MetaZone/mce
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: CSP nonce替代unsafe-inline, HSTS始终启用, router/api拆分, 管理后台+用户设置页拆分, DB健康降级, 时区配置, UID统一解析, CI接入
Some checks failed
CI / Lint + Build (push) Has been cancelled
Details

Browse Source 
审计修复:
- CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用
- HSTS: 始终启用(不再依赖release模式)
- Controller Exp: common.GetGinExp包装, 不再直接读context
- UID解析: common.ParseUIDParam统一, follow/admin controller改用

重构:
- router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio
- 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单
- 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件

新增:
- DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面
- 时区配置: config.yaml server.timezone→time.Local初始化
- .gitea/workflows/ci.yml: strict模式CI流水线
This commit is contained in:
Victor Jay
2026-06-22 03:06:24 +08:00
parent e7185f58fb
commit 2449a27eb5
43 changed files with 2157 additions and 226 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
internal/router/admin.go
View File

@ -28,6 +28,14 @@ func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
adminPages.GET("/posts", d.adminPostCtrl.PostsPage)
adminPages.GET("/site-settings", d.siteSettingCtrl.SiteSettingsPage,
middleware.RequirePageRole(model.RoleOwner))
adminPages.GET("/settings/brand", d.siteSettingCtrl.BrandPage,
middleware.RequirePageRole(model.RoleOwner))
adminPages.GET("/settings/security", d.siteSettingCtrl.SecurityPage,
middleware.RequirePageRole(model.RoleOwner))
adminPages.GET("/settings/registration", d.siteSettingCtrl.RegistrationPage,
middleware.RequirePageRole(model.RoleOwner))
adminPages.GET("/settings/content", d.siteSettingCtrl.ContentPage,
middleware.RequirePageRole(model.RoleOwner))
adminPages.GET("/energy", d.adminEnergyCtrl.EnergyPage)
adminPages.GET("/energy/logs", d.adminEnergyCtrl.EnergyLogPage)
adminPages.GET("/energy/fund-logs", d.adminEnergyCtrl.FundLogPage)

196
internal/router/api.go
View File

@ -2,197 +2,17 @@ package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupAPIRoutes 注册 API 路由
// setupAPIRoutes 按域分发 API 路由注册
func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
// --- 设置页 API（需登录） ---
settingsAPI := r.Group("/api/settings")
settingsAPI.Use(d.authMdw.Required())
settingsAPI.Use(d.authMdw.BannedWriteGuard())
settingsAPI.Use(middleware.CSRF(cfg))
{
settingsAPI.PUT("/profile", d.settingsCtrl.UpdateProfile)
settingsAPI.POST("/avatar", d.settingsCtrl.UploadAvatar)
settingsAPI.PUT("/password", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.ChangePassword)
settingsAPI.POST("/delete-account", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.DeleteAccount)
settingsAPI.GET("/audit-status", d.settingsCtrl.AuditStatus)
// 登录管理
settingsAPI.GET("/sessions", d.settingsCtrl.ListSessions)
settingsAPI.DELETE("/sessions/:sid", d.settingsCtrl.DestroySession)
settingsAPI.POST("/sessions/destroy-others", d.settingsCtrl.DestroyOtherSessions)
settingsAPI.PUT("/sessions/:sid/remark", d.settingsCtrl.UpdateSessionRemark)
// 通知偏好
settingsAPI.GET("/notify-prefs", d.settingsCtrl.GetNotifyPrefs)
settingsAPI.PUT("/notify-prefs", d.settingsCtrl.UpdateNotifyPref)
}
// --- 消息中心 API（需登录） ---
messagesAPI := r.Group("/api/messages")
messagesAPI.Use(d.authMdw.Required())
messagesAPI.Use(d.authMdw.BannedWriteGuard())
messagesAPI.Use(middleware.CSRF(cfg))
{
messagesAPI.GET("/unread", d.messageCtrl.UnreadCount)
messagesAPI.POST("/:id/read", d.messageCtrl.MarkRead)
messagesAPI.POST("/read-all", d.messageCtrl.MarkAllRead)
}
// --- 积分/等级 API（需登录） ---
levelAPI := r.Group("/api/level")
levelAPI.Use(d.authMdw.Required())
levelAPI.Use(d.authMdw.BannedWriteGuard())
levelAPI.Use(middleware.CSRF(cfg))
{
levelAPI.POST("/checkin", middleware.SensitiveRateLimit(d.rateLimiter), d.levelCtrl.CheckIn)
levelAPI.GET("/info", d.levelCtrl.GetLevel)
}
// --- 认证 API ---
api := r.Group("/api")
api.Use(middleware.CSRF(cfg))
{
api.POST("/auth/check-email", d.authCtrl.CheckEmail)
api.POST("/auth/register", d.authCtrl.Register)
api.POST("/auth/login", d.authCtrl.Login)
api.POST("/auth/confirm-restore", d.authCtrl.ConfirmRestore)
api.POST("/auth/logout", d.authCtrl.Logout)
api.POST("/auth/refresh", d.authCtrl.RefreshToken)
// 帖子公开 API（无需登录）
api.GET("/posts", d.postCtrl.ListAPI)
api.GET("/posts/:id", d.postCtrl.ShowAPI)
}
// --- 帖子 API（需登录） ---
postsAPI := r.Group("/api/posts")
postsAPI.Use(d.authMdw.Required())
postsAPI.Use(d.authMdw.BannedWriteGuard())
postsAPI.Use(middleware.CSRF(cfg))
{
postsAPI.POST("/:id/submit", d.postCtrl.Submit)
postsAPI.POST("/upload-image", d.postCtrl.UploadImage)
}
// --- 创作中心 API（需登录） ---
studioAPI := r.Group("/api/studio")
studioAPI.Use(d.authMdw.Required())
studioAPI.Use(d.authMdw.BannedWriteGuard())
studioAPI.Use(middleware.CSRF(cfg))
{
studioAPI.GET("/overview", d.studioCtrl.OverviewAPI)
studioAPI.GET("/posts", d.studioCtrl.ListPostsAPI)
studioAPI.POST("/posts", d.studioCtrl.Create)
studioAPI.PUT("/posts/:id", d.studioCtrl.Update)
studioAPI.DELETE("/posts/:id", d.studioCtrl.Delete)
studioAPI.POST("/posts/:id/submit", d.studioCtrl.Submit)
}
// --- 域能 API（需登录） ---
energyAPI := r.Group("/api/energy")
energyAPI.Use(d.authMdw.Required())
energyAPI.Use(d.authMdw.BannedWriteGuard())
energyAPI.Use(middleware.CSRF(cfg))
{
energyAPI.POST("/energize", d.energyCtrl.Energize)
energyAPI.GET("/info", d.energyCtrl.GetEnergyInfo)
energyAPI.GET("/logs", d.energyCtrl.GetEnergyLogs)
}
// --- 评论 API（部分需登录） ---
// 公开读取
commentsPublic := r.Group("/api/posts/:id/comments")
{
commentsPublic.GET("", d.commentCtrl.ListRootComments)
commentsPublic.GET("/:root_id/replies", d.commentCtrl.ListReplies)
}
// 需要登录的操作
commentsAPI := r.Group("/api")
commentsAPI.Use(d.authMdw.Required())
commentsAPI.Use(d.authMdw.BannedWriteGuard())
commentsAPI.Use(middleware.CSRF(cfg))
{
commentsAPI.POST("/posts/:id/comments", d.commentCtrl.CreateRoot)
commentsAPI.POST("/comments/:id/reply", d.commentCtrl.CreateReply)
commentsAPI.DELETE("/comments/:id", d.commentCtrl.Delete)
commentsAPI.GET("/users/search", d.commentCtrl.SearchUsers)
commentsAPI.POST("/comments/upload-image", d.commentCtrl.UploadImage)
}
// --- 赞/踩 API ---
// 公开：查询反应状态（未登录返回 none + 点赞数）
r.GET("/api/posts/:id/reaction", d.reactionCtrl.GetReaction)
// 需登录：切换赞/踩
reactionAPI := r.Group("/api/posts/:id")
reactionAPI.Use(d.authMdw.Required())
reactionAPI.Use(d.authMdw.BannedWriteGuard())
reactionAPI.Use(middleware.CSRF(cfg))
{
reactionAPI.POST("/like", d.reactionCtrl.ToggleLike)
reactionAPI.POST("/dislike", d.reactionCtrl.ToggleDislike)
}
// --- 关注 API ---
// 公开（Optional 认证以获取当前用户关注状态，未登录返回 false）
followPublic := r.Group("/api/users/:uid")
followPublic.Use(d.authMdw.Optional())
{
followPublic.GET("/follow-status", d.followCtrl.GetStatus)
followPublic.GET("/followers", d.followCtrl.Followers)
followPublic.GET("/following", d.followCtrl.Following)
}
// 需登录：切换关注
followAPI := r.Group("/api/users/:uid")
followAPI.Use(d.authMdw.Required())
followAPI.Use(d.authMdw.BannedWriteGuard())
followAPI.Use(middleware.CSRF(cfg))
{
followAPI.POST("/follow", d.followCtrl.Toggle)
}
// --- 收藏夹 API ---
// 公开：文章收藏状态（未登录返回 false）
r.GET("/api/posts/:id/folder-status", d.favoriteCtrl.GetPostStatus)
// 公开：查看公开收藏夹内容
r.GET("/api/folders/:id/posts", d.favoriteCtrl.ListFolderItems)
// 需登录：收藏操作
folderAPI := r.Group("/api/folders")
folderAPI.Use(d.authMdw.Required())
folderAPI.Use(d.authMdw.BannedWriteGuard())
folderAPI.Use(middleware.CSRF(cfg))
{
folderAPI.GET("", d.favoriteCtrl.ListFolders)
folderAPI.POST("", d.favoriteCtrl.CreateFolder)
folderAPI.PUT("/:id", d.favoriteCtrl.UpdateFolder)
folderAPI.DELETE("/:id", d.favoriteCtrl.DeleteFolder)
folderAPI.POST("/:id/posts", d.favoriteCtrl.AddToFolder)
folderAPI.DELETE("/:id/posts/:postId", d.favoriteCtrl.RemoveFromFolder)
}
// 需登录：切换收藏（Toggle）
favToggleAPI := r.Group("/api/posts/:id")
favToggleAPI.Use(d.authMdw.Required())
favToggleAPI.Use(d.authMdw.BannedWriteGuard())
favToggleAPI.Use(middleware.CSRF(cfg))
{
favToggleAPI.POST("/favorite", d.favoriteCtrl.ToggleFavorite)
}
// --- 空间/隐私设置 API（需登录） ---
spaceAPI := r.Group("/api/space")
spaceAPI.Use(d.authMdw.Required())
spaceAPI.Use(d.authMdw.BannedWriteGuard())
spaceAPI.Use(middleware.CSRF(cfg))
{
spaceAPI.PUT("/privacy", d.spaceCtrl.UpdatePrivacy)
}
// --- Studio 趋势 API（需登录） ---
trendsAPI := r.Group("/api/studio")
trendsAPI.Use(d.authMdw.Required())
{
trendsAPI.GET("/trends", d.studioCtrl.TrendsAPI)
}
setupAuthAPIRoutes(r, cfg, d)
setupSettingsAPIRoutes(r, cfg, d)
setupPostsAPIRoutes(r, cfg, d)
setupCommentsAPIRoutes(r, cfg, d)
setupStudioAPIRoutes(r, cfg, d)
setupReactionsAPIRoutes(r, cfg, d)
setupSocialAPIRoutes(r, cfg, d)
}

27
internal/router/api_auth.go Normal file
View File

@ -0,0 +1,27 @@
package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupAuthAPIRoutes 注册认证相关 API 路由
func setupAuthAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
api := r.Group("/api")
api.Use(middleware.CSRF(cfg))
{
// 认证
api.POST("/auth/check-email", d.authCtrl.CheckEmail)
api.POST("/auth/register", d.authCtrl.Register)
api.POST("/auth/login", d.authCtrl.Login)
api.POST("/auth/confirm-restore", d.authCtrl.ConfirmRestore)
api.POST("/auth/logout", d.authCtrl.Logout)
api.POST("/auth/refresh", d.authCtrl.RefreshToken)
// 帖子公开 API（无需登录）
api.GET("/posts", d.postCtrl.ListAPI)
api.GET("/posts/:id", d.postCtrl.ShowAPI)
}
}

31
internal/router/api_comments.go Normal file
View File

@ -0,0 +1,31 @@
package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupCommentsAPIRoutes 注册评论相关 API 路由
func setupCommentsAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
// 公开读取
commentsPublic := r.Group("/api/posts/:id/comments")
{
commentsPublic.GET("", d.commentCtrl.ListRootComments)
commentsPublic.GET("/:root_id/replies", d.commentCtrl.ListReplies)
}
// 需要登录的操作
commentsAPI := r.Group("/api")
commentsAPI.Use(d.authMdw.Required())
commentsAPI.Use(d.authMdw.BannedWriteGuard())
commentsAPI.Use(middleware.CSRF(cfg))
{
commentsAPI.POST("/posts/:id/comments", d.commentCtrl.CreateRoot)
commentsAPI.POST("/comments/:id/reply", d.commentCtrl.CreateReply)
commentsAPI.DELETE("/comments/:id", d.commentCtrl.Delete)
commentsAPI.GET("/users/search", d.commentCtrl.SearchUsers)
commentsAPI.POST("/comments/upload-image", d.commentCtrl.UploadImage)
}
}

20
internal/router/api_posts.go Normal file
View File

@ -0,0 +1,20 @@
package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupPostsAPIRoutes 注册帖子相关 API 路由
func setupPostsAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
postsAPI := r.Group("/api/posts")
postsAPI.Use(d.authMdw.Required())
postsAPI.Use(d.authMdw.BannedWriteGuard())
postsAPI.Use(middleware.CSRF(cfg))
{
postsAPI.POST("/:id/submit", d.postCtrl.Submit)
postsAPI.POST("/upload-image", d.postCtrl.UploadImage)
}
}

24
internal/router/api_reactions.go Normal file
View File

@ -0,0 +1,24 @@
package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupReactionsAPIRoutes 注册赞/踩相关 API 路由
func setupReactionsAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
// 公开：查询反应状态
r.GET("/api/posts/:id/reaction", d.reactionCtrl.GetReaction)
// 需登录：切换赞/踩
reactionAPI := r.Group("/api/posts/:id")
reactionAPI.Use(d.authMdw.Required())
reactionAPI.Use(d.authMdw.BannedWriteGuard())
reactionAPI.Use(middleware.CSRF(cfg))
{
reactionAPI.POST("/like", d.reactionCtrl.ToggleLike)
reactionAPI.POST("/dislike", d.reactionCtrl.ToggleDislike)
}
}

51
internal/router/api_settings.go Normal file
View File

@ -0,0 +1,51 @@
package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupSettingsAPIRoutes 注册设置、消息、等级相关 API 路由
func setupSettingsAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
// 设置页 API
settingsAPI := r.Group("/api/settings")
settingsAPI.Use(d.authMdw.Required())
settingsAPI.Use(d.authMdw.BannedWriteGuard())
settingsAPI.Use(middleware.CSRF(cfg))
{
settingsAPI.PUT("/profile", d.settingsCtrl.UpdateProfile)
settingsAPI.POST("/avatar", d.settingsCtrl.UploadAvatar)
settingsAPI.PUT("/password", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.ChangePassword)
settingsAPI.POST("/delete-account", middleware.SensitiveRateLimit(d.rateLimiter), d.settingsCtrl.DeleteAccount)
settingsAPI.GET("/audit-status", d.settingsCtrl.AuditStatus)
settingsAPI.GET("/sessions", d.settingsCtrl.ListSessions)
settingsAPI.DELETE("/sessions/:sid", d.settingsCtrl.DestroySession)
settingsAPI.POST("/sessions/destroy-others", d.settingsCtrl.DestroyOtherSessions)
settingsAPI.PUT("/sessions/:sid/remark", d.settingsCtrl.UpdateSessionRemark)
settingsAPI.GET("/notify-prefs", d.settingsCtrl.GetNotifyPrefs)
settingsAPI.PUT("/notify-prefs", d.settingsCtrl.UpdateNotifyPref)
}
// 消息中心 API
messagesAPI := r.Group("/api/messages")
messagesAPI.Use(d.authMdw.Required())
messagesAPI.Use(d.authMdw.BannedWriteGuard())
messagesAPI.Use(middleware.CSRF(cfg))
{
messagesAPI.GET("/unread", d.messageCtrl.UnreadCount)
messagesAPI.POST("/:id/read", d.messageCtrl.MarkRead)
messagesAPI.POST("/read-all", d.messageCtrl.MarkAllRead)
}
// 积分/等级 API
levelAPI := r.Group("/api/level")
levelAPI.Use(d.authMdw.Required())
levelAPI.Use(d.authMdw.BannedWriteGuard())
levelAPI.Use(middleware.CSRF(cfg))
{
levelAPI.POST("/checkin", middleware.SensitiveRateLimit(d.rateLimiter), d.levelCtrl.CheckIn)
levelAPI.GET("/info", d.levelCtrl.GetLevel)
}
}

64
internal/router/api_social.go Normal file
View File

@ -0,0 +1,64 @@
package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupSocialAPIRoutes 注册关注、收藏夹、空间相关 API 路由
func setupSocialAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
// 关注 — 公开（Optional 认证）
followPublic := r.Group("/api/users/:uid")
followPublic.Use(d.authMdw.Optional())
{
followPublic.GET("/follow-status", d.followCtrl.GetStatus)
followPublic.GET("/followers", d.followCtrl.Followers)
followPublic.GET("/following", d.followCtrl.Following)
}
// 需登录：切换关注
followAPI := r.Group("/api/users/:uid")
followAPI.Use(d.authMdw.Required())
followAPI.Use(d.authMdw.BannedWriteGuard())
followAPI.Use(middleware.CSRF(cfg))
{
followAPI.POST("/follow", d.followCtrl.Toggle)
}
// 收藏夹 — 公开
r.GET("/api/posts/:id/folder-status", d.favoriteCtrl.GetPostStatus)
r.GET("/api/folders/:id/posts", d.favoriteCtrl.ListFolderItems)
// 收藏夹 — 需登录
folderAPI := r.Group("/api/folders")
folderAPI.Use(d.authMdw.Required())
folderAPI.Use(d.authMdw.BannedWriteGuard())
folderAPI.Use(middleware.CSRF(cfg))
{
folderAPI.GET("", d.favoriteCtrl.ListFolders)
folderAPI.POST("", d.favoriteCtrl.CreateFolder)
folderAPI.PUT("/:id", d.favoriteCtrl.UpdateFolder)
folderAPI.DELETE("/:id", d.favoriteCtrl.DeleteFolder)
folderAPI.POST("/:id/posts", d.favoriteCtrl.AddToFolder)
folderAPI.DELETE("/:id/posts/:postId", d.favoriteCtrl.RemoveFromFolder)
}
// 切换收藏 Toggle
favToggleAPI := r.Group("/api/posts/:id")
favToggleAPI.Use(d.authMdw.Required())
favToggleAPI.Use(d.authMdw.BannedWriteGuard())
favToggleAPI.Use(middleware.CSRF(cfg))
{
favToggleAPI.POST("/favorite", d.favoriteCtrl.ToggleFavorite)
}
// 空间/隐私设置
spaceAPI := r.Group("/api/space")
spaceAPI.Use(d.authMdw.Required())
spaceAPI.Use(d.authMdw.BannedWriteGuard())
spaceAPI.Use(middleware.CSRF(cfg))
{
spaceAPI.PUT("/privacy", d.spaceCtrl.UpdatePrivacy)
}
}

43
internal/router/api_studio.go Normal file
View File

@ -0,0 +1,43 @@
package router
import (
"metazone.cc/mce/internal/config"
"metazone.cc/mce/internal/middleware"
"github.com/gin-gonic/gin"
)
// setupStudioAPIRoutes 注册创作中心、域能、趋势相关 API 路由
func setupStudioAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
// 创作中心
studioAPI := r.Group("/api/studio")
studioAPI.Use(d.authMdw.Required())
studioAPI.Use(d.authMdw.BannedWriteGuard())
studioAPI.Use(middleware.CSRF(cfg))
{
studioAPI.GET("/overview", d.studioCtrl.OverviewAPI)
studioAPI.GET("/posts", d.studioCtrl.ListPostsAPI)
studioAPI.POST("/posts", d.studioCtrl.Create)
studioAPI.PUT("/posts/:id", d.studioCtrl.Update)
studioAPI.DELETE("/posts/:id", d.studioCtrl.Delete)
studioAPI.POST("/posts/:id/submit", d.studioCtrl.Submit)
}
// 域能
energyAPI := r.Group("/api/energy")
energyAPI.Use(d.authMdw.Required())
energyAPI.Use(d.authMdw.BannedWriteGuard())
energyAPI.Use(middleware.CSRF(cfg))
{
energyAPI.POST("/energize", d.energyCtrl.Energize)
energyAPI.GET("/info", d.energyCtrl.GetEnergyInfo)
energyAPI.GET("/logs", d.energyCtrl.GetEnergyLogs)
}
// 趋势
trendsAPI := r.Group("/api/studio")
trendsAPI.Use(d.authMdw.Required())
{
trendsAPI.GET("/trends", d.studioCtrl.TrendsAPI)
}
}

1
internal/router/router.go
View File

@ -14,6 +14,7 @@ import (
func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSettings, redisClient *redis.Client) {
r.Use(middleware.SecurityHeaders())
r.Use(middleware.InjectSiteInfo(siteSettings))
r.Use(middleware.DBHealthGuard())
deps := buildDeps(db, cfg, siteSettings, redisClient)