feat: 消息通知中心 + 账号安全体系 + Bug修复
## 新增功能 ### 消息通知中心 (全新模块) - 新增 MessageController / NotificationService / NotificationRepo - SSR 消息页面 (/messages)：左侧边栏 + 右侧卡片列表，noindex 元标签 - 通知能力：列表分页、单条标为已读、一键全部标为已读 - 未读数角标 (1/66/99+)：侧边栏 + 导航栏铃铛图标 - 导航栏轮询 /api/messages/unread 每 60 秒刷新未读数 - 审核通过/驳回时自动 fire-and-forget 推送通知 ### 密码修改 - ChangePassword：验证当前密码 → 新密码强度校验(8位+字母+数字) → 哈希更新 - 修改后递增 token_version 强制所有设备退登 ### 账号自助注销 - DeleteAccount：验证密码 → 设置 deleted 状态 → 记录原因 → 吊销 JWT - 注销后登录二次确认：Login 检测 deleted → 返回 confirm_restore - ConfirmRestore 恢复账号，重新签发 token - 注销页文案："账号将在 7 天后正式注销，期间可随时重新登录恢复" ### IP 审计记录 - 注册时记录 RegIP，登录时记录 LastLoginIP + LastLoginAt - clientIP() 支持 X-Forwarded-For / X-Real-IP 反向代理 ### 安全加固 - Login 防时序攻击：用户不存在时仍执行完整 bcrypt 比对 - FindByEmail 改用 Unscoped() 覆盖软删除用户 - 站长 (owner) 不允许自主注销，避免权限体系死锁 ## Bug 修复 1. 注销按钮不触发：JS IIFE 中 profile 代码 return 阻塞了 account 标签页处理器注册 → 拆分为两层 IIFE，profile 放在内层 2. label 缺少 for 属性导致控制台警告 → 全部补充 for 属性 3. 注销后未自动退登：DeleteAccount 只设状态未吊销 JWT → 末尾加 InvalidateSessions 4. 退登后重定向 500 panic：authenticateToken 中 err||versionMismatch 合并判断 在 err=nil 但版本不匹配时返回 (nil,nil) → 拆为两个独立判断 injectUserContext 增加 claims==nil / 类型断言空安全守卫 5. 注销后登录直接提示"登录成功"：FindByEmail 默认 scope 排除软删除记录 → 改用 Unscoped() ## 文件变更 - 新建 17 个文件 (消息/审核/站点设置完整模块) - 修改 25 个文件 (认证/设置/中间件/前端) - 统计：+3229 / -161，42 files changed
This commit is contained in:
185
templates/admin/static/css/audit.css
Normal file
185
templates/admin/static/css/audit.css
Normal file
@ -0,0 +1,185 @@
|
||||
/* =====================================================
|
||||
MetaLab 管理面板 - 审核管理 CSS
|
||||
===================================================== */
|
||||
|
||||
/* TAB 切换 */
|
||||
.audit-tabs {
|
||||
display: flex;
|
||||
gap: 0;
|
||||
border-bottom: 2px solid #e9ecef;
|
||||
}
|
||||
|
||||
.audit-tab {
|
||||
padding: 10px 24px;
|
||||
border: none;
|
||||
background: none;
|
||||
color: #636e72;
|
||||
font-size: 14px;
|
||||
cursor: pointer;
|
||||
border-bottom: 2px solid transparent;
|
||||
margin-bottom: -2px;
|
||||
transition: color .2s, border-color .2s;
|
||||
}
|
||||
|
||||
.audit-tab:hover {
|
||||
color: #2d3436;
|
||||
}
|
||||
|
||||
.audit-tab.active {
|
||||
color: #0984e3;
|
||||
border-bottom-color: #0984e3;
|
||||
font-weight: 600;
|
||||
}
|
||||
|
||||
/* 审核面板显隐 */
|
||||
.audit-panel {
|
||||
display: none;
|
||||
}
|
||||
|
||||
.audit-panel.active {
|
||||
display: block;
|
||||
}
|
||||
|
||||
/* 头像审核网格 */
|
||||
.avatar-audit-grid {
|
||||
display: grid;
|
||||
grid-template-columns: repeat(auto-fill, minmax(340px, 1fr));
|
||||
gap: 16px;
|
||||
}
|
||||
|
||||
.avatar-audit-card {
|
||||
background: #fff;
|
||||
border: 1px solid #e9ecef;
|
||||
border-radius: 8px;
|
||||
padding: 16px;
|
||||
display: flex;
|
||||
flex-direction: column;
|
||||
gap: 12px;
|
||||
}
|
||||
|
||||
.avatar-audit-card .card-header {
|
||||
display: flex;
|
||||
justify-content: space-between;
|
||||
align-items: center;
|
||||
font-size: 13px;
|
||||
color: #636e72;
|
||||
}
|
||||
|
||||
.avatar-audit-card .card-header strong {
|
||||
color: #2d3436;
|
||||
}
|
||||
|
||||
.avatar-audit-card .avatar-compare {
|
||||
display: flex;
|
||||
align-items: center;
|
||||
gap: 12px;
|
||||
justify-content: center;
|
||||
}
|
||||
|
||||
.avatar-audit-card .avatar-compare img {
|
||||
width: 80px;
|
||||
height: 80px;
|
||||
border-radius: 8px;
|
||||
object-fit: cover;
|
||||
border: 2px solid #e9ecef;
|
||||
}
|
||||
|
||||
.avatar-audit-card .avatar-compare .arrow {
|
||||
font-size: 24px;
|
||||
color: #0984e3;
|
||||
flex-shrink: 0;
|
||||
}
|
||||
|
||||
.avatar-audit-card .card-actions {
|
||||
display: flex;
|
||||
gap: 8px;
|
||||
justify-content: flex-end;
|
||||
}
|
||||
|
||||
/* 表格内长文本截断 */
|
||||
.col-long-text {
|
||||
max-width: 280px;
|
||||
overflow: hidden;
|
||||
text-overflow: ellipsis;
|
||||
white-space: nowrap;
|
||||
}
|
||||
|
||||
/* 审核记录状态标签 */
|
||||
.audit-status-tag {
|
||||
display: inline-block;
|
||||
padding: 2px 10px;
|
||||
border-radius: 12px;
|
||||
font-size: 12px;
|
||||
font-weight: 500;
|
||||
}
|
||||
|
||||
.audit-status-tag.pending {
|
||||
background: #fff3cd;
|
||||
color: #856404;
|
||||
}
|
||||
|
||||
.audit-status-tag.approved {
|
||||
background: #d4edda;
|
||||
color: #155724;
|
||||
}
|
||||
|
||||
.audit-status-tag.rejected {
|
||||
background: #f8d7da;
|
||||
color: #721c24;
|
||||
}
|
||||
|
||||
/* 全屏加载 */
|
||||
.table-loading-full {
|
||||
text-align: center;
|
||||
padding: 40px;
|
||||
color: #636e72;
|
||||
grid-column: 1 / -1;
|
||||
}
|
||||
|
||||
/* 拒绝弹窗 */
|
||||
.modal-overlay {
|
||||
position: fixed;
|
||||
inset: 0;
|
||||
background: rgba(0,0,0,.4);
|
||||
display: flex;
|
||||
align-items: center;
|
||||
justify-content: center;
|
||||
z-index: 999;
|
||||
}
|
||||
|
||||
.modal-box {
|
||||
background: #fff;
|
||||
border-radius: 12px;
|
||||
padding: 28px;
|
||||
width: 420px;
|
||||
max-width: 90vw;
|
||||
box-shadow: 0 8px 30px rgba(0,0,0,.15);
|
||||
}
|
||||
|
||||
.modal-box h3 {
|
||||
margin: 0 0 8px;
|
||||
font-size: 18px;
|
||||
}
|
||||
|
||||
.modal-box p {
|
||||
color: #636e72;
|
||||
margin: 0 0 12px;
|
||||
font-size: 14px;
|
||||
}
|
||||
|
||||
.modal-box textarea {
|
||||
width: 100%;
|
||||
padding: 10px;
|
||||
border: 1px solid #dcdde1;
|
||||
border-radius: 6px;
|
||||
font-size: 14px;
|
||||
resize: vertical;
|
||||
box-sizing: border-box;
|
||||
}
|
||||
|
||||
.modal-actions {
|
||||
display: flex;
|
||||
justify-content: flex-end;
|
||||
gap: 10px;
|
||||
margin-top: 16px;
|
||||
}
|
||||
260
templates/admin/static/js/audit.js
Normal file
260
templates/admin/static/js/audit.js
Normal file
@ -0,0 +1,260 @@
|
||||
/* =====================================================
|
||||
MetaLab 管理面板 - 审核管理 JS
|
||||
单一职责：审核列表 TAB 切换、分页、审批操作
|
||||
===================================================== */
|
||||
|
||||
let currentTab = 'username';
|
||||
const pageSize = 20;
|
||||
const pages = {
|
||||
username: 1,
|
||||
avatar: 1,
|
||||
bio: 1,
|
||||
history: 1
|
||||
};
|
||||
let pendingRejectId = null;
|
||||
|
||||
document.addEventListener('DOMContentLoaded', () => {
|
||||
// TAB 切换
|
||||
document.querySelectorAll('.audit-tab').forEach(tab => {
|
||||
tab.addEventListener('click', () => {
|
||||
document.querySelectorAll('.audit-tab').forEach(t => t.classList.remove('active'));
|
||||
tab.classList.add('active');
|
||||
currentTab = tab.dataset.tab;
|
||||
document.querySelectorAll('.audit-panel').forEach(p => p.classList.remove('active'));
|
||||
document.getElementById('panel-' + currentTab).classList.add('active');
|
||||
loadCurrentTab();
|
||||
});
|
||||
});
|
||||
|
||||
// 初始加载
|
||||
loadCurrentTab();
|
||||
});
|
||||
|
||||
/* =========================================
|
||||
数据加载
|
||||
========================================= */
|
||||
|
||||
function loadCurrentTab() {
|
||||
if (currentTab === 'history') {
|
||||
loadHistory();
|
||||
} else if (currentTab === 'avatar') {
|
||||
loadAvatarAudits();
|
||||
} else {
|
||||
loadTableAudits();
|
||||
}
|
||||
}
|
||||
|
||||
function loadTableAudits() {
|
||||
const page = pages[currentTab];
|
||||
api.get(`/api/admin/audits?type=${currentTab}&page=${page}&page_size=${pageSize}`)
|
||||
.then(res => {
|
||||
if (res.success) {
|
||||
renderTable(res.data.items, currentTab + 'TableBody');
|
||||
renderPagination(res.data.total, res.data.page, currentTab + 'Pagination');
|
||||
} else {
|
||||
showToast(res.message || '加载失败', 'error');
|
||||
}
|
||||
})
|
||||
.catch(() => showToast('网络错误', 'error'));
|
||||
}
|
||||
|
||||
function loadAvatarAudits() {
|
||||
const page = pages['avatar'];
|
||||
api.get(`/api/admin/audits?type=avatar&page=${page}&page_size=${pageSize}`)
|
||||
.then(res => {
|
||||
if (res.success) {
|
||||
renderAvatarCards(res.data.items);
|
||||
renderPagination(res.data.total, res.data.page, 'avatarPagination');
|
||||
} else {
|
||||
showToast(res.message || '加载失败', 'error');
|
||||
}
|
||||
})
|
||||
.catch(() => showToast('网络错误', 'error'));
|
||||
}
|
||||
|
||||
function loadHistory() {
|
||||
const page = pages['history'];
|
||||
api.get(`/api/admin/audits?page=${page}&page_size=${pageSize}&status=`)
|
||||
.then(res => {
|
||||
if (res.success) {
|
||||
renderHistoryTable(res.data.items);
|
||||
renderPagination(res.data.total, res.data.page, 'historyPagination');
|
||||
} else {
|
||||
showToast(res.message || '加载失败', 'error');
|
||||
}
|
||||
})
|
||||
.catch(() => showToast('网络错误', 'error'));
|
||||
}
|
||||
|
||||
/* =========================================
|
||||
表格渲染（用户名/签名）
|
||||
========================================= */
|
||||
|
||||
function renderTable(items, bodyId) {
|
||||
const tbody = document.getElementById(bodyId);
|
||||
if (!items || items.length === 0) {
|
||||
const cols = currentTab === 'bio' ? 4 : 5;
|
||||
tbody.innerHTML = `<tr><td colspan="${cols}" style="text-align:center;padding:40px;color:#636e72;">没有待审核记录</td></tr>`;
|
||||
return;
|
||||
}
|
||||
tbody.innerHTML = items.map(item => {
|
||||
if (currentTab === 'bio') {
|
||||
return renderBioRow(item);
|
||||
}
|
||||
return renderUsernameRow(item);
|
||||
}).join('');
|
||||
}
|
||||
|
||||
function renderUsernameRow(item) {
|
||||
return `
|
||||
<tr>
|
||||
<td>${escapeHtml(item.submitter_username || '—')}</td>
|
||||
<td>—</td>
|
||||
<td><strong>${escapeHtml(item.new_value)}</strong></td>
|
||||
<td>${formatTime(item.created_at)}</td>
|
||||
<td class="col-actions">
|
||||
<button class="btn btn-primary btn-sm" onclick="approveAudit(${item.uid})">通过</button>
|
||||
<button class="btn btn-outline btn-sm" onclick="openRejectModal(${item.uid})">拒绝</button>
|
||||
</td>
|
||||
</tr>`;
|
||||
}
|
||||
|
||||
function renderBioRow(item) {
|
||||
const text = item.new_value || '';
|
||||
const display = text.length > 40 ? text.substring(0, 40) + '...' : text;
|
||||
return `
|
||||
<tr>
|
||||
<td>${escapeHtml(item.submitter_username || '—')}</td>
|
||||
<td title="${escapeHtml(text)}">${escapeHtml(display)}</td>
|
||||
<td>${formatTime(item.created_at)}</td>
|
||||
<td class="col-actions">
|
||||
<button class="btn btn-primary btn-sm" onclick="approveAudit(${item.uid})">通过</button>
|
||||
<button class="btn btn-outline btn-sm" onclick="openRejectModal(${item.uid})">拒绝</button>
|
||||
</td>
|
||||
</tr>`;
|
||||
}
|
||||
|
||||
/* =========================================
|
||||
头像卡片渲染
|
||||
========================================= */
|
||||
|
||||
function renderAvatarCards(items) {
|
||||
const grid = document.getElementById('avatarGrid');
|
||||
if (!items || items.length === 0) {
|
||||
grid.innerHTML = '<div class="table-loading-full">没有待审核头像</div>';
|
||||
return;
|
||||
}
|
||||
grid.innerHTML = items.map(item => `
|
||||
<div class="avatar-audit-card">
|
||||
<div class="card-header">
|
||||
<span>提交者: <strong>${escapeHtml(item.submitter_username || '—')}</strong></span>
|
||||
<span>${formatTime(item.created_at)}</span>
|
||||
</div>
|
||||
<div class="avatar-compare">
|
||||
<span>新头像 →</span>
|
||||
<img src="${escapeHtml(item.new_value)}" alt="新头像" onerror="this.src='data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 80 80%22><rect fill=%22%23eee%22 width=%2280%22 height=%2280%22/><text x=%2240%22 y=%2245%22 text-anchor=%22middle%22 fill=%22%23999%22 font-size=%2212%22>加载失败</text></svg>'">
|
||||
</div>
|
||||
<div class="card-actions">
|
||||
<button class="btn btn-primary btn-sm" onclick="approveAudit(${item.uid})">通过</button>
|
||||
<button class="btn btn-outline btn-sm" onclick="openRejectModal(${item.uid})">拒绝</button>
|
||||
</div>
|
||||
</div>
|
||||
`).join('');
|
||||
}
|
||||
|
||||
/* =========================================
|
||||
审核记录渲染
|
||||
========================================= */
|
||||
|
||||
function renderHistoryTable(items) {
|
||||
const tbody = document.getElementById('historyTableBody');
|
||||
if (!items || items.length === 0) {
|
||||
tbody.innerHTML = '<tr><td colspan="6" style="text-align:center;padding:40px;color:#636e72;">没有审核记录</td></tr>';
|
||||
return;
|
||||
}
|
||||
tbody.innerHTML = items.map(item => {
|
||||
const typeLabel = window.__AUDIT_TYPES[item.audit_type] || item.audit_type;
|
||||
const statusLabel = window.__AUDIT_STATUS[item.status] || item.status;
|
||||
const statusClass = item.status;
|
||||
const content = item.new_value.length > 40 ? item.new_value.substring(0, 40) + '...' : item.new_value;
|
||||
const reviewer = item.reviewer_name || '—';
|
||||
return `
|
||||
<tr>
|
||||
<td>${typeLabel}</td>
|
||||
<td>${escapeHtml(item.submitter_username || '—')}</td>
|
||||
<td>${escapeHtml(content)}</td>
|
||||
<td><span class="audit-status-tag ${statusClass}">${statusLabel}</span></td>
|
||||
<td>${escapeHtml(reviewer)}</td>
|
||||
<td>${formatTime(item.created_at)}</td>
|
||||
</tr>`;
|
||||
}).join('');
|
||||
}
|
||||
|
||||
/* =========================================
|
||||
审核操作
|
||||
========================================= */
|
||||
|
||||
async function approveAudit(id) {
|
||||
const ok = await showConfirm('通过审核', '确定要通过此审核吗？通过后将立即生效。');
|
||||
if (!ok) return;
|
||||
const res = await api.post('/api/admin/audits/' + id + '/approve');
|
||||
if (res.success) {
|
||||
showToast(res.message, 'success');
|
||||
loadCurrentTab();
|
||||
} else {
|
||||
showToast(res.message || '操作失败', 'error');
|
||||
}
|
||||
}
|
||||
|
||||
function openRejectModal(id) {
|
||||
pendingRejectId = id;
|
||||
document.getElementById('rejectReason').value = '';
|
||||
document.getElementById('rejectModal').style.display = 'flex';
|
||||
}
|
||||
|
||||
function closeRejectModal() {
|
||||
pendingRejectId = null;
|
||||
document.getElementById('rejectModal').style.display = 'none';
|
||||
}
|
||||
|
||||
document.getElementById('confirmRejectBtn').addEventListener('click', async () => {
|
||||
const reason = document.getElementById('rejectReason').value.trim();
|
||||
if (!reason) {
|
||||
showToast('请填写拒绝理由', 'error');
|
||||
return;
|
||||
}
|
||||
const res = await api.post('/api/admin/audits/' + pendingRejectId + '/reject', { reason });
|
||||
if (res.success) {
|
||||
showToast(res.message, 'success');
|
||||
closeRejectModal();
|
||||
loadCurrentTab();
|
||||
} else {
|
||||
showToast(res.message || '操作失败', 'error');
|
||||
}
|
||||
});
|
||||
|
||||
// 点击遮罩关闭弹窗
|
||||
document.getElementById('rejectModal').addEventListener('click', (e) => {
|
||||
if (e.target === e.currentTarget) closeRejectModal();
|
||||
});
|
||||
|
||||
/* =========================================
|
||||
分页
|
||||
========================================= */
|
||||
|
||||
function renderPagination(total, page, barId) {
|
||||
const totalPages = Math.ceil(total / pageSize);
|
||||
const bar = document.getElementById(barId);
|
||||
if (totalPages <= 1) { bar.innerHTML = ''; return; }
|
||||
|
||||
let html = `<button onclick="goPage(${page - 1})" ${page <= 1 ? 'disabled' : ''}>上一页</button>`;
|
||||
html += `<span class="page-current">第 ${page} / ${totalPages} 页（共 ${total} 条）</span>`;
|
||||
html += `<button onclick="goPage(${page + 1})" ${page >= totalPages ? 'disabled' : ''}>下一页</button>`;
|
||||
bar.innerHTML = html;
|
||||
}
|
||||
|
||||
function goPage(p) {
|
||||
pages[currentTab] = p;
|
||||
loadCurrentTab();
|
||||
window.scrollTo({ top: 0 });
|
||||
}
|
||||
Reference in New Issue
Block a user