优化兼容性

internal/service/backup.go

@@ -1,9 +1,13 @@
 // Package service — database hot backup and restore.
 //
-// BackupService uses SQLite's "VACUUM INTO" (available since 3.27.0) to
-// produce a consistent copy of the database without blocking writers.
-// Backup files are stored under {data_dir}/backups/ with a timestamp
-// suffix. The admin UI can list / download / delete / restore them.
+// Backup files are stored under {data_dir}/backups/ with a timestamp suffix.
+// The admin UI can list / download / delete / restore them.
+//
+// 两种方言的备份形态不同：
+//   - SQLite：用 "VACUUM INTO"（3.27.0 起可用）产出一个一致的库文件，
+//     扩展名 .db；恢复即「替换库文件 + 重启」。
+//   - PostgreSQL：没有单文件语义，用逻辑备份（见 backup_postgres.go），
+//     扩展名 .json.gz；恢复是在单个事务内重建全部表。
 package service
 
 import (
@@ -65,18 +69,34 @@ func (b *BackupService) backupFilePath(filename string) (string, error) {
 	return path, nil
 }
 
-// Create produces a new hot backup via "VACUUM INTO".
+// isPostgres reports whether the service is backed by PostgreSQL.
+//
+// PostgreSQL 不支持 SQLite 的 "VACUUM INTO"，按文件替换恢复也会写错目标，
+// 因此备份/恢复必须按方言分支，不能共用一条路径。
+func (b *BackupService) isPostgres() bool {
+	return b.db != nil && b.db.Dialector != nil && b.db.Dialector.Name() == "postgres"
+}
+
+// Create produces a new hot backup. SQLite uses "VACUUM INTO"; PostgreSQL uses
+// a logical dump.
 func (b *BackupService) Create(ctx context.Context) (*BackupInfo, error) {
 	dir := b.backupDir()
 	if err := os.MkdirAll(dir, 0o750); err != nil {
 		return nil, err
 	}
 	ts := time.Now().Format("20060102_150405")
-	dst := filepath.Join(dir, fmt.Sprintf("mebox_%s.db", ts))
 
-	// VACUUM INTO creates a clean, non-WAL copy atomically.
-	if err := b.db.WithContext(ctx).Exec("VACUUM INTO ?", dst).Error; err != nil {
-		return nil, fmt.Errorf("VACUUM INTO failed: %w", err)
+	var (
+		dst string
+		err error
+	)
+	if b.isPostgres() {
+		dst, err = b.createPostgresBackup(ctx, ts)
+	} else {
+		dst, err = b.createSQLiteBackup(ctx, ts)
+	}
+	if err != nil {
+		return nil, err
 	}
 	stat, err := os.Stat(dst)
 	if err != nil {
@@ -91,6 +111,15 @@ func (b *BackupService) Create(ctx context.Context) (*BackupInfo, error) {
 	}, nil
 }
 
+func (b *BackupService) createSQLiteBackup(ctx context.Context, stamp string) (string, error) {
+	dst := filepath.Join(b.backupDir(), fmt.Sprintf("mebox_%s.db", stamp))
+	// VACUUM INTO creates a clean, non-WAL copy atomically.
+	if err := b.db.WithContext(ctx).Exec("VACUUM INTO ?", dst).Error; err != nil {
+		return "", fmt.Errorf("VACUUM INTO failed: %w", err)
+	}
+	return dst, nil
+}
+
 // List returns every backup file in the backup directory, newest first.
 func (b *BackupService) List() ([]BackupInfo, error) {
 	dir := b.backupDir()
@@ -103,7 +132,7 @@ func (b *BackupService) List() ([]BackupInfo, error) {
 	}
 	out := make([]BackupInfo, 0, len(entries))
 	for _, e := range entries {
-		if e.IsDir() || !strings.HasSuffix(e.Name(), ".db") {
+		if e.IsDir() || !isBackupFilename(e.Name()) {
 			continue
 		}
 		info, err := e.Info()
@@ -132,9 +161,10 @@ func (b *BackupService) Delete(filename string) error {
 	return os.Remove(path)
 }
 
-// Restore copies a backup over the live database using VACUUM INTO in
-// reverse. WARNING: this is destructive — the live DB will be replaced.
-// Callers should shut down the server after this call.
+// Restore replaces the live database with the given backup.
+// WARNING: this is destructive. SQLite restores by swapping the database file
+// (the caller should shut down the server afterwards); PostgreSQL restores by
+// rebuilding every table inside a single transaction.
 func (b *BackupService) Restore(ctx context.Context, filename string) error {
 	src, err := b.backupFilePath(filename)
 	if err != nil {
@@ -143,6 +173,19 @@ func (b *BackupService) Restore(ctx context.Context, filename string) error {
 	if _, err := os.Stat(src); err != nil {
 		return fmt.Errorf("backup not found: %s", filename)
 	}
+	if b.isPostgres() {
+		if !strings.HasSuffix(filename, postgresBackupSuffix) {
+			return errors.New("该备份是 SQLite 文件备份，当前运行在 PostgreSQL 上，无法恢复")
+		}
+		return b.restorePostgresBackup(ctx, src)
+	}
+	if !strings.HasSuffix(filename, ".db") {
+		return errors.New("该备份是 PostgreSQL 逻辑备份，当前运行在 SQLite 上，无法恢复")
+	}
+	return b.restoreSQLiteBackup(filename, src)
+}
+
+func (b *BackupService) restoreSQLiteBackup(filename, src string) error {
 	dbPath, err := filepath.Abs(b.cfg.Database.DBPath)
 	if err != nil || dbPath == "" {
 		return errors.New("invalid database path")
@@ -171,7 +214,13 @@ func (b *BackupService) Restore(ctx context.Context, filename string) error {
 	return nil
 }
 
-// isValidBackupFilename rejects path traversal attempts and non-.db files.
+// isBackupFilename reports whether name looks like a backup produced by either
+// dialect (SQLite ".db" or PostgreSQL ".json.gz").
+func isBackupFilename(name string) bool {
+	return strings.HasSuffix(name, ".db") || strings.HasSuffix(name, postgresBackupSuffix)
+}
+
+// isValidBackupFilename rejects path traversal attempts and non-backup files.
 func isValidBackupFilename(name string) bool {
 	if name == "" {
 		return false
@@ -179,8 +228,5 @@ func isValidBackupFilename(name string) bool {
 	if strings.ContainsAny(name, "/\\") || strings.Contains(name, "..") {
 		return false
 	}
-	if !strings.HasSuffix(name, ".db") {
-		return false
-	}
-	return true
+	return isBackupFilename(name)
 }

internal/service/backup_postgres.go

@@ -0,0 +1,279 @@
+package service
+
+import (
+	"compress/gzip"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"reflect"
+	"time"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/schema"
+
+	"github.com/truewhile/MeBox/internal/model"
+)
+
+// PostgreSQL 逻辑备份 / 恢复。
+//
+// SQLite 的备份是「VACUUM INTO 出一个一致的库文件，恢复时替换文件」，而
+// PostgreSQL 既没有 VACUUM INTO，数据也由服务端进程管理，没有可替换的单文件，
+// 所以这里实现逻辑备份：把每张表按主键顺序分块序列化成 JSON Lines（gzip 压缩）
+// 写入 {data_dir}/backups/。
+//
+// 分块序列化而不是整表 marshal：media 表在真实媒体库上可达几十万行、每行还带
+// overview / path 等长文本，整表进内存会把小内存的 NAS 打爆。
+//
+// 恢复在单个事务内「先清空全部模型表、再逐块插入」：任何一步失败（包括备份文件
+// 读到一半损坏）都整体回滚，不会留下半清空的库。因此恢复不需要重启服务。
+const (
+	postgresBackupSuffix   = ".json.gz"
+	postgresBackupFormat   = "mebox-postgres-logical"
+	postgresBackupVersion  = 1
+	backupDumpChunkSize    = 1000
+	backupRestoreBatchSize = 500
+)
+
+type postgresBackupHeader struct {
+	Format    string    `json:"format"`
+	Version   int       `json:"version"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+// postgresBackupRow 是「列名 → JSON 值」的一行。
+//
+// 刻意逐列反射序列化，而不是直接 json.Marshal 模型结构体：模型里有大量带
+// json:"-" 的列（Base.DeletedAt、User.AllowedLibraryIDs、APIConfig.APIKey、
+// StrmAccount.Config、PlayProfile.PINHash、ReaderBookSource.RawJSON…），走结构体
+// 自带的序列化会把这些列整列丢掉——软删除行会在恢复后「复活」，加密后的第三方
+// 密钥与 PIN 会全部丢失。
+type postgresBackupRow map[string]json.RawMessage
+
+type postgresBackupChunk struct {
+	Table string              `json:"table"`
+	Rows  []postgresBackupRow `json:"rows"`
+}
+
+// parseModelSchema 返回模型对应的表名与 GORM schema（逐列反射所需）。
+func parseModelSchema(db *gorm.DB, m any) (table string, sch *schema.Schema, err error) {
+	stmt := &gorm.Statement{DB: db}
+	if err := stmt.Parse(m); err != nil {
+		return "", nil, err
+	}
+	return stmt.Schema.Table, stmt.Schema, nil
+}
+
+// postgresBackupModelSchemas 返回「表名 → 模型 schema / 结构体类型」，用于把备份
+// 里的行还原成 GORM 能插入的具体类型。
+func postgresBackupModelSchemas(db *gorm.DB) (map[string]*schema.Schema, map[string]reflect.Type, error) {
+	schemas := make(map[string]*schema.Schema, len(model.AllModels()))
+	types := make(map[string]reflect.Type, len(model.AllModels()))
+	for _, m := range model.AllModels() {
+		table, sch, err := parseModelSchema(db, m)
+		if err != nil {
+			return nil, nil, err
+		}
+		schemas[table] = sch
+		types[table] = reflect.TypeOf(m).Elem()
+	}
+	return schemas, types, nil
+}
+
+// createPostgresBackup 把全库导出成一个 gzip 压缩的 JSON Lines 文件。
+func (b *BackupService) createPostgresBackup(ctx context.Context, stamp string) (string, error) {
+	dst := filepath.Join(b.backupDir(), "mebox_"+stamp+postgresBackupSuffix)
+	file, err := os.OpenFile(dst, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)
+	if err != nil {
+		return "", err
+	}
+	complete := false
+	defer func() {
+		_ = file.Close()
+		if !complete {
+			// 半截备份文件比没有备份更危险：留着会让人以为有可用的还原点。
+			_ = os.Remove(dst)
+		}
+	}()
+
+	zw := gzip.NewWriter(file)
+	enc := json.NewEncoder(zw)
+	if err := enc.Encode(postgresBackupHeader{
+		Format:    postgresBackupFormat,
+		Version:   postgresBackupVersion,
+		CreatedAt: time.Now(),
+	}); err != nil {
+		return "", fmt.Errorf("写入备份头失败: %w", err)
+	}
+	for _, m := range model.AllModels() {
+		table, sch, err := parseModelSchema(b.db, m)
+		if err != nil {
+			return "", err
+		}
+		if !b.db.Migrator().HasTable(table) {
+			continue
+		}
+		if err := b.dumpPostgresTable(ctx, m, sch, table, enc); err != nil {
+			return "", err
+		}
+	}
+	if err := zw.Close(); err != nil {
+		return "", fmt.Errorf("压缩备份失败: %w", err)
+	}
+	if err := file.Sync(); err != nil {
+		return "", fmt.Errorf("写入备份失败: %w", err)
+	}
+	complete = true
+	return dst, nil
+}
+
+// dumpPostgresTable 按主键分块导出一张表。FindInBatches 会自己按主键升序游标
+// 翻页（WHERE pk > last），不会像 OFFSET 分页那样在大表上做 O(n²) 扫描。
+func (b *BackupService) dumpPostgresTable(ctx context.Context, m any, sch *schema.Schema, table string, enc *json.Encoder) error {
+	// 软删除行也要备份：恢复后应还原成删除前的样子，而不是让它们「复活」。
+	slicePtr := reflect.New(reflect.SliceOf(reflect.TypeOf(m).Elem()))
+	err := b.db.WithContext(ctx).Unscoped().
+		FindInBatches(slicePtr.Interface(), backupDumpChunkSize, func(_ *gorm.DB, _ int) error {
+			rows, err := encodePostgresBackupRows(ctx, sch, slicePtr.Elem())
+			if err != nil {
+				return fmt.Errorf("编码表 %s 失败: %w", table, err)
+			}
+			return enc.Encode(postgresBackupChunk{Table: table, Rows: rows})
+		}).Error
+	if err != nil {
+		return fmt.Errorf("导出表 %s 失败: %w", table, err)
+	}
+	return nil
+}
+
+// backupPersistableFields 返回真正对应数据库列的字段。
+//
+// GORM 的 Schema.Fields 里还带着 gorm:"-" 的字段（例如 User.AllowedLibraryList、
+// LibraryTagList），它们的 DBName 是空字符串。不过滤的话多个「列」会共用空键：
+// 编码时互相覆盖，解码时把某个字段的值写到另一个字段上，报出
+// 「cannot unmarshal number into Go value of type []string」这类与真实数据无关的错。
+func backupPersistableFields(sch *schema.Schema) []*schema.Field {
+	out := make([]*schema.Field, 0, len(sch.Fields))
+	for _, field := range sch.Fields {
+		if field.DBName == "" {
+			continue
+		}
+		out = append(out, field)
+	}
+	return out
+}
+
+// encodePostgresBackupRows 逐列反射序列化一个批次。
+func encodePostgresBackupRows(ctx context.Context, sch *schema.Schema, slice reflect.Value) ([]postgresBackupRow, error) {
+	fields := backupPersistableFields(sch)
+	rows := make([]postgresBackupRow, 0, slice.Len())
+	for i := 0; i < slice.Len(); i++ {
+		element := slice.Index(i)
+		row := make(postgresBackupRow, len(fields))
+		for _, field := range fields {
+			value := field.ReflectValueOf(ctx, element)
+			if !value.IsValid() {
+				continue
+			}
+			raw, err := json.Marshal(value.Interface())
+			if err != nil {
+				return nil, fmt.Errorf("列 %s: %w", field.DBName, err)
+			}
+			row[field.DBName] = raw
+		}
+		rows = append(rows, row)
+	}
+	return rows, nil
+}
+
+// decodePostgresBackupRows 把「列名 → JSON 值」还原成可直接插入的具体切片。
+func decodePostgresBackupRows(ctx context.Context, sch *schema.Schema, modelType reflect.Type, rows []postgresBackupRow) (any, error) {
+	fields := backupPersistableFields(sch)
+	slice := reflect.MakeSlice(reflect.SliceOf(modelType), len(rows), len(rows))
+	for i, row := range rows {
+		element := slice.Index(i)
+		for _, field := range fields {
+			raw, ok := row[field.DBName]
+			if !ok {
+				continue
+			}
+			holder := reflect.New(field.FieldType)
+			if err := json.Unmarshal(raw, holder.Interface()); err != nil {
+				return nil, fmt.Errorf("列 %s: %w", field.DBName, err)
+			}
+			if err := field.Set(ctx, element, holder.Elem().Interface()); err != nil {
+				return nil, fmt.Errorf("列 %s: %w", field.DBName, err)
+			}
+		}
+	}
+	return slice.Interface(), nil
+}
+
+// restorePostgresBackup 用逻辑备份重建全库。
+func (b *BackupService) restorePostgresBackup(ctx context.Context, src string) error {
+	file, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer file.Close()
+	zr, err := gzip.NewReader(file)
+	if err != nil {
+		return fmt.Errorf("备份文件不是有效的 gzip: %w", err)
+	}
+	defer zr.Close()
+
+	dec := json.NewDecoder(zr)
+	var header postgresBackupHeader
+	if err := dec.Decode(&header); err != nil {
+		return fmt.Errorf("备份头损坏: %w", err)
+	}
+	if header.Format != postgresBackupFormat || header.Version != postgresBackupVersion {
+		return fmt.Errorf("不支持的备份格式 %q (v%d)", header.Format, header.Version)
+	}
+	schemas, modelTypes, err := postgresBackupModelSchemas(b.db)
+	if err != nil {
+		return err
+	}
+
+	// 恢复必须在单个事务里完成：清空成功后中途失败若不回滚，库就空了。
+	return b.db.WithContext(ctx).Transaction(func(tx *gorm.DB) error {
+		// 逆序清空，保证 library_roots → libraries 这类外键先删子表。
+		models := model.AllModels()
+		for i := len(models) - 1; i >= 0; i-- {
+			m := models[i]
+			if !tx.Migrator().HasTable(m) {
+				continue
+			}
+			if err := tx.Session(&gorm.Session{AllowGlobalUpdate: true}).Unscoped().Delete(m).Error; err != nil {
+				return fmt.Errorf("清空表失败: %w", err)
+			}
+		}
+		for {
+			var chunk postgresBackupChunk
+			decodeErr := dec.Decode(&chunk)
+			if errors.Is(decodeErr, io.EOF) {
+				return nil
+			}
+			if decodeErr != nil {
+				return fmt.Errorf("备份文件损坏: %w", decodeErr)
+			}
+			sch, ok := schemas[chunk.Table]
+			if !ok {
+				return fmt.Errorf("备份包含未知表 %s，可能来自不兼容的版本", chunk.Table)
+			}
+			if len(chunk.Rows) == 0 {
+				continue
+			}
+			rows, err := decodePostgresBackupRows(ctx, sch, modelTypes[chunk.Table], chunk.Rows)
+			if err != nil {
+				return fmt.Errorf("表 %s 解码失败: %w", chunk.Table, err)
+			}
+			if err := tx.Unscoped().CreateInBatches(rows, backupRestoreBatchSize).Error; err != nil {
+				return fmt.Errorf("恢复表 %s 失败: %w", chunk.Table, err)
+			}
+		}
+	})
+}

internal/service/backup_postgres_test.go

@@ -0,0 +1,226 @@
+package service
+
+import (
+	"compress/gzip"
+	"context"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"go.uber.org/zap"
+
+	"github.com/truewhile/MeBox/internal/config"
+	"github.com/truewhile/MeBox/internal/model"
+)
+
+func newBackupTestService(t *testing.T) (*BackupService, *config.Config) {
+	t.Helper()
+	cfg := &config.Config{}
+	cfg.App.DataDir = t.TempDir()
+	db := newServiceTestDB(t)
+	svc := &BackupService{cfg: cfg, log: zap.NewNop(), db: db}
+	// Create 会先建目录；直接调各方言的 create* 助手时需要它已存在。
+	if err := os.MkdirAll(svc.backupDir(), 0o750); err != nil {
+		t.Fatal(err)
+	}
+	return svc, cfg
+}
+
+// TestPostgresLogicalBackupRoundTrip 验证「备份 → 改库 → 恢复」后整库回到备份时的
+// 样子，包括软删除行与 json:"-" 的列。
+//
+// 逻辑备份/恢复本身是方言无关的 GORM 代码（PostgreSQL 专有的只有文件后缀与
+// isPostgres() 分派），所以可以直接在 SQLite 上跑。
+func TestPostgresLogicalBackupRoundTrip(t *testing.T) {
+	svc, _ := newBackupTestService(t)
+	ctx := context.Background()
+	db := svc.db
+
+	lib := model.Library{Base: model.Base{ID: "lib-1"}, Name: "Movies", Path: "/media/movies", Type: "movie", Enabled: true}
+	if err := db.Create(&lib).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&model.LibraryRoot{Base: model.Base{ID: "root-1"}, LibraryID: lib.ID, Path: "/media/movies"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&model.Media{Base: model.Base{ID: "m-keep"}, LibraryID: lib.ID, Title: "Keep", Path: "/media/movies/keep.mkv"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&model.Media{Base: model.Base{ID: "m-gone"}, LibraryID: lib.ID, Title: "Gone", Path: "/media/movies/gone.mkv"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Delete(&model.Media{}, "id = ?", "m-gone").Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&model.Setting{Key: "k", Value: "v"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	// 下面这些列都带 json:"-"：走结构体自带的 JSON 序列化会被整列丢掉，
+	// 恢复之后用户权限、置顶库、加密后的密钥会一起消失。
+	user := model.User{
+		Base:                 model.Base{ID: "u-1"},
+		Username:             "alice",
+		PasswordHash:         "hash",
+		Role:                 "user",
+		AllowedLibraryIDs:    `["lib-1"]`,
+		PinnedLibraryIDs:     `["lib-1"]`,
+		HideAdult:            true,
+		IsActive:             true,
+		DanmakuEnabled:       true,
+		PlayerVr360GuideSeen: true,
+	}
+	if err := db.Create(&user).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&model.APIConfig{Base: model.Base{ID: "cfg-1"}, Provider: "tmdb", APIKey: "ciphertext", Enabled: true}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	dump, err := svc.createPostgresBackup(ctx, "20260101_000000")
+	if err != nil {
+		t.Fatalf("createPostgresBackup: %v", err)
+	}
+	if dump == "" {
+		t.Fatal("createPostgresBackup returned an empty path")
+	}
+
+	// 破坏当前数据：加一条备份里没有的、硬删一条备份里有的。
+	if err := db.Create(&model.Media{Base: model.Base{ID: "m-extra"}, LibraryID: lib.ID, Title: "Extra", Path: "/media/movies/extra.mkv"}).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Unscoped().Delete(&model.Media{}, "id = ?", "m-keep").Error; err != nil {
+		t.Fatal(err)
+	}
+
+	if err := svc.restorePostgresBackup(ctx, dump); err != nil {
+		t.Fatalf("restorePostgresBackup: %v", err)
+	}
+
+	var ids []string
+	if err := db.Unscoped().Model(&model.Media{}).Order("id asc").Pluck("id", &ids).Error; err != nil {
+		t.Fatal(err)
+	}
+	if want := []string{"m-gone", "m-keep"}; !reflect.DeepEqual(ids, want) {
+		t.Fatalf("media ids after restore = %v, want %v", ids, want)
+	}
+
+	// 软删除状态必须原样还原，而不是被「复活」。
+	var gone model.Media
+	if err := db.Unscoped().First(&gone, "id = ?", "m-gone").Error; err != nil {
+		t.Fatal(err)
+	}
+	if !gone.DeletedAt.Valid {
+		t.Fatal("soft-deleted media was revived by restore")
+	}
+	var live int64
+	if err := db.Model(&model.Media{}).Where("id = ?", "m-keep").Count(&live).Error; err != nil {
+		t.Fatal(err)
+	}
+	if live != 1 {
+		t.Fatalf("live media count = %d, want 1", live)
+	}
+
+	var value string
+	if err := db.Model(&model.Setting{}).Where("key = ?", "k").Select("value").Scan(&value).Error; err != nil {
+		t.Fatal(err)
+	}
+	if value != "v" {
+		t.Fatalf("setting value = %q, want v", value)
+	}
+	var libCount int64
+	if err := db.Model(&model.Library{}).Count(&libCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if libCount != 1 {
+		t.Fatalf("library count = %d, want 1", libCount)
+	}
+	var rootCount int64
+	if err := db.Model(&model.LibraryRoot{}).Count(&rootCount).Error; err != nil {
+		t.Fatal(err)
+	}
+	if rootCount != 1 {
+		t.Fatalf("library root count = %d, want 1", rootCount)
+	}
+
+	// json:"-" 的列必须同样被备份：它们是权限与凭据，丢了比丢一条媒体严重得多。
+	var restoredUser model.User
+	if err := db.First(&restoredUser, "id = ?", "u-1").Error; err != nil {
+		t.Fatal(err)
+	}
+	if restoredUser.PasswordHash != "hash" {
+		t.Fatalf("password hash = %q, want hash", restoredUser.PasswordHash)
+	}
+	if restoredUser.AllowedLibraryIDs != `["lib-1"]` {
+		t.Fatalf(`allowed library ids = %q, want ["lib-1"]`, restoredUser.AllowedLibraryIDs)
+	}
+	if restoredUser.PinnedLibraryIDs != `["lib-1"]` {
+		t.Fatalf(`pinned library ids = %q, want ["lib-1"]`, restoredUser.PinnedLibraryIDs)
+	}
+	if !restoredUser.HideAdult || !restoredUser.IsActive || !restoredUser.DanmakuEnabled || !restoredUser.PlayerVr360GuideSeen {
+		t.Fatalf("boolean columns lost: %+v", restoredUser)
+	}
+
+	var restoredConfig model.APIConfig
+	if err := db.First(&restoredConfig, "id = ?", "cfg-1").Error; err != nil {
+		t.Fatal(err)
+	}
+	if restoredConfig.APIKey != "ciphertext" {
+		t.Fatalf("api key = %q, want ciphertext", restoredConfig.APIKey)
+	}
+}
+
+// TestRestorePostgresBackupKeepsDataOnCorruptFile 验证损坏的备份不会在回滚后留下
+// 半清空的库：恢复是先清空再插入，必须整体在一个事务里，否则中途失败就把库清掉了。
+func TestRestorePostgresBackupKeepsDataOnCorruptFile(t *testing.T) {
+	svc, _ := newBackupTestService(t)
+	ctx := context.Background()
+	if err := svc.db.Create(&model.Setting{Key: "keep", Value: "me"}).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	corrupt := filepath.Join(t.TempDir(), "broken.json.gz")
+	file, err := os.Create(corrupt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	zw := gzip.NewWriter(file)
+	// 头部完整、正文半截：解码在清空表之后才会失败。
+	if _, err := zw.Write([]byte(
+		`{"format":"mebox-postgres-logical","version":1,"created_at":"2026-01-01T00:00:00Z"}` + "\n" +
+			`{"table":"media","rows":[`)); err != nil {
+		t.Fatal(err)
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := file.Close(); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := svc.restorePostgresBackup(ctx, corrupt); err == nil {
+		t.Fatal("corrupt backup should fail to restore")
+	}
+
+	var value string
+	if err := svc.db.Model(&model.Setting{}).Where("key = ?", "keep").Select("value").Scan(&value).Error; err != nil {
+		t.Fatal(err)
+	}
+	if value != "me" {
+		t.Fatalf("a failed restore wiped the database: settings keep = %q", value)
+	}
+}
+
+// TestRestoreRejectsBackupFromOtherDialect 验证备份文件与当前方言不匹配时给出明确
+// 错误，而不是把 SQLite 文件写到 PostgreSQL 部署的库路径上（那是原实现的隐患）。
+func TestRestoreRejectsBackupFromOtherDialect(t *testing.T) {
+	svc, _ := newBackupTestService(t)
+	pgStyle := filepath.Join(svc.backupDir(), "mebox_20260101_000000.json.gz")
+	if err := os.WriteFile(pgStyle, []byte("not-gzip"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	// SQLite 路径下不允许恢复 PostgreSQL 逻辑备份。
+	if err := svc.Restore(context.Background(), filepath.Base(pgStyle)); err == nil {
+		t.Fatal("SQLite restore accepted a PostgreSQL logical backup")
+	}
+}

internal/service/emby_episodic_path_test.go

@@ -0,0 +1,82 @@
+package service
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/truewhile/MeBox/internal/model"
+)
+
+// TestLikelyEpisodicPathSQLNormalisesSeparator 守住剧集路径判定的转义差异。
+//
+// 此前 embyLikelyEpisodicPathSQL 会额外生成一份反斜杠模式
+// （strings.ReplaceAll(pattern, "/", `\`)）。PostgreSQL 的 LIKE 默认就把反斜杠
+// 当转义符，模式结尾的 `\%` 被解析成「字面百分号」而不是「反斜杠 + 通配符」，
+// 那些模式在 PostgreSQL 下永不命中；SQLite 没有默认转义符所以一直正常。
+// 现在统一在 SQL 里把分隔符归一化成 '/'，模式本身不再含反斜杠。
+func TestLikelyEpisodicPathSQLNormalisesSeparator(t *testing.T) {
+	clause, args := embyLikelyEpisodicPathSQL()
+	if !strings.Contains(clause, "REPLACE(media.path") {
+		t.Fatalf("clause no longer normalises the path separator:\n%s", clause)
+	}
+	if got := strings.Count(clause, "LIKE ?"); got != len(args) {
+		t.Fatalf("clause has %d placeholders but %d args:\n%s", got, len(args), clause)
+	}
+	for _, arg := range args {
+		pattern, ok := arg.(string)
+		if !ok {
+			t.Fatalf("unexpected pattern type %T", arg)
+		}
+		if strings.Contains(pattern, `\`) {
+			t.Fatalf("pattern %q still contains a backslash; PostgreSQL's LIKE would treat it as an escape character", pattern)
+		}
+		if !strings.Contains(pattern, "/") {
+			t.Fatalf("pattern %q lost its separator", pattern)
+		}
+	}
+}
+
+// TestFilterLikelyEpisodicPathsHandlesWindowsStylePaths 验证反斜杠路径（Windows
+// 宿主机入库的媒体）仍然被判成剧集并从电影库查询里排除。
+func TestFilterLikelyEpisodicPathsHandlesWindowsStylePaths(t *testing.T) {
+	db := newServiceTestDB(t)
+	episodic := model.Media{
+		Base:       model.Base{ID: "ep-1"},
+		Path:       `D:\Media\国产剧\我的剧\Season 1\我的剧 - S01E01.mkv`,
+		SeasonNum:  1,
+		EpisodeNum: 1,
+	}
+	movie := model.Media{
+		Base: model.Base{ID: "mv-1"},
+		Path: `D:\Media\电影\某电影\某电影.mkv`,
+	}
+	if err := db.Create(&episodic).Error; err != nil {
+		t.Fatal(err)
+	}
+	if err := db.Create(&movie).Error; err != nil {
+		t.Fatal(err)
+	}
+
+	q := filterLikelyEpisodicPathsFromMovieQuery(
+		db.Model(&model.Media{}).Where("season_num > 0 OR episode_num > 0"),
+	)
+	var rows []model.Media
+	if err := q.Find(&rows).Error; err != nil {
+		t.Fatal(err)
+	}
+	if len(rows) != 0 {
+		t.Fatalf("windows-style episodic path was not excluded, got %d rows", len(rows))
+	}
+
+	// 反证：电影类型的行必须保留。
+	var kept []model.Media
+	keepQ := filterLikelyEpisodicPathsFromMovieQuery(
+		db.Model(&model.Media{}).Where("path LIKE ?", `D:\Media\电影\%`),
+	)
+	if err := keepQ.Find(&kept).Error; err != nil {
+		t.Fatal(err)
+	}
+	if len(kept) != 1 || kept[0].ID != "mv-1" {
+		t.Fatalf("plain movie row was dropped from the movie query: %+v", kept)
+	}
+}

internal/service/emby_items_list.go

@@ -7,6 +7,7 @@ import (
 	"time"
 
 	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/repository"
 )
 
 func (e *EmbyService) mediaItems(ctx context.Context, p ItemsParams) (map[string]any, error) {
@@ -21,7 +22,11 @@ func (e *EmbyService) mediaItems(ctx context.Context, p ItemsParams) (map[string
 		q = q.Where("library_id IN ? OR series_id = ?", e.mergedLibraryIDs(ctx, p.ParentID), p.ParentID)
 	}
 	if p.SearchTerm != "" {
-		q = q.Where("title LIKE ? OR original_name LIKE ?", "%"+p.SearchTerm+"%", "%"+p.SearchTerm+"%")
+		// ILIKE（PostgreSQL）/ LIKE（SQLite）由方言决定，避免换库后搜索词
+		// 大小写不匹配就搜不到结果。
+		likeOp := repository.LikeOperator(e.repo.DB)
+		term := "%" + p.SearchTerm + "%"
+		q = q.Where("title "+likeOp+" ? OR original_name "+likeOp+" ?", term, term)
 	}
 	if containsEmbyFilter(p.Filters, "IsFavorite") {
 		if strings.TrimSpace(p.UserID) == "" {
@@ -264,7 +269,11 @@ func (e *EmbyService) seriesItemsForLibrary(ctx context.Context, libraryID strin
 		q = q.Where("library_id IN ?", e.mergedLibraryIDs(ctx, libraryID))
 	}
 	if p.SearchTerm != "" {
-		q = q.Where("title LIKE ? OR original_name LIKE ?", "%"+p.SearchTerm+"%", "%"+p.SearchTerm+"%")
+		// ILIKE（PostgreSQL）/ LIKE（SQLite）由方言决定，避免换库后搜索词
+		// 大小写不匹配就搜不到结果。
+		likeOp := repository.LikeOperator(e.repo.DB)
+		term := "%" + p.SearchTerm + "%"
+		q = q.Where("title "+likeOp+" ? OR original_name "+likeOp+" ?", term, term)
 	}
 	if containsEmbyFilter(p.Filters, "IsFavorite") {
 		if strings.TrimSpace(p.UserID) == "" {

internal/service/emby_movie_items.go

@@ -9,6 +9,7 @@ import (
 	"gorm.io/gorm"
 
 	"github.com/truewhile/MeBox/internal/model"
+	"github.com/truewhile/MeBox/internal/repository"
 )
 
 // movieLibraryHasEpisodicContent 报告电影类型库里是否混入了「剧集结构」内容
@@ -51,7 +52,11 @@ func (e *EmbyService) movieLibraryItems(ctx context.Context, p ItemsParams) (map
 		q = e.applyUserMediaVisibility(ctx, q, p.UserID)
 		q = q.Where("library_id IN ?", libIDs)
 		if p.SearchTerm != "" {
-			q = q.Where("title LIKE ? OR original_name LIKE ?", "%"+p.SearchTerm+"%", "%"+p.SearchTerm+"%")
+			// 方言相关的 ILIKE/LIKE：PostgreSQL 的 LIKE 区分大小写，
+			// 直接用 LIKE 会让客户端搜索的大小写与入库标题不一致时搜不到。
+			likeOp := repository.LikeOperator(e.repo.DB)
+			term := "%" + p.SearchTerm + "%"
+			q = q.Where("title "+likeOp+" ? OR original_name "+likeOp+" ?", term, term)
 		}
 		if containsEmbyFilter(p.Filters, "IsFavorite") {
 			if strings.TrimSpace(p.UserID) == "" {
@@ -266,6 +271,14 @@ func filterLikelyEpisodicPathsFromMovieQuery(q *gorm.DB) *gorm.DB {
 	return q.Where("NOT ((media.season_num > 0 OR media.episode_num > 0) AND ("+clause+"))", args...)
 }
 
+// embyEpisodicPathExpr 把路径分隔符归一化成 '/' 后再小写化，供剧集路径判定使用。
+//
+// 反斜杠归一化必须放在 SQL 里做，而不是再生成一份反斜杠模式：PostgreSQL 的
+// LIKE 默认就把反斜杠当转义符，模式结尾的 `\%` 会被解析成「字面百分号」而不是
+// 「反斜杠 + 通配符」，那些模式在 PostgreSQL 下永不命中（SQLite 没有默认转义符，
+// 所以只有换库之后才会暴露）。归一化列值后两种方言结果一致。
+const embyEpisodicPathExpr = `LOWER(REPLACE(media.path, '\', '/'))`
+
 func embyLikelyEpisodicPathSQL() (string, []any) {
 	patterns := []string{
 		"%/season %/%", "%/season.%/%", "%/season-%/%", "%/season_%/%",
@@ -274,15 +287,11 @@ func embyLikelyEpisodicPathSQL() (string, []any) {
 		"%/电视剧/%", "%/剧集/%", "%/连续剧/%", "%/短剧/%", "%/国产剧/%", "%/国剧/%", "%/大陆剧/%", "%/华语剧/%", "%/国产电视剧/%", "%/大陆电视剧/%", "%/华语电视剧/%", "%/欧美剧/%", "%/欧美电视剧/%", "%/美剧/%", "%/英剧/%", "%/日韩剧/%", "%/日韩电视剧/%", "%/日剧/%", "%/韩剧/%", "%/港剧/%", "%/台剧/%", "%/港台剧/%", "%/泰剧/%",
 		"%/日番/%", "%/国漫/%", "%/番剧/%", "%/动漫/%", "%/特别篇/%", "%/特別篇/%", "%/番外/%", "%/特典/%",
 	}
-	clauses := make([]string, 0, len(patterns)*2)
-	args := make([]any, 0, len(patterns)*2)
+	clauses := make([]string, 0, len(patterns))
+	args := make([]any, 0, len(patterns))
 	for _, pattern := range patterns {
-		clauses = append(clauses, "LOWER(media.path) LIKE ?")
+		clauses = append(clauses, embyEpisodicPathExpr+" LIKE ?")
 		args = append(args, pattern)
-		if strings.Contains(pattern, "/") {
-			clauses = append(clauses, "LOWER(media.path) LIKE ?")
-			args = append(args, strings.ReplaceAll(pattern, "/", `\`))
-		}
 	}
 	return strings.Join(clauses, " OR "), args
 }

internal/service/local_availability.go

@@ -50,9 +50,12 @@ func LookupLocalAvailability(ctx context.Context, repo *repository.Container, ti
 		return out
 	}
 	like := "%" + query + "%"
+	// 方言相关的 ILIKE/LIKE：PostgreSQL 下用 LIKE 会因标题大小写与查询不一致而
+	// 漏判「本地已有该剧」，进而反复提示订阅缺失。
+	likeOp := repository.LikeOperator(repo.DB)
 	var rows []model.Media
 	if err := repo.DB.WithContext(ctx).
-		Where("title LIKE ? OR original_name LIKE ? OR path LIKE ?", like, like, like).
+		Where("title "+likeOp+" ? OR original_name "+likeOp+" ? OR path "+likeOp+" ?", like, like, like).
 		Order("season_num asc, episode_num asc, episode_fraction asc, created_at desc").
 		Limit(2000).
 		Find(&rows).Error; err != nil {