## 后端安全加固 - 新增 UserUploadPathResolver: 用户上传文件路径安全解析, 防目录穿越 - LocalReportFileStorage: 文件存储路径安全加固 - local_account_file_cleanup: 账号删除时文件清理逻辑增强 - AuthService: 认证逻辑增强 - file_endpoints / report_endpoints: 文件访问接口安全加固 - ai_chat_endpoints / doctor_endpoints: 接口安全调整 - Program.cs: 服务注册调整 ## 前端认证与媒体 - 新增 authenticated_network_image.dart: 带认证的图片加载组件 - auth_provider: 认证状态管理大幅增强(+173) - api_client: 网络客户端增强(+124) - chat_provider: 聊天 provider 重构(+76) - omron_device_provider: 蓝牙设备 provider 增强(+53) - sse_handler: SSE 处理增强(+35) - consultation_provider / data_providers / conversation_history_provider: 调整 ## 页面调整 - remaining_pages: 健康档案/饮食记录等页面增强(+115) - home_page / chat_messages_view: 主页微调 - doctor 端多页微调(consultations/dashboard/followups/patient_detail/profile/report_detail/reports) - report_pages / settings_pages / notification_prefs_page: 微调 - device_scan_page / diet_capture_page / admin_home_page: 微调 ## 测试 - 新增 file_path_security_tests: 文件路径安全测试 - 新增 protected_media_url_test: 媒体URL保护测试 - 新增 user_session_identity_test: 用户会话身份测试 - account_deletion_tests / application_service_tests / auth_tests: 更新
123 lines
4.4 KiB
C#
123 lines
4.4 KiB
C#
using Health.Domain.Entities;
|
||
using Health.Domain.Enums;
|
||
|
||
namespace Health.Application.Reports;
|
||
|
||
public sealed class ReportService(
|
||
IReportRepository reports,
|
||
IReportFileStorage fileStorage,
|
||
IReportAnalysisQueue queue) : IReportService
|
||
{
|
||
private const long MaxReportFileBytes = 20 * 1024 * 1024;
|
||
private static readonly HashSet<string> AllowedExtensions = new(StringComparer.OrdinalIgnoreCase)
|
||
{
|
||
".jpg", ".jpeg", ".png", ".webp", ".pdf"
|
||
};
|
||
|
||
private readonly IReportRepository _reports = reports;
|
||
private readonly IReportFileStorage _fileStorage = fileStorage;
|
||
private readonly IReportAnalysisQueue _queue = queue;
|
||
|
||
public async Task<IReadOnlyList<ReportDto>> GetReportsAsync(Guid userId, CancellationToken ct)
|
||
{
|
||
var result = await _reports.ListAsync(userId, ct);
|
||
return result.Select(ToDto).ToList();
|
||
}
|
||
|
||
public async Task<ReportDto?> GetReportAsync(Guid userId, Guid reportId, CancellationToken ct)
|
||
{
|
||
var report = await _reports.GetOwnedAsync(userId, reportId, ct);
|
||
return report == null ? null : ToDto(report);
|
||
}
|
||
|
||
public async Task<ReportUploadResult> UploadReportAsync(Guid userId, ReportUploadFile file, CancellationToken ct)
|
||
{
|
||
if (file.Length <= 0)
|
||
return Fail(400, "未上传文件");
|
||
|
||
if (file.Length > MaxReportFileBytes)
|
||
return Fail(400, "报告文件不能超过 20MB,请压缩后重新上传");
|
||
|
||
var ext = Path.GetExtension(file.FileName).ToLowerInvariant();
|
||
if (!AllowedExtensions.Contains(ext))
|
||
return Fail(400, "目前支持上传 JPG、PNG、WEBP 图片或 PDF 报告");
|
||
|
||
var storedFile = await _fileStorage.SaveAsync(file, ext, ct);
|
||
var report = new Report
|
||
{
|
||
Id = Guid.NewGuid(),
|
||
UserId = userId,
|
||
FileUrl = storedFile.FileUrl,
|
||
FileType = ext == ".pdf" ? ReportFileType.Pdf : ReportFileType.Image,
|
||
Category = ReportCategory.Other,
|
||
Status = ReportStatus.Analyzing,
|
||
AiSummary = null,
|
||
AiIndicators = null,
|
||
CreatedAt = DateTime.UtcNow,
|
||
};
|
||
|
||
await _reports.AddAsync(report, ct);
|
||
await _queue.EnqueueAsync(new ReportAnalysisJob(Guid.NewGuid(), report.Id, storedFile.FilePath), ct);
|
||
|
||
return new ReportUploadResult(true, 0, "报告已上传,AI 正在分析中", ToDto(report));
|
||
}
|
||
|
||
public async Task<bool> DeleteReportAsync(Guid userId, Guid reportId, CancellationToken ct)
|
||
{
|
||
var report = await _reports.GetOwnedAsync(userId, reportId, ct);
|
||
if (report == null) return false;
|
||
|
||
var filePath = _fileStorage.GetLocalFilePath(report.FileUrl);
|
||
if (_fileStorage.Exists(filePath))
|
||
_fileStorage.Delete(filePath);
|
||
|
||
_reports.Delete(report);
|
||
await _reports.SaveChangesAsync(ct);
|
||
return true;
|
||
}
|
||
|
||
public async Task<bool> ReanalyzeReportAsync(Guid userId, Guid reportId, CancellationToken ct)
|
||
{
|
||
var report = await _reports.GetOwnedAsync(userId, reportId, ct);
|
||
if (report == null) return false;
|
||
|
||
var filePath = _fileStorage.GetLocalFilePath(report.FileUrl);
|
||
if (!_fileStorage.Exists(filePath)) return false;
|
||
|
||
report.Status = ReportStatus.Analyzing;
|
||
report.AiSummary = null;
|
||
report.AiIndicators = null;
|
||
await _queue.EnqueueAsync(new ReportAnalysisJob(Guid.NewGuid(), report.Id, filePath), ct);
|
||
return true;
|
||
}
|
||
|
||
public static ReportDto ToDto(Report report) => new(
|
||
report.Id,
|
||
report.UserId,
|
||
$"/api/reports/{report.Id}/file",
|
||
report.FileType.ToString(),
|
||
report.Category.ToString(),
|
||
report.Status.ToString(),
|
||
ToAiStatus(report),
|
||
report.Status == ReportStatus.DoctorReviewed ? "Reviewed" : "Pending",
|
||
report.Severity,
|
||
report.AiSummary,
|
||
report.AiIndicators,
|
||
report.DoctorComment,
|
||
report.DoctorRecommendation,
|
||
report.DoctorName,
|
||
report.ReviewedAt,
|
||
report.CreatedAt);
|
||
|
||
private static string ToAiStatus(Report report) => report.Status switch
|
||
{
|
||
ReportStatus.Analyzing => "Analyzing",
|
||
ReportStatus.AnalysisFailed => "Failed",
|
||
_ when string.IsNullOrWhiteSpace(report.AiSummary) => "Analyzing",
|
||
_ => "Succeeded"
|
||
};
|
||
|
||
private static ReportUploadResult Fail(int code, string message) =>
|
||
new(false, code, message, null);
|
||
}
|