feat: 印尼语敏感词库种子数据（id-ID 增量补全 78 词）

- 新增 GooglePlayVerifier（调 Google Play Developer API 二次校验票据）
- StoreVerifier.verify 扩展 productId 参数，订单/控制器链路同步
- DisabledStoreVerifier 加条件装配，Google 启用后自动切换
- application.yml 增加 pay.google 配置（凭证经环境变量注入，默认关闭）

deploy/docker-compose.yml

@@ -0,0 +1,32 @@
+# Author: fruit.com.cn
+# 监控组件编排：Prometheus + Grafana（Loki 日志后续接入）
+services:
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: fruitshorts-prometheus
+    ports:
+      - "9090:9090"
+    volumes:
+      - ./prometheus.yml:/etc/prometheus/prometheus.yml
+      - prometheus-data:/prometheus
+    command:
+      - "--config.file=/etc/prometheus/prometheus.yml"
+    extra_hosts:
+      - "host.docker.internal:host-gateway"
+    restart: unless-stopped
+
+  grafana:
+    image: grafana/grafana:latest
+    container_name: fruitshorts-grafana
+    ports:
+      - "3000:3000"
+    volumes:
+      - grafana-data:/var/lib/grafana
+    environment:
+      - GF_SECURITY_ADMIN_USER=admin
+      - GF_SECURITY_ADMIN_PASSWORD=admin
+    restart: unless-stopped
+
+volumes:
+  prometheus-data:
+  grafana-data:

deploy/prometheus.yml

@@ -0,0 +1,16 @@
+# Author: fruit.com.cn
+# Prometheus 抓取配置：抓取后端双服务的 actuator 指标
+global:
+  scrape_interval: 15s
+  evaluation_interval: 15s
+
+scrape_configs:
+  - job_name: "fruitshorts-app-api"
+    metrics_path: "/actuator/prometheus"
+    static_configs:
+      - targets: ["host.docker.internal:8081"]
+
+  - job_name: "fruitshorts-admin-api"
+    metrics_path: "/actuator/prometheus"
+    static_configs:
+      - targets: ["host.docker.internal:8080"]

docs/api-phase1.md

@@ -74,30 +74,6 @@ POST /app/auth/register
 }
 ```
 
-**邮箱 + 密码注册（C 端第一批口径）**
-
-```json
-POST /app/auth/register
-{
-  "targetType": "EMAIL", "target": "User@Example.com ", "password": "nonton2026",
-  "deviceId": "d-1", "countryCode": "ID", "agreementVersion": "2026-10-01"
-}
-```
-
-| 规则 | 口径 |
-| --- | --- |
-| `targetType=EMAIL` | **`code` 可以不传**（邮箱+密码直接注册）；传了就走一次验证码校验（邮箱验证能力保留） |
-| `targetType=PHONE` | 维持原状：`code` **必填** |
-| 邮箱规范化 | 去空格 + 转小写（`batch1@Example.com ` → `batch1@example.com`）；格式不合法直接 `400 邮箱格式不正确` |
-| 密码强度 | 8–64 位，且**同时包含字母与数字**（不强制特殊字符：低端机输入成本高，拦机器注册靠频控） |
-| 注册频控 | 同 IP 24h ≤ **5** 个、同设备 24h ≤ **3** 个，超出返回 `429`（`TOO_MANY_REQUESTS`） |
-| 邮箱验证状态 | 免码注册时 `app_user_credential.verified = 0`（保留"待验证"），**不阻塞登录**；只有**验证码登录**会把 `verified` 置 1，密码登录不改变该状态 |
-
-频控口径落库在 `app_user.register_ip` / `register_device_id` 上（按 24h 计数，不新建计数表）。
-**残留风险**：IP 取自 `X-Forwarded-For`、设备号由客户端上报，都能伪造，只能挡脚本批量；
-真要防住需要接图形/行为验证码或风控服务，本阶段未做。验证码通道目前是 `LogOtpSender`（只写日志不发信），
-所以邮箱**可达性**未验证 —— 这也是"不阻塞注册"的前提。
-
 响应（登录、刷新同结构）：
 
 ```json

fruitshorts-admin-api/src/main/java/com/fruitshorts/FruitShortsApplication.java

@@ -5,48 +5,7 @@ package com.fruitshorts;
 import org.mybatis.spring.annotation.MapperScan;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import io.swagger.v3.oas.annotations.OpenAPIDefinition;
-import io.swagger.v3.oas.annotations.info.Info;
-import io.swagger.v3.oas.annotations.tags.Tag;
 
-@OpenAPIDefinition(
-        info = @Info(
-                title = "FruitShorts 运营后台接口（/admin/**）",
-                version = "1.0.0",
-                description = "接口契约以 FruitServer/docs/api-phase1.md 为准"
-        ),
-        tags = {
-                @Tag(name = "后台-管理员账号", description = "后台管理员账号管理"),
-                @Tag(name = "后台-App 用户", description = "App 用户查询与处置"),
-                @Tag(name = "后台-登录与个人", description = "管理端登录、菜单、个人资料与改密"),
-                @Tag(name = "后台-轮播图管理", description = "轮播图维护与排序"),
-                @Tag(name = "后台-评论审核", description = "评论检索与审核"),
-                @Tag(name = "后台-系统配置", description = "系统参数配置"),
-                @Tag(name = "后台-创作者管理", description = "创作者入驻审核与账号开通"),
-                @Tag(name = "创作者中心", description = "创作者工作台（作品、通知、看板）"),
-                @Tag(name = "创作者中心-内容与收费", description = "创作者内容编辑、提交审核与分集收费"),
-                @Tag(name = "后台-数据看板", description = "运营大盘与转码看板"),
-                @Tag(name = "后台-字典", description = "分类与状态字典"),
-                @Tag(name = "后台-离线下载管理", description = "下载授权查询、吊销与清理"),
-                @Tag(name = "后台-短剧分类", description = "短剧分类维护"),
-                @Tag(name = "后台-短剧管理", description = "短剧 CRUD 与审核发布流转"),
-                @Tag(name = "后台-权益管理", description = "权益补发与回收"),
-                @Tag(name = "后台-剧集管理", description = "剧集 CRUD 与排序"),
-                @Tag(name = "后台-媒资管理", description = "分片上传与媒资详情"),
-                @Tag(name = "后台-菜单管理", description = "菜单树维护"),
-                @Tag(name = "后台-操作日志", description = "操作日志检索"),
-                @Tag(name = "后台-订单管理", description = "订单检索、补发与退款"),
-                @Tag(name = "后台-权限点", description = "权限点查询"),
-                @Tag(name = "后台-分集收费", description = "分集价格配置"),
-                @Tag(name = "后台-对账", description = "对账任务与手动对账"),
-                @Tag(name = "后台-举报工单", description = "举报工单处理"),
-                @Tag(name = "后台-角色分类", description = "角色分类维护"),
-                @Tag(name = "后台-角色管理", description = "角色与角色权限"),
-                @Tag(name = "后台-敏感词库", description = "敏感词维护"),
-                @Tag(name = "后台-内容提交审核", description = "创作者内容提交审核"),
-                @Tag(name = "后台-金币钱包", description = "金币流水与人工补币"),
-        }
-)
 @SpringBootApplication
 @MapperScan("com.fruitshorts.**.dal.mapper")
 public class FruitShortsApplication {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/AdminUserController.java

@@ -27,7 +27,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.Map;
 
-@Tag(name = "后台-管理员账号")
+@Tag(name = "管理员管理")
 @RestController
 @RequestMapping("/admin/admin-users")
 @RequiredArgsConstructor
@@ -35,7 +35,7 @@ public class AdminUserController {
 
     private final AdminUserService adminUserService;
 
-    @Operation(summary = "管理员分页查询")
+    @Operation(summary = "管理员分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('system:admin-user')")
     public Result<PageResult<AdminUserRespVO>> page(AdminUserPageReqVO req) {
@@ -49,7 +49,7 @@ public class AdminUserController {
         return Result.ok(adminUserService.get(id));
     }
 
-    @Operation(summary = "新建管理员")
+    @Operation(summary = "新增管理员")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('system:admin-user')")
     @OperationLog(module = "后台管理", action = "新增管理员")
@@ -75,7 +75,7 @@ public class AdminUserController {
         return Result.ok();
     }
 
-    @Operation(summary = "启用 / 停用管理员")
+    @Operation(summary = "修改管理员状态")
     @PutMapping("/{id}/status")
     @PreAuthorize("@ss.hasPermission('system:admin-user')")
     @OperationLog(module = "后台管理", action = "修改管理员状态")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/AppUserAdminController.java

@@ -34,7 +34,7 @@ import java.util.Map;
 import java.util.stream.Collectors;
 
 /** 后台用户管理。 */
-@Tag(name = "后台-App 用户")
+@Tag(name = "App 用户管理")
 @RestController
 @RequestMapping("/admin/app-users")
 @RequiredArgsConstructor
@@ -45,21 +45,21 @@ public class AppUserAdminController {
     private final DramaService dramaService;
     private final EpisodeService episodeService;
 
-    @Operation(summary = "App 用户分页查询")
+    @Operation(summary = "用户分页检索（uid/昵称/手机号/邮箱/状态/国家/注册来源）")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('app-user:list')")
     public Result<PageResult<AppUserAdminRespVO>> page(AppUserQueryReqVO req) {
         return Result.ok(appUserAdminService.page(req));
     }
 
-    @Operation(summary = "App 用户详情")
+    @Operation(summary = "用户详情")
     @GetMapping("/{id}")
     @PreAuthorize("@ss.hasPermission('app-user:list')")
     public Result<AppUserAdminRespVO> detail(@PathVariable Long id) {
         return Result.ok(appUserAdminService.detail(id));
     }
 
-    @Operation(summary = "封禁 / 处置记录")
+    @Operation(summary = "封禁与申诉记录")
     @GetMapping("/{id}/ban-records")
     @PreAuthorize("@ss.hasPermission('app-user:list')")
     public Result<List<AppUserBanRecord>> banRecords(@PathVariable Long id) {
@@ -67,7 +67,7 @@ public class AppUserAdminController {
     }
 
     /** 观看流水明细：客服核对"用户说看了但没记录"这类问题时用，带上剧名与集号。 */
-    @Operation(summary = "观看流水明细（客服核对用）")
+    @Operation(summary = "观看流水明细（客服核对用，带剧名与集号）")
     @GetMapping("/{id}/watch-history")
     @PreAuthorize("@ss.hasPermission('app-user:list')")
     public Result<List<AppUserWatchHistoryVO>> watchHistory(@PathVariable Long id,
@@ -115,7 +115,7 @@ public class AppUserAdminController {
     }
 
     /** 状态处置：normal/limited/banned。封禁会立即吊销该用户全部会话。 */
-    @Operation(summary = "处置用户状态（封禁会立即吊销全部会话）")
+    @Operation(summary = "修改用户状态（normal/limited/banned，封禁立即吊销全部会话）")
     @PutMapping("/{id}/status")
     @PreAuthorize("@ss.hasPermission('app-user:update')")
     @OperationLog(module = "用户管理", action = "修改用户状态")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/AuthController.java

@@ -25,7 +25,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
 
-@Tag(name = "后台-登录与个人")
+@Tag(name = "后台认证")
 @RestController
 @RequestMapping("/admin/auth")
 @RequiredArgsConstructor
@@ -33,7 +33,7 @@ public class AuthController {
 
     private final AuthService authService;
 
-    @Operation(summary = "管理端登录")
+    @Operation(summary = "后台登录，返回 token")
     @PostMapping("/login")
     @OperationLog(module = "认证", action = "登录")
     public Result<LoginRespVO> login(@Valid @RequestBody LoginReqVO req, HttpServletRequest request) {
@@ -54,14 +54,14 @@ public class AuthController {
     }
 
     /** JWT 无状态，登出由前端清除 token 即可。 */
-    @Operation(summary = "登出")
+    @Operation(summary = "登出（JWT 无状态，前端清除 token 即可）")
     @PostMapping("/logout")
     @OperationLog(module = "认证", action = "退出登录")
     public Result<Void> logout() {
         return Result.ok();
     }
 
-    @Operation(summary = "修改自己的登录密码")
+    @Operation(summary = "修改密码")
     @PostMapping("/password")
     @OperationLog(module = "认证", action = "修改密码")
     public Result<Void> changePassword(@Valid @RequestBody PasswordChangeReqVO req) {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/BannerController.java

@@ -27,7 +27,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.List;
 import java.util.Map;
 
-@Tag(name = "后台-轮播图管理")
+@Tag(name = "轮播图管理")
 @RestController
 @RequestMapping("/admin/banners")
 @RequiredArgsConstructor
@@ -35,7 +35,7 @@ public class BannerController {
 
     private final BannerService bannerService;
 
-    @Operation(summary = "轮播图分页查询")
+    @Operation(summary = "轮播图分页检索（按位置/状态过滤）")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('banner:list')")
     public Result<PageResult<BannerRespVO>> page(@RequestParam(required = false) String position,
@@ -52,7 +52,7 @@ public class BannerController {
         return Result.ok(bannerService.get(id));
     }
 
-    @Operation(summary = "新建轮播图")
+    @Operation(summary = "新增轮播图")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('banner:create')")
     @OperationLog(module = "内容管理", action = "新增轮播图")
@@ -78,7 +78,7 @@ public class BannerController {
         return Result.ok();
     }
 
-    @Operation(summary = "上架 / 下架轮播图")
+    @Operation(summary = "修改轮播图状态")
     @PutMapping("/{id}/status")
     @PreAuthorize("@ss.hasPermission('banner:update')")
     @OperationLog(module = "内容管理", action = "修改轮播图状态")
@@ -87,7 +87,7 @@ public class BannerController {
         return Result.ok();
     }
 
-    @Operation(summary = "调整轮播排序")
+    @Operation(summary = "调整轮播图排序")
     @PutMapping("/sort")
     @PreAuthorize("@ss.hasPermission('banner:update')")
     public Result<Void> sort(@RequestBody Map<String, List<Long>> body) {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/CommentAdminController.java

@@ -27,7 +27,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.List;
 
 /** 后台评论审核。 */
-@Tag(name = "后台-评论审核")
+@Tag(name = "评论治理")
 @RestController
 @RequestMapping("/admin/comments")
 @RequiredArgsConstructor
@@ -36,7 +36,7 @@ public class CommentAdminController {
     private final CommentService commentService;
 
     /** 检索评论：默认按状态过滤，`status=pending` 即审核队列。 */
-    @Operation(summary = "评论检索（默认按状态过滤，待审队列）")
+    @Operation(summary = "评论检索（status=pending 即审核队列）")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('comment:list')")
     public Result<PageResult<CommentRespVO>> page(CommentQueryReqVO req) {
@@ -44,14 +44,14 @@ public class CommentAdminController {
     }
 
     /** 审核留证：机审与人审的完整链路。 */
-    @Operation(summary = "评论审核留证（机审 + 人审链路）")
+    @Operation(summary = "审核留证（机审与人审完整链路）")
     @GetMapping("/{id}/audit-records")
     @PreAuthorize("@ss.hasPermission('comment:list')")
     public Result<List<ContentAuditRecord>> auditRecords(@PathVariable Long id) {
         return Result.ok(commentService.auditRecords(id));
     }
 
-    @Operation(summary = "审核评论（通过 / 驳回）")
+    @Operation(summary = "审核评论（通过/驳回，带原因码与说明）")
     @PutMapping("/{id}/audit")
     @PreAuthorize("@ss.hasPermission('comment:audit')")
     @OperationLog(module = "内容治理", action = "审核评论")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/ConfigController.java

@@ -19,7 +19,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.List;
 import java.util.Map;
 
-@Tag(name = "后台-系统配置")
+@Tag(name = "系统配置")
 @RestController
 @RequestMapping("/admin/configs")
 @RequiredArgsConstructor
@@ -34,7 +34,7 @@ public class ConfigController {
         return Result.ok(configService.list());
     }
 
-    @Operation(summary = "保存系统配置")
+    @Operation(summary = "批量修改系统配置")
     @PutMapping
     @PreAuthorize("@ss.hasPermission('system:role')")
     @OperationLog(module = "后台管理", action = "修改系统设置")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/CreatorAdminController.java

@@ -31,7 +31,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.List;
 
 /** 后台创作者：检索、详情、资质、入驻审核。 */
-@Tag(name = "后台-创作者管理")
+@Tag(name = "创作者管理")
 @RestController
 @RequestMapping("/admin/creators")
 @RequiredArgsConstructor
@@ -40,7 +40,7 @@ public class CreatorAdminController {
     private final CreatorService creatorService;
     private final CreatorAccountService creatorAccountService;
 
-    @Operation(summary = "创作者分页查询")
+    @Operation(summary = "创作者分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('creator:list')")
     public Result<PageResult<Creator>> page(CreatorQueryReqVO req) {
@@ -55,14 +55,14 @@ public class CreatorAdminController {
     }
 
     /** 资质文件：审核前要看证件原件。 */
-    @Operation(summary = "创作者资质文件")
+    @Operation(summary = "资质文件（审核前查看证件原件）")
     @GetMapping("/{id}/documents")
     @PreAuthorize("@ss.hasPermission('creator:list')")
     public Result<List<CreatorDocument>> documents(@PathVariable Long id) {
         return Result.ok(creatorService.documents(id));
     }
 
-    @Operation(summary = "创作者入驻审核")
+    @Operation(summary = "入驻审核（通过/驳回/冻结）")
     @PutMapping("/{id}/audit")
     @PreAuthorize("@ss.hasPermission('creator:audit')")
     @OperationLog(module = "创作者管理", action = "入驻审核")
@@ -71,7 +71,7 @@ public class CreatorAdminController {
     }
 
     /** 手工录入创作者主体（C 端申请入驻还没实现，先用它打通链路）。 */
-    @Operation(summary = "手工录入创作者主体")
+    @Operation(summary = "手工录入创作者主体（C 端申请未实现前的打通用口）")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('creator:audit')")
     @OperationLog(module = "创作者管理", action = "新增创作者")
@@ -80,7 +80,7 @@ public class CreatorAdminController {
     }
 
     /** 开通创作者账号：仅审核通过可开；已开通则幂等返回，不重复建号。 */
-    @Operation(summary = "开通创作者账号（仅审核通过可开通，幂等）")
+    @Operation(summary = "开通创作者账号（仅审核通过可开，幂等）")
     @PostMapping("/{id}/account")
     @PreAuthorize("@ss.hasPermission('creator:account')")
     @OperationLog(module = "创作者管理", action = "开通创作者账号")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/CreatorCenterController.java

@@ -40,7 +40,7 @@ public class CreatorCenterController {
     private final CreatorDashboardService creatorDashboardService;
 
     /** 当前创作者的主体信息与入驻状态。 */
-    @Operation(summary = "我的创作者资料与入驻状态")
+    @Operation(summary = "当前创作者的主体信息与入驻状态")
     @GetMapping("/profile")
     @PreAuthorize("@ss.hasPermission('creator-center:view')")
     public Result<CreatorCenterProfileVO> profile() {
@@ -48,7 +48,7 @@ public class CreatorCenterController {
     }
 
     /** 我的作品列表（含最近一次提交的审核进度）。 */
-    @Operation(summary = "我的作品列表（含最近一次审核进度）")
+    @Operation(summary = "我的作品列表（含最近一次提交的审核进度）")
     @GetMapping("/dramas/page")
     @PreAuthorize("@ss.hasPermission('creator-center:view')")
     public Result<PageResult<CreatorCenterDramaVO>> pageMyDramas(CreatorCenterDramaQueryReqVO req) {
@@ -56,7 +56,7 @@ public class CreatorCenterController {
     }
 
     /** 我的作品详情：id 是别人的作品时返回 403，不区分"不存在"。 */
-    @Operation(summary = "我的作品详情")
+    @Operation(summary = "我的作品详情（他人作品返回 403）")
     @GetMapping("/dramas/{id}")
     @PreAuthorize("@ss.hasPermission('creator-center:view')")
     public Result<CreatorCenterDramaVO> myDrama(@PathVariable Long id) {
@@ -64,7 +64,7 @@ public class CreatorCenterController {
     }
 
     /** 我的通知：入驻审核结果 + 我提交内容的审核结果。 */
-    @Operation(summary = "我的通知（入驻与内容审核结果）")
+    @Operation(summary = "我的通知（入驻审核 + 内容审核结果）")
     @GetMapping("/notices")
     @PreAuthorize("@ss.hasPermission('creator-center:view')")
     public Result<List<CreatorCenterNoticeVO>> notices() {
@@ -72,7 +72,7 @@ public class CreatorCenterController {
     }
 
     /** 我的数据看板：播放 / 完播 / 收藏 / 评论 / 解锁收入概览（只读，只含自己的作品）。 */
-    @Operation(summary = "我的数据看板（播放 / 完播 / 收藏 / 评论 / 解锁收入）")
+    @Operation(summary = "我的数据看板（播放/完播/收藏/评论/解锁收入，只读）")
     @GetMapping("/dashboard")
     @PreAuthorize("@ss.hasPermission('creator-center:stat:view')")
     public Result<Map<String, Object>> dashboard() {
@@ -83,7 +83,7 @@ public class CreatorCenterController {
      * 代看目标下拉的数据源：只有带 `creator-center:impersonate` 的账号（第一阶段 = 超管）能调。
      * 前端拿它渲染顶部的「当前创作者」下拉；没权限的账号不显示下拉，也不会请求这个接口。
      */
-    @Operation(summary = "代看可选创作者列表")
+    @Operation(summary = "代看目标下拉数据源（仅持 creator-center:impersonate 可调）")
     @GetMapping("/impersonation/targets")
     @PreAuthorize("@ss.hasPermission('creator-center:impersonate')")
     public Result<List<CreatorCenterTargetVO>> impersonationTargets() {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/CreatorContentController.java

@@ -36,7 +36,7 @@ import java.util.List;
  * 与 {@link CreatorCenterController} 一样**不接收 creatorId**：归属由登录态解析，
  * 服务层强制 `where creator_id = 当前创作者`，改别人的剧或分集一律 403。
  */
-@Tag(name = "创作者中心-内容与收费")
+@Tag(name = "创作者作品")
 @RestController
 @RequestMapping("/admin/creator-center")
 @RequiredArgsConstructor
@@ -54,7 +54,7 @@ public class CreatorContentController {
     }
 
     /** 编辑作品信息（仅草稿 / 已下线可改）。 */
-    @Operation(summary = "编辑作品信息（仅草稿 / 已下线可改）")
+    @Operation(summary = "编辑作品信息（仅草稿/已下线可改）")
     @PutMapping("/dramas/{id}")
     @PreAuthorize("@ss.hasPermission('creator-center:drama:edit')")
     @OperationLog(module = "创作者中心", action = "编辑作品")
@@ -72,7 +72,7 @@ public class CreatorContentController {
     }
 
     /** 新增分集（集号不传自动排到最后）。 */
-    @Operation(summary = "新增分集")
+    @Operation(summary = "新增分集（不传集号自动排到最后）")
     @PostMapping("/dramas/{id}/episodes")
     @PreAuthorize("@ss.hasPermission('creator-center:drama:edit')")
     @OperationLog(module = "创作者中心", action = "新增分集")
@@ -81,7 +81,7 @@ public class CreatorContentController {
     }
 
     /** 编辑分集（时长 / 封面 / 片源 / 排序）。 */
-    @Operation(summary = "编辑分集（时长 / 封面 / 片源）")
+    @Operation(summary = "编辑分集（时长/封面/片源/排序）")
     @PutMapping("/dramas/{id}/episodes/{episodeId}")
     @PreAuthorize("@ss.hasPermission('creator-center:drama:edit')")
     @OperationLog(module = "创作者中心", action = "编辑分集")
@@ -102,7 +102,7 @@ public class CreatorContentController {
     }
 
     /** 批量排序：body 里按新顺序给出分集 id。 */
-    @Operation(summary = "分集批量排序")
+    @Operation(summary = "批量排序分集")
     @PutMapping("/dramas/{id}/episodes/sort")
     @PreAuthorize("@ss.hasPermission('creator-center:drama:edit')")
     @OperationLog(module = "创作者中心", action = "调整分集顺序")
@@ -112,7 +112,7 @@ public class CreatorContentController {
     }
 
     /** 提交审核：CREATE / UPDATE / PUBLISH / OFFLINE。 */
-    @Operation(summary = "提交审核（CREATE / UPDATE / PUBLISH / OFFLINE）")
+    @Operation(summary = "提交审核（CREATE/UPDATE/PUBLISH/OFFLINE）")
     @PostMapping("/dramas/{id}/submit")
     @PreAuthorize("@ss.hasPermission('creator-center:drama:edit')")
     @OperationLog(module = "创作者中心", action = "提交审核")
@@ -121,7 +121,7 @@ public class CreatorContentController {
     }
 
     /** 撤回自己的提交（撤回后作品退回草稿，可继续编辑）。 */
-    @Operation(summary = "撤回自己的提交")
+    @Operation(summary = "撤回提交（撤回后作品退回草稿）")
     @PostMapping("/submissions/{id}/withdraw")
     @PreAuthorize("@ss.hasPermission('creator-center:drama:edit')")
     @OperationLog(module = "创作者中心", action = "撤回提交")
@@ -130,7 +130,7 @@ public class CreatorContentController {
     }
 
     /** 我的提交历史（审核进度）。 */
-    @Operation(summary = "我的提交历史")
+    @Operation(summary = "我的提交历史（审核进度）")
     @GetMapping("/dramas/{id}/submissions")
     @PreAuthorize("@ss.hasPermission('creator-center:view')")
     public Result<List<ContentSubmission>> listSubmissions(@PathVariable Long id) {
@@ -138,7 +138,7 @@ public class CreatorContentController {
     }
 
     /** 把上传好的视频产物挂到自己的分集上（产物必须是本人上传的）。 */
-    @Operation(summary = "把上传产物挂到自己的分集上")
+    @Operation(summary = "挂载分集视频产物（产物必须是本人上传）")
     @PostMapping("/dramas/{id}/episodes/{episodeId}/attach")
     @PreAuthorize("@ss.hasPermission('creator-center:upload')")
     @OperationLog(module = "创作者中心", action = "挂载分集视频")
@@ -149,7 +149,7 @@ public class CreatorContentController {
     }
 
     /** 分集收费与试看秒数：读现状。 */
-    @Operation(summary = "分集收费与试看秒数（读）")
+    @Operation(summary = "分集收费与试看秒数：读取")
     @GetMapping("/dramas/{id}/prices")
     @PreAuthorize("@ss.hasPermission('creator-center:view')")
     public Result<PriceRespVO> priceDetail(@PathVariable Long id) {
@@ -157,7 +157,7 @@ public class CreatorContentController {
     }
 
     /** 分集收费与试看秒数：保存（复用后台同一套 PriceService，改完立即影响付费判定）。 */
-    @Operation(summary = "分集收费与试看秒数（保存）")
+    @Operation(summary = "分集收费与试看秒数：保存（改完立即影响付费判定）")
     @PutMapping("/dramas/{id}/prices")
     @PreAuthorize("@ss.hasPermission('creator-center:price:update')")
     @OperationLog(module = "创作者中心", action = "配置分集价格")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/DashboardAdminController.java

@@ -20,7 +20,7 @@ import java.util.Map;
  * 指标口径写在 DashboardService 的类注释与 docs/api-phase1.md 里；
  * 取不到数据源的指标返回 null 并在 notes 里说明，不用 0 冒充。
  */
-@Tag(name = "后台-数据看板")
+@Tag(name = "数据看板")
 @RestController
 @RequestMapping("/admin/dashboard")
 @RequiredArgsConstructor
@@ -29,7 +29,7 @@ public class DashboardAdminController {
     private final DashboardService dashboardService;
 
     /** 总览：用户 / 内容 / 播放 / 收入 / 成本。 */
-    @Operation(summary = "运营大盘总览（用户 / 内容 / 播放 / 收入 / 成本）")
+    @Operation(summary = "总览：用户/内容/播放/收入/成本")
     @GetMapping("/overview")
     @PreAuthorize("@ss.hasPermission('dashboard:view')")
     public Result<Map<String, Object>> overview() {
@@ -37,7 +37,7 @@ public class DashboardAdminController {
     }
 
     /** 转码看板：队列积压与失败任务明细。 */
-    @Operation(summary = "转码看板（队列积压与失败任务）")
+    @Operation(summary = "转码看板：队列积压与失败任务明细")
     @GetMapping("/transcode")
     @PreAuthorize("@ss.hasPermission('dashboard:view')")
     public Result<Map<String, Object>> transcode() {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/DictController.java

@@ -21,7 +21,7 @@ import java.util.Map;
 /**
  * 字典接口：题材、内容状态等下拉数据。
  */
-@Tag(name = "后台-字典")
+@Tag(name = "数据字典")
 @RestController
 @RequestMapping("/admin/dicts")
 @RequiredArgsConstructor
@@ -29,7 +29,7 @@ public class DictController {
 
     private final DramaCategoryService dramaCategoryService;
 
-    @Operation(summary = "短剧分类字典")
+    @Operation(summary = "题材字典（下拉数据）")
     @GetMapping("/drama-category")
     @PreAuthorize("@ss.hasPermission('drama:list')")
     public Result<List<DramaCategoryRespVO>> dramaCategories() {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/DownloadAdminController.java

@@ -22,7 +22,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.Map;
 
 /** 后台下载授权管理。 */
-@Tag(name = "后台-离线下载管理")
+@Tag(name = "下载管理")
 @RestController
 @RequestMapping("/admin/downloads")
 @RequiredArgsConstructor
@@ -30,14 +30,14 @@ public class DownloadAdminController {
 
     private final DownloadService downloadService;
 
-    @Operation(summary = "下载授权分页查询")
+    @Operation(summary = "下载授权分页检索（含剧名与集号）")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('download:list')")
     public Result<PageResult<DownloadLicenseRespVO>> page(DownloadQueryReqVO req) {
         return Result.ok(downloadService.page(req));
     }
 
-    @Operation(summary = "下载统计")
+    @Operation(summary = "授权与任务分布统计")
     @GetMapping("/stats")
     @PreAuthorize("@ss.hasPermission('download:list')")
     public Result<Map<String, Object>> stats() {
@@ -45,7 +45,7 @@ public class DownloadAdminController {
     }
 
     /** 吊销单条授权：用户侧下次联网即失效。 */
-    @Operation(summary = "吊销单条下载授权")
+    @Operation(summary = "吊销授权（用户侧下次联网即失效）")
     @PutMapping("/{id}/revoke")
     @PreAuthorize("@ss.hasPermission('download:revoke')")
     @OperationLog(module = "下载管理", action = "吊销下载授权")
@@ -55,7 +55,7 @@ public class DownloadAdminController {
     }
 
     /** 手动触发过期清理，正常情况下由定时任务每天执行。 */
-    @Operation(summary = "手动触发过期授权清理")
+    @Operation(summary = "手动清理过期授权（默认每天凌晨自动执行）")
     @PostMapping("/cleanup")
     @PreAuthorize("@ss.hasPermission('download:revoke')")
     @OperationLog(module = "下载管理", action = "清理过期下载授权")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/DramaCategoryController.java

@@ -27,7 +27,7 @@ import java.util.List;
 /**
  * 短剧类型管理。类型属于短剧域，权限沿用 drama:*，不再单开权限点。
  */
-@Tag(name = "后台-短剧分类")
+@Tag(name = "短剧类型")
 @RestController
 @RequestMapping("/admin/drama-categories")
 @RequiredArgsConstructor
@@ -35,14 +35,14 @@ public class DramaCategoryController {
 
     private final DramaCategoryService dramaCategoryService;
 
-    @Operation(summary = "分类列表")
+    @Operation(summary = "短剧类型列表")
     @GetMapping
     @PreAuthorize("@ss.hasPermission('drama:list')")
     public Result<List<DramaCategoryRespVO>> list() {
         return Result.ok(dramaCategoryService.list());
     }
 
-    @Operation(summary = "新建分类")
+    @Operation(summary = "新增短剧类型")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('drama:create')")
     @OperationLog(module = "内容管理", action = "新增短剧类型")
@@ -50,7 +50,7 @@ public class DramaCategoryController {
         return Result.ok(dramaCategoryService.create(req));
     }
 
-    @Operation(summary = "编辑分类")
+    @Operation(summary = "编辑短剧类型")
     @PutMapping("/{id}")
     @PreAuthorize("@ss.hasPermission('drama:update')")
     @OperationLog(module = "内容管理", action = "编辑短剧类型")
@@ -59,7 +59,7 @@ public class DramaCategoryController {
         return Result.ok();
     }
 
-    @Operation(summary = "删除分类")
+    @Operation(summary = "删除短剧类型")
     @DeleteMapping("/{id}")
     @PreAuthorize("@ss.hasPermission('drama:delete')")
     @OperationLog(module = "内容管理", action = "删除短剧类型")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/DramaController.java

@@ -28,7 +28,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
 
-@Tag(name = "后台-短剧管理")
+@Tag(name = "短剧管理")
 @RestController
 @RequestMapping("/admin/dramas")
 @RequiredArgsConstructor
@@ -36,7 +36,7 @@ public class DramaController {
 
     private final DramaService dramaService;
 
-    @Operation(summary = "短剧分页查询")
+    @Operation(summary = "短剧分页检索（含热门、状态筛选）")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('drama:list')")
     public Result<PageResult<DramaRespVO>> page(DramaPageReqVO req) {
@@ -95,7 +95,7 @@ public class DramaController {
         return Result.ok();
     }
 
-    @Operation(summary = "审核驳回")
+    @Operation(summary = "驳回短剧")
     @PostMapping("/{id}/reject")
     @PreAuthorize("@ss.hasPermission('drama:review')")
     @OperationLog(module = "内容管理", action = "驳回短剧")
@@ -104,7 +104,7 @@ public class DramaController {
         return Result.ok();
     }
 
-    @Operation(summary = "上线")
+    @Operation(summary = "短剧上线")
     @PostMapping("/{id}/publish")
     @PreAuthorize("@ss.hasPermission('drama:review')")
     @OperationLog(module = "内容管理", action = "短剧上线")
@@ -113,7 +113,7 @@ public class DramaController {
         return Result.ok();
     }
 
-    @Operation(summary = "下线")
+    @Operation(summary = "短剧下线")
     @PostMapping("/{id}/offline")
     @PreAuthorize("@ss.hasPermission('drama:review')")
     @OperationLog(module = "内容管理", action = "短剧下线")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/EntitlementAdminController.java

@@ -23,7 +23,7 @@ import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
 /** 后台权益：检索、人工补发、回收。 */
-@Tag(name = "后台-权益管理")
+@Tag(name = "权益管理")
 @RestController
 @RequestMapping("/admin/entitlements")
 @RequiredArgsConstructor
@@ -31,7 +31,7 @@ public class EntitlementAdminController {
 
     private final EntitlementService entitlementService;
 
-    @Operation(summary = "权益分页查询")
+    @Operation(summary = "权益分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('entitlement:list')")
     public Result<PageResult<Entitlement>> page(@RequestParam(required = false) Long userId,
@@ -43,7 +43,7 @@ public class EntitlementAdminController {
     }
 
     /** 客服补偿：直接给用户某集/整剧的播放权益。 */
-    @Operation(summary = "补发权益（客服补偿）")
+    @Operation(summary = "人工补发权益（客服补偿）")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('entitlement:update')")
     @OperationLog(module = "订单管理", action = "人工补发权益")
@@ -55,7 +55,7 @@ public class EntitlementAdminController {
     }
 
     /** 回收权益：退款、违规处置后用。 */
-    @Operation(summary = "回收权益（退款 / 违规处置）")
+    @Operation(summary = "回收权益（退款/违规处置用，播放判定实时生效）")
     @PutMapping("/{id}/revoke")
     @PreAuthorize("@ss.hasPermission('entitlement:update')")
     @OperationLog(module = "订单管理", action = "回收权益")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/EpisodeController.java

@@ -25,7 +25,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
 
-@Tag(name = "后台-剧集管理")
+@Tag(name = "剧集管理")
 @RestController
 @RequestMapping("/admin/episodes")
 @RequiredArgsConstructor
@@ -33,7 +33,7 @@ public class EpisodeController {
 
     private final EpisodeService episodeService;
 
-    @Operation(summary = "剧集列表")
+    @Operation(summary = "某剧分集列表")
     @GetMapping
     @PreAuthorize("@ss.hasPermission('episode:list')")
     public Result<List<EpisodeRespVO>> list(@RequestParam Long dramaId,
@@ -41,7 +41,7 @@ public class EpisodeController {
         return Result.ok(episodeService.listByDrama(dramaId, status));
     }
 
-    @Operation(summary = "新建剧集")
+    @Operation(summary = "新增分集")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('episode:upload')")
     @OperationLog(module = "内容管理", action = "新增剧集")
@@ -49,7 +49,7 @@ public class EpisodeController {
         return Result.ok(episodeService.create(req));
     }
 
-    @Operation(summary = "编辑剧集")
+    @Operation(summary = "编辑分集")
     @PutMapping("/{id}")
     @PreAuthorize("@ss.hasPermission('episode:upload')")
     @OperationLog(module = "内容管理", action = "编辑剧集")
@@ -58,7 +58,7 @@ public class EpisodeController {
         return Result.ok();
     }
 
-    @Operation(summary = "删除剧集")
+    @Operation(summary = "删除分集")
     @DeleteMapping("/{id}")
     @PreAuthorize("@ss.hasPermission('episode:upload')")
     @OperationLog(module = "内容管理", action = "删除剧集")
@@ -67,7 +67,7 @@ public class EpisodeController {
         return Result.ok();
     }
 
-    @Operation(summary = "剧集排序")
+    @Operation(summary = "批量排序分集")
     @PutMapping("/sort")
     @PreAuthorize("@ss.hasPermission('episode:sort')")
     @OperationLog(module = "内容管理", action = "调整剧集顺序")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/MediaController.java

@@ -28,7 +28,7 @@ import org.springframework.web.multipart.MultipartFile;
 /**
  * 媒资上传（本地存储版）：init 建会话 → chunk 传分片 → complete 合并出地址。
  */
-@Tag(name = "后台-媒资管理")
+@Tag(name = "媒资上传")
 @RestController
 @RequestMapping("/admin/media")
 @RequiredArgsConstructor
@@ -36,7 +36,7 @@ public class MediaController {
 
     private final MediaService mediaService;
 
-    @Operation(summary = "初始化分片上传")
+    @Operation(summary = "建上传会话（返回 uploadId / chunkSize / totalChunks）")
     @PostMapping("/upload/init")
     @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
     public Result<UploadInitRespVO> init(@Valid @RequestBody UploadInitReqVO req) {
@@ -45,7 +45,7 @@ public class MediaController {
         return Result.ok(mediaService.init(req, SecurityUtils.getUserId()));
     }
 
-    @Operation(summary = "上传分片")
+    @Operation(summary = "上传分片（可重复传同一片）")
     @PostMapping("/upload/chunk")
     @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
     public Result<Integer> uploadChunk(@RequestParam String uploadId,
@@ -56,7 +56,7 @@ public class MediaController {
         return Result.ok(index);
     }
 
-    @Operation(summary = "完成上传")
+    @Operation(summary = "合并分片出媒资（同一 uploadId 幂等）")
     @PostMapping("/upload/complete")
     @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
     public Result<MediaAssetRespVO> complete(@Valid @RequestBody UploadCompleteReqVO req) {
@@ -65,7 +65,7 @@ public class MediaController {
     }
 
     /** 断点续传：查上传会话进度（只能查自己发起的会话）。 */
-    @Operation(summary = "查询上传进度（断点续传）")
+    @Operation(summary = "断点续传进度查询（只能查自己发起的会话）")
     @GetMapping("/upload/{uploadId}")
     @PreAuthorize("@ss.hasAnyPermission('cover:upload','episode:upload')")
     public Result<UploadProgressRespVO> progress(@PathVariable String uploadId) {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/MenuController.java

@@ -23,7 +23,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
 
-@Tag(name = "后台-菜单管理")
+@Tag(name = "菜单管理")
 @RestController
 @RequestMapping("/admin/menus")
 @RequiredArgsConstructor
@@ -38,7 +38,7 @@ public class MenuController {
         return Result.ok(menuService.listAll());
     }
 
-    @Operation(summary = "新建菜单")
+    @Operation(summary = "新增菜单")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('system:menu')")
     @OperationLog(module = "后台管理", action = "新增菜单")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/OperationLogController.java

@@ -16,7 +16,7 @@ import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
-@Tag(name = "后台-操作日志")
+@Tag(name = "操作日志")
 @RestController
 @RequestMapping("/admin/operation-logs")
 @RequiredArgsConstructor
@@ -24,7 +24,7 @@ public class OperationLogController {
 
     private final OperationLogService operationLogService;
 
-    @Operation(summary = "操作日志分页查询")
+    @Operation(summary = "操作日志分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('log:list')")
     public Result<PageResult<OperationLogRespVO>> page(OperationLogPageReqVO req) {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/OrderAdminController.java

@@ -26,7 +26,7 @@ import java.util.List;
 import java.util.Map;
 
 /** 后台订单：检索、补发、退款回收。 */
-@Tag(name = "后台-订单管理")
+@Tag(name = "订单管理")
 @RestController
 @RequestMapping("/admin/orders")
 @RequiredArgsConstructor
@@ -34,7 +34,7 @@ public class OrderAdminController {
 
     private final OrderService orderService;
 
-    @Operation(summary = "订单分页查询")
+    @Operation(summary = "订单分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('order:list')")
     public Result<PageResult<Orders>> page(OrderQueryReqVO req) {
@@ -49,7 +49,7 @@ public class OrderAdminController {
     }
 
     /** 订单状态流转流水：支付争议时的证据链。 */
-    @Operation(summary = "订单状态流转流水")
+    @Operation(summary = "订单状态流转流水（支付争议证据链）")
     @GetMapping("/{orderNo}/events")
     @PreAuthorize("@ss.hasPermission('order:list')")
     public Result<List<OrderEvent>> events(@PathVariable String orderNo) {
@@ -57,7 +57,7 @@ public class OrderAdminController {
     }
 
     /** 补发：已支付未交付的订单重新交付；已交付时幂等返回。 */
-    @Operation(summary = "补发订单（已支付未交付重新交付，幂等）")
+    @Operation(summary = "订单补发（已交付时幂等返回）")
     @PostMapping("/{orderNo}/compensate")
     @PreAuthorize("@ss.hasPermission('order:update')")
     @OperationLog(module = "订单管理", action = "补发订单")
@@ -66,7 +66,7 @@ public class OrderAdminController {
     }
 
     /** 退款/撤销：回收权益并扣回金币。 */
-    @Operation(summary = "退款 / 撤销（回收权益并扣回金币）")
+    @Operation(summary = "订单退款/撤销（回收权益并扣回金币）")
     @PostMapping("/{orderNo}/refund")
     @PreAuthorize("@ss.hasPermission('order:update')")
     @OperationLog(module = "订单管理", action = "订单退款")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/PermissionController.java

@@ -15,7 +15,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
 
-@Tag(name = "后台-权限点")
+@Tag(name = "权限管理")
 @RestController
 @RequestMapping("/admin/permissions")
 @RequiredArgsConstructor
@@ -24,7 +24,7 @@ public class PermissionController {
     private final PermissionService permissionService;
 
     /** 按分组返回权限点，直接喂给前端的角色权限配置页。 */
-    @Operation(summary = "权限点列表（按分组返回）")
+    @Operation(summary = "权限点分组列表（角色权限配置页用）")
     @GetMapping
     @PreAuthorize("@ss.hasPermission('system:role')")
     public Result<List<PermissionGroupVO>> groups() {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/PriceAdminController.java

@@ -19,7 +19,7 @@ import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
 /** 后台分集价格与免费集配置。 */
-@Tag(name = "后台-分集收费")
+@Tag(name = "分集价格")
 @RestController
 @RequestMapping("/admin/prices")
 @RequiredArgsConstructor
@@ -28,14 +28,14 @@ public class PriceAdminController {
     private final PriceService priceService;
 
     /** 当前价格配置：整剧默认 + 分集明细。 */
-    @Operation(summary = "分集价格配置（整剧默认 + 分集明细）")
+    @Operation(summary = "当前价格配置：整剧默认 + 分集明细")
     @GetMapping
     @PreAuthorize("@ss.hasPermission('price:update')")
     public Result<PriceRespVO> detail(@RequestParam Long dramaId) {
         return Result.ok(priceService.detail(dramaId));
     }
 
-    @Operation(summary = "保存分集价格配置")
+    @Operation(summary = "保存价格配置（改价立即影响播放与下载判定）")
     @PutMapping
     @PreAuthorize("@ss.hasPermission('price:update')")
     @OperationLog(module = "定价管理", action = "配置分集价格")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/ReconcileAdminController.java

@@ -20,7 +20,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.time.LocalDate;
 
 /** 后台对账：手动触发与历史查看。 */
-@Tag(name = "后台-对账")
+@Tag(name = "对账管理")
 @RestController
 @RequestMapping("/admin/reconcile")
 @RequiredArgsConstructor
@@ -28,7 +28,7 @@ public class ReconcileAdminController {
 
     private final ReconcileService reconcileService;
 
-    @Operation(summary = "对账任务列表")
+    @Operation(summary = "对账历史分页")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('order:list')")
     public Result<PageResult<ReconcileTask>> page(@RequestParam(defaultValue = "1") Integer pageIndex,
@@ -37,7 +37,7 @@ public class ReconcileAdminController {
     }
 
     /** 手动对账：默认前一天，可指定日期与渠道。 */
-    @Operation(summary = "手动触发对账")
+    @Operation(summary = "手动对账（默认前一天，可指定日期与渠道）")
     @PostMapping("/run")
     @PreAuthorize("@ss.hasPermission('reconcile:run')")
     @OperationLog(module = "订单管理", action = "手动对账")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/ReportAdminController.java

@@ -22,7 +22,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 /** 后台举报工单。 */
-@Tag(name = "后台-举报工单")
+@Tag(name = "举报工单")
 @RestController
 @RequestMapping("/admin/reports")
 @RequiredArgsConstructor
@@ -30,7 +30,7 @@ public class ReportAdminController {
 
     private final ReportService reportService;
 
-    @Operation(summary = "举报工单分页查询")
+    @Operation(summary = "举报工单检索（状态/类型/原因）")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('report:list')")
     public Result<PageResult<ContentReport>> page(ReportQueryReqVO req) {
@@ -38,7 +38,7 @@ public class ReportAdminController {
     }
 
     /** 处理工单：结论成立会联动驳回被举报评论，可选择同时封禁被举报用户。 */
-    @Operation(summary = "处理举报工单（可联动驳回评论与封禁用户）")
+    @Operation(summary = "处理工单（结论成立联动驳回被举报评论，可选择同时封禁用户）")
     @PutMapping("/{id}/handle")
     @PreAuthorize("@ss.hasPermission('report:handle')")
     @OperationLog(module = "内容治理", action = "处理举报")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/RoleCategoryController.java

@@ -23,7 +23,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
 
-@Tag(name = "后台-角色分类")
+@Tag(name = "角色分类")
 @RestController
 @RequestMapping("/admin/role-categories")
 @RequiredArgsConstructor
@@ -38,7 +38,7 @@ public class RoleCategoryController {
         return Result.ok(roleCategoryService.list());
     }
 
-    @Operation(summary = "新建角色分类")
+    @Operation(summary = "新增角色分类")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('system:role-category')")
     @OperationLog(module = "后台管理", action = "新增角色分类")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/RoleController.java

@@ -26,7 +26,7 @@ import org.springframework.web.bind.annotation.RestController;
 
 import java.util.List;
 
-@Tag(name = "后台-角色管理")
+@Tag(name = "角色管理")
 @RestController
 @RequestMapping("/admin/roles")
 @RequiredArgsConstructor
@@ -34,7 +34,7 @@ public class RoleController {
 
     private final RoleService roleService;
 
-    @Operation(summary = "角色分页查询")
+    @Operation(summary = "角色分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('system:role')")
     public Result<PageResult<RoleRespVO>> page(@RequestParam(required = false) String keyword,
@@ -43,7 +43,7 @@ public class RoleController {
         return Result.ok(roleService.page(keyword, pageIndex, pageSize));
     }
 
-    @Operation(summary = "角色下拉列表")
+    @Operation(summary = "角色全量列表")
     @GetMapping("/list")
     public Result<List<RoleRespVO>> list() {
         return Result.ok(roleService.listAll());
@@ -56,7 +56,7 @@ public class RoleController {
         return Result.ok(roleService.get(id));
     }
 
-    @Operation(summary = "新建角色")
+    @Operation(summary = "新增角色")
     @PostMapping
     @PreAuthorize("@ss.hasPermission('system:role')")
     @OperationLog(module = "后台管理", action = "新增角色")
@@ -82,7 +82,7 @@ public class RoleController {
         return Result.ok();
     }
 
-    @Operation(summary = "角色已授权限")
+    @Operation(summary = "查询角色权限码")
     @GetMapping("/{id}/permissions")
     @PreAuthorize("@ss.hasPermission('system:role')")
     public Result<List<String>> permissions(@PathVariable Long id) {

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/SensitiveWordAdminController.java

@@ -24,7 +24,7 @@ import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
 
 /** 后台敏感词库。改动即时生效（服务端词库缓存会失效重建）。 */
-@Tag(name = "后台-敏感词库")
+@Tag(name = "敏感词")
 @RestController
 @RequestMapping("/admin/sensitive-words")
 @RequiredArgsConstructor
@@ -32,7 +32,7 @@ public class SensitiveWordAdminController {
 
     private final SensitiveWordService sensitiveWordService;
 
-    @Operation(summary = "敏感词分页查询")
+    @Operation(summary = "敏感词分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('sensitive-word:list')")
     public Result<PageResult<SensitiveWord>> page(@RequestParam(required = false) String keyword,
@@ -51,7 +51,7 @@ public class SensitiveWordAdminController {
         return Result.ok(sensitiveWordService.create(req));
     }
 
-    @Operation(summary = "编辑敏感词")
+    @Operation(summary = "修改敏感词")
     @PutMapping("/{id}")
     @PreAuthorize("@ss.hasPermission('sensitive-word:update')")
     @OperationLog(module = "内容治理", action = "修改敏感词")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/SubmissionAdminController.java

@@ -22,7 +22,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 /** 后台内容提交审核：检索、详情、审核（通过 / 驳回 / 撤回）。 */
-@Tag(name = "后台-内容提交审核")
+@Tag(name = "内容提交审核")
 @RestController
 @RequestMapping("/admin/submissions")
 @RequiredArgsConstructor
@@ -30,7 +30,7 @@ public class SubmissionAdminController {
 
     private final ContentSubmissionService submissionService;
 
-    @Operation(summary = "内容提交分页查询")
+    @Operation(summary = "内容提交分页检索")
     @GetMapping("/page")
     @PreAuthorize("@ss.hasPermission('submission:list')")
     public Result<PageResult<ContentSubmission>> page(SubmissionQueryReqVO req) {
@@ -44,7 +44,7 @@ public class SubmissionAdminController {
         return Result.ok(submissionService.getExisting(id));
     }
 
-    @Operation(summary = "内容提交审核")
+    @Operation(summary = "审核内容提交（通过后按类型落短剧状态机）")
     @PutMapping("/{id}/audit")
     @PreAuthorize("@ss.hasPermission('submission:audit')")
     @OperationLog(module = "内容审核", action = "提交审核")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/controller/WalletAdminController.java

@@ -27,7 +27,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.List;
 
 /** 后台钱包：人工补币/扣回，全部进流水且必须带幂等键。 */
-@Tag(name = "后台-金币钱包")
+@Tag(name = "钱包管理")
 @RestController
 @RequestMapping("/admin/wallets")
 @RequiredArgsConstructor
@@ -36,7 +36,7 @@ public class WalletAdminController {
     private final WalletService walletService;
     private final AppUserMapper appUserMapper;
 
-    @Operation(summary = "金币流水")
+    @Operation(summary = "金币流水查询")
     @GetMapping("/{userId}/ledger")
     @PreAuthorize("@ss.hasPermission('order:list')")
     public Result<List<CoinLedger>> ledger(@PathVariable Long userId,
@@ -44,7 +44,7 @@ public class WalletAdminController {
         return Result.ok(walletService.recentLedger(userId, limit));
     }
 
-    @Operation(summary = "人工补币")
+    @Operation(summary = "人工补币/扣回（必须带幂等键，先校验用户存在）")
     @PostMapping("/coins")
     @PreAuthorize("@ss.hasPermission('wallet:update')")
     @OperationLog(module = "订单管理", action = "人工补币")

fruitshorts-admin-api/src/main/java/com/fruitshorts/admin/vo/AppUserWatchHistoryVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.admin.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 import java.time.LocalDateTime;
@@ -15,18 +16,30 @@ import java.time.LocalDateTime;
 @Data
 public class AppUserWatchHistoryVO {
 
+    @Schema(description = "ID")
     private Long id;
+    @Schema(description = "短剧 ID")
     private Long dramaId;
+    @Schema(description = "剧名")
     private String dramaTitle;
     /** 短剧当前是否已上线，用于识别"用户说看了但剧已下线"的情况 */
+    @Schema(description = "短剧当前是否已上线")
     private Boolean dramaPublished;
+    @Schema(description = "剧集 ID")
     private Long episodeId;
+    @Schema(description = "集号")
     private Integer episodeNo;
+    @Schema(description = "播放进度（毫秒）")
     private Long positionMs;
+    @Schema(description = "时长（毫秒）")
     private Long durationMs;
     /** 是否已看完（进度到达片尾 1 秒内） */
+    @Schema(description = "是否已看完")
     private Boolean finished;
+    @Schema(description = "来源")
     private String source;
+    @Schema(description = "设备 ID")
     private String deviceId;
+    @Schema(description = "观看时间")
     private LocalDateTime watchedAt;
 }

fruitshorts-admin-api/src/main/resources/application.yml

@@ -28,15 +28,10 @@ mybatis-plus:
   global-config:
     banner: false
     db-config:
-      # 主键由应用侧雪花算法生成（S0），数据库不再自增
       id-type: assign_id
       logic-delete-field: deleted
       logic-delete-value: 1
       logic-not-delete-value: 0
-    sequence:
-      # 单机开发用固定值；上多实例前必须改成按实例分配（环境变量注入），否则会撞 ID
-      worker-id: 1
-      datacenter-id: 1
 
 fruitshorts:
   media:
@@ -58,3 +53,15 @@ springdoc:
 logging:
   level:
     com.fruitshorts: debug
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: prometheus,health
+  endpoint:
+    health:
+      show-details: always
+  metrics:
+    tags:
+      application: ${spring.application.name}

fruitshorts-app-api/pom.xml

@@ -41,12 +41,6 @@
             <groupId>com.fruitshorts</groupId>
             <artifactId>fruitshorts-module-commerce</artifactId>
         </dependency>
-        <!-- 契约测试用：MockMvc + Mockito + JUnit5，test scope，不进运行态依赖 -->
-        <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-test</artifactId>
-            <scope>test</scope>
-        </dependency>
     </dependencies>
 
     <build>

fruitshorts-app-api/src/main/java/com/fruitshorts/app/AppApiApplication.java

@@ -5,34 +5,12 @@ package com.fruitshorts.app;
 import org.mybatis.spring.annotation.MapperScan;
 import org.springframework.boot.SpringApplication;
 import org.springframework.boot.autoconfigure.SpringBootApplication;
-import io.swagger.v3.oas.annotations.OpenAPIDefinition;
-import io.swagger.v3.oas.annotations.info.Info;
-import io.swagger.v3.oas.annotations.tags.Tag;
 
 /**
  * 客户端接口服务，只暴露 /app/** 与静态媒资 /files/**。
  * 与 fruitshorts-admin-api 共用同一套领域模块和数据库，但入口、鉴权和限流策略独立。
  */
 /* 显式指定扫描根包：本类在 com.fruitshorts.app 下，默认扫不到 content/system/framework 模块的 Bean */
-@OpenAPIDefinition(
-        info = @Info(
-                title = "FruitShorts 客户端接口（/app/**）",
-                version = "1.0.0",
-                description = "接口契约以 FruitServer/docs/api-phase1.md 为准"
-        ),
-        tags = {
-                @Tag(name = "客户端-账号", description = "验证码、注册、登录、令牌刷新与登出"),
-                @Tag(name = "客户端-内容浏览", description = "首页 / 发现 / 分类聚合接口"),
-                @Tag(name = "客户端-评论", description = "评论发布、列表与删除"),
-                @Tag(name = "客户端-金币与订单", description = "钱包、金币解锁与订单票据"),
-                @Tag(name = "客户端-离线下载", description = "下载授权、下载偏好与断点续传"),
-                @Tag(name = "客户端-短剧与播放", description = "短剧详情与播放票据"),
-                @Tag(name = "客户端-收藏", description = "收藏切换与列表"),
-                @Tag(name = "客户端-点赞与举报", description = "点赞与举报提报"),
-                @Tag(name = "客户端-个人中心", description = "资料、设备、数据导出与注销"),
-                @Tag(name = "客户端-观看进度", description = "观看进度上报与续看位置"),
-        }
-)
 @SpringBootApplication(scanBasePackages = "com.fruitshorts")
 @MapperScan("com.fruitshorts.**.dal.mapper")
 public class AppApiApplication {

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppAuthController.java

@@ -3,6 +3,7 @@
 package com.fruitshorts.app.controller;
 
 import com.fruitshorts.common.pojo.Result;
+import com.fruitshorts.framework.redis.RateLimit;
 import com.fruitshorts.framework.security.SecurityUtils;
 import com.fruitshorts.framework.web.WebUtils;
 import com.fruitshorts.user.service.AppAuthService;
@@ -24,7 +25,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 /** 客户端账号：验证码、注册、登录、刷新、登出。 */
-@Tag(name = "客户端-账号")
+@Tag(name = "账号")
 @RestController
 @RequestMapping("/app/auth")
 @RequiredArgsConstructor
@@ -34,35 +35,37 @@ public class AppAuthController {
     private final AppAuthService authService;
 
     /** 发送验证码。频控在服务端，客户端不需要自己限流。 */
-    @Operation(summary = "发送验证码（频控在服务端）")
+    @Operation(summary = "发送验证码（注册/登录/找回密码，服务端频控）")
+    @RateLimit(limit = 20, windowSeconds = 60, key = "otp")
     @PostMapping("/otp")
     public Result<Void> sendOtp(@Valid @RequestBody OtpSendReqVO req, HttpServletRequest request) {
         otpService.send(req, WebUtils.getClientIp(request));
         return Result.ok();
     }
 
-    @Operation(summary = "注册账号（邮箱免验证码 / 手机号需验证码）")
+    @Operation(summary = "注册账号（手机号/邮箱 + 验证码），返回令牌")
     @PostMapping("/register")
     public Result<TokenRespVO> register(@Valid @RequestBody RegisterReqVO req,
                                         HttpServletRequest request) {
         return Result.ok(authService.register(req, WebUtils.getClientIp(request)));
     }
 
-    @Operation(summary = "登录（验证码或密码）")
+    @Operation(summary = "登录（验证码或密码），返回令牌")
+    @RateLimit(limit = 10, windowSeconds = 60, key = "login")
     @PostMapping("/login")
     public Result<TokenRespVO> login(@Valid @RequestBody LoginReqVO req,
                                      HttpServletRequest request) {
         return Result.ok(authService.login(req, WebUtils.getClientIp(request)));
     }
 
-    @Operation(summary = "刷新令牌（旧 refresh token 立即失效）")
+    @Operation(summary = "刷新令牌（refresh token 轮换）")
     @PostMapping("/refresh")
     public Result<TokenRespVO> refresh(@Valid @RequestBody RefreshReqVO req) {
         return Result.ok(authService.refresh(req.getRefreshToken()));
     }
 
     /** 登出：默认只吊销当前设备的会话，allDevices=true 时吊销全部。 */
-    @Operation(summary = "登出（默认当前设备，allDevices 吊销全部）")
+    @Operation(summary = "登出（allDevices=true 时吊销全部设备会话）")
     @PostMapping("/logout")
     public Result<Void> logout(@RequestBody(required = false) LogoutReqVO req) {
         authService.logout(SecurityUtils.getUserIdOrNull(), req == null ? new LogoutReqVO() : req);

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppCatalogController.java

@@ -18,7 +18,7 @@ import java.util.List;
 /**
  * 客户端目录接口：首页与发现页各一次请求拿全量聚合数据。
  */
-@Tag(name = "客户端-内容浏览")
+@Tag(name = "内容浏览")
 @RestController
 @RequestMapping("/app")
 @RequiredArgsConstructor
@@ -26,13 +26,13 @@ public class AppCatalogController {
 
     private final AppCatalogService appCatalogService;
 
-    @Operation(summary = "首页聚合：轮播 + 分区，一次请求渲染整页")
+    @Operation(summary = "首页聚合数据（轮播 + 分区卡片，卡片带预览集）")
     @GetMapping("/home/feed")
     public Result<AppFeedVO> homeFeed() {
         return Result.ok(appCatalogService.homeFeed());
     }
 
-    @Operation(summary = "发现页聚合：分区列表")
+    @Operation(summary = "发现页聚合数据")
     @GetMapping("/discover/feed")
     public Result<AppFeedVO> discoverFeed() {
         return Result.ok(appCatalogService.discoverFeed());

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppCommentController.java

@@ -31,7 +31,7 @@ import org.springframework.web.bind.annotation.RestController;
  * 不传 `rootId` 时返回顶层评论，传了则返回该楼层的回复。
  * 列表允许匿名浏览；发布与删除需要登录。
  */
-@Tag(name = "客户端-评论")
+@Tag(name = "评论")
 @RestController
 @RequestMapping("/app/comments")
 @RequiredArgsConstructor
@@ -39,7 +39,7 @@ public class AppCommentController {
 
     private final CommentService commentService;
 
-    @Operation(summary = "发布评论")
+    @Operation(summary = "发表评论或回复（敏感词处置后按策略发布或转待审）")
     @PostMapping
     public Result<CommentRespVO> publish(@Valid @RequestBody CommentPublishReqVO req,
                                          HttpServletRequest request) {
@@ -47,7 +47,7 @@ public class AppCommentController {
                 WebUtils.getClientIp(request), request.getHeader("X-Device-Id")));
     }
 
-    @Operation(summary = "评论列表（游标翻页，可匿名浏览）")
+    @Operation(summary = "评论列表（游标翻页；不传 rootId 为顶层评论，传了为楼层回复）")
     @GetMapping
     public Result<CursorResult<CommentRespVO>> page(@RequestParam Long dramaId,
                                                     @RequestParam(required = false) Long episodeId,
@@ -63,7 +63,7 @@ public class AppCommentController {
         return Result.ok(commentService.page(SecurityUtils.getUserIdOrNull(), query));
     }
 
-    @Operation(summary = "删除自己的评论")
+    @Operation(summary = "删除自己的评论（逻辑删除）")
     @DeleteMapping("/{id}")
     public Result<Void> delete(@PathVariable Long id) {
         commentService.delete(SecurityUtils.getAppUserId(), id);

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppCommerceController.java

@@ -28,7 +28,7 @@ import java.util.Map;
  * 金币解锁是第一阶段真实的收费方式；真实商店购买走 {@code /app/orders/verify}，
  * 本轮只预留接口（商店未接入时返回明确业务提示，不会产生假订单）。
  */
-@Tag(name = "客户端-金币与订单")
+@Tag(name = "金币与订单")
 @RestController
 @RequestMapping("/app")
 @RequiredArgsConstructor
@@ -39,7 +39,7 @@ public class AppCommerceController {
     private final OrderService orderService;
 
     /** 我的钱包：余额 + 最近流水，客户端一处渲染。 */
-    @Operation(summary = "我的钱包（余额 + 最近流水）")
+    @Operation(summary = "我的钱包：金币余额 + 最近流水")
     @GetMapping("/wallet")
     public Result<Map<String, Object>> wallet() {
         Long userId = SecurityUtils.getAppUserId();
@@ -50,7 +50,7 @@ public class AppCommerceController {
     }
 
     /** 金币解锁分集：幂等，重复点击不会重复扣币。 */
-    @Operation(summary = "金币解锁分集（幂等，重复点击不重复扣币）")
+    @Operation(summary = "金币解锁分集（幂等，重复调用不重复扣币）")
     @PostMapping("/episodes/{episodeId}/unlock")
     public Result<Map<String, Object>> unlock(@PathVariable Long episodeId) {
         return Result.ok(unlockService.unlock(SecurityUtils.getAppUserId(), episodeId));
@@ -63,10 +63,12 @@ public class AppCommerceController {
     }
 
     /** 提交商店票据。第一阶段商店未接入，会返回明确的"尚未配置"。 */
-    @Operation(summary = "提交商店票据（第一阶段商店未接入，返回明确提示）")
+    @Operation(summary = "提交商店票据（IAP/Google Play；商店未接入时返回明确业务提示）")
     @PostMapping("/orders/verify")
     public Result<Orders> verify(@RequestBody Map<String, String> body) {
         return Result.ok(orderService.verifyAndDeliver(SecurityUtils.getAppUserId(),
-                body.getOrDefault("platform", ""), body.getOrDefault("receipt", "")));
+                body.getOrDefault("platform", ""),
+                body.getOrDefault("productId", ""),
+                body.getOrDefault("receipt", "")));
     }
 }

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppDownloadController.java

@@ -33,7 +33,7 @@ import java.util.List;
  * <p>服务端只发授权与地址，分片由客户端向 CDN 拉取；进度上报用于断点续传与跨端展示。
  * 设备标识优先取请求体，其次取请求头 X-Device-Id。
  */
-@Tag(name = "客户端-离线下载")
+@Tag(name = "离线下载")
 @RestController
 @RequestMapping("/app/downloads")
 @RequiredArgsConstructor
@@ -42,7 +42,7 @@ public class AppDownloadController {
     private final DownloadService downloadService;
 
     /** 申请下载授权（同一剧集重复申请幂等，只刷新有效期）。 */
-    @Operation(summary = "申请下载授权（同一剧集幂等，只刷新有效期）")
+    @Operation(summary = "申请下载授权（同剧集重复申请幂等，只刷新有效期）")
     @PostMapping
     public Result<DownloadLicenseRespVO> grant(@Valid @RequestBody DownloadGrantReqVO req,
                                                HttpServletRequest request) {
@@ -50,20 +50,20 @@ public class AppDownloadController {
                 request.getHeader("X-Device-Id")));
     }
 
-    @Operation(summary = "我的下载授权列表")
+    @Operation(summary = "下载列表（授权 + 任务进度，可直接渲染）")
     @GetMapping
     public Result<List<DownloadLicenseRespVO>> list(@RequestParam(required = false) String deviceId) {
         return Result.ok(downloadService.list(SecurityUtils.getAppUserId(), deviceId));
     }
 
-    @Operation(summary = "下载规则（设备上限 / 仅 Wi-Fi / 清晰度上限）")
+    @Operation(summary = "下载策略与配额（单设备上限/授权天数/仅 Wi-Fi/清晰度上限）")
     @GetMapping("/policy")
     public Result<DownloadPolicyRespVO> policy(@RequestParam(required = false) String deviceId) {
         return Result.ok(downloadService.policy(SecurityUtils.getAppUserId(), deviceId));
     }
 
     /** 仅 Wi-Fi 下载、清晰度上限等偏好。 */
-    @Operation(summary = "更新下载偏好设置")
+    @Operation(summary = "更新下载偏好（仅 Wi-Fi 下载、最高清晰度）")
     @PutMapping("/settings")
     public Result<Void> updateSettings(@RequestBody DownloadSettingReqVO req) {
         downloadService.updateSettings(SecurityUtils.getAppUserId(), req);
@@ -71,7 +71,7 @@ public class AppDownloadController {
     }
 
     /** 断点续传前重新取一次地址：授权不变，只有地址是短时效的。 */
-    @Operation(summary = "重新获取下载地址（断点续传前刷新短时效地址）")
+    @Operation(summary = "断点续传前重新获取下载地址（授权不变，地址短时效）")
     @GetMapping("/{episodeId}/url")
     public Result<DownloadLicenseRespVO> refreshUrl(@PathVariable Long episodeId,
                                                     HttpServletRequest request) {
@@ -79,7 +79,7 @@ public class AppDownloadController {
                 request.getHeader("X-Device-Id")));
     }
 
-    @Operation(summary = "上报下载进度")
+    @Operation(summary = "上报下载进度（用于断点续传与跨端展示）")
     @PostMapping("/{episodeId}/progress")
     public Result<DownloadLicenseRespVO> reportProgress(@PathVariable Long episodeId,
                                                         @RequestBody DownloadProgressReqVO req,
@@ -88,7 +88,7 @@ public class AppDownloadController {
                 request.getHeader("X-Device-Id")));
     }
 
-    @Operation(summary = "吊销某集的下载授权")
+    @Operation(summary = "删除单条下载（吊销授权）")
     @DeleteMapping("/{episodeId}")
     public Result<Void> revoke(@PathVariable Long episodeId,
                                @RequestParam(required = false) String deviceId,
@@ -99,7 +99,7 @@ public class AppDownloadController {
     }
 
     /** 清空当前设备的全部下载授权。 */
-    @Operation(summary = "清空当前设备的全部下载授权")
+    @Operation(summary = "清空当前设备全部下载（返回清除条数）")
     @DeleteMapping
     public Result<Integer> clear(@RequestParam(required = false) String deviceId,
                                  HttpServletRequest request) {

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppDramaController.java

@@ -18,7 +18,7 @@ import org.springframework.web.bind.annotation.PathVariable;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
-@Tag(name = "客户端-短剧与播放")
+@Tag(name = "短剧与播放")
 @RestController
 @RequestMapping("/app")
 @RequiredArgsConstructor
@@ -28,7 +28,7 @@ public class AppDramaController {
     private final PlaybackService playbackService;
 
     /** 详情：包含剧集列表，客户端进详情页一次请求即可渲染 */
-    @Operation(summary = "短剧详情（含剧集列表，进详情页一次请求即可渲染）")
+    @Operation(summary = "短剧详情（含剧集列表，免费集带已签名播放地址）")
     @GetMapping("/dramas/{id}")
     public Result<AppDramaDetailVO> detail(@PathVariable Long id) {
         return Result.ok(appCatalogService.dramaDetail(id));
@@ -38,7 +38,7 @@ public class AppDramaController {
      * 播放票据：服务端判定权益后签发短时效播放地址。
      * 未登录也能播免费集；付费集未解锁时只返回需要多少金币。
      */
-    @Operation(summary = "播放票据：判定权益后签发短时效播放地址")
+    @Operation(summary = "签发播放票据与签名地址（服务端判定权益：免费/已购/需解锁/无片源）")
     @GetMapping("/episodes/{id}/play")
     public Result<PlayRespVO> play(@PathVariable Long id, HttpServletRequest request) {
         return Result.ok(playbackService.play(

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppEventController.java

@@ -0,0 +1,35 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.app.controller;
+
+import com.fruitshorts.app.service.AppEventService;
+import com.fruitshorts.app.vo.AppEventReqVO;
+import com.fruitshorts.common.pojo.Result;
+import com.fruitshorts.framework.security.SecurityUtils;
+import com.fruitshorts.framework.web.WebUtils;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.validation.Valid;
+import lombok.RequiredArgsConstructor;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestBody;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+/** 客户端埋点上报。 */
+@Tag(name = "埋点")
+@RestController
+@RequestMapping("/app")
+@RequiredArgsConstructor
+public class AppEventController {
+
+    private final AppEventService eventService;
+
+    @Operation(summary = "埋点事件批量上报")
+    @PostMapping("/events")
+    public Result<Void> report(@Valid @RequestBody AppEventReqVO req, HttpServletRequest request) {
+        eventService.save(req, SecurityUtils.getUserIdOrNull(), WebUtils.getClientIp(request));
+        return Result.ok();
+    }
+}

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppFavoriteController.java

@@ -23,7 +23,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.List;
 
 /** 收藏。 */
-@Tag(name = "客户端-收藏")
+@Tag(name = "收藏")
 @RestController
 @RequestMapping("/app/favorites")
 @RequiredArgsConstructor
@@ -33,14 +33,14 @@ public class AppFavoriteController {
     private final AppCatalogService appCatalogService;
 
     /** 切换收藏，返回切换后的状态：true 为已收藏。 */
-    @Operation(summary = "切换收藏（返回切换后的状态）")
+    @Operation(summary = "切换收藏状态（返回切换后的结果）")
     @PostMapping("/toggle")
     public Result<Boolean> toggle(@Valid @RequestBody FavoriteToggleReqVO req) {
         return Result.ok(favoriteService.toggle(SecurityUtils.getAppUserId(), req.getDramaId()));
     }
 
     /** 收藏列表，卡片结构与首页一致。 */
-    @Operation(summary = "我的收藏列表")
+    @Operation(summary = "收藏列表（卡片结构与首页一致）")
     @GetMapping
     public Result<List<AppDramaCardVO>> list() {
         return Result.ok(appCatalogService.toCards(

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppInteractionController.java

@@ -19,7 +19,7 @@ import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RestController;
 
 /** 点赞与举报。 */
-@Tag(name = "客户端-点赞与举报")
+@Tag(name = "点赞与举报")
 @RestController
 @RequestMapping("/app")
 @RequiredArgsConstructor
@@ -29,14 +29,14 @@ public class AppInteractionController {
     private final ReportService reportService;
 
     /** 点赞/取消点赞，返回切换后的状态与最新计数。 */
-    @Operation(summary = "点赞 / 取消点赞")
+    @Operation(summary = "点赞/取消点赞（支持短剧与评论），返回切换后状态与计数")
     @PostMapping("/likes/toggle")
     public Result<LikeToggleRespVO> toggleLike(@Valid @RequestBody LikeToggleReqVO req) {
         return Result.ok(likeService.toggle(SecurityUtils.getAppUserId(), req));
     }
 
     /** 提交举报：同一用户对同一目标只保留一条待处理工单。 */
-    @Operation(summary = "提交举报（同一目标只保留一条待处理工单）")
+    @Operation(summary = "提交举报（评论/用户/短剧，同一目标仅保留一条待处理工单）")
     @PostMapping("/reports")
     public Result<Long> report(@Valid @RequestBody ReportCreateReqVO req) {
         return Result.ok(reportService.create(SecurityUtils.getAppUserId(), req));

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppMeController.java

@@ -25,7 +25,7 @@ import java.util.List;
 import java.util.Map;
 
 /** 客户端个人中心：资料、设备、注销、数据导出。 */
-@Tag(name = "客户端-个人中心")
+@Tag(name = "个人中心")
 @RestController
 @RequestMapping("/app/me")
 @RequiredArgsConstructor
@@ -33,33 +33,33 @@ public class AppMeController {
 
     private final AppUserService userService;
 
-    @Operation(summary = "我的资料")
+    @Operation(summary = "获取当前用户资料")
     @GetMapping
     public Result<AppUserRespVO> me() {
         return Result.ok(userService.me(SecurityUtils.getAppUserId()));
     }
 
-    @Operation(summary = "修改资料（昵称 / 头像 / 语言等）")
+    @Operation(summary = "修改资料（昵称/头像/性别/生日/语言/时区/区域）")
     @PutMapping
     public Result<AppUserRespVO> update(@Valid @RequestBody ProfileUpdateReqVO req) {
         return Result.ok(userService.updateProfile(SecurityUtils.getAppUserId(), req));
     }
 
-    @Operation(summary = "我的登录设备列表")
+    @Operation(summary = "登录设备列表")
     @GetMapping("/devices")
     public Result<List<AppUserDevice>> devices() {
         return Result.ok(userService.devices(SecurityUtils.getAppUserId()));
     }
 
     /** 商店与隐私法规要求的数据导出，返回账号侧数据；内容侧数据由客户端自行下载。 */
-    @Operation(summary = "数据导出（合规要求）")
+    @Operation(summary = "数据导出（商店与隐私法规要求，返回账号侧数据）")
     @GetMapping("/export")
     public Result<Map<String, Object>> export() {
         return Result.ok(userService.exportAccount(SecurityUtils.getAppUserId()));
     }
 
     /** 申请注销：立即登出全部设备，进入冷静期，期间可撤销。 */
-    @Operation(summary = "申请注销（进入冷静期并登出全部设备）")
+    @Operation(summary = "申请注销（进入冷静期并登出全部设备，期间可撤销）")
     @PostMapping("/deactivate")
     public Result<LocalDateTime> deactivate(@RequestBody(required = false) DeactivateReqVO req) {
         return Result.ok(userService.requestDeactivation(SecurityUtils.getAppUserId(), req));

fruitshorts-app-api/src/main/java/com/fruitshorts/app/controller/AppWatchController.java

@@ -23,7 +23,7 @@ import org.springframework.web.bind.annotation.RestController;
 import java.util.List;
 
 /** 观看进度与观看记录。 */
-@Tag(name = "客户端-观看进度")
+@Tag(name = "观看记录")
 @RestController
 @RequestMapping("/app/watch")
 @RequiredArgsConstructor
@@ -32,14 +32,14 @@ public class AppWatchController {
     private final WatchProgressService progressService;
 
     /** 上报进度：客户端每 10 秒一次，切集时立即上报一次。 */
-    @Operation(summary = "上报观看进度（客户端每 10 秒一次）")
+    @Operation(summary = "上报观看进度（建议每 10 秒一次，切集时补报）")
     @PostMapping("/progress")
     public Result<ProgressRespVO> save(@Valid @RequestBody ProgressSaveReqVO req) {
         return Result.ok(progressService.save(SecurityUtils.getAppUserId(), req));
     }
 
     /** 某部剧的续看位置，进详情页时用它决定"续看第 N 集"。 */
-    @Operation(summary = "某部剧的续看位置")
+    @Operation(summary = "查询某部剧的续看位置")
     @GetMapping("/progress")
     public Result<ProgressRespVO> ofDrama(@RequestParam Long dramaId) {
         return Result.ok(progressService.ofDrama(SecurityUtils.getAppUserId(), dramaId));
@@ -58,7 +58,7 @@ public class AppWatchController {
         return Result.ok();
     }
 
-    @Operation(summary = "清空观看记录")
+    @Operation(summary = "清空全部观看记录")
     @DeleteMapping("/progress")
     public Result<Void> clear() {
         progressService.clear(SecurityUtils.getAppUserId());

fruitshorts-app-api/src/main/java/com/fruitshorts/app/dal/entity/AppEventLog.java

@@ -0,0 +1,33 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.app.dal.entity;
+
+import com.baomidou.mybatisplus.annotation.FieldStrategy;
+import com.baomidou.mybatisplus.annotation.IdType;
+import com.baomidou.mybatisplus.annotation.TableField;
+import com.baomidou.mybatisplus.annotation.TableId;
+import com.baomidou.mybatisplus.annotation.TableName;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+
+/** 埋点事件落库记录，为后续分析/漏斗预留原始数据。 */
+@Data
+@TableName("app_event_log")
+public class AppEventLog {
+
+    @TableId(type = IdType.ASSIGN_ID)
+    private Long id;
+    private String eventName;
+    private LocalDateTime eventTime;
+    private Long userId;
+    private String deviceId;
+    private String sessionId;
+    private String page;
+    private String properties;
+    private String clientIp;
+    private LocalDateTime createdAt;
+
+    @TableField(updateStrategy = FieldStrategy.NEVER)
+    private LocalDateTime updatedAt;
+}

fruitshorts-app-api/src/main/java/com/fruitshorts/app/dal/mapper/AppEventLogMapper.java

@@ -0,0 +1,10 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.app.dal.mapper;
+
+import com.baomidou.mybatisplus.core.mapper.BaseMapper;
+import com.fruitshorts.app.dal.entity.AppEventLog;
+
+/** 埋点事件 Mapper。 */
+public interface AppEventLogMapper extends BaseMapper<AppEventLog> {
+}

fruitshorts-app-api/src/main/java/com/fruitshorts/app/service/AppCatalogService.java

@@ -168,10 +168,7 @@ public class AppCatalogService {
         vo.setNumber(episode.getEpNo());
         vo.setTitle(episode.getTitle());
         vo.setDurationSec(episode.getDurationSec());
-        int seconds = episode.getDurationSec() == null ? 0 : episode.getDurationSec();
-        vo.setDuration(String.format("%02d:%02d", seconds / 60, seconds % 60));
         boolean free = episode.getIsFree() != null && episode.getIsFree() == 1;
-        vo.setIsFree(free);
         vo.setLocked(!free);
         vo.setUnlockCoin(episode.getUnlockCoin());
         if (free) {

fruitshorts-app-api/src/main/java/com/fruitshorts/app/service/AppEventService.java

@@ -0,0 +1,40 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.app.service;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fruitshorts.app.dal.entity.AppEventLog;
+import com.fruitshorts.app.dal.mapper.AppEventLogMapper;
+import com.fruitshorts.app.vo.AppEventReqVO;
+import lombok.RequiredArgsConstructor;
+import lombok.SneakyThrows;
+import org.springframework.stereotype.Service;
+
+import java.time.LocalDateTime;
+
+/** 埋点事件接收：批量落库，事件名与属性暂不校验、透传，口径后续与运营对齐。 */
+@Service
+@RequiredArgsConstructor
+public class AppEventService {
+
+    private final AppEventLogMapper eventLogMapper;
+    private final ObjectMapper objectMapper;
+
+    @SneakyThrows
+    public void save(AppEventReqVO req, Long userId, String clientIp) {
+        for (AppEventReqVO.EventItem item : req.getEvents()) {
+            AppEventLog log = new AppEventLog();
+            log.setEventName(item.getEventName());
+            log.setEventTime(item.getEventTime() == null ? LocalDateTime.now() : item.getEventTime());
+            log.setUserId(userId);
+            log.setDeviceId(req.getDeviceId());
+            log.setSessionId(req.getSessionId());
+            log.setPage(item.getPage());
+            log.setProperties(item.getProperties() == null ? null
+                    : objectMapper.writeValueAsString(item.getProperties()));
+            log.setClientIp(clientIp);
+            log.setCreatedAt(LocalDateTime.now());
+            eventLogMapper.insert(log);
+        }
+    }
+}

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppBannerVO.java

@@ -2,15 +2,21 @@
 
 package com.fruitshorts.app.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 @Data
 public class AppBannerVO {
 
+    @Schema(description = "轮播图 ID")
     private Long id;
+
+    @Schema(description = "图片地址")
     private String imageUrl;
-    /** NONE / DRAMA / URL */
+
+    @Schema(description = "跳转类型：NONE / DRAMA / URL")
     private String linkType;
-    /** 短剧 ID 或跳转地址 */
+
+    @Schema(description = "跳转目标：短剧 ID 或跳转地址")
     private String linkValue;
 }

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppCategoryVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.app.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 
@@ -9,6 +10,9 @@ import lombok.Data;
 @AllArgsConstructor
 public class AppCategoryVO {
 
+    @Schema(description = "分类 ID")
     private Long id;
+
+    @Schema(description = "分类名称")
     private String name;
 }

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppDramaCardVO.java

@@ -2,24 +2,40 @@
 
 package com.fruitshorts.app.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 /** 列表卡片，用于首页/发现页/分类分区 */
 @Data
 public class AppDramaCardVO {
 
+    @Schema(description = "短剧 ID")
     private Long id;
+
+    @Schema(description = "短剧标题")
     private String title;
+
+    @Schema(description = "封面地址")
     private String cover;
+
+    @Schema(description = "简介")
     private String synopsis;
+
+    @Schema(description = "题材")
     private String genre;
+
+    @Schema(description = "分类名称")
     private String category;
+
+    @Schema(description = "总集数")
     private Integer totalEpisodes;
+
+    @Schema(description = "是否热门")
     private Boolean isHot;
+
+    @Schema(description = "播放量")
     private Long viewCount;
-    /**
-     * 首个可播免费集。首页竖屏播放需要在列表阶段就能起播，
-     * 带上这一集可以省掉「点开→请求详情→再请求播放地址」的往返。
-     */
+
+    @Schema(description = "首个可播免费集；首页竖屏播放可直接起播，省去再请求详情/播放地址的往返")
     private AppEpisodeVO preview;
 }

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppDramaDetailVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.app.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 import java.util.List;
@@ -9,16 +10,39 @@ import java.util.List;
 @Data
 public class AppDramaDetailVO {
 
+    @Schema(description = "短剧 ID")
     private Long id;
+
+    @Schema(description = "短剧标题")
     private String title;
+
+    @Schema(description = "简介")
     private String synopsis;
+
+    @Schema(description = "封面地址")
     private String cover;
+
+    @Schema(description = "题材")
     private String genre;
+
+    @Schema(description = "分类名称")
     private String category;
+
+    @Schema(description = "总集数")
     private Integer totalEpisodes;
+
+    @Schema(description = "免费集数")
     private Integer freeEpisodes;
+
+    @Schema(description = "单集解锁所需金币数")
     private Integer unlockCoin;
+
+    @Schema(description = "是否热门")
     private Boolean isHot;
+
+    @Schema(description = "播放量")
     private Long viewCount;
+
+    @Schema(description = "剧集列表")
     private List<AppEpisodeVO> episodes;
 }

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppEpisodeVO.java

@@ -2,24 +2,30 @@
 
 package com.fruitshorts.app.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 @Data
 public class AppEpisodeVO {
 
+    @Schema(description = "剧集 ID")
     private Long id;
+
+    @Schema(description = "集号（第几集）")
     private Integer number;
+
+    @Schema(description = "剧集标题")
     private String title;
-    /** 展示用时长 mm:ss */
-    private String duration;
+
+    @Schema(description = "时长（秒）")
     private Integer durationSec;
-    private Boolean isFree;
-    /** true 表示需要解锁后才能播放 */
+
+    @Schema(description = "是否锁定，true 表示需要解锁后才能播放")
     private Boolean locked;
+
+    @Schema(description = "解锁所需金币数")
     private Integer unlockCoin;
-    /**
-     * 可播放时的地址；锁定或不含片源时为空。
-     * 详情页拿到就能直接播，不必按集再请求一次播放票据。
-     */
+
+    @Schema(description = "可播放地址；锁定或无片源时为空")
     private String playUrl;
 }

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppEventReqVO.java

@@ -0,0 +1,48 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.app.vo;
+
+import io.swagger.v3.oas.annotations.media.Schema;
+import jakarta.validation.Valid;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.NotEmpty;
+import jakarta.validation.constraints.Size;
+import lombok.Data;
+
+import java.time.LocalDateTime;
+import java.util.List;
+import java.util.Map;
+
+/** 埋点事件批量上报请求。 */
+@Data
+public class AppEventReqVO {
+
+    @Schema(description = "设备ID")
+    private String deviceId;
+
+    @Schema(description = "会话ID")
+    private String sessionId;
+
+    @Schema(description = "事件列表")
+    @NotEmpty(message = "事件列表不能为空")
+    @Size(max = 50, message = "单次最多上报 50 条事件")
+    @Valid
+    private List<EventItem> events;
+
+    @Data
+    public static class EventItem {
+
+        @Schema(description = "事件名，如 playback_start/playback_end/pay_success")
+        @NotBlank(message = "事件名不能为空")
+        private String eventName;
+
+        @Schema(description = "事件发生时间，缺省用服务端接收时间")
+        private LocalDateTime eventTime;
+
+        @Schema(description = "页面/场景标识")
+        private String page;
+
+        @Schema(description = "事件属性（key-value）")
+        private Map<String, Object> properties;
+    }
+}

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppFeedVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.app.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 
@@ -12,6 +13,9 @@ import java.util.List;
 @AllArgsConstructor
 public class AppFeedVO {
 
+    @Schema(description = "轮播图列表")
     private List<AppBannerVO> banners;
+
+    @Schema(description = "分区列表")
     private List<AppSectionVO> sections;
 }

fruitshorts-app-api/src/main/java/com/fruitshorts/app/vo/AppSectionVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.app.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.AllArgsConstructor;
 import lombok.Data;
 
@@ -12,8 +13,12 @@ import java.util.List;
 @AllArgsConstructor
 public class AppSectionVO {
 
-    /** 分区标识：hot / new / category-{id}，客户端可据此做埋点与样式 */
+    @Schema(description = "分区标识：hot / new / category-{id}，客户端据此做埋点与样式")
     private String code;
+
+    @Schema(description = "分区标题")
     private String title;
+
+    @Schema(description = "分区内短剧列表")
     private List<AppDramaCardVO> dramas;
 }

fruitshorts-app-api/src/main/resources/application.yml

@@ -16,6 +16,10 @@ spring:
   jackson:
     date-format: yyyy-MM-dd HH:mm:ss
     time-zone: Asia/Shanghai
+  data:
+    redis:
+      host: ${REDIS_HOST:127.0.0.1}
+      port: ${REDIS_PORT:6379}
 
 mybatis-plus:
   configuration:
@@ -23,17 +27,11 @@ mybatis-plus:
   global-config:
     banner: false
     db-config:
-      # 主键由应用侧雪花算法生成（S0），数据库不再自增
       id-type: assign_id
       logic-delete-field: deleted
       logic-delete-value: 1
       logic-not-delete-value: 0
-    sequence:
-      # 单机开发用固定值；上多实例前必须改成按实例分配（环境变量注入），否则会撞 ID
-      worker-id: 1
-      datacenter-id: 1
 
-# 接口文档：/doc.html 打开 Swagger UI，/v3/api-docs 是机器可读契约（前端联调按它写）
 springdoc:
   swagger-ui:
     path: /doc.html
@@ -63,7 +61,25 @@ fruitshorts:
     admin-ttl-hours: 12
   cors:
     allowed-origins: "*"
+  pay:
+    google:
+      # 接入 Google Play Billing 后置 true，并注入服务账号 JSON
+      enabled: false
+      package-name: com.nontonki
+      service-account-json: ${GOOGLE_PLAY_SERVICE_ACCOUNT_JSON:}
 
 logging:
   level:
     com.fruitshorts: info
+
+management:
+  endpoints:
+    web:
+      exposure:
+        include: prometheus,health
+  endpoint:
+    health:
+      show-details: always
+  metrics:
+    tags:
+      application: ${spring.application.name}

fruitshorts-app-api/src/test/java/com/fruitshorts/app/controller/AppAuthControllerContractTest.java

@@ -1,140 +0,0 @@
-// Author: fruit.com.cn
-package com.fruitshorts.app.controller;
-
-import com.fruitshorts.app.support.ControllerContractSupport;
-import com.fruitshorts.common.exception.ErrorCode;
-import com.fruitshorts.common.exception.ServiceException;
-import com.fruitshorts.user.service.AppAuthService;
-import com.fruitshorts.user.service.AppOtpService;
-import com.fruitshorts.user.vo.TokenRespVO;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.http.MediaType;
-import org.springframework.test.web.servlet.MockMvc;
-
-import static org.hamcrest.Matchers.containsString;
-import static org.hamcrest.Matchers.nullValue;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.verify;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-
-/**
- * `/app/auth/**` 的接入层契约：路由、请求体绑定、统一响应包 `{code,message,data}`、错误码映射。
- *
- * <p>业务规则（免码、密码强度、频控）在 {@code AppAuthServiceTest} / {@code AppOtpServiceTest} 里用真服务验证，
- * 这里只钉"接口长什么样"。
- */
-class AppAuthControllerContractTest {
-
-    private AppOtpService otpService;
-    private AppAuthService authService;
-    private MockMvc mockMvc;
-
-    @BeforeEach
-    void setUp() {
-        otpService = mock(AppOtpService.class);
-        authService = mock(AppAuthService.class);
-        mockMvc = ControllerContractSupport.mockMvcOf(new AppAuthController(otpService, authService));
-    }
-
-    @Test
-    void should_return_access_token_when_email_register_succeeds() throws Exception {
-        given(authService.register(any(), any())).willReturn(tokens("access-1", "refresh-1"));
-
-        mockMvc.perform(post("/app/auth/register")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"targetType\":\"EMAIL\",\"target\":\"a@b.com\",\"password\":\"abcd1234\"}"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.message").value("ok"))
-                .andExpect(jsonPath("$.data.accessToken").value("access-1"))
-                .andExpect(jsonPath("$.data.tokenType").value("Bearer"))
-                .andExpect(jsonPath("$.data.newUser").value(true));
-    }
-
-    @Test
-    void should_return_data_exists_code_when_email_is_already_registered() throws Exception {
-        given(authService.register(any(), any())).willThrow(
-                new ServiceException(ErrorCode.DATA_EXISTS, "该账号已注册，请直接登录"));
-
-        mockMvc.perform(post("/app/auth/register")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"targetType\":\"EMAIL\",\"target\":\"a@b.com\",\"password\":\"abcd1234\"}"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(ErrorCode.DATA_EXISTS.getCode()))
-                .andExpect(jsonPath("$.message").value("该账号已注册，请直接登录"))
-                .andExpect(jsonPath("$.data").value(nullValue()));
-    }
-
-    @Test
-    void should_map_otp_required_error_when_phone_register_has_no_code() throws Exception {
-        given(authService.register(any(), any())).willThrow(
-                new ServiceException(ErrorCode.BAD_REQUEST, "请先获取验证码"));
-
-        mockMvc.perform(post("/app/auth/register")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"targetType\":\"PHONE\",\"target\":\"08123456789\"}"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(ErrorCode.BAD_REQUEST.getCode()))
-                .andExpect(jsonPath("$.message").value("请先获取验证码"));
-    }
-
-    @Test
-    void should_return_bad_request_code_when_register_body_has_no_target() throws Exception {
-        mockMvc.perform(post("/app/auth/register")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"targetType\":\"EMAIL\"}"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(ErrorCode.BAD_REQUEST.getCode()))
-                .andExpect(jsonPath("$.message").value(containsString("请输入手机号或邮箱")));
-    }
-
-    @Test
-    void should_return_access_token_when_password_login_succeeds() throws Exception {
-        given(authService.login(any(), any())).willReturn(tokens("access-2", "refresh-2"));
-
-        mockMvc.perform(post("/app/auth/login")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"targetType\":\"EMAIL\",\"target\":\"a@b.com\",\"password\":\"abcd1234\"}"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.data.accessToken").value("access-2"));
-    }
-
-    @Test
-    void should_return_login_failed_code_when_password_is_wrong() throws Exception {
-        given(authService.login(any(), any())).willThrow(new ServiceException(ErrorCode.LOGIN_FAILED));
-
-        mockMvc.perform(post("/app/auth/login")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"targetType\":\"EMAIL\",\"target\":\"a@b.com\",\"password\":\"wrongpass1\"}"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(ErrorCode.LOGIN_FAILED.getCode()))
-                .andExpect(jsonPath("$.message").value("账号或密码错误"));
-    }
-
-    @Test
-    void should_return_ok_envelope_when_otp_send_succeeds() throws Exception {
-        mockMvc.perform(post("/app/auth/otp")
-                        .contentType(MediaType.APPLICATION_JSON)
-                        .content("{\"scene\":\"REGISTER\",\"targetType\":\"PHONE\",\"target\":\"08123456789\",\"deviceId\":\"d-1\"}"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.data").value(nullValue()));
-
-        verify(otpService).send(any(), any());
-    }
-
-    private TokenRespVO tokens(String accessToken, String refreshToken) {
-        TokenRespVO vo = new TokenRespVO();
-        vo.setAccessToken(accessToken);
-        vo.setRefreshToken(refreshToken);
-        vo.setExpiresIn(7200);
-        vo.setNewUser(true);
-        return vo;
-    }
-}

fruitshorts-app-api/src/test/java/com/fruitshorts/app/controller/AppCatalogControllerContractTest.java

@@ -1,114 +0,0 @@
-// Author: fruit.com.cn
-package com.fruitshorts.app.controller;
-
-import com.fruitshorts.app.service.AppCatalogService;
-import com.fruitshorts.app.support.ControllerContractSupport;
-import com.fruitshorts.app.vo.AppBannerVO;
-import com.fruitshorts.app.vo.AppCategoryVO;
-import com.fruitshorts.app.vo.AppDramaDetailVO;
-import com.fruitshorts.app.vo.AppFeedVO;
-import com.fruitshorts.common.exception.ErrorCode;
-import com.fruitshorts.common.exception.ServiceException;
-import com.fruitshorts.playback.service.PlaybackService;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.test.web.servlet.MockMvc;
-
-import java.util.List;
-
-import static org.hamcrest.Matchers.nullValue;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.verify;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-
-/**
- * 目录接口的接入层契约：`/app/home/feed`、`/app/discover/feed`、`/app/categories`、`/app/dramas/{id}`。
- *
- * <p>关注三件事：路由通不通、路径参数有没有绑对、响应壳是不是 `{code,message,data}`。
- */
-class AppCatalogControllerContractTest {
-
-    private AppCatalogService catalogService;
-    private MockMvc catalogMvc;
-    private MockMvc dramaMvc;
-
-    @BeforeEach
-    void setUp() {
-        catalogService = mock(AppCatalogService.class);
-        catalogMvc = ControllerContractSupport.mockMvcOf(new AppCatalogController(catalogService));
-        dramaMvc = ControllerContractSupport.mockMvcOf(
-                new AppDramaController(catalogService, mock(PlaybackService.class)));
-    }
-
-    @Test
-    void should_return_banners_and_sections_when_home_feed_is_requested() throws Exception {
-        AppBannerVO banner = new AppBannerVO();
-        banner.setId(9L);
-        banner.setImageUrl("/files/banner/9.png");
-        banner.setLinkType("DRAMA");
-        banner.setLinkValue("12");
-        AppFeedVO feed = new AppFeedVO(List.of(banner), List.of());
-        given(catalogService.homeFeed()).willReturn(feed);
-
-        catalogMvc.perform(get("/app/home/feed"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.data.banners[0].id").value(9))
-                .andExpect(jsonPath("$.data.banners[0].imageUrl").value("/files/banner/9.png"))
-                .andExpect(jsonPath("$.data.banners[0].linkType").value("DRAMA"));
-    }
-
-    @Test
-    void should_return_sections_when_discover_feed_is_requested() throws Exception {
-        AppFeedVO feed = new AppFeedVO(List.of(), List.of());
-        given(catalogService.discoverFeed()).willReturn(feed);
-
-        catalogMvc.perform(get("/app/discover/feed"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.data.sections").isArray());
-    }
-
-    @Test
-    void should_return_category_list_when_categories_are_requested() throws Exception {
-        AppCategoryVO category = new AppCategoryVO(3L, "都市");
-        given(catalogService.categories()).willReturn(List.of(category));
-
-        catalogMvc.perform(get("/app/categories"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.data[0].id").value(3))
-                .andExpect(jsonPath("$.data[0].name").value("都市"));
-    }
-
-    @Test
-    void should_bind_path_variable_when_drama_detail_is_requested() throws Exception {
-        AppDramaDetailVO detail = new AppDramaDetailVO();
-        detail.setId(42L);
-        detail.setTitle("命运的相遇");
-        detail.setEpisodes(List.of());
-        given(catalogService.dramaDetail(42L)).willReturn(detail);
-
-        dramaMvc.perform(get("/app/dramas/42"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.data.id").value(42))
-                .andExpect(jsonPath("$.data.title").value("命运的相遇"));
-
-        verify(catalogService).dramaDetail(42L);
-    }
-
-    @Test
-    void should_return_data_not_found_code_when_drama_does_not_exist() throws Exception {
-        given(catalogService.dramaDetail(404L))
-                .willThrow(new ServiceException(ErrorCode.DATA_NOT_FOUND, "短剧不存在"));
-
-        dramaMvc.perform(get("/app/dramas/404"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(ErrorCode.DATA_NOT_FOUND.getCode()))
-                .andExpect(jsonPath("$.data").value(nullValue()));
-    }
-}

fruitshorts-app-api/src/test/java/com/fruitshorts/app/controller/AppPlaybackContractTest.java

@@ -1,96 +0,0 @@
-// Author: fruit.com.cn
-package com.fruitshorts.app.controller;
-
-import com.fruitshorts.app.service.AppCatalogService;
-import com.fruitshorts.app.support.ControllerContractSupport;
-import com.fruitshorts.playback.service.PlaybackService;
-import com.fruitshorts.playback.vo.PlayRespVO;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.test.web.servlet.MockMvc;
-
-import java.util.List;
-
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.ArgumentMatchers.isNull;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.verify;
-import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
-import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
-
-/**
- * 播放票据接口的接入层契约：`/app/episodes/{id}/play` 的免费/付费两种形态与参数透传。
- *
- * <p>免费 / 付费的**判定规则**在 {@code PlaybackServiceTest} 里用真服务验证；
- * 这里钉的是"下发给客户端的字段长什么样"（客户端 Flutter 依赖这些字段名）。
- */
-class AppPlaybackContractTest {
-
-    private PlaybackService playbackService;
-    private MockMvc mockMvc;
-
-    @BeforeEach
-    void setUp() {
-        playbackService = mock(PlaybackService.class);
-        mockMvc = ControllerContractSupport.mockMvcOf(
-                new AppDramaController(mock(AppCatalogService.class), playbackService));
-    }
-
-    @Test
-    void should_return_free_access_when_episode_is_free() throws Exception {
-        given(playbackService.play(isNull(), eq(11L), any(), any()))
-                .willReturn(ticket(11L, true, PlaybackService.ACCESS_FREE, "/files/ep.mp4?s=1"));
-
-        mockMvc.perform(get("/app/episodes/11/play").header("X-Device-Id", "device-9"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.code").value(0))
-                .andExpect(jsonPath("$.data.episodeId").value(11))
-                .andExpect(jsonPath("$.data.accessible").value(true))
-                .andExpect(jsonPath("$.data.accessType").value(PlaybackService.ACCESS_FREE))
-                .andExpect(jsonPath("$.data.playUrl").value("/files/ep.mp4?s=1"));
-    }
-
-    @Test
-    void should_return_coin_required_when_episode_is_locked_and_not_entitled() throws Exception {
-        PlayRespVO locked = ticket(12L, false, PlaybackService.ACCESS_COIN_REQUIRED, "");
-        locked.setUnlockCoin(60);
-        given(playbackService.play(isNull(), eq(12L), any(), any())).willReturn(locked);
-
-        mockMvc.perform(get("/app/episodes/12/play"))
-                .andExpect(status().isOk())
-                .andExpect(jsonPath("$.data.accessible").value(false))
-                .andExpect(jsonPath("$.data.accessType").value(PlaybackService.ACCESS_COIN_REQUIRED))
-                .andExpect(jsonPath("$.data.playUrl").value(""))
-                .andExpect(jsonPath("$.data.unlockCoin").value(60));
-    }
-
-    @Test
-    void should_pass_episode_id_and_device_header_when_play_is_requested() throws Exception {
-        given(playbackService.play(isNull(), eq(13L), eq("device-9"), any()))
-                .willReturn(ticket(13L, true, PlaybackService.ACCESS_FREE, "/files/ep13.mp4?s=1"));
-
-        mockMvc.perform(get("/app/episodes/13/play").header("X-Device-Id", "device-9"))
-                .andExpect(status().isOk());
-
-        verify(playbackService).play(isNull(), eq(13L), eq("device-9"), any());
-    }
-
-    private PlayRespVO ticket(Long episodeId, boolean accessible, String accessType, String playUrl) {
-        PlayRespVO vo = new PlayRespVO();
-        vo.setEpisodeId(episodeId);
-        vo.setDramaId(7L);
-        vo.setNumber(1);
-        vo.setTitle("第 1 集");
-        vo.setDurationSec(120);
-        vo.setAccessible(accessible);
-        vo.setAccessType(accessType);
-        vo.setPlayUrl(playUrl);
-        vo.setQualities(List.of("AUTO"));
-        vo.setUnlockCoin(0);
-        vo.setPreviewSeconds(0);
-        return vo;
-    }
-}

fruitshorts-app-api/src/test/java/com/fruitshorts/app/service/AppAuthServiceTest.java

@@ -1,320 +0,0 @@
-// Author: fruit.com.cn
-package com.fruitshorts.app.service;
-
-import com.fruitshorts.common.exception.ErrorCode;
-import com.fruitshorts.common.exception.ServiceException;
-import com.fruitshorts.framework.security.JwtTokenProvider;
-import com.fruitshorts.user.dal.entity.AppUser;
-import com.fruitshorts.user.dal.entity.AppUserCredential;
-import com.fruitshorts.user.dal.entity.AppUserOtp;
-import com.fruitshorts.user.dal.entity.AppUserSession;
-import com.fruitshorts.user.dal.mapper.AppUserConsentMapper;
-import com.fruitshorts.user.dal.mapper.AppUserCredentialMapper;
-import com.fruitshorts.user.dal.mapper.AppUserDeviceMapper;
-import com.fruitshorts.user.dal.mapper.AppUserMapper;
-import com.fruitshorts.user.dal.mapper.AppUserOtpMapper;
-import com.fruitshorts.user.dal.mapper.AppUserSessionMapper;
-import com.fruitshorts.user.enums.AppUserStatus;
-import com.fruitshorts.user.service.AppAuthService;
-import com.fruitshorts.user.service.AppOtpService;
-import com.fruitshorts.user.service.CredentialHasher;
-import com.fruitshorts.user.service.OtpSender;
-import com.fruitshorts.user.vo.LoginReqVO;
-import com.fruitshorts.user.vo.RegisterReqVO;
-import com.fruitshorts.user.vo.TokenRespVO;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-import org.springframework.security.crypto.password.PasswordEncoder;
-
-import java.time.Duration;
-import java.time.LocalDateTime;
-import java.util.concurrent.atomic.AtomicReference;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.verify;
-
-/**
- * C 端注册 / 登录的**业务规则**测试：真 `AppAuthService` + 替身 Mapper，不连库。
- *
- * <p>覆盖几件接入层测不到的事：EMAIL 免码到底走没走验证码、密码强度、注册频控、
- * 账号重复、密码比对与封禁判断。验证码本身的校验规则在 `AppOtpServiceTest`。
- */
-class AppAuthServiceTest {
-
-    private AppUserMapper userMapper;
-    private AppUserCredentialMapper credentialMapper;
-    private AppUserSessionMapper sessionMapper;
-    private AppUserConsentMapper consentMapper;
-    private AppUserDeviceMapper deviceMapper;
-    private AppOtpService otpService;
-    private CredentialHasher hasher;
-    private JwtTokenProvider tokenProvider;
-    private PasswordEncoder passwordEncoder;
-    private AppAuthService authService;
-
-    @BeforeEach
-    void setUp() {
-        userMapper = mock(AppUserMapper.class);
-        credentialMapper = mock(AppUserCredentialMapper.class);
-        sessionMapper = mock(AppUserSessionMapper.class);
-        consentMapper = mock(AppUserConsentMapper.class);
-        deviceMapper = mock(AppUserDeviceMapper.class);
-        otpService = mock(AppOtpService.class);
-        hasher = mock(CredentialHasher.class);
-        tokenProvider = mock(JwtTokenProvider.class);
-        passwordEncoder = mock(PasswordEncoder.class);
-        authService = new AppAuthService(userMapper, credentialMapper, sessionMapper, consentMapper,
-                deviceMapper, otpService, hasher, tokenProvider, passwordEncoder);
-    }
-
-    @Test
-    void should_register_without_otp_when_target_type_is_email() {
-        stubHappyRegister();
-        AtomicReference<AppUserCredential> saved = captureCredential();
-
-        TokenRespVO resp = authService.register(emailRegister("abcd1234", null), "203.0.113.8");
-
-        assertThat(resp.getAccessToken()).isEqualTo("access-1");
-        assertThat(resp.getRefreshToken()).isEqualTo("refresh-1");
-        assertThat(resp.isNewUser()).isTrue();
-        // 免码注册不等于"已验证"：邮箱可达性没验证过，所以先记 0，等日后点验证链接再置 1
-        assertThat(saved.get().getVerified()).isZero();
-        verify(otpService, never()).consume(anyString(), anyString(), anyString(), any());
-    }
-
-    @Test
-    void should_consume_otp_when_email_register_carries_a_code() {
-        stubHappyRegister();
-
-        authService.register(emailRegister("abcd1234", "654321"), "203.0.113.8");
-
-        verify(otpService).consume(eq("REGISTER"), eq("EMAIL"), eq("a@b.com"), eq("654321"));
-    }
-
-    @Test
-    void should_consume_otp_when_target_type_is_phone() {
-        stubHappyRegister();
-
-        authService.register(phoneRegister("+628123456789", "654321"), "203.0.113.8");
-
-        verify(otpService).consume(eq("REGISTER"), eq("PHONE"), eq("+628123456789"), eq("654321"));
-    }
-
-    @Test
-    void should_reject_phone_register_when_no_code_was_requested() {
-        AppAuthService serviceWithRealOtp = serviceWithRealOtpService(null);
-
-        assertThatThrownBy(() -> serviceWithRealOtp.register(phoneRegister("+628123456789", ""), "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .hasMessage("请先获取验证码");
-    }
-
-    @Test
-    void should_reject_phone_register_when_code_is_wrong() {
-        AppUserOtp issued = new AppUserOtp();
-        issued.setCodeHash("hash-of-654321");
-        issued.setExpireAt(LocalDateTime.now().plusMinutes(5));
-        issued.setFailCount(0);
-        AppAuthService serviceWithRealOtp = serviceWithRealOtpService(issued);
-
-        assertThatThrownBy(() -> serviceWithRealOtp.register(phoneRegister("+628123456789", "000000"), "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .hasMessage("验证码不正确");
-    }
-
-    @Test
-    void should_reject_email_register_when_password_is_weak() {
-        RegisterReqVO req = emailRegister("abcdefgh", null);
-
-        assertThatThrownBy(() -> authService.register(req, "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .hasMessageContaining("密码需同时包含字母和数字");
-    }
-
-    @Test
-    void should_reject_email_register_when_format_is_invalid() {
-        RegisterReqVO req = emailRegister("abcd1234", null);
-        req.setTarget("not-an-email");
-
-        assertThatThrownBy(() -> authService.register(req, "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .hasMessage("邮箱格式不正确");
-    }
-
-    @Test
-    void should_return_data_exists_when_email_is_already_registered() {
-        given(userMapper.selectCount(any())).willReturn(0L);
-        AppUserCredential existing = new AppUserCredential();
-        existing.setUserId(1001L);
-        given(credentialMapper.selectOne(any())).willReturn(existing);
-
-        assertThatThrownBy(() -> authService.register(emailRegister("abcd1234", null), "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .satisfies(ex -> assertThat(((ServiceException) ex).getCode())
-                        .isEqualTo(ErrorCode.DATA_EXISTS.getCode()))
-                .hasMessage("该账号已注册，请直接登录");
-    }
-
-    @Test
-    void should_reject_register_when_ip_reaches_the_daily_limit() {
-        given(userMapper.selectCount(any())).willReturn(5L);
-
-        assertThatThrownBy(() -> authService.register(emailRegister("abcd1234", null), "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .satisfies(ex -> assertThat(((ServiceException) ex).getCode())
-                        .isEqualTo(ErrorCode.TOO_MANY_REQUESTS.getCode()))
-                .hasMessageContaining("当前网络注册过于频繁");
-    }
-
-    @Test
-    void should_return_tokens_when_password_matches() {
-        stubLogin(credential("bcrypt-hash"), user(AppUserStatus.NORMAL));
-        given(passwordEncoder.matches("abcd1234", "bcrypt-hash")).willReturn(true);
-
-        TokenRespVO resp = authService.login(emailLogin("abcd1234"), "203.0.113.8");
-
-        assertThat(resp.getAccessToken()).isEqualTo("access-1");
-        assertThat(resp.getUser().getUid()).isEqualTo("UAB12CD");
-        verify(sessionMapper).insert(any(AppUserSession.class));
-    }
-
-    @Test
-    void should_reject_login_when_password_does_not_match() {
-        stubLogin(credential("bcrypt-hash"), user(AppUserStatus.NORMAL));
-        given(passwordEncoder.matches("wrongpass1", "bcrypt-hash")).willReturn(false);
-
-        assertThatThrownBy(() -> authService.login(emailLogin("wrongpass1"), "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .satisfies(ex -> assertThat(((ServiceException) ex).getCode())
-                        .isEqualTo(ErrorCode.LOGIN_FAILED.getCode()))
-                .hasMessage("账号或密码错误");
-    }
-
-    @Test
-    void should_reject_login_when_account_does_not_exist() {
-        given(credentialMapper.selectOne(any())).willReturn(null);
-
-        assertThatThrownBy(() -> authService.login(emailLogin("abcd1234"), "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .satisfies(ex -> assertThat(((ServiceException) ex).getCode())
-                        .isEqualTo(ErrorCode.LOGIN_FAILED.getCode()))
-                .hasMessage("账号不存在，请先注册");
-    }
-
-    @Test
-    void should_reject_login_when_account_is_banned() {
-        stubLogin(credential("bcrypt-hash"), user(AppUserStatus.BANNED));
-        given(passwordEncoder.matches("abcd1234", "bcrypt-hash")).willReturn(true);
-
-        assertThatThrownBy(() -> authService.login(emailLogin("abcd1234"), "203.0.113.8"))
-                .isInstanceOf(ServiceException.class)
-                .satisfies(ex -> assertThat(((ServiceException) ex).getCode())
-                        .isEqualTo(ErrorCode.ACCOUNT_DISABLED.getCode()));
-    }
-
-    private void stubHappyRegister() {
-        given(userMapper.selectCount(any())).willReturn(0L);
-        given(credentialMapper.selectOne(any())).willReturn(null);
-        given(hasher.newUid()).willReturn("UAB12CD");
-        given(hasher.newRefreshToken()).willReturn("refresh-1");
-        given(hasher.sha256(anyString())).willReturn("hash-1");
-        given(passwordEncoder.encode(anyString())).willReturn("bcrypt-hash");
-        given(tokenProvider.createAppToken(any(), anyString(), any())).willReturn("access-1");
-        given(tokenProvider.accessTtlSeconds()).willReturn(7200L);
-        given(tokenProvider.appRefreshTtl()).willReturn(Duration.ofDays(30));
-        AtomicReference<AppUser> inserted = new AtomicReference<>();
-        given(userMapper.insert(any(AppUser.class))).willAnswer(invocation -> {
-            AppUser saved = invocation.getArgument(0);
-            saved.setId(1001L);
-            inserted.set(saved);
-            return 1;
-        });
-        given(userMapper.selectById(any())).willAnswer(invocation -> inserted.get());
-    }
-
-    private AtomicReference<AppUserCredential> captureCredential() {
-        AtomicReference<AppUserCredential> saved = new AtomicReference<>();
-        given(credentialMapper.insert(any(AppUserCredential.class))).willAnswer(invocation -> {
-            saved.set(invocation.getArgument(0));
-            return 1;
-        });
-        return saved;
-    }
-
-    private void stubLogin(AppUserCredential credential, AppUser user) {
-        given(credentialMapper.selectOne(any())).willReturn(credential);
-        given(userMapper.selectById(any())).willReturn(user);
-        given(hasher.newRefreshToken()).willReturn("refresh-1");
-        given(hasher.sha256(anyString())).willReturn("hash-1");
-        given(tokenProvider.createAppToken(any(), anyString(), any())).willReturn("access-1");
-        given(tokenProvider.accessTtlSeconds()).willReturn(7200L);
-        given(tokenProvider.appRefreshTtl()).willReturn(Duration.ofDays(30));
-    }
-
-    private AppAuthService serviceWithRealOtpService(AppUserOtp issued) {
-        AppUserOtpMapper otpMapper = mock(AppUserOtpMapper.class);
-        CredentialHasher otpHasher = mock(CredentialHasher.class);
-        given(otpMapper.selectOne(any())).willReturn(issued);
-        given(otpHasher.hashOtp(any())).willReturn("hash-of-something-else");
-        AppOtpService realOtpService = new AppOtpService(otpMapper, mock(OtpSender.class), otpHasher);
-        return new AppAuthService(userMapper, credentialMapper, sessionMapper, consentMapper,
-                deviceMapper, realOtpService, hasher, tokenProvider, passwordEncoder);
-    }
-
-    private RegisterReqVO emailRegister(String password, String code) {
-        RegisterReqVO req = new RegisterReqVO();
-        req.setTargetType("EMAIL");
-        req.setTarget("a@b.com");
-        req.setPassword(password);
-        req.setCode(code);
-        req.setDeviceId("device-9");
-        req.setAgreementVersion("2026-10-01");
-        return req;
-    }
-
-    private RegisterReqVO phoneRegister(String target, String code) {
-        RegisterReqVO req = new RegisterReqVO();
-        req.setTargetType("PHONE");
-        req.setTarget(target);
-        req.setCode(code);
-        req.setDeviceId("device-9");
-        req.setAgreementVersion("2026-10-01");
-        return req;
-    }
-
-    private LoginReqVO emailLogin(String password) {
-        LoginReqVO req = new LoginReqVO();
-        req.setTargetType("EMAIL");
-        req.setTarget("a@b.com");
-        req.setPassword(password);
-        req.setDeviceId("device-9");
-        return req;
-    }
-
-    private AppUserCredential credential(String passwordHash) {
-        AppUserCredential credential = new AppUserCredential();
-        credential.setId(1L);
-        credential.setUserId(1001L);
-        credential.setType("EMAIL");
-        credential.setIdentifier("a@b.com");
-        credential.setPasswordHash(passwordHash);
-        return credential;
-    }
-
-    private AppUser user(String status) {
-        AppUser user = new AppUser();
-        user.setId(1001L);
-        user.setUid("UAB12CD");
-        user.setNickname("UserAB12CD");
-        user.setStatus(status);
-        user.setCountryCode("ID");
-        return user;
-    }
-}

fruitshorts-app-api/src/test/java/com/fruitshorts/app/service/AppOtpServiceTest.java

@@ -1,104 +0,0 @@
-// Author: fruit.com.cn
-package com.fruitshorts.app.service;
-
-import com.fruitshorts.common.exception.ErrorCode;
-import com.fruitshorts.common.exception.ServiceException;
-import com.fruitshorts.user.dal.entity.AppUserOtp;
-import com.fruitshorts.user.dal.mapper.AppUserOtpMapper;
-import com.fruitshorts.user.service.AppOtpService;
-import com.fruitshorts.user.service.CredentialHasher;
-import com.fruitshorts.user.service.OtpSender;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.time.LocalDateTime;
-import java.util.concurrent.atomic.AtomicReference;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatThrownBy;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-
-/**
- * 验证码**校验规则**测试：真 `AppOtpService` + 替身 Mapper。
- *
- * <p>注册/登录链路"PHONE 必须带验证码"的拒绝对外表现，靠这里的真规则 + `AppAuthServiceTest`
- * 里的"必须调用 consume"两条一起钉住，避免两边都用替身导致互相假装。
- */
-class AppOtpServiceTest {
-
-    private AppUserOtpMapper otpMapper;
-    private CredentialHasher hasher;
-    private AppOtpService otpService;
-
-    @BeforeEach
-    void setUp() {
-        otpMapper = mock(AppUserOtpMapper.class);
-        hasher = mock(CredentialHasher.class);
-        otpService = new AppOtpService(otpMapper, mock(OtpSender.class), hasher);
-    }
-
-    @Test
-    void should_reject_consume_when_no_code_was_requested() {
-        given(otpMapper.selectOne(any())).willReturn(null);
-
-        assertThatThrownBy(() -> otpService.consume("REGISTER", "PHONE", "+628123456789", "123456"))
-                .isInstanceOf(ServiceException.class)
-                .satisfies(ex -> assertThat(((ServiceException) ex).getCode())
-                        .isEqualTo(ErrorCode.BAD_REQUEST.getCode()))
-                .hasMessage("请先获取验证码");
-    }
-
-    @Test
-    void should_reject_consume_when_code_is_wrong() {
-        AppUserOtp issued = issuedOtp("hash-of-123456");
-        given(otpMapper.selectOne(any())).willReturn(issued);
-        given(hasher.hashOtp("000000")).willReturn("hash-of-000000");
-
-        assertThatThrownBy(() -> otpService.consume("REGISTER", "PHONE", "+628123456789", "000000"))
-                .isInstanceOf(ServiceException.class)
-                .hasMessage("验证码不正确");
-        // 失败要计数，连续错 5 次就作废（防爆破）
-        assertThat(issued.getFailCount()).isEqualTo(1);
-    }
-
-    @Test
-    void should_reject_consume_when_code_is_expired() {
-        AppUserOtp issued = issuedOtp("hash-of-123456");
-        issued.setExpireAt(LocalDateTime.now().minusMinutes(1));
-        given(otpMapper.selectOne(any())).willReturn(issued);
-
-        assertThatThrownBy(() -> otpService.consume("REGISTER", "PHONE", "+628123456789", "123456"))
-                .isInstanceOf(ServiceException.class)
-                .hasMessage("验证码已过期");
-    }
-
-    @Test
-    void should_mark_code_used_when_code_matches() {
-        AppUserOtp issued = issuedOtp("hash-of-123456");
-        AtomicReference<AppUserOtp> updated = new AtomicReference<>();
-        given(otpMapper.selectOne(any())).willReturn(issued);
-        given(hasher.hashOtp("123456")).willReturn("hash-of-123456");
-        given(otpMapper.updateById(any(AppUserOtp.class))).willAnswer(invocation -> {
-            updated.set(invocation.getArgument(0));
-            return 1;
-        });
-
-        otpService.consume("REGISTER", "PHONE", "+628123456789", "123456");
-
-        assertThat(updated.get().getUsedAt()).isNotNull();
-    }
-
-    private AppUserOtp issuedOtp(String codeHash) {
-        AppUserOtp otp = new AppUserOtp();
-        otp.setId(1L);
-        otp.setScene("REGISTER");
-        otp.setTargetType("PHONE");
-        otp.setTarget("+628123456789");
-        otp.setCodeHash(codeHash);
-        otp.setExpireAt(LocalDateTime.now().plusMinutes(5));
-        otp.setFailCount(0);
-        return otp;
-    }
-}

fruitshorts-app-api/src/test/java/com/fruitshorts/app/service/PlaybackServiceTest.java

@@ -1,146 +0,0 @@
-// Author: fruit.com.cn
-package com.fruitshorts.app.service;
-
-import com.fruitshorts.content.dal.entity.Drama;
-import com.fruitshorts.content.dal.entity.DramaEpisode;
-import com.fruitshorts.content.service.DramaService;
-import com.fruitshorts.content.service.EpisodeService;
-import com.fruitshorts.media.service.PlaybackSigner;
-import com.fruitshorts.media.service.TranscodeService;
-import com.fruitshorts.playback.dal.entity.PlaybackTicket;
-import com.fruitshorts.playback.dal.mapper.PlaybackTicketMapper;
-import com.fruitshorts.playback.service.EntitlementPort;
-import com.fruitshorts.playback.service.PlaybackService;
-import com.fruitshorts.playback.vo.PlayRespVO;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.util.List;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyLong;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.ArgumentMatchers.isNull;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.never;
-import static org.mockito.Mockito.verify;
-
-/**
- * 播放票据的**判定规则**测试：真 `PlaybackService` + 替身依赖，不连库。
- *
- * <p>两条关键分支（接入层只验证字段形态，判定在这里）：免费集一律给签名地址；
- * 付费集在没权益时**不给地址**，只回 `COIN_REQUIRED` 与所需金币。
- */
-class PlaybackServiceTest {
-
-    private EpisodeService episodeService;
-    private DramaService dramaService;
-    private PlaybackTicketMapper ticketMapper;
-    private PlaybackSigner signer;
-    private EntitlementPort entitlementPort;
-    private TranscodeService transcodeService;
-    private PlaybackService playbackService;
-
-    @BeforeEach
-    void setUp() {
-        episodeService = mock(EpisodeService.class);
-        dramaService = mock(DramaService.class);
-        ticketMapper = mock(PlaybackTicketMapper.class);
-        signer = mock(PlaybackSigner.class);
-        entitlementPort = mock(EntitlementPort.class);
-        transcodeService = mock(TranscodeService.class);
-        playbackService = new PlaybackService(episodeService, dramaService, ticketMapper, signer,
-                entitlementPort, transcodeService);
-        given(dramaService.getPublished(anyLong())).willReturn(drama());
-        given(transcodeService.listRenditions(anyLong())).willReturn(List.of());
-        given(signer.sign(anyString())).willReturn("/files/episode/1.mp4?e=1&s=sig");
-    }
-
-    @Test
-    void should_return_free_access_when_episode_is_free() {
-        given(episodeService.getPublished(11L)).willReturn(episode(11L, 1, 0, "/files/episode/1.mp4"));
-
-        PlayRespVO resp = playbackService.play(null, 11L, "device-9", "203.0.113.8");
-
-        assertThat(resp.getAccessible()).isTrue();
-        assertThat(resp.getAccessType()).isEqualTo(PlaybackService.ACCESS_FREE);
-        assertThat(resp.getPlayUrl()).isEqualTo("/files/episode/1.mp4?e=1&s=sig");
-        // 未登录不记票据（票据是"已登录用户"的签发审计）
-        verify(ticketMapper, never()).insert(any(PlaybackTicket.class));
-    }
-
-    @Test
-    void should_return_coin_required_when_episode_is_locked_and_not_entitled() {
-        given(episodeService.getPublished(12L)).willReturn(episode(12L, 0, 60, "/files/episode/2.mp4"));
-        given(entitlementPort.isUnlocked(anyLong(), anyLong(), anyLong())).willReturn(false);
-
-        PlayRespVO resp = playbackService.play(1001L, 12L, "device-9", "203.0.113.8");
-
-        assertThat(resp.getAccessible()).isFalse();
-        assertThat(resp.getAccessType()).isEqualTo(PlaybackService.ACCESS_COIN_REQUIRED);
-        assertThat(resp.getPlayUrl()).isEmpty();
-        assertThat(resp.getUnlockCoin()).isEqualTo(60);
-        verify(ticketMapper, never()).insert(any(PlaybackTicket.class));
-    }
-
-    @Test
-    void should_return_entitled_access_when_entitlement_port_confirms_unlock() {
-        given(episodeService.getPublished(13L)).willReturn(episode(13L, 0, 60, "/files/episode/3.mp4"));
-        given(entitlementPort.isUnlocked(eq(1001L), anyLong(), eq(13L))).willReturn(true);
-
-        PlayRespVO resp = playbackService.play(1001L, 13L, "device-9", "203.0.113.8");
-
-        assertThat(resp.getAccessible()).isTrue();
-        assertThat(resp.getAccessType()).isEqualTo(PlaybackService.ACCESS_ENTITLED);
-        assertThat(resp.getPlayUrl()).isEqualTo("/files/episode/1.mp4?e=1&s=sig");
-        verify(ticketMapper).insert(any(PlaybackTicket.class));
-    }
-
-    @Test
-    void should_return_no_media_when_episode_has_no_source() {
-        given(episodeService.getPublished(14L)).willReturn(episode(14L, 1, 0, ""));
-
-        PlayRespVO resp = playbackService.play(isNull(), 14L, "device-9", "203.0.113.8");
-
-        assertThat(resp.getAccessible()).isFalse();
-        assertThat(resp.getAccessType()).isEqualTo(PlaybackService.ACCESS_NO_MEDIA);
-        assertThat(resp.getPlayUrl()).isEmpty();
-    }
-
-    @Test
-    void should_prefer_hls_url_when_the_episode_has_multi_bitrate_renditions() {
-        DramaEpisode episode = episode(15L, 1, 0, "/files/episode/origin.mp4");
-        episode.setHlsUrl("/files/episode/15/master.m3u8");
-        given(episodeService.getPublished(15L)).willReturn(episode);
-
-        PlayRespVO resp = playbackService.play(null, 15L, "device-9", "203.0.113.8");
-
-        assertThat(resp.getPlayUrl()).isEqualTo("/files/episode/1.mp4?e=1&s=sig");
-        verify(signer).sign("/files/episode/15/master.m3u8");
-    }
-
-    private DramaEpisode episode(Long id, int isFree, int unlockCoin, String videoUrl) {
-        DramaEpisode episode = new DramaEpisode();
-        episode.setId(id);
-        episode.setDramaId(7L);
-        episode.setEpNo(1);
-        episode.setTitle("第 1 集");
-        episode.setDurationSec(120);
-        episode.setIsFree(isFree);
-        episode.setUnlockCoin(unlockCoin);
-        episode.setPreviewSeconds(0);
-        episode.setVideoUrl(videoUrl);
-        episode.setStatus("published");
-        return episode;
-    }
-
-    private Drama drama() {
-        Drama drama = new Drama();
-        drama.setId(7L);
-        drama.setTitle("命运的相遇");
-        return drama;
-    }
-}

fruitshorts-app-api/src/test/java/com/fruitshorts/app/support/ControllerContractSupport.java

@@ -1,33 +0,0 @@
-// Author: fruit.com.cn
-package com.fruitshorts.app.support;
-
-import com.fruitshorts.framework.log.AccessDeniedRecorder;
-import com.fruitshorts.framework.web.GlobalExceptionHandler;
-import org.mockito.Mockito;
-import org.springframework.beans.factory.ObjectProvider;
-import org.springframework.test.web.servlet.MockMvc;
-import org.springframework.test.web.servlet.setup.MockMvcBuilders;
-
-/**
- * 控制器契约测试的公共装配：真控制器 + 真全局异常处理器 + 真校验器，**不启 Spring 容器**。
- *
- * <p>为什么不用 {@code @WebMvcTest}：{@code AppApiApplication} 上挂着
- * {@code @MapperScan("com.fruitshorts.**.dal.mapper")}，而切片测试不装配 DataSource / MyBatis，
- * 扫描出的 Mapper 工厂会因为缺少 {@code SqlSessionFactory} 直接报错；要绕开就得再加一套测试专用的
- * 引导配置。这里的 standaloneSetup 同样只装 Web 层（路由、参数绑定、消息转换、异常处理），
- * 覆盖面不变而更轻、更稳。
- */
-public final class ControllerContractSupport {
-
-    private ControllerContractSupport() {
-    }
-
-    /** 组装一个只含指定控制器与全局异常处理的 MockMvc。 */
-    @SuppressWarnings("unchecked")
-    public static MockMvc mockMvcOf(Object controller) {
-        AccessDeniedRecorder recorder = new AccessDeniedRecorder(Mockito.mock(ObjectProvider.class));
-        return MockMvcBuilders.standaloneSetup(controller)
-                .setControllerAdvice(new GlobalExceptionHandler(recorder))
-                .build();
-    }
-}

fruitshorts-framework/pom.xml

@@ -66,5 +66,19 @@
             <groupId>org.springdoc</groupId>
             <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
         </dependency>
+
+        <!-- 监控：暴露 actuator 指标供 Prometheus 抓取 -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-actuator</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.micrometer</groupId>
+            <artifactId>micrometer-registry-prometheus</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-data-redis</artifactId>
+        </dependency>
     </dependencies>
 </project>

fruitshorts-framework/src/main/java/com/fruitshorts/framework/compliance/ComplianceNotice.java

@@ -0,0 +1,27 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.framework.compliance;
+
+/**
+ * 平台合规声明（法律红线，不可删除或修改）。
+ *
+ * <p>本软件「水果短剧（FruitShorts）」为正规短剧平台，仅用于承载、分发符合法律法规
+ * 与公序良俗的短剧内容。平台严禁且不提供任何用于上传、传播、存储色情、淫秽、露骨或
+ * 违法犯罪内容的功能。任何运营方利用本软件从事违法犯罪行为的，其法律责任由运营方独立
+ * 承担，与开发者无任何法律关系。
+ */
+public final class ComplianceNotice {
+
+    private ComplianceNotice() {
+    }
+
+    /** 平台定位与合法用途声明。 */
+    public static final String PLATFORM_STATEMENT =
+            "水果短剧（FruitShorts）为正规短剧平台，仅用于合法合规的短剧内容运营，"
+                    + "严禁用于任何违法犯罪活动或色情、淫秽、露骨内容的传播。";
+
+    /** 内容合规红线：用户生成内容发布前必须通过敏感词自动检查。 */
+    public static final String CONTENT_RED_LINE =
+            "所有用户生成内容必须通过敏感词自动检查（BLOCK 级直接拦截），"
+                    + "命中待审词必须进入人工审核，禁止任何违规内容上线。";
+}

fruitshorts-framework/src/main/java/com/fruitshorts/framework/compliance/ContentModerationService.java

@@ -0,0 +1,31 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.framework.compliance;
+
+/**
+ * 图片/视频内容审核抽象（露骨内容、违规画面检测）。
+ * 第一阶段默认未接入第三方，接入时新增实现类即可，业务侧不感知。
+ */
+public interface ContentModerationService {
+
+    /** 审核结论：通过 / 拦截 / 转人工。 */
+    enum Verdict {
+        PASS, BLOCK, REVIEW
+    }
+
+    /**
+     * 审核图片。
+     *
+     * @param imageUrl 图片地址
+     * @return 审核结论
+     */
+    Verdict checkImage(String imageUrl);
+
+    /**
+     * 审核视频（实现方负责抽帧）。
+     *
+     * @param videoUrl 视频地址
+     * @return 审核结论
+     */
+    Verdict checkVideo(String videoUrl);
+}

fruitshorts-framework/src/main/java/com/fruitshorts/framework/compliance/DisabledContentModeration.java

@@ -0,0 +1,20 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.framework.compliance;
+
+/**
+ * 默认内容审核实现：未配置第三方审核服务时一律放行，交由运营方人工审核兜底。
+ * 接入第三方（如阿里云内容安全 / Google Cloud Vision SafeSearch）后新增实现类并替换装配。
+ */
+public class DisabledContentModeration implements ContentModerationService {
+
+    @Override
+    public Verdict checkImage(String imageUrl) {
+        return Verdict.PASS;
+    }
+
+    @Override
+    public Verdict checkVideo(String videoUrl) {
+        return Verdict.PASS;
+    }
+}

fruitshorts-framework/src/main/java/com/fruitshorts/framework/redis/RateLimit.java

@@ -0,0 +1,25 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.framework.redis;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+/**
+ * 接口级固定窗口限流。基于 Redis INCR，key 按客户端 IP 维度隔离。
+ */
+@Target(ElementType.METHOD)
+@Retention(RetentionPolicy.RUNTIME)
+public @interface RateLimit {
+
+    /** 窗口内允许的最大请求次数。 */
+    int limit() default 10;
+
+    /** 窗口时长（秒）。 */
+    int windowSeconds() default 60;
+
+    /** 限流维度前缀，默认取方法名。 */
+    String key() default "";
+}

fruitshorts-framework/src/main/java/com/fruitshorts/framework/redis/RateLimitAspect.java

@@ -0,0 +1,54 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.framework.redis;
+
+import com.fruitshorts.common.exception.ErrorCode;
+import com.fruitshorts.common.exception.ServiceException;
+import jakarta.servlet.http.HttpServletRequest;
+import lombok.RequiredArgsConstructor;
+import org.aspectj.lang.annotation.Aspect;
+import org.aspectj.lang.annotation.Before;
+import org.springframework.stereotype.Component;
+import org.springframework.web.context.request.RequestContextHolder;
+import org.springframework.web.context.request.ServletRequestAttributes;
+
+import java.time.Duration;
+
+/**
+ * 固定窗口限流切面：每次命中注解先 INCR，超阈值即拒绝。
+ */
+@Aspect
+@Component
+@RequiredArgsConstructor
+public class RateLimitAspect {
+
+    private final RedisService redisService;
+
+    @Before("@annotation(rateLimit)")
+    public void check(RateLimit rateLimit) {
+        long count = redisService.increment(
+                buildKey(rateLimit), Duration.ofSeconds(rateLimit.windowSeconds()));
+        if (count > rateLimit.limit()) {
+            throw new ServiceException(ErrorCode.TOO_MANY_REQUESTS, "请求过于频繁，请稍后再试");
+        }
+    }
+
+    private String buildKey(RateLimit rateLimit) {
+        String scope = rateLimit.key().isBlank() ? "default" : rateLimit.key();
+        return "rate:" + scope + ":" + clientIp();
+    }
+
+    private String clientIp() {
+        ServletRequestAttributes attrs =
+                (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
+        if (attrs == null) {
+            return "unknown";
+        }
+        HttpServletRequest request = attrs.getRequest();
+        String forwarded = request.getHeader("X-Forwarded-For");
+        if (forwarded != null && !forwarded.isBlank()) {
+            return forwarded.split(",")[0].trim();
+        }
+        return request.getRemoteAddr();
+    }
+}

fruitshorts-framework/src/main/java/com/fruitshorts/framework/redis/RedisService.java

@@ -0,0 +1,45 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.framework.redis;
+
+import lombok.RequiredArgsConstructor;
+import org.springframework.data.redis.core.StringRedisTemplate;
+import org.springframework.stereotype.Component;
+
+import java.time.Duration;
+
+/**
+ * Redis 字符串操作封装，供缓存与限流复用。
+ * 统一在这里兜底过期策略，业务侧不直接接触 RedisTemplate。
+ */
+@Component
+@RequiredArgsConstructor
+public class RedisService {
+
+    private final StringRedisTemplate redisTemplate;
+
+    public void set(String key, String value, Duration ttl) {
+        redisTemplate.opsForValue().set(key, value, ttl);
+    }
+
+    public String get(String key) {
+        return redisTemplate.opsForValue().get(key);
+    }
+
+    public void delete(String key) {
+        redisTemplate.delete(key);
+    }
+
+    /**
+     * 固定窗口计数：自增并保证首次写入时设置过期时间。
+     * 用于接口限流，返回当前窗口内的累计次数。
+     */
+    public long increment(String key, Duration window) {
+        Long count = redisTemplate.opsForValue().increment(key);
+        long value = count == null ? 1 : count;
+        if (value == 1) {
+            redisTemplate.expire(key, window);
+        }
+        return value;
+    }
+}

fruitshorts-framework/src/main/java/com/fruitshorts/framework/security/SecurityConfig.java

@@ -41,6 +41,8 @@ public class SecurityConfig {
             "/app/dramas/**",
             "/app/episodes/*/play",
             "/app/config/**",
+            /* 埋点上报：游客浏览也要记录，匿名可访问 */
+            "/app/events",
             /* 媒资：封面与视频用 <img>/<video> 直接访问，无法带请求头。
                片源的防盗链由 fruitshorts.media.signature-required 控制。 */
             "/files/**",
@@ -48,7 +50,8 @@ public class SecurityConfig {
             "/swagger-ui/**",
             "/swagger-ui.html",
             "/v3/api-docs/**",
-            "/actuator/health"
+            "/actuator/health",
+            "/actuator/prometheus"
     };
 
     private final JwtAuthenticationFilter jwtAuthenticationFilter;

fruitshorts-module-commerce/pom.xml

@@ -34,5 +34,16 @@
             <groupId>com.fruitshorts</groupId>
             <artifactId>fruitshorts-module-playback</artifactId>
         </dependency>
+        <!-- Google Play Billing 票据校验 -->
+        <dependency>
+            <groupId>com.google.apis</groupId>
+            <artifactId>google-api-services-androidpublisher</artifactId>
+            <version>v3-rev20231030-2.0.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.google.auth</groupId>
+            <artifactId>google-auth-library-oauth2-http</artifactId>
+            <version>1.23.0</version>
+        </dependency>
     </dependencies>
 </project>

fruitshorts-module-commerce/src/main/java/com/fruitshorts/commerce/service/DisabledStoreVerifier.java

@@ -4,17 +4,22 @@ package com.fruitshorts.commerce.service;
 
 import com.fruitshorts.common.exception.ErrorCode;
 import com.fruitshorts.common.exception.ServiceException;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.stereotype.Component;
 
 /**
  * 未接入商店时的默认实现：明确报"未配置"，而不是静默放行或假装成功。
  * 这样客户端拿到的是可理解的业务提示，也不会产生假订单。
+ *
+ * Google Play 校验启用后（fruitshorts.pay.google.enabled=true）自动失效。
  */
 @Component
+@ConditionalOnProperty(name = "fruitshorts.pay.google.enabled", havingValue = "false",
+        matchIfMissing = true)
 public class DisabledStoreVerifier implements StoreVerifier {
 
     @Override
-    public StoreReceiptResult verify(String platform, String receipt) {
+    public StoreReceiptResult verify(String platform, String productId, String receipt) {
         throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED,
                 "Apple / Google 商店校验尚未配置，第一阶段仅预留接口");
     }

fruitshorts-module-commerce/src/main/java/com/fruitshorts/commerce/service/GooglePlayVerifier.java

@@ -0,0 +1,85 @@
+// Author: fruit.com.cn
+
+package com.fruitshorts.commerce.service;
+
+import com.google.api.client.googleapis.javanet.GoogleNetHttpTransport;
+import com.google.api.client.json.gson.GsonFactory;
+import com.google.api.services.androidpublisher.AndroidPublisher;
+import com.google.api.services.androidpublisher.model.ProductPurchase;
+import com.google.auth.http.HttpCredentialsAdapter;
+import com.google.auth.oauth2.GoogleCredentials;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
+import org.springframework.stereotype.Component;
+
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+
+/**
+ * Google Play Billing 票据校验（B1）。
+ *
+ * 通过 Google Play Developer API 的 purchases.products.get 二次校验购买票据，
+ * 不信任客户端上报。凭证（服务账号 JSON）与包名通过配置注入，未启用时走
+ * DisabledStoreVerifier。
+ */
+@Slf4j
+@Component
+@ConditionalOnProperty(name = "fruitshorts.pay.google.enabled", havingValue = "true")
+public class GooglePlayVerifier implements StoreVerifier {
+
+    private static final String SCOPE = "https://www.googleapis.com/auth/androidpublisher";
+
+    private final String packageName;
+    private final AndroidPublisher publisher;
+
+    public GooglePlayVerifier(
+            @Value("${fruitshorts.pay.google.package-name:}") String packageName,
+            @Value("${fruitshorts.pay.google.service-account-json:}") String serviceAccountJson) {
+        this.packageName = packageName;
+        this.publisher = buildPublisher(serviceAccountJson);
+    }
+
+    @Override
+    public StoreReceiptResult verify(String platform, String productId, String receipt) {
+        if (!"GOOGLE".equalsIgnoreCase(platform)) {
+            return StoreReceiptResult.failed("不支持的平台：" + platform);
+        }
+        try {
+            AndroidPublisher.Purchases.Products.Get get =
+                    publisher.purchases().products().get(packageName, productId, receipt);
+            ProductPurchase purchase = get.execute();
+            Integer purchaseState = purchase.getPurchaseState();
+            // 0 = 已购买；1 = 已取消；2 = 待处理
+            if (purchaseState == null || purchaseState != 0) {
+                return StoreReceiptResult.failed("购买状态异常：purchaseState=" + purchaseState);
+            }
+            String orderId = purchase.getOrderId();
+            if (orderId == null || orderId.isEmpty()) {
+                return StoreReceiptResult.failed("票据缺少订单号");
+            }
+            return new StoreReceiptResult(true, orderId, orderId, productId, "ok");
+        } catch (Exception e) {
+            log.warn("Google Play 票据校验失败：{}", e.getMessage());
+            return StoreReceiptResult.failed("票据校验失败：" + e.getMessage());
+        }
+    }
+
+    private AndroidPublisher buildPublisher(String serviceAccountJson) {
+        try {
+            GoogleCredentials credentials = GoogleCredentials.fromStream(
+                    new ByteArrayInputStream(
+                            serviceAccountJson.getBytes(StandardCharsets.UTF_8)))
+                    .createScoped(SCOPE);
+            return new AndroidPublisher.Builder(
+                    GoogleNetHttpTransport.newTrustedTransport(),
+                    GsonFactory.getDefaultInstance(),
+                    new HttpCredentialsAdapter(credentials))
+                    .setApplicationName("FruitShorts")
+                    .build();
+        } catch (Exception e) {
+            throw new IllegalStateException(
+                    "初始化 Google Play 校验失败：" + e.getMessage(), e);
+        }
+    }
+}

fruitshorts-module-commerce/src/main/java/com/fruitshorts/commerce/service/OrderService.java

@@ -85,8 +85,8 @@ public class OrderService {
      * 宁可不收钱，也不能在支付链路上给出"看起来成功"的假象。
      */
     @Transactional(rollbackFor = Exception.class)
-    public Orders verifyAndDeliver(Long userId, String platform, String receipt) {
-        StoreVerifier.StoreReceiptResult result = storeVerifier.verify(platform, receipt);
+    public Orders verifyAndDeliver(Long userId, String platform, String productId, String receipt) {
+        StoreVerifier.StoreReceiptResult result = storeVerifier.verify(platform, productId, receipt);
         if (!result.ok()) {
             throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, result.message());
         }

fruitshorts-module-commerce/src/main/java/com/fruitshorts/commerce/service/StoreVerifier.java

@@ -11,7 +11,14 @@ package com.fruitshorts.commerce.service;
  */
 public interface StoreVerifier {
 
-    StoreReceiptResult verify(String platform, String receipt);
+    /**
+     * 校验商店票据。
+     *
+     * @param platform 平台标识（GOOGLE / APPLE）
+     * @param productId 商品 ID（Google Play 校验必需，Apple 可为空）
+     * @param receipt 票据：Google 为 purchaseToken，Apple 为 receipt data
+     */
+    StoreReceiptResult verify(String platform, String productId, String receipt);
 
     /** 校验结果。ok=false 时 message 说明原因，用于人工排查。 */
     record StoreReceiptResult(boolean ok, String transactionId, String originalTransactionId,

fruitshorts-module-commerce/src/main/java/com/fruitshorts/commerce/vo/CoinAdjustReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.commerce.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotNull;
 import lombok.Data;
 
@@ -9,15 +10,19 @@ import lombok.Data;
 @Data
 public class CoinAdjustReqVO {
 
+    @Schema(description = "用户ID")
     @NotNull(message = "缺少 userId")
     private Long userId;
 
     /** 正数补发、负数扣回 */
+    @Schema(description = "变动金额（正数补发、负数扣回）")
     @NotNull(message = "缺少变动金额")
     private Long amount;
 
+    @Schema(description = "备注")
     private String remark;
 
     /** 幂等键：同一个工单重复提交只生效一次 */
+    @Schema(description = "幂等键")
     private String idempotentKey;
 }

fruitshorts-module-commerce/src/main/java/com/fruitshorts/commerce/vo/EntitlementGrantReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.commerce.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotNull;
 import lombok.Data;
 
@@ -9,17 +10,22 @@ import lombok.Data;
 @Data
 public class EntitlementGrantReqVO {
 
+    @Schema(description = "用户ID")
     @NotNull(message = "缺少 userId")
     private Long userId;
 
+    @Schema(description = "短剧ID")
     @NotNull(message = "缺少 dramaId")
     private Long dramaId;
 
     /** 传 0 表示整剧权益 */
+    @Schema(description = "剧集ID（传 0 表示整剧权益）")
     private Long episodeId;
 
     /** EPISODE/DRAMA */
+    @Schema(description = "权益类型（EPISODE/DRAMA）")
     private String type = "EPISODE";
 
+    @Schema(description = "原因")
     private String reason;
 }

fruitshorts-module-commerce/src/main/java/com/fruitshorts/commerce/vo/OrderQueryReqVO.java

@@ -2,17 +2,29 @@
 
 package com.fruitshorts.commerce.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 /** 后台订单检索条件。 */
 @Data
 public class OrderQueryReqVO {
 
+    @Schema(description = "用户ID")
     private Long userId;
+
+    @Schema(description = "订单号")
     private String orderNo;
+
     /** CREATED/PAID/DELIVERED/REFUNDED/CLOSED */
+    @Schema(description = "状态（CREATED/PAID/DELIVERED/REFUNDED/CLOSED）")
     private String status;
+
+    @Schema(description = "平台")
     private String platform;
+
+    @Schema(description = "页码")
     private Integer pageIndex = 1;
+
+    @Schema(description = "每页数量")
     private Integer pageSize = 10;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/BannerRespVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import com.fasterxml.jackson.annotation.JsonFormat;
 import lombok.Data;
 
@@ -10,19 +11,31 @@ import java.time.LocalDateTime;
 @Data
 public class BannerRespVO {
 
+    @Schema(description = "轮播图 ID")
     private Long id;
+    @Schema(description = "图片地址")
     private String imageUrl;
+    @Schema(description = "展示位置")
     private String position;
+    @Schema(description = "展示位置文本")
     private String positionText;
+    @Schema(description = "跳转类型")
     private String linkType;
+    @Schema(description = "跳转类型文本")
     private String linkTypeText;
+    @Schema(description = "跳转目标")
     private String linkValue;
     /** 跳转目标的展示文案，如短剧名称 */
+    @Schema(description = "跳转目标文案")
     private String linkText;
+    @Schema(description = "排序")
     private Integer sort;
+    @Schema(description = "状态")
     private Integer status;
+    @Schema(description = "状态文本")
     private String statusText;
 
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    @Schema(description = "更新时间")
     private LocalDateTime updatedAt;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/BannerSaveReqVO.java

@@ -2,23 +2,30 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 @Data
 public class BannerSaveReqVO {
 
     @jakarta.validation.constraints.NotBlank(message = "请上传轮播图片")
+    @Schema(description = "轮播图片地址")
     private String imageUrl;
 
     /** HOME_TOP / DISCOVER */
+    @Schema(description = "展示位置")
     private String position;
 
     /** NONE / DRAMA / URL */
+    @Schema(description = "跳转类型")
     private String linkType;
 
     /** 剧集 ID 或跳转地址 */
+    @Schema(description = "跳转目标")
     private String linkValue;
 
+    @Schema(description = "排序")
     private Integer sort;
+    @Schema(description = "状态")
     private Integer status;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/DramaCategoryRespVO.java

@@ -2,15 +2,21 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 @Data
 public class DramaCategoryRespVO {
 
+    @Schema(description = "分类 ID")
     private Long id;
+    @Schema(description = "分类名称")
     private String name;
+    @Schema(description = "排序")
     private Integer sort;
+    @Schema(description = "状态")
     private Integer status;
     /** 该类型下的短剧数量 */
+    @Schema(description = "短剧数量")
     private Integer dramaCount;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/DramaCategorySaveReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotBlank;
 import lombok.Data;
 
@@ -9,8 +10,11 @@ import lombok.Data;
 public class DramaCategorySaveReqVO {
 
     @NotBlank(message = "请填写类型名称")
+    @Schema(description = "类型名称")
     private String name;
 
+    @Schema(description = "排序")
     private Integer sort;
+    @Schema(description = "状态")
     private Integer status;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/DramaPageReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import com.fruitshorts.common.pojo.PageParam;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
@@ -11,9 +12,13 @@ import lombok.EqualsAndHashCode;
 public class DramaPageReqVO extends PageParam {
 
     /** 标题关键字 */
+    @Schema(description = "标题关键字")
     private String keyword;
+    @Schema(description = "状态")
     private String status;
+    @Schema(description = "分类 ID")
     private Long categoryId;
     /** 是否只看热门 */
+    @Schema(description = "是否热门")
     private Boolean isHot;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/DramaRespVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import com.fasterxml.jackson.annotation.JsonFormat;
 import lombok.Data;
 
@@ -13,33 +14,55 @@ import java.time.LocalDateTime;
 @Data
 public class DramaRespVO {
 
+    @Schema(description = "短剧 ID")
     private Long id;
+    @Schema(description = "编码")
     private String code;
+    @Schema(description = "标题")
     private String title;
+    @Schema(description = "副标题")
     private String subtitle;
+    @Schema(description = "分类 ID")
     private Long categoryId;
+    @Schema(description = "分类名称")
     private String category;
+    @Schema(description = "题材")
     private String genre;
+    @Schema(description = "简介")
     private String description;
+    @Schema(description = "封面地址")
     private String cover;
     /** 整剧预告片地址 */
+    @Schema(description = "预告片地址")
     private String trailerUrl;
+    @Schema(description = "语言")
     private String language;
+    @Schema(description = "总集数")
     private Integer episodes;
+    @Schema(description = "免费集数")
     private Integer freeEpisodes;
+    @Schema(description = "解锁金币")
     private Integer unlockCoin;
+    @Schema(description = "是否热门")
     private Boolean isHot;
+    @Schema(description = "状态")
     private String status;
+    @Schema(description = "状态文本")
     private String statusText;
+    @Schema(description = "播放量")
     private Long views;
+    @Schema(description = "排序")
     private Integer sort;
 
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    @Schema(description = "发布时间")
     private LocalDateTime publishAt;
 
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    @Schema(description = "创建时间")
     private LocalDateTime createdAt;
 
     @JsonFormat(pattern = "yyyy-MM-dd HH:mm:ss")
+    @Schema(description = "更新时间")
     private LocalDateTime updatedAt;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/DramaSaveReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotBlank;
 import lombok.Data;
 
@@ -9,19 +10,31 @@ import lombok.Data;
 public class DramaSaveReqVO {
 
     @NotBlank(message = "请填写短剧名称")
+    @Schema(description = "短剧名称")
     private String title;
 
+    @Schema(description = "副标题")
     private String subtitle;
+    @Schema(description = "分类 ID")
     private Long categoryId;
+    @Schema(description = "题材")
     private String genre;
+    @Schema(description = "简介")
     private String description;
+    @Schema(description = "封面地址")
     private String cover;
     /** 整剧预告片地址（复用已有的 drama.trailer_url 列） */
+    @Schema(description = "预告片地址")
     private String trailerUrl;
+    @Schema(description = "语言")
     private String language;
+    @Schema(description = "免费集数")
     private Integer freeEpisodes;
+    @Schema(description = "解锁金币")
     private Integer unlockCoin;
     /** 是否热门 */
+    @Schema(description = "是否热门")
     private Boolean isHot;
+    @Schema(description = "排序")
     private Integer sort;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/DramaStatusReqVO.java

@@ -2,11 +2,13 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 @Data
 public class DramaStatusReqVO {
 
     /** 驳回原因，其他动作可空 */
+    @Schema(description = "驳回原因")
     private String reason;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/EpisodeRespVO.java

@@ -2,24 +2,39 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 @Data
 public class EpisodeRespVO {
 
+    @Schema(description = "剧集 ID")
     private Long id;
+    @Schema(description = "短剧 ID")
     private Long dramaId;
+    @Schema(description = "集号")
     private Integer number;
+    @Schema(description = "标题")
     private String title;
     /** 展示用时长，mm:ss */
+    @Schema(description = "展示时长（mm:ss）")
     private String duration;
+    @Schema(description = "时长（秒）")
     private Integer durationSec;
+    @Schema(description = "封面地址")
     private String cover;
+    @Schema(description = "视频地址")
     private String videoUrl;
+    @Schema(description = "是否免费")
     private Boolean isFree;
+    @Schema(description = "解锁金币")
     private Integer unlockCoin;
+    @Schema(description = "状态")
     private String status;
+    @Schema(description = "状态文本")
     private String statusText;
+    @Schema(description = "播放量")
     private Long views;
+    @Schema(description = "排序")
     private Integer sort;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/EpisodeSaveReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotNull;
 import lombok.Data;
 
@@ -9,17 +10,27 @@ import lombok.Data;
 public class EpisodeSaveReqVO {
 
     @NotNull(message = "请选择所属短剧")
+    @Schema(description = "短剧 ID")
     private Long dramaId;
 
     @NotNull(message = "请填写集号")
+    @Schema(description = "集号")
     private Integer number;
 
+    @Schema(description = "标题")
     private String title;
+    @Schema(description = "时长（秒）")
     private Integer durationSec;
+    @Schema(description = "封面地址")
     private String cover;
+    @Schema(description = "视频地址")
     private String videoUrl;
+    @Schema(description = "是否免费")
     private Boolean isFree;
+    @Schema(description = "解锁金币")
     private Integer unlockCoin;
+    @Schema(description = "状态")
     private String status;
+    @Schema(description = "排序")
     private Integer sort;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/EpisodeSortReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import jakarta.validation.constraints.NotEmpty;
 import lombok.Data;
 
@@ -11,5 +12,6 @@ import java.util.List;
 public class EpisodeSortReqVO {
 
     @NotEmpty(message = "请提供排序后的剧集 ID 列表")
+    @Schema(description = "排序后的剧集 ID 列表")
     private List<Long> ids;
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/PriceRespVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 import java.util.List;
@@ -10,24 +11,36 @@ import java.util.List;
 @Data
 public class PriceRespVO {
 
+    @Schema(description = "短剧 ID")
     private Long dramaId;
+    @Schema(description = "免费集数")
     private Integer freeEpisodes;
+    @Schema(description = "解锁金币")
     private Integer unlockCoin;
     /** 该剧剧集总数 */
+    @Schema(description = "剧集总数")
     private Integer episodeCount;
     /** 本次实际发生变化的剧集数 */
+    @Schema(description = "本次变更剧集数")
     private Integer changedCount;
     /** 剧集明细：后台定价页要按集展示当前价格与免费状态 */
+    @Schema(description = "剧集明细")
     private List<DramaEpisodePriceVO> episodes;
 
     @Data
     public static class DramaEpisodePriceVO {
+        @Schema(description = "剧集 ID")
         private Long episodeId;
+        @Schema(description = "集号")
         private Integer number;
+        @Schema(description = "标题")
         private String title;
+        @Schema(description = "是否免费")
         private Boolean free;
+        @Schema(description = "解锁金币")
         private Integer unlockCoin;
         /** 试看秒数，0 = 不限制 */
+        @Schema(description = "试看秒数")
         private Integer previewSeconds;
     }
 }

fruitshorts-module-content/src/main/java/com/fruitshorts/content/vo/PriceSaveReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.content.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 import java.util.List;
@@ -10,21 +11,29 @@ import java.util.List;
 @Data
 public class PriceSaveReqVO {
 
+    @Schema(description = "短剧 ID")
     private Long dramaId;
     /** 整剧免费集数：前 N 集免费，其余按 unlockCoin 收费 */
+    @Schema(description = "整剧免费集数")
     private Integer freeEpisodes;
     /** 整剧默认解锁金币（逐集未单独指定时生效） */
+    @Schema(description = "整剧默认解锁金币")
     private Integer unlockCoin;
     /** 逐集覆盖，可空；列表里的集优先于整剧默认值 */
+    @Schema(description = "逐集覆盖配置")
     private List<EpisodePrice> episodes;
 
     @Data
     public static class EpisodePrice {
+        @Schema(description = "剧集 ID")
         private Long episodeId;
         /** 1 免费 / 0 收费 */
+        @Schema(description = "是否免费")
         private Integer isFree;
+        @Schema(description = "解锁金币")
         private Integer unlockCoin;
         /** 试看秒数：0 = 不限制（复用 drama_episode.preview_seconds，播放接口已经在下发这个字段） */
+        @Schema(description = "试看秒数")
         private Integer previewSeconds;
     }
 }

fruitshorts-module-creator/pom.xml

@@ -39,5 +39,10 @@
             <groupId>com.fruitshorts</groupId>
             <artifactId>fruitshorts-module-system</artifactId>
         </dependency>
+        <!-- 提交审核前做敏感词自动检查（词库在互动域），拦截违规标题/描述 -->
+        <dependency>
+            <groupId>com.fruitshorts</groupId>
+            <artifactId>fruitshorts-module-interaction</artifactId>
+        </dependency>
     </dependencies>
 </project>

fruitshorts-module-creator/src/main/java/com/fruitshorts/creator/service/ContentSubmissionService.java

@@ -12,6 +12,9 @@ import com.fruitshorts.content.dal.entity.Drama;
 import com.fruitshorts.content.enums.ContentStatus;
 import com.fruitshorts.content.service.DramaService;
 import com.fruitshorts.content.service.EpisodeService;
+import com.fruitshorts.content.vo.EpisodeRespVO;
+import com.fruitshorts.interaction.service.SensitiveWordCheck;
+import com.fruitshorts.interaction.service.SensitiveWordService;
 import com.fruitshorts.creator.dal.entity.ContentSubmission;
 import com.fruitshorts.creator.dal.entity.Creator;
 import com.fruitshorts.creator.dal.mapper.ContentSubmissionMapper;
@@ -52,6 +55,7 @@ public class ContentSubmissionService {
     private final ContentSubmissionMapper submissionMapper;
     private final DramaService dramaService;
     private final EpisodeService episodeService;
+    private final SensitiveWordService sensitiveWordService;
 
     public PageResult<ContentSubmission> page(SubmissionQueryReqVO req) {
         Page<ContentSubmission> page = new Page<>(req.getSafePageIndex(), req.getSafePageSize());
@@ -90,6 +94,7 @@ public class ContentSubmissionService {
         if (!Objects.equals(drama.getCreatorId(), creator.getId())) {
             throw new ServiceException(ErrorCode.FORBIDDEN, "无权访问该作品");
         }
+        checkContentSensitive(drama);
         if (!Set.of(TYPE_CREATE, TYPE_UPDATE, TYPE_PUBLISH, TYPE_OFFLINE).contains(type)) {
             throw new ServiceException(ErrorCode.BAD_REQUEST, "未知的提交类型: " + type);
         }
@@ -166,6 +171,30 @@ public class ContentSubmissionService {
         return submission;
     }
 
+    /**
+     * 提交审核前的敏感词自动检查：命中禁止词（BLOCK）直接拦截，命中待审词（REVIEW）仍放行交由人工复核。
+     * 覆盖标题、副标题、简介、标签与全部分集标题。
+     */
+    private void checkContentSensitive(Drama drama) {
+        checkText(drama.getTitle(), "标题");
+        checkText(drama.getSubtitle(), "副标题");
+        checkText(drama.getSynopsis(), "简介");
+        checkText(drama.getTags(), "标签");
+        for (EpisodeRespVO ep : episodeService.listByDrama(drama.getId(), null)) {
+            checkText(ep.getTitle(), "分集标题");
+        }
+    }
+
+    private void checkText(String text, String field) {
+        if (!StringUtils.hasText(text)) {
+            return;
+        }
+        SensitiveWordCheck check = sensitiveWordService.check(text);
+        if (check.blocked()) {
+            throw new ServiceException(ErrorCode.OPERATION_NOT_ALLOWED, field + check.reason());
+        }
+    }
+
     /**
      * 创作者撤回自己的提交（撤回重提）。
      * 只有还没出结果的提交能撤回；撤回后短剧退回草稿，创作者可以继续改。

fruitshorts-module-creator/src/main/java/com/fruitshorts/creator/vo/CreatorAccountOpenReqVO.java

@@ -2,6 +2,7 @@
 
 package com.fruitshorts.creator.vo;
 
+import io.swagger.v3.oas.annotations.media.Schema;
 import lombok.Data;
 
 /** 开通创作者账号：用户名默认取 creator.code 小写，可用这个字段覆盖。 */
@@ -9,5 +10,6 @@ import lombok.Data;
 public class CreatorAccountOpenReqVO {
 
     /** 覆盖默认登录名；留空则用 creator.code 的小写形式 */
+    @Schema(description = "覆盖默认登录名（留空则用 creator.code 的小写形式）")
     private String username;
 }