Files
Scoreboard/server/internal/httpapi/repo_results.go
T
AskaEth 2c983bcfdf fix: 枚举入参校验(500→400)、5xx 错误串不再外泄、健康检查探库、限流键清理
服务端一批「会误导现场」的缺陷,全部补了测试:

- 枚举型入参(events 的 event_type/result_mode/result_type/compare/status、
  scoring_profiles 的 tie_mode/record_bonus_mode、entries.status、results.status)
  过去完全没有校验,非法值一路落到 SQLite 的 CHECK 约束,被统一错误处理当成
  服务端异常报成 500;现在统一在 enums.go 拦成 400 VALIDATION_FAILED,
  message 带字段名与合法取值、detail 带原始输入值。空值仍走原来的默认值。
- 5xx 响应体不再回显内部错误原文:新增 apiError.logDetail,SQLite / 引擎的
  原始错误串只进 ERROR 日志的 detail 字段。此前正好是反的——前端拿得到原文,
  日志里只有「服务端异常」。同时校准 newAPIError / internalMsg 的 skip 层数,
  拦截点不再退化成 response.go 里的构造函数。
- /api/health 新增 db / dbError:用 SELECT 1 探库(Ping 探不到「文件在、库读不动」),
  超时 5s 与 busy_timeout 同量级。状态码仍恒 200 —— Console 拿状态码当存活信号,
  数据库故障时回 5xx 只会变成重启循环,两个事实分两个字段表达。
- 修改密码时原密码错误由 401 改为 400 AUTH_FAILED(新增 wrongCredential):
  401 的语义是「本请求没有有效会话」,而这里会话是好的。
- 限流 hits map 在键数超过阈值时清理窗口内已无记录的键(窗口内活跃的键不动,
  否则堆键数就能冲掉别人的计数)。
- createEntry / updateEntry 拒绝「A 小项的报名挂在 B 小项的组别上」。
  数据库层仍无 (event_id, category_id) 复合外键(重建 entries 会牵动 results /
  score_ledger 的级联,风险高不做),这一层先兜住。
- 补测试:枚举字段逐项正反例、CSRF 反向用例、写限流 429、健康探库(含库故障)、
  5xx 不外泄原文、限流键清理不误删。
2026-09-11 14:28:25 +08:00

305 lines
9.0 KiB
Go
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
package httpapi
import (
"context"
"database/sql"
"encoding/json"
"errors"
"git.yeij.top/AskaEth/Scoreboard/server/internal/domain"
)
// ---------- 成员姓名 JSON 数组 ----------
func parseNames(ns sql.NullString) []string {
if !ns.Valid || ns.String == "" {
return nil
}
var out []string
if err := json.Unmarshal([]byte(ns.String), &out); err != nil {
return nil
}
return out
}
func marshalNames(names []string) any {
if len(names) == 0 {
return nil
}
raw, err := json.Marshal(names)
if err != nil {
return nil
}
return string(raw)
}
// ---------- results ----------
const resultColumns = `id, event_id, entry_id, rank, result_text, result_value, unit, is_tie,
points_override, status, state, recorded_by, recorded_at, verified_by, verified_at, note`
func scanResult(row interface{ Scan(...any) error }) (resultDTO, error) {
var (
r resultDTO
rank sql.NullInt64
text, unit sql.NullString
value, override sql.NullFloat64
recordedBy, verifiedBy sql.NullInt64
recordedAt, verifiedAt, note sql.NullString
)
if err := row.Scan(&r.ID, &r.EventID, &r.EntryID, &rank, &text, &value, &unit, &r.IsTie,
&override, &r.Status, &r.State, &recordedBy, &recordedAt, &verifiedBy, &verifiedAt, &note); err != nil {
return r, err
}
r.Rank = intPtr(rank)
r.ResultText = text.String
r.ResultValue = f64Ptr(value)
r.Unit = unit.String
r.PointsOverride = f64Ptr(override)
r.RecordedBy = i64Ptr(recordedBy)
r.RecordedAt = strPtr(recordedAt)
r.VerifiedBy = i64Ptr(verifiedBy)
r.VerifiedAt = strPtr(verifiedAt)
r.Note = strPtr(note)
return r, nil
}
func (s *server) resultsByEvent(ctx context.Context, eventID int64) ([]resultDTO, error) {
return queryResults(ctx, s.ev, `SELECT `+resultColumns+` FROM results WHERE event_id = ? ORDER BY id`, eventID)
}
func queryResults(ctx context.Context, q queryer, query string, args ...any) ([]resultDTO, error) {
rows, err := q.QueryContext(ctx, query, args...)
if err != nil {
return nil, internal(err)
}
defer func() { _ = rows.Close() }()
out := make([]resultDTO, 0)
for rows.Next() {
r, err := scanResult(rows)
if err != nil {
return nil, internal(err)
}
out = append(out, r)
}
if err := rows.Err(); err != nil {
return nil, internal(err)
}
if err := attachResultPoints(ctx, q, out); err != nil {
return nil, err
}
return out, nil
}
// attachResultPoints 给已发布成绩补上得分(该成绩产生的 result 流水合计)。
// 草稿没有流水,保持 nil;录入页据此预览发布后的分值变化。
func attachResultPoints(ctx context.Context, q queryer, items []resultDTO) error {
ids := make([]any, 0, len(items))
index := make(map[int64]int, len(items))
for i := range items {
if items[i].State != "published" {
continue
}
ids = append(ids, items[i].ID)
index[items[i].ID] = i
}
if len(ids) == 0 {
return nil
}
rows, err := q.QueryContext(ctx,
`SELECT result_id, SUM(points) FROM score_ledger
WHERE voided = 0 AND source_type = 'result' AND result_id IN (`+placeholders(len(ids))+`)
GROUP BY result_id`, ids...)
if err != nil {
return internal(err)
}
defer func() { _ = rows.Close() }()
for rows.Next() {
var (
resultID int64
points float64
)
if err := rows.Scan(&resultID, &points); err != nil {
return internal(err)
}
if i, ok := index[resultID]; ok {
v := points
items[i].Points = &v
}
}
if err := rows.Err(); err != nil {
return internal(err)
}
return nil
}
func (s *server) getResult(ctx context.Context, id int64) (resultDTO, error) {
r, err := scanResult(s.ev.QueryRowContext(ctx, `SELECT `+resultColumns+` FROM results WHERE id = ?`, id))
if errors.Is(err, sql.ErrNoRows) {
return resultDTO{}, notFound("成绩不存在")
}
if err != nil {
return resultDTO{}, internal(err)
}
items := []resultDTO{r}
if err := attachResultPoints(ctx, s.ev, items); err != nil {
return resultDTO{}, err
}
return items[0], nil
}
func (s *server) listResultsPage(ctx context.Context, eventID int64, state string, page, size int) (pageResult[resultDTO], error) {
where := []string{"1 = 1"}
args := []any{}
if eventID > 0 {
where = append(where, "event_id = ?")
args = append(args, eventID)
}
if state != "" {
where = append(where, "state = ?")
args = append(args, state)
}
clause := " WHERE " + joinAnd(where)
var total int
if err := s.ev.QueryRowContext(ctx, `SELECT COUNT(*) FROM results`+clause, args...).Scan(&total); err != nil {
return pageResult[resultDTO]{}, internal(err)
}
query := `SELECT ` + resultColumns + ` FROM results` + clause + ` ORDER BY id LIMIT ? OFFSET ?`
args = append(args, size, (page-1)*size)
items, err := queryResults(ctx, s.ev, query, args...)
if err != nil {
return pageResult[resultDTO]{}, err
}
return pageResult[resultDTO]{Items: items, Total: total, Page: page, Size: size}, nil
}
// upsertDraft 批量保存草稿;已发布的成绩直接拒绝(STATE_INVALID),
// 必须先撤销发布再改,避免 rank 被就地清空而流水不动。
func (s *server) upsertDraft(ctx context.Context, eventID int64, userID int64, items []draftResultInput) ([]resultDTO, error) {
tx, err := s.ev.BeginTx(ctx, nil)
if err != nil {
return nil, internal(err)
}
defer func() { _ = tx.Rollback() }()
for i, it := range items {
if it.EntryID == 0 {
return nil, badRequest("results[].entryId 必填", i)
}
var entryEvent int64
if err := tx.QueryRowContext(ctx, `SELECT event_id FROM entries WHERE id = ?`, it.EntryID).Scan(&entryEvent); err != nil {
if errors.Is(err, sql.ErrNoRows) {
return nil, badRequest("entryId 不存在", it.EntryID)
}
return nil, internal(err)
}
if entryEvent != eventID {
return nil, badRequest("entryId 不属于该小项", it.EntryID)
}
status, err := normalizeResultStatus(it.Status)
if err != nil {
return nil, err
}
// 已发布成绩不能被「存草稿」就地改写:ON CONFLICT 不改 state,
// 若放行会把 rank 清空但流水不动,大屏奖牌与积分立刻对不上。
var state string
err = tx.QueryRowContext(ctx, `SELECT state FROM results WHERE entry_id = ?`, it.EntryID).Scan(&state)
switch {
case errors.Is(err, sql.ErrNoRows):
// 尚无成绩,正常新建草稿。
case err != nil:
return nil, internal(err)
case state == string(domain.ResultStatePublished):
return nil, stateInvalid("该成绩已发布,请先撤销发布再修改")
}
if _, err := tx.ExecContext(ctx,
`INSERT INTO results (event_id, entry_id, rank, result_text, result_value, unit, is_tie,
points_override, status, state, recorded_by, recorded_at, note, updated_at)
VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 'draft', ?, datetime('now'), ?, datetime('now'))
ON CONFLICT(entry_id) DO UPDATE SET
rank = excluded.rank,
result_text = excluded.result_text,
result_value = excluded.result_value,
unit = COALESCE(excluded.unit, results.unit),
is_tie = excluded.is_tie,
points_override = excluded.points_override,
status = excluded.status,
note = excluded.note,
recorded_by = excluded.recorded_by,
recorded_at = excluded.recorded_at,
updated_at = datetime('now')`,
eventID, it.EntryID, nullInt(it.Rank), nullStr(it.ResultText), nullF64(it.ResultValue),
nullStr(it.Unit), it.IsTie, nullF64(it.PointsOverride), status,
nullID(userID), nullStr(it.Note)); err != nil {
return nil, internal(err)
}
}
if err := tx.Commit(); err != nil {
return nil, internal(err)
}
return s.resultsByEvent(ctx, eventID)
}
func nullID(id int64) any {
if id == 0 {
return nil
}
return id
}
func joinAnd(parts []string) string {
out := ""
for i, p := range parts {
if i > 0 {
out += " AND "
}
out += p
}
return out
}
// ---------- ledger ----------
func (s *server) activeLedger(ctx context.Context, q queryer) ([]domain.LedgerEntry, error) {
return queryLedger(ctx, q, `SELECT id, team_id, athlete_id, event_id, entry_id, result_id,
source_type, source_id, points, voided, created_at, count_to_team FROM score_ledger WHERE voided = 0`)
}
func queryLedger(ctx context.Context, q queryer, query string, args ...any) ([]domain.LedgerEntry, error) {
rows, err := q.QueryContext(ctx, query, args...)
if err != nil {
return nil, internal(err)
}
defer func() { _ = rows.Close() }()
out := make([]domain.LedgerEntry, 0)
for rows.Next() {
var (
l domain.LedgerEntry
athlete sql.NullInt64
event sql.NullInt64
entry sql.NullInt64
result sql.NullInt64
created sql.NullString
countToTeam int
)
if err := rows.Scan(&l.ID, &l.TeamID, &athlete, &event, &entry, &result,
&l.SourceType, &l.SourceID, &l.Points, &l.Voided, &created, &countToTeam); err != nil {
return nil, internal(err)
}
l.AthleteID = athlete.Int64
l.EventID = event.Int64
l.EntryID = entry.Int64
l.ResultID = result.Int64
l.CreatedAt = created.String
l.CountToTeam = countToTeam != 0
out = append(out, l)
}
return out, rows.Err()
}