24kycj
ebe191b06d
- 会员改为永久激活方案；云端文件不再拦截非会员；预览弹窗内导出/打印才校验 - 首页最近文件支持本地记录，登录后与云端合并；移除独立会员页与订阅页 - 模板库入库管理：soon_templates 表、Admin 上传 CRUD、/templates 轻量列表与按需下载 Co-authored-by: Cursor <cursoragent@cursor.com>
101 lines
4.2 KiB
PHP
101 lines
4.2 KiB
PHP
<?php
|
|
declare(strict_types=1);
|
|
|
|
require __DIR__ . '/../src/bootstrap.php';
|
|
|
|
use Soon\Api\Admin\Controllers\AuditsController;
|
|
use Soon\Api\Admin\Controllers\OrdersController;
|
|
use Soon\Api\Admin\Controllers\PaymentController;
|
|
use Soon\Api\Admin\Controllers\PlansController;
|
|
use Soon\Api\Admin\Controllers\SettingsController;
|
|
use Soon\Api\Admin\Controllers\StatsController;
|
|
use Soon\Api\Admin\Controllers\TemplatesController;
|
|
use Soon\Api\Admin\Controllers\UsersController;
|
|
use Soon\Api\Core\Config;
|
|
use Soon\Api\Core\Json;
|
|
use Soon\Api\Core\Router;
|
|
use Soon\Api\Middleware\AdminAuth;
|
|
use Soon\Api\Middleware\RateLimit;
|
|
use Soon\Api\Services\AdminPermission;
|
|
|
|
$origin = $_SERVER['HTTP_ORIGIN'] ?? '';
|
|
$allowed = (array)Config::get('app.cors_origins', []);
|
|
if ($origin !== '' && in_array($origin, $allowed, true)) {
|
|
header('Access-Control-Allow-Origin: ' . $origin);
|
|
header('Vary: Origin');
|
|
header('Access-Control-Allow-Credentials: true');
|
|
header('Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS');
|
|
header('Access-Control-Allow-Headers: Authorization, Content-Type');
|
|
}
|
|
header('X-Content-Type-Options: nosniff');
|
|
header('X-Frame-Options: DENY');
|
|
header('Referrer-Policy: no-referrer');
|
|
|
|
if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
|
|
http_response_code(204);
|
|
exit;
|
|
}
|
|
|
|
$path = parse_url($_SERVER['REQUEST_URI'] ?? '/', PHP_URL_PATH) ?: '/';
|
|
$method = $_SERVER['REQUEST_METHOD'] ?? 'GET';
|
|
|
|
Router::get('/api/admin/stats', [StatsController::class, 'summary']);
|
|
|
|
Router::get('/api/admin/users', [UsersController::class, 'list']);
|
|
Router::post('/api/admin/users', [UsersController::class, 'create']);
|
|
Router::get('/api/admin/users/{id}', [UsersController::class, 'detail']);
|
|
Router::put('/api/admin/users/{id}', [UsersController::class, 'update']);
|
|
Router::delete('/api/admin/users/{id}', [UsersController::class, 'delete']);
|
|
Router::post('/api/admin/users/{id}/password', [UsersController::class, 'setPassword']);
|
|
Router::post('/api/admin/users/{id}/subscription', [UsersController::class, 'setSubscription']);
|
|
Router::post('/api/admin/users/{id}/status', [UsersController::class, 'setStatus']);
|
|
|
|
Router::get('/api/admin/orders', [OrdersController::class, 'list']);
|
|
Router::get('/api/admin/orders/{id}', [OrdersController::class, 'detail']);
|
|
Router::post('/api/admin/orders/{id}/cancel', [OrdersController::class, 'cancel']);
|
|
Router::post('/api/admin/orders/{id}/refund/approve', [OrdersController::class, 'refundApprove']);
|
|
Router::post('/api/admin/orders/{id}/refund/reject', [OrdersController::class, 'refundReject']);
|
|
|
|
Router::get('/api/admin/plans', [PlansController::class, 'list']);
|
|
Router::post('/api/admin/plans', [PlansController::class, 'upsert']);
|
|
|
|
Router::get('/api/admin/templates', [TemplatesController::class, 'list']);
|
|
Router::post('/api/admin/templates', [TemplatesController::class, 'create']);
|
|
Router::put('/api/admin/templates/{id}', [TemplatesController::class, 'update']);
|
|
Router::delete('/api/admin/templates/{id}', [TemplatesController::class, 'delete']);
|
|
|
|
Router::get('/api/admin/settings', [SettingsController::class, 'list']);
|
|
Router::post('/api/admin/settings', [SettingsController::class, 'set']);
|
|
Router::post('/api/admin/settings/batch', [SettingsController::class, 'setBatch']);
|
|
|
|
Router::get('/api/admin/audits', [AuditsController::class, 'list']);
|
|
|
|
Router::post('/api/admin/payment/upload', [PaymentController::class, 'upload']);
|
|
Router::post('/api/admin/payment/config', [PaymentController::class, 'saveConfig']);
|
|
Router::get('/api/admin/payment/status', [PaymentController::class, 'status']);
|
|
|
|
if (str_starts_with($path, '/api/admin/')) {
|
|
$adminId = AdminAuth::require();
|
|
AdminPermission::assertPath($adminId, $path);
|
|
RateLimit::check('admin/*', $method, $path, $adminId);
|
|
}
|
|
|
|
$match = Router::dispatch($method, $path);
|
|
if ($match === null) {
|
|
Json::fail('not_found', '管理接口不存在', 404);
|
|
}
|
|
[$handler, $params] = $match;
|
|
foreach ($params as $k => $v) {
|
|
if ($k === 'id' && is_string($v) && ctype_digit($v)) {
|
|
$params[$k] = (int)$v;
|
|
}
|
|
}
|
|
if (is_array($handler)) {
|
|
[$class, $action] = $handler;
|
|
$instance = new $class();
|
|
$args = array_values($params);
|
|
$instance->$action($adminId, ...$args);
|
|
} else {
|
|
($handler)($params);
|
|
}
|