xfy/yggdrasil
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity
1,143 Commits 1 Branch 8 Tags
Commit Graph

19 Commits

Author SHA1 Message Date
xfy
b4e15ecbff feat(admin): 文章列表支持按标题搜索 
为 /admin/posts 的「全部文章」tab 增加按标题搜索能力：

- list_posts server fn 增加可选 search: Option<String> 参数，非空时按
  title ILIKE 子串匹配（转义 % / _ / \，限长 200 字符）过滤草稿+已发布，
  否则走原全量列表路径；COUNT 与分页查询同步带过滤条件。
- AllPostsList 增加搜索输入条（回车 / 搜索按钮提交，清除按钮复位），
  search_query signal 在 use_paginated 的 page 闭包内同步读取以建立响应式
  依赖：提交新词即使停在首页也会重新请求；fetch 闭包请求时读取当前词传后端。
  搜索结果为空时展示「未找到匹配的文章」空状态。
- 同步更新 dashboard.rs 与 query.rs 文档示例中的 list_posts 调用签名。
 2026-07-28 17:33:06 +08:00
xfy
b269fcf205 perf(posts): list/search 零 capacity Vec 改 collect 预分配 + helpers retain 
list.rs 5 处、search.rs 1 处用 Vec::new()+循环 push，初始 capacity 为 0，
循环触发多次指数 realloc。rows.iter().map().collect() 用 slice 迭代器的
精确 size_hint 一次性预分配。首页/列表/搜索/标签分页路径。

helpers.rs row_to_post_list_item / row_to_post_full：tags 从
into_iter().filter().collect() 改 retain 原地过滤。unwrap_or_default()
已返回 owned Vec，旧写法重建第二个 Vec。每行文章记录省一次 Vec 分配。

顺带修 slugify 一个 dead store（prev_dash=false 后被 true 无条件覆盖）。
 2026-07-15 11:46:56 +08:00
xfy
373498870a style: apply cargo fmt to workspace
Some checks failed
CI / check (push) Failing after 5m35s
Details
CI / build (push) Has been skipped
Details
2026-06-29 13:47:40 +08:00
xfy
79cb809010 perf(posts): add optional pagination to get_posts_by_tag, fix total count 
- get_posts_by_tag 现接受 page/per_page 可选参数；两者均 None 时返回全部
  （上限 200，用于无翻页 UI 的标签详情页），均提供时走标准分页。
- 修正 total：不再用 posts.len()，改为真实 COUNT(*)，即使被 LIMIT 截断
  也返回完整计数。
- 新增 CacheKey::PostsByTagPage 分页缓存键，与不分页键 PostsByTag 共存。
- 前端 tags.rs 传 (None, None) 保持原全部展示行为。
 2026-06-18 11:14:56 +08:00
xfy
1eedab8f21 perf(posts): remove content_md from list/search SQL, read stored word counts 2026-06-17 16:06:27 +08:00
xfy
170c021b37 feat(cache): add PostListItem DTO and use it in list/tag/search caches 2026-06-17 15:51:19 +08:00
xfy
449a545886 security: fix critical issues from repository review
Some checks failed
CI / build (push) Has been cancelled
Details
CI / check (push) Has been cancelled
Details 
P0 blockers:
- Fix migration numbering conflict and duplicate indexes
- Change comments.post_id FK to ON DELETE CASCADE
- Restrict public post detail endpoint to published posts only
- Fix rate-limiting IP extraction and fallback to ConnectInfo
- Harden HTML sanitizer: deny unknown URL schemes, restrict data URIs
- Remove session token from login response body
- Enforce image pixel/dimension limits on upload and serving

P1 high-risk:
- Validate uploads by magic bytes and decode GIF/WebP
- Add pagination/rate-limiting to search, tag posts, and comments
- Make first-admin registration and slug uniqueness check atomic
- HTML-escape comment author fields
- Improve HTML minify cache key and skip admin/error responses
- Add mobile navigation menu

P2 accessibility/quality:
- Associate form labels with inputs
- Key PostDetail article by slug to re-init scripts on navigation
- Improve image viewer keyboard accessibility
- Make theme toggle SSR-friendly and add aria-label
- Invalidate slug 404 cache on create and pending count on new comment
- Deduplicate tags case-insensitively

P3 cleanup:
- Remove unused tower-http dependency, expand make clean
- Configure DB pool timeouts and verified recycling
- Run background cleanup tasks immediately on startup
- Use SHA-256 for stable disk cache keys
- Log DB errors with Display instead of Debug
- Update README migration instructions

All tests pass (321), clippy clean, dx check clean.
 2026-06-17 10:34:14 +08:00
xfy
b6de75ee97 feat(api): 新增 list_deleted_posts 回收站列表接口 2026-06-16 12:34:28 +08:00
xfy
c60e4e08d7 fix(build): 用 cfg gate 消除 WASM 构建的 27 个假阳性 warning
Some checks failed
CI / check (push) Failing after 5m17s
Details
CI / build (push) Has been skipped
Details 
Dioxus fullstack 在 WASM 构建中会剥离 #[server] 函数体，导致仅在
函数体内使用的导入/函数/常量被误报为 unused / dead_code。

- 仅在服务端使用的导入加 #[cfg(feature="server")]：get_conn、
  PostStatus/PostStats/Tag、password/session、User/UserRole、
  slug.rs 的 dioxus::prelude（保留 ServerFnError 给 server-gated
  的 ensure_unique_slug）
- 仅在服务端使用的项加 cfg gate：clamp_pagination 及其常量、
  rebuild 常量、format_relative_time、compute_content_hash、
  CommentStatus::from_str
- CommentCountResponse/PendingCommentsResponse 出现在 #[server]
  签名中（WASM 保留），无法 gate，改用 #[allow(dead_code)]，
  与现有 CreateCommentRequest 处理一致

make build 零 warning，cargo test 299 passed。
 2026-06-16 11:29:18 +08:00
xfy
1cc4bc5aeb style(list): 简化多行表达式为单行
Some checks failed
CI / check (push) Failing after 13m53s
Details
CI / build (push) Has been skipped
Details
2026-06-15 14:15:11 +08:00
xfy
eaa7118e09 fix(posts): 钳制 page 上限，防止无界 OFFSET 与缓存键扇出 
clamp_pagination 原先仅限制 per_page，page 无上限。攻击者可用海量不同
page 值撑大缓存键空间（缓存污染）并触发无意义的超大 OFFSET 扫描。新增
MAX_PAGE=10_000，对任何实际博客都足够宽裕（配合 MAX_PER_PAGE 最多覆盖
50 万篇文章），同时把缓存键空间限制在有限范围。
 2026-06-15 11:38:24 +08:00
xfy
cfa4975813 fix(posts): 钳制分页参数 per_page 上限，消除公开接口 DoS 
list_published_posts 为无需认证的公开接口，原先 per_page 直接透传给
SQL LIMIT，攻击者可传入巨大值迫使数据库扫描并实例化超大 Vec，造成
内存放大与拒绝服务。新增 MAX_PER_PAGE=50 与 clamp_pagination()，在
list_published_posts 与 list_posts 入口钳制 page/per_page；钳制值同时
用于缓存键与查询，避免同一逻辑页落入不同缓存条目。
 2026-06-15 11:27:25 +08:00
xfy
a785683fc6 docs(posts): 补充中文注释 2026-06-12 18:50:17 +08:00
xfy
294d60afab style: format rust code
Some checks failed
CI / build (push) Has been cancelled
Details
CI / check (push) Has been cancelled
Details
2026-06-12 17:14:31 +08:00
xfy
265eb15887 feat(admin): add pagination to posts management page 
- list_posts API now accepts page/per_page params with LIMIT/OFFSET
- Add /admin/posts/:page route with PostsPage component
- Pagination component with prev/next navigation (20 posts/page)
- Update dashboard to use new list_posts(1, 5) signature
 2026-06-10 18:03:36 +08:00
xfy
5e2487a067 fix: gate helper imports with #[cfg(feature = "server")] in posts API 
Server-only helper functions (get_current_admin_user, row_to_post_list,
row_to_post_full, sync_tags, clean_tags) are defined behind
#[cfg(feature = "server")] in helpers.rs, but their imports in consumer
files were not gated, causing WASM build failures.
 2026-06-10 14:49:54 +08:00
xfy
311ddbe204 perf(cache): cache COUNT(*) result separately to avoid redundant queries 
- Add TotalPublishedPosts cache key for reusing total count across pages
- list_published_posts now checks total cache before running COUNT(*)
- Add note to get_posts_by_tag about total = posts.len() assumption
- Remove unused invalidate_total_published_posts helper
 2026-06-10 14:44:53 +08:00
xfy
44eba24121 feat: return total count from post list server functions 2026-06-10 14:14:04 +08:00
xfy
b1385efd5e refactor(api): split posts.rs into module directory 
- Move posts.rs (891 lines) to posts/ with 11 submodules
- Extract shared tag sync logic into helpers::sync_tags
- Extract tag cleaning into helpers::clean_tags
- All external import paths unchanged via mod.rs re-exports
- Zero behavioral changes, pure structural refactor
 2026-06-10 13:45:21 +08:00