缩略图懒生成 + 评论登录限流：时间线不再拉原图

- 新增 /uploads/thumb/{key}?w=：首访从存储端读一次原图，标准库盒均值缩放后
  落盘 data/.thumbnail_cache（按内容哈希命名，天然失效）；失败写 .failed 冷却
  一小时，非图片/超大一律 302 回原图，前端无感。原图路由改用 ServeContent，
  补上视频拖动进度条所需的 Range 支持
- 前端 thumbURL/thumbifyHtml 接入两套 UI 的时间线配图、长文封面与短文正文，
  并补 loading=lazy；详情页与灯箱仍用原图。/api/site 改为
  {settings, uploads_public_base}，让前端识别哪些直链属于自家存储
- 后台登录的滑动窗口限速器抽成 internal/ratelimit 共享包（调用面不变），
  新增：读者登录失败按 IP 20 次/10 分钟、评论写入按读者 5 条/分钟
  （站主豁免，且只计成功写入）

backend/internal/api/api.go

@@ -16,14 +16,19 @@ import (
 	"oneblog/internal/config"
 	"oneblog/internal/httpx"
 	"oneblog/internal/model"
+	"oneblog/internal/ratelimit"
 	"oneblog/internal/storage"
 	"oneblog/internal/store"
+	"oneblog/internal/thumbs"
 )
 
 type API struct {
 	Store *store.Store
 	Cfg   *config.Config
 	Blobs storage.BlobStore // 文件上传的存储后端（main.go 装配，与 admin 共享）
+	// Thumbs 是缩略图磁盘缓存（main.go 装配，DataDir/.thumbnail_cache）。
+	// 为 nil 时 /uploads/thumb/ 路由直接回原图。
+	Thumbs *thumbs.Store
 	// 评论区读者会话与 GitHub OAuth（main.go 装配）
 	ReaderSessions *auth.ReaderSessions
 	GH             auth.GitHub
@@ -35,9 +40,26 @@ type API struct {
 	// 其余登录方式（main.go 装配，未配置的自动不开放）
 	GG auth.Google
 	TG auth.Telegram
+
+	// 限流（Routes 里惰性初始化）：读者登录失败按 IP 计、评论写入按读者计。
+	// 登录入口此前裸奔——OAuth 跳转本身难刷，但 state 校验失败、
+	// Telegram 伪造签名这类恶意请求需要一个兜底。
+	authFails  *ratelimit.Window
+	commentNew *ratelimit.Window
 }
 
+const (
+	maxAuthFails   = 20 // 窗口内允许的登录失败（含伪造回调）
+	authFailWindow = 10 * time.Minute
+	maxComments    = 5 // 每个读者每窗口最多发几条
+	commentWindow  = time.Minute
+)
+
 func (a *API) Routes() http.Handler {
+	if a.authFails == nil {
+		a.authFails = ratelimit.New(maxAuthFails, authFailWindow)
+		a.commentNew = ratelimit.New(maxComments, commentWindow)
+	}
 	mux := http.NewServeMux()
 	mux.HandleFunc("/api/health", func(w http.ResponseWriter, r *http.Request) {
 		if err := a.Store.Ping(r.Context()); err != nil {
@@ -81,7 +103,8 @@ func (a *API) site(w http.ResponseWriter, r *http.Request) {
 		httpx.ServerError(w, err)
 		return
 	}
-	httpx.OK(w, st)
+	// uploads_public_base 告诉前端哪些图片直链是自己的存储（可转 /uploads/thumb/ 缩略图）
+	httpx.OK(w, map[string]any{"settings": st, "uploads_public_base": a.Cfg.UploadsPublicBase})
 }
 
 func listOptions(r *http.Request, defSize int) store.ListOptions {
@@ -341,11 +364,17 @@ func (a *API) uploads(w http.ResponseWriter, r *http.Request) {
 	}
 	defer rc.Close()
 
+	// ServeContent 自带 Range（视频/音频拖动进度条必需）、ETag 比对与 304。
+	// key 含内容哈希：内容不变则 URL 不变，可永久缓存。
 	w.Header().Set("Content-Type", f.Mime)
-	w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
 	w.Header().Set("ETag", `"`+f.SHA256+`"`)
-	// key 含内容哈希：内容不变则 URL 不变，可永久缓存
 	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+	if rs, ok := rc.(io.ReadSeeker); ok {
+		http.ServeContent(w, r, f.Name, time.Time{}, rs)
+		return
+	}
+	// 非本地存储拿不到 Seeker 时退回流式拷贝
+	w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
 	if match := r.Header.Get("If-None-Match"); match != "" && match == `"`+f.SHA256+`"` {
 		w.WriteHeader(http.StatusNotModified)
 		return

backend/internal/api/api_test.go

@@ -0,0 +1,96 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"oneblog/internal/auth"
+	"oneblog/internal/config"
+	"oneblog/internal/db"
+	"oneblog/internal/model"
+	"oneblog/internal/store"
+)
+
+func newTestAPI(t *testing.T) (*API, http.Handler) {
+	t.Helper()
+	d, err := db.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() { d.Close() })
+	st, err := store.New(d)
+	if err != nil {
+		t.Fatalf("store: %v", err)
+	}
+	a := &API{
+		Store:          st,
+		Cfg:            &config.Config{SiteURL: "http://localhost:8080"},
+		ReaderSessions: auth.NewReaderSessions("test-secret", time.Hour),
+		TG:             auth.Telegram{Bot: "testbot", Token: "123:abc"},
+	}
+	settings, err := st.GetSettings()
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+	settings.CommentsEnabled = true
+	if err := st.UpdateSettings(settings); err != nil {
+		t.Fatalf("enable comments: %v", err)
+	}
+	return a, a.Routes()
+}
+
+// Telegram 伪造签名反复重试应触发 IP 限速
+func TestTelegramAuthRateLimited(t *testing.T) {
+	_, h := newTestAPI(t)
+	body := `{"id":1,"first_name":"x","hash":"deadbeef"}`
+	var rec *httptest.ResponseRecorder
+	for i := 0; i < maxAuthFails; i++ {
+		req := httptest.NewRequest(http.MethodPost, "/api/auth/telegram", strings.NewReader(body))
+		rec = httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		if rec.Code != http.StatusForbidden {
+			t.Fatalf("attempt %d: got %d, want 403", i+1, rec.Code)
+		}
+	}
+	req := httptest.NewRequest(http.MethodPost, "/api/auth/telegram", strings.NewReader(body))
+	rec = httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != http.StatusTooManyRequests {
+		t.Fatalf("after %d failures: got %d, want 429", maxAuthFails, rec.Code)
+	}
+}
+
+// 评论写入按读者限速：第 maxComments+1 条被拒
+func TestCommentRateLimited(t *testing.T) {
+	a, h := newTestAPI(t)
+	p, err := a.Store.Create(model.PostInput{Kind: model.KindLong, Title: "t", Slug: "t",
+		ContentMd: "x", Status: model.StatusPublished})
+	if err != nil {
+		t.Fatal(err)
+	}
+	rd, err := a.Store.UpsertReader(model.Reader{Provider: "github", Handle: "u1", Name: "u1"})
+	if err != nil {
+		t.Fatal(err)
+	}
+	tok, _ := a.ReaderSessions.Issue(rd.ID)
+	post := func(i int) *httptest.ResponseRecorder {
+		body, _ := json.Marshal(map[string]any{"post_id": p.ID, "body_md": "好"})
+		req := httptest.NewRequest(http.MethodPost, "/api/comments", strings.NewReader(string(body)))
+		req.AddCookie(&http.Cookie{Name: auth.ReaderCookie, Value: tok})
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec
+	}
+	for i := 0; i < maxComments; i++ {
+		if rec := post(i); rec.Code != http.StatusCreated {
+			t.Fatalf("comment %d: got %d %s", i+1, rec.Code, rec.Body.String())
+		}
+	}
+	if rec := post(maxComments); rec.Code != http.StatusTooManyRequests {
+		t.Fatalf("over limit: got %d, want 429", rec.Code)
+	}
+}

backend/internal/api/comments.go

@@ -18,6 +18,7 @@ import (
 	"oneblog/internal/auth"
 	"oneblog/internal/httpx"
 	"oneblog/internal/model"
+	"oneblog/internal/ratelimit"
 	"oneblog/internal/render"
 	"oneblog/internal/store"
 )
@@ -121,18 +122,26 @@ func (a *API) githubCallback(w http.ResponseWriter, r *http.Request) {
 		httpx.NotFound(w)
 		return
 	}
+	ip := ratelimit.SourceKey(r)
+	if a.authFails.Blocked(ip) {
+		httpx.Error(w, http.StatusTooManyRequests, "登录失败次数过多，请稍后再试")
+		return
+	}
 	ck, err := r.Cookie(oauthStateCook)
 	if err != nil || ck.Value == "" || ck.Value != r.FormValue("state") {
+		a.authFails.Add(ip)
 		httpx.BadRequest(w, "state 不匹配，请重新登录")
 		return
 	}
 	gh, err := a.GH.Exchange(r.Context(), r.FormValue("code"), a.Cfg.SiteURL+"/api/auth/callback/github")
 	if err != nil {
+		a.authFails.Add(ip)
 		httpx.ServerError(w, err)
 		return
 	}
 	u, err := a.GH.FetchUser(r.Context(), gh)
 	if err != nil {
+		a.authFails.Add(ip)
 		httpx.ServerError(w, err)
 		return
 	}
@@ -206,6 +215,15 @@ func (a *API) createComment(w http.ResponseWriter, r *http.Request) {
 		httpx.Error(w, http.StatusForbidden, "你已被禁言，暂时无法评论")
 		return
 	}
+	// 写入限速：每读者每分钟最多 maxComments 条（站主豁免，批量回复不该被卡）
+	var rateKey string
+	if !isOwner {
+		rateKey = strconv.FormatInt(reader.ID, 10)
+		if a.commentNew.Blocked(rateKey) {
+			httpx.Error(w, http.StatusTooManyRequests, "发得太快了，休息一分钟再试")
+			return
+		}
+	}
 	st, err := a.Store.GetSettings()
 	if err != nil {
 		httpx.ServerError(w, err)
@@ -267,6 +285,9 @@ func (a *API) createComment(w http.ResponseWriter, r *http.Request) {
 		httpx.ServerError(w, err)
 		return
 	}
+	if rateKey != "" {
+		a.commentNew.Add(rateKey) // 只计成功写入：空正文这类手滑不扣配额
+	}
 	httpx.Created(w, c)
 }
 

backend/internal/api/providers.go

@@ -14,6 +14,7 @@ import (
 	"oneblog/internal/auth"
 	"oneblog/internal/httpx"
 	"oneblog/internal/model"
+	"oneblog/internal/ratelimit"
 )
 
 // authProviders 列出已配置的登录方式。
@@ -79,18 +80,26 @@ func (a *API) googleCallback(w http.ResponseWriter, r *http.Request) {
 		httpx.NotFound(w)
 		return
 	}
+	ip := ratelimit.SourceKey(r)
+	if a.authFails.Blocked(ip) {
+		httpx.Error(w, http.StatusTooManyRequests, "登录失败次数过多，请稍后再试")
+		return
+	}
 	ck, err := r.Cookie(oauthStateCook)
 	if err != nil || ck.Value == "" || ck.Value != r.FormValue("state") {
+		a.authFails.Add(ip)
 		httpx.BadRequest(w, "state 不匹配，请重新登录")
 		return
 	}
 	accessToken, err := a.GG.Exchange(r.Context(), r.FormValue("code"), a.Cfg.SiteURL+"/api/auth/callback/google")
 	if err != nil {
+		a.authFails.Add(ip)
 		httpx.ServerError(w, err)
 		return
 	}
 	u, err := a.GG.FetchUser(r.Context(), accessToken)
 	if err != nil {
+		a.authFails.Add(ip)
 		httpx.ServerError(w, err)
 		return
 	}
@@ -121,6 +130,12 @@ func (a *API) telegramAuth(w http.ResponseWriter, r *http.Request) {
 		httpx.NotFound(w)
 		return
 	}
+	// widget 回传是纯表单 POST，签名可被伪造重放——失败计数最必要的一路
+	ip := ratelimit.SourceKey(r)
+	if a.authFails.Blocked(ip) {
+		httpx.Error(w, http.StatusTooManyRequests, "登录失败次数过多，请稍后再试")
+		return
+	}
 	// 原样读 body：验签必须用收到的全部字段（官方规则），
 	// 身份字段再单独解一次
 	body, err := io.ReadAll(r.Body)
@@ -130,10 +145,12 @@ func (a *API) telegramAuth(w http.ResponseWriter, r *http.Request) {
 	}
 	var fields map[string]any
 	if err := json.Unmarshal(body, &fields); err != nil || len(fields) == 0 {
+		a.authFails.Add(ip)
 		httpx.BadRequest(w, "invalid body")
 		return
 	}
 	if err := a.TG.VerifyMap(fields); err != nil {
+		a.authFails.Add(ip)
 		httpx.Error(w, http.StatusForbidden, "Telegram 登录校验失败，请重试")
 		return
 	}

backend/internal/api/thumb.go

@@ -0,0 +1,141 @@
+// 缩略图懒生成：GET /uploads/thumb/{key}?w=960
+//
+// 首次请求从存储端读一次原图，缩放编码后落盘缓存（DataDir/.thumbnail_cache），
+// 之后直接供缓存——时间线首屏不再拉原图。非图片 / 解码失败 / 冷却期内
+// 一律 302 回原图：前端 <img> 拿 302 是无感的。
+package api
+
+import (
+	"errors"
+	"net/http"
+	"os"
+	"strconv"
+	"strings"
+
+	"oneblog/internal/httpx"
+	"oneblog/internal/model"
+	"oneblog/internal/storage"
+	"oneblog/internal/store"
+	"oneblog/internal/thumbs"
+)
+
+const (
+	thumbDefaultW = 960
+	thumbMinW     = 64
+	thumbMaxW     = 1600
+)
+
+func (a *API) ThumbHandler() http.Handler {
+	return http.HandlerFunc(a.thumb)
+}
+
+func (a *API) thumb(w http.ResponseWriter, r *http.Request) {
+	if a.Thumbs == nil {
+		httpx.NotFound(w)
+		return
+	}
+	key := strings.TrimPrefix(r.URL.Path, "/uploads/thumb/")
+	if key == "" || strings.Contains(key, "..") {
+		httpx.NotFound(w)
+		return
+	}
+	width := thumbDefaultW
+	if s := r.URL.Query().Get("w"); s != "" {
+		if n, err := strconv.Atoi(s); err == nil && n >= thumbMinW && n <= thumbMaxW {
+			width = n
+		}
+	}
+
+	f, err := a.Store.GetFileByKey(key)
+	if errors.Is(err, store.ErrNotFound) {
+		httpx.NotFound(w)
+		return
+	}
+	if err != nil {
+		httpx.ServerError(w, err)
+		return
+	}
+
+	if !thumbs.Supported(f.Mime) || f.SHA256 == "" {
+		a.thumbFallback(w, r, f)
+		return
+	}
+
+	// 快路径：缓存命中直接供（锁外）
+	if p := a.Thumbs.FindCached(f.SHA256, width); p != "" {
+		a.serveThumbFile(w, r, p, f)
+		return
+	}
+	// 冷却期：近期失败过，不再尝试
+	if a.Thumbs.FailedRecently(f.SHA256) {
+		a.thumbFallback(w, r, f)
+		return
+	}
+
+	// 慢路径：同 key+宽度并发只生成一次，后来者等锁后读缓存
+	lk := a.Thumbs.Lock(f.SHA256, width)
+	lk.Lock()
+	defer lk.Unlock()
+	if p := a.Thumbs.FindCached(f.SHA256, width); p != "" {
+		a.serveThumbFile(w, r, p, f)
+		return
+	}
+
+	rc, _, err := a.Blobs.Open(r.Context(), f.Key)
+	if err != nil {
+		a.Thumbs.MarkFailed(f.SHA256)
+		a.thumbFallback(w, r, f)
+		return
+	}
+	src, err := thumbs.ReadAllLimited(rc, thumbs.MaxSrcBytes)
+	rc.Close()
+	if err != nil {
+		a.Thumbs.MarkFailed(f.SHA256)
+		a.thumbFallback(w, r, f)
+		return
+	}
+	out, outMime, _, err := thumbs.Generate(src, f.Mime, width)
+	if err != nil {
+		a.Thumbs.MarkFailed(f.SHA256)
+		a.thumbFallback(w, r, f)
+		return
+	}
+	p, err := a.Thumbs.Put(f.SHA256, width, out, outMime)
+	if err != nil {
+		// 写缓存失败不拖累本次响应：产物就在内存里
+		a.serveThumbBytes(w, outMime, out, f)
+		return
+	}
+	a.serveThumbFile(w, r, p, f)
+}
+
+// thumbFallback 回原图：R2 + 公开域名是 302 直链，本地/未配域名回 /uploads/ 路由。
+func (a *API) thumbFallback(w http.ResponseWriter, r *http.Request, f model.File) {
+	http.Redirect(w, r, storage.FileURL(f.Store, f.Key, a.Cfg.UploadsPublicBase), http.StatusFound)
+}
+
+// serveThumbFile 用 ServeContent 供缓存文件：自带 Range/Last-Modified/304。
+func (a *API) serveThumbFile(w http.ResponseWriter, r *http.Request, path string, f model.File) {
+	fp, err := os.Open(path)
+	if err != nil {
+		a.thumbFallback(w, r, f)
+		return
+	}
+	defer fp.Close()
+	fi, err := fp.Stat()
+	if err != nil {
+		httpx.NotFound(w)
+		return
+	}
+	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+	http.ServeContent(w, r, path, fi.ModTime(), fp)
+}
+
+func (a *API) serveThumbBytes(w http.ResponseWriter, mime string, data []byte, f model.File) {
+	w.Header().Set("Content-Type", mime)
+	w.Header().Set("Content-Length", strconv.Itoa(len(data)))
+	w.Header().Set("ETag", `"`+f.SHA256+`"`)
+	w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(data)
+}