fix(product-suite): validate item id before generation

app/image_studio.py

@@ -4,6 +4,7 @@ from __future__ import annotations
 
 import json
 import os
+import unicodedata
 import uuid
 from contextlib import contextmanager
 from dataclasses import dataclass
@@ -253,15 +254,27 @@ def _db_path(path=None, config=None) -> str:
     return path or appconfig.db_path(config)
 
 
-def _normalize_item_id(item_id) -> str:
+def normalize_item_id_input(item_id) -> str:
+    """Normalize product ID input without accepting non-numeric formal IDs."""
+
     text = str(item_id or "").strip()
+    return "".join(
+        character
+        for character in text
+        if unicodedata.category(character) != "Cf"
+    ).strip()
+
+
+def _normalize_item_id(item_id) -> str:
+    text = normalize_item_id_input(item_id)
     if not text:
         raise ImageStudioError("商品ID不能为空")
     return text
 
 
 def is_formal_item_id(item_id) -> bool:
-    return str(item_id or "").strip().isdigit()
+    text = normalize_item_id_input(item_id)
+    return bool(text) and all("0" <= character <= "9" for character in text)
 
 
 def is_draft_project(project) -> bool:
@@ -404,7 +417,7 @@ def get_project(project_id, path=None, conn=None, include_deleted=False):
 
 def get_project_by_account_item(account_alias, item_id, path=None, conn=None, include_deleted=False):
     clauses = ["account_alias = ?", "item_id = ?"]
-    params = [str(account_alias).strip(), str(item_id).strip()]
+    params = [str(account_alias).strip(), normalize_item_id_input(item_id)]
     if not include_deleted:
         clauses.append("deleted_at IS NULL")
     sql = "SELECT * FROM image_studio_projects WHERE " + " AND ".join(clauses)
@@ -431,7 +444,7 @@ def create_or_get_project(
         account_name=account_name,
         account_slug=account_slug,
     )
-    item = str(item_id or _get(account, "item_id") or "").strip()
+    item = normalize_item_id_input(item_id or _get(account, "item_id") or "")
     if not item:
         raise db.DbError("AI工场项目缺少商品ID")
     now = _now()
@@ -535,7 +548,7 @@ def create_draft_project(
 def bind_draft_project(project_id, item_id, path=None, conn=None):
     """Bind one active draft to a formal numeric item ID without moving its files."""
 
-    item = str(item_id or "").strip()
+    item = normalize_item_id_input(item_id)
     if not is_formal_item_id(item):
         raise ImageStudioError("正式商品ID必须是数字")
     with _connection(conn, path) as database: