feat: add ads/sponsor/captcha modules and polish home & chat UI

2026-09-23 04:39:58 +08:00
parent 96314893bb
commit c1f6a6636b
27 changed files with 4278 additions and 121 deletions
--- a/backend/service/ad.go
+++ b/backend/service/ad.go
@@ -0,0 +1,580 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"net/mail"
+	"net/url"
+	"regexp"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/freefire/jiang13-bbs/model"
+	"gorm.io/gorm"
+)
+
+const (
+	SettingKeyAdsConfig = "ads_config"
+
+	AdMaxTitleRunes  = 24
+	AdMaxNoteRunes   = 100
+	AdMaxImageShow   = 5
+	AdMaxTextShow    = 6
+	AdMaxActiveShow  = AdMaxImageShow + AdMaxTextShow
+	AdDefaultTitle   = "自助推广"
+)
+
+var (
+	ErrAdNotFound      = errors.New("广告不存在")
+	ErrAdForbidden     = errors.New("无权操作")
+	ErrAdInvalid       = errors.New("广告参数无效")
+	ErrAdCaptcha       = errors.New("验证码错误或已过期")
+	ErrAdDisabled      = errors.New("自助推广暂未开放")
+	ErrAdBadPayment    = errors.New("请选择有效的支付方式")
+	ErrAdBadDuration   = errors.New("请选择有效的投放时长")
+	hexColorRe         = regexp.MustCompile(`^#([0-9a-fA-F]{6})$`)
+	adImageHTTPSRe     = regexp.MustCompile(`(?i)^https://[^\s\\]{1,500}$`)
+	adImageUploadRe    = regexp.MustCompile(`(?i)^/uploads/(ads|images|brand)/[0-9a-f]{32}\.(png|jpe?g|gif|webp)$`)
+)
+
+// AdDurationOption 可购时长档位
+type AdDurationOption struct {
+	Days      int    `json:"days"`
+	Label     string `json:"label"`
+	PriceHint string `json:"price_hint"`
+}
+
+// AdPaymentOption 收款方式（展示二维码，人工确认）
+type AdPaymentOption struct {
+	ID      string `json:"id"`
+	Name    string `json:"name"`
+	Kind    string `json:"kind"` // alipay | wechat | other
+	QRURL   string `json:"qr_url"`
+	Hint    string `json:"hint"`
+	Enabled bool   `json:"enabled"`
+}
+
+// AdConfig 广告位运营配置
+type AdConfig struct {
+	Enabled    bool               `json:"enabled"`
+	PanelTitle string             `json:"panel_title"`
+	Durations  []AdDurationOption `json:"durations"`
+	Payments   []AdPaymentOption  `json:"payments"`
+}
+
+func DefaultAdConfig() AdConfig {
+	return AdConfig{
+		Enabled:    true,
+		PanelTitle: AdDefaultTitle,
+		Durations: []AdDurationOption{
+			{Days: 30, Label: "1 个月", PriceHint: ""},
+			{Days: 60, Label: "2 个月", PriceHint: ""},
+			{Days: 90, Label: "3 个月", PriceHint: ""},
+			{Days: 180, Label: "6 个月", PriceHint: ""},
+			{Days: 365, Label: "12 个月", PriceHint: ""},
+		},
+		Payments: []AdPaymentOption{},
+	}
+}
+
+// AdService 广告业务
+type AdService struct {
+	db      *gorm.DB
+	captcha *CaptchaStore
+}
+
+func NewAdService(db *gorm.DB, captcha *CaptchaStore) *AdService {
+	return &AdService{db: db, captcha: captcha}
+}
+
+func (s *AdService) Captcha() *CaptchaStore { return s.captcha }
+
+func (s *AdService) loadConfig() (AdConfig, error) {
+	var row model.SiteSetting
+	err := s.db.Where("key = ?", SettingKeyAdsConfig).First(&row).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return DefaultAdConfig(), nil
+	}
+	if err != nil {
+		return AdConfig{}, err
+	}
+	cfg := DefaultAdConfig()
+	if strings.TrimSpace(row.Value) == "" {
+		return cfg, nil
+	}
+	if err := json.Unmarshal([]byte(row.Value), &cfg); err != nil {
+		return DefaultAdConfig(), nil
+	}
+	if strings.TrimSpace(cfg.PanelTitle) == "" || cfg.PanelTitle == "赞助商" {
+		cfg.PanelTitle = AdDefaultTitle
+	}
+	if isLegacyAdDurations(cfg.Durations) {
+		cfg.Durations = DefaultAdConfig().Durations
+	}
+	for i := range cfg.Durations {
+		if strings.TrimSpace(cfg.Durations[i].PriceHint) == "面议" {
+			cfg.Durations[i].PriceHint = ""
+		}
+	}
+	return cfg, nil
+}
+
+func (s *AdService) GetConfig() (AdConfig, error) {
+	return s.loadConfig()
+}
+
+// PublicConfig 购买页可见配置（仅启用的支付方式）
+func (s *AdService) PublicConfig() (AdConfig, error) {
+	cfg, err := s.loadConfig()
+	if err != nil {
+		return cfg, err
+	}
+	pays := make([]AdPaymentOption, 0, len(cfg.Payments))
+	for _, p := range cfg.Payments {
+		if p.Enabled && strings.TrimSpace(p.QRURL) != "" {
+			pays = append(pays, p)
+		}
+	}
+	cfg.Payments = pays
+	return cfg, nil
+}
+
+func (s *AdService) SaveConfig(in AdConfig) (AdConfig, error) {
+	out, err := normalizeAdConfig(in)
+	if err != nil {
+		return AdConfig{}, err
+	}
+	b, err := json.Marshal(out)
+	if err != nil {
+		return AdConfig{}, err
+	}
+	row := model.SiteSetting{Key: SettingKeyAdsConfig, Value: string(b), UpdatedAt: time.Now()}
+	if err := s.db.Save(&row).Error; err != nil {
+		return AdConfig{}, err
+	}
+	return out, nil
+}
+
+func normalizeAdConfig(in AdConfig) (AdConfig, error) {
+	out := DefaultAdConfig()
+	out.Enabled = in.Enabled
+	title := strings.TrimSpace(in.PanelTitle)
+	if title == "" {
+		title = AdDefaultTitle
+	}
+	if utf8.RuneCountInString(title) > 16 {
+		return AdConfig{}, ErrAdInvalid
+	}
+	out.PanelTitle = title
+
+	if len(in.Durations) == 0 || len(in.Durations) > 12 {
+		return AdConfig{}, errors.New("请配置 1–12 个时长档位")
+	}
+	durs := make([]AdDurationOption, 0, len(in.Durations))
+	seenDays := map[int]struct{}{}
+	for _, d := range in.Durations {
+		if d.Days < 1 || d.Days > 366 {
+			return AdConfig{}, errors.New("时长须为 1–366 天")
+		}
+		if _, ok := seenDays[d.Days]; ok {
+			return AdConfig{}, errors.New("时长档位不可重复")
+		}
+		seenDays[d.Days] = struct{}{}
+		label := strings.TrimSpace(d.Label)
+		if label == "" {
+			label = formatDaysLabel(d.Days)
+		}
+		if utf8.RuneCountInString(label) > 20 {
+			return AdConfig{}, ErrAdInvalid
+		}
+		price := strings.TrimSpace(d.PriceHint)
+		if price == "面议" {
+			price = ""
+		}
+		if utf8.RuneCountInString(price) > 32 {
+			return AdConfig{}, ErrAdInvalid
+		}
+		durs = append(durs, AdDurationOption{Days: d.Days, Label: label, PriceHint: price})
+	}
+	out.Durations = durs
+
+	if len(in.Payments) > 8 {
+		return AdConfig{}, errors.New("支付方式最多 8 个")
+	}
+	pays := make([]AdPaymentOption, 0, len(in.Payments))
+	seenID := map[string]struct{}{}
+	for i, p := range in.Payments {
+		id := strings.TrimSpace(p.ID)
+		if id == "" {
+			id = "pay_" + strings.TrimSpace(strings.ToLower(p.Kind)) + "_" + itoa(i+1)
+		}
+		if !regexp.MustCompile(`^[a-zA-Z0-9_-]{2,32}$`).MatchString(id) {
+			return AdConfig{}, errors.New("支付方式 ID 非法")
+		}
+		if _, ok := seenID[id]; ok {
+			return AdConfig{}, errors.New("支付方式 ID 重复")
+		}
+		seenID[id] = struct{}{}
+		name := strings.TrimSpace(p.Name)
+		if name == "" || utf8.RuneCountInString(name) > 20 {
+			return AdConfig{}, errors.New("支付方式名称无效")
+		}
+		kind := strings.TrimSpace(strings.ToLower(p.Kind))
+		switch kind {
+		case "alipay", "wechat", "other":
+		default:
+			return AdConfig{}, errors.New("支付类型须为 alipay / wechat / other")
+		}
+		qr, ok := normalizeAdAssetURL(p.QRURL, true)
+		if p.Enabled && !ok {
+			return AdConfig{}, errors.New("启用中的支付方式须配置有效收款码图片")
+		}
+		if !p.Enabled && strings.TrimSpace(p.QRURL) != "" && !ok {
+			return AdConfig{}, errors.New("收款码图片地址无效")
+		}
+		if !ok {
+			qr = ""
+		}
+		hint := strings.TrimSpace(p.Hint)
+		if utf8.RuneCountInString(hint) > 80 {
+			return AdConfig{}, ErrAdInvalid
+		}
+		pays = append(pays, AdPaymentOption{
+			ID: id, Name: name, Kind: kind, QRURL: qr, Hint: hint, Enabled: p.Enabled,
+		})
+	}
+	out.Payments = pays
+	return out, nil
+}
+
+// isLegacyAdDurations 识别早期默认 7/30/90 天档位，读出时换成月档
+func isLegacyAdDurations(durs []AdDurationOption) bool {
+	if len(durs) != 3 {
+		return false
+	}
+	return durs[0].Days == 7 && durs[1].Days == 30 && durs[2].Days == 90
+}
+
+func formatDaysLabel(days int) string {
+	switch days {
+	case 30:
+		return "1 个月"
+	case 60:
+		return "2 个月"
+	case 90:
+		return "3 个月"
+	case 180:
+		return "6 个月"
+	case 365:
+		return "12 个月"
+	default:
+		return itoa(days) + " 天"
+	}
+}
+
+func itoa(n int) string {
+	if n == 0 {
+		return "0"
+	}
+	var b [12]byte
+	i := len(b)
+	neg := n < 0
+	if neg {
+		n = -n
+	}
+	for n > 0 {
+		i--
+		b[i] = byte('0' + n%10)
+		n /= 10
+	}
+	if neg {
+		i--
+		b[i] = '-'
+	}
+	return string(b[i:])
+}
+
+func normalizeAdAssetURL(raw string, allowEmpty bool) (string, bool) {
+	u := strings.TrimSpace(raw)
+	if u == "" {
+		return "", allowEmpty
+	}
+	if adImageUploadRe.MatchString(u) {
+		return u, true
+	}
+	if adImageHTTPSRe.MatchString(u) {
+		parsed, err := url.Parse(u)
+		if err != nil || parsed.Host == "" {
+			return "", false
+		}
+		return u, true
+	}
+	return "", false
+}
+
+func normalizeAdLinkURL(raw string) (string, bool) {
+	u := strings.TrimSpace(raw)
+	if u == "" || utf8.RuneCountInString(u) > 500 {
+		return "", false
+	}
+	lower := strings.ToLower(u)
+	if strings.HasPrefix(lower, "javascript:") || strings.HasPrefix(lower, "data:") {
+		return "", false
+	}
+	if !strings.HasPrefix(lower, "https://") {
+		return "", false
+	}
+	parsed, err := url.Parse(u)
+	if err != nil || parsed.Host == "" {
+		return "", false
+	}
+	return u, true
+}
+
+func normalizeHexColor(raw, fallback string) (string, bool) {
+	s := strings.TrimSpace(raw)
+	if s == "" {
+		return fallback, true
+	}
+	if !hexColorRe.MatchString(s) {
+		return "", false
+	}
+	return strings.ToUpper(s), true
+}
+
+// AdSubmitInput 游客提交
+type AdSubmitInput struct {
+	Kind         string
+	ContactEmail string
+	LinkURL      string
+	ImageURL     string
+	Title        string
+	TextColor    string
+	BgColor      string
+	DurationDays int
+	PaymentID    string
+	BuyerNote    string
+	CaptchaID    string
+	CaptchaCode  string
+	IP           string
+}
+
+func (s *AdService) Submit(in AdSubmitInput) (*model.Ad, error) {
+	cfg, err := s.loadConfig()
+	if err != nil {
+		return nil, err
+	}
+	if !cfg.Enabled {
+		return nil, ErrAdDisabled
+	}
+	if s.captcha == nil || !s.captcha.Verify(in.CaptchaID, in.CaptchaCode) {
+		return nil, ErrAdCaptcha
+	}
+
+	kind := strings.TrimSpace(in.Kind)
+	if kind != model.AdKindImage && kind != model.AdKindText {
+		return nil, ErrAdInvalid
+	}
+
+	email := strings.TrimSpace(in.ContactEmail)
+	if _, err := mail.ParseAddress(email); err != nil || len(email) > 128 {
+		return nil, errors.New("请填写有效的联系邮箱")
+	}
+	link, ok := normalizeAdLinkURL(in.LinkURL)
+	if !ok {
+		return nil, errors.New("广告链接须为 https 地址")
+	}
+
+	var daysOK bool
+	for _, d := range cfg.Durations {
+		if d.Days == in.DurationDays {
+			daysOK = true
+			break
+		}
+	}
+	if !daysOK {
+		return nil, ErrAdBadDuration
+	}
+
+	payOK := false
+	payID := strings.TrimSpace(in.PaymentID)
+	for _, p := range cfg.Payments {
+		if p.Enabled && p.ID == payID && strings.TrimSpace(p.QRURL) != "" {
+			payOK = true
+			break
+		}
+	}
+	if !payOK {
+		return nil, ErrAdBadPayment
+	}
+
+	note := strings.TrimSpace(in.BuyerNote)
+	if utf8.RuneCountInString(note) > AdMaxNoteRunes {
+		return nil, errors.New("备注过长")
+	}
+
+	ad := &model.Ad{
+		Kind:         kind,
+		Status:       model.AdStatusPending,
+		ContactEmail: email,
+		LinkURL:      link,
+		DurationDays: in.DurationDays,
+		PaymentID:    payID,
+		BuyerNote:    note,
+		SubmitIP:     strings.TrimSpace(in.IP),
+	}
+
+	switch kind {
+	case model.AdKindImage:
+		img, ok := normalizeAdAssetURL(in.ImageURL, false)
+		if !ok || !strings.HasPrefix(strings.ToLower(img), "https://") {
+			return nil, errors.New("图片地址须为 https（支持 png/jpg/gif/webp）")
+		}
+		ad.ImageURL = img
+	case model.AdKindText:
+		title := strings.TrimSpace(in.Title)
+		if title == "" || utf8.RuneCountInString(title) > AdMaxTitleRunes {
+			return nil, errors.New("请填写 1–24 字广告标题")
+		}
+		tc, ok := normalizeHexColor(in.TextColor, "#1E293B")
+		if !ok {
+			return nil, errors.New("文字颜色须为 #RRGGBB")
+		}
+		bc, ok := normalizeHexColor(in.BgColor, "#F1F5F9")
+		if !ok {
+			return nil, errors.New("背景颜色须为 #RRGGBB")
+		}
+		ad.Title = title
+		ad.TextColor = tc
+		ad.BgColor = bc
+	}
+
+	if err := s.db.Create(ad).Error; err != nil {
+		return nil, err
+	}
+	return ad, nil
+}
+
+// ActivePublic 侧栏展示用（自动视过期为失效；按类型各取上限）
+func (s *AdService) ActivePublic() ([]model.Ad, AdConfig, error) {
+	cfg, err := s.loadConfig()
+	if err != nil {
+		return nil, cfg, err
+	}
+	if !cfg.Enabled {
+		return []model.Ad{}, cfg, nil
+	}
+	now := time.Now()
+	_ = s.db.Model(&model.Ad{}).
+		Where("status = ? AND ends_at IS NOT NULL AND ends_at < ?", model.AdStatusActive, now).
+		Update("status", model.AdStatusExpired).Error
+
+	base := s.db.Where("status = ?", model.AdStatusActive).
+		Where("(ends_at IS NULL OR ends_at >= ?)", now).
+		Order("sort_order ASC, id DESC")
+
+	var images, texts []model.Ad
+	if err := base.Session(&gorm.Session{}).Where("kind = ?", model.AdKindImage).
+		Limit(AdMaxImageShow).Find(&images).Error; err != nil {
+		return nil, cfg, err
+	}
+	if err := base.Session(&gorm.Session{}).Where("kind = ?", model.AdKindText).
+		Limit(AdMaxTextShow).Find(&texts).Error; err != nil {
+		return nil, cfg, err
+	}
+	list := make([]model.Ad, 0, len(images)+len(texts))
+	list = append(list, images...)
+	list = append(list, texts...)
+	return list, cfg, nil
+}
+
+func (s *AdService) AdminList(status string, page, size int) ([]model.Ad, int64, error) {
+	if page < 1 {
+		page = 1
+	}
+	if size < 1 || size > 50 {
+		size = 20
+	}
+	q := s.db.Model(&model.Ad{})
+	status = strings.TrimSpace(status)
+	if status != "" {
+		q = q.Where("status = ?", status)
+	}
+	var total int64
+	if err := q.Count(&total).Error; err != nil {
+		return nil, 0, err
+	}
+	var list []model.Ad
+	err := q.Order("id DESC").Offset((page - 1) * size).Limit(size).Find(&list).Error
+	return list, total, err
+}
+
+func (s *AdService) Approve(actorID, id uint) (*model.Ad, error) {
+	var ad model.Ad
+	if err := s.db.First(&ad, id).Error; err != nil {
+		return nil, ErrAdNotFound
+	}
+	if ad.Status != model.AdStatusPending && ad.Status != model.AdStatusExpired && ad.Status != model.AdStatusRejected {
+		if ad.Status != model.AdStatusActive {
+			return nil, errors.New("当前状态不可上架")
+		}
+	}
+	now := time.Now()
+	ends := now.Add(time.Duration(ad.DurationDays) * 24 * time.Hour)
+	ad.Status = model.AdStatusActive
+	ad.StartsAt = &now
+	ad.EndsAt = &ends
+	ad.ReviewedAt = &now
+	ad.ReviewedBy = &actorID
+	ad.RejectReason = ""
+	if err := s.db.Save(&ad).Error; err != nil {
+		return nil, err
+	}
+	return &ad, nil
+}
+
+func (s *AdService) Reject(actorID, id uint, reason string) (*model.Ad, error) {
+	var ad model.Ad
+	if err := s.db.First(&ad, id).Error; err != nil {
+		return nil, ErrAdNotFound
+	}
+	if ad.Status != model.AdStatusPending && ad.Status != model.AdStatusActive {
+		return nil, errors.New("当前状态不可拒绝")
+	}
+	reason = strings.TrimSpace(reason)
+	if utf8.RuneCountInString(reason) > 100 {
+		return nil, errors.New("拒绝原因过长")
+	}
+	now := time.Now()
+	ad.Status = model.AdStatusRejected
+	ad.RejectReason = reason
+	ad.ReviewedAt = &now
+	ad.ReviewedBy = &actorID
+	if err := s.db.Save(&ad).Error; err != nil {
+		return nil, err
+	}
+	return &ad, nil
+}
+
+func (s *AdService) Delete(id uint) error {
+	res := s.db.Delete(&model.Ad{}, id)
+	if res.Error != nil {
+		return res.Error
+	}
+	if res.RowsAffected == 0 {
+		return ErrAdNotFound
+	}
+	return nil
+}
+
+func (s *AdService) SetSort(id uint, sort int) error {
+	res := s.db.Model(&model.Ad{}).Where("id = ?", id).Update("sort_order", sort)
+	if res.Error != nil {
+		return res.Error
+	}
+	if res.RowsAffected == 0 {
+		return ErrAdNotFound
+	}
+	return nil
+}
--- a/backend/service/captcha.go
+++ b/backend/service/captcha.go
@@ -0,0 +1,236 @@
+package service
+
+import (
+	"bytes"
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/hex"
+	"image"
+	"image/color"
+	"image/draw"
+	"image/png"
+	"math/big"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	captchaTTL     = 5 * time.Minute
+	captchaLen     = 5
+	captchaCharset = "ABCDEFGHJKLMNPQRSTUVWXYZ23456789" // 去掉易混 I/O/0/1
+)
+
+type captchaEntry struct {
+	answer    string
+	expiresAt time.Time
+}
+
+// CaptchaStore 内存图形验证码（单实例足够；重启后未用完的码失效）
+type CaptchaStore struct {
+	mu   sync.Mutex
+	data map[string]captchaEntry
+}
+
+func NewCaptchaStore() *CaptchaStore {
+	s := &CaptchaStore{data: make(map[string]captchaEntry)}
+	go s.loopPurge()
+	return s
+}
+
+func (s *CaptchaStore) loopPurge() {
+	t := time.NewTicker(2 * time.Minute)
+	defer t.Stop()
+	for range t.C {
+		s.mu.Lock()
+		now := time.Now()
+		for id, e := range s.data {
+			if now.After(e.expiresAt) {
+				delete(s.data, id)
+			}
+		}
+		s.mu.Unlock()
+	}
+}
+
+// Issue 生成验证码，返回 id 与 PNG data URL
+func (s *CaptchaStore) Issue() (id, dataURL string, err error) {
+	answer, err := randomCaptchaText(captchaLen)
+	if err != nil {
+		return "", "", err
+	}
+	b := make([]byte, 16)
+	if _, err := rand.Read(b); err != nil {
+		return "", "", err
+	}
+	id = hex.EncodeToString(b)
+	img, err := renderCaptchaPNG(answer)
+	if err != nil {
+		return "", "", err
+	}
+	s.mu.Lock()
+	s.data[id] = captchaEntry{answer: strings.ToUpper(answer), expiresAt: time.Now().Add(captchaTTL)}
+	s.mu.Unlock()
+	dataURL = "data:image/png;base64," + base64.StdEncoding.EncodeToString(img)
+	return id, dataURL, nil
+}
+
+// Verify 校验并立即作废（一次性）
+func (s *CaptchaStore) Verify(id, answer string) bool {
+	id = strings.TrimSpace(id)
+	answer = strings.ToUpper(strings.TrimSpace(answer))
+	if id == "" || answer == "" {
+		return false
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	e, ok := s.data[id]
+	if !ok {
+		return false
+	}
+	delete(s.data, id)
+	if time.Now().After(e.expiresAt) {
+		return false
+	}
+	return e.answer == answer
+}
+
+func randomCaptchaText(n int) (string, error) {
+	var b strings.Builder
+	max := big.NewInt(int64(len(captchaCharset)))
+	for i := 0; i < n; i++ {
+		v, err := rand.Int(rand.Reader, max)
+		if err != nil {
+			return "", err
+		}
+		b.WriteByte(captchaCharset[v.Int64()])
+	}
+	return b.String(), nil
+}
+
+func renderCaptchaPNG(text string) ([]byte, error) {
+	const w, h = 140, 44
+	img := image.NewRGBA(image.Rect(0, 0, w, h))
+	bg := color.RGBA{R: 248, G: 250, B: 252, A: 255}
+	draw.Draw(img, img.Bounds(), &image.Uniform{C: bg}, image.Point{}, draw.Src)
+
+	// 噪点
+	for i := 0; i < 180; i++ {
+		x, _ := rand.Int(rand.Reader, big.NewInt(w))
+		y, _ := rand.Int(rand.Reader, big.NewInt(h))
+		img.Set(int(x.Int64()), int(y.Int64()), color.RGBA{R: 180, G: 190, B: 200, A: 255})
+	}
+	// 干扰线
+	for i := 0; i < 4; i++ {
+		x0, _ := rand.Int(rand.Reader, big.NewInt(w))
+		y0, _ := rand.Int(rand.Reader, big.NewInt(h))
+		x1, _ := rand.Int(rand.Reader, big.NewInt(w))
+		y1, _ := rand.Int(rand.Reader, big.NewInt(h))
+		drawLine(img, int(x0.Int64()), int(y0.Int64()), int(x1.Int64()), int(y1.Int64()), color.RGBA{R: 160, G: 170, B: 185, A: 255})
+	}
+
+	fg := color.RGBA{R: 30, G: 41, B: 59, A: 255}
+	startX := 12
+	for i, ch := range text {
+		ox := startX + i*24
+		oy := 10 + int(i%2)*2
+		drawGlyph(img, ch, ox, oy, fg)
+	}
+
+	var buf bytes.Buffer
+	if err := png.Encode(&buf, img); err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+func drawLine(img *image.RGBA, x0, y0, x1, y1 int, c color.Color) {
+	dx := abs(x1 - x0)
+	dy := -abs(y1 - y0)
+	sx, sy := 1, 1
+	if x0 >= x1 {
+		sx = -1
+	}
+	if y0 >= y1 {
+		sy = -1
+	}
+	err := dx + dy
+	for {
+		img.Set(x0, y0, c)
+		if x0 == x1 && y0 == y1 {
+			break
+		}
+		e2 := 2 * err
+		if e2 >= dy {
+			err += dy
+			x0 += sx
+		}
+		if e2 <= dx {
+			err += dx
+			y0 += sy
+		}
+	}
+}
+
+func abs(v int) int {
+	if v < 0 {
+		return -v
+	}
+	return v
+}
+
+// 简易 5×7 点阵（仅验证码字符集）
+var glyphBits = map[rune][7]string{
+	'A': {"01110", "10001", "10001", "11111", "10001", "10001", "10001"},
+	'B': {"11110", "10001", "10001", "11110", "10001", "10001", "11110"},
+	'C': {"01111", "10000", "10000", "10000", "10000", "10000", "01111"},
+	'D': {"11110", "10001", "10001", "10001", "10001", "10001", "11110"},
+	'E': {"11111", "10000", "10000", "11110", "10000", "10000", "11111"},
+	'F': {"11111", "10000", "10000", "11110", "10000", "10000", "10000"},
+	'G': {"01111", "10000", "10000", "10011", "10001", "10001", "01111"},
+	'H': {"10001", "10001", "10001", "11111", "10001", "10001", "10001"},
+	'J': {"00111", "00010", "00010", "00010", "00010", "10010", "01100"},
+	'K': {"10001", "10010", "10100", "11000", "10100", "10010", "10001"},
+	'L': {"10000", "10000", "10000", "10000", "10000", "10000", "11111"},
+	'M': {"10001", "11011", "10101", "10001", "10001", "10001", "10001"},
+	'N': {"10001", "11001", "10101", "10011", "10001", "10001", "10001"},
+	'P': {"11110", "10001", "10001", "11110", "10000", "10000", "10000"},
+	'Q': {"01110", "10001", "10001", "10001", "10101", "10010", "01101"},
+	'R': {"11110", "10001", "10001", "11110", "10100", "10010", "10001"},
+	'S': {"01111", "10000", "10000", "01110", "00001", "00001", "11110"},
+	'T': {"11111", "00100", "00100", "00100", "00100", "00100", "00100"},
+	'U': {"10001", "10001", "10001", "10001", "10001", "10001", "01110"},
+	'V': {"10001", "10001", "10001", "10001", "10001", "01010", "00100"},
+	'W': {"10001", "10001", "10001", "10001", "10101", "10101", "01010"},
+	'X': {"10001", "10001", "01010", "00100", "01010", "10001", "10001"},
+	'Y': {"10001", "10001", "01010", "00100", "00100", "00100", "00100"},
+	'Z': {"11111", "00001", "00010", "00100", "01000", "10000", "11111"},
+	'2': {"01110", "10001", "00001", "00010", "00100", "01000", "11111"},
+	'3': {"11110", "00001", "00001", "01110", "00001", "00001", "11110"},
+	'4': {"00010", "00110", "01010", "10010", "11111", "00010", "00010"},
+	'5': {"11111", "10000", "11110", "00001", "00001", "10001", "01110"},
+	'6': {"01110", "10000", "10000", "11110", "10001", "10001", "01110"},
+	'7': {"11111", "00001", "00010", "00100", "01000", "01000", "01000"},
+	'8': {"01110", "10001", "10001", "01110", "10001", "10001", "01110"},
+	'9': {"01110", "10001", "10001", "01111", "00001", "00001", "01110"},
+}
+
+func drawGlyph(img *image.RGBA, ch rune, ox, oy int, c color.Color) {
+	bits, ok := glyphBits[ch]
+	if !ok {
+		return
+	}
+	scale := 2
+	for row, line := range bits {
+		for col, cell := range line {
+			if cell != '1' {
+				continue
+			}
+			for dy := 0; dy < scale; dy++ {
+				for dx := 0; dx < scale; dx++ {
+					img.Set(ox+col*scale+dx, oy+row*scale+dy, c)
+				}
+			}
+		}
+	}
+}
--- a/backend/service/overview.go
+++ b/backend/service/overview.go
@@ -10,13 +10,19 @@ import (

 // OverviewService 首页聚合服务：一次请求返回统计、热门榜、活跃用户、板块计数
 type OverviewService struct {
-	db *gorm.DB
+	db  *gorm.DB
+	ads *AdService
 }

 func NewOverviewService(db *gorm.DB) *OverviewService {
 	return &OverviewService{db: db}
 }

+func (s *OverviewService) WithAds(ads *AdService) *OverviewService {
+	s.ads = ads
+	return s
+}
+
 // OverviewStats 社区整体统计（社区脉搏卡）
 type OverviewStats struct {
 	Posts         int64 `json:"posts"`
@@ -75,6 +81,32 @@ type OverviewData struct {
 	SidebarPages       []SidebarPageItem  `json:"sidebar_pages"`
 	NewUsers           []NewUserItem      `json:"new_users"`
 	Checkin            *CheckinStatus     `json:"checkin,omitempty"`
+	Ads                []PublicAdItem     `json:"ads"`
+	AdsPanelTitle      string             `json:"ads_panel_title"`
+	AdsEnabled         bool               `json:"ads_enabled"`
+	Sponsors           []PublicSponsorItem `json:"sponsors"`
+	SponsorsPanelTitle string              `json:"sponsors_panel_title"`
+	SponsorsEnabled    bool                `json:"sponsors_enabled"`
+}
+
+// PublicAdItem 侧栏广告条目
+type PublicAdItem struct {
+	ID        uint   `json:"id"`
+	Kind      string `json:"kind"`
+	LinkURL   string `json:"link_url"`
+	ImageURL  string `json:"image_url,omitempty"`
+	Title     string `json:"title,omitempty"`
+	TextColor string `json:"text_color,omitempty"`
+	BgColor   string `json:"bg_color,omitempty"`
+}
+
+// PublicSponsorItem 侧栏赞助商
+type PublicSponsorItem struct {
+	ID        string `json:"id"`
+	Name      string `json:"name"`
+	LogoURL   string `json:"logo_url"`
+	LinkURL   string `json:"link_url,omitempty"`
+	HoverText string `json:"hover_text,omitempty"`
 }

 const (
@@ -286,6 +318,36 @@ LIMIT 5`
 		})
 	}

+	data.Ads = []PublicAdItem{}
+	data.AdsPanelTitle = AdDefaultTitle
+	data.Sponsors = []PublicSponsorItem{}
+	data.SponsorsPanelTitle = SponsorDefaultTitle
+	if s.ads != nil {
+		list, cfg, err := s.ads.ActivePublic()
+		if err == nil {
+			data.AdsEnabled = cfg.Enabled
+			data.AdsPanelTitle = cfg.PanelTitle
+			for _, a := range list {
+				data.Ads = append(data.Ads, PublicAdItem{
+					ID: a.ID, Kind: a.Kind, LinkURL: a.LinkURL,
+					ImageURL: a.ImageURL, Title: a.Title,
+					TextColor: a.TextColor, BgColor: a.BgColor,
+				})
+			}
+		}
+		scfg, slist, err := s.ads.PublicSponsors()
+		if err == nil {
+			data.SponsorsEnabled = scfg.Enabled
+			data.SponsorsPanelTitle = scfg.PanelTitle
+			for _, it := range slist {
+				data.Sponsors = append(data.Sponsors, PublicSponsorItem{
+					ID: it.ID, Name: it.Name, LogoURL: it.LogoURL,
+					LinkURL: it.LinkURL, HoverText: it.HoverText,
+				})
+			}
+		}
+	}
+
 	return data, nil
 }

--- a/backend/service/ratelimit.go
+++ b/backend/service/ratelimit.go
@@ -82,6 +82,8 @@ const (
 	RateInteract     = "interact"      // 投票/抽奖/解锁等互动
 	RateHidePassword = "hide_password" // 密码隐藏块尝试
 	RateTimelineGit  = "timeline_git"  // Git 提交导入 10/分钟
+	RateAdSubmit     = "ad_submit"     // 广告申购 5/分钟（按 IP）
+	RateCaptcha      = "captcha"       // 验证码刷新 30/分钟
 )

 // DefaultRateLimiter 创建默认速率限制器
@@ -96,5 +98,7 @@ func DefaultRateLimiter() *RateLimiter {
 	rl.SetLimit(RateInteract, 40)     // 互动 40/分钟
 	rl.SetLimit(RateHidePassword, 20) // 密码尝试 20/分钟（按 IP）
 	rl.SetLimit(RateTimelineGit, 10)  // 时间线 Git 导入 10/分钟
+	rl.SetLimit(RateAdSubmit, 5)      // 广告申购 5/分钟
+	rl.SetLimit(RateCaptcha, 30)      // 验证码 30/分钟
 	return rl
 }
--- a/backend/service/sponsor.go
+++ b/backend/service/sponsor.go
@@ -0,0 +1,198 @@
+package service
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"net/url"
+	"strings"
+	"time"
+	"unicode/utf8"
+
+	"github.com/freefire/jiang13-bbs/model"
+	"gorm.io/gorm"
+)
+
+const (
+	SettingKeySponsorsConfig = "sponsors_config"
+	SponsorDefaultTitle      = "赞助商"
+	SponsorMaxItems          = 24
+	SponsorMaxNameRunes      = 32
+	SponsorMaxHoverRunes     = 120
+)
+
+// SponsorItem 侧栏赞助商条目
+type SponsorItem struct {
+	ID        string `json:"id"`
+	Name      string `json:"name"`
+	LogoURL   string `json:"logo_url"`
+	LinkURL   string `json:"link_url"`
+	HoverText string `json:"hover_text"`
+	Enabled   bool   `json:"enabled"`
+	SortOrder int    `json:"sort_order"`
+}
+
+// SponsorsConfig 赞助商板块配置
+type SponsorsConfig struct {
+	Enabled    bool          `json:"enabled"`
+	PanelTitle string        `json:"panel_title"`
+	Items      []SponsorItem `json:"items"`
+}
+
+func DefaultSponsorsConfig() SponsorsConfig {
+	return SponsorsConfig{
+		Enabled:    true,
+		PanelTitle: SponsorDefaultTitle,
+		Items:      []SponsorItem{},
+	}
+}
+
+func (s *AdService) loadSponsorsConfig() (SponsorsConfig, error) {
+	var row model.SiteSetting
+	err := s.db.Where("key = ?", SettingKeySponsorsConfig).First(&row).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return DefaultSponsorsConfig(), nil
+	}
+	if err != nil {
+		return SponsorsConfig{}, err
+	}
+	cfg := DefaultSponsorsConfig()
+	if strings.TrimSpace(row.Value) == "" {
+		return cfg, nil
+	}
+	if err := json.Unmarshal([]byte(row.Value), &cfg); err != nil {
+		return DefaultSponsorsConfig(), nil
+	}
+	if strings.TrimSpace(cfg.PanelTitle) == "" {
+		cfg.PanelTitle = SponsorDefaultTitle
+	}
+	return cfg, nil
+}
+
+func (s *AdService) GetSponsorsConfig() (SponsorsConfig, error) {
+	return s.loadSponsorsConfig()
+}
+
+// PublicSponsors 侧栏展示用（仅启用且有 logo 的条目）
+func (s *AdService) PublicSponsors() (SponsorsConfig, []SponsorItem, error) {
+	cfg, err := s.loadSponsorsConfig()
+	if err != nil {
+		return cfg, nil, err
+	}
+	if !cfg.Enabled {
+		return cfg, []SponsorItem{}, nil
+	}
+	out := make([]SponsorItem, 0, len(cfg.Items))
+	for _, it := range cfg.Items {
+		if !it.Enabled {
+			continue
+		}
+		if strings.TrimSpace(it.LogoURL) == "" {
+			continue
+		}
+		out = append(out, it)
+	}
+	return cfg, out, nil
+}
+
+func (s *AdService) SaveSponsorsConfig(in SponsorsConfig) (SponsorsConfig, error) {
+	out, err := normalizeSponsorsConfig(in)
+	if err != nil {
+		return SponsorsConfig{}, err
+	}
+	b, err := json.Marshal(out)
+	if err != nil {
+		return SponsorsConfig{}, err
+	}
+	row := model.SiteSetting{Key: SettingKeySponsorsConfig, Value: string(b), UpdatedAt: time.Now()}
+	if err := s.db.Save(&row).Error; err != nil {
+		return SponsorsConfig{}, err
+	}
+	return out, nil
+}
+
+func normalizeSponsorsConfig(in SponsorsConfig) (SponsorsConfig, error) {
+	out := DefaultSponsorsConfig()
+	out.Enabled = in.Enabled
+	title := strings.TrimSpace(in.PanelTitle)
+	if title == "" {
+		title = SponsorDefaultTitle
+	}
+	if utf8.RuneCountInString(title) > 16 {
+		return SponsorsConfig{}, errors.New("侧栏标题最多 16 字")
+	}
+	out.PanelTitle = title
+
+	if len(in.Items) > SponsorMaxItems {
+		return SponsorsConfig{}, fmt.Errorf("赞助商最多 %d 个", SponsorMaxItems)
+	}
+	seen := map[string]struct{}{}
+	items := make([]SponsorItem, 0, len(in.Items))
+	for i, raw := range in.Items {
+		id := strings.TrimSpace(raw.ID)
+		if id == "" {
+			id = fmt.Sprintf("sp_%d", i+1)
+		}
+		if _, ok := seen[id]; ok {
+			return SponsorsConfig{}, errors.New("赞助商 id 重复")
+		}
+		seen[id] = struct{}{}
+
+		name := strings.TrimSpace(raw.Name)
+		if name == "" {
+			return SponsorsConfig{}, errors.New("请填写赞助商名称")
+		}
+		if utf8.RuneCountInString(name) > SponsorMaxNameRunes {
+			return SponsorsConfig{}, fmt.Errorf("赞助商名称最多 %d 字", SponsorMaxNameRunes)
+		}
+
+		logo := strings.TrimSpace(raw.LogoURL)
+		if logo == "" {
+			return SponsorsConfig{}, errors.New("请上传或填写赞助商 logo")
+		}
+		if !validSponsorLogoURL(logo) {
+			return SponsorsConfig{}, errors.New("logo 须为 https 或本站 /uploads/ 图片")
+		}
+
+		link := strings.TrimSpace(raw.LinkURL)
+		if link != "" {
+			u, err := url.Parse(link)
+			if err != nil || (u.Scheme != "https" && u.Scheme != "http") || u.Host == "" {
+				return SponsorsConfig{}, errors.New("赞助商链接须为 http(s) 地址")
+			}
+			link = u.String()
+		}
+
+		hover := strings.TrimSpace(raw.HoverText)
+		if utf8.RuneCountInString(hover) > SponsorMaxHoverRunes {
+			return SponsorsConfig{}, fmt.Errorf("赞助说明最多 %d 字", SponsorMaxHoverRunes)
+		}
+
+		items = append(items, SponsorItem{
+			ID:        id,
+			Name:      name,
+			LogoURL:   logo,
+			LinkURL:   link,
+			HoverText: hover,
+			Enabled:   raw.Enabled,
+			SortOrder: i,
+		})
+	}
+	out.Items = items
+	return out, nil
+}
+
+func validSponsorLogoURL(u string) bool {
+	if adImageUploadRe.MatchString(u) {
+		return true
+	}
+	if strings.HasPrefix(strings.ToLower(u), "https://") && adImageHTTPSRe.MatchString(u) {
+		return true
+	}
+	// 允许常见本站 uploads 路径（赞助 logo）
+	low := strings.ToLower(u)
+	if strings.HasPrefix(low, "/uploads/") && len(u) <= 500 {
+		return true
+	}
+	return false
+}
--- a/backend/service/upload.go
+++ b/backend/service/upload.go
@@ -7,6 +7,7 @@ import (
 	"encoding/hex"
 	"errors"
 	"image"
+	_ "image/gif"
 	_ "image/jpeg"
 	_ "image/png"
 	"io"
@@ -77,6 +78,9 @@ func (s *UploadService) EnsureDir() error {
 	if err := os.MkdirAll(filepath.Join(s.dir, "backgrounds"), 0o755); err != nil {
 		return err
 	}
+	if err := os.MkdirAll(filepath.Join(s.dir, "ads"), 0o755); err != nil {
+		return err
+	}
 	return os.MkdirAll(filepath.Join(s.dir, "brand"), 0o755)
 }

@@ -166,7 +170,10 @@ func detectImageFormat(data []byte) (imageFormat, error) {
 	if len(data) >= 12 && string(data[0:4]) == "RIFF" && string(data[8:12]) == "WEBP" {
 		return imageFormat{ext: ".webp", mime: "image/webp"}, nil
 	}
-	return imageFormat{}, errors.New("仅支持 JPEG / PNG / WebP")
+	if len(data) >= 6 && (string(data[0:6]) == "GIF87a" || string(data[0:6]) == "GIF89a") {
+		return imageFormat{ext: ".gif", mime: "image/gif"}, nil
+	}
+	return imageFormat{}, errors.New("仅支持 JPEG / PNG / WebP / GIF")
 }

 func decodeImageSizeReader(r io.Reader, mime string) (w, h int, err error) {
@@ -403,6 +410,91 @@ func (s *UploadService) SaveBackground(src io.Reader) (string, error) {
 	return "/uploads/backgrounds/" + filename, nil
 }

+const AdAssetMaxBytes = 2 << 20 // 收款码 / 广告素材 2MB
+
+// SaveAdAsset 保存广告相关图片（收款码等）到 uploads/ads，保留原格式含 GIF
+func (s *UploadService) SaveAdAsset(src io.Reader) (string, error) {
+	if src == nil {
+		return "", errors.New("文件为空")
+	}
+	tooLarge := func() error { return errors.New("图片不能超过 2MB") }
+
+	head := make([]byte, 12)
+	n, err := io.ReadFull(src, head)
+	if err != nil && !errors.Is(err, io.ErrUnexpectedEOF) && !errors.Is(err, io.EOF) {
+		return "", errors.New("读取图片失败")
+	}
+	if n == 0 {
+		return "", errors.New("文件为空")
+	}
+	format, err := detectImageFormat(head[:n])
+	if err != nil {
+		return "", err
+	}
+	if err := os.MkdirAll(filepath.Join(s.dir, "ads"), 0o755); err != nil {
+		return "", err
+	}
+	nameBytes := make([]byte, 16)
+	if _, err := rand.Read(nameBytes); err != nil {
+		return "", err
+	}
+	filename := hex.EncodeToString(nameBytes) + format.ext
+	fullPath := filepath.Join(s.dir, "ads", filename)
+	tmp := fullPath + ".partial"
+	if s.ops != nil {
+		release, e := s.ops.BeginTemporary(tmp)
+		if e != nil {
+			return "", e
+		}
+		defer release()
+	}
+	f, err := os.OpenFile(tmp, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return "", err
+	}
+	remain := AdAssetMaxBytes + 1 - int64(n)
+	if remain < 0 {
+		_ = f.Close()
+		_ = os.Remove(tmp)
+		return "", tooLarge()
+	}
+	if _, err := f.Write(head[:n]); err != nil {
+		_ = f.Close()
+		_ = os.Remove(tmp)
+		return "", err
+	}
+	writtenRest, copyErr := io.Copy(f, io.LimitReader(src, remain))
+	_ = f.Close()
+	if copyErr != nil {
+		_ = os.Remove(tmp)
+		return "", copyErr
+	}
+	if int64(n)+writtenRest > AdAssetMaxBytes {
+		_ = os.Remove(tmp)
+		return "", tooLarge()
+	}
+	rf, err := os.Open(tmp)
+	if err != nil {
+		_ = os.Remove(tmp)
+		return "", err
+	}
+	w, h, err := decodeImageSizeReader(rf, format.mime)
+	_ = rf.Close()
+	if err != nil {
+		_ = os.Remove(tmp)
+		return "", err
+	}
+	if w < 1 || h < 1 || w > 4096 || h > 4096 {
+		_ = os.Remove(tmp)
+		return "", errors.New("图片尺寸无效")
+	}
+	if err := os.Rename(tmp, fullPath); err != nil {
+		_ = os.Remove(tmp)
+		return "", err
+	}
+	return "/uploads/ads/" + filename, nil
+}
+
 // CopyBackgroundFromMedia 把当前用户媒体库里的一张图复制进 backgrounds，不写站点设置
 func (s *UploadService) CopyBackgroundFromMedia(userID, attachmentID uint) (string, error) {
 	var att model.Attachment