feat: poll/voting system with live results and bar charts

backend/db.js

@@ -179,6 +179,27 @@ async function initSchema(connection) {
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP
   ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`);
 
+  await createIfNotExists('polls', `CREATE TABLE polls (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    title VARCHAR(200) NOT NULL,
+    description TEXT,
+    options JSON NOT NULL,
+    active TINYINT(1) NOT NULL DEFAULT 1,
+    created_by INT,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    INDEX idx_active (active)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`);
+
+  await createIfNotExists('poll_votes', `CREATE TABLE poll_votes (
+    id INT AUTO_INCREMENT PRIMARY KEY,
+    poll_id INT NOT NULL,
+    user_id INT NOT NULL,
+    option_index INT NOT NULL,
+    created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+    UNIQUE KEY uk_poll_user (poll_id, user_id),
+    INDEX idx_poll (poll_id)
+  ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4`);
+
   await createIfNotExists('audit_logs', `CREATE TABLE audit_logs (
     id INT AUTO_INCREMENT PRIMARY KEY,
     user_id INT,

backend/routes/polls.js

@@ -0,0 +1,65 @@
+const express = require('express');
+const { query, getRow } = require('../db');
+const { authenticate, requireRole } = require('../middleware/auth');
+
+const router = express.Router();
+
+router.get('/', authenticate, async (req, res) => {
+  const polls = await query('SELECT id, title, description, active, created_at FROM polls ORDER BY created_at DESC');
+  res.json(polls);
+});
+
+router.get('/active', authenticate, async (req, res) => {
+  const polls = await query('SELECT id, title, description, active, created_at FROM polls WHERE active = 1 ORDER BY created_at DESC');
+  for (const p of polls) {
+    p.options = JSON.parse(p.options || '[]');
+    const rows = await query('SELECT option_index, COUNT(*) as count FROM poll_votes WHERE poll_id = ? GROUP BY option_index', [p.id]);
+    p.votes = {};
+    let total = 0;
+    for (const r of rows) { p.votes[r.option_index] = r.count; total += r.count; }
+    p.total = total;
+    const myVote = await getRow('SELECT option_index FROM poll_votes WHERE poll_id = ? AND user_id = ?', [p.id, req.user.id]);
+    p.my_vote = myVote ? myVote.option_index : null;
+  }
+  res.json(polls);
+});
+
+router.post('/', authenticate, requireRole('owner'), async (req, res) => {
+  const { title, description, options } = req.body;
+  if (!title || !options || !Array.isArray(options) || options.length < 2) return res.status(400).json({ error: '标题和至少2个选项为必填' });
+  const r = await query('INSERT INTO polls(title, description, options, created_by) VALUES (?,?,?,?)', [title, description||'', JSON.stringify(options), req.user.id]);
+  res.status(201).json({ id: r.insertId, message: '创建成功' });
+});
+
+router.put('/:id', authenticate, requireRole('owner'), async (req, res) => {
+  const p = await getRow('SELECT * FROM polls WHERE id = ?', [req.params.id]);
+  if (!p) return res.status(404).json({ error: '投票不存在' });
+  const fields = {};
+  if (req.body.title) fields.title = req.body.title;
+  if (req.body.description !== undefined) fields.description = req.body.description;
+  if (req.body.active !== undefined) fields.active = req.body.active ? 1 : 0;
+  if (req.body.options) fields.options = JSON.stringify(req.body.options);
+  if (!Object.keys(fields).length) return res.status(400).json({ error: '无更新内容' });
+  const sets = Object.keys(fields).map(k => `${k} = ?`).join(', ');
+  await query(`UPDATE polls SET ${sets} WHERE id = ?`, [...Object.values(fields), req.params.id]);
+  res.json({ message: '更新成功' });
+});
+
+router.delete('/:id', authenticate, requireRole('owner'), async (req, res) => {
+  await query('DELETE FROM poll_votes WHERE poll_id = ?', [req.params.id]);
+  await query('DELETE FROM polls WHERE id = ?', [req.params.id]);
+  res.json({ message: '已删除' });
+});
+
+router.post('/:id/vote', authenticate, async (req, res) => {
+  const p = await getRow('SELECT * FROM polls WHERE id = ? AND active = 1', [req.params.id]);
+  if (!p) return res.status(404).json({ error: '投票不存在或已关闭' });
+  const { option_index } = req.body;
+  if (option_index === undefined || option_index === null) return res.status(400).json({ error: '请选择选项' });
+  const opts = JSON.parse(p.options || '[]');
+  if (option_index < 0 || option_index >= opts.length) return res.status(400).json({ error: '无效选项' });
+  await query('INSERT INTO poll_votes(poll_id, user_id, option_index) VALUES (?,?,?) ON DUPLICATE KEY UPDATE option_index = VALUES(option_index)', [req.params.id, req.user.id, option_index]);
+  res.json({ message: '投票成功' });
+});
+
+module.exports = router;

backend/server.js

@@ -104,6 +104,7 @@ if (isInstalled()) {
   app.use('/api/export', methodGuard(['GET']), generalLimiter, require('./routes/export'));
   app.use('/api/uploads', methodGuard(['GET']), generalLimiter, require('./routes/uploads'));
   app.use('/api/notifications', methodGuard(['GET','POST','PUT','DELETE']), generalLimiter, require('./routes/notifications'));
+  app.use('/api/polls', methodGuard(['GET','POST','PUT','DELETE']), generalLimiter, require('./routes/polls'));
   app.use('/api/external', require('./routes/external'));
 
   app.get('/api/verify', (req, res) => res.redirect(`/#/verify?token=${req.query.token}`));