MongoDB: 综合项目：电商评论系统（6 模块）

shophub-reviews/
├── package.json
├── .env
├── .env.example
├── src/
│   ├── app.js              # Express 应用
│   ├── config/
│   │   └── db.js          # mongoose 连接
│   ├── models/            # 数据模型
│   │   ├── User.js
│   │   ├── Product.js
│   │   └── Review.js
│   ├── controllers/       # 业务逻辑
│   │   ├── authController.js
│   │   ├── productController.js
│   │   └── reviewController.js
│   ├── routes/            # 路由
│   │   ├── auth.js
│   │   ├── products.js
│   │   └── reviews.js
│   ├── middlewares/       # 中间件
│   │   ├── auth.js        # JWT 认证
│   │   ├── errorHandler.js
│   │   └── validate.js
│   ├── validators/        # 请求体验证
│   │   └── schemas.js
│   └── utils/             # 工具
│       ├── logger.js
│       └── jwt.js
└── README.md

{
  "name": "shophub-reviews",
  "version": "1.0.0",
  "scripts": {
    "start": "node src/app.js",
    "dev": "nodemon src/app.js",
    "test": "jest --watch"
  },
  "dependencies": {
    "express": "^4.19.2",
    "mongoose": "^7.6.0",
    "jsonwebtoken": "^9.0.0",
    "bcrypt": "^5.1.0",
    "joi": "^17.13.0",
    "dotenv": "^16.4.0",
    "cors": "^2.8.5"
  },
  "devDependencies": {
    "nodemon": "^3.1.0",
    "jest": "^29.7.0"
  }
}

NODE_ENV=development
PORT=3000
MONGODB_URI=mongodb://localhost:27017/shophub
JWT_SECRET=your-super-secret-key-change-in-prod
JWT_EXPIRES_IN=7d

// models/User.js
const mongoose = require('mongoose');
const bcrypt = require('bcrypt');

const UserSchema = new mongoose.Schema({
  email: {
    type: String,
    required: [true, 'Email is required'],
    unique: true,
    lowercase: true,
    trim: true,
    match: [/^\S+@\S+\.\S+$/, 'Invalid email format']
  },
  username: {
    type: String,
    required: true,
    unique: true,
    minlength: 3,
    maxlength: 30,
    match: [/^[a-zA-Z0-9_]+$/, 'Alphanumeric + underscore only']
  },
  passwordHash: {
    type: String,
    required: true,
    minlength: 60,  // bcrypt hash 长度
    select: false
  },
  role: {
    type: String,
    enum: ['customer', 'admin', 'moderator'],
    default: 'customer'
  },
  isActive: { type: Boolean, default: true }
}, { timestamps: true });

// 密码哈希中间件
UserSchema.pre('save', async function(next) {
  if (!this.isModified('passwordHash')) return next();
  this.passwordHash = await bcrypt.hash(this.passwordHash, 10);
  next();
});

// 验证密码
UserSchema.methods.comparePassword = function(candidate) {
  return bcrypt.compare(candidate, this.passwordHash);
};

module.exports = mongoose.model('User', UserSchema);

// models/Product.js
const ProductSchema = new mongoose.Schema({
  sku: { type: String, required: true, unique: true, index: true },
  title: { type: String, required: true, maxlength: 200 },
  description: { type: String, maxlength: 5000 },
  price: { type: mongoose.Schema.Types.Decimal128, required: true, min: 0 },
  category: { type: String, enum: ['Electronics', 'Books', 'Clothing', 'Home'], index: true },
  stock: { type: Number, default: 0, min: 0 },
  rating: { type: Number, default: 0, min: 0, max: 5 },
  reviewCount: { type: Number, default: 0 },
  isActive: { type: Boolean, default: true, index: true }
}, { timestamps: true });

ProductSchema.index({ category: 1, price: -1 });
ProductSchema.index({ title: 'text', description: 'text' });

module.exports = mongoose.model('Product', ProductSchema);

// models/Review.js
const ReviewSchema = new mongoose.Schema({
  productId: { type: mongoose.Schema.Types.ObjectId, ref: 'Product', required: true, index: true },
  userId: { type: mongoose.Schema.Types.ObjectId, ref: 'User', required: true },
  content: { type: String, required: true, maxlength: 1000 },
  rating: { type: Number, required: true, min: 1, max: 5 },
  parentId: { type: mongoose.Schema.Types.ObjectId, ref: 'Review', default: null, index: true },
  likes: [{ type: mongoose.Schema.Types.ObjectId, ref: 'User' }],
  likeCount: { type: Number, default: 0 },
  isApproved: { type: Boolean, default: true },
  isDeleted: { type: Boolean, default: false }
}, { timestamps: true });

ReviewSchema.index({ productId: 1, createdAt: -1 });
ReviewSchema.pre(/^find/, function(next) {
  this.where({ isDeleted: { $ne: true } });
  next();
});

module.exports = mongoose.model('Review', ReviewSchema);

**嵌套评论查询策略**：

```mermaid
sequenceDiagram
    participant Client
    participant API as /products/:id/reviews
    participant DB as MongoDB

    Client->>API: GET /products/123/reviews
    API->>DB: 查询顶层评论 (parentId=null)
    DB-->>API: 返回 [R1, R2, R3]
    API->>DB: 查询所有回复 (parentId in [R1,R2,R3]._id)
    DB-->>API: 返回 [R1.1, R1.2, R2.1]
    API->>API: 组装树形结构<br/>R1.replies=[R1.1, R1.2]<br/>R2.replies=[R2.1]
    API-->>Client: 返回树形数据

// controllers/reviewController.js
exports.createReview = async (req, res) => {
  const { productId } = req.params;
  const { content, rating, parentId } = req.body;

  // 验证商品存在
  const product = await Product.findById(productId);
  if (!product) return res.status(404).json({ error: 'Product not found' });

  // 如果是回复，验证父评论存在
  if (parentId) {
    const parent = await Review.findById(parentId);
    if (!parent) return res.status(404).json({ error: 'Parent review not found' });
  }

  const review = await Review.create({
    productId,
    userId: req.user._id,
    content,
    rating,
    parentId: parentId || null
  });

  // 更新商品评分统计
  await updateProductRating(productId);

  await review.populate('userId', 'username avatar');
  res.status(201).json(review);
};

exports.listReviews = async (req, res) => {
  const { productId } = req.params;
  const { sort = 'createdAt', order = 'desc', limit = 20, page = 1 } = req.query;

  // 查询顶层评论
  const reviews = await Review.find({
    productId,
    parentId: null
  })
    .populate('userId', 'username avatar')
    .sort({ [sort]: order === 'desc' ? -1 : 1 })
    .limit(limit * 1)
    .skip((page - 1) * limit)
    .lean();

  // 查询所有回复
  const reviewIds = reviews.map(r => r._id);
  const replies = await Review.find({
    parentId: { $in: reviewIds }
  })
    .populate('userId', 'username avatar')
    .sort({ createdAt: 1 })
    .lean();

  // 组装树形结构
  const tree = reviews.map(parent => ({
    ...parent,
    replies: replies.filter(r => r.parentId.toString() === parent._id.toString())
  }));

  res.json({ data: tree, page, limit });
};

exports.likeReview = async (req, res) => {
  const { reviewId } = req.params;
  const userId = req.user._id;

  const review = await Review.findById(reviewId);
  if (!review) return res.status(404).json({ error: 'Review not found' });

  const alreadyLiked = review.likes.some(id => id.toString() === userId.toString());

  if (alreadyLiked) {
    await Review.updateOne(
      { _id: reviewId },
      { $pull: { likes: userId }, $inc: { likeCount: -1 } }
    );
    return res.json({ liked: false });
  } else {
    await Review.updateOne(
      { _id: reviewId },
      { $addToSet: { likes: userId }, $inc: { likeCount: 1 } }
    );
    return res.json({ liked: true });
  }
};

**聚合管道设计模式**：

| 统计需求 | 聚合阶段 | 输出 |
|:---------|:---------|:-----|
| 评分分布 | $match → $bucket | [{_id: 5, count: 120}, ...] |
| 商品统计 | $match → $facet | {total, avgRating, distribution, recent} |
| 热门商品 | $match → $group → $sort → $lookup → $limit | [{productId, avgRating, reviewCount}] |

**$facet 的价值**：$facet 允许在同一输入上并行执行多个聚合管道——一次查询返回 total、avgRating、ratingDistribution、recentReviews 四个维度。如果没有 $facet，需要 4 次独立查询。

```mermaid
graph TB
    Input[评论数据流] --> Facet["$facet<br/>多管道并行"]
    
    Facet --> P1["管道1: $count<br/>总数"]
    Facet --> P2["管道2: $group<br/>平均评分"]
    Facet --> P3["管道3: $group + $sort<br/>评分分布"]
    Facet --> P4["管道4: $sort + $limit + $lookup<br/>近期评论(含用户信息)"]
    
    P1 --> Output[合并输出<br/>{total, avg, distribution, recent}]
    P2 --> Output
    P3 --> Output
    P4 --> Output

    style Facet fill:#d4edda
    style Output fill:#cce5ff

exports.getRatingDistribution = async (req, res) => {
  const { productId } = req.params;

  const distribution = await Review.aggregate([
    { $match: { productId: new mongoose.Types.ObjectId(productId), parentId: null } },
    {
      $bucket: {
        groupBy: '$rating',
        boundaries: [1, 2, 3, 4, 5, 6],
        default: 'Other',
        output: {
          count: { $sum: 1 },
          avgHelpful: { $avg: '$likeCount' }
        }
      }
    }
  ]);

  res.json({ data: distribution });
};

exports.getProductStats = async (req, res) => {
  const { productId } = req.params;

  const stats = await Review.aggregate([
    { $match: { productId: new mongoose.Types.ObjectId(productId), parentId: null } },
    {
      $facet: {
        total: [{ $count: 'count' }],
        avgRating: [{ $group: { _id: null, avg: { $avg: '$rating' } } }],
        ratingDistribution: [
          { $group: { _id: '$rating', count: { $sum: 1 } } },
          { $sort: { _id: 1 } }
        ],
        recentReviews: [
          { $sort: { createdAt: -1 } },
          { $limit: 5 },
          {
            $lookup: {
              from: 'users',
              localField: 'userId',
              foreignField: '_id',
              as: 'userInfo'
            }
          },
          { $unwind: '$userInfo' },
          {
            $project: {
              content: 1,
              rating: 1,
              createdAt: 1,
              username: '$userInfo.username',
              avatar: '$userInfo.avatar'
            }
          }
        ]
      }
    }
  ]);

  res.json(stats[0]);
};

exports.getTopProducts = async (req, res) => {
  const { limit = 10 } = req.query;

  const topProducts = await Review.aggregate([
    { $match: { parentId: null, isApproved: true } },
    {
      $group: {
        _id: '$productId',
        avgRating: { $avg: '$rating' },
        reviewCount: { $sum: 1 },
        totalLikes: { $sum: '$likeCount' }
      }
    },
    { $sort: { avgRating: -1, reviewCount: -1 } },
    { $limit: limit * 1 },
    {
      $lookup: {
        from: 'products',
        localField: '_id',
        foreignField: '_id',
        as: 'product'
      }
    },
    { $unwind: '$product' },
    {
      $project: {
        sku: '$product.sku',
        title: '$product.title',
        thumbnail: '$product.thumbnail',
        avgRating: 1,
        reviewCount: 1
      }
    }
  ]);

  res.json({ data: topProducts });
};

**JWT 认证 vs Session 认证**：

| 维度 | JWT | Session |
|:-----|:----|:--------|
| 存储位置 | 客户端（Token） | 服务端（内存/Redis） |
| 扩展性 | 无状态，天然支持分布式 | 需共享 Session 存储 |
| 安全性 | Token 泄露无法即时撤销 | 可即时销毁 Session |
| 性能 | 无服务端查询开销 | 每次查 Session 存储 |
| 过期管理 | exp 声明，无法主动续期 | 可滑动续期 |
| 适用场景 | API / 微服务 | 传统 Web 应用 |

**RBAC 权限模型**：Role-Based Access Control 基于角色分配权限——用户拥有角色，角色拥有权限。本系统三个角色：

| 角色 | 权限 | 操作范围 |
|:-----|:-----|:---------|
| customer | 评论、点赞、编辑自己的评论 | /reviews（自己的） |
| moderator | 审核/删除任意评论 | /reviews（所有） + 审核后台 |
| admin | 管理商品、用户、所有评论 | /products + /users + /reviews（所有） |

**注入防护要点**：MongoDB 注入风险主要来自 $where（执行任意 JS）和无锚定 $regex（DoS 攻击）。防护原则：① 永远用参数化查询而非字符串拼接；② mongoose 自动转义查询值；③ $regex 需转义特殊字符。

```mermaid
sequenceDiagram
    participant Client
    participant Auth as authenticate 中间件
    participant Authorize as authorize 中间件
    participant Controller
    participant DB

    Client->>Auth: 请求 + Bearer Token
    Auth->>Auth: jwt.verify(token, secret)
    alt Token 无效
        Auth-->>Client: 401 Unauthorized
    else Token 有效
        Auth->>Authorize: req.user = {id, role}
        Authorize->>Authorize: roles.includes(req.user.role)?
        alt 无权限
            Authorize-->>Client: 403 Forbidden
        else 有权限
            Authorize->>Controller: 执行业务逻辑
            Controller->>DB: 参数化查询
            DB-->>Client: 200 OK
        end
    end

// middlewares/auth.js
const jwt = require('jsonwebtoken');

exports.authenticate = (req, res, next) => {
  const token = req.header('Authorization')?.replace('Bearer ', '');
  if (!token) return res.status(401).json({ error: 'No token' });

  try {
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded;
    next();
  } catch (err) {
    res.status(401).json({ error: 'Invalid token' });
  }
};

exports.authorize = (...roles) => (req, res, next) => {
  if (!req.user || !roles.includes(req.user.role)) {
    return res.status(403).json({ error: 'Forbidden' });
  }
  next();
};

// controllers/authController.js
const User = require('../models/User');
const jwt = require('jsonwebtoken');

exports.register = async (req, res) => {
  const { email, username, password } = req.body;

  const existing = await User.findOne({ $or: [{ email }, { username }] });
  if (existing) return res.status(409).json({ error: 'Email or username already exists' });

  const user = await User.create({
    email,
    username,
    passwordHash: password  // pre-save 中间件会哈希
  });

  const token = jwt.sign(
    { id: user._id, role: user.role },
    process.env.JWT_SECRET,
    { expiresIn: '7d' }
  );

  res.status(201).json({ user: { id: user._id, email: user.email, username: user.username }, token });
};

exports.login = async (req, res) => {
  const { email, password } = req.body;

  const user = await User.findOne({ email }).select('+passwordHash');
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });

  const valid = await user.comparePassword(password);
  if (!valid) return res.status(401).json({ error: 'Invalid credentials' });

  const token = jwt.sign(
    { id: user._id, role: user.role },
    process.env.JWT_SECRET,
    { expiresIn: '7d' }
  );

  res.json({ user: { id: user._id, email: user.email, username: user.username, role: user.role }, token });
};

// ❌ 危险：$where 执行任意 JS
db.reviews.find({ $where: 'this.userId == "' + userId + '"' });

// ✅ 安全：使用参数化查询
db.reviews.find({ userId: new ObjectId(userId) });

// ✅ mongoose 自动转义
const reviews = await Review.find({ userId: userId });

// ❌ 危险：$regex DoS
db.reviews.find({ content: { $regex: req.query.q } });

// ✅ 安全：转义正则特殊字符
function escapeRegex(str) {
  return str.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
}
db.reviews.find({ content: { $regex: escapeRegex(req.query.q), $options: 'i' } });

**部署架构**：

```mermaid
graph LR
    Client[用户浏览器] -->|HTTPS| CDN[CDN / 静态资源]
    Client -->|HTTPS| LB[Load Balancer]
    LB -->|HTTP| App1[Render Instance 1<br/>Express App]
    LB -->|HTTP| App2[Render Instance 2<br/>Express App]
    App1 -->|TLS + SRV| Atlas[MongoDB Atlas<br/>3 节点副本集]
    App2 -->|TLS + SRV| Atlas
    Atlas -->| PITR | Backup[自动备份<br/>7天保留]

    style Atlas fill:#d4edda
    style App1 fill:#cce5ff

# 1. 创建 Atlas 集群（参考课程 #01）
# 2. 配置 IP 白名单：0.0.0.0/0（开发）或应用服务器 IP
# 3. 创建数据库用户：app_user / <password>
# 4. 获取连接字符串：
mongodb+srv://app_user:<password>@cluster0.mongodb.net/shophub?retryWrites=true&w=majority

# .env.production
NODE_ENV=production
PORT=3000
MONGODB_URI=mongodb+srv://app_user:StrongPass@cluster0.mongodb.net/shophub?retryWrites=true&w=majority
JWT_SECRET=<generated-strong-secret-256-bit>
JWT_EXPIRES_IN=7d
CORS_ORIGIN=https://shophub.example.com

app.get('/healthz', async (req, res) => {
  try {
    const db = mongoose.connection.db;
    await db.admin().command({ ping: 1 });
    res.json({
      status: 'ok',
      uptime: process.uptime(),
      mongo: 'connected',
      timestamp: new Date().toISOString()
    });
  } catch (err) {
    res.status(503).json({ status: 'error', error: err.message });
  }
});

# === Render 部署 ===
# 1. 连接 GitHub 仓库
# 2. 设置环境变量（MONGODB_URI, JWT_SECRET 等）
# 3. 设置构建命令：npm install
# 4. 设置启动命令：npm start
# 5. 自动 HTTPS + 部署

# === Railway 部署 ===
railway login
railway init
railway add mongodb  # 一键添加 MongoDB
railway up

// === src/app.js 优化版 ===
const mongoose = require('mongoose');

mongoose.connect(process.env.MONGODB_URI, {
  maxPoolSize: 50,
  minPoolSize: 5,
  serverSelectionTimeoutMS: 5000
});

app.use(express.json({ limit: '1mb' }));
app.use(cors({
  origin: process.env.CORS_ORIGIN || '*',
  credentials: true
}));

# === 启动项目 ===
npm install
npm start

# === API 调用示例 ===

# 1. 注册用户
curl -X POST http://localhost:3000/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"alice@example.com","username":"alice","password":"Pass123!"}'

# 2. 登录
curl -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"alice@example.com","password":"Pass123!"}'

# 3. 创建评论
curl -X POST http://localhost:3000/api/products/<productId>/reviews \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"content":"Great product!","rating":5}'

# 4. 查看商品统计
curl http://localhost:3000/api/products/<productId>/stats

# 5. 健康检查
curl http://localhost:3000/healthz

// === 场景：Alice 评论商品，Bob 回复 Alice，Charlie 点赞 ===

// 1. Alice 发表 5 星评论
const aliceReview = await Review.create({
  productId: '647f1f77bcf86cd799439011',
  userId: aliceId,
  content: 'Excellent smartphone! The camera quality is outstanding.',
  rating: 5,
  parentId: null  // 顶层评论
});
// 返回: { _id: 'review001', content: '...', rating: 5, likeCount: 0 }

// 2. Bob 回复 Alice
const bobReply = await Review.create({
  productId: '647f1f77bcf86cd799439011',
  userId: bobId,
  content: 'I agree, the camera is amazing!',
  rating: 5,
  parentId: aliceReview._id  // 引用父评论
});
// 返回: { _id: 'review002', parentId: 'review001', content: '...' }

// 3. Charlie 点赞 Alice 的评论
await Review.updateOne(
  { _id: aliceReview._id },
  { $addToSet: { likes: charlieId }, $inc: { likeCount: 1 } }
);
// Alice 的评论: { likeCount: 1, likes: [charlieId] }

// 4. 再次点赞 → 取消
await Review.updateOne(
  { _id: aliceReview._id },
  { $pull: { likes: charlieId }, $inc: { likeCount: -1 } }
);
// Alice 的评论: { likeCount: 0, likes: [] }

// 5. 查询嵌套评论树
const reviews = await Review.find({ productId: '647f...', parentId: null })
  .populate('userId', 'username avatar')
  .lean();
const replies = await Review.find({ parentId: { $in: reviews.map(r => r._id) } })
  .populate('userId', 'username avatar')
  .lean();
const tree = reviews.map(r => ({
  ...r,
  replies: replies.filter(rep => rep.parentId.toString() === r._id.toString())
}));

console.log(JSON.stringify(tree, null, 2));
// [{
//   content: 'Excellent smartphone!...',
//   userId: { username: 'alice', avatar: '...' },
//   replies: [{ content: 'I agree...', userId: { username: 'bob' } }]
// }]

# === 1. 启动 MongoDB 副本集 ===
docker run -d --name mongo -p 27017:27017 mongo:7.0 --replSet rs0
docker exec mongo mongosh --eval 'rs.initiate()'

# === 2. 启动 Node.js 应用 ===
npm install
npm start

# 输出：
# ✅ MongoDB connected: localhost
# 🚀 Server running on port 3000

# === 3. 测试核心 API ===

# 3.1 用户注册
curl -X POST http://localhost:3000/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email":"alice@example.com","username":"alice","password":"Pass123!"}'

# 返回：
# {
#   "success": true,
#   "user": { "id": "...", "email": "alice@example.com", "username": "alice" },
#   "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
# }

# 3.2 用户登录
curl -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"alice@example.com","password":"Pass123!"}'

# 3.3 创建商品
curl -X POST http://localhost:3000/api/products \
  -H "Authorization: Bearer <admin_token>" \
  -H "Content-Type: application/json" \
  -d '{
    "sku": "PHONE-001",
    "title": "Smartphone X",
    "price": 599,
    "category": "Electronics",
    "stock": 50
  }'

# 3.4 商品列表（带分页 + 投影）
curl 'http://localhost:3000/api/products?page=1&limit=20&category=Electronics'

# 返回：
# {
#   "success": true,
#   "data": [{ "sku": "PHONE-001", "title": "Smartphone X", "price": 599, "thumbnail": "...", "rating": 0 }],
#   "meta": { "page": 1, "limit": 20, "total": 1, "pages": 1 }
# }

# 3.5 添加评论
curl -X POST http://localhost:3000/api/products/507f1f77bcf86cd799439021/reviews \
  -H "Authorization: Bearer <user_token>" \
  -H "Content-Type: application/json" \
  -d '{"content":"Great phone!","rating":5}'

# 3.6 点赞评论
curl -X POST http://localhost:3000/api/reviews/507f1f77bcf86cd799439031/like \
  -H "Authorization: Bearer <user_token>"

# 3.7 查看商品统计
curl http://localhost:3000/api/products/507f1f77bcf86cd799439021/stats

# 返回：
# {
#   "total": [{ "count": 1 }],
#   "avgRating": [{ "avg": 5 }],
#   "ratingDistribution": [{ "_id": 5, "count": 1 }],
#   "recentReviews": [{ "content": "Great phone!", "rating": 5, "username": "alice" }]
# }

# 3.8 健康检查
curl http://localhost:3000/healthz

# 返回：
# {
#   "status": "ok",
#   "uptime": 1234,
#   "mongo": "connected",
#   "timestamp": "2026-07-06T10:00:00.000Z"
# }

# === 4. 部署到 Render/Railway ===
git push heroku main
# 自动部署，环境变量 MONGODB_URI 指向 Atlas

# === 5. 性能监控（生产）===
# Datadog APM 自动追踪：
# - mongoose 查询耗时
# - API 响应时间
# - 数据库连接数
# - 慢查询告警

// === 1. 生产部署检查清单（启动时自动验证）===
async function productionReadinessCheck() {
  const checks = [];

  // 环境变量
  const requiredEnvVars = ['MONGODB_URI', 'JWT_SECRET', 'NODE_ENV', 'PORT'];
  requiredEnvVars.forEach(v => {
    checks.push({
      item: `环境变量 ${v}`,
      status: process.env[v] ? 'PASS' : 'FAIL',
      detail: process.env[v] ? '已设置' : '未设置'
    });
  });
  checks.push({
    item: 'NODE_ENV=production',
    status: process.env.NODE_ENV === 'production' ? 'PASS' : 'WARN',
    detail: `当前值: ${process.env.NODE_ENV || '未设置'}`
  });

  // 数据库连接
  try {
    const adminStatus = await mongoose.connection.db.adminCommand({ ping: 1 });
    checks.push({ item: '数据库连接', status: 'PASS', detail: '连接正常' });

    const serverStatus = await mongoose.connection.db.adminCommand({ serverStatus: 1 });
    checks.push({
      item: '连接池使用率',
      status: serverStatus.connections.current < serverStatus.connections.available * 0.8 ? 'PASS' : 'WARN',
      detail: `${serverStatus.connections.current}/${serverStatus.connections.available}`
    });
  } catch (err) {
    checks.push({ item: '数据库连接', status: 'FAIL', detail: err.message });
  }

  // 索引检查
  const collections = ['products', 'reviews', 'users'];
  for (const coll of collections) {
    const indexes = await mongoose.connection.db.collection(coll).indexes();
    const hasTextIndex = indexes.some(i => Object.values(i.key).includes('text'));
    checks.push({
      item: `${coll} 文本索引`,
      status: hasTextIndex ? 'PASS' : 'WARN',
      detail: hasTextIndex ? '已创建' : '未创建，全文搜索不可用'
    });
  }

  return checks;
}

// === 2. 健康检查端点（供负载均衡器探测）===
app.get('/health', async (req, res) => {
  const start = Date.now();
  const health = {
    status: 'ok',
    uptime: process.uptime(),
    timestamp: new Date().toISOString(),
    checks: {}
  };

  // MongoDB 连接检查
  try {
    await mongoose.connection.db.adminCommand({ ping: 1 });
    health.checks.mongodb = { status: 'up', responseTime: `${Date.now() - start}ms` };
  } catch {
    health.checks.mongodb = { status: 'down' };
    health.status = 'degraded';
  }

  // 内存检查
  const mem = process.memoryUsage();
  health.checks.memory = {
    rss: `${Math.round(mem.rss / 1024 / 1024)}MB`,
    heapUsed: `${Math.round(mem.heapUsed / 1024 / 1024)}MB`,
    heapTotal: `${Math.round(mem.heapTotal / 1024 / 1024)}MB`,
    status: mem.heapUsed / mem.heapTotal < 0.9 ? 'ok' : 'warn'
  };

  const statusCode = health.status === 'ok' ? 200 : 503;
  res.status(statusCode).json(health);
});

// === 3. Prometheus 指标采集 ===
const client = require('prom-client');
const register = new client.Registry();

const httpRequestDuration = new client.Histogram({
  name: 'http_request_duration_seconds',
  help: 'HTTP request duration in seconds',
  labelNames: ['method', 'route', 'status'],
  buckets: [0.05, 0.1, 0.25, 0.5, 1, 2.5, 5]
});
register.registerMetric(httpRequestDuration);

const dbQueryDuration = new client.Histogram({
  name: 'mongodb_query_duration_seconds',
  help: 'MongoDB query duration',
  labelNames: ['collection', 'operation'],
  buckets: [0.01, 0.05, 0.1, 0.25, 0.5, 1]
});
register.registerMetric(dbQueryDuration);

app.use((req, res, next) => {
  const start = Date.now();
  res.on('finish', () => {
    httpRequestDuration
      .labels(req.method, req.route?.path || req.path, res.statusCode)
      .observe((Date.now() - start) / 1000);
  });
  next();
});

app.get('/metrics', async (req, res) => {
  res.set('Content-Type', register.contentType);
  res.end(await register.metrics());
});

// === 4. 告警规则配置（Prometheus 规则文件）===
const alertRules = `
groups:
  - name: review_system
    rules:
      - alert: HighErrorRate
        expr: rate(http_requests_total{status=~"5.."}[5m]) / rate(http_requests_total[5m]) > 0.01
        for: 5m
        labels: { severity: critical }
        annotations: { summary: "5xx 错误率超过 1%" }

      - alert: SlowAPIResponse
        expr: histogram_quantile(0.95, rate(http_request_duration_seconds_bucket[5m])) > 1
        for: 10m
        labels: { severity: warning }
        annotations: { summary: "API P95 响应时间超过 1 秒" }

      - alert: MongoDBConnectionPoolExhausted
        expr: mongodb_connections{state="current"} / mongodb_connections{state="available"} > 0.8
        for: 5m
        labels: { severity: warning }
        annotations: { summary: "MongoDB 连接池使用率超过 80%" }

      - alert: HighMemoryUsage
        expr: process_heap_bytes / process_max_heap_bytes > 0.9
        for: 5m
        labels: { severity: critical }
        annotations: { summary: "Node.js 内存使用率超过 90%" }
`;