From cea27ff7ef9f7b909645bbb427f57209bf95548d Mon Sep 17 00:00:00 2001 From: QiuSW <105186638@qq.com> Date: Tue, 4 Aug 2026 15:08:13 +0800 Subject: [PATCH 1/2] docs(tasks): define T-202 draft creation --- docs/tasks/T-202.md | 73 +++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 73 insertions(+) create mode 100644 docs/tasks/T-202.md diff --git a/docs/tasks/T-202.md b/docs/tasks/T-202.md new file mode 100644 index 0000000..ac53125 --- /dev/null +++ b/docs/tasks/T-202.md @@ -0,0 +1,73 @@ +--- +id: T-202 +title: 手工建单与 DRAFT 基础列表 +phase: 2 +deps: [T-201, T-004, T-005] +status: DOING +created: 2026-08-04 +vikunja_task_id: 27 +context_ref: 1c35155 +work_branch: task/t-202-admin-draft +needs_device: false +needs_human_review: false +write_paths: + - docs/tasks/T-202.md + - admin/cmd/server/main.go + - admin/internal/config/** + - admin/internal/server/** + - admin/internal/tasks/** + - admin/internal/storage/sqlite/** + - admin/internal/transport/webui/** + - admin/README.md +--- + + +## 问题 / 背景 + +T-201 已提供管理员会话；T-004 已提供 tasks 表。根据 T-010 加速门禁，T-103 尚未完成时只允许实现不启动试选的 DRAFT 手工建单与基础列表。 + +## 关联需求与交互 + +F-001、US-001、IX-002；GET /tasks、GET /tasks/new、POST /tasks；沿用已确认的传统表格与创建弹窗/直达页。 + +## 方案 + +1. 显式数据库配置并打开已迁移 SQLite；以仓储接口隔离 HTTP 和 SQL，创建事务只写 MANUAL、DRAFT、version=1。 +2. 表单校验任务名称、canonical 拼多多链接、颜色分类、尺码、正整数数量和正十进制总额上限；金额只用字符串并规范为两位小数。链接只接受 HTTPS mobile.yangkeduo.com/goods.html 且 goods_id 为唯一纯数字参数，额外查询参数不进入数据库。 +3. 以服务端生成的 create_key 同时作为任务 ID；重复相同 key 和相同内容返回原结果，不创建第二条，内容不同则冲突。 +4. GET /tasks 默认 created_at DESC 显示 DRAFT 基础表格；创建入口用服务端渲染的 modal 状态，/tasks/new 复用同一表单作为无脚本兜底；失败保留非密码输入并显示字段错误，成功 303 回列表且新任务第一行。 +5. 页面只显示需求字段、采购结果占位、DRAFT 状态与创建时间；不读取或伪造规格面板价格/证据，不提供勾选开始试选、状态推进、详情或设备接口。 + +## 验收要点 + +- 覆盖创建成功、倒序第一行、严格链接/goods_id、数量、金额、空白/长度、CSRF/未登录、幂等重放与冲突、SQL 错误 fail closed。 +- 弹窗与 /tasks/new 共享校验；错误保留输入并可访问；标题只链接到由 goods_id 重建的 canonical PDD URL并使用安全新标签属性。 +- go test ./...、go test -race ./...、go vet ./...、go build ./...、完整 init.ps1、上下文校验和 diff-check 通过。 + +## 执行记录 + +（暂无） + + +## 边界 + +- 本任务只创建 `source=MANUAL`、`status=DRAFT`、`version=1` 的任务并显示 DRAFT 基础列表；不得 + 实现勾选、批量开始试选、`DRAFT → PENDING` 或任何其他状态流转，也不得新增设备领取接口。 +- 不增加或修改数据库 schema，不读写 `spec_trials`、`order_authorizations`、`order_submissions`， + 不生成或展示机器实际规格、规格面板单价、截图、证据哈希或 PDD 页面判据。 +- 启动服务必须从显式 `CMBUYER_DATABASE_SOURCE` 读取 SQLite data source；缺失时明确失败，不提供 + 隐式内存库或仓库内默认数据库。服务不自动猜迁移目录；README 必须先给出显式迁移命令。 +- 商品链接只接受 `https://mobile.yangkeduo.com/goods.html`，且必须恰有一个纯数字 `goods_id`； + 拒绝 userinfo、端口、fragment、重复参数、其他 host/scheme/path 和编码绕过。数据库只保存 goods_id， + 展示链接由 goods_id 重建 canonical URL；`uin` 等额外查询参数既不保存也不回显。 +- 标题、颜色分类、尺码必须去除首尾空白后非空并受明确长度上限约束；数量必须是可表示的正整数； + 总额上限必须是大于零、最多两位小数的十进制字符串并规范为两位小数。金额校验、保存与展示均不得 + 使用浮点数或从其他数字推测。 +- `create_key` 由服务端用 `crypto/rand` 生成并验证格式，同时作为任务 ID；相同 key 与相同规范化内容 + 重放只能返回原任务，不得二次 INSERT，相同 key 携带不同内容必须冲突。SQL 必须参数化，创建失败 + 不得留下半条或未知状态记录。 +- `GET /tasks`、`GET /tasks/new`、`POST /tasks` 都必须复用 T-201 管理会话；POST 必须验证 CSRF。 + 校验失败保留非敏感输入并逐字段提示，数据库内部错误只给通用响应，不泄露 SQL、路径或凭据。 +- 页面只使用服务端模板转义；标题商品链接在新标签打开时必须带 `noopener noreferrer`。导入按钮只作 + 禁用占位；不得加载外部资源或把原型假数据、真机数据、地址、手机号带进生产页面。 +- 不实现或引用试选、数量设置、订单确认、提交围栏、提交订单、付款、免密支付或先用后付能力。 From d38cfb61af264a7cf57d5eba6b9c28c22e997dff Mon Sep 17 00:00:00 2001 From: QiuSW <105186638@qq.com> Date: Tue, 4 Aug 2026 16:33:22 +0800 Subject: [PATCH 2/2] feat(admin): add draft task creation --- admin/README.md | 3 + admin/cmd/server/main.go | 12 + admin/internal/config/config.go | 7 + admin/internal/config/config_test.go | 3 + admin/internal/server/router.go | 153 ++++++++- admin/internal/server/router_test.go | 188 +++++++++++ admin/internal/tasks/store.go | 129 ++++++++ admin/internal/tasks/tasks.go | 159 ++++++++++ admin/internal/tasks/tasks_test.go | 300 ++++++++++++++++++ .../transport/webui/templates/tasks.html | 20 +- admin/internal/transport/webui/webui.go | 17 +- docs/tasks/T-202.md | 8 +- 12 files changed, 966 insertions(+), 33 deletions(-) create mode 100644 admin/internal/tasks/store.go create mode 100644 admin/internal/tasks/tasks.go create mode 100644 admin/internal/tasks/tasks_test.go diff --git a/admin/README.md b/admin/README.md index 595b968..2ef7b8f 100644 --- a/admin/README.md +++ b/admin/README.md @@ -8,6 +8,7 @@ | `CMBUYER_ADMIN_PASSWORD_BCRYPT` | 非空 bcrypt 密码哈希，不接受明文密码。 | | `CMBUYER_SESSION_SECRET` | 至少 32 字节的会话签名密钥。 | | `CMBUYER_COOKIE_SECURE` | 可选；存在时只能精确为 `true` 或 `false`。HTTPS 部署应设为 `true`。 | +| `CMBUYER_DATABASE_SOURCE` | 已迁移 SQLite 的显式 data source。 | 示例仅展示变量名，不提供可运行凭据： @@ -16,6 +17,8 @@ $env:CMBUYER_ADMIN_USERNAME = '<管理员账号>' $env:CMBUYER_ADMIN_PASSWORD_BCRYPT = '' $env:CMBUYER_SESSION_SECRET = '<至少 32 字节的随机密钥>' $env:CMBUYER_COOKIE_SECURE = 'true' +$env:CMBUYER_DATABASE_SOURCE = '' +go run ./cmd/migrate -database $env:CMBUYER_DATABASE_SOURCE up go run ./cmd/server ``` diff --git a/admin/cmd/server/main.go b/admin/cmd/server/main.go index 19720a3..ff1596b 100644 --- a/admin/cmd/server/main.go +++ b/admin/cmd/server/main.go @@ -8,6 +8,8 @@ import ( "cmbuyer/admin/internal/auth" "cmbuyer/admin/internal/config" "cmbuyer/admin/internal/server" + "cmbuyer/admin/internal/storage/sqlite" + "cmbuyer/admin/internal/tasks" ) const listenAddress = ":8080" @@ -23,11 +25,21 @@ func run() error { if err != nil { return err } + database, err := sqlite.Open(configuration.DatabaseSource) + if err != nil { + return err + } + defer database.Close() + taskStore, err := tasks.NewSQLiteStore(database) + if err != nil { + return err + } router, err := server.NewRouter(server.Options{ AdminUsername: configuration.AdminUsername, AdminPasswordBcrypt: configuration.AdminPasswordBcrypt, Sessions: auth.NewManager(configuration.SessionSecret, configuration.CookieSecure), + Tasks: taskStore, }) if err != nil { return err diff --git a/admin/internal/config/config.go b/admin/internal/config/config.go index 312c91c..81c63c4 100644 --- a/admin/internal/config/config.go +++ b/admin/internal/config/config.go @@ -15,6 +15,7 @@ const ( adminPasswordBcryptEnv = "CMBUYER_ADMIN_PASSWORD_BCRYPT" sessionSecretEnv = "CMBUYER_SESSION_SECRET" cookieSecureEnv = "CMBUYER_COOKIE_SECURE" + databaseSourceEnv = "CMBUYER_DATABASE_SOURCE" minimumSecretLength = 32 ) @@ -24,6 +25,7 @@ type Config struct { AdminPasswordBcrypt string SessionSecret []byte CookieSecure bool + DatabaseSource string } // LoadFromEnv 从进程环境读取配置。错误只指出缺失或非法的变量名，绝不回显秘密。 @@ -65,12 +67,17 @@ func Load(lookup func(string) (string, bool)) (Config, error) { return Config{}, fmt.Errorf("%s must be exactly true or false", cookieSecureEnv) } } + databaseSource, err := required(lookup, databaseSourceEnv) + if err != nil { + return Config{}, err + } return Config{ AdminUsername: username, AdminPasswordBcrypt: passwordHash, SessionSecret: []byte(secret), CookieSecure: cookieSecure, + DatabaseSource: databaseSource, }, nil } diff --git a/admin/internal/config/config_test.go b/admin/internal/config/config_test.go index b94b776..f321d00 100644 --- a/admin/internal/config/config_test.go +++ b/admin/internal/config/config_test.go @@ -20,6 +20,7 @@ func TestLoad(t *testing.T) { "CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash), "CMBUYER_SESSION_SECRET": strings.Repeat("s", 32), "CMBUYER_COOKIE_SECURE": "true", + "CMBUYER_DATABASE_SOURCE": ":memory:", } got, err := config.Load(lookup(values)) @@ -41,6 +42,7 @@ func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) { "CMBUYER_ADMIN_USERNAME": "admin", "CMBUYER_ADMIN_PASSWORD_BCRYPT": string(hash), "CMBUYER_SESSION_SECRET": strings.Repeat("s", 32), + "CMBUYER_DATABASE_SOURCE": ":memory:", } tests := []struct { @@ -52,6 +54,7 @@ func TestLoadRejectsMissingOrInvalidConfiguration(t *testing.T) { {"invalid bcrypt", func(values map[string]string) { values["CMBUYER_ADMIN_PASSWORD_BCRYPT"] = "not-a-bcrypt-hash" }, "CMBUYER_ADMIN_PASSWORD_BCRYPT"}, {"short secret", func(values map[string]string) { values["CMBUYER_SESSION_SECRET"] = "short" }, "CMBUYER_SESSION_SECRET"}, {"invalid secure flag", func(values map[string]string) { values["CMBUYER_COOKIE_SECURE"] = "1" }, "CMBUYER_COOKIE_SECURE"}, + {"missing database", func(values map[string]string) { delete(values, "CMBUYER_DATABASE_SOURCE") }, "CMBUYER_DATABASE_SOURCE"}, } for _, test := range tests { diff --git a/admin/internal/server/router.go b/admin/internal/server/router.go index 037a1af..e574a73 100644 --- a/admin/internal/server/router.go +++ b/admin/internal/server/router.go @@ -9,6 +9,7 @@ import ( "strings" "cmbuyer/admin/internal/auth" + "cmbuyer/admin/internal/tasks" "cmbuyer/admin/internal/transport/webui" "github.com/gin-gonic/gin" @@ -22,11 +23,12 @@ type Options struct { AdminUsername string AdminPasswordBcrypt string Sessions *auth.Manager + Tasks tasks.Store } // NewRouter 返回当前服务范围内的完整 HTTP 路由。 func NewRouter(options Options) (*gin.Engine, error) { - if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil { + if options.AdminUsername == "" || options.AdminPasswordBcrypt == "" || options.Sessions == nil || options.Tasks == nil { return nil, errors.New("server authentication options are incomplete") } @@ -38,6 +40,8 @@ func NewRouter(options Options) (*gin.Engine, error) { router.POST("/login", login(options)) router.POST("/logout", logout(options)) router.GET("/tasks", tasksPage(options)) + router.GET("/tasks/new", newTaskPage(options)) + router.POST("/tasks", createTask(options)) return router, nil } @@ -70,11 +74,14 @@ func loginPage(options Options) gin.HandlerFunc { func login(options Options) gin.HandlerFunc { return func(context *gin.Context) { - limitFormBody(context) - csrfToken := context.PostForm("csrf_token") - returnPath := returnTo(context.PostForm("return_to")) - username := context.PostForm("username") - password := context.PostForm("password") + if !parseForm(context) { + return + } + form := context.Request.PostForm + csrfToken := form.Get("csrf_token") + returnPath := returnTo(form.Get("return_to")) + username := form.Get("username") + password := form.Get("password") if _, ok := options.Sessions.VerifyCSRF(context.Request, csrfToken); !ok { newCSRF, _ := options.Sessions.Ensure(context.Writer, context.Request) @@ -97,8 +104,10 @@ func login(options Options) gin.HandlerFunc { func logout(options Options) gin.HandlerFunc { return func(context *gin.Context) { - limitFormBody(context) - authenticated, ok := options.Sessions.VerifyCSRF(context.Request, context.PostForm("csrf_token")) + if !parseForm(context) { + return + } + authenticated, ok := options.Sessions.VerifyCSRF(context.Request, context.Request.PostForm.Get("csrf_token")) if !ok || !authenticated { context.Status(http.StatusForbidden) return @@ -117,10 +126,111 @@ func tasksPage(options Options) gin.HandlerFunc { return } - context.Header("Content-Type", "text/html; charset=utf-8") - if err := webui.RenderTasks(context.Writer, webui.TasksData{CSRFToken: csrfToken}); err != nil { - _ = context.Error(err) + drafts, err := options.Tasks.ListDrafts(context.Request.Context()) + if err != nil { + context.Status(http.StatusInternalServerError) + return } + data := webui.TasksData{CSRFToken: csrfToken, Drafts: drafts} + for _, draft := range drafts { + if draft.ID == context.Query("created") { + data.Success = true + break + } + } + if context.Query("create") == "1" { + form, err := newTaskForm() + if err != nil { + context.Status(http.StatusInternalServerError) + return + } + data.OpenForm = true + data.Form = form + data.FocusField = "title" + } + renderTasks(context, http.StatusOK, data) + } +} + +func newTaskPage(options Options) gin.HandlerFunc { + return func(context *gin.Context) { + csrf, authenticated := options.Sessions.Ensure(context.Writer, context.Request) + if !authenticated { + context.Redirect(http.StatusSeeOther, "/login?return_to=%2Ftasks%2Fnew") + return + } + form, err := newTaskForm() + if err != nil { + context.Status(http.StatusInternalServerError) + return + } + renderTasks(context, http.StatusOK, webui.TasksData{CSRFToken: csrf, Form: form, FullPage: true, FocusField: "title"}) + } +} +func createTask(options Options) gin.HandlerFunc { + return func(context *gin.Context) { + if !parseForm(context) { + return + } + requestForm := context.Request.PostForm + authenticated, csrfOK := options.Sessions.VerifyCSRF(context.Request, requestForm.Get("csrf_token")) + if !csrfOK || !authenticated { + context.Status(http.StatusForbidden) + return + } + form := taskForm(requestForm) + draft, validation := tasks.Validate(form) + if draft.GoodsID != "" { + form.ProductURL = tasks.CanonicalURL(draft.GoodsID) + } + fullPage := requestForm.Get("form_mode") == "full" + if !validation.Valid() { + drafts, err := options.Tasks.ListDrafts(context.Request.Context()) + if err != nil { + context.Status(http.StatusInternalServerError) + return + } + renderTasks(context, http.StatusBadRequest, webui.TasksData{CSRFToken: csrfFor(context, options), Drafts: drafts, Form: form, Errors: validation, OpenForm: !fullPage, FullPage: fullPage, FocusField: firstError(validation)}) + return + } + created, err := options.Tasks.CreateDraft(context.Request.Context(), draft) + if err != nil { + if errors.Is(err, tasks.ErrCreateKeyConflict) { + validation["create_key"] = "该创建请求已用于另一条任务，请重新打开表单。" + drafts, listErr := options.Tasks.ListDrafts(context.Request.Context()) + if listErr != nil { + context.Status(http.StatusInternalServerError) + return + } + renderTasks(context, http.StatusConflict, webui.TasksData{CSRFToken: csrfFor(context, options), Drafts: drafts, Form: form, Errors: validation, OpenForm: !fullPage, FullPage: fullPage, FocusField: firstError(validation)}) + return + } + context.Status(http.StatusInternalServerError) + return + } + context.Redirect(http.StatusSeeOther, "/tasks?created="+url.QueryEscape(created.ID)) + } +} + +func newTaskForm() (tasks.Form, error) { + key, err := tasks.NewCreateKey() + if err != nil { + return tasks.Form{}, err + } + return tasks.Form{CreateKey: key}, nil +} +func taskForm(form url.Values) tasks.Form { + return tasks.Form{CreateKey: form.Get("create_key"), Title: form.Get("title"), ProductURL: form.Get("product_url"), SKUColor: form.Get("sku_color"), SKUSize: form.Get("sku_size"), Quantity: form.Get("quantity"), MaxTotalPrice: form.Get("max_total_price")} +} +func csrfFor(context *gin.Context, options Options) string { + csrf, _ := options.Sessions.Ensure(context.Writer, context.Request) + return csrf +} +func renderTasks(context *gin.Context, status int, data webui.TasksData) { + context.Header("Content-Type", "text/html; charset=utf-8") + context.Status(status) + if err := webui.RenderTasks(context.Writer, data); err != nil { + _ = context.Error(err) } } @@ -137,8 +247,27 @@ func renderLogin(context *gin.Context, status int, csrfToken, returnPath, userna } } -func limitFormBody(context *gin.Context) { +func parseForm(context *gin.Context) bool { context.Request.Body = http.MaxBytesReader(context.Writer, context.Request.Body, maxFormBytes) + if err := context.Request.ParseForm(); err != nil { + var tooLarge *http.MaxBytesError + if errors.As(err, &tooLarge) { + context.Status(http.StatusRequestEntityTooLarge) + } else { + context.Status(http.StatusBadRequest) + } + return false + } + return true +} + +func firstError(validation tasks.Errors) string { + for _, field := range []string{"title", "product_url", "sku_color", "sku_size", "quantity", "max_total_price"} { + if _, ok := validation[field]; ok { + return field + } + } + return "title" } func returnTo(value string) string { diff --git a/admin/internal/server/router_test.go b/admin/internal/server/router_test.go index 54aa508..e4547cb 100644 --- a/admin/internal/server/router_test.go +++ b/admin/internal/server/router_test.go @@ -1,6 +1,7 @@ package server_test import ( + "context" "net/http" "net/http/httptest" "net/url" @@ -10,12 +11,14 @@ import ( "cmbuyer/admin/internal/auth" "cmbuyer/admin/internal/server" + "cmbuyer/admin/internal/tasks" "github.com/gin-gonic/gin" "golang.org/x/crypto/bcrypt" ) var csrfPattern = regexp.MustCompile(`name="csrf_token" value="([^"]+)"`) +var createKeyPattern = regexp.MustCompile(`name="create_key" value="([^"]+)"`) func TestHealthzIsPublic(t *testing.T) { router, _ := newRouter(t) @@ -175,6 +178,149 @@ func TestTamperedCookieCannotAccessTasks(t *testing.T) { } +func TestTaskCreationRendersSharedFormsAndPersistsOnlyDraft(t *testing.T) { + router, _ := newRouter(t) + cookie := authenticate(t, router) + + modal := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie) + if modal.Code != http.StatusOK { + t.Fatalf("GET dialog form status = %d, want 200", modal.Code) + } + fullPage := serve(router, http.MethodGet, "/tasks/new", nil, cookie) + if fullPage.Code != http.StatusOK { + t.Fatalf("GET full form status = %d, want 200", fullPage.Code) + } + for _, want := range []string{`
筛选`, `disabled>清除`, `min-height:44px`, `overflow-x:auto`, `prefers-reduced-motion`} { + if !strings.Contains(modal.Body.String(), want) { + t.Fatalf("dialog form is missing %q", want) + } + } + for _, want := range []string{`name="title"`, `name="product_url"`, `name="sku_color"`, `name="sku_size"`, `name="quantity"`, `name="max_total_price"`, `name="form_mode" value="full"`} { + if !strings.Contains(fullPage.Body.String(), want) { + t.Fatalf("full-page form is missing %q", want) + } + } + + invalid := serve(router, http.MethodPost, "/tasks", url.Values{ + "csrf_token": {csrfToken(t, modal.Body.String())}, + "create_key": {createKey(t, modal.Body.String())}, + "title": {``}, + "product_url": {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&uin=discard"}, + "sku_color": {"black"}, + "sku_size": {"M"}, + "quantity": {"0"}, + "max_total_price": {"12.80"}, + "form_mode": {"dialog"}, + }, cookie) + if invalid.Code != http.StatusBadRequest || !strings.Contains(invalid.Body.String(), `alert(1)`) || !strings.Contains(invalid.Body.String(), `<script>alert(1)</script>`) { + t.Fatalf("invalid create did not safely preserve title: %q", invalid.Body.String()) + } + if strings.Contains(invalid.Body.String(), "uin=discard") || !strings.Contains(invalid.Body.String(), `value="https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"`) { + t.Fatalf("invalid create did not canonicalize product URL: %q", invalid.Body.String()) + } + + createPage := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie) + key := createKey(t, createPage.Body.String()) + created := serve(router, http.MethodPost, "/tasks", url.Values{ + "csrf_token": {csrfToken(t, createPage.Body.String())}, + "create_key": {key}, + "title": {"夏季上衣"}, + "product_url": {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"}, + "sku_color": {"black"}, + "sku_size": {"M"}, + "quantity": {"2"}, + "max_total_price": {"12.8"}, + "form_mode": {"dialog"}, + }, cookie) + if created.Code != http.StatusSeeOther || !strings.HasPrefix(created.Header().Get("Location"), "/tasks?created=") { + t.Fatalf("valid create = (%d, %q), want 303 to a created-task acknowledgement", created.Code, created.Header().Get("Location")) + } + replay := serve(router, http.MethodPost, "/tasks", url.Values{ + "csrf_token": {csrfToken(t, createPage.Body.String())}, + "create_key": {key}, + "title": {"夏季上衣"}, + "product_url": {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=discard"}, + "sku_color": {"black"}, + "sku_size": {"M"}, + "quantity": {"2"}, + "max_total_price": {"12.8"}, + "form_mode": {"dialog"}, + }, cookie) + if replay.Code != http.StatusSeeOther { + t.Fatalf("idempotent replay status = %d, want 303", replay.Code) + } + conflict := serve(router, http.MethodPost, "/tasks", url.Values{ + "csrf_token": {csrfToken(t, createPage.Body.String())}, + "create_key": {key}, + "title": {"different task"}, + "product_url": {"https://mobile.yangkeduo.com/goods.html?goods_id=937122477375"}, + "sku_color": {"black"}, + "sku_size": {"M"}, + "quantity": {"2"}, + "max_total_price": {"12.80"}, + "form_mode": {"dialog"}, + }, cookie) + if conflict.Code != http.StatusConflict || !strings.Contains(conflict.Body.String(), "该创建请求已用于另一条任务") { + t.Fatalf("conflicting create = (%d, %q), want a 409 form error", conflict.Code, conflict.Body.String()) + } + + list := serve(router, http.MethodGet, created.Header().Get("Location"), nil, cookie) + if list.Code != http.StatusOK { + t.Fatalf("GET /tasks status = %d, want 200", list.Code) + } + body := list.Body.String() + for _, want := range []string{`任务已创建，已显示在列表首行。`, `<b>夏季上衣</b>`, `https://mobile.yangkeduo.com/goods.html?goods_id=937122477375`, `target="_blank"`, `rel="noopener noreferrer"`, `¥12.80`, `待开始`, `选择全部任务`, `选择任务`} { + if !strings.Contains(body, want) { + t.Fatalf("task list is missing %q", want) + } + } + for _, forbidden := range []string{"utm_source", "试选", "PENDING", "支付", "订单确认", "真机", "提交订单"} { + if strings.Contains(body, forbidden) { + t.Fatalf("task list exposed deferred scope %q", forbidden) + } + } +} + +func TestTaskCreationRequiresAuthenticationAndCSRF(t *testing.T) { + router, _ := newRouter(t) + if response := serve(router, http.MethodPost, "/tasks", url.Values{}, nil); response.Code != http.StatusForbidden { + t.Fatalf("anonymous POST /tasks = %d, want 403", response.Code) + } + cookie := authenticate(t, router) + if response := serve(router, http.MethodPost, "/tasks", url.Values{}, cookie); response.Code != http.StatusForbidden { + t.Fatalf("POST /tasks without CSRF = %d, want 403", response.Code) + } +} + +func TestTaskCreationFailsClosedForMalformedOrOversizedForms(t *testing.T) { + router, _ := newRouter(t) + cookie := authenticate(t, router) + page := serve(router, http.MethodGet, "/tasks?create=1", nil, cookie) + base := url.Values{ + "csrf_token": {csrfToken(t, page.Body.String())}, + "create_key": {createKey(t, page.Body.String())}, + "title": {"title"}, + "product_url": {"https://mobile.yangkeduo.com/goods.html?goods_id=1;uin=malformed"}, + "sku_color": {"black"}, + "sku_size": {"M"}, + "quantity": {"1"}, + "max_total_price": {"1.00"}, + "form_mode": {"dialog"}, + } + malformed := serve(router, http.MethodPost, "/tasks", base, cookie) + if malformed.Code != http.StatusBadRequest || !strings.Contains(malformed.Body.String(), "canonical 商品链接") { + t.Fatalf("malformed URL create = (%d, %q), want validation failure", malformed.Code, malformed.Body.String()) + } + + oversized := url.Values{"csrf_token": {csrfToken(t, page.Body.String())}, "title": {strings.Repeat("x", 9<<10)}} + if response := serve(router, http.MethodPost, "/tasks", oversized, cookie); response.Code != http.StatusRequestEntityTooLarge { + t.Fatalf("oversized form status = %d, want 413", response.Code) + } +} + func assertSecurityHeaders(t *testing.T, response *httptest.ResponseRecorder) { t.Helper() want := map[string]string{ @@ -246,6 +392,7 @@ func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) { AdminUsername: "admin", AdminPasswordBcrypt: string(hash), Sessions: manager, + Tasks: &memoryStore{}, }) if err != nil { t.Fatalf("NewRouter: %v", err) @@ -253,6 +400,24 @@ func newRouter(t *testing.T) (*gin.Engine, *auth.Manager) { return router, manager } +type memoryStore struct{ drafts []tasks.Draft } + +func (store *memoryStore) CreateDraft(_ context.Context, draft tasks.Draft) (tasks.Draft, error) { + for _, existing := range store.drafts { + if existing.ID == draft.ID { + if existing.Title != draft.Title || existing.GoodsID != draft.GoodsID || existing.SKUColor != draft.SKUColor || existing.SKUSize != draft.SKUSize || existing.Quantity != draft.Quantity || existing.MaxTotalPrice != draft.MaxTotalPrice { + return tasks.Draft{}, tasks.ErrCreateKeyConflict + } + return existing, nil + } + } + store.drafts = append(store.drafts, draft) + return draft, nil +} +func (store *memoryStore) ListDrafts(_ context.Context) ([]tasks.Draft, error) { + return append([]tasks.Draft(nil), store.drafts...), nil +} + func serve(router http.Handler, method, target string, form url.Values, cookie *http.Cookie) *httptest.ResponseRecorder { var body *strings.Reader if form == nil { @@ -291,3 +456,26 @@ func csrfToken(t *testing.T, body string) string { } return matches[1] } + +func createKey(t *testing.T, body string) string { + t.Helper() + matches := createKeyPattern.FindStringSubmatch(body) + if len(matches) != 2 || matches[1] == "" { + t.Fatalf("no create key in response body: %q", body) + } + return matches[1] +} + +func authenticate(t *testing.T, router http.Handler) *http.Cookie { + t.Helper() + page := serve(router, http.MethodGet, "/login", nil, nil) + login := serve(router, http.MethodPost, "/login", url.Values{ + "csrf_token": {csrfToken(t, page.Body.String())}, + "username": {"admin"}, + "password": {"test-password"}, + }, sessionCookie(t, page)) + if login.Code != http.StatusSeeOther { + t.Fatalf("authenticate status = %d, want 303", login.Code) + } + return sessionCookie(t, login) +} diff --git a/admin/internal/tasks/store.go b/admin/internal/tasks/store.go new file mode 100644 index 0000000..bea9cba --- /dev/null +++ b/admin/internal/tasks/store.go @@ -0,0 +1,129 @@ +package tasks + +import ( + "context" + "database/sql" + "errors" + "fmt" + "time" +) + +const sqliteWriteTimeout = 2 * time.Second + +type Store interface { + CreateDraft(context.Context, Draft) (Draft, error) + ListDrafts(context.Context) ([]Draft, error) +} +type SQLiteStore struct { + database *sql.DB + now func() time.Time + createGate chan struct{} +} + +func NewSQLiteStore(database *sql.DB) (*SQLiteStore, error) { + if database == nil { + return nil, errors.New("database is required") + } + if _, err := database.Exec("SELECT 1 FROM tasks LIMIT 1"); err != nil { + return nil, fmt.Errorf("tasks migration is not available: %w", err) + } + return &SQLiteStore{database: database, now: time.Now, createGate: make(chan struct{}, 1)}, nil +} + +func (store *SQLiteStore) CreateDraft(ctx context.Context, draft Draft) (Draft, error) { + writeContext, cancel := context.WithTimeout(ctx, sqliteWriteTimeout) + defer cancel() + // SQLite permits one writer at a time. Serializing this store's short create + // transaction prevents concurrent retries of one create key from surfacing as busy. + select { + case store.createGate <- struct{}{}: + defer func() { <-store.createGate }() + case <-writeContext.Done(): + return Draft{}, writeContext.Err() + } + draft.CreatedAt = store.now().UTC() + transaction, err := store.database.BeginTx(writeContext, nil) + if err != nil { + return Draft{}, err + } + defer transaction.Rollback() + _, err = transaction.ExecContext(writeContext, `INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'MANUAL', ?, ?, ?, ?, ?, ?, 'DRAFT', 1, ?, ?)`, draft.ID, draft.Title, draft.GoodsID, draft.SKUColor, draft.SKUSize, draft.Quantity, draft.MaxTotalPrice, draft.CreatedAt.Format(time.RFC3339Nano), draft.CreatedAt.Format(time.RFC3339Nano)) + if err == nil { + if err := transaction.Commit(); err != nil { + return Draft{}, err + } + return draft, nil + } + existing, found, currentPhase, lookupErr := findDraft(writeContext, transaction, draft.ID) + if lookupErr != nil { + return Draft{}, lookupErr + } + if found && currentPhase && samePayload(existing, draft) { + if err := transaction.Commit(); err != nil { + return Draft{}, err + } + return existing, nil + } + if found { + return Draft{}, ErrCreateKeyConflict + } + return Draft{}, err +} + +func (store *SQLiteStore) ListDrafts(ctx context.Context) ([]Draft, error) { + // rowid makes equal timestamps deterministic: SQLite assigns it in insertion order, + // whereas UUID v4 is deliberately not time-sortable. + rows, err := store.database.QueryContext(ctx, `SELECT id, title, goods_id, sku_color, sku_size, quantity, max_total_price, created_at FROM tasks WHERE source = 'MANUAL' AND status = 'DRAFT' ORDER BY created_at DESC, rowid DESC`) + if err != nil { + return nil, err + } + defer rows.Close() + result := []Draft{} + for rows.Next() { + draft, err := scanDraft(rows) + if err != nil { + return nil, err + } + result = append(result, draft) + } + return result, rows.Err() +} + +func findDraft(ctx context.Context, transaction *sql.Tx, id string) (Draft, bool, bool, error) { + row := transaction.QueryRowContext(ctx, `SELECT id, title, goods_id, sku_color, sku_size, quantity, max_total_price, created_at, source, status, version FROM tasks WHERE id = ?`, id) + var draft Draft + var created, source, status string + var version int + err := row.Scan(&draft.ID, &draft.Title, &draft.GoodsID, &draft.SKUColor, &draft.SKUSize, &draft.Quantity, &draft.MaxTotalPrice, &created, &source, &status, &version) + if errors.Is(err, sql.ErrNoRows) { + return Draft{}, false, false, nil + } + if err != nil { + return Draft{}, false, false, err + } + parsed, err := time.Parse(time.RFC3339Nano, created) + if err != nil { + return Draft{}, false, false, err + } + draft.CreatedAt = parsed + return draft, true, source == "MANUAL" && status == "DRAFT" && version == 1, nil +} + +type scanner interface{ Scan(...any) error } + +func scanDraft(row scanner) (Draft, error) { + var draft Draft + var created string + if err := row.Scan(&draft.ID, &draft.Title, &draft.GoodsID, &draft.SKUColor, &draft.SKUSize, &draft.Quantity, &draft.MaxTotalPrice, &created); err != nil { + return Draft{}, err + } + parsed, err := time.Parse(time.RFC3339Nano, created) + if err != nil { + return Draft{}, err + } + draft.CreatedAt = parsed + return draft, nil +} +func samePayload(left, right Draft) bool { + return left.ID == right.ID && left.Title == right.Title && left.GoodsID == right.GoodsID && left.SKUColor == right.SKUColor && left.SKUSize == right.SKUSize && left.Quantity == right.Quantity && left.MaxTotalPrice == right.MaxTotalPrice +} diff --git a/admin/internal/tasks/tasks.go b/admin/internal/tasks/tasks.go new file mode 100644 index 0000000..e7262e2 --- /dev/null +++ b/admin/internal/tasks/tasks.go @@ -0,0 +1,159 @@ +// Package tasks 定义手工 DRAFT 任务的校验与窄仓储边界。 +package tasks + +import ( + "crypto/rand" + "encoding/hex" + "errors" + "net/url" + "strconv" + "strings" + "time" +) + +const ( + maxTitleLength = 120 + maxSKUText = 80 +) + +var ErrCreateKeyConflict = errors.New("create key conflicts with a different task") + +type Draft struct { + ID string + Title string + GoodsID string + SKUColor string + SKUSize string + Quantity int + MaxTotalPrice string + CreatedAt time.Time +} + +type Form struct{ CreateKey, Title, ProductURL, SKUColor, SKUSize, Quantity, MaxTotalPrice string } +type Errors map[string]string + +func (errors Errors) Valid() bool { return len(errors) == 0 } + +// Validate trims and normalizes a user form. It never reads a product page or derives price data. +func Validate(form Form) (Draft, Errors) { + draft := Draft{ID: strings.TrimSpace(form.CreateKey), Title: strings.TrimSpace(form.Title), SKUColor: strings.TrimSpace(form.SKUColor), SKUSize: strings.TrimSpace(form.SKUSize)} + errors := Errors{} + if !validUUID(draft.ID) { + errors["create_key"] = "创建请求已过期，请重新打开表单。" + } + if draft.Title == "" || len([]rune(draft.Title)) > maxTitleLength { + errors["title"] = "任务名称不能为空，且不能超过 120 个字符。" + } + if draft.SKUColor == "" || len([]rune(draft.SKUColor)) > maxSKUText { + errors["sku_color"] = "颜色分类不能为空，且不能超过 80 个字符。" + } + if draft.SKUSize == "" || len([]rune(draft.SKUSize)) > maxSKUText { + errors["sku_size"] = "尺码不能为空，且不能超过 80 个字符。" + } + goodsID, ok := CanonicalGoodsID(strings.TrimSpace(form.ProductURL)) + if !ok { + errors["product_url"] = "请输入唯一的 canonical 商品链接。" + } else { + draft.GoodsID = goodsID + } + quantity, err := strconv.ParseInt(strings.TrimSpace(form.Quantity), 10, 0) + if err != nil || quantity < 1 { + errors["quantity"] = "数量必须是正整数。" + } else { + draft.Quantity = int(quantity) + } + money, ok := normalizeMoney(strings.TrimSpace(form.MaxTotalPrice)) + if !ok { + errors["max_total_price"] = "价格上限必须大于零，且最多两位小数。" + } else { + draft.MaxTotalPrice = money + } + return draft, errors +} + +// CanonicalGoodsID only accepts the one verified manual-entry URL shape; untrusted query data is discarded. +func CanonicalGoodsID(value string) (string, bool) { + if value == "" || strings.Contains(value, "\\") || strings.Contains(value, "%") { + return "", false + } + parsed, err := url.ParseRequestURI(value) + if err != nil || parsed.Scheme != "https" || parsed.Host != "mobile.yangkeduo.com" || parsed.User != nil || parsed.Port() != "" || parsed.Path != "/goods.html" || parsed.Fragment != "" { + return "", false + } + values, err := url.ParseQuery(parsed.RawQuery) + if err != nil { + return "", false + } + goodsIDs := values["goods_id"] + if len(goodsIDs) != 1 || goodsIDs[0] == "" { + return "", false + } + for _, character := range goodsIDs[0] { + if character < '0' || character > '9' { + return "", false + } + } + return goodsIDs[0], true +} + +func CanonicalURL(goodsID string) string { + return "https://mobile.yangkeduo.com/goods.html?goods_id=" + goodsID +} + +func NewCreateKey() (string, error) { + bytes := make([]byte, 16) + if _, err := rand.Read(bytes); err != nil { + return "", err + } + bytes[6] = (bytes[6] & 0x0f) | 0x40 + bytes[8] = (bytes[8] & 0x3f) | 0x80 + hexValue := hex.EncodeToString(bytes) + return hexValue[0:8] + "-" + hexValue[8:12] + "-" + hexValue[12:16] + "-" + hexValue[16:20] + "-" + hexValue[20:32], nil +} + +func validUUID(value string) bool { + if len(value) != 36 { + return false + } + for index, character := range value { + if index == 8 || index == 13 || index == 18 || index == 23 { + if character != '-' { + return false + } + continue + } + if !(character >= '0' && character <= '9' || character >= 'a' && character <= 'f') { + return false + } + } + return value[14] == '4' && (value[19] == '8' || value[19] == '9' || value[19] == 'a' || value[19] == 'b') +} + +func normalizeMoney(value string) (string, bool) { + parts := strings.Split(value, ".") + if len(parts) > 2 || parts[0] == "" || len(parts) == 2 && (len(parts[1]) == 0 || len(parts[1]) > 2) { + return "", false + } + for _, character := range parts[0] { + if character < '0' || character > '9' { + return "", false + } + } + fraction := "" + if len(parts) == 2 { + fraction = parts[1] + for _, character := range fraction { + if character < '0' || character > '9' { + return "", false + } + } + } + whole := strings.TrimLeft(parts[0], "0") + if whole == "" { + whole = "0" + } + if whole == "0" && strings.Trim(fraction, "0") == "" { + return "", false + } + return whole + "." + (fraction + "00")[:2], true +} diff --git a/admin/internal/tasks/tasks_test.go b/admin/internal/tasks/tasks_test.go new file mode 100644 index 0000000..36dcf82 --- /dev/null +++ b/admin/internal/tasks/tasks_test.go @@ -0,0 +1,300 @@ +package tasks + +import ( + "context" + "database/sql" + "errors" + "path/filepath" + "regexp" + "runtime" + "sync" + "testing" + "time" + + "cmbuyer/admin/internal/migrations" + "cmbuyer/admin/internal/storage/sqlite" +) + +const testKey = "a3c9f507-7473-4fa6-8d71-8786c34c6301" + +func TestValidateNormalizesManualDraft(t *testing.T) { + draft, validation := Validate(Form{ + CreateKey: " " + testKey + " ", + Title: " 夏季上衣 ", + ProductURL: "https://mobile.yangkeduo.com/goods.html?goods_id=937122477375&utm_source=untrusted", + SKUColor: " 黑色CHA(纯棉) ", + SKUSize: " M(建议100-115) ", + Quantity: "2", + MaxTotalPrice: "00012.8", + }) + if !validation.Valid() { + t.Fatalf("Validate errors = %#v", validation) + } + if draft.ID != testKey || draft.GoodsID != "937122477375" || draft.Title != "夏季上衣" || draft.SKUColor != "黑色CHA(纯棉)" || draft.SKUSize != "M(建议100-115)" || draft.Quantity != 2 || draft.MaxTotalPrice != "12.80" { + t.Fatalf("normalized draft = %#v", draft) + } +} + +func TestValidateRejectsInvalidFieldsAndURLs(t *testing.T) { + base := Form{CreateKey: testKey, Title: "title", ProductURL: "https://mobile.yangkeduo.com/goods.html?goods_id=1", SKUColor: "black", SKUSize: "M", Quantity: "1", MaxTotalPrice: "1"} + for name, update := range map[string]func(*Form){ + "empty title": func(form *Form) { form.Title = " " }, + "long color": func(form *Form) { form.SKUColor = string(make([]rune, maxSKUText+1)) }, + "fraction quantity": func(form *Form) { form.Quantity = "1.5" }, + "zero quantity": func(form *Form) { form.Quantity = "0" }, + "too many decimals": func(form *Form) { form.MaxTotalPrice = "1.234" }, + "trailing decimal": func(form *Form) { form.MaxTotalPrice = "1." }, + "zero money": func(form *Form) { form.MaxTotalPrice = "0.00" }, + } { + t.Run(name, func(t *testing.T) { + form := base + update(&form) + if _, validation := Validate(form); validation.Valid() { + t.Fatal("invalid form was accepted") + } + }) + } + + for _, value := range []string{ + "http://mobile.yangkeduo.com/goods.html?goods_id=1", + "https://yangkeduo.com/goods.html?goods_id=1", + "https://mobile.yangkeduo.com:443/goods.html?goods_id=1", + "https://user@mobile.yangkeduo.com/goods.html?goods_id=1", + "https://mobile.yangkeduo.com/goods.html?goods_id=1#fragment", + "https://mobile.yangkeduo.com/goods.html?goods_id=1&goods_id=2", + "https://mobile.yangkeduo.com/goods.html?goods_id=one", + "https://mobile.yangkeduo.com/goods.html?goods_id=%31", + "https://mobile.yangkeduo.com/goods.html?goods_id=1%26goods_id%3D2", + "https://mobile.yangkeduo.com/goods.html?goods_id=1;uin=bad", + "https://mobile.yangkeduo.com/other.html?goods_id=1", + } { + if _, ok := CanonicalGoodsID(value); ok { + t.Fatalf("CanonicalGoodsID accepted %q", value) + } + } +} + +func TestNormalizeMoneyBoundaries(t *testing.T) { + for value, want := range map[string]string{"1": "1.00", "1.2": "1.20", "000.01": "0.01", "999999999999999999": "999999999999999999.00"} { + got, ok := normalizeMoney(value) + if !ok || got != want { + t.Fatalf("normalizeMoney(%q) = (%q, %t), want (%q, true)", value, got, ok, want) + } + } + for _, value := range []string{"0", "0.0", "0.00", "1.", ".1", "1.000", "-1", "1e2", " 1"} { + if got, ok := normalizeMoney(value); ok { + t.Fatalf("normalizeMoney(%q) = %q, want rejection", value, got) + } + } +} + +func TestNewCreateKeyIsUUIDv4(t *testing.T) { + key, err := NewCreateKey() + if err != nil { + t.Fatalf("NewCreateKey: %v", err) + } + if !regexp.MustCompile(`^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$`).MatchString(key) { + t.Fatalf("create key %q is not UUID v4", key) + } +} + +func TestSQLiteStoreRequiresMigratedDatabase(t *testing.T) { + database := openDatabase(t) + if _, err := NewSQLiteStore(database); err == nil { + t.Fatal("NewSQLiteStore accepted an unmigrated database") + } +} + +func TestSQLiteStoreCreatesListsAndHandlesIdempotency(t *testing.T) { + database := migratedDatabase(t) + store, err := NewSQLiteStore(database) + if err != nil { + t.Fatalf("NewSQLiteStore: %v", err) + } + baseTime := time.Date(2026, 8, 4, 9, 0, 0, 0, time.UTC) + call := 0 + store.now = func() time.Time { + result := baseTime.Add(time.Duration(call) * time.Minute) + call++ + return result + } + first := testDraft(testKey, "first") + created, err := store.CreateDraft(context.Background(), first) + if err != nil { + t.Fatalf("create first draft: %v", err) + } + replayed, err := store.CreateDraft(context.Background(), first) + if err != nil { + t.Fatalf("replay first draft: %v", err) + } + if replayed.CreatedAt != created.CreatedAt { + t.Fatalf("replayed CreatedAt = %s, want original %s", replayed.CreatedAt, created.CreatedAt) + } + second := testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "second") + if _, err := store.CreateDraft(context.Background(), second); err != nil { + t.Fatalf("create second draft: %v", err) + } + drafts, err := store.ListDrafts(context.Background()) + if err != nil { + t.Fatalf("list drafts: %v", err) + } + if len(drafts) != 2 || drafts[0].ID != second.ID || drafts[1].ID != first.ID { + t.Fatalf("draft order = %#v, want second then first", drafts) + } + var source, status string + var version int + if err := database.QueryRow(`SELECT source, status, version FROM tasks WHERE id = ?`, first.ID).Scan(&source, &status, &version); err != nil { + t.Fatalf("read stored task: %v", err) + } + if source != "MANUAL" || status != "DRAFT" || version != 1 { + t.Fatalf("stored metadata = (%q, %q, %d)", source, status, version) + } + + conflicting := first + conflicting.Title = "different" + if _, err := store.CreateDraft(context.Background(), conflicting); !errors.Is(err, ErrCreateKeyConflict) { + t.Fatalf("conflicting create error = %v, want ErrCreateKeyConflict", err) + } +} + +func TestSQLiteStoreRollsBackFailedCreate(t *testing.T) { + database := migratedDatabase(t) + store, err := NewSQLiteStore(database) + if err != nil { + t.Fatalf("NewSQLiteStore: %v", err) + } + if _, err := database.Exec(`CREATE TRIGGER reject_task BEFORE INSERT ON tasks BEGIN SELECT RAISE(ABORT, 'reject test insert'); END`); err != nil { + t.Fatalf("create trigger: %v", err) + } + if _, err := store.CreateDraft(context.Background(), testDraft(testKey, "blocked")); err == nil { + t.Fatal("CreateDraft succeeded despite rejecting trigger") + } + drafts, err := store.ListDrafts(context.Background()) + if err != nil { + t.Fatalf("list after failed create: %v", err) + } + if len(drafts) != 0 { + t.Fatalf("failed create persisted drafts: %#v", drafts) + } +} + +func TestSQLiteStoreUsesInsertionOrderForEqualTimesAndFiltersPhase(t *testing.T) { + database := migratedDatabase(t) + store, err := NewSQLiteStore(database) + if err != nil { + t.Fatalf("NewSQLiteStore: %v", err) + } + store.now = func() time.Time { return time.Date(2026, 8, 4, 9, 0, 0, 0, time.UTC) } + first := testDraft(testKey, "first") + second := testDraft("b3c9f507-7473-4fa6-8d71-8786c34c6301", "second") + for _, draft := range []Draft{first, second} { + if _, err := store.CreateDraft(context.Background(), draft); err != nil { + t.Fatalf("create %s: %v", draft.Title, err) + } + } + if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES ('excel-draft', 'EXCEL', 'other', '1', 'black', 'M', 1, '1.00', 'DRAFT', 1, '2026-08-04T10:00:00Z', '2026-08-04T10:00:00Z'), ('manual-pending', 'MANUAL', 'other', '2', 'black', 'M', 1, '1.00', 'PENDING', 1, '2026-08-04T10:00:00Z', '2026-08-04T10:00:00Z')`); err != nil { + t.Fatalf("insert out-of-scope tasks: %v", err) + } + drafts, err := store.ListDrafts(context.Background()) + if err != nil { + t.Fatalf("list drafts: %v", err) + } + if len(drafts) != 2 || drafts[0].ID != second.ID || drafts[1].ID != first.ID { + t.Fatalf("equal-time draft order/filter = %#v, want second then first only", drafts) + } + if _, err := database.Exec(`UPDATE tasks SET status = 'PENDING' WHERE id = ?`, first.ID); err != nil { + t.Fatalf("move draft outside current phase: %v", err) + } + if _, err := store.CreateDraft(context.Background(), first); !errors.Is(err, ErrCreateKeyConflict) { + t.Fatalf("replay of non-DRAFT record error = %v, want conflict", err) + } + third := testDraft("c3c9f507-7473-4fa6-8d71-8786c34c6301", "third") + if _, err := database.Exec(`INSERT INTO tasks (id, source, title, goods_id, sku_color, sku_size, quantity, max_total_price, status, version, created_at, updated_at) VALUES (?, 'EXCEL', ?, ?, ?, ?, ?, ?, 'DRAFT', 1, '2026-08-04T09:00:00Z', '2026-08-04T09:00:00Z')`, third.ID, third.Title, third.GoodsID, third.SKUColor, third.SKUSize, third.Quantity, third.MaxTotalPrice); err != nil { + t.Fatalf("insert same-payload EXCEL record: %v", err) + } + if _, err := store.CreateDraft(context.Background(), third); !errors.Is(err, ErrCreateKeyConflict) { + t.Fatalf("replay of non-MANUAL record error = %v, want conflict", err) + } + if _, err := database.Exec(`UPDATE tasks SET version = 2, source = 'MANUAL' WHERE id = ?`, third.ID); err != nil { + t.Fatalf("change replay record version: %v", err) + } + if _, err := store.CreateDraft(context.Background(), third); !errors.Is(err, ErrCreateKeyConflict) { + t.Fatalf("replay of non-v1 record error = %v, want conflict", err) + } +} + +func TestSQLiteStoreConcurrentIdenticalCreateIsOneDraft(t *testing.T) { + store, err := NewSQLiteStore(migratedDatabase(t)) + if err != nil { + t.Fatalf("NewSQLiteStore: %v", err) + } + const callers = 20 + start := make(chan struct{}) + errors := make(chan error, callers) + results := make(chan Draft, callers) + var group sync.WaitGroup + for range callers { + group.Add(1) + go func() { + defer group.Done() + <-start + draft, err := store.CreateDraft(context.Background(), testDraft(testKey, "same")) + if err != nil { + errors <- err + return + } + results <- draft + }() + } + close(start) + group.Wait() + close(errors) + close(results) + for err := range errors { + t.Fatalf("concurrent create: %v", err) + } + for result := range results { + if result.ID != testKey { + t.Fatalf("concurrent result = %#v", result) + } + } + drafts, err := store.ListDrafts(context.Background()) + if err != nil { + t.Fatalf("list after concurrent create: %v", err) + } + if len(drafts) != 1 || drafts[0].ID != testKey { + t.Fatalf("concurrent creates persisted %#v, want exactly one", drafts) + } +} + +func testDraft(id, title string) Draft { + return Draft{ID: id, Title: title, GoodsID: "937122477375", SKUColor: "black", SKUSize: "M", Quantity: 2, MaxTotalPrice: "12.80"} +} + +func openDatabase(t *testing.T) *sql.DB { + t.Helper() + database, err := sqlite.Open(filepath.Join(t.TempDir(), "tasks.db")) + if err != nil { + t.Fatalf("open database: %v", err) + } + t.Cleanup(func() { _ = database.Close() }) + return database +} + +func migratedDatabase(t *testing.T) *sql.DB { + t.Helper() + database := openDatabase(t) + if err := migrations.Up(context.Background(), database, migrationDirectory(t)); err != nil { + t.Fatalf("migrate database: %v", err) + } + return database +} + +func migrationDirectory(t *testing.T) string { + t.Helper() + _, file, _, ok := runtime.Caller(0) + if !ok { + t.Fatal("locate test source") + } + return filepath.Join(filepath.Dir(file), "..", "..", "migrations") +} diff --git a/admin/internal/transport/webui/templates/tasks.html b/admin/internal/transport/webui/templates/tasks.html index 6bd97d1..999237f 100644 --- a/admin/internal/transport/webui/templates/tasks.html +++ b/admin/internal/transport/webui/templates/tasks.html @@ -6,22 +6,14 @@ 采购任务 · 采购服务 + :root{--bg:#f4f7fb;--surface:#fff;--text:#172033;--muted:#526079;--border:#cfd8e6;--primary:#155eef;--danger:#b42318;--success:#067647;--focus:#ffbf47;font-family:"Segoe UI","Microsoft YaHei UI",system-ui,sans-serif}*{box-sizing:border-box}html{min-width:320px;background:var(--bg)}body{min-height:100dvh;margin:0;color:var(--text);background:var(--bg);font-size:16px;line-height:1.55}button,input{font:inherit}:focus-visible{outline:3px solid var(--focus);outline-offset:3px}.skip{position:fixed;z-index:100;top:8px;left:8px;padding:10px;color:#fff;background:#172033;transform:translateY(-160%)}.skip:focus{transform:translateY(0)}header{display:flex;align-items:center;justify-content:space-between;gap:16px;min-height:64px;padding:10px clamp(16px,4vw,40px);border-bottom:1px solid var(--border);background:var(--surface)}.brand{font-weight:700}.brand b{display:inline-grid;place-items:center;width:32px;height:32px;margin-right:8px;border-radius:8px;background:var(--primary);color:#fff;font-size:.82rem}.logout,.button{display:inline-flex;align-items:center;justify-content:center;min-height:44px;padding:9px 14px;border:1px solid var(--border);border-radius:8px;color:var(--text);background:#fff;font-weight:700;text-decoration:none;cursor:pointer}.button.primary{border-color:var(--primary);background:var(--primary);color:#fff}.button:disabled,.filter input:disabled{opacity:.5;cursor:not-allowed}main{width:min(100% - 32px,1200px);margin:32px auto}.toolbar{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:16px}.toolbar-actions,.filters,.actions{display:flex;flex-wrap:wrap;gap:10px}.muted,.placeholder{color:var(--muted)}.filters{align-items:end;margin:0 0 16px}.filters label{display:grid;gap:4px;font-weight:700}.filters input{min-height:44px;min-width:180px;padding:8px 10px;border:1px solid var(--border);border-radius:8px;background:#fff}.table-wrap{overflow-x:auto;border:1px solid var(--border);border-radius:12px;background:var(--surface)}table{width:100%;min-width:880px;border-collapse:collapse}th,td{padding:12px 14px;border-bottom:1px solid var(--border);text-align:left;vertical-align:top}th{background:#f8fafc;font-size:.88rem}td a{color:#124cc5;font-weight:700;text-underline-offset:3px}.status{display:inline-block;padding:3px 8px;border-radius:999px;background:#eaf1ff;color:#173d8f;font-size:.85rem;font-weight:700}.empty,.success{padding:20px;border:1px solid var(--border);border-radius:12px;background:var(--surface)}.success{margin:0 0 16px;border-color:#9dd9b8;background:#ecfdf3;color:var(--success)}.modal-scrim{position:fixed;z-index:20;inset:0;background:rgba(23,32,51,.52)}dialog[open]{position:fixed;z-index:30;top:50%;left:50%;width:min(calc(100% - 24px),640px);max-height:calc(100dvh - 24px);margin:0;padding:28px;overflow-y:auto;border:1px solid var(--border);border-radius:14px;box-shadow:0 18px 48px rgba(23,32,51,.24);transform:translate(-50%,-50%);background:var(--surface)}.form-page{width:min(100% - 32px,640px);margin:32px auto;padding:28px;border:1px solid var(--border);border-radius:14px;background:var(--surface)}.form-grid{display:grid;gap:16px}.field label{display:block;margin-bottom:6px;font-weight:700}.required{color:var(--danger)}.field input{width:100%;min-height:44px;padding:10px 12px;border:1px solid #9ba9bc;border-radius:8px}.field input[aria-invalid=true]{border-color:var(--danger)}.error{margin:5px 0 0;color:var(--danger);font-size:.9rem}.summary{margin:0 0 16px;padding:12px;border-left:4px solid var(--danger);background:#fef3f2;color:var(--danger)}.summary p{margin:0}.summary ul{margin:8px 0 0;padding-left:20px}.summary a{color:inherit}.sr-only{position:absolute;width:1px;height:1px;padding:0;margin:-1px;overflow:hidden;clip:rect(0,0,0,0);white-space:nowrap;border:0}@media(max-width:420px){main,.form-page{width:calc(100% - 24px);margin:24px auto}.toolbar{align-items:stretch;flex-direction:column}.toolbar-actions,.toolbar .button{width:100%}.toolbar-actions .button{flex:1}.filters{align-items:stretch;flex-direction:column}.filters input,.filters .button{width:100%}}@media(prefers-reduced-motion:reduce){*,*::before,*::after{transition-duration:.01ms!important;animation-duration:.01ms!important}} - -
采购服务
-

采购任务

任务功能正在准备中。

当前页面仅用于验证管理员会话。

+ +
采购服务
+ {{if .FullPage}}
{{template "form" .}}
{{else}}

采购任务

只显示待开始的手工任务。

创建任务
{{if .Success}}

任务已创建，已显示在列表首行。

{{end}}{{if .Drafts}}
{{range .Drafts}}{{end}}
标题颜色分类尺码价格上限数量采购结果状态创建时间
{{.Title}}{{.SKUColor}}{{.SKUSize}}¥{{.MaxTotalPrice}}{{.Quantity}}—待开始
{{else}}

还没有待开始任务

创建一条手工任务后会显示在这里。

{{end}}
{{if .OpenForm}}{{template "form" .}}{{end}}{{end}} {{end}} +{{define "form"}}

创建采购任务

保存后仅生成待开始任务，不会执行其他动作。

{{if .Errors}}{{end}}
{{template "field" (list "title" "任务名称" .Form.Title .Errors .FocusField)}}{{template "field" (list "product_url" "商品链接" .Form.ProductURL .Errors .FocusField)}}{{template "field" (list "sku_color" "颜色分类" .Form.SKUColor .Errors .FocusField)}}{{template "field" (list "sku_size" "尺码" .Form.SKUSize .Errors .FocusField)}}{{template "field" (list "quantity" "数量" .Form.Quantity .Errors .FocusField)}}{{template "field" (list "max_total_price" "价格上限" .Form.MaxTotalPrice .Errors .FocusField)}}
取消
{{end}} +{{define "field"}}{{$name:=index . 0}}{{$label:=index . 1}}{{$value:=index . 2}}{{$errors:=index . 3}}{{$focus:=index . 4}}
{{with index $errors $name}}

{{.}}

{{end}}
{{end}} diff --git a/admin/internal/transport/webui/webui.go b/admin/internal/transport/webui/webui.go index 960e7b2..3ca957f 100644 --- a/admin/internal/transport/webui/webui.go +++ b/admin/internal/transport/webui/webui.go @@ -5,12 +5,14 @@ import ( "embed" "html/template" "io" + + "cmbuyer/admin/internal/tasks" ) //go:embed templates/*.html var templateFiles embed.FS -var templates = template.Must(template.New("webui").ParseFS(templateFiles, "templates/*.html")) +var templates = template.Must(template.New("webui").Funcs(template.FuncMap{"list": func(values ...any) []any { return values }}).ParseFS(templateFiles, "templates/*.html")) // LoginData 是登录页面所需的非敏感展示数据。 type LoginData struct { @@ -20,9 +22,16 @@ type LoginData struct { Error string } -// TasksData 是当前受保护任务空壳所需的数据。任务字段将在后续任务实现。 +// TasksData 是受保护的 DRAFT 建单与列表页面所需数据。 type TasksData struct { - CSRFToken string + CSRFToken string + Drafts []tasks.Draft + Form tasks.Form + Errors tasks.Errors + OpenForm bool + FullPage bool + FocusField string + Success bool } // RenderLogin 写入登录页。 @@ -30,7 +39,7 @@ func RenderLogin(writer io.Writer, data LoginData) error { return templates.ExecuteTemplate(writer, "login.html", data) } -// RenderTasks 写入登录后的受保护空壳。 +// RenderTasks 写入登录后的受保护任务页。 func RenderTasks(writer io.Writer, data TasksData) error { return templates.ExecuteTemplate(writer, "tasks.html", data) } diff --git a/docs/tasks/T-202.md b/docs/tasks/T-202.md index ac53125..1336b7d 100644 --- a/docs/tasks/T-202.md +++ b/docs/tasks/T-202.md @@ -3,7 +3,7 @@ id: T-202 title: 手工建单与 DRAFT 基础列表 phase: 2 deps: [T-201, T-004, T-005] -status: DOING +status: DONE created: 2026-08-04 vikunja_task_id: 27 context_ref: 1c35155 @@ -21,7 +21,7 @@ write_paths: - admin/README.md --- - + ## 问题 / 背景 T-201 已提供管理员会话；T-004 已提供 tasks 表。根据 T-010 加速门禁，T-103 尚未完成时只允许实现不启动试选的 DRAFT 手工建单与基础列表。 @@ -46,7 +46,9 @@ F-001、US-001、IX-002；GET /tasks、GET /tasks/new、POST /tasks；沿用已 ## 执行记录 -（暂无） +### 2026-08-04T08:30:47Z · ila + +已完成：DRAFT 手工建单与基础列表；已验证链接、金额、CSRF、幂等、SQLite 并发和 SSR 无障碍，Go 与上下文门禁均通过。 ## 边界