初始化项目：基础设施 + 用户认证 + 后台管理系统 + AGPL 3.0 许可
This commit is contained in:
131
internal/controller/admin/admin_controller.go
Normal file
131
internal/controller/admin/admin_controller.go
Normal file
@ -0,0 +1,131 @@
|
||||
package admin
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
"metazone.cc/metalab/internal/service"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// AdminController 管理后台控制器
|
||||
type AdminController struct {
|
||||
adminService *service.AdminService
|
||||
}
|
||||
|
||||
// NewAdminController 构造函数
|
||||
func NewAdminController(adminService *service.AdminService) *AdminController {
|
||||
return &AdminController{adminService: adminService}
|
||||
}
|
||||
|
||||
// Dashboard 管理首页（欢迎页）
|
||||
func (ac *AdminController) Dashboard(c *gin.Context) {
|
||||
c.HTML(http.StatusOK, "admin/dashboard/index.html", common.BuildAdminPageData(c, gin.H{
|
||||
"Title": "管理首页",
|
||||
}))
|
||||
}
|
||||
|
||||
// UsersPage 用户管理页面
|
||||
func (ac *AdminController) UsersPage(c *gin.Context) {
|
||||
c.HTML(http.StatusOK, "admin/users/index.html", common.BuildAdminPageData(c, gin.H{
|
||||
"Title": "用户管理",
|
||||
"ExtraCSS": "/admin/static/css/users.css",
|
||||
"ExtraJS": "/admin/static/js/users.js",
|
||||
}))
|
||||
}
|
||||
|
||||
// ListUsers 用户列表 API（分页 + 搜索 + 筛选）
|
||||
func (ac *AdminController) ListUsers(c *gin.Context) {
|
||||
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||||
pageSize, _ := strconv.Atoi(c.DefaultQuery("page_size", "20"))
|
||||
|
||||
params := service.ListUsersParams{
|
||||
Keyword: c.Query("keyword"),
|
||||
Role: c.Query("role"),
|
||||
Status: c.Query("status"),
|
||||
Page: page,
|
||||
PageSize: pageSize,
|
||||
}
|
||||
|
||||
result, err := ac.adminService.ListUsers(params)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "查询失败")
|
||||
return
|
||||
}
|
||||
|
||||
common.Ok(c, result)
|
||||
}
|
||||
|
||||
// UpdateUserStatus 封禁/解封用户
|
||||
func (ac *AdminController) UpdateUserStatus(c *gin.Context) {
|
||||
targetUID, err := parseUIDParam(c)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "无效的用户 ID")
|
||||
return
|
||||
}
|
||||
|
||||
var req struct {
|
||||
Status string `json:"status" binding:"required"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "参数错误")
|
||||
return
|
||||
}
|
||||
|
||||
operatorUID := c.GetUint("uid")
|
||||
if err := ac.adminService.UpdateUserStatus(operatorUID, targetUID, req.Status); err != nil {
|
||||
handleServiceError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
action := "封禁"
|
||||
if req.Status == model.StatusActive {
|
||||
action = "解封"
|
||||
} else if req.Status == model.StatusLocked {
|
||||
action = "已删除"
|
||||
}
|
||||
common.OkMessage(c, action+"成功")
|
||||
}
|
||||
|
||||
// ResetToken 强制用户下线
|
||||
func (ac *AdminController) ResetToken(c *gin.Context) {
|
||||
targetUID, err := parseUIDParam(c)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "无效的用户 ID")
|
||||
return
|
||||
}
|
||||
|
||||
operatorUID := c.GetUint("uid")
|
||||
if err := ac.adminService.ResetUserToken(operatorUID, targetUID); err != nil {
|
||||
handleServiceError(c, err)
|
||||
return
|
||||
}
|
||||
|
||||
common.OkMessage(c, "已强制下线")
|
||||
}
|
||||
|
||||
// parseUIDParam 从 URL 路径参数解析 uid
|
||||
func parseUIDParam(c *gin.Context) (uint, error) {
|
||||
uid, err := strconv.ParseUint(c.Param("uid"), 10, 64)
|
||||
if err != nil {
|
||||
return 0, err
|
||||
}
|
||||
return uint(uid), nil
|
||||
}
|
||||
|
||||
// handleServiceError 统一处理 service 层返回的错误
|
||||
func handleServiceError(c *gin.Context, err error) {
|
||||
switch err {
|
||||
case common.ErrPermissionDenied:
|
||||
common.Error(c, http.StatusForbidden, "权限不足")
|
||||
case common.ErrUserNotFound:
|
||||
common.Error(c, http.StatusNotFound, "用户不存在")
|
||||
case common.ErrEmailExists:
|
||||
common.Error(c, http.StatusConflict, "该邮箱已被其他用户注册，无法解锁")
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||||
}
|
||||
}
|
||||
229
internal/controller/auth_controller.go
Normal file
229
internal/controller/auth_controller.go
Normal file
@ -0,0 +1,229 @@
|
||||
package controller
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
|
||||
"metazone.cc/metalab/internal/common"
|
||||
"metazone.cc/metalab/internal/config"
|
||||
"metazone.cc/metalab/internal/middleware"
|
||||
"metazone.cc/metalab/internal/model"
|
||||
"metazone.cc/metalab/internal/service"
|
||||
"metazone.cc/metalab/internal/theme"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
)
|
||||
|
||||
// AuthController 认证相关页面 + API
|
||||
type AuthController struct {
|
||||
authService *service.AuthService
|
||||
tokenService *service.TokenService
|
||||
rateLimiter *middleware.RateLimiter
|
||||
cfg *config.Config
|
||||
}
|
||||
|
||||
// NewAuthController 构造函数
|
||||
func NewAuthController(authService *service.AuthService, tokenSvc *service.TokenService, limiter *middleware.RateLimiter, cfg *config.Config) *AuthController {
|
||||
return &AuthController{authService: authService, tokenService: tokenSvc, rateLimiter: limiter, cfg: cfg}
|
||||
}
|
||||
|
||||
// RegisterPage 注册页面（已登录用户重定向到首页）
|
||||
func (ac *AuthController) RegisterPage(c *gin.Context) {
|
||||
if _, exists := c.Get("uid"); exists {
|
||||
c.Redirect(http.StatusMovedPermanently, "/")
|
||||
return
|
||||
}
|
||||
guidelines, err := theme.LoadContent("templates/MetaLab-2026/guidelines.html")
|
||||
if err != nil {
|
||||
c.String(http.StatusInternalServerError, "加载准则失败")
|
||||
return
|
||||
}
|
||||
c.HTML(http.StatusOK, "auth/register.html", common.BuildPageData(c, gin.H{
|
||||
"Title": "注册",
|
||||
"ExtraCSS": "/static/css/auth.css",
|
||||
"Guidelines": guidelines,
|
||||
}))
|
||||
}
|
||||
|
||||
// LoginPage 登录页面（已登录用户重定向到首页）
|
||||
func (ac *AuthController) LoginPage(c *gin.Context) {
|
||||
if _, exists := c.Get("uid"); exists {
|
||||
c.Redirect(http.StatusMovedPermanently, "/")
|
||||
return
|
||||
}
|
||||
c.HTML(http.StatusOK, "auth/login.html", common.BuildPageData(c, gin.H{
|
||||
"Title": "登录",
|
||||
"ExtraCSS": "/static/css/auth.css",
|
||||
}))
|
||||
}
|
||||
|
||||
// clientIP 获取客户端真实 IP（考虑反向代理）
|
||||
func clientIP(c *gin.Context) string {
|
||||
if fwd := c.GetHeader("X-Forwarded-For"); fwd != "" {
|
||||
return fwd
|
||||
}
|
||||
if real := c.GetHeader("X-Real-IP"); real != "" {
|
||||
return real
|
||||
}
|
||||
return c.ClientIP()
|
||||
}
|
||||
|
||||
// Login 登录 API（含双维度限流）
|
||||
func (ac *AuthController) Login(c *gin.Context) {
|
||||
var req model.LoginRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请检查输入")
|
||||
return
|
||||
}
|
||||
|
||||
email := req.Email
|
||||
ip := clientIP(c)
|
||||
|
||||
// --- 限流：账户维度 ---
|
||||
acctResult, recordAccount := ac.rateLimiter.AllowAccount(email)
|
||||
if acctResult.Blocked {
|
||||
common.Error(c, http.StatusTooManyRequests, acctResult.Message)
|
||||
return
|
||||
}
|
||||
|
||||
// --- 限流：IP 维度 ---
|
||||
ipResult, recordIP := ac.rateLimiter.AllowIP(ip)
|
||||
if ipResult.Blocked {
|
||||
common.Error(c, http.StatusTooManyRequests, ipResult.Message)
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, refreshToken, user, err := ac.authService.Login(req)
|
||||
if err != nil {
|
||||
// 记录失败 → 两个维度各 +1
|
||||
if recordAccount != nil {
|
||||
recordAccount()
|
||||
}
|
||||
if recordIP != nil {
|
||||
recordIP()
|
||||
}
|
||||
|
||||
switch err {
|
||||
case service.ErrInvalidCred:
|
||||
common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
|
||||
case service.ErrUserBanned:
|
||||
common.Error(c, http.StatusForbidden, "账号已被封禁")
|
||||
case service.ErrUserLocked:
|
||||
common.Error(c, http.StatusUnauthorized, "邮箱或密码错误")
|
||||
case service.ErrUserDeleted:
|
||||
// deleted 状态本应在 Login 中自动恢复，此 case 作为兜底
|
||||
common.Error(c, http.StatusForbidden, "该账号已申请注销，登录即自动恢复")
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "登录失败，请稍后重试")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// 登录成功 → 清除失败计数
|
||||
ac.rateLimiter.Clear(email, ip)
|
||||
|
||||
common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"message": "登录成功",
|
||||
"data": user,
|
||||
})
|
||||
}
|
||||
|
||||
// CheckEmail 检查邮箱是否已注册
|
||||
func (ac *AuthController) CheckEmail(c *gin.Context) {
|
||||
var req model.CheckEmailRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请提供有效的邮箱地址")
|
||||
return
|
||||
}
|
||||
|
||||
exists, err := ac.authService.CheckEmail(req.Email)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusInternalServerError, "检查失败")
|
||||
return
|
||||
}
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"data": gin.H{"exists": exists},
|
||||
})
|
||||
}
|
||||
|
||||
// Register 注册 API
|
||||
func (ac *AuthController) Register(c *gin.Context) {
|
||||
var req model.RegisterRequest
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
common.Error(c, http.StatusBadRequest, "请检查输入："+err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
// 注册 IP 限流：1 分钟 5 次
|
||||
regResult, recordReg := ac.rateLimiter.AllowIP(clientIP(c) + ":register")
|
||||
if regResult.Blocked {
|
||||
common.Error(c, http.StatusTooManyRequests, "注册请求过于频繁，请稍后重试")
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, refreshToken, user, err := ac.authService.Register(req)
|
||||
if err != nil {
|
||||
if recordReg != nil {
|
||||
recordReg()
|
||||
}
|
||||
switch err {
|
||||
case service.ErrEmailExists:
|
||||
common.Error(c, http.StatusConflict, "该邮箱已注册")
|
||||
case service.ErrWeakPassword:
|
||||
common.Error(c, http.StatusBadRequest, err.Error())
|
||||
default:
|
||||
common.Error(c, http.StatusInternalServerError, "注册失败，请稍后重试")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
common.SetAuthCookies(c, accessToken, refreshToken, req.RememberMe, ac.cfg)
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"message": "注册成功！欢迎加入 MetaLab",
|
||||
"data": user,
|
||||
})
|
||||
}
|
||||
|
||||
// Logout 退出登录：清除所有认证 Cookie
|
||||
func (ac *AuthController) Logout(c *gin.Context) {
|
||||
common.ClearAuthCookies(c, ac.cfg)
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
"message": "已退出登录",
|
||||
})
|
||||
}
|
||||
|
||||
// RefreshToken 用 refresh token 换取新的 access token
|
||||
func (ac *AuthController) RefreshToken(c *gin.Context) {
|
||||
refreshToken, err := c.Cookie(common.RefreshCookieName)
|
||||
if err != nil {
|
||||
common.Error(c, http.StatusUnauthorized, "请重新登录")
|
||||
return
|
||||
}
|
||||
|
||||
accessToken, _, err := ac.tokenService.RefreshAccessToken(refreshToken)
|
||||
if err != nil {
|
||||
common.ClearAuthCookies(c, ac.cfg)
|
||||
switch err {
|
||||
case service.ErrTokenExpired, service.ErrTokenRevoked:
|
||||
common.Error(c, http.StatusUnauthorized, "登录凭证已失效，请重新登录")
|
||||
case service.ErrUserBanned:
|
||||
common.Error(c, http.StatusForbidden, "账号已被封禁")
|
||||
default:
|
||||
common.Error(c, http.StatusUnauthorized, "请重新登录")
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
common.SetAccessCookie(c, accessToken, ac.cfg)
|
||||
|
||||
c.JSON(http.StatusOK, gin.H{
|
||||
"success": true,
|
||||
})
|
||||
}
|
||||
Reference in New Issue
Block a user