feat: 盲盒房间体系重构 — 强制登录、独立房间、用户归属

- 新增 BlindBoxRoom/BlindBoxMember 模型，BlindBoxIdea 增加 userId/drawnById
- 新增房间 API（创建/加入/列表/详情），所有盲盒 API 增加认证和成员校验
- 新建盲盒大厅页面（三层引导式设计：未登录氛围页/首次创建引导/房间列表）
- 新建盲盒房间页面（成员校验/邀请分享/用户归属展示/自动聚焦）
- 首页删除契约画廊和 localStorage 盲盒逻辑，周末契约跳转到 /blindbox
- 清理旧路由 /room/[id]/blindbox
- 提取共享工具 src/lib/blindbox.ts（错误响应/房间号生成/成员校验）
- AuthModal 支持 defaultTab 参数
- 更新项目规范：新项目原则、代码优雅和复用优先

src/app/api/blindbox/draw/route.ts

@@ -1,39 +1,51 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
+import { errorResponse, validateMembership } from "@/lib/blindbox";
 
 export async function POST(req: NextRequest) {
   try {
-    const { roomId } = await req.json();
+    const { roomId, userId } = await req.json();
 
+    if (!userId || typeof userId !== "string") {
+      return errorResponse("请先登录", 401);
+    }
     if (!roomId || typeof roomId !== "string") {
-      return NextResponse.json({ error: "roomId 不能为空" }, { status: 400 });
+      return errorResponse("roomId 不能为空", 400);
+    }
+
+    const isMember = await validateMembership(roomId, userId);
+    if (!isMember) {
+      return errorResponse("你不是这个房间的成员", 403);
     }
 
     const pool = await prisma.blindBoxIdea.findMany({
-      where: { roomId: roomId.trim(), status: "in_pool" },
+      where: { roomId, status: "in_pool" },
       select: { id: true },
     });
 
     if (pool.length === 0) {
-      return NextResponse.json(
-        { error: "盒子是空的，先往里面塞点想法吧！" },
-        { status: 404 },
-      );
+      return errorResponse("盒子是空的，先往里面塞点想法吧！", 404);
     }
 
     const picked = pool[Math.floor(Math.random() * pool.length)];
 
     const idea = await prisma.blindBoxIdea.update({
       where: { id: picked.id },
-      data: { status: "drawn" },
+      data: { status: "drawn", drawnById: userId },
+      include: {
+        user: { select: { id: true, username: true, avatar: true } },
+        drawnBy: { select: { id: true, username: true, avatar: true } },
+      },
     });
 
     return NextResponse.json({
       id: idea.id,
       content: idea.content,
       createdAt: idea.createdAt,
+      submitter: idea.user,
+      drawnBy: idea.drawnBy,
     });
   } catch {
-    return NextResponse.json({ error: "抽取失败" }, { status: 500 });
+    return errorResponse("抽取失败", 500);
   }
 }

src/app/api/blindbox/room/[code]/route.ts

@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from "next/server";
+import { errorResponse, getRoomByCode } from "@/lib/blindbox";
+
+export async function GET(
+  _req: NextRequest,
+  { params }: { params: Promise<{ code: string }> },
+) {
+  try {
+    const { code } = await params;
+    const room = await getRoomByCode(code.toUpperCase());
+
+    if (!room) {
+      return errorResponse("房间不存在", 404);
+    }
+
+    return NextResponse.json({
+      id: room.id,
+      code: room.code,
+      name: room.name,
+      creatorId: room.creatorId,
+      poolCount: room._count.ideas,
+      members: room.members.map((m) => ({
+        ...m.user,
+        joinedAt: m.joinedAt,
+      })),
+    });
+  } catch {
+    return errorResponse("获取房间信息失败", 500);
+  }
+}

src/app/api/blindbox/room/join/route.ts

@@ -0,0 +1,38 @@
+import { NextRequest, NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+import { errorResponse } from "@/lib/blindbox";
+
+export async function POST(req: NextRequest) {
+  try {
+    const { userId, code } = await req.json();
+
+    if (!userId || typeof userId !== "string") {
+      return errorResponse("请先登录", 401);
+    }
+    if (!code || typeof code !== "string") {
+      return errorResponse("请输入房间号", 400);
+    }
+
+    const room = await prisma.blindBoxRoom.findUnique({
+      where: { code: code.trim().toUpperCase() },
+    });
+    if (!room) {
+      return errorResponse("房间不存在，请检查房间号", 404);
+    }
+
+    const existing = await prisma.blindBoxMember.findUnique({
+      where: { roomId_userId: { roomId: room.id, userId } },
+    });
+    if (existing) {
+      return NextResponse.json({ id: room.id, code: room.code, name: room.name, alreadyMember: true });
+    }
+
+    await prisma.blindBoxMember.create({
+      data: { roomId: room.id, userId },
+    });
+
+    return NextResponse.json({ id: room.id, code: room.code, name: room.name }, { status: 201 });
+  } catch {
+    return errorResponse("加入房间失败", 500);
+  }
+}

src/app/api/blindbox/room/route.ts

@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+import { errorResponse, generateUniqueRoomCode } from "@/lib/blindbox";
+
+export async function POST(req: NextRequest) {
+  try {
+    const { userId, name } = await req.json();
+
+    if (!userId || typeof userId !== "string") {
+      return errorResponse("请先登录", 401);
+    }
+
+    const roomName = (name || "").trim() || "我们的周末";
+    if (roomName.length > 30) {
+      return errorResponse("房间名不能超过 30 个字", 400);
+    }
+
+    const user = await prisma.user.findUnique({ where: { id: userId } });
+    if (!user) {
+      return errorResponse("用户不存在", 404);
+    }
+
+    const code = await generateUniqueRoomCode();
+
+    const room = await prisma.blindBoxRoom.create({
+      data: {
+        code,
+        name: roomName,
+        creatorId: userId,
+        members: {
+          create: { userId },
+        },
+      },
+    });
+
+    return NextResponse.json({ id: room.id, code: room.code, name: room.name }, { status: 201 });
+  } catch {
+    return errorResponse("创建房间失败", 500);
+  }
+}

src/app/api/blindbox/rooms/route.ts

@@ -0,0 +1,69 @@
+import { NextRequest, NextResponse } from "next/server";
+import { prisma } from "@/lib/prisma";
+import { errorResponse } from "@/lib/blindbox";
+
+export async function GET(req: NextRequest) {
+  const userId = req.nextUrl.searchParams.get("userId");
+
+  if (!userId) {
+    return errorResponse("请先登录", 401);
+  }
+
+  try {
+    const memberships = await prisma.blindBoxMember.findMany({
+      where: { userId },
+      include: {
+        room: {
+          include: {
+            members: {
+              include: { user: { select: { id: true, username: true, avatar: true } } },
+              orderBy: { joinedAt: "asc" },
+              take: 5,
+            },
+            _count: {
+              select: {
+                ideas: true,
+                members: true,
+              },
+            },
+            ideas: {
+              where: { status: "drawn" },
+              orderBy: { createdAt: "desc" },
+              take: 1,
+              select: { content: true, createdAt: true },
+            },
+          },
+        },
+      },
+      orderBy: { joinedAt: "desc" },
+    });
+
+    const rooms = memberships.map((m) => ({
+      id: m.room.id,
+      code: m.room.code,
+      name: m.room.name,
+      memberCount: m.room._count.members,
+      ideaCount: m.room._count.ideas,
+      poolCount: 0,
+      members: m.room.members.map((mb) => mb.user),
+      lastDrawn: m.room.ideas[0] ?? null,
+      joinedAt: m.joinedAt,
+    }));
+
+    const roomIds = rooms.map((r) => r.id);
+    const poolCounts = await prisma.blindBoxIdea.groupBy({
+      by: ["roomId"],
+      where: { roomId: { in: roomIds }, status: "in_pool" },
+      _count: true,
+    });
+    const poolMap = new Map(poolCounts.map((p) => [p.roomId, p._count]));
+
+    for (const room of rooms) {
+      room.poolCount = poolMap.get(room.id) ?? 0;
+    }
+
+    return NextResponse.json({ rooms });
+  } catch {
+    return errorResponse("获取房间列表失败", 500);
+  }
+}

src/app/api/blindbox/route.ts

@@ -1,50 +1,76 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/prisma";
+import { errorResponse, validateMembership } from "@/lib/blindbox";
 
 export async function POST(req: NextRequest) {
   try {
-    const { roomId, content } = await req.json();
+    const { roomId, userId, content } = await req.json();
 
+    if (!userId || typeof userId !== "string") {
+      return errorResponse("请先登录", 401);
+    }
     if (!roomId || typeof roomId !== "string") {
-      return NextResponse.json({ error: "roomId 不能为空" }, { status: 400 });
+      return errorResponse("roomId 不能为空", 400);
     }
     if (!content || typeof content !== "string" || content.trim().length === 0) {
-      return NextResponse.json({ error: "内容不能为空" }, { status: 400 });
+      return errorResponse("内容不能为空", 400);
     }
     if (content.trim().length > 200) {
-      return NextResponse.json({ error: "内容不能超过 200 字" }, { status: 400 });
+      return errorResponse("内容不能超过 200 字", 400);
+    }
+
+    const isMember = await validateMembership(roomId, userId);
+    if (!isMember) {
+      return errorResponse("你不是这个房间的成员", 403);
     }
 
     const idea = await prisma.blindBoxIdea.create({
       data: {
-        roomId: roomId.trim(),
+        roomId,
+        userId,
         content: content.trim(),
       },
     });
 
     return NextResponse.json({ id: idea.id }, { status: 201 });
   } catch {
-    return NextResponse.json({ error: "提交失败" }, { status: 500 });
+    return errorResponse("提交失败", 500);
   }
 }
 
 export async function GET(req: NextRequest) {
   const roomId = req.nextUrl.searchParams.get("roomId");
+  const userId = req.nextUrl.searchParams.get("userId");
 
   if (!roomId) {
-    return NextResponse.json({ error: "缺少 roomId" }, { status: 400 });
+    return errorResponse("缺少 roomId", 400);
+  }
+  if (!userId) {
+    return errorResponse("请先登录", 401);
   }
 
-  const [poolCount, drawn] = await Promise.all([
-    prisma.blindBoxIdea.count({
-      where: { roomId, status: "in_pool" },
-    }),
-    prisma.blindBoxIdea.findMany({
-      where: { roomId, status: "drawn" },
-      orderBy: { createdAt: "desc" },
-      select: { id: true, content: true, createdAt: true },
-    }),
-  ]);
+  const isMember = await validateMembership(roomId, userId);
+  if (!isMember) {
+    return errorResponse("你不是这个房间的成员", 403);
+  }
 
-  return NextResponse.json({ poolCount, drawn });
+  try {
+    const [poolCount, drawn] = await Promise.all([
+      prisma.blindBoxIdea.count({
+        where: { roomId, status: "in_pool" },
+      }),
+      prisma.blindBoxIdea.findMany({
+        where: { roomId, status: "drawn" },
+        orderBy: { createdAt: "desc" },
+        include: {
+          user: { select: { id: true, username: true, avatar: true } },
+          drawnBy: { select: { id: true, username: true, avatar: true } },
+        },
+      }),
+    ]);
+
+    return NextResponse.json({ poolCount, drawn });
+  } catch {
+    return errorResponse("查询失败", 500);
+  }
 }