feat(partner): map pick UX and Tencent LBS SN signature

Hide locate on store forms; restore optimized locpicker overlay.
Add TENCENT_LBS_SECRET_KEY and server-side sig for WebServiceAPI.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/.env.example

@@ -60,9 +60,10 @@ WX_PAY_NOTIFY_URL=https://api.dukanghaoke.com/api/v1/callbacks/wechat/pay
 WECOM_AIBOT_ENABLED=false
 
 # 腾讯位置服务（地理编码 / 逆地理 / 地点搜索选点，服务端调用）
-# 控制台须开启 WebServiceAPI；服务端调用建议 Key 不设域名白名单，或改用 IP 白名单
-# （浏览器内嵌官方选点组件已弃用，避免 mapapi.qq.com / formatted_addresses 崩溃）
+# 控制台须开启 WebServiceAPI；推荐开启「签名校验」并配置下方 SK（服务端自动附 sig）
+# 未开签名校验时可只填 KEY；SK 勿下发前端
 TENCENT_LBS_KEY=
+TENCENT_LBS_SECRET_KEY=
 
 # 阿里云 OSS（ali-oss@6.x；凭证齐全时直传，缺失则服务端报错）
 # RAM 用户需具备 PutObject 权限；可在控制台 Bucket 授权策略中为该 RAM UID 授予读写

server/dukang-api/src/common/system-config/system-config.registry.ts

@@ -107,7 +107,25 @@ export const SYSTEM_CONFIG_FIELDS: SystemConfigFieldMeta[] = [
   { key: 'OSS_MAX_UPLOAD_BYTES', label: '单文件上限(字节)', group: G.oss, type: 'number', requiresRestart: false },
 
   { key: 'USER_H5_URL', label: 'C 端 H5 落地页', group: G.app, type: 'string', requiresRestart: false },
-  { key: 'TENCENT_LBS_KEY', label: '腾讯位置服务 Key（须开 WebServiceAPI；服务端地点搜索/地理编码）', group: G.app, type: 'password', secret: true, requiresRestart: false },
+  {
+    key: 'TENCENT_LBS_KEY',
+    label: '腾讯位置服务 Key',
+    group: G.app,
+    type: 'password',
+    secret: true,
+    requiresRestart: false,
+    description: '须开启 WebServiceAPI；服务端地理编码/地点搜索与前端选点组件共用',
+  },
+  {
+    key: 'TENCENT_LBS_SECRET_KEY',
+    label: '腾讯位置服务 SecretKey（SK）',
+    group: G.app,
+    type: 'password',
+    secret: true,
+    requiresRestart: false,
+    description:
+      '控制台开启 WebServiceAPI「签名校验」后生成；仅服务端计算 sig，勿泄露。配置后接口请求自动附带签名',
+  },
 
   { key: 'DEPLOY_WEBHOOK_URL', label: '发布 Webhook URL', group: G.deploy, type: 'string', requiresRestart: false },
   { key: 'DEPLOY_WEBHOOK_SECRET', label: '发布 Webhook Secret', group: G.deploy, type: 'password', secret: true, requiresRestart: false },

server/dukang-api/src/integrations/map/tencent-lbs.provider.ts

@@ -2,6 +2,7 @@ import { Injectable, Logger } from '@nestjs/common';
 import { loadAppConfig } from '@dukang/shared-types';
 import { PrismaService } from '../../common/prisma/prisma.module';
 import type { WechatActorRef } from '../wechat/wechat-log.util';
+import { buildTencentLbsRequestUrl } from './tencent-lbs.sign';
 
 export type ReverseGeocodeResult = {
   province: string;
@@ -54,11 +55,22 @@ export class TencentLbsProvider {
 
   constructor(private readonly prisma: PrismaService) {}
 
-  /** 每次读取，避免构造时缓存、以及系统设置热更新后仍用旧 Key */
+  /** 每次读取，避免构造时缓存、以及系统设置热更新后仍用旧 Key/SK */
   private getLbsKey() {
     return (loadAppConfig().tencentLbsKey || '').trim();
   }
 
+  private getLbsSecretKey() {
+    return (loadAppConfig().tencentLbsSecretKey || '').trim();
+  }
+
+  private lbsUrl(path: string, params: Record<string, string>) {
+    return buildTencentLbsRequestUrl(path, params, {
+      key: this.getLbsKey(),
+      secretKey: this.getLbsSecretKey(),
+    });
+  }
+
   isEnabled() {
     return !!this.getLbsKey();
   }
@@ -91,12 +103,10 @@ export class TencentLbsProvider {
       return null;
     }
 
-    const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
-    url.searchParams.set('address', trimmed);
-    url.searchParams.set('key', this.getLbsKey());
+    const url = this.lbsUrl('/ws/geocoder/v1', { address: trimmed });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -169,14 +179,13 @@ export class TencentLbsProvider {
       return null;
     }
 
-    const location = `${latitude},${longitude}`;
-    const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
-    url.searchParams.set('location', location);
-    url.searchParams.set('key', this.getLbsKey());
-    url.searchParams.set('get_poi', '0');
+    const url = this.lbsUrl('/ws/geocoder/v1', {
+      location: `${latitude},${longitude}`,
+      get_poi: '0',
+    });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -265,25 +274,25 @@ export class TencentLbsProvider {
       return { items: [], error: 'TENCENT_LBS_KEY 未配置' };
     }
 
-    const url = new URL('https://apis.map.qq.com/ws/place/v1/suggestion');
-    url.searchParams.set('keyword', trimmed.slice(0, 64));
-    url.searchParams.set('key', this.getLbsKey());
-    url.searchParams.set('policy', '1');
-    url.searchParams.set('page_index', '1');
-    url.searchParams.set('page_size', '20');
+    const params: Record<string, string> = {
+      keyword: trimmed.slice(0, 64),
+      policy: '1',
+      page_index: '1',
+      page_size: '20',
+    };
     const region = options?.region?.trim();
-    if (region) url.searchParams.set('region', region);
+    if (region) params.region = region;
     if (
       options?.latitude != null &&
       options?.longitude != null &&
       Number.isFinite(options.latitude) &&
       Number.isFinite(options.longitude)
     ) {
-      url.searchParams.set('location', `${options.latitude},${options.longitude}`);
+      params.location = `${options.latitude},${options.longitude}`;
     }
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(this.lbsUrl('/ws/place/v1/suggestion', params));
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -315,14 +324,14 @@ export class TencentLbsProvider {
     }
 
     const radius = Math.min(5000, Math.max(200, Math.round(radiusMeters)));
-    const url = new URL('https://apis.map.qq.com/ws/place/v1/explore');
-    url.searchParams.set('boundary', `nearby(${latitude},${longitude},${radius})`);
-    url.searchParams.set('policy', '1');
-    url.searchParams.set('page_size', '20');
-    url.searchParams.set('key', this.getLbsKey());
+    const url = this.lbsUrl('/ws/place/v1/explore', {
+      boundary: `nearby(${latitude},${longitude},${radius})`,
+      policy: '1',
+      page_size: '20',
+    });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -352,13 +361,13 @@ export class TencentLbsProvider {
       return { item: null, error: 'TENCENT_LBS_KEY 未配置' };
     }
 
-    const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
-    url.searchParams.set('location', `${latitude},${longitude}`);
-    url.searchParams.set('key', this.getLbsKey());
-    url.searchParams.set('get_poi', '1');
+    const url = this.lbsUrl('/ws/geocoder/v1', {
+      location: `${latitude},${longitude}`,
+      get_poi: '1',
+    });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;

server/dukang-api/src/integrations/map/tencent-lbs.sign.ts

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const LBS_HOST = 'https://apis.map.qq.com';
+
+/**
+ * 腾讯位置服务 WebServiceAPI（GET）签名 URL。
+ * 控制台开启 SN/签名校验后须附带 sig；SecretKey 仅服务端使用。
+ *
+ * sig = md5(请求路径 + "?" + 按参数名升序的原始 query + SK)
+ * @see https://lbs.qq.com/FAQ/server_faq.html
+ */
+export function buildTencentLbsRequestUrl(
+  path: string,
+  params: Record<string, string>,
+  options: { key: string; secretKey?: string },
+): string {
+  const key = options.key.trim();
+  if (!key) {
+    throw new Error('TENCENT_LBS_KEY 未配置');
+  }
+
+  const pathname = (path.startsWith('/') ? path : `/${path}`).replace(/\/+$/, '') || '/';
+  const all: Record<string, string> = { ...params, key };
+  const sortedKeys = Object.keys(all).sort();
+  const rawQuery = sortedKeys.map((k) => `${k}=${all[k]}`).join('&');
+
+  const search = new URLSearchParams();
+  for (const k of sortedKeys) {
+    search.set(k, all[k]);
+  }
+
+  const sk = options.secretKey?.trim();
+  if (sk) {
+    const sig = createHash('md5').update(`${pathname}?${rawQuery}${sk}`).digest('hex');
+    search.set('sig', sig);
+  }
+
+  return `${LBS_HOST}${pathname}?${search.toString()}`;
+}