perf: add rate limiting, validation, logging, and error handling

- Add express-rate-limit with tiered rate limits per endpoint
- Add express-validator for input validation on all API routes
- Add winston + morgan for structured logging
- Add node-cache for lottery result caching (5min TTL, 1000 max keys)
- Convert OCR to async task queue with max 2 concurrent jobs
- Add global error handler middleware
- Add React ErrorBoundary for client-side error handling
- Fix memory leaks in OCR task queue and lottery cache
- Add per-item error handling in batch ticket updates
- Fix SQL UPDATE to include user_id in WHERE clause

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/routes/auth.js

@@ -2,17 +2,16 @@ const express = require('express');
 const bcrypt = require('bcryptjs');
 const db = require('../db/init');
 const { generateToken } = require('../middleware/auth');
+const { authLimiter } = require('../middleware/rateLimiter');
+const { validate, registerRules, loginRules } = require('../middleware/validate');
+const logger = require('../services/logger');
 
 const router = express.Router();
 
 // 注册
-router.post('/register', (req, res) => {
+router.post('/register', authLimiter, registerRules, validate, (req, res) => {
   const { username, password } = req.body;
 
-  if (!username || !password) {
-    return res.status(400).json({ error: '用户名和密码不能为空' });
-  }
-
   try {
     const hashedPassword = bcrypt.hashSync(password, 10);
     const stmt = db.prepare('INSERT INTO users (username, password) VALUES (?, ?)');
@@ -21,31 +20,31 @@ router.post('/register', (req, res) => {
     const user = { id: result.lastInsertRowid, username };
     const token = generateToken(user);
 
+    logger.info(`用户注册成功: ${username}`);
     res.json({ user, token });
   } catch (err) {
     if (err.code === 'SQLITE_CONSTRAINT_UNIQUE') {
       return res.status(400).json({ error: '用户名已存在' });
     }
+    logger.error('注册失败', { error: err.message });
     res.status(500).json({ error: '注册失败' });
   }
 });
 
 // 登录
-router.post('/login', (req, res) => {
+router.post('/login', authLimiter, loginRules, validate, (req, res) => {
   const { username, password } = req.body;
 
-  if (!username || !password) {
-    return res.status(400).json({ error: '用户名和密码不能为空' });
-  }
-
   const stmt = db.prepare('SELECT * FROM users WHERE username = ?');
   const user = stmt.get(username);
 
   if (!user || !bcrypt.compareSync(password, user.password)) {
+    logger.warn(`登录失败: ${username}`);
     return res.status(401).json({ error: '用户名或密码错误' });
   }
 
   const token = generateToken(user);
+  logger.info(`用户登录成功: ${username}`);
   res.json({ user: { id: user.id, username: user.username }, token });
 });
 

server/routes/lottery.js

@@ -2,25 +2,23 @@ const express = require('express');
 const db = require('../db/init');
 const { authMiddleware } = require('../middleware/auth');
 const { fetchLotteryResult, updateTicketsStatus, getEstimatedDrawTime } = require('../services/lottery');
+const { refreshLimiter, standardLimiter } = require('../middleware/rateLimiter');
+const { validate, lotteryQueryRules } = require('../middleware/validate');
+const logger = require('../services/logger');
 
 const router = express.Router();
 
 router.use(authMiddleware);
 
 // 查询开奖结果
-router.get('/result', async (req, res) => {
+router.get('/result', lotteryQueryRules, validate, async (req, res) => {
   const { game, issue } = req.query;
 
-  if (!game || !issue) {
-    return res.status(400).json({ error: '请提供彩票类型和期号' });
-  }
-
   try {
     const result = await fetchLotteryResult(game, issue);
     if (result) {
       res.json(result);
     } else {
-      // 未开奖时返回预计开奖时间
       const estimatedTime = getEstimatedDrawTime(game, issue);
       res.json({
         message: '暂未开奖或未找到数据',
@@ -29,22 +27,25 @@ router.get('/result', async (req, res) => {
       });
     }
   } catch (err) {
+    logger.error('查询开奖结果失败', { game, issue, error: err.message });
     res.status(500).json({ error: '查询失败' });
   }
 });
 
 // 刷新用户所有待开奖彩票状态
-router.post('/refresh', async (req, res) => {
+router.post('/refresh', refreshLimiter, async (req, res) => {
   try {
     await updateTicketsStatus(req.user.id);
+    logger.info(`刷新开奖: userId=${req.user.id}`);
     res.json({ message: '刷新成功' });
   } catch (err) {
+    logger.error('刷新开奖失败', { error: err.message });
     res.status(500).json({ error: '刷新失败' });
   }
 });
 
 // 获取最近开奖记录
-router.get('/recent', async (req, res) => {
+router.get('/recent', standardLimiter, (req, res) => {
   const { game, limit = 10 } = req.query;
 
   let query = 'SELECT * FROM lottery_results';
@@ -58,8 +59,13 @@ router.get('/recent', async (req, res) => {
   query += ' ORDER BY draw_date DESC LIMIT ?';
   params.push(Number(limit));
 
-  const results = db.prepare(query).all(...params);
-  res.json(results.map(r => ({ ...r, numbers: JSON.parse(r.numbers) })));
+  try {
+    const results = db.prepare(query).all(...params);
+    res.json(results.map(r => ({ ...r, numbers: JSON.parse(r.numbers) })));
+  } catch (err) {
+    logger.error('获取最近开奖记录失败', { error: err.message });
+    res.status(500).json({ error: '查询失败' });
+  }
 });
 
 module.exports = router;

server/routes/ocr.js

@@ -3,7 +3,9 @@ const multer = require('multer');
 const path = require('path');
 const fs = require('fs');
 const { authMiddleware } = require('../middleware/auth');
-const { parseTicketImage } = require('../services/ocr');
+const { parseTicketImage, getOCRResult } = require('../services/ocr');
+const { ocrLimiter } = require('../middleware/rateLimiter');
+const logger = require('../services/logger');
 
 const router = express.Router();
 
@@ -25,7 +27,6 @@ const upload = multer({
   storage,
   limits: { fileSize: 10 * 1024 * 1024 },
   fileFilter: (req, file, cb) => {
-    // 放宽图片类型限制
     if (file.mimetype.startsWith('image/')) {
       cb(null, true);
     } else {
@@ -36,18 +37,49 @@ const upload = multer({
 
 router.use(authMiddleware);
 
-// 上传并解析彩票图片
-router.post('/parse', upload.single('image'), async (req, res) => {
+// 上传并解析彩票图片 (改为异步)
+router.post('/parse', ocrLimiter, upload.single('image'), (req, res) => {
   if (!req.file) {
     return res.status(400).json({ error: '请上传图片' });
   }
 
   try {
-    const result = await parseTicketImage(req.file.path);
-    result.image_path = `/uploads/${req.file.filename}`;
-    res.json(result);
+    const { taskId } = parseTicketImage(req.file.path);
+    logger.info(`OCR任务已提交: ${taskId}`);
+    res.json({ taskId, status: 'processing', message: '图片已提交处理，请稍后查询结果' });
   } catch (err) {
-    res.status(500).json({ error: err.message || '解析失败' });
+    logger.error('OCR提交失败', { error: err.message });
+    res.status(500).json({ error: err.message || '提交失败' });
+  }
+});
+
+// 查询OCR结果
+router.get('/result/:taskId', (req, res) => {
+  const { taskId } = req.params;
+
+  if (!taskId || !taskId.startsWith('ocr_')) {
+    return res.status(400).json({ error: '无效的任务ID' });
+  }
+
+  try {
+    const result = getOCRResult(taskId);
+
+    if (result.completed) {
+      if (result.success) {
+        res.json({
+          status: 'completed',
+          ...result.data
+          // image_path 在提交时由客户端记录，此处无需返回
+        });
+      } else {
+        res.status(500).json({ status: 'failed', error: result.error });
+      }
+    } else {
+      res.json({ status: result.processing ? 'processing' : 'pending', taskId });
+    }
+  } catch (err) {
+    logger.error('OCR结果查询失败', { taskId, error: err.message });
+    res.status(500).json({ error: '查询失败' });
   }
 });
 

server/routes/tickets.js

@@ -2,6 +2,8 @@ const express = require('express');
 const db = require('../db/init');
 const { authMiddleware } = require('../middleware/auth');
 const { getEstimatedDrawTime } = require('../services/lottery');
+const { validate, ticketCreateRules, ticketUpdateRules, idParamRule } = require('../middleware/validate');
+const logger = require('../services/logger');
 
 const router = express.Router();
 
@@ -16,7 +18,6 @@ router.get('/', (req, res) => {
     SELECT * FROM tickets WHERE user_id = ? ORDER BY created_at DESC LIMIT ? OFFSET ?
   `).all(req.user.id, limit, offset);
 
-  // 为未开奖彩票添加预计开奖时间
   const ticketsWithDrawTime = tickets.map(ticket => {
     if (ticket.status === 'pending' && ticket.game && ticket.issue) {
       return {
@@ -57,13 +58,9 @@ router.get('/stats', (req, res) => {
 });
 
 // 添加彩票
-router.post('/', (req, res) => {
+router.post('/', ticketCreateRules, validate, (req, res) => {
   const { type, game, issue, numbers, bet_count, multiple, is_additional, cost, image_path } = req.body;
 
-  if (!type || !game || !cost) {
-    return res.status(400).json({ error: '缺少必要字段' });
-  }
-
   const stmt = db.prepare(`
     INSERT INTO tickets (user_id, type, game, issue, numbers, bet_count, multiple, is_additional, cost, image_path)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
@@ -75,11 +72,12 @@ router.post('/', (req, res) => {
     bet_count || 1, multiple || 1, is_additional ? 1 : 0, cost, image_path || null
   );
 
+  logger.info(`添加彩票: userId=${req.user.id}, game=${game}, cost=${cost}`);
   res.json({ id: result.lastInsertRowid, message: '添加成功' });
 });
 
 // 更新彩票
-router.put('/:id', (req, res) => {
+router.put('/:id', idParamRule, validate, (req, res) => {
   const { id } = req.params;
   const { type, game, issue, numbers, bet_count, multiple, is_additional, cost, prize, status } = req.body;
 
@@ -90,7 +88,7 @@ router.put('/:id', (req, res) => {
 
   const stmt = db.prepare(`
     UPDATE tickets SET type = ?, game = ?, issue = ?, numbers = ?, bet_count = ?, multiple = ?, is_additional = ?, cost = ?, prize = ?, status = ?
-    WHERE id = ?
+    WHERE id = ? AND user_id = ?
   `);
   stmt.run(
     type ?? ticket.type,
@@ -103,35 +101,31 @@ router.put('/:id', (req, res) => {
     cost ?? ticket.cost,
     prize ?? ticket.prize,
     status ?? ticket.status,
-    id
+    id,
+    req.user.id
   );
 
+  logger.info(`更新彩票: id=${id}`);
   res.json({ message: '更新成功' });
 });
 
 // 删除彩票
-router.delete('/:id', (req, res) => {
+router.delete('/:id', idParamRule, validate, (req, res) => {
   const { id } = req.params;
-  const ticketId = Number(id);
-
-  console.log('删除请求:', { id, ticketId, userId: req.user.id });
-
-  if (isNaN(ticketId)) {
-    return res.status(400).json({ error: '无效的ID' });
-  }
+  const ticketId = Number(id); // idParamRule 已验证 id 为正整数
 
   try {
     const result = db.prepare('DELETE FROM tickets WHERE id = ? AND user_id = ?').run(ticketId, req.user.id);
-    console.log('删除结果:', result);
 
     if (result.changes === 0) {
       return res.status(404).json({ error: '彩票不存在' });
     }
 
+    logger.info(`删除彩票: id=${ticketId}`);
     res.json({ message: '删除成功' });
   } catch (err) {
-    console.error('删除错误:', err);
-    res.status(500).json({ error: '删除失败: ' + err.message });
+    logger.error('删除彩票失败', { error: err.message });
+    res.status(500).json({ error: '删除失败' });
   }
 });