feat(player): 接入创蓝短信手机注册与登录页优化

新增 SMS 验证码注册、8 国手机号选择与 Redis 频控；优化登录/注册 UI 及图形验证码样式。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/app.module.ts

@@ -4,6 +4,7 @@ import { ScheduleModule } from '@nestjs/schedule';
 import { APP_GUARD } from '@nestjs/core';
 import { JwtAuthGuard } from './domains/identity/guards';
 import { PrismaModule } from './shared/prisma/prisma.module';
+import { RedisModule } from './shared/redis/redis.module';
 import { SystemConfigModule } from './shared/config/system-config.module';
 import { IdentityModule } from './domains/identity/identity.module';
 import { AgentsModule } from './domains/agent/agents.module';
@@ -22,6 +23,7 @@ import { AgentPortalModule } from './applications/agent/agent-portal.module';
     ConfigModule.forRoot({ isGlobal: true }),
     ScheduleModule.forRoot(),
     PrismaModule,
+    RedisModule,
     SystemConfigModule,
     IdentityModule,
     AgentsModule,

apps/api/src/domains/identity/auth.controller.ts

@@ -20,7 +20,12 @@ export class AuthController {
   @Public()
   @Post('player/auth/login')
   async playerLogin(@Body() dto: LoginDto) {
-    const result = await this.auth.login(dto.username, dto.password, 'player');
+    const result = await this.auth.login(
+      dto.username,
+      dto.password,
+      'player',
+      dto.countryCode,
+    );
     return jsonResponse(result);
   }
 
@@ -28,8 +33,11 @@ export class AuthController {
   @Post('player/auth/register')
   async playerRegister(@Body() dto: RegisterDto) {
     const result = await this.auth.registerPlayer({
-      username: dto.username,
+      phone: dto.phone,
+      countryCode: dto.countryCode,
       password: dto.password,
+      smsCode: dto.smsCode,
+      sessionId: dto.sessionId,
       inviteCode: dto.inviteCode,
       locale: dto.locale,
     });

apps/api/src/domains/identity/auth.dto.ts

@@ -10,18 +10,35 @@ export class LoginDto {
   @IsString()
   @MinLength(1)
   password!: string;
+
+  @ApiProperty({ required: false, description: '国家区号，不含 +，如 86' })
+  @IsOptional()
+  @IsString()
+  countryCode?: string;
 }
 
 export class RegisterDto {
-  @ApiProperty()
+  @ApiProperty({ description: '本地手机号，不含国家区号' })
   @IsString()
-  username!: string;
+  phone!: string;
+
+  @ApiProperty({ description: '国家区号，不含 +，如 86' })
+  @IsString()
+  countryCode!: string;
 
   @ApiProperty()
   @IsString()
   @MinLength(8)
   password!: string;
 
+  @ApiProperty({ description: '短信验证码' })
+  @IsString()
+  smsCode!: string;
+
+  @ApiProperty({ description: '发送验证码返回的 sessionId' })
+  @IsString()
+  sessionId!: string;
+
   @ApiProperty({ required: false })
   @IsOptional()
   @IsString()

apps/api/src/domains/identity/auth.module.ts

@@ -7,9 +7,11 @@ import { InvitesService } from './invites.service';
 import { JwtStrategy } from './jwt.strategy';
 import { AuthController } from './auth.controller';
 import { SystemConfigModule } from '../../shared/config/system-config.module';
+import { SmsModule } from './sms/sms.module';
 
 @Module({
   imports: [
+    SmsModule,
     SystemConfigModule,
     PassportModule.register({ defaultStrategy: 'jwt' }),
     JwtModule.registerAsync({

apps/api/src/domains/identity/auth.service.ts

@@ -8,6 +8,8 @@ import { assertPlayerUsername } from '@thebet365/shared';
 import { PrismaService } from '../../shared/prisma/prisma.service';
 import { SystemConfigService } from '../../shared/config/system-config.service';
 import { InvitesService } from './invites.service';
+import { SmsService } from './sms/sms.service';
+import { normalizePhone, resolvePlayerLoginUsername } from './sms/phone.util';
 
 const MAX_LOGIN_FAILS = 5;
 const LOCK_DURATION_MS = 15 * 60 * 1000;
@@ -27,6 +29,7 @@ export class AuthService {
     private config: ConfigService,
     private systemConfig: SystemConfigService,
     private invites: InvitesService,
+    private sms: SmsService,
   ) {}
 
   /** 平台管理员 / 代理统一登录（按 userType 签发对应 JWT） */
@@ -42,9 +45,19 @@ export class AuthService {
     return this.login(username, password, portal);
   }
 
-  async login(username: string, password: string, portal: 'player' | 'admin' | 'agent') {
+  async login(
+    username: string,
+    password: string,
+    portal: 'player' | 'admin' | 'agent',
+    countryCode?: string,
+  ) {
+    const lookupUsername =
+      portal === 'player'
+        ? resolvePlayerLoginUsername(username, countryCode)
+        : username.trim();
+
     const user = await this.prisma.user.findUnique({
-      where: { username },
+      where: { username: lookupUsername },
       include: { auth: true, adminRole: { include: { role: true } } },
     });
 
@@ -143,23 +156,35 @@ export class AuthService {
   }
 
   async registerPlayer(data: {
-    username: string;
+    phone: string;
+    countryCode: string;
     password: string;
+    smsCode: string;
+    sessionId: string;
     inviteCode?: string;
     locale?: string;
   }) {
-    const username = data.username.trim();
-    if (!username) {
-      throw appBadRequest('USERNAME_REQUIRED');
-    }
+    const phone = normalizePhone(data.countryCode, data.phone);
+    const username = phone;
+
     try {
       assertPlayerUsername(username);
     } catch {
-      throw appBadRequest('USERNAME_FORMAT_INVALID');
+      throw appBadRequest('PHONE_INVALID');
     }
     if (!data.password || data.password.length < 8) {
       throw appBadRequest('PASSWORD_MIN_LENGTH');
     }
+    if (!data.smsCode?.trim() || !data.sessionId?.trim()) {
+      throw appBadRequest('SMS_CODE_REQUIRED');
+    }
+
+    await this.sms.verifyCode({
+      phone: data.phone,
+      countryCode: data.countryCode,
+      code: data.smsCode.trim(),
+      sessionId: data.sessionId.trim(),
+    });
 
     const { parentId, sponsorId, inviteId } = await this.resolveInviteSponsor(data.inviteCode);
     const inviteSponsorId = parentId == null && sponsorId != null ? sponsorId : null;
@@ -169,7 +194,7 @@ export class AuthService {
       select: { id: true },
     });
     if (existing) {
-      throw appBadRequest('USERNAME_TAKEN');
+      throw appBadRequest('PHONE_TAKEN');
     }
 
     const hash = await this.hashPassword(data.password);
@@ -195,7 +220,7 @@ export class AuthService {
       });
 
       await tx.userPreference.create({
-        data: { userId: created.id, locale },
+        data: { userId: created.id, locale, phone },
       });
 
       if (inviteId) {

apps/api/src/domains/identity/sms/chuanglan/client.ts

@@ -0,0 +1,61 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { generateChuanglanSign } from './sign';
+import { loadChuanglanConfig } from './config';
+import type { ChuanglanSendResponse, SmsSendResult } from '../sms.types';
+
+@Injectable()
+export class ChuanglanClient {
+  private readonly cfg;
+
+  constructor(config: ConfigService) {
+    this.cfg = loadChuanglanConfig(config);
+  }
+
+  async sendSms(mobile: string, msg: string, uid?: string): Promise<SmsSendResult> {
+    const nonce = String(Date.now());
+
+    const body: Record<string, string> = {
+      account: this.cfg.account,
+      mobile,
+      msg,
+    };
+    if (uid) body.uid = uid;
+
+    const sign = generateChuanglanSign(this.cfg.password, { ...body, nonce });
+
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.cfg.readTimeoutMs);
+
+    try {
+      const res = await fetch(this.cfg.endpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/json',
+          nonce,
+          sign,
+        },
+        body: JSON.stringify(body),
+        signal: controller.signal,
+      });
+
+      const data = (await res.json()) as ChuanglanSendResponse;
+
+      if (data.code === '0') {
+        return {
+          success: true,
+          code: data.code,
+          message: 'OK',
+          messageId: data.data?.messageId,
+        };
+      }
+
+      return { success: false, code: data.code, message: data.message };
+    } catch (err) {
+      const message = err instanceof Error ? err.message : 'Unknown error';
+      return { success: false, code: 'HTTP_ERROR', message };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+}

apps/api/src/domains/identity/sms/chuanglan/config.ts

@@ -0,0 +1,36 @@
+import { ConfigService } from '@nestjs/config';
+
+export interface ChuanglanConfig {
+  account: string;
+  password: string;
+  endpoint: string;
+  connectTimeoutMs: number;
+  readTimeoutMs: number;
+}
+
+export interface SmsBusinessConfig {
+  codeTtlSeconds: number;
+  rateLimitSeconds: number;
+}
+
+export function loadChuanglanConfig(config: ConfigService): ChuanglanConfig {
+  const account = config.get<string>('CHUANGLAN_ACCOUNT');
+  const password = config.get<string>('CHUANGLAN_PASSWORD');
+  if (!account || !password) {
+    throw new Error('Missing CHUANGLAN_ACCOUNT or CHUANGLAN_PASSWORD');
+  }
+  return {
+    account,
+    password,
+    endpoint: config.get('CHUANGLAN_ENDPOINT', 'https://sgap.253.com/send/sms'),
+    connectTimeoutMs: Number(config.get('CHUANGLAN_CONNECT_TIMEOUT_MS', 10_000)),
+    readTimeoutMs: Number(config.get('CHUANGLAN_READ_TIMEOUT_MS', 10_000)),
+  };
+}
+
+export function loadSmsBusinessConfig(config: ConfigService): SmsBusinessConfig {
+  return {
+    codeTtlSeconds: Number(config.get('SMS_CODE_TTL_SECONDS', 300)),
+    rateLimitSeconds: Number(config.get('SMS_RATE_LIMIT_SECONDS', 60)),
+  };
+}

apps/api/src/domains/identity/sms/chuanglan/sign.ts

@@ -0,0 +1,18 @@
+import { createHash } from 'node:crypto';
+
+export function generateChuanglanSign(
+  password: string,
+  params: Record<string, string | undefined>,
+): string {
+  const raw = Object.keys(params)
+    .sort()
+    .reduce((acc, key) => {
+      const value = params[key];
+      if (value != null && value.trim() !== '') {
+        return acc + key + value;
+      }
+      return acc;
+    }, '');
+
+  return createHash('md5').update(raw + password, 'utf8').digest('hex').toLowerCase();
+}

apps/api/src/domains/identity/sms/code.ts

@@ -0,0 +1,3 @@
+export function generateSixDigitCode(): string {
+  return String(Math.floor(Math.random() * 1_000_000)).padStart(6, '0');
+}

apps/api/src/domains/identity/sms/phone.util.ts

@@ -0,0 +1,52 @@
+import { appBadRequest } from '../../../shared/common/app-error';
+import { isSupportedPhoneDial } from '@thebet365/shared';
+
+/** 归一化为创蓝格式：国家区号 + 本地号码（纯数字，无 +） */
+export function normalizePhone(countryDial: string, localInput: string): string {
+  const dial = countryDial.replace(/\D/g, '');
+  let local = localInput.replace(/\D/g, '');
+
+  if (!dial || !local) {
+    throw appBadRequest('PHONE_REQUIRED');
+  }
+  if (!isSupportedPhoneDial(dial)) {
+    throw appBadRequest('PHONE_COUNTRY_UNSUPPORTED');
+  }
+
+  // 马来西亚等本地号常以 0 开头
+  if (local.startsWith('0') && local.length > 1) {
+    local = local.replace(/^0+/, '');
+  }
+
+  const combined = `${dial}${local}`;
+  if (combined.length < 10 || combined.length > 15) {
+    throw appBadRequest('PHONE_INVALID');
+  }
+  return combined;
+}
+
+/** 玩家登录：选国家 + 本地号；字母账号（如 player1）原样返回 */
+export function resolvePlayerLoginUsername(
+  input: string,
+  countryDial?: string,
+): string {
+  const trimmed = input.trim();
+  if (!trimmed) return trimmed;
+
+  if (!/^[\d+\s\-()]+$/.test(trimmed)) {
+    return trimmed;
+  }
+
+  if (countryDial?.trim()) {
+    try {
+      return normalizePhone(countryDial, trimmed);
+    } catch {
+      return trimmed;
+    }
+  }
+
+  const digits = trimmed.replace(/\D/g, '');
+  if (digits.length >= 10) return digits;
+
+  return trimmed;
+}

apps/api/src/domains/identity/sms/sms.controller.ts

@@ -0,0 +1,26 @@
+import { Controller, Post, Body, Req } from '@nestjs/common';
+import { ApiTags } from '@nestjs/swagger';
+import type { Request } from 'express';
+import { SmsService } from './sms.service';
+import { SendSmsCodeDto } from './sms.dto';
+import { Public } from '../../../shared/common/decorators';
+import { jsonResponse } from '../../../shared/common/filters';
+import { getClientIp } from '../../../shared/common/client-ip.util';
+
+@ApiTags('SMS')
+@Controller()
+export class SmsController {
+  constructor(private sms: SmsService) {}
+
+  @Public()
+  @Post('player/sms/send')
+  async send(@Body() dto: SendSmsCodeDto, @Req() req: Request) {
+    const result = await this.sms.sendVerifyCode({
+      phone: dto.phone.trim(),
+      countryCode: dto.countryCode.trim(),
+      locale: dto.locale,
+      clientIp: getClientIp(req),
+    });
+    return jsonResponse(result);
+  }
+}

apps/api/src/domains/identity/sms/sms.dto.ts

@@ -0,0 +1,35 @@
+import { IsString, IsOptional } from 'class-validator';
+import { ApiProperty } from '@nestjs/swagger';
+
+export class SendSmsCodeDto {
+  @ApiProperty({ example: '13800138000', description: '本地手机号，不含国家区号' })
+  @IsString()
+  phone!: string;
+
+  @ApiProperty({ example: '86', description: '国家区号，不含 +' })
+  @IsString()
+  countryCode!: string;
+
+  @ApiProperty({ required: false })
+  @IsOptional()
+  @IsString()
+  locale?: string;
+}
+
+export class VerifySmsCodeDto {
+  @ApiProperty()
+  @IsString()
+  phone!: string;
+
+  @ApiProperty()
+  @IsString()
+  countryCode!: string;
+
+  @ApiProperty()
+  @IsString()
+  code!: string;
+
+  @ApiProperty()
+  @IsString()
+  sessionId!: string;
+}

apps/api/src/domains/identity/sms/sms.module.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+import { SmsService } from './sms.service';
+import { SmsController } from './sms.controller';
+import { ChuanglanClient } from './chuanglan/client';
+
+@Module({
+  providers: [SmsService, ChuanglanClient],
+  controllers: [SmsController],
+  exports: [SmsService],
+})
+export class SmsModule {}

apps/api/src/domains/identity/sms/sms.service.ts

@@ -0,0 +1,95 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { randomUUID } from 'node:crypto';
+import { normalizeLocale } from '@thebet365/shared';
+import { RedisService } from '../../../shared/redis/redis.service';
+import { appBadRequest, appTooManyRequests } from '../../../shared/common/app-error';
+import { ChuanglanClient } from './chuanglan/client';
+import { loadSmsBusinessConfig } from './chuanglan/config';
+import { generateSixDigitCode } from './code';
+import { normalizePhone } from './phone.util';
+import { renderVerifySms } from './templates';
+import type { SmsLang } from './sms.types';
+
+const codeKey = (sessionId: string) => `sms:code:${sessionId}`;
+const phoneRateKey = (phone: string) => `sms:rate:phone:${phone}`;
+const ipRateKey = (ip: string) => `sms:rate:ip:${ip}`;
+
+function mapLocaleToSmsLang(locale?: string): SmsLang {
+  const normalized = normalizeLocale(locale);
+  if (normalized === 'zh-CN') return 'zh';
+  if (normalized === 'ms-MY') return 'ms';
+  return 'en';
+}
+
+@Injectable()
+export class SmsService {
+  private readonly smsCfg;
+
+  constructor(
+    private redis: RedisService,
+    private chuanglan: ChuanglanClient,
+    config: ConfigService,
+  ) {
+    this.smsCfg = loadSmsBusinessConfig(config);
+  }
+
+  async sendVerifyCode(params: {
+    phone: string;
+    countryCode: string;
+    locale?: string;
+    clientIp: string;
+  }): Promise<{ sessionId: string }> {
+    const phone = normalizePhone(params.countryCode, params.phone);
+
+    const [phoneLimited, ipLimited] = await Promise.all([
+      this.redis.exists(phoneRateKey(phone)),
+      this.redis.exists(ipRateKey(params.clientIp)),
+    ]);
+    if (phoneLimited || ipLimited) {
+      throw appTooManyRequests('SMS_RATE_LIMIT');
+    }
+
+    const code = generateSixDigitCode();
+    const sessionId = randomUUID();
+    const lang = mapLocaleToSmsLang(params.locale);
+    const msg = renderVerifySms(lang, code);
+
+    const result = await this.chuanglan.sendSms(phone, msg, sessionId);
+    if (!result.success) {
+      throw appBadRequest('SMS_SEND_FAILED');
+    }
+
+    await Promise.all([
+      this.redis.set(
+        codeKey(sessionId),
+        JSON.stringify({ phone, code }),
+        this.smsCfg.codeTtlSeconds,
+      ),
+      this.redis.set(phoneRateKey(phone), '1', this.smsCfg.rateLimitSeconds),
+      this.redis.set(ipRateKey(params.clientIp), '1', this.smsCfg.rateLimitSeconds),
+    ]);
+
+    return { sessionId };
+  }
+
+  async verifyCode(params: {
+    phone: string;
+    countryCode: string;
+    code: string;
+    sessionId: string;
+  }): Promise<void> {
+    const phone = normalizePhone(params.countryCode, params.phone);
+    const raw = await this.redis.get(codeKey(params.sessionId));
+    if (!raw) {
+      throw appBadRequest('SMS_CODE_EXPIRED');
+    }
+
+    const cached = JSON.parse(raw) as { phone: string; code: string };
+    if (cached.phone !== phone || cached.code !== params.code.trim()) {
+      throw appBadRequest('SMS_CODE_INVALID');
+    }
+
+    await this.redis.del(codeKey(params.sessionId));
+  }
+}

apps/api/src/domains/identity/sms/sms.types.ts

@@ -0,0 +1,14 @@
+export type SmsLang = 'zh' | 'en' | 'vi' | 'ms' | 'kh';
+
+export interface ChuanglanSendResponse {
+  code: string;
+  message: string;
+  data?: { messageId: string };
+}
+
+export interface SmsSendResult {
+  success: boolean;
+  code: string;
+  message: string;
+  messageId?: string;
+}

apps/api/src/domains/identity/sms/templates.ts

@@ -0,0 +1,16 @@
+import type { SmsLang } from './sms.types';
+
+const TEMPLATES: Record<string, string> = {
+  default: '您的验证码是：{code}。5分钟内有效。',
+  zh: '您的验证码是：{code}。5分钟内有效。',
+  en: 'Your verification code is {code}. Valid for 5 minutes.',
+  vi: 'Mã xác minh của bạn là {code}. Có hiệu lực trong 5 phút.',
+  ms: 'Kod pengesahan anda ialah {code}. Sah selama 5 minit.',
+  kh: 'កូដផ្ទៀងផ្ទាត់របស់អ្នកគឺ {code} ។ មានសុពលភាពរយៈពេល ៥ នាទី។',
+};
+
+export function renderVerifySms(lang: SmsLang | undefined, code: string): string {
+  const key = lang?.trim() || 'zh';
+  const tpl = TEMPLATES[key] ?? TEMPLATES.default ?? TEMPLATES.zh;
+  return tpl.replace('{code}', code);
+}

apps/api/src/shared/common/app-error.ts

@@ -1,6 +1,8 @@
 import {
   BadRequestException,
   ForbiddenException,
+  HttpException,
+  HttpStatus,
   NotFoundException,
   UnauthorizedException,
 } from '@nestjs/common';
@@ -33,6 +35,10 @@ export function appUnauthorized(code: ApiErrorCode, params?: ApiErrorParams) {
   return new UnauthorizedException(body(code, params));
 }
 
+export function appTooManyRequests(code: ApiErrorCode, params?: ApiErrorParams) {
+  return new HttpException(body(code, params), HttpStatus.TOO_MANY_REQUESTS);
+}
+
 export function isCodedExceptionResponse(
   res: unknown,
 ): res is { code: ApiErrorCode; params?: ApiErrorParams } {

apps/api/src/shared/common/client-ip.util.ts

@@ -0,0 +1,13 @@
+import type { Request } from 'express';
+
+export function getClientIp(req: Request): string {
+  const forwarded = req.headers['x-forwarded-for'];
+  if (typeof forwarded === 'string' && forwarded.trim()) {
+    return forwarded.split(',')[0]?.trim() || '0.0.0.0';
+  }
+  const realIp = req.headers['x-real-ip'];
+  if (typeof realIp === 'string' && realIp.trim()) {
+    return realIp.trim();
+  }
+  return req.ip || req.socket?.remoteAddress || '0.0.0.0';
+}

apps/api/src/shared/redis/redis.module.ts

@@ -0,0 +1,9 @@
+import { Global, Module } from '@nestjs/common';
+import { RedisService } from './redis.service';
+
+@Global()
+@Module({
+  providers: [RedisService],
+  exports: [RedisService],
+})
+export class RedisModule {}

apps/api/src/shared/redis/redis.service.ts

@@ -0,0 +1,37 @@
+import { Injectable, OnModuleDestroy } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import Redis from 'ioredis';
+
+@Injectable()
+export class RedisService implements OnModuleDestroy {
+  private readonly client: Redis;
+
+  constructor(config: ConfigService) {
+    const url = config.get<string>('REDIS_URL', 'redis://127.0.0.1:6379');
+    this.client = new Redis(url, { maxRetriesPerRequest: 3, lazyConnect: true });
+  }
+
+  async onModuleDestroy() {
+    await this.client.quit();
+  }
+
+  get raw(): Redis {
+    return this.client;
+  }
+
+  async exists(key: string): Promise<boolean> {
+    return (await this.client.exists(key)) > 0;
+  }
+
+  async get(key: string): Promise<string | null> {
+    return this.client.get(key);
+  }
+
+  async set(key: string, value: string, ttlSeconds: number): Promise<void> {
+    await this.client.set(key, value, 'EX', ttlSeconds);
+  }
+
+  async del(key: string): Promise<void> {
+    await this.client.del(key);
+  }
+}