xfy/yggdrasil
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
1,129 Commits 1 Branch 8 Tags
Commit Graph

25 Commits

Author SHA1 Message Date
xfy
9eac025b3e feat(mcp): 完整工具面 + token 管理 + 管理页（T2-T5 并行实现 + 合并） 
T2 token 管理（src/api/mcp_tokens.rs）：create/list/reveal/revoke + get_mcp_client_configs
服务端函数，均经 get_current_admin_user 鉴权；TokenLifetime 枚举（1/7/30/90天/永不过期）。
src/mcp/config.rs 生成 4 种客户端配置（Claude Code/Cursor/Cline/通用 + CLI）。
src/pages/admin/mcp.rs 令牌管理页：列表 + 新建表单 + 一次性明文展示/重查 + 撤销 +
配置片段卡片。路由 /admin/mcp，导航项加入 admin_layout。

T3 read 工具 + Resources（tools/read.rs, resources.rs）：search_posts/get_post/list_tags
（read 作用域，仅已发布）；published-post Resources（post://{slug}，游标分页）。
search_published 提取为共享函数。

T4 write 工具（tools/{posts,comments,tags,media}.rs）：create/update/publish/trash/delete_post、
评论审核、标签 CRUD、媒体 base64 上传（WebP 转码 + 去重）。复用既有 helper 的 SQL 与
缓存失效（moka + ssr_cache）。write 作用域，可读草稿。

T5 admin 工具（tools/{settings,runner}.rs）：get/update_settings、run_code（沙箱执行）。
admin 作用域。

合并（server.rs）：用 rmcp tool_router 的「命名路由 + 组合」模式，7 个工具组在
YggMcpServer 上 impl，combined_router 用 + 合并成单一 ServerHandler。各工具组鉴权
独立，经 Extension<Parts> 读 McpPrincipal + scope.grants 校验。

新增依赖 base64 0.22（媒体上传解码）。验证：server/web 双目标编译通过、clippy
--all-features -D warnings 干净、659 单测 + 1 集成全绿（+20 新测试）。
 2026-07-28 11:53:32 +08:00
xfy
99b96e7a0c feat(assets): 素材管理只读列表页 
- list_assets：引用状态筛选 + filename/alt 搜索 + 时间/大小排序 +
  分页（60/页），一次响应带齐 tabs 计数与可清理孤儿统计
- /admin/assets 网格页：?thumb=300x300 缩略图卡片 + 引用徽标，
  单路由客户端分页（对齐管理文章模式），导航加「素材」入口
 2026-07-24 16:15:19 +08:00
xfy
db74a96de1 style: 格式化 Rust 与 TS 代码 2026-07-23 13:34:27 +08:00
xfy
bcd13958ac feat(katex): 移植 mhchem 化学公式转译器(\ce/\pu → LaTeX)
Some checks failed
CI / check (push) Has been cancelled
Details
CI / build (push) Has been cancelled
Details 
katex-rs 默认无 mhchem 解析器,\ce/\pu 化学公式渲染为红字(实测正确页面 648
的 137 个公式中 32 处化学公式坏掉,含 \ce×24 + \pu×8)。

从 mhchemParser 4.2.2(Apache-2.0)机械移植状态机转译器为纯 Rust:
- src/api/mhchem.rs:数据模型 + 模式匹配 + go() 主循环 + texify 输出 + 公开 API
- src/api/mhchem_tables.rs:14 个状态机转移表 + 机器局部动作(ce/pu/...)
- 模式含 lookahead (?=)/(?!),Rust regex crate 不支持,故用 fancy-regex
  (已被 syntect 间接引入,此处显式声明为直接 server 依赖)
- ce/pu 包裹 catch_unwind,任何内部异常回退原样输出,绝不 panic
- katex.rs 新增 expand_chem:渲染前嵌套花括号配对扫描 \ce/\pu 预转译
- 行尾 ^ 气体符号转译为 \uparrow,消解原 mhchem 解析错误
- 8 个 mhchem 单测 + 5 个 katex 集成测试(水/反应箭头/气体箭头/单位/络离子)
 2026-07-23 12:23:53 +08:00
xfy
891a576dc0 feat(deps): 引入 katex-rs 服务端数学公式渲染 
纯 Rust 的 katex-rs 0.2.4 重实现 KaTeX,把 TeX 公式渲染成 HTML span,
供后续 pulldown-cmark 的 InlineMath/DisplayMath 事件调用。

- Cargo.toml: katex-rs 作为 optional dep 经 server feature 启用
- src/api/katex.rs: thread_local 缓存 KatexContext/Settings(因含 RefCell
  宏表非 Sync,不能放全局 static);OutputFormat::Html 避开 MathML 标签
  使 sanitizer 无需开白名单;throw_on_error=false 防坏公式中断全文
- src/api/mod.rs: #[cfg(feature="server")] 注册 katex 模块

双 target 编译通过(server + wasm32),4 个单测通过。
 2026-07-16 14:09:14 +08:00
xfy
65a7b1226f style: 全项目格式规范化（cargo fmt）+ Docker daemon 断连容错 
- 全项目 .rs 统一 cargo fmt 排版（换行/缩进/参数分行/导入排序）
- infra/docker: DOCKER_CLIENT 连接失败不 panic，降级返回 None
  （博客不依赖 Docker，panic=abort 下会导致整个进程崩溃）
- infra/mod: 去除多余空行
- database/mod: 模块声明按字母序重新排序
 2026-07-15 17:22:06 +08:00
xfy
60fd6378b6 feat(api): define shared serialized structs for code runner 
Co-authored-by: plan docs/superpowers/plans/2026-07-03-code-runner.md Task 3
 2026-07-03 18:09:27 +08:00
xfy
7553dcf405 feat(admin): add database status tab (tables/connections/migration version) 
get_db_status server function 查 pg_catalog 聚合：数据库总大小/连接数/
表清单(行数估算+大小+死元组)/索引占用 Top10/活跃连接(过滤自身)/迁移版本。
前端 DbStatusTab：概览卡片 + 表/索引/连接表格 + 刷新按钮 + 自动刷新开关
(1s/2s/5s/30s/手动，默认手动；wasm 端用 web_sys setTimeout 轮询，无新依赖)。
 2026-06-29 18:36:08 +08:00
xfy
373498870a style: apply cargo fmt to workspace
Some checks failed
CI / check (push) Failing after 5m35s
Details
CI / build (push) Has been skipped
Details
2026-06-29 13:47:40 +08:00
xfy
c836e3e1df feat(api): 新增 healthz/readyz 健康检查端点
Some checks failed
CI / check (push) Failing after 7m29s
Details
CI / build (push) Has been skipped
Details 
新增两个无中间件探针端点，供 Docker HEALTHCHECK 与反向代理/负载
均衡使用：

GET /healthz — liveness 存活探针，进程在跑即 200，不查 DB。
GET /readyz  — readiness 就绪探针，SELECT 1 检测 DB 连通性（2s
超时），不可达返回 503，附带连接池 size/available/max_size/waiting
指标。

路由挂载在 static_routes（无 CSRF/超时/缓存中间件），避免被
add_cache_control 误加 max-age 缓存头导致探针误判。readyz 直接用
DB_POOL.get() 不走 get_conn 的退避重试，保证探针快速失败。

dx check + clippy + 405 tests 全通过。
 2026-06-25 16:45:09 +08:00
xfy
82a3c12940 feat(security): add Origin-based CSRF protection for write endpoints 
对所有 POST/PUT/PATCH/DELETE 请求校验 Origin（回退 Referer）等于本站，
堵住 login CSRF 与未来 GET 化写接口的盲区（SameSite=Lax 覆盖不到）。

- 新增 src/api/csrf.rs：纯函数 origin 解析（不引入 url crate）+ axum 中间件
- 挂载到 upload 路由与 Dioxus app 路由（最外层，先于超时/压缩）
- APP_BASE_URL 配置可信域名；未设置时回退 Host + X-Forwarded-Proto
- GET/OPTIONS 放行；拿不到本站 origin 时放行避免误杀
- 9 个单测覆盖写方法识别、origin 标准化、默认端口省略、头解析回退
 2026-06-18 13:22:59 +08:00
xfy
f5e19def1a feat(api): 新增回收站配置读写接口 2026-06-16 12:34:28 +08:00
xfy
26b012c40c docs(api, auth): 补充中文注释 2026-06-12 18:27:24 +08:00
xfy
a10bf8737c refactor(sanitizer): extract shared sanitizer module and migrate from ammonia to lol_html 2026-06-12 11:15:42 +08:00
xfy
04737300e6 feat(comments): add complete comment system with guest commenting, moderation, and admin UI 
Implements a fully self-built comment system for the blog:

Data layer:
- comments table with BIGSERIAL PK, parent_id self-reference (ON DELETE SET NULL),
  depth tracking (max 20), status workflow (pending/approved/spam/trash),
  content hashing for dedup, GDPR consent tracking, IP/UA storage with auto-purge
- 5 partial indexes optimized for read patterns
- updated_at auto-trigger

API (9 Dioxus server functions):
- Public: get_comments, get_comment_count, create_comment
- Admin: get_pending_comments, get_pending_count, get_all_comments,
  approve_comment (with ancestor auto-approval), spam_comment, trash_comment,
  batch_update_comment_status

Security:
- Function-level rate limiting (1/sec, burst 5) via FullstackContext IP extraction
- Input validation (name, email, URL scheme, content length, consent)
- Parent chain validation (must be approved, same post)
- Strict comment Markdown renderer (headings→strong, no img/id/data URIs, nofollow links)
- Honeypot anti-spam field
- 5-minute dedup window via SHA-256 content hash

Frontend:
- CommentSection with SuspenseBoundary isolation
- Flat-list rendering with depth-based CSS indentation (responsive)
- Gravatar via cravatar.cn (server-computed, email never exposed)
- Inline reply forms (one-at-a-time via Signal)
- Admin action buttons (approve/spam/delete) visible per-comment
- CommentForm with privacy consent, Markdown hint, loading states

Admin:
- /admin/comments page with status tabs, batch operations, pagination
- Pending count badge on admin dashboard

Infrastructure:
- Shared get_current_admin_user moved from posts/helpers to auth module
- COMMENT_LIMITER rate limiter tier
- Moka caches (60s TTL for comments, 10s for pending count)
- IP/UA purge background task (daily, 90-day retention)
 2026-06-11 12:34:26 +08:00
xfy
a3fa602df2 refactor(api): unify error handling with AppError enum 
Replace scattered ServerFnError::new("...") inline calls and utils.rs
helper functions with a single AppError enum that provides:
- Automatic tracing::error logging for system errors
- Safe generic messages to frontend (no SQL/connection detail leaks)
- Typed error variants (Unauthorized, Forbidden, NotFound, etc.)
- 5 unit tests for message passthrough and detail hiding

Removes src/api/utils.rs entirely; all error creation now goes through
src/api/error.rs.
 2026-06-10 13:16:06 +08:00
xfy
e74b9f3c39 feat: apply rate limiting to Register, Login, and upload endpoints 
- Remove unused tags.rs and related re-exports
- Convert strict_limit/upload_limit from Layer to manual check functions
- Add IP-based rate limiting checks to Register, Login, and upload_image
- Keep general_limit as global middleware for all other routes
 2026-06-08 17:30:26 +08:00
xfy
771b155a88 refactor: split posts.rs and fix N+1 with JOIN+array_agg 2026-06-08 16:53:31 +08:00
xfy
32131377c3 refactor: integrate tags module into posts.rs and mod.rs 2026-06-08 16:45:20 +08:00
xfy
1f009f57c8 feat: add image processing handler with resize/thumbnail/rotate/format 2026-06-08 15:13:18 +08:00
xfy
1bae3446e6 feat(api): add image upload handler with admin auth 2026-06-05 14:56:29 +08:00
xfy
d3be04bcec refactor: extract session parsing to auth/session.rs and db error helpers to api/utils.rs 2026-06-04 15:16:40 +08:00
xfy
9c5b09a278 chore: code cleanup - formatting, EOF newlines, model helper, and UI tweaks 2026-06-02 17:33:28 +08:00
xfy
973d6f3d57 feat: add posts, tags database schema and API 
- Add migration 002_posts.sql with posts, tags, post_tags tables
- Add Post/Tag/PostStats models with PostStatus enum
- Add posts API with full CRUD:
  - create_post, update_post, delete_post (admin only)
  - get_post_by_slug, list_published_posts (public)
  - list_posts, get_post_stats (admin)
  - list_tags, get_posts_by_tag, search_posts (public)
- Slug auto-generation with uniqueness check
- Server-side markdown rendering with pulldown-cmark
- Auto-summary extraction from markdown
- Soft delete support
 2026-06-02 17:33:28 +08:00
xfy
b2a1e13c79 US-003: 认证 API (Server Functions) 
- src/api/auth.rs: register, login, logout, get_current_user
- register(): 输入验证 + 首个用户 admin + 后续关闭注册
- login(): argon2 验证 + session 创建 + token 返回
- logout(): session 清理
- get_current_user(): 从 cookie 读取 token，返回 Option<User>
- 使用 server_context().request_parts() 读取请求 cookie

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
 2026-05-25 16:21:11 +08:00