env)
+        
+        output = ""
+        if result.stdout:
+            output += f"📝 标准输出:\n{result.stdout}\n"
+        if result.stderr:
+            output += f"\n⚠️ 错误输出:\n{result.stderr}"
+        if not output:
+            output = "✅ 脚本执行完成，无输出"
+        
+        # 限制输出大小防止返回大量数据
+        if len(output) > 1000:
+            output = output[:1000] + "\n...（输出已截断）"
+            
+        return {
+            "status": "success" if result.returncode == 0 else "error",
+            "return_code": result.returncode,
+            "output": output
+        }
+        
+    except ScriptExecutionBusy:
+        raise HTTPException(status_code=503, detail="脚本执行繁忙，请先确认当前执行状态") from None
+    except subprocess.TimeoutExpired:
+        return {
+            "status": "error",
+            "output": "❌ 脚本执行超时 (30秒)"
+        }
+    except Exception as error:
+        logger.error("ADMIN_SCRIPT_ERROR | error_type=%s", type(error).__name__)
+        return {
+            "status": "error",
+            "output": "脚本执行暂不可用，请先确认当前状态"
+        }
+
+# ==========================================
+# 原有功能：私信与聊天
+# ==========================================
+@router.post("/api/messages/private")
+@shared_limit(30)  # 🔒 安全限流：防止私信骚扰/刷屏（聊天节奏快，阈值比发帖宽松）
+async def send_private_message(request: Request, msg: PrivateMessage, current_user: str = Depends(require_auth)):
+    await run_message_io(chat_store.send_message, current_user, msg.receiver, msg.content)
+    return {"status": "success"}
+
+@router.post("/api/messages/private/idempotent")
+@shared_limit(30)
+async def send_idempotent_private_message(request: Request, msg: IdempotentPrivateMessage, current_user: str = Depends(require_auth)):
+    receipt = await run_message_io(chat_store.send_message, current_user, msg.receiver, msg.content, msg.client_request_id)
+    return {"status": "success", "data": receipt}
+
+
+@router.get("/api/chats/{account}")
+async def get_chat_list(account: str, current_user: str = Depends(require_auth)):
+    if account != current_user:
+        raise HTTPException(status_code=403, detail="无权访问他人私信")
+    data = await run_message_io(chat_store.chat_list, account)
+    return {"status": "success", "data": data}
+
+@router.get("/api/chats/{account}/{target_account}")
+async def get_chat_history(account: str, target_account: str, current_user: str = Depends(require_auth)):
+    if account != current_user:
+        raise HTTPException(status_code=403, detail="无权访问他人聊天记录")
+    data = await run_message_io(chat_store.chat_history, account, target_account)
+    return {"status": "success", "data": data}
+
+# ==========================================
+# 改造：获取通知列表 (加入系统公告懒加载注入)
+# 使用 atomic_update 避免并发覆盖问题
+# 🔥 性能优化：先用只读方式检查是否有实际变更，避免无意义的写入和HF上传
+# ==========================================
+@router.get("/api/messages/{account}")
+async def get_messages(account: str, count_only: bool = False, current_user: str = Depends(require_auth)):
+    # 🔒 P0安全加固：拦截越权读取他人消息（含 count_only 轮询）
+    if account != current_user:
+        raise HTTPException(status_code=403, detail="无权访问他人消息")
+    return await run_message_io(notification_store.get_messages, account, count_only)
+
+@router.post("/api/messages/{account}/read")
+@shared_limit(60)
+async def mark_messages_read(request: Request, account: str, current_user: str = Depends(require_auth)):
+    """
+    标记消息为已读（原子操作，并发安全）
+    """
+    # 🔒 P0安全加固：补全鉴权，防止任意用户篡改他人消息已读状态
+    if account != current_user:
+        raise HTTPException(status_code=403, detail="无权操作他人消息")
+    await run_message_io(notification_store.mark_messages_read, account)
+    return {"status": "success"}

router_open_api.py

@@ -1,4 +1,3 @@
-import asyncio
 # router_open_api.py
 # ==========================================
 # 🌐 通用开放 API 模块（供第三方插件调用）
@@ -7,7 +6,7 @@ import asyncio
 #       供 NodeCraft AI 等第三方插件复用 ComfyUI-Ranking 账号体系。
 # 关联文件：
 #   - 安全认证.py        (verify_token_with_fallback, require_auth)
-#   - database_sql.py    (get_db, SessionLocal)
+#   - database_sql.py    (SessionLocal)
 #   - models_sql.py      (Wallet, Transaction)
 #   - 数据库连接.py       (users.json 读写)
 # 安全机制：
@@ -25,17 +24,20 @@ import hashlib
 import logging
 from typing import Optional
 
-from fastapi import APIRouter, Depends, Header, HTTPException, Query
+from fastapi import APIRouter, Header, HTTPException, Query
 from fastapi.responses import JSONResponse
 from sqlalchemy.orm import Session
 from sqlalchemy import func, text
 from pydantic import BaseModel, Field
 
-from database_sql import get_db, SessionLocal
+from database_sql import SessionLocal
 from models_sql import Wallet, Transaction, RegisteredPlugin, OpenApiRateLimitBucket
 from open_transaction import lock_open_wallet, positive_integer, validate_live_plugin, quota_total
+from open_transaction import open_operation_identity, read_open_operation, save_open_operation
 from plugin_permissions import parse_permissions
 from tip_store import run_tip_effect
+from auth_io import run_identity_io
+from owned_thread import OwnedThreadGroup
 from 安全认证 import verify_token_with_fallback
 import 数据库连接 as json_db
 
@@ -44,6 +46,21 @@ logger = logging.getLogger("ComfyUI-Ranking.OpenAPI")
 router = APIRouter(prefix="/api/open", tags=["open-api"])
 
 
+MAX_OPEN_SQL_WORK = 8
+_open_sql_work = OwnedThreadGroup(MAX_OPEN_SQL_WORK,
+    lambda: HTTPException(status_code=503, detail="插件限流服务暂不可用"))
+start_open_sql = _open_sql_work.start
+stop_open_sql = _open_sql_work.stop
+close_open_sql = _open_sql_work.close
+
+
+async def _run_open_sql(function, *args, **kwargs):
+    def execute():
+        with SessionLocal() as session:
+            return function(*args, db=session, **kwargs)
+    return await _open_sql_work.run(execute)
+
+
 # ═══════════════ 插件注册表（从数据库动态加载） ═══════════════
 # 反向索引：plugin_key -> {id, key, name, rate_limit, permissions, max_deduct_per_tx, max_deduct_per_day}
 _PLUGIN_KEY_INDEX: dict = {}
@@ -215,7 +232,7 @@ async def _resolve_user_from_token(token: str) -> str:
     """从 Token 中解析出账号；失败时抛 401"""
     if not token:
         raise HTTPException(status_code=401, detail="缺少用户 Token")
-    is_valid, account, error_msg = await asyncio.to_thread(verify_token_with_fallback, token)
+    is_valid, account, error_msg = await run_identity_io(verify_token_with_fallback, token)
     if not is_valid or not account:
         raise HTTPException(status_code=401, detail=error_msg or "Token 无效")
     return account
@@ -239,12 +256,16 @@ class DeductRequest(BaseModel):
     amount: int = Field(..., gt=0, strict=True, description="扣款金额（正整数）")
     reason: str = Field(..., description="业务标识/扣款原因")
     reference_id: Optional[str] = Field(None, description="业务侧参考 ID")
+    request_id: Optional[str] = Field(None, strict=True, min_length=8, max_length=128,
+        pattern=r"^[A-Za-z0-9][A-Za-z0-9._:-]*$", description="同次扣款重试使用相同请求标识")
 
 
 class RefundRequest(BaseModel):
     token: str = Field(..., description="用户 JWT Token")
     transaction_id: str = Field(..., description="原扣款交易 ID")
     amount: int = Field(..., gt=0, strict=True, description="退款金额（正整数）")
+    request_id: Optional[str] = Field(None, strict=True, min_length=8, max_length=128,
+        pattern=r"^[A-Za-z0-9][A-Za-z0-9._:-]*$", description="同次退款重试使用相同请求标识")
 
 
 # ==========================================
@@ -254,20 +275,19 @@ class RefundRequest(BaseModel):
 async def open_verify_token(
     req: VerifyTokenRequest,
     x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    db: Session = Depends(get_db),
 ):
     """
     供第三方插件验证用户 Token 有效性。
     成功返回账号与基础资料（昵称、头像）。
     """
-    plugin_info = _require_plugin(x_plugin_key, "verify", db)
+    plugin_info = await _run_open_sql(_require_plugin, x_plugin_key, "verify")
 
-    is_valid, account, error_msg = await asyncio.to_thread(verify_token_with_fallback, req.token)
+    is_valid, account, error_msg = await run_identity_io(verify_token_with_fallback, req.token)
     if not is_valid or not account:
         logger.info(f"OPEN_VERIFY_TOKEN_FAIL | plugin={plugin_info['id']} | category=invalid_token")
         return {"valid": False, "error": error_msg or "Token 无效"}
 
-    users_db = json_db.load_data("users.json", default_data={})
+    users_db = await run_identity_io(json_db.load_data, "users.json", default_data={})
     user = users_db.get(account, {}) or {}
 
     logger.info(f"OPEN_VERIFY_TOKEN | plugin={plugin_info['id']}")
@@ -286,13 +306,12 @@ async def open_verify_token(
 async def open_get_balance(
     authorization: Optional[str] = Header(None, alias="Authorization"),
     x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    db: Session = Depends(get_db),
 ):
     """
     查询用户钱包余额。
     认证：Authorization: Bearer <user_token> + X-Plugin-Key
     """
-    plugin_info = _require_plugin(x_plugin_key, "balance", db)
+    plugin_info = await _run_open_sql(_require_plugin, x_plugin_key, "balance")
 
     if not authorization:
         raise HTTPException(status_code=401, detail="缺少 Authorization Header")
@@ -301,6 +320,105 @@ async def open_get_balance(
         raise HTTPException(status_code=401, detail="Authorization 格式错误，请使用 Bearer Token")
 
     account = await _resolve_user_from_token(parts[1])
+    return await _run_open_sql(_read_open_balance, account, plugin_info)
+
+
+# ==========================================
+# 3️⃣ 通用扣款：POST /api/open/deduct
+# ==========================================
+@router.post("/deduct")
+async def open_deduct(
+    req: DeductRequest,
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+):
+    """
+    通用扣款接口（从 wallet.balance 扣减）。
+    流程：
+      1. 校验 Plugin Key + 权限 + 限流
+      2. 解析 Token -> account
+      3. 共用写锁锁定钱包与实时插件配置，检查额度/余额
+      4. 扣款 + 写入 Transaction（含哈希链）
+    """
+    plugin_info = await _run_open_sql(_require_plugin, x_plugin_key, "deduct")
+    account = await _resolve_user_from_token(req.token)
+    return await _run_open_sql(_deduct_open_balance, req, account, plugin_info, x_plugin_key)
+
+
+# ==========================================
+# 4️⃣ 退款：POST /api/open/refund
+# ==========================================
+@router.post("/refund")
+async def open_refund(
+    req: RefundRequest,
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+):
+    """
+    退款接口：将之前 OPEN_DEDUCT 的金额（部分或全额）退还到用户钱包。
+
+    校验：
+      - 原交易必须存在且 tx_type == OPEN_DEDUCT
+      - 原交易归属当前 token 用户
+      - 原交易由当前插件发起（related_account == plugin_id）
+      - 累计退款金额 ≤ 原扣款金额
+    """
+    plugin_info = await _run_open_sql(_require_plugin, x_plugin_key, "refund")
+    account = await _resolve_user_from_token(req.token)
+    return await _run_open_sql(_refund_open_balance, req, account, plugin_info, x_plugin_key)
+
+
+# ==========================================
+# 5️⃣ 消费记录查询：GET /api/open/transactions
+# ==========================================
+@router.get("/transactions")
+async def open_list_transactions(
+    authorization: Optional[str] = Header(None, alias="Authorization"),
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    page: int = Query(1, ge=1, description="页码（从 1 开始）"),
+    page_size: int = Query(20, ge=1, le=100, description="每页条数（1-100）"),
+    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
+    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
+    tx_type: Optional[str] = Query(None, description="交易类型，如 OPEN_DEDUCT / OPEN_REFUND"),
+):
+    """
+    查询当前用户由当前插件产生的消费/退款记录。
+
+    认证：Authorization: Bearer <user_token> + X-Plugin-Key
+    安全：仅返回 source_plugin == 当前 plugin_id 的记录，防止跨插件读取。
+    """
+    plugin_info = await _run_open_sql(_require_plugin, x_plugin_key, "verify")
+
+    if not authorization:
+        raise HTTPException(status_code=401, detail="缺少 Authorization Header")
+    parts = authorization.split(" ", 1)
+    if len(parts) != 2 or parts[0].lower() != "bearer":
+        raise HTTPException(status_code=401, detail="Authorization 格式错误，请使用 Bearer Token")
+    account = await _resolve_user_from_token(parts[1])
+
+    return await _run_open_sql(_read_open_transactions, account, plugin_info, page, page_size, start_time, end_time, tx_type)
+
+
+# ==========================================
+# 6️⃣ 消费汇总：GET /api/open/usage-summary
+# ==========================================
+@router.get("/usage-summary")
+async def open_usage_summary(
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    account: Optional[str] = Query(None, description="指定用户账号，不传则统计所有用户"),
+    period: str = Query("daily", description="聚合粒度：daily / monthly / total"),
+    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
+    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
+):
+    """
+    本插件维度的消费汇总统计。
+
+    返回：总扣款 / 总退款 / 总笔数 / 净消费 + 按 period 分桶的明细。
+    安全：仅统计 source_plugin == 当前 plugin_id 的记录。
+    """
+    plugin_info = await _run_open_sql(_require_plugin, x_plugin_key, "verify")
+    return await _run_open_sql(_read_open_usage, plugin_info, account, period, start_time, end_time)
+
+
+def _read_open_balance(account, plugin_info, db):
     wallet = db.query(Wallet).filter(Wallet.account == account).first()
 
     if not wallet:
@@ -326,30 +444,17 @@ async def open_get_balance(
     return result
 
 
-# ==========================================
-# 3️⃣ 通用扣款：POST /api/open/deduct
-# ==========================================
-@router.post("/deduct")
-async def open_deduct(
-    req: DeductRequest,
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    db: Session = Depends(get_db),
-):
-    """
-    通用扣款接口（从 wallet.balance 扣减）。
-    流程：
-      1. 校验 Plugin Key + 权限 + 限流
-      2. 解析 Token -> account
-      3. 共用写锁锁定钱包与实时插件配置，检查额度/余额
-      4. 扣款 + 写入 Transaction（含哈希链）
-    """
-    plugin_info = _require_plugin(x_plugin_key, "deduct", db)
-    account = await _resolve_user_from_token(req.token)
+def _deduct_open_balance(req, account, plugin_info, x_plugin_key, db):
     amount = req.amount
     if isinstance(amount, bool) or not isinstance(amount, int) or amount <= 0:
         raise HTTPException(status_code=422, detail="扣款金额必须为正整数")
+    operation = open_operation_identity(req.request_id, account, plugin_info['id'], 'OPEN_DEDUCT',
+        [amount, req.reason, req.reference_id])
     try:
         wallet, plugin_row = lock_open_wallet(db, account, plugin_info["id"], x_plugin_key, "deduct")
+        replay = read_open_operation(db, operation, account, plugin_info['id'], 'OPEN_DEDUCT', -amount, req.reference_id)
+        if replay is not None:
+            return replay
         max_per_tx = positive_integer(plugin_row.max_deduct_per_tx)
         max_daily = positive_integer(plugin_row.max_deduct_per_day)
         if amount > max_per_tx:
@@ -374,7 +479,7 @@ async def open_deduct(
         if wallet.balance < amount:
             raise HTTPException(status_code=402, detail="余额不足")
         wallet.balance -= amount
-        tx_id = f"OPEN_DEDUCT_{uuid.uuid4().hex}"
+        tx_id = f"OPEN_DEDUCT_{operation[0] if operation is not None else uuid.uuid4().hex}"
         last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(
             Transaction.created_at.desc(), Transaction.tx_id.desc()).with_for_update().first()
         prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
@@ -383,6 +488,7 @@ async def open_deduct(
             tx_hash=_calc_tx_hash(tx_id, account, "OPEN_DEDUCT", -amount, prev_hash),
             description=f"[{plugin_row.name}] {req.reason}", source_plugin=plugin_info["id"]))
         response = {"success": True, "remaining_balance": wallet.balance, "transaction_id": tx_id}
+        save_open_operation(db, operation, response)
         db.commit()
     except HTTPException:
         db.rollback()
@@ -395,31 +501,17 @@ async def open_deduct(
     return response
 
 
-# ==========================================
-# 4️⃣ 退款：POST /api/open/refund
-# ==========================================
-@router.post("/refund")
-async def open_refund(
-    req: RefundRequest,
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    db: Session = Depends(get_db),
-):
-    """
-    退款接口：将之前 OPEN_DEDUCT 的金额（部分或全额）退还到用户钱包。
-
-    校验：
-      - 原交易必须存在且 tx_type == OPEN_DEDUCT
-      - 原交易归属当前 token 用户
-      - 原交易由当前插件发起（related_account == plugin_id）
-      - 累计退款金额 ≤ 原扣款金额
-    """
-    plugin_info = _require_plugin(x_plugin_key, "refund", db)
-    account = await _resolve_user_from_token(req.token)
+def _refund_open_balance(req, account, plugin_info, x_plugin_key, db):
     refund_amount = req.amount
     if isinstance(refund_amount, bool) or not isinstance(refund_amount, int) or refund_amount <= 0:
         raise HTTPException(status_code=422, detail="退款金额必须为正整数")
+    operation = open_operation_identity(req.request_id, account, plugin_info['id'], 'OPEN_REFUND',
+        [refund_amount, req.transaction_id])
     try:
         wallet, plugin_row = lock_open_wallet(db, account, plugin_info["id"], x_plugin_key, "refund")
+        replay = read_open_operation(db, operation, account, plugin_info['id'], 'OPEN_REFUND', refund_amount, req.transaction_id)
+        if replay is not None:
+            return replay
         original_tx = db.query(Transaction).filter(Transaction.tx_id == req.transaction_id).populate_existing().with_for_update().first()
         if original_tx is None:
             raise HTTPException(status_code=404, detail="原交易不存在")
@@ -447,7 +539,7 @@ async def open_refund(
         if isinstance(wallet.balance, bool) or not isinstance(wallet.balance, int):
             raise ValueError("invalid wallet balance")
         wallet.balance += refund_amount
-        tx_id = f"OPEN_REFUND_{uuid.uuid4().hex}"
+        tx_id = f"OPEN_REFUND_{operation[0] if operation is not None else uuid.uuid4().hex}"
         last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(
             Transaction.created_at.desc(), Transaction.tx_id.desc()).with_for_update().first()
         prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
@@ -456,6 +548,7 @@ async def open_refund(
             tx_hash=_calc_tx_hash(tx_id, account, "OPEN_REFUND", refund_amount, prev_hash),
             description=f"[{plugin_row.name}] 退款 {req.transaction_id}", source_plugin=plugin_info["id"]))
         response = {"success": True, "remaining_balance": wallet.balance, "transaction_id": tx_id}
+        save_open_operation(db, operation, response)
         db.commit()
     except HTTPException:
         db.rollback()
@@ -468,35 +561,7 @@ async def open_refund(
     return response
 
 
-# ==========================================
-# 5️⃣ 消费记录查询：GET /api/open/transactions
-# ==========================================
-@router.get("/transactions")
-async def open_list_transactions(
-    authorization: Optional[str] = Header(None, alias="Authorization"),
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    page: int = Query(1, ge=1, description="页码（从 1 开始）"),
-    page_size: int = Query(20, ge=1, le=100, description="每页条数（1-100）"),
-    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
-    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
-    tx_type: Optional[str] = Query(None, description="交易类型，如 OPEN_DEDUCT / OPEN_REFUND"),
-    db: Session = Depends(get_db),
-):
-    """
-    查询当前用户由当前插件产生的消费/退款记录。
-
-    认证：Authorization: Bearer <user_token> + X-Plugin-Key
-    安全：仅返回 source_plugin == 当前 plugin_id 的记录，防止跨插件读取。
-    """
-    plugin_info = _require_plugin(x_plugin_key, "verify", db)
-
-    if not authorization:
-        raise HTTPException(status_code=401, detail="缺少 Authorization Header")
-    parts = authorization.split(" ", 1)
-    if len(parts) != 2 or parts[0].lower() != "bearer":
-        raise HTTPException(status_code=401, detail="Authorization 格式错误，请使用 Bearer Token")
-    account = await _resolve_user_from_token(parts[1])
-
+def _read_open_transactions(account, plugin_info, page, page_size, start_time, end_time, tx_type, db):
     plugin_id = plugin_info["id"]
 
     # 构造查询：按 source_plugin 过滤；兼容历史 NULL 数据走 related_account 兜底
@@ -546,25 +611,7 @@ async def open_list_transactions(
     }
 
 
-# ==========================================
-# 6️⃣ 消费汇总：GET /api/open/usage-summary
-# ==========================================
-@router.get("/usage-summary")
-async def open_usage_summary(
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    account: Optional[str] = Query(None, description="指定用户账号，不传则统计所有用户"),
-    period: str = Query("daily", description="聚合粒度：daily / monthly / total"),
-    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
-    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
-    db: Session = Depends(get_db),
-):
-    """
-    本插件维度的消费汇总统计。
-
-    返回：总扣款 / 总退款 / 总笔数 / 净消费 + 按 period 分桶的明细。
-    安全：仅统计 source_plugin == 当前 plugin_id 的记录。
-    """
-    plugin_info = _require_plugin(x_plugin_key, "verify", db)
+def _read_open_usage(plugin_info, account, period, start_time, end_time, db):
     plugin_id = plugin_info["id"]
 
     period = (period or "daily").lower()
@@ -638,3 +685,4 @@ async def open_usage_summary(
         },
         "breakdown": breakdown,
     }
+

router_users_auth.py

@@ -12,7 +12,6 @@
 
 from fastapi import APIRouter, HTTPException, BackgroundTasks, Request
 from rate_limit import shared_limit, store_verification_code, consume_verification_code
-import asyncio
 import time
 import re
 import secrets
@@ -21,6 +20,8 @@ import logging
 import 数据库连接 as db
 from models import UserRegister, UserLogin, SendCodeRequest
 from verify_code_engine import send_email_code, send_sms_code, cleanup_expired_codes, check_send_cooldown
+from verification_io import run_verification_io
+from auth_io import run_auth_io
 
 # 🔒 P0安全增强：导入密码哈希和 JWT 工具
 from 安全认证 import hash_password, verify_password, create_token, require_password_match, require_auth
@@ -59,7 +60,7 @@ async def _check_code_contact(req, request=None):
         account = await require_auth(request.headers.get("Authorization"))
         if req.account is not None and req.account != account:
             raise HTTPException(status_code=403, detail="无权为其他账号请求提现验证码")
-        user = await asyncio.to_thread(read_user, account)
+        user = await run_verification_io(read_user, account)
         contact = user.get("email") or user.get("phone", "")
         contact_type = "email" if user.get("email") else "phone"
         if (not isinstance(contact, str) or not contact.strip() or
@@ -67,12 +68,12 @@ async def _check_code_contact(req, request=None):
             raise HTTPException(status_code=400, detail="联系方式与当前账号绑定信息不匹配")
         return True
     if req.action_type == "recover":
-        account, _ = await asyncio.to_thread(_find_contact_account, req.contact, req.contact_type)
+        account, _ = await run_verification_io(_find_contact_account, req.contact, req.contact_type)
         return account is not None
     if req.action_type == "reset":
         if not req.account:
             raise HTTPException(status_code=400, detail="找回密码需先填写当前账号")
-        user = await asyncio.to_thread(read_user, req.account)
+        user = await run_verification_io(read_user, req.account)
         if user.get(req.contact_type) != req.contact:
             raise HTTPException(status_code=400, detail="填写的联系方式与该账号绑定信息不匹配")
     return True
@@ -100,7 +101,7 @@ async def send_verify_code(request: Request, req: SendCodeRequest, bg_tasks: Bac
         return {"status": "success", "message": "如果该联系方式已绑定账号，验证码已发送"}
 
     # 🔒 检查发送频率限制（同一联系方式60秒内只能发送1条）
-    check_send_cooldown(req.contact)
+    await run_verification_io(check_send_cooldown, req.contact)
     
     # 生成6位随机验证码
     code = str(secrets.randbelow(900000) + 100000)
@@ -112,13 +113,13 @@ async def send_verify_code(request: Request, req: SendCodeRequest, bg_tasks: Bac
     cache_key = f"{req.contact}:{req.action_type}"
     
     # 将验证码安全摘要写入 SQL，有效期5分钟
-    await asyncio.to_thread(store_verification_code, cache_key, code, int(time.time()) + 300)
+    await run_verification_io(store_verification_code, cache_key, code, int(time.time()) + 300)
     
     # 根据联系方式类型，添加后台发送任务
     if req.contact_type == "email":
-        bg_tasks.add_task(send_email_code, req.contact, code, req.action_type)
+        bg_tasks.add_task(run_verification_io, send_email_code, req.contact, code, req.action_type)
     elif req.contact_type == "phone":
-        bg_tasks.add_task(send_sms_code, req.contact, code, req.action_type)
+        bg_tasks.add_task(run_verification_io, send_sms_code, req.contact, code, req.action_type)
     else:
         raise HTTPException(status_code=400, detail="不支持的验证方式")
         
@@ -138,7 +139,7 @@ async def send_code_api(request: Request, req: SendCodeRequest):
         return {"status": "success", "message": "如果该联系方式已绑定账号，验证码已发送"}
 
     # 🔒 检查发送频率限制（同一联系方式60秒内只能发送1条）
-    check_send_cooldown(req.contact)
+    await run_verification_io(check_send_cooldown, req.contact)
     
     # 生成6位随机验证码
     code = str(secrets.randbelow(900000) + 100000)
@@ -146,11 +147,11 @@ async def send_code_api(request: Request, req: SendCodeRequest):
     key = f"{req.contact}:{req.action_type}"
     
     # 存入缓存，有效期5分钟
-    await asyncio.to_thread(store_verification_code, key, code, int(time.time()) + 300)
+    await run_verification_io(store_verification_code, key, code, int(time.time()) + 300)
     
     if req.contact_type == "email":
         try:
-            await asyncio.to_thread(send_email_code, req.contact, code, req.action_type)
+            await run_verification_io(send_email_code, req.contact, code, req.action_type)
             return {"status": "success", "message": "验证码已成功发送至邮箱"}
         except Exception as e:
             # 🔒 P0安全修复：仅服务端记录详细错误，不暴露给前端
@@ -159,7 +160,7 @@ async def send_code_api(request: Request, req: SendCodeRequest):
             
     elif req.contact_type == "phone":
         try:
-            await asyncio.to_thread(send_sms_code, req.contact, code, req.action_type)
+            await run_verification_io(send_sms_code, req.contact, code, req.action_type)
             return {"status": "success", "message": "验证码已成功发送至手机"}
         except Exception as error:
             logger.error("验证码短信发送失败: action=%s, error_type=%s", req.action_type, type(error).__name__)
@@ -209,11 +210,11 @@ async def recover_account(request: Request):
     # ========== 第二步：验证码校验（原子性一次性消费，并发安全） ==========
     cache_key = f"{email}:recover"
     # 🛡️ 防枚举：验证码错误与邮箱未注册统一报错，不暴露账号注册状态
-    if not await asyncio.to_thread(consume_verification_code, cache_key, code):
+    if not await run_auth_io(consume_verification_code, cache_key, code):
         raise HTTPException(status_code=400, detail="验证码不正确或已过期")
 
     # ========== 第三步：按邮箱反查账号 ==========
-    matched_account, matched_user = await asyncio.to_thread(_find_contact_account, email, "email")
+    matched_account, matched_user = await run_auth_io(_find_contact_account, email, "email")
 
     if not matched_account:
         # 理论上验证码已验证邮箱存在，此处为防御性分支
@@ -250,7 +251,7 @@ async def register_user(request: Request, user: UserRegister):
         - code: 验证码
         - intro: 个人介绍（可选，最多100字）
     """
-    await asyncio.to_thread(check_registration, user.account, user.email, user.phone)
+    await run_auth_io(check_registration, user.account, user.email, user.phone)
     RESERVED_ACCOUNTS = {"admin", "system", "root", "test", "anonymous", "administrator"}
     if user.account.lower() in RESERVED_ACCOUNTS:
         raise HTTPException(status_code=400, detail="该账号名不可用")
@@ -260,7 +261,7 @@ async def register_user(request: Request, user: UserRegister):
     cache_key = f"{user.email}:register" if user.email else f"{user.phone}:register"
     # 🔒 P0安全修复：验证码一次性使用，并发安全键防止并发重用
     # 校验验证码是否正确且未过期
-    if not await asyncio.to_thread(consume_verification_code, cache_key, user.code):
+    if not await run_auth_io(consume_verification_code, cache_key, user.code):
         raise HTTPException(status_code=400, detail="验证码不正确或已过期")
         
     # ========== 第三步：格式校验 ==========
@@ -286,7 +287,7 @@ async def register_user(request: Request, user: UserRegister):
         new_user["avatarDataUrl"] = ""
     
     # 🔒 P0安全增强：密码哈希化存储（不再存储明文密码）
-    new_user["password"] = await asyncio.to_thread(hash_password, new_user["password"])
+    new_user["password"] = await run_auth_io(hash_password, new_user["password"])
     
     new_user.update({
         "created_at": int(time.time()),  # 注册时间戳
@@ -296,7 +297,7 @@ async def register_user(request: Request, user: UserRegister):
     })
     
     # 保存到数据库
-    public_user = await asyncio.to_thread(create_user, new_user)
+    public_user = await run_auth_io(create_user, new_user)
     return {"status": "success", "message": "注册成功", "data": public_user}
 
 
@@ -317,18 +318,18 @@ async def login_user(request: Request, user: UserLogin):
         - account: 账号
         - password: 密码
     """
-    user_data = await asyncio.to_thread(read_user, user.account)
+    user_data = await run_auth_io(read_user, user.account)
     stored_password = user_data.get("password") or ""
     if not isinstance(stored_password, str):
         raise HTTPException(status_code=503, detail="用户认证数据暂不可用")
     password_version = get_password_version(user_data)
-    if not await asyncio.to_thread(require_password_match, stored_password, user.password):
+    if not await run_auth_io(require_password_match, stored_password, user.password):
         raise HTTPException(status_code=401, detail="密码错误")
     migrated = None
     if stored_password and not stored_password.startswith(('$2b$', '$2a$')):
-        migrated = await asyncio.to_thread(hash_password, user.password)
+        migrated = await run_auth_io(hash_password, user.password)
     # bcrypt 运行期间可能发生密码重置，不能用旧密码升级覆盖新密码。
-    user_data = await asyncio.to_thread(finish_login, user.account, stored_password, password_version, migrated)
+    user_data = await run_auth_io(finish_login, user.account, stored_password, password_version, migrated)
 
     # 🔒 P0安全增强：生成 JWT Token（替代 mock_token）
     # 获取password_version用于Token生成（如不存在则默认为0）
@@ -399,13 +400,13 @@ async def reset_password(request: Request):
         raise HTTPException(status_code=400, detail="请求参数格式不正确")
     if verify_type not in ("email", "phone"):
         raise HTTPException(status_code=400, detail="联系方式类型不正确")
-    user = await asyncio.to_thread(read_user, account)
+    user = await run_auth_io(read_user, account)
     if user.get(verify_type) != verify_contact:
         raise HTTPException(status_code=400, detail="填写的联系方式与该账号绑定信息不匹配")
 
     # 校验验证码（原子性获取+删除）
     cache_key = f"{verify_contact}:reset"
-    if not await asyncio.to_thread(consume_verification_code, cache_key, code):
+    if not await run_auth_io(consume_verification_code, cache_key, code):
         raise HTTPException(status_code=400, detail="验证码不正确或已过期")
 
     # 校验新密码格式
@@ -414,9 +415,9 @@ async def reset_password(request: Request):
     if not re.match(r'^[a-zA-Z0-9!@#$%^&*()_+\-=\[\]{};\':"\\|,.<>\/?]{6,}$', new_password): 
         raise HTTPException(status_code=400, detail="新密码包含不支持的特殊字符")
     
-    password_hash = await asyncio.to_thread(hash_password, new_password)
+    password_hash = await run_auth_io(hash_password, new_password)
     # 保存最新记录时再次检查绑定信息，版本严格递增（同秒重置也撤销旧凭证）。
-    version = await asyncio.to_thread(reset_user_password, account, verify_type, verify_contact, password_hash)
+    version = await run_auth_io(reset_user_password, account, verify_type, verify_contact, password_hash)
     new_token = create_token(account, extra_data={"pwd_ver": version})
 
     return {"status": "success", "message": "密码修改成功", "token": new_token}

shutdown_lifecycle.py

@@ -0,0 +1,127 @@
+"""同一应用代次共用一个关闭拥有者和真实终态。"""
+import asyncio
+import threading
+
+
+def prepare_application_shutdown(state):
+    previous = getattr(state, '_ranking_shutdown_future', None)
+    if previous is not None and not previous.done():
+        raise RuntimeError('application shutdown is still pending')
+    if getattr(state, '_ranking_shutdown_incomplete', False):
+        raise RuntimeError('application cleanup is incomplete')
+    state._ranking_shutdown_future = None
+    state._ranking_shutdown_owner = None
+    state._ranking_shutdown_cancelled = False
+    state._ranking_shutdown_stop = threading.Event()
+
+
+def shutdown_cancel_requested(state):
+    if getattr(state, '_ranking_shutdown_cancelled', False):
+        return True
+    owner = getattr(state, '_ranking_shutdown_owner', None)
+    return owner is not None and owner.cancelling() > state._ranking_shutdown_initial_cancels
+
+
+async def _wait_shutdown(state, future):
+    caller = asyncio.current_task()
+    initial_cancels = caller.cancelling()
+    cancelled = None
+    while not future.done():
+        try:
+            await asyncio.shield(future)
+        except asyncio.CancelledError as error:
+            if caller.cancelling() > initial_cancels:
+                if getattr(state, '_ranking_shutdown_future', None) is future:
+                    state._ranking_shutdown_cancelled = True
+                cancelled = error
+        except BaseException:
+            break
+    if cancelled is not None:
+        raise cancelled
+    return future.result()
+
+
+async def run_application_shutdown(state, operation):
+    owner = asyncio.current_task()
+    previous = getattr(state, '_ranking_shutdown_future', None)
+    retry = (previous is not None and previous.done()
+             and (previous.cancelled() or previous.exception() is not None))
+    if previous is not None and not retry:
+        if not previous.done() and getattr(state, '_ranking_shutdown_owner', None) is owner:
+            raise RuntimeError('application shutdown reentry')
+        return await _wait_shutdown(state, previous)
+    future = asyncio.get_running_loop().create_future()
+    stop = getattr(state, '_ranking_shutdown_stop', None)
+    if stop is None:
+        stop = threading.Event()
+    stop.set()
+    state._ranking_shutdown_stop = stop
+    state._ranking_shutdown_future = future
+    state._ranking_shutdown_owner = owner
+    state._ranking_shutdown_initial_cancels = owner.cancelling()
+    state._ranking_shutdown_cancelled = False
+    state._ranking_closers = getattr(state, '_ranking_closers', 0) + 1
+    try:
+        result = await operation()
+        if shutdown_cancel_requested(state):
+            raise asyncio.CancelledError
+    except BaseException as error:
+        if not future.done():
+            if isinstance(error, asyncio.CancelledError):
+                future.cancel()
+            else:
+                future.set_exception(error)
+                future.exception()
+        raise
+    else:
+        if not future.done():
+            future.set_result(result)
+        return result
+    finally:
+        state._ranking_shutdown_owner = None
+        state._ranking_closers -= 1
+
+
+class ShutdownFailures:
+    def __init__(self, logger):
+        self.logger = logger
+        self.error = None
+        self.cancelled = None
+        self.incomplete = False
+
+    def _record(self, stage, error, *, incomplete):
+        self.incomplete |= incomplete
+        if isinstance(error, asyncio.CancelledError):
+            if self.cancelled is None:
+                self.cancelled = error
+            return
+        if self.error is None:
+            self.error = error
+        try:
+            self.logger.error('SHUTDOWN_STEP_FAILED | stage=%s | error_type=%s', stage, type(error).__name__)
+        except Exception:
+            pass
+
+    def call(self, stage, function, *args):
+        try:
+            return function(*args)
+        except asyncio.CancelledError as error:
+            self._record(stage, error, incomplete=True)
+        except Exception as error:
+            self._record(stage, error, incomplete=True)
+
+    async def wait(self, stage, function, *args):
+        try:
+            return await function(*args)
+        except asyncio.CancelledError as error:
+            self._record(stage, error, incomplete=False)
+        except Exception as error:
+            self._record(stage, error, incomplete=True)
+
+    def raise_if_failed(self, *, cancel_requested):
+        if self.cancelled is not None:
+            raise self.cancelled
+        if cancel_requested:
+            raise asyncio.CancelledError
+        if self.error is not None:
+            raise self.error

startup_warmup.py

@@ -0,0 +1,82 @@
+"""启动预热的线程归属、停止信号与关闭等待。"""
+import asyncio
+import threading
+
+from owned_thread import run_owned_thread
+
+
+def prepare_startup_warmup(state):
+    previous = getattr(state, '_ranking_warmup_task', None)
+    if previous is not None and not previous.done():
+        raise RuntimeError('startup work is still pending')
+    state._ranking_warmup_stop = threading.Event()
+    state._ranking_warmup_shutdown = False
+    state._ranking_warmup_task = None
+
+
+def startup_warmup_stopped(state):
+    stop = getattr(state, '_ranking_warmup_stop', None)
+    shutdown = getattr(state, '_ranking_shutdown_stop', None)
+    return (stop is not None and stop.is_set()) or (shutdown is not None and shutdown.is_set())
+
+
+def stop_startup_warmup(state):
+    state._ranking_warmup_shutdown = True
+    stop = getattr(state, '_ranking_warmup_stop', None)
+    if stop is None:
+        stop = threading.Event()
+        state._ranking_warmup_stop = stop
+    stop.set()
+
+
+def startup_shutdown_requested(state):
+    shutdown = getattr(state, '_ranking_shutdown_stop', None)
+    return getattr(state, '_ranking_warmup_shutdown', False) or (shutdown is not None and shutdown.is_set())
+
+
+async def _wait_task(task, *, result, on_cancel=None):
+    owner = asyncio.current_task()
+    initial_cancels = owner.cancelling()
+    cancelled = None
+    while not task.done():
+        try:
+            await asyncio.shield(task)
+        except asyncio.CancelledError as error:
+            if owner.cancelling() > initial_cancels:
+                cancelled = error
+                if on_cancel is not None:
+                    on_cancel()
+        except BaseException:
+            break
+    if not task.cancelled():
+        task.exception()
+    if cancelled is not None:
+        raise cancelled
+    if result:
+        return task.result()
+
+
+async def run_startup_warmup(state, function):
+    if startup_warmup_stopped(state):
+        raise asyncio.CancelledError
+    previous = getattr(state, '_ranking_warmup_task', None)
+    if previous is not None and not previous.done():
+        raise RuntimeError('startup work is still pending')
+    coroutine = run_owned_thread(function)
+    try:
+        task = asyncio.create_task(coroutine)
+    except BaseException:
+        coroutine.close()
+        raise
+    state._ranking_warmup_task = task
+    try:
+        return await _wait_task(task, result=True, on_cancel=state._ranking_warmup_stop.set)
+    finally:
+        if startup_warmup_stopped(state):
+            raise asyncio.CancelledError
+
+
+async def wait_startup_warmup(state):
+    task = getattr(state, '_ranking_warmup_task', None)
+    if task is not None:
+        await _wait_task(task, result=False)

verification_io.py

@@ -0,0 +1,17 @@
+"""发码同步工作的有界准入与关闭等待。"""
+from fastapi import HTTPException
+from owned_thread import OwnedThreadGroup
+
+MAX_VERIFICATION_IO = 8
+
+
+class VerificationIO(OwnedThreadGroup):
+    def __init__(self, capacity=MAX_VERIFICATION_IO):
+        super().__init__(capacity, lambda: HTTPException(status_code=503, detail='验证码服务暂不可用'))
+
+
+_verification_io = VerificationIO()
+run_verification_io = _verification_io.run
+start_verification_io = _verification_io.start
+stop_verification_io = _verification_io.stop
+close_verification_io = _verification_io.close

verify_code_engine.py

@@ -32,21 +32,8 @@ _CLEANUP_INTERVAL = 300  # 5分钟清理一次
 # 作用：HF Spaces 的运行日志对外可见，验证码与联系方式明文入日志等同于泄露账号
 
 
-def _mask_contact(contact: str) -> str:
-    """
-    🔒 联系方式脱敏（邮箱 / 手机号统一处理），仅用于日志输出
-    参数：contact - 原始邮箱或手机号
-    返回：脱敏后的字符串，保留足够辨识度以便排障，但不足以定位到具体用户
-    """
-    if not contact:
-        return ""
-    contact = str(contact)
-    if "@" in contact:
-        name, _, domain = contact.partition("@")
-        return f"{name[:1]}***@{domain}" if len(name) > 1 else f"***@{domain}"
-    if len(contact) >= 7:
-        return contact[:3] + "****" + contact[-2:]
-    return "***"
+def _delivery_log_action(action: str) -> str:
+    return action if type(action) is str and action in ("register", "reset", "recover", "withdraw") else "unknown"
 
 
 def check_send_cooldown(contact: str):
@@ -91,6 +78,8 @@ def send_email_code(to_email: str, code: str, action: str):
     if not webhook_url:
         raise RuntimeError("verification_delivery_unavailable")
 
+    log_action = _delivery_log_action(action)
+
     # 根据动作类型生成不同的邮件标题
     if action == "register":
         action_str = "注册账号"
@@ -132,14 +121,13 @@ def send_email_code(to_email: str, code: str, action: str):
         with urllib.request.urlopen(req, timeout=10) as response:
             if not 200 <= response.status < 300:
                 raise RuntimeError("verification_delivery_unconfirmed")
-            # 🔒 安全修复：不再打印验证码与邮箱明文（日志对外可见），仅留脱敏标识与动作类型
-            print(f"✅ 成功触发 Webhook 发送验证码邮件至 {_mask_contact(to_email)}（动作: {action}）")
+            print(f"✅ Webhook 验证码邮件发送成功: action={log_action}")
     except Exception as e:
         status = getattr(getattr(e, "response", None), "status_code", None)
         if not isinstance(status, int):
             status = getattr(e, "code", None)
         status_text = f", status={status}" if isinstance(status, int) and 100 <= status <= 599 else ""
-        print(f"❌ Webhook 触发失败: action={action}, target={_mask_contact(to_email)}, error_type={type(e).__name__}{status_text}")
+        print(f"❌ Webhook 触发失败: action={log_action}, error_type={type(e).__name__}{status_text}")
         raise RuntimeError("verification_delivery_unconfirmed") from None
 
 
@@ -157,6 +145,7 @@ def send_sms_code(phone: str, code: str, action: str):
         - 环境变量 ALIYUN_AK, ALIYUN_SK, ALIYUN_SIGN_NAME (阿里云配置)
         - router_users_auth.py 的 send_verify_code() 异步调用此函数
     """
+    log_action = _delivery_log_action(action)
     if action == "register":
         action_str = "注册账号"
     elif action == "withdraw":
@@ -192,13 +181,13 @@ def send_sms_code(phone: str, code: str, action: str):
             with urllib.request.urlopen(req, timeout=10) as response:
                 if not 200 <= response.status < 300:
                     raise RuntimeError("verification_delivery_unconfirmed")
-                print(f"✅ Twilio 短信已成功下发至 {_mask_contact(phone)}")
+                print(f"✅ Twilio 短信发送成功: action={log_action}")
         except Exception as e:
             status = getattr(getattr(e, "response", None), "status_code", None)
             if not isinstance(status, int):
                 status = getattr(e, "code", None)
             status_text = f", status={status}" if isinstance(status, int) and 100 <= status <= 599 else ""
-            print(f"❌ Twilio 发送失败: target={_mask_contact(phone)}, error_type={type(e).__name__}{status_text}")
+            print(f"❌ Twilio 发送失败: action={log_action}, error_type={type(e).__name__}{status_text}")
             raise RuntimeError("verification_delivery_unconfirmed") from None
         return
 
@@ -240,12 +229,12 @@ def send_sms_code(phone: str, code: str, action: str):
         try:
             response = client.send_sms(send_req)
             if response.body.code == "OK":
-                print(f"✅ 阿里云短信已成功下发至 {_mask_contact(phone)}")
+                print(f"✅ 阿里云短信发送成功: action={log_action}")
             else:
-                print(f"❌ 阿里云下发失败: target={_mask_contact(phone)}")
+                print(f"❌ 阿里云下发失败: action={log_action}")
                 raise RuntimeError("verification_delivery_unconfirmed")
         except Exception as e:
-            print(f"❌ 阿里云请求异常: target={_mask_contact(phone)}, error_type={type(e).__name__}")
+            print(f"❌ 阿里云请求异常: action={log_action}, error_type={type(e).__name__}")
             raise RuntimeError("verification_delivery_unconfirmed") from None
         return
 

安全认证.py

@@ -10,7 +10,6 @@
 # ==========================================
 
 import os
-import asyncio
 import math
 import hashlib
 import hmac
@@ -20,6 +19,7 @@ import time
 from typing import Optional, Tuple
 from fastapi import HTTPException, Header
 from user_store import read_user, get_password_version
+from auth_io import run_identity_io
 
 # 🔒 P0安全增强：引入bcrypt进行密码哈希
 import bcrypt
@@ -335,7 +335,7 @@ async def require_auth(authorization: str = Header(None, alias="Authorization"))
     token = parts[1]
     
     # 验证 Token（严格 JWT 验证，不再有降级信任）
-    is_valid, account, error_msg = await asyncio.to_thread(verify_token_with_fallback, token)
+    is_valid, account, error_msg = await run_identity_io(verify_token_with_fallback, token)
     
     if not is_valid:
         raise HTTPException(status_code=401, detail=error_msg)