xinyouhe/photo-live
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
325 Commits 1 Branch 0 Tags
main
Commit Graph

325 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
浅念 45d46518b1 docs(plan): p3 completion header note 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-20 15:23:45 +08:00
浅念 e484aa5427 docs: p3 acceptance record 
P3 收口（Task 12）：回归门全绿实测数字、MuMu 设备集成证据（阶段 1
十二腿 + 阶段 2 双场景，引用 it-logs 存档原文）、29+3 轮排障 13 根因
展开表、契约增补（password-change + sourceDeviceId）登记、G2 真机
清单（计划全量 + 集成期新增 5 项）、G3 引用 README-ios、偏差表（计划
内 13 + 计划外 5）；总纲 P3 行进度注记（G2 待用户真机执行、D03 待确
认）；P3 计划 Task 11/12 勾选。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-20 15:21:49 +08:00
浅念 d41be367f8 fix(mobile,it): integration suite stabilization on real device 
Root causes found & fixed across 29 phase-1 + 3 phase-2 runs:
- MSYS path mangling for adb shell device paths (per-command MSYS_NO_PATHCONV + winpath)
- adb reverse tcp:9000: presign URLs embed server-side localhost MinIO host,
  unreachable from emulator (uploads hung forever)
- compose --profile ov omitted: Docker restarts stranded ov side (ov-api 500s)
- soft keyboard occlusion on dialog buttons (dismissKeyboard + ensureVisible)
- stacked-route BackButton ambiguity (goBack must tap topmost hit-testable)
- bottom-sheet entrance animation race (wait for hit-testable option)
- language leg: drive LocaleSettings provider (sheet tap flaky, covered by unit tests)
- password page: self-pops on success (no extra goBack)
- bg verify: server-side authoritative assertion (fresh process = fresh memory DB)
- flutter test uninstall-reinstall wipes app data: image dir fallback to /data/local/tmp
- run-as cp failures no longer silently swallowed
- phase-2 missing IT_STAFF_ACCOUNT define

Phase 1: all 12 legs green (login→album→category→invite→3 uploads via native
WorkManager→server history→ov visible→hide sync→network fault/recovery→
password change→relogin→locale switch)
Phase 2: bg-home + kill-restart green (A04/A05 emulator-level)

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-20 15:03:17 +08:00
浅念 fb3c278e50 test(mobile): integration suite against real backend on mumu 
P3 Task 11 (WRITE & COMPILE phase; device run pending MuMu availability).

- integration_test/p3_flow_test.dart: login -> album (zh+en) -> category
  -> invite -> enqueue 3 real JPEGs -> queue completed -> server history
  (sourceDeviceId) -> ov public API sees 3 -> hide via API + UI sync ->
  DIO fault-gate offline (waitingNetwork -> retry -> 4 completed) ->
  password change (session kept) -> relogin -> in-app locale smoke.
- integration_test/p3_background_test.dart: IT_PHASE=prepare/verify spec
  for HOME-background continuation and force-stop kill-restart recovery
  (2 x ~14MB noise JPEGs give a deterministic mid-flight window).
- helpers: dart-define config, fault-injecting DIO adapter, app harness
  (picker/notification/locale provider overrides), UI step library with
  live-binding polling (no pumpAndSettle).
- scripts/run-mobile-it.sh: device detect (exit 2), backend ensure
  (compose + api/ov/worker/sync, exit 3), idempotent per-run user seed
  (no DB reset), APK build/install + adb push of testdata, phase 1 /
  --background phase 2 orchestration with server-side confirmed-count
  truth via curl.
- services/api seed:it script (create-if-absent staff accounts).
- debug-only network security config: cleartext HTTP permitted to
  10.0.2.2/127.0.0.1/localhost only (release unaffected).
- testdata: 3 x ~120KB + 2 x ~14MB generated JPEGs.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 05:35:16 +08:00
浅念 8f3966d7b5 feat(mobile): in-app locale switching 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 05:00:11 +08:00
浅念 955f9b13c1 feat(mobile): upload queue ui and continuous capture page 
Task 9 (P3 plan): queue tab replaces the stub, continuous capture page
enqueues per shot, album detail gains an upload FAB, and the upload
engine lifecycle is now bound to the login session.

- Engine scope: session account drives UploadEngine start/stop; wired
  from app boot, login success, logout, and 401 eviction. Tasks stay in
  the store across logout (accountId hard isolation).
- Queue tab: album x state x time filter bar, task rows with thumbnail,
  state chip, localized error copy, attempt count, per-row progress via
  a broadcast progress hub, state-dependent actions (re-pick retry,
  retryNow, cancel, delete), batch retry bar, 200ms-debounced live
  refresh from drift table updates.
- Capture page: camera preview via injected CaptureSource, one enqueue
  per shutter press, persistent album/category/badges overlay with a
  switch-only-affects-new-shots hint, gallery multi-pick, exit confirm
  while uploads are pending, permission-denied and init-failure views.
- POST_NOTIFICATIONS runtime permission via a small MethodChannel
  (photolive/permissions) + PermissionPlugin.kt: single runtime
  permission need, avoids permission_handler dependency; requested once
  on first enqueue, silent degradation when denied or unavailable.
- Album detail FAB: capture-and-upload / pick-from-gallery sheet.
- l10n: ~50 new keys in zh/en arbs; tests: +45 (filter matrix, engine
  scope lifecycle, permission gate, queue tab, capture page, FAB entry);
  existing page tests updated to inject session/task-store fakes.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 04:47:31 +08:00
浅念 42e1c2e34b feat(mobile): ios background upload bridge (compile-gated at G3) 
Swift 侧（协议与 Android UploadPlugin.kt 逐字一致，编译/真机留 G3）：
- UploadBridge.swift：通道/方法/事件/失败码常量 + registerTask 参数解析
  （镜像 UploadProtocol.kt）
- UploadEventBus.swift：单调 seq + 终态 ack 缓存重放（镜像
  UploadEventBus.kt），iOS 增强——未 ack 终态落盘（系统后台拉起投递的
  回调在进程重启后同样重放，技术方案 §6.2 持久化原生回调）
- UploadTaskStore.swift：taskId→URLSession taskIdentifier 映射 plist 持久化
  （Application Support；对应 Android WorkManager 自持映射）
- UploadPlugin.swift：URLSession background
  （com.photolive.photo_live.uploads）+ delegate 失败分类（2xx→completed+etag
  / 403→needsRenew / 4xx→HTTP_4XX / 网络→重试上限后 NETWORK，镜像
  UploadPutExecutor/UploadWorker）、原生重试（5 次上限、10s 指数退避）、
  进度 500ms 节流、queryTask/cancelTask/ackEvents、静默取消
- AppDelegate.swift：implicit engine 通道注册 + 启动重建会话 +
  handleEventsForBackgroundURLSession completionHandler 暂存
- Info.plist：UIBackgroundModes 有意不声明（background URLSession 无需；
  计划措辞按技术方案 §6.2 修正，见 README-ios.md）
- project.pbxproj 登记新 Swift 文件；README-ios.md（Xcode 步骤 + G3 验证
  清单：实际文件上传/持久化回调窗口/服务端补偿/重启重联校准/强制退出/
  低电量延迟/100 张批量）

Dart：NativeTransport 选择矩阵并入 iOS（Platform.isAndroid || isIOS，
FORCE_DART_TRANSPORT 覆盖不变）——协议两侧一致，无新通道代码。

flutter analyze 0 issue；flutter test 219 全绿。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 03:42:49 +08:00
浅念 4e35bdc0b2 feat(mobile): android background upload bridge via workmanager 
Kotlin 侧（MethodChannel photolive/uploads + EventChannel photolive/uploads/events）：
- UploadPlugin：registerTask 入队 WorkManager OneTimeWorkRequest（unique
  work=upload-task-{taskId}，expedited + OutOfQuotaPolicy 回退、CONNECTED
  约束、指数退避 10s 起）、cancelTask / queryTask / ackEvents
- UploadWorker（CoroutineWorker）：dataSync 前台服务 + 进度通知，
  OkHttp PUT（ETag 捕获、64KB 分片进度），结局分类：2xx→completed、
  403→needsRenew、4xx→failed{HTTP_4XX}、网络/5xx→Result.retry（上限
  5 次后 failed{NETWORK|SERVER_ERROR}）、缺文件→failed{SOURCE_MISSING}
- UploadEventBus：终态事件单调 seq + 未 ack 缓存重放（上限 200），
  重注册/取消作废旧缓存——进程重启/切后台恢复不丢完成信号
- Manifest：FOREGROUND_SERVICE(_DATA_SYNC)/POST_NOTIFICATIONS 权限 +
  SystemForegroundService tools:node=merge 补 dataSync 类型（已验证
  合并产物）

Dart 侧：Transport 接口（init/complete/renew 留引擎，仅 PUT 委托）——
DartHttpTransport（Task 6 逻辑抽出，403→renew 异常归一）+ NativeTransport
（registerTask→事件流终态/进度映射、终态 ack、取消联动）；引擎传输选择：
Android 缺省原生，dart-define FORCE_DART_TRANSPORT=true 强制 Dart 路径；
失败分类与 dio 路径语义对齐（401 短退避/429 网络桶/SOURCE_MISSING 不
自动重试等）

测试：gradle testDebugUnitTest 29 例（executor MockWebServer 分类×10、
协议解析×11、事件总线×8）；flutter test 219 全绿（新增 NativeTransport
事件映射/取消/ack/并发路由、引擎×Transport 委托与 needsRenew 重注册、
传输选择矩阵）；flutter analyze 0；debug apk 构建通过

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 03:22:42 +08:00
浅念 3ddb0ea2d4 feat(mobile): upload engine with preparation, batching states and retries 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 02:50:40 +08:00
浅念 d96e56f653 feat(mobile): drift upload task store with state machine 
- upload_tasks 表（accountId 隔离 + 三个复合索引）、状态列枚举转换器、
  datetime 文本落库（UTC 归一，亚秒精度）
- 纯状态机（task_state.dart）：合法迁移表 + canTransition/assertTransition，
  completed/cancelled 终态
- TaskStore 仓储：create（clientTaskId 同账号同相册应用侧唯一）、
  updateState（迁移守护+旁路字段）、账号隔离读路径（硬守护）、
  countsByState 徽章、cleanupCandidates/markCleanable（仅终态可清理——
  评审缺口 1 硬守护，未完成源文件永不清理）
- 测试 26 例（状态机表驱动全边 + 守护/隔离/筛选/保留策略）；
  sqlite3 3.x build hooks 在 flutter test 宿主与 Android APK 构建均验证
  （libsqlite3.so 已打包全 ABI，运行时验证留 Task 11）

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 02:12:39 +08:00
浅念 bbea1dd364 feat(mobile): album management pages with qr share 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 01:56:38 +08:00
浅念 8be21b856b feat(mobile): login, password change and logout screens 
P3 Task 3 移动端（对接 Task 2 api client + 本任务新增的后端契约）：

- 登录页实装：账号/密码表单（空值客户端校验）→ api.login（会话自动
  持久化）→ pushReplacement /home；错误码本地化（AUTH_INVALID_
  CREDENTIALS / AUTH_RATE_LIMITED（含稍后再试文案）/ 网络 / 校验）；
  提交加载态防重复提交。
- 修改密码页（设置页入口）：当前/新/确认三字段，客户端校验（≥8 位、
  两次一致）→ api.changePassword → toast + pop；成功后本地会话不变
  （服务端保留当前会话）；旧密码错误（401 AUTH_INVALID_CREDENTIALS）
  显示「当前密码错误」且不触发 401 驱逐。
- 退出登录：设置页按钮 → api.logout 尽力而为 → 清会话 → 清栈回
  /login；App 壳 initState 注册 onUnauthorized（业务 401 → 清栈 /login），
  根 navigatorKey 接线；password-change 的 401 豁免会话驱逐（拦截器
  豁免集合与令牌附加分离）。
- l10n：新增 16 组 zh/en 文案；错误码 → 文案解析扩展
  （core/error_l10n.dart，errorCode→AppLocalizations）。
- 测试：ApiClient.changePassword 单测 ×2（Bearer+请求体；旧密码 401
  不驱逐）；widget 测试 ×12（登录 5：空值/成功跳转/凭据错误/限速文案/
  加载禁用；改密 4：过短/不一致/旧密码错误文案+会话保留/成功 toast+pop
  且令牌不变；设置 2：改密入口跳转/登出清会话回登录；App 壳 1：401
  清栈回 /login）。flutter analyze 0 issue；flutter test 81/81。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 01:19:57 +08:00
浅念 31ba03de11 feat(api): password change endpoint and source device id on uploads 
P3 Task 3 契约增补批次（单一事实来源 openapi.yaml + cn 实现 + e2e）：

- POST /v1/auth/password-change（operationId changePassword，需求 4.1 的
  P1 契约缺口补齐）：Bearer + {oldPassword 1-128, newPassword 8-128} → 204；
  旧密码错误 401 AUTH_INVALID_CREDENTIALS；成功后事务内更新 argon2 哈希、
  撤销该用户除当前会话外的全部其他会话（当前会话保留，本人不下线）、写
  审计 auth.password_change。
- sourceDeviceId（A19 设备来源语义）：UploadInitRequest 可选 8-64 位设备
  标识；upload_sessions 落列（VARCHAR(64) utf8mb4_0900_bin，可空，存量
  行 NULL 兼容）；GET /uploads 条目回显；幂等重放不比对（first-writer，
  首次落库值不随重放漂移）。
- e2e：auth 增 4 例（未认证 401 / 新密码过短 400 / 旧密码错误 401 且会话
  无副作用 / 成功后他端会话撤销当前保留 + 新旧密码登录裁决 + 审计）；
  uploads 增 1 例（携带落库回显、换设备重放保留首值、缺省 null、长度
  越界 400）。api e2e 179 → 184；contracts gen/redocly/单测、worker、
  sync 门全绿。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 00:59:39 +08:00
浅念 f975321b67 feat(mobile): api client, session storage and contract-aligned models 
P3 计划 Task 2（apps/mobile）：

- core/config.dart：API_BASE/VIEWER_BASE 经 --dart-define 覆盖，缺省
  10.0.2.2 模拟器宿主回环；viewer 相册链接构造 {VIEWER_BASE}/a/{token}。
- core/error_codes.dart：errors.ts 17 码 1:1 镜像（含注释），另设 4 个
  客户端本地伪码（NETWORK_ERROR/NETWORK_TIMEOUT/CANCELLED/HTTP_ERROR）。
- core/api_client.dart：dio 封装——Bearer 注入（登录端点豁免）、401
  驱逐（清会话 + onUnauthorized 回调去重，App 壳注册跳 /login）、
  DioException/错误体 {code,message,requestId} 归一 AppException、
  通用游标分页助手；auth/albums/members/categories/admin/uploads/photos
  全端点方法；riverpod provider 出口。
- core/session_store.dart：SessionStore 抽象 + flutter_secure_storage
  实现（token/expiresAt/account 三键，encode/decode 纯函数可测）。
- features/{auth,albums,uploads,photos}/models.dart：手写 fromJson/
  toJson，逐字段对齐 openapi.yaml（类注释标注契约 schema/operationId）；
  locale 按字符串透传（zh-CN 标识符不兼容），业务枚举 Dart 化并在
  未知值 fail-fast。
- 测试 66 项：17 码表驱动 + 网络/超时/取消 + 兜底映射、游标边界
  （含 CursorPageMeta 不变式违约容错）、模型往返（fixture 转写自
  openapi.yaml schema 与 api e2e 断言，来源在测试头注释）、拦截器
  行为（手写 FakeAdapter：Bearer 注入/401 驱逐/登录豁免/并发去重/
  尽力而为 logout/refresh 滑动续期）。flutter analyze 零告警。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 00:40:02 +08:00
浅念 8bc50e07ef feat(mobile): flutter scaffold with env script and baseline nav 
- scripts/flutter-env.sh: toolchain PATH/JAVA_HOME/ANDROID_HOME + pub 镜像 env
- apps/mobile: flutter create (com.photolive.photo_live, android+ios)
  - Android minSdk 24 / targetSdk 36；INTERNET 权限（main manifest，debug+release）
  - iOS Info.plist：本地网络 ATS 例外 + 相册/相机用途说明（zh+en）
- 依赖接入：riverpod / drift(+sqlite3_flutter_libs) / dio / secure_storage /
  image_picker / camera / qr_flutter / path_provider / path / intl
- l10n：l10n.yaml + app_zh/app_en arb（20 键），gen-l10n（zh 模板，非空 getter）
- 基线：Material 3 主题、/login→/home 命名路由、底部导航（相册/队列/设置桩）、
  locale provider 脚手架（Task 10 完成切换）
- flutter analyze 零问题；widget 测试通过；debug apk 构建成功
  （MuMu 冒烟因宿主 commit 内存耗尽未完成，Task 2 重试）

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-19 00:22:04 +08:00
浅念 5879552ecb docs(plan): p3 flutter app plan (approved; review fixes applied) 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 23:30:58 +08:00
浅念 79eb975096 docs: p2 acceptance record 
P2 Task 12: 验收记录（A09/A10/A14/A21 部分/A26/A27 仿真级 + A25 部分
本地直读证据；D07/D11 初值确认——30min 浏览窗口、2s 推送/5min 对账/
60s 回传建议维持待 P5 实测冻结；13 项偏差登记；P4a/P5 移交清单；回归
门实测统计——全仓 448 测试绿）+ 总纲 P2 行进度注记。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 20:17:54 +08:00
浅念 452ec12bbd test(sync): cross-region simulation integration suite 
P2 Task 11: 六幕串行场景套件（cn+ov 双入口进程内起真服务，真实双
MySQL/MinIO/HMAC/WS）——①端到端复制+互动+统计回传（A25 观众路径只打
ov、A27 快照替换）②隐藏传播（high 优先+WS photo.hidden+恢复发布复原）
③发送器停机积压→排空追平→对账稳态④墓碑不复活（旧 published 重放拒绝
+bootstrap 重跑仍隐藏，A26）⑤紧急停用（ov 404/WS error、cn 无感、enable
复原含新照片）⑥50 并发点赞/30 并发浏览幂等小样（终值==Σdelta、恰+15）。

services/sync devDeps 增 ws/@types/ws/ioredis（WS 场景客户端 + 限速
滑窗键清场，同 api spec 约定；版本与 api 对齐）。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 20:05:25 +08:00
浅念 cdead49838 feat(viewer): likes, bubbles, visit reporting and hot sorting 
Task 10 viewer 互动化：

- 点赞：useLikes 批次状态机（500ms 防抖 / 5 次满额即冲 / 失败同 batchId
  退避重试 3 次后回滚丢弃），乐观计数 + 服务端 total 权威校准
  （countVersion 单调），大图与格子双入口；
- WS 实时：RealtimeClient 纯状态机（半频心跳、指数退避重连、三败降级、
  重连成功 resync 第 1 页重取），消息路由器做 likes.burst 自身过滤
  （originBatchIds 求交）、隐藏页暂停与减少动画下仅校准不出气泡；
  photo.hidden/deleted 即时移出序列并回退邻居大图；降级后 8s 轮询接管；
- 浏览上报：visitorId 跨标签 BroadcastChannel first-writer-wins 协调，
  可见时上报、requestId 持久幂等、网络失败指数重试；
- 排序：最新/热门 chips（热门走 ov 冷快照），大图打开期间禁用切换；
  顶栏「减少动画」偏好开关；
- 契约包新增 ./realtime 子路径出口（浏览器面不可引桶出口——其连带
  internal-sync 的 node:crypto 会被 Vite 外置化致整页崩溃）；
- e2e 注入钩子 __viewerWsUrl/__viewerWsRetryBaseMs/__viewerRealtimePollMs/
  __viewerBubbleMs 与 .activity[data-connection] 连接态锚。

vitest：viewer 105（新增 36：likes 批次 8、visitor 协调 5、上报门控 4、
路由 8、WS 状态机 7、排序 4）；Playwright：viewer 21（新增 likes.spec 7、
journey 补互动腿断言）。

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 19:52:27 +08:00
浅念 955bea49b5 feat(sync): stat snapshot return path with version replacement 
P2 Task 9 统计回传（ov→cn）：
- cn 迁移：albums 增 viewCountReplica/statsVersion/statsSyncedAt、
  photos 增 statsVersion（like_count 已有副本位；无 VARCHAR 新列不涉校对手决）
- cn 接收端 POST /v1/internal/sync/stat-snapshots（InternalSyncGuard）：
  整批单事务，逐快照 updateMany WHERE statsVersion < statVersion —— 仅更高
  statVersion 以权威 total 整体替换副本（绝不相加），重复/乱序幂等忽略；
  accepted 只数实际应用条数；views 应用同时推进 statsSyncedAt（A27 展示）
- ov 回传发送器 services/sync/stat-return.ts：聚合 outbox_stat_events 未发送
  行按（kind, photoId|albumId）取 MAX(statVersion) 折叠突发 → HMAC 推送 →
  200 后按计数器标记截至该版本全部源行 sentAt；失败留待下轮重发；main.ts
  第三循环 STAT_RETURN_INTERVAL_MS（默认 60s，env 可调）
- 契约 AlbumSummary + statsSyncedAt（string|null readOnly，+gen）；listAlbums/
  getAlbum 经 toSummaryResponse 暴露（管理 UI 列留 P4a）
- e2e（services/sync stat-return.e2e-spec，7 例）：逐次点赞回传替换式收敛
  （2→5→10 非累加）、浏览窗口去重回传 + statsSyncedAt、重复回传 accepted=0
  值不动（A27 不重复累计）、乱序高版本替换（total 可下调）+ 低版本忽略、
  发送端折叠只发最高版本且被折叠行随批确认、管理列表 likeCount/statsSyncedAt
  展示、新端点 401/400 守卫

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 18:45:43 +08:00
浅念 1f2a0c658f feat(ov): windowed dedup visit counting with retention cleanup 
Task 8 (P2): POST /public/albums/{token}/visits with visit_sessions
window dedup (VISIT_WINDOW_MINUTES), requestId idempotent replay
(echoes stored outcome; expired beyond VISIT_REQUEST_TTL_MINUTES
rejected), album_stats viewCount/statVersion authority + outbox_stat_events
views snapshots, WS stats.updated broadcast, visitorId+IP fixed-window
rate limit (VISIT_WINDOW_REQUESTS), and ov CleanupModule scheduler
(setInterval, CLEANUP_INTERVAL_MINUTES) deleting like_batches /
visit_requests / visit_sessions past their windows — totals never
touched. Contract prose aligned to replay semantics; constants
VISIT_WINDOW_REQUESTS / CLEANUP_INTERVAL_MINUTES added.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 18:14:01 +08:00
浅念 85b2da3db5 feat(ov): idempotent batched likes and realtime broadcast 
P2 Task 7（点赞批次端点 + ov 实时网关）：
- interactions 模块（仅 ov 装配）：POST /public/albums/{token}/photos/
  {photoId}/likes——相册不可见/照片未发布 404、delta 1..20 与
  sessionId/batchId 1..64 校验 400；单事务 like_batches 唯一插入
  （P2002=幂等重试，batchAccepted=true 不重加）→ photos_ov.likeTotal/
  countVersion 原子自增回读 → outbox_stat_events(kind=likes) 兜底；
  Redis ov（REDIS_URL_OV）INCRBY+TTL 会话/IP 双窗口限流（默认
  500/2000，超限 429 RATE_LIMITED），幂等重试先于限流不耗额度
- 过期批次重放边界（24h 清理后的 batchId 重插会再次计入）：接受该
  边界——无永久账本可查（保留全量批次行违背清理策略），会话/IP 窗口
  上限即重放天然封顶（同一 sessionId 重放挤占自身额度），偏差已在
  likes.service 头注释登记，Task 8 统计侧按清理后语义处理
- realtime：ContractWsAdapter（契约 {type,...} 帧分发，ws 与 HTTP 同
  端口挂 /v1/realtime）+ RealtimeGateway 相册房间模型——subscribe 逐
  相册校验 isAlbumVisibleOv，失败回 error 帧且连接保持；应用层 ping→
  pong 回显 ts；传输层 HEARTBEAT_MS 周期 ping 踢死连接；点赞提交经
  EventEmitter2（单进程，多实例 Redis pub/sub 登记 P5）触发
  likes.burst 500ms 合并窗（delta 聚合、originBatchIds 供客户端过滤
  自身批次）；sync-inbox 应用事务提交后发 OV_PHOTO_APPLIED →
  photo.published/hidden/deleted 按房间广播（stale/duplicate/暂存/
  缺席即撤下不转发）
- 契约：REALTIME_WS_PATH、ServerMessage 增 error 帧（穷尽锁 7 成员
  + 类型测试）、LIKE_SESSION_WINDOW_DELTA/LIKE_IP_WINDOW_DELTA/
  LIKE_BURST_MERGE_MS 常量与 .env.example
- e2e（likes-realtime.e2e-spec.ts，6 用例）：A09 三批累加/幂等重试/
  outbox 行、小额度 429、ping/pong+幽灵 token error 帧连接保持、
  A10 双房间隔离（先证非空调订）、合并窗单 burst（delta 求和+双
  originBatchIds）、cn 隐藏→房间收 photo.hidden+隐藏后点赞 404；
  凡进程内起 AppOvModule 的 spec（sync×2/public-ov/emergency）补装
  ContractWsAdapter 与生产 main-ov 一致——api e2e 168（162+6）

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 17:51:55 +08:00
浅念 0fcf18cc5c feat(ov): public read api on replicas with hot sorting 
P2 Task 6（ov 公开读 API + viewer 切换）：
- ov 装配 PublicOvModule（仅 app-ov.module）：/public/albums/{token}、
  /photos、/photos/{id} 三端点同契约读 ov 副本——translations/categories
  自 JSON 列解析（防御性过滤），banner 经 ov 侧 STORAGE_PORT_OV 预签名
  （同本地 MinIO；只读属约定，真实 OSS 只读凭证 P5），viewCount 取
  album_stats 权威累计（无行默认 0；计数端点 Task 8 接线）
- 排序：latest=发布时间 keyset（shared/cursor.ts 同 cn）；hot=likeTotal
  desc + photoId desc 决胜，顺序按 `${albumId}|${category}` 短期快照
  （内存 TTL 默认 30s，HOT_SORT_TTL_MS 惰性读取）——计数逐请求现读、
  顺序冻结窗口内一致，偏移游标（base64url 整数）在快照内严格稳定；
  非法 sort 400 VALIDATION_FAILED（cn 不感知该参数）
- 契约：viewCount 放宽为 integer|null（cn null、ov 权威值）；
  listPublicPhotos 增 sort 枚举（latest|hot，缺省 latest）；
  PhotoPublishedPayload 增 categoryId——补上 Tasks 3/4 管线缺口
  （payloads/publish.service/sync-inbox 投影 + 关联测试随改）
- e2e（services/api/test/public-ov.e2e-spec.ts，7 用例）：双入口同进程
  起 cn+ov，cn API 种子→真实发送管线投递；断言相册/列表/单图与 cn
  深等（仅签名 URL 剔除）、banner 真字节、参数矩阵 400/404、hot 排序
  TTL 内快照（计数新/顺序旧）+TTL 过期翻转+偏移翻页、隐藏/下线/紧急
  停用逐态撤下
- viewer 切 ov：API 基址 VITE_API_BASE（缺省 http://127.0.0.1:8081，
  空串=同源网关；Vite 只读 apps/viewer/.env*，根 .env 对前端无效），
  移除 /v1 dev 代理（CORS_ORIGINS 增 127.0.0.1:5175 直连两形）；
  playwright webServer 增 dev:ov；e2e 夹具 flushSync(albumId)=cn
  bootstrap 快照 + deliverPendingOnce（sender 新导出）经真实管线投影
  种子，deleteSeededPhoto 改软删让墓碑可同步；14 个 Playwright 全绿
  （journey 管理/staffB 腿仍走 cn 8080）

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 17:05:56 +08:00
浅念 eac8da6d6c feat(ov): emergency disable channel independent of sync 
P2 Task 5（海外紧急停用入口）：
- ov 新增 POST /v1/internal/emergency/disable|enable（InternalSyncGuard
  HMAC，albumToken/albumId 恰好其一、都缺省 400；副本不存在 404
  ALBUM_NOT_FOUND）：直写 albums_ov.emergencyDisabled（唯一 ov 本地可写
  位），独立于同步版本链——更高版本 album.updated 重放不解除（e2e 断言
  entityVersion 推进而标志保持），恢复仅经显式 enable；幂等语义
  （alreadyDisabled/wasDisabled 入审计行）
- cn 侧不感知：无对应 cn 状态位、无反向同步（契约描述文档化）
- 审计：pino child（audit=emergency 字段常驻每行）结构化日志——偏差
  登记：计划原文「写 ov 侧日志文件」落地为字段标记而非独立文件通道
  （免新增文件 transport 依赖，P5 运维按字段路由聚合）；注入令牌
  EMERGENCY_AUDIT_LOGGER，测试覆写为内存目的地断言字段
- isAlbumVisibleOv 共享判定（status=active && publicEnabled &&
  !emergencyDisabled——镜像 cn 公开语义叠加本地停用位）：Task 6 公开
  API / Task 7 WS subscribe 的 404 ALBUM_NOT_PUBLIC 语义单一实现，
  判定矩阵单测锁定
- 契约 [internal] 增 emergency disable/enable 操作与 schema（gen 已跑、
  redocly 通过）；e2e：token/id 定位、幂等、enable 恢复、未签名 401、
  均缺省 400、未知相册 404、同步事件不解除

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 16:19:02 +08:00
浅念 36082c5a74 feat(sync): reconciliation scheduler with digest and bootstrap healing 
P2 Task 4（inbox 对账）：
- services/sync 新增 SyncReconciler（runOnce 可测；main 双循环，间隔
  SYNC_RECONCILE_INTERVAL_MS env 可调，CN_API_URL 指向 cn 入口）：每轮
  先按 album/category/photo/asset 逐类分页拉取 cn reconcile「当前状态
  事件」并直接签名推送到既有 content-batches 管道。sinceVersion 取 0
  （全量当前态）而非 per-type 已应用最大版本——cn reconcile 以类型级
  全局版本阈值过滤，类型内单实体滞后会被 max 掩蔽；ov 的 eventId 幂等
  + 版本单调把已追平实体全部判重（recon 确定性 eventId 重扫零成本），
  偏差登记：计划原文对账返回「缺失清单」，契约已定为可重放 SyncEvent
  数组（免建第二条拉取通道），openapi 描述同步更新
- cn 新增 POST /internal/sync/digest：每相册权威计数 {categoryCount,
  publishedPhotoCount, photoCount, assetCount}；ov 比对副本计数（照片
  取 [publishedPhotoCount, photoCount] 区间口径——hidden/deleted 照片
  若从未以 published 态同步过 ov 合法无行，缺席即撤下），不一致相册
  自动触发 cn bootstrap 重建；ov-only 相册（cn 行已删，bootstrap 无法
  表达删除）告警登记不自动处置
- 收敛语义两处落位：① sync-inbox 版本比较改「严格更旧才拒绝」——
  同版本新 eventId（bootstrap/reconcile 快照重发）为当前态幂等重断言
  应用，修复 ov 缺失副本行；A26 不受影响（更旧版本仍拒绝，cn 侧
  entityVersion 与状态一一对应）② album.updated 快照载荷（bootstrap/
  reconcile）携带分类全量清单，ov 存在即整体替换 albums_ov.categories
  ——修复错过的 category 墓碑（Task 3 登记边界：cn 行已删，无现存实体
  事件可重放，唯全量替换可收敛）
- e2e（reconcile.e2e-spec）：漏事件追赶（ov v1/cn v5 事件投后即失）→
  清扫追平；digest 修复缺失 photos_ov 行（bootstrap 重发 → 同版本
  重断言重建）；digest 修复丢失的分类墓碑（全量清单替换收敛）；稳态
  空转（applied=0、无 bootstrap）；Task 3 套件保持绿

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 16:18:31 +08:00
浅念 65726702f3 feat(sync): cn event coverage, bootstrap and outbox sender 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 15:21:41 +08:00
浅念 3d6e9ce175 feat(ov): ov schema, entry skeleton and compose profile 
P2 Task 2 ov 数据层：
- compose ov profile：mysql-ov（mysql:8.4，127.0.0.1:3309，库级
  utf8mb4_0900_bin）+ redis-ov（6381），cn 侧默认 up 不受影响
  （3307/3308 已被其它本机项目占用，端口决策 3309）
- @photo/db-ov：9 表 schema（albums_ov/photos_ov 副本、sync_inbox/
  sync_state 同步账本（水位行同表标志位）、like_batches/album_stats/
  visit_sessions/visit_requests 互动域、outbox_stat_events 回传队列）；
  迁移 20260918060102_init_ov 走固化校对手决流程，information_schema
  复核全部业务表/列 utf8mb4_0900_bin（_prisma_migrations 同 cn 先例
  保持 unicode_ci）
- generator 独立 output（包内 generated/）：pnpm 将两包 @prisma/client
  提升为同一 store 实例，默认 .prisma/client 输出会被双 schema 互相
  覆盖，ov 客户端独立产出经 src/index.ts 转出口
- ov 入口骨架：main-ov.ts（PORT_OV 默认 8081）+ app-ov.module.ts
  （仅管线骨架 + /v1/health，feature modules 后续任务装配）；logger
  装配选项抽取至 shared/logger-options.ts 供 cn/ov 双入口共用（行为
  不变，P1 套件守护）
- test/reset-ov.ts：ov 库 truncate-if-exists 隔离工具（无 MinIO 清理）
- 根脚本：db:generate 双库齐跑，新增 db-ov:migrate/db-ov:generate/dev:ov

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 14:11:41 +08:00
浅念 a4b95abd4c chore(plan): mysql-ov host port 3309 (yunke-mysql occupies 3307; user decision) 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 13:51:43 +08:00
浅念 24327c5147 feat(contracts): p2 realtime, likes, visits and internal sync contracts 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 13:34:35 +08:00
浅念 06111e1466 docs(plan): p2 implementation plan (approved, both review gaps fixed) 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 13:19:52 +08:00
浅念 b5145d6860 docs: p1b acceptance record 
- P1b-验收记录.md: A08 (viewer.spec + journey), A12 partial (viewer
  i18n switch/fallback + admin template i18n; data-lang is P4b), R09
  (assets.e2e + admin upload + viewer render + journey banner), P1a
  final-review 4 items registered (47fb81a, absent from P1a record),
  9-row deviation table (ports 5175/5176 + cms conflict disclosure,
  staff-wide account lookup, art-design-pro v3.0.2 pin + lint ignore,
  no thumbnails in AdminPhoto, session-scoped banner preview,
  errorCode/pending_upload omissions, useCursorList, esbuild
  onlyBuiltDependencies), P2 handover, per-package test stats
- master roadmap: P1 fully complete (P1a + P1b), tag p1; G1 formally
  registered as skipped (no OSS credentials provided)
- P1b plan: all task checkboxes marked with completion notes

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 12:56:59 +08:00
浅念 40f8f37ca4 test(e2e): p1b cross-frontend playwright journey 
- viewer playwright.config: third webServer boots admin dev (5176,
  reuseExisting) so one config serves both frontends
- journey.spec.ts: admin UI (login, zh+en album, real-jpeg banner via
  file chooser, category, staffB invite by account search, logout) ->
  staffB API uploads x3 (init/presign-PUT/complete) -> worker
  PublishService.processPhoto x3 -> public list verify -> viewer UI
  (banner bytes, zh->en switch, waterfall 3, chip filter 1, lightbox
  zoom/close, deep link) -> admin hide -> viewer 2 + hidden deep-link
  404 notice -> empty album state
- cleanup: journey album domain rows + staffB account via Prisma

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 12:54:18 +08:00
浅念 50c59ca9d4 feat(admin): album management pages with members and categories 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 12:33:46 +08:00
浅念 a6cc190751 feat(admin): art-design-pro integration with local session auth 
P1b Task 9: apps/admin based on art-design-pro v3.0.2 (tag, commit
d224dd4; source recorded in apps/admin/SOURCE.md), trimmed to
layout/login/i18n/request/table-form core. Login wired to real
POST /v1/auth/password (single-token session), Bearer header on all
requests, 401 interceptor logout+redirect, request-driven sliding
renewal (refresh at ~80% TTL, single-flight), best-effort
POST /v1/auth/logout on user-menu logout. One protected stub page
(相册管理). Dev port 5176 strictPort + /v1 proxy to 8080. Admin keeps
its own eslint9 flat config; root eslint ignores apps/admin/**.
vitest unit tests for renewal pacing + Playwright e2e (guard redirect,
localized wrong-password error, login lands on stub, token persists
across reload, logout clears session).

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 11:47:32 +08:00
浅念 90fe64f637 feat(viewer): photo viewer with zoom, navigation and deep link 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 11:04:05 +08:00
浅念 d0b79dd0c9 feat(viewer): waterfall feed with lazy load, filter and new-photo hint 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 10:23:27 +08:00
浅念 adc45b1563 feat(viewer): album page with locale fallback and timezone display 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 09:52:22 +08:00
浅念 04b5641901 chore(viewer): move dev ports to 5175/5176 (user decision; avoids cms project conflict on 5173) 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 09:18:27 +08:00
浅念 f9cb72ed06 feat(viewer): vite vue3 scaffold with routing and i18n 
- apps/viewer (@photo/viewer): Vite 5 + Vue 3.4 + TS 最小骨架（无 Pinia/UI 库）
- router: /a/:token 活动页 + /a/:token/p/:photoId 单图深链（复用活动页组件）
- i18n: vue-i18n 9，zh-CN/en 词条，localStorage(viewer.locale) 持久 +
  navigator.language 检测兜底 zh-CN；顶栏语言切换组件；文案全量走 i18n
- api client: 类型化 fetch 封装（契约生成类型直连），错误信封 → ApiError，
  错误码 → i18n key 映射表（src/api/errors.ts）
- scripts: dev/build/preview/test(vitest 10 例)/test:e2e(Playwright 冒烟,
  webServer 自拉 dev)/lint/vue-tsc 全部接入 turbo
- root: +@playwright/test、+eslint-plugin-vue（flat config 收敛到 apps/**/*.vue）、
  pnpm.onlyBuiltDependencies 放行 esbuild

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 09:12:45 +08:00
浅念 8ba98ace63 feat(api): management photo list and account lookup 
P1b Task 4: listAlbumPhotos (GET /albums/{albumId}/photos, tag
[photos]) + lookupUsersByAccount (GET /admin/users, tag [admin]).

- management list: all visibility states visible (unpublished/
  published/hidden/deleted) for owner/admin; collaborator 403,
  outsider/ghost album 404 (canView -> canManage ordering, same
  anti-enumeration as members). Items = PhotoRecord + uploader
  {userId, account, displayName} (flat-FK second query, redacted).
  Keyset (uploadedAt,id) DESC via shared/cursor; visibility filter
  validated against PhotoVisibility enum (400 otherwise), categoryId
  must belong to the album (ghost/cross-album same-code 400).
  pending_upload rows (uploadedAt NULL) excluded: the sort key is
  both the contract-required field and the keyset predicate - NULL
  can neither be shaped as PhotoRecord nor compared; in-flight
  uploads are covered by the uploads history endpoint.
- account lookup (new src/admin module): prefix search over active
  users only (credentialStatus=active, sourceStatus!=disabled,
  !localLocked - same eligibility as SessionGuard/members.add),
  account ASC, no cursor (small cap). $queryRaw LIKE prefix% with
  explicit ESCAPE '!': !/%/_/\ escaped to literal matching (Prisma
  startsWith escaping is not contractual); utf8mb4_0900_bin makes
  the prefix match case-sensitive ('AL' misses 'alice'), documented
  in contract + tests. Access policy per contract: any authenticated
  staff (deviation from plan's admin/owner), unauthenticated 401.
- e2e: photos-admin (6) + users-lookup (6) cases; api e2e 136 -> 148.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 08:54:44 +08:00
浅念 361a72f300 feat(api): album asset upload chain 
P1b Task 3: initAlbumAssetUpload / completeAlbumAssetUpload (tags
[assets]) over album_assets with in-row one-shot sessions.

- migration asset_state: album_assets + state (pending|effective),
  expectedBytes, contentType (utf8mb4_0900_bin); pre-existing rows
  backfilled to effective. Complete head-verifies bytes AND
  contentType vs the init declaration (P1a Task 11 server-side
  fallback), then conditionally flips pending->effective with the
  winner writing the album.asset.add audit (resourceId=albumId,
  metadata assetId/kind/locale). Effective rows re-complete
  idempotently (re-signed URL, no re-verify, survives object
  cleanup).
- object key is the final key (albums/{albumId}/assets/{assetId}.{ext});
  the pending row is the logical staging - no copy step, keys embed
  assetId so re-init can never overwrite another row's object.
- permissions: owner/admin only (collaborator 403, outsider 404);
  uploadEnabled does NOT gate assets (switch governs photo uploads
  per 4.9 - both endpoints carry no ALBUM_UPLOAD_DISABLED).
- public banner now locale-aware (req 4.7): effective rows resolved
  as display-locale row -> global (locale NULL) row -> null, latest
  wins per tier (same-kind re-upload replaces, old rows retained).
- e2e: test/assets.e2e-spec.ts (14 cases, real jpegs via sharp,
  MinIO round-trips); public spec seed marked effective.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 08:40:32 +08:00
浅念 c2a9cc51f3 feat(contracts): p1b asset upload, management photo list, account lookup 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 08:23:59 +08:00
浅念 47fb81ad31 chore(api): p1a final-review hygiene items 
- contracts: add NOT_FOUND error code (framework-level 404 for unknown
  routes); Error enum + regen committed
- api: 404 default mapping in AllExceptionsFilter now NOT_FOUND (was
  ALBUM_NOT_FOUND); business 404s unchanged via explicit ApiException codes
- api: extract configureApp (prefix/CORS/x-powered-by) shared by main-cn
  bootstrap and e2e; disable x-powered-by, asserted in e2e
- api: move parseCursor/parseLimit (+page-size bounds) from
  albums.controller to shared/pagination; members/uploads/public re-pointed
- infra: bind compose published ports to 127.0.0.1 (mysql/redis/minio);
  .env.example endpoints follow suit
- e2e: unknown-route 404 NOT_FOUND + x-powered-by absent cases added
  (api e2e 120 -> 122)

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 08:18:30 +08:00
浅念 62382eca3c docs(plan): p1b implementation plan (approved with advisory fixes) 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 08:05:06 +08:00
浅念 43de31ffda docs: p1a completion markers in plan and master roadmap 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 00:14:23 +08:00
浅念 8a09001525 docs: p1a acceptance record 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 00:06:44 +08:00
浅念 96057ba207 test(api): full-chain e2e covering A01 A02 A03 A06 
One spec chaining the whole business flow over public APIs only:
seed-admin + real password login, album/category/member invite,
same-filename double upload via presign PUT (idempotent complete),
real BullMQ worker consumption publishing both photos (outbox has
exactly two photo.published events), public feed with locale
fallback, cursor pagination and signed-URL bytes, hide/remove/
soft-delete lifecycle with immediate permission loss, and full
audit-trail assertions.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-18 00:03:35 +08:00
浅念 6d61d117d5 feat(api): photo visibility lifecycle with audit and outbox events 
Serializes turbo tasks (concurrency=1): api and worker e2e suites share
one MySQL/MinIO and resetDb TRUNCATEs raced when run in parallel.

Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-17 23:51:29 +08:00
浅念 1f1c8ce191 feat(api): public photo feed with stable cursor pagination 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-17 23:39:50 +08:00
浅念 6863c736c3 feat(api): public album info with locale fallback 
Co-Authored-By: Claude Code <noreply@anthropic.com>
 2026-09-17 23:33:57 +08:00