新增提示词界面

app.py

@@ -53,6 +53,7 @@ from router_messages import router as messages_router # ✉️ 私信系统
 from router_wallet import router as wallet_router     # 💰 钱包/提现
 from router_proxy import router as proxy_router       # 🔗 代理下载
 from router_posts import router as posts_router       # 💬 讨论区
+from router_prompts import router as prompts_router   # ✨ 提示词市场
 from router_tasks import router as tasks_router       # 📝 任务榜
 from router_open_api import router as open_api_router  # 🌐 通用开放API（第三方插件）
 from router_admin_plugins import router as admin_plugins_router  # 🔒 管理后台 - 第三方插件管理API
@@ -284,6 +285,7 @@ app.include_router(messages_router)       # ✉️ 私信系统
 app.include_router(wallet_router)         # 💰 钱包/提现
 app.include_router(proxy_router)          # 🔗 代理下载
 app.include_router(posts_router)          # 💬 讨论区
+app.include_router(prompts_router)        # ✨ 提示词市场
 app.include_router(tasks_router)          # 📝 任务榜
 app.include_router(open_api_router)       # 🌐 通用开放API（供第三方插件调用）
 app.include_router(admin_plugins_router)  # 🔒 管理后台 - 第三方插件管理API

models.py

@@ -261,4 +261,36 @@ class PostUpdate(BaseModel):
     images: Optional[List[str]] = None
     is_original: Optional[bool] = None      # 🎨 是否为原创作品
     post_type: Optional[str] = None         # "image" 或 "video"
-    video_url: Optional[str] = None         # 视频 URL（仅 video 类型）
+    video_url: Optional[str] = None         # 视频 URL（仅 video 类型）
+
+# ==========================================
+# ✨ 提示词市场数据模型（图像/视频提示词）
+# ==========================================
+
+class PromptCreate(BaseModel):
+    """ 发布提示词 """
+    prompt_type: str                        # "image" 或 "video"（所属子界面）
+    category: str                           # 所属分类（人物/动作等）
+    title: str                              # 标题
+    content: str                            # 公开介绍文案
+    prompt_text: str                        # 提示词正文（付费内容，服务端脱敏下发）
+    cover_image: str                        # 封面图
+    media_type: str = "image"               # "image" 或 "video"（示例媒体类型）
+    video_url: Optional[str] = None         # 示例视频 URL（仅 media_type=video）
+    price: int = 0                          # 定价（0=免费）
+
+class PromptUpdate(BaseModel):
+    """ 更新提示词 """
+    category: Optional[str] = None
+    title: Optional[str] = None
+    content: Optional[str] = None
+    prompt_text: Optional[str] = None
+    cover_image: Optional[str] = None
+    media_type: Optional[str] = None
+    video_url: Optional[str] = None
+    price: Optional[int] = None
+
+class PromptCategoryAdd(BaseModel):
+    """ 添加提示词分类 """
+    prompt_type: str                        # "image" 或 "video"
+    name: str                               # 分类名称（≤8字，去重）

router_prompts.py

@@ -0,0 +1,952 @@
+# 云端Space代码/router_prompts.py
+# ==========================================
+# ✨ 提示词市场API路由（图像/视频提示词）
+# ==========================================
+# 功能：提示词发布、列表（分类筛选）、详情（付费内容脱敏）、
+#       互动（点赞/收藏/评论/打赏）、购买解锁、分类管理
+# 数据持久化：prompts.json / prompt_categories.json
+#   与 posts.json 相同，经 数据库连接.py 自动同步至 HF Dataset
+# 关联文件：
+#   - router_posts.py (实现模式参照)
+#   - router_wallet.py (钱包/交易逻辑参照)
+#   - models_sql.py (Wallet/Transaction/Ownership)
+# ==========================================
+
+from fastapi import APIRouter, HTTPException, Depends, Request
+from sqlalchemy.orm import Session
+from models import PromptCreate, PromptUpdate, PromptCategoryAdd
+import 数据库连接 as db
+from 安全认证 import require_auth, optional_auth
+from db_utils import record_view, sort_cache
+from database_sql import get_db
+from models_sql import Wallet, Transaction, Ownership
+from notifications import add_notification
+import time
+import uuid
+import hashlib
+import datetime
+import logging
+
+# 🔒 P0安全优化：API限流（与 router_wallet.py 保持一致）
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+limiter = Limiter(key_func=get_remote_address)
+
+router = APIRouter()
+
+# 📝 审计日志
+logger = logging.getLogger("ComfyUI-Ranking.Prompts")
+
+# 内置默认分类（首次读取 prompt_categories.json 不存在时自动初始化）
+DEFAULT_CATEGORIES = {
+    "image": ["人物", "动物", "植物", "道具", "建筑"],
+    "video": ["动作", "表情变化", "天气变化", "光效变化", "运镜", "视觉风格"]
+}
+
+VALID_PROMPT_TYPES = ("image", "video")
+
+# 内容长度上限
+MAX_TITLE_LEN = 50
+MAX_CONTENT_LEN = 2000
+MAX_PROMPT_TEXT_LEN = 20000
+MAX_PRICE = 10000
+MAX_CATEGORY_LEN = 8
+MAX_CATEGORY_PER_TYPE = 30
+
+
+def calculate_tx_hash(tx_id, account, tx_type, amount, prev_hash):
+    data = f"{tx_id}{account}{tx_type}{amount}{prev_hash}"
+    return hashlib.sha256(data.encode()).hexdigest()
+
+
+def _load_categories() -> dict:
+    """读取分类数据，不存在时用内置默认值初始化并持久化"""
+    categories = db.load_data("prompt_categories.json", default_data=None)
+    if not isinstance(categories, dict) or "image" not in categories or "video" not in categories:
+        categories = {
+            "image": list(DEFAULT_CATEGORIES["image"]),
+            "video": list(DEFAULT_CATEGORIES["video"])
+        }
+        db.save_data("prompt_categories.json", categories)
+    return categories
+
+
+def _user_owns_prompt(db_session: Session, account: str, prompt_id: str) -> bool:
+    """检查用户是否已购买（未退款）该提示词"""
+    if not account:
+        return False
+    ownership = db_session.query(Ownership).filter(
+        Ownership.account == account,
+        Ownership.item_id == prompt_id,
+        Ownership.is_refunded == False
+    ).first()
+    return ownership is not None
+
+
+def _mask_prompt_text(prompt_data: dict, can_view: bool) -> dict:
+    """
+    🔒 内容脱敏核心逻辑：
+    未授权用户一律不下发 prompt_text（服务端脱敏，不依赖前端隐藏）
+    """
+    if can_view:
+        prompt_data["locked"] = False
+    else:
+        prompt_data["prompt_text"] = None
+        prompt_data["locked"] = True
+    return prompt_data
+
+
+# ==========================================
+# 📂 分类管理接口
+# ==========================================
+
+@router.get("/api/prompt-categories")
+async def get_prompt_categories(prompt_type: str = None):
+    """
+    获取提示词分类列表
+    - prompt_type: image / video，不传则返回全部
+    """
+    categories = _load_categories()
+    if prompt_type in VALID_PROMPT_TYPES:
+        return {"status": "success", "data": categories.get(prompt_type, [])}
+    return {"status": "success", "data": categories}
+
+
+@router.post("/api/prompt-categories")
+@limiter.limit("5/minute")  # 🔒 限流：防止分类刷屏
+async def add_prompt_category(request: Request, body: PromptCategoryAdd, current_user: str = Depends(require_auth)):
+    """
+    添加提示词分类（登录用户均可，重名去重）
+    """
+    if body.prompt_type not in VALID_PROMPT_TYPES:
+        raise HTTPException(status_code=400, detail="分类所属类型必须是 image 或 video")
+
+    name = (body.name or "").strip()
+    if not name:
+        raise HTTPException(status_code=400, detail="分类名称不能为空")
+    if len(name) > MAX_CATEGORY_LEN:
+        raise HTTPException(status_code=400, detail=f"分类名称不能超过{MAX_CATEGORY_LEN}个字")
+
+    result_holder = {}
+
+    def updater(data):
+        if not isinstance(data, dict):
+            data = {
+                "image": list(DEFAULT_CATEGORIES["image"]),
+                "video": list(DEFAULT_CATEGORIES["video"])
+            }
+        cat_list = data.get(body.prompt_type, [])
+        if name in cat_list:
+            result_holder["error"] = "duplicate"
+            return
+        if len(cat_list) >= MAX_CATEGORY_PER_TYPE:
+            result_holder["error"] = "too_many"
+            return
+        cat_list.append(name)
+        data[body.prompt_type] = cat_list
+        result_holder["data"] = cat_list
+
+    db.atomic_update("prompt_categories.json", updater, default_data={})
+
+    if result_holder.get("error") == "duplicate":
+        raise HTTPException(status_code=400, detail="该分类已存在")
+    if result_holder.get("error") == "too_many":
+        raise HTTPException(status_code=400, detail=f"分类数量已达上限({MAX_CATEGORY_PER_TYPE})")
+
+    logger.info(f"PROMPT_CATEGORY_ADD | user={current_user} | type={body.prompt_type} | name={name}")
+    return {"status": "success", "data": result_holder["data"]}
+
+
+# ==========================================
+# 📝 提示词CRUD接口
+# ==========================================
+
+@router.get("/api/prompts")
+async def get_prompts(prompt_type: str = None, category: str = None,
+                      page: int = 1, limit: int = 20, sort: str = "latest"):
+    """
+    获取提示词列表（分页，支持类型/分类筛选与多种排序）
+    - prompt_type: image / video（子界面筛选）
+    - category: 分类筛选
+    - sort: latest / likes / favorites / views / daily_views / tips
+    ⚠️ 列表接口永不下发 prompt_text（付费内容脱敏）
+    """
+    prompts_db = db.load_data("prompts.json", default_data=[])
+    users_db = db.load_data("users.json", default_data={})
+    user_map = users_db
+
+    # 🗂️ 使用排序缓存优化排序性能
+    cache_key = f"prompts:{sort}"
+
+    def sort_fn(data):
+        if sort == "likes":
+            data.sort(key=lambda x: x.get("likes", 0), reverse=True)
+        elif sort == "favorites":
+            data.sort(key=lambda x: x.get("favorites", 0), reverse=True)
+        elif sort == "views":
+            data.sort(key=lambda x: x.get("views", 0), reverse=True)
+        elif sort == "daily_views":
+            data.sort(key=lambda x: x.get("daily_views", 0), reverse=True)
+        elif sort == "tips":
+            data.sort(key=lambda x: sum(t.get("amount", 0) for t in x.get("tip_board", [])), reverse=True)
+        else:  # latest 或其他默认
+            data.sort(key=lambda x: x.get("created_at", 0), reverse=True)
+
+    sorted_prompts = sort_cache.get_sorted(cache_key, prompts_db, sort_fn)
+
+    # 类型与分类过滤
+    if prompt_type in VALID_PROMPT_TYPES:
+        sorted_prompts = [p for p in sorted_prompts if p.get("prompt_type") == prompt_type]
+    if category:
+        sorted_prompts = [p for p in sorted_prompts if p.get("category") == category]
+
+    # 分页
+    total = len(sorted_prompts)
+    start = (page - 1) * limit
+    end = start + limit
+    paged_prompts = sorted_prompts[start:end]
+
+    # 附加作者信息，并过滤敏感字段
+    result = []
+    for prompt in paged_prompts:
+        author_info = user_map.get(prompt.get("author"), {})
+        prompt_data = {
+            **prompt,
+            "author_name": author_info.get("name", prompt.get("author")),
+            "author_avatar": author_info.get("avatarDataUrl", "")
+        }
+        # 🔒 脱敏：列表永不下发提示词正文与浏览记录
+        prompt_data.pop("prompt_text", None)
+        prompt_data.pop("viewed_by", None)
+        result.append(prompt_data)
+
+    return {
+        "status": "success",
+        "data": result,
+        "total": total,
+        "page": page,
+        "limit": limit
+    }
+
+
+@router.get("/api/my-prompts")
+async def get_my_prompts(current_user: str = Depends(require_auth)):
+    """
+    获取我发布的提示词（个人中心用）
+    作者本人可见自己的 prompt_text
+    """
+    prompts_db = db.load_data("prompts.json", default_data=[])
+
+    my_prompts = [p for p in prompts_db if p.get("author") == current_user]
+    my_prompts = sorted(my_prompts, key=lambda x: x.get("created_at", 0), reverse=True)
+
+    result = []
+    for prompt in my_prompts:
+        prompt_data = dict(prompt)
+        prompt_data.pop("viewed_by", None)
+        result.append(prompt_data)
+
+    return {"status": "success", "data": result}
+
+
+@router.get("/api/prompts/{prompt_id}")
+async def get_prompt_detail(prompt_id: str, current_user: str = Depends(optional_auth),
+                            db_session: Session = Depends(get_db)):
+    """
+    获取提示词详情
+    🔒 仅当 ①免费 ②作者本人 ③已购买 时下发 prompt_text
+    """
+    prompts_db = db.load_data("prompts.json", default_data=[])
+    users_db = db.load_data("users.json", default_data={})
+    user_map = users_db
+
+    for prompt in prompts_db:
+        if prompt["id"] == prompt_id:
+            author_info = user_map.get(prompt.get("author"), {})
+            prompt_data = {
+                **prompt,
+                "author_name": author_info.get("name", prompt.get("author")),
+                "author_avatar": author_info.get("avatarDataUrl", "")
+            }
+            prompt_data.pop("viewed_by", None)
+
+            price = int(prompt.get("price", 0) or 0)
+            is_author = current_user and current_user == prompt.get("author")
+            can_view = price <= 0 or is_author or _user_owns_prompt(db_session, current_user, prompt_id)
+            prompt_data["owned"] = bool(can_view)
+            _mask_prompt_text(prompt_data, can_view)
+
+            return {"status": "success", "data": prompt_data}
+
+    raise HTTPException(status_code=404, detail="提示词不存在")
+
+
+@router.post("/api/prompts")
+async def create_prompt(prompt: PromptCreate, current_user: str = Depends(require_auth)):
+    """
+    发布提示词
+    """
+    # 参数校验
+    if prompt.prompt_type not in VALID_PROMPT_TYPES:
+        raise HTTPException(status_code=400, detail="提示词类型必须是 image 或 video")
+    title = (prompt.title or "").strip()
+    content = (prompt.content or "").strip()
+    prompt_text = (prompt.prompt_text or "").strip()
+    category = (prompt.category or "").strip()
+    if not title or not content or not prompt_text:
+        raise HTTPException(status_code=400, detail="标题、介绍文案与提示词正文均不能为空")
+    if len(title) > MAX_TITLE_LEN:
+        raise HTTPException(status_code=400, detail=f"标题不能超过{MAX_TITLE_LEN}个字")
+    if len(content) > MAX_CONTENT_LEN:
+        raise HTTPException(status_code=400, detail=f"介绍文案不能超过{MAX_CONTENT_LEN}个字")
+    if len(prompt_text) > MAX_PROMPT_TEXT_LEN:
+        raise HTTPException(status_code=400, detail=f"提示词正文不能超过{MAX_PROMPT_TEXT_LEN}个字")
+    if not category:
+        raise HTTPException(status_code=400, detail="请选择分类")
+
+    # 分类必须存在于分类库
+    categories = _load_categories()
+    if category not in categories.get(prompt.prompt_type, []):
+        raise HTTPException(status_code=400, detail="所选分类不存在")
+
+    price = int(prompt.price or 0)
+    if price < 0 or price > MAX_PRICE:
+        raise HTTPException(status_code=400, detail=f"定价必须在0-{MAX_PRICE}之间")
+
+    media_type = prompt.media_type if prompt.media_type in ("image", "video") else "image"
+    video_url = prompt.video_url if media_type == "video" else None
+    if media_type == "video" and not video_url:
+        # 未上传示例视频时降级为图片展示
+        media_type = "image"
+
+    new_prompt = {
+        "id": f"prompt_{int(time.time())}_{uuid.uuid4().hex[:6]}",
+        "prompt_type": prompt.prompt_type,
+        "category": category,
+        "title": title,
+        "content": content,
+        "prompt_text": prompt_text,
+        "cover_image": prompt.cover_image,
+        "media_type": media_type,
+        "video_url": video_url,
+        "price": price,
+        "author": current_user,
+        "created_at": int(time.time()),
+        # 互动数据
+        "likes": 0,
+        "favorites": 0,
+        "comments": 0,
+        "liked_by": [],
+        "favorited_by": [],
+        "tip_board": [],  # 打赏榜单
+        "views": 0,
+        "daily_views": 0,
+        "viewed_by": [],
+        "daily_views_date": ""
+    }
+
+    prompts_db = db.load_data("prompts.json", default_data=[])
+    prompts_db.insert(0, new_prompt)
+    db.save_data("prompts.json", prompts_db)
+    # 🗂️ 清除排序缓存
+    sort_cache.invalidate("prompts:")
+
+    return {"status": "success", "data": new_prompt}
+
+
+@router.put("/api/prompts/{prompt_id}")
+async def update_prompt(prompt_id: str, update_data: PromptUpdate, current_user: str = Depends(require_auth)):
+    """
+    更新提示词（仅作者可操作，原子操作，并发安全）
+    """
+    result_holder = {}
+
+    def updater(data):
+        for prompt in data:
+            if prompt["id"] == prompt_id:
+                if prompt.get("author") != current_user:
+                    result_holder["error"] = "forbidden"
+                    return False
+                # 更新字段
+                if update_data.title is not None:
+                    title = update_data.title.strip()
+                    if not title or len(title) > MAX_TITLE_LEN:
+                        result_holder["error"] = "invalid_title"
+                        return False
+                    prompt["title"] = title
+                if update_data.content is not None:
+                    content = update_data.content.strip()
+                    if len(content) > MAX_CONTENT_LEN:
+                        result_holder["error"] = "invalid_content"
+                        return False
+                    prompt["content"] = content
+                if update_data.prompt_text is not None:
+                    prompt_text = update_data.prompt_text.strip()
+                    if not prompt_text or len(prompt_text) > MAX_PROMPT_TEXT_LEN:
+                        result_holder["error"] = "invalid_prompt_text"
+                        return False
+                    prompt["prompt_text"] = prompt_text
+                if update_data.category is not None:
+                    category = update_data.category.strip()
+                    categories = _load_categories()
+                    if category not in categories.get(prompt.get("prompt_type"), []):
+                        result_holder["error"] = "invalid_category"
+                        return False
+                    prompt["category"] = category
+                if update_data.cover_image is not None:
+                    prompt["cover_image"] = update_data.cover_image
+                if update_data.price is not None:
+                    price = int(update_data.price)
+                    if price < 0 or price > MAX_PRICE:
+                        result_holder["error"] = "invalid_price"
+                        return False
+                    prompt["price"] = price
+                if update_data.media_type is not None:
+                    if update_data.media_type not in ("image", "video"):
+                        result_holder["error"] = "invalid_media_type"
+                        return False
+                    prompt["media_type"] = update_data.media_type
+                    if update_data.media_type == "image":
+                        prompt["video_url"] = None
+                if update_data.video_url is not None:
+                    prompt["video_url"] = update_data.video_url
+                    if update_data.video_url:
+                        prompt["media_type"] = "video"
+                result_holder["prompt"] = prompt
+                return True
+        result_holder["error"] = "not_found"
+        return False
+
+    db.atomic_update("prompts.json", updater, default_data=[])
+
+    error_map = {
+        "forbidden": (403, "无权修改他人提示词"),
+        "not_found": (404, "提示词不存在"),
+        "invalid_title": (400, f"标题不能为空且不能超过{MAX_TITLE_LEN}个字"),
+        "invalid_content": (400, f"介绍文案不能超过{MAX_CONTENT_LEN}个字"),
+        "invalid_prompt_text": (400, "提示词正文不能为空且长度超限"),
+        "invalid_category": (400, "所选分类不存在"),
+        "invalid_price": (400, f"定价必须在0-{MAX_PRICE}之间"),
+        "invalid_media_type": (400, "媒体类型必须是 image 或 video")
+    }
+    error = result_holder.get("error")
+    if error:
+        code, detail = error_map.get(error, (400, "参数错误"))
+        raise HTTPException(status_code=code, detail=detail)
+
+    # 🗂️ 清除排序缓存
+    sort_cache.invalidate("prompts:")
+    return {"status": "success"}
+
+
+@router.delete("/api/prompts/{prompt_id}")
+async def delete_prompt(prompt_id: str, current_user: str = Depends(require_auth)):
+    """
+    删除提示词（仅作者可操作）
+    """
+    prompts_db = db.load_data("prompts.json", default_data=[])
+
+    for i, prompt in enumerate(prompts_db):
+        if prompt["id"] == prompt_id:
+            if prompt.get("author") != current_user:
+                raise HTTPException(status_code=403, detail="无权删除他人提示词")
+
+            prompts_db.pop(i)
+            db.save_data("prompts.json", prompts_db)
+            # 🗂️ 清除排序缓存
+            sort_cache.invalidate("prompts:")
+            return {"status": "success"}
+
+    raise HTTPException(status_code=404, detail="提示词不存在")
+
+
+# ==========================================
+# ❤️ 互动接口（点赞/收藏）
+# ==========================================
+
+@router.post("/api/prompts/{prompt_id}/like")
+async def toggle_like(prompt_id: str, current_user: str = Depends(require_auth)):
+    """
+    点赞/取消点赞（原子操作，并发安全）
+    """
+    result_container = [None]
+
+    def updater(data):
+        for prompt in data:
+            if prompt["id"] == prompt_id:
+                liked_by = prompt.get("liked_by", [])
+                if current_user in liked_by:
+                    liked_by.remove(current_user)
+                    prompt["likes"] = max(0, prompt.get("likes", 0) - 1)
+                    action = "unliked"
+                else:
+                    liked_by.append(current_user)
+                    prompt["likes"] = prompt.get("likes", 0) + 1
+                    action = "liked"
+                prompt["liked_by"] = liked_by
+                result_container[0] = {"status": "success", "action": action, "likes": prompt["likes"]}
+                return
+        result_container[0] = None  # 未找到提示词
+
+    db.atomic_update("prompts.json", updater, default_data=[])
+
+    if result_container[0] is None:
+        raise HTTPException(status_code=404, detail="提示词不存在")
+
+    # 🗂️ 清除排序缓存（点赞数变化可能影响排序）
+    sort_cache.invalidate("prompts:")
+
+    return result_container[0]
+
+
+@router.post("/api/prompts/{prompt_id}/favorite")
+async def toggle_favorite(prompt_id: str, current_user: str = Depends(require_auth)):
+    """
+    收藏/取消收藏（原子操作，并发安全）
+    """
+    result_container = [None]
+
+    def updater(data):
+        for prompt in data:
+            if prompt["id"] == prompt_id:
+                favorited_by = prompt.get("favorited_by", [])
+                if current_user in favorited_by:
+                    favorited_by.remove(current_user)
+                    prompt["favorites"] = max(0, prompt.get("favorites", 0) - 1)
+                    action = "unfavorited"
+                else:
+                    favorited_by.append(current_user)
+                    prompt["favorites"] = prompt.get("favorites", 0) + 1
+                    action = "favorited"
+                prompt["favorited_by"] = favorited_by
+                result_container[0] = {"status": "success", "action": action, "favorites": prompt["favorites"]}
+                return
+        result_container[0] = None  # 未找到提示词
+
+    db.atomic_update("prompts.json", updater, default_data=[])
+
+    if result_container[0] is None:
+        raise HTTPException(status_code=404, detail="提示词不存在")
+
+    # 🗂️ 清除排序缓存（收藏数变化可能影响排序）
+    sort_cache.invalidate("prompts:")
+
+    return result_container[0]
+
+
+# ==========================================
+# 🎁 打赏接口
+# ==========================================
+
+@router.post("/api/prompts/{prompt_id}/tip")
+async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
+                     current_user: str = Depends(require_auth), db_session: Session = Depends(get_db)):
+    """
+    打赏提示词（原子操作，并发安全）- 使用 SQL Wallet 系统
+    """
+    if amount <= 0:
+        raise HTTPException(status_code=400, detail="打赏金额必须大于0")
+    MAX_TIP_AMOUNT = 100000
+    if amount > MAX_TIP_AMOUNT:
+        raise HTTPException(status_code=400, detail=f"打赏金额必须在1-{MAX_TIP_AMOUNT}之间")
+
+    result_container = [None]
+    author_account = [None]  # 用于在原子操作外获取作者账号
+
+    def updater(data):
+        # 在锁内查找提示词
+        target_prompt = None
+        for prompt in data:
+            if prompt["id"] == prompt_id:
+                target_prompt = prompt
+                break
+
+        if not target_prompt:
+            result_container[0] = {"error": "not_found"}
+            return
+
+        # 不能打赏自己
+        if target_prompt.get("author") == current_user:
+            result_container[0] = {"error": "self_tip"}
+            return
+
+        author_account[0] = target_prompt.get("author")
+
+        # 更新打赏榜单
+        tip_board = target_prompt.get("tip_board", [])
+        existing = next((t for t in tip_board if t["account"] == current_user), None)
+        if existing:
+            existing["amount"] += amount
+        else:
+            tip_board.append({"account": current_user, "amount": amount, "is_anon": is_anon})
+        tip_board.sort(key=lambda x: x["amount"], reverse=True)
+        target_prompt["tip_board"] = tip_board
+
+        result_container[0] = {"status": "success", "message": f"成功打赏 {amount} 积分"}
+
+    db.atomic_update("prompts.json", updater, default_data=[])
+
+    result = result_container[0]
+    if result is None or result.get("error") == "not_found":
+        raise HTTPException(status_code=404, detail="提示词不存在")
+    if result.get("error") == "self_tip":
+        raise HTTPException(status_code=400, detail="不能打赏自己的提示词")
+
+    # 💳 使用 SQL Wallet 系统处理余额转账
+    try:
+        author = author_account[0]
+        if not author:
+            raise HTTPException(status_code=404, detail="作者账户不存在")
+
+        # 🔒 P1幂等性防护：检查最近5秒内是否存在相同交易
+        recent_cutoff = datetime.datetime.utcnow() - datetime.timedelta(seconds=5)
+        duplicate_tx = db_session.query(Transaction).filter(
+            Transaction.account == current_user,
+            Transaction.tx_type == "TIP_OUT",
+            Transaction.amount == -amount,
+            Transaction.related_account == author,
+            Transaction.created_at >= recent_cutoff
+        ).first()
+        if duplicate_tx:
+            return {"status": "success", "message": "打赏已处理（重复请求）"}
+
+        # 🔒 并发安全：使用悲观锁获取双方钱包
+        tipper_wallet = db_session.query(Wallet).filter(Wallet.account == current_user).with_for_update().first()
+        author_wallet = db_session.query(Wallet).filter(Wallet.account == author).with_for_update().first()
+
+        if not tipper_wallet or tipper_wallet.balance < amount:
+            raise HTTPException(status_code=400, detail="余额不足")
+        if not author_wallet:
+            # 如果作者钱包不存在，创建一个
+            author_wallet = Wallet(account=author, balance=0, earn_balance=0, tip_balance=0, frozen_balance=0)
+            db_session.add(author_wallet)
+
+        # 执行转账
+        tipper_wallet.balance -= amount
+        author_wallet.balance += amount         # 实际收入进统一余额
+        author_wallet.tip_balance += amount     # 累计打赏收益统计（只增不减）
+
+        # 创建交易记录
+        tx_id_tipper = f"TIP_OUT_{int(time.time())}_{uuid.uuid4().hex[:6]}"
+        tx_id_author = f"TIP_IN_{int(time.time())}_{uuid.uuid4().hex[:6]}"
+
+        # 获取最后交易记录的哈希
+        last_tx_tipper = db_session.query(Transaction).filter(Transaction.account == current_user).order_by(Transaction.created_at.desc()).first()
+        last_tx_author = db_session.query(Transaction).filter(Transaction.account == author).order_by(Transaction.created_at.desc()).first()
+        prev_hash_tipper = last_tx_tipper.tx_hash if last_tx_tipper else "GENESIS_HASH"
+        prev_hash_author = last_tx_author.tx_hash if last_tx_author else "GENESIS_HASH"
+
+        # 获取用户信息和提示词标题
+        users_db = db.load_data("users.json", default_data={})
+        author_info = users_db.get(author, {})
+        tipper_info = users_db.get(current_user, {})
+        author_name = author_info.get("name", author)
+        tipper_name = tipper_info.get("name", current_user)
+
+        prompt_title = None
+        prompts_db = db.load_data("prompts.json", default_data=[])
+        for prompt in prompts_db:
+            if prompt["id"] == prompt_id:
+                prompt_title = prompt.get("title")
+                break
+
+        # 打赏方交易记录 (TIP_OUT)
+        tx_tipper = Transaction(
+            tx_id=tx_id_tipper,
+            account=current_user,
+            tx_type="TIP_OUT",
+            amount=-amount,
+            related_account=author,
+            item_id=prompt_id,
+            prev_hash=prev_hash_tipper,
+            tx_hash=calculate_tx_hash(tx_id_tipper, current_user, "TIP_OUT", -amount, prev_hash_tipper),
+            description=f"打赏给 {author_name}" + (f" 的提示词《{prompt_title}》" if prompt_title else ""),
+            item_title=prompt_title,
+            item_type="prompt",
+            related_user_name=author_name
+        )
+
+        # 接收方交易记录 (TIP_IN)
+        tx_author = Transaction(
+            tx_id=tx_id_author,
+            account=author,
+            tx_type="TIP_IN",
+            amount=amount,
+            related_account=current_user,
+            item_id=prompt_id,
+            prev_hash=prev_hash_author,
+            tx_hash=calculate_tx_hash(tx_id_author, author, "TIP_IN", amount, prev_hash_author),
+            description=f"收到 {tipper_name} 的提示词打赏" + (f" ({prompt_title})" if prompt_title else ""),
+            item_title=prompt_title,
+            item_type="prompt",
+            related_user_name=tipper_name if not is_anon else "匿名用户"
+        )
+
+        db_session.add(tx_tipper)
+        db_session.add(tx_author)
+        db_session.commit()
+
+        # 📝 审计日志
+        logger.info(f"PROMPT_TIP | from={current_user} | to={author} | amount={amount} | prompt={prompt_id} | anon={is_anon}")
+
+        # 🔔 打赏通知（考虑匿名）
+        if not is_anon:
+            add_notification(author, {
+                "type": "tip",
+                "from_user": current_user,
+                "target_item_id": prompt_id,
+                "target_item_title": prompt_title or "",
+                "content": f"您收到来自 {tipper_name} 的 {amount} 积分提示词打赏"
+            })
+        else:
+            add_notification(author, {
+                "type": "tip",
+                "from_user": "anonymous",
+                "target_item_id": prompt_id,
+                "target_item_title": "",
+                "content": f"您收到了一份 {amount} 积分的匿名提示词打赏"
+            })
+
+        # 🗂️ 清除排序缓存（打赏可能影响排序）
+        sort_cache.invalidate("prompts:")
+
+    except HTTPException:
+        db_session.rollback()
+        raise
+    except Exception as e:
+        db_session.rollback()
+        logger.error(f"PROMPT_TIP_ERROR | from={current_user} | prompt={prompt_id} | amount={amount} | error={str(e)}")
+        raise HTTPException(status_code=500, detail="打赏处理失败，请稍后重试")
+
+    return result
+
+
+# ==========================================
+# 🛒 购买解锁接口
+# ==========================================
+
+@router.post("/api/prompts/{prompt_id}/purchase")
+@limiter.limit("10/minute")  # 🔒 P0安全优化：购买每分钟最多10次
+async def purchase_prompt(request: Request, prompt_id: str,
+                          current_user: str = Depends(require_auth), db_session: Session = Depends(get_db)):
+    """
+    购买提示词解锁正文（与 /api/wallet/purchase 逻辑对齐）
+    - 扣费、所有权、PURCHASE/SALE 交易记录、通知一步到位
+    - 成功后直接返回 prompt_text，前端立即展示
+    """
+    prompts_db = db.load_data("prompts.json", default_data=[])
+    prompt = next((p for p in prompts_db if p["id"] == prompt_id), None)
+
+    if not prompt:
+        raise HTTPException(status_code=404, detail="提示词不存在")
+
+    price = int(prompt.get("price", 0) or 0)
+    seller_account = prompt.get("author")
+
+    if price <= 0 or current_user == seller_account:
+        # ☁️ 免费提示词或作者本人，确保 Ownership 记录存在
+        existing_ownership = db_session.query(Ownership).filter(
+            Ownership.account == current_user,
+            Ownership.item_id == prompt_id,
+            Ownership.is_refunded == False
+        ).first()
+        if not existing_ownership:
+            new_ownership = Ownership(
+                account=current_user,
+                item_id=prompt_id,
+                price_paid=0
+            )
+            db_session.add(new_ownership)
+            db_session.commit()
+        return {
+            "status": "success",
+            "already_owned": True,
+            "prompt_text": prompt.get("prompt_text", "")
+        }
+
+    # 检查是否已拥有（排除已退款的记录）
+    owned = db_session.query(Ownership).filter(
+        Ownership.account == current_user,
+        Ownership.item_id == prompt_id,
+        Ownership.is_refunded == False
+    ).first()
+    if owned:
+        return {
+            "status": "success",
+            "already_owned": True,
+            "prompt_text": prompt.get("prompt_text", "")
+        }
+
+    # 🔒 P1并发安全：使用悲观锁+异常处理+事务回滚防止双花问题
+    try:
+        buyer_wallet = db_session.query(Wallet).filter(Wallet.account == current_user).with_for_update().first()
+        if not buyer_wallet or buyer_wallet.balance < price:
+            raise HTTPException(status_code=402, detail="余额不足，请先充值")
+
+        seller_wallet = db_session.query(Wallet).filter(Wallet.account == seller_account).with_for_update().first()
+        if not seller_wallet:
+            seller_wallet = Wallet(account=seller_account, balance=0, earn_balance=0, tip_balance=0, frozen_balance=0)
+            db_session.add(seller_wallet)
+
+        buyer_wallet.balance = int(buyer_wallet.balance or 0) - int(price)
+        seller_wallet.balance = int(seller_wallet.balance or 0) + int(price)          # 实际收入进统一余额
+        seller_wallet.earn_balance = int(seller_wallet.earn_balance or 0) + int(price)  # 累计销售收益统计（只增不减）
+
+        # 记录所有权与实付价格
+        new_ownership = Ownership(account=current_user, item_id=prompt_id, price_paid=price)
+        db_session.add(new_ownership)
+
+        tx_id = f"BUY_{int(time.time())}_{uuid.uuid4().hex[:6]}"
+        last_tx = db_session.query(Transaction).filter(Transaction.account == current_user).order_by(Transaction.created_at.desc()).first()
+        prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
+        tx_hash = calculate_tx_hash(tx_id, current_user, "PURCHASE", -price, prev_hash)
+
+        # 获取卖家用户名
+        users_db = db.load_data("users.json", default_data={})
+        seller_info = users_db.get(seller_account, {})
+        seller_user_name = seller_info.get("name", seller_account)
+
+        # 创建交易记录 (字段名为 related_account，与 models_sql.py 中 Transaction 模型保持一致)
+        new_tx = Transaction(
+            tx_id=tx_id, account=current_user, tx_type="PURCHASE", amount=-price,
+            related_account=seller_account, item_id=prompt_id, prev_hash=prev_hash, tx_hash=tx_hash,
+            description=f"购买提示词 {prompt.get('title', '未知提示词')}",
+            item_title=prompt.get('title', ''),
+            item_type="prompt",
+            related_user_name=seller_user_name
+        )
+        db_session.add(new_tx)
+
+        # 为卖家生成销售收入记录
+        buyer_info = users_db.get(current_user, {})
+        buyer_user_name = buyer_info.get("name", current_user)
+        seller_tx_id = f"SALE_{int(time.time())}_{uuid.uuid4().hex[:6]}"
+        seller_tx = Transaction(
+            tx_id=seller_tx_id,
+            account=seller_account,
+            tx_type="SALE",
+            amount=price,
+            related_account=current_user,
+            item_id=prompt_id,
+            item_title=prompt.get('title', ''),
+            item_type="prompt",
+            related_user_name=buyer_user_name,
+            description=f"��售收入: {prompt.get('title', prompt_id)}"
+        )
+        db_session.add(seller_tx)
+        db_session.commit()
+
+        # 📝 P2优化：购买审计日志
+        logger.info(f"PROMPT_PURCHASE | buyer={current_user} | seller={seller_account} | prompt={prompt_id} | amount={price} | tx={tx_id}")
+
+        # 🔔 通知卖家提示词被购买
+        if seller_account and seller_account != current_user:
+            add_notification(seller_account, {
+                "type": "purchase",
+                "from_user": current_user,
+                "target_item_id": prompt_id,
+                "target_item_title": prompt.get("title", ""),
+                "content": f"您的提示词《{prompt.get('title', '')}》已被购买"
+            })
+
+        # 购买成功后直接返回提示词正文
+        return {
+            "status": "success",
+            "already_owned": False,
+            "prompt_text": prompt.get("prompt_text", "")
+        }
+    except HTTPException:
+        db_session.rollback()
+        raise
+    except Exception as e:
+        db_session.rollback()
+        logger.error(f"PROMPT_PURCHASE_ERROR | buyer={current_user} | prompt={prompt_id} | error={str(e)}")
+        raise HTTPException(status_code=500, detail="购买处理失败，请稍后重试")
+
+
+# ==========================================
+# 💬 评论接口（复用通用评论存储 comments.json）
+# ==========================================
+
+@router.get("/api/prompts/{prompt_id}/comments")
+async def get_prompt_comments(prompt_id: str):
+    """
+    获取提示词评论
+    """
+    comments_db = db.load_data("comments.json", default_data={})
+    users_db = db.load_data("users.json", default_data={})
+    user_map = users_db
+
+    # comments_db 是 {item_id: [comments]} 格式
+    prompt_comments = comments_db.get(prompt_id, [])
+
+    # 附加用户信息
+    result = []
+    for c in prompt_comments:
+        author_info = user_map.get(c.get("author"), {})
+        result.append({
+            **c,
+            "author_name": author_info.get("name", c.get("author")),
+            "author_avatar": author_info.get("avatarDataUrl", "")
+        })
+
+    return {"status": "success", "data": result}
+
+
+@router.post("/api/prompts/{prompt_id}/comments")
+async def add_prompt_comment(prompt_id: str, content: str, current_user: str = Depends(require_auth)):
+    """
+    添加提示词评论
+    """
+    if not content or not content.strip():
+        raise HTTPException(status_code=400, detail="评论内容不能为空")
+
+    prompts_db = db.load_data("prompts.json", default_data=[])
+    comments_db = db.load_data("comments.json", default_data={})
+
+    # 检查提示词是否存在
+    prompt_exists = any(p["id"] == prompt_id for p in prompts_db)
+    if not prompt_exists:
+        raise HTTPException(status_code=404, detail="提示词不存在")
+
+    new_comment = {
+        "id": f"comment_{int(time.time())}_{uuid.uuid4().hex[:6]}",
+        "author": current_user,
+        "content": content.strip(),
+        "created_at": int(time.time())
+    }
+
+    # comments_db 是 {item_id: [comments]} 格式
+    prompt_comments = comments_db.get(prompt_id, [])
+    prompt_comments.insert(0, new_comment)
+    comments_db[prompt_id] = prompt_comments
+    db.save_data("comments.json", comments_db)
+
+    # 🗂️ 清除排序缓存（评论数变化可能影响排序）
+    sort_cache.invalidate("prompts:")
+
+    # 更新提示词评论数
+    for prompt in prompts_db:
+        if prompt["id"] == prompt_id:
+            prompt["comments"] = prompt.get("comments", 0) + 1
+            break
+    db.save_data("prompts.json", prompts_db)
+
+    return {"status": "success", "data": new_comment}
+
+
+@router.post("/api/prompts/{prompt_id}/view")
+async def record_prompt_view(prompt_id: str, current_user: str = Depends(require_auth)):
+    """
+    记录提示词访问量
+    👁️ 需要用户认证，每个用户只计算一次总访问量，日访问量每次调用都增加
+    """
+    result = record_view("prompts.json", prompt_id, current_user)
+
+    if result is None:
+        raise HTTPException(status_code=404, detail="提示词不存在")
+
+    # 🗂️ 清除排序缓存（浏览量变化可能影响排序）
+    sort_cache.invalidate("prompts:")
+
+    return {"status": "success", "views": result["views"], "daily_views": result["daily_views"]}

router_wallet.py

@@ -1057,7 +1057,14 @@ async def get_purchase_status(account: str, item_id: str, db: Session = Depends(
     # 读取商品，获取 allow_refund（旧数据默认 True）
     items_db = json_db.load_data("items.json", default_data=[])
     item = next((i for i in items_db if i.get("id") == item_id), None)
-    allow_refund = item.get("allow_refund", True) if item else True
+    if item:
+        allow_refund = item.get("allow_refund", True)
+    elif item_id.startswith("prompt_"):
+        # ✨ 提示词：虚拟内容即时消费，不支持退款
+        # 注：提示词被作者删除时所有权仍有效，照常返回 owned，仅禁止退款
+        allow_refund = False
+    else:
+        allow_refund = True
     
     # 计算是否在退款窗口内
     purchased_at = ownership.purchased_at

数据库连接.py

@@ -73,6 +73,8 @@ CACHE_TTL = {
     "tasks.json": 60,       # 任务数据 1 分钟
     "users.json": 30,       # 🔒 用户数据 30秒（含权限字段 is_admin，缩短 TTL 确保权限变更及时生效）
     "posts.json": 120,      # 帖子数据 2 分钟
+    "prompts.json": 120,    # ✨ 提示词数据 2 分钟
+    "prompt_categories.json": 300,  # ✨ 提示词分类 5 分钟
     "comments.json": 60,    # 评论数据 1 分钟
     "disputes.json": 60,    # 申诉数据 1 分钟
     "_default": 60          # 默认 1 分钟