补齐未接入代码的功能域：参与人 / 评论 / 花销与分摊

数据库里早就建好了 comments、node_members + role_tags、expenses + expense_splits 三组表，但一直没有代码接入。本次把这三块连上业务，并新增「节点详情页」作为聚合入口。新增 - src/Access.php 统一归属校验。此前每个控制器各写各的 family_id 条件，容易漏；现在 activity()/node()/target() 一处收敛， requireAdmin() 统一管理员判断。 - src/Comments.php 两级平铺：parent_id 只允许指向顶层，写「回复的回复」时规范化回顶层；删顶层会连同回复一起删。 - src/Members.php 参与人 + 角色标签 + 情绪 + 签到。情绪目录 17 项，全部选用 Emoji 11.0（2018）及以前的码位，避免旧系统字体缺字形显示成空白方块。 - src/Expenses.php 花销与分摊。分摊按「分」为单位 intdiv 平均，余数归最后一人，保证 SUM(share_amount) = total_amount。 - templates/nodes/show.php 节点详情页：基本信息 + 参与人 + 花销 + 讨论 + 附件入口。 - 角色标签管理、评论区、参与人区、花销区各自的模板与控制器。修复 - 越权：往别人活动的节点上插节点、把别家用户加成参与人，都只校验了「节点存在」，没校验「用户与节点同家庭」。现统一走 Access。 - 删活动时节点附件文件删不掉：附件在 /uploads/attachments/ 下，却调了只认 /uploads/covers/ 的删除函数，判定不通过 → 文件永久残留。改为统一的 deleteUploadFile()，两个目录都认。 - 删有引用记录的用户会 500（activities.created_by / attachments.uploader_id / comments.author_id / expenses.payer_user_id 这几处没有级联，也没做前置检查）。其他 - 活动/节点列表补上附件、评论、参与人、花销四个计数（一次 GROUP BY 查完）。 - 首页布局新增一条迁移易踩的规避：新列上的索引必须排在 ALTER TABLE 之后。 - 新增 .gitignore：config.php（含数据库口令）与 uploads/ 下用户上传的头像封面不入库，只保留 uploads/.htaccess 那条禁止执行脚本的规则。 - 新增 config.example.php 作为新环境的配置模板。本批不改数据库结构，不需要任何数据迁移。本地与线上验证 - php -l 全绿（PHP 8.4 本地 / 线上 7.4.30 与 8.1.7 双版本）。 - 模板渲染检查 180 项全通过。 - 线上端到端 153 项全通过：登录、活动增删改查、节点流转、参与人/角色标签/情绪/签到、评论、花销与分摊、权限、级联清理、全站页面无 PHP 报错泄漏、跑完基线逐表核对且既有 id 集合逐字未变。 - 顺带写了 trip_sql_column_check.py：拿真实库表结构静态校验全项目 SQL 的列名引用。本次就是靠它之外的 e2e 抓到 travel_modes 并没有 line_name （该列属于 trip_nodes），一个列名写错导致节点详情页整页 Fatal。
2026-09-22 22:03:08 +08:00
parent 6c1345e202
commit a79956758b
49 changed files with 7059 additions and 0 deletions
@@ -0,0 +1,266 @@
+<?php
+declare(strict_types=1);
+
+namespace App\Controllers;
+
+use App\Auth;
+use App\Database;
+
+class VehicleController
+{
+    public const TYPE_LABELS = [
+        'own'    => '自有车',
+        'rental' => '租车',
+    ];
+
+    public function index(): void
+    {
+        $this->requireLogin();
+
+        $db = Database::get();
+        $familyId = Auth::familyId();
+
+        $stmt = $db->prepare('SELECT * FROM vehicles WHERE family_id = ?
+            ORDER BY vehicle_type ASC, is_default DESC, id ASC');
+        $stmt->execute([$familyId]);
+        $vehicles = $stmt->fetchAll();
+
+        // 统计每个车辆被出行方式引用次数
+        foreach ($vehicles as &$v) {
+            $s = $db->prepare('SELECT COUNT(*) FROM travel_modes WHERE vehicle_id = ?');
+            $s->execute([$v['id']]);
+            $v['mode_count'] = (int)$s->fetchColumn();
+        }
+        unset($v);
+
+        view('vehicles/index', [
+            'vehicles'  => $vehicles,
+            'typeLabels' => self::TYPE_LABELS,
+            'pageTitle' => '车辆管理',
+        ]);
+    }
+
+    public function create(): void
+    {
+        $this->requireLogin();
+        view('vehicles/form', [
+            'vehicle'   => null,
+            'typeLabels' => self::TYPE_LABELS,
+            'pageTitle' => '新增车辆',
+        ]);
+    }
+
+    public function store(): void
+    {
+        $this->requireLogin();
+        csrf_check();
+
+        $db = Database::get();
+        $familyId = Auth::familyId();
+
+        $data = $this->collectInput();
+        if ($data['error']) {
+            flash('error', $data['error']);
+            redirect('vehicles/create');
+        }
+
+        // 车牌唯一性
+        $chk = $db->prepare('SELECT id FROM vehicles WHERE family_id = ? AND plate_number = ? LIMIT 1');
+        $chk->execute([$familyId, $data['plate_number']]);
+        if ($chk->fetch()) {
+            flash('error', '该车牌号已存在');
+            redirect('vehicles/create');
+        }
+
+        // 如果是默认自有车，先把其他自有车的 is_default 清掉
+        if ($data['vehicle_type'] === 'own' && $data['is_default']) {
+            $db->prepare('UPDATE vehicles SET is_default = 0 WHERE family_id = ? AND vehicle_type = "own"')
+               ->execute([$familyId]);
+        }
+
+        $stmt = $db->prepare('INSERT INTO vehicles
+            (family_id, plate_number, model_name, vehicle_type, rental_company, rental_order_no, is_default, notes)
+            VALUES (?, ?, ?, ?, ?, ?, ?, ?)');
+        $stmt->execute([
+            $familyId,
+            $data['plate_number'],
+            $data['model_name'],
+            $data['vehicle_type'],
+            $data['rental_company'],
+            $data['rental_order_no'],
+            $data['is_default'] ? 1 : 0,
+            $data['notes'],
+        ]);
+
+        flash('error', '创建成功');
+        redirect('vehicles/index');
+    }
+
+    public function edit(): void
+    {
+        $this->requireLogin();
+        $id = (int)($_GET['id'] ?? 0);
+        $db = Database::get();
+
+        $stmt = $db->prepare('SELECT * FROM vehicles WHERE id = ? AND family_id = ?');
+        $stmt->execute([$id, Auth::familyId()]);
+        $vehicle = $stmt->fetch();
+        if (!$vehicle) {
+            http_response_code(404);
+            exit('车辆不存在');
+        }
+
+        view('vehicles/form', [
+            'vehicle'   => $vehicle,
+            'typeLabels' => self::TYPE_LABELS,
+            'pageTitle' => '编辑车辆',
+        ]);
+    }
+
+    public function update(): void
+    {
+        $this->requireLogin();
+        csrf_check();
+
+        $db = Database::get();
+        $familyId = Auth::familyId();
+        $id = (int)($_POST['id'] ?? 0);
+
+        $stmt = $db->prepare('SELECT * FROM vehicles WHERE id = ? AND family_id = ?');
+        $stmt->execute([$id, $familyId]);
+        $old = $stmt->fetch();
+        if (!$old) {
+            http_response_code(404);
+            exit('车辆不存在');
+        }
+
+        $data = $this->collectInput();
+        if ($data['error']) {
+            flash('error', $data['error']);
+            redirect('vehicles/edit', ['id' => $id]);
+        }
+
+        // 车牌唯一性（排除自身）
+        $chk = $db->prepare('SELECT id FROM vehicles WHERE family_id = ? AND plate_number = ? AND id != ? LIMIT 1');
+        $chk->execute([$familyId, $data['plate_number'], $id]);
+        if ($chk->fetch()) {
+            flash('error', '该车牌号已被其他车辆使用');
+            redirect('vehicles/edit', ['id' => $id]);
+        }
+
+        // 如果改为默认自有车，清掉其他默认
+        if ($data['vehicle_type'] === 'own' && $data['is_default']) {
+            $db->prepare('UPDATE vehicles SET is_default = 0 WHERE family_id = ? AND vehicle_type = "own" AND id != ?')
+               ->execute([$familyId, $id]);
+        }
+
+        $stmt = $db->prepare('UPDATE vehicles SET
+            plate_number = ?, model_name = ?, vehicle_type = ?,
+            rental_company = ?, rental_order_no = ?, is_default = ?, notes = ?
+            WHERE id = ?');
+        $stmt->execute([
+            $data['plate_number'],
+            $data['model_name'],
+            $data['vehicle_type'],
+            $data['rental_company'],
+            $data['rental_order_no'],
+            $data['is_default'] ? 1 : 0,
+            $data['notes'],
+            $id,
+        ]);
+
+        flash('error', '保存成功');
+        redirect('vehicles/index');
+    }
+
+    public function destroy(): void
+    {
+        $this->requireLogin();
+        csrf_check();
+
+        $db = Database::get();
+        $id = (int)($_POST['id'] ?? 0);
+
+        $stmt = $db->prepare('SELECT * FROM vehicles WHERE id = ? AND family_id = ?');
+        $stmt->execute([$id, Auth::familyId()]);
+        $vehicle = $stmt->fetch();
+        if (!$vehicle) {
+            flash('error', '车辆不存在');
+            redirect('vehicles/index');
+        }
+
+        // 检查是否被出行方式引用
+        $cnt = $db->prepare('SELECT COUNT(*) FROM travel_modes WHERE vehicle_id = ?');
+        $cnt->execute([$id]);
+        $usedCount = (int)$cnt->fetchColumn();
+        if ($usedCount > 0) {
+            flash('error', "该车辆已被 {$usedCount} 条出行方式引用，无法删除");
+            redirect('vehicles/index');
+        }
+
+        // 检查是否被节点直接引用（vehicle_id 在 trip_nodes 上也可能存在）
+        $cnt2 = $db->prepare('SELECT COUNT(*) FROM trip_nodes WHERE vehicle_id = ?');
+        $cnt2->execute([$id]);
+        $nodeCount = (int)$cnt2->fetchColumn();
+        if ($nodeCount > 0) {
+            flash('error', "该车辆已被 {$nodeCount} 个节点使用，无法删除");
+            redirect('vehicles/index');
+        }
+
+        $stmt = $db->prepare('DELETE FROM vehicles WHERE id = ?');
+        $stmt->execute([$id]);
+
+        flash('error', '删除成功');
+        redirect('vehicles/index');
+    }
+
+    /**
+     * 从 $_POST 收集车辆数据并做基本校验
+     * @return array {error: string|null, plate_number, model_name, vehicle_type, rental_company, rental_order_no, is_default, notes}
+     */
+    private function collectInput(): array
+    {
+        $plateNumber = strtoupper(trim($_POST['plate_number'] ?? ''));
+        $modelName   = trim($_POST['model_name'] ?? '');
+        $vehicleType = $_POST['vehicle_type'] ?? 'own';
+        $rentalCompany = trim($_POST['rental_company'] ?? '');
+        $rentalOrderNo = trim($_POST['rental_order_no'] ?? '');
+        $isDefault   = !empty($_POST['is_default']);
+        $notes       = trim($_POST['notes'] ?? '');
+
+        if ($plateNumber === '') {
+            return ['error' => '车牌号不能为空'];
+        }
+        if (mb_strlen($plateNumber) > 20) {
+            return ['error' => '车牌号不能超过 20 个字符'];
+        }
+        if ($modelName === '') {
+            return ['error' => '车型名称不能为空'];
+        }
+        if (!in_array($vehicleType, ['own', 'rental'], true)) {
+            return ['error' => '无效的车辆类型'];
+        }
+        // 自有车不能是默认租车
+        if ($vehicleType === 'rental') {
+            $isDefault = false;
+        }
+
+        return [
+            'error'            => null,
+            'plate_number'     => $plateNumber,
+            'model_name'       => $modelName,
+            'vehicle_type'     => $vehicleType,
+            'rental_company'   => $vehicleType === 'rental' ? ($rentalCompany ?: null) : null,
+            'rental_order_no'  => $vehicleType === 'rental' ? ($rentalOrderNo ?: null) : null,
+            'is_default'       => $isDefault,
+            'notes'            => $notes ?: null,
+        ];
+    }
+
+    private function requireLogin(): void
+    {
+        if (!Auth::check()) {
+            redirect('auth/login');
+        }
+    }
+}