【安全加密】交易密码：二级密码与资金保护

---大额交易的二级验证
local BIG_TRADE_GOLD = 100000

function Trade.execute(actor, targetName, gold, itemIdx)
    if gold >= BIG_TRADE_GOLD then
        local passed = getplayvar(actor, 2, "TradePassAt")
        -- 二级密码 5 分钟内有效
        if passed == nil or os.time() - tonumber(passed) > 300 then
            sendmsg(actor, 1, "大额交易请先输入交易密码")
            Trade.promptSecond(actor)
            return false
        end
    end
    -- 正常的交易结算
    return Trade.settle(actor, targetName, gold, itemIdx)
end

---校验：错误计数与锁定
function Trade.verifySecond(actor, input)
    local fails = tonumber(getplayvar(actor, 2, "TradeFailCnt")) or 0
    if fails >= 3 then
        sendmsg(actor, 1, "错误次数过多，请 30 分钟后再试")
        return false
    end
    local dk = getplayvar(actor, 2, "TradePinHash")
    if Cipher.pbkdf(input, actor:GetUserId(), 500) ~= dk then
        setplayvar(actor, "HUMAN", "TradeFailCnt", fails + 1, 1)
        sendmsg(actor, 1, "交易密码错误，剩余尝试 " .. (2 - fails) .. " 次")
        return false
    end
    setplayvar(actor, "HUMAN", "TradeFailCnt", 0, 1)
    setplayvar(actor, "HUMAN", "TradePassAt", os.time(), 0)
    return true
end