debug: security中间件+controller加JSAPI完整请求日志，定位openid缺失问题

my-uniapp-vue3/src/pages/payment-confirm/index.vue

@@ -158,7 +158,7 @@ async function handleWechatOAuth() {
       const result = await post<{ openid: string }>('/payment/wechat/openid', { code });
       openid.value = result.openid;
       localStorage.setItem('wx_openid', result.openid);
-      console.log('[WeChat Pay] openid 获取成功');
+      console.log('[WeChat Pay] openid 获取成功，自动重新发起支付');
 
       // 清除 URL 中的 code/state
       searchParams.delete('code');
@@ -167,6 +167,9 @@ async function handleWechatOAuth() {
       const newUrl = window.location.origin + window.location.pathname
         + (newSearch ? '?' + newSearch : '');
       window.history.replaceState({}, '', newUrl);
+
+      // 自动重新发起支付（不用用户再点一次）
+      setTimeout(() => handleWechatJsapiPay(), 100);
     } catch (e) {
       console.error('[WeChat Pay] 获取 openid 失败:', e);
     } finally {

server/src/middleware/security.ts

@@ -60,6 +60,16 @@ function sanitizeString(str: string): string {
 // SQL 注入防护
 export function sqlInjectionProtection() {
   return async (ctx: any, next: any) => {
+    // ===== DEBUG: 记录所有请求 =====
+    if (ctx.path?.includes('/wechat/jsapi')) {
+      console.log('[SECURITY-DEBUG] JSAPI请求到达security中间件');
+      console.log('[SECURITY-DEBUG] method:', ctx.method);
+      console.log('[SECURITY-DEBUG] path:', ctx.path);
+      console.log('[SECURITY-DEBUG] query:', JSON.stringify(ctx.request.query));
+      console.log('[SECURITY-DEBUG] body:', JSON.stringify(ctx.request.body));
+      console.log('[SECURITY-DEBUG] headers[content-type]:', ctx.request.headers['content-type']);
+    }
+
     // 检查请求参数
     const params = {
       ...ctx.request.query,
@@ -69,6 +79,7 @@ export function sqlInjectionProtection() {
     for (const key in params) {
       if (typeof params[key] === 'string') {
         if (detectSQLInjection(params[key])) {
+          console.log('[SECURITY-DEBUG] ❌ JSAPI请求被SQL注入拦截, key:', key, 'value:', params[key].substring(0, 100));
           ctx.status = 400;
           ctx.body = {
             code: 400,
@@ -79,6 +90,10 @@ export function sqlInjectionProtection() {
       }
     }
 
+    if (ctx.path?.includes('/wechat/jsapi')) {
+      console.log('[SECURITY-DEBUG] JSAPI请求通过security中间件，进入next()');
+    }
+
     await next();
   };
 }