首次提交：姜十三论坛

后端 Go+Gin：认证/CSRF/限流、板块、帖子、评论、点赞、通知、用户资料、置顶推荐；前端 Next.js 16：发帖/编辑/删除、搜索、分页、点赞、通知中心、设置；基础设施 docker-compose 与配置模板；添加 .gitignore 与专有许可证（保留所有权利）

backend/middleware/auth.go

@@ -0,0 +1,100 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"github.com/freefire/jiang13-bbs/service"
+	"github.com/gin-gonic/gin"
+)
+
+// AuthMiddleware 认证中间件
+type AuthMiddleware struct {
+	auth *service.AuthService
+}
+
+func NewAuthMiddleware(auth *service.AuthService) *AuthMiddleware {
+	return &AuthMiddleware{auth: auth}
+}
+
+// OptionalAuth 可选登录：解析 token，失败不阻断
+func (m *AuthMiddleware) OptionalAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		user, ok := m.parseToken(c)
+		if ok {
+			c.Set("user", user)
+		}
+		c.Next()
+	}
+}
+
+// RequireAuth 必须登录
+func (m *AuthMiddleware) RequireAuth() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		user, ok := m.parseToken(c)
+		if !ok {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "未登录"})
+			return
+		}
+		if user.Banned {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "账号已被封禁"})
+			return
+		}
+		c.Set("user", user)
+		c.Next()
+	}
+}
+
+// RequireAdmin 必须管理员
+func (m *AuthMiddleware) RequireAdmin() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		user, ok := m.parseToken(c)
+		if !ok {
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "未登录"})
+			return
+		}
+		if user.Role != service.RoleAdmin {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "需要管理员权限"})
+			return
+		}
+		c.Set("user", user)
+		c.Next()
+	}
+}
+
+// parseToken 解析并校验 token：
+// 1. 优先从 HttpOnly cookie 读取，回退 Authorization header
+// 2. 校验 JWT 签名和过期
+// 3. 查 DB 实时校验 token_version 和 banned 状态
+func (m *AuthMiddleware) parseToken(c *gin.Context) (*service.UserClaims, bool) {
+	tokenStr, err := c.Cookie(service.CookieName)
+	if err != nil || tokenStr == "" {
+		auth := c.GetHeader("Authorization")
+		if auth == "" {
+			return nil, false
+		}
+		tokenStr = strings.TrimPrefix(auth, "Bearer ")
+		if tokenStr == auth {
+			return nil, false
+		}
+	}
+	claims, err := m.auth.ParseToken(tokenStr)
+	if err != nil {
+		return nil, false
+	}
+	// 实时校验：token_version 匹配 + 未封禁（防止旧 JWT 在封禁/改密码后仍有效）
+	if _, err := m.auth.ValidateClaims(claims); err != nil {
+		return nil, false
+	}
+	return claims, true
+}
+
+// CurrentUser 从 context 获取当前用户
+func CurrentUser(c *gin.Context) *service.UserClaims {
+	if v, ok := c.Get("user"); ok {
+		if u, ok := v.(*service.UserClaims); ok {
+			return u
+		}
+	}
+	return nil
+}

backend/middleware/csrf.go

@@ -0,0 +1,34 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/freefire/jiang13-bbs/service"
+	"github.com/gin-gonic/gin"
+)
+
+// CSRFMiddleware CSRF 防护中间件
+// 对 POST/PUT/DELETE 等状态变更请求，校验 X-CSRF-Token header 与 cookie 中的 CSRF token 是否一致
+func CSRFMiddleware() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// 仅对状态变更方法校验
+		if c.Request.Method == http.MethodGet || c.Request.Method == http.MethodHead || c.Request.Method == http.MethodOptions {
+			c.Next()
+			return
+		}
+
+		cookieToken, err := c.Cookie(service.CSRFCookieName)
+		if err != nil || cookieToken == "" {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "CSRF token 缺失"})
+			return
+		}
+
+		headerToken := c.GetHeader(service.CSRFHeaderName)
+		if headerToken == "" || headerToken != cookieToken {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "CSRF 校验失败"})
+			return
+		}
+
+		c.Next()
+	}
+}

backend/middleware/ratelimit.go

@@ -0,0 +1,20 @@
+package middleware
+
+import (
+	"net/http"
+
+	"github.com/freefire/jiang13-bbs/service"
+	"github.com/gin-gonic/gin"
+)
+
+// RateLimitMiddleware 速率限制中间件
+func RateLimitMiddleware(rl *service.RateLimiter, rateType string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		key := rateType + ":" + c.ClientIP()
+		if !rl.Allow(key) {
+			c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"error": "请求过于频繁，请稍后再试"})
+			return
+		}
+		c.Next()
+	}
+}

backend/middleware/security.go

@@ -0,0 +1,43 @@
+package middleware
+
+import (
+	"github.com/gin-gonic/gin"
+)
+
+// SecurityHeaders 安全响应头中间件
+// 为所有响应添加安全头，降低 XSS、点击劫持、MIME 嗅探等风险
+func SecurityHeaders() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		// CSP：限制资源加载来源，降低 XSS 危害
+		c.Header("Content-Security-Policy",
+			"default-src 'self'; "+
+				"script-src 'self' 'unsafe-inline'; "+
+				"style-src 'self' 'unsafe-inline'; "+
+				"img-src 'self' data: https:; "+
+				"font-src 'self' data:; "+
+				"connect-src 'self'; "+
+				"frame-ancestors 'none'; "+
+				"base-uri 'self'; "+
+				"form-action 'self'")
+
+		// HSTS：强制 HTTPS（生产环境生效，dev 模式浏览器会忽略）
+		c.Header("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
+
+		// 点击劫持防护
+		c.Header("X-Frame-Options", "DENY")
+
+		// MIME 嗅探防护
+		c.Header("X-Content-Type-Options", "nosniff")
+
+		// 控制 Referer 信息泄露
+		c.Header("Referrer-Policy", "strict-origin-when-cross-origin")
+
+		// XSS 防护（旧浏览器兼容，现代浏览器靠 CSP）
+		c.Header("X-XSS-Protection", "1; mode=block")
+
+		// 禁止浏览器缓存敏感页面（可按需覆盖）
+		// c.Header("Cache-Control", "no-store, no-cache, must-revalidate, max-age=0")
+
+		c.Next()
+	}
+}