refactor: 拆分 middleware/router 为单一职责文件，新增站点设置管理页面

middleware:
- 拆分 auth.go → auth.go + auth_token.go + auth_parser.go + auth_admin.go
- 拆分 csrf.go → csrf.go + csrf_token.go
- 拆分 ratelimit.go → ratelimit.go + ratelimit_core.go + ratelimit_cleanup.go
- 修复 import 未使用/缺失问题

router:
- 拆分 router.go → admin.go + api.go + frontend.go + deps_core.go + deps_extra.go

feat(admin): 站点设置管理页面
- 新增 SSR 页面 /admin/site-settings（仅 Owner）
- 审核开关 Toggle 即时保存
- 通用设置展示
- 侧边栏新增站点设置入口
- 注册 UpdateBoolSetting/GetBoolSetting API 路由

internal/controller/admin/site_setting_controller.go

@@ -21,6 +21,15 @@ func NewSiteSettingController(settingService siteSettingUseCase, defaults *servi
 	return &SiteSettingController{settingService: settingService, defaults: defaults}
 }
 
+// SiteSettingsPage 站点设置管理页面
+func (sc *SiteSettingController) SiteSettingsPage(c *gin.Context) {
+	c.HTML(http.StatusOK, "admin/site-settings/index.html", common.BuildAdminPageData(c, gin.H{
+		"Title":   "站点设置",
+		"ExtraCSS": "/admin/static/css/site-settings.css",
+		"ExtraJS":  "/admin/static/js/site-settings.js",
+	}))
+}
+
 // GetSettings 获取所有站点设置
 func (sc *SiteSettingController) GetSettings(c *gin.Context) {
 	all := sc.settingService.GetSettings()

internal/middleware/auth.go

@@ -1,16 +1,10 @@
 package middleware
 
 import (
-	"log"
-	"net/http"
-	"strings"
-	"time"
-
 	"metazone.cc/metalab/internal/common"
 	"metazone.cc/metalab/internal/config"
 
 	"github.com/gin-gonic/gin"
-	"github.com/golang-jwt/jwt/v5"
 )
 
 // AuthMiddleware 认证中间件（结构体模式，持有 DB 依赖用于实时令牌吊销校验）
@@ -25,7 +19,6 @@ func NewAuthMiddleware(cfg *config.Config, userRepo tokenVersionStore) *AuthMidd
 }
 
 // Required 登录认证中间件：校验 JWT → 检查 token_version → 注入用户信息
-// 令牌版本与 DB 不匹配时即时拒绝，实现实时吊销
 func (am *AuthMiddleware) Required() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		claims, err := am.authenticateToken(c)
@@ -36,122 +29,20 @@ func (am *AuthMiddleware) Required() gin.HandlerFunc {
 			})
 			return
 		}
-
 		injectUserContext(c, claims)
 		c.Next()
 	}
 }
 
-// Optional 可选认证：已登录且版本通过则注入，未登录或版本不匹配也放行（仅清除过期 Cookie）
+// Optional 可选认证：已登录且版本通过则注入，未登录或版本不匹配也放行
 func (am *AuthMiddleware) Optional() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		claims, err := am.authenticateToken(c)
 		if err != nil {
-			log.Printf("[AuthOptional] token invalid for %s: %v", c.Request.URL.Path, err)
 			c.Next()
 			return
 		}
-
-		log.Printf("[AuthOptional] OK: uid=%v username=%v path=%s", claims["uid"], claims["username"], c.Request.URL.Path)
 		injectUserContext(c, claims)
 		c.Next()
 	}
 }
-
-// AdminAuth 管理后台页面认证：失败时 302 跳首页而非返回 JSON
-func (am *AuthMiddleware) AdminAuth() gin.HandlerFunc {
-	return func(c *gin.Context) {
-		claims, err := am.authenticateToken(c)
-		if err != nil {
-			log.Printf("[AdminAuth] auth failed path=%s err=%v → 302", c.Request.URL.Path, err)
-			common.ClearAuthCookies(c, am.cfg)
-			c.Redirect(http.StatusFound, "/")
-			c.Abort()
-			return
-		}
-
-		log.Printf("[AdminAuth] OK: uid=%v role=%v path=%s", claims["uid"], claims["role"], c.Request.URL.Path)
-		injectUserContext(c, claims)
-		c.Next()
-	}
-}
-
-// authenticateToken 统一的认证核心流程：读 Cookie → 解析 JWT → 检查 token_version
-// 成功返回 claims，失败返回 error（调用方自行决定如何响应）
-func (am *AuthMiddleware) authenticateToken(c *gin.Context) (jwt.MapClaims, error) {
-	tokenStr, err := c.Cookie(common.CookieName)
-	if err != nil {
-		return nil, err
-	}
-
-	claims, err := parseToken(tokenStr, am.cfg.JWT.Secret)
-	if err != nil {
-		return nil, err
-	}
-
-	uid := uint(claims["uid"].(float64))
-	tokenVer := int(claims["ver"].(float64))
-
-	currentVer, err := am.userRepo.FindTokenVersion(uid)
-	if err != nil {
-		return nil, err
-	}
-	if tokenVer != currentVer {
-		log.Printf("[authenticateToken] REVOKED: uid=%d tokenVer=%d dbVer=%d", uid, tokenVer, currentVer)
-		return nil, common.ErrTokenRevoked
-	}
-
-	return claims, nil
-}
-
-// injectUserContext 将 JWT claims 中的用户信息注入 gin context
-func injectUserContext(c *gin.Context, claims jwt.MapClaims) {
-	if claims == nil {
-		return
-	}
-	uid, ok := claims["uid"].(float64)
-	if !ok {
-		return
-	}
-	c.Set("uid", uint(uid))
-	c.Set("email", claims["email"])
-	c.Set("username", claims["username"])
-	c.Set("role", claims["role"])
-}
-
-// parseToken 解析并验证 JWT
-func parseToken(tokenStr, secret string) (jwt.MapClaims, error) {
-	now := time.Now()
-	token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
-		return []byte(secret), nil
-	})
-	if err != nil || !token.Valid {
-		log.Printf("[parseToken] FAIL: now=%v err=%v (secret_len=%d token_len=%d)",
-			now, err, len(secret), len(tokenStr))
-		return nil, err
-	}
-	claims, ok := token.Claims.(jwt.MapClaims)
-	if !ok {
-		return nil, jwt.ErrSignatureInvalid
-	}
-	// Debug: 打印 exp/iat 对比当前时间
-	if exp, exists := claims["exp"]; exists {
-		var expTime time.Time
-		switch v := exp.(type) {
-		case float64:
-			expTime = time.Unix(int64(v), 0)
-		case *jwt.NumericDate:
-			expTime = v.Time
-		}
-		if !expTime.IsZero() {
-			log.Printf("[parseToken] OK: exp=%v (%d) now=%v isExpired=%v",
-				expTime, expTime.Unix(), now, now.After(expTime))
-		}
-	}
-	return claims, nil
-}
-
-// IsLoginPage 检查是否已在登录状态，已登录用户跳过登录/注册页
-func IsLoginPage(c *gin.Context) bool {
-	return strings.HasPrefix(c.Request.URL.Path, "/auth/")
-}

internal/middleware/auth_admin.go

@@ -0,0 +1,27 @@
+package middleware
+
+import (
+	"log"
+	"net/http"
+
+	"metazone.cc/metalab/internal/common"
+
+	"github.com/gin-gonic/gin"
+)
+
+// AdminAuth 管理后台页面认证：失败时 302 跳首页而非返回 JSON
+func (am *AuthMiddleware) AdminAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		claims, err := am.authenticateToken(c)
+		if err != nil {
+			log.Printf("[AdminAuth] auth failed path=%s err=%v → 302", c.Request.URL.Path, err)
+			common.ClearAuthCookies(c, am.cfg)
+			c.Redirect(http.StatusFound, "/")
+			c.Abort()
+			return
+		}
+		log.Printf("[AdminAuth] OK: uid=%v role=%v path=%s", claims["uid"], claims["role"], c.Request.URL.Path)
+		injectUserContext(c, claims)
+		c.Next()
+	}
+}

internal/middleware/auth_parser.go

@@ -0,0 +1,46 @@
+package middleware
+
+import (
+	"log"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// parseToken 解析并验证 JWT
+func parseToken(tokenStr, secret string) (jwt.MapClaims, error) {
+	now := time.Now()
+	token, err := jwt.Parse(tokenStr, func(t *jwt.Token) (interface{}, error) {
+		return []byte(secret), nil
+	})
+	if err != nil || !token.Valid {
+		log.Printf("[parseToken] FAIL: now=%v err=%v (secret_len=%d token_len=%d)",
+			now, err, len(secret), len(tokenStr))
+		return nil, err
+	}
+	claims, ok := token.Claims.(jwt.MapClaims)
+	if !ok {
+		return nil, jwt.ErrSignatureInvalid
+	}
+	if exp, exists := claims["exp"]; exists {
+		var expTime time.Time
+		switch v := exp.(type) {
+		case float64:
+			expTime = time.Unix(int64(v), 0)
+		case *jwt.NumericDate:
+			expTime = v.Time
+		}
+		if !expTime.IsZero() {
+			log.Printf("[parseToken] OK: exp=%v (%d) now=%v isExpired=%v",
+				expTime, expTime.Unix(), now, now.After(expTime))
+		}
+	}
+	return claims, nil
+}
+
+// IsLoginPage 检查是否已在登录状态，已登录用户跳过登录/注册页
+func IsLoginPage(c *gin.Context) bool {
+	return strings.HasPrefix(c.Request.URL.Path, "/auth/")
+}

internal/middleware/auth_token.go

@@ -0,0 +1,48 @@
+package middleware
+
+import (
+	"log"
+
+	"metazone.cc/metalab/internal/common"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+// authenticateToken 统一的认证核心流程：读 Cookie → 解析 JWT → 检查 token_version
+func (am *AuthMiddleware) authenticateToken(c *gin.Context) (jwt.MapClaims, error) {
+	tokenStr, err := c.Cookie(common.CookieName)
+	if err != nil {
+		return nil, err
+	}
+	claims, err := parseToken(tokenStr, am.cfg.JWT.Secret)
+	if err != nil {
+		return nil, err
+	}
+	uid := uint(claims["uid"].(float64))
+	tokenVer := int(claims["ver"].(float64))
+	currentVer, err := am.userRepo.FindTokenVersion(uid)
+	if err != nil {
+		return nil, err
+	}
+	if tokenVer != currentVer {
+		log.Printf("[authenticateToken] REVOKED: uid=%d tokenVer=%d dbVer=%d", uid, tokenVer, currentVer)
+		return nil, common.ErrTokenRevoked
+	}
+	return claims, nil
+}
+
+// injectUserContext 将 JWT claims 中的用户信息注入 gin context
+func injectUserContext(c *gin.Context, claims jwt.MapClaims) {
+	if claims == nil {
+		return
+	}
+	uid, ok := claims["uid"].(float64)
+	if !ok {
+		return
+	}
+	c.Set("uid", uint(uid))
+	c.Set("email", claims["email"])
+	c.Set("username", claims["username"])
+	c.Set("role", claims["role"])
+}

internal/middleware/csrf.go

@@ -1,8 +1,6 @@
 package middleware
 
 import (
-	"crypto/rand"
-	"encoding/hex"
 	"net/http"
 
 	"metazone.cc/metalab/internal/config"
@@ -14,15 +12,11 @@ const (
 	csrfCookieName = "mlb_csrf"
 	csrfHeaderName = "X-CSRF-Token"
 	csrfMetaName   = "csrf_token"
-	csrfTokenLen   = 32 // 字节
 )
 
 // CSRF 中间件：Double Submit Cookie 模式
-// 前端 JS 从 Cookie 中读取 token 并放入 X-CSRF-Token 请求头，后端验证两者一致
-// GET / HEAD / OPTIONS 请求自动放行
 func CSRF(cfg *config.Config) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		// 安全读取豁免
 		if c.Request.Method == http.MethodGet ||
 			c.Request.Method == http.MethodHead ||
 			c.Request.Method == http.MethodOptions {
@@ -39,7 +33,6 @@ func CSRF(cfg *config.Config) gin.HandlerFunc {
 		}
 
 		headerToken := c.GetHeader(csrfHeaderName)
-		// Fallback：如果请求头没有，尝试从表单字段读取（纯 HTML form 提交通道）
 		if headerToken == "" {
 			headerToken = c.PostForm(csrfMetaName)
 		}
@@ -50,7 +43,6 @@ func CSRF(cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
-		// 恒定时间比较防时序攻击
 		if !constantTimeEq(cookieToken, headerToken) {
 			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
 				"success": false, "message": "CSRF 验证失败",
@@ -58,55 +50,7 @@ func CSRF(cfg *config.Config) gin.HandlerFunc {
 			return
 		}
 
-		// 注入到上下文，供前端 <meta> 使用
 		c.Set(csrfMetaName, cookieToken)
 		c.Next()
 	}
 }
-
-// SetCSRFToken 在首次页面访问时下发 CSRF Cookie（由页面路由中间件调用）
-// 注意：此 Cookie HttpOnly=false，JS 可读——这是 Double Submit 模式的必要条件
-func SetCSRFToken(c *gin.Context, cfg *config.Config) string {
-	secure := cfg.Server.Mode != "debug"
-
-	// 如果已有 token 且未过期，复用（但必须注入 context，供模板 meta 标签使用）
-	if existing, err := c.Cookie(csrfCookieName); err == nil && existing != "" {
-		c.Set(csrfMetaName, existing)
-		return existing
-	}
-
-	token, err := generateCSRFToken()
-	if err != nil {
-		// 极端情况：随机数生成失败，使用短 token
-		token = "fallback-" + hex.EncodeToString([]byte("metazone"))
-	}
-
-	c.SetSameSite(http.SameSiteStrictMode)
-	// 30 天有效期，与 refresh token 对齐
-	maxAge := int(cfg.JWT.RememberExpire * 3600)
-	c.SetCookie(csrfCookieName, token, maxAge, "/", "", secure, false)
-
-	c.Set(csrfMetaName, token)
-	return token
-}
-
-// generateCSRFToken 生成 64 字符十六进制随机 CSRF token
-func generateCSRFToken() (string, error) {
-	b := make([]byte, csrfTokenLen)
-	if _, err := rand.Read(b); err != nil {
-		return "", err
-	}
-	return hex.EncodeToString(b), nil
-}
-
-// constantTimeEq 恒定时间字符串比较（防时序攻击）
-func constantTimeEq(a, b string) bool {
-	if len(a) != len(b) {
-		return false
-	}
-	var result byte
-	for i := 0; i < len(a); i++ {
-		result |= a[i] ^ b[i]
-	}
-	return result == 0
-}

internal/middleware/csrf_token.go

@@ -0,0 +1,54 @@
+package middleware
+
+import (
+	"crypto/rand"
+	"encoding/hex"
+	"net/http"
+
+	"metazone.cc/metalab/internal/config"
+
+	"github.com/gin-gonic/gin"
+)
+
+const csrfTokenLen = 32
+
+// SetCSRFToken 在首次页面访问时下发 CSRF Cookie（由页面路由中间件调用）
+func SetCSRFToken(c *gin.Context, cfg *config.Config) string {
+	secure := cfg.Server.Mode != "debug"
+	if existing, err := c.Cookie(csrfCookieName); err == nil && existing != "" {
+		c.Set(csrfMetaName, existing)
+		return existing
+	}
+
+	token, err := generateCSRFToken()
+	if err != nil {
+		token = "fallback-" + hex.EncodeToString([]byte("metazone"))
+	}
+
+	c.SetSameSite(http.SameSiteStrictMode)
+	maxAge := int(cfg.JWT.RememberExpire * 3600)
+	c.SetCookie(csrfCookieName, token, maxAge, "/", "", secure, false)
+	c.Set(csrfMetaName, token)
+	return token
+}
+
+// generateCSRFToken 生成 64 字符十六进制随机 CSRF token
+func generateCSRFToken() (string, error) {
+	b := make([]byte, csrfTokenLen)
+	if _, err := rand.Read(b); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(b), nil
+}
+
+// constantTimeEq 恒定时间字符串比较（防时序攻击）
+func constantTimeEq(a, b string) bool {
+	if len(a) != len(b) {
+		return false
+	}
+	var result byte
+	for i := 0; i < len(a); i++ {
+		result |= a[i] ^ b[i]
+	}
+	return result == 0
+}

internal/middleware/ratelimit.go

@@ -1,47 +1,16 @@
 package middleware
 
-import (
+import "sync"
-	"fmt"
-	"sync"
-	"time"
-)
 
 // RateLimiter 双维度滑动窗口登录限流
 // 维度一（账户）：同邮箱 1 分钟内失败 3 次 → 锁定 1 分钟
 // 维度二（IP）：同 IP 1 分钟内失败 10 次 → 锁定 1 分钟
 type RateLimiter struct {
-	mu sync.RWMutex
+	mu              sync.RWMutex
-	// accountFailures key = 邮箱（小写）
 	accountFailures map[string]*windowState
-	// ipFailures key = IP
+	ipFailures      map[string]*windowState
-	ipFailures map[string]*windowState
 }
 
-// windowState 单个维度的限流状态
-type windowState struct {
-	count      int
-	windowStart time.Time
-	blockedUntil time.Time // 零值为未封锁
-}
-
-// RateLimitResult 限流检查结果
-type RateLimitResult struct {
-	Blocked    bool
-	RetryAfter int // 剩余封锁秒数
-	Message    string
-}
-
-const (
-	accountWindow     = 1 * time.Minute
-	accountMaxFails   = 3
-	accountBlockDur   = 1 * time.Minute
-	ipWindow          = 1 * time.Minute
-	ipMaxFails        = 10
-	ipBlockDur        = 1 * time.Minute
-	cleanupInterval   = 2 * time.Minute
-	maxEntries        = 10000 // 单维度最大条目数（防内存耗尽）
-)
-
 // NewRateLimiter 创建限流器并启动后台清理
 func NewRateLimiter() *RateLimiter {
 	rl := &RateLimiter{
@@ -53,7 +22,6 @@ func NewRateLimiter() *RateLimiter {
 }
 
 // AllowAccount 检查账户维度是否允许登录尝试
-// 返回 (result, 登录失败时应调用的记录函数)
 func (rl *RateLimiter) AllowAccount(email string) (RateLimitResult, func()) {
 	return rl.check(rl.accountFailures, email, accountWindow, accountBlockDur, accountMaxFails, true)
 }
@@ -62,88 +30,3 @@ func (rl *RateLimiter) AllowAccount(email string) (RateLimitResult, func()) {
 func (rl *RateLimiter) AllowIP(ip string) (RateLimitResult, func()) {
 	return rl.check(rl.ipFailures, ip, ipWindow, ipBlockDur, ipMaxFails, false)
 }
-
-// check 核心检查逻辑
-// lowKey: 是否需要脱敏日志（true = 暗示账户存在，仅泄漏给已知该邮箱的人）
-func (rl *RateLimiter) check(m map[string]*windowState, key string, window, blockDur time.Duration, maxFails int, lowKey bool) (RateLimitResult, func()) {
-	rl.mu.Lock()
-	defer rl.mu.Unlock()
-
-	now := time.Now()
-	state, exists := m[key]
-
-	if !exists {
-		state = &windowState{}
-		if len(m) < maxEntries {
-			m[key] = state
-		}
-	}
-
-	// 检查是否处于封锁期
-	if !state.blockedUntil.IsZero() && now.Before(state.blockedUntil) {
-		retry := int(state.blockedUntil.Sub(now).Seconds()) + 1
-		msg := "请求过于频繁，请稍后重试"
-		if lowKey {
-			msg = fmt.Sprintf("该账号登录尝试过于频繁，请 %d 秒后重试", retry)
-		}
-		return RateLimitResult{Blocked: true, RetryAfter: retry, Message: msg}, nil
-	}
-
-	// 窗口过期 → 重置
-	if now.Sub(state.windowStart) > window {
-		state.count = 0
-		state.windowStart = now
-		state.blockedUntil = time.Time{}
-	}
-
-	// 记录失败（由调用方在登录失败时调用）的闭包
-	recordFail := func() {
-		rl.mu.Lock()
-		defer rl.mu.Unlock()
-		s := m[key]
-		if s == nil {
-			return
-		}
-		if now.Sub(s.windowStart) > window {
-			s.count = 1
-			s.windowStart = now
-			return
-		}
-		s.count++
-		if s.count >= maxFails {
-			s.blockedUntil = now.Add(blockDur)
-		}
-	}
-
-	return RateLimitResult{Blocked: false}, recordFail
-}
-
-// Clear 登录成功后清除该 email 和 IP 的失败计数
-func (rl *RateLimiter) Clear(email, ip string) {
-	rl.mu.Lock()
-	defer rl.mu.Unlock()
-	delete(rl.accountFailures, email)
-	delete(rl.ipFailures, ip)
-}
-
-// cleanupLoop 定期清理过期条目
-func (rl *RateLimiter) cleanupLoop() {
-	ticker := time.NewTicker(cleanupInterval)
-	defer ticker.Stop()
-	for range ticker.C {
-		rl.mu.Lock()
-		now := time.Now()
-		clean := func(m map[string]*windowState) {
-			for k, v := range m {
-				// 封锁期已过且窗口已过期 → 删除
-				if (v.blockedUntil.IsZero() || now.After(v.blockedUntil)) &&
-					now.Sub(v.windowStart) > accountWindow+ipBlockDur {
-					delete(m, k)
-				}
-			}
-		}
-		clean(rl.accountFailures)
-		clean(rl.ipFailures)
-		rl.mu.Unlock()
-	}
-}

internal/middleware/ratelimit_cleanup.go

@@ -0,0 +1,32 @@
+package middleware
+
+import "time"
+
+// Clear 登录成功后清除该 email 和 IP 的失败计数
+func (rl *RateLimiter) Clear(email, ip string) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+	delete(rl.accountFailures, email)
+	delete(rl.ipFailures, ip)
+}
+
+// cleanupLoop 定期清理过期条目
+func (rl *RateLimiter) cleanupLoop() {
+	ticker := time.NewTicker(cleanupInterval)
+	defer ticker.Stop()
+	for range ticker.C {
+		rl.mu.Lock()
+		now := time.Now()
+		clean := func(m map[string]*windowState) {
+			for k, v := range m {
+				if (v.blockedUntil.IsZero() || now.After(v.blockedUntil)) &&
+					now.Sub(v.windowStart) > accountWindow+ipBlockDur {
+					delete(m, k)
+				}
+			}
+		}
+		clean(rl.accountFailures)
+		clean(rl.ipFailures)
+		rl.mu.Unlock()
+	}
+}

internal/middleware/ratelimit_core.go

@@ -0,0 +1,81 @@
+package middleware
+
+import (
+	"fmt"
+	"time"
+)
+
+// RateLimitResult 限流检查结果
+type RateLimitResult struct {
+	Blocked    bool
+	RetryAfter int
+	Message    string
+}
+
+const (
+	accountWindow   = 1 * time.Minute
+	accountMaxFails = 3
+	accountBlockDur = 1 * time.Minute
+	ipWindow        = 1 * time.Minute
+	ipMaxFails      = 10
+	ipBlockDur      = 1 * time.Minute
+	cleanupInterval = 2 * time.Minute
+	maxEntries      = 10000
+)
+
+// windowState 单个维度的限流状态
+type windowState struct {
+	count        int
+	windowStart  time.Time
+	blockedUntil time.Time
+}
+
+// check 核心检查逻辑
+func (rl *RateLimiter) check(m map[string]*windowState, key string, window, blockDur time.Duration, maxFails int, lowKey bool) (RateLimitResult, func()) {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	now := time.Now()
+	state, exists := m[key]
+	if !exists {
+		state = &windowState{}
+		if len(m) < maxEntries {
+			m[key] = state
+		}
+	}
+
+	if !state.blockedUntil.IsZero() && now.Before(state.blockedUntil) {
+		retry := int(state.blockedUntil.Sub(now).Seconds()) + 1
+		msg := "请求过于频繁，请稍后重试"
+		if lowKey {
+			msg = fmt.Sprintf("该账号登录尝试过于频繁，请 %d 秒后重试", retry)
+		}
+		return RateLimitResult{Blocked: true, RetryAfter: retry, Message: msg}, nil
+	}
+
+	if now.Sub(state.windowStart) > window {
+		state.count = 0
+		state.windowStart = now
+		state.blockedUntil = time.Time{}
+	}
+
+	recordFail := func() {
+		rl.mu.Lock()
+		defer rl.mu.Unlock()
+		s := m[key]
+		if s == nil {
+			return
+		}
+		if now.Sub(s.windowStart) > window {
+			s.count = 1
+			s.windowStart = now
+			return
+		}
+		s.count++
+		if s.count >= maxFails {
+			s.blockedUntil = now.Add(blockDur)
+		}
+	}
+
+	return RateLimitResult{Blocked: false}, recordFail
+}

internal/router/admin.go

@@ -0,0 +1,57 @@
+package router
+
+import (
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/middleware"
+	"metazone.cc/metalab/internal/model"
+
+	"github.com/gin-gonic/gin"
+)
+
+// setupAdminRoutes 注册管理后台页面和 API 路由
+func setupAdminRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
+	// --- 管理后台 SSR 页面 ---
+	adminPages := r.Group("/admin")
+	adminPages.Use(d.authMdw.AdminAuth())
+	adminPages.Use(middleware.RequirePageRole(model.RoleModerator))
+	adminPages.Use(middleware.CSRF(cfg))
+	adminPages.Use(func(c *gin.Context) {
+		middleware.SetCSRFToken(c, cfg)
+		c.Next()
+	})
+	{
+		adminPages.GET("/", d.adminCtrl.Dashboard)
+		adminPages.GET("/users", d.adminCtrl.UsersPage,
+			middleware.RequirePageRole(model.RoleAdmin))
+		adminPages.GET("/audits", d.auditCtrl.AuditPage,
+			middleware.RequirePageRole(model.RoleAdmin))
+		adminPages.GET("/site-settings", d.siteSettingCtrl.SiteSettingsPage,
+			middleware.RequirePageRole(model.RoleOwner))
+	}
+
+	// --- 管理后台 API ---
+	adminAPI := r.Group("/api/admin")
+	adminAPI.Use(d.authMdw.Required())
+	adminAPI.Use(middleware.RequireMinRole(model.RoleAdmin))
+	adminAPI.Use(middleware.CSRF(cfg))
+	{
+		adminAPI.GET("/users", d.adminCtrl.ListUsers)
+		adminAPI.PUT("/users/:uid/status", d.adminCtrl.UpdateUserStatus)
+		adminAPI.POST("/users/:uid/reset-token", d.adminCtrl.ResetToken)
+		adminAPI.GET("/audits", d.auditCtrl.ListAudits)
+		adminAPI.POST("/audits/:id/approve", d.auditCtrl.Approve)
+		adminAPI.POST("/audits/:id/reject", d.auditCtrl.Reject)
+	}
+
+	// --- 站点设置 API（仅 owner） ---
+	siteSettingsAPI := r.Group("/api/admin/site-settings")
+	siteSettingsAPI.Use(d.authMdw.Required())
+	siteSettingsAPI.Use(middleware.RequireMinRole(model.RoleOwner))
+	siteSettingsAPI.Use(middleware.CSRF(cfg))
+	{
+		siteSettingsAPI.GET("", d.siteSettingCtrl.GetSettings)
+		siteSettingsAPI.PUT("", d.siteSettingCtrl.UpdateSetting)
+		siteSettingsAPI.PUT("/bool", d.siteSettingCtrl.UpdateBoolSetting)
+		siteSettingsAPI.GET("/bool", d.siteSettingCtrl.GetBoolSetting)
+	}
+}

internal/router/api.go

@@ -0,0 +1,45 @@
+package router
+
+import (
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+// setupAPIRoutes 注册 API 路由
+func setupAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
+	// --- 设置页 API（需登录） ---
+	settingsAPI := r.Group("/api/settings")
+	settingsAPI.Use(d.authMdw.Required())
+	settingsAPI.Use(middleware.CSRF(cfg))
+	{
+		settingsAPI.PUT("/profile", d.settingsCtrl.UpdateProfile)
+		settingsAPI.POST("/avatar", d.settingsCtrl.UploadAvatar)
+		settingsAPI.PUT("/password", d.settingsCtrl.ChangePassword)
+		settingsAPI.POST("/delete-account", d.settingsCtrl.DeleteAccount)
+		settingsAPI.GET("/audit-status", d.settingsCtrl.AuditStatus)
+	}
+
+	// --- 消息中心 API（需登录） ---
+	messagesAPI := r.Group("/api/messages")
+	messagesAPI.Use(d.authMdw.Required())
+	messagesAPI.Use(middleware.CSRF(cfg))
+	{
+		messagesAPI.GET("/unread", d.messageCtrl.UnreadCount)
+		messagesAPI.POST("/:id/read", d.messageCtrl.MarkRead)
+		messagesAPI.POST("/read-all", d.messageCtrl.MarkAllRead)
+	}
+
+	// --- 认证 API ---
+	api := r.Group("/api")
+	api.Use(middleware.CSRF(cfg))
+	{
+		api.POST("/auth/check-email", d.tokenCtrl.CheckEmail)
+		api.POST("/auth/register", d.tokenCtrl.Register)
+		api.POST("/auth/login", d.tokenCtrl.Login)
+		api.POST("/auth/confirm-restore", d.tokenCtrl.ConfirmRestore)
+		api.POST("/auth/logout", d.tokenCtrl.Logout)
+		api.POST("/auth/refresh", d.tokenCtrl.RefreshToken)
+	}
+}

internal/router/deps_core.go

@@ -0,0 +1,39 @@
+package router
+
+import (
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/controller"
+	adminCtrl "metazone.cc/metalab/internal/controller/admin"
+	"metazone.cc/metalab/internal/middleware"
+	"metazone.cc/metalab/internal/repository"
+	"metazone.cc/metalab/internal/service"
+
+	"gorm.io/gorm"
+)
+
+type dependencies struct {
+	authCtrl        *controller.AuthController
+	authMdw         *middleware.AuthMiddleware
+	settingsCtrl    *controller.SettingsController
+	messageCtrl     *controller.MessageController
+	adminCtrl       *adminCtrl.AdminController
+	auditCtrl       *adminCtrl.AuditController
+	siteSettingCtrl *adminCtrl.SiteSettingController
+	tokenCtrl       *controller.AuthController
+}
+
+func buildDepsCore(db *gorm.DB, cfg *config.Config) (
+	*repository.UserRepo, *service.TokenService, *service.AuthService,
+	*middleware.RateLimiter, *controller.AuthController,
+	*service.AvatarService, *middleware.AuthMiddleware, *adminCtrl.AdminController,
+) {
+	userRepo := repository.NewUserRepo(db)
+	tokenSvc := service.NewTokenService(cfg, userRepo)
+	authService := service.NewAuthService(userRepo, tokenSvc, cfg)
+	rateLimiter := middleware.NewRateLimiter()
+	authCtrl := controller.NewAuthController(authService, tokenSvc, rateLimiter, cfg)
+	avatarSvc := service.NewAvatarService(userRepo)
+	authMdw := middleware.NewAuthMiddleware(cfg, userRepo)
+	adminController := adminCtrl.NewAdminController(service.NewAdminService(userRepo))
+	return userRepo, tokenSvc, authService, rateLimiter, authCtrl, avatarSvc, authMdw, adminController
+}

internal/router/deps_extra.go

@@ -0,0 +1,38 @@
+package router
+
+import (
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/controller"
+	adminCtrl "metazone.cc/metalab/internal/controller/admin"
+	"metazone.cc/metalab/internal/repository"
+	"metazone.cc/metalab/internal/service"
+
+	"gorm.io/gorm"
+)
+
+func buildDeps(db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSettings) *dependencies {
+	userRepo, _, authService, _, authCtrl, avatarSvc, authMdw, adminController := buildDepsCore(db, cfg)
+
+	auditRepo := repository.NewAuditRepo(db)
+	notificationRepo := repository.NewNotificationRepo(db)
+	notificationService := service.NewNotificationService(notificationRepo)
+	auditService := service.NewAuditService(auditRepo, userRepo, siteSettings, cfg.Audit, notificationService)
+	auditController := adminCtrl.NewAuditController(auditService, userRepo)
+
+	messageController := controller.NewMessageController(notificationService)
+
+	settingsCtrl := controller.NewSettingsController(authService, avatarSvc, auditService)
+	siteSettingController := adminCtrl.NewSiteSettingController(
+		service.NewSiteSettingService(siteSettings),
+		&service.AuditDefaults{
+			Enabled: cfg.Audit.Enabled, UsernameAudit: cfg.Audit.UsernameAudit,
+			AvatarAudit: cfg.Audit.AvatarAudit, BioAudit: cfg.Audit.BioAudit,
+		},
+	)
+
+	return &dependencies{
+		authCtrl: authCtrl, authMdw: authMdw, settingsCtrl: settingsCtrl,
+		messageCtrl: messageController, adminCtrl: adminController,
+		auditCtrl: auditController, siteSettingCtrl: siteSettingController, tokenCtrl: authCtrl,
+	}
+}

internal/router/frontend.go

@@ -0,0 +1,50 @@
+package router
+
+import (
+	"net/http"
+
+	"metazone.cc/metalab/internal/common"
+	"metazone.cc/metalab/internal/config"
+	"metazone.cc/metalab/internal/middleware"
+
+	"github.com/gin-gonic/gin"
+)
+
+// setupFrontendRoutes 注册前端页面路由
+func setupFrontendRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
+	// --- 页面路由（CSRF 仅下发 token，不验证） ---
+	pages := r.Group("/")
+	pages.Use(d.authMdw.Optional())
+	pages.Use(middleware.CSRF(cfg))
+	pages.Use(func(c *gin.Context) {
+		middleware.SetCSRFToken(c, cfg)
+		c.Next()
+	})
+	{
+		pages.GET("/", func(c *gin.Context) {
+			c.HTML(http.StatusOK, "home/index.html", common.BuildPageData(c, gin.H{
+				"Title":    "首页",
+				"ExtraCSS": "/static/css/home.css",
+			}))
+		})
+
+		pages.GET("/settings", func(c *gin.Context) {
+			c.Redirect(http.StatusFound, "/settings/profile")
+		})
+		pages.GET("/settings/:tab", d.settingsCtrl.SettingsPage)
+		pages.GET("/messages", d.messageCtrl.MessagesPage)
+	}
+
+	// 认证页面（已登录自动跳走）
+	authPages := r.Group("/auth")
+	authPages.Use(d.authMdw.Optional())
+	authPages.Use(middleware.CSRF(cfg))
+	authPages.Use(func(c *gin.Context) {
+		middleware.SetCSRFToken(c, cfg)
+		c.Next()
+	})
+	{
+		authPages.GET("/register", d.authCtrl.RegisterPage)
+		authPages.GET("/login", d.authCtrl.LoginPage)
+	}
+}

internal/router/router.go

@@ -1,16 +1,8 @@
 package router
 
 import (
-	"net/http"
-
-	"metazone.cc/metalab/internal/common"
 	"metazone.cc/metalab/internal/config"
-	"metazone.cc/metalab/internal/controller"
-	adminCtrl "metazone.cc/metalab/internal/controller/admin"
 	"metazone.cc/metalab/internal/middleware"
-	"metazone.cc/metalab/internal/model"
-	"metazone.cc/metalab/internal/repository"
-	"metazone.cc/metalab/internal/service"
 
 	"github.com/gin-gonic/gin"
 	"gorm.io/gorm"
@@ -18,159 +10,11 @@ import (
 
 // Setup 注册所有路由
 func Setup(r *gin.Engine, db *gorm.DB, cfg *config.Config, siteSettings *config.SiteSettings) {
-	// --- 全局中间件 ---
 	r.Use(middleware.SecurityHeaders())
 
-	// --- 依赖注入 ---
+	deps := buildDeps(db, cfg, siteSettings)
-	userRepo := repository.NewUserRepo(db)
-	tokenSvc := service.NewTokenService(cfg, userRepo)
-	authService := service.NewAuthService(userRepo, tokenSvc, cfg)
-	rateLimiter := middleware.NewRateLimiter()
-	authCtrl := controller.NewAuthController(authService, tokenSvc, rateLimiter, cfg)
-	avatarSvc := service.NewAvatarService(userRepo)
-	authMdw := middleware.NewAuthMiddleware(cfg, userRepo)
 
-	// 管理后台
+	setupFrontendRoutes(r, cfg, deps)
-	adminService := service.NewAdminService(userRepo)
+	setupAPIRoutes(r, cfg, deps)
-	adminController := adminCtrl.NewAdminController(adminService)
+	setupAdminRoutes(r, cfg, deps)
-
-	// 审核系统
-	auditRepo := repository.NewAuditRepo(db)
-	notificationRepo := repository.NewNotificationRepo(db)
-	notificationService := service.NewNotificationService(notificationRepo)
-	auditService := service.NewAuditService(auditRepo, userRepo, siteSettings, cfg.Audit, notificationService)
-	auditController := adminCtrl.NewAuditController(auditService, userRepo)
-
-	// 消息中心
-	messageController := controller.NewMessageController(notificationService)
-
-	// 站点设置
-	siteSettingService := service.NewSiteSettingService(siteSettings)
-	auditDefaults := &service.AuditDefaults{
-		Enabled:       cfg.Audit.Enabled,
-		UsernameAudit: cfg.Audit.UsernameAudit,
-		AvatarAudit:   cfg.Audit.AvatarAudit,
-		BioAudit:      cfg.Audit.BioAudit,
-	}
-	siteSettingController := adminCtrl.NewSiteSettingController(siteSettingService, auditDefaults)
-
-	// 个人设置（需要审核服务）
-	settingsCtrl := controller.NewSettingsController(authService, avatarSvc, auditService)
-
-	// --- 页面路由（CSRF 仅下发 token，不验证——页面 GET 被豁免） ---
-	pages := r.Group("/")
-	pages.Use(authMdw.Optional())
-	pages.Use(middleware.CSRF(cfg))
-	pages.Use(func(c *gin.Context) {
-		// 页面路由：确保每个页面都下发 CSRF Cookie
-		middleware.SetCSRFToken(c, cfg)
-		c.Next()
-	})
-	{
-		pages.GET("/", func(c *gin.Context) {
-			c.HTML(http.StatusOK, "home/index.html", common.BuildPageData(c, gin.H{
-				"Title":    "首页",
-				"ExtraCSS": "/static/css/home.css",
-			}))
-		})
-
-		// 个人设置页（需登录，/:tab 为伪静态子页面）
-		pages.GET("/settings", func(c *gin.Context) {
-			c.Redirect(http.StatusFound, "/settings/profile")
-		})
-		pages.GET("/settings/:tab", settingsCtrl.SettingsPage)
-
-		// 消息中心（需登录，noindex）
-		pages.GET("/messages", messageController.MessagesPage)
-	}
-
-	// 认证页面（已登录自动跳走）
-	authPages := r.Group("/auth")
-	authPages.Use(authMdw.Optional())
-	authPages.Use(middleware.CSRF(cfg))
-	authPages.Use(func(c *gin.Context) {
-		middleware.SetCSRFToken(c, cfg)
-		c.Next()
-	})
-	{
-		authPages.GET("/register", authCtrl.RegisterPage)
-		authPages.GET("/login", authCtrl.LoginPage)
-	}
-
-	// --- 设置页 API（需登录） ---
-	settingsAPI := r.Group("/api/settings")
-	settingsAPI.Use(authMdw.Required())
-	settingsAPI.Use(middleware.CSRF(cfg))
-	{
-		settingsAPI.PUT("/profile", settingsCtrl.UpdateProfile)
-		settingsAPI.POST("/avatar", settingsCtrl.UploadAvatar)
-		settingsAPI.PUT("/password", settingsCtrl.ChangePassword)
-		settingsAPI.POST("/delete-account", settingsCtrl.DeleteAccount)
-		// 查询当前用户的待审核状态
-		settingsAPI.GET("/audit-status", settingsCtrl.AuditStatus)
-	}
-
-	// --- 消息中心 API（需登录） ---
-	messagesAPI := r.Group("/api/messages")
-	messagesAPI.Use(authMdw.Required())
-	messagesAPI.Use(middleware.CSRF(cfg))
-	{
-		messagesAPI.GET("/unread", messageController.UnreadCount)
-		messagesAPI.POST("/:id/read", messageController.MarkRead)
-		messagesAPI.POST("/read-all", messageController.MarkAllRead)
-	}
-
-	// --- 管理后台 SSR 页面（认证失败 302 跳首页） ---
-	adminPages := r.Group("/admin")
-	adminPages.Use(authMdw.AdminAuth())
-	adminPages.Use(middleware.RequirePageRole(model.RoleModerator))
-	adminPages.Use(middleware.CSRF(cfg))
-	adminPages.Use(func(c *gin.Context) {
-		middleware.SetCSRFToken(c, cfg)
-		c.Next()
-	})
-	{
-		adminPages.GET("/", adminController.Dashboard)
-		adminPages.GET("/users", adminController.UsersPage,
-			middleware.RequirePageRole(model.RoleAdmin))
-		adminPages.GET("/audits", auditController.AuditPage,
-			middleware.RequirePageRole(model.RoleAdmin))
-	}
-
-	// --- 管理后台 API（JSON 响应） ---
-	adminAPI := r.Group("/api/admin")
-	adminAPI.Use(authMdw.Required())
-	adminAPI.Use(middleware.RequireMinRole(model.RoleAdmin))
-	adminAPI.Use(middleware.CSRF(cfg))
-	{
-		adminAPI.GET("/users", adminController.ListUsers)
-		adminAPI.PUT("/users/:uid/status", adminController.UpdateUserStatus)
-		adminAPI.POST("/users/:uid/reset-token", adminController.ResetToken)
-		// 审核 API
-		adminAPI.GET("/audits", auditController.ListAudits)
-		adminAPI.POST("/audits/:id/approve", auditController.Approve)
-		adminAPI.POST("/audits/:id/reject", auditController.Reject)
-	}
-
-	// --- 站点设置 API（仅 owner 可访问） ---
-	siteSettingsAPI := r.Group("/api/admin/site-settings")
-	siteSettingsAPI.Use(authMdw.Required())
-	siteSettingsAPI.Use(middleware.RequireMinRole(model.RoleOwner))
-	siteSettingsAPI.Use(middleware.CSRF(cfg))
-	{
-		siteSettingsAPI.GET("", siteSettingController.GetSettings)
-		siteSettingsAPI.PUT("", siteSettingController.UpdateSetting)
-	}
-
-	// --- API 路由（CSRF 严格验证） ---
-	api := r.Group("/api")
-	api.Use(middleware.CSRF(cfg))
-	{
-		api.POST("/auth/check-email", authCtrl.CheckEmail)
-		api.POST("/auth/register", authCtrl.Register)
-		api.POST("/auth/login", authCtrl.Login)
-		api.POST("/auth/confirm-restore", authCtrl.ConfirmRestore)
-		api.POST("/auth/logout", authCtrl.Logout)
-		api.POST("/auth/refresh", authCtrl.RefreshToken)
-	}
 }

templates/admin/html/layout/base.html

@@ -39,6 +39,12 @@
                 审核管理
             </a>
             {{end}}
+            {{if .CanManageSettings}}
+            <a href="/admin/site-settings" class="sidebar-item {{if eq .CurrentPath "/admin/site-settings"}}active{{end}}">
+                <span class="sidebar-icon"><svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2"><circle cx="12" cy="12" r="3"/><path d="M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83-2.83l.06-.06A1.65 1.65 0 0 0 4.68 15a1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 2.83-2.83l.06.06A1.65 1.65 0 0 0 9 4.68a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 2.83l-.06.06A1.65 1.65 0 0 0 19.4 9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"/></svg></span>
+                站点设置
+            </a>
+            {{end}}
         </nav>
     </aside>
     <main class="admin-main">

templates/admin/html/site-settings/index.html

@@ -0,0 +1,64 @@
+{{template "admin/layout/base.html" .}}
+        <div class="page-header">
+            <h1>站点设置</h1>
+            <p class="page-desc">管理审核开关与站点全局配置</p>
+        </div>
+
+        <!-- 审核设置 -->
+        <div class="settings-section">
+            <div class="section-title">审核设置</div>
+            <div class="section-body">
+                <div class="setting-item">
+                    <div class="setting-info">
+                        <span class="setting-label">启用审核系统</span>
+                        <span class="setting-desc">启用后，用户名、头像、签名修改将进入审核流程</span>
+                    </div>
+                    <label class="toggle-switch">
+                        <input type="checkbox" id="audit-enabled" data-key="audit.enabled">
+                        <span class="toggle-slider"></span>
+                    </label>
+                </div>
+
+                <div class="setting-item">
+                    <div class="setting-info">
+                        <span class="setting-label">用户名审核</span>
+                        <span class="setting-desc">更改用户名需要管理员审核</span>
+                    </div>
+                    <label class="toggle-switch">
+                        <input type="checkbox" id="audit-username" data-key="audit.username_audit">
+                        <span class="toggle-slider"></span>
+                    </label>
+                </div>
+
+                <div class="setting-item">
+                    <div class="setting-info">
+                        <span class="setting-label">头像审核</span>
+                        <span class="setting-desc">更改头像需要管理员审核</span>
+                    </div>
+                    <label class="toggle-switch">
+                        <input type="checkbox" id="audit-avatar" data-key="audit.avatar_audit">
+                        <span class="toggle-slider"></span>
+                    </label>
+                </div>
+
+                <div class="setting-item">
+                    <div class="setting-info">
+                        <span class="setting-label">签名审核</span>
+                        <span class="setting-desc">更改个人签名需要管理员审核</span>
+                    </div>
+                    <label class="toggle-switch">
+                        <input type="checkbox" id="audit-bio" data-key="audit.bio_audit">
+                        <span class="toggle-slider"></span>
+                    </label>
+                </div>
+            </div>
+        </div>
+
+        <!-- 通用设置 -->
+        <div class="settings-section">
+            <div class="section-title">通用设置</div>
+            <div class="section-body" id="general-settings">
+                <div class="settings-empty" id="settings-empty">加载中...</div>
+            </div>
+        </div>
+{{template "admin/layout/footer.html" .}}

templates/admin/static/css/site-settings.css

@@ -0,0 +1,83 @@
+/* =====================================================
+   MetaLab 管理面板 - 站点设置
+   单一职责：设置页面布局、表单分组、开关组件
+   ===================================================== */
+
+/* --- 设置区块 --- */
+.settings-section {
+    background: var(--bg-card);
+    border-radius: var(--radius);
+    box-shadow: var(--shadow);
+    margin-bottom: 20px;
+    overflow: hidden;
+}
+.section-title {
+    font-size: 15px; font-weight: 600;
+    color: var(--text);
+    padding: 16px 20px;
+    border-bottom: 1px solid var(--border);
+    background: #fafafa;
+}
+.section-body { padding: 4px 0; }
+
+/* --- 设置条目 --- */
+.setting-item {
+    display: flex; align-items: center; justify-content: space-between;
+    padding: 14px 20px;
+    border-bottom: 1px solid #f5f5f5;
+    gap: 20px;
+}
+.setting-item:last-child { border-bottom: none; }
+.setting-info { flex: 1; min-width: 0; }
+.setting-label {
+    font-size: 13px; font-weight: 500;
+    color: var(--text); display: block;
+}
+.setting-desc {
+    font-size: 12px; color: var(--text-muted);
+    margin-top: 2px;
+}
+.setting-value {
+    font-size: 12px; color: var(--text-muted);
+    margin-top: 2px; font-family: monospace;
+    background: #f5f6fa; padding: 2px 6px; border-radius: 3px;
+    display: inline-block;
+    word-break: break-all;
+}
+
+/* --- 空状态 --- */
+.settings-empty {
+    text-align: center; padding: 28px 20px;
+    color: var(--text-muted); font-size: 13px;
+}
+
+/* --- Toggle 开关 --- */
+.toggle-switch {
+    position: relative; display: inline-block;
+    width: 44px; height: 24px; flex-shrink: 0;
+}
+.toggle-switch input { opacity: 0; width: 0; height: 0; }
+.toggle-slider {
+    position: absolute; cursor: pointer;
+    top: 0; left: 0; right: 0; bottom: 0;
+    background: #ccc;
+    border-radius: 24px;
+    transition: background 0.2s;
+}
+.toggle-slider::before {
+    position: absolute; content: "";
+    height: 18px; width: 18px;
+    left: 3px; bottom: 3px;
+    background: #fff;
+    border-radius: 50%;
+    transition: transform 0.2s;
+}
+.toggle-switch input:checked + .toggle-slider {
+    background: var(--primary);
+}
+.toggle-switch input:checked + .toggle-slider::before {
+    transform: translateX(20px);
+}
+.toggle-switch input:disabled + .toggle-slider {
+    opacity: 0.4; cursor: not-allowed;
+}

templates/admin/static/js/site-settings.js

@@ -0,0 +1,87 @@
+/* =====================================================
+   MetaLab 管理面板 - 站点设置
+   单一职责：加载/保存站点设置，开关即时生效
+   ===================================================== */
+
+(function() {
+    'use strict';
+
+    const TOGGLE_KEYS = [
+        { id: 'audit-enabled', key: 'audit.enabled' },
+        { id: 'audit-username', key: 'audit.username_audit' },
+        { id: 'audit-avatar', key: 'audit.avatar_audit' },
+        { id: 'audit-bio', key: 'audit.bio_audit' }
+    ];
+
+    // --- 初始加载 ---
+    async function loadSettings() {
+        try {
+            const res = await api.get('/api/admin/site-settings');
+            if (!res.success) return;
+
+            // 审核开关
+            const audit = res.data.audit || {};
+            TOGGLE_KEYS.forEach(function(t) {
+                var el = document.getElementById(t.id);
+                if (el) {
+                    el.checked = audit[t.key.split('.')[1]] === true;
+                    el.addEventListener('change', function() {
+                        updateBoolSetting(t.key, el.checked, el);
+                    });
+                }
+            });
+
+            // 通用设置
+            renderGeneralSettings(res.data.all || {});
+        } catch (e) {
+            showToast('加载设置失败', 'error');
+        }
+    }
+
+    // --- 更新布尔设置 ---
+    async function updateBoolSetting(key, value, toggle) {
+        toggle.disabled = true;
+        try {
+            var res = await api.put('/api/admin/site-settings/bool', {
+                key: key,
+                value: String(value)
+            });
+            if (res.success) {
+                showToast('设置已更新', 'success');
+            } else {
+                showToast(res.message || '保存失败', 'error');
+                toggle.checked = !value; // 回滚
+            }
+        } catch (e) {
+            showToast('保存失败', 'error');
+            toggle.checked = !value; // 回滚
+        } finally {
+            toggle.disabled = false;
+        }
+    }
+
+    // --- 渲染通用设置 ---
+    function renderGeneralSettings(all) {
+        var container = document.getElementById('general-settings');
+        var keys = Object.keys(all);
+        if (keys.length === 0) {
+            container.innerHTML = '<div class="settings-empty">暂无其他设置</div>';
+            return;
+        }
+        container.innerHTML = '';
+        keys.forEach(function(key) {
+            var val = all[key] || '';
+            var item = document.createElement('div');
+            item.className = 'setting-item';
+            item.innerHTML =
+                '<div class="setting-info">' +
+                    '<span class="setting-label">' + escapeHtml(key) + '</span>' +
+                    '<span class="setting-value">' + escapeHtml(val.length > 80 ? val.slice(0, 80) + '...' : val) + '</span>' +
+                '</div>';
+            container.appendChild(item);
+        });
+    }
+
+    // --- 入口 ---
+    loadSettings();
+})();