test: harden business boundary conditions

apps/server/src/archive/archive.service.ts

@@ -61,20 +61,27 @@ export class ArchiveService {
     const student = await this.studentRepo.findOne({ where: { id: studentId } });
     if (!student) throw new NotFoundException('学生不存在');
 
-    const [profileRaw, enrollments, examScores, learningRecords, resultArchive, attachments, attendances] =
-      await Promise.all([
-        this.profileRepo.findOne({ where: { studentId } }),
-        this.enrollmentRepo.find({ where: { studentId }, order: { createdAt: 'DESC' } }),
-        this.examScoreRepo.find({ where: { studentId }, order: { examDate: 'DESC' } }),
-        this.learningRecordRepo.find({ where: { studentId }, order: { recordDate: 'DESC' } }),
-        this.resultRepo.findOne({ where: { studentId } }),
-        this.attachmentRepo.find({ where: { studentId }, order: { createdAt: 'DESC' } }),
-        this.attendanceRepo.find({
-          where: { studentId },
-          relations: ['schedule', 'class'],
-          order: { attendanceDate: 'DESC', punchTime: 'DESC' },
-        }),
-      ]);
+    const [
+      profileRaw,
+      enrollments,
+      examScores,
+      learningRecords,
+      resultArchive,
+      attachments,
+      attendances,
+    ] = await Promise.all([
+      this.profileRepo.findOne({ where: { studentId } }),
+      this.enrollmentRepo.find({ where: { studentId }, order: { createdAt: 'DESC' } }),
+      this.examScoreRepo.find({ where: { studentId }, order: { examDate: 'DESC' } }),
+      this.learningRecordRepo.find({ where: { studentId }, order: { recordDate: 'DESC' } }),
+      this.resultRepo.findOne({ where: { studentId } }),
+      this.attachmentRepo.find({ where: { studentId }, order: { createdAt: 'DESC' } }),
+      this.attendanceRepo.find({
+        where: { studentId },
+        relations: ['schedule', 'class'],
+        order: { attendanceDate: 'DESC', punchTime: 'DESC' },
+      }),
+    ]);
 
     return {
       student,
@@ -123,9 +130,18 @@ export class ArchiveService {
     return { message: '已删除' };
   }
 
+  private async assertEnrollmentBelongsToStudent(studentId: number, enrollmentId?: number) {
+    if (enrollmentId === undefined) return;
+    const enrollment = await this.enrollmentRepo.findOne({
+      where: { id: enrollmentId, studentId },
+    });
+    if (!enrollment) throw new BadRequestException('报名记录不属于该学生');
+  }
+
   async addExamScore(studentId: number, dto: CreateExamScoreDto) {
     const student = await this.studentRepo.findOne({ where: { id: studentId } });
     if (!student) throw new NotFoundException('学生不存在');
+    await this.assertEnrollmentBelongsToStudent(studentId, dto.enrollmentId);
 
     const entity = this.examScoreRepo.create({ ...dto, studentId });
     return this.examScoreRepo.save(entity);
@@ -134,6 +150,7 @@ export class ArchiveService {
   async updateExamScore(id: number, dto: UpdateExamScoreDto) {
     const entity = await this.examScoreRepo.findOne({ where: { id } });
     if (!entity) throw new NotFoundException('考试成绩不存在');
+    await this.assertEnrollmentBelongsToStudent(entity.studentId, dto.enrollmentId);
     Object.assign(entity, dto);
     return this.examScoreRepo.save(entity);
   }
@@ -181,6 +198,8 @@ export class ArchiveService {
   }
 
   async addAttachment(studentId: number, file: Express.Multer.File, category: string) {
+    if (!file?.buffer || !file.originalname) throw new BadRequestException('请选择附件文件');
+
     const student = await this.studentRepo.findOne({ where: { id: studentId } });
     if (!student) throw new NotFoundException('学生不存在');