refactor(backend): split project write responsibilities
This commit is contained in:
101
backend/internal/logic/files/handlers.go
Normal file
101
backend/internal/logic/files/handlers.go
Normal file
@@ -0,0 +1,101 @@
|
||||
package files
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"net/http"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"gorm.io/gorm"
|
||||
"senlinai-agent/backend/internal/httpx"
|
||||
"senlinai-agent/backend/internal/logic/auth"
|
||||
"senlinai-agent/backend/internal/logic/projects"
|
||||
"senlinai-agent/backend/internal/models"
|
||||
)
|
||||
|
||||
// SourceDTO 是文件资料写接口的稳定响应，仅包含可公开的相对存储路径。
|
||||
type SourceDTO struct {
|
||||
ID string `json:"id"`
|
||||
ProjectID string `json:"projectId"`
|
||||
Kind string `json:"kind"`
|
||||
Title string `json:"title"`
|
||||
FilePath string `json:"filePath"`
|
||||
CreatedAt time.Time `json:"createdAt"`
|
||||
UpdatedAt time.Time `json:"updatedAt"`
|
||||
}
|
||||
|
||||
// Handler 负责 multipart 边界，文件名清理和本地路径构造始终委托给 Service。
|
||||
type Handler struct {
|
||||
service *Service
|
||||
}
|
||||
|
||||
// NewHandler 创建文件资料 HTTP registrar。
|
||||
func NewHandler(service *Service) *Handler {
|
||||
return &Handler{service: service}
|
||||
}
|
||||
|
||||
// Register 将文件资料上传接口注册到上层提供的 /api/v1 路由组。
|
||||
func (h *Handler) Register(router gin.IRouter) {
|
||||
router.POST("/projects/:id/sources", h.upload)
|
||||
}
|
||||
|
||||
func (h *Handler) upload(c *gin.Context) {
|
||||
userID, ok := auth.CurrentUserID(c)
|
||||
if !ok {
|
||||
httpx.Error(c, http.StatusUnauthorized, "unauthorized", "未登录或登录已失效")
|
||||
return
|
||||
}
|
||||
projectIdentity, ok := httpx.IdentityParam(c, "id")
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
// 所有权必须在写磁盘前校验，防止越权请求留下孤立文件。
|
||||
project, err := projects.FindOwnedProject(userID, projectIdentity)
|
||||
if err != nil {
|
||||
writeSourceError(c, err)
|
||||
return
|
||||
}
|
||||
fileHeader, err := c.FormFile("file")
|
||||
if err != nil {
|
||||
httpx.Error(c, http.StatusBadRequest, "invalid_request", "请选择要上传的文件")
|
||||
return
|
||||
}
|
||||
file, err := fileHeader.Open()
|
||||
if err != nil {
|
||||
httpx.Error(c, http.StatusBadRequest, "invalid_request", "文件读取失败")
|
||||
return
|
||||
}
|
||||
defer file.Close()
|
||||
|
||||
// 先由文件服务保存内容，再用其返回的相对路径创建资料记录；handler 不拼接任何本地路径。
|
||||
stored, err := h.service.Save(project.ID, fileHeader.Filename, file)
|
||||
if err != nil {
|
||||
httpx.Error(c, http.StatusInternalServerError, "internal_error", "文件保存失败")
|
||||
return
|
||||
}
|
||||
source, err := h.service.CreateSource(userID, project, c.PostForm("title"), stored)
|
||||
if err != nil {
|
||||
writeSourceError(c, err)
|
||||
return
|
||||
}
|
||||
c.JSON(http.StatusCreated, sourceDTO(*source))
|
||||
}
|
||||
|
||||
func sourceDTO(source models.SenlinAgentSource) SourceDTO {
|
||||
return SourceDTO{
|
||||
ID: source.Identity, ProjectID: source.ProjectIdentity, Kind: source.Kind,
|
||||
Title: source.Title, FilePath: source.FilePath,
|
||||
CreatedAt: source.CreatedAt.UTC(), UpdatedAt: source.UpdatedAt.UTC(),
|
||||
}
|
||||
}
|
||||
|
||||
func writeSourceError(c *gin.Context, err error) {
|
||||
switch {
|
||||
case errors.Is(err, gorm.ErrRecordNotFound):
|
||||
httpx.Error(c, http.StatusNotFound, "not_found", "项目不存在")
|
||||
case errors.Is(err, ErrSourceTitleRequired), errors.Is(err, ErrSourcePathRequired):
|
||||
httpx.Error(c, http.StatusBadRequest, "invalid_request", "资料参数无效")
|
||||
default:
|
||||
httpx.Error(c, http.StatusInternalServerError, "internal_error", "资料创建失败")
|
||||
}
|
||||
}
|
||||
96
backend/internal/logic/files/handlers_test.go
Normal file
96
backend/internal/logic/files/handlers_test.go
Normal file
@@ -0,0 +1,96 @@
|
||||
package files
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"mime/multipart"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/glebarez/sqlite"
|
||||
"github.com/stretchr/testify/require"
|
||||
"gorm.io/gorm"
|
||||
"senlinai-agent/backend/internal/config"
|
||||
"senlinai-agent/backend/internal/httpx"
|
||||
"senlinai-agent/backend/internal/models"
|
||||
)
|
||||
|
||||
func TestFileRegistrarSavesBeforeCreatingIdentitySourceDTO(t *testing.T) {
|
||||
router, database, project, storageRoot := newFileHandlerTestRouter(t, 1, 1)
|
||||
body := &bytes.Buffer{}
|
||||
writer := multipart.NewWriter(body)
|
||||
require.NoError(t, writer.WriteField("title", "客户资料"))
|
||||
part, err := writer.CreateFormFile("file", "客户资料.txt")
|
||||
require.NoError(t, err)
|
||||
_, err = part.Write([]byte("private content"))
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, writer.Close())
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/projects/"+project.Identity+"/sources", body)
|
||||
req.Header.Set("Content-Type", writer.FormDataContentType())
|
||||
req.Header.Set("Authorization", "Bearer test-token")
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
router.ServeHTTP(rec, req)
|
||||
|
||||
require.Equal(t, http.StatusCreated, rec.Code, rec.Body.String())
|
||||
var source models.SenlinAgentSource
|
||||
require.NoError(t, database.Where("project_id = ?", project.ID).First(&source).Error)
|
||||
require.FileExists(t, filepath.Join(storageRoot, filepath.FromSlash(source.FilePath)))
|
||||
var payload map[string]any
|
||||
require.NoError(t, json.Unmarshal(rec.Body.Bytes(), &payload))
|
||||
require.Equal(t, source.Identity, payload["id"])
|
||||
require.Equal(t, project.Identity, payload["projectId"])
|
||||
require.Equal(t, filepath.ToSlash(source.FilePath), payload["filePath"])
|
||||
require.NotContains(t, payload["filePath"], storageRoot)
|
||||
require.NotContains(t, payload, "AbsolutePath")
|
||||
require.NotContains(t, rec.Body.String(), storageRoot)
|
||||
}
|
||||
|
||||
func TestFileRegistrarChecksOwnershipBeforeWritingFile(t *testing.T) {
|
||||
router, database, project, storageRoot := newFileHandlerTestRouter(t, 1, 2)
|
||||
body := &bytes.Buffer{}
|
||||
writer := multipart.NewWriter(body)
|
||||
part, err := writer.CreateFormFile("file", "hidden.txt")
|
||||
require.NoError(t, err)
|
||||
_, err = part.Write([]byte("must not be stored"))
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, writer.Close())
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/v1/projects/"+project.Identity+"/sources", body)
|
||||
req.Header.Set("Content-Type", writer.FormDataContentType())
|
||||
req.Header.Set("Authorization", "Bearer test-token")
|
||||
rec := httptest.NewRecorder()
|
||||
|
||||
router.ServeHTTP(rec, req)
|
||||
|
||||
require.Equal(t, http.StatusNotFound, rec.Code, rec.Body.String())
|
||||
var count int64
|
||||
require.NoError(t, database.Model(&models.SenlinAgentSource{}).Count(&count).Error)
|
||||
require.Zero(t, count)
|
||||
entries, err := os.ReadDir(storageRoot)
|
||||
require.NoError(t, err)
|
||||
require.Empty(t, entries)
|
||||
}
|
||||
|
||||
func newFileHandlerTestRouter(t *testing.T, currentUserID, ownerID uint) (*gin.Engine, *gorm.DB, models.SenlinAgentProject, string) {
|
||||
t.Helper()
|
||||
database, err := gorm.Open(sqlite.Open(fmt.Sprintf("file:%s?mode=memory&cache=shared", t.Name())), &gorm.Config{TranslateError: true})
|
||||
require.NoError(t, err)
|
||||
require.NoError(t, models.AutoMigrate(database))
|
||||
models.DBService = database
|
||||
require.NoError(t, database.Create(&models.SenlinAgentUser{Email: "owner@example.com", DisplayName: "Owner", PasswordHash: "hash"}).Error)
|
||||
require.NoError(t, database.Create(&models.SenlinAgentUser{Email: "other@example.com", DisplayName: "Other", PasswordHash: "hash"}).Error)
|
||||
project := models.SenlinAgentProject{OwnerID: ownerID, Name: "Files", Identifier: fmt.Sprintf("FILES-%d", ownerID)}
|
||||
require.NoError(t, database.Create(&project).Error)
|
||||
storageRoot := t.TempDir()
|
||||
router := httpx.NewProtectedRouter(
|
||||
config.Config{Env: "test"},
|
||||
func(string) (uint, error) { return currentUserID, nil },
|
||||
NewHandler(NewService(storageRoot, database)),
|
||||
)
|
||||
return router, database, project, storageRoot
|
||||
}
|
||||
@@ -1,16 +1,21 @@
|
||||
package files
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"gorm.io/gorm"
|
||||
"senlinai-agent/backend/internal/models"
|
||||
)
|
||||
|
||||
type Service struct {
|
||||
root string
|
||||
db *gorm.DB
|
||||
}
|
||||
|
||||
type StoredFile struct {
|
||||
@@ -19,10 +24,16 @@ type StoredFile struct {
|
||||
AbsolutePath string
|
||||
}
|
||||
|
||||
func NewService(root string) *Service {
|
||||
return &Service{root: root}
|
||||
// NewService 集中持有存储根目录；任何服务端本地路径都只能由该服务构造。
|
||||
func NewService(root string, databases ...*gorm.DB) *Service {
|
||||
var database *gorm.DB
|
||||
if len(databases) > 0 {
|
||||
database = databases[0]
|
||||
}
|
||||
return &Service{root: root, db: database}
|
||||
}
|
||||
|
||||
// Save 清理客户端文件名，并只返回供持久化的相对路径；绝对路径不得进入 API DTO。
|
||||
func (s *Service) Save(projectID uint, originalName string, content io.Reader) (StoredFile, error) {
|
||||
cleanName := filepath.Base(strings.ReplaceAll(strings.TrimSpace(originalName), "\\", "/"))
|
||||
if cleanName == "." || cleanName == "" {
|
||||
@@ -43,3 +54,38 @@ func (s *Service) Save(projectID uint, originalName string, content io.Reader) (
|
||||
}
|
||||
return StoredFile{OriginalName: cleanName, RelativePath: relative, AbsolutePath: absolute}, nil
|
||||
}
|
||||
|
||||
func (s *Service) database() *gorm.DB {
|
||||
if s.db != nil {
|
||||
return s.db
|
||||
}
|
||||
return models.DBService
|
||||
}
|
||||
|
||||
var (
|
||||
ErrSourceTitleRequired = errors.New("source title is required")
|
||||
ErrSourcePathRequired = errors.New("source file path is required")
|
||||
)
|
||||
|
||||
// CreateSource 只持久化 Save 产生的相对路径，不接受 handler 自行拼接本地路径。
|
||||
func (s *Service) CreateSource(ownerID uint, project *models.SenlinAgentProject, title string, stored StoredFile) (*models.SenlinAgentSource, error) {
|
||||
title = strings.TrimSpace(title)
|
||||
if title == "" {
|
||||
title = stored.OriginalName
|
||||
}
|
||||
if title == "" {
|
||||
return nil, ErrSourceTitleRequired
|
||||
}
|
||||
relativePath := filepath.ToSlash(strings.TrimSpace(stored.RelativePath))
|
||||
if relativePath == "" || filepath.IsAbs(relativePath) {
|
||||
return nil, ErrSourcePathRequired
|
||||
}
|
||||
source := &models.SenlinAgentSource{
|
||||
ProjectID: project.ID, ProjectIdentity: project.Identity, CreatedBy: ownerID,
|
||||
Kind: "file", Title: title, FilePath: relativePath,
|
||||
}
|
||||
if err := s.database().Create(source).Error; err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return source, nil
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user