商品白名单

server/dukang-api/src/common/guards/optional-jwt-auth.guard.ts

@@ -7,6 +7,15 @@ import { JwtService } from '@nestjs/jwt';
 import { CLIENT_APP_ACTOR_MAP, ClientApp } from '@dukang/shared-types';
 import type { AuthUser } from './jwt-auth.guard';
 
+/** C 端 H5 / 小程序同属 USER，目录白名单只认 actorId→手机号，允许端间 token 兼容 */
+const USER_CLIENT_APPS = new Set<ClientApp>([ClientApp.USER_MINI, ClientApp.USER_H5]);
+
+function clientAppCompatible(headerApp: ClientApp | undefined, payloadApp: unknown): boolean {
+  if (!headerApp || payloadApp == null) return false;
+  if (headerApp === payloadApp) return true;
+  return USER_CLIENT_APPS.has(headerApp) && USER_CLIENT_APPS.has(payloadApp as ClientApp);
+}
+
 @Injectable()
 export class OptionalJwtAuthGuard implements CanActivate {
   constructor(private readonly jwtService: JwtService) {}
@@ -20,7 +29,7 @@ export class OptionalJwtAuthGuard implements CanActivate {
     try {
       const payload = this.jwtService.verify(auth.slice(7));
       const clientApp = req.headers['x-client-app'] as ClientApp;
-      if (!clientApp || payload.clientApp !== clientApp) return true;
+      if (!clientAppCompatible(clientApp, payload.clientApp)) return true;
       const expectedActor = CLIENT_APP_ACTOR_MAP[clientApp];
       if (payload.actorType !== expectedActor) return true;
       req.user = {

server/dukang-api/src/modules/catalog/catalog.service.ts

@@ -81,11 +81,9 @@ export class CatalogService {
     return serializeBigInt(
       visible.map((p) => {
         const media = mapProductMedia(p, resourceMap.get(p.id.toString()) ?? []);
-        const { visibilityPhones, ...rest } = p;
+        const { visibilityPhones: _phones, visibilityWhitelistEnabled: _wl, ...rest } = p;
         return {
           ...rest,
-          visibilityWhitelistEnabled: p.visibilityWhitelistEnabled,
-          visibilityPhones: visibilityPhones.map((row) => row.phone),
           benefitAmount: p.benefitAmount ?? p.price,
           price: Number(p.price),
           benefitDisplay: Number(p.benefitAmount ?? p.price),
@@ -119,11 +117,9 @@ export class CatalogService {
     });
 
     const media = mapProductMedia(product, resources);
-    const { visibilityPhones, ...rest } = product;
+    const { visibilityPhones: _phones, visibilityWhitelistEnabled: _wl, ...rest } = product;
     return serializeBigInt({
       ...rest,
-      visibilityWhitelistEnabled: product.visibilityWhitelistEnabled,
-      visibilityPhones: visibilityPhones.map((row) => row.phone),
       benefitAmount: product.benefitAmount ?? product.price,
       price: Number(product.price),
       ...media,