|
|
45f4e9cde0
|
refactor(ui): 去除 Rust 中硬编码颜色，统一语义色阶
跟随 Catppuccin 配色迁移，清理 src/ 中绕过 paper-* 语义 token 的
硬编码 dark:[#hex] 任意值，改用 Tailwind 默认灰阶（gray-700/800），
它们随主题切换自然适配。
- post.rs 状态徽章：dark:bg-[#333]/dark:text-[#9b9c9d] → gray-800/gray-400/500
（同步更新测试断言）
- comments/* 与 skeletons/* 的 dark:[#2a2a2a]/[#2e2e33]/[#333]/[#5a5a62]
→ 对应 gray-600/700/800
- trash.rs 状态灯发光圈 rgba 由旧鼠尾草绿(92,122,94) 改 Latte green(64,160,43)
- ui.rs BTN_SECONDARY 注释更新为新 Teal 强调色值
注：src/pages/admin/posts.rs 的 clippy redundant_closure 报错为既有问题，
与本次配色迁移无关，不在范围内。
|
2026-07-03 14:25:40 +08:00 |
|
|
|
10ef52bede
|
fix(comment): harden comment form with server honeypot, a11y labels, and reply layout
CI / check (push) Failing after 5m20s
CI / build (push) Has been skipped
四项评论区输入框修复:
1. 蜜罐服务端二次校验
- helpers.rs 新增 validate_comment_honeypot 校验器 + 单元测试
- create_comment 加 honeypot 参数,在限流后做服务端校验
- 即便机器人禁用 JS 绕过前端拦截,服务端仍返回 spam_detected 错误
- 与 rate limit 共同构成纵深防御
2. label/input 关联 (可访问性)
- 四个字段补 id + r#for 属性,用 id_suffix(顶层 root/回复用 parent_id)保证页面唯一
- textarea 原本无 label,补上"内容 *"label
3. 提交按钮右对齐 + 宽度自适应
- 新常量 COMMENT_SUBMIT_CLASS 去掉 w-full、px-4 改为 px-6
- 外层包 flex justify-end,按钮跟随文字宽度
- login/register 的全宽按钮保持不变(模态卡片场景)
4. 深层回复表单回到内容区左边缘
- CommentForm 新增 parent_indent prop,回复时用负 margin 抵消父评论缩进
- 避免 depth 越深表单被越挤越右
验证: cargo test (376 passed) / cargo clippy --all-targets (无警告) / dx check (无问题)
|
2026-06-22 13:45:28 +08:00 |
|
|
|
04737300e6
|
feat(comments): add complete comment system with guest commenting, moderation, and admin UI
Implements a fully self-built comment system for the blog:
Data layer:
- comments table with BIGSERIAL PK, parent_id self-reference (ON DELETE SET NULL),
depth tracking (max 20), status workflow (pending/approved/spam/trash),
content hashing for dedup, GDPR consent tracking, IP/UA storage with auto-purge
- 5 partial indexes optimized for read patterns
- updated_at auto-trigger
API (9 Dioxus server functions):
- Public: get_comments, get_comment_count, create_comment
- Admin: get_pending_comments, get_pending_count, get_all_comments,
approve_comment (with ancestor auto-approval), spam_comment, trash_comment,
batch_update_comment_status
Security:
- Function-level rate limiting (1/sec, burst 5) via FullstackContext IP extraction
- Input validation (name, email, URL scheme, content length, consent)
- Parent chain validation (must be approved, same post)
- Strict comment Markdown renderer (headings→strong, no img/id/data URIs, nofollow links)
- Honeypot anti-spam field
- 5-minute dedup window via SHA-256 content hash
Frontend:
- CommentSection with SuspenseBoundary isolation
- Flat-list rendering with depth-based CSS indentation (responsive)
- Gravatar via cravatar.cn (server-computed, email never exposed)
- Inline reply forms (one-at-a-time via Signal)
- Admin action buttons (approve/spam/delete) visible per-comment
- CommentForm with privacy consent, Markdown hint, loading states
Admin:
- /admin/comments page with status tabs, batch operations, pagination
- Pending count badge on admin dashboard
Infrastructure:
- Shared get_current_admin_user moved from posts/helpers to auth module
- COMMENT_LIMITER rate limiter tier
- Moka caches (60s TTL for comments, 10s for pending count)
- IP/UA purge background task (daily, 90-day retention)
|
2026-06-11 12:34:26 +08:00 |
|
