修改

1、微信回调签名验证绕过问题
2、联系请求竞态条件问题
3、contact列表count过滤bug
4、核心业务表索引添加

video-gen-api/app/api/v1/contact.py

@@ -2,6 +2,7 @@ from datetime import datetime, timezone, timedelta
 
 from fastapi import APIRouter, Depends, HTTPException, status
 from sqlalchemy import func, select
+from sqlalchemy.exc import IntegrityError
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.dependencies import get_db, get_current_user
@@ -19,37 +20,48 @@ async def create_contact_request(
     db: AsyncSession = Depends(get_db),
     user: User = Depends(get_current_user),
 ):
-    today_start = datetime.now(timezone.utc).replace(hour=0, minute=0, second=0, microsecond=0)
-    today_end = today_start + timedelta(days=1)
+    today_str = datetime.now(timezone.utc).strftime("%Y-%m-%d")
     
-    count = await db.execute(
-        select(func.count(ContactRequest.id))
-        .where(ContactRequest.user_id == user.id)
-        .where(ContactRequest.created_at >= today_start)
-        .where(ContactRequest.created_at < today_end)
-    )
-    daily_count = count.scalar_one()
+    async with db.begin_nested():
+        user_result = await db.execute(
+            select(User).where(User.id == user.id).with_for_update().limit(1)
+        )
+        locked_user = user_result.scalar_one_or_none()
+        if not locked_user:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
+        
+        existing = await db.execute(
+            select(ContactRequest.id)
+            .where(ContactRequest.user_id == user.id)
+            .where(ContactRequest.submit_date == today_str)
+            .limit(1)
+        )
+        if existing.scalar_one_or_none():
+            raise HTTPException(
+                status_code=status.HTTP_429_TOO_MANY_REQUESTS,
+                detail="每个账号每天只能提交一次联系我们"
+            )
     
-    if daily_count >= 1:
+    try:
+        contact_request = ContactRequest(
+            id=generate_id(),
+            user_id=user.id,
+            phone=request.phone,
+            company_name=request.company_name,
+            industry=request.industry,
+            name=request.name,
+            message=request.message,
+            submit_date=today_str,
+        )
+        db.add(contact_request)
+        await db.commit()
+    except IntegrityError:
+        await db.rollback()
         raise HTTPException(
             status_code=status.HTTP_429_TOO_MANY_REQUESTS,
             detail="每个账号每天只能提交一次联系我们"
         )
     
-    contact_request = ContactRequest(
-        id=generate_id(),
-        user_id=user.id,
-        phone=request.phone,
-        company_name=request.company_name,
-        industry=request.industry,
-        name=request.name,
-        message=request.message,
-    )
-    
-    db.add(contact_request)
-    await db.commit()
-    await db.refresh(contact_request)
-    
     return {"message": "提交成功，我们会尽快与您联系"}
 
 
@@ -64,17 +76,20 @@ async def get_contact_requests(
     if not user.is_admin:
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="无权限")
     
-    query = select(ContactRequest).order_by(ContactRequest.created_at.desc())
+    query = select(ContactRequest)
+    count_query = select(func.count(ContactRequest.id))
     
     if is_handled is not None:
         query = query.where(ContactRequest.is_handled == is_handled)
+        count_query = count_query.where(ContactRequest.is_handled == is_handled)
+    
+    query = query.order_by(ContactRequest.created_at.desc())
     
     offset = (page - 1) * page_size
     result = await db.execute(query.offset(offset).limit(page_size))
     items = result.scalars().all()
     
-    count_result = await db.execute(select(func.count(ContactRequest.id)))
-    total = count_result.scalar_one()
+    total = (await db.execute(count_query)).scalar_one()
     
     return {"items": items, "total": total}