Merge branch 'master' of http://82.157.175.59:3000/GenarrativeAI/Genarrative

server-rs/crates/api-server/src/admin.rs

@@ -16,12 +16,14 @@ use axum::{
 };
 use reqwest::Client;
 use serde::Deserialize;
-use serde_json::Value;
+use serde_json::{Map, Value};
 use shared_contracts::admin::{
-    AdminDatabaseOverviewPayload, AdminDatabaseTableStatPayload, AdminDebugHeaderInput,
-    AdminDebugHttpRequest, AdminDebugHttpResponse, AdminLoginRequest, AdminLoginResponse,
-    AdminMeResponse, AdminOverviewResponse, AdminServiceOverviewPayload, AdminSessionPayload,
-    AdminTrackingEventEntryPayload, AdminTrackingEventListQuery, AdminTrackingEventListResponse,
+    AdminDatabaseOverviewPayload, AdminDatabaseTableListResponse, AdminDatabaseTableRowPayload,
+    AdminDatabaseTableRowsQuery, AdminDatabaseTableRowsResponse, AdminDatabaseTableStatPayload,
+    AdminDebugHeaderInput, AdminDebugHttpRequest, AdminDebugHttpResponse, AdminLoginRequest,
+    AdminLoginResponse, AdminMeResponse, AdminOverviewResponse, AdminServiceOverviewPayload,
+    AdminSessionPayload, AdminTrackingEventEntryPayload, AdminTrackingEventListQuery,
+    AdminTrackingEventListResponse,
 };
 use time::{OffsetDateTime, format_description::well_known::Rfc3339};
 
@@ -46,6 +48,8 @@ const BLOCKED_DEBUG_HEADERS: &[&str] = &[
 const SPACETIME_SCHEMA_VERSION_QUERY: &str = "version=9";
 const ADMIN_TRACKING_EVENT_DEFAULT_LIMIT: u32 = 200;
 const ADMIN_TRACKING_EVENT_MAX_LIMIT: u32 = 1000;
+const ADMIN_DATABASE_TABLE_DEFAULT_LIMIT: u32 = 100;
+const ADMIN_DATABASE_TABLE_MAX_LIMIT: u32 = 500;
 
 #[derive(Clone, Debug)]
 pub struct AuthenticatedAdmin {
@@ -170,6 +174,26 @@ pub async fn admin_list_tracking_events(
     ))
 }
 
+pub async fn admin_list_database_tables(
+    State(state): State<AppState>,
+    Extension(request_context): Extension<RequestContext>,
+    Extension(_admin): Extension<AuthenticatedAdmin>,
+) -> Result<Json<Value>, AppError> {
+    let response = fetch_admin_database_table_list(&state).await?;
+    Ok(json_success_body(Some(&request_context), response))
+}
+
+pub async fn admin_list_database_table_rows(
+    State(state): State<AppState>,
+    Extension(request_context): Extension<RequestContext>,
+    Extension(_admin): Extension<AuthenticatedAdmin>,
+    axum::extract::Path(table_name): axum::extract::Path<String>,
+    Query(query): Query<AdminDatabaseTableRowsQuery>,
+) -> Result<Json<Value>, AppError> {
+    let response = fetch_admin_database_table_rows(&state, &table_name, query).await?;
+    Ok(json_success_body(Some(&request_context), response))
+}
+
 pub async fn require_admin_auth(
     State(state): State<AppState>,
     mut request: Request,
@@ -263,21 +287,7 @@ async fn fetch_database_overview(state: &AppState) -> AdminDatabaseOverviewPaylo
     .ok()
     .flatten();
 
-    let schema_table_names = schema
-        .as_ref()
-        .and_then(|value| value.tables.as_ref())
-        .map(|tables| {
-            tables
-                .iter()
-                .filter_map(|table| table.name.as_deref())
-                .map(str::trim)
-                .filter(|name| !name.is_empty())
-                .map(ToOwned::to_owned)
-                .collect::<BTreeSet<_>>()
-                .into_iter()
-                .collect::<Vec<_>>()
-        })
-        .unwrap_or_default();
+    let schema_table_names = extract_schema_table_names(schema.as_ref());
 
     let mut table_stats = Vec::new();
     for table_name in &schema_table_names {
@@ -505,6 +515,275 @@ fn parse_count_value(value: &Value) -> Result<u64, String> {
     }
 }
 
+async fn fetch_admin_database_table_list(
+    state: &AppState,
+) -> Result<AdminDatabaseTableListResponse, AppError> {
+    let (_, tables, fetch_errors) = fetch_admin_database_schema_tables(state).await;
+    Ok(AdminDatabaseTableListResponse {
+        tables,
+        fetch_errors,
+    })
+}
+
+async fn fetch_admin_database_table_rows(
+    state: &AppState,
+    table_name: &str,
+    query: AdminDatabaseTableRowsQuery,
+) -> Result<AdminDatabaseTableRowsResponse, AppError> {
+    let table_name = table_name.trim();
+    if !is_safe_spacetime_table_name(table_name) {
+        return Err(AppError::from_status(StatusCode::BAD_REQUEST).with_message("表名不合法"));
+    }
+
+    let (_, tables, _) = fetch_admin_database_schema_tables(state).await;
+    if !tables.iter().any(|name| name == table_name) {
+        return Err(AppError::from_status(StatusCode::NOT_FOUND).with_message("表不存在"));
+    }
+
+    let client = Client::new();
+    let server_root = state.config.spacetime_server_url.trim_end_matches('/');
+    let database = state.config.spacetime_database.trim();
+    let token = resolve_admin_spacetime_sql_token(state);
+    let limit = clamp_admin_database_table_limit(query.limit);
+    let sql = format!("SELECT * FROM {table_name} LIMIT {limit}");
+    let payload = fetch_spacetime_sql_json(&client, server_root, database, token.as_deref(), &sql)
+        .await
+        .map_err(|error| {
+            AppError::from_status(StatusCode::BAD_GATEWAY).with_message(format!(
+                "表数据读取失败：{}",
+                normalize_table_count_error(&error)
+            ))
+        })?;
+    let mut response = parse_admin_database_table_rows_sql_response(table_name, limit, payload)
+        .map_err(|error| {
+            AppError::from_status(StatusCode::BAD_GATEWAY)
+                .with_message(format!("表数据解析失败：{error}"))
+        })?;
+    apply_admin_database_table_filters(&mut response.rows, &query)?;
+    response.total_returned = response.rows.len();
+    Ok(response)
+}
+
+async fn fetch_admin_database_schema_tables(
+    state: &AppState,
+) -> (Option<SpacetimeSchemaResponse>, Vec<String>, Vec<String>) {
+    let client = Client::new();
+    let server_root = state.config.spacetime_server_url.trim_end_matches('/');
+    let database = state.config.spacetime_database.trim();
+    let token = resolve_admin_spacetime_sql_token(state);
+    let mut fetch_errors = Vec::new();
+    let schema = fetch_spacetime_json::<SpacetimeSchemaResponse>(
+        &client,
+        &build_spacetime_schema_url(server_root, database),
+        token.as_deref(),
+    )
+    .await
+    .map_err(|error| fetch_errors.push(format!("数据库 schema 读取失败：{error}")))
+    .ok()
+    .flatten();
+    let tables = extract_schema_table_names(schema.as_ref());
+    (schema, tables, fetch_errors)
+}
+
+fn extract_schema_table_names(schema: Option<&SpacetimeSchemaResponse>) -> Vec<String> {
+    schema
+        .and_then(|value| value.tables.as_ref())
+        .map(|tables| {
+            tables
+                .iter()
+                .filter_map(|table| table.name.as_deref())
+                .map(str::trim)
+                .filter(|name| !name.is_empty())
+                .map(ToOwned::to_owned)
+                .collect::<BTreeSet<_>>()
+                .into_iter()
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default()
+}
+
+fn resolve_admin_spacetime_sql_token(state: &AppState) -> Option<String> {
+    state
+        .config
+        .spacetime_token
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(str::to_string)
+        .or_else(load_local_spacetime_cli_token)
+}
+
+fn clamp_admin_database_table_limit(limit: Option<u32>) -> u32 {
+    limit
+        .unwrap_or(ADMIN_DATABASE_TABLE_DEFAULT_LIMIT)
+        .clamp(1, ADMIN_DATABASE_TABLE_MAX_LIMIT)
+}
+
+fn parse_admin_database_table_rows_sql_response(
+    table_name: &str,
+    limit: u32,
+    payload: Value,
+) -> Result<AdminDatabaseTableRowsResponse, String> {
+    let statement = extract_first_sql_statement(payload)?;
+    let columns = extract_sql_statement_columns(&statement);
+    let rows_value = statement
+        .get("rows")
+        .ok_or_else(|| "SQL 响应缺少 rows 字段".to_string())?;
+    let row_values = rows_value
+        .as_array()
+        .ok_or_else(|| "SQL rows 字段格式非法".to_string())?;
+    let rows = row_values
+        .iter()
+        .map(|row| build_admin_database_table_row(row, &columns))
+        .collect::<Vec<_>>();
+    Ok(AdminDatabaseTableRowsResponse {
+        table_name: table_name.to_string(),
+        columns,
+        total_returned: rows.len(),
+        rows,
+        limit,
+    })
+}
+
+fn extract_first_sql_statement(payload: Value) -> Result<Value, String> {
+    match payload {
+        Value::Array(statements) => statements
+            .into_iter()
+            .next()
+            .ok_or_else(|| "SQL 结果为空".to_string()),
+        Value::Object(statement) => Ok(Value::Object(statement)),
+        _ => Err("SQL 响应格式非法".to_string()),
+    }
+}
+
+fn extract_sql_statement_columns(statement: &Value) -> Vec<String> {
+    statement
+        .get("schema")
+        .and_then(|schema| schema.get("elements"))
+        .and_then(Value::as_array)
+        .map(|elements| {
+            elements
+                .iter()
+                .enumerate()
+                .map(|(index, element)| {
+                    element
+                        .get("name")
+                        .and_then(extract_sql_schema_name)
+                        .map(ToOwned::to_owned)
+                        .unwrap_or_else(|| format!("col_{}", index + 1))
+                })
+                .collect::<Vec<_>>()
+        })
+        .unwrap_or_default()
+}
+
+fn build_admin_database_table_row(row: &Value, columns: &[String]) -> AdminDatabaseTableRowPayload {
+    let raw = normalize_admin_database_value(row);
+    let mut cells = Map::new();
+    if let Some(values) = row.as_array() {
+        for (index, value) in values.iter().enumerate() {
+            let key = columns
+                .get(index)
+                .cloned()
+                .unwrap_or_else(|| format!("col_{}", index + 1));
+            cells.insert(key, normalize_admin_database_value(value));
+        }
+    } else if let Some(object) = row.as_object() {
+        for (key, value) in object {
+            cells.insert(key.clone(), normalize_admin_database_value(value));
+        }
+    }
+    AdminDatabaseTableRowPayload {
+        cells: Value::Object(cells),
+        raw,
+    }
+}
+
+fn normalize_admin_database_value(value: &Value) -> Value {
+    match value {
+        Value::Array(items) if items.len() == 1 => normalize_admin_database_value(&items[0]),
+        Value::Array(items) if items.len() == 2 => {
+            if let Some(index) = items.first().and_then(Value::as_u64) {
+                if index == 0 {
+                    return items
+                        .get(1)
+                        .map(normalize_admin_database_value)
+                        .unwrap_or(Value::Null);
+                }
+                if index == 1 && items.get(1).and_then(Value::as_array).is_some() {
+                    return Value::Null;
+                }
+            }
+            Value::Array(items.iter().map(normalize_admin_database_value).collect())
+        }
+        Value::Array(items) => {
+            Value::Array(items.iter().map(normalize_admin_database_value).collect())
+        }
+        Value::Object(object) => {
+            if let Some(value) = object.get("some") {
+                return normalize_admin_database_value(value);
+            }
+            Value::Object(
+                object
+                    .iter()
+                    .map(|(key, value)| (key.clone(), normalize_admin_database_value(value)))
+                    .collect(),
+            )
+        }
+        _ => value.clone(),
+    }
+}
+
+fn apply_admin_database_table_filters(
+    rows: &mut Vec<AdminDatabaseTableRowPayload>,
+    query: &AdminDatabaseTableRowsQuery,
+) -> Result<(), AppError> {
+    if let Some(search) = normalized_non_empty(query.search.as_deref()) {
+        let needle = search.to_ascii_lowercase();
+        rows.retain(|row| row.cells.to_string().to_ascii_lowercase().contains(&needle));
+    }
+
+    if let Some(filters) = normalized_non_empty(query.filters.as_deref()) {
+        let parsed = serde_json::from_str::<Value>(filters).map_err(|error| {
+            AppError::from_status(StatusCode::BAD_REQUEST)
+                .with_message(format!("筛选 JSON 解析失败：{error}"))
+        })?;
+        let object = parsed.as_object().ok_or_else(|| {
+            AppError::from_status(StatusCode::BAD_REQUEST)
+                .with_message("筛选条件必须是 JSON object")
+        })?;
+        rows.retain(|row| row_matches_admin_database_filters(row, object));
+    }
+    Ok(())
+}
+
+fn row_matches_admin_database_filters(
+    row: &AdminDatabaseTableRowPayload,
+    filters: &Map<String, Value>,
+) -> bool {
+    let Some(cells) = row.cells.as_object() else {
+        return filters.is_empty();
+    };
+    filters.iter().all(|(key, expected)| {
+        cells
+            .get(key)
+            .map(|actual| admin_database_filter_value_matches(actual, expected))
+            .unwrap_or(false)
+    })
+}
+
+fn admin_database_filter_value_matches(actual: &Value, expected: &Value) -> bool {
+    if actual == expected {
+        return true;
+    }
+    if let Some(expected_text) = expected.as_str() {
+        return value_to_string(actual)
+            .map(|actual_text| actual_text == expected_text)
+            .unwrap_or(false);
+    }
+    false
+}
+
 async fn fetch_admin_tracking_events(
     state: &AppState,
     query: AdminTrackingEventListQuery,
@@ -949,14 +1228,16 @@ fn build_admin_session_payload(session: crate::state::AdminSession) -> AdminSess
 #[cfg(test)]
 mod tests {
     use super::{
+        apply_admin_database_table_filters, build_admin_database_table_row,
         build_admin_tracking_events_sql, build_body_preview, build_debug_base_url,
-        build_spacetime_schema_url, clamp_admin_tracking_event_limit, is_safe_spacetime_table_name,
-        normalize_debug_path, normalize_table_count_error,
+        build_spacetime_schema_url, clamp_admin_database_table_limit,
+        clamp_admin_tracking_event_limit, is_safe_spacetime_table_name, normalize_debug_path,
+        normalize_table_count_error, parse_admin_database_table_rows_sql_response,
         parse_admin_tracking_events_sql_response, parse_spacetime_sql_count_response, trim_preview,
     };
     use axum::{http::StatusCode, response::IntoResponse};
     use serde_json::json;
-    use shared_contracts::admin::AdminTrackingEventListQuery;
+    use shared_contracts::admin::{AdminDatabaseTableRowsQuery, AdminTrackingEventListQuery};
 
     #[test]
     fn normalize_debug_path_rejects_absolute_url() {
@@ -1119,6 +1400,103 @@ mod tests {
         assert_eq!(count, 3);
     }
 
+    #[test]
+    fn clamp_admin_database_table_limit_uses_default_and_bounds() {
+        assert_eq!(clamp_admin_database_table_limit(None), 100);
+        assert_eq!(clamp_admin_database_table_limit(Some(0)), 1);
+        assert_eq!(clamp_admin_database_table_limit(Some(800)), 500);
+    }
+
+    #[test]
+    fn parse_admin_database_table_rows_sql_response_maps_schema_columns() {
+        let payload = json!([
+            {
+                "schema": {
+                    "elements": [
+                        {"name": {"some": "user_id"}},
+                        {"name": {"some": "points"}}
+                    ]
+                },
+                "rows": [["u1", 12]]
+            }
+        ]);
+
+        let response = parse_admin_database_table_rows_sql_response("profile_wallet", 100, payload)
+            .expect("table rows should parse");
+
+        assert_eq!(response.table_name, "profile_wallet");
+        assert_eq!(response.columns, vec!["user_id", "points"]);
+        assert_eq!(response.total_returned, 1);
+        assert_eq!(response.rows[0].cells["user_id"], json!("u1"));
+        assert_eq!(response.rows[0].cells["points"], json!(12));
+    }
+
+    #[test]
+    fn build_admin_database_table_row_normalizes_optional_sats_values() {
+        let row = build_admin_database_table_row(
+            &json!([[0, "u1"], [1, []]]),
+            &["user_id".to_string(), "deleted_at".to_string()],
+        );
+
+        assert_eq!(row.cells["user_id"], json!("u1"));
+        assert_eq!(row.cells["deleted_at"], json!(null));
+    }
+
+    #[test]
+    fn apply_admin_database_table_filters_supports_search_and_json_filters() {
+        let mut rows = vec![
+            build_admin_database_table_row(
+                &json!(["u1", "alice", 12]),
+                &[
+                    "user_id".to_string(),
+                    "name".to_string(),
+                    "points".to_string(),
+                ],
+            ),
+            build_admin_database_table_row(
+                &json!(["u2", "bob", 8]),
+                &[
+                    "user_id".to_string(),
+                    "name".to_string(),
+                    "points".to_string(),
+                ],
+            ),
+        ];
+
+        apply_admin_database_table_filters(
+            &mut rows,
+            &AdminDatabaseTableRowsQuery {
+                search: Some("ali".to_string()),
+                filters: Some(r#"{"points":12}"#.to_string()),
+                limit: None,
+            },
+        )
+        .expect("filters should apply");
+
+        assert_eq!(rows.len(), 1);
+        assert_eq!(rows[0].cells["user_id"], json!("u1"));
+    }
+
+    #[test]
+    fn apply_admin_database_table_filters_rejects_non_object_filter() {
+        let mut rows = vec![build_admin_database_table_row(
+            &json!(["u1"]),
+            &["user_id".to_string()],
+        )];
+
+        let error = apply_admin_database_table_filters(
+            &mut rows,
+            &AdminDatabaseTableRowsQuery {
+                search: None,
+                filters: Some("[]".to_string()),
+                limit: None,
+            },
+        )
+        .expect_err("non object filter should fail");
+
+        assert_eq!(error.into_response().status(), StatusCode::BAD_REQUEST);
+    }
+
     #[test]
     fn build_admin_tracking_events_sql_quotes_filters_and_clamps_limit() {
         let sql = build_admin_tracking_events_sql(&AdminTrackingEventListQuery {

server-rs/crates/api-server/src/app.rs

@@ -14,8 +14,8 @@ use tracing::{Level, Span, error, info, info_span, warn};
 
 use crate::{
     admin::{
-        admin_debug_http, admin_list_tracking_events, admin_login, admin_me, admin_overview,
-        require_admin_auth,
+        admin_debug_http, admin_list_database_table_rows, admin_list_database_tables,
+        admin_list_tracking_events, admin_login, admin_me, admin_overview, require_admin_auth,
     },
     ai_tasks::{
         append_ai_text_chunk, attach_ai_result_reference, cancel_ai_task, complete_ai_stage,
@@ -200,6 +200,20 @@ pub fn build_router(state: AppState) -> Router {
                 require_admin_auth,
             )),
         )
+        .route(
+            "/admin/api/database/tables",
+            get(admin_list_database_tables).route_layer(middleware::from_fn_with_state(
+                state.clone(),
+                require_admin_auth,
+            )),
+        )
+        .route(
+            "/admin/api/database/tables/{table_name}/rows",
+            get(admin_list_database_table_rows).route_layer(middleware::from_fn_with_state(
+                state.clone(),
+                require_admin_auth,
+            )),
+        )
         .route(
             "/admin/api/profile/redeem-codes",
             get(admin_list_profile_redeem_codes)

server-rs/crates/api-server/src/auth_session.rs

@@ -26,6 +26,47 @@ pub fn create_password_auth_session(
     create_auth_session(state, user, session_client, AuthLoginMethod::Password)
 }
 
+#[cfg(not(test))]
+pub async fn record_daily_login_tracking_event_after_auth_success(
+    state: &AppState,
+    request_context: &crate::request_context::RequestContext,
+    user_id: &str,
+    login_method: AuthLoginMethod,
+) {
+    // 登录埋点是运营数据，不应反向阻断已经成功的认证会话签发。
+    match state
+        .spacetime_client()
+        .record_daily_login_tracking_event(user_id.to_string())
+        .await
+    {
+        Ok(()) => tracing::info!(
+            request_id = request_context.request_id(),
+            operation = request_context.operation(),
+            user_id = %user_id,
+            login_method = %login_method.as_str(),
+            "登录成功每日登录埋点已记录"
+        ),
+        Err(error) => tracing::warn!(
+            request_id = request_context.request_id(),
+            operation = request_context.operation(),
+            user_id = %user_id,
+            login_method = %login_method.as_str(),
+            error = %error,
+            "登录成功每日登录埋点记录失败，登录流程继续"
+        ),
+    }
+}
+
+#[cfg(test)]
+pub async fn record_daily_login_tracking_event_after_auth_success(
+    _state: &AppState,
+    _request_context: &crate::request_context::RequestContext,
+    _user_id: &str,
+    _login_method: AuthLoginMethod,
+) {
+    // 单元测试默认不启动 SpacetimeDB；这里仅验证登录链路调用点能通过编译并保持非阻断语义。
+}
+
 pub fn create_auth_session(
     state: &AppState,
     user: &AuthUser,

server-rs/crates/api-server/src/password_entry.rs

@@ -4,7 +4,7 @@ use axum::{
     http::{HeaderMap, StatusCode},
     response::IntoResponse,
 };
-use module_auth::{PasswordEntryError, PasswordEntryInput};
+use module_auth::{AuthLoginMethod, PasswordEntryError, PasswordEntryInput};
 use serde_json::json;
 use shared_contracts::auth::{PasswordEntryRequest, PasswordEntryResponse};
 
@@ -12,7 +12,8 @@ use crate::{
     api_response::json_success_body,
     auth_payload::map_auth_user_payload,
     auth_session::{
-        attach_set_cookie_header, build_refresh_session_cookie_header, create_password_auth_session,
+        attach_set_cookie_header, build_refresh_session_cookie_header,
+        create_password_auth_session, record_daily_login_tracking_event_after_auth_success,
     },
     http_error::AppError,
     request_context::RequestContext,
@@ -49,6 +50,13 @@ pub async fn password_entry(
     }
     let session_client = resolve_session_client_context(&headers);
     let signed_session = create_password_auth_session(&state, &result.user, &session_client)?;
+    record_daily_login_tracking_event_after_auth_success(
+        &state,
+        &request_context,
+        &result.user.id,
+        AuthLoginMethod::Password,
+    )
+    .await;
     state
         .sync_auth_store_snapshot_to_spacetime()
         .await

server-rs/crates/api-server/src/password_management.rs

@@ -16,6 +16,7 @@ use crate::{
     auth_payload::map_auth_user_payload,
     auth_session::{
         attach_set_cookie_header, build_refresh_session_cookie_header, create_auth_session,
+        record_daily_login_tracking_event_after_auth_success,
     },
     http_error::AppError,
     phone_auth::map_phone_auth_error,
@@ -79,6 +80,13 @@ pub async fn reset_password(
         &session_client,
         module_auth::AuthLoginMethod::Password,
     )?;
+    record_daily_login_tracking_event_after_auth_success(
+        &state,
+        &request_context,
+        &result.user.id,
+        module_auth::AuthLoginMethod::Password,
+    )
+    .await;
 
     let mut headers = HeaderMap::new();
     attach_set_cookie_header(

server-rs/crates/api-server/src/phone_auth.rs

@@ -20,6 +20,7 @@ use crate::{
     auth_payload::map_auth_user_payload,
     auth_session::{
         attach_set_cookie_header, build_refresh_session_cookie_header, create_auth_session,
+        record_daily_login_tracking_event_after_auth_success,
     },
     http_error::AppError,
     platform_errors::{attach_retry_after, map_phone_auth_platform_store_error},
@@ -176,6 +177,13 @@ pub async fn phone_login(
         &session_client,
         AuthLoginMethod::Phone,
     )?;
+    record_daily_login_tracking_event_after_auth_success(
+        &state,
+        &request_context,
+        &result.user.id,
+        AuthLoginMethod::Phone,
+    )
+    .await;
     state
         .sync_auth_store_snapshot_to_spacetime()
         .await

server-rs/crates/api-server/src/refresh_session.rs

@@ -13,7 +13,8 @@ use crate::{
     auth::RefreshSessionToken,
     auth_session::{
         attach_set_cookie_header, build_clear_refresh_session_cookie_header,
-        build_refresh_session_cookie_header, map_refresh_session_error, sign_access_token_for_user,
+        build_refresh_session_cookie_header, map_refresh_session_error,
+        record_daily_login_tracking_event_after_auth_success, sign_access_token_for_user,
     },
     http_error::AppError,
     request_context::RequestContext,
@@ -54,6 +55,13 @@ pub async fn refresh_session(
         &rotated.session.session_id,
         Some(&rotated.session.issued_by_provider),
     )?;
+    record_daily_login_tracking_event_after_auth_success(
+        &state,
+        &request_context,
+        &rotated.user.id,
+        rotated.session.issued_by_provider.clone(),
+    )
+    .await;
     state
         .sync_auth_store_snapshot_to_spacetime()
         .await

server-rs/crates/api-server/src/wechat_auth.rs

@@ -21,6 +21,7 @@ use crate::{
     auth_payload::map_auth_user_payload,
     auth_session::{
         attach_set_cookie_header, build_refresh_session_cookie_header, create_auth_session,
+        record_daily_login_tracking_event_after_auth_success,
     },
     http_error::AppError,
     platform_errors::{attach_retry_after, map_wechat_provider_error},
@@ -74,6 +75,7 @@ pub async fn start_wechat_login(
 
 pub async fn handle_wechat_callback(
     State(state): State<AppState>,
+    Extension(request_context): Extension<RequestContext>,
     headers: HeaderMap,
     Query(query): Query<WechatCallbackQuery>,
 ) -> Result<impl IntoResponse, AppError> {
@@ -141,6 +143,13 @@ pub async fn handle_wechat_callback(
                 &session_client,
                 AuthLoginMethod::Wechat,
             )?;
+            record_daily_login_tracking_event_after_auth_success(
+                &state,
+                &request_context,
+                &result.user.id,
+                AuthLoginMethod::Wechat,
+            )
+            .await;
             state
                 .sync_auth_store_snapshot_to_spacetime()
                 .await
@@ -208,6 +217,13 @@ pub async fn bind_wechat_phone(
         &session_client,
         AuthLoginMethod::Wechat,
     )?;
+    record_daily_login_tracking_event_after_auth_success(
+        &state,
+        &request_context,
+        &result.user.id,
+        AuthLoginMethod::Wechat,
+    )
+    .await;
     state
         .sync_auth_store_snapshot_to_spacetime()
         .await

server-rs/crates/module-runtime/src/domain.rs

@@ -544,6 +544,13 @@ pub struct RuntimeTrackingEventInput {
     pub occurred_at_micros: i64,
 }
 
+#[cfg_attr(feature = "spacetime-types", derive(SpacetimeType))]
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+pub struct RuntimeTrackingEventProcedureResult {
+    pub ok: bool,
+    pub error_message: Option<String>,
+}
+
 #[cfg_attr(feature = "spacetime-types", derive(SpacetimeType))]
 #[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
 pub struct RuntimeProfileTaskConfigSnapshot {

server-rs/crates/platform-oss/README.md

@@ -34,6 +34,8 @@
 1. 当前产品口径为服务器上传 AI 生成资源、Web 端只负责读取。
 2. 因此 `STS` 不作为默认上传主链，`api-server` 只暴露禁用式 contract，避免浏览器拿到 OSS 写权限。
 3. 服务端生成资源应优先复用 `OssClient::put_object`，上传成功后再走对象确认链路写入 `asset_object`。
+    4. 读签名和 `HEAD Object` 的入参必须直接传 object_key，不要把 bucket 名拼进路径；例如 `generated-square-hole-assets/.../image.png` 才是正确入参，`xushi-dev/...` 这类前缀不属于 object_key。
+    5. OSS V4 `x-oss-date` 必须固定为 `yyyyMMdd'T'HHmmss'Z'`，不能依赖 `time::Time::to_string()`；后者在小时小于 10 时可能输出非补零时间，导致签名格式错误。
 
 ## 3. 边界约束
 

server-rs/crates/platform-oss/src/lib.rs

@@ -1084,6 +1084,7 @@ fn build_v4_signature_scope(endpoint: &str, signed_at: OffsetDateTime) -> Result
 }
 
 fn build_v4_signature_date(signed_at: OffsetDateTime) -> Result<String, OssError> {
+    // 中文注释：time::Time 的 Display 在小时小于 10 时不会稳定补零，OSS V4 必须使用固定宽度 UTC 时间。
     Ok(format!(
         "{}T{:02}{:02}{:02}Z",
         format_v4_signature_scope_date(signed_at),
@@ -1486,6 +1487,39 @@ mod tests {
         assert!(response.signed_url.contains("&x-oss-signature="));
     }
 
+    #[test]
+    fn sign_get_object_url_uses_square_hole_object_key_without_bucket_prefix() {
+        let client = OssClient::new(
+            OssConfig::new(
+                "xushi-dev".to_string(),
+                "oss-cn-shanghai.aliyuncs.com".to_string(),
+                "test-access-key-id".to_string(),
+                "test-access-key-secret".to_string(),
+                DEFAULT_READ_EXPIRE_SECONDS,
+                DEFAULT_POST_EXPIRE_SECONDS,
+                DEFAULT_POST_MAX_SIZE_BYTES,
+                DEFAULT_SUCCESS_ACTION_STATUS,
+            )
+            .expect("OSS config should be valid"),
+        );
+
+        let response = client
+            .sign_get_object_url(OssSignedGetObjectUrlRequest {
+                object_key: "generated-square-hole-assets/square-hole-session-546d881972684be2980a2a882cd0cc71/square-hole-profile-134411276ce1469cbe398f946a25d7f8/square-hole-shape-image/rabbit-option/asset-1777979289912039/image.png".to_string(),
+                expire_seconds: Some(300),
+            })
+            .expect("square hole object key should build signed url");
+
+        assert_eq!(response.bucket, "xushi-dev".to_string());
+        assert_eq!(
+            response.object_key,
+            "generated-square-hole-assets/square-hole-session-546d881972684be2980a2a882cd0cc71/square-hole-profile-134411276ce1469cbe398f946a25d7f8/square-hole-shape-image/rabbit-option/asset-1777979289912039/image.png".to_string()
+        );
+        assert!(response
+            .signed_url
+            .starts_with("https://xushi-dev.oss-cn-shanghai.aliyuncs.com/generated-square-hole-assets/square-hole-session-546d881972684be2980a2a882cd0cc71/square-hole-profile-134411276ce1469cbe398f946a25d7f8/square-hole-shape-image/rabbit-option/asset-1777979289912039/image.png?"));
+    }
+
     #[test]
     fn sign_get_object_url_rejects_unsupported_prefix() {
         let client = build_client();

server-rs/crates/shared-contracts/src/admin.rs

@@ -77,6 +77,42 @@ pub struct AdminDatabaseTableStatPayload {
     pub error_message: Option<String>,
 }
 
+// 后台表清单独立用于“表查询”页，避免页面必须先拉完整总览。
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminDatabaseTableListResponse {
+    pub tables: Vec<String>,
+    pub fetch_errors: Vec<String>,
+}
+
+// 后台通用表查询参数，用户输入不进入 SQL，只在 API Server 内存中过滤。
+#[derive(Clone, Debug, Serialize, Deserialize, Default, PartialEq, Eq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminDatabaseTableRowsQuery {
+    pub limit: Option<u32>,
+    pub search: Option<String>,
+    pub filters: Option<String>,
+}
+
+// 后台通用表查询响应，cells 使用列名映射，raw 保留原始行便于详情排障。
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminDatabaseTableRowsResponse {
+    pub table_name: String,
+    pub columns: Vec<String>,
+    pub rows: Vec<AdminDatabaseTableRowPayload>,
+    pub total_returned: usize,
+    pub limit: u32,
+}
+
+// 单行查询结果，值统一用 JSON 承载以兼容不同表字段类型。
+#[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
+#[serde(rename_all = "camelCase")]
+pub struct AdminDatabaseTableRowPayload {
+    pub cells: Value,
+    pub raw: Value,
+}
+
 // 调试请求只允许同源路径、受控请求头和有限请求体。
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq)]
 #[serde(rename_all = "camelCase")]

server-rs/crates/spacetime-client/src/mapper.rs

@@ -894,6 +894,16 @@ pub(crate) fn map_runtime_profile_reward_code_redeem_procedure_result(
     ))
 }
 
+pub(crate) fn map_runtime_tracking_event_procedure_result(
+    result: RuntimeTrackingEventProcedureResult,
+) -> Result<(), SpacetimeClientError> {
+    if !result.ok {
+        return Err(SpacetimeClientError::procedure_failed(result.error_message));
+    }
+
+    Ok(())
+}
+
 pub(crate) fn map_runtime_profile_task_center_procedure_result(
     result: RuntimeProfileTaskCenterProcedureResult,
 ) -> Result<RuntimeProfileTaskCenterRecord, SpacetimeClientError> {

server-rs/crates/spacetime-client/src/module_bindings/mod.rs

@@ -525,6 +525,7 @@ pub mod record_big_fish_like_procedure;
 pub mod record_big_fish_play_procedure;
 pub mod record_custom_world_profile_like_procedure;
 pub mod record_custom_world_profile_play_procedure;
+pub mod record_daily_login_tracking_event_and_return_procedure;
 pub mod record_puzzle_work_like_procedure;
 pub mod record_visual_novel_runtime_event_procedure;
 pub mod redeem_profile_referral_invite_code_procedure;
@@ -655,6 +656,7 @@ pub mod runtime_snapshot_table;
 pub mod runtime_snapshot_type;
 pub mod runtime_snapshot_upsert_input_type;
 pub mod runtime_tracking_scope_kind_type;
+pub mod runtime_tracking_event_procedure_result_type;
 pub mod save_puzzle_form_draft_procedure;
 pub mod save_puzzle_generated_images_procedure;
 pub mod seed_analytics_date_dimensions_reducer;
@@ -1309,6 +1311,7 @@ pub use record_big_fish_like_procedure::record_big_fish_like;
 pub use record_big_fish_play_procedure::record_big_fish_play;
 pub use record_custom_world_profile_like_procedure::record_custom_world_profile_like;
 pub use record_custom_world_profile_play_procedure::record_custom_world_profile_play;
+pub use record_daily_login_tracking_event_and_return_procedure::record_daily_login_tracking_event_and_return;
 pub use record_puzzle_work_like_procedure::record_puzzle_work_like;
 pub use record_visual_novel_runtime_event_procedure::record_visual_novel_runtime_event;
 pub use redeem_profile_referral_invite_code_procedure::redeem_profile_referral_invite_code;
@@ -1439,6 +1442,7 @@ pub use runtime_snapshot_table::*;
 pub use runtime_snapshot_type::RuntimeSnapshot;
 pub use runtime_snapshot_upsert_input_type::RuntimeSnapshotUpsertInput;
 pub use runtime_tracking_scope_kind_type::RuntimeTrackingScopeKind;
+pub use runtime_tracking_event_procedure_result_type::RuntimeTrackingEventProcedureResult;
 pub use save_puzzle_form_draft_procedure::save_puzzle_form_draft;
 pub use save_puzzle_generated_images_procedure::save_puzzle_generated_images;
 pub use seed_analytics_date_dimensions_reducer::seed_analytics_date_dimensions;

server-rs/crates/spacetime-client/src/module_bindings/record_daily_login_tracking_event_and_return_procedure.rs

@@ -0,0 +1,62 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+use super::runtime_profile_task_center_get_input_type::RuntimeProfileTaskCenterGetInput;
+use super::runtime_tracking_event_procedure_result_type::RuntimeTrackingEventProcedureResult;
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+struct RecordDailyLoginTrackingEventAndReturnArgs {
+    pub input: RuntimeProfileTaskCenterGetInput,
+}
+
+impl __sdk::InModule for RecordDailyLoginTrackingEventAndReturnArgs {
+    type Module = super::RemoteModule;
+}
+
+#[allow(non_camel_case_types)]
+/// Extension trait for access to the procedure `record_daily_login_tracking_event_and_return`.
+///
+/// Implemented for [`super::RemoteProcedures`].
+pub trait record_daily_login_tracking_event_and_return {
+    fn record_daily_login_tracking_event_and_return(
+        &self,
+        input: RuntimeProfileTaskCenterGetInput,
+    ) {
+        self.record_daily_login_tracking_event_and_return_then(input, |_, _| {});
+    }
+
+    fn record_daily_login_tracking_event_and_return_then(
+        &self,
+        input: RuntimeProfileTaskCenterGetInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<RuntimeTrackingEventProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    );
+}
+
+impl record_daily_login_tracking_event_and_return for super::RemoteProcedures {
+    fn record_daily_login_tracking_event_and_return_then(
+        &self,
+        input: RuntimeProfileTaskCenterGetInput,
+
+        __callback: impl FnOnce(
+                &super::ProcedureEventContext,
+                Result<RuntimeTrackingEventProcedureResult, __sdk::InternalError>,
+            ) + Send
+            + 'static,
+    ) {
+        self.imp
+            .invoke_procedure_with_callback::<_, RuntimeTrackingEventProcedureResult>(
+                "record_daily_login_tracking_event_and_return",
+                RecordDailyLoginTrackingEventAndReturnArgs { input },
+                __callback,
+            );
+    }
+}

server-rs/crates/spacetime-client/src/module_bindings/runtime_tracking_event_procedure_result_type.rs

@@ -0,0 +1,16 @@
+// THIS FILE IS AUTOMATICALLY GENERATED BY SPACETIMEDB. EDITS TO THIS FILE
+// WILL NOT BE SAVED. MODIFY TABLES IN YOUR MODULE SOURCE CODE INSTEAD.
+
+#![allow(unused, clippy::all)]
+use spacetimedb_sdk::__codegen::{self as __sdk, __lib, __sats, __ws};
+
+#[derive(__lib::ser::Serialize, __lib::de::Deserialize, Clone, PartialEq, Debug)]
+#[sats(crate = __lib)]
+pub struct RuntimeTrackingEventProcedureResult {
+    pub ok: bool,
+    pub error_message: Option<String>,
+}
+
+impl __sdk::InModule for RuntimeTrackingEventProcedureResult {
+    type Module = super::RemoteModule;
+}

server-rs/crates/spacetime-client/src/runtime.rs

@@ -304,6 +304,30 @@ impl SpacetimeClient {
         .await
     }
 
+    pub async fn record_daily_login_tracking_event(
+        &self,
+        user_id: String,
+    ) -> Result<(), SpacetimeClientError> {
+        let procedure_input = build_runtime_profile_task_center_get_input(user_id)
+            .map_err(SpacetimeClientError::validation_failed)?
+            .into();
+
+        self.call_after_connect(move |connection, sender| {
+            connection
+                .procedures()
+                .record_daily_login_tracking_event_and_return_then(
+                    procedure_input,
+                    move |_, result| {
+                        let mapped = result
+                            .map_err(SpacetimeClientError::from_sdk_error)
+                            .and_then(map_runtime_tracking_event_procedure_result);
+                        send_once(&sender, mapped);
+                    },
+                );
+        })
+        .await
+    }
+
     pub async fn get_profile_task_center(
         &self,
         user_id: String,

server-rs/crates/spacetime-module/src/runtime/profile.rs

@@ -491,13 +491,36 @@ pub fn query_analytics_metric(
     }
 }
 
-// 任务中心读取会顺手记录当日登录埋点，确保“每日登录”只依赖后端事实。
+// 登录成功埋点由认证链路主动调用；任务中心只负责读取和刷新任务进度。
+#[spacetimedb::procedure]
+pub fn record_daily_login_tracking_event_and_return(
+    ctx: &mut ProcedureContext,
+    input: RuntimeProfileTaskCenterGetInput,
+) -> RuntimeTrackingEventProcedureResult {
+    match ctx.try_with_tx(|tx| {
+        let validated_input = build_runtime_profile_task_center_get_input(input.user_id.clone())
+            .map_err(|error| error.to_string())?;
+        ensure_default_profile_task_config(tx);
+        record_daily_login_tracking_event(tx, &validated_input.user_id)
+    }) {
+        Ok(()) => RuntimeTrackingEventProcedureResult {
+            ok: true,
+            error_message: None,
+        },
+        Err(message) => RuntimeTrackingEventProcedureResult {
+            ok: false,
+            error_message: Some(message),
+        },
+    }
+}
+
+// 任务中心读取会刷新进度；每日登录埋点应由登录成功链路提前记录。
 #[spacetimedb::procedure]
 pub fn get_profile_task_center(
     ctx: &mut ProcedureContext,
     input: RuntimeProfileTaskCenterGetInput,
 ) -> RuntimeProfileTaskCenterProcedureResult {
-    match ctx.try_with_tx(|tx| get_profile_task_center_snapshot(tx, input.clone(), true)) {
+    match ctx.try_with_tx(|tx| get_profile_task_center_snapshot(tx, input.clone(), false)) {
         Ok(record) => RuntimeProfileTaskCenterProcedureResult {
             ok: true,
             record: Some(record),