2820823b36
feat(api): API keys + Redis rate limiting + usage stats
...
CI / Python (ingestion) (pull_request) Successful in 12s
CI / Migrations (postgres) (pull_request) Successful in 24s
CI / Go (api) (pull_request) Successful in 53s
Add an optional API-key layer to the public read-only API. Keys grant
higher per-minute rate limits and attribute usage; anonymous callers are
still allowed at a lower IP-based budget.
- migration 0008_api_key: api_key table (sha256 hash only, plaintext shown once)
- apikey pkg: key generation + hashing
- ratelimit pkg: Redis fixed-window limiter + per-key usage counters; fails open
- public API middleware: X-API-Key / Bearer auth, X-RateLimit-* headers, 429+Retry-After
- admin: issue/list/revoke keys + usage view (API + UI tab)
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 08:24:07 +00:00
5b9338175e
style(api): gofmt gtin_test.go
...
CI / Python (ingestion) (pull_request) Successful in 8s
CI / Migrations (postgres) (pull_request) Successful in 15s
CI / Go (api) (pull_request) Successful in 31s
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 07:33:10 +00:00
98b5f1575d
feat(barcode): admin barcode CRUD endpoints + UI; show extra barcodes publicly
...
CI / Python (ingestion) (pull_request) Successful in 10s
CI / Go (api) (pull_request) Failing after 15s
CI / Migrations (postgres) (pull_request) Failing after 11m35s
Wire the multi-barcode store layer to HTTP and the operator console:
- adminhandler: add POST /products/{id}/barcodes, DELETE
/products/{id}/barcodes/{barcodeID}, and POST .../primary. A barcode
owned by another product returns 409 with the conflicting product
(gtin/product_id/product_name); an invalid GTIN returns 400.
- admin-frontend: BarcodesCard on the product detail page lists all
barcodes (primary starred), adds with type/pack-level/region, sets
primary, and deletes; audit labels for the new actions.
- public-frontend: product detail surfaces non-primary barcodes so a
case/region code resolves and is visible to consumers.
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 07:06:07 +00:00
1d5f775d33
feat(barcode): 多条码管理（后端+迁移+GTIN校验）WIP
...
CI / Go (api) (pull_request) Failing after 18s
CI / Python (ingestion) (pull_request) Successful in 7s
CI / Migrations (postgres) (pull_request) Failing after 22s
- 迁移 0007: 新增 product_barcode 表（一品多码），回填旧 product.gtin 为主码，
全局唯一索引保证「一码一品」，每品至多一个主码
- internal/gtin: GS1 GTIN-8/12/13/14 校验（校验位 + 拒收店内码/变量重量码/优惠券码）
- 公开只读 API: 任一条码命中商品、详情返回 barcodes、搜索匹配条码
- adminstore: 商品详情含 barcodes；新增 AddBarcode/DeleteBarcode/SetPrimaryBarcode，
一码命中其他商品返回 ConflictError 供后台去重
待办（按用户要求暂停）: 后台 handler 路由、投稿/审核多条码、前后端 UI
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 05:54:18 +00:00
c9a4404052
feat: 公开首页(搜索+商品详情) + 好心人投稿 + 后台审核收纳
...
CI / Go (api) (pull_request) Failing after 20s
CI / Python (ingestion) (pull_request) Successful in 8s
CI / Migrations (postgres) (pull_request) Failing after 17s
- 公开前端 SPA（根路径 /）：首页大搜索框、检索结果、只读商品详情、贡献档案表单
- 公开写入端点 POST /api/public/submissions（无需登录，基础频率限流），投稿进入 submission 待审核队列，不直接写 product
- 迁移 0006：submission 投稿表 + community 来源(trust=0.50)
- 后台审核队列：列表(待审核/已通过/已驳回) → 查看投稿 → 通过(创建/补全商品 + 记 source=community + 字段级溯源 + 审计 + 重算质量分) / 驳回(记原因)
- 公开只读 api 服务内嵌公开 SPA；Dockerfile.prod 增加 node 构建阶段 + 内嵌 dist
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 05:11:07 +00:00
bad771e172
build(admin): npm 走 npmmirror 镜像以适配部署环境网络
...
CI / Go (api) (pull_request) Failing after 19s
CI / Python (ingestion) (pull_request) Successful in 7s
CI / Migrations (postgres) (pull_request) Failing after 21s
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 02:54:32 +00:00
d90a539e6b
feat(admin): 运营后台（登录/查看/审核编辑/补全）+ 写入API + 审计留痕
...
CI / Go (api) (pull_request) Failing after 18s
CI / Python (ingestion) (pull_request) Successful in 7s
CI / Migrations (postgres) (pull_request) Failing after 18s
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 02:53:30 +00:00
6777461268
chore(deploy): 生产 docker compose + scratch Dockerfile + 部署文档
...
CI / Go (api) (pull_request) Failing after 41s
CI / Python (ingestion) (pull_request) Successful in 43s
CI / Migrations (postgres) (pull_request) Failing after 17s
- docker-compose.prod.yml：仅 api 绑 127.0.0.1:8120，DB/redis/minio 不暴露，restart=unless-stopped，凭据走 .env
- api/Dockerfile.prod：runtime 改用 scratch + 拷贝 ca-certs（gcr.io/distroless 不可达环境），Go 模块走 goproxy.cn
- .env.example / docs/deploy.md
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-20 02:27:09 +00:00
lixu
e750501b44
feat(M3): 只读 API 端点实现
...
CI / Go (api) (push) Has been cancelled
CI / Python (ingestion) (push) Has been cancelled
CI / Migrations (postgres) (push) Has been cancelled
- store: pgx 只读数据访问层(productByGTIN/ByID/search/nutriments/msrp/brands/categories/source)
- handler: 真实查询替换 501 占位, 统一分页 + 错误信封, MSRP 带免责声明无购买入口
- main: pgxpool 连接池接线
- search: 名称模糊 + 分类子树过滤(ltree <@)
- 测试: healthz/pageParams 单测 + DB-backed handler 集成测试(无库自动跳过)
- CI: Go job 增加 postgres service + migrate up, 实跑 DB 测试
- 依赖: pgx v5.7.2 (固定到兼容 go1.23 的版本)
- 本地实跑: 8 个端点对真实 OFF 数据返回正确(barcode/search/nutriments/msrp/brands/categories/source/404)
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-08 07:14:18 +00:00
lixu
786b7d3721
feat(M0): 工程地基 - Go API + Python 采集骨架 + CI + 数据契约
...
- api/: Go(chi) 只读 API 骨架, /healthz + 版本化路由(占位), Dockerfile, 单测
- ingestion/: Python 采集/ETL 包骨架, units 单位归一化(纯函数+测试), adapter 协议
- docker-compose.yml: postgres + redis + minio + api
- .github/workflows/ci.yml: Go build/vet/test + Python ruff/pytest
- docs/data-contract.md(两端共享契约) + docs/disclaimer.md(不提供购买声明)
- migrations/ 占位(M1 起填充)
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-06-08 06:18:31 +00:00
novaalphastrikeomegaz663
lixu