From eb81ef8133543d6eef3843d12c378893496f1d1d Mon Sep 17 00:00:00 2001
From: xcbyy <2578898740@qq.com>
Date: Mon, 26 Oct 2026 10:49:10 +0800
Subject: [PATCH] =?UTF-8?q?fix(upload):=20=E4=B8=8A=E4=BC=A0=E4=B8=8E?=
 =?UTF-8?q?=E7=94=A8=E6=88=B7=E8=AE=BE=E7=BD=AE=E7=9B=AE=E5=BD=95=E6=94=B9?=
 =?UTF-8?q?=E4=B8=BA=E6=8C=81=E4=B9=85=E5=8C=96=E7=9B=AE=E5=BD=95=E5=B9=B6?=
 =?UTF-8?q?=E4=BF=9D=E7=95=99=E6=97=A7=E7=9B=AE=E5=BD=95=E5=9B=9E=E9=80=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 上传目录默认 process.cwd()/public/uploads，支持 UPLOAD_DIR 覆盖，避免代码部署覆盖用户上传文件

- 用户设置目录默认 process.cwd()/data，支持 DATA_DIR 覆盖，旧 data/user_settings.json 自动回退读取
---
 server/src/index.ts | 21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)

diff --git a/server/src/index.ts b/server/src/index.ts
index 1d57df2..743d92a 100644
--- a/server/src/index.ts
+++ b/server/src/index.ts
@@ -161,12 +161,20 @@ app.use(
   })
 );
 
-// 静态文件与对象存储目录配置
-const uploadDir = path.resolve(__dirname, '../public/uploads');
+// 静态文件与对象存储目录配置（优先持久化目录 process.cwd()/public/uploads，避免代码构建部署覆盖用户上传文件）
+const persistentUploadDir = process.env.UPLOAD_DIR
+  ? path.resolve(process.env.UPLOAD_DIR)
+  : path.resolve(process.cwd(), 'public/uploads');
+const fallbackUploadDir = path.resolve(__dirname, '../public/uploads');
+
+const uploadDir = persistentUploadDir;
 if (!fs.existsSync(uploadDir)) {
   fs.mkdirSync(uploadDir, { recursive: true });
 }
 app.use('/uploads', express.static(uploadDir));
+if (uploadDir !== fallbackUploadDir && fs.existsSync(fallbackUploadDir)) {
+  app.use('/uploads', express.static(fallbackUploadDir));
+}
 
 // Multer 文件上传引擎配置
 const storage = multer.diskStorage({
@@ -4226,7 +4234,9 @@ app.post('/api/users/:id/profile', async (req: Request, res: Response) => {
 
 // 7.2.1.b 用户隐私安全与通知订阅偏好持久化接口
 // 用户设置文件存放于对外不可见的私有目录，避免被 /uploads 静态服务公开读取
-const userSettingsDir = path.resolve(__dirname, '../data');
+const userSettingsDir = process.env.DATA_DIR
+  ? path.resolve(process.env.DATA_DIR)
+  : path.resolve(process.cwd(), 'data');
 if (!fs.existsSync(userSettingsDir)) {
   try {
     fs.mkdirSync(userSettingsDir, { recursive: true });
@@ -4235,12 +4245,17 @@ if (!fs.existsSync(userSettingsDir)) {
   }
 }
 const userSettingsFilePath = path.resolve(userSettingsDir, 'user_settings.json');
+const fallbackUserSettingsFilePath = path.resolve(__dirname, '../data/user_settings.json');
 function readAllUserSettings(): Record<string, { privacyHidePhone: boolean; noticeSubscribe: boolean; updatedAt: string }> {
   try {
     if (fs.existsSync(userSettingsFilePath)) {
       const raw = fs.readFileSync(userSettingsFilePath, 'utf-8');
       return JSON.parse(raw) || {};
     }
+    if (userSettingsFilePath !== fallbackUserSettingsFilePath && fs.existsSync(fallbackUserSettingsFilePath)) {
+      const raw = fs.readFileSync(fallbackUserSettingsFilePath, 'utf-8');
+      return JSON.parse(raw) || {};
+    }
   } catch (e) {
     logServerError('userSettings.read', e);
   }