jackyu66gitandCursor
89756f65b4
落地输入合规、探索题库、报告日/时辰刷新、账号头像、OEJTS 量表，并补齐 H5 埋点与 Admin 漏斗；同步 ESS 工件、切至自建 Git、清理 GitHub Actions。 Co-authored-by: Cursor <cursoragent@cursor.com>
56 lines
1.2 KiB
Markdown
56 lines
1.2 KiB
Markdown
# BD-2026-015 — Account avatar
|
||
|
||
Status: Approved
|
||
**ECR:** ECR-015
|
||
**Date:** 2026-08-13
|
||
**Change Level:** L2
|
||
**Risk:** Low
|
||
**Retrospective:** true
|
||
|
||
## Backend Change Boundary
|
||
|
||
### In
|
||
|
||
- `users.avatar_url` (varchar)
|
||
- Package `internal/avatar`：Store / ResolveAbs · MaxBytes 2MiB · jpeg/png/webp
|
||
- Auth `POST /me/avatar`（需登录）→ 写盘 + 更新 DB
|
||
- Public `GET /media/avatars/:file`（无鉴权读）
|
||
- OpenAPI
|
||
|
||
### Out
|
||
|
||
- S3/COS · 图片审核 SaaS · 多人头像/档案头像分离
|
||
|
||
## Data flow
|
||
|
||
```text
|
||
H5 MinePage → multipart POST /auth/me/avatar
|
||
→ avatar.Store(data/avatars, userID, file)
|
||
→ auth_repo SET avatar_url=/api/v1/media/avatars/{user_id}.ext
|
||
→ return AuthUser
|
||
|
||
GET /media/avatars/:file
|
||
→ ResolveAbs（防 ..）→ File
|
||
```
|
||
|
||
## Migration
|
||
|
||
YES — `000018_user_avatar.up.sql`
|
||
|
||
## Security
|
||
|
||
- 扩展名/Content-Type 白名单
|
||
- 大小上限 2MB
|
||
- ResolveAbs 禁止路径穿越
|
||
- 文件名绑定 user UUID（覆盖旧文件）
|
||
|
||
## Test
|
||
|
||
- avatar Store 拒超大/拒坏类型
|
||
- ResolveAbs 拒 `../`
|
||
- 可选：handler 冒烟
|
||
|
||
## Rollback
|
||
|
||
- 停用 Upload 路由；列可留；磁盘文件可人工清
|