订单接口最小化与私有文件访问加固

- 订单列表使用独立最小 DTO 并分页，号主待办提供独立接口与统计 - 用户 token 增加版本控制，冻结/改密/退出即时撤销会话 - 移除 URL token 传参，SSE 与接口统一使用 HttpOnly Cookie - 私有文件按上传归属与业务关联授权，收款凭证转私有访问并校验归属 - 公开商品接口返回最小字段，隐藏号主身份与内部状态 - 每日清理超过 30 天未关联业务的上传归属，上传归属失败时补偿删除对象
2026-08-16 21:47:46 +08:00
parent f48da14ed2
commit 85332df2bd
63 changed files with 1827 additions and 290 deletions
@@ -1,11 +1,119 @@
 package router

 import (
+	"context"
+	"net/url"
+	"strings"
+
+	"hfb_sys/backend/internal/model"
+
 	"github.com/redis/go-redis/v9"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )

 type Dependencies struct {
 	DB    *gorm.DB
 	Redis *redis.Client
 }
+
+// privateFileAuthorizer 仅允许对象所属用户、订单参与者或聊天成员读取私有文件。
+// 未能关联到业务记录的对象默认拒绝，避免随机 key 成为访问凭证。
+func privateFileAuthorizer(db *gorm.DB) func(context.Context, uint64, string) (bool, error) {
+	return func(ctx context.Context, userID uint64, key string) (bool, error) {
+		if db == nil || userID == 0 || key == "" {
+			return false, nil
+		}
+		encodedKey := url.QueryEscape(key)
+		var count int64
+		queries := []struct {
+			sql  string
+			args []any
+		}{
+			{
+				sql:  "SELECT COUNT(1) FROM file_upload_owners WHERE user_id = ? AND object_key = ?",
+				args: []any{userID, key},
+			},
+			{
+				sql: `SELECT COUNT(1) FROM game_accounts a
+WHERE a.owner_id = ?
+	  AND (INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0)`,
+				args: []any{userID, key, encodedKey},
+			},
+			{
+				sql: `SELECT COUNT(1) FROM game_accounts a
+JOIN rental_orders o ON o.account_id = a.id
+WHERE (o.owner_id = ? OR o.renter_id = ?)
+	  AND (INSTR(a.screenshot_urls, ?) > 0 OR INSTR(a.screenshot_urls, ?) > 0)`,
+				args: []any{userID, userID, key, encodedKey},
+			},
+			{
+				sql: `SELECT COUNT(1) FROM order_checkouts c
+JOIN rental_orders o ON o.id = c.order_id
+WHERE (o.owner_id = ? OR o.renter_id = ?)
+	  AND (INSTR(c.evidence_urls, ?) > 0 OR INSTR(c.evidence_urls, ?) > 0)`,
+				args: []any{userID, userID, key, encodedKey},
+			},
+			{
+				sql: `SELECT COUNT(1) FROM disputes d
+JOIN rental_orders o ON o.id = d.order_id
+WHERE (o.owner_id = ? OR o.renter_id = ?)
+	  AND (INSTR(d.evidence_urls, ?) > 0 OR INSTR(d.evidence_urls, ?) > 0)`,
+				args: []any{userID, userID, key, encodedKey},
+			},
+			{
+				sql: `SELECT COUNT(1) FROM handoff_records h
+JOIN rental_orders o ON o.id = h.order_id
+WHERE (o.owner_id = ? OR o.renter_id = ?)
+	  AND (INSTR(h.attachment_urls, ?) > 0 OR INSTR(h.attachment_urls, ?) > 0)`,
+				args: []any{userID, userID, key, encodedKey},
+			},
+			{
+				sql: `SELECT COUNT(1) FROM chat_messages m
+JOIN chat_participants p ON p.conversation_id = m.conversation_id
+WHERE p.participant_type = 'user' AND p.participant_id = ?
+	  AND (INSTR(m.attachment_urls, ?) > 0 OR INSTR(m.attachment_urls, ?) > 0)`,
+				args: []any{userID, key, encodedKey},
+			},
+			{
+				sql: `SELECT COUNT(1) FROM user_payment_accounts p
+WHERE p.user_id = ?
+  AND (INSTR(p.certificate_urls, ?) > 0 OR INSTR(p.certificate_urls, ?) > 0)`,
+				args: []any{userID, key, encodedKey},
+			},
+		}
+		for _, query := range queries {
+			if err := db.WithContext(ctx).Raw(query.sql, query.args...).Scan(&count).Error; err != nil {
+				// 旧库缺少新表时继续检查其他可用关联，其他数据库错误则安全拒绝。
+				if strings.Contains(strings.ToLower(err.Error()), "no such table") || strings.Contains(strings.ToLower(err.Error()), "doesn't exist") {
+					continue
+				}
+				return false, err
+			}
+			if count > 0 {
+				return true, nil
+			}
+		}
+		return false, nil
+	}
+}
+
+// recordPrivateFileUpload 记录用户上传的原图和变体，保证草稿状态下也仅上传者可预览。
+func recordPrivateFileUpload(db *gorm.DB) func(context.Context, uint64, []string) error {
+	return func(ctx context.Context, userID uint64, objectKeys []string) error {
+		if db == nil || userID == 0 || len(objectKeys) == 0 {
+			return nil
+		}
+		records := make([]model.FileUploadOwner, 0, len(objectKeys))
+		for _, key := range objectKeys {
+			if key == "" {
+				continue
+			}
+			records = append(records, model.FileUploadOwner{UserID: userID, ObjectKey: key})
+		}
+		if len(records) == 0 {
+			return nil
+		}
+		return db.WithContext(ctx).Clauses(clause.OnConflict{DoNothing: true}).Create(&records).Error
+	}
+}