From 502ae8babbd05580ae3dd4a55f625351aea77131 Mon Sep 17 00:00:00 2001
From: Milky0217 <m943790568@163.com>
Date: Thu, 23 Apr 2026 12:34:39 +0800
Subject: [PATCH] =?UTF-8?q?fix(payment):=20payment=5Fpage=E6=94=AF?=
 =?UTF-8?q?=E6=8C=81URL=E5=8F=82=E6=95=B0=E4=BC=A0=E9=80=92JWT=EF=BC=8Cpay?=
 =?UTF-8?q?ment=5Findex=E9=A1=B5=E9=9D=A2=E8=B7=B3=E8=BD=AC=E6=97=B6?=
 =?UTF-8?q?=E6=90=BA=E5=B8=A6JWT?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/handlers/payment.rs | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/src/handlers/payment.rs b/src/handlers/payment.rs
index 4a1a7d8..06c44ab 100644
--- a/src/handlers/payment.rs
+++ b/src/handlers/payment.rs
@@ -314,6 +314,9 @@ pub async fn payment_index() -> Result<HttpResponse, AppError> {
 <div class="notice">支付成功后额度将自动到账，如有疑问请联系客服</div>
 <script>
   let selected = null;
+  // 从 URL 参数获取 JWT（来自小程序的跳转链接）
+  const urlParams = new URLSearchParams(window.location.search);
+  const jwt = urlParams.get('jwt') || '';
   function selectPackage(pkg) {
     selected = pkg;
     document.querySelectorAll('.pkg-card').forEach(c => c.classList.remove('selected'));
@@ -326,7 +329,7 @@ pub async fn payment_index() -> Result<HttpResponse, AppError> {
   }
   function goPay() {
     if (!selected) return;
-    window.location.href = '/payment/page?package=' + selected;
+    window.location.href = '/payment/page?package=' + selected + (jwt ? '&jwt=' + encodeURIComponent(jwt) : '');
   }
 </script>
 </body>
@@ -343,6 +346,9 @@ pub async fn payment_index() -> Result<HttpResponse, AppError> {
 pub struct PaymentPageQuery {
     #[serde(rename = "package")]
     pub package_: String,
+    /// JWT: 从 URL 参数传入（外部浏览器无 Cookie 时使用）
+    #[serde(default)]
+    pub jwt: Option<String>,
 }
 
 #[get("/payment/page")]
@@ -351,7 +357,9 @@ pub async fn payment_page(
     pool: web::Data<PgPool>,
     query: web::Query<PaymentPageQuery>,
 ) -> Result<HttpResponse, AppError> {
-    let token = extract_token(&req).ok_or_else(|| AppError::Unauthorized("未登录".to_string()))?;
+    let token = extract_token(&req)
+        .or_else(|| query.jwt.clone())
+        .ok_or_else(|| AppError::Unauthorized("未登录".to_string()))?;
 
     let claims = crate::auth::verify_token(&token, &get_jwt_secret())
         .map_err(|_| AppError::Unauthorized("Token 无效".to_string()))?;