fix(admin,partner): harden Tencent locpicker coords and confirm flow

Accept latlng-only postMessage, confirm before apply, and read LBS key per request.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/h5-partner/src/lib/tencentLocPicker.ts

@@ -14,7 +14,22 @@ type LocPickerMessage = {
   cityname?: string;
 };
 
-const REFERER = 'dukang-haoke';
+const REFERER = 'dukang';
+
+function coerceMessageData(data: unknown): LocPickerMessage | null {
+  if (data == null) return null;
+  if (typeof data === 'string') {
+    const trimmed = data.trim();
+    if (!trimmed || (trimmed[0] !== '{' && trimmed[0] !== '[')) return null;
+    try {
+      return JSON.parse(trimmed) as LocPickerMessage;
+    } catch {
+      return null;
+    }
+  }
+  if (typeof data === 'object') return data as LocPickerMessage;
+  return null;
+}
 
 export function buildTencentLocPickerUrl(
   key: string,
@@ -26,6 +41,8 @@ export function buildTencentLocPickerUrl(
     key,
     referer: REFERER,
     policy: '1',
+    total: '20',
+    radius: '2000',
   });
   const lat = options?.latitude;
   const lng = options?.longitude;
@@ -43,17 +60,21 @@ export function buildTencentLocPickerUrl(
 }
 
 export function parseTencentLocPickerMessage(data: unknown): TencentPickedLocation | null {
-  const loc = data as LocPickerMessage;
+  const loc = coerceMessageData(data);
   if (!loc || loc.module !== 'locationPicker') return null;
   const lat = Number(loc.latlng?.lat);
   const lng = Number(loc.latlng?.lng);
   if (!Number.isFinite(lat) || !Number.isFinite(lng)) return null;
-  if (!loc.poiname && !loc.poiaddress) return null;
+
+  let name = loc.poiname?.trim() || undefined;
+  const address = loc.poiaddress?.trim() || undefined;
+  if (name === '我的位置' && address) name = address;
+
   return {
     latitude: lat,
     longitude: lng,
-    address: loc.poiaddress?.trim() || undefined,
-    name: loc.poiname?.trim() || undefined,
+    address,
+    name,
     cityname: loc.cityname?.trim() || undefined,
   };
 }