feat: 文件存储安全加固 + 认证增强 + 媒体URL保护 + provider 重构

## 后端安全加固 - 新增 UserUploadPathResolver: 用户上传文件路径安全解析, 防目录穿越 - LocalReportFileStorage: 文件存储路径安全加固 - local_account_file_cleanup: 账号删除时文件清理逻辑增强 - AuthService: 认证逻辑增强 - file_endpoints / report_endpoints: 文件访问接口安全加固 - ai_chat_endpoints / doctor_endpoints: 接口安全调整 - Program.cs: 服务注册调整 ## 前端认证与媒体 - 新增 authenticated_network_image.dart: 带认证的图片加载组件 - auth_provider: 认证状态管理大幅增强(+173) - api_client: 网络客户端增强(+124) - chat_provider: 聊天 provider 重构(+76) - omron_device_provider: 蓝牙设备 provider 增强(+53) - sse_handler: SSE 处理增强(+35) - consultation_provider / data_providers / conversation_history_provider: 调整 ## 页面调整 - remaining_pages: 健康档案/饮食记录等页面增强(+115) - home_page / chat_messages_view: 主页微调 - doctor 端多页微调(consultations/dashboard/followups/patient_detail/profile/report_detail/reports) - report_pages / settings_pages / notification_prefs_page: 微调 - device_scan_page / diet_capture_page / admin_home_page: 微调 ## 测试 - 新增 file_path_security_tests: 文件路径安全测试 - 新增 protected_media_url_test: 媒体URL保护测试 - 新增 user_session_identity_test: 用户会话身份测试 - account_deletion_tests / application_service_tests / auth_tests: 更新
2026-07-20 10:19:01 +08:00
parent 0d4fd88ce7
commit 9cea41705e
48 changed files with 1181 additions and 212 deletions
--- a/backend/src/Health.WebApi/Endpoints/ai_chat_endpoints.cs
+++ b/backend/src/Health.WebApi/Endpoints/ai_chat_endpoints.cs
@@ -24,13 +24,12 @@ public static class AiChatEndpoints

    public static void MapAiChatEndpoints(this WebApplication app)
    {
-        // SSE 流式对话（GET 方式，token 通过 query string 传递）
+        // SSE 流式对话。认证统一走 ASP.NET Core JWT 中间件。
        app.MapGet("/api/ai/{agentType}/chat", async (
            string message,
            string? conversationId,
            string? imageUrl,
            string? pdfUrl,
-            string token,
            string agentType,
            HttpContext http,
            DeepSeekClient llmClient,
@@ -43,8 +42,7 @@ public static class AiChatEndpoints
            IPatientContextService patientContexts,
            CancellationToken ct) =>
        {
-            // 支持 token 通过 query string（浏览器 EventSource）或 header 传递
-            var userId = GetUserId(http) ?? GetUserIdFromToken(token);
+            var userId = GetUserId(http);
            if (userId == null)
            {
                http.Response.StatusCode = 401;
@@ -89,7 +87,7 @@ public static class AiChatEndpoints
                await SseWriteAsync(http, new { action = "conversation_id", data = activeConversationId.ToString() }, ct);

            // 附件解析（图片走 VLM、PDF 走 PdfPig），结果同时拼 LLM 上下文 + 持久化到 user message metadata
-            var attachment = await attachments.BuildAsync(imageUrl, pdfUrl, ct);
+            var attachment = await attachments.BuildAsync(userId.Value, imageUrl, pdfUrl, ct);
            string? userMessageMetadataJson = null;
            if (attachment != null)
            {
@@ -277,7 +275,7 @@ public static class AiChatEndpoints

            await SseWriteAsync(http, new { action = "status", data = completedNormally ? "done" : "error" }, ct);
            await http.Response.WriteAsync("data: [DONE]\n\n", ct);
-        });
+        }).RequireAuthorization();

        app.MapPost("/api/ai/confirm-write/{commandId:guid}", async (
            Guid commandId,
@@ -327,7 +325,7 @@ public static class AiChatEndpoints
                : Results.Json(
                    new { code = 40401, data = (object?)null, message = "对话不存在" },
                    statusCode: StatusCodes.Status404NotFound);
-        });
+        }).RequireAuthorization();

        // 一键清空当前用户的全部对话
        app.MapDelete("/api/ai/conversations", async (HttpContext http, IAiConversationService conversations, CancellationToken ct) =>
@@ -421,19 +419,6 @@ public static class AiChatEndpoints
    private static Guid? GetUserId(HttpContext http) =>
        Guid.TryParse(http.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value, out var id) ? id : null;

-    private static Guid? GetUserIdFromToken(string? token)
-    {
-        if (string.IsNullOrEmpty(token)) return null;
-        try
-        {
-            var handler = new System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler();
-            var jwt = handler.ReadJwtToken(token);
-            var sub = jwt.Claims.FirstOrDefault(c => c.Type == System.Security.Claims.ClaimTypes.NameIdentifier)?.Value;
-            return sub != null && Guid.TryParse(sub, out var id) ? id : null;
-        }
-        catch (Exception) { return null; }
-    }
-
    private static async Task TryUpdateConversationSummaryAsync(
        IAiConversationService conversations,
        DeepSeekClient llmClient,
--- a/backend/src/Health.WebApi/Endpoints/doctor_endpoints.cs
+++ b/backend/src/Health.WebApi/Endpoints/doctor_endpoints.cs
@@ -43,6 +43,20 @@ public static class DoctorEndpoints
        return (startUtc, startUtc.AddDays(1));
    }

+    private static DateTime ParseBeijingDateTimeAsUtc(string value)
+    {
+        if (DateTimeOffset.TryParse(value, out var offset) &&
+            (value.EndsWith("Z", StringComparison.OrdinalIgnoreCase) ||
+             value.LastIndexOf('+') > 9 ||
+             value.LastIndexOf('-') > 9))
+            return offset.UtcDateTime;
+
+        var beijing = DateTime.Parse(value);
+        return DateTime.SpecifyKind(
+            DateTime.SpecifyKind(beijing, DateTimeKind.Unspecified).AddHours(-8),
+            DateTimeKind.Utc);
+    }
+
    public static void MapDoctorEndpoints(this WebApplication app)
    {
        var group = app.MapGroup("/api/doctor").RequireAuthorization();
@@ -304,7 +318,7 @@ public static class DoctorEndpoints
                query = query.Where(r => r.Status == s);

            var reports = await query.OrderByDescending(r => r.CreatedAt)
-                .Select(r => new { r.Id, r.UserId, PatientName = r.User.Name, r.FileUrl, FileType = r.FileType.ToString(), Category = r.Category.ToString(), Status = r.Status.ToString(), r.Severity, r.AiSummary, r.AiIndicators, r.DoctorComment, r.DoctorRecommendation, r.DoctorName, r.ReviewedAt, r.CreatedAt })
+                .Select(r => new { r.Id, r.UserId, PatientName = r.User.Name, FileUrl = "/api/reports/" + r.Id + "/file", FileType = r.FileType.ToString(), Category = r.Category.ToString(), Status = r.Status.ToString(), r.Severity, r.AiSummary, r.AiIndicators, r.DoctorComment, r.DoctorRecommendation, r.DoctorName, r.ReviewedAt, r.CreatedAt })
                .ToListAsync();
            return Results.Ok(new { code = 0, data = reports, message = (string?)null });
        });
@@ -317,7 +331,7 @@ public static class DoctorEndpoints
                return Results.Ok(new { code = 500, data = (object?)null, message = "医生档案未关联" });

            var report = await db.Reports.Where(r => r.Id == id && r.User.DoctorId == doctorId)
-                .Select(r => new { r.Id, r.UserId, PatientName = r.User.Name, r.FileUrl, FileType = r.FileType.ToString(), Category = r.Category.ToString(), Status = r.Status.ToString(), r.Severity, r.AiSummary, r.AiIndicators, r.DoctorComment, r.DoctorRecommendation, r.DoctorName, r.ReviewedAt, r.CreatedAt })
+                .Select(r => new { r.Id, r.UserId, PatientName = r.User.Name, FileUrl = "/api/reports/" + r.Id + "/file", FileType = r.FileType.ToString(), Category = r.Category.ToString(), Status = r.Status.ToString(), r.Severity, r.AiSummary, r.AiIndicators, r.DoctorComment, r.DoctorRecommendation, r.DoctorName, r.ReviewedAt, r.CreatedAt })
                .FirstOrDefaultAsync();
            if (report == null) return Results.Ok(new { code = 404, data = (object?)null, message = "报告不存在" });
            return Results.Ok(new { code = 0, data = report, message = (string?)null });
@@ -391,7 +405,7 @@ public static class DoctorEndpoints
                Title = json.RootElement.GetProperty("title").GetString() ?? "",
                DoctorName = profile.Name,
                Department = profile.Department,
-                ScheduledAt = DateTime.Parse(json.RootElement.GetProperty("scheduledAt").GetString()!),
+                ScheduledAt = ParseBeijingDateTimeAsUtc(json.RootElement.GetProperty("scheduledAt").GetString()!),
                Notes = json.RootElement.TryGetProperty("notes", out var n) ? n.GetString() : null,
                Status = FollowUpStatus.Upcoming,
                CreatedAt = DateTime.UtcNow
@@ -415,7 +429,7 @@ public static class DoctorEndpoints
            var body = await reader.ReadToEndAsync(ct);
            var json = System.Text.Json.JsonDocument.Parse(body);
            if (json.RootElement.TryGetProperty("title", out var t)) followUp.Title = t.GetString() ?? followUp.Title;
-            if (json.RootElement.TryGetProperty("scheduledAt", out var sa)) followUp.ScheduledAt = DateTime.Parse(sa.GetString()!);
+            if (json.RootElement.TryGetProperty("scheduledAt", out var sa)) followUp.ScheduledAt = ParseBeijingDateTimeAsUtc(sa.GetString()!);
            if (json.RootElement.TryGetProperty("notes", out var no)) followUp.Notes = no.GetString();
            if (json.RootElement.TryGetProperty("status", out var st) && Enum.TryParse<FollowUpStatus>(st.GetString(), out var fs)) followUp.Status = fs;
            await db.SaveChangesAsync(ct);
--- a/backend/src/Health.WebApi/Endpoints/file_endpoints.cs
+++ b/backend/src/Health.WebApi/Endpoints/file_endpoints.cs
@@ -1,3 +1,5 @@
+using Health.Infrastructure.Files;
+
 namespace Health.WebApi.Endpoints;

 public static class FileEndpoints
@@ -47,24 +49,48 @@ public static class FileEndpoints

                var storedName = $"{fileId}{ext}";
                var filePath = Path.Combine(uploadsDir, $"{fileId}{ext}");
-                await using var stream = new FileStream(filePath, FileMode.Create);
+                await using var stream = new FileStream(filePath, FileMode.CreateNew);
                await file.CopyToAsync(stream, ct);
                results.Add(new
                {
                    id = fileId,
                    name = file.FileName,
                    size = file.Length,
-                    url = $"/uploads/users/{userDirectoryName}/{storedName}",
+                    url = $"/api/files/content/{storedName}",
                    contentType = string.IsNullOrWhiteSpace(file.ContentType) ? "application/octet-stream" : file.ContentType
                });
            }

            return Results.Ok(new { code = 0, data = results, message = (string?)null });
        });
+
+        group.MapGet("/content/{fileName}", (string fileName, HttpContext http) =>
+        {
+            var userId = GetUserId(http);
+            var filePath = UserUploadPathResolver.Resolve(userId, fileName);
+            if (filePath == null || !File.Exists(filePath))
+                return Results.NotFound();
+
+            return Results.File(
+                filePath,
+                ContentTypeFor(filePath),
+                enableRangeProcessing: true);
+        });
    }

    private static Guid GetUserId(HttpContext http) =>
        Guid.TryParse(http.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value, out var id)
            ? id
            : Guid.Empty;
+
+    private static string ContentTypeFor(string path) =>
+        Path.GetExtension(path).ToLowerInvariant() switch
+        {
+            ".jpg" or ".jpeg" => "image/jpeg",
+            ".png" => "image/png",
+            ".webp" => "image/webp",
+            ".gif" => "image/gif",
+            ".pdf" => "application/pdf",
+            _ => "application/octet-stream"
+        };
 }
--- a/backend/src/Health.WebApi/Endpoints/report_endpoints.cs
+++ b/backend/src/Health.WebApi/Endpoints/report_endpoints.cs
@@ -24,6 +24,47 @@ public static class ReportEndpoints
                : Results.Ok(new { code = 0, data = report, message = (string?)null });
        });

+        group.MapGet("/{id:guid}/file", async (
+            Guid id,
+            HttpContext http,
+            AppDbContext db,
+            IReportFileStorage fileStorage,
+            CancellationToken ct) =>
+        {
+            var currentUserId = GetUserId(http);
+            var report = await db.Reports
+                .Include(r => r.User)
+                .FirstOrDefaultAsync(r => r.Id == id, ct);
+            if (report == null)
+                return Results.NotFound();
+
+            var allowed = report.UserId == currentUserId;
+            if (!allowed && GetRole(http) == "Doctor")
+            {
+                var doctorId = await db.DoctorProfiles
+                    .Where(profile => profile.UserId == currentUserId)
+                    .Select(profile => profile.DoctorId)
+                    .FirstOrDefaultAsync(ct);
+                allowed = doctorId != null && report.User.DoctorId == doctorId;
+            }
+            if (!allowed)
+                return Results.NotFound();
+
+            var filePath = fileStorage.GetLocalFilePath(report.FileUrl);
+            if (!fileStorage.Exists(filePath))
+                return Results.NotFound();
+
+            var contentType = Path.GetExtension(filePath).ToLowerInvariant() switch
+            {
+                ".jpg" or ".jpeg" => "image/jpeg",
+                ".png" => "image/png",
+                ".webp" => "image/webp",
+                ".pdf" => "application/pdf",
+                _ => "application/octet-stream"
+            };
+            return Results.File(filePath, contentType, enableRangeProcessing: true);
+        });
+
        group.MapPost("/", async (HttpContext http, IReportService reports, CancellationToken ct) =>
        {
            var userId = GetUserId(http);
@@ -66,4 +107,9 @@ public static class ReportEndpoints

    private static Guid GetUserId(HttpContext http) =>
        Guid.TryParse(http.User.FindFirst(System.Security.Claims.ClaimTypes.NameIdentifier)?.Value, out var id) ? id : Guid.Empty;
+
+    private static string GetRole(HttpContext http) =>
+        http.User.FindFirst(System.Security.Claims.ClaimTypes.Role)?.Value ??
+        http.User.FindFirst("Role")?.Value ??
+        "User";
 }
--- a/backend/src/Health.WebApi/Program.cs
+++ b/backend/src/Health.WebApi/Program.cs
@@ -34,7 +34,6 @@ using Health.WebApi.Middleware;
 using Microsoft.AspNetCore.DataProtection;
 using Microsoft.AspNetCore.Authentication.JwtBearer;
 using Microsoft.EntityFrameworkCore;
-using Microsoft.Extensions.FileProviders;
 using Microsoft.IdentityModel.Tokens;

 // 加载 .env 文件（开发环境）
@@ -211,13 +210,8 @@ app.UseAuthorization();
 app.UseDefaultFiles();
 app.UseStaticFiles();

-var uploadsPath = Path.Combine(Directory.GetCurrentDirectory(), "uploads");
-Directory.CreateDirectory(uploadsPath);
-app.UseStaticFiles(new StaticFileOptions
-{
-    FileProvider = new PhysicalFileProvider(uploadsPath),
-    RequestPath = "/uploads"
-});
+// 用户上传文件不能作为静态目录公开；统一通过带鉴权和归属校验的 API 读取。
+Directory.CreateDirectory(Path.Combine(Directory.GetCurrentDirectory(), "uploads"));

 if (app.Environment.IsDevelopment())
    app.MapOpenApi();