优化访问接口报错Server internal error

server/.env.example

@@ -18,13 +18,13 @@ REDIS_DB = 0
 
 # API 鉴权与用户（可选，不填则用默认值）
 # authToken 签名密钥（必填，与客户端约定，用于 signature 校验）
- API_AUTH_TOKEN_SECRET = xF75oK91TQj13s0UmNIr1NBWMWGfflNO
+API_AUTH_TOKEN_SECRET = xF75oK91TQj13s0UmNIr1NBWMWGfflNO
 # authToken 时间戳允许误差秒数，防重放，默认 300
- API_AUTH_TOKEN_TIME_TOLERANCE = 300
- API_AUTH_TOKEN_EXP = 86400
+API_AUTH_TOKEN_TIME_TOLERANCE = 300
+API_AUTH_TOKEN_EXP = 86400
 # API_USER_TOKEN_EXP = 604800
- API_USER_CACHE_EXPIRE = 86400
- API_USER_ENCRYPT_KEY = Wj818SK8dhKBKNOY3PUTmZfhQDMCXEZi
+API_USER_CACHE_EXPIRE = 86400
+API_USER_ENCRYPT_KEY = Wj818SK8dhKBKNOY3PUTmZfhQDMCXEZi
 
 # 验证码配置,支持cache|session
 CAPTCHA_MODE = cache

server/app/api/cache/AuthTokenCache.php

@@ -1,54 +0,0 @@
-<?php
-declare(strict_types=1);
-
-namespace app\api\cache;
-
-use support\think\Cache;
-
-/**
- * 按设备标识存储当前有效的 auth-token，同一设备只保留最新一个，旧 token 自动失效
- */
-class AuthTokenCache
-{
-    private static function prefix(): string
-    {
-        return config('api.auth_token_device_prefix', 'api:auth_token:');
-    }
-
-    /**
-     * 设置该设备当前有效的 auth-token（会覆盖同设备之前的 token，使旧 token 失效）
-     * @param string $device 设备标识，如 dice
-     * @param string $token 完整 auth-token 字符串
-     * @param int $ttl 过期时间（秒），应与 auth_token_exp 一致
-     */
-    public static function setDeviceToken(string $device, string $token, int $ttl): bool
-    {
-        if ($device === '' || $ttl <= 0) {
-            return false;
-        }
-        $key = self::prefix() . $device;
-        return Cache::set($key, $token, $ttl);
-    }
-
-    /**
-     * 获取该设备当前有效的 auth-token，不存在或已过期返回 null
-     */
-    public static function getDeviceToken(string $device): ?string
-    {
-        if ($device === '') {
-            return null;
-        }
-        $key = self::prefix() . $device;
-        $value = Cache::get($key);
-        return $value !== null && $value !== '' ? (string) $value : null;
-    }
-
-    /**
-     * 校验请求中的 token 是否为该设备当前唯一有效 token
-     */
-    public static function isCurrentToken(string $device, string $token): bool
-    {
-        $current = self::getDeviceToken($device);
-        return $current !== null && $current === $token;
-    }
-}

server/app/api/cache/UserCache.php

@@ -178,4 +178,108 @@ class UserCache
         $current = self::getCurrentUserToken($userId);
         return $current !== null && $current === $token;
     }
+
+    /** 按 username 的登录会话 key 前缀（token 中间件：存在即视为已登录） */
+    private static function sessionUsernamePrefix(): string
+    {
+        return config('api.session_username_prefix', 'api:user:session:');
+    }
+
+    private static function sessionExpire(): int
+    {
+        return (int) config('api.session_expire', 604800);
+    }
+
+    /** 设置 username 当前有效 token（JWT），重新登录会覆盖，实现单点登录 */
+    public static function setSessionByUsername(string $username, string $token): bool
+    {
+        if ($username === '' || $token === '') {
+            return false;
+        }
+        $key = self::sessionUsernamePrefix() . $username;
+        return Cache::set($key, $token, self::sessionExpire());
+    }
+
+    /** 获取 username 当前在服务端登记的有效 token（JWT），不存在返回 null */
+    public static function getSessionTokenByUsername(string $username): ?string
+    {
+        if ($username === '') {
+            return null;
+        }
+        $key = self::sessionUsernamePrefix() . $username;
+        $val = Cache::get($key);
+        return $val !== null && $val !== '' ? (string) $val : null;
+    }
+
+    /** 检查 username 是否已有登录会话（Redis 中是否存在当前 token） */
+    public static function hasSessionByUsername(string $username): bool
+    {
+        return self::getSessionTokenByUsername($username) !== null;
+    }
+
+    /** 删除 username 登录会话（退出登录时调用） */
+    public static function deleteSessionByUsername(string $username): bool
+    {
+        if ($username === '') {
+            return false;
+        }
+        $key = self::sessionUsernamePrefix() . $username;
+        return Cache::delete($key);
+    }
+
+    /** 玩家缓存 key 前缀（Token 中间件用，减少重复查库） */
+    private static function playerCachePrefix(): string
+    {
+        return config('api.player_cache_prefix', 'api:player:');
+    }
+
+    private static function playerCacheTtl(): int
+    {
+        return (int) config('api.player_cache_ttl', 300);
+    }
+
+    /**
+     * 按 username 缓存玩家信息（仅 id + username，供中间件注入 request->player 后使用）
+     * 登录/信息变更时需调用 deletePlayerByUsername 失效
+     */
+    public static function setPlayerByUsername(string $username, array $playerRow): bool
+    {
+        if ($username === '' || empty($playerRow)) {
+            return false;
+        }
+        $ttl = self::playerCacheTtl();
+        if ($ttl <= 0) {
+            return true;
+        }
+        $key = self::playerCachePrefix() . $username;
+        return Cache::set($key, json_encode($playerRow), $ttl);
+    }
+
+    /** 按 username 取缓存玩家，未命中返回 null */
+    public static function getPlayerByUsername(string $username): ?array
+    {
+        if ($username === '') {
+            return null;
+        }
+        if (self::playerCacheTtl() <= 0) {
+            return null;
+        }
+        $key = self::playerCachePrefix() . $username;
+        $val = Cache::get($key);
+        if ($val === null || $val === '') {
+            return null;
+        }
+        $data = json_decode((string) $val, true);
+        return is_array($data) ? $data : null;
+    }
+
+    /** 退出登录或玩家信息变更时删除玩家缓存 */
+    public static function deletePlayerByUsername(string $username): bool
+    {
+        if ($username === '') {
+            return false;
+        }
+        $key = self::playerCachePrefix() . $username;
+        return Cache::delete($key);
+    }
 }

server/app/api/controller/AuthTokenController.php

@@ -1,90 +0,0 @@
-<?php
-declare(strict_types=1);
-
-namespace app\api\controller;
-
-use support\Request;
-use support\Response;
-use Tinywan\Jwt\JwtToken;
-use plugin\saiadmin\basic\OpenController;
-use app\api\util\ReturnCode;
-use app\api\cache\AuthTokenCache;
-
-/**
- * API 鉴权 Token 接口
- * 仅支持 GET，必传参数：signature、secret、device、time，签名规则：signature = md5(device . secret . time)
- * 后续所有 /api 接口调用均需在请求头携带此接口返回的 auth-token
- */
-class AuthTokenController extends OpenController
-{
-    /**
-     * 获取 auth-token
-     * GET /api/authToken
-     * 参数：signature（签名）、secret（密钥）、device（设备标识）、time（时间戳，秒），四者均为必传且非空
-     */
-    public function index(Request $request): Response
-    {
-        if (strtoupper($request->method()) !== 'GET') {
-            return $this->fail('仅支持 GET 请求', ReturnCode::PARAMS_ERROR);
-        }
-
-        $param = $request->get();
-        $signature = trim((string) ($param['signature'] ?? ''));
-        $secret = trim((string) ($param['secret'] ?? ''));
-        $device = trim((string) ($param['device'] ?? ''));
-        $time = trim((string) ($param['time'] ?? ''));
-
-        if ($signature === '' || $secret === '' || $device === '' || $time === '') {
-            return $this->fail('signature、secret、device、time 均为必传且不能为空', ReturnCode::PARAMS_ERROR);
-        }
-
-        $serverSecret = trim((string) config('api.auth_token_secret', ''));
-        if ($serverSecret === '') {
-            return $this->fail('服务未配置 API_AUTH_TOKEN_SECRET', ReturnCode::PARAMS_ERROR);
-        }
-        if ($secret !== $serverSecret) {
-            return $this->fail('密钥错误', ReturnCode::FORBIDDEN);
-        }
-
-        $tolerance = (int) config('api.auth_token_time_tolerance', 300);
-        $now = time();
-        $ts = is_numeric($time) ? (int) $time : 0;
-        if ($ts <= 0 || abs($now - $ts) > $tolerance) {
-            return $this->fail('时间戳无效或已过期', ReturnCode::PARAMS_ERROR);
-        }
-
-        $sign = $this->getAuthToken($device, $serverSecret, $time);
-        if ($sign !== $signature) {
-            return $this->fail('签名验证失败', ReturnCode::FORBIDDEN);
-        }
-
-        $exp = (int) config('api.auth_token_exp', 86400);
-        $tokenResult = JwtToken::generateToken([
-            'id' => 0,
-            'plat' => 'api',
-            'device' => $device,
-            'access_exp' => $exp,
-        ]);
-
-        // 同一设备只保留最新 token，覆盖后旧 token 失效
-        AuthTokenCache::setDeviceToken($device, $tokenResult['access_token'], $exp);
-
-        return $this->success([
-            'auth-token' => $tokenResult['access_token'],
-            'expires_in' => $tokenResult['expires_in'],
-        ]);
-    }
-
-    /**
-     * 生成签名：signature = md5(device . secret . time)
-     *
-     * @param string $device 设备标识
-     * @param string $secret 密钥（来自配置）
-     * @param string $time 时间戳
-     * @return string
-     */
-    private function getAuthToken(string $device, string $secret, string $time): string
-    {
-        return md5($device . $secret . $time);
-    }
-}

server/app/api/controller/GameController.php

@@ -3,11 +3,11 @@ declare(strict_types=1);
 
 namespace app\api\controller;
 
+use support\Log;
 use support\Request;
 use support\Response;
 use app\api\logic\GameLogic;
 use app\api\logic\PlayStartLogic;
-use app\api\logic\UserLogic;
 use app\api\util\ReturnCode;
 use app\dice\model\play_record\DicePlayRecord;
 use app\dice\model\player\DicePlayer;
@@ -23,12 +23,12 @@ class GameController extends OpenController
     /**
      * 购买抽奖券
      * POST /api/game/buyLotteryTickets
-     * header: auth-token, user-token（由 CheckUserTokenMiddleware 注入 request->user_id）
+     * header: token（由 TokenMiddleware 注入 request->player_id）
      * body: count = 1 | 5 | 10（1次/100coin, 5次/500coin, 10次/1000coin）
      */
     public function buyLotteryTickets(Request $request): Response
     {
-        $userId = UserLogic::getUserIdFromRequest($request) ?? 0;
+        $userId = (int) ($request->player_id ?? 0);
         $count = (int) $request->post('count', 0);
         if (!in_array($count, [1, 5, 10], true)) {
             return $this->fail('购买抽奖券错误', ReturnCode::PARAMS_ERROR);
@@ -52,7 +52,7 @@ class GameController extends OpenController
     /**
      * 获取彩金池（中奖配置表）
      * GET /api/game/lotteryPool
-     * header: auth-token
+     * header: token
      * 返回 DiceRewardConfig 列表（彩金池/中奖配置）
      */
     public function lotteryPool(Request $request): Response
@@ -64,12 +64,12 @@ class GameController extends OpenController
     /**
      * 开始游戏（抽奖一局）
      * POST /api/game/playStart
-     * header: auth-token, user-token（由 CheckUserTokenMiddleware 注入 request->user_id）
+     * header: token（由 TokenMiddleware 注入 request->player_id）
      * body: rediction 必传，0=无 1=中奖
      */
     public function playStart(Request $request): Response
     {
-        $userId = UserLogic::getUserIdFromRequest($request) ?? 0;
+        $userId = (int) ($request->player_id ?? 0);
         $rediction = $request->post('rediction');
         if ($rediction === '' || $rediction === null) {
             return $this->fail('请传递 rediction 参数', ReturnCode::PARAMS_ERROR);
@@ -111,10 +111,13 @@ class GameController extends OpenController
                     'roll_array'         => '[]',
                     'status'             => PlayStartLogic::RECORD_STATUS_TIMEOUT,
                 ]);
-            } catch (\Throwable $_) {
+            } catch (\Exception $e) {
+                $timeout_message = $e->getMessage();
+                Log::error("游玩记录写入超时: ". $e->getMessage());
             }
+
             $payload = $timeoutRecord ? ['record' => $timeoutRecord->toArray()] : [];
-            return $this->success($payload, '服务超时');
+            return $this->success($payload, '服务超时，'.$timeout_message ?? '没有原因');
         }
     }
 }

server/app/api/controller/UserController.php

@@ -13,77 +13,86 @@ use app\dice\model\player_wallet_record\DicePlayerWalletRecord;
 use plugin\saiadmin\basic\OpenController;
 
 /**
- * API 用户登录/注册
- * 需先携带 auth-token，登录/注册成功后返回 user-token 与用户信息，用户信息已写入 Redis（key=base64(user_id)，value=加密）
+ * API 用户登录等
+ * 登录接口 /api/user/Login 无需 token；其余接口需在请求头携带 token（base64(username.-.time)），由 TokenMiddleware 鉴权并注入 request->player_id / request->player
  */
 class UserController extends OpenController
 {
     /**
-     * 登录
-     * POST /api/user/login
-     * body: phone (+60), password
+     * 登录（JSON body）
+     * POST /api/user/Login
+     * body: { "username": "+60123456789", "password": "123456", "lang": "chs", "coin": 2000.00, "time": 1772692089 }
+     * 根据 username 查找或创建 DicePlayer，按 coin 增减平台币，会话写 Redis，返回带 token 的连接地址
      */
-    public function login(Request $request): Response
+    public function Login(Request $request): Response
     {
-        $phone = $request->post('phone', '');
-        $password = $request->post('password', '');
-        if ($phone === '' || $password === '') {
-            return $this->fail('请填写手机号和密码', ReturnCode::PARAMS_ERROR);
+        $body = $request->rawBody();
+        if ($body === '' || $body === null) {
+            return $this->fail('请提交 JSON  body', ReturnCode::PARAMS_ERROR);
+        }
+        $data = json_decode($body, true);
+        if (!is_array($data)) {
+            return $this->fail('JSON 格式错误', ReturnCode::PARAMS_ERROR);
+        }
+        $username = trim((string) ($data['username'] ?? ''));
+        $password = trim((string) ($data['password'] ?? ''));
+        $lang = trim((string) ($data['lang'] ?? 'chs'));
+        $coin = isset($data['coin']) ? (float) $data['coin'] : 0.0;
+        $time = isset($data['time']) ? (string) $data['time'] : (string) time();
+        if ($username === '' || $password === '') {
+            return $this->fail('username、password 不能为空', ReturnCode::PARAMS_ERROR);
         }
-        $logic = new UserLogic();
-        $data = $logic->login($phone, $password);
-        return $this->success([
-            'user' => $data['user'],
-            'user-token' => $data['user-token'],
-            'user_id' => $data['user_id'],
-        ]);
-    }
 
-    /**
-     * 注册
-     * POST /api/user/register
-     * body: phone (+60), password, nickname(可选)
-     */
-    public function register(Request $request): Response
-    {
-        $phone = $request->post('phone', '');
-        $password = $request->post('password', '');
-        $nickname = $request->post('nickname');
-        if ($phone === '' || $password === '') {
-            return $this->fail('请填写手机号和密码', ReturnCode::PARAMS_ERROR);
+        try {
+            $logic = new UserLogic();
+            $result = $logic->loginByUsername($username, $password, $lang, $coin, $time);
+            return $this->success([
+                'url' => $result['url'],
+                'token' => $result['token'],
+                'lang' => $result['lang'],
+                'user_id' => $result['user_id'],
+                'user' => $result['user'],
+            ]);
+        } catch (\plugin\saiadmin\exception\ApiException $e) {
+            return $this->fail($e->getMessage(), ReturnCode::PARAMS_ERROR);
         }
-        $logic = new UserLogic();
-        $data = $logic->register($phone, $password, $nickname ? (string) $nickname : null);
-        return $this->success([
-            'user' => $data['user'],
-            'user-token' => $data['user-token'],
-            'user_id' => $data['user_id'],
-        ]);
     }
 
     /**
      * 退出登录
      * POST /api/user/logout
-     * header: user-token（由 CheckUserTokenMiddleware 校验并注入 request->userToken）
+     * header: token（JWT），清除该 username 的 Redis 会话
      */
     public function logout(Request $request): Response
     {
-        $token = $request->userToken ?? UserLogic::getTokenFromRequest($request);
-        if ($token === '' || !UserLogic::logout($token)) {
-            return $this->fail('退出失败或 token 已失效', ReturnCode::TOKEN_INVALID);
+        $token = $request->header('token');
+        if ($token === null || $token === '') {
+            $auth = $request->header('authorization');
+            if ($auth && stripos($auth, 'Bearer ') === 0) {
+                $token = trim(substr($auth, 7));
+            }
         }
+        $token = $token !== null ? trim((string) $token) : '';
+        if ($token === '') {
+            return $this->fail('请携带 token', ReturnCode::UNAUTHORIZED);
+        }
+        $username = UserLogic::getUsernameFromJwtPayload($token);
+        if ($username === null || $username === '') {
+            return $this->fail('token 无效', ReturnCode::TOKEN_INVALID);
+        }
+        UserCache::deleteSessionByUsername($username);
+        UserCache::deletePlayerByUsername($username);
         return $this->success('已退出登录');
     }
 
     /**
      * 获取当前用户信息
      * GET /api/user/info
-     * header: user-token（由 CheckUserTokenMiddleware 校验并注入 request->user_id）
-     * 返回：id, username, phone, uid, name, coin, total_ticket_count
+     * header: token（由 TokenMiddleware 校验并注入 request->player_id）
      */
     public function info(Request $request): Response
     {
-        $userId = UserLogic::getUserIdFromRequest($request) ?? 0;
+        $userId = (int) ($request->player_id ?? 0);
         $user = UserLogic::getCachedUser($userId);
         if (empty($user)) {
             return $this->fail('用户不存在', ReturnCode::NOT_FOUND);
@@ -99,13 +108,13 @@ class UserController extends OpenController
     }
 
     /**
-     * 获取钱包余额（优先读缓存，缓存未命中时从库拉取并回写缓存）
+     * 获取钱包余额（优先读缓存）
      * GET /api/user/balance
-     * header: user-token（由 CheckUserTokenMiddleware 校验并注入 request->user_id）
+     * header: token（由 TokenMiddleware 注入 request->player_id）
      */
     public function balance(Request $request): Response
     {
-        $userId = UserLogic::getUserIdFromRequest($request) ?? 0;
+        $userId = (int) ($request->player_id ?? 0);
         $user = UserLogic::getCachedUser($userId);
         if (empty($user)) {
             return $this->fail('用户不存在', ReturnCode::NOT_FOUND);
@@ -124,12 +133,12 @@ class UserController extends OpenController
     /**
      * 玩家钱包流水
      * GET /api/user/walletRecord
-     * header: user-token（由 CheckUserTokenMiddleware 校验并注入 request->user_id）
+     * header: token（由 TokenMiddleware 注入 request->player_id）
      * 参数: page 页码（默认1）, limit 每页条数（默认10）, create_time_min/create_time_max 创建时间范围（可选）
      */
     public function walletRecord(Request $request): Response
     {
-        $userId = UserLogic::getUserIdFromRequest($request) ?? 0;
+        $userId = (int) ($request->player_id ?? 0);
         $page = (int) $request->post('page', 1);
         $limit = (int) $request->post('limit', 10);
         if ($page < 1) {
@@ -166,12 +175,12 @@ class UserController extends OpenController
     /**
      * 游玩记录
      * GET /api/user/playGameRecord
-     * header: user-token（由 CheckUserTokenMiddleware 校验并注入 request->user_id）
+     * header: token（由 TokenMiddleware 注入 request->player_id）
      * 参数: page 页码（默认1）, limit 每页条数（默认10）, create_time_min/create_time_max 创建时间范围（可选）
      */
     public function playGameRecord(Request $request): Response
     {
-        $userId = UserLogic::getUserIdFromRequest($request) ?? 0;
+        $userId = (int) ($request->player_id ?? 0);
         $page = (int) $request->post('page', 1);
         $limit = (int) $request->post('limit', 10);
         if ($page < 1) {

server/app/api/logic/GameLogic.php

@@ -27,7 +27,8 @@ class GameLogic
 
     /**
      * 购买抽奖券
-     * @param int $playerId 玩家ID（即 user_id）
+     * 先更新 Redis 玩家信息（后续游玩从 Redis 读），再用事务更新数据库；事务失败则回滚 Redis
+     * @param int $playerId 玩家ID
      * @param int $count 购买档位：1 / 5 / 10
      * @return array 更新后的 coin, total_ticket_count, paid_ticket_count, free_ticket_count
      */
@@ -55,59 +56,70 @@ class GameLogic
         $totalBefore = (int) ($player->total_ticket_count ?? 0);
         $paidBefore = (int) ($player->paid_ticket_count ?? 0);
         $freeBefore = (int) ($player->free_ticket_count ?? 0);
+        $totalAfter = $totalBefore + $addTotal;
+        $paidAfter = $paidBefore + $addPaid;
+        $freeAfter = $freeBefore + $addFree;
 
-        Db::transaction(function () use (
-            $player,
-            $playerId,
-            $cost,
-            $coinBefore,
-            $coinAfter,
-            $addTotal,
-            $addPaid,
-            $addFree,
-            $totalBefore,
-            $paidBefore,
-            $freeBefore
-        ) {
-            $player->coin = $coinAfter;
-            $player->total_ticket_count = $totalBefore + $addTotal;
-            $player->paid_ticket_count = $paidBefore + $addPaid;
-            $player->free_ticket_count = $freeBefore + $addFree;
-            $player->save();
+        $oldUserArr = $player->hidden(['password'])->toArray();
+        $updatedUserArr = $oldUserArr;
+        $updatedUserArr['coin'] = $coinAfter;
+        $updatedUserArr['total_ticket_count'] = $totalAfter;
+        $updatedUserArr['paid_ticket_count'] = $paidAfter;
+        $updatedUserArr['free_ticket_count'] = $freeAfter;
 
-            // 钱包流水记录
-            DicePlayerWalletRecord::create([
-                'player_id'         => $playerId,
-                'coin'              => -$cost,
-                'type'              => self::WALLET_TYPE_BUY_DRAW,
-                'wallet_before'     => $coinBefore,
-                'wallet_after'      => $coinAfter,
-                'total_ticket_count'  => $addTotal,
-                'paid_ticket_count'   => $addPaid,
-                'free_ticket_count'   => $addFree,
-                'remark'            => "购买抽奖券{$addTotal}次（付费{$addPaid}次+赠送{$addFree}次）",
-            ]);
+        UserCache::setUser($playerId, $updatedUserArr);
 
-            // 抽奖券获取记录
-            DicePlayerTicketRecord::create([
-                'player_id'        => $playerId,
-                'use_coins'        => $cost,
-                'total_ticket_count' => $addTotal,
-                'paid_ticket_count'  => $addPaid,
-                'free_ticket_count'  => $addFree,
-                'remark'           => "购买抽奖券{$addTotal}次（付费{$addPaid}次+赠送{$addFree}次）",
-            ]);
-        });
+        try {
+            Db::transaction(function () use (
+                $player,
+                $playerId,
+                $cost,
+                $coinBefore,
+                $coinAfter,
+                $addTotal,
+                $addPaid,
+                $addFree,
+                $totalAfter,
+                $paidAfter,
+                $freeAfter
+            ) {
+                $player->coin = $coinAfter;
+                $player->total_ticket_count = $totalAfter;
+                $player->paid_ticket_count = $paidAfter;
+                $player->free_ticket_count = $freeAfter;
+                $player->save();
 
-        $updated = DicePlayer::find($playerId);
-        $userArr = $updated->hidden(['password'])->toArray();
-        UserCache::setUser($playerId, $userArr);
+                DicePlayerWalletRecord::create([
+                    'player_id'          => $playerId,
+                    'coin'               => -$cost,
+                    'type'               => self::WALLET_TYPE_BUY_DRAW,
+                    'wallet_before'      => $coinBefore,
+                    'wallet_after'       => $coinAfter,
+                    'total_ticket_count' => $addTotal,
+                    'paid_ticket_count'  => $addPaid,
+                    'free_ticket_count'  => $addFree,
+                    'remark'             => "购买抽奖券{$addTotal}次（付费{$addPaid}次+赠送{$addFree}次）",
+                ]);
+
+                DicePlayerTicketRecord::create([
+                    'player_id'          => $playerId,
+                    'use_coins'          => $cost,
+                    'total_ticket_count' => $addTotal,
+                    'paid_ticket_count'  => $addPaid,
+                    'free_ticket_count'  => $addFree,
+                    'remark'             => "购买抽奖券{$addTotal}次（付费{$addPaid}次+赠送{$addFree}次）",
+                ]);
+            });
+        } catch (\Throwable $e) {
+            UserCache::setUser($playerId, $oldUserArr);
+            throw $e;
+        }
 
         return [
-            'coin'               => (float) $updated->coin,
-            'total_ticket_count'   => (int) $updated->total_ticket_count,
-            'paid_ticket_count'    => (int) $updated->paid_ticket_count,
-            'free_ticket_count'    => (int) $updated->free_ticket_count,
+            'coin'                => (float) $coinAfter,
+            'total_ticket_count'  => (int) $totalAfter,
+            'paid_ticket_count'   => (int) $paidAfter,
+            'free_ticket_count'   => (int) $freeAfter,
         ];
     }
 }

server/app/api/logic/PlayStartLogic.php

@@ -12,6 +12,7 @@ use app\dice\model\player_ticket_record\DicePlayerTicketRecord;
 use app\dice\model\player_wallet_record\DicePlayerWalletRecord;
 use app\dice\model\reward_config\DiceRewardConfig;
 use plugin\saiadmin\exception\ApiException;
+use support\Log;
 use support\think\Cache;
 use support\think\Db;
 
@@ -69,19 +70,49 @@ class PlayStartLogic
             throw new ApiException('奖池配置不存在');
         }
 
+        // 先按奖池权重抽出档位 T1-T5
         $tier = LotteryService::drawTierByWeights($config);
-        $rewards = DiceRewardConfig::where('tier', $tier)->select();
-        if ($rewards->isEmpty()) {
+
+        // 生成 5 个 1-6 的点数，计算总和 roll_number（即本局摇到的点数）
+        $rollArray = $this->generateRollArray();
+        $rollNumber = (int) array_sum($rollArray);
+
+        // 索引范围为 0~25 共 26 个格子
+        $boardSize = 26;
+
+        // 1. 根据抽到的档位，在 tier 相等的数据中任选一条，其 id 为结束索引 target_index
+        $tierRewards = DiceRewardConfig::where('tier', $tier)->select()->toArray();
+        if (empty($tierRewards)) {
+            Log::error("档位 {$tier} 无任何奖励配置");
             throw new ApiException('该档位暂无奖励配置');
         }
-        $rewardList = $rewards->all();
-        $reward = $rewardList[array_rand($rewardList)];
+        $chosen = $tierRewards[array_rand($tierRewards)];
+        $reward = DiceRewardConfig::find($chosen['id']);
+        if (!$reward) {
+            throw new ApiException('奖励配置不存在');
+        }
+        $targetIndex = (int) $reward->id;
+        $targetIndex = (($targetIndex % $boardSize) + $boardSize) % $boardSize;
+
+        // 2. 根据结果反推起始点 start_index（由 target_index 与方向反算）
+        // 顺时针(direction=0): targetIndex = (startIndex + rollNumber) % 26  =>  startIndex = (targetIndex - rollNumber) % 26
+        // 逆时针(direction=1): targetIndex = (startIndex - rollNumber) % 26  =>  startIndex = (targetIndex + rollNumber) % 26
+        if ($direction === 0) {
+            $startIndex = ($targetIndex - $rollNumber) % $boardSize;
+        } else {
+            $startIndex = ($targetIndex + $rollNumber) % $boardSize;
+        }
+        $startIndex = ($startIndex % $boardSize + $boardSize) % $boardSize;
+
+        Log::info(sprintf(
+            '摇取点数 roll_number=%d, 方向=%d, start_index=%d, target_index=%d',
+            $rollNumber,
+            $direction,
+            $startIndex,
+            $targetIndex
+        ));
         $realEv = (float) $reward->real_ev;
         $winCoin = 100 + $realEv; // 赢取平台币 = 100 + DiceRewardConfig.real_ev
-        $gridNumber = (int) $reward->grid_number;
-        $startIndex = (int) Cache::get(LotteryService::getStartIndexKey($playerId), 0);
-        $targetIndex = (int) $reward->id;
-        $rollArray = $this->generateRollArray($gridNumber);
 
         $record = null;
         $configId = (int) $config->id;
@@ -162,8 +193,6 @@ class PlayStartLogic
                     'wallet_after'   => $coinAfter,
                     'remark'         => '抽奖|play_record_id=' . $record->id,
                 ]);
-
-                Cache::set(LotteryService::getStartIndexKey($playerId), $targetIndex, 86400 * 30);
             });
         } catch (\Throwable $e) {
             if ($record === null) {
@@ -202,23 +231,13 @@ class PlayStartLogic
         return $arr;
     }
 
-    /** 生成 5 个 1-6 的点数，和为 grid_number（5~30），严格不超范围 */
-    private function generateRollArray(int $gridNumber): array
+    /** 生成 5 个 1-6 的点数，roll_number 为其总和 */
+    private function generateRollArray(): array
     {
-        $minSum = 5;
-        $maxSum = 30;
-        $n = max($minSum, min($maxSum, $gridNumber));
-        $dice = [1, 1, 1, 1, 1];
-        $remain = $n - 5;
-        while ($remain > 0) {
-            $i = array_rand($dice);
-            if ($dice[$i] < 6) {
-                $add = min($remain, 6 - $dice[$i]);
-                $dice[$i] += $add;
-                $remain -= $add;
-            }
+        $dice = [];
+        for ($i = 0; $i < 5; $i++) {
+            $dice[] = random_int(1, 6);
         }
-        shuffle($dice);
         return $dice;
     }
 }

server/app/api/logic/UserLogic.php

@@ -33,78 +33,6 @@ class UserLogic
         }
     }
 
-    /**
-     * 登录：手机号 + 密码，返回用户信息与 user-token，并写入 Redis 缓存
-     */
-    public function login(string $phone, string $password): array
-    {
-        self::validatePhone($phone);
-
-        $user = DicePlayer::where('phone', $phone)->find();
-        if (!$user) {
-            throw new ApiException('手机号未注册');
-        }
-        if ((int) $user->status !== self::STATUS_NORMAL) {
-            throw new ApiException('账号已被禁用');
-        }
-        $hashed = $this->hashPassword($password);
-        if ($user->password !== $hashed) {
-            throw new ApiException('密码错误');
-        }
-
-        $userArr = $user->hidden(['password'])->toArray();
-        UserCache::setUser((int) $user->id, $userArr);
-
-        $userToken = $this->generateUserToken((int) $user->id);
-        // 同一用户只保留最新一次登录的 token，旧 token 自动失效
-        UserCache::setCurrentUserToken((int) $user->id, $userToken);
-        return [
-            'user' => $userArr,
-            'user-token' => $userToken,
-            'user_id' => (int) $user->id,
-        ];
-    }
-
-    /**
-     * 注册：手机号 + 密码（+60），创建玩家并返回用户信息与 user-token，写入 Redis
-     */
-    public function register(string $phone, string $password, ?string $nickname = null): array
-    {
-        self::validatePhone($phone);
-
-        if (strlen($password) < 6) {
-            throw new ApiException('密码至少 6 位');
-        }
-
-        $exists = DicePlayer::where('phone', $phone)->find();
-        if ($exists) {
-            throw new ApiException('该手机号已注册');
-        }
-
-        $user = new DicePlayer();
-        $user->phone = $phone;
-        $user->username = $phone;
-        if ($nickname !== null && $nickname !== '') {
-            $user->name = $nickname;
-        }
-        // name 未传时由 DicePlayer::onBeforeInsert 默认设为 uid
-        $user->password = $this->hashPassword($password);
-        $user->status = self::STATUS_NORMAL;
-        $user->save();
-
-        $userArr = $user->hidden(['password'])->toArray();
-        UserCache::setUser((int) $user->id, $userArr);
-
-        $userToken = $this->generateUserToken((int) $user->id);
-        // 同一用户只保留最新一次登录的 token，旧 token 自动失效
-        UserCache::setCurrentUserToken((int) $user->id, $userToken);
-        return [
-            'user' => $userArr,
-            'user-token' => $userToken,
-            'user_id' => (int) $user->id,
-        ];
-    }
-
     /**
      * 与 DicePlayerLogic 一致的密码加密：md5(salt . password)
      */
@@ -114,97 +42,84 @@ class UserLogic
     }
 
     /**
-     * 生成 user-token（JWT，plat=api_user，id=user_id）
+     * 登录（JSON：username, password, lang, coin, time）
+     * 存在则校验密码并更新 coin（累加）；不存在则创建用户并写入 coin。
+     * 将会话写入 Redis，返回 token 与前端连接地址。
      */
-    private function generateUserToken(int $userId): string
+    public function loginByUsername(string $username, string $password, string $lang, float $coin, string $time): array
     {
-        $exp = config('api.user_token_exp', 604800);
-        $result = JwtToken::generateToken([
-            'id' => $userId,
-            'plat' => 'api_user',
+        $username = trim($username);
+        if ($username === '') {
+            throw new ApiException('username 不能为空');
+        }
+
+        $player = DicePlayer::where('username', $username)->find();
+        if ($player) {
+            $hashed = $this->hashPassword($password);
+            if ($player->password !== $hashed) {
+                throw new ApiException('密码错误');
+            }
+            $currentCoin = (float) $player->coin;
+            $player->coin = $currentCoin + $coin;
+            $player->save();
+        } else {
+            $player = new DicePlayer();
+            $player->username = $username;
+            $player->phone = $username;
+            $player->password = $this->hashPassword($password);
+            $player->status = self::STATUS_NORMAL;
+            $player->coin = $coin;
+            $player->save();
+        }
+
+        $exp = (int) config('api.session_expire', 604800);
+        $tokenResult = JwtToken::generateToken([
+            'id' => (int) $player->id,
+            'username' => $username,
+            'plat' => 'api_login',
             'access_exp' => $exp,
         ]);
-        return $result['access_token'];
+        $token = $tokenResult['access_token'];
+        UserCache::setSessionByUsername($username, $token);
+
+        $userArr = $player->hidden(['password'])->toArray();
+        UserCache::setUser((int) $player->id, $userArr);
+        UserCache::setPlayerByUsername($username, $userArr);
+
+        $baseUrl = rtrim(config('api.login_url_base', 'https://127.0.0.1:6777'), '/');
+        $lang = in_array($lang, ['chs', 'en'], true) ? $lang : 'chs';
+        $tokenInUrl = str_replace('%3D', '=', urlencode($token));
+        $url = $baseUrl . '?token=' . $tokenInUrl . '&lang=' . $lang;
+
+        return [
+            'url' => $url,
+            'token' => $token,
+            'lang' => $lang,
+            'user_id' => (int) $player->id,
+            'user' => $userArr,
+        ];
     }
 
     /**
-     * 从请求中解析 user-token（header: user-token 或 Authorization: Bearer）
-     * @param object $request 需有 header(string $name) 方法
+     * 从 JWT 中解析 username（仅解码 payload，不校验签名与过期，用于退出时清除会话）
      */
-    public static function getTokenFromRequest(object $request): string
+    public static function getUsernameFromJwtPayload(string $token): ?string
     {
-        $token = $request->header('user-token') ?? '';
-        if ($token !== '') {
-            return trim((string) $token);
-        }
-        $auth = $request->header('authorization');
-        if ($auth && stripos($auth, 'Bearer ') === 0) {
-            return trim(substr($auth, 7));
-        }
-        return '';
-    }
-
-    /**
-     * 从请求获取当前用户 ID：优先 request->user_id，否则从 header 的 user-token 解析
-     * 中间件未正确注入时仍可兜底解析
-     * @param object $request 需有 user_id 属性及 header() 方法
-     */
-    public static function getUserIdFromRequest(object $request): ?int
-    {
-        $id = $request->user_id ?? null;
-        if ($id !== null && (int) $id > 0) {
-            return (int) $id;
-        }
-        $token = self::getTokenFromRequest($request);
-        if ($token === '') {
+        $parts = explode('.', $token);
+        if (count($parts) !== 3) {
             return null;
         }
-        return self::getUserIdFromToken($token);
-    }
-
-    /**
-     * 根据 user-token 获取 user_id（不写缓存，仅解析 JWT）
-     * 若 token 已通过退出接口加入黑名单，返回 null
-     */
-    public static function getUserIdFromToken(string $userToken): ?int
-    {
-        if (UserCache::isTokenBlacklisted($userToken)) {
+        $payload = base64_decode(strtr($parts[1], '-_', '+/'), true);
+        if ($payload === false) {
             return null;
         }
-        try {
-            $decoded = JwtToken::verify(1, $userToken);
-            $extend = $decoded['extend'] ?? [];
-            if (($extend['plat'] ?? '') !== 'api_user') {
-                return null;
-            }
-            $id = $extend['id'] ?? null;
-            if ($id === null) {
-                return null;
-            }
-            $userId = (int) $id;
-            // 同一用户只允许当前登记的 token 生效，重新登录/注册后旧 token 失效
-            if (!UserCache::isCurrentUserToken($userId, $userToken)) {
-                return null;
-            }
-            return $userId;
-        } catch (\Throwable $e) {
+        $data = json_decode($payload, true);
+        if (!is_array($data)) {
             return null;
         }
-    }
-
-    /**
-     * 退出登录：将当前 user-token 加入黑名单，使该 token 失效
-     */
-    public static function logout(string $userToken): bool
-    {
-        try {
-            $decoded = JwtToken::verify(1, $userToken);
-            $exp = (int) ($decoded['exp'] ?? 0);
-            $ttl = $exp > time() ? $exp - time() : 86400;
-            return UserCache::addTokenToBlacklist($userToken, $ttl);
-        } catch (\Throwable $e) {
-            return false;
-        }
+        $extend = $data['extend'] ?? $data;
+        $username = $extend['username'] ?? null;
+        return $username !== null ? trim((string) $username) : null;
     }
 
     /**

server/app/api/middleware/CheckAuthTokenMiddleware.php

@@ -1,109 +0,0 @@
-<?php
-declare(strict_types=1);
-
-namespace app\api\middleware;
-
-use support\Log;
-use Webman\Http\Request;
-use Webman\Http\Response;
-use Webman\MiddlewareInterface;
-use Tinywan\Jwt\JwtToken;
-use Tinywan\Jwt\Exception\JwtTokenException;
-use Tinywan\Jwt\Exception\JwtTokenExpiredException;
-use app\api\util\ReturnCode;
-use app\api\cache\AuthTokenCache;
-use plugin\saiadmin\exception\ApiException;
-
-/**
- * 仅校验 auth-token 请求头
- * 白名单路径（如 /api/authToken）不校验，其它接口必须携带有效 auth-token 或 Authorization: Bearer <token>，且必须通过 JWT 签名与 plat=api 校验
- */
-class CheckAuthTokenMiddleware implements MiddlewareInterface
-{
-    /** 不需要 auth-token 的路径 */
-    private const WHITELIST = [
-        'api/authToken',
-    ];
-
-    /** JWT 至少为 xxx.yyy.zzz 三段 */
-    private const JWT_PARTS_MIN = 3;
-
-    public function process(Request $request, callable $handler): Response
-    {
-        $path = trim((string) $request->path(), '/');
-        if ($this->isWhitelist($path)) {
-            return $handler($request);
-        }
-
-        $token = $this->getAuthTokenFromRequest($request);
-        if ($token === '') {
-            throw new ApiException('请携带 auth-token', ReturnCode::UNAUTHORIZED);
-        }
-
-        if (!$this->looksLikeJwt($token)) {
-            throw new ApiException('auth-token 格式无效', ReturnCode::TOKEN_INVALID);
-        }
-
-        $decoded = $this->verifyAuthToken($token);
-        $extend = $decoded['extend'] ?? [];
-        if (($extend['plat'] ?? '') !== 'api') {
-            throw new ApiException('auth-token 无效（非 API 凭证）', ReturnCode::TOKEN_INVALID);
-        }
-
-        // 同一设备只允许一个 auth-token 生效，非当前 token 视为已失效
-        $device = (string) ($extend['device'] ?? '');
-        if ($device !== '' && !AuthTokenCache::isCurrentToken($device, $token)) {
-            throw new ApiException('auth-token 已失效（该设备已签发新凭证，请使用新 auth-token）', ReturnCode::TOKEN_INVALID);
-        }
-
-        return $handler($request);
-    }
-
-    private function getAuthTokenFromRequest(Request $request): string
-    {
-        $token = $request->header('auth-token');
-        if ($token !== null && $token !== '') {
-            return trim((string) $token);
-        }
-        $auth = $request->header('authorization');
-        if ($auth && stripos($auth, 'Bearer ') === 0) {
-            return trim(substr($auth, 7));
-        }
-        return '';
-    }
-
-    private function looksLikeJwt(string $token): bool
-    {
-        $parts = explode('.', $token);
-        return count($parts) >= self::JWT_PARTS_MIN;
-    }
-
-    /**
-     * 校验 auth-token 有效性（签名、过期、iss 等），无效或过期必抛 ApiException
-     */
-    private function verifyAuthToken(string $token): array
-    {
-        try {
-            return JwtToken::verify(1, $token);
-        } catch (JwtTokenExpiredException $e) {
-            Log::error('auth-token 已过期, 报错信息' . $e);
-            throw new ApiException('auth-token 已过期', ReturnCode::TOKEN_INVALID);
-        } catch (JwtTokenException $e) {
-            Log::error('auth-token 无效, 报错信息' . $e);
-            throw new ApiException($e->getMessage() ?: 'auth-token 无效', ReturnCode::TOKEN_INVALID);
-        } catch (\Throwable $e) {
-            Log::error('auth-token 校验失败, 报错信息' . $e);
-            throw new ApiException('auth-token 校验失败', ReturnCode::TOKEN_INVALID);
-        }
-    }
-
-    private function isWhitelist(string $path): bool
-    {
-        foreach (self::WHITELIST as $prefix) {
-            if ($path === $prefix || str_starts_with($path, $prefix . '/')) {
-                return true;
-            }
-        }
-        return false;
-    }
-}

server/app/api/middleware/CheckUserTokenMiddleware.php

@@ -1,42 +0,0 @@
-<?php
-declare(strict_types=1);
-
-namespace app\api\middleware;
-
-use Webman\Http\Request;
-use Webman\Http\Response;
-use Webman\MiddlewareInterface;
-use app\api\logic\UserLogic;
-use app\api\util\ReturnCode;
-use plugin\saiadmin\exception\ApiException;
-
-/**
- * 校验 user-token 请求头
- * 从 header 读取 user-token 或 Authorization: Bearer <user-token>，校验通过后将 user_id、userToken 写入 request 供控制器使用
- */
-class CheckUserTokenMiddleware implements MiddlewareInterface
-{
-    public function process(Request $request, callable $handler): Response
-    {
-        $token = $request->header('user-token');
-        if (empty($token)) {
-            $auth = $request->header('authorization');
-            if ($auth && stripos($auth, 'Bearer ') === 0) {
-                $token = trim(substr($auth, 7));
-            }
-        }
-        if (empty($token)) {
-            throw new ApiException('请携带 user-token', ReturnCode::UNAUTHORIZED);
-        }
-
-        $userId = UserLogic::getUserIdFromToken($token);
-        if ($userId === null) {
-            throw new ApiException('user-token 无效或已过期', ReturnCode::TOKEN_INVALID);
-        }
-
-        $request->user_id = $userId;
-        $request->userToken = $token;
-
-        return $handler($request);
-    }
-}

server/app/api/middleware/TokenMiddleware.php

@@ -0,0 +1,87 @@
+<?php
+declare(strict_types=1);
+
+namespace app\api\middleware;
+
+use app\api\cache\UserCache;
+use app\api\util\ReturnCode;
+use app\dice\model\player\DicePlayer;
+use plugin\saiadmin\exception\ApiException;
+use Tinywan\Jwt\JwtToken;
+use Tinywan\Jwt\Exception\JwtTokenException;
+use Tinywan\Jwt\Exception\JwtTokenExpiredException;
+use Webman\Http\Request;
+use Webman\Http\Response;
+use Webman\MiddlewareInterface;
+
+/**
+ * 校验 token 请求头（JWT）
+ * 解码 JWT 取 username，与 Redis 中当前有效 token 比对；不一致则旧 token 已失效，请重新登录
+ * 通过后注入 request->player_id、request->player
+ */
+class TokenMiddleware implements MiddlewareInterface
+{
+    public function process(Request $request, callable $handler): Response
+    {
+        $token = $request->header('token');
+        if ($token === null || $token === '') {
+            $auth = $request->header('authorization');
+            if ($auth && stripos($auth, 'Bearer ') === 0) {
+                $token = trim(substr($auth, 7));
+            }
+        }
+        $token = $token !== null ? trim((string) $token) : '';
+        if ($token === '') {
+            throw new ApiException('请携带 token', ReturnCode::UNAUTHORIZED);
+        }
+
+        try {
+            $decoded = JwtToken::verify(1, $token);
+        } catch (JwtTokenExpiredException $e) {
+            throw new ApiException('token 已过期，请重新登录', ReturnCode::TOKEN_INVALID);
+        } catch (JwtTokenException $e) {
+            throw new ApiException('token 无效', ReturnCode::TOKEN_INVALID);
+        } catch (\Throwable $e) {
+            throw new ApiException('token 格式无效', ReturnCode::TOKEN_INVALID);
+        }
+
+        $extend = $decoded['extend'] ?? [];
+        if ((string) ($extend['plat'] ?? '') !== 'api_login') {
+            throw new ApiException('token 无效', ReturnCode::TOKEN_INVALID);
+        }
+        $username = trim((string) ($extend['username'] ?? ''));
+        if ($username === '') {
+            throw new ApiException('token 无效', ReturnCode::TOKEN_INVALID);
+        }
+
+        $currentToken = UserCache::getSessionTokenByUsername($username);
+        if ($currentToken === null || $currentToken === '') {
+            $player = DicePlayer::where('username', $username)->find();
+            if (!$player) {
+                throw new ApiException('请注册', ReturnCode::TOKEN_INVALID);
+            }
+            throw new ApiException('请重新登录', ReturnCode::TOKEN_INVALID);
+        }
+        if ($currentToken !== $token) {
+            throw new ApiException('请重新登录（当前账号已在其他处登录）', ReturnCode::TOKEN_INVALID);
+        }
+
+        // 优先从 Redis 缓存取玩家，避免每次请求都查库
+        $player = null;
+        $cached = UserCache::getPlayerByUsername($username);
+        if ($cached !== null && isset($cached['id'])) {
+            $player = (new DicePlayer())->data($cached, true);
+        }
+        if ($player === null) {
+            $player = DicePlayer::where('username', $username)->find();
+            if (!$player) {
+                UserCache::deleteSessionByUsername($username);
+                throw new ApiException('请重新登录', ReturnCode::TOKEN_INVALID);
+            }
+            UserCache::setPlayerByUsername($username, $player->hidden(['password'])->toArray());
+        }
+        $request->player_id = (int) $player->id;
+        $request->player = $player;
+        return $handler($request);
+    }
+}

server/app/dice/model/player/DicePlayer.php

@@ -49,6 +49,11 @@ class DicePlayer extends BaseModel
      */
     protected $table = 'dice_player';
 
+    /** 创建时间字段（dice_player 表为 created_at） */
+    protected $createTime = 'created_at';
+    /** 更新时间字段（dice_player 表为 updated_at） */
+    protected $updateTime = 'updated_at';
+
     /**
      * 新增前：生成唯一 uid，昵称 name 默认使用 uid
      * 用 try-catch 避免表尚未含 uid 时 getAttr/getData 抛 InvalidArgumentException

server/config/api.php

@@ -3,6 +3,12 @@
  * API 鉴权与用户相关配置
  */
 return [
+    // 登录成功返回的连接地址前缀，如 https://127.0.0.1:6777
+    'login_url_base' => env('API_LOGIN_URL_BASE', 'https://127.0.0.1:6777'),
+    // 按 username 存储的登录会话 Redis key 前缀，用于 token 中间件校验
+    'session_username_prefix' => env('API_SESSION_USERNAME_PREFIX', 'api:user:session:'),
+    // 登录会话过期时间（秒），默认 7 天
+    'session_expire' => (int) env('API_SESSION_EXPIRE', 604800),
     // auth-token 签名密钥（与客户端约定，用于 /api/authToken 的 signature 校验，必填）
     'auth_token_secret' => env('API_AUTH_TOKEN_SECRET', ''),
     // auth-token 时间戳允许误差（秒），防重放，默认 300 秒
@@ -21,4 +27,7 @@ return [
     'user_cache_prefix' => env('API_USER_CACHE_PREFIX', 'api:user:'),
     // 用户信息加密密钥（用于 Redis 中 value 的加密），建议 32 位
     'user_encrypt_key' => env('API_USER_ENCRYPT_KEY', 'dafuweng_api_user_cache_key_32'),
+    // 玩家信息按 username 缓存（Token 中间件用），0 表示不缓存
+    'player_cache_ttl' => (int) env('API_PLAYER_CACHE_TTL', 300),
+    'player_cache_prefix' => env('API_PLAYER_CACHE_PREFIX', 'api:player:'),
 ];

server/config/app.php

@@ -15,7 +15,8 @@
 use support\Request;
 
 return [
-    'debug' => true,
+    // 生产环境务必设为 false，减少 I/O 与堆栈输出，提升接口响应
+    'debug' => env('APP_DEBUG', false),
     'error_reporting' => E_ALL,
     'default_timezone' => 'Asia/Shanghai',
     'request_class' => Request::class,

server/config/database.php

@@ -18,10 +18,10 @@ return [
                 PDO::ATTR_EMULATE_PREPARES => false, // Must be false for Swoole and Swow drivers.
             ],
             'pool' => [
-                'max_connections' => 5,
-                'min_connections' => 1,
-                'wait_timeout' => 3,
-                'idle_timeout' => 60,
+                'max_connections' => (int) env('DB_POOL_MAX', 20),
+                'min_connections' => (int) env('DB_POOL_MIN', 2),
+                'wait_timeout' => (float) env('DB_POOL_WAIT_TIMEOUT', 1.0),
+                'idle_timeout' => (int) env('DB_POOL_IDLE_TIMEOUT', 60),
                 'heartbeat_interval' => 50,
             ],
         ],

server/config/log.php

@@ -20,7 +20,7 @@ return [
                 'constructor' => [
                     runtime_path() . '/logs/webman.log',
                     7, //$maxFiles
-                    Monolog\Logger::DEBUG,
+                    env('LOG_LEVEL', Monolog\Logger::INFO),
                 ],
                 'formatter' => [
                     'class' => Monolog\Formatter\LineFormatter::class,

server/config/redis.php

@@ -7,9 +7,9 @@ return [
         'port' => env('REDIS_PORT', 6379),
         'database' => env('REDIS_DB', 0),
         'pool' => [
-            'max_connections' => 5,
-            'min_connections' => 1,
-            'wait_timeout' => 3,
+            'max_connections' => (int) env('REDIS_POOL_MAX', 20),
+            'min_connections' => (int) env('REDIS_POOL_MIN', 2),
+            'wait_timeout' => (float) env('REDIS_POOL_WAIT_TIMEOUT', 1.0),
             'idle_timeout' => 60,
             'heartbeat_interval' => 50,
         ],

server/config/route.php

@@ -13,19 +13,14 @@
  */
 
 use Webman\Route;
-use app\api\middleware\CheckAuthTokenMiddleware;
-use app\api\middleware\CheckUserTokenMiddleware;
+use app\api\middleware\TokenMiddleware;
 
-// 仅需 auth-token 的路由组（authToken 接口在中间件内白名单跳过）
+// 登录接口：无需 token，提交 JSON 获取带 token 的连接地址
 Route::group('/api', function () {
-    Route::any('/authToken', [app\api\controller\AuthTokenController::class, 'index']);
-    Route::any('/user/login', [app\api\controller\UserController::class, 'login']);
-    Route::any('/user/register', [app\api\controller\UserController::class, 'register']);
-})->middleware([
-    CheckAuthTokenMiddleware::class,
-]);
+    Route::any('/user/Login', [app\api\controller\UserController::class, 'Login']);
+})->middleware([]);
 
-// 需 auth-token + user-token 的路由组
+// 其余接口：仅经 token 中间件鉴权（header: token，base64(username.-.time)）
 Route::group('/api', function () {
     Route::any('/user/logout', [app\api\controller\UserController::class, 'logout']);
     Route::any('/user/info', [app\api\controller\UserController::class, 'info']);
@@ -36,6 +31,5 @@ Route::group('/api', function () {
     Route::any('/game/lotteryPool', [app\api\controller\GameController::class, 'lotteryPool']);
     Route::any('/game/playStart', [app\api\controller\GameController::class, 'playStart']);
 })->middleware([
-    CheckAuthTokenMiddleware::class,
-    CheckUserTokenMiddleware::class,
+    TokenMiddleware::class,
 ]);

server/config/think-cache.php

@@ -24,13 +24,13 @@ return [
             'tag_expire' => 86400 * 30,
             // 缓存标签前缀
             'tag_prefix' => 'tag:',
-            // 连接池配置
+            // 连接池配置（与 redis.php 对齐，生产可调大以减少等待）
             'pool' => [
-                'max_connections' => 5, // 最大连接数
-                'min_connections' => 1, // 最小连接数
-                'wait_timeout' => 3,    // 从连接池获取连接等待超时时间
-                'idle_timeout' => 60,   // 连接最大空闲时间，超过该时间会被回收
-                'heartbeat_interval' => 50, // 心跳检测间隔，需要小于60秒
+                'max_connections' => (int) env('REDIS_POOL_MAX', 20),
+                'min_connections' => (int) env('REDIS_POOL_MIN', 2),
+                'wait_timeout' => (float) env('REDIS_POOL_WAIT_TIMEOUT', 1.0),
+                'idle_timeout' => 60,
+                'heartbeat_interval' => 50,
             ],
         ],
         // 文件缓存

server/config/think-orm.php

@@ -18,8 +18,7 @@ return [
             'hostport' => env('DB_PORT', 3306),
             // 数据库连接参数
             'params' => [
-                // 连接超时3秒
-                \PDO::ATTR_TIMEOUT => 3,
+                \PDO::ATTR_TIMEOUT => (int) env('DB_CONNECT_TIMEOUT', 2),
             ],
             // 数据库编码默认采用utf8
             'charset' => 'utf8',
@@ -29,13 +28,13 @@ return [
             'break_reconnect' => true,
             // 自定义分页类
             'bootstrap' =>  '',
-            // 连接池配置
+            // 连接池配置（与 database.php 对齐）
             'pool' => [
-                'max_connections' => 5, // 最大连接数
-                'min_connections' => 1, // 最小连接数
-                'wait_timeout' => 3,    // 从连接池获取连接等待超时时间
-                'idle_timeout' => 60,   // 连接最大空闲时间，超过该时间会被回收
-                'heartbeat_interval' => 50, // 心跳检测间隔，需要小于60秒
+                'max_connections' => (int) env('DB_POOL_MAX', 20),
+                'min_connections' => (int) env('DB_POOL_MIN', 2),
+                'wait_timeout' => (float) env('DB_POOL_WAIT_TIMEOUT', 1.0),
+                'idle_timeout' => (int) env('DB_POOL_IDLE_TIMEOUT', 60),
+                'heartbeat_interval' => 50,
             ],
         ],
     ],

server/plugin/saiadmin/app/controller/SystemController.php

@@ -33,24 +33,26 @@ class SystemController extends BaseController
      */
     public function userInfo(): Response
     {
-        $info['user'] = $this->adminInfo;
+        if ($this->adminInfo === null || !is_array($this->adminInfo) || !isset($this->adminInfo['id'])) {
+            return $this->fail('登录已过期或用户信息无效，请重新登录', 401);
+        }
         $info = [];
         $info['id'] = $this->adminInfo['id'];
         $info['username'] = $this->adminInfo['username'];
-        $info['dashboard'] = $this->adminInfo['dashboard'];
-        $info['avatar'] = $this->adminInfo['avatar'];
-        $info['email'] = $this->adminInfo['email'];
-        $info['phone'] = $this->adminInfo['phone'];
-        $info['gender'] = $this->adminInfo['gender'];
-        $info['signed'] = $this->adminInfo['signed'];
-        $info['realname'] = $this->adminInfo['realname'];
-        $info['department'] = $this->adminInfo['deptList'];
-        if ($this->adminInfo['id'] === 1) {
+        $info['dashboard'] = $this->adminInfo['dashboard'] ?? '';
+        $info['avatar'] = $this->adminInfo['avatar'] ?? '';
+        $info['email'] = $this->adminInfo['email'] ?? '';
+        $info['phone'] = $this->adminInfo['phone'] ?? '';
+        $info['gender'] = $this->adminInfo['gender'] ?? '';
+        $info['signed'] = $this->adminInfo['signed'] ?? '';
+        $info['realname'] = $this->adminInfo['realname'] ?? '';
+        $info['department'] = $this->adminInfo['deptList'] ?? [];
+        if ((int) $this->adminInfo['id'] === 1) {
             $info['buttons'] = ['*'];
             $info['roles'] = ['super_admin'];
         } else {
             $info['buttons'] = UserAuthCache::getUserAuth($this->adminInfo['id']);
-            $info['roles'] = Arr::getArrayColumn($this->adminInfo['roleList'], 'code');
+            $info['roles'] = Arr::getArrayColumn($this->adminInfo['roleList'] ?? [], 'code');
         }
         return $this->success($info);
     }
@@ -70,6 +72,9 @@ class SystemController extends BaseController
      */
     public function menu(): Response
     {
+        if ($this->adminInfo === null || !is_array($this->adminInfo) || !isset($this->adminInfo['id'])) {
+            return $this->fail('登录已过期或用户信息无效，请重新登录', 401);
+        }
         $data = UserMenuCache::getUserMenu($this->adminInfo['id']);
         return $this->success($data);
     }

server/plugin/saiadmin/app/exception/Handler.php

@@ -40,29 +40,35 @@ class Handler extends ExceptionHandler
         $this->logger->error($logs);
     }
 
-    public function render(Request $request, Throwable $exception): Response
-    {
-        $debug = config('app.debug', true);
-        $code = $exception->getCode();
-        $json = [
-            'code' => $code ? $code : 500,
-            'message' => $code !== 500 ? $exception->getMessage() : 'Server internal error',
-            'type' => 'failed'
-        ];
-        if ($debug) {
-            $json['request_url'] = $request->method() . ' ' . $request->uri();
-            $json['timestamp'] = date('Y-m-d H:i:s');
-            $json['client_ip'] = $request->getRealIp();
-            $json['request_param'] = $request->all();
-            $json['exception_handle'] = get_class($exception);
-            $json['exception_info'] = [
-                'code' => $exception->getCode(),
-                'message' => $exception->getMessage(),
-                'file' => $exception->getFile(),
-                'line' => $exception->getLine(),
-                'trace' => explode("\n", $exception->getTraceAsString())
-            ];
-        }
-        return new Response(200, ['Content-Type' => 'application/json;charset=utf-8'], json_encode($json));
-    }
+//    public function render(Request $request, Throwable $exception): Response
+//    {
+//        $debug = config('app.debug', true);
+//        $code = $exception->getCode();
+//        $httpCode = ($code >= 400 && $code < 600) ? $code : 500;
+//        // 开启 debug 时始终返回真实错误信息，便于排查；未开启时 500 不暴露详情
+//        $message = $exception->getMessage();
+//        if (!$debug && $httpCode === 500) {
+//            $message = 'Server internal error';
+//        }
+//        $json = [
+//            'code' => $httpCode,
+//            'message' => $message,
+//            'type' => 'failed'
+//        ];
+//        if ($debug) {
+//            $json['request_url'] = $request->method() . ' ' . $request->uri();
+//            $json['timestamp'] = date('Y-m-d H:i:s');
+//            $json['client_ip'] = $request->getRealIp();
+//            $json['request_param'] = $request->all();
+//            $json['exception_handle'] = get_class($exception);
+//            $json['exception_info'] = [
+//                'code' => $exception->getCode(),
+//                'message' => $exception->getMessage(),
+//                'file' => $exception->getFile(),
+//                'line' => $exception->getLine(),
+//                'trace' => explode("\n", $exception->getTraceAsString())
+//            ];
+//        }
+//        return new Response(200, ['Content-Type' => 'application/json;charset=utf-8'], json_encode($json));
+//    }
 }

server/plugin/saiadmin/app/middleware/CheckLogin.php

@@ -32,8 +32,11 @@ class CheckLogin implements MiddlewareInterface
             if ($token['plat'] !== 'saiadmin') {
                 throw new ApiException('登录凭证校验失败');
             }
-            $request->setHeader('check_login', true);
-            $request->setHeader('check_admin', $token);
+            // 一次合并设置，避免 setHeader 覆盖导致只保留最后一个
+            $request->setHeader(array_merge($request->header() ?: [], [
+                'check_login' => true,
+                'check_admin' => $token,
+            ]));
         }
         return $handler($request);
     }

server/plugin/saiadmin/basic/BaseController.php

@@ -45,16 +45,20 @@ class BaseController extends OpenController
      */
     protected function init(): void
     {
-        // 登录模式赋值
+        // 登录模式赋值（仅当 check_admin 有效时赋值，避免登录接口等未带 token 时访问 null 导致报错）
         $isLogin = request()->header('check_login', false);
-        if ($isLogin) {
-            $result = request()->header('check_admin');
-            $this->adminId = $result['id'];
-            $this->adminName = $result['username'];
-            $this->adminInfo = UserInfoCache::getUserInfo($result['id']);
+        $result = request()->header('check_admin');
+        if ($isLogin && $result !== null && (is_array($result) || is_object($result))) {
+            $arr = is_array($result) ? $result : (array) $result;
+            $adminId = $arr['id'] ?? null;
+            if ($adminId !== null) {
+                $this->adminId = (int) $adminId;
+                $this->adminName = $arr['username'] ?? '';
+                $this->adminInfo = UserInfoCache::getUserInfo($adminId);
 
-            // 用户数据传递给逻辑层
-            $this->logic && $this->logic->init($this->adminInfo);
+                // 用户数据传递给逻辑层
+                $this->logic && $this->logic->init($this->adminInfo);
+            }
         }
     }
 

server/plugin/saiadmin/basic/think/BaseModel.php

@@ -35,6 +35,12 @@ class BaseModel extends Model implements ModelInterface
      */
     protected $updateTime = 'update_time';
 
+    /**
+     * 自动写入时间戳（创建时写 create_time，更新时写 update_time）
+     * @var bool
+     */
+    protected $autoWriteTimestamp = true;
+
     /**
      * 隐藏字段
      * @var array
@@ -94,24 +100,54 @@ class BaseModel extends Model implements ModelInterface
     }
 
     /**
-     * 新增前事件
+     * 新增前事件：自动写入 create_time，有后台登录信息时写入 created_by
      * @param Model $model
      * @return void
      */
     public static function onBeforeInsert($model): void
     {
-        $info = getCurrentInfo();
-        $info && $model->setAttr('created_by', $info['id']);
+        try {
+            $createTime = $model->createTime ?? 'create_time';
+            if ($createTime && !$model->getData($createTime)) {
+                $model->set($createTime, date('Y-m-d H:i:s'));
+            }
+        } catch (\Throwable $e) {
+        }
+        try {
+            if (function_exists('getCurrentInfo')) {
+                $info = getCurrentInfo();
+                if (!empty($info['id'])) {
+                    $model->setAttr('created_by', $info['id']);
+                }
+            }
+        } catch (\Throwable $e) {
+        }
     }
 
     /**
-     * 写入前事件
+     * 写入前事件：更新时自动写入 update_time，有后台登录信息时写入 updated_by
      * @param Model $model
      * @return void
      */
     public static function onBeforeWrite($model): void
     {
-        $info = getCurrentInfo();
-        $info && $model->setAttr('updated_by', $info['id']);
+        try {
+            if ($model->isExists()) {
+                $updateTime = $model->updateTime ?? 'update_time';
+                if ($updateTime) {
+                    $model->set($updateTime, date('Y-m-d H:i:s'));
+                }
+            }
+        } catch (\Throwable $e) {
+        }
+        try {
+            if (function_exists('getCurrentInfo')) {
+                $info = getCurrentInfo();
+                if (!empty($info['id'])) {
+                    $model->setAttr('updated_by', $info['id']);
+                }
+            }
+        } catch (\Throwable $e) {
+        }
     }
 }

server/plugin/saiadmin/config/middleware.php

@@ -4,8 +4,9 @@ use plugin\saiadmin\app\middleware\SystemLog;
 use plugin\saiadmin\app\middleware\CheckLogin;
 use plugin\saiadmin\app\middleware\CheckAuth;
 
+// 仅对 /core 后台路由生效，避免 /api 请求经过登录/权限/操作日志中间件，提升接口响应
 return [
-    '' => [
+    'core' => [
         CheckLogin::class,
         CheckAuth::class,
         SystemLog::class,

server/support/Request.php

@@ -20,11 +20,11 @@ namespace support;
  */
 class Request extends \Webman\Http\Request
 {
-    /** 由 CheckUserTokenMiddleware 注入：当前用户 ID */
-    public ?int $user_id = null;
+    /** 由 TokenMiddleware 注入：当前玩家 ID（DicePlayer.id） */
+    public ?int $player_id = null;
 
-    /** 由 CheckUserTokenMiddleware 注入：当前 user-token 原始字符串 */
-    public ?string $userToken = null;
+    /** 由 TokenMiddleware 注入：当前玩家模型实例 */
+    public $player = null;
 
     /**
      * 获取参数增强方法