MVP: 按 07 风格重写前端 + Go 后端落地（长文/短文、编辑器、后台管理）

2026-09-20 20:56:03 +08:00
parent edee708802
commit 4d8f2de3a4
96 changed files with 6005 additions and 2602 deletions
@@ -0,0 +1,350 @@
+// Package admin serves the authenticated surface at /api/admin/*.
+// It is mounted separately from the public API so the two never share a
+// handler chain.
+package admin
+
+import (
+	"crypto/subtle"
+	"errors"
+	"net/http"
+	"strings"
+
+	"oneblog/internal/config"
+	"oneblog/internal/httpx"
+	"oneblog/internal/model"
+	"oneblog/internal/store"
+)
+
+type API struct {
+	Store    *store.Store
+	Cfg      *config.Config
+	Sessions *Sessions
+}
+
+const cookieName = "one_session"
+
+func (a *API) Routes() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("/api/admin/login", a.login)
+	mux.HandleFunc("/api/admin/logout", a.logout)
+	mux.HandleFunc("/api/admin/me", a.guard(a.me))
+
+	mux.HandleFunc("/api/admin/posts", a.guard(a.listPosts))
+	mux.HandleFunc("/api/admin/posts/", a.guard(a.postByID))
+	mux.HandleFunc("/api/admin/tags", a.guard(a.listTags))
+	mux.HandleFunc("/api/admin/tags/", a.guard(a.tagByID))
+	mux.HandleFunc("/api/admin/settings", a.guard(a.settings))
+	return mux
+}
+
+// guard requires a valid session; the token may arrive as a cookie (browser)
+// or as a Bearer token (CLI / API client).
+func (a *API) guard(next http.HandlerFunc) http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) {
+		token := bearer(r)
+		if token == "" {
+			if c, err := r.Cookie(cookieName); err == nil {
+				token = c.Value
+			}
+		}
+		if token == "" || !a.valid(token) {
+			httpx.Unauthorized(w)
+			return
+		}
+		next(w, r)
+	}
+}
+
+func bearer(r *http.Request) string {
+	h := r.Header.Get("Authorization")
+	if strings.HasPrefix(strings.ToLower(h), "bearer ") {
+		return strings.TrimSpace(h[7:])
+	}
+	return ""
+}
+
+func (a *API) valid(token string) bool {
+	_, err := a.Sessions.Verify(token)
+	return err == nil
+}
+
+// ---------- auth ----------
+
+type loginRequest struct {
+	Username string `json:"username"`
+	Password string `json:"password"`
+}
+
+func (a *API) login(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		httpx.Error(w, http.StatusMethodNotAllowed, "POST required")
+		return
+	}
+	var in loginRequest
+	if err := httpx.Decode(r, &in); err != nil {
+		httpx.BadRequest(w, "invalid body")
+		return
+	}
+	userOK := subtle.ConstantTimeCompare([]byte(in.Username), []byte(a.Cfg.AdminUser)) == 1
+	passOK := subtle.ConstantTimeCompare([]byte(in.Password), []byte(a.Cfg.AdminPass)) == 1
+	if !userOK || !passOK {
+		httpx.Unauthorized(w)
+		return
+	}
+	token, exp := a.Sessions.Issue(a.Cfg.AdminUser)
+	http.SetCookie(w, &http.Cookie{
+		Name:     cookieName,
+		Value:    token,
+		Path:     "/",
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+		Expires:  exp,
+		MaxAge:   a.Sessions.TTL(),
+	})
+	httpx.OK(w, map[string]any{"token": token, "expires_at": exp.UTC().Format(rfc3339)})
+}
+
+const rfc3339 = "2006-01-02T15:04:05Z07:00"
+
+func (a *API) logout(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     cookieName,
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		SameSite: http.SameSiteLaxMode,
+		MaxAge:   -1,
+	})
+	httpx.OK(w, map[string]any{"ok": true})
+}
+
+func (a *API) me(w http.ResponseWriter, r *http.Request) {
+	httpx.OK(w, map[string]any{"user": a.Cfg.AdminUser})
+}
+
+// ---------- posts ----------
+
+func (a *API) listPosts(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		o := store.ListOptions{
+			Kind:   httpx.QueryString(r, "kind"),
+			Tag:    httpx.QueryString(r, "tag"),
+			Query:  httpx.QueryString(r, "q"),
+			Status: httpx.QueryString(r, "status"),
+			Page:   httpx.QueryInt(r, "page", 1),
+			Size:   httpx.QueryInt(r, "size", 20),
+		}
+		if o.Status == "" {
+			o.Status = "any"
+		}
+		page, err := a.Store.List(o)
+		if err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		httpx.OK(w, page)
+	case http.MethodPost:
+		var in model.PostInput
+		if err := httpx.Decode(r, &in); err != nil {
+			httpx.BadRequest(w, "invalid body")
+			return
+		}
+		in.Status = normalizeStatus(in.Status)
+		p, err := a.Store.Create(in)
+		if err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		httpx.Created(w, p)
+	default:
+		httpx.Error(w, http.StatusMethodNotAllowed, "GET/POST required")
+	}
+}
+
+func normalizeStatus(s string) string {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case model.StatusDraft, model.StatusPublished:
+		return strings.ToLower(strings.TrimSpace(s))
+	default:
+		return model.StatusDraft
+	}
+}
+
+func (a *API) postByID(w http.ResponseWriter, r *http.Request) {
+	rest := strings.Trim(strings.TrimPrefix(r.URL.Path, "/api/admin/posts/"), "/")
+	if rest == "" {
+		a.listPosts(w, r)
+		return
+	}
+	id, err := parseInt(rest)
+	if err != nil {
+		httpx.BadRequest(w, "bad post id")
+		return
+	}
+	switch r.Method {
+	case http.MethodGet:
+		p, err := a.Store.Get(id)
+		writeOne(w, p, err)
+	case http.MethodPut, http.MethodPatch:
+		var in model.PostInput
+		if err := httpx.Decode(r, &in); err != nil {
+			httpx.BadRequest(w, "invalid body")
+			return
+		}
+		if in.Status != "" {
+			in.Status = normalizeStatus(in.Status)
+		}
+		p, err := a.Store.Update(id, in)
+		writeOne(w, p, err)
+	case http.MethodDelete:
+		if err := a.Store.Delete(id); err != nil {
+			if errors.Is(err, store.ErrNotFound) {
+				httpx.NotFound(w)
+				return
+			}
+			httpx.ServerError(w, err)
+			return
+		}
+		httpx.OK(w, map[string]any{"ok": true})
+	default:
+		httpx.Error(w, http.StatusMethodNotAllowed, "GET/PUT/DELETE required")
+	}
+}
+
+func writeOne(w http.ResponseWriter, p model.Post, err error) {
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			httpx.NotFound(w)
+			return
+		}
+		httpx.ServerError(w, err)
+		return
+	}
+	httpx.OK(w, p)
+}
+
+// ---------- tags ----------
+
+func (a *API) listTags(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		tags, err := a.Store.ListTags()
+		if err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		if tags == nil {
+			tags = []model.Tag{}
+		}
+		httpx.OK(w, map[string]any{"tags": tags})
+	case http.MethodPost:
+		var in struct {
+			Name string `json:"name"`
+		}
+		if err := httpx.Decode(r, &in); err != nil {
+			httpx.BadRequest(w, "invalid body")
+			return
+		}
+		name := strings.TrimSpace(in.Name)
+		if name == "" {
+			httpx.BadRequest(w, "name required")
+			return
+		}
+		t, err := a.Store.CreateTag(name)
+		if err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		httpx.Created(w, t)
+	default:
+		httpx.Error(w, http.StatusMethodNotAllowed, "GET/POST required")
+	}
+}
+
+func (a *API) tagByID(w http.ResponseWriter, r *http.Request) {
+	rest := strings.Trim(strings.TrimPrefix(r.URL.Path, "/api/admin/tags/"), "/")
+	id, err := parseInt(rest)
+	if err != nil {
+		httpx.BadRequest(w, "bad tag id")
+		return
+	}
+	switch r.Method {
+	case http.MethodPut, http.MethodPatch:
+		var in struct {
+			Name string `json:"name"`
+		}
+		if err := httpx.Decode(r, &in); err != nil {
+			httpx.BadRequest(w, "invalid body")
+			return
+		}
+		t, err := a.Store.RenameTag(id, in.Name)
+		writeTag(w, t, err)
+	case http.MethodDelete:
+		if err := a.Store.DeleteTag(id); err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		httpx.OK(w, map[string]any{"ok": true})
+	default:
+		httpx.Error(w, http.StatusMethodNotAllowed, "PUT/DELETE required")
+	}
+}
+
+func writeTag(w http.ResponseWriter, t model.Tag, err error) {
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			httpx.NotFound(w)
+			return
+		}
+		httpx.Error(w, http.StatusBadRequest, err.Error())
+		return
+	}
+	httpx.OK(w, t)
+}
+
+// ---------- settings ----------
+
+func (a *API) settings(w http.ResponseWriter, r *http.Request) {
+	switch r.Method {
+	case http.MethodGet:
+		st, err := a.Store.GetSettings()
+		if err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		httpx.OK(w, st)
+	case http.MethodPut, http.MethodPost:
+		var in model.Settings
+		if err := httpx.Decode(r, &in); err != nil {
+			httpx.BadRequest(w, "invalid body")
+			return
+		}
+		if err := a.Store.UpdateSettings(in); err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		st, err := a.Store.GetSettings()
+		if err != nil {
+			httpx.ServerError(w, err)
+			return
+		}
+		httpx.OK(w, st)
+	default:
+		httpx.Error(w, http.StatusMethodNotAllowed, "GET/PUT required")
+	}
+}
+
+func parseInt(s string) (int64, error) {
+	if s == "" {
+		return 0, errors.New("empty")
+	}
+	var n int64
+	for _, c := range s {
+		if c < '0' || c > '9' {
+			return 0, errors.New("not a number")
+		}
+		n = n*10 + int64(c-'0')
+	}
+	return n, nil
+}
@@ -0,0 +1,71 @@
+package admin
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
+	"time"
+)
+
+// Sessions are stateless: base64("user:expiryUnix") + "." + HMAC-SHA256.
+// They survive restarts as long as ONE_SECRET stays the same.
+type Sessions struct {
+	secret []byte
+	ttl    time.Duration
+}
+
+func NewSessions(secret string, ttl time.Duration) *Sessions {
+	if ttl <= 0 {
+		ttl = 7 * 24 * time.Hour
+	}
+	return &Sessions{secret: []byte(secret), ttl: ttl}
+}
+
+var ErrBadSession = errors.New("invalid session")
+
+func (s *Sessions) Issue(user string) (string, time.Time) {
+	exp := time.Now().Add(s.ttl)
+	payload := base64.RawURLEncoding.EncodeToString([]byte(user + ":" + strconv.FormatInt(exp.Unix(), 10)))
+	return payload + "." + s.sign(payload), exp
+}
+
+func (s *Sessions) Verify(token string) (string, error) {
+	parts := strings.Split(token, ".")
+	if len(parts) != 2 {
+		return "", ErrBadSession
+	}
+	if !hmac.Equal([]byte(s.sign(parts[0])), []byte(parts[1])) {
+		return "", ErrBadSession
+	}
+	raw, err := base64.RawURLEncoding.DecodeString(parts[0])
+	if err != nil {
+		return "", ErrBadSession
+	}
+	i := strings.LastIndex(string(raw), ":")
+	if i <= 0 {
+		return "", ErrBadSession
+	}
+	user := string(raw)[:i]
+	expUnix, err := strconv.ParseInt(string(raw)[i+1:], 10, 64)
+	if err != nil {
+		return "", ErrBadSession
+	}
+	if time.Now().After(time.Unix(expUnix, 0)) {
+		return "", ErrBadSession
+	}
+	return user, nil
+}
+
+func (s *Sessions) sign(payload string) string {
+	mac := hmac.New(sha256.New, s.secret)
+	mac.Write([]byte(payload))
+	return base64.RawURLEncoding.EncodeToString(mac.Sum(nil))
+}
+
+func (s *Sessions) TTL() int { return int(s.ttl.Seconds()) }
+
+func (s *Sessions) String() string { return fmt.Sprintf("sessions(ttl=%s)", s.ttl) }