feat: 实现完整的板块级RBAC内容审核系统

- 新增站长/超级管理员/管理员/板块管理员四级角色体系
- 实现实时权限快照加载与细粒度权限校验
- 新增内容审核队列与前后端页面
- 重构用户权限管理与站点管理逻辑
- 新增评论/帖子审核状态与通知推送
- 优化前端权限控制与角色徽章展示
- 修正数据库迁移与默认值问题

backend/service/actor.go

@@ -0,0 +1,115 @@
+package service
+
+import (
+	"github.com/freefire/jiang13-bbs/model"
+)
+
+// 权限码：后台功能点。路由通过 RequirePerm 声明，
+// 板块管理员的板块范围由 Actor.BoardIDs 在业务层二次校验。
+const (
+	PermUsers         = "users"         // 用户与权限管理（超管/站长）
+	PermAnnouncements = "announcements" // 公告管理（管理员及以上）
+	PermSettings      = "settings"      // 站点外观设置（超管/站长）
+	PermModeration    = "moderation"    // 内容审核（任意管理角色，板块范围受限）
+)
+
+// Actor 当前请求操作者的实时权限快照（每次后台请求从 DB 现取，
+// 不依赖 JWT 内的 role claim，角色/授权变更立即生效）
+type Actor struct {
+	ID       uint
+	Username string
+	Role     model.Role
+	BoardIDs []uint // 板块管理员被授权的板块；其他角色为空
+}
+
+// IsStaff 是否管理团队成员
+func (a *Actor) IsStaff() bool {
+	return a != nil && model.IsStaff(a.Role)
+}
+
+// HasPerm 是否拥有某后台功能点
+func (a *Actor) HasPerm(p string) bool {
+	if a == nil {
+		return false
+	}
+	switch p {
+	case PermUsers, PermSettings:
+		return a.Role == model.RoleSuperAdmin || a.Role == model.RoleOwner
+	case PermAnnouncements:
+		return model.RoleLevel(a.Role) >= model.RoleLevel(model.RoleAdmin)
+	case PermModeration:
+		return a.IsStaff()
+	}
+	return false
+}
+
+// CanModerateBoard 是否可管理指定板块的内容：
+// 管理员及以上不限板块；板块管理员仅限被授权板块
+func (a *Actor) CanModerateBoard(boardID uint) bool {
+	if a == nil {
+		return false
+	}
+	if model.RoleLevel(a.Role) >= model.RoleLevel(model.RoleAdmin) {
+		return true
+	}
+	if a.Role != model.RoleBoardAdmin {
+		return false
+	}
+	for _, id := range a.BoardIDs {
+		if id == boardID {
+			return true
+		}
+	}
+	return false
+}
+
+// CanAssignRole 操作者能否把他人设置为目标角色（站长不可被授予，仅站长可授予超管）
+func (a *Actor) CanAssignRole(target model.Role) bool {
+	if a == nil {
+		return false
+	}
+	if target == model.RoleOwner {
+		return false // 站长身份不通过授权产生
+	}
+	if target == model.RoleSuperAdmin {
+		return a.Role == model.RoleOwner
+	}
+	return a.HasPerm(PermUsers)
+}
+
+// LoadActor 读取用户实时角色与板块授权
+func (s *AuthService) LoadActor(id uint) (*Actor, error) {
+	var u model.User
+	if err := s.db.Select("id", "username", "role").First(&u, id).Error; err != nil {
+		return nil, err
+	}
+	actor := &Actor{ID: u.ID, Username: u.Username, Role: u.Role, BoardIDs: []uint{}}
+	if u.Role == model.RoleBoardAdmin {
+		var ids []uint
+		if err := s.db.Model(&model.UserBoard{}).
+			Where("user_id = ?", id).
+			Order("board_id ASC").
+			Pluck("board_id", &ids).Error; err != nil {
+			return nil, err
+		}
+		actor.BoardIDs = ids
+	}
+	return actor, nil
+}
+
+// GetUserBoardIDs 读取用户被授权的板块 ID（供 /me 等场景）
+func (s *AuthService) GetUserBoardIDs(id uint) ([]uint, error) {
+	var ids []uint
+	err := s.db.Model(&model.UserBoard{}).
+		Where("user_id = ?", id).Order("board_id ASC").Pluck("board_id", &ids).Error
+	return ids, err
+}
+
+// GetUserIDByUsername 按用户名查 ID（登录失败审计用），用户不存在返回 0
+func (s *AuthService) GetUserIDByUsername(username string) uint {
+	var u model.User
+	if err := s.db.Select("id").Where("username = ?", username).First(&u).Error; err != nil {
+		return 0
+	}
+	return u.ID
+}

backend/service/admin_user.go

@@ -8,16 +8,25 @@ import (
 	"gorm.io/gorm"
 )
 
-// 管理员用户操作的业务护栏（handler 层映射为 400，前端只展示消息）
+// 管理员用户操作的业务护栏（handler 层映射为 4xx，前端只展示消息）
 var (
 	// ErrAdminSelfAction 不能对自己的账号执行管理操作（自锁/误操作保护）
 	ErrAdminSelfAction = errors.New("不能对自己的账号执行该操作")
-	// ErrLastAdmin 至少保留一名未封禁的管理员，防止站点失去管理入口
-	ErrLastAdmin = errors.New("至少保留一名未封禁的管理员")
-	// ErrInvalidUserRole 角色入参非法
-	ErrInvalidUserRole = errors.New("角色参数无效")
+	// ErrInvalidRole 角色入参非法
+	ErrInvalidRole = errors.New("角色参数无效")
+	// ErrProtectedOwner 站长账号受保护，任何人不可改角色/封禁
+	ErrProtectedOwner = errors.New("站长账号受保护，不可操作")
+	// ErrCannotAssignRole 当前操作者无权授予该角色
+	ErrCannotAssignRole = errors.New("无权授予该角色")
+	// ErrBoardRequired 板块管理员至少要授权一个板块
+	ErrBoardRequired = errors.New("板块管理员至少需要授权一个板块")
+	// ErrBoardNotFound 授权的板块不存在
+	ErrBoardNotFound = errors.New("部分板块不存在")
 )
 
+// onlineThreshold last_seen_at 在该窗口内视为在线
+const onlineThreshold = 5 * time.Minute
+
 // AdminUserService 后台用户管理
 type AdminUserService struct {
 	db *gorm.DB
@@ -27,7 +36,7 @@ func NewAdminUserService(db *gorm.DB) *AdminUserService {
 	return &AdminUserService{db: db}
 }
 
-// AdminUserItem 后台用户列表项：email / last_seen 在 User 模型上 json:"-"，
+// AdminUserItem 后台用户列表项：email / last_seen / 登录 IP 在 User 模型上 json:"-"，
 // 仅管理员接口通过此 DTO 显式带出
 type AdminUserItem struct {
 	ID           uint       `json:"id"`
@@ -37,14 +46,18 @@ type AdminUserItem struct {
 	Avatar       string     `json:"avatar"`
 	Signature    string     `json:"signature"`
 	Role         string     `json:"role"`
+	BoardIDs     []uint     `json:"board_ids"`
 	Banned       bool       `json:"banned"`
 	PostCount    int64      `json:"post_count"`
 	CommentCount int64      `json:"comment_count"`
 	CreatedAt    time.Time  `json:"created_at"`
 	LastSeenAt   *time.Time `json:"last_seen_at"`
+	Online       bool       `json:"online"`
+	LastLoginIP  string     `json:"last_login_ip"`
+	LastLoginAt  *time.Time `json:"last_login_at"`
 }
 
-// AdminUserSummary 列表顶部汇总（总数/管理员/封禁/今日新增）
+// AdminUserSummary 列表顶部汇总（总数/管理团队/封禁/今日新增）
 type AdminUserSummary struct {
 	Total    int64 `json:"total"`
 	Admins   int64 `json:"admins"`
@@ -52,12 +65,18 @@ type AdminUserSummary struct {
 	TodayNew int64 `json:"today_new"`
 }
 
+// staffRoles 管理团队角色集合
+var staffRoles = []string{
+	string(model.RoleBoardAdmin), string(model.RoleAdmin),
+	string(model.RoleSuperAdmin), string(model.RoleOwner),
+}
+
 // AdminUserListQuery 用户列表查询
 type AdminUserListQuery struct {
 	Page    int
 	Size    int
 	Keyword string // 用户名 / 昵称 / 邮箱模糊匹配
-	Role    string // "" 全部 | "admin" 仅管理员
+	Role    string // "" 全部 | "staff" 管理团队 | 具体角色枚举
 	Status  string // "" 全部 | "banned" 已封禁 | "normal" 正常
 }
 
@@ -84,8 +103,11 @@ func (s *AdminUserService) List(q AdminUserListQuery) (*AdminUserListResult, err
 		like := "%" + kw + "%"
 		query = query.Where("username ILIKE ? OR nickname ILIKE ? OR email ILIKE ?", like, like, like)
 	}
-	if q.Role == string(model.RoleAdmin) {
-		query = query.Where("role = ?", model.RoleAdmin)
+	switch {
+	case q.Role == "staff":
+		query = query.Where("role IN ?", staffRoles)
+	case q.Role != "" && model.ValidRole(model.Role(q.Role)):
+		query = query.Where("role = ?", q.Role)
 	}
 	if q.Status == "banned" {
 		query = query.Where("banned = ?", true)
@@ -112,7 +134,7 @@ func (s *AdminUserService) List(q AdminUserListQuery) (*AdminUserListResult, err
 	dayStart := time.Date(now.Year(), now.Month(), now.Day(), 0, 0, 0, 0, now.Location())
 	summary := AdminUserSummary{}
 	s.db.Model(&model.User{}).Count(&summary.Total)
-	s.db.Model(&model.User{}).Where("role = ?", model.RoleAdmin).Count(&summary.Admins)
+	s.db.Model(&model.User{}).Where("role IN ?", staffRoles).Count(&summary.Admins)
 	s.db.Model(&model.User{}).Where("banned = ?", true).Count(&summary.Banned)
 	s.db.Model(&model.User{}).Where("created_at >= ?", dayStart).Count(&summary.TodayNew)
 
@@ -125,13 +147,14 @@ func (s *AdminUserService) List(q AdminUserListQuery) (*AdminUserListResult, err
 	}, nil
 }
 
-// toItems 批量把 User 模型转为 DTO，并用两条 GROUP BY 填充计数
+// toItems 批量把 User 模型转为 DTO，并用聚合查询填充计数/授权板块/最近登录
 func (s *AdminUserService) toItems(users []model.User) []AdminUserItem {
 	items := make([]AdminUserItem, 0, len(users))
 	ids := make([]uint, 0, len(users))
+	now := time.Now()
 	for _, u := range users {
 		ids = append(ids, u.ID)
-		items = append(items, AdminUserItem{
+		item := AdminUserItem{
 			ID:         u.ID,
 			Username:   u.Username,
 			Nickname:   u.Nickname,
@@ -139,15 +162,33 @@ func (s *AdminUserService) toItems(users []model.User) []AdminUserItem {
 			Avatar:     u.Avatar,
 			Signature:  u.Signature,
 			Role:       string(u.Role),
+			BoardIDs:   []uint{},
 			Banned:     u.Banned,
 			CreatedAt:  u.CreatedAt,
 			LastSeenAt: u.LastSeenAt,
-		})
+		}
+		if u.LastSeenAt != nil && now.Sub(*u.LastSeenAt) <= onlineThreshold {
+			item.Online = true
+		}
+		items = append(items, item)
 	}
 	if len(ids) == 0 {
 		return items
 	}
 
+	// 板块授权：一次查出本页全部映射
+	type ubRow struct {
+		UserID  uint
+		BoardID uint
+	}
+	var ubRows []ubRow
+	s.db.Model(&model.UserBoard{}).Where("user_id IN ?", ids).
+		Order("board_id ASC").Scan(&ubRows)
+	boardsMap := map[uint][]uint{}
+	for _, r := range ubRows {
+		boardsMap[r.UserID] = append(boardsMap[r.UserID], r.BoardID)
+	}
+
 	type countRow struct {
 		UserID uint
 		Cnt    int64
@@ -173,9 +214,32 @@ func (s *AdminUserService) toItems(users []model.User) []AdminUserItem {
 		commentCounts[r.UserID] = r.Cnt
 	}
 
+	// 每个用户最近一次成功登录（DISTINCT ON 走 user_id+created_at 索引）
+	type loginRow struct {
+		UserID    uint
+		IP        string
+		CreatedAt time.Time
+	}
+	var loginRows []loginRow
+	s.db.Raw(`SELECT DISTINCT ON (user_id) user_id, ip, created_at
+		FROM login_logs WHERE user_id IN ? AND success = true
+		ORDER BY user_id, created_at DESC`, ids).Scan(&loginRows)
+	lastLogin := map[uint]loginRow{}
+	for _, r := range loginRows {
+		lastLogin[r.UserID] = r
+	}
+
 	for i := range items {
 		items[i].PostCount = postCounts[items[i].ID]
 		items[i].CommentCount = commentCounts[items[i].ID]
+		if b := boardsMap[items[i].ID]; len(b) > 0 {
+			items[i].BoardIDs = b
+		}
+		if l, ok := lastLogin[items[i].ID]; ok {
+			t := l.CreatedAt
+			items[i].LastLoginIP = l.IP
+			items[i].LastLoginAt = &t
+		}
 	}
 	return items
 }
@@ -190,42 +254,78 @@ func (s *AdminUserService) getItem(tx *gorm.DB, id uint) (*AdminUserItem, error)
 	return &items[0], nil
 }
 
-// SetRole 修改用户角色。管理员降级时递增 token_version 并撤销 refresh token，
-// 使其旧 JWT（claims 中仍带 admin）立即失效，需重新登录获得新角色身份
-func (s *AdminUserService) SetRole(operatorID, targetID uint, role string) (*AdminUserItem, error) {
-	if role != string(model.RoleAdmin) && role != string(model.RoleUser) {
-		return nil, ErrInvalidUserRole
+// SetStaff 修改用户管理角色与板块授权。角色变更后强制下线，
+// 使其旧 JWT（claims 中带旧角色）立即失效，需重新登录获得新身份。
+// 站长账号任何时候都不可被操作；只有站长可授予超管；站长身份不可被授予。
+func (s *AdminUserService) SetStaff(operator *Actor, targetID uint, role model.Role, boardIDs []uint) (*AdminUserItem, error) {
+	if operator == nil {
+		return nil, ErrCannotAssignRole
 	}
-	if operatorID == targetID {
+	if operator.ID == targetID {
 		return nil, ErrAdminSelfAction
 	}
+	if !model.ValidRole(role) || role == model.RoleOwner {
+		return nil, ErrInvalidRole
+	}
+	if !operator.CanAssignRole(role) {
+		return nil, ErrCannotAssignRole
+	}
+
+	// 板块管理员：规整、去重并校验板块存在
+	var normBoards []uint
+	if role == model.RoleBoardAdmin {
+		seen := map[uint]bool{}
+		for _, b := range boardIDs {
+			if b > 0 && !seen[b] {
+				seen[b] = true
+				normBoards = append(normBoards, b)
+			}
+		}
+		if len(normBoards) == 0 {
+			return nil, ErrBoardRequired
+		}
+		var boardCnt int64
+		if err := s.db.Model(&model.Board{}).Where("id IN ?", normBoards).Count(&boardCnt).Error; err != nil {
+			return nil, err
+		}
+		if int(boardCnt) != len(normBoards) {
+			return nil, ErrBoardNotFound
+		}
+	}
 
-	var item *AdminUserItem
 	err := s.db.Transaction(func(tx *gorm.DB) error {
 		var u model.User
 		if err := tx.First(&u, targetID).Error; err != nil {
 			return err
 		}
-		if string(u.Role) == role {
-			return nil
+		// 站长账号是唯一硬保护对象
+		if u.Role == model.RoleOwner {
+			return ErrProtectedOwner
 		}
-		// 降级管理员：确保还存在另一名未封禁管理员
-		if u.Role == model.RoleAdmin {
-			var otherAdmins int64
-			if err := tx.Model(&model.User{}).
-				Where("role = ? AND banned = ? AND id <> ?", model.RoleAdmin, false, targetID).
-				Count(&otherAdmins).Error; err != nil {
+
+		roleChanged := u.Role != role
+		if roleChanged {
+			if err := tx.Model(&u).Update("role", role).Error; err != nil {
 				return err
 			}
-			if otherAdmins == 0 {
-				return ErrLastAdmin
-			}
 		}
-		if err := tx.Model(&u).Update("role", model.Role(role)).Error; err != nil {
+
+		// 同步板块授权：整体替换；非板块管理员清空
+		if err := tx.Where("user_id = ?", targetID).Delete(&model.UserBoard{}).Error; err != nil {
 			return err
 		}
-		// 管理员被降级：强制下线，避免 15 分钟 JWT 窗口内仍保有管理权限
-		if role == string(model.RoleUser) {
+		if role == model.RoleBoardAdmin {
+			rows := make([]model.UserBoard, 0, len(normBoards))
+			for _, b := range normBoards {
+				rows = append(rows, model.UserBoard{UserID: targetID, BoardID: b})
+			}
+			if err := tx.Create(&rows).Error; err != nil {
+				return err
+			}
+		}
+
+		// 任何角色变化都强制下线（板块授权变化因 Actor 每次现查 DB，无需下线）
+		if roleChanged {
 			if err := invalidateUserSessions(tx, targetID); err != nil {
 				return err
 			}
@@ -235,13 +335,15 @@ func (s *AdminUserService) SetRole(operatorID, targetID uint, role string) (*Adm
 	if err != nil {
 		return nil, err
 	}
-	item, err = s.getItem(s.db, targetID)
-	return item, err
+	return s.getItem(s.db, targetID)
 }
 
-// SetBanned 封禁/解封用户。封禁时同事务使该用户全部登录态立即失效
-func (s *AdminUserService) SetBanned(operatorID, targetID uint, banned bool) (*AdminUserItem, error) {
-	if operatorID == targetID {
+// SetBanned 封禁/解封用户。站长账号不可封禁；封禁时同事务使登录态立即失效
+func (s *AdminUserService) SetBanned(operator *Actor, targetID uint, banned bool) (*AdminUserItem, error) {
+	if operator == nil {
+		return nil, ErrProtectedOwner
+	}
+	if operator.ID == targetID {
 		return nil, ErrAdminSelfAction
 	}
 
@@ -250,21 +352,12 @@ func (s *AdminUserService) SetBanned(operatorID, targetID uint, banned bool) (*A
 		if err := tx.First(&u, targetID).Error; err != nil {
 			return err
 		}
+		if u.Role == model.RoleOwner {
+			return ErrProtectedOwner
+		}
 		if u.Banned == banned {
 			return nil
 		}
-		// 封禁管理员：确保还存在另一名未封禁管理员，避免站点失去管理入口
-		if banned && u.Role == model.RoleAdmin {
-			var otherAdmins int64
-			if err := tx.Model(&model.User{}).
-				Where("role = ? AND banned = ? AND id <> ?", model.RoleAdmin, false, targetID).
-				Count(&otherAdmins).Error; err != nil {
-				return err
-			}
-			if otherAdmins == 0 {
-				return ErrLastAdmin
-			}
-		}
 		if err := tx.Model(&u).Update("banned", banned).Error; err != nil {
 			return err
 		}
@@ -281,6 +374,55 @@ func (s *AdminUserService) SetBanned(operatorID, targetID uint, banned bool) (*A
 	return s.getItem(s.db, targetID)
 }
 
+// RecordLogin 记录一次登录尝试（成功/失败都写）。失败时用户可能不存在，
+// userID 传 0，username 仍落库便于异常登录排查
+func (s *AdminUserService) RecordLogin(userID uint, username, ip, ua string, success bool) {
+	if len([]rune(ua)) > 500 {
+		ua = string([]rune(ua)[:500])
+	}
+	log := model.LoginLog{
+		UserID:    userID,
+		Username:  truncateStr(username, 128),
+		IP:        truncateStr(ip, 45),
+		UserAgent: ua,
+		Success:   success,
+	}
+	// Select 强制写入全部字段：Success=false 是 Go 零值，
+	// 否则 GORM 会因 default 标签省略该列，导致失败记录被写成默认值
+	_ = s.db.Select("user_id", "username", "ip", "user_agent", "success", "created_at").
+		Create(&log).Error // 审计写失败不应阻断登录
+}
+
+// ListLoginLogs 查询某用户的登录历史（最近在前）
+func (s *AdminUserService) ListLoginLogs(targetID uint, page, size int) ([]model.LoginLog, int64, error) {
+	if page < 1 {
+		page = 1
+	}
+	if size < 1 || size > 50 {
+		size = 15
+	}
+	q := s.db.Model(&model.LoginLog{}).Where("user_id = ?", targetID)
+	var total int64
+	if err := q.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	var logs []model.LoginLog
+	if err := q.Order("created_at DESC").
+		Offset((page - 1) * size).Limit(size).
+		Find(&logs).Error; err != nil {
+		return nil, 0, err
+	}
+	return logs, total, nil
+}
+
+func truncateStr(s string, n int) string {
+	r := []rune(s)
+	if len(r) > n {
+		return string(r[:n])
+	}
+	return s
+}
+
 // invalidateUserSessions 在事务内递增 token_version 并撤销全部 refresh token，
 // 与 AuthService 的强制下线逻辑等价（封禁/管理员降级时调用）
 func invalidateUserSessions(tx *gorm.DB, userID uint) error {

backend/service/auth.go

@@ -21,9 +21,6 @@ import (
 )
 
 const (
-	RoleUser  = "user"
-	RoleAdmin = "admin"
-
 	// CSRFHeaderName 前端传递 CSRF token 的 header 名
 	CSRFHeaderName = "X-CSRF-Token"
 

backend/service/checkin.go

@@ -20,9 +20,9 @@ var ErrAlreadyCheckedIn = errors.New("今日已签到")
 // CheckinStatus 签到状态（首页右栏与签到接口共用）
 type CheckinStatus struct {
 	CheckedToday bool `json:"checked_today"`
-	Streak       int  `json:"streak"`        // 连续签到天数
-	TotalPoints  int  `json:"total_points"`  // 累计积分（签到所得）
-	TodayPoints  int  `json:"today_points"`  // 今日签到可得积分
+	Streak       int  `json:"streak"`       // 连续签到天数
+	TotalPoints  int  `json:"total_points"` // 累计积分（签到所得）
+	TodayPoints  int  `json:"today_points"` // 今日签到可得积分
 }
 
 // CheckinService 每日签到

backend/service/comment.go

@@ -9,6 +9,12 @@ import (
 	"gorm.io/gorm"
 )
 
+// 评论操作错误
+var (
+	ErrCommentNotFound  = errors.New("评论不存在")
+	ErrCommentForbidden = errors.New("无权限删除此评论")
+)
+
 // CommentService 评论服务
 type CommentService struct {
 	db *gorm.DB
@@ -114,25 +120,33 @@ func (s *CommentService) ListFloorPaged(postID uint, page, size int) ([]CommentN
 	return result, floors, totalComments, nil
 }
 
-// Create 创建评论（parentID 为 nil 时发主评论/楼层，否则发为对应评论的子回复）
+// Create 创建评论（parentID 为 nil 时发主评论/楼层，否则发为对应评论的子回复）。
+// status 由 handler 按角色计算：管理团队直发 published，普通用户进入 pending；
+// pending 评论不计入 comment_count，审核通过时才 +1。
 // 返回：新评论、父评论（子回复时非 nil，供通知定位被回复人）
-func (s *CommentService) Create(userID, postID uint, content string, parentID *uint) (*model.Comment, *model.Comment, error) {
+func (s *CommentService) Create(userID, postID uint, content string, parentID *uint, status string) (*model.Comment, *model.Comment, error) {
 	content = strings.TrimSpace(content)
 	if content == "" {
 		return nil, nil, errors.New("评论内容不能为空")
 	}
+	if status != model.ContentStatusPending && status != model.ContentStatusPublished {
+		status = model.ContentStatusPending
+	}
 
-	// 检查帖子是否存在且未锁定评论
+	// 检查帖子存在且已发布（待审/被拒帖子不接受评论）
 	var post model.Post
 	if err := s.db.First(&post, postID).Error; err != nil {
 		return nil, nil, errors.New("帖子不存在")
 	}
+	if post.Status != model.ContentStatusPublished {
+		return nil, nil, errors.New("帖子不存在")
+	}
 
 	comment := &model.Comment{
 		PostID:  postID,
 		UserID:  userID,
 		Content: content,
-		Status:  model.ContentStatusPublished,
+		Status:  status,
 	}
 
 	// 子回复：校验父评论（同帖、已发布），继承楼层根与层级
@@ -159,8 +173,10 @@ func (s *CommentService) Create(userID, postID uint, content string, parentID *u
 	if err := s.db.Create(comment).Error; err != nil {
 		return nil, nil, err
 	}
-	// 更新帖子评论数
-	s.db.Model(&post).UpdateColumn("comment_count", gorm.Expr("comment_count + 1"))
+	// 仅已发布评论立即计入评论数；待审评论通过审核时才 +1
+	if comment.Status == model.ContentStatusPublished {
+		s.db.Model(&post).UpdateColumn("comment_count", gorm.Expr("comment_count + 1"))
+	}
 	// 预加载用户
 	s.db.Preload("User").First(comment, comment.ID)
 	return comment, parent, nil
@@ -210,15 +226,22 @@ func (s *CommentService) CountByUser(userID uint) (int64, error) {
 	return total, err
 }
 
-// Delete 删除评论（仅作者或管理员可操作），级联软删整棵子树
-func (s *CommentService) Delete(commentID, userID uint, role string) error {
+// Delete 删除评论（作者本人，或对帖子所属板块有审核权的管理成员），
+// 级联软删整棵子树
+func (s *CommentService) Delete(actor *Actor, commentID, userID uint) error {
 	var comment model.Comment
 	if err := s.db.First(&comment, commentID).Error; err != nil {
-		return errors.New("评论不存在")
+		return ErrCommentNotFound
 	}
-	// 权限校验：作者本人或管理员
-	if comment.UserID != userID && role != RoleAdmin {
-		return errors.New("无权限删除此评论")
+	// 权限校验：作者本人或板块审核权
+	if comment.UserID != userID {
+		var post model.Post
+		if err := s.db.Select("id", "board_id").First(&post, comment.PostID).Error; err != nil {
+			return ErrCommentNotFound
+		}
+		if !actor.CanModerateBoard(post.BoardID) {
+			return ErrCommentForbidden
+		}
 	}
 	// 收集子树：取同楼层全部评论，多轮标记出以目标为祖先的集合（含自身，深度有限必然收敛）
 	var all []model.Comment
@@ -247,11 +270,27 @@ func (s *CommentService) Delete(commentID, userID uint, role string) error {
 	for id := range descendants {
 		ids = append(ids, id)
 	}
-	// 软删子树并按实际条数递减帖子评论数
+	// 只有已发布评论曾计入 comment_count，递减时排除待审/被拒评论。
+	// all 含同楼层全部子评论（删除主评论时目标自身不在 all 内，需单独计入）
+	publishedCnt := 0
+	if comment.Status == model.ContentStatusPublished {
+		publishedCnt++
+	}
+	for _, c := range all {
+		if c.ID == comment.ID {
+			continue
+		}
+		if descendants[c.ID] && c.Status == model.ContentStatusPublished {
+			publishedCnt++
+		}
+	}
+	// 软删子树并按已发布条数递减帖子评论数
 	if err := s.db.Delete(&model.Comment{}, ids).Error; err != nil {
 		return err
 	}
-	s.db.Model(&model.Post{}).Where("id = ?", comment.PostID).
-		UpdateColumn("comment_count", gorm.Expr("GREATEST(comment_count - ?, 0)", len(ids)))
+	if publishedCnt > 0 {
+		s.db.Model(&model.Post{}).Where("id = ?", comment.PostID).
+			UpdateColumn("comment_count", gorm.Expr("GREATEST(comment_count - ?, 0)", publishedCnt))
+	}
 	return nil
 }

backend/service/moderation.go

@@ -0,0 +1,277 @@
+package service
+
+import (
+	"errors"
+	"time"
+
+	"github.com/freefire/jiang13-bbs/model"
+	"gorm.io/gorm"
+)
+
+// 内容审核相关错误
+var (
+	ErrModerationForbidden = errors.New("无权审核该板块的内容")
+	ErrNotPending          = errors.New("该内容不在待审核状态")
+)
+
+// ModerationService 帖子/评论审核队列
+type ModerationService struct {
+	db    *gorm.DB
+	notif *NotificationService
+}
+
+func NewModerationService(db *gorm.DB, notif *NotificationService) *ModerationService {
+	return &ModerationService{db: db, notif: notif}
+}
+
+// PendingCommentItem 待审评论列表项（带上所属帖子与板块，便于按板块隔离与展示）
+type PendingCommentItem struct {
+	ID        uint        `json:"id"`
+	PostID    uint        `json:"post_id"`
+	PostTitle string      `json:"post_title"`
+	BoardID   uint        `json:"board_id"`
+	Board     model.Board `json:"board"`
+	Content   string      `json:"content"`
+	CreatedAt time.Time   `json:"created_at"`
+	User      model.User  `json:"user"`
+}
+
+// boardScope 板块管理员只能看到/操作被授权板块；管理员及以上不限
+func boardScope(q *gorm.DB, actor *Actor) *gorm.DB {
+	if actor.Role == model.RoleBoardAdmin {
+		return q.Where("board_id IN ?", actor.BoardIDs)
+	}
+	return q
+}
+
+// PendingPosts 待审核帖子分页
+func (s *ModerationService) PendingPosts(actor *Actor, page, size int) ([]model.Post, int64, error) {
+	if page < 1 {
+		page = 1
+	}
+	if size < 1 || size > 50 {
+		size = 15
+	}
+	q := s.db.Model(&model.Post{}).Where("status = ?", model.ContentStatusPending)
+	q = boardScope(q, actor)
+	var total int64
+	if err := q.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	var posts []model.Post
+	if err := q.Order("created_at ASC").
+		Offset((page - 1) * size).Limit(size).
+		Preload("Board").Preload("User").
+		Find(&posts).Error; err != nil {
+		return nil, 0, err
+	}
+	return posts, total, nil
+}
+
+// PendingComments 待审核评论分页（JOIN 帖子取板块与标题）
+func (s *ModerationService) PendingComments(actor *Actor, page, size int) ([]PendingCommentItem, int64, error) {
+	if page < 1 {
+		page = 1
+	}
+	if size < 1 || size > 50 {
+		size = 15
+	}
+	base := s.db.Table("comments").
+		Joins("JOIN posts ON posts.id = comments.post_id").
+		Where("comments.status = ? AND comments.deleted_at IS NULL AND posts.deleted_at IS NULL",
+			model.ContentStatusPending)
+	if actor.Role == model.RoleBoardAdmin {
+		base = base.Where("posts.board_id IN ?", actor.BoardIDs)
+	}
+	var total int64
+	if err := base.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	type row struct {
+		ID        uint
+		PostID    uint
+		PostTitle string
+		BoardID   uint
+		Content   string
+		CreatedAt time.Time
+		UserID    uint
+	}
+	var rows []row
+	if err := base.Select("comments.id, comments.post_id, posts.title AS post_title, posts.board_id, " +
+		"comments.content, comments.created_at, comments.user_id").
+		Order("comments.created_at ASC").
+		Offset((page - 1) * size).Limit(size).
+		Scan(&rows).Error; err != nil {
+		return nil, 0, err
+	}
+	items := make([]PendingCommentItem, 0, len(rows))
+	if len(rows) > 0 {
+		userIDs := map[uint]bool{}
+		boardIDs := map[uint]bool{}
+		for _, r := range rows {
+			userIDs[r.UserID] = true
+			if r.BoardID > 0 {
+				boardIDs[r.BoardID] = true
+			}
+		}
+		var users []model.User
+		s.db.Where("id IN ?", keys(userIDs)).Find(&users)
+		userMap := map[uint]model.User{}
+		for _, u := range users {
+			userMap[u.ID] = u
+		}
+		var boards []model.Board
+		s.db.Where("id IN ?", keys(boardIDs)).Find(&boards)
+		boardMap := map[uint]model.Board{}
+		for _, b := range boards {
+			boardMap[b.ID] = b
+		}
+		for _, r := range rows {
+			items = append(items, PendingCommentItem{
+				ID:        r.ID,
+				PostID:    r.PostID,
+				PostTitle: r.PostTitle,
+				BoardID:   r.BoardID,
+				Board:     boardMap[r.BoardID],
+				Content:   r.Content,
+				CreatedAt: r.CreatedAt,
+				User:      userMap[r.UserID],
+			})
+		}
+	}
+	return items, total, nil
+}
+
+// PendingCounts 当前操作者可见的待审数量（导航角标）
+func (s *ModerationService) PendingCounts(actor *Actor) (posts int64, comments int64) {
+	q := s.db.Model(&model.Post{}).Where("status = ?", model.ContentStatusPending)
+	boardScope(q, actor).Count(&posts)
+
+	cq := s.db.Table("comments").
+		Joins("JOIN posts ON posts.id = comments.post_id").
+		Where("comments.status = ? AND comments.deleted_at IS NULL AND posts.deleted_at IS NULL",
+			model.ContentStatusPending)
+	if actor.Role == model.RoleBoardAdmin {
+		cq = cq.Where("posts.board_id IN ?", actor.BoardIDs)
+	}
+	cq.Count(&comments)
+	return
+}
+
+// ApprovePost 帖子审核通过
+func (s *ModerationService) ApprovePost(actor *Actor, id uint) error {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var post model.Post
+		if err := tx.First(&post, id).Error; err != nil {
+			return err
+		}
+		if !actor.CanModerateBoard(post.BoardID) {
+			return ErrModerationForbidden
+		}
+		if post.Status != model.ContentStatusPending {
+			return ErrNotPending
+		}
+		if err := tx.Model(&post).Update("status", model.ContentStatusPublished).Error; err != nil {
+			return err
+		}
+		s.notif.Create(post.UserID, actor.ID, model.NotificationTypeApproved, post.ID, 0,
+			"你的帖子《"+post.Title+"》已通过审核")
+		return nil
+	})
+}
+
+// RejectPost 帖子审核拒绝（标记 rejected，不物理删除；作者仍可在详情页看到结果）
+func (s *ModerationService) RejectPost(actor *Actor, id uint) error {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var post model.Post
+		if err := tx.First(&post, id).Error; err != nil {
+			return err
+		}
+		if !actor.CanModerateBoard(post.BoardID) {
+			return ErrModerationForbidden
+		}
+		if post.Status != model.ContentStatusPending {
+			return ErrNotPending
+		}
+		if err := tx.Model(&post).Update("status", model.ContentStatusRejected).Error; err != nil {
+			return err
+		}
+		s.notif.Create(post.UserID, actor.ID, model.NotificationTypeRejected, post.ID, 0,
+			"你的帖子《"+post.Title+"》未通过审核")
+		return nil
+	})
+}
+
+// ApproveComment 评论审核通过（通过时才计入帖子评论数）
+func (s *ModerationService) ApproveComment(actor *Actor, id uint) error {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var cm model.Comment
+		if err := tx.First(&cm, id).Error; err != nil {
+			return err
+		}
+		var post model.Post
+		if err := tx.Select("id", "board_id", "title").First(&post, cm.PostID).Error; err != nil {
+			return err
+		}
+		if !actor.CanModerateBoard(post.BoardID) {
+			return ErrModerationForbidden
+		}
+		if cm.Status != model.ContentStatusPending {
+			return ErrNotPending
+		}
+		if err := tx.Model(&cm).Update("status", model.ContentStatusPublished).Error; err != nil {
+			return err
+		}
+		if err := tx.Model(&model.Post{}).Where("id = ?", cm.PostID).
+			UpdateColumn("comment_count", gorm.Expr("comment_count + 1")).Error; err != nil {
+			return err
+		}
+		s.notif.Create(cm.UserID, actor.ID, model.NotificationTypeApproved, cm.PostID, cm.ID,
+			"你在帖子《"+post.Title+"》下的评论已通过审核")
+		// 评论此时才公开，补发送业务通知（以评论者为 actor）：
+		// 主评论通知帖子作者；子回复通知父评论作者
+		if cm.ParentID == nil {
+			s.notif.Create(post.UserID, cm.UserID, model.NotificationTypeComment, cm.PostID, cm.ID, cm.Content)
+		} else {
+			var parent model.Comment
+			if err := tx.Select("user_id").First(&parent, *cm.ParentID).Error; err == nil {
+				s.notif.Create(parent.UserID, cm.UserID, model.NotificationTypeReply, cm.PostID, cm.ID, cm.Content)
+			}
+		}
+		return nil
+	})
+}
+
+// RejectComment 评论审核拒绝
+func (s *ModerationService) RejectComment(actor *Actor, id uint) error {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var cm model.Comment
+		if err := tx.First(&cm, id).Error; err != nil {
+			return err
+		}
+		var post model.Post
+		if err := tx.Select("id", "board_id", "title").First(&post, cm.PostID).Error; err != nil {
+			return err
+		}
+		if !actor.CanModerateBoard(post.BoardID) {
+			return ErrModerationForbidden
+		}
+		if cm.Status != model.ContentStatusPending {
+			return ErrNotPending
+		}
+		if err := tx.Model(&cm).Update("status", model.ContentStatusRejected).Error; err != nil {
+			return err
+		}
+		s.notif.Create(cm.UserID, actor.ID, model.NotificationTypeRejected, cm.PostID, cm.ID,
+			"你在帖子《"+post.Title+"》下的评论未通过审核")
+		return nil
+	})
+}
+
+func keys(m map[uint]bool) []uint {
+	out := make([]uint, 0, len(m))
+	for k := range m {
+		out = append(out, k)
+	}
+	return out
+}

backend/service/overview.go

@@ -25,7 +25,7 @@ type OverviewStats struct {
 	TodayPosts    int64 `json:"today_posts"`
 	TodayUsers    int64 `json:"today_users"`
 	TodayComments int64 `json:"today_comments"`
-	Online        int64 `json:"online"`     // 近 5 分钟活跃用户
+	Online        int64 `json:"online"`      // 近 5 分钟活跃用户
 	PeakOnline    int64 `json:"peak_online"` // 历史在线峰值
 }
 
@@ -65,13 +65,13 @@ type NewUserItem struct {
 
 // OverviewData 首页聚合数据
 type OverviewData struct {
-	Stats         OverviewStats       `json:"stats"`
-	Hot           []PostListItem      `json:"hot"`
-	ActiveUsers   []ActiveUser        `json:"active_users"`
-	Boards        []BoardCount        `json:"boards"`
-	Announcements []AnnouncementItem  `json:"announcements"`
-	NewUsers      []NewUserItem       `json:"new_users"`
-	Checkin       *CheckinStatus      `json:"checkin,omitempty"`
+	Stats         OverviewStats      `json:"stats"`
+	Hot           []PostListItem     `json:"hot"`
+	ActiveUsers   []ActiveUser       `json:"active_users"`
+	Boards        []BoardCount       `json:"boards"`
+	Announcements []AnnouncementItem `json:"announcements"`
+	NewUsers      []NewUserItem      `json:"new_users"`
+	Checkin       *CheckinStatus     `json:"checkin,omitempty"`
 }
 
 const (

backend/service/post.go

@@ -9,6 +9,12 @@ import (
 	"gorm.io/gorm"
 )
 
+// 帖子操作错误
+var (
+	ErrPostNotFound  = errors.New("帖子不存在")
+	ErrPostForbidden = errors.New("无权限操作此帖子")
+)
+
 // PostService 帖子服务
 type PostService struct {
 	db *gorm.DB
@@ -67,14 +73,14 @@ type PostListItem struct {
 	PostType     string         `json:"post_type"`
 	Pinned       int            `json:"pinned"`
 	Recommended  bool           `json:"recommended"`
-	LikeCount    int           `json:"like_count"`
-	ViewCount    int           `json:"view_count"`
-	CommentCount int           `json:"comment_count"`
-	Liked        bool          `json:"liked"`
-	CreatedAt    time.Time     `json:"created_at"`
+	LikeCount    int            `json:"like_count"`
+	ViewCount    int            `json:"view_count"`
+	CommentCount int            `json:"comment_count"`
+	Liked        bool           `json:"liked"`
+	CreatedAt    time.Time      `json:"created_at"`
 	LastReply    *LastReplyInfo `json:"last_reply,omitempty"`
-	Board        model.Board   `json:"board"`
-	User         model.User    `json:"user"`
+	Board        model.Board    `json:"board"`
+	User         model.User     `json:"user"`
 }
 
 // fillLastReply 批量填充每帖最后一条已发布评论（发帖人+时间），
@@ -263,19 +269,51 @@ func (s *PostService) ToggleRecommend(id uint) (bool, error) {
 	return newVal, nil
 }
 
-// GetByID 获取帖子详情
-func (s *PostService) GetByID(id uint) (*model.Post, error) {
+// visibleTo 非已发布帖子仅作者本人或对该板块有审核权的管理成员可见。
+// loadActor 为懒加载回调：仅访问非已发布帖且访问者非作者时才触发，避免常规浏览多查 DB
+func visibleToPost(post *model.Post, viewerID uint, loadActor func() *Actor) bool {
+	if post.Status == model.ContentStatusPublished {
+		return true
+	}
+	if viewerID > 0 && post.UserID == viewerID {
+		return true
+	}
+	if loadActor == nil {
+		return false
+	}
+	return loadActor().CanModerateBoard(post.BoardID)
+}
+
+// GetByIDForViewer 获取帖子详情（带可见性校验）；通过校验才计入浏览量。
+// viewerID 为当前登录用户（未登录传 0），loadActor 可传 nil
+func (s *PostService) GetByIDForViewer(id, viewerID uint, loadActor func() *Actor) (*model.Post, error) {
 	var post model.Post
 	if err := s.db.Preload("Board").Preload("User").First(&post, id).Error; err != nil {
-		return nil, err
+		return nil, ErrPostNotFound
 	}
-	// 增加浏览量
+	if !visibleToPost(&post, viewerID, loadActor) {
+		return nil, ErrPostNotFound
+	}
+	// 增加浏览量（待审/被拒内容不计）
 	s.db.Model(&post).UpdateColumn("view_count", gorm.Expr("view_count + 1"))
 	return &post, nil
 }
 
-// Create 创建帖子
-func (s *PostService) Create(userID uint, boardID uint, title, content, tags, postType string) (*model.Post, error) {
+// EnsurePostVisible 校验帖子对当前访问者可见（评论列表等场景复用，不增加浏览量）
+func (s *PostService) EnsurePostVisible(postID, viewerID uint, loadActor func() *Actor) error {
+	var post model.Post
+	if err := s.db.Select("id", "user_id", "board_id", "status").First(&post, postID).Error; err != nil {
+		return ErrPostNotFound
+	}
+	if !visibleToPost(&post, viewerID, loadActor) {
+		return ErrPostNotFound
+	}
+	return nil
+}
+
+// Create 创建帖子。status 由 handler 按角色计算：
+// 管理团队成员直发 published，普通用户进入 pending 等待审核
+func (s *PostService) Create(userID uint, boardID uint, title, content, tags, postType, status string) (*model.Post, error) {
 	title = strings.TrimSpace(title)
 	content = strings.TrimSpace(content)
 	if title == "" {
@@ -287,6 +325,9 @@ func (s *PostService) Create(userID uint, boardID uint, title, content, tags, po
 	if boardID == 0 {
 		return nil, errors.New("请选择板块")
 	}
+	if status != model.ContentStatusPending && status != model.ContentStatusPublished {
+		status = model.ContentStatusPending
+	}
 
 	// 新用户 24h 冷静期校验
 	if err := s.checkNewUserCooldown(userID); err != nil {
@@ -300,7 +341,7 @@ func (s *PostService) Create(userID uint, boardID uint, title, content, tags, po
 		Content:  content,
 		Tags:     tags,
 		PostType: postType,
-		Status:   model.ContentStatusPublished,
+		Status:   status,
 	}
 	if err := s.db.Create(post).Error; err != nil {
 		return nil, err
@@ -323,15 +364,15 @@ func (s *PostService) checkNewUserCooldown(userID uint) error {
 	return nil
 }
 
-// Update 更新帖子（仅作者或管理员可操作）
-func (s *PostService) Update(postID, userID uint, role string, title, content, tags string) (*model.Post, error) {
+// Update 更新帖子（作者本人，或对该板块有审核权的管理成员）
+func (s *PostService) Update(actor *Actor, postID, userID uint, title, content, tags string) (*model.Post, error) {
 	var post model.Post
 	if err := s.db.First(&post, postID).Error; err != nil {
-		return nil, errors.New("帖子不存在")
+		return nil, ErrPostNotFound
 	}
-	// 权限校验：作者本人或管理员
-	if post.UserID != userID && role != RoleAdmin {
-		return nil, errors.New("无权限编辑此帖子")
+	// 权限校验：作者本人或板块审核权
+	if post.UserID != userID && !actor.CanModerateBoard(post.BoardID) {
+		return nil, ErrPostForbidden
 	}
 
 	updates := map[string]interface{}{}
@@ -358,15 +399,15 @@ func (s *PostService) Update(postID, userID uint, role string, title, content, t
 	return &post, nil
 }
 
-// Delete 删除帖子（仅作者或管理员可操作）
-func (s *PostService) Delete(postID, userID uint, role string) error {
+// Delete 删除帖子（作者本人，或对该板块有审核权的管理成员）
+func (s *PostService) Delete(actor *Actor, postID, userID uint) error {
 	var post model.Post
 	if err := s.db.First(&post, postID).Error; err != nil {
-		return errors.New("帖子不存在")
+		return ErrPostNotFound
 	}
-	// 权限校验：作者本人或管理员
-	if post.UserID != userID && role != RoleAdmin {
-		return errors.New("无权限删除此帖子")
+	// 权限校验：作者本人或板块审核权
+	if post.UserID != userID && !actor.CanModerateBoard(post.BoardID) {
+		return ErrPostForbidden
 	}
 	// 软删除（gorm DeletedAt）
 	if err := s.db.Delete(&post).Error; err != nil {

backend/service/ratelimit.go

@@ -71,9 +71,9 @@ const (
 // DefaultRateLimiter 创建默认速率限制器
 func DefaultRateLimiter() *RateLimiter {
 	rl := NewRateLimiter()
-	rl.SetLimit(RateLogin, 20)     // 登录 20/分钟
-	rl.SetLimit(RateRegister, 10)  // 注册 10/分钟
-	rl.SetLimit(RatePost, 10)      // 发帖 10/分钟
-	rl.SetLimit(RateComment, 30)   // 评论 30/分钟
+	rl.SetLimit(RateLogin, 20)    // 登录 20/分钟
+	rl.SetLimit(RateRegister, 10) // 注册 10/分钟
+	rl.SetLimit(RatePost, 10)     // 发帖 10/分钟
+	rl.SetLimit(RateComment, 30)  // 评论 30/分钟
 	return rl
 }