1

app/api/v1/auth.py

@@ -9,6 +9,7 @@ from app.schemas.auth import (
     TokenResponse,
     UserPublic,
 )
+from app.core.heartbeat_verify import compute_server_verify_code
 from app.schemas.common import ApiResponse
 from app.services import auth as auth_service
 
@@ -64,15 +65,29 @@ async def heartbeat(
     db: DbSession,
     device_serial: str | None = Header(default=None, convert_underscores=False),
 ) -> ApiResponse[HeartbeatResponse]:
+    verify_code = body.verify_code.strip()
+    if not verify_code:
+        return ApiResponse(ok=False, message="verify_code 无效")
+
+    # 无论业务成败都返回 server_verify_code，供客户端校验响应真实性
+    server_verify = compute_server_verify_code(verify_code)
     try:
         data = await auth_service.process_heartbeat(
             db,
             current_user,
             device_serial,
-            body.verify_code,
+            verify_code,
         )
     except auth_service.AuthError as exc:
-        return ApiResponse(ok=False, message=exc.message)
+        return ApiResponse(
+            ok=False,
+            message=exc.message,
+            data=HeartbeatResponse(
+                vip_end_time=current_user.vip_end_time,
+                vip_active=False,
+                server_verify_code=server_verify,
+            ),
+        )
     return ApiResponse(ok=True, message="", data=data)
 
 

app/api/v1/oem_users.py

@@ -1,13 +1,13 @@
-"""管理员用户 CRUD。"""
+"""OEM 用户 CRUD。"""
 
 from fastapi import APIRouter, Query
 
 from app.dependencies import OemUser, DbSession
 from app.schemas.admin_user import AdminUserCreate, AdminUserOut, AdminUserUpdate
 from app.schemas.common import ApiResponse, PaginatedData
-from app.services import admin_user as oem_user_service
+from app.services import oem_user as oem_user_service
 
-router = APIRouter(prefix="/oem/users", tags=["管理-用户"])
+router = APIRouter(prefix="/oem/users", tags=["OEM-用户"])
 
 
 @router.get("", response_model=ApiResponse[PaginatedData[AdminUserOut]])
@@ -25,13 +25,12 @@ async def list_users(
     agent_id: int | None = Query(None, description="按所属代理用户 ID 筛选"),
     role_id: int | None = Query(None, ge=0, le=3, description="按角色筛选"),
 ) -> ApiResponse[PaginatedData[AdminUserOut]]:
-    oem_id=_oem.id
     users, total = await oem_user_service.list_users(
         db,
         page=page,
         page_size=page_size,
         username=username,
-        oem_id=oem_id,
+        oem_id=_oem.id,
         agent_id=agent_id,
         role_id=role_id,
     )
@@ -54,7 +53,7 @@ async def create_user(
     db: DbSession,
 ) -> ApiResponse[AdminUserOut]:
     try:
-        user = await oem_user_service.create_user(db, body,oem)
+        user = await oem_user_service.create_user(db, body, oem)
     except oem_user_service.AdminUserError as exc:
         return ApiResponse(ok=False, message=exc.message)
 
@@ -75,6 +74,7 @@ async def update_user(
     try:
         user = await oem_user_service.update_user(
             db,
+            oem,
             user_id,
             body,
             actor_id=oem.id,
@@ -96,7 +96,7 @@ async def delete_user(
     db: DbSession,
 ) -> ApiResponse[None]:
     try:
-        await oem_user_service.delete_user(db, user_id, actor_id=admin.id)
+        await oem_user_service.delete_user(db, oem, user_id, actor_id=oem.id)
     except oem_user_service.AdminUserError as exc:
         return ApiResponse(ok=False, message=exc.message)