From d0c2dd17cb039ae31e8546cb56c5ac9f70d1ddcd Mon Sep 17 00:00:00 2001
From: "weicw1996@qq.com" <weicw1996@qq.com>
Date: Thu, 10 Sep 2026 23:44:19 +0800
Subject: [PATCH] =?UTF-8?q?feat(tender):=20=E7=99=BB=E5=BD=95=E5=8A=A0?=
 =?UTF-8?q?=E5=9B=BE=E5=BD=A2=E9=AA=8C=E8=AF=81=E7=A0=81=E3=80=81=E6=B3=A8?=
 =?UTF-8?q?=E5=86=8C=E5=8A=A0=E7=9F=AD=E4=BF=A1=E9=AA=8C=E8=AF=81=E7=A0=81?=
 =?UTF-8?q?=EF=BC=9B=E6=94=B9=E6=8C=89=20body.code=20=E5=88=A4=E5=AE=9A=20?=
 =?UTF-8?q?401/403?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 新增 captcha / sms / logout 三个 Nuxt server 代理
- 修复代理把 ApiResult 拍扁成 data 的问题（my-orders、enterprise、order、pay、
  mark-paid）：登录态失败被前端当成「没有订单 / 未提交资质」，无法区分
- 新增 handleAuthCode 统一处理：401 → 清凭据并跳 /login?redirect=…；
  403 → 只提示「没有访问权限」，不清 token、不跳登录页
- 登录页与注册页分别接入图形验证码与短信验证码（含 60s 倒计时）
- 修复回跳开放重定向：redirect 参数安全解码且只接受站内路径
  （拒绝 //evil.com、https://… 及反斜杠变体 /\evil.com）
- 下单成功但发起支付失败时停在支付步，避免用户重提交产生重复订单
---
 app/components/HjcUserBar.vue                 |   5 +-
 app/composables/useHjcAuth.ts                 | 115 +++++++++++++++++-
 app/pages/login.vue                           |  83 ++++++++++++-
 app/pages/register.vue                        |  94 +++++++++++++-
 app/pages/tender/orders.vue                   |  17 ++-
 app/pages/tender/qualification.vue            |  28 ++++-
 .../template-07/pages/BuyDocument.vue         |  46 +++++--
 server/api/tender/captcha.get.ts              |  32 +++++
 server/api/tender/enterprise.get.ts           |  10 +-
 server/api/tender/logout.post.ts              |  36 ++++++
 server/api/tender/mark-paid.put.ts            |   8 +-
 server/api/tender/my-orders.get.ts            |  10 +-
 server/api/tender/order.post.ts               |   8 +-
 server/api/tender/pay.post.ts                 |   8 +-
 server/api/tender/sms.post.ts                 |  34 ++++++
 15 files changed, 485 insertions(+), 49 deletions(-)
 create mode 100644 server/api/tender/captcha.get.ts
 create mode 100644 server/api/tender/logout.post.ts
 create mode 100644 server/api/tender/sms.post.ts

diff --git a/app/components/HjcUserBar.vue b/app/components/HjcUserBar.vue
index f41cbba..5ae2533 100644
--- a/app/components/HjcUserBar.vue
+++ b/app/components/HjcUserBar.vue
@@ -17,8 +17,9 @@
 const { isLoggedIn, user, logout } = useHjcAuth()
 const loggedIn = ref(isLoggedIn())
 
-function doLogout() {
-  logout()
+async function doLogout() {
+  // logout() 会先通知后端（无服务端会话），再清本地凭据
+  await logout()
   return navigateTo('/tender')
 }
 </script>
diff --git a/app/composables/useHjcAuth.ts b/app/composables/useHjcAuth.ts
index d0e5c0a..ab77114 100644
--- a/app/composables/useHjcAuth.ts
+++ b/app/composables/useHjcAuth.ts
@@ -1,5 +1,17 @@
 import type { HjcUser } from '~/types/tender'
 
+/**
+ * 后端 ApiResult.code 的登录态语义。
+ *
+ * <b>HTTP 状态码恒为 200</b>，失败一律靠 body 的 code 判定：
+ * - 0   成功
+ * - 401 未登录或 token 失效 → 清本地凭据并跳登录页
+ * - 403 已登录但无权限（message「没有访问权限」）→ 只提示，<b>不清 token、不跳登录页</b>
+ * - 其他非 0 → 业务失败，展示 message
+ */
+export const HJC_CODE_UNAUTHORIZED = 401
+export const HJC_CODE_FORBIDDEN = 403
+
 /** 登录态（token 存 cookie，SSR 安全；服务器端代理从 cookie 读取并转发 Authorization） */
 export function useHjcAuth() {
   const token = useCookie<string | null>('hjc_token', {
@@ -12,11 +24,82 @@ export function useHjcAuth() {
     return !!token.value
   }
 
-  async function login(enterpriseName: string, password: string) {
+  /** 清本地凭据（token 是无状态 JWT，后端无会话，清本地即退出） */
+  function clearCredentials() {
+    token.value = null
+    user.value = null
+  }
+
+  /**
+   * 统一处理 ApiResult 的登录态失败：**只看 body.code，不看 HTTP 状态码**。
+   *
+   * @param res 服务器代理透传的 ApiResult
+   * @param redirect 401 跳登录页时带上，便于登录后回跳
+   * @returns handled=true 表示已按登录态问题处理完（401 已跳转 / 403 带提示文案）；
+   *          handled=false 表示不是登录态问题，交调用方按业务失败处理
+   */
+  async function handleAuthCode(
+    res: any,
+    redirect = '/'
+  ): Promise<{ handled: boolean; message?: string }> {
+    const code = Number(res?.code)
+    if (code === HJC_CODE_UNAUTHORIZED) {
+      clearCredentials()
+      await navigateTo(`/login?redirect=${encodeURIComponent(redirect)}`)
+      return { handled: true }
+    }
+    if (code === HJC_CODE_FORBIDDEN) {
+      // 已登录但无权限：不清 token、不跳登录页，仅提示后端 message
+      return { handled: true, message: res?.message || '没有访问权限' }
+    }
+    return { handled: false }
+  }
+
+  /**
+   * 拉取登录用图形验证码。
+   * 后端只返回图片（data:image/png;base64,...），不下发答案，需用户肉眼识别后输入。
+   */
+  async function fetchCaptcha(): Promise<{ ok: boolean; image?: string; message?: string }> {
+    try {
+      // 带时间戳，避免浏览器/中间层缓存旧验证码图片
+      const res: any = await $fetch('/api/tender/captcha', { query: { t: Date.now() } })
+      if (res?.code === 0 && res.data?.image) {
+        return { ok: true, image: res.data.image }
+      }
+      return { ok: false, message: res?.message || '验证码获取失败' }
+    } catch (e: any) {
+      return { ok: false, message: e?.data?.statusMessage || e?.data?.message || e?.message || '验证码获取失败' }
+    }
+  }
+
+  /**
+   * 发送注册短信验证码。
+   * @param phone 经办人手机号（即账号手机号），后端据此发码
+   */
+  async function sendSms(phone: string): Promise<{ ok: boolean; message?: string }> {
+    try {
+      const res: any = await $fetch('/api/tender/sms', {
+        method: 'POST',
+        body: { phone }
+      })
+      if (res?.code === 0) {
+        return { ok: true, message: res?.message || '验证码已发送' }
+      }
+      return { ok: false, message: res?.message || '验证码发送失败' }
+    } catch (e: any) {
+      return { ok: false, message: e?.data?.statusMessage || e?.data?.message || e?.message || '验证码发送失败' }
+    }
+  }
+
+  /**
+   * 企业登录
+   * @param code 图形验证码（必填，后端先校验非空）
+   */
+  async function login(enterpriseName: string, password: string, code: string) {
     try {
       const res: any = await $fetch('/api/tender/login', {
         method: 'POST',
-        body: { enterpriseName, password }
+        body: { enterpriseName, password, code }
       })
       // mp-api 统一返回 ApiResult{code,message,data}，code===0 成功
       if (res?.code === 0 && res.data?.access_token) {
@@ -30,6 +113,10 @@ export function useHjcAuth() {
     }
   }
 
+  /**
+   * 企业注册（一站式）
+   * @param payload 注册字段 + `code`（短信验证码，发给经办人手机号）
+   */
   async function register(payload: Record<string, any>) {
     try {
       const res: any = await $fetch('/api/tender/register', {
@@ -47,10 +134,26 @@ export function useHjcAuth() {
     }
   }
 
-  function logout() {
-    token.value = null
-    user.value = null
+  /** 退出登录：先通知后端（无服务端会话，仅为契约完整），再清本地凭据 */
+  async function logout() {
+    try {
+      await $fetch('/api/tender/logout', { method: 'POST' })
+    } catch {
+      // 退出接口失败不阻断本地退出：token 是无状态 JWT，清本地凭据即已登出
+    }
+    clearCredentials()
   }
 
-  return { token, user, isLoggedIn, login, register, logout }
+  return {
+    token,
+    user,
+    isLoggedIn,
+    clearCredentials,
+    handleAuthCode,
+    fetchCaptcha,
+    sendSms,
+    login,
+    register,
+    logout
+  }
 }
diff --git a/app/pages/login.vue b/app/pages/login.vue
index 2d47b59..53d29db 100644
--- a/app/pages/login.vue
+++ b/app/pages/login.vue
@@ -11,6 +11,33 @@
           <label class="text-sm text-gray-600">密码</label>
           <input v-model="password" type="password" class="mt-1 w-full rounded-md border border-gray-300 px-4 py-2 text-sm" placeholder="请输入密码" />
         </div>
+        <div>
+          <label class="text-sm text-gray-600">图形验证码</label>
+          <div class="mt-1 flex items-center gap-2">
+            <input
+              v-model="code"
+              class="w-full rounded-md border border-gray-300 px-4 py-2 text-sm"
+              placeholder="请输入图片中的验证码"
+              autocomplete="off"
+            />
+            <img
+              v-if="captchaImage"
+              :src="captchaImage"
+              alt="图形验证码"
+              title="看不清？点击换一张"
+              class="h-[38px] w-28 shrink-0 cursor-pointer rounded-md border border-gray-300 object-cover"
+              @click="refreshCaptcha"
+            />
+            <button
+              v-else
+              type="button"
+              class="h-[38px] w-28 shrink-0 rounded-md border border-gray-300 text-xs text-gray-600 hover:bg-gray-50"
+              @click="refreshCaptcha"
+            >
+              获取验证码
+            </button>
+          </div>
+        </div>
         <button type="submit" class="w-full rounded-md bg-blue-600 py-3 text-white font-medium hover:bg-blue-700 disabled:opacity-50" :disabled="loading">
           {{ loading ? '登录中...' : '登录' }}
         </button>
@@ -25,22 +52,72 @@
 </template>
 
 <script setup lang="ts">
-const { login } = useHjcAuth()
+const { login, fetchCaptcha } = useHjcAuth()
 const route = useRoute()
 const enterpriseName = ref('')
 const password = ref('')
+/** 图形验证码（后端只下发图片，答案由用户肉眼识别后输入） */
+const code = ref('')
+const captchaImage = ref('')
 const loading = ref(false)
 const error = ref('')
 
+/** 拉取/刷新图形验证码图片；失败时提示并允许点击重试 */
+async function refreshCaptcha() {
+  code.value = ''
+  const res = await fetchCaptcha()
+  if (res.ok && res.image) {
+    captchaImage.value = res.image
+    return
+  }
+  captchaImage.value = ''
+  // 不覆盖已有错误（如登录失败 message），仅在无错误时提示验证码本身的问题
+  if (!error.value) error.value = res.message || '验证码获取失败，请点击重试'
+}
+
+/**
+ * 登录成功后的去向：`redirect` 可能被 encodeURIComponent 过（如 /buy%3Fid%3D3），
+ * 这里安全解码；仅接受站内路径，避免开放重定向。
+ */
+function resolveRedirect() {
+  const raw = (route.query.redirect as string) || ''
+  if (!raw) return '/tender'
+  let target = raw
+  try {
+    target = decodeURIComponent(raw)
+  } catch {
+    target = raw
+  }
+  // 必须以单个 '/' 开头：排除 http(s)://、协议相对地址 //evil.com，
+  // 以及反斜杠变体 /\evil.com（部分浏览器把 '\' 归一成 '/'，等价于 //evil.com）
+  return target.startsWith('/') && !target.startsWith('//') && !target.includes('\\') ? target : '/tender'
+}
+
+onMounted(refreshCaptcha)
+
 async function submitForm() {
   error.value = ''
+  if (!enterpriseName.value.trim()) {
+    error.value = '请输入企业名称'
+    return
+  }
+  if (!password.value) {
+    error.value = '请输入密码'
+    return
+  }
+  if (!code.value.trim()) {
+    error.value = '请输入图形验证码'
+    return
+  }
   loading.value = true
   try {
-    const res = await login(enterpriseName.value, password.value)
+    const res = await login(enterpriseName.value.trim(), password.value, code.value.trim())
     if (res.ok) {
-      return navigateTo((route.query.redirect as string) || '/tender')
+      return navigateTo(resolveRedirect())
     }
     error.value = res.message || '登录失败'
+    // 验证码一次性，失败后换一张，避免用户用同一个码反复提交
+    await refreshCaptcha()
   } catch (e: any) {
     error.value = e?.message || '登录失败'
   } finally {
diff --git a/app/pages/register.vue b/app/pages/register.vue
index 557f5be..8f6b7af 100644
--- a/app/pages/register.vue
+++ b/app/pages/register.vue
@@ -12,6 +12,28 @@
           show-password
         />
 
+        <!-- 短信验证码：发到「经办人手机号」（即账号手机号），注册接口的 code 用它校验 -->
+        <div class="space-y-1">
+          <label class="block text-sm text-gray-600">短信验证码</label>
+          <div class="flex items-center gap-2">
+            <input
+              v-model="smsCode"
+              class="w-full rounded-md border border-gray-300 px-4 py-2 text-sm"
+              placeholder="发送至上方填写的经办人手机号"
+              autocomplete="off"
+            />
+            <button
+              type="button"
+              class="h-[38px] w-32 shrink-0 rounded-md border border-gray-300 text-xs text-gray-600 hover:bg-gray-50 disabled:cursor-not-allowed disabled:opacity-50"
+              :disabled="countdown > 0 || sending"
+              @click="sendCode"
+            >
+              {{ countdown > 0 ? `${countdown} 秒后重发` : sending ? '发送中...' : '发送验证码' }}
+            </button>
+          </div>
+          <p class="text-xs text-gray-400">验证码发到「经办人手机号」，该号码就是登录账号手机号</p>
+        </div>
+
         <p class="text-center text-xs text-gray-500">
           企业联系电话、企业地址选填，其余项必填；提交后等待平台审核，审核通过方可购买标书
         </p>
@@ -35,12 +57,38 @@
 </template>
 
 <script setup lang="ts">
-const { register } = useHjcAuth()
+const { register, sendSms } = useHjcAuth()
 const route = useRoute()
 const loading = ref(false)
 const error = ref('')
 const entForm = ref<any>(null)
 
+/** 短信验证码（注册接口的 code）+ 发送倒计时 */
+const smsCode = ref('')
+const sending = ref(false)
+const countdown = ref(0)
+let countdownTimer: ReturnType<typeof setInterval> | null = null
+
+const SMS_COUNTDOWN_SECONDS = 60
+
+/**
+ * 注册成功后的去向：`redirect` 可能被 encodeURIComponent 过（如 /buy%3Fid%3D3），
+ * 这里安全解码；仅接受站内路径，避免开放重定向。
+ */
+function resolveRedirect() {
+  const raw = (route.query.redirect as string) || ''
+  if (!raw) return '/tender'
+  let target = raw
+  try {
+    target = decodeURIComponent(raw)
+  } catch {
+    target = raw
+  }
+  // 必须以单个 '/' 开头：排除 http(s)://、协议相对地址 //evil.com，
+  // 以及反斜杠变体 /\evil.com（部分浏览器把 '\' 归一成 '/'，等价于 //evil.com）
+  return target.startsWith('/') && !target.startsWith('//') && !target.includes('\\') ? target : '/tender'
+}
+
 const form = ref<Record<string, any>>({
   name: '',
   password: '',
@@ -62,9 +110,49 @@ const materials = ref<any[]>([
   { materialType: 'license', label: '营业执照', materialName: '营业执照', fileUrl: '' }
 ])
 
+/** 停止倒计时（倒计时结束或页面卸载时调用） */
+function stopCountdown() {
+  if (countdownTimer) {
+    clearInterval(countdownTimer)
+    countdownTimer = null
+  }
+  countdown.value = 0
+}
+
+/** 发送短信验证码到经办人手机号（= 账号手机号） */
+async function sendCode() {
+  error.value = ''
+  const phone = String(form.value.agentPhone || '').trim()
+  if (!phone) {
+    error.value = '请先填写经办人手机号'
+    return
+  }
+  sending.value = true
+  try {
+    const res = await sendSms(phone)
+    if (!res.ok) {
+      error.value = res.message || '验证码发送失败'
+      return
+    }
+    countdown.value = SMS_COUNTDOWN_SECONDS
+    countdownTimer = setInterval(() => {
+      countdown.value -= 1
+      if (countdown.value <= 0) stopCountdown()
+    }, 1000)
+  } finally {
+    sending.value = false
+  }
+}
+
+onUnmounted(stopCountdown)
+
 async function submitForm() {
   error.value = ''
   if (!entForm.value?.validate()) return
+  if (!smsCode.value.trim()) {
+    error.value = '请输入短信验证码'
+    return
+  }
   loading.value = true
   try {
     // buildPayload 返回 { name, ... }；注册接口用 enterpriseName 作为登录账号
@@ -72,10 +160,12 @@ async function submitForm() {
     const res = await register({
       enterpriseName: name,
       password: form.value.password,
+      // code = 短信验证码（登录接口的 code 是图形验证码，两者不同）
+      code: smsCode.value.trim(),
       ...rest
     })
     if (res.ok) {
-      return navigateTo((route.query.redirect as string) || '/tender')
+      return navigateTo(resolveRedirect())
     }
     error.value = res.message || '注册失败'
   } catch (e: any) {
diff --git a/app/pages/tender/orders.vue b/app/pages/tender/orders.vue
index 1e4540e..15f0b4d 100644
--- a/app/pages/tender/orders.vue
+++ b/app/pages/tender/orders.vue
@@ -10,6 +10,8 @@
       <NuxtLink to="/login?redirect=/tender/orders" class="mt-4 inline-block rounded-md bg-blue-600 px-6 py-2 text-white hover:bg-blue-700">去登录</NuxtLink>
     </div>
 
+    <div v-else-if="error" class="py-20 text-center text-red-500">{{ error }}</div>
+
     <div v-else-if="orders.length" class="space-y-4">
       <div v-for="o in orders" :key="o.id" class="rounded-lg border border-gray-200 p-5">
         <div class="flex items-start justify-between">
@@ -32,10 +34,11 @@
 </template>
 
 <script setup lang="ts">
-const { isLoggedIn } = useHjcAuth()
+const { isLoggedIn, handleAuthCode } = useHjcAuth()
 const loggedIn = ref(false)
 const orders = shallowRef<any[]>([])
 const loaded = ref(false)
+const error = ref('')
 
 function formatMoney(n?: number | string) {
   return Number(n ?? 0).toFixed(2)
@@ -54,8 +57,18 @@ function payStatusClass(s?: number) {
 
 loggedIn.value = isLoggedIn()
 if (loggedIn.value) {
+  // 代理原样透传 ApiResult：按 body.code 判定（HTTP 状态码恒为 200，不可用于判定）
   const res: any = await $fetch('/api/tender/my-orders')
-  orders.value = Array.isArray(res) ? res : []
+  const auth = await handleAuthCode(res, '/tender/orders')
+  if (auth.handled) {
+    // 401 已清凭据并跳登录页；403 只提示「没有访问权限」，不清 token
+    error.value = auth.message || ''
+    loggedIn.value = isLoggedIn()
+  } else if (res?.code === 0) {
+    orders.value = Array.isArray(res.data) ? res.data : []
+  } else {
+    error.value = res?.message || '订单加载失败'
+  }
   loaded.value = true
 } else {
   loaded.value = true
diff --git a/app/pages/tender/qualification.vue b/app/pages/tender/qualification.vue
index effa3f1..715c4f6 100644
--- a/app/pages/tender/qualification.vue
+++ b/app/pages/tender/qualification.vue
@@ -47,7 +47,7 @@
 </template>
 
 <script setup lang="ts">
-const { isLoggedIn } = useHjcAuth()
+const { isLoggedIn, handleAuthCode } = useHjcAuth()
 const loggedIn = ref(false)
 const authStatus = ref(-1)
 const rejectReason = ref('')
@@ -88,11 +88,24 @@ const authStatusClass = computed(() => {
 const readonly = computed(() => authStatus.value === 0 || authStatus.value === 1)
 
 async function load() {
+  // 代理原样透传 ApiResult：按 body.code 判定（HTTP 状态码恒为 200，不可用于判定）
   const res: any = await $fetch('/api/tender/enterprise')
-  if (res) {
-    authStatus.value = res.authStatus ?? -1
-    rejectReason.value = res.rejectReason || ''
-    entForm.value?.fill(res)
+  const auth = await handleAuthCode(res, '/tender/qualification')
+  if (auth.handled) {
+    // 401 已清凭据并跳登录页；403 只提示「没有访问权限」，不清 token
+    error.value = auth.message || ''
+    loggedIn.value = isLoggedIn()
+    return
+  }
+  if (res?.code !== 0) {
+    error.value = res?.message || '资质信息加载失败'
+    return
+  }
+  const data = res.data
+  if (data) {
+    authStatus.value = data.authStatus ?? -1
+    rejectReason.value = data.rejectReason || ''
+    entForm.value?.fill(data)
   }
 }
 
@@ -106,6 +119,11 @@ async function submit() {
       method: 'POST',
       body: entForm.value.buildPayload()
     })
+    const auth = await handleAuthCode(res, '/tender/qualification')
+    if (auth.handled) {
+      error.value = auth.message || ''
+      return
+    }
     if (res?.code !== 0) {
       error.value = res?.message || '提交失败'
       return
diff --git a/app/templates/template-07/pages/BuyDocument.vue b/app/templates/template-07/pages/BuyDocument.vue
index 585ae45..e6ffd5f 100644
--- a/app/templates/template-07/pages/BuyDocument.vue
+++ b/app/templates/template-07/pages/BuyDocument.vue
@@ -78,7 +78,7 @@ import type { Tender } from '~/types/tender'
 
 const route = useRoute()
 const id = route.query.id as string
-const { isLoggedIn } = useHjcAuth()
+const { isLoggedIn, handleAuthCode } = useHjcAuth()
 
 const loggedIn = ref(false)
 const tender = shallowRef<Tender | null>(null)
@@ -102,6 +102,7 @@ async function submit() {
   error.value = ''
   submitting.value = true
   try {
+    // 代理原样透传 ApiResult：按 body.code 判定（HTTP 状态码恒为 200，不可用于判定）
     const order: any = await $fetch('/api/tender/order', {
       method: 'POST',
       body: {
@@ -112,15 +113,31 @@ async function submit() {
         contactEmail: form.contactEmail
       }
     })
-    if (order && order.orderNo) {
-      orderNo.value = order.orderNo
-      totalAmount.value = order.totalAmount || 0
-      // 发起支付
-      const pay: any = await $fetch('/api/tender/pay', { method: 'POST', body: { orderNo: order.orderNo } })
-      codeUrl.value = pay?.codeUrl || ''
-      step.value = 'pay'
-    } else {
+    const orderAuth = await handleAuthCode(order, redirect.value)
+    if (orderAuth.handled) {
+      // 401 已清凭据并跳登录页；403 只提示「没有访问权限」，不清 token
+      error.value = orderAuth.message || ''
+      return
+    }
+    if (order?.code !== 0) {
       error.value = order?.message || '下单失败'
+      return
+    }
+    orderNo.value = order.data?.orderNo || ''
+    totalAmount.value = order.data?.totalAmount || 0
+    // 发起支付
+    const pay: any = await $fetch('/api/tender/pay', { method: 'POST', body: { orderNo: orderNo.value } })
+    const payAuth = await handleAuthCode(pay, redirect.value)
+    if (payAuth.handled) {
+      error.value = payAuth.message || ''
+      return
+    }
+    // 订单已创建：即使发起支付失败也停在支付步骤，避免用户重提交产生重复订单
+    step.value = 'pay'
+    if (pay?.code === 0) {
+      codeUrl.value = pay.data?.codeUrl || ''
+    } else {
+      error.value = pay?.message || '发起支付失败，请稍后重试'
     }
   } catch (e: any) {
     error.value = e?.data?.message || e?.message || '下单失败'
@@ -133,7 +150,16 @@ async function markPaid() {
   error.value = ''
   marking.value = true
   try {
-    await $fetch('/api/tender/mark-paid', { method: 'PUT', body: { orderNo: orderNo.value } })
+    const res: any = await $fetch('/api/tender/mark-paid', { method: 'PUT', body: { orderNo: orderNo.value } })
+    const auth = await handleAuthCode(res, redirect.value)
+    if (auth.handled) {
+      error.value = auth.message || ''
+      return
+    }
+    if (res?.code !== 0) {
+      error.value = res?.message || '确认失败'
+      return
+    }
     step.value = 'done'
   } catch (e: any) {
     error.value = e?.data?.message || e?.message || '确认失败'
diff --git a/server/api/tender/captcha.get.ts b/server/api/tender/captcha.get.ts
new file mode 100644
index 0000000..b8e3166
--- /dev/null
+++ b/server/api/tender/captcha.get.ts
@@ -0,0 +1,32 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../utils/tenant'
+
+/**
+ * 图形验证码（登录用）
+ * GET /api/tender/captcha
+ * 代理到 mp-api /api/hjc/auth/captcha；匿名可访问。
+ *
+ * 约定：mp-api 原样透传 ApiResult{code,message,data}，
+ * data = { image: 'data:image/png;base64,...' }。<b>后端刻意不下发答案</b>，
+ * 必须把图片显示给用户肉眼识别后输入，前端不得（也无法）自行校验答案。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+
+  try {
+    return await $fetch('/hjc/auth/captcha', {
+      baseURL: config.public.modulesApiBase,
+      method: 'GET',
+      headers: { TenantId: ctx.tenantId },
+      query: { TenantId: ctx.tenantId }
+    })
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.data?.message || error?.statusMessage || 'Failed to fetch captcha'
+    })
+  }
+})
diff --git a/server/api/tender/enterprise.get.ts b/server/api/tender/enterprise.get.ts
index 856d46e..af6819b 100644
--- a/server/api/tender/enterprise.get.ts
+++ b/server/api/tender/enterprise.get.ts
@@ -7,6 +7,10 @@ import { getTenantFromContext } from '../../utils/tenant'
  * 我的企业资质（含证件材料）
  * GET /api/tender/enterprise
  * 代理到 mp-api /api/hjc/enterprise/my；需登录态。
+ *
+ * 约定：原样透传 ApiResult{code,message,data}。HTTP 状态码恒为 200，
+ * 「未登录/token 失效」是 code=401、「无权限」是 code=403，前端必须按 code 判定；
+ * 故这里**不能**只取 data，否则登录态失败会被误当成「未提交资质」。
  */
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
@@ -15,16 +19,14 @@ export default defineEventHandler(async (event) => {
   const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
 
   try {
-    const res = await $fetch('/hjc/enterprise/my', {
+    return await $fetch('/hjc/enterprise/my', {
       baseURL: config.public.modulesApiBase,
       headers: {
         TenantId: ctx.tenantId,
         ...(auth ? { Authorization: auth } : {})
       },
       query: { TenantId: ctx.tenantId }
-    }) as any
-    const data = res && res.data !== undefined ? res.data : res
-    return data
+    })
   } catch (error: any) {
     throw createError({
       statusCode: error?.statusCode || error?.response?.status || 502,
diff --git a/server/api/tender/logout.post.ts b/server/api/tender/logout.post.ts
new file mode 100644
index 0000000..703c9c4
--- /dev/null
+++ b/server/api/tender/logout.post.ts
@@ -0,0 +1,36 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler, getHeader, getCookie } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../utils/tenant'
+
+/**
+ * 退出登录
+ * POST /api/tender/logout
+ * 代理到 mp-api /api/hjc/auth/logout。
+ *
+ * 说明：后端不维护服务端会话与 token 黑名单（token 是无状态 JWT），
+ * 调用本接口只为契约完整；<b>前端清本地凭据才是真正生效的退出</b>。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+  const cookieToken = getCookie(event, 'hjc_token')
+  const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
+
+  try {
+    return await $fetch('/hjc/auth/logout', {
+      baseURL: config.public.modulesApiBase,
+      method: 'POST',
+      headers: {
+        TenantId: ctx.tenantId,
+        ...(auth ? { Authorization: auth } : {})
+      },
+      query: { TenantId: ctx.tenantId }
+    })
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.data?.message || error?.statusMessage || 'Failed to logout'
+    })
+  }
+})
diff --git a/server/api/tender/mark-paid.put.ts b/server/api/tender/mark-paid.put.ts
index 24f5c19..72dc06e 100644
--- a/server/api/tender/mark-paid.put.ts
+++ b/server/api/tender/mark-paid.put.ts
@@ -7,6 +7,8 @@ import { getTenantFromContext } from '../../utils/tenant'
  * 标记订单已支付（幂等）并触发一站式推送
  * PUT /api/tender/mark-paid { orderNo }
  * 代理到 mp-api /api/hjc/order/mark-paid；需登录态。
+ *
+ * 约定：原样透传 ApiResult{code,message,data}，由前端按 code 判定登录态与业务失败。
  */
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
@@ -16,7 +18,7 @@ export default defineEventHandler(async (event) => {
   const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
 
   try {
-    const res = await $fetch('/hjc/order/mark-paid', {
+    return await $fetch('/hjc/order/mark-paid', {
       baseURL: config.public.modulesApiBase,
       method: 'PUT',
       headers: {
@@ -25,9 +27,7 @@ export default defineEventHandler(async (event) => {
       },
       query: { TenantId: ctx.tenantId },
       body
-    }) as any
-    const data = res && res.data !== undefined ? res.data : res
-    return data
+    })
   } catch (error: any) {
     throw createError({
       statusCode: error?.statusCode || error?.response?.status || 502,
diff --git a/server/api/tender/my-orders.get.ts b/server/api/tender/my-orders.get.ts
index fec1750..5451af6 100644
--- a/server/api/tender/my-orders.get.ts
+++ b/server/api/tender/my-orders.get.ts
@@ -7,6 +7,10 @@ import { getTenantFromContext } from '../../utils/tenant'
  * 我的订单列表
  * GET /api/tender/my-orders
  * 代理到 mp-api /api/hjc/order/my；需登录态。
+ *
+ * 约定：原样透传 ApiResult{code,message,data}。HTTP 状态码恒为 200，
+ * 「未登录/token 失效」是 code=401、「无权限」是 code=403，前端必须按 code 判定；
+ * 故这里**不能**只取 data，否则登录态失败会被误当成「没有订单」。
  */
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
@@ -15,16 +19,14 @@ export default defineEventHandler(async (event) => {
   const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
 
   try {
-    const res = await $fetch('/hjc/order/my', {
+    return await $fetch('/hjc/order/my', {
       baseURL: config.public.modulesApiBase,
       headers: {
         TenantId: ctx.tenantId,
         ...(auth ? { Authorization: auth } : {})
       },
       query: { TenantId: ctx.tenantId }
-    }) as any
-    const data = res && res.data !== undefined ? res.data : res
-    return data
+    })
   } catch (error: any) {
     throw createError({
       statusCode: error?.statusCode || error?.response?.status || 502,
diff --git a/server/api/tender/order.post.ts b/server/api/tender/order.post.ts
index ee17649..7b0cd66 100644
--- a/server/api/tender/order.post.ts
+++ b/server/api/tender/order.post.ts
@@ -7,6 +7,9 @@ import { getTenantFromContext } from '../../utils/tenant'
  * 创建标书订单
  * POST /api/tender/order { projectId, quantity, contactName, contactPhone, contactEmail }
  * 代理到 mp-api（mp-java） /api/hjc/order/create；需登录态（从 cookie hjc_token 或 Authorization 透传）。
+ *
+ * 约定：原样透传 ApiResult{code,message,data}，由前端按 code 判定
+ * （401 未登录/token 失效、403 无权限、其余为业务失败）。
  */
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
@@ -16,7 +19,7 @@ export default defineEventHandler(async (event) => {
   const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
 
   try {
-    const res = await $fetch('/hjc/order/create', {
+    return await $fetch('/hjc/order/create', {
       baseURL: config.public.modulesApiBase,
       method: 'POST',
       headers: {
@@ -25,8 +28,7 @@ export default defineEventHandler(async (event) => {
       },
       query: { TenantId: ctx.tenantId },
       body
-    }) as any
-    return res?.data ?? res
+    })
   } catch (error: any) {
     throw createError({
       statusCode: error?.statusCode || error?.response?.status || 502,
diff --git a/server/api/tender/pay.post.ts b/server/api/tender/pay.post.ts
index e566af9..8ac982d 100644
--- a/server/api/tender/pay.post.ts
+++ b/server/api/tender/pay.post.ts
@@ -7,6 +7,8 @@ import { getTenantFromContext } from '../../utils/tenant'
  * 发起支付（微信Native扫码，返回 codeUrl）
  * POST /api/tender/pay { orderNo }
  * 代理到 mp-api /api/hjc/order/pay；需登录态。
+ *
+ * 约定：原样透传 ApiResult{code,message,data}，由前端按 code 判定登录态与业务失败。
  */
 export default defineEventHandler(async (event) => {
   const config = useRuntimeConfig()
@@ -16,7 +18,7 @@ export default defineEventHandler(async (event) => {
   const auth = getHeader(event, 'authorization') || (cookieToken ? `Bearer ${cookieToken}` : null)
 
   try {
-    const res = await $fetch('/hjc/order/pay', {
+    return await $fetch('/hjc/order/pay', {
       baseURL: config.public.modulesApiBase,
       method: 'POST',
       headers: {
@@ -25,9 +27,7 @@ export default defineEventHandler(async (event) => {
       },
       query: { TenantId: ctx.tenantId },
       body
-    }) as any
-    const data = res && res.data !== undefined ? res.data : res
-    return data
+    })
   } catch (error: any) {
     throw createError({
       statusCode: error?.statusCode || error?.response?.status || 502,
diff --git a/server/api/tender/sms.post.ts b/server/api/tender/sms.post.ts
new file mode 100644
index 0000000..b5a8159
--- /dev/null
+++ b/server/api/tender/sms.post.ts
@@ -0,0 +1,34 @@
+import { $fetch } from 'ofetch'
+import { createError, defineEventHandler, readBody } from 'h3'
+import { useRuntimeConfig } from '#imports'
+import { getTenantFromContext } from '../../utils/tenant'
+
+/**
+ * 发送注册短信验证码
+ * POST /api/tender/sms { phone }
+ * 代理到 mp-api /api/hjc/auth/sms；匿名可访问（注册在登录前调用）。
+ *
+ * 说明：`phone` 必须传<b>经办人手机号</b>——后端以「经办人手机号」作为账号手机号建号，
+ * 注册接口的 `code` 校验的正是发给该号码的短信验证码。
+ * 原样透传 ApiResult{code,message,data}，成功 message 为「验证码已发送」。
+ */
+export default defineEventHandler(async (event) => {
+  const config = useRuntimeConfig()
+  const ctx = getTenantFromContext(event, config)
+  const body = await readBody(event)
+
+  try {
+    return await $fetch('/hjc/auth/sms', {
+      baseURL: config.public.modulesApiBase,
+      method: 'POST',
+      headers: { TenantId: ctx.tenantId },
+      query: { TenantId: ctx.tenantId },
+      body
+    })
+  } catch (error: any) {
+    throw createError({
+      statusCode: error?.statusCode || error?.response?.status || 502,
+      statusMessage: error?.data?.message || error?.statusMessage || 'Failed to send sms'
+    })
+  }
+})