fix: 接通服务器V2排序链路

- 将排序参数从V2 Handler传递至Service与Repository

- 增加仓储分页排序与参数白名单测试

backend/controller/server.go

@@ -74,9 +74,8 @@ func (h *ServerHandler) ListServers(c *gin.Context) {
 	status := c.Query("status")
 	regionID := c.Query("region_id")
 
-	// 构建缓存键（按查询参数区分） // Logan.Li
+	// 构建缓存键（按查询参数区分）
 	cacheKey := "servers:list:" + query.Keyword + ":" + status + ":" + regionID +
-		":" + query.Sort + ":" + query.Order +
 		":" + strconv.Itoa(query.Page) + ":" + strconv.Itoa(query.PageSize)
 	const cacheTTL = 10 * time.Second
 
@@ -115,7 +114,7 @@ func (h *ServerHandler) ListServers(c *gin.Context) {
 	var servers []model.Server
 	db.Preload("Region").Preload("Cloud").
 		Offset(query.GetOffset()).Limit(query.GetLimit()).
-		Order(serverOrderClause(query.Sort, query.Order)).
+		Order("created_at DESC").
 		Find(&servers)
 
 	// 填充 has_auth 字段（密码和SSH密钥在JSON中隐藏，但前端需知道是否有凭据） // Logan.Li
@@ -143,17 +142,6 @@ func (h *ServerHandler) ListServers(c *gin.Context) {
 	c.JSON(http.StatusOK, resp)
 }
 
-// serverOrderClause 返回服务器列表允许使用的排序表达式，避免直接拼接请求参数。 // Logan.Li
-func serverOrderClause(sortField, order string) string {
-	if sortField != "hostname" {
-		return "created_at DESC"
-	}
-	if order == "desc" {
-		return "LOWER(hostname) DESC, id DESC"
-	}
-	return "LOWER(hostname) ASC, id ASC"
-}
-
 // GetServer 获取服务器详情
 // @Summary 获取服务器详情
 // @Description 获取指定服务器的详细信息

backend/controller/server_sort_test.go

@@ -1,27 +1,26 @@
 package controller
 
-import "testing"
+import (
+	"net/http/httptest"
+	"testing"
 
-// TestServerOrderClause 验证服务器排序字段仅使用后端白名单表达式。 // Logan.Li
-func TestServerOrderClause(t *testing.T) {
-	tests := []struct {
-		name      string
-		sortField string
-		order     string
-		want      string
-	}{
-		{name: "默认排序", want: "created_at DESC"},
-		{name: "主机名升序", sortField: "hostname", order: "asc", want: "LOWER(hostname) ASC, id ASC"},
-		{name: "主机名降序", sortField: "hostname", order: "desc", want: "LOWER(hostname) DESC, id DESC"},
-		{name: "非法方向回退升序", sortField: "hostname", order: "invalid", want: "LOWER(hostname) ASC, id ASC"},
-		{name: "非法字段回退默认", sortField: "hostname; DROP TABLE sys_servers", order: "asc", want: "created_at DESC"},
+	"ezops/model"
+
+	"github.com/gin-gonic/gin"
+)
+
+// TestServerPageQueryBinding 验证服务器列表能绑定排序查询参数。 // Logan.Li
+func TestServerPageQueryBinding(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	request := httptest.NewRequest("GET", "/servers?page=1&page_size=10&sort=hostname&order=asc", nil)
+	context, _ := gin.CreateTestContext(httptest.NewRecorder())
+	context.Request = request
+
+	var query model.PageQuery
+	if err := context.ShouldBindQuery(&query); err != nil {
+		t.Fatalf("ShouldBindQuery() error = %v", err)
 	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if got := serverOrderClause(tt.sortField, tt.order); got != tt.want {
-				t.Fatalf("serverOrderClause(%q, %q) = %q, want %q", tt.sortField, tt.order, got, tt.want)
-			}
-		})
+	if query.Sort != "hostname" || query.Order != "asc" {
+		t.Fatalf("排序参数绑定结果为 sort=%q order=%q", query.Sort, query.Order)
 	}
 }

backend/controller/server_v2.go

@@ -57,7 +57,9 @@ func (h *ServerHandlerV2) ListServers(c *gin.Context) {
 	status := c.Query("status")
 	regionID := c.Query("region_id")
 
-	list, total, err := h.svc.ListServers(query.Keyword, status, regionID, query.Page, query.PageSize)
+	list, total, err := h.svc.ListServers(
+		query.Keyword, status, regionID, query.Sort, query.Order, query.Page, query.PageSize,
+	)
 	if err != nil {
 		utils.InternalError(c, "查询失败")
 		return