Victor_Jay
2449a27eb5
Some checks failed
CI / Lint + Build (push) Has been cancelled
审计修复: - CSP: unsafe-inline移除, nonce替代; unsafe-eval保留供Vditor使用 - HSTS: 始终启用(不再依赖release模式) - Controller Exp: common.GetGinExp包装, 不再直接读context - UID解析: common.ParseUIDParam统一, follow/admin controller改用 重构: - router/api.go(198行)拆为7个域文件: auth/settings/posts/comments/reactions/social/studio - 管理后台站点设置: 单页拆为4个子页(brand/security/registration/content)+子菜单 - 前台用户设置页: 1201行拆为6个独立模板+6个独立JS文件 新增: - DB健康检测中间件(middleware/db_health.go): 5s ping+降级页面 - 时区配置: config.yaml server.timezone→time.Local初始化 - .gitea/workflows/ci.yml: strict模式CI流水线
65 lines
2.0 KiB
Go
65 lines
2.0 KiB
Go
package router
|
||
|
||
import (
|
||
"metazone.cc/mce/internal/config"
|
||
"metazone.cc/mce/internal/middleware"
|
||
|
||
"github.com/gin-gonic/gin"
|
||
)
|
||
|
||
// setupSocialAPIRoutes 注册关注、收藏夹、空间相关 API 路由
|
||
func setupSocialAPIRoutes(r *gin.Engine, cfg *config.Config, d *dependencies) {
|
||
// 关注 — 公开（Optional 认证）
|
||
followPublic := r.Group("/api/users/:uid")
|
||
followPublic.Use(d.authMdw.Optional())
|
||
{
|
||
followPublic.GET("/follow-status", d.followCtrl.GetStatus)
|
||
followPublic.GET("/followers", d.followCtrl.Followers)
|
||
followPublic.GET("/following", d.followCtrl.Following)
|
||
}
|
||
// 需登录：切换关注
|
||
followAPI := r.Group("/api/users/:uid")
|
||
followAPI.Use(d.authMdw.Required())
|
||
followAPI.Use(d.authMdw.BannedWriteGuard())
|
||
followAPI.Use(middleware.CSRF(cfg))
|
||
{
|
||
followAPI.POST("/follow", d.followCtrl.Toggle)
|
||
}
|
||
|
||
// 收藏夹 — 公开
|
||
r.GET("/api/posts/:id/folder-status", d.favoriteCtrl.GetPostStatus)
|
||
r.GET("/api/folders/:id/posts", d.favoriteCtrl.ListFolderItems)
|
||
|
||
// 收藏夹 — 需登录
|
||
folderAPI := r.Group("/api/folders")
|
||
folderAPI.Use(d.authMdw.Required())
|
||
folderAPI.Use(d.authMdw.BannedWriteGuard())
|
||
folderAPI.Use(middleware.CSRF(cfg))
|
||
{
|
||
folderAPI.GET("", d.favoriteCtrl.ListFolders)
|
||
folderAPI.POST("", d.favoriteCtrl.CreateFolder)
|
||
folderAPI.PUT("/:id", d.favoriteCtrl.UpdateFolder)
|
||
folderAPI.DELETE("/:id", d.favoriteCtrl.DeleteFolder)
|
||
folderAPI.POST("/:id/posts", d.favoriteCtrl.AddToFolder)
|
||
folderAPI.DELETE("/:id/posts/:postId", d.favoriteCtrl.RemoveFromFolder)
|
||
}
|
||
|
||
// 切换收藏 Toggle
|
||
favToggleAPI := r.Group("/api/posts/:id")
|
||
favToggleAPI.Use(d.authMdw.Required())
|
||
favToggleAPI.Use(d.authMdw.BannedWriteGuard())
|
||
favToggleAPI.Use(middleware.CSRF(cfg))
|
||
{
|
||
favToggleAPI.POST("/favorite", d.favoriteCtrl.ToggleFavorite)
|
||
}
|
||
|
||
// 空间/隐私设置
|
||
spaceAPI := r.Group("/api/space")
|
||
spaceAPI.Use(d.authMdw.Required())
|
||
spaceAPI.Use(d.authMdw.BannedWriteGuard())
|
||
spaceAPI.Use(middleware.CSRF(cfg))
|
||
{
|
||
spaceAPI.PUT("/privacy", d.spaceCtrl.UpdatePrivacy)
|
||
}
|
||
}
|