feat: 数据导入支持合并其他账号的备份

Refs: #10

Author: margrop

README.en.md

@@ -178,7 +178,7 @@ Practice statistics show total practice, accuracy (correct / attempted) and acti
 - **🔍 Filters**: filter by mastery, date range, knowledge point, question type, grade and term, paper level and more; supports bulk actions and comparing the similarity of two questions. Selected questions can be exported as JSON, Excel or Word (the Excel columns match the question bank import template, so the file can be re-imported directly).
 - **📊 Statistics**: mastery rate, trends and subject distribution for both mistakes and practice, with time-range and subject filters.
 - **⏳ Background tasks**: the button at the bottom right shows the progress of long-running jobs such as recognition, AI generation, animation voice, bulk tagging and exam generation. Jobs keep running on the server after you leave the page. Photo recognition results are also kept in **Recognition**.
-- **💾 Import and export**: export or import data backups in **Settings**, including notebooks, questions, system and custom tags, practice and answer records, exams, personal preferences and synthesized cloud voice. Tags are restored by tag system and parent path, keeping identically named chapters and knowledge points under different grades separate and reconnecting questions to their specific tag nodes. Account credentials and AI settings are not included.
+- **💾 Import and export**: export or import data backups in **Settings**, including notebooks, questions, system and custom tags, practice and answer records, exams, personal preferences and synthesized cloud voice. Tags are restored by tag system and parent path, keeping identically named chapters and knowledge points under different grades separate and reconnecting questions to their specific tag nodes. A backup from another account can be merged into the current account after confirmation; all data belongs to the current account and the other account's preferences are not restored. Account credentials and AI settings are not included.
 - **🌗 Dark mode**: the theme button in the top navigation bar switches between Auto (follow system), Light and Dark; Auto is the default. The choice is saved per account, so it carries over when you sign in on another device.
 - **🕒 Application time zone**: Beijing time by default and changeable by administrators; dates and statistics follow the application time zone. See [TIME_ZONE.md](doc/TIME_ZONE.md) (Chinese).
 - **🔑 One-time setup link**: fresh installs no longer ship an admin with a fixed password. On first start the server generates a setup link that works only once; open it to choose the admin email and password. The desktop and standalone Android apps open it automatically; on fnOS you enter the admin email and password in the install wizard instead; Docker, npm and source runs print it in the startup log (the token is also in `config/setup-token` in the data directory). Instances upgraded from earlier versions keep their accounts.

README.md

@@ -178,7 +178,7 @@
 - **🔍 多维度筛选**：按掌握状态、时间范围、知识点、题型、年级学期、试卷等级等条件筛选，支持批量操作和两题相似度比较；选中的错题可导出为 JSON、Excel 或 Word（Excel 列与题库导入模板一致，可往返导入）。
 - **📊 数据统计**：错题与练习的掌握率、趋势和学科分布，支持时间范围与学科筛选。错题列表支持用地址参数预设掌握状态（`?mastery=new|reviewing|mastered`）和知识点标签（`?tag=标签名`）筛选。
 - **⏳ 后台任务**：页面右下角的按钮可查看识别、AI 生成、动画语音生成、批量标注、组卷等耗时事务的进度；离开页面后事务仍在服务器上继续。拍照识别的结果另在「识别任务」中持久保存。
-- **💾 数据导入导出**：在「设置」中导出或导入数据备份，包含错题本、错题、系统及自定义标签、练习与作答记录、试卷、个人偏好和已合成的云端语音；标签按体系和父子路径还原，不同年级下的同名章节与知识点分别保留，题目恢复到具体标签节点。账户凭据和 AI 配置不在备份中。
+- **💾 数据导入导出**：在「设置」中导出或导入数据备份，包含错题本、错题、系统及自定义标签、练习与作答记录、试卷、个人偏好和已合成的云端语音；标签按体系和父子路径还原，不同年级下的同名章节与知识点分别保留，题目恢复到具体标签节点。备份来自其他账号时可在确认后合并到当前账号，数据全部归当前账号，不还原对方的偏好设置。账户凭据和 AI 配置不在备份中。
 - **🌗 深色模式**：顶部导航栏的主题按钮可在「自动（跟随系统）」「浅色」「深色」之间切换，默认自动。偏好按用户保存在账号中，换设备登录也保持一致。
 - **🕒 应用时区**：默认北京时间，管理员可修改，日期显示与统计都按应用时区计算，详见 [时区说明](doc/TIME_ZONE.md)。
 - **🔑 一次性初始化链接**：全新安装不再预置固定密码的管理员。服务首次启动时生成只能使用一次的初始化链接，打开后自行设置管理员邮箱和密码：桌面版、安卓单机版自动打开；飞牛OS 直接在安装向导中填写管理员邮箱和密码；Docker、npm、源码运行打印在启动日志中（也可在数据目录的 `config/setup-token` 中找到令牌）。从旧版本升级的实例保留原有账号。

doc/wiki/Backup-and-Restore.md

@@ -14,7 +14,7 @@
 
 ## 网页导出与导入
 
-在设置的数据管理入口导出 JSON，并妥善保存。普通用户导入时，导出文件中的用户邮箱必须与当前账户一致；管理员可以使用管理范围的全部数据导入导出。
+在设置的数据管理入口导出 JSON，并妥善保存。普通用户导入时，导出文件中的用户邮箱通常必须与当前账户一致；备份来自其他账号时，可在确认后合并到当前账号，错题本、标签、题目和试卷全部归当前账号，不还原对方的偏好设置。管理员可以使用管理范围的全部数据导入导出。
 
 ### 导出 JSON（题目交换格式）
 

doc/wiki/Settings-and-Users.md

@@ -56,7 +56,7 @@
 
 | 角色 | 主要权限 |
 | --- | --- |
-| 普通用户 | 管理自己的错题、练习、试卷和个人偏好，导入导出本人数据 |
+| 普通用户 | 管理自己的错题、练习、试卷和个人偏好，导入导出本人数据；可把其他账号的备份合并到当前账号 |
 | 管理员 | 使用全局 AI 和提示词设置、时区设置、注册开关、用户管理及管理范围的数据导入导出 |
 
 管理员从“设置 → 用户管理”进入后台，可查看使用统计，启用、禁用或删除用户。删除前应确认对象并[备份数据](Backup-and-Restore)。

doc/wiki/en/Backup-and-Restore-en.md

@@ -14,7 +14,7 @@ The JSON export does not include full user accounts with passwords, AI data shar
 
 ## Web export and import
 
-Export JSON from the data management section in the settings and keep it safe. When a regular user imports, the email in the export file must match the current account; admins can import and export data for all users.
+Export JSON from the data management section in the settings and keep it safe. When a regular user imports, the email in the export file normally must match the current account; a backup from another account can be merged into the current account after confirmation, with notebooks, tags, questions and exam papers all assigned to the current account and the other account's preferences not restored. Admins can import and export data for all users.
 
 ### Export JSON (Question Exchange Format)
 

doc/wiki/en/Settings-and-Users-en.md

@@ -56,7 +56,7 @@ AI features send the question text, images, answers, reference answers and expla
 
 | Role | Main permissions |
 | --- | --- |
-| Regular user | Manage their own questions, practice, exam papers and preferences; import and export their own data |
+| Regular user | Manage their own questions, practice, exam papers and preferences; import and export their own data, and merge another account's backup into the current account |
 | Admin | Global AI and prompt settings, time zone, registration switch, user management and site-wide data import/export |
 
 Admins open the dashboard from "Settings → User Management" to see usage statistics and enable, disable or delete users. Confirm the target and [back up your data](Backup-and-Restore-en) before deleting.

src/__tests__/integration/data-backup.test.ts

@@ -44,8 +44,8 @@ async function exportBackup() {
     return response.json();
 }
 
-async function importBackup(body: object) {
-    const response = await IMPORT(new Request('http://localhost/api/import', {
+async function importBackup(body: object, query = '') {
+    const response = await IMPORT(new Request(`http://localhost/api/import${query}`, {
         method: 'POST',
         body: JSON.stringify(body),
         headers: { 'Content-Type': 'application/json' },
@@ -805,3 +805,53 @@ describe('数据导出后再导入（真实 SQLite）', () => {
         });
     });
 });
+
+describe('跨账号合并导入', () => {
+    const originalSession = { user: { id: 'user-1', email: 'backup-test@example.com', role: 'user' }, expires: '2099-01-01' };
+
+    /** 创建另一个账号的备份（含该账号的偏好设置和题目） */
+    async function exportOtherAccountBackup() {
+        await database.user.create({
+            data: { id: 'user-2', email: 'parent@example.com', password: 'test-only', confirmBeforeImport: true },
+        });
+        await database.subject.create({
+            data: { id: 'parent-math', name: '家长数学', stage: 'junior_high', subjectKey: 'math', userId: 'user-2' },
+        });
+        await database.errorItem.create({
+            data: { id: 'parent-item', userId: 'user-2', subjectId: 'parent-math', originalImageUrl: '', questionText: '家长录入的题目', answerText: '答案', analysis: '解析' },
+        });
+        mocks.session = { user: { id: 'user-2', email: 'parent@example.com', role: 'user' }, expires: '2099-01-01' };
+        const backup = await exportBackup();
+        mocks.session = originalSession;
+        return backup;
+    }
+
+    it('merge=true 时把其他账号的备份合并到当前账号，且不还原对方偏好', async () => {
+        const backup = await exportOtherAccountBackup();
+        expect(backup.user.email).toBe('parent@example.com');
+        await clearUserData();
+
+        const { stats } = await importBackup(backup, '?merge=true');
+
+        expect(stats.preferencesRestored).toBe(false);
+        expect((await database.user.findUniqueOrThrow({ where: { id: 'user-1' } })).confirmBeforeImport).toBe(false);
+        expect((await database.user.findUniqueOrThrow({ where: { id: 'user-2' } })).confirmBeforeImport).toBe(true);
+        const importedItem = await database.errorItem.findFirstOrThrow({ where: { questionText: '家长录入的题目', userId: 'user-1' } });
+        expect(importedItem.userId).toBe('user-1');
+        const importedNotebook = await database.subject.findUniqueOrThrow({ where: { id: importedItem.subjectId! } });
+        expect(importedNotebook.userId).toBe('user-1');
+    });
+
+    it('未指定 merge=true 时仍拒绝其他账号的备份', async () => {
+        const backup = await exportOtherAccountBackup();
+        await clearUserData();
+        const response = await IMPORT(new Request('http://localhost/api/import', {
+            method: 'POST',
+            body: JSON.stringify(backup),
+            headers: { 'Content-Type': 'application/json' },
+        }));
+
+        expect(response.status).toBe(400);
+        expect(await database.errorItem.count({ where: { userId: 'user-1' } })).toBe(0);
+    });
+});

src/app/api/import/route.ts

@@ -31,6 +31,8 @@ export async function POST(req: Request) {
 
     const { searchParams } = new URL(req.url);
     const importAll = searchParams.get('all') === 'true';
+    // 合并其他账号的备份：非本人邮箱时也允许导入，数据全部归到当前账号，偏好设置不还原
+    const merge = searchParams.get('merge') === 'true';
 
     // 只有管理员可以导入全部数据
     if (importAll && session.user.role !== 'admin') {
@@ -50,8 +52,8 @@ export async function POST(req: Request) {
         }
         const body = parsed.data;
 
-        // 非管理员模式：验证导出数据属于当前用户
-        if (!importAll && body.user.email !== user.email) {
+        // 非管理员模式：导出数据属于当前用户，或显式要求合并其他账号的备份
+        if (!importAll && body.user.email !== user.email && !merge) {
             return badRequest("Import data does not belong to current user");
         }
 
@@ -85,7 +87,7 @@ export async function POST(req: Request) {
 
             logger.info({
                 userId: user.id,
-                scope: importAll ? 'all' : 'user',
+                scope: importAll ? 'all' : merge && body.user.email !== user.email ? 'merge' : 'user',
                 ...stats,
             }, 'Data import completed');
 

src/components/settings-dialog.tsx

@@ -61,6 +61,7 @@ export function SettingsDialog() {
     const { data: session } = useSession();
     const isAdmin = session?.user?.role === 'admin';
     const userId = session?.user?.id ?? '';
+    const userEmail = session?.user?.email ?? '';
     const { t } = useLanguage();
     const router = useRouter();
     const [open, setOpen] = useState(false);
@@ -208,7 +209,7 @@ export function SettingsDialog() {
 
                     <TabsContent value="danger" className="space-y-4 py-4">
                         <div className="space-y-3">
-                            <DataBackupSettings isAdmin={isAdmin} userId={userId} />
+                            <DataBackupSettings isAdmin={isAdmin} userId={userId} userEmail={userEmail} />
                             <DangerZoneSettings isAdmin={isAdmin} />
                             <DeleteAccountSettings isAdmin={isAdmin} />
                         </div>

src/components/settings/data-backup-settings.tsx

@@ -17,6 +17,8 @@ type ImportStats = Record<string, number | boolean | undefined>;
 interface DataBackupSettingsProps {
     isAdmin: boolean;
     userId: string;
+    /** 当前登录账号邮箱，用于识别备份是否来自其他账号 */
+    userEmail: string;
 }
 
 function formatImportResult(stats: ImportStats, t: Translations): string {
@@ -32,7 +34,7 @@ function formatImportResult(stats: ImportStats, t: Translations): string {
 }
 
 /** 数据备份：导出、导入 JSON；管理员可导出、导入全部用户的数据 */
-export function DataBackupSettings({ isAdmin, userId }: DataBackupSettingsProps) {
+export function DataBackupSettings({ isAdmin, userId, userEmail }: DataBackupSettingsProps) {
     const { t } = useLanguage();
     const [exporting, setExporting] = useState(false);
     const [importing, setImporting] = useState(false);
@@ -71,17 +73,33 @@ export function DataBackupSettings({ isAdmin, userId }: DataBackupSettingsProps)
 
     const handleImport = async (all: boolean) => {
         if (!selectedFile) return;
+        let data: unknown;
+        try {
+            data = JSON.parse(await selectedFile.text());
+        } catch (error) {
+            frontendLogger.error('[DataBackupSettings]', 'Import file is not valid JSON', { error });
+            toast.error(t.settings?.importFailed || "Import failed");
+            return;
+        }
+
+        const backupUser = typeof data === 'object' && data !== null && 'user' in data ? data.user : undefined;
+        const sourceEmail = typeof backupUser === 'object' && backupUser !== null && 'email' in backupUser && typeof backupUser.email === 'string'
+            ? backupUser.email
+            : null;
+        const merging = !all && !!sourceEmail && !!userEmail && sourceEmail !== userEmail;
         const confirmText = all
             ? (t.settings?.importAllConfirm || "Import all users' data? This will restore data for all users from the export file.")
-            : (t.settings?.importConfirm || "Are you sure you want to import?");
+            : merging
+                ? (t.settings?.importOtherAccountConfirm || "This backup belongs to {email}. Importing merges it into the current account without restoring that account's preferences. Continue?").replace("{email}", sourceEmail ?? "")
+                : (t.settings?.importConfirm || "Are you sure you want to import?");
         if (!(await confirmDialog(confirmText))) {
             return;
         }
 
         setImporting(true);
         try {
-            const data = JSON.parse(await selectedFile.text());
-            const { stats } = await apiClient.post<{ stats: ImportStats }>(all ? '/api/import?all=true' : '/api/import', data);
+            const url = all ? '/api/import?all=true' : merging ? '/api/import?merge=true' : '/api/import';
+            const { stats } = await apiClient.post<{ stats: ImportStats }>(url, data);
             toast.success(formatImportResult(stats, t));
             setSelectedFile(null);
             window.location.reload();
@@ -90,7 +108,7 @@ export function DataBackupSettings({ isAdmin, userId }: DataBackupSettingsProps)
                 toast.info(t.errors.TASK_ALREADY_RUNNING);
                 await refreshImportTask();
             } else {
-                frontendLogger.error('[DataBackupSettings]', all ? 'Import all failed' : 'Import failed', { error });
+                frontendLogger.error('[DataBackupSettings]', all ? 'Import all failed' : merging ? 'Merge import failed' : 'Import failed', { error });
                 toast.error(t.settings?.importFailed || "Import failed");
             }
         } finally {