server.js

// ============ 智能考勤系统 API v3.5.1 ============
// 功能：学号登录、考勤密码保存、 自动签到订阅、邮箱VIP（Resend）、卡密系统、管理员后台
// 包含：邀请功能、系统通知配置、邮件宣传信息、时区修复、管理员删除用户、管理员代签到
// 新增：用户留言反馈系统

const express = require('express');
const mongoose = require('mongoose');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');
const cors = require('cors');
const cron = require('node-cron');
const { spawn } = require('child_process');
const path = require('path');
const crypto = require('crypto');
const fs = require('fs');
const http = require('http');
const uploadsDir = path.join(__dirname, 'uploads');
if (!fs.existsSync(uploadsDir)) {
  fs.mkdirSync(uploadsDir, { recursive: true });
}
const { Server } = require('socket.io');
const app = express();
const server = http.createServer(app);
const PlantData = require('./PlantData');//zhiwu
const ControlCmd = require('./ControlCmd');
const io = new Server(server, {
  cors: {
    origin: '*',
    methods: ['GET', 'POST']
  }
});

// ============ WebSocket 用户映射 ============
const userSockets = new Map();

io.on('connection', (socket) => {
  console.log('🔌 WebSocket 客户端已连接:', socket.id);
  
  socket.on('bindUser', (userId) => {
    if (userId) {
      userSockets.set(userId, socket.id);
      console.log(`👤 用户 ${userId} 绑定 WebSocket: ${socket.id}`);
    }
  });

  socket.on('disconnect', () => {
    for (const [uid, sid] of userSockets.entries()) {
      if (sid === socket.id) {
        userSockets.delete(uid);
        console.log(`👤 用户 ${uid} 断开 WebSocket`);
      }
    }
  });
});

// ============ CORS 配置 ============
const allowedOrigins = [
  'https://login.agai.online',
  'https://api.agai.online',
  'https://attendance-frontend.ag985211ag.workers.dev',
  'http://localhost:3000',
  'http://127.0.0.1:5500',
  'http://localhost:5500'
];

app.use(cors({
  origin: function (origin, callback) {
    if (!origin || allowedOrigins.includes(origin)) {
      callback(null, true);
    } else {
      console.log('❌ CORS 拒绝的域名:', origin);
      callback(new Error('Not allowed by CORS'));
    }
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  optionsSuccessStatus: 200
}));

app.options('*', (req, res) => {
  res.header('Access-Control-Allow-Origin', req.headers.origin || '*');
  res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
  res.header('Access-Control-Allow-Headers', 'Content-Type, Authorization');
  res.header('Access-Control-Allow-Credentials', 'true');
  res.sendStatus(200);
});

app.use(express.json({ limit: '10mb' }));
app.use(express.urlencoded({ limit: '10mb', extended: true }));
app.use('/uploads', express.static(uploadsDir));

// ============ 数据库连接 ============
const MONGODB_URI = process.env.MONGODB_URI;

if (!MONGODB_URI) {
  console.error('❌ MONGODB_URI 未设置！');
} else {
  mongoose.connect(MONGODB_URI)
    .then(() => console.log('✅ MongoDB 连接成功'))
    .catch(err => console.error('❌ MongoDB 连接失败:', err.message));
}

// ============ 时区辅助函数 ============
function getBeijingTime(date = new Date()) {
  return date.toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' });
}

// ============ 生成邀请码 ============
function generateInviteCode(length = 8) {
  return crypto.randomBytes(length).toString('hex').substring(0, length).toUpperCase();
}

// ============ 数据模型 ============

const userSchema = new mongoose.Schema({
  studentId: { type: String, required: true, unique: true },
  name: { type: String, default: '' },
  email: { type: String, default: '' },
  emailVerified: { type: Boolean, default: false },
  isVip: { type: Boolean, default: false },
  vipExpireAt: { type: Date, default: null },
  role: { type: String, enum: ['user', 'admin'], default: 'user' },
  isActive: { type: Boolean, default: true },
  attendancePassword: { type: String, default: 'Ahgydx@920' },
  createdAt: { type: Date, default: Date.now },
  lastLogin: Date,
  totalSignCount: { type: Number, default: 0 },
  successSignCount: { type: Number, default: 0 },
  // 邀请功能字段
  inviteCode: { type: String, unique: true, sparse: true },
  invitedBy: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
  inviteCount: { type: Number, default: 0 },
  // 二手市场收款码
  payQR: {
    wechat: { type: String, default: '' },
    alipay: { type: String, default: '' }
  },
  isGuest: { type: Boolean, default: false },
  source: { type: String, enum: ['attendance', 'market'], default: 'attendance' }
});



const subscriptionSchema = new mongoose.Schema({
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  name: { type: String, default: '晚寝签到' },
  enabled: { type: Boolean, default: true },
  scheduleType: { type: String, enum: ['daily', 'weekdays', 'custom'], default: 'weekdays' },
  customDays: { type: [Number], default: [1, 2, 3, 4, 5] },
  signTime: { type: String, default: '21:25' },
  maxRetries: { type: Number, default: 3 },
  notifyOnSuccess: { type: Boolean, default: true },
  notifyOnFailure: { type: Boolean, default: true },
  createdAt: { type: Date, default: Date.now },
  updatedAt: { type: Date, default: Date.now }
});

const signLogSchema = new mongoose.Schema({
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  subscriptionId: { type: mongoose.Schema.Types.ObjectId, ref: 'Subscription' },
  subscriptionName: { type: String, default: '手动签到' },
  status: { type: String, enum: ['success', 'failed', 'pending'] },
  message: { type: String, default: '' },
  signTime: { type: Date, default: Date.now },
  executedAt: { type: Date, default: Date.now }
});

const emailCodeSchema = new mongoose.Schema({
  email: { type: String, required: true },
  code: { type: String, required: true },
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
  used: { type: Boolean, default: false },
  expiresAt: { type: Date, required: true },
  createdAt: { type: Date, default: Date.now }
});

const cardSchema = new mongoose.Schema({
  code: { type: String, required: true, unique: true },
  days: { type: Number, default: 30 },
  type: { type: String, enum: ['vip_30d', 'vip_90d', 'vip_365d'], default: 'vip_30d' },
  status: { type: String, enum: ['unused', 'used'], default: 'unused' },
  usedBy: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
  usedAt: Date,
  createdAt: { type: Date, default: Date.now }
});

// 系统配置模型
const systemConfigSchema = new mongoose.Schema({
  key: { type: String, required: true, unique: true },
  value: mongoose.Schema.Types.Mixed,
  updatedAt: { type: Date, default: Date.now }
});

// 邀请记录模型
const inviteLogSchema = new mongoose.Schema({
  inviterId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  inviteeId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  rewardDays: { type: Number, default: 10 },
  createdAt: { type: Date, default: Date.now }
});

// ============ 二手市场模型 ============
const marketItemSchema = new mongoose.Schema({
  productNo: { type: String, unique: true, sparse: true },
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  title: { type: String, required: true },
  description: { type: String, required: true },
  price: { type: Number, required: true },
  category: { type: String, enum: ['book', 'electronic', 'life', 'other'], default: 'other' },
  images: { type: [String], default: [] },
  paymentQR: { type: String, default: '' },
  contact: {
    qq: { type: String, default: '' },
    wechat: { type: String, default: '' }
  },
  status: { type: String, enum: ['active', 'reserved', 'sold', 'removed'], default: 'active' },
  views: { type: Number, default: 0 },
  contactViews: { type: Number, default: 0 },
  createdAt: { type: Date, default: Date.now },
  updatedAt: { type: Date, default: Date.now }
});
marketItemSchema.index({ status: 1, category: 1, createdAt: -1 });
marketItemSchema.index({ title: 'text', description: 'text', productNo: 'text' });

const favoriteSchema = new mongoose.Schema({
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  productId: { type: mongoose.Schema.Types.ObjectId, ref: 'MarketItem', required: true },
  createdAt: { type: Date, default: Date.now }
});
favoriteSchema.index({ userId: 1, productId: 1 }, { unique: true });

const chatRoomSchema = new mongoose.Schema({
  productId: { type: mongoose.Schema.Types.ObjectId, ref: 'MarketItem' },
  buyerId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  sellerId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  lastMessage: String,
  lastMessageAt: Date,
  createdAt: { type: Date, default: Date.now }
});
chatRoomSchema.index({ productId: 1, buyerId: 1 }, { unique: true });

const messageSchema = new mongoose.Schema({
  roomId: { type: mongoose.Schema.Types.ObjectId, ref: 'ChatRoom', required: true },
  senderId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  content: { type: String, required: true },
  createdAt: { type: Date, default: Date.now }
});

const MarketItem = mongoose.models.MarketItem || mongoose.model('MarketItem', marketItemSchema);
const Favorite = mongoose.models.Favorite || mongoose.model('Favorite', favoriteSchema);
const ChatRoom = mongoose.models.ChatRoom || mongoose.model('ChatRoom', chatRoomSchema);
const Message = mongoose.models.Message || mongoose.model('Message', messageSchema); 

// ============ 举报和拉黑模型 ============
const reportSchema = new mongoose.Schema({
  reporterId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  targetUserId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  productId: { type: mongoose.Schema.Types.ObjectId, ref: 'MarketItem' },
  reason: { type: String, required: true },
  status: { type: String, enum: ['pending', 'handled', 'dismissed'], default: 'pending' },
  createdAt: { type: Date, default: Date.now }
});

const blockSchema = new mongoose.Schema({
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  blockedUserId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  createdAt: { type: Date, default: Date.now }
});
blockSchema.index({ userId: 1, blockedUserId: 1 }, { unique: true });

const Report = mongoose.models.Report || mongoose.model('Report', reportSchema);
const Block = mongoose.models.Block || mongoose.model('Block', blockSchema);
// ============ 购物车模型 ============
const cartSchema = new mongoose.Schema({
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  productId: { type: mongoose.Schema.Types.ObjectId, ref: 'MarketItem', required: true },
  createdAt: { type: Date, default: Date.now }
});
cartSchema.index({ userId: 1, productId: 1 }, { unique: true });

// ============ 二手市场订单模型 ============
const marketOrderSchema = new mongoose.Schema({
  orderNo: { type: String, required: true, unique: true },
  buyerId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  sellerId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  productId: { type: mongoose.Schema.Types.ObjectId, ref: 'MarketItem', required: true },
  productNo: String,
  title: String,
  price: Number,
  address: {
    name: { type: String, required: true },
    phone: { type: String, required: true },
    detail: { type: String, required: true }
  },
  status: { type: String, enum: ['pending', 'confirmed', 'shipped', 'completed', 'cancelled'], default: 'pending' },
  createdAt: { type: Date, default: Date.now },
  updatedAt: { type: Date, default: Date.now }
});

const Cart = mongoose.models.Cart || mongoose.model('Cart', cartSchema);
const MarketOrder = mongoose.models.MarketOrder || mongoose.model('MarketOrder', marketOrderSchema);

const MARKET_CATEGORIES = ['book', 'electronic', 'life', 'other'];
const MARKET_ORDER_STATUS = ['pending', 'confirmed', 'shipped', 'completed', 'cancelled'];

function escapeRegExp(value = '') {
  return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}

function clampNumber(value, min, max, fallback) {
  const parsed = Number(value);
  if (!Number.isFinite(parsed)) return fallback;
  return Math.min(max, Math.max(min, parsed));
}

function normalizeMarketText(value, maxLength) {
  return String(value || '').trim().slice(0, maxLength);
}

function normalizeMarketPrice(value) {
  const price = Number(value);
  if (!Number.isFinite(price) || price < 0 || price > 99999) return null;
  return Math.round(price * 100) / 100;
}

function normalizeMarketImages(images) {
  if (!Array.isArray(images)) return [];
  return images
    .filter(img => typeof img === 'string' && img.length <= 2 * 1024 * 1024 && /^data:image\/(png|jpe?g|webp);base64,/i.test(img))
    .slice(0, 5);
}

function normalizeMarketContact(contact = {}) {
  return {
    qq: normalizeMarketText(contact.qq, 40),
    wechat: normalizeMarketText(contact.wechat, 80)
  };
}

function normalizeQrImage(value) {
  if (value === '') return '';
  if (typeof value !== 'string') return null;
  if (value.length > 1024 * 1024) return null;
  return /^data:image\/(png|jpe?g|webp);base64,/i.test(value) ? value : null;
}

async function hasMarketBlockBetween(userA, userB) {
  if (!userA || !userB) return false;
  return !!(await Block.exists({
    $or: [
      { userId: userA, blockedUserId: userB },
      { userId: userB, blockedUserId: userA }
    ]
  }));
}

async function releaseMarketItemIfNoOpenOrders(productId) {
  const openOrder = await MarketOrder.exists({
    productId,
    status: { $in: ['pending', 'confirmed', 'shipped'] }
  });
  if (!openOrder) {
    await MarketItem.updateOne({ _id: productId, status: 'reserved' }, { status: 'active', updatedAt: new Date() });
  }
}


// 留言/反馈模型
const feedbackSchema = new mongoose.Schema({
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  title: { type: String, required: true },
  content: { type: String, required: true },
  type: { type: String, enum: ['bug', 'suggestion', 'question', 'other'], default: 'other' },
  status: { type: String, enum: ['pending', 'read', 'replied', 'closed'], default: 'pending' },
  adminReply: { type: String, default: '' },
  repliedAt: { type: Date },
  repliedBy: { type: mongoose.Schema.Types.ObjectId, ref: 'User' },
  createdAt: { type: Date, default: Date.now },
  updatedAt: { type: Date, default: Date.now }
});

// ============ 支付订单模型 ============
const paymentOrderSchema = new mongoose.Schema({
  orderNo: { type: String, required: true, unique: true },
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  amount: { type: Number, required: true },
  days: { type: Number, default: 0 },
  times: { type: Number, default: 0 },
  cardCategory: { type: String, enum: ['days', 'times'], default: 'days' },
  payMethod: { type: String, enum: ['wechat', 'alipay'], default: 'wechat' },
  status: { type: String, enum: ['pending', 'paid', 'expired'], default: 'pending' },
  cardId: { type: mongoose.Schema.Types.ObjectId, ref: 'Card' },
  expireAt: { type: Date },  // ← 新增：订单过期时间
  createdAt: { type: Date, default: Date.now },
  paidAt: Date
});

const PaymentOrder = mongoose.models.PaymentOrder || mongoose.model('PaymentOrder', paymentOrderSchema);

const User = mongoose.models.User || mongoose.model('User', userSchema);
const Subscription = mongoose.models.Subscription || mongoose.model('Subscription', subscriptionSchema);
const SignLog = mongoose.models.SignLog || mongoose.model('SignLog', signLogSchema);
const EmailCode = mongoose.models.EmailCode || mongoose.model('EmailCode', emailCodeSchema);
const Card = mongoose.models.Card || mongoose.model('Card', cardSchema);
const SystemConfig = mongoose.models.SystemConfig || mongoose.model('SystemConfig', systemConfigSchema);
const InviteLog = mongoose.models.InviteLog || mongoose.model('InviteLog', inviteLogSchema);
const Feedback = mongoose.models.Feedback || mongoose.model('Feedback', feedbackSchema);

const AUTO_SIGN_NAME = '自动签到';
const AUTO_SIGN_TIME = '21:25';
const DEFAULT_AUTO_SIGN_DAYS = [1, 2, 3, 4, 5];

function normalizeAutoSignDays(days) {
  const source = Array.isArray(days) && days.length > 0 ? days : DEFAULT_AUTO_SIGN_DAYS;
  const normalized = [...new Set(
    source
      .map(day => Number(day))
      .filter(day => Number.isInteger(day) && day >= 0 && day <= 6)
  )].sort((a, b) => a - b);

  return normalized.length > 0 ? normalized : DEFAULT_AUTO_SIGN_DAYS;
}

function formatAutoSignSetting(setting) {
  return {
    id: setting?._id || null,
    _id: setting?._id || null,
    name: AUTO_SIGN_NAME,
    enabled: !!setting?.enabled,
    scheduleType: 'custom',
    customDays: setting ? normalizeAutoSignDays(setting.customDays) : DEFAULT_AUTO_SIGN_DAYS,
    signTime: AUTO_SIGN_TIME,
    maxRetries: 3,
    notifyOnSuccess: setting ? setting.notifyOnSuccess !== false : true,
    notifyOnFailure: setting ? setting.notifyOnFailure !== false : true,
    createdAt: setting?.createdAt || null,
    updatedAt: setting?.updatedAt || null
  };
}

async function getAutoSignSetting(userId) {
  return Subscription.findOne({ userId }).sort({ createdAt: 1 });
}

async function saveAutoSignSetting(userId, options = {}, targetId = null) {
  const query = targetId ? { _id: targetId, userId } : { userId };
  let setting = await Subscription.findOne(query).sort({ createdAt: 1 });

  if (!setting) {
    setting = new Subscription({ userId });
  }

  setting.name = AUTO_SIGN_NAME;
  setting.enabled = options.enabled !== false;
  setting.scheduleType = 'custom';
  setting.customDays = normalizeAutoSignDays(options.customDays);
  setting.signTime = AUTO_SIGN_TIME;
  setting.maxRetries = 3;
  setting.notifyOnSuccess = options.notifyOnSuccess !== false;
  setting.notifyOnFailure = options.notifyOnFailure !== false;
  setting.updatedAt = new Date();

  await setting.save();
  await Subscription.deleteMany({ userId, _id: { $ne: setting._id } });

  return setting;
}

// ============ 初始化系统配置 ============
async function initSystemConfig() {
  const defaults = [
    { 
      key: 'dashboard_notice', 
      value: { 
        enabled: true, 
        title: '📢 系统公告', 
        content: '欢迎使用智能考勤系统！绑定邮箱即可获得 30 天 VIP。邀请好友注册，双方各得 10 天 VIP！', 
        style: 'info' 
      } 
    },
    { key: 'email_template', value: { footer: 'AG工作室 · 智能考勤系统', website: 'https://login.agai.online' } },
    { key: 'invite_reward_days', value: 10 }
  ];
  
  for (const cfg of defaults) {
    const exists = await SystemConfig.findOne({ key: cfg.key });
    if (!exists) {
      await SystemConfig.create(cfg);
      console.log(`✅ 初始化配置: ${cfg.key}`);
    }
  }
  console.log('✅ 系统配置初始化完成');
}

// ============ JWT 配置 ============
const JWT_SECRET = process.env.JWT_SECRET;
if (!JWT_SECRET) {
  console.error('❌ JWT_SECRET 环境变量未设置！');
  process.exit(1);
}
const JWT_EXPIRE = '30d';
const ADMIN_CREDENTIALS = parseAdminCredentials(process.env.ADMIN_CREDENTIALS || '111:0101');

function parseAdminCredentials(rawValue) {
  return String(rawValue)
    .split(',')
    .map(item => item.trim())
    .filter(Boolean)
    .reduce((credentials, item) => {
      const separatorIndex = item.indexOf(':');
      if (separatorIndex <= 0) return credentials;

      const account = item.slice(0, separatorIndex).trim();
      const password = item.slice(separatorIndex + 1);
      if (account && password) credentials.set(account, password);
      return credentials;
    }, new Map());
}

function timingSafeTextEqual(actual, expected) {
  const actualHash = crypto.createHash('sha256').update(String(actual || '')).digest();
  const expectedHash = crypto.createHash('sha256').update(String(expected || '')).digest();
  return crypto.timingSafeEqual(actualHash, expectedHash);
}

function isConfiguredAdminAccount(studentId) {
  return ADMIN_CREDENTIALS.has(String(studentId));
}

function validateAdminLogin(studentId, password) {
  const expectedPassword = ADMIN_CREDENTIALS.get(String(studentId));
  return Boolean(expectedPassword) && timingSafeTextEqual(password, expectedPassword);
}

// ============ 认证中间件 ============
const authMiddleware = async (req, res, next) => {
  try {
    const authHeader = req.headers.authorization;
    if (!authHeader) {
      return res.status(401).json({ success: false, message: '未登录' });
    }
    
    const token = authHeader.split(' ')[1];
    if (!token) {
      return res.status(401).json({ success: false, message: '令牌格式错误' });
    }
    
    const decoded = jwt.verify(token, JWT_SECRET);
    const user = await User.findById(decoded.userId);
    
    if (!user) {
      return res.status(401).json({ success: false, message: '用户不存在' });
    }
    
    req.user = user;
    // 游客只能访问市场相关API，禁止访问签到系统
    if (user.studentId && user.studentId.startsWith('guest_')) {
      const allowedPaths = [
        '/api/market', '/api/user/payqr', '/api/quick-login',
        '/api/user/profile', '/api/feedback'
      ];
      const isAllowed = allowedPaths.some(p => req.path.startsWith(p));
      if (!isAllowed) {
        return res.status(403).json({ success: false, message: '游客无权访问此功能，请使用市场账号' });
      }
    }
    next();
  } catch (error) {
    return res.status(401).json({ success: false, message: '登录已过期' });
  }
};

const adminMiddleware = async (req, res, next) => {
  try {
    await authMiddleware(req, res, async () => {
      if (req.user.role !== 'admin') {
        return res.status(403).json({ success: false, message: '需要管理员权限' });
      }
      next();
    });
  } catch (error) {
    res.status(401).json({ success: false, message: '未授权' });
  }
};

// ============ 邮箱配置（Resend API）============
const RESEND_API_KEY = process.env.RESEND_API_KEY || '';

async function sendVerificationCode(email, code) {
  if (!RESEND_API_KEY) {
    console.log('📧 Resend 未配置，验证码:', code);
    return false;
  }
  
  try {
    const response = await fetch('https://api.resend.com/emails', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${RESEND_API_KEY}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        from: 'AG工作室 <noreply@agai.online>',
        to: email,
        subject: '邮箱验证码 - AG工作室',
        html: `
          <div style="max-width: 450px; margin: 0 auto; padding: 20px; font-family: Arial, sans-serif;">
            <div style="text-align: center; margin-bottom: 24px;">
              <h1 style="color: #667eea; margin: 0;">📋 AG工作室</h1>
              <p style="color: #888; margin: 5px 0 0;">AG工作室</p>
            </div>
            <p style="font-size: 16px;">您的邮箱验证码是：</p>
            <div style="font-size: 36px; font-weight: bold; color: #667eea; padding: 20px; background: #f5f7fa; text-align: center; border-radius: 12px; letter-spacing: 5px;">
              ${code}
            </div>
            <p style="margin-top: 20px; color: #666;">验证码 5 分钟内有效，请勿泄露给他人。</p>
            
            <div style="margin-top: 24px; padding: 16px; background: linear-gradient(135deg, #667eea10 0%, #764ba210 100%); border-radius: 12px; text-align: center;">
              <p style="margin: 0 0 8px 0; font-weight: 600; color: #667eea;">🎉 绑定邮箱即送 30 天 VIP</p>
              <p style="margin: 0 0 12px 0; font-size: 13px; color: #666;">享受签到邮件通知 · 邀请好友再送 VIP</p>
              <a href="https://login.agai.online" style="display: inline-block; padding: 8px 20px; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); color: #fff; text-decoration: none; border-radius: 20px; font-size: 14px; font-weight: 500;">立即体验</a>
            </div>
            
            <hr style="margin: 24px 0; border: none; border-top: 1px solid #eee;">
            <p style="color: #999; font-size: 12px; text-align: center;">
              AG工作室 · 智能考勤系统<br>
              🌐 https://login.agai.online
            </p>
          </div>
        `
      })
    });
    
    if (response.ok) {
      console.log('✅ 验证码邮件发送成功:', email);
      return true;
    } else {
      const error = await response.text();
      console.error('❌ Resend 发送失败:', error);
      return false;
    }
  } catch (error) {
    console.error('❌ 发送邮件异常:', error);
    return false;
  }
}

// ============ 发送 VIP 到账邮件 ============
async function sendVipGrantEmail(user, addedDays, newExpireAt) {
  if (!RESEND_API_KEY) {
    console.log('📧 Resend 未配置，跳过 VIP 邮件');
    return false;
  }
  if (!user.email || !user.emailVerified) {
    console.log(`📧 用户 ${user.studentId} 未绑定邮箱，跳过`);
    return false;
  }

  const expireDate = newExpireAt ? new Date(newExpireAt).toLocaleDateString('zh-CN') : '永久';
  const subject = `🎉 VIP 已到账 - AG工作室`;

  try {
    const response = await fetch('https://api.resend.com/emails', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${RESEND_API_KEY}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        from: 'AG工作室 <noreply@agai.online>',
        to: user.email,
        subject: subject,
        html: `
          <div style="max-width:500px;margin:0 auto;padding:20px;font-family:Arial,sans-serif;">
            <div style="text-align:center;margin-bottom:24px;">
              <h1 style="color:#667eea;margin:0;">📋 AG工作室</h1>
            </div>
            <div style="background:#d4edda;padding:24px;border-radius:12px;border-left:4px solid #28a745;">
              <p style="font-size:18px;font-weight:700;margin:0 0 12px 0;">🎉 VIP 已到账！</p>
              <p style="margin:8px 0;"><strong>用户：</strong>${user.name || user.studentId}</p>
              <p style="margin:8px 0;"><strong>增加天数：</strong>${addedDays} 天</p>
              <p style="margin:8px 0;"><strong>有效期至：</strong>${expireDate}</p>
            </div>
            <div style="margin-top:24px;padding:16px;background:#f8f9fc;border-radius:12px;text-align:center;">
              <p style="margin:0 0 12px 0;font-size:14px;color:#666;">
                感谢您对 AG工作室 的信任与支持！<br>
                签到邮件通知、自动签到等权益已正常生效。
              </p>
              <a href="https://login.agai.online" style="display:inline-block;padding:10px 24px;background:linear-gradient(135deg,#667eea 0%,#764ba2 100%);color:#fff;text-decoration:none;border-radius:20px;font-size:14px;">进入仪表盘</a>
            </div>
            <hr style="margin:24px 0;border:none;border-top:1px solid #eee;">
            <p style="color:#999;font-size:12px;text-align:center;">
              AG工作室 · 智能考勤系统<br>
              🌐 https://login.agai.online
            </p>
          </div>
        `
      })
    });
    if (response.ok) {
      console.log(`✅ VIP 到账邮件发送成功: ${user.email}`);
      return true;
    } else {
      console.error(`❌ VIP 邮件发送失败:`, await response.text());
      return false;
    }
  } catch (error) {
    console.error('❌ 发送 VIP 邮件异常:', error);
    return false;
  }
}

async function sendSignNotification(email, studentId, result, subscriptionName, signTime = null) {
  console.log(`📧 准备发送通知: email=${email}, studentId=${studentId}, success=${result.success}`);
  
  if (!RESEND_API_KEY) {
    console.log('📧 Resend 未配置，跳过通知');
    return false;
  }
  
  const emoji = result.success ? '✅' : '❌';
  const statusText = result.success ? '成功' : '失败';
  const statusColor = result.success ? '#28a745' : '#dc3545';
  const displayTime = signTime 
    ? signTime.toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }) 
    : getBeijingTime();
  
  try {
    const response = await fetch('https://api.resend.com/emails', {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${RESEND_API_KEY}`,
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({
        from: 'AG工作室 <noreply@agai.online>',
        to: email,
        subject: `${emoji} 签到${statusText}通知 - ${subscriptionName}`,
        html: `
          <div style="max-width: 450px; margin: 0 auto; padding: 20px; font-family: Arial, sans-serif;">
            <div style="text-align: center; margin-bottom: 24px;">
              <h1 style="color: #667eea; margin: 0;">📋 签到通知</h1>
            </div>
            <div style="background: #f5f7fa; padding: 20px; border-radius: 12px;">
              <p><strong>学号：</strong>${studentId}</p>
              <p><strong>任务：</strong>${subscriptionName}</p>
              <p><strong>时间：</strong>${displayTime}</p>
              <p><strong>结果：</strong><span style="color: ${statusColor};">${result.message || statusText}</span></p>
            </div>
            
            <div style="margin-top: 24px; padding: 16px; background: linear-gradient(135deg, #667eea10 0%, #764ba210 100%); border-radius: 12px; text-align: center;">
              <p style="margin: 0 0 8px 0; font-weight: 600; color: #667eea;">🚀 智能考勤 · 让签到更简单</p>
              <p style="margin: 0 0 12px 0; font-size: 13px; color: #666;">自动签到 · 邮件通知 · 永久免费</p>
              <a href="https://login.agai.online" style="display: inline-block; padding: 8px 20px; background: linear-gradient(135deg, #667eea 0%, #764ba2 100%); color: #fff; text-decoration: none; border-radius: 20px; font-size: 14px; font-weight: 500;">访问官网</a>
              <p style="margin: 12px 0 0 0; font-size: 12px; color: #999;">邀请好友注册，双方各得 10 天 VIP！</p>
            </div>
            
            <hr style="margin: 24px 0; border: none; border-top: 1px solid #eee;">
            <p style="color: #999; font-size: 12px; text-align: center;">
              AG工作室 · 智能考勤系统<br>
              📧 客服邮箱：support@agai.online<br>
              🌐 官网：https://login.agai.online
            </p>
          </div>
        `
      })
    });
    
    if (response.ok) {
      console.log('✅ 签到通知发送成功:', email);
      return true;
    } else {
      const error = await response.text();
      console.error('❌ 通知发送失败:', error);
      return false;
    }
  } catch (error) {
    console.error('❌ 发送通知异常:', error);
    return false;
  }
}

// ============ 发送赞助者通知邮件（供管理员调用） ============
async function sendSponsorEmailToAllVips(notice) {
  if (!RESEND_API_KEY) {
    console.log('📧 Resend 未配置，跳过邮件群发');
    return;
  }
  // 获取所有邮箱已验证且为VIP的用户（排除游客）
  const users = await User.find({ emailVerified: true, isVip: true, isGuest: { $ne: true } }).select('email studentId name');
  if (users.length === 0) {
    console.log('📧 没有符合条件的VIP用户');
    return;
  }

  const subject = `🎉 ${notice.title || 'AG工作室感谢您的赞助！'}`;
  const content = notice.content || '感谢您的支持，我们将继续努力！';

  let successCount = 0, failCount = 0;
  for (const user of users) {
    try {
      const response = await fetch('https://api.resend.com/emails', {
        method: 'POST',
        headers: {
          'Authorization': `Bearer ${RESEND_API_KEY}`,
          'Content-Type': 'application/json'
        },
        body: JSON.stringify({
          from: 'AG工作室 <noreply@agai.online>',
          to: user.email,
          subject: subject,
          html: `
            <div style="max-width:500px;margin:0 auto;padding:20px;font-family:Arial,sans-serif;">
              <h2 style="color:#667eea;">📋 AG工作室</h2>
              <div style="background:#f8f9fc;padding:20px;border-radius:12px;">
                ${content.replace(/\n/g, '<br>')}
              </div>
              <p style="color:#888;margin-top:20px;text-align:center;">此邮件由管理员发送，感谢您的支持！</p>
            </div>
          `
        })
      });
      if (response.ok) successCount++; else failCount++;
    } catch (e) { failCount++; }
    // 避免触发邮件发送频率限制
    await new Promise(r => setTimeout(r, 200));
  }
  console.log(`📧 赞助邮件群发完成：成功 ${successCount}，失败 ${failCount}`);
}

// ============ 调用 Python 签到脚本 ============
async function realSign(studentId, password, maxRetries = 3) {
  return new Promise((resolve) => {
    const pythonScript = path.join(__dirname, 'attendance_runner.py');
    const pythonProcess = spawn('python3', [pythonScript], {
      timeout: 60000  // 60秒超时
    });
    
    let output = '';
    let errorOutput = '';
    let isResolved = false;
    
    // 超时处理
    const timeout = setTimeout(() => {
      if (!isResolved) {
        isResolved = true;
        pythonProcess.kill();
        console.error('⏰ Python 脚本执行超时');
        resolve({ success: false, message: '签到脚本执行超时', errors: ['执行超时'] });
      }
    }, 55000);  // 55秒超时
    
    pythonProcess.stdout.on('data', (data) => { 
      output += data.toString(); 
      console.log('Python stdout:', data.toString().substring(0, 200));
    });
    
    pythonProcess.stderr.on('data', (data) => { 
      errorOutput += data.toString();
      console.error('Python stderr:', data.toString());
    });
    
    pythonProcess.on('close', (code) => {
      if (isResolved) return;
      isResolved = true;
      clearTimeout(timeout);
      
      console.log(`Python 进程退出，代码: ${code}`);
      console.log('Python stdout 长度:', output.length);
      console.log('Python stderr 长度:', errorOutput.length);
      
      if (code !== 0) {
        resolve({ success: false, message: '脚本执行失败', errors: [errorOutput || '未知错误'] });
        return;
      }
      try {
        const result = JSON.parse(output);
        resolve(result);
      } catch (e) {
        console.error('解析 Python 输出失败:', output.substring(0, 500));
        resolve({ success: false, message: '解析失败', errors: [output.substring(0, 200)] });
      }
    });
    
    pythonProcess.on('error', (err) => {
      if (isResolved) return;
      isResolved = true;
      clearTimeout(timeout);
      console.error('Python 进程启动失败:', err);
      resolve({ success: false, message: '无法启动签到脚本', errors: [err.message] });
    });
    
    // 发送输入数据
    const inputData = JSON.stringify({
      action: 'sign_single',
      user: { studentId, password },
      maxRetries
    });
    
    console.log('发送给 Python 的数据:', inputData.substring(0, 100));
    pythonProcess.stdin.write(inputData);
    pythonProcess.stdin.end();
  });
}

// ============ 只验证密码（获取Token，不跑完整签到）============
async function verifyPassword(studentId, password) {
  return new Promise((resolve) => {
    const pythonScript = path.join(__dirname, 'attendance_runner.py');
    const pythonProcess = spawn('python3', [pythonScript], {
      timeout: 30000
    });
    
    let output = '';
    let errorOutput = '';
    let isResolved = false;
    
    const timeout = setTimeout(() => {
      if (!isResolved) {
        isResolved = true;
        pythonProcess.kill();
        resolve({ success: false, message: '验证超时，请重试' });
      }
    }, 25000);
    
    pythonProcess.stdout.on('data', (data) => { output += data.toString(); });
    pythonProcess.stderr.on('data', (data) => { 
      errorOutput += data.toString();
      console.error('验证密码 stderr:', data.toString());
    });
    
    pythonProcess.on('close', (code) => {
      if (isResolved) return;
      isResolved = true;
      clearTimeout(timeout);
      
      try {
        const result = JSON.parse(output);
        resolve({
          success: result.success === true,
          username: result.username || '',
          message: result.message || ''
        });
      } catch (e) {
        resolve({ success: false, message: '验证失败，请重试' });
      }
    });
    
    pythonProcess.on('error', (err) => {
      if (isResolved) return;
      isResolved = true;
      clearTimeout(timeout);
      resolve({ success: false, message: '验证服务暂不可用' });
    });
    
    pythonProcess.stdin.write(JSON.stringify({
      action: 'verify',
      user: { studentId, password }
    }));
    pythonProcess.stdin.end();
  });
}

// ============ 自动签到执行函数 ============
// ============ 自动签到执行函数（并发优化版）============
async function executeAutoSign() {
  console.log('⏰ 自动签到任务开始:', getBeijingTime());
  
  if (!MONGODB_URI) {
    console.log('⚠️ 数据库未连接');
    return;
  }
  
  try {
    const today = new Date();
    const dayOfWeek = today.getDay();
    
    const subscriptions = await Subscription.find({ enabled: true }).populate('userId');
    
    // 筛选今天需要签到的订阅
    const todaySubscriptions = subscriptions.filter(sub => {
      if (sub.scheduleType === 'daily') return true;
      if (sub.scheduleType === 'weekdays') return dayOfWeek >= 1 && dayOfWeek <= 5;
      if (sub.scheduleType === 'custom') {
        return sub.customDays && sub.customDays.includes(dayOfWeek);
      }
      return false;
    });
    
    // 按用户分组
    const userMap = new Map();
    for (const sub of todaySubscriptions) {
      const user = sub.userId;
      if (user && user.isActive !== false) {
        if (!userMap.has(user._id.toString())) {
          userMap.set(user._id.toString(), { user, subscriptions: [] });
        }
        userMap.get(user._id.toString()).subscriptions.push(sub);
      }
    }
    
    const userArray = Array.from(userMap.entries());
    console.log(`📊 今天需要签到: ${userArray.length} 个用户`);
    
    // 并发处理：每批 5 个用户同时签到
    const CONCURRENCY = 5;
    
    for (let i = 0; i < userArray.length; i += CONCURRENCY) {
      const batch = userArray.slice(i, i + CONCURRENCY);
      
      console.log(`🔄 处理第 ${Math.floor(i / CONCURRENCY) + 1} 批，共 ${batch.length} 人`);
      
        await Promise.allSettled(
      batch.map(async ([userId, data]) => {
        const { user, subscriptions } = data;
        
        try {
          // ========== 防止重复签到 ==========
          const todayStart = new Date();
          todayStart.setHours(0, 0, 0, 0);
          const todayEnd = new Date();
          todayEnd.setHours(23, 59, 59, 999);
    
          const existingLog = await SignLog.findOne({
            userId: user._id,
            status: 'success',
            signTime: { $gte: todayStart, $lte: todayEnd }
          });
    
          if (existingLog) {
            console.log(`⏭️ ${user.studentId} 今天已签到，跳过`);
            return;
          }
    
          console.log(`🔄 签到: ${user.studentId}`);
          
          const signPassword = user.attendancePassword || 'Ahgydx@920';
          const signTime = new Date();
          const signResult = await realSign(user.studentId, signPassword, 3);
          
          // 更新用户统计
          user.totalSignCount = (user.totalSignCount || 0) + 1;
          if (signResult.success) {
            user.successSignCount = (user.successSignCount || 0) + 1;
          }
          await user.save();
          
          // 记录签到日志
          for (const sub of subscriptions) {
            const log = new SignLog({
              userId: user._id,
              subscriptionId: sub._id,
              subscriptionName: sub.name,
              status: signResult.success ? 'success' : 'failed',
              message: signResult.message || '',
              signTime: signTime
            });
            await log.save();
          }
          
          // VIP 邮件通知
          if (user.isVip && user.emailVerified && user.email) {
            const now = new Date();
            const vipValid = user.vipExpireAt && user.vipExpireAt > now;
            
            if (vipValid) {
              const shouldNotify = signResult.success ? 
                subscriptions.some(s => s.notifyOnSuccess) : 
                subscriptions.some(s => s.notifyOnFailure);
              
              if (shouldNotify) {
                const subscriptionNames = subscriptions.map(s => s.name).join(', ');
                await sendSignNotification(
                  user.email, 
                  user.studentId, 
                  signResult, 
                  subscriptionNames,
                  signTime
                );
              }
            } else {
              user.isVip = false;
              await user.save();
            }
          }
          
          console.log(`✅ ${user.studentId}: ${signResult.success ? '成功' : '失败'}`);
          
        } catch (error) {
          console.error(`❌ ${data.user.studentId}:`, error.message);
        }
      })
    );
      
      // 每批之间间隔 3 秒，避免服务器压力过大
      if (i + CONCURRENCY < userArray.length) {
        await new Promise(resolve => setTimeout(resolve, 3000));
      }
    }
    
    console.log('✅ 自动签到任务完成');
    
  } catch (error) {
    console.error('❌ 定时任务错误:', error);
  }
}

// ============ API 路由 ============
// ========== 植物工厂数据接口 ==========

// 1. ESP8266 上传传感器数据 + AI 结果
app.post('/api/plant/data', async (req, res) => {
    try {
        const data = await PlantData.create(req.body);
        console.log('✅ 收到植物数据:', req.body.temperature + '°C');
        res.json({ success: true, id: data._id });
    } catch (err) {
        console.error('❌ 存储失败:', err.message);
        res.status(500).json({ success: false, error: err.message });
    }
});

// 2. 前端拉取最新一条数据
app.get('/api/plant/data', async (req, res) => {
    try {
        const data = await PlantData.findOne().sort({ createdAt: -1 });
        if (!data) return res.json({ error: '暂无数据' });
        res.json(data);
    } catch (err) {
        res.status(500).json({ error: err.message });
    }
});

// 3. 前端拉取历史数据（图表用，默认最近100条）
app.get('/api/plant/data/history', async (req, res) => {
    try {
        const limit = parseInt(req.query.limit) || 100;
        const data = await PlantData.find()
            .sort({ createdAt: -1 })
            .limit(limit)
            .select('temperature humidity light air_quality health_score createdAt');
        res.json(data);
    } catch (err) {
        res.status(500).json({ error: err.message });
    }
});



// 5. ESP8266 轮询拉取待执行的控制指令
app.get('/api/plant/control/pending', async (req, res) => {
    try {
        const cmd = await ControlCmd.findOneAndUpdate(
            { status: 'pending' },
            { status: 'executed' },
            { sort: { createdAt: 1 }, new: true }
        );
        if (!cmd) return res.json({ hasCommand: false });
        res.json({ hasCommand: true, command: cmd });
    } catch (err) {
        res.status(500).json({ hasCommand: false, error: err.message });
    }
});


app.get('/health', (req, res) => {
  res.json({ status: 'healthy', time: getBeijingTime() });
});

app.get('/', (req, res) => {
  res.json({ status: 'running', version: '3.5.0', emailService: RESEND_API_KEY ? 'Resend' : '未配置' });
});

// 3. 接收Web端控制指令，暂存后由ESP8266轮询拉取（或直接透传）
app.post('/api/plant/control', async (req, res) => {
    try {
        // 这里先返回成功，后续可对接ESP8266
        console.log('🔧 收到控制指令:', JSON.stringify(req.body));
        res.json({ success: true, message: '指令已收到' });
    } catch (err) {
        res.status(500).json({ success: false, error: err.message });
    }
});

// 4. 接收模式切换指令
app.post('/api/plant/mode', async (req, res) => {
    try {
        console.log('🔧 收到模式切换:', JSON.stringify(req.body));
        res.json({ success: true, message: '模式已切换' });
    } catch (err) {
        res.status(500).json({ success: false, error: err.message });
    }
});


// ============ 快速登录（无需考勤系统）============
app.post('/api/quick-login', async (req, res) => {
  try {
    const { nickname } = req.body;
    
    if (!nickname || nickname.trim().length < 2) {
      return res.status(400).json({ success: false, message: '昵称至少2个字符' });
    }
    
    if (!MONGODB_URI) {
      return res.status(503).json({ success: false, message: '数据库未配置' });
    }
    
    // 生成一个虚拟学号
    let guestId = 'guest_' + crypto.randomBytes(6).toString('hex');
    
    // 确保不重复
    let user = await User.findOne({ studentId: guestId });
    while (user) {
      guestId = 'guest_' + crypto.randomBytes(6).toString('hex');
      user = await User.findOne({ studentId: guestId });
    }
    
    // 生成邀请码
    let inviteCode;
    let isUnique = false;
    while (!isUnique) {
      inviteCode = generateInviteCode(8);
      const existing = await User.findOne({ inviteCode });
      if (!existing) isUnique = true;
    }
    
    user = new User({
      studentId: guestId,
      name: nickname.trim(),
      role: 'user',
      isGuest: true,
      source: 'market',
      inviteCode,
      lastLogin: new Date()
    });
    await user.save();
    
    const token = jwt.sign({ userId: user._id }, JWT_SECRET, { expiresIn: JWT_EXPIRE });
    
    res.json({
      success: true,
      token,
      user: {
        id: user._id,
        studentId: user.studentId,
        name: user.name,
        email: '',
        emailVerified: false,
        isVip: false,
        vipExpireAt: null,
        role: 'user',
        inviteCode: user.inviteCode,
        totalSignCount: 0,
        successSignCount: 0
      }
    });
  } catch (error) {
    console.error('快速登录错误:', error);
    res.status(500).json({ success: false, message: error.message });
  }
});
// ============ 登录 ============
app.post('/api/login', async (req, res) => {
  try {
    const { studentId, attendancePassword } = req.body;
    if (studentId && studentId.startsWith('guest_')) {
      return res.status(403).json({ success: false, message: '市场游客请通过二手市场登录' });
    }
    if (!studentId) {
      return res.status(400).json({ success: false, message: '请输入学号' });
    }
    
    if (!MONGODB_URI) {
      return res.status(503).json({ success: false, message: '数据库未配置' });
    }
    let verifyResult = null;
    const isAdminAccount = isConfiguredAdminAccount(studentId);

    if (isAdminAccount) {
      if (!attendancePassword) {
        return res.status(400).json({
          success: false,
          message: '请输入管理员密码'
        });
      }

      if (!validateAdminLogin(studentId, attendancePassword)) {
        return res.status(401).json({
          success: false,
          message: '管理员账号或密码错误'
        });
      }
    } else {
      // ========== 普通用户验证 ==========
      
      // 密码必填
      if (!attendancePassword) {
        return res.status(400).json({ 
          success: false, 
          message: '请输入考勤密码' 
        });
      }
      
      // 只验证密码是否正确（不跑完整签到流程）
       verifyResult = await verifyPassword(studentId, attendancePassword);
      
      console.log('密码验证结果:', JSON.stringify(verifyResult));
      
      if (!verifyResult.success) {
        return res.status(401).json({ 
          success: false, 
          message: verifyResult.message || '学号或密码错误' 
        });
      }
    }
    
    // ========== 验证通过，继续登录 ==========
    let user = await User.findOne({ studentId });
    
    if (!user) {
      let inviteCode;
      let isUnique = false;
      while (!isUnique) {
        inviteCode = generateInviteCode(8);
        const existing = await User.findOne({ inviteCode });
        if (!existing) isUnique = true;
      }
      
      // 获取 Python 验证返回的真实姓名（verifyResult 在普通用户验证时已赋值）
      const realName = (verifyResult?.username) || studentId;
      
      const userData = { 
        studentId,
        name: realName,  // ← 使用学校系统的真实姓名
        inviteCode,
        lastLogin: new Date()
      };

      if (isAdminAccount) {
        userData.role = 'admin';
      } else {
        userData.attendancePassword = attendancePassword || 'Ahgydx@920';
      }
      user = new User(userData);
      await user.save();
    } else {
      // 老用户：如果之前没存真实姓名，现在补上
      if (verifyResult?.username && (!user.name || user.name === user.studentId)) {
        user.name = verifyResult.username;
      }
      user.lastLogin = new Date();
      if (isAdminAccount) {
        user.role = 'admin';
      } else if (attendancePassword) {
        user.attendancePassword = attendancePassword;
      }
      if (!user.inviteCode) {
        let inviteCode;
        let isUnique = false;
        while (!isUnique) {
          inviteCode = generateInviteCode(8);
          const existing = await User.findOne({ inviteCode });
          if (!existing) isUnique = true;
        }
        user.inviteCode = inviteCode;
      }
      await user.save();
    }
    
    const token = jwt.sign({ userId: user._id }, JWT_SECRET, { expiresIn: JWT_EXPIRE });
    
    res.json({
      success: true,
      token,
      user: {
        id: user._id,
        studentId: user.studentId,
        name: user.name,
        email: user.email,
        emailVerified: user.emailVerified,
        isVip: user.isVip,
        vipExpireAt: user.vipExpireAt,
        role: user.role,
        inviteCode: user.inviteCode,
        invitedBy: user.invitedBy,
        inviteCount: user.inviteCount,
        totalSignCount: user.totalSignCount,
        successSignCount: user.successSignCount
      }
    });
  } catch (error) {
    console.error('登录错误:', error);
    res.status(500).json({ success: false, message: error.message });
  }
});
    
// 获取用户信息
app.get('/api/user/profile', authMiddleware, async (req, res) => {
  const user = req.user;
  res.json({
    success: true,
    user: {
      id: user._id,
      studentId: user.studentId,
      name: user.name,
      email: user.email,
      emailVerified: user.emailVerified,
      isVip: user.isVip,
      vipExpireAt: user.vipExpireAt,
      role: user.role,
      inviteCode: user.inviteCode,
      invitedBy: user.invitedBy,
      inviteCount: user.inviteCount,
      totalSignCount: user.totalSignCount,
      successSignCount: user.successSignCount,
      createdAt: user.createdAt,
      payQR: user.payQR || { wechat: '', alipay: '' }
    }
  });
});

// 更新用户信息
app.put('/api/user/profile', authMiddleware, async (req, res) => {
  try {
    const { name, attendancePassword } = req.body;
    const user = req.user;
    if (name) user.name = name;
    if (attendancePassword) user.attendancePassword = attendancePassword;
    await user.save();
    res.json({ success: true, user: { name: user.name } });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 系统通知 ============
app.get('/api/notice', authMiddleware, async (req, res) => {
  try {
    const config = await SystemConfig.findOne({ key: 'dashboard_notice' });
    res.json({ 
      success: true, 
      notice: config?.value || { enabled: false, title: '', content: '', style: 'info' } 
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// VIP 专属通知（仅VIP用户可见）
app.get('/api/notice/vip', authMiddleware, async (req, res) => {
  try {
    const user = req.user;
    if (!user.isVip) {
      return res.json({ success: true, notice: { enabled: false } });
    }
    const config = await SystemConfig.findOne({ key: 'sponsor_notice' });
    res.json({
      success: true,
      notice: config?.value || { enabled: false, title: '', content: '', style: 'info' }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 邮箱绑定 ============
app.post('/api/email/send-code', authMiddleware, async (req, res) => {
  try {
    const { email } = req.body;
    const user = req.user;
    
    if (!email) {
      return res.status(400).json({ success: false, message: '请输入邮箱' });
    }
    
    const existingUser = await User.findOne({ email, _id: { $ne: user._id } });
    if (existingUser) {
      return res.status(400).json({ success: false, message: '该邮箱已被绑定' });
    }
    
    const code = Math.floor(100000 + Math.random() * 900000).toString();
    
    await EmailCode.deleteMany({ email, used: false });
    const emailCode = new EmailCode({
      email,
      code,
      userId: user._id,
      expiresAt: new Date(Date.now() + 5 * 60 * 1000)
    });
    await emailCode.save();
    
    const sent = await sendVerificationCode(email, code);
    
    res.json({ 
      success: true, 
      message: sent ? '验证码已发送' : '验证码已生成（邮件服务暂不可用）',
      debugCode: sent ? undefined : code
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.post('/api/email/verify', authMiddleware, async (req, res) => {
  try {
    const { email, code } = req.body;
    const user = req.user;
    
    const emailCode = await EmailCode.findOne({ email, code, used: false });
    
    if (!emailCode) {
      return res.status(400).json({ success: false, message: '验证码错误' });
    }
    
    if (emailCode.expiresAt < new Date()) {
      return res.status(400).json({ success: false, message: '验证码已过期' });
    }
    
    emailCode.used = true;
    await emailCode.save();
    
    user.email = email;
    user.emailVerified = true;
    user.isVip = true;
    
    const vipExpireAt = new Date();
    vipExpireAt.setDate(vipExpireAt.getDate() + 30);
    user.vipExpireAt = vipExpireAt;
    
    await user.save();
    
    res.json({
      success: true,
      user: {
        email: user.email,
        emailVerified: user.emailVerified,
        isVip: user.isVip,
        vipExpireAt: user.vipExpireAt
      }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 换绑邮箱 ============
app.post('/api/email/rebind', authMiddleware, async (req, res) => {
  try {
    const { email, code } = req.body;
    const user = req.user;
    
    // 检查是否已绑定邮箱
    if (!user.emailVerified) {
      return res.status(400).json({ success: false, message: '您还没有绑定邮箱，请先绑定' });
    }
    
    if (!email || !code) {
      return res.status(400).json({ success: false, message: '请填写新邮箱和验证码' });
    }
    
    // 不能换绑成同一个邮箱
    if (email === user.email) {
      return res.status(400).json({ success: false, message: '新邮箱不能和当前邮箱相同' });
    }
    
    // 检查新邮箱是否已被其他人绑定
    const existingUser = await User.findOne({ email, _id: { $ne: user._id } });
    if (existingUser) {
      return res.status(400).json({ success: false, message: '该邮箱已被其他用户绑定' });
    }
    
    // 验证验证码
    const emailCode = await EmailCode.findOne({ email, code, used: false });
    if (!emailCode) {
      return res.status(400).json({ success: false, message: '验证码错误' });
    }
    
    if (emailCode.expiresAt < new Date()) {
      return res.status(400).json({ success: false, message: '验证码已过期' });
    }
    
    // 标记验证码已使用
    emailCode.used = true;
    await emailCode.save();
    
    // 更新邮箱
    const oldEmail = user.email;
    user.email = email;
    await user.save();
    
    console.log(`📧 用户 ${user.studentId} 换绑邮箱: ${oldEmail} → ${email}`);
    
    // 发送通知邮件到新邮箱
    if (RESEND_API_KEY) {
      try {
        await fetch('https://api.resend.com/emails', {
          method: 'POST',
          headers: {
            'Authorization': `Bearer ${RESEND_API_KEY}`,
            'Content-Type': 'application/json'
          },
          body: JSON.stringify({
            from: 'AG工作室 <noreply@agai.online>',
            to: email,
            subject: '邮箱换绑成功 - AG工作室',
            html: `
              <div style="max-width: 450px; margin: 0 auto; padding: 20px; font-family: Arial, sans-serif;">
                <div style="text-align: center; margin-bottom: 24px;">
                  <h1 style="color: #667eea; margin: 0;">📋 AG工作室</h1>
                </div>
                <p>您的绑定邮箱已成功更换为：<strong>${email}</strong></p>
                <p>原邮箱 <strong>${oldEmail}</strong> 将不再接收签到通知。</p>
                <hr style="margin: 24px 0;">
                <p style="color: #999; font-size: 12px; text-align: center;">
                  如果这不是您本人的操作，请联系管理员
                </p>
              </div>
            `
          })
        });
      } catch (e) {
        console.error('发送换绑通知失败:', e);
      }
    }
    
    res.json({
      success: true,
      message: '邮箱换绑成功',
      user: {
        email: user.email,
        emailVerified: user.emailVerified
      }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 卡密兑换 ============
app.post('/api/vip/redeem', authMiddleware, async (req, res) => {
  try {
    const { code } = req.body;
    const user = req.user;
    
    if (!code) {
      return res.status(400).json({ success: false, message: '请输入卡密' });
    }
    
    const card = await Card.findOne({ code: code.toUpperCase(), status: 'unused' });
    if (!card) {
      return res.status(400).json({ success: false, message: '卡密无效或已被使用' });
    }
    
    const now = new Date();
    let expireAt;
    if (user.isVip && user.vipExpireAt && user.vipExpireAt > now) {
      expireAt = new Date(user.vipExpireAt);
    } else {
      expireAt = new Date();
    }
    expireAt.setDate(expireAt.getDate() + card.days);
    
    user.isVip = true;
    user.vipExpireAt = expireAt;
    await user.save();
    
    card.status = 'used';
    card.usedBy = user._id;
    card.usedAt = new Date();
    await card.save();
    
    res.json({
      success: true,
      message: `兑换成功！VIP 有效期至 ${expireAt.toLocaleDateString()}`,
      vipExpireAt: expireAt
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 邀请功能 ============
app.get('/api/invite/info', authMiddleware, async (req, res) => {
  try {
    const user = req.user;
    
    const invitedUsers = await User.find({ invitedBy: user._id }).select('studentId name createdAt');
    const rewardConfig = await SystemConfig.findOne({ key: 'invite_reward_days' });
    
    res.json({
      success: true,
      inviteCode: user.inviteCode,
      inviteCount: user.inviteCount || 0,
      inviteUrl: `https://login.agai.online?invite=${user.inviteCode}`,
      rewardDays: rewardConfig?.value || 10,
      invitedUsers
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.post('/api/invite/apply', authMiddleware, async (req, res) => {
  try {
    const { inviteCode } = req.body;
    const user = req.user;
    
    if (user.invitedBy) {
      return res.status(400).json({ success: false, message: '您已经绑定过邀请人了' });
    }
    
    const inviter = await User.findOne({ inviteCode: inviteCode.toUpperCase() });
    if (!inviter) {
      return res.status(400).json({ success: false, message: '邀请码无效' });
    }
    
    if (inviter._id.toString() === user._id.toString()) {
      return res.status(400).json({ success: false, message: '不能邀请自己' });
    }
    
    const rewardConfig = await SystemConfig.findOne({ key: 'invite_reward_days' });
    const rewardDays = rewardConfig?.value || 10;
    
    user.invitedBy = inviter._id;
    
    const now = new Date();
    let expireAt = user.vipExpireAt && user.vipExpireAt > now ? new Date(user.vipExpireAt) : now;
    expireAt.setDate(expireAt.getDate() + rewardDays);
    user.isVip = true;
    user.vipExpireAt = expireAt;
    await user.save();
    
    let inviterExpireAt = inviter.vipExpireAt && inviter.vipExpireAt > now ? new Date(inviter.vipExpireAt) : now;
    inviterExpireAt.setDate(inviterExpireAt.getDate() + rewardDays);
    inviter.isVip = true;
    inviter.vipExpireAt = inviterExpireAt;
    inviter.inviteCount = (inviter.inviteCount || 0) + 1;
    await inviter.save();
    
    const log = new InviteLog({
      inviterId: inviter._id,
      inviteeId: user._id,
      rewardDays
    });
    await log.save();
    
    res.json({
      success: true,
      message: `成功绑定邀请人！您和邀请人各获得 ${rewardDays} 天 VIP`,
      rewardDays
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 订阅管理 ============
app.get('/api/subscriptions', authMiddleware, async (req, res) => {
  try {
    const setting = await getAutoSignSetting(req.user._id);
    res.json({ success: true, subscriptions: setting ? [formatAutoSignSetting(setting)] : [] });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.post('/api/subscriptions', authMiddleware, async (req, res) => {
  try {
    const savedSubscription = await saveAutoSignSetting(req.user._id, req.body);
    res.json({ success: true, subscription: formatAutoSignSetting(savedSubscription) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.get('/api/auto-sign', authMiddleware, async (req, res) => {
  try {
    const setting = await getAutoSignSetting(req.user._id);
    res.json({ success: true, setting: formatAutoSignSetting(setting) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.post('/api/auto-sign', authMiddleware, async (req, res) => {
  try {
    const setting = await saveAutoSignSetting(req.user._id, req.body);
    res.json({ success: true, setting: formatAutoSignSetting(setting) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.put('/api/auto-sign', authMiddleware, async (req, res) => {
  try {
    const setting = await saveAutoSignSetting(req.user._id, req.body);
    res.json({ success: true, setting: formatAutoSignSetting(setting) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.put('/api/subscriptions/:id', authMiddleware, async (req, res) => {
  try {
    const subscription = await Subscription.findOne({ _id: req.params.id, userId: req.user._id });
    if (!subscription) {
      return res.status(404).json({ success: false, message: '订阅不存在' });
    }
    
    const savedSubscription = await saveAutoSignSetting(req.user._id, req.body, req.params.id);
    res.json({ success: true, subscription: formatAutoSignSetting(savedSubscription) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.delete('/api/subscriptions/:id', authMiddleware, async (req, res) => {
  try {
    await Subscription.findOneAndDelete({ _id: req.params.id, userId: req.user._id });
    res.json({ success: true });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.post('/api/subscriptions/:id/toggle', authMiddleware, async (req, res) => {
  try {
    const subscription = await Subscription.findOne({ _id: req.params.id, userId: req.user._id });
    if (!subscription) {
      return res.status(404).json({ success: false, message: '订阅不存在' });
    }
    
    subscription.name = AUTO_SIGN_NAME;
    subscription.enabled = !subscription.enabled;
    subscription.scheduleType = 'custom';
    subscription.customDays = normalizeAutoSignDays(subscription.customDays);
    subscription.signTime = AUTO_SIGN_TIME;
    subscription.maxRetries = 3;
    subscription.updatedAt = new Date();
    await subscription.save();
    
    res.json({ success: true, enabled: subscription.enabled });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 手动签到 ============
app.post('/api/sign/manual', authMiddleware, async (req, res) => {
  try {
    const { attendancePassword } = req.body;
    const user = req.user;
    // 检查今天是否已签到成功
    const todayStart = new Date();
    todayStart.setHours(0, 0, 0, 0);
    const todayEnd = new Date();
    todayEnd.setHours(23, 59, 59, 999);
    
    const existingLog = await SignLog.findOne({
      userId: user._id,
      status: 'success',
      signTime: { $gte: todayStart, $lte: todayEnd }
    });
    
    if (existingLog) {
      return res.json({
        success: true,
        result: { success: true, message: '今天已签到，无需重复操作' }
      });
    }

    
    const signPassword = attendancePassword || user.attendancePassword || 'Ahgydx@920';
    const signTime = new Date();
    
    console.log(`🚀 手动签到: ${user.studentId}`);
    
    const signResult = await realSign(user.studentId, signPassword, 3);
    
    user.totalSignCount = (user.totalSignCount || 0) + 1;
    if (signResult.success) {
      user.successSignCount = (user.successSignCount || 0) + 1;
    }
    await user.save();
    
    const log = new SignLog({
      userId: user._id,
      subscriptionName: '手动签到',
      status: signResult.success ? 'success' : 'failed',
      message: signResult.message || JSON.stringify(signResult.errors || []),
      signTime: signTime
    });
    await log.save();
    
    if (user.isVip && user.emailVerified && user.email) {
      const now = new Date();
      if (user.vipExpireAt && user.vipExpireAt > now) {
        await sendSignNotification(user.email, user.studentId, signResult, '手动签到', signTime);
      }
    }
    
    res.json({
      success: true,
      result: {
        success: signResult.success,
        message: signResult.message,
        errors: signResult.errors || []
      }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 签到日志 ============
app.get('/api/sign/logs', authMiddleware, async (req, res) => {
  try {
    const { page = 1, limit = 20 } = req.query;
    const logs = await SignLog.find({ userId: req.user._id })
      .sort({ executedAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit));
    
    const total = await SignLog.countDocuments({ userId: req.user._id });
    res.json({ success: true, logs, total, page: parseInt(page) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 统计信息 ============
app.get('/api/stats', authMiddleware, async (req, res) => {
  try {
    const user = req.user;
    
    const today = new Date();
    today.setHours(0, 0, 0, 0);
    
    const todaySigns = await SignLog.countDocuments({ userId: user._id, executedAt: { $gte: today } });
    const todaySuccess = await SignLog.countDocuments({ userId: user._id, status: 'success', executedAt: { $gte: today } });
    const autoSignSetting = await Subscription.exists({ userId: user._id, enabled: true });
    const autoSignEnabled = !!autoSignSetting;
    
    res.json({
      success: true,
      stats: {
        totalSigns: user.totalSignCount || 0,
        successSigns: user.successSignCount || 0,
        todaySigns,
        todaySuccess,
        activeSubscriptions: autoSignEnabled ? 1 : 0,
        autoSignEnabled,
        isVip: user.isVip,
        vipExpireAt: user.vipExpireAt
      }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 留言反馈 API ============

// 提交留言
app.post('/api/feedback', authMiddleware, async (req, res) => {
  try {
    const { title, content, type } = req.body;
    const user = req.user;
    
    if (!title || !content) {
      return res.status(400).json({ success: false, message: '请填写标题和内容' });
    }
    
    const feedback = new Feedback({
      userId: user._id,
      title,
      content,
      type: type || 'other',
      status: 'pending'
    });
    
    await feedback.save();
    
    res.json({ success: true, feedback, message: '留言提交成功，我们会尽快回复！' });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 获取用户的留言列表
app.get('/api/feedback/my', authMiddleware, async (req, res) => {
  try {
    const feedbacks = await Feedback.find({ userId: req.user._id })
      .sort({ createdAt: -1 })
      .limit(50);
    
    res.json({ success: true, feedbacks });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 获取单条留言详情
app.get('/api/feedback/:id', authMiddleware, async (req, res) => {
  try {
    const feedback = await Feedback.findById(req.params.id);
    
    if (!feedback) {
      return res.status(404).json({ success: false, message: '留言不存在' });
    }
    
    // 检查权限：只能看自己的，管理员可以看所有
    if (feedback.userId.toString() !== req.user._id.toString() && req.user.role !== 'admin') {
      return res.status(403).json({ success: false, message: '无权查看' });
    }
    
    res.json({ success: true, feedback });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 管理员 API ============

// 系统统计
app.get('/api/admin/stats', adminMiddleware, async (req, res) => {
  try {
    const attendanceUserQuery = { isGuest: { $ne: true }, source: { $ne: 'market' }, studentId: { $not: /^guest_/ } };
    const marketUserQuery = {
      $or: [
        { source: 'market' },
        { isGuest: true },
        { studentId: /^guest_/ }
      ]
    };
    const totalUsers = await User.countDocuments(attendanceUserQuery);
    const vipUsers = await User.countDocuments({ isVip: true, isGuest: { $ne: true }, source: { $ne: 'market' } });
    const marketUsers = await User.countDocuments(marketUserQuery);
    const todayUsers = await User.countDocuments({
      ...attendanceUserQuery,
      createdAt: { $gte: new Date(new Date().setHours(0, 0, 0, 0)) }
    });
    
    const totalSigns = await SignLog.countDocuments();
    const todaySigns = await SignLog.countDocuments({ executedAt: { $gte: new Date(new Date().setHours(0, 0, 0, 0)) } });
    const successSigns = await SignLog.countDocuments({ status: 'success' });
    const todaySuccessSigns = await SignLog.countDocuments({ status: 'success', executedAt: { $gte: new Date(new Date().setHours(0, 0, 0, 0)) } });
    const successRate = todaySigns > 0 ? ((todaySuccessSigns / todaySigns) * 100).toFixed(1) : 0;
    
    const activeAutoSignUserIds = await Subscription.distinct('userId', { enabled: true });
    const activeAutoSignUsers = activeAutoSignUserIds.length;
    const totalInvites = await InviteLog.countDocuments();
    
    res.json({
      success: true,
      stats: {
        users: { total: totalUsers, attendance: totalUsers, market: marketUsers, vip: vipUsers, today: todayUsers },
        signs: { total: totalSigns, today: todaySigns, success: successSigns, successRate },
        subscriptions: { active: activeAutoSignUsers },
        autoSign: { users: activeAutoSignUsers },
        invites: { total: totalInvites }
      }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 获取系统配置
app.get('/api/admin/config', adminMiddleware, async (req, res) => {
  try {
    const configs = await SystemConfig.find();
    const configMap = {};
    configs.forEach(c => { configMap[c.key] = c.value; });
    res.json({ success: true, configs: configMap });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 更新系统配置
app.put('/api/admin/config/:key', adminMiddleware, async (req, res) => {
  try {
    const { key } = req.params;
    const { value } = req.body;

    let config = await SystemConfig.findOne({ key });
    if (!config) {
      config = new SystemConfig({ key, value });
    } else {
      config.value = value;
      config.updatedAt = new Date();
    }
    await config.save();

    // 🆕 如果更新的是 sponsor_notice，异步发送邮件给所有VIP
    if (key === 'sponsor_notice' && value && value.enabled) {
      // 异步执行，不阻塞响应
      sendSponsorEmailToAllVips(value).catch(err => console.error('群发赞助邮件失败:', err));
    }

    res.json({ success: true, config });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 用户列表
app.get('/api/admin/users', adminMiddleware, async (req, res) => {
  try {
    const { page = 1, limit = 20, search = '', showGuests = 'false', showMarket = 'false', scope = '' } = req.query;

    const conditions = [];
    if (scope === 'attendance') {
      conditions.push(
        { isGuest: { $ne: true } },
        { source: { $ne: 'market' } },
        { studentId: { $not: /^guest_/ } }
      );
    } else if (scope === 'market') {
      conditions.push({
        $or: [
          { source: 'market' },
          { isGuest: true },
          { studentId: /^guest_/ }
        ]
      });
    } else {
      if (showGuests !== 'true') {
        conditions.push({ isGuest: { $ne: true } });
      }
      if (showMarket !== 'true') {
        conditions.push({ source: { $ne: 'market' } });
      }
    }

    if (search) {
      conditions.push({
        $or: [
          { studentId: { $regex: search, $options: 'i' } },
          { name: { $regex: search, $options: 'i' } },
          { email: { $regex: search, $options: 'i' } }
        ]
      });
    }
    const query = conditions.length > 0 ? { $and: conditions } : {};
    
    
    const users = await User.find(query)
      .select('-__v -attendancePassword')
      .sort({ createdAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit));
    
    const total = await User.countDocuments(query);
    
    res.json({ success: true, users, total, page: parseInt(page) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 用户详情
app.get('/api/admin/users/:id', adminMiddleware, async (req, res) => {
  try {
    const user = await User.findById(req.params.id);
        // 从返回对象中删除敏感字段
    if (user) {
      user.attendancePassword = undefined;
    }
    if (!user) {
      return res.status(404).json({ success: false, message: '用户不存在' });
    }
    
    const autoSignSetting = await getAutoSignSetting(user._id);
    const subscriptions = autoSignSetting ? [formatAutoSignSetting(autoSignSetting)] : [];
    const logs = await SignLog.find({ userId: user._id }).sort({ executedAt: -1 }).limit(20);
    
    res.json({ success: true, user, subscriptions, logs });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 更新用户（管理员）
app.put('/api/admin/users/:id', adminMiddleware, async (req, res) => {
  try {
    const { name, email, attendancePassword, isVip, vipExpireAt, role, isActive } = req.body;

    const user = await User.findById(req.params.id);
    if (!user) {
      return res.status(404).json({ success: false, message: '用户不存在' });
    }

    // 记录旧的 VIP 状态和过期时间，用于判断是否需要发邮件
    const oldIsVip = user.isVip;
    const oldVipExpireAt = user.vipExpireAt ? new Date(user.vipExpireAt) : null;

    if (name !== undefined) user.name = name;
    if (email !== undefined) user.email = email;
    if (attendancePassword !== undefined) user.attendancePassword = attendancePassword;
    if (isVip !== undefined) user.isVip = isVip;
    if (vipExpireAt) user.vipExpireAt = new Date(vipExpireAt);
    if (role) user.role = role;
    if (isActive !== undefined) user.isActive = isActive;

    await user.save();

    // 🆕 判断是否需要发送 VIP 到账邮件
    // 条件：当前是 VIP 且（之前不是 VIP，或者过期时间比旧的时间更晚）
    const now = new Date();
    const newExpireAt = user.vipExpireAt ? new Date(user.vipExpireAt) : null;
    const isVipNow = user.isVip && newExpireAt && newExpireAt > now;

    let shouldSendEmail = false;
    let addedDays = 0;

    if (isVipNow) {
      if (!oldIsVip) {
        // 从非 VIP 变为 VIP
        shouldSendEmail = true;
        addedDays = Math.ceil((newExpireAt - now) / (1000 * 60 * 60 * 24));
      } else if (oldVipExpireAt && newExpireAt > oldVipExpireAt) {
        // VIP 天数增加（过期时间延后）
        shouldSendEmail = true;
        addedDays = Math.ceil((newExpireAt - oldVipExpireAt) / (1000 * 60 * 60 * 24));
      }
    }

    // 异步发送邮件，不阻塞响应
    if (shouldSendEmail && addedDays > 0) {
      sendVipGrantEmail(user, addedDays, user.vipExpireAt)
        .catch(err => console.error('发送 VIP 邮件失败:', err));
    }

    res.json({ success: true, user });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 删除用户
app.delete('/api/admin/users/:id', adminMiddleware, async (req, res) => {
  try {
    const userId = req.params.id;
    
    const user = await User.findById(userId);
    if (!user) {
      return res.status(404).json({ success: false, message: '用户不存在' });
    }
    
    if (user._id.toString() === req.user._id.toString()) {
      return res.status(400).json({ success: false, message: '不能删除自己的账号' });
    }
    
    await Subscription.deleteMany({ userId: user._id });
    await SignLog.deleteMany({ userId: user._id });
    await EmailCode.deleteMany({ userId: user._id });
    await InviteLog.deleteMany({ $or: [{ inviterId: user._id }, { inviteeId: user._id }] });
    await Feedback.deleteMany({ userId: user._id });
    
    await Card.updateMany(
      { usedBy: user._id }, 
      { $unset: { usedBy: '', usedAt: '' }, status: 'unused' }
    );
    
    await User.deleteOne({ _id: user._id });
    
    console.log(`✅ 管理员 ${req.user.studentId} 删除了用户 ${user.studentId}`);
    
    res.json({ success: true, message: '用户已删除' });
  } catch (error) {
    console.error('删除用户错误:', error);
    res.status(500).json({ success: false, message: error.message });
  }
});

// 管理员代签到
app.post('/api/admin/sign/:userId', adminMiddleware, async (req, res) => {
  try {
    const targetUserId = req.params.userId;
    const { attendancePassword } = req.body;
    
    const targetUser = await User.findById(targetUserId);
    if (!targetUser) {
      return res.status(404).json({ success: false, message: '用户不存在' });
    }
    
    const signPassword = attendancePassword || targetUser.attendancePassword || 'Ahgydx@920';
    const signTime = new Date();
    
    console.log(`🚀 管理员 ${req.user.studentId} 为 ${targetUser.studentId} 执行签到`);
    
    const signResult = await realSign(targetUser.studentId, signPassword, 3);
    
    targetUser.totalSignCount = (targetUser.totalSignCount || 0) + 1;
    if (signResult.success) {
      targetUser.successSignCount = (targetUser.successSignCount || 0) + 1;
    }
    await targetUser.save();
    
    const log = new SignLog({
      userId: targetUser._id,
      subscriptionName: `管理员代签 (by ${req.user.studentId})`,
      status: signResult.success ? 'success' : 'failed',
      message: signResult.message || '',
      signTime: signTime
    });
    await log.save();
    
    if (targetUser.isVip && targetUser.emailVerified && targetUser.email) {
      const now = new Date();
      if (targetUser.vipExpireAt && targetUser.vipExpireAt > now) {
        await sendSignNotification(
          targetUser.email, 
          targetUser.studentId, 
          signResult, 
          '管理员代签',
          signTime
        );
      }
    }
    
    res.json({
      success: true,
      result: {
        success: signResult.success,
        message: signResult.message,
        errors: signResult.errors || []
      }
    });
  } catch (error) {
    console.error('代签错误:', error);
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 支付 API ============
// 收款码图片地址
const PAY_QR_URLS = {
  wechat: 'https://login.agai.online/vxcode.png',   // 微信收款码
  alipay: 'https://login.agai.online/zfbcode.png'    // 支付宝收款码
};

// 默认收款码（兼容旧版）
const PAY_QR_URL = PAY_QR_URLS.wechat;

// ============ 生成唯一金额 ============
async function generateUniqueAmount(basePrice) {
  for (let i = 0; i < 10; i++) {
    const offset = parseFloat((Math.random() * 0.09 + 0.01).toFixed(2));
    const amount = parseFloat((basePrice + offset).toFixed(2));

    const exists = await PaymentOrder.findOne({
      amount,
      status: 'pending',
      createdAt: { $gt: new Date(Date.now() - 30 * 60 * 1000) }  // 30分钟内的待支付订单
    });

    if (!exists) return amount;
  }

  // 如果 10 次都没生成唯一金额，加一个时间戳后缀
  const timestamp = Date.now().toString().slice(-2);
  return parseFloat((basePrice + parseFloat('0.' + timestamp)).toFixed(2));
}
// 卡密套餐配置
const CARD_PACKAGES = [
  { days: 30, times: 0, cardCategory: 'days', price: 9.9, name: '30天VIP卡', description: '适合短期使用' },
  { days: 120, times: 0, cardCategory: 'days', price: 32.8, name: '一学期VIP卡', description: '性价比之选（上岸吧）' },
  { days: 365, times: 0, cardCategory: 'days', price: 53.2, name: '一学年VIP卡', description: '年度最划算（我上岸）' },
  { days: 0, times: 0, cardCategory: 'days', price: 0.01, name: '测试用勿拍', description: '仅测试' },
  // 如果以后需要次数卡，可以在这里追加
   { days: 0, times: 30, cardCategory: 'times', price: 19.9, name: '30次签到卡', description: '可签到30次，永久有效' },
   { days: 0, times: 10, cardCategory: 'times', price: 8.8, name: '10次签到卡', description: '可签到10次，永久有效' }
];


// 获取套餐列表
app.get('/api/payment/packages', authMiddleware, async (req, res) => {
  res.json({ success: true, packages: CARD_PACKAGES });
});

// 创建订单
app.post('/api/payment/create-order', authMiddleware, async (req, res) => {
  try {
    const { days, times, cardCategory, payMethod } = req.body;
    const user = req.user;
    
    // 根据类别查找套餐
    let pkg;
    if (cardCategory === 'times') {
      pkg = CARD_PACKAGES.find(p => p.times === parseInt(times) && p.cardCategory === 'times');
    } else {
      pkg = CARD_PACKAGES.find(p => p.days === parseInt(days) && p.cardCategory === 'days');
    }
    
    if (!pkg) {
      return res.status(400).json({ success: false, message: '无效的套餐' });
    }
    
    // 生成唯一金额
    const amount = await generateUniqueAmount(pkg.price);
    
    const orderNo = 'PAY' + Date.now() + Math.random().toString(36).substring(2, 8).toUpperCase();
    
    const order = new PaymentOrder({
      orderNo,
      userId: user._id,
      amount,
      days: pkg.days,
      times: pkg.times,
      cardCategory: pkg.cardCategory,
      payMethod: payMethod || 'wechat',
      status: 'pending',
      expireAt: new Date(Date.now() + 30 * 60 * 1000)  // 30分钟过期
    });
    await order.save();
    
    // 返回双收款码
    res.json({
      success: true,
      order: {
        orderNo: order.orderNo,
        amount: order.amount,
        days: order.days,
        times: order.times,
        cardCategory: order.cardCategory,
        payMethod: order.payMethod,
        expireAt: order.expireAt
      },
      qrCodes: {
        wechat: PAY_QR_URLS.wechat,
        alipay: PAY_QR_URLS.alipay
      }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// V免签心跳检测与配置验证
app.get('/api/payment/notify', (req, res) => {
  console.log('📡 收到V免签配置验证请求:', req.query);
  // 返回标准JSON响应
  res.json({ 
    code: 1, 
    msg: 'ok',
    data: {
      heartbeat: 'ok',
      time: new Date().toISOString()
    }
  });
});

// 接收支付通知（V免签回调）
app.post('/api/payment/notify', async (req, res) => {
  try {
    const { money, mark, sign } = req.body;
    
    // 验证签名（简化版，实际需要验证）
    const SECRET_KEY = process.env.PAYMENT_SECRET || 'my-secret-key-2024';
    const expectedSign = crypto.createHash('md5').update(money + mark + SECRET_KEY).digest('hex');
    
    // 这里先用简化验证，正式使用要严格验证
    console.log(`💰 收到支付通知: 金额=${money}, 备注=${mark}`);
    
    // 查找匹配的待支付订单
    const order = await PaymentOrder.findOne({
      amount: parseFloat(money),
      status: 'pending'
    }).sort({ createdAt: 1 });
    
    if (!order) {
      console.log('⚠️ 没有找到匹配的订单');
      return res.json({ code: 0, msg: '没有找到匹配的订单' });
    }
    
    // 生成卡密
    const code = 'VIP' + crypto.randomBytes(6).toString('hex').toUpperCase();
    const card = new Card({
      code,
      days: order.days,
      type: `vip_${order.days}d`,
      status: 'unused',
      createdAt: new Date()
    });
    await card.save();
    
    // 更新订单
    order.status = 'paid';
    order.paidAt = new Date();
    order.cardId = card._id;
    await order.save();
    
    // ========== WebSocket 实时推送 ==========
    const socketId = userSockets.get(order.userId.toString());
    if (socketId) {
      io.to(socketId).emit('paymentSuccess', {
        orderNo: order.orderNo,
        cardCode: code,
        amount: order.amount,
        days: order.days,
        times: order.times,
        cardCategory: order.cardCategory
      });
      console.log(`📡 WebSocket 推送支付成功: 用户=${order.userId}, 卡密=${code}`);
    }
    
    // 发送邮件通知用户（如果已绑定邮箱）
    const buyer = await User.findById(order.userId);
    if (buyer && buyer.email && buyer.emailVerified) {
      // 发送卡密邮件
      if (RESEND_API_KEY) {
        await fetch('https://api.resend.com/emails', {
          method: 'POST',
          headers: {
            'Authorization': `Bearer ${RESEND_API_KEY}`,
            'Content-Type': 'application/json'
          },
          body: JSON.stringify({
            from: 'AG工作室 <noreply@agai.online>',
            to: buyer.email,
            subject: '🎉 卡密购买成功 - AG工作室',
            html: `
              <div style="max-width: 450px; margin: 0 auto; padding: 20px; font-family: Arial, sans-serif;">
                <div style="text-align: center; margin-bottom: 24px;">
                  <h1 style="color: #667eea; margin: 0;">🎉 购买成功</h1>
                </div>
                <div style="background: #d4edda; padding: 20px; border-radius: 12px;">
                  <p style="margin: 0 0 15px 0;"><strong>订单号：</strong>${order.orderNo}</p>
                  <p style="margin: 0 0 15px 0;"><strong>套餐：</strong>${order.days}天VIP</p>
                  <p style="margin: 0 0 20px 0;"><strong>金额：</strong>¥${order.amount}</p>
                  <div style="background: #fff; padding: 15px; border-radius: 8px; text-align: center;">
                    <p style="margin: 0 0 10px 0;">您的卡密是：</p>
                    <div style="font-size: 28px; font-weight: bold; color: #667eea; letter-spacing: 3px;">${code}</div>
                  </div>
                </div>
                <p style="margin-top: 20px; color: #888; font-size: 13px; text-align: center;">
                  请前往 <a href="https://login.agai.online">AG工作室</a> 兑换使用
                </p>
              </div>
            `
          })
        }).catch(e => console.error('发送邮件失败:', e));
      }
    }
    
    console.log(`✅ 支付成功: 订单${order.orderNo}, 卡密${code}`);
    res.json({ code: 1, msg: '支付成功' });
    
  } catch (error) {
    console.error('支付回调错误:', error);
    res.json({ code: 0, msg: error.message });
  }
});

// 查询订单状态
app.get('/api/payment/order/:orderNo', authMiddleware, async (req, res) => {
  try {
    const order = await PaymentOrder.findOne({ 
      orderNo: req.params.orderNo,
      userId: req.user._id 
    });
    
    if (!order) {
      return res.status(404).json({ success: false, message: '订单不存在' });
    }
    
    res.json({
      success: true,
      order: {
        orderNo: order.orderNo,
        amount: order.amount,
        days: order.days,
        status: order.status,
        paidAt: order.paidAt
      },
      // 如果已支付，返回卡密
      cardCode: order.status === 'paid' && order.cardId ? 
        (await Card.findById(order.cardId))?.code : null
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 管理员一键签到 ============
app.post('/api/admin/trigger-sign', adminMiddleware, async (req, res) => {
  try {
    console.log(`🔔 管理员 ${req.user.studentId} 手动触发全员签到`);
    
    // 立即执行一次自动签到任务（异步，不阻塞响应）
    executeAutoSign().catch(err => console.error('手动签到任务错误:', err));
    
    res.json({
      success: true,
      message: '已触发全员签到任务，请查看日志了解执行情况'
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 管理员留言管理 API ============

// 获取所有留言（管理员）
app.get('/api/admin/feedback', adminMiddleware, async (req, res) => {
  try {
    const { page = 1, limit = 20, status, type } = req.query;
    
    const query = {};
    if (status) query.status = status;
    if (type) query.type = type;
    
    const feedbacks = await Feedback.find(query)
      .populate('userId', 'studentId name email')
      .populate('repliedBy', 'studentId name')
      .sort({ createdAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit));
    
    const total = await Feedback.countDocuments(query);
    
    const pendingCount = await Feedback.countDocuments({ status: 'pending' });
    const readCount = await Feedback.countDocuments({ status: 'read' });
    const repliedCount = await Feedback.countDocuments({ status: 'replied' });
    const closedCount = await Feedback.countDocuments({ status: 'closed' });
    
    res.json({ 
      success: true, 
      feedbacks, 
      total, 
      page: parseInt(page),
      stats: { pending: pendingCount, read: readCount, replied: repliedCount, closed: closedCount }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 回复留言（管理员）
app.put('/api/admin/feedback/:id/reply', adminMiddleware, async (req, res) => {
  try {
    const { reply } = req.body;
    const feedback = await Feedback.findById(req.params.id);
    
    if (!feedback) {
      return res.status(404).json({ success: false, message: '留言不存在' });
    }
    
    if (!reply) {
      return res.status(400).json({ success: false, message: '请输入回复内容' });
    }
    
    feedback.adminReply = reply;
    feedback.status = 'replied';
    feedback.repliedAt = new Date();
    feedback.repliedBy = req.user._id;
    feedback.updatedAt = new Date();
    
    await feedback.save();
    
    res.json({ success: true, feedback, message: '回复成功' });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 更新留言状态（管理员）
app.put('/api/admin/feedback/:id/status', adminMiddleware, async (req, res) => {
  try {
    const { status } = req.body;
    const feedback = await Feedback.findById(req.params.id);
    
    if (!feedback) {
      return res.status(404).json({ success: false, message: '留言不存在' });
    }
    
    feedback.status = status;
    feedback.updatedAt = new Date();
    await feedback.save();
    
    res.json({ success: true, feedback });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 删除留言（管理员）
app.delete('/api/admin/feedback/:id', adminMiddleware, async (req, res) => {
  try {
    const feedback = await Feedback.findByIdAndDelete(req.params.id);
    
    if (!feedback) {
      return res.status(404).json({ success: false, message: '留言不存在' });
    }
    
    res.json({ success: true, message: '留言已删除' });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 二手市场 API ============

// 获取商品列表
app.get('/api/market/items', async (req, res) => {
  try {
    const { page = 1, limit = 20, category, search, id, sort = 'latest', minPrice, maxPrice } = req.query;
    const safePage = clampNumber(page, 1, 100000, 1);
    const safeLimit = clampNumber(limit, 1, 50, 20);
    
    if (id) {
      const item = await MarketItem.findById(id).populate('userId', 'studentId name');
      if (!item || item.status === 'removed') return res.status(404).json({ success: false, message: '商品不存在' });
      item.views = (item.views || 0) + 1;
      await item.save();
      return res.json({ success: true, item, items: [item] });
    }
    
    const query = { status: 'active' };
    if (category && category !== 'all' && MARKET_CATEGORIES.includes(category)) query.category = category;
    const min = minPrice !== undefined ? normalizeMarketPrice(minPrice) : null;
    const max = maxPrice !== undefined ? normalizeMarketPrice(maxPrice) : null;
    if (min !== null || max !== null) {
      query.price = {};
      if (min !== null) query.price.$gte = min;
      if (max !== null) query.price.$lte = max;
    }
    if (search) {
      const regex = new RegExp(escapeRegExp(String(search).trim()).slice(0, 60), 'i');
      query.$or = [{ title: regex }, { description: regex }, { productNo: regex }];
    }
    const sortMap = {
      latest: { createdAt: -1 },
      priceAsc: { price: 1, createdAt: -1 },
      priceDesc: { price: -1, createdAt: -1 },
      popular: { views: -1, createdAt: -1 }
    };
    
    const items = await MarketItem.find(query)
      .select('-paymentQR')
      .populate('userId', 'studentId name')
      .sort(sortMap[sort] || sortMap.latest)
      .skip((safePage - 1) * safeLimit)
      .limit(safeLimit);
    
    const total = await MarketItem.countDocuments(query);
    res.json({ success: true, items, total, page: safePage, limit: safeLimit });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.get('/api/market/stats', async (req, res) => {
  try {
    const [activeItems, soldItems, activeSellers, completedOrders] = await Promise.all([
      MarketItem.countDocuments({ status: 'active' }),
      MarketItem.countDocuments({ status: 'sold' }),
      MarketItem.distinct('userId', { status: { $in: ['active', 'reserved', 'sold'] } }),
      MarketOrder.countDocuments({ status: 'completed' })
    ]);
    res.json({
      success: true,
      stats: {
        activeItems,
        soldItems,
        sellers: activeSellers.length,
        completedOrders
      }
    });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

//fa布商品
app.post('/api/market/items', authMiddleware, async (req, res) => {
  try {
    const { title, description, price, category, contact, images, paymentQR } = req.body;
    const cleanTitle = normalizeMarketText(title, 80);
    const cleanDescription = normalizeMarketText(description, 1000);
    const cleanPrice = normalizeMarketPrice(price);
    const cleanPaymentQR = normalizeQrImage(paymentQR || '');
    if (!cleanTitle || !cleanDescription || cleanPrice === null) {
      return res.status(400).json({ success: false, message: '请填写完整信息' });
    }
    // 生成商品专号：AG + 时间戳后6位 + 随机4位
    if (cleanPaymentQR === null) {
      return res.status(400).json({ success: false, message: '收款码图片无效或过大' });
    }
    const productNo = 'AG' + Date.now().toString(36).slice(-6).toUpperCase() + Math.random().toString(36).slice(2,6).toUpperCase();
    const item = new MarketItem({
      productNo,
      userId: req.user._id,
      title: cleanTitle,
      description: cleanDescription,
      price: cleanPrice,
      category: MARKET_CATEGORIES.includes(category) ? category : 'other',
      contact: normalizeMarketContact(contact),
      images: normalizeMarketImages(images),
      paymentQR: cleanPaymentQR,
      status: 'active'
    });
    await item.save();
    res.json({ success: true, item });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});


// 获取联系方式
app.get('/api/market/contact/:id', authMiddleware, async (req, res) => {
  try {
    const item = await MarketItem.findById(req.params.id);
    if (!item || item.status === 'removed') return res.status(404).json({ success: false, message: '商品不存在' });
    if (await hasMarketBlockBetween(req.user._id, item.userId)) {
      return res.status(403).json({ success: false, message: '双方暂不可联系' });
    }
    item.contactViews = (item.contactViews || 0) + 1;
    await item.save();
    res.json({ success: true, contact: item.contact });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 我的商品
app.get('/api/market/my', authMiddleware, async (req, res) => {
  try {
    const items = await MarketItem.find({ userId: req.user._id, status: { $ne: 'removed' } })
      .select('-paymentQR')
      .sort({ createdAt: -1 });
    res.json({ success: true, items });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 下架商品
app.delete('/api/market/items/:id', authMiddleware, async (req, res) => {
  try {
    const item = await MarketItem.findOne({ _id: req.params.id, userId: req.user._id });
    if (!item) return res.status(404).json({ success: false, message: '商品不存在' });
    const openOrder = await MarketOrder.exists({
      productId: item._id,
      status: { $in: ['pending', 'confirmed', 'shipped'] }
    });
    if (openOrder) {
      return res.status(400).json({ success: false, message: '商品正在交易中，请先处理订单' });
    }
    item.status = 'removed';
    item.updatedAt = new Date();
    await item.save();
    await Promise.all([
      Cart.deleteMany({ productId: item._id }),
      Favorite.deleteMany({ productId: item._id })
    ]);
    res.json({ success: true });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 收藏功能 ============

// 收藏/取消收藏
app.post('/api/market/favorite', authMiddleware, async (req, res) => {
  try {
    const { productId } = req.body;
    const item = await MarketItem.findOne({ _id: productId, status: 'active' });
    if (!item) return res.status(404).json({ success: false, message: '商品不存在或已下架' });
    if (item.userId.toString() === req.user._id.toString()) {
      return res.status(400).json({ success: false, message: '不能收藏自己的商品' });
    }
    const existing = await Favorite.findOne({ userId: req.user._id, productId });
    if (existing) {
      await Favorite.deleteOne({ _id: existing._id });
      return res.json({ success: true, favorited: false });
    }
    await Favorite.create({ userId: req.user._id, productId });
    res.json({ success: true, favorited: true });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 获取收藏列表
app.get('/api/market/favorite', authMiddleware, async (req, res) => {
  try {
    const favorites = await Favorite.find({ userId: req.user._id }).populate({
      path: 'productId',
      match: { status: 'active' },
      select: '-paymentQR',
      populate: { path: 'userId', select: 'studentId name' }
    });
    const items = favorites.filter(f => f.productId).map(f => f.productId);
    res.json({ success: true, items });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 聊天功能 ============

// 创建聊天室
app.post('/api/market/chat/create', authMiddleware, async (req, res) => {
  try {
    const { productId, sellerId: requestedSellerId, buyerId: requestedBuyerId } = req.body;
    const item = await MarketItem.findOne({ _id: productId, status: { $ne: 'removed' } });
    if (!item) return res.status(404).json({ success: false, message: '商品不存在或已下架' });
    const sellerId = item.userId;
    if (requestedSellerId && requestedSellerId !== sellerId.toString()) {
      return res.status(400).json({ success: false, message: '卖家信息与商品不匹配' });
    }
    let buyerId = req.user._id;

    if (sellerId.toString() === req.user._id.toString()) {
      if (!requestedBuyerId) return res.status(400).json({ success: false, message: '请指定买家' });
      const buyer = await User.findById(requestedBuyerId).select('_id');
      if (!buyer) return res.status(404).json({ success: false, message: '买家不存在' });
      buyerId = buyer._id;
    }

    if (buyerId.toString() === sellerId.toString()) return res.status(400).json({ success: false, message: '不能和自己聊天' });
    if (await hasMarketBlockBetween(buyerId, sellerId)) {
      return res.status(403).json({ success: false, message: '双方暂不可聊天' });
    }
    
    let room = await ChatRoom.findOne({ productId, buyerId, sellerId });
    if (!room) {
      room = await ChatRoom.create({ productId, buyerId, sellerId });
    }
    res.json({ success: true, roomId: room._id });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 聊天列表
app.get('/api/market/chat/list', authMiddleware, async (req, res) => {
  try {
    const rooms = await ChatRoom.find({
      $or: [{ buyerId: req.user._id }, { sellerId: req.user._id }]
    })
    .populate('productId', 'title')
    .populate('buyerId', 'studentId name')
    .populate('sellerId', 'studentId name')
    .sort({ lastMessageAt: -1 });
    
    const result = rooms.map(room => ({
      _id: room._id,
      productId: room.productId?._id,
      productTitle: room.productId?.title || '已删除',
      otherUser: room.buyerId._id.toString() === req.user._id.toString() ? room.sellerId : room.buyerId,
      lastMessage: room.lastMessage,
      lastMessageAt: room.lastMessageAt
    }));
    res.json({ success: true, rooms: result });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 获取消息
app.get('/api/market/chat/messages', authMiddleware, async (req, res) => {
  try {
    const { roomId } = req.query;
    const room = await ChatRoom.findById(roomId);
    if (!room || (room.buyerId.toString() !== req.user._id.toString() && room.sellerId.toString() !== req.user._id.toString())) {
      return res.status(403).json({ success: false, message: '无权查看该会话' });
    }
    const messages = await Message.find({ roomId }).sort({ createdAt: 1 }).limit(100);
    res.json({ success: true, messages });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 发送消息
app.post('/api/market/chat/send', authMiddleware, async (req, res) => {
  try {
    const { roomId, content } = req.body;
    const cleanContent = normalizeMarketText(content, 500);
    if (!cleanContent) return res.status(400).json({ success: false, message: '请输入内容' });
    const room = await ChatRoom.findById(roomId);
    if (!room || (room.buyerId.toString() !== req.user._id.toString() && room.sellerId.toString() !== req.user._id.toString())) {
      return res.status(403).json({ success: false, message: '无权发送消息' });
    }
    if (await hasMarketBlockBetween(room.buyerId, room.sellerId)) {
      return res.status(403).json({ success: false, message: '双方暂不可聊天' });
    }
    
    const message = await Message.create({
      roomId,
      senderId: req.user._id,
      content: cleanContent
    });
    
    await ChatRoom.findByIdAndUpdate(roomId, {
      lastMessage: cleanContent,
      lastMessageAt: new Date()
    });

    const receiverId = room.buyerId.toString() === req.user._id.toString() ? room.sellerId : room.buyerId;
    const receiverSocket = userSockets.get(receiverId.toString());
    if (receiverSocket) {
      io.to(receiverSocket).emit('newMessage', {
        roomId,
        _id: message._id,
        senderId: req.user._id,
        content: cleanContent,
        createdAt: message.createdAt
      });
    }
    
    res.json({ success: true, message });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});


// ============ 举报与拉黑 API ============

// 举报用户
app.post('/api/market/report', authMiddleware, async (req, res) => {
  try {
    const { userId, reason, productId } = req.body;
    const cleanReason = normalizeMarketText(reason, 300);
    if (!userId || !cleanReason) {
      return res.status(400).json({ success: false, message: '请填写举报原因' });
    }
    if (userId === req.user._id.toString()) {
      return res.status(400).json({ success: false, message: '不能举报自己' });
    }
    
    const targetUser = await User.findById(userId).select('_id');
    if (!targetUser) {
      return res.status(404).json({ success: false, message: '被举报用户不存在' });
    }

    const report = new Report({
      reporterId: req.user._id,
      targetUserId: userId,
      productId: productId || null,
      reason: cleanReason,
      status: 'pending'
    });
    await report.save();
    
    res.json({ success: true, message: '举报已提交，我们会尽快处理' });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 拉黑用户
app.post('/api/market/block', authMiddleware, async (req, res) => {
  try {
    const { userId } = req.body;
    if (!userId) return res.status(400).json({ success: false, message: '请指定用户' });
    if (userId === req.user._id.toString()) return res.status(400).json({ success: false, message: '不能拉黑自己' });
    
    const targetUser = await User.findById(userId).select('_id');
    if (!targetUser) return res.status(404).json({ success: false, message: '用户不存在' });

    const existing = await Block.findOne({ userId: req.user._id, blockedUserId: userId });
    if (existing) {
      await Block.deleteOne({ _id: existing._id });
      return res.json({ success: true, blocked: false, message: '已取消拉黑' });
    }
    
    await Block.create({ userId: req.user._id, blockedUserId: userId });
    res.json({ success: true, blocked: true, message: '已拉黑用户' });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});


// ============ 购物车 API ============
// 加入购物车
app.post('/api/market/cart', authMiddleware, async (req, res) => {
  try {
    const { productId } = req.body;
    const item = await MarketItem.findOne({ _id: productId, status: 'active' });
    if (!item) return res.status(404).json({ success: false, message: '商品不存在或已下架' });
    if (item.userId.toString() === req.user._id.toString()) {
      return res.status(400).json({ success: false, message: '不能加购自己的商品' });
    }
    if (await hasMarketBlockBetween(req.user._id, item.userId)) {
      return res.status(403).json({ success: false, message: '双方暂不可交易' });
    }
    const existing = await Cart.findOne({ userId: req.user._id, productId });
    if (existing) return res.json({ success: false, message: '已在购物车中' });
    await Cart.create({ userId: req.user._id, productId });
    res.json({ success: true, message: '已加入购物车' });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// 查看我的购物车
app.get('/api/market/cart', authMiddleware, async (req, res) => {
  try {
    const cartItems = await Cart.find({ userId: req.user._id })
      .populate({ path: 'productId', populate: { path: 'userId', select: 'studentId name' } });
    const items = cartItems.filter(c => c.productId && c.productId.status === 'active').map(c => c.productId);
    res.json({ success: true, items });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// 从购物车移除
app.delete('/api/market/cart/:productId', authMiddleware, async (req, res) => {
  try {
    await Cart.deleteOne({ userId: req.user._id, productId: req.params.productId });
    res.json({ success: true });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// 卖家查看谁加购了自己的商品
app.get('/api/market/cart/seller', authMiddleware, async (req, res) => {
  try {
    const myProducts = await MarketItem.find({ userId: req.user._id, status: 'active' }).select('_id productNo title');
    const productIds = myProducts.map(p => p._id);
    const cartEntries = await Cart.find({ productId: { $in: productIds } })
      .populate('userId', 'studentId name')
      .populate('productId', 'productNo title price');
    res.json({ success: true, cartEntries });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// ============ 二手订单 API ============
// 创建订单（含收货地址）
app.post('/api/market/orders', authMiddleware, async (req, res) => {
  try {
    const { productId, address } = req.body;
    const cleanAddress = {
      name: normalizeMarketText(address?.name, 40),
      phone: normalizeMarketText(address?.phone, 30),
      detail: normalizeMarketText(address?.detail, 300)
    };
    if (!cleanAddress.name || !cleanAddress.phone || !cleanAddress.detail) {
      return res.status(400).json({ success: false, message: '请填写完整收货信息' });
    }
    const item = await MarketItem.findOneAndUpdate(
      { _id: productId, status: 'active' },
      { status: 'reserved', updatedAt: new Date() },
      { new: true }
    );
    if (!item) return res.status(404).json({ success: false, message: '商品不存在、已下架或正在交易中' });
    if (item.userId.toString() === req.user._id.toString()) {
      await MarketItem.updateOne({ _id: item._id }, { status: 'active', updatedAt: new Date() });
      return res.status(400).json({ success: false, message: '不能购买自己的商品' });
    }
    if (await hasMarketBlockBetween(req.user._id, item.userId)) {
      await MarketItem.updateOne({ _id: item._id }, { status: 'active', updatedAt: new Date() });
      return res.status(403).json({ success: false, message: '双方暂不可交易' });
    }
    const orderNo = 'ORD' + Date.now().toString(36).toUpperCase() + Math.random().toString(36).slice(2,6).toUpperCase();
    let order;
    try {
      order = await MarketOrder.create({
        orderNo, buyerId: req.user._id, sellerId: item.userId, productId,
        productNo: item.productNo, title: item.title, price: item.price,
        address: cleanAddress, status: 'pending'
      });
    } catch (error) {
      await MarketItem.updateOne({ _id: item._id }, { status: 'active', updatedAt: new Date() });
      throw error;
    }
    await Cart.deleteOne({ userId: req.user._id, productId });
    const sellerSocket = userSockets.get(item.userId.toString());
    if (sellerSocket) {
      io.to(sellerSocket).emit('marketOrderCreated', {
        orderId: order._id,
        orderNo: order.orderNo,
        title: order.title,
        price: order.price
      });
    }
    res.json({ success: true, order });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// 买家查看我的订单
app.get('/api/market/orders/buyer', authMiddleware, async (req, res) => {
  try {
    const orders = await MarketOrder.find({ buyerId: req.user._id })
      .populate('sellerId', 'studentId name').sort({ createdAt: -1 });
    res.json({ success: true, orders });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// 卖家查看订单
app.get('/api/market/orders/seller', authMiddleware, async (req, res) => {
  try {
    const orders = await MarketOrder.find({ sellerId: req.user._id })
      .populate('buyerId', 'studentId name').sort({ createdAt: -1 });
    res.json({ success: true, orders });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// 买卖双方更新订单状态
app.put('/api/market/orders/:id', authMiddleware, async (req, res) => {
  try {
    const { status } = req.body;
    if (!MARKET_ORDER_STATUS.includes(status)) {
      return res.status(400).json({ success: false, message: '无效的订单状态' });
    }
    const order = await MarketOrder.findOne({
      _id: req.params.id,
      $or: [{ sellerId: req.user._id }, { buyerId: req.user._id }]
    });
    if (!order) return res.status(404).json({ success: false, message: '订单不存在' });
    const isSeller = order.sellerId.toString() === req.user._id.toString();
    const isBuyer = order.buyerId.toString() === req.user._id.toString();
    const sellerNext = {
      pending: ['confirmed', 'cancelled'],
      confirmed: ['shipped', 'cancelled']
    };
    const buyerNext = {
      pending: ['cancelled'],
      shipped: ['completed']
    };
    const allowed = isSeller ? sellerNext[order.status] : (isBuyer ? buyerNext[order.status] : []);
    if (!allowed?.includes(status)) {
      return res.status(400).json({ success: false, message: '当前订单状态不能这样变更' });
    }
    order.status = status;
    order.updatedAt = new Date();
    await order.save();
    if (status === 'cancelled') {
      await releaseMarketItemIfNoOpenOrders(order.productId);
    } else if (status === 'completed') {
      await MarketItem.updateOne({ _id: order.productId }, { status: 'sold', updatedAt: new Date() });
      await Cart.deleteMany({ productId: order.productId });
    }
    const notifyUserId = isSeller ? order.buyerId : order.sellerId;
    const notifySocket = userSockets.get(notifyUserId.toString());
    if (notifySocket) {
      io.to(notifySocket).emit('marketOrderUpdated', {
        orderId: order._id,
        orderNo: order.orderNo,
        status: order.status
      });
    }
    res.json({ success: true, order });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// ============ 收款码 API ============
// 上传收款码
app.post('/api/user/payqr', authMiddleware, async (req, res) => {
  try {
    const { wechat, alipay } = req.body;
    const update = {};
    if (wechat !== undefined) {
      const normalized = normalizeQrImage(wechat);
      if (normalized === null) return res.status(400).json({ success: false, message: '微信收款码图片无效或过大' });
      update['payQR.wechat'] = normalized;
    }
    if (alipay !== undefined) {
      const normalized = normalizeQrImage(alipay);
      if (normalized === null) return res.status(400).json({ success: false, message: '支付宝收款码图片无效或过大' });
      update['payQR.alipay'] = normalized;
    }
    await User.findByIdAndUpdate(req.user._id, update);
    res.json({ success: true, message: '收款码已更新' });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// 获取卖家收款码
app.get('/api/user/payqr/:userId', async (req, res) => {
  try {
    const user = await User.findById(req.params.userId).select('payQR name studentId');
    if (!user) return res.status(404).json({ success: false, message: '用户不存在' });
    res.json({ success: true, payQR: user.payQR || { wechat: '', alipay: '' }, name: user.name });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// ============ 管理员订单管理 ============
app.get('/api/admin/orders', adminMiddleware, async (req, res) => {
  try {
    const { page = 1, limit = 20, status } = req.query;
    const query = {};
    if (status) query.status = status;
    const orders = await MarketOrder.find(query)
      .populate('buyerId', 'studentId name')
      .populate('sellerId', 'studentId name')
      .sort({ createdAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit));
    const total = await MarketOrder.countDocuments(query);
    res.json({ success: true, orders, total, page: parseInt(page) });
  } catch (error) { res.status(500).json({ success: false, message: error.message }); }
});

// ============ 管理员商品管理 ============
app.get('/api/admin/market-items', adminMiddleware, async (req, res) => {
  try {
    const { page = 1, limit = 20, status = '' } = req.query;
    const query = {};
    if (status) query.status = status;
    const items = await MarketItem.find(query)
      .populate('userId', 'studentId name')
      .sort({ createdAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit));
    const total = await MarketItem.countDocuments(query);
    res.json({ success: true, items, total, page: parseInt(page) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.delete('/api/admin/market-items/:id', adminMiddleware, async (req, res) => {
  try {
    const item = await MarketItem.findById(req.params.id);
    if (!item) return res.status(404).json({ success: false, message: '商品不存在' });
    item.status = 'removed';
    await item.save();
    res.json({ success: true, message: '商品已下架' });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 管理员获取举报列表
app.get('/api/admin/reports', adminMiddleware, async (req, res) => {
  try {
    const { page = 1, limit = 20, status } = req.query;
    const query = {};
    if (status) query.status = status;
    
    const reports = await Report.find(query)
      .populate('reporterId', 'studentId name')
      .populate('targetUserId', 'studentId name')
      .populate('productId', 'title')
      .sort({ createdAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit));
    
    const total = await Report.countDocuments(query);
    const pendingCount = await Report.countDocuments({ status: 'pending' });
    
    res.json({ success: true, reports, total, page: parseInt(page), pendingCount });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// 管理员处理举报
app.put('/api/admin/reports/:id', adminMiddleware, async (req, res) => {
  try {
    const { status } = req.body;
    if (!['pending', 'handled', 'dismissed'].includes(status)) {
      return res.status(400).json({ success: false, message: '无效的举报状态' });
    }
    const report = await Report.findByIdAndUpdate(req.params.id, { status }, { new: true });
    if (!report) return res.status(404).json({ success: false, message: '举报不存在' });
    res.json({ success: true, report });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

// ============ 卡密管理 ============

app.post('/api/admin/cards/generate', adminMiddleware, async (req, res) => {
  try {
    const { count = 10, days = 30 } = req.body;
    
    const cards = [];
    for (let i = 0; i < count; i++) {
      const code = 'VIP' + crypto.randomBytes(6).toString('hex').toUpperCase();
      cards.push({ code, days, type: `vip_${days}d` });
    }
    
    await Card.insertMany(cards);
    
    res.json({ success: true, cards, message: `成功生成 ${count} 张卡密` });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.get('/api/admin/cards', adminMiddleware, async (req, res) => {
  try {
    const { page = 1, limit = 50, status } = req.query;
    
    const query = status ? { status } : {};
    
    const cards = await Card.find(query)
      .sort({ createdAt: -1 })
      .skip((page - 1) * limit)
      .limit(parseInt(limit))
      .populate('usedBy', 'studentId name');
    
    const total = await Card.countDocuments(query);
    const unusedCount = await Card.countDocuments({ status: 'unused' });
    const usedCount = await Card.countDocuments({ status: 'used' });
    
    res.json({ success: true, cards, total, unusedCount, usedCount, page: parseInt(page) });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.get('/api/admin/cards/export', adminMiddleware, async (req, res) => {
  try {
    const cards = await Card.find({ status: 'unused' }).select('code days');
    const text = cards.map(c => `${c.code} - ${c.days}天`).join('\n');
    
    res.setHeader('Content-Type', 'text/plain');
    res.setHeader('Content-Disposition', 'attachment; filename="vip_cards.txt"');
    res.send(text);
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});


// ============ 管理员群发邮件 ============
app.post('/api/admin/send-bulk-email', adminMiddleware, async (req, res) => {
  try {
    const { subject, content, recipients, filterGuest } = req.body;
    if (!RESEND_API_KEY) return res.status(400).json({ success: false, message: '邮件服务未配置' });
    if (!subject || !content) return res.status(400).json({ success: false, message: '请填写主题和内容' });

    let query = { email: { $ne: null, $ne: '' }, emailVerified: true };
    if (recipients === 'vip') query.isVip = true;
    else if (recipients === 'nonVip') query.isVip = { $ne: true };
    if (filterGuest === true) query.isGuest = { $ne: true };

    const users = await User.find(query).select('email studentId name');
    if (users.length === 0) return res.json({ success: false, message: '没有符合条件的收件人' });

    let successCount = 0, failCount = 0;
    for (const user of users) {
      try {
        const response = await fetch('https://api.resend.com/emails', {
          method: 'POST',
          headers: { 'Authorization': `Bearer ${RESEND_API_KEY}`, 'Content-Type': 'application/json' },
          body: JSON.stringify({
            from: 'AG工作室 <noreply@agai.online>',
            to: user.email,
            subject: subject,
            html: `<div style="max-width:500px;margin:0 auto;padding:20px;font-family:Arial,sans-serif;"><h2 style="color:#667eea;">📋 AG工作室</h2><div style="background:#f8f9fc;padding:20px;border-radius:12px;">${content.replace(/\n/g, '<br>')}</div><p style="color:#888;margin-top:20px;text-align:center;">此邮件由管理员发送</p></div>`
          })
        });
        if (response.ok) successCount++; else failCount++;
      } catch (e) { failCount++; }
      await new Promise(r => setTimeout(r, 500));
    }
    res.json({ success: true, message: `发送完成：成功 ${successCount}，失败 ${failCount}` });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});

app.get('/api/admin/email-recipients-count', adminMiddleware, async (req, res) => {
  try {
    const all = await User.countDocuments({ email: { $ne: null, $ne: '' }, emailVerified: true });
    const total = await User.countDocuments({ email: { $ne: null, $ne: '' }, emailVerified: true, isGuest: { $ne: true } });
    const vip = await User.countDocuments({ email: { $ne: null, $ne: '' }, emailVerified: true, isVip: true });
    res.json({ success: true, total, vip, all });
  } catch (error) {
    res.status(500).json({ success: false, message: error.message });
  }
});


// ============ 定时任务 ============
cron.schedule('25 21 * * *', executeAutoSign, { timezone: "Asia/Shanghai" });
//cron.schedule('30 21 * * *', executeAutoSign, { timezone: "Asia/Shanghai" });

// ============ 启动服务 ============
const PORT = process.env.PORT || 8080;

initSystemConfig().then(() => {
  // 使用 server.listen 而不是 app.listen（支持 WebSocket）
  server.listen(PORT, '0.0.0.0', () => {
    console.log(`🚀 服务器运行在端口 ${PORT}`);
    console.log(`📍 版本: 3.6.0 (V免签升级 + WebSocket实时推送)`);
    console.log(`📧 邮件服务: ${RESEND_API_KEY ? 'Resend 已配置' : '未配置'}`);
    console.log(`🤖 自动签到已启用 (每天 21:25)`);
    console.log(`🔌 WebSocket 已启用`);
  });
});