@code2rich/jpage 1.5.0

package/routes/files/detail-serve.js

@@ -0,0 +1,178 @@
+// 详情 / 原文 / 资源 / 渲染 / 下载 路由。
+// 从 routes/files.js 提取，行为保持不变。挂在共享 router 上。
+// 注册顺序：在静态路径（/、/search、/upload*）之后，其他 /:id/* 之前。
+
+const fs = require('fs');
+const path = require('path');
+const archiver = require('archiver');
+const { dbAll, dbGet } = require('../../lib/db');
+const { requireAuth, loadSession } = require('../../lib/middleware/auth');
+const { loadFileWithPrivacy } = require('../../lib/middleware/files');
+const { UPLOAD_DIR } = require('../../lib/paths');
+const { listBundleEntries, renderFile } = require('../../lib/render');
+const { setDownloadHeaders, isWithinBundle } = require('./_shared');
+const logger = require('../../logger');
+
+function registerDetailServe(router) {
+  // --- 详情 ---
+  router.get('/:id', loadSession, loadFileWithPrivacy, async (req, res) => {
+    try {
+      const f = req.fileRecord;
+      // 并行查询：tags / starred / category / version_count（WAL 下读不互斥）
+      const [tags, starredRow, cat, versionRow] = await Promise.all([
+        dbAll('SELECT t.id, t.name FROM tags t JOIN file_tags ft ON ft.tag_id = t.id WHERE ft.file_id = ?', [f.id]),
+        req.userId ? dbGet('SELECT 1 AS hit FROM starred_files WHERE user_id = ? AND file_id = ?', [req.userId, f.id]) : Promise.resolve(null),
+        f.category_id ? dbGet('SELECT name FROM categories WHERE id = ?', [f.category_id]) : Promise.resolve(null),
+        dbGet('SELECT COUNT(*) AS c FROM file_versions WHERE file_id = ?', [f.id]),
+      ]);
+      const starred = !!(starredRow && starredRow.hit);
+      const category_name = cat ? cat.name : null;
+      res.json({
+        id: f.id,
+        original_name: f.original_name,
+        file_type: f.file_type,
+        size: f.size,
+        is_public: f.is_public,
+        created_at: f.created_at,
+        updated_at: f.updated_at,
+        share_key: f.share_key,
+        category_id: f.category_id,
+        uploaded_by: f.uploaded_by,
+        is_bundle: f.is_bundle,
+        entry_path: f.entry_path,
+        view_count: f.view_count,
+        template_id: f.template_id,
+        version_count: versionRow ? versionRow.c : 0,
+        tags,
+        starred,
+        category_name,
+      });
+    } catch (e) {
+      logger.error({ type: 'app', error: e.message });
+      res.status(500).json({ error: '获取文件失败' });
+    }
+  });
+
+  // --- 原文 ---
+  router.get('/:id/content', requireAuth, loadFileWithPrivacy, async (req, res) => {
+    const file = req.fileRecord;
+    if (req.userRole !== 'admin' && file.uploaded_by !== req.userId) {
+      return res.status(403).json({ error: '无权读取此文件原文' });
+    }
+
+    // Bundle 没有单一原文：降级返回入口文件内容（源码视图）+ 目录清单 + 元信息。
+    // 这样前端预览页能正常进入，源码视图展示入口文件，完整包仍走 /download。
+    if (file.is_bundle) {
+      const bundleDir = path.join(UPLOAD_DIR, file.stored_name);
+      const entryPath = path.join(bundleDir, file.entry_path || 'index.html');
+      // 入口路径必须落在 bundle 目录内，防穿越（与 renderFile 同款校验）
+      if (!isWithinBundle(entryPath, bundleDir)) {
+        return res.status(403).json({ error: '非法路径' });
+      }
+      try {
+        // 入口读不到时降级为空串而非报错：预览页仍可用 iframe /render 与下载
+        const entryContent = await fs.promises.readFile(entryPath, 'utf-8').catch(() => '');
+        const { entries, truncated } = await listBundleEntries(bundleDir);
+        return res.json({
+          id: file.id,
+          original_name: file.original_name,
+          file_type: file.file_type,
+          is_public: file.is_public,
+          uploaded_by: file.uploaded_by,
+          is_bundle: file.is_bundle,
+          entry_path: file.entry_path,
+          template_id: file.template_id,
+          content: entryContent,
+          entries,
+          entries_truncated: truncated,
+        });
+      } catch (e) {
+        if (e && e.code === 'ENOENT') return res.status(404).json({ error: '文件已丢失' });
+        logger.error({ type: 'app', error: e.message });
+        return res.status(500).json({ error: '读取文件失败' });
+      }
+    }
+
+    const filePath = path.join(UPLOAD_DIR, file.stored_name);
+    try {
+      const content = await fs.promises.readFile(filePath, 'utf-8');
+      res.json({
+        id: file.id,
+        original_name: file.original_name,
+        file_type: file.file_type,
+        is_public: file.is_public,
+        uploaded_by: file.uploaded_by,
+        is_bundle: file.is_bundle,
+        template_id: file.template_id,
+        content
+      });
+    } catch (e) {
+      if (e && e.code === 'ENOENT') return res.status(404).json({ error: '文件已丢失' });
+      res.status(500).json({ error: '读取文件失败' });
+    }
+  });
+
+  // --- 资源（bundle 内静态文件） ---
+  router.get('/:id/asset/*', loadSession, loadFileWithPrivacy, async (req, res) => {
+    const file = req.fileRecord;
+    if (!file.is_bundle) return res.status(400).json({ error: '非网站包' });
+    const bundleDir = path.resolve(path.join(UPLOAD_DIR, file.stored_name));
+    const assetRelative = req.params[0];
+    const assetPath = path.resolve(path.join(bundleDir, assetRelative));
+    if (!isWithinBundle(assetPath, bundleDir)) {
+      return res.status(403).json({ error: '非法路径' });
+    }
+    try {
+      const stat = await fs.promises.stat(assetPath);
+      if (stat.isDirectory()) return res.status(404).json({ error: '资源不存在' });
+    } catch {
+      return res.status(404).json({ error: '资源不存在' });
+    }
+    res.sendFile(assetPath, (err) => {
+      if (err && !res.headersSent && err.code === 'ENOENT') {
+        res.status(404).json({ error: '资源不存在' });
+      }
+    });
+  });
+
+  // --- 渲染 ---
+  router.get('/:id/render', loadSession, loadFileWithPrivacy, async (req, res) => {
+    await renderFile(res, req.fileRecord);
+  });
+
+  // --- 下载 ---
+  router.get('/:id/download', loadSession, loadFileWithPrivacy, async (req, res) => {
+    const file = req.fileRecord;
+    if (file.is_bundle) {
+      const bundleDir = path.join(UPLOAD_DIR, file.stored_name);
+      try {
+        const st = await fs.promises.stat(bundleDir);
+        if (!st.isDirectory()) return res.status(404).json({ error: '文件已丢失' });
+      } catch {
+        return res.status(404).json({ error: '文件已丢失' });
+      }
+      setDownloadHeaders(res, file.original_name);
+      res.setHeader('Content-Type', 'application/zip');
+      const archive = archiver('zip', { zlib: { level: 9 } });
+      archive.directory(bundleDir, false);
+      archive.on('end', () => res.end());
+      archive.pipe(res);
+      return archive.finalize().catch(e => {
+        logger.error({ type: 'app', message: 'bundle 打包失败', error: e.message });
+        if (!res.headersSent) res.status(500).json({ error: '打包失败' });
+      });
+    }
+    const filePath = path.join(UPLOAD_DIR, file.stored_name);
+    setDownloadHeaders(res, file.original_name);
+    // 去掉同步 existsSync 预检：sendFile 找不到文件时走 errback 返回 404
+    res.sendFile(filePath, (err) => {
+      if (err && !res.headersSent) {
+        if (err.code === 'ENOENT') return res.status(404).json({ error: '文件已丢失' });
+        logger.error({ type: 'app', message: '下载失败', error: err.message });
+        return res.status(500).json({ error: '下载失败' });
+      }
+    });
+  });
+}
+
+module.exports = { registerDetailServe };

package/routes/files/index.js

@@ -0,0 +1,38 @@
+// 文件路由聚合器：创建单个 router，按**原始注册顺序**调用各子模块的 register。
+//
+// 为什么要保持顺序：Express 路由按声明顺序匹配。静态路径（/、/search、/upload、
+// /upload-json、/upload-zip-base64、/batch）必须先于 /:id 注册，否则会被 /:id 吞掉。
+// 这里用「共享 router」模式（而非子 router.use）正是为了把所有路由挂到同一个 router
+// 上、由聚合器统一管控顺序，避免拆分后路由匹配语义漂移。
+//
+// 外部入口仍是 routes/files.js（re-export 本文件），server.js 的 require 路径不变。
+
+const express = require('express');
+const { registerList } = require('./list');
+const { registerUpload } = require('./upload');
+const { registerCrud } = require('./crud');
+const { registerDetailServe } = require('./detail-serve');
+const { registerOverwrite } = require('./overwrite');
+const { registerVersions } = require('./versions');
+const { registerAssociations } = require('./associations');
+
+const router = express.Router();
+
+// 注册顺序 = routes/files.js 原始顺序，行为零差异：
+//   1. list          : GET /, GET /search              （静态路径，最先）
+//   2. upload        : POST /upload, /upload-json, /upload-zip-base64, POST /batch
+//                      注意：batch 在 crud 里，紧跟 upload 之后（原文件即如此）
+//   3. crud          : PUT /:id, DELETE /:id, POST /batch
+//   4. detail-serve  : GET /:id, /:id/content, /:id/asset/*, /:id/render, /:id/download
+//   5. overwrite     : POST /:id/overwrite, /:id/overwrite-json
+//   6. versions      : GET /:id/versions, ...content/render/restore, DELETE version
+//   7. associations  : PUT /:id/tags, star/unstar, /:id/category, GET /:id/stats
+registerList(router);
+registerUpload(router);
+registerCrud(router);          // 含 POST /batch（在 PUT/DELETE /:id 之间，与原文件一致）
+registerDetailServe(router);
+registerOverwrite(router);
+registerVersions(router);
+registerAssociations(router);
+
+module.exports = router;

package/routes/files/list.js

@@ -0,0 +1,200 @@
+// 文件列表 + 全文搜索路由。
+// 从 routes/files.js 提取，行为保持不变。挂在共享 router 上。
+// 注意：路由注册顺序敏感 —— `/` 和 `/search` 必须在 `/:id` 之前注册，
+// 否则 `/:id` 会吞掉这些静态路径。聚合器 routes/files/index.js 按序调用。
+
+const { dbGet, dbAll } = require('../../lib/db');
+const { requireAuth } = require('../../lib/middleware/auth');
+const { getCategoryName } = require('../../lib/categories');
+const { escapeFtsQuery } = require('../../lib/fts');
+const logger = require('../../logger');
+
+function registerList(router) {
+  // --- 列表 ---
+  router.get('/', requireAuth, async (req, res) => {
+    try {
+      const userId = req.userId;
+      const role = req.userRole;
+
+      // 分页参数
+      const page = Math.max(1, parseInt(req.query.page) || 1);
+      const maxLimit = 100;
+      const limit = Math.min(maxLimit, Math.max(1, parseInt(req.query.limit) || 20));
+      const offset = (page - 1) * limit;
+
+      // 排序参数（白名单校验，防 SQL 注入）
+      const allowedSorts = ['updated_at', 'created_at', 'original_name', 'size'];
+      const sort = allowedSorts.includes(req.query.sort) ? req.query.sort : 'updated_at';
+      const order = req.query.order === 'asc' ? 'ASC' : 'DESC';
+
+      // 筛选参数
+      const keyword = (req.query.keyword || '').trim();
+      const categoryId = req.query.category || null;
+      const tagId = req.query.tag || null;
+
+      // 构建 WHERE 条件
+      const conditions = [];
+      const params = [];
+
+      if (role !== 'admin') {
+        conditions.push(`f.uploaded_by = ?`);
+        params.push(userId);
+      }
+      if (keyword) {
+        conditions.push(`f.original_name LIKE ?`);
+        params.push(`%${keyword}%`);
+      }
+      if (categoryId === 'uncategorized') {
+        conditions.push(`f.category_id IS NULL`);
+      } else if (categoryId) {
+        conditions.push(`f.category_id = ?`);
+        params.push(parseInt(categoryId));
+      }
+      if (tagId) {
+        conditions.push(`EXISTS (SELECT 1 FROM file_tags ft WHERE ft.file_id = f.id AND ft.tag_id = ?)`);
+        params.push(parseInt(tagId));
+      }
+
+      const whereClause = conditions.length ? `WHERE ${conditions.join(' AND ')}` : '';
+
+      // 总数查询
+      const countRow = await dbGet(`SELECT COUNT(*) AS total FROM files f ${whereClause}`, params);
+      const total = countRow.total;
+      const totalPages = Math.ceil(total / limit) || 1;
+
+      // 数据查询
+      const sql = `SELECT f.id, f.original_name, f.file_type, f.size, f.is_public, f.created_at, f.updated_at, f.share_key, f.category_id, f.uploaded_by, f.is_bundle, f.entry_path, f.view_count, f.template_id,
+        (SELECT COUNT(*) FROM file_versions WHERE file_id = f.id) AS version_count
+      FROM files f ${whereClause} ORDER BY f.${sort} ${order} LIMIT ? OFFSET ?`;
+      const files = await dbAll(sql, [...params, limit, offset]);
+
+      const fileIdStr = files.length ? files.map(f => f.id).join(',') : '0';
+
+      // 批量获取标签
+      const tagRows = await dbAll(
+        `SELECT ft.file_id, t.id AS tag_id, t.name AS tag_name FROM file_tags ft JOIN tags t ON ft.tag_id = t.id WHERE ft.file_id IN (${fileIdStr})`
+      );
+      const tagsMap = {};
+      tagRows.forEach(r => {
+        if (!tagsMap[r.file_id]) tagsMap[r.file_id] = [];
+        tagsMap[r.file_id].push({ id: r.tag_id, name: r.tag_name });
+      });
+
+      // 批量获取收藏状态
+      let starredSet = new Set();
+      if (userId) {
+        const starRows = await dbAll(
+          `SELECT file_id FROM starred_files WHERE user_id = ? AND file_id IN (${fileIdStr})`, [userId]
+        );
+        starredSet = new Set(starRows.map(r => r.file_id));
+      }
+
+      // 分类名称走内存缓存（避免每次列表全表扫 categories）
+      const result = files.map(f => ({
+        ...f,
+        tags: tagsMap[f.id] || [],
+        starred: starredSet.has(f.id),
+        category_name: f.category_id ? getCategoryName(f.category_id) : null,
+      }));
+
+      res.json({
+        files: result,
+        pagination: { page, limit, total, totalPages }
+      });
+    } catch (e) {
+      res.status(500).json({ error: '获取文件列表失败' });
+    }
+  });
+
+  // --- 全文搜索 ---
+  // FTS5 的 MATCH 不能与普通列在 LEFT JOIN + OR 中混用（SQLite 报 "unable to use function MATCH"）。
+  // 因此用 UNION 合并两类命中：FTS 全文命中（带 snippet）+ 文件名 LIKE 命中（snippet 为 NULL）。
+  // UNION 自动按整行去重；外层 JOIN files 取详情，COUNT 与 LIMIT 同源，分页准确、无重复。
+  // 一次往返替代原来的两次全量查询 + 内存去重。
+  router.get('/search', requireAuth, async (req, res) => {
+    const q = (req.query.q || '').trim();
+    if (!q) return res.status(400).json({ error: '搜索关键词不能为空' });
+
+    const page = Math.max(1, parseInt(req.query.page) || 1);
+    const limit = Math.min(100, Math.max(1, parseInt(req.query.limit) || 20));
+    const offset = (page - 1) * limit;
+    const userId = req.userId;
+    const role = req.userRole;
+
+    const ftsQuery = escapeFtsQuery(q);
+    const likeQ = '%' + q + '%';
+    const useFts = !!ftsQuery;
+
+    try {
+      // 权限子句作用于外层 files 行
+      let permClause = '';
+      const permParams = [];
+      if (role !== 'admin') {
+        permClause = 'AND f.uploaded_by = ?';
+        permParams.push(userId);
+      }
+
+      // 匹配 id 集合（含 snippet）：FTS 命中 UNION 文件名命中
+      const matchedIdsSql = useFts
+        ? "(SELECT fts.file_id AS id, snippet(file_contents_fts, 0, '<mark>', '</mark>', '...', 32) AS snippet " +
+          'FROM file_contents_fts fts WHERE fts.content MATCH ? ' +
+          'UNION ' +
+          'SELECT f2.id AS id, NULL AS snippet FROM files f2 WHERE f2.original_name LIKE ?)'
+        : '(SELECT f2.id AS id, NULL AS snippet FROM files f2 WHERE f2.original_name LIKE ?)';
+      const matchedParams = useFts ? [ftsQuery, likeQ] : [likeQ];
+
+      const countRow = await dbGet(
+        'SELECT COUNT(*) AS total FROM files f JOIN ' + matchedIdsSql + ' m ON m.id = f.id WHERE 1=1 ' + permClause,
+        [...matchedParams, ...permParams]
+      );
+      const total = countRow.total;
+      const totalPages = Math.ceil(total / limit) || 1;
+
+      const files = await dbAll(
+        'SELECT f.id, f.original_name, f.file_type, f.size, f.is_public, f.created_at, f.updated_at, f.share_key, f.category_id, f.uploaded_by, f.is_bundle, f.entry_path, f.view_count, ' +
+        '(SELECT COUNT(*) FROM file_versions WHERE file_id = f.id) AS version_count, m.snippet ' +
+        'FROM files f JOIN ' + matchedIdsSql + ' m ON m.id = f.id WHERE 1=1 ' + permClause + ' ' +
+        'ORDER BY f.updated_at DESC LIMIT ? OFFSET ?',
+        [...matchedParams, ...permParams, limit, offset]
+      );
+
+      const fileIdStr = files.length ? files.map(f => f.id).join(',') : '0';
+
+      const tagRows = await dbAll(
+        'SELECT ft.file_id, t.id AS tag_id, t.name AS tag_name FROM file_tags ft JOIN tags t ON ft.tag_id = t.id WHERE ft.file_id IN (' + fileIdStr + ')'
+      );
+      const tagsMap = {};
+      tagRows.forEach(r => {
+        if (!tagsMap[r.file_id]) tagsMap[r.file_id] = [];
+        tagsMap[r.file_id].push({ id: r.tag_id, name: r.tag_name });
+      });
+
+      let starredSet = new Set();
+      if (userId) {
+        const starRows = await dbAll(
+          'SELECT file_id FROM starred_files WHERE user_id = ? AND file_id IN (' + fileIdStr + ')', [userId]
+        );
+        starredSet = new Set(starRows.map(r => r.file_id));
+      }
+
+      // 分类名称走内存缓存
+      const result = files.map(f => ({
+        ...f,
+        tags: tagsMap[f.id] || [],
+        starred: starredSet.has(f.id),
+        category_name: f.category_id ? getCategoryName(f.category_id) : null,
+      }));
+
+      res.json({
+        files: result,
+        query: q,
+        pagination: { page, limit, total, totalPages }
+      });
+    } catch (e) {
+      logger.error({ type: 'app', message: '搜索失败', error: e.message });
+      res.status(500).json({ error: '搜索失败' });
+    }
+  });
+}
+
+module.exports = { registerList };

package/routes/files/overwrite.js

@@ -0,0 +1,114 @@
+// 按 ID 覆盖上传（预览页专用）：multipart / JSON。自动保留版本历史。
+// 从 routes/files.js 提取，行为保持不变。挂在共享 router 上。
+
+const fs = require('fs');
+const path = require('path');
+const { dbGet } = require('../../lib/db');
+const { requireAuth } = require('../../lib/middleware/auth');
+const { unlinkQuiet, clientIp, decodeFilename } = require('../../lib/util');
+const { UPLOAD_DIR } = require('../../lib/paths');
+const { isFtsIndexable, indexFileContent } = require('../../lib/fts');
+const { uploadLimiter, upload, largeJson, MAX_FILE_SIZE, backupAndApplyVersion } = require('./_shared');
+const logger = require('../../logger');
+
+function registerOverwrite(router) {
+  // --- multipart 覆盖 ---
+  router.post('/:id/overwrite', requireAuth, uploadLimiter, upload.single('file'), async (req, res) => {
+    if (!req.file) return res.status(400).json({ error: '未上传文件' });
+    req.file.originalname = decodeFilename(req.file.originalname);
+    const ext = path.extname(req.file.originalname).toLowerCase();
+    let fileType = 'html';
+    if (ext === '.md' || ext === '.markdown') fileType = 'markdown';
+
+    try {
+      const file = await dbGet('SELECT * FROM files WHERE id = ?', [req.params.id]);
+      if (!file) return res.status(404).json({ error: '文件不存在' });
+
+      // 校验文件类型
+      if (file.file_type !== fileType) {
+        await unlinkQuiet(path.join(UPLOAD_DIR, req.file.filename));
+        return res.status(400).json({ error: '文件类型不匹配' });
+      }
+
+      const { version } = await backupAndApplyVersion(
+        file,
+        { storedName: req.file.filename, size: req.file.size },
+        file.uploaded_by
+      );
+
+      // FTS 索引同步
+      if (isFtsIndexable(fileType, req.file.filename)) {
+        indexFileContent(file.id, req.file.filename);
+      }
+
+      logger.audit('file.overwrite', { fileId: file.id, fileName: file.original_name, version, fileType, size: req.file.size, ip: clientIp(req) });
+      res.json({
+        id: file.id,
+        overwritten: true,
+        version,
+        original_name: file.original_name,
+        file_type: fileType,
+        size: req.file.size,
+        is_public: file.is_public,
+        share_key: file.share_key
+      });
+    } catch (e) {
+      res.status(500).json({ error: '覆盖上传失败' });
+    }
+  });
+
+  // --- JSON 覆盖 ---
+  router.post('/:id/overwrite-json', requireAuth, uploadLimiter, largeJson, async (req, res) => {
+    const { content } = req.body || {};
+    if (typeof content !== 'string') return res.status(400).json({ error: 'content 必须是字符串' });
+
+    let storedName;
+    try {
+      const file = await dbGet('SELECT * FROM files WHERE id = ?', [req.params.id]);
+      if (!file) return res.status(404).json({ error: '文件不存在' });
+
+      const size = Buffer.byteLength(content, 'utf-8');
+      if (size > MAX_FILE_SIZE) return res.status(400).json({ error: '文件大小超过50MB限制' });
+
+      const ext = file.file_type === 'markdown' ? '.md' : '.html';
+      const { generateStoredName } = require('./_shared');
+      storedName = generateStoredName(ext);
+      const filePath = path.join(UPLOAD_DIR, storedName);
+
+      try {
+        await fs.promises.writeFile(filePath, content, 'utf-8');
+      } catch (e) {
+        logger.error({ type: 'app', message: '写入文件失败', error: e.message });
+        return res.status(500).json({ error: '写入文件失败' });
+      }
+
+      const { version } = await backupAndApplyVersion(
+        file,
+        { storedName, size },
+        file.uploaded_by
+      );
+
+      // FTS 索引同步
+      if (isFtsIndexable(file.file_type, storedName)) {
+        indexFileContent(file.id, storedName);
+      }
+
+      logger.audit('file.overwrite', { fileId: file.id, fileName: file.original_name, version, fileType: file.file_type, size, ip: clientIp(req) });
+      res.json({
+        id: file.id,
+        overwritten: true,
+        version,
+        original_name: file.original_name,
+        file_type: file.file_type,
+        size,
+        is_public: file.is_public,
+        share_key: file.share_key
+      });
+    } catch (e) {
+      if (storedName) { await unlinkQuiet(path.join(UPLOAD_DIR, storedName)); }
+      res.status(500).json({ error: '覆盖上传失败' });
+    }
+  });
+}
+
+module.exports = { registerOverwrite };