Content: author endpoints + server-side HTML sanitization (Phase 4.2)
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 56/100
调研方向
首先检查 Content 模块现有的 endpoint 和 workflow 模式，然后检查 dependency #2 中的 Post 实体和 workflow。使用 tests/CommunityPro.Tests/Members/MembersTestHarness.cs 中的 Members 测试 harness 作为指定的测试参考，并为每个 endpoint 添加 xUnit 覆盖，包括具有恶意内容的 TipTap payload。满足所列出的 authorization、state、validation、sanitization、error-code 和 pagination 标准，即表示完成。
由索引模型根据 Issue 内容生成。
描述
Scope
Author-facing endpoints on the Content module. Any active member can write; authors can only touch their own posts.
| Method | Path | Auth | Notes |
|---|---|---|---|
| GET | /posts/mine |
active member | paginated, all statuses, author only |
| POST | /posts/mine |
active member | create draft |
| PUT | /posts/{id} |
active member | edit own Draft/Rejected post (autosave target — must be cheap) |
| POST | /posts/{id}/submit |
active member | Draft → Submitted |
Sanitization
On submit, produce ContentHtml from the TipTap payload server-side using HtmlSanitizer. Store both: ContentJson for re-editing, sanitized ContentHtml as the only thing public pages ever render. Never trust or render raw author HTML.
Validation
Title/excerpt length caps, tag whitelist + max count, cover image URL must be an allowed image host (see MemberProfileService.IsAllowedAvatarHttpsUrl for the pattern and host list).
Error codes
content.not_found, content.not_author, content.invalid_state, content.invalid_post
Dependencies
Blocked by #2 (Post entity + workflow).
Acceptance criteria
- Non-author gets
content.not_author(404-shaped, no existence leak, matching project convention) - Editing a Submitted/Published post fails with
content.invalid_state - Submit sanitizes: script tags, event handlers, javascript: URLs stripped (tests with hostile payloads)
- Pending (non-active) members are rejected by the policy
- xUnit coverage per endpoint
Conventions (project-wide, non-negotiable)
- .NET 9, records for immutable shapes, file-scoped namespaces, primary constructors where they read well. Minimal-API endpoints grouped per module via
IEndpointModule.MapEndpoints. Result<T>(SharedKernel) instead of exception-driven control flow. Endpoint results map failures to ProblemDetails with the stable error codes listed above — the frontend keys off them.- Module owns its EF Core
DbContextmapped to its own Postgres schema. Modules never reference each other's internals — cross-module needs go through a public contract interface or an in-process domain event (IEventPublisher). - All external calls (GitHub, Stripe, Brevo, Cloudinary, Meilisearch) behind interfaces owned by the consuming module.
- Every list endpoint paginated (offset is fine). xUnit tests in
tests/CommunityPro.Tests/<Module>/following the existing harness patterns (seeMembers/MembersTestHarness.cs).
- 主要语言
- C#
- 星标
- 0
- 派生
- 0
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 提供 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 没有贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
CommunityPro/community-pro-api 的其他 Issue
-
cross-cutting decision
难度 5/5 一周以上 新手友好度 35/100
-
cross-cutting
难度 4/5 3-5 天 新手友好度 58/100
-
admin
难度 5/5 一周以上 新手友好度 35/100
-
admin
难度 5/5 一周以上 新手友好度 35/100
-
sponsorship
难度 4/5 3-5 天 新手友好度 48/100
查看 CommunityPro/community-pro-api 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 78/100
sebastienros/jint#4282 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 76/100
pyrevitlabs/pyRevit#3792 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 60/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 65/100
fboucher/2d6-dungeon-app#256 ·
维护者通常 1 天内回复
-
area: design documentation
难度 2/5 1-3 小时 新手友好度 76/100
eyalgolan/statecraft-israel#883 ·
维护者通常 1 天内回复