备份：大改造前的完整版本 - 修复合同细节/付款节点/文件上传/施工管理/项目保存等BUG

backend/routes/upload.js

@@ -2,27 +2,30 @@ const express = require('express');
 const multer = require('multer');
 const path = require('path');
 const COS = require('cos-nodejs-sdk-v5');
+const { authenticate } = require('../middleware/auth');
 
 const router = express.Router();
 
+// COS配置从环境变量读取，不再硬编码密钥
 const cos = new COS({
-  SecretId: 'AKID8PXTCi2A4vdB6oMitsfM3b1FNQL5kEVZ',
-  SecretKey: 'vY0OgmhRyKUSClBRXSIySmqkTUZZYdwo'
+  SecretId: process.env.TENCENT_SECRET_ID,
+  SecretKey: process.env.TENCENT_SECRET_KEY
 });
 
 const cosConfig = {
-  Bucket: 'qingyuan-erp-files-1310040146',
-  Region: 'ap-hongkong'
+  Bucket: process.env.COS_BUCKET || 'qingyuan-erp-files-1310040146',
+  Region: process.env.COS_REGION || 'ap-hongkong'
 };
 
 const imageFormats = ['jpg', 'jpeg', 'png', 'gif', 'bmp', 'webp', 'svg'];
 
 const upload = multer({ 
   storage: multer.memoryStorage(),
-  limits: { fileSize: 10 * 1024 * 1024 }
+  limits: { fileSize: 50 * 1024 * 1024 }
 });
 
-router.post('/upload/single', upload.single('file'), (req, res) => {
+// 所有上传接口都需要认证
+router.post('/single', authenticate, upload.single('file'), (req, res) => {
   try {
     if (!req.file) {
       return res.status(400).json({ success: false, error: '没有上传文件' });
@@ -33,7 +36,6 @@ router.post('/upload/single', upload.single('file'), (req, res) => {
     const randomStr = Math.random().toString(36).substring(2, 8);
     const filename = 'uploads/' + timestamp + '_' + randomStr + '.' + ext;
     
-    console.log('开始上传文件到 COS:', filename);
     
     cos.putObject({
       Bucket: cosConfig.Bucket,
@@ -45,14 +47,12 @@ router.post('/upload/single', upload.single('file'), (req, res) => {
     }, (err, data) => {
       if (err) {
         console.error('COS 上传失败:', err);
-        return res.status(500).json({ success: false, error: '上传失败: ' + err.message });
+        return res.status(500).json({ success: false, error: '上传失败' });
       }
       
-      console.log('COS 上传成功:', data);
       
       const permanentUrl = 'https://' + cosConfig.Bucket + '.cos.' + cosConfig.Region + '.myqcloud.com/' + filename;
       
-      console.log('返回永久 URL:', permanentUrl);
       
       res.json({
         success: true,
@@ -73,7 +73,7 @@ router.post('/upload/single', upload.single('file'), (req, res) => {
   }
 });
 
-router.post('/upload/multiple', upload.array('files', 10), (req, res) => {
+router.post('/multiple', authenticate, upload.array('files', 10), (req, res) => {
   try {
     if (!req.files || req.files.length === 0) {
       return res.status(400).json({ success: false, error: '没有上传文件' });