补齐未接入代码的功能域：参与人 / 评论 / 花销与分摊

数据库里早就建好了 comments、node_members + role_tags、expenses + expense_splits 三组表，但一直没有代码接入。本次把这三块连上业务，并新增「节点详情页」作为聚合入口。新增 - src/Access.php 统一归属校验。此前每个控制器各写各的 family_id 条件，容易漏；现在 activity()/node()/target() 一处收敛， requireAdmin() 统一管理员判断。 - src/Comments.php 两级平铺：parent_id 只允许指向顶层，写「回复的回复」时规范化回顶层；删顶层会连同回复一起删。 - src/Members.php 参与人 + 角色标签 + 情绪 + 签到。情绪目录 17 项，全部选用 Emoji 11.0（2018）及以前的码位，避免旧系统字体缺字形显示成空白方块。 - src/Expenses.php 花销与分摊。分摊按「分」为单位 intdiv 平均，余数归最后一人，保证 SUM(share_amount) = total_amount。 - templates/nodes/show.php 节点详情页：基本信息 + 参与人 + 花销 + 讨论 + 附件入口。 - 角色标签管理、评论区、参与人区、花销区各自的模板与控制器。修复 - 越权：往别人活动的节点上插节点、把别家用户加成参与人，都只校验了「节点存在」，没校验「用户与节点同家庭」。现统一走 Access。 - 删活动时节点附件文件删不掉：附件在 /uploads/attachments/ 下，却调了只认 /uploads/covers/ 的删除函数，判定不通过 → 文件永久残留。改为统一的 deleteUploadFile()，两个目录都认。 - 删有引用记录的用户会 500（activities.created_by / attachments.uploader_id / comments.author_id / expenses.payer_user_id 这几处没有级联，也没做前置检查）。其他 - 活动/节点列表补上附件、评论、参与人、花销四个计数（一次 GROUP BY 查完）。 - 首页布局新增一条迁移易踩的规避：新列上的索引必须排在 ALTER TABLE 之后。 - 新增 .gitignore：config.php（含数据库口令）与 uploads/ 下用户上传的头像封面不入库，只保留 uploads/.htaccess 那条禁止执行脚本的规则。 - 新增 config.example.php 作为新环境的配置模板。本批不改数据库结构，不需要任何数据迁移。本地与线上验证 - php -l 全绿（PHP 8.4 本地 / 线上 7.4.30 与 8.1.7 双版本）。 - 模板渲染检查 180 项全通过。 - 线上端到端 153 项全通过：登录、活动增删改查、节点流转、参与人/角色标签/情绪/签到、评论、花销与分摊、权限、级联清理、全站页面无 PHP 报错泄漏、跑完基线逐表核对且既有 id 集合逐字未变。 - 顺带写了 trip_sql_column_check.py：拿真实库表结构静态校验全项目 SQL 的列名引用。本次就是靠它之外的 e2e 抓到 travel_modes 并没有 line_name （该列属于 trip_nodes），一个列名写错导致节点详情页整页 Fatal。
2026-09-22 22:03:08 +08:00
parent 6c1345e202
commit a79956758b
49 changed files with 7059 additions and 0 deletions
@@ -0,0 +1,231 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Controllers;
+
+use App\Auth;
+use App\Database;
+
+class TravelModeController
+{
+    public const MODE_LABELS = [
+        'drive_own'    => '自驾（自有车）',
+        'drive_rental' => '自驾（租车）',
+        'train'        => '火车/高铁',
+        'plane'        => '飞机',
+        'bus'          => '大巴/公交',
+        'subway'       => '地铁',
+        'taxi'         => '出租车/网约车',
+        'bike'         => '骑行',
+        'walk'         => '步行',
+        'ship'         => '轮渡/游船',
+        'other'        => '其他',
+    ];
+
+    public function index(): void
+    {
+        $this->requireLogin();
+
+        $db = Database::get();
+        $familyId = Auth::familyId();
+
+        $stmt = $db->prepare('
+            SELECT tm.*, v.plate_number, v.model_name
+            FROM travel_modes tm
+            LEFT JOIN vehicles v ON v.id = tm.vehicle_id
+            WHERE tm.family_id = ?
+            ORDER BY FIELD(tm.mode_type, "drive_own","drive_rental","train","plane","bus","subway","taxi","bike","walk","ship","other"), tm.id ASC
+        ');
+        $stmt->execute([$familyId]);
+        $modes = $stmt->fetchAll();
+
+        foreach ($modes as &$m) {
+            $s = $db->prepare('SELECT COUNT(*) FROM trip_nodes WHERE travel_mode_id = ?');
+            $s->execute([$m['id']]);
+            $m['node_count'] = (int)$s->fetchColumn();
+        }
+        unset($m);
+
+        view('travel_modes/index', [
+            'modes'      => $modes,
+            'modeLabels' => self::MODE_LABELS,
+            'pageTitle'  => '出行方式管理',
+        ]);
+    }
+
+    public function create(): void
+    {
+        $this->requireLogin();
+        view('travel_modes/form', [
+            'mode'       => null,
+            'vehicles'   => $this->fetchVehicles(),
+            'modeLabels' => self::MODE_LABELS,
+            'pageTitle'  => '新增出行方式',
+        ]);
+    }
+
+    public function store(): void
+    {
+        $this->requireLogin();
+        csrf_check();
+
+        $db = Database::get();
+        $familyId = Auth::familyId();
+
+        $modeType = $_POST['mode_type'] ?? '';
+        if (!isset(self::MODE_LABELS[$modeType])) {
+            flash('error', '无效的交通类型');
+            redirect('travel_modes/create');
+        }
+
+        $vehicleId = $this->validateVehicle($modeType, $db, $familyId, 'travel_modes/create');
+
+        $stmt = $db->prepare('INSERT INTO travel_modes (family_id, mode_type, vehicle_id, notes) VALUES (?, ?, ?, ?)');
+        $stmt->execute([
+            $familyId,
+            $modeType,
+            $vehicleId,
+            $this->strOrNull('notes'),
+        ]);
+
+        flash('error', '创建成功');
+        redirect('travel_modes/index');
+    }
+
+    public function edit(): void
+    {
+        $this->requireLogin();
+        $id = (int)($_GET['id'] ?? 0);
+        $db = Database::get();
+
+        $stmt = $db->prepare('SELECT * FROM travel_modes WHERE id = ? AND family_id = ?');
+        $stmt->execute([$id, Auth::familyId()]);
+        $mode = $stmt->fetch();
+        if (!$mode) {
+            http_response_code(404);
+            exit('出行方式不存在');
+        }
+
+        view('travel_modes/form', [
+            'mode'       => $mode,
+            'vehicles'   => $this->fetchVehicles(),
+            'modeLabels' => self::MODE_LABELS,
+            'pageTitle'  => '编辑出行方式',
+        ]);
+    }
+
+    public function update(): void
+    {
+        $this->requireLogin();
+        csrf_check();
+
+        $db = Database::get();
+        $familyId = Auth::familyId();
+        $id = (int)($_POST['id'] ?? 0);
+
+        $stmt = $db->prepare('SELECT * FROM travel_modes WHERE id = ? AND family_id = ?');
+        $stmt->execute([$id, $familyId]);
+        if (!$stmt->fetch()) {
+            http_response_code(404);
+            exit('出行方式不存在');
+        }
+
+        $modeType = $_POST['mode_type'] ?? '';
+        if (!isset(self::MODE_LABELS[$modeType])) {
+            flash('error', '无效的交通类型');
+            redirect('travel_modes/edit', ['id' => $id]);
+        }
+
+        $vehicleId = $this->validateVehicle($modeType, $db, $familyId, 'travel_modes/edit', ['id' => $id]);
+
+        $stmt = $db->prepare('UPDATE travel_modes SET mode_type = ?, vehicle_id = ?, notes = ? WHERE id = ?');
+        $stmt->execute([
+            $modeType,
+            $vehicleId,
+            $this->strOrNull('notes'),
+            $id,
+        ]);
+
+        flash('error', '保存成功');
+        redirect('travel_modes/index');
+    }
+
+    public function destroy(): void
+    {
+        $this->requireLogin();
+        csrf_check();
+
+        $db = Database::get();
+        $id = (int)($_POST['id'] ?? 0);
+
+        $stmt = $db->prepare('SELECT * FROM travel_modes WHERE id = ? AND family_id = ?');
+        $stmt->execute([$id, Auth::familyId()]);
+        if (!$stmt->fetch()) {
+            flash('error', '出行方式不存在');
+            redirect('travel_modes/index');
+        }
+
+        $cnt = $db->prepare('SELECT COUNT(*) FROM trip_nodes WHERE travel_mode_id = ?');
+        $cnt->execute([$id]);
+        $usedCount = (int)$cnt->fetchColumn();
+        if ($usedCount > 0) {
+            flash('error', "该出行方式已被 {$usedCount} 个节点使用，无法删除");
+            redirect('travel_modes/index');
+        }
+
+        $stmt = $db->prepare('DELETE FROM travel_modes WHERE id = ?');
+        $stmt->execute([$id]);
+
+        flash('error', '删除成功');
+        redirect('travel_modes/index');
+    }
+
+    private function validateVehicle(string $modeType, \PDO $db, int $familyId, string $route, array $params = []): ?int
+    {
+        if (!in_array($modeType, ['drive_own', 'drive_rental'], true)) {
+            return null;
+        }
+
+        $vehicleId = (int)($_POST['vehicle_id'] ?? 0);
+        if ($vehicleId <= 0) {
+            flash('error', '自驾类型必须选择车辆');
+            redirect($route, $params);
+        }
+        $chk = $db->prepare('SELECT id, vehicle_type FROM vehicles WHERE id = ? AND family_id = ?');
+        $chk->execute([$vehicleId, $familyId]);
+        $veh = $chk->fetch();
+        if (!$veh) {
+            flash('error', '车辆不存在');
+            redirect($route, $params);
+        }
+        if ($modeType === 'drive_own' && $veh['vehicle_type'] !== 'own') {
+            flash('error', '自有车类型必须选择自有车辆');
+            redirect($route, $params);
+        }
+        if ($modeType === 'drive_rental' && $veh['vehicle_type'] !== 'rental') {
+            flash('error', '租车类型必须选择租用车辆');
+            redirect($route, $params);
+        }
+        return $vehicleId;
+    }
+
+    private function fetchVehicles(): array
+    {
+        $stmt = Database::get()->prepare('SELECT * FROM vehicles WHERE family_id = ? ORDER BY vehicle_type ASC, is_default DESC, id ASC');
+        $stmt->execute([Auth::familyId()]);
+        return $stmt->fetchAll();
+    }
+
+    private function strOrNull(string $key): ?string
+    {
+        $v = trim($_POST[$key] ?? '');
+        return $v === '' ? null : $v;
+    }
+
+    private function requireLogin(): void
+    {
+        if (!Auth::check()) {
+            redirect('auth/login');
+        }
+    }
+}