hfb_sys/backend/internal/router/dependencies.go

package router

import (
	"context"
	"net/url"
	"strings"

	"hfb_sys/backend/internal/model"

	"github.com/redis/go-redis/v9"
	"gorm.io/gorm"
	"gorm.io/gorm/clause"
)

type Dependencies struct {
	DB    *gorm.DB
	Redis *redis.Client
}

// privateFileAuthorizer 仅允许对象所属用户、订单参与者或聊天成员读取私有文件。
// 未能关联到业务记录的对象默认拒绝，避免随机 key 成为访问凭证。
func privateFileAuthorizer(db *gorm.DB) func(context.Context, uint64, string) (bool, error) {
	return func(ctx context.Context, userID uint64, key string) (bool, error) {
		if db == nil || userID == 0 || key == "" {
			return false, nil
		}
		encodedKey := url.QueryEscape(key)

		// 若请求的是变体图片（.medium.jpg 或 .thumb.jpg），提取原始前缀，便于在存有原图的业务表中匹配
		basePrefix := key
		for _, suffix := range []string{".medium.jpg", ".thumb.jpg"} {
			if strings.HasSuffix(basePrefix, suffix) {
				basePrefix = strings.TrimSuffix(basePrefix, suffix)
				break
			}
		}
		encodedBasePrefix := url.QueryEscape(basePrefix)

		var count int64
		queries := []struct {
			sql  string
			args []any
		}{
			{
				sql:  "SELECT COUNT(1) FROM file_upload_owners WHERE user_id = ? AND object_key = ?",
				args: []any{userID, key},
			},
			{
				sql: `SELECT COUNT(1) FROM game_accounts a
JOIN rental_listings l ON l.account_id = a.id
WHERE l.status = 'published' AND l.review_status = 'approved'
	  AND (INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0)`,
				args: []any{key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM game_accounts a
WHERE a.owner_id = ?
	  AND (INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0)`,
				args: []any{userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM game_accounts a
JOIN rental_orders o ON o.account_id = a.id
WHERE (o.owner_id = ? OR o.renter_id = ?)
	  AND (INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0)`,
				args: []any{userID, userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM order_checkouts c
JOIN rental_orders o ON o.id = c.order_id
WHERE (o.owner_id = ? OR o.renter_id = ?)
	  AND (INSTR(c.evidence_urls, ?) > 0 OR INSTR(c.evidence_urls, ?) > 0 OR INSTR(c.evidence_urls, ?) > 0 OR INSTR(c.evidence_urls, ?) > 0)`,
				args: []any{userID, userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM disputes d
JOIN rental_orders o ON o.id = d.order_id
WHERE (o.owner_id = ? OR o.renter_id = ?)
	  AND (INSTR(d.evidence_urls, ?) > 0 OR INSTR(d.evidence_urls, ?) > 0 OR INSTR(d.evidence_urls, ?) > 0 OR INSTR(d.evidence_urls, ?) > 0)`,
				args: []any{userID, userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM handoff_records h
JOIN rental_orders o ON o.id = h.order_id
WHERE (o.owner_id = ? OR o.renter_id = ?)
	  AND (INSTR(h.attachment_urls, ?) > 0 OR INSTR(h.attachment_urls, ?) > 0 OR INSTR(h.attachment_urls, ?) > 0 OR INSTR(h.attachment_urls, ?) > 0)`,
				args: []any{userID, userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM chat_messages m
JOIN chat_participants p ON p.conversation_id = m.conversation_id
WHERE p.participant_type = 'user' AND p.participant_id = ?
	  AND (INSTR(m.attachment_urls, ?) > 0 OR INSTR(m.attachment_urls, ?) > 0 OR INSTR(m.attachment_urls, ?) > 0 OR INSTR(m.attachment_urls, ?) > 0)`,
				args: []any{userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM user_payment_accounts p
WHERE p.user_id = ?
  AND (INSTR(p.certificate_urls, ?) > 0 OR INSTR(p.certificate_urls, ?) > 0 OR INSTR(p.certificate_urls, ?) > 0 OR INSTR(p.certificate_urls, ?) > 0)`,
				args: []any{userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
			{
				sql: `SELECT COUNT(1) FROM withdrawal_requests w
WHERE w.user_id = ?
  AND (INSTR(w.payment_proof_url, ?) > 0 OR INSTR(w.payment_proof_url, ?) > 0 OR INSTR(w.payment_proof_url, ?) > 0 OR INSTR(w.payment_proof_url, ?) > 0)`,
				args: []any{userID, key, encodedKey, basePrefix, encodedBasePrefix},
			},
		}
		for _, query := range queries {
			if err := db.WithContext(ctx).Raw(query.sql, query.args...).Scan(&count).Error; err != nil {
				// 旧库缺少新表时继续检查其他可用关联，其他数据库错误则安全拒绝。
				if strings.Contains(strings.ToLower(err.Error()), "no such table") || strings.Contains(strings.ToLower(err.Error()), "doesn't exist") {
					continue
				}
				return false, err
			}
			if count > 0 {
				return true, nil
			}
		}
		return false, nil
	}
}

// recordPrivateFileUpload 记录用户上传的原图和变体，保证草稿状态下也仅上传者可预览。
func recordPrivateFileUpload(db *gorm.DB) func(context.Context, uint64, []string) error {
	return func(ctx context.Context, userID uint64, objectKeys []string) error {
		if db == nil || userID == 0 || len(objectKeys) == 0 {
			return nil
		}
		records := make([]model.FileUploadOwner, 0, len(objectKeys))
		for _, key := range objectKeys {
			if key == "" {
				continue
			}
			records = append(records, model.FileUploadOwner{UserID: userID, ObjectKey: key})
		}
		if len(records) == 0 {
			return nil
		}
		return db.WithContext(ctx).Clauses(clause.OnConflict{DoNothing: true}).Create(&records).Error
	}
}