新增 /profiles/me、/me/stats、/me/clouds 快捷路由，放开 stats 本人查看权限

app/routers/profiles.py

@@ -7,9 +7,16 @@ from sqlalchemy import func, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import joinedload
 
-from app.deps import AdminUser, CurrentUser, DbSession, OptionalUser
+from app.deps import CurrentUser, DbSession, OptionalUser
 from app.models import Cloud, Profile, User, UserCollection
-from app.schemas import CloudOut, PageOut, ProfileOut, ProfileStatsOut, ProfileUpdateIn, PublicProfileOut
+from app.schemas import (
+    CloudOut,
+    PageOut,
+    ProfileOut,
+    ProfileStatsOut,
+    ProfileUpdateIn,
+    PublicProfileOut,
+)
 from app.serializers import cloud_out, profile_out, public_profile_out
 from app.services.storage import delete_files, save_avatar
 
@@ -17,12 +24,14 @@ from app.services.storage import delete_files, save_avatar
 router = APIRouter(prefix="/profiles", tags=["用户资料"])
 
 
-@router.get("/{user_id}", response_model=PublicProfileOut)
-async def get_profile(user_id: uuid.UUID, db: DbSession) -> PublicProfileOut:
-    profile = await db.get(Profile, user_id)
-    if not profile:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
-    return public_profile_out(profile)
+# ---------------------------------------------------------------------------
+# /me 路由（必须定义在 /{user_id} 之前，避免 "me" 被当作 UUID 解析）
+# ---------------------------------------------------------------------------
+
+
+@router.get("/me", response_model=PublicProfileOut)
+async def get_my_profile(user: CurrentUser, db: DbSession) -> PublicProfileOut:
+    return public_profile_out(user.profile)
 
 
 @router.patch("/me", response_model=ProfileOut)
@@ -71,12 +80,64 @@ async def delete_avatar(
     return profile_out(user.profile)
 
 
+@router.get("/me/stats", response_model=ProfileStatsOut)
+async def get_my_stats(user: CurrentUser, db: DbSession) -> ProfileStatsOut:
+    return await _build_stats(user.id, db)
+
+
+@router.get("/me/clouds", response_model=PageOut[CloudOut])
+async def get_my_clouds(
+    user: CurrentUser,
+    db: DbSession,
+    page: int = Query(1, ge=1),
+    page_size: int = Query(50, ge=1, le=100),
+) -> PageOut[CloudOut]:
+    return await _list_profile_clouds(user.id, db, viewer_role=user.profile.role, viewer_id=user.id, page=page, page_size=page_size)
+
+
+# ---------------------------------------------------------------------------
+# /{user_id} 路由
+# ---------------------------------------------------------------------------
+
+
+@router.get("/{user_id}", response_model=PublicProfileOut)
+async def get_profile(user_id: uuid.UUID, db: DbSession) -> PublicProfileOut:
+    profile = await db.get(Profile, user_id)
+    if not profile:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
+    return public_profile_out(profile)
+
+
 @router.get("/{user_id}/stats", response_model=ProfileStatsOut)
 async def get_user_stats(
     user_id: uuid.UUID,
-    _: AdminUser,
+    viewer: CurrentUser,
     db: DbSession,
 ) -> ProfileStatsOut:
+    if viewer.id != user_id and viewer.profile.role != "admin":
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="只能查看自己的统计数据")
+    return await _build_stats(user_id, db)
+
+
+@router.get("/{user_id}/clouds", response_model=PageOut[CloudOut])
+async def get_profile_clouds(
+    user_id: uuid.UUID,
+    db: DbSession,
+    viewer: OptionalUser,
+    page: int = Query(1, ge=1),
+    page_size: int = Query(50, ge=1, le=100),
+) -> PageOut[CloudOut]:
+    viewer_role = viewer.profile.role if viewer else None
+    viewer_id = viewer.id if viewer else None
+    return await _list_profile_clouds(user_id, db, viewer_role=viewer_role, viewer_id=viewer_id, page=page, page_size=page_size)
+
+
+# ---------------------------------------------------------------------------
+# helpers
+# ---------------------------------------------------------------------------
+
+
+async def _build_stats(user_id: uuid.UUID, db: DbSession) -> ProfileStatsOut:
     result = await db.execute(
         select(User).options(joinedload(User.profile)).where(User.id == user_id)
     )
@@ -84,19 +145,28 @@ async def get_user_stats(
     if not user:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
 
-    cloud_count = await db.scalar(
-        select(func.count()).select_from(Cloud).where(Cloud.user_id == user_id)
-    ) or 0
-    public_cloud_count = await db.scalar(
-        select(func.count()).select_from(Cloud).where(
-            Cloud.user_id == user_id,
-            Cloud.status == "approved",
-            Cloud.is_hidden.is_(False),
+    cloud_count = (
+        await db.scalar(select(func.count()).select_from(Cloud).where(Cloud.user_id == user_id))
+        or 0
+    )
+    public_cloud_count = (
+        await db.scalar(
+            select(func.count())
+            .select_from(Cloud)
+            .where(
+                Cloud.user_id == user_id,
+                Cloud.status == "approved",
+                Cloud.is_hidden.is_(False),
+            )
         )
-    ) or 0
-    collection_count = await db.scalar(
-        select(func.count()).select_from(UserCollection).where(UserCollection.user_id == user_id)
-    ) or 0
+        or 0
+    )
+    collection_count = (
+        await db.scalar(
+            select(func.count()).select_from(UserCollection).where(UserCollection.user_id == user_id)
+        )
+        or 0
+    )
 
     return ProfileStatsOut(
         user_id=user.id,
@@ -109,18 +179,19 @@ async def get_user_stats(
     )
 
 
-@router.get("/{user_id}/clouds", response_model=PageOut[CloudOut])
-async def get_profile_clouds(
+async def _list_profile_clouds(
     user_id: uuid.UUID,
     db: DbSession,
-    viewer: OptionalUser,
-    page: int = Query(1, ge=1),
-    page_size: int = Query(50, ge=1, le=100),
+    *,
+    viewer_role: str | None,
+    viewer_id: uuid.UUID | None,
+    page: int,
+    page_size: int,
 ) -> PageOut[CloudOut]:
     if not await db.get(Profile, user_id):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="用户不存在")
 
-    can_manage = bool(viewer and (viewer.id == user_id or viewer.profile.role == "admin"))
+    can_manage = bool(viewer_id and (viewer_id == user_id or viewer_role == "admin"))
     filters = [Cloud.user_id == user_id]
     if not can_manage:
         filters.extend([Cloud.status == "approved", Cloud.is_hidden.is_(False)])