看图
正文
`}, + &legacyPostRow{ID: 102, BoardID: 10, UserID: 3, Title: "草稿帖", Status: "draft", PostType: "normal", Content: `草稿
`}, + &legacyPostRow{ID: 103, BoardID: 10, UserID: 1, Title: "投票帖", Status: "published", PostType: "poll", Content: `投票
`}, + &legacyPostRow{ID: 104, BoardID: 10, UserID: 4, Title: "缺图帖", Status: "published", PostType: "normal", + Content: `缺图
补一张
顶
`}, + &legacyCommentRow{ID: 202, PostID: 101, UserID: 1, Status: "published", Content: `前排
`}, + } + for _, row := range seed { + if err := oldDB.Create(row).Error; err != nil { + t.Fatalf("seed old db: %v", err) + } + } + // seed 完成即释放句柄，避免 TempDir 清理时文件被占用 + if sqlDB, err := oldDB.DB(); err == nil { + _ = sqlDB.Close() + } + + avatarZip := filepath.Join(tmp, "avatars.zip") + writeTestZip(t, avatarZip, map[string]string{"a1.jpg": "fake-avatar"}) + imagesZip := filepath.Join(tmp, "images.zip") + writeTestZip(t, imagesZip, map[string]string{"img1.jpg": "fake-image"}) + + svc := NewLegacyImportService(newDB, filepath.Join(tmp, "uploads")) + // 入厅钩子桩：生产为 PostgreSQL，ChatService.EnsureDefaultMembership 里的 + // GREATEST 表达式 SQLite 不支持，故用等价桩验证「建号即触发钩子」的接线 + hallMembers := map[uint]bool{} + svc.WithHallMembership(func(id uint) error { + hallMembers[id] = true + return nil + }) + return svc, oldPath, avatarZip, imagesZip, admin.ID, hallMembers +} + +func writeTestZip(t *testing.T, path string, files map[string]string) { + t.Helper() + f, err := os.Create(path) + if err != nil { + t.Fatalf("create zip: %v", err) + } + w := zip.NewWriter(f) + for name, content := range files { + fw, err := w.Create(name) + if err != nil { + t.Fatalf("zip entry: %v", err) + } + if _, err := fw.Write([]byte(content)); err != nil { + t.Fatalf("zip write: %v", err) + } + } + if err := w.Close(); err != nil { + t.Fatalf("zip close: %v", err) + } + if err := f.Close(); err != nil { + t.Fatalf("zip file close: %v", err) + } +} + +func TestLegacyImportPreviewLists(t *testing.T) { + svc, oldPath, avatarZip, imagesZip, _, _ := newLegacyTestEnv(t) + rep, err := svc.ImportFromFiles(oldPath, avatarZip, imagesZip, LegacyImportOptions{WithContent: true, DryRun: true}, 1) + if err != nil { + t.Fatalf("dry run: %v", err) + } + if len(rep.UserList) != 4 || len(rep.PostList) != 5 || len(rep.CommentList) != 3 { + t.Fatalf("预检清单数量不符: users=%d posts=%d comments=%d", len(rep.UserList), len(rep.PostList), len(rep.CommentList)) + } + if rep.UserList[0].Username != "alice" || !rep.UserList[0].HasAvatar { + t.Fatal("alice 预检项不符") + } + // 将导入：#100/#101/#104（草稿、投票排除） + if rep.Posts.Imported != 3 || rep.Posts.PollsSkipped != 1 { + t.Fatalf("预检帖子统计不符: %+v", rep.Posts) + } + // dry-run 不落盘 + if _, err := os.Stat(filepath.Join(svc.uploadsDir, "images", "img1.jpg")); !os.IsNotExist(err) { + t.Fatal("预检不应写文件") + } +} + +func TestLegacyImportSelectiveRun(t *testing.T) { + svc, oldPath, avatarZip, imagesZip, adminID, hallMembers := newLegacyTestEnv(t) + opts := LegacyImportOptions{ + WithContent: true, + SkipUserIDs: map[uint]bool{2: true, 3: true}, // bob / carol 不建号 + UserTargetNames: map[uint]string{2: "admin"}, // bob 的内容归到已有账号 admin + SkipCommentIDs: map[uint]bool{202: true}, // 排除 alice 在 #101 的评论 + } + rep, err := svc.ImportFromFiles(oldPath, avatarZip, imagesZip, opts, adminID) + if err != nil { + t.Fatalf("import: %v", err) + } + + // 用户：alice / dave 建号，bob / carol 排除 + if rep.Users.Imported != 2 || rep.Users.Excluded != 2 { + t.Fatalf("用户统计不符: %+v", rep.Users) + } + // 帖子：#100/#101/#104 导入，#102 草稿跳过，#103 投票 + if rep.Posts.Imported != 3 || rep.Posts.Excluded != 0 || rep.Posts.PollsSkipped != 1 { + t.Fatalf("帖子统计不符: %+v", rep.Posts) + } + // 评论：#200/#201 导入，#202 排除 + if rep.Comments.Imported != 2 || rep.Comments.Excluded != 1 { + t.Fatalf("评论统计不符: %+v", rep.Comments) + } + // 图片：#100 与 #200 各引用 img1.jpg，只落盘一次 + if rep.Posts.ImagesWritten != 1 || len(rep.Comments.ImagesMissing) != 0 { + t.Fatalf("图片统计不符: posts=%+v comments=%+v", rep.Posts.ImagesWritten, rep.Comments.ImagesMissing) + } + if len(rep.Posts.ImagesMissing) != 1 || rep.Posts.ImagesMissing[0] != "missing.jpg" { + t.Fatalf("缺失图片应记录: %v", rep.Posts.ImagesMissing) + } + + // 内容归属 + var post100, post101 model.Post + if err := svc.db.Where("title = ?", "看图帖").First(&post100).Error; err != nil { + t.Fatalf("post100: %v", err) + } + if err := svc.db.Where("title = ?", "普通帖").First(&post101).Error; err != nil { + t.Fatalf("post101: %v", err) + } + var alice model.User + if err := svc.db.Where("username = ?", "alice").First(&alice).Error; err != nil { + t.Fatalf("alice: %v", err) + } + if post100.UserID != alice.ID { + t.Fatalf("#100 应归 alice: got %d", post100.UserID) + } + if post101.UserID != adminID { + t.Fatalf("#101 应按 user_map 归 admin: got %d", post101.UserID) + } + + // bob 的评论 #200 也归 admin；carol 的评论 #201 兜底归 admin + var cm200, cm201 model.Comment + if err := svc.db.Where("content LIKE ?", "%补一张%").First(&cm200).Error; err != nil { + t.Fatalf("cm200: %v", err) + } + if err := svc.db.Where("content LIKE ?", "%顶%").First(&cm201).Error; err != nil { + t.Fatalf("cm201: %v", err) + } + if cm200.UserID != adminID || cm201.UserID != adminID { + t.Fatalf("评论归属不符: cm200=%d cm201=%d", cm200.UserID, cm201.UserID) + } + + // 图片 URL 改写 + 文件落盘 + if !strings.Contains(post100.Content, legacyImagePrefix+"img1.jpg") || strings.Contains(post100.Content, legacyPostImagePrefix) { + t.Fatalf("#100 图片 URL 未改写: %s", post100.Content) + } + if !strings.Contains(cm200.Content, legacyImagePrefix+"img1.jpg") || strings.Contains(cm200.Content, "old.example.com") { + t.Fatalf("#200 图片 URL 未改写: %s", cm200.Content) + } + // 缺图帖：包内缺失的引用保留原链接，不改写 + p104 := post104Content(t, svc) + if !strings.Contains(p104, legacyPostImagePrefix+"missing.jpg") || strings.Contains(p104, legacyImagePrefix) { + t.Fatalf("缺图引用应保留原链接: %s", p104) + } + if _, err := os.Stat(filepath.Join(svc.uploadsDir, "images", "img1.jpg")); err != nil { + t.Fatalf("img1.jpg 未落盘: %v", err) + } + if _, err := os.Stat(filepath.Join(svc.uploadsDir, "avatars", "a1.jpg")); err != nil { + t.Fatalf("头像未落盘: %v", err) + } + + // 导入建号的用户触发入厅钩子；被排除建号的 bob/carol 不触发 + var dave model.User + if err := svc.db.Where("username = ?", "dave").First(&dave).Error; err != nil { + t.Fatalf("dave: %v", err) + } + if len(hallMembers) != 2 || !hallMembers[alice.ID] || !hallMembers[dave.ID] { + t.Fatalf("入厅钩子应只对 alice/dave 触发: %v", hallMembers) + } + + // 幂等：重复导入全部跳过 + rep2, err := svc.ImportFromFiles(oldPath, avatarZip, imagesZip, opts, adminID) + if err != nil { + t.Fatalf("re-import: %v", err) + } + if rep2.Users.Imported != 0 || rep2.Posts.Imported != 0 || rep2.Comments.Imported != 0 { + t.Fatalf("重复导入应全部跳过: %+v", rep2) + } + if rep2.Users.Excluded != 2 || rep2.Posts.Skipped != 4 || rep2.Comments.Skipped != 2 { + t.Fatalf("重复导入统计不符: users=%+v posts=%+v comments=%+v", rep2.Users, rep2.Posts, rep2.Comments) + } +} + +// TestLegacyImportSkipPostCascades 排除帖子时其评论自动跳过 +func TestLegacyImportSkipPostCascades(t *testing.T) { + svc, oldPath, avatarZip, imagesZip, adminID, _ := newLegacyTestEnv(t) + opts := LegacyImportOptions{ + WithContent: true, + SkipPostIDs: map[uint]bool{101: true}, // #101 排除 → 其评论 #202 自动跳过 + } + rep, err := svc.ImportFromFiles(oldPath, avatarZip, imagesZip, opts, adminID) + if err != nil { + t.Fatalf("import: %v", err) + } + if rep.Posts.Imported != 2 || rep.Posts.Excluded != 1 { + t.Fatalf("帖子统计不符: %+v", rep.Posts) + } + if rep.Comments.Imported != 2 || rep.Comments.Excluded != 1 { + t.Fatalf("评论统计不符（#202 应随 #101 排除）: %+v", rep.Comments) + } + var n int64 + svc.db.Model(&model.Post{}).Where("title = ?", "普通帖").Count(&n) + if n != 0 { + t.Fatal("#101 不应导入") + } +} + +// TestLegacyImportBadTarget 归属目标账号不存在时报错 +func TestLegacyImportBadTarget(t *testing.T) { + svc, oldPath, avatarZip, imagesZip, adminID, _ := newLegacyTestEnv(t) + opts := LegacyImportOptions{WithContent: true, UserTargetNames: map[uint]string{2: "ghost"}} + _, err := svc.ImportFromFiles(oldPath, avatarZip, imagesZip, opts, adminID) + if !errors.Is(err, ErrLegacyBadTarget) { + t.Fatalf("应返回 ErrLegacyBadTarget: %v", err) + } +} + +func post104Content(t *testing.T, svc *LegacyImportService) string { + t.Helper() + var p model.Post + if err := svc.db.Where("title = ?", "缺图帖").First(&p).Error; err != nil { + t.Fatalf("post104: %v", err) + } + return p.Content +} diff --git a/backend/service/login_device.go b/backend/service/login_device.go index 2623471..241a5fc 100644 --- a/backend/service/login_device.go +++ b/backend/service/login_device.go @@ -163,8 +163,10 @@ func (s *AuthService) LookupFamilyByRefreshPlain(plain string, userID uint) uint return sessionFamilyID(rt) } -// TouchDeviceFromRefresh 用当前请求的 IP/UA 校准本会话，并回填尚未写入的 family_id。 -func (s *AuthService) TouchDeviceFromRefresh(plain, ip, ua string, userID uint) uint { +// TouchDeviceFromRefresh 刷新本会话活跃时间，并回填尚未写入的 family_id。 +// 会话的 IP/UA 以登录时记录为准，不随访问端环境漂移， +// 否则设备指纹会跟着请求变，设备列表在 UA 模拟/代理下会来回跳。 +func (s *AuthService) TouchDeviceFromRefresh(plain string, userID uint) uint { if plain == "" { return 0 } @@ -177,12 +179,6 @@ func (s *AuthService) TouchDeviceFromRefresh(plain, ip, ua string, userID uint) } now := time.Now() upd := map[string]any{"last_used_at": now, "updated_at": now} - if v := truncateStr(ip, 45); v != "" { - upd["ip"] = v - } - if v := truncateStr(ua, 500); v != "" { - upd["user_agent"] = v - } fid := sessionFamilyID(rt) if rt.FamilyID == 0 { upd["family_id"] = fid @@ -191,26 +187,29 @@ func (s *AuthService) TouchDeviceFromRefresh(plain, ip, ua string, userID uint) return fid } -// revokeAllSessionsExcept 真·单会话：登录时吊销该用户除新会话外的全部 -// 有效会话（任何新登录都踢掉所有旧设备）；返回吊销行数供上层广播告知。 -func (s *AuthService) revokeAllSessionsExcept(userID, keepFamily uint) int { +// maxActiveSessions 每个用户允许并存的活跃会话（登录设备）上限， +// 与设备列表展示上限 loginDeviceLimit 一致；超出时淘汰最久未使用的会话。 +const maxActiveSessions = 20 + +// enforceSessionCap 会话上限守护：多会话并存下新登录不踢旧设备，仅当该用户 +// 活跃会话超过 maxActiveSessions 时，按 last_used_at 淘汰最旧的会话腾位； +// 返回淘汰行数供上层广播告知（新会话 last_used_at 最新，不会被淘汰）。 +func (s *AuthService) enforceSessionCap(userID uint) int { now := time.Now() var actives []model.RefreshToken - if err := s.db.Select("id", "family_id"). + if err := s.db.Select("id"). Where("user_id = ? AND revoked = ? AND expires_at > ?", userID, false, now). + Order("last_used_at DESC, created_at DESC, id DESC"). Find(&actives).Error; err != nil { return 0 } - ids := make([]uint, 0) - for _, t := range actives { - if sessionFamilyID(t) == keepFamily { - continue - } - ids = append(ids, t.ID) - } - if len(ids) == 0 { + if len(actives) <= maxActiveSessions { return 0 } + ids := make([]uint, 0, len(actives)-maxActiveSessions) + for _, t := range actives[maxActiveSessions:] { + ids = append(ids, t.ID) + } res := s.db.Model(&model.RefreshToken{}).Where("id IN ?", ids). Updates(map[string]any{"revoked": true, "token_cipher": "", "updated_at": now}) if res.Error != nil { diff --git a/backend/service/login_session_test.go b/backend/service/login_session_test.go new file mode 100644 index 0000000..f202a5a --- /dev/null +++ b/backend/service/login_session_test.go @@ -0,0 +1,276 @@ +package service + +import ( + "errors" + "testing" + "time" + + "github.com/freefire/jiang13-bbs/model" + "github.com/glebarez/sqlite" + "golang.org/x/crypto/bcrypt" + "gorm.io/gorm" +) + +func newLoginSessionTestDB(t *testing.T) *gorm.DB { + t.Helper() + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open sqlite: %v", err) + } + if err := db.AutoMigrate(&model.User{}, &model.RefreshToken{}); err != nil { + t.Fatalf("migrate: %v", err) + } + return db +} + +func newLoginSessionUser(t *testing.T, db *gorm.DB, username string) *model.User { + t.Helper() + hashed, err := bcrypt.GenerateFromPassword([]byte("password123"), bcrypt.MinCost) + if err != nil { + t.Fatalf("hash password: %v", err) + } + user := model.User{Username: username, Password: string(hashed)} + if err := db.Create(&user).Error; err != nil { + t.Fatalf("seed user: %v", err) + } + return &user +} + +func countActiveSessions(t *testing.T, db *gorm.DB, userID uint) int64 { + t.Helper() + var n int64 + if err := db.Model(&model.RefreshToken{}). + Where("user_id = ? AND revoked = ? AND expires_at > ?", userID, false, time.Now()). + Count(&n).Error; err != nil { + t.Fatalf("count active sessions: %v", err) + } + return n +} + +// TestLoginMultiSessionCoexist 多会话并存：不同设备先后登录互不顶号， +// 各会话的 access token（family_id）均持续有效。 +func TestLoginMultiSessionCoexist(t *testing.T) { + db := newLoginSessionTestDB(t) + s := NewAuthService(db, "test-secret") + user := newLoginSessionUser(t, db, "alice") + + uas := []string{"Chrome-Windows", "Edge-Windows", "iPhone-Safari"} + families := make([]uint, 0, len(uas)) + for i, ua := range uas { + access, refresh, _, kicked, err := s.Login("alice", "password123", "1.2.3.4", ua) + if err != nil { + t.Fatalf("login #%d: %v", i+1, err) + } + if kicked != 0 { + t.Fatalf("login #%d 不应踢掉旧会话，kicked=%d", i+1, kicked) + } + if _, err := s.ValidateRefreshToken(refresh); err != nil { + t.Fatalf("login #%d refresh 校验失败: %v", i+1, err) + } + claims, err := s.ParseToken(access) + if err != nil { + t.Fatalf("login #%d 解析 access token: %v", i+1, err) + } + if _, err := s.ValidateClaims(claims); err != nil { + t.Fatalf("login #%d 会话应有效: %v", i+1, err) + } + families = append(families, claims.FamilyID) + } + + if n := countActiveSessions(t, db, user.ID); n != int64(len(uas)) { + t.Fatalf("应共存 %d 个活跃会话，实际 %d", len(uas), n) + } + for _, fam := range families { + if !s.familySessionActive(user.ID, fam) { + t.Fatalf("family=%d 会话应仍有效", fam) + } + } +} + +// TestSessionCapEvictsOldest 会话上限守护：活跃会话超过 maxActiveSessions 时， +// 按 last_used_at 淘汰最旧会话，其余会话不受影响。 +func TestSessionCapEvictsOldest(t *testing.T) { + db := newLoginSessionTestDB(t) + s := NewAuthService(db, "test-secret") + user := newLoginSessionUser(t, db, "bob") + + families := make([]uint, 0, maxActiveSessions) + for i := 0; i < maxActiveSessions; i++ { + _, family, kicked, err := s.CreateRefreshToken(user.ID, "1.2.3.4", "device") + if err != nil { + t.Fatalf("create #%d: %v", i+1, err) + } + if kicked != 0 { + t.Fatalf("create #%d 不应淘汰会话，kicked=%d", i+1, kicked) + } + families = append(families, family) + } + // 人为拉开 last_used_at，保证淘汰顺序确定（第 1 个最旧） + base := time.Now().Add(-2 * time.Hour) + for i, fam := range families { + if err := db.Model(&model.RefreshToken{}).Where("family_id = ?", fam). + Update("last_used_at", base.Add(time.Duration(i)*time.Minute)).Error; err != nil { + t.Fatalf("调整 last_used_at: %v", err) + } + } + + _, _, kicked, err := s.CreateRefreshToken(user.ID, "1.2.3.4", "device-new") + if err != nil { + t.Fatalf("create #%d: %v", maxActiveSessions+1, err) + } + if kicked != 1 { + t.Fatalf("超出上限应淘汰 1 个最旧会话，kicked=%d", kicked) + } + if n := countActiveSessions(t, db, user.ID); n != maxActiveSessions { + t.Fatalf("淘汰后应剩 %d 个活跃会话，实际 %d", maxActiveSessions, n) + } + if s.familySessionActive(user.ID, families[0]) { + t.Fatal("最旧会话应已被淘汰") + } + for _, fam := range families[1:] { + if !s.familySessionActive(user.ID, fam) { + t.Fatalf("family=%d 会话不应被淘汰", fam) + } + } +} + +// TestRevokeLoginDeviceWithMultiSessions 多会话下剔除设备：仅目标会话失效， +// 当前会话不受影响（沿用既有剔除语义的回归保障）。 +func TestRevokeLoginDeviceWithMultiSessions(t *testing.T) { + db := newLoginSessionTestDB(t) + s := NewAuthService(db, "test-secret") + user := newLoginSessionUser(t, db, "carol") + + access1, refresh1, _, _, err := s.Login("carol", "password123", "1.1.1.1", "Chrome-Home") + if err != nil { + t.Fatalf("login 1: %v", err) + } + claims1, err := s.ParseToken(access1) + if err != nil { + t.Fatalf("parse access 1: %v", err) + } + family1 := claims1.FamilyID + access2, _, _, _, err := s.Login("carol", "password123", "2.2.2.2", "iPhone-Mobile") + if err != nil { + t.Fatalf("login 2: %v", err) + } + claims2, err := s.ParseToken(access2) + if err != nil { + t.Fatalf("parse access 2: %v", err) + } + family2 := claims2.FamilyID + + devices, err := s.ListLoginDevices(user.ID, family1, "1.1.1.1", "Chrome-Home") + if err != nil { + t.Fatalf("list devices: %v", err) + } + if len(devices) != 2 { + t.Fatalf("应列出 2 台设备，实际 %d", len(devices)) + } + var targetID uint + for _, d := range devices { + if !d.Current { + targetID = d.ID + } + } + if targetID == 0 { + t.Fatal("未找到非当前设备") + } + if err := s.RevokeLoginDevice(user.ID, family1, targetID); err != nil { + t.Fatalf("revoke device: %v", err) + } + + if s.familySessionActive(user.ID, family2) { + t.Fatal("被剔除设备的会话应已失效") + } + if _, err := s.ValidateRefreshToken(refresh1); err != nil { + t.Fatalf("当前设备会话不应受影响: %v", err) + } +} + +// TestRefreshReuseRevokesFamilyOnly 宽限期外的重放判定盗用时，仅吊销该轮转链 +// 所在家族，不牵连同用户其他登录设备（此前误撤全用户会话：开发期 middleware +// /浏览器丢轮换的竞态会把 Chrome 等所有设备一齐踢下线）。 +func TestRefreshReuseRevokesFamilyOnly(t *testing.T) { + db := newLoginSessionTestDB(t) + s := NewAuthService(db, "test-secret") + user := newLoginSessionUser(t, db, "dave") + + access1, refresh1, _, _, err := s.Login("dave", "password123", "1.1.1.1", "Chrome-Home") + if err != nil { + t.Fatalf("login 1: %v", err) + } + claims1, err := s.ParseToken(access1) + if err != nil { + t.Fatalf("parse access 1: %v", err) + } + access2, refresh2, _, _, err := s.Login("dave", "password123", "2.2.2.2", "iPhone-Mobile") + if err != nil { + t.Fatalf("login 2: %v", err) + } + claims2, err := s.ParseToken(access2) + if err != nil { + t.Fatalf("parse access 2: %v", err) + } + + // 家族1 正常轮转一次：旧行吊销并链接到新行 + if _, _, _, err := s.RotateRefreshToken(refresh1, "1.1.1.1", "Chrome-Home"); err != nil { + t.Fatalf("rotate 1: %v", err) + } + + // 把旧行 rotated_at 拨回宽限期之外，模拟「轮换响应丢失后的延迟重放」 + if err := db.Model(&model.RefreshToken{}). + Where("token_hash = ?", hashRefreshToken(refresh1)). + Update("rotated_at", time.Now().Add(-2*time.Minute)).Error; err != nil { + t.Fatalf("backdate rotated_at: %v", err) + } + + // 宽限期外重放：判定盗用，仅家族1 被整体吊销 + if _, _, _, err := s.RotateRefreshToken(refresh1, "1.1.1.1", "Chrome-Home"); !errors.Is(err, ErrRefreshReused) { + t.Fatalf("期望 ErrRefreshReused，实际 %v", err) + } + if s.familySessionActive(user.ID, claims1.FamilyID) { + t.Fatal("重放所在家族应被整体吊销") + } + if !s.familySessionActive(user.ID, claims2.FamilyID) { + t.Fatal("其他登录设备（家族）不应被牵连") + } + if n := countActiveSessions(t, db, user.ID); n != 1 { + t.Fatalf("应仅剩家族2 的 1 个活跃会话，实际 %d", n) + } + if _, err := s.ValidateRefreshToken(refresh2); err != nil { + t.Fatalf("其他设备的 refresh 不应受影响: %v", err) + } +} + +// TestRefreshReuseDevGraceReturnsSamePair dev 模式宽限期放宽：轮换后远超 +// 生产宽限窗的同链重放（dev 重启丢响应的常态）仍返回同一对，不升级为盗用判定。 +func TestRefreshReuseDevGraceReturnsSamePair(t *testing.T) { + db := newLoginSessionTestDB(t) + s := NewAuthService(db, "test-secret").WithDevMode(true) + newLoginSessionUser(t, db, "eve") + + _, refresh1, _, _, err := s.Login("eve", "password123", "1.1.1.1", "Chrome-Home") + if err != nil { + t.Fatalf("login: %v", err) + } + _, newRefresh, _, err := s.RotateRefreshToken(refresh1, "1.1.1.1", "Chrome-Home") + if err != nil { + t.Fatalf("rotate: %v", err) + } + + // rotated_at 拨回生产宽限期之外（仍在 dev 宽限内） + if err := db.Model(&model.RefreshToken{}). + Where("token_hash = ?", hashRefreshToken(refresh1)). + Update("rotated_at", time.Now().Add(-2*time.Minute)).Error; err != nil { + t.Fatalf("backdate rotated_at: %v", err) + } + + _, replayRefresh, _, err := s.RotateRefreshToken(refresh1, "1.1.1.1", "Chrome-Home") + if err != nil { + t.Fatalf("dev 宽限期内重放不应报错: %v", err) + } + if replayRefresh != newRefresh { + t.Fatal("dev 宽限期内重放应返回同一对新 token") + } +} diff --git a/backend/service/media_library.go b/backend/service/media_library.go new file mode 100644 index 0000000..a3d24ac --- /dev/null +++ b/backend/service/media_library.go @@ -0,0 +1,388 @@ +package service + +import ( + "fmt" + "os" + "path/filepath" + "sort" + "strings" + "time" + + "github.com/freefire/jiang13-bbs/model" +) + +// 媒体库（管理后台）：盘点站点内全部图片资源。 +// 数据源 = uploads 五个分类目录的磁盘扫描 + attachments 表元数据合并： +// - 旧站导入图 / 背景图 / 广告素材 / 品牌 Logo 落盘但无附件记录，只有磁盘扫描能覆盖 +// - 附件记录（头像、帖子插图）补充上传者、创建时间等元数据；远程存储对象（/api/media/）仅存在于库中 +// 同名（去扩展名）同时存在原图与 WebP 时只展示 WebP，原图 URL 挂在 OriginalURL 供查看。 + +// 媒体库分类：目录名即分类键，前端 tab 直接使用 +var mediaLibraryCategories = []struct { + Key string // 分类键（image/avatar/background/ads/brand） + Dir string // uploads 下的子目录 + Name string // 展示名 +}{ + {"image", "images", "帖子插图"}, + {"avatar", "avatars", "用户头像"}, + {"background", "backgrounds", "站点背景"}, + {"ads", "ads", "广告素材"}, + {"brand", "brand", "品牌资源"}, +} + +// MediaLibraryItem 媒体库条目 +type MediaLibraryItem struct { + URL string `json:"url"` // 展示地址（有 WebP 时为 WebP） + OriginalURL string `json:"original_url,omitempty"` // 同名原图（仅当原图与 WebP 并存） + Category string `json:"category"` // image/avatar/background/ads/brand + CategoryName string `json:"category_name"` + Name string `json:"name"` // 文件名（含扩展名） + MIME string `json:"mime"` + Size int64 `json:"size"` + Width int `json:"width"` + Height int `json:"height"` + Uploader string `json:"uploader,omitempty"` // 上传者昵称（取自附件记录，无记录为空） + UploadedAt *time.Time `json:"uploaded_at,omitempty"` + SourceURL string `json:"source_url,omitempty"` // 来源回链（帖子/评论锚点/用户主页） + SourceLabel string `json:"source_label,omitempty"` // 来源描述（如：帖子《…》下的评论） +} + +// AdminMediaLibrary 全站图片盘点：磁盘扫描 + 附件元数据合并，按时间倒序。 +// 返回条目列表与各分类计数（含全部计数由前端按列表累加）。 +func (s *UploadService) AdminMediaLibrary() ([]MediaLibraryItem, map[string]int, error) { + // 附件元数据索引：URL → 记录（联出上传者昵称） + type attMeta struct { + Kind string + URL string + MIME string + Size int + Width int + Height int + Nickname string + Username string + CreatedAt time.Time + } + var rows []attMeta + if err := s.db.Table("attachments"). + Select("attachments.kind, attachments.url, attachments.mime, attachments.size, attachments.width, attachments.height, attachments.created_at, users.nickname, users.username"). + Joins("LEFT JOIN users ON users.id = attachments.user_id"). + Scan(&rows).Error; err != nil { + return nil, nil, err + } + metaByURL := make(map[string]attMeta, len(rows)) + // 远程存储对象（/api/media/）不在磁盘上，直接作为条目加入 + items := make([]MediaLibraryItem, 0, len(rows)) + categoryName := func(key string) string { + for _, cat := range mediaLibraryCategories { + if cat.Key == key { + return cat.Name + } + } + return key + } + for _, r := range rows { + metaByURL[r.URL] = r // 本地文件在磁盘扫描时按 URL 合并元数据 + if !strings.HasPrefix(r.URL, "/api/media/") { + continue + } + uploader := r.Nickname + if uploader == "" { + uploader = r.Username + } + cat := r.Kind + if cat != model.AttachmentKindImage && cat != model.AttachmentKindAvatar { + continue // 未知 kind 不进媒体库 + } + ca := r.CreatedAt + items = append(items, MediaLibraryItem{ + URL: r.URL, Category: cat, CategoryName: categoryName(cat), + Name: strings.TrimPrefix(r.URL, "/api/media/"), MIME: r.MIME, + Size: int64(r.Size), Width: r.Width, Height: r.Height, + Uploader: uploader, UploadedAt: &ca, + }) + } + + // 磁盘扫描五类目录；同名（去扩展名）成组，WebP 优先展示、原图挂 OriginalURL + type group struct { + webp *MediaLibraryItem + original *MediaLibraryItem + } + for _, cat := range mediaLibraryCategories { + dir := filepath.Join(s.dir, cat.Dir) + entries, err := os.ReadDir(dir) + if err != nil { + continue // 目录不存在视为空 + } + groups := map[string]*group{} + for _, e := range entries { + if e.IsDir() || strings.HasSuffix(e.Name(), ".partial") { + continue + } + ext := strings.ToLower(filepath.Ext(e.Name())) + switch ext { + case ".jpg", ".jpeg", ".png", ".webp", ".gif": + default: + continue + } + url := "/uploads/" + cat.Dir + "/" + e.Name() + item := MediaLibraryItem{ + URL: url, Category: cat.Key, CategoryName: cat.Name, + Name: e.Name(), + MIME: map[string]string{ + ".jpg": "image/jpeg", ".jpeg": "image/jpeg", ".png": "image/png", + ".webp": "image/webp", ".gif": "image/gif", + }[ext], + } + if info, err := e.Info(); err == nil { + item.Size = info.Size() + mt := info.ModTime() + item.UploadedAt = &mt + } + if m, ok := metaByURL[url]; ok { + // 附件记录有上传者与准确创建时间，覆盖磁盘信息 + uploader := m.Nickname + if uploader == "" { + uploader = m.Username + } + ca := m.CreatedAt + item.Uploader = uploader + item.UploadedAt = &ca + if m.Size > 0 { + item.Size = int64(m.Size) + } + if m.Width > 0 { + item.Width, item.Height = m.Width, m.Height + } + } + // 无尺寸记录时读图片头解析宽高（失败不阻断，保持 0） + if item.Width == 0 && item.Size > 0 && item.Size <= 20<<20 { + if f, err := os.Open(filepath.Join(dir, e.Name())); err == nil { + w, h, derr := decodeImageSizeReader(f, item.MIME) + _ = f.Close() + if derr == nil { + item.Width, item.Height = w, h + } + } + } + stem := strings.TrimSuffix(e.Name(), filepath.Ext(e.Name())) + g := groups[stem] + if g == nil { + g = &group{} + groups[stem] = g + } + if ext == ".webp" { + g.webp = &item + } else if g.original == nil { + g.original = &item + } + } + for _, g := range groups { + switch { + case g.webp != nil && g.original != nil: + // 原图与 WebP 并存：只展示 WebP，原图作 original_url + g.webp.OriginalURL = g.original.URL + if g.webp.Size == 0 { + g.webp.Size = g.original.Size + } + items = append(items, *g.webp) + case g.webp != nil: + items = append(items, *g.webp) + default: + items = append(items, *g.original) + } + } + } + + sort.Slice(items, func(i, j int) bool { + ti, tj := items[i].UploadedAt, items[j].UploadedAt + switch { + case ti == nil && tj == nil: + return items[i].URL < items[j].URL + case ti == nil: + return false + case tj == nil: + return true + } + return ti.After(*tj) + }) + + counts := map[string]int{} + for _, it := range items { + counts[it.Category]++ + } + s.attachMediaSources(items) + return items, counts, nil +} + +// attachMediaSources 为条目补来源回链： +// - 头像：users.avatar 精确匹配 → 用户主页 +// - 其余：分块 LIKE 扫描帖子/评论正文（展示 URL 与同名原图都参与匹配），帖子优先于评论 +// +// 内容 LIKE 无索引，纯顺序扫描，但仅管理端低频调用；分块 OR 控制往返次数。 +func (s *UploadService) attachMediaSources(items []MediaLibraryItem) { + urlSet := map[string]bool{} + for _, it := range items { + for _, u := range []string{it.URL, it.OriginalURL} { + if strings.HasPrefix(u, "/uploads/") { + urlSet[u] = true + } + } + } + if len(urlSet) == 0 { + return + } + urls := make([]string, 0, len(urlSet)) + for u := range urlSet { + urls = append(urls, u) + } + + type postRef struct { + id uint + title string + } + postByURL := map[string]postRef{} + type commentRef struct { + id, postID uint + } + commentByURL := map[string]commentRef{} + + for i := 0; i < len(urls); i += 40 { + end := i + 40 + if end > len(urls) { + end = len(urls) + } + chunk := urls[i:end] + conds := make([]string, len(chunk)) + args := make([]any, len(chunk)) + for j, u := range chunk { + conds[j] = "content LIKE ?" + args[j] = "%" + u + "%" + } + where := strings.Join(conds, " OR ") + + var prows []struct { + ID uint + Title string + Content string + } + if err := s.db.Model(&model.Post{}).Select("id, title, content"). + Where(where, args...).Order("id ASC").Limit(600).Scan(&prows).Error; err != nil { + return + } + for _, p := range prows { + for _, u := range chunk { + if strings.Contains(p.Content, u) { + if _, ok := postByURL[u]; !ok { + postByURL[u] = postRef{id: p.ID, title: p.Title} + } + } + } + } + + var crows []struct { + ID uint + PostID uint + Content string + } + if err := s.db.Model(&model.Comment{}).Select("id, post_id, content"). + Where(where, args...).Order("id ASC").Limit(600).Scan(&crows).Error; err != nil { + return + } + for _, cm := range crows { + for _, u := range chunk { + if strings.Contains(cm.Content, u) { + if _, ok := commentByURL[u]; !ok { + commentByURL[u] = commentRef{id: cm.ID, postID: cm.PostID} + } + } + } + } + } + + // 评论来源要带宿主帖子标题，一次性补齐 + postTitle := func(id uint) string { + var p model.Post + if err := s.db.Select("id, title").First(&p, id).Error; err != nil { + return "" + } + return p.Title + } + commentPostTitle := map[uint]string{} + for _, cm := range commentByURL { + if _, ok := commentPostTitle[cm.postID]; !ok { + commentPostTitle[cm.postID] = postTitle(cm.postID) + } + } + + // 头像使用者：users.avatar 精确匹配（同一头像多人使用时取最早的用户） + userByAvatar := map[string]struct { + ID uint + Nickname, Username string + }{} + var urows []struct { + ID uint + Nickname string + Username string + Avatar string + } + if err := s.db.Model(&model.User{}).Select("id, nickname, username, avatar"). + Where("avatar IN ?", urls).Order("id ASC").Find(&urows).Error; err == nil { + for _, u := range urows { + if _, ok := userByAvatar[u.Avatar]; !ok { + userByAvatar[u.Avatar] = struct { + ID uint + Nickname, Username string + }{ID: u.ID, Nickname: u.Nickname, Username: u.Username} + } + } + } + + truncate := func(s string, n int) string { + r := []rune(s) + if len(r) <= n { + return s + } + return string(r[:n]) + "…" + } + postLabel := func(p postRef) string { + title := p.title + if title == "" { + title = fmt.Sprintf("#%d", p.id) + } + return "帖子《" + truncate(title, 40) + "》" + } + + for i := range items { + it := &items[i] + // 头像使用者优先（头像正文引用场景极少） + if u, ok := userByAvatar[it.URL]; ok { + name := u.Nickname + if name == "" { + name = u.Username + } + it.SourceURL = fmt.Sprintf("/u/%d", u.ID) + it.SourceLabel = "@" + name + " 的头像" + continue + } + for _, u := range []string{it.URL, it.OriginalURL} { + if u == "" || it.SourceURL != "" { + continue + } + if p, ok := postByURL[u]; ok { + it.SourceURL = fmt.Sprintf("/post/%d", p.id) + it.SourceLabel = postLabel(p) + break + } + if cm, ok := commentByURL[u]; ok { + it.SourceURL = fmt.Sprintf("/post/%d#comment-%d", cm.postID, cm.id) + title := commentPostTitle[cm.postID] + if title != "" { + it.SourceLabel = "帖子《" + truncate(title, 40) + "》下的评论" + } else { + it.SourceLabel = "帖子评论" + } + break + } + } + } +} diff --git a/backend/service/media_library_test.go b/backend/service/media_library_test.go new file mode 100644 index 0000000..535a8b7 --- /dev/null +++ b/backend/service/media_library_test.go @@ -0,0 +1,312 @@ +package service + +import ( + "bytes" + "fmt" + "image" + "image/color" + "image/png" + "os" + "path/filepath" + "strings" + "testing" + "time" + + xwebp "golang.org/x/image/webp" + + "github.com/freefire/jiang13-bbs/model" + "github.com/glebarez/sqlite" + "gorm.io/gorm" +) + +func newMediaLibraryService(t *testing.T) (*UploadService, string) { + t.Helper() + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open sqlite: %v", err) + } + if err := db.AutoMigrate(&model.Attachment{}, &model.User{}, &model.Post{}, &model.Comment{}); err != nil { + t.Fatalf("migrate: %v", err) + } + dir := t.TempDir() + s := NewUploadService(db, dir) + if err := s.EnsureDir(); err != nil { + t.Fatalf("ensure dir: %v", err) + } + return s, dir +} + +func writeMediaFile(t *testing.T, dir, rel string, data []byte) { + t.Helper() + full := filepath.Join(dir, filepath.FromSlash(rel)) + if err := os.MkdirAll(filepath.Dir(full), 0o755); err != nil { + t.Fatalf("mkdir: %v", err) + } + if err := os.WriteFile(full, data, 0o644); err != nil { + t.Fatalf("write %s: %v", rel, err) + } +} + +func tinyPNG() []byte { + src := image.NewRGBA(image.Rect(0, 0, 12, 8)) + src.Set(0, 0, color.RGBA{1, 2, 3, 255}) + var buf bytes.Buffer + _ = png.Encode(&buf, src) + return buf.Bytes() +} + +func TestAdminMediaLibraryWebpPreferredWithOriginalURL(t *testing.T) { + s, dir := newMediaLibraryService(t) + + writeMediaFile(t, dir, "images/pair.jpg", []byte("fake-jpeg-bytes")) + writeMediaFile(t, dir, "images/pair.webp", []byte("fake-webp-bytes")) + writeMediaFile(t, dir, "images/solo.png", tinyPNG()) + writeMediaFile(t, dir, "images/trash.txt", []byte("not an image")) + writeMediaFile(t, dir, "images/partial.jpg.partial", []byte("temp")) + writeMediaFile(t, dir, "ads/qr.gif", []byte("GIF89a-fake")) + + items, counts, err := s.AdminMediaLibrary() + if err != nil { + t.Fatalf("AdminMediaLibrary: %v", err) + } + byURL := map[string]MediaLibraryItem{} + for _, it := range items { + byURL[it.URL] = it + } + + // 同名原图 + WebP 并存：只出 WebP 条目，原图挂 original_url + pair, ok := byURL["/uploads/images/pair.webp"] + if !ok { + t.Fatalf("pair.webp missing; items=%v", items) + } + if pair.OriginalURL != "/uploads/images/pair.jpg" { + t.Fatalf("want original pair.jpg, got %q", pair.OriginalURL) + } + if _, exists := byURL["/uploads/images/pair.jpg"]; exists { + t.Fatal("pair.jpg should be hidden behind webp") + } + + // 无配对的单文件：保留原格式并解析出宽高 + solo, ok := byURL["/uploads/images/solo.png"] + if !ok { + t.Fatal("solo.png missing") + } + if solo.MIME != "image/png" || solo.Width != 12 || solo.Height != 8 { + t.Fatalf("solo.png meta wrong: %+v", solo) + } + + // 非图片与 .partial 被过滤 + if _, exists := byURL["/uploads/images/trash.txt"]; exists { + t.Fatal("trash.txt should be excluded") + } + if _, exists := byURL["/uploads/images/partial.jpg.partial"]; exists { + t.Fatal(".partial should be excluded") + } + + // 广告素材目录计入 ads 分类 + if qr, ok := byURL["/uploads/ads/qr.gif"]; !ok || qr.Category != "ads" { + t.Fatalf("ads/qr.gif missing or wrong category: %+v", qr) + } + + if counts["image"] != 2 || counts["ads"] != 1 { + t.Fatalf("counts wrong: %v", counts) + } +} + +func TestAdminMediaLibraryMergesAttachmentMetaAndRemoteObjects(t *testing.T) { + s, dir := newMediaLibraryService(t) + + // 附件记录引用的磁盘文件必须真实存在，否则该记录会被跳过（见 SkipsLocalMissingFiles） + writeMediaFile(t, dir, "images/abc.webp", []byte("fake-webp-bytes")) + + created := time.Date(2026, 9, 1, 10, 0, 0, 0, time.UTC) + if err := s.db.Create(&model.User{Username: "alice", Nickname: "爱丽丝"}).Error; err != nil { + t.Fatalf("create user: %v", err) + } + var alice model.User + if err := s.db.Where("username = ?", "alice").First(&alice).Error; err != nil { + t.Fatalf("load user: %v", err) + } + if err := s.db.Create(&model.Attachment{ + UserID: alice.ID, Kind: model.AttachmentKindImage, + URL: "/uploads/images/abc.webp", MIME: "image/webp", + Size: 4567, Width: 320, Height: 240, CreatedAt: created, + }).Error; err != nil { + t.Fatalf("create attachment: %v", err) + } + if err := s.db.Create(&model.Attachment{ + UserID: alice.ID, Kind: model.AttachmentKindAvatar, + URL: "/api/media/remote01", MIME: "image/webp", + Size: 999, Width: 128, Height: 128, CreatedAt: created, + }).Error; err != nil { + t.Fatalf("create remote attachment: %v", err) + } + + items, counts, err := s.AdminMediaLibrary() + if err != nil { + t.Fatalf("AdminMediaLibrary: %v", err) + } + byURL := map[string]MediaLibraryItem{} + for _, it := range items { + byURL[it.URL] = it + } + + // 磁盘文件与附件记录合并：元数据以记录为准（上传者/尺寸/创建时间） + disk, ok := byURL["/uploads/images/abc.webp"] + if !ok { + t.Fatalf("attachment-backed local file missing: %+v", items) + } + if disk.Uploader != "爱丽丝" || disk.Size != 4567 || disk.Width != 320 || disk.Height != 240 { + t.Fatalf("meta not merged: %+v", disk) + } + + // 远程存储对象：不在磁盘上也必须出现在媒体库 + remote, ok := byURL["/api/media/remote01"] + if !ok { + t.Fatal("remote object missing") + } + if remote.Category != "avatar" || remote.Uploader != "爱丽丝" { + t.Fatalf("remote meta wrong: %+v", remote) + } + + if counts["avatar"] != 1 { + t.Fatalf("avatar count wrong: %v", counts) + } +} + +func TestAdminMediaLibrarySkipsLocalMissingFiles(t *testing.T) { + s, _ := newMediaLibraryService(t) + + if err := s.db.Create(&model.Attachment{ + UserID: 1, Kind: model.AttachmentKindImage, + URL: "/uploads/images/ghost.webp", MIME: "image/webp", Size: 1, + }).Error; err != nil { + t.Fatalf("create attachment: %v", err) + } + + items, _, err := s.AdminMediaLibrary() + if err != nil { + t.Fatalf("AdminMediaLibrary: %v", err) + } + for _, it := range items { + if it.URL == "/uploads/images/ghost.webp" { + t.Fatal("local-missing file should not be listed") + } + } +} + +func TestAdminMediaLibraryAttachSources(t *testing.T) { + s, dir := newMediaLibraryService(t) + + writeMediaFile(t, dir, "avatars/av1.webp", []byte("fake-webp")) + writeMediaFile(t, dir, "images/p1.webp", []byte("fake-webp")) + writeMediaFile(t, dir, "images/c1.jpg", []byte("fake-jpeg")) + + // 头像被 bob 使用 + if err := s.db.Create(&model.User{ + Username: "bob", Nickname: "阿Bob", Avatar: "/uploads/avatars/av1.webp", + }).Error; err != nil { + t.Fatalf("create user: %v", err) + } + // 帖子正文引用 p1 + post := model.Post{UserID: 1, Title: "图片来源测试", Content: "看图 "} + if err := s.db.Create(&post).Error; err != nil { + t.Fatalf("create post: %v", err) + } + // 评论引用 c1 + if err := s.db.Create(&model.Comment{ + PostID: post.ID, UserID: 1, Content: "评论里也有 /uploads/images/c1.jpg", + }).Error; err != nil { + t.Fatalf("create comment: %v", err) + } + + items, _, err := s.AdminMediaLibrary() + if err != nil { + t.Fatalf("AdminMediaLibrary: %v", err) + } + byURL := map[string]MediaLibraryItem{} + for _, it := range items { + byURL[it.URL] = it + } + + av, ok := byURL["/uploads/avatars/av1.webp"] + if !ok { + t.Fatal("avatar item missing") + } + if av.SourceURL != "/u/1" || av.SourceLabel != "@阿Bob 的头像" { + t.Fatalf("avatar source wrong: %+v", av) + } + + pimg, ok := byURL["/uploads/images/p1.webp"] + if !ok { + t.Fatal("post image missing") + } + if pimg.SourceURL != fmt.Sprintf("/post/%d", post.ID) || + !strings.Contains(pimg.SourceLabel, "图片来源测试") { + t.Fatalf("post source wrong: %+v", pimg) + } + + cimg, ok := byURL["/uploads/images/c1.jpg"] + if !ok { + t.Fatal("comment image missing") + } + if cimg.SourceURL != fmt.Sprintf("/post/%d#comment-", post.ID) && + !strings.HasPrefix(cimg.SourceURL, fmt.Sprintf("/post/%d#comment-", post.ID)) { + t.Fatalf("comment source url wrong: %+v", cimg) + } + if !strings.Contains(cimg.SourceLabel, "下的评论") { + t.Fatalf("comment source label wrong: %+v", cimg) + } +} + +func TestMediaThumb(t *testing.T) { + s, dir := newMediaLibraryService(t) + + // 960×640 PNG → 缩到 480×320 的 WebP + big := image.NewRGBA(image.Rect(0, 0, 960, 640)) + var bigBuf bytes.Buffer + if err := png.Encode(&bigBuf, big); err != nil { + t.Fatalf("encode png: %v", err) + } + writeMediaFile(t, dir, "images/big.png", bigBuf.Bytes()) + + // 小图（≤480）直接回原图 + writeMediaFile(t, dir, "images/small.png", tinyPNG()) + + bigThumb, err := s.MediaThumb("/uploads/images/big.png") + if err != nil { + t.Fatalf("MediaThumb big: %v", err) + } + img, err := xwebp.Decode(bytes.NewReader(bigThumb)) + if err != nil { + t.Fatalf("thumb not webp: %v", err) + } + if img.Bounds().Dx() != 480 || img.Bounds().Dy() != 320 { + t.Fatalf("thumb size wrong: %v", img.Bounds()) + } + + small, err := s.MediaThumb("/uploads/images/small.png") + if err != nil { + t.Fatalf("MediaThumb small: %v", err) + } + if !bytes.Equal(small, tinyPNG()) { + t.Fatal("small image should be returned as-is") + } + + // 缓存命中：第二次调用结果一致 + again, err := s.MediaThumb("/uploads/images/big.png") + if err != nil || !bytes.Equal(again, bigThumb) { + t.Fatalf("cache miss/mismatch: %v", err) + } + + // 非法与越界路径 + if _, err := s.MediaThumb("/api/media/xxx"); err == nil { + t.Fatal("remote url should be rejected") + } + if _, err := s.MediaThumb("/uploads/../secrets/x.png"); err == nil { + t.Fatal("traversal should be rejected") + } + if _, err := s.MediaThumb("/uploads/other/x.png"); err == nil { + t.Fatal("unknown category should be rejected") + } +} diff --git a/backend/service/media_thumbs.go b/backend/service/media_thumbs.go new file mode 100644 index 0000000..2b32566 --- /dev/null +++ b/backend/service/media_thumbs.go @@ -0,0 +1,114 @@ +package service + +import ( + "bytes" + "crypto/sha1" + "encoding/hex" + "errors" + "image" + _ "image/gif" + _ "image/jpeg" + _ "image/png" + "os" + "path/filepath" + "strings" + + webpenc "github.com/gen2brain/webp" + "golang.org/x/image/draw" + xwebp "golang.org/x/image/webp" +) + +// 媒体库缩略图：管理后台网格不再直连原图（全量图片一次加载网络压力大）。 +// 服务端按需生成最长边 480px 的 WebP 缩略图，落盘 .thumbs/（按 URL 哈希命名）缓存， +// 源文件更新后（mtime 更新）自动重建。仅覆盖本地 /uploads/ 图片； +// 远程存储对象与解码失败（如动图 WebP）由调用方回退原图。 + +// MediaThumbMaxSide 缩略图最长边（网格单元 ~200px，2x DPR 足够） +const MediaThumbMaxSide = 480 + +// MediaThumb 返回指定 /uploads/ 图片的缩略图字节。 +func (s *UploadService) MediaThumb(url string) ([]byte, error) { + if !strings.HasPrefix(url, "/uploads/") || len(url) > 512 { + return nil, errors.New("无效地址") + } + rel := filepath.Clean(filepath.FromSlash(strings.TrimPrefix(url, "/uploads/"))) + if filepath.IsAbs(rel) || rel == "." || strings.HasPrefix(rel, "..") { + return nil, errors.New("无效地址") + } + dir := filepath.Dir(rel) + ok := false + for _, cat := range mediaLibraryCategories { + if cat.Dir == dir { + ok = true + break + } + } + if !ok { + return nil, errors.New("无效地址") + } + ext := strings.ToLower(filepath.Ext(rel)) + switch ext { + case ".jpg", ".jpeg", ".png", ".webp", ".gif": + default: + return nil, errors.New("非图片") + } + + src := filepath.Join(s.dir, rel) + info, err := os.Stat(src) + if err != nil || info.IsDir() { + return nil, errors.New("文件不存在") + } + + // 磁盘缓存：哈希命名防跨分类文件名冲突；mtime 旧于源文件则重建 + sum := sha1.Sum([]byte(url)) + thumbPath := filepath.Join(s.dir, ".thumbs", hex.EncodeToString(sum[:])+".webp") + if ti, err := os.Stat(thumbPath); err == nil && !ti.IsDir() && !ti.ModTime().Before(info.ModTime()) { + return os.ReadFile(thumbPath) + } + + data, err := os.ReadFile(src) + if err != nil { + return nil, err + } + var img image.Image + if ext == ".webp" { + img, err = xwebp.Decode(bytes.NewReader(data)) + } else { + img, _, err = image.Decode(bytes.NewReader(data)) + } + if err != nil { + return nil, err // 如动图 WebP，调用方回退原图 + } + + b := img.Bounds() + w, h := b.Dx(), b.Dy() + if w <= MediaThumbMaxSide && h <= MediaThumbMaxSide { + // 小图无需缩放，直接回原图省 CPU + return data, nil + } + nw, nh := w, h + if w >= h { + nw = MediaThumbMaxSide + nh = max(1, h*MediaThumbMaxSide/w) + } else { + nh = MediaThumbMaxSide + nw = max(1, w*MediaThumbMaxSide/h) + } + dst := image.NewRGBA(image.Rect(0, 0, nw, nh)) + draw.CatmullRom.Scale(dst, dst.Bounds(), img, b, draw.Src, nil) + + var buf bytes.Buffer + if err := webpenc.Encode(&buf, dst, webpenc.Options{Quality: 78}); err != nil { + return nil, err + } + // 原子落缓存（失败仅影响下次重复生成，不阻断响应） + if err := os.MkdirAll(filepath.Dir(thumbPath), 0o755); err == nil { + tmp := thumbPath + ".partial" + if err := os.WriteFile(tmp, buf.Bytes(), 0o644); err == nil { + if err := os.Rename(tmp, thumbPath); err != nil { + _ = os.Remove(tmp) + } + } + } + return buf.Bytes(), nil +} diff --git a/backend/service/upload.go b/backend/service/upload.go index 85bc6f2..4022079 100644 --- a/backend/service/upload.go +++ b/backend/service/upload.go @@ -19,6 +19,7 @@ import ( "time" "github.com/freefire/jiang13-bbs/model" + webpenc "github.com/gen2brain/webp" "golang.org/x/image/webp" "gorm.io/gorm" ) @@ -29,10 +30,13 @@ const ( AvatarMinDim = 64 AvatarMaxDim = 512 - // 帖子插图：允许 JPEG/PNG/WebP，不强制转码 - ImageMaxBytes = 5 << 20 // 5 MiB + // 帖子插图：JPEG/PNG 统一转存 WebP；GIF（动图）与已是 WebP 的原样保留 + ImageMaxBytes = 5 << 20 // 5 MiB（对原始上传文件生效） ImageMaxDim = 4096 + // JPEG 转 WebP 的有损质量；PNG 走无损，不受此参数影响 + ImageWebPQuality = 80 + // 站点背景图（前台/后台墙纸） BackgroundMaxBytes = 8 << 20 // 8 MiB BackgroundMaxDim = 8192 @@ -190,7 +194,50 @@ func decodeImageSizeReader(r io.Reader, mime string) (w, h int, err error) { return cfg.Width, cfg.Height, nil } -// SaveImage 流式保存帖子插图：校验格式/大小/尺寸 → 落盘 → 写 attachments（kind=image） +// transcodeImageToWebP 把校验通过的 JPEG/PNG 临时文件解码后转码为 WebP： +// JPEG 走有损 q80，PNG 走无损（保留透明通道与文字锐度）。 +// 成功返回新文件名/MIME/大小并清理原临时文件；失败返回 error（调用方保留原格式落盘）。 +func (s *UploadService) transcodeImageToWebP(tmp, name, ext string) (string, string, int64, error) { + webpName := strings.TrimSuffix(name, ext) + ".webp" + webpPath := filepath.Join(s.dir, "images", webpName) + webpTmp := webpPath + ".partial" + if s.ops != nil { + release, e := s.ops.BeginTemporary(webpTmp) + if e != nil { + return "", "", 0, e + } + defer release() + } + + f, err := os.Open(tmp) + if err != nil { + return "", "", 0, err + } + img, _, err := image.Decode(f) // 仅 JPEG/PNG 会走到这里，解码器已在文件头注册 + _ = f.Close() + if err != nil { + return "", "", 0, err + } + var buf bytes.Buffer + if err := webpenc.Encode(&buf, img, webpenc.Options{ + Quality: ImageWebPQuality, + Lossless: ext == ".png", + }); err != nil { + return "", "", 0, err + } + if err := os.WriteFile(webpTmp, buf.Bytes(), 0o644); err != nil { + _ = os.Remove(webpTmp) + return "", "", 0, err + } + if err := os.Rename(webpTmp, webpPath); err != nil { + _ = os.Remove(webpTmp) + return "", "", 0, err + } + _ = os.Remove(tmp) + return webpName, "image/webp", int64(buf.Len()), nil +} + +// SaveImage 流式保存帖子插图：校验格式/大小/尺寸 → JPEG/PNG 转 WebP → 落盘 → 写 attachments（kind=image） func (s *UploadService) SaveImage(userID uint, src io.Reader) (*model.Attachment, error) { if src == nil { return nil, errors.New("文件为空") @@ -284,33 +331,48 @@ func (s *UploadService) SaveImage(userID uint, src io.Reader) (*model.Attachment _ = os.Remove(tmp) return nil, errors.New("图片边长不能超过 4096px") } - if err := os.Rename(tmp, fullPath); err != nil { - _ = os.Remove(tmp) - return nil, err + + // JPEG/PNG 统一转存 WebP；GIF（动图）与已是 WebP 的原样保留 + storeName, storeMime, storeSize := filename, format.mime, total + storePath := fullPath + if format.mime == "image/jpeg" || format.mime == "image/png" { + name, mime, size, err := s.transcodeImageToWebP(tmp, filename, format.ext) + if err != nil { + log.Printf("[upload] 插图转 WebP 失败，保留原格式 %s: %v", filename, err) + } else { + storeName, storeMime, storeSize = name, mime, size + storePath = filepath.Join(s.dir, "images", name) + } + } + if storePath == fullPath { + if err := os.Rename(tmp, fullPath); err != nil { + _ = os.Remove(tmp) + return nil, err + } } att := &model.Attachment{ UserID: userID, Kind: model.AttachmentKindImage, - URL: "/uploads/images/" + filename, - MIME: format.mime, - Size: int(total), + URL: "/uploads/images/" + storeName, + MIME: storeMime, + Size: int(storeSize), Width: w, Height: h, } if s.ops != nil { - id, e := s.ops.StoreFile(fullPath, att.MIME, true) + id, e := s.ops.StoreFile(storePath, att.MIME, true) if e != nil { - _ = os.Remove(fullPath) + _ = os.Remove(storePath) return nil, e } if id != "" { att.URL = "/api/media/" + id - _ = os.Remove(fullPath) + _ = os.Remove(storePath) } } if err := s.db.Create(att).Error; err != nil { - _ = os.Remove(fullPath) + _ = os.Remove(storePath) return nil, err } return att, nil diff --git a/backend/service/upload_webp_test.go b/backend/service/upload_webp_test.go new file mode 100644 index 0000000..7d6f967 --- /dev/null +++ b/backend/service/upload_webp_test.go @@ -0,0 +1,172 @@ +package service + +import ( + "bytes" + "image" + "image/color" + "image/gif" + "image/jpeg" + "image/png" + "os" + "path/filepath" + "strings" + "testing" + + "github.com/freefire/jiang13-bbs/model" + webpenc "github.com/gen2brain/webp" + "github.com/glebarez/sqlite" + xwebp "golang.org/x/image/webp" + "gorm.io/gorm" +) + +func newUploadTestService(t *testing.T) (*UploadService, string) { + t.Helper() + db, err := gorm.Open(sqlite.Open(":memory:"), &gorm.Config{}) + if err != nil { + t.Fatalf("open sqlite: %v", err) + } + if err := db.AutoMigrate(&model.Attachment{}); err != nil { + t.Fatalf("migrate: %v", err) + } + dir := t.TempDir() + s := NewUploadService(db, dir) + if err := s.EnsureDir(); err != nil { + t.Fatalf("ensure dir: %v", err) + } + return s, dir +} + +func storedUploadPath(t *testing.T, dir, url string) []byte { + t.Helper() + rel := strings.TrimPrefix(url, "/uploads/") + data, err := os.ReadFile(filepath.Join(dir, filepath.FromSlash(rel))) + if err != nil { + t.Fatalf("read stored file %s: %v", url, err) + } + return data +} + +func TestSaveImageTranscodesJPEGToWebP(t *testing.T) { + s, dir := newUploadTestService(t) + + src := image.NewRGBA(image.Rect(0, 0, 48, 36)) + for y := 0; y < 36; y++ { + for x := 0; x < 48; x++ { + src.Set(x, y, color.RGBA{uint8(x * 5), uint8(y * 7), 128, 255}) + } + } + var in bytes.Buffer + if err := jpeg.Encode(&in, src, nil); err != nil { + t.Fatalf("encode jpeg: %v", err) + } + + att, err := s.SaveImage(1, bytes.NewReader(in.Bytes())) + if err != nil { + t.Fatalf("SaveImage: %v", err) + } + if !strings.HasSuffix(att.URL, ".webp") || att.MIME != "image/webp" { + t.Fatalf("want webp attachment, got url=%s mime=%s", att.URL, att.MIME) + } + if att.Width != 48 || att.Height != 36 { + t.Fatalf("dims changed: %dx%d", att.Width, att.Height) + } + + img, err := xwebp.Decode(bytes.NewReader(storedUploadPath(t, dir, att.URL))) + if err != nil { + t.Fatalf("decode stored webp: %v", err) + } + if got := img.Bounds(); got.Dx() != 48 || got.Dy() != 36 { + t.Fatalf("stored webp dims: %v", got) + } +} + +func TestSaveImageTranscodesPNGLosslessKeepsAlpha(t *testing.T) { + s, dir := newUploadTestService(t) + + src := image.NewNRGBA(image.Rect(0, 0, 24, 24)) + for y := 0; y < 24; y++ { + for x := 0; x < 24; x++ { + if y < 12 { + src.SetNRGBA(x, y, color.NRGBA{0, 0, 0, 0}) // 上半透明 + } else { + src.SetNRGBA(x, y, color.NRGBA{12, 34, 56, 255}) + } + } + } + var in bytes.Buffer + if err := png.Encode(&in, src); err != nil { + t.Fatalf("encode png: %v", err) + } + + att, err := s.SaveImage(1, bytes.NewReader(in.Bytes())) + if err != nil { + t.Fatalf("SaveImage: %v", err) + } + if !strings.HasSuffix(att.URL, ".webp") || att.MIME != "image/webp" { + t.Fatalf("want webp attachment, got url=%s mime=%s", att.URL, att.MIME) + } + + img, err := xwebp.Decode(bytes.NewReader(storedUploadPath(t, dir, att.URL))) + if err != nil { + t.Fatalf("decode stored webp: %v", err) + } + if _, _, _, a := img.At(0, 0).RGBA(); a != 0 { + t.Fatalf("alpha lost at transparent pixel: %d", a) + } + r, g, b, _ := img.At(5, 20).RGBA() + if r>>8 != 12 || g>>8 != 34 || b>>8 != 56 { + t.Fatalf("opaque color changed: %d,%d,%d", r>>8, g>>8, b>>8) + } +} + +func TestSaveImageKeepsGIFAsIs(t *testing.T) { + s, dir := newUploadTestService(t) + + src := image.NewRGBA(image.Rect(0, 0, 16, 16)) + for y := 0; y < 16; y++ { + for x := 0; x < 16; x++ { + src.Set(x, y, color.RGBA{uint8(x * 16), uint8(y * 16), 0, 255}) + } + } + var in bytes.Buffer + if err := gif.Encode(&in, src, nil); err != nil { + t.Fatalf("encode gif: %v", err) + } + + att, err := s.SaveImage(1, bytes.NewReader(in.Bytes())) + if err != nil { + t.Fatalf("SaveImage: %v", err) + } + if !strings.HasSuffix(att.URL, ".gif") || att.MIME != "image/gif" { + t.Fatalf("gif should be kept as-is, got url=%s mime=%s", att.URL, att.MIME) + } + data := storedUploadPath(t, dir, att.URL) + magic := string(data[:6]) + if magic != "GIF89a" && magic != "GIF87a" { + t.Fatalf("stored gif magic invalid: %q", magic) + } +} + +func TestSaveImageKeepsWebPAsIs(t *testing.T) { + s, dir := newUploadTestService(t) + + src := image.NewRGBA(image.Rect(0, 0, 20, 10)) + var in bytes.Buffer + if err := webpenc.Encode(&in, src, webpenc.Options{Quality: ImageWebPQuality}); err != nil { + t.Fatalf("encode webp: %v", err) + } + + att, err := s.SaveImage(1, bytes.NewReader(in.Bytes())) + if err != nil { + t.Fatalf("SaveImage: %v", err) + } + if !strings.HasSuffix(att.URL, ".webp") || att.MIME != "image/webp" { + t.Fatalf("want webp attachment, got url=%s mime=%s", att.URL, att.MIME) + } + if !bytes.Equal(storedUploadPath(t, dir, att.URL), in.Bytes()) { + t.Fatal("webp input should be stored byte-for-byte") + } + if att.Size != in.Len() { + t.Fatalf("size mismatch: att=%d input=%d", att.Size, in.Len()) + } +} diff --git a/docs/migration-announcement.md b/docs/migration-announcement.md new file mode 100644 index 0000000..93f6ee4 --- /dev/null +++ b/docs/migration-announcement.md @@ -0,0 +1,36 @@ +# 旧站迁移公告：账号数据已迁入，旧站将全面搬家 + +各位社区成员： + +**旧网站将在不久后全面迁移到姜十三论坛**，以后我们就在新家见面。 + +## 目前已迁移：用户账号 + +旧站账号数据已完成迁移，包括用户名、昵称、个性签名、邮箱和头像。 + +**无需重新注册**，直接用旧站的**用户名 + 原密码**登录即可——密码是原样迁移的，不需要重置。登录后建议在「账号设置」里核对一下资料。 + + + +## 暂未迁移：帖子与评论 + +旧站的帖子与评论**暂时不会搬过来**。因为直接迁移会丢失旧帖里的图片，迁移方案还在完善中。等完成后我们会发布公告，把大家的帖子完整搬进来，请耐心等待。 + +在此之前，新内容请直接发在新站。 + +## 常见问题 + +**Q：需要重新注册吗？** +A：不需要，用旧站用户名和密码直接登录。 + +**Q：密码忘了怎么办？** +A：联系管理员，核对身份后协助重置。 + +**Q：旧帖会丢失吗？** +A：不会。帖子与评论等迁移方案完善后会完整搬入，届时另行公告。 + +--- + +如有问题或建议，可通过邮件联系：aarbbs@88.com + +—— 姜十三论坛 团队 diff --git a/docs/site-operations.md b/docs/site-operations.md index 4e6e3ea..a551f30 100644 --- a/docs/site-operations.md +++ b/docs/site-operations.md @@ -68,7 +68,7 @@ - cdn：默认空，可选 HTTPS 基址。只用于已声明公开图片，部署方必须配置其桶/前缀权限。私有文件仍走鉴权下载；CDN 不是将私有桶设为公开的指令。 - image_max_mb：默认 5 MiB，范围 1–50；attachment_max_mb：默认 20 MiB，范围 1–100；attachment_max_count：默认每帖 10，范围 1–20。原 API 每次上传一个文件，前端批量仍受每帖上限约束。 - attachment_ext_limit：默认 true；attachment_exts：继承原业务白名单，1–80 个小写字母数字扩展名。原站点支持软件安装包和技术文本；这些仍只作为强制下载附件，不能内联执行。 -- 正文图片复用 JPEG/PNG/WebP 解码检查与最大 4096px；头像保持 2 MiB、64–512px WebP；SVG 仅保留管理员品牌上传能力。附件复用真实图片头校验，伪装/活跃内容降为二进制并强制 attachment/nosniff。 +- 正文图片复用 JPEG/PNG/WebP/GIF 解码检查与最大 4096px，其中 JPEG/PNG 落盘前统一转存 WebP（JPEG 有损 q80、PNG 无损；GIF 动图与已是 WebP 的原样保留，转码失败降级为保留原格式）；头像保持 2 MiB、64–512px WebP；SVG 仅保留管理员品牌上传能力。附件复用真实图片头校验，伪装/活跃内容降为二进制并强制 attachment/nosniff。 - 1 MiB=1,048,576 字节；仓库 Nginx 示例与 Next 代理缓冲均为 512 MiB，仍需确认实际部署入口没有更低限制。 - 保存 S3 前验证合并后的草稿，在专用 tests/ 前缀上传、读回并删除一个随机测试对象，不扫描桶。失败不更新配置；不会自动切回其他存储。 - 每个远程对象保存不可变 storage-N 配置引用与对象键。切换后原本地 URL、历史远程配置继续可读；界面显示历史引用数，不提供删除历史配置按钮。 diff --git a/frontend/app/about/page.tsx b/frontend/app/about/page.tsx index 8a66033..4084635 100644 --- a/frontend/app/about/page.tsx +++ b/frontend/app/about/page.tsx @@ -16,7 +16,6 @@ import { SiteDocShell, SiteDocIdentity, SiteDocAnnoNav, - SiteDocBreadcrumb, } from "@/components/site-doc"; import { requestCanonical } from "@/lib/canonicalMeta"; @@ -109,13 +108,6 @@ export default async function AboutIndexPage() { className="px-5 sm:px-6 pt-5 pb-4" style={{ borderBottom: "1px solid var(--line)" }} > -至少保留一个时长档位。
) : ( -| 天数 | +标签 | +图片价格 | +文字价格 | +操作 | +
|---|---|---|---|---|
| + { + const durations = [...cfg.durations]; + durations[i] = { ...d, days: Number(e.target.value) || 1 }; + setCfg({ ...cfg, durations }); + }} + aria-label="天数" + /> + | ++ { + const durations = [...cfg.durations]; + durations[i] = { ...d, label: e.target.value }; + setCfg({ ...cfg, durations }); + }} + /> + | ++ { + const durations = [...cfg.durations]; + durations[i] = { ...d, price_hint: e.target.value }; + setCfg({ ...cfg, durations }); + }} + aria-label="图片广告价格" + /> + | ++ { + const durations = [...cfg.durations]; + durations[i] = { ...d, price_hint_text: e.target.value }; + setCfg({ ...cfg, durations }); + }} + aria-label="文字广告价格" + /> + | ++ + | +
- 管理员自定义徽章：全站作者处展示前 2 枚，个人主页展示徽章墙；授予后用户会收到站内通知。 -
-加载徽章列表…
- ) : badges.length === 0 ? ( -还没有徽章，点击右上角“新建徽章”开始。
-搜索结果
-+ 全部徽章 +
+ {!loading && badges.length > 0 && ( + {badges.length} 枚 + )} +加载徽章列表…
+ ) : badges.length === 0 ? ( +还没有徽章，点击右上角“新建徽章”开始。
++ {creating ? "新建徽章" : "编辑徽章"} +
+ {!creating && selected && ( + )}当前持有者（{holders.length}）
- {holdersLoading ? ( -加载持有者…
- ) : holders.length === 0 ? ( -暂无人持有。
- ) : ( -预览
-+ 持有者 + {holders.length} 人 +
+搜索结果
+当前持有者（{holders.length}）
+ {holdersLoading ? ( +加载持有者…
+ ) : holders.length === 0 ? ( +暂无人持有。
+ ) : ( ++ {showOriginal + ? "当前显示原图（原格式，体积更大）" + : "当前显示 WebP 压缩版；站点内容引用的均为 WebP"} +
+ )} + +
+
+
- - 布局有未保存的修改 -
- -{kindLabel} {selectedDuration ? ` · ${selectedDuration.label}` : ""} + {selectedPrice ? ` · ${selectedPrice}` : ""}
(initialMessages);
const [hasMore, setHasMore] = useState(initialHasMore);
const [loadingMore, setLoadingMore] = useState(false);
+ // 「回到底部」悬浮钮：column-reverse 下 scrollTop≤0（视觉底部为 0，上翻为负），
+ // -scrollTop 即距底部距离；newBelowCount 为翻历史期间新到的、尚未“看见”的消息数
+ const [showJumpBottom, setShowJumpBottom] = useState(false);
+ const [newBelowCount, setNewBelowCount] = useState(0);
const [content, setContent] = useState("");
const [sending, setSending] = useState(false);
const [members, setMembers] = useState
@@ -1313,7 +1340,7 @@ export default function ChatRoomClient({ @@ -1435,7 +1462,7 @@ export default function ChatRoomClient({