12 Commits

Author	SHA1	Message	Date
xfy	00478e4a1a	perf(rate-limit): use lenient bucket when client IP is unknown ... TRUSTED_PROXY_COUNT=0（默认）时，Dioxus server function 拿不到 TCP 对端， get_client_ip 返回 "unknown"，所有匿名请求共用严格桶（1 req/s, burst 5）， 正常用户的高频请求被误杀。check_strict_limit 现在对 unknown IP 改走 宽松桶（30 req/s, burst 100，可通过 RATE_LIMIT_UNKNOWN_* 调整）。 配好反向代理后走真实 IP，仍命中严格桶。新增 2 个 serial 测试锁定两路行为。	2026-06-18 11:28:06 +08:00
xfy	449a545886	security: fix critical issues from repository review ... P0 blockers: - Fix migration numbering conflict and duplicate indexes - Change comments.post_id FK to ON DELETE CASCADE - Restrict public post detail endpoint to published posts only - Fix rate-limiting IP extraction and fallback to ConnectInfo - Harden HTML sanitizer: deny unknown URL schemes, restrict data URIs - Remove session token from login response body - Enforce image pixel/dimension limits on upload and serving P1 high-risk: - Validate uploads by magic bytes and decode GIF/WebP - Add pagination/rate-limiting to search, tag posts, and comments - Make first-admin registration and slug uniqueness check atomic - HTML-escape comment author fields - Improve HTML minify cache key and skip admin/error responses - Add mobile navigation menu P2 accessibility/quality: - Associate form labels with inputs - Key PostDetail article by slug to re-init scripts on navigation - Improve image viewer keyboard accessibility - Make theme toggle SSR-friendly and add aria-label - Invalidate slug 404 cache on create and pending count on new comment - Deduplicate tags case-insensitively P3 cleanup: - Remove unused tower-http dependency, expand make clean - Configure DB pool timeouts and verified recycling - Run background cleanup tasks immediately on startup - Use SHA-256 for stable disk cache keys - Log DB errors with Display instead of Debug - Update README migration instructions All tests pass (321), clippy clean, dx check clean.	2026-06-17 10:34:14 +08:00
xfy	26b012c40c	docs(api, auth): 补充中文注释	2026-06-12 18:27:24 +08:00
xfy	4fe26f7eb3	test: improve unit test coverage and assertions ... - Add tests for sanitizer, mime_to_ext, clean_tags, Theme::toggle - Tighten assertions in highlight, markdown, post status classes - Add boundary and XSS cases for comments, slug, rate_limit, webp - Update Cargo.lock for serial_test dev-dependency	2026-06-12 18:13:51 +08:00
xfy	294d60afab	style: format rust code	2026-06-12 17:14:31 +08:00
xfy	71ac08c373	feat(rate_limit): derive real client IP from X-Forwarded-For with TRUSTED_PROXY_COUNT	2026-06-12 17:13:17 +08:00
xfy	04737300e6	feat(comments): add complete comment system with guest commenting, moderation, and admin UI ... Implements a fully self-built comment system for the blog: Data layer: - comments table with BIGSERIAL PK, parent_id self-reference (ON DELETE SET NULL), depth tracking (max 20), status workflow (pending/approved/spam/trash), content hashing for dedup, GDPR consent tracking, IP/UA storage with auto-purge - 5 partial indexes optimized for read patterns - updated_at auto-trigger API (9 Dioxus server functions): - Public: get_comments, get_comment_count, create_comment - Admin: get_pending_comments, get_pending_count, get_all_comments, approve_comment (with ancestor auto-approval), spam_comment, trash_comment, batch_update_comment_status Security: - Function-level rate limiting (1/sec, burst 5) via FullstackContext IP extraction - Input validation (name, email, URL scheme, content length, consent) - Parent chain validation (must be approved, same post) - Strict comment Markdown renderer (headings→strong, no img/id/data URIs, nofollow links) - Honeypot anti-spam field - 5-minute dedup window via SHA-256 content hash Frontend: - CommentSection with SuspenseBoundary isolation - Flat-list rendering with depth-based CSS indentation (responsive) - Gravatar via cravatar.cn (server-computed, email never exposed) - Inline reply forms (one-at-a-time via Signal) - Admin action buttons (approve/spam/delete) visible per-comment - CommentForm with privacy consent, Markdown hint, loading states Admin: - /admin/comments page with status tabs, batch operations, pagination - Pending count badge on admin dashboard Infrastructure: - Shared get_current_admin_user moved from posts/helpers to auth module - COMMENT_LIMITER rate limiter tier - Moka caches (60s TTL for comments, 10s for pending count) - IP/UA purge background task (daily, 90-day retention)	2026-06-11 12:34:26 +08:00
xfy	3974856f3d	fix: resolve image/upload 500 errors and refactor rate limiting ... - Separate /uploads and /api/upload routes from Dioxus app to avoid IncrementalRenderer intercepting non-page requests - Remove broken SmartIpKeyExtractor-based general_limit() that failed under Dioxus dev server proxy (Unable To Extract Key) - Move rate limiting into handlers using governor::RateLimiter directly - Add IMAGE_LIMITER for /uploads/* serving - Make all rate limits configurable via environment variables - Add rate limit config to .env.example with sensible defaults	2026-06-09 09:48:51 +08:00
xfy	4f368e6fb8	test: add 122 unit tests across 12 modules ... Cover utils/text, api/slug, auth/password, auth/session, models/post, models/user, api/auth validation, api/markdown, api/image, highlight, api/rate_limit. Add make test target.	2026-06-09 09:25:44 +08:00
xfy	e74b9f3c39	feat: apply rate limiting to Register, Login, and upload endpoints ... - Remove unused tags.rs and related re-exports - Convert strict_limit/upload_limit from Layer to manual check functions - Add IP-based rate limiting checks to Register, Login, and upload_image - Keep general_limit as global middleware for all other routes	2026-06-08 17:30:26 +08:00
xfy	76f1b8dd53	feat: add rate limiting configurations	2026-06-08 16:57:48 +08:00
xfy	771b155a88	refactor: split posts.rs and fix N+1 with JOIN+array_agg	2026-06-08 16:53:31 +08:00