swagger 推广后台 优化对战百佳历史接口

skins-promo/src/main/java/com/ruoyi/promo/config/PromoWebConfig.java

@@ -23,6 +23,6 @@ public class PromoWebConfig implements WebMvcConfigurer {
     public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(promoMaintenanceInterceptor)
                 .addPathPatterns("/promo/**")
-                .excludePathPatterns("/promo/login", "/promo/smsLogin", "/promo/register");
+                .excludePathPatterns("/promo/smsLogin", "/promo/register");
     }
 }

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoAdminManageController.java

@@ -19,8 +19,6 @@ import com.ruoyi.domain.entity.sys.PromoAdmin;
 import com.ruoyi.domain.entity.sys.TtUser;
 import com.ruoyi.promo.domain.entity.PromoCardKey;
 import com.ruoyi.promo.mapper.PromoCardKeyMapper;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import org.apache.commons.collections4.CollectionUtils;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
@@ -32,7 +30,6 @@ import java.util.stream.Collectors;
 /**
  * 超级管理员专属管理接口
  */
-@Api(tags = "超管管理")
 @RestController
 @RequestMapping("/promo/adminManage")
 public class PromoAdminManageController extends BaseController {
@@ -63,7 +60,6 @@ public class PromoAdminManageController extends BaseController {
     /**
      * 招商管理：查看所有招商及其下属主播汇总数据
      */
-    @ApiOperation("招商管理列表")
     @GetMapping("/businessList")
     public R<List<Map<String, Object>>> getBusinessList() {
         if (!isSuperAdmin()) {
@@ -207,7 +203,6 @@ public class PromoAdminManageController extends BaseController {
     /**
      * 主播管理：查看所有主播及其下属用户汇总数据
      */
-    @ApiOperation("主播管理列表")
     @GetMapping("/anchorList")
     public R<List<Map<String, Object>>> getAnchorList() {
         if (!isSuperAdmin()) {
@@ -305,7 +300,6 @@ public class PromoAdminManageController extends BaseController {
     /**
      * 卡商管理：查看所有卡商及其卡密记录
      */
-    @ApiOperation("卡商管理列表")
     @GetMapping("/cardMerchantList")
     public R<List<Map<String, Object>>> getCardMerchantList() {
         if (!isSuperAdmin()) {
@@ -420,7 +414,6 @@ public class PromoAdminManageController extends BaseController {
 
     // ==================== 推广后台管理员账号管理（仅超管） ====================
 
-    @ApiOperation("管理员列表")
     @GetMapping("/adminList")
     public R<List<PromoAdmin>> adminList() {
         if (!isSuperAdmin()) {
@@ -432,7 +425,6 @@ public class PromoAdminManageController extends BaseController {
         return R.ok(list);
     }
 
-    @ApiOperation("新增/修改管理员")
     @PostMapping("/saveAdmin")
     public R<Void> saveAdmin(@RequestBody PromoAdmin body) {
         if (!isSuperAdmin()) {
@@ -511,7 +503,6 @@ public class PromoAdminManageController extends BaseController {
                 .count() > 0;
     }
 
-    @ApiOperation("删除管理员")
     @PostMapping("/deleteAdmin/{id}")
     public R<Void> deleteAdmin(@PathVariable("id") Integer id) {
         if (!isSuperAdmin()) {

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoCaptchaController.java

@@ -10,8 +10,6 @@ import com.ruoyi.common.core.domain.R;
 import com.ruoyi.common.core.redis.RedisCache;
 import com.ruoyi.common.utils.StringUtils;
 import com.ruoyi.promo.model.PromoCaptchaCheckRequest;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -26,7 +24,6 @@ import java.util.concurrent.TimeUnit;
  * POST /promo/captcha/gen   - 生成验证码
  * POST /promo/captcha/check - 校验验证码
  */
-@Api(tags = "推广后台滑块验证码")
 @Slf4j
 @RestController
 @RequestMapping("/promo/captcha")
@@ -44,7 +41,6 @@ public class PromoCaptchaController extends BaseController {
     /**
      * 生成滑块验证码
      */
-    @ApiOperation("生成滑块验证码")
     @Anonymous
     @PostMapping("/gen")
     public R<Object> genCaptcha() {
@@ -74,7 +70,6 @@ public class PromoCaptchaController extends BaseController {
      * 校验滑块验证码
      * 通过后在 Redis 写入 promo:captcha:verified:{phoneNumber} = captchaId，有效期 5 分钟
      */
-    @ApiOperation("校验滑块验证码")
     @Anonymous
     @PostMapping("/check")
     public R<Object> checkCaptcha(@RequestBody PromoCaptchaCheckRequest request) {

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoCardKeyController.java

@@ -10,8 +10,6 @@ import com.ruoyi.promo.domain.entity.PromoCardKey;
 import com.ruoyi.promo.service.PromoCardKeyService;
 import com.ruoyi.promo.service.PromoLoginService;
 import com.ruoyi.domain.entity.TtRechargeProd;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
 
@@ -20,7 +18,6 @@ import java.util.List;
 import java.util.Map;
 import java.util.concurrent.TimeUnit;
 
-@Api(tags = "卡商卡密管理")
 @RestController
 @RequestMapping("/promo/cardKey")
 public class PromoCardKeyController extends BaseController {
@@ -37,7 +34,6 @@ public class PromoCardKeyController extends BaseController {
     /**
      * 获取卡商信息（名称、余额）
      */
-    @ApiOperation("获取卡商信息")
     @GetMapping("/merchantInfo")
     public R<Map<String, Object>> getMerchantInfo() {
         var loginUser = getLoginUser();
@@ -56,7 +52,6 @@ public class PromoCardKeyController extends BaseController {
     /**
      * 获取充值列表（金额选项）
      */
-    @ApiOperation("获取充值金额列表")
     @GetMapping("/rechargeList")
     public R<List<TtRechargeProd>> getRechargeList() {
         List<TtRechargeProd> list = promoLoginService.queryList();
@@ -66,7 +61,6 @@ public class PromoCardKeyController extends BaseController {
     /**
      * 生成卡密
      */
-    @ApiOperation("生成卡密")
     @PostMapping("/generate")
     public R<List<String>> generateCardKeys(@RequestBody Map<String, Object> request) {
         var loginUser = getLoginUser();
@@ -112,7 +106,6 @@ public class PromoCardKeyController extends BaseController {
     /**
      * 销毁未使用卡密（软删除并按面值退回卡商余额；已使用的不可销毁）
      */
-    @ApiOperation("销毁卡密")
     @PostMapping("/destroy")
     public R<String> destroyCardKey(@RequestBody Map<String, Object> request) {
         var loginUser = getLoginUser();
@@ -140,7 +133,6 @@ public class PromoCardKeyController extends BaseController {
     /**
      * 获取卡密列表
      */
-    @ApiOperation("获取卡密列表")
     @GetMapping("/list")
     public R<IPage<PromoCardKey>> getCardKeyList(
             @RequestParam(required = false) String usedByName,

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoCdkeyController.java

@@ -9,8 +9,6 @@ import com.ruoyi.domain.common.constant.UserType;
 import com.ruoyi.promo.domain.entity.PromoCdkey;
 import com.ruoyi.promo.domain.entity.PromoCdkeyRedeem;
 import com.ruoyi.promo.service.PromoCdkeyService;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
 
@@ -23,7 +21,6 @@ import java.util.concurrent.TimeUnit;
 /**
  * 推广CDKEY管理
  */
-@Api(tags = "推广CDKEY管理")
 @RestController
 @RequestMapping("/promo/cdkey")
 public class PromoCdkeyController extends BaseController {
@@ -37,7 +34,6 @@ public class PromoCdkeyController extends BaseController {
     /**
      * 生成CDKEY（仅主播账号可操作）
      */
-    @ApiOperation("生成CDKEY")
     @PostMapping("/generate")
     public R<List<String>> generate(@RequestBody Map<String, Object> form) {
         var loginUser = getLoginUser();
@@ -70,7 +66,6 @@ public class PromoCdkeyController extends BaseController {
     /**
      * 获取创建CDKEY记录列表
      */
-    @ApiOperation("获取创建CDKEY记录列表")
     @GetMapping("/createList")
     public R<List<PromoCdkey>> createList(
             @RequestParam(required = false) String startDate,
@@ -91,7 +86,6 @@ public class PromoCdkeyController extends BaseController {
     /**
      * 获取兑换CDKEY记录列表
      */
-    @ApiOperation("获取兑换CDKEY记录列表")
     @GetMapping("/redeemList")
     public R<List<PromoCdkeyRedeem>> redeemList(
             @RequestParam(required = false) String startDate,
@@ -113,7 +107,6 @@ public class PromoCdkeyController extends BaseController {
     /**
      * 创建CDKEY日报
      */
-    @ApiOperation("创建CDKEY日报")
     @GetMapping("/createDaily")
     public R<List<Map<String, Object>>> createDaily(
             @RequestParam(required = false) String startDate,
@@ -133,7 +126,6 @@ public class PromoCdkeyController extends BaseController {
     /**
      * 兑换CDKEY日报
      */
-    @ApiOperation("兑换CDKEY日报")
     @GetMapping("/redeemDaily")
     public R<List<Map<String, Object>>> redeemDaily(
             @RequestParam(required = false) String startDate,

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoLoginController.java

@@ -20,15 +20,12 @@ import com.ruoyi.admin.config.RedisConstants;
 import com.ruoyi.admin.mapper.PromoAdminMapper;
 import com.ruoyi.admin.mapper.TtUserMapper;
 import com.ruoyi.common.redis.config.RedisLock;
-import com.ruoyi.domain.other.ApiLoginBody;
 import com.ruoyi.domain.other.ApiVerificationCodeLoginBody;
 import com.ruoyi.promo.contract.request.RegisterRequest;
 import com.ruoyi.promo.contract.request.UpdateInvitationCodeRequest;
 import com.ruoyi.promo.contract.response.GetShareDomainResponse;
 import com.ruoyi.promo.service.PromoLoginService;
 import com.ruoyi.system.service.ISysConfigService;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.validation.annotation.Validated;
 import org.springframework.web.bind.annotation.*;
@@ -40,7 +37,6 @@ import java.util.Map;
 import java.util.LinkedHashMap;
 import java.util.concurrent.TimeUnit;
 
-@Api(tags = "推广后台用户认证")
 @RestController
 @RequestMapping("/promo")
 public class PromoLoginController extends BaseController {
@@ -63,7 +59,6 @@ public class PromoLoginController extends BaseController {
     @Autowired
     private RedisLock redisLock;
 
-    @ApiOperation("获取推广后台用户信息")
     @PostMapping("/getInfo")
     public R<Map<String, Object>> getPromoInfo() {
         var loginUser = getLoginUser();
@@ -134,7 +129,6 @@ public class PromoLoginController extends BaseController {
         return R.ok(info);
     }
 
-    @ApiOperation("修改个人资料（昵称/手机号/邮箱）")
     @PostMapping("/updateProfile")
     public R<Void> updateProfile(@RequestBody Map<String, String> body) {
         var loginUser = getLoginUser();
@@ -186,7 +180,6 @@ public class PromoLoginController extends BaseController {
         return R.ok();
     }
 
-    @ApiOperation("修改头像（超管，前端裁剪后的 base64）")
     @PostMapping("/updateAvatar")
     public R<Void> updateAvatar(@RequestBody Map<String, String> body) {
         var loginUser = getLoginUser();
@@ -216,7 +209,6 @@ public class PromoLoginController extends BaseController {
         return R.ok();
     }
 
-    @ApiOperation("修改登录密码")
     @PostMapping("/updatePassword")
     public R<Void> updatePassword(@RequestBody Map<String, String> body) {
         var loginUser = getLoginUser();
@@ -263,21 +255,6 @@ public class PromoLoginController extends BaseController {
         return R.ok();
     }
 
-    @ApiOperation("推广后台用户登录")
-    @Anonymous
-    @PostMapping("/login")
-    public AjaxResult login(@RequestBody ApiLoginBody apiLoginBody) {
-        if ("1".equals(configService.selectConfigByKey("promoMaintenance"))) {
-            return AjaxResult.error("系统维护中，请稍后再试");
-        }
-        AjaxResult ajax = AjaxResult.success();
-        String token = promoLoginService.login(apiLoginBody.getUsername(), apiLoginBody.getPassword());
-        ajax.put(Constants.TOKEN, token);
-        ajax.put("user", null);
-        return ajax;
-    }
-
-    @ApiOperation("推广后台短信验证码登录")
     @Anonymous
     @PostMapping("/smsLogin")
     public AjaxResult smsLogin(@RequestBody ApiVerificationCodeLoginBody body) {
@@ -294,7 +271,6 @@ public class PromoLoginController extends BaseController {
         }
     }
 
-    @ApiOperation("推广后台用户注册")
     @Anonymous
     @PostMapping("/register")
     public AjaxResult register(@RequestBody RegisterRequest request) {
@@ -311,27 +287,23 @@ public class PromoLoginController extends BaseController {
         return ajax;
     }
 
-    @ApiOperation("推广后台用户修改推广码")
     @PostMapping("/updateInvitationCode")
     public R updateInvitationCode(@RequestBody @Validated UpdateInvitationCodeRequest request) {
         return promoLoginService.updateInvitationCode(request);
     }
 
-    @ApiOperation("获取主播/招商推广域名")
     @GetMapping("/getsharedomain")
     public R<GetShareDomainResponse> getShareDomain() {
         return promoLoginService.getShareDomain();
     }
 
 
-    @ApiOperation("获取充值卡列表")
     @GetMapping("/card/list")
     public PageDataInfo<TtRechargeProd> cardList() {
         List<TtRechargeProd> list = promoLoginService.queryList();
         return getPageData(list);
     }
 
-    @ApiOperation("生成充值卡")
     @PostMapping("/generateCard/{rechargeListId}/{num}")
     @UpdateUserCache
     public R<List<String>> generateCard(@PathVariable("rechargeListId") Integer rechargeListId,

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoMenuController.java

@@ -5,14 +5,11 @@ import com.ruoyi.common.core.domain.R;
 import com.ruoyi.domain.common.constant.UserType;
 import com.ruoyi.promo.domain.entity.PromoMenuConfig;
 import com.ruoyi.promo.service.PromoMenuService;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.*;
 
 import java.util.*;
 
-@Api(tags = "推广后台菜单权限管理")
 @RestController
 @RequestMapping("/promo/menu")
 public class PromoMenuController extends BaseController {
@@ -23,7 +20,6 @@ public class PromoMenuController extends BaseController {
     /**
      * 获取当前登录用户的菜单权限（根据用户类型）
      */
-    @ApiOperation("获取当前用户菜单权限")
     @GetMapping("/getMenus")
     public R<List<String>> getMenus() {
         var loginUser = getLoginUser();
@@ -38,7 +34,6 @@ public class PromoMenuController extends BaseController {
     /**
      * 获取所有可分配的菜单配置（从数据库读取，前端权限页用）
      */
-    @ApiOperation("获取所有可分配菜单")
     @GetMapping("/allMenuConfigs")
     public R<List<PromoMenuConfig>> getAllMenuConfigs() {
         var loginUser = getLoginUser();
@@ -55,7 +50,6 @@ public class PromoMenuController extends BaseController {
     /**
      * 超管：获取某角色类型的菜单配置
      */
-    @ApiOperation("获取角色菜单配置（超管用）")
     @GetMapping("/getRoleMenus/{roleType}")
     public R<List<String>> getRoleMenus(@PathVariable("roleType") String roleType) {
         var loginUser = getLoginUser();
@@ -72,7 +66,6 @@ public class PromoMenuController extends BaseController {
     /**
      * 超管：保存某角色类型的菜单权限
      */
-    @ApiOperation("保存角色菜单权限（超管用）")
     @PostMapping("/saveRoleMenus")
     public R<Void> saveRoleMenus(@RequestBody Map<String, Object> request) {
         var loginUser = getLoginUser();

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoRollController.java

@@ -13,13 +13,12 @@ import com.ruoyi.domain.entity.TtBoxRecords;
 import com.ruoyi.domain.entity.TtOrnament;
 import com.ruoyi.domain.entity.roll.*;
 import com.ruoyi.domain.entity.sys.TtUser;
+import com.ruoyi.domain.common.constant.UserType;
 import com.ruoyi.domain.common.constant.TtAccountRecordSource;
 import com.ruoyi.domain.common.constant.TtboxRecordSource;
 import com.ruoyi.admin.service.TtUserService;
 import com.ruoyi.admin.mapper.TtUserMapper;
 import com.ruoyi.promo.mapper.*;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.transaction.annotation.Transactional;
@@ -31,7 +30,6 @@ import java.util.*;
 /**
  * 推广 ROLL 房管理
  */
-@Api(tags = "推广 ROLL 房管理")
 @RestController
 @RequestMapping("/promo/roll")
 @Slf4j
@@ -70,11 +68,24 @@ public class PromoRollController extends BaseController {
     /**
      * 获取奖池列表（下拉选择用）
      */
-    @ApiOperation("获取奖池列表")
     @GetMapping("/jackpotList")
     public R<List<TtRollJackpot>> jackpotList(
             @RequestParam(value = "jackpotName", required = false) String jackpotName) {
+        // 归属校验：只返回自己 Roll 房关联的奖池（此前无过滤，任何推广账号都能看到别人的全部奖池）
+        List<Integer> myJackpotIds = new ArrayList<>();
+        for (TtRoll roll : new LambdaQueryChainWrapper<>(promoRollMapper)
+                .eq(TtRoll::getUserId, getUserId().intValue())
+                .isNotNull(TtRoll::getJackpotId)
+                .list()) {
+            if (!myJackpotIds.contains(roll.getJackpotId())) {
+                myJackpotIds.add(roll.getJackpotId());
+            }
+        }
+        if (myJackpotIds.isEmpty()) {
+            return R.ok(new ArrayList<>());
+        }
         LambdaQueryWrapper<TtRollJackpot> wrapper = Wrappers.lambdaQuery();
+        wrapper.in(TtRollJackpot::getJackpotId, myJackpotIds);
         if (StringUtils.isNotEmpty(jackpotName)) {
             wrapper.like(TtRollJackpot::getJackpotName, jackpotName);
         }
@@ -85,7 +96,6 @@ public class PromoRollController extends BaseController {
     /**
      * 搜索可用饰品（用于添加到奖池）
      */
-    @ApiOperation("搜索可用饰品")
     @GetMapping("/ornaments")
     public R<List<TtOrnament>> searchOrnaments(
             @RequestParam(required = false) String name,
@@ -105,7 +115,6 @@ public class PromoRollController extends BaseController {
     /**
      * 按价格区间搜索饰品（用于模板选择，价格升序）
      */
-    @ApiOperation("按价格区间搜索饰品（分页）")
     @GetMapping("/ornamentsByPrice")
     public R<Map<String, Object>> searchOrnamentsByPrice(
             @RequestParam(required = false) BigDecimal minPrice,
@@ -142,7 +151,6 @@ public class PromoRollController extends BaseController {
     /**
      * 获取固定金币饰品列表（唯一Hash名以 jinbi- 开头，按面值升序）
      */
-    @ApiOperation("获取固定金币饰品列表")
     @GetMapping("/coinOrnaments")
     public R<List<TtOrnament>> coinOrnaments() {
         LambdaQueryWrapper<TtOrnament> wrapper = Wrappers.lambdaQuery();
@@ -154,9 +162,12 @@ public class PromoRollController extends BaseController {
     /**
      * 获取奖池饰品列表
      */
-    @ApiOperation("获取奖池饰品列表")
     @GetMapping("/jackpotOrnaments/{jackpotId}")
     public R<List<TtRollJackpotOrnaments>> jackpotOrnaments(@PathVariable("jackpotId") Integer jackpotId) {
+        R<String> ownerCheck = checkJackpotOwner(jackpotId);
+        if (ownerCheck != null) {
+            return R.fail(ownerCheck.getMsg());
+        }
         List<TtRollJackpotOrnaments> list = new LambdaQueryChainWrapper<>(promoJackpotOrnamentsMapper)
                 .eq(TtRollJackpotOrnaments::getJackpotId, jackpotId)
                 .list();
@@ -166,7 +177,6 @@ public class PromoRollController extends BaseController {
     /**
      * 向奖池添加饰品
      */
-    @ApiOperation("向奖池添加饰品")
     @PostMapping("/addOrnaments")
     @Transactional(rollbackFor = Exception.class)
     public R<String> addOrnaments(@RequestBody Map<String, Object> body) {
@@ -231,7 +241,6 @@ public class PromoRollController extends BaseController {
     /**
      * 从奖池移除饰品
      */
-    @ApiOperation("从奖池移除饰品")
     @DeleteMapping("/removeOrnament/{id}")
     @Transactional(rollbackFor = Exception.class)
     public R<String> removeOrnament(@PathVariable("id") Integer id) {
@@ -266,7 +275,6 @@ public class PromoRollController extends BaseController {
     /**
      * 更新奖池饰品数量
      */
-    @ApiOperation("更新奖池饰品数量")
     @PutMapping("/updateOrnamentNum")
     @Transactional(rollbackFor = Exception.class)
     public R<String> updateOrnamentNum(@RequestBody Map<String, Object> body) {
@@ -410,7 +418,6 @@ public class PromoRollController extends BaseController {
     /**
      * Roll房列表
      */
-    @ApiOperation("Roll房列表")
     @GetMapping("/list")
     public R<List<TtRoll>> list(
             @RequestParam(required = false) Integer id,
@@ -433,9 +440,13 @@ public class PromoRollController extends BaseController {
     /**
      * Roll房详情
      */
-    @ApiOperation("Roll房详情")
     @GetMapping("/{rollId}")
     public R<TtRoll> getInfo(@PathVariable("rollId") Integer rollId) {
+        // 归属校验：只能看自己的 Roll 房（此前传任意 id 都能看到别人房间配置）
+        R<String> ownerCheck = checkRollOwner(rollId);
+        if (ownerCheck != null) {
+            return R.fail(ownerCheck.getMsg());
+        }
         TtRoll roll = promoRollMapper.selectById(rollId);
         if (roll == null) return R.fail("Roll房不存在");
         return R.ok(roll);
@@ -444,7 +455,6 @@ public class PromoRollController extends BaseController {
     /**
      * 新增Roll房
      */
-    @ApiOperation("新增Roll房")
     @PostMapping
     @RepeatSubmit(interval = 3000, message = "Roll房创建中，请勿重复提交")
     @Transactional(rollbackFor = Exception.class)
@@ -601,7 +611,6 @@ public class PromoRollController extends BaseController {
     /**
      * 修改Roll房
      */
-    @ApiOperation("修改Roll房")
     @PutMapping
     public R<String> edit(@RequestBody TtRoll ttRoll) {
         if (ttRoll.getId() == null) return R.fail("Roll房ID不能为空");
@@ -639,7 +648,6 @@ public class PromoRollController extends BaseController {
     /**
      * 删除 Roll 房
      */
-    @ApiOperation("删除 Roll 房")
     @DeleteMapping("/{rollId}")
     @Transactional(rollbackFor = Exception.class)
     public R<String> remove(@PathVariable("rollId") Integer rollId) {
@@ -688,7 +696,6 @@ public class PromoRollController extends BaseController {
     /**
      * 指定奖池饰品获奖用户
      */
-    @ApiOperation("指定奖池饰品获奖用户")
     @PutMapping("/designateOrnamentUser")
     public R<String> designateOrnamentUser(@RequestBody Map<String, Object> body) {
         Integer id = body.get("id") != null ? ((Number) body.get("id")).intValue() : null;
@@ -773,7 +780,6 @@ public class PromoRollController extends BaseController {
     /**
      * Roll房用户列表
      */
-    @ApiOperation("Roll 房用户列表")
     @GetMapping("/users/{rollId}")
     public R<List<TtRollUser>> users(@PathVariable("rollId") Integer rollId) {
         R<String> ownerCheck = checkRollOwner(rollId);
@@ -793,7 +799,6 @@ public class PromoRollController extends BaseController {
      * Roll房中奖名单（参与用户中了什么饰品）
      * 数据口径：tt_box_records 中 source=roll房(3) 且 rollId 匹配的记录，为开奖后实际发放的饰品
      */
-    @ApiOperation("Roll 房中奖名单")
     @GetMapping("/winners/{rollId}")
     public R<List<Map<String, Object>>> winners(@PathVariable("rollId") Integer rollId) {
         R<String> ownerCheck = checkRollOwner(rollId);
@@ -859,36 +864,77 @@ public class PromoRollController extends BaseController {
         return null;
     }
 
+    /**
+     * 校验奖池归属：奖池必须关联当前登录用户自己的 Roll 房
+     * （读接口用，不要求"未开奖"——已开奖的房间本人仍然要看自己的奖池）
+     */
+    private R<String> checkJackpotOwner(Integer jackpotId) {
+        TtRoll roll = findRollByJackpot(jackpotId);
+        if (roll == null) return R.fail("奖池未关联Roll房");
+        if (roll.getUserId() == null || !roll.getUserId().equals(getUserId().intValue())) {
+            return R.fail("无权查看他人奖池");
+        }
+        return null;
+    }
+
+    /**
+     * 奖项模板归属校验：只有创建者本人或推广超管可以改/删
+     */
+    private R<String> checkTemplateOwner(TtRollPrizeTemplate tpl) {
+        if (tpl == null) return R.fail("模板不存在");
+        if (isSuperAdmin() || isTemplateCreator(tpl)) return null;
+        return R.fail("无权操作他人奖项模板");
+    }
+
+    /** 模板是共享库（建房间时可选用任意模板），但 createBy 是创建人手机号，非本人/超管一律置空 */
+    private void hideTemplateCreatorIfNotMine(List<TtRollPrizeTemplate> list) {
+        for (TtRollPrizeTemplate tpl : list) {
+            hideTemplateCreatorIfNotMine(tpl);
+        }
+    }
+
+    private void hideTemplateCreatorIfNotMine(TtRollPrizeTemplate tpl) {
+        if (tpl == null || isSuperAdmin() || isTemplateCreator(tpl)) return;
+        tpl.setCreateBy(null);
+    }
+
+    private boolean isTemplateCreator(TtRollPrizeTemplate tpl) {
+        var loginUser = getLoginUser();
+        String currentUserName = (loginUser != null && loginUser.getUserData() != null)
+                ? loginUser.getUserData().getUserName() : null;
+        return currentUserName != null && currentUserName.equals(tpl.getCreateBy());
+    }
+
+    private boolean isSuperAdmin() {
+        var loginUser = getLoginUser();
+        return loginUser != null && loginUser.getUserData() != null
+                && UserType.SUPER_ADMIN.getCode().equals(loginUser.getUserData().getUserType());
+    }
+
     // ==================== 奖项模板管理 ====================
 
     /**
      * 获取奖项模板列表
      */
-    @ApiOperation("获取奖项模板列表")
     @GetMapping("/prizeTemplates")
     public R<List<TtRollPrizeTemplate>> prizeTemplateList() {
         List<TtRollPrizeTemplate> list = new LambdaQueryChainWrapper<>(promoRollPrizeTemplateMapper)
                 .orderByDesc(TtRollPrizeTemplate::getCreateTime)
                 .list();
-        // 补充每个模板的饰品数量
-        for (TtRollPrizeTemplate tpl : list) {
-            int count = new LambdaQueryChainWrapper<>(promoRollPrizeTemplateDetailMapper)
-                    .eq(TtRollPrizeTemplateDetail::getTemplateId, tpl.getId())
-                    .count().intValue();
-            // 用 description 字段临时存数量（不加新字段）
-            tpl.setCreateBy(tpl.getCreateBy());
-        }
+        // 模板是共享库（创建房间时可以选择任意模板），但 createBy 存的是 tt_user.user_name（手机号），
+        // 只有本人和超管能看到，其他人置空，避免泄露他人手机号
+        hideTemplateCreatorIfNotMine(list);
         return R.ok(list);
     }
 
     /**
      * 获取奖项模板详情（含饰品列表）
      */
-    @ApiOperation("获取奖项模板详情")
     @GetMapping("/prizeTemplate/{templateId}")
     public R<Map<String, Object>> prizeTemplateDetail(@PathVariable("templateId") Integer templateId) {
         TtRollPrizeTemplate tpl = promoRollPrizeTemplateMapper.selectById(templateId);
         if (tpl == null) return R.fail("模板不存在");
+        hideTemplateCreatorIfNotMine(tpl);
         List<TtRollPrizeTemplateDetail> details = new LambdaQueryChainWrapper<>(promoRollPrizeTemplateDetailMapper)
                 .eq(TtRollPrizeTemplateDetail::getTemplateId, templateId)
                 .orderByDesc(TtRollPrizeTemplateDetail::getPrice)
@@ -902,7 +948,6 @@ public class PromoRollController extends BaseController {
     /**
      * 创建奖项模板
      */
-    @ApiOperation("创建奖项模板")
     @PostMapping("/prizeTemplate")
     public R<TtRollPrizeTemplate> createPrizeTemplate(@RequestBody Map<String, Object> body) {
         String templateName = body.get("templateName") != null ? body.get("templateName").toString() : null;
@@ -933,7 +978,6 @@ public class PromoRollController extends BaseController {
     /**
      * 修改奖项模板
      */
-    @ApiOperation("修改奖项模板")
     @PutMapping("/prizeTemplate")
     public R<String> updatePrizeTemplate(@RequestBody Map<String, Object> body) {
         Integer id = body.get("id") != null ? ((Number) body.get("id")).intValue() : null;
@@ -941,6 +985,9 @@ public class PromoRollController extends BaseController {
 
         TtRollPrizeTemplate existing = promoRollPrizeTemplateMapper.selectById(id);
         if (existing == null) return R.fail("模板不存在");
+        // 归属校验：只有创建者本人或推广超管能改别人的奖项模板
+        R<String> ownerCheck = checkTemplateOwner(existing);
+        if (ownerCheck != null) return ownerCheck;
 
         // 校验模板总价值不低于200金币
         BigDecimal total = calcTemplateTotal(body);
@@ -967,9 +1014,13 @@ public class PromoRollController extends BaseController {
     /**
      * 删除奖项模板
      */
-    @ApiOperation("删除奖项模板")
     @DeleteMapping("/prizeTemplate/{templateId}")
     public R<String> deletePrizeTemplate(@PathVariable("templateId") Integer templateId) {
+        TtRollPrizeTemplate existing = promoRollPrizeTemplateMapper.selectById(templateId);
+        if (existing == null) return R.fail("模板不存在");
+        // 归属校验：只有创建者本人或推广超管能删别人的奖项模板
+        R<String> ownerCheck = checkTemplateOwner(existing);
+        if (ownerCheck != null) return ownerCheck;
         promoRollPrizeTemplateMapper.deleteById(templateId);
         new LambdaUpdateChainWrapper<>(promoRollPrizeTemplateDetailMapper)
                 .eq(TtRollPrizeTemplateDetail::getTemplateId, templateId)

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoSmsController.java

@@ -1,20 +1,15 @@
 package com.ruoyi.promo.controller;
 
-import com.baomidou.mybatisplus.extension.conditions.query.LambdaQueryChainWrapper;
-import com.ruoyi.admin.mapper.PromoAdminMapper;
-import com.ruoyi.admin.service.TtUserService;
 import com.ruoyi.common.annotation.Anonymous;
 import com.ruoyi.common.core.controller.BaseController;
 import com.ruoyi.common.core.domain.R;
 import com.ruoyi.common.core.redis.RedisCache;
 import com.ruoyi.common.utils.StringUtils;
-import com.ruoyi.domain.common.constant.UserType;
-import com.ruoyi.domain.entity.sys.TtUser;
+import com.ruoyi.promo.model.PromoPhoneRequest;
+import com.ruoyi.promo.service.PromoAccountService;
 import com.ruoyi.system.service.ISysConfigService;
 import com.ruoyi.thirdparty.common.model.ApiSmsBody;
 import com.ruoyi.thirdparty.common.service.ApiSmsService;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.web.bind.annotation.PostMapping;
@@ -22,39 +17,72 @@ import org.springframework.web.bind.annotation.RequestBody;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
+import java.util.concurrent.TimeUnit;
+
 /**
  * 推广后台短信验证码控制器
- * POST /promo/sms/getVerifyCode - 获取短信验证码（需要滑块验证）
+ * POST /promo/sms/precheck        - 点「获取验证码」时的账号前置校验（不弹滑块）
+ * POST /promo/sms/getVerifyCode   - 获取短信验证码（需要滑块验证，此处再兜底校验一次账号）
  */
-@Api(tags = "推广后台短信")
 @Slf4j
 @RestController
 @RequestMapping("/promo/sms")
 public class PromoSmsController extends BaseController {
 
+    /** 前置校验节流：同一手机号 10 分钟最多 10 次，避免被拿来批量探测哪些手机号有推广后台账号 */
+    private static final int PRECHECK_MAX_COUNT = 10;
+    private static final int PRECHECK_MINUTES = 10;
+
     private final ISysConfigService sysConfigService;
     private final ApiSmsService apiSmsService;
-    private final PromoAdminMapper promoAdminMapper;
+    private final PromoAccountService promoAccountService;
 
     @Autowired
     private RedisCache redisCache;
 
-    @Autowired
-    private TtUserService userService;
-
     public PromoSmsController(ISysConfigService sysConfigService,
                               ApiSmsService apiSmsService,
-                              PromoAdminMapper promoAdminMapper) {
+                              PromoAccountService promoAccountService) {
         this.sysConfigService = sysConfigService;
         this.apiSmsService = apiSmsService;
-        this.promoAdminMapper = promoAdminMapper;
+        this.promoAccountService = promoAccountService;
+    }
+
+    /**
+     * 取验证码前的账号校验：没权限的号直接在这儿被拦住，不用先拖一次滑块再被拒
+     */
+    @Anonymous
+    @PostMapping("/precheck")
+    public R<Object> precheck(@RequestBody PromoPhoneRequest request) {
+        String websiteMaintenance = sysConfigService.selectConfigByKey("websiteMaintenance");
+        if ("1".equals(websiteMaintenance)) {
+            return R.fail("网站维护中......");
+        }
+
+        String phoneNumber = request.getPhoneNumber();
+        if (StringUtils.isEmpty(phoneNumber)) {
+            return R.fail("手机号不能为空");
+        }
+        String throttleKey = "promo:sms:precheck:" + phoneNumber;
+        Long count = redisCache.redisTemplate.opsForValue().increment(throttleKey);
+        if (count != null && count == 1L) {
+            redisCache.expire(throttleKey, PRECHECK_MINUTES, TimeUnit.MINUTES);
+        }
+        if (count != null && count > PRECHECK_MAX_COUNT) {
+            return R.fail("操作过于频繁，请" + PRECHECK_MINUTES + "分钟后再试");
+        }
+
+        String denyReason = promoAccountService.checkLoginPermission(phoneNumber, request.getParentInvitationCode());
+        if (denyReason != null) {
+            return R.fail(denyReason);
+        }
+        return R.ok("校验通过");
     }
 
     /**
      * 获取短信验证码（推广后台版本）
      * 需要先完成/promo/captcha/check 滑块验证
      */
-    @ApiOperation("获取短信验证码")
     @Anonymous
     @PostMapping("/getVerifyCode")
     public R<Object> getVerifyCode(@RequestBody ApiSmsBody smsBody) {
@@ -69,23 +97,10 @@ public class PromoSmsController extends BaseController {
             return R.fail("验证码类型错误");
         }
         if ("2".equals(smsBody.getType())) {
-            TtUser user = new LambdaQueryChainWrapper<>(userService.getBaseMapper())
-                    .eq(TtUser::getPhoneNumber, phoneNumber)
-                    .eq(TtUser::getDelFlag, "0")
-                    .eq(TtUser::getStatus, "0")
-                    .one();
-            boolean hasPromoRole = user != null
-                    && (UserType.ANCHOR.getCode().equals(user.getUserType())
-                    || UserType.BUSINESS_USER.getCode().equals(user.getUserType())
-                    || UserType.CARD_MERCHANT.getCode().equals(user.getUserType()));
-            // 超级管理员账号（promo_admin.username / phone_number）也可以是手机号，同样允许短信登录
-            boolean isSuperAdmin = !hasPromoRole && promoAdminMapper.findByAccount(phoneNumber) != null;
-            // 手机号没注册过：带有效招商邀请码时允许发码（登录即自动注册为主播）
-            boolean canAutoRegister = !hasPromoRole && !isSuperAdmin
-                    && StringUtils.isNotEmpty(smsBody.getParentInvitationCode())
-                    && findBusinessByInvitationCode(smsBody.getParentInvitationCode()) != null;
-            if (!hasPromoRole && !isSuperAdmin && !canAutoRegister) {
-                return R.fail("该手机号无推广后台登录权限");
+            // 兜底：前置校验可以被绕过（直接打接口），真正发短信前必须再验一次
+            String denyReason = promoAccountService.checkLoginPermission(phoneNumber, smsBody.getParentInvitationCode());
+            if (denyReason != null) {
+                return R.fail(denyReason);
             }
         }
 
@@ -100,6 +115,8 @@ public class PromoSmsController extends BaseController {
         if (StringUtils.isEmpty(storedCaptchaId) || !storedCaptchaId.equals(captchaId)) {
             return R.fail("滑块验证已过期或无效，请重新验证");
         }
+        // 一次性消费：同一个 captchaId 在 5 分钟有效期内只能换一条短信，否则可重放刷短信
+        redisCache.deleteObject(verifiedKey);
 
         String msg = apiSmsService.getVerifyCode(smsBody);
         if (StringUtils.isNotEmpty(msg)) {
@@ -113,19 +130,4 @@ public class PromoSmsController extends BaseController {
         log.info("[推广后台短信发送成功] phone={}", phoneNumber);
         return R.ok("获取验证码成功，请注意短信通知！");
     }
-
-    /**
-     * 按邀请码找招商账号（必须是 04 招商）
-     */
-    private TtUser findBusinessByInvitationCode(String invitationCode) {
-        TtUser parent = new LambdaQueryChainWrapper<>(userService.getBaseMapper())
-                .eq(TtUser::getInvitationCode, invitationCode.trim().toUpperCase())
-                .eq(TtUser::getDelFlag, "0")
-                .eq(TtUser::getStatus, "0")
-                .one();
-        if (parent == null || !UserType.BUSINESS_USER.getCode().equals(parent.getUserType())) {
-            return null;
-        }
-        return parent;
-    }
 }

skins-promo/src/main/java/com/ruoyi/promo/controller/PromoTurnoverController.java

@@ -31,8 +31,6 @@ import com.ruoyi.promo.domain.param.AnchorDayTurnoverParam;
 import com.ruoyi.promo.domain.vo.AnchorDayTurnoverVO;
 import com.ruoyi.promo.mapper.PromoTurnoverMapper;
 import com.ruoyi.promo.service.PromoTurnoverService;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
 import org.apache.commons.collections4.CollectionUtils;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -46,7 +44,6 @@ import java.time.LocalDateTime;
 import java.util.*;
 import java.util.stream.Collectors;
 
-@Api(tags = "推广流水")
 @RestController
 @RequestMapping("/promo/turnover")
 public class PromoTurnoverController extends BaseController {
@@ -66,28 +63,24 @@ public class PromoTurnoverController extends BaseController {
     @Autowired
     private TtUserBlendErcashMapper ttUserBlendErcashMapper;
 
-    @ApiOperation("获取实时数据")
     @GetMapping("/getRealTimeData")
     public AjaxResult getRealTimeData() {
         Long userId = SecurityUtils.getUserId();
         return promoTurnoverService.getRealTimeData(userId.intValue());
     }
 
-    @ApiOperation("获取首页游戏返利看板数据")
     @GetMapping("/getGameCommissionData")
     public AjaxResult getGameCommissionData() {
         Long userId = SecurityUtils.getUserId();
         return promoTurnoverService.getGameCommissionData(userId.intValue());
     }
 
-    @ApiOperation("获取近10天推广数据")
     @GetMapping("getLast10DaysPromotionData")
     public AjaxResult getLast10DaysPromotionData() {
         Long userId = SecurityUtils.getUserId();
         return promoTurnoverService.getLast10DaysPromotionData(userId.intValue());
     }
 
-    @ApiOperation("获取主播推广数据")
     @GetMapping("/getAnchorPromotionData")
     public TableDataInfo getAnchorPromotionData(AnchorDayTurnoverParam param) {
         if (param.getPageNum() == null || param.getPageNum() <= 0) {
@@ -176,7 +169,6 @@ public class PromoTurnoverController extends BaseController {
         return pageDataInfo;
     }
 
-    @ApiOperation("获取下级历史数据")
     @GetMapping("/getSubBranches")
     public AjaxResult getSubBranches(GetSubBranchesRequest request) {
         Long userId = getUserId();
@@ -185,22 +177,28 @@ public class PromoTurnoverController extends BaseController {
         return AjaxResult.success(response);
     }
 
-    @ApiOperation("获取日流水记录")
     @GetMapping("/getPurchaseByUserId/{userId}")
     public TableDataInfo getPurchaseByUserId(GetPurchaseByUserIdRequest request) {
         return promoTurnoverService.getPurchaseByUserId(request);
     }
 
-    @ApiOperation("获取佣金比例")
     @GetMapping("/getCommissionRateByUserId/{userId}")
     public AjaxResult getCommissionRateByUserId(@PathVariable("userId") Integer userId) {
+        // 归属校验：只能查自己或自己直属下级的返佣比例（此前传任意 userId 都能查到别人的比例）
+        Long currentUserId = getUserId();
+        if (!userId.equals(currentUserId.intValue())) {
+            TtUser targetUser = userMapper.selectById(userId);
+            if (targetUser == null || targetUser.getParentId() == null
+                    || !targetUser.getParentId().equals(currentUserId.intValue())) {
+                return AjaxResult.error("无权查看该用户的佣金比例");
+            }
+        }
         BigDecimal commissionRate = promoTurnoverService.getCommissionRateByUserId(userId);
         Map<String, Object> map = new HashMap<>();
         map.put("commissionRate", commissionRate);
         return AjaxResult.success(map);
     }
 
-    @ApiOperation("获取佣金比例")
     @PutMapping("/updateCommissionRate")
     public AjaxResult updateCommissionRate(@RequestBody TtUser ttUser) {
         Integer userId = ttUser.getUserId();
@@ -229,7 +227,6 @@ public class PromoTurnoverController extends BaseController {
         return row >= 1 ? AjaxResult.success("修改成功") : AjaxResult.error("修改失败");
     }
 
-    @ApiOperation("获取佣金列表")
     @GetMapping("/getCommissionList")
     public AjaxResult getCommissionList() {
         Long userId = getUserId();
@@ -237,7 +234,6 @@ public class PromoTurnoverController extends BaseController {
         return AjaxResult.success(commissionList);
     }
 
-    @ApiOperation("我的下级列表")
     @GetMapping("/mySubordinates")
     public AjaxResult mySubordinates(@RequestParam(required = false) String account) {
         Long userId = getUserId();
@@ -266,7 +262,6 @@ public class PromoTurnoverController extends BaseController {
         return AjaxResult.success(result);
     }
 
-    @ApiOperation("解除下级关系")
     @PostMapping("/removeSubordinate")
     public AjaxResult removeSubordinate(@RequestParam("subUserId") Integer subUserId) {
         Long currentUserId = getUserId();
@@ -288,7 +283,6 @@ public class PromoTurnoverController extends BaseController {
         return success ? AjaxResult.success("解除成功") : AjaxResult.error("解除失败");
     }
 
-    @ApiOperation("获取已结算佣金总额")
     @GetMapping("/settledTotalCommission")
     public AjaxResult settledTotalCommission(@RequestParam(required = false) String startDate,
                                              @RequestParam(required = false) String endDate) {
@@ -317,7 +311,6 @@ public class PromoTurnoverController extends BaseController {
         return AjaxResult.success(result);
     }
 
-    @ApiOperation("下级流水记录")
     @GetMapping("/flowRecord")
     public AjaxResult flowRecord(@RequestParam(required = false) Integer userId,
                                  @RequestParam(required = false) String startDate,
@@ -538,7 +531,6 @@ public class PromoTurnoverController extends BaseController {
         }
     }
 
-    @ApiOperation("招商每日佣金（默认本周，支持 startDate/endDate 自定义范围）")
     @GetMapping("/weeklyDailyCommission")
     public AjaxResult weeklyDailyCommission(@RequestParam(required = false) String startDate,
                                             @RequestParam(required = false) String endDate) {
@@ -822,7 +814,6 @@ public class PromoTurnoverController extends BaseController {
         return dateObj.toString();
     }
 
-    @ApiOperation("获取主播推广奖励列表")
     @GetMapping("/queryPromoteWelfare")
     public AjaxResult queryPromoteWelfare(QueryPromoteWelfareRequest request) {
         Long userId = getUserId();
@@ -830,7 +821,6 @@ public class PromoTurnoverController extends BaseController {
         return AjaxResult.success(response);
     }
 
-    @ApiOperation("佣金明细记录")
     @GetMapping("/commissionDetail")
     public AjaxResult commissionDetail(
             @RequestParam(required = false) String date,
@@ -896,7 +886,6 @@ public class PromoTurnoverController extends BaseController {
         return AjaxResult.success(list);
     }
 
-    @ApiOperation("佣金日报")
     @GetMapping("/commissionDaily")
     public AjaxResult commissionDaily(
             @RequestParam(required = false) String date,
@@ -945,7 +934,6 @@ public class PromoTurnoverController extends BaseController {
         return AjaxResult.success(list);
     }
 
-    @ApiOperation("佣金汇总")
     @GetMapping("/commissionSummary")
     public AjaxResult commissionSummary(
             @RequestParam(required = false) String startDate,
@@ -1010,7 +998,6 @@ public class PromoTurnoverController extends BaseController {
         return userIds;
     }
 
-    @ApiOperation("下级充值报表")
     @GetMapping("/subordinateRecharge")
     public AjaxResult subordinateRecharge(
             @RequestParam(required = false) String month,

skins-promo/src/main/java/com/ruoyi/promo/model/PromoPhoneRequest.java

@@ -0,0 +1,14 @@
+package com.ruoyi.promo.model;
+
+import lombok.Data;
+
+/**
+ * 手机号入参（取验证码前置校验用）
+ */
+@Data
+public class PromoPhoneRequest {
+
+    private String phoneNumber;
+
+    private String parentInvitationCode;
+}

skins-promo/src/main/java/com/ruoyi/promo/service/PromoAccountService.java

@@ -0,0 +1,85 @@
+package com.ruoyi.promo.service;
+
+import com.baomidou.mybatisplus.extension.conditions.query.LambdaQueryChainWrapper;
+import com.ruoyi.admin.mapper.PromoAdminMapper;
+import com.ruoyi.admin.service.TtUserService;
+import com.ruoyi.common.utils.StringUtils;
+import com.ruoyi.domain.common.constant.UserType;
+import com.ruoyi.domain.entity.sys.TtUser;
+import org.springframework.stereotype.Service;
+
+/**
+ * 推广后台登录账号校验。
+ * 点「获取验证码」时先跑一遍（不弹滑块），发短信时再跑一遍兜底，两处必须是同一份规则。
+ */
+@Service
+public class PromoAccountService {
+
+    private final TtUserService userService;
+    private final PromoAdminMapper promoAdminMapper;
+
+    public PromoAccountService(TtUserService userService, PromoAdminMapper promoAdminMapper) {
+        this.userService = userService;
+        this.promoAdminMapper = promoAdminMapper;
+    }
+
+    /**
+     * @return null 表示有权登录；否则是给用户看的拒绝原因
+     */
+    public String checkLoginPermission(String phoneNumber, String parentInvitationCode) {
+        TtUser user = new LambdaQueryChainWrapper<>(userService.getBaseMapper())
+                .eq(TtUser::getPhoneNumber, phoneNumber)
+                .eq(TtUser::getDelFlag, "0")
+                .eq(TtUser::getStatus, "0")
+                .one();
+        boolean hasPromoRole = user != null
+                && (UserType.ANCHOR.getCode().equals(user.getUserType())
+                || UserType.BUSINESS_USER.getCode().equals(user.getUserType())
+                || UserType.CARD_MERCHANT.getCode().equals(user.getUserType()));
+        if (hasPromoRole) {
+            return null;
+        }
+        // 超级管理员账号（promo_admin.username / phone_number）也可以是手机号，同样允许短信登录
+        if (promoAdminMapper.findByAccount(phoneNumber) != null) {
+            return null;
+        }
+        // 手机号从未注册过 + 有效招商邀请码：允许发码，登录时自动注册为主播(01)。
+        // 手机号已被占用（普通用户02 / 机器人 / 白号 / 已停用已删除的老号）时不能走自动注册：
+        // 自动注册会因手机号已存在而跳过，最后只在建 token 时报「用户不存在」，得在这里拦住。
+        boolean canAutoRegister = !phoneRegistered(phoneNumber)
+                && StringUtils.isNotEmpty(parentInvitationCode)
+                && findBusinessByInvitationCode(parentInvitationCode) != null;
+        if (canAutoRegister) {
+            return null;
+        }
+        // 统一提示「无权限」：能走到这里的要么是本来就没推广后台权限的号（含已注册的普通用户），
+        // 要么是邀请码没填/填错。不区分「已注册」，避免把某个手机号的注册状态暴露出去。
+        return "该手机号无推广后台登录权限";
+    }
+
+    /**
+     * 手机号在 tt_user 中是否已存在（含停用/软删除）。
+     * 必须与 PromoLoginServiceImpl.autoRegisterAnchorIfNeeded 的存在性口径一致，
+     * 否则两处判断不一致时会出现「发得出验证码但登录报用户不存在」。
+     */
+    private boolean phoneRegistered(String phoneNumber) {
+        return new LambdaQueryChainWrapper<>(userService.getBaseMapper())
+                .eq(TtUser::getPhoneNumber, phoneNumber)
+                .count() > 0;
+    }
+
+    /**
+     * 按邀请码找招商账号（必须是 04 招商）
+     */
+    private TtUser findBusinessByInvitationCode(String invitationCode) {
+        TtUser parent = new LambdaQueryChainWrapper<>(userService.getBaseMapper())
+                .eq(TtUser::getInvitationCode, invitationCode.trim().toUpperCase())
+                .eq(TtUser::getDelFlag, "0")
+                .eq(TtUser::getStatus, "0")
+                .one();
+        if (parent == null || !UserType.BUSINESS_USER.getCode().equals(parent.getUserType())) {
+            return null;
+        }
+        return parent;
+    }
+}

skins-promo/src/main/java/com/ruoyi/promo/service/PromoLoginService.java

@@ -11,10 +11,8 @@ import java.util.List;
 
 public interface PromoLoginService {
 
-    String login(String username, String password);
-
     /**
-     * 推广后台短信验证码登录；手机号未注册时，带上级邀请码则自动注册为主播
+     * 推广后台登录（仅手机号 + 4 位短信验证码）；手机号未注册时，带上级邀请码则自动注册为主播
      */
     String smsLogin(String phoneNumber, String code, String parentInvitationCode);
 

skins-promo/src/main/java/com/ruoyi/promo/service/impl/PromoLoginServiceImpl.java

@@ -26,7 +26,6 @@ import com.ruoyi.common.utils.uuid.UUID;
 import com.ruoyi.domain.common.constant.TtAccountRecordSource;
 import com.ruoyi.domain.common.constant.UserType;
 import com.ruoyi.domain.entity.TtRechargeProd;
-import com.ruoyi.domain.entity.sys.PromoAdmin;
 import com.ruoyi.domain.entity.sys.TtUser;
 import com.ruoyi.domain.other.TtRedPacket;
 import com.ruoyi.domain.other.TtUserAvatar;
@@ -35,6 +34,7 @@ import com.ruoyi.framework.web.service.TokenService;
 import com.ruoyi.promo.contract.request.RegisterRequest;
 import com.ruoyi.promo.contract.request.UpdateInvitationCodeRequest;
 import com.ruoyi.promo.contract.response.GetShareDomainResponse;
+import com.ruoyi.promo.service.PromoAccountService;
 import com.ruoyi.promo.service.PromoLoginService;
 import com.ruoyi.system.domain.SysConfig;
 import com.ruoyi.system.mapper.SysConfigMapper;
@@ -53,6 +53,7 @@ import java.util.ArrayList;
 import java.util.List;
 import java.util.Objects;
 import java.util.Random;
+import java.util.concurrent.TimeUnit;
 
 @Service
 @Slf4j
@@ -83,6 +84,9 @@ public class PromoLoginServiceImpl implements PromoLoginService {
     @Autowired
     private ApiSmsService apiSmsService;
 
+    @Autowired
+    private PromoAccountService promoAccountService;
+
     @Autowired
     private UserIdGenerator userIdGenerator;
 
@@ -104,110 +108,76 @@ public class PromoLoginServiceImpl implements PromoLoginService {
     /** 推广码已修改标记 Redis Key 前缀 */
     private static final String INVITATION_CODE_MODIFIED_KEY = "promo:invitation_code_modified:";
 
+    /** 登录失败计数：账号维度 / IP 维度，窗口内失败满 10 次锁定 10 分钟 */
+    private static final String LOGIN_FAIL_ACCOUNT_KEY = "promo:login_fail:account:";
+    private static final String LOGIN_FAIL_IP_KEY = "promo:login_fail:ip:";
+    private static final int LOGIN_FAIL_MAX = 10;
+    private static final int LOGIN_FAIL_LOCK_MINUTES = 10;
+
 
     /**
-     * 推广后台账号密码登录（短信未接入前统一走这里）：
-     * ① 超管 → promo_admin（username 或 phone_number）
-     * ② 招商(04)/主播(01)/卡商(05) → tt_user（账号为手机号）
-     */
-    @Override
-    public String login(String username, String password) {
-        sysLoginService.loginPreCheck(username, password);
-        String account = username.trim();
-
-        // ① 超级管理员
-        PromoAdmin promoAdmin = promoAdminMapper.findByAccount(account);
-        if (promoAdmin != null) {
-            if (!SecurityUtils.matchesPassword(password, promoAdmin.getPassword())) {
-                throw new IllegalArgumentException("账号或密码错误");
-            }
-            // 走 promo_ 前缀，确保拿到的是超管身份（promo_admin 表）
-            LoginUser loginUser = sysLoginService.createLoginUser("promo_" + promoAdmin.getUsername(), password);
-            return tokenService.createToken(loginUser);
-        }
-
-        // ② 招商/主播/卡商
-        TtUser user = new LambdaQueryChainWrapper<>(userService.getBaseMapper())
-                .and(w -> w.eq(TtUser::getPhoneNumber, account).or().eq(TtUser::getUserName, account))
-                .one();
-        if (user == null) {
-            throw new IllegalArgumentException("账号或密码错误");
-        }
-        if (!UserType.ANCHOR.getCode().equals(user.getUserType())
-                && !UserType.BUSINESS_USER.getCode().equals(user.getUserType())
-                && !UserType.CARD_MERCHANT.getCode().equals(user.getUserType())) {
-            throw new IllegalArgumentException("该账号无推广后台登录权限");
-        }
-        if (!SecurityUtils.matchesPassword(password, user.getPassword())) {
-            throw new IllegalArgumentException("账号或密码错误");
-        }
-        return createUserToken(user.getPhoneNumber());
-    }
-
-    /**
-     * 这个框既能填 4 位短信验证码，也能直接填密码：
-     * ① 非 4 位数字 → 按密码处理（超管 promo_admin / 招商·主播·卡商 tt_user）
-     * ② 4 位数字 → 按短信验证码处理
+     * 推广后台登录：只认「手机号 + 4 位短信验证码」。
+     * 账号密码登录已下线（/promo/login 一并删除），避免用密码绕过短信校验被撞库。
      */
     @Override
     public String smsLogin(String phoneNumber, String code, String parentInvitationCode) {
         String account = StringUtils.trim(phoneNumber);
         String value = StringUtils.trim(code);
-
-        PromoAdmin promoAdmin = StringUtils.isNotEmpty(account) ? promoAdminMapper.findByAccount(account) : null;
-        TtUser ttUser = StringUtils.isNotEmpty(account) ? findUserByAccount(account) : null;
-        boolean hasPromoRole = ttUser != null
-                && !"1".equals(ttUser.getDelFlag())
-                && !"1".equals(ttUser.getStatus())
-                && (UserType.ANCHOR.getCode().equals(ttUser.getUserType())
-                || UserType.BUSINESS_USER.getCode().equals(ttUser.getUserType())
-                || UserType.CARD_MERCHANT.getCode().equals(ttUser.getUserType()));
-        if (promoAdmin == null && ttUser == null && !Validator.isMobile(account)) {
-            throw new IllegalArgumentException("手机号格式错误，请检查手机号是否输入正确！");
-        }
-        boolean isCode = NumberUtil.isNumber(value) && value.length() == 4;
-
-        // ① 密码登录
-        if (!isCode && StringUtils.isNotEmpty(value)) {
-            if (promoAdmin != null && StringUtils.isNotEmpty(promoAdmin.getPassword())
-                    && SecurityUtils.matchesPassword(value, promoAdmin.getPassword())) {
-                // 走 promo_ 前缀，确保拿到的是超管身份
-                LoginUser loginUser = sysLoginService.createLoginUser("promo_" + promoAdmin.getUsername(), value);
-                return tokenService.createToken(loginUser);
+        checkLoginNotLocked(account);
+        try {
+            // 非 4 位数字一律按验证码错误处理，不再兼容「填密码」
+            if (!NumberUtil.isNumber(value) || value.length() != 4) {
+                throw new IllegalArgumentException("验证码错误");
             }
-            if (hasPromoRole && StringUtils.isNotEmpty(ttUser.getPassword())
-                    && SecurityUtils.matchesPassword(value, ttUser.getPassword())) {
-                return createUserToken(ttUser.getPhoneNumber());
+            String validateCaptcha = apiSmsService.validateCaptcha(value, "ApiLogin_" + account);
+            if (!"success".equals(validateCaptcha)) {
+                throw new IllegalArgumentException(validateCaptcha);
             }
-            if (promoAdmin != null || hasPromoRole) {
-                throw new IllegalArgumentException("密码错误");
+            // 发码时校验过一次，这里再兜一次：App 登录短信与推广后台共用同一个验证码 key
+            // （ApiLogin_<手机号>），普通用户拿 App 的码来打本接口时，没有这一步就会走到
+            // 建 token 才报「用户不存在」。两处必须是同一份口径。
+            String denyReason = promoAccountService.checkLoginPermission(account, parentInvitationCode);
+            if (denyReason != null) {
+                throw new IllegalArgumentException(denyReason);
             }
-            if (ttUser != null) {
-                throw new IllegalArgumentException("该账号无推广后台登录权限");
-            }
-            throw new IllegalArgumentException("验证码错误");
+            // 手机号没注册过：带上级邀请码则自动注册为主播（口径与 App 的 verificationCodeLoginOrRegister 一致）
+            autoRegisterAnchorIfNeeded(account, parentInvitationCode);
+            String token = createUserToken(account);
+            clearLoginFail(account);
+            return token;
+        } catch (IllegalArgumentException e) {
+            recordLoginFail(account);
+            throw e;
         }
-
-        // ② 短信验证码
-        if (!isCode) {
-            throw new IllegalArgumentException("验证码错误");
-        }
-        String validateCaptcha = apiSmsService.validateCaptcha(value, "ApiLogin_" + account);
-        if (!"success".equals(validateCaptcha)) {
-            throw new IllegalArgumentException(validateCaptcha);
-        }
-        // 手机号没注册过：带上级邀请码则自动注册为主播（口径与 App 的 verificationCodeLoginOrRegister 一致）
-        autoRegisterAnchorIfNeeded(account, parentInvitationCode);
-        return createUserToken(account);
     }
 
     /**
-     * 按手机号或用户名查 tt_user
+     * 登录失败计数（账号 + IP 双维度）：窗口内失败达到阈值直接拒绝，避免无限撞验证码/刷账号
      */
-    private TtUser findUserByAccount(String account) {
-        return new LambdaQueryChainWrapper<>(userService.getBaseMapper())
-                .and(w -> w.eq(TtUser::getPhoneNumber, account).or().eq(TtUser::getUserName, account))
-                .one();
+    private void checkLoginNotLocked(String account) {
+        if (loginFailCount(LOGIN_FAIL_ACCOUNT_KEY + account) >= LOGIN_FAIL_MAX
+                || loginFailCount(LOGIN_FAIL_IP_KEY + IpUtils.getIpAddr()) >= LOGIN_FAIL_MAX) {
+            throw new IllegalArgumentException("失败次数过多，请 " + LOGIN_FAIL_LOCK_MINUTES + " 分钟后再试");
+        }
+    }
+
+    private void recordLoginFail(String account) {
+        bumpLoginFail(LOGIN_FAIL_ACCOUNT_KEY + account);
+        bumpLoginFail(LOGIN_FAIL_IP_KEY + IpUtils.getIpAddr());
+    }
+
+    private void bumpLoginFail(String key) {
+        redisCache.setCacheObject(key, loginFailCount(key) + 1, LOGIN_FAIL_LOCK_MINUTES, TimeUnit.MINUTES);
+    }
+
+    /** 登录成功只清账号维度；IP 维度留给它自然过期，避免同一 IP 靠一次成功把失败记录洗掉 */
+    private void clearLoginFail(String account) {
+        redisCache.deleteObject(LOGIN_FAIL_ACCOUNT_KEY + account);
+    }
+
+    private int loginFailCount(String key) {
+        Integer count = redisCache.getCacheObject(key);
+        return count == null ? 0 : count;
     }
 
     /**