feat: anonymous ticket reply via tracking cookie

backend/routes/tickets.js

@@ -277,6 +277,17 @@ router.post('/:id/response', authenticate, async (req, res) => {
   res.status(201).json({ message: '回复成功' });
 });
 
+router.post('/:id/anon-response', async (req, res) => {
+  const { content } = req.body;
+  if (!content) return res.status(400).json({ error: '内容不能为空' });
+  const cookieToken = req.headers.cookie?.split('; ').find(c => c.startsWith('tracking_token='))?.split('=')[1];
+  if (!cookieToken) return res.status(403).json({ error: '无权操作，请先提交工单获取追踪标识' });
+  const t = await getRow('SELECT * FROM tickets WHERE id = ? AND tracking_token = ?', [req.params.id, cookieToken]);
+  if (!t) return res.status(404).json({ error: '工单不存在或无权操作' });
+  await query("INSERT INTO responses(ticket_id, content, is_staff) VALUES (?,?,0)", [req.params.id, content]);
+  res.status(201).json({ message: '补充成功' });
+});
+
 async function notifyStatusChange(ticket, newStatus) {
   if (ticket.user_id) {
     await sendEmailForTicket(ticket, 'ticket_updated', { ticket_status: SL[newStatus]||newStatus, ticket_status_color: SC[newStatus]||'#6b7280' });