xfy/yggdrasil
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
921 Commits 1 Branch 8 Tags
Commit Graph

19 Commits

Author SHA1 Message Date
xfy
79978aa4a4 fix(post): 修复上/下一篇导航后文章内容不更新 
点击文章底部的上一篇/下一篇后，URL 正确变化为 /post/<new-slug>，但页面
内容仍停留在旧文章，只有刷新浏览器才生效。

根因：use_server_future（内部即 use_resource）依赖 ReactiveContext 追踪
闭包内读取的 signal 来决定重跑时机。但 PostDetail 的 slug 是路由宏注入的
普通 String prop，move 进闭包后成为冻结快照，读取它不建立任何反应式订阅。
同一 Route::PostDetail 变体间的导航（/post/a -> /post/b）会复用组件实例、
仅更新 props，而 use_server_future 的 task 只在首次 hook 时创建一次，因此
永远不会重跑。

此前 commit 225bb24 把 slug_signal 镜像 + render 期 set 改成直接读 prop，
消除了反模式，但也丢掉了唯一能触发重跑的订阅源（slug_signal 的读取），
反而引入了这个 bug。

修复：在闭包内通过 dioxus::router::router().current::<Route>() 读取当前
slug。current() 内部调用 subscribe_to_current_context()，在 use_server_future
的 ReactiveContext 中注册订阅，路由变化即触发重跑。render body 保持纯净。

验证（headless chromium，本地需设 APP_BASE_URL 绕过 CSRF 403）：
- 修复前：点 Next 后 URL 变 /post/1783580058，标题仍为旧文章（复现 bug）
- 修复后：URL 变，标题随之变为新文章
 2026-07-09 15:34:25 +08:00
xfy
61c64841f9 refactor(skeletons): 统一骨架屏延迟机制，200ms 内加载不显示 
- DelayedSkeleton 从「延迟 pulse 动画」改为「延迟渲染」：
  前 200ms 完全不渲染，超时后才显示并带 pulse 动画
- admin_layout 从 use_delayed_loading hook 改为 DelayedSkeleton 包裹
- CommentListSkeleton 的两处裸用（section.rs / post_detail.rs）
  补上 DelayedSkeleton 包裹
- 移除不再使用的 use_delayed_loading hook 模块
 2026-07-08 14:18:08 +08:00
xfy
46860f7c41 fix(ui): apply mount animation inside each page component to avoid skeleton interception 2026-07-03 17:24:38 +08:00
xfy
45f4e9cde0 refactor(ui): 去除 Rust 中硬编码颜色，统一语义色阶 
跟随 Catppuccin 配色迁移，清理 src/ 中绕过 paper-* 语义 token 的
硬编码 dark:[#hex] 任意值，改用 Tailwind 默认灰阶（gray-700/800），
它们随主题切换自然适配。

- post.rs 状态徽章：dark:bg-[#333]/dark:text-[#9b9c9d] → gray-800/gray-400/500
  （同步更新测试断言）
- comments/* 与 skeletons/* 的 dark:[#2a2a2a]/[#2e2e33]/[#333]/[#5a5a62]
  → 对应 gray-600/700/800
- trash.rs 状态灯发光圈 rgba 由旧鼠尾草绿(92,122,94) 改 Latte green(64,160,43)
- ui.rs BTN_SECONDARY 注释更新为新 Teal 强调色值

注：src/pages/admin/posts.rs 的 clippy redundant_closure 报错为既有问题，
与本次配色迁移无关，不在范围内。
 2026-07-03 14:25:40 +08:00
xfy
225bb2406f docs(skill)+fix: 新增 dioxus-render-purity skill 并修复 post_detail 渲染期 set signal 
依据 Dioxus 0.7 antipatterns 官方指南，做两件事：

1. 新增 skill .agents/skills/dioxus-render-purity/
   把「render 函数必须纯净」做成可复用 skill，列出三类反模式（render 期
   副作用 / 用 use_signal 存派生值 / 用 use_effect 算派生值）及自检清单，
   防止后续编辑（人或 AI）再次在组件里写 signal.set 等副作用。触发关键词
   覆盖 dioxus/component/rsx/signal/use_effect 及对 src/pages、src/components
   的编辑。

2. 修复 post_detail.rs 的真实违规（被该 skill 捕获的典型反例）：
   原代码用 use_signal 镜像 slug prop，再在 render 期 if slug_signal()!=slug
   { slug_signal.set(...) } 触发 server future 重跑——这是文档明确点名的
   「don't mutate state during render」。改为直接读 prop：
   use_server_future(move || get_post_by_slug(slug.clone()))，路由 slug 变化
   时 Dioxus 自动重跑 future，无需镜像信号。key 改用 post.slug（post 已在
   match 分支内可用，避免 slug 被 move 后再读）。同步更新模块文档注释。

验证：dx check 通过、cargo test 405 passed。
 2026-06-25 18:24:57 +08:00
xfy
0398cc6c66 perf(render): 列表加显式 key + release 启用 panic=abort 
依据 Dioxus 0.7 optimizing 指南做两项改进：

- 为数据驱动列表渲染补全显式 key（13 处，9 个文件）：
  home/archives/tags/search 文章与标签列表、post_card/post_footer
  标签、header 桌面/移动导航、admin dashboard/posts/write 列表。
  使用各类型稳定唯一字段（post.id / tag / tag.name / item.label /
  err.id / year_group.year / month_group.month_en）作为 key，
  让 Dioxus diff 正确识别元素身份。骨架屏 for _ in 0..N 静态占位
  循环与已带 key 的评论树/admin 行不动。

- [profile.release] 加 panic = "abort"：WASM 去掉 unwind 元数据减小
  体积；server 端错误处理走 Result+?（见 error.rs），不依赖 panic
  unwind，无副作用。

其余文件为本机格式化（单行折叠/多行展开），一并提交。

验证：dx check 通过、cargo test 405 passed。
 2026-06-25 18:07:22 +08:00
xfy
449a545886 security: fix critical issues from repository review
Some checks failed
CI / build (push) Has been cancelled
Details
CI / check (push) Has been cancelled
Details 
P0 blockers:
- Fix migration numbering conflict and duplicate indexes
- Change comments.post_id FK to ON DELETE CASCADE
- Restrict public post detail endpoint to published posts only
- Fix rate-limiting IP extraction and fallback to ConnectInfo
- Harden HTML sanitizer: deny unknown URL schemes, restrict data URIs
- Remove session token from login response body
- Enforce image pixel/dimension limits on upload and serving

P1 high-risk:
- Validate uploads by magic bytes and decode GIF/WebP
- Add pagination/rate-limiting to search, tag posts, and comments
- Make first-admin registration and slug uniqueness check atomic
- HTML-escape comment author fields
- Improve HTML minify cache key and skip admin/error responses
- Add mobile navigation menu

P2 accessibility/quality:
- Associate form labels with inputs
- Key PostDetail article by slug to re-init scripts on navigation
- Improve image viewer keyboard accessibility
- Make theme toggle SSR-friendly and add aria-label
- Invalidate slug 404 cache on create and pending count on new comment
- Deduplicate tags case-insensitively

P3 cleanup:
- Remove unused tower-http dependency, expand make clean
- Configure DB pool timeouts and verified recycling
- Run background cleanup tasks immediately on startup
- Use SHA-256 for stable disk cache keys
- Log DB errors with Display instead of Debug
- Update README migration instructions

All tests pass (321), clippy clean, dx check clean.
 2026-06-17 10:34:14 +08:00
xfy
abfab19839 docs(pages-frontend): 补充中文注释 2026-06-12 19:16:59 +08:00
xfy
04737300e6 feat(comments): add complete comment system with guest commenting, moderation, and admin UI 
Implements a fully self-built comment system for the blog:

Data layer:
- comments table with BIGSERIAL PK, parent_id self-reference (ON DELETE SET NULL),
  depth tracking (max 20), status workflow (pending/approved/spam/trash),
  content hashing for dedup, GDPR consent tracking, IP/UA storage with auto-purge
- 5 partial indexes optimized for read patterns
- updated_at auto-trigger

API (9 Dioxus server functions):
- Public: get_comments, get_comment_count, create_comment
- Admin: get_pending_comments, get_pending_count, get_all_comments,
  approve_comment (with ancestor auto-approval), spam_comment, trash_comment,
  batch_update_comment_status

Security:
- Function-level rate limiting (1/sec, burst 5) via FullstackContext IP extraction
- Input validation (name, email, URL scheme, content length, consent)
- Parent chain validation (must be approved, same post)
- Strict comment Markdown renderer (headings→strong, no img/id/data URIs, nofollow links)
- Honeypot anti-spam field
- 5-minute dedup window via SHA-256 content hash

Frontend:
- CommentSection with SuspenseBoundary isolation
- Flat-list rendering with depth-based CSS indentation (responsive)
- Gravatar via cravatar.cn (server-computed, email never exposed)
- Inline reply forms (one-at-a-time via Signal)
- Admin action buttons (approve/spam/delete) visible per-comment
- CommentForm with privacy consent, Markdown hint, loading states

Admin:
- /admin/comments page with status tabs, batch operations, pagination
- Pending count badge on admin dashboard

Infrastructure:
- Shared get_current_admin_user moved from posts/helpers to auth module
- COMMENT_LIMITER rate limiter tier
- Moka caches (60s TTL for comments, 10s for pending count)
- IP/UA purge background task (daily, 90-day retention)
 2026-06-11 12:34:26 +08:00
xfy
ce14c476b5 refactor: replace string-based navigation with typed Route and Link components 2026-06-04 14:55:18 +08:00
xfy
5d018864c2 refactor: remove PageLayout from all frontend pages, delegate to FrontendLayout 
- Remove PageLayout wrapper from Home, HomePage, Archives, Tags,
  TagDetail, PostDetail, Search, and About components
- Remove unused imports: use_nav_items, use_route, PageLayout, Route
- Pages now render only their content; Header/Footer are provided by
  FrontendLayout via the router's #[layout] attribute
- Skeleton screens (DelayedSkeleton) remain in data-loading branches
- This eliminates redundant Header/Footer re-mounting on every route
  change, which was the primary source of page transition flicker

Files changed:
- src/pages/home.rs: remove PageLayout, keep HomeInfo + HomePosts
- src/pages/about.rs: remove PageLayout, render content directly
- src/pages/archives.rs: remove PageLayout, keep header + ArchivesContent
- src/pages/post_detail.rs: remove PageLayout, keep PostDetailContent
- src/pages/search.rs: remove PageLayout, keep search form + results
- src/pages/tags.rs: remove PageLayout from Tags and TagDetail
 2026-06-03 18:38:11 +08:00
xfy
778726251a fix: remove SuspenseBoundary, render skeleton screens directly in loading branch 2026-06-03 17:59:38 +08:00
xfy
754c1f5b86 feat: wrap all skeleton screens with DelayedSkeleton to prevent flicker 2026-06-03 17:43:34 +08:00
xfy
372c701b07 feat: add PostDetailSkeleton and replace generic fallback on post detail page 2026-06-03 17:13:39 +08:00
xfy
fe30d0495f feat: SSR for post detail page 2026-06-03 14:17:52 +08:00
xfy
6b1f2e27c9 feat(components): add post page components (header, toc, content, footer, nav) 2026-06-02 18:21:25 +08:00
xfy
f3c1718cd0 feat: add use_delayed_loading hook to prevent skeleton flash 2026-06-02 17:53:04 +08:00
xfy
1950646bef feat: add shared components, new pages, and pagination 2026-06-02 17:33:28 +08:00
xfy
b6cabe489f feat: migrate frontend to database-driven posts 
- Replace hardcoded POSTS with API-driven data in home, archives, tags
- Add post detail page /post/:slug with HTML rendering
- Add admin posts management page with list and soft delete
- Update dashboard with real stats from database
- Add admin navigation for posts management
- Fix PartialEq derives for Post, Tag, PostStats models
- Use use_resource and use_memo for data fetching with proper loading states
 2026-06-02 17:33:28 +08:00