diff --git a/docs/v2.md b/docs/v2.md
new file mode 100644
index 0000000..8f7ceca
--- /dev/null
+++ b/docs/v2.md
@@ -0,0 +1,148 @@
+# 小财记账系统重构计划
+
+> **文档状态**：讨论稿
+> **创建日期**：2026-07-22
+> **目的**：识别当前系统的设计缺陷与脆弱点，规划结构化改进方案，从“能用”走向“好用”。
+
+---
+
+## 一、当前系统现状概述
+
+经过多轮迭代，系统已具备以下核心功能：
+
+- 多用户登录、群聊管理、白名单权限
+- 聊天消息发送（文本+图片）、WebSocket实时推送
+- AI自动识别采购/付款/发票意图，创建采购记录
+- 采购清单（按月汇总）、采购详情（含操作历史、附件）
+- 删除/清空采购记录（管理员确认流程）
+- 图片压缩上传、附件关联
+- 移动端滑动手势、双击全屏、输入中气泡
+- 导出CSV、全局采购汇总
+
+**但所有功能都是“快速响应需求”的结果，缺乏统一设计，代码结构脆弱，修改一处容易引发多处问题。**
+
+---
+
+## 二、当前系统的主要问题与重构方向
+
+### 2.1 数据库与领域模型
+
+**存在问题**：
+
+- `purchases` 表字段通过多次 `ALTER TABLE` 添加，历史数据可能格式不一致（如 `created_at` 有时间和无时间两种格式）。
+- 金额计算规则散落在多处代码中，存在“AI返回金额”、“系统自动计算金额”两套逻辑，容易出错。
+- 状态机不明确（待处理/已采购/发票已收/已完成），更新时未严格约束状态转换。
+- 删除/清空操作依赖业务层手动管理级联，SQLite外键未开启。
+
+**改进方向**：
+
+1. **统一时间格式**：所有 `created_at` 和 `updated_at` 强制使用 `yyyy/MM/dd HH:mm:ss` 格式，在服务端工具函数中生成，不再依赖数据库默认值。
+2. **金额计算唯一化**：`amount` 字段仅由系统计算（`quantity * unit_price + freight`），AI 不再提供该字段。删除所有 AI 返回 `amount` 的处理逻辑。
+3. **定义采购状态机**：`待采购 → 已采购 → 发票已收 → 已完成`，更新状态时检查合法性。
+4. **开启外键约束**：在 `db.js` 中启用 `PRAGMA foreign_keys = ON;`，确保级联删除安全。
+
+---
+
+### 2.2 AI 交互层
+
+**存在问题**：
+
+- Prompt 分散在 `analyzeWithDeepSeek` 函数中，规则越来越多，难以维护。
+- AI 返回的 JSON 格式不稳定，有时带 `reply` 有时不带，有时 `action` 与字段不匹配。
+- 上下文管理简陋：对话历史只保留最近 40 条，无摘要压缩，token 使用效率低。
+- 附件补充、删除确认、权限判断等场景，AI 表现不稳定，经常误判意图。
+
+**改进方向**：
+
+1. **Prompt 模板化**：将 system prompt 拆分为多个模块（角色定义、意图分类、采购规则、删除规则、附件规则、权限规则），动态拼接。
+2. **JSON Schema 校验**：定义每种 `action` 对应的必选/可选字段，服务端在解析 AI 返回后立即校验，不符合的驳回或修正。
+3. **上下文管理升级**：
+ - 近期消息（30 条）保持完整 `messages` 数组。
+ - 超过 30 条时，调用 AI 生成结构化摘要（当前采购清单），作为 `system` 消息注入。
+4. **附件与更新逻辑分离**：
+ - 附件请求仅返回 `purchase_item`，不包含金额/数量字段，后端强制匹配已有记录并插入附件。
+ - 更新请求必须明确给出变化字段，后端对比后仅更新真正变化的列。
+
+---
+
+### 2.3 后端架构
+
+**存在问题**：
+
+- 所有业务逻辑（AI 调用、数据库操作、权限判断）混在 `server.js` 单文件中，超过 600 行，难以维护。
+- 错误处理不统一：有的地方静默失败，有的地方只打印日志，用户得不到反馈。
+- 权限检查仅通过中间件 `adminOnly`，但删除/清空的权限还依赖 AI 判断，存在双重标准。
+
+**改进方向**：
+
+1. **模块化拆分**：
+ - `routes/`：Express 路由（auth, rooms, messages, purchases, upload）
+ - `ai/`：Prompt 模板、AI 调用、结果解析与校验
+ - `db/`：数据库操作封装（含迁移逻辑）
+ - `ws/`：WebSocket 管理（连接、房间、广播）
+2. **统一错误处理中间件**：自定义错误类，全局捕获并返回标准 JSON 格式。
+3. **权限统一**：删除/清空操作仅在后端检查管理员权限，AI 不再参与权限判断（只负责识别意图）。
+
+---
+
+### 2.4 前端架构
+
+**存在问题**：
+
+- 单文件 HTML 包含所有 CSS/JS，超过 800 行，难以维护。
+- 状态管理混乱：`messageCache`、`rooms`、`pendingFiles` 等全局变量散落，修改时容易出现不一致。
+- 消息渲染使用 `innerHTML` 直接拼接，存在 XSS 风险（虽然做了部分转义，但 Markdown 渲染绕过）。
+- 图片加载、滚动位置控制不稳定，经常出现自动跳转。
+
+**改进方向**：
+
+1. **文件拆分**：CSS 独立文件、JS 按功能模块拆分（登录、聊天、清单、管理），使用 ES modules 或构建工具（如 esbuild）打包。
+2. **虚拟 DOM 或模板引擎**：考虑引入轻量框架（如 Preact 或 lit-html），避免手动拼接 HTML，同时解决 XSS 问题。
+3. **状态管理**：将所有全局状态集中到一个 `store` 对象，通过事件或 Proxy 驱动 UI 更新。
+4. **消息渲染优化**：图片加载完成后才调整滚动位置，防止跳动；使用懒加载。
+
+---
+
+### 2.5 安全性
+
+**存在问题**：
+
+- JWT secret 使用随机字符串，但未设置过期刷新机制，长期有效。
+- 文件上传仅限制格式和大小，未限制上传频率，有被滥用的风险。
+- 用户密码在环境变量中明文存储，传输时未加密（仅 HTTPS 保护）。
+
+**改进方向**：
+
+1. **JWT 刷新**：增加 refresh token 机制，短期 access token（1小时）+ 长期 refresh token（7天）。
+2. **上传频率限制**：使用 `express-rate-limit` 限制每用户每天上传次数。
+3. **密码哈希**：用户密码存储为 bcrypt 哈希，不再明文比较（需要修改登录逻辑和 `.env` 配置方式）。
+
+---
+
+### 2.6 运维与部署
+
+**存在问题**：
+
+- 数据库迁移依赖手动 `ALTER TABLE` 加 `try/catch`，日志不完善，问题难排查。
+- 图片存储使用本地磁盘，容器重建后丢失（除非挂载卷）。
+- 无备份机制，数据风险高。
+
+**改进方向**：
+
+1. **自动化迁移**：使用 `better-sqlite3` 的迁移工具或自定义版本管理系统，记录已执行迁移。
+2. **对象存储**：支持 S3 兼容存储（如 MinIO、阿里云 OSS）作为图片存储后端，本地仅做缓存。
+3. **定时备份**：通过 cronjob 定期导出 SQLite 数据库和上传目录。
+
+---
+
+## 三、优先重构顺序建议
+
+| 优先级 | 模块 | 原因 |
+|--------|------|------|
+| **P0** | AI交互层（Prompt模板化、JSON Schema校验、附件逻辑分离） | 直接影响用户体验，当前最不稳定 |
+| **P0** | 金额计算唯一化、时间格式统一 | 数据一致性基础，错误频发 |
+| **P1** | 后端模块化拆分 | 为后续开发铺路，当前单文件难以维护 |
+| **P1** | 权限模型统一 | 安全风险，目前依赖AI判断不可靠 |
+| **P2** | 前端状态管理与文件拆分 | 改善开发体验和运行稳定性 |
+| **P3** | 安全增强（JWT、密码哈希、上传限制） | 系统公开使用后必须处理 |
+| **P3** | 运维自动化（备份、存储迁移） | 数据安全，长期运行保障 |
diff --git a/server/ai/client.js b/server/ai/client.js
new file mode 100644
index 0000000..fce9cee
--- /dev/null
+++ b/server/ai/client.js
@@ -0,0 +1,19 @@
+// DeepSeek API 客户端
+const DEEPSEEK_API_KEY = process.env.DEEPSEEK_API_KEY || '';
+
+async function callDeepSeek(messages, temperature = 0.1) {
+ console.log('🤖 调用 DeepSeek...');
+ const res = await fetch('https://api.deepseek.com/chat/completions', {
+ method: 'POST',
+ headers: { 'Content-Type': 'application/json', 'Authorization': `Bearer ${DEEPSEEK_API_KEY}` },
+ body: JSON.stringify({ model: 'deepseek-v4-flash', messages, temperature, stream: false })
+ });
+ const data = await res.json();
+ if (!data.choices || !data.choices[0]) {
+ console.error('🤖 DeepSeek 返回异常:', JSON.stringify(data));
+ throw new Error('DeepSeek API 返回异常: ' + (data.error?.message || JSON.stringify(data)));
+ }
+ return data.choices[0].message.content;
+}
+
+module.exports = { callDeepSeek };
diff --git a/server/ai/prompt.js b/server/ai/prompt.js
new file mode 100644
index 0000000..c7f308b
--- /dev/null
+++ b/server/ai/prompt.js
@@ -0,0 +1,54 @@
+// AI Prompt 模板 — 模块化拼接
+function buildSystemPrompt(username, isAdmin) {
+ const now = new Date().toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai', hour12: false });
+
+ const role = `你是智能财务助手"小财"。当前服务器时间：${now}。结合对话历史理解用户意图，只返回JSON。`;
+
+ const intent = `
+意图分类：
+- 采购/付款/发票相关：action="purchase"，提取字段：purchase_item, quantity(默认1), unit_price(默认0), freight(默认0), payment_method(淘宝默认支付宝), invoice_type(默认无票), status, applicant, remarks, created_time
+- 查询汇总：action="query"
+- 聊天：action="chat"，reply简短回复
+- 删除指定物品：action="delete"，delete_item为物品名
+- 清空所有采购数据：action="clear_all"
+- 忽略（仅当完全无关）：action="ignore"`;
+
+ const permission = `
+⚠️ 权限规则：
+- 当前用户${username}，管理员状态：${isAdmin}。仅管理员可执行删除/清空操作。
+- 如果用户要求删除或清空，且 isAdmin 为 false，你必须返回 action="chat" 并说明"仅管理员可操作"。
+- 如果 isAdmin 为 true，正常返回 delete 或 clear_all。`;
+
+ const deleteRules = `
+⚠️ 删除规则：
+- 特殊批量删除：delete_item="__AMOUNT_ZERO__"（金额为0）、"__NULL_NAME__"（空名称）
+- 精确删除：用户指定数量/金额时同时返回 quantity/amount 字段，只匹配一条
+- 不要返回 action="ask" 处理删除请求`;
+
+ const attachmentRules = `
+⚠️ 附件规则：
+- 图片+物品名（"这是XX的图片"）→ 只返回 purchase_item，绝对不要 is_new/quantity/unit_price
+- 引用历史图片（"上面/前面/刚刚那张"）→ use_recent_image: true
+- 纯图片+物品名不是新建采购，系统自动关联附件`;
+
+ const prohibitionRules = `
+⚠️ 绝对禁止：
+- 图片+物品名请求 → 只能返回 purchase_item，禁止返回 is_new、quantity、unit_price、amount`;
+
+ const purchaseRules = `
+⚠️ 采购规则：
+- 只有明确消费意图（购买/采购/下单/付款/买了/花了）才返回 action="purchase"
+- 纯陈述（如"前天deep"）→ action="ignore"
+- 信息不完整 → action="ask" 追问
+- 新建 vs 更新：
+ * "昨天/今天/又/再/新/另一批"等重复购买 → is_new: true（强制新建）
+ * "改一下/更新/修改/调整"等 → 不提供 is_new（匹配已有更新）
+ * "纯图片+物品名"不是新建，不要返回 is_new
+ * 无法确定 → 默认 is_new: true
+- amount 由系统自动计算（quantity × unit_price + freight），AI 无需提供
+- 无法确定物品名 → action="ask" 追问`;
+
+ return [role, intent, permission, deleteRules, attachmentRules, prohibitionRules, purchaseRules].join('\n');
+}
+
+module.exports = { buildSystemPrompt };
diff --git a/server/ai/validator.js b/server/ai/validator.js
new file mode 100644
index 0000000..f2f92eb
--- /dev/null
+++ b/server/ai/validator.js
@@ -0,0 +1,40 @@
+// JSON Schema 校验 — 验证 AI 返回的 JSON 结构
+const schemas = {
+ purchase: { required: ['purchase_item'], optional: ['quantity','unit_price','freight','payment_method','invoice_type','status','applicant','remarks','created_time','is_new','use_recent_image'] },
+ query: { required: [], optional: [] },
+ chat: { required: ['reply'], optional: [] },
+ delete: { required: ['delete_item'], optional: ['quantity','amount'] },
+ clear_all: { required: [], optional: [] },
+ ignore: { required: [], optional: [] },
+};
+
+function validate(aiResult) {
+ if (!aiResult || !aiResult.action) {
+ return { valid: false, error: '缺少 action 字段' };
+ }
+ const schema = schemas[aiResult.action];
+ if (!schema) {
+ return { valid: false, error: `未知 action: ${aiResult.action}` };
+ }
+ for (const field of schema.required) {
+ if (aiResult[field] === undefined || aiResult[field] === null) {
+ return { valid: false, error: `action=${aiResult.action} 缺少必填字段: ${field}` };
+ }
+ }
+ return { valid: true };
+}
+
+// 修复常见问题
+function normalize(aiResult) {
+ // action="ask" 兼容 reply/question
+ if (aiResult.action === 'ask') {
+ aiResult.question = aiResult.question || aiResult.reply || '请提供更多信息。';
+ }
+ // chat 兼容 reply 为空
+ if (aiResult.action === 'chat' && !aiResult.reply) {
+ aiResult.reply = '好的。';
+ }
+ return aiResult;
+}
+
+module.exports = { validate, normalize };
diff --git a/server/db.js b/server/db.js
index 63ca632..2e606e1 100644
--- a/server/db.js
+++ b/server/db.js
@@ -9,9 +9,12 @@ if (!fs.existsSync(dataDir)) {
const dbPath = path.join(dataDir, 'xiaocai.db');
const db = new Database(dbPath);
-db.pragma('journal_mode = WAL');
-// 创建基础表（如果不存在）
+// 关键 pragma
+db.pragma('journal_mode = WAL');
+db.pragma('foreign_keys = ON');
+
+// 创建基础表
db.exec(`
CREATE TABLE IF NOT EXISTS users (
username TEXT PRIMARY KEY,
@@ -75,7 +78,7 @@ db.exec(`
);
`);
-// 为已有数据库添加可能缺失的列（安全迁移，忽略错误）
+// 安全迁移（忽略已存在的列）
const migrations = [
`ALTER TABLE purchases ADD COLUMN quantity INTEGER DEFAULT 1`,
`ALTER TABLE purchases ADD COLUMN unit_price REAL DEFAULT 0`,
@@ -85,13 +88,8 @@ const migrations = [
`ALTER TABLE purchases ADD COLUMN remarks TEXT DEFAULT ''`,
`ALTER TABLE rooms ADD COLUMN white_list TEXT DEFAULT ''`,
];
-
for (const sql of migrations) {
- try {
- db.exec(sql);
- } catch (e) {
- // 列已存在或其他错误，忽略
- }
+ try { db.exec(sql); } catch (e) { /* 列已存在 */ }
}
module.exports = db;
diff --git a/server/handlers.js b/server/handlers.js
new file mode 100644
index 0000000..98a0488
--- /dev/null
+++ b/server/handlers.js
@@ -0,0 +1,231 @@
+// AI 结果处理 + 共享状态
+const { v4: uuidv4 } = require('uuid');
+const db = require('../db');
+const { timestamp, normalizeTime } = require('../utils');
+const { broadcastToRoom } = require('../ws');
+
+// 对话历史（内存）
+const conversationHistory = new Map();
+function getHistory(roomId) { if (!conversationHistory.has(roomId)) conversationHistory.set(roomId, []); return conversationHistory.get(roomId); }
+function addToHistory(roomId, role, content) { const h = getHistory(roomId); h.push({ role, content }); if (h.length > 60) conversationHistory.set(roomId, h.slice(-40)); }
+
+// 待处理操作
+const pendingActions = new Map();
+function hasPendingAction(roomId, username) { return pendingActions.has(`${roomId}:${username}`); }
+function setPendingAction(roomId, username, action) { pendingActions.set(`${roomId}:${username}`, action); }
+function clearPendingAction(roomId, username) { pendingActions.delete(`${roomId}:${username}`); }
+
+function storeAndBroadcastText(roomId, user, text) {
+ const now = timestamp();
+ const result = db.prepare('INSERT INTO messages (room_id, user, text, timestamp) VALUES (?,?,?,?)').run(roomId, user, text, now);
+ const msg = { id: result.lastInsertRowid, room_id: roomId, user, text, attachments: [], timestamp: now };
+ const lastMsg = db.prepare('SELECT text, timestamp FROM messages WHERE room_id = ? ORDER BY id DESC LIMIT 1').get(roomId);
+ broadcastToRoom(roomId, { type: 'new_message', message: msg, room_preview: { room_id: roomId, last_message: lastMsg ? lastMsg.text : '', last_time: lastMsg ? lastMsg.timestamp : '' } });
+ return msg;
+}
+
+function executePendingAction(roomId, username) {
+ const action = pendingActions.get(`${roomId}:${username}`);
+ if (!action) return false;
+ clearPendingAction(roomId, username);
+ const now = timestamp();
+ try {
+ if (action.type === 'delete') {
+ const { itemName, purchaseIds } = action.data;
+ const delA = db.prepare('DELETE FROM purchase_attachments WHERE purchase_id = ?');
+ const delH = db.prepare('DELETE FROM purchase_history WHERE purchase_id = ?');
+ const delP = db.prepare('DELETE FROM purchases WHERE id = ?');
+ for (const id of purchaseIds) { delA.run(id); delH.run(id); delP.run(id); }
+ const reply = `✅ 已删除采购记录：${itemName}（共 ${purchaseIds.length} 条）`;
+ storeAndBroadcastText(roomId, '小财', reply); addToHistory(roomId, 'assistant', reply);
+ } else if (action.type === 'clear') {
+ db.prepare('DELETE FROM purchase_attachments WHERE purchase_id IN (SELECT id FROM purchases WHERE room_id = ?)').run(roomId);
+ db.prepare('DELETE FROM purchase_history WHERE purchase_id IN (SELECT id FROM purchases WHERE room_id = ?)').run(roomId);
+ db.prepare('DELETE FROM purchases WHERE room_id = ?').run(roomId);
+ const reply = '✅ 已清空当前房间的所有采购数据。';
+ storeAndBroadcastText(roomId, '小财', reply); addToHistory(roomId, 'assistant', reply);
+ }
+ broadcastToRoom(roomId, { type: 'purchase_updated' });
+ return true;
+ } catch (e) { storeAndBroadcastText(roomId, '小财', '❌ 操作执行失败，请重试。'); return false; }
+}
+
+function handleAIResult(aiResult, roomId, username, originalText, attachments) {
+ const now = timestamp();
+
+ if (aiResult.action === 'ask') {
+ const q = aiResult.question || aiResult.reply || '请提供更多信息。';
+ storeAndBroadcastText(roomId, '小财', q); addToHistory(roomId, 'assistant', q); return;
+ }
+
+ if (aiResult.action === 'delete') {
+ const itemName = aiResult.delete_item;
+ let purchases;
+ if (itemName === '__AMOUNT_ZERO__') {
+ purchases = db.prepare('SELECT id, item, amount, payment_method, status, applicant, created_at FROM purchases WHERE room_id = ? AND amount = 0').all(roomId);
+ } else if (itemName === '__NULL_NAME__') {
+ purchases = db.prepare("SELECT id, item, amount, payment_method, status, applicant, created_at FROM purchases WHERE room_id = ? AND (item IS NULL OR item = '' OR item = 'null' OR item = 'undefined')").all(roomId);
+ } else {
+ let query = 'SELECT id, item, amount, payment_method, status, applicant, created_at FROM purchases WHERE room_id = ? AND item LIKE ?';
+ const params = [roomId, `%${itemName}%`];
+ if (aiResult.quantity !== undefined) { query += ' AND quantity = ?'; params.push(aiResult.quantity); }
+ if (aiResult.amount !== undefined) { query += ' AND amount = ?'; params.push(aiResult.amount); }
+ console.log('🔍 删除查询:', query, params);
+ purchases = db.prepare(query).all(...params);
+ }
+ if (purchases.length === 0) {
+ const label = itemName === '__AMOUNT_ZERO__' ? '金额为0' : (itemName === '__NULL_NAME__' ? '名称为空' : `"${itemName}"`);
+ storeAndBroadcastText(roomId, '小财', `没有找到与"${label}"相关的采购记录。`);
+ return;
+ }
+ let confirmText = `⚠️ 即将删除以下 ${purchases.length} 条采购记录，请回复"确认"继续：\n\n`;
+ purchases.forEach(p => confirmText += `• ${p.item} | ¥${p.amount} | ${p.status} | ${p.applicant} | ${p.created_at}\n`);
+ confirmText += `\n如果不删除，请忽略此消息。`;
+ storeAndBroadcastText(roomId, '小财', confirmText);
+ addToHistory(roomId, 'assistant', confirmText);
+ setPendingAction(roomId, username, { type: 'delete', data: { itemName, purchaseIds: purchases.map(p => p.id) } });
+ return;
+ }
+
+ if (aiResult.action === 'clear_all') {
+ const count = db.prepare('SELECT COUNT(*) as count FROM purchases WHERE room_id = ?').get(roomId).count;
+ if (count === 0) { storeAndBroadcastText(roomId, '小财', '当前房间没有采购记录，无需清空。'); return; }
+ storeAndBroadcastText(roomId, '小财', `⚠️ 即将清空当前房间的 ${count} 条采购数据，请回复"确认"继续，否则忽略。`);
+ addToHistory(roomId, 'assistant', `请求清空${count}条记录`);
+ setPendingAction(roomId, username, { type: 'clear', data: {} });
+ return;
+ }
+
+ if (aiResult.action === 'purchase') {
+ const item = aiResult.purchase_item;
+ if (!item || item === 'null' || item === 'undefined' || item.trim().length < 2) {
+ console.log('🚫 拒绝无效 purchase_item:', JSON.stringify(item));
+ storeAndBroadcastText(roomId, '小财', '请提供具体的物品名称。');
+ addToHistory(roomId, 'assistant', '请提供具体的物品名称。');
+ return;
+ }
+ console.log('🛒 purchase 分支, item:', item, 'attachments:', JSON.stringify(attachments));
+
+ let usedRecentImage = false;
+ if (aiResult.use_recent_image) {
+ console.log('🔍 use_recent_image: 查找最近图片消息, roomId=', roomId);
+ const recentMsg = db.prepare("SELECT attachments FROM messages WHERE room_id = ? AND attachments IS NOT NULL AND attachments != '' AND attachments != '[]' ORDER BY id DESC LIMIT 1").get(roomId);
+ if (recentMsg) {
+ try {
+ const files = JSON.parse(recentMsg.attachments);
+ if (files.length) { attachments = files; usedRecentImage = true; console.log('✅ 引用图片:', files.length, '个'); }
+ } catch(e) { console.error('❌ 解析附件失败:', e); }
+ }
+ }
+
+ const createdTime = normalizeTime(aiResult.created_time);
+ let isNew = aiResult.is_new === true;
+ let purchase;
+ if (isNew && attachments?.length > 0) {
+ const existing = db.prepare('SELECT * FROM purchases WHERE room_id = ? AND item LIKE ? ORDER BY created_at DESC LIMIT 1').get(roomId, `%${aiResult.purchase_item}%`);
+ if (existing) { console.log('🛡️ 兜底纠正: 转为更新模式'); isNew = false; purchase = existing; }
+ }
+ if (!isNew && !purchase) {
+ purchase = db.prepare('SELECT * FROM purchases WHERE room_id = ? AND item LIKE ? AND status != ?').get(roomId, `%${aiResult.purchase_item}%`, '已完成');
+ }
+ console.log('📦 purchase_item:', aiResult.purchase_item, isNew ? '(强制新建)' : purchase ? '(匹配已有)' : '(未匹配-新建)');
+
+ let replyText = '';
+ const quantity = aiResult.quantity || 1;
+ const unitPrice = aiResult.unit_price || 0;
+ const freight = aiResult.freight || 0;
+ const amount = quantity * unitPrice + freight;
+
+ if (!purchase) {
+ const id = uuidv4();
+ const paymentMethod = aiResult.payment_method || (aiResult.method === '淘宝' ? '支付宝' : (aiResult.method || '未指定'));
+ const invoiceType = aiResult.invoice_type || '无票';
+ const status = aiResult.status || '待处理';
+ const applicant = aiResult.applicant || username;
+ const remarks = aiResult.remarks || '';
+ db.prepare('INSERT INTO purchases (id, room_id, item, quantity, unit_price, amount, freight, payment_method, invoice_type, status, applicant, remarks, created_at) VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?)').run(
+ id, roomId, item, quantity, unitPrice, amount, freight, paymentMethod, invoiceType, status, applicant, remarks, createdTime
+ );
+ db.prepare('INSERT INTO purchase_history (purchase_id, action, user, timestamp) VALUES (?,?,?,?)').run(id, `创建采购：${item}，数量${quantity}，金额¥${amount}，状态${status}`, '小财', now);
+ replyText = `✅ 已记录采购：${item}，数量 ${quantity}，金额 ¥${amount}，状态 ${status}`;
+ purchase = { id };
+ } else {
+ const old = purchase;
+ const newVals = {
+ quantity: aiResult.quantity ?? old.quantity,
+ unit_price: aiResult.unit_price ?? old.unit_price,
+ freight: aiResult.freight ?? old.freight,
+ payment_method: aiResult.payment_method || (aiResult.method === '淘宝' ? '支付宝' : (aiResult.method || old.payment_method)),
+ invoice_type: aiResult.invoice_type || old.invoice_type,
+ status: aiResult.status || old.status,
+ applicant: aiResult.applicant || old.applicant,
+ remarks: aiResult.remarks !== undefined ? aiResult.remarks : old.remarks,
+ created_at: aiResult.created_time || old.created_at
+ };
+ newVals.amount = newVals.quantity * newVals.unit_price + newVals.freight;
+
+ const historyChanges = [];
+ let changed = false;
+ for (const [field, newVal] of Object.entries(newVals)) {
+ if (String(newVal) !== String(old[field])) {
+ changed = true;
+ historyChanges.push(`${field}: ${old[field]} → ${newVal}`);
+ db.prepare(`UPDATE purchases SET ${field} = ? WHERE id = ?`).run(newVal, purchase.id);
+ }
+ }
+ if (changed) {
+ db.prepare('UPDATE purchases SET updated_at = ? WHERE id = ?').run(now, purchase.id);
+ db.prepare('INSERT INTO purchase_history (purchase_id, action, user, timestamp) VALUES (?,?,?,?)').run(purchase.id, `更新：${historyChanges.join('；')}`, username, now);
+ replyText = `🔄 已更新「${aiResult.purchase_item}」：${historyChanges.join('，')}`;
+ } else {
+ replyText = `ℹ️ 采购「${aiResult.purchase_item}」的信息没有发生变化。`;
+ }
+ }
+
+ if (attachments?.length) {
+ console.log('📎 插入附件:', attachments.length, '个, purchase_id=', purchase.id);
+ const insertAttach = db.prepare('INSERT INTO purchase_attachments (purchase_id, file_path, uploaded_by, timestamp) VALUES (?,?,?,?)');
+ attachments.forEach(fp => { console.log(' 📎', fp); insertAttach.run(purchase.id, fp, username, now); });
+ db.prepare('INSERT INTO purchase_history (purchase_id, action, user, timestamp) VALUES (?,?,?,?)').run(purchase.id, `添加附件：${attachments.length} 个`, username, now);
+ if (replyText.includes('没有发生') || usedRecentImage) {
+ replyText = `📎 已为「${aiResult.purchase_item}」添加 ${attachments.length} 个附件`;
+ }
+ console.log('✅ 附件完成, replyText:', replyText);
+ } else if (usedRecentImage) {
+ replyText = '❌ 未找到最近的图片消息，请先发送图片再试。';
+ }
+
+ storeAndBroadcastText(roomId, '小财', replyText);
+ addToHistory(roomId, 'assistant', replyText);
+ broadcastToRoom(roomId, { type: 'purchase_updated' });
+ return;
+ }
+
+ if (aiResult.action === 'query') {
+ const purchaseData = db.prepare('SELECT item, amount, payment_method, status FROM purchases WHERE room_id = ? ORDER BY created_at DESC').all(roomId).map(p => `${p.item} ¥${p.amount} ${p.payment_method||''} ${p.status}`).join('\n');
+ const summaryPrompt = `根据以下采购记录，用自然语言回答用户查询"${originalText}"。采购记录：\n${purchaseData || '暂无记录'}`;
+ callDeepSeekForSummary(summaryPrompt).then(reply => { storeAndBroadcastText(roomId, '小财', reply); addToHistory(roomId, 'assistant', reply); });
+ return;
+ }
+
+ if (aiResult.action === 'chat') {
+ storeAndBroadcastText(roomId, '小财', aiResult.reply || '好的。');
+ addToHistory(roomId, 'assistant', aiResult.reply);
+ return;
+ }
+}
+
+async function callDeepSeekForSummary(prompt) {
+ const { callDeepSeek } = require('../ai/client');
+ const messages = [
+ { role: 'system', content: '你是一个财务助手，请根据采购记录生成简洁回复。' },
+ { role: 'user', content: prompt }
+ ];
+ return callDeepSeek(messages, 0.3);
+}
+
+module.exports = {
+ getHistory, addToHistory,
+ hasPendingAction, setPendingAction, clearPendingAction,
+ handleAIResult, executePendingAction, storeAndBroadcastText
+};
diff --git a/server/middleware/auth.js b/server/middleware/auth.js
new file mode 100644
index 0000000..ec45a48
--- /dev/null
+++ b/server/middleware/auth.js
@@ -0,0 +1,23 @@
+// 认证与授权中间件
+const jwt = require('jsonwebtoken');
+const JWT_SECRET = process.env.JWT_SECRET || 'xiaocai-secret-2024';
+
+function authMiddleware(req, res, next) {
+ const authHeader = req.headers.authorization;
+ if (!authHeader) return res.status(401).json({ error: '未登录' });
+ const token = authHeader.split(' ')[1];
+ try {
+ const decoded = jwt.verify(token, JWT_SECRET);
+ req.user = decoded;
+ next();
+ } catch (e) {
+ res.status(401).json({ error: '登录已过期' });
+ }
+}
+
+function adminOnly(req, res, next) {
+ if (!req.user.isAdmin) return res.status(403).json({ error: '仅管理员可执行此操作' });
+ next();
+}
+
+module.exports = { authMiddleware, adminOnly, JWT_SECRET };
diff --git a/server/public/css/style.css b/server/public/css/style.css
new file mode 100644
index 0000000..ef308a2
--- /dev/null
+++ b/server/public/css/style.css
@@ -0,0 +1,111 @@
+* { margin: 0; padding: 0; box-sizing: border-box; }
+body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; background: #f5f5f5; height: 100vh; display: flex; justify-content: center; align-items: center; }
+.app { width: 100%; max-width: 420px; height: 100vh; background: #fff; display: flex; flex-direction: column; box-shadow: 0 0 20px rgba(0,0,0,0.1); position: relative; }
+.hidden { display: none !important; }
+
+.header { background: linear-gradient(135deg, #1e3c72 0%, #2a5298 100%); color: #fff; padding: 0 16px; display: flex; justify-content: space-between; align-items: center; min-height: 48px; }
+.header-left { display: flex; align-items: center; gap: 8px; }
+.header-left h2 { font-size: 18px; font-weight: 500; }
+.icon-btn { background: none; border: none; color: #fff; cursor: pointer; display: flex; align-items: center; justify-content: center; padding: 4px; border-radius: 50%; }
+.icon-btn svg { width: 22px; height: 22px; stroke: #fff; fill: none; stroke-width: 2; stroke-linecap: round; stroke-linejoin: round; }
+
+#create-room-btn { visibility: hidden; }
+#create-room-btn.visible { visibility: visible; }
+
+.chat-list { flex: 1; overflow-y: auto; padding-bottom: 8px; }
+.chat-item { padding: 14px 16px; border-bottom: 1px solid #f0f0f0; display: flex; align-items: center; cursor: pointer; }
+.chat-item:active { background: #f9f9f9; }
+.avatar { width: 44px; height: 44px; border-radius: 50%; background: #e0e0e0; margin-right: 12px; display: flex; align-items: center; justify-content: center; font-size: 18px; font-weight: 600; color: #555; flex-shrink: 0; }
+.chat-info { flex: 1; min-width: 0; }
+.chat-name { font-size: 16px; font-weight: 500; margin-bottom: 4px; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.last-msg { font-size: 14px; color: #888; white-space: nowrap; overflow: hidden; text-overflow: ellipsis; }
+.chat-right { display: flex; flex-direction: column; align-items: flex-end; margin-left: 8px; flex-shrink: 0; min-width: 56px; }
+.chat-time { font-size: 12px; color: #aaa; white-space: nowrap; }
+.room-actions { display: flex; gap: 4px; margin-top: 4px; }
+.edit-room-btn { background: none; border: none; cursor: pointer; display: flex; align-items: center; padding: 2px; }
+.edit-room-btn svg { width: 16px; height: 16px; stroke: #888; fill: none; stroke-width: 2; }
+
+.summary-card { background: #f0f7ff; margin: 8px; border-radius: 12px; padding: 14px 16px; cursor: pointer; display: flex; justify-content: space-between; align-items: center; }
+.summary-card h4 { font-size: 16px; font-weight: 500; }
+.summary-card .summary-preview { font-size: 14px; color: #555; }
+
+.chat-window { display: flex; flex-direction: column; height: 100%; }
+.chat-header { background: linear-gradient(135deg, #1e3c72 0%, #2a5298 100%); color: #fff; padding: 0 16px; display: flex; align-items: center; min-height: 48px; }
+.chat-header .back-btn { margin-right: 12px; }
+.chat-header .chat-title { font-size: 17px; font-weight: 500; flex: 1; }
+.messages { flex: 1; overflow-y: auto; padding: 12px; background: #fafafa; }
+.msg { margin-bottom: 12px; display: flex; flex-direction: column; }
+.msg.me { align-items: flex-end; }
+.msg-bubble { max-width: 75%; padding: 10px 14px; border-radius: 20px; font-size: 16px; line-height: 1.5; word-wrap: break-word; overflow-wrap: break-word; cursor: pointer; }
+.msg.me .msg-bubble { background: #d1f0d1; border-bottom-right-radius: 4px; }
+.msg.other .msg-bubble { background: #fff; border: 1px solid #eee; border-bottom-left-radius: 4px; }
+.msg-user { font-size: 12px; color: #888; margin-bottom: 2px; margin-left: 4px; }
+.msg.me .msg-user { text-align: right; margin-right: 4px; }
+.msg-time { font-size: 11px; color: #aaa; margin-top: 2px; }
+.msg-bubble h1, .msg-bubble h2, .msg-bubble h3 { font-size: 16px; margin: 5px 0; }
+.msg-bubble table { width: 100%; border-collapse: collapse; margin: 8px 0; }
+.msg-bubble th, .msg-bubble td { border: 1px solid #ddd; padding: 4px; text-align: left; font-size: 14px; }
+.msg-bubble th { background: #f0f0f0; }
+.msg-bubble pre { background: #f0f0f0; padding: 8px; border-radius: 4px; overflow-x: auto; }
+.msg-bubble code { background: #f0f0f0; padding: 2px 4px; border-radius: 3px; font-size: 14px; }
+
+.input-area { padding: 8px 12px; border-top: 1px solid #eee; display: flex; align-items: center; background: #fff; gap: 8px; }
+.input-area textarea { flex: 1; border: 1px solid #ddd; border-radius: 12px; padding: 10px 12px; font-size: 16px; outline: none; resize: none; min-height: 40px; max-height: 120px; overflow-y: hidden; line-height: 1.4; }
+.file-upload-btn { background: none; border: none; cursor: pointer; display: flex; align-items: center; justify-content: center; padding: 4px; }
+.file-upload-btn svg { width: 24px; height: 24px; stroke: #666; fill: none; stroke-width: 2; }
+.send-btn { background: #3b82f6; border: none; color: #fff; width: 32px; height: 32px; border-radius: 50%; display: flex; align-items: center; justify-content: center; cursor: pointer; flex-shrink: 0; }
+.send-btn svg { width: 18px; height: 18px; fill: #fff; }
+
+.purchase-panel-overlay { position: absolute; top: 0; left: 0; right: 0; bottom: 0; background: #fff; z-index: 10; display: flex; flex-direction: column; }
+.purchase-panel-header { background: linear-gradient(135deg, #1e3c72 0%, #2a5298 100%); color: #fff; padding: 0 16px; display: flex; justify-content: space-between; align-items: center; min-height: 48px; }
+.purchase-panel-body { flex: 1; overflow-y: auto; padding: 12px; }
+.purchase-month-group { margin-bottom: 20px; }
+.purchase-month-header { background: #f5f5f5; font-size: 16px; font-weight: 600; padding: 10px 8px; border-radius: 4px; display: flex; justify-content: space-between; }
+.purchase-item { padding: 12px 8px; border-bottom: 1px solid #f0f0f0; cursor: pointer; }
+.purchase-item:active { background: #f9f9f9; }
+.purchase-item .item-main { display: flex; justify-content: space-between; align-items: baseline; }
+.purchase-item .item-name { font-size: 16px; font-weight: 500; }
+.purchase-item .item-amount { font-size: 16px; font-weight: 600; }
+.purchase-item .item-meta { display: flex; justify-content: space-between; margin-top: 4px; font-size: 13px; color: #888; flex-wrap: wrap; gap: 4px; }
+.status-badge { background: #fef3c7; padding: 1px 6px; border-radius: 8px; font-size: 12px; }
+.status-badge.done { background: #d1fae5; }
+
+.modal-overlay { position: fixed; top: 0; left: 0; width: 100%; height: 100%; background: rgba(0,0,0,0.5); display: flex; justify-content: center; align-items: center; z-index: 100; }
+.modal { background: #fff; width: 90%; max-width: 400px; max-height: 80vh; border-radius: 12px; overflow: auto; padding: 16px; position: relative; }
+.modal .modal-close-btn { position: absolute; top: 10px; right: 12px; background: none; border: none; cursor: pointer; }
+.modal .modal-close-btn svg { width: 20px; height: 20px; stroke: #888; fill: none; stroke-width: 2; }
+.modal h3 { margin-bottom: 12px; font-size: 18px; padding-right: 30px; }
+.modal input { width: 100%; padding: 8px; margin: 8px 0; border: 1px solid #ddd; border-radius: 8px; font-size: 16px; }
+.modal button { margin-right: 8px; padding: 8px 16px; border-radius: 8px; border: none; cursor: pointer; font-size: 16px; }
+.modal .primary-btn { background: #3b82f6; color: #fff; }
+.history-list { list-style: none; font-size: 14px; }
+.history-list li { padding: 6px 0; border-bottom: 1px solid #f0f0f0; display: flex; }
+.history-time { min-width: 80px; color: #888; margin-right: 10px; font-size: 13px; }
+.img-thumb { width: 60px; height: 60px; object-fit: cover; border-radius: 4px; margin: 4px; border: 1px solid #eee; }
+.attachments { display: flex; flex-wrap: wrap; margin: 8px 0; }
+.msg-img { max-width: 200px; border-radius: 8px; margin: 4px 0; }
+.msg-placeholder .msg-bubble { opacity: 0.6; }
+
+.version { text-align: center; font-size: 12px; color: #aaa; margin-top: 16px; }
+
+.fullscreen-overlay {
+ position: fixed; top: 0; left: 0; width: 100%; height: 100%;
+ background: rgba(0,0,0,0.9); display: flex; align-items: center; justify-content: center;
+ z-index: 200; cursor: pointer;
+}
+.fullscreen-overlay img { max-width: 100%; max-height: 100%; object-fit: contain; }
+.fullscreen-overlay .fullscreen-text {
+ background: #fff; padding: 20px; border-radius: 8px; max-width: 90%; max-height: 80%;
+ overflow: auto; font-size: 16px; line-height: 1.5; color: #333;
+}
+.fullscreen-overlay .fullscreen-text img { max-width: 200px; border-radius: 8px; margin: 4px 0; }
+.fullscreen-overlay .fullscreen-text table {
+ width: 100%;
+ border-collapse: collapse;
+ margin: 8px 0;
+}
+.fullscreen-overlay .fullscreen-text th,
+.fullscreen-overlay .fullscreen-text td {border: 1px solid #ddd;padding: 4px;text-align: left;font-size: 14px;}
+.fullscreen-overlay .fullscreen-text th {background: #f0f0f0;}
+
+.detail-row { margin-bottom: 8px; }
diff --git a/server/public/index.html b/server/public/index.html
index b17d8f4..ce1801f 100644
--- a/server/public/index.html
+++ b/server/public/index.html
@@ -8,119 +8,7 @@
-
+
@@ -132,7 +20,7 @@
-
v2.5
+
v2.6
-
+
-
-
+
+
+
+
+
diff --git a/server/public/js/auth.js b/server/public/js/auth.js
new file mode 100644
index 0000000..2ec09fd
--- /dev/null
+++ b/server/public/js/auth.js
@@ -0,0 +1,54 @@
+// 认证与初始化
+async function init() {
+ const token = Store.getToken();
+ if (token) {
+ try {
+ const res = await fetch('/api/user', { headers: { 'Authorization': `Bearer ${token}` } });
+ if (res.ok) {
+ const user = await res.json();
+ document.getElementById('login-page').classList.add('hidden');
+ document.getElementById('main-page').classList.remove('hidden');
+ if (localStorage.getItem('isAdmin') === 'true') {
+ document.getElementById('create-room-btn').classList.add('visible');
+ } else {
+ document.getElementById('create-room-btn').classList.remove('visible');
+ }
+ initWebSocket();
+ loadRooms();
+ updateSummaryPreview();
+ initSwipeGestures();
+ return;
+ }
+ } catch(e) {}
+ Store.clearAuth();
+ }
+ document.getElementById('login-page').classList.remove('hidden');
+ document.getElementById('main-page').classList.add('hidden');
+}
+
+async function login() {
+ const u = document.getElementById('login-user').value;
+ const p = document.getElementById('login-pass').value;
+ const res = await fetch('/api/login', {
+ method: 'POST', headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify({ username: u, password: p })
+ });
+ if (res.ok) {
+ const data = await res.json();
+ Store.saveAuth(data);
+ document.getElementById('login-page').classList.add('hidden');
+ document.getElementById('main-page').classList.remove('hidden');
+ if (data.isAdmin) {
+ document.getElementById('create-room-btn').classList.add('visible');
+ } else {
+ document.getElementById('create-room-btn').classList.remove('visible');
+ }
+ initWebSocket();
+ loadRooms();
+ updateSummaryPreview();
+ initSwipeGestures();
+ } else {
+ const err = await res.json();
+ document.getElementById('login-error').textContent = err.error || '登录失败';
+ }
+}
diff --git a/server/public/js/chat.js b/server/public/js/chat.js
new file mode 100644
index 0000000..34f1f98
--- /dev/null
+++ b/server/public/js/chat.js
@@ -0,0 +1,167 @@
+// 工具函数
+if (typeof marked !== 'undefined') marked.setOptions({ breaks: true, gfm: true, sanitize: false });
+
+function escapeHtml(text) {
+ const div = document.createElement('div');
+ div.textContent = text;
+ return div.innerHTML;
+}
+
+function compressImage(file) {
+ return new Promise((resolve, reject) => {
+ const reader = new FileReader();
+ reader.onload = (e) => {
+ const img = new Image();
+ img.onload = () => {
+ const canvas = document.createElement('canvas');
+ let width = img.width, height = img.height;
+ if (width > 1200) { height = height * (1200 / width); width = 1200; }
+ canvas.width = width; canvas.height = height;
+ const ctx = canvas.getContext('2d');
+ ctx.drawImage(img, 0, 0, width, height);
+ canvas.toBlob((blob) => resolve(blob), 'image/jpeg', 0.8);
+ };
+ img.src = e.target.result;
+ };
+ reader.readAsDataURL(file);
+ });
+}
+
+// 消息渲染
+const messagesContainer = document.getElementById('messages-container');
+
+function renderMessageHTML(msg) {
+ const currentUser = localStorage.getItem('currentUser');
+ const isMe = msg.user === currentUser;
+ const name = msg.user === '小财' ? '小财' : msg.user;
+ let contentHtml = msg.text ? escapeHtml(msg.text) : '';
+ if (msg.user === '小财' && typeof marked !== 'undefined' && msg.text) {
+ try { contentHtml = marked.parse(msg.text); } catch(e) {}
+ }
+ let attachHtml = '';
+ if (msg.attachments && msg.attachments.length) {
+ try {
+ const files = typeof msg.attachments === 'string' ? JSON.parse(msg.attachments) : msg.attachments;
+ attachHtml = files.map(f => {
+ const isImage = /\.(jpg|jpeg|png|gif)$/i.test(f);
+ if (isImage) return `
`;
+ return ``;
+ }).join('');
+ } catch(e) {}
+ }
+ return `
+
+
${name}
+
${contentHtml}${attachHtml}
+
${msg.timestamp}
+
`;
+ overlay.addEventListener('click', () => overlay.remove());
+ document.body.appendChild(overlay);
+}
+
+function onImgThumbDblClick(img) {
+ const overlay = document.createElement('div');
+ overlay.className = 'fullscreen-overlay';
+ overlay.innerHTML = `
`;
+ overlay.addEventListener('click', () => overlay.remove());
+ document.body.appendChild(overlay);
+}
+
+function onBubbleDblClick(e) {
+ e.stopPropagation();
+ const bubble = e.currentTarget;
+ const clone = bubble.cloneNode(true);
+ const overlay = document.createElement('div');
+ overlay.className = 'fullscreen-overlay';
+ const container = document.createElement('div');
+ container.className = 'fullscreen-text';
+ container.innerHTML = clone.innerHTML;
+ overlay.appendChild(container);
+ overlay.addEventListener('click', () => overlay.remove());
+ document.body.appendChild(overlay);
+}
+
+// 临时气泡 + 降级轮询
+function insertTempBubble() {
+ clearTempBubble();
+ const tempId = 'temp_' + Date.now();
+ const tempMsg = { id: tempId, user: '小财', text: '输入中...', attachments: [], timestamp: '', isTemp: true };
+ Store.messageCache.push(tempMsg);
+ messagesContainer.insertAdjacentHTML('beforeend', renderMessageHTML(tempMsg));
+ scrollToBottom();
+ Store.tempBubbleTimer = setTimeout(() => { clearTempBubble(); }, 8000);
+ if (Store.pollTimer) clearInterval(Store.pollTimer);
+ let pollCount = 0;
+ Store.pollTimer = setInterval(async () => {
+ pollCount++;
+ if (!Store.currentRoom || pollCount > 5) { clearInterval(Store.pollTimer); Store.pollTimer = null; return; }
+ try {
+ const token = Store.getToken();
+ const res = await fetch('/api/rooms/' + Store.currentRoom + '/messages', { headers: { 'Authorization': `Bearer ${token}` } });
+ const msgs = await res.json();
+ const lastCacheId = Store.messageCache.filter(m => !m.isTemp && !m.isPlaceholder).slice(-1)[0]?.id;
+ const newMsgs = msgs.filter(m => !lastCacheId || m.id > lastCacheId);
+ if (newMsgs.length) {
+ clearInterval(Store.pollTimer); Store.pollTimer = null;
+ clearTempBubble();
+ newMsgs.forEach(m => appendMessage(m));
+ }
+ } catch(e) {}
+ }, 2000);
+}
+
+function clearTempBubble() {
+ if (Store.tempBubbleTimer) { clearTimeout(Store.tempBubbleTimer); Store.tempBubbleTimer = null; }
+ if (Store.pollTimer) { clearInterval(Store.pollTimer); Store.pollTimer = null; }
+ Store.messageCache = Store.messageCache.filter(m => !m.isTemp);
+ const tempEls = messagesContainer.querySelectorAll('[data-msg-id^="temp_"]');
+ tempEls.forEach(el => el.remove());
+}
diff --git a/server/public/js/purchases.js b/server/public/js/purchases.js
new file mode 100644
index 0000000..6b41f74
--- /dev/null
+++ b/server/public/js/purchases.js
@@ -0,0 +1,182 @@
+// 采购相关功能
+async function loadPurchases() {
+ if (!Store.currentRoom) return;
+ const token = Store.getToken();
+ const res = await fetch('/api/rooms/' + Store.currentRoom + '/purchases', { headers: { 'Authorization': `Bearer ${token}` } });
+ const items = await res.json();
+ renderPurchasePanel(items);
+}
+
+function renderPurchasePanel(items) {
+ const container = document.getElementById('purchase-panel-body');
+ if (items.length === 0) { container.innerHTML = '暂无采购记录
'; return; }
+ const groups = {};
+ items.forEach(item => {
+ const month = formatMonth(item.created_at);
+ if (!groups[month]) groups[month] = [];
+ groups[month].push(item);
+ });
+ let html = '';
+ Object.keys(groups).sort().reverse().forEach(month => {
+ const monthItems = groups[month];
+ const monthTotal = monthItems.reduce((s, i) => s + (i.amount||0), 0);
+ html += ``;
+ monthItems.forEach(item => {
+ const timeShort = item.created_at.split(' ')[1]?.substring(0,5) || '';
+ const dateShort = item.created_at.split(' ')[0]?.substring(5) || '';
+ html += `
+
+
${escapeHtml(item.item)}¥${item.amount}
+
+ ${dateShort} ${timeShort}
+ ×${item.quantity} ${item.invoice_type !== '无票' ? '· ' + item.invoice_type : ''}
+ ${item.status}
+
+
`;
+ });
+ html += '
加载中...
';
+ document.getElementById('purchase-panel-overlay').classList.remove('hidden');
+ loadPurchases();
+}
+
+function closePurchasePanel() { document.getElementById('purchase-panel-overlay').classList.add('hidden'); }
+
+async function openDetail(pid) {
+ const token = Store.getToken();
+ const res = await fetch('/api/purchases/' + pid, { headers: { 'Authorization': `Bearer ${token}` } });
+ const p = await res.json();
+ document.getElementById('detail-title').textContent = p.item;
+ let attachHtml = '';
+ if (p.attachments?.length) attachHtml = '' + p.attachments.map(a => `
`).join('') + '
数量：${p.quantity}
+ 单价：¥${p.unit_price}
+ 邮费：¥${p.freight}
+ 总金额：¥${p.amount}
+ 付款方式：${p.payment_method || '未指定'}
+ 发票：${p.invoice_type || '无票'}
+ 状态：${p.status}
+ 申请人：${p.applicant}
+ 采购时间：${p.created_at}
+ 备注：${p.remarks || '无'}
+ ${attachHtml}
+ 操作历史
+ `;
+ document.getElementById('detail-modal').classList.remove('hidden');
+}
+
+function closeDetailModal() { document.getElementById('detail-modal').classList.add('hidden'); }
+
+async function openSummary() {
+ const token = Store.getToken();
+ const res = await fetch('/api/summary', { headers: { 'Authorization': `Bearer ${token}` } });
+ const summary = await res.json();
+ let html = '';
+ if (summary.length === 0) html = '暂无采购记录
';
+ else {
+ summary.forEach(s => {
+ html += `${escapeHtml(s.room_name)}
${s.purchase_count} 条，合计 ¥${s.total_amount}
+
${escapeHtml(room.name.charAt(0))}
+
+
${escapeHtml(room.name)}
+
${escapeHtml(lastMsg)}
+
+
+
${lastTime}
+ ${isAdmin ? `
` : ''}
+
+