小程序后端架构与 BFF 层设计

客户端（小程序）
    ↓ HTTPS / wss
接入层（网关：限流、鉴权、路由）
    ↓
BFF 层（聚合、裁剪、编排）
    ↓
领域服务层（业务逻辑、数据访问）
    ↓
存储层（数据库、缓存、对象存储）

// BFF 层：并行聚合首页数据
async function composeHomeData(ctx) {
  const [profile, feed, banner, coupon] = await Promise.all([
    userService.getProfile(ctx.openid),
    feedService.getRecommend(ctx.openid),
    contentService.getBanner(),
    couponService.getAvailable(ctx.openid)
  ]);

  return {
    profile: trim(profile, ['openid', 'phone']),
    feed: feed.items.slice(0, 20),
    banner,
    coupon: coupon.available ? coupon.info : null
  };
}

// BFF 层的字段白名单裁剪
const USER_WHITELIST = ['nickname', 'avatar', 'level', 'vip'];

function trimUser(user) {
  const out = {};
  USER_WHITELIST.forEach((key) => {
    if (user[key] !== undefined) out[key] = user[key];
  });
  return out;
}

// 下游调用超时控制
async function withTimeout(promise, ms, fallback) {
  return new Promise((resolve) => {
    const timer = setTimeout(() => resolve(fallback), ms);
    promise.then((v) => { clearTimeout(timer); resolve(v); });
  });
}

// 推荐服务挂了也返回空列表，不阻塞首页
const feed = await withTimeout(
  feedService.getRecommend(openid),
  800,
  { items: [] }
);

{
  "code": 0,
  "message": "success",
  "data": {
    "list": [],
    "has_more": false
  }
}

// 游标分页（避免深分页性能问题）
{
  "code": 0,
  "data": {
    "items": [{ "id": "a1", "title": "..." }],
    "next_cursor": "a20",
    "has_more": true
  }
}

// 服务端：code2session 换取 openid
async function code2session(code) {
  const url =
    'https://api.weixin.qq.com/sns/jscode2session' +
    '?appid=' + APPID +
    '&secret=' + APPSECRET +
    '&js_code=' + code +
    '&grant_type=authorization_code';
  const res = await fetch(url).then((r) => r.json());
  if (res.errcode) throw new Error('code2session failed: ' + res.errcode);
  return { openid: res.openid, sessionKey: res.session_key };
}

客户端 → BFF：Authorization: Bearer <access_token>
BFF 校验令牌 → 解析出 openid → 向下游透传可信身份
令牌过期 → 返回 10002 → 客户端用 refresh_token 换新

// BFF 网关：令牌校验中间件
function authMiddleware(ctx, next) {
  const header = ctx.req.headers.authorization || '';
  const token = header.replace(/^Bearer\s+/i, '');
  try {
    const payload = verifyJwt(token);
    ctx.openid = payload.openid;
    return next();
  } catch (err) {
    ctx.status = 401;
    ctx.body = { code: 10002, message: '令牌无效或已过期' };
  }
}

// 防止水平越权：只能查询自己的订单
async function getOrder(openid, orderId) {
  const order = await orderRepo.find(orderId);
  if (!order || order.openid !== openid) {
    throw bizError(30003, '无权访问该订单');
  }
  return order;
}

// 云开发：云函数 + 云数据库
const cloud = require('wx-server-sdk');
cloud.init({ env: cloud.DYNAMIC_CURRENT_ENV });

exports.main = async (event) => {
  const db = cloud.database();
  const { OPENID } = cloud.getWXContext();

  // 云函数天然拿到 openid，无需自建鉴权
  const res = await db.collection('orders')
    .where({ openid: OPENID })
    .orderBy('createdAt', 'desc')
    .limit(20)
    .get();

  return { code: 0, data: res.data };
};

// 下单接口：同一 order_no 只生效一次
async function createOrder(openid, body) {
  const key = `order:${body.order_no}`;
  const existed = await redis.get(key);
  if (existed) return { code: 0, data: { duplicated: true } };

  const order = await orderRepo.create({ ...body, openid });
  await redis.set(key, order.id, 'EX', 86400);
  return { code: 0, data: order };
}

{
  "requestId": "req_8f3a",
  "openid": "oXXXX",
  "path": "/api/home",
  "costMs": 45,
  "code": 0,
  "upstream": {
    "feedService": 18,
    "userService": 22
  }
}