Files
mce/templates/admin/static/js/audit.js
Victor_Jay 0800ee2f3e feat: 消息通知中心 + 账号安全体系 + Bug修复
## 新增功能

### 消息通知中心 (全新模块)
- 新增 MessageController / NotificationService / NotificationRepo
- SSR 消息页面 (/messages):左侧边栏 + 右侧卡片列表,noindex 元标签
- 通知能力:列表分页、单条标为已读、一键全部标为已读
- 未读数角标 (1/66/99+):侧边栏 + 导航栏铃铛图标
- 导航栏轮询 /api/messages/unread 每 60 秒刷新未读数
- 审核通过/驳回时自动 fire-and-forget 推送通知

### 密码修改
- ChangePassword:验证当前密码 → 新密码强度校验(8位+字母+数字) → 哈希更新
- 修改后递增 token_version 强制所有设备退登

### 账号自助注销
- DeleteAccount:验证密码 → 设置 deleted 状态 → 记录原因 → 吊销 JWT
- 注销后登录二次确认:Login 检测 deleted → 返回 confirm_restore
- ConfirmRestore 恢复账号,重新签发 token
- 注销页文案:"账号将在 7 天后正式注销,期间可随时重新登录恢复"

### IP 审计记录
- 注册时记录 RegIP,登录时记录 LastLoginIP + LastLoginAt
- clientIP() 支持 X-Forwarded-For / X-Real-IP 反向代理

### 安全加固
- Login 防时序攻击:用户不存在时仍执行完整 bcrypt 比对
- FindByEmail 改用 Unscoped() 覆盖软删除用户
- 站长 (owner) 不允许自主注销,避免权限体系死锁

## Bug 修复

1. 注销按钮不触发:JS IIFE 中 profile 代码 return 阻塞了 account 标签页处理器注册
   → 拆分为两层 IIFE,profile 放在内层
2. label 缺少 for 属性导致控制台警告 → 全部补充 for 属性
3. 注销后未自动退登:DeleteAccount 只设状态未吊销 JWT → 末尾加 InvalidateSessions
4. 退登后重定向 500 panic:authenticateToken 中 err||versionMismatch 合并判断
   在 err=nil 但版本不匹配时返回 (nil,nil) → 拆为两个独立判断
   injectUserContext 增加 claims==nil / 类型断言空安全守卫
5. 注销后登录直接提示"登录成功":FindByEmail 默认 scope 排除软删除记录
   → 改用 Unscoped()

## 文件变更
- 新建 17 个文件 (消息/审核/站点设置完整模块)
- 修改 25 个文件 (认证/设置/中间件/前端)
- 统计:+3229 / -161,42 files changed
2026-05-27 13:32:45 +08:00

261 lines
9.5 KiB
JavaScript

/* =====================================================
MetaLab 管理面板 - 审核管理 JS
单一职责:审核列表 TAB 切换、分页、审批操作
===================================================== */
let currentTab = 'username';
const pageSize = 20;
const pages = {
username: 1,
avatar: 1,
bio: 1,
history: 1
};
let pendingRejectId = null;
document.addEventListener('DOMContentLoaded', () => {
// TAB 切换
document.querySelectorAll('.audit-tab').forEach(tab => {
tab.addEventListener('click', () => {
document.querySelectorAll('.audit-tab').forEach(t => t.classList.remove('active'));
tab.classList.add('active');
currentTab = tab.dataset.tab;
document.querySelectorAll('.audit-panel').forEach(p => p.classList.remove('active'));
document.getElementById('panel-' + currentTab).classList.add('active');
loadCurrentTab();
});
});
// 初始加载
loadCurrentTab();
});
/* =========================================
数据加载
========================================= */
function loadCurrentTab() {
if (currentTab === 'history') {
loadHistory();
} else if (currentTab === 'avatar') {
loadAvatarAudits();
} else {
loadTableAudits();
}
}
function loadTableAudits() {
const page = pages[currentTab];
api.get(`/api/admin/audits?type=${currentTab}&page=${page}&page_size=${pageSize}`)
.then(res => {
if (res.success) {
renderTable(res.data.items, currentTab + 'TableBody');
renderPagination(res.data.total, res.data.page, currentTab + 'Pagination');
} else {
showToast(res.message || '加载失败', 'error');
}
})
.catch(() => showToast('网络错误', 'error'));
}
function loadAvatarAudits() {
const page = pages['avatar'];
api.get(`/api/admin/audits?type=avatar&page=${page}&page_size=${pageSize}`)
.then(res => {
if (res.success) {
renderAvatarCards(res.data.items);
renderPagination(res.data.total, res.data.page, 'avatarPagination');
} else {
showToast(res.message || '加载失败', 'error');
}
})
.catch(() => showToast('网络错误', 'error'));
}
function loadHistory() {
const page = pages['history'];
api.get(`/api/admin/audits?page=${page}&page_size=${pageSize}&status=`)
.then(res => {
if (res.success) {
renderHistoryTable(res.data.items);
renderPagination(res.data.total, res.data.page, 'historyPagination');
} else {
showToast(res.message || '加载失败', 'error');
}
})
.catch(() => showToast('网络错误', 'error'));
}
/* =========================================
表格渲染(用户名/签名)
========================================= */
function renderTable(items, bodyId) {
const tbody = document.getElementById(bodyId);
if (!items || items.length === 0) {
const cols = currentTab === 'bio' ? 4 : 5;
tbody.innerHTML = `<tr><td colspan="${cols}" style="text-align:center;padding:40px;color:#636e72;">没有待审核记录</td></tr>`;
return;
}
tbody.innerHTML = items.map(item => {
if (currentTab === 'bio') {
return renderBioRow(item);
}
return renderUsernameRow(item);
}).join('');
}
function renderUsernameRow(item) {
return `
<tr>
<td>${escapeHtml(item.submitter_username || '—')}</td>
<td>—</td>
<td><strong>${escapeHtml(item.new_value)}</strong></td>
<td>${formatTime(item.created_at)}</td>
<td class="col-actions">
<button class="btn btn-primary btn-sm" onclick="approveAudit(${item.uid})">通过</button>
<button class="btn btn-outline btn-sm" onclick="openRejectModal(${item.uid})">拒绝</button>
</td>
</tr>`;
}
function renderBioRow(item) {
const text = item.new_value || '';
const display = text.length > 40 ? text.substring(0, 40) + '...' : text;
return `
<tr>
<td>${escapeHtml(item.submitter_username || '—')}</td>
<td title="${escapeHtml(text)}">${escapeHtml(display)}</td>
<td>${formatTime(item.created_at)}</td>
<td class="col-actions">
<button class="btn btn-primary btn-sm" onclick="approveAudit(${item.uid})">通过</button>
<button class="btn btn-outline btn-sm" onclick="openRejectModal(${item.uid})">拒绝</button>
</td>
</tr>`;
}
/* =========================================
头像卡片渲染
========================================= */
function renderAvatarCards(items) {
const grid = document.getElementById('avatarGrid');
if (!items || items.length === 0) {
grid.innerHTML = '<div class="table-loading-full">没有待审核头像</div>';
return;
}
grid.innerHTML = items.map(item => `
<div class="avatar-audit-card">
<div class="card-header">
<span>提交者: <strong>${escapeHtml(item.submitter_username || '—')}</strong></span>
<span>${formatTime(item.created_at)}</span>
</div>
<div class="avatar-compare">
<span>新头像 →</span>
<img src="${escapeHtml(item.new_value)}" alt="新头像" onerror="this.src='data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 80 80%22><rect fill=%22%23eee%22 width=%2280%22 height=%2280%22/><text x=%2240%22 y=%2245%22 text-anchor=%22middle%22 fill=%22%23999%22 font-size=%2212%22>加载失败</text></svg>'">
</div>
<div class="card-actions">
<button class="btn btn-primary btn-sm" onclick="approveAudit(${item.uid})">通过</button>
<button class="btn btn-outline btn-sm" onclick="openRejectModal(${item.uid})">拒绝</button>
</div>
</div>
`).join('');
}
/* =========================================
审核记录渲染
========================================= */
function renderHistoryTable(items) {
const tbody = document.getElementById('historyTableBody');
if (!items || items.length === 0) {
tbody.innerHTML = '<tr><td colspan="6" style="text-align:center;padding:40px;color:#636e72;">没有审核记录</td></tr>';
return;
}
tbody.innerHTML = items.map(item => {
const typeLabel = window.__AUDIT_TYPES[item.audit_type] || item.audit_type;
const statusLabel = window.__AUDIT_STATUS[item.status] || item.status;
const statusClass = item.status;
const content = item.new_value.length > 40 ? item.new_value.substring(0, 40) + '...' : item.new_value;
const reviewer = item.reviewer_name || '—';
return `
<tr>
<td>${typeLabel}</td>
<td>${escapeHtml(item.submitter_username || '—')}</td>
<td>${escapeHtml(content)}</td>
<td><span class="audit-status-tag ${statusClass}">${statusLabel}</span></td>
<td>${escapeHtml(reviewer)}</td>
<td>${formatTime(item.created_at)}</td>
</tr>`;
}).join('');
}
/* =========================================
审核操作
========================================= */
async function approveAudit(id) {
const ok = await showConfirm('通过审核', '确定要通过此审核吗?通过后将立即生效。');
if (!ok) return;
const res = await api.post('/api/admin/audits/' + id + '/approve');
if (res.success) {
showToast(res.message, 'success');
loadCurrentTab();
} else {
showToast(res.message || '操作失败', 'error');
}
}
function openRejectModal(id) {
pendingRejectId = id;
document.getElementById('rejectReason').value = '';
document.getElementById('rejectModal').style.display = 'flex';
}
function closeRejectModal() {
pendingRejectId = null;
document.getElementById('rejectModal').style.display = 'none';
}
document.getElementById('confirmRejectBtn').addEventListener('click', async () => {
const reason = document.getElementById('rejectReason').value.trim();
if (!reason) {
showToast('请填写拒绝理由', 'error');
return;
}
const res = await api.post('/api/admin/audits/' + pendingRejectId + '/reject', { reason });
if (res.success) {
showToast(res.message, 'success');
closeRejectModal();
loadCurrentTab();
} else {
showToast(res.message || '操作失败', 'error');
}
});
// 点击遮罩关闭弹窗
document.getElementById('rejectModal').addEventListener('click', (e) => {
if (e.target === e.currentTarget) closeRejectModal();
});
/* =========================================
分页
========================================= */
function renderPagination(total, page, barId) {
const totalPages = Math.ceil(total / pageSize);
const bar = document.getElementById(barId);
if (totalPages <= 1) { bar.innerHTML = ''; return; }
let html = `<button onclick="goPage(${page - 1})" ${page <= 1 ? 'disabled' : ''}>上一页</button>`;
html += `<span class="page-current">第 ${page} / ${totalPages} 页(共 ${total} 条)</span>`;
html += `<button onclick="goPage(${page + 1})" ${page >= totalPages ? 'disabled' : ''}>下一页</button>`;
bar.innerHTML = html;
}
function goPage(p) {
pages[currentTab] = p;
loadCurrentTab();
window.scrollTo({ top: 0 });
}