YunfanGoForIt · Oct 22, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 21, 2026 · Oct 22, 2026
diff --git a/common/page_info.go b/common/page_info.go
@@ -6,6 +6,8 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+const maxPageNumber = 1_000_000
+
 type PageInfo struct {
 	Page     int `json:"page"`      // page num 页码
 	PageSize int `json:"page_size"` // page size 页大小
@@ -48,13 +50,9 @@ func GetPageQuery(c *gin.Context) *PageInfo {
 		pageInfo.PageSize = pageSize
 	}
 	if pageInfo.Page < 1 {
-		// 兼容
-		page, _ := strconv.Atoi(c.Query("p"))
-		if page != 0 {
-			pageInfo.Page = page
-		} else {
-			pageInfo.Page = 1
-		}
+		pageInfo.Page = 1
+	} else if pageInfo.Page > maxPageNumber {
+		pageInfo.Page = maxPageNumber
 	}
 
 	if pageInfo.PageSize == 0 {
@@ -74,7 +72,9 @@ func GetPageQuery(c *gin.Context) *PageInfo {
 		}
 	}
 
-	if pageInfo.PageSize > 100 {
+	if pageInfo.PageSize < 1 {
+		pageInfo.PageSize = ItemsPerPage
+	} else if pageInfo.PageSize > 100 {
 		pageInfo.PageSize = 100
 	}
 

diff --git a/common/page_info_test.go b/common/page_info_test.go
@@ -0,0 +1,52 @@
+package common
+
+import (
+	"net/http/httptest"
+	"testing"
+
+	"github.com/gin-gonic/gin"
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetPageQueryClampsNegativeValues(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	for _, target := range []string{
+		"/list?p=-1&page_size=-1",
+		"/list?p=0&ps=-1",
+		"/list?p=1&size=-1",
+	} {
+		request := httptest.NewRequest("GET", target, nil)
+		context, _ := gin.CreateTestContext(httptest.NewRecorder())
+		context.Request = request
+
+		page := GetPageQuery(context)
+
+		require.Equal(t, 1, page.Page, target)
+		require.Equal(t, ItemsPerPage, page.PageSize, target)
+	}
+}
+
+func TestGetPageQueryCapsLargePageSize(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	request := httptest.NewRequest("GET", "/list?p=2&page_size=1000", nil)
+	context, _ := gin.CreateTestContext(httptest.NewRecorder())
+	context.Request = request
+
+	page := GetPageQuery(context)
+
+	require.Equal(t, 2, page.Page)
+	require.Equal(t, 100, page.PageSize)
+}
+
+func TestGetPageQueryCapsLargePageNumber(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	request := httptest.NewRequest("GET", "/list?p=2147483647&page_size=100", nil)
+	context, _ := gin.CreateTestContext(httptest.NewRecorder())
+	context.Request = request
+
+	page := GetPageQuery(context)
+
+	require.Equal(t, maxPageNumber, page.Page)
+	require.Equal(t, 100, page.PageSize)
+	require.GreaterOrEqual(t, page.GetStartIdx(), 0)
+}
diff --git a/controller/subscription.go b/controller/subscription.go
@@ -462,6 +462,21 @@ func normalizeAdminSubscriptionPlan(plan *model.SubscriptionPlan) error {
 	return plan.ValidateV1Contract()
 }
 
+func preserveUnsubmittedSubscriptionPlanFields(plan *model.SubscriptionPlan, existing model.SubscriptionPlan) {
+	if plan.Currency == "" {
+		plan.Currency = existing.Currency
+	}
+	if plan.AllowedChannels == "" {
+		plan.AllowedChannels = existing.AllowedChannels
+	}
+	if plan.MaxUpstreamCost == "" {
+		plan.MaxUpstreamCost = existing.MaxUpstreamCost
+	}
+	if plan.DisplayMetadata == "" {
+		plan.DisplayMetadata = existing.DisplayMetadata
+	}
+}
+
 func ensureUniqueProductCode(planId int, productCode string) error {
 	productCode = strings.TrimSpace(productCode)
 	if productCode == "" {
@@ -601,6 +616,7 @@ func AdminUpdateSubscriptionPlan(c *gin.Context) {
 			return
 		}
 	}
+	preserveUnsubmittedSubscriptionPlanFields(&req.Plan, existingPlan)
 	if err := normalizeAdminSubscriptionPlan(&req.Plan); err != nil {
 		common.ApiError(c, err)
 		return
@@ -647,14 +663,14 @@ func AdminUpdateSubscriptionPlan(c *gin.Context) {
 			"product_tier":               req.Plan.ProductTier,
 			"billing_multiplier":         req.Plan.BillingMultiplier,
 			"price_version":              req.Plan.PriceVersion,
-			"allowed_channels":           req.Plan.AllowedChannels,
-			"max_upstream_cost":          req.Plan.MaxUpstreamCost,
 			"fallback_allowed":           req.Plan.FallbackAllowed,
 			"course_eligible":            req.Plan.CourseEligible,
 			"template_id":                req.Plan.TemplateId,
-			"display_metadata":           req.Plan.DisplayMetadata,
 			"updated_at":                 common.GetTimestamp(),
 		}
+		updateMap["allowed_channels"] = req.Plan.AllowedChannels
+		updateMap["max_upstream_cost"] = req.Plan.MaxUpstreamCost
+		updateMap["display_metadata"] = req.Plan.DisplayMetadata
 		if req.Plan.AllowBalancePay != nil {
 			updateMap["allow_balance_pay"] = *req.Plan.AllowBalancePay
 		}

diff --git a/controller/subscription_catalog.go b/controller/subscription_catalog.go
@@ -32,7 +32,8 @@ type StorefrontCatalogItemDTO struct {
 
 // GetSubscriptionPublicCatalog serves the landing-page product catalog to
 // anonymous visitors. Listed products and display_metadata.preview drafts are
-// included; checkout keeps enforcing enabled/listed server-side.
+// included; paid checkout enforces Enabled server-side while Listed controls
+// catalog discovery and RedemptionEnabled independently controls code claims.
 func GetSubscriptionPublicCatalog(c *gin.Context) {
 	items, err := model.GetStorefrontCatalog()
 	if err != nil {
@@ -42,10 +43,7 @@ func GetSubscriptionPublicCatalog(c *gin.Context) {
 	result := make([]StorefrontCatalogItemDTO, 0, len(items))
 	for _, item := range items {
 		plan := item.Plan
-		metadata := json.RawMessage("{}")
-		if trimmed := strings.TrimSpace(plan.DisplayMetadata); trimmed != "" {
-			metadata = json.RawMessage(trimmed)
-		}
+		metadata := storefrontDisplayMetadata(plan.DisplayMetadata)
 		result = append(result, StorefrontCatalogItemDTO{
 			ProductID:       subscriptionPlanProductID(plan),
 			Title:           plan.Title,
@@ -65,3 +63,26 @@ func GetSubscriptionPublicCatalog(c *gin.Context) {
 	}
 	common.ApiSuccess(c, result)
 }
+
+func storefrontDisplayMetadata(raw string) json.RawMessage {
+	var input map[string]any
+	if err := common.Unmarshal([]byte(strings.TrimSpace(raw)), &input); err != nil {
+		return json.RawMessage("{}")
+	}
+	allowed := map[string]struct{}{
+		"badges": {}, "benefits": {}, "button_label": {}, "recommended": {},
+		"featured": {}, "reference_price": {}, "models_display": {}, "zone": {},
+		"image": {}, "image_alt": {}, "preview": {},
+	}
+	filtered := make(map[string]any, len(input))
+	for key, value := range input {
+		if _, ok := allowed[key]; ok {
+			filtered[key] = value
+		}
+	}
+	encoded, err := common.Marshal(filtered)
+	if err != nil {
+		return json.RawMessage("{}")
+	}
+	return json.RawMessage(encoded)
+}
diff --git a/controller/subscription_storefront_catalog_test.go b/controller/subscription_storefront_catalog_test.go
@@ -69,7 +69,7 @@ func setupStorefrontCatalogTest(t *testing.T) *gin.Engine {
 	model.InvalidateSubscriptionPlanCache(1)
 
 	router := gin.New()
-	router.GET("/api/subscription/public/catalog", middleware.HeaderNavModuleAuth("pricing"), GetSubscriptionPublicCatalog)
+	router.GET("/api/subscription/public/catalog", middleware.HeaderNavModulePublic("pricing"), GetSubscriptionPublicCatalog)
 	return router
 }
 
@@ -114,6 +114,14 @@ func decodeStorefrontCatalog(t *testing.T, body []byte) []map[string]any {
 
 func TestStorefrontCatalogServesAnonymousRequestsWithoutCostFields(t *testing.T) {
 	router := setupStorefrontCatalogTest(t)
+	func() {
+		common.OptionMapRWMutex.Lock()
+		defer common.OptionMapRWMutex.Unlock()
+		if common.OptionMap == nil {
+			common.OptionMap = make(map[string]string)
+		}
+		common.OptionMap["HeaderNavModules"] = `{"pricing":{"enabled":true,"requireAuth":true}}`
+	}()
 	createStorefrontCatalogPlan(t, model.SubscriptionPlan{
 		Title:           "Pro",
 		Subtitle:        "适合稳定使用与高频开发",
@@ -129,7 +137,7 @@ func TestStorefrontCatalogServesAnonymousRequestsWithoutCostFields(t *testing.T)
 		SortOrder:       10,
 		AllowedChannels: `{"deepseek-v4-flash-ga-260731":[7]}`,
 		MaxUpstreamCost: `{"deepseek-v4-flash-ga-260731":{"input":9.99}}`,
-		DisplayMetadata: `{"badges":[{"label":"主推","tone":"accent"}],"recommended":true}`,
+		DisplayMetadata: `{"badges":[{"label":"主推","tone":"accent"}],"recommended":true,"internal_note":"do not expose"}`,
 	})
 
 	code, body := requestStorefrontCatalog(t, router)
@@ -152,6 +160,7 @@ func TestStorefrontCatalogServesAnonymousRequestsWithoutCostFields(t *testing.T)
 	metadata, ok := item["display_metadata"].(map[string]any)
 	require.True(t, ok, "display_metadata must decode to an object: %v", item["display_metadata"])
 	assert.Equal(t, true, metadata["recommended"])
+	assert.NotContains(t, metadata, "internal_note")
 
 	for _, forbidden := range []string{
 		"allowed_channels", "max_upstream_cost", "fallback_allowed",
@@ -164,6 +173,36 @@ func TestStorefrontCatalogServesAnonymousRequestsWithoutCostFields(t *testing.T)
 	assert.NotContains(t, string(body), "9.99", "upstream settlement cost must never leak")
 }
 
+func TestPreserveUnsubmittedSubscriptionPlanFields(t *testing.T) {
+	existing := model.SubscriptionPlan{
+		Currency: "CNY", AllowedChannels: `{"model":[1]}`,
+		MaxUpstreamCost: `{"model":{"input":1}}`, DisplayMetadata: `{"recommended":true}`,
+	}
+	updated := model.SubscriptionPlan{Title: "Updated"}
+	preserveUnsubmittedSubscriptionPlanFields(&updated, existing)
+
+	require.Equal(t, existing.Currency, updated.Currency)
+	require.Equal(t, existing.AllowedChannels, updated.AllowedChannels)
+	require.Equal(t, existing.MaxUpstreamCost, updated.MaxUpstreamCost)
+	require.Equal(t, existing.DisplayMetadata, updated.DisplayMetadata)
+}
+
+func TestStorefrontCatalogRedactsUnknownDisplayMetadata(t *testing.T) {
+	router := setupStorefrontCatalogTest(t)
+	createStorefrontCatalogPlan(t, model.SubscriptionPlan{
+		Title: "Pro", ProductCode: "pro", Listed: true, Enabled: true,
+		DisplayMetadata: `{"button_label":"Buy","internal_note":"secret","allowed_channels":{"model":[7]}}`,
+	})
+
+	_, body := requestStorefrontCatalog(t, router)
+	items := decodeStorefrontCatalog(t, body)
+	require.Len(t, items, 1)
+	metadata := items[0]["display_metadata"].(map[string]any)
+	require.Equal(t, "Buy", metadata["button_label"])
+	assert.NotContains(t, metadata, "internal_note")
+	assert.NotContains(t, metadata, "allowed_channels")
+}
+
 func TestStorefrontCatalogIncludesPreviewDraftsAndHidesUnlistedDrafts(t *testing.T) {
 	router := setupStorefrontCatalogTest(t)
 	createStorefrontCatalogPlan(t, model.SubscriptionPlan{

diff --git a/middleware/header_nav.go b/middleware/header_nav.go
@@ -122,6 +122,22 @@ func HeaderNavModuleAuth(module string) gin.HandlerFunc {
 	}
 }
 
+// HeaderNavModulePublic keeps a public endpoint available regardless of the
+// module's navigation login preference while still honoring its enabled flag.
+func HeaderNavModulePublic(module string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !getHeaderNavAccess(module).Enabled {
+			c.JSON(http.StatusForbidden, gin.H{
+				"success": false,
+				"message": fmt.Sprintf("%s is disabled", module),
+			})
+			c.Abort()
+			return
+		}
+		TryUserAuth()(c)
+	}
+}
+
 func HeaderNavModulePublicOrUserAuth(module string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		access := getHeaderNavAccess(module)

diff --git a/middleware/header_nav_test.go b/middleware/header_nav_test.go
@@ -105,6 +105,14 @@ func TestHeaderNavModuleAuthRequiresLoginForPricing(t *testing.T) {
 	require.Equal(t, http.StatusUnauthorized, recorder.Code)
 }
 
+func TestHeaderNavModulePublicIgnoresRequireAuthButHonorsEnabled(t *testing.T) {
+	withHeaderNavModules(t, `{"pricing":{"enabled":true,"requireAuth":true}}`)
+	require.Equal(t, http.StatusOK, performHeaderNavRequest(t, HeaderNavModulePublic("pricing"), false).Code)
+
+	withHeaderNavModules(t, `{"pricing":{"enabled":false,"requireAuth":false}}`)
+	require.Equal(t, http.StatusForbidden, performHeaderNavRequest(t, HeaderNavModulePublic("pricing"), false).Code)
+}
+
 func TestHeaderNavModuleAuthRequiresLoginForRankings(t *testing.T) {
 	raw := `{"rankings":{"enabled":true,"requireAuth":true}}`
 	withHeaderNavModules(t, raw)

diff --git a/model/bigfish_product_test.go b/model/bigfish_product_test.go
@@ -176,6 +176,24 @@ func TestBigfishIFLinkPaySharedPoolKeyExpiryAndCrossTierLimit(t *testing.T) {
 	}
 }
 
+func TestHiddenEnabledPlanRemainsDirectlyPurchasable(t *testing.T) {
+	plans := setupBigfishProductsTest(t)
+	plan := plans[0]
+	require.False(t, plan.Listed)
+	require.True(t, plan.Enabled)
+
+	user := createV1ContractUser(t, "bigfish-hidden-purchase-user")
+	order, _, err := CreateSubscriptionOrder(user.Id, plan.Id, "bigfish-hidden-enabled", PaymentMethodIFLinkPay, PaymentProviderIFLinkPay, true)
+	require.NoError(t, err)
+	require.Equal(t, common.TopUpStatusPending, order.Status)
+
+	require.NoError(t, DB.Model(&SubscriptionPlan{}).Where("id = ?", plan.Id).Update("enabled", false).Error)
+	InvalidateSubscriptionPlanCache(plan.Id)
+	disabledUser := createV1ContractUser(t, "bigfish-disabled-purchase-user")
+	_, _, err = CreateSubscriptionOrder(disabledUser.Id, plan.Id, "bigfish-hidden-disabled", PaymentMethodIFLinkPay, PaymentProviderIFLinkPay, true)
+	require.ErrorContains(t, err, "套餐未启用")
+}
+
 func TestBigfishConcurrentOrdersCannotReserveDifferentTiers(t *testing.T) {
 	plans := setupBigfishProductsTest(t)
 	user := createV1ContractUser(t, "bigfish-concurrent-user")

diff --git a/model/cilai_contract_test.go b/model/cilai_contract_test.go
@@ -141,6 +141,25 @@ func TestValidateV1ContractRejectsFrozenRuleDrift(t *testing.T) {
 	require.ErrorContains(t, broken.ValidateV1Contract(), "fail closed")
 }
 
+func TestLimitedPlanRejectsAnotherPendingPurchase(t *testing.T) {
+	truncateTables(t)
+	user := createV1ContractUser(t, "limited-pending-user")
+	plan := v1MonthlyPlanFixture(t, "monthly-limited", 2, 49.9)
+	plan.MaxPurchasePerUser = 1
+	require.NoError(t, DB.Create(plan).Error)
+	InvalidateSubscriptionPlanCache(plan.Id)
+
+	first, _, err := CreateSubscriptionOrder(user.Id, plan.Id, "limited-pending-first", PaymentMethodAlipay, PaymentProviderAlipay, true)
+	require.NoError(t, err)
+	require.Equal(t, common.TopUpStatusPending, first.Status)
+	_, _, err = CreateSubscriptionOrder(user.Id, plan.Id, "limited-pending-second", PaymentMethodAlipay, PaymentProviderAlipay, true)
+	require.ErrorContains(t, err, "待支付")
+
+	var count int64
+	require.NoError(t, DB.Model(&SubscriptionOrder{}).Where("user_id = ? AND plan_id = ? AND status = ?", user.Id, plan.Id, common.TopUpStatusPending).Count(&count).Error)
+	require.EqualValues(t, 1, count)
+}
+
 func TestWalletProductPriceResolvesCurrentImmutableVersion(t *testing.T) {
 	truncateTables(t)
 	now := GetDBTimestamp()