feat: 消息通知中心 + 账号安全体系 + Bug修复
## 新增功能 ### 消息通知中心 (全新模块) - 新增 MessageController / NotificationService / NotificationRepo - SSR 消息页面 (/messages)：左侧边栏 + 右侧卡片列表，noindex 元标签 - 通知能力：列表分页、单条标为已读、一键全部标为已读 - 未读数角标 (1/66/99+)：侧边栏 + 导航栏铃铛图标 - 导航栏轮询 /api/messages/unread 每 60 秒刷新未读数 - 审核通过/驳回时自动 fire-and-forget 推送通知 ### 密码修改 - ChangePassword：验证当前密码 → 新密码强度校验(8位+字母+数字) → 哈希更新 - 修改后递增 token_version 强制所有设备退登 ### 账号自助注销 - DeleteAccount：验证密码 → 设置 deleted 状态 → 记录原因 → 吊销 JWT - 注销后登录二次确认：Login 检测 deleted → 返回 confirm_restore - ConfirmRestore 恢复账号，重新签发 token - 注销页文案："账号将在 7 天后正式注销，期间可随时重新登录恢复" ### IP 审计记录 - 注册时记录 RegIP，登录时记录 LastLoginIP + LastLoginAt - clientIP() 支持 X-Forwarded-For / X-Real-IP 反向代理 ### 安全加固 - Login 防时序攻击：用户不存在时仍执行完整 bcrypt 比对 - FindByEmail 改用 Unscoped() 覆盖软删除用户 - 站长 (owner) 不允许自主注销，避免权限体系死锁 ## Bug 修复 1. 注销按钮不触发：JS IIFE 中 profile 代码 return 阻塞了 account 标签页处理器注册 → 拆分为两层 IIFE，profile 放在内层 2. label 缺少 for 属性导致控制台警告 → 全部补充 for 属性 3. 注销后未自动退登：DeleteAccount 只设状态未吊销 JWT → 末尾加 InvalidateSessions 4. 退登后重定向 500 panic：authenticateToken 中 err||versionMismatch 合并判断 在 err=nil 但版本不匹配时返回 (nil,nil) → 拆为两个独立判断 injectUserContext 增加 claims==nil / 类型断言空安全守卫 5. 注销后登录直接提示"登录成功"：FindByEmail 默认 scope 排除软删除记录 → 改用 Unscoped() ## 文件变更 - 新建 17 个文件 (消息/审核/站点设置完整模块) - 修改 25 个文件 (认证/设置/中间件/前端) - 统计：+3229 / -161，42 files changed
This commit is contained in:
@ -22,4 +22,16 @@ var (
|
||||
ErrRateLimitIP = errors.New("请求过于频繁，请稍后重试")
|
||||
ErrRateLimitRegisterIP = errors.New("注册请求过于频繁，请稍后重试")
|
||||
ErrPermissionDenied = errors.New("权限不足")
|
||||
|
||||
// 审核相关
|
||||
ErrAuditNotFound = errors.New("审核记录不存在")
|
||||
ErrAuditNotPending = errors.New("该审核记录已处理")
|
||||
ErrAuditDisabled = errors.New("审核功能未开启")
|
||||
ErrAuditTypeOff = errors.New("该类型审核未开启")
|
||||
|
||||
// 密码 & 注销相关
|
||||
ErrIncorrectPassword = errors.New("当前密码错误")
|
||||
ErrLoginBeforeDelete = errors.New("请先登录再注销")
|
||||
ErrNeedsConfirmRestore = errors.New("需要二次确认恢复账号")
|
||||
ErrOwnerCannotDelete = errors.New("站长不可自主注销，请先转让站长权限")
|
||||
)
|
||||
|
||||
@ -42,6 +42,7 @@ func BuildAdminPageData(c *gin.Context, extra gin.H) gin.H {
|
||||
data["RoleDisplayName"] = roleStr
|
||||
}
|
||||
data["CanManageUsers"] = model.HasMinRole(roleStr, model.RoleAdmin)
|
||||
data["CanManageAudits"] = model.HasMinRole(roleStr, model.RoleAdmin)
|
||||
data["CanManageSettings"] = model.HasMinRole(roleStr, model.RoleOwner)
|
||||
data["IsOwner"] = model.HasMinRole(roleStr, model.RoleOwner)
|
||||
}
|
||||
|
||||
@ -16,6 +16,15 @@ type Config struct {
|
||||
JWT JWTConfig `mapstructure:"jwt"`
|
||||
Bcrypt BcryptConfig `mapstructure:"bcrypt"`
|
||||
Roles RolesConfig `mapstructure:"roles"`
|
||||
Audit AuditConfig `mapstructure:"audit"`
|
||||
}
|
||||
|
||||
// AuditConfig 审核系统配置（config.yaml 提供默认值，站点设置可运行时覆盖）
|
||||
type AuditConfig struct {
|
||||
Enabled bool `mapstructure:"enabled"`
|
||||
UsernameAudit bool `mapstructure:"username_audit"`
|
||||
AvatarAudit bool `mapstructure:"avatar_audit"`
|
||||
BioAudit bool `mapstructure:"bio_audit"`
|
||||
}
|
||||
|
||||
type ServerConfig struct {
|
||||
|
||||
109
internal/config/site_settings.go
Normal file
109
internal/config/site_settings.go
Normal file
@ -0,0 +1,109 @@
|
||||
package config
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
"sync"
|
||||
|
||||
"metazone.cc/metalab/internal/model"
|
||||
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// SiteSettings 站点设置管理器（DB 持久化 + 内存缓存，不重启生效）
|
||||
// 启动时从 DB 加载全量到内存，运行时读内存不查 DB，写入同步写 DB 和内存
|
||||
type SiteSettings struct {
|
||||
mu sync.RWMutex
|
||||
data map[string]string
|
||||
db *gorm.DB
|
||||
}
|
||||
|
||||
// NewSiteSettings 创建站点设置管理器并加载 DB 中已有配置
|
||||
func NewSiteSettings(db *gorm.DB) (*SiteSettings, error) {
|
||||
ss := &SiteSettings{
|
||||
data: make(map[string]string),
|
||||
db: db,
|
||||
}
|
||||
if err := ss.reload(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return ss, nil
|
||||
}
|
||||
|
||||
// reload 从 DB 加载全量设置到内存
|
||||
func (s *SiteSettings) reload() error {
|
||||
var rows []model.SiteSetting
|
||||
if err := s.db.Find(&rows).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
s.mu.Lock()
|
||||
defer s.mu.Unlock()
|
||||
for _, row := range rows {
|
||||
s.data[row.Key] = row.Value
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Get 读取一个字符串值，不存在返回默认值
|
||||
func (s *SiteSettings) Get(key, defaultVal string) string {
|
||||
s.mu.RLock()
|
||||
defer s.mu.RUnlock()
|
||||
val, ok := s.data[key]
|
||||
if !ok {
|
||||
return defaultVal
|
||||
}
|
||||
return val
|
||||
}
|
||||
|
||||
// GetBool 读取布尔值，不存在返回默认值（仅 "true" 字符串视为 true）
|
||||
func (s *SiteSettings) GetBool(key string, defaultVal bool) bool {
|
||||
s.mu.RLock()
|
||||
defer s.mu.RUnlock()
|
||||
val, ok := s.data[key]
|
||||
if !ok {
|
||||
return defaultVal
|
||||
}
|
||||
b, err := strconv.ParseBool(val)
|
||||
if err != nil {
|
||||
return defaultVal
|
||||
}
|
||||
return b
|
||||
}
|
||||
|
||||
// Set 写入设置（同步写 DB + 更新内存）
|
||||
func (s *SiteSettings) Set(key, value string) error {
|
||||
entry := model.SiteSetting{Key: key, Value: value}
|
||||
if err := s.db.Save(&entry).Error; err != nil {
|
||||
return err
|
||||
}
|
||||
s.mu.Lock()
|
||||
s.data[key] = value
|
||||
s.mu.Unlock()
|
||||
return nil
|
||||
}
|
||||
|
||||
// SetBool 写入布尔设置
|
||||
func (s *SiteSettings) SetBool(key string, value bool) error {
|
||||
return s.Set(key, strconv.FormatBool(value))
|
||||
}
|
||||
|
||||
// All 返回所有设置的快照（用于前端展示）
|
||||
func (s *SiteSettings) All() map[string]string {
|
||||
s.mu.RLock()
|
||||
defer s.mu.RUnlock()
|
||||
cp := make(map[string]string, len(s.data))
|
||||
for k, v := range s.data {
|
||||
cp[k] = v
|
||||
}
|
||||
return cp
|
||||
}
|
||||
|
||||
// IsAuditEnabled 审核总开关是否开启
|
||||
// 优先查站点设置 DB，若无则取 config.yaml 默认值
|
||||
func (s *SiteSettings) IsAuditEnabled() bool {
|
||||
return s.GetBool("audit.enabled", App.Audit.Enabled)
|
||||
}
|
||||
|
||||
// IsAuditTypeEnabled 某类型审核是否开启
|
||||
func (s *SiteSettings) IsAuditTypeEnabled(auditType string, defaultVal bool) bool {
|
||||
return s.GetBool("audit."+auditType, defaultVal)
|
||||
}
|
||||
140
internal/controller/admin/audit_controller.go
Normal file
140
internal/controller/admin/audit_controller.go
Normal file
@ -0,0 +1,140 @@
|
||||
package admin
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// AuditController 审核管理控制器
|
||||
type AuditController struct {
|
||||
auditService auditUseCase
|
||||
userRepo auditStatusProvider
|
||||
}
|
||||
|
||||
// NewAuditController 构造函数
|
||||
func NewAuditController(auditService auditUseCase, userRepo auditStatusProvider) *AuditController {
|
||||
return &AuditController{auditService: auditService, userRepo: userRepo}
|
||||
}
|
||||
|
||||
// AuditPage 审核管理页面
|
||||
func (ac *AuditController) AuditPage(c *gin.Context) {
|
||||
c.HTML(http.StatusOK, "admin/audit/index.html", common.BuildAdminPageData(c, gin.H{
|
||||
"Title": "审核管理",
|
||||
"ExtraCSS": "/admin/static/css/audit.css",
|
||||
"ExtraJS": "/admin/static/js/audit.js",
|
||||
"AuditTypes": model.AuditTypeNames,
|
||||
"AuditStatus": model.AuditStatusNames,
|
||||
}))
|
||||
}
|
||||
|
||||
// ListAudits 审核列表 API（分页 + 类型筛选）
|
||||
func (ac *AuditController) ListAudits(c *gin.Context) {
|
||||
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||
pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
|
||||
auditType := c.Query("type")
|
||||
status := c.Query("status")
|
||||
|
||||
// 默认查 pending
|
||||
if status == "" {
|
||||
status = model.AuditStatusPending
|
||||
}
|
||||
|
||||
result, err := ac.auditService.List(auditType, status, page, pageSize)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "查询失败")
|
||||
return
|
||||
}
|
||||
|
||||
// 为每个审核记录附加提交者的用户名
|
||||
type auditItem struct {
|
||||
model.AuditSubmission
|
||||
SubmitterUsername string `json:"submitter_username"`
|
||||
}
|
||||
|
||||
items := make([]auditItem, 0, len(result.Items))
|
||||
for _, a := range result.Items {
|
||||
item := auditItem{AuditSubmission: a}
|
||||
if user, err := ac.userRepo.FindByID(a.UserID); err == nil {
|
||||
item.SubmitterUsername = user.Username
|
||||
}
|
||||
items = append(items, item)
|
||||
}
|
||||
|
||||
common.Ok(c, gin.H{
|
||||
"items": items,
|
||||
"total": result.Total,
|
||||
"page": result.Page,
|
||||
})
|
||||
}
|
||||
|
||||
// Approve 通过审核
|
||||
func (ac *AuditController) Approve(c *gin.Context) {
|
||||
submissionID, err := parseIDParam(c.Param("id"))
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "无效的审核 ID")
|
||||
return
|
||||
}
|
||||
|
||||
reviewerID := c.GetUint("uid")
|
||||
if err := ac.auditService.Approve(reviewerID, submissionID); err != nil {
|
||||
handleAuditError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "审核通过")
|
||||
}
|
||||
|
||||
// Reject 拒绝审核
|
||||
func (ac *AuditController) Reject(c *gin.Context) {
|
||||
submissionID, err := parseIDParam(c.Param("id"))
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "无效的审核 ID")
|
||||
return
|
||||
}
|
||||
|
||||
var req struct {
|
||||
Reason string `json:"reason"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "参数错误")
|
||||
return
|
||||
}
|
||||
|
||||
reviewerID := c.GetUint("uid")
|
||||
if err := ac.auditService.Reject(reviewerID, submissionID, req.Reason); err != nil {
|
||||
handleAuditError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "已拒绝")
|
||||
}
|
||||
|
||||
// parseIDParam 从 URL 路径参数解析 uint ID
|
||||
func parseIDParam(s string) (uint, error) {
|
||||
id, err := strconv.ParseUint(s, 10, 64)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return uint(id), nil
|
||||
}
|
||||
|
||||
// handleAuditError 统一处理审核接口的 service 层错误
|
||||
func handleAuditError(c *gin.Context, err error) {
|
||||
switch err {
|
||||
case common.ErrAuditNotFound:
|
||||
common.Error(c, http.StatusNotFound, "审核记录不存在")
|
||||
case common.ErrAuditNotPending:
|
||||
common.Error(c, http.StatusBadRequest, "该审核记录已处理")
|
||||
case common.ErrUserNotFound:
|
||||
common.Error(c, http.StatusNotFound, "用户不存在")
|
||||
case common.ErrUsernameTaken:
|
||||
common.Error(c, http.StatusConflict, "该用户名已被其他用户占用，审批失败")
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
}
|
||||
}
|
||||
@ -1,6 +1,9 @@
|
||||
package admin
|
||||
|
||||
import "metazone.cc/metalab/internal/service"
|
||||
import (
|
||||
"metazone.cc/metalab/internal/model"
|
||||
"metazone.cc/metalab/internal/service"
|
||||
)
|
||||
|
||||
// adminUseCase AdminController 对 AdminService 的最小依赖（ISP：4 个方法）
|
||||
type adminUseCase interface {
|
||||
@ -9,3 +12,24 @@ type adminUseCase interface {
|
||||
ResetUserToken(operatorUID, targetUID uint) error
|
||||
CountUsers() (int64, error)
|
||||
}
|
||||
|
||||
// auditUseCase AuditController 对 AuditService 的最小依赖（ISP：4 个方法）
|
||||
type auditUseCase interface {
|
||||
List(auditType, status string, page, pageSize int) (*service.AuditListResult, error)
|
||||
Approve(reviewerID uint, submissionID uint) error
|
||||
Reject(reviewerID uint, submissionID uint, reason string) error
|
||||
}
|
||||
|
||||
// siteSettingUseCase SiteSettingController 对 SiteSettingService 的最小依赖（ISP：3 个方法）
|
||||
type siteSettingUseCase interface {
|
||||
GetSettings() map[string]string
|
||||
UpdateSetting(key, value string) error
|
||||
UpdateBoolSetting(key string, value bool) error
|
||||
GetAuditSettings(defaults *service.AuditDefaults) *service.AuditSettings
|
||||
}
|
||||
|
||||
// auditStatusProvider 审核控制器所需的用户信息查询（ISP）
|
||||
type auditStatusProvider interface {
|
||||
FindByID(id uint) (*model.User, error)
|
||||
FindByUsername(username string) (*model.User, error)
|
||||
}
|
||||
|
||||
103
internal/controller/admin/site_setting_controller.go
Normal file
103
internal/controller/admin/site_setting_controller.go
Normal file
@ -0,0 +1,103 @@
|
||||
package admin
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/service"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// SiteSettingController 站点设置控制器（仅 owner 可访问）
|
||||
type SiteSettingController struct {
|
||||
settingService siteSettingUseCase
|
||||
defaults *service.AuditDefaults
|
||||
}
|
||||
|
||||
// NewSiteSettingController 构造函数
|
||||
func NewSiteSettingController(settingService siteSettingUseCase, defaults *service.AuditDefaults) *SiteSettingController {
|
||||
return &SiteSettingController{settingService: settingService, defaults: defaults}
|
||||
}
|
||||
|
||||
// GetSettings 获取所有站点设置
|
||||
func (sc *SiteSettingController) GetSettings(c *gin.Context) {
|
||||
all := sc.settingService.GetSettings()
|
||||
audit := sc.settingService.GetAuditSettings(sc.defaults)
|
||||
common.Ok(c, gin.H{
|
||||
"all": all,
|
||||
"audit": audit,
|
||||
})
|
||||
}
|
||||
|
||||
// UpdateSetting 更新单项设置
|
||||
func (sc *SiteSettingController) UpdateSetting(c *gin.Context) {
|
||||
var req struct {
|
||||
Key string `json:"key" binding:"required"`
|
||||
Value string `json:"value"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "参数错误")
|
||||
return
|
||||
}
|
||||
|
||||
if err := sc.settingService.UpdateSetting(req.Key, req.Value); err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "保存失败")
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "设置已更新")
|
||||
}
|
||||
|
||||
// UpdateBoolSetting 更新布尔设置
|
||||
func (sc *SiteSettingController) UpdateBoolSetting(c *gin.Context) {
|
||||
var req struct {
|
||||
Key string `json:"key" binding:"required"`
|
||||
Value string `json:"value" binding:"required"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "参数错误")
|
||||
return
|
||||
}
|
||||
|
||||
v, err := service.ParseBool(req.Value)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "值必须为 true 或 false")
|
||||
return
|
||||
}
|
||||
|
||||
if err := sc.settingService.UpdateBoolSetting(req.Key, v); err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "保存失败")
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "设置已更新")
|
||||
}
|
||||
|
||||
// GetBoolSetting 获取单个布尔设置的当前值
|
||||
func (sc *SiteSettingController) GetBoolSetting(c *gin.Context) {
|
||||
key := c.Query("key")
|
||||
if key == "" {
|
||||
common.Error(c, http.StatusBadRequest, "缺少 key 参数")
|
||||
return
|
||||
}
|
||||
|
||||
defaultVal := c.DefaultQuery("default", "false")
|
||||
d, _ := strconv.ParseBool(defaultVal)
|
||||
|
||||
val := sc.settingService.GetAuditSettings(sc.defaults)
|
||||
// 简单键值查找
|
||||
switch key {
|
||||
case "audit.enabled":
|
||||
common.Ok(c, gin.H{"value": val.Enabled})
|
||||
case "audit.username_audit":
|
||||
common.Ok(c, gin.H{"value": val.UsernameAudit})
|
||||
case "audit.avatar_audit":
|
||||
common.Ok(c, gin.H{"value": val.AvatarAudit})
|
||||
case "audit.bio_audit":
|
||||
common.Ok(c, gin.H{"value": val.BioAudit})
|
||||
default:
|
||||
common.Ok(c, gin.H{"value": d})
|
||||
}
|
||||
}
|
||||
@ -90,7 +90,7 @@ func (ac *AuthController) Login(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, refreshToken, user, err := ac.authService.Login(req)
|
||||
accessToken, refreshToken, user, err := ac.authService.Login(req, ip)
|
||||
if err != nil {
|
||||
// 记录失败 → 两个维度各 +1
|
||||
if recordAccount != nil {
|
||||
@ -107,9 +107,13 @@ func (ac *AuthController) Login(c *gin.Context) {
|
||||
common.Error(c, http.StatusForbidden, "账号已被封禁")
|
||||
case common.ErrUserLocked:
|
||||
common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
|
||||
case common.ErrUserDeleted:
|
||||
// deleted 状态本应在 Login 中自动恢复，此 case 作为兜底
|
||||
common.Error(c, http.StatusForbidden, "该账号已申请注销，登录即自动恢复")
|
||||
case common.ErrNeedsConfirmRestore:
|
||||
// 注销账号登录 → 需要二次确认恢复
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"action": "confirm_restore",
|
||||
"message": "你的账号正在注销中，登录将中止注销流程",
|
||||
})
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
|
||||
}
|
||||
@ -124,6 +128,29 @@ func (ac *AuthController) Login(c *gin.Context) {
|
||||
common.OkWithMessage(c, user, "登录成功")
|
||||
}
|
||||
|
||||
// ConfirmRestore 二次确认恢复已注销账号
|
||||
func (ac *AuthController) ConfirmRestore(c *gin.Context) {
|
||||
var req model.LoginRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请检查输入")
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, refreshToken, user, err := ac.authService.ConfirmRestore(req, clientIP(c))
|
||||
if err != nil {
|
||||
switch err {
|
||||
case common.ErrInvalidCred:
|
||||
common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败，请稍后重试")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
|
||||
common.OkWithMessage(c, user, "账号已恢复，欢迎回来")
|
||||
}
|
||||
|
||||
// CheckEmail 检查邮箱是否已注册
|
||||
func (ac *AuthController) CheckEmail(c *gin.Context) {
|
||||
var req model.CheckEmailRequest
|
||||
@ -156,7 +183,7 @@ func (ac *AuthController) Register(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, refreshToken, user, err := ac.authService.Register(req)
|
||||
accessToken, refreshToken, user, err := ac.authService.Register(req, clientIP(c))
|
||||
if err != nil {
|
||||
if recordReg != nil {
|
||||
recordReg()
|
||||
|
||||
@ -5,10 +5,11 @@ import (
|
||||
"metazone.cc/metalab/internal/model"
|
||||
)
|
||||
|
||||
// authUseCase AuthController 对 AuthService 的最小依赖（ISP：3 个方法）
|
||||
// authUseCase AuthController 对 AuthService 的最小依赖（ISP：4 个方法）
|
||||
type authUseCase interface {
|
||||
Register(req model.RegisterRequest) (string, string, *model.User, error)
|
||||
Login(req model.LoginRequest) (string, string, *model.User, error)
|
||||
Register(req model.RegisterRequest, regIP string) (string, string, *model.User, error)
|
||||
Login(req model.LoginRequest, loginIP string) (string, string, *model.User, error)
|
||||
ConfirmRestore(req model.LoginRequest, loginIP string) (string, string, *model.User, error)
|
||||
CheckEmail(email string) (bool, error)
|
||||
}
|
||||
|
||||
|
||||
129
internal/controller/message_controller.go
Normal file
129
internal/controller/message_controller.go
Normal file
@ -0,0 +1,129 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// notifProvider MessageController 所需的通知服务接口（ISP：5 个方法）
|
||||
type notifProvider interface {
|
||||
List(userID uint, page, pageSize int) (*model.NotificationListResult, error)
|
||||
CountUnread(userID uint) (int64, error)
|
||||
MarkRead(id, userID uint) error
|
||||
MarkAllRead(userID uint) error
|
||||
}
|
||||
|
||||
// MessageController 消息中心控制器
|
||||
type MessageController struct {
|
||||
notifService notifProvider
|
||||
}
|
||||
|
||||
// NewMessageController 构造函数
|
||||
func NewMessageController(notifService notifProvider) *MessageController {
|
||||
return &MessageController{notifService: notifService}
|
||||
}
|
||||
|
||||
// MessagesPage 消息中心页面（需登录，noindex）
|
||||
func (mc *MessageController) MessagesPage(c *gin.Context) {
|
||||
uidVal, exists := c.Get("uid")
|
||||
if !exists {
|
||||
c.Redirect(http.StatusFound, "/auth/login")
|
||||
c.Abort()
|
||||
return
|
||||
}
|
||||
uid := uidVal.(uint)
|
||||
|
||||
// 从 query 取分页参数
|
||||
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||
if page < 1 {
|
||||
page = 1
|
||||
}
|
||||
pageSize := 20
|
||||
|
||||
result, err := mc.notifService.List(uid, page, pageSize)
|
||||
if err != nil {
|
||||
result = &model.NotificationListResult{Items: []model.Notification{}, Total: 0, Page: 1}
|
||||
}
|
||||
|
||||
totalPages := result.TotalPages
|
||||
if totalPages == 0 && result.Total > 0 {
|
||||
totalPages = int((result.Total + int64(pageSize) - 1) / int64(pageSize))
|
||||
}
|
||||
|
||||
c.HTML(http.StatusOK, "messages/index.html", common.BuildPageData(c, gin.H{
|
||||
"Title": "消息中心",
|
||||
"ExtraCSS": "/static/css/messages.css",
|
||||
"Messages": result.Items,
|
||||
"Total": result.Total,
|
||||
"Page": result.Page,
|
||||
"TotalPages": totalPages,
|
||||
"PrevPage": result.Page - 1,
|
||||
"NextPage": result.Page + 1,
|
||||
"HasPrev": result.Page > 1,
|
||||
"HasNext": result.Page < totalPages,
|
||||
"UnreadCount": result.Unread,
|
||||
"NotifyTypeNames": model.NotifyTypeNames,
|
||||
"AuditTypeNames": model.AuditTypeNames,
|
||||
}))
|
||||
}
|
||||
|
||||
// UnreadCount 获取未读消息数（API，供导航栏轮询）
|
||||
func (mc *MessageController) UnreadCount(c *gin.Context) {
|
||||
uidVal, exists := c.Get("uid")
|
||||
if !exists {
|
||||
common.Ok(c, gin.H{"unread": 0})
|
||||
return
|
||||
}
|
||||
|
||||
count, err := mc.notifService.CountUnread(uidVal.(uint))
|
||||
if err != nil {
|
||||
common.Ok(c, gin.H{"unread": 0})
|
||||
return
|
||||
}
|
||||
|
||||
common.Ok(c, gin.H{"unread": count})
|
||||
}
|
||||
|
||||
// MarkRead 标记单条消息已读（API）
|
||||
func (mc *MessageController) MarkRead(c *gin.Context) {
|
||||
uidVal, exists := c.Get("uid")
|
||||
if !exists {
|
||||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||||
return
|
||||
}
|
||||
|
||||
idStr := c.Param("id")
|
||||
id, err := strconv.ParseUint(idStr, 10, 64)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "消息 ID 无效")
|
||||
return
|
||||
}
|
||||
|
||||
if err := mc.notifService.MarkRead(uint(id), uidVal.(uint)); err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "已标记为已读")
|
||||
}
|
||||
|
||||
// MarkAllRead 一键全部已读（API）
|
||||
func (mc *MessageController) MarkAllRead(c *gin.Context) {
|
||||
uidVal, exists := c.Get("uid")
|
||||
if !exists {
|
||||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||||
return
|
||||
}
|
||||
|
||||
if err := mc.notifService.MarkAllRead(uidVal.(uint)); err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "已全部标为已读")
|
||||
}
|
||||
@ -11,26 +11,38 @@ import (
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// profileProvider SettingsController 对 Service 层的最小依赖（ISP：2 个方法）
|
||||
// profileProvider SettingsController 对 Service 层的最小依赖（ISP：4 个方法）
|
||||
type profileProvider interface {
|
||||
GetProfile(userID uint) (*model.User, error)
|
||||
UpdateProfile(userID uint, username, bio string) error
|
||||
ChangePassword(userID uint, currentPassword, newPassword string) error
|
||||
DeleteAccount(userID uint, password, reason string) error
|
||||
}
|
||||
|
||||
// avatarProvider 头像上传对 Service 层的最小依赖（ISP：1 个方法）
|
||||
// avatarProvider 头像上传对 Service 层的最小依赖（ISP：2 个方法）
|
||||
type avatarProvider interface {
|
||||
ProcessAvatar(userID uint, file io.Reader, contentType string, cropX, cropY, cropSize int) (string, error)
|
||||
ProcessImage(userID uint, file io.Reader, contentType string, cropX, cropY, cropSize int) (string, error)
|
||||
}
|
||||
|
||||
// auditSubmittable 个人设置对审核服务的依赖（ISP：3 个方法）
|
||||
type auditSubmittable interface {
|
||||
ShouldAudit(userID uint) (bool, error)
|
||||
SubmitProfileChanges(userID uint, currentUser *model.User, newUsername, newBio string) error
|
||||
Submit(userID uint, auditType, newValue string) error
|
||||
GetPendingTypes(userID uint) ([]string, error)
|
||||
}
|
||||
|
||||
// SettingsController 个人设置控制器
|
||||
type SettingsController struct {
|
||||
authService profileProvider
|
||||
avatarService avatarProvider
|
||||
auditService auditSubmittable
|
||||
}
|
||||
|
||||
// NewSettingsController 构造函数
|
||||
func NewSettingsController(authService profileProvider, avatarService avatarProvider) *SettingsController {
|
||||
return &SettingsController{authService: authService, avatarService: avatarService}
|
||||
func NewSettingsController(authService profileProvider, avatarService avatarProvider, auditService auditSubmittable) *SettingsController {
|
||||
return &SettingsController{authService: authService, avatarService: avatarService, auditService: auditService}
|
||||
}
|
||||
|
||||
// SettingsPage 个人设置页面（需登录）
|
||||
@ -55,17 +67,23 @@ func (sc *SettingsController) SettingsPage(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
|
||||
// 查询待审核类型（用于前端显示审核提示）
|
||||
pendingTypes, _ := sc.auditService.GetPendingTypes(uid)
|
||||
|
||||
c.HTML(http.StatusOK, "settings/index.html", common.BuildPageData(c, gin.H{
|
||||
"Title": "个人设置",
|
||||
"ExtraCSS": "/static/css/settings.css",
|
||||
"ActiveTab": tab,
|
||||
"User": user,
|
||||
"RoleName": model.RoleDisplayNames[user.Role],
|
||||
"StatusName": model.StatusDisplayNames[user.Status],
|
||||
"Title": "个人设置",
|
||||
"ExtraCSS": "/static/css/settings.css",
|
||||
"ActiveTab": tab,
|
||||
"User": user,
|
||||
"RoleName": model.RoleDisplayNames[user.Role],
|
||||
"StatusName": model.StatusDisplayNames[user.Status],
|
||||
"PendingTypes": pendingTypes,
|
||||
"AuditTypes": model.AuditTypeNames,
|
||||
}))
|
||||
}
|
||||
|
||||
// UpdateProfile 修改个人资料（用户名 + 个性签名，需登录）
|
||||
// 普通用户走审核流程，管理员及以上直接落库
|
||||
func (sc *SettingsController) UpdateProfile(c *gin.Context) {
|
||||
uid, exists := c.Get("uid")
|
||||
if !exists {
|
||||
@ -82,7 +100,31 @@ func (sc *SettingsController) UpdateProfile(c *gin.Context) {
|
||||
return
|
||||
}
|
||||
|
||||
if err := sc.authService.UpdateProfile(uid.(uint), req.Username, req.Bio); err != nil {
|
||||
userID := uid.(uint)
|
||||
|
||||
// 判断是否需要审核
|
||||
shouldAudit, err := sc.auditService.ShouldAudit(userID)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
return
|
||||
}
|
||||
|
||||
if shouldAudit {
|
||||
user, err := sc.authService.GetProfile(userID)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
return
|
||||
}
|
||||
if err := sc.auditService.SubmitProfileChanges(userID, user, req.Username, req.Bio); err != nil {
|
||||
handleAuditSubmitError(c, err)
|
||||
return
|
||||
}
|
||||
common.OkMessage(c, "修改已提交审核，通过前当前信息保持不变")
|
||||
return
|
||||
}
|
||||
|
||||
// 管理员及以上直接更新
|
||||
if err := sc.authService.UpdateProfile(userID, req.Username, req.Bio); err != nil {
|
||||
handleSettingsError(c, err)
|
||||
return
|
||||
}
|
||||
@ -91,6 +133,7 @@ func (sc *SettingsController) UpdateProfile(c *gin.Context) {
|
||||
}
|
||||
|
||||
// UploadAvatar 上传头像（需登录，multipart/form-data）
|
||||
// 普通用户走审核流程，管理员及以上直接更新
|
||||
func (sc *SettingsController) UploadAvatar(c *gin.Context) {
|
||||
uid, exists := c.Get("uid")
|
||||
if !exists {
|
||||
@ -110,7 +153,32 @@ func (sc *SettingsController) UploadAvatar(c *gin.Context) {
|
||||
cropY, _ := strconv.Atoi(c.PostForm("crop_y"))
|
||||
cropSize, _ := strconv.Atoi(c.PostForm("crop_size"))
|
||||
|
||||
url, err := sc.avatarService.ProcessAvatar(uid.(uint), file, header.Header.Get("Content-Type"), cropX, cropY, cropSize)
|
||||
userID := uid.(uint)
|
||||
|
||||
// 判断是否需要审核
|
||||
shouldAudit, err := sc.auditService.ShouldAudit(userID)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
return
|
||||
}
|
||||
|
||||
if shouldAudit {
|
||||
// 仅处理图片，不更新用户
|
||||
avatarURL, err := sc.avatarService.ProcessImage(userID, file, header.Header.Get("Content-Type"), cropX, cropY, cropSize)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, err.Error())
|
||||
return
|
||||
}
|
||||
if err := sc.auditService.Submit(userID, model.AuditTypeAvatar, avatarURL); err != nil {
|
||||
handleAuditSubmitError(c, err)
|
||||
return
|
||||
}
|
||||
common.OkMessage(c, "头像已提交审核，通过前当前头像保持不变")
|
||||
return
|
||||
}
|
||||
|
||||
// 管理员及以上直接更新
|
||||
url, err := sc.avatarService.ProcessAvatar(userID, file, header.Header.Get("Content-Type"), cropX, cropY, cropSize)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, err.Error())
|
||||
return
|
||||
@ -119,6 +187,56 @@ func (sc *SettingsController) UploadAvatar(c *gin.Context) {
|
||||
common.Ok(c, gin.H{"url": url})
|
||||
}
|
||||
|
||||
// ChangePassword 修改密码（需登录）
|
||||
func (sc *SettingsController) ChangePassword(c *gin.Context) {
|
||||
uid, exists := c.Get("uid")
|
||||
if !exists {
|
||||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||||
return
|
||||
}
|
||||
|
||||
var req struct {
|
||||
CurrentPassword string `json:"current_password" binding:"required"`
|
||||
NewPassword string `json:"new_password" binding:"required,min=8"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请检查输入")
|
||||
return
|
||||
}
|
||||
|
||||
if err := sc.authService.ChangePassword(uid.(uint), req.CurrentPassword, req.NewPassword); err != nil {
|
||||
handleSettingsError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "密码已修改，请重新登录")
|
||||
}
|
||||
|
||||
// DeleteAccount 自助注销账号（需登录，验证密码 + 注销原因）
|
||||
func (sc *SettingsController) DeleteAccount(c *gin.Context) {
|
||||
uid, exists := c.Get("uid")
|
||||
if !exists {
|
||||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||||
return
|
||||
}
|
||||
|
||||
var req struct {
|
||||
Password string `json:"password" binding:"required"`
|
||||
Reason string `json:"reason"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请检查输入")
|
||||
return
|
||||
}
|
||||
|
||||
if err := sc.authService.DeleteAccount(uid.(uint), req.Password, req.Reason); err != nil {
|
||||
handleSettingsError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "账号已注销，7 天内重新登录即可恢复")
|
||||
}
|
||||
|
||||
// handleSettingsError 统一处理 settings 接口的 service 层错误
|
||||
func handleSettingsError(c *gin.Context, err error) {
|
||||
switch err {
|
||||
@ -128,7 +246,44 @@ func handleSettingsError(c *gin.Context, err error) {
|
||||
common.Error(c, http.StatusBadRequest, err.Error())
|
||||
case common.ErrBioTooLong:
|
||||
common.Error(c, http.StatusBadRequest, err.Error())
|
||||
case common.ErrIncorrectPassword:
|
||||
common.Error(c, http.StatusForbidden, err.Error())
|
||||
case common.ErrOwnerCannotDelete:
|
||||
common.Error(c, http.StatusForbidden, err.Error())
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
}
|
||||
}
|
||||
|
||||
// handleAuditSubmitError 统一处理审核提交的错误
|
||||
func handleAuditSubmitError(c *gin.Context, err error) {
|
||||
switch err {
|
||||
case common.ErrAuditDisabled:
|
||||
common.Error(c, http.StatusForbidden, "审核功能未开启")
|
||||
case common.ErrAuditTypeOff:
|
||||
common.Error(c, http.StatusForbidden, "该类型审核未开启，请联系管理员")
|
||||
case common.ErrUsernameTaken:
|
||||
common.Error(c, http.StatusConflict, err.Error())
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "提交审核失败")
|
||||
}
|
||||
}
|
||||
|
||||
// AuditStatus 查询当前用户的待审核类型（需登录）
|
||||
func (sc *SettingsController) AuditStatus(c *gin.Context) {
|
||||
uid, exists := c.Get("uid")
|
||||
if !exists {
|
||||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||||
return
|
||||
}
|
||||
|
||||
types, err := sc.auditService.GetPendingTypes(uid.(uint))
|
||||
if err != nil {
|
||||
common.Ok(c, gin.H{"pending_types": []string{}})
|
||||
return
|
||||
}
|
||||
if types == nil {
|
||||
types = []string{}
|
||||
}
|
||||
common.Ok(c, gin.H{"pending_types": types})
|
||||
}
|
||||
|
||||
@ -70,7 +70,7 @@ func (am *AuthMiddleware) AdminAuth() gin.HandlerFunc {
|
||||
return
|
||||
}
|
||||
|
||||
log.Printf("[AdminAuth] OK: uid=%d role=%v path=%s", uint(claims["uid"].(float64)), claims["role"], c.Request.URL.Path)
|
||||
log.Printf("[AdminAuth] OK: uid=%v role=%v path=%s", claims["uid"], claims["role"], c.Request.URL.Path)
|
||||
injectUserContext(c, claims)
|
||||
c.Next()
|
||||
}
|
||||
@ -93,19 +93,27 @@ func (am *AuthMiddleware) authenticateToken(c *gin.Context) (jwt.MapClaims, erro
|
||||
tokenVer := int(claims["ver"].(float64))
|
||||
|
||||
currentVer, err := am.userRepo.FindTokenVersion(uid)
|
||||
if err != nil || tokenVer != currentVer {
|
||||
if tokenVer != currentVer {
|
||||
log.Printf("[authenticateToken] REVOKED: uid=%d tokenVer=%d dbVer=%d", uid, tokenVer, currentVer)
|
||||
}
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if tokenVer != currentVer {
|
||||
log.Printf("[authenticateToken] REVOKED: uid=%d tokenVer=%d dbVer=%d", uid, tokenVer, currentVer)
|
||||
return nil, common.ErrTokenRevoked
|
||||
}
|
||||
|
||||
return claims, nil
|
||||
}
|
||||
|
||||
// injectUserContext 将 JWT claims 中的用户信息注入 gin context
|
||||
func injectUserContext(c *gin.Context, claims jwt.MapClaims) {
|
||||
c.Set("uid", uint(claims["uid"].(float64)))
|
||||
if claims == nil {
|
||||
return
|
||||
}
|
||||
uid, ok := claims["uid"].(float64)
|
||||
if !ok {
|
||||
return
|
||||
}
|
||||
c.Set("uid", uint(uid))
|
||||
c.Set("email", claims["email"])
|
||||
c.Set("username", claims["username"])
|
||||
c.Set("role", claims["role"])
|
||||
|
||||
61
internal/model/audit.go
Normal file
61
internal/model/audit.go
Normal file
@ -0,0 +1,61 @@
|
||||
package model
|
||||
|
||||
// 审核类型常量
|
||||
const (
|
||||
AuditTypeUsername = "username"
|
||||
AuditTypeAvatar = "avatar"
|
||||
AuditTypeBio = "bio"
|
||||
)
|
||||
|
||||
// 审核状态常量
|
||||
const (
|
||||
AuditStatusPending = "pending"
|
||||
AuditStatusApproved = "approved"
|
||||
AuditStatusRejected = "rejected"
|
||||
)
|
||||
|
||||
// AuditSubmission 审核提交记录
|
||||
// 密钥设计：
|
||||
// - 用户提交修改 → 创建 pending 记录，User 表暂不更新
|
||||
// - 管理员审批通过 → 更新 User 表对应字段，标记 approved
|
||||
// - 管理员拒绝 → 标记 rejected，记录理由
|
||||
// - 用户连续提交同类型 → 旧 pending 标记 rejected（理由"用户重新提交"），创建新 pending
|
||||
type AuditSubmission struct {
|
||||
BaseModel
|
||||
|
||||
UserID uint `gorm:"index:idx_type_user_status,priority:2;not null" json:"user_id"`
|
||||
AuditType string `gorm:"type:varchar(20);index:idx_type_user_status,priority:1;not null" json:"audit_type"`
|
||||
NewValue string `gorm:"type:text;not null" json:"new_value"`
|
||||
|
||||
Status string `gorm:"type:varchar(20);index:idx_type_user_status,priority:3;not null;default:pending" json:"status"`
|
||||
|
||||
// 审核人信息（审核后才填充）
|
||||
ReviewedBy *uint `gorm:"default:null" json:"reviewed_by,omitempty"`
|
||||
ReviewerName *string `gorm:"type:varchar(50);default:null" json:"reviewer_name,omitempty"`
|
||||
|
||||
// 拒绝理由
|
||||
RejectReason *string `gorm:"type:text;default:null" json:"reject_reason,omitempty"`
|
||||
}
|
||||
|
||||
// AuditTypeNames 审核类型 → 中文名
|
||||
var AuditTypeNames = map[string]string{
|
||||
AuditTypeUsername: "用户名",
|
||||
AuditTypeAvatar: "头像",
|
||||
AuditTypeBio: "个性签名",
|
||||
}
|
||||
|
||||
// AuditStatusNames 审核状态 → 中文名
|
||||
var AuditStatusNames = map[string]string{
|
||||
AuditStatusPending: "待审核",
|
||||
AuditStatusApproved: "已通过",
|
||||
AuditStatusRejected: "已拒绝",
|
||||
}
|
||||
|
||||
// IsAuditType 校验审核类型合法性
|
||||
func IsAuditType(t string) bool {
|
||||
switch t {
|
||||
case AuditTypeUsername, AuditTypeAvatar, AuditTypeBio:
|
||||
return true
|
||||
}
|
||||
return false
|
||||
}
|
||||
@ -19,3 +19,15 @@ type LoginRequest struct {
|
||||
type CheckEmailRequest struct {
|
||||
Email string `json:"email" binding:"required,email"`
|
||||
}
|
||||
|
||||
// ChangePasswordRequest 修改密码请求
|
||||
type ChangePasswordRequest struct {
|
||||
CurrentPassword string `json:"current_password" binding:"required"`
|
||||
NewPassword string `json:"new_password" binding:"required,min=8"`
|
||||
}
|
||||
|
||||
// DeleteAccountRequest 注销账号请求
|
||||
type DeleteAccountRequest struct {
|
||||
Password string `json:"password" binding:"required"`
|
||||
Reason string `json:"reason"`
|
||||
}
|
||||
|
||||
34
internal/model/notification.go
Normal file
34
internal/model/notification.go
Normal file
@ -0,0 +1,34 @@
|
||||
package model
|
||||
|
||||
// 消息/通知类型常量
|
||||
const (
|
||||
NotifyAuditApproved = "audit_approved"
|
||||
NotifyAuditRejected = "audit_rejected"
|
||||
)
|
||||
|
||||
// Notification 消息/通知模型
|
||||
type Notification struct {
|
||||
BaseModel
|
||||
|
||||
UserID uint `gorm:"index:idx_user_read,priority:1;not null" json:"user_id"`
|
||||
NotifyType string `gorm:"type:varchar(30);index;not null" json:"notify_type"`
|
||||
Title string `gorm:"type:varchar(200);not null" json:"title"`
|
||||
Content string `gorm:"type:text" json:"content"`
|
||||
IsRead bool `gorm:"index:idx_user_read,priority:2;default:false;not null" json:"is_read"`
|
||||
RelatedID *uint `gorm:"default:null" json:"related_id,omitempty"` // 关联业务 ID
|
||||
}
|
||||
|
||||
// NotifyTypeNames 通知类型 → 中文名
|
||||
var NotifyTypeNames = map[string]string{
|
||||
NotifyAuditApproved: "系统通知",
|
||||
NotifyAuditRejected: "系统通知",
|
||||
}
|
||||
|
||||
// NotificationListResult 消息列表查询结果
|
||||
type NotificationListResult struct {
|
||||
Items []Notification `json:"items"`
|
||||
Total int64 `json:"total"`
|
||||
Page int `json:"page"`
|
||||
TotalPages int `json:"total_pages"`
|
||||
Unread int64 `json:"unread"`
|
||||
}
|
||||
7
internal/model/site_setting.go
Normal file
7
internal/model/site_setting.go
Normal file
@ -0,0 +1,7 @@
|
||||
package model
|
||||
|
||||
// SiteSetting 站点设置（键值对模型，存数据库，运行时加载到内存）
|
||||
type SiteSetting struct {
|
||||
Key string `gorm:"primarykey;type:varchar(100)" json:"key"`
|
||||
Value string `gorm:"type:text;not null" json:"value"`
|
||||
}
|
||||
@ -1,5 +1,7 @@
|
||||
package model
|
||||
|
||||
import "time"
|
||||
|
||||
// User 用户模型
|
||||
type User struct {
|
||||
BaseModel
|
||||
@ -12,7 +14,13 @@ type User struct {
|
||||
|
||||
Role string `gorm:"type:varchar(20);default:user;index;not null" json:"role"`
|
||||
Status string `gorm:"type:varchar(20);default:active;index;not null" json:"status"`
|
||||
TokenVersion int `gorm:"default:0;not null" json:"-"` // 令牌版本，+1 即时吊销所有 JWT
|
||||
TokenVersion int `gorm:"default:0;not null" json:"-"` // 令牌版本，+1 即时吊销所有 JWT
|
||||
|
||||
// 安全与审计
|
||||
RegIP string `gorm:"type:varchar(45);default:''" json:"-"` // 注册 IP
|
||||
LastLoginIP string `gorm:"type:varchar(45);default:''" json:"-"` // 最后登录 IP
|
||||
LastLoginAt *time.Time `gorm:"default:null" json:"last_login_at,omitempty"` // 最后登录时间
|
||||
DeleteReason string `gorm:"type:text;default:''" json:"-"` // 注销原因
|
||||
}
|
||||
|
||||
// 角色常量（仅用作字符串标识符，层级和权限由配置驱动）
|
||||
|
||||
103
internal/repository/audit_repo.go
Normal file
103
internal/repository/audit_repo.go
Normal file
@ -0,0 +1,103 @@
|
||||
package repository
|
||||
|
||||
import (
|
||||
"metazone.cc/metalab/internal/model"
|
||||
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// AuditRepo 审核记录数据访问
|
||||
type AuditRepo struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
|
||||
// NewAuditRepo 构造函数
|
||||
func NewAuditRepo(db *gorm.DB) *AuditRepo {
|
||||
return &AuditRepo{db: db}
|
||||
}
|
||||
|
||||
// AutoMigrate 自动迁移审核表
|
||||
func (r *AuditRepo) AutoMigrate() error {
|
||||
return r.db.AutoMigrate(&model.AuditSubmission{})
|
||||
}
|
||||
|
||||
// Create 创建审核提交
|
||||
func (r *AuditRepo) Create(audit *model.AuditSubmission) error {
|
||||
return r.db.Create(audit).Error
|
||||
}
|
||||
|
||||
// FindByID 按 ID 查找审核记录
|
||||
func (r *AuditRepo) FindByID(id uint) (*model.AuditSubmission, error) {
|
||||
var audit model.AuditSubmission
|
||||
err := r.db.First(&audit, id).Error
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &audit, nil
|
||||
}
|
||||
|
||||
// FindPendingByUserAndType 查找用户某类型的待审记录（用于连续提交覆盖）
|
||||
func (r *AuditRepo) FindPendingByUserAndType(userID uint, auditType string) (*model.AuditSubmission, error) {
|
||||
var audit model.AuditSubmission
|
||||
err := r.db.
|
||||
Where("user_id = ? AND audit_type = ? AND status = ?", userID, auditType, model.AuditStatusPending).
|
||||
First(&audit).Error
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return &audit, nil
|
||||
}
|
||||
|
||||
// Update 全量更新审核记录
|
||||
func (r *AuditRepo) Update(audit *model.AuditSubmission) error {
|
||||
return r.db.Save(audit).Error
|
||||
}
|
||||
|
||||
// findAudits 构建审核列表查询
|
||||
func (r *AuditRepo) findAudits(auditType, status string) *gorm.DB {
|
||||
q := r.db.Model(&model.AuditSubmission{})
|
||||
if auditType != "" {
|
||||
q = q.Where("audit_type = ?", auditType)
|
||||
}
|
||||
if status != "" {
|
||||
q = q.Where("status = ?", status)
|
||||
}
|
||||
return q
|
||||
}
|
||||
|
||||
// ListAudits 分页查询审核列表
|
||||
func (r *AuditRepo) ListAudits(auditType, status string, offset, limit int) ([]model.AuditSubmission, error) {
|
||||
var audits []model.AuditSubmission
|
||||
err := r.findAudits(auditType, status).
|
||||
Order("created_at DESC").
|
||||
Offset(offset).Limit(limit).
|
||||
Find(&audits).Error
|
||||
return audits, err
|
||||
}
|
||||
|
||||
// CountAudits 统计审核记录总数
|
||||
func (r *AuditRepo) CountAudits(auditType, status string) (int64, error) {
|
||||
var count int64
|
||||
err := r.findAudits(auditType, status).Count(&count).Error
|
||||
return count, err
|
||||
}
|
||||
|
||||
// FindPendingByUserID 查找用户所有待审记录（用于个人中心提示）
|
||||
func (r *AuditRepo) FindPendingByUserID(userID uint) ([]model.AuditSubmission, error) {
|
||||
var audits []model.AuditSubmission
|
||||
err := r.db.
|
||||
Where("user_id = ? AND status = ?", userID, model.AuditStatusPending).
|
||||
Find(&audits).Error
|
||||
return audits, err
|
||||
}
|
||||
|
||||
// ExistsPendingByTypeAndValue 检查是否有同类型同值的待审记录（用于防重名提交）
|
||||
// 排除指定 userID 的记录（允许同一用户覆盖自己的提交）
|
||||
func (r *AuditRepo) ExistsPendingByTypeAndValue(auditType, newValue string, excludeUserID uint) (bool, error) {
|
||||
var count int64
|
||||
err := r.db.Model(&model.AuditSubmission{}).
|
||||
Where("audit_type = ? AND new_value = ? AND status = ? AND user_id != ?",
|
||||
auditType, newValue, model.AuditStatusPending, excludeUserID).
|
||||
Count(&count).Error
|
||||
return count > 0, err
|
||||
}
|
||||
67
internal/repository/notification_repo.go
Normal file
67
internal/repository/notification_repo.go
Normal file
@ -0,0 +1,67 @@
|
||||
package repository
|
||||
|
||||
import (
|
||||
"metazone.cc/metalab/internal/model"
|
||||
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// NotificationRepo 消息/通知数据访问
|
||||
type NotificationRepo struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
|
||||
// NewNotificationRepo 构造函数
|
||||
func NewNotificationRepo(db *gorm.DB) *NotificationRepo {
|
||||
return &NotificationRepo{db: db}
|
||||
}
|
||||
|
||||
// AutoMigrate 自动迁移消息表
|
||||
func (r *NotificationRepo) AutoMigrate() error {
|
||||
return r.db.AutoMigrate(&model.Notification{})
|
||||
}
|
||||
|
||||
// Create 创建消息
|
||||
func (r *NotificationRepo) Create(n *model.Notification) error {
|
||||
return r.db.Create(n).Error
|
||||
}
|
||||
|
||||
// ListByUser 分页查询用户消息
|
||||
func (r *NotificationRepo) ListByUser(userID uint, offset, limit int) ([]model.Notification, error) {
|
||||
var list []model.Notification
|
||||
err := r.db.Where("user_id = ?", userID).
|
||||
Order("created_at DESC").
|
||||
Offset(offset).Limit(limit).
|
||||
Find(&list).Error
|
||||
return list, err
|
||||
}
|
||||
|
||||
// CountByUser 统计用户消息总数
|
||||
func (r *NotificationRepo) CountByUser(userID uint) (int64, error) {
|
||||
var count int64
|
||||
err := r.db.Model(&model.Notification{}).Where("user_id = ?", userID).Count(&count).Error
|
||||
return count, err
|
||||
}
|
||||
|
||||
// CountUnread 统计用户未读消息数
|
||||
func (r *NotificationRepo) CountUnread(userID uint) (int64, error) {
|
||||
var count int64
|
||||
err := r.db.Model(&model.Notification{}).
|
||||
Where("user_id = ? AND is_read = false", userID).
|
||||
Count(&count).Error
|
||||
return count, err
|
||||
}
|
||||
|
||||
// MarkRead 标记单条消息为已读
|
||||
func (r *NotificationRepo) MarkRead(id, userID uint) error {
|
||||
return r.db.Model(&model.Notification{}).
|
||||
Where("id = ? AND user_id = ?", id, userID).
|
||||
Update("is_read", true).Error
|
||||
}
|
||||
|
||||
// MarkAllRead 将用户所有未读消息标记为已读
|
||||
func (r *NotificationRepo) MarkAllRead(userID uint) error {
|
||||
return r.db.Model(&model.Notification{}).
|
||||
Where("user_id = ? AND is_read = false", userID).
|
||||
Update("is_read", true).Error
|
||||
}
|
||||
34
internal/repository/site_setting_repo.go
Normal file
34
internal/repository/site_setting_repo.go
Normal file
@ -0,0 +1,34 @@
|
||||
package repository
|
||||
|
||||
import (
|
||||
"metazone.cc/metalab/internal/model"
|
||||
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// SiteSettingRepo 站点设置数据访问
|
||||
type SiteSettingRepo struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
|
||||
// NewSiteSettingRepo 构造函数
|
||||
func NewSiteSettingRepo(db *gorm.DB) *SiteSettingRepo {
|
||||
return &SiteSettingRepo{db: db}
|
||||
}
|
||||
|
||||
// AutoMigrate 自动迁移站点设置表
|
||||
func (r *SiteSettingRepo) AutoMigrate() error {
|
||||
return r.db.AutoMigrate(&model.SiteSetting{})
|
||||
}
|
||||
|
||||
// Upsert 创建或更新站点设置
|
||||
func (r *SiteSettingRepo) Upsert(key, value string) error {
|
||||
return r.db.Save(&model.SiteSetting{Key: key, Value: value}).Error
|
||||
}
|
||||
|
||||
// GetAll 获取所有站点设置
|
||||
func (r *SiteSettingRepo) GetAll() ([]model.SiteSetting, error) {
|
||||
var settings []model.SiteSetting
|
||||
err := r.db.Find(&settings).Error
|
||||
return settings, err
|
||||
}
|
||||
@ -21,10 +21,10 @@ func (r *UserRepo) Create(user *model.User) error {
|
||||
return r.db.Create(user).Error
|
||||
}
|
||||
|
||||
// FindByEmail 按邮箱查找用户
|
||||
// FindByEmail 按邮箱查找用户（含软删除，用于登录等需要找到已注销用户的场景）
|
||||
func (r *UserRepo) FindByEmail(email string) (*model.User, error) {
|
||||
var user model.User
|
||||
err := r.db.Where("email = ?", email).First(&user).Error
|
||||
err := r.db.Unscoped().Where("email = ?", email).First(&user).Error
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
@ -17,7 +17,7 @@ import (
|
||||
)
|
||||
|
||||
// Setup 注册所有路由
|
||||
func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
|
||||
func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSettings) {
|
||||
// --- 全局中间件 ---
|
||||
r.Use(middleware.SecurityHeaders())
|
||||
|
||||
@ -28,14 +28,35 @@ func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
|
||||
rateLimiter := middleware.NewRateLimiter()
|
||||
authCtrl := controller.NewAuthController(authService, tokenSvc, rateLimiter, cfg)
|
||||
avatarSvc := service.NewAvatarService(userRepo)
|
||||
settingsCtrl := controller.NewSettingsController(authService, avatarSvc)
|
||||
|
||||
authMdw := middleware.NewAuthMiddleware(cfg, userRepo)
|
||||
|
||||
// 管理后台
|
||||
adminService := service.NewAdminService(userRepo)
|
||||
adminController := adminCtrl.NewAdminController(adminService)
|
||||
|
||||
// 审核系统
|
||||
auditRepo := repository.NewAuditRepo(db)
|
||||
notificationRepo := repository.NewNotificationRepo(db)
|
||||
notificationService := service.NewNotificationService(notificationRepo)
|
||||
auditService := service.NewAuditService(auditRepo, userRepo, siteSettings, cfg.Audit, notificationService)
|
||||
auditController := adminCtrl.NewAuditController(auditService, userRepo)
|
||||
|
||||
// 消息中心
|
||||
messageController := controller.NewMessageController(notificationService)
|
||||
|
||||
// 站点设置
|
||||
siteSettingService := service.NewSiteSettingService(siteSettings)
|
||||
auditDefaults := &service.AuditDefaults{
|
||||
Enabled: cfg.Audit.Enabled,
|
||||
UsernameAudit: cfg.Audit.UsernameAudit,
|
||||
AvatarAudit: cfg.Audit.AvatarAudit,
|
||||
BioAudit: cfg.Audit.BioAudit,
|
||||
}
|
||||
siteSettingController := adminCtrl.NewSiteSettingController(siteSettingService, auditDefaults)
|
||||
|
||||
// 个人设置（需要审核服务）
|
||||
settingsCtrl := controller.NewSettingsController(authService, avatarSvc, auditService)
|
||||
|
||||
// --- 页面路由（CSRF 仅下发 token，不验证——页面 GET 被豁免） ---
|
||||
pages := r.Group("/")
|
||||
pages.Use(authMdw.Optional())
|
||||
@ -58,6 +79,9 @@ func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
|
||||
c.Redirect(http.StatusFound, "/settings/profile")
|
||||
})
|
||||
pages.GET("/settings/:tab", settingsCtrl.SettingsPage)
|
||||
|
||||
// 消息中心（需登录，noindex）
|
||||
pages.GET("/messages", messageController.MessagesPage)
|
||||
}
|
||||
|
||||
// 认证页面（已登录自动跳走）
|
||||
@ -80,6 +104,20 @@ func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
|
||||
{
|
||||
settingsAPI.PUT("/profile", settingsCtrl.UpdateProfile)
|
||||
settingsAPI.POST("/avatar", settingsCtrl.UploadAvatar)
|
||||
settingsAPI.PUT("/password", settingsCtrl.ChangePassword)
|
||||
settingsAPI.POST("/delete-account", settingsCtrl.DeleteAccount)
|
||||
// 查询当前用户的待审核状态
|
||||
settingsAPI.GET("/audit-status", settingsCtrl.AuditStatus)
|
||||
}
|
||||
|
||||
// --- 消息中心 API（需登录） ---
|
||||
messagesAPI := r.Group("/api/messages")
|
||||
messagesAPI.Use(authMdw.Required())
|
||||
messagesAPI.Use(middleware.CSRF(cfg))
|
||||
{
|
||||
messagesAPI.GET("/unread", messageController.UnreadCount)
|
||||
messagesAPI.POST("/:id/read", messageController.MarkRead)
|
||||
messagesAPI.POST("/read-all", messageController.MarkAllRead)
|
||||
}
|
||||
|
||||
// --- 管理后台 SSR 页面（认证失败 302 跳首页） ---
|
||||
@ -95,6 +133,8 @@ func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
|
||||
adminPages.GET("/", adminController.Dashboard)
|
||||
adminPages.GET("/users", adminController.UsersPage,
|
||||
middleware.RequirePageRole(model.RoleAdmin))
|
||||
adminPages.GET("/audits", auditController.AuditPage,
|
||||
middleware.RequirePageRole(model.RoleAdmin))
|
||||
}
|
||||
|
||||
// --- 管理后台 API（JSON 响应） ---
|
||||
@ -106,6 +146,20 @@ func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
|
||||
adminAPI.GET("/users", adminController.ListUsers)
|
||||
adminAPI.PUT("/users/:uid/status", adminController.UpdateUserStatus)
|
||||
adminAPI.POST("/users/:uid/reset-token", adminController.ResetToken)
|
||||
// 审核 API
|
||||
adminAPI.GET("/audits", auditController.ListAudits)
|
||||
adminAPI.POST("/audits/:id/approve", auditController.Approve)
|
||||
adminAPI.POST("/audits/:id/reject", auditController.Reject)
|
||||
}
|
||||
|
||||
// --- 站点设置 API（仅 owner 可访问） ---
|
||||
siteSettingsAPI := r.Group("/api/admin/site-settings")
|
||||
siteSettingsAPI.Use(authMdw.Required())
|
||||
siteSettingsAPI.Use(middleware.RequireMinRole(model.RoleOwner))
|
||||
siteSettingsAPI.Use(middleware.CSRF(cfg))
|
||||
{
|
||||
siteSettingsAPI.GET("", siteSettingController.GetSettings)
|
||||
siteSettingsAPI.PUT("", siteSettingController.UpdateSetting)
|
||||
}
|
||||
|
||||
// --- API 路由（CSRF 严格验证） ---
|
||||
@ -115,6 +169,7 @@ func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
|
||||
api.POST("/auth/check-email", authCtrl.CheckEmail)
|
||||
api.POST("/auth/register", authCtrl.Register)
|
||||
api.POST("/auth/login", authCtrl.Login)
|
||||
api.POST("/auth/confirm-restore", authCtrl.ConfirmRestore)
|
||||
api.POST("/auth/logout", authCtrl.Logout)
|
||||
api.POST("/auth/refresh", authCtrl.RefreshToken)
|
||||
}
|
||||
|
||||
@ -4,9 +4,6 @@ import (
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
)
|
||||
|
||||
// AdminService 管理后台业务逻辑
|
||||
// 集中处理所有权限边界检查，避免胖控制器
|
||||
type AdminService struct {
|
||||
userRepo userAdminStore
|
||||
}
|
||||
@ -34,20 +31,15 @@ type ListUsersResult struct {
|
||||
|
||||
// ListUsers 分页搜索用户列表
|
||||
func (s *AdminService) ListUsers(params ListUsersParams) (*ListUsersResult, error) {
|
||||
if params.Page < 1 {
|
||||
params.Page = 1
|
||||
}
|
||||
if params.PageSize < 1 || params.PageSize > 100 {
|
||||
params.PageSize = 20
|
||||
}
|
||||
offset := (params.Page - 1) * params.PageSize
|
||||
p := common.Pagination{Page: params.Page, PageSize: params.PageSize}
|
||||
p.DefaultPagination()
|
||||
|
||||
total, err := s.userRepo.CountSearchUsers(params.Keyword, params.Role, params.Status)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
users, err := s.userRepo.SearchUsers(params.Keyword, params.Role, params.Status, offset, params.PageSize)
|
||||
users, err := s.userRepo.SearchUsers(params.Keyword, params.Role, params.Status, p.Offset(), p.PageSize)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
@ -55,7 +47,7 @@ func (s *AdminService) ListUsers(params ListUsersParams) (*ListUsersResult, erro
|
||||
return &ListUsersResult{
|
||||
Users: users,
|
||||
Total: total,
|
||||
Page: params.Page,
|
||||
Page: p.Page,
|
||||
}, nil
|
||||
}
|
||||
|
||||
|
||||
295
internal/service/audit_service.go
Normal file
295
internal/service/audit_service.go
Normal file
@ -0,0 +1,295 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/config"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
|
||||
"gorm.io/gorm"
|
||||
)
|
||||
|
||||
// auditRepo AuditService 所需的最小仓储接口（ISP）
|
||||
type auditRepo interface {
|
||||
Create(audit *model.AuditSubmission) error
|
||||
FindByID(id uint) (*model.AuditSubmission, error)
|
||||
FindPendingByUserAndType(userID uint, auditType string) (*model.AuditSubmission, error)
|
||||
Update(audit *model.AuditSubmission) error
|
||||
ListAudits(auditType, status string, offset, limit int) ([]model.AuditSubmission, error)
|
||||
CountAudits(auditType, status string) (int64, error)
|
||||
FindPendingByUserID(userID uint) ([]model.AuditSubmission, error)
|
||||
ExistsPendingByTypeAndValue(auditType, newValue string, excludeUserID uint) (bool, error)
|
||||
}
|
||||
|
||||
// userProfileStore 审核服务所需的最小用户仓储接口（ISP）
|
||||
type userProfileStore interface {
|
||||
FindByID(id uint) (*model.User, error)
|
||||
Update(user *model.User) error
|
||||
ExistsByUsername(username string) (bool, error)
|
||||
}
|
||||
|
||||
// siteSettingsChecker 审核服务所需的站点设置接口（ISP：仅读取审核开关）
|
||||
type siteSettingsChecker interface {
|
||||
IsAuditEnabled() bool
|
||||
IsAuditTypeEnabled(auditType string, defaultVal bool) bool
|
||||
}
|
||||
|
||||
// auditNotifier 审核服务所需的通知接口（ISP：审核通过/拒绝时发送通知）
|
||||
type auditNotifier interface {
|
||||
NotifyAuditApproved(userID uint, auditType string, relatedID uint)
|
||||
NotifyAuditRejected(userID uint, auditType, reason string, relatedID uint)
|
||||
}
|
||||
|
||||
// AuditService 审核业务逻辑
|
||||
type AuditService struct {
|
||||
auditRepo auditRepo
|
||||
userRepo userProfileStore
|
||||
settings siteSettingsChecker
|
||||
defaultCfg config.AuditConfig
|
||||
notifier auditNotifier
|
||||
}
|
||||
|
||||
// NewAuditService 构造函数
|
||||
func NewAuditService(auditRepo auditRepo, userRepo userProfileStore, settings siteSettingsChecker, cfg config.AuditConfig, notifier auditNotifier) *AuditService {
|
||||
return &AuditService{
|
||||
auditRepo: auditRepo,
|
||||
userRepo: userRepo,
|
||||
settings: settings,
|
||||
defaultCfg: cfg,
|
||||
notifier: notifier,
|
||||
}
|
||||
}
|
||||
|
||||
// ErrXxx 重导出
|
||||
var (
|
||||
ErrAuditNotFound = common.ErrAuditNotFound
|
||||
ErrAuditNotPending = common.ErrAuditNotPending
|
||||
ErrAuditDisabled = common.ErrAuditDisabled
|
||||
ErrAuditTypeOff = common.ErrAuditTypeOff
|
||||
)
|
||||
|
||||
// ShouldAudit 判断指定用户是否需要走审核流程
|
||||
// 规则：admin 及以上角色免审
|
||||
func (s *AuditService) ShouldAudit(userID uint) (bool, error) {
|
||||
user, err := s.userRepo.FindByID(userID)
|
||||
if err != nil {
|
||||
return false, err
|
||||
}
|
||||
return !model.HasMinRole(user.Role, model.RoleAdmin), nil
|
||||
}
|
||||
|
||||
// Submit 提交审核
|
||||
// - 总开关未开 → 返回 ErrAuditDisabled
|
||||
// - 类型开关未开 → 返回 ErrAuditTypeOff
|
||||
// - 用户名类型 → 先检查是否已被占用
|
||||
// - 若存在同类型 pending → 标记旧记录为 rejected（理由"用户重新提交"），创建新 pending
|
||||
func (s *AuditService) Submit(userID uint, auditType, newValue string) error {
|
||||
// 检查总开关
|
||||
if !s.settings.IsAuditEnabled() {
|
||||
return ErrAuditDisabled
|
||||
}
|
||||
|
||||
// 检查类型开关
|
||||
if !s.settings.IsAuditTypeEnabled(auditType, s.typeDefault(auditType)) {
|
||||
return ErrAuditTypeOff
|
||||
}
|
||||
|
||||
// 用户名冲突检查（提交时即拦截，避免提交到后台后审核失败）
|
||||
if auditType == model.AuditTypeUsername {
|
||||
// 1) users 表中已被占用
|
||||
exists, err := s.userRepo.ExistsByUsername(newValue)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if exists {
|
||||
return ErrUsernameTaken
|
||||
}
|
||||
// 2) 审核表中已有其他用户提交了同名 pending
|
||||
pendingExists, err := s.auditRepo.ExistsPendingByTypeAndValue(auditType, newValue, userID)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if pendingExists {
|
||||
return ErrUsernameTaken
|
||||
}
|
||||
}
|
||||
|
||||
// 覆盖旧的同类型 pending
|
||||
existing, err := s.auditRepo.FindPendingByUserAndType(userID, auditType)
|
||||
if err == nil {
|
||||
reason := "用户重新提交"
|
||||
existing.Status = model.AuditStatusRejected
|
||||
existing.RejectReason = &reason
|
||||
_ = s.auditRepo.Update(existing)
|
||||
}
|
||||
|
||||
submission := &model.AuditSubmission{
|
||||
UserID: userID,
|
||||
AuditType: auditType,
|
||||
NewValue: newValue,
|
||||
Status: model.AuditStatusPending,
|
||||
}
|
||||
return s.auditRepo.Create(submission)
|
||||
}
|
||||
|
||||
// SubmitProfileChanges 批量提交资料变更（用户名/签名），每个变更字段独立提交
|
||||
// 仅提交有变更的字段，无变更的跳过
|
||||
func (s *AuditService) SubmitProfileChanges(userID uint, currentUser *model.User, newUsername, newBio string) error {
|
||||
if newUsername != "" && newUsername != currentUser.Username {
|
||||
if err := s.Submit(userID, model.AuditTypeUsername, newUsername); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
if newBio != "" && newBio != currentUser.Bio {
|
||||
if err := s.Submit(userID, model.AuditTypeBio, newBio); err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// Approve 通过审核 → 更新 User 表对应字段
|
||||
// 仅审核人可操作，不可审核自己的提交
|
||||
func (s *AuditService) Approve(reviewerID uint, submissionID uint) error {
|
||||
return s.review(reviewerID, submissionID, true, "")
|
||||
}
|
||||
|
||||
// Reject 拒绝审核 → 记录拒绝理由
|
||||
func (s *AuditService) Reject(reviewerID uint, submissionID uint, reason string) error {
|
||||
return s.review(reviewerID, submissionID, false, reason)
|
||||
}
|
||||
|
||||
// review 通用审核操作
|
||||
func (s *AuditService) review(reviewerID uint, submissionID uint, approved bool, reason string) error {
|
||||
// 1. 查审核记录
|
||||
submission, err := s.auditRepo.FindByID(submissionID)
|
||||
if err != nil {
|
||||
if err == gorm.ErrRecordNotFound {
|
||||
return ErrAuditNotFound
|
||||
}
|
||||
return err
|
||||
}
|
||||
|
||||
// 2. 必须 pending
|
||||
if submission.Status != model.AuditStatusPending {
|
||||
return ErrAuditNotPending
|
||||
}
|
||||
|
||||
// 3. 查审核人信息
|
||||
reviewer, err := s.userRepo.FindByID(reviewerID)
|
||||
if err != nil {
|
||||
return common.ErrUserNotFound
|
||||
}
|
||||
|
||||
// 5. 标记审核结果
|
||||
submission.ReviewedBy = &reviewerID
|
||||
submission.ReviewerName = &reviewer.Username
|
||||
if approved {
|
||||
submission.Status = model.AuditStatusApproved
|
||||
// 更新 User 表对应字段
|
||||
if err := s.applyApproval(submission); err != nil {
|
||||
return err
|
||||
}
|
||||
// 通知用户审核通过
|
||||
if s.notifier != nil {
|
||||
s.notifier.NotifyAuditApproved(submission.UserID, submission.AuditType, submission.ID)
|
||||
}
|
||||
} else {
|
||||
submission.Status = model.AuditStatusRejected
|
||||
submission.RejectReason = &reason
|
||||
// 通知用户审核被拒
|
||||
if s.notifier != nil {
|
||||
reasonMsg := reason
|
||||
s.notifier.NotifyAuditRejected(submission.UserID, submission.AuditType, reasonMsg, submission.ID)
|
||||
}
|
||||
}
|
||||
return s.auditRepo.Update(submission)
|
||||
}
|
||||
|
||||
// applyApproval 将审核通过的内容写入 User 表
|
||||
// 用户名审批前再次检查冲突（防止提交到审批期间被其他用户抢占）
|
||||
func (s *AuditService) applyApproval(submission *model.AuditSubmission) error {
|
||||
user, err := s.userRepo.FindByID(submission.UserID)
|
||||
if err != nil {
|
||||
return common.ErrUserNotFound
|
||||
}
|
||||
|
||||
switch submission.AuditType {
|
||||
case model.AuditTypeUsername:
|
||||
exists, err := s.userRepo.ExistsByUsername(submission.NewValue)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if exists {
|
||||
return ErrUsernameTaken
|
||||
}
|
||||
user.Username = submission.NewValue
|
||||
case model.AuditTypeAvatar:
|
||||
user.Avatar = submission.NewValue
|
||||
case model.AuditTypeBio:
|
||||
user.Bio = submission.NewValue
|
||||
}
|
||||
return s.userRepo.Update(user)
|
||||
}
|
||||
|
||||
// List 分页查询审核列表
|
||||
func (s *AuditService) List(auditType, status string, page, pageSize int) (*AuditListResult, error) {
|
||||
if page < 1 {
|
||||
page = 1
|
||||
}
|
||||
if pageSize < 1 || pageSize > 100 {
|
||||
pageSize = 20
|
||||
}
|
||||
offset := (page - 1) * pageSize
|
||||
|
||||
total, err := s.auditRepo.CountAudits(auditType, status)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
items, err := s.auditRepo.ListAudits(auditType, status, offset, pageSize)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if items == nil {
|
||||
items = []model.AuditSubmission{}
|
||||
}
|
||||
|
||||
return &AuditListResult{
|
||||
Items: items,
|
||||
Total: total,
|
||||
Page: page,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// GetPendingTypes 获取用户所有待审核类型（用于个人中心提示）
|
||||
func (s *AuditService) GetPendingTypes(userID uint) ([]string, error) {
|
||||
submissions, err := s.auditRepo.FindPendingByUserID(userID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
types := make([]string, 0, len(submissions))
|
||||
for _, sub := range submissions {
|
||||
types = append(types, sub.AuditType)
|
||||
}
|
||||
return types, nil
|
||||
}
|
||||
|
||||
// typeDefault 获取某审核类型在 config.yaml 中的默认开关值
|
||||
func (s *AuditService) typeDefault(auditType string) bool {
|
||||
switch auditType {
|
||||
case model.AuditTypeUsername:
|
||||
return s.defaultCfg.UsernameAudit
|
||||
case model.AuditTypeAvatar:
|
||||
return s.defaultCfg.AvatarAudit
|
||||
case model.AuditTypeBio:
|
||||
return s.defaultCfg.BioAudit
|
||||
}
|
||||
return true
|
||||
}
|
||||
|
||||
// AuditListResult 审核列表查询结果
|
||||
type AuditListResult struct {
|
||||
Items []model.AuditSubmission `json:"items"`
|
||||
Total int64 `json:"total"`
|
||||
Page int `json:"page"`
|
||||
}
|
||||
@ -2,6 +2,7 @@ package service
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
"time"
|
||||
"unicode/utf8"
|
||||
|
||||
"metazone.cc/metalab/internal/common"
|
||||
@ -25,18 +26,21 @@ func NewAuthService(userRepo userAuthStore, tokenSvc tokenProvider, cfg *config.
|
||||
}
|
||||
|
||||
var (
|
||||
ErrEmailExists = common.ErrEmailExists
|
||||
ErrUsernameTaken = common.ErrUsernameTaken
|
||||
ErrInvalidCred = common.ErrInvalidCred
|
||||
ErrUserNotFound = common.ErrUserNotFound
|
||||
ErrUserBanned = common.ErrUserBanned
|
||||
ErrUserLocked = common.ErrUserLocked
|
||||
ErrUserDeleted = common.ErrUserDeleted
|
||||
ErrWeakPassword = common.ErrWeakPassword
|
||||
ErrTokenExpired = common.ErrTokenExpired
|
||||
ErrTokenInvalid = common.ErrTokenInvalid
|
||||
ErrTokenRevoked = common.ErrTokenRevoked
|
||||
ErrPermissionDenied = common.ErrPermissionDenied
|
||||
ErrEmailExists = common.ErrEmailExists
|
||||
ErrUsernameTaken = common.ErrUsernameTaken
|
||||
ErrInvalidCred = common.ErrInvalidCred
|
||||
ErrUserNotFound = common.ErrUserNotFound
|
||||
ErrUserBanned = common.ErrUserBanned
|
||||
ErrUserLocked = common.ErrUserLocked
|
||||
ErrUserDeleted = common.ErrUserDeleted
|
||||
ErrWeakPassword = common.ErrWeakPassword
|
||||
ErrTokenExpired = common.ErrTokenExpired
|
||||
ErrTokenInvalid = common.ErrTokenInvalid
|
||||
ErrTokenRevoked = common.ErrTokenRevoked
|
||||
ErrPermissionDenied = common.ErrPermissionDenied
|
||||
ErrIncorrectPassword = common.ErrIncorrectPassword
|
||||
ErrNeedsConfirmRestore = common.ErrNeedsConfirmRestore
|
||||
ErrOwnerCannotDelete = common.ErrOwnerCannotDelete
|
||||
)
|
||||
|
||||
var pwLetter = regexp.MustCompile(`[a-zA-Z]`)
|
||||
@ -68,7 +72,8 @@ func validatePassword(pw string) error {
|
||||
// Register 注册
|
||||
// 流程：密码强度 → 邮箱查重 → 哈希 → 生成唯一用户名 → 创建 → access JWT + refresh JWT
|
||||
// rememberMe=true: refresh Cookie 持久化（30天）；false: session cookie（关浏览器即清除）
|
||||
func (s *AuthService) Register(req model.RegisterRequest) (string, string, *model.User, error) {
|
||||
// regIP: 注册 IP 地址
|
||||
func (s *AuthService) Register(req model.RegisterRequest, regIP string) (string, string, *model.User, error) {
|
||||
// 1. 密码强度
|
||||
if err := validatePassword(req.Password); err != nil {
|
||||
return "", "", nil, err
|
||||
@ -102,6 +107,7 @@ func (s *AuthService) Register(req model.RegisterRequest) (string, string, *mode
|
||||
Username: username,
|
||||
Role: model.RoleUser,
|
||||
Status: model.StatusActive,
|
||||
RegIP: regIP,
|
||||
}
|
||||
if err := s.userRepo.Create(user); err != nil {
|
||||
return "", "", nil, err
|
||||
@ -123,24 +129,25 @@ func (s *AuthService) Register(req model.RegisterRequest) (string, string, *mode
|
||||
}
|
||||
|
||||
// Login 登录
|
||||
// 流程：按邮箱查找 → 检查状态 → 验证密码 → access JWT + refresh JWT
|
||||
// 流程：按邮箱查找 → 已注销则验证密码后要求二次确认 → 检查状态 → 验证密码 → 记录登录 IP/时间 → access JWT + refresh JWT
|
||||
// 防时序攻击：邮箱不存在时仍执行完整 bcrypt 比对
|
||||
// rememberMe=true: refresh Cookie 持久化（30天）；false: session cookie（关浏览器即清除）
|
||||
func (s *AuthService) Login(req model.LoginRequest) (string, string, *model.User, error) {
|
||||
// loginIP: 登录 IP 地址
|
||||
// 若用户处于 deleted 状态且密码正确 → 返回 ErrNeedsConfirmRestore（不自动恢复，不签发 token）
|
||||
func (s *AuthService) Login(req model.LoginRequest, loginIP string) (string, string, *model.User, error) {
|
||||
user, err := s.userRepo.FindByEmail(req.Email)
|
||||
if err != nil {
|
||||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||||
return "", "", nil, ErrInvalidCred
|
||||
}
|
||||
|
||||
// 已注销（deleted）→ 自动恢复
|
||||
// 已注销（deleted）→ 验证密码后要求二次确认，不自动恢复
|
||||
if user.Status == model.StatusDeleted {
|
||||
user.Status = model.StatusActive
|
||||
user.DeletedAt = gorm.DeletedAt{}
|
||||
if err := s.userRepo.Update(user); err != nil {
|
||||
return "", "", nil, err
|
||||
if !common.CheckPassword(req.Password, user.PasswordHash) {
|
||||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||||
return "", "", nil, ErrInvalidCred
|
||||
}
|
||||
// 恢复后继续正常登录流程
|
||||
return "", "", nil, ErrNeedsConfirmRestore
|
||||
}
|
||||
|
||||
// 永久锁定
|
||||
@ -158,6 +165,14 @@ func (s *AuthService) Login(req model.LoginRequest) (string, string, *model.User
|
||||
return "", "", nil, ErrInvalidCred
|
||||
}
|
||||
|
||||
// 记录登录 IP 和时间
|
||||
now := time.Now()
|
||||
user.LastLoginIP = loginIP
|
||||
user.LastLoginAt = &now
|
||||
if err := s.userRepo.Update(user); err != nil {
|
||||
return "", "", nil, err
|
||||
}
|
||||
|
||||
// 生成 access JWT
|
||||
accessToken, err := s.tokenService.BuildAccessToken(user)
|
||||
if err != nil {
|
||||
@ -173,6 +188,47 @@ func (s *AuthService) Login(req model.LoginRequest) (string, string, *model.User
|
||||
return accessToken, refreshToken, user, nil
|
||||
}
|
||||
|
||||
// ConfirmRestore 二次确认恢复已注销账号
|
||||
// 流程：按邮箱查找 → 验证密码 → 恢复为 active → 记录登录 IP/时间 → 签发 token
|
||||
func (s *AuthService) ConfirmRestore(req model.LoginRequest, loginIP string) (string, string, *model.User, error) {
|
||||
user, err := s.userRepo.FindByEmail(req.Email)
|
||||
if err != nil {
|
||||
_ = bcrypt.CompareHashAndPassword(dummyHash, []byte(req.Password))
|
||||
return "", "", nil, ErrInvalidCred
|
||||
}
|
||||
|
||||
// 仅 deleted 状态允许恢复
|
||||
if user.Status != model.StatusDeleted {
|
||||
return "", "", nil, ErrUserNotFound
|
||||
}
|
||||
|
||||
if !common.CheckPassword(req.Password, user.PasswordHash) {
|
||||
return "", "", nil, ErrInvalidCred
|
||||
}
|
||||
|
||||
// 恢复账号
|
||||
user.Status = model.StatusActive
|
||||
user.DeletedAt = gorm.DeletedAt{}
|
||||
now := time.Now()
|
||||
user.LastLoginIP = loginIP
|
||||
user.LastLoginAt = &now
|
||||
if err := s.userRepo.Update(user); err != nil {
|
||||
return "", "", nil, err
|
||||
}
|
||||
|
||||
accessToken, err := s.tokenService.BuildAccessToken(user)
|
||||
if err != nil {
|
||||
return "", "", nil, err
|
||||
}
|
||||
|
||||
refreshToken, err := s.tokenService.BuildRefreshToken(user, req.RememberMe)
|
||||
if err != nil {
|
||||
return "", "", nil, err
|
||||
}
|
||||
|
||||
return accessToken, refreshToken, user, nil
|
||||
}
|
||||
|
||||
// CheckEmail 检查邮箱是否已被注册（无需认证的轻量检查）
|
||||
func (s *AuthService) CheckEmail(email string) (bool, error) {
|
||||
return s.userRepo.ExistsByEmail(email)
|
||||
@ -183,6 +239,68 @@ func (s *AuthService) GetProfile(userID uint) (*model.User, error) {
|
||||
return s.userRepo.FindByID(userID)
|
||||
}
|
||||
|
||||
// ChangePassword 修改密码
|
||||
// 流程：验证当前密码 → 校验新密码强度 → 哈希 → 更新 → 吊销所有 JWT（强制重新登录）
|
||||
func (s *AuthService) ChangePassword(userID uint, currentPassword, newPassword string) error {
|
||||
user, err := s.userRepo.FindByID(userID)
|
||||
if err != nil {
|
||||
return common.ErrUserNotFound
|
||||
}
|
||||
|
||||
// 验证当前密码
|
||||
if !common.CheckPassword(currentPassword, user.PasswordHash) {
|
||||
return ErrIncorrectPassword
|
||||
}
|
||||
|
||||
// 新密码强度校验
|
||||
if err := validatePassword(newPassword); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// 哈希新密码
|
||||
hash, err := common.HashPassword(newPassword, s.cfg.Bcrypt.Cost)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
user.PasswordHash = hash
|
||||
if err := s.userRepo.Update(user); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// 强制所有设备重新登录（安全性）
|
||||
return s.InvalidateSessions(userID)
|
||||
}
|
||||
|
||||
// DeleteAccount 用户自主注销
|
||||
// 流程：检查角色 → 验证密码 → 记录原因 → 设置 deleted 状态 → 吊销所有 JWT → 7 天冷却期内登录需二次确认恢复
|
||||
func (s *AuthService) DeleteAccount(userID uint, password, reason string) error {
|
||||
user, err := s.userRepo.FindByID(userID)
|
||||
if err != nil {
|
||||
return common.ErrUserNotFound
|
||||
}
|
||||
|
||||
// 站长不允许自主注销（避免权限体系死锁）
|
||||
if user.Role == model.RoleOwner {
|
||||
return ErrOwnerCannotDelete
|
||||
}
|
||||
|
||||
// 验证当前密码（防止 CSRF 或未授权操作）
|
||||
if !common.CheckPassword(password, user.PasswordHash) {
|
||||
return ErrIncorrectPassword
|
||||
}
|
||||
|
||||
user.Status = model.StatusDeleted
|
||||
user.DeleteReason = reason
|
||||
|
||||
if err := s.userRepo.Update(user); err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
// 递增 token_version，即时吊销所有 JWT 强制退登
|
||||
return s.InvalidateSessions(userID)
|
||||
}
|
||||
|
||||
// InvalidateSessions 吊销某用户所有 JWT（递增 token_version，强制所有设备重新登录）
|
||||
// 适用场景：修改密码、账号被盗、管理员强制下线
|
||||
func (s *AuthService) InvalidateSessions(userID uint) error {
|
||||
|
||||
@ -36,6 +36,7 @@ const (
|
||||
type userAvatarStore interface {
|
||||
FindByID(id uint) (*model.User, error)
|
||||
Update(user *model.User) error
|
||||
FindByIDUnscoped(userID uint) (*model.User, error)
|
||||
}
|
||||
|
||||
// AvatarService 头像上传处理服务
|
||||
@ -49,10 +50,27 @@ func NewAvatarService(userRepo userAvatarStore) *AvatarService {
|
||||
return &AvatarService{userRepo: userRepo, storageDir: avatarStorageDir}
|
||||
}
|
||||
|
||||
// ProcessAvatar 处理头像上传流程
|
||||
// cropX, cropY, cropSize: 自定义裁切参数（原图像素坐标），全 0 则默认中心裁切
|
||||
// 返回头像 URL，失败返回错误
|
||||
// ProcessAvatar 处理头像上传流程（完整流程：处理图片 + 更新 User）
|
||||
func (s *AvatarService) ProcessAvatar(userID uint, file io.Reader, contentType string, cropX, cropY, cropSize int) (string, error) {
|
||||
avatarURL, err := s.ProcessImage(userID, file, contentType, cropX, cropY, cropSize)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
user, err := s.userRepo.FindByID(userID)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("用户不存在")
|
||||
}
|
||||
user.Avatar = avatarURL
|
||||
if err := s.userRepo.Update(user); err != nil {
|
||||
return "", fmt.Errorf("更新头像失败")
|
||||
}
|
||||
|
||||
return avatarURL, nil
|
||||
}
|
||||
|
||||
// ProcessImage 处理头像上传流程（仅处理图片 + 保存文件，不更新 User，审核场景用）
|
||||
func (s *AvatarService) ProcessImage(userID uint, file io.Reader, contentType string, cropX, cropY, cropSize int) (string, error) {
|
||||
// 1. 检查文件类型（不支持 GIF：裁切后无法保持动画）
|
||||
if contentType != "image/jpeg" && contentType != "image/png" && contentType != "image/webp" {
|
||||
return "", fmt.Errorf("仅支持 JPEG、PNG、WebP 格式")
|
||||
@ -127,18 +145,7 @@ func (s *AvatarService) ProcessAvatar(userID uint, file io.Reader, contentType s
|
||||
return "", fmt.Errorf("保存文件失败")
|
||||
}
|
||||
|
||||
// 10. 更新用户头像字段
|
||||
user, err := s.userRepo.FindByID(userID)
|
||||
if err != nil {
|
||||
return "", fmt.Errorf("用户不存在")
|
||||
}
|
||||
avatarURL := fmt.Sprintf("/uploads/avatars/%d_%d.webp", userID, ts)
|
||||
user.Avatar = avatarURL
|
||||
if err := s.userRepo.Update(user); err != nil {
|
||||
return "", fmt.Errorf("更新头像失败")
|
||||
}
|
||||
|
||||
return avatarURL, nil
|
||||
return fmt.Sprintf("/uploads/avatars/%d_%d.webp", userID, ts), nil
|
||||
}
|
||||
|
||||
// cleanOldAvatars 删除指定用户的所有旧头像文件（仅保留最新一次上传）
|
||||
|
||||
112
internal/service/notification_service.go
Normal file
112
internal/service/notification_service.go
Normal file
@ -0,0 +1,112 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
)
|
||||
|
||||
// notifRepo 通知服务所需的最小仓储接口（ISP）
|
||||
type notifRepo interface {
|
||||
Create(n *model.Notification) error
|
||||
ListByUser(userID uint, offset, limit int) ([]model.Notification, error)
|
||||
CountByUser(userID uint) (int64, error)
|
||||
CountUnread(userID uint) (int64, error)
|
||||
MarkRead(id, userID uint) error
|
||||
MarkAllRead(userID uint) error
|
||||
}
|
||||
|
||||
// NotificationService 消息/通知业务逻辑
|
||||
type NotificationService struct {
|
||||
repo notifRepo
|
||||
}
|
||||
|
||||
// NewNotificationService 构造函数
|
||||
func NewNotificationService(repo notifRepo) *NotificationService {
|
||||
return &NotificationService{repo: repo}
|
||||
}
|
||||
|
||||
// Create 创建消息
|
||||
func (s *NotificationService) Create(userID uint, notifyType, title, content string, relatedID *uint) error {
|
||||
n := &model.Notification{
|
||||
UserID: userID,
|
||||
NotifyType: notifyType,
|
||||
Title: title,
|
||||
Content: content,
|
||||
IsRead: false,
|
||||
RelatedID: relatedID,
|
||||
}
|
||||
return s.repo.Create(n)
|
||||
}
|
||||
|
||||
// List 分页查询用户消息列表
|
||||
func (s *NotificationService) List(userID uint, page, pageSize int) (*model.NotificationListResult, error) {
|
||||
p := common.Pagination{Page: page, PageSize: pageSize}
|
||||
p.DefaultPagination()
|
||||
|
||||
total, err := s.repo.CountByUser(userID)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
items, err := s.repo.ListByUser(userID, p.Offset(), p.PageSize)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if items == nil {
|
||||
items = []model.Notification{}
|
||||
}
|
||||
|
||||
totalPages := int((total + int64(p.PageSize) - 1) / int64(p.PageSize))
|
||||
unread, _ := s.CountUnread(userID)
|
||||
|
||||
return &model.NotificationListResult{
|
||||
Items: items,
|
||||
Total: total,
|
||||
Page: p.Page,
|
||||
TotalPages: totalPages,
|
||||
Unread: unread,
|
||||
}, nil
|
||||
}
|
||||
|
||||
// CountUnread 统计未读消息数
|
||||
func (s *NotificationService) CountUnread(userID uint) (int64, error) {
|
||||
return s.repo.CountUnread(userID)
|
||||
}
|
||||
|
||||
// MarkRead 标记单条消息为已读
|
||||
func (s *NotificationService) MarkRead(id, userID uint) error {
|
||||
return s.repo.MarkRead(id, userID)
|
||||
}
|
||||
|
||||
// MarkAllRead 标记所有未读为已读
|
||||
func (s *NotificationService) MarkAllRead(userID uint) error {
|
||||
return s.repo.MarkAllRead(userID)
|
||||
}
|
||||
|
||||
// NotifyAuditApproved 审核通过通知
|
||||
func (s *NotificationService) NotifyAuditApproved(userID uint, auditType string, relatedID uint) {
|
||||
typeName := model.AuditTypeNames[auditType]
|
||||
if typeName == "" {
|
||||
typeName = auditType
|
||||
}
|
||||
_ = s.Create(userID, model.NotifyAuditApproved,
|
||||
"审核已通过",
|
||||
"你的"+typeName+"修改已通过审核",
|
||||
&relatedID)
|
||||
}
|
||||
|
||||
// NotifyAuditRejected 审核拒绝通知
|
||||
func (s *NotificationService) NotifyAuditRejected(userID uint, auditType, reason string, relatedID uint) {
|
||||
typeName := model.AuditTypeNames[auditType]
|
||||
if typeName == "" {
|
||||
typeName = auditType
|
||||
}
|
||||
content := "你的" + typeName + "修改被拒绝"
|
||||
if reason != "" {
|
||||
content += "，理由：" + reason
|
||||
}
|
||||
_ = s.Create(userID, model.NotifyAuditRejected,
|
||||
"审核未通过",
|
||||
content,
|
||||
&relatedID)
|
||||
}
|
||||
82
internal/service/site_setting_service.go
Normal file
82
internal/service/site_setting_service.go
Normal file
@ -0,0 +1,82 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
)
|
||||
|
||||
// siteSettingsManager 站点设置服务所需的最小接口（ISP）
|
||||
type siteSettingsManager interface {
|
||||
Get(key, defaultVal string) string
|
||||
GetBool(key string, defaultVal bool) bool
|
||||
Set(key, value string) error
|
||||
SetBool(key string, value bool) error
|
||||
All() map[string]string
|
||||
}
|
||||
|
||||
// SiteSettingService 站点设置业务逻辑
|
||||
type SiteSettingService struct {
|
||||
settings siteSettingsManager
|
||||
}
|
||||
|
||||
// NewSiteSettingService 构造函数
|
||||
func NewSiteSettingService(settings siteSettingsManager) *SiteSettingService {
|
||||
return &SiteSettingService{settings: settings}
|
||||
}
|
||||
|
||||
// GetSettings 获取所有站点设置（仅 owner 可见）
|
||||
func (s *SiteSettingService) GetSettings() map[string]string {
|
||||
return s.settings.All()
|
||||
}
|
||||
|
||||
// UpdateSetting 更新单项设置
|
||||
func (s *SiteSettingService) UpdateSetting(key, value string) error {
|
||||
return s.settings.Set(key, value)
|
||||
}
|
||||
|
||||
// UpdateBoolSetting 更新布尔设置
|
||||
func (s *SiteSettingService) UpdateBoolSetting(key string, value bool) error {
|
||||
return s.settings.SetBool(key, value)
|
||||
}
|
||||
|
||||
// GetBool gets a boolean setting with a default
|
||||
func (s *SiteSettingService) GetBool(key string, defaultVal bool) bool {
|
||||
return s.settings.GetBool(key, defaultVal)
|
||||
}
|
||||
|
||||
// --- 审核相关设置快捷方法 ---
|
||||
|
||||
// AuditSettings 审核相关站点设置集合（用于前端展示）
|
||||
type AuditSettings struct {
|
||||
Enabled bool `json:"enabled"`
|
||||
UsernameAudit bool `json:"username_audit"`
|
||||
AvatarAudit bool `json:"avatar_audit"`
|
||||
BioAudit bool `json:"bio_audit"`
|
||||
}
|
||||
|
||||
// GetAuditSettings 获取审核相关设置
|
||||
func (s *SiteSettingService) GetAuditSettings(defaultCfg *AuditDefaults) *AuditSettings {
|
||||
return &AuditSettings{
|
||||
Enabled: s.settings.GetBool("audit.enabled", defaultCfg.Enabled),
|
||||
UsernameAudit: s.settings.GetBool("audit.username_audit", defaultCfg.UsernameAudit),
|
||||
AvatarAudit: s.settings.GetBool("audit.avatar_audit", defaultCfg.AvatarAudit),
|
||||
BioAudit: s.settings.GetBool("audit.bio_audit", defaultCfg.BioAudit),
|
||||
}
|
||||
}
|
||||
|
||||
// AuditDefaults config.yaml 中的审核默认值
|
||||
type AuditDefaults struct {
|
||||
Enabled bool
|
||||
UsernameAudit bool
|
||||
AvatarAudit bool
|
||||
BioAudit bool
|
||||
}
|
||||
|
||||
// GetBoolSetting is a generic getter used by controllers
|
||||
func (s *SiteSettingService) GetBoolSetting(key string, defaultVal bool) bool {
|
||||
return s.settings.GetBool(key, defaultVal)
|
||||
}
|
||||
|
||||
// ParseBool 解析字符串为布尔值
|
||||
func ParseBool(v string) (bool, error) {
|
||||
return strconv.ParseBool(v)
|
||||
}
|
||||
Reference in New Issue
Block a user