fix(寄件): 收敛授权上传范围并修正续期与收件关联

复用主干上传和存储驱动，移除独立上传、影子文件表及旧主题后台。仅为寄件保留后端关联、原子次数预占和容量校验；S3 寄件使用代理上传，拒绝并清理旧直传会话。

移除摘要双存，缺少原文的旧码停用并保留收件关联。恢复普通上传、2023 配置和公共驱动的上游行为。

验证：后端完整回归 134 项通过、2 项跳过，13 个子测试通过；三种存储寄件业务链与多文件 ZIP 投递验证通过。

Author: dawnstamp

apps/admin/dependencies.py

@@ -14,7 +14,6 @@
     ADMIN_SESSION_EXPIRE_MIN,
     settings,
 )
-from apps.admin.services import FileService, ConfigService, LocalFileService
 
 
 def _get_jwt_secret() -> bytes:
@@ -173,12 +172,18 @@ async def share_required_login(authorization: str = Header(default=None)):
 
 
 async def get_file_service():
+    # 工厂调用时加载业务服务，鉴权模块不依赖上传与文件管理实现。
+    from apps.admin.services import FileService
     return FileService()
 
 
 async def get_config_service():
+    # 工厂调用时加载业务服务，鉴权模块不依赖上传与文件管理实现。
+    from apps.admin.services import ConfigService
     return ConfigService()
 
 
 async def get_local_file_service():
+    # 工厂调用时加载业务服务，鉴权模块不依赖上传与文件管理实现。
+    from apps.admin.services import LocalFileService
     return LocalFileService()

apps/admin/services.py

@@ -14,7 +14,7 @@
 from apps.base.config import refresh_settings
 from apps.base.services import get_stored_download, response_from_download, stored_file_of
 from core.security import INTERNAL_CONFIG_KEYS, generate_jwt_secret
-from apps.base.models import DeliveryCode, DeliveryFile, FileCodes, KeyValue
+from apps.base.models import DeliveryCode, FileCodes, KeyValue
 from apps.base.utils import get_expire_info
 from apps.base.local_share import (
     LOCAL_REF_MARKER,
@@ -27,7 +27,7 @@
     should_skip_storage_delete,
 )
 from apps.base.metadata import normalize_metadata_note, normalize_metadata_tags
-from apps.base.share_storage import remove_delivery_share, storage_for_share, storage_type_for_share
+from apps.base.share_storage import storage_for_share, storage_type_for_share
 from fastapi import HTTPException
 from core.utils import get_now, hash_password, is_password_hashed, validate_background_url
 
@@ -104,9 +104,7 @@ def _file_metadata_key(self, file_id: int) -> str:
         return f"{self.FILE_METADATA_KEY_PREFIX}{file_id}"
 
     async def _delete_file_code(self, file_code: FileCodes):
-        # 寄件分享在两个管理入口使用相同撤销与清理逻辑，避免重复计费或遗留可用取件码。
-        if await remove_delivery_share(file_code):
-            return
+        # 寄件文件与普通文件共用删除流程，失败时保留记录供重试。
         # NAS 引用只删除分享记录，不能删除原始文件。
         if not should_skip_storage_delete(file_code):
             storage = await storage_for_share(file_code, self._file_storage)
@@ -227,7 +225,8 @@ async def update_file(
             raise HTTPException(status_code=404, detail="文件不存在")
 
         update_data: dict[str, Any] = {}
-        if code is not None and code != file_code.code:
+        # 历史私有文件没有公开口令，普通编辑不能改变其内部标识或公开权限。
+        if code is not None and not file_code.is_private and code != file_code.code:
             if await FileCodes.filter(code=code).first():
                 raise HTTPException(status_code=400, detail="code已存在")
             update_data["code"] = code
@@ -502,12 +501,9 @@ async def list_files(
         query = FileCodes.all()
         if delivery_id is not None:
             # 收件列表复用文件管理的数据与操作，只限定当前管理员选中的寄件码。
-            if not await DeliveryCode.filter(id=delivery_id, owner_id="admin").exists():
+            if not await DeliveryCode.filter(id=delivery_id).exists():
                 raise HTTPException(404, "寄件码不存在")
-            share_ids = await DeliveryFile.filter(
-                delivery_id=delivery_id, owner_id="admin", status="shared"
-            ).values_list("share_id", flat=True)
-            query = query.filter(id__in=share_ids)
+            query = query.filter(delivery_id=delivery_id)
         all_files = await query
         now = await get_now()
         enriched_files = []
@@ -610,7 +606,8 @@ async def _build_admin_file_item(
         )
         data = {
             "id": file_code.id,
-            "code": file_code.code,
+            "code": "" if file_code.is_private else file_code.code,
+            "is_private": file_code.is_private,
             "prefix": file_code.prefix,
             "suffix": file_code.suffix,
             "uuid_file_name": file_code.uuid_file_name,
@@ -685,10 +682,8 @@ async def get_file_detail(self, file_id: int):
             is_text=is_text,
         )
 
-        # 详情展示记录实际后端；历史普通文件没有可靠来源时显示 unknown。
-        actual_storage_type = await storage_type_for_share(file_code)
-        # 未知来源以 NULL 交给前端本地化，不能直接输出英文文案。
-        display_storage_type = actual_storage_type
+        # 只有寄件文件展示授权后端，普通文件仍显示站点当前设置。
+        display_storage_type = await storage_type_for_share(file_code)
         detail.update(
             {
                 "filename": detail["name"],
@@ -1417,7 +1412,7 @@ async def download_file(self, file_id: int):
         if file_code.text:
             return APIResponse(detail=file_code.text)
         else:
-            # 统一处理 NAS 引用路径及普通/寄件文件的存储快照。
+            # NAS 和普通下载沿用上游路径，寄件文件使用其授权后端。
             return response_from_download(await get_stored_download(file_code, self._file_storage))
 
     async def preview_file(self, file_id: int, max_chars: int = 4000):
@@ -1432,7 +1427,8 @@ async def preview_file(self, file_id: int, max_chars: int = 4000):
         preview = content[:max_chars]
         return {
             "id": file_code.id,
-            "code": file_code.code,
+            "code": "" if file_code.is_private else file_code.code,
+            "is_private": file_code.is_private,
             "name": f"{file_code.prefix}{file_code.suffix}",
             "type": "text",
             "content": preview,
@@ -1462,7 +1458,6 @@ async def share_local_file(self, item):
             suffix=suffix,
             uuid_file_name=local_file.file,
             file_path=LOCAL_REF_MARKER,
-            storage_type="local",
             size=local_file.size or 0,
             expired_at=expired_at,
             expired_count=expired_count,
@@ -1477,20 +1472,6 @@ async def share_local_file(self, item):
 
 
 class ConfigService:
-    # 2023 设置页仍使用迁移前的字段名；仅在旧管理接口边界转换，存储保持 snake_case。
-    LEGACY_CONFIG_FIELDS = {
-        "errorCount": "error_count",
-        "errorMinute": "error_minute",
-        "expireStyle": "expire_style",
-        "openUpload": "open_upload",
-        "robotsText": "robots_text",
-        "showAdminAddr": "show_admin_addr",
-        "themesChoices": "themes_choices",
-        "themesSelect": "themes_select",
-        "uploadCount": "upload_count",
-        "uploadMinute": "upload_minute",
-        "uploadSize": "upload_size",
-    }
     INT_FIELDS = {
         "admin_session_expire",
         "enable_chunk",
@@ -1514,45 +1495,22 @@ class ConfigService:
     }
     FLOAT_FIELDS = {"opacity"}
 
-    def get_config(self, *, legacy: bool = False):
+    def get_config(self):
         config = dict(settings.items())
         config["admin_token"] = ""
         for key in INTERNAL_CONFIG_KEYS:
             config.pop(key, None)
-        if legacy:
-            # 每个配置只返回一种键名，避免旧页面整表提交时携带两个互相冲突的值。
-            for old_key, current_key in self.LEGACY_CONFIG_FIELDS.items():
-                config[old_key] = config.pop(current_key)
         return config
 
     async def update_config(self, data: dict):
         current_config = dict(settings.items())
         next_config = dict(current_config)
-        # 必须在白名单过滤前转换，否则旧主题保存成功但主题、上传限制等实际未更新。
-        normalized_data = dict(data)
-        for old_key, current_key in self.LEGACY_CONFIG_FIELDS.items():
-            if old_key not in normalized_data:
-                continue
-            value = normalized_data.pop(old_key)
-            if current_key in normalized_data and normalized_data[current_key] != value:
-                raise HTTPException(status_code=400, detail=f"{current_key} 配置值冲突")
-            normalized_data[current_key] = value
         update_data = {
             key: value
-            for key, value in normalized_data.items()
-            if key in settings.default_config
-            and key not in INTERNAL_CONFIG_KEYS
-            and key != "themes_choices"  # 主题清单由程序维护，兼容旧字段时也不能允许客户端改写。
+            for key, value in data.items()
+            if key in settings.default_config and key not in INTERNAL_CONFIG_KEYS
         }
 
-        # 与寄件目录采用相同规则，允许空前缀表示普通上传的默认日期目录。
-        if "storage_path" in update_data:
-            from core.path_validation import validate_storage_directory
-            try:
-                update_data["storage_path"] = validate_storage_directory(update_data["storage_path"], allow_empty=True)
-            except ValueError as exc:
-                raise HTTPException(422, str(exc)) from None
-
         admin_token = update_data.get("admin_token")
         admin_password_changed = False
         if admin_token is None or admin_token == "":

apps/admin/views.py

@@ -532,10 +532,7 @@ async def file_view_presets_delete_post(
 async def get_config(
     config_service: ConfigService = Depends(get_config_service),
 ):
-    # 与实际返回的主题保持一致；2024 和公共 API 继续使用标准字段，2023 设置页使用旧字段。
-    from apps.base.pages import resolve_theme_root
-
-    return APIResponse(detail=config_service.get_config(legacy=resolve_theme_root().name == "2023"))
+    return APIResponse(detail=config_service.get_config())
 
 
 @admin_api.patch("/config/update")
@@ -545,8 +542,6 @@ async def update_config(
     file_service: FileService = Depends(get_file_service),
 ):
     data.pop("themes_choices", None)
-    # 旧主题会整表提交配置，同样剔除只读主题列表。
-    data.pop("themesChoices", None)
     await config_service.update_config(data)
     await file_service.record_admin_activity(
         action="config.update",

apps/base/migrations/migrations_011.py

@@ -1,4 +1,4 @@
-"""为普通文件及上传会话保存实际存储后端快照。"""
+"""仅为寄件分享保存授权指定的实际存储后端。"""
 
 from tortoise import connections
 
@@ -8,8 +8,6 @@ async def migrate():
     conn = connections.get("default")
     tables = {
         "filecodes": "storage_type",
-        "uploadchunk": "storage_type",
-        "presignuploadsession": "storage_type",
     }
     for table, column in tables.items():
         columns = await conn.execute_query_dict(f"PRAGMA table_info({table})")

apps/base/migrations/migrations_013.py

@@ -0,0 +1,72 @@
+"""收件归入普通文件表；旧私有文件保持私有，未完成上传迁入短期容量预留。"""
+
+import os
+import uuid
+from tortoise.transactions import in_transaction
+
+
+async def migrate():
+    # 整体事务保证迁移失败可以回滚，影子表仅在全部记录转移成功后移除。
+    async with in_transaction() as conn:
+        additions = {
+            "filecodes": {"delivery_id": "INT NULL", "is_private": "INT NOT NULL DEFAULT 0"},
+            "storagereservation": {
+                "delivery_id": "INT NULL", "auth_version": "INT NOT NULL DEFAULT 1",
+                "status": "VARCHAR(20) NOT NULL DEFAULT 'pending'",
+                "filename": "VARCHAR(255) NOT NULL DEFAULT ''",
+                "stored_name": "VARCHAR(255) NOT NULL DEFAULT ''",
+                "file_path": "VARCHAR(255) NOT NULL DEFAULT ''",
+                "storage_type": "VARCHAR(20) NULL",
+            },
+        }
+        for table, fields in additions.items():
+            names = {row["name"] for row in await conn.execute_query_dict(f"PRAGMA table_info({table})")}
+            for name, declaration in fields.items():
+                if name not in names:
+                    await conn.execute_query(f"ALTER TABLE {table} ADD COLUMN {name} {declaration}")
+        await conn.execute_query("CREATE INDEX IF NOT EXISTS idx_filecodes_delivery_id ON filecodes(delivery_id)")
+        await conn.execute_query("CREATE INDEX IF NOT EXISTS idx_reservation_delivery_id ON storagereservation(delivery_id)")
+        exists = await conn.execute_query_dict("SELECT name FROM sqlite_master WHERE type='table' AND name='deliveryfile'")
+        if not exists:
+            return
+        # 分批读取避免升级时将全部文件记录载入内存。
+        cursor = 0
+        while True:
+            rows = await conn.execute_query_dict("SELECT * FROM deliveryfile WHERE id > ? ORDER BY id LIMIT 100", [cursor])
+            if not rows:
+                break
+            for row in rows:
+                cursor = row["id"]
+                if row["status"] == "deleted":
+                    continue
+                code_id = row["delivery_id"]
+                # 旧版可能已物理删除耗尽口令；补只读历史壳以保留按码查收件的入口。
+                await conn.execute_query(
+                    "INSERT OR IGNORE INTO deliverycode (id, code_digest, name, storage_type, target_path, expires_at, max_uploads, enabled, deleted) "
+                    "VALUES (?, ?, ?, ?, '', CURRENT_TIMESTAMP, 1, 0, 0)",
+                    [code_id, uuid.uuid4().hex, "历史寄件（授权已撤销）", row["storage_type"]],
+                )
+                if row.get("share_id") is not None:
+                    await conn.execute_query(
+                        "UPDATE filecodes SET delivery_id = ?, storage_type = ?, upload_id = ? WHERE id = ?",
+                        [code_id, row["storage_type"], row["token"], row["share_id"]],
+                    )
+                elif row["status"] == "stored":
+                    prefix, suffix = os.path.splitext(row["filename"])
+                    await conn.execute_query(
+                        "INSERT INTO filecodes (code, prefix, suffix, uuid_file_name, file_path, size, expired_count, used_count, is_chunked, created_at, storage_type, delivery_id, is_private, upload_id) "
+                        "VALUES (?, ?, ?, ?, ?, ?, -1, 0, 0, ?, ?, ?, 1, ?)",
+                        [uuid.uuid4().hex, prefix, suffix, row["stored_name"], row["file_path"], row["size"], row["created_at"], row["storage_type"], code_id, row["token"]],
+                    )
+                elif row["status"] in {"pending", "finalizing", "cleanup"}:
+                    # 升级前未完成的上传统一取消并清理，不允许旧会话跨模型继续提交。
+                    await conn.execute_query("DELETE FROM storagereservation WHERE token IN (?, ?, ?)",
+                                             ["delivery:" + row["token"], "chunk:" + row["token"], "presign:" + row["token"]])
+                    await conn.execute_query(
+                        "INSERT OR IGNORE INTO storagereservation (token, size, expires_at, delivery_id, status, filename, stored_name, file_path, storage_type) "
+                        "VALUES (?, ?, CURRENT_TIMESTAMP, ?, 'cleanup', ?, ?, ?, ?)",
+                        [row["token"], row["size"], code_id, row["filename"], row["stored_name"], row["file_path"], row["storage_type"]],
+                    )
+        await conn.execute_query("UPDATE deliverycode SET reserved_count = 0")
+        await conn.execute_query("UPDATE deliverycode SET enabled = 0 WHERE used_count >= max_uploads OR deleted = 1")
+        await conn.execute_query("DROP TABLE deliveryfile")

apps/base/migrations/migrations_014.py

@@ -0,0 +1,54 @@
+"""移除重复口令摘要及预设账号归属；缺少原文的旧授权停用但保留收件关联。"""
+
+from tortoise.transactions import in_transaction
+
+
+async def migrate():
+    # SQLite 不能直接删除带唯一约束的旧列，使用事务内重建保留主键及全部业务字段。
+    async with in_transaction() as conn:
+        columns = {row["name"] for row in await conn.execute_query_dict("PRAGMA table_info(deliverycode)")}
+        if "code_digest" not in columns:
+            return
+        # 异常旧数据先中止升级，不能猜测同一口令应该属于哪条授权；错误不输出口令。
+        duplicates = await conn.execute_query_dict(
+            "SELECT MIN(id) AS first_id FROM deliverycode "
+            "WHERE code_value IS NOT NULL AND code_value != '' GROUP BY code_value HAVING COUNT(*) > 1"
+        )
+        if duplicates:
+            ids = ", ".join(str(row["first_id"]) for row in duplicates)
+            raise RuntimeError("寄件码原文存在重复，请先为相关记录重新设置不同口令，首条记录 ID：" + ids)
+        await conn.execute_query('''
+            CREATE TABLE deliverycode_without_digest (
+                id INTEGER PRIMARY KEY AUTOINCREMENT,
+                code_value VARCHAR(64) NULL UNIQUE,
+                auth_version INT NOT NULL DEFAULT 1,
+                name VARCHAR(100) NOT NULL,
+                note VARCHAR(2000) NOT NULL DEFAULT '',
+                tags JSON NOT NULL DEFAULT '[]',
+                storage_type VARCHAR(20) NOT NULL,
+                target_path VARCHAR(200) NOT NULL,
+                expires_at TIMESTAMP NOT NULL,
+                max_uploads INT NOT NULL,
+                used_count INT NOT NULL DEFAULT 0,
+                reserved_count INT NOT NULL DEFAULT 0,
+                enabled INT NOT NULL DEFAULT 1,
+                deleted INT NOT NULL DEFAULT 0,
+                created_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP
+            )
+        ''')
+        await conn.execute_query('''
+            INSERT INTO deliverycode_without_digest (
+                id, code_value, auth_version, name, note, tags, storage_type, target_path,
+                expires_at, max_uploads, used_count, reserved_count, enabled, deleted, created_at
+            )
+            SELECT id, NULLIF(code_value, ''),
+                auth_version + CASE WHEN code_value IS NULL OR code_value = '' THEN 1 ELSE 0 END,
+                name, note, tags, storage_type, target_path, expires_at, max_uploads,
+                used_count, reserved_count,
+                CASE WHEN code_value IS NULL OR code_value = '' THEN 0 ELSE enabled END,
+                deleted, created_at
+            FROM deliverycode
+        ''')
+        # ID 保持不变；已存在的 FileCodes.delivery_id 以及历史计数不会丢失。
+        await conn.execute_query("DROP TABLE deliverycode")
+        await conn.execute_query("ALTER TABLE deliverycode_without_digest RENAME TO deliverycode")