update

db/migrations/2026-09-22-01-single-table-publish.sql

@@ -18,7 +18,11 @@ ALTER TABLE street_snaps
   ADD COLUMN IF NOT EXISTS status        varchar(16)  NOT NULL DEFAULT 'pending',
   ADD COLUMN IF NOT EXISTS job_id        bigint       NOT NULL DEFAULT 0,
   ADD COLUMN IF NOT EXISTS reviewer      varchar(64)  NOT NULL DEFAULT '',
-  ADD COLUMN IF NOT EXISTS reject_reason varchar(255) NOT NULL DEFAULT '';
+  ADD COLUMN IF NOT EXISTS reject_reason varchar(255) NOT NULL DEFAULT '',
+  -- 街拍标题中文化：保留既有 title 作英文源，仅加 title_cn 供后台人工翻译、前端按 locale 取用。
+  -- 与 brand_runways 用 title_en/title_cn 不同：street_snaps 上有 uq_ss_entity(city, year, COALESCE(title,''))，
+  -- 改名成本过高；pickLocale 在中文为空时回落英文，无需数据回灌。
+  ADD COLUMN IF NOT EXISTS title_cn      text         NOT NULL DEFAULT '';
 
 -- 2) 存量行置已发布**不在本文件里**：它是数据变更且只能执行一次，见同目录
 --    2026-09-22-01b-publish-existing-rows.sql。
@@ -31,14 +35,20 @@ CREATE INDEX IF NOT EXISTS idx_br_status ON brand_runways (status);
 CREATE INDEX IF NOT EXISTS idx_ss_status ON street_snaps  (status);
 
 -- 4) 公开只读视图：把「必须是已发布且未删除」固化成结构性保证，公开查询漏写过滤成为不可能。
---    注意：视图列集被 SELECT * 冻结 —— 以后给这 4 张基表加列，必须同批重建视图。
+--    视图列集显式枚举（非 SELECT *）：只暴露对外需要的列，刻意排除审核/溯源列
+--    （job_id / reviewer / reject_reason），避免敏感列随基表加列被无意暴露到公开读路径。
+--    图片子视图仍取 i.*（图片表无敏感列）；改动基表列集时按本文件同批重建视图。
 DROP VIEW IF EXISTS public_brand_runway_images;
 DROP VIEW IF EXISTS public_brand_runways;
 DROP VIEW IF EXISTS public_street_snap_images;
 DROP VIEW IF EXISTS public_street_snaps;
 
 CREATE VIEW public_brand_runways AS
-  SELECT * FROM brand_runways WHERE status = 'published' AND is_deleted = 0;
+  SELECT
+    id, brand_id, title_en, title_cn, description_en, description_cn,
+    cover, image_count, year, collection_type, season, season_code,
+    status, is_deleted, created_at, updated_at
+  FROM brand_runways WHERE status = 'published' AND is_deleted = 0;
 
 CREATE VIEW public_brand_runway_images AS
   SELECT i.* FROM brand_runway_images i
@@ -46,7 +56,10 @@ CREATE VIEW public_brand_runway_images AS
   WHERE i.is_deleted = 0 AND r.status = 'published' AND r.is_deleted = 0;
 
 CREATE VIEW public_street_snaps AS
-  SELECT * FROM street_snaps WHERE status = 'published' AND is_deleted = 0;
+  SELECT
+    id, title, title_cn, year, city, cover, image_count,
+    status, is_deleted, created_at, updated_at
+  FROM street_snaps WHERE status = 'published' AND is_deleted = 0;
 
 CREATE VIEW public_street_snap_images AS
   SELECT i.* FROM street_snap_images i