优化

internal/server/handler/api.go

@@ -199,9 +199,10 @@ func (h *API) ApplySync(c *gin.Context) {
 	httpx.OK(c)
 }
 func (h *API) FreshCasbin(c *gin.Context) {
-	// Policies are read from casbin_rule on every authorization decision, so
-	// there is no in-memory enforcer cache to reload. Keep the compatible
-	// endpoint and success response.
+	if err := h.service.FreshCasbin(c.Request.Context()); err != nil {
+		httpx.Fail(c, "刷新失败")
+		return
+	}
 	httpx.Write(c, httpx.CodeSuccess, gin.H{}, "刷新成功")
 }
 

internal/server/handler/export.go

@@ -22,15 +22,26 @@ func NewExport(service *service.ExportService) *Export {
 	return &Export{service: service}
 }
 
-func exportParams(values url.Values) map[string]string {
+func exportParams(values url.Values) (map[string]string, error) {
 	out := map[string]string{}
-	nested, _ := url.ParseQuery(values.Get("params"))
+	nested, err := url.ParseQuery(values.Get("params"))
+	if err != nil {
+		return nil, err
+	}
 	for key, items := range nested {
 		if len(items) > 0 {
 			out[key] = items[0]
 		}
 	}
-	return out
+	return out, nil
+}
+
+func exportIssueParams(values url.Values, blank bool) (map[string]string, error) {
+	params, err := exportParams(values)
+	if err != nil && blank {
+		return map[string]string{}, nil
+	}
+	return params, err
 }
 
 func (h *Export) Create(c *gin.Context) {
@@ -133,7 +144,8 @@ func (h *Export) Preview(c *gin.Context) {
 		httpx.Fail(c, "模板ID不能为空")
 		return
 	}
-	sql, err := h.service.Preview(c.Request.Context(), templateID, exportParams(c.Request.URL.Query()))
+	params, _ := exportParams(c.Request.URL.Query())
+	sql, err := h.service.Preview(c.Request.Context(), templateID, params)
 	if err != nil {
 		httpx.Fail(c, "获取失败")
 		return
@@ -148,7 +160,12 @@ func (h *Export) Issue(blank bool) gin.HandlerFunc {
 			httpx.Fail(c, "模板ID不能为空")
 			return
 		}
-		token, err := h.service.IssueToken(c.Request.Context(), templateID, exportParams(c.Request.URL.Query()), blank)
+		params, err := exportIssueParams(c.Request.URL.Query(), blank)
+		if err != nil {
+			httpx.Fail(c, "解析 params 参数失败")
+			return
+		}
+		token, err := h.service.IssueToken(c.Request.Context(), templateID, params, blank)
 		if err != nil {
 			httpx.Fail(c, "导出令牌创建失败")
 			return

internal/server/handler/export_test.go

@@ -0,0 +1,40 @@
+package handler
+
+import (
+	"net/url"
+	"testing"
+)
+
+func TestExportParamsRejectsMalformedNestedQuery(t *testing.T) {
+	_, err := exportParams(url.Values{"params": {"name=%zz"}})
+	if err == nil {
+		t.Fatal("exportParams accepted malformed nested query")
+	}
+}
+
+func TestExportParamsUsesFirstValue(t *testing.T) {
+	got, err := exportParams(url.Values{"params": {"name=first&name=second"}})
+	if err != nil {
+		t.Fatalf("exportParams returned error: %v", err)
+	}
+	if got["name"] != "first" {
+		t.Fatalf("exportParams name = %q, want first", got["name"])
+	}
+}
+
+func TestExportIssueParamsKeepsBlankTemplateCompatible(t *testing.T) {
+	got, err := exportIssueParams(url.Values{"params": {"name=%zz"}}, true)
+	if err != nil {
+		t.Fatalf("blank template params returned error: %v", err)
+	}
+	if len(got) != 0 {
+		t.Fatalf("blank template params = %#v, want empty", got)
+	}
+}
+
+func TestExportIssueParamsRejectsMalformedExcelParams(t *testing.T) {
+	_, err := exportIssueParams(url.Values{"params": {"name=%zz"}}, false)
+	if err == nil {
+		t.Fatal("Excel export accepted malformed nested query")
+	}
+}