From bab8e47d630af451fa37a974c9bd5a8209fd43c2 Mon Sep 17 00:00:00 2001
From: Victor_Jay <ovoex.cn@gmail.com>
Date: Mon, 1 Jun 2026 20:16:51 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E5=85=B3=E6=B3=A8?=
 =?UTF-8?q?=E6=8C=89=E9=92=AE=20CSRF=20403=20+=20=E7=BC=BA=E5=B0=91?=
 =?UTF-8?q?=E6=A0=B7=E5=BC=8F=20+=20IncrCount=20SQL=20=E9=94=99=E8=AF=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 修复 CSRF 403：移除 space/index.html 中手动设置 X-CSRF-Token 头（与 common.js 自动注入冲突导致 token 重复）
- 修复按钮无样式：header.html 新增 ExtraCSS2 支持，space 页面加载 follow.css
- 修复 IncrCount SQL 错误：follow_repo.go 中 users 表列名修正 id → uid
---
 internal/controller/space_controller.go        | 1 +
 internal/repository/follow_repo.go             | 4 ++--
 templates/MetaLab-2026/html/layout/header.html | 3 +++
 templates/MetaLab-2026/html/space/index.html   | 3 ---
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/internal/controller/space_controller.go b/internal/controller/space_controller.go
index 03cec3e..342f94b 100644
--- a/internal/controller/space_controller.go
+++ b/internal/controller/space_controller.go
@@ -99,5 +99,6 @@ func (ctrl *SpaceController) ShowSpace(c *gin.Context) {
 		"NextPage":   nextPage,
 		"IsOwnSpace": isOwnSpace,
 		"ExtraCSS":   "/static/css/space.css",
+		"ExtraCSS2":  "/static/css/follow.css",
 	}))
 }
diff --git a/internal/repository/follow_repo.go b/internal/repository/follow_repo.go
index 5532975..d879087 100644
--- a/internal/repository/follow_repo.go
+++ b/internal/repository/follow_repo.go
@@ -93,14 +93,14 @@ func (r *FollowRepo) ListFollowing(userID uint, offset, limit int) ([]model.User
 // IncrFollowersCount 原子增减粉丝数
 func (r *FollowRepo) IncrFollowersCount(userID uint, delta int) error {
 	return r.db.Model(&model.User{}).
-		Where("id = ?", userID).
+		Where("uid = ?", userID).
 		UpdateColumn("followers_count", gorm.Expr("followers_count + ?", delta)).Error
 }
 
 // IncrFollowingCount 原子增减关注数
 func (r *FollowRepo) IncrFollowingCount(userID uint, delta int) error {
 	return r.db.Model(&model.User{}).
-		Where("id = ?", userID).
+		Where("uid = ?", userID).
 		UpdateColumn("following_count", gorm.Expr("following_count + ?", delta)).Error
 }
 
diff --git a/templates/MetaLab-2026/html/layout/header.html b/templates/MetaLab-2026/html/layout/header.html
index 67c71e9..52caf11 100644
--- a/templates/MetaLab-2026/html/layout/header.html
+++ b/templates/MetaLab-2026/html/layout/header.html
@@ -17,5 +17,8 @@
 {{if .ExtraCSS}}
 <link rel="stylesheet" href="{{.ExtraCSS}}?v={{assetV .ExtraCSS}}">
 {{end}}
+{{if .ExtraCSS2}}
+<link rel="stylesheet" href="{{.ExtraCSS2}}?v={{assetV .ExtraCSS2}}">
+{{end}}
 <script src="/shared/static/js/utils.js?v={{assetV "/shared/static/js/utils.js"}}"></script>
 </head>
diff --git a/templates/MetaLab-2026/html/space/index.html b/templates/MetaLab-2026/html/space/index.html
index 43bcb45..10cdd4d 100644
--- a/templates/MetaLab-2026/html/space/index.html
+++ b/templates/MetaLab-2026/html/space/index.html
@@ -104,8 +104,6 @@
     var followBtn = document.getElementById('followBtn');
     if (!followBtn) return;
     var targetUid = followBtn.getAttribute('data-uid');
-    var csrfMeta = document.querySelector('meta[name="csrf-token"]');
-    var csrfToken = csrfMeta ? csrfMeta.getAttribute('content') : '';
 
     // 四个按钮状态文案
     var labels = {
@@ -149,7 +147,6 @@
         followBtn.classList.add('waiting');
         var xhr = new XMLHttpRequest();
         xhr.open('POST', '/api/users/' + targetUid + '/follow', true);
-        xhr.setRequestHeader('X-CSRF-Token', csrfToken);
         xhr.onreadystatechange = function() {
             if (xhr.readyState === 4) {
                 followBtn.classList.remove('waiting');