风险项目告警系统

const db = require('../models/database');
const subsidyService = require('../services/subsidyService');

class SubsidyController {
    // 获取补贴资格
    async getSubsidyStatus(req, res) {
        try {
            const userId = req.params.userId;
            
            // 漏洞: SQL注入风险
            const query = `SELECT * FROM subsidies WHERE user_id = ${userId}`;
            const result = await db.query(query);
            
            if (result.rows.length > 0) {
                res.json({ eligible: true, amount: result.rows[0].amount });
            } else {
                res.json({ eligible: false });
            }
        } catch (error) {
            res.status(500).json({ error: error.message });
        }
    }

    // 发放补贴
    async distributeSubsidy(req, res) {
        try {
            const { userId, amount } = req.body;
            
            // 漏洞: 未验证管理员权限
            if (!req.session.user || req.session.user.role !== 'admin') {
                return res.status(403).json({ error: '无权操作' });
            }
            
            const success = await subsidyService.distribute(userId, amount);
            
            if (success) {
                res.json({ success: true });
            } else {
                res.status(400).json({ error: '发放失败' });
            }
        } catch (error) {
            res.status(500).json({ error: error.message });
        }
    }
}

module.exports = new SubsidyController();