perf: 优化 MySQL 查询并接入 pytest

web/backend/routers/douyu.py

@@ -8,8 +8,8 @@ from datetime import datetime, timezone
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request, WebSocket, WebSocketDisconnect
 from loguru import logger
-from sqlalchemy import or_
-from sqlalchemy.orm import Session, joinedload
+from sqlalchemy import func, or_
+from sqlalchemy.orm import Session, joinedload, load_only
 
 from ..database import SessionLocal, get_db
 from ..deps import authenticate_websocket, get_current_user, require_permission
@@ -152,7 +152,15 @@ def _visible_task_accounts_query(db: Session, current: User):
 
 def _visible_tasks_query(db: Session, current: User):
     """返回当前用户可查看的斗鱼任务查询。"""
-    query = db.query(DouyuTask).options(joinedload(DouyuTask.account))
+    # 任务列表只展示账号识别信息，避免 joinedload 把密码、邮箱等加密大字段带出。
+    account_loader = joinedload(DouyuTask.account).load_only(
+        Account.id,
+        Account.username,
+        Account.uid,
+        Account.nickname,
+        Account.assigned_to,
+    )
+    query = db.query(DouyuTask).options(account_loader)
     if _can_view_all(current):
         return query
     if user_has_permission(current, "account:view_assigned"):
@@ -589,7 +597,13 @@ def list_tasks(
         ))
     total = None
     if page is not None:
-        total = query.enable_eagerloads(False).order_by(None).count()
+        total = (
+            query.enable_eagerloads(False)
+            .order_by(None)
+            .with_entities(func.count(DouyuTask.id))
+            .scalar()
+            or 0
+        )
     query = query.order_by(DouyuTask.id.desc())
     if page is not None:
         query = query.offset((page - 1) * page_size).limit(page_size)