fix: 云函数鉴权加固与投票数据防护

- follow/cms-vote/cms-articles-like/cms-articles-collect 云对象写操作强制 checkToken,uid 以服务端令牌为准,杜绝客户端伪造身份
- user-info.getIP 仅允许查询本人登录 IP(get_user_info 公开资料保持不变)
- ext-storage-co 上传凭证需登录,删除文件仅限 admin 角色(原为完全裸奔)
- cms-vote/cms-vote-info/user_select_vote 三表 schema 写权限全部关闭(投票读写均走云对象)
- 修复 follow.reFollow 中 total<0 永假导致的逻辑错误
- 各云对象 package.json 补 uni-id-common 依赖声明
- main.js 登录过期跳转修正为实际页面路径 /pages/login/login

uniCloud-alipay/cloudfunctions/follow/index.obj.js

@@ -1,8 +1,11 @@
 const db = uniCloud.database();
 const _ = db.command;
+const uniID = require('uni-id-common');
 module.exports = {
 	_before: function () { // 通用预处理器
-
+		this.uniID = uniID.createInstance({
+			context: this.getClientInfo()
+		});
 	},
 	async getIsFollow(query) {
 		try {
@@ -35,10 +38,10 @@ module.exports = {
 	},
 	async follow(query) {
 		try {
-			const {
-				uid,
-				fid
-			} = query;
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+			const uid = payload.uid; // 以服务端令牌为准，忽略客户端传入
+			const fid = query.fid;
 			const res = await db.collection("follow").where({
 				uid: uid,
 				fid: fid
@@ -70,15 +73,15 @@ module.exports = {
 	},
 	async reFollow(query) {
 		try {
-			const {
-				uid,
-				fid
-			} = query;
+			const payload = await this.uniID.checkToken(this.getUniIdToken());
+			if (payload.errCode) throw new Error('登录状态失效，请重新登录');
+			const uid = payload.uid; // 以服务端令牌为准，忽略客户端传入
+			const fid = query.fid;
 			const res = await db.collection("follow").where({
 				uid: uid,
 				fid: fid
 			}).count();
-			if (res.total < 0) {
+			if (res.total == 0) {
 				return {
 					code: 201,
 					msg: "未关注"