feat(download): switch download buttons to direct source links

The token relay still stood between the button and the file: every click issued a short-lived token URL, so downloads never reached the real source address directly. - Render direct anchors (target=_blank) to the raw source URL in the download box and the paid card, with inline extract-code buttons - Retire the relay: delete Content\Download plus its init wiring, header query-var branch and SEO noindex branch, and drop the dead download-request flow from cms-download.js (cashier, scan-pay and error views stay) - Keep the dl_token table and the download logs page as read-only history; unscheduling of the orphaned cleanup cron is preserved
2026-09-24 19:12:45 +08:00
parent bc97c4ddc3
commit ab495854d5
10 changed files with 118 additions and 841 deletions
@@ -0,0 +1,92 @@
+'use strict';
+
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const test = require('node:test');
+
+const root = path.resolve(__dirname, '..', '..');
+const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');
+const exists = (file) => fs.existsSync(path.join(root, file));
+
+test('the token relay is fully retired', () => {
+  // The relay class itself is gone.
+  assert.equal(exists('src/Content/Download.php'), false);
+
+  // No init wiring remains (DownloadState is a different class and stays).
+  assert.doesNotMatch(read('functions.php'), /Content\\Download'/);
+
+  // The orphaned cleanup cron is still unscheduled on theme switch.
+  assert.match(read('functions.php'), /aksrt_dl_token_cleanup/);
+
+  // Header query-var branch and SEO noindex branch are gone with the route.
+  assert.doesNotMatch(read('inc/helpers/homepage/header-components.php'), /aksrt_dl_token/);
+  assert.doesNotMatch(read('src/Core/SEOHead.php'), /render_robots/);
+  assert.doesNotMatch(read('src/Core/SEOHead.php'), /aksrt_dl_token/);
+});
+
+test('the download box renders direct anchors with inline extract codes', () => {
+  const box = read('templates/parts/resource-download-box.php');
+
+  // No relay button, captcha surface or low-credit data attributes.
+  assert.doesNotMatch(box, /data-action="aksrt-download"/);
+  assert.doesNotMatch(box, /data-captcha/);
+  assert.doesNotMatch(box, /data-aksrt-download-captcha/);
+  assert.doesNotMatch(box, /captcha_active/);
+  assert.doesNotMatch(box, /data-balance|data-cost/);
+
+  // Sources without a raw URL are skipped; the button is a direct anchor.
+  assert.match(box, /if \(\$url === ''\) \{[\s\S]*?continue;/);
+  assert.match(box, /\$btn_href = \$url;/);
+  assert.match(box, /\$btn_target = ' target="_blank"'/);
+  assert.match(box, /\$btn_rel = ' rel="nofollow noopener"'/);
+
+  // Extract codes surface inline next to the anchor, no popup involved.
+  assert.match(box, /if \(\$has_extract\) : \?>/);
+  assert.match(box, /data-clipboard-text="<\?php echo esc_attr\(\$extract_code\); \?>/);
+
+  // The login gate keeps its own anchor.
+  assert.match(box, /\$btn_href = \$login_url;/);
+});
+
+test('the paid card download actions render direct anchors', () => {
+  const pay = read('inc/helpers/aksrt-pay.php');
+
+  assert.doesNotMatch(pay, /data-action="aksrt-download"/);
+  assert.doesNotMatch(pay, /data-captcha/);
+  assert.doesNotMatch(pay, /data-aksrt-download-captcha/);
+  assert.doesNotMatch(pay, /captcha_active/);
+
+  // Direct anchor to the raw source URL, empty sources skipped.
+  assert.match(pay, /if \(\$url === ''\) \{[\s\S]*?continue;/);
+  assert.match(pay, /<a class="mr10 but ' \. esc_attr\(\$button_class\) \. '" href="' \. esc_url\(\$url\) \. '" target="_blank" rel="nofollow noopener">/);
+
+  // The extract-code badge next to the anchor stays.
+  assert.match(pay, /<span class="badg">' \. esc_html\(\$extract_code\)/);
+});
+
+test('cms-download.js only serves the cashier now', () => {
+  const js = read('assets/js/cms-download.js');
+
+  // The download request flow is gone.
+  assert.doesNotMatch(js, /download\/request/);
+  assert.doesNotMatch(js, /data-action="aksrt-download"/);
+  assert.doesNotMatch(js, /renderSuccess|startDownload|performDownloadRequest|requestDownload/);
+  assert.doesNotMatch(js, /AKSRTCaptcha/);
+
+  // Cashier, scan-pay and error views remain.
+  assert.match(js, /data-aksrt-pay-content/);
+  assert.match(js, /window\.aksrtOpenCashier = function/);
+  assert.match(js, /function renderCashier/);
+  assert.match(js, /function renderScanPay/);
+  assert.match(js, /function renderError/);
+
+  // The script is still enqueued for resource / paid singles.
+  assert.match(read('src/Core/ScriptsPart1b.php'), /'aksrt-cms-download'/);
+});
+
+test('the download logs page reports historical token records', () => {
+  const page = read('src/Admin/Native/PayDownloadLogs.php');
+  assert.match(page, /aksrt_dl_token/);
+  assert.match(page, /不再签发新令牌/);
+});