Files

T

jackyu66gitandCursor 89756f65b4 feat(ECR-012–016): 合规、题库、时辰刷新、头像、MBTI OEJTS 与埋点

落地输入合规、探索题库、报告日/时辰刷新、账号头像、OEJTS 量表，并补齐 H5 埋点与 Admin 漏斗；同步 ESS 工件、切至自建 Git、清理 GitHub Actions。

Co-authored-by: Cursor <cursoragent@cursor.com>

2026-08-13 01:27:58 +08:00

1.2 KiB

Raw Blame History

BD-2026-015 — Account avatar

Status: Approved
ECR: ECR-015
Date: 2026-08-13
Change Level: L2
Risk: Low
Retrospective: true

Backend Change Boundary

In

users.avatar_url (varchar)
Package internal/avatar：Store / ResolveAbs · MaxBytes 2MiB · jpeg/png/webp
Auth POST /me/avatar（需登录）→ 写盘 + 更新 DB
Public GET /media/avatars/:file（无鉴权读）
OpenAPI

Out

S3/COS · 图片审核 SaaS · 多人头像/档案头像分离

Data flow

H5 MinePage → multipart POST /auth/me/avatar
  → avatar.Store(data/avatars, userID, file)
  → auth_repo SET avatar_url=/api/v1/media/avatars/{user_id}.ext
  → return AuthUser

GET /media/avatars/:file
  → ResolveAbs（防 ..）→ File

Migration

YES — 000018_user_avatar.up.sql

Security

扩展名/Content-Type 白名单
大小上限 2MB
ResolveAbs 禁止路径穿越
文件名绑定 user UUID（覆盖旧文件）

Test

avatar Store 拒超大/拒坏类型
ResolveAbs 拒 ../
可选：handler 冒烟

Rollback

停用 Upload 路由；列可留；磁盘文件可人工清

1.2 KiB Raw Blame History Unescape Escape

BD-2026-015 — Account avatar

Backend Change Boundary

In

Out

Data flow

Migration

Security

Test

Rollback

1.2 KiB

Raw Blame History