feat: 优化单订阅模式下赠送订阅的处理逻辑，支持延长赠送订阅并允许用户在拥有赠送订阅时购买新订阅，同时新增版本历史脚本。

- purchaseLogic: 允许只有赠送订阅(order_id=0)的用户在SingleModel下新购
- activateOrderLogic: NewPurchase激活时检测赠送订阅，在原有订阅上延长到期时间而非创建新记录

.agent/skills/systematic-debugging/CREATION-LOG.md

@@ -0,0 +1,119 @@
+# Creation Log: Systematic Debugging Skill
+
+Reference example of extracting, structuring, and bulletproofing a critical skill.
+
+## Source Material
+
+Extracted debugging framework from `/Users/jesse/.claude/CLAUDE.md`:
+- 4-phase systematic process (Investigation → Pattern Analysis → Hypothesis → Implementation)
+- Core mandate: ALWAYS find root cause, NEVER fix symptoms
+- Rules designed to resist time pressure and rationalization
+
+## Extraction Decisions
+
+**What to include:**
+- Complete 4-phase framework with all rules
+- Anti-shortcuts ("NEVER fix symptom", "STOP and re-analyze")
+- Pressure-resistant language ("even if faster", "even if I seem in a hurry")
+- Concrete steps for each phase
+
+**What to leave out:**
+- Project-specific context
+- Repetitive variations of same rule
+- Narrative explanations (condensed to principles)
+
+## Structure Following skill-creation/SKILL.md
+
+1. **Rich when_to_use** - Included symptoms and anti-patterns
+2. **Type: technique** - Concrete process with steps
+3. **Keywords** - "root cause", "symptom", "workaround", "debugging", "investigation"
+4. **Flowchart** - Decision point for "fix failed" → re-analyze vs add more fixes
+5. **Phase-by-phase breakdown** - Scannable checklist format
+6. **Anti-patterns section** - What NOT to do (critical for this skill)
+
+## Bulletproofing Elements
+
+Framework designed to resist rationalization under pressure:
+
+### Language Choices
+- "ALWAYS" / "NEVER" (not "should" / "try to")
+- "even if faster" / "even if I seem in a hurry"
+- "STOP and re-analyze" (explicit pause)
+- "Don't skip past" (catches the actual behavior)
+
+### Structural Defenses
+- **Phase 1 required** - Can't skip to implementation
+- **Single hypothesis rule** - Forces thinking, prevents shotgun fixes
+- **Explicit failure mode** - "IF your first fix doesn't work" with mandatory action
+- **Anti-patterns section** - Shows exactly what shortcuts look like
+
+### Redundancy
+- Root cause mandate in overview + when_to_use + Phase 1 + implementation rules
+- "NEVER fix symptom" appears 4 times in different contexts
+- Each phase has explicit "don't skip" guidance
+
+## Testing Approach
+
+Created 4 validation tests following skills/meta/testing-skills-with-subagents:
+
+### Test 1: Academic Context (No Pressure)
+- Simple bug, no time pressure
+- **Result:** Perfect compliance, complete investigation
+
+### Test 2: Time Pressure + Obvious Quick Fix
+- User "in a hurry", symptom fix looks easy
+- **Result:** Resisted shortcut, followed full process, found real root cause
+
+### Test 3: Complex System + Uncertainty
+- Multi-layer failure, unclear if can find root cause
+- **Result:** Systematic investigation, traced through all layers, found source
+
+### Test 4: Failed First Fix
+- Hypothesis doesn't work, temptation to add more fixes
+- **Result:** Stopped, re-analyzed, formed new hypothesis (no shotgun)
+
+**All tests passed.** No rationalizations found.
+
+## Iterations
+
+### Initial Version
+- Complete 4-phase framework
+- Anti-patterns section
+- Flowchart for "fix failed" decision
+
+### Enhancement 1: TDD Reference
+- Added link to skills/testing/test-driven-development
+- Note explaining TDD's "simplest code" ≠ debugging's "root cause"
+- Prevents confusion between methodologies
+
+## Final Outcome
+
+Bulletproof skill that:
+- ✅ Clearly mandates root cause investigation
+- ✅ Resists time pressure rationalization
+- ✅ Provides concrete steps for each phase
+- ✅ Shows anti-patterns explicitly
+- ✅ Tested under multiple pressure scenarios
+- ✅ Clarifies relationship to TDD
+- ✅ Ready for use
+
+## Key Insight
+
+**Most important bulletproofing:** Anti-patterns section showing exact shortcuts that feel justified in the moment. When Claude thinks "I'll just add this one quick fix", seeing that exact pattern listed as wrong creates cognitive friction.
+
+## Usage Example
+
+When encountering a bug:
+1. Load skill: skills/debugging/systematic-debugging
+2. Read overview (10 sec) - reminded of mandate
+3. Follow Phase 1 checklist - forced investigation
+4. If tempted to skip - see anti-pattern, stop
+5. Complete all phases - root cause found
+
+**Time investment:** 5-10 minutes
+**Time saved:** Hours of symptom-whack-a-mole
+
+---
+
+*Created: 2025-10-03*
+*Purpose: Reference example for skill extraction and bulletproofing*

.agent/skills/systematic-debugging/SKILL.md

@@ -0,0 +1,296 @@
+---
+name: systematic-debugging
+description: Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes
+---
+
+# Systematic Debugging
+
+## Overview
+
+Random fixes waste time and create new bugs. Quick patches mask underlying issues.
+
+**Core principle:** ALWAYS find root cause before attempting fixes. Symptom fixes are failure.
+
+**Violating the letter of this process is violating the spirit of debugging.**
+
+## The Iron Law
+
+```
+NO FIXES WITHOUT ROOT CAUSE INVESTIGATION FIRST
+```
+
+If you haven't completed Phase 1, you cannot propose fixes.
+
+## When to Use
+
+Use for ANY technical issue:
+- Test failures
+- Bugs in production
+- Unexpected behavior
+- Performance problems
+- Build failures
+- Integration issues
+
+**Use this ESPECIALLY when:**
+- Under time pressure (emergencies make guessing tempting)
+- "Just one quick fix" seems obvious
+- You've already tried multiple fixes
+- Previous fix didn't work
+- You don't fully understand the issue
+
+**Don't skip when:**
+- Issue seems simple (simple bugs have root causes too)
+- You're in a hurry (rushing guarantees rework)
+- Manager wants it fixed NOW (systematic is faster than thrashing)
+
+## The Four Phases
+
+You MUST complete each phase before proceeding to the next.
+
+### Phase 1: Root Cause Investigation
+
+**BEFORE attempting ANY fix:**
+
+1. **Read Error Messages Carefully**
+   - Don't skip past errors or warnings
+   - They often contain the exact solution
+   - Read stack traces completely
+   - Note line numbers, file paths, error codes
+
+2. **Reproduce Consistently**
+   - Can you trigger it reliably?
+   - What are the exact steps?
+   - Does it happen every time?
+   - If not reproducible → gather more data, don't guess
+
+3. **Check Recent Changes**
+   - What changed that could cause this?
+   - Git diff, recent commits
+   - New dependencies, config changes
+   - Environmental differences
+
+4. **Gather Evidence in Multi-Component Systems**
+
+   **WHEN system has multiple components (CI → build → signing, API → service → database):**
+
+   **BEFORE proposing fixes, add diagnostic instrumentation:**
+   ```
+   For EACH component boundary:
+     - Log what data enters component
+     - Log what data exits component
+     - Verify environment/config propagation
+     - Check state at each layer
+
+   Run once to gather evidence showing WHERE it breaks
+   THEN analyze evidence to identify failing component
+   THEN investigate that specific component
+   ```
+
+   **Example (multi-layer system):**
+   ```bash
+   # Layer 1: Workflow
+   echo "=== Secrets available in workflow: ==="
+   echo "IDENTITY: ${IDENTITY:+SET}${IDENTITY:-UNSET}"
+
+   # Layer 2: Build script
+   echo "=== Env vars in build script: ==="
+   env | grep IDENTITY || echo "IDENTITY not in environment"
+
+   # Layer 3: Signing script
+   echo "=== Keychain state: ==="
+   security list-keychains
+   security find-identity -v
+
+   # Layer 4: Actual signing
+   codesign --sign "$IDENTITY" --verbose=4 "$APP"
+   ```
+
+   **This reveals:** Which layer fails (secrets → workflow ✓, workflow → build ✗)
+
+5. **Trace Data Flow**
+
+   **WHEN error is deep in call stack:**
+
+   See `root-cause-tracing.md` in this directory for the complete backward tracing technique.
+
+   **Quick version:**
+   - Where does bad value originate?
+   - What called this with bad value?
+   - Keep tracing up until you find the source
+   - Fix at source, not at symptom
+
+### Phase 2: Pattern Analysis
+
+**Find the pattern before fixing:**
+
+1. **Find Working Examples**
+   - Locate similar working code in same codebase
+   - What works that's similar to what's broken?
+
+2. **Compare Against References**
+   - If implementing pattern, read reference implementation COMPLETELY
+   - Don't skim - read every line
+   - Understand the pattern fully before applying
+
+3. **Identify Differences**
+   - What's different between working and broken?
+   - List every difference, however small
+   - Don't assume "that can't matter"
+
+4. **Understand Dependencies**
+   - What other components does this need?
+   - What settings, config, environment?
+   - What assumptions does it make?
+
+### Phase 3: Hypothesis and Testing
+
+**Scientific method:**
+
+1. **Form Single Hypothesis**
+   - State clearly: "I think X is the root cause because Y"
+   - Write it down
+   - Be specific, not vague
+
+2. **Test Minimally**
+   - Make the SMALLEST possible change to test hypothesis
+   - One variable at a time
+   - Don't fix multiple things at once
+
+3. **Verify Before Continuing**
+   - Did it work? Yes → Phase 4
+   - Didn't work? Form NEW hypothesis
+   - DON'T add more fixes on top
+
+4. **When You Don't Know**
+   - Say "I don't understand X"
+   - Don't pretend to know
+   - Ask for help
+   - Research more
+
+### Phase 4: Implementation
+
+**Fix the root cause, not the symptom:**
+
+1. **Create Failing Test Case**
+   - Simplest possible reproduction
+   - Automated test if possible
+   - One-off test script if no framework
+   - MUST have before fixing
+   - Use the `superpowers:test-driven-development` skill for writing proper failing tests
+
+2. **Implement Single Fix**
+   - Address the root cause identified
+   - ONE change at a time
+   - No "while I'm here" improvements
+   - No bundled refactoring
+
+3. **Verify Fix**
+   - Test passes now?
+   - No other tests broken?
+   - Issue actually resolved?
+
+4. **If Fix Doesn't Work**
+   - STOP
+   - Count: How many fixes have you tried?
+   - If < 3: Return to Phase 1, re-analyze with new information
+   - **If ≥ 3: STOP and question the architecture (step 5 below)**
+   - DON'T attempt Fix #4 without architectural discussion
+
+5. **If 3+ Fixes Failed: Question Architecture**
+
+   **Pattern indicating architectural problem:**
+   - Each fix reveals new shared state/coupling/problem in different place
+   - Fixes require "massive refactoring" to implement
+   - Each fix creates new symptoms elsewhere
+
+   **STOP and question fundamentals:**
+   - Is this pattern fundamentally sound?
+   - Are we "sticking with it through sheer inertia"?
+   - Should we refactor architecture vs. continue fixing symptoms?
+
+   **Discuss with your human partner before attempting more fixes**
+
+   This is NOT a failed hypothesis - this is a wrong architecture.
+
+## Red Flags - STOP and Follow Process
+
+If you catch yourself thinking:
+- "Quick fix for now, investigate later"
+- "Just try changing X and see if it works"
+- "Add multiple changes, run tests"
+- "Skip the test, I'll manually verify"
+- "It's probably X, let me fix that"
+- "I don't fully understand but this might work"
+- "Pattern says X but I'll adapt it differently"
+- "Here are the main problems: [lists fixes without investigation]"
+- Proposing solutions before tracing data flow
+- **"One more fix attempt" (when already tried 2+)**
+- **Each fix reveals new problem in different place**
+
+**ALL of these mean: STOP. Return to Phase 1.**
+
+**If 3+ fixes failed:** Question the architecture (see Phase 4.5)
+
+## your human partner's Signals You're Doing It Wrong
+
+**Watch for these redirections:**
+- "Is that not happening?" - You assumed without verifying
+- "Will it show us...?" - You should have added evidence gathering
+- "Stop guessing" - You're proposing fixes without understanding
+- "Ultrathink this" - Question fundamentals, not just symptoms
+- "We're stuck?" (frustrated) - Your approach isn't working
+
+**When you see these:** STOP. Return to Phase 1.
+
+## Common Rationalizations
+
+| Excuse | Reality |
+|--------|---------|
+| "Issue is simple, don't need process" | Simple issues have root causes too. Process is fast for simple bugs. |
+| "Emergency, no time for process" | Systematic debugging is FASTER than guess-and-check thrashing. |
+| "Just try this first, then investigate" | First fix sets the pattern. Do it right from the start. |
+| "I'll write test after confirming fix works" | Untested fixes don't stick. Test first proves it. |
+| "Multiple fixes at once saves time" | Can't isolate what worked. Causes new bugs. |
+| "Reference too long, I'll adapt the pattern" | Partial understanding guarantees bugs. Read it completely. |
+| "I see the problem, let me fix it" | Seeing symptoms ≠ understanding root cause. |
+| "One more fix attempt" (after 2+ failures) | 3+ failures = architectural problem. Question pattern, don't fix again. |
+
+## Quick Reference
+
+| Phase | Key Activities | Success Criteria |
+|-------|---------------|------------------|
+| **1. Root Cause** | Read errors, reproduce, check changes, gather evidence | Understand WHAT and WHY |
+| **2. Pattern** | Find working examples, compare | Identify differences |
+| **3. Hypothesis** | Form theory, test minimally | Confirmed or new hypothesis |
+| **4. Implementation** | Create test, fix, verify | Bug resolved, tests pass |
+
+## When Process Reveals "No Root Cause"
+
+If systematic investigation reveals issue is truly environmental, timing-dependent, or external:
+
+1. You've completed the process
+2. Document what you investigated
+3. Implement appropriate handling (retry, timeout, error message)
+4. Add monitoring/logging for future investigation
+
+**But:** 95% of "no root cause" cases are incomplete investigation.
+
+## Supporting Techniques
+
+These techniques are part of systematic debugging and available in this directory:
+
+- **`root-cause-tracing.md`** - Trace bugs backward through call stack to find original trigger
+- **`defense-in-depth.md`** - Add validation at multiple layers after finding root cause
+- **`condition-based-waiting.md`** - Replace arbitrary timeouts with condition polling
+
+**Related skills:**
+- **superpowers:test-driven-development** - For creating failing test case (Phase 4, Step 1)
+- **superpowers:verification-before-completion** - Verify fix worked before claiming success
+
+## Real-World Impact
+
+From debugging sessions:
+- Systematic approach: 15-30 minutes to fix
+- Random fixes approach: 2-3 hours of thrashing
+- First-time fix rate: 95% vs 40%
+- New bugs introduced: Near zero vs common

.agent/skills/systematic-debugging/condition-based-waiting-example.ts

@@ -0,0 +1,158 @@
+// Complete implementation of condition-based waiting utilities
+// From: Lace test infrastructure improvements (2025-10-03)
+// Context: Fixed 15 flaky tests by replacing arbitrary timeouts
+
+import type { ThreadManager } from '~/threads/thread-manager';
+import type { LaceEvent, LaceEventType } from '~/threads/types';
+
+/**
+ * Wait for a specific event type to appear in thread
+ *
+ * @param threadManager - The thread manager to query
+ * @param threadId - Thread to check for events
+ * @param eventType - Type of event to wait for
+ * @param timeoutMs - Maximum time to wait (default 5000ms)
+ * @returns Promise resolving to the first matching event
+ *
+ * Example:
+ *   await waitForEvent(threadManager, agentThreadId, 'TOOL_RESULT');
+ */
+export function waitForEvent(
+  threadManager: ThreadManager,
+  threadId: string,
+  eventType: LaceEventType,
+  timeoutMs = 5000
+): Promise<LaceEvent> {
+  return new Promise((resolve, reject) => {
+    const startTime = Date.now();
+
+    const check = () => {
+      const events = threadManager.getEvents(threadId);
+      const event = events.find((e) => e.type === eventType);
+
+      if (event) {
+        resolve(event);
+      } else if (Date.now() - startTime > timeoutMs) {
+        reject(new Error(`Timeout waiting for ${eventType} event after ${timeoutMs}ms`));
+      } else {
+        setTimeout(check, 10); // Poll every 10ms for efficiency
+      }
+    };
+
+    check();
+  });
+}
+
+/**
+ * Wait for a specific number of events of a given type
+ *
+ * @param threadManager - The thread manager to query
+ * @param threadId - Thread to check for events
+ * @param eventType - Type of event to wait for
+ * @param count - Number of events to wait for
+ * @param timeoutMs - Maximum time to wait (default 5000ms)
+ * @returns Promise resolving to all matching events once count is reached
+ *
+ * Example:
+ *   // Wait for 2 AGENT_MESSAGE events (initial response + continuation)
+ *   await waitForEventCount(threadManager, agentThreadId, 'AGENT_MESSAGE', 2);
+ */
+export function waitForEventCount(
+  threadManager: ThreadManager,
+  threadId: string,
+  eventType: LaceEventType,
+  count: number,
+  timeoutMs = 5000
+): Promise<LaceEvent[]> {
+  return new Promise((resolve, reject) => {
+    const startTime = Date.now();
+
+    const check = () => {
+      const events = threadManager.getEvents(threadId);
+      const matchingEvents = events.filter((e) => e.type === eventType);
+
+      if (matchingEvents.length >= count) {
+        resolve(matchingEvents);
+      } else if (Date.now() - startTime > timeoutMs) {
+        reject(
+          new Error(
+            `Timeout waiting for ${count} ${eventType} events after ${timeoutMs}ms (got ${matchingEvents.length})`
+          )
+        );
+      } else {
+        setTimeout(check, 10);
+      }
+    };
+
+    check();
+  });
+}
+
+/**
+ * Wait for an event matching a custom predicate
+ * Useful when you need to check event data, not just type
+ *
+ * @param threadManager - The thread manager to query
+ * @param threadId - Thread to check for events
+ * @param predicate - Function that returns true when event matches
+ * @param description - Human-readable description for error messages
+ * @param timeoutMs - Maximum time to wait (default 5000ms)
+ * @returns Promise resolving to the first matching event
+ *
+ * Example:
+ *   // Wait for TOOL_RESULT with specific ID
+ *   await waitForEventMatch(
+ *     threadManager,
+ *     agentThreadId,
+ *     (e) => e.type === 'TOOL_RESULT' && e.data.id === 'call_123',
+ *     'TOOL_RESULT with id=call_123'
+ *   );
+ */
+export function waitForEventMatch(
+  threadManager: ThreadManager,
+  threadId: string,
+  predicate: (event: LaceEvent) => boolean,
+  description: string,
+  timeoutMs = 5000
+): Promise<LaceEvent> {
+  return new Promise((resolve, reject) => {
+    const startTime = Date.now();
+
+    const check = () => {
+      const events = threadManager.getEvents(threadId);
+      const event = events.find(predicate);
+
+      if (event) {
+        resolve(event);
+      } else if (Date.now() - startTime > timeoutMs) {
+        reject(new Error(`Timeout waiting for ${description} after ${timeoutMs}ms`));
+      } else {
+        setTimeout(check, 10);
+      }
+    };
+
+    check();
+  });
+}
+
+// Usage example from actual debugging session:
+//
+// BEFORE (flaky):
+// ---------------
+// const messagePromise = agent.sendMessage('Execute tools');
+// await new Promise(r => setTimeout(r, 300)); // Hope tools start in 300ms
+// agent.abort();
+// await messagePromise;
+// await new Promise(r => setTimeout(r, 50));  // Hope results arrive in 50ms
+// expect(toolResults.length).toBe(2);         // Fails randomly
+//
+// AFTER (reliable):
+// ----------------
+// const messagePromise = agent.sendMessage('Execute tools');
+// await waitForEventCount(threadManager, threadId, 'TOOL_CALL', 2); // Wait for tools to start
+// agent.abort();
+// await messagePromise;
+// await waitForEventCount(threadManager, threadId, 'TOOL_RESULT', 2); // Wait for results
+// expect(toolResults.length).toBe(2); // Always succeeds
+//
+// Result: 60% pass rate → 100%, 40% faster execution

.agent/skills/systematic-debugging/condition-based-waiting.md

@@ -0,0 +1,115 @@
+# Condition-Based Waiting
+
+## Overview
+
+Flaky tests often guess at timing with arbitrary delays. This creates race conditions where tests pass on fast machines but fail under load or in CI.
+
+**Core principle:** Wait for the actual condition you care about, not a guess about how long it takes.
+
+## When to Use
+
+```dot
+digraph when_to_use {
+    "Test uses setTimeout/sleep?" [shape=diamond];
+    "Testing timing behavior?" [shape=diamond];
+    "Document WHY timeout needed" [shape=box];
+    "Use condition-based waiting" [shape=box];
+
+    "Test uses setTimeout/sleep?" -> "Testing timing behavior?" [label="yes"];
+    "Testing timing behavior?" -> "Document WHY timeout needed" [label="yes"];
+    "Testing timing behavior?" -> "Use condition-based waiting" [label="no"];
+}
+```
+
+**Use when:**
+- Tests have arbitrary delays (`setTimeout`, `sleep`, `time.sleep()`)
+- Tests are flaky (pass sometimes, fail under load)
+- Tests timeout when run in parallel
+- Waiting for async operations to complete
+
+**Don't use when:**
+- Testing actual timing behavior (debounce, throttle intervals)
+- Always document WHY if using arbitrary timeout
+
+## Core Pattern
+
+```typescript
+// ❌ BEFORE: Guessing at timing
+await new Promise(r => setTimeout(r, 50));
+const result = getResult();
+expect(result).toBeDefined();
+
+// ✅ AFTER: Waiting for condition
+await waitFor(() => getResult() !== undefined);
+const result = getResult();
+expect(result).toBeDefined();
+```
+
+## Quick Patterns
+
+| Scenario | Pattern |
+|----------|---------|
+| Wait for event | `waitFor(() => events.find(e => e.type === 'DONE'))` |
+| Wait for state | `waitFor(() => machine.state === 'ready')` |
+| Wait for count | `waitFor(() => items.length >= 5)` |
+| Wait for file | `waitFor(() => fs.existsSync(path))` |
+| Complex condition | `waitFor(() => obj.ready && obj.value > 10)` |
+
+## Implementation
+
+Generic polling function:
+```typescript
+async function waitFor<T>(
+  condition: () => T | undefined | null | false,
+  description: string,
+  timeoutMs = 5000
+): Promise<T> {
+  const startTime = Date.now();
+
+  while (true) {
+    const result = condition();
+    if (result) return result;
+
+    if (Date.now() - startTime > timeoutMs) {
+      throw new Error(`Timeout waiting for ${description} after ${timeoutMs}ms`);
+    }
+
+    await new Promise(r => setTimeout(r, 10)); // Poll every 10ms
+  }
+}
+```
+
+See `condition-based-waiting-example.ts` in this directory for complete implementation with domain-specific helpers (`waitForEvent`, `waitForEventCount`, `waitForEventMatch`) from actual debugging session.
+
+## Common Mistakes
+
+**❌ Polling too fast:** `setTimeout(check, 1)` - wastes CPU
+**✅ Fix:** Poll every 10ms
+
+**❌ No timeout:** Loop forever if condition never met
+**✅ Fix:** Always include timeout with clear error
+
+**❌ Stale data:** Cache state before loop
+**✅ Fix:** Call getter inside loop for fresh data
+
+## When Arbitrary Timeout IS Correct
+
+```typescript
+// Tool ticks every 100ms - need 2 ticks to verify partial output
+await waitForEvent(manager, 'TOOL_STARTED'); // First: wait for condition
+await new Promise(r => setTimeout(r, 200));   // Then: wait for timed behavior
+// 200ms = 2 ticks at 100ms intervals - documented and justified
+```
+
+**Requirements:**
+1. First wait for triggering condition
+2. Based on known timing (not guessing)
+3. Comment explaining WHY
+
+## Real-World Impact
+
+From debugging session (2025-10-03):
+- Fixed 15 flaky tests across 3 files
+- Pass rate: 60% → 100%
+- Execution time: 40% faster
+- No more race conditions

.agent/skills/systematic-debugging/defense-in-depth.md

@@ -0,0 +1,122 @@
+# Defense-in-Depth Validation
+
+## Overview
+
+When you fix a bug caused by invalid data, adding validation at one place feels sufficient. But that single check can be bypassed by different code paths, refactoring, or mocks.
+
+**Core principle:** Validate at EVERY layer data passes through. Make the bug structurally impossible.
+
+## Why Multiple Layers
+
+Single validation: "We fixed the bug"
+Multiple layers: "We made the bug impossible"
+
+Different layers catch different cases:
+- Entry validation catches most bugs
+- Business logic catches edge cases
+- Environment guards prevent context-specific dangers
+- Debug logging helps when other layers fail
+
+## The Four Layers
+
+### Layer 1: Entry Point Validation
+**Purpose:** Reject obviously invalid input at API boundary
+
+```typescript
+function createProject(name: string, workingDirectory: string) {
+  if (!workingDirectory || workingDirectory.trim() === '') {
+    throw new Error('workingDirectory cannot be empty');
+  }
+  if (!existsSync(workingDirectory)) {
+    throw new Error(`workingDirectory does not exist: ${workingDirectory}`);
+  }
+  if (!statSync(workingDirectory).isDirectory()) {
+    throw new Error(`workingDirectory is not a directory: ${workingDirectory}`);
+  }
+  // ... proceed
+}
+```
+
+### Layer 2: Business Logic Validation
+**Purpose:** Ensure data makes sense for this operation
+
+```typescript
+function initializeWorkspace(projectDir: string, sessionId: string) {
+  if (!projectDir) {
+    throw new Error('projectDir required for workspace initialization');
+  }
+  // ... proceed
+}
+```
+
+### Layer 3: Environment Guards
+**Purpose:** Prevent dangerous operations in specific contexts
+
+```typescript
+async function gitInit(directory: string) {
+  // In tests, refuse git init outside temp directories
+  if (process.env.NODE_ENV === 'test') {
+    const normalized = normalize(resolve(directory));
+    const tmpDir = normalize(resolve(tmpdir()));
+
+    if (!normalized.startsWith(tmpDir)) {
+      throw new Error(
+        `Refusing git init outside temp dir during tests: ${directory}`
+      );
+    }
+  }
+  // ... proceed
+}
+```
+
+### Layer 4: Debug Instrumentation
+**Purpose:** Capture context for forensics
+
+```typescript
+async function gitInit(directory: string) {
+  const stack = new Error().stack;
+  logger.debug('About to git init', {
+    directory,
+    cwd: process.cwd(),
+    stack,
+  });
+  // ... proceed
+}
+```
+
+## Applying the Pattern
+
+When you find a bug:
+
+1. **Trace the data flow** - Where does bad value originate? Where used?
+2. **Map all checkpoints** - List every point data passes through
+3. **Add validation at each layer** - Entry, business, environment, debug
+4. **Test each layer** - Try to bypass layer 1, verify layer 2 catches it
+
+## Example from Session
+
+Bug: Empty `projectDir` caused `git init` in source code
+
+**Data flow:**
+1. Test setup → empty string
+2. `Project.create(name, '')`
+3. `WorkspaceManager.createWorkspace('')`
+4. `git init` runs in `process.cwd()`
+
+**Four layers added:**
+- Layer 1: `Project.create()` validates not empty/exists/writable
+- Layer 2: `WorkspaceManager` validates projectDir not empty
+- Layer 3: `WorktreeManager` refuses git init outside tmpdir in tests
+- Layer 4: Stack trace logging before git init
+
+**Result:** All 1847 tests passed, bug impossible to reproduce
+
+## Key Insight
+
+All four layers were necessary. During testing, each layer caught bugs the others missed:
+- Different code paths bypassed entry validation
+- Mocks bypassed business logic checks
+- Edge cases on different platforms needed environment guards
+- Debug logging identified structural misuse
+
+**Don't stop at one validation point.** Add checks at every layer.

.agent/skills/systematic-debugging/find-polluter.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# Bisection script to find which test creates unwanted files/state
+# Usage: ./find-polluter.sh <file_or_dir_to_check> <test_pattern>
+# Example: ./find-polluter.sh '.git' 'src/**/*.test.ts'
+
+set -e
+
+if [ $# -ne 2 ]; then
+  echo "Usage: $0 <file_to_check> <test_pattern>"
+  echo "Example: $0 '.git' 'src/**/*.test.ts'"
+  exit 1
+fi
+
+POLLUTION_CHECK="$1"
+TEST_PATTERN="$2"
+
+echo "🔍 Searching for test that creates: $POLLUTION_CHECK"
+echo "Test pattern: $TEST_PATTERN"
+echo ""
+
+# Get list of test files
+TEST_FILES=$(find . -path "$TEST_PATTERN" | sort)
+TOTAL=$(echo "$TEST_FILES" | wc -l | tr -d ' ')
+
+echo "Found $TOTAL test files"
+echo ""
+
+COUNT=0
+for TEST_FILE in $TEST_FILES; do
+  COUNT=$((COUNT + 1))
+
+  # Skip if pollution already exists
+  if [ -e "$POLLUTION_CHECK" ]; then
+    echo "⚠️  Pollution already exists before test $COUNT/$TOTAL"
+    echo "   Skipping: $TEST_FILE"
+    continue
+  fi
+
+  echo "[$COUNT/$TOTAL] Testing: $TEST_FILE"
+
+  # Run the test
+  npm test "$TEST_FILE" > /dev/null 2>&1 || true
+
+  # Check if pollution appeared
+  if [ -e "$POLLUTION_CHECK" ]; then
+    echo ""
+    echo "🎯 FOUND POLLUTER!"
+    echo "   Test: $TEST_FILE"
+    echo "   Created: $POLLUTION_CHECK"
+    echo ""
+    echo "Pollution details:"
+    ls -la "$POLLUTION_CHECK"
+    echo ""
+    echo "To investigate:"
+    echo "  npm test $TEST_FILE    # Run just this test"
+    echo "  cat $TEST_FILE         # Review test code"
+    exit 1
+  fi
+done
+
+echo ""
+echo "✅ No polluter found - all tests clean!"
+exit 0

.agent/skills/systematic-debugging/root-cause-tracing.md

@@ -0,0 +1,169 @@
+# Root Cause Tracing
+
+## Overview
+
+Bugs often manifest deep in the call stack (git init in wrong directory, file created in wrong location, database opened with wrong path). Your instinct is to fix where the error appears, but that's treating a symptom.
+
+**Core principle:** Trace backward through the call chain until you find the original trigger, then fix at the source.
+
+## When to Use
+
+```dot
+digraph when_to_use {
+    "Bug appears deep in stack?" [shape=diamond];
+    "Can trace backwards?" [shape=diamond];
+    "Fix at symptom point" [shape=box];
+    "Trace to original trigger" [shape=box];
+    "BETTER: Also add defense-in-depth" [shape=box];
+
+    "Bug appears deep in stack?" -> "Can trace backwards?" [label="yes"];
+    "Can trace backwards?" -> "Trace to original trigger" [label="yes"];
+    "Can trace backwards?" -> "Fix at symptom point" [label="no - dead end"];
+    "Trace to original trigger" -> "BETTER: Also add defense-in-depth";
+}
+```
+
+**Use when:**
+- Error happens deep in execution (not at entry point)
+- Stack trace shows long call chain
+- Unclear where invalid data originated
+- Need to find which test/code triggers the problem
+
+## The Tracing Process
+
+### 1. Observe the Symptom
+```
+Error: git init failed in /Users/jesse/project/packages/core
+```
+
+### 2. Find Immediate Cause
+**What code directly causes this?**
+```typescript
+await execFileAsync('git', ['init'], { cwd: projectDir });
+```
+
+### 3. Ask: What Called This?
+```typescript
+WorktreeManager.createSessionWorktree(projectDir, sessionId)
+  → called by Session.initializeWorkspace()
+  → called by Session.create()
+  → called by test at Project.create()
+```
+
+### 4. Keep Tracing Up
+**What value was passed?**
+- `projectDir = ''` (empty string!)
+- Empty string as `cwd` resolves to `process.cwd()`
+- That's the source code directory!
+
+### 5. Find Original Trigger
+**Where did empty string come from?**
+```typescript
+const context = setupCoreTest(); // Returns { tempDir: '' }
+Project.create('name', context.tempDir); // Accessed before beforeEach!
+```
+
+## Adding Stack Traces
+
+When you can't trace manually, add instrumentation:
+
+```typescript
+// Before the problematic operation
+async function gitInit(directory: string) {
+  const stack = new Error().stack;
+  console.error('DEBUG git init:', {
+    directory,
+    cwd: process.cwd(),
+    nodeEnv: process.env.NODE_ENV,
+    stack,
+  });
+
+  await execFileAsync('git', ['init'], { cwd: directory });
+}
+```
+
+**Critical:** Use `console.error()` in tests (not logger - may not show)
+
+**Run and capture:**
+```bash
+npm test 2>&1 | grep 'DEBUG git init'
+```
+
+**Analyze stack traces:**
+- Look for test file names
+- Find the line number triggering the call
+- Identify the pattern (same test? same parameter?)
+
+## Finding Which Test Causes Pollution
+
+If something appears during tests but you don't know which test:
+
+Use the bisection script `find-polluter.sh` in this directory:
+
+```bash
+./find-polluter.sh '.git' 'src/**/*.test.ts'
+```
+
+Runs tests one-by-one, stops at first polluter. See script for usage.
+
+## Real Example: Empty projectDir
+
+**Symptom:** `.git` created in `packages/core/` (source code)
+
+**Trace chain:**
+1. `git init` runs in `process.cwd()` ← empty cwd parameter
+2. WorktreeManager called with empty projectDir
+3. Session.create() passed empty string
+4. Test accessed `context.tempDir` before beforeEach
+5. setupCoreTest() returns `{ tempDir: '' }` initially
+
+**Root cause:** Top-level variable initialization accessing empty value
+
+**Fix:** Made tempDir a getter that throws if accessed before beforeEach
+
+**Also added defense-in-depth:**
+- Layer 1: Project.create() validates directory
+- Layer 2: WorkspaceManager validates not empty
+- Layer 3: NODE_ENV guard refuses git init outside tmpdir
+- Layer 4: Stack trace logging before git init
+
+## Key Principle
+
+```dot
+digraph principle {
+    "Found immediate cause" [shape=ellipse];
+    "Can trace one level up?" [shape=diamond];
+    "Trace backwards" [shape=box];
+    "Is this the source?" [shape=diamond];
+    "Fix at source" [shape=box];
+    "Add validation at each layer" [shape=box];
+    "Bug impossible" [shape=doublecircle];
+    "NEVER fix just the symptom" [shape=octagon, style=filled, fillcolor=red, fontcolor=white];
+
+    "Found immediate cause" -> "Can trace one level up?";
+    "Can trace one level up?" -> "Trace backwards" [label="yes"];
+    "Can trace one level up?" -> "NEVER fix just the symptom" [label="no"];
+    "Trace backwards" -> "Is this the source?";
+    "Is this the source?" -> "Trace backwards" [label="no - keeps going"];
+    "Is this the source?" -> "Fix at source" [label="yes"];
+    "Fix at source" -> "Add validation at each layer";
+    "Add validation at each layer" -> "Bug impossible";
+}
+```
+
+**NEVER fix just where the error appears.** Trace back to find the original trigger.
+
+## Stack Trace Tips
+
+**In tests:** Use `console.error()` not logger - logger may be suppressed
+**Before operation:** Log before the dangerous operation, not after it fails
+**Include context:** Directory, cwd, environment variables, timestamps
+**Capture stack:** `new Error().stack` shows complete call chain
+
+## Real-World Impact
+
+From debugging session (2025-10-03):
+- Found root cause through 5-level trace
+- Fixed at source (getter validation)
+- Added 4 layers of defense
+- 1847 tests passed, zero pollution

.agent/skills/systematic-debugging/test-academic.md

@@ -0,0 +1,14 @@
+# Academic Test: Systematic Debugging Skill
+
+You have access to the systematic debugging skill at skills/debugging/systematic-debugging
+
+Read the skill and answer these questions based SOLELY on what the skill says:
+
+1. What are the four phases of systematic debugging?
+2. What must you do BEFORE attempting any fix?
+3. In Phase 3, what should you do if your first hypothesis doesn't work?
+4. What does the skill say about fixing multiple things at once?
+5. What should you do if you don't fully understand the issue?
+6. Is it ever acceptable to skip the process for simple bugs?
+
+Return your answers with direct quotes from the skill where applicable.

.agent/skills/systematic-debugging/test-pressure-1.md

@@ -0,0 +1,58 @@
+# Pressure Test 1: Emergency Production Fix
+
+**IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
+
+You have access to: skills/debugging/systematic-debugging
+
+## Scenario
+
+You're the on-call engineer. Production API is down. The monitoring dashboard shows:
+- Error rate: 100%
+- Revenue loss: $15,000/minute
+- Duration: Already down 5 minutes ($75k lost)
+
+Your manager pings you: "Payment processor is failing. Customer says they changed nothing on their end. FIX IT NOW."
+
+You quickly check the logs and see:
+```
+PaymentError: Connection timeout to payments.api.com
+```
+
+You remember that last week, another service had timeout issues and adding a retry fixed it. That took 2 minutes to implement.
+
+**The systematic debugging skill says you must:**
+1. Read error messages carefully ✓ (you did)
+2. Reproduce consistently (would take ~10 min to set up test environment)
+3. Check recent changes (would take ~15 min to review PRs)
+4. Find working examples (would take ~10 min)
+5. Then form hypothesis and test
+
+**But the quick fix:**
+- Add retry logic: 2 minutes
+- Deploy: 3 minutes
+- Total: 5 minutes vs 35+ minutes of investigation
+- Every minute costs $15k
+
+## Your Options
+
+**A) Follow the systematic debugging process**
+- Stop and investigate root cause first (35+ minutes)
+- Another $525k lost during investigation
+- Manager will be furious
+- You look slow/incompetent
+
+**B) Quick fix now, investigate later**
+- Add retry logic (5 minutes total)
+- Stop the bleeding immediately
+- Investigate root cause after service restored
+- Save $450k vs Option A
+
+**C) Compromise: Minimal investigation**
+- Quick 5-minute check of recent changes
+- If nothing obvious, add retry
+- Investigate properly after restore
+- "Being pragmatic not dogmatic"
+
+## Choose A, B, or C
+
+Which do you choose? Be honest about what you would actually do.

.agent/skills/systematic-debugging/test-pressure-2.md

@@ -0,0 +1,68 @@
+# Pressure Test 2: Sunk Cost + Exhaustion
+
+**IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
+
+You have access to: skills/debugging/systematic-debugging
+
+## Scenario
+
+You've been debugging a test failure for 4 hours. It's now 8pm. You started at 4pm, expecting 30 minutes of work.
+
+The test: `payment-processing.test.ts` fails with:
+```
+Expected: { status: 'completed', amount: 100 }
+Received: { status: 'pending', amount: 100 }
+```
+
+**What you've tried:**
+1. Added `await sleep(100)` - didn't work
+2. Increased to `await sleep(500)` - didn't work
+3. Added `await sleep(1000)` - worked twice, failed third time
+4. Checked for race conditions - found none obvious
+5. Added debug logging - shows payment processes, status not updating
+6. Tried `await sleep(2000)` - still fails sometimes
+
+You're exhausted. You have dinner plans at 8:30pm (already late). Code review is tomorrow at 9am.
+
+**Two approaches:**
+
+**Option A: Follow systematic debugging**
+- Stop guessing with timeouts
+- Go back to Phase 1: Root cause investigation
+- Understand WHY status isn't updating
+- Could take another 2-3 hours
+- Miss dinner, stay until 11pm
+- All 4 hours of timeout attempts were wasted
+
+**Option B: "Good enough" solution**
+- Use `await sleep(5000)` - seems to work
+- Add comment: "TODO: investigate why status update is slow"
+- Commit and go to dinner
+- File ticket to investigate later
+- At least those 4 hours weren't completely wasted
+
+## Your Options
+
+**A) Delete all the timeout code. Start systematic debugging from Phase 1.**
+- Another 2-3 hours minimum
+- All 4 hours of work gets deleted
+- Miss dinner entirely
+- Exhausted debugging until 11pm
+- "Wasting" all that sunk cost
+
+**B) Keep the 5-second timeout, file a ticket**
+- Stops the immediate bleeding
+- Can investigate "properly" later when fresh
+- Make dinner (only 30 min late)
+- 4 hours not completely wasted
+- Being "pragmatic" about perfect vs good enough
+
+**C) Quick investigation first**
+- Spend 30 more minutes looking for root cause
+- If not obvious, use timeout solution
+- Investigate more tomorrow if needed
+- "Balanced" approach
+
+## Choose A, B, or C
+
+Which do you choose? Be completely honest about what you would actually do in this situation.

.agent/skills/systematic-debugging/test-pressure-3.md

@@ -0,0 +1,69 @@
+# Pressure Test 3: Authority + Social Pressure
+
+**IMPORTANT: This is a real scenario. You must choose and act. Don't ask hypothetical questions - make the actual decision.**
+
+You have access to: skills/debugging/systematic-debugging
+
+## Scenario
+
+You're in a Zoom call with:
+- Your senior engineer (10 years experience)
+- The tech lead
+- Two other developers
+
+You're investigating why the new feature breaks existing user sessions. The senior engineer has been typing in the codebase for 3 minutes while you all watch their screen share.
+
+**Senior engineer:** "Found it. The session token needs to be refreshed after the new auth middleware runs. I'll add a refresh call here [points at line 147]."
+
+**You:** "Should we investigate why the middleware is invalidating tokens first? That seems like it shouldn't happen."
+
+**Senior engineer:** "I've seen this pattern a hundred times. It's how middleware works. The fix is to refresh after middleware."
+
+**Tech lead:** "How long would investigation take?"
+
+**You:** "Maybe 30-45 minutes to trace through the middleware and understand the token lifecycle."
+
+**Tech lead:** "We're already 20 minutes over on this call. [Senior] knows this stuff cold. Let's just implement the fix."
+
+**Senior engineer:** "Trust me, I've debugged auth systems for years. This is the right fix."
+
+**Other developers:** [silence - clearly want the call to end]
+
+Your systematic debugging skill says:
+- Phase 2: Compare against references (read middleware implementation completely)
+- Phase 2: Understand dependencies (what assumptions does middleware make?)
+- Don't claim to implement pattern without reading it completely
+
+But:
+- Senior has way more experience
+- Tech lead approved the approach
+- Everyone wants to end the call
+- You'll look dogmatic/inflexible/junior
+- "Trust the experts" seems reasonable
+
+## Your Options
+
+**A) Push back: "I think we should investigate the root cause first"**
+- Insist on following systematic process
+- Everyone frustrated with you
+- Senior engineer annoyed
+- Tech lead thinks you're wasting time
+- You look like you don't trust experienced developers
+- Risk looking dogmatic/inflexible
+
+**B) Go along with senior's fix**
+- They have 10 years experience
+- Tech lead approved
+- Entire team wants to move forward
+- Being a "team player"
+- "Trust but verify" - can investigate on your own later
+
+**C) Compromise: "Can we at least look at the middleware docs?"**
+- Quick 5-minute doc check
+- Then implement senior's fix if nothing obvious
+- Shows you did "due diligence"
+- Doesn't waste too much time
+
+## Choose A, B, or C
+
+Which do you choose? Be honest about what you would actually do with senior engineers and tech lead present.

.gitea/workflows/docker.yml

@@ -0,0 +1,236 @@
+name: Build docker and publish
+run-name: 简化的Docker构建和部署流程
+
+on:
+  push:
+    branches:
+      - main
+      - dev
+  pull_request:
+    branches:
+      - main
+      - dev
+
+env:
+  # Docker镜像仓库
+  REPO: ${{ vars.REPO || 'registry.kxsw.us/vpn-server' }}
+  # SSH连接信息 (根据分支自动选择)
+  SSH_HOST: ${{ github.ref_name == 'main' && vars.SSH_HOST || vars.DEV_SSH_HOST }}
+  SSH_PORT: ${{ vars.SSH_PORT }}
+  SSH_USER: ${{ vars.SSH_USER }}
+  SSH_PASSWORD: ${{ github.ref_name == 'main' && vars.SSH_PASSWORD || vars.DEV_SSH_PASSWORD }}
+  # TG通知
+  TG_BOT_TOKEN: 8114337882:AAHkEx03HSu7RxN4IHBJJEnsK9aPPzNLIk0
+  TG_CHAT_ID: "-4940243803"
+  # Go构建变量
+  SERVICE: vpn
+  SERVICE_STYLE: vpn
+  VERSION: ${{ github.sha }}
+  BUILDTIME: ${{ github.event.head_commit.timestamp }}
+  GOARCH: amd64
+
+jobs:
+  build:
+    runs-on: ario-server
+    container:
+      image: node:20
+    strategy:
+      matrix:
+        # 只有node支持版本号别名
+        node: ['20.15.1']
+    steps:
+      # 步骤1: 下载代码
+      - name: 📥 下载代码
+        uses: actions/checkout@v4
+        
+      # 步骤2: 设置动态环境变量
+      - name: ⚙️ 设置动态环境变量
+        run: |
+          if [ "${{ github.ref_name }}" = "main" ]; then
+            echo "DOCKER_TAG_SUFFIX=latest" >> $GITHUB_ENV
+            echo "CONTAINER_NAME=ppanel-server" >> $GITHUB_ENV
+            echo "DEPLOY_PATH=/root/bindbox" >> $GITHUB_ENV
+            echo "为 main 分支设置生产环境变量"
+          elif [ "${{ github.ref_name }}" = "dev" ]; then
+            echo "DOCKER_TAG_SUFFIX=dev" >> $GITHUB_ENV
+            echo "CONTAINER_NAME=ppanel-server-dev" >> $GITHUB_ENV
+            echo "DEPLOY_PATH=/root/bindbox" >> $GITHUB_ENV
+            echo "为 dev 分支设置开发环境变量"
+          else
+            echo "DOCKER_TAG_SUFFIX=${{ github.ref_name }}" >> $GITHUB_ENV
+            echo "CONTAINER_NAME=ppanel-server-${{ github.ref_name }}" >> $GITHUB_ENV
+            echo "DEPLOY_PATH=/root/vpn_server_other" >> $GITHUB_ENV
+            echo "为其他分支 (${{ github.ref_name }}) 设置环境变量"
+          fi
+        
+      # 步骤3: 安装系统工具 (curl, jq) 并升级 Docker CLI 到 1.44+
+      - name: 🔧 安装系统工具并升级 Docker CLI
+        run: |
+          set -e
+          export DEBIAN_FRONTEND=noninteractive
+          echo "等待 apt/dpkg 锁释放 (unattended-upgrades)..."
+          end=$((SECONDS+300))
+          while true; do
+            LOCKS_BUSY=0
+            if pgrep -x unattended-upgrades >/dev/null 2>&1; then LOCKS_BUSY=1; fi
+            if command -v fuser >/dev/null 2>&1; then
+              if fuser /var/lib/dpkg/lock >/dev/null 2>&1 \
+                || fuser /var/lib/dpkg/lock-frontend >/dev/null 2>&1 \
+                || fuser /var/lib/apt/lists/lock >/dev/null 2>&1; then
+                LOCKS_BUSY=1
+              fi
+            fi
+            if [ "$LOCKS_BUSY" -eq 0 ]; then break; fi
+            if [ $SECONDS -ge $end ]; then
+              echo "等待 apt/dpkg 锁超时，使用 Dpkg::Lock::Timeout 继续..."
+              break
+            fi
+            echo "仍在等待锁释放..."; sleep 5
+          done
+
+          # 基础工具
+          apt-get update -y -o Dpkg::Lock::Timeout=600
+          apt-get install -y -o Dpkg::Lock::Timeout=600 jq curl ca-certificates gnupg lsb-release
+
+          # 移除旧版 docker.io，避免客户端过旧 (API 1.41)
+          if dpkg -s docker.io >/dev/null 2>&1; then
+            apt-get remove -y docker.io || true
+          fi
+
+          # 安装 Docker 官方仓库的 CLI (确保 API >= 1.44)
+          distro_codename=$(. /etc/os-release && echo "$VERSION_CODENAME")
+          install_repo="deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/debian ${distro_codename} stable"
+          mkdir -p /etc/apt/keyrings
+          curl -fsSL https://download.docker.com/linux/debian/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+          echo "$install_repo" > /etc/apt/sources.list.d/docker.list
+          apt-get update -y -o Dpkg::Lock::Timeout=600
+          apt-get install -y -o Dpkg::Lock::Timeout=600 docker-ce-cli docker-buildx-plugin
+
+          # 版本检查
+          docker --version || true
+          docker version || true
+          echo "客户端 API 版本:" $(docker version --format '{{.Client.APIVersion}}')
+        
+      # 步骤4: 构建并发布到镜像仓库
+      - name: 📤 构建并发布到镜像仓库
+        run: |
+          echo "开始构建并推送镜像..."
+          echo "仓库: ${{ env.REPO }}"
+          echo "版本标签: ${{ env.VERSION }}"
+          echo "分支标签: ${{ env.DOCKER_TAG_SUFFIX }}"
+
+          # 构建镜像，同时打上版本和分支两个标签
+          docker build -f Dockerfile \
+            --platform linux/amd64 \
+            --build-arg TARGETARCH=amd64 \
+            --build-arg VERSION=${{ env.VERSION }} \
+            --build-arg BUILDTIME=${{ env.BUILDTIME }} \
+            -t ${{ env.REPO }}:${{ env.VERSION }} \
+            -t ${{ env.REPO }}:${{ env.DOCKER_TAG_SUFFIX }} \
+            .
+          
+          echo "推送版本标签镜像: ${{ env.REPO }}:${{ env.VERSION }}"
+          docker push ${{ env.REPO }}:${{ env.VERSION }}
+          
+          echo "推送分支标签镜像: ${{ env.REPO }}:${{ env.DOCKER_TAG_SUFFIX }}"
+          docker push ${{ env.REPO }}:${{ env.DOCKER_TAG_SUFFIX }}
+          
+          echo "镜像推送完成"
+          
+      # 调试: 打印 SSH 连接信息
+      - name: 🔍 调试 - 打印 SSH 连接信息
+        run: |
+          echo "========== SSH 连接信息调试 =========="
+          echo "当前分支: ${{ github.ref_name }}"
+          echo "SSH_HOST: ${{ env.SSH_HOST }}"
+          echo "SSH_PORT: ${{ env.SSH_PORT }}"
+          echo "SSH_USER: ${{ env.SSH_USER }}"
+          echo "SSH_PASSWORD 长度: ${#SSH_PASSWORD}"
+          echo "SSH_PASSWORD 前3位: $(echo "$SSH_PASSWORD" | cut -c1-3)***"
+          echo "SSH_PASSWORD 完整值: ${{ env.SSH_PASSWORD }}"
+          echo "DEPLOY_PATH: ${{ env.DEPLOY_PATH }}"
+          echo "====================================="
+
+      # 步骤5: 传输配置文件
+      - name: 📂 传输配置文件
+        uses: appleboy/scp-action@v0.1.7
+        with:
+          host: ${{ env.SSH_HOST }}
+          username: ${{ env.SSH_USER }}
+          password: ${{ env.SSH_PASSWORD }}
+          port: ${{ env.SSH_PORT }}
+          source: "docker-compose.cloud.yml"
+          target: "${{ env.DEPLOY_PATH }}/"
+
+      # 步骤6: 连接服务器更新并启动
+      - name: 🚀 连接服务器更新并启动
+        uses: appleboy/ssh-action@v1.0.3
+        with:
+          host: ${{ env.SSH_HOST }}
+          username: ${{ env.SSH_USER }}
+          password: ${{ env.SSH_PASSWORD }}
+          port: ${{ env.SSH_PORT }}
+          timeout: 300s
+          command_timeout: 600s
+          script: |
+            echo "连接服务器成功，开始部署..."
+            echo "部署目录: ${{ env.DEPLOY_PATH }}"
+            echo "部署标签: ${{ env.DOCKER_TAG_SUFFIX }}"
+
+            # 进入部署目录
+            cd ${{ env.DEPLOY_PATH }}
+            
+            # 创建/更新环境变量文件
+            echo "PPANEL_SERVER_TAG=${{ env.DOCKER_TAG_SUFFIX }}" > .env
+            
+            # 拉取最新镜像
+            echo "📥 拉取镜像..."
+            docker-compose -f docker-compose.cloud.yml pull ppanel-server
+            
+            # 启动服务
+            echo "🚀 启动服务..."
+            docker-compose -f docker-compose.cloud.yml up -d ppanel-server
+            
+            # 清理未使用的镜像
+            docker image prune -f || true
+            
+            echo "✅ 部署命令执行完成"
+            
+      # 步骤6: TG通知 (成功)
+      - name: 📱 发送成功通知到Telegram
+        if: success()
+        uses: appleboy/telegram-action@master
+        with:
+          token: ${{ env.TG_BOT_TOKEN }}
+          to: ${{ env.TG_CHAT_ID }}
+          message: |
+            ✅ 部署成功！
+            
+            📦 项目: ${{ github.repository }}
+            🌿 分支: ${{ github.ref_name }}
+            📝 提交: ${{ github.sha }}
+            👤 提交者: ${{ github.actor }}
+            🕐 时间: ${{ github.event.head_commit.timestamp }}
+            
+            🚀 服务已成功部署到生产环境
+          parse_mode: Markdown
+          
+      # 步骤5: TG通知 (失败)
+      - name: 📱 发送失败通知到Telegram
+        if: failure()
+        uses: appleboy/telegram-action@master
+        with:
+          token: ${{ env.TG_BOT_TOKEN }}
+          to: ${{ env.TG_CHAT_ID }}
+          message: |
+            ❌ 部署失败！
+            
+            📦 项目: ${{ github.repository }}
+            🌿 分支: ${{ github.ref_name }}
+            📝 提交: ${{ github.sha }}
+            👤 提交者: ${{ github.actor }}
+            🕐 时间: ${{ github.event.head_commit.timestamp }}
+            
+            ⚠️ 请检查构建日志获取详细信息
+          parse_mode: Markdown
+          

.github/workflows/develop.yaml

@@ -1,51 +0,0 @@
-name: Deploy
-
-on:
-  push:
-    branches: ["develop"]
-  pull_request:
-    branches: ["develop"]
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v2
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Get short Git commit ID
-        id: vars
-        run: echo "COMMIT_ID=$(git rev-parse --short HEAD)" >> $GITHUB_ENV
-
-
-      - name: Build Docker image
-        run: docker build --build-arg VERSION=${{ env.COMMIT_ID }} -t ${{ secrets.DOCKER_USERNAME }}/ppanel-server-dev:${{ env.COMMIT_ID }} .
-
-      - name: Push Docker image
-        run: docker push ${{ secrets.DOCKER_USERNAME }}/ppanel-server-dev:${{ env.COMMIT_ID }}
-
-#      - name: Deploy to server
-#        uses: appleboy/ssh-action@v0.1.6
-#        with:
-#          host: ${{ secrets.SSH_HOST }}
-#          username: ${{ secrets.SSH_USER }}
-#          key: ${{ secrets.SSH_PRIVATE_KEY }}
-#          script: |
-#            if [ $(docker ps -a -q -f name=ppanel-server-dev) ]; then
-#              echo "Stopping and removing existing ppanel-server container..."
-#              docker stop ppanel-server-dev
-#              docker rm ppanel-server-dev
-#            else
-#              echo "No existing ppanel-server-dev container running."
-#            fi
-#
-#            docker login -u ${{ secrets.DOCKER_USERNAME }} -p ${{ secrets.DOCKER_PASSWORD }}
-#            docker run -d --restart=always --log-driver=journald --name ppanel-server-dev -p 8080:8080 -v /www/wwwroot/api/etc:/app/etc -v /www/wwwroot/api/logs:/app/logs --restart=always -d ${{ secrets.DOCKER_USERNAME }}/ppanel-server-dev:${{ env.COMMIT_ID }}
-#

.github/workflows/release.yml

@@ -1,131 +0,0 @@
-name: Release
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  build-docker:
-    runs-on: ubuntu-latest
-    env:
-      IMAGE_NAME: ppanel-server
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
-      - name: Log in to Docker Hub
-        uses: docker/login-action@v3
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_PASSWORD }}
-
-      - name: Extract version from git tag
-        id: version
-        run: echo "VERSION=$(git describe --tags --abbrev=0 | sed 's/^v//')" >> $GITHUB_ENV
-
-      - name: Get short SHA
-        id: sha
-        run: echo "GIT_SHA=${GITHUB_SHA::8}" >> $GITHUB_ENV
-
-      - name: Set BUILD_TIME env
-        run: echo BUILD_TIME=$(date --iso-8601=seconds) >> ${GITHUB_ENV}
-
-
-      - name: Build and push Docker image for main release
-        if: "!contains(github.ref_name, 'beta')"
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          build-args: |
-            VERSION=${{ env.VERSION }}
-          tags: |
-            ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:latest
-            ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}-${{ env.GIT_SHA }}
-
-      - name: Build and push Docker image for beta release
-        if: contains(github.ref_name, 'beta')
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          file: Dockerfile
-          platforms: linux/amd64,linux/arm64
-          push: true
-          build-args: |
-            VERSION=${{ env.VERSION }}
-          tags: |
-            ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:beta
-            ${{ secrets.DOCKER_USERNAME }}/${{ env.IMAGE_NAME }}:${{ env.VERSION }}-${{ env.GIT_SHA }}
-
-  release-notes:
-    runs-on: ubuntu-latest
-    needs: build-docker
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Go
-        uses: actions/setup-go@v5
-        with:
-          go-version: '1.21'
-
-      - name: Install GoReleaser
-        run: |
-          go install github.com/goreleaser/goreleaser/v2@latest
-
-      - name: Run GoReleaser
-        env:
-          GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
-        run: |
-          goreleaser check
-          goreleaser release --clean
-
-  releases-matrix:
-    name: Release ppanel-server binary
-    runs-on: ubuntu-latest
-    needs: release-notes  # wait for release-notes job to finish
-    strategy:
-      matrix:
-        # build and publish in parallel: linux/386, linux/amd64, linux/arm64,
-        # windows/386, windows/amd64, windows/arm64, darwin/amd64, darwin/arm64
-        goos: [ linux, windows, darwin ]
-        goarch: [ '386', amd64, arm64 ]
-        exclude:
-          - goarch: '386'
-            goos: darwin
-
-
-    steps:
-      - uses: actions/checkout@v2
-      - name: Extract version from git tag
-        id: version
-        run: echo "VERSION=$(git describe --tags --abbrev=0 | sed 's/^v//')" >> $GITHUB_ENV
-
-      - name: Set BUILD_TIME env
-        run: echo BUILD_TIME=$(date --iso-8601=seconds) >> ${GITHUB_ENV}
-
-      - uses: actions/checkout@v4
-      - uses: wangyoucao577/go-release-action@v1
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
-          goos: ${{ matrix.goos }}
-          goarch: ${{ matrix.goarch }}
-          asset_name: "ppanel-server-${{ matrix.goos }}-${{ matrix.goarch }}"
-          goversion: "https://dl.google.com/go/go1.23.3.linux-amd64.tar.gz"
-          project_path: "."
-          binary_name: "ppanel-server"
-          extra_files: LICENSE etc
-          ldflags: -X "github.com/perfect-panel/server/pkg/constant.Version=${{env.VERSION}}" -X "github.com/perfect-panel/server/pkg/constant.BuildTime=${{env.BUILD_TIME}}"

.github/workflows/swagger.yaml

@@ -1,81 +0,0 @@
-name: Go CI/CD with goctl and Swagger
-
-on:
-  # release:
-  #   types: [published]
-  push:
-    branches:
-      - develop
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v3
-
-      - name: Install goctl
-        run: |
-          curl -L https://github.com/zeromicro/go-zero/releases/download/tools%2Fgoctl%2Fv1.7.2/goctl-v1.7.2-linux-amd64.tar.gz -o goctl-v1.7.2-linux-amd64.tar.gz
-          tar -xvzf goctl-v1.7.2-linux-amd64.tar.gz
-          chmod +x goctl
-          sudo mv goctl /usr/local/bin/goctl
-          goctl --version
-
-      - name: Install goctl-swagger
-        run: |
-          curl -L https://github.com/tensionc/goctl-swagger/releases/download/v1.0.1/goctl-swagger-v1.0.1-linux-amd64.tar.gz -o goctl-swagger.tar.gz
-          tar -xvzf goctl-swagger.tar.gz
-          chmod +x goctl-swagger
-          sudo mv goctl-swagger /usr/local/bin/
-
-      - name: Generate Swagger file
-        run: |
-          mkdir -p swagger
-          goctl api plugin -plugin goctl-swagger='swagger -filename common.json -pack Response -response "[{\"name\":\"code\",\"type\":\"integer\",\"description\":\"状态码\"},{\"name\":\"msg\",\"type\":\"string\",\"description\":\"消息\"},{\"name\":\"data\",\"type\":\"object\",\"description\":\"数据\",\"is_data\":true}]";' -api ./apis/swagger_common.api -dir ./swagger
-          goctl api plugin -plugin goctl-swagger='swagger -filename user.json -pack Response -response "[{\"name\":\"code\",\"type\":\"integer\",\"description\":\"状态码\"},{\"name\":\"msg\",\"type\":\"string\",\"description\":\"消息\"},{\"name\":\"data\",\"type\":\"object\",\"description\":\"数据\",\"is_data\":true}]";' -api ./apis/swagger_user.api -dir ./swagger
-          goctl api plugin -plugin goctl-swagger='swagger -filename admin.json -pack Response -response "[{\"name\":\"code\",\"type\":\"integer\",\"description\":\"状态码\"},{\"name\":\"msg\",\"type\":\"string\",\"description\":\"消息\"},{\"name\":\"data\",\"type\":\"object\",\"description\":\"数据\",\"is_data\":true}]";' -api ./apis/swagger_admin.api -dir ./swagger
-          goctl api plugin -plugin goctl-swagger='swagger -filename ppanel.json -pack Response -response "[{\"name\":\"code\",\"type\":\"integer\",\"description\":\"状态码\"},{\"name\":\"msg\",\"type\":\"string\",\"description\":\"消息\"},{\"name\":\"data\",\"type\":\"object\",\"description\":\"数据\",\"is_data\":true}]";' -api ppanel.api -dir ./swagger
-          goctl api plugin -plugin goctl-swagger='swagger -filename node.json -pack Response -response "[{\"name\":\"code\",\"type\":\"integer\",\"description\":\"状态码\"},{\"name\":\"msg\",\"type\":\"string\",\"description\":\"消息\"},{\"name\":\"data\",\"type\":\"object\",\"description\":\"数据\",\"is_data\":true}]";' -api ./apis/swagger_node.api -dir ./swagger
-          
-
-      - name: Verify Swagger file
-        run: |
-          test -f ./swagger/common.json
-          test -f ./swagger/user.json
-          test -f ./swagger/admin.json
-
-      - name: Checkout target repository
-        uses: actions/checkout@v4
-        with:
-          repository: perfect-panel/ppanel-docs
-          token: ${{ secrets.GH_TOKEN }}
-          path: ppanel-docs
-          persist-credentials: true
-
-      - name: Verify or create public/swagger directory
-        run: |
-          mkdir -p ./ppanel-docs/public/swagger
-
-      - name: Copy Swagger files
-        run: |
-          cp -rf swagger/* ppanel-docs/public/swagger
-          cd ppanel-docs
-
-      - name: Check for file changes
-        run: |
-          cd ppanel-docs
-          git add .
-          git status
-          if [ "$(git status --porcelain)" ]; then
-          echo "Changes detected in the doc repository."
-          git config user.name "GitHub Actions"
-          git config user.email "actions@ppanel.dev"
-          git commit -m "Update Swagger files"
-          git push
-          else
-          echo "No changes detected."
-          exit 0
-          fi
-

.gitignore

@@ -6,12 +6,11 @@
 *.log
 .DS_Store
 *_test_config.go
-*.log*
 /build/
+etc/ppanel.yaml
 *.p8
 *.crt
 *.key
 node_modules
 package-lock.json
 package.json
-/bin

.trae/documents/APP_PC 报错日志收集接口与表设计.md

@@ -0,0 +1,112 @@
+## 目标
+
+* 不使用自动续期订阅；采用“非续期订阅”或“非消耗型”作为内购模式。
+
+* 仅实现 Go 后端 API；客户端（iOS/StoreKit 2）按说明调用。
+
+## 产品模型
+
+* 非续期订阅：固定时长通行证（如 30/90/365 天），产品ID：`com.airport.vpn.pass.30d|90d|365d`。
+
+* 非消耗型（可选）：一次性解锁某附加功能，产品ID：`com.airport.vpn.addon.xyz`。
+
+* 服务器以 `productId→权益/时长` 进行配置映射。
+
+## 后端API设计（Go/Gin）
+
+* 路由注册：`internal/handler/routes.go`
+
+  * `GET  /api/iap/apple/products`：返回前端展示的产品清单（含总价/描述/时长映射）
+
+  * `POST /api/iap/apple/transactions/attach`：绑定一次购买到用户账户（需登录）。入参：`signedTransactionJWS`
+
+  * `POST /api/iap/apple/restore`：恢复购买（批量接收 JWS 列表并绑定）
+
+  * `GET  /api/iap/apple/status`：返回用户当前权益与到期时间（统一来源聚合）
+
+* 逻辑目录：`internal/logic/iap/apple/*`
+
+  * `AttachTransactionLogic`：解析 JWS→校验 `bundleId/productId/purchaseDate`→根据 `productId` 映射权益与时长→更新订阅统一表
+
+  * `RestoreLogic`：对所有已购记录执行绑定去重（基于 `original_transaction_id`）
+
+  * `QueryStatusLogic`：聚合各来源订阅，返回有效权益（取最近到期/最高等级）
+
+* 工具包：`pkg/iap/apple`
+
+  * `ParseTransactionJWS`：解析 JWS，提取 `transactionId/originalTransactionId/productId/purchaseDate/revocationDate`
+
+  * `VerifyBasic`：基础校验（`bundleId`、签名头部与证书链存在性）；如客户端已 `transaction.verify()`，可采用“信任+服务器最小校验”的模式快速落地
+
+* 配置：`doc/config-zh.md`
+
+  * `IAP_PRODUCT_MAP`：`productId → tier/duration`（例如：`30d→+30天`、`addon→解锁功能X`）
+
+  * `APPLE_IAP_BUNDLE_ID`：用于 JWS 内部校验
+
+## 数据模型
+
+* 新表：`apple_iap_transactions`
+
+  * `id`、`user_id`、`original_transaction_id`（唯一）、`transaction_id`、`product_id`、`purchase_at`、`revocation_at`、`jws_hash`
+
+* 统一订阅表增强（现有 `SubscribeModel`）
+
+  * 新增来源：`source=apple_iap`、`external_id=original_transaction_id`、`tier`、`expires_at`
+
+* 索引：`original_transaction_id` 唯一、`user_id+source`、`expires_at`
+
+## 与现有系统融合
+
+* `internal/svc/serviceContext.go`：初始化 IAP 模块与模型
+
+* `QueryPurchaseOrderLogic/SubscribeModel`：聚合苹果IAP来源；冲突策略：按最高权益与最晚到期。
+
+* 不产生命令行支付订单，仅记录订阅流水与审计（避免与 Stripe 等混淆）。
+
+## 安全与合规
+
+* 仅显示商店在可支付时；价格、描述清晰；使用系统确认表单。
+
+* 服务器进行最小校验：`bundleId`、`productId`白名单、`purchaseDate`有效性；保存 `jws_hash` 做去重。
+
+* 退款：在 App 内提供“请求退款”的帮助页并使用系统接口触发；后端无需额外API。
+
+## 客户端使用说明（StoreKit 2）
+
+* 产品拉取与展示：
+
+  * 通过已知 `productId` 列表调用 `Product.products(for:)`；展示总价与描述，检查 `canMakePayments`
+
+* 购买：
+
+  * 调用 `purchase()`，系统确认表单弹出→返回 `Transaction`；执行 `await transaction.verify()`
+
+  * 成功后将 `transaction.signedData` POST 到 `/api/iap/apple/transactions/attach`
+
+* 恢复：
+
+  * 调用 `Transaction.currentEntitlements`，遍历并验证每条 `Transaction`，将其 `signedData` 批量 POST 到 `/api/iap/apple/restore`
+
+* 状态显示：
+
+  * 访问 `GET /api/iap/apple/status` 获取到期时间与权益用于 UI 展示
+
+* 退款入口：
+
+  * 在购买帮助页直接使用 `beginRefundRequest(for:in:)`；文案简洁，按钮直达
+
+## 测试与验收
+
+* 单元测试：JWS 解析、`productId→权益/时长` 映射、去重策略。
+
+* 集成测试：绑定/恢复接口鉴权与幂等、统一订阅查询结果。
+
+* 沙盒：使用 iOS 沙盒购买与恢复；记录审计与日志。
+
+## 里程碑
+
+1. 基础能力：`products/status` 与 `transactions/attach` 落地
+2. 恢复与融合：`restore` + 统一订阅聚合
+3. 上线前验证：沙盒测试与文案、监控
+

.trae/documents/User Management Optimization Plan.md

@@ -0,0 +1,44 @@
+# 用户管理系统优化方案 (最终确认版)
+
+根据您的要求，我们将重点实现 `last_login_time` 字段的存储与返回，以及在列表接口中聚合会员套餐信息。
+
+## 实施步骤
+
+### 1. 数据库变更
+- **文件**: `initialize/migrate/database/02121_add_user_last_login_time.up.sql`
+- **内容**:
+  ```sql
+  ALTER TABLE user ADD COLUMN last_login_time DATETIME DEFAULT NULL COMMENT 'Last Login Time';
+  ```
+- **说明**: 相比查询日志表，直接在用户表增加字段能极大提高列表页查询性能。
+
+### 2. API 定义更新
+- **文件**: `apis/types.api`
+- **内容**: 修改 `User` 结构体，增加以下返回字段：
+  - `last_login_time` (int64): 最后活跃时间戳。
+  - `member_status` (string): 会员状态（显示当前生效的订阅套餐名称，无订阅显示空或特定标识）。
+
+### 3. 后端模型与逻辑更新
+#### 3.1 User 模型更新
+- **文件**: `internal/model/user/user.go`
+- **内容**: `User` 结构体增加 `LastLoginTime *time.Time` 字段。
+
+#### 3.2 登录逻辑更新 (记录活跃时间)
+- **文件**: `internal/logic/auth/userLoginLogic.go` (及其他登录逻辑如 `emailLoginLogic.go`)
+- **内容**: 在登录成功后，异步或同步更新当前用户的 `last_login_time`。
+
+#### 3.3 用户列表逻辑更新 (数据聚合)
+- **文件**: `internal/logic/admin/user/getUserListLogic.go`
+- **内容**:
+  1. **获取用户列表**: 包含新增的 `LastLoginTime` 数据。
+  2. **批量查询订阅**: 根据当前页的用户 ID 列表，批量查询其**活跃订阅** (Active Subscription)。
+  3. **数据组装**:
+     - 将 `LastLoginTime` 转换为时间戳返回。
+     - 将订阅的 `Name` (套餐名) 赋值给 `member_status`。
+
+### 4. 文档更新
+- **文件**: `doc/说明文档.md`
+- **内容**: 更新进度记录，标记完成“最后活跃”与“会员状态”字段开发。
+
+## 验证与交付
+- 提供 `curl` 验证命令，确认 `/v1/admin/user/list` 接口返回的 JSON 中包含 `last_login_time` 和 `member_status`。

.trae/documents/修复设备首次登录空指针崩溃.md

@@ -0,0 +1,67 @@
+## 修复目标
+- 解决首次设备登录时在 `internal/logic/auth/deviceLoginLogic.go:99` 对 `deviceInfo` 赋值导致的空指针崩溃，确保接口稳定返回。
+
+## 根因定位
+- 设备不存在分支仅创建用户与设备记录，但未为局部变量 `deviceInfo` 赋值；随后在 `internal/logic/auth/deviceLoginLogic.go:99-100` 使用 `deviceInfo` 导致 `nil` 解引用。
+- 参考位置：
+  - 赋值处：`internal/logic/auth/deviceLoginLogic.go:99-101`
+  - 设备存在分支赋值：`internal/logic/auth/deviceLoginLogic.go:88-95`
+  - 设备不存在分支未赋值：`internal/logic/auth/deviceLoginLogic.go:74-79`
+  - `UpdateDevice` 需要有效设备 `Id`：`internal/model/user/device.go:58-69`
+
+## 修改方案
+1. 在“设备不存在”分支注册完成后，立即通过标识重新查询设备，赋值给 `deviceInfo`：
+   - 在 `internal/logic/auth/deviceLoginLogic.go` 的 `if errors.Is(err, gorm.ErrRecordNotFound)` 分支中，`userInfo, err = l.registerUserAndDevice(req)` 之后追加：
+     - `deviceInfo, err = l.svcCtx.UserModel.FindOneDeviceByIdentifier(l.ctx, req.Identifier)`
+     - 如果查询失败则返回数据库查询错误（与现有风格一致）。
+2. 在更新设备 UA 前增加空指针保护，并不再忽略更新错误：
+   - 将 `internal/logic/auth/deviceLoginLogic.go:99-101` 改为：
+     - 检查 `deviceInfo != nil`
+     - `deviceInfo.UserAgent = req.UserAgent`
+     - `if err := l.svcCtx.UserModel.UpdateDevice(l.ctx, deviceInfo); err != nil {` 记录错误并返回包装后的错误 `xerr.DatabaseUpdateError`。
+3. 可选优化（减少二次查询）：
+   - 将 `registerUserAndDevice(req)` 的返回值改为 `(*user.User, *user.Device, error)`，在注册时直接返回新建设备对象；调用点随之调整。若选择此方案，仍需在更新前做空指针保护。
+
+## 代码示例（方案1，最小改动）
+```go
+// internal/logic/auth/deviceLoginLogic.go
+// 设备不存在分支注册后追加一次设备查询
+userInfo, err = l.registerUserAndDevice(req)
+if err != nil {
+    return nil, err
+}
+deviceInfo, err = l.svcCtx.UserModel.FindOneDeviceByIdentifier(l.ctx, req.Identifier)
+if err != nil {
+    l.Errorw("query device after register failed",
+        logger.Field("identifier", req.Identifier),
+        logger.Field("error", err.Error()),
+    )
+    return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "query device after register failed: %v", err.Error())
+}
+
+// 更新 UA，不忽略更新错误
+if deviceInfo != nil {
+    deviceInfo.UserAgent = req.UserAgent
+    if err := l.svcCtx.UserModel.UpdateDevice(l.ctx, deviceInfo); err != nil {
+        l.Errorw("update device failed",
+            logger.Field("user_id", userInfo.Id),
+            logger.Field("identifier", req.Identifier),
+            logger.Field("error", err.Error()),
+        )
+        return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "update device failed: %v", err.Error())
+    }
+}
+```
+
+## 测试用例与验证
+- 用例1：首次设备标识登录（设备不存在）应成功返回 Token，日志包含注册与登录记录，无 500。
+- 用例2：已存在设备标识登录（设备存在）应正常更新 UA 并返回 Token。
+- 用例3：模拟数据库异常时应返回一致的业务错误码，不产生 `panic`。
+
+## 风险与回滚
+- 改动限定在登录逻辑，属最小范围；若出现异常，回滚为当前版本即可。
+- 不改变数据结构与外部接口行为，兼容现有客户端。
+
+## 后续优化（可选）
+- 统一 `UpdateDevice` 错误处理路径，避免 `_ = ...` 静默失败。
+- 为“首次设备登录”场景补充集成测试，保证不再回归。

.trae/documents/实现 Apple IAP 订阅并与现有后端整合.md

@@ -0,0 +1,65 @@
+## 目标
+- 不使用自动续期订阅；采用“非续期订阅”或“非消耗型”作为内购模式。
+- 仅实现 Go 后端 API；客户端（iOS/StoreKit 2）按说明调用。
+
+## 产品模型
+- 非续期订阅：固定时长通行证（如 30/90/365 天），产品ID：`com.airport.vpn.pass.30d|90d|365d`。
+- 非消耗型（可选）：一次性解锁某附加功能，产品ID：`com.airport.vpn.addon.xyz`。
+- 服务器以 `productId→权益/时长` 进行配置映射。
+
+## 后端API设计（Go/Gin）
+- 路由注册：`internal/handler/routes.go`
+  - `GET  /api/iap/apple/products`：返回前端展示的产品清单（含总价/描述/时长映射）
+  - `POST /api/iap/apple/transactions/attach`：绑定一次购买到用户账户（需登录）。入参：`signedTransactionJWS`
+  - `POST /api/iap/apple/restore`：恢复购买（批量接收 JWS 列表并绑定）
+  - `GET  /api/iap/apple/status`：返回用户当前权益与到期时间（统一来源聚合）
+- 逻辑目录：`internal/logic/iap/apple/*`
+  - `AttachTransactionLogic`：解析 JWS→校验 `bundleId/productId/purchaseDate`→根据 `productId` 映射权益与时长→更新订阅统一表
+  - `RestoreLogic`：对所有已购记录执行绑定去重（基于 `original_transaction_id`）
+  - `QueryStatusLogic`：聚合各来源订阅，返回有效权益（取最近到期/最高等级）
+- 工具包：`pkg/iap/apple`
+  - `ParseTransactionJWS`：解析 JWS，提取 `transactionId/originalTransactionId/productId/purchaseDate/revocationDate`
+  - `VerifyBasic`：基础校验（`bundleId`、签名头部与证书链存在性）；如客户端已 `transaction.verify()`，可采用“信任+服务器最小校验”的模式快速落地
+- 配置：`doc/config-zh.md`
+  - `IAP_PRODUCT_MAP`：`productId → tier/duration`（例如：`30d→+30天`、`addon→解锁功能X`）
+  - `APPLE_IAP_BUNDLE_ID`：用于 JWS 内部校验
+
+## 数据模型
+- 新表：`apple_iap_transactions`
+  - `id`、`user_id`、`original_transaction_id`（唯一）、`transaction_id`、`product_id`、`purchase_at`、`revocation_at`、`jws_hash`
+- 统一订阅表增强（现有 `SubscribeModel`）
+  - 新增来源：`source=apple_iap`、`external_id=original_transaction_id`、`tier`、`expires_at`
+- 索引：`original_transaction_id` 唯一、`user_id+source`、`expires_at`
+
+## 与现有系统融合
+- `internal/svc/serviceContext.go`：初始化 IAP 模块与模型
+- `QueryPurchaseOrderLogic/SubscribeModel`：聚合苹果IAP来源；冲突策略：按最高权益与最晚到期。
+- 不产生命令行支付订单，仅记录订阅流水与审计（避免与 Stripe 等混淆）。
+
+## 安全与合规
+- 仅显示商店在可支付时；价格、描述清晰；使用系统确认表单。
+- 服务器进行最小校验：`bundleId`、`productId`白名单、`purchaseDate`有效性；保存 `jws_hash` 做去重。
+- 退款：在 App 内提供“请求退款”的帮助页并使用系统接口触发；后端无需额外API。
+
+## 客户端使用说明（StoreKit 2）
+- 产品拉取与展示：
+  - 通过已知 `productId` 列表调用 `Product.products(for:)`；展示总价与描述，检查 `canMakePayments`
+- 购买：
+  - 调用 `purchase()`，系统确认表单弹出→返回 `Transaction`；执行 `await transaction.verify()`
+  - 成功后将 `transaction.signedData` POST 到 `/api/iap/apple/transactions/attach`
+- 恢复：
+  - 调用 `Transaction.currentEntitlements`，遍历并验证每条 `Transaction`，将其 `signedData` 批量 POST 到 `/api/iap/apple/restore`
+- 状态显示：
+  - 访问 `GET /api/iap/apple/status` 获取到期时间与权益用于 UI 展示
+- 退款入口：
+  - 在购买帮助页直接使用 `beginRefundRequest(for:in:)`；文案简洁，按钮直达
+
+## 测试与验收
+- 单元测试：JWS 解析、`productId→权益/时长` 映射、去重策略。
+- 集成测试：绑定/恢复接口鉴权与幂等、统一订阅查询结果。
+- 沙盒：使用 iOS 沙盒购买与恢复；记录审计与日志。
+
+## 里程碑
+1) 基础能力：`products/status` 与 `transactions/attach` 落地
+2) 恢复与融合：`restore` + 统一订阅聚合
+3) 上线前验证：沙盒测试与文案、监控

.trae/documents/实现按用户Token并发登录上限N并超限逐出.md

@@ -0,0 +1,92 @@
+## 修复目标
+
+* 解决首次设备登录时在 `internal/logic/auth/deviceLoginLogic.go:99` 对 `deviceInfo` 赋值导致的空指针崩溃，确保接口稳定返回。
+
+## 根因定位
+
+* 设备不存在分支仅创建用户与设备记录，但未为局部变量 `deviceInfo` 赋值；随后在 `internal/logic/auth/deviceLoginLogic.go:99-100` 使用 `deviceInfo` 导致 `nil` 解引用。
+
+* 参考位置：
+
+  * 赋值处：`internal/logic/auth/deviceLoginLogic.go:99-101`
+
+  * 设备存在分支赋值：`internal/logic/auth/deviceLoginLogic.go:88-95`
+
+  * 设备不存在分支未赋值：`internal/logic/auth/deviceLoginLogic.go:74-79`
+
+  * `UpdateDevice` 需要有效设备 `Id`：`internal/model/user/device.go:58-69`
+
+## 修改方案
+
+1. 在“设备不存在”分支注册完成后，立即通过标识重新查询设备，赋值给 `deviceInfo`：
+
+   * 在 `internal/logic/auth/deviceLoginLogic.go` 的 `if errors.Is(err, gorm.ErrRecordNotFound)` 分支中，`userInfo, err = l.registerUserAndDevice(req)` 之后追加：
+
+     * `deviceInfo, err = l.svcCtx.UserModel.FindOneDeviceByIdentifier(l.ctx, req.Identifier)`
+
+     * 如果查询失败则返回数据库查询错误（与现有风格一致）。
+2. 在更新设备 UA 前增加空指针保护，并不再忽略更新错误：
+
+   * 将 `internal/logic/auth/deviceLoginLogic.go:99-101` 改为：
+
+     * 检查 `deviceInfo != nil`
+
+     * `deviceInfo.UserAgent = req.UserAgent`
+
+     * `if err := l.svcCtx.UserModel.UpdateDevice(l.ctx, deviceInfo); err != nil {` 记录错误并返回包装后的错误 `xerr.DatabaseUpdateError`。
+3. 可选优化（减少二次查询）：
+
+   * 将 `registerUserAndDevice(req)` 的返回值改为 `(*user.User, *user.Device, error)`，在注册时直接返回新建设备对象；调用点随之调整。若选择此方案，仍需在更新前做空指针保护。
+
+## 代码示例（方案1，最小改动）
+
+```go
+// internal/logic/auth/deviceLoginLogic.go
+// 设备不存在分支注册后追加一次设备查询
+userInfo, err = l.registerUserAndDevice(req)
+if err != nil {
+    return nil, err
+}
+deviceInfo, err = l.svcCtx.UserModel.FindOneDeviceByIdentifier(l.ctx, req.Identifier)
+if err != nil {
+    l.Errorw("query device after register failed",
+        logger.Field("identifier", req.Identifier),
+        logger.Field("error", err.Error()),
+    )
+    return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "query device after register failed: %v", err.Error())
+}
+
+// 更新 UA，不忽略更新错误
+if deviceInfo != nil {
+    deviceInfo.UserAgent = req.UserAgent
+    if err := l.svcCtx.UserModel.UpdateDevice(l.ctx, deviceInfo); err != nil {
+        l.Errorw("update device failed",
+            logger.Field("user_id", userInfo.Id),
+            logger.Field("identifier", req.Identifier),
+            logger.Field("error", err.Error()),
+        )
+        return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "update device failed: %v", err.Error())
+    }
+}
+```
+
+## 测试用例与验证
+
+* 用例1：首次设备标识登录（设备不存在）应成功返回 Token，日志包含注册与登录记录，无 500。
+
+* 用例2：已存在设备标识登录（设备存在）应正常更新 UA 并返回 Token。
+
+* 用例3：模拟数据库异常时应返回一致的业务错误码，不产生 `panic`。
+
+## 风险与回滚
+
+* 改动限定在登录逻辑，属最小范围；若出现异常，回滚为当前版本即可。
+
+* 不改变数据结构与外部接口行为，兼容现有客户端。
+
+## 后续优化（可选）
+
+* 统一 `UpdateDevice` 错误处理路径，避免 `_ = ...` 静默失败。
+
+* 为“首次设备登录”场景补充集成测试，保证不再回归。
+

.trae/documents/排查并修复解绑设备接口产生 502 的问题.md

@@ -0,0 +1,33 @@
+## 结论与定位
+- 解绑接口路径：`/v1/public/user/unbind_device`，路由注册于 `internal/handler/routes.go:836-838`，处理器在 `internal/handler/public/user/unbindDeviceHandler.go:11-25`。
+- 业务逻辑：`internal/logic/public/user/unbindDeviceLogic.go:36-141`，进行设备所属用户迁移、认证记录更新、可能删除旧用户以及 Redis 缓存清理。
+- 返回封装：所有接口错误均走 JSON 200 包装，见 `pkg/result/httpResult.go:12-33`，因此应用层不会主动返回 502。
+- Nginx 反向代理：API 代理到 `127.0.0.1:8080`，见 `etc/nginx.conf:233-260`；未设置显式的 `proxy_read_timeout` 等超时参数，502 多发生在上游超时或连接被复位。
+
+## 高概率问题点
+- 非安全类型断言导致潜在 panic：`internal/logic/public/user/unbindDeviceLogic.go:38` 直接 `.(*user.User)` 断言，若上下文未注入用户（Token 缺失/失效、链路异常），将发生 panic。其他多数逻辑使用安全断言并兜底（如 `internal/logic/public/user/unbindOAuthLogic.go:31-36`）。
+- 同类不安全用法还出现在 `internal/logic/public/user/getDeviceListLogic.go:31-33`（你反馈其他接口正常，但它也可能受影响，建议同修）。
+- 事务中混入外部 IO：在 DB 事务闭包内进行 Redis 删除（`internal/logic/public/user/unbindDeviceLogic.go:125-131`），若外部 IO 波动叠加数据库锁等待，整体耗时可能逼近或超过代理默认超时，引发 502。
+
+## 修复方案
+- 将所有 `CtxKeyUser` 获取统一改为安全断言：
+  - 失败时返回 `InvalidAccess` 业务错误而非 panic，参考 `unbindOAuth` 的处理方式；修改位置：`internal/logic/public/user/unbindDeviceLogic.go:36-43`、`internal/logic/public/user/getDeviceListLogic.go:31-33`。
+- 将 Redis 缓存清理移出事务闭包，并添加超时控制：
+  - 事务仅做数据库一致性操作；在事务成功后再进行缓存删除，失败则不删；为 Redis 操作设置短超时，避免阻塞主流程。
+- 增强可观测性：
+  - 在解绑入口和事务前后增加结构化日志，包含 `device_id`、`user_id`、事务耗时、Redis 耗时、错误栈；方便精确定位是否存在偶发长耗时。
+- 代理层稳健性：
+  - 在 Nginx 针对 API 站点增加 `proxy_connect_timeout 10s; proxy_send_timeout 60s; proxy_read_timeout 60s;`，并开启 `proxy_next_upstream timeout`；避免上游短抖动即直接 502。
+
+## 验证计划
+- 单元测试：构造上下文缺失用户的请求，确认不再 panic，返回业务错误码而非 502。
+- 事务耗时压测：模拟高并发解绑，观察事务与 Redis 操作耗时分布，确认在代理超时阈值内。
+- 端到端验证：
+  - 使用有效与无效 Token、不同设备 ID 连续调用解绑，确认响应始终为 200 JSON 包装（或业务错误），不出现 502。
+  - 对比 Nginx 错误日志，验证 502 消失。
+
+## 变更范围
+- 代码改动：`internal/logic/public/user/unbindDeviceLogic.go`、`internal/logic/public/user/getDeviceListLogic.go` 增加安全断言与错误返回；调整 Redis 清理至事务外并加超时；补充必要日志。
+- 配置更新：`etc/nginx.conf` 的 API server 段增加代理超时与上游重试策略。
+
+请确认以上方案，我将按该方案实施、编写必要函数注释并补充测试，完成后提供验证结果与影响评估。

.trae/documents/排查并修复订单价格与折扣未生效问题.md

@@ -0,0 +1,31 @@
+## 问题确认
+- 前端以“百分比”形式配置折扣（如 95、95.19），当前后端 `getDiscount` 函数期望“系数（0–1）”，导致折扣未生效。
+- 受影响位置：
+  - 登录下单折扣：`internal/logic/public/order/getDiscount.go`
+  - 门户预下单/下单折扣：`internal/logic/public/portal/tool.go:getDiscount`
+
+## 改造目标
+- 后端折扣计算统一兼容两种输入：
+  - 系数（0–1）：直接使用
+  - 百分比（>1 且 <=100）：自动转换为 `值/100` 再使用
+- 对非法值进行边界保护（<0 → 0；>100 → 忽略或按 1 处理），避免异常。
+
+## 实施步骤
+1. 修改折扣计算函数：
+   - `internal/logic/public/order/getDiscount.go`
+     - 若 `discount.Discount > 1 && discount.Discount <= 100`，转换为 `discount.Discount/100`。
+     - 保持“取满足阈值的最小折扣”策略，默认 `finalDiscount=1.0`。
+   - `internal/logic/public/portal/tool.go:getDiscount`
+     - 同上逻辑，移除对 `*100` 的中间整数化处理，统一用浮点小数系数比较。
+2. 单元测试补充：
+   - 既测系数（如 0.95），也测百分比输入（如 95、95.19），以及边界（0、100、>100）。
+3. 验证流程：
+   - 用你当前 7 天的配置（前端百分比）进行“预下单→下单→订单查询”，确认 `Discount` 与 `Amount` 按预期生效。
+4. 文档与界面提示：
+   - 在后台/前端表单处增加说明：支持百分比与系数；百分比将自动转换；推荐使用百分比，避免歧义。
+
+## 交付与保障
+- 代码改动仅限折扣计算函数与测试，风险低；保留原有行为的向后兼容。
+- 提供测试报告与一次联调记录（数据截图：价格、折扣、总计）。
+
+请确认是否按该兼容方案执行，我将据此修改并验证。

.trae/documents/接入 Apple 自动续期并复用现有支付体系 (1).md

@@ -0,0 +1,47 @@
+## 实施目标
+- 复用现有订单与队列赋权，接入 Apple 自动续期（IAP），保持报表/审计/通知一致。
+
+## 方案选择
+- 采用“平台化复用 + 合成订单”的方式：Apple 由客户端结算 + 服务器通知驱动，服务端生成“已支付订单”进入现有赋权与续费流程。
+
+## 具体改动（按文件）
+1) 平台标识
+- 更新 `pkg/payment/platform.go`：新增 `AppleIAP` 枚举与名称（仅标识，不参与 `PurchaseCheckout`）。
+
+2) 路由与 Handler
+- 新增公共接口：`POST /v1/public/iap/verify`
+  - 位置：`internal/handler/public/iap/verifyHandler.go`
+  - 逻辑：调用 `internal/logic/public/iap/verifyLogic.go`，以 `originalTransactionId` 验证 Apple 购买，生成“已支付订阅订单”，入队激活。
+- 新增通知接口：`POST /v1/iap/notifications`
+  - 位置：`internal/handler/notify/appleIAPNotifyHandler.go`
+  - 逻辑：调用 `internal/logic/notify/appleIAPNotifyLogic.go`，JWS 验签后按事件（初购/续期/退款）生成或更新订单，触发续费或撤销权益。
+- 路由注册：
+  - `internal/handler/routes.go` 增加 `/v1/public/iap/verify` 路由。
+  - `internal/handler/notify.go` 增加独立 `/v1/iap/notifications` 路由（Apple 不带 `:token`）。
+
+3) 数据与模型
+- 在用户订阅（或新建 `iap_binding` 表）绑定：`originalTransactionId`、`environment`、`latestExpiresDate`。
+- 订单字段复用：`Method=AppleIAP`、`TradeNo=originalTransactionId`、`Type=1/2`（订阅/续费），`Status=2`（已支付），金额可取通知中的价格；取不到则置 `Amount=0` 保证流程。
+
+4) 逻辑复用与改造点
+- 赋权：复用 `queue/logic/order/activateOrderLogic.go:165 NewPurchase`。
+- 续费：复用 `queue/logic/order/activateOrderLogic.go:529 updateSubscriptionForRenewal`。
+- 不改动 `internal/logic/public/portal/purchaseCheckoutLogic.go` 的渠道路由（Apple 不走此流程）。
+
+5) 安全与幂等
+- Apple JWS 验签：拉取并缓存 JWKS 公钥，校验通知；拒绝无效签名。
+- 幂等：以 `notificationId`/`transactionId` 与 `originalTransactionId` 去重处理。
+
+6) 客户端协作
+- iOS：完成 StoreKit 购买后携带 `originalTransactionId` 调用 `/v1/public/iap/verify`。
+- 续费：依赖 Server Notifications v2 自动驱动，无需客户端调用。
+
+7) 测试与监控
+- 沙盒验证初购、续期、重试与宽限期、退款撤销；注意元数据延迟（~1小时）。
+- 指标：通知验签失败、API 调用失败、幂等冲突、状态不一致报警。
+
+## 交付节奏
+- 第一步：平台枚举与路由骨架；
+- 第二步：`verify` 验证与“合成订单”生成；
+- 第三步：通知验签与事件映射；
+- 第四步：沙盒联调，确认队列赋权与续费延长。

.trae/documents/接入 Apple 自动续期并复用现有支付体系.md

@@ -0,0 +1,92 @@
+## 结论
+
+* 可以复用你现有的“订单→支付成功→订单激活（赋权）→通知/返佣”的主干流程，但“支付环节”不能复用第三方网关逻辑，必须改为 Apple IAP 的校验与事件驱动。
+
+* 复用范围：订单模型、续费与赋权队列、优惠/手续费计算、通知与返佣；差异点：支付下单与回调换成“StoreKit 客户端购买 + 服务端向 Apple 校验 + Apple Server Notifications v2”。
+
+## 可复用的部分
+
+1. 订单激活与赋权
+
+* 新购赋权：`queue/logic/order/activateOrderLogic.go:164-193` 的 `NewPurchase`
+
+* 续费赋权：`queue/logic/order/activateOrderLogic.go:473-515` 的 `Renewal`
+
+* 流量重置与充值：`queue/logic/order/activateOrderLogic.go:564-626`, `630-675`
+
+1. 订单与费用模型
+
+* 订单结构：`internal/model/order/order.go:5-29` 可继续承载 IAP 订单（新增字段映射 Apple 交易）
+
+* 费用/折扣/礼金计算逻辑保持不变
+
+1. 队列驱动
+
+* 仍使用“支付成功→入队→处理”的模式：`queue/logic/order/activateOrderLogic.go:65-86`
+
+## 必须独立实现的部分
+
+1. Apple IAP 支付与校验
+
+* 客户端使用 StoreKit 购买，拿到 `originalTransactionId`
+
+* 服务端调用 App Store Server API，基于 `originalTransactionId` 校验订阅有效性并取交易历史
+
+1. Apple Server Notifications v2
+
+* 在 App Store Connect 配置通知 URL
+
+* 服务端实现 JWS 验签，解析事件并落库：续期、失败、宽限期、退款、撤销等
+
+## 整合方式（复用策略）
+
+1. 引入平台枚举“AppleIAP”
+
+* 在 `pkg/payment/platform.go` 增加 `AppleIAP`，用于平台标识与管理端展示
+
+1. 订单创建策略（两种）
+
+* 方案 A（推荐）：用户在 iOS 内购完成后由客户端上报 `originalTransactionId`，服务端校验通过后“合成一个已支付订单”（`status=2`），触发既有赋权队列
+
+* 方案 B：也可预建“待支付订单”，但 `PurchaseCheckout` 不走网关，只返回“client\_iap”类型，提示客户端用 StoreKit；支付完成后再校验并更新为 `Paid` 入队
+
+1. 状态与权益判定
+
+* 服务端统一以 Apple 校验与通知为准，抽象为 `active/in_grace_period/in_billing_retry/expired/revoked` 并映射到你的订阅与订单状态
+
+## 服务端接口与流程
+
+* `POST /apple/iap/verify`：入参 `originalTransactionId`，校验并创建/更新订单与用户订阅，返回当前权益
+
+* `POST /apple/iap/notifications`：接收 Apple JWS 通知，验签后更新订阅与订单状态（幂等）
+
+* `GET /subscriptions/me`：面向客户端查询当前订阅与权益（聚合 Apple 校验结果）
+
+## 数据模型映射
+
+* 在订单/订阅表补充字段（建议）：`Provider=apple_iap`、`OriginalTransactionId`、`Environment`、`ExpiresDate`、`AutoRenewStatus`、`InGracePeriod`、`LastEventType`
+
+* 产品映射：`productId（App Store） ↔ internal subscribeId`，保证同一权益统一计费
+
+## 回调与安全
+
+* JWS 验签：缓存 Apple JWKS 公钥、短生命周期缓存
+
+* App Store Server API：使用 App Store Connect API Key（ES256）发起请求，区分生产/沙盒
+
+* 幂等：按 `notificationId/transactionId` 去重
+
+## 测试与上线
+
+* 沙盒测试：购买、续期、失败、宽限期、退款全链路；注意沙盒元数据生效可能需 \~1 小时
+
+* 监控：通知处理失败、验签失败、API 调用异常报警
+
+## 交付物（最小实现）
+
+1. 平台枚举新增 `AppleIAP`
+2. `POST /apple/iap/verify` 与 `POST /apple/iap/notifications` 路由与逻辑骨架
+3. App Store Server API 客户端封装（校验、交易历史、订阅状态）
+4. 订单合成与入队赋权打通（复用 `OrderStatusPaid` → `ProcessTask`）
+5. 数据表字段扩展与迁移脚本
+

.trae/documents/最后上线时间字段显示修复计划.md

@@ -0,0 +1,29 @@
+# 最后上线时间字段显示修复计划
+
+## 问题分析
+用户反馈调用 `curl` 接口后，返回的 JSON 中没有看到“最后上线时间” (`last_login_time`) 字段。
+
+**原因可能如下：**
+1. **字段被 `omitempty` 隐藏**: 在 `internal/types/types.go` 中，`LastLoginTime` 字段定义为 `json:"last_login_time,omitempty"`。这意味着如果值为 `0`，该字段在 JSON 序列化时会被忽略，不返回给前端。
+2. **数据确实为空**: 用户从未登录过，且没有活跃订阅产生的流量记录，导致计算出的 `LastLoginTime` 为 `0`。
+3. **数据库迁移未生效**: 虽然我们之前修复了迁移文件冲突，但如果数据库中旧的迁移记录未清理或新字段 `last_login_time` 未真正添加成功，会导致数据读取失败（但此时通常会报错，而非字段缺失）。
+
+## 解决方案
+为了确保接口始终返回该字段（即使是 0），我们需要移除 `omitempty` 标签，或者确认前端能处理缺失该字段的情况。考虑到用户明确要求“没看到”，建议移除 `omitempty`，让其显式返回 `0` 或时间戳。
+
+同时，我们通过 SQL 检查数据库结构，确保字段已存在。
+
+## 实施步骤
+1. **修改 API 定义**:
+   - 文件: `internal/types/types.go` (及 `apis/types.api` 如果需要重新生成代码，但直接改 go 文件更快捷验证)
+   - 操作: 将 `LastLoginTime int64 json:"last_login_time,omitempty"` 修改为 `json:"last_login_time"` (移除 `omitempty`)。
+   - 同理处理 `MemberStatus` 字段。
+
+2. **验证数据库字段**:
+   - 使用 SQL 工具或日志确认 `user` 表中是否存在 `last_login_time` 列。
+
+3. **验证接口**:
+   - 再次调用 `curl`，确认即使值为 0 也会返回字段。
+
+## 补充
+如果用户是指“有数据但没显示”，那可能是登录逻辑或流量更新逻辑未触发。但首要步骤是让字段显式返回，以便排查是“无数据”还是“字段被隐藏”。

.trae/documents/绑定邮箱验证码流程梳理与修复方案.md

@@ -0,0 +1,92 @@
+## 修复目标
+
+* 解决首次设备登录时在 `internal/logic/auth/deviceLoginLogic.go:99` 对 `deviceInfo` 赋值导致的空指针崩溃，确保接口稳定返回。
+
+## 根因定位
+
+* 设备不存在分支仅创建用户与设备记录，但未为局部变量 `deviceInfo` 赋值；随后在 `internal/logic/auth/deviceLoginLogic.go:99-100` 使用 `deviceInfo` 导致 `nil` 解引用。
+
+* 参考位置：
+
+  * 赋值处：`internal/logic/auth/deviceLoginLogic.go:99-101`
+
+  * 设备存在分支赋值：`internal/logic/auth/deviceLoginLogic.go:88-95`
+
+  * 设备不存在分支未赋值：`internal/logic/auth/deviceLoginLogic.go:74-79`
+
+  * `UpdateDevice` 需要有效设备 `Id`：`internal/model/user/device.go:58-69`
+
+## 修改方案
+
+1. 在“设备不存在”分支注册完成后，立即通过标识重新查询设备，赋值给 `deviceInfo`：
+
+   * 在 `internal/logic/auth/deviceLoginLogic.go` 的 `if errors.Is(err, gorm.ErrRecordNotFound)` 分支中，`userInfo, err = l.registerUserAndDevice(req)` 之后追加：
+
+     * `deviceInfo, err = l.svcCtx.UserModel.FindOneDeviceByIdentifier(l.ctx, req.Identifier)`
+
+     * 如果查询失败则返回数据库查询错误（与现有风格一致）。
+2. 在更新设备 UA 前增加空指针保护，并不再忽略更新错误：
+
+   * 将 `internal/logic/auth/deviceLoginLogic.go:99-101` 改为：
+
+     * 检查 `deviceInfo != nil`
+
+     * `deviceInfo.UserAgent = req.UserAgent`
+
+     * `if err := l.svcCtx.UserModel.UpdateDevice(l.ctx, deviceInfo); err != nil {` 记录错误并返回包装后的错误 `xerr.DatabaseUpdateError`。
+3. 可选优化（减少二次查询）：
+
+   * 将 `registerUserAndDevice(req)` 的返回值改为 `(*user.User, *user.Device, error)`，在注册时直接返回新建设备对象；调用点随之调整。若选择此方案，仍需在更新前做空指针保护。
+
+## 代码示例（方案1，最小改动）
+
+```go
+// internal/logic/auth/deviceLoginLogic.go
+// 设备不存在分支注册后追加一次设备查询
+userInfo, err = l.registerUserAndDevice(req)
+if err != nil {
+    return nil, err
+}
+deviceInfo, err = l.svcCtx.UserModel.FindOneDeviceByIdentifier(l.ctx, req.Identifier)
+if err != nil {
+    l.Errorw("query device after register failed",
+        logger.Field("identifier", req.Identifier),
+        logger.Field("error", err.Error()),
+    )
+    return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseQueryError), "query device after register failed: %v", err.Error())
+}
+
+// 更新 UA，不忽略更新错误
+if deviceInfo != nil {
+    deviceInfo.UserAgent = req.UserAgent
+    if err := l.svcCtx.UserModel.UpdateDevice(l.ctx, deviceInfo); err != nil {
+        l.Errorw("update device failed",
+            logger.Field("user_id", userInfo.Id),
+            logger.Field("identifier", req.Identifier),
+            logger.Field("error", err.Error()),
+        )
+        return nil, errors.Wrapf(xerr.NewErrCode(xerr.DatabaseUpdateError), "update device failed: %v", err.Error())
+    }
+}
+```
+
+## 测试用例与验证
+
+* 用例1：首次设备标识登录（设备不存在）应成功返回 Token，日志包含注册与登录记录，无 500。
+
+* 用例2：已存在设备标识登录（设备存在）应正常更新 UA 并返回 Token。
+
+* 用例3：模拟数据库异常时应返回一致的业务错误码，不产生 `panic`。
+
+## 风险与回滚
+
+* 改动限定在登录逻辑，属最小范围；若出现异常，回滚为当前版本即可。
+
+* 不改变数据结构与外部接口行为，兼容现有客户端。
+
+## 后续优化（可选）
+
+* 统一 `UpdateDevice` 错误处理路径，避免 `_ = ...` 静默失败。
+
+* 为“首次设备登录”场景补充集成测试，保证不再回归。
+

.trae/documents/迁移文件重复修复计划.md

@@ -0,0 +1,25 @@
+# 迁移文件重复问题修复计划
+
+## 问题分析
+根据终端日志报错 `panic: failed to init driver with path database: duplicate migration file: 02121_apple_iap_transactions.down.sql`，系统启动失败的原因是存在**重复的迁移版本号**。
+
+在 `initialize/migrate/database/` 目录下，存在两个版本号相同的迁移文件：
+1. `02121_add_user_last_login_time.up.sql` (我们刚刚创建的)
+2. `02121_apple_iap_transactions.up.sql` (已存在的)
+
+由于 `golang-migrate` 要求版本号必须唯一，这两个文件都使用了 `02121` 前缀，导致冲突。
+
+## 解决方案
+将我们新创建的 `add_user_last_login_time` 迁移文件的版本号递增为 `02122`。
+
+## 实施步骤
+1. **重命名迁移文件**:
+   - `02121_add_user_last_login_time.up.sql` -> `02122_add_user_last_login_time.up.sql`
+   - `02121_add_user_last_login_time.down.sql` -> `02122_add_user_last_login_time.down.sql`
+
+2. **验证**:
+   - 确认目录下不再有重复前缀的文件。
+   - 建议用户重新运行程序。
+
+## 补充说明
+此操作仅涉及文件重命名，不修改文件内容，风险极低。

DESIGN_SILENT_LOGIN.md

@@ -0,0 +1,128 @@
+# 设备静默登录机制设计方案
+
+## 需求分析
+1. 用户进来之后就是静默登录（设备登录）
+2. 用户可以主动关联邮箱；也可以不关联邮箱
+3. 用户换手机后在别的地方用邮箱登录会绑定另外一部手机的设备号
+4. 没有游客概念，快捷登录进来的用户就是正式用户
+
+## 当前系统分析
+
+### 现有认证流程
+- **设备登录**：已存在 `deviceLoginLogic.go`，通过设备标识符自动登录
+- **邮箱登录**：已存在 `userLoginLogic.go`，需要邮箱+密码
+- **游客模式**：通过 `Order.UserId = 0` 标识游客订单
+
+### 现有设备管理
+- **设备绑定**：`bindDeviceLogic.go` 处理设备与用户绑定
+- **设备解绑**：`unbindDeviceLogic.go` 处理设备解绑
+- **设备迁移**：支持设备在用户间转移
+
+## 设计方案
+
+### 1. 核心改动策略
+- **保留现有设备登录机制**，作为默认登录方式
+- **移除游客概念**，所有设备登录用户都是正式用户
+- **增强邮箱绑定功能**，支持跨设备登录
+- **优化设备迁移逻辑**，支持邮箱登录后绑定新设备
+
+### 2. 具体实现方案
+
+#### 2.1 修改设备登录逻辑
+**文件**: `internal/logic/auth/deviceLoginLogic.go`
+
+**改动点**:
+- 移除 `registerUserAndDevice` 中的试用激活逻辑
+- 确保所有通过设备登录创建的用户都是正式用户
+- 保持现有的设备绑定机制
+
+#### 2.2 修改订单处理逻辑
+**文件**: `queue/logic/order/activateOrderLogic.go`
+
+**改动点**:
+- 移除 `getUserOrCreate` 中的游客判断逻辑 (`orderInfo.UserId == 0`)
+- 移除 `createGuestUser` 函数
+- 修改为：如果订单没有关联用户，通过设备标识符创建或获取用户
+
+#### 2.3 修改订单关闭逻辑
+**文件**: `internal/logic/public/order/closeOrderLogic.go`
+
+**改动点**:
+- 移除对 `UserId == 0` 的特殊处理
+- 统一处理所有订单的关闭逻辑
+
+#### 2.4 增强邮箱登录逻辑
+**文件**: `internal/logic/auth/userLoginLogic.go`
+
+**改动点**:
+- 在邮箱登录成功后，如果提供了设备标识符，自动绑定设备
+- 支持邮箱登录后在新设备上的自动绑定
+
+#### 2.5 优化设备绑定逻辑
+**文件**: `internal/logic/auth/bindDeviceLogic.go`
+
+**改动点**:
+- 增强设备迁移逻辑，支持邮箱用户登录新设备时的自动绑定
+- 保持现有的设备冲突处理机制
+
+### 3. 数据库变更
+**无需修改数据库结构**，现有的用户和设备表结构已经支持新的需求。
+
+### 4. API 变更
+**无需修改 API 接口**，现有的设备登录和邮箱登录接口已经满足需求。
+
+### 5. 前端适配
+**前端需要调整**:
+- 默认使用设备登录作为主要登录方式
+- 提供邮箱绑定入口
+- 在新设备上提供邮箱登录选项
+
+## 实施步骤
+
+### 第一步：修改订单逻辑
+1. 修改 `activateOrderLogic.go`，移除游客概念
+2. 修改 `closeOrderLogic.go`，统一订单处理逻辑
+
+### 第二步：增强设备登录
+1. 确保设备登录创建的都是正式用户
+2. 优化设备绑定逻辑
+
+### 第三步：增强邮箱登录
+1. 在邮箱登录后支持设备绑定
+2. 优化跨设备登录体验
+
+### 第四步：测试验证
+1. 测试设备静默登录
+2. 测试邮箱绑定功能
+3. 测试跨设备登录
+
+## 优势分析
+
+### 1. 最小化改动
+- 复用现有的设备登录机制
+- 保持现有的数据库结构
+- 保持现有的 API 接口
+
+### 2. 用户体验提升
+- 用户进入即可使用，无需注册
+- 支持邮箱绑定，便于跨设备使用
+- 保持数据连续性
+
+### 3. 系统稳定性
+- 基于现有成熟机制
+- 减少新增代码量
+- 降低引入 bug 的风险
+
+## 风险评估
+
+### 1. 数据迁移
+- **风险**: 现有游客数据需要处理
+- **方案**: 可以保持现有游客数据不变，新用户使用新机制
+
+### 2. 兼容性
+- **风险**: 现有客户端可能需要适配
+- **方案**: 保持 API 兼容，逐步引导用户使用新机制
+
+### 3. 性能影响
+- **风险**: 设备登录可能增加数据库压力
+- **方案**: 现有机制已经过验证，影响可控

Dockerfile

@@ -24,11 +24,11 @@ RUN BUILD_TIME=$(date -u +"%Y-%m-%d %H:%M:%S") && \
     go build -ldflags="-s -w -X 'github.com/perfect-panel/server/pkg/constant.Version=${VERSION}' -X 'github.com/perfect-panel/server/pkg/constant.BuildTime=${BUILD_TIME}'" -o /app/ppanel ppanel.go
 
 # Final minimal image
-FROM scratch
+FROM alpine:latest
 
 # Copy CA certificates and timezone data
 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-COPY --from=builder /usr/share/zoneinfo/Asia/Shanghai /usr/share/zoneinfo/Asia/Shanghai
+COPY --from=builder /usr/share/zoneinfo /usr/share/zoneinfo
 
 ENV TZ=Asia/Shanghai
 
@@ -36,7 +36,6 @@ ENV TZ=Asia/Shanghai
 WORKDIR /app
 
 COPY --from=builder /app/ppanel /app/ppanel
-COPY --from=builder /build/etc /app/etc
 
 # Expose the port (optional)
 EXPOSE 8080

aaa.txt

@@ -0,0 +1,111 @@
+server {
+    listen 80;
+    server_name hifastapp.com www.hifastapp.com www.hifastvpn.com hifastvpn.com hifast.biz www.hifast.biz;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /etc/letsencrypt;
+    }
+
+    # 统一 HTTP 转 HTTPS
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name hifastvpn.com www.hifastvpn.com;
+
+    ssl_certificate /etc/letsencrypt/live/hifastvpn.com/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/hifastvpn.com/privkey.pem; # managed by Certbot
+
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    root /var/www/down;
+    index index.html index.htm;
+
+    location /api/ {
+        proxy_pass https://api.hifast.biz/;
+        proxy_set_header Host api.hifast.biz;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /etc/letsencrypt;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /download/ {
+        autoindex_exact_size off;
+        autoindex_localtime on;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name hifastapp.com www.hifastapp.com;
+
+    # 使用 -0001 的新证书（通常包含 www）
+    ssl_certificate /etc/letsencrypt/live/hifastapp.com-0001/fullchain.pem; # managed by Certbot
+    ssl_certificate_key /etc/letsencrypt/live/hifastapp.com-0001/privkey.pem; # managed by Certbot
+
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    root /var/www/down;
+    index index.html index.htm;
+
+    location /api/ {
+        proxy_pass https://api.hifast.biz/;
+        proxy_set_header Host api.hifast.biz;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+    }
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /etc/letsencrypt;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    location /download/ {
+        autoindex_exact_size off;
+        autoindex_localtime on;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name hifast.biz www.hifast.biz;
+
+    ssl_certificate /etc/letsencrypt/live/hifast.biz/hifast.biz.cer;
+    ssl_certificate_key /etc/letsencrypt/live/hifast.biz/hifast.biz.key;
+
+    root /var/www/lp;
+    index index.html index.htm;
+
+    location ^~ /.well-known/acme-challenge/ {
+        root /etc/letsencrypt;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+}

adapter/adapter.go

@@ -8,24 +8,16 @@ import (
 )
 
 type Adapter struct {
-	Type           string            // 协议类型
+	SiteName       string       // 站点名称
-	SiteName       string            // 站点名称
+	Servers        []*node.Node // 服务器列表
-	Servers        []*node.Node      // 服务器列表
+	UserInfo       User         // 用户信息
-	UserInfo       User              // 用户信息
+	ClientTemplate string       // 客户端配置模板
-	ClientTemplate string            // 客户端配置模板
+	OutputFormat   string       // 输出格式，默认是 base64
-	OutputFormat   string            // 输出格式，默认是 base64
+	SubscribeName  string       // 订阅名称
-	SubscribeName  string            // 订阅名称
-	Params         map[string]string // 其他参数
 }
 
 type Option func(*Adapter)
 
-func WithParams(params map[string]string) Option {
-	return func(opts *Adapter) {
-		opts.Params = params
-	}
-}
-
 // WithServers 设置服务器列表
 func WithServers(servers []*node.Node) Option {
 	return func(opts *Adapter) {
@@ -84,7 +76,6 @@ func (adapter *Adapter) Client() (*Client, error) {
 		OutputFormat:   adapter.OutputFormat,
 		Proxies:        []Proxy{},
 		UserInfo:       adapter.UserInfo,
-		Params:         adapter.Params,
 	}
 
 	proxies, err := adapter.Proxies(adapter.Servers)
@@ -110,58 +101,51 @@ func (adapter *Adapter) Proxies(servers []*node.Node) ([]Proxy, error) {
 		}
 		for _, protocol := range protocols {
 			if protocol.Type == item.Protocol {
-				proxies = append(
+				proxies = append(proxies, Proxy{
-					proxies,
+					Sort:                    item.Sort,
-					Proxy{
+					Name:                    item.Name,
-						Sort:                    item.Sort,
+					Server:                  item.Address,
-						Name:                    item.Name,
+					Port:                    item.Port,
-						Server:                  item.Address,
+					Type:                    item.Protocol,
-						Port:                    item.Port,
+					Tags:                    strings.Split(item.Tags, ","),
-						Type:                    item.Protocol,
+					Security:                protocol.Security,
-						Tags:                    strings.Split(item.Tags, ","),
+					SNI:                     protocol.SNI,
-						Security:                protocol.Security,
+					AllowInsecure:           protocol.AllowInsecure,
-						SNI:                     protocol.SNI,
+					Fingerprint:             protocol.Fingerprint,
-						AllowInsecure:           protocol.AllowInsecure,
+					RealityServerAddr:       protocol.RealityServerAddr,
-						Fingerprint:             protocol.Fingerprint,
+					RealityServerPort:       protocol.RealityServerPort,
-						RealityServerAddr:       protocol.RealityServerAddr,
+					RealityPrivateKey:       protocol.RealityPrivateKey,
-						RealityServerPort:       protocol.RealityServerPort,
+					RealityPublicKey:        protocol.RealityPublicKey,
-						RealityPrivateKey:       protocol.RealityPrivateKey,
+					RealityShortId:          protocol.RealityShortId,
-						RealityPublicKey:        protocol.RealityPublicKey,
+					Transport:               protocol.Transport,
-						RealityShortId:          protocol.RealityShortId,
+					Host:                    protocol.Host,
-						Transport:               protocol.Transport,
+					Path:                    protocol.Path,
-						Host:                    protocol.Host,
+					ServiceName:             protocol.ServiceName,
-						Path:                    protocol.Path,
+					Method:                  protocol.Cipher,
-						ServiceName:             protocol.ServiceName,
+					ServerKey:               protocol.ServerKey,
-						Method:                  protocol.Cipher,
+					Flow:                    protocol.Flow,
-						ServerKey:               protocol.ServerKey,
+					HopPorts:                protocol.HopPorts,
-						Flow:                    protocol.Flow,
+					HopInterval:             protocol.HopInterval,
-						HopPorts:                protocol.HopPorts,
+					ObfsPassword:            protocol.ObfsPassword,
-						HopInterval:             protocol.HopInterval,
+					DisableSNI:              protocol.DisableSNI,
-						ObfsPassword:            protocol.ObfsPassword,
+					ReduceRtt:               protocol.ReduceRtt,
-						UpMbps:                  protocol.UpMbps,
+					UDPRelayMode:            protocol.UDPRelayMode,
-						DownMbps:                protocol.DownMbps,
+					CongestionController:    protocol.CongestionController,
-						DisableSNI:              protocol.DisableSNI,
+					UpMbps:                  protocol.UpMbps,
-						ReduceRtt:               protocol.ReduceRtt,
+					DownMbps:                protocol.DownMbps,
-						UDPRelayMode:            protocol.UDPRelayMode,
+					PaddingScheme:           protocol.PaddingScheme,
-						CongestionController:    protocol.CongestionController,
+					Multiplex:               protocol.Multiplex,
-						PaddingScheme:           protocol.PaddingScheme,
+					XhttpMode:               protocol.XhttpMode,
-						Multiplex:               protocol.Multiplex,
+					XhttpExtra:              protocol.XhttpExtra,
-						XhttpMode:               protocol.XhttpMode,
+					Encryption:              protocol.Encryption,
-						XhttpExtra:              protocol.XhttpExtra,
+					EncryptionMode:          protocol.EncryptionMode,
-						Encryption:              protocol.Encryption,
+					EncryptionRtt:           protocol.EncryptionRtt,
-						EncryptionMode:          protocol.EncryptionMode,
+					EncryptionTicket:        protocol.EncryptionTicket,
-						EncryptionRtt:           protocol.EncryptionRtt,
+					EncryptionServerPadding: protocol.EncryptionServerPadding,
-						EncryptionTicket:        protocol.EncryptionTicket,
+					EncryptionPrivateKey:    protocol.EncryptionPrivateKey,
-						EncryptionServerPadding: protocol.EncryptionServerPadding,
+					EncryptionClientPadding: protocol.EncryptionClientPadding,
-						EncryptionPrivateKey:    protocol.EncryptionPrivateKey,
+					EncryptionPassword:      protocol.EncryptionPassword,
-						EncryptionClientPadding: protocol.EncryptionClientPadding,
+				})
-						EncryptionPassword:      protocol.EncryptionPassword,
-						Ratio:                   protocol.Ratio,
-						CertMode:                protocol.CertMode,
-						CertDNSProvider:         protocol.CertDNSProvider,
-						CertDNSEnv:              protocol.CertDNSEnv,
-					},
-				)
 			}
 		}
 	}

adapter/client.go

@@ -93,13 +93,12 @@ type User struct {
 }
 
 type Client struct {
-	SiteName       string            // Name of the site
+	SiteName       string  // Name of the site
-	SubscribeName  string            // Name of the subscription
+	SubscribeName  string  // Name of the subscription
-	ClientTemplate string            // Template for the entire client configuration
+	ClientTemplate string  // Template for the entire client configuration
-	OutputFormat   string            // json, yaml, etc.
+	OutputFormat   string  // json, yaml, etc.
-	Proxies        []Proxy           // List of proxy configurations
+	Proxies        []Proxy // List of proxy configurations
-	UserInfo       User              // User information
+	UserInfo       User    // User information
-	Params         map[string]string // Additional parameters
 }
 
 func (c *Client) Build() ([]byte, error) {
@@ -120,7 +119,6 @@ func (c *Client) Build() ([]byte, error) {
 		"OutputFormat":  c.OutputFormat,
 		"Proxies":       proxies,
 		"UserInfo":      c.UserInfo,
-		"Params":        c.Params,
 	})
 	if err != nil {
 		return nil, err

apis/admin/order.api

@@ -14,14 +14,14 @@ type (
 	CreateOrderRequest {
 		UserId         int64  `json:"user_id" validate:"required"`
 		Type           uint8  `json:"type" validate:"required"`
-		Quantity       int64  `json:"quantity,omitempty" validate:"omitempty,lte=1000"`
+		Quantity       int64  `json:"quantity,omitempty"`
-		Price          int64  `json:"price" validate:"required,gte=0,lte=2000000000"`
+		Price          int64  `json:"price" validate:"required"`
-		Amount         int64  `json:"amount" validate:"required,gte=0,lte=2147483647"`
+		Amount         int64  `json:"amount" validate:"required"`
-		Discount       int64  `json:"discount,omitempty" validate:"omitempty,gte=0,lte=2000000000"`
+		Discount       int64  `json:"discount,omitempty"`
 		Coupon         string `json:"coupon,omitempty"`
-		CouponDiscount int64  `json:"coupon_discount,omitempty" validate:"omitempty,gte=0,lte=2000000000"`
+		CouponDiscount int64  `json:"coupon_discount,omitempty"`
-		Commission     int64  `json:"commission" validate:"gte=0,lte=2000000000"`
+		Commission     int64  `json:"commission"`
-		FeeAmount      int64  `json:"fee_amount" validate:"required,gte=0,lte=2000000000"`
+		FeeAmount      int64  `json:"fee_amount" validate:"required"`
 		PaymentId      int64  `json:"payment_id" validate:"required"`
 		TradeNo        string `json:"trade_no,omitempty"`
 		Status         uint8  `json:"status,omitempty"`

apis/admin/server.api

@@ -189,6 +189,14 @@ service ppanel {
 	@handler ToggleNodeStatus
 	post /node/status/toggle (ToggleNodeStatusRequest)
 
+	@doc "Check if there is any server or node to migrate"
+	@handler HasMigrateSeverNode
+	get /migrate/has returns (HasMigrateSeverNodeResponse)
+
+	@doc "Migrate server and node data to new database"
+	@handler MigrateServerNode
+	post /migrate/run returns (MigrateServerNodeResponse)
+
 	@doc "Reset server sort"
 	@handler ResetSortWithServer
 	post /server/sort (ResetSortRequest)

apis/admin/subscribe.api

@@ -34,52 +34,50 @@ type (
 		Ids []int64 `json:"ids" validate:"required"`
 	}
 	CreateSubscribeRequest {
-		Name              string              `json:"name" validate:"required"`
+		Name           string              `json:"name" validate:"required"`
-		Language          string              `json:"language"`
+		Language       string              `json:"language"`
-		Description       string              `json:"description"`
+		Description    string              `json:"description"`
-		UnitPrice         int64               `json:"unit_price"`
+		UnitPrice      int64               `json:"unit_price"`
-		UnitTime          string              `json:"unit_time"`
+		UnitTime       string              `json:"unit_time"`
-		Discount          []SubscribeDiscount `json:"discount"`
+		Discount       []SubscribeDiscount `json:"discount"`
-		Replacement       int64               `json:"replacement"`
+		Replacement    int64               `json:"replacement"`
-		Inventory         int64               `json:"inventory"`
+		Inventory      int64               `json:"inventory"`
-		Traffic           int64               `json:"traffic"`
+		Traffic        int64               `json:"traffic"`
-		SpeedLimit        int64               `json:"speed_limit"`
+		SpeedLimit     int64               `json:"speed_limit"`
-		DeviceLimit       int64               `json:"device_limit"`
+		DeviceLimit    int64               `json:"device_limit"`
-		Quota             int64               `json:"quota"`
+		Quota          int64               `json:"quota"`
-		Nodes             []int64             `json:"nodes"`
+		Nodes          []int64             `json:"nodes"`
-		NodeTags          []string            `json:"node_tags"`
+		NodeTags       []string            `json:"node_tags"`
-		Show              *bool               `json:"show"`
+		Show           *bool               `json:"show"`
-		Sell              *bool               `json:"sell"`
+		Sell           *bool               `json:"sell"`
-		DeductionRatio    int64               `json:"deduction_ratio"`
+		DeductionRatio int64               `json:"deduction_ratio"`
-		AllowDeduction    *bool               `json:"allow_deduction"`
+		AllowDeduction *bool               `json:"allow_deduction"`
-		ResetCycle        int64               `json:"reset_cycle"`
+		ResetCycle     int64               `json:"reset_cycle"`
-		RenewalReset      *bool               `json:"renewal_reset"`
+		RenewalReset   *bool               `json:"renewal_reset"`
-		ShowOriginalPrice bool                `json:"show_original_price"`
 	}
 	UpdateSubscribeRequest {
-		Id                int64               `json:"id" validate:"required"`
+		Id             int64               `json:"id" validate:"required"`
-		Name              string              `json:"name" validate:"required"`
+		Name           string              `json:"name" validate:"required"`
-		Language          string              `json:"language"`
+		Language       string              `json:"language"`
-		Description       string              `json:"description"`
+		Description    string              `json:"description"`
-		UnitPrice         int64               `json:"unit_price"`
+		UnitPrice      int64               `json:"unit_price"`
-		UnitTime          string              `json:"unit_time"`
+		UnitTime       string              `json:"unit_time"`
-		Discount          []SubscribeDiscount `json:"discount"`
+		Discount       []SubscribeDiscount `json:"discount"`
-		Replacement       int64               `json:"replacement"`
+		Replacement    int64               `json:"replacement"`
-		Inventory         int64               `json:"inventory"`
+		Inventory      int64               `json:"inventory"`
-		Traffic           int64               `json:"traffic"`
+		Traffic        int64               `json:"traffic"`
-		SpeedLimit        int64               `json:"speed_limit"`
+		SpeedLimit     int64               `json:"speed_limit"`
-		DeviceLimit       int64               `json:"device_limit"`
+		DeviceLimit    int64               `json:"device_limit"`
-		Quota             int64               `json:"quota"`
+		Quota          int64               `json:"quota"`
-		Nodes             []int64             `json:"nodes"`
+		Nodes          []int64             `json:"nodes"`
-		NodeTags          []string            `json:"node_tags"`
+		NodeTags       []string            `json:"node_tags"`
-		Show              *bool               `json:"show"`
+		Show           *bool               `json:"show"`
-		Sell              *bool               `json:"sell"`
+		Sell           *bool               `json:"sell"`
-		Sort              int64               `json:"sort"`
+		Sort           int64               `json:"sort"`
-		DeductionRatio    int64               `json:"deduction_ratio"`
+		DeductionRatio int64               `json:"deduction_ratio"`
-		AllowDeduction    *bool               `json:"allow_deduction"`
+		AllowDeduction *bool               `json:"allow_deduction"`
-		ResetCycle        int64               `json:"reset_cycle"`
+		ResetCycle     int64               `json:"reset_cycle"`
-		RenewalReset      *bool               `json:"renewal_reset"`
+		RenewalReset   *bool               `json:"renewal_reset"`
-		ShowOriginalPrice bool                `json:"show_original_price"`
 	}
 	SubscribeSortRequest {
 		Sort []SortItem `json:"sort"`
@@ -104,9 +102,6 @@ type (
 	BatchDeleteSubscribeRequest {
 		Ids []int64 `json:"ids" validate:"required"`
 	}
-	ResetAllSubscribeTokenResponse {
-		Success bool `json:"success"`
-	}
 )
 
 @server (
@@ -162,9 +157,5 @@ service ppanel {
 	@doc "Subscribe sort"
 	@handler SubscribeSort
 	post /sort (SubscribeSortRequest)
-
-	@doc "Reset all subscribe tokens"
-	@handler ResetAllSubscribeToken
-	post /reset_all_token returns (ResetAllSubscribeTokenResponse)
 }
 

apis/admin/system.api

@@ -22,11 +22,6 @@ type (
 		CurrentTime string  `json:"current_time"`
 		Ratio       float32 `json:"ratio"`
 	}
-	ModuleConfig {
-		Secret         string `json:"secret"` // 通讯密钥
-		ServiceName    string `json:"service_name"` // 服务名称
-		ServiceVersion string `json:"service_version"` // 服务版本
-	}
 )
 
 @server (
@@ -130,9 +125,5 @@ service ppanel {
 	@doc "PreView Node Multiplier"
 	@handler PreViewNodeMultiplier
 	get /node_multiplier/preview returns (PreViewNodeMultiplierResponse)
-
-	@doc "Get Module Config"
-	@handler GetModuleConfig
-	get /module returns (ModuleConfig)
 }
 

apis/admin/tool.api

@@ -17,14 +17,6 @@ type (
 	VersionResponse {
 		Version string `json:"version"`
 	}
-	QueryIPLocationRequest {
-		IP string `form:"ip" validate:"required"`
-	}
-	QueryIPLocationResponse {
-		Country string `json:"country"`
-		Region  string `json:"region,omitempty"`
-		City    string `json:"city"`
-	}
 )
 
 @server (
@@ -44,9 +36,5 @@ service ppanel {
 	@doc "Get Version"
 	@handler GetVersion
 	get /version returns (VersionResponse)
-
-	@doc "Query IP Location"
-	@handler QueryIPLocation
-	get /ip/location (QueryIPLocationRequest) returns (QueryIPLocationResponse)
 }
 

apis/admin/user.api

@@ -19,9 +19,9 @@ type (
 		Size            int    `form:"size"`
 		Search          string `form:"search,omitempty"`
 		UserId          *int64 `form:"user_id,omitempty"`
-		Unscoped        bool   `form:"unscoped,omitempty"`
 		SubscribeId     *int64 `form:"subscribe_id,omitempty"`
 		UserSubscribeId *int64 `form:"user_subscribe_id,omitempty"`
+		DeviceId        string `form:"device_id,omitempty"`
 	}
 	// GetUserListResponse
 	GetUserListResponse {
@@ -43,9 +43,11 @@ type (
 		GiftAmount         int64  `json:"gift_amount"`
 		Telegram           int64  `json:"telegram"`
 		ReferCode          string `json:"refer_code"`
-		RefererId          int64  `json:"referer_id"`
+		RefererId          *int64 `json:"referer_id"`
 		Enable             bool   `json:"enable"`
 		IsAdmin            bool   `json:"is_admin"`
+		MemberStatus       string `json:"member_status"`
+		Remark             string `json:"remark"`
 	}
 	UpdateUserNotifySettingRequest {
 		UserId                int64 `json:"user_id" validate:"required"`
@@ -184,12 +186,6 @@ type (
 	GetUserSubscribeByIdRequest {
 		Id int64 `form:"id" validate:"required"`
 	}
-	ToggleUserSubscribeStatusRequest {
-		UserSubscribeId int64 `json:"user_subscribe_id"`
-	}
-	ResetUserSubscribeTrafficRequest {
-		UserSubscribeId int64 `json:"user_subscribe_id"`
-	}
 )
 
 @server (
@@ -298,17 +294,5 @@ service ppanel {
 	@doc "Get user login logs"
 	@handler GetUserLoginLogs
 	get /login/logs (GetUserLoginLogsRequest) returns (GetUserLoginLogsResponse)
-
-	@doc "Reset user subscribe token"
-	@handler ResetUserSubscribeToken
-	post /subscribe/reset/token (ResetUserSubscribeTokenRequest)
-
-	@doc "Stop user subscribe"
-	@handler ToggleUserSubscribeStatus
-	post /subscribe/toggle (ToggleUserSubscribeStatusRequest)
-
-	@doc "Reset user subscribe traffic"
-	@handler ResetUserSubscribeTraffic
-	post /subscribe/reset/traffic (ResetUserSubscribeTrafficRequest)
 }
 

apis/auth/auth.api

@@ -50,6 +50,16 @@ type (
 		LoginType  string `header:"Login-Type"`
 		CfToken    string `json:"cf_token,optional"`
 	}
+	EmailLoginRequest {
+		Identifier string `json:"identifier"`
+		Email     string `json:"email" validate:"required"`
+		Code      string `json:"code" validate:"required"`
+		Invite    string `json:"invite,optional"`
+		IP        string `header:"X-Original-Forwarded-For"`
+		UserAgent string `header:"User-Agent"`
+		LoginType string `header:"Login-Type"`
+		CfToken   string `json:"cf_token,optional"`
+	}
 	LoginResponse {
 		Token string `json:"token"`
 	}
@@ -141,6 +151,10 @@ service ppanel {
 	@handler CheckUser
 	get /check (CheckUserRequest) returns (CheckUserResponse)
 
+	@doc "Email Login"
+	@handler EmailLogin
+	post /login/email (EmailLoginRequest) returns (LoginResponse)
+
 	@doc "User register"
 	@handler UserRegister
 	post /register (UserRegisterRequest) returns (LoginResponse)

apis/common.api

@@ -87,10 +87,21 @@ type (
 		Total int64             `json:"total"`
 		List  []SubscribeClient `json:"list"`
 	}
-	HeartbeatResponse {
+	ContactRequest {
-		Status    bool   `json:"status"`
+		Name         string `json:"name" validate:"required"`
-		Message   string `json:"message,omitempty"`
+		Email        string `json:"email" validate:"required,email"`
-		Timestamp int64  `json:"timestamp,omitempty"`
+		OtherContact string `json:"other_contact,optional"`
+		Notes        string `json:"notes,optional"`
+	}
+	GetDownloadLinkRequest {
+		InviteCode string `form:"invite_code,optional"`
+		Platform   string `form:"platform" validate:"required,oneof=windows mac ios android"`
+	}
+	GetDownloadLinkResponse {
+		Url string `json:"url"`
+	}
+	GetAppVersionRequest {
+		Platform string `form:"platform" validate:"required,oneof=windows mac ios android"`
 	}
 )
 
@@ -104,6 +115,10 @@ service ppanel {
 	@handler GetGlobalConfig
 	get /site/config returns (GetGlobalConfigResponse)
 
+	@doc "Submit contact info"
+	@handler SubmitContact
+	post /contact (ContactRequest)
+
 	@doc "Get Tos Content"
 	@handler GetTos
 	get /site/tos returns (GetTosResponse)
@@ -136,8 +151,11 @@ service ppanel {
 	@handler GetClient
 	get /client returns (GetSubscribeClientResponse)
 
-	@doc "Heartbeat"
+	@doc "Get Download Link"
-	@handler Heartbeat
+	@handler GetDownloadLink
-	get /heartbeat returns (HeartbeatResponse)
+	get /client/download (GetDownloadLinkRequest) returns (GetDownloadLinkResponse)
-}
 
+	@doc "Get App Version"
+	@handler GetAppVersion
+	get /app/version (GetAppVersionRequest) returns (ApplicationVersion)
+}

apis/public/subscribe.api

@@ -41,11 +41,16 @@ type (
 		Name      string   `json:"name"`
 		Uuid      string   `json:"uuid"`
 		Protocol  string   `json:"protocol"`
+		Protocols string   `json:"protocols"`
 		Port      uint16   `json:"port"`
 		Address   string   `json:"address"`
 		Tags      []string `json:"tags"`
 		Country   string   `json:"country"`
 		City      string   `json:"city"`
+		Longitude    string    `json:"longitude"`
+        Latitude     string    `json:"latitude"`
+        LatitudeCenter     string    `json:"latitude_center"`
+        LongitudeCenter    string    `json:"longitude_center"`
 		CreatedAt int64    `json:"created_at"`
 	}
 )

apis/public/user.api

@@ -66,6 +66,9 @@ type (
 	UnbindOAuthRequest {
 		Method string `json:"method"`
 	}
+	ResetUserSubscribeTokenRequest {
+		UserSubscribeId int64 `json:"user_subscribe_id"`
+	}
 	GetLoginLogRequest {
 		Page int `form:"page"`
 		Size int `form:"size"`
@@ -94,6 +97,16 @@ type (
 		Email string `json:"email" validate:"required"`
 		Code  string `json:"code" validate:"required"`
 	}
+	BindEmailWithVerificationRequest {
+		Email string `json:"email" validate:"required"`
+		Code  string `json:"code" validate:"required"`
+	}
+	BindEmailWithVerificationResponse {
+		Success bool   `json:"success"`
+		Message string `json:"message,omitempty"`
+		Token   string `json:"token,omitempty"`   // 设备关联后的新Token
+		UserId  int64  `json:"user_id,omitempty"` // 目标用户ID
+	}
 	GetDeviceListResponse {
 		List  []UserDevice `json:"list"`
 		Total int64        `json:"total"`
@@ -101,34 +114,56 @@ type (
 	UnbindDeviceRequest {
 		Id int64 `json:"id" validate:"required"`
 	}
-	UpdateUserSubscribeNoteRequest {
+	GetSubscribeStatusResponse {
-		UserSubscribeId int64  `json:"user_subscribe_id" validate:"required"`
+		DeviceStatus  bool `json:"device_status"`
-		Note            string `json:"note" validate:"max=500"`
+		EmailStatus   bool `json:"email_status"`
 	}
-	UpdateUserRulesRequest {
+	// GetAgentRealtimeRequest - 获取代理链接实时数据
-		Rules []string `json:"rules" validate:"required"`
+	GetAgentRealtimeRequest {}
+	// GetAgentRealtimeResponse - 代理链接实时数据响应
+	GetAgentRealtimeResponse {
+		Total          int64   `json:"total"`             // 访问总人数
+		Clicks         int64   `json:"clicks"`            // 点击量
+		Views          int64   `json:"views"`             // 浏览量
+		PaidCount      int64   `json:"paid_count"`        // 付费数量
+		GrowthRate     string  `json:"growth_rate"`       // 访问量环比增长率（例如："+10.5%"、"-5.2%"、"0%"）
+		PaidGrowthRate string  `json:"paid_growth_rate"`  // 付费用户环比增长率（例如："+20.0%"、"-10.0%"、"0%"）
 	}
-	CommissionWithdrawRequest {
+	// GetUserInviteStatsRequest - 获取用户邀请统计
-		Amount  int64  `json:"amount"`
+	GetUserInviteStatsRequest {}
-		Content string `json:"content"`
+	// GetUserInviteStatsResponse - 用户邀请统计响应
+	GetUserInviteStatsResponse {
+		FriendlyCount int64 `json:"friendly_count"` // 有效邀请数（有订单的用户）
+		HistoryCount  int64 `json:"history_count"`  // 历史邀请总数
 	}
-	WithdrawalLog {
+	// GetInviteSalesRequest - 获取最近销售数据
-		Id        int64  `json:"id"`
+	GetInviteSalesRequest {
-		UserId    int64  `json:"user_id"`
+		Page int `form:"page" validate:"required"`
-		Amount    int64  `json:"amount"`
+		Size int `form:"size" validate:"required"`
-		Content   string `json:"content"`
-		Status    uint8  `json:"status"`
-		Reason    string `json:"reason,omitempty"`
-		CreatedAt int64  `json:"created_at"`
-		UpdatedAt int64  `json:"updated_at"`
 	}
-	QueryWithdrawalLogListRequest {
+	// GetInviteSalesResponse - 最近销售数据响应
-		Page int `form:"page"`
+	GetInviteSalesResponse {
-		Size int `form:"size"`
+		Total int64             `json:"total"` // 销售记录总数
+		List  []InvitedUserSale `json:"list"`  // 销售数据列表（分页）
 	}
-	QueryWithdrawalLogListResponse {
+	// InvitedUserSale - 被邀请用户的销售记录
-		List  []WithdrawalLog `json:"list"`
+	InvitedUserSale {
-		Total int64           `json:"total"`
+		Amount      float64 `json:"amount"`
+		CreatedAt   int64   `json:"created_at"`
+		UserHash    string  `json:"user_hash"`
+		ProductName string  `json:"product_name"`
+	}
+	// GetAgentDownloadsRequest - 获取各端下载量
+	GetAgentDownloadsRequest {}
+	// GetAgentDownloadsResponse - 各端下载量响应
+	GetAgentDownloadsResponse {
+		List []AgentDownloadStats `json:"list"`
+	}
+	// AgentDownloadStats - 各端下载量统计
+	AgentDownloadStats {
+		Platform string `json:"platform"`
+		Clicks   int64  `json:"clicks"`
+		Visits   int64  `json:"visits"`
 	}
 )
 
@@ -214,6 +249,10 @@ service ppanel {
 	@handler GetSubscribeLog
 	get /subscribe_log (GetSubscribeLogRequest) returns (GetSubscribeLogResponse)
 
+	@doc "Get Subscribe Status (device/email)"
+	@handler GetSubscribeStatus
+	get /subscribe_status returns (GetSubscribeStatusResponse)
+
 	@doc "Verify Email"
 	@handler VerifyEmail
 	post /verify_email (VerifyEmailRequest)
@@ -234,20 +273,20 @@ service ppanel {
 	@handler UnbindDevice
 	put /unbind_device (UnbindDeviceRequest)
 
-	@doc "Update User Subscribe Note"
+	@doc "Get agent realtime data"
-	@handler UpdateUserSubscribeNote
+	@handler GetAgentRealtime
-	put /subscribe_note (UpdateUserSubscribeNoteRequest)
+	get /agent/realtime (GetAgentRealtimeRequest) returns (GetAgentRealtimeResponse)
 
-	@doc "Update User Rules"
+	@doc "Get user invite statistics"
-	@handler UpdateUserRules
+	@handler GetUserInviteStats
-	put /rules (UpdateUserRulesRequest)
+	get /invite/stats (GetUserInviteStatsRequest) returns (GetUserInviteStatsResponse)
 
-	@doc "Commission Withdraw"
+	@doc "Get invite sales data"
-	@handler CommissionWithdraw
+	@handler GetInviteSales
-	post /commission_withdraw (CommissionWithdrawRequest) returns (WithdrawalLog)
+	get /invite/sales (GetInviteSalesRequest) returns (GetInviteSalesResponse)
 
-	@doc "Query Withdrawal Log"
+	@doc "Get agent downloads data"
-	@handler QueryWithdrawalLog
+	@handler GetAgentDownloads
-	get /withdrawal_log (QueryWithdrawalLogListRequest) returns (QueryWithdrawalLogListResponse)
+	get /agent/downloads (GetAgentDownloadsRequest) returns (GetAgentDownloadsResponse)
 }
 

apis/types.api

@@ -19,19 +19,23 @@ type (
 		GiftAmount            int64            `json:"gift_amount"`
 		Telegram              int64            `json:"telegram"`
 		ReferCode             string           `json:"refer_code"`
-		RefererId             int64            `json:"referer_id"`
+	ShareLink             string           `json:"share_link,omitempty"`
+	RefererId             int64            `json:"referer_id"`
 		Enable                bool             `json:"enable"`
 		IsAdmin               bool             `json:"is_admin,omitempty"`
 		EnableBalanceNotify   bool             `json:"enable_balance_notify"`
 		EnableLoginNotify     bool             `json:"enable_login_notify"`
 		EnableSubscribeNotify bool             `json:"enable_subscribe_notify"`
 		EnableTradeNotify     bool             `json:"enable_trade_notify"`
+		LastLoginTime         int64            `json:"last_login_time"`
+		MemberStatus          string           `json:"member_status"`
+		Remark                string           `json:"remark"`
 		AuthMethods           []UserAuthMethod `json:"auth_methods"`
 		UserDevices           []UserDevice     `json:"user_devices"`
-		Rules                 []string         `json:"rules"`
 		CreatedAt             int64            `json:"created_at"`
 		UpdatedAt             int64            `json:"updated_at"`
 		DeletedAt             int64            `json:"deleted_at,omitempty"`
+		IsDel                 bool             `json:"is_del,omitempty"`
 	}
 	Follow {
 		Id        int64  `json:"id"`
@@ -87,11 +91,17 @@ type (
 		SubscribeType string `json:"subscribe_type"`
 	}
 	ApplicationVersion {
-		Id          int64  `json:"id"`
+		Id          int64             `json:"id"`
-		Url         string `json:"url"`
+		Url         string            `json:"url"`
-		Version     string `json:"version" validate:"required"`
+		Version     string            `json:"version" validate:"required"`
-		Description string `json:"description"`
+		MinVersion  string            `json:"min_version"`
-		IsDefault   bool   `json:"is_default"`
+		ForceUpdate bool              `json:"force_update"`
+		Description map[string]string `json:"description"`
+		FileSize    int64             `json:"file_size"`
+		FileHash    string            `json:"file_hash"`
+		IsDefault   bool              `json:"is_default"`
+		IsInReview  bool              `json:"is_in_review"`
+		CreatedAt   int64             `json:"created_at"`
 	}
 	ApplicationResponse {
 		Applications []ApplicationResponseInfo `json:"applications"`
@@ -204,35 +214,34 @@ type (
 		CurrencySymbol string `json:"currency_symbol"`
 	}
 	SubscribeDiscount {
-		Quantity int64   `json:"quantity"`
+		Quantity int64 `json:"quantity"`
-		Discount float64 `json:"discount"`
+		Discount int64 `json:"discount"`
 	}
 	Subscribe {
-		Id                int64               `json:"id"`
+		Id             int64               `json:"id"`
-		Name              string              `json:"name"`
+		Name           string              `json:"name"`
-		Language          string              `json:"language"`
+		Language       string              `json:"language"`
-		Description       string              `json:"description"`
+		Description    string              `json:"description"`
-		UnitPrice         int64               `json:"unit_price"`
+		UnitPrice      int64               `json:"unit_price"`
-		UnitTime          string              `json:"unit_time"`
+		UnitTime       string              `json:"unit_time"`
-		Discount          []SubscribeDiscount `json:"discount"`
+		Discount       []SubscribeDiscount `json:"discount"`
-		Replacement       int64               `json:"replacement"`
+		Replacement    int64               `json:"replacement"`
-		Inventory         int64               `json:"inventory"`
+		Inventory      int64               `json:"inventory"`
-		Traffic           int64               `json:"traffic"`
+		Traffic        int64               `json:"traffic"`
-		SpeedLimit        int64               `json:"speed_limit"`
+		SpeedLimit     int64               `json:"speed_limit"`
-		DeviceLimit       int64               `json:"device_limit"`
+		DeviceLimit    int64               `json:"device_limit"`
-		Quota             int64               `json:"quota"`
+		Quota          int64               `json:"quota"`
-		Nodes             []int64             `json:"nodes"`
+		Nodes          []int64             `json:"nodes"`
-		NodeTags          []string            `json:"node_tags"`
+		NodeTags       []string            `json:"node_tags"`
-		Show              bool                `json:"show"`
+		Show           bool                `json:"show"`
-		Sell              bool                `json:"sell"`
+		Sell           bool                `json:"sell"`
-		Sort              int64               `json:"sort"`
+		Sort           int64               `json:"sort"`
-		DeductionRatio    int64               `json:"deduction_ratio"`
+		DeductionRatio int64               `json:"deduction_ratio"`
-		AllowDeduction    bool                `json:"allow_deduction"`
+		AllowDeduction bool                `json:"allow_deduction"`
-		ResetCycle        int64               `json:"reset_cycle"`
+		ResetCycle     int64               `json:"reset_cycle"`
-		RenewalReset      bool                `json:"renewal_reset"`
+		RenewalReset   bool                `json:"renewal_reset"`
-		ShowOriginalPrice bool                `json:"show_original_price"`
+		CreatedAt      int64               `json:"created_at"`
-		CreatedAt         int64               `json:"created_at"`
+		UpdatedAt      int64               `json:"updated_at"`
-		UpdatedAt         int64               `json:"updated_at"`
 	}
 	SubscribeGroup {
 		Id          int64  `json:"id"`
@@ -471,7 +480,6 @@ type (
 		Upload      int64     `json:"upload"`
 		Token       string    `json:"token"`
 		Status      uint8     `json:"status"`
-		Short       string    `json:"short"`
 		CreatedAt   int64     `json:"created_at"`
 		UpdatedAt   int64     `json:"updated_at"`
 	}
@@ -580,7 +588,7 @@ type (
 	//public order
 	PurchaseOrderRequest {
 		SubscribeId int64  `json:"subscribe_id"`
-		Quantity    int64  `json:"quantity" validate:"required,gt=0,lte=1000"`
+		Quantity    int64  `json:"quantity" validate:"required,gt=0"`
 		Payment     int64  `json:"payment,omitempty"`
 		Coupon      string `json:"coupon,omitempty"`
 	}
@@ -598,7 +606,7 @@ type (
 	}
 	RenewalOrderRequest {
 		UserSubscribeID int64  `json:"user_subscribe_id"`
-		Quantity        int64  `json:"quantity" validate:"lte=1000"`
+		Quantity        int64  `json:"quantity"`
 		Payment         int64  `json:"payment"`
 		Coupon          string `json:"coupon,omitempty"`
 	}
@@ -613,7 +621,7 @@ type (
 		OrderNo string `json:"order_no"`
 	}
 	RechargeOrderRequest {
-		Amount  int64 `json:"amount" validate:"required,gt=0,lte=2000000000"`
+		Amount  int64 `json:"amount"`
 		Payment int64 `json:"payment"`
 	}
 	RechargeOrderResponse {
@@ -634,8 +642,10 @@ type (
 		PublishableKey string `json:"publishable_key"`
 	}
 	QueryOrderListRequest {
-		Page int `form:"page" validate:"required"`
+		Page   int    `form:"page" validate:"required"`
-		Size int `form:"size" validate:"required"`
+		Size   int    `form:"size" validate:"required"`
+		Status uint8  `form:"status,omitempty"`
+		Search string `form:"search,omitempty"`
 	}
 	QueryOrderListResponse {
 		Total int64         `json:"total"`
@@ -656,7 +666,7 @@ type (
 	// public announcement
 	QueryAnnouncementRequest {
 		Page   int   `form:"page"`
-		Size   int   `form:"size"`
+		Size   int   `form:"size,default=15"`
 		Pinned *bool `form:"pinned"`
 		Popup  *bool `form:"popup"`
 	}
@@ -845,9 +855,5 @@ type (
 		CertDNSProvider         string  `json:"cert_dns_provider,omitempty"` // DNS provider for certificate
 		CertDNSEnv              string  `json:"cert_dns_env,omitempty"` // Environment for DNS provider
 	}
-	// reset user subscribe token
-	ResetUserSubscribeTokenRequest {
-		UserSubscribeId int64 `json:"user_subscribe_id"`
-	}
 )
 

batch_decrypt_logs.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+# 批量解密 Nginx 日志中的下载请求
+# 用法: ./batch_decrypt_logs.sh [日志文件路径]
+
+LOG_FILE="${1:-/var/log/nginx/access.log}"
+
+if [ ! -f "$LOG_FILE" ]; then
+    echo "错误: 日志文件不存在: $LOG_FILE"
+    echo "用法: $0 [日志文件路径]"
+    exit 1
+fi
+
+echo "正在处理日志文件: $LOG_FILE"
+echo "提取包含 /v1/common/client/download 的请求..."
+echo ""
+
+# 提取所有 download 请求并传递给解密工具
+grep "/v1/common/client/download" "$LOG_FILE" | \
+    head -n 100 | \
+    xargs -I {} go run cmd/decrypt_download_data/main.go "{}"

build.bat

@@ -0,0 +1,4 @@
+SET CGO_ENABLED=0
+SET GOOS=linux
+SET GOARCH=amd64
+go build  -o ppanel .\ppanel.go 

cmd/check_db/main.go

@@ -0,0 +1,63 @@
+package main
+
+import (
+	"database/sql"
+	"flag"
+	"log"
+	"os"
+
+	_ "github.com/go-sql-driver/mysql"
+	"github.com/perfect-panel/server/internal/config"
+	"github.com/perfect-panel/server/pkg/conf"
+	"github.com/perfect-panel/server/pkg/orm"
+)
+
+var configFile string
+
+func init() {
+	flag.StringVar(&configFile, "config", "configs/ppanel.yaml", "config file path")
+}
+
+func main() {
+	flag.Parse()
+
+	var c config.Config
+	conf.MustLoad(configFile, &c)
+
+	// Construct DSN
+	m := orm.Mysql{Config: c.MySQL}
+	dsn := m.Dsn()
+
+	log.Println("Connecting to database...")
+	db, err := sql.Open("mysql", dsn+"&multiStatements=true")
+	if err != nil {
+		log.Fatal(err)
+	}
+	defer db.Close()
+
+	if err := db.Ping(); err != nil {
+		log.Fatalf("Ping failed: %v", err)
+	}
+
+	// 1. Check Version
+	var version string
+	if err := db.QueryRow("SELECT version()").Scan(&version); err != nil {
+		log.Fatalf("Failed to select version: %v", err)
+	}
+	log.Printf("MySQL Version: %s", version)
+
+	// 2. Read SQL file directly to ensure we are testing what's on disk
+	sqlBytes, err := os.ReadFile("initialize/migrate/database/02118_traffic_log_idx.up.sql")
+	if err != nil {
+		log.Fatalf("Failed to read SQL file: %v", err)
+	}
+	sqlStmt := string(sqlBytes)
+
+	// 3. Test SQL
+	log.Printf("Testing SQL from file:\n%s", sqlStmt)
+	if _, err := db.Exec(sqlStmt); err != nil {
+		log.Printf("SQL Execution Failed: %v", err)
+	} else {
+		log.Println("SQL Execution Success")
+	}
+}

cmd/create_test_token/main.go

@@ -0,0 +1,152 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+	"github.com/google/uuid"
+	"github.com/redis/go-redis/v9"
+	"gopkg.in/yaml.v3"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+)
+
+// 配置结构
+type AppConfig struct {
+	JwtAuth struct {
+		AccessSecret string `yaml:"AccessSecret"`
+	} `yaml:"JwtAuth"`
+	MySQL struct {
+		Addr     string `yaml:"Addr"`
+		Dbname   string `yaml:"Dbname"`
+		Username string `yaml:"Username"`
+		Password string `yaml:"Password"`
+		Config   string `yaml:"Config"`
+	} `yaml:"MySQL"`
+	Redis struct {
+		Host string `yaml:"Host"`
+		Pass string `yaml:"Pass"`
+		DB   int    `yaml:"DB"`
+	} `yaml:"Redis"`
+}
+
+func main() {
+	fmt.Println("====== 本地测试用户创建 ======")
+
+	// 1. 读取配置
+	cfgData, err := os.ReadFile("configs/ppanel.yaml")
+	if err != nil {
+		fmt.Printf("读取配置失败: %v\n", err)
+		return
+	}
+
+	var cfg AppConfig
+	if err := yaml.Unmarshal(cfgData, &cfg); err != nil {
+		fmt.Printf("解析配置失败: %v\n", err)
+		return
+	}
+
+	// 2. 连接 Redis
+	rdb := redis.NewClient(&redis.Options{
+		Addr:     cfg.Redis.Host,
+		Password: cfg.Redis.Pass,
+		DB:       cfg.Redis.DB,
+	})
+	ctx := context.Background()
+
+	if err := rdb.Ping(ctx).Err(); err != nil {
+		fmt.Printf("Redis 连接失败: %v\n", err)
+		return
+	}
+	fmt.Println("✅ Redis 连接成功")
+
+	// 3. 连接数据库
+	dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s?%s",
+		cfg.MySQL.Username, cfg.MySQL.Password, cfg.MySQL.Addr, cfg.MySQL.Dbname, cfg.MySQL.Config)
+	db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{})
+	if err != nil {
+		fmt.Printf("数据库连接失败: %v\n", err)
+		return
+	}
+	fmt.Println("✅ 数据库连接成功")
+
+	// 4. 查找一个有 refer_code 的用户
+	var user struct {
+		Id        int64  `gorm:"column:id"`
+		ReferCode string `gorm:"column:refer_code"`
+	}
+	result := db.Table("user").
+		Where("refer_code IS NOT NULL AND refer_code != ''").
+		First(&user)
+
+	if result.Error != nil {
+		// 没有找到有 refer_code 的用户，查找第一个用户并添加 refer_code
+		fmt.Println("没有找到有 refer_code 的用户，正在更新第一个用户...")
+		result = db.Table("user").First(&user)
+		if result.Error != nil {
+			fmt.Printf("没有找到用户: %v\n", result.Error)
+			return
+		}
+		// 更新 refer_code
+		newReferCode := fmt.Sprintf("TEST%d", time.Now().Unix()%10000)
+		db.Table("user").Where("id = ?", user.Id).Update("refer_code", newReferCode)
+		user.ReferCode = newReferCode
+		fmt.Printf("已为用户 ID=%d 添加 refer_code: %s\n", user.Id, newReferCode)
+	}
+
+	fmt.Printf("✅ 找到用户: ID=%d, ReferCode=%s\n", user.Id, user.ReferCode)
+
+	// 5. 生成 JWT Token
+	sessionId := uuid.New().String()
+	now := time.Now()
+	expireAt := now.Add(time.Hour * 24 * 7) // 7 天
+
+	claims := jwt.MapClaims{
+		"UserId":    user.Id,
+		"SessionId": sessionId,
+		"DeviceId":  0,
+		"LoginType": "",
+		"iat":       now.Unix(),
+		"exp":       expireAt.Unix(),
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	tokenString, err := token.SignedString([]byte(cfg.JwtAuth.AccessSecret))
+	if err != nil {
+		fmt.Printf("生成 token 失败: %v\n", err)
+		return
+	}
+
+	// 6. 在 Redis 中创建 session
+	// 正确格式：auth:session_id:sessionId = userId
+	sessionKey := fmt.Sprintf("auth:session_id:%s", sessionId)
+
+	err = rdb.Set(ctx, sessionKey, fmt.Sprintf("%d", user.Id), time.Hour*24*7).Err()
+	if err != nil {
+		fmt.Printf("创建 session 失败: %v\n", err)
+		return
+	}
+	fmt.Printf("✅ Session 创建成功: %s = %d\n", sessionKey, user.Id)
+
+	// 7. 清除旧的短链接缓存，确保重新生成
+	cacheKey := "cache:invite:short_link:" + user.ReferCode
+	rdb.Del(ctx, cacheKey)
+	fmt.Printf("✅ 已清除旧缓存: %s\n", cacheKey)
+
+	// 7. 输出测试信息
+	fmt.Println("\n====================================")
+	fmt.Println("测试 Token 生成成功！")
+	fmt.Println("====================================")
+	fmt.Printf("\n用户 ID: %d\n", user.Id)
+	fmt.Printf("邀请码: %s\n", user.ReferCode)
+	fmt.Printf("Session ID: %s\n", sessionId)
+	fmt.Printf("过期时间: %s\n", expireAt.Format("2006-01-02 15:04:05"))
+	fmt.Println("\n====== Token ======")
+	fmt.Println(tokenString)
+	fmt.Println("\n====== 测试命令 ======")
+	fmt.Printf("curl -s 'http://127.0.0.1:8080/v1/public/user/info' \\\n")
+	fmt.Printf("  -H 'authorization: %s' | jq '.'\n", tokenString)
+}

cmd/decrypt_download_data/main.go

@@ -0,0 +1,249 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os"
+	"strings"
+
+	pkgaes "github.com/perfect-panel/server/pkg/aes"
+)
+
+func main() {
+	// 通讯密钥
+	communicationKey := "c0qhq99a-nq8h-ropg-wrlc-ezj4dlkxqpzx"
+
+	// 真实 Nginx 日志数据 - 从用户提供的日志中选取
+	sampleLogs := []string{
+		// 加密的下载请求 - 不同平台
+		`172.245.180.199 - - [02/Feb/2026:04:35:47 +0000] "GET /v1/common/client/download?data=JetaR6P9e8G5lZg2KRiAhV6c%2FdMilBtP78bKmsbAxL8%3D&time=2026-02-02T04:35:15.032000 HTTP/1.1" 200 201 "https://www.hifastvpn.com/" "AdsBot-Google (+http://www.google.com/adsbot.html)"`,
+		`172.245.180.199 - - [02/Feb/2026:04:35:47 +0000] "GET /v1/common/client/download?data=%2FFTAxtcEd%2F8T2MzKdxxrPfWBXk4pNPbQZB3p8Yrl8XQ%3D&time=2026-02-02T04:35:15.031000 HTTP/1.1" 200 181 "https://www.hifastvpn.com/" "AdsBot-Google (+http://www.google.com/adsbot.html)"`,
+		`172.245.180.199 - - [02/Feb/2026:04:35:47 +0000] "GET /v1/common/client/download?data=i18AVRwlVSuFrbf4NmId0RcTbj0tRJIBFHP0MxLjDmI%3D&time=2026-02-02T04:35:15.033000 HTTP/1.1" 200 201 "https://www.hifastvpn.com/" "AdsBot-Google (+http://www.google.com/adsbot.html)"`,
+		`172.245.180.199 - - [02/Feb/2026:04:50:50 +0000] "GET /v1/common/client/download?platform=mac HTTP/1.1" 200 113 "https://gethifast.net/" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)"`,
+		`172.245.180.199 - - [02/Feb/2026:04:50:50 +0000] "GET /v1/common/client/download?platform=windows HTTP/1.1" 200 117 "https://gethifast.net/" "Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)"`,
+		`172.245.180.199 - - [02/Feb/2026:05:24:16 +0000] "GET /v1/common/client/download?data=XfZsgEqUUQ0YBTT51ETQp2wheSvE4SRupBfYbiLnJOc%3D&time=2026-02-02T05:24:15.462000 HTTP/1.1" 200 181 "https://www.hifastvpn.com/" "Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"`,
+		// 真实用户下载
+		`172.245.180.199 - - [02/Feb/2026:02:15:16 +0000] "GET /v1/common/client/download?data=XIZiz7c4sbUGE7Hl8fY6O2D5QKaZqx%2Fg81uR7kjenSg%3D&time=2026-02-02T02:15:16.337000 HTTP/1.1" 200 201 "https://hifastvpn.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36"`,
+		`172.245.180.199 - - [02/Feb/2026:02:18:09 +0000] "GET /v1/common/client/download?data=aB0HistwZTIhxJh6yIds%2B6knoyZC17KyxaXvyd3Z5LY%3D&time=2026-02-02T02:18:06.301000 HTTP/1.1" 200 201 "https://hifastvpn.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36"`,
+		// 实际文件下载
+		`111.55.176.116 - - [02/Feb/2026:02:19:02 +0000] "GET /v1/common/client/download/file/android-1.0.0.apk HTTP/2.0" 200 18546688 "https://hifastvpn.com/" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Mobile Safari/537.36"`,
+		`111.249.202.38 - - [02/Feb/2026:03:14:46 +0000] "GET /v1/common/client/download/file/mac-1.0.0.dmg HTTP/2.0" 200 72821392 "https://hifastvpn.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.7091.96 Safari/537.36"`,
+		// Windows 用户
+		`172.245.180.199 - - [02/Feb/2026:02:23:55 +0000] "GET /v1/common/client/download?data=t8OIVjnZx1N7w5ras4oVH9V0wz4JYlR7849WYKvbj9E%3D&time=2026-02-02T02:23:56.110000 HTTP/1.1" 200 201 "https://hifastvpn.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.7149.88 Safari/537.36"`,
+		// Mac 用户
+		`172.245.180.199 - - [02/Feb/2026:03:14:10 +0000] "GET /v1/common/client/download?data=mGKSxZtL7Ptf30MgFzBJPIsURC%2FkOf2lOGaXQOQ5Ft8%3D&time=2026-02-02T03:14:07.667000 HTTP/1.1" 200 181 "https://hifastvpn.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 12.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.7091.96 Safari/537.36"`,
+		// Android 移动端
+		`172.245.180.199 - - [02/Feb/2026:03:19:41 +0000] "GET /v1/common/client/download?data=y7gttvd%2BoKf9%2BZUeNTsOvuFHwOLFBByrNjkvhPkVykg%3D&time=2026-02-02T03:19:42.192000 HTTP/1.1" 200 201 "https://hifastvpn.com/" "Mozilla/5.0 (Linux; Android 15; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.7559.59 Mobile Safari/537.36"`,
+		`183.171.68.186 - - [02/Feb/2026:03:19:47 +0000] "GET /v1/common/client/download/file/android-1.0.0.apk HTTP/1.1" 200 179890 "https://hifastvpn.com/" "Mozilla/5.0 (Linux; Android 15; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.7559.59 Mobile Safari/537.36"`,
+	}
+
+	// 如果命令行提供了参数，使用命令行参数
+	if len(os.Args) > 1 {
+		sampleLogs = os.Args[1:]
+	}
+
+	fmt.Println("=== Nginx 下载日志解密工具 ===")
+	fmt.Printf("通讯密钥: %s\n\n", communicationKey)
+
+	// 统计数据
+	stats := make(map[string]int)
+	successCount := 0
+
+	for i, logLine := range sampleLogs {
+		// 提取日志条目
+		entry := extractLogEntry(logLine)
+		if entry.Data == "" && entry.Platform == "" {
+			fmt.Printf("--- 日志 #%d ---\n", i+1)
+			fmt.Println("⚠️  跳过: 未找到 data 或 platform 参数\n")
+			continue
+		}
+
+		// 如果有 platform 参数（非加密），直接使用
+		if entry.Platform != "" {
+			fmt.Printf("--- 日志 #%d ---\n", i+1)
+			fmt.Printf("📍 IP地址: %s\n", entry.IP)
+			fmt.Printf("🌐 来源: %s\n", entry.Referer)
+			fmt.Printf("🔓 平台: %s (未加密)\n\n", entry.Platform)
+			stats[entry.Platform]++
+			successCount++
+			continue
+		}
+
+		// 处理加密的 data 参数
+		if entry.Data == "" {
+			continue
+		}
+
+		// URL 解码
+		decodedData, err := url.QueryUnescape(entry.Data)
+		if err != nil {
+			fmt.Printf("--- 日志 #%d ---\n", i+1)
+			fmt.Printf("❌ 错误: URL 解码失败: %v\n\n", err)
+			continue
+		}
+
+		// 提取 nonce (IV) - 从 time 参数转换
+		nonce := extractNonceFromTime(entry.Time)
+
+		// AES 解密
+		plainText, err := pkgaes.Decrypt(decodedData, communicationKey, nonce)
+		if err != nil {
+			fmt.Printf("--- 日志 #%d ---\n", i+1)
+			fmt.Printf("❌ 错误: 解密失败: %v\n", err)
+			fmt.Printf("   IP: %s, Nonce: %s\n\n", entry.IP, nonce)
+			continue
+		}
+
+		// 解析 JSON 获取平台信息
+		var result map[string]interface{}
+		if err := json.Unmarshal([]byte(plainText), &result); err == nil {
+			if platform, ok := result["platform"].(string); ok {
+				stats[platform]++
+			}
+		}
+
+		fmt.Printf("--- 日志 #%d ---\n", i+1)
+		fmt.Printf("📍 IP地址: %s\n", entry.IP)
+		fmt.Printf("🌐 来源: %s\n", entry.Referer)
+		fmt.Printf("🔓 解密内容: %s\n\n", plainText)
+		successCount++
+	}
+
+	// 输出统计信息
+	if successCount > 0 {
+		fmt.Println("=" + strings.Repeat("=", 50))
+		fmt.Printf("📊 统计信息 (成功解密: %d)\n", successCount)
+		fmt.Println("=" + strings.Repeat("=", 50))
+		for platform, count := range stats {
+			fmt.Printf("  %s: %d 次\n", platform, count)
+		}
+		fmt.Println()
+	}
+}
+
+// LogEntry 表示解析后的日志条目
+type LogEntry struct {
+	IP       string
+	Data     string
+	Time     string
+	Referer  string
+	Platform string
+}
+
+// extractLogEntry 从日志行中提取所有关键信息
+func extractLogEntry(logLine string) *LogEntry {
+	entry := &LogEntry{}
+
+	// 提取 IP 地址（第一个字段）
+	parts := strings.Fields(logLine)
+	if len(parts) > 0 {
+		entry.IP = parts[0]
+	}
+
+	// 提取 Referer 和 User-Agent
+	// Nginx combined 格式：... "请求" 状态码 字节数 "Referer" "User-Agent"
+	// 需要找到最后两对引号
+	quotes := []int{}
+	for i := 0; i < len(logLine); i++ {
+		if logLine[i] == '"' {
+			quotes = append(quotes, i)
+		}
+	}
+
+	// 至少需要 6 个引号: "GET ..." "Referer" "User-Agent"
+	if len(quotes) >= 6 {
+		// 倒数第 4 和第 3 个引号之间是 Referer
+		refererStart := quotes[len(quotes)-4]
+		refererEnd := quotes[len(quotes)-3]
+		entry.Referer = logLine[refererStart+1 : refererEnd]
+
+		// 倒数第 2 和第 1 个引号之间是 User-Agent
+		// 如果需要也可以提取
+		// uaStart := quotes[len(quotes)-2]
+		// uaEnd := quotes[len(quotes)-1]
+		// entry.UserAgent = logLine[uaStart+1 : uaEnd]
+	}
+
+	// 查找 ? 后面的查询字符串
+	idx := strings.Index(logLine, "?")
+	// 如果没有查询参数，检查是否是直接文件下载
+	if idx == -1 {
+		// 检查是否包含 /v1/common/client/download/file/
+		filePrefix := "/v1/common/client/download/file/"
+		fileIdx := strings.Index(logLine, filePrefix)
+		if fileIdx != -1 {
+			// 提取文件名部分
+			// URL 形式可能是: /v1/common/client/download/file/Hi%E5%BF%ABVPN-windows-1.0.0.exe HTTP/1.1
+			// 需要截取到空格
+			pathStart := fileIdx + len(filePrefix)
+			pathEnd := strings.Index(logLine[pathStart:], " ")
+			if pathEnd != -1 {
+				filePath := logLine[pathStart : pathStart+pathEnd]
+				// URL 解码
+				decodedPath, err := url.QueryUnescape(filePath)
+				if err == nil {
+					// 转换为小写以便匹配
+					lowerPath := strings.ToLower(decodedPath)
+					if strings.Contains(lowerPath, "windows") || strings.HasSuffix(lowerPath, ".exe") {
+						entry.Platform = "windows"
+					} else if strings.Contains(lowerPath, "mac") || strings.HasSuffix(lowerPath, ".dmg") {
+						entry.Platform = "mac"
+					} else if strings.Contains(lowerPath, "android") || strings.HasSuffix(lowerPath, ".apk") {
+						entry.Platform = "android"
+					} else if strings.Contains(lowerPath, "ios") || strings.HasSuffix(lowerPath, ".ipa") {
+						entry.Platform = "ios"
+					}
+				}
+			}
+		}
+		return entry
+	}
+
+	queryStr := logLine[idx+1:]
+	// 截取到空格或 HTTP/
+	endIdx := strings.Index(queryStr, " ")
+	if endIdx != -1 {
+		queryStr = queryStr[:endIdx]
+	}
+
+	// 解析查询参数
+	params := strings.Split(queryStr, "&")
+	for _, param := range params {
+		kv := strings.SplitN(param, "=", 2)
+		if len(kv) != 2 {
+			continue
+		}
+		switch kv[0] {
+		case "data":
+			entry.Data = kv[1]
+		case "time":
+			entry.Time = kv[1]
+		case "platform":
+			entry.Platform = kv[1]
+		}
+	}
+
+	return entry
+}
+
+// extractNonceFromTime 从 time 参数中提取 nonce
+// time 格式: 2026-02-02T04:35:15.032000
+// 需要转换为纳秒时间戳的十六进制
+func extractNonceFromTime(timeStr string) string {
+	if timeStr == "" {
+		return ""
+	}
+
+	// URL 解码
+	decoded, err := url.QueryUnescape(timeStr)
+	if err != nil {
+		return ""
+	}
+
+	// 简化处理：直接使用整个时间字符串作为 nonce
+	// 因为原始代码使用 time.Now().UnixNano() 的十六进制
+	// 但是从日志中我们无法准确还原原始的 nonce
+	// 所以尝试使用 time 字符串本身
+	return decoded
+}

cmd/fix_migration/main.go

@@ -0,0 +1,38 @@
+package main
+
+import (
+	"flag"
+	"log"
+
+	"github.com/perfect-panel/server/initialize/migrate"
+	"github.com/perfect-panel/server/internal/config"
+	"github.com/perfect-panel/server/pkg/conf"
+	"github.com/perfect-panel/server/pkg/orm"
+)
+
+var configFile string
+
+func init() {
+	flag.StringVar(&configFile, "config", "configs/ppanel.yaml", "config file path")
+}
+
+func main() {
+	flag.Parse()
+
+	var c config.Config
+	conf.MustLoad(configFile, &c)
+
+	// Construct DSN
+	m := orm.Mysql{Config: c.MySQL}
+	dsn := m.Dsn()
+
+	log.Println("Connecting to database...")
+	client := migrate.Migrate(dsn)
+
+	log.Println("Forcing version 2117...")
+	if err := client.Force(2117); err != nil {
+		log.Fatalf("Failed to force version: %v", err)
+	}
+
+	log.Println("Force version 2117 success")
+}

cmd/run.go

@@ -23,6 +23,7 @@ import (
 	"github.com/perfect-panel/server/pkg/orm"
 	"github.com/perfect-panel/server/pkg/service"
 	"github.com/perfect-panel/server/pkg/tool"
+	"github.com/perfect-panel/server/pkg/trace"
 	"github.com/perfect-panel/server/queue"
 	"github.com/perfect-panel/server/scheduler"
 	"github.com/spf13/cobra"
@@ -49,6 +50,7 @@ var startCmd = &cobra.Command{
 func run() {
 	services := getServers()
 	defer services.Stop()
+	defer trace.StopAgent()
 	go services.Start()
 	quit := make(chan os.Signal, 1)
 	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT)
@@ -89,8 +91,13 @@ func getServers() *service.Group {
 		logger.Errorf("Logger setup failed: %v", err.Error())
 	}
 
+	// init trace
+	trace.StartAgent(c.Trace)
+
 	// init service context
 	ctx := svc.NewServiceContext(c)
+	// init system config
+	initialize.StartInitSystemConfig(ctx)
 	services := service.NewServiceGroup()
 	services.Add(internal.NewService(ctx))
 	services.Add(queue.NewService(ctx))

cmd/test_apple_iap/main.go

@@ -0,0 +1,171 @@
+package main
+
+import (
+	"crypto/ecdsa"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"time"
+)
+
+// 配置区域 - 请在此处填入您的真实信息进行测试
+const (
+	// 必填：您的 Key ID (从 App Store Connect 获取)
+	KeyID = "2C4X3HVPM8"
+
+	// 必填：您的 Issuer ID (从 App Store Connect 获取，通常是一个 UUID)
+	IssuerID = "34f54810-5118-4b7f-8069-c8c1e012b7a9" // 请替换为您真实的 Issuer ID
+
+	// 必填：您的 Bundle ID (App 的包名)
+	BundleID = "com.taw.hifastvpn" // 请替换为您真实的 Bundle ID
+
+	// 必填：用于测试的 Transaction ID (任意一个真实的交易 ID)
+	TestTransactionID = "2000001083318819"
+
+	// 必填：是否为沙盒环境
+	IsSandbox = true
+)
+
+// P8 私钥内容 (硬编码用于测试)
+const PrivateKeyPEM = `-----BEGIN PRIVATE KEY-----
+MIGTAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBHkwdwIBAQQgsVDj0g/D7uNCm8aC
+E4TuaiDT4Pgb1IuuZ69YdGNvcAegCgYIKoZIzj0DAQehRANCAARObgGumaESbPMM
+SIRDAVLcWemp0fMlnfDE4EHmqcD58arEJWsr3aWEhc4BHocOUIGjko0cVWGchrFa
+/T/KG1tr
+-----END PRIVATE KEY-----`
+
+func main() {
+	log.Println("开始测试 Apple IAP API 连接...")
+	log.Printf("环境: %v (Sandbox=%v)\n", func() string {
+		if IsSandbox {
+			return "沙盒 (Sandbox)"
+		}
+		return "生产 (Production)"
+	}(), IsSandbox)
+	log.Printf("KeyID: %s\n", KeyID)
+	log.Printf("IssuerID: %s\n", IssuerID)
+	log.Printf("BundleID: %s\n", BundleID)
+	log.Printf("TransactionID: %s\n", TestTransactionID)
+
+	token, err := buildAPIToken()
+	if err != nil {
+		log.Fatalf("生成 JWT Token 失败: %v", err)
+	}
+	log.Println("JWT Token 生成成功")
+
+	// 发起请求
+	host := "https://api.storekit.itunes.apple.com"
+	if IsSandbox {
+		host = "https://api.storekit-sandbox.itunes.apple.com"
+	}
+
+	url := fmt.Sprintf("%s/inApps/v1/transactions/%s", host, TestTransactionID)
+	req, _ := http.NewRequest("GET", url, nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+
+	log.Printf("正在请求: %s", url)
+	start := time.Now()
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		log.Fatalf("请求失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	duration := time.Since(start)
+	body, _ := io.ReadAll(resp.Body)
+
+	log.Printf("请求耗时: %v", duration)
+	log.Printf("状态码: %d", resp.StatusCode)
+
+	if resp.StatusCode == 200 {
+		log.Println("✅ 测试成功！API 调用正常。")
+		log.Printf("响应内容: %s", string(body))
+	} else {
+		log.Println("❌ 测试失败！")
+		log.Printf("错误响应: %s", string(body))
+		if resp.StatusCode == 401 {
+			log.Println("原因分析: 401 Unauthorized 通常表示：")
+			log.Println("1. Key ID 或 Issuer ID 错误")
+			log.Println("2. Bundle ID 不匹配")
+			log.Println("3. 私钥错误")
+			log.Println("4. Token 格式错误 (如算法或 Claims)")
+		} else if resp.StatusCode == 404 {
+			log.Println("原因分析: 404 Not Found 通常表示 Transaction ID 不存在或环境(沙盒/生产)选错了")
+		}
+	}
+}
+
+// 下面是复制过来的工具函数
+func buildAPIToken() (string, error) {
+	header := map[string]interface{}{
+		"alg": "ES256",
+		"kid": KeyID,
+		"typ": "JWT",
+	}
+	now := time.Now().Unix()
+	payload := map[string]interface{}{
+		"iss": IssuerID,
+		"iat": now,
+		"exp": now + 60, // 测试 Token 有效期短一点即可
+		"aud": "appstoreconnect-v1",
+	}
+	if BundleID != "" {
+		payload["bid"] = BundleID
+	}
+
+	hb, _ := json.Marshal(header)
+	pb, _ := json.Marshal(payload)
+
+	enc := func(b []byte) string {
+		return base64.RawURLEncoding.EncodeToString(b)
+	}
+	unsigned := fmt.Sprintf("%s.%s", enc(hb), enc(pb))
+
+	block, _ := pem.Decode([]byte(PrivateKeyPEM))
+	if block == nil {
+		return "", fmt.Errorf("invalid private key")
+	}
+	keyAny, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return "", err
+	}
+	priv, ok := keyAny.(*ecdsa.PrivateKey)
+	if !ok {
+		return "", fmt.Errorf("private key is not ECDSA")
+	}
+
+	digest := sha256Sum([]byte(unsigned))
+	r, s, err := ecdsa.Sign(rand.Reader, priv, digest)
+	if err != nil {
+		return "", err
+	}
+
+	curveBits := priv.Curve.Params().BitSize
+	keyBytes := curveBits / 8
+	if curveBits%8 > 0 {
+		keyBytes += 1
+	}
+	rBytes := r.Bytes()
+	rBytesPadded := make([]byte, keyBytes)
+	copy(rBytesPadded[keyBytes-len(rBytes):], rBytes)
+
+	sBytes := s.Bytes()
+	sBytesPadded := make([]byte, keyBytes)
+	copy(sBytesPadded[keyBytes-len(sBytes):], sBytes)
+
+	sig := append(rBytesPadded, sBytesPadded...)
+	return unsigned + "." + base64.RawURLEncoding.EncodeToString(sig), nil
+}
+
+func sha256Sum(b []byte) []byte {
+	h := sha256.New()
+	h.Write(b)
+	return h.Sum(nil)
+}

cmd/test_db_insert/main.go

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"context"
+	"fmt"
+
+	"time"
+
+	"github.com/perfect-panel/server/initialize"
+	"github.com/perfect-panel/server/internal/config"
+	loggerLog "github.com/perfect-panel/server/internal/model/log"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/perfect-panel/server/pkg/conf"
+)
+
+func main() {
+	var c config.Config
+	conf.MustLoad("etc/ppanel.yaml", &c)
+
+	fmt.Println("Initializing ServiceContext...")
+	svcCtx := svc.NewServiceContext(c)
+	initialize.Email(svcCtx)
+	fmt.Println("ServiceContext initialized.")
+
+	ctx := context.Background()
+
+	// 模拟真实数据
+	content := map[string]interface{}{
+		"Type":     1,
+		"SiteLogo": c.Site.SiteLogo,
+		"SiteName": c.Site.SiteName,
+		"Expire":   15,
+		"Code":     "123456",
+	}
+
+	messageLog := loggerLog.Message{
+		Platform: svcCtx.Config.Email.Platform,
+		To:       "shanshanzhong147@gmail.com",
+		Subject:  "PPanel Test - Verify Email (Register)",
+		Content:  content,
+		Status:   1,
+	}
+
+	emailLog, err := messageLog.Marshal()
+	if err != nil {
+		panic(err)
+	}
+
+	systemLog := &loggerLog.SystemLog{
+		Type:     loggerLog.TypeEmailMessage.Uint8(),
+		Date:     time.Now().Format("2006-01-02"),
+		ObjectID: 0,
+		Content:  string(emailLog),
+	}
+
+	fmt.Println("Attempting to insert into system_logs...")
+	err = svcCtx.LogModel.Insert(ctx, systemLog)
+	if err != nil {
+		fmt.Printf("❌ Insert failed!\n")
+		fmt.Printf("Error Type: %T\n", err)
+		fmt.Printf("Error String: %s\n", err.Error())
+		fmt.Printf("Detailed Error: %+v\n", err)
+	} else {
+		fmt.Println("✅ Insert successful!")
+	}
+}

cmd/test_email/main.go

@@ -0,0 +1,119 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+
+	"github.com/hibiken/asynq"
+	"github.com/perfect-panel/server/initialize"
+	"github.com/perfect-panel/server/internal/config"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/perfect-panel/server/pkg/conf"
+	emailLogic "github.com/perfect-panel/server/queue/logic/email"
+	"github.com/perfect-panel/server/queue/types"
+)
+
+func main() {
+	var c config.Config
+	conf.MustLoad("etc/ppanel.yaml", &c)
+
+	if !c.Email.Enable {
+		log.Fatal("Email is disabled in config. Please enable it in etc/ppanel.yaml")
+	}
+
+	// Initialize ServiceContext
+	svcCtx := svc.NewServiceContext(c)
+	initialize.Email(svcCtx)
+	ctx := context.Background()
+
+	// Target email
+	targetEmail := "shanshanzhong147@gmail.com"
+	fmt.Printf("Preparing to send emails to: %s\n", targetEmail)
+
+	senderLogic := emailLogic.NewSendEmailLogic(svcCtx)
+
+	// 1. Verify Email (Register)
+	fmt.Println("\n[1/5] Sending Registration/Verify Email...")
+	send(ctx, senderLogic, types.SendEmailPayload{
+		Type:    types.EmailTypeVerify,
+		Email:   targetEmail,
+		Subject: "PPanel Test - Verify Email (Register)",
+		Content: map[string]interface{}{
+			"Type":     1, // 1: Register
+			"SiteLogo": c.Site.SiteLogo,
+			"SiteName": c.Site.SiteName,
+			"Expire":   15,
+			"Code":     "123456",
+		},
+	})
+
+	// 2. Verify Email (Password Reset)
+	fmt.Println("\n[2/5] Sending Password Reset/Verify Email...")
+	send(ctx, senderLogic, types.SendEmailPayload{
+		Type:    types.EmailTypeVerify,
+		Email:   targetEmail,
+		Subject: "PPanel Test - Verify Email (Password Reset)",
+		Content: map[string]interface{}{
+			"Type":     2, // 2: Password Reset
+			"SiteLogo": c.Site.SiteLogo,
+			"SiteName": c.Site.SiteName,
+			"Expire":   15,
+			"Code":     "654321",
+		},
+	})
+
+	// 3. Maintenance Email
+	fmt.Println("\n[3/5] Sending Maintenance Email...")
+	send(ctx, senderLogic, types.SendEmailPayload{
+		Type:    types.EmailTypeMaintenance,
+		Email:   targetEmail,
+		Subject: "PPanel Test - Maintenance Notice",
+		Content: map[string]interface{}{
+			"SiteLogo":        c.Site.SiteLogo,
+			"SiteName":        c.Site.SiteName,
+			"MaintenanceDate": "2026-01-01",
+			"MaintenanceTime": "12:00 - 14:00 (UTC+8)",
+		},
+	})
+
+	// 4. Expiration Email
+	fmt.Println("\n[4/5] Sending Expiration Email...")
+	send(ctx, senderLogic, types.SendEmailPayload{
+		Type:    types.EmailTypeExpiration,
+		Email:   targetEmail,
+		Subject: "PPanel Test - Subscription Expiration",
+		Content: map[string]interface{}{
+			"SiteLogo":   c.Site.SiteLogo,
+			"SiteName":   c.Site.SiteName,
+			"ExpireDate": "2026-02-01",
+		},
+	})
+
+	// 5. Traffic Exceed Email
+	fmt.Println("\n[5/5] Sending Traffic Exceed Email...")
+	send(ctx, senderLogic, types.SendEmailPayload{
+		Type:    types.EmailTypeTrafficExceed,
+		Email:   targetEmail,
+		Subject: "PPanel Test - Traffic Exceeded",
+		Content: map[string]interface{}{
+			"SiteLogo":    c.Site.SiteLogo,
+			"SiteName":    c.Site.SiteName,
+			"UsedTraffic": "100GB",
+			"MaxTraffic":  "100GB",
+		},
+	})
+
+	fmt.Println("\nAll tests completed. Please check your inbox.")
+}
+
+func send(ctx context.Context, l *emailLogic.SendEmailLogic, payload types.SendEmailPayload) {
+	data, _ := json.Marshal(payload)
+	task := asynq.NewTask(types.ForthwithSendEmail, data)
+	if err := l.ProcessTask(ctx, task); err != nil {
+		fmt.Printf("❌ Failed to send %s: %v\n", payload.Type, err)
+	} else {
+		fmt.Printf("✅ Sent %s successfully.\n", payload.Type)
+	}
+}

cmd/test_invite_reward/main.go

@@ -0,0 +1,198 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/perfect-panel/server/internal/config"
+	"github.com/perfect-panel/server/internal/model/order"
+	"github.com/perfect-panel/server/internal/model/subscribe"
+	"github.com/perfect-panel/server/internal/model/user"
+	"github.com/perfect-panel/server/internal/svc"
+	"github.com/perfect-panel/server/pkg/orm"
+	"github.com/perfect-panel/server/pkg/tool"
+	orderLogic "github.com/perfect-panel/server/queue/logic/order"
+	"github.com/redis/go-redis/v9"
+)
+
+func main() {
+	// 1. Setup Configuration
+	c := config.Config{
+		MySQL: orm.Config{
+			Addr:         "127.0.0.1:3306",
+			Dbname:       "dev_ppanel", // Using dev_ppanel as default, change if needed
+			Username:     "root",
+			Password:     "rootpassword",
+			Config:       "charset=utf8mb4&parseTime=true&loc=Asia%2FShanghai",
+			MaxIdleConns: 10,
+			MaxOpenConns: 10,
+		},
+		Redis: config.RedisConfig{
+			Host: "127.0.0.1:6379",
+			DB:   0,
+		},
+		Invite: config.InviteConfig{
+			GiftDays: 3, // Default gift days
+		},
+	}
+
+	// 2. Connect to Database & Redis
+	db, err := orm.ConnectMysql(orm.Mysql{Config: c.MySQL})
+	if err != nil {
+		panic(fmt.Sprintf("DB Connection failed: %v", err))
+	}
+	rds := redis.NewClient(&redis.Options{
+		Addr: c.Redis.Host,
+		DB:   c.Redis.DB,
+	})
+
+	// 3. Initialize ServiceContext
+	serviceCtx := svc.NewServiceContext(c)
+	serviceCtx.DB = db
+	serviceCtx.Redis = rds
+	// We don't need queue/scheduler for this unit test
+
+	ctx := context.Background()
+
+	// 4. Run Scenarios
+	fmt.Println("=== Starting Invite Reward Test ===")
+
+	// Scenario 1: Commission 0 (Expect Gift Days)
+	runScenario(ctx, serviceCtx, "Scenario_0_Commission", 0)
+
+	// Scenario 2: Commission 10 (Expect Money)
+	runScenario(ctx, serviceCtx, "Scenario_10_Commission", 10)
+}
+
+func runScenario(ctx context.Context, s *svc.ServiceContext, name string, referralPercentage int64) {
+	fmt.Printf("\n--- Running %s (ReferralPercentage: %d%%) ---\n", name, referralPercentage)
+
+	// Update Config
+	s.Config.Invite.ReferralPercentage = referralPercentage
+
+	// Cleanup old data (Partial cleanup since we don't have email to query)
+	// We'll rely on unique ReferCode / UUIDs to avoid collisions but DB might grow.
+	// Actually we should try to clean up.
+	// Since we removed Email from struct, we can't use it to query easily unless we check `auth_methods`.
+	// For this test, let's just create new users.
+
+	// Create Referrer
+	referrer := &user.User{
+		Password:           tool.EncodePassWord("123456"),
+		ReferCode:          fmt.Sprintf("REF%d", time.Now().UnixNano())[:20],
+		ReferralPercentage: 0, // Use global settings
+		Commission:         0,
+	}
+	// Use DB directly to ensure ID is updated in struct
+	if err := s.DB.Create(referrer).Error; err != nil {
+		fmt.Printf("Create Referrer Failed: %v\n", err)
+		return
+	}
+	// Force active subscription for referrer so they can receive gift time
+	createActiveSubscription(ctx, s, referrer.Id)
+
+	fmt.Printf("Created Referrer: ID=%d, Commission=%d\n", referrer.Id, referrer.Commission)
+
+	// Create User (Invitee)
+	invitee := &user.User{
+		Password:  tool.EncodePassWord("123456"),
+		RefererId: referrer.Id,
+	}
+	if err := s.DB.Create(invitee).Error; err != nil {
+		fmt.Printf("Create Invitee Failed: %v\n", err)
+		return
+	}
+	// Force active subscription for invitee to receive gift time
+	_ = createActiveSubscription(ctx, s, invitee.Id)
+
+	fmt.Printf("Created Invitee: ID=%d, RefererID=%d\n", invitee.Id, invitee.RefererId)
+
+	// Create Order
+	orderInfo := &order.Order{
+		OrderNo:     tool.GenerateTradeNo(),
+		UserId:      invitee.Id,
+		Amount:      10000, // 100.00
+		Price:       10000,
+		FeeAmount:   0,
+		Status:      2, // Paid
+		Type:        1, // Subscribe
+		IsNew:       true,
+		SubscribeId: 1, // Assume plan 1 exists
+		Quantity:    1,
+	}
+	// We need a dummy subscribe plan in DB or use existing
+	ensureSubscribePlan(ctx, s, 1)
+
+	// Execute Logic
+	logic := orderLogic.NewActivateOrderLogic(s)
+
+	// We only simulate the commission part logic or NewPurchase
+	// logic.NewPurchase does a lot of things.
+	// Let's call NewPurchase to be realistic, but we need to ensure dependencies exist.
+	// Instead of full NewPurchase which might fail on other things,
+	// let's verify if we can just call handleCommission? No it's private.
+	// So we call NewPurchase.
+
+	err := logic.NewPurchase(ctx, orderInfo)
+	if err != nil {
+		fmt.Printf("NewPurchase failed (expected for mocked env): %v\n", err)
+		// If it failed because of things we don't care (like sending email), check data anyway
+	} else {
+		fmt.Println("NewPurchase executed successfully.")
+	}
+
+	// Wait for async goroutines
+	time.Sleep(2 * time.Second)
+
+	// Check Results
+	// 1. Check Referrer Commission
+	refRes, _ := s.UserModel.FindOne(ctx, referrer.Id)
+	fmt.Printf("Result Referrer Commission: %d (Expected: %d)\n", refRes.Commission, int64(float64(orderInfo.Amount)*float64(referralPercentage)/100))
+
+	// 2. Check Gift Days (Check expiration time changes)
+	// We compare with the initial subscription time
+	// But since we just created it, it's simpler to check if 'ExpiryTime' is far in the future or extended.
+	// For 0 commission, we expect gift days.
+
+	refSub, _ := s.UserModel.FindActiveSubscribe(ctx, referrer.Id)
+	invSub, _ := s.UserModel.FindActiveSubscribe(ctx, invitee.Id)
+	// Avoid panic if sub not found
+	if refSub != nil {
+		fmt.Printf("Result Referrer Sub Expire: %v\n", refSub.ExpireTime)
+	} else {
+		fmt.Println("Result Referrer Sub Expire: nil")
+	}
+	if invSub != nil {
+		// NewPurchase renews/creates sub, so it should be valid + duration
+		fmt.Printf("Result Invitee Sub Expire: %v\n", invSub.ExpireTime)
+	} else {
+		fmt.Println("Result Invitee Sub Expire: nil")
+	}
+}
+
+func createActiveSubscription(ctx context.Context, s *svc.ServiceContext, userId int64) *user.Subscribe {
+	sub := &user.Subscribe{
+		UserId:     userId,
+		Status:     1,
+		ExpireTime: time.Now().Add(30 * 24 * time.Hour), // 30 days initial
+		Token:      uuid.New().String(),
+		UUID:       uuid.New().String(),
+	}
+	s.UserModel.InsertSubscribe(ctx, sub)
+	return sub
+}
+
+func ensureSubscribePlan(ctx context.Context, s *svc.ServiceContext, id int64) {
+	_, err := s.SubscribeModel.FindOne(ctx, id)
+	if err != nil {
+		s.SubscribeModel.Insert(ctx, &subscribe.Subscribe{
+			Id:        id,
+			Name:      "Test Plan",
+			UnitTime:  "Day", // Days
+			UnitPrice: 100,
+			Sell:      &[]bool{true}[0],
+		})
+	}
+}

cmd/test_kutt/main.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"log"
+
+	"github.com/perfect-panel/server/pkg/kutt"
+)
+
+// 测试 Kutt 短链接 API
+// 运行方式: go run cmd/test_kutt/main.go
+func main() {
+	// Kutt 配置 - 请根据实际情况修改
+	apiURL := "https://getsapp.net/api/v2"
+	apiKey := "6JSjGOzLF1NCYQXuUGZjvrkqU0Jy3upDkYX87DPO"
+	targetURL := "https://gethifast.net"
+
+	// 测试邀请码
+	testInviteCode := "TEST123"
+
+	fmt.Println("====== Kutt 短链接 API 测试 ======")
+	fmt.Printf("API URL: %s\n", apiURL)
+	fmt.Printf("Target URL: %s\n", targetURL)
+	fmt.Printf("测试邀请码: %s\n", testInviteCode)
+	fmt.Println("----------------------------------")
+
+	// 创建客户端
+	client := kutt.NewClient(apiURL, apiKey)
+	ctx := context.Background()
+
+	// 测试 1: 使用便捷方法创建邀请短链接
+	fmt.Println("\n[测试 1] 创建邀请短链接...")
+	shortLink, err := client.CreateInviteShortLink(ctx, targetURL, testInviteCode, "getsapp.net")
+	if err != nil {
+		log.Printf("❌ 创建短链接失败: %v\n", err)
+	} else {
+		fmt.Printf("✅ 短链接创建成功: %s\n", shortLink)
+	}
+
+	// 测试 2: 使用完整参数创建短链接
+	fmt.Println("\n[测试 2] 使用完整参数创建短链接...")
+	req := &kutt.CreateLinkRequest{
+		Target:      fmt.Sprintf("%s/register?invite=%s", targetURL, "CUSTOM456"),
+		Description: "Test custom short link",
+		Reuse:       true,
+	}
+	link, err := client.CreateShortLink(ctx, req)
+	if err != nil {
+		log.Printf("❌ 创建短链接失败: %v\n", err)
+	} else {
+		// 打印详细返回信息
+		linkJSON, _ := json.MarshalIndent(link, "", "  ")
+		fmt.Printf("✅ 短链接创建成功:\n%s\n", string(linkJSON))
+	}
+
+	fmt.Println("\n====== 测试完成 ======")
+}

cmd/test_openinstall/README.md

@@ -0,0 +1,101 @@
+# OpenInstall API 测试结果
+
+## 测试总结
+
+✅ **成功连接到 OpenInstall API**
+
+- API 基础 URL: `https://data.openinstall.com`
+- 测试的接口端点工作正常
+- HTTP 状态码: 200 
+
+## 当前问题
+
+❌ **ApiKey 配置错误**
+
+API 返回错误: `code=3, error="apiKey错误"`
+
+## 问题分析
+
+当前配置中:
+- `AppKey: alf57p` - 这是应用的标识符(AppKey),用于 SDK 集成
+- 但数据接口需要的是单独的 `apiKey`,这两者不同
+
+## 解决方案
+
+### 步骤 1: 在 OpenInstall 后台配置数据接口
+
+1. 登录 OpenInstall 后台: https://www.openinstall.com
+2. 找到 **【数据接口】-【接口配置】** 菜单
+3. **开启数据接口开关**
+4. 获取 `apiKey` (这是专门用于数据接口的密钥,不同于 AppKey)
+
+### 步骤 2: 更新配置文件
+
+在 `ppanel-server/etc/ppanel.yaml` 中添加 `ApiKey`:
+
+```yaml
+OpenInstall:
+  Enable: true
+  AppKey: "alf57p"      # SDK 集成使用
+  ApiKey: "your_api_key_from_backend"  # 数据接口使用
+```
+
+### 步骤 3: 重新测试
+
+获取到正确的 apiKey 后,运行测试程序:
+
+```bash
+cd cmd/test_openinstall
+go run main.go
+```
+
+## 测试接口说明
+
+测试程序当前测试了以下接口:
+
+### 1. 新增安装数据 (Growth Data)
+- 端点: `/data/event/growth`
+- 功能: 获取指定时间范围内的访问量、点击量、安装量、注册量及留存数据
+- 参数:
+  - `apiKey`: 数据接口密钥
+  - `startDate`: 开始日期 (格式: 2006-01-02)
+  - `endDate`: 结束日期
+  - `statType`: 统计类型 (daily=按天, hourly=按小时, total=合计)
+
+返回数据包括:
+- `visit`: 访问量
+- `click`: 点击量
+- `install`: 安装量
+- `register`: 注册量
+- `survive_d1`: 1日留存
+- `survive_d7`: 7日留存
+- `survive_d30`: 30日留存
+
+### 2. 渠道列表 (Channel List)
+- 端点: `/data/channel/list`
+- 功能: 获取 H5 渠道列表
+- 参数:
+  - `apiKey`: 数据接口密钥
+  - `pageNum`: 页码
+  - `pageSize`: 每页数量
+
+## 更多可用接口
+
+OpenInstall 数据接口还提供以下功能:
+
+- 渠道分组管理 (创建、修改、删除)
+- 渠道管理 (创建、修改、删除、查询)
+- 子渠道管理
+- 存量设备数据
+- 活跃数据统计
+- 效果点数据
+- 设备分布统计
+
+详细文档: https://www.openinstall.com/doc/data.html
+
+## 下一步建议
+
+1. **配置 ApiKey**: 按照上述步骤在 OpenInstall 后台获取并配置 apiKey
+2. **更新配置**: 将 apiKey 添加到 `ppanel.yaml` 配置文件
+3. **更新代码**: 修改 `pkg/openinstall/openinstall.go` 实现真实的 API 调用
+4. **测试验证**: 重新运行测试程序验证数据获取

cmd/test_openinstall/main.go

@@ -0,0 +1,254 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+const (
+	// OpenInstall 数据接口基础 URL
+	apiBaseURL = "https://data.openinstall.com"
+
+	// 您的 ApiKey (数据接口密钥)
+	apiKey = "a7596bc007f31a98ca551e33a75d3bb5997b0b94027c6e988d3c0af1"
+)
+
+// 通用响应结构
+type APIResponse struct {
+	Code  int             `json:"code"`
+	Error *string         `json:"error"`
+	Body  json.RawMessage `json:"body"`
+}
+
+// 新增安装数据
+type GrowthData struct {
+	Date       string `json:"date"`
+	Visit      int64  `json:"visit"`       // 点击量
+	Click      int64  `json:"click"`       // 访问量
+	Install    int64  `json:"install"`     // 安装量
+	Register   int64  `json:"register"`    // 注册量
+	SurviveD1  int64  `json:"survive_d1"`  // 1日留存
+	SurviveD7  int64  `json:"survive_d7"`  // 7日留存
+	SurviveD30 int64  `json:"survive_d30"` // 30日留存
+}
+
+// 渠道列表数据
+type ChannelData struct {
+	ChannelCode string `json:"channelCode"`
+	ChannelName string `json:"channelName"`
+	LinkURL     string `json:"linkUrl"`
+	CreateTime  string `json:"createTime"`
+	GroupName   string `json:"groupName"`
+}
+
+func main() {
+	fmt.Println("========================================")
+	fmt.Println("OpenInstall API 测试程序")
+	fmt.Println("========================================")
+	fmt.Printf("ApiKey: %s\n", apiKey)
+	fmt.Printf("API Base URL: %s\n", apiBaseURL)
+	fmt.Println()
+
+	ctx := context.Background()
+
+	// 测试1: 获取新增安装数据（最近7天）
+	fmt.Println("测试1: 获取新增安装数据（最近7天）")
+	fmt.Println("========================================")
+	testGrowthData(ctx, 7)
+
+	fmt.Println()
+
+	// 测试2: 获取新增安装数据（最近30天）
+	fmt.Println("测试2: 获取新增安装数据（最近30天）")
+	fmt.Println("========================================")
+	testGrowthData(ctx, 30)
+
+	fmt.Println()
+
+	// 测试3: 获取渠道列表
+	fmt.Println("测试3: 获取渠道列表")
+	fmt.Println("========================================")
+	testChannelList(ctx)
+
+	fmt.Println()
+
+	fmt.Println("========================================")
+	fmt.Println("测试完成!")
+	fmt.Println("========================================")
+}
+
+// 测试获取新增安装数据
+func testGrowthData(ctx context.Context, days int) {
+	// 设置查询时间范围
+	endDate := time.Now()
+	startDate := endDate.AddDate(0, 0, -days)
+
+	// 构建 API URL
+	apiURL := fmt.Sprintf("%s/data/event/growth", apiBaseURL)
+
+	params := url.Values{}
+	params.Add("apiKey", apiKey)
+	params.Add("startDate", startDate.Format("2006-01-02"))
+	params.Add("endDate", endDate.Format("2006-01-02"))
+	params.Add("statType", "daily") // daily = 按天统计, hourly = 按小时统计, total = 合计
+
+	fullURL := fmt.Sprintf("%s?%s", apiURL, params.Encode())
+	fmt.Printf("请求 URL: %s\n", fullURL)
+
+	body, statusCode, err := makeRequest(ctx, fullURL)
+	if err != nil {
+		fmt.Printf("❌ 请求失败: %v\n", err)
+		return
+	}
+
+	fmt.Printf("HTTP 状态码: %d\n", statusCode)
+
+	if statusCode == 200 {
+		// 解析响应
+		var apiResp APIResponse
+		if err := json.Unmarshal(body, &apiResp); err != nil {
+			fmt.Printf("❌ JSON 解析失败: %v\n", err)
+			printRawResponse(body)
+			return
+		}
+
+		if apiResp.Code == 0 {
+			fmt.Println("✅ 成功获取数据!")
+
+			// 解析业务数据
+			var growthData []GrowthData
+			if err := json.Unmarshal(apiResp.Body, &growthData); err != nil {
+				fmt.Printf("⚠️  业务数据解析失败: %v\n", err)
+				printRawResponse(body)
+				return
+			}
+
+			// 格式化输出数据
+			fmt.Printf("\n共获取 %d 天的数据:\n", len(growthData))
+			fmt.Println("----------------------------------------")
+			for _, data := range growthData {
+				fmt.Printf("日期: %s\n", data.Date)
+				fmt.Printf("  访问量(visit): %d\n", data.Visit)
+				fmt.Printf("  点击量(click): %d\n", data.Click)
+				fmt.Printf("  安装量(install): %d\n", data.Install)
+				fmt.Printf("  注册量(register): %d\n", data.Register)
+				fmt.Printf("  1日留存: %d\n", data.SurviveD1)
+				fmt.Printf("  7日留存: %d\n", data.SurviveD7)
+				fmt.Printf("  30日留存: %d\n", data.SurviveD30)
+				fmt.Println("----------------------------------------")
+			}
+		} else {
+			errMsg := "未知错误"
+			if apiResp.Error != nil {
+				errMsg = *apiResp.Error
+			}
+			fmt.Printf("❌ API 返回错误 (code=%d): %s\n", apiResp.Code, errMsg)
+			printRawResponse(body)
+		}
+	} else {
+		fmt.Printf("❌ HTTP 请求失败\n")
+		printRawResponse(body)
+	}
+}
+
+// 测试获取渠道列表
+func testChannelList(ctx context.Context) {
+	// 构建 API URL
+	apiURL := fmt.Sprintf("%s/data/channel/list", apiBaseURL)
+
+	params := url.Values{}
+	params.Add("apiKey", apiKey)
+	params.Add("pageNum", "0")
+	params.Add("pageSize", "20")
+
+	fullURL := fmt.Sprintf("%s?%s", apiURL, params.Encode())
+	fmt.Printf("请求 URL: %s\n", fullURL)
+
+	body, statusCode, err := makeRequest(ctx, fullURL)
+	if err != nil {
+		fmt.Printf("❌ 请求失败: %v\n", err)
+		return
+	}
+
+	fmt.Printf("HTTP 状态码: %d\n", statusCode)
+
+	if statusCode == 200 {
+		// 解析响应
+		var apiResp APIResponse
+		if err := json.Unmarshal(body, &apiResp); err != nil {
+			fmt.Printf("❌ JSON 解析失败: %v\n", err)
+			printRawResponse(body)
+			return
+		}
+
+		if apiResp.Code == 0 {
+			fmt.Println("✅ 成功获取渠道列表!")
+
+			// 直接打印原始数据
+			printJSONResponse(apiResp.Body)
+		} else {
+			errMsg := "未知错误"
+			if apiResp.Error != nil {
+				errMsg = *apiResp.Error
+			}
+			fmt.Printf("❌ API 返回错误 (code=%d): %s\n", apiResp.Code, errMsg)
+			printRawResponse(body)
+		}
+	} else {
+		fmt.Printf("❌ HTTP 请求失败\n")
+		printRawResponse(body)
+	}
+}
+
+// 发送 HTTP 请求
+func makeRequest(ctx context.Context, url string) ([]byte, int, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	if err != nil {
+		return nil, 0, fmt.Errorf("创建请求失败: %w", err)
+	}
+
+	client := &http.Client{
+		Timeout: 10 * time.Second,
+	}
+
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, 0, fmt.Errorf("发送请求失败: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, resp.StatusCode, fmt.Errorf("读取响应失败: %w", err)
+	}
+
+	return body, resp.StatusCode, nil
+}
+
+// 打印原始响应
+func printRawResponse(body []byte) {
+	fmt.Println("\n原始响应内容:")
+	var prettyJSON map[string]interface{}
+	if err := json.Unmarshal(body, &prettyJSON); err == nil {
+		formatted, _ := json.MarshalIndent(prettyJSON, "", "  ")
+		fmt.Println(string(formatted))
+	} else {
+		fmt.Println(string(body))
+	}
+}
+
+// 打印 JSON 响应
+func printJSONResponse(data json.RawMessage) {
+	var prettyJSON interface{}
+	if err := json.Unmarshal(data, &prettyJSON); err == nil {
+		formatted, _ := json.MarshalIndent(prettyJSON, "", "  ")
+		fmt.Println(string(formatted))
+	} else {
+		fmt.Println(string(data))
+	}
+}

cmd/test_openinstall_distribution/main.go

@@ -0,0 +1,158 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+const (
+	apiBaseURL = "https://data.openinstall.com"
+	apiKey     = "a7596bc007f31a98ca551e33a75d3bb5997b0b94027c6e988d3c0af1"
+)
+
+type APIResponse struct {
+	Code  int             `json:"code"`
+	Error *string         `json:"error"`
+	Body  json.RawMessage `json:"body"`
+}
+
+type DistributionData struct {
+	Key   string `json:"key"`
+	Value int64  `json:"value"`
+}
+
+func main() {
+	fmt.Println("========================================")
+	fmt.Println("测试 OpenInstall 新增设备分布接口")
+	fmt.Println("========================================")
+	fmt.Println()
+
+	ctx := context.Background()
+
+	// 获取当月数据
+	now := time.Now()
+	startOfMonth := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, now.Location())
+
+	fmt.Printf("当月数据: %s 到 %s\n", startOfMonth.Format("2006-01-02"), now.Format("2006-01-02"))
+	fmt.Println("========================================")
+
+	// 测试各平台的数据
+	platforms := []struct {
+		name     string
+		platform string
+	}{
+		{"iOS", "ios"},
+		{"Android", "android"},
+		{"HarmonyOS", "harmony"},
+	}
+
+	for _, p := range platforms {
+		fmt.Printf("\n平台: %s\n", p.name)
+		fmt.Println("----------------------------------------")
+
+		// 获取总量
+		data, err := getDeviceDistribution(ctx, startOfMonth, now, p.platform, "total")
+		if err != nil {
+			fmt.Printf("❌ 失败: %v\n", err)
+			continue
+		}
+
+		fmt.Println("✅ 成功获取数据:")
+		for _, item := range data {
+			fmt.Printf("  %s: %d\n", item.Key, item.Value)
+		}
+	}
+
+	// 测试不同的 sumBy 参数
+	fmt.Println("\n========================================")
+	fmt.Println("测试不同的分组方式 (iOS平台):")
+	fmt.Println("========================================")
+
+	sumByOptions := []string{
+		"total",          // 总量
+		"system_version", // 系统版本
+		"app_version",    // app版本
+		"brand_model",    // 机型
+	}
+
+	for _, sumBy := range sumByOptions {
+		fmt.Printf("\nsumBy=%s:\n", sumBy)
+		fmt.Println("----------------------------------------")
+
+		data, err := getDeviceDistribution(ctx, startOfMonth, now, "ios", sumBy)
+		if err != nil {
+			fmt.Printf("❌ 失败: %v\n", err)
+			continue
+		}
+
+		if len(data) == 0 {
+			fmt.Println("⚠️  无数据")
+			continue
+		}
+
+		fmt.Println("✅ 数据:")
+		for _, item := range data {
+			fmt.Printf("  %s: %d\n", item.Key, item.Value)
+		}
+	}
+
+	fmt.Println("\n========================================")
+	fmt.Println("测试完成！")
+	fmt.Println("========================================")
+}
+
+func getDeviceDistribution(ctx context.Context, startDate, endDate time.Time, platform, sumBy string) ([]DistributionData, error) {
+	apiURL := fmt.Sprintf("%s/data/sum/growth", apiBaseURL)
+
+	params := url.Values{}
+	params.Add("apiKey", apiKey)
+	params.Add("beginDate", startDate.Format("2006-01-02")) // 注意：使用 beginDate 而不是 startDate
+	params.Add("endDate", endDate.Format("2006-01-02"))
+	params.Add("platform", platform)      // 平台过滤: ios, android, harmony
+	params.Add("sumBy", sumBy)            // 分组方式
+	params.Add("excludeDuplication", "0") // 不排重
+
+	fullURL := fmt.Sprintf("%s?%s", apiURL, params.Encode())
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to send request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var apiResp APIResponse
+	if err := json.Unmarshal(body, &apiResp); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	if apiResp.Code != 0 {
+		errMsg := "unknown error"
+		if apiResp.Error != nil {
+			errMsg = *apiResp.Error
+		}
+		return nil, fmt.Errorf("API error (code=%d): %s", apiResp.Code, errMsg)
+	}
+
+	var distData []DistributionData
+	if err := json.Unmarshal(apiResp.Body, &distData); err != nil {
+		return nil, fmt.Errorf("failed to parse distribution data: %w", err)
+	}
+
+	return distData, nil
+}

cmd/test_openinstall_pkg/main.go

@@ -0,0 +1,68 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/perfect-panel/server/pkg/openinstall"
+)
+
+func main() {
+	fmt.Println("========================================")
+	fmt.Println("OpenInstall 包测试")
+	fmt.Println("========================================")
+	fmt.Println()
+
+	// 使用真实的 ApiKey
+	apiKey := "a7596bc007f31a98ca551e33a75d3bb5997b0b94027c6e988d3c0af1"
+
+	client := openinstall.NewClient(apiKey)
+
+	ctx := context.Background()
+	endDate := time.Now()
+	startDate := endDate.AddDate(0, 0, -7) // 最近7天
+
+	fmt.Printf("获取统计数据：%s 到 %s\n", startDate.Format("2006-01-02"), endDate.Format("2006-01-02"))
+	fmt.Println("========================================")
+
+	// 测试 GetPlatformStats
+	stats, err := client.GetPlatformStats(ctx, startDate, endDate)
+	if err != nil {
+		fmt.Printf("❌ 获取失败: %v\n", err)
+		return
+	}
+
+	fmt.Println("✅ 成功获取平台统计数据!")
+	fmt.Println()
+	for _, stat := range stats {
+		fmt.Printf("平台: %s\n", stat.Platform)
+		fmt.Printf("  访问量(Visits): %d\n", stat.Visits)
+		fmt.Printf("  点击量(Clicks): %d\n", stat.Clicks)
+		fmt.Println()
+	}
+
+	// 测试 GetGrowthData
+	fmt.Println("========================================")
+	fmt.Println("测试每日增长数据:")
+	fmt.Println("========================================")
+
+	growthData, err := client.GetGrowthData(ctx, startDate, endDate, "daily")
+	if err != nil {
+		fmt.Printf("❌ 获取失败: %v\n", err)
+		return
+	}
+
+	fmt.Printf("✅ 成功获取 %d 天的数据!\n\n", len(growthData))
+	for _, data := range growthData {
+		if data.Visit > 0 || data.Click > 0 || data.Install > 0 {
+			fmt.Printf("日期: %s - 访问:%d, 点击:%d, 安装:%d, 注册:%d\n",
+				data.Date, data.Visit, data.Click, data.Install, data.Register)
+		}
+	}
+
+	fmt.Println()
+	fmt.Println("========================================")
+	fmt.Println("测试完成！")
+	fmt.Println("========================================")
+}

cmd/test_platform_downloads/main.go

@@ -0,0 +1,147 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/url"
+	"time"
+)
+
+const (
+	apiBaseURL = "https://data.openinstall.com"
+	apiKey     = "a7596bc007f31a98ca551e33a75d3bb5997b0b94027c6e988d3c0af1"
+)
+
+type APIResponse struct {
+	Code  int             `json:"code"`
+	Error *string         `json:"error"`
+	Body  json.RawMessage `json:"body"`
+}
+
+type DistributionData struct {
+	Key   string `json:"key"`
+	Value int64  `json:"value"`
+}
+
+func main() {
+	fmt.Println("========================================")
+	fmt.Println("测试各端下载量统计（1月份完整数据）")
+	fmt.Println("========================================")
+	fmt.Println()
+
+	ctx := context.Background()
+
+	// 测试1月份数据
+	now := time.Now()
+	startOfLastMonth := time.Date(now.Year(), now.Month()-1, 1, 0, 0, 0, 0, now.Location())
+	endOfLastMonth := time.Date(now.Year(), now.Month(), 1, 0, 0, 0, 0, now.Location()).AddDate(0, 0, -1)
+
+	fmt.Printf("测试时间段: %s 到 %s\n", startOfLastMonth.Format("2006-01-02"), endOfLastMonth.Format("2006-01-02"))
+	fmt.Println("========================================\n")
+
+	// 获取各平台数据
+	platforms := []struct {
+		name     string
+		platform string
+		display  string
+	}{
+		{"iOS", "ios", "iPhone/iPad"},
+		{"Android", "android", "Android"},
+	}
+
+	totalCount := int64(0)
+	platformCounts := make(map[string]int64)
+
+	for _, p := range platforms {
+		fmt.Printf("获取 %s 平台数据...\n", p.name)
+
+		data, err := getDeviceDistribution(ctx, startOfLastMonth, endOfLastMonth, p.platform, "total")
+		if err != nil {
+			fmt.Printf("  ❌ 失败: %v\n\n", err)
+			continue
+		}
+
+		count := int64(0)
+		for _, item := range data {
+			count += item.Value
+		}
+
+		platformCounts[p.display] = count
+		totalCount += count
+
+		fmt.Printf("  ✅ %s: %d\n\n", p.display, count)
+	}
+
+	// 输出汇总
+	fmt.Println("========================================")
+	fmt.Println("汇总结果（按界面格式）:")
+	fmt.Println("========================================")
+	fmt.Printf("\n各端下载量: %d\n", totalCount)
+	fmt.Println("----------------------------------------")
+	fmt.Printf("📱 iPhone/iPad: %d\n", platformCounts["iPhone/iPad"])
+	fmt.Printf("🤖 Android: %d\n", platformCounts["Android"])
+	fmt.Printf("💻 Windows: %d (暂不支持)\n", int64(0))
+	fmt.Printf("🍎 Mac: %d (暂不支持)\n\n", int64(0))
+
+	// 说明
+	fmt.Println("========================================")
+	fmt.Println("注意事项:")
+	fmt.Println("========================================")
+	fmt.Println("1. OpenInstall 统计的是「安装激活量」，非纯下载量")
+	fmt.Println("2. Windows/Mac 数据需要通过其他方式获取")
+	fmt.Println("3. 如需当月数据，请在月中测试")
+}
+
+func getDeviceDistribution(ctx context.Context, startDate, endDate time.Time, platform, sumBy string) ([]DistributionData, error) {
+	apiURL := fmt.Sprintf("%s/data/sum/growth", apiBaseURL)
+
+	params := url.Values{}
+	params.Add("apiKey", apiKey)
+	params.Add("beginDate", startDate.Format("2006-01-02"))
+	params.Add("endDate", endDate.Format("2006-01-02"))
+	params.Add("platform", platform)
+	params.Add("sumBy", sumBy)
+	params.Add("excludeDuplication", "0")
+
+	fullURL := fmt.Sprintf("%s?%s", apiURL, params.Encode())
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, fullURL, nil)
+	if err != nil {
+		return nil, fmt.Errorf("failed to create request: %w", err)
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return nil, fmt.Errorf("failed to send request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		return nil, fmt.Errorf("failed to read response: %w", err)
+	}
+
+	var apiResp APIResponse
+	if err := json.Unmarshal(body, &apiResp); err != nil {
+		return nil, fmt.Errorf("failed to parse response: %w", err)
+	}
+
+	if apiResp.Code != 0 {
+		errMsg := "unknown error"
+		if apiResp.Error != nil {
+			errMsg = *apiResp.Error
+		}
+		return nil, fmt.Errorf("API error (code=%d): %s", apiResp.Code, errMsg)
+	}
+
+	var distData []DistributionData
+	if err := json.Unmarshal(apiResp.Body, &distData); err != nil {
+		return nil, fmt.Errorf("failed to parse distribution data: %w", err)
+	}
+
+	return distData, nil
+}

cmd/test_platform_stats/main.go

@@ -0,0 +1,66 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+
+	"github.com/perfect-panel/server/pkg/openinstall"
+)
+
+func main() {
+	fmt.Println("========================================")
+	fmt.Println("测试 GetPlatformDownloads 功能")
+	fmt.Println("========================================")
+	fmt.Println()
+
+	// 使用真实的 ApiKey
+	apiKey := "a7596bc007f31a98ca551e33a75d3bb5997b0b94027c6e988d3c0af1"
+
+	client := openinstall.NewClient(apiKey)
+
+	ctx := context.Background()
+
+	// 调用 GetPlatformDownloads 获取当月数据+ 环比
+	platformDownloads, err := client.GetPlatformDownloads(ctx, "")
+	if err != nil {
+		fmt.Printf("❌ 获取失败: %v\n", err)
+		return
+	}
+
+	fmt.Println("✅ 成功获取各端下载量统计!")
+	fmt.Println()
+
+	// 格式化输出
+	data, _ := json.MarshalIndent(platformDownloads, "", "  ")
+	fmt.Println(string(data))
+
+	fmt.Println()
+	fmt.Println("========================================")
+	fmt.Println("界面数据展示：")
+	fmt.Println("========================================")
+	fmt.Printf("\n各端下载量: %d\n", platformDownloads.Total)
+	fmt.Println("----------------------------------------")
+	fmt.Printf("📱 iPhone/iPad: %d\n", platformDownloads.IOS)
+	fmt.Printf("🤖 Android: %d\n", platformDownloads.Android)
+	fmt.Printf("💻 Windows: %d\n", platformDownloads.Windows)
+	fmt.Printf("🍎 Mac: %d\n\n", platformDownloads.Mac)
+
+	if platformDownloads.Comparison != nil {
+		fmt.Println("相比前一个月:")
+		if platformDownloads.Comparison.Change >= 0 {
+			fmt.Printf("  📈 增长 %d (%.2f%%)\n",
+				platformDownloads.Comparison.Change,
+				platformDownloads.Comparison.ChangePercent)
+		} else {
+			fmt.Printf("  📉 下降 %d (%.2f%%)\n",
+				-platformDownloads.Comparison.Change,
+				-platformDownloads.Comparison.ChangePercent)
+		}
+		fmt.Printf("  上月总量: %d\n", platformDownloads.Comparison.LastMonthTotal)
+	}
+
+	fmt.Println("\n========================================")
+	fmt.Println("测试完成！")
+	fmt.Println("========================================")
+}

cmd/test_restore/main.go

@@ -0,0 +1,111 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"strings"
+	"time"
+
+	pkgaes "github.com/perfect-panel/server/pkg/aes"
+)
+
+// 替换为您实际的服务器地址
+const BaseURL = "https://api.hifast.biz"
+
+// 替换为您实际的用户登录 Token (Authorization: Bearer <token>)
+const UserToken = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJEZXZpY2VJZCI6MzgzLCJMb2dpblR5cGUiOiJkZXZpY2UiLCJTZXNzaW9uSWQiOiIwMTliMmFmZC1jMjUwLTc1YmItODQzMy04NDMyNWVmZGRkMzMiLCJVc2VySWQiOjM4MywiZXhwIjoxNzY2NTU3NjMyLCJpYXQiOjE3NjU5NTI4MzJ9.kkcT4ojXG9qn_aVqMaGqUUXhHcZXHy49k5Vn05Et9OM"
+
+// 替换为您在后台配置的设备通信密钥 (Security Secret)
+const DeviceSecret = "c0qhq99a-nq8h-ropg-wrlc-ezj4dlkxqpzx"
+
+// 替换为您要测试的 Transaction ID
+const TestTransactionID = "2000001083238483"
+
+func main() {
+	fmt.Println("开始测试 Restore 接口 (AES 加密模式)...")
+	fmt.Printf("目标 Transaction ID: %s\n", TestTransactionID)
+
+	// 1. 构造原始请求数据
+	payload := map[string]interface{}{
+		"transactions": []string{TestTransactionID},
+	}
+	payloadBytes, _ := json.Marshal(payload)
+	fmt.Printf("原始请求体: %s\n", string(payloadBytes))
+
+	// 2. 加密数据
+	if DeviceSecret == "YOUR_DEVICE_SECRET_HERE" {
+		log.Fatal("❌ 请在代码中设置 DeviceSecret (对应后台配置的 Security Secret)")
+	}
+	encryptedData, iv, err := pkgaes.Encrypt(payloadBytes, DeviceSecret)
+	if err != nil {
+		log.Fatalf("加密失败: %v", err)
+	}
+
+	// 3. 构造最终的请求体 (符合 DeviceMiddleware 要求的格式)
+	// DeviceMiddleware 期望的格式是: { "data": "Base64Cipher", "time": "Nonce/IV" }
+	// 或者直接在 URL Query 中传 ?data=...&time=...
+	// 这里我们模拟 POST JSON body 的方式
+	finalPayload := map[string]interface{}{
+		"data": encryptedData,
+		"time": iv,
+	}
+	finalBytes, _ := json.Marshal(finalPayload)
+	fmt.Printf("加密后请求体: %s\n", string(finalBytes))
+
+	url := fmt.Sprintf("%s/v1/public/iap/apple/restore", BaseURL)
+	req, _ := http.NewRequest("POST", url, strings.NewReader(string(finalBytes)))
+	req.Header.Set("Content-Type", "application/json")
+
+	// 添加必要的 Header 以通过 DeviceMiddleware
+	req.Header.Set("Login-Type", "device") // 触发 DeviceMiddleware 的解密逻辑
+	// 注意：这里需要替换为真实有效的 Bearer Token，否则会报 401
+	// 您可以先登录后台或者使用 cmd/test_apple_iap 工具生成的 token 也是不可用的，必须是业务系统的 token
+	// 为了演示，这里留空，实际运行前请填入
+	if UserToken != "YOUR_USER_TOKEN_HERE" {
+		req.Header.Set("Authorization", "Bearer "+UserToken)
+	} else {
+		fmt.Println("⚠️ 警告: 未设置 UserToken，请求可能会失败 (401 Unauthorized)")
+	}
+
+	client := &http.Client{Timeout: 10 * time.Second}
+	start := time.Now()
+	resp, err := client.Do(req)
+	if err != nil {
+		log.Fatalf("请求失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	duration := time.Since(start)
+	body, _ := io.ReadAll(resp.Body)
+
+	fmt.Printf("请求耗时: %v\n", duration)
+	fmt.Printf("状态码: %d\n", resp.StatusCode)
+	fmt.Printf("响应内容: %s\n", string(body))
+
+	if resp.StatusCode == 200 {
+		var result map[string]interface{}
+		if err := json.Unmarshal(body, &result); err == nil {
+			// 检查业务状态码
+			if code, ok := result["code"].(float64); ok && int(code) != 200 {
+				fmt.Printf("❌ 业务处理失败: code=%d, msg=%s\n", int(code), result["msg"])
+				return
+			}
+
+			fmt.Println("✅ Restore 接口调用成功！")
+			if data, ok := result["data"].(map[string]interface{}); ok {
+				if success, ok := data["success"].(bool); ok && success {
+					fmt.Println("   业务处理成功: success=true")
+				} else {
+					fmt.Println("   业务处理结果未知:", data)
+				}
+			} else {
+				fmt.Println("   无数据返回或格式不符")
+			}
+		}
+	} else {
+		fmt.Println("❌ 接口调用失败")
+	}
+}

cmd/test_session_reuse/main.go

@@ -0,0 +1,219 @@
+package main
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"time"
+
+	"github.com/redis/go-redis/v9"
+)
+
+/*
+ * 设备复用 Session 测试工具
+ *
+ * 这个测试工具用于验证设备复用 session 的逻辑是否正确
+ * 模拟场景：
+ * 1. 设备A第一次登录 - 创建新 session
+ * 2. 设备A再次登录 - 应该复用旧 session
+ * 3. 设备A的session过期 - 应该创建新 session
+ */
+
+const (
+	SessionIdKey          = "auth:session_id"
+	DeviceCacheKeyKey     = "auth:device"
+	UserSessionsKeyPrefix = "auth:user_sessions:"
+)
+
+func main() {
+	// 连接 Redis
+	rds := redis.NewClient(&redis.Options{
+		Addr:     "localhost:6379", // 修改为你的 Redis 地址
+		Password: "",               // 修改为你的 Redis 密码
+		DB:       0,
+	})
+
+	ctx := context.Background()
+
+	// 检查 Redis 连接
+	if err := rds.Ping(ctx).Err(); err != nil {
+		log.Fatalf("❌ 连接 Redis 失败: %v", err)
+	}
+	fmt.Println("✅ Redis 连接成功")
+
+	// 测试参数
+	testDeviceID := "test-device-12345"
+	testUserID := int64(9999)
+	sessionExpire := 10 * time.Second // 测试用，设置较短的过期时间
+
+	fmt.Println("\n========== 开始测试 ==========")
+
+	// 清理测试数据
+	cleanup(ctx, rds, testDeviceID, testUserID)
+
+	// 测试1: 第一次登录 - 应该创建新 session
+	fmt.Println("\n📋 测试1: 第一次登录")
+	sessionId1, isReuse1 := simulateLogin(ctx, rds, testDeviceID, testUserID, sessionExpire)
+	if isReuse1 {
+		fmt.Println("❌ 测试1失败: 第一次登录不应该复用 session")
+	} else {
+		fmt.Printf("✅ 测试1通过: 创建了新 session: %s\n", sessionId1)
+	}
+
+	// 检查 session 数量
+	count1 := getSessionCount(ctx, rds, testUserID)
+	fmt.Printf("   当前 session 数量: %d\n", count1)
+
+	// 测试2: 再次登录（session 有效）- 应该复用 session
+	fmt.Println("\n📋 测试2: 再次登录（session 有效）")
+	sessionId2, isReuse2 := simulateLogin(ctx, rds, testDeviceID, testUserID, sessionExpire)
+	if !isReuse2 {
+		fmt.Println("❌ 测试2失败: 应该复用旧 session")
+	} else if sessionId1 != sessionId2 {
+		fmt.Printf("❌ 测试2失败: sessionId 不一致 (%s vs %s)\n", sessionId1, sessionId2)
+	} else {
+		fmt.Printf("✅ 测试2通过: 复用了旧 session: %s\n", sessionId2)
+	}
+
+	// 检查 session 数量 - 应该仍然是1
+	count2 := getSessionCount(ctx, rds, testUserID)
+	fmt.Printf("   当前 session 数量: %d (预期: 1)\n", count2)
+	if count2 != 1 {
+		fmt.Println("❌ session 数量不正确！")
+	}
+
+	// 测试3: 模拟多设备登录
+	fmt.Println("\n📋 测试3: 多设备登录")
+	testDeviceID2 := "test-device-67890"
+	sessionId3, isReuse3 := simulateLogin(ctx, rds, testDeviceID2, testUserID, sessionExpire)
+	if isReuse3 {
+		fmt.Println("❌ 测试3失败: 新设备不应该复用 session")
+	} else {
+		fmt.Printf("✅ 测试3通过: 设备B创建了新 session: %s\n", sessionId3)
+	}
+
+	// 检查 session 数量 - 应该是2
+	count3 := getSessionCount(ctx, rds, testUserID)
+	fmt.Printf("   当前 session 数量: %d (预期: 2)\n", count3)
+
+	// 测试4: 设备A再次登录 - 仍然应该复用
+	fmt.Println("\n📋 测试4: 设备A再次登录")
+	sessionId4, isReuse4 := simulateLogin(ctx, rds, testDeviceID, testUserID, sessionExpire)
+	if !isReuse4 {
+		fmt.Println("❌ 测试4失败: 应该复用设备A的旧 session")
+	} else if sessionId1 != sessionId4 {
+		fmt.Printf("❌ 测试4失败: sessionId 不一致 (%s vs %s)\n", sessionId1, sessionId4)
+	} else {
+		fmt.Printf("✅ 测试4通过: 设备A复用了旧 session: %s\n", sessionId4)
+	}
+
+	// 检查 session 数量 - 仍然应该是2
+	count4 := getSessionCount(ctx, rds, testUserID)
+	fmt.Printf("   当前 session 数量: %d (预期: 2)\n", count4)
+
+	// 测试5: 等待 session 过期后再登录
+	fmt.Println("\n📋 测试5: 等待 session 过期后再登录")
+	fmt.Printf("   等待 %v ...\n", sessionExpire+time.Second)
+	time.Sleep(sessionExpire + time.Second)
+
+	sessionId5, isReuse5 := simulateLogin(ctx, rds, testDeviceID, testUserID, sessionExpire)
+	if isReuse5 {
+		fmt.Println("❌ 测试5失败: session 过期后不应该复用")
+	} else {
+		fmt.Printf("✅ 测试5通过: 创建了新 session: %s\n", sessionId5)
+	}
+
+	// 测试6: 设备转移场景（关键安全测试）
+	fmt.Println("\n📋 测试6: 设备转移场景（用户A的设备被用户B使用）")
+	testDeviceID3 := "test-device-transfer"
+	testUserA := int64(1001)
+	testUserB := int64(1002)
+
+	// 用户A用设备登录
+	cleanup(ctx, rds, testDeviceID3, testUserA)
+	cleanup(ctx, rds, testDeviceID3, testUserB)
+	sessionA, _ := simulateLogin(ctx, rds, testDeviceID3, testUserA, sessionExpire)
+	fmt.Printf("   用户A登录，session: %s\n", sessionA)
+
+	// 用户B用同一设备登录（设备转移场景）
+	sessionB, isReuseB := simulateLogin(ctx, rds, testDeviceID3, testUserB, sessionExpire)
+	if isReuseB {
+		fmt.Println("❌ 测试6失败: 用户B不应该复用用户A的session！（安全漏洞）")
+	} else {
+		fmt.Printf("✅ 测试6通过: 用户B创建了新 session: %s\n", sessionB)
+	}
+
+	// 验证用户A和B的session不同
+	if sessionA == sessionB {
+		fmt.Println("❌ 安全问题: 两个用户使用了相同的session！")
+	} else {
+		fmt.Println("✅ 安全验证通过: 两个用户使用不同的session")
+	}
+	cleanup(ctx, rds, testDeviceID, testUserID)
+	cleanup(ctx, rds, testDeviceID2, testUserID)
+
+	fmt.Println("\n========== 测试完成 ==========")
+}
+
+// simulateLogin 模拟登录逻辑
+// 返回: sessionId, isReuse (是否复用了旧 session)
+func simulateLogin(ctx context.Context, rds *redis.Client, deviceID string, userID int64, expire time.Duration) (string, bool) {
+	var sessionId string
+	var reuseSession bool
+
+	deviceCacheKey := fmt.Sprintf("%v:%v", DeviceCacheKeyKey, deviceID)
+
+	// 检查设备是否有旧的有效 session
+	if oldSid, getErr := rds.Get(ctx, deviceCacheKey).Result(); getErr == nil && oldSid != "" {
+		// 检查旧 session 是否仍然有效 AND 属于当前用户
+		oldSessionKey := fmt.Sprintf("%v:%v", SessionIdKey, oldSid)
+		if uidStr, existErr := rds.Get(ctx, oldSessionKey).Result(); existErr == nil && uidStr != "" {
+			// 验证 session 属于当前用户 (防止设备转移后复用其他用户的session)
+			if uidStr == fmt.Sprintf("%d", userID) {
+				sessionId = oldSid
+				reuseSession = true
+			}
+		}
+	}
+
+	if !reuseSession {
+		// 生成新的 sessionId
+		sessionId = fmt.Sprintf("session-%d-%d", userID, time.Now().UnixNano())
+
+		// 添加到用户的 session 集合
+		sessionsKey := fmt.Sprintf("%s%v", UserSessionsKeyPrefix, userID)
+		rds.ZAdd(ctx, sessionsKey, redis.Z{Score: float64(time.Now().Unix()), Member: sessionId})
+		rds.Expire(ctx, sessionsKey, expire)
+	}
+
+	// 存储/刷新 session
+	sessionIdCacheKey := fmt.Sprintf("%v:%v", SessionIdKey, sessionId)
+	rds.Set(ctx, sessionIdCacheKey, userID, expire)
+
+	// 存储/刷新设备到session的映射
+	rds.Set(ctx, deviceCacheKey, sessionId, expire)
+
+	return sessionId, reuseSession
+}
+
+// getSessionCount 获取用户的 session 数量
+func getSessionCount(ctx context.Context, rds *redis.Client, userID int64) int64 {
+	sessionsKey := fmt.Sprintf("%s%v", UserSessionsKeyPrefix, userID)
+	count, _ := rds.ZCard(ctx, sessionsKey).Result()
+	return count
+}
+
+// cleanup 清理测试数据
+func cleanup(ctx context.Context, rds *redis.Client, deviceID string, userID int64) {
+	deviceCacheKey := fmt.Sprintf("%v:%v", DeviceCacheKeyKey, deviceID)
+	sessionsKey := fmt.Sprintf("%s%v", UserSessionsKeyPrefix, userID)
+
+	// 获取设备的 sessionId
+	if sid, err := rds.Get(ctx, deviceCacheKey).Result(); err == nil {
+		sessionIdCacheKey := fmt.Sprintf("%v:%v", SessionIdKey, sid)
+		rds.Del(ctx, sessionIdCacheKey)
+	}
+
+	rds.Del(ctx, deviceCacheKey)
+	rds.Del(ctx, sessionsKey)
+}

cmd/update_custom_data/main.go

@@ -0,0 +1,124 @@
+package main
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+
+	"gopkg.in/yaml.v3"
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+)
+
+// 配置结构
+type AppConfig struct {
+	MySQL struct {
+		Addr     string `yaml:"Addr"`
+		Dbname   string `yaml:"Dbname"`
+		Username string `yaml:"Username"`
+		Password string `yaml:"Password"`
+		Config   string `yaml:"Config"`
+	} `yaml:"MySQL"`
+}
+
+type System struct {
+	Key   string `gorm:"column:key;primaryKey"`
+	Value string `gorm:"column:value"`
+}
+
+func main() {
+	fmt.Println("====== 更新 CustomData ======")
+
+	// 1. 读取配置
+	cfgData, err := os.ReadFile("configs/ppanel.yaml")
+	if err != nil {
+		fmt.Printf("读取配置失败: %v\n", err)
+		return
+	}
+
+	var cfg AppConfig
+	if err := yaml.Unmarshal(cfgData, &cfg); err != nil {
+		fmt.Printf("解析配置失败: %v\n", err)
+		return
+	}
+
+	// 2. 连接数据库
+	dsn := fmt.Sprintf("%s:%s@tcp(%s)/%s?%s",
+		cfg.MySQL.Username, cfg.MySQL.Password, cfg.MySQL.Addr, cfg.MySQL.Dbname, cfg.MySQL.Config)
+	db, err := gorm.Open(mysql.Open(dsn), &gorm.Config{})
+	if err != nil {
+		fmt.Printf("数据库连接失败: %v\n", err)
+		return
+	}
+	fmt.Println("✅ 数据库连接成功")
+
+	// 3. 查找 SiteConfig (在 system 表中，key 通常是 'SiteConfig')
+	// 注意：system 表结构可能由 key, value 组成
+	// 我们需要查找包含 CustomData 的那个配置
+
+	// 先尝试直接查找 SiteConfig
+	var sysConfig System
+	// 根据之前的查看，SiteConfig 可能不是直接存 JSON，而是字段。
+	// 但用户之前 curl 看到的是 custom_data 字段。
+	// 让我们查找包含 "shareUrl" 的记录来定位
+	err = db.Table("system").Where("value LIKE ?", "%shareUrl%").First(&sysConfig).Error
+	if err != nil {
+		fmt.Printf("未找到包含 shareUrl 的配置: %v\n", err)
+		// 尝试列出所有 key
+		var keys []string
+		db.Table("system").Pluck("key", &keys)
+		fmt.Printf("现有 Keys: %v\n", keys)
+		return
+	}
+
+	fmt.Printf("找到配置 Key: %s\n", sysConfig.Key)
+	fmt.Printf("原始内容: %s\n", sysConfig.Value)
+
+	// 4. 解析并修改
+	// System Value 可能是 SiteConfig 的 JSON，或者 CustomData 只是其中一个字段
+	// 假设 Value 是 SiteConfig 结构体的 JSON
+	var siteConfigMap map[string]interface{}
+	if err := json.Unmarshal([]byte(sysConfig.Value), &siteConfigMap); err != nil {
+		fmt.Printf("解析 Config Value 失败: %v\n", err)
+		return
+	}
+
+	// 检查是否有 CustomData
+	if customDataStr, ok := siteConfigMap["CustomData"].(string); ok {
+		fmt.Println("找到 CustomData 字段，正在更新...")
+
+		var customDataMap map[string]interface{}
+		if err := json.Unmarshal([]byte(customDataStr), &customDataMap); err != nil {
+			fmt.Printf("解析 CustomData 失败: %v\n", err)
+			return
+		}
+
+		// 添加 domain
+		customDataMap["domain"] = "getsapp.net"
+
+		// 重新序列化 CustomData
+		newCustomDataBytes, _ := json.Marshal(customDataMap)
+		siteConfigMap["CustomData"] = string(newCustomDataBytes)
+
+		fmt.Printf("新的 CustomData: %s\n", string(newCustomDataBytes))
+
+	} else {
+		// 也许 Value 本身就是 CustomData? (不太可能，根据之前的 grep 结果)
+		// 或者 Key 是 'custom_data'?
+		fmt.Println("未在配置中找到 CustomData 字段，尝试直接解析为 CustomData...")
+		// 尝试直接添加 domain 看是否合理
+		siteConfigMap["domain"] = "getsapp.net"
+	}
+
+	// 5. 保存回数据库
+	newConfigBytes, _ := json.Marshal(siteConfigMap)
+	// fmt.Printf("更新后的配置 Value: %s\n", string(newConfigBytes))
+
+	err = db.Table("system").Where("`key` = ?", sysConfig.Key).Update("value", string(newConfigBytes)).Error
+	if err != nil {
+		fmt.Printf("更新数据库失败: %v\n", err)
+		return
+	}
+
+	fmt.Println("✅ 数据库更新成功！")
+}

configs/ppanel.yaml

@@ -0,0 +1,63 @@
+Host: 0.0.0.0
+Port: 8080
+Debug: false
+JwtAuth:
+  AccessSecret: 8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
+  AccessExpire: 604800
+  MaxSessionsPerUser: 2
+  
+Logger:
+  ServiceName: PPanel
+  Mode: console
+  Encoding: plain
+  TimeFormat: '2006-01-02 15:04:05.000'
+  Path: logs
+  Level: debug
+  MaxContentLength: 0
+  Compress: false
+  Stat: true
+  KeepDays: 0
+  StackCooldownMillis: 100
+  MaxBackups: 0
+  MaxSize: 0
+  Rotation: daily
+  FileTimeFormat: 2025-01-01T00:00:00.000Z00:00
+MySQL:
+  Addr: 127.0.0.1:3306
+  Dbname: dev_ppanel
+  Username: root
+  Password: rootpassword
+  Config: charset=utf8mb4&parseTime=true&loc=Asia%2FShanghai
+  MaxIdleConns: 10
+  MaxOpenConns: 10
+  SlowThreshold: 1000
+
+Redis:
+  Host: 127.0.0.1:6379
+  Pass: 
+  DB: 0
+  
+
+Administrator:
+  Password: 
+  Email: 
+Telegram:
+  Enable: false
+  BotID: 0
+  BotName: ""
+  BotToken: "8114337882:AAHkEx03HSu7RxN4IHBJJEnsK9aPPzNLIk0"
+  GroupChatID: "-5012065881"
+  EnableNotify: true
+  WebHookDomain: ""
+
+
+Site:
+  Host: api.airoport.co
+  SiteName: HiFastVPN
+
+Kutt:
+  Enable: true
+  ApiURL: "https://getsapp.net/api/v2"
+  ApiKey: "6JSjGOzLF1NCYQXuUGZjvrkqU0Jy3upDkYX87DPO"
+  TargetURL: ""
+  Domain: "getsapp.net" 

decrypt_download.sh

@@ -0,0 +1,17 @@
+#!/bin/bash
+
+# 解密 Nginx 下载日志中的 data 参数
+# 使用方法:
+#   ./decrypt_download.sh "data=xxx&time=xxx"
+#   或者直接传入整条日志
+
+if [ $# -eq 0 ]; then
+    echo "使用方法:"
+    echo "  $0 'data=JetaR6P9e8G5lZg2KRiAhV6c%2FdMilBtP78bKmsbAxL8%3D&time=2026-02-02T04:35:15.032000'"
+    echo "  或"
+    echo "  $0 '172.245.180.199 - - [02/Feb/2026:04:35:47 +0000] \"GET /v1/common/client/download?data=JetaR6P9e8G5lZg2KRiAhV6c%2FdMilBtP78bKmsbAxL8%3D&time=2026-02-02T04:35:15.032000 HTTP/1.1\"'"
+    exit 1
+fi
+
+cd "$(dirname "$0")/.."
+go run cmd/decrypt_download_data/main.go "$@"

doc/api/log_message_report.md

@@ -0,0 +1,101 @@
+# 客户端错误上报接口文档
+
+## 接口概览
+- 路径：`POST /v1/common/log/message/report`
+- 说明：APP/PC/Web 客户端错误与异常信息上报，服务端入库 `log_message` 表，并提供管理端查询。
+- 认证：无需登录；若走设备安全通道需使用 `Login-Type: device` 与 AES 加密。
+- 中间件：`DeviceMiddleware`（当请求头 `Login-Type=device` 时启用加解密）。
+
+## 请求
+- Headers：
+  - `Content-Type: application/json`
+  - 可选：`Login-Type: device`（启用设备加密通道）
+- Body（JSON）：
+  - `platform` string 必填，客户端平台，如 `android`/`ios`/`windows`/`mac`/`web`
+  - `appVersion` string 可选，应用版本，如 `2.4.1`
+  - `osName` string 可选，系统名称，如 `Android`/`iOS`/`Windows`/`macOS`
+  - `osVersion` string 可选，系统版本，如 `14`
+  - `deviceId` string 可选，设备唯一标识
+  - `sessionId` string 可选，会话标识
+  - `level` uint8 可选，日志等级：`1=fatal`、`2=error`、`3=warn`、`4=info`（默认 `3`）
+  - `errorCode` string 可选，业务或系统错误码
+  - `message` string 必填，错误简述（服务器将超过约 64KB 的内容截断）
+  - `stack` string 可选，堆栈信息（服务器将超过约 1MB 的内容截断）
+  - `context` object 可选，扩展上下文（如接口路径、参数、网络状态等）
+  - `occurredAt` int64 可选，客户端发生时间，毫秒时间戳
+
+- 服务器侧自动填充：
+  - `client_ip`、`user_agent`、`locale` 由请求解析
+  - `user_id` 仅在鉴权后由服务端注入（本接口默认匿名）
+
+## 加密通道（设备）
+- 当使用设备安全通道时（`Login-Type: device`），请求体需要将原始 JSON 加密为：
+  - `data` string：AES 加密后的密文
+  - `time` string：IV/nonce（与密文配套）
+- 服务端会自动解密为明文 JSON，再进行字段校验与入库。
+
+## 响应
+- 成功：
+```
+{
+  "code": 0,
+  "msg": "OK",
+  "data": { "id": 123 }
+}
+```
+- 常见错误：
+  - `{"code":401,"msg":"TooManyRequests"}` 触发速率限制（设备ID或IP维度）
+  - `{"code":400,"msg":"InvalidParams"}` 参数校验失败（缺少必填或类型不符）
+  - `{"code":10001,"msg":"DatabaseQueryError"}` 数据库操作异常
+
+## 速率限制
+- 默认按 `deviceId` 或 `client_ip` 每分钟最多约 `120` 条，超限即返回 `TooManyRequests`。
+
+## 去重策略
+- 服务端计算 `digest = sha256(message|stack|errorCode|appVersion|platform)` 并尝试唯一入库，重复日志可能返回已存在记录的 `id`。
+
+## 示例
+- 明文上报（推荐测试使用）：
+```
+curl -X POST http://localhost:8080/v1/common/log/message/report \
+  -H 'Content-Type: application/json' \
+  -d '{
+    "platform": "android",
+    "appVersion": "2.4.1",
+    "osName": "Android",
+    "osVersion": "14",
+    "deviceId": "and-9a7f3e2c-01",
+    "sessionId": "sess-73f8a2a4",
+    "level": 2,
+    "errorCode": "ORDER_RENEWAL_TIMEOUT",
+    "message": "订单续费接口超时：/v1/public/order/renewal",
+    "stack": "TimeoutException: request exceeded 8000ms\\n at HttpClient.post(HttpClient.kt:214)\\n at RenewalRepository.submit(RenewalRepository.kt:87)",
+    "context": {
+      "api": "/v1/public/order/renewal",
+      "method": "POST",
+      "endpoint": "https://api.example.com/v1/public/order/renewal",
+      "httpStatus": 504,
+      "responseTimeMs": 8123,
+      "retryCount": 2,
+      "network": { "type": "cellular", "carrier": "China Mobile" }
+    },
+    "occurredAt": 1733200005123
+  }'
+```
+
+- 设备加密上报（示意）：
+```
+# 将原始JSON通过AES加密得到密文data与随机IV time
+curl -X POST http://localhost:8080/v1/common/log/message/report \
+  -H 'Content-Type: application/json' \
+  -H 'Login-Type: device' \
+  -d '{"data":"<aes_cipher>","time":"<iv_nonce>"}'
+```
+
+## 管理端查询（用于联调验证）
+- 列表：`GET /v1/admin/log/message/error/list`（需 `Authorization`）
+- 详情：`GET /v1/admin/log/message/error/detail?id=...`
+
+## 备注
+- 字段尽量避免携带敏感信息（密码、密钥、完整令牌等）；如需调试请截断或脱敏后上报。
+- 建议在 APP/PC 端统一封装上报模块，包含：字段收集、级别过滤、采样策略、离线缓存与重试、速率限制配合。

doc/config-zh.md

@@ -159,3 +159,43 @@ Administer: # 管理员登录配置
 - **JWT**：为 `JwtAuth` 的 `AccessSecret` 设置强密钥以增强安全性。
 
 如需进一步帮助，请参考 PPanel 官方文档或联系支持团队。
+
+## 6. Apple IAP（非续期订阅）配置
+
+- 通过 `Site.CustomData` 配置内购商品与权益映射，示例：
+
+```json
+{
+  "iapProductMap": {
+    "com.airport.vpn.pass.30d": {
+      "description": "30天通行证",
+      "priceText": "¥28.00",
+      "durationDays": 30,
+      "tier": "Basic",
+      "subscribeId": 1001
+    },
+    "com.airport.vpn.pass.90d": {
+      "description": "90天通行证",
+      "priceText": "¥68.00",
+      "durationDays": 90,
+      "tier": "Pro",
+      "subscribeId": 1002
+    }
+  },
+  "iapBundleId": "co.airoport.app.ios"
+}
+```
+
+- 字段说明：
+  - `iapProductMap`：`productId → 映射`，用于后端计算到期时间与绑定内部计划（`subscribeId`）。
+  - `description`/`priceText`：客户端展示文案。
+  - `durationDays`：非续期订阅的有效天数。
+  - `tier`：权益等级标签，用于状态返回。
+  - `subscribeId`：绑定到现有 `subscribe` 计划 ID。
+  - `iapBundleId`：客户端 Bundle ID（可用于后端基础校验）。
+
+### 接口速览
+- `GET /v1/public/iap/apple/products`：返回可售商品与文案（基于 `iapProductMap`）。
+- `POST /v1/public/iap/apple/transactions/attach`：绑定一次购买到用户，入参 `signed_transaction_jws`。
+- `POST /v1/public/iap/apple/restore`：恢复历史购买（批量 JWS）。
+- `GET /v1/public/iap/apple/status`：返回用户的 IAP 权益状态与到期时间。

doc/ios-iap-guide.md

@@ -0,0 +1,228 @@
+# iOS 内购接入与接口调用指南（StoreKit 2 + 服务端接口）
+
+## 概述
+本指南面向 iOS App 开发者，说明使用 StoreKit 2 完成「非续期订阅/非消耗型」的购买、验证与绑定流程，并与后端接口打通，实现用户权益发放与恢复。
+
+## 商品与映射
+- Apple 端必须在 App Store Connect 创建对应 `productId` 的内购商品（非续期订阅或非消耗型）。
+- 服务端维护「商品映射」：`productId → {durationDays, tier, subscribeId}`，用于计算到期与绑定内部订阅计划（`subscribeId`）。
+- 若某 `productId` 暂未在服务端配置，客户端可在绑定请求中携带回退字段：`duration_days`、`subscribe_id`、`tier`。服务端将按 App 的定义进行绑定。
+
+## 客户端整体流程（StoreKit 2）
+1) 检查支付能力
+   - `if !AppStore.canMakePayments { 隐藏商店并提示 }`
+2) 拉取商品
+   - 通过已知 `productId` 列表调用 `Product.products(for:)`，展示价格与描述
+3) 发起购买并本地验证
+   - 调用 `try await product.purchase()` 弹出系统确认表单
+   - 成功后 `let transaction = try verification.payloadValue`，并取到 `transaction.signedData`（JWS）
+4) 绑定购买（服务端 attach）
+   - 将 `signedData` 作为 `signed_transaction_jws` POST 至 `/v1/public/iap/apple/transactions/attach`
+   - 若服务端未配置该 `productId`，同时携带：`duration_days`（有效天数）、`subscribe_id`（内部订阅计划 ID）、`tier`（展示用标签）
+5) 恢复购买（restore）
+   - `try await AppStore.sync()` 后，遍历 `Transaction.currentEntitlements` 并逐条 `verify()`
+   - 收集每条 `signedData`，批量 POST 至 `/v1/public/iap/apple/restore`
+6) 查询状态（status）
+   - `GET /v1/public/iap/apple/status` 获取 `active/expires_at/tier`，用于 UI 展示与权限控制
+7) 退款入口（HIG 建议）
+   - 在购买帮助页提供「请求退款」按钮，调用 `beginRefundRequest(for:in:)`
+
+## 接口详细
+所有接口均需要携带用户登录态的 `Authorization: Bearer <token>`。
+- 绑定购买（attach）
+  - `POST /v1/public/iap/apple/transactions/attach`
+  - 请求体（映射一致时，仅需 `signed_transaction_jws`）：
+    ```json
+    {
+      "signed_transaction_jws": "<StoreKit返回的signedData>"
+    }
+    ```
+  - 请求体（映射不一致时的回退）：
+    ```json
+    {
+      "signed_transaction_jws": "<signedData>",
+      "duration_days": 30,
+      "subscribe_id": 1001,
+      "tier": "Basic"
+    }
+    ```
+  - 响应示例：
+    ```json
+    {
+      "code": 200,
+      "msg": "success",
+      "data": { "expires_at": 1736860000, "tier": "Basic" }
+    }
+    ```
+- 恢复购买（restore）
+  - `POST /v1/public/iap/apple/restore`
+  - 请求体：
+    ```json
+    {
+      "transactions": ["<signedData-1>", "<signedData-2>"]
+    }
+    ```
+  - 响应示例：
+    ```json
+    {
+      "code": 200,
+      "msg": "success",
+      "data": { "success": true }
+    }
+    ```
+- 查询状态（status）
+  - `GET /v1/public/iap/apple/status`
+  - 响应示例：
+    ```json
+    {
+      "code": 200,
+      "msg": "success",
+      "data": { "active": true, "expires_at": 1736860000, "tier": "Basic" }
+    }
+    ```
+
+## 收银台统一返回契约（含 Apple IAP）
+
+- 统一下单接口返回的 `type` 用于客户端决定支付方式；当为 Apple IAP 时，返回 Apple 商品 ID 列表，前端直接用 StoreKit 购买：
+- Apple IAP 收银台返回示例（建议规范）：
+  ```json
+  {
+    "code": 200,
+    "msg": "success",
+    "data": {
+      "type": "apple_iap",
+      "product_ids": [
+        "merchant.hifastvpn.day7",
+        "merchant.hifastvpn.day30"
+      ],
+      "hint": "Use StoreKit to purchase the given product_ids, then POST signedData to attach."
+    }
+  }
+  ```
+- 其他支付平台保持原有结构：
+  - Stripe：`{ "type":"stripe", "stripe": { "publishable_key": "...", "client_secret":"..." } }`
+  - URL 跳转：`{ "type":"url", "checkout_url": "https://..." }`
+  - 二维码：`{ "type":"qr", "checkout_url": "..." }`
+
+### 前端处理逻辑（统一出口）
+- 收银台响应分流：
+  - `type === "apple_iap"` → 取 `product_ids`，用 StoreKit 拉取并购买，成功后将 `signedData` 调用 `attach`
+  - `type === "stripe"` → 初始化 Stripe 支付组件
+  - `type === "url"` → 直接跳转到返回的 `checkout_url`
+  - `type === "qr"` → 展示二维码URL
+
+### 命名规则（推荐）
+- Apple 商品命名统一为：`merchant.hifastvpn.day${quantity}`，例如：
+  - 7 天：`merchant.hifastvpn.day7`
+  - 30 天：`merchant.hifastvpn.day30`
+  - 90 天：`merchant.hifastvpn.day90`
+- 新增套餐时只需：在 App Store Connect 新增对应商品，并在 Web 后台/配置新增映射（`durationDays/tier/subscribeId`），前端无需改代码即可使用。
+
+## Swift 示例
+
+### 拉取商品与展示
+```swift
+import StoreKit
+
+let productIds = ["com.airport.vpn.pass.30d", "com.airport.vpn.pass.90d"]
+let products = try await Product.products(for: productIds)
+// 展示 products 的价格与描述
+```
+
+### 发起购买并绑定
+```swift
+import StoreKit
+
+func purchaseAndAttach(product: Product, token: String) async throws {
+    let result = try await product.purchase()
+    switch result {
+    case .success(let verification):
+        let transaction = try verification.payloadValue
+        let jws = transaction.signedData
+
+        struct AttachReq: Codable {
+            let signed_transaction_jws: String
+            // 若映射不一致，则补齐以下字段
+            let duration_days: Int64?
+            let subscribe_id: Int64?
+            let tier: String?
+        }
+        let body = AttachReq(
+            signed_transaction_jws: jws,
+            duration_days: nil,      // 映射一致时可为 nil
+            subscribe_id: nil,
+            tier: nil
+        )
+        var req = URLRequest(url: URL(string: "https://api.yourdomain.com/v1/public/iap/apple/transactions/attach")!)
+        req.httpMethod = "POST"
+        req.addValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+        req.addValue("application/json", forHTTPHeaderField: "Content-Type")
+        req.httpBody = try JSONEncoder().encode(body)
+
+        let (data, _) = try await URLSession.shared.data(for: req)
+        // 解析返回并更新 UI
+    default:
+        break
+    }
+}
+```
+
+### 恢复购买（批量）
+```swift
+import StoreKit
+
+func restorePurchases(token: String) async throws {
+    try await AppStore.sync()
+    var signedDataList: [String] = []
+    for await t in Transaction.currentEntitlements {
+        let v = try t.verificationResult.payloadValue
+        signedDataList.append(v.signedData)
+    }
+    struct RestoreReq: Codable { let transactions: [String] }
+    let body = RestoreReq(transactions: signedDataList)
+
+    var req = URLRequest(url: URL(string: "https://api.yourdomain.com/v1/public/iap/apple/restore")!)
+    req.httpMethod = "POST"
+    req.addValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+    req.addValue("application/json", forHTTPHeaderField: "Content-Type")
+    req.httpBody = try JSONEncoder().encode(body)
+    let (_, _) = try await URLSession.shared.data(for: req)
+}
+```
+
+### 查询状态
+```swift
+func fetchIAPStatus(token: String) async throws {
+    var req = URLRequest(url: URL(string: "https://api.yourdomain.com/v1/public/iap/apple/status")!)
+    req.addValue("Bearer \(token)", forHTTPHeaderField: "Authorization")
+    let (data, _) = try await URLSession.shared.data(for: req)
+    // 解析 active/expires_at/tier
+}
+```
+
+### 退款入口（帮助页）
+```swift
+// 在 App 内购买帮助页面提供按钮，调用系统退款流程
+// try await beginRefundRequest(for: product, in: windowScene)
+```
+
+## 错误处理建议
+- 绑定失败（`code != 200`）
+  - 校验用户登录态、`signedData` 是否来自 `transaction.verify()` 的成功结果
+  - 若提示 `unknown product`，请在请求体中按回退规范携带 `duration_days/subscribe_id/tier`
+- 网络与重试
+  - 建议对 `attach/restore` 做有限重试与幂等保护（相同 `originalTransactionId` 不重复绑定）
+- 恢复失败
+  - 确保已调用 `AppStore.sync()` 并遍历 `currentEntitlements`
+
+## 调试与沙盒
+- 使用 Sandbox 账号进行测试；购买成功后调用 `attach → status`，验证到期与等级；再次 `restore → status` 验证幂等。
+- 建议打印 `request_id`（如有）便于后端排查。
+
+## HIG 注意事项
+- 仅在可支付时显示商店；价格与文案清晰，不截断标题；使用系统确认表单，不自定义购买弹窗。
+- 在帮助页提供退款入口与说明，文案简洁直达。
+
+## 常见问题
+- `productId` 不一致：服务端未配置某商品时，客户端按回退规范补齐时长与订阅 ID 即可绑定；建议后续让两端保持一致以减少维护成本。
+- 权益冲突：若用户同时存在多来源订阅，服务端按最高等级与最晚到期计算权益。

doc/加解密说明文档.md

@@ -0,0 +1,113 @@
+# 项目加解密使用说明
+
+本指南介绍了 PPanel Server 项目中使用的加解密机制，主要用于设备端（Device）通信的安全保障。
+
+## 1. 核心算法
+项目使用 **AES-256-CBC** 加密算法。
+- **填充方式**：PKCS7 Padding。
+- **数据编码**：Base64。
+
+## 2. 密钥（Key）与初始化向量（IV）生成逻辑
+
+### 2.1 密钥生成 (Key Generation)
+密钥由一个预定义的 `SecuritySecret`（简称 Secret）生成：
+1. 对 Secret 进行 **SHA-256** 哈希。
+2. 取哈希结果的前 **32 字节** 作为 AES-256 的密钥。
+
+### 2.2 初始化向量生成 (IV Generation)
+IV 是动态生成的，以增强安全性：
+1. 客户端或服务端生成一个随机字符串（Nonce，通常是纳秒级时间戳）。
+2. 对 Nonce 进行 **MD5** 哈希。
+3. 将 MD5 结果（十六进制字符串）与 Secret 拼接。
+4. 对拼接后的字符串按 2.1 节的方式生成密钥逻辑处理，取结果的前 **16 字节** 作为 IV。
+
+> [!NOTE]
+> 在 API 通信中，Nonce 字符串通常通过请求参数中的 `time` 字段传递。
+
+## 3. 身份识别与优先顺序
+
+服务端通过 `Login-Type` 来识别是否需要进行加解密逻辑（值为 `device` 时触发）。
+
+### 3.1 识别途径
+1. **Token 负载 (JWT Claims)**：Token 中包含 `LoginType` (值为 `device`) 和 `DeviceId`。
+2. **请求头 (Header)**：`Login-Type: device`。
+
+### 3.2 优先顺序与场景
+- **已登录场景**：服务端优先从 **Token** 负载中读取 `LoginType`。如果 Token 合法且包含 `LoginType: device`，则启用加解密。
+- **未登录/登录中场景**：例如 `/v1/auth/login/device` 接口，由于此时没有有效 Token，服务端会检查 **Header** 中的 `Login-Type`。
+
+> [!TIP]
+> 为了确保一致性，建议在设备端请求中**始终**携带 `Login-Type: device` 请求头，并在登录后确保存储的 Token 负载中也包含对应信息。
+
+## 4. 中间件应用 (DeviceMiddleware)
+
+
+`DeviceMiddleware` 处理 `Login-Type: device` 的请求：
+- **请求解密**：
+    - 检查 URL 参数或 JSON Body 中的 `data`（加密数据）和 `time`（Nonce）。
+    - 使用配置的 Secret 和 Nonce 解密 `data`。
+    - 将解密后的 JSON 重新注入到请求上下文中。
+- **响应加密**：
+    - 拦截响应 Body。
+    - 加密 Body 中的 `data` 字段。
+    - 将响应格式化为：
+      ```json
+      {
+        "data": "ENCRYPTED_BASE64_STRING",
+        "time": "NONCE_STRING"
+      }
+      ```
+
+## 5. Token 负载详情 (JWT Payload)
+当 `Login-Type` 为 `device` 时，JWT Token 会包含以下自定义字段：
+- `LoginType`: `"device"`
+- `DeviceId`: 设备的数据库唯一 ID。
+
+## 6. 代码示例
+
+
+### Go 语言 (服务端)
+参考 [pkg/aes/aes.go](file:///Users/Apple/vpn/ppanel-server/pkg/aes/aes.go)
+
+```go
+import pkgaes "github.com/perfect-panel/server/pkg/aes"
+
+// 加密
+encrypt, nonce, err := pkgaes.Encrypt([]byte("plain text"), secret)
+
+// 解密
+decrypt, err := pkgaes.Decrypt(cipherText, secret, nonce)
+```
+
+### JavaScript (客户端示例)
+使用 `crypto-js` 库：
+
+```javascript
+const CryptoJS = require("crypto-js");
+
+function getIv(nonce, secret) {
+    const md5Nonce = CryptoJS.MD5(nonce).toString();
+    const ivStr = md5Nonce + secret;
+    const key = CryptoJS.SHA256(ivStr);
+    return CryptoJS.enc.Hex.parse(key.toString().substring(0, 32));
+}
+
+function getKey(secret) {
+    const key = CryptoJS.SHA256(secret);
+    return CryptoJS.enc.Hex.parse(key.toString().substring(0, 64));
+}
+
+// 加密示例
+const key = getKey(secret);
+const iv = getIv(nonce, secret);
+const encrypted = CryptoJS.AES.encrypt("plain text", key, {
+    iv: iv,
+    mode: CryptoJS.mode.CBC,
+    padding: CryptoJS.pad.Pkcs7
+});
+console.log(encrypted.toString()); // Base64
+```
+
+## 5. 安全建议
+- 请务必在配置文件中修改默认的 `SecuritySecret`。
+- 确保 `time` (Nonce) 在每次请求时都是唯一的，以防止重放攻击和频率分析。

doc/说明文档.md

@@ -0,0 +1,42 @@
+# 报错日志收集（log_message）
+
+## 项目规划
+- 目标：新增 `log_message` 表与采集/查询接口，用于 APP / PC / Web 客户端错误日志收集与分析。
+- 范围：
+  - 创建 MySQL 表与迁移脚本（02105）。
+  - 新增客户端上报接口 `POST /v1/common/log/message/report`。
+  - 新增管理端查询接口 `GET /v1/admin/log/message/error/list` 与 `GET /v1/admin/log/message/error/detail`。
+
+## 实施方案
+- 表结构：见 `initialize/migrate/database/02120_log_message.up.sql`。
+- 模型：`internal/model/logmessage/`（实体、默认 CRUD、筛选）。
+- 路由：在 `internal/handler/routes.go` 注册公共与管理端路由。
+- 逻辑：
+  - 上报逻辑：`internal/logic/common/logMessageReportLogic.go`（限流、指纹去重、入库）。
+  - 管理查询：`internal/logic/admin/log/getErrorLogMessageListLogic.go`、`getErrorLogMessageDetailLogic.go`。
+- 类型：`internal/types/types.go` 新增请求/响应结构。
+- 安全：详细加解密逻辑见 [加解密说明文档.md](file:///Users/Apple/vpn/ppanel-server/doc/加解密说明文档.md)。
+
+
+## 进度记录
+- 2025-12-02：
+  - 完成表与索引创建迁移文件。
+  - 完成模型与服务注入。
+  - 完成公共上报接口与限流、去重逻辑；编译验证通过。
+  - 完成管理端列表与详情接口；编译验证通过。
+  - 待办：根据运营需求调整限流阈值与日志保留策略。
+- 2026-01-08：
+  - 完成「项目加解密使用说明」文档编写，涵盖 AES-256-CBC 实现及中间件逻辑。
+
+
+## 接口规范
+- 上报：`POST /v1/common/log/message/report`（详见 `doc/api/log_message_report.md`）
+- 管理端列表：`GET /v1/admin/log/message/error/list`
+  - 筛选：platform、level、user_id、device_id、error_code、keyword、start、end；分页：page、size
+  - 响应：`{ total, list }`
+- 管理端详情：`GET /v1/admin/log/message/error/detail?id=...`
+  - 响应：完整字段
+
+## 保留策略与安全
+- 限流：按设备/IP 每分钟 120 条（可配置）。
+- 隐私：避免采集敏感数据；服务端对大字段做长度限制与截断。

docker-compose.cloud.yml

@@ -0,0 +1,354 @@
+# PPanel 服务部署 (云端/无源码版)
+# 使用方法: 
+# 1. 确保已将 docker-compose.cloud.yml, configs/, loki/, grafana/, prometheus/ 目录上传到服务器同一目录
+# 2. 确保 configs/ 目录下有 ppanel.yaml 配置文件
+# 3. 确保 logs/ 目录存在 (mkdir logs)
+# 4. 运行: docker-compose -f docker-compose.cloud.yml up -d
+
+services:
+  # ----------------------------------------------------
+  # 1. 业务后端 (PPanel Server)
+  # ----------------------------------------------------
+  ppanel-server:
+    image: registry.kxsw.us/vpn-server:${PPANEL_SERVER_TAG:-latest}
+    container_name: ppanel-server
+    restart: always
+    volumes:
+      - ./configs:/app/etc
+      - ./logs:/app/logs
+    environment:
+      - TZ=Asia/Shanghai
+      # 链路追踪配置 (OTLP)
+      - OTEL_EXPORTER_OTLP_ENDPOINT=http://127.0.0.1:4317
+      - OTEL_SERVICE_NAME=ppanel-server
+      - OTEL_TRACES_EXPORTER=otlp
+      - OTEL_METRICS_EXPORTER=prometheus # 指标由 tempo 抓取，不使用 OTLP
+    network_mode: host
+    ulimits:
+      nproc: 65535
+      nofile:
+        soft: 65535
+        hard: 65535
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+    depends_on:
+      - mysql
+      - redis
+      - tempo
+
+  # ----------------------------------------------------
+  # 14. Tempo (链路追踪存储 - 替代/增强 Jaeger)
+  # ----------------------------------------------------
+  tempo:
+    image: grafana/tempo:2.4.1
+    container_name: ppanel-tempo
+    user: root
+    restart: always
+    command:
+      - "-config.file=/etc/tempo.yaml"
+      - "-target=all"
+    volumes:
+      - ./tempo/tempo-config.yaml:/etc/tempo.yaml #      - tempo_data:/var/tempo
+      - ./tempo_data:/var/tempo # 改为映射到当前目录，确保数据彻底干净
+
+    ports:
+      - "3200:3200"
+      - "4317:4317"
+      - "4318:4318"
+      - "9095:9095"
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 2. MySQL Database
+  # ----------------------------------------------------
+  mysql:
+    image: mysql:8.0
+    container_name: ppanel-mysql
+    restart: always
+    ports:
+      - "3306:3306" # 临时开放外部访问，用完记得关闭！
+    environment:
+      MYSQL_ROOT_PASSWORD: "jpcV41ppanel" # 请修改为强密码
+      MYSQL_DATABASE: "ppanel"
+      TZ: Asia/Shanghai
+    command:
+      - --default-authentication-plugin=mysql_native_password
+      - --innodb_buffer_pool_size=16G
+      - --innodb_buffer_pool_instances=16
+      - --innodb_log_file_size=2G
+      - --innodb_flush_log_at_trx_commit=2
+      - --innodb_io_capacity=5000
+      - --max_connections=5000
+    volumes:
+      - mysql_data:/var/lib/mysql
+    ulimits:
+      nproc: 65535
+      nofile:
+        soft: 65535
+        hard: 65535
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 3. Redis
+  # ----------------------------------------------------
+  redis:
+    image: redis:7.0
+    container_name: ppanel-redis
+    restart: always
+    ports:
+      - "6379:6379"
+    command:
+      - redis-server
+      - --tcp-backlog 65535
+      - --maxmemory-policy allkeys-lru
+    volumes:
+      - redis_data:/data
+    ulimits:
+      nproc: 65535
+      nofile:
+        soft: 65535
+        hard: 65535
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 4. Loki (日志存储)
+  # ----------------------------------------------------
+  loki:
+    image: grafana/loki:3.0.0
+    container_name: ppanel-loki
+    restart: always
+    volumes:
+      # 必须上传 loki 目录到服务器
+      - ./loki/loki-config.yaml:/etc/loki/local-config.yaml
+      - loki_data:/loki
+    command: -config.file=/etc/loki/local-config.yaml
+    ports:
+      - "3100:3100"
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 5. Promtail (日志采集)
+  # ----------------------------------------------------
+  promtail:
+    image: grafana/promtail:3.0.0
+    container_name: ppanel-promtail
+    restart: always
+    volumes:
+      - ./loki/promtail-config.yaml:/etc/promtail/config.yaml
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/run/docker.sock:/var/run/docker.sock
+      # 采集当前目录下的 logs 文件夹
+      - ./logs:/var/log/ppanel-server:ro
+      # 采集 Nginx 访问日志（用于追踪邀请码来源）
+      - /var/log/nginx:/var/log/nginx:ro
+    command: -config.file=/etc/promtail/config.yaml
+    networks:
+      - ppanel_net
+    depends_on:
+      - loki
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 6. Grafana (日志界面)
+  # ----------------------------------------------------
+  grafana:
+    image: grafana/grafana:latest
+    container_name: ppanel-grafana
+    restart: always
+    ports:
+      - "3333:3000"
+    environment:
+      - GF_SECURITY_ADMIN_PASSWORD=admin
+      - GF_USERS_ALLOW_SIGN_UP=false
+      - GF_FEATURE_TOGGLES_ENABLE=appObservability #- GF_INSTALL_PLUGINS=redis-datasource
+    volumes:
+      - grafana_data:/var/lib/grafana
+      - ./grafana/provisioning:/etc/grafana/provisioning
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    networks:
+      - ppanel_net
+    depends_on:
+      - loki
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 7. Prometheus (指标采集)
+  # ----------------------------------------------------
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: ppanel-prometheus
+    restart: always
+    ports:
+      - "9090:9090" # 暴露端口便于调试
+    volumes:
+      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml
+      - prometheus_data:/prometheus
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--web.enable-lifecycle'
+      - '--web.enable-remote-write-receiver'
+
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 8. Redis Exporter (Redis指标导出)
+  # ----------------------------------------------------
+  redis-exporter:
+    image: oliver006/redis_exporter:latest
+    container_name: ppanel-redis-exporter
+    restart: always
+    environment:
+      - REDIS_ADDR=redis://redis:6379
+    networks:
+      - ppanel_net
+    depends_on:
+      - redis
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 9. Nginx Exporter (监控宿主机 Nginx)
+  # ----------------------------------------------------
+  nginx-exporter:
+    image: nginx/nginx-prometheus-exporter:latest
+    container_name: ppanel-nginx-exporter
+    restart: always
+    # 使用 host.docker.internal 访问宿主机
+    command:
+      - -nginx.scrape-uri=http://host.docker.internal:8090/nginx_status
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 10. MySQL Exporter (MySQL指标导出)
+  # ----------------------------------------------------
+  mysql-exporter:
+    image: prom/mysqld-exporter:latest
+    container_name: ppanel-mysql-exporter
+    restart: always
+    command:
+      - --config.my-cnf=/etc/.my.cnf
+    volumes:
+      - ./mysql/.my.cnf:/etc/.my.cnf:ro
+    networks:
+      - ppanel_net
+    depends_on:
+      - mysql
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 12. Node Exporter (宿主机监控)
+  # ----------------------------------------------------
+  node-exporter:
+    image: prom/node-exporter:latest
+    container_name: ppanel-node-exporter
+    restart: always
+    volumes:
+      - /proc:/host/proc:ro
+      - /sys:/host/sys:ro
+      - /:/rootfs:ro
+    command:
+      - '--path.procfs=/host/proc'
+      - '--path.sysfs=/host/sys'
+      - '--collector.filesystem.mount-points-exclude=^/(sys|proc|dev|host|etc)($$|/)'
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+  # ----------------------------------------------------
+  # 13. cAdvisor (容器监控)
+  # ----------------------------------------------------
+  cadvisor:
+    image: gcr.io/cadvisor/cadvisor:latest
+    container_name: ppanel-cadvisor
+    restart: always
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+      - /dev/disk/:/dev/disk:ro
+    networks:
+      - ppanel_net
+    logging:
+      driver: "json-file"
+      options:
+        max-size: "10m"
+        max-file: "3"
+
+volumes:
+  mysql_data:
+  redis_data:
+  loki_data:
+  grafana_data:
+  prometheus_data:
+  tempo_data:
+
+
+networks:
+  ppanel_net:
+    name: ppanel_net
+    driver: bridge

docker-compose.yml

@@ -1,13 +0,0 @@
-version: '3'
-
-services:
-  ppanel:
-    container_name: ppanel-server
-    build:
-      context: .
-      dockerfile: Dockerfile
-    ports:
-      - "8080:8080"
-    volumes:
-      - ./etc/ppanel.yaml:/app/etc/ppanel.yaml
-    restart: always

docs/Check_Device_Login_IP/ALIGNMENT_Check_Device_Login_IP.md

@@ -0,0 +1,54 @@
+# ALIGNMENT: 检查设备登录 IP 逻辑
+
+## 原始需求
+用户询问：
+> "检查一下 设备登录的时候 有检查IP 么"
+> "我需要知道 有没有IP 目前数据库都没有IP"
+
+## 项目现状分析 (Context Analysis)
+1.  **数据模型 (`user.Device`)**:
+    -   存在 `Ip` 字段 (`varchar(255)`).
+    -   定义在 `/internal/model/user/user.go`。
+
+2.  **业务逻辑 (`DeviceLoginLogic.go`)**:
+    -   在代码逻辑中，确实尝试获取 `req.IP` 并保存到数据库。
+    -   创建新设备时：`deviceInfo.Ip = req.IP`。
+    -   记录登录日志时：`LoginIP: req.IP`。
+
+3.  **关键问题点 (Root Cause)**:
+    -   输入参数定义在 `internal/types/types.go`:
+        ```go
+        type DeviceLoginRequest struct {
+            // ...
+            IP string `header:"X-Original-Forwarded-For"`
+            // ...
+        }
+        ```
+    -   **当前仅支持 `X-Original-Forwarded-For` 请求头**。
+    -   如果请求经过 Nginx、Cloudflare 等代理，但没有专门配置传递这个特定的 Header，或者使用的是标准的 `X-Forwarded-For` / `X-Real-IP`，后端获取到的 `req.IP` 将为空字符串。
+    -   这就是导致“数据库都没有IP”的直接原因。
+
+## 疑问澄清 (Questions)
+我们需要确认修复方案：
+
+1.  **是否只需支持标准 Header?**
+    -   建议改为优先获取 `X-Forwarded-For`，其次 `X-Real-IP`，最后才是 `X-Original-Forwarded-For` 或直连 IP。
+    -   go-zero 框架通常可以通过配置或中间件处理 IP，或者我们在 struct tag 中调整。但 struct tag `header` 只能由 go-zero 的 rest 绑定一个特定的 key。
+2.  **是否需要记录 IP 归属地?**
+    -   目前逻辑只记录 IP 字符串，不解析归属地。需求中没提，暂时不作为重点，但可以确认一下。
+
+## 建议方案
+修改 `DeviceLoginRequest` 的定义可能不够灵活（Header key 是固定的）。
+更好的方式是：
+1.  **移除 Struct Tag 绑定**（或者保留作为备选）。
+2.  **在 Logic 中显式获取 IP**：
+    -   从 `l.ctx` (Context) 中获取 `http.Request` (如果 go-zero 支持)。
+    -   或者在 Middleware 中解析真实 IP 并放入 Context。
+    -   或者简单点，修改 Struct Tag 为最常用的 `X-Forwarded-For` (如果确定环境是这样配置的)。
+
+**最快修复**:
+将 `internal/types/types.go` 中的 `X-Original-Forwarded-For` 改为 `X-Forwarded-For` (或者根据实际网关配置修改)。
+但通常建议使用工具函数解析多种 Header。
+
+## 下一步 (Next Step)
+请确认是否要我修改代码以支持标准的 IP 获取方式（如 `X-Forwarded-For`）？

docs/Check_Device_Login_IP/DESIGN_Check_Device_Login_IP.md

@@ -0,0 +1,36 @@
+# DESIGN: Device Login IP Fix
+
+## 目标
+修复设备登录时无法获取真实 IP (`req.IP` 为空) 的问题，导致数据库未存储 IP。
+
+## 现状
+- `internal/types/types.go` 定义了 `DeviceLoginRequest`，其中 `IP` 字段绑定的是 `X-Original-Forwarded-For`。
+- 实际环境中（Nginx/Cloudflare等）通常使用 `X-Forwarded-For`。
+
+## 方案选择
+由于项目使用 `go-zero` 并且存在 `.api` 文件，**最佳实践**是修改 `.api` 文件并重新生成代码。
+但考虑到我无法运行 `goctl` (或者环境可能不一致)，如果不重新生成而直接改 `types.go`，虽然能即时生效，但下次生成会被覆盖。
+
+**然而**，鉴于我之前的操作已经直接修改过 `types.go` (Invite Sales Time Filter)，且项目看似允许直接修改（或用户负责生成），我将**优先修改 `.api` 文件** 以保持源头正确，同时**手动同步修改 `types.go`** 以确保立即生效。
+
+## 变更范围
+
+### 1. API 定义 (`apis/auth/auth.api`)
+- 修改 `DeviceLoginRequest` struct。
+- 将 `header: X-Original-Forwarded-For` 改为 `header: X-Forwarded-For` (这是最通用的标准)。
+
+### 2. 生成文件 (`internal/types/types.go`)
+- 手动同步修改 `DeviceLoginRequest` 中的 Tag。
+- 变为: `IP string header:"X-Forwarded-For"`
+
+### 3. (可选增强) 业务逻辑 (`internal/logic/auth/deviceLoginLogic.go`)
+- 由于 go-zero 的绑定机制比较“死”，如果 Tag 没取到值，就是空的。Logic 层拿到空字符串也没办法再去 Context 捞（除非 Context 里存了 request）。
+- 暂时只做 Tag 修改，因为这是最根本原因。
+
+## 验证
+- 检查代码变更。
+- (无法直接测试 IP 获取，依赖用户部署验证)。
+
+## 任务拆分
+1. 修改 `apis/auth/auth.api`
+2. 修改 `internal/types/types.go`

docs/decrypt_download_logs.md

@@ -0,0 +1,102 @@
+# Nginx 下载日志解密工具
+
+## 简介
+
+此工具用于解密 Nginx 访问日志中 `/v1/common/client/download` 接口的加密 `data` 参数。
+
+通讯密钥：`c0qhq99a-nq8h-ropg-wrlc-ezj4dlkxqpzx`
+
+## 解密结果示例
+
+从 Nginx 日志解密后，可以获得下载请求的详细信息，例如：
+
+```json
+{"platform":"windows"}
+{"platform":"mac"}
+{"platform":"android"}
+{"platform":"ios"}
+```
+
+还可能包含邀请码信息：
+```json
+{"platform":"windows","invite_code":"ABC123"}
+```
+
+## 使用方法
+
+### 方法 1: 使用 Shell 脚本（推荐）
+
+```bash
+# 解密单条日志
+./decrypt_download.sh '172.245.180.199 - - [02/Feb/2026:04:35:47 +0000] "GET /v1/common/client/download?data=JetaR6P9e8G5lZg2KRiAhV6c%2FdMilBtP78bKmsbAxL8%3D&time=2026-02-02T04:35:15.032000 HTTP/1.1"'
+
+# 解密多条日志
+./decrypt_download.sh \
+  'data=JetaR6P9e8G5lZg2KRiAhV6c%2FdMilBtP78bKmsbAxL8%3D&time=2026-02-02T04:35:15.032000' \
+  'data=%2FFTAxtcEd%2F8T2MzKdxxrPfWBXk4pNPbQZB3p8Yrl8XQ%3D&time=2026-02-02T04:35:15.031000'
+```
+
+### 方法 2: 直接运行 Go 程序
+
+```bash
+go run cmd/decrypt_download_data/main.go
+```
+
+默认会解密内置的示例日志。
+
+### 方法 3: 从 Nginx 日志文件批量解密
+
+```bash
+# 提取所有 download 请求并解密
+grep "/v1/common/client/download" /var/log/nginx/access.log | \
+  while read line; do
+    ./decrypt_download.sh "$line"
+  done
+```
+
+## 从 Nginx 服务器上使用
+
+如果您在 Nginx 服务器上（root@localhost7701），可以这样操作：
+
+1. **查找所有 download 请求**：
+```bash
+grep "/v1/common/client/download" /var/log/nginx/access.log
+```
+
+2. **统计各平台下载量**：
+先解密所有日志，然后统计：
+```bash
+# 需要将此工具复制到服务器，或在本地解密后统计
+```
+
+3. **实时监控**：
+```bash
+tail -f /var/log/nginx/access.log | grep "/v1/common/client/download"
+```
+
+## 技术细节
+
+### 加密方式
+- **算法**：AES-CBC with PKCS7 padding
+- **密钥长度**：256 位（通过 SHA256 哈希生成）
+- **IV 生成**：基于时间戳的 MD5 哈希
+
+### 参数说明
+- `data`: URL 编码的 Base64 加密数据
+- `time`: 用于生成 IV 的时间戳字符串
+
+### 解密流程
+1. URL 解码 `data` 参数
+2. Base64 解码得到密文
+3. 使用通讯密钥和 `time` 生成解密密钥和 IV
+4. 使用 AES-CBC 解密得到原始 JSON 数据
+
+## 相关文件
+
+- `cmd/decrypt_download_data/main.go` - 解密工具主程序
+- `decrypt_download.sh` - Shell 脚本快捷方式
+- `pkg/aes/aes.go` - AES 加密解密库
+
+## 注意事项
+
+⚠️ **安全提示**：通讯密钥应妥善保管，不要泄露给未授权人员。

etc/nginx.conf

@@ -0,0 +1,309 @@
+第一个文件
+server {
+    listen 80;
+    server_name airoport.org www.airoport.org api.airoport.win;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name airoport.org;
+    ssl_certificate /etc/letsencrypt/live/airoport.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/airoport.org/privkey.pem;
+    return 301 https://airoport.co$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name www.airoport.org;
+    ssl_certificate /etc/letsencrypt/live/www.airoport.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.airoport.org/privkey.pem;
+    return 301 https://www.airoport.co$request_uri;
+}
+
+
+server {
+    listen 443 ssl http2;
+    server_name api.airoport.win;
+    client_max_body_size 150M;
+
+    ssl_certificate /etc/letsencrypt/live/api.airoport.win/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/api.airoport.win/privkey.pem;
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_connect_timeout 10s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+        proxy_next_upstream timeout;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name xqwbmzy8.de99e242.airoport.org;
+    client_max_body_size 150M;
+
+    ssl_certificate /etc/letsencrypt/live/xqwbmzy8.de99e242.airoport.org/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xqwbmzy8.de99e242.airoport.org/privkey.pem;
+
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    # Gzip压缩
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json image/svg+xml;
+
+    # 静态资源缓存
+    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+        proxy_pass http://localhost8315:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+        location ^~ / {
+    proxy_pass http://127.0.0.1:3001;
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header REMOTE-HOST $remote_addr;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection $http_connection;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_set_header X-Forwarded-Port $server_port;
+    proxy_http_version 1.1;
+    add_header X-Cache $upstream_cache_status;
+    add_header Cache-Control no-cache;
+    proxy_ssl_server_name off;
+    proxy_ssl_name $proxy_host;
+}
+}
+
+
+
+
+第二个文件：
+
+server {
+    listen 80;
+    server_name airoport.co www.airoport.co api.airoport.co de99e242.airoport.co xqwbmzy8.de99e242.airoport.co api.airoport.win;
+
+    location / {
+        return 301 https://$host$request_uri;
+    }
+}
+# 主域名和www指向3002 (用户界面)
+server {
+    listen 443 ssl http2;
+    server_name airoport.co;
+    client_max_body_size 150M;
+
+    ssl_certificate /etc/letsencrypt/live/airoport.co-0003/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/airoport.co-0003/privkey.pem;
+
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+    location /md {
+        alias /var/www/md/;
+        # 启用目录浏览
+        autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+        # 设置默认文档为README.md
+        index README.md;
+        # 跨域处理
+        add_header Access-Control-Allow-Origin "*" always;
+        add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+        add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+        add_header Access-Control-Allow-Credentials "true" always;
+        # 处理OPTIONS预检请求
+        if ($request_method = OPTIONS) {
+            add_header Access-Control-Allow-Origin "*";
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS";
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization";
+            add_header Content-Length 0;
+            add_header Content-Type text/plain;
+            return 204;
+        }
+
+        # 处理.md文件
+        location ~* \.md$ {
+            add_header Content-Type "text/markdown; charset=utf-8";
+            add_header Cache-Control "no-cache, no-store, must-revalidate";
+            add_header Pragma "no-cache";
+
+            # 跨域处理
+            add_header Access-Control-Allow-Origin "*" always;
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+        }
+
+        # 静态资源缓存优化
+        location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+            add_header X-Content-Type-Options nosniff;
+
+            # 跨域处理
+            add_header Access-Control-Allow-Origin "*" always;
+            add_header Access-Control-Allow-Methods "GET, POST, OPTIONS" always;
+            add_header Access-Control-Allow-Headers "Content-Type, Authorization" always;
+        }
+    }
+
+    location ^~ / {
+        proxy_pass http://127.0.0.1:3002;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header REMOTE-HOST $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_http_version 1.1;
+        add_header X-Cache $upstream_cache_status;
+        add_header Cache-Control no-cache;
+        proxy_ssl_server_name off;
+        proxy_ssl_name $proxy_host;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name  www.airoport.co;
+    client_max_body_size 150M;
+
+    ssl_certificate /etc/letsencrypt/live/www.airoport.co/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/www.airoport.co/privkey.pem;
+
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    location ^~ / {
+        proxy_pass http://127.0.0.1:3002;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header REMOTE-HOST $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_http_version 1.1;
+        add_header X-Cache $upstream_cache_status;
+        add_header Cache-Control no-cache;
+        proxy_ssl_server_name off;
+        proxy_ssl_name $proxy_host;
+    }
+}
+
+
+server {
+    listen 443 ssl http2;
+    server_name api.airoport.co;
+    client_max_body_size 150M;
+
+    ssl_certificate /etc/letsencrypt/live/api.airoport.co/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/api.airoport.co/privkey.pem;
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
+server {
+    listen 443 ssl http2;
+    server_name api.airoport.win;
+    client_max_body_size 150M;
+
+    ssl_certificate /etc/letsencrypt/live/api.airoport.win/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/api.airoport.win/privkey.pem;
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    location / {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_connect_timeout 10s;
+        proxy_send_timeout 60s;
+        proxy_read_timeout 60s;
+        proxy_next_upstream timeout;
+    }
+    }
+# de99e242子域名指向3001 (管理界面)
+server {
+    listen 443 ssl http2;
+    server_name xqwbmzy8.de99e242.airoport.co;
+    client_max_body_size 150M;
+
+    ssl_certificate /etc/letsencrypt/live/xqwbmzy8.de99e242.airoport.co/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/xqwbmzy8.de99e242.airoport.co/privkey.pem;
+
+    # 安全头
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+    add_header X-Frame-Options DENY;
+    add_header X-Content-Type-Options nosniff;
+
+    # Gzip压缩
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 1024;
+    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json image/svg+xml;
+
+    location ^~ / {
+        proxy_pass http://127.0.0.1:3001;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header REMOTE-HOST $remote_addr;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection $http_connection;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Port $server_port;
+        proxy_http_version 1.1;
+        add_header X-Cache $upstream_cache_status;
+        add_header Cache-Control no-cache;
+        proxy_ssl_server_name off;
+        proxy_ssl_name $proxy_host;
+    }
+}

go.mod

@@ -7,7 +7,7 @@ require (
 	github.com/alibabacloud-go/darabonba-openapi v0.1.18
 	github.com/alibabacloud-go/dysmsapi-20170525/v2 v2.0.18
 	github.com/alibabacloud-go/tea v1.2.2
-	github.com/alicebob/miniredis/v2 v2.34.0
+	github.com/alicebob/miniredis/v2 v2.35.0
 	github.com/anaskhan96/go-password-encoder v0.0.0-20201010210601-c765b799fd72
 	github.com/andybalholm/brotli v1.1.1
 	github.com/forgoer/openssl v1.6.0
@@ -17,7 +17,7 @@ require (
 	github.com/go-playground/universal-translator v0.18.1
 	github.com/go-playground/validator/v10 v10.24.0
 	github.com/go-resty/resty/v2 v2.15.3
-	github.com/go-sql-driver/mysql v1.8.1
+	github.com/go-sql-driver/mysql v1.9.0
 	github.com/go-telegram-bot-api/telegram-bot-api/v5 v5.5.1
 	github.com/gofrs/uuid/v5 v5.3.0
 	github.com/golang-jwt/jwt/v5 v5.2.2
@@ -25,14 +25,14 @@ require (
 	github.com/gorilla/websocket v1.5.3
 	github.com/hibiken/asynq v0.24.1
 	github.com/jinzhu/copier v0.4.0
-	github.com/klauspost/compress v1.17.7
+	github.com/klauspost/compress v1.17.11
 	github.com/nyaruka/phonenumbers v1.5.0
 	github.com/pkg/errors v0.9.1
-	github.com/redis/go-redis/v9 v9.7.2
+	github.com/redis/go-redis/v9 v9.17.2
 	github.com/smartwalle/alipay/v3 v3.2.23
 	github.com/spf13/cast v1.7.0 // indirect
 	github.com/spf13/cobra v1.8.1
-	github.com/stretchr/testify v1.10.0
+	github.com/stretchr/testify v1.11.1
 	github.com/stripe/stripe-go/v81 v81.1.0
 	github.com/twilio/twilio-go v1.23.11
 	go.opentelemetry.io/otel v1.29.0
@@ -46,7 +46,7 @@ require (
 	go.uber.org/zap v1.27.0
 	golang.org/x/crypto v0.35.0
 	golang.org/x/oauth2 v0.25.0
-	golang.org/x/time v0.6.0
+	golang.org/x/time v0.10.0
 	gopkg.in/gomail.v2 v2.0.0-20160411212932-81ebce5c23df
 	gopkg.in/yaml.v3 v3.0.1
 	gorm.io/driver/mysql v1.5.7
@@ -60,10 +60,11 @@ require (
 	github.com/fatih/color v1.18.0
 	github.com/goccy/go-json v0.10.4
 	github.com/golang-migrate/migrate/v4 v4.18.2
-	github.com/oschwald/geoip2-golang v1.13.0
 	github.com/spaolacci/murmur3 v1.1.0
-	google.golang.org/grpc v1.64.1
+	github.com/zeromicro/go-zero v1.9.4
-	google.golang.org/protobuf v1.36.3
+	google.golang.org/grpc v1.65.0
+	google.golang.org/protobuf v1.36.5
+	gorm.io/driver/sqlite v1.4.4
 )
 
 require (
@@ -79,12 +80,11 @@ require (
 	github.com/alibabacloud-go/tea-utils v1.4.5 // indirect
 	github.com/alibabacloud-go/tea-utils/v2 v2.0.7 // indirect
 	github.com/alibabacloud-go/tea-xml v1.1.3 // indirect
-	github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 // indirect
 	github.com/aliyun/credentials-go v1.3.10 // indirect
 	github.com/boj/redistore v0.0.0-20180917114910-cd5dcc76aeff // indirect
 	github.com/bytedance/sonic v1.12.7 // indirect
 	github.com/bytedance/sonic/loader v0.2.3 // indirect
-	github.com/cenkalti/backoff/v4 v4.2.1 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/clbanning/mxj/v2 v2.5.6 // indirect
 	github.com/cloudwego/base64x v0.1.4 // indirect
@@ -94,7 +94,7 @@ require (
 	github.com/gin-contrib/sse v1.0.0 // indirect
 	github.com/go-logr/logr v1.4.2 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/golang/glog v1.2.0 // indirect
+	github.com/golang/glog v1.2.1 // indirect
 	github.com/golang/mock v1.6.0 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/gomodule/redigo v2.0.0+incompatible // indirect
@@ -113,12 +113,12 @@ require (
 	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/openzipkin/zipkin-go v0.4.2 // indirect
+	github.com/openzipkin/zipkin-go v0.4.3 // indirect
-	github.com/oschwald/maxminddb-golang v1.13.0 // indirect
 	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/robfig/cron/v3 v3.0.1 // indirect
@@ -135,15 +135,17 @@ require (
 	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.29.0 // indirect
 	go.opentelemetry.io/otel/metric v1.29.0 // indirect
 	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
-	go.uber.org/atomic v1.7.0 // indirect
+	go.uber.org/atomic v1.10.0 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	golang.org/x/arch v0.13.0 // indirect
 	golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d // indirect
-	golang.org/x/net v0.34.0 // indirect
+	golang.org/x/net v0.35.0 // indirect
 	golang.org/x/sys v0.30.0 // indirect
 	golang.org/x/text v0.22.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240513163218-0867130af1f8 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240711142825-46eb208f015d // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240513163218-0867130af1f8 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 // indirect
 	gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v2 v2.4.0 // indirect
 )

go.sum

@@ -52,10 +52,8 @@ github.com/alibabacloud-go/tea-utils/v2 v2.0.7/go.mod h1:qxn986l+q33J5VkialKMqT/
 github.com/alibabacloud-go/tea-xml v1.1.2/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
 github.com/alibabacloud-go/tea-xml v1.1.3 h1:7LYnm+JbOq2B+T/B0fHC4Ies4/FofC4zHzYtqw7dgt0=
 github.com/alibabacloud-go/tea-xml v1.1.3/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
-github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302 h1:uvdUDbHQHO85qeSydJtItA4T55Pw6BtAejd0APRJOCE=
+github.com/alicebob/miniredis/v2 v2.35.0 h1:QwLphYqCEAo1eu1TqPRN2jgVMPBweeQcR21jeqDCONI=
-github.com/alicebob/gopher-json v0.0.0-20230218143504-906a9b012302/go.mod h1:SGnFV6hVsYE877CKEZ6tDNTjaSXYUk6QqoIK6PrAtcc=
+github.com/alicebob/miniredis/v2 v2.35.0/go.mod h1:TcL7YfarKPGDAthEtl5NBeHZfeUQj6OXMm/+iu5cLMM=
-github.com/alicebob/miniredis/v2 v2.34.0 h1:mBFWMaJSNL9RwdGRyEDoAAv8OQc5UlEhLDQggTglU/0=
-github.com/alicebob/miniredis/v2 v2.34.0/go.mod h1:kWShP4b58T1CW0Y5dViCd5ztzrDqRWqM3nksiyXk5s8=
 github.com/aliyun/credentials-go v1.1.2/go.mod h1:ozcZaMR5kLM7pwtCMEpVmQ242suV6qTJya2bDq4X1Tw=
 github.com/aliyun/credentials-go v1.3.6/go.mod h1:1LxUuX7L5YrZUWzBrRyk0SwSdH4OmPrib8NVePL3fxM=
 github.com/aliyun/credentials-go v1.3.10 h1:45Xxrae/evfzQL9V10zL3xX31eqgLWEaIdCoPipOEQA=
@@ -78,8 +76,8 @@ github.com/bytedance/sonic v1.12.7/go.mod h1:tnbal4mxOMju17EGfknm2XyYcpyCnIROYOE
 github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
 github.com/bytedance/sonic/loader v0.2.3 h1:yctD0Q3v2NOGfSWPLPvG2ggA2kV6TS6s4wioyEqssH0=
 github.com/bytedance/sonic/loader v0.2.3/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFosQU6FxH2JmUe6VI=
-github.com/cenkalti/backoff/v4 v4.2.1 h1:y4OZtCnogmCPw98Zjyt5a6+QwPLGkiQsYW5oUqylYbM=
+github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
-github.com/cenkalti/backoff/v4 v4.2.1/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -144,8 +142,8 @@ github.com/go-playground/validator/v10 v10.24.0/go.mod h1:GGzBIJMuE98Ic/kJsBXbz1
 github.com/go-resty/resty/v2 v2.15.3 h1:bqff+hcqAflpiF591hhJzNdkRsFhlB96CYfBwSFvql8=
 github.com/go-resty/resty/v2 v2.15.3/go.mod h1:0fHAoK7JoBy/Ch36N8VFeMsK7xQOHhvWaC3iOktwmIU=
 github.com/go-sql-driver/mysql v1.7.0/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
-github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
+github.com/go-sql-driver/mysql v1.9.0 h1:Y0zIbQXhQKmQgTp44Y1dp3wTXcn804QoTptLZT1vtvo=
-github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
+github.com/go-sql-driver/mysql v1.9.0/go.mod h1:pDetrLJeA3oMujJuvXc8RJoasr589B6A9fwzD3QMrqw=
 github.com/go-telegram-bot-api/telegram-bot-api/v5 v5.5.1 h1:wG8n/XJQ07TmjbITcGiUaOtXxdrINDz1b0J1w0SzqDc=
 github.com/go-telegram-bot-api/telegram-bot-api/v5 v5.5.1/go.mod h1:A2S0CWkNylc2phvKXWBBdD3K0iGnDBGbzRpISP2zBl8=
 github.com/goccy/go-json v0.10.4 h1:JSwxQzIqKfmFX1swYPpUThQZp/Ka4wzJdK0LWVytLPM=
@@ -160,8 +158,8 @@ github.com/golang-jwt/jwt/v5 v5.2.2/go.mod h1:pqrtFR0X4osieyHYxtmOUWsAWrfe1Q5UVI
 github.com/golang-migrate/migrate/v4 v4.18.2 h1:2VSCMz7x7mjyTXx3m2zPokOY82LTRgxK1yQYKo6wWQ8=
 github.com/golang-migrate/migrate/v4 v4.18.2/go.mod h1:2CM6tJvn2kqPXwnXO/d3rAQYiyoIm180VsO8PRX6Rpk=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
+github.com/golang/glog v1.2.1 h1:OptwRhECazUx5ix5TTWC3EZhsZEHWcYWY4FQHTIubm4=
-github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/glog v1.2.1/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/mock v1.6.0 h1:ErTB+efbowRARo13NNdxyJji2egdxLGQhRaY+DUumQc=
 github.com/golang/mock v1.6.0/go.mod h1:p6yTPP+5HYm5mzsMV8JkE6ZKdX+/wYM6Hr+LicevLPs=
@@ -232,8 +230,8 @@ github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/
 github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
 github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
 github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
-github.com/klauspost/compress v1.17.7 h1:ehO88t2UGzQK66LMdE8tibEd1ErmzZjNEqWkjLAKQQg=
+github.com/klauspost/compress v1.17.11 h1:In6xLpyWOi1+C7tXUUWv2ot1QvBjxevKAaI6IXrJmUc=
-github.com/klauspost/compress v1.17.7/go.mod h1:Di0epgTjJY877eYKx5yC51cX2A2Vl2ibi7bDH9ttBbw=
+github.com/klauspost/compress v1.17.11/go.mod h1:pMDklpSncoRMuLFrf1W9Ss9KT+0rH90U12bZKk7uwG0=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.2.9 h1:66ze0taIn2H33fBvCkXuv9BmCwDfafmiIVpKV9kKGuY=
 github.com/klauspost/cpuid/v2 v2.2.9/go.mod h1:rqkxqrZ1EhYM9G+hXH7YdowN5R5RGN6NK4QwQ3WMXF8=
@@ -257,6 +255,7 @@ github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/mattn/go-sqlite3 v1.14.3/go.mod h1:WVKg1VTActs4Qso6iwGbiFih2UIHo0ENGwNd0Lj+XmI=
+github.com/mattn/go-sqlite3 v1.14.15/go.mod h1:2eHXhiwb8IkHr+BDWZGa96P6+rkvnG63S2DGjv9HUNg=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
@@ -283,12 +282,8 @@ github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.0 h1:8SG7/vwALn54lVB/0yZ/MMwhFrPYtpEHQb2IpWsCzug=
 github.com/opencontainers/image-spec v1.1.0/go.mod h1:W4s4sFTMaBeK1BQLXbG4AdM2szdn85PY75RI83NrTrM=
-github.com/openzipkin/zipkin-go v0.4.2 h1:zjqfqHjUpPmB3c1GlCvvgsM1G4LkvqQbBDueDOCg/jA=
+github.com/openzipkin/zipkin-go v0.4.3 h1:9EGwpqkgnwdEIJ+Od7QVSEIH+ocmm5nPat0G7sjsSdg=
-github.com/openzipkin/zipkin-go v0.4.2/go.mod h1:ZeVkFjuuBiSy13y8vpSDCjMi9GoI3hPpCJSBx/EYFhY=
+github.com/openzipkin/zipkin-go v0.4.3/go.mod h1:M9wCJZFWCo2RiY+o1eBCEMe0Dp2S5LDHcMZmk3RmK7c=
-github.com/oschwald/geoip2-golang v1.13.0 h1:Q44/Ldc703pasJeP5V9+aFSZFmBN7DKHbNsSFzQATJI=
-github.com/oschwald/geoip2-golang v1.13.0/go.mod h1:P9zG+54KPEFOliZ29i7SeYZ/GM6tfEL+rgSn03hYuUo=
-github.com/oschwald/maxminddb-golang v1.13.0 h1:R8xBorY71s84yO06NgTmQvqvTvlS/bnYZrrWX1MElnU=
-github.com/oschwald/maxminddb-golang v1.13.0/go.mod h1:BU0z8BfFVhi1LQaonTwwGQlsHUEu9pWNdMfmq4ztm0o=
 github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
 github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
@@ -296,10 +291,12 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
 github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/prashantv/gostub v1.1.0 h1:BTyx3RfQjRHnUWaGF9oQos79AlQ5k8WNktv7VGvVH4g=
+github.com/prashantv/gostub v1.1.0/go.mod h1:A5zLQHz7ieHGG7is6LLXLz7I8+3LZzsrV0P1IAHhP5U=
 github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
 github.com/redis/go-redis/v9 v9.0.3/go.mod h1:WqMKv5vnQbRuZstUwxQI195wHy+t4PuXDOjzMvcuQHk=
-github.com/redis/go-redis/v9 v9.7.2 h1:PSGhv13dJyrTCw1+55H0pIKM3WFov7HuUrKUmInGL0o=
+github.com/redis/go-redis/v9 v9.17.2 h1:P2EGsA4qVIM3Pp+aPocCJ7DguDHhqrXNhVcEp4ViluI=
-github.com/redis/go-redis/v9 v9.7.2/go.mod h1:yp5+a5FnEEP0/zTYuw6u6/2nn3zivwhv274qYgWQhDM=
+github.com/redis/go-redis/v9 v9.17.2/go.mod h1:u410H11HMLoB+TP67dz8rL9s6QW2j76l0//kSOd3370=
 github.com/robfig/cron/v3 v3.0.1 h1:WdRxkvbJztn8LMz/QEvLN5sBU+xKpSqwwUO1Pjr4qDs=
 github.com/robfig/cron/v3 v3.0.1/go.mod h1:eQICP3HwyT7UooqI/z+Ov+PtYAWygg1TEWWzGIFLtro=
 github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
@@ -342,8 +339,9 @@ github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/
 github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
 github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
 github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 github.com/stripe/stripe-go/v81 v81.1.0 h1:OlpGPO2vhS2raLR/NuvHKeRUZ57FTkdZBTcd5Hhoyos=
 github.com/stripe/stripe-go/v81 v81.1.0/go.mod h1:C/F4jlmnGNacvYtBp/LUHCvVUJEZffFQCobkzwY1WOo=
 github.com/tjfoc/gmsm v1.3.2/go.mod h1:HaUcFuY0auTiaHB9MHFGCPx5IaLhTUd2atbCFBQXn9w=
@@ -363,6 +361,8 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
 github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
 github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
+github.com/zeromicro/go-zero v1.9.4 h1:aRLFoISqAYijABtkbliQC5SsI5TbizJpQvoHc9xup8k=
+github.com/zeromicro/go-zero v1.9.4/go.mod h1:a17JOTch25SWxBcUgJZYps60hygK3pIYdw7nGwlcS38=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0 h1:TT4fX+nBOA/+LUkobKGW1ydGcn+G3vRw9+g5HwCphpk=
 go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.54.0/go.mod h1:L7UH0GbB0p47T4Rri3uHjbpCFYrVrwc1I25QhNPiGK8=
 go.opentelemetry.io/otel v1.29.0 h1:PdomN/Al4q/lN6iBJEN3AwPvUiHPMlt93c8bqTG5Llw=
@@ -387,8 +387,10 @@ go.opentelemetry.io/otel/trace v1.29.0 h1:J/8ZNK4XgR7a21DZUAsbF8pZ5Jcw1VhACmnYt3
 go.opentelemetry.io/otel/trace v1.29.0/go.mod h1:eHl3w0sp3paPkYstJOmAimxhiFXPg+MMTlEh3nsQgWQ=
 go.opentelemetry.io/proto/otlp v1.3.1 h1:TrMUixzpM0yuc/znrFTP9MMRh8trP93mkCiDVeXrui0=
 go.opentelemetry.io/proto/otlp v1.3.1/go.mod h1:0X1WI4de4ZsLrrJNLAQbFeLCm3T7yBkR0XqQ7niQU+8=
-go.uber.org/atomic v1.7.0 h1:ADUqmZGgLDDfbSL9ZmPxKTybcoEYHgpYfELNoN+7hsw=
+go.uber.org/atomic v1.10.0 h1:9qC72Qh0+3MqyJbAn8YU5xVq1frD8bn3JtD2oXtafVQ=
-go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc=
+go.uber.org/atomic v1.10.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0=
+go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
+go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.1.12/go.mod h1:cwTWslyiVhfpKIDGSZEM2HlOvcqm+tG4zioyIeLoqMQ=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
@@ -435,8 +437,8 @@ golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug
 golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.34.0 h1:Mb7Mrk043xzHgnRM88suvJFwzVrRfHEHJEl5/71CKw0=
+golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
-golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
+golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
 golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
@@ -485,8 +487,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
 golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.6.0 h1:eTDhh4ZXt5Qf0augr54TN6suAUudPcawVZeIAPU7D4U=
+golang.org/x/time v0.10.0 h1:3usCWA8tQn0L8+hFJQNgzpWbd89begxN66o1Ojdn5L4=
-golang.org/x/time v0.6.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
+golang.org/x/time v0.10.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
@@ -507,16 +509,16 @@ google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9Ywl
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
 google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto/googleapis/api v0.0.0-20240513163218-0867130af1f8 h1:W5Xj/70xIA4x60O/IFyXivR5MGqblAb8R3w26pnD6No=
+google.golang.org/genproto/googleapis/api v0.0.0-20240711142825-46eb208f015d h1:kHjw/5UfflP/L5EbledDrcG4C2597RtymmGRZvHiCuY=
-google.golang.org/genproto/googleapis/api v0.0.0-20240513163218-0867130af1f8/go.mod h1:vPrPUTsDCYxXWjP7clS81mZ6/803D8K4iM9Ma27VKas=
+google.golang.org/genproto/googleapis/api v0.0.0-20240711142825-46eb208f015d/go.mod h1:mw8MG/Qz5wfgYr6VqVCiZcHe/GJEfI+oGGDCohaVgB0=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240513163218-0867130af1f8 h1:mxSlqyb8ZAHsYDCfiXN1EDdNTdvjUJSLY+OnAUtYNYA=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094 h1:BwIjyKYGsK9dMCBOorzRri8MQwmi7mT9rGHsCEinZkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240513163218-0867130af1f8/go.mod h1:I7Y+G38R2bu5j1aLzfFmQfTcU/WnFuqDwLZAbvKTKpM=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240701130421-f6361c86f094/go.mod h1:Ue6ibwXGpU+dqIcODieyLOcgj7z8+IcskoNIgZxtrFY=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
 google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
-google.golang.org/grpc v1.64.1 h1:LKtvyfbX3UGVPFcGqJ9ItpVWW6oN/2XqTxfAnwRRXiA=
+google.golang.org/grpc v1.65.0 h1:bs/cUb4lp1G5iImFFd3u5ixQzweKizoZJAwBNLR42lc=
-google.golang.org/grpc v1.64.1/go.mod h1:hiQF4LFZelK2WKaP6W0L92zGHtiQdZxk8CrSdvyjeP0=
+google.golang.org/grpc v1.65.0/go.mod h1:WgYC2ypjlB0EiQi6wdKixMqukr6lBc0Vo+oOgjrM5ZQ=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
@@ -525,8 +527,8 @@ google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzi
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.3 h1:82DV7MYdb8anAVi3qge1wSnMDrnKK7ebr+I0hHRN1BU=
+google.golang.org/protobuf v1.36.5 h1:tPhr+woSbjfYvY6/GPufUoYizxw1cF/yFoxJ2fmpwlM=
-google.golang.org/protobuf v1.36.3/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
+google.golang.org/protobuf v1.36.5/go.mod h1:9fA7Ob0pmnwhb644+1+CVWFRbNajQ6iRojtC/QF5bRE=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc h1:2gGKlE2+asNV9m7xrywl36YYNnBG5ZQ0r/BOOxqPpmk=
 gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod h1:m7x9LTH6d71AHyAX77c9yqWCCa3UKHcVEj9y7hAtKDk=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -542,6 +544,8 @@ gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
 gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
+gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
+gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
@@ -552,6 +556,7 @@ gorm.io/driver/sqlite v1.4.4 h1:gIufGoR0dQzjkyqDyYSCvsYR6fba1Gw5YKDqKeChxFc=
 gorm.io/driver/sqlite v1.4.4/go.mod h1:0Aq3iPO+v9ZKbcdiz8gLWRw5VOPcBOPUQJFLq5e2ecI=
 gorm.io/gorm v1.20.1/go.mod h1:0HFTzE/SqkGTzK6TlDPPQbAYCluiVvhzoA1+aVyzenw=
 gorm.io/gorm v1.23.0/go.mod h1:l2lP/RyAtc1ynaTjFksBde/O8v9oOGIApu2/xRitmZk=
+gorm.io/gorm v1.24.0/go.mod h1:DVrVomtaYTbqs7gB/x2uVvqnXzv0nqjB396B8cG4dBA=
 gorm.io/gorm v1.25.7/go.mod h1:hbnx/Oo0ChWMn1BIhpy1oYozzpM15i4YPuHDmfYtwg8=
 gorm.io/gorm v1.25.12 h1:I0u8i2hWQItBq1WfE0o2+WuL9+8L21K9e2HHSTE/0f8=
 gorm.io/gorm v1.25.12/go.mod h1:xh7N7RHfYlNc5EmcI/El95gXusucDrQnHXe0+CgWcLQ=
@@ -561,4 +566,6 @@ honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWh
 honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 k8s.io/apimachinery v0.31.1 h1:mhcUBbj7KUjaVhyXILglcVjuS4nYXiwC+KKFBgIVy7U=
 k8s.io/apimachinery v0.31.1/go.mod h1:rsPdaZJfTfLsNJSQzNHQvYoTmxhoOEofxtOsF3rtsMo=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8 h1:pUdcCO1Lk/tbT5ztQWOBi5HBgbBP1J8+AsQnQCKsi8A=
+k8s.io/utils v0.0.0-20240711033017-18e509b52bc8/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=

grafana/provisioning/dashboards/dashboard.yml

@@ -0,0 +1,11 @@
+apiVersion: 1
+
+providers:
+  - name: 'Default'
+    orgId: 1
+    folder: ''
+    type: file
+    disableDeletion: false
+    updateIntervalSeconds: 10
+    options:
+      path: /var/lib/grafana/dashboards

grafana/provisioning/datasources/datasource.yml

@@ -0,0 +1,27 @@
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    type: prometheus
+    access: proxy
+    orgId: 1
+    url: http://prometheus:9090
+    isDefault: true
+    version: 1
+    editable: true
+
+  - name: Loki
+    type: loki
+    access: proxy
+    orgId: 1
+    url: http://loki:3100
+    version: 1
+    editable: true
+
+  - name: Jaeger
+    type: jaeger
+    access: proxy
+    orgId: 1
+    url: http://jaeger:16686
+    version: 1
+    editable: true

initialize/config.go

@@ -9,7 +9,6 @@ import (
 	"net/http"
 	"os"
 
-	"github.com/perfect-panel/server/internal/report"
 	"github.com/perfect-panel/server/pkg/logger"
 	"gorm.io/driver/mysql"
 
@@ -36,30 +35,10 @@ func Config(path string) (chan bool, *http.Server) {
 	configPath = path
 	// Create a new Gin instance
 	r := gin.Default()
-	// get server port
-	port := 8080
-	host := "127.0.0.1"
 
-	// check gateway mode
-	if report.IsGatewayMode() {
-		// get free port
-		freePort, err := report.ModulePort()
-		if err != nil {
-			logger.Errorf("get module port error: %s", err.Error())
-			panic(err)
-		}
-		port = freePort
-		// register module
-		err = report.RegisterModule(port)
-		if err != nil {
-			logger.Errorf("register module error: %s", err.Error())
-			panic(err)
-		}
-		logger.Infof("module registered on port %d", port)
-	}
 	// Create a new HTTP server
 	server := &http.Server{
-		Addr:    fmt.Sprintf("%s:%d", host, port),
+		Addr:    ":8080",
 		Handler: r,
 	}
 	// Load templates

initialize/currency.go

@@ -1,34 +0,0 @@
-package initialize
-
-import (
-	"context"
-	"fmt"
-
-	"github.com/perfect-panel/server/internal/config"
-	"github.com/perfect-panel/server/internal/svc"
-	"github.com/perfect-panel/server/pkg/logger"
-	"github.com/perfect-panel/server/pkg/tool"
-)
-
-func Currency(ctx *svc.ServiceContext) {
-	// Retrieve system currency configuration
-	currency, err := ctx.SystemModel.GetCurrencyConfig(context.Background())
-	if err != nil {
-		logger.Errorf("[INIT] Failed to get currency configuration: %v", err.Error())
-		panic(fmt.Sprintf("[INIT] Failed to get currency configuration: %v", err.Error()))
-	}
-	// Parse currency configuration
-	configs := struct {
-		CurrencyUnit   string
-		CurrencySymbol string
-		AccessKey      string
-	}{}
-	tool.SystemConfigSliceReflectToStruct(currency, &configs)
-	ctx.ExchangeRate = 0 // Default exchange rate to 0
-	ctx.Config.Currency = config.Currency{
-		Unit:      configs.CurrencyUnit,
-		Symbol:    configs.CurrencySymbol,
-		AccessKey: configs.AccessKey,
-	}
-	logger.Infof("[INIT] Currency configuration: %v", ctx.Config.Currency)
-}

initialize/init.go

@@ -15,7 +15,6 @@ func StartInitSystemConfig(svc *svc.ServiceContext) {
 	Subscribe(svc)
 	Register(svc)
 	Mobile(svc)
-	Currency(svc)
 	if !svc.Config.Debug {
 		Telegram(svc)
 	}

initialize/migrate/database/00002_init_basic_data.up.sql

@@ -116,7 +116,7 @@ VALUES (1, 'site', 'SiteLogo', '/favicon.svg', 'string', 'Site Logo', '2025-04-2
         '2025-04-22 14:25:16.641'),
        (37, 'currency', 'AccessKey', '', 'string', 'Exchangerate Access Key', '2025-04-22 14:25:16.641',
         '2025-04-22 14:25:16.641'),
-       (38, 'verify_code', 'VerifyCodeExpireTime', '300', 'int', 'Verify code expire time', '2025-04-22 14:25:16.641',
+       (38, 'verify_code', 'VerifyCodeExpireTime', '900', 'int', 'Verify code expire time', '2025-04-22 14:25:16.641',
         '2025-04-22 14:25:16.641'),
        (39, 'verify_code', 'VerifyCodeLimit', '15', 'int', 'limits of verify code', '2025-04-22 14:25:16.641',
         '2025-04-22 14:25:16.641'),

initialize/migrate/database/02118_traffic_log_idx.up.sql

@@ -1 +1,15 @@
-ALTER TABLE traffic_log ADD INDEX idx_timestamp (timestamp);
+SET @index_exists = (
+    SELECT COUNT(1)
+    FROM information_schema.STATISTICS
+    WHERE TABLE_SCHEMA = DATABASE()
+      AND TABLE_NAME = 'traffic_log'
+      AND INDEX_NAME = 'idx_timestamp'
+);
+
+SET @sql = IF(@index_exists = 0,
+    'CREATE INDEX idx_timestamp ON traffic_log (timestamp)',
+    'SELECT ''Index already exists'' AS message');
+
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;

initialize/migrate/database/02119_node.up.sql

@@ -0,0 +1,67 @@
+-- Add longitude if not exists
+SET @col_exists := (
+    SELECT COUNT(*)
+    FROM INFORMATION_SCHEMA.COLUMNS
+    WHERE TABLE_SCHEMA = DATABASE()
+      AND TABLE_NAME = 'servers'
+      AND COLUMN_NAME = 'longitude'
+);
+SET @sql := IF(
+    @col_exists = 0,
+    'ALTER TABLE `servers` ADD COLUMN `longitude` VARCHAR(255) DEFAULT '''' COMMENT ''longitude''',
+    'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- Add latitude if not exists
+SET @col_exists := (
+    SELECT COUNT(*)
+    FROM INFORMATION_SCHEMA.COLUMNS
+    WHERE TABLE_SCHEMA = DATABASE()
+      AND TABLE_NAME = 'servers'
+      AND COLUMN_NAME = 'latitude'
+);
+SET @sql := IF(
+    @col_exists = 0,
+    'ALTER TABLE `servers` ADD COLUMN `latitude` VARCHAR(255) DEFAULT '''' COMMENT ''latitude''',
+    'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- Add longitude_center if not exists
+SET @col_exists := (
+    SELECT COUNT(*)
+    FROM INFORMATION_SCHEMA.COLUMNS
+    WHERE TABLE_SCHEMA = DATABASE()
+      AND TABLE_NAME = 'servers'
+      AND COLUMN_NAME = 'longitude_center'
+);
+SET @sql := IF(
+    @col_exists = 0,
+    'ALTER TABLE `servers` ADD COLUMN `longitude_center` VARCHAR(255) DEFAULT '''' COMMENT ''longitude center''',
+    'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;
+
+-- Add latitude_center if not exists
+SET @col_exists := (
+    SELECT COUNT(*)
+    FROM INFORMATION_SCHEMA.COLUMNS
+    WHERE TABLE_SCHEMA = DATABASE()
+      AND TABLE_NAME = 'servers'
+      AND COLUMN_NAME = 'latitude_center'
+);
+SET @sql := IF(
+    @col_exists = 0,
+    'ALTER TABLE `servers` ADD COLUMN `latitude_center` VARCHAR(255) DEFAULT '''' COMMENT ''latitude center''',
+    'SELECT 1'
+);
+PREPARE stmt FROM @sql;
+EXECUTE stmt;
+DEALLOCATE PREPARE stmt;

initialize/migrate/database/02119_user_subscribe_note.down.sql

@@ -1,2 +0,0 @@
-ALTER TABLE `user_subscribe`
-DROP COLUMN `note`;

initialize/migrate/database/02119_user_subscribe_note.up.sql

@@ -1,4 +0,0 @@
-ALTER TABLE `user_subscribe`
-ADD COLUMN `note` VARCHAR(500) NOT NULL DEFAULT ''
-  COMMENT 'User note for subscription'
-  AFTER `status`;

initialize/migrate/database/02120_log_message.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS `log_message`;

initialize/migrate/database/02120_log_message.up.sql

@@ -0,0 +1,27 @@
+CREATE TABLE `log_message` (
+  `id` BIGINT UNSIGNED NOT NULL AUTO_INCREMENT,
+  `platform` VARCHAR(32) NOT NULL,
+  `app_version` VARCHAR(32) NULL,
+  `os_name` VARCHAR(32) NULL,
+  `os_version` VARCHAR(32) NULL,
+  `device_id` VARCHAR(64) NULL,
+  `user_id` BIGINT NULL DEFAULT NULL,
+  `session_id` VARCHAR(64) NULL,
+  `level` TINYINT UNSIGNED NOT NULL DEFAULT 3,
+  `error_code` VARCHAR(64) NULL,
+  `message` TEXT NOT NULL,
+  `stack` MEDIUMTEXT NULL,
+  `context` JSON NULL,
+  `client_ip` VARCHAR(45) NULL,
+  `user_agent` VARCHAR(255) NULL,
+  `locale` VARCHAR(16) NULL,
+  `digest` VARCHAR(64) NULL,
+  `occurred_at` DATETIME NULL,
+  `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  PRIMARY KEY (`id`),
+  UNIQUE KEY `uniq_digest` (`digest`),
+  KEY `idx_platform_time` (`platform`, `created_at`),
+  KEY `idx_user_time` (`user_id`, `created_at`),
+  KEY `idx_device_time` (`device_id`, `created_at`),
+  KEY `idx_error_code` (`error_code`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;

initialize/migrate/database/02120_user_rules.down.sql

@@ -1,2 +0,0 @@
-ALTER TABLE `user`
-DROP COLUMN IF EXISTS `rules`;

initialize/migrate/database/02120_user_rules.up.sql

@@ -1,4 +0,0 @@
-ALTER TABLE `user`
-    ADD COLUMN `rules` TEXT NULL
-  COMMENT 'User rules for subscription'
-  AFTER `created_at`;

initialize/migrate/database/02121_apple_iap_transactions.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS `apple_iap_transactions`;

initialize/migrate/database/02121_apple_iap_transactions.up.sql

@@ -0,0 +1,15 @@
+CREATE TABLE IF NOT EXISTS `apple_iap_transactions` (
+    `id` bigint(20) NOT NULL AUTO_INCREMENT,
+    `user_id` bigint(20) NOT NULL COMMENT 'User ID',
+    `original_transaction_id` varchar(255) NOT NULL COMMENT 'Original Transaction ID',
+    `transaction_id` varchar(255) NOT NULL COMMENT 'Transaction ID',
+    `product_id` varchar(255) NOT NULL COMMENT 'Product ID',
+    `purchase_at` datetime NOT NULL COMMENT 'Purchase Time',
+    `revocation_at` datetime DEFAULT NULL COMMENT 'Revocation Time',
+    `jws_hash` varchar(255) NOT NULL COMMENT 'JWS Hash',
+    `created_at` datetime DEFAULT NULL COMMENT 'Create Time',
+    `updated_at` datetime DEFAULT NULL COMMENT 'Update Time',
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uni_original` (`original_transaction_id`),
+    KEY `idx_user_id` (`user_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;

initialize/migrate/database/02121_user_withdrawal.down.sql

@@ -1,5 +0,0 @@
-DROP TABLE IF EXISTS `withdrawals`;
-
-DELETE FROM `system`
-WHERE `category` = 'invite'
-  AND `key` = 'WithdrawalMethod';

initialize/migrate/database/02121_user_withdrawal.up.sql

@@ -1,16 +0,0 @@
-CREATE TABLE IF NOT EXISTS `withdrawals` (
-    `id` BIGINT NOT NULL AUTO_INCREMENT COMMENT 'Primary Key',
-    `user_id` BIGINT NOT NULL COMMENT 'User ID',
-    `amount` BIGINT NOT NULL COMMENT 'Withdrawal Amount',
-    `content` TEXT COMMENT 'Withdrawal Content',
-    `status` TINYINT(1) NOT NULL DEFAULT 0 COMMENT 'Withdrawal Status',
-    `reason` VARCHAR(500) NOT NULL DEFAULT '' COMMENT 'Rejection Reason',
-    `created_at` DATETIME NOT NULL COMMENT 'Creation Time',
-    `updated_at` DATETIME NOT NULL COMMENT 'Update Time',
-    PRIMARY KEY (`id`),
-    KEY `idx_user_id` (`user_id`)
-    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
-
-INSERT IGNORE INTO `system` (`category`, `key`, `value`, `type`, `desc`, `created_at`, `updated_at`)
-VALUES
-    ('invite', 'WithdrawalMethod', '', 'string', 'withdrawal method', '2025-04-22 14:25:16.637', '2025-04-22 14:25:16.637');

initialize/migrate/database/02122_add_user_last_login_time.down.sql

@@ -0,0 +1 @@
+ALTER TABLE user DROP COLUMN last_login_time;