3.0更新

Dockerfile

@@ -1,5 +1,5 @@
-# 🚀 P2优化：使用轻量级基镜像，从 900MB 降到 ~150MB
-FROM python:3.9-slim
+# 使用Python 3.11 slim基镜像；包含FFmpeg后的实际镜像体积需测量
+FROM python:3.11-slim
 
 # 设置工作目录
 WORKDIR /code
@@ -13,8 +13,10 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     && rm -rf /var/lib/apt/lists/*
 
 # 先复制依赖文件，利用 Docker 缓存层
-COPY ./requirements.txt /code/requirements.txt
-RUN pip install --no-cache-dir --upgrade -r /code/requirements.txt
+COPY ./requirements.txt ./requirements.lock ./requirements-build.lock /code/
+RUN python -m pip install --no-cache-dir --require-hashes --only-binary=:all: -r /code/requirements-build.lock \
+    && python -m pip install --no-cache-dir --require-hashes --no-build-isolation -r /code/requirements.lock \
+    && python -m pip check
 
 # 复制应用代码
 COPY . .
@@ -29,4 +31,4 @@ HEALTHCHECK --interval=30s --timeout=5s --retries=3 CMD python -c "import urllib
 # force rebuild: 2026-08-16
 
 # 启动命令
-CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]
+CMD ["uvicorn", "app:app", "--host", "0.0.0.0", "--port", "7860"]

app.py

@@ -1,22 +1,22 @@
 # ⚙️ 后端逻辑/核心服务端.py (Hugging Face Spaces app.py)
 from fastapi import FastAPI, File, UploadFile, Form, Depends, HTTPException, Request
+from rate_limit import shared_limit
+from response_privacy import requires_no_store
 from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import Response, JSONResponse, FileResponse 
 from sqlalchemy.orm import Session
 from pydantic import BaseModel
 from huggingface_hub import hf_hub_download, HfApi
-import hashlib
 import uuid
 import urllib.parse
 import urllib.request
 import urllib.error
 import os
 import json
-import mimetypes
 import logging
 import time
-import subprocess
 import datetime
+import threading
 import 数据库连接 as db
 import asyncio
 from 安全认证 import require_auth
@@ -31,6 +31,8 @@ logging.basicConfig(
     datefmt='%Y-%m-%d %H:%M:%S'
 )
 logger = logging.getLogger("ComfyUI-Ranking")
+_UPLOAD_CONCURRENCY = max(1, min(int(os.environ.get("MAX_CONCURRENT_UPLOADS", "4")), 16))
+_UPLOAD_SEMAPHORE = threading.BoundedSemaphore(_UPLOAD_CONCURRENCY)
 
 
 from 云端_定时版本检测引擎 import daily_version_check_task, reset_daily_views_task
@@ -62,15 +64,9 @@ from router_admin_plugins import router as admin_plugins_router  # 🔒 管理
 from database_sql import init_sql_db, get_db, SessionLocal
 from models_sql import SystemConfig  # 🧹 P2清理：Ownership 在本文件无引用
 
-# 🚀 P2优化：速率限制 (防止暴力攻击)
-from slowapi import Limiter, _rate_limit_exceeded_handler
-from slowapi.util import get_remote_address
-from slowapi.errors import RateLimitExceeded
 from fastapi.exceptions import RequestValidationError
 from starlette.exceptions import HTTPException as StarletteHTTPException
-import traceback
 
-limiter = Limiter(key_func=get_remote_address)
 app = FastAPI(
     title="ComfyUI Ranking API",
     description="ComfyUI 社区排名系统 API",
@@ -78,8 +74,6 @@ app = FastAPI(
     docs_url="/api/docs",
     redoc_url="/api/redoc"
 )
-app.state.limiter = limiter
-app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 
 
 # ==========================================
@@ -107,7 +101,7 @@ def create_error_response(status_code: int, detail: str, error_type: str = None,
 @app.exception_handler(StarletteHTTPException)
 async def http_exception_handler(request, exc):
     """🚀 P3优化：HTTP 异常处理，返回统一格式"""
-    logger.warning(f"HTTP {exc.status_code} | {request.url.path} | {exc.detail}")
+    logger.warning(f"HTTP {exc.status_code} | {request.url.path} | detail_type={type(exc.detail).__name__}")
     
     # 根据状态码确定错误类型
     error_type_map = {
@@ -117,6 +111,7 @@ async def http_exception_handler(request, exc):
         404: "not_found",
         409: "conflict",
         429: "rate_limited",
+        502: "upstream_error",
     }
     error_type = error_type_map.get(exc.status_code, "http_error")
     
@@ -125,16 +120,40 @@ async def http_exception_handler(request, exc):
         content=create_error_response(exc.status_code, str(exc.detail), error_type)
     )
 
+from upload_body_guard import UploadBodyGuard
+app.add_middleware(UploadBodyGuard, capacity=_UPLOAD_CONCURRENCY, error_response=create_error_response)
+
+from public_list_etag import PublicListETag
+app.add_middleware(PublicListETag)
+
+@app.middleware("http")
+async def private_response_cache_control(request: Request, call_next):
+    response = await call_next(request)
+    if requires_no_store(request.url.path, request.headers.get("Authorization")):
+        response.headers["Cache-Control"] = "no-store"
+        vary = [name.strip() for name in response.headers.get("Vary", "").split(",") if name.strip()]
+        if not any(name.lower() in {"authorization", "*"} for name in vary):
+            vary.append("Authorization")
+        response.headers["Vary"] = ", ".join(vary)
+    return response
+
+
 @app.exception_handler(RequestValidationError)
 async def validation_exception_handler(request, exc):
     """🚀 P3优化：请求参数校验失败处理"""
-    logger.warning(f"Validation Error | {request.url.path} | {exc.errors()}")
+    # Pydantic errors may include rejected input values (passwords, tokens, private text).
+    # Keep only field paths and machine error codes in public runtime logs.
+    error_fields = [
+        {"field": ".".join(str(loc) for loc in err.get("loc", ())[1:]), "type": err.get("type", "unknown")}
+        for err in exc.errors()
+    ]
+    logger.warning(f"Validation Error | {request.url.path} | fields={error_fields}")
     
     # 提取简洁的错误信息
     errors = []
     for err in exc.errors():
         field = ".".join(str(loc) for loc in err["loc"][1:])  # 跳过 'body'
-        errors.append({"field": field, "message": err["msg"], "type": err["type"]})
+        errors.append({"field": field, "message": "该字段格式不正确", "type": err["type"]})
     
     return JSONResponse(
         status_code=422,
@@ -150,8 +169,7 @@ async def validation_exception_handler(request, exc):
 async def global_exception_handler(request, exc):
     """🚀 P3优化：全局异常处理，捕获所有未预期异常"""
     error_id = f"ERR_{int(time.time())}_{id(exc) % 10000}"
-    logger.error(f"Unhandled Exception [{error_id}] | {request.url.path} | {type(exc).__name__}: {exc}")
-    logger.error(traceback.format_exc())
+    logger.error(f"Unhandled Exception [{error_id}] | {request.url.path} | error_type={type(exc).__name__}")
     return JSONResponse(
         status_code=500,
         content=create_error_response(
@@ -187,7 +205,8 @@ def detailed_health_check():
             health_status["components"]["sql_database"] = "error: connection failed"
             health_status["status"] = "degraded"
     except Exception as e:
-        health_status["components"]["sql_database"] = f"error: {str(e)}"
+        logger.warning(f"健康检查 SQL 数据库异常: error_type={type(e).__name__}")
+        health_status["components"]["sql_database"] = "error: connection failed"
         health_status["status"] = "degraded"
     
     # 检查 JSON 文件访问
@@ -196,7 +215,8 @@ def detailed_health_check():
         json_db.load_data("users.json", default_data={})
         health_status["components"]["json_storage"] = "ok"
     except Exception as e:
-        health_status["components"]["json_storage"] = f"error: {str(e)}"
+        logger.warning(f"健康检查 JSON 存储异常: error_type={type(e).__name__}")
+        health_status["components"]["json_storage"] = "error: storage unavailable"
         health_status["status"] = "degraded"
     
     return health_status
@@ -214,7 +234,7 @@ async def on_startup():
         init_sql_db()
         logger.info("✅ SQL 数据库初始化完成")
     except Exception as e:
-        logger.error(f"❌ SQL 数据库初始化失败: {e}")
+        logger.error(f"❌ SQL 数据库初始化失败: error_type={type(e).__name__}")
         # 不抛出异常，允许降级运行
 
     # ========== 加载第三方插件注册表（依赖 SQL 数据库） ==========
@@ -223,7 +243,7 @@ async def on_startup():
         load_plugins_from_db()
         logger.info("✅ 第三方插件注册表已加载")
     except Exception as e:
-        logger.warning(f"⚠️ 第三方插件注册表加载失败: {e}")
+        logger.warning(f"⚠️ 第三方插件注册表加载失败: error_type={type(e).__name__}")
     
     # ========== 预热检查：JSON 数据库 ==========
     try:
@@ -231,8 +251,26 @@ async def on_startup():
         db.load_data("items.json", default_data=[])
         logger.info("✅ JSON 数据库访问正常")
     except Exception as e:
-        logger.warning(f"⚠️ JSON 数据库访问异常: {e}")
+        logger.warning(f"⚠️ JSON 数据库访问异常: error_type={type(e).__name__}")
     
+    # SQL资金已冻结但JSON发布失败的任务，重启后继续投影；持有句柄供停机收尾。
+    from task_publication import publication_worker
+    from database_sql import engine
+    from db_utils import sort_cache
+    app.state.task_publication_stop = asyncio.Event()
+    app.state.task_publication_worker = asyncio.create_task(publication_worker(
+        engine, db, sort_cache.invalidate, app.state.task_publication_stop))
+
+    from resource_publication import publication_worker as resource_publication_worker
+    app.state.resource_publication_stop = asyncio.Event()
+    app.state.resource_publication_worker = asyncio.create_task(resource_publication_worker(
+        engine, db, sort_cache.invalidate, app.state.resource_publication_stop))
+
+    from resource_deletion import resource_deletion_worker
+    app.state.resource_deletion_stop = asyncio.Event()
+    app.state.resource_deletion_worker = asyncio.create_task(resource_deletion_worker(
+        db, app.state.resource_deletion_stop, sort_cache.invalidate))
+
     # ========== 启动后台任务 ==========
     asyncio.create_task(daily_version_check_task())
     logger.info("✅ 定时版本检测任务已挂载")
@@ -242,7 +280,7 @@ async def on_startup():
     
     # ========== 启动 HF 批量同步定时器 ==========
     db.start_batch_sync()
-    logger.info("✅ HF 批量同步定时器已启动")
+    logger.info("✅ HF 同步调度初始化已完成")
     
     logger.info("🎉 ComfyUI-Ranking API 启动完成!")
 
@@ -252,9 +290,30 @@ async def on_shutdown():
     """优雅关闭，清理资源"""
     logger.info("🛑 ComfyUI-Ranking API 正在关闭...")
 
+    publication_stop = getattr(app.state, "task_publication_stop", None)
+    publication_task = getattr(app.state, "task_publication_worker", None)
+    if publication_stop is not None:
+        publication_stop.set()
+    if publication_task is not None:
+        await publication_task
+
+    resource_stop = getattr(app.state, "resource_publication_stop", None)
+    resource_task = getattr(app.state, "resource_publication_worker", None)
+    if resource_stop is not None:
+        resource_stop.set()
+    if resource_task is not None:
+        await resource_task
+
+    deletion_stop = getattr(app.state, "resource_deletion_stop", None)
+    deletion_task = getattr(app.state, "resource_deletion_worker", None)
+    if deletion_stop is not None:
+        deletion_stop.set()
+    if deletion_task is not None:
+        await deletion_task
+
     # ========== 关闭前同步所有脏文件 ==========
-    db.flush_sync()
-    logger.info("✅ HF 批量同步已完成")
+    await asyncio.to_thread(db.flush_sync)
+    logger.info("✅ HF 关闭前同步尝试已结束")
 
     # 这里可以添加其他清理逻辑（如关闭连接池等）
     logger.info("✅ 关闭完成")
@@ -264,7 +323,10 @@ async def on_shutdown():
 # 传递 Token 且 allow_credentials=False 不依赖 Cookie，通配风险可控）。
 # 如需收紧可在环境变量 ALLOWED_ORIGINS 中逗号分隔指定域名。
 ALLOWED_ORIGINS = os.environ.get("ALLOWED_ORIGINS", "*").split(",")
-logger.info(f"CORS 允许域名: {ALLOWED_ORIGINS}")
+logger.info(
+    f"CORS 配置已加载: origin_count={len(ALLOWED_ORIGINS)} | "
+    f"wildcard={len(ALLOWED_ORIGINS) == 1 and ALLOWED_ORIGINS[0] == '*'}"
+)
 
 app.add_middleware(
     CORSMiddleware,
@@ -272,6 +334,7 @@ app.add_middleware(
     allow_credentials=False, 
     allow_methods=["*"],
     allow_headers=["*"],
+    expose_headers=["ETag"],
 )
 
 # ==========================================
@@ -298,46 +361,12 @@ app.include_router(admin_plugins_router)  # 🔒 管理后台 - 第三方插件
 # 🟢 私有图床代理中心 (Image Proxy)
 # 解决 Private 仓库下，本地客户端报 401 Unauthorized 的终极方案
 # ==========================================
+from media_proxy_service import read_public_media
+
 @app.get("/api/image_proxy")
 def proxy_hf_image(url: str = None, path: str = None):
-    """云端图片代理：使用云端的 HF_TOKEN 提取私有图床图片并返回给没有任何权限的本地端"""
-    
-    # 兼容处理：如果本地发来的是已经被污染的老版本 HF 直链，我们自动将其转换为相对路径
-    if url and url.startswith("https://huggingface.co/datasets/"):
-        try:
-            path = url.split("resolve/main/")[-1]
-            path = urllib.parse.unquote(path)
-        except Exception:
-            raise HTTPException(status_code=400, detail="无效的 HF 原链接格式")
-            
-    if not path:
-        raise HTTPException(status_code=400, detail="缺少路径参数")
-    
-    # 🛡️ 路径穿越防护：禁止包含 .. 和绝对路径
-    if ".." in path or path.startswith("/"):
-        raise HTTPException(status_code=400, detail="非法路径")
-        
-    # 🛡️ 绝对的安全红线：限制只能代理下载图片目录，严禁黑客通过此接口下载 users.json 或账本数据！
-    allowed_dirs = ["uploads/", "avatars/", "covers/"]
-    if not any(path.startswith(d) for d in allowed_dirs):
-        raise HTTPException(status_code=403, detail="非法访问：该接口仅允许代理图片资源")
-        
-    hf_token = os.environ.get("HF_TOKEN")
-    dataset_repo_id = db.DATASET_REPO_ID 
-    
-    try:
-        # hf_hub_download 会自动利用云端容器的缓存，只有第一次会去真实请求 Dataset
-        cached_file_path = hf_hub_download(
-            repo_id=dataset_repo_id,
-            repo_type="dataset",
-            filename=path,
-            token=hf_token
-        )
-        # 智能识别文件类型 (image/jpeg, image/png 等)
-        content_type, _ = mimetypes.guess_type(cached_file_path)
-        return FileResponse(cached_file_path, media_type=content_type or "application/octet-stream")
-    except Exception as e:
-        return JSONResponse(content={"error": f"代理获取图片失败: {str(e)}"}, status_code=404)
+    return read_public_media(url, path, store=db, download=hf_hub_download,
+                             file_response=FileResponse, error_response=create_error_response)
 
 # ==========================================
 # 上传接口 (将返回的 URL 替换为 Proxy 代理链接)
@@ -348,148 +377,18 @@ from image_moderation import moderate_image_sync, ModerationResult
 # ==========================================
 # 🎵 音频安全净化：重编码压缩，剥离元数据与隐藏附加信息
 # ==========================================
-AUDIO_TRANSCODE_ARGS = {
-    "mp3": ["-acodec", "libmp3lame", "-b:a", "192k"],
-    "wav": ["-acodec", "pcm_s16le", "-ar", "44100"],
-    "m4a": ["-acodec", "aac", "-b:a", "192k"],
-    "ogg": ["-acodec", "libvorbis", "-b:a", "192k"],
-}
-
-def sanitize_audio_content(content: bytes, ext: str) -> bytes:
-    """🔒 用 ffmpeg 重编码压缩音频并剥离元数据/隐藏附加信息；处理失败一律拒绝上传，保障平台安全"""
-    src_path = f"/tmp/audio_src_{uuid.uuid4().hex[:8]}.{ext}"
-    dst_path = f"/tmp/audio_dst_{uuid.uuid4().hex[:8]}.{ext}"
-    try:
-        with open(src_path, "wb") as f:
-            f.write(content)
-        cmd = ["ffmpeg", "-y", "-i", src_path, "-vn", "-map_metadata", "-1", "-fflags", "+bitexact"] \
-            + AUDIO_TRANSCODE_ARGS[ext] + [dst_path]
-        try:
-            result = subprocess.run(cmd, capture_output=True, timeout=120)
-        except subprocess.TimeoutExpired:
-            logger.error(f"AUDIO_SANITIZE_TIMEOUT | ext={ext}")
-            raise HTTPException(status_code=400, detail="音频处理超时，请上传更短的音频")
-        if result.returncode != 0:
-            logger.error(f"AUDIO_SANITIZE_FAIL | ext={ext} | {result.stderr[-500:]}")
-            raise HTTPException(status_code=400, detail="音频文件解析失败，请转换格式后重新上传")
-        with open(dst_path, "rb") as f:
-            sanitized = f.read()
-        if not sanitized:
-            raise HTTPException(status_code=400, detail="音频处理结果为空，请重新上传")
-        logger.info(f"AUDIO_SANITIZE_OK | ext={ext} | {len(content)} -> {len(sanitized)} bytes")
-        return sanitized
-    finally:
-        for p in (src_path, dst_path):
-            if os.path.exists(p):
-                os.remove(p)
-
+from upload_service import process_upload
 
 @app.post("/api/upload")
-@limiter.limit("30/minute")  # 🔒 安全限流：防止刷存储（单次发布最多 9 图 + 1 JSON，阈值留足余量）
+@shared_limit(30)
 def upload_file(request: Request, file: UploadFile = File(...), file_type: str = Form(...), current_user: str = Depends(require_auth)):
-    # 🟢 动态文件大小风控
-    # 🔒 安全修复：上限必须先算出来。原实现是先把整个文件 read() 进内存再判大小，
-    # 超大文件会直接吃满容器内存（可被用于打挂服务），现改为分块读取、超限立即中止。
-    max_size = 10 * 1024 * 1024  
-    if file_type == "avatar":
-        max_size = 2 * 1024 * 1024   
-    elif file_type == "cover":
-        # GIF 动图允许更大文件（前端不压缩，保留动画）
-        if file.filename and file.filename.lower().endswith('.gif'):
-            max_size = 50 * 1024 * 1024  # GIF: 50MB
-        else:
-            max_size = 5 * 1024 * 1024   # 其他图片: 5MB
-    elif file_type == "banner":
-        # 广告横幅图片：支持GIF动图
-        if file.filename and file.filename.lower().endswith('.gif'):
-            max_size = 50 * 1024 * 1024  # GIF: 50MB
-        else:
-            max_size = 10 * 1024 * 1024  # 其他图片: 10MB
-    elif file_type == "post_video":
-        max_size = 100 * 1024 * 1024
-    elif file_type == "post_audio":
-        max_size = 30 * 1024 * 1024   # 音乐提示词音频：30MB
-
-    # 分块读取（1MB / 块），累计超限则马上报错，不再继续消耗内存与带宽
-    _CHUNK_SIZE = 1024 * 1024
-    _chunks = []
-    _received = 0
-    while True:
-        _chunk = file.file.read(_CHUNK_SIZE)
-        if not _chunk:
-            break
-        _received += len(_chunk)
-        if _received > max_size:
-            raise HTTPException(status_code=400, detail=f"文件过大，{file_type} 类型请限制在 {max_size // (1024*1024)}MB 以内")
-        _chunks.append(_chunk)
-    content = b"".join(_chunks)
-        
-    if not file.filename:
-        raise HTTPException(status_code=400, detail="文件名不能为空")
-    ext = file.filename.split(".")[-1].lower()
-    allowed_exts = ["jpg", "jpeg", "png", "gif", "webp", "json", "mp4"]
-    if file_type == "post_video":
-        allowed_exts = ["mp4", "webm", "mov"]
-    elif file_type == "post_audio":
-        allowed_exts = ["mp3", "wav", "m4a", "ogg"]
-    if ext not in allowed_exts:
-        raise HTTPException(status_code=400, detail=f"不支持的文件格式，{file_type} 类型仅支持 {', '.join(allowed_exts)}")
-
-    # 🔒 音频安全净化：重编码压缩，剥离可能附带的元数据与隐藏附加信息
-    if file_type == "post_audio":
-        content = sanitize_audio_content(content, ext)
-        if len(content) > max_size:
-            raise HTTPException(status_code=400, detail=f"音频处理后仍超过 {max_size // (1024*1024)}MB 限制，请上传更短的音频")
-    
-    # 📝 审计日志：记录上传操作
-    logger.info(f"UPLOAD | account={current_user} | filename={file.filename} | file_type={file_type}")
-    
-    # 🔒 P0安全优化：图片内容审核
-    if ext in ["jpg", "jpeg", "png", "gif", "webp"]:
-        moderation_result = moderate_image_sync(content, ext)
-        if not moderation_result.passed:
-            raise HTTPException(
-                status_code=400, 
-                detail=f"图片内容审核未通过：{moderation_result.label or '内容不合规'}"
-            )
-        
-    if file_type in ("post_video", "post_audio"):
-        safe_filename = f"{file_type}_{uuid.uuid4().hex[:8]}.{ext}"
-    else:
-        file_hash = hashlib.md5(content).hexdigest()[:10]
-        safe_filename = f"{file_type}_{file_hash}.{ext}"
-    
-    local_tmp_path = f"/tmp/{safe_filename}"
-    with open(local_tmp_path, "wb") as f:
-        f.write(content)
-        
-    hf_token = os.environ.get("HF_TOKEN")
-    dataset_repo_id = "ZHIWEI666/ComfyUI-Ranking"
-    
-    try:
-        api = HfApi()
-        api.upload_file(
-            path_or_fileobj=local_tmp_path,
-            path_in_repo=f"uploads/{file_type}/{safe_filename}",
-            repo_id=dataset_repo_id,
-            repo_type="dataset",
-            token=hf_token,
-            commit_message=f"Upload media: {safe_filename}"
-        )
-    except Exception as e:
-        raise HTTPException(status_code=500, detail=f"图床同步失败: {str(e)}")
-    finally:
-        if os.path.exists(local_tmp_path):
-            os.remove(local_tmp_path)
-            
-    # 🚀 核心修复：不再返回暴露隐私且报 401 的 HF 直链，而是返回我们刚写好的 Proxy 代理链接
-    if file_type == "post_video":
-        # 视频文件返回相对路径，由前端 proxyImages 统一处理
-        # 前端会将其转换为 /community_hub/video 本地视频代理（支持 Range 请求和流式传输）
-        permanent_url = f"uploads/{file_type}/{safe_filename}"
-    else:
-        permanent_url = f"https://zhiwei666-comfyui-ranking-api.hf.space/api/image_proxy?path=uploads/{file_type}/{safe_filename}"
-    return {"status": "success", "url": permanent_url}
+    return process_upload(file, file_type, current_user, store=db, storage_factory=HfApi,
+                          moderate=moderate_image_sync, limiter=_UPLOAD_SEMAPHORE,
+                          error_response=create_error_response)
+
+
+
+from github_source import select_github_token
 
 
 class ValidateResourceRequest(BaseModel):
@@ -497,75 +396,14 @@ class ValidateResourceRequest(BaseModel):
     item_id: str
     account: str
 
-@app.post("/api/validate_resource")
-def validate_resource(req_data: ValidateResourceRequest, sql_db: Session = Depends(get_db)):
-    target_url = req_data.url
-    
-    # 允许的链接前缀：HuggingFace数据集、GitHub仓库、内部代理URL
-    ALLOWED_URL_PREFIXES = (
-        "https://huggingface.co/datasets/",
-        "https://github.com/",
-        "https://zhiwei666-comfyui-ranking-api.hf.space/api/image_proxy",
-    )
-    
-    if not any(target_url.startswith(prefix) for prefix in ALLOWED_URL_PREFIXES):
-        return JSONResponse(content={"error": "无效的下载链接"}, status_code=400)
-        
-    items_db = db.load_data("items.json", default_data=[])
-    item = next((i for i in items_db if i["id"] == req_data.item_id), None)
-    
-    if not item: return JSONResponse(content={"error": "资源不存在或已被删除"}, status_code=404)
-        
-    # 内部代理URL直接返回成功（文件已存在于服务器本地）
-    if target_url.startswith("https://zhiwei666-comfyui-ranking-api.hf.space/api/image_proxy"):
-        return {"status": "success", "message": "资源有效"}
-
-    hf_token = os.environ.get("HF_TOKEN")
-    if not hf_token: return JSONResponse(content={"error": "云端环境变量未配置 HF_TOKEN"}, status_code=401)
-        
-    try:
-        if target_url.startswith("https://github.com/"):
-            creator_token = item.get("github_token")
-            fallback_token = os.environ.get("GITHUB_PAT")
-            active_token = creator_token if creator_token else fallback_token
-            
-            headers = {"User-Agent": "ComfyUI-Ranking-SaaS"}
-            if active_token:
-                headers["Authorization"] = f"Bearer {active_token}"
-                
-            repo_parts = target_url.rstrip("/").split("/")
-            if len(repo_parts) < 2: return JSONResponse(content={"error": "无效的仓库地址格式"}, status_code=400)
-            owner, repo = repo_parts[-2], repo_parts[-1]
-            api_url = f"https://api.github.com/repos/{owner}/{repo}"
-            
-            req = urllib.request.Request(api_url, headers=headers)
-            with urllib.request.urlopen(req) as response:
-                if response.status != 200:
-                    return JSONResponse(content={"error": "资源仓库不可访问，可能已被作者删除或设为私有"}, status_code=404)
-            return {"status": "success", "message": "资源有效"}
-            
-        elif target_url.startswith("https://huggingface.co/datasets/"):
-            repo_path_encoded = target_url.split("resolve/main/")[-1]
-            repo_path = urllib.parse.unquote(repo_path_encoded)
-            
-            cached_file_path = hf_hub_download(
-                repo_id=db.DATASET_REPO_ID,
-                repo_type="dataset",
-                filename=repo_path,
-                token=hf_token
-            )
-            if not os.path.exists(cached_file_path):
-                return JSONResponse(content={"error": "云端文件不存在，可能已被作者删除"}, status_code=404)
-                
-            return {"status": "success", "message": "资源有效"}
-            
-    except urllib.error.HTTPError as e:
-        return JSONResponse(content={"error": f"资源探测失败，源站返回: {e.code}。请联系作者处理。"}, status_code=400)
-    except Exception as e:
-        return JSONResponse(content={"error": f"资源探测异常: {str(e)}"}, status_code=500)
-        
-    return {"status": "success"}
+from resource_probe_service import probe_resource
+from github_probe_transport import open_github_probe
 
+@app.post("/api/validate_resource")
+def validate_resource(req_data: ValidateResourceRequest, sql_db: Session = Depends(get_db), current_user: str = Depends(require_auth)):
+    return probe_resource(req_data.item_id, store=db, download=hf_hub_download,
+                          open_url=open_github_probe, token_selector=select_github_token,
+                          error_response=create_error_response)
 
 # ==========================================
 # 🔒 管理员：系统配置 API
@@ -592,7 +430,7 @@ def _load_system_config_from_db(db: Session) -> dict:
                 result[cfg.config_key] = cfg.config_value
         return result
     except Exception as e:
-        logger.warning(f"从数据库加载系统配置失败，降级到文件: {e}")
+        logger.warning(f"从数据库加载系统配置失败，降级到文件: error_type={type(e).__name__}")
         return _load_system_config_from_file()
 
 def _load_system_config_from_file() -> dict:
@@ -602,7 +440,7 @@ def _load_system_config_from_file() -> dict:
             with open(SYSTEM_CONFIG_FILE, "r") as f:
                 return json.load(f)
     except Exception as e:
-        logger.debug(f"加载系统配置文件失败: {e}")
+        logger.debug(f"加载系统配置文件失败: error_type={type(e).__name__}")
     return {}
 
 def _save_system_config_to_db(db: Session, config_key: str, value, updated_by: str = None):
@@ -618,7 +456,7 @@ def _save_system_config_to_db(db: Session, config_key: str, value, updated_by: s
         db.commit()
     except Exception as e:
         db.rollback()
-        logger.warning(f"保存系统配置到数据库失败，降级到文件: {e}")
+        logger.warning(f"保存系统配置到数据库失败，降级到文件: error_type={type(e).__name__}")
         # 降级：保存到文件
         config = _load_system_config_from_file()
         config[config_key] = value
@@ -626,7 +464,7 @@ def _save_system_config_to_db(db: Session, config_key: str, value, updated_by: s
             with open(SYSTEM_CONFIG_FILE, "w") as f:
                 json.dump(config, f, ensure_ascii=False)
         except Exception as fe:
-            logger.warning(f"降级保存系统配置文件也失败: {fe}")
+            logger.warning(f"降级保存系统配置文件也失败: error_type={type(fe).__name__}")
 
 # 兼容旧调用的包装函数
 def _load_system_config(db: Session = None) -> dict:

chat_store.py

@@ -0,0 +1,157 @@
+"""私信按真实参与者读取，所有消息修改使用锁内最新记录。"""
+import copy
+import logging
+import math
+import time
+import uuid
+
+from fastapi import HTTPException
+import 数据库连接 as db
+
+logger = logging.getLogger(__name__)
+HISTORY_TTL = 7 * 24 * 3600
+MAX_MESSAGE_LENGTH = 1000
+MESSAGE_FIELDS = frozenset({"id", "sender", "receiver", "content", "created_at", "is_read"})
+
+
+def _unavailable():
+    return HTTPException(status_code=503, detail="聊天数据暂不可用")
+
+
+def _timestamp(message):
+    value = message["created_at"]
+    return value / 1000 if value >= 1e12 else value
+
+
+def _validate(data):
+    if not isinstance(data, dict):
+        raise _unavailable()
+    for key, messages in data.items():
+        if not isinstance(key, str) or not isinstance(messages, list):
+            raise _unavailable()
+        for message in messages:
+            if not isinstance(message, dict):
+                raise _unavailable()
+            if any(not isinstance(message.get(field), str) or not message[field]
+                   for field in ("id", "sender", "receiver")):
+                raise _unavailable()
+            timestamp = message.get("created_at")
+            if not isinstance(message.get("content"), str) or type(timestamp) not in (int, float):
+                raise _unavailable()
+            try:
+                valid_timestamp = math.isfinite(timestamp) and timestamp >= 0
+            except (OverflowError, ValueError):
+                valid_timestamp = False
+            if not valid_timestamp or type(message.get("is_read", False)) is not bool:
+                raise _unavailable()
+    return data
+
+
+def _read(name):
+    try:
+        return db.load_data(name, default_data={}, skip_cache=True, strict=True)
+    except Exception as error:
+        logger.warning("聊天读取失败: %s", type(error).__name__)
+        raise _unavailable() from None
+
+
+def _mutate(updater):
+    try:
+        return db.atomic_update("chats.json", lambda data: updater(_validate(data)), default_data={})
+    except HTTPException:
+        raise
+    except Exception as error:
+        logger.warning("聊天写入失败: %s", type(error).__name__)
+        raise _unavailable() from None
+
+
+def _pair(message, account, target):
+    return ((message["sender"] == account and message["receiver"] == target)
+            or (message["sender"] == target and message["receiver"] == account))
+
+
+def _project(message):
+    result = copy.deepcopy({key: value for key, value in message.items() if key in MESSAGE_FIELDS})
+    result.setdefault("is_read", False)
+    return result
+
+
+def send_message(sender, receiver, content):
+    if not isinstance(receiver, str) or not receiver or not isinstance(content, str) or not content.strip() or len(content) > MAX_MESSAGE_LENGTH:
+        raise HTTPException(status_code=400, detail="私信内容或接收者不正确")
+    users = _read("users.json")
+    if not isinstance(users, dict):
+        raise _unavailable()
+    if receiver not in users:
+        raise HTTPException(status_code=404, detail="接收者不存在")
+    if not isinstance(users[receiver], dict) or users[receiver].get("account", receiver) != receiver:
+        raise _unavailable()
+    message = {"id": f"chat_{int(time.time())}_{uuid.uuid4().hex}", "sender": sender,
+               "receiver": receiver, "content": content, "created_at": int(time.time()), "is_read": False}
+    key = f"{min(sender, receiver)}_{max(sender, receiver)}"
+    _mutate(lambda data: data.setdefault(key, []).append(message))
+
+
+def chat_list(account):
+    data = _validate(_read("chats.json"))
+    users = _read("users.json")
+    if not isinstance(users, dict):
+        raise _unavailable()
+    conversations = {}
+    # 旧键的下划线编码可能相撞，账号子串也不能代表参与者。
+    for messages in data.values():
+        for message in messages:
+            if message["sender"] == account:
+                target = message["receiver"]
+            elif message["receiver"] == account:
+                target = message["sender"]
+            else:
+                continue
+            conversations.setdefault(target, []).append(message)
+    result = []
+    for target, messages in conversations.items():
+        user = users.get(target, {})
+        if not isinstance(user, dict):
+            raise _unavailable()
+        last = max(messages, key=_timestamp)
+        result.append({"account": target, "name": user.get("name", target), "avatar": user.get("avatarDataUrl", ""),
+                       "last_message": last["content"], "last_time": last["created_at"],
+                       "unread_count": sum(message["receiver"] == account and not message.get("is_read", False)
+                                           for message in messages)})
+    result.sort(key=lambda item: item["last_time"] / 1000 if item["last_time"] >= 1e12 else item["last_time"], reverse=True)
+    return result
+
+
+def chat_history(account, target):
+    now = time.time()
+    data = _validate(_read("chats.json"))
+
+    def expires(message):
+        return message.get("is_read", False) and now - _timestamp(message) >= HISTORY_TTL
+
+    def matching(message):
+        return _pair(message, account, target)
+
+    def needs_update(message):
+        return matching(message) and (expires(message) or (message["receiver"] == account and not message.get("is_read", False)))
+
+    def snapshot(data):
+        return sorted((_project(message) for messages in data.values() for message in messages
+                       if matching(message)), key=_timestamp)
+
+    if not any(needs_update(message) for messages in data.values() for message in messages):
+        return snapshot(data)
+
+    def update(data):
+        for key, messages in data.items():
+            kept = []
+            for message in messages:
+                if matching(message):
+                    if expires(message):
+                        continue
+                    if message["receiver"] == account:
+                        message["is_read"] = True
+                kept.append(message)
+            data[key] = kept
+        return snapshot(data)
+    return _mutate(update)

comment_store.py

@@ -0,0 +1,118 @@
+"""评论记录的锁内修改；路由负责认证、内容存在性及响应契约。"""
+import copy
+import logging
+from fastapi import HTTPException
+import 数据库连接 as db
+from resource_deletion import resource_mutation_lock, assert_comment_target_active
+from resource_store import ResourceStoreError
+
+
+def _item_comments(data, item_id):
+    if not isinstance(data, dict):
+        raise HTTPException(status_code=503, detail="评论数据暂不可用")
+    records = data.get(item_id, [])
+    if not isinstance(records, list):
+        raise HTTPException(status_code=503, detail="评论数据暂不可用")
+    return records
+
+
+def append_comment(item_id, record, parent_id=None, prepend=False):
+    def updater(data):
+        records = _item_comments(data, item_id)
+        if parent_id:
+            parent = next((entry for entry in records if isinstance(entry, dict)
+                           and entry.get("id") == parent_id), None)
+            if parent is None:
+                raise HTTPException(status_code=404, detail="找不到要回复的评论")
+            replies = parent.setdefault("replies", [])
+            if not isinstance(replies, list):
+                raise HTTPException(status_code=503, detail="评论数据暂不可用")
+            replies.append(copy.deepcopy(record))
+        elif prepend:
+            records.insert(0, copy.deepcopy(record))
+        else:
+            records.append(copy.deepcopy(record))
+        data[item_id] = records
+    try:
+        with resource_mutation_lock:
+            assert_comment_target_active(db, item_id)
+            db.atomic_update("comments.json", updater, default_data={})
+    except ResourceStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+
+
+def _find_comment(records, comment_id, depth=0):
+    if depth > 20 or not isinstance(records, list):
+        return None
+    for record in records:
+        if not isinstance(record, dict):
+            continue
+        if record.get("id") == comment_id:
+            return record
+        found = _find_comment(record.get("replies", []), comment_id, depth + 1)
+        if found is not None:
+            return found
+    return None
+
+
+def delete_comment(item_id, comment_id, account, can_moderate=False):
+    def updater(data):
+        target = _find_comment(_item_comments(data, item_id), comment_id)
+        if target is None:
+            raise HTTPException(status_code=404, detail="找不到该评论")
+        # 在同一锁内检查最新目标并执行软删除，不能使用先前读取的快照。
+        if target.get("author") != account and not can_moderate:
+            raise HTTPException(status_code=403, detail="无权删除此评论")
+        target["isDeleted"] = True
+        target["content"] = ""
+    db.atomic_update("comments.json", updater, default_data={})
+
+
+def increment_comment_count(file_name, item_id):
+    """派生计数独立更新；失败不能把已提交评论误报为失败或重放评论。"""
+    def updater(records):
+        for record in records:
+            if record.get("id") == item_id:
+                old_count = record.get("comments", 0)
+                record["comments"] = (old_count if type(old_count) is int and old_count >= 0 else 0) + 1
+                break
+    try:
+        db.atomic_update(file_name, updater, default_data=[])
+        return True
+    except Exception:
+        logging.getLogger(__name__).warning("评论已提交，派生计数暂未更新")
+        return False
+
+
+def _visible_count(records, depth=0):
+    if not isinstance(records, list) or depth > 20:
+        raise ValueError("Invalid comment thread")
+    count = 0
+    for record in records:
+        if not isinstance(record, dict) or not isinstance(record.get("id"), str) or not record["id"].strip():
+            raise ValueError("Invalid comment record")
+        deleted = record.get("isDeleted", False)
+        if type(deleted) is not bool:
+            raise ValueError("Invalid comment state")
+        if not deleted:
+            count += 1
+        count += _visible_count(record.get("replies", []), depth + 1)
+    return count
+
+
+def attach_comment_counts(records):
+    """只校对响应副本，以评论主记录恢复展示计数，不写内容或资金数据。"""
+    try:
+        snapshot = db.load_data("comments.json", default_data={}, skip_cache=True, strict=True)
+        if not isinstance(snapshot, dict):
+            raise ValueError("Invalid comment data")
+    except Exception:
+        logging.getLogger(__name__).warning("评论计数无法校对，保留已有计数")
+        return records
+    for record in records:
+        try:
+            count = _visible_count(snapshot.get(record["id"], []))
+        except (KeyError, TypeError, ValueError):
+            continue
+        record["comments"] = count
+    return records

database_sql.py

@@ -77,10 +77,10 @@ def db_retry(max_retries: int = 3, delay: float = 0.5):
                     last_error = e
                     if attempt < max_retries - 1:
                         wait_time = delay * (2 ** attempt)  # 指数退避
-                        logger.warning(f"DB 操作失败 (第{attempt+1}次):{e}, {wait_time}秒后重试")
+                        logger.warning(f"DB 操作失败 (第{attempt+1}次): error_type={type(e).__name__}, {wait_time}秒后重试")
                         time.sleep(wait_time)
                     else:
-                        logger.error(f"DB 操作失败 (重试{max_retries}次后放弃): {e}")
+                        logger.error(f"DB 操作失败 (重试{max_retries}次后放弃): error_type={type(e).__name__}")
             raise last_error
         return wrapper
     return decorator
@@ -99,10 +99,10 @@ def init_sql_db():
             return
         except Exception as e:
             if attempt < 2:
-                logger.warning(f"数据库初始化失败 (第{attempt+1}次): {e}")
+                logger.warning(f"数据库初始化失败 (第{attempt+1}次): error_type={type(e).__name__}")
                 time.sleep(2 ** attempt)
             else:
-                logger.error(f"数据库初始化失败 (已重试3次): {e}")
+                logger.error(f"数据库初始化失败 (已重试3次): error_type={type(e).__name__}")
                 raise
 
 
@@ -130,7 +130,7 @@ def _auto_migrate_p7_fields():
                             conn.execute(text("ALTER TABLE ownerships ADD COLUMN IF NOT EXISTS price_paid INTEGER DEFAULT 0"))
                         logger.info("迁移完成: 添加 ownerships.price_paid 字段")
                     except Exception as e:
-                        logger.debug(f"跳过 ownerships.price_paid (可能已存在): {e}")
+                        logger.debug(f"跳过 ownerships.price_paid (可能已存在): error_type={type(e).__name__}")
                 
                 if 'is_refunded' not in columns:
                     try:
@@ -140,7 +140,7 @@ def _auto_migrate_p7_fields():
                             conn.execute(text("ALTER TABLE ownerships ADD COLUMN IF NOT EXISTS is_refunded BOOLEAN DEFAULT FALSE"))
                         logger.info("迁移完成: 添加 ownerships.is_refunded 字段")
                     except Exception as e:
-                        logger.debug(f"跳过 ownerships.is_refunded (可能已存在): {e}")
+                        logger.debug(f"跳过 ownerships.is_refunded (可能已存在): error_type={type(e).__name__}")
                 
                 if 'refunded_at' not in columns:
                     try:
@@ -150,7 +150,7 @@ def _auto_migrate_p7_fields():
                             conn.execute(text("ALTER TABLE ownerships ADD COLUMN IF NOT EXISTS refunded_at TIMESTAMP"))
                         logger.info("迁移完成: 添加 ownerships.refunded_at 字段")
                     except Exception as e:
-                        logger.debug(f"跳过 ownerships.refunded_at (可能已存在): {e}")
+                        logger.debug(f"跳过 ownerships.refunded_at (可能已存在): error_type={type(e).__name__}")
                 
                 conn.commit()
         
@@ -167,7 +167,7 @@ def _auto_migrate_p7_fields():
                             conn.execute(text("ALTER TABLE wallets ADD COLUMN IF NOT EXISTS task_balance INTEGER DEFAULT 0"))
                         logger.info("[DB Migration] 添加列 wallets.task_balance")
                     except Exception as e:
-                        logger.debug(f"跳过 wallets.task_balance (可能已存在): {e}")
+                        logger.debug(f"跳过 wallets.task_balance (可能已存在): error_type={type(e).__name__}")
                 
                 conn.commit()
         
@@ -206,7 +206,7 @@ def _auto_migrate_p7_fields():
                                     conn.execute(text(f"ALTER TABLE transactions ADD COLUMN IF NOT EXISTS {col_name} {col_type}"))
                             logger.info(f"[DB Migration] 添加列 transactions.{col_name}")
                         except Exception as e:
-                            logger.debug(f"跳过 transactions.{col_name} (可能已存在): {e}")
+                            logger.debug(f"跳过 transactions.{col_name} (可能已存在): error_type={type(e).__name__}")
                 
                 conn.commit()
                 
@@ -235,7 +235,7 @@ def _auto_migrate_p7_fields():
             logger.info("✅ 已创建 registered_plugins 表")
 
     except Exception as e:
-        logger.warning(f"字段迁移跳过 (可能已存在): {e}")
+        logger.warning(f"字段迁移跳过 (可能已存在): error_type={type(e).__name__}")
 
 
 def get_db():
@@ -244,7 +244,7 @@ def get_db():
     try:
         yield db
     except (OperationalError, InterfaceError) as e:
-        logger.error(f"数据库连接错误: {e}")
+        logger.error(f"数据库连接错误: error_type={type(e).__name__}")
         db.rollback()
         raise
     finally:
@@ -262,5 +262,5 @@ def check_db_connection() -> bool:
         db.close()
         return True
     except Exception as e:
-        logger.error(f"数据库连接检查失败: {e}")
-        return False
+        logger.error(f"数据库连接检查失败: error_type={type(e).__name__}")
+        return False

db_utils.py

@@ -11,6 +11,7 @@
 # ==========================================
 
 from typing import Any, Dict, List, Optional, Callable, Union
+import copy
 import 数据库连接 as db
 
 
@@ -111,6 +112,34 @@ def count_by(file_name: str, **conditions) -> int:
 # ✏️ 更新工具函数
 # ==========================================
 
+class _Unchanged(Exception):
+    def __init__(self, result):
+        self.result = result
+
+
+def _mutate(file_name, callback):
+    def update(data):
+        if not isinstance(data, (dict, list)) or not all(isinstance(item, dict) for item in (data.values() if isinstance(data, dict) else data)):
+            raise ValueError('invalid mutable record source')
+        result = callback(data)
+        if result is False or (type(result) is int and result == 0):
+            raise _Unchanged(result)
+        return result
+    try:
+        return db.atomic_update(file_name, update, default_data=[])
+    except _Unchanged as unchanged:
+        return unchanged.result
+
+
+def _find_record(data, item_id, id_field):
+    if isinstance(data, dict):
+        return data.get(item_id)
+    matches = [item for item in data if item.get(id_field) == item_id]
+    if len(matches) > 1:
+        raise ValueError('ambiguous mutable record identity')
+    return matches[0] if matches else None
+
+
 def update_by_id(file_name: str, item_id: str, updates: Dict, id_field: str = "id") -> bool:
     """
     根据 ID 更新记录
@@ -127,22 +156,13 @@ def update_by_id(file_name: str, item_id: str, updates: Dict, id_field: str = "i
     示例：
         update_by_id("tasks.json", "task_123", {"status": "completed"})
     """
-    data = db.load_data(file_name, default_data=[])
-    
-    if isinstance(data, dict):
-        if item_id in data:
-            data[item_id].update(updates)
-            db.save_data(file_name, data)
-            return True
-        return False
-    
-    for item in data:
-        if item.get(id_field) == item_id:
-            item.update(updates)
-            db.save_data(file_name, data)
-            return True
-    
-    return False
+    saved_updates = copy.deepcopy(updates)
+    def update(data):
+        item = _find_record(data, item_id, id_field)
+        if item is None: return False
+        item.update(copy.deepcopy(saved_updates))
+        return True
+    return _mutate(file_name, update)
 
 
 def update_with_fn(file_name: str, item_id: str, update_fn: Callable[[Dict], None], id_field: str = "id") -> bool:
@@ -164,22 +184,12 @@ def update_with_fn(file_name: str, item_id: str, update_fn: Callable[[Dict], Non
         
         update_with_fn("items.json", "item_123", increment_views)
     """
-    data = db.load_data(file_name, default_data=[])
-    
-    if isinstance(data, dict):
-        if item_id in data:
-            update_fn(data[item_id])
-            db.save_data(file_name, data)
-            return True
-        return False
-    
-    for item in data:
-        if item.get(id_field) == item_id:
-            update_fn(item)
-            db.save_data(file_name, data)
-            return True
-    
-    return False
+    def update(data):
+        item = _find_record(data, item_id, id_field)
+        if item is None: return False
+        update_fn(item)
+        return True
+    return _mutate(file_name, update)
 
 
 # ==========================================
@@ -201,23 +211,19 @@ def insert(file_name: str, item: Dict, prepend: bool = True) -> bool:
     示例：
         insert("tasks.json", {"id": "task_123", "title": "新任务"})
     """
-    data = db.load_data(file_name, default_data=[])
-    
-    if isinstance(data, dict):
-        item_id = item.get("id") or item.get("account")
-        if item_id:
-            data[item_id] = item
-            db.save_data(file_name, data)
-            return True
-        return False
-    
-    if prepend:
-        data.insert(0, item)
-    else:
-        data.append(item)
-    
-    db.save_data(file_name, data)
-    return True
+    saved = copy.deepcopy(item)
+    if not isinstance(saved, dict): raise ValueError('invalid inserted record')
+    def append(data):
+        if isinstance(data, dict):
+            item_id = saved.get('id') or saved.get('account')
+            if not item_id: return False
+            data[item_id] = copy.deepcopy(saved)
+        elif prepend:
+            data.insert(0, copy.deepcopy(saved))
+        else:
+            data.append(copy.deepcopy(saved))
+        return True
+    return _mutate(file_name, append)
 
 
 def insert_if_not_exists(file_name: str, item: Dict, id_field: str = "id") -> bool:
@@ -232,15 +238,19 @@ def insert_if_not_exists(file_name: str, item: Dict, id_field: str = "id") -> bo
     返回：
         True 插入成功 / False 已存在
     """
-    item_id = item.get(id_field)
-    if not item_id:
-        return False
-    
-    existing = get_by_id(file_name, item_id, id_field)
-    if existing:
-        return False
-    
-    return insert(file_name, item)
+    saved = copy.deepcopy(item)
+    if not isinstance(saved, dict): raise ValueError('invalid inserted record')
+    item_id = saved.get(id_field)
+    if not item_id: return False
+    def append(data):
+        if isinstance(data, dict):
+            if item_id in data: return False
+            data[item_id] = copy.deepcopy(saved)
+        else:
+            if _find_record(data, item_id, id_field) is not None: return False
+            data.insert(0, copy.deepcopy(saved))
+        return True
+    return _mutate(file_name, append)
 
 
 # ==========================================
@@ -259,23 +269,7 @@ def delete_by_id(file_name: str, item_id: str, id_field: str = "id") -> bool:
     返回：
         True 删除成功 / False 记录不存在
     """
-    data = db.load_data(file_name, default_data=[])
-    
-    if isinstance(data, dict):
-        if item_id in data:
-            del data[item_id]
-            db.save_data(file_name, data)
-            return True
-        return False
-    
-    original_len = len(data)
-    data = [item for item in data if item.get(id_field) != item_id]
-    
-    if len(data) < original_len:
-        db.save_data(file_name, data)
-        return True
-    
-    return False
+    return bool(batch_delete(file_name, [item_id], id_field))
 
 
 def soft_delete_by_id(file_name: str, item_id: str, id_field: str = "id") -> bool:
@@ -575,25 +569,12 @@ def batch_update(file_name: str, item_ids: List[str], updates: Dict, id_field: s
     返回：
         更新的记录数量
     """
-    data = db.load_data(file_name, default_data=[])
-    updated_count = 0
-    
-    if isinstance(data, dict):
-        for item_id in item_ids:
-            if item_id in data:
-                data[item_id].update(updates)
-                updated_count += 1
-    else:
-        id_set = set(item_ids)
-        for item in data:
-            if item.get(id_field) in id_set:
-                item.update(updates)
-                updated_count += 1
-    
-    if updated_count > 0:
-        db.save_data(file_name, data)
-    
-    return updated_count
+    identities, saved_updates = set(item_ids), copy.deepcopy(updates)
+    def update(data):
+        selected = [item for key, item in data.items() if key in identities] if isinstance(data, dict) else [item for item in data if item.get(id_field) in identities]
+        for item in selected: item.update(copy.deepcopy(saved_updates))
+        return len(selected)
+    return _mutate(file_name, update)
 
 
 def batch_delete(file_name: str, item_ids: List[str], id_field: str = "id") -> int:
@@ -608,20 +589,13 @@ def batch_delete(file_name: str, item_ids: List[str], id_field: str = "id") -> i
     返回：
         删除的记录数量
     """
-    data = db.load_data(file_name, default_data=[])
-    original_count = len(data) if isinstance(data, list) else len(data)
-    
-    if isinstance(data, dict):
-        for item_id in item_ids:
-            data.pop(item_id, None)
-    else:
-        id_set = set(item_ids)
-        data = [item for item in data if item.get(id_field) not in id_set]
-    
-    new_count = len(data) if isinstance(data, list) else len(data)
-    deleted_count = original_count - new_count
-    
-    if deleted_count > 0:
-        db.save_data(file_name, data)
-    
-    return deleted_count
+    identities = set(item_ids)
+    def delete(data):
+        if isinstance(data, dict):
+            selected = [key for key in data if key in identities]
+            for key in selected: del data[key]
+            return len(selected)
+        old_count = len(data)
+        data[:] = [item for item in data if item.get(id_field) not in identities]
+        return old_count - len(data)
+    return _mutate(file_name, delete)

deployment_config.py

@@ -0,0 +1,49 @@
+"""可信部署地址配置；不依据请求 Host 或转发头构造持久链接。"""
+import ipaddress
+import os
+import re
+from urllib.parse import urlsplit, urlunsplit
+
+DEFAULT_PUBLIC_API_BASE_URL = "https://zhiwei666-comfyui-ranking-api.hf.space"
+PUBLIC_API_BASE_URL_ENV = "RANKING_PUBLIC_API_BASE_URL"
+_CONFIG_ERROR = "RANKING_PUBLIC_API_BASE_URL 配置无效：需要 HTTPS 服务基址，HTTP 仅允许本机回环地址"
+
+
+def public_api_base_url(environ=None):
+    """读取受运维控制的基址；缺失兼容默认，显式错误拒绝初始化。"""
+    environ = os.environ if environ is None else environ
+    value = environ.get(PUBLIC_API_BASE_URL_ENV, DEFAULT_PUBLIC_API_BASE_URL)
+    if (not isinstance(value, str) or not value or len(value) > 2048
+            or any(ord(char) <= 32 or ord(char) >= 127 for char in value)
+            or "\\" in value):
+        raise RuntimeError(_CONFIG_ERROR)
+    try:
+        parsed = urlsplit(value)
+        host = parsed.hostname
+        port = parsed.port
+        if (parsed.scheme not in {"http", "https"} or not host
+                or parsed.username is not None or parsed.password is not None
+                or "?" in value or "#" in value
+                or (port is not None and not 1 <= port <= 65535)
+                or parsed.netloc.endswith(":")):
+            raise ValueError()
+        try:
+            address = ipaddress.ip_address(host)
+        except ValueError:
+            address = None
+            if (len(host) > 253 or not all(re.fullmatch(r"[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?", label)
+                    for label in host.split(".")) or re.fullmatch(r"[0-9.]+", host)):
+                raise ValueError()
+        if parsed.scheme == "http" and not (host == "localhost" or address and address.is_loopback):
+            raise ValueError()
+        path = parsed.path.rstrip("/")
+        if (path and (not path.startswith("/") or "//" in path
+                or not re.fullmatch(r"/[A-Za-z0-9._~/-]+", path)
+                or any(segment in {".", ".."} for segment in path.split("/")))):
+            raise ValueError()
+        return urlunsplit((parsed.scheme, parsed.netloc.lower(), path, "", ""))
+    except ValueError:
+        raise RuntimeError(_CONFIG_ERROR) from None
+
+
+PUBLIC_API_BASE_URL = public_api_base_url()

github_archive.py

@@ -0,0 +1,103 @@
+"""固定Git commit归档与缓存来源证明；不把旧缓存当作已核实安装包。"""
+import datetime
+import hashlib
+import json
+import re
+from github_source import canonical_repository
+
+ARCHIVE_SCHEMA = 3
+ARCHIVE_MAX_BYTES = 500 * 1024 * 1024
+
+
+def archive_repository(value):
+    """仅接收明确的owner/name标识，不能用元数据构造额外URL路径。"""
+    if (not isinstance(value, str) or len(value) > 193
+            or not re.fullmatch(r'[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,94}[A-Za-z0-9])?/[A-Za-z0-9](?:[A-Za-z0-9_.-]{0,94}[A-Za-z0-9])?', value)
+            or '..' in value or '--' in value):
+        raise ValueError('invalid archive storage identity')
+    return value
+
+
+def commit_sha(value):
+    if not isinstance(value, str) or not re.fullmatch(r'[0-9a-fA-F]{40}', value):
+        raise ValueError('invalid commit identity')
+    return value.lower()
+
+
+def commit_ref(value):
+    if not isinstance(value, str) or not re.fullmatch(r'(?:[0-9a-fA-F]{7}|[0-9a-fA-F]{40})', value):
+        raise ValueError('invalid commit reference')
+    return value.lower()
+
+
+def source_signature(item, token):
+    author = item.get('author')
+    if not isinstance(author, str) or not author.strip():
+        raise ValueError('invalid archive author')
+    source = [canonical_repository(item.get('link')).lower(), author, token or '']
+    # 元数据只保存摘要，不保存或输出凭据。
+    return hashlib.sha256(json.dumps(source, ensure_ascii=True, separators=(',', ':')).encode()).hexdigest()
+
+
+def archive_path(item_id, sha, signature):
+    if not isinstance(item_id, str) or not re.fullmatch(r'[A-Za-z0-9_-]{1,100}', item_id):
+        raise ValueError('invalid archive item')
+    if not isinstance(signature, str) or not re.fullmatch(r'[0-9a-f]{64}', signature):
+        raise ValueError('invalid archive source')
+    return f'zips/{item_id}_{commit_sha(sha)}_{signature[:16]}.zip'
+
+
+def cached_archive(item, token, entry, *, repo_id, now=None):
+    """只有完整来源、commit、HF不可变提交及未过期元数据才允许命中。"""
+    try:
+        if not isinstance(entry, dict) or type(entry.get('archive_schema')) is not int or entry['archive_schema'] != ARCHIVE_SCHEMA:
+            return None
+        repository = archive_repository(repo_id)
+        if entry.get('archive_repo_id') != repository:
+            return None
+        if entry.get('archive_storage_private') is not True:
+            return None
+        sha = commit_sha(entry.get('archive_commit'))
+        if entry.get('version_commit') not in (None, sha):
+            return None
+        if entry.get('hash') != sha[:7]:
+            return None
+        signature = source_signature(item, token)
+        if entry.get('archive_source') != signature:
+            return None
+        path = archive_path(item.get('id'), sha, signature)
+        if entry.get('archive_path') != path:
+            return None
+        hf_commit = commit_sha(entry.get('archive_hf_commit'))
+        size = entry.get('zip_size')
+        if type(size) is not int or not 0 < size <= ARCHIVE_MAX_BYTES:
+            return None
+        cached_at = datetime.datetime.fromisoformat(entry['cached_at'].replace('Z', '+00:00'))
+        if cached_at.tzinfo is None:
+            return None
+        elapsed = (now or datetime.datetime.now(datetime.timezone.utc)) - cached_at
+        if not datetime.timedelta(minutes=-5) <= elapsed <= datetime.timedelta(days=30):
+            return None
+        return dict(commit=sha, path=path, hf_commit=hf_commit, size=size, repo_id=repository)
+    except (ValueError, TypeError, KeyError, AttributeError):
+        return None
+
+
+def publish_archive_metadata(versions, item_id, expected_hash, metadata):
+    """锁内只更新目标缓存字段；晚到下载不能改变当前版本或其它资源。"""
+    if not isinstance(versions, dict):
+        raise ValueError('invalid version source')
+    entry = versions.get(item_id)
+    if isinstance(entry, str):
+        entry = {'hash': entry}
+    if not isinstance(entry, dict) or entry.get('hash') != commit_ref(expected_hash)[:7]:
+        return False
+    if (entry.get('version_commit') not in (None, metadata.get('archive_commit'))
+            or entry.get('version_source') not in (None, metadata.get('archive_source'))):
+        return False
+    keys = ('archive_schema', 'archive_commit', 'archive_source', 'archive_path',
+            'archive_hf_commit', 'archive_storage_private', 'archive_repo_id', 'zip_size', 'cached_at')
+    archive_repository(metadata['archive_repo_id'])
+    entry = {**entry, **{key: metadata[key] for key in keys}}
+    versions[item_id] = entry
+    return True

github_probe_transport.py

@@ -0,0 +1,89 @@
+"""GitHub元数据预检传输：凭据仅留在HTTPS API源，不跟随外部跳转。"""
+import re
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+from github_source import repository_parts
+
+MAX_PROBE_TIMEOUT = 10
+MAX_PROBE_REDIRECTS = 3
+
+
+def _metadata_target(url):
+    if (not isinstance(url, str) or len(url) > 2048
+            or any(ord(char) <= 32 or ord(char) >= 127 for char in url)
+            or "\\" in url or "?" in url or "#" in url):
+        raise ValueError("invalid GitHub metadata target")
+    parsed = urllib.parse.urlsplit(url)
+    if (parsed.scheme != "https" or parsed.hostname != "api.github.com"
+            or parsed.username is not None or parsed.password is not None
+            or parsed.port not in (None, 443) or parsed.netloc.endswith(":")):
+        raise ValueError("invalid GitHub metadata origin")
+    if parsed.path.startswith("/repos/"):
+        repository_parts("https://github.com/" + parsed.path[len("/repos/"):])
+    elif not re.fullmatch(r"/repositories/[0-9]{1,20}", parsed.path):
+        raise ValueError("invalid GitHub metadata path")
+    return url
+
+
+class GithubMetadataRedirect(urllib.request.HTTPRedirectHandler):
+    max_redirections = MAX_PROBE_REDIRECTS
+    max_repeats = 1
+
+    def __init__(self, deadline):
+        self.deadline = deadline
+
+    def redirect_request(self, req, fp, code, msg, headers, newurl):
+        try:
+            _metadata_target(req.full_url)
+            _metadata_target(newurl)
+        except ValueError:
+            raise urllib.error.HTTPError(req.full_url, code, "GitHub预检跳转不允许", {}, fp) from None
+        remaining = self.deadline - time.monotonic()
+        if remaining <= 0:
+            fp.close()
+            raise TimeoutError("GitHub metadata probe timed out")
+        # urllib的父处理器使用旧req.timeout传给下一跳；收紧到剩余预算。
+        req.timeout = min(getattr(req, "timeout", MAX_PROBE_TIMEOUT), remaining)
+        return super().redirect_request(req, fp, code, msg, headers, newurl)
+
+
+    def http_error_302(self, req, fp, code, msg, headers):
+        location = headers.get("location") or headers.get("uri")
+        if not isinstance(location, str) or not location or len(location) > 2048:
+            raise urllib.error.HTTPError(req.full_url, code, "GitHub预检跳转无效", {}, fp)
+        try:
+            target = urllib.parse.urljoin(req.full_url, location)
+        except ValueError:
+            raise urllib.error.HTTPError(req.full_url, code, "GitHub预检跳转无效", {}, fp) from None
+        new_request = self.redirect_request(req, fp, code, msg, headers, target)
+        count = getattr(req, "_ranking_probe_redirects", 0)
+        seen = getattr(req, "_ranking_probe_seen", {req.full_url})
+        if new_request is None or count >= MAX_PROBE_REDIRECTS or target in seen:
+            raise urllib.error.HTTPError(req.full_url, code, "GitHub预检跳转次数过多", {}, fp)
+        new_request._ranking_probe_redirects = count + 1
+        new_request._ranking_probe_seen = seen | {target}
+        # 只看元数据状态：关闭跳转正文，不使用urllib默认的无界fp.read()。
+        fp.close()
+        return self.parent.open(new_request, timeout=req.timeout)
+
+    http_error_301 = http_error_303 = http_error_307 = http_error_308 = http_error_302
+
+
+def open_github_probe(request, *, timeout=MAX_PROBE_TIMEOUT):
+    """创建本次请求专用opener，不修改全局；HTTP错误也关闭其响应。"""
+    _metadata_target(request.full_url)
+    if (request.get_method() != "GET" or isinstance(timeout, bool)
+            or not isinstance(timeout, (int, float)) or not 0 < timeout <= MAX_PROBE_TIMEOUT):
+        raise ValueError("invalid GitHub metadata request")
+    redirect = GithubMetadataRedirect(time.monotonic() + timeout)
+    opener = urllib.request.build_opener(redirect)
+    try:
+        return opener.open(request, timeout=timeout)
+    except urllib.error.HTTPError as error:
+        try:
+            error.close()
+        except Exception:
+            pass  # 清理失败不覆盖原HTTP错误，不输出响应或地址。
+        raise

github_source.py

@@ -0,0 +1,53 @@
+"""GitHub资源地址与凭据选择；普通发布者不能借用服务器全局PAT。"""
+import os
+import re
+from urllib.parse import urlsplit
+
+
+def repository_parts(url):
+    if not isinstance(url, str):
+        raise ValueError('invalid repository')
+    parsed = urlsplit(url.strip())
+    if (parsed.scheme != 'https' or parsed.hostname != 'github.com' or parsed.username or parsed.password
+            or parsed.port not in (None, 443) or parsed.query or parsed.fragment):
+        raise ValueError('invalid repository origin')
+    parts = parsed.path.strip('/').split('/')
+    if len(parts) != 2:
+        raise ValueError('invalid repository path')
+    owner, repo = parts
+    if repo.endswith('.git'):
+        repo = repo[:-4]
+    if (not re.fullmatch(r'[A-Za-z0-9](?:[A-Za-z0-9-]{0,37}[A-Za-z0-9])?', owner)
+            or not re.fullmatch(r'[A-Za-z0-9_.-]{1,100}', repo) or repo in {'.', '..'}):
+        raise ValueError('invalid repository identity')
+    return owner, repo
+
+
+def canonical_repository(url):
+    owner, repo = repository_parts(url)
+    return f'https://github.com/{owner}/{repo}'
+
+
+def _token(value):
+    if value is None or value == '':
+        return None
+    if not isinstance(value, str) or not re.fullmatch(r'[\x21-\x7e]+', value):
+        raise ValueError('invalid github credential')
+    return value
+
+
+def select_github_token(item, *, admin_check=None):
+    repository_parts(item.get('link'))
+    author = item.get('author')
+    if not isinstance(author, str) or not author.strip():
+        raise ValueError('invalid resource author')
+    creator = _token(item.get('github_token'))
+    if creator is not None:
+        return creator
+    if admin_check is None:
+        from 安全认证 import is_admin
+        admin_check = is_admin
+    # 权限来自服务端管理员配置与已保存作者，不信任请求账号或前端管理员标记。
+    if admin_check(author) is True:
+        return _token(os.environ.get('GITHUB_PAT'))
+    return None

github_versions.py

@@ -0,0 +1,89 @@
+"""每资源版本检测票据和局部发布；拒绝较早检测的迟到结果。"""
+import asyncio
+import uuid
+from github_archive import commit_sha, source_signature
+from github_source import select_github_token
+from proxy_access import read_proxy_item
+
+
+def _entry(versions, item_id):
+    if not isinstance(versions, dict):
+        raise ValueError('invalid version source')
+    entry = versions.get(item_id)
+    if entry is None:
+        return {}
+    if isinstance(entry, str):
+        return {'hash': entry}
+    if not isinstance(entry, dict):
+        raise ValueError('invalid version record')
+    return dict(entry)
+
+
+def _without_cache(entry):
+    return {key: value for key, value in entry.items()
+            if key not in ('cached_at', 'zip_size') and not key.startswith('archive_')}
+
+
+def begin_probe(store, item_id):
+    item = read_proxy_item(store, item_id)
+    token = select_github_token(item)
+    source = source_signature(item, token)
+    ticket = uuid.uuid4().hex
+    def update(versions):
+        entry = _entry(versions, item_id)
+        entry['_probe_ticket'] = ticket
+        entry['_probe_source'] = source
+        versions[item_id] = entry
+    store.atomic_update('versions.json', update, default_data={})
+    return dict(item=item, token=token, source=source, ticket=ticket)
+
+
+def finish_probe(store, operation, sha):
+    sha = commit_sha(sha)
+    item_id = operation['item']['id']
+    current = read_proxy_item(store, item_id)
+    if source_signature(current, select_github_token(current)) != operation['source']:
+        return None
+    def update(versions):
+        entry = _entry(versions, item_id)
+        if entry.get('_probe_ticket') != operation['ticket'] or entry.get('_probe_source') != operation['source']:
+            return None
+        changed = entry.get('hash') != sha[:7]
+        if (changed or entry.get('version_source') not in (None, operation['source'])
+                or entry.get('version_commit') not in (None, sha)
+                or entry.get('archive_commit') not in (None, sha)):
+            entry = _without_cache(entry)
+        entry.update(hash=sha[:7], version_commit=sha, version_source=operation['source'])
+        entry.pop('_probe_ticket', None); entry.pop('_probe_source', None)
+        versions[item_id] = entry
+        return dict(item=current, token=operation['token'], commit=sha, changed=changed)
+    return store.atomic_update('versions.json', update, default_data={})
+
+
+def invalidate_source(store, item_id):
+    """旧编辑回调也读取最新资源；已属于最新来源的确认记录保持。"""
+    current = read_proxy_item(store, item_id)
+    try:
+        source = source_signature(current, select_github_token(current))
+    except ValueError:
+        source = None
+    def update(versions):
+        entry = _entry(versions, item_id)
+        if source is not None and entry.get('version_source') == source:
+            return False
+        entry = _without_cache(entry)
+        for key in ('version_commit', '_probe_ticket', '_probe_source'):
+            entry.pop(key, None)
+        entry.update(hash='', version_source=source)
+        versions[item_id] = entry
+        return True
+    return store.atomic_update('versions.json', update, default_data={})
+
+
+async def refresh_resource_version(store, item_id):
+    from 云端_定时版本检测引擎 import fetch_github_commit
+    operation = await asyncio.to_thread(begin_probe, store, item_id)
+    sha = await fetch_github_commit(operation['item']['link'], operation['token'])
+    if not sha:
+        return None
+    return await asyncio.to_thread(finish_probe, store, operation, sha)

github_zip_service.py

@@ -0,0 +1,145 @@
+"""授权后的GitHub ZIP交付服务；认证/实时所有权仍由路由负责。"""
+import asyncio
+import os
+from github_archive import cached_archive
+from github_source import repository_parts
+from proxy_resources import ProxyResources
+from workflow_stream_response import OwnedProxyResponse
+from zip_stream import zip_response_length, stream_zip_bytes
+
+
+async def prepare_github_zip(item, item_id, *, store, token_selector, resolve_commit,
+                             send, client_factory, transport_factory, error_response,
+                             cache_max_bytes, direct_max_bytes):
+    # 按服务端资源解析仓库，普通作者只使用本人绑定凭据或匿名GitHub。
+    try:
+        repo_url = item.get("link", "")
+        owner, repo = repository_parts(repo_url)
+        active_token = token_selector(item)
+    except ValueError:
+        return error_response(content={"error": "资源仓库或凭据暂时无法核实"}, status_code=503)
+
+    # ===== ZIP 缓存优先机制（鉴权后、GitHub请求前） =====
+    cache_resources = None
+    cache_handed_off = False
+    try:
+        versions_db = store.load_data("versions.json", default_data={})
+        item_version = versions_db.get(item_id)
+        archive = cached_archive(item, active_token, item_version, repo_id=store.DATASET_REPO_ID)
+        hf_cache_token = os.environ.get("HF_TOKEN")
+        if archive and hf_cache_token:
+            hf_headers = {"Authorization": f"Bearer {hf_cache_token}"}
+            cache_filename = archive["path"]
+            cache_url = f"https://huggingface.co/datasets/{archive['repo_id']}/resolve/{archive['hf_commit']}/{cache_filename}"
+            cache_client = client_factory(
+                follow_redirects=False, trust_env=False, transport=transport_factory(),
+            )
+            cache_resources = ProxyResources(cache_client)
+            head_resp = cache_resources.track(await send(
+                cache_client, "HEAD", cache_url, headers=hf_headers, timeout=10))
+            if head_resp.status_code == 200:
+                await cache_resources.close_response(head_resp)
+                stream_resp = cache_resources.track(await send(
+                    cache_client, "GET", cache_url, headers=hf_headers, timeout=120))
+                if stream_resp.status_code == 200:
+                    # identity响应应与已上传归档大小一致；编码响应仍保持原始透传。
+                    encoding = (stream_resp.headers.get('content-encoding') or 'identity').strip().lower()
+                    expected_size = archive['size'] if encoding == 'identity' else None
+                    cache_length = zip_response_length(stream_resp.headers, max_bytes=cache_max_bytes,
+                                                       expected_size=expected_size)
+                    cache_headers = {}
+                    content_length = stream_resp.headers.get('content-length')
+                    if content_length:
+                        cache_headers["Content-Length"] = content_length
+                    content_encoding = stream_resp.headers.get('content-encoding')
+                    if content_encoding:
+                        cache_headers["Content-Encoding"] = content_encoding
+                    if item_version.get('hash'):
+                        cache_headers["X-Installed-Version"] = archive["commit"]
+
+                    async def cache_stream_generator():
+                        try:
+                            async for chunk in stream_zip_bytes(stream_resp, max_bytes=cache_max_bytes,
+                                                                length=cache_length, expected_size=expected_size):
+                                yield chunk
+                        except Exception as error:
+                            print(f"[ZIP缓存] 响应流中断: error={type(error).__name__}")
+                            raise
+                        finally:
+                            await cache_resources.close()
+
+                    prepared = OwnedProxyResponse(cache_stream_generator(), close_callback=cache_resources.close,
+                                                  media_type="application/zip", headers=cache_headers)
+                    cache_handed_off = True
+                    return prepared
+                print(f"[ZIP缓存] GET失败，回退GitHub: status={stream_resp.status_code}")
+    except asyncio.CancelledError:
+        raise
+    except Exception as error:
+        print(f"[ZIP缓存] 查询失败，回退GitHub: error={type(error).__name__}")
+    finally:
+        if cache_resources is not None and not cache_handed_off:
+            await cache_resources.close()
+
+    # 先取得完整commit，再按它下载；不在下载后另取“最新版本”冒充实际内容。
+    live_commit = await resolve_commit(repo_url, active_token)
+    if not live_commit:
+        return error_response(content={"error": "资源版本���时无法核实，请稍后重试"}, status_code=502)
+    github_zip_api = f"https://api.github.com/repos/{owner}/{repo}/zipball/{live_commit}"
+
+    headers = {
+        "Accept": "application/vnd.github.v3+json",
+        "User-Agent": "ComfyUI-Ranking-SaaS"
+    }
+    if active_token:
+        headers["Authorization"] = f"Bearer {active_token}"
+
+    # 异步请求固定GitHub commit，原始块保持长度与Content-Encoding契约。
+    client = client_factory(
+        follow_redirects=False, trust_env=False, transport=transport_factory(),
+    )
+    resources = ProxyResources(client)
+    handed_off = False
+    try:
+        try:
+            response = resources.track(await send(
+                client, "GET", github_zip_api, headers=headers, timeout=120))
+        except Exception as error:
+            print(f"[proxy_github_zip] 请求失败: error={type(error).__name__}")
+            return error_response(content={"error": "代理下载时发生网络异常，请稍后重试"}, status_code=502)
+        if response.status_code != 200:
+            status_map = {404: "仓库不存在或无权访问", 401: "Token 无效或已过期", 403: "访问被拒绝（可能触发速率限制）"}
+            err_msg = status_map.get(response.status_code, f"GitHub API 返回 HTTP {response.status_code}")
+            return error_response(content={"error": f"GITHUB_DOWNLOAD_FAILED: {err_msg}"}, status_code=502)
+        declared_length = zip_response_length(response.headers, max_bytes=direct_max_bytes)
+        resp_headers = {}
+        content_length = response.headers.get('content-length', '')
+        if content_length:
+            resp_headers["Content-Length"] = content_length
+        content_encoding = response.headers.get('content-encoding')
+        if content_encoding:
+            resp_headers["Content-Encoding"] = content_encoding
+        resp_headers["X-Installed-Version"] = live_commit
+
+        async def stream_generator():
+            try:
+                async for chunk in stream_zip_bytes(response, max_bytes=direct_max_bytes, length=declared_length):
+                    yield chunk
+            except Exception as error:
+                print(f"[proxy_github_zip] 响应流中断: error={type(error).__name__}")
+                raise
+            finally:
+                await resources.close()
+
+        prepared = OwnedProxyResponse(stream_generator(), close_callback=resources.close,
+                                      media_type="application/zip", headers=resp_headers)
+        handed_off = True
+        return prepared
+    except asyncio.CancelledError:
+        raise
+    except Exception as error:
+        print(f"[proxy_github_zip] 响应准备失败: error={type(error).__name__}")
+        return error_response(content={"error": "代理下载时发生网络异常，请稍后重试"}, status_code=502)
+    finally:
+        if not handed_off:
+            await resources.close()

hf_snapshot_store.py

@@ -0,0 +1,101 @@
+"""HF私有临时快照生命周期；创建/回收必须持同目录公共提交锁。"""
+from contextlib import contextmanager
+import json
+import logging
+import os
+from pathlib import Path
+import re
+import stat
+import uuid
+
+
+logger=logging.getLogger('ComfyUI-Ranking.DB')
+
+
+class SnapshotStore:
+    MANIFEST='snapshot-owner.json'
+    NAME=re.compile(r'\.hf-sync-[0-9a-f]{32}\Z')
+    PAYLOAD=re.compile(r'(0|[1-9][0-9]*)\.json\Z')
+
+    def __init__(self,directory):
+        self.root=Path(os.path.abspath(directory))
+
+    @staticmethod
+    def _check(path,directory=False):
+        info=os.lstat(path)
+        if (getattr(info,'st_file_attributes',0)&1024
+                or not (stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))
+                or not info.st_ino):
+            raise ValueError('invalid snapshot path')
+        return (info.st_dev,info.st_ino)
+
+    def _owner(self,path):
+        if path.parent!=self.root or not self.NAME.fullmatch(path.name):
+            raise ValueError('unknown snapshot directory')
+        self._check(self.root,directory=True)
+        directory_id=self._check(path,directory=True)
+        marker=path/self.MANIFEST
+        marker_id=self._check(marker)
+        descriptor=os.open(marker,os.O_RDONLY|getattr(os,'O_NOFOLLOW',0)
+            |getattr(os,'O_NONBLOCK',0)|getattr(os,'O_BINARY',0))
+        with os.fdopen(descriptor,'rb') as stream:
+            info=os.fstat(stream.fileno())
+            if not stat.S_ISREG(info.st_mode) or (info.st_dev,info.st_ino)!=marker_id:
+                raise ValueError('snapshot owner identity changed')
+            data=stream.read(4097)
+        if len(data)>4096:raise ValueError('snapshot owner too large')
+        owner=json.loads(data)
+        if (not isinstance(owner,dict) or set(owner)!={'schema','kind','directory'}
+                or type(owner['schema']) is not int or owner['schema']!=1
+                or owner['kind']!='ranking-hf-snapshot' or owner['directory']!=path.name):
+            raise ValueError('invalid snapshot owner')
+        if self._check(path,directory=True)!=directory_id or self._check(marker)!=marker_id:
+            raise ValueError('snapshot identity changed')
+        return directory_id
+
+    def remove(self,path):
+        """只删除验证归属且内容全为普通快照文件的本层目录，不递归删除。"""
+        path=Path(path)
+        directory_id=self._owner(path)
+        entries=[]
+        for entry in path.iterdir():
+            if len(entries)>=4096:raise ValueError('too many snapshot files')
+            if entry.name!=self.MANIFEST and not self.PAYLOAD.fullmatch(entry.name):
+                raise ValueError('unknown snapshot content')
+            self._check(entry)
+            entries.append(entry)
+        # 先完整校验，再删除数据，归属记录最后删除，失败可在后续接手。
+        for entry in sorted(entries,key=lambda entry:entry.name==self.MANIFEST):
+            self._check(self.root,directory=True)
+            if self._check(path,directory=True)!=directory_id:
+                raise ValueError('snapshot directory changed')
+            entry.unlink()
+        path.rmdir()
+
+    def cleanup_stale(self):
+        self._check(self.root,directory=True)
+        removed=retained=0
+        for path in self.root.glob('.hf-sync-*'):
+            try:self.remove(path);removed+=1
+            except FileNotFoundError:
+                if path.exists() or path.is_symlink():retained+=1
+            except (OSError,ValueError):retained+=1
+        return removed,retained
+
+    @contextmanager
+    def temporary(self):
+        self._check(self.root,directory=True)
+        path=self.root/('.hf-sync-'+uuid.uuid4().hex)
+        path.mkdir(mode=0o700)
+        try:
+            with (path/self.MANIFEST).open('xb') as stream:
+                data=json.dumps({'schema':1,'kind':'ranking-hf-snapshot','directory':path.name}).encode('utf-8')
+                stream.write(data);stream.flush();os.fsync(stream.fileno())
+            yield str(path)
+        finally:
+            try:self.remove(path)
+            except FileNotFoundError:
+                if path.exists() or path.is_symlink():
+                    logger.warning('HF snapshot cleanup unavailable; retained for recovery')
+            except (OSError,ValueError):
+                logger.warning('HF snapshot cleanup unavailable; retained for recovery')

hf_sync_journal.py

@@ -0,0 +1,97 @@
+"""同目录HF待同步写前记录；调用方持业务文件锁，提交方另持公共提交锁。"""
+import hashlib
+import json
+import os
+from pathlib import Path
+import stat
+import tempfile
+import uuid
+
+
+class SyncJournal:
+    def __init__(self,directory):
+        self.directory=Path(directory)/'.hf-pending'
+
+    @staticmethod
+    def validate_name(name):
+        if (not isinstance(name,str) or not name or name in {'.','..'}
+                or os.path.normcase(name)==os.path.normcase('__hf_dataset_sync__')
+                or any(char in name for char in '/\\:') or any(ord(char)<32 for char in name)):
+            raise ValueError('invalid sync file name')
+
+    def path(self,name):
+        self.validate_name(name)
+        key=hashlib.sha256(os.path.normcase(name).encode('utf-8')).hexdigest()
+        return self.directory/(key+'.json')
+
+    @staticmethod
+    def check_regular(path,directory=False):
+        info=os.lstat(path)
+        if (stat.S_ISLNK(info.st_mode) or getattr(info,'st_file_attributes',0)&1024
+                or not (stat.S_ISDIR(info.st_mode) if directory else stat.S_ISREG(info.st_mode))):
+            raise ValueError('invalid sync journal path')
+
+    def mark(self,name):
+        target=self.path(name)
+        self.directory.mkdir(exist_ok=True)
+        self.check_regular(self.directory,directory=True)
+        if target.exists() or target.is_symlink(): self.check_regular(target)
+        generation=uuid.uuid4().hex
+        data=json.dumps({'schema':1,'file':name,'generation':generation},ensure_ascii=False).encode('utf-8')
+        if len(data)>4096: raise ValueError('sync journal record too large')
+        descriptor,temporary=tempfile.mkstemp(prefix='.pending-',suffix='.tmp',dir=self.directory)
+        try:
+            with os.fdopen(descriptor,'wb') as stream:
+                stream.write(data); stream.flush(); os.fsync(stream.fileno())
+            os.replace(temporary,target)
+        finally:
+            try: os.unlink(temporary)
+            except FileNotFoundError: pass
+        return generation
+
+    def read_record(self,path):
+        self.check_regular(self.directory,directory=True)
+        self.check_regular(path)
+        descriptor=os.open(path,os.O_RDONLY|getattr(os,'O_NOFOLLOW',0))
+        with os.fdopen(descriptor,'rb') as stream:
+            if not stat.S_ISREG(os.fstat(stream.fileno()).st_mode): raise ValueError('invalid sync journal file')
+            content=stream.read(4097)
+        if len(content)>4096: raise ValueError('sync journal record too large')
+        data=json.loads(content)
+        if (not isinstance(data,dict) or set(data)!={'schema','file','generation'}
+                or type(data['schema']) is not int or data['schema']!=1):
+            raise ValueError('invalid sync journal schema')
+        self.validate_name(data['file'])
+        generation=data['generation']
+        if (not isinstance(generation,str) or len(generation)!=32
+                or any(char not in '0123456789abcdef' for char in generation)
+                or self.path(data['file'])!=path):
+            raise ValueError('invalid sync journal identity')
+        return data
+
+    def read(self,name):
+        try: return self.read_record(self.path(name))['generation']
+        except FileNotFoundError: return None
+
+    def pending(self,on_invalid=None):
+        """默认严格读取；同步方可隔离坏记录，目录本身故障仍整体拒绝。"""
+        if not self.directory.exists():
+            if self.directory.is_symlink(): raise ValueError('invalid sync journal directory')
+            return set()
+        self.check_regular(self.directory,directory=True)
+        names=set()
+        for path in self.directory.glob('*.json'):
+            try: names.add(self.read_record(path)['file'])
+            except FileNotFoundError: pass  # 其他提交方已确认该记录。
+            except (OSError,ValueError) as error:
+                if on_invalid is None: raise
+                on_invalid(error)
+        return names
+
+    def acknowledge(self,name,generation):
+        if (not isinstance(generation,str) or len(generation)!=32
+                or any(char not in '0123456789abcdef' for char in generation)):
+            return False
+        if self.read(name)!=generation: return False
+        os.unlink(self.path(name))
+        return True

hf_sync_scheduler.py

@@ -0,0 +1,109 @@
+"""单工作线程同步调度；持久待同步记录由调用方管理。"""
+import math
+import threading
+import time
+
+
+class SyncScheduler:
+    MAX_PENDING_NAMES = 128
+
+    def __init__(self, sync, interval, on_error, cooldown=None):
+        self._sync = sync
+        self._interval = interval
+        self._on_error = on_error
+        self._cooldown = cooldown or (lambda: 0)
+        self._condition = threading.Condition()
+        self._state = 'new'
+        self._thread = None
+        self._pending = set()
+        self._all_pending = False
+
+    def _delay(self):
+        delay = float(self._interval())
+        if not math.isfinite(delay) or delay <= 0:
+            raise ValueError('invalid sync interval')
+        return delay
+
+    def _start_locked(self, restart):
+        if self._state == 'running':
+            return False
+        if self._state == 'stopping' or (self._state == 'stopped' and not restart):
+            return False
+        self._delay()
+        self._state = 'running'
+        self._thread = threading.Thread(target=self._run, name='ranking-hf-sync', daemon=True)
+        try:
+            self._thread.start()
+        except Exception:
+            self._state = 'new'
+            self._thread = None
+            raise
+        return True
+
+    def start(self, restart=False):
+        with self._condition:
+            return self._start_locked(restart)
+
+    def request(self, file_name):
+        with self._condition:
+            if self._state in {'stopping', 'stopped'}:
+                return False
+            if not self._all_pending:
+                self._pending.add(file_name)
+                if len(self._pending) > self.MAX_PENDING_NAMES:
+                    self._pending.clear()
+                    self._all_pending = True
+            self._start_locked(False)
+            self._condition.notify_all()
+            return True
+
+    def close(self):
+        with self._condition:
+            thread = self._thread
+            if thread is threading.current_thread():
+                raise RuntimeError('sync worker cannot join itself')
+            self._state = 'stopping'
+            self._pending.clear()
+            self._all_pending = False
+            self._condition.notify_all()
+        if thread is not None:
+            thread.join()
+        with self._condition:
+            if self._thread is thread:
+                self._state = 'stopped'
+                self._thread = None
+
+    def _run(self):
+        try:
+            deadline = time.monotonic() + self._delay()
+            while True:
+                with self._condition:
+                    while self._state == 'running':
+                        periodic = time.monotonic() >= deadline
+                        if periodic or self._pending or self._all_pending:
+                            cooldown = float(self._cooldown())
+                            if not math.isfinite(cooldown) or cooldown < 0:
+                                raise ValueError('invalid sync cooldown')
+                            if cooldown > 0:
+                                # 远期服务端日期也不能超过平台锁等待上限。
+                                self._condition.wait(min(cooldown, 60))
+                                continue
+                            names = None if periodic or self._all_pending else sorted(self._pending)
+                            self._pending.clear()
+                            self._all_pending = False
+                            break
+                        self._condition.wait(min(60, max(0, deadline - time.monotonic())))
+                    else:
+                        return
+                try:
+                    self._sync(names)
+                except Exception as error:
+                    self._on_error(error)
+                # 即时请求不能无限推迟正常批量窗口。
+                if periodic:
+                    deadline = time.monotonic() + self._delay()
+        finally:
+            with self._condition:
+                if self._state == 'running':
+                    self._state = 'stopped'
+                self._condition.notify_all()

image_file_budget.py

@@ -0,0 +1,192 @@
+"""Bounded image container inspection; never decompress pixels or retain image payloads."""
+import os
+import time
+
+MAX_EDGE = 16_000
+MAX_PIXELS = 40_000_000
+MAX_FRAMES = 240
+MAX_ANIMATION_PIXELS = 400_000_000
+MAX_FILE_BYTES = 50 * 1024 * 1024
+MAX_STEPS = 500_000
+SCAN_SECONDS = 3
+JPEG_HEADER_BYTES = 256 * 1024
+
+class ImageBudgetError(ValueError):
+    pass
+
+def _bad():
+    raise ImageBudgetError('invalid or over-budget image container')
+
+def _budget(width, height, frames=1):
+    if not 0 < width <= MAX_EDGE or not 0 < height <= MAX_EDGE or width * height > MAX_PIXELS:
+        _bad()
+    if not 0 < frames <= MAX_FRAMES or width * height * frames > MAX_ANIMATION_PIXELS:
+        _bad()
+
+class _Reader:
+    def __init__(self, file):
+        self.file = file
+        self.size = os.fstat(file.fileno()).st_size
+        self.deadline = time.monotonic() + SCAN_SECONDS
+        self.steps = 0
+        if not 0 < self.size <= MAX_FILE_BYTES: _bad()
+    def check(self, length):
+        self.steps += 1
+        if self.steps > MAX_STEPS or time.monotonic() > self.deadline or length < 0 or self.file.tell() + length > self.size:
+            _bad()
+    def read(self, length):
+        self.check(length)
+        if length > 32: _bad()
+        result = self.file.read(length)
+        if len(result) != length: _bad()
+        return result
+    def skip(self, length):
+        self.check(length)
+        self.file.seek(length, 1)
+    def pos(self): return self.file.tell()
+
+def _png(r):
+    if r.read(8) != b'\x89PNG\r\n\x1a\n': _bad()
+    if r.read(8) != b'\x00\x00\x00\rIHDR': _bad()
+    header = r.read(13)
+    width, height = int.from_bytes(header[:4], 'big'), int.from_bytes(header[4:8], 'big')
+    _budget(width, height)
+    r.skip(4)
+    declared, frames, data, first_control_before_data = None, 0, False, False
+    while r.pos() < r.size:
+        head = r.read(8); length, kind = int.from_bytes(head[:4], 'big'), head[4:]
+        if kind == b'acTL':
+            if declared is not None or data or length != 8: _bad()
+            declared = int.from_bytes(r.read(8)[:4], 'big'); _budget(width, height, declared)
+        elif kind == b'fcTL':
+            if declared is None or length != 26: _bad()
+            control = r.read(26)
+            w, h, x, y = [int.from_bytes(control[n:n+4], 'big') for n in (4,8,12,16)]
+            if not w or not h or x + w > width or y + h > height: _bad()
+            if frames == 0: first_control_before_data = not data
+            frames += 1; _budget(width, height, frames)
+        elif kind == b'IDAT':
+            data = True; r.skip(length)
+        elif kind == b'IEND':
+            if length != 0 or not data or (declared is not None and frames != declared): _bad()
+            r.skip(4)
+            if r.pos() != r.size: _bad()
+            total = frames + (0 if first_control_before_data else 1) if declared is not None else 1
+            _budget(width, height, total)
+            return width, height, total
+        else:
+            r.skip(length)
+        r.skip(4)
+    _bad()
+
+def _gif(r):
+    if r.read(6) not in (b'GIF87a', b'GIF89a'): _bad()
+    head = r.read(7); width, height = int.from_bytes(head[:2],'little'), int.from_bytes(head[2:4],'little')
+    _budget(width,height)
+    if head[4] & 128: r.skip(3 * (1 << ((head[4] & 7) + 1)))
+    def blocks():
+        while True:
+            size = r.read(1)[0]
+            if not size: return
+            r.skip(size)
+    frames = 0
+    while r.pos() < r.size:
+        kind = r.read(1)[0]
+        if kind == 0x21:
+            r.read(1); blocks()
+        elif kind == 0x2c:
+            image = r.read(9)
+            x,y,w,h = [int.from_bytes(image[n:n+2],'little') for n in (0,2,4,6)]
+            if not w or not h or x+w > width or y+h > height: _bad()
+            frames += 1; _budget(width,height,frames)
+            if image[8] & 128: r.skip(3 * (1 << ((image[8] & 7) + 1)))
+            if not 2 <= r.read(1)[0] <= 8: _bad()
+            blocks()
+        elif kind == 0x3b:
+            if not frames or r.pos() != r.size: _bad()
+            return width,height,frames
+        else: _bad()
+    _bad()
+
+def _jpeg(r):
+    if r.read(2) != b'\xff\xd8': _bad()
+    while r.pos() < min(r.size, JPEG_HEADER_BYTES):
+        if r.read(1) != b'\xff': _bad()
+        marker = r.read(1)[0]
+        while marker == 0xff: marker = r.read(1)[0]
+        if marker in (0,0xd8,0xd9,0xda) or 0xd0 <= marker <= 0xd7: _bad()
+        length = int.from_bytes(r.read(2),'big')
+        if length < 2 or r.pos() + length - 2 > min(r.size, JPEG_HEADER_BYTES): _bad()
+        if 0xc0 <= marker <= 0xcf and marker not in (0xc4,0xc8,0xcc):
+            if length < 8: _bad()
+            head = r.read(6); height, width = int.from_bytes(head[1:3],'big'), int.from_bytes(head[3:5],'big')
+            _budget(width,height)
+            return width,height,1
+        r.skip(length-2)
+    _bad()
+
+def _webp(r):
+    head = r.read(12)
+    if head[:4] != b'RIFF' or head[8:] != b'WEBP' or int.from_bytes(head[4:8],'little')+8 != r.size: _bad()
+    canvas, frames, animated, animation_header, static = None, 0, False, False, False
+    def codec(kind,length):
+        if kind == b'VP8 ':
+            if length < 10: _bad()
+            h = r.read(10)
+            if h[3:6] != b'\x9d\x01\x2a' or h[0] & 1: _bad()
+            result = int.from_bytes(h[6:8],'little') & 0x3fff, int.from_bytes(h[8:10],'little') & 0x3fff
+            r.skip(length-10)
+        elif kind == b'VP8L':
+            if length < 5: _bad()
+            h = r.read(5)
+            if h[0] != 0x2f: _bad()
+            bits = int.from_bytes(h[1:],'little')
+            if bits >> 29: _bad()
+            result = (bits & 0x3fff)+1, ((bits >> 14) & 0x3fff)+1
+            r.skip(length-5)
+        else: _bad()
+        _budget(*result)
+        return result
+    while r.pos() < r.size:
+        head = r.read(8); kind, length = head[:4], int.from_bytes(head[4:],'little')
+        r.check(length+(length & 1)); end = r.pos()+length
+        if kind == b'VP8X':
+            if canvas is not None or length != 10: _bad()
+            h=r.read(10); canvas=(int.from_bytes(h[4:7],'little')+1,int.from_bytes(h[7:10],'little')+1)
+            _budget(*canvas); animated=bool(h[0] & 2)
+        elif kind == b'ANIM':
+            if not animated or length != 6 or animation_header: _bad()
+            animation_header=True; r.skip(length)
+        elif kind == b'ANMF':
+            if not animated or not animation_header or canvas is None or length < 16: _bad()
+            h=r.read(16); x,y=int.from_bytes(h[:3],'little')*2,int.from_bytes(h[3:6],'little')*2
+            w,hh=int.from_bytes(h[6:9],'little')+1,int.from_bytes(h[9:12],'little')+1
+            if x+w > canvas[0] or y+hh > canvas[1]: _bad()
+            frames+=1; _budget(*canvas,frames)
+            found=False
+            while r.pos()<end:
+                chunk=r.read(8); sub,size=chunk[:4],int.from_bytes(chunk[4:],'little')
+                if r.pos()+size+(size & 1)>end: _bad()
+                if sub in (b'VP8 ',b'VP8L'):
+                    if found or codec(sub,size)!=(w,hh): _bad()
+                    found=True
+                else: r.skip(size)
+                if size & 1: r.skip(1)
+            if not found: _bad()
+        elif kind in (b'VP8 ',b'VP8L'):
+            if animated or static: _bad()
+            size=codec(kind,length)
+            if canvas is not None and size!=canvas: _bad()
+            canvas=size;static=True
+        else: r.skip(length)
+        if r.pos()!=end: _bad()
+        if length & 1: r.skip(1)
+    if canvas is None or (animated and not frames) or (not animated and not static): _bad()
+    return canvas[0], canvas[1], frames if animated else 1
+
+def inspect_image_file(path, ext):
+    parser={'png':_png,'gif':_gif,'jpg':_jpeg,'jpeg':_jpeg,'webp':_webp}.get(ext)
+    if parser is None: _bad()
+    with open(path,'rb') as file:
+        width,height,frames=parser(_Reader(file))
+    return {'width':width,'height':height,'frames':frames}

image_moderation.py

@@ -58,7 +58,7 @@ def _load_quota() -> dict:
                     return {"month": current_month, "aliyun": 0, "tencent": 0}
                 return data
     except Exception as e:
-        logger.debug(f"加载额度记录失败: {e}")
+        logger.debug(f"加载额度记录失败: error_type={type(e).__name__}")
     return {"month": current_month, "aliyun": 0, "tencent": 0}
 
 def _save_quota(quota: dict):
@@ -67,7 +67,7 @@ def _save_quota(quota: dict):
         with open(QUOTA_FILE, "w") as f:
             json.dump(quota, f)
     except Exception as e:
-        logger.warning(f"保存额度记录失败: {e}")
+        logger.warning(f"保存额度记录失败: error_type={type(e).__name__}")
 
 def _increment_quota(provider: str):
     """增加使用次数"""
@@ -196,31 +196,39 @@ async def moderate_image_tencent(image_content: bytes) -> ModerationResult:
             result = resp.json()
         
         response = result.get("Response", {})
+        if not isinstance(response, dict) or not response:
+            logger.error("IMAGE_MODERATION_API_FAIL | provider=tencent | category=empty_result")
+            return ModerationResult(passed=False, suggestion="review",
+                                   details={"error": "审核服务暂时不可用，需人工审核"})
         
         if "Error" in response:
-            logger.error(f"腾讯云审核API错误: {response.get('Error', 'unknown')!r}")
-            return ModerationResult(passed=True, suggestion="pass", 
-                                   details={"error": response["Error"]})
+            logger.error("IMAGE_MODERATION_API_FAIL | provider=tencent | category=provider_error")
+            return ModerationResult(passed=False, suggestion="review",
+                                   details={"error": "审核服务暂时不可用，需人工审核"})
         
         # 解析审核结果
-        suggestion = response.get("Suggestion", "Pass").lower()
+        suggestion = str(response.get("Suggestion", "")).lower()
+        if suggestion not in {"pass", "review", "block"}:
+            logger.error("IMAGE_MODERATION_API_FAIL | provider=tencent | category=invalid_result")
+            return ModerationResult(passed=False, suggestion="review",
+                                   details={"error": "审核服务暂时不可用，需人工审核"})
         label = response.get("Label", "")
         score = response.get("Score", 0)
         
         passed = suggestion == "pass"
         
-        logger.info(f"腾讯云审核结果: suggestion={suggestion}, label={label}, score={score}")
+        logger.info(f"IMAGE_MODERATION_RESULT | provider=tencent | suggestion={suggestion}")
         
         return ModerationResult(
             passed=passed,
             label=label,
             confidence=score,
             suggestion=suggestion,
-            details=response
+            details={"provider": "tencent"}
         )
         
     except Exception as e:
-        logger.error(f"腾讯云审核异常: {e!r}")
+        logger.error(f"IMAGE_MODERATION_FAIL | provider=tencent | error_type={type(e).__name__}")
         # 审核服务异常时拒绝，需要人工审核
         return ModerationResult(passed=False, suggestion="review",
                                details={"error": "审核服务暂时不可用，需人工审核"})
@@ -321,15 +329,21 @@ async def moderate_image_aliyun(image_content: bytes) -> ModerationResult:
         
         # 解析审核结果
         if result.get("code") != 200:
-            logger.error(f"阿里云审核API错误: {result}")
-            return ModerationResult(passed=True, suggestion="pass",
-                                   details={"error": result})
+            logger.error("IMAGE_MODERATION_API_FAIL | provider=aliyun | category=provider_error")
+            return ModerationResult(passed=False, suggestion="review",
+                                   details={"error": "审核服务暂时不可用，需人工审核"})
         
         data = result.get("data", [])
         if not data:
-            return ModerationResult(passed=True, suggestion="pass")
+            logger.error("IMAGE_MODERATION_API_FAIL | provider=aliyun | category=empty_result")
+            return ModerationResult(passed=False, suggestion="review",
+                                   details={"error": "审核服务暂时不可用，需人工审核"})
         
         task_result = data[0].get("results", [])
+        if not task_result:
+            logger.error("IMAGE_MODERATION_API_FAIL | provider=aliyun | category=empty_result")
+            return ModerationResult(passed=False, suggestion="review",
+                                   details={"error": "审核服务暂时不可用，需人工审核"})
         
         # 检查所有场景的审核结果
         max_rate = 0
@@ -338,7 +352,11 @@ async def moderate_image_aliyun(image_content: bytes) -> ModerationResult:
         
         for scene_result in task_result:
             scene = scene_result.get("scene", "")
-            suggestion = scene_result.get("suggestion", "pass")
+            suggestion = str(scene_result.get("suggestion", "")).lower()
+            if suggestion not in {"pass", "review", "block"}:
+                logger.error("IMAGE_MODERATION_API_FAIL | provider=aliyun | category=invalid_result")
+                return ModerationResult(passed=False, suggestion="review",
+                                       details={"error": "审核服务暂时不可用，需人工审核"})
             rate = scene_result.get("rate", 0)
             label = scene_result.get("label", "")
             
@@ -355,18 +373,18 @@ async def moderate_image_aliyun(image_content: bytes) -> ModerationResult:
         
         passed = overall_suggestion == "pass"
         
-        logger.info(f"阿里云审核结果: suggestion={overall_suggestion}, label={block_label}, rate={max_rate}")
+        logger.info(f"IMAGE_MODERATION_RESULT | provider=aliyun | suggestion={overall_suggestion}")
         
         return ModerationResult(
             passed=passed,
             label=block_label,
             confidence=max_rate * 100,
             suggestion=overall_suggestion,
-            details=result
+            details={"provider": "aliyun"}
         )
         
     except Exception as e:
-        logger.error(f"阿里云审核异常: {str(e)}")
+        logger.error(f"阿里云审核异常: error_type={type(e).__name__}")
         # 审核服务异常时拒绝，需要人工审核
         return ModerationResult(passed=False, suggestion="review",
                                details={"error": "审核服务暂时不可用，需人工审核"})
@@ -397,7 +415,7 @@ def _is_moderation_enabled() -> bool:
         finally:
             db.close()
     except Exception as e:
-        logger.debug(f"从数据库读取审核配置失败，降级到文件: {e}")
+        logger.debug(f"从数据库读取审核配置失败，降级到文件: error_type={type(e).__name__}")
     
     # 2️⃣ 降级到文件
     try:
@@ -407,7 +425,7 @@ def _is_moderation_enabled() -> bool:
                 if "image_moderation_enabled" in config:
                     return config["image_moderation_enabled"] == True
     except Exception as e:
-        logger.debug(f"读取系统配置文件失败: {e}")
+        logger.debug(f"读取系统配置文件失败: error_type={type(e).__name__}")
     
     # 3️⃣ 回退到环境变量
     return MODERATION_ENABLED

json_file_lock.py

@@ -0,0 +1,68 @@
+"""同一数据目录内的稳定协调锁，不锁会被原子替换的JSON inode。"""
+import hashlib
+import os
+import sys
+import threading
+import time
+
+
+class DataFileLock:
+    def __init__(self, directory, file_name, timeout=30):
+        if (not isinstance(file_name, str) or not file_name or file_name in ('.', '..')
+                or any(char in file_name for char in '/\\:') or any(ord(char) < 32 for char in file_name)):
+            raise ValueError('invalid data file name')
+        self.directory = os.path.abspath(directory)
+        self.path = os.path.join(self.directory, '.locks', hashlib.sha256(os.path.normcase(file_name).encode()).hexdigest() + '.lock')
+        self.timeout = timeout
+        self.thread_lock = threading.Lock()
+        self.handle = None
+
+    def __enter__(self):
+        self.thread_lock.acquire()
+        handle = None
+        try:
+            os.makedirs(os.path.dirname(self.path), exist_ok=True)
+            handle = open(self.path, 'a+b')
+            # Windows允许锁定EOF之外的字节；不初始化写入，避免首次并发争用锁区。
+            deadline = time.monotonic() + self.timeout
+            while True:
+                try:
+                    if sys.platform == 'win32':
+                        import msvcrt
+                        handle.seek(0)
+                        msvcrt.locking(handle.fileno(), msvcrt.LK_NBLCK, 1)
+                    else:
+                        import fcntl
+                        fcntl.flock(handle.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+                    break
+                except OSError as error:
+                    import errno
+                    if error.errno not in (errno.EACCES, errno.EAGAIN, errno.EDEADLK):
+                        raise
+                    if time.monotonic() >= deadline:
+                        raise TimeoutError('data coordination lock timed out') from None
+                    time.sleep(.05)
+            self.handle = handle
+            return self
+        except BaseException:
+            if handle is not None:
+                handle.close()
+            self.thread_lock.release()
+            raise
+
+    def __exit__(self, exc_type, exc_value, traceback):
+        handle, self.handle = self.handle, None
+        try:
+            if sys.platform == 'win32':
+                import msvcrt
+                handle.seek(0)
+                msvcrt.locking(handle.fileno(), msvcrt.LK_UNLCK, 1)
+            else:
+                import fcntl
+                fcntl.flock(handle.fileno(), fcntl.LOCK_UN)
+        finally:
+            try:
+                handle.close()
+            finally:
+                self.thread_lock.release()
+        return False

media_proxy_service.py

@@ -0,0 +1,65 @@
+"""公开媒体读取服务；仅代理既有允许目录与扩展名，不处理工作流下载。"""
+import logging
+import mimetypes
+import os
+import time
+import urllib.parse
+import uuid
+from fastapi import HTTPException
+from fastapi.responses import JSONResponse
+
+logger = logging.getLogger("ComfyUI-Ranking")
+
+
+def read_public_media(url=None, path=None, *, store, download, file_response, error_response):
+    """公开媒体服务：使用服务凭据读取既有允许目录中的媒体"""
+
+    # 兼容处理：如果本地发来的是已经被污染的老版本 HF 直链，我们自动将其转换为相对路径
+    if url and url.startswith("https://huggingface.co/datasets/"):
+        try:
+            path = url.split("resolve/main/")[-1]
+            path = urllib.parse.unquote(path)
+        except Exception:
+            raise HTTPException(status_code=400, detail="无效的 HF 原链接格式")
+
+    if not path:
+        raise HTTPException(status_code=400, detail="缺少路径参数")
+
+    # 🛡️ 路径穿越防护：禁止包含 .. 和绝对路径
+    if ".." in path or path.startswith("/"):
+        raise HTTPException(status_code=400, detail="非法路径")
+
+    # 🛡️ 绝对的安全红线：限制只能代理下载图片目录，严禁黑客通过此接口下载 users.json 或账本数据！
+    allowed_dirs = ["uploads/", "avatars/", "covers/"]
+    if not any(path.startswith(d) for d in allowed_dirs):
+        raise HTTPException(status_code=403, detail="非法访问：该接口仅允许代理图片资源")
+
+    media_extensions = {"jpg", "jpeg", "png", "gif", "webp", "mp4", "webm", "mov", "wav", "mp3", "m4a", "ogg"}
+    if path.rsplit(".", 1)[-1].lower() not in media_extensions:
+        raise HTTPException(status_code=403, detail="该接口不允许访问非媒体文件")
+
+    hf_token = os.environ.get("HF_TOKEN")
+    dataset_repo_id = store.DATASET_REPO_ID
+
+    try:
+        # hf_hub_download 会自动利用云端容器的缓存，只有第一次会去真实请求 Dataset
+        cached_file_path = download(
+            repo_id=dataset_repo_id,
+            repo_type="dataset",
+            filename=path,
+            token=hf_token
+        )
+        # 智能识别文件类型 (image/jpeg, image/png 等)
+        content_type, _ = mimetypes.guess_type(cached_file_path)
+        return file_response(cached_file_path, media_type=content_type or "application/octet-stream")
+    except Exception as e:
+        error_id = f"ERR_{int(time.time())}_{uuid.uuid4().hex[:8]}"
+        upstream_status = getattr(getattr(e, "response", None), "status_code", None)
+        if not isinstance(upstream_status, int):
+            upstream_status = getattr(e, "code", None)
+        status_text = f" status={upstream_status}" if isinstance(upstream_status, int) and 100 <= upstream_status <= 599 else ""
+        logger.warning(f"IMAGE_PROXY_FAIL | error_id={error_id} | error_type={type(e).__name__}{status_text}")
+        return JSONResponse(
+            status_code=502,
+            content=error_response(502, "图片暂时无法获取，请稍后重试", "upstream_error", error_id=error_id),
+        )

models.py

@@ -79,6 +79,7 @@ class CommentCreate(BaseModel):
     parent_id: Optional[str] = None 
 
 class ItemCreate(BaseModel):
+    request_id: Optional[str] = Field(default=None, strict=True, pattern=r'^[0-9a-f]{32}$')
     type: str
     title: str
     shortDesc: str
@@ -87,7 +88,7 @@ class ItemCreate(BaseModel):
     coverUrl: Optional[str] = None
     imageUrls: Optional[List[str]] = []
     author: str 
-    price: int = 0
+    price: int = Field(default=0, ge=0, strict=True)
     github_token: Optional[str] = None
     netdisk_password: Optional[str] = None  # ☁️ 网盘提取码（加密存储，购买后解密）
     is_netdisk: Optional[bool] = False      # ☁️ 是否为网盘资源
@@ -95,13 +96,14 @@ class ItemCreate(BaseModel):
     allow_refund: Optional[bool] = True     # 💸 是否支持退款（默认支持）
 
 class ItemUpdate(BaseModel):
+    expected_revision: Optional[int] = Field(default=None, ge=0, le=9007199254740991, strict=True)
     title: Optional[str] = None
     shortDesc: Optional[str] = None
     fullDesc: Optional[str] = None
     link: Optional[str] = None
     coverUrl: Optional[str] = None
-    imageUrls: Optional[List[str]] = []
-    price: Optional[int] = None
+    imageUrls: Optional[List[str]] = None
+    price: Optional[int] = Field(default=None, ge=0, strict=True)
     github_token: Optional[str] = None
     netdisk_password: Optional[str] = None  # ☁️ 网盘提取码
     is_netdisk: Optional[bool] = None       # ☁️ 是否为网盘资源
@@ -144,12 +146,16 @@ class RatingRequest(BaseModel):
 
 class RechargeRequest(BaseModel):
     account: str
-    amount: int = Field(..., ge=1, le=10000)  # 单次充值1-10000
+    amount: int = Field(..., ge=1, le=10000, strict=True)  # 单次充值1-10000
     method: Optional[str] = "alipay"
 
 class PurchaseRequest(BaseModel):
     account: str
     item_id: str
+    expected_price: Optional[int] = Field(default=None, ge=0, strict=True)
+
+class PromptPurchaseRequest(BaseModel):
+    expected_price: Optional[int] = Field(default=None, ge=0, strict=True)
 
 class TipRequest(BaseModel):
     sender_account: str
@@ -160,10 +166,10 @@ class TipRequest(BaseModel):
 
 class WithdrawRequest(BaseModel):
     account: str
-    amount: int = Field(..., ge=1, le=5000)  # 单次提现1-5000
-    alipayAccount: str
-    real_name: str
-    code: str
+    amount: int = Field(..., ge=1, le=5000, strict=True)  # 单次提现1-5000
+    alipayAccount: str = Field(..., min_length=1, max_length=256)
+    real_name: str = Field(..., min_length=1, max_length=128)
+    code: str = Field(..., pattern=r"^[0-9]{6}$")
 
 
 # ==========================================
@@ -175,8 +181,8 @@ class TaskCreate(BaseModel):
     description: str                        # 任务详情
     referenceImages: Optional[List[str]] = []  # 参考图（最多6张）
     referenceLink: Optional[str] = None     # 参考链接
-    totalPrice: int                         # 总价格（积分）
-    depositRatio: int                       # 订金比例（10/20/30/50）
+    totalPrice: int = Field(..., ge=0, le=2147483647, strict=True)  # SQL整数范围
+    depositRatio: int = Field(..., strict=True)  # 订金比例（10/20/30/50）
     deadline: str                           # 截止时间 (ISO格式)
     publisher: str                          # 发布者账号
 
@@ -186,8 +192,8 @@ class TaskUpdate(BaseModel):
     description: Optional[str] = None
     referenceImages: Optional[List[str]] = None
     referenceLink: Optional[str] = None
-    totalPrice: Optional[int] = None
-    depositRatio: Optional[int] = None
+    totalPrice: Optional[int] = Field(None, ge=0, le=2147483647, strict=True)
+    depositRatio: Optional[int] = Field(None, strict=True)
     deadline: Optional[str] = None
 
 # 🔧 P2修复：以下三个 body 模型修复前后端参数通道不匹配
@@ -251,7 +257,7 @@ class PromptCreate(BaseModel):
     audio_url: Optional[str] = None         # 示例音频 URL（仅音乐提示词，图片+音频方案；视频可选）
     images: Optional[List[str]] = None      # 图像提示词图片列表（最多9张，首张为封面）
     is_original: bool = False               # 原创作品标记
-    price: int = 0                          # 定价（0=免费）
+    price: int = Field(default=0, ge=0, le=10000, strict=True)  # 提示词定价（0=免费）
     tags: Optional[List[str]] = None        # 自定义标签（最多10个，每个≤12字）
 
 class PromptUpdate(BaseModel):
@@ -266,10 +272,10 @@ class PromptUpdate(BaseModel):
     audio_url: Optional[str] = None         # 示例音频 URL（仅音乐提示词；传 null 表示清除）
     images: Optional[List[str]] = None      # 图像提示词图片列表（最多9张，首张为封面）
     is_original: Optional[bool] = None      # 原创作品标记
-    price: Optional[int] = None
+    price: Optional[int] = Field(default=None, ge=0, le=10000, strict=True)
     tags: Optional[List[str]] = None
 
 class PromptCategoryAdd(BaseModel):
     """ 添加提示词分类 """
     prompt_type: str                        # "image"、"video" 或 "music"
-    name: str                               # 分类名称（≤8字，去重）
+    name: str                               # 分类名称（≤8字，去重）

models_sql.py

@@ -1,131 +1,288 @@
-# models_sql.py
-# ==========================================
-# 🗄️ SQL 数据库模型定义
-# ==========================================
-# 🚀 P1性能优化：添加复合索引加速查询
-# ==========================================
-
-from sqlalchemy import Column, Integer, String, DateTime, Boolean, Index, func
-from sqlalchemy.orm import declarative_base
-import datetime
-
-Base = declarative_base()
-
-class Wallet(Base):
-    """用户钱包表"""
-    __tablename__ = "wallets"
-    
-    account = Column(String, primary_key=True, index=True)
-    balance = Column(Integer, default=0, nullable=False)         # 用于消费的余额 (充值获得)
-    earn_balance = Column(Integer, default=0, nullable=False)    # 创作者销售收益余额 (别人购买获得)
-    tip_balance = Column(Integer, default=0, nullable=False)     # 【新增】创作者打赏收益余额 (粉丝赞助获得)
-    task_balance = Column(Integer, default=0, nullable=False)    # 【新增】任务相关余额
-    frozen_balance = Column(Integer, default=0, nullable=False)  # 提现审核冻结中的余额
-    
-    # 乐观锁版本号，防止并发扣款被击穿
-    version = Column(Integer, default=1)
-
-class Ownership(Base):
-    """资源所有权表"""
-    __tablename__ = "ownerships"
-    
-    id = Column(Integer, primary_key=True, autoincrement=True)
-    account = Column(String, index=True)
-    item_id = Column(String, index=True)
-    purchased_at = Column(DateTime, default=datetime.datetime.utcnow)
-    # 🔄 P7后悔模式增强
-    price_paid = Column(Integer, default=0)       # 购买时支付的价格
-    is_refunded = Column(Boolean, default=False)  # 是否已退款
-    refunded_at = Column(DateTime, nullable=True) # 退款时间
-    
-    # 🚀 P1性能优化：复合索引
-    __table_args__ = (
-        Index('ix_ownerships_account_item', 'account', 'item_id'),
-        Index('ix_ownerships_account_refunded', 'account', 'is_refunded'),
-    )
-
-class Refund(Base):
-    """🔄 P7后悔模式：退款记录表"""
-    __tablename__ = "refunds"
-    
-    id = Column(Integer, primary_key=True, autoincrement=True)
-    account = Column(String, index=True)          # 退款用户
-    item_id = Column(String, index=True)          # 退款商品
-    amount = Column(Integer)                       # 退款金额
-    refunded_at = Column(DateTime, default=datetime.datetime.utcnow)
-    ban_until = Column(DateTime)                   # 禁止购买截止时间（30天后）
-
-class RechargeOrder(Base):
-    """💰 充值订单预存表（订单号→账号映射持久化，防止实例重启导致回调找不到订单）"""
-    __tablename__ = "recharge_orders"
-    
-    order_id = Column(String, primary_key=True)    # 商户订单号 PAY_xxx
-    account = Column(String, index=True)           # 充值用户
-    amount = Column(Integer)                        # 充值金额
-    status = Column(String, default="pending")     # pending/paid
-    created_at = Column(DateTime, default=datetime.datetime.utcnow)
-
-class Transaction(Base):
-    """交易流水表"""
-    __tablename__ = "transactions"
-    
-    tx_id = Column(String, primary_key=True)
-    account = Column(String, index=True)
-    tx_type = Column(String)                     # 枚举: RECHARGE, PURCHASE, SALE, TIP_OUT, TIP_IN, WITHDRAW, WITHDRAW_FEE, REFUND, TASK_FREEZE, TASK_DEPOSIT, TASK_PAYMENT, TASK_INCOME, TASK_REFUND, TASK_CANCEL_REFUND
-    amount = Column(Integer)
-    related_account = Column(String, nullable=True)
-    item_id = Column(String, nullable=True)
-    created_at = Column(DateTime, default=datetime.datetime.utcnow, index=True)  # 🚀 P1: 添加时间索引
-    prev_hash = Column(String)                   # 上一笔订单的哈希
-    tx_hash = Column(String)                     # 本笔订单的哈希 (防篡改)
-    
-    # 💰 提现相关字段 (仅 WITHDRAW_APPLY 类型交易使用)
-    alipay_account = Column(String, nullable=True)      # 收款支付宝账号
-    real_name = Column(String, nullable=True)            # 收款人姓名
-    withdraw_status = Column(String, nullable=True)      # pending / completed
-    payment_order_id = Column(String, nullable=True)     # 管理员填写的打款订单号
-    net_amount = Column(Integer, nullable=True)          # 实际到账金额（用于解冻时准确扣减）
-    
-    # 交易详情增强字段
-    description = Column(String, nullable=True)          # 交易自描述文本
-    item_title = Column(String, nullable=True)           # 资源/任务标题
-    item_type = Column(String, nullable=True)            # 资源类型 (tool/skill/app/recommend/post/task/prompt)
-    related_user_name = Column(String, nullable=True)    # 对方用户名
-    
-    # 🌐 开放API：来源插件标识（如 "nodecraft_ai"），用于按工具结构化追踪消费
-    source_plugin = Column(String(50), nullable=True, index=True)
-    
-    # 🚀 P1性能优化：复合索引
-    __table_args__ = (
-        Index('ix_transactions_account_type', 'account', 'tx_type'),
-        Index('ix_transactions_account_created', 'account', 'created_at'),
-        Index('ix_transactions_source_plugin_created', 'source_plugin', 'created_at'),
-    )
-
-class SystemConfig(Base):
-    """系统配置表 - 持久化存储，替代 /tmp/system_config.json"""
-    __tablename__ = "system_configs"
-    
-    config_key = Column(String, primary_key=True)
-    config_value = Column(String, nullable=False, default="{}")
-    updated_at = Column(DateTime, default=datetime.datetime.utcnow)
-    updated_by = Column(String, nullable=True)
-
-
-class RegisteredPlugin(Base):
-    """🌐 开放API：第三方插件注册信息表"""
-    __tablename__ = "registered_plugins"
-
-    plugin_id          = Column(String(50), primary_key=True)   # 英文标识如 "nodecraft_ai"
-    plugin_key         = Column(String(100), unique=True, nullable=False, index=True)
-    name               = Column(String(100), nullable=False)     # 显示名
-    description        = Column(String(500), nullable=True)
-    enabled            = Column(Boolean, default=True, nullable=False)
-    rate_limit         = Column(Integer, default=100)            # 每分钟最大请求数
-    max_deduct_per_tx  = Column(Integer, default=100)            # 单笔扣款上限
-    max_deduct_per_day = Column(Integer, default=1000)           # 日扣款上限
-    permissions        = Column(String(200), default='["verify","balance","deduct","refund"]')  # JSON数组
-    created_at         = Column(DateTime, default=func.now())
-    created_by         = Column(String(50))                      # 创建者管理员账号
-    updated_at         = Column(DateTime, onupdate=func.now())
-    last_rotated_at    = Column(DateTime, nullable=True)         # 上次轮换key时间
+# models_sql.py
+# ==========================================
+# 🗄️ SQL 数据库模型定义
+# ==========================================
+# 🚀 P1性能优化：添加复合索引加速查询
+# ==========================================
+
+from sqlalchemy import Column, Integer, String, DateTime, Boolean, Index, func, Text
+from sqlalchemy.orm import declarative_base
+import datetime
+
+Base = declarative_base()
+
+
+class ResourcePublication(Base):
+    """同次资源发布的持久原始请求和恢复内容；不参与资金变更。"""
+    __tablename__ = "resource_publications"
+    request_key = Column(String(64), primary_key=True)
+    item_id = Column(String(100), nullable=False, unique=True)
+    author = Column(String, nullable=False)
+    request_payload = Column(Text, nullable=False)
+    payload = Column(Text, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+    created_at = Column(DateTime, default=datetime.datetime.utcnow, nullable=False)
+
+
+class TaskPublication(Base):
+    """与任务资金冻结同提交的待发布记录；保留原始内容供失败恢复。"""
+    __tablename__ = "task_publications"
+    task_id = Column(String(64), primary_key=True)
+    publisher = Column(String, nullable=False)
+    payload = Column(Text, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+    created_at = Column(DateTime, default=datetime.datetime.utcnow, nullable=False)
+
+
+class TaskRevision(Base):
+    """任务编辑的持久字段投影，与改价资金同事务；版本按钱包锁串行递增。"""
+    __tablename__ = "task_revisions"
+    task_id = Column(String(64), primary_key=True)
+    revision = Column(Integer, primary_key=True)
+    publisher = Column(String, nullable=False)
+    payload = Column(Text, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+    created_at = Column(DateTime, default=datetime.datetime.utcnow, nullable=False)
+
+
+class TaskAssignment(Base):
+    """指派和订金SQL提交后的状态投影，不能因JSON失败再次扣订金。"""
+    __tablename__ = "task_assignments"
+    task_id = Column(String(64), primary_key=True)
+    publisher = Column(String, nullable=False)
+    assignee = Column(String, nullable=False)
+    deposit = Column(Integer, nullable=False)
+    assigned_at = Column(Integer, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+
+
+class TaskDelivery(Base):
+    """交付/退回最新版本先持久保存，JSON失败不能丢失成果或恢复旧验收。"""
+    __tablename__ = "task_deliveries"
+    task_id = Column(String(64), primary_key=True)
+    publisher = Column(String, nullable=False)
+    assignee = Column(String, nullable=False)
+    revision = Column(Integer, nullable=False)
+    payload = Column(Text, nullable=False)
+    updated_at = Column(Integer, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+
+
+class TaskSettlement(Base):
+    """验收付款和待完成状态同事务；一任务只结算一次。"""
+    __tablename__ = "task_settlements"
+    task_id = Column(String(64), primary_key=True)
+    publisher = Column(String, nullable=False)
+    assignee = Column(String, nullable=False)
+    amount = Column(Integer, nullable=False)
+    deposit = Column(Integer, nullable=False)
+    payment_tx_id = Column(String, nullable=False)
+    income_tx_id = Column(String, nullable=False)
+    completed_at = Column(Integer, nullable=False)
+    feedback = Column(Text, nullable=True)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+
+
+class TaskResolution(Base):
+    """仲裁资金和裁决同提交；一任务只允许一次最终分配。"""
+    __tablename__ = "task_resolutions"
+    task_id = Column(String(64), primary_key=True)
+    dispute_id = Column(String(64), nullable=False, unique=True)
+    publisher = Column(String, nullable=False)
+    assignee = Column(String, nullable=False)
+    amount = Column(Integer, nullable=False)
+    deposit = Column(Integer, nullable=False)
+    publisher_refund = Column(Integer, nullable=False)
+    assignee_income = Column(Integer, nullable=False)
+    initiator_role = Column(String(16), nullable=False)
+    resolution = Column(String(32), nullable=False)
+    ratio = Column(Integer, nullable=True)
+    note = Column(Text, nullable=True)
+    resolved_by = Column(String, nullable=False)
+    resolved_at = Column(Integer, nullable=False)
+    payment_tx_id = Column(String, nullable=False)
+    refund_tx_id = Column(String, nullable=False)
+    income_tx_id = Column(String, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+
+class TaskDisputeRecord(Base):
+    """申诉先持久保存；JSON同步期间也禁止普通验收结算。"""
+    __tablename__ = "task_dispute_records"
+    task_id = Column(String(64), primary_key=True)
+    dispute_id = Column(String(64), nullable=False, unique=True)
+    publisher = Column(String, nullable=False)
+    assignee = Column(String, nullable=False)
+    payload = Column(Text, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+    created_at = Column(Integer, nullable=False)
+
+
+class TaskDisputeResponseRecord(Base):
+    """首次申诉回应持久记录；一个任务只保存一份原始回应。"""
+    __tablename__ = "task_dispute_responses"
+    task_id = Column(String(64), primary_key=True)
+    dispute_id = Column(String(64), nullable=False, unique=True)
+    publisher = Column(String, nullable=False)
+    assignee = Column(String, nullable=False)
+    respondent = Column(String, nullable=False)
+    payload = Column(Text, nullable=False)
+    projected = Column(Boolean, nullable=False, default=False, index=True)
+
+
+class Wallet(Base):
+    """用户钱包表"""
+    __tablename__ = "wallets"
+    
+    account = Column(String, primary_key=True, index=True)
+    balance = Column(Integer, default=0, nullable=False)         # 用于消费的余额 (充值获得)
+    earn_balance = Column(Integer, default=0, nullable=False)    # 创作者销售收益余额 (别人购买获得)
+    tip_balance = Column(Integer, default=0, nullable=False)     # 【新增】创作者打赏收益余额 (粉丝赞助获得)
+    task_balance = Column(Integer, default=0, nullable=False)    # 【新增】任务相关余额
+    frozen_balance = Column(Integer, default=0, nullable=False)  # 提现审核冻结中的余额
+    
+    # 预留版本列；未配置 version_id_col，不提供 ORM 乐观锁保护
+    version = Column(Integer, default=1)
+
+class Ownership(Base):
+    """资源所有权表"""
+    __tablename__ = "ownerships"
+    
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    account = Column(String, index=True)
+    item_id = Column(String, index=True)
+    purchased_at = Column(DateTime, default=datetime.datetime.utcnow)
+    # 🔄 P7后悔模式增强
+    price_paid = Column(Integer, default=0)       # 购买时支付的价格
+    is_refunded = Column(Boolean, default=False)  # 是否已退款
+    refunded_at = Column(DateTime, nullable=True) # 退款时间
+    
+    # 🚀 P1性能优化：复合索引
+    __table_args__ = (
+        Index('ix_ownerships_account_item', 'account', 'item_id'),
+        Index('ix_ownerships_account_refunded', 'account', 'is_refunded'),
+    )
+
+class Refund(Base):
+    """🔄 P7后悔模式：退款记录表"""
+    __tablename__ = "refunds"
+    
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    account = Column(String, index=True)          # 退款用户
+    item_id = Column(String, index=True)          # 退款商品
+    amount = Column(Integer)                       # 退款金额
+    refunded_at = Column(DateTime, default=datetime.datetime.utcnow)
+    ban_until = Column(DateTime)                   # 禁止购买截止时间（30天后）
+
+class RechargeOrder(Base):
+    """💰 充值订单预存表（订单号→账号映射持久化，防止实例重启导致回调找不到订单）"""
+    __tablename__ = "recharge_orders"
+    
+    order_id = Column(String, primary_key=True)    # 商户订单号 PAY_xxx
+    account = Column(String, index=True)           # 充值用户
+    amount = Column(Integer)                        # 充值金额
+    status = Column(String, default="pending")     # pending/paid
+    created_at = Column(DateTime, default=datetime.datetime.utcnow)
+
+class Transaction(Base):
+    """交易流水表"""
+    __tablename__ = "transactions"
+    
+    tx_id = Column(String, primary_key=True)
+    account = Column(String, index=True)
+    tx_type = Column(String)                     # 枚举: RECHARGE, PURCHASE, SALE, TIP_OUT, TIP_IN, WITHDRAW, WITHDRAW_FEE, REFUND, SALE_REFUND, TASK_FREEZE, TASK_PRICE_ADJUST, TASK_DEPOSIT, TASK_PAYMENT, TASK_INCOME, TASK_REFUND, TASK_CANCEL_REFUND
+    amount = Column(Integer)
+    related_account = Column(String, nullable=True)
+    item_id = Column(String, nullable=True)
+    created_at = Column(DateTime, default=datetime.datetime.utcnow, index=True)  # 🚀 P1: 添加时间索引
+    prev_hash = Column(String)                   # 上一笔订单的哈希
+    tx_hash = Column(String)                     # 本笔订单的哈希 (防篡改)
+    
+    # 💰 提现相关字段 (仅 WITHDRAW_APPLY 类型交易使用)
+    alipay_account = Column(String, nullable=True)      # 收款支付宝账号
+    real_name = Column(String, nullable=True)            # 收款人姓名
+    withdraw_status = Column(String, nullable=True)      # pending / completed
+    payment_order_id = Column(String, nullable=True)     # 管理员填写的打款订单号
+    net_amount = Column(Integer, nullable=True)          # 实际到账金额（用于解冻时准确扣减）
+    
+    # 交易详情增强字段
+    description = Column(String, nullable=True)          # 交易自描述文本
+    item_title = Column(String, nullable=True)           # 资源/任务标题
+    item_type = Column(String, nullable=True)            # 资源类型 (tool/skill/app/recommend/post/task/prompt)
+    related_user_name = Column(String, nullable=True)    # 对方用户名
+    
+    # 🌐 开放API：来源插件标识（如 "nodecraft_ai"），用于按工具结构化追踪消费
+    source_plugin = Column(String(50), nullable=True, index=True)
+    
+    # 🚀 P1性能优化：复合索引
+    __table_args__ = (
+        Index('ix_transactions_account_type', 'account', 'tx_type'),
+        Index('ix_transactions_account_created', 'account', 'created_at'),
+        Index('ix_transactions_source_plugin_created', 'source_plugin', 'created_at'),
+    )
+
+class SystemConfig(Base):
+    """系统配置表 - 持久化存储，替代 /tmp/system_config.json"""
+    __tablename__ = "system_configs"
+    
+    config_key = Column(String, primary_key=True)
+    config_value = Column(String, nullable=False, default="{}")
+    updated_at = Column(DateTime, default=datetime.datetime.utcnow)
+    updated_by = Column(String, nullable=True)
+
+
+class RegisteredPlugin(Base):
+    """🌐 开放API：第三方插件注册信息表"""
+    __tablename__ = "registered_plugins"
+
+    plugin_id          = Column(String(50), primary_key=True)   # 英文标识如 "nodecraft_ai"
+    plugin_key         = Column(String(100), unique=True, nullable=False, index=True)
+    name               = Column(String(100), nullable=False)     # 显示名
+    description        = Column(String(500), nullable=True)
+    enabled            = Column(Boolean, default=True, nullable=False)
+    rate_limit         = Column(Integer, default=100)            # 每分钟最大请求数
+    max_deduct_per_tx  = Column(Integer, default=100)            # 单笔扣款上限
+    max_deduct_per_day = Column(Integer, default=1000)           # 日扣款上限
+    permissions        = Column(String(200), default='["verify","balance","deduct","refund"]')  # JSON数组
+    created_at         = Column(DateTime, default=func.now())
+    created_by         = Column(String(50))                      # 创建者管理员账号
+    updated_at         = Column(DateTime, onupdate=func.now())
+    last_rotated_at    = Column(DateTime, nullable=True)         # 上次轮换key时间
+
+
+class OpenApiRateLimitBucket(Base):
+    """跨 worker 持久化的开放 API 插件分钟窗口计数。"""
+    __tablename__ = "open_api_rate_limit_buckets"
+
+    plugin_id = Column(String(50), primary_key=True)
+    window_start = Column(Integer, nullable=False)
+    request_count = Column(Integer, nullable=False, default=0)
+    updated_at = Column(DateTime, default=datetime.datetime.utcnow, onupdate=datetime.datetime.utcnow)
+
+
+class ApiRateLimitBucket(Base):
+    """跨 worker 共享的常规 API 限流分钟窗口。"""
+    __tablename__ = "api_rate_limit_buckets"
+
+    bucket_key = Column(String(64), primary_key=True)
+    window_start = Column(Integer, nullable=False)
+    request_count = Column(Integer, nullable=False, default=0)
+    updated_at = Column(DateTime, default=datetime.datetime.utcnow, onupdate=datetime.datetime.utcnow)
+
+
+class VerificationContactCooldown(Base):
+    """验证码联系方式发送冷却；只持久化脱敏哈希键，不保存原始邮箱/手机号。"""
+    __tablename__ = "verification_contact_cooldowns"
+
+    contact_key = Column(String(64), primary_key=True)
+    last_sent_at = Column(Integer, nullable=False)
+    claim_id = Column(String(32), nullable=False)
+
+
+class VerificationCode(Base):
+    """跨 worker 一次性验证码；仅保存联系方式哈希和带密钥的验证码摘要。"""
+    __tablename__ = "verification_codes"
+
+    contact_key = Column(String(64), primary_key=True)
+    code_digest = Column(String(64), nullable=False)
+    expires_at = Column(Integer, nullable=False, index=True)
+    updated_at = Column(DateTime, default=datetime.datetime.utcnow, onupdate=datetime.datetime.utcnow)

notification_store.py

@@ -0,0 +1,165 @@
+"""通知与公告的严格读取、白名单输出和锁内更新。"""
+import copy
+import logging
+import math
+import time
+import uuid
+
+from fastapi import HTTPException
+import 数据库连接 as db
+
+logger = logging.getLogger(__name__)
+TTL = 7 * 24 * 3600
+FIELDS = frozenset({"id", "type", "from_user", "from_name", "from_avatar", "target_item_id",
+                    "target_item_title", "content", "is_read", "created_at", "receiver"})
+
+
+def _unavailable():
+    return HTTPException(status_code=503, detail="通知数据暂不可用")
+
+
+def _timestamp(message):
+    value = message["created_at"]
+    return value / 1000 if value >= 1e12 else value
+
+
+def _validate(message):
+    if not isinstance(message, dict):
+        raise _unavailable()
+    if any(not isinstance(message.get(key), str) or not message[key] for key in ("id", "type")):
+        raise _unavailable()
+    timestamp = message.get("created_at")
+    try:
+        valid_timestamp = type(timestamp) in (int, float) and math.isfinite(timestamp) and timestamp >= 0
+    except (OverflowError, ValueError):
+        valid_timestamp = False
+    if not valid_timestamp:
+        raise _unavailable()
+    if not isinstance(message.get("content", ""), str) or type(message.get("is_read", False)) is not bool:
+        raise _unavailable()
+    return message
+
+
+def _messages(data, account):
+    if not isinstance(data, dict) or not isinstance(data.get(account, []), list):
+        raise _unavailable()
+    messages = data.get(account, [])
+    for message in messages:
+        _validate(message)
+        if "receiver" in message and message["receiver"] != account:
+            raise _unavailable()
+    return messages
+
+
+def _announcements(data):
+    if not isinstance(data, list):
+        raise _unavailable()
+    for message in data:
+        if _validate(message)["type"] != "system":
+            raise _unavailable()
+    return data
+
+
+def _read(name, default):
+    try:
+        return db.load_data(name, default_data=default, skip_cache=True, strict=True)
+    except Exception as error:
+        logger.warning("通知读取失败: %s", type(error).__name__)
+        raise _unavailable() from None
+
+
+def _mutate(name, updater, default):
+    try:
+        return db.atomic_update(name, updater, default_data=default)
+    except HTTPException:
+        raise
+    except Exception as error:
+        logger.warning("通知写入失败: %s", type(error).__name__)
+        raise _unavailable() from None
+
+
+def _profile(account):
+    users = _read("users.json", {})
+    if not isinstance(users, dict) or not isinstance(users.get(account, {}), dict):
+        raise _unavailable()
+    return users.get(account, {})
+
+
+def publish_announcement(account, content):
+    if not isinstance(content, str) or not content.strip():
+        raise HTTPException(status_code=400, detail="公告内容不能为空")
+    user = _profile(account)
+    announcement = {"id": f"sys_{int(time.time())}_{uuid.uuid4().hex}", "type": "system", "from_user": account,
+                    "from_name": user.get("name", account), "from_avatar": user.get("avatarDataUrl", ""),
+                    "content": content, "created_at": int(time.time())}
+    def update(data):
+        _announcements(data).append(announcement)
+    _mutate("announcements.json", update, [])
+
+
+def append_notification(account, payload):
+    source = payload.get("from_user")
+    if not account or source == account:
+        return
+    user = _profile(source) if source and source != "system" else {}
+    message = {"id": f"msg_{int(time.time())}_{uuid.uuid4().hex}", "type": payload.get("type"),
+               "from_user": source, "from_name": user.get("name", source) if source and source != "system" else "系统通知",
+               "from_avatar": user.get("avatarDataUrl", ""), "target_item_id": payload.get("target_item_id", ""),
+               "target_item_title": payload.get("target_item_title", ""), "content": payload.get("content", ""),
+               "is_read": False, "created_at": int(time.time())}
+    _validate(message)
+    def update(data):
+        messages = _messages(data, account)
+        data[account] = [message, *messages]
+    _mutate("messages.json", update, {})
+
+
+def get_messages(account, count_only=False):
+    now = time.time()
+    announcements = _announcements(_read("announcements.json", []))
+    # 过期公告不重复注入已被清理的旧通知，也不在角标中重新出现。
+    active = [message for message in announcements if now - _timestamp(message) < TTL]
+    messages = _messages(_read("messages.json", {}), account)
+
+    def combine(messages):
+        result = copy.deepcopy(messages)
+        ids = {message["id"] for message in result}
+        for message in active:
+            if message["id"] not in ids:
+                result.append({**copy.deepcopy(message), "receiver": account, "is_read": False})
+                ids.add(message["id"])
+        return result
+
+    def unread(messages):
+        return sum(not message.get("is_read", False) and message["type"] not in ("private", "plugin_update")
+                   and now - _timestamp(message) < TTL for message in messages)
+
+    def project(messages):
+        return [copy.deepcopy({key: value for key, value in message.items() if key in FIELDS}) for message in messages]
+
+    combined = combine(messages)
+    if count_only:
+        return {"status": "success", "unread_count": unread(combined)}
+    if len(combined) == len(messages) and all(message.get("is_read", False) and now - _timestamp(message) < TTL for message in messages):
+        return {"status": "success", "data": project(messages), "unread_count": 0}
+
+    def update(data):
+        latest = combine(_messages(data, account))
+        count = unread(latest)
+        kept = [message for message in latest if not message.get("is_read", False) or now - _timestamp(message) < TTL]
+        for message in kept:
+            message["is_read"] = True
+        kept.sort(key=_timestamp, reverse=True)
+        data[account] = kept
+        return {"status": "success", "data": project(kept), "unread_count": count}
+    return _mutate("messages.json", update, {})
+
+
+def mark_messages_read(account):
+    messages = _messages(_read("messages.json", {}), account)
+    if all(message.get("is_read", False) for message in messages):
+        return
+    def update(data):
+        for message in _messages(data, account):
+            message["is_read"] = True
+    _mutate("messages.json", update, {})

notifications.py

@@ -1,44 +1,8 @@
-import time
-import uuid
-import 数据库连接 as db
+import notification_store
 
 def add_notification(target_account: str, notif_data: dict):
     try:
-        from_user = notif_data.get("from_user")
-        if not target_account:
-            return
-        if from_user and target_account == from_user:
-            return  # 不给自己发通知
-        
-        users_db = db.load_data("users.json", default_data={})
-        
-        if from_user == "system" or not from_user:
-            from_name = "系统通知"
-            from_avatar = ""
-        else:
-            user_info = users_db.get(from_user, {})
-            from_name = user_info.get("name", from_user)
-            from_avatar = user_info.get("avatarDataUrl", "")
-        
-        notif = {
-            "id": f"msg_{int(time.time())}_{uuid.uuid4().hex[:6]}",
-            "type": notif_data.get("type"), 
-            "from_user": from_user,
-            "from_name": from_name,
-            "from_avatar": from_avatar,
-            "target_item_id": notif_data.get("target_item_id", ""),
-            "target_item_title": notif_data.get("target_item_title", ""),
-            "content": notif_data.get("content", ""),
-            "is_read": False,
-            "created_at": int(time.time())
-        }
-        
-        def updater(data):
-            if target_account not in data:
-                data[target_account] = []
-            data[target_account].insert(0, notif)
-        
-        db.atomic_update("messages.json", updater, default_data={})
-    except Exception as e:
-        print(f"⚠️ 通知发送失败 (target={target_account}): {e}")
-        # 不抛出异常，让主流程继续
+        notification_store.append_notification(target_account, notif_data)
+    except Exception as error:
+        # 通知属于派生操作，故障不影响已经完成的业务；不打印账号/正文。
+        print(f"通知写入失败: error_type={type(error).__name__}")

open_transaction.py

@@ -0,0 +1,47 @@
+"""开放资金接口的实时插件授权与钱包写锁；事务由调用方提交/回滚。"""
+import hmac
+import json
+from decimal import Decimal
+
+from fastapi import HTTPException
+from models_sql import RegisteredPlugin
+from tip_transaction import lock_wallet_accounts
+
+
+def validate_live_plugin(row, key, permission):
+    if row is None or not row.enabled:
+        raise HTTPException(status_code=403, detail="插件已停用或不存在")
+    if not isinstance(row.plugin_key, str) or not isinstance(key, str) or not hmac.compare_digest(row.plugin_key.encode('utf-8'), key.encode('utf-8')):
+        raise HTTPException(status_code=403, detail="Plugin Key 已失效")
+    try:
+        permissions = json.loads(row.permissions)
+        if not isinstance(permissions, list) or any(not isinstance(value, str) for value in permissions):
+            raise ValueError("invalid permissions")
+    except Exception:
+        raise HTTPException(status_code=503, detail="插件权限配置暂不可用")
+    if permission not in permissions:
+        raise HTTPException(status_code=403, detail="插件无权限调用该接口")
+    return row
+
+
+def lock_open_wallet(session, account, plugin_id, key, permission):
+    # 首项资金SQL取得SQLite写事务；其它方言先锁钱包再锁插件，所有开放资金路径同序。
+    wallet = lock_wallet_accounts(session, (account,))[account]
+    row = session.query(RegisteredPlugin).filter(RegisteredPlugin.plugin_id == plugin_id).populate_existing().with_for_update().first()
+    validate_live_plugin(row, key, permission)
+    return wallet, row
+
+
+def positive_integer(value):
+    if isinstance(value, bool) or not isinstance(value, int) or value <= 0:
+        raise HTTPException(status_code=503, detail="插件额度配置暂不可用")
+    return value
+
+
+def quota_total(value):
+    """SQL聚合可返回整数或精确Decimal；拒绝浮点/字符串/非整数与坏统计。"""
+    if isinstance(value, Decimal) and value.is_finite() and value >= 0 and value == value.to_integral_value():
+        return int(value)
+    if isinstance(value, bool) or not isinstance(value, int) or value < 0:
+        raise ValueError("invalid quota history")
+    return value

owned_thread.py

@@ -0,0 +1,33 @@
+"""等待所属同步工作结束；取消不能遗留仍持有文件/SDK操作的线程。"""
+import asyncio
+
+
+async def run_owned_thread(function, *args, **kwargs):
+    async def finish():
+        # 被取消的shield在部分Python版本会立即记录内层异常正文。
+        # 先把常规线程结果封装为数据，所属调用再决定传播异常或取消。
+        try:
+            return True, await asyncio.to_thread(function, *args, **kwargs)
+        except Exception as error:
+            return False, error
+
+    task = asyncio.create_task(finish())
+    cancelled = None
+    while not task.done():
+        try:
+            await asyncio.shield(task)
+        except asyncio.CancelledError as error:
+            cancelled = error
+        except Exception:
+            break
+    if cancelled is not None:
+        # 消费线程结果/异常，取消仍是本次调用的终态。
+        try:
+            task.result()
+        except Exception:
+            pass
+        raise cancelled
+    succeeded, result = task.result()
+    if not succeeded:
+        raise result
+    return result

post_store.py

@@ -0,0 +1,91 @@
+"""帖子主记录在最新文件上的局部修改；不处理资金或评论跨文件清理。"""
+import copy
+from publication_identity import same_publication
+
+
+class PostStoreError(Exception):
+    def __init__(self, status_code, message):
+        self.status_code = status_code
+        self.message = message
+        super().__init__(message)
+
+
+class _Unchanged(Exception):
+    def __init__(self, result): self.result = result
+
+
+def _records(source):
+    if not isinstance(source, list):
+        raise ValueError('invalid post source')
+    identities = set()
+    for record in source:
+        if (not isinstance(record, dict) or not isinstance(record.get('id'), str)
+                or not record['id'].strip() or record['id'] in identities
+                or not isinstance(record.get('author'), str) or not record['author'].strip()):
+            raise ValueError('invalid or ambiguous post record')
+        identities.add(record['id'])
+    return source
+
+
+def _mutate(store, callback):
+    try:
+        return store.atomic_update('posts.json', lambda source: callback(_records(source)), default_data=[])
+    except _Unchanged as unchanged:
+        return unchanged.result
+    except PostStoreError:
+        raise
+    except Exception:
+        # 替换后的同步故障也属于未知结果，不推断为未保存，不自动重放。
+        raise PostStoreError(503, '帖子保存结果暂时无法确认，请稍后核对') from None
+
+
+def publish_post(store, record, replay=False):
+    saved = copy.deepcopy(record)
+    try:
+        _records([saved])
+    except ValueError:
+        raise PostStoreError(400, '帖子发布参数无效') from None
+    def append(records):
+        existing = next((item for item in records if item['id'] == saved['id']), None)
+        if existing is not None:
+            fields = ('author', 'title', 'content', 'cover_image', 'images', 'is_original', 'post_type', 'video_url')
+            if replay and same_publication(existing, saved, fields):
+                raise _Unchanged(copy.deepcopy(existing))
+            raise PostStoreError(409, '帖子发布请求与已有记录冲突，请核对后再提交')
+        records.insert(0, copy.deepcopy(saved))
+        return copy.deepcopy(saved)
+    return _mutate(store, append)
+
+
+def _owned(records, post_id, account, action):
+    index = next((index for index, post in enumerate(records) if post['id'] == post_id), None)
+    if index is None:
+        raise PostStoreError(404, '帖子不存在')
+    if records[index]['author'] != account:
+        raise PostStoreError(403, f'无权{action}他人帖子')
+    return index
+
+
+def edit_post(store, post_id, account, changes):
+    fields = {'title', 'content', 'cover_image', 'images', 'is_original', 'post_type', 'video_url'}
+    if not isinstance(changes, dict) or set(changes) - fields:
+        raise PostStoreError(400, '帖子编辑参数无效')
+    saved = {key: copy.deepcopy(value) for key, value in changes.items() if value is not None}
+    def edit(records):
+        index = _owned(records, post_id, account, '修改')
+        edited = copy.deepcopy(records[index])
+        edited.update(copy.deepcopy(saved))
+        if 'images' in saved:
+            edited['images'] = saved['images'][:9]
+        if saved.get('post_type') == 'video':
+            edited['images'] = []
+        records[index] = edited
+        return copy.deepcopy(edited)
+    return _mutate(store, edit)
+
+
+def delete_post(store, post_id, account):
+    def remove(records):
+        index = _owned(records, post_id, account, '删除')
+        records.pop(index)
+    return _mutate(store, remove)

prompt_store.py

@@ -0,0 +1,146 @@
+"""提示词主记录与分类的锁内局部修改，价格只在副本上投影。"""
+import copy
+from publication_identity import same_publication
+import datetime
+from purchase_transaction import effective_resource_price
+
+
+class PromptStoreError(Exception):
+    def __init__(self, status_code, message):
+        self.status_code = status_code
+        self.message = message
+        super().__init__(message)
+
+
+class _Unchanged(Exception):
+    def __init__(self, result): self.result = result
+
+
+def _mutate(store, filename, callback, default):
+    try:
+        return store.atomic_update(filename, callback, default_data=default)
+    except _Unchanged as unchanged:
+        return unchanged.result
+    except PromptStoreError:
+        raise
+    except Exception:
+        raise PromptStoreError(503, '提示词保存结果暂时无法确认，请稍后核对') from None
+
+
+def _records(source):
+    if not isinstance(source, list): raise ValueError('invalid prompt collection')
+    ids = set()
+    for record in source:
+        if (not isinstance(record, dict) or not isinstance(record.get('id'), str)
+                or not record['id'].strip() or record['id'] in ids
+                or not isinstance(record.get('author'), str) or not record['author'].strip()):
+            raise ValueError('invalid prompt identity')
+        ids.add(record['id'])
+    return source
+
+
+def read_prompts(store):
+    try:
+        return copy.deepcopy(_records(store.load_data('prompts.json', default_data=[], strict=True, skip_cache=True)))
+    except Exception:
+        raise PromptStoreError(503, '提示词暂时不可读取') from None
+
+
+def project_price(record):
+    result = copy.deepcopy(record)
+    result['price'] = effective_resource_price(result)
+    if result.get('pending_price') is not None and result.get('pending_price_effective_at'):
+        when = datetime.datetime.fromisoformat(result['pending_price_effective_at'])
+        now = datetime.datetime.now(when.tzinfo) if when.tzinfo else datetime.datetime.now()
+        if now >= when:
+            result['pending_price'] = None
+            result['pending_price_effective_at'] = None
+    return result
+
+
+def publish_prompt(store, record, replay=False):
+    saved = copy.deepcopy(record)
+    try:
+        _records([saved])
+        effective_resource_price(saved)
+    except Exception:
+        raise PromptStoreError(400, '提示词发布参数无效') from None
+    def append(source):
+        records = _records(source)
+        existing = next((item for item in records if item['id'] == saved['id']), None)
+        if existing is not None:
+            fields = ('author', 'prompt_type', 'category', 'title', 'content', 'prompt_text', 'cover_image',
+                      'media_type', 'video_url', 'audio_url', 'images', 'is_original', 'price', 'tags')
+            if replay and same_publication(existing, saved, fields):
+                raise _Unchanged(copy.deepcopy(existing))
+            raise PromptStoreError(409, '提示词发布请求与已有记录冲突，请核对后再提交')
+        records.insert(0, copy.deepcopy(saved))
+        return copy.deepcopy(saved)
+    return _mutate(store, 'prompts.json', append, [])
+
+
+def _owned(source, prompt_id, account, action):
+    records = _records(source)
+    index = next((index for index, record in enumerate(records) if record['id'] == prompt_id), None)
+    if index is None: raise PromptStoreError(404, '提示词不存在')
+    if records[index]['author'] != account:
+        raise PromptStoreError(403, f'无权{action}他人提示词')
+    return index
+
+
+def edit_prompt(store, prompt_id, account, apply):
+    def edit(source):
+        index = _owned(source, prompt_id, account, '修改')
+        edited = project_price(source[index])
+        apply(edited)
+        source[index] = edited
+        return copy.deepcopy(edited)
+    return _mutate(store, 'prompts.json', edit, [])
+
+
+def delete_prompt(store, prompt_id, account):
+    def remove(source): source.pop(_owned(source, prompt_id, account, '删除'))
+    return _mutate(store, 'prompts.json', remove, [])
+
+
+def _categories(source, defaults):
+    if not isinstance(source, dict): raise ValueError('invalid prompt categories')
+    result = copy.deepcopy(source)
+    for kind, values in defaults.items():
+        existing = result.setdefault(kind, copy.deepcopy(values))
+        if not isinstance(existing, list) or not all(isinstance(name, str) and name.strip() for name in existing):
+            raise ValueError('invalid prompt category group')
+    return result
+
+
+def load_categories(store, defaults):
+    try:
+        source = store.load_data('prompt_categories.json', default_data={}, strict=True, skip_cache=True)
+        completed = _categories(source, defaults)
+    except Exception:
+        raise PromptStoreError(503, '提示词分类暂时不可读取') from None
+    if completed == source: return completed
+    def initialize(latest):
+        completed = _categories(latest, defaults)
+        if completed == latest: raise _Unchanged(completed)
+        latest.clear(); latest.update(completed)
+        return copy.deepcopy(completed)
+    return _mutate(store, 'prompt_categories.json', initialize, {})
+
+
+def modify_category(store, defaults, kind, name, *, delete=False, maximum=30):
+    if kind not in defaults or not isinstance(name, str) or not name.strip():
+        raise PromptStoreError(400, '分类参数无效')
+    def update(source):
+        completed = _categories(source, defaults)
+        values = completed[kind]
+        if delete:
+            if name not in values: raise PromptStoreError(404, '分类不存在')
+            values.remove(name)
+        else:
+            if name in values: raise PromptStoreError(400, '该分类已存在')
+            if len(values) >= maximum: raise PromptStoreError(400, f'分类数量已达上限({maximum})')
+            values.append(name)
+        source.clear(); source.update(completed)
+        return copy.deepcopy(values)
+    return _mutate(store, 'prompt_categories.json', update, {})

proxy_access.py

@@ -0,0 +1,62 @@
+"""下载代理共用资源/有效价格/当前所有权核查，不把存储故障视为免费。"""
+import asyncio
+from models_sql import Ownership
+from purchase_transaction import effective_resource_price
+
+
+class ProxyAccessError(Exception):
+    def __init__(self, status_code, message):
+        self.status_code = status_code
+        self.message = message
+        super().__init__(message)
+
+
+def read_proxy_item(store, item_id):
+    try:
+        source = store.load_data('items.json', default_data=[], strict=True, skip_cache=True)
+        if not isinstance(source, list):
+            raise ValueError('invalid resource source')
+        if any(not isinstance(item, dict) or not isinstance(item.get('id'), str) or not item['id'] for item in source):
+            raise ValueError('invalid resource record')
+        matches = [item for item in source if item.get('id') == item_id]
+        if not matches:
+            raise ProxyAccessError(404, '资源不存在')
+        if len(matches) != 1:
+            raise ValueError('ambiguous resource')
+        item = matches[0]
+        author = item.get('author')
+        if not isinstance(author, str) or not author.strip():
+            raise ValueError('invalid resource author')
+        effective_resource_price(item)
+        return item
+    except ProxyAccessError:
+        raise
+    except Exception:
+        raise ProxyAccessError(503, '资源信息暂时无法核实，请稍后核对') from None
+
+
+async def authorized_proxy_item(store, session, item_id, account):
+    try:
+        item = await asyncio.to_thread(read_proxy_item, store, item_id)
+        author = item['author']
+        price = effective_resource_price(item)
+        if price > 0 and account != author:
+            # SQL会话仍留在调用线程；不用陈旧的身份/拥有缓存，也不授予已退款记录。
+            ownerships = session.query(Ownership).filter(Ownership.account == account, Ownership.item_id == item_id).populate_existing().all()
+            if any(type(row.is_refunded) is not bool for row in ownerships):
+                raise ValueError('invalid ownership refund state')
+            rows = [row for row in ownerships if not row.is_refunded]
+            if len(rows) > 1:
+                raise ValueError('ambiguous ownership')
+            if not rows:
+                raise ProxyAccessError(403, '尚未获取该资源')
+        return item
+    except ProxyAccessError:
+        raise
+    except Exception:
+        raise ProxyAccessError(503, '下载授权暂时无法核实，请稍后核对') from None
+    finally:
+        try:
+            session.rollback()  # 不让下载流长期持有所有权读取事务。
+        except Exception:
+            raise ProxyAccessError(503, '下载授权暂时无法核实，请稍后核对') from None

proxy_resources.py

@@ -0,0 +1,63 @@
+"""代理请求的所属响应/客户端收尾：每对象一次，取消等待同一任务。"""
+import asyncio
+import logging
+
+logger = logging.getLogger("ComfyUI-Ranking")
+
+
+async def _await_close(task):
+    cancelled = None
+    while not task.done():
+        try:
+            await asyncio.shield(task)
+        except asyncio.CancelledError as error:
+            cancelled = error
+    task.result()
+    if cancelled is not None:
+        raise cancelled
+
+
+class ProxyResources:
+    def __init__(self, client):
+        self.client = client
+        self._responses = []
+        self._response_tasks = {}
+        self._close_task = None
+
+    def track(self, response):
+        if self._close_task is not None:
+            raise RuntimeError("proxy resources already closing")
+        if not any(previous is response for previous in self._responses):
+            self._responses.append(response)
+        return response
+
+    async def close_response(self, response):
+        key = id(response)
+        if key not in self._response_tasks:
+            async def finish():
+                try:
+                    await response.aclose()
+                except Exception as error:
+                    logger.warning("PROXY_RESPONSE_CLOSE_FAIL | error_type=%s", type(error).__name__)
+            self._response_tasks[key] = asyncio.create_task(finish())
+        await _await_close(self._response_tasks[key])
+
+    async def close(self):
+        if self._close_task is None:
+            async def finish():
+                cancelled = None
+                try:
+                    for response in self._responses:
+                        try:
+                            await self.close_response(response)
+                        except asyncio.CancelledError as error:
+                            cancelled = error
+                finally:
+                    try:
+                        await self.client.aclose()
+                    except Exception as error:
+                        logger.warning("PROXY_CLIENT_CLOSE_FAIL | error_type=%s", type(error).__name__)
+                if cancelled is not None:
+                    raise cancelled
+            self._close_task = asyncio.create_task(finish())
+        await _await_close(self._close_task)

public_list_etag.py

@@ -0,0 +1,71 @@
+"""Bounded conditional replies for anonymous public list JSON responses."""
+import hashlib
+
+PUBLIC_LIST_PATHS = frozenset({'/api/items', '/api/creators', '/api/creators/search',
+                               '/api/posts', '/api/prompts', '/api/tasks'})
+MAX_JSON_BYTES = 1024 * 1024
+MAX_VALIDATOR_BYTES = 4096
+
+
+def _matches(value, etag):
+    if len(value) > MAX_VALIDATOR_BYTES:
+        return False
+    for candidate in value.split(','):
+        candidate = candidate.strip()
+        if candidate == '*' or candidate.removeprefix('W/') == etag.removeprefix('W/'):
+            return True
+    return False
+
+
+class PublicListETag:
+    """Inspect a single bounded JSON body; streams and private responses pass through."""
+    def __init__(self, app):
+        self.app = app
+
+    async def __call__(self, scope, receive, send):
+        headers = {key.lower(): value for key, value in scope.get('headers', [])}
+        eligible = (scope.get('type') == 'http' and scope.get('method') == 'GET'
+                    and scope.get('path') in PUBLIC_LIST_PATHS
+                    and b'authorization' not in headers and b'cookie' not in headers)
+        if not eligible:
+            return await self.app(scope, receive, send)
+        validator = headers.get(b'if-none-match', b'').decode('latin-1')
+        start = None
+        bypass = False
+
+        async def conditional_send(message):
+            nonlocal start, bypass
+            if bypass:
+                return await send(message)
+            if message['type'] == 'http.response.start':
+                response_headers = {key.lower(): value for key, value in message.get('headers', [])}
+                media = response_headers.get(b'content-type', b'').split(b';', 1)[0].strip().lower()
+                if (message['status'] != 200 or media != b'application/json'
+                        or b'content-encoding' in response_headers or b'etag' in response_headers
+                        or b'set-cookie' in response_headers
+                        or b'no-store' in response_headers.get(b'cache-control', b'').lower()):
+                    bypass = True
+                    return await send(message)
+                start = message
+                return
+            if message['type'] != 'http.response.body' or start is None:
+                return await send(message)
+            body = message.get('body', b'')
+            if message.get('more_body', False) or len(body) > MAX_JSON_BYTES:
+                bypass = True
+                await send(start)
+                return await send(message)
+            etag = 'W/"rk-' + hashlib.sha256(body).hexdigest() + '"'
+            updated = [(key, value) for key, value in start.get('headers', [])
+                       if key.lower() not in {b'cache-control', b'etag'}]
+            updated.extend([(b'etag', etag.encode('ascii')), (b'cache-control', b'private, no-cache')])
+            if _matches(validator, etag):
+                updated = [(key, value) for key, value in updated if key.lower() != b'content-length']
+                await send({**start, 'status': 304, 'headers': updated})
+                await send({'type': 'http.response.body', 'body': b''})
+            else:
+                await send({**start, 'headers': updated})
+                await send(message)
+            bypass = True
+
+        await self.app(scope, receive, conditional_send)

publication_identity.py

@@ -0,0 +1,22 @@
+"""可选发布请求身份；只提供现存内容记录范围内的重复创建确认。"""
+import hashlib
+import json
+import re
+
+
+def publication_identity(kind, account, key):
+    if key is None:
+        return None
+    if kind not in {'post', 'prompt'} or not isinstance(account, str) or not account:
+        raise ValueError('invalid publication owner')
+    if not isinstance(key, str) or re.fullmatch(r'[0-9a-f]{32}', key) is None:
+        raise ValueError('invalid publication key')
+    data = json.dumps([kind, account, key], ensure_ascii=False, separators=(',', ':')).encode('utf-8')
+    return f'{kind}_publish_{hashlib.sha256(data).hexdigest()}'
+
+
+def same_publication(existing, incoming, fields):
+    def content(record):
+        return json.dumps({field: record.get(field) for field in fields}, ensure_ascii=False,
+                          sort_keys=True, separators=(',', ':'), allow_nan=False)
+    return content(existing) == content(incoming)

purchase_transaction.py

@@ -0,0 +1,25 @@
+"""资源购买的有效价格与写事务准备；调用方负责提交/回滚。"""
+import datetime
+from tip_transaction import lock_wallet_accounts
+
+
+def effective_resource_price(item):
+    price = item.get("price", 0)
+    pending = item.get("pending_price")
+    effective = item.get("pending_price_effective_at")
+    if pending is not None and effective:
+        when = datetime.datetime.fromisoformat(effective)
+        now = datetime.datetime.now(when.tzinfo) if when.tzinfo else datetime.datetime.now()
+        if now >= when:
+            price = pending
+    if isinstance(price, bool) or not isinstance(price, int) or price < 0:
+        raise ValueError("invalid resource price")
+    return price
+
+
+def lock_resource_purchase_wallets(session, buyer, seller, free):
+    # 免费/作者本人仍需买方钱包行作为跨进程所有权查重的锁锚点。
+    accounts = (buyer,) if free else (buyer, seller)
+    create = (buyer,) if free else (seller,)
+    wallets = lock_wallet_accounts(session, accounts, create)
+    return wallets[buyer], wallets.get(seller)

rate_limit.py

@@ -0,0 +1,290 @@
+"""跨 worker API 限流：已验证用户按账号计数，匿名请求按客户端 IP 计数。"""
+
+from datetime import datetime
+from functools import wraps
+import hashlib
+import hmac
+import logging
+import threading
+import time
+
+from fastapi import Request
+from fastapi import HTTPException
+from starlette.concurrency import run_in_threadpool
+from sqlalchemy import case, delete
+from sqlalchemy.dialects.mysql import insert as mysql_insert
+from sqlalchemy.dialects.postgresql import insert as postgresql_insert
+from sqlalchemy.dialects.sqlite import insert as sqlite_insert
+
+from 安全认证 import get_account_from_token
+from database_sql import SessionLocal, engine
+from models_sql import ApiRateLimitBucket, VerificationCode, VerificationContactCooldown
+from 安全认证 import JWT_SECRET
+
+logger = logging.getLogger("ComfyUI-Ranking.RateLimit")
+_cleanup_lock = threading.Lock()
+_last_cleanup_at = 0.0
+
+
+def get_remote_address(request: Request) -> str:
+    """仅信任 ASGI transport 提供的客户端地址，不直接信任可伪造的代理头。"""
+    client = getattr(request, "client", None)
+    return getattr(client, "host", None) or "unknown"
+
+
+def get_rate_limit_key(request: Request) -> str:
+    """返回稳定的限流身份键；只读取并验证 Bearer Token，不记录或返回 Token。"""
+    authorization = request.headers.get("Authorization", "")
+    scheme, _, token = authorization.partition(" ")
+    if scheme.lower() == "bearer" and token.strip():
+        account = get_account_from_token(token.strip())
+        if account:
+            return f"account:{account.casefold()}"
+    return f"ip:{get_remote_address(request)}"
+
+
+def _consume_shared_limit(identity: str, scope: str, limit: int) -> None:
+    """使用数据库原子 UPSERT 计数；数据库不可用时 fail closed。"""
+    now = int(time.time())
+    window_start = now - (now % 60)
+    bucket_key = hashlib.sha256(f"{identity}\0{scope}".encode("utf-8")).hexdigest()
+    session = SessionLocal()
+    try:
+        dialect = engine.dialect.name
+        values = {
+            "bucket_key": bucket_key,
+            "window_start": window_start,
+            "request_count": 1,
+            "updated_at": datetime.utcnow(),
+        }
+        if dialect == "sqlite":
+            statement = sqlite_insert(ApiRateLimitBucket).values(**values)
+            statement = statement.on_conflict_do_update(
+                index_elements=[ApiRateLimitBucket.bucket_key],
+                set_={
+                    "window_start": window_start,
+                    "request_count": case(
+                        (ApiRateLimitBucket.window_start == window_start,
+                         case((ApiRateLimitBucket.request_count < limit + 1,
+                               ApiRateLimitBucket.request_count + 1), else_=limit + 1)),
+                        else_=1,
+                    ),
+                    "updated_at": datetime.utcnow(),
+                },
+            )
+        elif dialect == "postgresql":
+            statement = postgresql_insert(ApiRateLimitBucket).values(**values)
+            statement = statement.on_conflict_do_update(
+                index_elements=[ApiRateLimitBucket.bucket_key],
+                set_={
+                    "window_start": window_start,
+                    "request_count": case(
+                        (ApiRateLimitBucket.window_start == window_start,
+                         case((ApiRateLimitBucket.request_count < limit + 1,
+                               ApiRateLimitBucket.request_count + 1), else_=limit + 1)),
+                        else_=1,
+                    ),
+                    "updated_at": datetime.utcnow(),
+                },
+            )
+        elif dialect == "mysql":
+            statement = mysql_insert(ApiRateLimitBucket).values(**values)
+            statement = statement.on_duplicate_key_update(
+                [
+                    # MySQL evaluates ON DUPLICATE KEY UPDATE assignments left-to-right.
+                    # Read the old window before replacing it, or a new minute would
+                    # incorrectly continue the prior minute's count.
+                    ("request_count", case(
+                        (ApiRateLimitBucket.window_start == window_start,
+                         case((ApiRateLimitBucket.request_count < limit + 1,
+                               ApiRateLimitBucket.request_count + 1), else_=limit + 1)),
+                        else_=1,
+                    )),
+                    ("window_start", window_start),
+                    ("updated_at", datetime.utcnow()),
+                ]
+            )
+        else:
+            raise RuntimeError(f"Unsupported SQL dialect for shared rate limiting: {dialect}")
+
+        session.execute(statement)
+        bucket = session.get(ApiRateLimitBucket, bucket_key)
+        if not bucket:
+            raise RuntimeError("Rate limit bucket upsert did not produce a row")
+        request_count = bucket.request_count
+        session.commit()
+        if request_count > limit:
+            raise HTTPException(status_code=429, detail=f"请求过于频繁，限流 {limit}/分钟，请稍后再试")
+        _cleanup_old_buckets_if_due()
+    except HTTPException:
+        session.rollback()
+        raise
+    except Exception as exc:
+        session.rollback()
+        logger.error("SHARED_RATE_LIMIT_DB_FAIL | scope=%s | error_type=%s", scope, type(exc).__name__)
+        raise HTTPException(status_code=503, detail="限流服务暂不可用") from exc
+    finally:
+        session.close()
+
+
+def _cleanup_old_buckets_if_due() -> None:
+    global _last_cleanup_at
+    now = time.time()
+    if now - _last_cleanup_at < 900:
+        return
+    if not _cleanup_lock.acquire(blocking=False):
+        return
+    try:
+        if now - _last_cleanup_at < 900:
+            return
+        session = SessionLocal()
+        try:
+            session.execute(delete(ApiRateLimitBucket).where(ApiRateLimitBucket.window_start < int(now) - 86_400))
+            session.execute(delete(VerificationContactCooldown).where(
+                VerificationContactCooldown.last_sent_at < int(now) - 86_400
+            ))
+            session.execute(delete(VerificationCode).where(VerificationCode.expires_at < int(now)))
+            session.commit()
+            _last_cleanup_at = now
+        except Exception:
+            session.rollback()
+            logger.warning("SHARED_RATE_LIMIT_CLEANUP_FAIL")
+        finally:
+            session.close()
+    finally:
+        _cleanup_lock.release()
+
+
+def shared_limit(limit: int):
+    """FastAPI endpoint decorator backed by the shared SQL minute-window table."""
+    if not isinstance(limit, int) or limit < 1:
+        raise ValueError("limit must be a positive integer")
+
+    def decorate(endpoint):
+        scope = f"{endpoint.__module__}.{endpoint.__name__}"
+
+        @wraps(endpoint)
+        async def wrapped(*args, **kwargs):
+            request = kwargs.get("request")
+            if request is None:
+                request = next((arg for arg in args if isinstance(arg, Request)), None)
+            if request is None:
+                raise RuntimeError(f"{scope} requires a FastAPI Request parameter")
+            identity = await run_in_threadpool(get_rate_limit_key, request)
+            await run_in_threadpool(_consume_shared_limit, identity, scope, limit)
+            return await endpoint(*args, **kwargs)
+
+        return wrapped
+
+    return decorate
+
+
+def reserve_contact_cooldown(contact: str, cooldown_seconds: int) -> int:
+    """原子预留联系方式冷却；返回 0 表示成功，否则返回剩余秒数。"""
+    normalized = str(contact or "").strip().casefold()
+    contact_key = hashlib.sha256(normalized.encode("utf-8")).hexdigest()
+    now = int(time.time())
+    cutoff = now - cooldown_seconds
+    claim_id = hashlib.sha256(f"{contact_key}:{now}:{time.time_ns()}".encode()).hexdigest()[:32]
+    session = SessionLocal()
+    try:
+        values = {"contact_key": contact_key, "last_sent_at": now, "claim_id": claim_id}
+        dialect = engine.dialect.name
+        if dialect == "sqlite":
+            statement = sqlite_insert(VerificationContactCooldown).values(**values)
+            statement = statement.on_conflict_do_update(
+                index_elements=[VerificationContactCooldown.contact_key],
+                set_={
+                    "last_sent_at": case((VerificationContactCooldown.last_sent_at <= cutoff, now),
+                                         else_=VerificationContactCooldown.last_sent_at),
+                    "claim_id": case((VerificationContactCooldown.last_sent_at <= cutoff, claim_id),
+                                     else_=VerificationContactCooldown.claim_id),
+                },
+            )
+        elif dialect == "postgresql":
+            statement = postgresql_insert(VerificationContactCooldown).values(**values)
+            statement = statement.on_conflict_do_update(
+                index_elements=[VerificationContactCooldown.contact_key],
+                set_={
+                    "last_sent_at": case((VerificationContactCooldown.last_sent_at <= cutoff, now),
+                                         else_=VerificationContactCooldown.last_sent_at),
+                    "claim_id": case((VerificationContactCooldown.last_sent_at <= cutoff, claim_id),
+                                     else_=VerificationContactCooldown.claim_id),
+                },
+            )
+        elif dialect == "mysql":
+            statement = mysql_insert(VerificationContactCooldown).values(**values)
+            statement = statement.on_duplicate_key_update(
+                [
+                    # Evaluate eligibility against the old timestamp before advancing it.
+                    ("claim_id", case((VerificationContactCooldown.last_sent_at <= cutoff, claim_id),
+                                      else_=VerificationContactCooldown.claim_id)),
+                    ("last_sent_at", case((VerificationContactCooldown.last_sent_at <= cutoff, now),
+                                          else_=VerificationContactCooldown.last_sent_at)),
+                ]
+            )
+        else:
+            raise RuntimeError(f"Unsupported SQL dialect for contact cooldown: {dialect}")
+
+        session.execute(statement)
+        record = session.get(VerificationContactCooldown, contact_key)
+        if not record:
+            raise RuntimeError("Contact cooldown upsert did not produce a row")
+        allowed = record.claim_id == claim_id
+        last_sent_at = record.last_sent_at
+        session.commit()
+        return 0 if allowed else max(1, cooldown_seconds - (now - last_sent_at))
+    except Exception as exc:
+        session.rollback()
+        logger.error("CONTACT_COOLDOWN_DB_FAIL | error_type=%s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="验证码发送频控暂不可用") from exc
+    finally:
+        session.close()
+
+
+def _verification_key(key: str) -> str:
+    return hashlib.sha256(str(key).strip().casefold().encode("utf-8")).hexdigest()
+
+
+def _verification_digest(key: str, code: str) -> str:
+    return hmac.new(JWT_SECRET.encode("utf-8"), f"{_verification_key(key)}\0{code}".encode("utf-8"), hashlib.sha256).hexdigest()
+
+
+def store_verification_code(key: str, code: str, expires_at: int) -> None:
+    """存储跨 worker 可用的一次性验证码，不保存验证码或联系方式明文。"""
+    session = SessionLocal()
+    try:
+        session.merge(VerificationCode(contact_key=_verification_key(key),
+                                        code_digest=_verification_digest(key, code),
+                                        expires_at=int(expires_at)))
+        session.commit()
+    except Exception as exc:
+        session.rollback()
+        logger.error("VERIFICATION_CODE_STORE_FAIL | error_type=%s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="验证码服务暂不可用") from exc
+    finally:
+        session.close()
+
+
+def consume_verification_code(key: str, code: str, session=None) -> bool:
+    """正确且未过期时原子删除验证码；可传入业务事务 session 一并提交。"""
+    owns_session = session is None
+    session = session or SessionLocal()
+    try:
+        result = session.execute(delete(VerificationCode).where(
+            VerificationCode.contact_key == _verification_key(key),
+            VerificationCode.code_digest == _verification_digest(key, code),
+            VerificationCode.expires_at >= int(time.time()),
+        ))
+        consumed = result.rowcount == 1
+        if owns_session:
+            session.commit()
+        return consumed
+    except Exception as exc:
+        if owns_session:
+            session.rollback()
+        logger.error("VERIFICATION_CODE_CONSUME_FAIL | error_type=%s", type(exc).__name__)
+        raise HTTPException(status_code=503, detail="验证码服务暂不可用") from exc
+    finally:
+        if owns_session:
+            session.close()

recharge_transaction.py

@@ -0,0 +1,90 @@
+"""充值只信任持久订单；回调与主动查单共用同一到账事务。"""
+import hashlib
+import re
+from decimal import Decimal
+from sqlalchemy.orm import Session
+from models_sql import RechargeOrder, Transaction
+from tip_transaction import lock_wallet_accounts
+
+
+def payment_amount(value):
+    if not isinstance(value, str) or not re.fullmatch(r"[0-9]{1,5}(?:\.[0-9]{1,2})?", value):
+        raise ValueError("invalid payment amount")
+    amount = Decimal(value)
+    if not 1 <= amount <= 10000 or amount != amount.to_integral_value():
+        raise ValueError("invalid payment amount")
+    return int(amount)
+
+
+def validate_order(row):
+    if (row is None or not isinstance(row.account, str) or not row.account.strip()
+            or type(row.amount) is not int or not 1 <= row.amount <= 10000
+            or row.status not in {"pending", "paid"}):
+        raise ValueError("invalid recharge order")
+
+
+def validate_ledger(tx, account, amount):
+    if tx is not None and (tx.account != account or tx.tx_type != "RECHARGE"
+            or type(tx.amount) is not int or tx.amount != amount):
+        raise ValueError("invalid recharge ledger")
+
+
+def read_order(db, order_id):
+    if not isinstance(order_id, str) or not re.fullmatch(r"PAY_[0-9a-f]{32}", order_id):
+        return None
+    # 网络查单前的读取不在业务 Session 留下事务或钱包锁。
+    with Session(bind=db.get_bind(), autoflush=False) as lookup:
+        row = lookup.get(RechargeOrder, order_id)
+        if row is None:
+            return None
+        validate_order(row)
+        tx = lookup.get(Transaction, order_id)
+        validate_ledger(tx, row.account, row.amount)
+        if row.status == "paid" and tx is None:
+            raise ValueError("paid recharge ledger missing")
+        return {"account": row.account, "amount": row.amount, "credited": tx is not None}
+
+
+def persist_order(db, order_id, account, amount):
+    if type(amount) is not int or not 1 <= amount <= 10000 or not isinstance(account, str) or not account.strip():
+        raise ValueError("invalid recharge request")
+    try:
+        db.add(RechargeOrder(order_id=order_id, account=account, amount=amount, status="pending"))
+        db.commit()
+    except Exception:
+        db.rollback()
+        raise
+
+
+def credit_order(db, order_id, amount):
+    info = read_order(db, order_id)
+    if info is None or type(amount) is not int or amount != info["amount"]:
+        raise ValueError("payment order mismatch")
+    account = info["account"]
+    try:
+        wallet = lock_wallet_accounts(db, (account,), (account,))[account]
+        row = db.query(RechargeOrder).filter(RechargeOrder.order_id == order_id).populate_existing().with_for_update().first()
+        validate_order(row)
+        if row.account != account or row.amount != amount:
+            raise ValueError("payment order changed")
+        tx = db.query(Transaction).filter(Transaction.tx_id == order_id).populate_existing().with_for_update().first()
+        validate_ledger(tx, account, amount)
+        if tx is not None:
+            row.status = "paid"
+            db.commit()
+            return False
+        if row.status != "pending" or type(wallet.balance) is not int:
+            raise ValueError("invalid recharge state")
+        last = db.query(Transaction).filter(Transaction.account == account).order_by(
+            Transaction.created_at.desc(), Transaction.tx_id.desc()).with_for_update().first()
+        previous = last.tx_hash if last else "GENESIS_HASH"
+        digest = hashlib.sha256(f"{order_id}{account}RECHARGE{amount}{previous}".encode()).hexdigest()
+        wallet.balance += amount
+        row.status = "paid"
+        db.add(Transaction(tx_id=order_id, account=account, tx_type="RECHARGE", amount=amount,
+                           prev_hash=previous, tx_hash=digest, description="支付宝充值"))
+        db.commit()
+        return True
+    except Exception:
+        db.rollback()
+        raise

requirements-build.lock

@@ -0,0 +1,13 @@
+# Source SDK build tools, pinned separately from runtime dependencies.
+
+packaging==26.3 \
+    --hash=sha256:94edc256424af38762eb31306eed28beb9f0efc50a8837492c9d6fd6004aed79 \
+    --hash=sha256:d7193f7c8e4e93f444fde0262bf90af30e16fa0ad0ad44cb553c87339b23cd1c
+
+setuptools==84.0.0 \
+    --hash=sha256:51a52592b3b99e102b609654876bd65f19f999935166d1352678931132b0c670 \
+    --hash=sha256:f4695c21257f0d9b537ec2692c941d02ee143b7cc1276941349a546573b2ef73
+
+wheel==0.48.0 \
+    --hash=sha256:3217dcc807155e45db462d7ef2431f5ddda0d7273b700d05a67b271ceb1287ab \
+    --hash=sha256:94800765601e9171bf5d58d066e640662842bcedcbab982b2c90787a2c987322

requirements.txt

@@ -1,19 +1,23 @@
-# 🔒 P0安全修复：依赖版本锁定，防止供应链攻击和不兼容更新
-fastapi==0.104.1
+# 直接依赖入口；生产部署以requirements.lock固定完整依赖并校验SHA256
+fastapi==0.142.2
 uvicorn==0.24.0
-pydantic==2.5.2
+pydantic==2.13.5
 huggingface_hub==0.19.4
 # 🧹 P2清理：datasets/aiofiles 全库零引用，已移除
-python-multipart==0.0.6
+python-multipart==0.0.32
 alibabacloud_dysmsapi20170525==2.0.24
 # 🧹 P2修复：verify_code_engine.py 直接导入 alibabacloud_tea_openapi，显式声明避免隐式依赖漂移
 alibabacloud_tea_openapi==0.3.8
 sqlalchemy==2.0.23
 psycopg2-binary==2.9.9
 httpx==0.25.2
-# 🚀 P2优化：速率限制
-slowapi==0.1.9
+# HTTPX 0.25.2 使用的连接后端直接依赖，供下载代理绑定已校验 DNS 地址到 TCP 连接
+httpcore==1.0.9
 # 🔒 P0安全增强：bcrypt密码哈希
 bcrypt==4.1.2
 # 🔧 P0修复：升级支付宝SDK，打破旧版死锁，自动适配最新安全加密库
-python-alipay-sdk>=3.3.0
+python-alipay-sdk==3.4.0
+
+# 表单解析与异步资源管理的安全修复版本，与FastAPI组合验证
+starlette==1.7.0
+anyio==4.15.1

resource_deletion.py

@@ -0,0 +1,208 @@
+"""资源删除的本地恢复记录与关联清理；不访问或修改资金数据。"""
+import asyncio
+import copy
+import datetime
+import logging
+import re
+import threading
+import uuid
+from resource_store import ResourceStoreError, _records
+
+DELETION_FILE = 'resource_deletions.json'
+resource_mutation_lock = threading.RLock()
+logger = logging.getLogger(__name__)
+
+
+def _queue(source):
+    if not isinstance(source, dict):
+        raise ValueError('invalid resource deletion source')
+    for item_id, entry in source.items():
+        if (not isinstance(item_id, str) or not item_id.strip() or not isinstance(entry, dict)
+                or entry.get('item_id') != item_id or type(entry.get('schema')) is not int or entry['schema'] != 1
+                or not isinstance(entry.get('author'), str) or not entry['author'].strip()
+                or not isinstance(entry.get('ticket'), str) or not re.fullmatch(r'[0-9a-f]{32}', entry['ticket'])
+                or entry.get('state') not in ('pending', 'complete')):
+            raise ValueError('invalid resource deletion record')
+    return source
+
+
+def _read_queue(store):
+    return _queue(store.load_data(DELETION_FILE, default_data={}, strict=True, skip_cache=True))
+
+
+def _read_items(store):
+    return _records(store.load_data('items.json', default_data=[], strict=True, skip_cache=True))
+
+
+def assert_id_not_deleted(store, item_id):
+    if item_id in _read_queue(store):
+        raise ResourceStoreError(409, '资源编号已用于删除，不能重复使用')
+
+
+def assert_comment_target_active(store, item_id):
+    if item_id not in _read_queue(store):
+        return
+    if not any(item['id'] == item_id for item in _read_items(store)):
+        raise ResourceStoreError(404, '资源已删除，不能添加评论')
+
+
+def _authorized(author, account, can_moderate):
+    if not isinstance(author, str) or not author.strip():
+        raise ValueError('invalid resource author')
+    if author != account and can_moderate is not True:
+        raise ResourceStoreError(403, '无权删除他人发布的内容')
+
+
+def _prepare(store, item):
+    receipt = dict(schema=1, item_id=item['id'], author=item['author'], ticket=uuid.uuid4().hex,
+                   state='pending', created_at=datetime.datetime.now(datetime.timezone.utc).isoformat())
+    expected = None
+    def update(source):
+        nonlocal expected
+        queue = _queue(source)
+        old = queue.get(item['id'])
+        if old:
+            if old['author'] != item['author']:
+                raise ValueError('ambiguous deletion owner')
+            if old['state'] == 'pending':
+                expected = copy.deepcopy(old)
+                return copy.deepcopy(old)
+        queue[item['id']] = copy.deepcopy(receipt)
+        expected = copy.deepcopy(receipt)
+        return copy.deepcopy(receipt)
+    try:
+        return store.atomic_update(DELETION_FILE, update, default_data={})
+    except Exception:
+        confirmed = _read_queue(store).get(item['id'])
+        if expected and confirmed == expected and confirmed['state'] == 'pending':
+            return copy.deepcopy(confirmed)
+        raise
+
+
+def _drop_bucket(store, filename, item_id):
+    source = store.load_data(filename, default_data={}, strict=True, skip_cache=True)
+    if not isinstance(source, dict):
+        raise ValueError('invalid associated resource source')
+    if item_id not in source:
+        return False
+    def update(current):
+        if not isinstance(current, dict):
+            raise ValueError('invalid associated resource source')
+        return current.pop(item_id, None) is not None
+    store.atomic_update(filename, update, default_data={})
+    return True
+
+
+def _cleanup(store, receipt):
+    """调用者持协调锁；严格确认主资源已不存在才清理本ID关联数据。"""
+    item_id = receipt['item_id']
+    if any(item['id'] == item_id for item in _read_items(store)):
+        return False, False
+    current = _read_queue(store).get(item_id)
+    if not current or current['ticket'] != receipt['ticket']:
+        return False, False
+    changed = _drop_bucket(store, 'comments.json', item_id)
+    changed = _drop_bucket(store, 'versions.json', item_id) or changed
+    if current['state'] == 'complete':
+        return True, changed
+    def acknowledge(source):
+        queue = _queue(source)
+        entry = queue.get(item_id)
+        if not entry or entry['ticket'] != receipt['ticket']:
+            return False
+        entry['state'] = 'complete'
+        entry.setdefault('completed_at', datetime.datetime.now(datetime.timezone.utc).isoformat())
+        return True
+    acknowledged = store.atomic_update(DELETION_FILE, acknowledge, default_data={})
+    return bool(acknowledged), bool(acknowledged) or changed
+
+
+def delete_resource(store, item_id, account, can_moderate=False):
+    try:
+        with resource_mutation_lock:
+            source = _read_items(store)
+            item = next((item for item in source if item['id'] == item_id), None)
+            if item is None:
+                receipt = _read_queue(store).get(item_id)
+                if receipt is None:
+                    raise ResourceStoreError(404, '找不到该内容记录')
+                _authorized(receipt['author'], account, can_moderate)
+            else:
+                _authorized(item.get('author'), account, can_moderate)
+                receipt = _prepare(store, item)
+                attempted = False
+                def remove(current):
+                    nonlocal attempted
+                    records = _records(current)
+                    index = next((index for index, value in enumerate(records) if value['id'] == item_id), None)
+                    if index is not None:
+                        _authorized(records[index].get('author'), account, can_moderate)
+                        if records[index]['author'] != receipt['author']:
+                            raise ValueError('changed resource author')
+                        records.pop(index)
+                    attempted = True
+                try:
+                    store.atomic_update('items.json', remove, default_data=[])
+                except ResourceStoreError:
+                    raise
+                except Exception:
+                    if not attempted or any(item['id'] == item_id for item in _read_items(store)):
+                        raise
+                    logger.warning('资源主删除本地已核实，后续同步暂未确认')
+            # 清理失败不能把已经核实的主删除误报为失败；保留恢复记录继续重试。
+            try:
+                complete, _ = _cleanup(store, receipt)
+            except Exception as error:
+                logger.warning('资源删除关联清理待重试: error_type=%s', type(error).__name__)
+                complete = False
+            return dict(cleanup_pending=not complete)
+    except ResourceStoreError:
+        raise
+    except Exception:
+        raise ResourceStoreError(503, '资源删除暂时无法核实，请稍后核对') from None
+
+
+def repair_resource_deletions(store, cursor=0, limit=50, should_stop=lambda: False):
+    queue = _read_queue(store)
+    ids = list(queue)
+    if not ids:
+        return 0, 0
+    start = cursor % len(ids)
+    selected = (ids[start:] + ids[:start])[:limit]
+    changed = 0
+    processed = 0
+    for item_id in selected:
+        if should_stop():
+            break
+        try:
+            with resource_mutation_lock:
+                _, updated = _cleanup(store, queue[item_id])
+                changed += bool(updated)
+        except Exception as error:
+            logger.warning('资源删除恢复失败: error_type=%s', type(error).__name__)
+        processed += 1
+    return (start + processed) % len(ids), changed
+
+
+async def resource_deletion_worker(store, stop, invalidate=None, interval=30):
+    initialized = False
+    cursor = 0
+    while not stop.is_set():
+        try:
+            if not initialized:
+                await asyncio.to_thread(store.atomic_update, DELETION_FILE, _queue, default_data={})
+                initialized = True
+            cursor, changed = await asyncio.to_thread(repair_resource_deletions, store, cursor, 50, stop.is_set)
+            if changed and invalidate:
+                try:
+                    invalidate('items:')
+                except Exception:
+                    logger.warning('资源删除恢复后的排序失效失败')
+        except Exception as error:
+            logger.warning('资源删除恢复轮次失败: error_type=%s', type(error).__name__)
+        if stop.is_set():
+            break
+        try:
+            await asyncio.wait_for(stop.wait(), timeout=interval)
+        except asyncio.TimeoutError:
+            pass

resource_probe_service.py

@@ -0,0 +1,93 @@
+"""资源可用性预检：可信资源记录决定来源；不替代真实下载所有权核查。"""
+import logging
+import os
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+import uuid
+from fastapi.responses import JSONResponse
+from github_source import repository_parts
+from proxy_access import read_proxy_item, ProxyAccessError
+from workflow_source import authorized_workflow_path, WorkflowSourceError
+
+logger = logging.getLogger("ComfyUI-Ranking")
+
+
+def probe_resource(item_id, *, store, download, open_url, token_selector, error_response):
+    # 购买前只探测资源可用性；真实下载仍须通过独立所有权授权。
+    try:
+        item = read_proxy_item(store, item_id)
+    except ProxyAccessError as error:
+        return JSONResponse(content={"error": error.message}, status_code=error.status_code)
+    target_url = item.get("link")
+    if not isinstance(target_url, str):
+        return JSONResponse(content={"error": "无效的下载链接"}, status_code=400)
+    try:
+        parsed = urllib.parse.urlsplit(target_url)
+        valid_origin = parsed.scheme == "https" and not parsed.username and not parsed.password and parsed.port in (None, 443)
+    except ValueError:
+        valid_origin = False
+    if not valid_origin:
+        return JSONResponse(content={"error": "无效的下载链接"}, status_code=400)
+    if (parsed.hostname == "zhiwei666-comfyui-ranking-api.hf.space"
+            and parsed.path == "/api/image_proxy"):
+        return JSONResponse(content={"error": "工作流下载不使用公开媒体地址，请重新上传"}, status_code=400)
+    if parsed.hostname not in ("github.com", "huggingface.co"):
+        return JSONResponse(content={"error": "无效的下载链接"}, status_code=400)
+    try:
+        if target_url.startswith("https://github.com/"):
+            owner, repo = repository_parts(target_url)
+            active_token = token_selector(item)
+            headers = {"User-Agent": "ComfyUI-Ranking-SaaS"}
+            if active_token:
+                headers["Authorization"] = f"Bearer {active_token}"
+            api_url = f"https://api.github.com/repos/{owner}/{repo}"
+
+            req = urllib.request.Request(api_url, headers=headers)
+            with open_url(req, timeout=10) as response:
+                if response.status != 200:
+                    return JSONResponse(content={"error": "资源仓库不可访问，可能已被作者删除或设为私有"}, status_code=404)
+            return {"status": "success", "message": "资源有效"}
+
+        elif target_url.startswith("https://huggingface.co/datasets/"):
+            hf_token = os.environ.get("HF_TOKEN")
+            if not hf_token:
+                return JSONResponse(content={"error": "资源源站暂时无法访问"}, status_code=503)
+            expected_prefix = f"https://huggingface.co/datasets/{store.DATASET_REPO_ID}/resolve/main/"
+            if not target_url.startswith(expected_prefix) or parsed.query or parsed.fragment:
+                return JSONResponse(content={"error": "无效的下载链接"}, status_code=400)
+            repo_path_encoded = target_url[len(expected_prefix):]
+            repo_path = urllib.parse.unquote(repo_path_encoded)
+            if not repo_path or any(part in ("", ".", "..") for part in repo_path.split("/")) or "\\" in repo_path:
+                return JSONResponse(content={"error": "无效的下载链接"}, status_code=400)
+
+            authorized_workflow_path(store, item, target_url)
+            cached_file_path = download(
+                repo_id=store.DATASET_REPO_ID,
+                repo_type="dataset",
+                filename=repo_path,
+                token=hf_token
+            )
+            if not os.path.exists(cached_file_path):
+                return JSONResponse(content={"error": "云端文件不存在，可能已被作者删除"}, status_code=404)
+
+            return {"status": "success", "message": "资源有效"}
+
+    except WorkflowSourceError as error:
+        return JSONResponse(content={"error": error.message}, status_code=error.status_code)
+    except urllib.error.HTTPError as e:
+        return JSONResponse(content={"error": f"资源探测失败，源站返回: {e.code}。请联系作者处理。"}, status_code=400)
+    except Exception as e:
+        error_id = f"ERR_{int(time.time())}_{uuid.uuid4().hex[:8]}"
+        upstream_status = getattr(getattr(e, "response", None), "status_code", None)
+        if not isinstance(upstream_status, int):
+            upstream_status = getattr(e, "code", None)
+        status_text = f" status={upstream_status}" if isinstance(upstream_status, int) and 100 <= upstream_status <= 599 else ""
+        logger.warning(f"RESOURCE_PROBE_FAIL | error_id={error_id} | error_type={type(e).__name__}{status_text}")
+        return JSONResponse(
+            status_code=502,
+            content=error_response(502, "资源源站暂时无法访��，请稍后重试", "upstream_error", error_id=error_id),
+        )
+
+    return JSONResponse(content={"error": "无效的下载链接"}, status_code=400)

resource_publication.py

@@ -0,0 +1,188 @@
+"""持久发布身份先入SQL；JSON失败可恢复，同次重试不制造新资源。"""
+import asyncio
+import copy
+import hashlib
+import json
+import logging
+import re
+from sqlalchemy.orm import Session
+from models_sql import ResourcePublication
+from resource_store import ResourceStoreError, _records
+
+
+def _serialize(value):
+    return json.dumps(value, sort_keys=True, ensure_ascii=True, allow_nan=False)
+
+
+CREATE_FIELDS = frozenset(('type', 'title', 'shortDesc', 'fullDesc', 'link', 'coverUrl', 'imageUrls',
+    'author', 'price', 'github_token', 'netdisk_password', 'is_netdisk', 'is_original', 'allow_refund'))
+
+
+def _request_receipt(request):
+    if not isinstance(request, dict) or set(request) - CREATE_FIELDS or not {'author', 'price', 'type'} <= set(request):
+        raise ValueError('invalid publication request')
+    return _serialize({'fields': sorted(request), 'sha256': hashlib.sha256(_serialize(request).encode()).hexdigest()})
+
+
+def _receipt(row):
+    record = json.loads(row.payload)
+    request = json.loads(row.request_payload)
+    if (not isinstance(record, dict) or not isinstance(request, dict) or set(request) != {'fields', 'sha256'}
+            or not isinstance(request.get('fields'), list) or not all(isinstance(key, str) for key in request['fields'])
+            or len(set(request['fields'])) != len(request['fields']) or set(request['fields']) - CREATE_FIELDS
+            or not {'author', 'price', 'type'} <= set(request['fields'])
+            or not re.fullmatch(r'[0-9a-f]{64}', request.get('sha256') or '')
+            or not re.fullmatch(r'[0-9a-f]{64}', row.request_key or '')
+            or not re.fullmatch(r'[A-Za-z0-9_-]{1,100}', row.item_id or '')
+            or not isinstance(row.author, str) or not row.author.strip()
+            or record.get('id') != row.item_id or record.get('author') != row.author
+            or not isinstance(record.get('type'), str) or not record['type']
+            or type(record.get('price')) is not int or record['price'] < 0
+            or type(record.get('created_at')) is not int or type(row.projected) is not bool):
+        raise ValueError('invalid resource publication receipt')
+    if not row.projected:
+        original = {key: record[key] for key in request['fields']}
+        if _request_receipt(original) != _serialize(request):
+            raise ValueError('publication request differs from payload')
+    elif set(record) != {'id', 'author', 'type', 'price', 'created_at'}:
+        raise ValueError('invalid publication summary')
+    return copy.deepcopy(record), _serialize(request)
+
+
+def _project(store, record, *, allow_insert=True):
+    from resource_deletion import resource_mutation_lock, assert_id_not_deleted
+    def select(records):
+        matches = [entry for entry in _records(records) if entry['id'] == record['id']]
+        if not matches:
+            return None
+        item = matches[0]
+        if any(item.get(key) != record.get(key) for key in ('author', 'type', 'created_at')):
+            raise ResourceStoreError(409, '资源发布记录冲突')
+        return copy.deepcopy(item)
+    with resource_mutation_lock:
+        assert_id_not_deleted(store, record['id'])
+        current = select(store.load_data('items.json', default_data=[], strict=True, skip_cache=True))
+        if current is not None:
+            return current, False
+        if not allow_insert:
+            raise ResourceStoreError(503, '已发布资源当前无法核实，请先核对个人作品')
+        result = None
+        def append(records):
+            nonlocal result
+            assert_id_not_deleted(store, record['id'])
+            result = select(records)
+            if result is None:
+                records.insert(0, copy.deepcopy(record))
+                result = copy.deepcopy(record)
+        try:
+            store.atomic_update('items.json', append, default_data=[], force_sync=bool(record.get('github_token')))
+        except Exception:
+            # 本地替换后远端同步可能失败，只在最新完整记录可核实时确认。
+            current = select(store.load_data('items.json', default_data=[], strict=True, skip_cache=True))
+            if current is None:
+                raise
+            return current, True
+        return result, True
+
+
+def publish_once(bind, store, record, request_id, request):
+    if not isinstance(request_id, str) or not re.fullmatch(r'[0-9a-f]{32}', request_id):
+        raise ResourceStoreError(400, '发布请求编号无效')
+    author = record.get('author')
+    if not isinstance(author, str) or not author.strip():
+        raise ResourceStoreError(400, '发布作者无效')
+    key = hashlib.sha256(_serialize([author, request_id]).encode()).hexdigest()
+    try:
+        encoded_request = _request_receipt(request)
+        candidate = ResourcePublication(request_key=key, item_id=record['id'], author=author,
+            request_payload=encoded_request, payload=_serialize(record), projected=False)
+        if request.get('author') != author or _serialize({key: record.get(key) for key in request}) != _serialize(request):
+            raise ValueError('publication payload differs from request')
+        _receipt(candidate)
+        with Session(bind=bind, autoflush=False) as session:
+            try:
+                if session.get(ResourcePublication, key) is None:
+                    session.add(candidate)
+                    session.commit()
+            except Exception:
+                session.rollback()
+                # 唯一键并发或提交响应未知，下一独立读取核实持久结果。
+        with Session(bind=bind, autoflush=False) as session:
+            row = session.get(ResourcePublication, key)
+            if row is None:
+                raise ValueError('resource publication not confirmed')
+            saved, original_request = _receipt(row)
+            if type(row.projected) is not bool:
+                raise ValueError('invalid projection state')
+            projected = row.projected
+            if row.author != author or original_request != encoded_request:
+                raise ResourceStoreError(409, '同次发布内容已改变，请先核对原记录')
+        result, _ = _project(store, saved, allow_insert=not projected)
+        if not projected:
+            _confirm_projection(bind, key, saved['id'])
+        return result
+    except ResourceStoreError:
+        raise
+    except Exception:
+        raise ResourceStoreError(503, '资源发布结果暂时无法核实，请先核对个人作品') from None
+
+
+def _confirm_projection(bind, key, item_id):
+    with Session(bind=bind, autoflush=False) as session:
+        try:
+            row = session.get(ResourcePublication, key)
+            if row is None or row.item_id != item_id:
+                raise ValueError('publication receipt missing')
+            record, _ = _receipt(row)
+            summary = _serialize({field: record[field] for field in ('id', 'author', 'type', 'price', 'created_at')})
+            count = session.query(ResourcePublication).filter(ResourcePublication.request_key == key,
+                ResourcePublication.item_id == item_id, ResourcePublication.payload == row.payload,
+                ResourcePublication.projected.is_(False)).update(
+                    {'projected': True, 'payload': summary}, synchronize_session=False)
+            if count != 1:
+                session.expire_all()
+                confirmed = session.get(ResourcePublication, key)
+                if confirmed is None or confirmed.item_id != item_id or confirmed.projected is not True:
+                    raise ValueError('publication projection confirmation changed')
+                _receipt(confirmed)
+            session.commit()
+        except Exception:
+            session.rollback()
+            raise
+
+
+def repair_publications(bind, store, invalidate, cursor='', limit=50):
+    """轮转未确认投影，坏记录逐项隔离；已确认而后丢失的内容不猜测重建。"""
+    with Session(bind=bind, autoflush=False) as session:
+        rows = session.query(ResourcePublication).filter(ResourcePublication.projected.is_(False), ResourcePublication.request_key > cursor).order_by(
+            ResourcePublication.request_key).limit(limit).all()
+        snapshots = []
+        for row in rows:
+            try:
+                record, _ = _receipt(row)
+                snapshots.append((row.request_key, record))
+            except Exception:
+                logging.getLogger(__name__).warning('资源发布恢复跳过损坏记录')
+        next_cursor = rows[-1].request_key if rows else ''
+    for key, record in snapshots:
+        try:
+            _, changed = _project(store, record)
+            _confirm_projection(bind, key, record['id'])
+            if changed:
+                invalidate('items:')
+        except Exception:
+            logging.getLogger(__name__).warning('资源发布恢复暂未完成')
+    return next_cursor
+
+
+async def publication_worker(bind, store, invalidate, stop, interval=30):
+    cursor = ''
+    while not stop.is_set():
+        try:
+            cursor = await asyncio.to_thread(repair_publications, bind, store, invalidate, cursor)
+        except Exception:
+            logging.getLogger(__name__).warning('资源发布恢复轮次暂未完成')
+        try:
+            await asyncio.wait_for(stop.wait(), timeout=interval)
+        except asyncio.TimeoutError:
+            pass

resource_store.py

@@ -0,0 +1,148 @@
+"""资源发布/编辑的锁内局部修改与保存故障核实。"""
+import copy
+import logging
+import re
+import json
+import datetime
+from purchase_transaction import effective_resource_price
+
+
+class ResourceStoreError(Exception):
+    def __init__(self, status_code, message):
+        self.status_code = status_code
+        self.message = message
+        super().__init__(message)
+
+
+def _records(source):
+    if not isinstance(source, list):
+        raise ValueError('invalid resource source')
+    ids = []
+    for entry in source:
+        if not isinstance(entry, dict) or not isinstance(entry.get('id'), str) or not entry['id'].strip():
+            raise ValueError('invalid resource identity')
+        ids.append(entry['id'])
+    if len(ids) != len(set(ids)):
+        raise ValueError('ambiguous resource identities')
+    return source
+
+
+def publish_resource(store, record):
+    if not isinstance(record, dict):
+        raise ResourceStoreError(400, '资源发布参数无效')
+    saved = copy.deepcopy(record)
+    serialized = json.dumps(saved, sort_keys=True, ensure_ascii=True, allow_nan=False)
+    def matches(entry):
+        return json.dumps(entry, sort_keys=True, ensure_ascii=True, allow_nan=False) == serialized
+    if (not isinstance(saved.get('id'), str) or not re.fullmatch(r'[A-Za-z0-9_-]{1,100}', saved['id'])
+            or not isinstance(saved.get('author'), str) or not saved['author'].strip()
+            or type(saved.get('price')) is not int or saved['price'] < 0):
+        raise ResourceStoreError(400, '资源发布参数无效')
+    def append(source):
+        records = _records(source)
+        from resource_deletion import assert_id_not_deleted
+        assert_id_not_deleted(store, saved['id'])
+        matches = [entry for entry in records if entry['id'] == saved['id']]
+        if matches:
+            if json.dumps(matches[0], sort_keys=True, ensure_ascii=True, allow_nan=False) == serialized:
+                return
+            raise ResourceStoreError(409, '资源编号冲突，请重新提交')
+        records.insert(0, copy.deepcopy(saved))
+    try:
+        store.atomic_update('items.json', append, default_data=[], force_sync=bool(saved.get('github_token')))
+    except Exception as error:
+        # 本地替换成功后，HF排队/同步也可能失败；只有完整确认已保存才报告成功。
+        try:
+            records = _records(store.load_data('items.json', default_data=[], strict=True, skip_cache=True))
+            committed = any(matches(entry) for entry in records)
+        except Exception:
+            committed = False
+        if not committed:
+            if isinstance(error, ResourceStoreError):
+                raise error
+            raise ResourceStoreError(503, '资源保存暂时无法核实，请稍后核对') from None
+        logging.getLogger(__name__).warning('资源本地已保存，发布后同步暂未确认')
+    return copy.deepcopy(saved)
+
+
+def published_response(record):
+    response = copy.deepcopy(record)
+    response['has_private_token'] = bool(response.pop('github_token', None))
+    response.pop('netdisk_password', None)
+    return response
+
+
+def edit_resource(store, item_id, account, changes):
+    fields = {'title', 'shortDesc', 'fullDesc', 'link', 'coverUrl', 'imageUrls', 'price',
+              'github_token', 'netdisk_password', 'is_netdisk', 'is_original', 'allow_refund', 'expected_revision'}
+    if not isinstance(changes, dict) or set(changes) - fields:
+        raise ResourceStoreError(400, '资源编辑参数无效')
+    changes = {key: copy.deepcopy(value) for key, value in changes.items() if value is not None}
+    expected_revision = changes.pop('expected_revision', None)
+    if expected_revision is not None and (type(expected_revision) is not int or not 0 <= expected_revision <= 9007199254740991):
+        raise ResourceStoreError(400, '资源编辑版本无效')
+    if 'price' in changes and (type(changes['price']) is not int or changes['price'] < 0):
+        raise ResourceStoreError(400, '资源价格无效')
+    expected = None
+    result = None
+    def update(source):
+        nonlocal expected, result
+        records = _records(source)
+        index = next((index for index, record in enumerate(records) if record['id'] == item_id), None)
+        if index is None:
+            raise ResourceStoreError(404, '找不到该内容记录')
+        original = records[index]
+        author = original.get('author')
+        if not isinstance(author, str) or not author.strip():
+            raise ValueError('invalid resource author')
+        if author != account:
+            raise ResourceStoreError(403, '无权修改他人发布的内容')
+        revision = original.get('edit_revision', 0)
+        if type(revision) is not int or not 0 <= revision < 9007199254740991:
+            raise ValueError('invalid resource edit revision')
+        if expected_revision is not None and revision != expected_revision:
+            raise ResourceStoreError(409, 'resource_revision_conflict')
+        edited = copy.deepcopy(original)
+        edited['edit_revision'] = revision + 1
+        current_price = effective_resource_price(edited)
+        edited['price'] = current_price
+        pending = edited.get('pending_price')
+        effective = edited.get('pending_price_effective_at')
+        if type(pending) is int and pending == current_price and effective:
+            when = datetime.datetime.fromisoformat(effective)
+            now = datetime.datetime.now(when.tzinfo) if when.tzinfo else datetime.datetime.now()
+            if now >= when:
+                edited['pending_price'] = None
+                edited['pending_price_effective_at'] = None
+        price_change = None
+        for key, value in changes.items():
+            if key != 'price':
+                edited[key] = value
+        if 'price' in changes:
+            if changes['price'] != current_price:
+                effective_at = (datetime.datetime.now() + datetime.timedelta(hours=24)).isoformat()
+                edited.update(pending_price=changes['price'], pending_price_effective_at=effective_at)
+                price_change = dict(current_price=current_price, new_price=changes['price'], effective_at=effective_at)
+            else:
+                edited.update(pending_price=None, pending_price_effective_at=None)
+        result = dict(edit_revision=revision + 1, price_change_info=price_change,
+            source_changed=any(original.get(key) != edited.get(key) for key in ('link', 'github_token')))
+        expected = copy.deepcopy(edited)
+        records[index] = edited
+        return copy.deepcopy(result)
+    try:
+        return store.atomic_update('items.json', update, default_data=[], force_sync=bool(changes.get('github_token')))
+    except ResourceStoreError:
+        raise
+    except Exception:
+        if expected is not None:
+            try:
+                source = _records(store.load_data('items.json', default_data=[], strict=True, skip_cache=True))
+                serialized = json.dumps(expected, sort_keys=True, allow_nan=False)
+                confirmed = any(json.dumps(record, sort_keys=True, allow_nan=False) == serialized for record in source)
+            except Exception:
+                confirmed = False
+            if confirmed:
+                logging.getLogger(__name__).warning('资源编辑本地已保存，后续同步暂未确认')
+                return copy.deepcopy(result)
+        raise ResourceStoreError(503, '资源编辑保存暂时无法核实，请稍后核对') from None

response_privacy.py

@@ -0,0 +1,14 @@
+"""浏览器/共享 HTTP 缓存的私有响应边界，无数据库或应用依赖。"""
+import re
+
+_PRIVATE_PATH = re.compile(
+    r"^/api/(wallet|messages|chats|admin|disputes|users)(?:/|$)"
+    r"|^/api/my-(posts|prompts|tasks)(?:/|$)"
+    r"|^/api/(tasks|prompts)/[^/]+$"
+)
+
+
+def requires_no_store(path, authorization=None):
+    # 含 Authorization 的响应即使路径公开也不交给共享 HTTP 缓存。
+    # 匿名访问私有路径的错误响应及登录返回的 Token 同样不能缓存。
+    return bool(authorization or _PRIVATE_PATH.search(path))

router_admin_plugins.py

@@ -13,19 +13,22 @@
 
 import re
 import json
+import hmac
+import hashlib
 import secrets
 import logging
 import datetime
 from typing import Optional, List
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
+from rate_limit import shared_limit
 from fastapi.responses import JSONResponse
 from sqlalchemy.orm import Session
 from pydantic import BaseModel, Field, field_validator  # 🧹 P2修复：pydantic v2 已废弃 v1 风格 validator
 
 from database_sql import get_db
 from models_sql import RegisteredPlugin
-from 安全认证 import require_auth, is_admin
+from 安全认证 import require_auth, is_admin, JWT_SECRET
 
 logger = logging.getLogger("ComfyUI-Ranking.AdminPlugins")
 
@@ -42,6 +45,13 @@ _PLUGIN_ID_PATTERN = re.compile(r"^[a-z0-9_]{3,50}$")
 _DEFAULT_PERMISSIONS = ["verify", "balance", "deduct", "refund"]
 
 
+def _audit_actor_id(account: str) -> str:
+    """稳定关联管理员审计事件，但不把可识别账号写入运行日志。"""
+    return hmac.new(
+        JWT_SECRET.encode("utf-8"), str(account).encode("utf-8"), hashlib.sha256
+    ).hexdigest()[:16]
+
+
 def generate_plugin_key() -> str:
     """生成 plugin_key，格式: rk_plug_ + 32位hex随机串"""
     return f"rk_plug_{secrets.token_hex(16)}"
@@ -67,7 +77,7 @@ def _notify_registry_reload():
         reload_plugin_registry()
         logger.info("插件注册表热更新成功")
     except (ImportError, Exception) as e:
-        logger.warning(f"插件注册表热更新失败: {e}")
+        logger.warning(f"插件注册表热更新失败: error_type={type(e).__name__}")
 
 
 def _serialize_plugin(p: RegisteredPlugin, include_key: bool = False, raw_key: Optional[str] = None) -> dict:
@@ -178,7 +188,7 @@ async def list_plugins(
     except HTTPException:
         raise
     except Exception as e:
-        logger.exception(f"列出插件失败: {e}")
+        logger.error(f"列出插件失败: error_type={type(e).__name__}")
         return JSONResponse(status_code=500, content={"success": False, "error": "服务器内部错误"})
 
 
@@ -197,7 +207,9 @@ async def get_plugin(
 
 
 @router.post("/api/admin/plugins")
+@shared_limit(20)
 async def create_plugin(
+    request: Request,
     payload: PluginCreateRequest,
     account: str = Depends(require_auth),
     db: Session = Depends(get_db),
@@ -234,10 +246,10 @@ async def create_plugin(
         db.refresh(plugin)
     except Exception as e:
         db.rollback()
-        logger.exception(f"创建插件失败: {e}")
+        logger.error(f"创建插件失败: error_type={type(e).__name__}")
         return JSONResponse(status_code=500, content={"success": False, "error": "创建插件失败"})
 
-    logger.info(f"管理员 {account} 创建插件 plugin_id={payload.plugin_id}")
+    logger.info(f"ADMIN_PLUGIN_CREATE | actor={_audit_actor_id(account)} | plugin_id={payload.plugin_id}")
     _notify_registry_reload()
 
     return JSONResponse(status_code=201, content={
@@ -251,7 +263,9 @@ async def create_plugin(
 
 
 @router.put("/api/admin/plugins/{plugin_id}")
+@shared_limit(30)
 async def update_plugin(
+    request: Request,
     plugin_id: str,
     payload: PluginUpdateRequest,
     account: str = Depends(require_auth),
@@ -282,10 +296,13 @@ async def update_plugin(
         db.refresh(plugin)
     except Exception as e:
         db.rollback()
-        logger.exception(f"更新插件失败: {e}")
+        logger.error(f"更新插件失败: error_type={type(e).__name__}")
         return JSONResponse(status_code=500, content={"success": False, "error": "更新插件失败"})
 
-    logger.info(f"管理员 {account} 更新插件 plugin_id={plugin_id}, fields={list(update_fields.keys())}")
+    logger.info(
+        f"ADMIN_PLUGIN_UPDATE | actor={_audit_actor_id(account)} | plugin_id={plugin_id} | "
+        f"fields={','.join(sorted(update_fields.keys()))}"
+    )
     _notify_registry_reload()
 
     return JSONResponse(content={
@@ -296,7 +313,9 @@ async def update_plugin(
 
 
 @router.delete("/api/admin/plugins/{plugin_id}")
+@shared_limit(10)
 async def delete_plugin(
+    request: Request,
     plugin_id: str,
     account: str = Depends(require_auth),
     db: Session = Depends(get_db),
@@ -313,17 +332,19 @@ async def delete_plugin(
         db.commit()
     except Exception as e:
         db.rollback()
-        logger.exception(f"删除插件失败: {e}")
+        logger.error(f"删除插件失败: error_type={type(e).__name__}")
         return JSONResponse(status_code=500, content={"success": False, "error": "删除插件失败"})
 
-    logger.info(f"管理员 {account} 删除插件 plugin_id={plugin_id}")
+    logger.info(f"ADMIN_PLUGIN_DELETE | actor={_audit_actor_id(account)} | plugin_id={plugin_id}")
     _notify_registry_reload()
 
     return JSONResponse(content={"success": True, "message": "插件已删除", "plugin_id": plugin_id})
 
 
 @router.post("/api/admin/plugins/{plugin_id}/rotate-key")
+@shared_limit(5)
 async def rotate_plugin_key(
+    request: Request,
     plugin_id: str,
     account: str = Depends(require_auth),
     db: Session = Depends(get_db),
@@ -346,10 +367,10 @@ async def rotate_plugin_key(
         db.refresh(plugin)
     except Exception as e:
         db.rollback()
-        logger.exception(f"轮换 plugin_key 失败: {e}")
+        logger.error(f"轮换 plugin_key 失败: error_type={type(e).__name__}")
         return JSONResponse(status_code=500, content={"success": False, "error": "轮换 plugin_key 失败"})
 
-    logger.info(f"管理员 {account} 轮换插件 plugin_id={plugin_id} 的 plugin_key")
+    logger.info(f"ADMIN_PLUGIN_ROTATE_KEY | actor={_audit_actor_id(account)} | plugin_id={plugin_id}")
     _notify_registry_reload()
 
     return JSONResponse(content={
@@ -362,7 +383,9 @@ async def rotate_plugin_key(
 
 
 @router.post("/api/admin/plugins/{plugin_id}/toggle")
+@shared_limit(20)
 async def toggle_plugin(
+    request: Request,
     plugin_id: str,
     account: str = Depends(require_auth),
     db: Session = Depends(get_db),
@@ -381,10 +404,13 @@ async def toggle_plugin(
         db.refresh(plugin)
     except Exception as e:
         db.rollback()
-        logger.exception(f"切换插件状态失败: {e}")
+        logger.error(f"切换插件状态失败: error_type={type(e).__name__}")
         return JSONResponse(status_code=500, content={"success": False, "error": "切换插件状态失败"})
 
-    logger.info(f"管理员 {account} 切换插件 plugin_id={plugin_id} 状态为 enabled={plugin.enabled}")
+    logger.info(
+        f"ADMIN_PLUGIN_TOGGLE | actor={_audit_actor_id(account)} | plugin_id={plugin_id} | "
+        f"enabled={bool(plugin.enabled)}"
+    )
     _notify_registry_reload()
 
     return JSONResponse(content={

router_comments.py

@@ -4,19 +4,20 @@ import time
 import uuid
 from html import escape
 import 数据库连接 as db
+from comment_store import append_comment, delete_comment
 from notifications import add_notification
 from models import InteractionToggle, CommentCreate
 from 安全认证 import require_auth, is_admin
 
 # 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
-from slowapi import Limiter
-from slowapi.util import get_remote_address
-limiter = Limiter(key_func=get_remote_address)
+from rate_limit import shared_limit
+from db_utils import sort_cache
 
 router = APIRouter()
 
 @router.post("/api/interactions/toggle")
-async def toggle_interaction(interaction: InteractionToggle, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def toggle_interaction(request: Request, interaction: InteractionToggle, current_user: str = Depends(require_auth)):
     interaction.user_id = current_user  # 强制使用当前用户身份，防止伪造
     
     list_key = f"{interaction.action_type}d_by" 
@@ -54,6 +55,9 @@ async def toggle_interaction(interaction: InteractionToggle, current_user: str =
     
     if result_container.get("error"):
         raise HTTPException(status_code=404, detail=result_container["error"])
+
+    # 统一互动接口也会改变资源排序，成功提交后失效派生排序缓存。
+    sort_cache.invalidate("items:")
     
     # 通知在原子操作外发送（通知失败不影响主流程）
     if interaction.is_active:
@@ -62,7 +66,7 @@ async def toggle_interaction(interaction: InteractionToggle, current_user: str =
     return {"status": "success", "new_count": result_container["count"]}
 
 @router.post("/api/comments")
-@limiter.limit("10/minute")  # 🔒 安全限流：防止刷评论洗版（正常用户不会一分钟发 10 条以上）
+@shared_limit(10)  # 🔒 安全限流：防止刷评论洗版（正常用户不会一分钟发 10 条以上）
 async def post_comment(request: Request, comment: CommentCreate, current_user: str = Depends(require_auth)):
     comment.author = current_user  # 强制使用认证用户身份，防止伪造
     # 评论内容长度校验
@@ -70,12 +74,10 @@ async def post_comment(request: Request, comment: CommentCreate, current_user: s
         raise HTTPException(status_code=400, detail="评论长度必须在1-5000字符之间")
     # HTML 转义，防止 XSS
     comment.content = escape(comment.content)
-    comments_db = db.load_data("comments.json", default_data={}) 
     users_db = db.load_data("users.json", default_data={})
     author_info = users_db.get(comment.author, {})
     reply_name = users_db.get(comment.reply_to_user, {}).get("name", comment.reply_to_user) if comment.reply_to_user else None
 
-    item_comments = comments_db.get(comment.item_id, [])
     new_comment = {
         "id": f"c_{int(time.time())}_{uuid.uuid4().hex[:6]}", "author": comment.author, 
         "authorName": author_info.get("name", comment.author), "avatar": author_info.get("avatarDataUrl", ""),
@@ -83,122 +85,42 @@ async def post_comment(request: Request, comment: CommentCreate, current_user: s
         "isDeleted": False, "replies": [], "created_at": int(time.time())
     }
     
+    notification = None
     if comment.parent_id:
-        parent = next((c for c in item_comments if c["id"] == comment.parent_id), None)
-        if parent: 
-            parent["replies"].append(new_comment)
-            if comment.reply_to_user:
-                add_notification(comment.reply_to_user, {"type": "reply", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": "收到新的回复", "content": comment.content})
-        else: raise HTTPException(status_code=404, detail="找不到要回复的评论")
+        if comment.reply_to_user:
+            notification = (comment.reply_to_user, {"type": "reply", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": "收到新的回复", "content": comment.content})
     else: 
-        item_comments.append(new_comment)
         items_db = db.load_data("items.json", default_data=[])
         posts_db = db.load_data("posts.json", default_data=[])
         target_item = next((item for item in items_db if item["id"] == comment.item_id), None)
         target_post = next((post for post in posts_db if post["id"] == comment.item_id), None)
         if target_item:
-            add_notification(target_item.get("author", ""), {"type": "comment", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": target_item["title"], "content": comment.content})
+            notification = (target_item.get("author", ""), {"type": "comment", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": target_item["title"], "content": comment.content})
         elif target_post:
-            add_notification(target_post.get("author", ""), {"type": "comment", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": target_post.get("title", "") or "", "content": comment.content})
+            notification = (target_post.get("author", ""), {"type": "comment", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": target_post.get("title", "") or "", "content": comment.content})
         elif comment.item_id in users_db:
-            add_notification(comment.item_id, {"type": "comment", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": "您的个人留言板", "content": comment.content})
+            notification = (comment.item_id, {"type": "comment", "from_user": comment.author, "target_item_id": comment.item_id, "target_item_title": "您的个人留言板", "content": comment.content})
 
-    comments_db[comment.item_id] = item_comments
-    db.save_data("comments.json", comments_db)
+    append_comment(comment.item_id, new_comment, parent_id=comment.parent_id)
+    if notification:
+        add_notification(*notification)
     return {"status": "success", "data": new_comment}
 
 @router.delete("/api/comments/{item_id}/{comment_id}")
-async def soft_delete_comment(item_id: str, comment_id: str, account: str = Depends(require_auth)):
+@shared_limit(10)
+async def soft_delete_comment(request: Request, item_id: str, comment_id: str, account: str = Depends(require_auth)):
     """
     软删除评论
     权限规则：评论作者可删除自己的评论，帖子/内容作者可删除其帖子下的评论，管理员可删除任何评论
     """
-    comments_db = db.load_data("comments.json", default_data={})
     items_db = db.load_data("items.json", default_data=[])
     posts_db = db.load_data("posts.json", default_data=[])
     users_db = db.load_data("users.json", default_data={})
     tasks_db = db.load_data("tasks.json", default_data=[])
-    
-    item_comments = comments_db.get(item_id, [])
-    target_comment = None
-    
-    def find_comment(comments_list, depth=0):
-        """查找目标评论"""
-        if depth > 20:  # 防止极端嵌套导致栈溢出
-            return False
-        nonlocal target_comment
-        for c in comments_list:
-            if c["id"] == comment_id:
-                target_comment = c
-                return True
-            if "replies" in c and find_comment(c["replies"], depth + 1):
-                return True
-        return False
-    
-    if not find_comment(item_comments):
-        raise HTTPException(status_code=404, detail="找不到该评论")
-    
-    # 权限检查
-    is_comment_author = target_comment["author"] == account
-    is_admin_user = is_admin(account)
-    
-    # 检查是否为内容作者（帖子作者或资源作者）
-    is_content_author = False
-    # 检查是否为帖子作者
-    for post in posts_db:
-        if post["id"] == item_id and post.get("author") == account:
-            is_content_author = True
-            break
-    # 检查是否为资源作者
-    if not is_content_author:
-        for item in items_db:
-            if item["id"] == item_id and item.get("author") == account:
-                is_content_author = True
-                break
-    # 任务发布者
-    if not is_content_author:
-        for task in tasks_db:
-            if task["id"] == item_id and task.get("publisher") == account:
-                is_content_author = True
-                break
-    # 检查是否为个人主页留言板作者
-    if not is_content_author:
-        if item_id in users_db and item_id == account:
-            is_content_author = True
-    
-    # 权限判断：评论作者、内容作者或管理员可删除
-    if not (is_comment_author or is_content_author or is_admin_user):
-        raise HTTPException(status_code=403, detail="无权删除此评论")
-    
-    # 执行软删除
-    def mark_deleted(comments_list, depth=0):
-        if depth > 20:  # 防止极端嵌套导致栈溢出
-            return False
-        for c in comments_list:
-            if c["id"] == comment_id:
-                c["isDeleted"] = True
-                c["content"] = ""
-                return True
-            if "replies" in c and mark_deleted(c["replies"], depth + 1):
-                return True
-        return False
-    
-    # 原子操作软删除，防止并发覆盖
-    max_retries = 3
-    for attempt in range(max_retries):
-        try:
-            comments_db = db.load_data("comments.json", default_data={})
-            item_comments = comments_db.get(item_id, [])
-            if not find_comment(item_comments):
-                raise HTTPException(status_code=404, detail="找不到该评论")
-            mark_deleted(item_comments)
-            comments_db[item_id] = item_comments
-            db.save_data("comments.json", comments_db)
-            break
-        except HTTPException:
-            raise
-        except Exception:
-            if attempt == max_retries - 1:
-                raise
-    
-    return {"status": "success"}
+    is_content_author = any(entry.get("id") == item_id and entry.get("author") == account
+                            for entry in posts_db + items_db)
+    is_content_author = is_content_author or any(entry.get("id") == item_id and entry.get("publisher") == account
+                                               for entry in tasks_db)
+    is_content_author = is_content_author or (item_id == account and item_id in users_db)
+    delete_comment(item_id, comment_id, account, can_moderate=is_content_author or is_admin(account))
+    return {"status": "success"}

router_items.py

@@ -1,18 +1,25 @@
 # router_items.py
-from fastapi import APIRouter, HTTPException, Depends
+from fastapi import APIRouter, HTTPException, Depends, Request
+from rate_limit import shared_limit
 import time
 import uuid
 import datetime
 import os
+import re
 import urllib.request
 import urllib.error
 import json
 import asyncio
 import 数据库连接 as db
 from models import ItemCreate, ItemUpdate, RatingRequest
-from 安全认证 import require_auth, check_ownership
+from 安全认证 import require_auth, check_ownership, is_admin
 from 数据库连接 import invalidate_cache
 from db_utils import record_view, sort_cache
+from github_source import repository_parts, select_github_token
+from github_versions import refresh_resource_version, invalidate_source
+from resource_store import publish_resource, published_response, edit_resource, ResourceStoreError
+from purchase_transaction import effective_resource_price
+from resource_deletion import delete_resource
 
 router = APIRouter()
 
@@ -30,18 +37,21 @@ def _get_version_str(versions_db: dict, item_id: str) -> str:
     return val or ""
 
 def _apply_effective_price(item: dict) -> None:
-    """检查 pending_price 是否已过生效时间，若是则更新 price 字段供前端显示"""
-    pending_price = item.get("pending_price")
-    pending_effective = item.get("pending_price_effective_at")
-    if pending_price is not None and pending_effective:
-        try:
-            effective_time = datetime.datetime.fromisoformat(pending_effective)
-            if datetime.datetime.now() >= effective_time:
-                item["price"] = pending_price
-                item["pending_price"] = None
-                item["pending_price_effective_at"] = None
-        except (ValueError, TypeError):
-            pass
+    """计算当前有效价格；调用者须传响应副本或处于编辑锁内。"""
+    try:
+        price = effective_resource_price(item)
+        pending = item.get('pending_price')
+        effective = item.get('pending_price_effective_at')
+        if type(pending) is int and pending == price and effective:
+            when = datetime.datetime.fromisoformat(effective)
+            now = datetime.datetime.now(when.tzinfo) if when.tzinfo else datetime.datetime.now()
+            if now >= when:
+                item['pending_price'] = None
+                item['pending_price_effective_at'] = None
+        item['price'] = price
+    except (ValueError, TypeError):
+        raise HTTPException(status_code=503, detail="资源价格暂时无法核实") from None
+
 
 def get_last_6_months():
     res = []
@@ -94,17 +104,10 @@ async def get_items(type: str = "tool", sort: str = "time", limit: int = 50): #
     
     filtered_items = sort_cache.get_sorted(cache_key, filtered_items, sort_fn)
         
-    price_updated = False
     result_items = []
     for item in filtered_items:
-        # 💰 检查延迟价格是否已生效（在原始字典上执行，确保生效后可持久化）
-        old_price = item.get("price", 0)
-        _apply_effective_price(item)
-        if item.get("price", 0) != old_price:
-            price_updated = True
-
-        # 🔒 P0数据修复：浅拷贝后再做下发加工，避免 pop/注入字段污染 items.json 源数据
         item_data = {**item}
+        _apply_effective_price(item_data)
         item_data["commentsData"] = comments_db.get(item_data["id"], [])
         item_data["comments"] = len(item_data["commentsData"])
         item_data["latest_version"] = _get_version_str(versions_db, item_data["id"])
@@ -116,11 +119,6 @@ async def get_items(type: str = "tool", sort: str = "time", limit: int = 50): #
         item_data.pop("viewed_by", None)  # 👁️ 访问者列表不暴露给前端
         result_items.append(item_data)
     
-    # 如果有价格生效了，持久化回 items.json
-    if price_updated:
-        db.save_data("items.json", items_db)
-        invalidate_cache("items.json")
-    
     return {"status": "success", "data": result_items[:limit]}
 
 def _build_creator_trend_data(account: str, u_items: list, months: list) -> dict:
@@ -327,18 +325,14 @@ async def get_creator_details(account: str):
     }
 
 @router.post("/api/items")
-async def create_item(item: ItemCreate, current_user: str = Depends(require_auth)):
+@shared_limit(5)
+async def create_item(request: Request, item: ItemCreate, current_user: str = Depends(require_auth)):
     # 🔒 P0安全修复：使用 JWT 认证的用户账号作为作者，防止伪造
     item.author = current_user
-    if not item.type:
-        raise HTTPException(status_code=400, detail="资源类型不能为空")
-    item.price = int(item.price or 0)
-    if item.price < 0:
-        raise HTTPException(status_code=400, detail="🚨 安全拦截：商品价格不能为负数")
-        
-    items_db = db.load_data("items.json", default_data=[])
+    if not re.fullmatch(r'[A-Za-z0-9_-]{1,50}', item.type or ''):
+        raise HTTPException(status_code=400, detail="资源类型无效")
     new_item = {
-        "id": f"{item.type}_{int(time.time())}_{uuid.uuid4().hex[:6]}", "type": item.type, "title": item.title, "author": item.author,
+        "id": f"{item.type}_{int(time.time())}_{uuid.uuid4().hex}", "type": item.type, "title": item.title, "author": item.author,
         "shortDesc": item.shortDesc, "fullDesc": item.fullDesc, "link": item.link, "coverUrl": item.coverUrl, 
         "imageUrls": item.imageUrls or [],  # 🖼️ 效果展示图列表
         "price": item.price, 
@@ -357,167 +351,80 @@ async def create_item(item: ItemCreate, current_user: str = Depends(require_auth
         "rating_dist": {"1": 0, "2": 0, "3": 0, "4": 0, "5": 0},
         "rated_by": {}
     }
-    items_db.insert(0, new_item)
-    db.save_data("items.json", items_db, force_sync=bool(item.github_token))
-    # 🗂️ 清除排序缓存
-    sort_cache.invalidate("items:")
+    try:
+        if item.request_id is not None:
+            from database_sql import engine
+            from resource_publication import publish_once
+            payload = {key: new_item[key] for key in item.model_dump(exclude={'request_id'})}
+            new_item = await asyncio.to_thread(publish_once, engine, db, new_item, item.request_id, payload)
+        else:
+            new_item = await asyncio.to_thread(publish_resource, db, new_item)
+    except ResourceStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+    # 已提交内容不因派生排序缓存故障而误报发布失败。
+    try:
+        sort_cache.invalidate("items:")
+    except Exception as error:
+        print(f"[资源发布] 缓存失效失败: error_type={type(error).__name__}")
     
     # 🚀 首次发布立即触发版本检测与预缓存
     try:
         link = item.link or ""
         if "github.com" in link:
-            from 云端_定时版本检测引擎 import fetch_latest_github_hash, precache_github_zip
+            from 云端_定时版本检测引擎 import precache_github_zip
             
             async def _first_publish_precache():
                 try:
-                    token = item.github_token or os.environ.get("GITHUB_PAT", "")
-                    latest_hash = await fetch_latest_github_hash(link, token)
-                    if latest_hash:
-                        # 写入 versions.json
-                        versions_db = db.load_data("versions.json", default_data={})
-                        versions_db[new_item["id"]] = {"hash": latest_hash}
-                        db.save_data("versions.json", versions_db)
-                        # 触发预缓存
-                        await precache_github_zip(link, token, new_item["id"], latest_hash)
-                        print(f"[缓存刷新] 首次发布预缓存完成: {new_item['id']}")
+                    refreshed = await refresh_resource_version(db, new_item['id'])
+                    if refreshed:
+                        await precache_github_zip(refreshed['item']['link'], refreshed['token'], new_item['id'], refreshed['commit'])
                 except Exception as e:
-                    import traceback
-                    print(f"[缓存刷新] 首次发布预缓存失败（不影响发布）: {e}")
-                    print(f"[缓存刷新] 详细堆栈: {traceback.format_exc()}")
+                    print(f"[缓存刷新] 首次发布预缓存失败（不影响发布）: item_id={new_item['id']}, error_type={type(e).__name__}")
             
             asyncio.create_task(_first_publish_precache())
     except Exception as e:
-        print(f"[缓存刷新] 触发首次发布缓存异常（不影响发布）: {e}")
+        print(f"[缓存刷新] 触发首次发布缓存异常（不影响发布）: item_id={new_item['id']}, error_type={type(e).__name__}")
     
-    return {"status": "success", "data": new_item}
+    return {"status": "success", "data": published_response(new_item)}
 
 @router.put("/api/items/{item_id}")
-async def update_item(item_id: str, update_data: ItemUpdate, current_user: str = Depends(require_auth)):
+@shared_limit(10)
+async def update_item(request: Request, item_id: str, update_data: ItemUpdate, current_user: str = Depends(require_auth)):
     """
     更新内容接口
     🔒 P0安全修复：使用 JWT Token 验证用户身份，而非前端传入的 author 参数
     🔄 P7后悔模式：价格修改延迟24小时生效
     🔧 Bug修复：使用 atomic_update 避免并发竞态条件
     """
-    if update_data.price is not None:
-        update_data.price = int(update_data.price)
-        if update_data.price < 0:
-            raise HTTPException(status_code=400, detail="🚨 安全拦截：商品价格不能为负数")
-    
-    result_holder = {}
-    
-    def updater(items_db):
-        for item in items_db:
-            if item["id"] == item_id:
-                # 🔒 P0安全修复：使用 JWT 解析出的真实用户账号进行校验
-                if item.get("author") != current_user:
-                    result_holder["error"] = "forbidden"
-                    return False
-                
-                price_change_info = None
-                
-                if update_data.title is not None: item["title"] = update_data.title
-                if update_data.shortDesc is not None: item["shortDesc"] = update_data.shortDesc
-                if update_data.fullDesc is not None: item["fullDesc"] = update_data.fullDesc
-                old_link = item.get("link", "")
-                if update_data.link is not None: item["link"] = update_data.link
-                result_holder["link_changed"] = old_link != item.get("link", "")
-                result_holder["new_link"] = item.get("link", "")
-                if update_data.coverUrl is not None: item["coverUrl"] = update_data.coverUrl
-                if update_data.imageUrls is not None: item["imageUrls"] = update_data.imageUrls  # 🖼️ 效果展示图列表
-                
-                # 🔄 P7后悔模式：价格修改延迟24小时生效
-                if update_data.price is not None:
-                    current_price = item.get("price", 0)
-                    new_price = update_data.price
-                    
-                    if current_price != new_price:
-                        # 设置待生效价格，24小时后生效
-                        import datetime
-                        effective_time = datetime.datetime.now() + datetime.timedelta(hours=24)
-                        item["pending_price"] = new_price
-                        item["pending_price_effective_at"] = effective_time.isoformat()
-                        price_change_info = {
-                            "current_price": current_price,
-                            "new_price": new_price,
-                            "effective_at": effective_time.isoformat()
-                        }
-                        # 不立即修改 price，等待24小时后生效
-                    else:
-                        # 价格未变，清除待生效价格
-                        item["pending_price"] = None
-                        item["pending_price_effective_at"] = None
-                
-                if update_data.github_token is not None: item["github_token"] = update_data.github_token 
-                if update_data.netdisk_password is not None: item["netdisk_password"] = update_data.netdisk_password  # ☁️
-                if update_data.is_netdisk is not None: item["is_netdisk"] = update_data.is_netdisk  # ☁️
-                if update_data.is_original is not None: item["is_original"] = update_data.is_original  # 🎨
-                if update_data.allow_refund is not None: item["allow_refund"] = update_data.allow_refund  # 💸
-                
-                result_holder["success"] = True
-                result_holder["price_change_info"] = price_change_info
-                result_holder["current_price"] = price_change_info.get("current_price") if price_change_info else None
-                result_holder["new_price"] = price_change_info.get("new_price") if price_change_info else None
-                return True
-        
-        result_holder["error"] = "not_found"
-        return False
-    
-    db.atomic_update("items.json", updater, default_data=[], force_sync=bool(update_data.github_token))
-    
-    if result_holder.get("error") == "forbidden":
-        raise HTTPException(status_code=403, detail="无权修改他人发布的内容")
-    if result_holder.get("error") == "not_found":
-        raise HTTPException(status_code=404, detail="找不到该内容记录")
-    
-    # 🗂️ 清除排序缓存和主数据缓存
-    sort_cache.invalidate("items:")
-    invalidate_cache("items.json")
-    
-    # 🔄 [缓存刷新] 资源 link 变更时清除 ZIP 缓存元信息
-    if result_holder.get("link_changed"):
+    try:
+        result_holder = await asyncio.to_thread(edit_resource, db, item_id, current_user,
+            update_data.model_dump(exclude_unset=True))
+    except ResourceStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+    # 编辑已经提交，派生缓存故障不改写主操作的成功结果。
+    for invalidate, key in ((sort_cache.invalidate, "items:"), (invalidate_cache, "items.json")):
         try:
-            versions_db = db.load_data("versions.json", default_data={})
-            entry = versions_db.get(item_id)
-            if entry is not None:
-                if isinstance(entry, str):
-                    entry = {"hash": entry}
-                had_meta = "cached_at" in entry or "zip_size" in entry
-                entry.pop("cached_at", None)
-                entry.pop("zip_size", None)
-                if had_meta:
-                    versions_db[item_id] = entry
-                    db.save_data("versions.json", versions_db)
-                    print(f"[缓存刷新] 已清除 item {item_id} 的 ZIP 缓存元信息")
-            
-            # 可选：触发异步预缓存
-            new_link = result_holder.get("new_link", "")
-            if new_link and new_link.startswith("https://github.com/"):
+            invalidate(key)
+        except Exception as error:
+            print(f"[资源编辑] 缓存失效失败: error_type={type(error).__name__}")
+
+    # 来源变更撤销旧版本；后台重新检测当前资源，绝不用旧仓库hash请求新仓库。
+    if result_holder.get('source_changed'):
+        try:
+            await asyncio.to_thread(invalidate_source, db, item_id)
+            async def refresh_changed_source():
                 try:
-                    from 云端_定时版本检测引擎 import precache_github_zip
-                    # 获取当前 item 的 token 和 version_hash
-                    items_db = db.load_data("items.json", default_data=[])
-                    token = None
-                    for it in items_db:
-                        if it["id"] == item_id:
-                            token = it.get("github_token")
-                            break
-                    
-                    versions_db = db.load_data("versions.json", default_data={})
-                    entry = versions_db.get(item_id, {})
-                    version_hash = entry.get("hash", "") if isinstance(entry, dict) else entry
-                    
-                    if version_hash:
-                        asyncio.create_task(precache_github_zip(new_link, token, item_id, version_hash))
-                        print(f"[缓存刷新] 已触发 item {item_id} 的异步预缓存")
-                except ImportError:
-                    print(f"[缓存刷新] 预缓存模块导入失败，跳过异步预缓存")
-                except Exception as e:
-                    print(f"[缓存刷新] 触发异步预缓存失败: {e}")
-        except Exception as e:
-            print(f"[缓存刷新] 缓存刷新失败（不影响主流程）: {e}")
-    
-    result = {"status": "success"}
+                    refreshed = await refresh_resource_version(db, item_id)
+                    if refreshed:
+                        from 云端_定时版本检测引擎 import precache_github_zip
+                        await precache_github_zip(refreshed['item']['link'], refreshed['token'], item_id, refreshed['commit'])
+                except Exception as error:
+                    print(f"[缓存刷新] 来源检测失败: error_type={type(error).__name__}")
+            asyncio.create_task(refresh_changed_source())
+        except Exception as error:
+            print(f"[缓存刷新] 来源撤销失败: error_type={type(error).__name__}")
+
+    result = {"status": "success", "edit_revision": result_holder["edit_revision"]}
     if result_holder.get("price_change_info"):
         price_change_info = result_holder["price_change_info"]
         result["price_change"] = price_change_info
@@ -529,80 +436,25 @@ async def update_item(item_id: str, update_data: ItemUpdate, current_user: str =
 # 可通过外部调度器 (cron-job.org / GitHub Actions) 每日 02:00 触发
 # ==========================================
 @router.post("/api/check_updates")
-async def check_github_updates():
+@shared_limit(30)
+async def check_github_updates(request: Request, current_user: str = Depends(require_auth)):
     """
     遍历所有 GitHub 类型的工具，获取最新 commit hash，存入 versions.json
     """
-    items_db = db.load_data("items.json", default_data=[])
-    versions_db = db.load_data("versions.json", default_data={})
-    
+    if not is_admin(current_user):
+        raise HTTPException(status_code=403, detail="无权限")
+    items_db = await asyncio.to_thread(db.load_data, "items.json", default_data=[], strict=True, skip_cache=True)
     updated_count = 0
-    
     for item in items_db:
-        # 只处理 GitHub 仓库类型的工具
-        link = item.get("link", "")
-        if not link.startswith("https://github.com/"):
+        if not item.get('link', '').startswith('https://github.com/'):
             continue
-            
-        item_id = item["id"]
-        
         try:
-            # 解析仓库信息
-            repo_parts = link.rstrip("/").replace(".git", "").split("/")
-            if len(repo_parts) < 2:
-                continue
-            owner, repo = repo_parts[-2], repo_parts[-1]
-            
-            # 获取创作者 Token 或使用全局兜底 Token
-            creator_token = item.get("github_token")
-            fallback_token = os.environ.get("GITHUB_PAT")
-            active_token = creator_token if creator_token else fallback_token
-            
-            # 请求 GitHub API 获取最新 commit
-            api_url = f"https://api.github.com/repos/{owner}/{repo}/commits?per_page=1"
-            headers = {
-                "Accept": "application/vnd.github.v3+json",
-                "User-Agent": "ComfyUI-Ranking-VersionChecker"
-            }
-            if active_token:
-                headers["Authorization"] = f"Bearer {active_token}"
-            
-            req = urllib.request.Request(api_url, headers=headers)
-
-            # ⚡ 性能修复：urlopen 是同步阻塞调用（timeout=10），在 async 处理器里
-            # 逐个 item 串行等待会占死唯一的事件循环（N 个仓库最坏 N×10 秒全站无响应）；
-            # 抽成同步小函数交给线程池执行，异常仍由下方 except 分支按原样捕获。
-            def _fetch_commits():
-                with urllib.request.urlopen(req, timeout=10) as response:
-                    return json.loads(response.read().decode("utf-8"))
-
-            commits = await asyncio.to_thread(_fetch_commits)
-            if commits and len(commits) > 0:
-                latest_sha = commits[0].get("sha", "")[:7]  # 取前7位作为版本标识
-
-                # 如果版本有变化，更新 versions.json
-                # 🧹 P2修复（格式统一）：统一以新格式 dict 读写，保留 cached_at/zip_size 等缓存元字段；
-                # 旧逻辑拿字符串与 dict 比较会把 dict 条目永远判为"有更新"并覆盖成字符串丢失元信息
-                entry = versions_db.get(item_id)
-                if isinstance(entry, str):
-                    entry = {"hash": entry}
-                elif not isinstance(entry, dict):
-                    entry = {}
-                old_version = entry.get("hash", "")
-                if latest_sha and latest_sha != old_version:
-                    entry["hash"] = latest_sha
-                    versions_db[item_id] = entry
-                    updated_count += 1
-                    print(f"[版本更新] {item['title']}: {old_version} -> {latest_sha}")
-
-        except urllib.error.HTTPError as e:
-            print(f"[版本检查失败] {item.get('title', item_id)}: HTTP {e.code}")
-        except Exception as e:
-            print(f"[版本检查异常] {item.get('title', item_id)}: {str(e)}")
-    
-    # 保存更新后的版本库
-    db.save_data("versions.json", versions_db)
-    
+            refreshed = await refresh_resource_version(db, item['id'])
+            if refreshed and refreshed['changed']:
+                updated_count += 1
+        except Exception as error:
+            print(f"[版本检查异常] error_type={type(error).__name__}")
+
     return {
         "status": "success", 
         "message": f"版本检查完成，共更新 {updated_count} 个工具的版本号",
@@ -618,16 +470,8 @@ async def get_item_by_id(item_id: str):
     
     for item in items_db:
         if item["id"] == item_id:
-            # 💰 检查延迟价格是否已生效（在原字典上操作，确保生效结果可持久化）
-            old_price = item.get("price", 0)
-            _apply_effective_price(item)
-            if item.get("price", 0) != old_price:
-                db.save_data("items.json", items_db)
-                invalidate_cache("items.json")
-            
-            # 🔒 P2修复（与 get_items 同款）：浅拷贝后再做下发加工，
-            # 避免 pop 敏感字段污染 items.json 源数据/共享缓存（导致 github_token 永久丢失）
             item_data = {**item}
+            _apply_effective_price(item_data)
             # 添加关联数据
             item_data["commentsData"] = comments_db.get(item_id, [])
             item_data["comments"] = len(item_data["commentsData"])
@@ -650,56 +494,28 @@ async def get_item_version(item_id: str):
     return {"status": "success", "version": _get_version_str(versions_db, item_id)}
 
 @router.delete("/api/items/{item_id}")
-async def delete_item(item_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(10)
+async def delete_item(request: Request, item_id: str, current_user: str = Depends(require_auth)):
     """
     删除内容（仅作者或管理员可操作）
     🔧 Bug修复：使用 atomic_update 避免并发竞态条件
     """
-    result_holder = {}
-    
-    def items_updater(items_db):
-        for i, item in enumerate(items_db):
-            if item["id"] == item_id:
-                # 🔒 权限检查：仅作者或管理员可删除
-                if not check_ownership(item, current_user, owner_field="author", allow_admin=True):
-                    result_holder["error"] = "forbidden"
-                    return False
-                
-                # 1. 从 items.json 中删除该条目
-                items_db.pop(i)
-                result_holder["item_deleted"] = True
-                return True
-        
-        result_holder["error"] = "not_found"
-        return False
-    
-    db.atomic_update("items.json", items_updater, default_data=[])
-    
-    if result_holder.get("error") == "forbidden":
-        raise HTTPException(status_code=403, detail="无权删除他人发布的内容")
-    if result_holder.get("error") == "not_found":
-        raise HTTPException(status_code=404, detail="找不到该内容记录")
-    
-    # 2. 清理关联评论：从 comments.json 中删除该内容的所有评论
-    def comments_updater(comments_db):
-        if item_id in comments_db:
-            del comments_db[item_id]
-            return True
-        return False
-    
-    db.atomic_update("comments.json", comments_updater, default_data={})
-    
-    # 3. 清理缓存：使 items.json 和 comments.json 的缓存失效
-    invalidate_cache("items.json")
-    invalidate_cache("comments.json")
-    # 🗂️ 清除排序缓存
-    sort_cache.invalidate("items:")
-    
-    return {"status": "success", "message": "内容已删除"}
+    try:
+        result = await asyncio.to_thread(delete_resource, db, item_id, current_user, is_admin(current_user))
+    except ResourceStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+    for invalidate, key in ((invalidate_cache, "items.json"), (invalidate_cache, "comments.json"),
+                            (invalidate_cache, "versions.json"), (sort_cache.invalidate, "items:")):
+        try:
+            invalidate(key)
+        except Exception as error:
+            print(f"[资源删除] 缓存失效失败: error_type={type(error).__name__}")
+    return {"status": "success", "message": "内容已删除", **result}
 
 
 @router.post("/api/items/{item_id}/view")
-async def record_item_view(item_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(60)
+async def record_item_view(request: Request, item_id: str, current_user: str = Depends(require_auth)):
     """
     记录资源访问量
     👁️ 需要用户认证，每个用户只计算一次总访问量，日访问量每次调用都增加
@@ -716,7 +532,8 @@ async def record_item_view(item_id: str, current_user: str = Depends(require_aut
 
 
 @router.post("/api/items/{item_id}/use")
-async def record_item_use(item_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def record_item_use(request: Request, item_id: str, current_user: str = Depends(require_auth)):
     """
     记录资源使用量/下载量（原子操作，并发安全）
     📥 每个用户对同一资源只计一次，防止重复计数
@@ -760,12 +577,13 @@ async def record_item_use(item_id: str, current_user: str = Depends(require_auth
 # ==========================================
 
 @router.post("/api/items/{item_id}/rating")
-async def rate_item(item_id: str, request: RatingRequest, current_user: str = Depends(require_auth)):
+@shared_limit(20)
+async def rate_item(request: Request, item_id: str, payload: RatingRequest, current_user: str = Depends(require_auth)):
     """
     为资源评分（原子操作，并发安全）
     ⭐ score: 1-5
     """
-    score = request.score
+    score = payload.score
     if score < 1 or score > 5:
         raise HTTPException(status_code=400, detail="评分必须在1-5之间")
     
@@ -834,7 +652,8 @@ async def rate_item(item_id: str, request: RatingRequest, current_user: str = De
 
 
 @router.post("/api/items/{item_id}/like")
-async def toggle_item_like(item_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def toggle_item_like(request: Request, item_id: str, current_user: str = Depends(require_auth)):
     """
     点赞/取消点赞（原子操作，并发安全）
     """
@@ -869,7 +688,8 @@ async def toggle_item_like(item_id: str, current_user: str = Depends(require_aut
 
 
 @router.post("/api/items/{item_id}/favorite")
-async def toggle_item_favorite(item_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def toggle_item_favorite(request: Request, item_id: str, current_user: str = Depends(require_auth)):
     """
     收藏/取消收藏（原子操作，并发安全）
     """
@@ -907,7 +727,8 @@ async def toggle_item_favorite(item_id: str, current_user: str = Depends(require
 # 🔄 手动触发预缓存刷新接口
 # ==========================================
 @router.post("/api/items/{item_id}/refresh_cache")
-async def refresh_item_cache(item_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(3)
+async def refresh_item_cache(request: Request, item_id: str, current_user: str = Depends(require_auth)):
     """手动触发指定资源的 ZIP 预缓存刷新，仅限作者调用"""
     items_db = db.load_data("items.json", default_data=[])
     
@@ -931,31 +752,16 @@ async def refresh_item_cache(item_id: str, current_user: str = Depends(require_a
         raise HTTPException(status_code=400, detail="仅支持 GitHub 仓库类型的资源")
     
     try:
-        from 云端_定时版本检测引擎 import fetch_latest_github_hash, precache_github_zip
+        from 云端_定时版本检测引擎 import precache_github_zip
     except ImportError:
         raise HTTPException(status_code=500, detail="预缓存模块不可用")
     
-    # 获取 token
-    token = target_item.get("github_token") or os.environ.get("GITHUB_PAT", "")
-    
-    # 获取最新 hash
-    latest_hash = await fetch_latest_github_hash(link, token)
-    if not latest_hash:
-        raise HTTPException(status_code=500, detail="获取最新版本号失败，请稍后重试")
-    
-    # 写入 versions.json
-    versions_db = db.load_data("versions.json", default_data={})
-    entry = versions_db.get(item_id, {})
-    if isinstance(entry, str):
-        entry = {"hash": entry}
-    entry["hash"] = latest_hash
-    versions_db[item_id] = entry
-    db.save_data("versions.json", versions_db)
-    
-    # 执行预缓存
-    success = await precache_github_zip(link, token, item_id, latest_hash)
-    
+    refreshed = await refresh_resource_version(db, item_id)
+    if not refreshed:
+        raise HTTPException(status_code=503, detail="资源版本暂时无法核实，请稍后重试")
+    success = await precache_github_zip(refreshed['item']['link'], refreshed['token'], item_id, refreshed['commit'])
+
     if success:
         return {"status": "success", "message": "缓存刷新完成"}
     else:
-        return {"status": "error", "message": "缓存刷新失败，请查看云端日志获取详细信息"}
+        return {"status": "error", "message": "缓存刷新失败，请查看云端日志获取详细信息"}

router_messages.py

@@ -1,5 +1,6 @@
 # router_messages.py
 from fastapi import APIRouter, HTTPException, Depends, Request
+from rate_limit import shared_limit
 from pydantic import BaseModel
 import asyncio
 import time
@@ -7,13 +8,12 @@ import uuid
 import subprocess
 import os
 import 数据库连接 as db
+import chat_store
+import notification_store
 from models import PrivateMessage
 from 安全认证 import require_auth, is_admin
 
 # 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
-from slowapi import Limiter
-from slowapi.util import get_remote_address
-limiter = Limiter(key_func=get_remote_address)
 
 router = APIRouter()
 
@@ -28,29 +28,13 @@ class SystemAnnouncement(BaseModel):
 # 新增：发布系统公告接口 (仅限管理员，使用JWT验证)
 # ==========================================
 @router.post("/api/system/announcement")
-async def publish_announcement(ann: SystemAnnouncement, current_user: str = Depends(require_auth)):
+@shared_limit(5)
+async def publish_announcement(request: Request, ann: SystemAnnouncement, current_user: str = Depends(require_auth)):
     # 🔒 P0安全修复：使用环境变量配置的管理员列表
     if not is_admin(current_user):
         raise HTTPException(status_code=403, detail="无权发布系统公告，仅管理员可操作")
     
-    # 查询管理员信息
-    users_db = db.load_data("users.json", default_data={})
-    admin_info = users_db.get(current_user, {})
-    
-    announcements_db = db.load_data("announcements.json", default_data=[])
-    
-    new_ann = {
-        "id": f"sys_{int(time.time())}_{uuid.uuid4().hex[:6]}",
-        "type": "system",
-        "from_user": current_user,  # 使用真实的管理员账号
-        "from_name": admin_info.get("name", current_user),  # 使用真实昵称，fallback 为账号
-        "from_avatar": admin_info.get("avatarDataUrl", ""),  # 使用真实头像
-        "content": ann.content,
-        "created_at": int(time.time())
-    }
-    
-    announcements_db.append(new_ann)
-    db.save_data("announcements.json", announcements_db)
+    await asyncio.to_thread(notification_store.publish_announcement, current_user, ann.content)
     return {"status": "success"}
 
 
@@ -71,7 +55,8 @@ ALLOWED_SCRIPTS = {
 }
 
 @router.post("/api/admin/run-script")
-async def run_admin_script(req: AdminScriptRequest, current_user: str = Depends(require_auth)):
+@shared_limit(3)
+async def run_admin_script(request: Request, req: AdminScriptRequest, current_user: str = Depends(require_auth)):
     """
     管理员专属：执行指定的 Python 脚本
     🔒 P0安全修复：白名单 + 路径穿越防护
@@ -159,93 +144,24 @@ async def run_admin_script(req: AdminScriptRequest, current_user: str = Depends(
 # 原有功能：私信与聊天
 # ==========================================
 @router.post("/api/messages/private")
-@limiter.limit("30/minute")  # 🔒 安全限流：防止私信骚扰/刷屏（聊天节奏快，阈值比发帖宽松）
+@shared_limit(30)  # 🔒 安全限流：防止私信骚扰/刷屏（聊天节奏快，阈值比发帖宽松）
 async def send_private_message(request: Request, msg: PrivateMessage, current_user: str = Depends(require_auth)):
-    msg.sender = current_user  # 强制发送者身份，防止伪造
-    
-    # 验证接收者存在
-    users_db = db.load_data("users.json", default_data={})
-    if msg.receiver not in users_db:
-        raise HTTPException(status_code=404, detail="接收者不存在")
-    
-    chats_db = db.load_data("chats.json", default_data={})
-    conv_id = f"{min(msg.sender, msg.receiver)}_{max(msg.sender, msg.receiver)}"
-    if conv_id not in chats_db: chats_db[conv_id] = []
-    
-    chat_msg = {"id": f"chat_{int(time.time())}_{uuid.uuid4().hex[:6]}", "sender": msg.sender, "receiver": msg.receiver, "content": msg.content, "created_at": int(time.time()), "is_read": False}
-    chats_db[conv_id].append(chat_msg)
-    db.save_data("chats.json", chats_db)
-    
-    # 🔔 私信未读提醒改由聊天入口(✉️红点)承载（读取 chats.json 每会话未读数），
-    #    不再向 messages.json 写入 private 铃铛通知，避免与聊天红点重复计数
+    await asyncio.to_thread(chat_store.send_message, current_user, msg.receiver, msg.content)
     return {"status": "success"}
 
 @router.get("/api/chats/{account}")
 async def get_chat_list(account: str, current_user: str = Depends(require_auth)):
     if account != current_user:
         raise HTTPException(status_code=403, detail="无权访问他人私信")
-    chats_db = db.load_data("chats.json", default_data={})
-    users_db = db.load_data("users.json", default_data={})
-    
-    chat_list = []
-    for conv_id, msgs in chats_db.items():
-        if account in conv_id:
-            if not msgs: continue
-            # 🔧 P1修复：对方账户从消息的 sender/receiver 字段推导，而非对 conv_id 做 replace
-            # （replace 会替换所有子串，若账户名互为子串或含下划线会解析出错误账户）
-            other_account = None
-            for m in reversed(msgs):
-                if m.get("sender") != account:
-                    other_account = m.get("sender")
-                    break
-                if m.get("receiver") != account:
-                    other_account = m.get("receiver")
-                    break
-            if not other_account: continue
-            last_msg = msgs[-1]
-            unread_count = sum(1 for m in msgs if m["receiver"] == account and not m.get("is_read"))
-            other_user = users_db.get(other_account, {})
-            chat_list.append({
-                "account": other_account,
-                "name": other_user.get("name", other_account),
-                "avatar": other_user.get("avatarDataUrl", ""),
-                "last_message": last_msg["content"],
-                "last_time": last_msg["created_at"],
-                "unread_count": unread_count
-            })
-            
-    chat_list.sort(key=lambda x: x["last_time"], reverse=True)
-    return {"status": "success", "data": chat_list}
+    data = await asyncio.to_thread(chat_store.chat_list, account)
+    return {"status": "success", "data": data}
 
 @router.get("/api/chats/{account}/{target_account}")
 async def get_chat_history(account: str, target_account: str, current_user: str = Depends(require_auth)):
     if account != current_user:
         raise HTTPException(status_code=403, detail="无权访问他人聊天记录")
-    chats_db = db.load_data("chats.json", default_data={})
-    conv_id = f"{min(account, target_account)}_{max(account, target_account)}"
-    msgs = chats_db.get(conv_id, [])
-    
-    now = int(time.time())
-    seven_days = 7 * 24 * 3600
-    valid_msgs = []
-    modified = False
-    
-    for m in msgs:
-        if not m.get("is_read") or (now - m.get("created_at", 0) < seven_days):
-            valid_msgs.append(m)
-        else:
-            modified = True
-            
-        # 本次访问即为已读
-        if m["receiver"] == account and not m.get("is_read"): 
-            m["is_read"] = True
-            modified = True
-            
-    if modified or len(valid_msgs) != len(msgs): 
-        chats_db[conv_id] = valid_msgs
-        db.save_data("chats.json", chats_db)
-        
-    return {"status": "success", "data": valid_msgs}
+    data = await asyncio.to_thread(chat_store.chat_history, account, target_account)
+    return {"status": "success", "data": data}
 
 # ==========================================
 # 改造：获取通知列表 (加入系统公告懒加载注入)
@@ -257,138 +173,16 @@ async def get_messages(account: str, count_only: bool = False, current_user: str
     # 🔒 P0安全加固：拦截越权读取他人消息（含 count_only 轮询）
     if account != current_user:
         raise HTTPException(status_code=403, detail="无权访问他人消息")
-    # 🔥 count_only 模式：轻量级轮询，只返回未读数，不标记已读
-    if count_only:
-        messages_db = db.load_data("messages.json", default_data={})
-        user_msgs = messages_db.get(account, [])
-        
-        now = int(time.time())
-        seven_days = 7 * 24 * 3600
-        
-        # 🔔 只统计未过期的未读消息；私信提醒已迁移至聊天入口(✉️红点)、
-        #    插件更新提醒已迁移至卡片徽章，铃铛未读数不再计入这两类，避免同一提醒重复出现
-        unread = sum(1 for m in user_msgs 
-                     if not m.get("is_read") 
-                     and m.get("type") not in ("private", "plugin_update")
-                     and (now - m.get("created_at", 0) < seven_days))
-        return {"status": "success", "unread_count": unread}
-    
-    # 公告是只读的，先加载
-    announcements_db = db.load_data("announcements.json", default_data=[])
-    
-    # 🔥 性能优化：先用只读方式检查是否有实际变更需要写入
-    messages_db = db.load_data("messages.json", default_data={})
-    user_msgs = messages_db.get(account, [])
-    
-    now = int(time.time())
-    seven_days = 7 * 24 * 3600
-    
-    # 检查三个条件判断是否需要写入
-    # 1. 是否有新公告需要注入
-    user_msg_ids = {m.get("id") for m in user_msgs}
-    has_new_announcements = any(
-        ann.get("id") not in user_msg_ids 
-        for ann in announcements_db
-    )
-    
-    # 2. 是否有未读消息需要标记已读
-    has_unread = any(not m.get("is_read") for m in user_msgs)
-    
-    # 3. 是否有已读超过7天的消息需要清理
-    has_expired = any(
-        m.get("is_read") and (now - m.get("created_at", 0) >= seven_days)
-        for m in user_msgs
-    )
-    
-    needs_update = has_new_announcements or has_unread or has_expired
-    
-    # 🔥 修复：在标记已读之前先计算真实的未读数
-    unread_before_mark = sum(1 for m in user_msgs 
-                              if not m.get("is_read") 
-                              and (now - m.get("created_at", 0) < seven_days))
-    
-    if not needs_update:
-        # 无变更，直接返回只读数据，不触发写入和HF上传
-        return {
-            "status": "success",
-            "data": user_msgs,
-            "unread_count": unread_before_mark  # 🔥 修复：返回真实的未读数
-        }
-    
-    # 有变更需要写入，使用 atomic_update 保证并发安全
-    result_container = [None]
-    
-    def updater(data):
-        user_msgs = data.get(account, [])
-        
-        # --- 核心改造区：瞬间比对并注入全局公告 ---
-        user_msg_ids = {m.get("id") for m in user_msgs}
-        
-        injected = False
-        for ann in announcements_db:
-            if ann.get("id") not in user_msg_ids:
-                new_sys_msg = dict(ann)
-                new_sys_msg["is_read"] = False
-                new_sys_msg["receiver"] = account
-                user_msgs.append(new_sys_msg)
-                injected = True
-        
-        if injected:
-            # 重新按照时间倒序排列，让新公告置顶
-            user_msgs.sort(key=lambda x: x.get("created_at", 0), reverse=True)
-        # ----------------------------------------
-        
-        now = int(time.time())
-        seven_days = 7 * 24 * 3600
-        valid = []
-        
-        # 如果注入了新公告，则判定为需要回写数据库保存
-        modified = injected
-        
-        for m in user_msgs:
-            if not m.get("is_read") or (now - m.get("created_at", 0) < seven_days):
-                valid.append(m)
-            else:
-                modified = True
-            
-            # 本次访问即为已读 - 将所有未读消息标记为已读
-            if not m.get("is_read"):
-                m["is_read"] = True
-                modified = True
-        # 原地修改 data，atomic_update 会自动保存
-        data[account] = valid
-        
-        # 通过闭包返回结果
-        result_container[0] = {
-            "status": "success",
-            "data": valid,
-            "unread_count": unread_before_mark  # 🔥 修复：返回标记已读前的真实未读数
-        }
-    
-    db.atomic_update("messages.json", updater, default_data={})
-    
-    return result_container[0]
+    return await asyncio.to_thread(notification_store.get_messages, account, count_only)
 
 @router.post("/api/messages/{account}/read")
-async def mark_messages_read(account: str, current_user: str = Depends(require_auth)):
+@shared_limit(60)
+async def mark_messages_read(request: Request, account: str, current_user: str = Depends(require_auth)):
     """
     标记消息为已读（原子操作，并发安全）
     """
     # 🔒 P0安全加固：补全鉴权，防止任意用户篡改他人消息已读状态
     if account != current_user:
         raise HTTPException(status_code=403, detail="无权操作他人消息")
-    def updater(data):
-        user_msgs = data.get(account, [])
-        modified = False
-        for m in user_msgs:
-            if not m.get("is_read"):
-                m["is_read"] = True
-                modified = True
-        
-        # 原地修改 data，atomic_update 会自动保存
-        if modified:
-            data[account] = user_msgs
-    
-    db.atomic_update("messages.json", updater, default_data={})
-    
-    return {"status": "success"}
+    await asyncio.to_thread(notification_store.mark_messages_read, account)
+    return {"status": "success"}

router_open_api.py

@@ -1,740 +1,638 @@
-# router_open_api.py
-# ==========================================
-# 🌐 通用开放 API 模块（供第三方插件调用）
-# ==========================================
-# 作用：对外提供受 Plugin Key 保护的通用接口，
-#       供 NodeCraft AI 等第三方插件复用 ComfyUI-Ranking 账号体系。
-# 关联文件：
-#   - 安全认证.py        (verify_token_with_fallback, require_auth)
-#   - database_sql.py    (get_db, SessionLocal)
-#   - models_sql.py      (Wallet, Transaction)
-#   - 数据库连接.py       (users.json 读写)
-# 安全机制：
-#   - X-Plugin-Key Header 鉴权
-#   - 基于 plugin_key 的内存限流（每分钟重置）
-#   - 所有扣款/退款操作记录到 Transaction 流水（含哈希链）
-# ==========================================
-
-import os
-import json
-import time
-import uuid
-import datetime
-import hashlib
-import logging
-import threading
-from datetime import date
-from typing import Optional
-
-from fastapi import APIRouter, Depends, Header, HTTPException, Query
-from fastapi.responses import JSONResponse
-from sqlalchemy.orm import Session
-from pydantic import BaseModel, Field
-
-from database_sql import get_db, SessionLocal
-from models_sql import Wallet, Transaction, RegisteredPlugin
-from 安全认证 import verify_token_with_fallback
-import 数据库连接 as json_db
-
-logger = logging.getLogger("ComfyUI-Ranking.OpenAPI")
-
-router = APIRouter(prefix="/api/open", tags=["open-api"])
-
-
-# ═══════════════ 插件注册表（从数据库动态加载） ═══════════════
-# 反向索引：plugin_key -> {id, key, name, rate_limit, permissions, max_deduct_per_tx, max_deduct_per_day}
-_PLUGIN_KEY_INDEX: dict = {}
-
-
-def load_plugins_from_db():
-    """启动时从数据库加载所有启用的插件到内存索引"""
-    global _PLUGIN_KEY_INDEX
-
-    db = SessionLocal()
-    try:
-        # 首次启动时 seed 默认插件
-        if not db.query(RegisteredPlugin).first():
-            default_key = os.environ.get("NCA_PLUGIN_KEY", "nca_2026_nodecraft_ai_plugin")
-            default_plugin = RegisteredPlugin(
-                plugin_id="nodecraft_ai",
-                plugin_key=default_key,
-                name="NodeCraft AI",
-                enabled=True,
-                rate_limit=100,
-                max_deduct_per_tx=100,
-                max_deduct_per_day=1000,
-                permissions='["verify","balance","deduct","refund"]',
-                created_by="system",
-            )
-            db.add(default_plugin)
-            db.commit()
-            logger.info("✅ 已 seed 默认插件: NodeCraft AI")
-
-        plugins = db.query(RegisteredPlugin).filter(RegisteredPlugin.enabled == True).all()
-
-        # 构建内存索引
-        new_index = {}
-        for p in plugins:
-            try:
-                perms = json.loads(p.permissions) if p.permissions else ["verify", "balance", "deduct", "refund"]
-            except Exception:
-                perms = ["verify", "balance", "deduct", "refund"]
-            new_index[p.plugin_key] = {
-                "id": p.plugin_id,
-                "key": p.plugin_key,
-                "name": p.name,
-                "rate_limit": p.rate_limit or 100,
-                "permissions": perms,
-                "max_deduct_per_tx": p.max_deduct_per_tx or 100,
-                "max_deduct_per_day": p.max_deduct_per_day or 1000,
-            }
-
-        _PLUGIN_KEY_INDEX = new_index
-        logger.info(f"✅ 已加载 {len(new_index)} 个插件到注册表")
-    except Exception as e:
-        logger.error(f"❌ 加载插件注册表失败: {e}")
-        # 如果加载失败且索引为空，使用环境变量 fallback
-        if not _PLUGIN_KEY_INDEX:
-            fallback_key = os.environ.get("NCA_PLUGIN_KEY", "nca_2026_nodecraft_ai_plugin")
-            _PLUGIN_KEY_INDEX = {
-                fallback_key: {
-                    "id": "nodecraft_ai",
-                    "key": fallback_key,
-                    "name": "NodeCraft AI",
-                    "rate_limit": 100,
-                    "permissions": ["verify", "balance", "deduct", "refund"],
-                    "max_deduct_per_tx": 100,
-                    "max_deduct_per_day": 1000,
-                }
-            }
-            logger.warning("⚠️ 使用 fallback 插件配置")
-    finally:
-        db.close()
-
-
-def reload_plugin_registry():
-    """热更新插件注册表（管理操作后调用）"""
-    load_plugins_from_db()
-
-
-# ==========================================
-# 💰 日扣款总额限制：内存计数器（每自然日重置）
-# ==========================================
-_daily_deduct_lock = threading.Lock()
-_daily_deduct_counters: dict = {}  # {plugin_id: {"date": "2026-06-17", "total": 500}}
-
-
-def _peek_daily_used(plugin_id: str) -> int:
-    """读取插件当日已使用的扣款总额（不修改计数）。跨日自动归零。"""
-    today = str(date.today())
-    with _daily_deduct_lock:
-        counter = _daily_deduct_counters.get(plugin_id)
-        if not counter or counter.get("date") != today:
-            return 0
-        return int(counter.get("total", 0))
-
-
-def _commit_daily_used(plugin_id: str, amount: int) -> int:
-    """扣款成功后将本次金额累加到当日计数，返回累加后的总额。"""
-    today = str(date.today())
-    with _daily_deduct_lock:
-        counter = _daily_deduct_counters.get(plugin_id)
-        if not counter or counter.get("date") != today:
-            counter = {"date": today, "total": 0}
-        counter["total"] = int(counter.get("total", 0)) + int(amount)
-        _daily_deduct_counters[plugin_id] = counter
-        return counter["total"]
-
-
-def verify_plugin_key(plugin_key: str) -> dict:
-    """
-    校验 Plugin Key 并返回插件配置。
-
-    参数:
-        plugin_key: 请求头 X-Plugin-Key 的值
-    返回:
-        匹配到的插件配置字典（包含 id 字段）
-    异常:
-        401: 未提供 Plugin Key
-        403: Plugin Key 无效或未注册
-    """
-    if not plugin_key:
-        raise HTTPException(status_code=401, detail="缺少 X-Plugin-Key Header")
-    info = _PLUGIN_KEY_INDEX.get(plugin_key)
-    if not info:
-        logger.warning(f"OPEN_API_INVALID_KEY | key_prefix={plugin_key[:8]}")
-        raise HTTPException(status_code=403, detail="Plugin Key 无效或未注册")
-    return info
-
-
-# ==========================================
-# 🚦 限流：基于 plugin_id 的内存计数器（每分钟自动重置）
-# ==========================================
-_rate_lock = threading.Lock()
-_rate_buckets: dict = {}  # {plugin_id: {"window_start": int, "count": int}}
-
-
-def _check_rate_limit(plugin_info: dict, permission: str) -> None:
-    """
-    校验插件权限并执行限流。
-
-    - 权限不足 -> 403
-    - 触发限流 -> 429
-    """
-    plugin_id = plugin_info["id"]
-    rate_limit = int(plugin_info.get("rate_limit", 60))
-    perms = plugin_info.get("permissions", [])
-    if permission not in perms:
-        raise HTTPException(
-            status_code=403,
-            detail=f"插件 {plugin_id} 无权限调用 {permission} 接口",
-        )
-
-    now = int(time.time())
-    window_start = now - (now % 60)
-
-    with _rate_lock:
-        bucket = _rate_buckets.get(plugin_id)
-        if not bucket or bucket["window_start"] != window_start:
-            bucket = {"window_start": window_start, "count": 0}
-            _rate_buckets[plugin_id] = bucket
-        if bucket["count"] >= rate_limit:
-            raise HTTPException(
-                status_code=429,
-                detail=f"请求过于频繁，限流 {rate_limit}/分钟，请稍后再试",
-            )
-        bucket["count"] += 1
-
-
-def _require_plugin(plugin_key: Optional[str], permission: str) -> dict:
-    """统一入口：校验 Plugin Key + 权限 + 限流"""
-    info = verify_plugin_key(plugin_key or "")
-    _check_rate_limit(info, permission)
-    return info
-
-
-def _resolve_user_from_token(token: str) -> str:
-    """从 Token 中解析出账号；失败时抛 401"""
-    if not token:
-        raise HTTPException(status_code=401, detail="缺少用户 Token")
-    is_valid, account, error_msg = verify_token_with_fallback(token)
-    if not is_valid or not account:
-        raise HTTPException(status_code=401, detail=error_msg or "Token 无效")
-    return account
-
-
-def _calc_tx_hash(tx_id: str, account: str, tx_type: str, amount: int, prev_hash: str) -> str:
-    """计算交易哈希（与 router_wallet.calculate_tx_hash 算法一致）"""
-    data = f"{tx_id}{account}{tx_type}{amount}{prev_hash}"
-    return hashlib.sha256(data.encode()).hexdigest()
-
-
-# ==========================================
-# 📦 请求模型
-# ==========================================
-class VerifyTokenRequest(BaseModel):
-    token: str = Field(..., description="待验证的用户 JWT Token")
-
-
-class DeductRequest(BaseModel):
-    token: str = Field(..., description="用户 JWT Token")
-    amount: int = Field(..., gt=0, description="扣款金额（正整数）")
-    reason: str = Field(..., description="业务标识/扣款原因")
-    reference_id: Optional[str] = Field(None, description="业务侧参考 ID")
-
-
-class RefundRequest(BaseModel):
-    token: str = Field(..., description="用户 JWT Token")
-    transaction_id: str = Field(..., description="原扣款交易 ID")
-    amount: int = Field(..., gt=0, description="退款金额（正整数）")
-
-
-# ==========================================
-# 1️⃣ Token 验证：POST /api/open/verify-token
-# ==========================================
-@router.post("/verify-token")
-async def open_verify_token(
-    req: VerifyTokenRequest,
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-):
-    """
-    供第三方插件验证用户 Token 有效性。
-    成功返回账号与基础资料（昵称、头像）。
-    """
-    plugin_info = _require_plugin(x_plugin_key, "verify")
-
-    is_valid, account, error_msg = verify_token_with_fallback(req.token)
-    if not is_valid or not account:
-        logger.info(
-            f"OPEN_VERIFY_TOKEN_FAIL | plugin={plugin_info['id']} | reason={error_msg}"
-        )
-        return {"valid": False, "error": error_msg or "Token 无效"}
-
-    users_db = json_db.load_data("users.json", default_data={})
-    user = users_db.get(account, {}) or {}
-
-    logger.info(f"OPEN_VERIFY_TOKEN | plugin={plugin_info['id']} | account={account}")
-    return {
-        "valid": True,
-        "account": account,
-        "name": user.get("name", account),
-        "avatar": user.get("avatarDataUrl", "") or user.get("avatar", ""),
-    }
-
-
-# ==========================================
-# 2️⃣ 余额查询：GET /api/open/balance
-# ==========================================
-@router.get("/balance")
-async def open_get_balance(
-    authorization: Optional[str] = Header(None, alias="Authorization"),
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    db: Session = Depends(get_db),
-):
-    """
-    查询用户钱包余额。
-    认证：Authorization: Bearer <user_token> + X-Plugin-Key
-    """
-    plugin_info = _require_plugin(x_plugin_key, "balance")
-
-    if not authorization:
-        raise HTTPException(status_code=401, detail="缺少 Authorization Header")
-    parts = authorization.split(" ", 1)
-    if len(parts) != 2 or parts[0].lower() != "bearer":
-        raise HTTPException(status_code=401, detail="Authorization 格式错误，请使用 Bearer Token")
-
-    account = _resolve_user_from_token(parts[1])
-    wallet = db.query(Wallet).filter(Wallet.account == account).first()
-
-    if not wallet:
-        result = {
-            "account": account,
-            "balance": 0,
-            "earn_balance": 0,
-            "tip_balance": 0,
-            "task_balance": 0,
-            "frozen_balance": 0,
-        }
-    else:
-        result = {
-            "account": account,
-            "balance": int(wallet.balance or 0),
-            "earn_balance": int(wallet.earn_balance or 0),
-            "tip_balance": int(wallet.tip_balance or 0),
-            "task_balance": int(wallet.task_balance or 0),
-            "frozen_balance": int(wallet.frozen_balance or 0),
-        }
-
-    logger.info(
-        f"OPEN_BALANCE | plugin={plugin_info['id']} | account={account} | balance={result['balance']}"
-    )
-    return result
-
-
-# ==========================================
-# 3️⃣ 通用扣款：POST /api/open/deduct
-# ==========================================
-@router.post("/deduct")
-async def open_deduct(
-    req: DeductRequest,
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    db: Session = Depends(get_db),
-):
-    """
-    通用扣款接口（从 wallet.balance 扣减）。
-    流程：
-      1. 校验 Plugin Key + 权限 + 限流
-      2. 解析 Token -> account
-      3. 悲观锁锁定钱包，检查余额
-      4. 扣款 + 写入 Transaction（含哈希链）
-    """
-    plugin_info = _require_plugin(x_plugin_key, "deduct")
-    account = _resolve_user_from_token(req.token)
-    amount = int(req.amount)
-
-    # 🛡️ 单笔扣款上限校验（在余额检查之前快速拒绝）
-    max_per_tx = int(plugin_info.get("max_deduct_per_tx", 100))
-    if amount > max_per_tx:
-        logger.warning(
-            f"OPEN_DEDUCT_TX_LIMIT | plugin={plugin_info['id']} | account={account} | "
-            f"amount={amount} | max={max_per_tx}"
-        )
-        return JSONResponse(status_code=403, content={
-            "error": "AMOUNT_EXCEEDS_LIMIT",
-            "message": f"单笔扣款不能超过{max_per_tx}积分",
-            "max": max_per_tx,
-        })
-
-    # 🛡️ 日扣款总额校验（仅检查不累加，扣款成功后再累加）
-    max_daily = int(plugin_info.get("max_deduct_per_day", 1000))
-    used_today = _peek_daily_used(plugin_info["id"])
-    if used_today + amount > max_daily:
-        logger.warning(
-            f"OPEN_DEDUCT_DAILY_LIMIT | plugin={plugin_info['id']} | account={account} | "
-            f"amount={amount} | used={used_today} | limit={max_daily}"
-        )
-        return JSONResponse(status_code=403, content={
-            "error": "DAILY_LIMIT_EXCEEDED",
-            "message": "今日扣款已达上限",
-            "limit": max_daily,
-            "used": used_today,
-        })
-
-    try:
-        wallet = (
-            db.query(Wallet)
-            .filter(Wallet.account == account)
-            .with_for_update()
-            .first()
-        )
-        if not wallet or int(wallet.balance or 0) < amount:
-            raise HTTPException(status_code=402, detail="余额不足")
-
-        wallet.balance = int(wallet.balance or 0) - amount
-
-        tx_id = f"OPEN_DEDUCT_{int(time.time())}_{uuid.uuid4().hex[:8]}"
-        last_tx = (
-            db.query(Transaction)
-            .filter(Transaction.account == account)
-            .order_by(Transaction.created_at.desc())
-            .first()
-        )
-        prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
-        tx_hash = _calc_tx_hash(tx_id, account, "OPEN_DEDUCT", -amount, prev_hash)
-
-        new_tx = Transaction(
-            tx_id=tx_id,
-            account=account,
-            tx_type="OPEN_DEDUCT",
-            amount=-amount,
-            related_account=plugin_info["id"],
-            item_id=req.reference_id,
-            prev_hash=prev_hash,
-            tx_hash=tx_hash,
-            description=f"[{plugin_info['name']}] {req.reason}",
-            source_plugin=plugin_info["id"],  # 🌐 来源插件标识，用于按工具结构化追踪
-        )
-        db.add(new_tx)
-        db.commit()
-        db.refresh(wallet)
-    except HTTPException:
-        db.rollback()
-        raise
-    except Exception as e:
-        db.rollback()
-        logger.error(
-            f"OPEN_DEDUCT_FAIL | plugin={plugin_info['id']} | account={account} | err={e}"
-        )
-        raise HTTPException(status_code=500, detail=f"扣款失败: {e}")
-
-    # ✅ 扣款成功后再累加日计数器，避免余额不足等失败场景占用额度
-    daily_total = _commit_daily_used(plugin_info["id"], amount)
-
-    logger.info(
-        f"OPEN_DEDUCT | plugin={plugin_info['id']} | account={account} | "
-        f"amount={amount} | tx={tx_id} | reason={req.reason} | ref={req.reference_id} | "
-        f"daily_used={daily_total}/{max_daily}"
-    )
-    return {
-        "success": True,
-        "remaining_balance": int(wallet.balance or 0),
-        "transaction_id": tx_id,
-    }
-
-
-# ==========================================
-# 4️⃣ 退款：POST /api/open/refund
-# ==========================================
-@router.post("/refund")
-async def open_refund(
-    req: RefundRequest,
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    db: Session = Depends(get_db),
-):
-    """
-    退款接口：将之前 OPEN_DEDUCT 的金额（部分或全额）退还到用户钱包。
-
-    校验：
-      - 原交易必须存在且 tx_type == OPEN_DEDUCT
-      - 原交易归属当前 token 用户
-      - 原交易由当前插件发起（related_account == plugin_id）
-      - 累计退款金额 ≤ 原扣款金额
-    """
-    plugin_info = _require_plugin(x_plugin_key, "refund")
-    account = _resolve_user_from_token(req.token)
-    refund_amount = int(req.amount)
-
-    original_tx = (
-        db.query(Transaction).filter(Transaction.tx_id == req.transaction_id).first()
-    )
-    if not original_tx:
-        raise HTTPException(status_code=404, detail="原交易不存在")
-    if original_tx.account != account:
-        raise HTTPException(status_code=403, detail="无权对该交易执行退款")
-    if original_tx.tx_type != "OPEN_DEDUCT":
-        raise HTTPException(status_code=400, detail="该交易类型不支持开放退款")
-    if (original_tx.related_account or "") != plugin_info["id"]:
-        raise HTTPException(status_code=403, detail="不允许跨插件退款")
-
-    original_amount = abs(int(original_tx.amount or 0))
-    if refund_amount > original_amount:
-        raise HTTPException(status_code=400, detail="退款金额超过原扣款金额")
-
-    # 累计已退金额校验（防止重复退款超额）
-    refunded_records = (
-        db.query(Transaction)
-        .filter(
-            Transaction.tx_type == "OPEN_REFUND",
-            Transaction.related_account == plugin_info["id"],
-            Transaction.item_id == req.transaction_id,
-        )
-        .all()
-    )
-    already_refunded = sum(abs(int(t.amount or 0)) for t in refunded_records)
-    if already_refunded + refund_amount > original_amount:
-        raise HTTPException(
-            status_code=400,
-            detail=f"退款金额超过可退余额（已退 {already_refunded}/{original_amount}）",
-        )
-
-    try:
-        wallet = (
-            db.query(Wallet)
-            .filter(Wallet.account == account)
-            .with_for_update()
-            .first()
-        )
-        if not wallet:
-            wallet = Wallet(
-                account=account,
-                balance=0,
-                earn_balance=0,
-                tip_balance=0,
-                frozen_balance=0,
-            )
-            db.add(wallet)
-            db.flush()
-        wallet.balance = int(wallet.balance or 0) + refund_amount
-
-        tx_id = f"OPEN_REFUND_{int(time.time())}_{uuid.uuid4().hex[:8]}"
-        last_tx = (
-            db.query(Transaction)
-            .filter(Transaction.account == account)
-            .order_by(Transaction.created_at.desc())
-            .first()
-        )
-        prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
-        tx_hash = _calc_tx_hash(tx_id, account, "OPEN_REFUND", refund_amount, prev_hash)
-
-        new_tx = Transaction(
-            tx_id=tx_id,
-            account=account,
-            tx_type="OPEN_REFUND",
-            amount=refund_amount,
-            related_account=plugin_info["id"],
-            item_id=req.transaction_id,  # 关联原扣款交易
-            prev_hash=prev_hash,
-            tx_hash=tx_hash,
-            description=f"[{plugin_info['name']}] 退款 {req.transaction_id}",
-            source_plugin=plugin_info["id"],  # 🌐 来源插件标识
-        )
-        db.add(new_tx)
-        db.commit()
-        db.refresh(wallet)
-    except HTTPException:
-        db.rollback()
-        raise
-    except Exception as e:
-        db.rollback()
-        logger.error(
-            f"OPEN_REFUND_FAIL | plugin={plugin_info['id']} | account={account} | err={e}"
-        )
-        raise HTTPException(status_code=500, detail=f"退款失败: {e}")
-
-    logger.info(
-        f"OPEN_REFUND | plugin={plugin_info['id']} | account={account} | "
-        f"amount={refund_amount} | tx={tx_id} | original={req.transaction_id}"
-    )
-    return {
-        "success": True,
-        "remaining_balance": int(wallet.balance or 0),
-        "transaction_id": tx_id,
-    }
-
-
-# ==========================================
-# 5️⃣ 消费记录查询：GET /api/open/transactions
-# ==========================================
-@router.get("/transactions")
-async def open_list_transactions(
-    authorization: Optional[str] = Header(None, alias="Authorization"),
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    page: int = Query(1, ge=1, description="页码（从 1 开始）"),
-    page_size: int = Query(20, ge=1, le=100, description="每页条数（1-100）"),
-    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
-    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
-    tx_type: Optional[str] = Query(None, description="交易类型，如 OPEN_DEDUCT / OPEN_REFUND"),
-    db: Session = Depends(get_db),
-):
-    """
-    查询当前用户由当前插件产生的消费/退款记录。
-
-    认证：Authorization: Bearer <user_token> + X-Plugin-Key
-    安全：仅返回 source_plugin == 当前 plugin_id 的记录，防止跨插件读取。
-    """
-    plugin_info = _require_plugin(x_plugin_key, "verify")
-
-    if not authorization:
-        raise HTTPException(status_code=401, detail="缺少 Authorization Header")
-    parts = authorization.split(" ", 1)
-    if len(parts) != 2 or parts[0].lower() != "bearer":
-        raise HTTPException(status_code=401, detail="Authorization 格式错误，请使用 Bearer Token")
-    account = _resolve_user_from_token(parts[1])
-
-    plugin_id = plugin_info["id"]
-
-    # 构造查询：按 source_plugin 过滤；兼容历史 NULL 数据走 related_account 兜底
-    q = db.query(Transaction).filter(
-        Transaction.account == account,
-        ((Transaction.source_plugin == plugin_id)
-         | ((Transaction.source_plugin.is_(None)) & (Transaction.related_account == plugin_id))),
-    )
-
-    if tx_type:
-        q = q.filter(Transaction.tx_type == tx_type)
-    if start_time is not None:
-        q = q.filter(Transaction.created_at >= datetime.datetime.utcfromtimestamp(int(start_time)))
-    if end_time is not None:
-        q = q.filter(Transaction.created_at <= datetime.datetime.utcfromtimestamp(int(end_time)))
-
-    total = q.count()
-    rows = (
-        q.order_by(Transaction.created_at.desc())
-        .offset((page - 1) * page_size)
-        .limit(page_size)
-        .all()
-    )
-
-    items = []
-    for t in rows:
-        created_ts = int(t.created_at.timestamp()) if t.created_at else 0
-        # reason 从 description 中解析（去掉 [插件名] 前缀），兼容旧记录
-        reason = (t.description or "").replace(f"[{plugin_info['name']}] ", "").strip() or None
-        items.append({
-            "id": t.tx_id,
-            "type": t.tx_type,
-            "amount": int(t.amount or 0),
-            "reason": reason,
-            "reference_id": t.item_id,
-            "created_at": created_ts,
-            "description": t.description or "",
-        })
-
-    logger.info(
-        f"OPEN_LIST_TX | plugin={plugin_id} | account={account} | "
-        f"page={page}/{page_size} | total={total}"
-    )
-    return {
-        "success": True,
-        "transactions": items,
-        "total": total,
-        "page": page,
-        "page_size": page_size,
-    }
-
-
-# ==========================================
-# 6️⃣ 消费汇总：GET /api/open/usage-summary
-# ==========================================
-@router.get("/usage-summary")
-async def open_usage_summary(
-    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
-    account: Optional[str] = Query(None, description="指定用户账号，不传则统计所有用户"),
-    period: str = Query("daily", description="聚合粒度：daily / monthly / total"),
-    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
-    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
-    db: Session = Depends(get_db),
-):
-    """
-    本插件维度的消费汇总统计。
-
-    返回：总扣款 / 总退款 / 总笔数 / 净消费 + 按 period 分桶的明细。
-    安全：仅统计 source_plugin == 当前 plugin_id 的记录。
-    """
-    plugin_info = _require_plugin(x_plugin_key, "verify")
-    plugin_id = plugin_info["id"]
-
-    period = (period or "daily").lower()
-    if period not in ("daily", "monthly", "total"):
-        raise HTTPException(status_code=400, detail="period 仅支持 daily / monthly / total")
-
-    base = db.query(Transaction).filter(
-        ((Transaction.source_plugin == plugin_id)
-         | ((Transaction.source_plugin.is_(None)) & (Transaction.related_account == plugin_id))),
-        Transaction.tx_type.in_(["OPEN_DEDUCT", "OPEN_REFUND"]),
-    )
-    if account:
-        base = base.filter(Transaction.account == account)
-    if start_time is not None:
-        base = base.filter(Transaction.created_at >= datetime.datetime.utcfromtimestamp(int(start_time)))
-    if end_time is not None:
-        base = base.filter(Transaction.created_at <= datetime.datetime.utcfromtimestamp(int(end_time)))
-
-    rows = base.all()
-
-    total_deduct = 0
-    total_refund = 0
-    total_count = len(rows)
-    bucket: dict = {}  # key -> {"deduct":int,"refund":int,"count":int}
-
-    for t in rows:
-        amt = int(t.amount or 0)
-        if t.tx_type == "OPEN_DEDUCT":
-            total_deduct += abs(amt)
-        elif t.tx_type == "OPEN_REFUND":
-            total_refund += abs(amt)
-
-        if period == "total":
-            continue
-        if not t.created_at:
-            continue
-        if period == "daily":
-            key = t.created_at.strftime("%Y-%m-%d")
-        else:  # monthly
-            key = t.created_at.strftime("%Y-%m")
-
-        b = bucket.setdefault(key, {"deduct": 0, "refund": 0, "count": 0})
-        if t.tx_type == "OPEN_DEDUCT":
-            b["deduct"] += abs(amt)
-        elif t.tx_type == "OPEN_REFUND":
-            b["refund"] += abs(amt)
-        b["count"] += 1
-
-    breakdown = []
-    if period != "total":
-        for key in sorted(bucket.keys(), reverse=True):
-            v = bucket[key]
-            label = "date" if period == "daily" else "month"
-            breakdown.append({
-                label: key,
-                "deduct": v["deduct"],
-                "refund": v["refund"],
-                "count": v["count"],
-            })
-
-    logger.info(
-        f"OPEN_USAGE_SUMMARY | plugin={plugin_id} | account={account or '*'} | "
-        f"period={period} | tx_count={total_count}"
-    )
-    return {
-        "success": True,
-        "plugin_id": plugin_id,
-        "plugin_name": plugin_info.get("name", plugin_id),
-        "summary": {
-            "total_deduct": total_deduct,
-            "total_refund": total_refund,
-            "total_transactions": total_count,
-            "net_consumption": total_deduct - total_refund,
-        },
-        "breakdown": breakdown,
-    }
+import asyncio
+# router_open_api.py
+# ==========================================
+# 🌐 通用开放 API 模块（供第三方插件调用）
+# ==========================================
+# 作用：对外提供受 Plugin Key 保护的通用接口，
+#       供 NodeCraft AI 等第三方插件复用 ComfyUI-Ranking 账号体系。
+# 关联文件：
+#   - 安全认证.py        (verify_token_with_fallback, require_auth)
+#   - database_sql.py    (get_db, SessionLocal)
+#   - models_sql.py      (Wallet, Transaction)
+#   - 数据库连接.py       (users.json 读写)
+# 安全机制：
+#   - X-Plugin-Key Header 鉴权
+#   - 基于 plugin_id 的 SQL 持久化限流（每分钟窗口，多 worker 共享）
+#   - 所有扣款/退款操作记录到 Transaction 流水（含哈希链）
+# ==========================================
+
+import os
+import json
+import time
+import uuid
+import datetime
+import hashlib
+import logging
+from typing import Optional
+
+from fastapi import APIRouter, Depends, Header, HTTPException, Query
+from fastapi.responses import JSONResponse
+from sqlalchemy.orm import Session
+from sqlalchemy import func, text
+from pydantic import BaseModel, Field
+
+from database_sql import get_db, SessionLocal
+from models_sql import Wallet, Transaction, RegisteredPlugin, OpenApiRateLimitBucket
+from open_transaction import lock_open_wallet, positive_integer, validate_live_plugin, quota_total
+from tip_store import run_tip_effect
+from 安全认证 import verify_token_with_fallback
+import 数据库连接 as json_db
+
+logger = logging.getLogger("ComfyUI-Ranking.OpenAPI")
+
+router = APIRouter(prefix="/api/open", tags=["open-api"])
+
+
+# ═══════════════ 插件注册表（从数据库动态加载） ═══════════════
+# 反向索引：plugin_key -> {id, key, name, rate_limit, permissions, max_deduct_per_tx, max_deduct_per_day}
+_PLUGIN_KEY_INDEX: dict = {}
+_INSECURE_LEGACY_PLUGIN_KEYS = frozenset({"nca_2026_nodecraft_ai_plugin"})
+
+
+def load_plugins_from_db():
+    """启动时从数据库加载所有启用的插件到内存索引"""
+    global _PLUGIN_KEY_INDEX
+
+    db = None
+    try:
+        db = SessionLocal()
+        # 首次启动时仅在显式配置高熵 Key 时 seed 默认插件，不再使用源码内固定凭证。
+        if not db.query(RegisteredPlugin).first():
+            default_key = os.environ.get("NCA_PLUGIN_KEY", "").strip()
+            if len(default_key) >= 32 and default_key not in _INSECURE_LEGACY_PLUGIN_KEYS:
+                default_plugin = RegisteredPlugin(
+                    plugin_id="nodecraft_ai",
+                    plugin_key=default_key,
+                    name="NodeCraft AI",
+                    enabled=True,
+                    rate_limit=100,
+                    max_deduct_per_tx=100,
+                    max_deduct_per_day=1000,
+                    permissions='["verify","balance","deduct","refund"]',
+                    created_by="system",
+                )
+                db.add(default_plugin)
+                db.commit()
+                logger.info("✅ 已 seed 默认插件: NodeCraft AI")
+            else:
+                logger.warning("NCA_PLUGIN_KEY 缺失或不符合安全要求，跳过默认插件 seed")
+
+        plugins = db.query(RegisteredPlugin).filter(RegisteredPlugin.enabled == True).all()
+
+        # 构建内存索引
+        new_index = {}
+        for p in plugins:
+            # 固定旧 Key 已随源代码泄露，不能继续接受；管理员轮换成新 Key 后即可恢复。
+            if p.plugin_key in _INSECURE_LEGACY_PLUGIN_KEYS:
+                logger.critical(f"拒绝加载已泄露的默认 Plugin Key: plugin_id={p.plugin_id}")
+                continue
+            try:
+                perms = json.loads(p.permissions) if p.permissions else ["verify", "balance", "deduct", "refund"]
+            except Exception:
+                perms = ["verify", "balance", "deduct", "refund"]
+            new_index[p.plugin_key] = {
+                "id": p.plugin_id,
+                "key": p.plugin_key,
+                "name": p.name,
+                "rate_limit": p.rate_limit or 100,
+                "permissions": perms,
+                "max_deduct_per_tx": p.max_deduct_per_tx or 100,
+                "max_deduct_per_day": p.max_deduct_per_day or 1000,
+            }
+
+        _PLUGIN_KEY_INDEX = new_index
+        logger.info(f"✅ 已加载 {len(new_index)} 个插件到注册表")
+    except Exception as e:
+        # 数据源不可信/不可用时 fail closed：清空内存索引，撤销旧 Key 的继续访问能力。
+        _PLUGIN_KEY_INDEX = {}
+        logger.error(f"❌ 加载插件注册表失败: error_type={type(e).__name__}; 插件 API 已 fail closed")
+    finally:
+        if db is not None:
+            try:
+                db.close()
+            except Exception as e:
+                _PLUGIN_KEY_INDEX = {}
+                logger.error(
+                    f"关闭插件注册表会话失败: error_type={type(e).__name__}; 插件 API 已 fail closed"
+                )
+
+
+def reload_plugin_registry():
+    """热更新插件注册表（管理操作后调用）"""
+    load_plugins_from_db()
+
+
+# ==========================================
+def verify_plugin_key(plugin_key: str) -> dict:
+    """
+    校验 Plugin Key 并返回插件配置。
+
+    参数:
+        plugin_key: 请求头 X-Plugin-Key 的值
+    返回:
+        匹配到的插件配置字典（包含 id 字段）
+    异常:
+        401: 未提供 Plugin Key
+        403: Plugin Key 无效或未注册
+    """
+    if not plugin_key:
+        raise HTTPException(status_code=401, detail="缺少 X-Plugin-Key Header")
+    info = _PLUGIN_KEY_INDEX.get(plugin_key)
+    if not info:
+        logger.warning("OPEN_API_INVALID_KEY")
+        raise HTTPException(status_code=403, detail="Plugin Key 无效或未注册")
+    return info
+
+
+# ==========================================
+# 🚦 限流：SQL 分钟计数器，多 worker 共享
+# ==========================================
+def _check_rate_limit(plugin_info: dict, permission: str, db: Session) -> None:
+    """
+    校验插件权限并执行限流。
+
+    - 权限不足 -> 403
+    - 触发限流 -> 429
+    """
+    plugin_id = plugin_info["id"]
+
+    now = int(time.time())
+    window_start = now - (now % 60)
+    try:
+        # 对配置列执行 no-op UPDATE：PostgreSQL 获取行锁，SQLite 也会取得写事务锁；
+        # 再 SELECT FOR UPDATE，保证首次建桶和窗口递增串行，而不是只依赖进程锁。
+        db.execute(
+            text("UPDATE registered_plugins SET rate_limit = rate_limit WHERE plugin_id = :plugin_id"),
+            {"plugin_id": plugin_id},
+        )
+        plugin_row = (db.query(RegisteredPlugin)
+            .filter(RegisteredPlugin.plugin_id == plugin_id)
+            .populate_existing()
+            .with_for_update()
+            .first())
+        validate_live_plugin(plugin_row, plugin_info.get("key"), permission)
+        rate_limit = positive_integer(plugin_row.rate_limit)
+        bucket = (db.query(OpenApiRateLimitBucket)
+            .filter(OpenApiRateLimitBucket.plugin_id == plugin_id)
+            .with_for_update()
+            .first())
+        if not bucket:
+            bucket = OpenApiRateLimitBucket(
+                plugin_id=plugin_id, window_start=window_start, request_count=0
+            )
+            db.add(bucket)
+            db.flush()
+        if bucket.window_start != window_start:
+            bucket.window_start = window_start
+            bucket.request_count = 0
+        if bucket.request_count >= rate_limit:
+            db.rollback()
+            raise HTTPException(
+                status_code=429,
+                detail=f"请求过于频繁，限流 {rate_limit}/分钟，请稍后再试",
+            )
+        bucket.request_count += 1
+        db.commit()
+    except HTTPException:
+        db.rollback()
+        raise
+    except Exception as exc:
+        db.rollback()
+        logger.error(f"OPEN_API_RATE_LIMIT_DB_FAIL | plugin={plugin_id} | error_type={type(exc).__name__}")
+        raise HTTPException(status_code=503, detail="插件限流服务暂不可用")
+
+
+def _require_plugin(plugin_key: Optional[str], permission: str, db: Session) -> dict:
+    """统一入口：校验 Plugin Key + 权限 + 限流"""
+    info = verify_plugin_key(plugin_key or "")
+    _check_rate_limit(info, permission, db)
+    return info
+
+
+async def _resolve_user_from_token(token: str) -> str:
+    """从 Token 中解析出账号；失败时抛 401"""
+    if not token:
+        raise HTTPException(status_code=401, detail="缺少用户 Token")
+    is_valid, account, error_msg = await asyncio.to_thread(verify_token_with_fallback, token)
+    if not is_valid or not account:
+        raise HTTPException(status_code=401, detail=error_msg or "Token 无效")
+    return account
+
+
+def _calc_tx_hash(tx_id: str, account: str, tx_type: str, amount: int, prev_hash: str) -> str:
+    """计算交易哈希（与 router_wallet.calculate_tx_hash 算法一致）"""
+    data = f"{tx_id}{account}{tx_type}{amount}{prev_hash}"
+    return hashlib.sha256(data.encode()).hexdigest()
+
+
+# ==========================================
+# 📦 请求模型
+# ==========================================
+class VerifyTokenRequest(BaseModel):
+    token: str = Field(..., description="待验证的用户 JWT Token")
+
+
+class DeductRequest(BaseModel):
+    token: str = Field(..., description="用户 JWT Token")
+    amount: int = Field(..., gt=0, strict=True, description="扣款金额（正整数）")
+    reason: str = Field(..., description="业务标识/扣款原因")
+    reference_id: Optional[str] = Field(None, description="业务侧参考 ID")
+
+
+class RefundRequest(BaseModel):
+    token: str = Field(..., description="用户 JWT Token")
+    transaction_id: str = Field(..., description="原扣款交易 ID")
+    amount: int = Field(..., gt=0, strict=True, description="退款金额（正整数）")
+
+
+# ==========================================
+# 1️⃣ Token 验证：POST /api/open/verify-token
+# ==========================================
+@router.post("/verify-token")
+async def open_verify_token(
+    req: VerifyTokenRequest,
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    db: Session = Depends(get_db),
+):
+    """
+    供第三方插件验证用户 Token 有效性。
+    成功返回账号与基础资料（昵称、头像）。
+    """
+    plugin_info = _require_plugin(x_plugin_key, "verify", db)
+
+    is_valid, account, error_msg = await asyncio.to_thread(verify_token_with_fallback, req.token)
+    if not is_valid or not account:
+        logger.info(f"OPEN_VERIFY_TOKEN_FAIL | plugin={plugin_info['id']} | category=invalid_token")
+        return {"valid": False, "error": error_msg or "Token 无效"}
+
+    users_db = json_db.load_data("users.json", default_data={})
+    user = users_db.get(account, {}) or {}
+
+    logger.info(f"OPEN_VERIFY_TOKEN | plugin={plugin_info['id']}")
+    return {
+        "valid": True,
+        "account": account,
+        "name": user.get("name", account),
+        "avatar": user.get("avatarDataUrl", "") or user.get("avatar", ""),
+    }
+
+
+# ==========================================
+# 2️⃣ 余额查询：GET /api/open/balance
+# ==========================================
+@router.get("/balance")
+async def open_get_balance(
+    authorization: Optional[str] = Header(None, alias="Authorization"),
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    db: Session = Depends(get_db),
+):
+    """
+    查询用户钱包余额。
+    认证：Authorization: Bearer <user_token> + X-Plugin-Key
+    """
+    plugin_info = _require_plugin(x_plugin_key, "balance", db)
+
+    if not authorization:
+        raise HTTPException(status_code=401, detail="缺少 Authorization Header")
+    parts = authorization.split(" ", 1)
+    if len(parts) != 2 or parts[0].lower() != "bearer":
+        raise HTTPException(status_code=401, detail="Authorization 格式错误，请使用 Bearer Token")
+
+    account = await _resolve_user_from_token(parts[1])
+    wallet = db.query(Wallet).filter(Wallet.account == account).first()
+
+    if not wallet:
+        result = {
+            "account": account,
+            "balance": 0,
+            "earn_balance": 0,
+            "tip_balance": 0,
+            "task_balance": 0,
+            "frozen_balance": 0,
+        }
+    else:
+        result = {
+            "account": account,
+            "balance": int(wallet.balance or 0),
+            "earn_balance": int(wallet.earn_balance or 0),
+            "tip_balance": int(wallet.tip_balance or 0),
+            "task_balance": int(wallet.task_balance or 0),
+            "frozen_balance": int(wallet.frozen_balance or 0),
+        }
+
+    logger.info(f"OPEN_BALANCE | plugin={plugin_info['id']}")
+    return result
+
+
+# ==========================================
+# 3️⃣ 通用扣款：POST /api/open/deduct
+# ==========================================
+@router.post("/deduct")
+async def open_deduct(
+    req: DeductRequest,
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    db: Session = Depends(get_db),
+):
+    """
+    通用扣款接口（从 wallet.balance 扣减）。
+    流程：
+      1. 校验 Plugin Key + 权限 + 限流
+      2. 解析 Token -> account
+      3. 共用写锁锁定钱包与实时插件配置，检查额度/余额
+      4. 扣款 + 写入 Transaction（含哈希链）
+    """
+    plugin_info = _require_plugin(x_plugin_key, "deduct", db)
+    account = await _resolve_user_from_token(req.token)
+    amount = req.amount
+    if isinstance(amount, bool) or not isinstance(amount, int) or amount <= 0:
+        raise HTTPException(status_code=422, detail="扣款金额必须为正整数")
+    try:
+        wallet, plugin_row = lock_open_wallet(db, account, plugin_info["id"], x_plugin_key, "deduct")
+        max_per_tx = positive_integer(plugin_row.max_deduct_per_tx)
+        max_daily = positive_integer(plugin_row.max_deduct_per_day)
+        if amount > max_per_tx:
+            db.rollback()
+            return JSONResponse(status_code=403, content={
+                "error": "AMOUNT_EXCEEDS_LIMIT", "message": f"单笔扣款不能超过{max_per_tx}积分", "max": max_per_tx})
+        now = datetime.datetime.utcnow()
+        day_start = now.replace(hour=0, minute=0, second=0, microsecond=0)
+        used_today = db.query(func.coalesce(func.sum(func.abs(Transaction.amount)), 0)).filter(
+            Transaction.tx_type == "OPEN_DEDUCT", Transaction.source_plugin == plugin_info["id"],
+            Transaction.created_at >= day_start,
+            Transaction.created_at < day_start + datetime.timedelta(days=1)).scalar()
+        used_today = quota_total(used_today)
+        if used_today + amount > max_daily:
+            db.rollback()
+            return JSONResponse(status_code=403, content={
+                "error": "DAILY_LIMIT_EXCEEDED", "message": "今日扣款已达上限", "limit": max_daily, "used": used_today})
+        if wallet is None:
+            raise HTTPException(status_code=402, detail="余额不足")
+        if isinstance(wallet.balance, bool) or not isinstance(wallet.balance, int):
+            raise ValueError("invalid wallet balance")
+        if wallet.balance < amount:
+            raise HTTPException(status_code=402, detail="余额不足")
+        wallet.balance -= amount
+        tx_id = f"OPEN_DEDUCT_{uuid.uuid4().hex}"
+        last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(
+            Transaction.created_at.desc(), Transaction.tx_id.desc()).with_for_update().first()
+        prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
+        db.add(Transaction(tx_id=tx_id, account=account, tx_type="OPEN_DEDUCT", amount=-amount,
+            related_account=plugin_info["id"], item_id=req.reference_id, prev_hash=prev_hash,
+            tx_hash=_calc_tx_hash(tx_id, account, "OPEN_DEDUCT", -amount, prev_hash),
+            description=f"[{plugin_row.name}] {req.reason}", source_plugin=plugin_info["id"]))
+        response = {"success": True, "remaining_balance": wallet.balance, "transaction_id": tx_id}
+        db.commit()
+    except HTTPException:
+        db.rollback()
+        raise
+    except Exception as error:
+        db.rollback()
+        logger.error("OPEN_DEDUCT_FAIL | error_type=%s", type(error).__name__)
+        raise HTTPException(status_code=500, detail="扣款失败，请稍后重试")
+    run_tip_effect(lambda: logger.info("OPEN_DEDUCT_COMPLETED"))
+    return response
+
+
+# ==========================================
+# 4️⃣ 退款：POST /api/open/refund
+# ==========================================
+@router.post("/refund")
+async def open_refund(
+    req: RefundRequest,
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    db: Session = Depends(get_db),
+):
+    """
+    退款接口：将之前 OPEN_DEDUCT 的金额（部分或全额）退还到用户钱包��
+
+    校验：
+      - 原交易必须存在且 tx_type == OPEN_DEDUCT
+      - 原交易归属当前 token 用户
+      - 原交易由当前插件发起（related_account == plugin_id）
+      - 累计退款金额 ≤ 原扣款金额
+    """
+    plugin_info = _require_plugin(x_plugin_key, "refund", db)
+    account = await _resolve_user_from_token(req.token)
+    refund_amount = req.amount
+    if isinstance(refund_amount, bool) or not isinstance(refund_amount, int) or refund_amount <= 0:
+        raise HTTPException(status_code=422, detail="退款金额必须为正整数")
+    try:
+        wallet, plugin_row = lock_open_wallet(db, account, plugin_info["id"], x_plugin_key, "refund")
+        original_tx = db.query(Transaction).filter(Transaction.tx_id == req.transaction_id).populate_existing().with_for_update().first()
+        if original_tx is None:
+            raise HTTPException(status_code=404, detail="原交易不存在")
+        if original_tx.account != account:
+            raise HTTPException(status_code=403, detail="无权对该交易执行退款")
+        if original_tx.tx_type != "OPEN_DEDUCT":
+            raise HTTPException(status_code=400, detail="该交易类型不支持开放退款")
+        if original_tx.related_account != plugin_info["id"] or original_tx.source_plugin not in (None, plugin_info["id"]):
+            raise HTTPException(status_code=403, detail="不允许跨插件退款")
+        if isinstance(original_tx.amount, bool) or not isinstance(original_tx.amount, int) or original_tx.amount >= 0:
+            raise HTTPException(status_code=503, detail="原交易金额暂时无法核实")
+        original_amount = -original_tx.amount
+        # 校验全部关联退款，不能用 abs() 把损坏的负退款/跨账号记录视为合法。
+        refunded = db.query(Transaction).filter(
+            Transaction.tx_type == "OPEN_REFUND", Transaction.item_id == req.transaction_id).all()
+        if any(row.account != account or row.related_account != plugin_info["id"] or
+            row.source_plugin not in (None, plugin_info["id"]) or isinstance(row.amount, bool) or
+            not isinstance(row.amount, int) or row.amount <= 0 for row in refunded):
+            raise HTTPException(status_code=503, detail="退款流水暂时无法核实")
+        already_refunded = sum(row.amount for row in refunded)
+        if already_refunded + refund_amount > original_amount:
+            raise HTTPException(status_code=400, detail="退款金额超过可退余额")
+        if wallet is None:
+            raise HTTPException(status_code=503, detail="钱包记录暂时无法核实")
+        if isinstance(wallet.balance, bool) or not isinstance(wallet.balance, int):
+            raise ValueError("invalid wallet balance")
+        wallet.balance += refund_amount
+        tx_id = f"OPEN_REFUND_{uuid.uuid4().hex}"
+        last_tx = db.query(Transaction).filter(Transaction.account == account).order_by(
+            Transaction.created_at.desc(), Transaction.tx_id.desc()).with_for_update().first()
+        prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
+        db.add(Transaction(tx_id=tx_id, account=account, tx_type="OPEN_REFUND", amount=refund_amount,
+            related_account=plugin_info["id"], item_id=req.transaction_id, prev_hash=prev_hash,
+            tx_hash=_calc_tx_hash(tx_id, account, "OPEN_REFUND", refund_amount, prev_hash),
+            description=f"[{plugin_row.name}] 退款 {req.transaction_id}", source_plugin=plugin_info["id"]))
+        response = {"success": True, "remaining_balance": wallet.balance, "transaction_id": tx_id}
+        db.commit()
+    except HTTPException:
+        db.rollback()
+        raise
+    except Exception as error:
+        db.rollback()
+        logger.error("OPEN_REFUND_FAIL | error_type=%s", type(error).__name__)
+        raise HTTPException(status_code=500, detail="退款失败，请稍后重试")
+    run_tip_effect(lambda: logger.info("OPEN_REFUND_COMPLETED"))
+    return response
+
+
+# ==========================================
+# 5️⃣ 消费记录查询：GET /api/open/transactions
+# ==========================================
+@router.get("/transactions")
+async def open_list_transactions(
+    authorization: Optional[str] = Header(None, alias="Authorization"),
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    page: int = Query(1, ge=1, description="页码（从 1 开始）"),
+    page_size: int = Query(20, ge=1, le=100, description="每页条数（1-100）"),
+    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
+    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
+    tx_type: Optional[str] = Query(None, description="交易类型，如 OPEN_DEDUCT / OPEN_REFUND"),
+    db: Session = Depends(get_db),
+):
+    """
+    查询当前用户由当前插件产生的消费/退款记录。
+
+    认证：Authorization: Bearer <user_token> + X-Plugin-Key
+    安全：仅返回 source_plugin == 当前 plugin_id 的记录，防止跨插件读取。
+    """
+    plugin_info = _require_plugin(x_plugin_key, "verify", db)
+
+    if not authorization:
+        raise HTTPException(status_code=401, detail="缺少 Authorization Header")
+    parts = authorization.split(" ", 1)
+    if len(parts) != 2 or parts[0].lower() != "bearer":
+        raise HTTPException(status_code=401, detail="Authorization 格式错误，请使用 Bearer Token")
+    account = await _resolve_user_from_token(parts[1])
+
+    plugin_id = plugin_info["id"]
+
+    # 构造查询：按 source_plugin 过滤；兼容历史 NULL 数据走 related_account 兜底
+    q = db.query(Transaction).filter(
+        Transaction.account == account,
+        ((Transaction.source_plugin == plugin_id)
+         | ((Transaction.source_plugin.is_(None)) & (Transaction.related_account == plugin_id))),
+    )
+
+    if tx_type:
+        q = q.filter(Transaction.tx_type == tx_type)
+    if start_time is not None:
+        q = q.filter(Transaction.created_at >= datetime.datetime.utcfromtimestamp(int(start_time)))
+    if end_time is not None:
+        q = q.filter(Transaction.created_at <= datetime.datetime.utcfromtimestamp(int(end_time)))
+
+    total = q.count()
+    rows = (
+        q.order_by(Transaction.created_at.desc())
+        .offset((page - 1) * page_size)
+        .limit(page_size)
+        .all()
+    )
+
+    items = []
+    for t in rows:
+        created_ts = int(t.created_at.timestamp()) if t.created_at else 0
+        # reason 从 description 中解析（去掉 [插件名] 前缀），兼容旧记录
+        reason = (t.description or "").replace(f"[{plugin_info['name']}] ", "").strip() or None
+        items.append({
+            "id": t.tx_id,
+            "type": t.tx_type,
+            "amount": int(t.amount or 0),
+            "reason": reason,
+            "reference_id": t.item_id,
+            "created_at": created_ts,
+            "description": t.description or "",
+        })
+
+    logger.info(f"OPEN_LIST_TX | plugin={plugin_id} | page={page}/{page_size} | total={total}")
+    return {
+        "success": True,
+        "transactions": items,
+        "total": total,
+        "page": page,
+        "page_size": page_size,
+    }
+
+
+# ==========================================
+# 6️⃣ 消费汇总：GET /api/open/usage-summary
+# ==========================================
+@router.get("/usage-summary")
+async def open_usage_summary(
+    x_plugin_key: Optional[str] = Header(None, alias="X-Plugin-Key"),
+    account: Optional[str] = Query(None, description="指定用户账号，不传则统计所有用户"),
+    period: str = Query("daily", description="聚合粒度：daily / monthly / total"),
+    start_time: Optional[int] = Query(None, description="起始时间（unix 秒）"),
+    end_time: Optional[int] = Query(None, description="结束时间（unix 秒）"),
+    db: Session = Depends(get_db),
+):
+    """
+    本插件维度的消费汇总统计。
+
+    返回：总扣款 / 总退款 / 总笔数 / 净消费 + 按 period 分桶的明细。
+    安全：仅统计 source_plugin == 当前 plugin_id 的记录。
+    """
+    plugin_info = _require_plugin(x_plugin_key, "verify", db)
+    plugin_id = plugin_info["id"]
+
+    period = (period or "daily").lower()
+    if period not in ("daily", "monthly", "total"):
+        raise HTTPException(status_code=400, detail="period 仅支持 daily / monthly / total")
+
+    base = db.query(Transaction).filter(
+        ((Transaction.source_plugin == plugin_id)
+         | ((Transaction.source_plugin.is_(None)) & (Transaction.related_account == plugin_id))),
+        Transaction.tx_type.in_(["OPEN_DEDUCT", "OPEN_REFUND"]),
+    )
+    if account:
+        base = base.filter(Transaction.account == account)
+    if start_time is not None:
+        base = base.filter(Transaction.created_at >= datetime.datetime.utcfromtimestamp(int(start_time)))
+    if end_time is not None:
+        base = base.filter(Transaction.created_at <= datetime.datetime.utcfromtimestamp(int(end_time)))
+
+    rows = base.all()
+
+    total_deduct = 0
+    total_refund = 0
+    total_count = len(rows)
+    bucket: dict = {}  # key -> {"deduct":int,"refund":int,"count":int}
+
+    for t in rows:
+        amt = int(t.amount or 0)
+        if t.tx_type == "OPEN_DEDUCT":
+            total_deduct += abs(amt)
+        elif t.tx_type == "OPEN_REFUND":
+            total_refund += abs(amt)
+
+        if period == "total":
+            continue
+        if not t.created_at:
+            continue
+        if period == "daily":
+            key = t.created_at.strftime("%Y-%m-%d")
+        else:  # monthly
+            key = t.created_at.strftime("%Y-%m")
+
+        b = bucket.setdefault(key, {"deduct": 0, "refund": 0, "count": 0})
+        if t.tx_type == "OPEN_DEDUCT":
+            b["deduct"] += abs(amt)
+        elif t.tx_type == "OPEN_REFUND":
+            b["refund"] += abs(amt)
+        b["count"] += 1
+
+    breakdown = []
+    if period != "total":
+        for key in sorted(bucket.keys(), reverse=True):
+            v = bucket[key]
+            label = "date" if period == "daily" else "month"
+            breakdown.append({
+                label: key,
+                "deduct": v["deduct"],
+                "refund": v["refund"],
+                "count": v["count"],
+            })
+
+    logger.info(f"OPEN_USAGE_SUMMARY | plugin={plugin_id} | period={period} | tx_count={total_count}")
+    return {
+        "success": True,
+        "plugin_id": plugin_id,
+        "plugin_name": plugin_info.get("name", plugin_id),
+        "summary": {
+            "total_deduct": total_deduct,
+            "total_refund": total_refund,
+            "total_transactions": total_count,
+            "net_consumption": total_deduct - total_refund,
+        },
+        "breakdown": breakdown,
+    }

router_posts.py

@@ -1,3 +1,4 @@
+from publication_identity import publication_identity
 # 云端Space代码/router_posts.py
 # ==========================================
 # 💬 讨论区API路由（小红书风格图文社区）
@@ -9,24 +10,41 @@ from fastapi import APIRouter, HTTPException, Depends, Request
 from sqlalchemy.orm import Session
 from models import PostCreate, PostUpdate, RatingRequest
 import 数据库连接 as db
+from comment_store import append_comment, increment_comment_count, attach_comment_counts
 from 安全认证 import require_auth
 from db_utils import record_view, sort_cache
 from database_sql import get_db
 from models_sql import Wallet, Transaction
 from notifications import add_notification
+from tip_transaction import lock_tip_wallets
+from tip_store import run_tip_effect
 import time
+import asyncio
+from post_store import publish_post, edit_post, delete_post as remove_post, PostStoreError
 import uuid
 import hashlib
 import datetime
 import logging
 
 # 🔒 频次限制（与 router_users_auth.py / router_wallet.py / router_prompts.py 同一写法）
-from slowapi import Limiter
-from slowapi.util import get_remote_address
-limiter = Limiter(key_func=get_remote_address)
+from rate_limit import shared_limit
 
 router = APIRouter()
 
+
+async def _post_mutation(operation, *args):
+    try:
+        return await asyncio.to_thread(operation, *args)
+    except PostStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+
+
+def _invalidate_posts():
+    try:
+        sort_cache.invalidate("posts:")
+    except Exception as error:
+        logging.getLogger(__name__).warning("帖子排序缓存失效失败: error_type=%s", type(error).__name__)
+
 # ==========================================
 # 📝 帖子CRUD接口
 # ==========================================
@@ -87,6 +105,7 @@ async def get_posts(page: int = 1, limit: int = 20, sort: str = "latest"):
         post_data.pop("viewed_by", None)
         result.append(post_data)
 
+    attach_comment_counts(result)
     return {
         "status": "success",
         "data": result,
@@ -115,6 +134,7 @@ async def get_my_posts(current_user: str = Depends(require_auth)):
         post_data.pop("viewed_by", None)
         result.append(post_data)
 
+    attach_comment_counts(result)
     return {
         "status": "success",
         "data": result
@@ -141,6 +161,7 @@ async def get_post_detail(post_id: str):
             }
             # 过滤敏感字段
             post_data.pop("viewed_by", None)
+            attach_comment_counts([post_data])
             return {
                 "status": "success",
                 "data": post_data
@@ -149,13 +170,16 @@ async def get_post_detail(post_id: str):
     raise HTTPException(status_code=404, detail="帖子不存在")
 
 @router.post("/api/posts")
-@limiter.limit("5/minute")  # 🔒 安全限流：防止刷帖洗版（一次发布含多图上传，但建帖只调一次）
+@shared_limit(5)  # 🔒 安全限流：防止刷帖洗版（一次发布含多图上传，但建帖只调一次）
 async def create_post(request: Request, post: PostCreate, current_user: str = Depends(require_auth)):
     """
     发布帖子
     """
-    posts_db = db.load_data("posts.json", default_data=[])
-    
+    try:
+        stable_id = publication_identity('post', current_user, getattr(request, 'headers', {}).get('Idempotency-Key'))
+    except ValueError:
+        raise HTTPException(status_code=400, detail='发布请求身份无效') from None
+
     # 限制图片数量
     images = (post.images or [])[:9]
     post_type = post.post_type if hasattr(post, "post_type") else "image"
@@ -166,7 +190,7 @@ async def create_post(request: Request, post: PostCreate, current_user: str = De
         images = []
     
     new_post = {
-        "id": f"post_{int(time.time())}_{uuid.uuid4().hex[:6]}",
+        "id": stable_id or f"post_{int(time.time())}_{uuid.uuid4().hex}",
         "title": post.title,
         "content": post.content,
         "cover_image": post.cover_image,
@@ -193,91 +217,43 @@ async def create_post(request: Request, post: PostCreate, current_user: str = De
         "rated_by": {}
     }
     
-    posts_db.insert(0, new_post)
-    db.save_data("posts.json", posts_db)
-    # 🗂️ 清除排序缓存
-    sort_cache.invalidate("posts:")
+    new_post = await _post_mutation(publish_post, db, new_post, stable_id is not None)
+    _invalidate_posts()
     
     return {"status": "success", "data": new_post}
 
 @router.put("/api/posts/{post_id}")
-async def update_post(post_id: str, update_data: PostUpdate, current_user: str = Depends(require_auth)):
+@shared_limit(10)
+async def update_post(request: Request, post_id: str, update_data: PostUpdate, current_user: str = Depends(require_auth)):
     """
     更新帖子（仅作者可操作，原子操作，并发安全）
     """
-    result_holder = {}
-    
-    def updater(data):
-        for post in data:
-            if post["id"] == post_id:
-                if post.get("author") != current_user:
-                    result_holder["error"] = "forbidden"
-                    return False
-                # 更新字段
-                if update_data.title is not None:
-                    post["title"] = update_data.title
-                if update_data.content is not None:
-                    post["content"] = update_data.content
-                if update_data.cover_image is not None:
-                    post["cover_image"] = update_data.cover_image
-                if update_data.images is not None:
-                    post["images"] = update_data.images[:9]
-                if update_data.is_original is not None:
-                    post["is_original"] = update_data.is_original  # 🎨 更新原创作品标记
-                if update_data.post_type is not None:
-                    post["post_type"] = update_data.post_type
-                    # 如果切换为视频帖，清空图片列表
-                    if update_data.post_type == "video":
-                        post["images"] = []
-                if update_data.video_url is not None:
-                    post["video_url"] = update_data.video_url
-                result_holder["post"] = post
-                return True
-        result_holder["error"] = "not_found"
-        return False
-    
-    db.atomic_update("posts.json", updater, default_data=[])
-    
-    if result_holder.get("error") == "forbidden":
-        raise HTTPException(status_code=403, detail="无权修改他人帖子")
-    if result_holder.get("error") == "not_found":
-        raise HTTPException(status_code=404, detail="帖子不存在")
-    
-    # 🗂️ 清除排序缓存
-    sort_cache.invalidate("posts:")
+    changes = {key: getattr(update_data, key) for key in (
+        "title", "content", "cover_image", "images", "is_original", "post_type", "video_url")}
+    await _post_mutation(edit_post, db, post_id, current_user, changes)
+    _invalidate_posts()
     return {"status": "success"}
 
 @router.delete("/api/posts/{post_id}")
-async def delete_post(post_id: str, current_user: str = Depends(require_auth)):
-    """
-    删除帖子（仅作者可操作）
-    """
-    posts_db = db.load_data("posts.json", default_data=[])
-    
-    for i, post in enumerate(posts_db):
-        if post["id"] == post_id:
-            if post.get("author") != current_user:
-                raise HTTPException(status_code=403, detail="无权删除他人帖子")
-            
-            posts_db.pop(i)
-            db.save_data("posts.json", posts_db)
-            # 🗂️ 清除排序缓存
-            sort_cache.invalidate("posts:")
-            return {"status": "success"}
-    
-    raise HTTPException(status_code=404, detail="帖子不存在")
+@shared_limit(10)
+async def delete_post(request: Request, post_id: str, current_user: str = Depends(require_auth)):
+    """删除帖子；锁内确认最新作者，只删除目标主记录。"""
+    await _post_mutation(remove_post, db, post_id, current_user)
+    _invalidate_posts()
+    return {"status": "success"}
 
 # ==========================================
 # ❤️ 互动接口（点赞/收藏）
 # ==========================================
 
 @router.post("/api/posts/{post_id}/rating")
-async def rate_post(post_id: str, request: RatingRequest, current_user: str = Depends(require_auth)):
+@shared_limit(20)
+async def rate_post(request: Request, post_id: str, payload: RatingRequest, current_user: str = Depends(require_auth)):
     """
     为帖子评分（原子操作，并发安全）
     ⭐ score: 1-5
     """
-    score = request.score
+    score = payload.score
     if score < 1 or score > 5:
         raise HTTPException(status_code=400, detail="评分必须在1-5之间")
     
@@ -346,7 +322,8 @@ async def rate_post(post_id: str, request: RatingRequest, current_user: str = De
 
 
 @router.post("/api/posts/{post_id}/like")
-async def toggle_like(post_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def toggle_like(request: Request, post_id: str, current_user: str = Depends(require_auth)):
     """
     点赞/取消点赞（原子操作，并发安全）
     """
@@ -380,7 +357,8 @@ async def toggle_like(post_id: str, current_user: str = Depends(require_auth)):
     return result_container[0]
 
 @router.post("/api/posts/{post_id}/favorite")
-async def toggle_favorite(post_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def toggle_favorite(request: Request, post_id: str, current_user: str = Depends(require_auth)):
     """
     收藏/取消收藏（原子操作，并发安全）
     """
@@ -425,7 +403,8 @@ def calculate_tx_hash(tx_id, account, tx_type, amount, prev_hash):
     return hashlib.sha256(data.encode()).hexdigest()
 
 @router.post("/api/posts/{post_id}/tip")
-async def tip_post(post_id: str, amount: int, is_anon: bool = False, current_user: str = Depends(require_auth), db_session: Session = Depends(get_db)):
+@shared_limit(10)
+async def tip_post(request: Request, post_id: str, amount: int, is_anon: bool = False, current_user: str = Depends(require_auth), db_session: Session = Depends(get_db)):
     """
     打赏帖子（原子操作，并发安全）- 使用 SQL Wallet 系统
     """
@@ -451,6 +430,8 @@ async def tip_post(post_id: str, amount: int, is_anon: bool = False, current_use
     # 💳 使用 SQL Wallet 系统处理余额转账（先扣款）
     try:
         
+        # 🔒 并发安全：使用悲观锁获取双方钱包
+        tipper_wallet, author_wallet = lock_tip_wallets(db_session, current_user, author)
         # 🔒 P1幂等性防护：检查最近5秒内是否存在相同交易
         recent_cutoff = datetime.datetime.utcnow() - datetime.timedelta(seconds=5)
         duplicate_tx = db_session.query(Transaction).filter(
@@ -459,20 +440,14 @@ async def tip_post(post_id: str, amount: int, is_anon: bool = False, current_use
             Transaction.amount == -amount,
             Transaction.related_account == author,
             Transaction.created_at >= recent_cutoff
-        ).first()
+        ).with_for_update().first()
         if duplicate_tx:
+            db_session.rollback()  # 重复请求释放锁，不执行任何后续操作
             return {"status": "success", "message": "打赏已处理（重复请求）"}
         
-        # 🔒 并发安全：使用悲观锁获取双方钱包
-        tipper_wallet = db_session.query(Wallet).filter(Wallet.account == current_user).with_for_update().first()
-        author_wallet = db_session.query(Wallet).filter(Wallet.account == author).with_for_update().first()
-        
         if not tipper_wallet or tipper_wallet.balance < amount:
             raise HTTPException(status_code=400, detail="余额不足")
-        if not author_wallet:
-            # 如果作者钱包不存在，创建一个
-            author_wallet = Wallet(account=author, balance=0, earn_balance=0, tip_balance=0, frozen_balance=0)
-            db_session.add(author_wallet)
+
         
         # 执行转账
         tipper_wallet.balance -= amount
@@ -533,8 +508,17 @@ async def tip_post(post_id: str, amount: int, is_anon: bool = False, current_use
         db_session.commit()
         
         # 📝 审计日志
-        logger.info(f"POST_TIP | from={current_user} | to={author} | amount={amount} | post={post_id} | anon={is_anon}")
+        logger.info(f"POST_TIP | post={post_id}")
         
+    except HTTPException:
+        db_session.rollback()
+        raise
+    except Exception as e:
+        db_session.rollback()
+        logger.error(f"POST_TIP_ERROR | post={post_id} | error_type={type(e).__name__}")
+        raise HTTPException(status_code=500, detail="打赏处理失败，请稍后重试")
+    
+    def notify_tip():
         # 🔔 打赏通知（考虑匿名）
         if not is_anon:
             add_notification(author, {
@@ -552,18 +536,10 @@ async def tip_post(post_id: str, amount: int, is_anon: bool = False, current_use
                 "target_item_title": "",
                 "content": f"您收到了一份 {amount} 积分的匿名帖子打赏"
             })
-        
-        # 🗂️ 清除排序缓存（打赏可能影响排序）
-        sort_cache.invalidate("posts:")
-        
-    except HTTPException:
-        db_session.rollback()
-        raise
-    except Exception as e:
-        db_session.rollback()
-        logger.error(f"POST_TIP_ERROR | from={current_user} | post={post_id} | amount={amount} | error={str(e)}")
-        raise HTTPException(status_code=500, detail="打赏处理失败，请稍后重试")
     
+    run_tip_effect(notify_tip)
+    run_tip_effect(lambda: sort_cache.invalidate("posts:"))
+
     # 🏆 扣款成功后再写打赏榜（写榜失败仅记录日志，不影响资金安全）
     def board_updater(data):
         for post in data:
@@ -581,7 +557,7 @@ async def tip_post(post_id: str, amount: int, is_anon: bool = False, current_use
     try:
         db.atomic_update("posts.json", board_updater, default_data=[])
     except Exception as e:
-        logger.error(f"POST_TIP_BOARD_ERROR | post={post_id} | error={str(e)}")
+        logger.error(f"POST_TIP_BOARD_ERROR | post={post_id} | error_type={type(e).__name__}")
     
     return {"status": "success", "message": f"成功打赏 {amount} 积分"}
 
@@ -616,7 +592,8 @@ async def get_post_comments(post_id: str):
     return {"status": "success", "data": result}
 
 @router.post("/api/posts/{post_id}/comments")
-async def add_post_comment(post_id: str, content: str, current_user: str = Depends(require_auth)):
+@shared_limit(10)
+async def add_post_comment(request: Request, post_id: str, content: str, current_user: str = Depends(require_auth)):
     """
     添加帖子评论
     """
@@ -624,7 +601,6 @@ async def add_post_comment(post_id: str, content: str, current_user: str = Depen
         raise HTTPException(status_code=400, detail="评论内容不能为空")
     
     posts_db = db.load_data("posts.json", default_data=[])
-    comments_db = db.load_data("comments.json", default_data={})
     
     # 检查帖子是否存在
     post_exists = any(p["id"] == post_id for p in posts_db)
@@ -638,27 +614,18 @@ async def add_post_comment(post_id: str, content: str, current_user: str = Depen
         "created_at": int(time.time())
     }
     
-    # comments_db 是 {item_id: [comments]} 格式
-    post_comments = comments_db.get(post_id, [])
-    post_comments.insert(0, new_comment)
-    comments_db[post_id] = post_comments
-    db.save_data("comments.json", comments_db)
-    
+    append_comment(post_id, new_comment, prepend=True)
+    increment_comment_count("posts.json", post_id)
+
     # 🗂️ 清除排序缓存（评论数变化可能影响排序）
     sort_cache.invalidate("posts:")
     
-    # 更新帖子评论数
-    for post in posts_db:
-        if post["id"] == post_id:
-            post["comments"] = post.get("comments", 0) + 1
-            break
-    db.save_data("posts.json", posts_db)
-    
     return {"status": "success", "data": new_comment}
 
 
 @router.post("/api/posts/{post_id}/view")
-async def record_post_view(post_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(60)
+async def record_post_view(request: Request, post_id: str, current_user: str = Depends(require_auth)):
     """
     记录帖子访问量
     👁️ 需要用户认证，每个用户只计算一次总访问量，日访问量每次调用都增加

router_prompts.py

@@ -1,3 +1,4 @@
+from publication_identity import publication_identity
 # 云端Space代码/router_prompts.py
 # ==========================================
 # ✨ 提示词市场API路由（图像/视频提示词）
@@ -14,23 +15,29 @@
 
 from fastapi import APIRouter, HTTPException, Depends, Request
 from sqlalchemy.orm import Session
-from models import PromptCreate, PromptUpdate, PromptCategoryAdd
+from models import PromptCreate, PromptUpdate, PromptCategoryAdd, PromptPurchaseRequest
+from typing import Optional
 import 数据库连接 as db
+from comment_store import append_comment, increment_comment_count, attach_comment_counts
 from 安全认证 import require_auth, optional_auth, is_admin
 from db_utils import record_view, sort_cache
 from database_sql import get_db
 from models_sql import Wallet, Transaction, Ownership
 from notifications import add_notification
+from tip_transaction import lock_tip_wallets
+from purchase_transaction import effective_resource_price, lock_resource_purchase_wallets
+from tip_store import run_tip_effect
 import time
+import asyncio
+from prompt_store import (PromptStoreError, publish_prompt, edit_prompt,
+    delete_prompt as remove_prompt, project_price, load_categories, modify_category, read_prompts)
 import uuid
 import hashlib
 import datetime
 import logging
 
 # 🔒 P0安全优化：API限流（与 router_wallet.py 保持一致）
-from slowapi import Limiter
-from slowapi.util import get_remote_address
-limiter = Limiter(key_func=get_remote_address)
+from rate_limit import shared_limit
 
 router = APIRouter()
 
@@ -95,35 +102,18 @@ def _sanitize_tags(tags) -> list:
     return cleaned
 
 
-def _load_categories() -> dict:
-    """读取分类数据，不存在时用内置默认值初始化并持久化"""
-    categories = db.load_data("prompt_categories.json", default_data=None)
-    if not isinstance(categories, dict) or "image" not in categories or "video" not in categories:
-        categories = {
-            "image": list(DEFAULT_CATEGORIES["image"]),
-            "video": list(DEFAULT_CATEGORIES["video"])
-        }
-        db.save_data("prompt_categories.json", categories)
-    # 存量分类文件补全 music 分组（历史数据只有 image/video 键）
-    if "music" not in categories:
-        categories["music"] = list(DEFAULT_CATEGORIES["music"])
-        db.save_data("prompt_categories.json", categories)
-    return categories
-
-
-def _apply_effective_price(prompt: dict) -> None:
-    """检查 pending_price 是否已过生效时间，若是则更新 price 字段供前端显示（与 router_items.py 同构）"""
-    pending_price = prompt.get("pending_price")
-    pending_effective = prompt.get("pending_price_effective_at")
-    if pending_price is not None and pending_effective:
-        try:
-            effective_time = datetime.datetime.fromisoformat(pending_effective)
-            if datetime.datetime.now() >= effective_time:
-                prompt["price"] = pending_price
-                prompt["pending_price"] = None
-                prompt["pending_price_effective_at"] = None
-        except (ValueError, TypeError):
-            pass
+async def _prompt_operation(operation, *args, **kwargs):
+    try:
+        return await asyncio.to_thread(operation, *args, **kwargs)
+    except PromptStoreError as error:
+        raise HTTPException(status_code=error.status_code, detail=error.message) from None
+
+
+def _invalidate_prompts():
+    try:
+        sort_cache.invalidate("prompts:")
+    except Exception as error:
+        logger.warning("提示词排序缓存失效失败: error_type=%s", type(error).__name__)
 
 
 def _user_owns_prompt(db_session: Session, account: str, prompt_id: str) -> bool:
@@ -161,14 +151,14 @@ async def get_prompt_categories(prompt_type: str = None):
     获取提示词分类列表
     - prompt_type: image / video / music，不传则返回全部
     """
-    categories = _load_categories()
+    categories = await _prompt_operation(load_categories, db, DEFAULT_CATEGORIES)
     if prompt_type in VALID_PROMPT_TYPES:
         return {"status": "success", "data": categories.get(prompt_type, [])}
     return {"status": "success", "data": categories}
 
 
 @router.post("/api/prompt-categories")
-@limiter.limit("5/minute")  # 🔒 限流：防止分类刷屏
+@shared_limit(5)  # 🔒 限流：防止分类刷屏
 async def add_prompt_category(request: Request, body: PromptCategoryAdd, current_user: str = Depends(require_auth)):
     """
     添加提示词分类（仅管理员，入口在云端管理界面，重名去重）
@@ -184,38 +174,13 @@ async def add_prompt_category(request: Request, body: PromptCategoryAdd, current
     if len(name) > MAX_CATEGORY_LEN:
         raise HTTPException(status_code=400, detail=f"分类名称不能超过{MAX_CATEGORY_LEN}个字")
 
-    result_holder = {}
-
-    def updater(data):
-        if not isinstance(data, dict):
-            data = {
-                "image": list(DEFAULT_CATEGORIES["image"]),
-                "video": list(DEFAULT_CATEGORIES["video"])
-            }
-        cat_list = data.get(body.prompt_type, [])
-        if name in cat_list:
-            result_holder["error"] = "duplicate"
-            return
-        if len(cat_list) >= MAX_CATEGORY_PER_TYPE:
-            result_holder["error"] = "too_many"
-            return
-        cat_list.append(name)
-        data[body.prompt_type] = cat_list
-        result_holder["data"] = cat_list
-
-    db.atomic_update("prompt_categories.json", updater, default_data={})
-
-    if result_holder.get("error") == "duplicate":
-        raise HTTPException(status_code=400, detail="该分类已存在")
-    if result_holder.get("error") == "too_many":
-        raise HTTPException(status_code=400, detail=f"分类数量已达上限({MAX_CATEGORY_PER_TYPE})")
-
-    logger.info(f"PROMPT_CATEGORY_ADD | user={current_user} | type={body.prompt_type} | name={name}")
-    return {"status": "success", "data": result_holder["data"]}
+    values = await _prompt_operation(modify_category, db, DEFAULT_CATEGORIES, body.prompt_type, name, maximum=MAX_CATEGORY_PER_TYPE)
+    logger.info("PROMPT_CATEGORY_ADD | type=%s", body.prompt_type)
+    return {"status": "success", "data": values}
 
 
 @router.delete("/api/prompt-categories")
-@limiter.limit("5/minute")  # 🔒 限流：与添加分类一致
+@shared_limit(5)  # 🔒 限流：与添加分类一致
 async def delete_prompt_category(request: Request, prompt_type: str = None, name: str = None,
                                 current_user: str = Depends(require_auth)):
     """
@@ -233,27 +198,9 @@ async def delete_prompt_category(request: Request, prompt_type: str = None, name
     if not name:
         raise HTTPException(status_code=400, detail="分类名称不能为空")
 
-    result_holder = {}
-
-    def updater(data):
-        if not isinstance(data, dict):
-            result_holder["error"] = "not_found"
-            return
-        cat_list = data.get(prompt_type, [])
-        if name not in cat_list:
-            result_holder["error"] = "not_found"
-            return
-        cat_list.remove(name)
-        data[prompt_type] = cat_list
-        result_holder["data"] = cat_list
-
-    db.atomic_update("prompt_categories.json", updater, default_data={})
-
-    if result_holder.get("error") == "not_found":
-        raise HTTPException(status_code=404, detail="分类不存在")
-
-    logger.info(f"PROMPT_CATEGORY_DELETE | user={current_user} | type={prompt_type} | name={name}")
-    return {"status": "success", "data": result_holder["data"]}
+    values = await _prompt_operation(modify_category, db, DEFAULT_CATEGORIES, prompt_type, name, delete=True)
+    logger.info("PROMPT_CATEGORY_DELETE | type=%s", prompt_type)
+    return {"status": "success", "data": values}
 
 
 # ==========================================
@@ -285,7 +232,7 @@ async def get_prompts(prompt_type: str = None, category: str = None,
     - sort: latest / likes / favorites / views / daily_views / tips
     ⚠️ 列表接口永不下发 prompt_text（付费内容脱敏）
     """
-    prompts_db = db.load_data("prompts.json", default_data=[])
+    prompts_db = await _prompt_operation(read_prompts, db)
     users_db = db.load_data("users.json", default_data={})
     user_map = users_db
 
@@ -322,13 +269,11 @@ async def get_prompts(prompt_type: str = None, category: str = None,
 
     # 附加作者信息，并过滤敏感字段
     result = []
-    price_updated = False
     for prompt in paged_prompts:
-        # 💰 检查延迟价格是否已生效（与资源列表同构）
-        old_price = prompt.get("price", 0)
-        _apply_effective_price(prompt)
-        if prompt.get("price", 0) != old_price:
-            price_updated = True
+        try:
+            prompt = project_price(prompt)
+        except Exception:
+            raise HTTPException(status_code=503, detail="提示词暂时不可读取") from None
         author_info = user_map.get(prompt.get("author"), {})
         prompt_data = {
             **prompt,
@@ -340,9 +285,7 @@ async def get_prompts(prompt_type: str = None, category: str = None,
         prompt_data.pop("viewed_by", None)
         result.append(prompt_data)
 
-    if price_updated:
-        db.save_data("prompts.json", prompts_db)
-
+    attach_comment_counts(result)
     return {
         "status": "success",
         "data": result,
@@ -358,26 +301,22 @@ async def get_my_prompts(current_user: str = Depends(require_auth)):
     获取我发布的提示词（个人中心用）
     作者本人可见自己的 prompt_text
     """
-    prompts_db = db.load_data("prompts.json", default_data=[])
+    prompts_db = await _prompt_operation(read_prompts, db)
 
     my_prompts = [p for p in prompts_db if p.get("author") == current_user]
     my_prompts = sorted(my_prompts, key=lambda x: x.get("created_at", 0), reverse=True)
 
     result = []
-    price_updated = False
     for prompt in my_prompts:
-        # 💰 检查延迟价格是否已生效
-        old_price = prompt.get("price", 0)
-        _apply_effective_price(prompt)
-        if prompt.get("price", 0) != old_price:
-            price_updated = True
+        try:
+            prompt = project_price(prompt)
+        except Exception:
+            raise HTTPException(status_code=503, detail="提示词暂时不可读取") from None
         prompt_data = dict(prompt)
         prompt_data.pop("viewed_by", None)
         result.append(prompt_data)
 
-    if price_updated:
-        db.save_data("prompts.json", prompts_db)
-
+    attach_comment_counts(result)
     return {"status": "success", "data": result}
 
 
@@ -388,42 +327,54 @@ async def get_prompt_detail(prompt_id: str, current_user: str = Depends(optional
     获取提示词详情
     🔒 仅当 ①免费 ②作者本人 ③已购买 时下发 prompt_text
     """
-    prompts_db = db.load_data("prompts.json", default_data=[])
+    try:
+        prompts_db = db.load_data("prompts.json", default_data=[], strict=True, skip_cache=True)
+        if not isinstance(prompts_db, list):
+            raise ValueError("invalid prompt collection")
+    except Exception:
+        raise HTTPException(status_code=503, detail="提示词暂时不可读取")
     users_db = db.load_data("users.json", default_data={})
     user_map = users_db
 
     for prompt in prompts_db:
-        if prompt["id"] == prompt_id:
-            # 💰 检查延迟价格是否已生效
-            old_price = prompt.get("price", 0)
-            _apply_effective_price(prompt)
-            if prompt.get("price", 0) != old_price:
-                db.save_data("prompts.json", prompts_db)
+        if isinstance(prompt, dict) and prompt.get("id") == prompt_id:
+            try:
+                price = effective_resource_price(prompt)
+            except Exception:
+                raise HTTPException(status_code=503, detail="提示词暂时不可读取")
 
             author_info = user_map.get(prompt.get("author"), {})
             prompt_data = {
                 **prompt,
+                "price": price,
                 "author_name": author_info.get("name", prompt.get("author")),
                 "author_avatar": author_info.get("avatarDataUrl", "")
             }
             prompt_data.pop("viewed_by", None)
 
-            price = int(prompt.get("price", 0) or 0)
             is_author = current_user and current_user == prompt.get("author")
             can_view = price <= 0 or is_author or _user_owns_prompt(db_session, current_user, prompt_id)
             prompt_data["owned"] = bool(can_view)
+            prompt_data["price_confirmation_supported"] = True
             _mask_prompt_text(prompt_data, can_view)
 
+            attach_comment_counts([prompt_data])
             return {"status": "success", "data": prompt_data}
 
     raise HTTPException(status_code=404, detail="提示词不存在")
 
 
 @router.post("/api/prompts")
-async def create_prompt(prompt: PromptCreate, current_user: str = Depends(require_auth)):
+@shared_limit(5)
+async def create_prompt(request: Request, prompt: PromptCreate, current_user: str = Depends(require_auth)):
     """
     发布提示词
     """
+    try:
+        stable_id = publication_identity('prompt', current_user, getattr(request, 'headers', {}).get('Idempotency-Key'))
+    except ValueError:
+        raise HTTPException(status_code=400, detail='发布请求身份无效') from None
+
     # 参数校验
     if prompt.prompt_type not in VALID_PROMPT_TYPES:
         raise HTTPException(status_code=400, detail="提示词类型必须是 image、video 或 music")
@@ -443,12 +394,12 @@ async def create_prompt(prompt: PromptCreate, current_user: str = Depends(requir
         raise HTTPException(status_code=400, detail="请选择分类")
 
     # 分类必须存在于分类库
-    categories = _load_categories()
+    categories = await _prompt_operation(load_categories, db, DEFAULT_CATEGORIES)
     if category not in categories.get(prompt.prompt_type, []):
         raise HTTPException(status_code=400, detail="所选分类不存在")
 
-    price = int(prompt.price or 0)
-    if price < 0 or price > MAX_PRICE:
+    price = prompt.price
+    if type(price) is not int or not 0 <= price <= MAX_PRICE:
         raise HTTPException(status_code=400, detail=f"定价必须在0-{MAX_PRICE}之间")
 
     media_type = prompt.media_type if prompt.media_type in ("image", "video") else "image"
@@ -466,7 +417,7 @@ async def create_prompt(prompt: PromptCreate, current_user: str = Depends(requir
         audio_url = None
 
     new_prompt = {
-        "id": f"prompt_{int(time.time())}_{uuid.uuid4().hex[:6]}",
+        "id": stable_id or f"prompt_{int(time.time())}_{uuid.uuid4().hex}",
         "prompt_type": prompt.prompt_type,
         "category": category,
         "title": title,
@@ -495,106 +446,18 @@ async def create_prompt(prompt: PromptCreate, current_user: str = Depends(requir
         "tags": _sanitize_tags(prompt.tags)
     }
 
-    prompts_db = db.load_data("prompts.json", default_data=[])
-    prompts_db.insert(0, new_prompt)
-    db.save_data("prompts.json", prompts_db)
-    # 🗂️ 清除排序缓存
-    sort_cache.invalidate("prompts:")
+    new_prompt = await _prompt_operation(publish_prompt, db, new_prompt, stable_id is not None)
+    _invalidate_prompts()
 
     return {"status": "success", "data": new_prompt}
 
 
 @router.put("/api/prompts/{prompt_id}")
-async def update_prompt(prompt_id: str, update_data: PromptUpdate, current_user: str = Depends(require_auth)):
+@shared_limit(10)
+async def update_prompt(request: Request, prompt_id: str, update_data: PromptUpdate, current_user: str = Depends(require_auth)):
     """
     更新提示词（仅作者可操作，原子操作，并发安全）
     """
-    result_holder = {}
-
-    def updater(data):
-        for prompt in data:
-            if prompt["id"] == prompt_id:
-                if prompt.get("author") != current_user:
-                    result_holder["error"] = "forbidden"
-                    return False
-                # 更新字段
-                if update_data.title is not None:
-                    title = update_data.title.strip()
-                    if not title or len(title) > MAX_TITLE_LEN:
-                        result_holder["error"] = "invalid_title"
-                        return False
-                    prompt["title"] = title
-                if update_data.content is not None:
-                    content = update_data.content.strip()
-                    if len(content) > MAX_CONTENT_LEN:
-                        result_holder["error"] = "invalid_content"
-                        return False
-                    prompt["content"] = content
-                if update_data.prompt_text is not None:
-                    prompt_text = update_data.prompt_text.strip()
-                    if not prompt_text or len(prompt_text) > MAX_PROMPT_TEXT_LEN:
-                        result_holder["error"] = "invalid_prompt_text"
-                        return False
-                    prompt["prompt_text"] = prompt_text
-                if update_data.category is not None:
-                    category = update_data.category.strip()
-                    categories = _load_categories()
-                    if category not in categories.get(prompt.get("prompt_type"), []):
-                        result_holder["error"] = "invalid_category"
-                        return False
-                    prompt["category"] = category
-                if update_data.cover_image is not None:
-                    prompt["cover_image"] = update_data.cover_image
-                if update_data.price is not None:
-                    price = int(update_data.price)
-                    if price < 0 or price > MAX_PRICE:
-                        result_holder["error"] = "invalid_price"
-                        return False
-                    current_price = int(prompt.get("price", 0) or 0)
-                    if current_price != price:
-                        # 设置待生效价格，24小时后生效（与资源改价机制同构；提示词不支持退款，无需禁购配套）
-                        effective_time = datetime.datetime.now() + datetime.timedelta(hours=24)
-                        prompt["pending_price"] = price
-                        prompt["pending_price_effective_at"] = effective_time.isoformat()
-                        # 不立即修改 price，等待24小时后生效
-                    else:
-                        # 价格未变，清除待生效价格
-                        prompt["pending_price"] = None
-                        prompt["pending_price_effective_at"] = None
-                if update_data.media_type is not None:
-                    if update_data.media_type not in ("image", "video"):
-                        result_holder["error"] = "invalid_media_type"
-                        return False
-                    prompt["media_type"] = update_data.media_type
-                    if update_data.media_type == "image":
-                        # 图像类型不保留视频（与 create 逻辑一致）
-                        prompt["video_url"] = None
-                if update_data.video_url is not None:
-                    prompt["video_url"] = update_data.video_url
-                    if update_data.video_url:
-                        prompt["media_type"] = "video"
-                if update_data.audio_url is not None:
-                    # 🎵 音频仅音乐提示词保留；传空字符串/null 表示清除
-                    audio_url = (update_data.audio_url or "").strip() or None
-                    prompt["audio_url"] = audio_url if prompt.get("prompt_type") == "music" else None
-                # 类型变更后补正关联字段（pydantic 无法区分未传与 null，统一在此收尾）
-                if prompt.get("media_type") == "image":
-                    prompt["video_url"] = None
-                else:
-                    prompt["images"] = []
-                if update_data.images is not None:
-                    prompt["images"] = _sanitize_images(update_data.images)
-                if update_data.is_original is not None:
-                    prompt["is_original"] = bool(update_data.is_original)
-                if update_data.tags is not None:
-                    prompt["tags"] = _sanitize_tags(update_data.tags)
-                result_holder["prompt"] = prompt
-                return True
-        result_holder["error"] = "not_found"
-        return False
-
-    db.atomic_update("prompts.json", updater, default_data=[])
-
     error_map = {
         "forbidden": (403, "无权修改他人提示词"),
         "not_found": (404, "提示词不存在"),
@@ -605,35 +468,87 @@ async def update_prompt(prompt_id: str, update_data: PromptUpdate, current_user:
         "invalid_price": (400, f"定价必须在0-{MAX_PRICE}之间"),
         "invalid_media_type": (400, "媒体类型必须是 image 或 video")
     }
-    error = result_holder.get("error")
-    if error:
-        code, detail = error_map.get(error, (400, "参数错误"))
-        raise HTTPException(status_code=code, detail=detail)
+    categories = await _prompt_operation(load_categories, db, DEFAULT_CATEGORIES) if update_data.category is not None else None
+
+    def apply(prompt):
+        # 更新字段
+        if update_data.title is not None:
+            title = update_data.title.strip()
+            if not title or len(title) > MAX_TITLE_LEN:
+                raise PromptStoreError(*error_map["invalid_title"])
+            prompt["title"] = title
+        if update_data.content is not None:
+            content = update_data.content.strip()
+            if len(content) > MAX_CONTENT_LEN:
+                raise PromptStoreError(*error_map["invalid_content"])
+            prompt["content"] = content
+        if update_data.prompt_text is not None:
+            prompt_text = update_data.prompt_text.strip()
+            if not prompt_text or len(prompt_text) > MAX_PROMPT_TEXT_LEN:
+                raise PromptStoreError(*error_map["invalid_prompt_text"])
+            prompt["prompt_text"] = prompt_text
+        if update_data.category is not None:
+            category = update_data.category.strip()
+            if category not in categories.get(prompt.get("prompt_type"), []):
+                raise PromptStoreError(*error_map["invalid_category"])
+            prompt["category"] = category
+        if update_data.cover_image is not None:
+            prompt["cover_image"] = update_data.cover_image
+        if update_data.price is not None:
+            price = update_data.price
+            if type(price) is not int or not 0 <= price <= MAX_PRICE:
+                raise PromptStoreError(*error_map["invalid_price"])
+            current_price = effective_resource_price(prompt)
+            if current_price != price:
+                # 设置待生效价格，24小时后生效（与资源改价机制同构；提示词不支持退款，无需禁购配套）
+                effective_time = datetime.datetime.now() + datetime.timedelta(hours=24)
+                prompt["pending_price"] = price
+                prompt["pending_price_effective_at"] = effective_time.isoformat()
+                # 不立即修改 price，等待24小时后生效
+            else:
+                # 价格未变，清除待生效价格
+                prompt["pending_price"] = None
+                prompt["pending_price_effective_at"] = None
+        if update_data.media_type is not None:
+            if update_data.media_type not in ("image", "video"):
+                raise PromptStoreError(*error_map["invalid_media_type"])
+            prompt["media_type"] = update_data.media_type
+            if update_data.media_type == "image":
+                # 图像类型不保留视频（与 create 逻辑一致）
+                prompt["video_url"] = None
+        if update_data.video_url is not None:
+            prompt["video_url"] = update_data.video_url
+            if update_data.video_url:
+                prompt["media_type"] = "video"
+        if update_data.audio_url is not None or "audio_url" in getattr(update_data, "model_fields_set", set()):
+            # 🎵 音频仅音乐提示词保留；显式空字符串/null 清除，未传保持
+            audio_url = (update_data.audio_url or "").strip() or None
+            prompt["audio_url"] = audio_url if prompt.get("prompt_type") == "music" else None
+        if update_data.images is not None:
+            prompt["images"] = _sanitize_images(update_data.images)
+        if update_data.is_original is not None:
+            prompt["is_original"] = bool(update_data.is_original)
+        if update_data.tags is not None:
+            prompt["tags"] = _sanitize_tags(update_data.tags)
+        if prompt.get("media_type") == "image":
+            prompt["video_url"] = None
+        else:
+            prompt["images"] = []
 
-    # 🗂️ 清除排序缓存
-    sort_cache.invalidate("prompts:")
+    await _prompt_operation(edit_prompt, db, prompt_id, current_user, apply)
+    _invalidate_prompts()
     return {"status": "success"}
 
 
 @router.delete("/api/prompts/{prompt_id}")
-async def delete_prompt(prompt_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(10)
+async def delete_prompt(request: Request, prompt_id: str, current_user: str = Depends(require_auth)):
     """
     删除提示词（仅作者可操作）
     """
-    prompts_db = db.load_data("prompts.json", default_data=[])
-
-    for i, prompt in enumerate(prompts_db):
-        if prompt["id"] == prompt_id:
-            if prompt.get("author") != current_user:
-                raise HTTPException(status_code=403, detail="无权删除他人提示词")
-
-            prompts_db.pop(i)
-            db.save_data("prompts.json", prompts_db)
-            # 🗂️ 清除排序缓存
-            sort_cache.invalidate("prompts:")
-            return {"status": "success"}
-
-    raise HTTPException(status_code=404, detail="提示词不存在")
+    await _prompt_operation(remove_prompt, db, prompt_id, current_user)
+    _invalidate_prompts()
+    return {"status": "success"}
 
 
 # ==========================================
@@ -641,7 +556,8 @@ async def delete_prompt(prompt_id: str, current_user: str = Depends(require_auth
 # ==========================================
 
 @router.post("/api/prompts/{prompt_id}/like")
-async def toggle_like(prompt_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def toggle_like(request: Request, prompt_id: str, current_user: str = Depends(require_auth)):
     """
     点赞/取消点赞（原子操作，并发安全）
     """
@@ -676,7 +592,8 @@ async def toggle_like(prompt_id: str, current_user: str = Depends(require_auth))
 
 
 @router.post("/api/prompts/{prompt_id}/favorite")
-async def toggle_favorite(prompt_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(30)
+async def toggle_favorite(request: Request, prompt_id: str, current_user: str = Depends(require_auth)):
     """
     收藏/取消收藏（原子操作，并发安全）
     """
@@ -715,7 +632,8 @@ async def toggle_favorite(prompt_id: str, current_user: str = Depends(require_au
 # ==========================================
 
 @router.post("/api/prompts/{prompt_id}/tip")
-async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
+@shared_limit(10)
+async def tip_prompt(request: Request, prompt_id: str, amount: int, is_anon: bool = False,
                      current_user: str = Depends(require_auth), db_session: Session = Depends(get_db)):
     """
     打赏提示词（原子操作，并发安全）- 使用 SQL Wallet 系统
@@ -742,6 +660,8 @@ async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
     # 💳 使用 SQL Wallet 系统处理余额转账（先扣款）
     try:
 
+        # 🔒 并发安全：使用悲观锁获取双方钱包
+        tipper_wallet, author_wallet = lock_tip_wallets(db_session, current_user, author)
         # 🔒 P1幂等性防护：检查最近5秒内是否存在相同交易
         recent_cutoff = datetime.datetime.utcnow() - datetime.timedelta(seconds=5)
         duplicate_tx = db_session.query(Transaction).filter(
@@ -750,20 +670,13 @@ async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
             Transaction.amount == -amount,
             Transaction.related_account == author,
             Transaction.created_at >= recent_cutoff
-        ).first()
+        ).with_for_update().first()
         if duplicate_tx:
+            db_session.rollback()  # 重复请求释放锁，不执行任何后续操作
             return {"status": "success", "message": "打赏已处理（重复请求）"}
 
-        # 🔒 并发安全：使用悲观锁获取双方钱包
-        tipper_wallet = db_session.query(Wallet).filter(Wallet.account == current_user).with_for_update().first()
-        author_wallet = db_session.query(Wallet).filter(Wallet.account == author).with_for_update().first()
-
         if not tipper_wallet or tipper_wallet.balance < amount:
             raise HTTPException(status_code=400, detail="余额不足")
-        if not author_wallet:
-            # 如果作者钱包不存在，创建一个
-            author_wallet = Wallet(account=author, balance=0, earn_balance=0, tip_balance=0, frozen_balance=0)
-            db_session.add(author_wallet)
 
         # 执行转账
         tipper_wallet.balance -= amount
@@ -824,8 +737,17 @@ async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
         db_session.commit()
 
         # 📝 审计日志
-        logger.info(f"PROMPT_TIP | from={current_user} | to={author} | amount={amount} | prompt={prompt_id} | anon={is_anon}")
+        logger.info(f"PROMPT_TIP | prompt={prompt_id}")
+
+    except HTTPException:
+        db_session.rollback()
+        raise
+    except Exception as e:
+        db_session.rollback()
+        logger.error(f"PROMPT_TIP_ERROR | prompt={prompt_id} | error_type={type(e).__name__}")
+        raise HTTPException(status_code=500, detail="打赏处理失败，请稍后重试")
 
+    def notify_tip():
         # 🔔 打赏通知（考虑匿名）
         if not is_anon:
             add_notification(author, {
@@ -844,16 +766,8 @@ async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
                 "content": f"您收到了一份 {amount} 积分的匿名提示词打赏"
             })
 
-        # 🗂️ 清除排序缓存（打赏可能影响排序）
-        sort_cache.invalidate("prompts:")
-
-    except HTTPException:
-        db_session.rollback()
-        raise
-    except Exception as e:
-        db_session.rollback()
-        logger.error(f"PROMPT_TIP_ERROR | from={current_user} | prompt={prompt_id} | amount={amount} | error={str(e)}")
-        raise HTTPException(status_code=500, detail="打赏处理失败，请稍后重试")
+    run_tip_effect(notify_tip)
+    run_tip_effect(lambda: sort_cache.invalidate("prompts:"))
 
     # 🏆 扣款成功后再写打赏榜（写榜失败仅记录日志，不影响资金安全）
     def board_updater(data):
@@ -872,7 +786,7 @@ async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
     try:
         db.atomic_update("prompts.json", board_updater, default_data=[])
     except Exception as e:
-        logger.error(f"PROMPT_TIP_BOARD_ERROR | prompt={prompt_id} | error={str(e)}")
+        logger.error(f"PROMPT_TIP_BOARD_ERROR | prompt={prompt_id} | error_type={type(e).__name__}")
 
     return {"status": "success", "message": f"成功打赏 {amount} 积分"}
 
@@ -882,164 +796,108 @@ async def tip_prompt(prompt_id: str, amount: int, is_anon: bool = False,
 # ==========================================
 
 @router.post("/api/prompts/{prompt_id}/purchase")
-@limiter.limit("10/minute")  # 🔒 P0安全优化：购买每分钟最多10次
+@shared_limit(10)  # 🔒 P0安全优化：购买每分钟最多10次
 async def purchase_prompt(request: Request, prompt_id: str,
+                          purchase: Optional[PromptPurchaseRequest] = None,
                           current_user: str = Depends(require_auth), db_session: Session = Depends(get_db)):
-    """
-    购买提示词解锁正文（与 /api/wallet/purchase 逻辑对齐）
-    - 扣费、所有权、PURCHASE/SALE 交易记录、通知一步到位
-    - 成功后直接返回 prompt_text，前端立即展示
-    """
-    prompts_db = db.load_data("prompts.json", default_data=[])
-    prompt = next((p for p in prompts_db if p["id"] == prompt_id), None)
-
-    if not prompt:
-        raise HTTPException(status_code=404, detail="提示词不存在")
-
-    # 💰 应用延迟生效价格（与 /api/wallet/purchase 同构），确保扣费价与前端显示价一致
-    old_price = prompt.get("price", 0)
-    _apply_effective_price(prompt)
-    if prompt.get("price", 0) != old_price:
-        db.save_data("prompts.json", prompts_db)
-
-    price = int(prompt.get("price", 0) or 0)
-    seller_account = prompt.get("author")
-
-    if price <= 0 or current_user == seller_account:
-        # ☁️ 免费提示词或作者本人，确保 Ownership 记录存在
-        existing_ownership = db_session.query(Ownership).filter(
-            Ownership.account == current_user,
-            Ownership.item_id == prompt_id,
-            Ownership.is_refunded == False
-        ).first()
-        if not existing_ownership:
-            new_ownership = Ownership(
-                account=current_user,
-                item_id=prompt_id,
-                price_paid=0
-            )
-            db_session.add(new_ownership)
-            db_session.commit()
-        return {
-            "status": "success",
-            "already_owned": True,
-            "prompt_text": prompt.get("prompt_text", "")
-        }
-
-    # 检查是否已拥有（排除已退款的记录）
-    owned = db_session.query(Ownership).filter(
-        Ownership.account == current_user,
-        Ownership.item_id == prompt_id,
-        Ownership.is_refunded == False
-    ).first()
-    if owned:
-        return {
-            "status": "success",
-            "already_owned": True,
-            "prompt_text": prompt.get("prompt_text", "")
-        }
+    """资金与所有权原子提交；通知失败不改变已提交的购买结果。"""
+    try:
+        prompts_db = db.load_data("prompts.json", default_data=[], strict=True, skip_cache=True)
+        if not isinstance(prompts_db, list):
+            raise ValueError("invalid prompt collection")
+        prompt = next((p for p in prompts_db if isinstance(p, dict) and p.get("id") == prompt_id), None)
+        if prompt is None:
+            raise HTTPException(status_code=404, detail="提示词不存在")
+        price = effective_resource_price(prompt)
+        seller_account = prompt.get("author")
+        prompt_text = prompt.get("prompt_text")
+        if not isinstance(seller_account, str) or not seller_account.strip() or not isinstance(prompt_text, str):
+            raise ValueError("invalid prompt delivery")
+        response = {"status": "success", "already_owned": True, "prompt_text": prompt_text}
+    except HTTPException:
+        raise
+    except Exception as error:
+        logger.error("PROMPT_PURCHASE_SOURCE_ERROR | error_type=%s", type(error).__name__)
+        raise HTTPException(status_code=503, detail="提示词暂时不可购买")
 
-    # 🔒 P1并发安全：使用悲观锁+异常处理+事务回滚防止双花问题
+    # 非资金展示资料在写锁外读取；失败不影响正文交付或交易。
     try:
-        buyer_wallet = db_session.query(Wallet).filter(Wallet.account == current_user).with_for_update().first()
+        users_db = db.load_data("users.json", default_data={})
+        seller_info = users_db.get(seller_account, {})
+        buyer_info = users_db.get(current_user, {})
+        seller_user_name = seller_info.get("name", seller_account)
+        buyer_user_name = buyer_info.get("name", current_user)
+    except Exception:
+        seller_user_name, buyer_user_name = seller_account, current_user
 
-        # 🔒 锁内二次检查：串行化后重查 Ownership，彻底消除并发重复购买竞态
-        owned_locked = db_session.query(Ownership).filter(
+    free = price == 0 or current_user == seller_account
+    try:
+        # 必须是本次事务的第一项 SQL；SQLite 使用 BEGIN IMMEDIATE。
+        buyer_wallet, seller_wallet = lock_resource_purchase_wallets(
+            db_session, current_user, seller_account, free)
+        owned = db_session.query(Ownership).filter(
             Ownership.account == current_user,
             Ownership.item_id == prompt_id,
             Ownership.is_refunded == False
         ).first()
-        if owned_locked:
+        if owned:
             db_session.rollback()
-            return {
-                "status": "success",
-                "already_owned": True,
-                "prompt_text": prompt.get("prompt_text", "")
-            }
-
-        if not buyer_wallet or buyer_wallet.balance < price:
+            return response
+        if free:
+            db_session.add(Ownership(account=current_user, item_id=prompt_id, price_paid=0))
+            db_session.commit()
+            return response
+        expected_price = getattr(purchase, "expected_price", None)
+        if expected_price is None:
+            raise HTTPException(status_code=428, detail="purchase_price_confirmation_required")
+        if isinstance(expected_price, bool) or not isinstance(expected_price, int) or expected_price < 0:
+            raise HTTPException(status_code=422, detail="purchase_price_invalid")
+        if expected_price != price:
+            raise HTTPException(status_code=409, detail="purchase_price_changed")
+        if buyer_wallet is None or buyer_wallet.balance < price:
             raise HTTPException(status_code=402, detail="余额不足，请先充值")
-
-        seller_wallet = db_session.query(Wallet).filter(Wallet.account == seller_account).with_for_update().first()
-        if not seller_wallet:
-            seller_wallet = Wallet(account=seller_account, balance=0, earn_balance=0, tip_balance=0, frozen_balance=0)
-            db_session.add(seller_wallet)
-
-        buyer_wallet.balance = int(buyer_wallet.balance or 0) - int(price)
-        seller_wallet.balance = int(seller_wallet.balance or 0) + int(price)          # 实际收入进统一余额
-        seller_wallet.earn_balance = int(seller_wallet.earn_balance or 0) + int(price)  # 累计销售收益统计（只增不减）
-
-        # 记录所有权与实付价格
-        new_ownership = Ownership(account=current_user, item_id=prompt_id, price_paid=price)
-        db_session.add(new_ownership)
-
-        tx_id = f"BUY_{int(time.time())}_{uuid.uuid4().hex[:6]}"
-        last_tx = db_session.query(Transaction).filter(Transaction.account == current_user).order_by(Transaction.created_at.desc()).first()
-        prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
-        tx_hash = calculate_tx_hash(tx_id, current_user, "PURCHASE", -price, prev_hash)
-
-        # 获取卖家用户名
-        users_db = db.load_data("users.json", default_data={})
-        seller_info = users_db.get(seller_account, {})
-        seller_user_name = seller_info.get("name", seller_account)
-
-        # 创建交易记录 (字段名为 related_account，与 models_sql.py 中 Transaction 模型保持一致)
-        new_tx = Transaction(
-            tx_id=tx_id, account=current_user, tx_type="PURCHASE", amount=-price,
-            related_account=seller_account, item_id=prompt_id, prev_hash=prev_hash, tx_hash=tx_hash,
-            description=f"购买提示词 {prompt.get('title', '未知提示词')}",
-            item_title=prompt.get('title', ''),
-            item_type="prompt",
-            related_user_name=seller_user_name
-        )
-        db_session.add(new_tx)
-
-        # 为卖家生成销售收入记录
-        buyer_info = users_db.get(current_user, {})
-        buyer_user_name = buyer_info.get("name", current_user)
-        seller_tx_id = f"SALE_{int(time.time())}_{uuid.uuid4().hex[:6]}"
-        seller_tx = Transaction(
-            tx_id=seller_tx_id,
-            account=seller_account,
-            tx_type="SALE",
-            amount=price,
-            related_account=current_user,
-            item_id=prompt_id,
-            item_title=prompt.get('title', ''),
-            item_type="prompt",
-            related_user_name=buyer_user_name,
-            description=f"销售收入: {prompt.get('title', prompt_id)}"
-        )
-        db_session.add(seller_tx)
+        for amount in (buyer_wallet.balance, seller_wallet.balance, seller_wallet.earn_balance):
+            if isinstance(amount, bool) or not isinstance(amount, int):
+                raise ValueError("invalid wallet amount")
+        buyer_wallet.balance -= price
+        seller_wallet.balance += price
+        seller_wallet.earn_balance += price
+        db_session.add(Ownership(account=current_user, item_id=prompt_id, price_paid=price))
+
+        for account, other, tx_type, amount, user_name, description in (
+            (current_user, seller_account, "PURCHASE", -price, seller_user_name,
+             f"购买提示词 {prompt.get('title', '未知提示词')}"),
+            (seller_account, current_user, "SALE", price, buyer_user_name,
+             f"销售收入: {prompt.get('title', prompt_id)}")
+        ):
+            last_tx = db_session.query(Transaction).filter(Transaction.account == account).order_by(
+                Transaction.created_at.desc(), Transaction.tx_id.desc()).with_for_update().first()
+            prev_hash = last_tx.tx_hash if last_tx else "GENESIS_HASH"
+            tx_id = f"{tx_type}_{uuid.uuid4().hex}"
+            db_session.add(Transaction(
+                tx_id=tx_id, account=account, tx_type=tx_type, amount=amount,
+                related_account=other, item_id=prompt_id, prev_hash=prev_hash,
+                tx_hash=calculate_tx_hash(tx_id, account, tx_type, amount, prev_hash),
+                description=description, item_title=prompt.get("title", ""),
+                item_type="prompt", related_user_name=user_name))
+        response["already_owned"] = False
         db_session.commit()
-
-        # 📝 P2优化：购买审计日志
-        logger.info(f"PROMPT_PURCHASE | buyer={current_user} | seller={seller_account} | prompt={prompt_id} | amount={price} | tx={tx_id}")
-
-        # 🔔 通知卖家提示词被购买
-        if seller_account and seller_account != current_user:
-            add_notification(seller_account, {
-                "type": "purchase",
-                "from_user": current_user,
-                "target_item_id": prompt_id,
-                "target_item_title": prompt.get("title", ""),
-                "content": f"您的提示词《{prompt.get('title', '')}》已被购买"
-            })
-
-        # 购买成功后直接返回提示词正文
-        return {
-            "status": "success",
-            "already_owned": False,
-            "prompt_text": prompt.get("prompt_text", "")
-        }
     except HTTPException:
         db_session.rollback()
         raise
-    except Exception as e:
+    except Exception as error:
         db_session.rollback()
-        logger.error(f"PROMPT_PURCHASE_ERROR | buyer={current_user} | prompt={prompt_id} | error={str(e)}")
+        logger.error("PROMPT_PURCHASE_ERROR | error_type=%s", type(error).__name__)
         raise HTTPException(status_code=500, detail="购买处理失败，请稍后重试")
 
+    run_tip_effect(lambda: logger.info("PROMPT_PURCHASE_COMPLETED"))
+    run_tip_effect(lambda: add_notification(seller_account, {
+        "type": "purchase", "from_user": current_user,
+        "target_item_id": prompt_id, "target_item_title": prompt.get("title", ""),
+        "content": f"您的提示词《{prompt.get('title', '')}》已被购买"
+    }))
+    return response
+
 
 # ==========================================
 # 💬 评论接口（复用通用评论存储 comments.json）
@@ -1071,7 +929,8 @@ async def get_prompt_comments(prompt_id: str):
 
 
 @router.post("/api/prompts/{prompt_id}/comments")
-async def add_prompt_comment(prompt_id: str, content: str, current_user: str = Depends(require_auth)):
+@shared_limit(10)
+async def add_prompt_comment(request: Request, prompt_id: str, content: str, current_user: str = Depends(require_auth)):
     """
     添加提示词评论
     """
@@ -1079,7 +938,6 @@ async def add_prompt_comment(prompt_id: str, content: str, current_user: str = D
         raise HTTPException(status_code=400, detail="评论内容不能为空")
 
     prompts_db = db.load_data("prompts.json", default_data=[])
-    comments_db = db.load_data("comments.json", default_data={})
 
     # 检查提示词是否存在
     prompt_exists = any(p["id"] == prompt_id for p in prompts_db)
@@ -1093,27 +951,18 @@ async def add_prompt_comment(prompt_id: str, content: str, current_user: str = D
         "created_at": int(time.time())
     }
 
-    # comments_db 是 {item_id: [comments]} 格式
-    prompt_comments = comments_db.get(prompt_id, [])
-    prompt_comments.insert(0, new_comment)
-    comments_db[prompt_id] = prompt_comments
-    db.save_data("comments.json", comments_db)
+    append_comment(prompt_id, new_comment, prepend=True)
+    increment_comment_count("prompts.json", prompt_id)
 
     # 🗂️ 清除排序缓存（评论数变化可能影响排序）
     sort_cache.invalidate("prompts:")
 
-    # 更新提示词评论数
-    for prompt in prompts_db:
-        if prompt["id"] == prompt_id:
-            prompt["comments"] = prompt.get("comments", 0) + 1
-            break
-    db.save_data("prompts.json", prompts_db)
-
     return {"status": "success", "data": new_comment}
 
 
 @router.post("/api/prompts/{prompt_id}/view")
-async def record_prompt_view(prompt_id: str, current_user: str = Depends(require_auth)):
+@shared_limit(60)
+async def record_prompt_view(request: Request, prompt_id: str, current_user: str = Depends(require_auth)):
     """
     记录提示词访问量
     👁️ 需要用户认证，每个用户只计算一次总访问量，日访问量每次调用都增加

router_proxy.py

@@ -1,22 +1,102 @@
 # router_proxy.py
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
+from rate_limit import shared_limit
 from fastapi.responses import StreamingResponse, JSONResponse, Response
 from sqlalchemy.orm import Session
 from pydantic import BaseModel, Field, field_validator, HttpUrl
 from typing import Optional
-from urllib.parse import urlparse
+from urllib.parse import urlparse, urljoin
 import ipaddress
 import httpx
 import os
 import re
+import asyncio
+import socket
 import urllib.request
 import urllib.error
 import 数据库连接 as json_db
 from database_sql import get_db
 from models_sql import Ownership
+from workflow_source import authorized_workflow_path, workflow_credential_target, WorkflowSourceError
+from proxy_access import authorized_proxy_item, ProxyAccessError
+from github_source import repository_parts, select_github_token
+from github_archive import ARCHIVE_MAX_BYTES
 from 安全认证 import require_auth
+from safe_http_transport import ValidatedAsyncHTTPTransport
+from workflow_download_service import prepare_workflow_download
+from zip_stream import ZIP_DOWNLOAD_MAX_BYTES
+from github_zip_service import prepare_github_zip
 
 router = APIRouter()
+MAX_PROXY_DOWNLOAD_BYTES = int(os.environ.get("MAX_PROXY_DOWNLOAD_BYTES", str(256 * 1024 * 1024)))
+
+
+async def _validate_public_http_target(url: str) -> str:
+    """Validate every proxy hop and reject local/private destinations."""
+    parsed = urlparse(url)
+    if parsed.scheme not in ("http", "https") or not parsed.hostname or parsed.username or parsed.password:
+        raise HTTPException(status_code=400, detail="下载地址无效")
+    try:
+        port = parsed.port
+    except ValueError:
+        raise HTTPException(status_code=400, detail="下载地址端口无效")
+    if port not in (None, 80, 443):
+        raise HTTPException(status_code=400, detail="不允许访问自定义端口")
+
+    host = parsed.hostname.rstrip(".").lower()
+    try:
+        addresses = [ipaddress.ip_address(host)]
+    except ValueError:
+        try:
+            infos = await asyncio.to_thread(
+                socket.getaddrinfo, host, port or (443 if parsed.scheme == "https" else 80),
+                type=socket.SOCK_STREAM,
+            )
+        except OSError:
+            raise HTTPException(status_code=400, detail="下载地址无法解析")
+        addresses = [ipaddress.ip_address(info[4][0].split("%", 1)[0]) for info in infos]
+    if not addresses or any(not address.is_global for address in addresses):
+        raise HTTPException(status_code=400, detail="下载地址解析到非公网地址")
+    return host
+
+
+async def _send_with_validated_redirects(client, method: str, url: str, headers=None, timeout=None,
+                                         max_redirects: int = 5):
+    """逐跳校验 URL/DNS 后请求；不让 HTTPX 自动跟随未经检查的重定向。"""
+    current_url = url
+    original_host = await _validate_public_http_target(current_url)
+    original_parsed = urlparse(current_url)
+    original_origin = (
+        original_parsed.scheme.lower(),
+        original_host,
+        original_parsed.port or (443 if original_parsed.scheme.lower() == "https" else 80),
+    )
+    request_headers = dict(headers or {})
+    for redirect_count in range(max_redirects + 1):
+        current_host = await _validate_public_http_target(current_url)
+        current_parsed = urlparse(current_url)
+        current_origin = (
+            current_parsed.scheme.lower(),
+            current_host,
+            current_parsed.port or (443 if current_parsed.scheme.lower() == "https" else 80),
+        )
+        hop_headers = dict(request_headers)
+        if current_origin != original_origin:
+            # 凭据只发给初始 HTTPS origin，绝不随跨 origin 重定向传递。
+            hop_headers.pop("Authorization", None)
+        response = await client.send(
+            client.build_request(method, current_url, headers=hop_headers, timeout=timeout),
+            stream=True,
+            follow_redirects=False,
+        )
+        if response.status_code not in (301, 302, 303, 307, 308):
+            return response
+        location = response.headers.get("location")
+        await response.aclose()
+        if not location or redirect_count >= max_redirects:
+            raise HTTPException(status_code=502, detail="下载源重定向无效或次数过多")
+        current_url = urljoin(current_url, location)
+    raise HTTPException(status_code=502, detail="下载源重定向失败")
 
 
 class ProxyGithubZipRequest(BaseModel):
@@ -35,172 +115,27 @@ class ProxyGithubZipRequest(BaseModel):
         return v
 
 @router.post("/api/proxy_github_zip")
-async def proxy_github_zip(req_data: ProxyGithubZipRequest, account: str = Depends(require_auth), db: Session = Depends(get_db)):
+@shared_limit(5)
+async def proxy_github_zip(request: Request, req_data: ProxyGithubZipRequest, account: str = Depends(require_auth), db: Session = Depends(get_db)):
     """云端代理：校验所有权后，拉取 GitHub 私有库 ZIP 流透传给本地"""
-    items_db = json_db.load_data("items.json", default_data=[])
-    item = next((i for i in items_db if i["id"] == req_data.item_id), None)
-    if not item: return JSONResponse(content={"error": "资源不存在"}, status_code=404)
-    
-    # 1. 核心鉴权：验证用户是否购买过该工具（account 来自 Token 验证，不可伪造）
-    try:
-        price = int(float(item.get("price", 0) or 0))
-    except (ValueError, TypeError):
-        price = 0
-    if price > 0 and account != item.get("author"):
-        owned = db.query(Ownership).filter(Ownership.account == account, Ownership.item_id == req_data.item_id).first()
-        if not owned:
-            return JSONResponse(content={"error": "🚨 拒绝访问：未找到购买记录！"}, status_code=403)
-
-    # ===== ZIP 缓存优先机制（鉴权后、GitHub请求前） =====
-    try:
-        versions_db = json_db.load_data("versions.json", default_data={})
-        item_version = versions_db.get(req_data.item_id)
-        
-        # 兼容新格式：{"item_id": {"hash": "...", "cached_at": "...", "zip_size": ...}}
-        if isinstance(item_version, dict) and item_version.get("cached_at"):
-            cache_filename = f"zips/{req_data.item_id}_{item_version['hash']}.zip"
-            cache_url = f"https://huggingface.co/datasets/ZHIWEI666/ComfyUI-Ranking/resolve/main/{cache_filename}"
-            
-            cache_client = httpx.AsyncClient(follow_redirects=True)
-            head_resp = None
-            try:
-                head_resp = await cache_client.head(cache_url, timeout=10, follow_redirects=True)
-            except Exception as head_err:
-                print(f"[ZIP缓存] HEAD验证失败: {head_err}")
-                await cache_client.aclose()
-                raise
-            
-            if head_resp.status_code == 200:
-                print(f"[ZIP缓存] 命中: {req_data.item_id}, 大小: {item_version.get('zip_size', 'unknown')}")
-                
-                content_length = head_resp.headers.get('content-length', '') or str(item_version.get('zip_size', ''))
-                
-                try:
-                    stream_resp = await cache_client.send(
-                        cache_client.build_request("GET", cache_url),
-                        stream=True
-                    )
-                except Exception as stream_err:
-                    print(f"[ZIP缓存] 流请求失败: {stream_err}")
-                    await cache_client.aclose()
-                    raise
-                
-                cache_headers = {}
-                if content_length:
-                    cache_headers["Content-Length"] = content_length
-                # 🔖 回传本次实际下发的版本戳（缓存命中即 item_version['hash']），
-                #    供本地私有安装写入 LocalVer 驱动卡片更新徽章（前端 installed_version 优先）
-                if item_version.get('hash'):
-                    cache_headers["X-Installed-Version"] = item_version['hash']
-                
-                async def cache_stream_generator():
-                    try:
-                        if stream_resp.status_code != 200:
-                            yield b"CACHE_DOWNLOAD_FAILED"
-                            return
-                        async for chunk in stream_resp.aiter_bytes():
-                            yield chunk
-                    except Exception:
-                        yield b"CACHE_DOWNLOAD_FAILED"
-                    finally:
-                        await stream_resp.aclose()
-                        await cache_client.aclose()
-                
-                return StreamingResponse(cache_stream_generator(), media_type="application/zip", headers=cache_headers)
-            
-            # 缓存未命中：关闭 client 后继续原有逻辑
-            await cache_client.aclose()
-    except Exception as e:
-        print(f"[ZIP缓存] 查询失败，fallback到GitHub直连: {e}")
-
-    # 2. 解析 GitHub 仓库信息
-    repo_url = item.get("link", "").rstrip("/")
-    if not repo_url.startswith("https://github.com/"):
-        return JSONResponse(content={"error": "无效的仓库地址，目前仅支持 GitHub 私有库代理"}, status_code=400)
-
-    repo_parts = repo_url.split("/")
-    if len(repo_parts) < 2: return JSONResponse(content={"error": "无效的仓库地址格式"}, status_code=400)
-    owner = repo_parts[-2]
-    repo = repo_parts[-1].replace(".git", "")
-    
-    # GitHub 官方提供的打包下载 API
-    github_zip_api = f"https://api.github.com/repos/{owner}/{repo}/zipball"
-    
-    # 优先读取该资源在数据库中绑定的专属创作者 Token
-    creator_token = item.get("github_token")
-    # 如果没填，尝试使用官方全局兜底的 PAT
-    fallback_token = os.environ.get("GITHUB_PAT") 
-    
-    active_token = creator_token if creator_token else fallback_token
-
-    headers = {
-        "Accept": "application/vnd.github.v3+json",
-        "User-Agent": "ComfyUI-Ranking-SaaS"
-    }
-    if active_token:
-        headers["Authorization"] = f"Bearer {active_token}"
-
-    # 3. 异步请求 GitHub API 并以流形式透传回客户端 (防内存打爆)
-    client = httpx.AsyncClient(follow_redirects=True)
     try:
-        try:
-            response = await client.send(
-                client.build_request("GET", github_zip_api, headers=headers),
-                stream=True
-            )
-        except Exception as send_err:
-            await client.aclose()
-            return JSONResponse(content={"error": f"代理下载时发生网络异常：{str(send_err)}"}, status_code=500)
-
-        # 非 200 直接返回错误，避免 Content-Length 不匹配导致 h11 协议错误
-        if response.status_code != 200:
-            error_body = ""
-            try:
-                error_body = (await response.aread()).decode('utf-8', errors='ignore')[:200]
-            except Exception:
-                pass
-            await response.aclose()
-            await client.aclose()
-            status_map = {404: "仓库不存在或无权访问", 401: "Token 无效或已过期", 403: "访问被拒绝（可能触发速率限制）"}
-            err_msg = status_map.get(response.status_code, f"GitHub API 返回 HTTP {response.status_code}")
-            print(f"[proxy_github_zip] ❌ GitHub API 失败: {response.status_code}, repo: {github_zip_api}, body: {error_body[:100]}")
-            return JSONResponse(content={"error": f"GITHUB_DOWNLOAD_FAILED: {err_msg}"}, status_code=502)
+        item = await authorized_proxy_item(json_db, db, req_data.item_id, account)
+    except ProxyAccessError as error:
+        return JSONResponse(content={"error": error.message}, status_code=error.status_code)
 
-        # 成功时才透传 Content-Length 和流式响应
-        content_length = response.headers.get('content-length', '')
-        resp_headers = {}
-        if content_length:
-            resp_headers["Content-Length"] = content_length
+    async def resolve_commit(repo_url, token):
+        # 缓存命中不加载版本引擎；保留原按需导入时序。
+        from 云端_定时版本检测引擎 import fetch_github_commit
+        return await fetch_github_commit(repo_url, token)
 
-        # 🔖 缓存未命中（含 versions.json 尚未填充）时，现取仓库最新 commit 短 hash 回传，
-        #    补齐私有工具"安装瞬间无版本戳"的边界，使卡片更新徽章可正常触发。
-        #    解析失败不影响 ZIP 下发（前端会兜底 latest_version）
-        try:
-            from 云端_定时版本检测引擎 import fetch_latest_github_hash
-            live_hash = await fetch_latest_github_hash(repo_url, active_token)
-            if live_hash:
-                resp_headers["X-Installed-Version"] = live_hash
-        except Exception as ver_err:
-            print(f"[proxy_github_zip] ⚠️ 版本戳解析失败（不影响下发）: {ver_err}")
+    return await prepare_github_zip(item, req_data.item_id, store=json_db,
+        token_selector=select_github_token, resolve_commit=resolve_commit,
+        send=_send_with_validated_redirects, client_factory=httpx.AsyncClient,
+        transport_factory=ValidatedAsyncHTTPTransport, error_response=JSONResponse,
+        cache_max_bytes=ARCHIVE_MAX_BYTES, direct_max_bytes=ZIP_DOWNLOAD_MAX_BYTES)
 
-        async def stream_generator():
-            try:
-                async for chunk in response.aiter_bytes():
-                    yield chunk
-            except Exception:
-                yield b"GITHUB_DOWNLOAD_FAILED"
-            finally:
-                await response.aclose()
-                await client.aclose()
 
-        return StreamingResponse(stream_generator(), media_type="application/zip", headers=resp_headers)
-    except Exception as e:
-        await client.aclose()
-        return JSONResponse(content={"error": f"代理下载时发生网络异常：{str(e)}"}, status_code=500)
 
-# ==========================================
-# 新增：工作流/应用 (App) JSON 代理下载接口
-# ==========================================
 class ProxyDownloadRequest(BaseModel):
     """工作流/应用 JSON 代理下载请求模型"""
     url: str = Field(..., min_length=1, description="下载URL")
@@ -240,68 +175,17 @@ class ProxyDownloadRequest(BaseModel):
         return v
 
 @router.post("/api/proxy_download")
-async def proxy_download(req_data: ProxyDownloadRequest, account: str = Depends(require_auth), db: Session = Depends(get_db)):
+@shared_limit(10)
+async def proxy_download(request: Request, req_data: ProxyDownloadRequest, account: str = Depends(require_auth), db: Session = Depends(get_db)):
     """云端代理：校验所有权后，拉取真实的工作流 JSON 文件并透传给本地"""
-    items_db = json_db.load_data("items.json", default_data=[])
-    item = next((i for i in items_db if i["id"] == req_data.item_id), None)
-    
-    if not item: 
-        return JSONResponse(content={"error": "云端记录中找不到该资源"}, status_code=404)
-    
-    # 1. 核心鉴权：验证用户是否购买/获取过该工作流（account 来自 Token 验证，不可伪造）
-    try:
-        price = int(float(item.get("price", 0) or 0))
-    except (ValueError, TypeError):
-        price = 0
-    if price > 0 and account != item.get("author"):
-        owned = db.query(Ownership).filter(Ownership.account == account, Ownership.item_id == req_data.item_id).first()
-        if not owned:
-            return JSONResponse(content={"error": "您尚未获取该工作流，请先在社区页面点击获取"}, status_code=403)
-
-    target_url = req_data.url
-    
-    # 🚀 核心修复：从环境变量提取 Hugging Face Token，并组装 Authorization 请求头
-    hf_token = os.environ.get("HF_TOKEN") 
-    
-    headers = {"User-Agent": "ComfyUI-Ranking-SaaS"}
-    if hf_token and "huggingface.co" in target_url:
-        headers["Authorization"] = f"Bearer {hf_token}"
-    
-    # 🚀 核心修复：使用异步 httpx 替代同步 urllib，避免阻塞事件循环
-    # ⚠️ 安全警告：仅在网络环境导致证书验证失败时，通过环境变量临时关闭
-    verify_ssl = os.environ.get("DISABLE_SSL_VERIFY", "").lower() not in ("1", "true")
-    if not verify_ssl:
-        print("⚠️ SSL证书验证已关闭，请仅在调试环境使用")
-    
     try:
-        async with httpx.AsyncClient(follow_redirects=True, verify=verify_ssl, timeout=120.0) as client:
-            print(f"🔍 开始下载资源 [{req_data.item_id}]")
-            print(f"🔗 目标地址：{target_url[:80]}...")
-            
-            response = await client.get(target_url, headers=headers)
-            
-            if response.status_code != 200:
-                print(f"❌ 源文件拉取失败 [HTTP {response.status_code}]")
-                return JSONResponse(
-                    content={"error": f"源文件拉取失败，HTTP 状态码：{response.status_code}"}, 
-                    status_code=response.status_code
-                )
-            
-            content = response.content
-            print(f"✅ 成功下载资源 [{req_data.item_id}], 大小：{len(content)} bytes")
-            
-            return Response(
-                content=content, 
-                media_type="application/json", 
-                status_code=200,
-                headers={"Content-Disposition": f"attachment; filename={req_data.item_id}.json"}
-            )
-            
-    except httpx.TimeoutException as e:
-        print(f"❌ 下载超时：{str(e)}")
-        return JSONResponse(content={"error": "下载超时，请稍后重试"}, status_code=504)
-    except Exception as e:
-        import traceback
-        print(f"❌ 代理下载异常：{str(e)}")
-        print(traceback.format_exc())
-        return JSONResponse(content={"error": f"代理下载时发生网络异常：{str(e)}"}, status_code=500)
+        item = await authorized_proxy_item(json_db, db, req_data.item_id, account)
+    except ProxyAccessError as error:
+        return JSONResponse(content={"error": error.message}, status_code=error.status_code)
+
+    return await prepare_workflow_download(item, req_data.item_id, store=json_db,
+        source_authorizer=authorized_workflow_path, source_error=WorkflowSourceError,
+        credential_target=workflow_credential_target, validate_target=_validate_public_http_target,
+        client_factory=httpx.AsyncClient, transport_factory=ValidatedAsyncHTTPTransport,
+        timeout_error=httpx.TimeoutException, http_error=HTTPException,
+        error_response=JSONResponse, max_bytes=MAX_PROXY_DOWNLOAD_BYTES)