feat(ops): ECR-007 行为分析与 ECR-008 内容运营后台

落地埋点 ingest/数据看板、首页宫格 CMS 与测评上下架；含账号引导、问答流式与免责声明去重，以及 review P1 审计同事务修复。

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/internal/handler/admin.go

@@ -10,12 +10,14 @@ import (
 
 	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
 	"github.com/yuxingu/digital-psychology/apps/api/internal/service/admin"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/analytics"
 	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
 )
 
 // AdminHandler serves /api/v1/admin/* (no DeviceAuth).
 type AdminHandler struct {
-	Svc *admin.Service
+	Svc       *admin.Service
+	Analytics *analytics.Service
 }
 
 // Register mounts public login + authed admin routes.
@@ -27,11 +29,19 @@ func (h *AdminHandler) Register(api *gin.RouterGroup) {
 	authed.Use(middleware.AdminAuth(h.Svc))
 	authed.POST("/auth/logout", h.Logout)
 	authed.GET("/me", h.Me)
+	authed.GET("/stats", h.Stats)
 	authed.GET("/users", h.ListUsers)
 	authed.GET("/users/:id", h.GetUser)
 	authed.POST("/users/:id/membership/grant", h.GrantMembership)
+	authed.POST("/users/:id/ask-quota/grant", h.GrantAskQuota)
 	authed.GET("/orders", h.ListOrders)
 	authed.GET("/audit-logs", h.ListAudit)
+	authed.GET("/analytics/overview", h.AnalyticsOverview)
+	authed.GET("/analytics/pages", h.AnalyticsPages)
+	authed.GET("/analytics/exits", h.AnalyticsExits)
+	authed.GET("/analytics/clicks", h.AnalyticsClicks)
+	authed.GET("/analytics/funnel", h.AnalyticsFunnel)
+	h.registerContent(authed)
 }
 
 func (h *AdminHandler) Login(c *gin.Context) {
@@ -75,6 +85,15 @@ func (h *AdminHandler) Me(c *gin.Context) {
 	response.OK(c, me)
 }
 
+func (h *AdminHandler) Stats(c *gin.Context) {
+	stats, err := h.Svc.DashboardStats(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50017, "stats failed")
+		return
+	}
+	response.OK(c, stats)
+}
+
 func (h *AdminHandler) ListUsers(c *gin.Context) {
 	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
 	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
@@ -135,6 +154,38 @@ func (h *AdminHandler) GrantMembership(c *gin.Context) {
 	response.OK(c, gin.H{"ok": true})
 }
 
+func (h *AdminHandler) GrantAskQuota(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	userID, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40002, "invalid user id")
+		return
+	}
+	var body admin.GrantAskQuotaInput
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40005, "delta required")
+		return
+	}
+	left, err := h.Svc.GrantAskQuota(c.Request.Context(), adminID, userID, body.Delta)
+	if err != nil {
+		if errors.Is(err, admin.ErrInvalidAskDelta) {
+			response.Fail(c, http.StatusBadRequest, 40006, "invalid delta")
+			return
+		}
+		if errors.Is(err, admin.ErrUserNotFound) {
+			response.Fail(c, http.StatusNotFound, 40401, "user not found")
+			return
+		}
+		response.Fail(c, http.StatusInternalServerError, 50018, "grant ask quota failed")
+		return
+	}
+	response.OK(c, gin.H{"ok": true, "ask_paid_quota_left": left})
+}
+
 func (h *AdminHandler) ListOrders(c *gin.Context) {
 	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
 	offset, _ := strconv.Atoi(c.DefaultQuery("offset", "0"))
@@ -156,3 +207,96 @@ func (h *AdminHandler) ListAudit(c *gin.Context) {
 	}
 	response.OK(c, gin.H{"items": items})
 }
+
+func (h *AdminHandler) AnalyticsOverview(c *gin.Context) {
+	from, to, err := analytics.ParseDayRange(c.Query("from"), c.Query("to"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40030, "invalid from/to")
+		return
+	}
+	if !h.requireAnalytics(c) {
+		return
+	}
+	data, err := h.Analytics.Overview(c.Request.Context(), from, to)
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50022, "overview failed")
+		return
+	}
+	response.OK(c, data)
+}
+
+func (h *AdminHandler) AnalyticsPages(c *gin.Context) {
+	from, to, err := analytics.ParseDayRange(c.Query("from"), c.Query("to"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40030, "invalid from/to")
+		return
+	}
+	if !h.requireAnalytics(c) {
+		return
+	}
+	items, err := h.Analytics.Pages(c.Request.Context(), from, to)
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50023, "pages failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) AnalyticsExits(c *gin.Context) {
+	from, to, err := analytics.ParseDayRange(c.Query("from"), c.Query("to"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40030, "invalid from/to")
+		return
+	}
+	if !h.requireAnalytics(c) {
+		return
+	}
+	items, err := h.Analytics.Exits(c.Request.Context(), from, to)
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50024, "exits failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) AnalyticsClicks(c *gin.Context) {
+	from, to, err := analytics.ParseDayRange(c.Query("from"), c.Query("to"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40030, "invalid from/to")
+		return
+	}
+	if !h.requireAnalytics(c) {
+		return
+	}
+	items, err := h.Analytics.Clicks(c.Request.Context(), from, to)
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50025, "clicks failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) AnalyticsFunnel(c *gin.Context) {
+	from, to, err := analytics.ParseDayRange(c.Query("from"), c.Query("to"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40030, "invalid from/to")
+		return
+	}
+	if !h.requireAnalytics(c) {
+		return
+	}
+	steps, err := h.Analytics.Funnel(c.Request.Context(), from, to)
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50026, "funnel failed")
+		return
+	}
+	response.OK(c, gin.H{"steps": steps})
+}
+
+func (h *AdminHandler) requireAnalytics(c *gin.Context) bool {
+	if h.Analytics == nil {
+		response.Fail(c, http.StatusInternalServerError, 50021, "analytics unavailable")
+		return false
+	}
+	return true
+}

apps/api/internal/handler/admin_content.go

@@ -0,0 +1,96 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/admin"
+	homesvc "github.com/yuxingu/digital-psychology/apps/api/internal/service/home"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+func (h *AdminHandler) registerContent(authed *gin.RouterGroup) {
+	authed.GET("/home/tools", h.ListHomeTools)
+	authed.PUT("/home/tools", h.ReplaceHomeTools)
+	authed.GET("/scales", h.ListScales)
+	authed.PATCH("/scales/:id", h.PatchScale)
+}
+
+func (h *AdminHandler) ListHomeTools(c *gin.Context) {
+	items, err := h.Svc.ListHomeTools(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50031, "list home tools failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) ReplaceHomeTools(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	var body struct {
+		Items []homesvc.ReplaceInput `json:"items"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40040, "invalid body")
+		return
+	}
+	if err := h.Svc.ReplaceHomeTools(c.Request.Context(), adminID, body.Items); err != nil {
+		if errors.Is(err, homesvc.ErrInvalidTools) || errors.Is(err, homesvc.ErrTooManyTools) {
+			response.Fail(c, http.StatusBadRequest, 40041, err.Error())
+			return
+		}
+		response.Fail(c, http.StatusInternalServerError, 50032, "replace home tools failed")
+		return
+	}
+	response.OK(c, gin.H{"ok": true})
+}
+
+func (h *AdminHandler) ListScales(c *gin.Context) {
+	items, err := h.Svc.ListScalesAdmin(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50033, "list scales failed")
+		return
+	}
+	response.OK(c, gin.H{"items": items})
+}
+
+func (h *AdminHandler) PatchScale(c *gin.Context) {
+	adminID, ok := middleware.AdminIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40101, "admin auth required")
+		return
+	}
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40042, "invalid scale id")
+		return
+	}
+	var body struct {
+		Status string `json:"status"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil || body.Status == "" {
+		response.Fail(c, http.StatusBadRequest, 40043, "status required")
+		return
+	}
+	if err := h.Svc.PatchScaleStatus(c.Request.Context(), adminID, id, body.Status); err != nil {
+		if errors.Is(err, admin.ErrInvalidScaleStatus) {
+			response.Fail(c, http.StatusBadRequest, 40044, "invalid status")
+			return
+		}
+		if errors.Is(err, admin.ErrScaleNotFound) {
+			response.Fail(c, http.StatusNotFound, 40410, "scale not found")
+			return
+		}
+		response.Fail(c, http.StatusInternalServerError, 50034, "patch scale failed")
+		return
+	}
+	response.OK(c, gin.H{"ok": true})
+}

apps/api/internal/handler/analytics.go

@@ -0,0 +1,57 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/analytics"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+// AnalyticsHandler serves POST /api/v1/analytics/events (DeviceAuth).
+type AnalyticsHandler struct {
+	Svc *analytics.Service
+}
+
+// Register mounts analytics routes on a DeviceAuth group.
+func (h *AnalyticsHandler) Register(api *gin.RouterGroup) {
+	g := api.Group("/analytics")
+	g.POST("/events", h.Ingest)
+}
+
+func (h *AnalyticsHandler) Ingest(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
+	if deviceKey == "" {
+		response.Fail(c, http.StatusBadRequest, 40020, "device key required")
+		return
+	}
+	var body struct {
+		Items []analytics.EventIn `json:"items"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 40021, "invalid body")
+		return
+	}
+	res, err := h.Svc.Ingest(c.Request.Context(), userID, deviceKey, body.Items)
+	if err != nil {
+		if errors.Is(err, analytics.ErrTooManyItems) {
+			response.Fail(c, http.StatusBadRequest, 40022, "too many items")
+			return
+		}
+		if errors.Is(err, analytics.ErrInvalidBatch) {
+			response.Fail(c, http.StatusBadRequest, 40023, "invalid batch")
+			return
+		}
+		response.Fail(c, http.StatusInternalServerError, 50020, "ingest failed")
+		return
+	}
+	response.OK(c, res)
+}

apps/api/internal/handler/ask.go

@@ -1,7 +1,10 @@
 package handler
 
 import (
+	"encoding/json"
+	"fmt"
 	"net/http"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
@@ -20,6 +23,7 @@ type AskHandler struct {
 func (h *AskHandler) Register(rg *gin.RouterGroup) {
 	rg.GET("/ask/quota", h.GetQuota)
 	rg.POST("/ask/threads", h.CreateThread)
+	rg.DELETE("/ask/threads/:id", h.ClearThread)
 	rg.GET("/ask/threads/:id/messages", h.ListMessages)
 	rg.POST("/ask/threads/:id/messages", h.SendMessage)
 }
@@ -69,6 +73,25 @@ func (h *AskHandler) CreateThread(c *gin.Context) {
 	response.OK(c, th)
 }
 
+// ClearThread handles DELETE /ask/threads/:id.
+func (h *AskHandler) ClearThread(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	tid, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "invalid id")
+		return
+	}
+	if err := h.Svc.ClearThread(c.Request.Context(), userID, tid); err != nil {
+		response.Fail(c, http.StatusNotFound, 40410, err.Error())
+		return
+	}
+	response.OK(c, gin.H{"cleared": true})
+}
+
 // ListMessages handles GET /ask/threads/:id/messages.
 func (h *AskHandler) ListMessages(c *gin.Context) {
 	userID, ok := middleware.UserIDFromContext(c)
@@ -90,6 +113,7 @@ func (h *AskHandler) ListMessages(c *gin.Context) {
 }
 
 // SendMessage handles POST /ask/threads/:id/messages.
+// Use ?stream=1 (or Accept: text/event-stream) for SSE streaming.
 func (h *AskHandler) SendMessage(c *gin.Context) {
 	userID, ok := middleware.UserIDFromContext(c)
 	if !ok {
@@ -108,10 +132,18 @@ func (h *AskHandler) SendMessage(c *gin.Context) {
 		response.Fail(c, http.StatusBadRequest, 10000, "invalid request")
 		return
 	}
+
+	wantStream := c.Query("stream") == "1" ||
+		strings.Contains(c.GetHeader("Accept"), "text/event-stream")
+	if wantStream {
+		h.sendMessageStream(c, userID, tid, req.Content)
+		return
+	}
+
 	out, err := h.Svc.SendMessage(c.Request.Context(), userID, tid, req.Content)
 	if err != nil {
 		if asksvc.IsQuotaExhausted(err) {
-			response.Fail(c, http.StatusPaymentRequired, 40210, "问答次数已用完，可开通成长会员获取更多次数")
+			response.Fail(c, http.StatusPaymentRequired, 40210, "问答次数已用完，可购买额度或开通成长会员")
 			return
 		}
 		response.Fail(c, http.StatusBadRequest, 40011, err.Error())
@@ -119,3 +151,39 @@ func (h *AskHandler) SendMessage(c *gin.Context) {
 	}
 	response.OK(c, out)
 }
+
+func (h *AskHandler) sendMessageStream(c *gin.Context, userID, tid uuid.UUID, content string) {
+	c.Writer.Header().Set("Content-Type", "text/event-stream; charset=utf-8")
+	c.Writer.Header().Set("Cache-Control", "no-cache, no-transform")
+	c.Writer.Header().Set("Connection", "keep-alive")
+	c.Writer.Header().Set("X-Accel-Buffering", "no")
+	c.Status(http.StatusOK)
+	flusher, ok := c.Writer.(http.Flusher)
+	if !ok {
+		response.Fail(c, http.StatusInternalServerError, 50000, "stream unsupported")
+		return
+	}
+
+	writeEvent := func(event string, payload any) error {
+		raw, err := json.Marshal(payload)
+		if err != nil {
+			return err
+		}
+		if _, err := fmt.Fprintf(c.Writer, "event: %s\ndata: %s\n\n", event, raw); err != nil {
+			return err
+		}
+		flusher.Flush()
+		return nil
+	}
+
+	err := h.Svc.StreamMessage(c.Request.Context(), userID, tid, content, writeEvent)
+	if err != nil {
+		msg := err.Error()
+		code := 40011
+		if asksvc.IsQuotaExhausted(err) {
+			msg = "问答次数已用完，可购买额度或开通成长会员"
+			code = 40210
+		}
+		_ = writeEvent("error", map[string]any{"code": code, "message": msg})
+	}
+}

apps/api/internal/handler/auth.go

@@ -0,0 +1,105 @@
+package handler
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/middleware"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/auth"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+// AuthHandler serves /api/v1/auth/*.
+type AuthHandler struct {
+	Svc *auth.Service
+}
+
+// Register mounts auth routes. Public register/login; me/logout need device (+ session).
+func (h *AuthHandler) Register(api *gin.RouterGroup) {
+	g := api.Group("/auth")
+	g.POST("/register", h.RegisterAccount)
+	g.POST("/login", h.Login)
+	g.POST("/logout", h.Logout)
+	g.GET("/me", h.Me)
+}
+
+type authBody struct {
+	Phone    string `json:"phone"`
+	Password string `json:"password"`
+	Nickname string `json:"nickname"`
+}
+
+// RegisterAccount handles POST /auth/register (DeviceAuth required on group).
+func (h *AuthHandler) RegisterAccount(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	var body authBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "invalid request")
+		return
+	}
+	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
+	res, err := h.Svc.Register(c.Request.Context(), userID, deviceKey, body.Phone, body.Password, body.Nickname)
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40110, err.Error())
+		return
+	}
+	response.OK(c, res)
+}
+
+// Login handles POST /auth/login (open mode: any phone+password).
+func (h *AuthHandler) Login(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	var body authBody
+	if err := c.ShouldBindJSON(&body); err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "invalid request")
+		return
+	}
+	deviceKey := c.GetHeader(middleware.DeviceKeyHeader)
+	res, err := h.Svc.Login(c.Request.Context(), userID, deviceKey, body.Phone, body.Password)
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 40111, err.Error())
+		return
+	}
+	c.Set(string(middleware.UserIDKey), res.User.ID)
+	response.OK(c, res)
+}
+
+// Logout handles POST /auth/logout.
+func (h *AuthHandler) Logout(c *gin.Context) {
+	tok := bearerToken(c)
+	_ = h.Svc.Logout(c.Request.Context(), tok)
+	response.OK(c, gin.H{"ok": true})
+}
+
+// Me handles GET /auth/me.
+func (h *AuthHandler) Me(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	me, err := h.Svc.Me(c.Request.Context(), userID)
+	if err != nil {
+		response.Fail(c, http.StatusUnauthorized, 40112, "请先登录")
+		return
+	}
+	response.OK(c, me)
+}
+
+func bearerToken(c *gin.Context) string {
+	h := c.GetHeader("Authorization")
+	if strings.HasPrefix(strings.ToLower(h), "bearer ") {
+		return strings.TrimSpace(h[7:])
+	}
+	return ""
+}

apps/api/internal/handler/home.go

@@ -0,0 +1,34 @@
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"github.com/yuxingu/digital-psychology/apps/api/internal/repository"
+	"github.com/yuxingu/digital-psychology/apps/api/internal/service/home"
+	"github.com/yuxingu/digital-psychology/apps/api/pkg/response"
+)
+
+// HomeHandler serves GET /api/v1/home/* (DeviceAuth).
+type HomeHandler struct {
+	Svc *home.Service
+}
+
+// Register mounts home routes.
+func (h *HomeHandler) Register(api *gin.RouterGroup) {
+	g := api.Group("/home")
+	g.GET("/tools", h.Tools)
+}
+
+func (h *HomeHandler) Tools(c *gin.Context) {
+	items, err := h.Svc.ListPublic(c.Request.Context())
+	if err != nil {
+		response.Fail(c, http.StatusInternalServerError, 50030, "home tools failed")
+		return
+	}
+	if items == nil {
+		items = []repository.HomeTool{}
+	}
+	response.OK(c, gin.H{"items": items})
+}

apps/api/internal/handler/report.go

@@ -34,12 +34,47 @@ func (h *ReportHandler) Register(rg *gin.RouterGroup) {
 	rg.POST("/reports/synastry", h.CreateSynastry)
 	rg.POST("/reports/rhythm", h.CreateRhythm)
 	rg.GET("/reports", h.List)
+	rg.GET("/reports/latest", h.GetLatest)
 	rg.GET("/reports/:id", h.Get)
 	rg.GET("/membership/me", h.GetMembership)
 	rg.POST("/orders", h.CreateOrder)
 	rg.POST("/orders/:id/pay-mock", h.PayMock)
 }
 
+// GetLatest handles GET /reports/latest?profile_id=&type=&peer_profile_id=.
+func (h *ReportHandler) GetLatest(c *gin.Context) {
+	userID, ok := middleware.UserIDFromContext(c)
+	if !ok {
+		response.Fail(c, http.StatusUnauthorized, 40100, "unauthorized")
+		return
+	}
+	pid, err := uuid.Parse(c.Query("profile_id"))
+	if err != nil {
+		response.Fail(c, http.StatusBadRequest, 10000, "profile_id required")
+		return
+	}
+	typ := c.Query("type")
+	if typ == "" {
+		response.Fail(c, http.StatusBadRequest, 10000, "type required")
+		return
+	}
+	var peer *uuid.UUID
+	if ps := c.Query("peer_profile_id"); ps != "" {
+		id, err := uuid.Parse(ps)
+		if err != nil {
+			response.Fail(c, http.StatusBadRequest, 10000, "invalid peer_profile_id")
+			return
+		}
+		peer = &id
+	}
+	rep, err := h.Svc.GetLatest(c.Request.Context(), userID, pid, typ, peer)
+	if err != nil {
+		response.Fail(c, http.StatusNotFound, 40402, err.Error())
+		return
+	}
+	response.OK(c, rep)
+}
+
 // CreatePortrait handles POST /reports/portrait.
 func (h *ReportHandler) CreatePortrait(c *gin.Context) {
 	userID, ok := middleware.UserIDFromContext(c)