Files
sub2api/backend/internal/handler/admin/group_handler.go

360 lines
13 KiB
Go
Raw Normal View History

2025-12-18 13:50:39 +08:00
package admin
import (
"strconv"
fix(admin): 代码审查修复 - 输入验证和测试完善 根据 Codex 代码审查报告,修复所有 P0 和 P1 优先级问题。 ## P0 紧急修复 ### 1. 修复集成测试编译错误 - 更新 group_repo_integration_test.go 中所有 ListWithFilters 调用 - 添加缺失的 search 参数(传入空字符串) - 修复 4 处旧签名调用,避免 CI 编译失败 ### 2. 添加统一的 search 参数输入验证 为所有 admin handler 添加一致的输入验证逻辑: - group_handler.go: 添加 TrimSpace + 长度限制 - proxy_handler.go: 添加 TrimSpace + 长度限制 - redeem_handler.go: 添加 TrimSpace + 长度限制 - user_handler.go: 添加 TrimSpace + 长度限制 验证规则: - TrimSpace() 去除首尾空格 - 最大长度 100 字符(防止 DoS 攻击) - 超长输入自动截断 ## P1 改进 ### 3. 补充 search 功能的单元测试 新增 admin_service_group_test.go 中的测试: - TestAdminService_ListGroups_WithSearch - search 参数正常传递到 repository 层 - search 为空字符串时的行为 - search 与其他过滤条件组合使用 新增 admin_service_search_test.go 文件: - 为其他 admin API 添加 search 测试覆盖 - 统一的测试模式和断言 ### 4. 补充 search 功能的集成测试 新增 group_repo_integration_test.go 测试场景: - TestListWithFilters_Search - 搜索 name 字段匹配 - 搜索 description 字段匹配 - 搜索不存在内容(返回空) - 大小写不敏感测试 - 特殊字符转义测试(%、_) - 与其他过滤条件组合 ## 测试结果 - ✅ 编译检查通过 - ✅ 单元测试全部通过 (3/3) - ✅ 集成测试编译通过 - ✅ 所有 service 测试通过 ## 影响范围 修改文件: 8 个 代码变更: +234 行 / -8 行 ## 相关 Issue 解决代码审查中的安全性和稳定性问题: - 防止 DoS 攻击(超长搜索字符串) - 修复测试编译错误(CI 阻塞问题) - 提升测试覆盖率
2026-01-09 19:43:19 +08:00
"strings"
2025-12-18 13:50:39 +08:00
"github.com/Wei-Shaw/sub2api/internal/handler/dto"
2025-12-24 21:07:21 +08:00
"github.com/Wei-Shaw/sub2api/internal/pkg/response"
"github.com/Wei-Shaw/sub2api/internal/service"
2025-12-18 13:50:39 +08:00
"github.com/gin-gonic/gin"
)
// GroupHandler handles admin group management
type GroupHandler struct {
adminService service.AdminService
}
// NewGroupHandler creates a new admin group handler
func NewGroupHandler(adminService service.AdminService) *GroupHandler {
return &GroupHandler{
adminService: adminService,
}
}
// CreateGroupRequest represents create group request
type CreateGroupRequest struct {
Name string `json:"name" binding:"required"`
Description string `json:"description"`
Platform string `json:"platform" binding:"omitempty,oneof=anthropic openai gemini antigravity sora"`
2025-12-18 13:50:39 +08:00
RateMultiplier float64 `json:"rate_multiplier"`
IsExclusive bool `json:"is_exclusive"`
SubscriptionType string `json:"subscription_type" binding:"omitempty,oneof=standard subscription"`
DailyLimitUSD *float64 `json:"daily_limit_usd"`
WeeklyLimitUSD *float64 `json:"weekly_limit_usd"`
MonthlyLimitUSD *float64 `json:"monthly_limit_usd"`
// 图片生成计费配置antigravity 和 gemini 平台使用,负数表示清除配置)
2026-01-23 22:24:46 +08:00
ImagePrice1K *float64 `json:"image_price_1k"`
ImagePrice2K *float64 `json:"image_price_2k"`
ImagePrice4K *float64 `json:"image_price_4k"`
2026-02-04 20:35:09 +08:00
SoraImagePrice360 *float64 `json:"sora_image_price_360"`
SoraImagePrice540 *float64 `json:"sora_image_price_540"`
SoraVideoPricePerRequest *float64 `json:"sora_video_price_per_request"`
SoraVideoPricePerRequestHD *float64 `json:"sora_video_price_per_request_hd"`
2026-01-23 22:24:46 +08:00
ClaudeCodeOnly bool `json:"claude_code_only"`
FallbackGroupID *int64 `json:"fallback_group_id"`
FallbackGroupIDOnInvalidRequest *int64 `json:"fallback_group_id_on_invalid_request"`
// 模型路由配置(仅 anthropic 平台使用)
ModelRouting map[string][]int64 `json:"model_routing"`
ModelRoutingEnabled bool `json:"model_routing_enabled"`
MCPXMLInject *bool `json:"mcp_xml_inject"`
2026-02-02 22:20:08 +08:00
// 支持的模型系列(仅 antigravity 平台使用)
SupportedModelScopes []string `json:"supported_model_scopes"`
// Sora 存储配额
SoraStorageQuotaBytes int64 `json:"sora_storage_quota_bytes"`
// 从指定分组复制账号(创建后自动绑定)
CopyAccountsFromGroupIDs []int64 `json:"copy_accounts_from_group_ids"`
2025-12-18 13:50:39 +08:00
}
// UpdateGroupRequest represents update group request
type UpdateGroupRequest struct {
Name string `json:"name"`
Description string `json:"description"`
Platform string `json:"platform" binding:"omitempty,oneof=anthropic openai gemini antigravity sora"`
2025-12-18 13:50:39 +08:00
RateMultiplier *float64 `json:"rate_multiplier"`
IsExclusive *bool `json:"is_exclusive"`
Status string `json:"status" binding:"omitempty,oneof=active inactive"`
SubscriptionType string `json:"subscription_type" binding:"omitempty,oneof=standard subscription"`
DailyLimitUSD *float64 `json:"daily_limit_usd"`
WeeklyLimitUSD *float64 `json:"weekly_limit_usd"`
MonthlyLimitUSD *float64 `json:"monthly_limit_usd"`
// 图片生成计费配置antigravity 和 gemini 平台使用,负数表示清除配置)
2026-01-23 22:24:46 +08:00
ImagePrice1K *float64 `json:"image_price_1k"`
ImagePrice2K *float64 `json:"image_price_2k"`
ImagePrice4K *float64 `json:"image_price_4k"`
2026-02-04 20:35:09 +08:00
SoraImagePrice360 *float64 `json:"sora_image_price_360"`
SoraImagePrice540 *float64 `json:"sora_image_price_540"`
SoraVideoPricePerRequest *float64 `json:"sora_video_price_per_request"`
SoraVideoPricePerRequestHD *float64 `json:"sora_video_price_per_request_hd"`
2026-01-23 22:24:46 +08:00
ClaudeCodeOnly *bool `json:"claude_code_only"`
FallbackGroupID *int64 `json:"fallback_group_id"`
FallbackGroupIDOnInvalidRequest *int64 `json:"fallback_group_id_on_invalid_request"`
// 模型路由配置(仅 anthropic 平台使用)
ModelRouting map[string][]int64 `json:"model_routing"`
ModelRoutingEnabled *bool `json:"model_routing_enabled"`
MCPXMLInject *bool `json:"mcp_xml_inject"`
2026-02-02 22:20:08 +08:00
// 支持的模型系列(仅 antigravity 平台使用)
SupportedModelScopes *[]string `json:"supported_model_scopes"`
// Sora 存储配额
SoraStorageQuotaBytes *int64 `json:"sora_storage_quota_bytes"`
// 从指定分组复制账号(同步操作:先清空当前分组的账号绑定,再绑定源分组的账号)
CopyAccountsFromGroupIDs []int64 `json:"copy_accounts_from_group_ids"`
2025-12-18 13:50:39 +08:00
}
// List handles listing all groups with pagination
// GET /api/v1/admin/groups
func (h *GroupHandler) List(c *gin.Context) {
page, pageSize := response.ParsePagination(c)
platform := c.Query("platform")
status := c.Query("status")
search := c.Query("search")
fix(admin): 代码审查修复 - 输入验证和测试完善 根据 Codex 代码审查报告,修复所有 P0 和 P1 优先级问题。 ## P0 紧急修复 ### 1. 修复集成测试编译错误 - 更新 group_repo_integration_test.go 中所有 ListWithFilters 调用 - 添加缺失的 search 参数(传入空字符串) - 修复 4 处旧签名调用,避免 CI 编译失败 ### 2. 添加统一的 search 参数输入验证 为所有 admin handler 添加一致的输入验证逻辑: - group_handler.go: 添加 TrimSpace + 长度限制 - proxy_handler.go: 添加 TrimSpace + 长度限制 - redeem_handler.go: 添加 TrimSpace + 长度限制 - user_handler.go: 添加 TrimSpace + 长度限制 验证规则: - TrimSpace() 去除首尾空格 - 最大长度 100 字符(防止 DoS 攻击) - 超长输入自动截断 ## P1 改进 ### 3. 补充 search 功能的单元测试 新增 admin_service_group_test.go 中的测试: - TestAdminService_ListGroups_WithSearch - search 参数正常传递到 repository 层 - search 为空字符串时的行为 - search 与其他过滤条件组合使用 新增 admin_service_search_test.go 文件: - 为其他 admin API 添加 search 测试覆盖 - 统一的测试模式和断言 ### 4. 补充 search 功能的集成测试 新增 group_repo_integration_test.go 测试场景: - TestListWithFilters_Search - 搜索 name 字段匹配 - 搜索 description 字段匹配 - 搜索不存在内容(返回空) - 大小写不敏感测试 - 特殊字符转义测试(%、_) - 与其他过滤条件组合 ## 测试结果 - ✅ 编译检查通过 - ✅ 单元测试全部通过 (3/3) - ✅ 集成测试编译通过 - ✅ 所有 service 测试通过 ## 影响范围 修改文件: 8 个 代码变更: +234 行 / -8 行 ## 相关 Issue 解决代码审查中的安全性和稳定性问题: - 防止 DoS 攻击(超长搜索字符串) - 修复测试编译错误(CI 阻塞问题) - 提升测试覆盖率
2026-01-09 19:43:19 +08:00
// 标准化和验证 search 参数
search = strings.TrimSpace(search)
if len(search) > 100 {
search = search[:100]
}
2025-12-18 13:50:39 +08:00
isExclusiveStr := c.Query("is_exclusive")
var isExclusive *bool
if isExclusiveStr != "" {
val := isExclusiveStr == "true"
isExclusive = &val
}
groups, total, err := h.adminService.ListGroups(c.Request.Context(), page, pageSize, platform, status, search, isExclusive)
2025-12-18 13:50:39 +08:00
if err != nil {
2025-12-25 20:52:47 +08:00
response.ErrorFrom(c, err)
2025-12-18 13:50:39 +08:00
return
}
outGroups := make([]dto.AdminGroup, 0, len(groups))
for i := range groups {
outGroups = append(outGroups, *dto.GroupFromServiceAdmin(&groups[i]))
}
response.Paginated(c, outGroups, total, page, pageSize)
2025-12-18 13:50:39 +08:00
}
// GetAll handles getting all active groups without pagination
// GET /api/v1/admin/groups/all
func (h *GroupHandler) GetAll(c *gin.Context) {
platform := c.Query("platform")
var groups []service.Group
2025-12-18 13:50:39 +08:00
var err error
if platform != "" {
groups, err = h.adminService.GetAllGroupsByPlatform(c.Request.Context(), platform)
} else {
groups, err = h.adminService.GetAllGroups(c.Request.Context())
}
if err != nil {
2025-12-25 20:52:47 +08:00
response.ErrorFrom(c, err)
2025-12-18 13:50:39 +08:00
return
}
outGroups := make([]dto.AdminGroup, 0, len(groups))
for i := range groups {
outGroups = append(outGroups, *dto.GroupFromServiceAdmin(&groups[i]))
}
response.Success(c, outGroups)
2025-12-18 13:50:39 +08:00
}
// GetByID handles getting a group by ID
// GET /api/v1/admin/groups/:id
func (h *GroupHandler) GetByID(c *gin.Context) {
groupID, err := strconv.ParseInt(c.Param("id"), 10, 64)
if err != nil {
response.BadRequest(c, "Invalid group ID")
return
}
group, err := h.adminService.GetGroup(c.Request.Context(), groupID)
if err != nil {
2025-12-25 20:52:47 +08:00
response.ErrorFrom(c, err)
2025-12-18 13:50:39 +08:00
return
}
response.Success(c, dto.GroupFromServiceAdmin(group))
2025-12-18 13:50:39 +08:00
}
// Create handles creating a new group
// POST /api/v1/admin/groups
func (h *GroupHandler) Create(c *gin.Context) {
var req CreateGroupRequest
if err := c.ShouldBindJSON(&req); err != nil {
response.BadRequest(c, "Invalid request: "+err.Error())
return
}
group, err := h.adminService.CreateGroup(c.Request.Context(), &service.CreateGroupInput{
2026-01-23 22:24:46 +08:00
Name: req.Name,
Description: req.Description,
Platform: req.Platform,
RateMultiplier: req.RateMultiplier,
IsExclusive: req.IsExclusive,
SubscriptionType: req.SubscriptionType,
DailyLimitUSD: req.DailyLimitUSD,
WeeklyLimitUSD: req.WeeklyLimitUSD,
MonthlyLimitUSD: req.MonthlyLimitUSD,
ImagePrice1K: req.ImagePrice1K,
ImagePrice2K: req.ImagePrice2K,
ImagePrice4K: req.ImagePrice4K,
2026-02-04 20:35:09 +08:00
SoraImagePrice360: req.SoraImagePrice360,
SoraImagePrice540: req.SoraImagePrice540,
SoraVideoPricePerRequest: req.SoraVideoPricePerRequest,
SoraVideoPricePerRequestHD: req.SoraVideoPricePerRequestHD,
2026-01-23 22:24:46 +08:00
ClaudeCodeOnly: req.ClaudeCodeOnly,
FallbackGroupID: req.FallbackGroupID,
FallbackGroupIDOnInvalidRequest: req.FallbackGroupIDOnInvalidRequest,
ModelRouting: req.ModelRouting,
ModelRoutingEnabled: req.ModelRoutingEnabled,
MCPXMLInject: req.MCPXMLInject,
2026-02-02 22:20:08 +08:00
SupportedModelScopes: req.SupportedModelScopes,
SoraStorageQuotaBytes: req.SoraStorageQuotaBytes,
2026-02-03 15:36:17 +08:00
CopyAccountsFromGroupIDs: req.CopyAccountsFromGroupIDs,
2025-12-18 13:50:39 +08:00
})
if err != nil {
2025-12-25 20:52:47 +08:00
response.ErrorFrom(c, err)
2025-12-18 13:50:39 +08:00
return
}
response.Success(c, dto.GroupFromServiceAdmin(group))
2025-12-18 13:50:39 +08:00
}
// Update handles updating a group
// PUT /api/v1/admin/groups/:id
func (h *GroupHandler) Update(c *gin.Context) {
groupID, err := strconv.ParseInt(c.Param("id"), 10, 64)
if err != nil {
response.BadRequest(c, "Invalid group ID")
return
}
var req UpdateGroupRequest
if err := c.ShouldBindJSON(&req); err != nil {
response.BadRequest(c, "Invalid request: "+err.Error())
return
}
group, err := h.adminService.UpdateGroup(c.Request.Context(), groupID, &service.UpdateGroupInput{
2026-01-23 22:24:46 +08:00
Name: req.Name,
Description: req.Description,
Platform: req.Platform,
RateMultiplier: req.RateMultiplier,
IsExclusive: req.IsExclusive,
Status: req.Status,
SubscriptionType: req.SubscriptionType,
DailyLimitUSD: req.DailyLimitUSD,
WeeklyLimitUSD: req.WeeklyLimitUSD,
MonthlyLimitUSD: req.MonthlyLimitUSD,
ImagePrice1K: req.ImagePrice1K,
ImagePrice2K: req.ImagePrice2K,
ImagePrice4K: req.ImagePrice4K,
2026-02-04 20:35:09 +08:00
SoraImagePrice360: req.SoraImagePrice360,
SoraImagePrice540: req.SoraImagePrice540,
SoraVideoPricePerRequest: req.SoraVideoPricePerRequest,
SoraVideoPricePerRequestHD: req.SoraVideoPricePerRequestHD,
2026-01-23 22:24:46 +08:00
ClaudeCodeOnly: req.ClaudeCodeOnly,
FallbackGroupID: req.FallbackGroupID,
FallbackGroupIDOnInvalidRequest: req.FallbackGroupIDOnInvalidRequest,
ModelRouting: req.ModelRouting,
ModelRoutingEnabled: req.ModelRoutingEnabled,
MCPXMLInject: req.MCPXMLInject,
2026-02-02 22:20:08 +08:00
SupportedModelScopes: req.SupportedModelScopes,
SoraStorageQuotaBytes: req.SoraStorageQuotaBytes,
2026-02-03 15:36:17 +08:00
CopyAccountsFromGroupIDs: req.CopyAccountsFromGroupIDs,
2025-12-18 13:50:39 +08:00
})
if err != nil {
2025-12-25 20:52:47 +08:00
response.ErrorFrom(c, err)
2025-12-18 13:50:39 +08:00
return
}
response.Success(c, dto.GroupFromServiceAdmin(group))
2025-12-18 13:50:39 +08:00
}
// Delete handles deleting a group
// DELETE /api/v1/admin/groups/:id
func (h *GroupHandler) Delete(c *gin.Context) {
groupID, err := strconv.ParseInt(c.Param("id"), 10, 64)
if err != nil {
response.BadRequest(c, "Invalid group ID")
return
}
err = h.adminService.DeleteGroup(c.Request.Context(), groupID)
if err != nil {
2025-12-25 20:52:47 +08:00
response.ErrorFrom(c, err)
2025-12-18 13:50:39 +08:00
return
}
response.Success(c, gin.H{"message": "Group deleted successfully"})
}
// GetStats handles getting group statistics
// GET /api/v1/admin/groups/:id/stats
func (h *GroupHandler) GetStats(c *gin.Context) {
groupID, err := strconv.ParseInt(c.Param("id"), 10, 64)
if err != nil {
response.BadRequest(c, "Invalid group ID")
return
}
// Return mock data for now
response.Success(c, gin.H{
"total_api_keys": 0,
"active_api_keys": 0,
"total_requests": 0,
"total_cost": 0.0,
})
_ = groupID // TODO: implement actual stats
}
// GetGroupAPIKeys handles getting API keys in a group
// GET /api/v1/admin/groups/:id/api-keys
func (h *GroupHandler) GetGroupAPIKeys(c *gin.Context) {
groupID, err := strconv.ParseInt(c.Param("id"), 10, 64)
if err != nil {
response.BadRequest(c, "Invalid group ID")
return
}
page, pageSize := response.ParsePagination(c)
keys, total, err := h.adminService.GetGroupAPIKeys(c.Request.Context(), groupID, page, pageSize)
if err != nil {
2025-12-25 20:52:47 +08:00
response.ErrorFrom(c, err)
2025-12-18 13:50:39 +08:00
return
}
outKeys := make([]dto.APIKey, 0, len(keys))
for i := range keys {
outKeys = append(outKeys, *dto.APIKeyFromService(&keys[i]))
}
response.Paginated(c, outKeys, total, page, pageSize)
2025-12-18 13:50:39 +08:00
}
// UpdateSortOrderRequest represents the request to update group sort orders
type UpdateSortOrderRequest struct {
Updates []struct {
ID int64 `json:"id" binding:"required"`
SortOrder int `json:"sort_order"`
} `json:"updates" binding:"required,min=1"`
}
// UpdateSortOrder handles updating group sort orders
// PUT /api/v1/admin/groups/sort-order
func (h *GroupHandler) UpdateSortOrder(c *gin.Context) {
var req UpdateSortOrderRequest
if err := c.ShouldBindJSON(&req); err != nil {
response.BadRequest(c, "Invalid request: "+err.Error())
return
}
updates := make([]service.GroupSortOrderUpdate, 0, len(req.Updates))
for _, u := range req.Updates {
updates = append(updates, service.GroupSortOrderUpdate{
ID: u.ID,
SortOrder: u.SortOrder,
})
}
if err := h.adminService.UpdateGroupSortOrders(c.Request.Context(), updates); err != nil {
response.ErrorFrom(c, err)
return
}
response.Success(c, gin.H{"message": "Sort order updated successfully"})
}