feat(ECR-012–016): 合规、题库、时辰刷新、头像、MBTI OEJTS 与埋点

落地输入合规、探索题库、报告日/时辰刷新、账号头像、OEJTS 量表，并补齐 H5 埋点与 Admin 漏斗；同步 ESS 工件、切至自建 Git、清理 GitHub Actions。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-13 01:27:58 +08:00
parent 13860bf1ef
commit 89756f65b4
227 changed files with 7405 additions and 1407 deletions
@@ -0,0 +1,35 @@
+# BD-2026-012 — Input text compliance
+
+Status: Approved  
+**ECR:** ECR-012  
+**Date:** 2026-08-12  
+**Change Level:** L2  
+**Risk:** Low  
+
+## Backend Change Boundary
+
+### In
+
+- Package `internal/textsafe`（纯函数，无 DB）  
+- Service/Handler 在写库前 `Check(Kind, s)`  
+- 失败 → `response.Fail(..., 40060, err.Error())`  
+
+### Out
+
+- 新表 · Redis 限流 · Admin CMS 全量  
+
+## Module
+
+| Module | Change |
+|--------|--------|
+| textsafe | Check / Normalize / Kind |
+| auth · profile · ask · companion · growth · synastry | 调用 Check |
+
+## Test
+
+- 单测：禁止词 · XSS · 刷屏 · 长度 · 合法样本  
+- 可选 integration 抽一条 PATCH nickname  
+
+## Rollback
+
+- 去掉 Check 调用即可；无 migration  
@@ -0,0 +1,66 @@
+# BD-2026-013 — Curated scale bank (explore)
+
+Status: Approved  
+**ECR:** ECR-013  
+**Date:** 2026-08-13  
+**Change Level:** L2  
+**Risk:** Low–Med（题量大 · 文案非诊断）  
+
+## Backend Change Boundary
+
+### In
+
+- Package `internal/scalebank`（embed `curated.json` · Catalog/Category/Get/ScoreSum/QuestionID）  
+- `service/scale`：bank slug Get/Submit/LatestResult；`EnsurePublished` stub 行  
+- `handler/scale`：`/scale-bank/*`  
+- `repository.ScaleRepo.EnsurePublished`  
+
+### Out
+
+- 新业务表存题目全文（题目仅 embed）· 临床类 · Admin 题库 CMS  
+
+## Module
+
+| Module | Change |
+|--------|--------|
+| scalebank | embed A 集 · 稳定 QuestionID |
+| scale service | bank 分支计分 BuildResult + disclaimer |
+| scale handler | catalog / category |
+| OpenAPI | 上述路径 |
+
+## Data flow
+
+```text
+H5 /explore → GET scale-bank/catalog
+H5 /explore/bank/:key → GET scale-bank/categories/:key
+H5 /scales/:slug → Get(bank|db) → optional GET result → POST result
+Submit bank → EnsurePublished → ScoreSum → BuildResult → SaveResult
+```
+
+## API
+
+| Method | Path | Notes |
+|--------|------|-------|
+| GET | `/api/v1/scale-bank/catalog` | featured + categories |
+| GET | `/api/v1/scale-bank/categories/:key` | category + items |
+| GET/POST | `/api/v1/scales/:slug` / `.../result` | bank slug 同契约 |
+
+## Migration
+
+NO（`EnsurePublished` upsert `scales` 元数据行；题目不入库）
+
+## Test
+
+- unit：`scalebank` catalog/featured icons unique  
+- integration：`TestScaleBankResultRoundtrip`（sm1）  
+- H5：ScalePage latest result（含 bank slug）  
+
+## Rollback
+
+- 下线路由 + 回退 Explore UI；已写 `scale_results` 可保留  
+
+## Failure
+
+- 未知 category → 40402  
+- 无结果 → 40411  
+- 无 Self profile → 提交 400  
@@ -0,0 +1,46 @@
+# BD-2026-014 — Temporal refresh (tips · star · rhythm)
+
+Status: Approved  
+**ECR:** ECR-014  
+**Date:** 2026-08-13  
+**Change Level:** L2  
+**Risk:** Low  
+**Retrospective:** true（实现已部分在树，本 BD 冻结边界）  
+
+## Backend Change Boundary
+
+### In
+
+- `home_daily_tips` 表 · HomeDailyTipsRepo · DailyTips 响应装饰时辰窗  
+- report `refreshTemporalIfNeeded` on Get / GetLatest（star|rhythm）  
+- OpenAPI 字段说明  
+
+### Out
+
+- 头像 · scalebank · 新建报告 id 换日  
+
+## Data flow
+
+```text
+GET /home/daily-tips
+  → CurrentShichen → cache hit? return+decorate : fallback + async LLM warm
+  → valid_until = next 时辰 start
+
+GET /reports/latest|/:id (star|rhythm)
+  → if as_of != today CST → in-place UpdateContent outlook/tips
+  → stamp valid_until = next midnight CST
+```
+
+## Migration
+
+YES — `000023_home_daily_tips`（若尚未应用则 migrate）
+
+## Test
+
+- `TestCurrentShichenBoundaries` · `TestFallbackTipsChangeByShichen`  
+- `temporal_test.go` as_of / valid_until  
+- 可选：手工 GET 冒烟  
+
+## Rollback
+
+- 停用 refresh 调用；表可保留  
@@ -0,0 +1,55 @@
+# BD-2026-015 — Account avatar
+
+Status: Approved  
+**ECR:** ECR-015  
+**Date:** 2026-08-13  
+**Change Level:** L2  
+**Risk:** Low  
+**Retrospective:** true  
+
+## Backend Change Boundary
+
+### In
+
+- `users.avatar_url` (varchar)  
+- Package `internal/avatar`：Store / ResolveAbs · MaxBytes 2MiB · jpeg/png/webp  
+- Auth `POST /me/avatar`（需登录）→ 写盘 + 更新 DB  
+- Public `GET /media/avatars/:file`（无鉴权读）  
+- OpenAPI  
+
+### Out
+
+- S3/COS · 图片审核 SaaS · 多人头像/档案头像分离  
+
+## Data flow
+
+```text
+H5 MinePage → multipart POST /auth/me/avatar
+  → avatar.Store(data/avatars, userID, file)
+  → auth_repo SET avatar_url=/api/v1/media/avatars/{user_id}.ext
+  → return AuthUser
+
+GET /media/avatars/:file
+  → ResolveAbs（防 ..）→ File
+```
+
+## Migration
+
+YES — `000018_user_avatar.up.sql`
+
+## Security
+
+- 扩展名/Content-Type 白名单  
+- 大小上限 2MB  
+- ResolveAbs 禁止路径穿越  
+- 文件名绑定 user UUID（覆盖旧文件）  
+
+## Test
+
+- avatar Store 拒超大/拒坏类型  
+- ResolveAbs 拒 `../`  
+- 可选：handler 冒烟  
+
+## Rollback
+
+- 停用 Upload 路由；列可留；磁盘文件可人工清  
@@ -0,0 +1,31 @@
+# BD-2026-016 — MBTI OEJTS lite/full
+
+Status: Approved  
+**ECR:** ECR-016  
+**Retrospective:** true  
+**Change Level:** L2  
+
+## Boundary
+
+### In
+
+- migrations 019–022  
+- jungian scoring · BuildJungianResult  
+- scale service membership gate for mbti-full  
+
+### Out
+
+- scalebank · 官方 MBTI® 版权题  
+
+## Migration
+
+YES — 000019 label · 000020 questions · 000021 OEJTS 32 · 000022 full 60  
+
+## Test
+
+- ScoreJungian / BuildJungianResult unit  
+- optional membership lock  
+
+## Rollback
+
+- soft-deleted rows remain；可再 seed