1

app/api/v1/auth.py

@@ -9,6 +9,7 @@ from app.schemas.auth import (
     TokenResponse,
     UserPublic,
 )
+from app.core.heartbeat_verify import compute_server_verify_code
 from app.schemas.common import ApiResponse
 from app.services import auth as auth_service
 
@@ -64,15 +65,29 @@ async def heartbeat(
     db: DbSession,
     device_serial: str | None = Header(default=None, convert_underscores=False),
 ) -> ApiResponse[HeartbeatResponse]:
+    verify_code = body.verify_code.strip()
+    if not verify_code:
+        return ApiResponse(ok=False, message="verify_code 无效")
+
+    # 无论业务成败都返回 server_verify_code，供客户端校验响应真实性
+    server_verify = compute_server_verify_code(verify_code)
     try:
         data = await auth_service.process_heartbeat(
             db,
             current_user,
             device_serial,
-            body.verify_code,
+            verify_code,
         )
     except auth_service.AuthError as exc:
-        return ApiResponse(ok=False, message=exc.message)
+        return ApiResponse(
+            ok=False,
+            message=exc.message,
+            data=HeartbeatResponse(
+                vip_end_time=current_user.vip_end_time,
+                vip_active=False,
+                server_verify_code=server_verify,
+            ),
+        )
     return ApiResponse(ok=True, message="", data=data)