xiaoshu-app/scripts/deploy-admin-functions.mjs

#!/usr/bin/env node

const APP_ID = process.env.XIAOSHU_PARSE_APP_ID || '7pIbDBJmKx_main';
const MASTER_KEY = process.env.XIAOSHU_MASTER_KEY || '';
const PARSE_URL = (process.env.XIAOSHU_PARSE_URL || 'https://server.xiaoshu.pro/parse').replace(/\/$/, '');
const validateOnly = process.argv.includes('--validate');

const adminGatewayCode = String.raw`
const CLASS_LABELS = {
  _User: '用户管理', Company: '帐套管理', Profile: '员工档案', Group: '用户组', Role: '角色', Permission: '权限', Department: '组织部门',
  CourseBinding: '课程绑定', CourseAppointment: '课程预约', LessonRecord: '上课记录', DailyStudyRecord: '每日学习记录', PracticeRecord: '练习记录', MemoryPracticeRecord: '抗遗忘记录',
  VocabularyWord: '词库', CommonModel: '通用内容', ContentArticle: '文章内容', ContentPublish: '报刊内容', Node: '栏目节点', NodeAuth: '节点权限', Model: '内容模型', ModelField: '模型字段', PublishNode: '报刊发布节点',
  ExamClass: '试题分类', ExamSysQuestions: '考试题库', ExamSysPapers: '考试试卷', ExamType: '考试类型', ExamPoint: '知识点', PaperQuestions: '试卷大题分组',
  Datadiccategory: '数据字典分类', Datadic: '数据字典项',
  GradeCate: '多级字典分类', Grade: '多级字典选项',
  Currency: '货币管理', SysHoliday: '节假日管理',
  Product: '商品', StoreProduct: '门店商品', StoreApplication: '门店申请', ShopFareTlp: '商城运费模板', ShopMoneyRegular: '金额规则', PayPlat: '支付平台',
  GuestBar: '互动社区', Guestbook: '留言', Guestcate: '留言分类', Feedback: '反馈', Baike: '百科审核', Pub: '互动模块定义', PubTw: '提问互动提交', PubWTHD: '问题回答提交', PubZXDC: '在线调查提交', Role: '系统角色', ARoleAuth: '角色权限', Search: '后台快捷入口', AdZone: '广告位管理', AdInfo: '广告内容管理', FontPicShape: '字体图形素材', FontPicShapeType: '字体图形分类', DesignAsk: '问卷调查', DesignQuestion: '问卷题目', DesignAnswer: '问卷答卷', DesignRes: '可视化设计资源', ServiceSeat: '客服席位', Temp: '客服欢迎语', StoreApplication: '店铺管理', StoreStyle: '店铺样式', PageStyle: '黄页样式', PlatComp: '协同办公企业', ContentTagKey: '内容标签词库', UserLevel: '积分等级', UserMoneyLog: '资金积分流水', UserPromotion: '用户推广关系', CRMSAttr: 'CRM 客户类型', SysLog: '系统日志', MisType: 'OA 流程类型', Agency: '代理机构', DeliveryCenter: '交付中心'
};
const ALLOWED_CLASSES = new Set([
  'PageTemplate','PaperQuestions','PayPlat','Permission','PlatComp','App','DesignAnswer','DesignAsk','Attachment','DesignPage','DesignQuestion','DesignRes','Feedback','DesignScence','StudentAchieve','ContentArticle','DesignSiteInfo','Profile','AdInfo','AdZone','ARoleAuth','Baike','ExamSysQuestions','ContactInfo','VocabularyWord','AssessmentProfile','Agency','MemoryPracticeRecord','DeliveryCenter','CourseBinding','PracticeRecord','CourseAppointment','Account','SurveyItem','SurveyLog','LessonRecord','DailyStudyRecord','CommonModel','ContentPublish','Company','_Role','_User','CRMSAttr','Currency','Datadic','Datadiccategory','DesignTlp','DocModel','DocPermission','ExamClass','ExamSysPapers','ExamType','ExamPoint','ExTeacher','FontPicShape','FontPicShapeType','Grade','GradeCate','Group','GroupModel','GuestBar','Guestbook','Guestcate','MailTemp','Manager','MisProcedure','MisProLevel','MisSign','MisType','PageStyle','Model','ModelField','Node','NodeAuth','NodeModelTemplate','Product','PlatUserRole','Pub','PubTw','PubWTHD','PubZXDC','PublishNode','QuestionsKnowledge','Role','StoreProduct','SafeMobile','Search','SenTask','ServiceSeat','ShopFareTlp','ShopMoneyRegular','Special','StoreApplication','StoreStyle','SysCSSManage','SysHoliday','SysLog','Temp','ThirdPlatInfo','UserCredit','UserDummyPoint','UserFriendGroup','UserLevel','UserMoneyLog','UserPromotion','UserSIcon','UserUserPoint','UserExpDomP','UserExpHis'
]);
const READ_ONLY_CLASSES = new Set(['_Role','Permission','ARoleAuth','PayPlat','ThirdPlatInfo','GuestBar','DesignAnswer','Baike','ExamSysPapers','ExamSysQuestions','PaperQuestions','ExamType','ContentPublish','PublishNode','SysLog','Pub','PubTw','PubWTHD','PubZXDC']);
const SYSTEM_FIELDS = new Set(['objectId','createdAt','updatedAt','ACL','company','password','authData','sessionToken','legacyPasswordHash','legacyPasswordHashType','appPassword','newapiToken','fmodeApiToken','useMasterKey','adminPassword','randNumber','adminRoleKey','isAdmin','roles','role','isDisabled','legacyUserId','legacyGroupId','legacyUserData','legacyUserPlat','groupId']);
const HIDDEN_FIELDS = new Set(['password','authData','sessionToken','legacyPasswordHash','legacyPasswordHashType','appPassword','newapiToken','fmodeApiToken','useMasterKey','adminPassword','randNumber','apiKey','appSecret','secret','token']);
const GENERIC_WRITE_TYPES = new Set(['String','Number','Boolean','Date','Pointer','Object','Array']);
const CLASS_SYSTEM_FIELDS = {
  CommonModel: new Set(['generalId','modelId','nodeId','itemId','tableName','status','isDeleted','sourceKey','orderId']),
  Node: new Set(['nodeId','parentId','depth','child','orderId','zstatus','sourceKey','cuser','cuname','editDate']),
  Special: new Set(['specId','pid','orderId','sourceKey','cuser','editDate']),
  Model: new Set(['modelId','modelType','tableName','sourceKey','nodeId','fromModel','multiFlag','sysModel']),
  ModelField: new Set(['fieldId','modelId','fieldName','fieldType','sourceKey','sysType','orderId']),
  Guestbook: new Set(['gid','parentid','cateid','userid','status','sourceKey','gdate','ip']),
  Guestcate: new Set(['cateid','parentId','gtype','sourceKey','orderId']),
  GuestBar: new Set(['id','cateId','pid','replyId','replyUserId','cuser','cuname','cdate','status','sourceKey','orderFlag','postFlag']),
  ExamClass: new Set(['cId','cClassid','cOrderBy','cClassType','sourceKey']),
  ExamPoint: new Set(['id','tid','orderBy','addUser','addTime','sourceKey']),
  QuestionsKnowledge: new Set(['kId','kClassId','kOrderBy','pid','cuser','cdate','sourceKey']),
  ExTeacher: new Set(['id','tclsss','addUser','creatTime','sourceKey']),
  Datadiccategory: new Set(['diccateid','sourceKey']),
  Datadic: new Set(['dicid','diccate','sourceKey']),
  GradeCate: new Set(['cateId','sourceKey']),
  Grade: new Set(['gradeId','cate','parentId','grade','sourceKey']),
  Currency: new Set(['id','sourceKey']),
  SysHoliday: new Set(['id','cdate','cadminId','cuserId','sourceKey']),
  Search: new Set(['id','type','state','time','adminId','orderId','linkType','linkState','sourceKey']),
  AdZone: new Set(['id','cdate','cadmin','image','sourceKey']),
  AdInfo: new Set(['id','cdate','zoneId','ztype','extend1','extend2','extend3','sourceKey']),
  FontPicShape: new Set(['id','shape','typeId','userId','userName','sourceKey','createTime','updateTime']),
  FontPicShapeType: new Set(['id','sourceKey','createTime','updateTime']),
  DesignAsk: new Set(['id','cdate','cuser','adminId','sourceKey']),
  DesignQuestion: new Set(['id','askId','cdate','cuser','orderId','sourceKey']),
  DesignAnswer: new Set(['id','askId','ip','cdate','userId','sourceKey']),
  DesignRes: new Set(['id','vpath','previewimg','cdate','userid','sourceKey']),
  Role: new Set(['roleId','ztype','zstatus','nodeId','auth','auth2','auth3','cadminId','cdate','sourceKey']),
  ARoleAuth: new Set(['id','rid','adminId','sourceKey']),
  ServiceSeat: new Set(['sId','sAdminId','sRemrk','sDateTime','sourceKey']),
  Temp: new Set(['id','useType','str3','str5','str6','describe','cdate','userId','sourceKey']),
  StoreApplication: new Set(['id','userId','userName','addTime','storeState','storeCommendState','storeModelId','sourceKey']),
  StoreStyle: new Set(['id','cdate','zstatus','sourceKey']),
  UserLevel: new Set(['id','cdate','ztype','addon1','addon2','addon3','addon4','addon5','orderId','storeId','zstatus','sourceKey','discountRate']),
  CRMSAttr: new Set(['id','ztype','cdate','zstatus','value2','value3','sourceKey']),
  ShopFareTlp: new Set(['id','cdate','userId','adminId','isFree','regionBan','ems','mail','sourceKey']),
  MisType: new Set(['id','createTime','sourceKey']),
  PageStyle: new Set(['pageNodeid','addtime','sourceKey']),
  PlatComp: new Set(['id','createUser','status','uppath','sourceKey'])
};
const USER_MONEY_LOG_CLASSES = { 1:'UserExpDomP', 2:'UserSIcon', 3:'UserExpHis', 4:'UserUserPoint', 5:'UserDummyPoint', 6:'UserCredit' };
const USER_MONEY_LOG_LABELS = { 1:'余额', 2:'银币', 3:'经验', 4:'积分', 5:'虚拟币', 6:'信用分' };

function inputOf(request) {
  const body = request.body || {};
  return body.params && typeof body.params === 'object' ? body.params : body;
}
function fail(status, message) { const error = new Error(message); error.status = status; throw error; }
function pointerId(value) { return value && (value.id || value.objectId || (value.__type === 'Pointer' && value.objectId)); }
function escapeRegex(value) { return String(value).replace(/[\\^$.*+?()[\]{}|]/g, '\\$&'); }
function safeValue(value, depth = 0) {
  if (value == null || depth > 4) return value;
  if (Array.isArray(value)) return value.map((item) => safeValue(item, depth + 1));
  if (value instanceof Date) return value.toISOString();
  if (value && typeof value === 'object' && ['Object','Pointer'].includes(value.__type) && value.className && value.objectId) return { __type: 'Pointer', className: String(value.className), objectId: String(value.objectId) };
  if (value && typeof value.toJSON === 'function') return safeValue(value.toJSON(), depth + 1);
  if (typeof value === 'object') {
    const output = {};
    for (const [key, item] of Object.entries(value)) {
      if (HIDDEN_FIELDS.has(key) || /(?:password|secret|token|masterkey|privatekey|mch_key|^ak$|^sk$)/i.test(key)) continue;
      output[key] = safeValue(item, depth + 1);
    }
    return output;
  }
  return value;
}
function normalizeContentTags(value) {
  const source = Array.isArray(value) ? value : String(value == null ? '' : value).split(/[|\r\n]+/);
  if (source.length > 1000) fail(400, '标签数量不能超过 1000 个');
  const tags = source.map((item) => String(item == null ? '' : item).replace(/[\s"\\]/g, '')).filter(Boolean);
  if (tags.some((tag) => tag.length > 100 || /[\u0000-\u001f\u007f]/.test(tag))) fail(400, '单个标签长度不能超过 100 个字符且不能包含控制字符');
  return tags;
}
async function readContentTags() {
  const config = await Parse.Config.get({ useMasterKey: true });
  return normalizeContentTags(config.get('legacyContentTags') || []);
}
function isVisible(object) { const value = object && typeof object.get === 'function' ? object.get('isDeleted') : object && object.isDeleted; return ![true, 1, '1', 'true', 'True', 'TRUE'].includes(value); }
async function requireAdmin(request) {
  const current = request.user || (typeof user !== 'undefined' ? user : null);
  if (!current) fail(401, '管理员会话已失效');
  await current.fetch({ useMasterKey: true });
  if (current.get('isDisabled') === true || current.get('isDeleted') === true) fail(403, '管理员账号已停用');
  const roles = Array.isArray(current.get('roles')) ? current.get('roles').map(String) : [];
  const role = String(current.get('role') || '');
  const roleKey = String(current.get('adminRoleKey') || '');
  const isSuperAdmin = roleKey === 'super-admin' || roles.includes('super-admin');
  const isAdmin = current.get('isAdmin') === true || role === 'admin' || roles.includes('admin') || isSuperAdmin;
  if (!isAdmin) fail(403, '当前账号未被授权为后台管理员');
  const company = request.company || current.get('company') || null;
  if (!company && !isSuperAdmin) fail(403, '管理员账号尚未分配帐套');
  return { current, roles, isSuperAdmin, company };
}
function isAdminAccount(target) {
  const roles = Array.isArray(target.get('roles')) ? target.get('roles').map(String) : [];
  return target.get('isAdmin') === true || target.get('role') === 'admin' || roles.includes('admin') || target.get('adminRoleKey') === 'super-admin' || roles.includes('super-admin');
}
function assertCanManageUser(context, target, action) {
  if (action === 'lock' && target.id === context.current.id) fail(400, '不能停用当前登录账号');
  if (isAdminAccount(target) && target.id !== context.current.id && !context.isSuperAdmin) fail(403, '只有超级管理员可以管理其他管理员账号');
}
async function revokeSessions(targets) {
  let revoked = 0;
  while (targets.length) {
    const query = new Parse.Query('_Session'); query.containedIn('user', targets); query.limit(1000);
    const sessions = await query.find({ useMasterKey: true });
    if (!sessions.length) break;
    await Parse.Object.destroyAll(sessions, { useMasterKey: true }); revoked += sessions.length;
    if (sessions.length < 1000) break;
  }
  return revoked;
}
function assertClass(className) {
  if (!ALLOWED_CLASSES.has(className)) fail(400, '不允许访问该数据类');
}
function isSystemField(className, name) { return SYSTEM_FIELDS.has(name) || Boolean(CLASS_SYSTEM_FIELDS[className] && CLASS_SYSTEM_FIELDS[className].has(name)); }
async function schemaFor(className) {
  assertClass(className);
  const schema = await new Parse.Schema(className).get({ useMasterKey: true });
  return schema && schema.fields ? schema.fields : {};
}
function applyTenant(query, fields, context, requestedCompanyId) {
  if (!fields.company) return;
  if (context.isSuperAdmin && requestedCompanyId) {
    query.equalTo('company', Parse.Object.createWithoutData('Company', String(requestedCompanyId)));
  } else if (context.company) {
    query.equalTo('company', context.company);
  }
}
function serializeObject(object) { return safeValue(object.toJSON()); }
function toParseValue(field, value) {
  if (value == null || value === '') return value;
  if (field.type === 'Pointer') {
    const objectId = pointerId(value) || value;
    return Parse.Object.createWithoutData(field.targetClass, String(objectId));
  }
  if (field.type === 'Date') {
    const date = new Date(value.iso || value);
    if (Number.isNaN(date.getTime())) fail(400, '日期字段格式无效');
    return date;
  }
  if (field.type === 'Number') {
    const number = Number(value);
    if (!Number.isFinite(number)) fail(400, '数字字段格式无效');
    return number;
  }
  if (field.type === 'Boolean') return value === true || value === 'true';
  if (field.type === 'Array') { if (!Array.isArray(value)) fail(400, '数组字段格式无效'); return value; }
  if (field.type === 'Object') { if (!value || typeof value !== 'object' || Array.isArray(value)) fail(400, '对象字段格式无效'); return value; }
  if (!GENERIC_WRITE_TYPES.has(field.type)) fail(400, '该字段类型不允许通用编辑: ' + field.type);
  return value;
}
async function countClass(className, context) {
  const fields = await schemaFor(className);
  const query = new Parse.Query(className);
  applyTenant(query, fields, context);
  if (fields.isDeleted) query.notEqualTo('isDeleted', true);
  return query.count({ useMasterKey: true });
}
async function audit(context, action, className, objectId) {
  try {
    const log = new Parse.Object('SysLog');
    const schema = await new Parse.Schema('SysLog').get({ useMasterKey: true });
    const fields = schema.fields || {};
    if (fields.company && context.company) log.set('company', context.company);
    if (fields.userId) log.set('userId', context.current.id);
    if (fields.userName) log.set('userName', String(context.current.get('username') || ''));
    if (fields.remind) log.set('remind', '[AngularAdmin] ' + action + ' ' + className + '/' + objectId);
    if (fields.logType) log.set('logType', 'angular-admin');
    await log.save(null, { useMasterKey: true });
  } catch (_) { /* 审计表字段来自旧系统，失败不能覆盖主操作结果。 */ }
}

async function handler(request, response) {
  try {
    const input = inputOf(request);
    const operation = String(input.operation || 'meta');
    const context = await requireAdmin(request);
    if (operation === 'meta') {
      const functionQuery = new Parse.Query('Function');
      functionQuery.notEqualTo('enabled', false);
      const cloudFunctions = await functionQuery.count({ useMasterKey: true });
      return response.json({ success: true, data: {
        identity: { objectId: context.current.id, username: String(context.current.get('username') || ''), displayName: String(context.current.get('realName') || context.current.get('realname') || context.current.get('nickname') || context.current.get('username') || ''), company: safeValue(context.company), roles: context.roles, isSuperAdmin: context.isSuperAdmin },
        classes: ALLOWED_CLASSES.size, cloudFunctions
      }});
    }
    if (operation === 'logout') {
      const sessionToken = String(input.sessionToken || '');
      if (!sessionToken || sessionToken.length > 512) fail(400, '缺少有效的管理员会话');
      const query = new Parse.Query('_Session'); query.equalTo('sessionToken', sessionToken); query.equalTo('user', context.current); query.limit(1);
      const session = await query.first({ useMasterKey: true });
      if (session) await session.destroy({ useMasterKey: true });
      return response.json({ success: true, data: { revoked: Boolean(session) } });
    }
    if (operation === 'changeOwnPassword') {
      const oldPassword = typeof input.oldPassword === 'string' ? input.oldPassword : ''; const newPassword = typeof input.newPassword === 'string' ? input.newPassword : '';
      if (!oldPassword || newPassword.length < 8 || newPassword.length > 72) fail(400, '原密码不能为空，新密码长度应为 8 至 72 位'); if (oldPassword === newPassword) fail(400, '新密码不能与原密码相同');
      let verified; try { verified = await Parse.User.logIn(String(context.current.get('username') || ''), oldPassword); } catch (_) { fail(400, '原密码错误'); } if (!verified || verified.id !== context.current.id) fail(400, '原密码验证失败');
      const activeSessionQuery = new Parse.Query('_Session'); activeSessionQuery.equalTo('user', context.current); const activeSessions = await activeSessionQuery.count({ useMasterKey: true }); context.current.setPassword(newPassword); await context.current.save(null, { useMasterKey: true }); const explicitlyRevoked = await revokeSessions([context.current]); await audit(context, 'change-own-password', '_User', context.current.id); return response.json({ success: true, data: { objectId: context.current.id, revokedSessions: Math.max(activeSessions, explicitlyRevoked), reauthenticationRequired: true } });
    }
    if (operation === 'dashboard') {
      const metrics = [
        ['_User','用户总数'],['CourseBinding','课程绑定'],['CourseAppointment','课程预约'],['PracticeRecord','练习记录'],['LessonRecord','上课记录'],['DailyStudyRecord','每日学习'],['VocabularyWord','词库单词'],['CommonModel','内容记录']
      ];
      const counts = await Promise.all(metrics.map(async ([className, label]) => ({ className, label, count: await countClass(className, context), route: '/admin/resources/' + className })));
      const functionQuery = new Parse.Query('Function'); functionQuery.notEqualTo('enabled', false);
      let registeredRecords = 195452;
      try { const row = await Psql.oneOrNone('SELECT COUNT(*)::int AS count FROM cms.record_registry'); if (row) registeredRecords = Number(row.count); } catch (_) {}
      return response.json({ success: true, data: { identity: { objectId: context.current.id, username: String(context.current.get('username') || ''), displayName: String(context.current.get('realName') || context.current.get('nickname') || context.current.get('username') || ''), company: safeValue(context.company), roles: context.roles, isSuperAdmin: context.isSuperAdmin }, metrics: counts, migration: { sourceObjects: 338, migratedClasses: 96, registeredRecords, cloudFunctions: await functionQuery.count({ useMasterKey: true }) } } });
    }
    if (operation === 'catalog') {
      const resources = [...ALLOWED_CLASSES].sort().map((className) => ({ className, label: CLASS_LABELS[className] || className, writable: !READ_ONLY_CLASSES.has(className), route: '/admin/resources/' + className }));
      return response.json({ success: true, data: { total: resources.length, resources } });
    }
    if (operation === 'apiCatalog') {
      const query = new Parse.Query('Function'); query.ascending('path'); query.limit(1000); const rows = await query.find({ useMasterKey: true });
      const results = rows.filter((entry) => entry.get('isDeleted') !== true && String(entry.get('path') || '').startsWith('xiaoshu/')).map((entry) => ({ objectId: entry.id, name: String(entry.get('name') || ''), desc: String(entry.get('desc') || ''), path: String(entry.get('path') || ''), type: String(entry.get('type') || 'standalone'), paramList: Array.isArray(entry.get('paramList')) ? safeValue(entry.get('paramList')) : [], respType: String(entry.get('respType') || 'json'), updatedAt: safeValue(entry.updatedAt) }));
      return response.json({ success: true, data: { total: results.length, results } });
    }
    if (operation === 'legacyConfigBlocker') {
      const action = String(input.action || ''); const blockers = {
        APIInfo_Submit: '旧 API_ID/API_Key/API_AdminKey、IP 访问策略与目标 sessionToken/云函数权限模型不等价，且没有能对全部函数生效的站点配置层',
        APIInfo_SwaggerClose: '目标云函数引擎没有帐套级 Swagger 实时调试关闭开关',
        APIInfo_SwaggerOpen: '目标云函数引擎没有帐套级 Swagger 实时调试开启开关',
        LicenceFile_API: '目标 Schema 缺少许可、隐私、协议与版权文档存储，云函数也不能写旧 wwwroot/Config 文件',
        close_system: '云函数运行时不存在可通过 app_offline.htm 关闭的单体 ASP.NET 进程',
        Hotkey: '目标 Schema 没有 KeyboardConfig/Hotkey 持久化模型，旧 XML 配置文件也不在云函数运行时',
        HotkeyAdd: '目标 Schema 没有 KeyboardConfig/Hotkey 持久化模型，无法生成可全局生效的快捷键',
        HotkeyAdd_Submit: '目标 Schema 没有 KeyboardConfig/Hotkey 持久化模型，不能伪造保存成功',
        Hotkey_API: '目标 Schema 没有 KeyboardConfig/Hotkey 持久化模型，启停、删除、重载和脚本匹配无可操作对象',
        Prize: '目标 Schema 没有 PrizeConfig/PrizeTask 配置模型及签到、任务规则数据',
        Prize_Submit: '目标 Schema 没有 PrizeConfig/PrizeTask 配置模型，无法持久化奖励积分、重复周期和过期规则'
      };
      if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧配置动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'createUser') {
      const username = String(input.username || '').trim();
      const password = typeof input.password === 'string' ? input.password : '';
      const displayName = String(input.displayName || '').trim();
      const mobile = String(input.mobile || '').trim();
      const inviteUsername = String(input.inviteUsername || '').trim();
      if (username.length < 3 || username.length > 64) fail(400, '账号长度应为 3 至 64 位');
      if (password.length < 8 || password.length > 72) fail(400, '密码长度应为 8 至 72 位');
      if (displayName.length > 100) fail(400, '显示名不能超过 100 位');
      if (mobile.length > 32) fail(400, '手机号不能超过 32 位');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '开户必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const userFields = await schemaFor('_User');
      if (!userFields.company) fail(500, '用户表缺少帐套字段');
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "_User" WHERE "company"=$1 AND "username"=$2 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) LIMIT 1', [companyId, username]);
      if (duplicate) fail(409, '此用户名已被使用');
      let parentId = 0;
      if (inviteUsername) {
        const inviter = await Psql.oneOrNone('SELECT COALESCE("legacyUserId", CASE WHEN COALESCE("legacyUserData"->>\'UserID\',\'\') ~ \'^[0-9]+$\' THEN ("legacyUserData"->>\'UserID\')::numeric END) AS id FROM "_User" WHERE "company"=$1 AND "username"=$2 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) LIMIT 1', [companyId, inviteUsername]);
        parentId = Number(inviter && inviter.id) || 0;
        if (!parentId) fail(400, '邀请账号不存在');
      }
      const created = new Parse.User();
      created.setUsername(username); created.setPassword(password); created.set('company', company);
      if (userFields.type) created.set('type', 'user');
      if (userFields.isDisabled) created.set('isDisabled', false);
      if (userFields.isDeleted) created.set('isDeleted', false);
      if (userFields.legacyGroupId) created.set('legacyGroupId', 1);
      if (userFields.nickname) created.set('nickname', displayName || username);
      if (mobile && userFields.mobile) created.set('mobile', mobile);
      if (userFields.isAdmin) created.set('isAdmin', false);
      if (userFields.roles) created.set('roles', []);
      try { await created.signUp(null, { useMasterKey: true }); }
      catch (error) { if (Number(error && error.code) === 202) fail(409, '此用户名已被使用'); throw error; }
      try {
        const regTime = new Date().toISOString();
        const legacyData = { UserID:0,UserName:username,HoneyName:displayName || username,GroupID:1,ParentUserID:parentId,VIP:0,RegTime:regTime,Purse:0,SilverCoin:0,UserExp:0,UserPoint:0,boffExp:0,State:1 };
        const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-legacy-user-id\'))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("legacyUserId"),0)+1 AS id FROM "_User",lock_row WHERE "company"=$1 AND COALESCE("legacyUserId",0)>0) UPDATE "_User" SET "legacyUserId"=next_id.id,"legacyGroupId"=1,"legacyUserData"=jsonb_set($3::jsonb,\'{UserID}\',to_jsonb(next_id.id),true),"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, created.id, JSON.stringify(legacyData)]);
        const legacyUserId = Number(rows[0] && rows[0].id) || 0;
        if (!legacyUserId) throw new Error('无法分配旧系统用户 ID');
        await created.fetch({ useMasterKey: true });
        await audit({ ...context, company }, 'create-user', '_User', created.id);
        return response.json({ success: true, data: { ...serializeObject(created), userId: legacyUserId, groupId: 1 } });
      } catch (error) {
        await created.destroy({ useMasterKey: true }).catch(() => undefined);
        throw error;
      }
    }
    if (operation === 'userBatch') {
      const action = String(input.action || '');
      if (!['lock','unlock','move'].includes(action)) fail(400, '不支持的用户批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个用户');
      const userFields = await schemaFor('_User');
      const query = new Parse.Query('_User'); applyTenant(query, userFields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分用户不存在或不属于当前帐套');
      for (const target of targets) assertCanManageUser(context, target, action);
      let group = null;
      let groupId = 0;
      if (action === 'move') {
        groupId = Number(input.groupId);
        if (!Number.isInteger(groupId) || groupId < 1) fail(400, '请选择有效用户组');
        const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))];
        if (companyIds.length !== 1) fail(400, '批量移动的用户必须属于同一帐套');
        const groupRow = await Psql.oneOrNone('SELECT "objectId" FROM "Group" WHERE "company"=$1 AND "groupId"=$2 LIMIT 1', [companyIds[0], groupId]);
        if (!groupRow) fail(404, '目标用户组不存在或不属于当前帐套');
        group = await new Parse.Query('Group').get(String(groupRow.objectId), { useMasterKey: true });
      }
      const now = new Date();
      for (const target of targets) {
        const legacyData = { ...(target.get('legacyUserData') || {}) };
        if (action === 'move') {
          target.set('legacyGroupId', groupId); legacyData.GroupID = groupId;
        } else {
          const disabled = action === 'lock'; target.set('isDisabled', disabled); legacyData.State = disabled ? 0 : 1;
          if (userFields.statusAction) target.set('statusAction', disabled ? 'admin-lock' : 'admin-unlock');
          if (userFields.statusReason) target.set('statusReason', String(input.reason || '').trim().slice(0, 200));
          if (userFields.statusUpdatedAt) target.set('statusUpdatedAt', now);
          if (userFields.statusUpdatedBy) target.set('statusUpdatedBy', context.current.id);
        }
        target.set('legacyUserData', legacyData);
      }
      await Parse.Object.saveAll(targets, { useMasterKey: true });
      const revokedSessions = action === 'lock' ? await revokeSessions(targets) : 0;
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'user-' + action, '_User', target.id);
      return response.json({ success: true, data: { action, updated: targets.length, revokedSessions, group: group ? serializeObject(group) : null, results: targets.map(serializeObject) } });
    }
    if (operation === 'saveGroup') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const groupName = String(payload.groupName || '').trim();
      const description = String(payload.description || groupName).trim();
      const parentGroupId = payload.parentGroupId === undefined || payload.parentGroupId === '' ? 0 : Number(payload.parentGroupId);
      if (!groupName || groupName.length > 100) fail(400, '用户组名称为必填项且不能超过 100 位');
      if (description.length > 500) fail(400, '用户组说明不能超过 500 位');
      if (!Number.isInteger(parentGroupId) || parentGroupId < 0) fail(400, '父用户组编号无效');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '用户组必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const groupFields = await schemaFor('Group');
      let target;
      let currentGroupId = 0;
      if (objectId) {
        const query = new Parse.Query('Group'); applyTenant(query, groupFields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        currentGroupId = Number(target.get('groupId')) || 0;
      } else target = new Parse.Object('Group');
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "Group" WHERE "company"=$1 AND LOWER(COALESCE("groupName",\'\'))=LOWER($2) AND ($3=\'\' OR "objectId"<>$3) LIMIT 1', [companyId, groupName, objectId]);
      if (duplicate) fail(409, '当前帐套已存在同名用户组');
      if (parentGroupId) {
        let cursor = parentGroupId; const visited = new Set();
        while (cursor) {
          if (cursor === currentGroupId || visited.has(cursor)) fail(400, '父用户组不能形成循环');
          visited.add(cursor);
          const parent = await Psql.oneOrNone('SELECT "parentGroupId" AS parent_id FROM "Group" WHERE "company"=$1 AND "groupId"=$2 LIMIT 1', [companyId, cursor]);
          if (!parent) fail(404, '父用户组不存在或不属于当前帐套');
          cursor = Number(parent.parent_id) || 0;
          if (visited.size > 100) fail(400, '用户组层级过深');
        }
      }
      target.set('company', company); target.set('groupName', groupName); target.set('description', description); target.set('parentGroupId', parentGroupId);
      const stringFields = ['otherName','enroll','signImg'];
      const numberFields = ['orderId','companyGroup','vipgroup','rebateRate','credit','vipnum','upPoint','upSicon','favCount','consumeType','ccountPerDay','upGradeMoney'];
      for (const name of stringFields) if (payload[name] !== undefined && groupFields[name]) target.set(name, String(payload[name] || '').trim());
      for (const name of numberFields) if (payload[name] !== undefined && payload[name] !== '') { const value = Number(payload[name]); if (!Number.isFinite(value)) fail(400, name + ' 必须是数字'); if (groupFields[name]) target.set(name, value); }
      if (payload.regSelect !== undefined && groupFields.regSelect) target.set('regSelect', payload.regSelect === true || payload.regSelect === 'true');
      if (!objectId && groupFields.sourceKey) target.set('sourceKey', 'cloud:admin-group:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10));
      await target.save(null, { useMasterKey: true });
      if (!objectId) {
        try {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-group-id\'))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("groupId"),0)+1 AS id FROM "Group",lock_row WHERE "company"=$1 AND COALESCE("groupId",0)>0) UPDATE "Group" SET "groupId"=next_id.id,"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]);
          currentGroupId = Number(rows[0] && rows[0].id) || 0;
          if (!currentGroupId) throw new Error('无法分配用户组编号');
        } catch (error) { await target.destroy({ useMasterKey: true }).catch(() => undefined); throw error; }
      }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-group' : 'create-group', 'Group', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveNode') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const nodeName = String(payload.nodeName || '').trim();
      const nodeDir = String(payload.nodeDir || '').trim();
      const parentId = Number(input.parentId == null ? payload.parentId || 0 : input.parentId);
      if (!nodeName || nodeName.length > 100) fail(400, '栏目名称长度应为 1 至 100 位');
      if (!Number.isInteger(parentId) || parentId < 0) fail(400, '父节点编号无效');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '栏目必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const fields = await schemaFor('Node');
      let target;
      let currentNodeId = 0;
      if (objectId) {
        const query = new Parse.Query('Node'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId;
        currentNodeId = Number(target.get('nodeId')) || 0;
      } else target = new Parse.Object('Node');
      let parentDepth = 0;
      if (parentId > 0) {
        const parent = await Psql.oneOrNone('SELECT "nodeId","depth" FROM "Node" WHERE "company"=$1 AND "nodeId"=$2 AND COALESCE("zstatus",99)<>-2 LIMIT 1', [companyId, parentId]);
        if (!parent) fail(404, '父节点不存在、已回收或不属于当前帐套');
        parentDepth = Number(parent.depth) || 0;
        if (currentNodeId) {
          const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "nodeId","parentId",ARRAY["nodeId"::text] AS path FROM "Node" WHERE "company"=$1 AND "nodeId"=$2 UNION ALL SELECT n."nodeId",n."parentId",chain.path||n."nodeId"::text FROM "Node" n JOIN chain ON n."nodeId"=chain."parentId" WHERE n."company"=$1 AND NOT n."nodeId"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "nodeId"=$3 LIMIT 1', [companyId, parentId, currentNodeId]);
          if (cycle) fail(409, '不能把栏目移动到自身或其下级栏目');
        }
      }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "Node" WHERE "company"=$1 AND COALESCE("parentId",0)=$2 AND "objectId"<>$3 AND COALESCE("zstatus",99)<>-2 AND (LOWER(TRIM(COALESCE("nodeName",\'\')))=LOWER($4) OR ($5<>\'\' AND LOWER(TRIM(COALESCE("nodeDir",\'\')))=LOWER($5))) LIMIT 1', [companyId, parentId, objectId, nodeName, nodeDir]);
      if (duplicate) fail(409, '同一父栏目下的栏目名称或目录名不能重复');
      for (const [name, value] of Object.entries(payload)) {
        if (!fields[name] || isSystemField('Node', name)) continue;
        if (!GENERIC_WRITE_TYPES.has(fields[name].type)) fail(400, '字段不允许编辑: ' + name);
        if (value === null) target.unset(name); else target.set(name, toParseValue(fields[name], value));
      }
      target.set('nodeName', nodeName); target.set('nodeDir', nodeDir); target.set('parentId', parentId); target.set('depth', parentDepth + 1); target.set('company', company);
      if (!objectId) {
        target.set('sourceKey', 'cloud:admin-node:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10));
        target.set('zstatus', 99); target.set('child', 0); target.set('cdate', new Date());
        if (fields.cuser) target.set('cuser', Number(context.current.get('legacyUserId')) || 0);
        if (fields.cuname) target.set('cuname', String(context.current.get('username') || ''));
      }
      if (fields.editDate) target.set('editDate', new Date());
      try { await target.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '栏目初始写入失败: ' + String(error && error.message || error)); }
      try {
        if (!objectId) {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-node-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("nodeId"),0)+1 AS id FROM "Node",lock_row WHERE "company"=$1 AND COALESCE("nodeId",0)>0), next_order AS MATERIALIZED (SELECT COALESCE(MAX("orderId"),0)+1 AS id FROM "Node",lock_row WHERE "company"=$1 AND COALESCE("parentId",0)=$3 AND "objectId"<>$2) UPDATE "Node" SET "nodeId"=next_id.id,"orderId"=next_order.id,"sourceKey"=\'[["NodeID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id,next_order WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id, parentId]);
          currentNodeId = Number(rows[0] && rows[0].id) || 0;
          if (!currentNodeId) throw new Error('无法分配栏目编号');
        }
        await Psql.query('WITH RECURSIVE tree AS (SELECT "objectId","nodeId",$3::numeric AS depth FROM "Node" WHERE "company"=$1 AND "objectId"=$2 UNION ALL SELECT n."objectId",n."nodeId",tree.depth+1 FROM "Node" n JOIN tree ON n."parentId"=tree."nodeId" WHERE n."company"=$1) UPDATE "Node" n SET "depth"=tree.depth,"updatedAt"=NOW() FROM tree WHERE n."objectId"=tree."objectId"', [companyId, target.id, parentDepth + 1]);
      } catch (error) { if (!objectId) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '栏目结构写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-node' : 'create-node', 'Node', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'nodeBatch') {
      const action = String(input.action || '');
      if (!['recycle','recover','move','purge'].includes(action)) fail(400, '不支持的栏目批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个栏目');
      const fields = await schemaFor('Node');
      const query = new Parse.Query('Node'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分栏目不存在或不属于当前帐套');
      const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))];
      if (companyIds.length !== 1) fail(400, '批量操作的栏目必须属于同一帐套');
      const companyId = companyIds[0];
      const nodeIds = targets.map((target) => Number(target.get('nodeId')) || 0);
      if (nodeIds.some((nodeId) => nodeId < 1)) fail(409, '栏目缺少有效旧系统编号');
      let parentId = null;
      let parentDepth = 0;
      if (action === 'move') {
        parentId = Number(input.parentId);
        if (!Number.isInteger(parentId) || parentId < 0) fail(400, '目标父节点编号无效');
        if (parentId > 0) {
          const parent = await Psql.oneOrNone('SELECT "nodeId","depth" FROM "Node" WHERE "company"=$1 AND "nodeId"=$2 AND COALESCE("zstatus",99)<>-2 LIMIT 1', [companyId, parentId]);
          if (!parent) fail(404, '目标父节点不存在、已回收或不属于当前帐套');
          parentDepth = Number(parent.depth) || 0;
          for (const nodeId of nodeIds) {
            const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "nodeId","parentId",ARRAY["nodeId"::text] AS path FROM "Node" WHERE "company"=$1 AND "nodeId"=$2 UNION ALL SELECT n."nodeId",n."parentId",chain.path||n."nodeId"::text FROM "Node" n JOIN chain ON n."nodeId"=chain."parentId" WHERE n."company"=$1 AND NOT n."nodeId"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "nodeId"=$3 LIMIT 1', [companyId, parentId, nodeId]);
            if (cycle) fail(409, '不能把栏目移动到自身或其下级栏目');
          }
        }
        for (const target of targets) { target.set('parentId', parentId); target.set('depth', parentDepth + 1); if (fields.editDate) target.set('editDate', new Date()); }
        await Parse.Object.saveAll(targets, { useMasterKey: true });
        for (const target of targets) await Psql.query('WITH RECURSIVE tree AS (SELECT "objectId","nodeId",$3::numeric AS depth FROM "Node" WHERE "company"=$1 AND "objectId"=$2 UNION ALL SELECT n."objectId",n."nodeId",tree.depth+1 FROM "Node" n JOIN tree ON n."parentId"=tree."nodeId" WHERE n."company"=$1) UPDATE "Node" n SET "depth"=tree.depth,"updatedAt"=NOW() FROM tree WHERE n."objectId"=tree."objectId"', [companyId, target.id, parentDepth + 1]);
      } else if (action === 'purge') {
        const refs = await Psql.one('SELECT (SELECT COUNT(*)::int FROM "CommonModel" WHERE "company"=$1 AND "nodeId"=ANY($2::numeric[])) AS contents,(SELECT COUNT(*)::int FROM "Node" WHERE "company"=$1 AND "parentId"=ANY($2::numeric[]) AND NOT ("nodeId"=ANY($2::numeric[]))) AS children,(SELECT COUNT(*)::int FROM "NodeAuth" WHERE "nodeId"=ANY($2::numeric[])) AS auth,(SELECT COUNT(*)::int FROM "NodeModelTemplate" WHERE "nodeId"=ANY($2::numeric[])) AS templates', [companyId, nodeIds]);
        if (Number(refs.contents) || Number(refs.children) || Number(refs.auth) || Number(refs.templates)) fail(409, '栏目仍被内容、下级栏目、权限或模板引用，不能永久删除');
        await Parse.Object.destroyAll(targets, { useMasterKey: true });
      } else {
        const status = action === 'recycle' ? -2 : 99;
        for (const target of targets) { target.set('zstatus', status); if (fields.editDate) target.set('editDate', new Date()); }
        await Parse.Object.saveAll(targets, { useMasterKey: true });
      }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'node-' + action, 'Node', target.id);
      return response.json({ success: true, data: { action, updated: targets.length, parentId, results: action === 'purge' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'saveSpecial') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const specName = String(payload.specName || '').trim();
      const specDir = String(payload.specDir || '').trim();
      const pid = Number(input.pid == null ? payload.pid || 0 : input.pid);
      if (!specName || specName.length > 100) fail(400, '专题名称长度应为 1 至 100 位');
      if (!specDir || specDir.length > 100) fail(400, '专题目录长度应为 1 至 100 位');
      if (!Number.isInteger(pid) || pid < 0) fail(400, '父专题编号无效');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '专题必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const fields = await schemaFor('Special');
      let target;
      let currentSpecId = 0;
      if (objectId) {
        const query = new Parse.Query('Special'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId; currentSpecId = Number(target.get('specId')) || 0;
      } else target = new Parse.Object('Special');
      if (pid > 0) {
        const parent = await Psql.oneOrNone('SELECT "specId" FROM "Special" WHERE "company"=$1 AND "specId"=$2 LIMIT 1', [companyId, pid]);
        if (!parent) fail(404, '父专题不存在或不属于当前帐套');
        if (currentSpecId) {
          const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "specId","pid",ARRAY["specId"::text] AS path FROM "Special" WHERE "company"=$1 AND "specId"=$2 UNION ALL SELECT s."specId",s."pid",chain.path||s."specId"::text FROM "Special" s JOIN chain ON s."specId"=chain."pid" WHERE s."company"=$1 AND NOT s."specId"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "specId"=$3 LIMIT 1', [companyId, pid, currentSpecId]);
          if (cycle) fail(409, '不能把专题移动到自身或其下级专题');
        }
      }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "Special" WHERE "company"=$1 AND "objectId"<>$2 AND (LOWER(TRIM(COALESCE("specName",\'\')))=LOWER($3) OR LOWER(TRIM(COALESCE("specDir",\'\')))=LOWER($4)) LIMIT 1', [companyId, objectId, specName, specDir]);
      if (duplicate) fail(409, '专题名称或目录不能重复');
      for (const [name, value] of Object.entries(payload)) {
        if (!fields[name] || isSystemField('Special', name)) continue;
        if (!GENERIC_WRITE_TYPES.has(fields[name].type)) fail(400, '字段不允许编辑: ' + name);
        if (value === null) target.unset(name); else target.set(name, toParseValue(fields[name], value));
      }
      target.set('specName', specName); target.set('specDir', specDir); target.set('pid', pid); target.set('company', company); target.set('editDate', new Date());
      if (!objectId) { target.set('sourceKey', 'cloud:admin-special:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('openType', true); target.set('cdate', new Date()); target.set('cuser', String(context.current.get('username') || '')); }
      try { await target.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '专题初始写入失败: ' + String(error && error.message || error)); }
      try {
        if (!objectId) {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-special-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("specId"),0)+1 AS id FROM "Special",lock_row WHERE "company"=$1 AND COALESCE("specId",0)>0), next_order AS MATERIALIZED (SELECT COALESCE(MAX("orderId"),0)+1 AS id FROM "Special",lock_row WHERE "company"=$1 AND COALESCE("pid",0)=$3 AND "objectId"<>$2) UPDATE "Special" SET "specId"=next_id.id,"orderId"=next_order.id,"sourceKey"=\'[["SpecID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id,next_order WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id, pid]);
          currentSpecId = Number(rows[0] && rows[0].id) || 0;
          if (!currentSpecId) throw new Error('无法分配专题编号');
        }
      } catch (error) { if (!objectId) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '专题结构写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-special' : 'create-special', 'Special', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'specialBatch') {
      const action = String(input.action || '');
      if (action === 'merge') fail(501, 'migration_blocked: CommonModel.specialId 仅存在于 Parse Schema、PostgreSQL 物理列缺失，且商品主表未迁移，无法安全合并专题关系');
      if (action !== 'move') fail(400, '不支持的专题批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个专题');
      const fields = await schemaFor('Special');
      const query = new Parse.Query('Special'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分专题不存在或不属于当前帐套');
      const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))];
      if (companyIds.length !== 1) fail(400, '批量操作的专题必须属于同一帐套');
      const companyId = companyIds[0];
      const specIds = targets.map((target) => Number(target.get('specId')) || 0);
      const pid = Number(input.pid);
      if (!Number.isInteger(pid) || pid < 0) fail(400, '目标父专题编号无效');
      if (pid > 0) {
        const parent = await Psql.oneOrNone('SELECT "specId" FROM "Special" WHERE "company"=$1 AND "specId"=$2 LIMIT 1', [companyId, pid]);
        if (!parent) fail(404, '目标父专题不存在或不属于当前帐套');
        for (const specId of specIds) {
          const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "specId","pid",ARRAY["specId"::text] AS path FROM "Special" WHERE "company"=$1 AND "specId"=$2 UNION ALL SELECT s."specId",s."pid",chain.path||s."specId"::text FROM "Special" s JOIN chain ON s."specId"=chain."pid" WHERE s."company"=$1 AND NOT s."specId"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "specId"=$3 LIMIT 1', [companyId, pid, specId]);
          if (cycle) fail(409, '不能把专题移动到自身或其下级专题');
        }
      }
      for (const target of targets) { target.set('pid', pid); target.set('editDate', new Date()); }
      await Parse.Object.saveAll(targets, { useMasterKey: true });
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'special-move', 'Special', target.id);
      return response.json({ success: true, data: { action, updated: targets.length, pid, results: targets.map(serializeObject) } });
    }
    if (operation === 'saveModelMetadata' || operation === 'saveModelFieldMetadata') {
      const className = operation === 'saveModelMetadata' ? 'Model' : 'ModelField';
      const objectId = String(input.objectId || '');
      if (!objectId) fail(501, 'migration_blocked: 新增模型或字段需要同步创建 PostgreSQL 物理表/列及旧模板文件，托管云函数中未开放此 DDL 流程');
      const fields = await schemaFor(className);
      const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const allowed = className === 'Model'
        ? new Set(['modelName','itemName','itemUnit','itemIcon','description','islotsize','contentTemplate','thumbnail'])
        : new Set(['fieldAlias','fieldTips','description','isNotNull','isSearchForm','content','isShow','isView','showList','showWidth','isCopy','islotsize','isChain']);
      if (className === 'Model') {
        const modelName = String(payload.modelName == null ? target.get('modelName') || '' : payload.modelName).trim();
        if (!modelName || modelName.length > 100) fail(400, '模型名称长度应为 1 至 100 位');
        const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "Model" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("modelName",\'\')))=LOWER($3) LIMIT 1', [pointerId(target.get('company')), objectId, modelName]);
        if (duplicate) fail(409, '模型名称已存在');
        target.set('modelName', modelName);
      } else {
        const fieldAlias = String(payload.fieldAlias == null ? target.get('fieldAlias') || '' : payload.fieldAlias).trim();
        if (!fieldAlias || fieldAlias.length > 100) fail(400, '字段别名长度应为 1 至 100 位');
        target.set('fieldAlias', fieldAlias);
      }
      for (const [name, value] of Object.entries(payload)) {
        if (!allowed.has(name) || !fields[name]) continue;
        if (value === null) target.unset(name); else target.set(name, toParseValue(fields[name], value));
      }
      await target.save(null, { useMasterKey: true }); await audit(context, className === 'Model' ? 'update-model-metadata' : 'update-model-field-metadata', className, objectId);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'modelFieldOrder') {
      const items = Array.isArray(input.items) ? input.items : [];
      if (!items.length || items.length > 100) fail(400, '每次请提交 1 至 100 个字段顺序');
      const objectIds = items.map((item) => String(item && item.objectId || '').trim());
      const orderIds = items.map((item) => Number(item && item.orderId));
      if (objectIds.some((id) => !id) || new Set(objectIds).size !== objectIds.length || orderIds.some((id) => !Number.isInteger(id) || id < 0) || new Set(orderIds).size !== orderIds.length) fail(400, '字段或顺序参数无效/重复');
      const fields = await schemaFor('ModelField');
      const query = new Parse.Query('ModelField'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分模型字段不存在或不属于当前帐套');
      const modelIds = [...new Set(targets.map((target) => Number(target.get('modelId')) || 0))];
      if (modelIds.length !== 1) fail(400, '只能对同一模型的字段排序');
      const targetMap = new Map(targets.map((target) => [target.id, target]));
      for (const item of items) targetMap.get(String(item.objectId)).set('orderId', Number(item.orderId));
      await Parse.Object.saveAll(targets, { useMasterKey: true });
      for (const target of targets) await audit(context, 'order-model-field', 'ModelField', target.id);
      return response.json({ success: true, data: { updated: targets.length, modelId: modelIds[0], results: targets.map(serializeObject) } });
    }
    if (operation === 'saveGuestbook') {
      const objectId = String(input.objectId || '');
      if (!objectId) fail(400, '普通留言新增必须走前台留言云函数；后台只能通过专用回复流程新增');
      const fields = await schemaFor('Guestbook');
      const query = new Parse.Query('Guestbook'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const title = String(payload.title == null ? target.get('title') || '' : payload.title).trim();
      const content = String(payload.tcontent == null ? target.get('tcontent') || '' : payload.tcontent);
      if (!title || title.length > 200) fail(400, '留言标题长度应为 1 至 200 位');
      if (content.length > 200000) fail(400, '留言内容过长');
      target.set('title', title); target.set('tcontent', content);
      await target.save(null, { useMasterKey: true }); await audit(context, 'update-guestbook', 'Guestbook', objectId);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'guestbookReply') {
      const parentObjectId = String(input.parentObjectId || '');
      const title = String(input.title || '').trim() || '[管理员回复]';
      const content = String(input.content || '');
      if (!parentObjectId) fail(400, '缺少原留言');
      if (title.length > 200 || !content.trim() || content.length > 200000) fail(400, '回复标题或内容无效');
      const fields = await schemaFor('Guestbook');
      const query = new Parse.Query('Guestbook'); applyTenant(query, fields, context, input.companyId); const parent = await query.get(parentObjectId, { useMasterKey: true });
      const company = parent.get('company') || context.company; const companyId = pointerId(company); const parentGid = Number(parent.get('gid')) || 0; const cateid = Number(parent.get('cateid')) || 0;
      if (!companyId || !parentGid) fail(409, '原留言缺少帐套或旧系统编号');
      const reply = new Parse.Object('Guestbook');
      reply.set('sourceKey', 'cloud:admin-guestbook-reply:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); reply.set('company', company); reply.set('parentid', parentGid); reply.set('cateid', cateid); reply.set('userid', Number(context.current.get('legacyUserId')) || 0); reply.set('title', title); reply.set('tcontent', content); reply.set('status', 99); reply.set('gdate', new Date()); reply.set('ip', 'admin-cloud');
      try { await reply.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '管理员回复初始写入失败: ' + String(error && error.message || error)); }
      try {
        const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-guestbook-gid:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("gid"),0)+1 AS id FROM "Guestbook",lock_row WHERE "company"=$1 AND COALESCE("gid",0)>0) UPDATE "Guestbook" SET "gid"=next_id.id,"sourceKey"=\'[["Gid",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, reply.id]);
        if (!Number(rows[0] && rows[0].id)) throw new Error('无法分配回复编号');
      } catch (error) { await reply.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '管理员回复结构写入失败: ' + String(error && error.message || error)); }
      await reply.fetch({ useMasterKey: true }); await audit({ ...context, company }, 'reply-guestbook', 'Guestbook', reply.id);
      return response.json({ success: true, data: serializeObject(reply) });
    }
    if (operation === 'guestbookBatch') {
      const action = String(input.action || '');
      if (!['audit','unaudit','recycle','recover','purge'].includes(action)) fail(400, '不支持的留言批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条留言');
      const fields = await schemaFor('Guestbook');
      const query = new Parse.Query('Guestbook'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分留言不存在或不属于当前帐套');
      if (action === 'purge') {
        const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))]; const gids = targets.map((target) => Number(target.get('gid')) || 0);
        if (companyIds.length !== 1 || gids.some((gid) => gid < 1)) fail(409, '留言缺少有效帐套或编号');
        const children = await Psql.one('SELECT COUNT(*)::int AS count FROM "Guestbook" WHERE "company"=$1 AND "parentid"=ANY($2::numeric[]) AND NOT ("gid"=ANY($2::numeric[]))', [companyIds[0], gids]);
        if (Number(children.count) > 0) fail(409, '留言仍有回复，不能永久删除');
        await Parse.Object.destroyAll(targets, { useMasterKey: true });
      } else {
        const status = action === 'recycle' ? -2 : action === 'unaudit' ? 0 : 99;
        for (const target of targets) target.set('status', status);
        await Parse.Object.saveAll(targets, { useMasterKey: true });
      }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'guestbook-' + action, 'Guestbook', target.id);
      return response.json({ success: true, data: { action, updated: targets.length, results: action === 'purge' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'saveGuestCategory') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const catename = String(payload.catename || '').trim();
      const parentId = Number(input.parentId == null ? payload.parentId || 0 : input.parentId);
      let gtype = Number(input.gtype == null ? payload.gtype || 0 : input.gtype);
      if (!catename || catename.length > 100) fail(400, '分类名称长度应为 1 至 100 位');
      if (!Number.isInteger(parentId) || parentId < 0 || ![0,1].includes(gtype)) fail(400, '分类类型或父分类编号无效');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '分类必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const fields = await schemaFor('Guestcate');
      let target;
      let currentCateId = 0;
      if (objectId) {
        const query = new Parse.Query('Guestcate'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId; currentCateId = Number(target.get('cateid')) || 0; gtype = Number(target.get('gtype')) || 0;
      } else target = new Parse.Object('Guestcate');
      if (gtype === 0 && parentId !== 0) fail(400, '留言分类只能建立为顶级分类');
      if (parentId > 0) {
        const parent = await Psql.oneOrNone('SELECT "cateid" FROM "Guestcate" WHERE "company"=$1 AND "cateid"=$2 AND COALESCE("gtype",0)=$3 LIMIT 1', [companyId, parentId, gtype]);
        if (!parent) fail(404, '父分类不存在、类型不一致或不属于当前帐套');
        if (currentCateId) {
          const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "cateid","parentId",ARRAY["cateid"::text] AS path FROM "Guestcate" WHERE "company"=$1 AND "cateid"=$2 UNION ALL SELECT c."cateid",c."parentId",chain.path||c."cateid"::text FROM "Guestcate" c JOIN chain ON c."cateid"=chain."parentId" WHERE c."company"=$1 AND NOT c."cateid"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "cateid"=$3 LIMIT 1', [companyId, parentId, currentCateId]);
          if (cycle) fail(409, '不能把分类移动到自身或其下级分类');
        }
      }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "Guestcate" WHERE "company"=$1 AND "objectId"<>$2 AND COALESCE("gtype",0)=$3 AND COALESCE("parentId",0)=$4 AND LOWER(TRIM(COALESCE("catename",\'\')))=LOWER($5) LIMIT 1', [companyId, objectId, gtype, parentId, catename]);
      if (duplicate) fail(409, '同一父分类下的分类名称不能重复');
      const allowed = new Set(['catename','desc','status','needLog','isShowUnaudit','postAuth','zipImgSize','barImage','barOwner','permibit','sendScore','replyScore','barInfo','isPlat']);
      for (const [name, value] of Object.entries(payload)) {
        if (!allowed.has(name) || !fields[name]) continue;
        if (value === null) target.unset(name); else target.set(name, toParseValue(fields[name], value));
      }
      target.set('catename', catename); target.set('parentId', parentId); target.set('gtype', gtype); target.set('company', company);
      if (!objectId) { target.set('sourceKey', 'cloud:admin-guestcate:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); if (fields.status && payload.status == null) target.set('status', 1); }
      try { await target.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '分类初始写入失败: ' + String(error && error.message || error)); }
      try {
        if (!objectId) {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-guestcate-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("cateid"),0)+1 AS id FROM "Guestcate",lock_row WHERE "company"=$1 AND COALESCE("cateid",0)>0), next_order AS MATERIALIZED (SELECT COALESCE(MAX("orderId"),0)+1 AS id FROM "Guestcate",lock_row WHERE "company"=$1 AND COALESCE("gtype",0)=$3 AND COALESCE("parentId",0)=$4 AND "objectId"<>$2) UPDATE "Guestcate" SET "cateid"=next_id.id,"orderId"=next_order.id,"sourceKey"=\'[["Cateid",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id,next_order WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id, gtype, parentId]);
          currentCateId = Number(rows[0] && rows[0].id) || 0;
          if (!currentCateId) throw new Error('无法分配分类编号');
        }
      } catch (error) { if (!objectId) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '分类结构写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-guest-category' : 'create-guest-category', 'Guestcate', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'guestCategoryBatch') {
      const action = String(input.action || '');
      if (!['delete','recommend','unrecommend'].includes(action)) fail(400, '不支持的分类批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个分类');
      const fields = await schemaFor('Guestcate');
      const query = new Parse.Query('Guestcate'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分分类不存在或不属于当前帐套');
      if (action === 'delete') {
        const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))]; const cateids = targets.map((target) => Number(target.get('cateid')) || 0);
        if (companyIds.length !== 1 || cateids.some((id) => id < 1)) fail(409, '分类缺少有效帐套或编号');
        const refs = await Psql.one('SELECT (SELECT COUNT(*)::int FROM "Guestcate" WHERE "company"=$1 AND "parentId"=ANY($2::numeric[]) AND NOT ("cateid"=ANY($2::numeric[]))) AS children,(SELECT COUNT(*)::int FROM "Guestbook" WHERE "company"=$1 AND "cateid"=ANY($2::numeric[])) AS messages,(SELECT COUNT(*)::int FROM "GuestBar" WHERE "company"=$1 AND "cateId"=ANY($2::numeric[])) AS posts', [companyIds[0], cateids]);
        if (Number(refs.children) || Number(refs.messages) || Number(refs.posts)) fail(409, '分类仍被下级分类、留言或帖子引用，不能删除');
        await Parse.Object.destroyAll(targets, { useMasterKey: true });
      } else {
        for (const target of targets) { if (Number(target.get('gtype')) !== 1) fail(400, '只有贴吧分类支持推荐'); target.set('barInfo', action === 'recommend' ? 'Recommend' : ''); }
        await Parse.Object.saveAll(targets, { useMasterKey: true });
      }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'guest-category-' + action, 'Guestcate', target.id);
      return response.json({ success: true, data: { action, updated: targets.length, results: action === 'delete' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'barAuthorization') {
      fail(501, 'migration_blocked: 目标 Schema 缺少旧 ZL_Guest_BarAuth 用户版块权限关系（Uid、BarID、Look、Send、Reply），无法安全读取或保存逐用户浏览、发帖和回复权限');
    }
    if (operation === 'barMedal') {
      fail(501, 'migration_blocked: 目标 Schema 缺少旧 ZL_Guest_Medals 勋章及用户帖子授予关系，无法安全授予或撤销帖子勋章');
    }
    if (operation === 'saveDictionaryCategory') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const categoryName = String(payload.categoryname || '').trim();
      const isUsed = payload.isused == null ? true : payload.isused === true || payload.isused === 'true';
      if (!categoryName || categoryName.length > 50) fail(400, '字典分类名称长度应为 1 至 50 位');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '字典分类必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const fields = await schemaFor('Datadiccategory');
      let target;
      if (objectId) {
        const query = new Parse.Query('Datadiccategory'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId;
      } else target = new Parse.Object('Datadiccategory');
      const duplicateQuery = new Parse.Query('Datadiccategory'); applyTenant(duplicateQuery, fields, context, input.companyId); duplicateQuery.limit(1000);
      const duplicates = await duplicateQuery.find({ useMasterKey: true });
      if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('categoryname') || '').trim().toLowerCase() === categoryName.toLowerCase())) fail(409, '同一帐套的字典分类名称不能重复');
      target.set('categoryname', categoryName); target.set('isused', isUsed); target.set('company', company);
      if (objectId) {
        try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '字典分类写入失败: ' + String(error && error.message || error)); }
      } else {
        let lastError;
        for (let attempt = 0; attempt < 5; attempt++) {
          const allCategories = new Parse.Query('Datadiccategory'); allCategories.limit(1000);
          const allItems = new Parse.Query('Datadic'); allItems.limit(1000);
          const [categoryRows, itemRows] = await Promise.all([allCategories.find({ useMasterKey: true }), allItems.find({ useMasterKey: true })]);
          const nextId = Math.max(0, ...categoryRows.map((entry) => Number(entry.get('diccateid')) || 0), ...itemRows.map((entry) => Number(entry.get('diccate')) || 0)) + 1;
          target.set('diccateid', nextId); target.set('sourceKey', '[["Diccateid",' + nextId + ']]');
          try { await target.save(null, { useMasterKey: true }); lastError = null; break; }
          catch (error) { lastError = error; if (!(Number(error && error.code) === 137 || /duplicate|unique/i.test(String(error && error.message || '')))) break; }
        }
        if (lastError || !target.id) fail(422, '字典分类原子编号写入失败: ' + String(lastError && lastError.message || lastError || '无法分配编号'));
      }
      await audit({ ...context, company }, objectId ? 'update-dictionary-category' : 'create-dictionary-category', 'Datadiccategory', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveDictionaryItem') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const itemName = String(payload.dicname || '').trim();
      const categoryId = Number(input.categoryId == null ? payload.diccate || 0 : input.categoryId);
      const isUsed = payload.isused == null ? true : payload.isused === true || payload.isused === 'true';
      if (!itemName || itemName.length > 50) fail(400, '字典项名称长度应为 1 至 50 位');
      if (!Number.isInteger(categoryId) || categoryId < 1) fail(400, '请选择有效字典分类');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '字典项必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const fields = await schemaFor('Datadic');
      let target;
      if (objectId) {
        const query = new Parse.Query('Datadic'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId;
      } else target = new Parse.Object('Datadic');
      const categoryFields = await schemaFor('Datadiccategory'); const categoryQuery = new Parse.Query('Datadiccategory'); applyTenant(categoryQuery, categoryFields, context, input.companyId); categoryQuery.equalTo('diccateid', categoryId);
      const category = await categoryQuery.first({ useMasterKey: true });
      if (!category || pointerId(category.get('company')) !== companyId) fail(404, '字典分类不存在或不属于当前帐套');
      const duplicateQuery = new Parse.Query('Datadic'); applyTenant(duplicateQuery, fields, context, input.companyId); duplicateQuery.equalTo('diccate', categoryId); duplicateQuery.limit(1000);
      const duplicates = await duplicateQuery.find({ useMasterKey: true });
      if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('dicname') || '').trim().toLowerCase() === itemName.toLowerCase())) fail(409, '同一字典分类中的字典项名称不能重复');
      target.set('dicname', itemName); target.set('diccate', categoryId); target.set('isused', isUsed); target.set('company', company);
      if (objectId) {
        try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '字典项写入失败: ' + String(error && error.message || error)); }
      } else {
        let lastError;
        for (let attempt = 0; attempt < 5; attempt++) {
          const allItems = new Parse.Query('Datadic'); allItems.limit(1000); const itemRows = await allItems.find({ useMasterKey: true });
          const nextId = Math.max(0, ...itemRows.map((entry) => Number(entry.get('dicid')) || 0)) + 1;
          target.set('dicid', nextId); target.set('sourceKey', '[["Dicid",' + nextId + ']]');
          try { await target.save(null, { useMasterKey: true }); lastError = null; break; }
          catch (error) { lastError = error; if (!(Number(error && error.code) === 137 || /duplicate|unique/i.test(String(error && error.message || '')))) break; }
        }
        if (lastError || !target.id) fail(422, '字典项原子编号写入失败: ' + String(lastError && lastError.message || lastError || '无法分配编号'));
      }
      await audit({ ...context, company }, objectId ? 'update-dictionary-item' : 'create-dictionary-item', 'Datadic', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'dictionaryCategories') {
      const fields = await schemaFor('Datadiccategory'); const query = new Parse.Query('Datadiccategory'); applyTenant(query, fields, context, input.companyId);
      if (input.enabledOnly === true) query.equalTo('isused', true);
      query.ascending('diccateid'); query.limit(1000);
      const results = await query.find({ useMasterKey: true });
      return response.json({ success: true, data: { results: results.map(serializeObject) } });
    }
    if (operation === 'dictionaryBatch') {
      const className = String(input.className || ''); const action = String(input.action || '');
      if (!['Datadiccategory','Datadic'].includes(className) || !['enable','disable','delete'].includes(action)) fail(400, '不支持的字典批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条字典记录');
      const fields = await schemaFor(className); const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分字典记录不存在或不属于当前帐套');
      if (action === 'delete' && className === 'Datadiccategory') {
        const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))]; const categoryIds = targets.map((target) => Number(target.get('diccateid')) || 0);
        if (companyIds.length !== 1 || categoryIds.some((id) => id < 1)) fail(409, '字典分类缺少有效帐套或编号');
        const itemFields = await schemaFor('Datadic'); const refs = new Parse.Query('Datadic'); applyTenant(refs, itemFields, context, companyIds[0]); refs.containedIn('diccate', categoryIds);
        if (await refs.count({ useMasterKey: true })) fail(409, '字典分类仍有字典项，不能删除');
      }
      if (action === 'delete') await Parse.Object.destroyAll(targets, { useMasterKey: true });
      else { for (const target of targets) target.set('isused', action === 'enable'); await Parse.Object.saveAll(targets, { useMasterKey: true }); }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'dictionary-' + action, className, target.id);
      return response.json({ success: true, data: { action, updated: targets.length, results: action === 'delete' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'saveGradeCategory') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const cateName = String(payload.cateName || '').trim(); const remark = String(payload.remark || '').trim();
      const aliases = String(payload.gradeField || '').split(/\r?\n|\|/).map((value) => value.trim()).filter(Boolean); const gradeField = aliases.join('|');
      if (!cateName || cateName.length > 50) fail(400, '多级字典分类名称长度应为 1 至 50 位');
      if (remark.length > 255) fail(400, '多级字典分类备注不能超过 255 位');
      if (aliases.length < 2 || gradeField.length > 500) fail(400, '层级别名至少填写 2 级，且总长度不能超过 500 位');
      let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '多级字典分类必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('GradeCate'); let target;
      if (objectId) { const query = new Parse.Query('GradeCate'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; }
      else target = new Parse.Object('GradeCate');
      const duplicateQuery = new Parse.Query('GradeCate'); applyTenant(duplicateQuery, fields, context, input.companyId); duplicateQuery.limit(1000); const duplicates = await duplicateQuery.find({ useMasterKey: true });
      if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('cateName') || '').trim().toLowerCase() === cateName.toLowerCase())) fail(409, '同一帐套的多级字典分类名称不能重复');
      target.set('cateName', cateName); target.set('remark', remark); target.set('gradeField', gradeField); target.set('company', company);
      if (objectId) { try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '多级字典分类写入失败: ' + String(error && error.message || error)); } }
      else {
        let lastError;
        for (let attempt = 0; attempt < 5; attempt++) {
          const categories = new Parse.Query('GradeCate'); categories.limit(1000); const options = new Parse.Query('Grade'); options.limit(1000);
          const [categoryRows, optionRows] = await Promise.all([categories.find({ useMasterKey: true }), options.find({ useMasterKey: true })]);
          const nextId = Math.max(0, ...categoryRows.map((entry) => Number(entry.get('cateId')) || 0), ...optionRows.map((entry) => Number(entry.get('cate')) || 0)) + 1;
          target.set('cateId', nextId); target.set('sourceKey', '[["CateID",' + nextId + ']]');
          try { await target.save(null, { useMasterKey: true }); lastError = null; break; }
          catch (error) { lastError = error; if (!(Number(error && error.code) === 137 || /duplicate|unique/i.test(String(error && error.message || '')))) break; }
        }
        if (lastError || !target.id) fail(422, '多级字典分类原子编号写入失败: ' + String(lastError && lastError.message || lastError || '无法分配编号'));
      }
      await audit({ ...context, company }, objectId ? 'update-grade-category' : 'create-grade-category', 'GradeCate', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveGradeOption') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const gradeName = String(payload.gradeName || '').trim();
      if (!gradeName || gradeName.length > 50) fail(400, '多级字典选项名称长度应为 1 至 50 位');
      let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '多级字典选项必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('Grade'); let target; let categoryId; let parentId; let level;
      if (objectId) {
        const query = new Parse.Query('Grade'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId;
        categoryId = Number(target.get('cate')) || 0; parentId = Number(target.get('parentId')) || 0; level = Number(target.get('grade')) || 0;
      } else { target = new Parse.Object('Grade'); categoryId = Number(input.categoryId == null ? payload.cate || 0 : input.categoryId); parentId = Number(input.parentId == null ? payload.parentId || 0 : input.parentId); level = 1; }
      if (!Number.isInteger(categoryId) || categoryId < 1 || !Number.isInteger(parentId) || parentId < 0) fail(400, '多级字典分类或父选项编号无效');
      const categoryFields = await schemaFor('GradeCate'); const categoryQuery = new Parse.Query('GradeCate'); applyTenant(categoryQuery, categoryFields, context, input.companyId); categoryQuery.equalTo('cateId', categoryId); const category = await categoryQuery.first({ useMasterKey: true });
      if (!category || pointerId(category.get('company')) !== companyId) fail(404, '多级字典分类不存在或不属于当前帐套');
      const aliases = String(category.get('gradeField') || '').split('|').map((value) => value.trim()).filter(Boolean);
      if (!objectId && parentId > 0) { const parentQuery = new Parse.Query('Grade'); applyTenant(parentQuery, fields, context, input.companyId); parentQuery.equalTo('gradeId', parentId); const parent = await parentQuery.first({ useMasterKey: true }); if (!parent || Number(parent.get('cate')) !== categoryId || pointerId(parent.get('company')) !== companyId) fail(404, '父选项不存在、分类不一致或不属于当前帐套'); level = Number(parent.get('grade')) + 1; }
      if (!Number.isInteger(level) || level < 1 || level > aliases.length) fail(409, '当前层级已超过分类定义的层级别名');
      const duplicateQuery = new Parse.Query('Grade'); applyTenant(duplicateQuery, fields, context, input.companyId); duplicateQuery.equalTo('cate', categoryId); duplicateQuery.equalTo('parentId', parentId); duplicateQuery.limit(1000); const duplicates = await duplicateQuery.find({ useMasterKey: true });
      if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('gradeName') || '').trim().toLowerCase() === gradeName.toLowerCase())) fail(409, '同一父级下的多级字典选项名称不能重复');
      target.set('gradeName', gradeName); target.set('cate', categoryId); target.set('parentId', parentId); target.set('grade', level); target.set('company', company);
      if (objectId) { try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '多级字典选项写入失败: ' + String(error && error.message || error)); } }
      else {
        let lastError;
        for (let attempt = 0; attempt < 5; attempt++) {
          const allOptions = new Parse.Query('Grade'); allOptions.limit(1000); const optionRows = await allOptions.find({ useMasterKey: true }); const nextId = Math.max(0, ...optionRows.map((entry) => Number(entry.get('gradeId')) || 0)) + 1;
          target.set('gradeId', nextId); target.set('sourceKey', '[["GradeID",' + nextId + ']]');
          try { await target.save(null, { useMasterKey: true }); lastError = null; break; }
          catch (error) { lastError = error; if (!(Number(error && error.code) === 137 || /duplicate|unique/i.test(String(error && error.message || '')))) break; }
        }
        if (lastError || !target.id) fail(422, '多级字典选项原子编号写入失败: ' + String(lastError && lastError.message || lastError || '无法分配编号'));
      }
      await audit({ ...context, company }, objectId ? 'update-grade-option' : 'create-grade-option', 'Grade', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'gradeCategories') {
      const fields = await schemaFor('GradeCate'); const query = new Parse.Query('GradeCate'); applyTenant(query, fields, context, input.companyId); query.ascending('cateId'); query.limit(1000); const results = await query.find({ useMasterKey: true });
      return response.json({ success: true, data: { results: results.map(serializeObject) } });
    }
    if (operation === 'gradeOptions') {
      const categoryId = Number(input.categoryId || 0); const parentId = input.parentId == null || input.parentId === '' ? -1 : Number(input.parentId); if (!Number.isInteger(categoryId) || categoryId < 1 || !Number.isInteger(parentId) || parentId < -1) fail(400, '多级字典筛选条件无效');
      const fields = await schemaFor('Grade'); const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const query = new Parse.Query('Grade'); applyTenant(query, fields, context, input.companyId); query.equalTo('cate', categoryId); if (parentId >= 0) query.equalTo('parentId', parentId);
      const search = String(input.search || '').trim(); if (search) query.matches('gradeName', escapeRegex(search), 'i'); const total = await query.count({ useMasterKey: true }); query.ascending('gradeId'); query.skip((page - 1) * pageSize); query.limit(pageSize); const results = await query.find({ useMasterKey: true });
      return response.json({ success: true, data: { className: 'Grade', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'gradeBatch') {
      const className = String(input.className || ''); if (!['GradeCate','Grade'].includes(className) || String(input.action || '') !== 'delete') fail(400, '不支持的多级字典批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条多级字典记录');
      const fields = await schemaFor(className); const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分多级字典记录不存在或不属于当前帐套');
      if (className === 'GradeCate') { const ids = targets.map((target) => Number(target.get('cateId')) || 0); const optionFields = await schemaFor('Grade'); const refs = new Parse.Query('Grade'); applyTenant(refs, optionFields, context, input.companyId); refs.containedIn('cate', ids); if (await refs.count({ useMasterKey: true })) fail(409, '多级字典分类仍有选项，不能删除'); }
      else { const ids = targets.map((target) => Number(target.get('gradeId')) || 0); const refs = new Parse.Query('Grade'); applyTenant(refs, fields, context, input.companyId); refs.containedIn('parentId', ids); if (await refs.count({ useMasterKey: true })) fail(409, '多级字典选项仍有下级选项，不能删除'); }
      await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'grade-delete', className, target.id);
      return response.json({ success: true, data: { action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'saveCurrency') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const title = String(payload.title || '').trim(); const currencyName = String(payload.currencyName || '').trim().toUpperCase(); const currencySymbol = String(payload.currencySymbol || '').trim(); const exchange = Number(payload.currentExchange); const remark = String(payload.remark || '').trim();
      if (!title || title.length > 50) fail(400, '货币名称长度应为 1 至 50 位');
      if (!/^[A-Z][A-Z0-9]{1,9}$/.test(currencyName)) fail(400, '货币代码应为 2 至 10 位大写字母或数字');
      if (!currencySymbol || currencySymbol.length > 16) fail(400, '货币符号长度应为 1 至 16 位');
      if (!Number.isFinite(exchange) || exchange <= 0 || exchange > 1000000000) fail(400, '当前汇率必须是大于 0 的有效数字');
      if (remark.length > 255) fail(400, '货币备注不能超过 255 位');
      let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '货币必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('Currency'); let target;
      if (!objectId) fail(501, 'migration_blocked: Currency.id 与 Parse 对象保留 id 冲突，且 PostgreSQL 物理表缺少可写旧 ID 列，不能安全新增货币');
      { const query = new Parse.Query('Currency'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; }
      const duplicateQuery = new Parse.Query('Currency'); applyTenant(duplicateQuery, fields, context, input.companyId); duplicateQuery.limit(1000); const duplicates = await duplicateQuery.find({ useMasterKey: true });
      if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('title') || '').trim().toLowerCase() === title.toLowerCase())) fail(409, '同一帐套的货币名称不能重复');
      if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('currencyName') || '').trim().toUpperCase() === currencyName)) fail(409, '同一帐套的货币代码不能重复');
      target.set('title', title); target.set('currencyName', currencyName); target.set('currencySymbol', currencySymbol); target.set('currentExchange', exchange); target.set('remark', remark); target.set('company', company);
      try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '货币写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-currency' : 'create-currency', 'Currency', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'currencyBatch') {
      if (String(input.className || '') !== 'Currency' || String(input.action || '') !== 'delete') fail(400, '不支持的货币批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条货币记录');
      const fields = await schemaFor('Currency'); const query = new Parse.Query('Currency'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分货币记录不存在或不属于当前帐套'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'currency-delete', 'Currency', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'saveHoliday') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      if (!objectId) fail(501, 'migration_blocked: SysHoliday.id 与 Parse 对象保留 id 冲突，且 PostgreSQL 物理表缺少可写旧 ID 列，不能安全新增节假日');
      const name = String(payload.name || '').trim(); const htype = String(payload.htype || '').trim(); const hdate = String(payload.hdate || '').trim();
      const hdateStart = Number(payload.hdateStart); const hdateEnd = Number(payload.hdateEnd); const zstatus = Number(payload.zstatus);
      const strings = { ztype: String(payload.ztype || '').trim(), himage: String(payload.himage || '').trim(), remind: String(payload.remind || '').trim(), heffect: String(payload.heffect || '').trim(), hcontent: String(payload.hcontent || '').trim() };
      if (!name || name.length > 100) fail(400, '节假日名称长度应为 1 至 100 位');
      if (!['公历','农历'].includes(htype)) fail(400, '节假日类型只能是公历或农历');
      if (!/^(0[1-9]|1[0-2])月(0[1-9]|[12][0-9]|3[01])日$/.test(hdate)) fail(400, '节假日日期必须使用 MM月DD日 格式');
      if (!Number.isInteger(hdateStart) || hdateStart < 0 || hdateStart > 365 || !Number.isInteger(hdateEnd) || hdateEnd < 0 || hdateEnd > 365) fail(400, '提前与延后影响天数必须是 0 至 365 的整数');
      if (![0,99].includes(zstatus)) fail(400, '节假日状态只能是停用或启用');
      if (strings.ztype.length > 100 || strings.himage.length > 500 || strings.remind.length > 1000 || strings.heffect.length > 500 || strings.hcontent.length > 4000) fail(400, '节假日文本字段超过允许长度');
      const fields = await schemaFor('SysHoliday'); const query = new Parse.Query('SysHoliday'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      const duplicateQuery = new Parse.Query('SysHoliday'); applyTenant(duplicateQuery, fields, context, input.companyId); duplicateQuery.limit(1000); const duplicates = await duplicateQuery.find({ useMasterKey: true });
      if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('name') || '').trim().toLowerCase() === name.toLowerCase() && String(entry.get('htype') || '') === htype && String(entry.get('hdate') || '') === hdate)) fail(409, '同一帐套的节假日名称、类型和日期不能完全重复');
      target.set('name', name); target.set('htype', htype); target.set('hdate', hdate); target.set('hdateStart', hdateStart); target.set('hdateEnd', hdateEnd); target.set('zstatus', zstatus);
      for (const [field, value] of Object.entries(strings)) target.set(field, value);
      try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '节假日写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-holiday', 'SysHoliday', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'holidayBatch') {
      if (String(input.className || '') !== 'SysHoliday' || String(input.action || '') !== 'delete') fail(400, '不支持的节假日批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条节假日记录');
      const fields = await schemaFor('SysHoliday'); const query = new Parse.Query('SysHoliday'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分节假日记录不存在或不属于当前帐套'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'holiday-delete', 'SysHoliday', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'searchNavigations') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const type = Number(input.type == null ? 1 : input.type); const state = Number(input.state == null ? -100 : input.state); const elite = Number(input.elite == null ? -100 : input.elite);
      if (![1,2].includes(type) || ![-100,1,2].includes(state) || ![-100,0,1].includes(elite)) fail(400, '快捷入口筛选条件无效');
      const fields = await schemaFor('Search'); const query = new Parse.Query('Search'); applyTenant(query, fields, context, input.companyId); query.limit(1000); const search = String(input.search || '').trim().toLowerCase();
      let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => Number(entry.get('type')) === type && (state === -100 || Number(entry.get('state')) === state) && (elite === -100 || (elite === 1 ? Number(entry.get('eliteLevel')) > 0 : Number(entry.get('eliteLevel')) === 0)) && (!search || String(entry.get('name') || '').toLowerCase().includes(search) || String(entry.get('fileUrl') || '').toLowerCase().includes(search)));
      results.sort((left, right) => Number(left.get('orderId') || 0) - Number(right.get('orderId') || 0) || Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize);
      return response.json({ success: true, data: { className: 'Search', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveSearchNavigation') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      if (!objectId) fail(501, 'migration_blocked: Search.id 与 Parse 对象保留 id 冲突，且 PostgreSQL 物理表缺少可写旧 ID 列，不能安全新增快捷入口');
      const name = String(payload.name || '').trim(); const fileUrl = String(payload.fileUrl || '').trim(); const ico = String(payload.ico || '').trim(); const bkcolor = String(payload.bkcolor || '').trim(); const userGroup = String(payload.userGroup || '').trim();
      const openType = Number(payload.openType); const mobile = Number(payload.mobile); const size = Number(payload.size); const eliteLevel = Number(payload.eliteLevel);
      if (!name || name.length > 100) fail(400, '快捷入口名称长度应为 1 至 100 位');
      if (!fileUrl || fileUrl.length > 500 || !fileUrl.startsWith('/') || fileUrl.startsWith('//') || /^[a-z]+:/i.test(fileUrl)) fail(400, '快捷入口地址必须是 1 至 500 位的站内路径');
      if (ico.length > 100 || (bkcolor && !/^#[0-9a-f]{6}$/i.test(bkcolor))) fail(400, '图标或背景颜色格式无效');
      if (![0,1].includes(openType) || ![0,1].includes(mobile) || !Number.isInteger(size) || size < 1 || size > 4 || !Number.isInteger(eliteLevel) || eliteLevel < 0 || eliteLevel > 10) fail(400, '快捷入口展示参数无效');
      if (userGroup && !/^\d+(,\d+)*$/.test(userGroup)) fail(400, '用户组必须使用逗号分隔的正整数 ID');
      const fields = await schemaFor('Search'); const query = new Parse.Query('Search'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      target.set('name', name); target.set('fileUrl', fileUrl); target.set('ico', ico); target.set('openType', openType); target.set('mobile', mobile); target.set('size', size); target.set('bkcolor', bkcolor); target.set('userGroup', userGroup); target.set('eliteLevel', eliteLevel);
      try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '快捷入口写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-search-navigation', 'Search', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'searchNavigationBatch') {
      if (String(input.className || '') !== 'Search') fail(400, '只能处理快捷入口'); const action = String(input.action || '');
      if (action === 'starturl') fail(501, 'migration_blocked: 目标云函数架构没有旧 SiteConfig.SiteOption.Admin_StartUrl 持久层，不能伪造全局后台起始页');
      if (!['enable','disable','elite','unelite','delete','order'].includes(action)) fail(400, '不支持的快捷入口批量操作');
      let requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; let orders = [];
      if (action === 'order') { orders = Array.isArray(input.orders) ? input.orders.map((entry) => ({ objectId: String(entry && entry.objectId || '').trim(), orderId: Number(entry && entry.orderId) })) : []; if (!orders.length || orders.length > 100 || orders.some((entry) => !entry.objectId || !Number.isInteger(entry.orderId) || entry.orderId < 1 || entry.orderId > 1000000)) fail(400, '排序必须包含 1 至 100 条有效入口及正整数顺序'); requestedIds = orders.map((entry) => entry.objectId); }
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100 || (action === 'order' && objectIds.length !== orders.length)) fail(400, '每次请选择 1 至 100 条唯一快捷入口');
      const fields = await schemaFor('Search'); const query = new Parse.Query('Search'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分快捷入口不存在或不属于当前帐套');
      if (action === 'delete') await Parse.Object.destroyAll(targets, { useMasterKey: true });
      else { const orderMap = new Map(orders.map((entry) => [entry.objectId, entry.orderId])); for (const target of targets) { if (action === 'enable') target.set('state', 1); else if (action === 'disable') target.set('state', 2); else if (action === 'elite') target.set('eliteLevel', 1); else if (action === 'unelite') target.set('eliteLevel', 0); else target.set('orderId', orderMap.get(target.id)); } await Parse.Object.saveAll(targets, { useMasterKey: true }); }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'search-navigation-' + action, 'Search', target.id); return response.json({ success: true, data: { action, updated: targets.length, results: action === 'delete' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'adZones') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(1000, Math.max(1, Number(input.pageSize) || 20)); const status = Number(input.status == null ? -100 : input.status); const type = String(input.type || '').trim(); const search = String(input.search || '').trim().toLowerCase();
      if (![-100,0,99].includes(status) || type.length > 50 || search.length > 100) fail(400, '广告位筛选条件无效');
      const fields = await schemaFor('AdZone'); const query = new Parse.Query('AdZone'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true });
      results = results.filter((entry) => (status === -100 || Number(entry.get('zstatus')) === status) && (!type || String(entry.get('ztype') || '') === type) && (!search || [entry.get('name'),entry.get('remind'),entry.get('ztype')].some((value) => String(value || '').toLowerCase().includes(search))));
      results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize);
      return response.json({ success: true, data: { className: 'AdZone', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'adInfos') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const status = Number(input.status == null ? -100 : input.status); const zoneId = String(input.zoneId || '').trim(); const search = String(input.search || '').trim().toLowerCase();
      if (![-100,0,99].includes(status) || (zoneId && !/^\d+$/.test(zoneId)) || search.length > 100) fail(400, '广告内容筛选条件无效');
      const fields = await schemaFor('AdInfo'); const query = new Parse.Query('AdInfo'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true });
      results = results.filter((entry) => (status === -100 || Number(entry.get('zstatus')) === status) && (!zoneId || String(entry.get('zoneId') || '') === zoneId) && (!search || [entry.get('name'),entry.get('linkUrl'),entry.get('text'),entry.get('remind')].some((value) => String(value || '').toLowerCase().includes(search))));
      results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize);
      return response.json({ success: true, data: { className: 'AdInfo', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveAdZone') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      if (!objectId) fail(501, 'migration_blocked: AdZone.id 与 Parse 对象保留 id 冲突，且省略 id 创建不会生成旧广告位编号，不能安全新增广告位');
      const name = String(payload.name || '').trim(); const remind = String(payload.remind || '').trim(); const ztype = String(payload.ztype || '').trim(); const showType = String(payload.showType || '').trim(); const zstatus = Number(payload.zstatus);
      if (!name || name.length > 100 || remind.length > 2000 || !ztype || ztype.length > 50 || !showType || showType.length > 50 || ![0,99].includes(zstatus)) fail(400, '广告位名称、类型、展示方式、状态或备注无效');
      const fields = await schemaFor('AdZone'); const query = new Parse.Query('AdZone'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      target.set('name', name); target.set('remind', remind); target.set('ztype', ztype); target.set('showType', showType); target.set('zstatus', zstatus); const adminId = Number(context.current.get('legacyUserId')) || 0; if (adminId) target.set('cadmin', adminId);
      try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '广告位写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-ad-zone', 'AdZone', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveAdInfo') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      if (!objectId) fail(501, 'migration_blocked: AdInfo.id 与 Parse 对象保留 id 冲突，且省略 id 创建不会生成旧广告编号，不能安全新增广告内容');
      const name = String(payload.name || '').trim(); const zoneId = String(input.zoneId == null ? payload.zoneId || '' : input.zoneId).trim(); const hasPriority = Object.prototype.hasOwnProperty.call(payload, 'priority'); const priority = hasPriority ? Number(payload.priority) : 0; const zstatus = Number(payload.zstatus);
      const valueOfDate = (value) => value && typeof value === 'object' && value.iso ? value.iso : value; const sdate = new Date(valueOfDate(payload.sdate)); const edate = new Date(valueOfDate(payload.edate));
      const strings = { linkUrl: String(payload.linkUrl || '').trim(), text: String(payload.text || ''), html: String(payload.html || ''), images: String(payload.images || '').trim(), image: String(payload.image || '').trim(), remind: String(payload.remind || '').trim(), style: String(payload.style || '') };
      if (!name || name.length > 100 || !/^\d+$/.test(zoneId) || (hasPriority && (String(payload.priority).trim() === '' || !Number.isInteger(priority) || priority < 0 || priority > 1000000)) || ![0,99].includes(zstatus)) fail(400, '广告名称、广告位、权重或状态无效');
      if (Number.isNaN(sdate.getTime()) || Number.isNaN(edate.getTime()) || edate < sdate) fail(400, '广告到期时间必须大于或等于开始时间');
      if (strings.linkUrl.length > 2000 || strings.text.length > 20000 || strings.html.length > 200000 || strings.images.length > 10000 || strings.image.length > 2000 || strings.remind.length > 2000 || strings.style.length > 10000) fail(400, '广告内容字段超过允许长度');
      const zoneFields = await schemaFor('AdZone'); const zoneQuery = new Parse.Query('AdZone'); applyTenant(zoneQuery, zoneFields, context, input.companyId); zoneQuery.limit(1000); const zones = await zoneQuery.find({ useMasterKey: true }); if (!zones.some((entry) => String(entry.get('id') || '') === zoneId)) fail(404, '目标广告位不存在或不属于当前帐套');
      const fields = await schemaFor('AdInfo'); const query = new Parse.Query('AdInfo'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      target.set('name', name); target.set('zoneId', zoneId); if (hasPriority) target.set('priority', String(priority)); target.set('zstatus', zstatus); target.set('sdate', sdate); target.set('edate', edate); for (const [field, value] of Object.entries(strings)) if (Object.prototype.hasOwnProperty.call(payload, field)) target.set(field, value);
      try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '广告内容写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-ad-info', 'AdInfo', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'adZoneBatch') {
      if (String(input.className || '') !== 'AdZone') fail(400, '只能处理广告位'); const action = String(input.action || ''); if (!['active','pause','delete'].includes(action)) fail(400, '不支持的广告位批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个广告位');
      const fields = await schemaFor('AdZone'); const query = new Parse.Query('AdZone'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分广告位不存在或不属于当前帐套');
      if (action === 'delete') { const zoneIds = new Set(targets.map((target) => String(target.get('id') || ''))); const infoFields = await schemaFor('AdInfo'); const refsQuery = new Parse.Query('AdInfo'); applyTenant(refsQuery, infoFields, context, input.companyId); refsQuery.limit(1000); const refs = await refsQuery.find({ useMasterKey: true }); if (refs.length >= 1000) fail(409, '广告内容数量超过安全核验上限，不能删除广告位'); if (refs.some((entry) => zoneIds.has(String(entry.get('zoneId') || '')))) fail(409, '广告位仍有关联广告内容，不能删除'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); }
      else { for (const target of targets) target.set('zstatus', action === 'active' ? 99 : 0); await Parse.Object.saveAll(targets, { useMasterKey: true }); }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'ad-zone-' + action, 'AdZone', target.id); return response.json({ success: true, data: { action, updated: targets.length, results: action === 'delete' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'adInfoBatch') {
      if (String(input.className || '') !== 'AdInfo') fail(400, '只能处理广告内容'); const action = String(input.action || ''); if (!['audit','unaudit','delete'].includes(action)) fail(400, '不支持的广告内容批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条广告内容');
      const fields = await schemaFor('AdInfo'); const query = new Parse.Query('AdInfo'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分广告内容不存在或不属于当前帐套');
      if (action === 'delete') await Parse.Object.destroyAll(targets, { useMasterKey: true }); else { for (const target of targets) target.set('zstatus', action === 'audit' ? 99 : 0); await Parse.Object.saveAll(targets, { useMasterKey: true }); }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'ad-info-' + action, 'AdInfo', target.id); return response.json({ success: true, data: { action, updated: targets.length, results: action === 'delete' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'adPreview') {
      const objectId = String(input.zoneObjectId || ''); if (!objectId) fail(400, '缺少广告位 objectId'); const zoneFields = await schemaFor('AdZone'); const zoneQuery = new Parse.Query('AdZone'); applyTenant(zoneQuery, zoneFields, context, input.companyId); const zone = await zoneQuery.get(objectId, { useMasterKey: true }); const zoneId = String(zone.get('id') || '');
      const infoFields = await schemaFor('AdInfo'); const infoQuery = new Parse.Query('AdInfo'); applyTenant(infoQuery, infoFields, context, input.companyId); infoQuery.limit(1000); const now = Date.now(); let results = await infoQuery.find({ useMasterKey: true }); results = results.filter((entry) => String(entry.get('zoneId') || '') === zoneId && Number(entry.get('zstatus')) === 99 && (!entry.get('sdate') || new Date(entry.get('sdate')).getTime() <= now) && (!entry.get('edate') || new Date(entry.get('edate')).getTime() >= now)); results.sort((left, right) => Number(right.get('priority') || 0) - Number(left.get('priority') || 0) || Number(left.get('id') || 0) - Number(right.get('id') || 0));
      return response.json({ success: true, data: { zone: serializeObject(zone), total: results.length, results: results.map(serializeObject) } });
    }
    if (operation === 'fontShapeTypes') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(1000, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '图形分类搜索词过长');
      const fields = await schemaFor('FontPicShapeType'); const query = new Parse.Query('FontPicShapeType'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => !search || [entry.get('name'),entry.get('remarks')].some((value) => String(value || '').toLowerCase().includes(search))); results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize);
      return response.json({ success: true, data: { className: 'FontPicShapeType', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'fontShapes') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const typeId = Number(input.typeId || 0); const search = String(input.search || '').trim().toLowerCase(); if (!Number.isInteger(typeId) || typeId < 0 || search.length > 100) fail(400, '图形素材筛选条件无效');
      const fields = await schemaFor('FontPicShape'); const query = new Parse.Query('FontPicShape'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => (!typeId || Number(entry.get('typeId')) === typeId) && (!search || [entry.get('name'),entry.get('remarks'),entry.get('userName')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize);
      return response.json({ success: true, data: { className: 'FontPicShape', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveFontShapeType') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: FontPicShapeType.id 与 Parse 保留 id 冲突，且省略 id 创建不会生成旧分类编号，不能安全新增图形分类');
      const name = String(payload.name || '').trim(); const remarks = String(payload.remarks || '').trim(); if (!name || name.length > 100 || remarks.length > 2000) fail(400, '图形分类名称或备注无效');
      const fields = await schemaFor('FontPicShapeType'); const query = new Parse.Query('FontPicShapeType'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); target.set('name', name); target.set('remarks', remarks); target.set('updateTime', new Date());
      try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '图形分类写入失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-font-shape-type', 'FontPicShapeType', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveFontShape') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: FontPicShape.id 与 Parse 保留 id 冲突，且省略 id 创建不会生成旧素材编号，不能安全新增图形素材');
      if (input.file) fail(501, 'migration_blocked: 当前 Parse Server 的 SDK 与 /files REST 接口均错误调用 MongoDB 文件适配器，而本项目使用 PostgreSQL；修复服务端文件存储配置前不能替换图形文件');
      const name = String(payload.name || '').trim(); const remarks = String(payload.remarks || '').trim(); const typeId = Number(input.typeId == null ? payload.typeId || 0 : input.typeId); if (!name || name.length > 100 || remarks.length > 2000 || !Number.isInteger(typeId) || typeId < 1) fail(400, '图形素材名称、分类或备注无效');
      const typeFields = await schemaFor('FontPicShapeType'); const typeQuery = new Parse.Query('FontPicShapeType'); applyTenant(typeQuery, typeFields, context, input.companyId); typeQuery.limit(1000); const types = await typeQuery.find({ useMasterKey: true }); if (!types.some((entry) => Number(entry.get('id')) === typeId)) fail(404, '目标图形分类不存在或不属于当前帐套');
      const fields = await schemaFor('FontPicShape'); const query = new Parse.Query('FontPicShape'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      target.set('name', name); target.set('typeId', typeId); target.set('remarks', remarks); target.set('updateTime', new Date()); try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '图形素材写入失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-font-shape', 'FontPicShape', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'fontShapeTypeBatch') {
      if (String(input.className || '') !== 'FontPicShapeType' || String(input.action || '') !== 'delete') fail(400, '不支持的图形分类批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个图形分类');
      const fields = await schemaFor('FontPicShapeType'); const query = new Parse.Query('FontPicShapeType'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分图形分类不存在或不属于当前帐套'); const typeIds = new Set(targets.map((entry) => Number(entry.get('id'))).filter((value) => value > 0));
      if (typeIds.size) { const shapeFields = await schemaFor('FontPicShape'); const refsQuery = new Parse.Query('FontPicShape'); applyTenant(refsQuery, shapeFields, context, input.companyId); refsQuery.limit(1000); const refs = await refsQuery.find({ useMasterKey: true }); if (refs.length >= 1000) fail(409, '图形素材数量超过安全核验上限，不能删除分类'); if (refs.some((entry) => typeIds.has(Number(entry.get('typeId'))))) fail(409, '图形分类仍有素材引用，不能删除'); }
      await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-font-shape-type', 'FontPicShapeType', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'fontShapeBatch') {
      if (String(input.className || '') !== 'FontPicShape' || String(input.action || '') !== 'delete') fail(400, '不支持的图形素材批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个图形素材');
      const fields = await schemaFor('FontPicShape'); const query = new Parse.Query('FontPicShape'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分图形素材不存在或不属于当前帐套'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-font-shape', 'FontPicShape', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'designResources') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const type = String(input.type || '').trim().toLowerCase(); const search = String(input.search || '').trim().toLowerCase(); if (type.length > 32 || search.length > 100) fail(400, '设计资源筛选条件无效');
      const fields = await schemaFor('DesignRes'); const query = new Parse.Query('DesignRes'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => (!type || String(entry.get('ztype') || '').toLowerCase() === type) && (!search || [entry.get('name'),entry.get('useage'),entry.get('vpath'),entry.get('previewimg')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize);
      return response.json({ success: true, data: { className: 'DesignRes', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveDesignResource') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      if (!objectId) fail(501, 'migration_blocked: 新增设计资源必须上传原文件并分配 DesignRes.id；当前 PostgreSQL Parse 文件适配器配置错误，且 id 与 Parse 保留属性冲突');
      if (input.file || input.cover) fail(501, 'migration_blocked: 当前 Parse Server 的 SDK 与 /files REST 接口均错误调用 MongoDB 文件适配器，本项目使用 PostgreSQL；修复服务端文件存储前不能新增或替换设计资源文件');
      const name = String(payload.name || '').trim(); const ztype = String(payload.ztype || '').trim(); const useage = String(payload.useage || '').trim(); const style = String(payload.style || ''); const use = String(payload.use || ''); const fun = String(payload.fun || ''); const zstatus = Number(payload.zstatus == null || payload.zstatus === '' ? 0 : payload.zstatus);
      if (!name || name.length > 100 || !/^[a-zA-Z0-9_-]{1,32}$/.test(ztype) || useage.length > 100 || style.length > 20000 || use.length > 20000 || fun.length > 20000 || !Number.isInteger(zstatus) || zstatus < -100 || zstatus > 999) fail(400, '设计资源名称、类型、用途、状态或代码字段无效');
      const fields = await schemaFor('DesignRes'); const query = new Parse.Query('DesignRes'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true });
      target.set('name', name); target.set('ztype', ztype); target.set('useage', useage); target.set('style', style); target.set('use', use); target.set('fun', fun); target.set('zstatus', zstatus); try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '设计资源元数据写入失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-design-resource', 'DesignRes', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'designResourceBatch') {
      if (String(input.className || '') !== 'DesignRes' || String(input.action || '') !== 'delete') fail(400, '不支持的设计资源批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个设计资源');
      const fields = await schemaFor('DesignRes'); const query = new Parse.Query('DesignRes'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分设计资源不存在或不属于当前帐套'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-design-resource', 'DesignRes', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'roles') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const type = String(input.type || 'admin').trim().toLowerCase(); const search = String(input.search || '').trim().toLowerCase(); if (!['admin','user','-100'].includes(type) || search.length > 100) fail(400, '角色类型或搜索词无效');
      const fields = await schemaFor('Role'); const query = new Parse.Query('Role'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => (type === '-100' || String(entry.get('ztype') || 'admin').toLowerCase() === type) && (!search || [entry.get('roleName'),entry.get('description')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left, right) => Number(left.get('roleId') || 0) - Number(right.get('roleId') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize);
      return response.json({ success: true, data: { className: 'Role', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveRole') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const roleName = String(payload.roleName || '').trim(); const description = String(payload.description || '').trim(); const requestedType = String(input.roleType || payload.ztype || 'admin').trim().toLowerCase(); if (!roleName || roleName.length > 100 || description.length > 1000 || !['admin','user'].includes(requestedType)) fail(400, '角色名称、说明或类型无效');
      let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '角色必须指定帐套'); const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('Role'); let target; let created = false; let roleType = requestedType;
      if (objectId) { const query = new Parse.Query('Role'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; roleType = String(target.get('ztype') || 'admin').toLowerCase(); if (requestedType !== roleType) fail(400, '角色类型不允许在管理员角色与用户角色之间迁移'); } else { target = new Parse.Object('Role'); target.set('company', company); target.set('sourceKey', 'cloud:role:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('ztype', roleType); target.set('zstatus', 99); target.set('nodeId', 0); target.set('auth', ''); target.set('auth2', ''); target.set('auth3', ''); target.set('cdate', new Date()); target.set('cadminId', Number(context.current.get('legacyUserId') || (context.current.get('legacyUserData') || {}).UserID || 0)); created = true; }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "Role" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("roleName",\'\')))=LOWER($3) AND LOWER(COALESCE("ztype",\'admin\'))=$4 LIMIT 1', [companyId, objectId, roleName, roleType]); if (duplicate) fail(409, '同一帐套同一类型的角色名称不能重复'); target.set('roleName', roleName); target.set('description', description);
      try { await target.save(null, { useMasterKey: true }); if (created) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-role-id:\'||$1))),next_id AS MATERIALIZED (SELECT COALESCE(MAX("roleId"),0)+1 AS id FROM "Role",lock_row WHERE "company"=$1) UPDATE "Role" SET "roleId"=next_id.id,"sourceKey"=\'[["RoleID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!Number(rows[0] && rows[0].id)) throw new Error('无法分配角色编号'); } } catch (error) { if (created && target.id) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '角色保存失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || company }, objectId ? 'update-role' : 'create-role', 'Role', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'roleAuthorization') {
      const objectId = String(input.objectId || ''); if (!objectId) fail(400, '缺少角色 objectId'); const roleFields = await schemaFor('Role'); const roleQuery = new Parse.Query('Role'); applyTenant(roleQuery, roleFields, context, input.companyId); const role = await roleQuery.get(objectId, { useMasterKey: true }); const roleId = Number(role.get('roleId')) || 0; if (!roleId) fail(409, '角色缺少旧数字 ID'); const authFields = await schemaFor('ARoleAuth'); const authQuery = new Parse.Query('ARoleAuth'); applyTenant(authQuery, authFields, { ...context, company: role.get('company') || context.company }, pointerId(role.get('company'))); authQuery.equalTo('rid', roleId); authQuery.limit(2); const authRows = await authQuery.find({ useMasterKey: true }); if (authRows.length > 1) fail(409, '角色存在重复权限记录'); const names = ['model','content','shop','page','exam','user','system','office','portable','sites','other','extend']; const authorization = authRows[0] ? serializeObject(authRows[0]) : { rid: roleId }; for (const name of names) if (!Object.prototype.hasOwnProperty.call(authorization, name)) authorization[name] = '';
      return response.json({ success: true, data: { ...serializeObject(role), authorization } });
    }
    if (operation === 'saveRoleAuthorization') {
      const roleObjectId = String(input.roleObjectId || input.objectId || ''); const payload = input.authorization && typeof input.authorization === 'object' ? input.authorization : {}; if (!roleObjectId) fail(400, '缺少角色 objectId'); const roleFields = await schemaFor('Role'); const roleQuery = new Parse.Query('Role'); applyTenant(roleQuery, roleFields, context, input.companyId); const role = await roleQuery.get(roleObjectId, { useMasterKey: true }); const roleId = Number(role.get('roleId')) || 0; const companyId = pointerId(role.get('company')) || pointerId(context.company); if (!roleId || !companyId) fail(409, '角色缺少旧编号或帐套'); const names = ['model','content','shop','page','exam','user','system','office','portable','sites','other','extend']; const normalized = {}; let totalLength = 0; for (const name of names) { const values = [...new Set(String(payload[name] || '').split(',').map((value) => value.trim()).filter(Boolean))]; if (values.length > 100 || values.some((value) => !/^[A-Za-z0-9_.:-]{1,64}$/.test(value))) fail(400, '角色权限码格式无效'); normalized[name] = values.join(','); totalLength += normalized[name].length; } if (totalLength > 10000) fail(400, '角色权限码过长');
      const authFields = await schemaFor('ARoleAuth'); const authQuery = new Parse.Query('ARoleAuth'); applyTenant(authQuery, authFields, { ...context, company: role.get('company') || context.company }, companyId); authQuery.equalTo('rid', roleId); authQuery.limit(2); const rows = await authQuery.find({ useMasterKey: true }); if (rows.length > 1) fail(409, '角色存在重复权限记录'); let target = rows[0]; const created = !target; if (!target) { target = new Parse.Object('ARoleAuth'); target.set('company', role.get('company')); target.set('rid', roleId); target.set('sourceKey', 'cloud:role-auth:' + companyId + ':' + roleId + ':' + Date.now()); } for (const [name,value] of Object.entries(normalized)) target.set(name, value); target.set('adminId', Number(context.current.get('legacyUserId') || (context.current.get('legacyUserData') || {}).UserID || 0));
      try { await target.save(null, { useMasterKey: true }); if (created) { const assigned = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-role-auth-id:\'||$1))),next_id AS MATERIALIZED (SELECT COALESCE(MAX("id"),0)+1 AS id FROM "ARoleAuth",lock_row WHERE "company"=$1) UPDATE "ARoleAuth" SET "id"=next_id.id,"sourceKey"=\'[["ID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!Number(assigned[0] && assigned[0].id)) throw new Error('无法分配角色权限编号'); } } catch (error) { if (created && target.id) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '角色权限保存失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: role.get('company') || context.company }, created ? 'create-role-authorization' : 'update-role-authorization', 'ARoleAuth', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'roleBatch') {
      if (String(input.className || '') !== 'Role' || String(input.action || '') !== 'delete') fail(400, '不支持的角色批量操作'); const objectIds = [...new Set((Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]).map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个角色'); const fields = await schemaFor('Role'); const query = new Parse.Query('Role'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分角色不存在或不属于当前帐套'); const authFields = await schemaFor('ARoleAuth'); const authTargets = [];
      for (const target of targets) { const companyId = pointerId(target.get('company')); const roleId = Number(target.get('roleId')) || 0; if (!companyId || !roleId) fail(409, '角色缺少旧编号或帐套'); const refs = await Psql.one('SELECT (SELECT COUNT(*)::int FROM "Manager" WHERE "company"=$1 AND POSITION(\',\'||$2::text||\',\' IN \',\'||REPLACE(COALESCE("adminRole",\'\'),\' \',\'\')||\',\')>0) AS managers,(SELECT COUNT(*)::int FROM "_User" WHERE "company"=$1 AND POSITION(\',\'||$2::text||\',\' IN \',\'||REPLACE(COALESCE("legacyUserData"->>\'UserRole\',\'\'),\' \',\'\')||\',\')>0) AS users', [companyId, roleId]); if (Number(refs.managers) || Number(refs.users)) fail(409, '角色仍被管理员或用户引用，不能删除'); const authQuery = new Parse.Query('ARoleAuth'); applyTenant(authQuery, authFields, { ...context, company: target.get('company') || context.company }, companyId); authQuery.equalTo('rid', roleId); authQuery.limit(100); authTargets.push(...await authQuery.find({ useMasterKey: true })); }
      if (authTargets.length) await Parse.Object.destroyAll(authTargets, { useMasterKey: true }); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-role', 'Role', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length, deletedAuthorizations: authTargets.length } });
    }
    if (operation === 'legacyFontPicBlocker') {
      const action = String(input.action || ''); const blockers = { Index: '目标 Schema 缺少旧 FontPic 成品字体图主表与历史数据', FontPicInfo: '目标 Schema 缺少旧 FontPic 成品字体图详情数据', FontPicInfo_Submit: '目标 Schema 缺少旧 FontPic 成品字体图持久化模型', FontPic_API: '目标 Schema 缺少旧 FontPic 成品字体图可删除记录', Draft: '目标 Schema 缺少旧 FontPicDraft 草稿表与历史数据', DraftInfo: '目标 Schema 缺少旧 FontPicDraft 草稿详情数据', DraftInfo_Submit: '目标 Schema 缺少旧 FontPicDraft 草稿持久化模型', Draft_API: '目标 Schema 缺少旧 FontPicDraft 可删除记录' }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧字体图动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'surveys') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); const status = Number(input.status == null ? -100 : input.status); if (search.length > 100 || ![-100,0,99].includes(status)) fail(400, '问卷筛选条件无效');
      const fields = await schemaFor('DesignAsk'); const query = new Parse.Query('DesignAsk'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => (status === -100 || Number(entry.get('zstatus')) === status) && (!search || [entry.get('title'),entry.get('category'),entry.get('remind')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'DesignAsk', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'surveyQuestions') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const askId = Number(input.askId || 0); const search = String(input.search || '').trim().toLowerCase(); if (!Number.isInteger(askId) || askId < 1 || search.length > 100) fail(400, '问卷题目筛选条件无效');
      const askFields = await schemaFor('DesignAsk'); const askQuery = new Parse.Query('DesignAsk'); applyTenant(askQuery, askFields, context, input.companyId); askQuery.limit(1000); const asks = await askQuery.find({ useMasterKey: true }); if (!asks.some((entry) => Number(entry.get('id')) === askId)) fail(404, '问卷不存在或不属于当前帐套');
      const fields = await schemaFor('DesignQuestion'); const query = new Parse.Query('DesignQuestion'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => Number(entry.get('askId')) === askId && (!search || [entry.get('qtitle'),entry.get('qcontent'),entry.get('qoption')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left, right) => Number(left.get('orderId') || 0) - Number(right.get('orderId') || 0) || Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'DesignQuestion', askId, page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'surveyResults') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const askId = Number(input.askId || 0); if (!Number.isInteger(askId) || askId < 1) fail(400, '问卷答卷筛选条件无效');
      const askFields = await schemaFor('DesignAsk'); const askQuery = new Parse.Query('DesignAsk'); applyTenant(askQuery, askFields, context, input.companyId); askQuery.limit(1000); const asks = await askQuery.find({ useMasterKey: true }); if (!asks.some((entry) => Number(entry.get('id')) === askId)) fail(404, '问卷不存在或不属于当前帐套');
      const fields = await schemaFor('DesignAnswer'); const query = new Parse.Query('DesignAnswer'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => Number(entry.get('askId')) === askId); results.sort((left, right) => Number(right.get('id') || 0) - Number(left.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'DesignAnswer', askId, page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveSurvey') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: DesignAsk.id 与 Parse 保留 id 冲突，sourceKey 创建探测不能还原旧问卷编号，不能安全新增问卷');
      const title = String(payload.title || '').trim(); const category = String(payload.category || '').trim(); const remind = String(payload.remind || '').trim(); const preViewImg = String(payload.preViewImg || '').trim(); const startRaw = payload.startDate && typeof payload.startDate === 'object' ? payload.startDate.iso : payload.startDate; const endRaw = payload.endDate && typeof payload.endDate === 'object' ? payload.endDate.iso : payload.endDate; const startDate = new Date(String(startRaw || '')); const endDate = new Date(String(endRaw || '')); const ztype = Number(payload.ztype || 0); const ipinterval = Number(payload.ipinterval || 0); const zstatus = Number(payload.zstatus == null ? 0 : payload.zstatus); const flags = { isIplimit: Number(payload.isIplimit || 0), isNeedLogin: Number(payload.isNeedLogin || 0), isShowResult: Number(payload.isShowResult || 0), isEnableVcode: Number(payload.isEnableVcode || 0) };
      if (!title || title.length > 200 || category.length > 100 || remind.length > 10000 || preViewImg.length > 2000 || Number.isNaN(startDate.getTime()) || Number.isNaN(endDate.getTime()) || endDate < startDate || endDate.getTime() < Date.now() || !Number.isInteger(ztype) || ztype < 0 || !Number.isFinite(ipinterval) || ipinterval < 0 || ![0,99].includes(zstatus) || Object.values(flags).some((value) => ![0,1].includes(value))) fail(400, '问卷标题、时间、状态或访问设置无效');
      const fields = await schemaFor('DesignAsk'); const query = new Parse.Query('DesignAsk'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); target.set('title', title); target.set('category', category); target.set('remind', remind); target.set('preViewImg', preViewImg); target.set('startDate', startDate); target.set('endDate', endDate); target.set('ztype', ztype); target.set('ipinterval', ipinterval); target.set('zstatus', zstatus); for (const [name,value] of Object.entries(flags)) target.set(name, value); await target.save(null, { useMasterKey: true }); await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-survey', 'DesignAsk', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveSurveyQuestion') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: DesignQuestion.id 与 Parse 保留 id 冲突，sourceKey 创建探测不能还原旧题目编号，不能安全新增问卷题目');
      const qtitle = String(payload.qtitle || '').trim(); const qcontent = String(payload.qcontent || '').trim(); const qtype = String(payload.qtype || '').trim().toLowerCase(); const qoption = String(payload.qoption || '').trim(); const qflag = String(payload.qflag || '').trim(); const required = payload.required === true || payload.required === 1 || payload.required === '1' || payload.required === 'true' ? 1 : 0; if (!qtitle || qtitle.length > 1000 || qcontent.length > 20000 || !/^[a-z][a-z0-9_-]{0,30}$/.test(qtype) || qoption.length > 20000 || qflag.length > 5000) fail(400, '问卷题目内容或类型无效');
      if (['radio','checkbox'].includes(qtype)) { let options; try { options = JSON.parse(qoption); } catch { fail(400, '单选/多选题选项必须是有效 JSON 数组'); } if (!Array.isArray(options) || !options.length || options.length > 100 || options.some((item) => !item || typeof item !== 'object' || !String(item.text || '').trim() || String(item.text || '').length > 500 || String(item.value || '').length > 500)) fail(400, '单选/多选题选项格式无效'); }
      if (qflag) { let flag; try { flag = JSON.parse(qflag); } catch { fail(400, '题目扩展设置必须是有效 JSON'); } if (!flag || typeof flag !== 'object' || Array.isArray(flag)) fail(400, '题目扩展设置必须是 JSON 对象'); }
      const fields = await schemaFor('DesignQuestion'); const query = new Parse.Query('DesignQuestion'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); const askId = Number(target.get('askId') || 0); const askFields = await schemaFor('DesignAsk'); const askQuery = new Parse.Query('DesignAsk'); applyTenant(askQuery, askFields, context, input.companyId); askQuery.limit(1000); const asks = await askQuery.find({ useMasterKey: true }); if (!asks.some((entry) => Number(entry.get('id')) === askId)) fail(409, '题目所属问卷已不存在，不能继续编辑');
      target.set('qtitle', qtitle); target.set('qcontent', qcontent); target.set('qtype', qtype); target.set('qoption', qoption); target.set('qflag', qflag || '{}'); target.set('required', required); await target.save(null, { useMasterKey: true }); await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-survey-question', 'DesignQuestion', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'surveyBatch') {
      const className = String(input.className || ''); const action = String(input.action || ''); const allowed = className === 'DesignAsk' ? ['start','stop','delete'] : className === 'DesignQuestion' ? ['delete','sort'] : className === 'DesignAnswer' ? ['delete'] : []; if (!allowed.includes(action)) fail(400, '不支持的问卷批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条问卷记录');
      const fields = await schemaFor(className); const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分问卷记录不存在或不属于当前帐套');
      if (action === 'delete') await Parse.Object.destroyAll(targets, { useMasterKey: true }); else if (className === 'DesignAsk') { for (const target of targets) target.set('zstatus', action === 'start' ? 99 : 0); await Parse.Object.saveAll(targets, { useMasterKey: true }); } else { const orders = Array.isArray(input.orders) ? input.orders : []; const orderMap = new Map(orders.map((item) => [String(item && item.objectId || ''), Number(item && item.orderId)])); if (orderMap.size !== objectIds.length || [...orderMap.values()].some((value) => !Number.isInteger(value) || value < 1 || value > 1000000)) fail(400, '题目排序数据无效'); for (const target of targets) target.set('orderId', orderMap.get(target.id)); await Parse.Object.saveAll(targets, { useMasterKey: true }); }
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'survey-' + className + '-' + action, className, target.id); return response.json({ success: true, data: { className, action, updated: targets.length, results: action === 'delete' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'surveyResultChart') {
      const askId = Number(input.askId || 0); if (!Number.isInteger(askId) || askId < 1) fail(400, '缺少有效问卷编号'); const askFields = await schemaFor('DesignAsk'); const askQuery = new Parse.Query('DesignAsk'); applyTenant(askQuery, askFields, context, input.companyId); askQuery.limit(1000); const asks = await askQuery.find({ useMasterKey: true }); const survey = asks.find((entry) => Number(entry.get('id')) === askId); if (!survey) fail(404, '问卷不存在或不属于当前帐套');
      const questionFields = await schemaFor('DesignQuestion'); const questionQuery = new Parse.Query('DesignQuestion'); applyTenant(questionQuery, questionFields, context, input.companyId); questionQuery.limit(1000); const questions = (await questionQuery.find({ useMasterKey: true })).filter((entry) => Number(entry.get('askId')) === askId); const answerFields = await schemaFor('DesignAnswer'); const answerQuery = new Parse.Query('DesignAnswer'); applyTenant(answerQuery, answerFields, context, input.companyId); answerQuery.limit(1000); const answers = (await answerQuery.find({ useMasterKey: true })).filter((entry) => Number(entry.get('askId')) === askId); const counts = new Map(); let invalidAnswers = 0;
      for (const entry of answers) { let details; try { details = JSON.parse(String(entry.get('answer') || '')); } catch { invalidAnswers++; continue; } if (!Array.isArray(details)) { invalidAnswers++; continue; } for (const detail of details) { const qid = String(detail && detail.qid || ''); let values = detail && detail.answer; if (!Array.isArray(values)) values = values == null || values === '' ? [] : [values]; for (const value of values) { const key = qid + '\u0000' + String(value); counts.set(key, (counts.get(key) || 0) + 1); } } }
      const chart = questions.sort((left, right) => Number(left.get('orderId') || 0) - Number(right.get('orderId') || 0) || Number(left.get('id') || 0) - Number(right.get('id') || 0)).map((question) => { let options = []; try { const parsed = JSON.parse(String(question.get('qoption') || '[]')); if (Array.isArray(parsed)) options = parsed; } catch {} const qid = String(question.get('id') || ''); const known = new Set(options.map((option) => String(option && option.value || ''))); let otherCount = 0; for (const [key,value] of counts) if (key.startsWith(qid + '\u0000') && !known.has(key.slice(qid.length + 1))) otherCount += value; return { id: qid, title: String(question.get('qtitle') || ''), type: String(question.get('qtype') || ''), options: options.map((option) => ({ text: String(option && option.text || ''), value: String(option && option.value || ''), count: counts.get(qid + '\u0000' + String(option && option.value || '')) || 0 })), otherCount }; }); return response.json({ success: true, data: { survey: serializeObject(survey), responseCount: answers.length, invalidAnswers, questions: chart } });
    }
    if (operation === 'serviceSeats') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '客服席位搜索词过长'); const fields = await schemaFor('ServiceSeat'); const query = new Parse.Query('ServiceSeat'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => !search || [entry.get('sName'),entry.get('sRemrk')].some((value) => String(value || '').toLowerCase().includes(search))); results.sort((left, right) => Number(left.get('sIndex') || 0) - Number(right.get('sIndex') || 0) || Number(left.get('sId') || 0) - Number(right.get('sId') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'ServiceSeat', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveServiceSeat') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const name = String(payload.sName || '').trim(); const faceImg = String(payload.sFaceImg || '').trim(); const username = String(input.username || payload.sRemrk || '').trim(); const isDefault = Number(payload.sDefault || 0); const index = Number(payload.sIndex || 0); if (!name || name.length > 100 || faceImg.length > 2000 || !/^[A-Za-z0-9_@.\-\u4e00-\u9fff]{2,64}$/.test(username) || ![0,1].includes(isDefault) || !Number.isInteger(index) || index < 0 || index > 1000000) fail(400, '客服名称、绑定账号、默认状态或排序无效'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '客服席位必须指定帐套'); const userRow = await Psql.oneOrNone('SELECT "objectId",COALESCE("legacyUserId",CASE WHEN COALESCE("legacyUserData"->>\'UserID\',\'\') ~ \'^[0-9]+$\' THEN ("legacyUserData"->>\'UserID\')::numeric END) AS legacy_id FROM "_User" WHERE "company"=$1 AND LOWER("username")=LOWER($2) AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) AND ("isDisabled" IS NULL OR "isDisabled"=FALSE) LIMIT 1', [companyId, username]); const legacyUserId = Number(userRow && userRow.legacy_id) || 0; if (!legacyUserId) fail(501, 'migration_blocked: 绑定账号不存在或缺少旧用户 ID；旧系统会用固定密码 123456 自动开户，该不安全行为不予迁移，请先通过安全开户流程创建账号'); const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('ServiceSeat'); let target; let created = false; if (objectId) { const query = new Parse.Query('ServiceSeat'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); } else { target = new Parse.Object('ServiceSeat'); target.set('sourceKey', 'cloud:service-seat:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('company', company); target.set('sDateTime', new Date().toISOString()); created = true; }
      target.set('sName', name); target.set('sFaceImg', faceImg); target.set('sRemrk', username); target.set('sAdminId', legacyUserId); target.set('sDefault', isDefault); target.set('sIndex', index); try { await target.save(null, { useMasterKey: true }); if (created) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-service-seat-id\'))),next_id AS MATERIALIZED (SELECT COALESCE(MAX("sId"),0)+1 AS id FROM "ServiceSeat",lock_row WHERE "company"=$1) UPDATE "ServiceSeat" SET "sId"=next_id.id,"sourceKey"=\'[["S_ID",\'||next_id.id||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!Number(rows[0] && rows[0].id)) throw new Error('无法分配客服席位编号'); } if (isDefault === 1) { const otherQuery = new Parse.Query('ServiceSeat'); applyTenant(otherQuery, fields, context, companyId); otherQuery.notEqualTo('objectId', target.id); otherQuery.limit(1000); const others = await otherQuery.find({ useMasterKey: true }); for (const other of others) if (Number(other.get('sDefault')) === 1) other.set('sDefault', 0); if (others.length) await Parse.Object.saveAll(others, { useMasterKey: true }); } } catch (error) { if (created && target.id) await target.destroy({ useMasterKey: true }).catch(() => undefined); throw error; } await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-service-seat' : 'create-service-seat', 'ServiceSeat', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'serviceCodes') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '欢迎语搜索词过长'); const fields = await schemaFor('Temp'); const query = new Parse.Query('Temp'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => Number(entry.get('useType')) === 12 && (!search || [entry.get('str1'),entry.get('str2'),entry.get('str4')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'Temp', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveServiceCode') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: Temp.id 与 Parse 保留 id 冲突，省略 id 创建不能生成旧欢迎语编号，不能安全新增欢迎语模板'); const name = String(payload.str1 || '').trim(); const content = String(payload.str2 || '').trim(); const theme = String(payload.str4 || '').trim(); if (!name || name.length > 100 || !content || content.length > 50000 || !/^[A-Za-z0-9_-]{1,50}$/.test(theme)) fail(400, '欢迎语名称、内容或主题无效'); const fields = await schemaFor('Temp'); const query = new Parse.Query('Temp'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); if (Number(target.get('useType')) !== 12) fail(409, '该临时模板不是客服欢迎语'); target.set('str1', name); target.set('str2', content); target.set('str4', theme); await target.save(null, { useMasterKey: true }); await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-service-code', 'Temp', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'serviceBatch') {
      const className = String(input.className || ''); if (!['ServiceSeat','Temp'].includes(className) || String(input.action || '') !== 'delete') fail(400, '不支持的客服批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条客服记录'); const fields = await schemaFor(className); const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length || (className === 'Temp' && targets.some((target) => Number(target.get('useType')) !== 12))) fail(404, '部分客服记录不存在、不属于当前帐套或不是欢迎语模板'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-service-' + (className === 'ServiceSeat' ? 'seat' : 'code'), className, target.id); return response.json({ success: true, data: { className, action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'legacyServiceChatBlocker') {
      const action = String(input.action || ''); const blockers = { MsgEx: '目标 Schema 缺少旧 ChatMsg 会话消息表与历史数据', MsgInfo: '目标 Schema 缺少旧 ChatMsg 单条消息详情数据', MsgList: '目标 Schema 缺少旧 ChatMsg 消息列表数据', chat_del: '目标 Schema 缺少旧 ChatMsg 可删除记录' }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧客服消息动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'storeApplications') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); const status = Number(input.status == null ? -100 : input.status); if (search.length > 100 || ![-100,-1,0,99].includes(status)) fail(400, '店铺筛选条件无效'); const fields = await schemaFor('StoreApplication'); const query = new Parse.Query('StoreApplication'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => (status === -100 || Number(entry.get('storeState')) === status) && (!search || [entry.get('storeName'),entry.get('userName'),entry.get('lxr'),entry.get('tel'),entry.get('addr')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'StoreApplication', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'storeStyles') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '店铺样式搜索词过长'); const fields = await schemaFor('StoreStyle'); const query = new Parse.Query('StoreStyle'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => !search || [entry.get('styleName'),entry.get('remind'),entry.get('templateIndex'),entry.get('templateContent'),entry.get('templateList')].some((value) => String(value || '').toLowerCase().includes(search))); results.sort((left, right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'StoreStyle', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveStoreApplication') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: StoreApplication.id 与 Parse 保留 id 冲突，且旧店铺创建还需要已丢失的模型 6 动态字段写入流程，不能安全新增店铺'); const storeName = String(payload.storeName || '').trim(); const username = String(input.username || payload.userName || '').trim(); const styleId = Number(input.styleId == null ? payload.storeStyleId || 0 : input.styleId); if (!storeName || storeName.length > 200 || !/^[A-Za-z0-9_@.\-\u4e00-\u9fff]{2,64}$/.test(username) || !Number.isInteger(styleId) || styleId < 0) fail(400, '店铺名称、所属用户或样式无效'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '店铺必须指定帐套'); const userRow = await Psql.oneOrNone('SELECT COALESCE("legacyUserId",CASE WHEN COALESCE("legacyUserData"->>\'UserID\',\'\') ~ \'^[0-9]+$\' THEN ("legacyUserData"->>\'UserID\')::numeric END) AS legacy_id FROM "_User" WHERE "company"=$1 AND LOWER("username")=LOWER($2) AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) LIMIT 1', [companyId, username]); const userId = Number(userRow && userRow.legacy_id) || 0; if (!userId) fail(404, '店铺所属用户不存在、缺少旧用户 ID 或不属于当前帐套'); if (styleId) { const styleFields = await schemaFor('StoreStyle'); const styleQuery = new Parse.Query('StoreStyle'); applyTenant(styleQuery, styleFields, context, input.companyId); styleQuery.limit(1000); const styles = await styleQuery.find({ useMasterKey: true }); if (!styles.some((entry) => Number(entry.get('id')) === styleId)) fail(404, '店铺样式不存在或不属于当前帐套'); }
      const fields = await schemaFor('StoreApplication'); const query = new Parse.Query('StoreApplication'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); const strings = { storeName, lxr: String(payload.lxr || '').trim(), tel: String(payload.tel || '').trim(), addr: String(payload.addr || '').trim(), area: String(payload.area || '').trim(), logo: String(payload.logo || '').trim(), pics: String(payload.pics || '').trim(), weibo: String(payload.weibo || '').trim(), map: String(payload.map || '').trim(), content: String(payload.content || '').trim(), synopsis: String(payload.synopsis || '').trim(), shopType: String(payload.shopType || '').trim(), videoUrl: String(payload.videoUrl || '').trim() }; if (Object.values(strings).some((value) => value.length > 50000) || strings.tel.length > 100 || strings.lxr.length > 100 || strings.area.length > 500 || strings.addr.length > 2000 || strings.logo.length > 2000 || strings.videoUrl.length > 2000) fail(400, '店铺资料字段超过允许长度'); for (const [name,value] of Object.entries(strings)) target.set(name, value); target.set('userId', userId); target.set('userName', username); target.set('storeStyleId', styleId); await target.save(null, { useMasterKey: true }); await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-store-application', 'StoreApplication', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveStoreStyle') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: StoreStyle.id 与 Parse 保留 id 冲突，省略 id 创建不能生成旧样式编号，不能安全新增店铺样式'); const styleName = String(payload.styleName || '').trim(); const remind = String(payload.remind || '').trim(); const thumbnail = String(payload.thumbnail || '').trim(); const templateIndex = String(payload.templateIndex || '').trim(); const templateContent = String(payload.templateContent || '').trim(); const templateList = String(payload.templateList || '').trim(); if (!styleName || styleName.length > 200 || remind.length > 5000 || thumbnail.length > 2000 || !templateIndex || !templateContent || !templateList || [templateIndex,templateContent,templateList].some((value) => value.length > 2000 || /[<>\r\n]/.test(value))) fail(400, '店铺样式名称、模板路径、缩略图或说明无效'); const fields = await schemaFor('StoreStyle'); const query = new Parse.Query('StoreStyle'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); target.set('styleName', styleName); target.set('remind', remind); target.set('thumbnail', thumbnail); target.set('templateIndex', templateIndex); target.set('templateContent', templateContent); target.set('templateList', templateList); await target.save(null, { useMasterKey: true }); await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-store-style', 'StoreStyle', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'storeBatch') {
      const className = String(input.className || ''); const action = String(input.action || ''); const allowed = className === 'StoreApplication' ? ['audit','unaudit','elite','unelite','delete'] : className === 'StoreStyle' ? ['delete'] : []; if (!allowed.includes(action)) fail(400, '不支持的店铺批量操作'); if (className === 'StoreApplication' && action === 'delete') fail(501, 'migration_blocked: 旧 ZL_Commodities 商品主表缺失，无法核验店铺是否仍有关联商品，不能安全真实删除店铺'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条店铺记录'); const fields = await schemaFor(className); const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分店铺记录不存在或不属于当前帐套'); if (className === 'StoreStyle') { const styleIds = new Set(targets.map((target) => Number(target.get('id')))); const storeFields = await schemaFor('StoreApplication'); const refsQuery = new Parse.Query('StoreApplication'); applyTenant(refsQuery, storeFields, context, input.companyId); refsQuery.limit(1000); const refs = await refsQuery.find({ useMasterKey: true }); if (refs.some((entry) => styleIds.has(Number(entry.get('storeStyleId'))))) fail(409, '店铺样式仍被店铺引用，不能删除'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); } else { for (const target of targets) { if (action === 'audit') target.set('storeState', 99); if (action === 'unaudit') target.set('storeState', -1); if (action === 'elite') { target.set('storeState', 99); target.set('storeCommendState', 1); } if (action === 'unelite') target.set('storeCommendState', 0); } await Parse.Object.saveAll(targets, { useMasterKey: true }); } for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'store-' + action, className, target.id); return response.json({ success: true, data: { className, action, updated: targets.length, results: action === 'delete' ? [] : targets.map(serializeObject) } });
    }
    if (operation === 'legacyStoreProductBlocker') fail(501, 'migration_blocked: 旧 Product 页面依赖 ZL_Commodities 商品主表；目标仅有 Product/StoreProduct 扩展碎片，缺少商品名称、店铺归属、审核/销售状态与节点关系，无法等价重建列表');
    if (operation === 'schema' && String(input.className || '') === 'ContentTagKey') {
      return response.json({ success: true, data: { className: 'ContentTagKey', label: CLASS_LABELS.ContentTagKey, fields: [{ name: 'objectId', type: 'String', writable: false }, { name: 'count', type: 'Number', writable: false }, { name: 'content', type: 'String', writable: false }], writable: true, creatable: false, supportsSoftDelete: false } });
    }
    if (operation === 'contentTagKeys' || operation === 'getContentTagKeys') {
      const tags = await readContentTags(); const record = { objectId: 'global-content-tags', count: tags.length, content: tags.join('|'), tags }; const search = String(input.search || '').trim().toLowerCase(); const visible = !search || tags.some((tag) => tag.toLowerCase().includes(search));
      if (operation === 'getContentTagKeys') { if (String(input.objectId || '') !== record.objectId) fail(404, '内容标签词库不存在'); return response.json({ success: true, data: record }); }
      return response.json({ success: true, data: { className: 'ContentTagKey', page: 1, pageSize: 20, total: visible ? 1 : 0, results: visible ? [record] : [] } });
    }
    if (operation === 'saveContentTagKeys') {
      if (String(input.objectId || '') !== 'global-content-tags') fail(400, '内容标签词库只有一份全局配置'); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const source = input.tags == null ? (input.content == null ? payload.content : input.content) : input.tags; const tags = normalizeContentTags(source); await Parse.Config.save({ legacyContentTags: tags }, { useMasterKey: true }); await audit(context, 'update-content-tag-keys', 'ContentTagKey', 'global-content-tags'); return response.json({ success: true, data: { objectId: 'global-content-tags', count: tags.length, content: tags.join('|'), tags } });
    }
    if (operation === 'legacyContentAddonBlocker') {
      const action = String(input.action || ''); const blockers = {
        Comment: '目标 Schema 缺少旧 ZL_Comment 评论主表与历史评论数据',
        Commont_API: '目标 Schema 缺少可审核、取消审核或删除的旧 ZL_Comment 评论记录',
        ConAudit_API: '目标 Schema 缺少 ContentAudit 审核记录、节点审核流程与管理员步骤状态',
        ConAudit_SJ_API: '目标 Schema 缺少 ContentAudit 送审确认/驳回记录和可追溯流程状态',
        ConAudit: '目标 Schema 缺少旧 ZL_Content_Audit 审核列表及历史数据',
        ConAuditDetail: '目标 Schema 缺少内容审核明细、备注、节点和操作人流转记录',
        VerBak: '目标 Schema 缺少旧 ZL_Content_VerBak 内容/商品版本快照与历史数据',
        VerBak_Del: '目标 Schema 缺少可定位和删除的旧 ZL_Content_VerBak 版本记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的内容附加功能动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyShopVendorBlocker') {
      const action = String(input.action || ''); const blockers = {
        Vendor: '目标 Schema 缺少旧 ZL_Shop_Vendor 供应商主表与历史供应商数据',
        Vendor_API: '目标没有可定位和删除的供应商记录；Agency/DeliveryCenter 与供应商语义不等价',
        VendorAdd: '目标 Schema 没有可承载供应商名称、地址、手机、传真、邮箱和状态的签约数据类',
        VendorAdd_Submit: '按既定数据库设计不能擅自新建 ShopVendor 类，也不能把供应商字段错写到 Agency 或 DeliveryCenter'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧供应商动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'userLevels') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '积分等级搜索词过长'); const fields = await schemaFor('UserLevel'); const query = new Parse.Query('UserLevel'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => !search || [entry.get('alias'),entry.get('remark')].some((value) => String(value || '').toLowerCase().includes(search))); results.sort((left,right) => Number(left.get('orderId') || left.get('id') || 0) - Number(right.get('orderId') || right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'UserLevel', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveUserLevel') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; if (!objectId) fail(501, 'migration_blocked: UserLevel.id 与 Parse 保留 id 冲突，兼容层无法为新积分等级生成旧数字 ID'); const alias = String(payload.alias || '').trim(); const pointRate = Number(payload.pointRate || 0); const image = String(payload.image || '').trim(); const remark = String(payload.remark || '').trim(); if (!alias || alias.length > 100 || !Number.isInteger(pointRate) || pointRate < 0 || pointRate > 1000000000 || image.length > 2000 || remark.length > 5000) fail(400, '积分等级名称、阈值、图片或备注无效'); const fields = await schemaFor('UserLevel'); const query = new Parse.Query('UserLevel'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); const companyId = pointerId(target.get('company')) || pointerId(context.company); const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "UserLevel" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("alias",\'\')))=LOWER($3) LIMIT 1', [companyId, objectId, alias]); if (duplicate) fail(409, '同一帐套的积分等级名称不能重复'); target.set('alias', alias); target.set('pointRate', pointRate); target.set('image', image); target.set('remark', remark); await target.save(null, { useMasterKey: true }); await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || context.company }, 'update-user-level', 'UserLevel', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'userLevelBatch') {
      if (String(input.action || '') !== 'delete') fail(400, '不支持的积分等级批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个积分等级'); const fields = await schemaFor('UserLevel'); const query = new Parse.Query('UserLevel'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分积分等级不存在或不属于当前帐套'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-user-level', 'UserLevel', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length, results: [] } });
    }
    if (operation === 'schema' && String(input.className || '') === 'UserMoneyLog') {
      return response.json({ success: true, data: { className: 'UserMoneyLog', label: CLASS_LABELS.UserMoneyLog, fields: ['objectId','moneyTypeLabel','userId','userName','score','scoreBefore','detail','remark','operator','hisTime','ledgerClass'].map((name) => ({ name, type: name === 'userId' || name === 'score' || name === 'scoreBefore' ? 'Number' : name === 'hisTime' ? 'Date' : 'String', writable: false })), writable: false, creatable: false, supportsSoftDelete: false } });
    }
    if (operation === 'userMoneyLogs' || operation === 'getUserMoneyLog') {
      const compositeId = String(input.objectId || ''); let type = Number(input.type || 1); let recordObjectId = ''; if (operation === 'getUserMoneyLog') { const match = compositeId.match(/^([A-Za-z][A-Za-z0-9_]*):(.+)$/); if (!match) fail(400, '资金流水标识无效'); type = Number(Object.entries(USER_MONEY_LOG_CLASSES).find(([,name]) => name === match[1])?.[0] || 0); recordObjectId = match[2]; } const ledgerClass = USER_MONEY_LOG_CLASSES[type]; if (!ledgerClass) fail(400, '资金流水类型必须为 1 至 6'); const fields = await schemaFor(ledgerClass); const query = new Parse.Query(ledgerClass); applyTenant(query, fields, context, input.companyId); if (operation === 'getUserMoneyLog') { const entry = await query.get(recordObjectId, { useMasterKey: true }); const row = serializeObject(entry); row.recordObjectId = entry.id; row.objectId = ledgerClass + ':' + entry.id; row.ledgerClass = ledgerClass; row.moneyType = type; row.moneyTypeLabel = USER_MONEY_LOG_LABELS[type]; return response.json({ success: true, data: row }); }
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '资金流水搜索词过长'); const start = input.startDate ? new Date(String(input.startDate) + 'T00:00:00.000Z') : null; const end = input.endDate ? new Date(String(input.endDate) + 'T23:59:59.999Z') : null; if ((start && Number.isNaN(start.getTime())) || (end && Number.isNaN(end.getTime())) || (start && end && start > end)) fail(400, '资金流水日期范围无效'); query.limit(1000); let entries = await query.find({ useMasterKey: true }); if (start) entries = entries.filter((entry) => new Date(entry.get('hisTime')).getTime() >= start.getTime()); if (end) entries = entries.filter((entry) => new Date(entry.get('hisTime')).getTime() <= end.getTime()); const userFields = await schemaFor('_User'); const userQuery = new Parse.Query('_User'); applyTenant(userQuery, userFields, context, input.companyId); userQuery.limit(1000); const users = await userQuery.find({ useMasterKey: true }); const userNames = new Map(users.map((entry) => [Number(entry.get('legacyUserId') || (entry.get('legacyUserData') || {}).UserID || 0), String(entry.get('username') || '')])); let rows = entries.map((entry) => { const row = serializeObject(entry); const userId = Number(entry.get('userId') || 0); row.recordObjectId = entry.id; row.objectId = ledgerClass + ':' + entry.id; row.ledgerClass = ledgerClass; row.moneyType = type; row.moneyTypeLabel = USER_MONEY_LOG_LABELS[type]; row.userName = userNames.get(userId) || ''; return row; }); rows = rows.filter((row) => !search || [row.userId,row.userName,row.detail,row.remark,row.operator].some((value) => String(value || '').toLowerCase().includes(search))); rows.sort((left,right) => new Date(String(right.hisTime?.iso || right.hisTime || 0)).getTime() - new Date(String(left.hisTime?.iso || left.hisTime || 0)).getTime()); const total = rows.length; rows = rows.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'UserMoneyLog', page, pageSize, total, results: rows } });
    }
    if (operation === 'schema' && String(input.className || '') === 'UserPromotion') {
      const fields = [
        ['objectId','String'],['userId','Number'],['userName','String'],['honeyName','String'],['parentUserId','Number'],['parentUserName','String'],['parentHoneyName','String'],['promotionCount','Number'],['regTime','Date']
      ].map(([name,type]) => ({ name, type, writable: false }));
      return response.json({ success: true, data: { className: 'UserPromotion', label: CLASS_LABELS.UserPromotion, fields, writable: false, creatable: false, supportsSoftDelete: false } });
    }
    if (operation === 'userPromotions' || operation === 'getUserPromotion') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); const parentUserId = Number(input.parentUserId || 0); const onlyWithChildren = input.onlyWithChildren === true || String(input.onlyWithChildren || '') === '1'; const startDate = String(input.startDate || '').trim(); const endDate = String(input.endDate || '').trim();
      if (search.length > 100 || !Number.isInteger(parentUserId) || parentUserId < 0 || (startDate && !/^\d{4}-\d{2}-\d{2}$/.test(startDate)) || (endDate && !/^\d{4}-\d{2}-\d{2}$/.test(endDate))) fail(400, '推广关系筛选条件无效'); const start = startDate ? new Date(startDate + 'T00:00:00+08:00') : null; const end = endDate ? new Date(new Date(endDate + 'T00:00:00+08:00').getTime() + 86400000) : null; if ((start && Number.isNaN(start.getTime())) || (end && Number.isNaN(end.getTime())) || (start && end && start >= end)) fail(400, '推广关系日期范围无效'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '推广关系必须指定帐套');
      const raw = await Psql.query('SELECT "objectId","username","realName","nickname","legacyUserId","legacyUserData","createdAt" FROM "_User" WHERE "company"=$1 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE)', [companyId]); const normalized = raw.map((entry) => { let legacy = entry.legacyUserData || {}; if (typeof legacy === 'string') { try { legacy = JSON.parse(legacy); } catch (_) { legacy = {}; } } const userId = Number(entry.legacyUserId || legacy.UserID || 0); const rawRegTime = legacy.RegTime || entry.createdAt; const parsedRegTime = rawRegTime ? new Date(rawRegTime) : null; return { objectId:String(entry.objectId || ''), userId, userName:String(entry.username || legacy.UserName || ''), honeyName:String(entry.realName || entry.nickname || legacy.HoneyName || entry.username || ''), parentUserId:Number(legacy.ParentUserID || 0), regTime:parsedRegTime && !Number.isNaN(parsedRegTime.getTime()) ? parsedRegTime.toISOString() : null }; }).filter((entry) => entry.objectId && entry.userId > 0); const byId = new Map(normalized.map((entry) => [entry.userId,entry])); const counts = new Map(); for (const entry of normalized) { if (!entry.parentUserId) continue; const time = entry.regTime ? new Date(entry.regTime).getTime() : NaN; if ((start && (Number.isNaN(time) || time < start.getTime())) || (end && (Number.isNaN(time) || time >= end.getTime()))) continue; counts.set(entry.parentUserId, Number(counts.get(entry.parentUserId) || 0) + 1); }
      let rows = normalized.map((entry) => { const parent = byId.get(entry.parentUserId); return { ...entry, parentUserName:parent?.userName || '', parentHoneyName:parent?.honeyName || '', promotionCount:Number(counts.get(entry.userId) || 0) }; }); if (operation === 'getUserPromotion') { const objectId = String(input.objectId || ''); const row = rows.find((entry) => entry.objectId === objectId); if (!row) fail(404, '推广用户不存在或不属于当前帐套'); return response.json({ success: true, data: row }); } rows = rows.filter((entry) => (!parentUserId || entry.parentUserId === parentUserId) && (!onlyWithChildren || entry.promotionCount > 0) && (!search || [entry.userName,entry.honeyName,entry.parentUserName,entry.parentHoneyName,entry.userId,entry.parentUserId].some((value) => String(value || '').toLowerCase().includes(search)))); rows.sort((left,right) => right.promotionCount - left.promotionCount || right.userId - left.userId); const total = rows.length; rows = rows.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className:'UserPromotion', page, pageSize, total, results:rows } });
    }
    if (operation === 'legacyUserAddonBlocker') {
      const action = String(input.action || ''); const blockers = {
        ThirdInfo: '旧 ThirdInfo.config 的 Baidu/QQ/Sina/BaiduTrans/Wechat/Printer 全局配置与历史密钥未迁入目标数据库',
        ThirdInfo_Submit: '目标 ThirdPlatInfo 只有版权印、飞印打印、百度翻译、头条号等不同业务平台，且云函数无旧 XML/OAuth 运行时消费者，不能伪造保存生效',
        SigninList: '目标 Schema 缺少 PrizeTaskLog 及 rids=Global.SignIn 的用户签到任务日志；MisSign 是工作签到配置而非用户签到历史',
        RealNameAuth: '目标 Schema 缺少 UserRealNameAuth 申请主表、审核状态与历史数据',
        RealNameAuthAdd: '目标 Profile 中零散身份字段不等价于实名认证申请，缺少可审阅的申请详情',
        RealNameAuth_API: '目标缺少实名申请记录及 Global.RealNameAuth 任务奖励链，无法安全审核、取消审核或删除'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧用户附加功能动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyAskBlocker') {
      const action = String(input.action || ''); const blockers = {
        Default: '目标 Schema 缺少旧 ZL_Ask 问题主表、回收站标记与历史问题数据',
        AskInfo: '目标无可定位的问答问题详情；Baike/Guestbook/GuestBar/DesignQuestion 均非等价问题主表',
        AskAdd: '目标无 Ask 数据类承载 QTitle/Qcontent 与问答状态、精华、回收站关系',
        AskAdd_Submit: '按既定数据库设计不能把问题错写到百科、留言、论坛或问卷题目',
        Ask_API: '目标缺少可回收、恢复、删除、审核或加精的旧问答问题记录',
        AnswerList: '目标 Schema 缺少旧 ZL_GuestAnswer 回答主表及 QueId 问题外键',
        AnswerAdd: '目标无可编辑或新增的问答回答记录与问题归属',
        AnswerAdd_Submit: '目标缺少 GuestAnswer 的 QueId/UserId/UserName/Content 数据模型与历史关系',
        Answer_API: '目标缺少可审核、取消审核或删除的旧问答回答记录',
        Config: '目标没有 GuestConfig.WDOption 问答运行时和 SelGroup/ReplyGroup/QuestGroup 权限消费者',
        Config_Submit: '即使存储积分与用户组参数，目标也没有问答发布/回复/推荐运行时执行这些规则，不能伪造保存生效'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧问答动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyBiaoCalcBlocker') {
      const action = String(input.action || ''); const blockers = {
        Default: '目标 Schema 缺少旧 BiaoCalcModel 裱件模型主表、状态与历史记录',
        BiaoDetail: '目标无可定位的裱件详情及其 UserID 用户关系',
        Biao_API: '目标缺少可启用、停用或删除的 BiaoCalcModel 裱件记录',
        UserFiles: '目标 Schema 缺少旧 BiaoCalcUserFiles 用户文件主表、等级、到期时间与历史授权记录',
        UserFiles_API: '目标无 BiaoCalcUserFiles.ExpireTime 可安全执行到期或按年月日续期；账户会员到期时间语义不等价'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧裱件计算动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyOfficeChartBlocker') {
      if (String(input.action || '') !== 'Index') fail(400, '不支持的旧 Office 图表动作');
      fail(501, 'migration_blocked: 旧 Office/Chart.Index 只保留了返回视图的空壳控制器，交付包与官方源码均缺少对应 Index.cshtml 视图、数据源和交互定义，无法 1:1 复原');
    }
    if (operation === 'crmClientTypes') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '客户类型搜索词不能超过 100 个字符'); const fields = await schemaFor('CRMSAttr'); const query = new Parse.Query('CRMSAttr'); applyTenant(query, fields, context, input.companyId); query.equalTo('ztype', 'ctype'); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((target) => !search || [target.get('value'),target.get('remark')].some((value) => String(value || '').toLowerCase().includes(search))); results.sort((left,right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'CRMSAttr', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveCrmClientType') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const value = String(payload.value || '').trim(); const remark = String(payload.remark || '').trim(); if (!value || value.length > 100 || remark.length > 1000) fail(400, '客户类型名称长度应为 1 至 100 位，备注不能超过 1000 位'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '客户类型必须指定帐套'); const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('CRMSAttr'); let target; let created = false; if (objectId) { const query = new Parse.Query('CRMSAttr'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); if (String(target.get('ztype') || '').toLowerCase() !== 'ctype') fail(409, '该 CRM 属性不是客户类型'); companyId = pointerId(target.get('company')) || companyId; } else { target = new Parse.Object('CRMSAttr'); target.set('sourceKey', 'cloud:crm-client-type:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('company', company); target.set('ztype', 'ctype'); target.set('zstatus', 0); target.set('cdate', new Date()); created = true; }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "CRMSAttr" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("value",\'\')))=LOWER($3) AND LOWER(COALESCE("ztype",\'\'))=\'ctype\' LIMIT 1', [companyId, objectId, value]); if (duplicate) fail(409, '同一帐套的客户类型名称不能重复'); target.set('value', value); target.set('remark', remark); try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '客户类型初始写入失败: ' + String(error && error.message || error)); }
      try { if (created) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-crm-client-type-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("id"),0)+1 AS id FROM "CRMSAttr",lock_row WHERE "company"=$1) UPDATE "CRMSAttr" SET "id"=next_id.id,"sourceKey"=\'[["ID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!(Number(rows[0] && rows[0].id) || 0)) throw new Error('无法分配客户类型编号'); } } catch (error) { if (created) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '客户类型编号写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || company }, objectId ? 'update-crm-client-type' : 'create-crm-client-type', 'CRMSAttr', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'crmClientTypeBatch') {
      if (String(input.action || '') !== 'delete') fail(400, '不支持的客户类型批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个客户类型'); const fields = await schemaFor('CRMSAttr'); const query = new Parse.Query('CRMSAttr'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length || targets.some((target) => String(target.get('ztype') || '').toLowerCase() !== 'ctype')) fail(404, '部分客户类型不存在或不属于当前帐套'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-crm-client-type', 'CRMSAttr', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length } });
    }
    if (operation === 'legacyCrmBlocker') {
      const action = String(input.action || ''); const blockers = {
        Index: '目标 Schema 缺少旧 CRMS_Client 客户主表，无法进入客户列表首页', ClientList: '目标 Schema 缺少旧 CRMS_Client 客户主表与 Model 48 动态附表', ClientView: '目标缺少客户、联系人、服务记录和动态附表的联合详情数据', ClientAdd: '目标没有可编辑或新增的 CRMS_Client 客户记录', BiServer_Del: '目标 Schema 缺少旧 IServer 服务记录主表', Client_Add: '目标缺少 CRMS_Client 与 Model 48 动态附表原子写入链', ClientImport: '目标缺少客户主表，且旧 CRM_Client.xml 导入定义未迁入', Import_DownTlp: '交付包没有旧 CRM_Client.xml 字段映射，无法等价生成 xlsx 模板', Import_Client: '目标缺少 CRMS_Client/Model 48 写入结构及旧 XML+NPOI 导入流水线', AddServiceRecord: '目标 Schema 缺少旧 IServer 客户服务记录主表', AddServiceRecord_Submit: '目标无法保存 crm_ID、管理员、用户、优先级、类型、状态、附件和提醒等服务记录', ServiceRecord_List: '目标没有可查询的旧 IServer 服务记录', Contact: '目标 Schema 缺少旧 CRMS_Contact 联系人主表；ContactInfo 是企业微信联系人，语义不等价', ContactAdd: '目标无可编辑或新增的 CRMS_Contact 客户联系人记录', Contact_Add: '不能把旧 CRM 联系人错写到企业微信 ContactInfo', ContactImport: '目标缺少 CRM 联系人主表，且旧 CRM_Contact.xml 导入定义未迁入', ContactImport_Down: '交付包没有旧 CRM_Contact.xml 字段映射，无法等价生成 xlsx 模板', ContactImport_Upload: '目标缺少 CRMS_Contact 写入结构及旧 XML+NPOI 导入流水线', BecomeCustomerList: '目标 Schema 缺少 user_becustomer 类型 Common_UserApply 经销商申请', BecomeCustomerDetail: '目标缺少经销商申请、申请用户和资质详情数据', BecomeCustomerDetailUpdate: '目标没有可更新的经销商申请 Info1/AdminRemind 记录', BecomeCustomer_API: '目标缺少申请、LicenceFiles/LicenceUserSign、CRM 客户及 PDF 文件运行时，无法执行审核链'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 CRM 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyCounterBlocker') {
      const action = String(input.action || ''); const blockers = {
        'Design/VisitList': '目标 Schema 缺少旧 ZL_Com_VisitCount 访问明细表及 h5 访问记录',
        'Design/VisitInfoList': '目标没有可按 InfoID 聚合的 h5 访问明细和最近访问记录',
        'Design/VisitInfoDetail': '目标缺少指定 InfoID 的访问时间、IP、浏览器、系统、地域和来源明细',
        'Design/Counter_API': '目标没有可定位并删除的旧访问统计记录',
        'Extend/StatisticalCode': '目标缺少 SiteInfo.AllSiteJS 配置模型及在所有页面注入统计脚本的运行时',
        'Extend/StatisticalCode_Submit': '云函数不能仅保存任意全站脚本而没有可信的前端注入、CSP 与版本发布链',
        'Extend/Index': '目标 Schema 缺少 ZL_Com_VisitCount 数据，无法生成旧访问统计首页',
        'Extend/Site': '目标缺少全站访问明细与总访问计数',
        'Extend/Month': '目标缺少可按年月聚合的访问日期明细',
        'Extend/Year': '目标缺少可按年度和月份聚合的访问日期明细',
        'Extend/Local': '目标缺少访客地域 Address 明细',
        'Extend/Browser': '目标缺少访客浏览器标识与访问明细',
        'Extend/Os': '目标缺少访客操作系统标识与访问明细',
        'Extend/Channel': '目标缺少访问来源渠道与 Referer 明细'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧访问统计动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyEChartsBlocker') {
      const action = String(input.action || ''); const blockers = {
        EChartList: '目标 Schema 缺少旧 Content_Chart 图表定义主表与历史图表',
        ChartCite: '目标缺少图表名称、站点 SiteUrl 和 /Common/ShowM 公开渲染链，无法生成旧 iframe/Markdown 引用',
        ShowM: '目标没有 Content_Chart option/package 数据与旧 ECharts ShowM 渲染页面',
        AddChart: '目标缺少 Content_Chart 持久层和旧 Bar/Pie/Dash/Funnel/Scatter/Circle/Map 配置生成运行时',
        AddChart_Submit: '目标无法持久化 TName、ChartTitle、ToolBox、Package、option、SType 与 Tag 图表定义',
        Default: '目标没有可按 SType 筛选分页的旧 Content_Chart 记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 ECharts 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyExamBlocker') {
      const action = String(input.action || ''); const blockers = {
        AddEngLishQuestion: '旧英语试题页依赖复合小题、音频/图片上传和答案解析器；目标仅保留只读 ExamSysQuestions 记录',
        Setting: '目标 Schema 缺少旧 Exam_Sys_Answer 答卷明细，无法按最近一周统计并重算试题难度',
        VersionList: '目标 Schema 缺少旧 Exam_Version 教材版本/册/章节树与历史数据', AddVersion: '目标无可定位或新建的 Exam_Version 版本树记录',
        SchoolManage: '目标 Schema 缺少旧 School 学校主表与省市县数据', AddSchool: '目标无可编辑或新增的 School 记录',
        ClassRoomManage: '目标 Schema 缺少旧 ClassRoom 班级主表与学校、年级、教师关系', AddClassRoom: '目标无可编辑或新增的 ClassRoom 记录',
        StudentList: '目标 Schema 缺少 ClassRoomStudent 班级学员关系、审核状态与学员类型',
        CourseManage: '目标 Schema 缺少旧 Course 课程主表；CourseBinding 是小树课程绑定，语义不等价', AddCourse: '目标无旧 Course 名称、科目、教师与课程结构记录',
        ToScore: '目标 Schema 缺少旧 Exam_Sys_Answer 主观题答卷与评分状态',
        Papers_Add: '试卷写入必须原子维护 qids/questList、分类、计时、价格与题目分值；当前只读迁移不允许通用表单破坏结构',
        Question_Add: '旧试题写入依赖题型答案解析、复合小题、知识点和上传资源；当前只读迁移不能安全保存',
        Version_GetList: '目标缺少可按 pid 查询的 Exam_Version 版本树', Version_Add: '目标缺少 Exam_Version 版本、册、章节持久层',
        School_Add: '目标缺少 School 主表，无法保存学校类型、地区、校徽和状态', ClassRoom_Add: '目标缺少 ClassRoom 与学校、教师、年级关系持久层', Course_Add: '目标缺少旧 Course 主表和科目树关系',
        Setting_Update: '目标缺少 Exam_Sys_Answer 作答统计，不能执行 CountDiffcult 难度重算',
        PublishDesign: '旧报刊可视化设计器的前端资产、布局协议与渲染运行时未迁入'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧考试动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyHelperBlocker') {
      const action = String(input.action || ''); const blockers = {
        Index: '旧动作会读取服务器 DBConfig.json、等待三秒并执行本地 SQL 脚本建表；云函数环境没有该文件运行时，目标数据类也已由受控迁移预置',
        HelpInfo: '目标 Schema 缺少旧 Notification 帮助信息数据，Angular/云函数也没有旧 SignalR 管理员分组与 HelpInfo 推送协议'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧帮助动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyHmsBlocker') {
      const action = String(input.action || ''); const blockers = {
        UList: '目标用户数据没有旧 ZL_UserBase.cardType 与 ICQ 到期时间字段，不能列出主题大师 VIP 卡用户',
        VipAdd: '目标用户数据没有旧 cardType 空值状态，不能判定可开通主题大师 VIP 卡的用户',
        VipAddJump: '旧七档主题大师卡与当前小树 VIP 合伙人等级不是同一业务，不能复用 VIP 字段',
        VipUpdate: '目标未保留旧 cardType 与 ICQ 卡片到期时间，无法还原编辑页',
        VipUpdate_Submit: '目标未保留旧 cardType/ICQ，不能安全写入卡种或按原到期日、当前时间重算期限',
        VipRenewal: '目标没有旧主题大师卡到期时间，无法展示续约上下文',
        VipRenewal_Submit: '目标没有旧 cardType/ICQ，不能按卡种天数或指定日期续约',
        VipOverdue: '目标没有旧主题大师卡到期时间，无法展示强制过期上下文',
        VipOverdue_Submit: '目标没有旧 ICQ 到期时间，不能执行强制过期且不能误写当前 VIP 合伙人字段',
        OList: '目标 Schema 缺少旧 ZL_Orderinfo 与 ZL_CartPro，无法查询主题大师 VIP 卡订单'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 Hms 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyIndexBlocker') {
      const action = String(input.action || ''); const blockers = {
        Scence: '旧桌面布局与主题写入 SiteConfig.SiteOption.Desk 和 B_Admin.Theme/StructureID；目标没有等价站点配置或管理员主题字段',
        Lockin: '旧锁屏依赖 B_Admin.LockScreen、明文口令再认证和 ASP.NET Session；目标没有持久化锁屏状态，不能把停用账号冒充屏幕锁',
        Lockin_Submit: '旧提交动作为空且锁屏状态依赖 ASP.NET Session/B_Admin，云函数没有可等价提交的数据',
        ASCXLoad: '旧动作按请求名称动态装载服务器 Razor/ASCX 局部视图；Angular 构建产物不允许运行时拼接并执行任意服务端模板路径',
        API: '旧 animate_start/animate_stop 写入全局 SiteConfig.SiteOption.Admin_ShowAnimate；目标没有该站点级持久化配置',
        AccountForm: '旧公开管理员申请受 SiteOption.RegManager 控制并创建默认锁定、高权限角色账号；目标没有审批开关和管理员申请模型，不能开放不安全的自助管理员入口',
        AccountForm_API: '目标没有管理员申请开关与待审批账号模型，不能提供公开管理员用户名/邮箱探测接口',
        AccountForm_Submit: '旧动作生成随机密码并直接授予固定角色 2/4/6/7/8；目标权限模型不等价且没有审批链，不能安全创建管理员申请'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧后台入口动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyMarkdownBlocker') {
      const action = String(input.action || ''); const blockers = {
        Index: '目标 Schema 缺少旧 MarkDown 主表、MDName/MDPath/MDStatus/MDPosition 等历史记录', MD: '目标没有可新建或编辑的 MarkDown 记录', Index_submit: '目标缺少 MarkDown 持久层，当前 Parse 文件适配器也不能替代旧 wwwroot/UploadFiles/MarkDown 本地上传目录', Dels: '目标没有 Markdown 记录与对应服务器文件可同步删除', Preview: '目标缺少 MarkDown 文件、SiteInfo.SiteUrl 与旧 /PreView/md 渲染运行时'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 Markdown 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyMessageBlocker') {
      const action = String(input.action || ''); const blockers = {
        Message: '目标 Schema 缺少旧 Message 站内信主表与收发历史；MailTemp 仅是邮件模板，语义不等价', MessageSend: '目标没有可编辑的站内信草稿、收件人、抄送和附件记录', Message_Add: '目标缺少站内信发送与草稿持久层，不能保存 Sender/Incept/CCUser/Attachment', MessageRead: '目标没有站内信详情与已读状态记录', Message_API: '目标没有可删除的站内信记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧站内信动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyMobileBlocker') {
      const action = String(input.action || ''); const blockers = {
        Index: '旧动作只有已丢失的 Mobile Razor 视图，发布包没有页面结构、交互或资源基线可恢复', MobileBrower: '旧移动浏览器预览页只有已丢失的 Razor 视图，目标没有对应渲染运行时'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 Mobile 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyNodeRemainderBlocker') {
      const action = String(input.action || ''); const blockers = {
        ZhiDing: '旧动作会把帐套内全部 ZStatus=99 栏目强制设为 depth=1、parentId=0，破坏现有规范化栏目树；现有 saveNode/nodeBatch 已在每次移动时安全维护深度', UnionNode_Merge: '旧合并同时改写 CommonModel 与未迁入的 ZL_Commodities 商品节点，并可删除来源栏目；缺商品主表时不能执行非原子半合并'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧栏目剩余动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'platformCompanies') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); if (search.length > 100) fail(400, '协同办公企业搜索词不能超过 100 个字符'); const fields = await schemaFor('PlatComp'); const query = new Parse.Query('PlatComp'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); const userFields = await schemaFor('_User'); const userQuery = new Parse.Query('_User'); applyTenant(userQuery, userFields, context, input.companyId); userQuery.limit(1000); const users = await userQuery.find({ useMasterKey: true }); const userNames = new Map(users.map((user) => [Number(user.get('legacyUserId') || (user.get('legacyUserData') || {}).UserID || 0), String(user.get('username') || '')])); results = results.filter((entry) => !search || [entry.get('compName'),entry.get('compShort'),entry.get('telephone'),entry.get('mobile'),entry.get('faren'),entry.get('industry')].some((value) => String(value || '').toLowerCase().includes(search))); results.sort((left,right) => Number(left.get('id') || 0) - Number(right.get('id') || 0)); const total = results.length; const rows = results.slice((page - 1) * pageSize, page * pageSize).map((entry) => ({ ...serializeObject(entry), creatorUsername: userNames.get(Number(entry.get('createUser')) || 0) || '' })); return response.json({ success: true, data: { className: 'PlatComp', page, pageSize, total, results: rows } });
    }
    if (operation === 'savePlatformCompany') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const compName = String(payload.compName || '').trim(); const creatorUsername = String(input.creatorUsername || '').trim(); const rawCreateTime = payload.createTime && typeof payload.createTime === 'object' ? payload.createTime.iso : payload.createTime; const rawRegisterTime = payload.registerTime && typeof payload.registerTime === 'object' ? payload.registerTime.iso : payload.registerTime; const createTime = rawCreateTime ? new Date(String(rawCreateTime)) : new Date(); const registerTime = rawRegisterTime ? new Date(String(rawRegisterTime)) : new Date(createTime.getTime() - 365 * 86400000); const compType = Number(payload.compType || 0); const registerMoney = Number(payload.registerMoney || 0); const strings = { compLogo:String(payload.compLogo || '').trim(), telephone:String(payload.telephone || '').trim(), mobile:String(payload.mobile || '').trim(), compHref:String(payload.compHref || '').trim(), compDesc:String(payload.compDesc || '').trim(), mails:String(payload.mails || '').trim(), compShort:String(payload.compShort || '').trim(), photo:String(payload.photo || '').trim(), faren:String(payload.faren || '').trim(), peoples:String(payload.peoples || '').trim(), keywords:String(payload.keywords || '').trim(), industry:String(payload.industry || '').trim(), registerAddr:String(payload.registerAddr || '').trim(), proAddr:String(payload.proAddr || '').trim() }; if (!compName || compName.length > 200 || Number.isNaN(createTime.getTime()) || Number.isNaN(registerTime.getTime()) || !Number.isInteger(compType) || compType < 0 || compType > 1000000 || !Number.isInteger(registerMoney) || registerMoney < 0 || registerMoney > 1000000000000 || Object.values(strings).some((value) => value.length > 50000) || strings.compLogo.length > 2000 || strings.photo.length > 5000 || strings.compHref.length > 2000 || strings.telephone.length > 100 || strings.mobile.length > 100 || strings.mails.length > 1000 || strings.compShort.length > 200 || strings.faren.length > 100 || strings.peoples.length > 100 || strings.keywords.length > 1000 || strings.industry.length > 200 || strings.registerAddr.length > 2000 || strings.proAddr.length > 2000 || /[<>\r\n]/.test(strings.compHref) || /^(?:javascript|data|vbscript):/i.test(strings.compHref)) fail(400, '企业名称、创建人、日期、网址或资料字段无效'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '协同办公企业必须指定帐套'); const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('PlatComp'); let target; let created = false; if (objectId) { const query = new Parse.Query('PlatComp'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; } else { target = new Parse.Object('PlatComp'); target.set('sourceKey', 'cloud:platform-company:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('company', company); target.set('status', 0); created = true; } let createUser = Number(target.get('createUser')) || Number(context.current.get('legacyUserId')) || Number((context.current.get('legacyUserData') || {}).UserID) || 0; if (creatorUsername) { const row = await Psql.oneOrNone('SELECT COALESCE("legacyUserId",CASE WHEN COALESCE("legacyUserData"->>\'UserID\',\'\') ~ \'^[0-9]+$\' THEN ("legacyUserData"->>\'UserID\')::numeric END) AS id FROM "_User" WHERE "company"=$1 AND LOWER("username")=LOWER($2) AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) LIMIT 1', [companyId, creatorUsername]); createUser = Number(row && row.id) || 0; } if (!createUser) fail(400, '企业创建账号不存在、缺少旧用户 ID 或不属于当前帐套'); const creator = await Psql.oneOrNone('SELECT "objectId" FROM "_User" WHERE "company"=$1 AND COALESCE("legacyUserId",CASE WHEN COALESCE("legacyUserData"->>\'UserID\',\'\') ~ \'^[0-9]+$\' THEN ("legacyUserData"->>\'UserID\')::numeric END)=$2 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) LIMIT 1', [companyId, createUser]); if (!creator) fail(404, '企业创建人不存在或不属于当前帐套'); const duplicateQuery = new Parse.Query('PlatComp'); applyTenant(duplicateQuery, fields, context, input.companyId); duplicateQuery.limit(1000); const duplicates = await duplicateQuery.find({ useMasterKey: true }); if (duplicates.some((entry) => entry.id !== objectId && String(entry.get('compName') || '').trim().toLowerCase() === compName.toLowerCase())) fail(409, '同一帐套的协同办公企业名称不能重复'); target.set('compName', compName); target.set('createTime', createTime); target.set('registerTime', registerTime); target.set('createUser', createUser); target.set('compType', compType); target.set('registerMoney', registerMoney); for (const [name,value] of Object.entries(strings)) target.set(name, value); try { await target.save(null, { useMasterKey: true }); if (created) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-platform-company-id:\'||$1))),next_id AS MATERIALIZED (SELECT COALESCE(MAX("id"),0)+1 AS id FROM "PlatComp",lock_row WHERE "company"=$1) UPDATE "PlatComp" SET "id"=next_id.id,"sourceKey"=\'[["ID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!Number(rows[0] && rows[0].id)) throw new Error('无法分配协同办公企业编号'); } } catch (error) { if (created && target.id) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '协同办公企业保存失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || company }, objectId ? 'update-platform-company' : 'create-platform-company', 'PlatComp', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'platformCompanyMembers') {
      const companyObjectId = String(input.companyObjectId || input.objectId || ''); const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 100)); const search = String(input.search || '').trim().toLowerCase(); if (!companyObjectId || search.length > 100) fail(400, '缺少企业或成员搜索词过长'); const fields = await schemaFor('PlatComp'); const companyQuery = new Parse.Query('PlatComp'); applyTenant(companyQuery, fields, context, input.companyId); const platformCompany = await companyQuery.get(companyObjectId, { useMasterKey: true }); const compId = Number(platformCompany.get('id')) || 0; if (!compId) fail(409, '企业缺少旧数字 ID'); const userFields = await schemaFor('_User'); const userQuery = new Parse.Query('_User'); applyTenant(userQuery, userFields, context, input.companyId); userQuery.limit(1000); let users = await userQuery.find({ useMasterKey: true }); const creatorUsername = String((users.find((user) => Number(user.get('legacyUserId') || (user.get('legacyUserData') || {}).UserID || 0) === Number(platformCompany.get('createUser') || 0)) || {}).get?.('username') || ''); users = users.filter((user) => { const platform = user.get('legacyUserPlat') || {}; return Number(platform.CompID || 0) === compId && (!search || [user.get('username'),user.get('realName'),user.get('nickname'),(user.get('legacyUserData') || {}).HoneyName,platform.TrueName,platform.Mobile,platform.Post].some((value) => String(value || '').toLowerCase().includes(search))); }); users.sort((left,right) => Number((left.get('legacyUserPlat') || {}).UserID || left.get('legacyUserId') || 0) - Number((right.get('legacyUserPlat') || {}).UserID || right.get('legacyUserId') || 0)); const total = users.length; const results = users.slice((page - 1) * pageSize, page * pageSize).map((user) => { const platform = user.get('legacyUserPlat') || {}; const legacy = user.get('legacyUserData') || {}; return { objectId:user.id, userId:Number(platform.UserID || user.get('legacyUserId') || legacy.UserID || 0), username:String(user.get('username') || ''), displayName:String(platform.TrueName || user.get('realName') || user.get('nickname') || legacy.HoneyName || user.get('username') || ''), mobile:String(platform.Mobile || user.get('mobile') || ''), userFace:String(platform.UserFace || user.get('avatar') || ''), post:String(platform.Post || ''), status:Number(platform.Status || 0), createTime:String(platform.CreateTime || '') }; }); return response.json({ success:true, data:{ companyObjectId, compId, creatorUsername, page, pageSize, total, results } });
    }
    if (operation === 'platformCompanyMemberBatch') {
      const companyObjectId = String(input.companyObjectId || ''); const action = String(input.action || ''); if (!companyObjectId || !['add','remove'].includes(action)) fail(400, '不支持的企业成员操作'); const fields = await schemaFor('PlatComp'); const companyQuery = new Parse.Query('PlatComp'); applyTenant(companyQuery, fields, context, input.companyId); const platformCompany = await companyQuery.get(companyObjectId, { useMasterKey: true }); const compId = Number(platformCompany.get('id')) || 0; const companyId = pointerId(platformCompany.get('company')) || pointerId(context.company); if (!compId || !companyId) fail(409, '企业缺少旧编号或帐套'); const userFields = await schemaFor('_User'); let targets = []; if (action === 'add') { const usernames = [...new Set((Array.isArray(input.usernames) ? input.usernames : [input.username]).map((value) => String(value || '').trim()).filter(Boolean))]; if (!usernames.length || usernames.length > 100 || usernames.some((value) => !/^[A-Za-z0-9_@.\-\u4e00-\u9fff]{2,64}$/.test(value))) fail(400, '每次请输入 1 至 100 个有效成员账号'); const rows = await Psql.query('SELECT "objectId" FROM "_User" WHERE "company"=$1 AND LOWER("username")=ANY($2::text[]) AND ("isDeleted" IS NULL OR "isDeleted"=FALSE)', [companyId, usernames.map((value) => value.toLowerCase())]); if (rows.length !== usernames.length) fail(404, '部分成员账号不存在或不属于当前帐套'); const query = new Parse.Query('_User'); applyTenant(query, userFields, context, companyId); query.containedIn('objectId', rows.map((row) => row.objectId)); query.limit(rows.length); targets = await query.find({ useMasterKey:true }); for (const target of targets) { const legacy = target.get('legacyUserData') || {}; const userId = Number(target.get('legacyUserId') || legacy.UserID || 0); if (!userId) fail(409, '成员账号缺少旧用户 ID'); const existing = target.get('legacyUserPlat'); const platform = existing && typeof existing === 'object' && !Array.isArray(existing) ? { ...existing } : { Post:'', Mobile:String(target.get('mobile') || ''), Status:1, UserID:userId, ATCount:null, TrueName:String(target.get('realName') || target.get('nickname') || legacy.HoneyName || target.get('username') || ''), UserFace:String(target.get('avatar') || ''), Plat_Role:'', CreateTime:new Date().toISOString(), Plat_Group:null }; platform.UserID = userId; platform.CompID = compId; if (!platform.CreateTime) platform.CreateTime = new Date().toISOString(); target.set('legacyUserPlat', platform); } await Parse.Object.saveAll(targets, { useMasterKey:true }); } else { const objectIds = [...new Set((Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]).map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个企业成员'); const query = new Parse.Query('_User'); applyTenant(query, userFields, context, companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); targets = await query.find({ useMasterKey:true }); if (targets.length !== objectIds.length || targets.some((target) => Number((target.get('legacyUserPlat') || {}).CompID || 0) !== compId)) fail(404, '部分成员不存在或不属于该企业'); for (const target of targets) target.unset('legacyUserPlat'); await Parse.Object.saveAll(targets, { useMasterKey:true }); } for (const target of targets) await audit({ ...context, company: platformCompany.get('company') || context.company }, action + '-platform-company-member', '_User', target.id); return response.json({ success:true, data:{ action, updated:targets.length } });
    }
    if (operation === 'platformCompanyBatch') {
      if (String(input.action || '') !== 'delete') fail(400, '不支持的协同办公企业批量操作'); const objectIds = [...new Set((Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]).map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个协同办公企业'); const fields = await schemaFor('PlatComp'); const query = new Parse.Query('PlatComp'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey:true }); if (targets.length !== objectIds.length) fail(404, '部分协同办公企业不存在或不属于当前帐套'); for (const target of targets) { const companyId = pointerId(target.get('company')); const compId = Number(target.get('id')) || 0; const refs = await Psql.one('SELECT (SELECT COUNT(*)::int FROM "_User" WHERE "company"=$1 AND COALESCE("legacyUserPlat"->>\'CompID\',\'\') ~ \'^[0-9]+$\' AND ("legacyUserPlat"->>\'CompID\')::numeric=$2) AS members,(SELECT COUNT(*)::int FROM "PlatUserRole" WHERE "company"=$1 AND COALESCE("compId",0)=$2) AS roles', [companyId, compId]); if (Number(refs.members) || Number(refs.roles)) fail(409, '企业仍有协同办公成员或角色，不能删除'); } await Parse.Object.destroyAll(targets, { useMasterKey:true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-platform-company', 'PlatComp', target.id); return response.json({ success:true, data:{ action:'delete', updated:targets.length } });
    }
    if (operation === 'legacyPlatBlocker') {
      const action = String(input.action || ''); const blockers = { Default:'旧默认页跳转到已缺失 Blog_Msg 动态管理，目标没有可进入的信息首页', AuditApply:'目标 Schema 缺少旧 Common_UserApply 协同办公申请主表', AuditApply_Agree:'目标没有可批量通过并改为状态 99 的协同办公申请', AuditApply_Reject:'目标没有可批量拒绝并改为状态 -1 的协同办公申请', CreateComp:'旧动作仅剩已丢失的 Razor 企业创建向导；Angular 企业表单已覆盖主表生命周期，但未知向导交互无法 1:1 恢复', PlatInfoDeail:'目标 Schema 缺少旧 Blog_Msg 动态消息主表', PlatInfoDetail_Submit:'目标没有可编辑正文与日期的旧协同办公动态消息', PlatInfoManage:'目标没有 Blog_Msg 顶级动态、回收状态和关键词数据', TopicList:'目标 Schema 缺少旧 Plat_Topic 话题主表与星标状态', WordTlp:'旧文字模板仅剩已丢失的 Razor 视图，目标没有模板数据或渲染协议', Crud:'目标 Schema 缺少旧 Plat_Group 企业部门/群组树', CrudAdd:'目标没有可编辑的企业群组、上级和成员管理员关系', CrudAdd_Submit:'目标缺少 Plat_Group 的 FirstID/Depth/ManageIDS/MemberIDS 持久层', GroupAdmin_API:'目标没有可删除的 Plat_Group 企业群组记录', API_msg_topic:'目标缺少 Blog_Msg 与 Plat_Topic，不能执行动态删除/恢复/清空或话题删除/星标' }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧协同办公动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyPrinterBlocker') {
      const action = String(input.action || '');
      if (action !== 'Index') fail(400, '不支持的旧打印动作');
      fail(501, 'migration_blocked: 旧 PrinterController.Index 只返回已丢失的 Razor 视图；目标 110 个 Schema 中没有旧 ZL_Shop_PrintDevice、ZL_Shop_PrintTlp、ZL_Shop_PrintMessage 数据，旧客户端还依赖 my.feyin.net 的明文 HTTP 设备协议，无法安全等价恢复');
    }
    if (operation === 'pageStyles') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim(); if (search.length > 100) fail(400, '黄页样式搜索词不能超过 100 个字符'); const fields = await schemaFor('PageStyle'); const query = new Parse.Query('PageStyle'); applyTenant(query, fields, context, input.companyId); if (search) query.matches('pageNodeName', escapeRegex(search), 'i'); query.ascending('orderid'); const total = await query.count({ useMasterKey: true }); query.skip((page - 1) * pageSize); query.limit(pageSize); const results = await query.find({ useMasterKey: true }); return response.json({ success: true, data: { className: 'PageStyle', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'savePageStyle') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const pageNodeName = String(payload.pageNodeName || '').trim(); const stylePath = String(payload.stylePath || '').trim(); const templateIndex = String(payload.templateIndex || '').trim(); const templateIndexPic = String(payload.templateIndexPic || '').trim(); const orderid = Number(payload.orderid || 0); const isDefault = Number(payload.isDefault || 0); const istrue = Number(payload.istrue == null ? 1 : payload.istrue); if (!pageNodeName || pageNodeName.length > 100 || [stylePath,templateIndex,templateIndexPic].some((value) => value.length > 2000 || /[<>\r\n]/.test(value)) || !Number.isInteger(orderid) || orderid < 0 || orderid > 1000000 || ![0,1].includes(isDefault) || ![0,1].includes(istrue)) fail(400, '黄页样式名称、路径、排序或状态无效'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '黄页样式必须指定帐套'); const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('PageStyle'); let target; let created = false; if (objectId) { const query = new Parse.Query('PageStyle'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; } else { target = new Parse.Object('PageStyle'); target.set('sourceKey', 'cloud:page-style:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('company', company); target.set('addtime', new Date()); created = true; } const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "PageStyle" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("pageNodeName",\'\')))=LOWER($3) LIMIT 1', [companyId, objectId, pageNodeName]); if (duplicate) fail(409, '同一帐套的黄页样式名称不能重复'); target.set('pageNodeName', pageNodeName); target.set('stylePath', stylePath); target.set('templateIndex', templateIndex); target.set('templateIndexPic', templateIndexPic); target.set('orderid', orderid); if (isDefault === 0) target.set('isDefault', 0); target.set('istrue', istrue); try { await target.save(null, { useMasterKey: true }); if (created) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-page-style-id:\'||$1))),next_id AS MATERIALIZED (SELECT COALESCE(MAX("pageNodeid"),0)+1 AS id FROM "PageStyle",lock_row WHERE "company"=$1) UPDATE "PageStyle" SET "pageNodeid"=next_id.id,"sourceKey"=\'[["PageNodeid",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!Number(rows[0] && rows[0].id)) throw new Error('无法分配黄页样式编号'); } if (isDefault === 1) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-page-style-default:\'||$1))) UPDATE "PageStyle" SET "isDefault"=CASE WHEN "objectId"=$2 THEN 1 ELSE 0 END,"updatedAt"=NOW() FROM lock_row WHERE "company"=$1 AND ("objectId"=$2 OR COALESCE("isDefault",0)=1) RETURNING "objectId"', [companyId, target.id]); if (!rows.some((row) => row.objectId === target.id)) throw new Error('无法设置默认黄页样式'); } } catch (error) { if (created && target.id) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '黄页样式保存失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || company }, objectId ? 'update-page-style' : 'create-page-style', 'PageStyle', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'pageStyleBatch') {
      if (String(input.action || '') !== 'delete') fail(400, '不支持的黄页样式批量操作'); const objectIds = [...new Set((Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]).map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个黄页样式'); const fields = await schemaFor('PageStyle'); const query = new Parse.Query('PageStyle'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分黄页样式不存在或不属于当前帐套'); for (const target of targets) { const refs = await Psql.one('SELECT COUNT(*)::int AS count FROM "PageTemplate" WHERE "company"=$1 AND LOWER(TRIM(COALESCE("userGroup",\'\')))=LOWER($2)', [pointerId(target.get('company')), String(target.get('pageNodeName') || '')]); if (Number(refs.count)) fail(409, '黄页样式仍被页面模板引用，不能删除'); } await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-page-style', 'PageStyle', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length } });
    }
    if (operation === 'legacyPageBlocker') {
      const action = String(input.action || ''); const blockers = {
        ApplyAudit: '目标 Schema 缺少旧 PageReg 用户黄页申请主表与审核状态', ApplyInfo: '目标缺少 PageReg 申请详情、用户动态字段和样式关联', PageContent: 'CommonModel 可管理普通内容，但目标缺少 PageReg 与黄页专属模型范围，不能还原旧 Page_Sel', EditContent: '现有内容详情可查看；目标缺少黄页申请与 PageTemplate 上下文，不能还原专用编辑器', Content_Edit: '现有内容可安全编辑主字段；黄页模型附表和 PageReg 关系缺失，不能执行旧动态字段更新', PageConfig: '目标没有 SiteOption.RegPageStart/Page_ContentStatus/Page_UserCanNode 配置层', PageTemplate: 'PageTemplate 为空且目标缺少 PageReg 用户归属，无法还原用户/公共模板树', PageTemplateAdd: '目标缺少 PageReg，不能确定模板的 RegID、用户和样式上下文', SetPageOrder: '目标没有 PageReg 归属的模板集合可安全排序', PageConfig_Update: '目标云函数架构没有旧黄页站点配置持久层', PageTemplate_Add: '目标缺少 PageReg 用户归属和旧模型复选关系，不能安全新增页面模板', SetPageOrder_Batch: '目标没有可按 PageReg 隔离的模板排序集合', SetPageOrder_UpMove: '目标没有可按 PageReg 隔离的相邻模板顺序', SetPageOrder_DownMove: '目标没有可按 PageReg 隔离的相邻模板顺序', Apply_Update: '目标缺少 PageReg 申请主表、黄页模型附表和用户申请字段'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧黄页动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'misTypes') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim(); if (search.length > 100) fail(400, '流程类型搜索词不能超过 100 个字符'); const fields = await schemaFor('MisType'); const query = new Parse.Query('MisType'); applyTenant(query, fields, context, input.companyId); if (search) query.matches('typeName', escapeRegex(search), 'i'); query.ascending('id'); const total = await query.count({ useMasterKey: true }); query.skip((page - 1) * pageSize); query.limit(pageSize); const results = await query.find({ useMasterKey: true }); return response.json({ success: true, data: { className: 'MisType', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveMisType') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const typeName = String(payload.typeName || '').trim(); const typeDescribe = String(payload.typeDescribe || '').trim(); if (!typeName || typeName.length > 100 || typeDescribe.length > 1000) fail(400, '流程类型名称为必填项且名称或说明过长'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '流程类型必须指定帐套'); const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('MisType'); let target; let created = false; if (objectId) { const query = new Parse.Query('MisType'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; } else { target = new Parse.Object('MisType'); target.set('sourceKey', 'cloud:mis-type:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('company', company); target.set('createTime', new Date()); created = true; }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "MisType" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("typeName",\'\')))=LOWER($3) LIMIT 1', [companyId, objectId, typeName]); if (duplicate) fail(409, '同一帐套的流程类型名称不能重复'); target.set('typeName', typeName); target.set('typeDescribe', typeDescribe); try { await target.save(null, { useMasterKey: true }); if (created) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-mis-type-id:\'||$1))),next_id AS MATERIALIZED (SELECT COALESCE(MAX("id"),0)+1 AS id FROM "MisType",lock_row WHERE "company"=$1) UPDATE "MisType" SET "id"=next_id.id,"sourceKey"=\'[["ID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!Number(rows[0] && rows[0].id)) throw new Error('无法分配流程类型编号'); } } catch (error) { if (created && target.id) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '流程类型保存失败: ' + String(error && error.message || error)); } await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || company }, objectId ? 'update-mis-type' : 'create-mis-type', 'MisType', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'misTypeBatch') {
      if (String(input.action || '') !== 'delete') fail(400, '不支持的流程类型批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个流程类型'); const fields = await schemaFor('MisType'); const query = new Parse.Query('MisType'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分流程类型不存在或不属于当前帐套'); for (const target of targets) { const refs = await Psql.one('SELECT COUNT(*)::int AS count FROM "MisProcedure" WHERE "company"=$1 AND COALESCE("typeId",0)=$2', [pointerId(target.get('company')), Number(target.get('id')) || 0]); if (Number(refs.count)) fail(409, '流程类型仍被 OA 流程引用，不能删除'); } await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-mis-type', 'MisType', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length } });
    }
    if (operation === 'legacyOABlocker') {
      const action = String(input.action || ''); const blockers = {
        Default: '目标缺少旧 OA_AuditFlow 审核流主表与历史数据', FlowInfo: '目标没有旧审核流名称、模型、模板、角色用户和会签配置记录', FlowInfo_Submit: '目标缺少 OA_AuditFlow 持久层，MisProcedure 是不同版本流程结构', Flow_API: '目标没有可删除的旧审核流记录', SelFlowModel: '目标缺少旧审核流可绑定的 Mis_Model 与套红模板关系', FlowItem: '目标缺少 OA_AuditFlowItem 审核步骤表', FlowItemInfo: '目标没有审核步骤、绑定用户、父步骤、会签、转交和退回记录', FlowItemInfo_Submit: '目标缺少审核步骤持久层', FlowItem_API: '目标没有可删除的审核步骤记录',
        AddMisModel: '目标 DocModel 与旧 Mis_Model 的 ModelContent/BindNode/DocType/WordPath 套红结构不等价', AddMisModel_Submit: '目标缺少旧 Mis_Model 持久层和 FileGuid 套红模板文件运行时', AddSign: '目标 MisSign 是考勤时间表，不是 OA_Sign 签章模型', AddSign_Submit: '目标缺少 OA_Sign 图片、名称、口令、密钥、所属用户与创建人持久层，不能保存明文签章口令', AddSign_Delete: '目标没有可删除的 OA_Sign 签章记录', ApplyManage: '目标缺少 OA_Document 文档申请主表', ApplyManage_Delete: '目标没有可删除的 OA 文档申请记录', MisModelManage: '目标缺少旧 Mis_Model 套红文档模型数据', MisModelManage_Delete: '目标没有可删除的旧套红文档模型', OAConfig: '旧动作只有已丢失的 OAConfig Razor 视图，目标没有对应站点配置模型', SelModelFieds: '目标 Model 数据可只读查看，但旧按 ModelType 选择并回填字段的 OA Razor 交互未迁入', SignManage: '目标缺少 OA_Sign 签章列表；MisSign 是不等价的考勤时间表'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 OA 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyDesignInteractiveBlocker') {
      const action = String(input.action || ''); const blockers = {
        InteractiveList: '目标 Schema 缺少旧 Design_Pub 交互提交表及 sceneid、uid、fname 数据；DesignAnswer 和 Pub 语义不等价',
        Interactive_API: '目标没有可按旧 Design_Pub ID 删除的交互提交记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧互动提交动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyIServerBlocker') {
      const action = String(input.action || ''); const blockers = {
        Default: '目标 Schema 缺少旧 IServer 服务工单主表与回复表', AddQuestionRecord: '目标无可新增的 IServer 工单、CRM 关联和附件模型', AddQuestionRecord_Submit: '目标缺少工单标题、内容、优先级、类型、来源、状态、附件及 CRM 关系持久层',
        BiServer: '目标没有可按状态、类型和标题筛选的 IServer 工单数据', BiServer_Del: '目标没有可删除的 IServer 工单记录', BiServerInfo: '目标缺少工单详情、阅读计数及回复关系', DelIServer: '目标缺少 IServerReply 回复记录', UpdateIServer: '目标缺少工单状态、优先级、来源、类型、备注和解决时间持久层', BselectiServer: '目标没有可供 CRM 选择的旧服务工单数据', ISReplyAdd: '目标缺少工单回复主表与父工单关系', ISReplyAdd_Submit: '目标缺少管理员工单回复、附件和内容持久层'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 iServer 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyLicenceBlocker') {
      const action = String(input.action || ''); const blockers = {
        LicenceFiles: '目标 Schema 缺少 LicenceFiles 协议文件定义与限定用户数据', LicenceFiles_API: '目标没有可删除的协议文件定义', LicenceFilesAdd: '目标无协议模板路径、字段、状态、限制类型和限定用户模型', LicenceFilesAdd_Submit: '目标缺少协议文件定义持久层且云函数不能写旧本地模板文件',
        LicenceSignApplyList: '目标缺少 Common_UserApply 的 user_signlicence 申请数据', LicenceSignApplyDetail: '目标缺少许可签署申请、用户和协议文件关联', LicenceSignApply_API: '目标缺少申请审核、签署记录与服务器 PDF 生成/本地文件哈希归档运行时', LicenceSignList: '目标 Schema 缺少 LicenceUserSign 签约记录', LicenceSignDetail: '目标缺少签约详情、协议文件和用户关联', LicenceSign_API: '目标没有可审核或驳回的签约记录',
        LicenceList: '目标 Schema 缺少 ZL_LicenceFiles 用户协议定义、强制签署类型与限定用户/用户组数据', LicenceAdd: '目标没有可编辑或新增的用户协议、PDF 路径、字段映射和适用范围记录', LicenceAdd_Submit: '目标缺少 LicenceFiles 持久层及协议 PDF 文件，不能只保存失效路径', Licence_API: '目标没有可启用、停用或删除的用户协议定义', LicenceUserSign: '目标 Schema 缺少 ZL_LicenceUserSign 用户签约历史及协议、用户关联'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧许可签约动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyUserPromoBlocker') {
      const action = String(input.action || ''); const blockers = {
        Index: '旧入口只重定向到提现申请页，目标缺少 Cash 提现主表，无法提供等价落点', WD: '目标 Schema 缺少 Cash 提现申请、手续费、结果、凭证与处理状态记录', WD_API: '目标没有可审核的提现申请记录', WDAudit: '目标缺少指定提现申请的金额、手续费、账户和处理详情', WDAudit_Accept: '目标缺少可原子审核的 Cash 提现事务记录', WDAudit_Reject: '目标缺少 Cash 提现申请及对应预扣余额账本，不能安全执行拒绝退款', UserBank: '目标 Schema 缺少 User_Bank 提现账户及审核状态数据', UserBankAdd: '目标没有可编辑的开户人、卡号、账户类型和开户行记录', UserBankAdd_Submit: '目标缺少 User_Bank 持久层，不能把提现账户错写到发票银行字段', UserBank_API: '目标没有可删除、审核或取消审核的提现账户记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧推广提现动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyPubBlocker') {
      const action = String(input.action || ''); const blockers = {
        PubManage: '目标 Pub 模块定义与 PubTw/PubWTHD/PubZXDC 提交类均为空，无法还原互动模块列表', Pub_API: '旧删除、复制、恢复依赖 Pub 定义与动态表，modelname 还会检查 SQL 物理表；目标没有可操作记录或动态建表运行时', Pubinfo: '旧动作只跳转到指定 Pub 定义编辑页，目标 Pub 没有任何历史模块', PubAdd: '新增互动模块需要动态模型、表、标签与模板选择，目标云函数没有等价创建运行时', PubAdd_Submit: '旧提交会动态建 SQL 表、Model/ModelField、XML 标签及两套服务器 HTML 模板，云函数不能等价执行', Pubsinfo: '目标没有 Pub 定义可确定提交表，三个已签约 Pub 提交类也全部为空', PubsinfoAdd: '目标缺少互动模块定义、动态字段与可编辑的提交记录', PubsinfoAdd_Submit: '目标无法根据空的 Pub 定义选择动态提交表并保存系统字段与模型字段', PubInfo_API: '目标没有可删除、审核或取消审核的互动提交记录', PubInfo2_API: '旧企业入驻分支硬编码依赖缺失的 ZL_Pub_BDQYSH 提交表，不能直接改写企业与用户归属', PubsinfoReply: '目标没有互动父记录、动态字段和回复上下文', PubsinfoReply_Submit: '目标缺少可确定回复表的 Pub 定义及父提交记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧互动模块动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyPushBlocker') {
      const action = String(input.action || ''); const blockers = {
        Index: '旧入口只跳转到推送 API 列表，目标缺少 Mobile_PushAPI 配置数据', APIList: '目标 Schema 缺少 Mobile_PushAPI 的别名、平台、AppKey 与密钥记录', API_del: '目标没有可定位并删除的推送服务配置', AddAPI: '目标没有可编辑或新增的极光推送 API 配置模型', AddAPI_Submit: '签约数据库未提供可安全存储和轮换推送 AppKey/AppSecret 的配置类', PushMsg: '目标缺少可选择的推送 API 配置与设备受众数据', PushMsg_Submit: '目标没有 JPush 凭据、SDK 消费者、ZL_UserBase.UC 设备注册号或移动端注册链，无法真实发送并记录结果', PushTlp: '目标 Schema 缺少 Mobile_PushTlp 推送模板与状态数据', AddPushTlp: '目标没有可编辑或新增的推送模板记录', AddPushTlp_Submit: '目标缺少推送模板名称、标题、内容和参数持久层', PushTlp_API: '目标没有可启用、停用或删除的推送模板', MsgList: '目标 Schema 缺少 Mobile_PushMsg 发送历史、受众与结果记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧推送动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyPWABlocker') {
      const action = String(input.action || ''); const blockers = {
        Default: '旧入口跳转到离线缓存配置；目标没有可动态改写已部署前端的 PWA 控制面', Default_Submit: '旧提交为空操作，目标不伪造无效果的保存成功', Mobile: '目标缺少旧 SiteOption PWA 配置、manifest 文件和多尺寸图标资产', Mobile_Submit: '云函数不能缩放上传图标、写 manifest.json、注入站点 head 或持久化旧 SiteConfig', Offline: '目标没有旧 PWA_PC_Enable/Exts/IndexUrl/PreCache 配置与服务器模板', Offline_Submit: '云函数不能读取 pwa_sw_js.tlp 并覆盖已部署站点根目录 /sw.js'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 PWA 动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyQuartzTaskBlocker') {
      const action = String(input.action || ''); const blockers = {
        TaskList: '目标 Schema 缺少 QuartzNetTask 任务定义、类型、状态、次数和历史记录；空 SenTask 语义不等价', ViewLog: '目标没有 QuartzNetTask.Log 执行日志可按任务查看', TaskAdd: '目标没有 Quartz IScheduler、ScheduleTaskHandler 与任务持久层，无法创建一次或循环任务', TaskEdit: '目标没有可编辑的 Quartz 任务定义', TaskUpdate: '目标没有可同步更新持久层与 Quartz 调度器的控制面', ExecuteNow: '云函数环境没有已注册的 Quartz 作业可立即触发', TaskDelete: '目标没有可同时删除 Quartz 作业与任务记录的调度控制面', TaskDeleteRange: '目标没有可批量注销 Quartz 作业与删除任务记录的控制面', TaskPause: '云函数环境没有常驻 Quartz 调度器或可暂停作业', TaskResume: '云函数环境没有常驻 Quartz 调度器或可恢复作业'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧 Quartz 任务动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyLogBlocker') {
      const action = String(input.action || ''); const blockers = {
        TxtLog: '云函数运行时没有旧 /Log/{LogType}/ 本地日志目录', TxtLogContent: '云函数不能按文件名读取旧服务器文本日志', TxtLog_Down: '云函数没有旧服务器日志文件可下载',
        TaskList: '现有 SenTask 是空的发送任务类，不含旧 Content_ScheTask 的 TaskName/TaskContent/ExecuteType/Interval/TaskFlag 数据', TaskAdd: '目标缺少旧调度任务模型与 Hangfire 控制面', TaskAdd_API: '目标不能复制旧任务并向 Hangfire 注册 RecurringJob', TaskAdd_Submit: '目标缺少旧任务持久层、本地脚本校验与 Hangfire 调度运行时', Task_API: '目标不能对不存在的 Hangfire 任务执行删除、停用、启用或立即执行', TaskCenter: '云函数环境没有旧 Hangfire Dashboard 管理页面'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧日志任务动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'systemLogs') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim(); const type1 = String(input.type1 || '').trim(); const type2 = String(input.type2 || '').trim(); const startDate = String(input.startDate || '').trim(); const endDate = String(input.endDate || '').trim();
      if (search.length > 100 || type1.length > 100 || type2.length > 100) fail(400, '日志关键词或类型不能超过 100 个字符'); if ((startDate && !/^\d{4}-\d{2}-\d{2}$/.test(startDate)) || (endDate && !/^\d{4}-\d{2}-\d{2}$/.test(endDate))) fail(400, '日志日期格式必须为 YYYY-MM-DD'); const start = startDate ? new Date(startDate + 'T00:00:00+08:00') : null; const end = endDate ? new Date(new Date(endDate + 'T00:00:00+08:00').getTime() + 86400000) : null; if ((start && Number.isNaN(start.getTime())) || (end && Number.isNaN(end.getTime())) || (start && end && start >= end)) fail(400, '日志日期范围无效'); const fields = await schemaFor('SysLog');
      const scopedQuery = () => { const query = new Parse.Query('SysLog'); applyTenant(query, fields, context, input.companyId); if (type1) query.equalTo('type1', type1); if (type2) query.equalTo('type2', type2); if (start) query.greaterThanOrEqualTo('cdate', start); if (end) query.lessThan('cdate', end); return query; };
      let query = scopedQuery(); if (search) { const pattern = escapeRegex(search); query = Parse.Query.or(...['cname','detail','content1','content2','rawUrl'].map((field) => { const candidate = scopedQuery(); candidate.matches(field, pattern, 'i'); return candidate; })); } const total = await query.count({ useMasterKey: true }); query.descending('cdate'); query.skip((page - 1) * pageSize); query.limit(pageSize); const results = await query.find({ useMasterKey: true }); return response.json({ success: true, data: { className: 'SysLog', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'shopFareTemplates') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim(); if (search.length > 100) fail(400, '运费模板搜索词不能超过 100 个字符'); const fields = await schemaFor('ShopFareTlp'); const query = new Parse.Query('ShopFareTlp'); applyTenant(query, fields, context, input.companyId); if (search) query.matches('tlpName', escapeRegex(search), 'i'); query.ascending('id'); const total = await query.count({ useMasterKey: true }); query.skip((page - 1) * pageSize); query.limit(pageSize); const results = await query.find({ useMasterKey: true }); return response.json({ success: true, data: { className: 'ShopFareTlp', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'saveShopFareTemplate') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {}; const name = String(payload.tlpName || '').trim(); const priceMode = Number(payload.priceMode == null ? 0 : payload.priceMode); const remind = String(payload.remind || '').trim(); const remind2 = String(payload.remind2 || '').trim(); if (!name || name.length > 100 || !Number.isInteger(priceMode) || priceMode < 0 || priceMode > 10 || remind.length > 1000 || remind2.length > 1000) fail(400, '运费模板名称、计价方式或备注无效'); let rules; try { rules = typeof payload.express === 'string' ? JSON.parse(payload.express || '[]') : payload.express; } catch { fail(400, '运费规则必须是 JSON 数组'); } if (!Array.isArray(rules) || rules.length > 50 || rules.some((rule) => !rule || typeof rule !== 'object' || Array.isArray(rule) || String(rule.name || '').length > 100 || Object.values(rule).some((value) => typeof value === 'string' && value.length > 500))) fail(400, '运费规则格式无效或数量超过 50 条'); let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '运费模板必须指定帐套'); const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true }); const fields = await schemaFor('ShopFareTlp'); let target; let created = false; if (objectId) { const query = new Parse.Query('ShopFareTlp'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; } else { target = new Parse.Object('ShopFareTlp'); target.set('sourceKey', 'cloud:shop-fare-template:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('company', company); target.set('cdate', new Date()); target.set('userId', 0); target.set('adminId', Number(context.current.get('legacyUserId')) || 0); target.set('isFree', 0); target.set('regionBan', 0); created = true; }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "ShopFareTlp" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("tlpName",\'\')))=LOWER($3) LIMIT 1', [companyId, objectId, name]); if (duplicate) fail(409, '同一帐套的运费模板名称不能重复'); target.set('tlpName', name); target.set('priceMode', priceMode); target.set('express', JSON.stringify(rules)); target.set('remind', remind); target.set('remind2', remind2); try { await target.save(null, { useMasterKey: true }); } catch (error) { fail(422, '运费模板初始写入失败: ' + String(error && error.message || error)); }
      try { if (created) { const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-shop-fare-template-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("id"),0)+1 AS id FROM "ShopFareTlp",lock_row WHERE "company"=$1) UPDATE "ShopFareTlp" SET "id"=next_id.id,"sourceKey"=\'[["ID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]); if (!(Number(rows[0] && rows[0].id) || 0)) throw new Error('无法分配运费模板编号'); } } catch (error) { if (created) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '运费模板编号写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company: target.get('company') || company }, objectId ? 'update-shop-fare-template' : 'create-shop-fare-template', 'ShopFareTlp', target.id); return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'shopFareTemplateBatch') {
      if (String(input.action || '') !== 'delete') fail(400, '不支持的运费模板批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个运费模板'); const fields = await schemaFor('ShopFareTlp'); const query = new Parse.Query('ShopFareTlp'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分运费模板不存在或不属于当前帐套'); await Parse.Object.destroyAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'delete-shop-fare-template', 'ShopFareTlp', target.id); return response.json({ success: true, data: { action: 'delete', updated: targets.length } });
    }
    if (operation === 'legacyShopExpBlocker') {
      const action = String(input.action || ''); const blockers = {
        OrderSend: '目标 Schema 缺少旧 OrderList 订单主表与 Order_Exp 物流单', OrderSend_Submit: '目标缺少订单物流状态、物流单、用户收件手机、SMSConfig 发货模板和 SafeMobile 日志链',
        Factory: '目标 Schema 缺少旧 Manufacturers 厂商主表与历史厂商数据', FactoryAdd: '目标无可编辑或新增的 Manufacturers 厂商记录', FactoryAdd_Submit: '目标缺少厂商名称、简称、地址、电话、传真、网站、分类、图片和介绍持久层', Factory_API: '目标没有可删除或启用的厂商记录', Factory_select: '目标没有可按 Producername 搜索选择的厂商数据',
        Trademark: '目标 Schema 缺少旧 Trademark 品牌主表与历史品牌数据', TrademarkAdd: '目标无可编辑或新增的 Trademark 品牌记录', Trademark_Submit: '目标缺少品牌名称、厂商、分类、启用/置顶/推荐、图片和介绍持久层', Trademark_API: '目标没有可删除或启用的品牌记录', Trademark_select: '目标没有可按 Trname 搜索选择的品牌数据'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧商城配送动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyChatBlocker') {
      const action = String(input.action || ''); const blockers = {
        Default: '目标 Schema 缺少 ChatMsg 消息表，无法还原用户消息数列表',
        UserChatHistory: '目标缺少 ChatMsg、ChatGroup 与个人/群组会话关系，无法聚合聊天对象',
        UserFriend: '目标缺少旧 User_Friend 好友关系与历史数据；UserFriendGroup 只是好友分组，不是好友关系',
        Group: '目标 Schema 缺少 ChatGroup 群组主表与历史群组',
        GroupAdd: '目标无可定位和编辑的 ChatGroup 群组记录',
        GroupAdd_Submit: '目标缺少 ChatGroup/ChatGroupUser 群主、管理员与成员关系，无法保持旧更换群主逻辑',
        GroupUser: '目标 Schema 缺少 ChatGroupUser 群成员和管理员记录',
        MessageHistory: '目标缺少 ChatMsg 个人/群组消息、发送者与接收者关系',
        Config: '目标没有旧 RoomConfig TRTC AppID/SecretKey 配置持久层和聊天运行时',
        Config_Submit: '目标没有消费 TRTC 密钥的聊天服务，保存配置不会生效且会伪造迁移完成',
        Chat_API: '目标缺少 ChatMsg/ChatGroup/ChatGroupUser 可删除、启停或授权的旧聊天记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧聊天动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyDesignClassBlocker') {
      const action = String(input.action || ''); const blockers = {
        ClassList: '目标 Schema 缺少 DesignTlpClass/Design_TlpClass 模板分类主表与历史分类数据',
        ClassAdd: '目标无可定位或新建的模板分类数据类；DesignTlp 仅保留数字 classId 引用',
        ClassAdd_Submit: '历史 DesignTlp 引用 classId=6，但分类 6 的名称、父级、排序和说明已丢失，不能伪造保存',
        Class_API: '目标无可删除的模板分类记录，且直接处理 classId=6 会使既有 DesignTlp 引用悬空'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧模板分类动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyComBlocker') {
      const action = String(input.action || ''); const blockers = {
        SPwdCheck: '目标管理员会话没有旧 Manager.RandNumber 二级密码验证状态和业务消费者，不能伪造 SPWD Session',
        Import: '目标与云函数运行时缺少旧 /Config/Import/{mode}.xml 导入定义',
        Import_DownTlp: '缺少旧 XML 字段别名、隐藏字段、类型与默认值规则，无法等价生成 xlsx 模板',
        Import_Submit: '云函数没有旧 XML+NPOI 动态表导入流水线，也不允许按客户端表名直接插入',
        ImportForContent: '目标缺少旧动态模型附表结构与通用 xlsx 内容导入页',
        ImportForContent_DownTlp: '目标无法从旧模型动态附表还原完整 xlsx 字段模板',
        ImportForContent_Submit: '目标缺少动态模型附表批量写入流程，商品分支还缺少 ZL_Commodities 主表'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧通用后台动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacyCommonBlocker') {
      const action = String(input.action || ''); const blockers = {
        UserBaseField: '目标缺少旧 B_UserBaseField 动态字段定义与 ZL_UserBase 原始扩展行；Profile 不是等价的动态字段模型',
        ContentField: '目标只保留 CommonModel 主记录与部分规范化副表，缺少按 TableName/ModelID 动态解析任意旧内容附表的数据与渲染层',
        SelUploadFiles: '旧交付包与官方源码均缺少 SelUploadFiles 视图，且当前 PostgreSQL Parse 文件适配器无法完成上传/选择流程'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧公共动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'legacySiteConfigBlocker') {
      const action = String(input.action || ''); const blockers = {
        Index: '旧配置首页只跳转 SiteInfo，目标没有签约的统一站点配置模型与运行时',
        SiteInfo: '目标缺少 SiteConfig.SiteInfo/SiteOption 站名、Logo、站长、版权、全站 JS 与后台目录配置模型',
        SiteInfo_Submit: '云函数无法更名 ASP.NET 后台路径或通过 web.config 重启宿主，也没有统一站点配置消费者',
        SiteOption: '目标没有旧 SiteOption/ShopConfig/UserConfig 的域名、模板、上传、审核、积分与安全策略聚合模型',
        SiteOption_Submit: '现有云函数未消费旧 SiteOption 的数十项站点/商城/互动规则，不能伪造保存生效',
        MailConfig: '目标缺少 SiteConfig.MailConfig SMTP 服务器、端口、帐号和收件列表配置模型',
        MailConfig_Submit: '目标无统一 SMTP 邮件发送运行时消费旧密码配置，MailTemp 只是模板而非邮件通道',
        UserConfig: '目标缺少 SiteConfig.UserConfig 注册、审核、验证码、必填字段、奖励与提现规则模型',
        UserConfig_Submit: '当前注册/登录云函数未实现旧 UserConfig 规则消费层，仅存储配置不会生效',
        SetOrderStatus: '目标缺少 OrderConfig 订单/配送/支付状态文案配置，且 ZL_Commodities/订单主链未迁入',
        SetOrderStatus_Submit: '目标无订单运行时消费 21 类旧状态文案，不能伪造保存',
        SMSCfg: '目标缺少 SMSConfig 多供应商帐号、密钥、签名、模板与频率限制模型',
        SMSConfig_Submit: '当前云函数没有可消费旧 SMSConfig 的短信网关，密码重置也因缺短信验证明确阻塞',
        ThumbConfig: '目标缺少 WaterModuleConfig/ThumbsConfig 水印、文字样式、尺寸与缩略图规则模型',
        ThumbConfig_Submit: '当前 PostgreSQL Parse 文件适配器配置错误，也没有图片上传后执行旧水印/缩略图规则的处理器',
        AppConfig: '目标云函数宿主没有 ASP.NET defaultDocument、customErrors、MIME 和扩展名配置界面',
        AppConfig_Submit: '云函数无法改写/重启旧 web.config 宿主，目标部署运行时也不消费这些 ASP.NET 选项',
        APPConfig_ReInstall: '目标没有旧 IsInstalled 状态与 /Install/Index 重新安装流程，云函数不应破坏现有生产库'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧站点配置动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'baikeEntries') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20)); const search = String(input.search || '').trim().toLowerCase(); const status = Number(input.status == null ? -100 : input.status); const elite = Number(input.elite == null ? -100 : input.elite); if (search.length > 100 || ![-100,0,1].includes(status) || ![-100,0,1].includes(elite)) fail(400, '百科搜索或状态筛选无效'); const fields = await schemaFor('Baike'); const query = new Parse.Query('Baike'); applyTenant(query, fields, context, input.companyId); query.limit(1000); let results = await query.find({ useMasterKey: true }); results = results.filter((entry) => (status === -100 || Number(entry.get('status')) === status) && (elite === -100 || Number(entry.get('elite')) === elite) && (!search || [entry.get('tittle'),entry.get('brief'),entry.get('contents'),entry.get('userName'),entry.get('classification')].some((value) => String(value || '').toLowerCase().includes(search)))); results.sort((left,right) => Number(right.get('id') || 0) - Number(left.get('id') || 0)); const total = results.length; results = results.slice((page - 1) * pageSize, page * pageSize); return response.json({ success: true, data: { className: 'Baike', page, pageSize, total, results: results.map(serializeObject) } });
    }
    if (operation === 'baikeBatch') {
      const action = String(input.action || ''); if (!['audit','unaudit','elite','unelite'].includes(action)) fail(400, '不支持的百科批量操作'); const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId]; const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))]; if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 个百科词条'); const fields = await schemaFor('Baike'); const query = new Parse.Query('Baike'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length); const targets = await query.find({ useMasterKey: true }); if (targets.length !== objectIds.length) fail(404, '部分百科词条不存在或不属于当前帐套'); for (const target of targets) { if (action === 'audit') target.set('status', 1); if (action === 'unaudit') target.set('status', 0); if (action === 'elite') target.set('elite', 1); if (action === 'unelite') target.set('elite', 0); } await Parse.Object.saveAll(targets, { useMasterKey: true }); for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'baike-' + action, 'Baike', target.id); return response.json({ success: true, data: { action, updated: targets.length, results: targets.map(serializeObject) } });
    }
    if (operation === 'legacyBaikeBlocker') {
      const action = String(input.action || ''); const blockers = {
        BKVersionList: '目标 Schema 缺少旧 BaikeEdit 版本表、待审核版本内容与历史版本数据',
        Version_API: '目标无 BaikeEdit 版本记录，无法审核后 Apply、取消审核、驳回或删除版本',
        BKList: '旧 BKList 按 Flow 读取 BaikeEdit 词条版本链，目标仅保留一条 Baike 主记录',
        Config: '目标没有 GuestConfig.BKOption 百科运行时、用户组权限和积分奖励消费者',
        Config_Submit: '目标没有百科创建/编辑/推荐运行时执行 CreatePoint/EditPoint/RemmPoint 规则，不能伪造配置生效'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧百科动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'saveExamClass') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const className = String(payload.cClassName || '').trim();
      const parentId = Number(input.parentId == null ? payload.cClassid || 0 : input.parentId);
      const classType = Number(input.classType == null ? payload.cClassType || 1 : input.classType);
      const orderId = Number(input.orderId == null ? payload.cOrderBy || 0 : input.orderId);
      if (!className || className.length > 255) fail(400, '试题分类名称长度应为 1 至 255 位');
      if (!Number.isInteger(parentId) || parentId < 0) fail(400, '父试题分类编号无效');
      if (![1,2].includes(classType)) fail(400, '试题分类类型只能是答题类型或视频操作类型');
      if (!Number.isInteger(orderId) || orderId < 0) fail(400, '试题分类排序必须是非负整数');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '试题分类必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const fields = await schemaFor('ExamClass');
      let target;
      let currentId = 0;
      if (objectId) {
        const query = new Parse.Query('ExamClass'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId; currentId = Number(target.get('cId')) || 0;
      } else target = new Parse.Object('ExamClass');
      if (parentId > 0) {
        const parent = await Psql.oneOrNone('SELECT "cId" FROM "ExamClass" WHERE "company"=$1 AND "cId"=$2 LIMIT 1', [companyId, parentId]);
        if (!parent) fail(404, '父试题分类不存在或不属于当前帐套');
        if (currentId) {
          const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "cId","cClassid",ARRAY["cId"::text] AS path FROM "ExamClass" WHERE "company"=$1 AND "cId"=$2 UNION ALL SELECT c."cId",c."cClassid",chain.path||c."cId"::text FROM "ExamClass" c JOIN chain ON c."cId"=chain."cClassid" WHERE c."company"=$1 AND NOT c."cId"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "cId"=$3 LIMIT 1', [companyId, parentId, currentId]);
          if (cycle) fail(409, '不能把试题分类移动到自身或其下级分类');
        }
      }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "ExamClass" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("cClassName",\'\')))=LOWER($3) LIMIT 1', [companyId, objectId, className]);
      if (duplicate) fail(409, '同一帐套的试题分类名称不能重复');
      target.set('cClassName', className); target.set('cClassid', parentId); target.set('cClassType', classType); target.set('company', company);
      if (objectId) target.set('cOrderBy', orderId); else target.set('sourceKey', 'cloud:admin-exam-class:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10));
      try { await target.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '试题分类初始写入失败: ' + String(error && error.message || error)); }
      try {
        if (!objectId) {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-exam-class-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("cId"),0)+1 AS id FROM "ExamClass",lock_row WHERE "company"=$1 AND COALESCE("cId",0)>0), next_order AS MATERIALIZED (SELECT COALESCE(MAX("cOrderBy"),0)+1 AS id FROM "ExamClass",lock_row WHERE "company"=$1 AND "objectId"<>$2) UPDATE "ExamClass" SET "cId"=next_id.id,"cOrderBy"=CASE WHEN $3>0 THEN $3 ELSE next_order.id END,"sourceKey"=\'[["C_id",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id,next_order WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id, orderId]);
          currentId = Number(rows[0] && rows[0].id) || 0;
          if (!currentId) throw new Error('无法分配试题分类编号');
        }
      } catch (error) { if (!objectId) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '试题分类结构写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-exam-class' : 'create-exam-class', 'ExamClass', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'examClassChildren') {
      const parentId = Number(input.parentId || 0);
      if (!Number.isInteger(parentId) || parentId < 0) fail(400, '父试题分类编号无效');
      const fields = await schemaFor('ExamClass'); const query = new Parse.Query('ExamClass'); applyTenant(query, fields, context, input.companyId); query.equalTo('cClassid', parentId); query.ascending('cOrderBy'); query.limit(1000);
      const results = await query.find({ useMasterKey: true });
      return response.json({ success: true, data: { parentId, results: results.map(serializeObject) } });
    }
    if (operation === 'saveExamPoint') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const pointName = String(payload.testPoint || '').trim();
      const parentId = Number(input.parentId == null ? payload.tid || 0 : input.parentId);
      const orderId = Number(input.orderId == null ? payload.orderBy || 0 : input.orderId);
      if (!pointName || pointName.length > 50) fail(400, '考点名称长度应为 1 至 50 位');
      if (!Number.isInteger(parentId) || parentId < 0) fail(400, '上级考点编号无效');
      if (!Number.isInteger(orderId) || orderId < 0) fail(400, '考点排序必须是非负整数');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '考点必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const fields = await schemaFor('ExamPoint');
      let target;
      let currentId = 0;
      if (objectId) {
        const query = new Parse.Query('ExamPoint'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId; currentId = Number(target.get('id')) || 0;
      } else target = new Parse.Object('ExamPoint');
      if (parentId > 0) {
        const parent = await Psql.oneOrNone('SELECT "id" FROM "ExamPoint" WHERE "company"=$1 AND "id"=$2 LIMIT 1', [companyId, parentId]);
        if (!parent) fail(404, '上级考点不存在或不属于当前帐套');
        if (currentId) {
          const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "id","tid",ARRAY["id"::text] AS path FROM "ExamPoint" WHERE "company"=$1 AND "id"=$2 UNION ALL SELECT p."id",p."tid",chain.path||p."id"::text FROM "ExamPoint" p JOIN chain ON p."id"=chain."tid" WHERE p."company"=$1 AND NOT p."id"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "id"=$3 LIMIT 1', [companyId, parentId, currentId]);
          if (cycle) fail(409, '不能把考点移动到自身或其下级考点');
        }
      }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "ExamPoint" WHERE "company"=$1 AND "objectId"<>$2 AND LOWER(TRIM(COALESCE("testPoint",\'\')))=LOWER($3) LIMIT 1', [companyId, objectId, pointName]);
      if (duplicate) fail(409, '同一帐套的考点名称不能重复');
      target.set('testPoint', pointName); target.set('tid', parentId); target.set('company', company);
      if (objectId) target.set('orderBy', orderId);
      else { target.set('sourceKey', 'cloud:admin-exam-point:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('addUser', Number(context.current.get('legacyUserId')) || 0); target.set('addTime', new Date()); }
      try { await target.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '考点初始写入失败: ' + String(error && error.message || error)); }
      try {
        if (!objectId) {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-exam-point-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("id"),0)+1 AS id FROM "ExamPoint",lock_row WHERE "company"=$1 AND COALESCE("id",0)>0), next_order AS MATERIALIZED (SELECT COALESCE(MAX("orderBy"),0)+1 AS id FROM "ExamPoint",lock_row WHERE "company"=$1 AND "objectId"<>$2) UPDATE "ExamPoint" SET "id"=next_id.id,"orderBy"=CASE WHEN $3>0 THEN $3 ELSE next_order.id END,"sourceKey"=\'[["ID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id,next_order WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id, orderId]);
          currentId = Number(rows[0] && rows[0].id) || 0;
          if (!currentId) throw new Error('无法分配考点编号');
        }
      } catch (error) { if (!objectId) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '考点结构写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-exam-point' : 'create-exam-point', 'ExamPoint', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'saveKnowledge') {
      const objectId = String(input.objectId || '');
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const knowledgeName = String(payload.kName || '').trim();
      const classId = Number(input.classId == null ? payload.kClassId || 0 : input.classId);
      const parentId = Number(input.parentId == null ? payload.pid || 0 : input.parentId);
      const orderId = Number(input.orderId == null ? payload.kOrderBy || 0 : input.orderId);
      const status = Number(payload.status == null ? 1 : payload.status);
      const grade = Number(payload.grade || 0);
      const isSys = Number(payload.isSys || 0);
      if (!knowledgeName || knowledgeName.length > 200) fail(400, '知识点名称长度应为 1 至 200 位');
      if (!Number.isInteger(classId) || classId < 1) fail(400, '请选择有效试题分类');
      if (!Number.isInteger(parentId) || parentId < 0) fail(400, '父知识点编号无效');
      if (!Number.isInteger(orderId) || orderId < 0) fail(400, '知识点排序必须是非负整数');
      if (![0,1].includes(status) || !Number.isInteger(grade) || grade < 0 || ![0,1].includes(isSys)) fail(400, '知识点状态、年级或系统标记无效');
      let companyId = pointerId(context.company);
      if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId);
      if (!companyId) fail(400, '知识点必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      const subject = await Psql.oneOrNone('SELECT "cId" FROM "ExamClass" WHERE "company"=$1 AND "cId"=$2 LIMIT 1', [companyId, classId]);
      if (!subject) fail(404, '试题分类不存在或不属于当前帐套');
      const fields = await schemaFor('QuestionsKnowledge');
      let target;
      let currentId = 0;
      if (objectId) {
        const query = new Parse.Query('QuestionsKnowledge'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true });
        companyId = pointerId(target.get('company')) || companyId; currentId = Number(target.get('kId')) || 0;
      } else target = new Parse.Object('QuestionsKnowledge');
      if (parentId > 0) {
        const parent = await Psql.oneOrNone('SELECT "kId" FROM "QuestionsKnowledge" WHERE "company"=$1 AND "kId"=$2 AND "kClassId"=$3 LIMIT 1', [companyId, parentId, classId]);
        if (!parent) fail(404, '父知识点不存在、科目不一致或不属于当前帐套');
        if (currentId) {
          const cycle = await Psql.oneOrNone('WITH RECURSIVE chain AS (SELECT "kId","pid",ARRAY["kId"::text] AS path FROM "QuestionsKnowledge" WHERE "company"=$1 AND "kId"=$2 UNION ALL SELECT k."kId",k."pid",chain.path||k."kId"::text FROM "QuestionsKnowledge" k JOIN chain ON k."kId"=chain."pid" WHERE k."company"=$1 AND NOT k."kId"::text=ANY(chain.path)) SELECT 1 AS found FROM chain WHERE "kId"=$3 LIMIT 1', [companyId, parentId, currentId]);
          if (cycle) fail(409, '不能把知识点移动到自身或其下级知识点');
        }
      }
      const duplicate = await Psql.oneOrNone('SELECT "objectId" FROM "QuestionsKnowledge" WHERE "company"=$1 AND "objectId"<>$2 AND "kClassId"=$3 AND LOWER(TRIM(COALESCE("kName",\'\')))=LOWER($4) LIMIT 1', [companyId, objectId, classId, knowledgeName]);
      if (duplicate) fail(409, '同一试题分类中的知识点名称不能重复');
      target.set('kName', knowledgeName); target.set('kClassId', classId); target.set('pid', parentId); target.set('status', status); target.set('grade', grade); target.set('isSys', isSys); target.set('company', company);
      if (objectId) target.set('kOrderBy', orderId);
      else { target.set('sourceKey', 'cloud:admin-knowledge:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('cuser', Number(context.current.get('legacyUserId')) || 0); target.set('cdate', new Date()); }
      try { await target.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '知识点初始写入失败: ' + String(error && error.message || error)); }
      try {
        if (!objectId) {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-knowledge-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("kId"),0)+1 AS id FROM "QuestionsKnowledge",lock_row WHERE "company"=$1 AND COALESCE("kId",0)>0), next_order AS MATERIALIZED (SELECT COALESCE(MAX("kOrderBy"),0)+1 AS id FROM "QuestionsKnowledge",lock_row WHERE "company"=$1 AND "kClassId"=$3 AND "pid"=$4 AND "objectId"<>$2) UPDATE "QuestionsKnowledge" SET "kId"=next_id.id,"kOrderBy"=CASE WHEN $5>0 THEN $5 ELSE next_order.id END,"sourceKey"=\'[["k_id",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id,next_order WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id, classId, parentId, orderId]);
          currentId = Number(rows[0] && rows[0].id) || 0;
          if (!currentId) throw new Error('无法分配知识点编号');
        }
      } catch (error) { if (!objectId) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '知识点结构写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-knowledge' : 'create-knowledge', 'QuestionsKnowledge', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'knowledgeChildren') {
      const parentId = Number(input.parentId || 0); const classId = Number(input.classId || 0);
      if (!Number.isInteger(parentId) || parentId < 0 || !Number.isInteger(classId) || classId < 1) fail(400, '知识点父级或试题分类编号无效');
      const fields = await schemaFor('QuestionsKnowledge'); const query = new Parse.Query('QuestionsKnowledge'); applyTenant(query, fields, context, input.companyId); query.equalTo('kClassId', classId); query.equalTo('pid', parentId); query.ascending('kOrderBy'); query.limit(1000);
      const results = await query.find({ useMasterKey: true });
      return response.json({ success: true, data: { classId, parentId, results: results.map(serializeObject) } });
    }
    if (operation === 'saveExamTeacher') {
      const objectId = String(input.objectId || ''); const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      const teacherName = String(payload.tname || '').trim(); const classId = Number(input.classId == null ? payload.tclsss || 0 : input.classId);
      if (!teacherName || teacherName.length > 50) fail(400, '教师姓名长度应为 1 至 50 位');
      if (!Number.isInteger(classId) || classId < 0) fail(400, '任教试题分类编号无效');
      let companyId = pointerId(context.company); if (context.isSuperAdmin && input.companyId) companyId = String(input.companyId); if (!companyId) fail(400, '教师必须指定帐套');
      const company = await new Parse.Query('Company').get(companyId, { useMasterKey: true });
      if (classId > 0) { const subject = await Psql.oneOrNone('SELECT "cId" FROM "ExamClass" WHERE "company"=$1 AND "cId"=$2 LIMIT 1', [companyId, classId]); if (!subject) fail(404, '任教试题分类不存在或不属于当前帐套'); }
      const fields = await schemaFor('ExTeacher'); let target;
      if (objectId) { const query = new Parse.Query('ExTeacher'); applyTenant(query, fields, context, input.companyId); target = await query.get(objectId, { useMasterKey: true }); companyId = pointerId(target.get('company')) || companyId; }
      else target = new Parse.Object('ExTeacher');
      const limits = { post: 50, teach: 50, fileUpload: 255, remark: 1000 };
      for (const [name, limit] of Object.entries(limits)) { const value = String(payload[name] || '').trim(); if (value.length > limit) fail(400, name + ' 超出最大长度 ' + limit); target.set(name, value); }
      target.set('tname', teacherName); target.set('tclsss', classId); target.set('company', company); target.set('addUser', Number(context.current.get('legacyUserId')) || 0);
      if (!objectId) { target.set('sourceKey', 'cloud:admin-exam-teacher:' + companyId + ':' + Date.now() + ':' + Math.random().toString(36).slice(2,10)); target.set('creatTime', new Date()); }
      try { await target.save(null, { useMasterKey: true }); }
      catch (error) { fail(422, '教师初始写入失败: ' + String(error && error.message || error)); }
      try {
        if (!objectId) {
          const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-exam-teacher-id:\'||$1))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("id"),0)+1 AS id FROM "ExTeacher",lock_row WHERE "company"=$1 AND COALESCE("id",0)>0) UPDATE "ExTeacher" SET "id"=next_id.id,"sourceKey"=\'[["ID",\'||next_id.id::text||\']]\',"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id', [companyId, target.id]);
          if (!(Number(rows[0] && rows[0].id) || 0)) throw new Error('无法分配教师编号');
        }
      } catch (error) { if (!objectId) await target.destroy({ useMasterKey: true }).catch(() => undefined); fail(422, '教师编号写入失败: ' + String(error && error.message || error)); }
      await target.fetch({ useMasterKey: true }); await audit({ ...context, company }, objectId ? 'update-exam-teacher' : 'create-exam-teacher', 'ExTeacher', target.id);
      return response.json({ success: true, data: serializeObject(target) });
    }
    if (operation === 'barBatch') {
      const action = String(input.action || '');
      const actions = ['audit','unaudit','recycle','recover','move','top-global','top-section','top-undo','elite','elite-undo','bottom','bottom-undo'];
      if (!actions.includes(action)) fail(400, '不支持的贴吧帖子批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条帖子');
      const fields = await schemaFor('GuestBar');
      const query = new Parse.Query('GuestBar'); applyTenant(query, fields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分帖子不存在或不属于当前帐套');
      let cateId = null;
      if (action === 'move') {
        cateId = Number(input.cateId);
        if (!Number.isInteger(cateId) || cateId < 1) fail(400, '目标贴吧分类编号无效');
        const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))];
        if (companyIds.length !== 1) fail(400, '批量移动的帖子必须属于同一帐套');
        const category = await Psql.oneOrNone('SELECT "objectId" FROM "Guestcate" WHERE "company"=$1 AND "cateid"=$2 AND COALESCE("gtype",0)=1 LIMIT 1', [companyIds[0], cateId]);
        if (!category) fail(404, '目标贴吧分类不存在或不属于当前帐套');
      }
      for (const target of targets) {
        if (action === 'audit' || action === 'recover') target.set('status', 99);
        else if (action === 'unaudit') target.set('status', 0);
        else if (action === 'recycle') target.set('status', -2);
        else if (action === 'move') target.set('cateId', cateId);
        else if (action === 'top-global') target.set('orderFlag', 2);
        else if (action === 'top-section') target.set('orderFlag', 1);
        else if (action === 'bottom') target.set('orderFlag', -1);
        else if (action === 'top-undo' || action === 'bottom-undo') target.set('orderFlag', 0);
        else {
          const flags = String(target.get('postFlag') || '').split(',').map((value) => value.trim()).filter(Boolean);
          const next = new Set(flags);
          if (action === 'elite') next.add('Recommend'); else next.delete('Recommend');
          target.set('postFlag', next.size ? ',' + [...next].join(',') + ',' : '');
        }
      }
      await Parse.Object.saveAll(targets, { useMasterKey: true });
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'bar-' + action, 'GuestBar', target.id);
      return response.json({ success: true, data: { action, updated: targets.length, cateId, results: targets.map(serializeObject) } });
    }
    if (operation === 'legacyContentUtility') {
      const action = String(input.action || '');
      if (action === 'get-md-file') return response.json({ success: true, data: { content: '' } });
      if (action === 'duplicate-title') {
        const title = String(input.title || '').trim();
        if (!title || title.length > 500) fail(400, '标题长度应为 1 至 500 位');
        const fields = await schemaFor('CommonModel'); const query = new Parse.Query('CommonModel'); applyTenant(query, fields, context, input.companyId); query.matches('title', '^' + escapeRegex(title) + '$', 'i'); query.descending('updatedAt'); query.limit(100);
        const results = await query.find({ useMasterKey: true });
        return response.json({ success: true, data: { title, total: results.length, results: results.map((target) => { const item = serializeObject(target); return { objectId: item.objectId, generalId: item.generalId, title: item.title, nodeId: item.nodeId, status: item.status, updatedAt: item.updatedAt }; }) } });
      }
      if (action === 'export') {
        const requestedIds = Array.isArray(input.objectIds) ? [...new Set(input.objectIds.map((value) => String(value || '').trim()).filter(Boolean))] : [];
        if (requestedIds.length > 1000) fail(400, '每次最多导出 1000 条内容');
        const fields = await schemaFor('CommonModel'); const query = new Parse.Query('CommonModel'); applyTenant(query, fields, context, input.companyId); if (requestedIds.length) query.containedIn('objectId', requestedIds); query.descending('updatedAt'); query.limit(requestedIds.length || 1000);
        const results = await query.find({ useMasterKey: true });
        if (requestedIds.length && results.length !== requestedIds.length) fail(404, '部分内容不存在或不属于当前帐套');
        const rows = results.map((target) => ({ id: Number(target.get('generalId')) || 0, title: String(target.get('title') || ''), inputer: String(target.get('inputer') || ''), hits: Number(target.get('hits')) || 0, elite: Number(target.get('eliteLevel')) || 0, status: Number(target.get('status')) || 0, createTime: safeValue(target.get('createTime')), updateTime: safeValue(target.get('upDateTime')) }));
        return response.json({ success: true, data: { total: rows.length, rows } });
      }
      fail(400, '不支持的旧内容兼容动作');
    }
    if (operation === 'legacyContentBlocker') {
      const action = String(input.action || ''); const blockers = {
        Content_AddToNew: '目标缺少按 CommonModel.tableName 动态复制任意旧模型附表的完整结构与数据',
        AddToSpec: 'CommonModel.specialId 仅存在于 Parse Schema，PostgreSQL 物理查询仍失败，无法安全读取专题关系',
        AddToSpec_Submit: '专题关系物理列不可可靠读写，且商品主表未迁移，不能伪造内容加入专题成功',
        ContentManage_Html: '云函数运行时没有旧模板解析器、站点根目录与静态 HTML 文件宿主',
        ContentRelease: '目标 Schema 缺少 Content_ScheTask 定时内容任务及既有任务记录',
        ContentRelease_Submit: '目标没有 HFHelper 调度器与 ZL_Task_Content 脚本执行运行时',
        CreateHtmlContent: '云函数没有旧节点模板、标签解析器与站点文件系统，无法预览静态生成范围',
        Create_Submit: '目标没有 ContentHtmlHelper 和旧模板标签运行时，无法执行内容静态生成任务',
        CreateHtml: '目标云函数不能写入旧站点 HTML 目录，也没有旧模板渲染环境',
        ConCatch: '目标缺少旧采集项目、采集规则、来源站点与任务历史数据',
        CatchConfig: '目标没有 SiteOption.Coll_Allow/Coll_Key 配置模型及采集运行时消费者',
        CatchConfig_Submit: '仅保存采集开关不会产生可执行采集能力，目标也没有旧 SiteConfig 更新链',
        MarkDown: '目标 Schema 缺少旧 Content_MarkDown 主表与历史 Markdown 记录',
        MarkDown_Del: '目标没有可定位并删除的旧 Content_MarkDown 记录'
      }; if (!Object.prototype.hasOwnProperty.call(blockers, action)) fail(400, '不支持的旧内容动作'); fail(501, 'migration_blocked: ' + blockers[action]);
    }
    if (operation === 'contentBatch') {
      const action = String(input.action || '');
      if (!['status','recycle','recover','move','refresh'].includes(action)) fail(400, '不支持的内容批量操作');
      const requestedIds = Array.isArray(input.objectIds) ? input.objectIds : [input.objectId];
      const objectIds = [...new Set(requestedIds.map((value) => String(value || '').trim()).filter(Boolean))];
      if (!objectIds.length || objectIds.length > 100) fail(400, '每次请选择 1 至 100 条内容');
      const contentFields = await schemaFor('CommonModel');
      const query = new Parse.Query('CommonModel'); applyTenant(query, contentFields, context, input.companyId); query.containedIn('objectId', objectIds); query.limit(objectIds.length);
      const targets = await query.find({ useMasterKey: true });
      if (targets.length !== objectIds.length) fail(404, '部分内容不存在或不属于当前帐套');
      let status = null;
      let nodeId = null;
      if (action === 'status') {
        status = Number(input.status);
        if (![-3,-1,0,99].includes(status)) fail(400, '不支持的内容状态');
      } else if (action === 'recycle') status = -2;
      else if (action === 'recover') status = 0;
      else if (action === 'move') {
        nodeId = Number(input.nodeId);
        if (!Number.isInteger(nodeId) || nodeId < 1) fail(400, '请选择有效目标节点');
        const companyIds = [...new Set(targets.map((target) => pointerId(target.get('company'))).filter(Boolean))];
        if (companyIds.length !== 1) fail(400, '批量移动的内容必须属于同一帐套');
        const node = await Psql.oneOrNone('SELECT "objectId" FROM "Node" WHERE "company"=$1 AND "nodeId"=$2 AND COALESCE("zstatus",99)<>-2 LIMIT 1', [companyIds[0], nodeId]);
        if (!node) fail(404, '目标节点不存在或不属于当前帐套');
      }
      for (const target of targets) {
        if (status !== null) target.set('status', status);
        if (nodeId !== null) target.set('nodeId', nodeId);
        if (action === 'refresh') { const now = new Date(); target.set('createTime', now); target.set('upDateTime', now); }
      }
      await Parse.Object.saveAll(targets, { useMasterKey: true });
      for (const target of targets) await audit({ ...context, company: target.get('company') || context.company }, 'content-' + action, 'CommonModel', target.id);
      return response.json({ success: true, data: { action, updated: targets.length, status, nodeId, results: targets.map(serializeObject) } });
    }
    const className = String(input.className || '');
    assertClass(className);
    const fields = await schemaFor(className);
    const classWritable = !READ_ONLY_CLASSES.has(className);
    if (operation === 'schema') {
      const fieldList = Object.entries(fields).filter(([name]) => !HIDDEN_FIELDS.has(name) && !/(?:password|secret|sessiontoken|masterkey|privatekey)/i.test(name)).map(([name, field]) => ({ name, type: field.type, targetClass: field.targetClass, required: field.required === true, writable: classWritable && !isSystemField(className, name) && GENERIC_WRITE_TYPES.has(field.type) }));
      return response.json({ success: true, data: { className, label: CLASS_LABELS[className] || className, fields: fieldList, writable: classWritable, creatable: classWritable && !['CommonModel','Model','ModelField','Guestbook','Currency','SysHoliday','Search','AdZone','AdInfo','FontPicShape','FontPicShapeType','DesignAsk','DesignQuestion','DesignRes','Temp','StoreApplication','StoreStyle','UserLevel'].includes(className), supportsSoftDelete: Boolean(fields.isDeleted) } });
    }
    if (operation === 'list') {
      const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20));
      let query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId);
      const search = String(input.search || '').trim();
      if (search) { const searchField = ['name','title','pName','pTitle','questionTitle','tName','newsName','nodeName','specName','modelName','fieldName','fieldAlias','groupName','categoryname','dicname','cateName','gradeName','cClassName','testPoint','kName','tname','username','realName','mobile','sourceKey'].find((name) => fields[name] && fields[name].type === 'String'); if (searchField) query.matches(searchField, escapeRegex(search), 'i'); }
      const sort = fields[input.sort] ? String(input.sort) : fields.updatedAt ? 'updatedAt' : 'createdAt'; if (input.order === 'asc') query.ascending(sort); else query.descending(sort);
      const total = await query.count({ useMasterKey: true }); query.skip((page - 1) * pageSize); query.limit(pageSize);
      const results = (await query.find({ useMasterKey: true })).filter(isVisible);
      return response.json({ success: true, data: { className, page, pageSize, total, results: results.map(serializeObject) } });
    }
    const objectId = String(input.objectId || '');
    if (operation === 'get') {
      if (!objectId) fail(400, '缺少 objectId'); const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); const object = await query.get(objectId, { useMasterKey: true });
      return response.json({ success: true, data: serializeObject(object) });
    }
    if (operation === 'save') {
      if (!classWritable) fail(403, '该系统类不允许通用编辑');
      if (className === '_User' && !objectId) fail(400, '新增用户必须走专用开户流程');
      if (className === 'Group') fail(400, '用户组必须走专用保存流程');
      if (className === 'Node') fail(400, '栏目必须走专用保存流程');
      if (className === 'Special') fail(400, '专题必须走专用保存流程');
      if (className === 'Model' || className === 'ModelField') fail(400, '模型结构必须走专用元数据流程');
      if (className === 'Guestbook') fail(400, '留言必须走专用编辑或回复流程');
      if (className === 'Guestcate') fail(400, '留言/贴吧分类必须走专用保存流程');
      if (className === 'ExamClass') fail(400, '试题分类必须走专用保存流程');
      if (className === 'ExamPoint') fail(400, '考点必须走专用保存流程');
      if (className === 'QuestionsKnowledge') fail(400, '知识点必须走专用保存流程');
      if (className === 'ExTeacher') fail(400, '考试教师必须走专用保存流程');
      if (className === 'Datadiccategory' || className === 'Datadic') fail(400, '数据字典必须走专用保存流程');
      if (className === 'GradeCate' || className === 'Grade') fail(400, '多级数据字典必须走专用保存流程');
      if (className === 'Currency') fail(400, '货币必须走专用保存流程');
      if (className === 'SysHoliday') fail(400, '节假日必须走专用保存流程');
      if (className === 'Search') fail(400, '快捷入口必须走专用保存流程');
      if (className === 'AdZone' || className === 'AdInfo') fail(400, '广告位与广告内容必须走专用保存流程');
      if (className === 'FontPicShape' || className === 'FontPicShapeType') fail(400, '字体图形素材与分类必须走专用保存流程');
      if (className === 'DesignAsk' || className === 'DesignQuestion' || className === 'DesignAnswer') fail(400, '问卷、题目与答卷必须走专用流程');
      if (className === 'ServiceSeat' || className === 'Temp') fail(400, '客服席位与欢迎语必须走专用保存流程');
      if (className === 'StoreApplication' || className === 'StoreStyle') fail(400, '店铺与店铺样式必须走专用保存流程');
      if (className === 'UserLevel') fail(400, '积分等级必须走专用保存流程');
      if (className === 'CRMSAttr') fail(400, 'CRM 客户类型必须走专用保存流程');
      if (className === 'ShopFareTlp') fail(400, '商城运费模板必须走专用保存流程');
      if (className === 'MisType') fail(400, 'OA 流程类型必须走专用保存流程');
      if (className === 'PageStyle') fail(400, '黄页样式必须走专用保存流程');
      if (className === 'PlatComp') fail(400, '协同办公企业必须走专用保存流程');
      if (className === 'DesignRes') fail(400, '设计资源必须走专用保存流程');
      if (className === 'Role') fail(400, '系统角色必须走专用保存流程');
      if (className === 'CommonModel' && !objectId) fail(400, '内容新增必须同时写入模型附表，不能走通用保存');
      let object;
      if (objectId) { const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); object = await query.get(objectId, { useMasterKey: true }); } else object = new Parse.Object(className);
      const payload = input.fields && typeof input.fields === 'object' ? input.fields : {};
      for (const [name, value] of Object.entries(payload)) { if (!fields[name] || isSystemField(className, name)) continue; if (!GENERIC_WRITE_TYPES.has(fields[name].type)) fail(400, '字段不允许通用编辑: ' + name); if (value === null) object.unset(name); else object.set(name, toParseValue(fields[name], value)); }
      if (fields.company && context.company) object.set('company', context.company); if (fields.isDeleted && !objectId) object.set('isDeleted', false);
      await object.save(null, { useMasterKey: true }); await audit(context, objectId ? 'update' : 'create', className, object.id);
      return response.json({ success: true, data: serializeObject(object) });
    }
    if (operation === 'delete') {
      if (!classWritable || !objectId) fail(400, '该记录不允许删除'); const query = new Parse.Query(className); applyTenant(query, fields, context, input.companyId); const object = await query.get(objectId, { useMasterKey: true });
      if (className === 'Model' || className === 'ModelField') fail(501, 'migration_blocked: 删除模型或字段需要同步删除 PostgreSQL 物理表/列并验证历史数据，托管云函数中未开放此 DDL 流程');
      if (className === 'AdZone' || className === 'AdInfo') fail(400, '广告位与广告内容必须走专用批量删除流程');
      if (className === 'FontPicShape' || className === 'FontPicShapeType') fail(400, '字体图形素材与分类必须走专用批量删除流程');
      if (className === 'DesignAsk' || className === 'DesignQuestion' || className === 'DesignAnswer') fail(400, '问卷、题目与答卷必须走专用批量流程');
      if (className === 'ServiceSeat' || className === 'Temp') fail(400, '客服席位与欢迎语必须走专用批量流程');
      if (className === 'StoreApplication' || className === 'StoreStyle') fail(400, '店铺与店铺样式必须走专用批量流程');
      if (className === 'CRMSAttr') fail(400, 'CRM 客户类型必须走专用批量流程');
      if (className === 'ShopFareTlp') fail(400, '商城运费模板必须走专用批量流程');
      if (className === 'MisType') fail(400, 'OA 流程类型必须走专用批量流程');
      if (className === 'PageStyle') fail(400, '黄页样式必须走专用批量流程');
      if (className === 'PlatComp') fail(400, '协同办公企业必须走专用批量流程');
      if (className === 'DesignRes') fail(400, '设计资源必须走专用批量流程');
      if (className === 'Role') fail(400, '系统角色必须走专用批量流程');
      if (className === 'Guestcate') { const cateid = Number(object.get('cateid')) || 0; const companyId = pointerId(object.get('company')); const refs = await Psql.one('SELECT (SELECT COUNT(*)::int FROM "Guestcate" WHERE "company"=$1 AND "parentId"=$2) AS children,(SELECT COUNT(*)::int FROM "Guestbook" WHERE "company"=$1 AND "cateid"=$2) AS messages,(SELECT COUNT(*)::int FROM "GuestBar" WHERE "company"=$1 AND "cateId"=$2) AS posts', [companyId, cateid]); if (Number(refs.children) || Number(refs.messages) || Number(refs.posts)) fail(409, '分类仍被下级分类、留言或帖子引用，不能删除'); await object.destroy({ useMasterKey: true }); await audit(context, 'delete-guest-category', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: false } }); }
      if (className === 'ExamClass') { const classId = Number(object.get('cId')) || 0; const companyId = pointerId(object.get('company')); const refs = await Psql.one('SELECT (SELECT COUNT(*)::int FROM "ExamClass" WHERE "company"=$1 AND "cClassid"=$2) AS children,(SELECT COUNT(*)::int FROM "ExamSysQuestions" WHERE "company"=$1 AND "pClass"=$2) AS questions', [companyId, classId]); if (Number(refs.children) || Number(refs.questions)) fail(409, '试题分类仍被下级分类或试题引用，不能删除'); await object.destroy({ useMasterKey: true }); await audit(context, 'delete-exam-class', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: false } }); }
      if (className === 'ExamPoint') { const pointId = Number(object.get('id')) || 0; const companyId = pointerId(object.get('company')); const children = await Psql.one('SELECT COUNT(*)::int AS count FROM "ExamPoint" WHERE "company"=$1 AND "tid"=$2', [companyId, pointId]); if (Number(children.count)) fail(409, '考点仍有下级考点，不能删除'); await object.destroy({ useMasterKey: true }); await audit(context, 'delete-exam-point', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: false } }); }
      if (className === 'QuestionsKnowledge') { const knowledgeId = Number(object.get('kId')) || 0; const companyId = pointerId(object.get('company')); const refs = await Psql.one('SELECT (SELECT COUNT(*)::int FROM "QuestionsKnowledge" WHERE "company"=$1 AND "pid"=$2) AS children,(SELECT COUNT(*)::int FROM "ExamSysQuestions" WHERE "company"=$1 AND "pKnowledge"=$2) AS questions', [companyId, knowledgeId]); if (Number(refs.children) || Number(refs.questions)) fail(409, '知识点仍被下级知识点或试题引用，不能删除'); await object.destroy({ useMasterKey: true }); await audit(context, 'delete-knowledge', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: false } }); }
      if (className === 'Datadiccategory' || className === 'Datadic') { if (className === 'Datadiccategory') { const categoryId = Number(object.get('diccateid')) || 0; const itemFields = await schemaFor('Datadic'); const refs = new Parse.Query('Datadic'); applyTenant(refs, itemFields, context, pointerId(object.get('company'))); refs.equalTo('diccate', categoryId); if (await refs.count({ useMasterKey: true })) fail(409, '字典分类仍有字典项，不能删除'); } await object.destroy({ useMasterKey: true }); await audit(context, 'delete-dictionary', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: false } }); }
      if (className === 'GradeCate' || className === 'Grade') { const referenceFields = await schemaFor('Grade'); const refs = new Parse.Query('Grade'); applyTenant(refs, referenceFields, context, pointerId(object.get('company'))); if (className === 'GradeCate') refs.equalTo('cate', Number(object.get('cateId')) || 0); else refs.equalTo('parentId', Number(object.get('gradeId')) || 0); if (await refs.count({ useMasterKey: true })) fail(409, className === 'GradeCate' ? '多级字典分类仍有选项，不能删除' : '多级字典选项仍有下级选项，不能删除'); await object.destroy({ useMasterKey: true }); await audit(context, 'delete-grade', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: false } }); }
      if (className === '_User') assertCanManageUser(context, object, 'lock');
      if (className === 'Group') { const groupId = Number(object.get('groupId')) || 0; const companyId = pointerId(object.get('company')); const users = await Psql.one('SELECT COUNT(*)::int AS count FROM "_User" WHERE "company"=$1 AND COALESCE("legacyGroupId",0)=$2 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE)', [companyId, groupId]); const children = await Psql.one('SELECT COUNT(*)::int AS count FROM "Group" WHERE "company"=$1 AND COALESCE("parentGroupId",0)=$2', [companyId, groupId]); if (Number(users.count) > 0) fail(409, '该用户组仍有用户，不能删除'); if (Number(children.count) > 0) fail(409, '该用户组仍有下级组，不能删除'); }
      if (className === 'CommonModel') { object.set('status', -2); await object.save(null, { useMasterKey: true }); await audit(context, 'content-recycle', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: true, status: -2 } }); }
      if (className === 'Node') { object.set('zstatus', -2); if (fields.editDate) object.set('editDate', new Date()); await object.save(null, { useMasterKey: true }); await audit(context, 'node-recycle', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: true, zstatus: -2 } }); }
      if (className === 'Special') { const specId = Number(object.get('specId')) || 0; const companyId = pointerId(object.get('company')); const children = await Psql.one('SELECT COUNT(*)::int AS count FROM "Special" WHERE "company"=$1 AND COALESCE("pid",0)=$2', [companyId, specId]); if (Number(children.count) > 0) fail(409, '该专题仍有下级专题，不能删除'); await object.destroy({ useMasterKey: true }); await audit(context, 'delete-special', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: false } }); }
      if (className === 'Guestbook') { object.set('status', -2); await object.save(null, { useMasterKey: true }); await audit(context, 'guestbook-recycle', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: true, status: -2 } }); }
      if (fields.isDeleted) { object.set('isDeleted', true); await object.save(null, { useMasterKey: true }); } else await object.destroy({ useMasterKey: true });
      if (className === '_User') await revokeSessions([object]);
      await audit(context, 'delete', className, objectId); return response.json({ success: true, data: { objectId, softDeleted: Boolean(fields.isDeleted) } });
    }
    if (operation === 'resetPassword') {
      if (className !== '_User' || !objectId || typeof input.newPassword !== 'string' || input.newPassword.length < 8) fail(400, '密码至少 8 位');
      const query = new Parse.Query('_User'); applyTenant(query, fields, context, input.companyId); const target = await query.get(objectId, { useMasterKey: true }); assertCanManageUser(context, target, 'reset-password'); target.setPassword(input.newPassword); if (fields.passwordResetRequired) target.set('passwordResetRequired', false); await target.save(null, { useMasterKey: true }); const revokedSessions = await revokeSessions([target]); await audit(context, 'reset-password', '_User', objectId); return response.json({ success: true, data: { objectId, revokedSessions } });
    }
    fail(400, '不支持的后台操作');
  } catch (error) {
    const status = Number(error.status || (error.code === 101 ? 404 : 500));
    return response.status(status).json({ success: false, error: status >= 500 ? 'cloud_function_error' : 'request_rejected', message: error.message || '云函数执行失败' });
  }
}
`;

function cmsReadCode(mode) {
  return String.raw`
const MODE = ${JSON.stringify(mode)};
const HIDDEN = /(?:password|secret|sessiontoken|masterkey|privatekey|legacyPasswordHash|adminPassword)/i;
function inputOf(request) { const body = request.body || {}; return body.params && typeof body.params === 'object' ? body.params : body; }
function fail(status, message) { const error = new Error(message); error.status = status; throw error; }
function safe(value, depth = 0) { if (value == null || depth > 4) return value; if (Array.isArray(value)) return value.map((item) => safe(item, depth + 1)); if (value && typeof value.toJSON === 'function') return safe(value.toJSON(), depth + 1); if (typeof value === 'object') { const output = {}; for (const [key,item] of Object.entries(value)) if (!HIDDEN.test(key)) output[key] = safe(item, depth + 1); return output; } return value; }
async function auth(request) { const current = request.user || (typeof user !== 'undefined' ? user : null); if (!current) fail(401, '需要登录'); await current.fetch({ useMasterKey: true }); const roles = Array.isArray(current.get('roles')) ? current.get('roles').map(String) : []; const superAdmin = current.get('adminRoleKey') === 'super-admin' || roles.includes('super-admin'); if (!(current.get('isAdmin') === true || current.get('role') === 'admin' || roles.includes('admin') || superAdmin)) fail(403, '需要管理员权限'); const company = request.company || current.get('company') || null; if (!company && !superAdmin) fail(403, '管理员未分配帐套'); return { current, company, superAdmin }; }
async function schema(name) { try { return (await new Parse.Schema(name).get({ useMasterKey: true })).fields || {}; } catch (_) { return {}; } }
function tenant(query, fields, context) { if (fields.company && context.company) query.equalTo('company', context.company); }
function stripHtml(content) { return String(content == null ? '' : content).replace(/<!--[\s\S]*?-->/g, ' ').replace(/<script\b[^>]*>[\s\S]*?<\/script>/gi, ' ').replace(/<style\b[^>]*>[\s\S]*?<\/style>/gi, ' ').replace(/<[^>]+>/g, ' ').replace(/&nbsp;|&#160;/gi, ' ').replace(/&amp;/gi, '&').replace(/&lt;/gi, '<').replace(/&gt;/gi, '>').replace(/&quot;/gi, '"').replace(/&#39;|&apos;/gi, "'").replace(/\s+/g, ' ').trim(); }
function escapeRegex(value) { return String(value).replace(/[\\^$.*+?()[\]{}|]/g, '\\$&'); }
async function handler(request, response) {
  try {
    const input = inputOf(request); const context = await auth(request); const page = Math.max(1, Number(input.page) || 1); const pageSize = Math.min(100, Math.max(1, Number(input.pageSize) || 20));
    if (MODE === 'content-normalizer') return response.json({ success: true, data: { content: stripHtml(input.content), mode: String(input.mode || 'strip') } });
    if (MODE.startsWith('user-')) {
      const userId = String(input.userId || ''); if (!userId) fail(400, '缺少 userId'); const fields = await schema('_User'); const query = new Parse.Query('_User'); tenant(query, fields, context); const target = await query.get(userId, { useMasterKey: true }); const data = safe(target);
      if (MODE === 'user-extended') { delete data.legacyUserPlat; delete data.legacyWxUser; delete data.wechat; delete data.wxapp; return response.json({ success: true, data }); }
      if (MODE === 'user-platform') return response.json({ success: true, data: { objectId: target.id, platform: safe(target.get('legacyUserPlat') || {}), company: safe(target.get('company')) } });
      return response.json({ success: true, data: { objectId: target.id, wechat: safe(target.get('legacyWxUser') || target.get('wechat') || target.get('wxapp') || {}) } });
    }
    if (MODE === 'exam-classes' || MODE === 'guest-bar') {
      const className = MODE === 'exam-classes' ? 'ExamClass' : 'GuestBar'; const fields = await schema(className); const query = new Parse.Query(className); tenant(query, fields, context); query.descending(fields.updatedAt ? 'updatedAt' : 'createdAt'); const total = await query.count({ useMasterKey: true }); query.skip((page - 1) * pageSize); query.limit(pageSize); const rows = await query.find({ useMasterKey: true }); return response.json({ success: true, data: { page, pageSize, total, results: rows.map(safe) } });
    }
    if (MODE === 'search') {
      const keyword = stripHtml(input.keyword); if (!keyword) fail(400, '请输入搜索关键词'); const fields = await schema('CommonModel'); const candidates = ['title','inputer','sourceKey','synopsis','content'].filter((name) => fields[name] && fields[name].type === 'String'); if (!candidates.length) return response.json({ success: true, data: { page, pageSize, total: 0, results: [] } });
      const pattern = escapeRegex(keyword); const queries = candidates.slice(0, 3).map((field) => { const query = new Parse.Query('CommonModel'); tenant(query, fields, context); query.matches(field, pattern, 'i'); return query; }); const query = queries.length === 1 ? queries[0] : Parse.Query.or(...queries); query.descending('updatedAt'); query.skip((page - 1) * pageSize); query.limit(pageSize); const rows = await query.find({ useMasterKey: true }); return response.json({ success: true, data: { page, pageSize, total: rows.length < pageSize ? (page - 1) * pageSize + rows.length : null, results: rows.map((row) => { const json = safe(row); if (json.content) json.content = stripHtml(json.content).slice(0, 260); return json; }) } });
    }
    fail(400, '不支持的 CMS 查询');
  } catch (error) { const status = Number(error.status || (error.code === 101 ? 404 : 500)); return response.status(status).json({ success: false, error: status >= 500 ? 'cloud_function_error' : 'request_rejected', message: error.message || '云函数执行失败' }); }
}

`;
}

const appGatewayCode = String.raw`
const DEFAULT_COMPANY_ID = '7pIbDBJmKx';
const PUBLIC_READ = new Set(['content_list','content_get','content_uphis','node_list','node_get','app_update']);
const BLOCKED = {
  mcode_send: '缺少新短信服务商凭据与验证码存储', user_login_mobile: '缺少新短信验证码服务', user_register_mobile: '缺少新短信验证码服务', user_sync2: '依赖微信容器授权与新版微信凭据',
  cart_list: '目标 Schema 无购物车类', coupon_list: '目标 Schema 无优惠券实例类', coupon_usrgot_add: '目标 Schema 无用户优惠券类', coupon_usrgot_list: '目标 Schema 无用户优惠券类',
  order_comment_add: '目标 Schema 无订单评价类', order_comment_list: '目标 Schema 无订单评价类', order_delivery: '目标 Schema 无订单与物流类', order_get: '目标 Schema 无订单类', order_list: '目标 Schema 无订单类', order_signfor: '目标 Schema 无订单类',
  payment_cart: '目标 Schema 无订单与支付明细类', payment_cart_again: '目标 Schema 无订单与支付明细类', payment_success: '目标 Schema 无支付明细类',
  invoice_add: '目标 Schema 无发票类', invoice_del: '目标 Schema 无发票类', invoice_get: '目标 Schema 无发票类', invoice_list: '目标 Schema 无发票类', invoice_upd: '目标 Schema 无发票类',
  receaddr_add: '目标 Schema 无收货地址类', receaddr_del: '目标 Schema 无收货地址类', receaddr_get: '目标 Schema 无收货地址类', receaddr_list: '目标 Schema 无收货地址类', receaddr_upd: '目标 Schema 无收货地址类',
  user_bank_add: '目标 Schema 无提现账户类', user_bank_del: '目标 Schema 无提现账户类', user_bank_get: '目标 Schema 无提现账户类', user_bank_list: '目标 Schema 无提现账户类', user_cash_add: '缺少提现事务账本', user_cash_list: '缺少提现事务账本',
  user_coin_recharge: '缺少支付凭据与事务账本', user_exp_transfer: '缺少积分事务规则确认', user_money_recharge: '缺少支付凭据与事务账本', user_money_transfer: '缺少资金事务规则确认',
  user_group_usr_supply: '目标 Schema 无会员续费订单类', user_group_usr_upgrade: '目标 Schema 无会员升级订单类', user_shop_order: '目标 Schema 无订单类', user_shop_sales: '目标 Schema 无销售明细类',
  user_star_add: '目标 Schema 无收藏关系类', user_star_del: '目标 Schema 无收藏关系类', user_star_is: '目标 Schema 无收藏关系类', user_update_paypwd: '需要独立支付密码哈希服务',
  user_update_pwd: '旧流程强制校验短信验证码，但新短信服务与验证码存储尚未提供', user_update_pwdall: '同时依赖登录密码与支付密码写入，目标系统缺少独立支付密码哈希服务',
  vote_add: '目标 Schema 无可证明的投票记录类', vote_ask: '目标 Schema 无可证明的投票记录类', vote_question: '目标 Schema 无可证明的投票记录类',
  product_list: '目标 Product 仅是 ZL_P_Product 附表，缺少 ZL_Commodities 商品主表', product_get: '目标 Product 仅是 ZL_P_Product 附表，缺少商品名称、价格、正文、所有者与主键关系', product_stock_list: '目标 Schema 无 ZL_Shop_Stock 库存流水类',
  product_del: '缺少 ZL_Commodities 主表及其 UserID 所有权字段', product_stock_change: '缺少 ZL_Commodities 主表、当前库存与 ZL_Shop_Stock 流水类', product_sale_change: '缺少 ZL_Commodities 主表及 Sales/UserID 字段',
  unit_record_update: '旧源码在调用前无条件 return；目标库也未迁移 Model 57 单元聚合副表',
  e_get_21list_tj: '迁移数据未包含复习收入金额字段或可验证的计价规则',
  pub_add: '旧前端依赖 Pub 7-13，但目标库只迁入 Pub 2-6，且缺少注销、供应商、商户邀请、退换货与结算副表', pub_list: '旧前端依赖 Pub 7-13，但目标库只迁入 Pub 2-6，无法恢复对应历史记录与审核范围',
  user_rnauth_add: '实名认证需新的合规审核与敏感数据存储', user_rnauth_get: '实名认证需新的合规审核与敏感数据存储', user_rnauth_upd: '实名认证需新的合规审核与敏感数据存储',
  product_add: '缺少 ZL_Commodities 商品主表，无法与 Product 附表进行事务新增', product_upd: '缺少 ZL_Commodities 商品主表，无法恢复主表与附表事务更新'
};
const SENSITIVE = /(?:password|pwd|secret|sessiontoken|masterkey|privatekey|legacyPasswordHash|adminPassword|payPassword)/i;
function inputOf(request) { const body = request.body || {}; return body.params && typeof body.params === 'object' ? body.params : body; }
function envelope(result, addon, page) { const value = { retcode: 0, retmsg: '', result }; if (addon !== undefined) value.addon = addon; if (page) value.page = page; return value; }
function reject(message) { return { retcode: -1, retmsg: message, result: null }; }
function fail(status, message) { const error = new Error(message); error.status = status; throw error; }
function safe(value, depth = 0) { if (value == null || depth > 4) return value; if (value instanceof Date) return value.toISOString(); if (Array.isArray(value)) return value.map((item) => safe(item, depth + 1)); if (value && typeof value.toJSON === 'function') return safe(value.toJSON(), depth + 1); if (typeof value === 'object') { const output = {}; for (const [key,item] of Object.entries(value)) if (!SENSITIVE.test(key)) output[key] = safe(item, depth + 1); return output; } return value; }
function number(value, fallback = 0) { const parsed = Number(value); return Number.isFinite(parsed) ? parsed : fallback; }
function pageInput(input) { return { index: Math.max(1, number(input.cpage || input.page, 1)), size: Math.min(100, Math.max(1, number(input.psize || input.pageSize, 20))) }; }
function companyPointer() { return Parse.Object.createWithoutData('Company', DEFAULT_COMPANY_ID); }
async function fieldsOf(className) { return (await new Parse.Schema(className).get({ useMasterKey: true })).fields || {}; }
function tenant(query, fields) { if (fields.company) query.equalTo('company', companyPointer()); }
function isVisible(row) { const value = row && typeof row.get === 'function' ? row.get('isDeleted') : row && row.isDeleted; return ![true, 1, '1', 'true', 'True', 'TRUE'].includes(value); }
function legacyAliases(value, className) {
  const row = safe(value); const maps = {
    CommonModel: { GeneralID:'generalId', OrderID:'orderId', NodeID:'nodeId', ModelID:'modelId', ItemID:'itemId', TableName:'tableName', Title:'title', Inputer:'inputer', Hits:'hits', CreateTime:'createTime', Status:'status', TopImg:'topImg', Subtitle:'subtitle' },
    Node: { NodeID:'nodeId', NodeName:'nodeName', NodeType:'nodeType', NodeDir:'nodeDir', NodeUrl:'nodeUrl', ParentID:'parentId', OrderID:'orderId', NodePic:'nodePicUrl', Description:'description', ConsumePoint:'consumePoint', ConsumeDeposit:'consumeDeposit', ConsumeType:'consumeType', ConsumeTime:'consumeTime', ConsumeCount:'consumeCount', AddPoint:'addPoint' },
    App: { ID:'id' }
  }; const map = maps[className] || {}; for (const [legacy,source] of Object.entries(map)) if (row[legacy] === undefined && row[source] !== undefined) row[legacy] = row[source]; return row;
}
async function currentUser(request, required = true) { const current = request.user || (typeof user !== 'undefined' ? user : null); if (!current) { if (required) fail(401, '登录状态已失效'); return null; } await current.fetch({ useMasterKey: true }); const company = current.get('company'); if (company && company.id !== DEFAULT_COMPANY_ID) fail(403, '用户不属于小树英语帐套'); return current; }
async function revokeUserSessions(target) { let count = 0; while (true) { const query = new Parse.Query('_Session'); query.equalTo('user', target); query.limit(1000); const sessions = await query.find({ useMasterKey:true }); if (!sessions.length) break; await Parse.Object.destroyAll(sessions,{useMasterKey:true}); count += sessions.length; if (sessions.length < 1000) break; } return count; }
function objectValue(source, key) { return source && typeof source.get === 'function' ? source.get(key) : source && source[key]; }
function legacyData(source) { const value = objectValue(source, 'legacyUserData'); return value && typeof value === 'object' && !Array.isArray(value) ? value : {}; }
function firstValue(...values) { return values.find((value) => value !== undefined && value !== null && value !== ''); }
function legacyUser(current, withToken = false) {
  const data = legacyData(current); const username = String(firstValue(objectValue(current,'username'),data.UserName,'') || ''); const userId = number(firstValue(objectValue(current,'legacyUserId'),objectValue(current,'userid'),objectValue(current,'num'),data.UserID)); const groupId = number(firstValue(objectValue(current,'legacyGroupId'),data.GroupID)); const honeyName = String(firstValue(objectValue(current,'nickname'),objectValue(current,'nickName'),objectValue(current,'realName'),data.HoneyName,username) || ''); const avatar = String(firstValue(objectValue(current,'avatar'),data.salt,'') || ''); const mobile = String(firstValue(objectValue(current,'mobile'),objectValue(current,'phone'),'') || ''); const parentId = number(firstValue(data.ParentUserID,objectValue(current,'puid'))); const vip = number(firstValue(data.VIP,objectValue(current,'vip')));
  const value = { objectId:String(objectValue(current,'objectId') || current.id || ''), userId, userName:username, honeyName, userFace:avatar, mobile, groupId, groupName:String(objectValue(current,'roleName') || ''), email:String(firstValue(objectValue(current,'email'),data.Email,'') || ''), puid:parentId, vip, regTime:firstValue(data.RegTime,objectValue(current,'createdAt')), birthday:firstValue(objectValue(current,'birthday'),data.birthday,''), wechat:firstValue(objectValue(current,'wechat'),data.wechat,''), seturl:String(firstValue(data.seturl,objectValue(current,'seturl'),'') || '') };
  if (withToken) value.sessionToken = current.getSessionToken(); return value;
}
function legacyUserAddon(current) {
  const data = legacyData(current); const state = objectValue(current,'isDisabled') === true ? 0 : number(firstValue(data.State,1),1); const result = { vip:number(data.VIP), state, State:state, regTime:firstValue(data.RegTime,objectValue(current,'createdAt')), purse:number(data.Purse), silverCoin:number(data.SilverCoin), userExp:number(data.UserExp), userPoint:number(data.UserPoint), boffExp:number(data.boffExp) }; result.VIP = result.vip; result.Purse = result.purse; result.SilverCoin = result.silverCoin; result.UserExp = result.userExp; result.UserPoint = result.userPoint; return result;
}
async function registerUser(input) {
  const username = String(input.name || input.username || '').trim(); const password = String(input.passwd || input.password || ''); if (!username) fail(400,'账号不能为空'); if (password.length < 6 || password.length > 18) fail(400,'密码长度应为 6 至 18 位'); const inviteCode = String(input.code || input.inviCode || '').trim(); let parentId = 0; if (inviteCode) { const rows = await Psql.query('SELECT COALESCE("legacyUserId",("legacyUserData"->>\'UserID\')::numeric) AS id FROM "_User" WHERE "company"=$1 AND "username"=$2 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) LIMIT 1',[DEFAULT_COMPANY_ID,inviteCode]); parentId = number(rows[0] && rows[0].id); if (!parentId) fail(400,'邀请码不存在'); }
  const company = await new Parse.Query('Company').get(DEFAULT_COMPANY_ID,{useMasterKey:true}); const created = new Parse.User(); created.setUsername(username); created.setPassword(password); created.set('company',company); created.set('type','user'); created.set('isDisabled',false); created.set('legacyGroupId',1); created.set('nickname',username); if (/^1\d{10}$/.test(username)) created.set('mobile',username); try { await created.signUp(); } catch (error) { if (number(error && error.code) === 202) fail(409,'此用户名已被使用'); throw error; }
  const sessionToken = created.getSessionToken(); try { const regTime = new Date().toISOString(); const data = { UserID:0,UserName:username,HoneyName:username,GroupID:1,ParentUserID:parentId,VIP:0,RegTime:regTime,Purse:0,SilverCoin:0,UserExp:0,UserPoint:0,boffExp:0,State:1 }; const rows = await Psql.query('WITH lock_row AS MATERIALIZED (SELECT pg_advisory_xact_lock(hashtext(\'xiaoshu-legacy-user-id\'))), next_id AS MATERIALIZED (SELECT COALESCE(MAX("legacyUserId"),0)+1 AS id FROM "_User",lock_row WHERE "company"=$1 AND COALESCE("legacyUserId",0)>0) UPDATE "_User" SET "legacyUserId"=next_id.id,"legacyGroupId"=1,"legacyUserData"=jsonb_set($3::jsonb,\'{UserID}\',to_jsonb(next_id.id),true),"updatedAt"=NOW() FROM next_id WHERE "objectId"=$2 RETURNING next_id.id',[DEFAULT_COMPANY_ID,created.id,JSON.stringify(data)]); const userId = number(rows[0] && rows[0].id); if (!userId) throw new Error('无法分配旧系统用户 ID'); await created.fetch({useMasterKey:true}); const result = legacyUser(created); result.sessionToken = sessionToken; return { result,addon:{ State:1,state:1,parentUserId:parentId } }; } catch (error) { await created.destroy({useMasterKey:true}).catch(() => undefined); throw error; }
}
async function updateUserProfile(input,current) {
  const ownId = ownLegacyId(current); const requestedId = number(input.uid || ownId); if (requestedId !== ownId && !isAdminUser(current)) fail(403,'不允许修改其他用户资料'); const model = parseObject(input.mu,'用户资料'); const fields = await fieldsOf('_User'); const source = { ...model,...input }; delete source.mu; const mappings = { honeyName:'nickname',nickname:'nickname',trueName:'realName',realName:'realName',userFace:'avatar',avatar:'avatar',mobile:'mobile',Email:'email',email:'email',sex:'gender',gender:'gender',birthday:'birthday',seturl:'seturl' }; const legacyMappings = { honeyName:'HoneyName',nickname:'HoneyName',trueName:'TrueName',realName:'TrueName',userFace:'salt',avatar:'salt',mobile:'Mobile',Email:'Email',email:'Email',sex:'Sex',gender:'Sex',birthday:'birthday',seturl:'seturl',Position:'Position',position:'Position' }; const data = { ...legacyData(current) }; for (const [key,target] of Object.entries(mappings)) if (source[key] !== undefined && fields[target]) current.set(target,writeValue(source[key],fields[target])); for (const [key,target] of Object.entries(legacyMappings)) if (source[key] !== undefined) data[target] = typeof source[key] === 'string' ? cleanText(source[key],target === 'salt' || target === 'seturl' ? 1000 : 200) : source[key];
  const inviteCode = String(input.inviCode || '').trim(); if (inviteCode) { const existingParent = number(data.ParentUserID); const rows = await Psql.query('SELECT COALESCE("legacyUserId",("legacyUserData"->>\'UserID\')::numeric) AS id FROM "_User" WHERE "company"=$1 AND "username"=$2 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) LIMIT 1',[DEFAULT_COMPANY_ID,inviteCode]); const parentId = number(rows[0] && rows[0].id); if (!parentId) fail(400,'邀请码不存在'); if (parentId === ownId || await chainContains(parentId,ownId)) fail(400,'邀请关系不能形成循环'); if (existingParent && existingParent !== parentId) fail(409,'邀请人已完善，不能变更'); data.ParentUserID = parentId; }
  current.set('legacyUserData',data); await current.save(null,{useMasterKey:true}); return { result:legacyUser(current),addon:legacyUserAddon(current) };
}
function legacyUserRow(source) {
  const data = legacyData(source); const userId = number(firstValue(source.legacyUserId,source.userid,source.num,data.UserID)); const username = String(firstValue(source.username,data.UserName,'') || ''); const honeyName = String(firstValue(source.nickname,source.nickName,source.realName,data.HoneyName,username) || ''); const groupId = number(firstValue(source.legacyGroupId,data.GroupID)); const parentId = number(firstValue(data.ParentUserID,source.puid)); const avatar = String(firstValue(source.avatar,data.salt,'') || ''); const teamSize = number(firstValue(source.__teamSize,source.TeamSize)); const vip = number(firstValue(data.VIP,source.vip)); const regTime = firstValue(data.RegTime,source.createdAt); const row = { objectId:String(source.objectId || ''), userId, userName:username, honeyName, userFace:avatar, mobile:String(firstValue(source.mobile,source.phone,'') || ''), groupId, puid:parentId, vip, regTime, teamSize, email:String(firstValue(source.email,data.Email,'') || ''), realName:String(firstValue(source.realName,data.TrueName,'') || '') };
  return { ...row, UserID:userId, UserName:username, HoneyName:honeyName, UserFace:avatar, GroupID:groupId, ParentUserID:parentId, VIP:vip, RegTime:regTime, TeamSize:teamSize, Email:row.email, TrueName:row.realName, UserExp:number(data.UserExp), boffExp:number(data.boffExp), salt:avatar };
}
async function findByLegacyId(className, fields, legacyId, aliases) { const field = aliases.find((name) => fields[name]); if (!field) return null; const companyClause = fields.company ? ' AND "company" = $2' : ''; const values = fields.company ? [String(legacyId),DEFAULT_COMPANY_ID] : [String(legacyId)]; const rows = await Psql.query('SELECT "objectId" FROM "' + className + '" WHERE CAST("' + field + '" AS text) = $1' + companyClause + ' LIMIT 1', values); return rows[0] ? new Parse.Query(className).get(rows[0].objectId,{useMasterKey:true}) : null; }
async function paged(className, input, configure) { const fields = await fieldsOf(className); const paging = pageInput(input); const query = new Parse.Query(className); tenant(query, fields); if (configure) configure(query, fields); const total = await query.count({ useMasterKey: true }); query.skip((paging.index - 1) * paging.size); query.limit(paging.size); query.descending(fields.updatedAt ? 'updatedAt' : 'createdAt'); const rows = (await query.find({ useMasterKey: true })).filter(isVisible); return { rows: rows.map(safe), page: { itemCount: total, pageCount: Math.ceil(total / paging.size), pageIndex: paging.index, pageSize: paging.size } }; }
const CONTENT_ADDONS = {
  52: { className:'VocabularyWord', fields:['id','lj','sy','yb','yp'] },
  53: { className:'PracticeRecord', fields:['id','kcid','scid','xxcs','yhid','jrscb'] },
  54: { className:'CourseAppointment', fields:['id','pl','bxrq','dslx','dszt','fxpl','jffs','jssj','kcid','kssj','plxm','scsj','sdsd','szmd','szyh','yysj','yykcid'] },
  56: { className:'DailyStudyRecord', fields:['id','pl','con','djq','ygg','dqrq','dsid','fxrl','xxqs','szmdid','userId','learned'] },
  58: { className:'CourseBinding', fields:['id','yxx','cksl','kcid','syjd','yhid'] },
  59: { className:'LessonRecord', fields:['id','pf','jffs','jsmz','kcid','kclx','kcmc','kzsj','pjnr','pldp','xymz','yyds','plpjsj','szmdid'] },
  60: { className:'MemoryPracticeRecord', fields:['id','fxzt','kcid','plid','wcsj','yhid','kywrq','kywsj','xxjlid','orderId'] },
  61: { className:'AssessmentProfile', fields:['id','df','askid','wrong','userId','answerid','dontKnow','prevScore','totalScore'] }
};
const NODE_MODELS = { 28:58, 29:54, 32:53, 291:56, 296:59, 327:52, 388:60, 389:61 };
const PRIVATE_CONTENT_MODELS = new Set([53,54,56,58,59,60,61]);
const CONTENT_WRITE_AUTH = {
  53: { subjects:['yhid'], actors:[], tableName:'ZL_C_lxjl', nodeId:32 }, 54: { subjects:['szyh'], actors:['pl'], tableName:'ZL_C_order', nodeId:29 }, 56: { subjects:['userId'], actors:['pl'], tableName:'ZL_C_ss', nodeId:291 }, 58: { subjects:['yhid'], actors:[], tableName:'ZL_C_kcbd', nodeId:28 },
  59: { subjects:['xymz'], actors:['jsmz'], tableName:'ZL_C_skjl', nodeId:296 }, 60: { subjects:['yhid'], actors:['plid'], tableName:'ZL_C_kywjl', nodeId:388 }, 61: { subjects:['userId'], actors:[], tableName:'ZL_C_cespj', nodeId:389 }
};
function contentModel(input, nodeIds) { const explicit = number(input.modelId || input.modelid || input.ModelID); return explicit || (nodeIds.length === 1 ? NODE_MODELS[number(nodeIds[0])] || 0 : 0); }
function requestedContentModel(input) { const nodes = String(input.nodeid || input.nid || input.nodes || '').split(',').map(number).filter(Boolean); return contentModel(input, nodes); }
function legacyFilterPairs(input) {
  const source = [input.myfield, input.myfield2].filter(Boolean).join('|'); if (!source) return [];
  return source.split('|').map((part) => { const match = String(part).trim().match(/^([A-Za-z][A-Za-z0-9_.]*)=(.*)$/); if (!match) fail(400, '内容过滤条件格式错误'); return { name: match[1].replace(/^B\./i,''), value: match[2] }; });
}
function addonField(config, requested) { return config && config.fields.find((field) => field.toLowerCase() === String(requested).toLowerCase()); }
function contentQueryRequiresAuth(action, input) { return (action === 'content_list' || action === 'content_list_llk') && (PRIVATE_CONTENT_MODELS.has(requestedContentModel(input)) || legacyFilterPairs(input).length > 0); }
async function authorizeContentAccess(current, input) {
  if (!PRIVATE_CONTENT_MODELS.has(requestedContentModel(input))) return; const pairs = legacyFilterPairs(input); await authorizeOwnerPairs(current, pairs.map((pair) => ({ name: pair.name.toLowerCase(), value: number(pair.value) })).filter((pair) => pair.value));
}
function isAdminUser(current) { const roles = Array.isArray(current.get('roles')) ? current.get('roles').map(String) : []; return current.get('isAdmin') === true || current.get('role') === 'admin' || roles.includes('admin'); }
async function authorizeOwnerPairs(current, pairs) {
  if (isAdminUser(current)) return; const owners = pairs.filter((pair) => ['userid','yhid','xymz','jsmz','szyh'].includes(pair.name)); if (!owners.length) fail(403, '私有内容查询必须限定用户');
  const ownId = number(current.get('legacyUserId') || current.get('userid') || current.get('num')); const subjects = owners.filter((pair) => ['userid','yhid','xymz'].includes(pair.name)); if (subjects.some((pair) => pair.value === ownId)) return;
  const targets = subjects.length ? subjects : owners; const fields = await fieldsOf('_User'); for (const targetId of [...new Set(targets.map((pair) => pair.value))]) { if (targetId === ownId) continue; const target = await findByLegacyId('_User', fields, targetId, ['legacyUserId','userid','num']); const agent = target && target.get('agent'); if (!target || !agent || agent.id !== current.id) fail(403, '无权查看该学员的内容记录'); }
}
async function authorizeContentDetail(current, detail) { const pairs = ['userId','yhid','xymz','jsmz','szyh'].map((name) => ({ name: name.toLowerCase(), value: number(detail[name] ?? detail[name === 'userId' ? 'UserID' : name]) })).filter((pair) => pair.value); await authorizeOwnerPairs(current, pairs); }
function contentOrder(input, config) {
  const raw = String(input.orders || '').trim(); if (!raw) return 'c."updatedAt" DESC'; if (/^NEWID\(\)$/i.test(raw)) return 'RANDOM()';
  const match = raw.match(/^([A-Za-z][A-Za-z0-9_.]*)\s*=\s*(ASC|DESC)$/i); if (!match) return 'c."updatedAt" DESC'; const requested = match[1].replace(/^B\./i,''); const direction = match[2].toUpperCase();
  const addon = addonField(config, requested); if (addon) return 'a."' + addon + '" ' + direction; const base = { id:'itemId', generalid:'generalId', createtime:'createTime', updatedat:'updatedAt', title:'title' }[requested.toLowerCase()]; return base ? 'c."' + base + '" ' + direction : 'c."updatedAt" DESC';
}
async function contentPage(input, publicOnly = false) {
  const paging = pageInput(input); const values = [DEFAULT_COMPANY_ID]; const clauses = ['c."company" = $1'];
  if (input.objectId) { values.push(String(input.objectId)); clauses.push('c."objectId" = $' + values.length); }
  if (input.generalId) { values.push(String(input.generalId)); clauses.push('CAST(c."generalId" AS text) = $' + values.length); }
  const nodeIds = String(input.nodeid || input.nid || input.nodes || '').split(',').map((value) => String(number(value))).filter((value) => value !== '0');
  if (nodeIds.length) { values.push(nodeIds); clauses.push('CAST(c."nodeId" AS text) = ANY($' + values.length + '::text[])'); }
  const modelId = contentModel(input, nodeIds); const config = CONTENT_ADDONS[modelId] || null; if (modelId) { values.push(String(modelId)); clauses.push('CAST(c."modelId" AS text) = $' + values.length); }
  if (publicOnly && !modelId) { values.push([...PRIVATE_CONTENT_MODELS].map(String)); clauses.push('CAST(c."modelId" AS text) <> ALL($' + values.length + '::text[])'); }
  const filters = legacyFilterPairs(input); if (filters.length && !config) fail(501, '该内容模型的 addon 联表尚未映射');
  for (const filter of filters) { const field = addonField(config, filter.name); if (!field) fail(501, 'addon 字段尚未映射: ' + filter.name); values.push(String(filter.value)); clauses.push('CAST(a."' + field + '" AS text) = $' + values.length); }
  if (input.skey) { values.push('%' + String(input.skey).replace(/[%_]/g, '') + '%'); clauses.push('c."title" ILIKE $' + values.length); }
  const join = config ? ' LEFT JOIN "' + config.className + '" a ON a."company" = $1 AND CAST(a."id" AS text) = CAST(c."itemId" AS text)' : ''; const where = clauses.join(' AND ');
  const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "CommonModel" c' + join + ' WHERE ' + where, values); const rowValues = values.concat([paging.size, (paging.index - 1) * paging.size]);
  const select = config ? 'c.*, row_to_json(a) AS "__addon"' : 'c.*'; const rows = await Psql.query('SELECT ' + select + ' FROM "CommonModel" c' + join + ' WHERE ' + where + ' ORDER BY ' + contentOrder(input, config) + ' LIMIT $' + (values.length + 1) + ' OFFSET $' + (values.length + 2), rowValues);
  const normalized = rows.filter(isVisible).map((source) => { const addon = source.__addon || {}; const row = { ...source, ...addon }; delete row.__addon; if (source.objectId) row.objectId = source.objectId; return legacyAliases(row, 'CommonModel'); }); const total = number(countRow.total);
  return { rows: normalized, page: { itemCount: total, pageCount: Math.ceil(total / paging.size), pageIndex: paging.index, pageSize: paging.size } };
}
async function sqlPage(className, input, filters = []) {
  if (!['App','Node'].includes(className)) fail(400, '不允许查询该类'); const paging = pageInput(input); const values = [DEFAULT_COMPANY_ID]; const clauses = ['"company" = $1'];
  for (const filter of filters) { values.push(String(filter.value)); clauses.push('CAST("' + filter.field + '" AS text) = $' + values.length); }
  const where = clauses.join(' AND '); const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "' + className + '" WHERE ' + where, values); const rowValues = values.concat([paging.size, (paging.index - 1) * paging.size]);
  const rows = await Psql.query('SELECT * FROM "' + className + '" WHERE ' + where + ' ORDER BY "updatedAt" DESC LIMIT $' + (values.length + 1) + ' OFFSET $' + (values.length + 2), rowValues); const total = number(countRow.total);
  return { rows: rows.filter(isVisible).map((row) => legacyAliases(row, className)), page: { itemCount: total, pageCount: Math.ceil(total / paging.size), pageIndex: paging.index, pageSize: paging.size } };
}
async function nodePage(input) {
  const paging = pageInput(input); const values = [DEFAULT_COMPANY_ID]; const clauses = ['"company"=$1']; if (input.pid !== undefined && input.pid !== '') { values.push(String(number(input.pid))); clauses.push('CAST("parentId" AS text)=$' + values.length); } const where = clauses.join(' AND '); const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "Node" WHERE ' + where,values); const rows = await Psql.query('SELECT * FROM "Node" WHERE ' + where + ' ORDER BY CASE WHEN CAST("orderId" AS text) ~ \'^-?[0-9]+$\' THEN CAST("orderId" AS numeric) ELSE 0 END ASC, CASE WHEN CAST("nodeId" AS text) ~ \'^-?[0-9]+$\' THEN CAST("nodeId" AS numeric) ELSE 0 END ASC LIMIT $' + (values.length + 1) + ' OFFSET $' + (values.length + 2),values.concat([paging.size,(paging.index - 1) * paging.size])); const total = number(countRow.total); return { rows:rows.filter(isVisible).map((row) => legacyAliases(row,'Node')),page:{itemCount:total,pageCount:Math.ceil(total / paging.size),pageIndex:paging.index,pageSize:paging.size} };
}
async function nodeUnitPage(input,current) {
  const uid = await authorizeRequestedUser(current,input.userId || input.uid); const paging = pageInput(input); const parentId = number(input.pid); if (!parentId) fail(400,'缺少课程栏目 ID'); const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "Node" WHERE "company"=$1 AND CAST("parentId" AS text)=$2',[DEFAULT_COMPANY_ID,String(parentId)]); const rows = await Psql.query('SELECT n.*,COALESCE(w.total,0)::int AS "total",COALESCE(l.learned,0)::int AS "yx_word" FROM "Node" n LEFT JOIN LATERAL (SELECT COUNT(*)::int AS total FROM "CommonModel" c WHERE c."company"=$1 AND CAST(c."modelId" AS text)=\'52\' AND CAST(c."nodeId" AS text)=CAST(n."nodeId" AS text)) w ON TRUE LEFT JOIN LATERAL (SELECT COUNT(DISTINCT CAST(p."scid" AS text))::int AS learned FROM "PracticeRecord" p JOIN "CommonModel" c ON c."company"=$1 AND CAST(c."modelId" AS text)=\'52\' AND CAST(c."generalId" AS text)=CAST(p."scid" AS text) AND CAST(c."nodeId" AS text)=CAST(n."nodeId" AS text) WHERE p."company"=$1 AND CAST(p."yhid" AS text)=$3 AND COALESCE(CAST(p."xxcs" AS numeric),0)>0) l ON TRUE WHERE n."company"=$1 AND CAST(n."parentId" AS text)=$2 ORDER BY CASE WHEN CAST(n."orderId" AS text) ~ \'^-?[0-9]+$\' THEN CAST(n."orderId" AS numeric) ELSE 0 END ASC,CASE WHEN CAST(n."nodeId" AS text) ~ \'^-?[0-9]+$\' THEN CAST(n."nodeId" AS numeric) ELSE 0 END ASC LIMIT $4 OFFSET $5',[DEFAULT_COMPANY_ID,String(parentId),String(uid),paging.size,(paging.index - 1) * paging.size]); const total = number(countRow.total); return { rows:rows.map((source) => { const row = legacyAliases(source,'Node'); row.total = number(source.total); row.yx_word = number(source.yx_word); row.process = row.total ? Math.round(row.yx_word / row.total * 100) : 0; return row; }),page:{itemCount:total,pageCount:Math.ceil(total / paging.size),pageIndex:paging.index,pageSize:paging.size} };
}
function legacyAppRow(source) { if (!source) return null; const row = legacyAliases(source,'App'); row.ver = number(firstValue(row.index,String(row.version || '').replace(/\D/g,''))); row.nver = String(row.version || ''); row.intro = String(firstValue(row.changelog,row.desc,'') || ''); row.path = String(firstValue(row.downUrl,row.apkUrl,'') || ''); row.size = null; row.sizeUnavailable = true; return row; }
function parseArray(value) { if (Array.isArray(value)) return value; if (typeof value !== 'string' || !value.trim()) return []; try { const parsed = JSON.parse(value); return Array.isArray(parsed) ? parsed : []; } catch (_) { return []; } }
function largePageInput(input) { return { index: Math.max(1, number(input.cpage || input.page, 1)), size: Math.min(500, Math.max(1, number(input.psize || input.pageSize, 20))) }; }
function ownLegacyId(current) { return number(current && (current.get('legacyUserId') || current.get('userid') || current.get('num'))); }
async function legacyUserObject(legacyId) { const fields = await fieldsOf('_User'); return findByLegacyId('_User', fields, legacyId, ['legacyUserId','userid','num']); }
async function chainContains(startId, expectedAncestorId) {
  let cursor = number(startId); const expected = number(expectedAncestorId); const visited = new Set();
  for (let depth = 0; cursor && depth < 64 && !visited.has(cursor); depth += 1) { if (cursor === expected) return true; visited.add(cursor); const item = await legacyUserObject(cursor); if (!item) return false; cursor = number(legacyData(item).ParentUserID); }
  return false;
}
async function authorizeTeamUser(current, requestedId) {
  const ownId = ownLegacyId(current); const targetId = number(requestedId || ownId); if (!targetId) fail(400, '缺少用户 ID'); if (isAdminUser(current) || targetId === ownId) return targetId;
  if (await chainContains(targetId, ownId)) return targetId; if (await chainContains(ownId, targetId)) return targetId; fail(403, '无权查看该团队成员');
}
function userSelect(alias = 'u') { return alias + '."objectId",' + alias + '."username",' + alias + '."email",' + alias + '."mobile",' + alias + '."phone",' + alias + '."avatar",' + alias + '."nickname",' + alias + '."nickName",' + alias + '."realName",' + alias + '."legacyUserId",' + alias + '."legacyGroupId",' + alias + '."legacyUserData",' + alias + '."createdAt"'; }
async function teamUserPage(input, current) {
  const paging = pageInput(input); const parentId = number(input.puid || ownLegacyId(current)); if (!parentId && !isAdminUser(current)) fail(400, '团队列表必须指定上级用户'); if (parentId) await authorizeTeamUser(current,parentId);
  const values = [DEFAULT_COMPANY_ID]; const clauses = ['u."company" = $1','(u."isDeleted" IS NULL OR u."isDeleted" = FALSE)']; if (parentId) { values.push(String(parentId)); clauses.push('COALESCE(u."legacyUserData"->>\'ParentUserID\',\'0\') = $' + values.length); }
  const groups = String(input.gids || '').split(',').map(number).filter((value) => value > 0); if (groups.length) { values.push(groups.map(String)); clauses.push('COALESCE(CAST(u."legacyGroupId" AS text),u."legacyUserData"->>\'GroupID\',\'0\') = ANY($' + values.length + '::text[])'); }
  const where = clauses.join(' AND '); const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "_User" u WHERE ' + where, values); const rowValues = values.concat([paging.size,(paging.index - 1) * paging.size]); const order = groups.length ? 'CASE WHEN COALESCE(u."legacyUserData"->>\'UserExp\',\'0\') ~ \'^-?[0-9]+(?:\\.[0-9]+)?$\' THEN (u."legacyUserData"->>\'UserExp\')::numeric ELSE 0 END DESC,' : '';
  const rows = await Psql.query('SELECT ' + userSelect('u') + ',(SELECT COUNT(*)::int FROM "_User" child WHERE child."company" = $1 AND COALESCE(child."legacyUserData"->>\'ParentUserID\',\'0\') = COALESCE(CAST(u."legacyUserId" AS text),u."legacyUserData"->>\'UserID\',\'0\')) AS "__teamSize" FROM "_User" u WHERE ' + where + ' ORDER BY ' + order + ' CASE WHEN COALESCE(CAST(u."legacyUserId" AS text),u."legacyUserData"->>\'UserID\',\'0\') ~ \'^[0-9]+$\' THEN COALESCE(CAST(u."legacyUserId" AS text),u."legacyUserData"->>\'UserID\',\'0\')::numeric ELSE 0 END DESC LIMIT $' + (values.length + 1) + ' OFFSET $' + (values.length + 2), rowValues); const total = number(countRow.total);
  return { rows:rows.map(legacyUserRow), page:{ itemCount:total, pageCount:Math.ceil(total / paging.size), pageIndex:paging.index, pageSize:paging.size } };
}
async function teamStats(input,current) {
  const parentId = await authorizeTeamUser(current,input.uid); const rows = await Psql.query('SELECT COALESCE("legacyUserData"->>\'VIP\',\'0\') AS vip,COUNT(*)::int AS total FROM "_User" WHERE "company"=$1 AND ("isDeleted" IS NULL OR "isDeleted"=FALSE) AND COALESCE("legacyUserData"->>\'ParentUserID\',\'0\')=$2 GROUP BY COALESCE("legacyUserData"->>\'VIP\',\'0\')', [DEFAULT_COMPANY_ID,String(parentId)]); const result = { childs:0,v0:0,v1:0,v2:0,v3:0,v4:0,v5:0 }; for (const row of rows) { const total = number(row.total); result.childs += total; const key = 'v' + Math.max(0,Math.min(5,number(row.vip))); result[key] += total; } return result;
}
async function coachStudentPage(input,current) {
  const coachId = ownLegacyId(current); if (!coachId) fail(400,'陪练账号缺少旧系统用户 ID'); const paging = pageInput(input); const baseValues = [DEFAULT_COMPANY_ID,String(coachId)]; const base = 'FROM "CommonModel" c JOIN "CourseAppointment" a ON a."company"=$1 AND CAST(a."id" AS text)=CAST(c."itemId" AS text) WHERE c."company"=$1 AND CAST(c."modelId" AS text)=\'54\' AND CAST(c."status" AS text)=\'99\' AND CAST(a."pl" AS text)=$2 AND COALESCE(CAST(a."szyh" AS text),\'\')<>\'\''; const countRow = await Psql.one('SELECT COUNT(DISTINCT CAST(a."szyh" AS text))::int AS total ' + base,baseValues); const rows = await Psql.query('WITH students AS (SELECT CAST(a."szyh" AS text) AS uid,MAX(CAST(a."id" AS text)) AS appointment_id ' + base + ' GROUP BY CAST(a."szyh" AS text) ORDER BY MAX(c."updatedAt") DESC LIMIT $3 OFFSET $4) SELECT ' + userSelect('u') + ',students.uid AS "__studentId",students.appointment_id AS "__appointmentId" FROM students LEFT JOIN "_User" u ON u."company"=$1 AND CAST(u."legacyUserId" AS text)=students.uid',baseValues.concat([paging.size,(paging.index - 1) * paging.size])); const normalized = rows.map((row) => { const value = legacyUserRow(row); const studentId = number(row.__studentId || value.UserID); return { ...value, userId:studentId, UserID:studentId, szyh:studentId, ID:number(row.__appointmentId), honeyname:value.HoneyName, honeyName:value.HoneyName }; }); const total = number(countRow.total); return { rows:normalized,page:{ itemCount:total,pageCount:Math.ceil(total / paging.size),pageIndex:paging.index,pageSize:paging.size } };
}
const POINT_HISTORY_CLASSES = { 1:'UserExpDomP',2:'UserSIcon',3:'UserExpHis',4:'UserUserPoint',5:'UserDummyPoint',6:'UserCredit' };
function legacyPointRow(source) { const row = safe(source); row.ExpHisID = firstValue(row.expHisId,row.objectId); row.UserID = number(row.userId); row.HisTime = firstValue(row.hisTime,row.createdAt); row.Score = number(row.score); row.Detail = String(firstValue(row.detail,row.remark,'') || ''); row.Remark = String(row.remark || ''); row.score_before = number(row.scoreBefore); return row; }
async function pointHistoryPage(input,current) {
  const stype = number(input.stype); const className = POINT_HISTORY_CLASSES[stype]; if (!className) fail(400,'虚拟币类型必须为 1-6'); const uid = await authorizeRequestedUser(current,input.uid); const paging = pageInput(input); const values = [DEFAULT_COMPANY_ID,String(uid)]; const where = '"company"=$1 AND CAST("userId" AS text)=$2'; const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "' + className + '" WHERE ' + where,values); const rows = await Psql.query('SELECT * FROM "' + className + '" WHERE ' + where + ' ORDER BY COALESCE("hisTime","updatedAt","createdAt") DESC LIMIT $3 OFFSET $4',values.concat([paging.size,(paging.index - 1) * paging.size])); const total = number(countRow.total); return { rows:rows.filter(isVisible).map(legacyPointRow),page:{ itemCount:total,pageCount:Math.ceil(total / paging.size),pageIndex:paging.index,pageSize:paging.size },addon:stype === 1 ? { purse_fee:null,purseFeeRuleUnavailable:true } : {} };
}
async function createGuestbook(input,current) {
  const model = parseObject(input.model,'留言'); const uid = ownLegacyId(current); if (!uid) fail(400,'当前用户缺少旧系统用户 ID'); const requestedUid = number(firstValue(model.UserID,model.userid,input.UserID,input.userid,uid)); if (requestedUid !== uid && !isAdminUser(current)) fail(403,'不允许代替其他用户提交留言'); const name = cleanText(firstValue(input.name,model.Name,model.name,''),80); const title = cleanText(firstValue(model.Title,model.title,input.Title,input.title,name ? name + ' 反馈的意见' : '用户反馈'),200); const content = String(firstValue(model.TContent,model.tcontent,input.TContent,input.tcontent,input.content,'') || '').trim(); if (!content) fail(400,'请填写反馈内容'); if (content.length > 800) fail(400,'反馈内容不得超过 800 字'); const gid = Math.floor(100000000000000 + Math.random() * 800000000000000); const item = new Parse.Object('Guestbook'); item.set('company',current.get('company')); item.set('sourceKey','cloud:guestbook_add:' + uid + ':' + gid); item.set('gid',gid); item.set('gdate',new Date()); item.set('userid',requestedUid); item.set('title',title); item.set('tcontent',content); item.set('cateid',number(firstValue(model.Cateid,model.cateid,input.Cateid,input.cateid),22)); item.set('parentid',0); item.set('status',0); await item.save(null,{useMasterKey:true}); const result = safe(item); return { ...result,GID:gid,UserID:requestedUid,Title:title,TContent:content,Cateid:number(result.cateid),Status:0 };
}
async function authorizeRequestedUser(current, requestedId) {
  const targetId = number(requestedId || ownLegacyId(current)); if (!targetId) fail(400, '缺少用户 ID'); if (isAdminUser(current) || targetId === ownLegacyId(current)) return targetId;
  const fields = await fieldsOf('_User'); const target = await findByLegacyId('_User', fields, targetId, ['legacyUserId','userid','num']); const agent = target && target.get('agent'); if (!target || !agent || agent.id !== current.id) fail(403, '无权查看该学员的业务记录'); return targetId;
}
async function authorizeBusinessRow(current, row, subjectFields, actorFields = []) {
  if (isAdminUser(current)) return; const ownId = ownLegacyId(current); const allIds = subjectFields.concat(actorFields).map((name) => number(row[name] ?? row[name.toLowerCase()] ?? row[name.toUpperCase()])).filter(Boolean); if (allIds.includes(ownId)) return;
  const subjectIds = subjectFields.map((name) => number(row[name] ?? row[name.toLowerCase()] ?? row[name.toUpperCase()])).filter(Boolean); if (!subjectIds.length) fail(403, '业务记录缺少可验证的所属用户'); const fields = await fieldsOf('_User'); for (const targetId of [...new Set(subjectIds)]) { const target = await findByLegacyId('_User', fields, targetId, ['legacyUserId','userid','num']); const agent = target && target.get('agent'); if (target && agent && agent.id === current.id) return; } fail(403, '无权查看该业务记录');
}
function normalizeWordRow(source) { const addon = source.__addon || {}; const merged = { ...source, ...addon }; delete merged.__addon; return legacyAliases(merged, 'CommonModel'); }
async function orderDetailRow(inputId, current, authorize = true) {
  const id = String(inputId || ''); if (!id) fail(400, '缺少预约 ID'); const rows = await Psql.query('SELECT c.*, row_to_json(a) AS "__addon", n."nodeName" AS "__courseTitle" FROM "CommonModel" c JOIN "CourseAppointment" a ON a."company" = $1 AND CAST(a."id" AS text) = CAST(c."itemId" AS text) LEFT JOIN "Node" n ON n."company" = $1 AND CAST(n."nodeId" AS text) = CAST(a."kcid" AS text) WHERE c."company" = $1 AND CAST(c."modelId" AS text) = \'54\' AND CAST(c."generalId" AS text) = $2 LIMIT 1', [DEFAULT_COMPANY_ID, id]);
  let source = rows[0]; if (!source && /^[A-Za-z0-9_-]{10,40}$/.test(id)) { const direct = await Psql.query('SELECT a.*, n."nodeName" AS "__courseTitle" FROM "CourseAppointment" a LEFT JOIN "Node" n ON n."company" = $1 AND CAST(n."nodeId" AS text) = CAST(a."kcid" AS text) WHERE a."company" = $1 AND a."objectId" = $2 LIMIT 1', [DEFAULT_COMPANY_ID, id]); if (direct[0]) source = { ...direct[0], generalId: id, GeneralID: id, title: direct[0].title || '课程预约' }; }
  if (!source) return null; const addon = source.__addon || {}; const courseTitle = source.__courseTitle || source.subtitle || ''; delete source.__addon; delete source.__courseTitle; const row = legacyAliases({ ...source, ...addon }, 'CommonModel'); row.kcmc = row.kcmc || courseTitle; row.yykcmc = row.yykcmc || courseTitle; row.HoneyName = row.HoneyName || String(row.Title || '').split('(')[0]; if (authorize) await authorizeBusinessRow(current, row, ['szyh'], ['pl']); return row;
}
async function recordDetailData(input, current) {
  const id = String(input.id || input.gid || ''); if (!id) fail(400, '缺少学习记录 ID'); const rows = await Psql.query('SELECT c.*, row_to_json(d) AS "__addon" FROM "CommonModel" c JOIN "DailyStudyRecord" d ON d."company" = $1 AND CAST(d."id" AS text) = CAST(c."itemId" AS text) WHERE c."company" = $1 AND CAST(c."modelId" AS text) = \'56\' AND CAST(c."generalId" AS text) = $2 LIMIT 1', [DEFAULT_COMPANY_ID, id]);
  if (!rows.length) return null; const source = rows[0]; const recordAddon = source.__addon || {}; delete source.__addon; const record = legacyAliases({ ...source, ...recordAddon }, 'CommonModel'); await authorizeBusinessRow(current, record, ['userId'], ['pl']); const storedWords = parseArray(recordAddon.xxqs); const ids = [...new Set(storedWords.map((item) => String(item && (item.GeneralID ?? item.generalId ?? item.id) || '')).filter(Boolean))]; let wordRows = [];
  if (ids.length) wordRows = await Psql.query('SELECT c.*, row_to_json(v) AS "__addon" FROM "CommonModel" c LEFT JOIN "VocabularyWord" v ON v."company" = $1 AND CAST(v."id" AS text) = CAST(c."itemId" AS text) WHERE c."company" = $1 AND CAST(c."modelId" AS text) = \'52\' AND CAST(c."generalId" AS text) = ANY($2::text[])', [DEFAULT_COMPANY_ID, ids]);
  const details = new Map(wordRows.map((row) => { const normalized = normalizeWordRow(row); return [String(normalized.GeneralID || normalized.generalId), normalized]; })); const words = storedWords.map((item) => { const raw = item && typeof item === 'object' ? safe(item) : {}; const wordId = String(raw.GeneralID ?? raw.generalId ?? raw.id ?? ''); const detail = details.get(wordId) || legacyAliases({ generalId: wordId, title: raw.Title || raw.title || '' }, 'CommonModel'); return { ...detail, ...raw, GeneralID: number(wordId, wordId), Title: raw.Title || raw.title || detail.Title || detail.title || '', detail: [detail] }; });
  const order = recordAddon.dsid ? await orderDetailRow(recordAddon.dsid, current, false) : null; return { words, addon: order ? [order] : [], record };
}
async function newWordPage(input, current) {
  const uid = await authorizeRequestedUser(current, input.uid); const paging = largePageInput(input); const values = [DEFAULT_COMPANY_ID, String(uid)]; const where = 'p."company" = $1 AND CAST(p."yhid" AS text) = $2 AND LOWER(CAST(p."jrscb" AS text)) IN (\'1\',\'true\')'; const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "PracticeRecord" p WHERE ' + where, values); const rows = await Psql.query('SELECT p.*, pc."generalId" AS "__practiceGeneralId", c.*, row_to_json(v) AS "__addon" FROM "PracticeRecord" p JOIN "CommonModel" c ON c."company" = $1 AND CAST(c."modelId" AS text) = \'52\' AND CAST(c."generalId" AS text) = CAST(p."scid" AS text) LEFT JOIN "VocabularyWord" v ON v."company" = $1 AND CAST(v."id" AS text) = CAST(c."itemId" AS text) LEFT JOIN "CommonModel" pc ON pc."company" = $1 AND CAST(pc."modelId" AS text) = \'53\' AND CAST(pc."itemId" AS text) = CAST(p."id" AS text) WHERE ' + where + ' ORDER BY p."updatedAt" DESC LIMIT $3 OFFSET $4', values.concat([paging.size, (paging.index - 1) * paging.size]));
  const result = rows.map((source) => { const practice = { id: source.id, kcid: source.kcid, scid: source.scid, xxcs: source.xxcs, yhid: source.yhid, jrscb: source.jrscb }; const detail = normalizeWordRow(source); return { ...practice, GeneralID: number(source.__practiceGeneralId || source.id), Title: detail.Title || detail.title || '', detail: [detail] }; }); const total = number(countRow.total); return { rows: result, page: { itemCount: total, pageCount: Math.ceil(total / paging.size), pageIndex: paging.index, pageSize: paging.size } };
}
async function courseWordPage(input, current) {
  const uid = await authorizeRequestedUser(current, input.uid); const nodes = String(input.nids || input.nid || '').split(',').map((value) => String(number(value))).filter((value) => value !== '0'); if (!nodes.length) fail(400, '缺少词库单元 ID'); const paging = { index: Math.max(1, number(input.cpage || input.page, 1)), size: Math.min(10000, Math.max(1, number(input.psize || input.pageSize, 1000))) }; const values = [DEFAULT_COMPANY_ID, String(uid), nodes]; const where = 'c."company" = $1 AND CAST(c."modelId" AS text) = \'52\' AND CAST(c."nodeId" AS text) = ANY($3::text[])'; const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "CommonModel" c WHERE ' + where, values); const rows = await Psql.query('SELECT c.*, row_to_json(v) AS "__addon", p."xxcs" AS "__learned", p."jrscb" AS "__newWord" FROM "CommonModel" c LEFT JOIN "VocabularyWord" v ON v."company" = $1 AND CAST(v."id" AS text) = CAST(c."itemId" AS text) LEFT JOIN LATERAL (SELECT pr."xxcs", pr."jrscb" FROM "PracticeRecord" pr WHERE pr."company" = $1 AND CAST(pr."yhid" AS text) = $2 AND CAST(pr."scid" AS text) = CAST(c."generalId" AS text) ORDER BY pr."updatedAt" DESC LIMIT 1) p ON TRUE WHERE ' + where + ' ORDER BY c."orderId" ASC, c."generalId" ASC LIMIT $4 OFFSET $5', values.concat([paging.size, (paging.index - 1) * paging.size])); const result = rows.map((source) => { const learned = number(source.__learned); const newWord = number(source.__newWord); delete source.__learned; delete source.__newWord; const word = normalizeWordRow(source); return { ...word, detail: word, gldy: word.GeneralID, w_learned: learned, ifnew: newWord }; }); const total = number(countRow.total); return { rows: result, page: { itemCount: total, pageCount: Math.ceil(total / paging.size), pageIndex: paging.index, pageSize: paging.size } };
}
async function updateLearningWords(input, current) {
  const uid = await authorizeRequestedUser(current, input.uid); const wordIds = [...new Set(String(input.wordsId || input.wordIds || '').split(',').map((value) => String(number(value))).filter((value) => value !== '0'))]; if (!wordIds.length) fail(400, '请选择单词'); if (wordIds.length > 100) fail(400, '单次最多操作 100 个单词'); const saveLearning = number(input.save) === 1; const hasNewWordFlag = input.ifnew !== undefined && input.ifnew !== ''; const newWordFlag = hasNewWordFlag ? (number(input.ifnew) === 1 ? '1' : '0') : null; if (!saveLearning && !hasNewWordFlag) fail(400, '缺少学习或生词操作类型'); const kcid = number(input.kcid);
  const validRows = await Psql.query('SELECT CAST("generalId" AS text) AS id FROM "CommonModel" WHERE "company" = $1 AND CAST("modelId" AS text) = \'52\' AND CAST("generalId" AS text) = ANY($2::text[])', [DEFAULT_COMPANY_ID, wordIds]); const validIds = new Set(validRows.map((row) => String(row.id))); const invalid = wordIds.filter((id) => !validIds.has(id)); if (invalid.length) fail(400, '包含不存在的词库 ID: ' + invalid.join(','));
  const existingRows = await Psql.query('SELECT "objectId", CAST("scid" AS text) AS "scid" FROM "PracticeRecord" WHERE "company" = $1 AND CAST("yhid" AS text) = $2 AND CAST("scid" AS text) = ANY($3::text[])', [DEFAULT_COMPANY_ID, String(uid), wordIds]); const existing = await Promise.all(existingRows.map((row) => new Parse.Query('PracticeRecord').get(row.objectId, { useMasterKey: true }))); const byWord = new Map(existing.map((item) => [String(item.get('scid')), item])); const changed = []; let created = 0;
  for (const wordId of wordIds) { let item = byWord.get(wordId); if (!item) { if (!kcid) fail(400, '首次记录单词时缺少课程 ID'); item = new Parse.Object('PracticeRecord'); item.set('company', current.get('company')); item.set('sourceKey', 'cloud:e_add_words:' + uid + ':' + wordId); item.set('yhid', uid); item.set('scid', number(wordId)); item.set('kcid', String(kcid)); item.set('xxcs', 0); item.set('jrscb', '0'); created += 1; } else if (kcid && !item.get('kcid')) item.set('kcid', String(kcid)); if (saveLearning) item.set('xxcs', number(item.get('xxcs')) + 1); if (newWordFlag !== null) item.set('jrscb', newWordFlag); changed.push(item); }
  const saved = await Parse.Object.saveAll(changed, { useMasterKey: true }); return { affected: saved.length, created, learnedIncremented: saveLearning ? saved.length : 0, newWordState: newWordFlag === null ? undefined : number(newWordFlag), objectIds: saved.map((item) => item.id) };
}
function parseObject(value, label) { if (value && typeof value === 'object' && !Array.isArray(value)) return value; if (typeof value !== 'string' || !value.trim()) return {}; try { const parsed = JSON.parse(value); if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) return parsed; } catch (_) {} fail(400, label + '格式错误'); }
function cleanText(value, max) { return String(value == null ? '' : value).trim().slice(0, max); }
async function validateStudyWords(raw) { const words = parseArray(raw); if (words.length > 500) fail(400, '单次学习记录最多 500 个单词'); const normalized = words.map((item) => ({ GeneralID: number(item && (item.GeneralID ?? item.generalId ?? item.id)), Title: cleanText(item && (item.Title ?? item.title), 200), check: number(item && item.check) })).filter((item) => item.GeneralID); if (!normalized.length && words.length) fail(400, '学习记录中的单词 ID 无效'); if (normalized.length) { const ids = [...new Set(normalized.map((item) => String(item.GeneralID)))]; const rows = await Psql.query('SELECT CAST("generalId" AS text) AS id FROM "CommonModel" WHERE "company" = $1 AND CAST("modelId" AS text) = \'52\' AND CAST("generalId" AS text) = ANY($2::text[])', [DEFAULT_COMPANY_ID, ids]); if (new Set(rows.map((row) => String(row.id))).size !== ids.length) fail(400, '学习记录包含不存在的词库 ID'); } return normalized; }
async function upsertStudyRecord(input, current) {
  const uid = await authorizeRequestedUser(current, input.uid); const orderId = String(input.orderId || input.id || '').trim(); if (!orderId) fail(400, '缺少预约 ID'); const order = await orderDetailRow(orderId, current); if (!order) fail(404, '预约记录不存在'); const orderOwner = number(order.szyh); if (orderOwner && orderOwner !== uid) fail(403, '预约记录与学员不匹配'); const addon = parseObject(input.addon, '学习记录'); const wordsProvided = addon.xxqs !== undefined; const words = wordsProvided ? await validateStudyWords(addon.xxqs) : null; const inputer = cleanText(input.inputer || current.get('nickname') || current.get('realName') || current.get('username'), 100); const title = cleanText(input.title || inputer, 200) || '学习记录';
  const rows = await Psql.query('SELECT c."objectId" AS "commonObjectId", c."generalId", d."objectId" AS "recordObjectId" FROM "CommonModel" c JOIN "DailyStudyRecord" d ON d."company" = $1 AND CAST(d."id" AS text) = CAST(c."itemId" AS text) WHERE c."company" = $1 AND CAST(c."modelId" AS text) = \'56\' AND CAST(d."dsid" AS text) = $2 AND CAST(d."userId" AS text) = $3 ORDER BY c."updatedAt" DESC LIMIT 1', [DEFAULT_COMPANY_ID, orderId, String(uid)]); const found = rows[0] || null; let record; let common; let created = false;
  if (found) { record = await new Parse.Query('DailyStudyRecord').get(found.recordObjectId, { useMasterKey: true }); common = await new Parse.Query('CommonModel').get(found.commonObjectId, { useMasterKey: true }); }
  const applyFields = (target) => { const actorId = ownLegacyId(current); target.set('userId', uid); target.set('dsid', orderId); target.set('pl', actorId && actorId !== uid ? String(actorId) : '0'); if (addon.con !== undefined) target.set('con', cleanText(addon.con, 1000)); if (addon.dqrq !== undefined) { const date = cleanText(addon.dqrq, 20); if (!/^\d{8}$/.test(date)) fail(400, '学习日期必须为 yyyymmdd'); target.set('dqrq', date); } if (addon.szmdid !== undefined) target.set('szmdid', cleanText(addon.szmdid, 100)); if (addon.fxrl !== undefined) target.set('fxrl', cleanText(addon.fxrl, 1000)); if (wordsProvided) { const learned = words.length; target.set('xxqs', JSON.stringify(words)); target.set('learned', learned); target.set('ygg', words.filter((item) => item.check === 1).length); target.set('djq', words.filter((item) => item.check === 2).length); } else { for (const name of ['learned','ygg','djq']) if (addon[name] !== undefined) target.set(name, Math.max(0, number(addon[name]))); } };
  if (record) { applyFields(record); common.set('title', title); common.set('inputer', inputer); common.set('hits', number(record.get('learned'))); await Parse.Object.saveAll([record, common], { useMasterKey: true }); return { GeneralID: number(found.generalId), generalId: number(found.generalId), objectId: common.id, recordObjectId: record.id, created: false }; }
  created = true; const baseId = Math.floor(100000000000000 + Math.random() * 800000000000000); const recordId = baseId; const generalId = baseId + 1; record = new Parse.Object('DailyStudyRecord'); record.set('company', current.get('company')); record.set('sourceKey', 'cloud:stu_record:' + uid + ':' + orderId); applyFields(record); await record.save(null, { useMasterKey: true }); try { await Psql.none('UPDATE "DailyStudyRecord" SET "id" = $1 WHERE "objectId" = $2', [recordId, record.id]); common = new Parse.Object('CommonModel'); common.set('company', current.get('company')); common.set('sourceKey', 'cloud:stu_record:' + uid + ':' + orderId); common.set('generalId', generalId); common.set('itemId', recordId); common.set('modelId', 56); common.set('nodeId', 291); common.set('tableName', 'ZL_C_ss'); common.set('title', title); common.set('inputer', inputer); common.set('hits', number(record.get('learned'))); common.set('status', 99); await common.save(null, { useMasterKey: true }); } catch (error) { if (common && common.id) await common.destroy({ useMasterKey: true }).catch(() => undefined); await record.destroy({ useMasterKey: true }).catch(() => undefined); throw error; } return { GeneralID: generalId, generalId, objectId: common.id, recordObjectId: record.id, created };
}
function reviewSchedule() {
  const shifted = new Date(Date.now() + 8 * 60 * 60 * 1000); const today = new Date(Date.UTC(shifted.getUTCFullYear(), shifted.getUTCMonth(), shifted.getUTCDate())); const pad = (value) => String(value).padStart(2, '0');
  return [1,2,3,5,7,9,11,14,17,21,30,40,50,60,90].map((offset) => { const day = new Date(today.getTime() + offset * 86400000); return day.getUTCFullYear() + pad(day.getUTCMonth() + 1) + pad(day.getUTCDate()); }).join(',');
}
async function createStudyContent(input, current) {
  const content = parseObject(input.content, '内容'); const addon = parseObject(input.addon, '附表内容'); const modelId = number(content.ModelID ?? content.modelId); if (modelId !== 56) fail(400, 'content_add_zt 只支持每日学习记录 Model 56');
  const uid = await authorizeRequestedUser(current, addon.UserID ?? addon.userId); const words = addon.xxqs === undefined ? [] : await validateStudyWords(addon.xxqs); const actorId = ownLegacyId(current); const recordId = Math.floor(100000000000000 + Math.random() * 800000000000000); const generalId = recordId + 1; let record; let common;
  record = new Parse.Object('DailyStudyRecord'); record.set('company', current.get('company')); record.set('sourceKey', 'cloud:content_add_zt:' + uid + ':' + generalId); record.set('userId', uid); record.set('pl', actorId && actorId !== uid ? String(actorId) : '0'); record.set('fxrl', reviewSchedule()); record.set('xxqs', JSON.stringify(words)); record.set('learned', words.length || Math.max(0, number(addon.learned))); record.set('ygg', words.length ? words.filter((item) => item.check === 1).length : Math.max(0, number(addon.ygg))); record.set('djq', words.length ? words.filter((item) => item.check === 2).length : Math.max(0, number(addon.djq)));
  if (addon.con !== undefined) record.set('con', cleanText(addon.con, 1000)); if (addon.dqrq !== undefined) { const date = cleanText(addon.dqrq, 20); if (!/^\d{8}$/.test(date)) fail(400, '学习日期必须为 yyyymmdd'); record.set('dqrq', date); } if (addon.dsid !== undefined) record.set('dsid', cleanText(addon.dsid, 100)); if (addon.szmdid !== undefined) record.set('szmdid', cleanText(addon.szmdid, 100));
  await record.save(null, { useMasterKey: true }); try { await Psql.none('UPDATE "DailyStudyRecord" SET "id" = $1 WHERE "objectId" = $2', [recordId, record.id]); common = new Parse.Object('CommonModel'); common.set('company', current.get('company')); common.set('sourceKey', 'cloud:content_add_zt:' + uid + ':' + generalId); common.set('generalId', generalId); common.set('itemId', recordId); common.set('modelId', 56); common.set('nodeId', number(content.nodeId ?? content.NodeID, 291) || 291); common.set('tableName', 'ZL_C_ss'); common.set('title', cleanText(content.title ?? content.Title, 200) || cleanText(current.get('nickname') || current.get('username'), 200) || '学习记录'); common.set('inputer', cleanText(content.inputer ?? content.Inputer ?? current.get('username'), 100)); common.set('hits', number(content.Hits ?? content.hits, record.get('learned'))); common.set('status', number(content.Status ?? content.status, 99)); await common.save(null, { useMasterKey: true }); } catch (error) { if (common && common.id) await common.destroy({ useMasterKey: true }).catch(() => undefined); await record.destroy({ useMasterKey: true }).catch(() => undefined); throw error; }
  return String(generalId);
}
function writeAddonField(config, requested) { const normalized = String(requested).replace(/[^A-Za-z0-9]/g, '').toLowerCase(); return config && config.fields.find((field) => field.replace(/[^A-Za-z0-9]/g, '').toLowerCase() === normalized); }
function writeValue(value, definition) {
  if (!definition) return value; if (definition.type === 'Number') { const parsed = Number(value); if (!Number.isFinite(parsed)) fail(400, '数值字段格式错误'); return parsed; }
  if (definition.type === 'Boolean') return [true,1,'1','true','True','TRUE'].includes(value); if (definition.type === 'Date') { const date = new Date(value); if (Number.isNaN(date.getTime())) fail(400, '日期字段格式错误'); return date; }
  if (definition.type === 'String') return typeof value === 'string' ? value.slice(0, 50000) : JSON.stringify(value).slice(0, 50000); fail(400, '不支持写入字段类型 ' + definition.type);
}
function snapshotFields(object, fields) { const snapshot = {}; for (const field of fields) snapshot[field] = Object.prototype.hasOwnProperty.call(object.attributes || {}, field) ? { exists:true, value:object.get(field) } : { exists:false }; return snapshot; }
function restoreFields(object, snapshot) { for (const [field,state] of Object.entries(snapshot)) { if (state.exists) object.set(field, state.value); else object.unset(field); } }
async function updateContentPair(input, current) {
  const content = parseObject(input.content, '内容'); const addonInput = parseObject(input.addon, '附表内容'); const generalId = String(content.GeneralID ?? content.generalId ?? input.id ?? input.generalId ?? '').trim(); if (!generalId) fail(400, '缺少内容 GeneralID');
  const resolved = await resolveContent({ id: generalId }, true); const common = resolved.object; if (!common) fail(404, '指定内容不存在'); const modelId = number(common.get('modelId')); const config = CONTENT_ADDONS[modelId]; const auth = CONTENT_WRITE_AUTH[modelId]; if (!config || !auth) fail(501, '目标 Schema 未迁移内容模型 ' + modelId); if (modelId === 59 && number(common.get('nodeId')) !== 296) fail(501, 'Model 59 的非课次节点缺少独立目标 Schema');
  const addonRows = await Psql.query('SELECT "objectId" FROM "' + config.className + '" WHERE "company" = $1 AND CAST("id" AS text) = $2 LIMIT 1', [DEFAULT_COMPANY_ID, String(common.get('itemId'))]); const addon = addonRows[0] ? await new Parse.Query(config.className).get(addonRows[0].objectId, { useMasterKey: true }) : null; if (!addon) fail(404, '内容附表不存在'); const existing = safe(addon); await authorizeBusinessRow(current, existing, auth.subjects, auth.actors);
  const addonSchema = await fieldsOf(config.className); const addonChanged = []; const addonSnapshot = {}; for (const [requested,value] of Object.entries(addonInput)) { if (String(requested).toLowerCase() === 'id') continue; const field = writeAddonField(config, requested); if (!field || !addonSchema[field] || ['id','company','sourceKey'].includes(field)) fail(400, '不允许更新附表字段 ' + requested); if (auth.subjects.concat(auth.actors).includes(field) && String(existing[field] ?? '') !== String(value ?? '')) fail(403, '不允许变更内容所属用户'); if (!addonSnapshot[field]) Object.assign(addonSnapshot, snapshotFields(addon, [field])); addon.set(field, writeValue(value, addonSchema[field])); addonChanged.push(field); }
  const commonSnapshot = snapshotFields(common, ['upDateTime','title','template','createTime']); const commonChanged = ['upDateTime']; common.set('upDateTime', new Date()); const title = content.Title ?? content.title; if (title !== undefined && String(title).trim()) { common.set('title', cleanText(title, 200)); commonChanged.push('title'); } const template = content.Template ?? content.template; if (template !== undefined && template !== null) { common.set('template', String(template) === '-100' ? '' : cleanText(template, 500)); commonChanged.push('template'); } const createTime = content.CreateTime ?? content.createTime; if (createTime) { const date = new Date(createTime); if (Number.isNaN(date.getTime()) || date.getUTCFullYear() <= 1970) fail(400, '内容创建时间格式错误'); common.set('createTime', date); commonChanged.push('createTime'); }
  if (!addonChanged.length && commonChanged.length === 1) fail(400, '没有可更新的内容字段'); try { await Parse.Object.saveAll([addon, common], { useMasterKey: true }); } catch (error) { restoreFields(addon, addonSnapshot); restoreFields(common, commonSnapshot); await Parse.Object.saveAll([addon, common], { useMasterKey: true }).catch(() => undefined); throw error; } return String(common.get('generalId'));
}
async function createContentPair(input, current) {
  const content = parseObject(input.content, '内容'); const addonInput = parseObject(input.addon, '附表内容'); const modelId = number(content.ModelID ?? content.modelId); const config = CONTENT_ADDONS[modelId]; const auth = CONTENT_WRITE_AUTH[modelId]; if (!config || !auth) fail(501, '目标 Schema 未迁移内容模型 ' + modelId); const nodeId = number(content.NodeID ?? content.nodeId, auth.nodeId); if (modelId === 59 && nodeId !== 296) fail(501, 'Model 59 的非课次节点缺少独立目标 Schema');
  const ownerField = auth.subjects[0]; const ownerRequested = Object.entries(addonInput).find(([key]) => writeAddonField(config, key) === ownerField); const ownerId = number(ownerRequested && ownerRequested[1]); if (!ownerId) fail(400, '附表缺少所属用户字段 ' + ownerField); await authorizeRequestedUser(current, ownerId); const actorId = ownLegacyId(current); const schema = await fieldsOf(config.className); const recordId = Math.floor(100000000000000 + Math.random() * 800000000000000); const generalId = recordId + 1; let addon; let common;
  addon = new Parse.Object(config.className); addon.set('company', current.get('company')); addon.set('sourceKey', 'cloud:content_add:' + ownerId + ':' + generalId); for (const [requested,value] of Object.entries(addonInput)) { if (String(requested).toLowerCase() === 'id') continue; const field = writeAddonField(config, requested); if (!field || !schema[field] || ['id','company','sourceKey'].includes(field)) fail(400, '不允许写入附表字段 ' + requested); if (auth.subjects.includes(field) && number(value) !== ownerId) fail(403, '不允许变更内容所属用户'); if (auth.actors.includes(field) && number(value) && !isAdminUser(current) && number(value) !== actorId) fail(403, '不允许冒用其他业务操作人'); addon.set(field, writeValue(value, schema[field])); }
  if (modelId === 56 && addonInput.xxqs !== undefined) { const words = await validateStudyWords(addonInput.xxqs); addon.set('xxqs', JSON.stringify(words)); addon.set('learned', words.length); addon.set('ygg', words.filter((item) => item.check === 1).length); addon.set('djq', words.filter((item) => item.check === 2).length); }
  await addon.save(null, { useMasterKey: true }); try { await Psql.none('UPDATE "' + config.className + '" SET "id" = $1 WHERE "objectId" = $2', [recordId, addon.id]); common = new Parse.Object('CommonModel'); common.set('company', current.get('company')); common.set('sourceKey', 'cloud:content_add:' + ownerId + ':' + generalId); common.set('generalId', generalId); common.set('itemId', recordId); common.set('modelId', modelId); common.set('nodeId', nodeId || auth.nodeId); common.set('tableName', auth.tableName); common.set('title', cleanText(content.Title ?? content.title, 200) || cleanText(current.get('nickname') || current.get('username'), 200) || '内容记录'); common.set('inputer', cleanText(content.Inputer ?? content.inputer ?? current.get('username'), 100)); common.set('hits', number(content.Hits ?? content.hits)); common.set('status', number(content.Status ?? content.status, 99)); if (content.Template ?? content.template) common.set('template', cleanText(content.Template ?? content.template, 500)); await common.save(null, { useMasterKey: true }); } catch (error) { if (common && common.id) await common.destroy({ useMasterKey: true }).catch(() => undefined); await addon.destroy({ useMasterKey: true }).catch(() => undefined); throw error; }
  return String(generalId);
}
function randomObjectId() { const chars = '0123456789abcdef'; let value = ''; for (let index = 0; index < 20; index += 1) value += chars[Math.floor(Math.random() * chars.length)]; return value; }
function periodConfig(type) { return ({ 1:{ field:'Purse', ledger:'UserExpDomP', point:0.5 }, 2:{ field:'SilverCoin', ledger:'UserSIcon', point:1 }, 3:{ field:'UserExp', ledger:'UserExpHis', point:0 }, 4:{ field:'UserPoint', ledger:'UserUserPoint', point:0 } })[number(type)] || null; }
async function deductOrderPeriod(student, uid, type, orderId, detail) {
  const config = periodConfig(type); if (!config) fail(400, '不支持的课时类型'); const periodKey = 'cloud:e_order_update:' + orderId + ':period'; const pointKey = 'cloud:e_order_update:' + orderId + ':point'; const sql = 'WITH locked AS (SELECT "objectId", COALESCE(("legacyUserData"->>$2)::numeric,0) AS before, COALESCE(("legacyUserData"->>\'UserPoint\')::numeric,0) AS point_before FROM "_User" WHERE "objectId"=$1 FOR UPDATE), claim AS (INSERT INTO "' + config.ledger + '" ("objectId","createdAt","updatedAt","company","sourceKey","score","scoreBefore","userId","hisTime","operator","scoreType","detail","remark","operatorIp","type1","type2","type3","attach","extend") SELECT $5,NOW(),NOW(),$7,$3,-1,locked.before,$8,NOW(),2,$9,$10,\'API\',\'\',\'0\',\'\',\'\',\'\',\'\' FROM locked WHERE locked.before >= 1 ON CONFLICT ("sourceKey") DO NOTHING RETURNING "objectId"), updated AS (UPDATE "_User" u SET "legacyUserData"=CASE WHEN $11::numeric > 0 THEN jsonb_set(jsonb_set(COALESCE(u."legacyUserData",\'{}\'::jsonb),ARRAY[$2]::text[],to_jsonb((locked.before-1)::numeric),true),ARRAY[\'UserPoint\']::text[],to_jsonb(GREATEST(locked.point_before-$11::numeric,0)),true) ELSE jsonb_set(COALESCE(u."legacyUserData",\'{}\'::jsonb),ARRAY[$2]::text[],to_jsonb((locked.before-1)::numeric),true) END, "updatedAt"=NOW() FROM locked,claim WHERE u."objectId"=locked."objectId" RETURNING u."objectId"), point_log AS (INSERT INTO "UserUserPoint" ("objectId","createdAt","updatedAt","company","sourceKey","score","scoreBefore","userId","hisTime","operator","scoreType","detail","remark","operatorIp","type1","type2","type3","attach","extend") SELECT $6,NOW(),NOW(),$7,$4,-$11,GREATEST(locked.point_before-$11::numeric,0),$8,NOW(),2,$9,$10,\'API\',\'\',\'0\',\'\',\'\',\'\',\'\' FROM locked,claim WHERE $11::numeric > 0 ON CONFLICT ("sourceKey") DO NOTHING RETURNING "objectId") SELECT (SELECT COUNT(*)::int FROM claim) AS claimed,(SELECT before FROM locked) AS before,(SELECT point_before FROM locked) AS point_before'; const rows = await Psql.query(sql, [student.id,config.field,periodKey,pointKey,randomObjectId(),randomObjectId(),DEFAULT_COMPANY_ID,uid,number(type),detail,config.point]); const row = rows[0] || {}; if (row.before === undefined) fail(404, '学员不存在'); if (number(row.before) < 1 && !number(row.claimed)) fail(409, '课时不足'); return { claimed:number(row.claimed) === 1, config, periodKey, pointKey };
}
async function rollbackOrderPeriod(studentId, config, periodKey, pointKey) {
  const sql = 'WITH period_deleted AS (DELETE FROM "' + config.ledger + '" WHERE "sourceKey"=$2 RETURNING 1), point_deleted AS (DELETE FROM "UserUserPoint" WHERE "sourceKey"=$3 RETURNING 1), updated AS (UPDATE "_User" u SET "legacyUserData"=CASE WHEN $5::numeric > 0 THEN jsonb_set(jsonb_set(COALESCE(u."legacyUserData",\'{}\'::jsonb),ARRAY[$4]::text[],to_jsonb((COALESCE((u."legacyUserData"->>$4)::numeric,0)+1)::numeric),true),ARRAY[\'UserPoint\']::text[],to_jsonb((COALESCE((u."legacyUserData"->>\'UserPoint\')::numeric,0)+$5::numeric)),true) ELSE jsonb_set(COALESCE(u."legacyUserData",\'{}\'::jsonb),ARRAY[$4]::text[],to_jsonb((COALESCE((u."legacyUserData"->>$4)::numeric,0)+1)::numeric),true) END,"updatedAt"=NOW() WHERE u."objectId"=$1 AND EXISTS(SELECT 1 FROM period_deleted) RETURNING 1) SELECT (SELECT COUNT(*)::int FROM updated) AS restored'; await Psql.query(sql, [studentId,periodKey,pointKey,config.field,config.point]);
}
async function memoryReviewsForOrder(orderId, order, current) {
  const rows = await Psql.query('SELECT d.*,c."generalId" AS "recordGeneralId" FROM "DailyStudyRecord" d JOIN "CommonModel" c ON c."company"=$1 AND CAST(c."modelId" AS text)=\'56\' AND CAST(c."itemId" AS text)=CAST(d."id" AS text) WHERE d."company"=$1 AND CAST(d."userId" AS text)=$2 AND CAST(d."dsid" AS text)=$3 ORDER BY d."updatedAt" DESC LIMIT 1', [DEFAULT_COMPANY_ID,String(number(order.szyh)),String(orderId)]); const study = rows[0]; if (!study) return { created:[], count:0 }; const dates = [...new Set(String(study.fxrl || '').split(',').filter((date) => /^\d{8}$/.test(date)))].slice(0, 15); const created = [];
  try { for (const date of dates) { const key = 'cloud:e_order_update:' + orderId + ':review:' + date; const existingRecordRows = await Psql.query('SELECT "objectId","id" FROM "MemoryPracticeRecord" WHERE "company"=$1 AND "sourceKey"=$2 LIMIT 1', [DEFAULT_COMPANY_ID,key]); let record = existingRecordRows[0] ? await new Parse.Query('MemoryPracticeRecord').get(existingRecordRows[0].objectId,{useMasterKey:true}) : null; const existingCommonRows = await Psql.query('SELECT "objectId" FROM "CommonModel" WHERE "company"=$1 AND "sourceKey"=$2 LIMIT 1', [DEFAULT_COMPANY_ID,key]); if (record && existingCommonRows[0]) continue; const recordId = record ? number(record.get('id')) : Math.floor(100000000000000 + Math.random() * 800000000000000); if (!record) { record = new Parse.Object('MemoryPracticeRecord'); record.set('company',current.get('company')); record.set('sourceKey',key); record.set('yhid',number(order.szyh)); record.set('plid',number(order.fxpl || order.pl)); record.set('orderId',number(orderId)); record.set('xxjlid',number(study.recordGeneralId)); record.set('kcid',number(order.kcid)); const iso = date.slice(0,4)+'-'+date.slice(4,6)+'-'+date.slice(6,8); record.set('kywrq',iso); record.set('kywsj',iso+' '+cleanText(order.sdsd,20)); await record.save(null,{useMasterKey:true}); await Psql.none('UPDATE "MemoryPracticeRecord" SET "id"=$1 WHERE "objectId"=$2',[recordId,record.id]); created.push({ record, common:null }); } if (!existingCommonRows[0]) { const common = new Parse.Object('CommonModel'); common.set('company',current.get('company')); common.set('sourceKey',key); common.set('generalId',recordId+1); common.set('itemId',recordId); common.set('modelId',60); common.set('nodeId',388); common.set('tableName','ZL_C_gywjl'); common.set('title',cleanText(order.HoneyName || order.Title,120)+'@21天抗遗忘@'+date.slice(0,4)+'-'+date.slice(4,6)+'-'+date.slice(6,8)); common.set('inputer',cleanText(current.get('nickname') || current.get('username'),100)); common.set('hits',0); common.set('status',99); await common.save(null,{useMasterKey:true}); const tracked = created.find((item) => item.record.id === record.id); if (tracked) tracked.common = common; else created.push({ record:null, common }); } } return { created, count:dates.length }; } catch (error) { for (const pair of created.reverse()) { if (pair.common) await pair.common.destroy({useMasterKey:true}).catch(() => undefined); if (pair.record) await pair.record.destroy({useMasterKey:true}).catch(() => undefined); } throw error; }
}
async function appointmentObject(orderId) { const rows = await Psql.query('SELECT a."objectId" FROM "CommonModel" c JOIN "CourseAppointment" a ON a."company"=$1 AND CAST(a."id" AS text)=CAST(c."itemId" AS text) WHERE c."company"=$1 AND CAST(c."modelId" AS text)=\'54\' AND CAST(c."generalId" AS text)=$2 LIMIT 1',[DEFAULT_COMPANY_ID,String(orderId)]); if (rows[0]) return new Parse.Query('CourseAppointment').get(rows[0].objectId,{useMasterKey:true}); if (/^[A-Za-z0-9_-]{10,40}$/.test(String(orderId))) return new Parse.Query('CourseAppointment').get(String(orderId),{useMasterKey:true}); return null; }
async function updateOrderStatus(input, current) {
  const content = parseObject(input.content,'预约更新内容'); const orderId = String(content.GeneralID ?? content.generalId ?? input.orderId ?? input.id ?? '').trim(); if (!orderId) fail(400,'缺少预约 ID'); const status = number(input.status,-1); if (![10,11,20,30].includes(status)) fail(400,'不支持的预约状态'); const order = await orderDetailRow(orderId,current,false); if (!order) fail(404,'预约记录不存在'); const actorId = ownLegacyId(current); const studentId = number(order.szyh); const coachId = number(order.pl); const requiredActor = status === 20 ? studentId : coachId; if (!isAdminUser(current) && actorId !== requiredActor) fail(403,status === 20 ? '仅预约学员可以确认评价' : '仅预约陪练可以更新课程状态'); const previous = number(order.dszt); const allowed = ({10:[0,10],11:[10,11],20:[11,20],30:[11,20,30]})[status]; if (!allowed.includes(previous)) fail(409,'预约状态不能从 '+previous+' 更新为 '+status); if (previous === status) return { GeneralID:orderId,previousStatus:previous,status,unchanged:true };
  const appointment = await appointmentObject(orderId); if (!appointment) fail(404,'预约附表不存在'); let reviews = {created:[],count:0}; let period = null; let student = null; try { if (status === 11) { reviews = await memoryReviewsForOrder(orderId,order,current); const fields = await fieldsOf('_User'); student = await findByLegacyId('_User',fields,studentId,['legacyUserId','userid','num']); if (!student) fail(404,'预约学员不存在'); period = await deductOrderPeriod(student,studentId,number(order.dslx),orderId,new Date().toISOString().slice(0,16).replace('T',' ')+'学习结束，订单：'+orderId); }
    appointment.set('dszt',String(status)); const now = cleanText(content.UpDateTime ?? content.updateTime,30) || new Date().toISOString().slice(0,16).replace('T',' '); if (status === 10) appointment.set('kssj',now); if (status === 11) appointment.set('jssj',now); await appointment.save(null,{useMasterKey:true}); return { GeneralID:orderId,previousStatus:previous,status,unchanged:false,reviewCount:reviews.count,periodDeducted:Boolean(period && period.claimed) }; }
  catch (error) { if (period && period.claimed && student) await rollbackOrderPeriod(student.id,period.config,period.periodKey,period.pointKey).catch(() => undefined); for (const pair of reviews.created.reverse()) { if (pair.common) await pair.common.destroy({useMasterKey:true}).catch(() => undefined); if (pair.record) await pair.record.destroy({useMasterKey:true}).catch(() => undefined); } throw error; }
}
async function orderStatistics(input, current) {
  const uid = await authorizeRequestedUser(current, input.uid); let target = current; if (uid !== ownLegacyId(current)) { const fields = await fieldsOf('_User'); target = await findByLegacyId('_User', fields, uid, ['legacyUserId','userid','num']); } if (!target) fail(404, '用户不存在'); const groupId = number(target.get('legacyGroupId') || target.get('groupId')); let t30 = 0; let t60 = 0; let tTiyan = 0; let total = 0; let commission = 0; let duration = 0;
  if (groupId === 3) { const row = await Psql.one('SELECT COUNT(*) FILTER (WHERE CAST("kclx" AS text) = \'1\')::int AS t30, COUNT(*) FILTER (WHERE CAST("kclx" AS text) = \'2\')::int AS t60, COUNT(*) FILTER (WHERE CAST("kclx" AS text) = \'3\')::int AS tiyan, COUNT(*)::int AS total FROM "LessonRecord" WHERE "company" = $1 AND CAST("jsmz" AS text) = $2', [DEFAULT_COMPANY_ID, String(uid)]); t30 = number(row.t30); t60 = number(row.t60); tTiyan = number(row.tiyan); total = number(row.total); commission = t30 * 20 + t60 * 40 + tTiyan * 40; duration = t30 * 0.5 + t60 + tTiyan; }
  else if (groupId === 1) { const row = await Psql.one('SELECT COUNT(*) FILTER (WHERE CAST("dslx" AS text) = \'1\')::int AS t30, COUNT(*) FILTER (WHERE CAST("dslx" AS text) = \'2\')::int AS t60, COUNT(*) FILTER (WHERE CAST("dslx" AS text) = \'3\')::int AS tiyan FROM "CourseAppointment" WHERE "company" = $1 AND CAST("szyh" AS text) = $2 AND CAST("dszt" AS text) ~ \'^[0-9]+$\' AND CAST("dszt" AS numeric) > 10', [DEFAULT_COMPANY_ID, String(uid)]); const practice = await Psql.one('SELECT COUNT(*)::int AS total FROM "PracticeRecord" WHERE "company" = $1 AND CAST("yhid" AS text) = $2', [DEFAULT_COMPANY_ID, String(uid)]); t30 = number(row.t30); t60 = number(row.t60); tTiyan = number(row.tiyan); total = number(practice.total); duration = t30 * 0.5 + t60 + tTiyan; }
  return { t30:String(t30), t60:String(t60), t_tiyan:String(tTiyan), t_shichang:String(duration), t_total:String(total), t_yongji:String(commission) };
}
function learnedDate(row) { const raw = String(row.dqrq || '').trim(); return /^\d{8}$/.test(raw) ? raw.slice(0,4) + '-' + raw.slice(4,6) + '-' + raw.slice(6,8) : String(row.kywsj || '').slice(0,10); }
async function memoryPage(input, current) {
  const uid = await authorizeRequestedUser(current, input.uid); const paging = largePageInput(input); const income = number(input.shouru) === 1; const values = [DEFAULT_COMPANY_ID, String(uid)]; const clauses = ['c."company" = $1', 'CAST(c."modelId" AS text) = \'60\'', 'CAST(m."' + (income ? 'plid' : 'yhid') + '" AS text) = $2']; if (input.status !== undefined && input.status !== '') { values.push(String(number(input.status))); clauses.push('CAST(m."fxzt" AS text) = $' + values.length); } const where = clauses.join(' AND '); const countRow = await Psql.one('SELECT COUNT(*)::int AS total FROM "CommonModel" c JOIN "MemoryPracticeRecord" m ON m."company" = $1 AND CAST(m."id" AS text) = CAST(c."itemId" AS text) WHERE ' + where, values); const rowValues = values.concat([paging.size, (paging.index - 1) * paging.size]);
  const rows = await Psql.query('SELECT c.*, row_to_json(m) AS "__addon", d."learned", d."dqrq", n."nodeName" AS "kc_title" FROM "CommonModel" c JOIN "MemoryPracticeRecord" m ON m."company" = $1 AND CAST(m."id" AS text) = CAST(c."itemId" AS text) LEFT JOIN "CommonModel" dc ON dc."company" = $1 AND CAST(dc."modelId" AS text) = \'56\' AND CAST(dc."generalId" AS text) = CAST(m."xxjlid" AS text) LEFT JOIN "DailyStudyRecord" d ON d."company" = $1 AND CAST(d."id" AS text) = CAST(dc."itemId" AS text) LEFT JOIN "Node" n ON n."company" = $1 AND CAST(n."nodeId" AS text) = CAST(m."kcid" AS text) WHERE ' + where + ' ORDER BY m."kywsj" DESC, c."updatedAt" DESC LIMIT $' + (values.length + 1) + ' OFFSET $' + (values.length + 2), rowValues); const result = rows.map((source) => { const addon = source.__addon || {}; delete source.__addon; const row = legacyAliases({ ...source, ...addon }, 'CommonModel'); row.learned_date = learnedDate(row); if (income) { row.money = 0; row.incomeRuleUnavailable = true; } return row; }); const total = number(countRow.total); return { rows: result, page: { itemCount: total, pageCount: Math.ceil(total / paging.size), pageIndex: paging.index, pageSize: paging.size } };
}
async function resolveContent(input, requireOne = false) { const fields = await fieldsOf('CommonModel'); const id = String(input.id || input.gid || input.generalId || ''); if (!id) { const query = new Parse.Query('CommonModel'); tenant(query, fields); if (requireOne) fail(400, '缺少内容 ID'); return { query, fields }; } if (!/^\d+$/.test(id) && /^[A-Za-z0-9_-]{10,40}$/.test(id)) { const byObjectId = new Parse.Query('CommonModel'); tenant(byObjectId, fields); try { return { object: await byObjectId.get(id, { useMasterKey: true }), fields }; } catch (_) {} } const rows = await Psql.query('SELECT "objectId" FROM "CommonModel" WHERE "company" = $1 AND CAST("generalId" AS text) = $2 LIMIT 1', [DEFAULT_COMPANY_ID, id]); if (!rows[0]) return { object:null, fields }; return { object:await new Parse.Query('CommonModel').get(rows[0].objectId, { useMasterKey: true }), fields }; }
async function handler(request, response) {
  try {
    const input = inputOf(request); const action = String(input.action || ''); if (!action) return response.status(400).json(reject('缺少 action'));
    if (action === 'migration_status') return response.json(envelope({ implemented: ['app_update','user_login_passwd','user_register','user_info_name','user_get','user_list','user_dept','e_user_list','user_update','content_list','content_list_llk','content_get','content_uphis','content_add','content_add_zt','content_update','node_list','node_get','e_add_words','e_ck_list','e_get_21list','e_order_detail','e_order_tongji','e_order_update_v2','e_record_detail','e_words_list','stu_record_update_v2','user_point_list','guestbook_add'], blocked: BLOCKED }));
    if (BLOCKED[action]) return response.status(501).json(reject('migration_blocked: ' + BLOCKED[action]));
    if (action === 'user_login_passwd') {
      const username = String(input.name || input.username || '').trim(); const password = String(input.passwd || input.password || ''); if (!username || !password) return response.status(400).json(reject('请输入账号和密码'));
      try { const loggedIn = await Parse.User.logIn(username, password); if (loggedIn.get('isDisabled') === true || loggedIn.get('isDeleted') === true) { await revokeUserSessions(loggedIn).catch(() => undefined); return response.status(403).json(reject('账号已停用')); } if (loggedIn.get('passwordResetRequired') === true) return response.status(403).json(reject('旧系统账号必须先重置 Parse 密码')); return response.json(envelope(legacyUser(loggedIn, true), { State: 1 })); } catch (_) { return response.status(401).json(reject('账号或密码错误')); }
    }
    if (action === 'user_register') { const registered = await registerUser(input); return response.json(envelope(registered.result,registered.addon)); }
    if (action === 'user_info_name') { const username = String(input.uname || input.name || '').trim(); if (!username) return response.status(400).json(reject('缺少用户名')); const rows = await Psql.query('SELECT "objectId" FROM "_User" WHERE "company" = $1 AND "username" = $2 LIMIT 1', [DEFAULT_COMPANY_ID, username]); const found = rows[0]; return found ? response.json(envelope({ objectId: found.objectId })) : response.status(404).json(reject('用户不存在')); }
    const privateNodeProgress = action === 'node_list' && number(input.ifunit) === 1; const publicRead = PUBLIC_READ.has(action) && !contentQueryRequiresAuth(action, input) && !privateNodeProgress; const current = await currentUser(request, !publicRead); if (contentQueryRequiresAuth(action, input) && current) await authorizeContentAccess(current, input);
    if (action === 'user_get') { const requestedId = number(input.uid || ownLegacyId(current)); let target = current; if (requestedId && requestedId !== ownLegacyId(current)) { await authorizeTeamUser(current,requestedId); target = await legacyUserObject(requestedId); if (!target) return response.status(404).json(reject('用户不存在')); } return response.json(envelope(legacyUser(target),legacyUserAddon(target))); }
    if (action === 'user_list') { const result = await teamUserPage(input,current); return response.json(envelope(result.rows,undefined,result.page)); }
    if (action === 'user_dept') return response.json(envelope(await teamStats(input,current)));
    if (action === 'e_user_list') { const result = await coachStudentPage(input,current); return response.json(envelope(result.rows,undefined,result.page)); }
    if (action === 'user_update') { const updated = await updateUserProfile(input,current); return response.json(envelope(updated.result,updated.addon)); }
    if (action === 'app_update') { const result = await sqlPage('App', { page: 1, pageSize: 1 }); return response.json(envelope(legacyAppRow(result.rows[0]))); }
    if (action === 'content_list' || action === 'content_list_llk') { const result = await contentPage(input, !current); return response.json(envelope(result.rows, undefined, result.page)); }
    if (action === 'content_get') { const id = String(input.id || input.gid || input.generalId || ''); if (!id) return response.status(400).json(reject('缺少内容 ID')); const identity = /^\d+$/.test(id) ? { generalId: id } : { objectId: id }; const base = await contentPage({ page: 1, pageSize: 1, ...identity }); let detail = base.rows[0]; if (!detail) return response.status(404).json(reject('内容不存在')); const detailModel = number(detail.modelId || detail.ModelID); if (CONTENT_ADDONS[detailModel]) detail = (await contentPage({ page: 1, pageSize: 1, modelId: detailModel, ...identity })).rows[0] || detail; if (PRIVATE_CONTENT_MODELS.has(detailModel)) { if (!current) return response.status(401).json(reject('该内容详情需要登录')); await authorizeContentDetail(current, detail); } return response.json(envelope([detail])); }
    if (action === 'content_uphis') { const id = String(input.id || input.gid || input.generalId || ''); if (!id) return response.status(400).json(reject('缺少内容 ID')); const identity = /^\d+$/.test(id) ? { generalId:id } : { objectId:id }; const base = await contentPage({ page:1,pageSize:1,...identity }); const detail = base.rows[0]; if (!detail) return response.status(404).json(reject('内容不存在')); const detailModel = number(detail.modelId || detail.ModelID); if (PRIVATE_CONTENT_MODELS.has(detailModel)) { if (!current) return response.status(401).json(reject('该内容详情需要登录')); await authorizeContentDetail(current,detail); } const updated = await Psql.one('UPDATE "CommonModel" SET "hits"=COALESCE("hits",0)+1,"updatedAt"=CURRENT_TIMESTAMP WHERE "company"=$1 AND CAST("objectId" AS text)=$2 RETURNING "hits"',[DEFAULT_COMPANY_ID,String(detail.objectId)]); return response.json(envelope({ hits:number(updated.hits) })); }
    if (action === 'content_add') return response.json(envelope(await createContentPair(input, current)));
    if (action === 'content_update') return response.json(envelope(await updateContentPair(input, current)));
    if (action === 'node_list') { const result = privateNodeProgress ? await nodeUnitPage(input,current) : await nodePage(input); return response.json(envelope(result.rows, undefined, result.page)); }
    if (action === 'node_get') { const result = await sqlPage('Node', { page: 1, pageSize: 1 }, [{ field: 'nodeId', value: number(input.id || input.nid) }]); return result.rows[0] ? response.json(envelope(result.rows[0])) : response.status(404).json(reject('栏目不存在')); }
    const legacyId = ownLegacyId(current);
    if (action === 'content_add_zt') return response.json(envelope(await createStudyContent(input, current)));
    if (action === 'e_order_update_v2') return response.json(envelope(await updateOrderStatus(input,current)));
    if (action === 'e_order_tongji') return response.json(envelope(await orderStatistics(input, current)));
    if (action === 'stu_record_update_v2') return response.json(envelope(await upsertStudyRecord(input, current)));
    if (action === 'e_add_words') return response.json(envelope(await updateLearningWords(input, current)));
    if (action === 'e_ck_list') { const result = await courseWordPage(input, current); return response.json(envelope(result.rows, undefined, result.page)); }
    if (action === 'e_get_21list') { const result = await memoryPage(input, current); return response.json(envelope(result.rows, undefined, result.page)); }
    if (action === 'e_words_list') { const result = await newWordPage(input, current); return response.json(envelope(result.rows, undefined, result.page)); }
    if (action === 'e_order_detail') { const found = await orderDetailRow(input.id, current); return found ? response.json(envelope([found])) : response.status(404).json(reject('预约记录不存在')); }
    if (action === 'e_record_detail') { const found = await recordDetailData(input, current); return found ? response.json(envelope(found.words, found.addon)) : response.status(404).json(reject('学习记录不存在')); }
    if (action === 'user_point_list') { const result = await pointHistoryPage(input,current); return response.json(envelope(result.rows,result.addon,result.page)); }
    if (action === 'guestbook_add') return response.json(envelope(await createGuestbook(input,current)));
    return response.status(501).json(reject('migration_blocked: 尚未完成动作映射 ' + action));
  } catch (error) { const status = Number(error.status || (error.code === 101 ? 404 : 500)); const message = status === 501 ? 'migration_blocked: ' + error.message : status >= 500 ? '云函数执行失败' : error.message; return response.status(status).json(reject(message)); }
}
`;

const definitions = [
  { name: 'xiaoshu.admin.gateway', desc: '小树陪练 Angular 管理后台统一数据网关（权限、帐套、CRUD、统计）', path: 'xiaoshu/admin/gateway', code: adminGatewayCode, params: [{ name: 'operation', type: 'String', required: true }] },
  { name: 'cms.content-normalizer', desc: '替代 ZL_StripeHtmlTag/ZL_StripeTrimstr，保守输出纯文本', path: 'xiaoshu/cms/content-normalizer', code: cmsReadCode('content-normalizer'), params: [{ name: 'content', type: 'String', required: false }] },
  { name: 'cms.users.extended', desc: '替代 ZL_EX_UserView，返回安全用户扩展资料', path: 'xiaoshu/cms/users/extended', code: cmsReadCode('user-extended'), params: [{ name: 'userId', type: 'String', required: true }] },
  { name: 'cms.users.platform', desc: '替代 ZL_User_PlatView', path: 'xiaoshu/cms/users/platform', code: cmsReadCode('user-platform'), params: [{ name: 'userId', type: 'String', required: true }] },
  { name: 'cms.users.wechat', desc: '替代 ZL_User_WXView，过滤令牌与密钥', path: 'xiaoshu/cms/users/wechat', code: cmsReadCode('user-wechat'), params: [{ name: 'userId', type: 'String', required: true }] },
  { name: 'cms.exams.classes', desc: '替代 ZL_Exam_ClassView', path: 'xiaoshu/cms/exams/classes', code: cmsReadCode('exam-classes'), params: [{ name: 'page', type: 'Number', required: false, default: 1 }] },
  { name: 'cms.guest.bar', desc: '替代 ZL_Guest_BarView', path: 'xiaoshu/cms/guest/bar', code: cmsReadCode('guest-bar'), params: [{ name: 'page', type: 'Number', required: false, default: 1 }] },
  { name: 'cms.search', desc: '替代 ZL_SearchView，搜索规范化 CommonModel', path: 'xiaoshu/cms/search', code: cmsReadCode('search'), params: [{ name: 'keyword', type: 'String', required: true }] },
  { name: 'xiaoshu.app.gateway', desc: '旧 WXAPP action 到 Parse 规范化类的兼容云函数；无法证明等价的动作返回 migration_blocked', path: 'xiaoshu/app/gateway', code: appGatewayCode, params: [{ name: 'action', type: 'String', required: true }] },
];

function validateDefinition(definition) {
  if (definition.path.startsWith('/')) throw new Error(`${definition.name}: 当前执行器的全局 path 不接受前导 /`);
  const factory = new Function(`${definition.code}\nreturn typeof handler;`);
  if (factory() !== 'function') throw new Error(`${definition.name}: 未定义 handler`);
}

async function parseRequest(path, init = {}) {
  const response = await fetch(`${PARSE_URL}${path}`, {
    ...init,
    headers: {
      'X-Parse-Application-Id': APP_ID,
      'X-Parse-Master-Key': MASTER_KEY,
      'Content-Type': 'application/json',
      ...(init.headers || {}),
    },
  });
  const payload = await response.json();
  if (!response.ok || payload.error) throw new Error(payload.error || `Parse 请求失败：${response.status}`);
  return payload;
}

async function upsert(definition) {
  const where = encodeURIComponent(JSON.stringify({ name: definition.name }));
  const existing = await parseRequest(`/classes/Function?where=${where}&limit=1&keys=objectId`);
  const body = {
    name: definition.name,
    desc: definition.desc,
    type: 'standalone',
    path: definition.path,
    code: definition.code.trim(),
    params: definition.params,
    paramList: definition.params,
    respType: 'json',
    respJson: { success: true, data: {} },
    enabled: true,
    version: '1.1.2',
  };
  const objectId = existing.results?.[0]?.objectId;
  if (objectId) {
    await parseRequest(`/classes/Function/${objectId}`, { method: 'PUT', body: JSON.stringify(body) });
    return { action: 'updated', objectId };
  }
  const created = await parseRequest('/classes/Function', { method: 'POST', body: JSON.stringify(body) });
  return { action: 'created', objectId: created.objectId };
}

for (const definition of definitions) validateDefinition(definition);

if (validateOnly) {
  console.log(`Validated ${definitions.length} cloud function definitions.`);
} else {
  if (!MASTER_KEY) throw new Error('缺少 XIAOSHU_MASTER_KEY；不会把 masterKey 写入项目文件。');
  for (const definition of definitions) {
    const result = await upsert(definition);
    console.log(`${result.action.padEnd(7)} ${definition.path} (${result.objectId})`);
  }
}