Sakurasan
4bb2ff4145
- users 表加 password_hash 列；后台账号（owner+admin）密码 bcrypt 存行内， 首次登录把 env / settings 引导凭据自迁移成行哈希 - 会话 token 从用户名改为携带用户 ID，角色与停用状态每请求查库， 改角色 / 停用账号即时生效（存量会话立即 401） - 登录：先查 users 表，再走 settings 哈希 / env 引导链； admin/admin 开发模式在任何账号设过密码后失效 - 权限：系统设置、用户管理仅 owner；内容管理 admin+owner； admin 后台新增 用户 页（创建 / 重置密码 / 停用 / 删除）， 设置页「登录与存储」tab 对管理员隐藏 - 账户页加修改密码表单（旧密码校验，OAuth/Passkey 首设免旧密码）； 评论区管理员身份跟随各自账号，不再统一挂站主名下 - 修复：providers 为 nil 时账户页白屏（Go nil slice 序列化成 null）
431 lines
13 KiB
Go
431 lines
13 KiB
Go
// Package api serves the read-only public surface: site settings, posts,
|
||
// archive, tags and RSS. Nothing here requires authentication.
|
||
package api
|
||
|
||
import (
|
||
"encoding/xml"
|
||
"errors"
|
||
"html"
|
||
"io"
|
||
"net/http"
|
||
"strconv"
|
||
"strings"
|
||
"time"
|
||
|
||
"oneblog/internal/auth"
|
||
"oneblog/internal/config"
|
||
"oneblog/internal/httpx"
|
||
"oneblog/internal/hub"
|
||
"oneblog/internal/model"
|
||
"oneblog/internal/ratelimit"
|
||
"oneblog/internal/render"
|
||
"oneblog/internal/storage"
|
||
"oneblog/internal/store"
|
||
"oneblog/internal/thumbs"
|
||
)
|
||
|
||
type API struct {
|
||
Store *store.Store
|
||
// Cfg 是环境变量配置（兜底值）。设置了 Res 时一律以 Res.Config()
|
||
// 的有效配置为准（DB 里的系统设置优先）；Res 为 nil（部分测试）才直接用它。
|
||
Cfg *config.Config
|
||
// Res 解析后台「系统设置」（DB 叠加 env），main.go 装配；可为 nil。
|
||
Res *config.Resolver
|
||
Blobs storage.BlobStore // 文件上传的存储后端（Res 设置时的兜底，二者取其一）
|
||
// Thumbs 是缩略图磁盘缓存（main.go 装配，DataDir/.thumbnail_cache）。
|
||
// 为 nil 时 /uploads/thumb/ 路由直接回原图。
|
||
Thumbs *thumbs.Store
|
||
// 评论区读者会话与 GitHub OAuth（main.go 装配）
|
||
ReaderSessions *auth.ReaderSessions
|
||
// AdminSessions 是后台管理员会话（admin.Sessions 满足它）。
|
||
// 前台访客登录时命中「已绑定给站主」的身份就靠它发后台会话。
|
||
// token 只带用户 ID（多用户后角色每请求查库，改角色 / 停用即时生效）。
|
||
AdminSessions interface {
|
||
Verify(token string) (int64, error)
|
||
Issue(userID int64) (string, time.Time)
|
||
TTL() int
|
||
}
|
||
// Passkeys 是 WebAuthn 服务（main.go 装配；nil 表示未启用，路由不开放）
|
||
Passkeys *auth.Passkeys
|
||
|
||
// passkeyFails 按 IP 限失败次数：passkey 登录是公开端点，
|
||
// 虽然伪造断言过不了验签，但不该让人无限次试。
|
||
passkeyFails *ratelimit.Window
|
||
// Hub 是评论变更的进程内广播（SSE 用；与后台 admin 共享同一实例）
|
||
Hub *hub.Hub
|
||
|
||
// 限流（Routes 里惰性初始化）：读者登录失败按 IP 计、评论写入按读者计。
|
||
// 登录入口此前裸奔——OAuth 跳转本身难刷，但 state 校验失败、
|
||
// Telegram 伪造签名这类恶意请求需要一个兜底。
|
||
authFails *ratelimit.Window
|
||
commentNew *ratelimit.Window
|
||
}
|
||
|
||
const (
|
||
maxAuthFails = 20 // 窗口内允许的登录失败（含伪造回调）
|
||
authFailWindow = 10 * time.Minute
|
||
maxComments = 5 // 每个读者每窗口最多发几条
|
||
commentWindow = time.Minute
|
||
)
|
||
|
||
func (a *API) Routes() http.Handler {
|
||
if a.authFails == nil {
|
||
a.authFails = ratelimit.New(maxAuthFails, authFailWindow)
|
||
a.commentNew = ratelimit.New(maxComments, commentWindow)
|
||
}
|
||
if a.passkeyFails == nil {
|
||
a.passkeyFails = ratelimit.New(maxAuthFails, authFailWindow)
|
||
}
|
||
mux := http.NewServeMux()
|
||
mux.HandleFunc("/api/health", func(w http.ResponseWriter, r *http.Request) {
|
||
if err := a.Store.Ping(r.Context()); err != nil {
|
||
httpx.Error(w, http.StatusServiceUnavailable, "database unreachable")
|
||
return
|
||
}
|
||
httpx.OK(w, map[string]any{"ok": true, "driver": a.Cfg.Driver})
|
||
})
|
||
// 读者登录与评论
|
||
mux.HandleFunc("/api/auth/providers", a.authProviders)
|
||
mux.HandleFunc("/api/auth/me", a.authMe)
|
||
mux.HandleFunc("/api/auth/logout", a.authLogout)
|
||
mux.HandleFunc("/api/auth/github/login", a.githubLogin)
|
||
mux.HandleFunc("/api/auth/callback/github", a.githubCallback)
|
||
mux.HandleFunc("/api/auth/google/login", a.googleLogin)
|
||
mux.HandleFunc("/api/auth/callback/google", a.googleCallback)
|
||
mux.HandleFunc("/api/auth/telegram", a.telegramAuth)
|
||
// 第三方身份绑定（需已登录后台）与 passkey 登录
|
||
mux.HandleFunc("/api/auth/github/bind", a.beginBind)
|
||
mux.HandleFunc("/api/auth/google/bind", a.beginBind)
|
||
mux.HandleFunc("/api/auth/passkey/begin", a.passkeyBegin)
|
||
mux.HandleFunc("/api/auth/passkey/finish", a.passkeyFinish)
|
||
mux.HandleFunc("/api/comments", a.comments)
|
||
mux.HandleFunc("/api/comments/stream", a.commentsStream)
|
||
mux.HandleFunc("/api/comments/", a.commentSub)
|
||
mux.HandleFunc("/api/site", a.site)
|
||
mux.HandleFunc("/api/posts", a.listPosts)
|
||
mux.HandleFunc("/api/posts/", a.getPost)
|
||
mux.HandleFunc("/api/archive", a.archive)
|
||
mux.HandleFunc("/api/tags", a.tags)
|
||
mux.HandleFunc("/api/projects", a.projects)
|
||
return mux
|
||
}
|
||
|
||
// Mount registers the feed routes on the root mux, where they are not
|
||
// shadowed by the SPA catch-all.
|
||
func (a *API) Mount(root *http.ServeMux) {
|
||
root.Handle("/api/", a.Routes())
|
||
root.HandleFunc("/rss.xml", a.RSS)
|
||
root.HandleFunc("/feed", a.RSS)
|
||
root.HandleFunc("/feed.xml", a.RSS)
|
||
}
|
||
|
||
func (a *API) site(w http.ResponseWriter, r *http.Request) {
|
||
st, err := a.Store.GetSettings()
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
// /api/site 是公开端点：管理员用户名只服务后台设置页，不外泄
|
||
st.AdminUsername = ""
|
||
st.AuthorAvatarURL = a.avatarURL(st.AuthorAvatarKey)
|
||
// uploads_public_base 告诉前端哪些图片直链是自己的存储（可转 /uploads/thumb/ 缩略图）
|
||
httpx.OK(w, map[string]any{"settings": st, "uploads_public_base": a.cfg().UploadsPublicBase})
|
||
}
|
||
|
||
// avatarURL 把 settings 里的头像 key 解析成可访问 URL。
|
||
// key 指向的文件已被删除时返回空串 —— 前台据此回落到站标，
|
||
// 而不是留一个打不开的裂图。
|
||
func (a *API) avatarURL(key string) string {
|
||
if key == "" {
|
||
return ""
|
||
}
|
||
f, err := a.Store.GetFileByKey(key)
|
||
if err != nil {
|
||
return ""
|
||
}
|
||
return storage.FileURL(f.Store, f.Key, a.cfg().UploadsPublicBase)
|
||
}
|
||
|
||
func listOptions(r *http.Request, defSize int) store.ListOptions {
|
||
return store.ListOptions{
|
||
Kind: httpx.QueryString(r, "kind"),
|
||
Tag: httpx.QueryString(r, "tag"),
|
||
Query: httpx.QueryString(r, "q"),
|
||
Page: httpx.QueryInt(r, "page", 1),
|
||
Size: httpx.QueryInt(r, "size", defSize),
|
||
Status: model.StatusPublished,
|
||
}
|
||
}
|
||
|
||
func (a *API) listPosts(w http.ResponseWriter, r *http.Request) {
|
||
page, err := a.Store.List(listOptions(r, 10))
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
// 时间线上短文直接铺正文：出口处做盘古之白（库里存的是原始渲染结果）
|
||
for i := range page.Items {
|
||
if page.Items[i].Kind == model.KindShort {
|
||
page.Items[i].ContentHTML = render.PanguHTML(page.Items[i].ContentHTML)
|
||
}
|
||
}
|
||
httpx.OK(w, page)
|
||
}
|
||
|
||
func (a *API) getPost(w http.ResponseWriter, r *http.Request) {
|
||
slug := strings.TrimPrefix(r.URL.Path, "/api/posts/")
|
||
slug = strings.TrimSuffix(slug, "/")
|
||
if slug == "" {
|
||
a.listPosts(w, r)
|
||
return
|
||
}
|
||
p, err := a.Store.GetBySlug(slug)
|
||
if err != nil {
|
||
if errors.Is(err, store.ErrNotFound) {
|
||
httpx.NotFound(w)
|
||
return
|
||
}
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
if p.Status != model.StatusPublished {
|
||
httpx.NotFound(w)
|
||
return
|
||
}
|
||
// 邻居给详情页侧栏的时间线用；取不到不该让详情页挂掉。
|
||
nb, err := a.Store.Neighbors(slug)
|
||
if err != nil {
|
||
nb = nil
|
||
}
|
||
// 详情正文出口做盘古之白（存库不动，改的是渲染层）
|
||
p.ContentHTML = render.PanguHTML(p.ContentHTML)
|
||
httpx.OK(w, struct {
|
||
model.Post
|
||
Neighbors []model.Post `json:"neighbors"`
|
||
}{p, nb})
|
||
}
|
||
|
||
func (a *API) archive(w http.ResponseWriter, r *http.Request) {
|
||
years, err := a.Store.Archive()
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
httpx.OK(w, map[string]any{"years": years})
|
||
}
|
||
|
||
func (a *API) tags(w http.ResponseWriter, r *http.Request) {
|
||
tags, err := a.Store.ListTags()
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
if tags == nil {
|
||
tags = []model.Tag{}
|
||
}
|
||
httpx.OK(w, map[string]any{"tags": tags})
|
||
}
|
||
|
||
func (a *API) projects(w http.ResponseWriter, r *http.Request) {
|
||
projects, err := a.Store.ListProjects(model.StatusPublished)
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
if projects == nil {
|
||
projects = []model.Project{}
|
||
}
|
||
httpx.OK(w, map[string]any{"projects": projects})
|
||
}
|
||
|
||
// ---------- RSS ----------
|
||
|
||
type rssItem struct {
|
||
XMLName xml.Name `xml:"item"`
|
||
Title string `xml:"title"`
|
||
Link string `xml:"link"`
|
||
Description string `xml:"description"`
|
||
PubDate string `xml:"pubDate"`
|
||
GUID string `xml:"guid"`
|
||
Category []string `xml:"category,omitempty"`
|
||
}
|
||
|
||
type rssChannel struct {
|
||
XMLName xml.Name `xml:"channel"`
|
||
Title string `xml:"title"`
|
||
Link string `xml:"link"`
|
||
Description string `xml:"description"`
|
||
Language string `xml:"language"`
|
||
LastBuild string `xml:"lastBuildDate"`
|
||
Items []rssItem `xml:"item"`
|
||
}
|
||
|
||
type rssFeed struct {
|
||
XMLName xml.Name `xml:"rss"`
|
||
Version string `xml:"version,attr"`
|
||
Channel rssChannel `xml:"channel"`
|
||
}
|
||
|
||
// RSS renders the site feed.
|
||
func (a *API) RSS(w http.ResponseWriter, r *http.Request) {
|
||
settings, err := a.Store.GetSettings()
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
page, err := a.Store.List(store.ListOptions{Status: model.StatusPublished, Page: 1, Size: 30})
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
base := strings.TrimSuffix(a.siteURL(), "/")
|
||
|
||
feed := rssFeed{
|
||
Version: "2.0",
|
||
Channel: rssChannel{
|
||
Title: orDefault(settings.SiteTitle, "ONE"),
|
||
Link: base + "/",
|
||
Description: orDefault(settings.SiteDesc, ""),
|
||
Language: "zh-CN",
|
||
LastBuild: time.Now().UTC().Format(time.RFC1123Z),
|
||
Items: []rssItem{},
|
||
},
|
||
}
|
||
for _, p := range page.Items {
|
||
title := p.Title
|
||
if p.Kind == model.KindShort || title == "" {
|
||
title = shortTitle(p)
|
||
}
|
||
desc := p.Summary
|
||
if desc == "" {
|
||
desc = trimRunes(stripTags(render.PanguHTML(p.ContentHTML)), 160)
|
||
}
|
||
item := rssItem{
|
||
Title: title,
|
||
Link: base + "/post/" + p.Slug,
|
||
Description: desc,
|
||
PubDate: rssDate(p.PublishedAt),
|
||
GUID: base + "/post/" + p.Slug,
|
||
Category: p.Tags,
|
||
}
|
||
if p.Kind == model.KindShort {
|
||
item.Title = "[短] " + title
|
||
}
|
||
feed.Channel.Items = append(feed.Channel.Items, item)
|
||
}
|
||
|
||
out, err := xml.MarshalIndent(feed, "", " ")
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
w.Header().Set("Content-Type", "application/rss+xml; charset=utf-8")
|
||
w.WriteHeader(http.StatusOK)
|
||
_, _ = w.Write([]byte(xml.Header))
|
||
_, _ = w.Write(out)
|
||
_, _ = w.Write([]byte("\n"))
|
||
}
|
||
|
||
func shortTitle(p model.Post) string {
|
||
s := strings.TrimSpace(stripTags(p.ContentHTML))
|
||
if s == "" {
|
||
return "无题"
|
||
}
|
||
return trimRunes(s, 40)
|
||
}
|
||
|
||
func stripTags(s string) string {
|
||
var b strings.Builder
|
||
in := false
|
||
for _, r := range s {
|
||
switch {
|
||
case r == '<':
|
||
in = true
|
||
case r == '>':
|
||
in = false
|
||
case !in:
|
||
b.WriteRune(r)
|
||
}
|
||
}
|
||
return html.UnescapeString(strings.TrimSpace(b.String()))
|
||
}
|
||
|
||
func trimRunes(s string, n int) string {
|
||
runes := []rune(s)
|
||
if len(runes) <= n {
|
||
return s
|
||
}
|
||
return string(runes[:n]) + "…"
|
||
}
|
||
|
||
func rssDate(rfc3339 string) string {
|
||
t, err := time.Parse(time.RFC3339, rfc3339)
|
||
if err != nil {
|
||
return time.Now().UTC().Format(time.RFC1123Z)
|
||
}
|
||
return t.UTC().Format(time.RFC1123Z)
|
||
}
|
||
|
||
func orDefault(s, def string) string {
|
||
if strings.TrimSpace(s) == "" {
|
||
return def
|
||
}
|
||
return s
|
||
}
|
||
|
||
// ---------- uploads（上传文件的公开访问） ----------
|
||
|
||
// UploadsHandler 供 main.go 挂在根 mux 的 /uploads/ 前缀上。按 key 查索引行，
|
||
// 经存储层流式返回本体；R2 + 公开域名时 302 到直链（后端不出流量）。
|
||
// key 必须在 files 表里有行——防止拿任意对象名探测存储端。
|
||
func (a *API) UploadsHandler() http.Handler {
|
||
return http.HandlerFunc(a.uploads)
|
||
}
|
||
|
||
func (a *API) uploads(w http.ResponseWriter, r *http.Request) {
|
||
key := strings.TrimPrefix(r.URL.Path, "/uploads/")
|
||
if key == "" || strings.Contains(key, "..") {
|
||
httpx.NotFound(w)
|
||
return
|
||
}
|
||
f, err := a.Store.GetFileByKey(key)
|
||
if errors.Is(err, store.ErrNotFound) {
|
||
httpx.NotFound(w)
|
||
return
|
||
}
|
||
if err != nil {
|
||
httpx.ServerError(w, err)
|
||
return
|
||
}
|
||
|
||
// R2 且配了公开域名：302 到直链，后端不出流量
|
||
if f.Store == "r2" && a.cfg().UploadsPublicBase != "" {
|
||
http.Redirect(w, r, storage.FileURL(f.Store, f.Key, a.cfg().UploadsPublicBase), http.StatusFound)
|
||
return
|
||
}
|
||
|
||
rc, size, err := a.blobs().Open(r.Context(), f.Key)
|
||
if err != nil {
|
||
httpx.NotFound(w)
|
||
return
|
||
}
|
||
defer rc.Close()
|
||
|
||
// ServeContent 自带 Range（视频/音频拖动进度条必需）、ETag 比对与 304。
|
||
// key 含内容哈希：内容不变则 URL 不变，可永久缓存。
|
||
w.Header().Set("Content-Type", f.Mime)
|
||
w.Header().Set("ETag", `"`+f.SHA256+`"`)
|
||
w.Header().Set("Cache-Control", "public, max-age=31536000, immutable")
|
||
if rs, ok := rc.(io.ReadSeeker); ok {
|
||
http.ServeContent(w, r, f.Name, time.Time{}, rs)
|
||
return
|
||
}
|
||
// 非本地存储拿不到 Seeker 时退回流式拷贝
|
||
w.Header().Set("Content-Length", strconv.FormatInt(size, 10))
|
||
if match := r.Header.Get("If-None-Match"); match != "" && match == `"`+f.SHA256+`"` {
|
||
w.WriteHeader(http.StatusNotModified)
|
||
return
|
||
}
|
||
io.Copy(w, rc)
|
||
}
|