'init'

app/api/auth/logout/route.ts

@@ -0,0 +1,8 @@
+import { NextRequest, NextResponse } from "next/server";
+import { COOKIE_NAME, getCookieOptions, getHostFromRequest } from "@/app/lib/auth-cookie";
+
+export async function POST(request: NextRequest) {
+  const res = NextResponse.json({ ok: true });
+  res.cookies.set(COOKIE_NAME, "", getCookieOptions(true, getHostFromRequest(request)) as Record<string, string | number | boolean>);
+  return res;
+}

app/api/auth/me/route.ts

@@ -0,0 +1,85 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getPocketBaseConfig, SITE_ID } from "@/config/services.config";
+import { getAdminToken } from "@/app/lib/pocketbase/admin";
+import { COOKIE_NAME, COOKIE_MAX_AGE } from "@/app/lib/auth-cookie";
+
+async function checkVip(userId: string): Promise<boolean> {
+  try {
+    const token = await getAdminToken();
+    if (!token) return false;
+    const pb = getPocketBaseConfig();
+    const filter = `user_id = "${userId}" && site_id = "${SITE_ID}"`;
+    const res = await fetch(
+      `${pb.url}/api/collections/site_vip/records?filter=${encodeURIComponent(filter)}&perPage=1`,
+      { headers: { Authorization: `Bearer ${token}` }, cache: "no-store" }
+    );
+    if (!res.ok) return false;
+    const data = await res.json();
+    const items = data?.items ?? [];
+    const record = items[0];
+    if (!record) return false;
+    const now = new Date().toISOString();
+    const isExpired = record?.expires_at && record.expires_at < now;
+    return !isExpired;
+  } catch {
+    return false;
+  }
+}
+
+export async function GET(request: NextRequest) {
+  const cookie = request.cookies.get(COOKIE_NAME)?.value;
+  if (!cookie) {
+    return NextResponse.json({ ok: true, user: null });
+  }
+  try {
+    const payload = JSON.parse(Buffer.from(cookie, "base64url").toString("utf-8"));
+    const { token, userId, email } = payload;
+    if (!token || !userId) return NextResponse.json({ ok: true, user: null });
+
+    const pb = getPocketBaseConfig();
+    const res = await fetch(`${pb.url}/api/collections/${pb.usersCollection}/auth-refresh`, {
+      method: "POST",
+      headers: { Authorization: `Bearer ${token}` },
+      cache: "no-store",
+    });
+    if (!res.ok) {
+      const r = NextResponse.json({ ok: true, user: null });
+      r.cookies.set(COOKIE_NAME, "", { path: "/", maxAge: 0 });
+      return r;
+    }
+    const data = await res.json();
+    const newToken = data.token;
+    const newRecord = data.record;
+    if (newToken && newRecord?.id) {
+      const newPayload = JSON.stringify({
+        token: newToken,
+        userId: newRecord.id,
+        email: newRecord.email ?? email,
+      });
+      const encoded = Buffer.from(newPayload, "utf-8").toString("base64url");
+      const vip = await checkVip(newRecord.id);
+      const r = NextResponse.json({
+        ok: true,
+        user: { id: newRecord.id, email: newRecord.email ?? email, vip },
+        token: newToken,
+      });
+      r.cookies.set(COOKIE_NAME, encoded, {
+        path: "/",
+        maxAge: COOKIE_MAX_AGE,
+        secure: process.env.NODE_ENV === "production",
+        sameSite: "lax",
+        httpOnly: true,
+      });
+      return r;
+    }
+    const uid = data.record?.id ?? userId;
+    const vip = uid ? await checkVip(uid) : false;
+    return NextResponse.json({
+      ok: true,
+      user: { id: uid, email: data.record?.email ?? email, vip },
+      token: data.token,
+    });
+  } catch {
+    return NextResponse.json({ ok: true, user: null });
+  }
+}

app/api/auth/sync-session/route.ts

@@ -0,0 +1,22 @@
+import { NextRequest, NextResponse } from "next/server";
+import { COOKIE_NAME, getCookieOptions, getHostFromRequest } from "@/app/lib/auth-cookie";
+
+export async function POST(request: NextRequest) {
+  const body = await request.json().catch(() => ({}));
+  const token = body?.token;
+  const record = body?.record;
+  if (!token || !record?.id) {
+    return NextResponse.json({ ok: false, error: "缺少 token 或 record" }, { status: 400 });
+  }
+
+  const payload = JSON.stringify({
+    token,
+    userId: record.id,
+    email: record.email ?? "",
+  });
+  const encoded = Buffer.from(payload, "utf-8").toString("base64url");
+
+  const res = NextResponse.json({ ok: true });
+  res.cookies.set(COOKIE_NAME, encoded, getCookieOptions(false, getHostFromRequest(request)) as Record<string, string | number | boolean>);
+  return res;
+}

app/api/join/route.ts

@@ -0,0 +1,60 @@
+import { NextRequest, NextResponse } from "next/server";
+import { postSalonApi } from "@/app/lib/salonApi";
+import { COOKIE_NAME } from "@/app/lib/auth-cookie";
+
+function getUserIdFromCookie(request: NextRequest): string | null {
+  const cookie = request.cookies.get(COOKIE_NAME)?.value;
+  if (!cookie) return null;
+  try {
+    const payload = JSON.parse(Buffer.from(cookie, "base64url").toString("utf-8"));
+    return payload?.userId ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const userId = getUserIdFromCookie(request);
+    if (!userId) {
+      return NextResponse.json({ ok: false, error: "请先登录" }, { status: 401 });
+    }
+    const body = await request.json();
+    const formData = body && typeof body === "object" ? body : {};
+
+    const record = {
+      user_id: userId,
+      nickname: formData.nickname || "",
+      occupation: formData.profession || "",
+      reason: formData.intro || "",
+      single: formData.single || "",
+      wechatId: formData.wechat || "",
+      gender: formData.gender || "",
+      education: formData.education || "",
+      gradYear: formData.graduationYear || "",
+      phone: formData.phone || "",
+      media: formData.media || "",
+    };
+
+    const { status, data } = await postSalonApi(request, "/api/salon/join", record);
+    if (status >= 500) {
+      const payload = typeof data === "object" && data !== null ? (data as Record<string, unknown>) : {};
+      return NextResponse.json(
+        { ok: false, error: (payload.detail as string) || (payload.error as string) || "提交失败" },
+        { status: 503 }
+      );
+    }
+    if (status >= 400) {
+      return NextResponse.json(data, { status });
+    }
+    const payload = typeof data === "object" && data !== null ? (data as Record<string, unknown>) : {};
+    return NextResponse.json({ ok: true, user_id: payload.user_id ?? userId });
+  } catch (e) {
+    const msg = e instanceof Error ? e.message : String(e);
+    console.error("Join API error:", e);
+    return NextResponse.json(
+      { ok: false, error: `提交失败: ${msg}` },
+      { status: 500 }
+    );
+  }
+}

app/api/join/status/route.ts

@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getSalonApi } from "@/app/lib/salonApi";
+import { COOKIE_NAME } from "@/app/lib/auth-cookie";
+
+function getUserIdFromCookie(request: NextRequest): string | null {
+  const cookie = request.cookies.get(COOKIE_NAME)?.value;
+  if (!cookie) return null;
+  try {
+    const payload = JSON.parse(Buffer.from(cookie, "base64url").toString("utf-8"));
+    return payload?.userId ?? null;
+  } catch {
+    return null;
+  }
+}
+
+export async function GET(request: NextRequest) {
+  const userId = getUserIdFromCookie(request);
+  if (!userId) {
+    return NextResponse.json({ hasRecord: false, isComplete: false });
+  }
+
+  try {
+    const { status, data } = await getSalonApi(
+      request,
+      `/api/salon/join/status?user_id=${encodeURIComponent(userId)}`
+    );
+    if (status !== 200) {
+      return NextResponse.json({ hasRecord: false, isComplete: false });
+    }
+    const payload = typeof data === "object" && data !== null ? (data as Record<string, unknown>) : {};
+    return NextResponse.json({
+      hasRecord: !!payload.hasRecord,
+      isComplete: !!payload.isComplete,
+    });
+  } catch {
+    return NextResponse.json({ hasRecord: false, isComplete: false });
+  }
+}

app/api/pay/route.ts

@@ -0,0 +1,467 @@
+import { NextRequest, NextResponse } from "next/server";
+import {
+  getApiUrlFromRequest,
+  getJoinPaymentConfig,
+  getPaymentConfig,
+  SITE_ID,
+} from "@/config/services.config";
+import { SITE_URL } from "@/app/lib/env";
+
+const ORDER_COOKIE = "join_pay_order";
+const SALON_PAY_PREFIX = "/salon";
+
+function resolvePayApiUrl(request: NextRequest): string {
+  const config = getPaymentConfig();
+  const hostHeader =
+    request.headers.get("host") || request.headers.get("x-forwarded-host");
+  return (getApiUrlFromRequest(hostHeader) || config.apiUrl).replace(/\/$/, "");
+}
+
+function setPayOrderCookie(response: NextResponse, orderId: string) {
+  response.cookies.set(ORDER_COOKIE, `${orderId}|${Date.now()}`, {
+    path: "/",
+    maxAge: 900,
+  });
+}
+
+function escapeAttr(s: string): string {
+  return String(s)
+    .replace(/&/g, "&")
+    .replace(/"/g, """)
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;");
+}
+
+function buildPayHtml(
+  payUrl: string,
+  params: Record<string, unknown>,
+  options?: { directToCashier?: boolean; orderId?: string }
+): string {
+  const inputs = Object.entries(params)
+    .filter(([, value]) => value != null && String(value).trim() !== "")
+    .map(
+      ([key, value]) =>
+        `<input type="hidden" name="${escapeAttr(key)}" value="${escapeAttr(
+          String(value)
+        )}" />`
+    )
+    .join("\n");
+
+  const pendingOrderScript = options?.orderId
+    ? `<script>(function(){var v=${JSON.stringify(
+        `${options.orderId}|${Date.now()}`
+      )};try{localStorage.setItem("join_pay_order",v);}catch(e){}document.cookie="join_pay_order="+encodeURIComponent(v)+"; path=/; max-age=900";})();</script>`
+    : "";
+
+  return options?.directToCashier
+    ? `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>支付</title><style>body{margin:0;overflow:hidden}</style></head><body><form id="f" action="${escapeAttr(
+        payUrl
+      )}" method="POST">${inputs}</form>${pendingOrderScript}<script>document.getElementById("f").submit()</script></body></html>`
+    : `<!DOCTYPE html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>跳转支付</title><style>body{font-family:system-ui;display:flex;justify-content:center;align-items:center;min-height:100vh;margin:0;background:#f0f4f8;}p{color:#64748b;}</style></head><body><p>正在跳转到支付页面...</p><form id="f" action="${escapeAttr(
+        payUrl
+      )}" method="POST">${inputs}</form>${pendingOrderScript}<script>document.getElementById("f").submit()</script></body></html>`;
+}
+
+function buildQrHtml(
+  imgSrc: string,
+  returnUrl: string,
+  orderId: string,
+  opts?: { channel?: string; successDesc?: string; confirmUrl?: string }
+): string {
+  const ch = (opts?.channel || "wxpay").toLowerCase();
+  const isWx = ch === "wxpay" || ch === "wx" || ch === "wechat";
+  const title = isWx ? "微信扫码支付" : "支付宝扫码支付";
+  const hint = isWx ? "请使用微信扫描下方二维码完成支付" : "请使用支付宝扫描下方二维码完成支付";
+  const successDesc = opts?.successDesc || "支付成功，即将跳转";
+  const confirmUrl = opts?.confirmUrl || "/api/salon/complete-order";
+  const esc = (s: string) =>
+    s.replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c] || c);
+  return `<!DOCTYPE html>
+<html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${esc(title)}</title>
+<style>
+*{box-sizing:border-box;}
+body{font-family:system-ui,-apple-system,sans-serif;display:flex;flex-direction:column;align-items:center;justify-content:center;min-height:100vh;margin:0;background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);}
+.card{background:#fff;border-radius:20px;padding:40px;box-shadow:0 25px 50px -12px rgba(0,0,0,.25);max-width:420px;}
+h2{color:#1e293b;margin:0 0 8px;font-size:1.5rem;}
+.hint{color:#64748b;font-size:14px;margin-bottom:20px;}
+.wait-row{display:flex;align-items:center;justify-content:center;gap:24px;margin:20px 0;}
+.qr-wrap img{width:200px;height:200px;border-radius:12px;border:2px solid #e2e8f0;background:#fff;}
+.countdown-wrap{width:72px;height:72px;flex-shrink:0;position:relative;}
+.countdown-ring{transform:rotate(-90deg);}
+.countdown-ring circle{fill:none;stroke-width:5;transition:stroke-dashoffset .5s linear;}
+.countdown-ring .bg{stroke:#e2e8f0;}
+.countdown-ring .progress{stroke:#22c55e;stroke-linecap:round;}
+.countdown-inner{position:absolute;inset:0;display:flex;flex-direction:column;align-items:center;justify-content:center;}
+.countdown-num{font-size:1rem;font-weight:700;color:#1e293b;line-height:1;}
+.countdown-unit{font-size:9px;color:#94a3b8;}
+.tip{font-size:13px;color:#64748b;margin-top:16px;}
+.success-wrap{display:none;}
+.success-wrap.show{display:block;}
+.wait-wrap.hide{display:none;}
+.success-icon{font-size:4rem;margin-bottom:16px;animation:scaleIn .4s ease;}
+.success-title{font-size:1.25rem;color:#16a34a;font-weight:600;margin-bottom:8px;}
+.success-desc{color:#64748b;font-size:14px;margin-bottom:24px;}
+.success-countdown{font-size:1.5rem;font-weight:700;color:#667eea;}
+@keyframes scaleIn{from{transform:scale(0);opacity:0;}to{transform:scale(1);opacity:1;}}
+@keyframes pulse{0%,100%{opacity:1;}50%{opacity:.7;}}
+.pulse{animation:pulse 2s ease-in-out infinite;}
+</style></head>
+<body>
+<div class="card">
+  <div class="wait-wrap" id="waitWrap">
+    <h2>${esc(title)}</h2>
+    <p class="hint">${esc(hint)}</p>
+    <div class="wait-row">
+      <div class="countdown-wrap">
+        <svg class="countdown-ring" width="72" height="72" viewBox="0 0 72 72">
+          <circle class="bg" cx="36" cy="36" r="32"/>
+          <circle class="progress" id="progressCircle" cx="36" cy="36" r="32" stroke-dasharray="201" stroke-dashoffset="0"/>
+        </svg>
+        <div class="countdown-inner">
+        <span class="countdown-num" id="countdownNum">5:00</span>
+        <span class="countdown-unit">分</span>
+        </div>
+      </div>
+      <div class="qr-wrap">
+        <img src="${imgSrc}" alt="支付二维码" />
+      </div>
+    </div>
+    <p class="tip pulse" id="tip">等待支付中...</p>
+  </div>
+  <div class="success-wrap" id="successWrap">
+    <div class="success-icon">✅</div>
+    <div class="success-title">支付成功</div>
+    <div class="success-desc">${esc(successDesc)}</div>
+    <div class="success-countdown" id="successCountdown">3 秒后跳转</div>
+  </div>
+</div>
+<script>
+(function(){
+  try{localStorage.setItem("join_pay_order",${JSON.stringify(`${orderId}|${Date.now()}`)});}catch(e){}
+  var orderId=${JSON.stringify(orderId)};
+  var returnUrl=${JSON.stringify(returnUrl)};
+  if(!orderId){return;}
+  var waitWrap=document.getElementById("waitWrap");
+  var successWrap=document.getElementById("successWrap");
+  var tip=document.getElementById("tip");
+  var countdownNum=document.getElementById("countdownNum");
+  var progressCircle=document.getElementById("progressCircle");
+  var successCountdown=document.getElementById("successCountdown");
+  var maxT=300,left=maxT;
+  var circumference=2*Math.PI*32;
+  function fmt(t){var m=Math.floor(t/60),s=t%60;return m+":"+(s<10?"0":"")+s;}
+  var countdownTimer=setInterval(function(){
+    left--;
+    countdownNum.textContent=left>60?fmt(left):left;
+    progressCircle.style.strokeDashoffset=circumference*(1-left/maxT);
+    if(left<=0){clearInterval(countdownTimer);tip.textContent="支付超时，返回首页";setTimeout(function(){window.location.href="/";},800);}
+  },1000);
+  function showSuccess(){
+    clearInterval(countdownTimer);
+    waitWrap.classList.add("hide");
+    successWrap.classList.add("show");
+    var s=3;
+    var t=setInterval(function(){
+      s--;
+      successCountdown.textContent=s>0?s+" 秒后跳转":"跳转中…";
+      if(s<=0){clearInterval(t);window.location.href=returnUrl;}
+    },1000);
+  }
+  var confirmUrl=${JSON.stringify(confirmUrl)};
+  function doConfirm(attempt){
+    if(attempt>=3){showSuccess();return;}
+    fetch(confirmUrl,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({order_id:orderId})})
+      .then(function(r){return r.json();})
+      .then(function(cd){
+        if(cd&&cd.ok){showSuccess();}
+        else{setTimeout(function(){doConfirm(attempt+1);},800);}
+      })
+      .catch(function(){setTimeout(function(){doConfirm(attempt+1);},800);});
+  }
+  function check(){
+    fetch("/api/pay/status?order_id="+encodeURIComponent(orderId),{cache:"no-store"})
+      .then(function(r){return r.json();})
+      .then(function(d){
+        if(d.ok&&d.paid){doConfirm(0);return;}
+        setTimeout(check,500);
+      })
+      .catch(function(){setTimeout(check,500);});
+  }
+  setTimeout(check,500);
+})();
+</script>
+</body></html>`;
+}
+
+async function createPayOrder(
+  apiUrl: string,
+  userId: string,
+  returnUrl: string,
+  totalFee: number,
+  type: string,
+  channel: string,
+  provider?: "xorpay",
+  clientIp?: string
+) {
+  const payload: Record<string, unknown> = {
+    user_id: userId,
+    site_id: SITE_ID,
+    total_fee: totalFee,
+    type,
+    channel,
+    return_url: returnUrl,
+    ...(provider ? { provider } : {}),
+    ...(clientIp ? { client_ip: clientIp } : {}),
+  };
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 10000);
+  const res = await fetch(`${apiUrl}${SALON_PAY_PREFIX}/payh5`, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(payload),
+    signal: controller.signal,
+  }).finally(() => clearTimeout(timeout));
+
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || data?.status !== "ok") {
+    console.error("[pay] salon createPayOrder failed status=%s body=%j", res.status, data);
+    throw new Error(data?.detail || data?.msg || data?.message || "支付创建失败");
+  }
+
+  return {
+    params: (data.params ?? data.xorpay_params ?? {}) as Record<string, string>,
+    payUrl:
+      data.pay_url || data.xorpay_url || getPaymentConfig().zpaySubmitUrl,
+    provider: String(data.provider || (provider ? "xorpay" : "zpay")).trim(),
+    orderId: String(
+      data.order_id ||
+        data.params?.out_trade_no ||
+        data.xorpay_params?.order_id ||
+        ""
+    ).trim(),
+  };
+}
+
+async function requestRedirect(
+  apiUrl: string,
+  path: string,
+  payload: Record<string, unknown>
+) {
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 12000);
+  try {
+    return await fetch(`${apiUrl}${path}`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify(payload),
+      redirect: "manual",
+      signal: controller.signal,
+    });
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    let body: Record<string, string | number>;
+    const contentType = request.headers.get("content-type") || "";
+    if (contentType.includes("application/json")) {
+      body = (await request.json()) as Record<string, string | number>;
+    } else {
+      const form = await request.formData();
+      body = Object.fromEntries(form.entries()) as Record<string, string>;
+    }
+
+    const joinConfig = getJoinPaymentConfig();
+    const payConfig = getPaymentConfig();
+    const hostHeader =
+      request.headers.get("host") || request.headers.get("x-forwarded-host");
+    const apiUrl = resolvePayApiUrl(request);
+    const userId = String(body?.user_id || "").trim();
+    const totalFee = Number(body?.total_fee) || joinConfig.amount;
+    const type = String(body?.type || joinConfig.type);
+    const channel = String(body?.channel || "wxpay");
+    const device = String(body?.device || "pc");
+    const forcedProvider = device === "wechat" ? "xorpay" : undefined;
+
+    if (!userId) {
+      return NextResponse.json(
+        { ok: false, error: "缺少 user_id" },
+        { status: 400 }
+      );
+    }
+
+    const origin =
+      request.headers.get("x-forwarded-host")
+        ? `${request.headers.get("x-forwarded-proto") || "https"}://${request.headers.get("x-forwarded-host")}`
+        : request.headers.get("origin") || SITE_URL;
+    const returnUrl =
+      String(body?.return_url || "").trim() || `${origin}/join/paid`;
+    const clientIp =
+      request.headers.get("x-forwarded-for")?.split(",")[0]?.trim() ||
+      request.headers.get("x-real-ip") ||
+      "";
+    const wantHtml =
+      String(body?.html) === "1" ||
+      (request.headers.get("accept") || "").includes("text/html");
+
+    console.log(
+      "[pay] salon apiUrl=%s host=%s provider=%s device=%s",
+      apiUrl,
+      hostHeader,
+      forcedProvider || "default",
+      device
+    );
+
+    const created = await createPayOrder(
+      apiUrl,
+      userId,
+      returnUrl,
+      totalFee,
+      type,
+      channel,
+      forcedProvider,
+      clientIp
+    );
+
+    if (!wantHtml) {
+      const response = NextResponse.json({
+        ok: true,
+        params: created.params,
+        payUrl: created.payUrl,
+        provider: created.provider,
+        order_id: created.orderId,
+      });
+      if (created.orderId) setPayOrderCookie(response, created.orderId);
+      return response;
+    }
+
+    if (created.provider === "xorpay") {
+      const html = buildPayHtml(created.payUrl, created.params, {
+        directToCashier: true,
+        orderId: created.orderId,
+      });
+      const response = new NextResponse(html, {
+        status: 200,
+        headers: { "Content-Type": "text/html; charset=utf-8" },
+      });
+      if (created.orderId) setPayOrderCookie(response, created.orderId);
+      return response;
+    }
+
+    const redirectPayload: Record<string, unknown> = {
+      user_id: userId,
+      site_id: SITE_ID,
+      total_fee: totalFee,
+      type,
+      channel,
+      return_url: returnUrl,
+      device,
+      ...(clientIp ? { client_ip: clientIp } : {}),
+    };
+
+    try {
+      const redirectRes = await requestRedirect(
+        apiUrl,
+        `${SALON_PAY_PREFIX}/payh5/redirect`,
+        redirectPayload
+      );
+
+      if (redirectRes.status >= 301 && redirectRes.status <= 308) {
+        const location = redirectRes.headers.get("location");
+        if (location) {
+          const response = NextResponse.redirect(location);
+          const orderId =
+            redirectRes.headers.get("x-pay-order-id")?.trim() ||
+            created.orderId;
+          if (orderId) setPayOrderCookie(response, orderId);
+          return response;
+        }
+      }
+
+      const resData = await redirectRes.json().catch(() => ({}));
+      if (redirectRes.status === 200 && resData?.qrcode_mode && resData?.img) {
+        const safeReturnUrl = String(resData.return_url || returnUrl).replace(
+          /[&<>"']/g,
+          (c) =>
+            ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[
+              c
+            ] || c)
+        );
+        const imgSrc = String(resData.img).replace(
+          /[&<>"']/g,
+          (c) =>
+            ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[
+              c
+            ] || c)
+        );
+        const rawOrderId = String(resData.order_id || created.orderId).trim();
+        const html = buildQrHtml(imgSrc, safeReturnUrl, rawOrderId, {
+          channel: resData.channel || "wxpay",
+          successDesc: "支付成功，申请已提交",
+          confirmUrl: "/api/salon/complete-order",
+        });
+        const response = new NextResponse(html, {
+          status: 200,
+          headers: { "Content-Type": "text/html; charset=utf-8" },
+        });
+        if (rawOrderId) setPayOrderCookie(response, rawOrderId);
+        return response;
+      }
+
+      if (redirectRes.status === 200 && resData?.use_form) {
+        const html = buildPayHtml(payConfig.zpaySubmitUrl, created.params, {
+          directToCashier: true,
+          orderId: String(resData.order_id || created.orderId).trim(),
+        });
+        const response = new NextResponse(html, {
+          status: 200,
+          headers: { "Content-Type": "text/html; charset=utf-8" },
+        });
+        const orderId = String(resData.order_id || created.orderId).trim();
+        if (orderId) setPayOrderCookie(response, orderId);
+        return response;
+      }
+
+      if (redirectRes.status >= 400) {
+        console.warn(
+          "[pay] redirect fallback status=%s body=%j",
+          redirectRes.status,
+          resData
+        );
+      }
+    } catch (error) {
+      console.warn(
+        "[pay] redirect fallback error=%s",
+        error instanceof Error ? error.message : String(error)
+      );
+    }
+
+    const html = buildPayHtml(created.payUrl, created.params, {
+      orderId: created.orderId,
+    });
+    const response = new NextResponse(html, {
+      status: 200,
+      headers: { "Content-Type": "text/html; charset=utf-8" },
+    });
+    if (created.orderId) setPayOrderCookie(response, created.orderId);
+    return response;
+  } catch (error) {
+    const err = error instanceof Error ? error : new Error(String(error));
+    const msg = err.message || "";
+    const hint =
+      msg.includes("fetch") || msg.includes("ECONNREFUSED")
+        ? "请确认 payjsapi 已启动：cd payjsapi && python run.py"
+        : err.name === "AbortError"
+          ? "请求超时，请检查 payjsapi 是否正常运行"
+          : msg;
+    console.error("Pay API error:", err);
+    return NextResponse.json(
+      { ok: false, error: `支付请求失败: ${hint}` },
+      { status: 500 }
+    );
+  }
+}

app/api/pay/status/route.ts

@@ -0,0 +1,46 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getApiUrlFromRequest, getPaymentConfig } from "@/config/services.config";
+
+function resolvePayApiUrl(request: NextRequest): string {
+  const config = getPaymentConfig();
+  const hostHeader =
+    request.headers.get("host") || request.headers.get("x-forwarded-host");
+  return (getApiUrlFromRequest(hostHeader) || config.apiUrl).replace(/\/$/, "");
+}
+
+export async function GET(request: NextRequest) {
+  const orderId = request.nextUrl.searchParams.get("order_id");
+  if (!orderId) {
+    return NextResponse.json(
+      { ok: false, error: "missing order_id" },
+      { status: 400 }
+    );
+  }
+
+  const hostHeader =
+    request.headers.get("host") || request.headers.get("x-forwarded-host");
+  const apiUrl = resolvePayApiUrl(request);
+  const url = `${apiUrl}/salon/order_status?order_id=${encodeURIComponent(orderId)}`;
+
+  try {
+    const controller = new AbortController();
+    const timeout = setTimeout(() => controller.abort(), 3000);
+    const res = await fetch(url, {
+      cache: "no-store",
+      signal: controller.signal,
+    }).finally(() => clearTimeout(timeout));
+    const data = await res.json().catch(() => ({}));
+    const paid = !!data?.paid;
+    if (paid) {
+      return NextResponse.json({ ok: true, paid: true });
+    }
+  } catch (error) {
+    console.log(
+      "[pay/status] error order_id=%s error=%s",
+      orderId,
+      error instanceof Error ? error.message : String(error)
+    );
+  }
+
+  return NextResponse.json({ ok: true, paid: false });
+}

app/api/salon/check-user/route.ts

@@ -0,0 +1,28 @@
+import { NextRequest, NextResponse } from "next/server";
+import { postSalonApi } from "@/app/lib/salonApi";
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json().catch(() => ({}));
+    const email = String(body?.email || "").trim();
+    if (!email) {
+      return NextResponse.json({ ok: false, error: "请输入邮箱" }, { status: 400 });
+    }
+
+    const { status, data } = await postSalonApi(request, "/api/salon/check-user", { email });
+    const payload = typeof data === "object" && data !== null ? (data as Record<string, unknown>) : {};
+    if (status >= 500) {
+      return NextResponse.json(
+        { ok: false, error: (payload.error as string) || "服务暂时不可用，请稍后重试" },
+        { status: 503 }
+      );
+    }
+    return NextResponse.json(data, { status });
+  } catch (error) {
+    console.error("salon check-user error:", error);
+    return NextResponse.json(
+      { ok: false, error: "服务暂时不可用，请稍后重试" },
+      { status: 503 }
+    );
+  }
+}

app/api/salon/complete-order/route.ts

@@ -0,0 +1,27 @@
+import { NextRequest, NextResponse } from "next/server";
+import { postSalonApi } from "@/app/lib/salonApi";
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json().catch(() => ({}));
+    const order_id = String(body?.order_id || "").trim();
+    if (!order_id) {
+      return NextResponse.json({ ok: false, error: "缺少 order_id" }, { status: 400 });
+    }
+
+    const { status, data } = await postSalonApi(request, "/api/salon/complete-order", {
+      order_id,
+    });
+    if (status >= 500) {
+      const payload = typeof data === "object" && data !== null ? (data as Record<string, unknown>) : {};
+      return NextResponse.json(
+        { ok: false, error: (payload.detail as string) || (payload.error as string) || "操作失败" },
+        { status: 503 }
+      );
+    }
+    return NextResponse.json(data, { status });
+  } catch (error) {
+    console.error("salon complete-order error:", error);
+    return NextResponse.json({ ok: false, error: "操作失败" }, { status: 500 });
+  }
+}

app/api/salon/ensure-user/route.ts

@@ -0,0 +1,29 @@
+import { NextRequest, NextResponse } from "next/server";
+import { postSalonApi } from "@/app/lib/salonApi";
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json().catch(() => ({}));
+    const email = String(body?.email || "").trim();
+    const password = String(body?.password || "").trim();
+    if (!email) {
+      return NextResponse.json({ ok: false, error: "请输入邮箱" }, { status: 400 });
+    }
+
+    const { status, data } = await postSalonApi(request, "/api/salon/ensure-user", {
+      email,
+      password: password || undefined,
+    });
+    if (status >= 500) {
+      const payload = typeof data === "object" && data !== null ? (data as Record<string, unknown>) : {};
+      return NextResponse.json(
+        { ok: false, error: (payload.error as string) || "操作失败" },
+        { status: 503 }
+      );
+    }
+    return NextResponse.json(data, { status });
+  } catch (error) {
+    console.error("salon ensure-user error:", error);
+    return NextResponse.json({ ok: false, error: "操作失败" }, { status: 500 });
+  }
+}

app/api/salon/set-needs-password-change/route.ts

@@ -0,0 +1,5 @@
+import { NextResponse } from "next/server";
+
+export async function POST() {
+  return NextResponse.json({ ok: true });
+}

app/api/upload-media/route.ts

@@ -0,0 +1,23 @@
+import { NextRequest, NextResponse } from "next/server";
+
+export async function POST(request: NextRequest) {
+  try {
+    const formData = await request.formData();
+    const file = formData.get("file");
+    if (!file || !(file instanceof File)) {
+      return NextResponse.json({ ok: false, error: "请选择文件" }, { status: 400 });
+    }
+    if (file.size > 20 * 1024 * 1024) {
+      return NextResponse.json({ ok: false, error: "文件大小不能超过 20MB" }, { status: 400 });
+    }
+    const publicUrl = process.env.MINIO_PUBLIC_URL || "https://example.com/uploads";
+    const prefix = process.env.MINIO_UPLOAD_PREFIX || "joins";
+    const ext = file.name.split(".").pop() || "jpg";
+    const filename = `${prefix}/${Date.now()}-${Math.random().toString(36).slice(2)}.${ext}`;
+    const url = `${publicUrl}/${filename}`;
+    return NextResponse.json({ ok: true, url });
+  } catch (e) {
+    console.error("upload-media error:", e);
+    return NextResponse.json({ ok: false, error: "上传失败" }, { status: 500 });
+  }
+}

app/api/vip/check/route.ts

@@ -0,0 +1,41 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getPocketBaseConfig, SITE_ID } from "@/config/services.config";
+import { getAdminToken } from "@/app/lib/pocketbase/admin";
+
+const COOKIE_NAME = "pb_session";
+
+export async function GET(request: NextRequest) {
+  const cookie = request.cookies.get(COOKIE_NAME)?.value;
+  if (!cookie) {
+    return NextResponse.json({ ok: true, vip: false });
+  }
+  try {
+    const payload = JSON.parse(Buffer.from(cookie, "base64url").toString("utf-8"));
+    const userId = payload?.userId;
+    if (!userId) return NextResponse.json({ ok: true, vip: false });
+
+    const token = await getAdminToken();
+    if (!token) return NextResponse.json({ ok: true, vip: false });
+
+    const pb = getPocketBaseConfig();
+    const filter = `user_id = "${userId}" && site_id = "${SITE_ID}"`;
+    const res = await fetch(
+      `${pb.url}/api/collections/site_vip/records?filter=${encodeURIComponent(filter)}&perPage=1`,
+      { headers: { Authorization: `Bearer ${token}` } }
+    );
+    if (!res.ok) return NextResponse.json({ ok: true, vip: false });
+    const data = await res.json();
+    const items = data?.items ?? [];
+    const record = items[0];
+    const now = new Date().toISOString();
+    const isExpired = record?.expires_at && record.expires_at < now;
+    const vip = !!record && !isExpired;
+    return NextResponse.json({
+      ok: true,
+      vip,
+      expires_at: record?.expires_at ?? null,
+    });
+  } catch {
+    return NextResponse.json({ ok: true, vip: false });
+  }
+}