feat: harden pet consultation SOP execution

internal/run/handler.go

@@ -15,6 +15,7 @@ import (
 	"github.com/gin-gonic/gin"
 	"gorm.io/datatypes"
 	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
 )
 
 type Handler struct {
@@ -108,6 +109,7 @@ func (h *Handler) Answer(c *gin.Context) {
 		return
 	}
 	var input struct {
+		NodeKey string                 `json:"node_key"`
 		Answers map[string]interface{} `json:"answers"`
 	}
 	if err := c.ShouldBindJSON(&input); err != nil {
@@ -116,12 +118,26 @@ func (h *Handler) Answer(c *gin.Context) {
 	}
 	var updated model.SOPRun
 	err := h.db.Transaction(func(tx *gorm.DB) error {
-		if err := tx.Clauses().Where("id = ? AND tenant_id = ?", id, p.TenantID).First(&updated).Error; err != nil {
+		if err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("id = ? AND tenant_id = ?", id, p.TenantID).First(&updated).Error; err != nil {
 			return err
 		}
 		if updated.Status != "running" {
 			return errors.New("run is not active")
 		}
+		if input.NodeKey != "" && input.NodeKey != updated.CurrentNodeKey {
+			return errors.New("当前步骤已经变化，请刷新后重试")
+		}
+		var currentNode model.SOPNode
+		if err := tx.Where("sop_version_id = ? AND node_key = ? AND tenant_id = ?", updated.SOPVersionID, updated.CurrentNodeKey, p.TenantID).First(&currentNode).Error; err != nil {
+			return err
+		}
+		var fields []model.ScenarioField
+		if err := tx.Table("scenario_fields sf").Joins("JOIN sops s ON s.scenario_id = sf.scenario_id").Where("s.id = ? AND sf.tenant_id = ?", updated.SOPID, p.TenantID).Order("sf.sort_order, sf.id").Find(&fields).Error; err != nil {
+			return err
+		}
+		if err := validateNodeAnswers(currentNode, fields, input.Answers); err != nil {
+			return err
+		}
 		answers := map[string]interface{}{}
 		if len(updated.Answers) > 0 {
 			_ = json.Unmarshal(updated.Answers, &answers)