优化考勤记录

backend/services/attendance_service.py

@@ -41,16 +41,29 @@ class AttendanceService:
         reason: Optional[str],
         apply_deduction: bool,
         recorder_id: int,
-        custom_deduction: Optional[int] = None
+        custom_deduction: Optional[int] = None,
+        slot: str = 'morning'
     ) -> Dict[str, Any]:
         """添加考勤记录"""
+        # 校验时段
+        if slot not in ('morning', 'afternoon', 'evening'):
+            return {"success": False, "message": "无效的考勤时段"}
+        # 校验状态
+        if status not in ('present', 'absent', 'late', 'leave'):
+            return {"success": False, "message": "无效的考勤状态"}
+        # 校验自定义扣分范围
+        if custom_deduction is not None and (custom_deduction < 1 or custom_deduction > 20):
+            return {"success": False, "message": "自定义扣分必须在1-20之间"}
+        
         # 检查权限
         role = await PermissionChecker.get_user_role(recorder_id)
         if role not in ["班主任", "考勤委员"]:
             return {"success": False, "message": "无权进行此操作"}
         
-        # 检查是否同班级
-        # 单班级系统，管理员均可操作
+        # 考勤委员扣分上限
+        if role == "考勤委员" and apply_deduction and status in ["absent", "late"]:
+            if custom_deduction is not None and custom_deduction > settings.ATTENDANCE_REP_MAX_POINTS:
+                return {"success": False, "message": f"考勤委员单次扣分上限为{settings.ATTENDANCE_REP_MAX_POINTS}分"}
         
         # 添加考勤记录
         attendance_id = await AttendanceModel.create_record(
@@ -58,7 +71,8 @@ class AttendanceService:
             date=date,
             status=status,
             reason=reason,
-            recorder_id=recorder_id
+            recorder_id=recorder_id,
+            slot=slot
         )
         
         if not attendance_id:
@@ -107,7 +121,8 @@ class AttendanceService:
     async def get_records(
         user_id: int,
         date: Optional[str] = None,
-        student_id: Optional[int] = None
+        student_id: Optional[int] = None,
+        slot: Optional[str] = None
     ) -> Dict[str, Any]:
         """获取考勤记录"""
         role = await PermissionChecker.get_user_role(user_id)
@@ -115,7 +130,8 @@ class AttendanceService:
         if role in ["班主任", "考勤委员"]:
             records = await AttendanceModel.get_class_records(
                 date=date,
-                student_id=student_id
+                student_id=student_id,
+                slot=slot
             )
         elif student_id:
             # 管理员可查看指定学生

backend/services/conduct_service.py

@@ -33,12 +33,18 @@ class ConductService:
         recorder_id: int,
         recorder_name: str
     ) -> Dict[str, Any]:
-        """
-        批量加减分
-        """
+        """批量加减分"""
+        # 输入校验
+        if not student_ids or len(student_ids) > 200:
+            return {"success": False, "message": "学生数量需在1-200之间"}
+        if not reason or not reason.strip() or len(reason) > 255:
+            return {"success": False, "message": "原因不能为空且不超过255字符"}
+        
         # 验证分值
         if points_change == 0:
             return {"success": False, "message": "分值不能为0"}
+        if abs(points_change) > 100:
+            return {"success": False, "message": "单次加减分不能超过100分"}
         
         # 获取操作人角色
         role = await PermissionChecker.get_user_role(recorder_id)
@@ -119,6 +125,9 @@ class ConductService:
     @staticmethod
     async def revoke_record(record_id: int, revoker_id: int) -> Dict[str, Any]:
         """撤销扣分记录"""
+        if not record_id or record_id <= 0:
+            return {"success": False, "message": "无效的记录ID"}
+        
         # 检查权限
         can_revoke = await PermissionChecker.check_can_revoke(revoker_id, record_id)
         if not can_revoke:
@@ -155,6 +164,9 @@ class ConductService:
     @staticmethod
     async def restore_record(record_id: int, restorer_id: int) -> Dict[str, Any]:
         """反撤销（恢复）已撤销的记录"""
+        if not record_id or record_id <= 0:
+            return {"success": False, "message": "无效的记录ID"}
+        
         # 检查权限：只有班主任可以反撤销
         role = await PermissionChecker.get_user_role(restorer_id)
         if role != "班主任":
@@ -207,6 +219,8 @@ class ConductService:
             end_date = None
         if related_type == "":
             related_type = None
+        if related_type and related_type not in ('manual', 'homework', 'attendance'):
+            return {"records": [], "page": page, "page_size": page_size, "total": 0, "total_pages": 0}
         
         role = await PermissionChecker.get_user_role(user_id)
         offset = (page - 1) * page_size