feat(partner): map pick UX and Tencent LBS SN signature

Hide locate on store forms; restore optimized locpicker overlay.
Add TENCENT_LBS_SECRET_KEY and server-side sig for WebServiceAPI.

Co-authored-by: Cursor <cursoragent@cursor.com>

server/dukang-api/src/integrations/map/tencent-lbs.provider.ts

@@ -2,6 +2,7 @@ import { Injectable, Logger } from '@nestjs/common';
 import { loadAppConfig } from '@dukang/shared-types';
 import { PrismaService } from '../../common/prisma/prisma.module';
 import type { WechatActorRef } from '../wechat/wechat-log.util';
+import { buildTencentLbsRequestUrl } from './tencent-lbs.sign';
 
 export type ReverseGeocodeResult = {
   province: string;
@@ -54,11 +55,22 @@ export class TencentLbsProvider {
 
   constructor(private readonly prisma: PrismaService) {}
 
-  /** 每次读取，避免构造时缓存、以及系统设置热更新后仍用旧 Key */
+  /** 每次读取，避免构造时缓存、以及系统设置热更新后仍用旧 Key/SK */
   private getLbsKey() {
     return (loadAppConfig().tencentLbsKey || '').trim();
   }
 
+  private getLbsSecretKey() {
+    return (loadAppConfig().tencentLbsSecretKey || '').trim();
+  }
+
+  private lbsUrl(path: string, params: Record<string, string>) {
+    return buildTencentLbsRequestUrl(path, params, {
+      key: this.getLbsKey(),
+      secretKey: this.getLbsSecretKey(),
+    });
+  }
+
   isEnabled() {
     return !!this.getLbsKey();
   }
@@ -91,12 +103,10 @@ export class TencentLbsProvider {
       return null;
     }
 
-    const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
-    url.searchParams.set('address', trimmed);
-    url.searchParams.set('key', this.getLbsKey());
+    const url = this.lbsUrl('/ws/geocoder/v1', { address: trimmed });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -169,14 +179,13 @@ export class TencentLbsProvider {
       return null;
     }
 
-    const location = `${latitude},${longitude}`;
-    const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
-    url.searchParams.set('location', location);
-    url.searchParams.set('key', this.getLbsKey());
-    url.searchParams.set('get_poi', '0');
+    const url = this.lbsUrl('/ws/geocoder/v1', {
+      location: `${latitude},${longitude}`,
+      get_poi: '0',
+    });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -265,25 +274,25 @@ export class TencentLbsProvider {
       return { items: [], error: 'TENCENT_LBS_KEY 未配置' };
     }
 
-    const url = new URL('https://apis.map.qq.com/ws/place/v1/suggestion');
-    url.searchParams.set('keyword', trimmed.slice(0, 64));
-    url.searchParams.set('key', this.getLbsKey());
-    url.searchParams.set('policy', '1');
-    url.searchParams.set('page_index', '1');
-    url.searchParams.set('page_size', '20');
+    const params: Record<string, string> = {
+      keyword: trimmed.slice(0, 64),
+      policy: '1',
+      page_index: '1',
+      page_size: '20',
+    };
     const region = options?.region?.trim();
-    if (region) url.searchParams.set('region', region);
+    if (region) params.region = region;
     if (
       options?.latitude != null &&
       options?.longitude != null &&
       Number.isFinite(options.latitude) &&
       Number.isFinite(options.longitude)
     ) {
-      url.searchParams.set('location', `${options.latitude},${options.longitude}`);
+      params.location = `${options.latitude},${options.longitude}`;
     }
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(this.lbsUrl('/ws/place/v1/suggestion', params));
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -315,14 +324,14 @@ export class TencentLbsProvider {
     }
 
     const radius = Math.min(5000, Math.max(200, Math.round(radiusMeters)));
-    const url = new URL('https://apis.map.qq.com/ws/place/v1/explore');
-    url.searchParams.set('boundary', `nearby(${latitude},${longitude},${radius})`);
-    url.searchParams.set('policy', '1');
-    url.searchParams.set('page_size', '20');
-    url.searchParams.set('key', this.getLbsKey());
+    const url = this.lbsUrl('/ws/place/v1/explore', {
+      boundary: `nearby(${latitude},${longitude},${radius})`,
+      policy: '1',
+      page_size: '20',
+    });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;
@@ -352,13 +361,13 @@ export class TencentLbsProvider {
       return { item: null, error: 'TENCENT_LBS_KEY 未配置' };
     }
 
-    const url = new URL('https://apis.map.qq.com/ws/geocoder/v1/');
-    url.searchParams.set('location', `${latitude},${longitude}`);
-    url.searchParams.set('key', this.getLbsKey());
-    url.searchParams.set('get_poi', '1');
+    const url = this.lbsUrl('/ws/geocoder/v1', {
+      location: `${latitude},${longitude}`,
+      get_poi: '1',
+    });
 
     try {
-      const res = await fetch(url.toString());
+      const res = await fetch(url);
       const data = (await res.json()) as {
         status?: number;
         message?: string;

server/dukang-api/src/integrations/map/tencent-lbs.sign.ts

@@ -0,0 +1,39 @@
+import { createHash } from 'node:crypto';
+
+const LBS_HOST = 'https://apis.map.qq.com';
+
+/**
+ * 腾讯位置服务 WebServiceAPI（GET）签名 URL。
+ * 控制台开启 SN/签名校验后须附带 sig；SecretKey 仅服务端使用。
+ *
+ * sig = md5(请求路径 + "?" + 按参数名升序的原始 query + SK)
+ * @see https://lbs.qq.com/FAQ/server_faq.html
+ */
+export function buildTencentLbsRequestUrl(
+  path: string,
+  params: Record<string, string>,
+  options: { key: string; secretKey?: string },
+): string {
+  const key = options.key.trim();
+  if (!key) {
+    throw new Error('TENCENT_LBS_KEY 未配置');
+  }
+
+  const pathname = (path.startsWith('/') ? path : `/${path}`).replace(/\/+$/, '') || '/';
+  const all: Record<string, string> = { ...params, key };
+  const sortedKeys = Object.keys(all).sort();
+  const rawQuery = sortedKeys.map((k) => `${k}=${all[k]}`).join('&');
+
+  const search = new URLSearchParams();
+  for (const k of sortedKeys) {
+    search.set(k, all[k]);
+  }
+
+  const sk = options.secretKey?.trim();
+  if (sk) {
+    const sig = createHash('md5').update(`${pathname}?${rawQuery}${sk}`).digest('hex');
+    search.set('sig', sig);
+  }
+
+  return `${LBS_HOST}${pathname}?${search.toString()}`;
+}