82a3c12940
feat(security): add Origin-based CSRF protection for write endpoints
...
对所有 POST/PUT/PATCH/DELETE 请求校验 Origin（回退 Referer）等于本站，
堵住 login CSRF 与未来 GET 化写接口的盲区（SameSite=Lax 覆盖不到）。
- 新增 src/api/csrf.rs：纯函数 origin 解析（不引入 url crate）+ axum 中间件
- 挂载到 upload 路由与 Dioxus app 路由（最外层，先于超时/压缩）
- APP_BASE_URL 配置可信域名；未设置时回退 Host + X-Forwarded-Proto
- GET/OPTIONS 放行；拿不到本站 origin 时放行避免误杀
- 9 个单测覆盖写方法识别、origin 标准化、默认端口省略、头解析回退
2026-06-18 13:22:59 +08:00
f5e19def1a
feat(api): 新增回收站配置读写接口
2026-06-16 12:34:28 +08:00
26b012c40c
docs(api, auth): 补充中文注释
2026-06-12 18:27:24 +08:00
a10bf8737c
refactor(sanitizer): extract shared sanitizer module and migrate from ammonia to lol_html
2026-06-12 11:15:42 +08:00
04737300e6
feat(comments): add complete comment system with guest commenting, moderation, and admin UI
...
Implements a fully self-built comment system for the blog:
Data layer:
- comments table with BIGSERIAL PK, parent_id self-reference (ON DELETE SET NULL),
depth tracking (max 20), status workflow (pending/approved/spam/trash),
content hashing for dedup, GDPR consent tracking, IP/UA storage with auto-purge
- 5 partial indexes optimized for read patterns
- updated_at auto-trigger
API (9 Dioxus server functions):
- Public: get_comments, get_comment_count, create_comment
- Admin: get_pending_comments, get_pending_count, get_all_comments,
approve_comment (with ancestor auto-approval), spam_comment, trash_comment,
batch_update_comment_status
Security:
- Function-level rate limiting (1/sec, burst 5) via FullstackContext IP extraction
- Input validation (name, email, URL scheme, content length, consent)
- Parent chain validation (must be approved, same post)
- Strict comment Markdown renderer (headings→strong, no img/id/data URIs, nofollow links)
- Honeypot anti-spam field
- 5-minute dedup window via SHA-256 content hash
Frontend:
- CommentSection with SuspenseBoundary isolation
- Flat-list rendering with depth-based CSS indentation (responsive)
- Gravatar via cravatar.cn (server-computed, email never exposed)
- Inline reply forms (one-at-a-time via Signal)
- Admin action buttons (approve/spam/delete) visible per-comment
- CommentForm with privacy consent, Markdown hint, loading states
Admin:
- /admin/comments page with status tabs, batch operations, pagination
- Pending count badge on admin dashboard
Infrastructure:
- Shared get_current_admin_user moved from posts/helpers to auth module
- COMMENT_LIMITER rate limiter tier
- Moka caches (60s TTL for comments, 10s for pending count)
- IP/UA purge background task (daily, 90-day retention)
2026-06-11 12:34:26 +08:00
a3fa602df2
refactor(api): unify error handling with AppError enum
...
Replace scattered ServerFnError::new("...") inline calls and utils.rs
helper functions with a single AppError enum that provides:
- Automatic tracing::error logging for system errors
- Safe generic messages to frontend (no SQL/connection detail leaks)
- Typed error variants (Unauthorized, Forbidden, NotFound, etc.)
- 5 unit tests for message passthrough and detail hiding
Removes src/api/utils.rs entirely; all error creation now goes through
src/api/error.rs.
2026-06-10 13:16:06 +08:00
e74b9f3c39
feat: apply rate limiting to Register, Login, and upload endpoints
...
- Remove unused tags.rs and related re-exports
- Convert strict_limit/upload_limit from Layer to manual check functions
- Add IP-based rate limiting checks to Register, Login, and upload_image
- Keep general_limit as global middleware for all other routes
2026-06-08 17:30:26 +08:00
771b155a88
refactor: split posts.rs and fix N+1 with JOIN+array_agg
2026-06-08 16:53:31 +08:00
32131377c3
refactor: integrate tags module into posts.rs and mod.rs
2026-06-08 16:45:20 +08:00
1f009f57c8
feat: add image processing handler with resize/thumbnail/rotate/format
2026-06-08 15:13:18 +08:00
1bae3446e6
feat(api): add image upload handler with admin auth
2026-06-05 14:56:29 +08:00
d3be04bcec
refactor: extract session parsing to auth/session.rs and db error helpers to api/utils.rs
2026-06-04 15:16:40 +08:00
9c5b09a278
chore: code cleanup - formatting, EOF newlines, model helper, and UI tweaks
2026-06-02 17:33:28 +08:00
973d6f3d57
feat: add posts, tags database schema and API
...
- Add migration 002_posts.sql with posts, tags, post_tags tables
- Add Post/Tag/PostStats models with PostStatus enum
- Add posts API with full CRUD:
- create_post, update_post, delete_post (admin only)
- get_post_by_slug, list_published_posts (public)
- list_posts, get_post_stats (admin)
- list_tags, get_posts_by_tag, search_posts (public)
- Slug auto-generation with uniqueness check
- Server-side markdown rendering with pulldown-cmark
- Auto-summary extraction from markdown
- Soft delete support
2026-06-02 17:33:28 +08:00
b2a1e13c79
US-003: 认证 API (Server Functions)
...
- src/api/auth.rs: register, login, logout, get_current_user
- register(): 输入验证 + 首个用户 admin + 后续关闭注册
- login(): argon2 验证 + session 创建 + token 返回
- logout(): session 清理
- get_current_user(): 从 cookie 读取 token，返回 Option<User>
- 使用 server_context().request_parts() 读取请求 cookie
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-25 16:21:11 +08:00
