阶段 0 完整版：名册 + 账号 + 安装向导 + 设置（宣纸主题）
这一版把「家」的地基铺完： 功能 - 安装向导 install.php：建四张表 → 建家庭 → 建第一人（兼管理员），装完自删； 「是否已装」以数据库四张表为准，不以文件是否存在为准 - 家庭名册：成员增删改查、头像上传（居中裁方 512×512 转 JPEG、finfo 校验、 随机文件名）、生日自动算年龄与倒数天数 - 敏感信息加密存储：手机号双写（SHA-256 哈希用于登录 + AES-256-CBC 密文用于显示）、 身份证只存密文；页面上永远只显示脱敏后的 138****8000 / 前 6 后 4 - 账号体系：人与账号分离（孩子可入名册但无需密码）、开通/停用/角色、 防爆破（5 次失败锁 60 秒）、修改密码、最后一个管理员不可移除 - 设置页：家庭名称与座右铭、加密密钥状态 - 宣纸主题 UI：砖红取自图标，扁平、留白充足；移动端顶栏收紧不换行 安全 - 所有 POST 走 CSRF；输出全量 e() 转义；uploads/ 禁执行脚本 - app/ 与 templates/ 加 .htaccess 整体拒绝直连（直接请求模板会 Fatal 并 把服务器绝对路径打在页面上 —— 这是线上真实抓到过的问题） - 已安装的 install.php 返回 404；display_errors 线上关闭 工程 - 无框架无 Composer，query-string 路由（index.php?r=模块/动作），不依赖 rewrite - 静态资源带 mtime+size 版本号，改版后浏览器不会吃旧缓存 - 配套部署与冒烟（_tooling/，不入库）：部署脚本容忍 tar 对非属主目录的 元数据回填失败；冒烟断言「状态码 + 正文无 PHP 错误 + </html> 收尾 + 无绝对路径泄露 + 断言总数下限」—— 只看状态码会把「200 但正文中间 Fatal」当成通过，这一版在线上真实抓到过一次
This commit is contained in:
+189
@@ -0,0 +1,189 @@
|
||||
<?php
|
||||
/**
|
||||
* 家庭名册（家庭成员 + 将来的外部联系人共用一张表）。
|
||||
*
|
||||
* 之所以不拆成两张表：两者字段几乎一样；而且需要互相转换 ——
|
||||
* 一个「认识的人」随时可能变成家庭成员，一个家庭成员也可能只作为联系人存在。
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App;
|
||||
|
||||
final class Person
|
||||
{
|
||||
/** 名册列表（连带账号信息，用于显示「是否已开通登录」） */
|
||||
public static function all(int $familyId, string $q = '', string $kind = 'member'): array
|
||||
{
|
||||
$sql = 'SELECT p.*, a.id AS account_id, a.role AS account_role, a.status AS account_status,
|
||||
a.last_login_at
|
||||
FROM persons p
|
||||
LEFT JOIN accounts a ON a.person_id = p.id
|
||||
WHERE p.family_id = ? AND p.kind = ?';
|
||||
$args = [$familyId, $kind];
|
||||
if ($q !== '') {
|
||||
$sql .= ' AND (p.name LIKE ? OR p.nickname LIKE ? OR p.email LIKE ?)';
|
||||
$like = '%' . $q . '%';
|
||||
$args[] = $like;
|
||||
$args[] = $like;
|
||||
$args[] = $like;
|
||||
}
|
||||
$sql .= ' ORDER BY p.sort_order ASC, p.id ASC';
|
||||
$st = Database::get()->prepare($sql);
|
||||
$st->execute($args);
|
||||
return $st->fetchAll();
|
||||
}
|
||||
|
||||
public static function find(int $id): ?array
|
||||
{
|
||||
$st = Database::get()->prepare('SELECT * FROM persons WHERE id = ?');
|
||||
$st->execute([$id]);
|
||||
$row = $st->fetch();
|
||||
return $row ?: null;
|
||||
}
|
||||
|
||||
/** 带账号信息的详情（详情页用） */
|
||||
public static function findWithAccount(int $id): ?array
|
||||
{
|
||||
$st = Database::get()->prepare(
|
||||
'SELECT p.*, a.id AS account_id, a.role AS account_role,
|
||||
a.status AS account_status, a.last_login_at
|
||||
FROM persons p LEFT JOIN accounts a ON a.person_id = p.id
|
||||
WHERE p.id = ?'
|
||||
);
|
||||
$st->execute([$id]);
|
||||
$row = $st->fetch();
|
||||
return $row ?: null;
|
||||
}
|
||||
|
||||
public static function findByPhoneHash(string $hash): ?array
|
||||
{
|
||||
$st = Database::get()->prepare('SELECT * FROM persons WHERE phone_hash = ? LIMIT 1');
|
||||
$st->execute([$hash]);
|
||||
$row = $st->fetch();
|
||||
return $row ?: null;
|
||||
}
|
||||
|
||||
/**
|
||||
* 新增。手机号是敏感字段，进来就加密 + 哈希。
|
||||
* @return int 新 id
|
||||
*/
|
||||
public static function create(int $familyId, array $d): int
|
||||
{
|
||||
$phone = $d['phone'] ?? '';
|
||||
$sql = 'INSERT INTO persons
|
||||
(family_id, kind, name, nickname, gender, birthday, avatar,
|
||||
phone_hash, phone_encrypted, id_card_encrypted, email, address, note, sort_order)
|
||||
VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)';
|
||||
$st = Database::get()->prepare($sql);
|
||||
$st->execute([
|
||||
$familyId,
|
||||
$d['kind'] ?? 'member',
|
||||
$d['name'],
|
||||
$d['nickname'] !== '' ? $d['nickname'] : null,
|
||||
$d['gender'] !== '' ? $d['gender'] : null,
|
||||
$d['birthday'] !== '' ? $d['birthday'] : null,
|
||||
$d['avatar'] !== '' ? $d['avatar'] : null,
|
||||
$phone !== '' ? Crypto::hash($phone) : null,
|
||||
$phone !== '' ? Crypto::encrypt($phone) : null,
|
||||
($d['id_card'] ?? '') !== '' ? Crypto::encrypt($d['id_card']) : null,
|
||||
$d['email'] !== '' ? $d['email'] : null,
|
||||
$d['address'] !== '' ? $d['address'] : null,
|
||||
$d['note'] !== '' ? $d['note'] : null,
|
||||
(int)($d['sort_order'] ?? 1000),
|
||||
]);
|
||||
return (int)Database::get()->lastInsertId();
|
||||
}
|
||||
|
||||
public static function update(int $id, array $d): void
|
||||
{
|
||||
$phone = $d['phone'] ?? '';
|
||||
$sql = 'UPDATE persons SET
|
||||
name = ?, nickname = ?, gender = ?, birthday = ?, avatar = ?,
|
||||
phone_hash = ?, phone_encrypted = ?, id_card_encrypted = ?,
|
||||
email = ?, address = ?, note = ?, sort_order = ?
|
||||
WHERE id = ?';
|
||||
Database::get()->prepare($sql)->execute([
|
||||
$d['name'],
|
||||
$d['nickname'] !== '' ? $d['nickname'] : null,
|
||||
$d['gender'] !== '' ? $d['gender'] : null,
|
||||
$d['birthday'] !== '' ? $d['birthday'] : null,
|
||||
$d['avatar'] !== '' ? $d['avatar'] : null,
|
||||
$phone !== '' ? Crypto::hash($phone) : null,
|
||||
$phone !== '' ? Crypto::encrypt($phone) : null,
|
||||
($d['id_card'] ?? '') !== '' ? Crypto::encrypt($d['id_card']) : null,
|
||||
$d['email'] !== '' ? $d['email'] : null,
|
||||
$d['address'] !== '' ? $d['address'] : null,
|
||||
$d['note'] !== '' ? $d['note'] : null,
|
||||
(int)($d['sort_order'] ?? 1000),
|
||||
$id,
|
||||
]);
|
||||
}
|
||||
|
||||
/** 只改头像（上传后单独调用，避免整条记录被表单覆盖） */
|
||||
public static function setAvatar(int $id, ?string $avatar): void
|
||||
{
|
||||
Database::get()->prepare('UPDATE persons SET avatar = ? WHERE id = ?')
|
||||
->execute([$avatar, $id]);
|
||||
}
|
||||
|
||||
public static function delete(int $id): void
|
||||
{
|
||||
Database::get()->prepare('DELETE FROM persons WHERE id = ?')->execute([$id]);
|
||||
}
|
||||
|
||||
/**
|
||||
* 最近要过生日的人（首页用）。
|
||||
* 直接算「今天是今年的第几天」与生日的差值，跨年自动处理。
|
||||
*/
|
||||
public static function upcomingBirthdays(int $familyId, int $withinDays = 60): array
|
||||
{
|
||||
$st = Database::get()->prepare(
|
||||
"SELECT id, name, avatar, birthday FROM persons
|
||||
WHERE family_id = ? AND kind = 'member' AND birthday IS NOT NULL
|
||||
ORDER BY DAYOFYEAR(birthday)"
|
||||
);
|
||||
$st->execute([$familyId]);
|
||||
$rows = $st->fetchAll();
|
||||
|
||||
$out = [];
|
||||
foreach ($rows as $r) {
|
||||
$days = days_until_birthday($r['birthday']);
|
||||
if ($days !== null && $days <= $withinDays) {
|
||||
$r['days_left'] = $days;
|
||||
$out[] = $r;
|
||||
}
|
||||
}
|
||||
usort($out, function ($a, $b) {
|
||||
return $a['days_left'] <=> $b['days_left'];
|
||||
});
|
||||
return $out;
|
||||
}
|
||||
|
||||
/** 校验表单，返回错误数组（空数组表示通过） */
|
||||
public static function validate(array $d): array
|
||||
{
|
||||
$err = [];
|
||||
if (trim((string)($d['name'] ?? '')) === '') {
|
||||
$err['name'] = '姓名不能为空';
|
||||
}
|
||||
$phone = trim((string)($d['phone'] ?? ''));
|
||||
if ($phone !== '' && !preg_match('/^\+?[0-9\-]{6,20}$/', $phone)) {
|
||||
$err['phone'] = '手机号格式看起来不对';
|
||||
}
|
||||
$email = trim((string)($d['email'] ?? ''));
|
||||
if ($email !== '' && !filter_var($email, FILTER_VALIDATE_EMAIL)) {
|
||||
$err['email'] = '邮箱格式看起来不对';
|
||||
}
|
||||
$b = trim((string)($d['birthday'] ?? ''));
|
||||
if ($b !== '' && !preg_match('/^\d{4}-\d{2}-\d{2}$/', $b)) {
|
||||
$err['birthday'] = '生日请按 年-月-日 填写';
|
||||
}
|
||||
// 身份证号只做很松的校验：家庭场景里要不要存它，本来就值得三思
|
||||
$idc = trim((string)($d['id_card'] ?? ''));
|
||||
if ($idc !== '' && !preg_match('/^[0-9Xx]{15,18}$/', $idc)) {
|
||||
$err['id_card'] = '身份证号应为 15 或 18 位';
|
||||
}
|
||||
return $err;
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user