refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入

审计修复: - CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用 - HSTS: 始终启用(不再依赖release模式) - Controller Exp: common.GetGinExp包装, 不再直接读context - UID解析: common.ParseUIDParam统一, follow/admin controller改用重构: - router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio - 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单 - 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件新增: - DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面 - 时区配置: config.yaml server.timezone→time.Local初始化 - .gitea/workflows/ci.yml: strict模式CI流水线
2026-06-22 03:06:24 +08:00
parent e7185f58fb
commit 2449a27eb5
43 changed files with 2157 additions and 226 deletions
--- a/internal/controller/admin/admin_controller.go
+++ b/internal/controller/admin/admin_controller.go
@ -134,11 +134,7 @@ func (ac *AdminController) ResetToken(c *gin.Context) {

 // parseUIDParam 从 URL 路径参数解析 uid
 func parseUIDParam(c *gin.Context) (uint, error) {
-	uid, err := strconv.ParseUint(c.Param("uid"), 10, 64)
-	if err != nil {
-		return 0, err
-	}
-	return uint(uid), nil
+	return common.ParseUIDParam(c, "uid")
 }

 // handleServiceError 统一处理 service 层返回的错误
--- a/internal/controller/admin/site_setting_controller.go
+++ b/internal/controller/admin/site_setting_controller.go
@ -21,12 +21,48 @@ func NewSiteSettingController(settingService siteSettingUseCase, defaults *servi
 	return &SiteSettingController{settingService: settingService, defaults: defaults}
 }

-// SiteSettingsPage 站点设置管理页面
+// SiteSettingsPage 旧站点设置页 — 301 重定向到品牌页
 func (sc *SiteSettingController) SiteSettingsPage(c *gin.Context) {
-	c.HTML(http.StatusOK, "admin/site-settings/index.html", common.BuildAdminPageData(c, gin.H{
-		"Title":    "站点设置",
-		"ExtraCSS": "/admin/static/css/site-settings.css",
-		"ExtraJS":  "/admin/static/js/site-settings.js",
+	c.Redirect(http.StatusMovedPermanently, "/admin/settings/brand")
+}
+
+// BrandPage 品牌与合规设置页
+func (sc *SiteSettingController) BrandPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/brand.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 品牌与合规",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "brand",
+	}))
+}
+
+// SecurityPage 安全与维护设置页
+func (sc *SiteSettingController) SecurityPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/security.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 安全与维护",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "security",
+	}))
+}
+
+// RegistrationPage 注册策略设置页
+func (sc *SiteSettingController) RegistrationPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/registration.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 注册策略",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "registration",
+	}))
+}
+
+// ContentPage 审核与内容设置页
+func (sc *SiteSettingController) ContentPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/content.html", common.BuildAdminPageData(c, gin.H{
+		"Title":         "站点设置 - 审核与内容",
+		"ExtraCSS":      "/admin/static/css/site-settings.css",
+		"ExtraJS":       "/admin/static/js/site-settings.js",
+		"ActiveSetting": "content",
 	}))
 }

--- a/internal/controller/comment_upload_controller.go
+++ b/internal/controller/comment_upload_controller.go
@ -28,12 +28,11 @@ func (ctrl *CommentController) UploadImage(c *gin.Context) {
 	}

 	// LV4+ 检查（Exp ≥ 1500）
-	expVal, exists := c.Get("exp")
-	if !exists {
+	exp, ok := common.GetGinExp(c)
+	if !ok {
 		common.Error(c, http.StatusForbidden, "无法获取经验值")
 		return
 	}
-	exp := expVal.(int)
 	if exp < 1500 {
 		common.Error(c, http.StatusForbidden, "需 Lv4 以上才能上传评论图片")
 		return
--- a/internal/controller/follow_controller.go
+++ b/internal/controller/follow_controller.go
@ -29,13 +29,13 @@ func (fc *FollowController) Toggle(c *gin.Context) {
 		return
 	}

-	targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
+	targetUID, err := common.ParseUIDParam(c, "uid")
 	if err != nil {
 		common.Error(c, http.StatusBadRequest, "无效的用户ID")
 		return
 	}

-	isFollowing, err := fc.followSvc.Toggle(uid, uint(targetUID))
+	isFollowing, err := fc.followSvc.Toggle(uid, targetUID)
 	if err != nil {
 		if err.Error() == "不能关注自己" {
 			common.Error(c, http.StatusBadRequest, err.Error())
@ -46,7 +46,7 @@ func (fc *FollowController) Toggle(c *gin.Context) {
 	}

 	// 获取最新状态
-	status, _ := fc.followSvc.GetStatus(uid, uint(targetUID))
+	status, _ := fc.followSvc.GetStatus(uid, targetUID)

 	common.Ok(c, gin.H{
 		"is_following": isFollowing,
@ -56,7 +56,7 @@ func (fc *FollowController) Toggle(c *gin.Context) {

 // GetStatus 查询关注关系 GET /api/users/:uid/follow-status
 func (fc *FollowController) GetStatus(c *gin.Context) {
-	targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
+	targetUID, err := common.ParseUIDParam(c, "uid")
 	if err != nil {
 		common.Error(c, http.StatusBadRequest, "无效的用户ID")
 		return
@ -64,7 +64,7 @@ func (fc *FollowController) GetStatus(c *gin.Context) {

 	uid, _, _ := common.GetGinUser(c) // 允许未登录（返回全是 false）

-	status, err := fc.followSvc.GetStatus(uid, uint(targetUID))
+	status, err := fc.followSvc.GetStatus(uid, targetUID)
 	if err != nil {
 		common.Error(c, http.StatusInternalServerError, "查询失败")
 		return
@ -75,7 +75,7 @@ func (fc *FollowController) GetStatus(c *gin.Context) {

 // Followers 粉丝列表 GET /api/users/:uid/followers
 func (fc *FollowController) Followers(c *gin.Context) {
-	targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
+	targetUID, err := common.ParseUIDParam(c, "uid")
 	if err != nil {
 		common.Error(c, http.StatusBadRequest, "无效的用户ID")
 		return
@ -86,7 +86,7 @@ func (fc *FollowController) Followers(c *gin.Context) {

 	uid, _, _ := common.GetGinUser(c) // 允许未登录

-	result, err := fc.followSvc.ListFollowers(uint(targetUID), uid, page, pageSize)
+	result, err := fc.followSvc.ListFollowers(targetUID, uid, page, pageSize)
 	if err != nil {
 		common.Error(c, http.StatusInternalServerError, "查询失败")
 		return
@ -97,7 +97,7 @@ func (fc *FollowController) Followers(c *gin.Context) {

 // Following 关注列表 GET /api/users/:uid/following
 func (fc *FollowController) Following(c *gin.Context) {
-	targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
+	targetUID, err := common.ParseUIDParam(c, "uid")
 	if err != nil {
 		common.Error(c, http.StatusBadRequest, "无效的用户ID")
 		return
@ -108,7 +108,7 @@ func (fc *FollowController) Following(c *gin.Context) {

 	uid, _, _ := common.GetGinUser(c)

-	result, err := fc.followSvc.ListFollowing(uint(targetUID), uid, page, pageSize)
+	result, err := fc.followSvc.ListFollowing(targetUID, uid, page, pageSize)
 	if err != nil {
 		common.Error(c, http.StatusInternalServerError, "查询失败")
 		return
@ -129,7 +129,7 @@ func NewFollowPageController(followSvc followUseCase) *FollowPageController {

 // FollowersPage 粉丝列表页面
 func (fpc *FollowPageController) FollowersPage(c *gin.Context) {
-	targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
+	targetUID, err := common.ParseUIDParam(c, "uid")
 	if err != nil {
 		common.Error(c, http.StatusBadRequest, "无效的用户ID")
 		return
@ -138,7 +138,7 @@ func (fpc *FollowPageController) FollowersPage(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))

 	uid, _, _ := common.GetGinUser(c)
-	result, err := fpc.followSvc.ListFollowers(uint(targetUID), uid, page, 20)
+	result, err := fpc.followSvc.ListFollowers(targetUID, uid, page, 20)
 	if err != nil {
 		result = &service.FollowListResult{Items: []model.UserFollow{}, Total: 0, Accessible: true}
 	}
@ -159,7 +159,7 @@ func (fpc *FollowPageController) FollowersPage(c *gin.Context) {

 // FollowingPage 关注列表页面
 func (fpc *FollowPageController) FollowingPage(c *gin.Context) {
-	targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
+	targetUID, err := common.ParseUIDParam(c, "uid")
 	if err != nil {
 		common.Error(c, http.StatusBadRequest, "无效的用户ID")
 		return
@ -168,7 +168,7 @@ func (fpc *FollowPageController) FollowingPage(c *gin.Context) {
 	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))

 	uid, _, _ := common.GetGinUser(c)
-	result, err := fpc.followSvc.ListFollowing(uint(targetUID), uid, page, 20)
+	result, err := fpc.followSvc.ListFollowing(targetUID, uid, page, 20)
 	if err != nil {
 		result = &service.FollowListResult{Items: []model.UserFollow{}, Total: 0, Accessible: true}
 	}
--- a/internal/controller/settings_controller.go
+++ b/internal/controller/settings_controller.go
@ -68,6 +68,7 @@ func (sc *SettingsController) SettingsPage(c *gin.Context) {
 	data := gin.H{
 		"Title":              "个人设置",
 		"ExtraCSS":           "/static/css/settings.css",
+		"ExtraJS":            "/static/js/settings-" + tab + ".js",
 		"ActiveTab":          tab,
 		"User":               user,
 		"RoleName":           model.RoleDisplayNames[user.Role],
@ -113,5 +114,22 @@ func (sc *SettingsController) SettingsPage(c *gin.Context) {
 		data["CurrentSID"] = currentSID
 	}

-	c.HTML(http.StatusOK, "settings/index.html", common.BuildPageData(c, data))
+	// 按 tab 渲染独立模板
+	tplName := "settings/index.html"
+	switch tab {
+	case "profile":
+		tplName = "settings/profile.html"
+	case "account":
+		tplName = "settings/account.html"
+	case "sessions":
+		tplName = "settings/sessions.html"
+	case "energy":
+		tplName = "settings/energy.html"
+	case "favorites":
+		tplName = "settings/favorites.html"
+	case "notify":
+		tplName = "settings/notify.html"
+	}
+
+	c.HTML(http.StatusOK, tplName, common.BuildPageData(c, data))
 }