feat: 消息通知中心 + 账号安全体系 + Bug修复
## 新增功能 ### 消息通知中心 (全新模块) - 新增 MessageController / NotificationService / NotificationRepo - SSR 消息页面 (/messages)：左侧边栏 + 右侧卡片列表，noindex 元标签 - 通知能力：列表分页、单条标为已读、一键全部标为已读 - 未读数角标 (1/66/99+)：侧边栏 + 导航栏铃铛图标 - 导航栏轮询 /api/messages/unread 每 60 秒刷新未读数 - 审核通过/驳回时自动 fire-and-forget 推送通知 ### 密码修改 - ChangePassword：验证当前密码 → 新密码强度校验(8位+字母+数字) → 哈希更新 - 修改后递增 token_version 强制所有设备退登 ### 账号自助注销 - DeleteAccount：验证密码 → 设置 deleted 状态 → 记录原因 → 吊销 JWT - 注销后登录二次确认：Login 检测 deleted → 返回 confirm_restore - ConfirmRestore 恢复账号，重新签发 token - 注销页文案："账号将在 7 天后正式注销，期间可随时重新登录恢复" ### IP 审计记录 - 注册时记录 RegIP，登录时记录 LastLoginIP + LastLoginAt - clientIP() 支持 X-Forwarded-For / X-Real-IP 反向代理 ### 安全加固 - Login 防时序攻击：用户不存在时仍执行完整 bcrypt 比对 - FindByEmail 改用 Unscoped() 覆盖软删除用户 - 站长 (owner) 不允许自主注销，避免权限体系死锁 ## Bug 修复 1. 注销按钮不触发：JS IIFE 中 profile 代码 return 阻塞了 account 标签页处理器注册 → 拆分为两层 IIFE，profile 放在内层 2. label 缺少 for 属性导致控制台警告 → 全部补充 for 属性 3. 注销后未自动退登：DeleteAccount 只设状态未吊销 JWT → 末尾加 InvalidateSessions 4. 退登后重定向 500 panic：authenticateToken 中 err||versionMismatch 合并判断 在 err=nil 但版本不匹配时返回 (nil,nil) → 拆为两个独立判断 injectUserContext 增加 claims==nil / 类型断言空安全守卫 5. 注销后登录直接提示"登录成功"：FindByEmail 默认 scope 排除软删除记录 → 改用 Unscoped() ## 文件变更 - 新建 17 个文件 (消息/审核/站点设置完整模块) - 修改 25 个文件 (认证/设置/中间件/前端) - 统计：+3229 / -161，42 files changed
This commit is contained in:
110
templates/admin/html/audit/index.html
Normal file
110
templates/admin/html/audit/index.html
Normal file
@ -0,0 +1,110 @@
|
||||
{{template "admin/layout/base.html" .}}
|
||||
<div class="page-header">
|
||||
<h1>审核管理</h1>
|
||||
<p class="page-desc">审核用户提交的用户名、头像、个性签名修改</p>
|
||||
</div>
|
||||
|
||||
<!-- 审核状态筛选 + TAB -->
|
||||
<div class="filter-bar">
|
||||
<div class="audit-tabs">
|
||||
<button class="audit-tab active" data-tab="username">用户名</button>
|
||||
<button class="audit-tab" data-tab="avatar">头像</button>
|
||||
<button class="audit-tab" data-tab="bio">个性签名</button>
|
||||
<button class="audit-tab" data-tab="history">审核记录</button>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
<!-- 用户名审核（表格） -->
|
||||
<div class="audit-panel active" id="panel-username">
|
||||
<div class="table-container">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>提交者</th>
|
||||
<th>当前用户名</th>
|
||||
<th>新用户名</th>
|
||||
<th>提交时间</th>
|
||||
<th>操作</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="usernameTableBody">
|
||||
<tr class="table-loading"><td colspan="5">加载中...</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<div class="pagination-bar" id="usernamePagination"></div>
|
||||
</div>
|
||||
|
||||
<!-- 头像审核（卡片网格） -->
|
||||
<div class="audit-panel" id="panel-avatar">
|
||||
<div class="avatar-audit-grid" id="avatarGrid">
|
||||
<div class="table-loading-full">加载中...</div>
|
||||
</div>
|
||||
<div class="pagination-bar" id="avatarPagination"></div>
|
||||
</div>
|
||||
|
||||
<!-- 签名审核（表格） -->
|
||||
<div class="audit-panel" id="panel-bio">
|
||||
<div class="table-container">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>提交者</th>
|
||||
<th>新签名</th>
|
||||
<th>提交时间</th>
|
||||
<th>操作</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="bioTableBody">
|
||||
<tr class="table-loading"><td colspan="4">加载中...</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<div class="pagination-bar" id="bioPagination"></div>
|
||||
</div>
|
||||
|
||||
<!-- 审核记录（全部状态） -->
|
||||
<div class="audit-panel" id="panel-history">
|
||||
<div class="table-container">
|
||||
<table class="data-table">
|
||||
<thead>
|
||||
<tr>
|
||||
<th>类型</th>
|
||||
<th>提交者</th>
|
||||
<th>内容</th>
|
||||
<th>状态</th>
|
||||
<th>审核人</th>
|
||||
<th>提交时间</th>
|
||||
</tr>
|
||||
</thead>
|
||||
<tbody id="historyTableBody">
|
||||
<tr class="table-loading"><td colspan="6">加载中...</td></tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</div>
|
||||
<div class="pagination-bar" id="historyPagination"></div>
|
||||
</div>
|
||||
|
||||
<!-- 拒绝理由弹窗 -->
|
||||
<div class="modal-overlay" id="rejectModal" style="display:none;">
|
||||
<div class="modal-box">
|
||||
<h3>拒绝审核</h3>
|
||||
<p>请填写拒绝理由：</p>
|
||||
<textarea id="rejectReason" rows="3" maxlength="500" placeholder="请输入拒绝理由..."></textarea>
|
||||
<div class="modal-actions">
|
||||
<button class="btn btn-outline" onclick="closeRejectModal()">取消</button>
|
||||
<button class="btn btn-danger" id="confirmRejectBtn">确认拒绝</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<script>
|
||||
window.__AUDIT_TYPES = {
|
||||
{{range $val, $label := .AuditTypes}}"{{$val}}": "{{$label}}",
|
||||
{{end}}
|
||||
};
|
||||
window.__AUDIT_STATUS = {
|
||||
{{range $val, $label := .AuditStatus}}"{{$val}}": "{{$label}}",
|
||||
{{end}}
|
||||
};
|
||||
</script>
|
||||
{{template "admin/layout/footer.html" .}}
|
||||
@ -33,6 +33,12 @@
|
||||
用户管理
|
||||
</a>
|
||||
{{end}}
|
||||
{{if .CanManageAudits}}
|
||||
<a href="/admin/audits" class="sidebar-item {{if eq .CurrentPath "/admin/audits"}}active{{end}}">
|
||||
<span class="sidebar-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><path d="M9 5H7a2 2 0 0 0-2 2v12a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V7a2 2 0 0 0-2-2h-2"/><rect x="9" y="3" width="6" height="4" rx="1"/><path d="m9 14 2 2 4-4"/></svg></span>
|
||||
审核管理
|
||||
</a>
|
||||
{{end}}
|
||||
</nav>
|
||||
</aside>
|
||||
<main class="admin-main">
|
||||
|
||||
Reference in New Issue
Block a user