会员权限控制

// 权限中间件 - 基于会员等级校验
export function requirePlan(minimumPlan: PlanTier) {
  return async (ctx: Context, next: Next) => {
    const userId = ctx.state.userId
    const membership = await getMembership(ctx, userId)
 
    // 等级权重比较：Enterprise > Team > Pro > Free
    if (getPlanWeight(membership.plan) < getPlanWeight(minimumPlan)) {
      ctx.status = 403
      ctx.body = {
        code: 'PLAN_UPGRADE_REQUIRED',
        requiredPlan: minimumPlan,
        currentPlan: membership.plan,
        upgradeUrl: `/billing/upgrade?to=${minimumPlan}`
      }
      return
    }
 
    // 将会员信息注入上下文，后续业务逻辑可直接使用
    ctx.state.membership = membership
    await next()
  }
}
 
// 使用示例
router.post('/api/comics/generate-batch',
  requirePlan('pro'),
  comicController.batchGenerate
)

// 功能级权限装饰器
function RequirePermission(permission: string) {
  return function (
    target: any,
    propertyKey: string,
    descriptor: PropertyDescriptor
  ) {
    const original = descriptor.value
 
    descriptor.value = async function (...args: any[]) {
      const ctx = args[0] // 约定第一个参数为 Context
      const permissions = await getUserPermissions(ctx, ctx.state.userId)
 
      if (!permissions.includes(permission)) {
        throw new PermissionDeniedError(permission)
      }
 
      return original.apply(this, args)
    }
 
    return descriptor
  }
}
 
// 使用示例
class ComicController {
  @RequirePermission('comic:export:4k')
  async exportHighRes(ctx: Context) {
    // 业务逻辑
  }
 
  @RequirePermission('comic:batch:generate')
  async batchGenerate(ctx: Context) {
    // 业务逻辑
  }
}

// 权限控制组件
function PermissionGate({
  permission,
  children,
  fallback
}: {
  permission: string
  children: React.ReactNode
  fallback?: React.ReactNode
}) {
  const { permissions } = useMembership()
 
  if (!permissions.includes(permission)) {
    return fallback ?? null
  }
 
  return <>{children}</>
}
 
// 使用示例
function EditorToolbar() {
  return (
    <div className="toolbar">
      <Button>保存</Button>
 
      <PermissionGate permission="comic:export:4k">
        <Button>高清导出</Button>
      </PermissionGate>
 
      <PermissionGate
        permission="comic:batch:generate"
        fallback={
          <Button variant="ghost" onClick={showUpgradeModal}>
            解锁批量生成
          </Button>
        }
      >
        <Button>批量生成</Button>
      </PermissionGate>
    </div>
  )
}

// Stripe webhook 处理
async function handleSubscriptionUpdated(event: Stripe.Event) {
  const subscription = event.data.object as Stripe.Subscription
 
  // 1. 映射 Stripe 价格 ID 到会员等级
  const newPlan = mapPriceIdToPlan(subscription.items.data[0].price.id)
 
  // 2. 更新数据库
  await db.membership.update({
    where: { userId: subscription.metadata.userId },
    data: {
      plan: newPlan,
      subscriptionId: subscription.id,
      currentPeriodEnd: new Date(subscription.current_period_end * 1000)
    }
  })
 
  // 3. 清除权限缓存
  await invalidatePermissionCache(subscription.metadata.userId)
 
  // 4. 发送通知（可选）
  await notifyUser(subscription.metadata.userId, 'plan_upgraded', { newPlan })
}

async function handlePlanDowngrade(userId: string, newPlan: PlanTier) {
  const membership = await getMembership(userId)
 
  // 策略：周期结束后生效
  const effectiveDate = membership.currentPeriodEnd
 
  // 1. 记录降级意向，不立即变更
  await db.membershipUpdate.create({
    data: {
      userId,
      type: 'DOWNGRADE_SCHEDULED',
      fromPlan: membership.plan,
      toPlan: newPlan,
      effectiveAt: effectiveDate
    }
  })
 
  // 2. 通知用户
  await notifyUser(userId, 'downgrade_scheduled', {
    newPlan,
    effectiveDate
  })
 
  // 3. 定时任务在 effectiveDate 执行实际降级
  // 见下方「过期处理」
}

// 定时任务：每日检查过期会员
async function processExpiredMemberships() {
  const expired = await db.membership.findMany({
    where: {
      currentPeriodEnd: { lt: new Date() },
      status: 'ACTIVE',
      gracePeriodEnd: { gt: new Date() } // 仍在宽限期内
    }
  })
 
  for (const membership of expired) {
    // 发送最后提醒
    await notifyUser(membership.userId, 'membership_expiring_soon', {
      daysLeft: Math.ceil(
        (membership.gracePeriodEnd.getTime() - Date.now()) / 86400000
      )
    })
  }
 
  // 宽限期已结束，执行降级
  const pastGrace = await db.membership.findMany({
    where: {
      currentPeriodEnd: { lt: new Date() },
      gracePeriodEnd: { lt: new Date() },
      status: 'ACTIVE'
    }
  })
 
  for (const membership of pastGrace) {
    await downgradeToFree(membership.userId)
  }
}

// 权限缓存结构
// Key: `permission:{userId}`
// Value: Hash { plan: 'pro', permissions: ['comic:export:4k', ...], exp: timestamp }
 
async function getUserPermissions(ctx: Context, userId: string): Promise<string[]> {
  const cacheKey = `permission:${userId}`
 
  // 1. 尝试从缓存读取
  const cached = await redis.hgetall(cacheKey)
  if (cached && cached.exp && Number(cached.exp) > Date.now()) {
    return JSON.parse(cached.permissions)
  }
 
  // 2. 缓存未命中或已过期，查询数据库
  const membership = await db.membership.findUnique({
    where: { userId }
  })
  const permissions = await buildPermissionsFromPlan(membership.plan)
 
  // 3. 写入缓存，TTL 10 分钟
  await redis.hset(cacheKey, {
    plan: membership.plan,
    permissions: JSON.stringify(permissions),
    exp: String(Date.now() + 10 * 60 * 1000)
  })
  await redis.expire(cacheKey, 10 * 60) // 兜底过期
 
  return permissions
}
 
// 权限变更时主动清除缓存
async function invalidatePermissionCache(userId: string) {
  await redis.del(`permission:${userId}`)
}

// TTL 加随机抖动，避免同时过期
const baseTTL = 10 * 60 // 10 分钟
const jitter = Math.floor(Math.random() * 2 * 60) // 0-2 分钟随机
await redis.expire(cacheKey, baseTTL + jitter)