feat: 新增备货单公共 API 接口（PI 号/VIN 号列表）

- 新增 ApiKeyAuth 中间件（hash_equals 防时序攻击） - 新增 PublicApiController（piList/vinList 两个只读接口） - 仅返回已审批通过（approval_status=2）的数据，支持分页和模糊搜索 - LIKE 通配符已转义，异常信息不暴露内部细节 - 附对接文档 docs/public-stock-api.md Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-06-02 17:44:53 +08:00
parent 929bae6f13
commit 35d98c16e9
6 changed files with 711 additions and 1 deletions
@@ -637,4 +637,10 @@ Route::group('/crm', function () {
        Route::any('/update', [app\common\controller\VehModificationController::class, 'update']);
        Route::any('/destroy', [app\common\controller\VehModificationController::class, 'destroy']);
    });
-});
+});
+
+// 公共 API（API Key 鉴权；通过 noNeedLogin/noNeedHeaderData 跳过 JWT 和 BasicData）
+Route::group('/common/public', function () {
+    Route::any('/pi/list', [app\common\controller\PublicApiController::class, 'piList']);
+    Route::any('/vin/list', [app\common\controller\PublicApiController::class, 'vinList']);
+})->middleware([app\middleware\AccessControl::class, app\middleware\ApiKeyAuth::class]);