feat(tender): 阶段3b 企业登录/注册 + 购买→支付→确认 闭环

- useHjcAuth：token 存 cookie(hjc_token)，login/register/isLoggedIn
- 页面 /login /register（企业名称+密码）
- server/api/tender/{auth/login,auth/register,pay,mark-paid} 代理；order 代理从 cookie 读取 hjc_token 透传 Authorization
- BuyDocument：未登录跳登录；下单→pay(codeUrl)→确认 mark-paid→成功
- types 增 HjcUser

server/api/tender/auth/login.post.ts

@@ -0,0 +1,32 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler, readBody } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../../utils/tenant'
+
+/**
+ * 企业登录
+ * POST /api/tender/login { enterpriseName, password }
+ * 代理到 mp-api /api/hjc/auth/login；成功返回 LoginResult{ access_token, user }。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+  const body = await readBody(event)
+
+  try {
+    const res = await $fetch('/hjc/auth/login', {
+      baseURL: config.public.modulesApiBase,
+      method: 'POST',
+      headers: { TenantId: ctx.tenantId },
+      query: { TenantId: ctx.tenantId },
+      body
+    }) as any
+    const data = res && res.data !== undefined ? res.data : res
+    return data
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.statusMessage || 'Failed to login'
+    })
+  }
+})

server/api/tender/auth/register.post.ts

@@ -0,0 +1,32 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler, readBody } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../../utils/tenant'
+
+/**
+ * 企业注册
+ * POST /api/tender/register { enterpriseName, password, creditCode, ... }
+ * 代理到 mp-api /api/hjc/auth/register；成功返回 LoginResult{ access_token, user }。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+  const body = await readBody(event)
+
+  try {
+    const res = await $fetch('/hjc/auth/register', {
+      baseURL: config.public.modulesApiBase,
+      method: 'POST',
+      headers: { TenantId: ctx.tenantId },
+      query: { TenantId: ctx.tenantId },
+      body
+    }) as any
+    const data = res && res.data !== undefined ? res.data : res
+    return data
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.statusMessage || 'Failed to register'
+    })
+  }
+})

server/api/tender/mark-paid.put.ts

@@ -0,0 +1,37 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler, readBody, getHeader, getCookie } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../utils/tenant'
+
+/**
+ * 标记订单已支付（幂等）并触发一站式推送
+ * PUT /api/tender/mark-paid { orderNo }
+ * 代理到 mp-api /api/hjc/order/mark-paid；需登录态。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+  const body = await readBody(event)
+  const cookieToken = getCookie(event, 'hjc_token')
+  const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
+
+  try {
+    const res = await $fetch('/hjc/order/mark-paid', {
+      baseURL: config.public.modulesApiBase,
+      method: 'PUT',
+      headers: {
+        TenantId: ctx.tenantId,
+        ...(auth ? { Authorization: auth } : {})
+      },
+      query: { TenantId: ctx.tenantId },
+      body
+    }) as any
+    const data = res && res.data !== undefined ? res.data : res
+    return data
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.statusMessage || 'Failed to mark paid'
+    })
+  }
+})

server/api/tender/order.post.ts

@@ -1,18 +1,19 @@
 import { $fetch } from 'ofetch'
-import { createError, defineEventHandler, readBody, getHeader } from 'h3'
+import { createError, defineEventHandler, readBody, getHeader, getCookie } from 'h3'
 import { useRuntimeConfig } from '#imports'
 import { getTenantFromContext } from '../../utils/tenant'
 
 /**
  * 创建标书订单
  * POST /api/tender/order { projectId, quantity, contactName, contactPhone, contactEmail }
- * 代理到 mp-api（mp-java） /api/hjc/order/create；需登录态（Authorization 透传）。
+ * 代理到 mp-api（mp-java） /api/hjc/order/create；需登录态（从 cookie hjc_token 或 Authorization 透传）。
  */
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
   const ctx = getTenantFromContext(event, config)
   const body = await readBody(event)
-  const auth = getHeader(event, 'authorization')
+  const cookieToken = getCookie(event, 'hjc_token')
+  const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
 
   try {
     const res = await $fetch('/hjc/order/create', {

server/api/tender/pay.post.ts

@@ -0,0 +1,37 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler, readBody, getHeader, getCookie } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../utils/tenant'
+
+/**
+ * 发起支付（微信Native扫码，返回 codeUrl）
+ * POST /api/tender/pay { orderNo }
+ * 代理到 mp-api /api/hjc/order/pay；需登录态。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+  const body = await readBody(event)
+  const cookieToken = getCookie(event, 'hjc_token')
+  const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
+
+  try {
+    const res = await $fetch('/hjc/order/pay', {
+      baseURL: config.public.modulesApiBase,
+      method: 'POST',
+      headers: {
+        TenantId: ctx.tenantId,
+        ...(auth ? { Authorization: auth } : {})
+      },
+      query: { TenantId: ctx.tenantId },
+      body
+    }) as any
+    const data = res && res.data !== undefined ? res.data : res
+    return data
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.statusMessage || 'Failed to pay'
+    })
+  }
+})