127 lines
5.0 KiB
Python
127 lines
5.0 KiB
Python
"""
|
||
评论路由。
|
||
|
||
接口（统一响应格式 {success, data, message}）：
|
||
- POST /api/comment/add 发表评论或回复（仅好友/博主；content 最长 2000 字；parent_id 指定回复对象）
|
||
- GET /api/comment/list 评论列表（可见性与文章一致；按时间升序，返回 parent_id 供前端分组展示）
|
||
|
||
权限：
|
||
- 游客不可评论；visitor 角色不可评论（需先成为好友）。
|
||
- 好友文章仅好友/博主可查看评论。
|
||
"""
|
||
|
||
import os
|
||
from typing import Optional
|
||
|
||
from fastapi import APIRouter, Depends, HTTPException, Request, status
|
||
from sqlalchemy.orm import Session
|
||
|
||
from ..auth import get_current_user
|
||
from ..database import get_db
|
||
from ..models import (
|
||
ROLE_BLOGGER,
|
||
ROLE_FRIEND,
|
||
VISIBILITY_FRIEND,
|
||
Article,
|
||
Comment,
|
||
User,
|
||
)
|
||
from ..schemas import CommentCreate, UnifiedResponse
|
||
from ..security import action_limiter, get_client_ip
|
||
from .deps import can_read_friend_article, get_optional_user
|
||
|
||
router = APIRouter(prefix="/api/comment", tags=["comment"])
|
||
|
||
# 评论内容长度限制（可通过 .env 的 COMMENT_MAX_LENGTH 调整，默认 2000）
|
||
COMMENT_MAX_LENGTH = int(os.getenv("COMMENT_MAX_LENGTH") or "2000")
|
||
|
||
|
||
@router.post("/add", response_model=UnifiedResponse)
|
||
def add_comment(
|
||
payload: CommentCreate,
|
||
request: Request,
|
||
current_user: User = Depends(get_current_user),
|
||
db: Session = Depends(get_db),
|
||
) -> UnifiedResponse:
|
||
"""发表评论或回复：仅好友或博主可评论，回复时 parent_id 必须属于同一篇文章。"""
|
||
# 写操作限流（IP 维度）：防止好友账号刷屏
|
||
if action_limiter.is_blocked(get_client_ip(request)):
|
||
raise HTTPException(status_code=status.HTTP_429_TOO_MANY_REQUESTS, detail="操作过于频繁，请稍后再试")
|
||
if current_user.role not in (ROLE_FRIEND, ROLE_BLOGGER):
|
||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="只有好友或博主可以评论")
|
||
article = db.query(Article).filter(Article.id == payload.article_id).first()
|
||
if article is None:
|
||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="文章不存在")
|
||
|
||
content = payload.content.strip()
|
||
if not content:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="评论内容不能为空")
|
||
if len(content) > COMMENT_MAX_LENGTH:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail=f"评论内容不能超过 {COMMENT_MAX_LENGTH} 字")
|
||
|
||
# 回复校验：父评论必须存在且属于同一篇文章，且不允许回复自身（无自身场景，防脏数据）
|
||
parent_id = payload.parent_id
|
||
if parent_id is not None:
|
||
parent = db.query(Comment).filter(Comment.id == parent_id).first()
|
||
if parent is None:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="回复的评论不存在")
|
||
if parent.article_id != article.id:
|
||
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="回复的评论不属于该文章")
|
||
|
||
comment = Comment(
|
||
article_id=payload.article_id,
|
||
user_id=current_user.id,
|
||
parent_id=parent_id,
|
||
content=content,
|
||
)
|
||
db.add(comment)
|
||
db.commit()
|
||
db.refresh(comment)
|
||
action_limiter.hit(get_client_ip(request))
|
||
|
||
data = {
|
||
"id": comment.id,
|
||
"article_id": comment.article_id,
|
||
"user_id": comment.user_id,
|
||
"parent_id": comment.parent_id,
|
||
"username": current_user.username,
|
||
"avatar": current_user.avatar,
|
||
"content": comment.content,
|
||
"created_time": comment.created_time,
|
||
}
|
||
return UnifiedResponse(success=True, data=data, message="评论成功")
|
||
|
||
|
||
@router.get("/list", response_model=UnifiedResponse)
|
||
def list_comments(
|
||
article_id: int,
|
||
current_user: Optional[User] = Depends(get_optional_user),
|
||
db: Session = Depends(get_db),
|
||
) -> UnifiedResponse:
|
||
"""评论列表：公开文章所有人可见，好友文章仅好友/博主可见。"""
|
||
article = db.query(Article).filter(Article.id == article_id).first()
|
||
if article is None:
|
||
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="文章不存在")
|
||
if article.visibility == VISIBILITY_FRIEND and not can_read_friend_article(current_user):
|
||
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权查看该文章评论")
|
||
|
||
comments = (
|
||
db.query(Comment)
|
||
.filter(Comment.article_id == article_id)
|
||
.order_by(Comment.created_time.asc(), Comment.id.asc())
|
||
.all()
|
||
)
|
||
data = [
|
||
{
|
||
"id": c.id,
|
||
"article_id": c.article_id,
|
||
"user_id": c.user_id,
|
||
"parent_id": c.parent_id,
|
||
"username": c.user.username if c.user else None,
|
||
"avatar": c.user.avatar if c.user else None,
|
||
"content": c.content,
|
||
"created_time": c.created_time,
|
||
}
|
||
for c in comments
|
||
]
|
||
return UnifiedResponse(success=True, data=data, message="获取成功") |