## 新增功能 ### 消息通知中心 (全新模块) - 新增 MessageController / NotificationService / NotificationRepo - SSR 消息页面 (/messages):左侧边栏 + 右侧卡片列表,noindex 元标签 - 通知能力:列表分页、单条标为已读、一键全部标为已读 - 未读数角标 (1/66/99+):侧边栏 + 导航栏铃铛图标 - 导航栏轮询 /api/messages/unread 每 60 秒刷新未读数 - 审核通过/驳回时自动 fire-and-forget 推送通知 ### 密码修改 - ChangePassword:验证当前密码 → 新密码强度校验(8位+字母+数字) → 哈希更新 - 修改后递增 token_version 强制所有设备退登 ### 账号自助注销 - DeleteAccount:验证密码 → 设置 deleted 状态 → 记录原因 → 吊销 JWT - 注销后登录二次确认:Login 检测 deleted → 返回 confirm_restore - ConfirmRestore 恢复账号,重新签发 token - 注销页文案:"账号将在 7 天后正式注销,期间可随时重新登录恢复" ### IP 审计记录 - 注册时记录 RegIP,登录时记录 LastLoginIP + LastLoginAt - clientIP() 支持 X-Forwarded-For / X-Real-IP 反向代理 ### 安全加固 - Login 防时序攻击:用户不存在时仍执行完整 bcrypt 比对 - FindByEmail 改用 Unscoped() 覆盖软删除用户 - 站长 (owner) 不允许自主注销,避免权限体系死锁 ## Bug 修复 1. 注销按钮不触发:JS IIFE 中 profile 代码 return 阻塞了 account 标签页处理器注册 → 拆分为两层 IIFE,profile 放在内层 2. label 缺少 for 属性导致控制台警告 → 全部补充 for 属性 3. 注销后未自动退登:DeleteAccount 只设状态未吊销 JWT → 末尾加 InvalidateSessions 4. 退登后重定向 500 panic:authenticateToken 中 err||versionMismatch 合并判断 在 err=nil 但版本不匹配时返回 (nil,nil) → 拆为两个独立判断 injectUserContext 增加 claims==nil / 类型断言空安全守卫 5. 注销后登录直接提示"登录成功":FindByEmail 默认 scope 排除软删除记录 → 改用 Unscoped() ## 文件变更 - 新建 17 个文件 (消息/审核/站点设置完整模块) - 修改 25 个文件 (认证/设置/中间件/前端) - 统计:+3229 / -161,42 files changed
130 lines
3.3 KiB
Go
130 lines
3.3 KiB
Go
package controller
|
||
|
||
import (
|
||
"net/http"
|
||
"strconv"
|
||
|
||
"metazone.cc/metalab/internal/common"
|
||
"metazone.cc/metalab/internal/model"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
// notifProvider MessageController 所需的通知服务接口(ISP:5 个方法)
|
||
type notifProvider interface {
|
||
List(userID uint, page, pageSize int) (*model.NotificationListResult, error)
|
||
CountUnread(userID uint) (int64, error)
|
||
MarkRead(id, userID uint) error
|
||
MarkAllRead(userID uint) error
|
||
}
|
||
|
||
// MessageController 消息中心控制器
|
||
type MessageController struct {
|
||
notifService notifProvider
|
||
}
|
||
|
||
// NewMessageController 构造函数
|
||
func NewMessageController(notifService notifProvider) *MessageController {
|
||
return &MessageController{notifService: notifService}
|
||
}
|
||
|
||
// MessagesPage 消息中心页面(需登录,noindex)
|
||
func (mc *MessageController) MessagesPage(c *gin.Context) {
|
||
uidVal, exists := c.Get("uid")
|
||
if !exists {
|
||
c.Redirect(http.StatusFound, "/auth/login")
|
||
c.Abort()
|
||
return
|
||
}
|
||
uid := uidVal.(uint)
|
||
|
||
// 从 query 取分页参数
|
||
page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
|
||
if page < 1 {
|
||
page = 1
|
||
}
|
||
pageSize := 20
|
||
|
||
result, err := mc.notifService.List(uid, page, pageSize)
|
||
if err != nil {
|
||
result = &model.NotificationListResult{Items: []model.Notification{}, Total: 0, Page: 1}
|
||
}
|
||
|
||
totalPages := result.TotalPages
|
||
if totalPages == 0 && result.Total > 0 {
|
||
totalPages = int((result.Total + int64(pageSize) - 1) / int64(pageSize))
|
||
}
|
||
|
||
c.HTML(http.StatusOK, "messages/index.html", common.BuildPageData(c, gin.H{
|
||
"Title": "消息中心",
|
||
"ExtraCSS": "/static/css/messages.css",
|
||
"Messages": result.Items,
|
||
"Total": result.Total,
|
||
"Page": result.Page,
|
||
"TotalPages": totalPages,
|
||
"PrevPage": result.Page - 1,
|
||
"NextPage": result.Page + 1,
|
||
"HasPrev": result.Page > 1,
|
||
"HasNext": result.Page < totalPages,
|
||
"UnreadCount": result.Unread,
|
||
"NotifyTypeNames": model.NotifyTypeNames,
|
||
"AuditTypeNames": model.AuditTypeNames,
|
||
}))
|
||
}
|
||
|
||
// UnreadCount 获取未读消息数(API,供导航栏轮询)
|
||
func (mc *MessageController) UnreadCount(c *gin.Context) {
|
||
uidVal, exists := c.Get("uid")
|
||
if !exists {
|
||
common.Ok(c, gin.H{"unread": 0})
|
||
return
|
||
}
|
||
|
||
count, err := mc.notifService.CountUnread(uidVal.(uint))
|
||
if err != nil {
|
||
common.Ok(c, gin.H{"unread": 0})
|
||
return
|
||
}
|
||
|
||
common.Ok(c, gin.H{"unread": count})
|
||
}
|
||
|
||
// MarkRead 标记单条消息已读(API)
|
||
func (mc *MessageController) MarkRead(c *gin.Context) {
|
||
uidVal, exists := c.Get("uid")
|
||
if !exists {
|
||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||
return
|
||
}
|
||
|
||
idStr := c.Param("id")
|
||
id, err := strconv.ParseUint(idStr, 10, 64)
|
||
if err != nil {
|
||
common.Error(c, http.StatusBadRequest, "消息 ID 无效")
|
||
return
|
||
}
|
||
|
||
if err := mc.notifService.MarkRead(uint(id), uidVal.(uint)); err != nil {
|
||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||
return
|
||
}
|
||
|
||
common.OkMessage(c, "已标记为已读")
|
||
}
|
||
|
||
// MarkAllRead 一键全部已读(API)
|
||
func (mc *MessageController) MarkAllRead(c *gin.Context) {
|
||
uidVal, exists := c.Get("uid")
|
||
if !exists {
|
||
common.Error(c, http.StatusUnauthorized, "请先登录")
|
||
return
|
||
}
|
||
|
||
if err := mc.notifService.MarkAllRead(uidVal.(uint)); err != nil {
|
||
common.Error(c, http.StatusInternalServerError, "操作失败")
|
||
return
|
||
}
|
||
|
||
common.OkMessage(c, "已全部标为已读")
|
||
}
|