# backend/app/routes/auth.py
from flask import Blueprint, request, jsonify
from flask_jwt_extended import create_access_token, jwt_required, get_jwt_identity
from werkzeug.security import check_password_hash, generate_password_hash
from app.models.user import User

auth_bp = Blueprint('auth', __name__)

@auth_bp.route('/api/auth/login', methods=['POST'])
def login():
    data = request.get_json()
    username = data.get('username')
    password = data.get('password')
    
    user = User.query.filter_by(username=username).first()
    
    if not user or not check_password_hash(user.password, password):
        return jsonify({'error': 'Invalid credentials'}), 401
    
    access_token = create_access_token(identity=user.id)
    
    return jsonify({
        'access_token': access_token,
        'user': {
            'id': user.id,
            'username': user.username,
            'email': user.email,
            'avatar': user.avatar,
            'gold': user.gold,
            'vip_level': user.vip_level
        }
    })

@auth_bp.route('/api/auth/register', methods=['POST'])
def register():
    data = request.get_json()
    
    # 检查用户名是否已存在
    if User.query.filter_by(username=data['username']).first():
        return jsonify({'error': 'Username already exists'}), 400
    
    # 创建新用户
    user = User(
        username=data['username'],
        email=data['email'],
        password=generate_password_hash(data['password']),
        gold=100  # 初始赠送100金币
    )
    
    db.session.add(user)
    db.session.commit()
    
    access_token = create_access_token(identity=user.id)
    
    return jsonify({
        'access_token': access_token,
        'user': {
            'id': user.id,
            'username': user.username,
            'email': user.email,
            'gold': user.gold,
            'vip_level': 0
        }
    }), 201

# backend/app/services/payment.py
import os
import json
import time
from datetime import datetime
from alipay.aop.api.AlipayClientConfig import AlipayClientConfig
from alipay.aop.api.DefaultAlipayClient import DefaultAlipayClient
from alipay.aop.api.domain.AlipayTradePagePayModel import AlipayTradePagePayModel
from alipay.aop.api.request.AlipayTradePagePayRequest import AlipayTradePagePayRequest
from alipay.aop.api.request.AlipayTradeQueryRequest import AlipayTradeQueryRequest
from app.models.payment import PaymentOrder
from app.models.user import User
from app import db

class PaymentService:
    def __init__(self):
        self.alipay_client = self._init_alipay_client()
    
    def _init_alipay_client(self):
        """初始化支付宝客户端"""
        alipay_client_config = AlipayClientConfig()
        alipay_client_config.server_url = 'https://openapi.alipay.com/gateway.do'
        alipay_client_config.app_id = os.getenv('ALIPAY_APP_ID')
        alipay_client_config.app_private_key = os.getenv('ALIPAY_PRIVATE_KEY')
        alipay_client_config.alipay_public_key = os.getenv('ALIPAY_PUBLIC_KEY')
        return DefaultAlipayClient(alipay_client_config)
    
    def create_order(self, user_id: int, amount: float, product_name: str) -> dict:
        """创建支付订单"""
        # 生成订单号
        order_no = f"AKA{int(time.time())}{user_id}"
        
        # 创建订单记录
        order = PaymentOrder(
            order_no=order_no,
            user_id=user_id,
            amount=amount,
            product_name=product_name,
            status='pending',
            created_at=datetime.utcnow()
        )
        db.session.add(order)
        db.session.commit()
        
        # 构建支付请求
        model = AlipayTradePagePayModel()
        model.out_trade_no = order_no
        model.total_amount = str(amount)
        model.subject = product_name
        model.product_code = "FAST_INSTANT_TRADE_PAY"
        
        request = AlipayTradePagePayRequest(biz_model=model)
        request.return_url = os.getenv('ALIPAY_RETURN_URL')
        request.notify_url = os.getenv('ALIPAY_NOTIFY_URL')
        
        # 获取支付表单
        form = self.alipay_client.page_execute(request)
        
        return {
            'order_no': order_no,
            'form': form,
            'amount': amount,
            'product_name': product_name
        }
    
    def verify_payment(self, data: dict) -> bool:
        """验证支付结果"""
        try:
            # 查询订单状态
            request = AlipayTradeQueryRequest()
            request.biz_content = json.dumps({
                'out_trade_no': data['out_trade_no']
            })
            
            response = self.alipay_client.execute(request)
            response_data = json.loads(response)
            
            if response_data.get('alipay_trade_query_response', {}).get('trade_status') == 'TRADE_SUCCESS':
                return self._update_order_status(data['out_trade_no'])
            
            return False
        except Exception as e:
            print(f"支付验证失败: {e}")
            return False
    
    def _update_order_status(self, order_no: str) -> bool:
        """更新订单状态并增加用户金币"""
        order = PaymentOrder.query.filter_by(order_no=order_no).first()
        if not order or order.status == 'completed':
            return False
        
        # 更新订单状态
        order.status = 'completed'
        order.completed_at = datetime.utcnow()
        
        # 增加用户金币
        user = User.query.get(order.user_id)
        if user:
            user.gold += int(order.amount * 100)  # 1元=100金币
        
        db.session.commit()
        return True

# backend/app/utils/validation.py
from marshmallow import Schema, fields, validate

class UserRegistrationSchema(Schema):
    username = fields.Str(
        required=True,
        validate=[
            validate.Length(min=3, max=50),
            validate.Regexp(r'^[a-zA-Z0-9_]+$', error='用户名只能包含字母、数字和下划线')
        ]
    )
    email = fields.Email(required=True)
    password = fields.Str(
        required=True,
        validate=validate.Length(min=8, max=128)
    )

class PaymentSchema(Schema):
    amount = fields.Decimal(
        required=True,
        validate=validate.Range(min=0.01, max=10000)
    )
    product_id = fields.Int(required=True)

# backend/app/utils/file_security.py
import os
import magic
from werkzeug.utils import secure_filename

ALLOWED_EXTENSIONS = {'png', 'jpg', 'jpeg', 'gif', 'mp3', 'wav'}
MAX_FILE_SIZE = 10 * 1024 * 1024  # 10MB

def validate_file(file):
    """验证上传文件的安全性"""
    
    # 检查文件扩展名
    filename = secure_filename(file.filename)
    if '.' not in filename:
        return False, "文件名无效"
    
    ext = filename.rsplit('.', 1)[1].lower()
    if ext not in ALLOWED_EXTENSIONS:
        return False, f"不支持的文件类型: {ext}"
    
    # 检查文件大小
    file.seek(0, os.SEEK_END)
    file_size = file.tell()
    file.seek(0)
    
    if file_size > MAX_FILE_SIZE:
        return False, "文件过大"
    
    # 检查文件MIME类型
    file_content = file.read(2048)
    file.seek(0)
    
    mime = magic.from_buffer(file_content, mime=True)
    allowed_mimes = {
        'image/png', 'image/jpeg', 'image/gif',
        'audio/mpeg', 'audio/wav'
    }
    
    if mime not in allowed_mimes:
        return False, "文件类型不匹配"
    
    return True, filename

# backend/app/models/music.py
class MusicContent(db.Model):
    __tablename__ = 'music_content'
    
    # 添加索引
    __table_args__ = (
        db.Index('idx_music_category_created', 'category_id', 'created_at'),
        db.Index('idx_music_active_play', 'is_active', 'play_count'),
    )
    
    @classmethod
    def get_by_category(cls, category_id, page=1, per_page=20):
        """优化分页查询"""
        return cls.query.filter_by(
            category_id=category_id,
            is_active=True
        ).order_by(
            cls.created_at.desc()
        ).paginate(
            page=page,
            per_page=per_page,
            error_out=False
        )
    
    @classmethod
    def get_popular(cls, limit=10):
        """获取热门音乐"""
        return cls.query.filter_by(
            is_active=True
        ).order_by(
            cls.play_count.desc()
        ).limit(limit).all()

# backend/app/utils/cache.py
import redis
import json
from functools import wraps

redis_client = redis.Redis(host='localhost', port=6379, db=0)

def cache_result(expiration=3600):
    """缓存装饰器"""
    def decorator(func):
        @wraps(func)
        def wrapper(*args, **kwargs):
            # 生成缓存键
            cache_key = f"{func.__name__}:{str(args)}:{str(kwargs)}"
            
            # 尝试从缓存获取
            cached = redis_client.get(cache_key)
            if cached:
                return json.loads(cached)
            
            # 执行函数并缓存结果
            result = func(*args, **kwargs)
            redis_client.setex(
                cache_key, 
                expiration, 
                json.dumps(result, default=str)
            )
            
            return result
        return wrapper
    return decorator

# 使用示例
@cache_result(expiration=1800)
def get_music_list(category_id, page=1):
    return MusicContent.get_by_category(category_id, page)

# tests/test_music_api.py
import pytest
from app import create_app
from app.models.music import MusicContent

@pytest.fixture
def client():
    app = create_app('testing')
    with app.test_client() as client:
        yield client

@pytest.fixture
def auth_headers(client):
    # 创建测试用户并获取token
    response = client.post('/api/auth/register', json={
        'username': 'testuser',
        'email': '[email protected]',
        'password': 'testpass123'
    })
    token = response.json['access_token']
    return {'Authorization': f'Bearer {token}'}

def test_get_music_list(client, auth_headers):
    # 创建测试数据
    music = MusicContent(
        title='测试歌曲',
        artist='测试艺术家',
        file_url='/test.mp3',
        category_id=1
    )
    db.session.add(music)
    db.session.commit()
    
    # 测试API
    response = client.get('/api/music?category_id=1', headers=auth_headers)
    assert response.status_code == 200
    assert len(response.json['items']) == 1
    assert response.json['items'][0]['title'] == '测试歌曲'

def test_music_playback(client, auth_headers):
    # 测试播放计数增加
    music = MusicContent.query.first()
    initial_count = music.play_count
    
    response = client.post(
        f'/api/music/{music.id}/play',
        headers=auth_headers
    )
    
    assert response.status_code == 200
    assert MusicContent.query.get(music.id).play_count == initial_count + 1