fix(mini-user): address review blockers

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/modules/iam/auth.service.ts

@@ -2,6 +2,7 @@ import { randomUUID } from 'crypto';
 import {
   BadRequestException,
   ForbiddenException,
+  forwardRef,
   Inject,
   Injectable,
   NotFoundException,
@@ -22,6 +23,7 @@ import { serializeBigInt } from '../../common/decorators/current-user.decorator'
 import { verifyPassword } from '../../common/crypto/password.util';
 import { AnalyticsService } from '../analytics/analytics.service';
 import { UserAddressService } from './user-address.service';
+import { ResourceService } from '../common/resource.service';
 
 import type { User } from '@prisma/client';
 
@@ -62,6 +64,7 @@ export class AuthService {
     private readonly analyticsService: AnalyticsService,
     private readonly smsCodeStore: SmsCodeStore,
     private readonly userAddressService: UserAddressService,
+    @Inject(forwardRef(() => ResourceService)) private readonly resourceService: ResourceService,
   ) {}
 
   private assertMobilePhone(phone: string) {
@@ -1407,12 +1410,9 @@ export class AuthService {
 
   async updateMiniWechatProfile(
     userId: bigint,
-    input: { nickname?: string; avatarUrl?: string },
+    input: { nickname?: string; avatarUrl?: string; avatarResourceId?: string },
   ) {
     const user = await this.assertActiveUser(userId);
-    if (!user.wxOpenId) {
-      throw new BadRequestException('请先完成微信授权');
-    }
 
     const data: {
       nickname?: string;
@@ -1425,37 +1425,23 @@ export class AuthService {
     }
 
     const avatarUrl = input.avatarUrl?.trim();
-    if (avatarUrl) {
-      if (user.avatarResourceId) {
-        await this.prisma.commonResource.update({
-          where: { id: user.avatarResourceId },
-          data: { url: avatarUrl },
-        });
-      } else {
-        const avatar = await this.prisma.commonResource.create({
-          data: {
-            ownerType: 'USER',
-            ownerId: userId,
-            bizType: 'AVATAR',
-            mediaType: 'IMAGE',
-            ossBucket: 'wechat',
-            ossKey: `wx-avatar/${user.wxOpenId}`,
-            url: avatarUrl,
-            status: 'ACTIVE',
-          },
-        });
-        data.avatarResourceId = avatar.id;
+    const avatarResourceId = input.avatarResourceId?.trim();
+    if (avatarResourceId) {
+      let resourceId: bigint;
+      try {
+        resourceId = BigInt(avatarResourceId);
+      } catch {
+        throw new BadRequestException('头像资源编号无效');
       }
+      const avatar = await this.resourceService.getOwnedActiveAvatar(resourceId, userId);
+      data.avatarResourceId = avatar.id;
+    } else if (avatarUrl) {
+      // 兼容已发布旧客户端：只接受刚由当前用户上传并登记过的真实资源 URL。
+      const avatar = await this.resourceService.getOwnedActiveAvatarByUrl(avatarUrl, userId);
+      data.avatarResourceId = avatar.id;
     }
 
     if (!data.nickname && !data.avatarResourceId) {
-      if (avatarUrl && user.avatarResourceId) {
-        const refreshed = await this.prisma.user.findUnique({
-          where: { id: userId },
-          include: { avatar: true },
-        });
-        return this.formatUserProfile(refreshed ?? user);
-      }
       return this.formatUserProfile(user);
     }
 

server/dukang-api/src/modules/iam/dto/auth.dto.ts

@@ -118,6 +118,10 @@ export class MiniWechatProfileDto {
   @IsString()
   @IsOptional()
   avatarUrl?: string;
+
+  @IsString()
+  @IsOptional()
+  avatarResourceId?: string;
 }
 
 export class CheckPartnerPhoneDto {

server/dukang-api/src/modules/iam/iam.module.ts

@@ -24,10 +24,12 @@ import { PartnerPrimaryGuard } from '../../common/guards/partner-primary.guard';
 import { PartnerPermissionGuard } from '../../common/guards/partner-permission.guard';
 import { ShopStoreGuard } from '../../common/guards/shop-store.guard';
 import { StoreMembershipService } from '../../common/guards/store-membership.service';
+import { CommonModule } from '../common/common.module';
 
 @Module({
   imports: [
     IntegrationsModule,
+    forwardRef(() => CommonModule),
     forwardRef(() => AnalyticsModule),
     JwtModule.register({
       secret: process.env.JWT_SECRET || 'dukang-prev1-dev-secret',