Upload 2 files

router_messages.py

@@ -9,25 +9,31 @@ from models import PrivateMessage
 
 router = APIRouter()
 
-# === 用于接收系统公告的请求体模型 ===
+# === 新增：用于接收系统公告的请求体模型 ===
 class SystemAnnouncement(BaseModel):
     admin_account: str
     content: str
 
-# === 发布系统公告接口 (仅限管理员) ===
+# === 新增：发布系统公告接口 (仅限管理员) ===
 @router.post("/api/system/announcement")
 async def publish_announcement(ann: SystemAnnouncement):
+    # 鉴权：只有指定的官方账号才能发公告
     if ann.admin_account != "666666":
         raise HTTPException(status_code=403, detail="无权发布系统公告")
     
     announcements_db = db.load_data("announcements.json", default_data=[])
     
+    # 【防御性修复】：确保就算之前存成了别的格式，这里也强制转换为列表，防止 append 报错
+    if not isinstance(announcements_db, list):
+        announcements_db = []
+    
+    # 构造一条标准的系统公告数据结构
     new_ann = {
         "id": f"sys_{int(time.time())}_{uuid.uuid4().hex[:6]}",
         "type": "system",
         "from_user": "666666",
         "from_name": "官方团队",
-        "from_avatar": "https://via.placeholder.com/150/FF9800/FFFFFF?text=Sys",
+        "from_avatar": "https://via.placeholder.com/150/FF9800/FFFFFF?text=Sys", # 专属的橙色系统头像
         "content": ann.content,
         "created_at": int(time.time())
     }
@@ -37,6 +43,7 @@ async def publish_announcement(ann: SystemAnnouncement):
     
     return {"status": "success", "data": new_ann}
 
+
 @router.post("/api/messages/private")
 async def send_private_message(msg: PrivateMessage):
     chats_db = db.load_data("chats.json", default_data={})
@@ -90,11 +97,13 @@ async def get_chat_history(account: str, target_account: str):
     modified = False
     
     for m in msgs:
+        # 聊天记录也遵循 7 天冷数据截断
         if now - m.get("created_at", 0) < seven_days:
             valid_msgs.append(m)
         else:
             modified = True
             
+        # 本次访问即为已读
         if m["receiver"] == account and not m.get("is_read"): 
             m["is_read"] = True
             modified = True
@@ -110,29 +119,43 @@ async def get_messages(account: str):
     msgs_db = db.load_data("messages.json", default_data={})
     user_msgs = msgs_db.get(account, [])
     
-    # --- 系统公告懒加载注入 ---
+    # 【防御性修复】：确保 user_msgs 是列表
+    if not isinstance(user_msgs, list):
+        user_msgs = []
+    
+    # =========================================================
+    # 系统公告懒加载注入逻辑 (Lazy Push)
+    # =========================================================
     announcements_db = db.load_data("announcements.json", default_data=[])
-    user_msg_ids = {m.get("id") for m in user_msgs}
+    if not isinstance(announcements_db, list):
+        announcements_db = []
+        
+    # 获取用户已经拥有的消息 ID 集合，用于快速比对（加入防脏数据判断）
+    user_msg_ids = {m.get("id") for m in user_msgs if isinstance(m, dict)}
     
     injected = False
     for ann in announcements_db:
-        if ann.get("id") not in user_msg_ids:
-            new_sys_msg = dict(ann) 
+        if isinstance(ann, dict) and ann.get("id") not in user_msg_ids:
+            # 如果是新公告，构造一条个人消息注入进去
+            new_sys_msg = dict(ann) # 浅拷贝，防止修改全局数据
             new_sys_msg["is_read"] = False
             new_sys_msg["receiver"] = account
             user_msgs.append(new_sys_msg)
             injected = True
             
     if injected:
-        user_msgs.sort(key=lambda x: x.get("created_at", 0), reverse=True)
-    # --------------------------
+        # 如果注入了新公告，按照时间重新倒序排列，确保最新的消息/公告在最上面
+        user_msgs.sort(key=lambda x: x.get("created_at", 0) if isinstance(x, dict) else 0, reverse=True)
+    # =========================================================
     
     now = int(time.time())
     seven_days = 7 * 24 * 3600
     valid = []
+    # 如果刚才注入了新公告，说明用户的消息列表被修改了，必须触发保存
     modified = injected 
     
     for m in user_msgs:
+        if not isinstance(m, dict): continue
         if not m.get("is_read") or (now - m.get("created_at", 0) < seven_days):
             valid.append(m)
         else:
@@ -142,7 +165,7 @@ async def get_messages(account: str):
         msgs_db[account] = valid
         db.save_data("messages.json", msgs_db)
         
-    return {"status": "success", "data": valid, "unread_count": sum(1 for m in valid if not m.get("is_read"))}
+    return {"status": "success", "data": valid, "unread_count": sum(1 for m in valid if m.get("is_read") is False)}
 
 @router.post("/api/messages/{account}/read")
 async def mark_messages_read(account: str):
@@ -150,13 +173,14 @@ async def mark_messages_read(account: str):
     user_msgs = msgs_db.get(account, [])
     modified = False
     
-    for m in user_msgs:
-        if not m.get("is_read"):
-            m["is_read"] = True
-            modified = True
-            
-    if modified:
-        msgs_db[account] = user_msgs
-        db.save_data("messages.json", msgs_db)
+    if isinstance(user_msgs, list):
+        for m in user_msgs:
+            if isinstance(m, dict) and not m.get("is_read"):
+                m["is_read"] = True
+                modified = True
+                
+        if modified:
+            msgs_db[account] = user_msgs
+            db.save_data("messages.json", msgs_db)
         
     return {"status": "success"}

router_wallet.py

@@ -1,5 +1,6 @@
 # router_wallet.py
 from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi.responses import Response # 【必须导入的模块，否则支付宝回调报 500】
 from sqlalchemy.orm import Session
 import time
 import uuid
@@ -104,7 +105,7 @@ async def tip_user(req: TipRequest, db: Session = Depends(get_db)):
 
 @router.post("/api/wallet/withdraw")
 async def submit_withdraw(req: WithdrawRequest, db: Session = Depends(get_db)):
-    # 1. 验证码校验（若想关闭风控测试，可注释掉此处）
+    # 1. 验证码校验
     verify_data = VERIFY_CODES.get(req.account)
     if not verify_data or verify_data["code"] != req.code or verify_data["action"] != "withdraw":
         raise HTTPException(status_code=400, detail="验证码无效或已过期")