Merge remote-tracking branch 'origin/dev' into dev

.gitignore

@@ -2,4 +2,5 @@ public/
 .idea/
 .env
 runtime/
-nohup.out
+nohup.out
+*.pem

app/common/middleware/RateLimitMiddleware.php

@@ -0,0 +1,60 @@
+<?php
+
+namespace app\common\middleware;
+
+use think\facade\Cache;
+use think\Response;
+
+class RateLimitMiddleware
+{
+    // 频率限制配置（单位：秒）
+    protected $rules = [
+        'ip' => ['limit' => 10, 'window' => 60],    // 每IP每分钟10次
+        'mobile' => ['limit' => 5, 'window' => 3600] // 每手机号每小时5次
+    ];
+
+    public function handle($request, \Closure $next)
+    {
+        $mobile = $request->param('mobile');
+        $ip = $request->ip();
+
+        // IP频率检查
+        $ipKey = "rate:ip:{$ip}";
+        if (!$this->checkRate($ipKey, $this->rules['ip'])) {
+            return $this->tooManyRequests('IP请求过于频繁');
+        }
+
+        // 手机号频率检查
+        $mobileKey = "rate:mobile:{$mobile}";
+        if (!$this->checkRate($mobileKey, $this->rules['mobile'])) {
+            return $this->tooManyRequests('该手机号请求过于频繁');
+        }
+
+        return $next($request);
+    }
+
+    protected function checkRate(string $key, array $rule): bool
+    {
+        $count = Cache::get($key, 0);
+
+        if ($count >= $rule['limit']) {
+            return false;
+        }
+
+        Cache::inc($key);
+        if ($count === 0) {
+            Cache::expire($key, $rule['window']);
+        }
+
+        return true;
+    }
+
+    protected function tooManyRequests(string $message): Response
+    {
+        return json([
+            'code' => 429,
+            'msg' => $message,
+            'data' => null
+        ])->code(429);
+    }
+}

app/common/middleware/SignatureMiddleware.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace app\common\middleware;
+
+use think\facade\Cache;
+use think\Response;
+
+class SignatureMiddleware
+{
+    public function handle($request, \Closure $next)
+    {
+        // 1. 获取加密签名
+        $sign = $request->header('X-Sign');
+        if (!$sign) {
+            return $this->reject('缺少签名', 401);
+        }
+
+        // 2. 读取私钥
+        $privateKey = file_get_contents(env('RSA_PRIVATE_KEY_PATH'));
+        if (!$privateKey) {
+            return $this->reject('服务器密钥错误', 500);
+        }
+
+        // 3. 解密数据
+        $decrypted = '';
+        openssl_private_decrypt(base64_decode($sign), $decrypted, $privateKey);
+
+        if (!$decrypted || !strpos($decrypted, ':')) {
+            return $this->reject('无效签名', 403);
+        }
+
+        // 4. 分离随机数和时间戳
+        list($nonce, $timestamp) = explode(':', $decrypted, 2);
+
+        // 5. 验证时间有效性（5分钟内）
+        if (abs(time() - $timestamp / 1000) > 300) {
+            return $this->reject('请求已过期', 403);
+        }
+
+        // 6. 防重放攻击（检查nonce唯一性）
+        $cacheKey = 'nonce_' . $nonce;
+        if (Cache::has($cacheKey)) {
+            return $this->reject('重复请求', 403);
+        }
+        Cache::set($cacheKey, 1, 300); // 5分钟缓存
+
+        return $next($request);
+    }
+
+    private function reject($msg, $code): Response
+    {
+        return Response::create([
+            'code' => $code,
+            'msg'  => $msg
+        ], 'json')->code($code);
+    }
+}

app/common/repositories/user/UserRepository.php

@@ -1075,6 +1075,7 @@ class UserRepository extends BaseRepository
                     'commission_type' => $commission_type,
                     'mark' => empty($mark) ?'管理员调整收益':$mark ,
                     'create_time' => date('Y-m-d H:i:s'),
+                    'take_time' => time()
                 ];
                 if($commission_type != 5){
                     $isert_data['balance'] = $user['brokerage_price'];

app/controller/api/Auth.php

@@ -48,12 +48,14 @@ use think\App;
 use think\db\exception\DataNotFoundException;
 use think\db\exception\DbException;
 use think\db\exception\ModelNotFoundException;
+use think\Env;
 use think\Exception;
 use think\exception\HttpResponseException;
 use think\facade\Cache;
 use think\facade\Db;
 use think\facade\Log;
 use think\Filesystem;
+use think\Response;
 
 /**
  * Class Auth
@@ -1322,6 +1324,41 @@ class Auth extends BaseController
         return $res;
     }
 
+
+    /**
+     * 获取验签公钥
+     * @return Response
+     */
+    public function getPublicKey(): Response
+    {
+        $path = env('RSA_PUBLIC_KEY_PATH');
+
+        if (empty($path)) {
+            return json([
+                'code' => 500,
+                'msg' => '公钥路径未配置',
+                'data' => null
+            ]);
+        }
+
+        if (!file_exists($path)) {
+            return json([
+                'code' => 500,
+                'msg' => '公钥文件不存在: ' . $path,
+                'data' => null
+            ]);
+        }
+
+        $publicKey = file_get_contents($path);
+        return json([
+            'code' => 200,
+            'msg' => 'success',
+            'data' => [
+                'publicKey' => $publicKey
+            ]
+        ]);
+    }
+
     public function verify(UserAuthValidate $validate)
     {
         $data = $this->request->params(['phone', 'code', 'key',"type"]);

app/controller/api/Notify.php

@@ -506,7 +506,7 @@ class Notify
 
 
                                         //Db::name('user')->where('uid',$spread_data['uid'])->update(['contribute'=> $gx_jf,'score'=> $gx_jf,'brokerage_price'=> $yj_amount,'fugou'=>$fgj_amount]);
-                                        $this->con_log($spread_data['uid'],round($pv * 0.3,2),$store_order_data['order_id'],0,"推广会员专区商品赠送贡献值",1);
+                                        $this->con_log($spread_data['uid'],round($gx_jf * 0.3,2),$store_order_data['order_id'],0,"推广会员专区商品赠送贡献值",1);
                                         $this->score_log($spread_data['uid'],bcmul($gx_jf, $rate, 2),$store_order_data['order_id'],0,"推广会员专区商品赠送积分",1);
                                         //推广佣金
                                         $this->bill_user_log($spread_data['uid'],$yj_amount_90,$store_order_data['order_id'],3,$store_order_data['order_sn'],'推广获得佣金',$store_order_data['mer_id']);

route/api.php

@@ -6,6 +6,8 @@
  * Copyright (c) http://crmeb.net
  */
 
+use app\common\middleware\RateLimitMiddleware;
+use app\common\middleware\SignatureMiddleware;
 use think\facade\Route;
 Route::miss(function () {
     $DB = DIRECTORY_SEPARATOR;
@@ -969,8 +971,16 @@ Route::group('api/', function () {
     Route::get('auth/wechat', 'api.Auth/auth');
     //小程序授权
     Route::post('auth/mp', 'api.Auth/mpAuth');
+
+    // 获取验签公钥
+    // openssl genrsa -out request_private_key.pem 2048
+    // openssl rsa -in request_private_key.pem -pubout -out request_public_key.pem
+    Route::get('auth/getPublicKey', 'api.Auth/getPublicKey');
+
     //验证码
-    Route::post('auth/verify', 'api.Auth/verify');
+    Route::post('auth/verify', 'api.Auth/verify')
+        ->middleware(SignatureMiddleware::class)
+        ->middleware(RateLimitMiddleware::class);
     //微信配置
     Route::get('wechat/config', 'api.Wechat/jsConfig');
     //图片验证码