# ============ 生产环境部署必读（避免「本地可以、线上不行」）============
# 1. 本文件必须真正生效：确认 oms.nanafa.com 的请求由「本 server 块」处理
#    - 若用 include：确保 include 的是含本 server 的 conf，且无其它 server 抢先匹配
#    - 更新后必须执行：nginx -t && nginx -s reload
# 2. /api、/Track、/rbac、/order 等 Admin 接口均由 nginx 代理到 api.nanafa.com，浏览器只访问 oms 同源
# 3. HTTPS：证书部署到服务器（勿提交 .key 到 git）
#      /etc/nginx/ssl/oms.nanafa.com.pem
#      /etc/nginx/ssl/oms.nanafa.com.key
# 4. 官网 `/` 走 Vue SPA；静态资源在 /site/；客户登录 /login；管理端 /admin
# 5. 静态资源使用 /login-assets/，勿使用 /login/ 目录名
# 6. 微信公众号服务器 URL 请使用 https://api.ideship.com/admin/apiwechat/verification
#    （生产三套：admin / itfx / track，均挂在 https://api.ideship.com/{pathbase}）
# ============================================================================

# HTTP → HTTPS
server {
    listen       80;
    server_name  oms.nanafa.com;

    return 301 https://$host$request_uri;
}

server {
    listen       443 ssl;
    http2        on;
    server_name  oms.nanafa.com;

    ssl_certificate     /etc/nginx/ssl/oms.nanafa.com.pem;
    ssl_certificate_key /etc/nginx/ssl/oms.nanafa.com.key;

    ssl_session_timeout 1d;
    ssl_session_cache shared:OMS_SSL:10m;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;

    # 启用gzip压缩
    gzip on;
    gzip_vary on;
    gzip_min_length 1024;
    gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json application/xml image/svg+xml;
    gzip_comp_level 6;
    gzip_disable "msie6";

    root /usr/share/nginx/html;

    # ============ 官网首页（Vue SPA）============
    location = / {
        try_files /index.html =200;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }

    location = /9610.html {
        try_files /9610.html =404;
        add_header Cache-Control "no-cache, no-store, must-revalidate";
    }

    # 官网仅静态资源在 /site/；首页保持在 /
    location = /site {
        return 301 /;
    }
    location = /site/ {
        return 301 /;
    }
    location = /site/index.html {
        return 301 /;
    }

    location ^~ /site/ {
        try_files $uri =404;
        expires 7d;
        add_header Cache-Control "public";
        access_log off;
    }

    location = /favicon.ico {
        try_files /favicon.png =404;
        expires 7d;
        add_header Cache-Control "public";
        access_log off;
    }

    location = /favicon.png {
        try_files /favicon.png =404;
        expires 7d;
        add_header Cache-Control "public";
        access_log off;
    }

    # ============ 客户 / 管理端登录入口 ============
    location = /login {
        try_files /index.html =200;
    }
    location = /login/ {
        try_files /index.html =200;
    }

    rewrite ^/admin/?$ /index.html last;

    location = /admin {
        try_files /index.html =200;
    }
    location = /admin/ {
        try_files /index.html =200;
    }

    # ============ API 前端路由（必须先于 /api/ 代理）============
    location ~ ^/api/(upstreamInterface|upstreamInterfaceConfig|upstreamInterfaceConfigEdit|downstreamInterface(|/newPort)|appList(|/createApplication)|requestLog|callStatistics|apiDebugger|apiTest|openApi)(/|$) {
        try_files /index.html =200;
    }

    # ============ 小红书前端路由（^~ 须比下方 /xhs/ API 更具体）============
    location ^~ /xhs/startService {
        try_files /index.html =200;
    }
    location ^~ /xhs/creation {
        try_files /index.html =200;
    }
    location ^~ /xhs/publishHistory {
        try_files /index.html =200;
    }
    location ^~ /xhs/skills {
        try_files /index.html =200;
    }
    location ^~ /xhs/humanSettings {
        try_files /index.html =200;
    }
    location ^~ /xhs/agentPair {
        try_files /index.html =200;
    }
    location = /xhs/analysis {
        try_files /index.html =200;
    }
    location = /xhs/analysis/ {
        try_files /index.html =200;
    }

    # ============ 微信 H5 / 操作页（^~ 须比下方 API 前缀更长或更具体）============
    location ^~ /wechat/register {
        try_files /index.html =200;
    }
    location ^~ /wechat/bind {
        try_files /index.html =200;
    }
    location ^~ /h5 {
        try_files /index.html =200;
    }
    location ^~ /operation/inboundScan {
        try_files /index.html =200;
    }
    location ^~ /operation/outboundScan {
        try_files /index.html =200;
    }
    location ^~ /operation/printLabel {
        try_files /index.html =200;
    }
    location ^~ /operation/parcelArrival {
        try_files /index.html =200;
    }
    location ^~ /operation/fulfillPack {
        try_files /index.html =200;
    }

    # ============ 订单前端路由（^~ 须比下方 /order/ API 正则代理更优先）============
    location ^~ /order/priceCheck {
        try_files /index.html =200;
    }
    location ^~ /order/placeOrder {
        try_files /index.html =200;
    }
    location ^~ /order/myOrders {
        try_files /index.html =200;
    }
    location ^~ /order/fulfillOrders {
        try_files /index.html =200;
    }
    location ^~ /order/waybillManage {
        try_files /index.html =200;
    }
    location ^~ /order/pickupOrder {
        try_files /index.html =200;
    }
    location ^~ /order/customs9610Order {
        try_files /index.html =200;
    }
    location ^~ /order/batchJobs {
        try_files /index.html =200;
    }
    location ^~ /order/templateMapping {
        try_files /index.html =200;
    }
    location ^~ /order/platformStore {
        try_files /index.html =200;
    }
    location ^~ /order/platformStoreOrder {
        try_files /index.html =200;
    }

    # ============ 知识库前端路由（^~ 须比下方 /kb/ API 代理更优先）============
    location ^~ /kb/category {
        try_files /index.html =200;
    }
    location ^~ /kb/article {
        try_files /index.html =200;
    }

    # ============ 仓储前端路由（^~ 须比下方 /warehouse/ API 正则代理更优先）============
    # 页面路径与 API 前缀相同者用精确匹配，避免 /warehouse/sku/list 等接口被误判为 SPA
    location = /warehouse/parcel {
        try_files /index.html =200;
    }
    location = /warehouse/inventory {
        try_files /index.html =200;
    }
    location = /warehouse/sku {
        try_files /index.html =200;
    }
    location = /warehouse/binLocation {
        try_files /index.html =200;
    }
    location ^~ /warehouse/inboundNotice {
        try_files /index.html =200;
    }

    # 采集插件确认页（/Plugin/AddPackage）；API 走 /plugin/browser/*
    location ^~ /Plugin/ {
        try_files /index.html =200;
    }

    # ============ 渠道前端路由（^~ 须比下方 /channel/ API 正则代理更优先）============
    location ^~ /channel/salesProducts { try_files /index.html =200; }
    location ^~ /channel/serviceChannels { try_files /index.html =200; }
    location ^~ /channel/priceArea { try_files /index.html =200; }
    location ^~ /channel/blacklist { try_files /index.html =200; }
    location ^~ /channel/remoteZones { try_files /index.html =200; }
    location ^~ /channel/weightRules { try_files /index.html =200; }
    location ^~ /channel/weightRounding { try_files /index.html =200; }
    location ^~ /channel/autoTrigger { try_files /index.html =200; }
    location ^~ /channel/issueTemplate { try_files /index.html =200; }
    location ^~ /channel/labelDesign { try_files /index.html =200; }
    location ^~ /channel/guide { try_files /index.html =200; }

    # ============ 系统管理前端路由（^~ 须比下方 /system/ API 正则代理更优先）============
    # 页面路径为 camelCase；API 为 kebab（如 /system/dict/list、/system/batch-email/…），勿用宽泛前缀匹配 dict
    location = /system/dict {
        try_files /index.html =200;
    }
    location = /system/warehouseAddress {
        try_files /index.html =200;
    }
    location = /system/announcement {
        try_files /index.html =200;
    }
    location ^~ /system/users {
        try_files /index.html =200;
    }
    location ^~ /system/roles {
        try_files /index.html =200;
    }
    location ^~ /system/menus {
        try_files /index.html =200;
    }
    location ^~ /system/organizations {
        try_files /index.html =200;
    }
    location ^~ /system/batchEmail {
        try_files /index.html =200;
    }
    location ^~ /system/otherConfig {
        try_files /index.html =200;
    }
    location ^~ /system/aiAssistant {
        try_files /index.html =200;
    }
    location ^~ /system/aiSkills {
        try_files /index.html =200;
    }
    location ^~ /system/mcpTools {
        try_files /index.html =200;
    }
    location ^~ /system/dataPerm/ {
        try_files /index.html =200;
    }

    # ============ 营销前端路由（^~ 须比下方 /marketing/ API 正则代理更优先）============
    location ^~ /marketing/memberLevel { try_files /index.html =200; }
    location ^~ /marketing/pointsRule { try_files /index.html =200; }
    location ^~ /marketing/pointsFlow { try_files /index.html =200; }
    location ^~ /marketing/couponTemplate { try_files /index.html =200; }
    location ^~ /marketing/couponGrant { try_files /index.html =200; }
    location ^~ /marketing/commissionRule { try_files /index.html =200; }
    location ^~ /marketing/commissionDetail { try_files /index.html =200; }
    location ^~ /marketing/commissionWithdraw { try_files /index.html =200; }
    location ^~ /marketing/referralTree { try_files /index.html =200; }

    # ============ 微信公众号服务器回调（admin API，非 itfx）============
    location ^~ /api/apiwechat/ {
        rewrite ^/api/apiwechat/(.*)$ /admin/apiwechat/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    # ============ API 代理（仅真实后端接口，同源请求避免跨域 405）============
    location ~ ^/api/ {
        rewrite ^/api/(.*)$ /itfx/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    location ^~ /Track {
        rewrite ^/Track(.*)$ /track/Track$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 30s;
    }

    # ============ Admin API 同源反代（/rbac /order /xhs … → api.nanafa.com/admin）============
    location ~ ^/(rbac|order|monitor|customer|recharge|channel|system|warehouse|plugin|marketing|kb)/ {
        rewrite ^/(.*)$ /admin/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 120s;
    }

    location ^~ /wechat/ {
        rewrite ^/(.*)$ /admin/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 120s;
    }

    location ^~ /operation/ {
        rewrite ^/(.*)$ /admin/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 120s;
    }

    location ^~ /xhs/ {
        rewrite ^/(.*)$ /admin/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 300s;
    }

    location ^~ /uploads/ {
        rewrite ^/(.*)$ /admin/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 120s;
    }

    location ^~ /mcp/ {
        rewrite ^/(.*)$ /admin/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 300s;
    }

    location ^~ /ai/ {
        rewrite ^/(.*)$ /admin/$1 break;
        proxy_pass http://api.nanafa.com;
        proxy_http_version 1.1;
        proxy_set_header Host api.nanafa.com;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_connect_timeout 30s;
        proxy_send_timeout 30s;
        proxy_read_timeout 300s;
    }

    # HTML 不缓存
    location = /index.html {
        add_header Cache-Control "no-cache, no-store, must-revalidate";
        add_header Pragma "no-cache";
        add_header Expires "0";
    }

    # 微信 JS 安全域名校验：原样返回 txt，禁止 SPA 回落 index.html
    location ~* ^/MP_verify_[A-Za-z0-9]+\.txt$ {
        default_type text/plain;
        charset off;
        add_header Cache-Control "no-store";
        try_files $uri =404;
    }

    # ============ 静态资源缓存 ============

    location ~* \.(?:js|css)$ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ~* \.(?:jpg|jpeg|png|gif|ico|svg|webp|avif)$ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ~* \.(?:woff2?|ttf|eot|otf)$ {
        try_files $uri =404;
        expires 1y;
        add_header Cache-Control "public, immutable";
        access_log off;
    }

    location ~* \.(?:pdf|zip|tar|gz|br)$ {
        try_files $uri =404;
        expires 1M;
        add_header Cache-Control "public";
        access_log off;
    }

    # ============ SPA 前端路由（放在最后）============
    # 不用 try_files $uri $uri/ —— 若磁盘存在同名目录且无 index，会 403 且不会回落 index.html
    location / {
        index index.html;
        try_files $uri /index.html;
    }

    error_page 500 502 503 504 /50x.html;
    location = /50x.html {
        root html;
    }
}