feat(forum): 论坛功能增强 - Markdown、图片上传、无限嵌套回复

api/openapi.yaml

@@ -1571,7 +1571,7 @@ paths:
 
     delete:
       summary: 删除社团讨论区话题或回复
-      description: 删除话题（包括其所有回复）或删除回复。话题发布者或讨论区管理员可执行删除操作。删除操作会记录至审计日志。
+      description: 删除话题或回复。删除话题时级联删除其所有后代回复（包括嵌套回复）。删除回复时仅删除该回复及其所有子后代。话题发布者或讨论区管理员可执行删除操作。所有删除操作均记录至审计日志。
       operationId: deleteClubForumPost
       security:
         - bearerAuth: []
@@ -1590,7 +1590,7 @@ paths:
             minimum: 1
       responses:
         "204":
-          description: 删除成功
+          description: 删除成功（包括所有后代）
         "400":
           description: 请求参数不合法
           content:
@@ -1616,6 +1616,128 @@ paths:
               schema:
                 $ref: "#/components/schemas/ApiError"
 
+  /api/v1/clubs/{clubId}/forum-posts/upload-image:
+    post:
+      summary: 上传论坛图片到 OSS
+      operationId: uploadForumImage
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: clubId
+          in: path
+          required: true
+          schema:
+            type: integer
+            minimum: 1
+      requestBody:
+        required: true
+        content:
+          multipart/form-data:
+            schema:
+              type: object
+              properties:
+                image:
+                  type: string
+                  format: binary
+                  description: 图片文件，支持 jpg、png、gif、webp，文件大小 ≤ 5MB
+              required: [image]
+      responses:
+        "200":
+          description: 图片上传成功
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ForumImageUploadResponse"
+        "400":
+          description: 图片文件不合法（类型或大小超限）
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "401":
+          description: 登录状态缺失或无效
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "403":
+          description: 当前用户不是该社团的有效成员
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "404":
+          description: 社团不存在
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "413":
+          description: 文件过大，超出大小限制
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "500":
+          description: OSS 上传失败
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+
+  /api/v1/clubs/{clubId}/forum-posts/delete-image:
+    delete:
+      summary: 删除已上传的论坛图片
+      operationId: deleteForumImage
+      security:
+        - bearerAuth: []
+      parameters:
+        - name: clubId
+          in: path
+          required: true
+          schema:
+            type: integer
+            minimum: 1
+        - name: storageKey
+          in: query
+          required: true
+          schema:
+            type: string
+          description: 存储对象键，来自上传响应
+      responses:
+        "200":
+          description: 图片删除成功
+        "400":
+          description: storageKey 参数不能为空
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "401":
+          description: 登录状态缺失或无效
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "403":
+          description: 当前用户不是该社团的有效成员
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "404":
+          description: 社团不存在
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+        "500":
+          description: OSS 删除失败
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ApiError"
+
   /api/v1/clubs/{clubId}/award-rule-documents:
     get:
       summary: 查询评奖评优评定细则
@@ -7149,6 +7271,29 @@ components:
           example: published
       required: [isTop, postStatus]
 
+    ForumImageUploadResponse:
+      type: object
+      description: 论坛图片上传响应
+      properties:
+        imageUrl:
+          type: string
+          description: 上传后的图片 OSS URL，可直接在 Markdown 中使用。
+          example: https://clubhub-oss.aliyuncs.com/forum/2026/08/19/abc123.png
+        fileName:
+          type: string
+          description: 图片文件名。
+          example: abc123.png
+        storageKey:
+          type: string
+          description: 存储对象键，用于后续删除操作。
+          example: clubs/1/forum/2026/08/19/abc123def456.png
+        uploadedAt:
+          type: string
+          format: date-time
+          description: 上传时间。
+          example: 2026-08-19T10:30:00Z
+      required: [imageUrl, fileName, storageKey, uploadedAt]
+
     NoticeReadResult:
       type: object
       description: 通知已读记录结果；接口成功响应表示该用户已经完成已读标记。

backend.Tests/ForumPostsAuthorizationTests.cs

@@ -40,13 +40,13 @@ public async Task CreateTopic_NonMember_IsForbidden()
     }
 
     [Fact]
-    public async Task CreateReply_ToReply_IsRejected()
+    public async Task CreateReply_ToReply_IsAllowed()
     {
         var (client, clubId) = await SeedAsync(member: true, moderate: false);
         var topic = await PostAndReadId(client, clubId, "{\"title\":\"topic\",\"content\":\"body\"}");
         var reply = await PostAndReadId(client, clubId, $"{{\"parentPostId\":{topic},\"content\":\"reply\"}}");
         using var response = await client.PostAsync($"/api/v1/clubs/{clubId}/forum-posts", Json($"{{\"parentPostId\":{reply},\"content\":\"nested\"}}"));
-        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+        Assert.Equal(HttpStatusCode.Created, response.StatusCode);
     }
 
     [Fact]
@@ -143,6 +143,44 @@ public async Task DeleteTopic_DeletesRepliesAlso()
         Assert.Equal(0, afterDocument.RootElement.GetArrayLength());
     }
 
+    [Fact]
+    public async Task NestedReplies_UpToThreeLevels_CreateQueryAndCascadeDelete()
+    {
+        var (client, clubId) = await SeedAsync(member: true, moderate: false);
+
+        // Create topic -> reply level 1 -> reply level 2 -> reply level 3
+        var topic = await PostAndReadId(client, clubId, "{\"title\":\"topic\",\"content\":\"body\"}");
+        var level1Reply = await PostAndReadId(client, clubId, $"{{\"parentPostId\":{topic},\"content\":\"level1\"}}");
+        var level2Reply = await PostAndReadId(client, clubId, $"{{\"parentPostId\":{level1Reply},\"content\":\"level2\"}}");
+        var level3Reply = await PostAndReadId(client, clubId, $"{{\"parentPostId\":{level2Reply},\"content\":\"level3\"}}");
+
+        // Verify all created
+        Assert.NotEqual(0, level1Reply);
+        Assert.NotEqual(0, level2Reply);
+        Assert.NotEqual(0, level3Reply);
+
+        // Verify structure in GET
+        using var getResponse = await client.GetAsync($"/api/v1/clubs/{clubId}/forum-posts");
+        using var getDocument = System.Text.Json.JsonDocument.Parse(await getResponse.Content.ReadAsStringAsync());
+        var topicReply = getDocument.RootElement[0].GetProperty("replies")[0];
+        var level1Nested = topicReply.GetProperty("replies")[0];
+        var level2Nested = level1Nested.GetProperty("replies")[0];
+        Assert.Equal("level1", topicReply.GetProperty("content").GetString());
+        Assert.Equal("level2", level1Nested.GetProperty("content").GetString());
+        Assert.Equal("level3", level2Nested.GetProperty("content").GetString());
+
+        // Delete level 2 reply -> should cascade delete level 3
+        using var deleteLevel2 = await client.DeleteAsync($"/api/v1/clubs/{clubId}/forum-posts/{level2Reply}");
+        Assert.Equal(HttpStatusCode.NoContent, deleteLevel2.StatusCode);
+
+        // Verify level 2 and 3 deleted, but level 1 still exists
+        using var afterDeleteResponse = await client.GetAsync($"/api/v1/clubs/{clubId}/forum-posts");
+        using var afterDeleteDocument = System.Text.Json.JsonDocument.Parse(await afterDeleteResponse.Content.ReadAsStringAsync());
+        var topicReplyAfter = afterDeleteDocument.RootElement[0].GetProperty("replies")[0];
+        Assert.Equal("level1", topicReplyAfter.GetProperty("content").GetString());
+        Assert.Equal(0, topicReplyAfter.GetProperty("replies").GetArrayLength());
+    }
+
     [Fact]
     public async Task DeleteReply_ByOwner_Succeeds()
     {
@@ -224,4 +262,53 @@ private static async Task<int> PostAndReadId(HttpClient client, int clubId, stri
         using var document = System.Text.Json.JsonDocument.Parse(await response.Content.ReadAsStringAsync());
         return document.RootElement.GetProperty("id").GetInt32();
     }
+
+    [Fact]
+    public async Task UploadImage_ExceedsRequestSizeLimit_Returns413()
+    {
+        var (client, clubId) = await SeedAsync(member: true, moderate: false);
+
+        // Create a multipart request that exceeds 5 MB limit
+        using var content = new MultipartFormDataContent();
+        var oversizeData = new byte[6 * 1024 * 1024]; // 6 MB
+        content.Add(new ByteArrayContent(oversizeData), "image", "large.jpg");
+
+        using var response = await client.PostAsync($"/api/v1/clubs/{clubId}/forum-posts/upload-image", content);
+
+        // Should receive 413 Payload Too Large due to RequestSizeLimit
+        Assert.Equal(HttpStatusCode.RequestEntityTooLarge, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task DeleteImage_WithValidStorageKey_ReturnsServerError()
+    {
+        var (client, clubId) = await SeedAsync(member: true, moderate: false);
+        const string testStorageKey = "clubs/1/forum/2026/08/19/test.png";
+
+        using var response = await client.DeleteAsync($"/api/v1/clubs/{clubId}/forum-posts/delete-image?storageKey={Uri.EscapeDataString(testStorageKey)}");
+
+        // OSS not configured in tests, so deletion fails with 500; verifies endpoint exists and accepts storageKey
+        Assert.Equal(HttpStatusCode.InternalServerError, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task DeleteImage_WithoutStorageKey_ReturnsBadRequest()
+    {
+        var (client, clubId) = await SeedAsync(member: true, moderate: false);
+
+        using var response = await client.DeleteAsync($"/api/v1/clubs/{clubId}/forum-posts/delete-image");
+
+        Assert.Equal(HttpStatusCode.BadRequest, response.StatusCode);
+    }
+
+    [Fact]
+    public async Task DeleteImage_NonMember_IsForbidden()
+    {
+        var (client, clubId) = await SeedAsync(member: false, moderate: false);
+        const string testStorageKey = "clubs/1/forum/2026/08/19/test.png";
+
+        using var response = await client.DeleteAsync($"/api/v1/clubs/{clubId}/forum-posts/delete-image?storageKey={Uri.EscapeDataString(testStorageKey)}");
+
+        Assert.Equal(HttpStatusCode.Forbidden, response.StatusCode);
+    }
 }