feat: improve attendance scheduling and API validation

apps/server/src/deposits/deposits.controller.ts

@@ -9,6 +9,7 @@ import {
   Query,
   UseGuards,
   Request,
+  ParseIntPipe,
 } from '@nestjs/common';
 import { InjectRepository } from '@nestjs/typeorm';
 import { Repository } from 'typeorm';
@@ -16,7 +17,12 @@ import { Student } from '../entities/student.entity';
 import { DepositsService } from './deposits.service';
 import { NotificationsService } from '../notifications/notifications.service';
 import { NotificationType } from '../entities/notification.entity';
-import { CreateDepositDto, RefundDepositDto } from './dto/deposit.dto';
+import {
+  CreateDepositDto,
+  CreateDepositInstallmentDto,
+  RefundDepositDto,
+  UpdateDepositInstallmentDto,
+} from './dto/deposit.dto';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { OperationLogsService } from '../operation-logs/operation-logs.service';
 import { extractRequestInfo } from '../common/request-utils';
@@ -40,9 +46,12 @@ export class DepositsController {
 
   @Get()
   @RequirePermission('deposit:view')
-  findAll(@Query('studentId') studentId?: string, @Query('status') status?: string) {
+  findAll(
+    @Query('studentId', new ParseIntPipe({ optional: true })) studentId?: number,
+    @Query('status') status?: string,
+  ) {
     return this.service.findAll({
-      studentId: studentId ? +studentId : undefined,
+      studentId,
       status: status || undefined,
     });
   }
@@ -55,8 +64,8 @@ export class DepositsController {
 
   @Get(':id')
   @RequirePermission('deposit:view')
-  findOne(@Param('id') id: string) {
-    return this.service.findOne(+id);
+  findOne(@Param('id', ParseIntPipe) id: number) {
+    return this.service.findOne(id);
   }
 
   @Post()
@@ -93,12 +102,12 @@ export class DepositsController {
   @Post(':id/installments')
   @RequirePermission('deposit:edit')
   async addInstallment(
-    @Param('id') id: string,
-    @Body() body: { amount: number; dueDate: string },
+    @Param('id', ParseIntPipe) id: number,
+    @Body() body: CreateDepositInstallmentDto,
     @Request() req: { user?: { id: number; username: string }; headers?: Record<string, string> },
   ) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.addInstallment(+id, body.amount, body.dueDate);
+    const result = await this.service.addInstallment(id, body.amount, body.dueDate);
     await this.logService.log({
       userId: req.user?.id,
       username: req.user?.username,
@@ -116,18 +125,18 @@ export class DepositsController {
   @Put('installments/:installmentId')
   @RequirePermission('deposit:edit')
   async updateInstallment(
-    @Param('installmentId') installmentId: string,
-    @Body() body: { paidDate?: string; status?: string },
+    @Param('installmentId', ParseIntPipe) installmentId: number,
+    @Body() body: UpdateDepositInstallmentDto,
     @Request() req: { user?: { id: number; username: string }; headers?: Record<string, string> },
   ) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.updateInstallment(+installmentId, body);
+    const result = await this.service.updateInstallment(installmentId, body);
     await this.logService.log({
       userId: req.user?.id,
       username: req.user?.username,
       module: '押金管理',
       action: '更新分期',
-      targetId: +installmentId,
+      targetId: installmentId,
       targetType: 'deposit-installment',
       detail: `更新分期${installmentId}, 状态：${result.status ?? '-'}, 实付日：${result.paidDate ?? '-'}`,
       ipAddress,
@@ -139,17 +148,17 @@ export class DepositsController {
   @Delete('installments/:installmentId')
   @RequirePermission('deposit:delete')
   async deleteInstallment(
-    @Param('installmentId') installmentId: string,
+    @Param('installmentId', ParseIntPipe) installmentId: number,
     @Request() req: { user?: { id: number; username: string }; headers?: Record<string, string> },
   ) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.deleteInstallment(+installmentId);
+    const result = await this.service.deleteInstallment(installmentId);
     await this.logService.log({
       userId: req.user?.id,
       username: req.user?.username,
       module: '押金管理',
       action: '删除分期',
-      targetId: +installmentId,
+      targetId: installmentId,
       targetType: 'deposit-installment',
       detail: `删除分期${installmentId}`,
       ipAddress,
@@ -160,15 +169,15 @@ export class DepositsController {
 
   @Put(':id/refund')
   @RequirePermission('deposit:refund')
-  async refund(@Param('id') id: string, @Body() dto: RefundDepositDto, @Request() req: any) {
+  async refund(@Param('id', ParseIntPipe) id: number, @Body() dto: RefundDepositDto, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.refund(+id, dto, req.user?.id);
+    const result = await this.service.refund(id, dto, req.user?.id);
     await this.logService.log({
       userId: req.user?.id,
       username: req.user?.username,
       module: '押金管理',
       action: '退还押金',
-      targetId: +id,
+      targetId: id,
       targetType: 'deposit',
       detail: `退还全部可用押金 ¥${result.refundAmount}`,
       ipAddress,
@@ -191,15 +200,15 @@ export class DepositsController {
 
   @Delete(':id')
   @RequirePermission('deposit:delete')
-  async remove(@Param('id') id: string, @Request() req: any) {
+  async remove(@Param('id', ParseIntPipe) id: number, @Request() req: any) {
     const { ipAddress, userAgent } = extractRequestInfo(req);
-    const result = await this.service.remove(+id);
+    const result = await this.service.remove(id);
     await this.logService.log({
       userId: req.user?.id,
       username: req.user?.username,
       module: '押金管理',
       action: '删除押金记录',
-      targetId: +id,
+      targetId: id,
       targetType: 'deposit',
       ipAddress,
       userAgent,