MetaZone/mce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入
Some checks failed
CI / Lint + Build (push) Has been cancelled
Details

Browse Source 
审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线
This commit is contained in:
Victor Jay
2026-06-22 03:06:24 +08:00
parent e7185f58fb
commit 2449a27eb5
43 changed files with 2157 additions and 226 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
internal/controller/follow_controller.go
View File

@ -29,13 +29,13 @@ func (fc *FollowController) Toggle(c *gin.Context) {
return
}
targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
targetUID, err := common.ParseUIDParam(c, "uid")
if err != nil {
common.Error(c, http.StatusBadRequest, "无效的用户ID")
return
}
isFollowing, err := fc.followSvc.Toggle(uid, uint(targetUID))
isFollowing, err := fc.followSvc.Toggle(uid, targetUID)
if err != nil {
if err.Error() == "不能关注自己" {
common.Error(c, http.StatusBadRequest, err.Error())
@ -46,7 +46,7 @@ func (fc *FollowController) Toggle(c *gin.Context) {
}
// 获取最新状态
status, _ := fc.followSvc.GetStatus(uid, uint(targetUID))
status, _ := fc.followSvc.GetStatus(uid, targetUID)
common.Ok(c, gin.H{
"is_following": isFollowing,
@ -56,7 +56,7 @@ func (fc *FollowController) Toggle(c *gin.Context) {
// GetStatus 查询关注关系 GET /api/users/:uid/follow-status
func (fc *FollowController) GetStatus(c *gin.Context) {
targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
targetUID, err := common.ParseUIDParam(c, "uid")
if err != nil {
common.Error(c, http.StatusBadRequest, "无效的用户ID")
return
@ -64,7 +64,7 @@ func (fc *FollowController) GetStatus(c *gin.Context) {
uid, _, _ := common.GetGinUser(c) // 允许未登录（返回全是 false）
status, err := fc.followSvc.GetStatus(uid, uint(targetUID))
status, err := fc.followSvc.GetStatus(uid, targetUID)
if err != nil {
common.Error(c, http.StatusInternalServerError, "查询失败")
return
@ -75,7 +75,7 @@ func (fc *FollowController) GetStatus(c *gin.Context) {
// Followers 粉丝列表 GET /api/users/:uid/followers
func (fc *FollowController) Followers(c *gin.Context) {
targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
targetUID, err := common.ParseUIDParam(c, "uid")
if err != nil {
common.Error(c, http.StatusBadRequest, "无效的用户ID")
return
@ -86,7 +86,7 @@ func (fc *FollowController) Followers(c *gin.Context) {
uid, _, _ := common.GetGinUser(c) // 允许未登录
result, err := fc.followSvc.ListFollowers(uint(targetUID), uid, page, pageSize)
result, err := fc.followSvc.ListFollowers(targetUID, uid, page, pageSize)
if err != nil {
common.Error(c, http.StatusInternalServerError, "查询失败")
return
@ -97,7 +97,7 @@ func (fc *FollowController) Followers(c *gin.Context) {
// Following 关注列表 GET /api/users/:uid/following
func (fc *FollowController) Following(c *gin.Context) {
targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
targetUID, err := common.ParseUIDParam(c, "uid")
if err != nil {
common.Error(c, http.StatusBadRequest, "无效的用户ID")
return
@ -108,7 +108,7 @@ func (fc *FollowController) Following(c *gin.Context) {
uid, _, _ := common.GetGinUser(c)
result, err := fc.followSvc.ListFollowing(uint(targetUID), uid, page, pageSize)
result, err := fc.followSvc.ListFollowing(targetUID, uid, page, pageSize)
if err != nil {
common.Error(c, http.StatusInternalServerError, "查询失败")
return
@ -129,7 +129,7 @@ func NewFollowPageController(followSvc followUseCase) *FollowPageController {
// FollowersPage 粉丝列表页面
func (fpc *FollowPageController) FollowersPage(c *gin.Context) {
targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
targetUID, err := common.ParseUIDParam(c, "uid")
if err != nil {
common.Error(c, http.StatusBadRequest, "无效的用户ID")
return
@ -138,7 +138,7 @@ func (fpc *FollowPageController) FollowersPage(c *gin.Context) {
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
uid, _, _ := common.GetGinUser(c)
result, err := fpc.followSvc.ListFollowers(uint(targetUID), uid, page, 20)
result, err := fpc.followSvc.ListFollowers(targetUID, uid, page, 20)
if err != nil {
result = &service.FollowListResult{Items: []model.UserFollow{}, Total: 0, Accessible: true}
}
@ -159,7 +159,7 @@ func (fpc *FollowPageController) FollowersPage(c *gin.Context) {
// FollowingPage 关注列表页面
func (fpc *FollowPageController) FollowingPage(c *gin.Context) {
targetUID, err := strconv.ParseUint(c.Param("uid"), 10, 64)
targetUID, err := common.ParseUIDParam(c, "uid")
if err != nil {
common.Error(c, http.StatusBadRequest, "无效的用户ID")
return
@ -168,7 +168,7 @@ func (fpc *FollowPageController) FollowingPage(c *gin.Context) {
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
uid, _, _ := common.GetGinUser(c)
result, err := fpc.followSvc.ListFollowing(uint(targetUID), uid, page, 20)
result, err := fpc.followSvc.ListFollowing(targetUID, uid, page, 20)
if err != nil {
result = &service.FollowListResult{Items: []model.UserFollow{}, Total: 0, Accessible: true}
}