初始化项目：基础设施 + 用户认证 + 后台管理系统 + AGPL 3.0 许可

internal/router/router.go

@@ -0,0 +1,104 @@
+package router
+
+import (
+	"net/http"
+
+	"metazone.cc/metalab/internal/common"
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/controller"
+	adminCtrl "metazone.cc/metalab/internal/controller/admin"
+	"metazone.cc/metalab/internal/middleware"
+	"metazone.cc/metalab/internal/model"
+	"metazone.cc/metalab/internal/repository"
+	"metazone.cc/metalab/internal/service"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+// Setup 注册所有路由
+func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config) {
+	// --- 全局中间件 ---
+	r.Use(middleware.SecurityHeaders())
+
+	// --- 依赖注入 ---
+	userRepo := repository.NewUserRepo(db)
+	tokenSvc := service.NewTokenService(cfg, userRepo)
+	authService := service.NewAuthService(userRepo, tokenSvc, cfg)
+	rateLimiter := middleware.NewRateLimiter()
+	authCtrl := controller.NewAuthController(authService, tokenSvc, rateLimiter, cfg)
+
+	authMdw := middleware.NewAuthMiddleware(cfg, userRepo)
+
+	// 管理后台
+	adminService := service.NewAdminService(userRepo)
+	adminController := adminCtrl.NewAdminController(adminService)
+
+	// --- 页面路由（CSRF 仅下发 token，不验证——页面 GET 被豁免） ---
+	pages := r.Group("/")
+	pages.Use(authMdw.Optional())
+	pages.Use(middleware.CSRF(cfg))
+	pages.Use(func(c *gin.Context) {
+		// 页面路由：确保每个页面都下发 CSRF Cookie
+		middleware.SetCSRFToken(c, cfg)
+		c.Next()
+	})
+	{
+		pages.GET("/", func(c *gin.Context) {
+			c.HTML(http.StatusOK, "home/index.html", common.BuildPageData(c, gin.H{
+				"Title":    "首页",
+				"ExtraCSS": "/static/css/home.css",
+			}))
+		})
+	}
+
+	// 认证页面（已登录自动跳走）
+	authPages := r.Group("/auth")
+	authPages.Use(authMdw.Optional())
+	authPages.Use(middleware.CSRF(cfg))
+	authPages.Use(func(c *gin.Context) {
+		middleware.SetCSRFToken(c, cfg)
+		c.Next()
+	})
+	{
+		authPages.GET("/register", authCtrl.RegisterPage)
+		authPages.GET("/login", authCtrl.LoginPage)
+	}
+
+	// --- 管理后台 SSR 页面（认证失败 302 跳首页） ---
+	adminPages := r.Group("/admin")
+	adminPages.Use(middleware.AdminAuth(cfg, userRepo))
+	adminPages.Use(middleware.RequirePageRole(model.RoleModerator))
+	adminPages.Use(middleware.CSRF(cfg))
+	adminPages.Use(func(c *gin.Context) {
+		middleware.SetCSRFToken(c, cfg)
+		c.Next()
+	})
+	{
+		adminPages.GET("/", adminController.Dashboard)
+		adminPages.GET("/users", adminController.UsersPage,
+			middleware.RequirePageRole(model.RoleAdmin))
+	}
+
+	// --- 管理后台 API（JSON 响应） ---
+	adminAPI := r.Group("/api/admin")
+	adminAPI.Use(authMdw.Required())
+	adminAPI.Use(middleware.RequireMinRole(model.RoleAdmin))
+	adminAPI.Use(middleware.CSRF(cfg))
+	{
+		adminAPI.GET("/users", adminController.ListUsers)
+		adminAPI.PUT("/users/:uid/status", adminController.UpdateUserStatus)
+		adminAPI.POST("/users/:uid/reset-token", adminController.ResetToken)
+	}
+
+	// --- API 路由（CSRF 严格验证） ---
+	api := r.Group("/api")
+	api.Use(middleware.CSRF(cfg))
+	{
+		api.POST("/auth/check-email", authCtrl.CheckEmail)
+		api.POST("/auth/register", authCtrl.Register)
+		api.POST("/auth/login", authCtrl.Login)
+		api.POST("/auth/logout", authCtrl.Logout)
+		api.POST("/auth/refresh", authCtrl.RefreshToken)
+	}
+}