首次提交：姜十三论坛

2026-09-12 01:11:05 +08:00
commit 0c2b0d2d6a
62 changed files with 8289 additions and 0 deletions
--- a/backend/handler/auth.go
+++ b/backend/handler/auth.go
@@ -0,0 +1,213 @@
+package handler
+
+import (
+	"net/http"
+	"time"
+
+	"github.com/freefire/jiang13-bbs/middleware"
+	"github.com/freefire/jiang13-bbs/service"
+	"github.com/gin-gonic/gin"
+)
+
+var (
+	accessCookieMaxAge  = int(service.AccessTokenTTL.Seconds())  // 15 分钟
+	refreshCookieMaxAge = int(service.RefreshTokenTTL.Seconds()) // 7 天
+)
+
+// setAuthCookies 设置认证 cookie：
+// - j13_token: access token（HttpOnly，15min）
+// - j13_refresh: refresh token（HttpOnly，7天，仅 /api/auth 路径）
+// - j13_csrf: CSRF token（可读，7天，与 refresh 同生命周期，确保 refresh 流程可用）
+func setAuthCookies(c *gin.Context, accessToken, refreshToken string, secure bool) {
+	csrfToken := service.GenerateCSRFToken()
+
+	// Access token cookie
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     service.CookieName,
+		Value:    accessToken,
+		Path:     "/",
+		MaxAge:   accessCookieMaxAge,
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteStrictMode,
+	})
+	// Refresh token cookie（仅 /api/auth 路径使用，缩小攻击面）
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     service.RefreshCookieName,
+		Value:    refreshToken,
+		Path:     "/api/auth",
+		MaxAge:   refreshCookieMaxAge,
+		HttpOnly: true,
+		Secure:   secure,
+		SameSite: http.SameSiteStrictMode,
+	})
+	// CSRF cookie（前端可读，放入 X-CSRF-Token header；与 refresh 同寿命以支持 refresh 流程）
+	http.SetCookie(c.Writer, &http.Cookie{
+		Name:     service.CSRFCookieName,
+		Value:    csrfToken,
+		Path:     "/",
+		MaxAge:   refreshCookieMaxAge,
+		HttpOnly: false,
+		Secure:   secure,
+		SameSite: http.SameSiteStrictMode,
+	})
+}
+
+// clearAuthCookies 清除所有认证 cookie
+func clearAuthCookies(c *gin.Context) {
+	cookies := []struct{ name, path string }{
+		{service.CookieName, "/"},
+		{service.RefreshCookieName, "/api/auth"},
+		{service.CSRFCookieName, "/"},
+	}
+	for _, ck := range cookies {
+		http.SetCookie(c.Writer, &http.Cookie{
+			Name:     ck.name,
+			Value:    "",
+			Path:     ck.path,
+			MaxAge:   -1,
+			HttpOnly: true,
+			Secure:   false,
+			SameSite: http.SameSiteStrictMode,
+			Expires:  time.Unix(0, 0),
+		})
+	}
+}
+
+// RegisterRequest 注册请求
+type RegisterRequest struct {
+	Username string `json:"username" binding:"required,min=3,max=32"`
+	Email    string `json:"email" binding:"omitempty,email"`
+	Password string `json:"password" binding:"required,min=6,max=64"`
+}
+
+// LoginRequest 登录请求
+type LoginRequest struct {
+	Username string `json:"username" binding:"required"`
+	Password string `json:"password" binding:"required"`
+}
+
+// Register 用户注册
+func (h *Handlers) Register(c *gin.Context) {
+	var req RegisterRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	user, err := h.Auth.Register(req.Username, req.Email, req.Password)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"id":       user.ID,
+		"username": user.Username,
+	})
+}
+
+// Login 用户登录：access + refresh token 写入 HttpOnly cookie，CSRF 写入可读 cookie
+func (h *Handlers) Login(c *gin.Context) {
+	var req LoginRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	accessToken, refreshToken, user, err := h.Auth.Login(req.Username, req.Password)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		return
+	}
+	// dev 模式不设 Secure，生产环境需 HTTPS
+	setAuthCookies(c, accessToken, refreshToken, !h.Cfg.DevMode)
+	c.JSON(http.StatusOK, gin.H{
+		"user": gin.H{
+			"id":       user.ID,
+			"username": user.Username,
+			"nickname": user.Nickname,
+			"avatar":   user.Avatar,
+			"role":     user.Role,
+		},
+	})
+}
+
+// Refresh 刷新 access token：验证 refresh token，轮转后签发新 access + refresh
+func (h *Handlers) Refresh(c *gin.Context) {
+	refreshToken, err := c.Cookie(service.RefreshCookieName)
+	if err != nil || refreshToken == "" {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "未登录"})
+		return
+	}
+	accessToken, newRefresh, user, err := h.Auth.RotateRefreshToken(refreshToken)
+	if err != nil {
+		clearAuthCookies(c)
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "登录已过期，请重新登录"})
+		return
+	}
+	setAuthCookies(c, accessToken, newRefresh, !h.Cfg.DevMode)
+	c.JSON(http.StatusOK, gin.H{
+		"user": gin.H{
+			"id":       user.ID,
+			"username": user.Username,
+			"nickname": user.Nickname,
+			"avatar":   user.Avatar,
+			"role":     user.Role,
+		},
+	})
+}
+
+// Logout 登出：撤销 refresh token，清除所有认证 cookie
+func (h *Handlers) Logout(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	if claims != nil {
+		// 撤销该用户所有 refresh token（防止 refresh token 被盗用）
+		h.Auth.RevokeAllUserRefreshTokens(claims.ID)
+	}
+	clearAuthCookies(c)
+	c.JSON(http.StatusOK, gin.H{"message": "已登出"})
+}
+
+// ChangePasswordRequest 修改密码请求
+type ChangePasswordRequest struct {
+	OldPassword string `json:"old_password" binding:"required"`
+	NewPassword string `json:"new_password" binding:"required,min=6,max=64"`
+}
+
+// ChangePassword 修改密码：校验旧密码，更新新密码，清除所有登录态
+func (h *Handlers) ChangePassword(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	var req ChangePasswordRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	if err := h.Auth.ChangePassword(claims.ID, req.OldPassword, req.NewPassword); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	// 密码已改，token_version 已递增，旧 token 全部失效，清除 cookie 要求重新登录
+	clearAuthCookies(c)
+	c.JSON(http.StatusOK, gin.H{"message": "密码修改成功，请重新登录"})
+}
+
+// Me 获取当前用户信息
+func (h *Handlers) Me(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	if claims == nil {
+		c.JSON(http.StatusOK, gin.H{"user": nil})
+		return
+	}
+	user, err := h.Auth.GetUserByID(claims.ID)
+	if err != nil {
+		c.JSON(http.StatusOK, gin.H{"user": nil})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"user": gin.H{
+			"id":       user.ID,
+			"username": user.Username,
+			"nickname": user.Nickname,
+			"avatar":   user.Avatar,
+			"role":     user.Role,
+		},
+	})
+}
--- a/backend/handler/board.go
+++ b/backend/handler/board.go
@@ -0,0 +1,17 @@
+package handler
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// Boards 获取板块列表
+func (h *Handlers) Boards(c *gin.Context) {
+	boards, err := h.Board.List()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"boards": boards})
+}
--- a/backend/handler/comment.go
+++ b/backend/handler/comment.go
@@ -0,0 +1,70 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/freefire/jiang13-bbs/middleware"
+	"github.com/freefire/jiang13-bbs/model"
+	"github.com/gin-gonic/gin"
+)
+
+// PostComments 获取帖子评论
+func (h *Handlers) PostComments(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	comments, err := h.Comment.ListByPost(uint(id))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"comments": comments})
+}
+
+// CreateCommentRequest 评论请求
+type CreateCommentRequest struct {
+	Content string `json:"content" binding:"required,min=1"`
+}
+
+// CreateComment 创建评论
+func (h *Handlers) CreateComment(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	var req CreateCommentRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	comment, err := h.Comment.Create(claims.ID, uint(id), req.Content)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	// 通知帖子作者（排除自己评论自己的帖子）
+	if authorID, e := h.Post.GetAuthorID(uint(id)); e == nil {
+		h.Notification.Create(authorID, claims.ID, model.NotificationTypeComment, uint(id), comment.ID, req.Content)
+	}
+	c.JSON(http.StatusOK, gin.H{"comment": comment})
+}
+
+// DeleteComment 删除评论
+func (h *Handlers) DeleteComment(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	cid, err := strconv.ParseUint(c.Param("cid"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的评论 ID"})
+		return
+	}
+	if err := h.Comment.Delete(uint(cid), claims.ID, claims.Role); err != nil {
+		c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "已删除"})
+}
--- a/backend/handler/handlers.go
+++ b/backend/handler/handlers.go
@@ -0,0 +1,17 @@
+package handler
+
+import (
+	"github.com/freefire/jiang13-bbs/config"
+	"github.com/freefire/jiang13-bbs/service"
+)
+
+// Handlers 聚合所有服务引用
+type Handlers struct {
+	Cfg          *config.Config
+	Auth         *service.AuthService
+	Board        *service.BoardService
+	Post         *service.PostService
+	Comment      *service.CommentService
+	Like         *service.LikeService
+	Notification *service.NotificationService
+}
--- a/backend/handler/health.go
+++ b/backend/handler/health.go
@@ -0,0 +1,17 @@
+package handler
+
+import (
+	"net/http"
+
+	"github.com/freefire/jiang13-bbs/model"
+	"github.com/gin-gonic/gin"
+)
+
+// Health 健康检查
+func (h *Handlers) Health(c *gin.Context) {
+	if err := model.PingDB(); err != nil {
+		c.JSON(http.StatusServiceUnavailable, gin.H{"status": "error", "error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"status": "ok"})
+}
--- a/backend/handler/like.go
+++ b/backend/handler/like.go
@@ -0,0 +1,32 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/freefire/jiang13-bbs/middleware"
+	"github.com/freefire/jiang13-bbs/model"
+	"github.com/gin-gonic/gin"
+)
+
+// ToggleLike 点赞/取消点赞
+func (h *Handlers) ToggleLike(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	liked, count, err := h.Like.Toggle(uint(id), claims.ID)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	// 仅点赞时通知帖子作者（取消点赞不通知）
+	if liked {
+		if authorID, e := h.Post.GetAuthorID(uint(id)); e == nil {
+			h.Notification.Create(authorID, claims.ID, model.NotificationTypeLike, uint(id), 0, "")
+		}
+	}
+	c.JSON(http.StatusOK, gin.H{"liked": liked, "like_count": count})
+}
--- a/backend/handler/notification.go
+++ b/backend/handler/notification.go
@@ -0,0 +1,64 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/freefire/jiang13-bbs/middleware"
+	"github.com/gin-gonic/gin"
+)
+
+// Notifications 获取当前用户的通知列表（分页）
+func (h *Handlers) Notifications(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+
+	list, total, err := h.Notification.List(claims.ID, page, size)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"notifications": list,
+		"total":         total,
+		"page":          page,
+		"size":          size,
+	})
+}
+
+// UnreadCount 获取未读通知数
+func (h *Handlers) UnreadCount(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	count, err := h.Notification.UnreadCount(claims.ID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"count": count})
+}
+
+// MarkRead 标记单条通知为已读
+func (h *Handlers) MarkRead(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的通知 ID"})
+		return
+	}
+	if err := h.Notification.MarkRead(uint(id), claims.ID); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "已标记为已读"})
+}
+
+// MarkAllRead 标记所有通知为已读
+func (h *Handlers) MarkAllRead(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	if err := h.Notification.MarkAllRead(claims.ID); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "已全部标记为已读"})
+}
--- a/backend/handler/post.go
+++ b/backend/handler/post.go
@@ -0,0 +1,179 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/freefire/jiang13-bbs/middleware"
+	"github.com/freefire/jiang13-bbs/service"
+	"github.com/gin-gonic/gin"
+)
+
+// Posts 获取帖子列表
+func (h *Handlers) Posts(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+	boardID, _ := strconv.ParseUint(c.Query("board_id"), 10, 64)
+	sort := c.DefaultQuery("sort", "latest")
+	keyword := c.Query("keyword")
+
+	items, total, err := h.Post.List(service.PostListQuery{
+		BoardID: uint(boardID),
+		Page:    page,
+		Size:    size,
+		Sort:    sort,
+		Keyword: keyword,
+	})
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	// 填充点赞状态（仅登录用户）
+	if claims := middleware.CurrentUser(c); claims != nil {
+		ids := make([]uint, 0, len(items))
+		for _, p := range items {
+			ids = append(ids, p.ID)
+		}
+		likedMap := h.Like.BatchHasLiked(ids, claims.ID)
+		for i := range items {
+			items[i].Liked = likedMap[items[i].ID]
+		}
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"posts": items,
+		"total": total,
+		"page":  page,
+		"size":  size,
+	})
+}
+
+// PostDetail 获取帖子详情
+func (h *Handlers) PostDetail(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	post, err := h.Post.GetByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "帖子不存在"})
+		return
+	}
+	// 填充点赞状态（仅登录用户）
+	if claims := middleware.CurrentUser(c); claims != nil {
+		post.Liked = h.Like.HasLiked(post.ID, claims.ID)
+	}
+	c.JSON(http.StatusOK, gin.H{"post": post})
+}
+
+// CreatePostRequest 发帖请求
+type CreatePostRequest struct {
+	BoardID  uint   `json:"board_id" binding:"required"`
+	Title    string `json:"title" binding:"required,min=1,max=256"`
+	Content  string `json:"content" binding:"required,min=1"`
+	Tags     string `json:"tags"`
+	PostType string `json:"post_type"`
+}
+
+// CreatePost 创建帖子
+func (h *Handlers) CreatePost(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	var req CreatePostRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	postType := req.PostType
+	if postType == "" {
+		postType = "normal"
+	}
+	post, err := h.Post.Create(claims.ID, req.BoardID, req.Title, req.Content, req.Tags, postType)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"post": post})
+}
+
+// UpdatePostRequest 更新帖子请求
+type UpdatePostRequest struct {
+	Title   string `json:"title" binding:"omitempty,min=1,max=256"`
+	Content string `json:"content" binding:"omitempty,min=1"`
+	Tags    string `json:"tags"`
+}
+
+// UpdatePost 编辑帖子
+func (h *Handlers) UpdatePost(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	var req UpdatePostRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	post, err := h.Post.Update(uint(id), claims.ID, claims.Role, req.Title, req.Content, req.Tags)
+	if err != nil {
+		c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"post": post})
+}
+
+// DeletePost 删除帖子
+func (h *Handlers) DeletePost(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	if err := h.Post.Delete(uint(id), claims.ID, claims.Role); err != nil {
+		c.JSON(http.StatusForbidden, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "已删除"})
+}
+
+// TogglePin 切换帖子置顶（仅管理员）
+func (h *Handlers) TogglePin(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	if claims.Role != "admin" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "仅管理员可操作"})
+		return
+	}
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	pinned, err := h.Post.TogglePin(uint(id))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"pinned": pinned})
+}
+
+// ToggleRecommend 切换帖子推荐（仅管理员）
+func (h *Handlers) ToggleRecommend(c *gin.Context) {
+	claims := middleware.CurrentUser(c)
+	if claims.Role != "admin" {
+		c.JSON(http.StatusForbidden, gin.H{"error": "仅管理员可操作"})
+		return
+	}
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的帖子 ID"})
+		return
+	}
+	recommended, err := h.Post.ToggleRecommend(uint(id))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"recommended": recommended})
+}
--- a/backend/handler/seo.go
+++ b/backend/handler/seo.go
@@ -0,0 +1,79 @@
+package handler
+
+import (
+	"encoding/xml"
+	"fmt"
+	"net/http"
+	"time"
+
+	"github.com/freefire/jiang13-bbs/model"
+	"github.com/gin-gonic/gin"
+)
+
+const siteBaseURL = "http://localhost:3000"
+
+// RobotsTxt robots.txt
+func (h *Handlers) RobotsTxt(c *gin.Context) {
+	content := fmt.Sprintf(`User-agent: *
+Allow: /
+Sitemap: %s/sitemap.xml
+`, siteBaseURL)
+	c.String(http.StatusOK, content)
+}
+
+// SitemapXML 生成 sitemap
+func (h *Handlers) SitemapXML(c *gin.Context) {
+	type urlEntry struct {
+		Loc        string `xml:"loc"`
+		Lastmod    string `xml:"lastmod"`
+		Changefreq string `xml:"changefreq"`
+		Priority   string `xml:"priority"`
+	}
+	type urlset struct {
+		XMLName xml.Name   `xml:"urlset"`
+		Xmlns   string     `xml:"xmlns,attr"`
+		URLs    []urlEntry `xml:"url"`
+	}
+
+	now := time.Now().Format("2006-01-02")
+	entries := []urlEntry{
+		{Loc: siteBaseURL + "/", Lastmod: now, Changefreq: "daily", Priority: "1.0"},
+	}
+
+	// 板块页
+	var boards []model.Board
+	model.DB.Find(&boards)
+	for _, b := range boards {
+		entries = append(entries, urlEntry{
+			Loc:        fmt.Sprintf("%s/board/%d", siteBaseURL, b.ID),
+			Lastmod:    now,
+			Changefreq: "daily",
+			Priority:   "0.8",
+		})
+	}
+
+	// 帖子详情页
+	var posts []model.Post
+	model.DB.Where("status = ?", model.ContentStatusPublished).
+		Order("created_at DESC").Limit(1000).Find(&posts)
+	for _, p := range posts {
+		entries = append(entries, urlEntry{
+			Loc:        fmt.Sprintf("%s/post/%d", siteBaseURL, p.ID),
+			Lastmod:    p.UpdatedAt.Format("2006-01-02"),
+			Changefreq: "weekly",
+			Priority:   "0.6",
+		})
+	}
+
+	us := urlset{
+		Xmlns: "http://www.sitemaps.org/schemas/sitemap/0.9",
+		URLs:  entries,
+	}
+	output, err := xml.MarshalIndent(us, "", "  ")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.Header("Content-Type", "application/xml")
+	c.String(http.StatusOK, xml.Header+string(output))
+}
--- a/backend/handler/user.go
+++ b/backend/handler/user.go
@@ -0,0 +1,96 @@
+package handler
+
+import (
+	"net/http"
+	"strconv"
+
+	"github.com/freefire/jiang13-bbs/middleware"
+	"github.com/gin-gonic/gin"
+)
+
+// UserProfile 获取用户资料：基本信息 + 统计 + 发帖列表（分页）
+func (h *Handlers) UserProfile(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的用户 ID"})
+		return
+	}
+
+	user, err := h.Auth.GetUserByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "用户不存在"})
+		return
+	}
+
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+
+	posts, postsTotal, err := h.Post.ListByUser(user.ID, page, size)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	// 填充点赞状态（仅登录用户）
+	if claims := middleware.CurrentUser(c); claims != nil {
+		ids := make([]uint, 0, len(posts))
+		for _, p := range posts {
+			ids = append(ids, p.ID)
+		}
+		likedMap := h.Like.BatchHasLiked(ids, claims.ID)
+		for i := range posts {
+			posts[i].Liked = likedMap[posts[i].ID]
+		}
+	}
+
+	postCount, _ := h.Post.CountByUser(user.ID)
+	commentCount, _ := h.Comment.CountByUser(user.ID)
+
+	c.JSON(http.StatusOK, gin.H{
+		"user": gin.H{
+			"id":         user.ID,
+			"username":   user.Username,
+			"nickname":   user.Nickname,
+			"avatar":     user.Avatar,
+			"role":       user.Role,
+			"created_at": user.CreatedAt,
+		},
+		"stats": gin.H{
+			"post_count":    postCount,
+			"comment_count": commentCount,
+		},
+		"posts":       posts,
+		"posts_total": postsTotal,
+		"page":        page,
+		"size":        size,
+	})
+}
+
+// UserComments 获取用户发表的评论列表（分页，含帖子标题）
+func (h *Handlers) UserComments(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "无效的用户 ID"})
+		return
+	}
+	// 校验用户存在
+	if _, err := h.Auth.GetUserByID(uint(id)); err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "用户不存在"})
+		return
+	}
+
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	size, _ := strconv.Atoi(c.DefaultQuery("size", "20"))
+
+	comments, total, err := h.Comment.ListByUser(uint(id), page, size)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"comments": comments,
+		"total":    total,
+		"page":     page,
+		"size":     size,
+	})
+}