feat(membership): replace purchase modal with membership page

frontend/src/app/api/payment/orders/route.ts

@@ -0,0 +1,51 @@
+import { NextResponse } from "next/server";
+import { isSupabaseConfigurationError } from "@/lib/supabase/config";
+import { createServerSupabaseClient } from "@/lib/supabase/server";
+import {
+  formatPaymentOrders,
+  PAYMENT_ORDERS_SELECT,
+  type PaymentOrderRow,
+} from "@/lib/payment-orders";
+
+export const runtime = "nodejs";
+
+const MAX_ORDERS = 20;
+
+export async function GET() {
+  try {
+    const supabase = await createServerSupabaseClient();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
+    if (authError || !user) {
+      return NextResponse.json({ error: "请先登录" }, { status: 401 });
+    }
+
+    const { data, error } = await supabase
+      .from("payment_orders")
+      .select(PAYMENT_ORDERS_SELECT.join(","))
+      .eq("user_id", user.id)
+      .order("created_at", { ascending: false })
+      .limit(MAX_ORDERS);
+
+    if (error) {
+      return NextResponse.json(
+        { error: "暂时无法查询订单" },
+        { status: 500 },
+      );
+    }
+
+    return NextResponse.json({
+      orders: formatPaymentOrders((data ?? []) as unknown as PaymentOrderRow[]),
+    });
+  } catch (error) {
+    if (isSupabaseConfigurationError(error)) {
+      return NextResponse.json(
+        { error: "Supabase 尚未配置", code: "SUPABASE_NOT_CONFIGURED" },
+        { status: 503 },
+      );
+    }
+    return NextResponse.json({ error: "订单服务暂时不可用" }, { status: 500 });
+  }
+}

frontend/src/app/api/redeem/route.ts

@@ -1,36 +1,48 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
-import { hashRedeemCode, normalizeRedeemCode } from "@/lib/supabase/codes";
+import { hashRedeemCode } from "@/lib/supabase/codes";
 import { isSupabaseConfigurationError } from "@/lib/supabase/config";
 import { createServerSupabaseClient } from "@/lib/supabase/server";
+import {
+  redeemErrorResponse,
+  redeemInputErrorResponse,
+} from "@/lib/redeem-response";
 
 export const runtime = "nodejs";
 
 const requestSchema = z.object({ code: z.string().max(100) });
 
-const redeemErrors: Record<string, { status: number; message: string }> = {
-  unauthorized: { status: 401, message: "请先登录" },
-  invalid_code: { status: 404, message: "兑换码不存在" },
-  expired_code: { status: 410, message: "兑换码已过期" },
-  revoked_code: { status: 410, message: "兑换码已撤销" },
-  already_redeemed: { status: 409, message: "兑换码已被使用" },
-  profile_missing: { status: 500, message: "账户资料不存在，请稍后重试" },
-};
-
 export async function POST(request: Request) {
   try {
-    const parsed = requestSchema.safeParse(await request.json().catch(() => null));
+    const parsed = requestSchema.safeParse(
+      await request.json().catch(() => null),
+    );
     if (!parsed.success) {
-      return NextResponse.json({ error: "请输入有效兑换码" }, { status: 400 });
+      const inputError = redeemInputErrorResponse();
+      return NextResponse.json(
+        { error: inputError.message, code: inputError.code },
+        { status: inputError.status },
+      );
     }
 
-    const code = normalizeRedeemCode(parsed.data.code);
-    if (!/^JYOTISH-[A-Z0-9]{4}-[A-Z0-9]{4}$/.test(code)) {
-      return NextResponse.json({ error: "兑换码格式不正确" }, { status: 400 });
+    // Only surrounding whitespace is trimmed; case is never changed. Every
+    // non-empty value is hashed as-is and evaluated by the database, so
+    // lowercase or malformed attempts still hit the RPC failure rate limit
+    // instead of being short-circuited client-side.
+    const code = parsed.data.code.trim();
+    if (!code) {
+      const inputError = redeemInputErrorResponse();
+      return NextResponse.json(
+        { error: inputError.message, code: inputError.code },
+        { status: inputError.status },
+      );
     }
 
     const supabase = await createServerSupabaseClient();
-    const { data: { user }, error: authError } = await supabase.auth.getUser();
+    const {
+      data: { user },
+      error: authError,
+    } = await supabase.auth.getUser();
     if (authError || !user) {
       return NextResponse.json({ error: "请先登录" }, { status: 401 });
     }
@@ -40,23 +52,37 @@ export async function POST(request: Request) {
     });
 
     if (error) {
-      return NextResponse.json({ error: "兑换失败，请稍后重试" }, { status: 500 });
+      const systemError = redeemErrorResponse("system_error");
+      return NextResponse.json(
+        { error: systemError.message, code: systemError.code },
+        { status: systemError.status },
+      );
     }
 
     const result = Array.isArray(data) ? data[0] : data;
     if (!result?.success) {
-      const mapped = redeemErrors[result?.error_code] ?? {
-        status: 500,
-        message: "兑换失败，请稍后重试",
-      };
-      return NextResponse.json({ error: mapped.message }, { status: mapped.status });
+      const mapped = redeemErrorResponse(result?.error_code);
+      return NextResponse.json(
+        { error: mapped.message, code: mapped.code },
+        { status: mapped.status },
+      );
     }
 
-    return NextResponse.json({ credits: result.credits });
+    return NextResponse.json({
+      awardedCredits: result.awarded_credits ?? null,
+      credits: result.credits,
+    });
   } catch (error) {
     if (isSupabaseConfigurationError(error)) {
-      return NextResponse.json({ error: "Supabase 尚未配置", code: "SUPABASE_NOT_CONFIGURED" }, { status: 503 });
+      return NextResponse.json(
+        { error: "Supabase 尚未配置", code: "SUPABASE_NOT_CONFIGURED" },
+        { status: 503 },
+      );
     }
-    return NextResponse.json({ error: "兑换服务暂时不可用" }, { status: 500 });
+    const systemError = redeemErrorResponse("system_error");
+    return NextResponse.json(
+      { error: systemError.message, code: systemError.code },
+      { status: systemError.status },
+    );
   }
 }