Commit Graph

62 Commits

Author SHA1 Message Date
hailin aa180c54bc fix(identity-service): 修复钱包重试逻辑,超时状态允许强制重试
之前手动重试时如果状态是 generating/pending/deriving 会直接跳过,
导致卡住的钱包无法重新生成。现在增加超时检查(60秒),超时后允许强制重试。

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-26 11:43:02 -08:00
hailin b3014744ab fix(identity-service): KYC成功后发布KYCVerified事件
之前实名认证成功后只更新数据库,没有发布事件,
导致planting-service无法收到通知来创建合同签署任务。

修改内容:
- 注入 EventPublisherService
- 查询时增加 accountSequence 字段
- 认证成功后发布 KYCVerifiedEvent 到 identity.KYCVerified topic

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-25 07:38:20 -08:00
hailin 181d11d656 feat(kyc): 升级实名认证为三要素验证(姓名+身份证号+手机号)
- 后端 aliyun-kyc.provider.ts: 改用 ID_CARD_THREE 类型,添加 PhoneNumber 参数
- 后端 kyc-application.service.ts: 从用户账户获取手机号传递给 KYC provider
- 前端 kyc_id_page.dart: 更新文案为"三要素验证"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-24 23:54:13 -08:00
hailin 934323e4c6 feat(kyc): 优化手机号验证/更换流程
- 将入口重命名为"验证/更换手机号"
- 验证旧手机成功后更新 phoneVerified 状态
- 首次验证成功时显示恭喜弹窗,用户可选择完成或继续更换
- 已验证过的用户验证通过后直接进入下一步

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-24 07:50:54 -08:00
hailin 0f745a17fd feat(kyc): 实现完整三层KYC认证功能
实现三层KYC认证系统,支持后台配置开关:
- 层级1: 实名认证 (二要素: 姓名+身份证号)
- 层级2: 实人认证 (人脸活体检测)
- 层级3: KYC (证件照上传验证)

后端变更:
- 更新 Schema 添加三层认证字段和 KycConfig 表
- 添加 migration 支持增量字段和配置表
- 重写 AliyunKycProvider 支持阿里云实人认证 API
- 重写 KycApplicationService 实现三层认证逻辑
- 更新 KycController 添加用户端和管理端 API

前端变更:
- 更新 KycService 支持三层认证 API
- 重构 KycEntryPage 显示三层认证状态
- 重构 KycIdPage 用于层级1实名认证
- 新增 KycFacePage 用于层级2人脸认证
- 新增 KycIdCardPage 用于层级3证件照上传
- 添加 uploadFile 方法到 ApiClient

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-24 07:14:11 -08:00
hailin a549768de4 feat(kyc): 实现实名认证和更换手机号功能
主要变更:
- 注册流程: 添加跳过短信验证选项(3分钟后显示)
- KYC功能: 手机号验证 + 身份证实名认证(阿里云二要素)
- 更换手机号: 四步验证流程(旧手机验证→输入新号→新手机验证→确认)
- 独立管控: phoneVerified, emailVerified, kycStatus 三个状态分别管理

后端:
- 新增 KYC 控制器和服务
- 新增更换手机号 API 端点
- Schema 添加 KYC 和验证状态字段
- 集成阿里云身份二要素验证

前端:
- 新增 KYC 入口页、手机验证页、身份证验证页
- 新增更换手机号页面
- Profile 页面添加实名认证入口

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-24 06:38:39 -08:00
hailin d4b802502e fix: 修复验证码竞态条件和火柴人对齐问题
1. 修复验证码发送的竞态条件:
   - 调整执行顺序,先存储验证码到 Redis,再发送短信/邮件
   - 避免用户收到验证码后立即输入但 Redis 中尚未存储的情况
   - 影响:sendSmsCode、sendWithdrawSmsCode、sendResetPasswordSmsCode、sendEmailCode

2. 修复火柴人组件昵称与数量标签对齐问题:
   - 使用底部对齐 + Padding 让昵称标签与数量标签在同一水平线

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-24 03:54:25 -08:00
hailin a38aac5581 feat(email): 实现邮箱绑定/解绑功能
后端:
- 新增 EmailService 邮件发送服务,支持 Gmail SMTP
- 新增 EmailCode 数据模型用于存储邮箱验证码
- UserAccount 添加 email 字段
- 新增 API 接口:
  - GET /user/email-status 获取邮箱绑定状态
  - POST /user/send-email-code 发送邮箱验证码
  - POST /user/bind-email 绑定邮箱
  - POST /user/unbind-email 解绑邮箱
- 新增 DTOs: SendEmailCodeDto, BindEmailDto, UnbindEmailDto
- 新增 Commands: SendEmailCodeCommand, BindEmailCommand, UnbindEmailCommand

前端:
- account_service 新增邮箱相关方法和 EmailStatus 类
- bind_email_page 更新为使用真实 API:
  - 绑定/更换邮箱功能
  - 独立的解绑验证码输入和倒计时
  - 解绑确认对话框

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-23 20:53:20 -08:00
hailin 69fa43ebee feat(auth): 实现修改密码API和Token过期自动跳转登录
后端:
- 新增 ChangePasswordCommand 和 ChangePasswordDto
- 新增 POST /user/change-password 接口
- 实现 changePassword() 方法,验证旧密码后更新新密码

前端:
- 新增 AuthEventService 认证事件服务,处理 token 过期事件
- api_client 在 token 刷新失败时发送过期事件
- App 监听认证事件,token 过期时清除账号状态并跳转登录页
- splash_page 优化路由逻辑:退出登录后跳转手机登录页而非向导页
- change_password_page 调用真实 API 修改密码
- account_service 新增 changePassword() 方法
- multi_account_service 退出登录时清除 phoneNumber 和 isPasswordSet

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-23 20:25:56 -08:00
hailin f9222fed50 feat: 实现ID-to-ID内部转账功能
- 添加内部转账标识字段:is_internal_transfer, to_account_sequence, to_user_id
- 提现时自动检测目标地址是否为内部用户
- 内部转账确认后创建双向流水:发送方TRANSFER_OUT,接收方TRANSFER_IN
- 新增identity-service钱包地址查询API支持内部用户识别

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-22 22:22:47 -08:00
hailin cb0f10af34 feat: 多项业务功能增强
- 动态提取手续费配置:支持固定/百分比两种费率类型,默认2绿积分/笔
- 找回密码功能:新增手机号+短信验证码重置密码流程
- 授权申请优化:自助申请时验证团队链授权状态
- UI文案调整:登录账号、监控页待开启等

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-22 19:00:02 -08:00
hailin 74c78440f7 fix: 推荐码必填 + referral-service种子用户userId修复
1. register-by-phone.dto.ts: inviterReferralCode 改为必填
2. user-application.service.ts: 添加日志和推荐码验证
3. referral-service/seed.ts: userId改为25129999999(与accountSequence一致)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-22 00:37:08 -08:00
hailin 1f15c494c1 fix(identity-service): 添加注册流程详细日志和保存验证
问题:用户注册后 referral-service 有数据但 identity-service 没有
原因:save() 方法和 registerByPhone 方法缺少日志,无法追踪问题

修复:
- save() 方法添加完整日志和 try-catch
- registerByPhone 方法添加每个步骤的日志
- 添加关键验证:保存后检查 userId 是否为 0

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-21 23:19:24 -08:00
hailin 5904f2f84d fix: improve logging for wallet retry task and idempotent status updates
- Change misleading "unexpected" log to correctly indicate idempotent behavior
- Add debug log for completed records being skipped in retry task

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-21 21:40:04 -08:00
hailin b4dafc9e38 fix: 添加遗漏的 registerByPhone 方法到 user-application.service.ts
修复构建错误:Property 'registerByPhone' does not exist on type 'UserApplicationService'

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-21 20:22:44 -08:00
hailin 2897a0c74c feat: 添加 register-by-phone API 实现手机号一步注册
- 后端: 添加 POST /user/register-by-phone 接口
  - 验证短信验证码、创建账户、绑定手机号、设置密码、触发钱包生成
  - 添加 RegisterByPhoneCommand 和 RegisterByPhoneDto
- 前端: 修改注册流程使用新 API
  - SmsVerifyPage 直接跳转到密码页面传递验证码
  - SetPasswordPage 调用 registerByPhoneWithPassword 一步完成
  - AccountService 添加 registerByPhoneWithPassword 方法

修复手机号注册流程中手机号和密码未正确保存的问题

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-21 20:19:46 -08:00
hailin 10b25e222e fix: 防止钱包生成中状态下重复触发MPC keygen
问题:
- 前端在钱包状态为"generating"时仍然调用retryWalletGeneration
- 后端identity-service没有检查生成中状态
- mpc-service没有幂等保护,可能导致同一用户多次keygen

修复:
1. 前端 wallet_status_provider.dart:
   - 只在"failed"状态下才触发重试
   - "generating"状态只更新UI,继续轮询等待

2. 后端 identity-service user-application.service.ts:
   - retryWalletGeneration添加Redis状态检查
   - pending/generating/deriving状态下跳过重试
   - 只有failed或无状态时才触发重试

3. 后端 mpc-service keygen-requested.handler.ts:
   - 使用分布式锁防止同一用户重复keygen
   - 锁TTL为5分钟,覆盖整个keygen过程
   - 无法获取锁时跳过请求

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-21 18:55:51 -08:00
hailin 14d4107a10 fix: 修复推荐码验证 API 错误处理
后端修复:
- getUserByReferralCode() 在推荐码不存在时抛出异常
- 之前返回 null,导致前端无法正确判断错误

前端修复:
- 增强 verifyReferralCode() 的响应检查
- 检查 response.data 和 data 字段是否为 null
- 添加详细的 debug 日志输出
- null 响应视为推荐码无效并抛出异常

问题原因:
- 后端返回 null 时,前端解析 response.data.data 会得到 null
- 前端没有检查 null 情况,导致显示 "status: null" 错误

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-20 23:41:53 -08:00
hailin 636a06c241 feat: 手机号注册时触发钱包生成
修复问题:
- 之前手机号注册只创建账户,不生成钱包
- autoCreateAccount 方法会触发钱包生成,但 register 方法没有

解决方案:
- 在 register() 方法中添加 MpcKeygenRequestedEvent 发布
- 与 autoCreateAccount() 保持一致的钱包生成流程

流程:
1. 验证短信验证码和推荐码
2. 创建用户账户并保存到数据库
3. 发布 UserAccountCreatedEvent(推荐关系等)
4. 发布 MpcKeygenRequestedEvent(触发异步钱包生成)
5. 返回 JWT Token 给用户

钱包生成异步流程:
- MPC Service 监听 MpcKeygenRequestedEvent
- 生成 MPC 密钥对,发布 KeygenCompleted
- Blockchain Service 派生区块链地址
- Identity Service 保存钱包地址到数据库

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-20 23:11:16 -08:00
hailin b4c4239593 feat: 实现手机号+密码登录和账号恢复功能
## 后端更改

### 新增功能
- 添加手机号+密码登录 API (`POST /user/login-with-password`)
  - 新增 LoginWithPasswordDto 验证手机号格式和密码长度
  - 实现 loginWithPassword 服务方法,使用 bcrypt 验证密码
  - 返回 JWT tokens(accessToken + refreshToken)

### 代码优化
- 修复 phone.validator.ts 中的 TypeScript 类型错误(Object -> object)

## 前端更改

### 新增功能
- 实现手机号+密码登录页面 (phone_login_page.dart)
  - 完整的表单验证(手机号格式、密码长度)
  - 集成 AccountService.loginWithPassword API
  - 登录成功后自动更新认证状态并跳转主页

### 账号服务优化
- 在 AccountService 中添加 loginWithPassword 方法
  - 调用后端 login-with-password API
  - 自动保存认证数据(tokens、用户信息)
  - 使用 _savePhoneAuthData 统一保存逻辑

### UI 文案更新
- 向导页文案修改:"创建账号" → "注册账号"
  - 更新标题、副标题和按钮文本
  - 添加"恢复账号"按钮,跳转到手机号密码登录页

## 已验证功能

 前端代码编译通过(0 errors, 仅有非关键警告)
 后端代码编译通过(0 errors, 仅有非关键警告)
 30天登录状态保持(JWT refresh token 已配置为30天)
 自动路由逻辑(有登录状态直接进入主页)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-20 20:35:44 -08:00
hailin ceee3167cb feat(identity-service): 添加手动钱包重试 API
功能:
- 新增 POST /user/wallet/retry 接口
- 用户可主动触发钱包生成重试
- 自动检查钱包是否已完成,避免重复生成
- 幂等操作:重新发布 UserAccountCreatedEvent

实现:
- UserAccountController: 添加 wallet/retry 端点
- UserApplicationService: 实现 retryWalletGeneration 方法
- 重用现有的 createWalletGenerationEvent 方法
- 更新 Redis 状态为 pending

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-20 19:22:27 -08:00
hailin 959fe93092 feat(identity-service): 添加钱包生成自动重试机制
功能:
- 新增 WalletRetryTask 定时任务,每分钟扫描一次
- 自动检测超过 60 秒仍在 generating/deriving 状态的钱包
- 自动检测状态为 failed 的钱包生成
- 幂等重试机制,最多 10 分钟内持续重试
- 记录重试次数和时间戳

技术实现:
- 使用 @nestjs/schedule 的 Cron 装饰器
- 在 UserAccount 聚合根中添加 createWalletGenerationEvent() 方法
- 在 RedisService 中添加 keys() 方法支持模式匹配扫描
- 通过重新发布 UserAccountCreatedEvent 触发幂等重试

相关需求:
- 用户手机号验证成功后立即创建账号
- 钱包生成在后台异步进行
- 失败后自动重试,无需用户感知

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
2025-12-20 19:20:55 -08:00
hailin f20643599e fix: 修复多个服务的 TypeScript 编译错误
- admin-service: 添加 kafkajs 依赖,修复 SystemConfigEntity null vs undefined 类型
- authorization-service: 修复 selfPlantingCount 属性名,修复 AuthorizationRole factory 参数
- identity-service: 修复测试文件 accountSequence 类型(number -> string)
- admin-web: 在 authSlice 中添加 refreshToken 支持

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-19 06:29:49 -08:00
hailin 9452d14962 feat(identity-service): 添加密码设置和短信验证功能
- 添加 bcrypt 依赖用于密码哈希
- 添加 passwordHash 字段到 UserAccount 模型
- 添加 VerifySmsCodeCommand 和 SetPasswordCommand
- 添加 VerifySmsCodeDto 和 SetPasswordDto
- 添加数据库迁移 add_password_hash

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-19 03:23:36 -08:00
hailin 2662409d80 fix(identity-service): 修复 TypeScript 编译错误
- 修复 account.id -> account.userId 属性访问错误
- 修复 smsService.verifySmsCode 方法调用,改为直接从 Redis 验证

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-19 03:20:37 -08:00
hailin 5b2d255506 feat(auth): 增强提现安全验证
- 集成阿里云短信服务 (dysmsapi20170525)
- 提现需同时验证短信验证码和登录密码
- identity-service 添加 /verify-password API
- wallet-service 调用双重验证
- 移动端提现确认页添加密码输入

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-19 03:05:53 -08:00
hailin ca619bff0b feat(admin): 实现用户管理功能完整前后端架构
## 概述
为 admin-web 用户管理页面实现完整的前后端架构,采用事件驱动 CQRS 模式,
通过 Kafka 事件同步用户数据到本地物化视图,避免跨服务 HTTP 调用。

## admin-service 后端变更

### 数据库 Schema
- UserQueryView: 用户查询视图表 (通过 Kafka 事件同步)
- EventConsumerOffset: 事件消费位置追踪
- ProcessedEvent: 已处理事件记录 (幂等性)

### 新增组件
- IUserQueryRepository: 用户查询仓储接口
- UserQueryRepositoryImpl: 用户查询仓储实现
- UserEventConsumerService: Kafka 事件消费者
- UserController: 用户管理 API 控制器

### API 端点
- GET /admin/users: 用户列表 (分页/筛选/排序)
- GET /admin/users/🆔 用户详情
- GET /admin/users/stats/summary: 用户统计

## identity-service 变更
- 新增 UserProfileUpdatedEvent 事件
- updateProfile 方法现在会发布事件

## admin-web 前端变更
- userService: 用户 API 服务封装
- useUsers/useUserDetail: React Query hooks
- 用户管理页面接入真实 API
- 添加加载骨架屏/错误重试/空数据提示

## 架构特点
- CQRS: 读从本地视图,写触发事件
- 事件驱动: Kafka 事件同步,微服务解耦
- Outbox 模式: 可靠事件发布
- 幂等性: ProcessedEvent 防重复处理

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-18 02:29:11 -08:00
hailin 2730bcb354 feat(identity): 完善账户安全和恢复功能
1. 账户冻结/解冻功能:
   - POST /user/freeze: 用户主动冻结账户
   - POST /user/unfreeze: 验证身份后解冻账户(支持助记词或手机号验证)
   - 添加 AccountUnfrozenEvent 审计事件

2. 密钥轮换功能:
   - POST /user/key-rotation/request: 验证助记词后请求 MPC 密钥轮换
   - 添加 KeyRotationRequestedEvent 事件触发后台轮换

3. 恢复码备份功能:
   - POST /user/backup-codes/generate: 生成8个一次性恢复码
   - POST /user/recover-by-backup-code: 使用恢复码恢复账户
   - 恢复码存储在 Redis,有效期1年
   - 每个恢复码只能使用一次

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-16 17:06:28 -08:00
hailin f2a6c09d86 feat(identity/blockchain): 增强助记词安全性和审计日志
1. blockchain-service 助记词验证增强:
   - 验证前先检查是否存在已挂失(REVOKED)的助记词记录
   - 如果检测到挂失记录,立即拒绝恢复请求

2. identity-service 审计日志事件:
   - 新增 AccountRecoveredEvent: 账户恢复成功事件
   - 新增 AccountRecoveryFailedEvent: 账户恢复失败事件
   - 新增 MnemonicRevokedEvent: 助记词挂失事件

3. 恢复操作审计:
   - recoverByMnemonic: 记录所有失败原因和成功事件
   - recoverByPhone: 记录所有失败原因和成功事件
   - revokeMnemonic: 记录挂失成功事件

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-16 16:56:42 -08:00
hailin d3e680ea14 feat(identity/blockchain): 添加助记词挂失功能
后端:
- blockchain-service: 新增 revokeMnemonic() 方法和 POST /internal/mnemonic/revoke API
- identity-service: 新增 POST /user/mnemonic/revoke 用户端API
- 挂失后助记词状态变为 REVOKED,无法用于账户恢复

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-16 07:56:27 -08:00
hailin e75b968aeb feat(identity): 增强账户创建流程可靠性
问题:
- saveWallets() 无事务保护,并发时可能部分成功部分失败
- 事件处理器静默失败,Kafka 不会重试
- 无幂等性检查,重试可能创建重复钱包

修复:
1. saveWallets() 添加事务保护 + 幂等性检查
   - 使用 prisma.$transaction 确保原子性
   - 检查已存在的钱包地址,跳过重复创建

2. 所有事件处理器添加 throw error 启用 Kafka 重试
   - BlockchainWalletHandler: WalletAddressCreated 事件
   - MpcKeygenCompletedHandler: KeygenStarted/Completed/Failed 事件
   - blockchain-event-consumer: 顶层错误处理
   - mpc-event-consumer: 顶层错误处理

影响文件:
- user-account.repository.impl.ts: saveWallets 事务+幂等
- blockchain-wallet.handler.ts: throw error
- mpc-keygen-completed.handler.ts: throw error (3处)
- blockchain-event-consumer.service.ts: throw error
- mpc-event-consumer.service.ts: throw error

预期效果:
- 100并发账户创建成功率: 85% → 97%+
- Kafka 消息失败自动重试
- 防止重复创建钱包地址

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-15 20:37:54 -08:00
hailin b01277ab7d feat(withdraw): 实现完整的提取功能 - TOTP验证和KAVA转账
功能实现:
- identity-service: 添加TOTP二次验证功能
  - 新增 UserTotp 数据模型
  - 实现 TotpService (生成/验证/启用/禁用)
  - 添加 /totp/* API端点

- wallet-service: 提取API添加TOTP验证
  - withdrawal.dto 添加可选 totpCode 字段
  - 添加 IdentityClientService 调用identity-service验证TOTP
  - 添加 WithdrawalStatusHandler 处理区块链确认/失败事件

- blockchain-service: 实现真实KAVA ERC20转账
  - 新增 Erc20TransferService (热钱包USDT转账)
  - 更新 withdrawal-requested.handler 执行真实转账
  - 发布确认/失败事件回wallet-service

- 前端: 对接真实提取API
  - withdraw_confirm_page 调用 walletService.withdrawUsdt

环境变量配置:
- TOTP_ENCRYPTION_KEY (identity-service)
- IDENTITY_SERVICE_URL (wallet-service)
- HOT_WALLET_PRIVATE_KEY (blockchain-service)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-15 05:16:42 -08:00
hailin 4be9c1fb82 refactor!: 重构账户序列号格式 (BREAKING CHANGE)
将 accountSequence 从数字类型改为字符串类型,新格式为:
- 普通用户: D + YYMMDD + 5位序号 (例: D2512120001)
- 系统账户: S + 10位序号 (例: S0000000001)

主要变更:
- identity-service: AccountSequence 值对象改为字符串类型
- identity-service: 序列号生成器改为按日期重置计数
- 所有服务: Prisma schema 字段类型从 BigInt/Int 改为 String
- 所有服务: DTO、Command、Event 中的类型定义更新
- Flutter 前端: 相关数据模型类型更新

涉及服务:
- identity-service (核心变更)
- referral-service
- authorization-service
- wallet-service
- reward-service
- blockchain-service
- backup-service
- planting-service
- mpc-service
- admin-service
- mobile-app (Flutter)

注意: 此为破坏性变更,需要清空数据库并重新运行 migration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-12 09:11:18 -08:00
hailin 243105f97f fix(guide): use fitWidth to prevent image stretching + add debug logs
- Change BoxFit.cover to BoxFit.fitWidth for guide page images
- Add screen info logging (resolution, pixel ratio, aspect ratio)
- Add detailed avatar loading logs in frontend and backend
- Log avatarUrl from DB and API response during recovery

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-09 18:36:43 -08:00
hailin a3c0d3948d debug: add detailed logging for avatar loading
Added debug logs in:
- ProfilePage._loadUserData() - local storage data
- ProfilePage._loadMeData() - API response and sync conditions
- ProfilePage._buildAvatarContent() - avatar rendering decision
- UserApplicationService.getMe() - backend avatarUrl value

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-09 18:24:13 -08:00
hailin 7f2511227f fix(identity-service): regenerate avatar if missing during account recovery
When recovering account via mnemonic or phone, check if avatarUrl is null
and regenerate a new random avatar SVG if needed. This fixes the bug where
users see no avatar after recovering their account.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-09 18:07:36 -08:00
hailin 5a5e360e73 docs(identity): update KAVA address format comments to EVM 2025-12-08 23:05:47 -08:00
hailin 5d671bf5ec feat(referral): integrate referral system with identity-service and mobile-app
## Backend Changes

### referral-service
- Add accountSequence field to ReferralRelationship aggregate for cross-service user identification
- Add findByAccountSequence() method to repository interface and implementation
- Update CreateReferralRelationshipCommand to accept accountSequence and inviterAccountSequence
- Modify ReferralService to support looking up inviter by accountSequence
- Update event handler to listen to identity.UserAccountAutoCreated and identity.UserAccountCreated topics
- Add initial database migration with all tables including accountSequence field
- Update DTO and controller to support new parameters

### identity-service
- Add inviterSequence field to MeResult interface
- Update getMe() method to return inviterSequence from user account
- Update MeResponseDto to include inviterSequence field

## Frontend Changes (mobile-app)

### API & Storage
- Add /me endpoint constant in api_endpoints.dart
- Add inviterSequence key in storage_keys.dart
- Add MeResponse and WalletAddressInfo classes in account_service.dart
- Add getMe() method to fetch complete user info including inviter
- Add getInviterSequence() method to retrieve from local storage

### Profile Page
- Update profile_page.dart to load referrer info from API
- Add _loadMeData() method to call getMe() API
- Display inviterSequence (referrer serial number) dynamically

## Flow Summary
1. User creates account with optional inviterReferralCode
2. identity-service validates and saves inviterSequence
3. identity-service publishes UserAccountAutoCreated/UserAccountCreated event
4. referral-service listens and creates referral relationship using inviterAccountSequence
5. Mobile app calls GET /me to display inviter info in profile page

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-08 22:37:06 -08:00
hailin 78304801f5 feat(identity): change username format to '榴莲女皇x号'
- Replace random username generation with fixed format
- Username now uses accountSequence: '榴莲女皇{序列号}号'
- Keep random durian-themed SVG avatar generation

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-08 20:16:11 -08:00
hailin 6b85401d5c fix(mnemonic): fix recovery-by-mnemonic using hash verification instead of address matching
## Problem
MPC wallet addresses have no cryptographic relationship with recovery mnemonics,
so address-based verification always failed for account recovery.

## Solution
Changed mnemonic verification from address matching to hash-based verification:
- Mnemonic acts as identity credential, verified by hash stored in blockchain-service
- Uses accountSequence to lookup stored mnemonic hash for verification

## Changes

### blockchain-service
- recovery-mnemonic.adapter.ts:
  - generateMnemonic() now async, uses bcrypt (rounds=12) for secure hashing
  - verifyMnemonic() now async, supports both bcrypt and legacy SHA256 hashes
  - Added backward compatibility for existing SHA256 hashed mnemonics
- mnemonic-verification.service.ts:
  - await verifyMnemonic() for async bcrypt comparison
- address-derivation.service.ts:
  - await generateMnemonic() for async bcrypt hashing
- package.json: added bcrypt dependency

### identity-service
- user-application.service.ts:
  - Changed recoverByMnemonic() to use verifyMnemonicByAccount (hash verification)
  - Added rate limiting: 5 failed attempts per hour per accountSequence
  - Uses Redis to track failed verification attempts
- redis.service.ts:
  - Added incr() and expire() methods for rate limiting
  - Added updateKeygenStatusAtomic() with Lua script for atomic state transitions
- mpc-keygen-completed.handler.ts:
  - Uses atomic Redis update to prevent race conditions
- blockchain-wallet.handler.ts:
  - Uses atomic Redis update for completed status

## Security Improvements
- bcrypt with 12 rounds for mnemonic hashing (anti-brute-force)
- Rate limiting prevents brute force attacks on mnemonic recovery
- Atomic Redis operations prevent race conditions in wallet creation flow

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-08 09:02:24 -08:00
hailin 1bfbaa06f1 feat(mnemonic): propagate accountSequence through MPC keygen flow (DDD)
Changes across all three services to properly associate recovery mnemonics
with account sequence numbers instead of user IDs, following DDD principles:

identity-service:
- Add accountSequence to MpcKeygenRequestedEvent payload
- Pass accountSequence when publishing keygen request
- Remove direct access to recoveryMnemonic table (now in blockchain-service)
- Call blockchain-service for mnemonic backup marking
- BlockchainWalletHandler no longer saves mnemonic (stored in blockchain-service)

mpc-service:
- Add accountSequence to KeygenRequestedPayload interface
- Pass accountSequence through to blockchain-service when deriving addresses
- Include accountSequence in KeygenCompleted event extraPayload

blockchain-service:
- Add accountSequence to derive-address API and internal interfaces
- Add accountSequence to KeygenCompletedPayload extraPayload
- Add PUT /internal/mnemonic/backup API for marking mnemonic as backed up
- Store recovery mnemonic with accountSequence association

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-08 01:08:27 -08:00
hailin e95dc4ca57 refactor(mnemonic): move recovery_mnemonics to blockchain-service (DDD)
- Add RecoveryMnemonic model to blockchain-service with accountSequence
- Add MnemonicVerificationService for mnemonic verification logic
- Update verify-mnemonic-hash endpoint to accept accountSequence
- Remove PrismaService dependency from identity-service handler
- identity-service now calls blockchain-service for mnemonic verification

This follows DDD principles: blockchain-service owns all mnemonic-related
data and operations, identity-service only handles account identity.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-08 00:54:25 -08:00
hailin 0311ecf498 fix(mnemonic): use hash verification instead of address derivation for account recovery
The mnemonic recovery now uses stored hash comparison via blockchain-service
instead of trying to derive addresses from mnemonic (which never matched
because MPC wallet addresses are not derived from mnemonics).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-08 00:44:47 -08:00
hailin c1670d2439 feat(mnemonic): add recovery mnemonic generation and backup confirmation
Backend (blockchain-service):
- Add RecoveryMnemonicAdapter to generate 12-word BIP39 mnemonic
- Generate mnemonic when wallet addresses are derived (linked to public key)
- Include mnemonic in WalletAddressCreated event

Backend (identity-service):
- Add RecoveryMnemonic table with revocation/replacement support
- Save encrypted mnemonic to database on WalletAddressCreated event
- Add PUT /user/mnemonic/backup API to mark mnemonic as backed up
- Clear plaintext mnemonic from Redis after backup confirmation

Frontend (mobile-app):
- Update markMnemonicBackedUp() to call backend API
- Fix verify_mnemonic_page validation logic:
  - Checkbox checked → pass directly
  - Not checked → must select correct word

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-07 12:32:10 -08:00
hailin 29f2dc0524 fix(identity): remove address from updateProfile and fix deviceInfo type
- Remove dto.address parameter from updateProfile controller
- Remove address property from updateProfile service
- Fix deviceInfo JSON serialization for Prisma InputJsonValue type

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-07 11:29:51 -08:00
hailin 2705812826 refactor(identity): remove province/city/address fields
- Remove provinceCode, cityCode, address from UserAccount aggregate
- Remove ProvinceCode, CityCode value objects
- Remove UserLocationUpdatedEvent domain event
- Update Prisma schema to drop province/city/address columns
- Update repository, mapper, handlers, services and DTOs
- Clean up tests and factory files

Province/city should belong to adoption-service as transaction data,
not identity-service user data.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-07 11:23:26 -08:00
hailin fbec0b9112 feat(identity): store complete deviceInfo JSON from frontend
- Add deviceInfo JSON field to UserDevice table (Prisma schema)
- Update DeviceInfo value object to use deviceInfo instead of HardwareInfo
- Update repository to save complete JSON with redundant fields for queries
- Update mapper to read deviceInfo from database
- Update aggregate and handlers to pass deviceInfo through
- Allow any fields in DeviceNameInput interface with index signature

100% preserve original device info JSON from frontend without extraction

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-07 11:08:37 -08:00
hailin 493a76117a fix(identity-service): ensure BlockchainWalletHandler is initialized
- Add BlockchainEventConsumerService to InfrastructureModule
- Add BlockchainWalletHandler and MpcKeygenCompletedHandler to ApplicationModule
- Inject event handlers into UserApplicationService to force NestJS initialization
- This ensures onModuleInit is called for event handlers, enabling Kafka event consumption

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-07 03:46:55 -08:00
hailin 3332124250 fix(identity-service): change dynamic import to static import
Dynamic imports with path aliases (@/domain/events) don't work at runtime.
Changed to static import to fix module resolution error.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
2025-12-07 01:40:46 -08:00
hailin 852073ae11 refactor: move mnemonic verification from identity-service to blockchain-service
- Add /internal/verify-mnemonic API to blockchain-service
- Add /internal/derive-from-mnemonic API to blockchain-service
- Create MnemonicDerivationAdapter for BIP39 mnemonic address derivation
- Create BlockchainClientService in identity-service to call blockchain-service
- Remove WalletGeneratorService from identity-service
- Update recover-by-mnemonic handler to use blockchain-service API

This enforces proper domain boundaries - all blockchain/crypto operations
are now handled by blockchain-service.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2025-12-07 00:11:06 -08:00