xfy
449a545886
P0 blockers: - Fix migration numbering conflict and duplicate indexes - Change comments.post_id FK to ON DELETE CASCADE - Restrict public post detail endpoint to published posts only - Fix rate-limiting IP extraction and fallback to ConnectInfo - Harden HTML sanitizer: deny unknown URL schemes, restrict data URIs - Remove session token from login response body - Enforce image pixel/dimension limits on upload and serving P1 high-risk: - Validate uploads by magic bytes and decode GIF/WebP - Add pagination/rate-limiting to search, tag posts, and comments - Make first-admin registration and slug uniqueness check atomic - HTML-escape comment author fields - Improve HTML minify cache key and skip admin/error responses - Add mobile navigation menu P2 accessibility/quality: - Associate form labels with inputs - Key PostDetail article by slug to re-init scripts on navigation - Improve image viewer keyboard accessibility - Make theme toggle SSR-friendly and add aria-label - Invalidate slug 404 cache on create and pending count on new comment - Deduplicate tags case-insensitively P3 cleanup: - Remove unused tower-http dependency, expand make clean - Configure DB pool timeouts and verified recycling - Run background cleanup tasks immediately on startup - Use SHA-256 for stable disk cache keys - Log DB errors with Display instead of Debug - Update README migration instructions All tests pass (321), clippy clean, dx check clean.
336 lines
12 KiB
Rust
336 lines
12 KiB
Rust
//! 文章列表查询接口。
|
||
//!
|
||
//! 提供已发布文章分页、管理员全量列表、以及按标签筛选三种查询能力，
|
||
//! 均通过缓存层减少重复数据库访问。
|
||
//! Dioxus server function，注册在 `/api` 路径下。
|
||
//! 仅在 `feature = "server"` 启用的服务端构建中查询数据库。
|
||
|
||
use dioxus::prelude::*;
|
||
|
||
#[cfg(feature = "server")]
|
||
use super::helpers::{get_current_admin_user, row_to_post_list};
|
||
use super::types::PostListResponse;
|
||
#[cfg(feature = "server")]
|
||
use crate::api::error::AppError;
|
||
#[cfg(feature = "server")]
|
||
use crate::db::pool::get_conn;
|
||
|
||
/// 单页允许的最大文章数。
|
||
///
|
||
/// 公开的 `list_published_posts` 接口无需认证，若不对 `per_page` 设上限，
|
||
/// 攻击者可传入巨大值迫使数据库扫描并实例化超大 Vec，造成内存放大与拒绝服务。
|
||
#[cfg(feature = "server")]
|
||
const MAX_PER_PAGE: i32 = 50;
|
||
|
||
/// 允许的最大页码。
|
||
///
|
||
/// `page` 无上限时，攻击者可用海量不同 `page` 值撑大缓存键空间（缓存污染），
|
||
/// 并触发无意义的超大 `OFFSET` 扫描。10_000 对任何实际博客都足够宽裕
|
||
/// （配合 `MAX_PER_PAGE` 最多覆盖 50 万篇文章），同时把缓存键空间限制在有限范围。
|
||
#[cfg(feature = "server")]
|
||
const MAX_PAGE: i32 = 10_000;
|
||
|
||
/// 将分页参数钳制到安全范围：页码 1–`MAX_PAGE`，每页 1–`MAX_PER_PAGE`。
|
||
///
|
||
/// 注意：返回值必须同时用于缓存键与 SQL 查询，避免同一逻辑页落入不同缓存条目。
|
||
#[cfg(feature = "server")]
|
||
fn clamp_pagination(page: i32, per_page: i32) -> (i32, i32) {
|
||
(page.clamp(1, MAX_PAGE), per_page.clamp(1, MAX_PER_PAGE))
|
||
}
|
||
|
||
/// 获取已发布文章分页列表。
|
||
///
|
||
/// 优先命中缓存；未命中时查询总数与分页记录，并按 published_at 降序排列。
|
||
#[server(ListPublishedPosts, "/api")]
|
||
pub async fn list_published_posts(
|
||
page: i32,
|
||
per_page: i32,
|
||
) -> Result<PostListResponse, ServerFnError> {
|
||
// 钳制分页参数，防止无认证调用方请求超大每页数量导致内存放大 / DoS。
|
||
let (page, per_page) = clamp_pagination(page, per_page);
|
||
|
||
#[cfg(feature = "server")]
|
||
{
|
||
let cache_key = crate::cache::CacheKey::PublishedPosts { page, per_page };
|
||
if let Some((cached_posts, cached_total)) = crate::cache::get_post_list(&cache_key).await {
|
||
return Ok(PostListResponse {
|
||
posts: cached_posts,
|
||
total: cached_total,
|
||
});
|
||
}
|
||
|
||
let client = get_conn().await.map_err(AppError::db_conn)?;
|
||
|
||
// 优先读取缓存中的已发布文章总数，否则查询数据库并回填缓存。
|
||
let total = if let Some(cached_total) = crate::cache::get_total_published_posts().await {
|
||
cached_total
|
||
} else {
|
||
let count_row = client
|
||
.query_one(
|
||
"SELECT COUNT(*) FROM posts WHERE status = 'published' AND deleted_at IS NULL",
|
||
&[],
|
||
)
|
||
.await
|
||
.map_err(AppError::query)?;
|
||
let total: i64 = count_row.get(0);
|
||
crate::cache::set_total_published_posts(total).await;
|
||
total
|
||
};
|
||
|
||
let offset = ((page - 1).max(0) as i64) * (per_page as i64);
|
||
let limit = per_page as i64;
|
||
let rows = client
|
||
.query(
|
||
"SELECT
|
||
p.id, p.author_id, p.title, p.slug, p.summary, p.content_md, p.content_html,
|
||
p.status, p.published_at, p.created_at, p.updated_at, p.cover_image,
|
||
COALESCE(array_agg(t.name) FILTER (WHERE t.name IS NOT NULL), '{}') as tags
|
||
FROM posts p
|
||
LEFT JOIN post_tags pt ON p.id = pt.post_id
|
||
LEFT JOIN tags t ON pt.tag_id = t.id
|
||
WHERE p.status = 'published' AND p.deleted_at IS NULL
|
||
GROUP BY p.id
|
||
ORDER BY p.published_at DESC
|
||
LIMIT $1 OFFSET $2",
|
||
&[&limit, &offset],
|
||
)
|
||
.await
|
||
.map_err(AppError::query)?;
|
||
|
||
let mut posts = Vec::new();
|
||
for row in &rows {
|
||
posts.push(row_to_post_list(&client, row).await);
|
||
}
|
||
|
||
crate::cache::set_post_list(&cache_key, posts.clone(), total).await;
|
||
Ok(PostListResponse { posts, total })
|
||
}
|
||
|
||
#[cfg(not(feature = "server"))]
|
||
{
|
||
Ok(PostListResponse {
|
||
posts: Vec::new(),
|
||
total: 0,
|
||
})
|
||
}
|
||
}
|
||
|
||
/// 获取管理员视角的全部文章列表（含草稿与已发布）。
|
||
///
|
||
/// 需要 admin 权限；结果按创建时间降序，不走缓存。
|
||
#[server(ListPosts, "/api")]
|
||
pub async fn list_posts(page: i32, per_page: i32) -> Result<PostListResponse, ServerFnError> {
|
||
// 与公开接口保持一致的分页钳制，避免单次请求拉取过多记录。
|
||
let (page, per_page) = clamp_pagination(page, per_page);
|
||
let _user = get_current_admin_user().await?;
|
||
|
||
#[cfg(feature = "server")]
|
||
{
|
||
let client = get_conn().await.map_err(AppError::db_conn)?;
|
||
|
||
let count_row = client
|
||
.query_one("SELECT COUNT(*) FROM posts WHERE deleted_at IS NULL", &[])
|
||
.await
|
||
.map_err(AppError::query)?;
|
||
let total: i64 = count_row.get(0);
|
||
|
||
let offset = ((page - 1).max(0) as i64) * (per_page as i64);
|
||
let limit = per_page as i64;
|
||
let rows = client
|
||
.query(
|
||
"SELECT
|
||
p.id, p.author_id, p.title, p.slug, p.summary, p.content_md, p.content_html,
|
||
p.status, p.published_at, p.created_at, p.updated_at, p.cover_image,
|
||
COALESCE(array_agg(t.name) FILTER (WHERE t.name IS NOT NULL), '{}') as tags
|
||
FROM posts p
|
||
LEFT JOIN post_tags pt ON p.id = pt.post_id
|
||
LEFT JOIN tags t ON pt.tag_id = t.id
|
||
WHERE p.deleted_at IS NULL
|
||
GROUP BY p.id
|
||
ORDER BY p.created_at DESC
|
||
LIMIT $1 OFFSET $2",
|
||
&[&limit, &offset],
|
||
)
|
||
.await
|
||
.map_err(AppError::query)?;
|
||
|
||
let mut posts = Vec::new();
|
||
for row in &rows {
|
||
posts.push(row_to_post_list(&client, row).await);
|
||
}
|
||
|
||
Ok(PostListResponse { posts, total })
|
||
}
|
||
|
||
#[cfg(not(feature = "server"))]
|
||
{
|
||
Ok(PostListResponse {
|
||
posts: Vec::new(),
|
||
total: 0,
|
||
})
|
||
}
|
||
}
|
||
|
||
/// 获取回收站中已软删除的文章列表。
|
||
///
|
||
/// 需要 admin 权限；按删除时间降序，不走缓存。
|
||
#[server(ListDeletedPosts, "/api")]
|
||
pub async fn list_deleted_posts(
|
||
page: i32,
|
||
per_page: i32,
|
||
) -> Result<PostListResponse, ServerFnError> {
|
||
// 与 list_posts 一致的分页钳制。
|
||
let (page, per_page) = clamp_pagination(page, per_page);
|
||
let _user = get_current_admin_user().await?;
|
||
|
||
#[cfg(feature = "server")]
|
||
{
|
||
let client = get_conn().await.map_err(AppError::db_conn)?;
|
||
|
||
let count_row = client
|
||
.query_one("SELECT COUNT(*) FROM posts WHERE deleted_at IS NOT NULL", &[])
|
||
.await
|
||
.map_err(AppError::query)?;
|
||
let total: i64 = count_row.get(0);
|
||
|
||
let offset = ((page - 1).max(0) as i64) * (per_page as i64);
|
||
let limit = per_page as i64;
|
||
let rows = client
|
||
.query(
|
||
"SELECT
|
||
p.id, p.author_id, p.title, p.slug, p.summary, p.content_md, p.content_html,
|
||
p.status, p.published_at, p.created_at, p.updated_at, p.cover_image, p.deleted_at,
|
||
COALESCE(array_agg(t.name) FILTER (WHERE t.name IS NOT NULL), '{}') as tags
|
||
FROM posts p
|
||
LEFT JOIN post_tags pt ON p.id = pt.post_id
|
||
LEFT JOIN tags t ON pt.tag_id = t.id
|
||
WHERE p.deleted_at IS NOT NULL
|
||
GROUP BY p.id
|
||
ORDER BY p.deleted_at DESC
|
||
LIMIT $1 OFFSET $2",
|
||
&[&limit, &offset],
|
||
)
|
||
.await
|
||
.map_err(AppError::query)?;
|
||
|
||
let mut posts = Vec::new();
|
||
for row in &rows {
|
||
posts.push(row_to_post_list(&client, row).await);
|
||
}
|
||
|
||
Ok(PostListResponse { posts, total })
|
||
}
|
||
|
||
#[cfg(not(feature = "server"))]
|
||
{
|
||
Ok(PostListResponse {
|
||
posts: Vec::new(),
|
||
total: 0,
|
||
})
|
||
}
|
||
}
|
||
|
||
/// 获取指定标签下的已发布文章列表。
|
||
///
|
||
/// 优先命中缓存；当前实现返回全部匹配文章，因此 total 用 posts.len() 计算。
|
||
#[server(GetPostsByTag, "/api")]
|
||
pub async fn get_posts_by_tag(tag_name: String) -> Result<PostListResponse, ServerFnError> {
|
||
#[cfg(feature = "server")]
|
||
{
|
||
if let Some((cached_posts, cached_total)) = crate::cache::get_posts_by_tag(&tag_name).await
|
||
{
|
||
return Ok(PostListResponse {
|
||
posts: cached_posts,
|
||
total: cached_total,
|
||
});
|
||
}
|
||
|
||
let client = get_conn().await.map_err(AppError::db_conn)?;
|
||
|
||
// 通过 JOIN 筛选含目标标签的已发布文章，并聚合该文章的所有标签。
|
||
let rows = client
|
||
.query(
|
||
"SELECT
|
||
p.id, p.author_id, p.title, p.slug, p.summary, p.content_md, p.content_html,
|
||
p.status, p.published_at, p.created_at, p.updated_at, p.cover_image,
|
||
COALESCE(array_agg(t2.name) FILTER (WHERE t2.name IS NOT NULL), '{}') as tags
|
||
FROM posts p
|
||
JOIN post_tags pt ON p.id = pt.post_id
|
||
JOIN tags t ON pt.tag_id = t.id
|
||
LEFT JOIN post_tags pt2 ON p.id = pt2.post_id
|
||
LEFT JOIN tags t2 ON pt2.tag_id = t2.id
|
||
WHERE t.name = $1 AND p.status = 'published' AND p.deleted_at IS NULL
|
||
GROUP BY p.id
|
||
ORDER BY p.published_at DESC
|
||
LIMIT 200",
|
||
&[&tag_name],
|
||
)
|
||
.await
|
||
.map_err(AppError::query)?;
|
||
|
||
let mut posts = Vec::new();
|
||
for row in &rows {
|
||
posts.push(row_to_post_list(&client, row).await);
|
||
}
|
||
|
||
// 当前查询未分页，返回全部匹配文章，因此 total 等于结果长度。
|
||
// 若后续增加分页，应改为 COUNT(*) 查询。
|
||
let total = posts.len() as i64;
|
||
crate::cache::set_posts_by_tag(&tag_name, posts.clone(), total).await;
|
||
Ok(PostListResponse { posts, total })
|
||
}
|
||
|
||
#[cfg(not(feature = "server"))]
|
||
{
|
||
Ok(PostListResponse {
|
||
posts: Vec::new(),
|
||
total: 0,
|
||
})
|
||
}
|
||
}
|
||
|
||
#[cfg(test)]
|
||
mod tests {
|
||
use super::*;
|
||
|
||
#[test]
|
||
fn clamp_pagination_keeps_valid_values() {
|
||
assert_eq!(clamp_pagination(1, 10), (1, 10));
|
||
assert_eq!(clamp_pagination(3, 20), (3, 20));
|
||
}
|
||
|
||
#[test]
|
||
fn clamp_pagination_clamps_oversized_per_page() {
|
||
// 攻击者传入超大 per_page 必须被压回上限，避免内存放大 / DoS。
|
||
assert_eq!(clamp_pagination(1, 1_000_000_000), (1, MAX_PER_PAGE));
|
||
assert_eq!(clamp_pagination(2, 51), (2, MAX_PER_PAGE));
|
||
}
|
||
|
||
#[test]
|
||
fn clamp_pagination_clamps_non_positive() {
|
||
assert_eq!(clamp_pagination(0, 10), (1, 10));
|
||
assert_eq!(clamp_pagination(-5, 10), (1, 10));
|
||
assert_eq!(clamp_pagination(1, 0), (1, 1));
|
||
assert_eq!(clamp_pagination(1, -100), (1, 1));
|
||
}
|
||
|
||
#[test]
|
||
fn clamp_pagination_clamps_oversized_page() {
|
||
// 巨大 page 必须被压回上限，避免无界 OFFSET 扫描与缓存键扇出。
|
||
assert_eq!(clamp_pagination(i32::MAX, 10), (MAX_PAGE, 10));
|
||
assert_eq!(clamp_pagination(MAX_PAGE + 1, 10), (MAX_PAGE, 10));
|
||
}
|
||
|
||
#[test]
|
||
fn clamp_pagination_max_page_boundary() {
|
||
assert_eq!(clamp_pagination(MAX_PAGE, 10), (MAX_PAGE, 10));
|
||
assert_eq!(clamp_pagination(MAX_PAGE - 1, 10), (MAX_PAGE - 1, 10));
|
||
}
|
||
|
||
#[test]
|
||
fn clamp_pagination_max_per_page_boundary() {
|
||
assert_eq!(clamp_pagination(1, MAX_PER_PAGE), (1, MAX_PER_PAGE));
|
||
assert_eq!(clamp_pagination(1, MAX_PER_PAGE - 1), (1, MAX_PER_PAGE - 1));
|
||
}
|
||
}
|