Sakurasan
dd2994189a
后端： - ORDER BY 白名单（sanitizeOrder）堵住 ?order= SQL 注入，补回归测试 - 登录限速（每 IP 10 次失败/10 分钟 429）、TLS/反代下 Secure cookie、NewAPI 构造器 - Delete/setTags/MergeTags/DeleteTag 包事务；Archive 去 500 篇上限 - 列表接口裁剪：不传 content_md，长文 content_html 截 600，新增 content_len；health 探 DB 前端： - EditorView 路由复用串写修复（RouterView :key + sync watch 回写原文章） - v-html 出口统一过 DOMPurify（sanitizeHtml），stripTags 改 DOMParser - 列表竞态防护（Home/Tag/Posts 请求序号）、TagView 分页修复 - 侧栏接口 30s 缓存去重；one:unauthorized 监听器泄漏修复 - 删 styles.css 498 行重复块；移除 tailwind/marked/vue-tsc 死依赖；CommandPalette a11y 语义
153 lines
4.2 KiB
Go
153 lines
4.2 KiB
Go
// Command one-server is the ONE blog backend: public API, admin API, RSS and
|
|
// (when built) the static frontend.
|
|
package main
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"flag"
|
|
"fmt"
|
|
"log"
|
|
"net/http"
|
|
"os"
|
|
"os/signal"
|
|
"path/filepath"
|
|
"strings"
|
|
"syscall"
|
|
"time"
|
|
|
|
"oneblog/internal/admin"
|
|
"oneblog/internal/api"
|
|
"oneblog/internal/config"
|
|
"oneblog/internal/db"
|
|
"oneblog/internal/store"
|
|
)
|
|
|
|
func main() {
|
|
addr := flag.String("addr", "", "listen address (overrides ONE_ADDR)")
|
|
flag.Parse()
|
|
|
|
cfg, err := config.Load()
|
|
if err != nil {
|
|
log.Fatalf("config: %v", err)
|
|
}
|
|
if *addr != "" {
|
|
cfg.Addr = *addr
|
|
}
|
|
|
|
pool, err := db.Open(cfg.Driver, cfg.DSN)
|
|
if err != nil {
|
|
log.Fatalf("database: %v", err)
|
|
}
|
|
defer pool.Close()
|
|
|
|
st, err := store.New(pool)
|
|
if err != nil {
|
|
log.Fatalf("store: %v", err)
|
|
}
|
|
|
|
public := &api.API{Store: st, Cfg: cfg}
|
|
adminAPI := admin.NewAPI(st, cfg, admin.NewSessions(cfg.SessionSec, 7*24*time.Hour))
|
|
|
|
root := http.NewServeMux()
|
|
root.Handle("/api/admin/", adminAPI.Routes())
|
|
public.Mount(root)
|
|
root.Handle("/", spaHandler(cfg.WebDist))
|
|
|
|
srv := &http.Server{
|
|
Addr: cfg.Addr,
|
|
Handler: requestLog(root),
|
|
ReadTimeout: 15 * time.Second,
|
|
WriteTimeout: 60 * time.Second,
|
|
IdleTimeout: 60 * time.Second,
|
|
}
|
|
|
|
go func() {
|
|
log.Printf("ONE server listening on %s (db=%s)", cfg.Addr, cfg.Driver)
|
|
if cfg.InsecureDev {
|
|
log.Printf("admin login: %s / %s (set ONE_ADMIN_PASSWORD to change)", cfg.AdminUser, cfg.AdminPass)
|
|
} else {
|
|
log.Printf("admin login: %s / (from ONE_ADMIN_PASSWORD)", cfg.AdminUser)
|
|
}
|
|
if !dirExists(cfg.WebDist) {
|
|
log.Printf("frontend build not found at %s — run `make web` or `make dev` (API still available)", cfg.WebDist)
|
|
}
|
|
if err := srv.ListenAndServe(); err != nil && !errors.Is(err, http.ErrServerClosed) {
|
|
log.Fatalf("listen: %v", err)
|
|
}
|
|
}()
|
|
|
|
stop := make(chan os.Signal, 1)
|
|
signal.Notify(stop, os.Interrupt, syscall.SIGTERM)
|
|
<-stop
|
|
|
|
ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
|
|
defer cancel()
|
|
_ = srv.Shutdown(ctx)
|
|
log.Print("bye")
|
|
}
|
|
|
|
// spaHandler serves the built Vue app and falls back to index.html so client
|
|
// routes like /post/foo work on refresh.
|
|
func spaHandler(dist string) http.Handler {
|
|
fs := http.Dir(dist)
|
|
fileServer := http.FileServer(fs)
|
|
index := filepath.Join(dist, "index.html")
|
|
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if !dirExists(dist) {
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
fmt.Fprint(w, placeholderPage())
|
|
return
|
|
}
|
|
p := strings.TrimPrefix(r.URL.Path, "/")
|
|
if p == "" {
|
|
p = "index.html"
|
|
}
|
|
if _, err := fs.Open(p); err == nil && hasExt(p) {
|
|
fileServer.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
http.ServeFile(w, r, index)
|
|
})
|
|
}
|
|
|
|
func hasExt(p string) bool {
|
|
return strings.Contains(filepath.Base(p), ".")
|
|
}
|
|
|
|
func dirExists(p string) bool {
|
|
fi, err := os.Stat(p)
|
|
return err == nil && fi.IsDir()
|
|
}
|
|
|
|
func requestLog(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
start := time.Now()
|
|
rec := &statusRecorder{ResponseWriter: w, status: http.StatusOK}
|
|
next.ServeHTTP(rec, r)
|
|
if strings.HasPrefix(r.URL.Path, "/api") || r.URL.Path == "/rss.xml" {
|
|
log.Printf("%s %s %d %s", r.Method, r.URL.RequestURI(), rec.status, time.Since(start).Truncate(time.Millisecond))
|
|
}
|
|
})
|
|
}
|
|
|
|
type statusRecorder struct {
|
|
http.ResponseWriter
|
|
status int
|
|
}
|
|
|
|
func (s *statusRecorder) WriteHeader(code int) { s.status = code; s.ResponseWriter.WriteHeader(code) }
|
|
|
|
func placeholderPage() string {
|
|
return `<!doctype html><meta charset="utf-8"><title>ONE</title>
|
|
<style>body{font-family:-apple-system,"PingFang SC",sans-serif;background:#faf7f1;color:#33302b;
|
|
display:flex;align-items:center;justify-content:center;height:100vh;margin:0}
|
|
div{max-width:520px;line-height:1.95;padding:0 24px}
|
|
code{background:#efe9dd;padding:2px 6px;border-radius:3px}</style>
|
|
<div><h1 style="font-family:Georgia,serif">ONE · 一个博客</h1>
|
|
<p>后端已启动，但前端还没构建。</p>
|
|
<p>在项目根目录执行 <code>make web</code> 构建前端，或 <code>make dev</code> 同时起前后端。</p>
|
|
<p>接口可用：<code>/api/posts</code>、<code>/api/archive</code>、<code>/api/tags</code>、<code>/rss.xml</code>；后台接口在 <code>/api/admin/</code>。</p></div>`
|
|
}
|