jack/digital-psychology
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ECR-017): AskOperations 问答会话只读并 Closed

Browse Source 
新增 admin.ask.read、GET /admin/ask/threads*（AskSessionView）与 admin-h5「问答」页；禁改消息/UGC/真支付。

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
jackyu66git
2026-08-07 18:39:37 +08:00
co-authored by Cursor
parent 1c157a0e46
commit 00a798bd85
33 changed files with 722 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/admin-h5/src/api/client.ts
+25
View File
@@ -196,6 +196,31 @@ export const adminApi = {
`/redemption-batches/${batchId}/codes`,
),
disableRedemptionCode: (id: string) => request<{ ok: boolean }>('POST', `/redemption-codes/${id}/disable`),
askThreads: (userId = '') => {
const q = userId ? `?user_id=${encodeURIComponent(userId)}` : ''
return request<{
items: Array<{
id: string
user_id: string
profile_id: string
scene?: string
message_count: number
created_at: string
updated_at: string
}>
}>('GET', `/ask/threads${q}`)
},
askThread: (id: string) =>
request<{
id: string
user_id: string
profile_id: string
scene?: string
message_count: number
created_at: string
updated_at: string
messages: Array<{ id: string; role: string; content: string; created_at: string }>
}>('GET', `/ask/threads/${id}`),
orders: () =>
request<{
items: Array<{
apps/admin-h5/src/layouts/AdminShell.vue
+1
View File
@@ -30,6 +30,7 @@ async function onLogout() {
<RouterLink to="/users">用户</RouterLink>
<RouterLink to="/plans">套餐</RouterLink>
<RouterLink to="/codes">兑换码</RouterLink>
<RouterLink to="/ask">问答</RouterLink>
<RouterLink to="/orders">订单</RouterLink>
<RouterLink to="/audit">审计</RouterLink>
</nav>
apps/admin-h5/src/pages/AskPage.vue
+127
View File
@@ -0,0 +1,127 @@
<script setup lang="ts">
import { onMounted, ref } from 'vue'
import { RouterLink } from 'vue-router'
import { adminApi } from '@/api/client'
type Thread = Awaited<ReturnType<typeof adminApi.askThreads>>['items'][number]
type Detail = Awaited<ReturnType<typeof adminApi.askThread>>
const loading = ref(false)
const error = ref('')
const items = ref<Thread[]>([])
const selected = ref<Detail | null>(null)
const detailErr = ref('')
const detailLoading = ref(false)
async function load() {
loading.value = true
error.value = ''
try {
const res = await adminApi.askThreads()
items.value = res.items || []
} catch (e) {
error.value = e instanceof Error ? e.message : '加载失败'
} finally {
loading.value = false
}
}
async function openThread(id: string) {
detailLoading.value = true
detailErr.value = ''
selected.value = null
try {
selected.value = await adminApi.askThread(id)
} catch (e) {
detailErr.value = e instanceof Error ? e.message : '详情失败'
} finally {
detailLoading.value = false
}
}
function fmtTime(iso?: string) {
if (!iso) return '—'
try {
return new Date(iso).toLocaleString('zh-CN')
} catch {
return iso
}
}
onMounted(load)
</script>
<template>
<section>
<h1>问答会话</h1>
<p class="muted">只读 AskSessionView · 不可改写消息</p>
<p v-if="loading" class="muted">加载中…</p>
<p v-else-if="error" class="err">{{ error }}</p>
<div v-else class="layout">
<div class="card list">
<p v-if="!items.length" class="muted">暂无会话</p>
<table v-else>
<thead>
<tr><th>更新</th><th>场景</th><th>消息</th><th>用户</th><th></th></tr>
</thead>
<tbody>
<tr v-for="t in items" :key="t.id">
<td>{{ fmtTime(t.updated_at) }}</td>
<td>{{ t.scene || '—' }}</td>
<td>{{ t.message_count }}</td>
<td>
<RouterLink :to="`/users/${t.user_id}`">{{ t.user_id.slice(0, 8) }}…</RouterLink>
</td>
<td><button class="btn" type="button" @click="openThread(t.id)">查看</button></td>
</tr>
</tbody>
</table>
</div>
<div class="card detail">
<h2>会话详情</h2>
<p v-if="detailLoading" class="muted">加载中…</p>
<p v-else-if="detailErr" class="err">{{ detailErr }}</p>
<template v-else-if="selected">
<p class="meta">
{{ selected.scene || '—' }} · {{ selected.message_count }} 条 ·
<RouterLink :to="`/users/${selected.user_id}`">用户</RouterLink>
</p>
<ul class="msgs">
<li v-for="m in selected.messages" :key="m.id" :class="m.role">
<span class="role">{{ m.role }}</span>
<p>{{ m.content }}</p>
<time>{{ fmtTime(m.created_at) }}</time>
</li>
</ul>
</template>
<p v-else class="muted">选择左侧会话查看消息</p>
</div>
</div>
</section>
</template>
<style scoped>
h1 { margin: 0 0 0.35rem; font-size: 1.35rem; }
h2 { margin: 0 0 0.6rem; font-size: 1.05rem; }
.layout {
display: grid;
grid-template-columns: 1.1fr 1fr;
gap: 1rem;
margin-top: 1rem;
}
.list table { width: 100%; font-size: 0.88rem; }
.meta { color: var(--muted); font-size: 0.85rem; }
.msgs { list-style: none; margin: 0.75rem 0 0; padding: 0; display: flex; flex-direction: column; gap: 0.65rem; }
.msgs li {
border: 1px solid var(--line);
border-radius: 10px;
padding: 0.55rem 0.7rem;
}
.msgs .role { font-size: 0.75rem; color: var(--muted); text-transform: uppercase; }
.msgs p { margin: 0.25rem 0; white-space: pre-wrap; word-break: break-word; }
.msgs time { font-size: 0.75rem; color: var(--muted); }
.msgs .assistant { background: rgba(255, 244, 242, 0.6); }
@media (max-width: 900px) {
.layout { grid-template-columns: 1fr; }
}
</style>
apps/admin-h5/src/router/index.ts
+1
View File
@@ -17,6 +17,7 @@ const router = createRouter({
{ path: 'orders', name: 'orders', component: () => import('@/pages/OrdersPage.vue') },
{ path: 'plans', name: 'plans', component: () => import('@/pages/MembershipPlansPage.vue') },
{ path: 'codes', name: 'codes', component: () => import('@/pages/RedemptionPage.vue') },
{ path: 'ask', name: 'ask', component: () => import('@/pages/AskPage.vue') },
{ path: 'audit', name: 'audit', component: () => import('@/pages/AuditPage.vue') },
],
},
apps/api/internal/handler/admin.go
+1
View File
@@ -47,6 +47,7 @@ func (h *AdminHandler) Register(api *gin.RouterGroup) {
h.registerMembershipPlans(authed)
h.registerRedemption(authed)
h.registerInsight(authed)
h.registerAskOps(authed)
}
func (h *AdminHandler) Login(c *gin.Context) {
apps/api/internal/handler/admin_ask_ops.go
+57
View File
@@ -0,0 +1,57 @@
package handler
import (
"errors"
"net/http"
"strconv"
"github.com/gin-gonic/gin"
"github.com/google/uuid"
"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
"github.com/yuxingu/digital-psychology/apps/api/internal/service/admin"
"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
)
func (h *AdminHandler) registerAskOps(authed *gin.RouterGroup) {
authed.GET("/ask/threads", middleware.RequireAdminPermission(h.Svc, admin.PermAskRead), h.ListAskThreads)
authed.GET("/ask/threads/:id", middleware.RequireAdminPermission(h.Svc, admin.PermAskRead), h.GetAskThread)
}
func (h *AdminHandler) ListAskThreads(c *gin.Context) {
limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
var userID *uuid.UUID
if q := c.Query("user_id"); q != "" {
id, err := uuid.Parse(q)
if err != nil {
response.Fail(c, http.StatusBadRequest, 40002, "invalid user_id")
return
}
userID = &id
}
items, err := h.Svc.ListAskSessions(c.Request.Context(), userID, limit, offset)
if err != nil {
response.Fail(c, http.StatusInternalServerError, 50019, "list ask threads failed")
return
}
response.OK(c, gin.H{"items": items})
}
func (h *AdminHandler) GetAskThread(c *gin.Context) {
id, err := uuid.Parse(c.Param("id"))
if err != nil {
response.Fail(c, http.StatusBadRequest, 40002, "invalid thread id")
return
}
detail, err := h.Svc.GetAskSessionDetail(c.Request.Context(), id)
if errors.Is(err, admin.ErrAskThreadNotFound) {
response.Fail(c, http.StatusNotFound, 40402, "ask thread not found")
return
}
if err != nil {
response.Fail(c, http.StatusInternalServerError, 50020, "get ask thread failed")
return
}
response.OK(c, detail)
}
apps/api/internal/integration/ask_ops_test.go
+115
View File
@@ -0,0 +1,115 @@
package integration_test
import (
"context"
"encoding/json"
"fmt"
"net/http"
"testing"
"time"
"github.com/google/uuid"
"golang.org/x/crypto/bcrypt"
)
func TestAskOperations(t *testing.T) {
r, pool := setupAPIPool(t)
ctx := context.Background()
tok := adminLogin(t, r, "admin", "change-me")
_, code := doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads", nil, "")
if code != http.StatusUnauthorized {
t.Fatalf("expected 401, got %d", code)
}
limitedRoleID := uuid.New()
_, err := pool.Exec(ctx, `
INSERT INTO admin_roles(id, name, system) VALUES ($1, $2, false)`,
limitedRoleID, "ask_lim_"+limitedRoleID.String()[:8])
if err != nil {
t.Fatalf("insert role: %v", err)
}
_, err = pool.Exec(ctx, `
INSERT INTO admin_role_permissions(role_id, code) VALUES ($1,'admin.users.read')`, limitedRoleID)
if err != nil {
t.Fatal(err)
}
hash, err := bcrypt.GenerateFromPassword([]byte("limited-pass"), bcrypt.DefaultCost)
if err != nil {
t.Fatal(err)
}
limitedUser := fmt.Sprintf("asklim_%d", time.Now().UnixNano())
_, err = pool.Exec(ctx, `
INSERT INTO admin_accounts(username, password_hash, role_id)
VALUES ($1,$2,$3)`, limitedUser, string(hash), limitedRoleID)
if err != nil {
t.Fatal(err)
}
t.Cleanup(func() {
_, _ = pool.Exec(ctx, `DELETE FROM admin_accounts WHERE username=$1`, limitedUser)
_, _ = pool.Exec(ctx, `DELETE FROM admin_roles WHERE id=$1`, limitedRoleID)
})
limTok := adminLogin(t, r, limitedUser, "limited-pass")
_, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads", nil, limTok)
if code != http.StatusForbidden {
t.Fatalf("expected 403 without ask.read, got %d", code)
}
key := mustRegister(t, r)
env, key := doJSON(t, r, http.MethodPost, "/api/v1/profiles", map[string]any{
"relation": "self", "birth_date": "1992-06-01", "display_name": "问",
}, key)
profileID := decodeData[map[string]any](t, env.Data)["id"].(string)
env, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads", map[string]any{
"profile_id": profileID, "scene": "self",
}, key)
threadID := decodeData[map[string]any](t, env.Data)["id"].(string)
_, key = doJSON(t, r, http.MethodPost, "/api/v1/ask/threads/"+threadID+"/messages", map[string]any{
"content": "运营可读吗",
}, key)
start := time.Now()
env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads", nil, tok)
if code != 200 || env.Code != 0 {
t.Fatalf("list http=%d code=%d msg=%s", code, env.Code, env.Message)
}
if time.Since(start) > 500*time.Millisecond {
t.Fatalf("list too slow: %v", time.Since(start))
}
var list struct {
Items []struct {
ID string `json:"id"`
MessageCount int `json:"message_count"`
} `json:"items"`
}
_ = json.Unmarshal(env.Data, &list)
found := false
for _, it := range list.Items {
if it.ID == threadID && it.MessageCount >= 1 {
found = true
break
}
}
if !found {
t.Fatalf("expected thread %s in list: %#v", threadID, list.Items)
}
env, code = doAdminJSON(t, r, http.MethodGet, "/api/v1/admin/ask/threads/"+threadID, nil, tok)
if code != 200 {
t.Fatalf("detail http=%d msg=%s", code, env.Message)
}
var detail struct {
Messages []struct {
Role string `json:"role"`
Content string `json:"content"`
} `json:"messages"`
}
_ = json.Unmarshal(env.Data, &detail)
if len(detail.Messages) < 2 {
t.Fatalf("expected user+assistant, got %#v", detail.Messages)
}
_ = key
}
apps/api/internal/repository/ask_ops_repo.go
+104
View File
@@ -0,0 +1,104 @@
package repository
import (
"context"
"errors"
"time"
"github.com/google/uuid"
"github.com/jackc/pgx/v5"
)
// AskSessionView is ops read meta for one ask thread.
type AskSessionView struct {
ID uuid.UUID `json:"id"`
UserID uuid.UUID `json:"user_id"`
ProfileID uuid.UUID `json:"profile_id"`
Scene *string `json:"scene,omitempty"`
MessageCount int `json:"message_count"`
CreatedAt time.Time `json:"created_at"`
UpdatedAt time.Time `json:"updated_at"`
}
// AskMessageView is a read-only message row for ops.
type AskMessageView struct {
ID uuid.UUID `json:"id"`
Role string `json:"role"`
Content string `json:"content"`
CreatedAt time.Time `json:"created_at"`
}
// ListAskSessions returns recent ask threads (optional user filter).
func (r *AdminRepo) ListAskSessions(ctx context.Context, userID *uuid.UUID, limit, offset int) ([]AskSessionView, error) {
if limit <= 0 || limit > 100 {
limit = 20
}
if offset < 0 {
offset = 0
}
rows, err := r.Pool.Query(ctx, `
SELECT t.id, t.user_id, t.profile_id, t.scene, t.created_at, t.updated_at,
(SELECT count(*)::int FROM ask_messages m
WHERE m.thread_id=t.id AND m.deleted_at IS NULL) AS message_count
FROM ask_threads t
WHERE t.deleted_at IS NULL
AND ($1::uuid IS NULL OR t.user_id=$1)
ORDER BY t.updated_at DESC
LIMIT $2 OFFSET $3`, userID, limit, offset)
if err != nil {
return nil, err
}
defer rows.Close()
var out []AskSessionView
for rows.Next() {
var s AskSessionView
if err := rows.Scan(
&s.ID, &s.UserID, &s.ProfileID, &s.Scene, &s.CreatedAt, &s.UpdatedAt, &s.MessageCount,
); err != nil {
return nil, err
}
out = append(out, s)
}
return out, rows.Err()
}
// GetAskSession loads one thread meta or ErrNoRows.
func (r *AdminRepo) GetAskSession(ctx context.Context, threadID uuid.UUID) (*AskSessionView, error) {
var s AskSessionView
err := r.Pool.QueryRow(ctx, `
SELECT t.id, t.user_id, t.profile_id, t.scene, t.created_at, t.updated_at,
(SELECT count(*)::int FROM ask_messages m
WHERE m.thread_id=t.id AND m.deleted_at IS NULL) AS message_count
FROM ask_threads t
WHERE t.id=$1 AND t.deleted_at IS NULL`, threadID,
).Scan(&s.ID, &s.UserID, &s.ProfileID, &s.Scene, &s.CreatedAt, &s.UpdatedAt, &s.MessageCount)
if errors.Is(err, pgx.ErrNoRows) {
return nil, err
}
if err != nil {
return nil, err
}
return &s, nil
}
// ListAskMessagesForAdmin returns messages oldest-first.
func (r *AdminRepo) ListAskMessagesForAdmin(ctx context.Context, threadID uuid.UUID) ([]AskMessageView, error) {
rows, err := r.Pool.Query(ctx, `
SELECT id, role, content, created_at
FROM ask_messages
WHERE thread_id=$1 AND deleted_at IS NULL
ORDER BY created_at ASC`, threadID)
if err != nil {
return nil, err
}
defer rows.Close()
var out []AskMessageView
for rows.Next() {
var m AskMessageView
if err := rows.Scan(&m.ID, &m.Role, &m.Content, &m.CreatedAt); err != nil {
return nil, err
}
out = append(out, m)
}
return out, rows.Err()
}
apps/api/internal/service/admin/ask_ops.go
+50
View File
@@ -0,0 +1,50 @@
package admin
import (
"context"
"errors"
"github.com/google/uuid"
"github.com/jackc/pgx/v5"
"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
)
// AskSessionDetail is AskSessionView plus messages.
type AskSessionDetail struct {
repository.AskSessionView
Messages []repository.AskMessageView `json:"messages"`
}
var ErrAskThreadNotFound = errString("ask thread not found")
// ListAskSessions lists AskSessionView rows.
func (s *Service) ListAskSessions(ctx context.Context, userID *uuid.UUID, limit, offset int) ([]repository.AskSessionView, error) {
items, err := s.Repo.ListAskSessions(ctx, userID, limit, offset)
if err != nil {
return nil, err
}
if items == nil {
items = []repository.AskSessionView{}
}
return items, nil
}
// GetAskSessionDetail loads meta + messages.
func (s *Service) GetAskSessionDetail(ctx context.Context, threadID uuid.UUID) (*AskSessionDetail, error) {
view, err := s.Repo.GetAskSession(ctx, threadID)
if errors.Is(err, pgx.ErrNoRows) {
return nil, ErrAskThreadNotFound
}
if err != nil {
return nil, err
}
msgs, err := s.Repo.ListAskMessagesForAdmin(ctx, threadID)
if err != nil {
return nil, err
}
if msgs == nil {
msgs = []repository.AskMessageView{}
}
return &AskSessionDetail{AskSessionView: *view, Messages: msgs}, nil
}
apps/api/internal/service/admin/rbac.go
+2
View File
@@ -24,6 +24,7 @@ const (
PermMembershipPlansWrite = "admin.membership.plans.write"
PermMembershipCodesRead = "admin.membership.codes.read"
PermMembershipCodesWrite = "admin.membership.codes.write"
PermAskRead = "admin.ask.read"
)
var knownPermissions = map[string]struct{}{
@@ -32,6 +33,7 @@ var knownPermissions = map[string]struct{}{
PermContentWrite: {}, PermRolesRead: {}, PermRolesWrite: {},
PermUsersStatusWrite: {}, PermMembershipPlansRead: {}, PermMembershipPlansWrite: {},
PermMembershipCodesRead: {}, PermMembershipCodesWrite: {},
PermAskRead: {},
}
var (
apps/api/migrations/000019_ask_ops_read.down.sql
+3
View File
@@ -0,0 +1,3 @@
-- ECR-017 down
DELETE FROM admin_role_permissions WHERE code = 'admin.ask.read';
apps/api/migrations/000019_ask_ops_read.up.sql
+7
View File
@@ -0,0 +1,7 @@
-- ECR-017 AskOperations: admin.ask.read
INSERT INTO admin_role_permissions(role_id, code)
SELECT r.id, 'admin.ask.read'
FROM admin_roles r
WHERE r.name = 'super_admin'
ON CONFLICT DO NOTHING;