+
- {/* 自绘顶条：系统红绿灯悬浮于左上，标题绝对居中（mac 原生习惯，永不重叠）；整条可拖拽 */}
-
- dudu 设置
-
-
+
@@ -164,6 +143,6 @@ export function SettingsApp() {
-
);
}
diff --git a/desktop/src/shared/WindowFrame.jsx b/desktop/src/shared/WindowFrame.jsx
new file mode 100644
index 0000000..d040427
--- /dev/null
+++ b/desktop/src/shared/WindowFrame.jsx
@@ -0,0 +1,31 @@
+// WindowFrame：透明窗口的自绘 MacWindow 框（对齐原型 DesktopShared.MacWindow 规格）。
+// 窗口须配 transparent + titleBarStyle Overlay + hiddenTitle + trafficLightPosition {18,18}；
+// 阴影用 macOS 原生（贴合内容圆角），窗口即卡片实际尺寸。设置 / 登录等窗口共用。
+export function WindowFrame({ title, children }) {
+ return (
+
+ {/* 自绘顶条：系统红绿灯悬浮左上，标题绝对居中（mac 原生习惯）；整条可拖拽 */}
+
+ {title}
+
+
+ {children}
+
+
+ );
+}
diff --git a/server/internal/auth/email.go b/server/internal/auth/email.go
new file mode 100644
index 0000000..d32ad02
--- /dev/null
+++ b/server/internal/auth/email.go
@@ -0,0 +1,152 @@
+// 邮箱验证码登录（桌面端第二登录方式）：
+// POST /v1/auth/email/code 发送 6 位验证码（60s 冷却，码 10 分钟有效）
+// POST /v1/auth/email 校验验证码 → 建号/登录 → JWT
+// 邮件发送经 Mailer 接口；SMTP 未配置时装配 MockMailer（验证码打日志，供联调）。
+package auth
+
+import (
+ "context"
+ "crypto/rand"
+ "crypto/subtle"
+ "errors"
+ "log/slog"
+ "net/http"
+ "strings"
+ "time"
+
+ "github.com/gin-gonic/gin"
+ "github.com/google/uuid"
+ "github.com/redis/go-redis/v9"
+ "gorm.io/gorm"
+
+ "dudu/server/internal/store"
+ "dudu/server/pkg/protocol"
+)
+
+const (
+ emailCodeTTL = 10 * time.Minute
+ emailCodeCooldown = 60 * time.Second
+)
+
+// Mailer 验证码邮件发送。
+type Mailer interface {
+ SendCode(ctx context.Context, email, code string) error
+}
+
+// MockMailer 开发期 mock：验证码打日志不真发（⚠️ 上线前必须替换 SMTP 实现）。
+type MockMailer struct{}
+
+func (MockMailer) SendCode(_ context.Context, email, code string) error {
+ slog.Info("mock mailer: email login code", "email", email, "code", code)
+ return nil
+}
+
+// randCode 6 位数字验证码（crypto/rand）。
+func randCode() string {
+ b := make([]byte, 6)
+ _, _ = rand.Read(b)
+ digits := make([]byte, 6)
+ for i, v := range b {
+ digits[i] = '0' + v%10
+ }
+ return string(digits)
+}
+
+// EmailCode POST /v1/auth/email/code 🔓
+func (h *Handlers) EmailCode(c *gin.Context) {
+ var req protocol.AuthEmailCodeRequest
+ if err := c.ShouldBindJSON(&req); err != nil {
+ c.JSON(http.StatusBadRequest, protocol.NewAPIError(protocol.ErrBadRequest))
+ return
+ }
+ email := strings.ToLower(strings.TrimSpace(req.Email))
+
+ // 60s 冷却（SET NX），防轰炸
+ ok, err := h.RDB.SetNX(c, store.KeyAuthEmailCd(email), 1, emailCodeCooldown).Result()
+ if err != nil {
+ c.JSON(http.StatusInternalServerError, protocol.NewAPIError(protocol.ErrInternal))
+ return
+ }
+ if !ok {
+ c.JSON(http.StatusTooManyRequests, protocol.NewAPIError(protocol.ErrRateLimited))
+ return
+ }
+
+ code := randCode()
+ if err := h.RDB.Set(c, store.KeyAuthEmail(email), code, emailCodeTTL).Err(); err != nil {
+ c.JSON(http.StatusInternalServerError, protocol.NewAPIError(protocol.ErrInternal))
+ return
+ }
+ if err := h.Mailer.SendCode(c, email, code); err != nil {
+ slog.Error("send email code failed", "email", email, "err", err)
+ c.JSON(http.StatusInternalServerError, protocol.NewAPIError(protocol.ErrInternal))
+ return
+ }
+ c.Status(http.StatusNoContent)
+}
+
+// EmailLogin POST /v1/auth/email 🔓
+func (h *Handlers) EmailLogin(c *gin.Context) {
+ var req protocol.AuthEmailRequest
+ if err := c.ShouldBindJSON(&req); err != nil {
+ c.JSON(http.StatusBadRequest, protocol.NewAPIError(protocol.ErrBadRequest))
+ return
+ }
+ email := strings.ToLower(strings.TrimSpace(req.Email))
+
+ want, err := h.RDB.Get(c, store.KeyAuthEmail(email)).Result()
+ if err == redis.Nil || subtle.ConstantTimeCompare([]byte(want), []byte(req.Code)) != 1 {
+ c.JSON(http.StatusBadRequest, protocol.NewAPIError(protocol.ErrBadRequest))
+ return
+ }
+ if err != nil && err != redis.Nil {
+ c.JSON(http.StatusInternalServerError, protocol.NewAPIError(protocol.ErrInternal))
+ return
+ }
+ // 一次性：校验通过即删，防复用
+ h.RDB.Del(c, store.KeyAuthEmail(email))
+
+ user, err := findOrCreateUserByEmail(h.DB, email)
+ if err != nil {
+ c.JSON(http.StatusInternalServerError, protocol.NewAPIError(protocol.ErrInternal))
+ return
+ }
+ token, err := h.JWT.Sign(user.ID)
+ if err != nil {
+ c.JSON(http.StatusInternalServerError, protocol.NewAPIError(protocol.ErrInternal))
+ return
+ }
+ c.JSON(http.StatusOK, protocol.AuthTokenResponse{
+ Token: token,
+ User: protocol.UserInfo{UserID: user.ID, NicknameMasked: MaskNickname(user.Nickname)},
+ })
+}
+
+// findOrCreateUserByEmail 邮箱身份建号/登录（昵称取邮箱前缀）。
+func findOrCreateUserByEmail(db *gorm.DB, email string) (*store.User, error) {
+ var ident store.EmailIdentity
+ err := db.Where("email = ?", email).First(&ident).Error
+ if err == nil {
+ var u store.User
+ return &u, db.First(&u, "id = ?", ident.UserID).Error
+ }
+ if !errors.Is(err, gorm.ErrRecordNotFound) {
+ return nil, err
+ }
+
+ nick := email
+ if i := strings.IndexByte(email, '@'); i > 0 {
+ nick = email[:i]
+ }
+ user := store.User{ID: strings.ReplaceAll(uuid.NewString(), "-", "")[:24], Nickname: nick}
+ err = db.Transaction(func(tx *gorm.DB) error {
+ if err := tx.Create(&user).Error; err != nil {
+ return err
+ }
+ return tx.Create(&store.EmailIdentity{UserID: user.ID, Email: email}).Error
+ })
+ if err != nil {
+ return nil, err
+ }
+ return &user, nil
+}
diff --git a/server/internal/auth/handlers.go b/server/internal/auth/handlers.go
index 66c454e..1dbfa8a 100644
--- a/server/internal/auth/handlers.go
+++ b/server/internal/auth/handlers.go
@@ -14,12 +14,13 @@ import (
"dudu/server/pkg/protocol"
)
-// Handlers 认证路由：扫码（5B）、微信 OAuth（5C）、logout。
+// Handlers 认证路由：扫码（5B）、微信 OAuth（5C）、邮箱验证码、logout。
type Handlers struct {
DB *gorm.DB
RDB *redis.Client
JWT *JWT
Wechat WechatClient
+ Mailer Mailer
// QrAuthURL 二维码内容模板（真实环境为微信开放平台授权页，%s 为 state）
QrAuthURL string
}
diff --git a/server/internal/config/config.go b/server/internal/config/config.go
index 2e20a45..b0ccdbb 100644
--- a/server/internal/config/config.go
+++ b/server/internal/config/config.go
@@ -40,6 +40,9 @@ type Config struct {
OSSKeyID string
OSSKeySecret string
+ // SMTP（邮箱验证码登录；未配置降级 mock mailer）
+ SMTPHost string
+
// AppLatest 启动时解析 APP_LATEST_JSON 一次（17G）：平台→版本信息。
// 解析失败或未配置则为 nil/空，handler 据此返回 204，不 fail-fast。
AppLatest map[string]protocol.AppLatestResponse
@@ -70,6 +73,7 @@ func Load() Config {
OSSEndpoint: os.Getenv("OSS_ENDPOINT"),
OSSBucket: os.Getenv("OSS_BUCKET"),
+ SMTPHost: os.Getenv("SMTP_HOST"),
OSSKeyID: os.Getenv("OSS_KEY_ID"),
OSSKeySecret: os.Getenv("OSS_KEY_SECRET"),
diff --git a/server/internal/httpapi/api_test.go b/server/internal/httpapi/api_test.go
index 75ba5cf..368584f 100644
--- a/server/internal/httpapi/api_test.go
+++ b/server/internal/httpapi/api_test.go
@@ -24,7 +24,7 @@ import (
"dudu/server/pkg/protocol"
)
-func newAPI(t *testing.T) (*httptest.Server, *gorm.DB) {
+func newAPI(t *testing.T) (*httptest.Server, *gorm.DB, *redis.Client) {
t.Helper()
gin.SetMode(gin.TestMode)
mr := miniredis.RunT(t)
@@ -45,7 +45,7 @@ func newAPI(t *testing.T) (*httptest.Server, *gorm.DB) {
Register(r, &Deps{Cfg: cfg, DB: db, RDB: rdb, JWT: jwt, Quota: quota.New(rdb, db)})
srv := httptest.NewServer(r)
t.Cleanup(srv.Close)
- return srv, db
+ return srv, db, rdb
}
func postJSON(t *testing.T, url, token string, body any) *http.Response {
@@ -93,7 +93,7 @@ func login(t *testing.T, srv *httptest.Server, code string) string {
}
func TestMobileLoginAndMe(t *testing.T) {
- srv, _ := newAPI(t)
+ srv, _, _ := newAPI(t)
token := login(t, srv, "wangjia99")
var me protocol.MeResponse
@@ -120,7 +120,7 @@ func TestMobileLoginAndMe(t *testing.T) {
}
func TestQrLoginFlow(t *testing.T) {
- srv, _ := newAPI(t)
+ srv, _, _ := newAPI(t)
resp := postJSON(t, srv.URL+"/v1/auth/qr", "", nil)
var qr protocol.AuthQrResponse
_ = json.NewDecoder(resp.Body).Decode(&qr)
@@ -154,7 +154,7 @@ func TestQrLoginFlow(t *testing.T) {
}
func TestOrderAndPayNotifyIdempotent(t *testing.T) {
- srv, db := newAPI(t)
+ srv, db, _ := newAPI(t)
token := login(t, srv, "buyer1")
// packs
@@ -235,7 +235,7 @@ func postFeedback(t *testing.T, srv *httptest.Server, token, content string, ima
}
func TestFeedback(t *testing.T) {
- srv, db := newAPI(t)
+ srv, db, _ := newAPI(t)
token := login(t, srv, "fbuser")
t.Cleanup(func() { _ = removeUploads() })
@@ -287,7 +287,7 @@ func TestFeedback(t *testing.T) {
func removeUploads() error { return nil } // LocalStorage 写入 var/uploads，测试容忍残留
func TestMetricsBatchAndAggregate(t *testing.T) {
- srv, db := newAPI(t)
+ srv, db, _ := newAPI(t)
body := protocol.MetricsBatchRequest{
DeviceID: "dev-m1", Platform: "mac", AppVersion: "0.1.0",
Events: []protocol.MetricEvent{
@@ -314,3 +314,55 @@ func TestMetricsBatchAndAggregate(t *testing.T) {
t.Fatalf("want 2 events stored (whitelist), got %d", n)
}
}
+
+// 邮箱验证码登录 E2E：发码（60s 冷却）→ 取码登录 → token 可用 → 码一次性。
+func TestEmailLogin(t *testing.T) {
+ srv, _, rdb := newAPI(t)
+
+ // 发码
+ resp := postJSON(t, srv.URL+"/v1/auth/email/code", "", map[string]string{"email": "Dev@Example.com"})
+ if resp.StatusCode != http.StatusNoContent {
+ t.Fatalf("send code: want 204, got %d", resp.StatusCode)
+ }
+ // 冷却期内再发 → 429
+ resp = postJSON(t, srv.URL+"/v1/auth/email/code", "", map[string]string{"email": "dev@example.com"})
+ if resp.StatusCode != http.StatusTooManyRequests {
+ t.Fatalf("cooldown: want 429, got %d", resp.StatusCode)
+ }
+
+ code, err := rdb.Get(t.Context(), store.KeyAuthEmail("dev@example.com")).Result()
+ if err != nil {
+ t.Fatal(err)
+ }
+
+ // 错码拒绝
+ resp = postJSON(t, srv.URL+"/v1/auth/email", "", map[string]string{"email": "dev@example.com", "code": "000000"})
+ if code != "000000" && resp.StatusCode != http.StatusBadRequest {
+ t.Fatalf("wrong code: want 400, got %d", resp.StatusCode)
+ }
+
+ // 正确码登录
+ resp = postJSON(t, srv.URL+"/v1/auth/email", "", map[string]string{"email": "DEV@example.com", "code": code})
+ if resp.StatusCode != http.StatusOK {
+ t.Fatalf("login: want 200, got %d", resp.StatusCode)
+ }
+ var tok protocol.AuthTokenResponse
+ _ = json.NewDecoder(resp.Body).Decode(&tok)
+ if tok.Token == "" || tok.User.UserID == "" {
+ t.Fatalf("empty token/user: %+v", tok)
+ }
+
+ // token 可访问 /v1/me
+ req, _ := http.NewRequest("GET", srv.URL+"/v1/me", nil)
+ req.Header.Set("Authorization", "Bearer "+tok.Token)
+ meResp, err := http.DefaultClient.Do(req)
+ if err != nil || meResp.StatusCode != http.StatusOK {
+ t.Fatalf("me with email token: %v %d", err, meResp.StatusCode)
+ }
+
+ // 码一次性：复用被拒
+ resp = postJSON(t, srv.URL+"/v1/auth/email", "", map[string]string{"email": "dev@example.com", "code": code})
+ if resp.StatusCode != http.StatusBadRequest {
+ t.Fatalf("code reuse: want 400, got %d", resp.StatusCode)
+ }
+}
diff --git a/server/internal/httpapi/router.go b/server/internal/httpapi/router.go
index f7a4a10..382ee43 100644
--- a/server/internal/httpapi/router.go
+++ b/server/internal/httpapi/router.go
@@ -53,6 +53,15 @@ func pickWechat(cfg config.Config) (auth.WechatClient, string) {
return auth.MockWechat{}, "mock" // TODO(5C-真实): 开放平台实现，凭证就绪后替换
}
+// pickMailer SMTP 未配置时使用 mock（验证码打日志，供联调）。返回 kind。
+// ⚠️ 上线前必须配置真实 SMTP，否则邮箱登录形同虚设。
+func pickMailer(cfg config.Config) (auth.Mailer, string) {
+ if cfg.SMTPHost == "" {
+ return auth.MockMailer{}, "mock"
+ }
+ return auth.MockMailer{}, "mock" // TODO(邮箱登录-真实): SMTP 实现，凭证就绪后替换
+}
+
// pickPay 商户号未配置（#2B 申请中）时使用 mock。返回 kind="mock"。
// ⚠️⚠️ 上线前必须替换为真实 PayClient！MockPay 不验签，/v1/pay/notify 等于公开充值接口。
func pickPay(cfg config.Config) (billing.PayClient, string) {
@@ -78,12 +87,14 @@ func Register(r *gin.Engine, d *Deps) {
wechat, wechatKind := pickWechat(d.Cfg)
pay, payKind := pickPay(d.Cfg)
storage, storageKind := pickStorage(d.Cfg)
+ mailer, mailerKind := pickMailer(d.Cfg)
// 启动时打印各外部依赖的装配结果（real/mock），便于部署核对（17E）。
slog.Info("dependency assembly",
- "asr_provider", providerKind, "wechat", wechatKind, "pay", payKind, "storage", storageKind)
+ "asr_provider", providerKind, "wechat", wechatKind, "pay", payKind,
+ "storage", storageKind, "mailer", mailerKind)
- authH := &auth.Handlers{DB: d.DB, RDB: d.RDB, JWT: d.JWT, Wechat: wechat}
+ authH := &auth.Handlers{DB: d.DB, RDB: d.RDB, JWT: d.JWT, Wechat: wechat, Mailer: mailer}
billH := &billing.Handlers{DB: d.DB, Pay: pay, Quota: d.Quota}
userH := &user.Handlers{DB: d.DB, Quota: d.Quota, AppVersions: d.Cfg.AppLatest}
fbH := &feedback.Handlers{DB: d.DB, RDB: d.RDB, Storage: storage}
@@ -103,6 +114,8 @@ func Register(r *gin.Engine, d *Deps) {
v1.GET("/auth/qr/:state", authH.PollQr)
v1.GET("/auth/wechat/callback", authH.QrCallback)
v1.POST("/auth/wechat", authH.MobileLogin)
+ v1.POST("/auth/email/code", authH.EmailCode)
+ v1.POST("/auth/email", authH.EmailLogin)
v1.GET("/packs", billH.Packs)
// ⚠️ 部署前必须切换到真实 PayClient（验签）！当前 MockPay 不验签，
// /v1/pay/notify 等于一个无鉴权的公开充值接口（任意人可伪造支付成功回调充值）。
diff --git a/server/internal/httpapi/var/uploads/fb/fb26c952f029ea46508af6bf/1.png b/server/internal/httpapi/var/uploads/fb/fb26c952f029ea46508af6bf/1.png
new file mode 100644
index 0000000..c9576d5
Binary files /dev/null and b/server/internal/httpapi/var/uploads/fb/fb26c952f029ea46508af6bf/1.png differ
diff --git a/server/internal/httpapi/var/uploads/fb/fb310c1bc197f04014896e6d/1.png b/server/internal/httpapi/var/uploads/fb/fb310c1bc197f04014896e6d/1.png
new file mode 100644
index 0000000..c9576d5
Binary files /dev/null and b/server/internal/httpapi/var/uploads/fb/fb310c1bc197f04014896e6d/1.png differ
diff --git a/server/internal/store/models.go b/server/internal/store/models.go
index 97b7997..880b02b 100644
--- a/server/internal/store/models.go
+++ b/server/internal/store/models.go
@@ -24,6 +24,14 @@ type WechatIdentity struct {
CreatedAt time.Time
}
+// EmailIdentity 邮箱验证码登录身份（桌面端第二登录方式）。
+type EmailIdentity struct {
+ ID uint `gorm:"primaryKey"`
+ UserID string `gorm:"size:32;index;not null"`
+ Email string `gorm:"size:255;uniqueIndex;not null"`
+ CreatedAt time.Time
+}
+
type DurationPack struct {
ID string `gorm:"primaryKey;size:32"`
Minutes int `gorm:"not null"`
@@ -141,10 +149,10 @@ type MetricDaily struct {
P95Ms float64 `gorm:"not null;default:0"`
}
-// AllModels 迁移清单（11 张表）。
+// AllModels 迁移清单（12 张表）。
func AllModels() []any {
return []any{
- &User{}, &WechatIdentity{}, &DurationPack{}, &Order{}, &BalanceLedger{},
+ &User{}, &WechatIdentity{}, &EmailIdentity{}, &DurationPack{}, &Order{}, &BalanceLedger{},
&TrialUsage{}, &ASRSession{}, &Device{}, &Feedback{}, &MetricEvent{}, &MetricDaily{},
}
}
diff --git a/server/internal/store/redis.go b/server/internal/store/redis.go
index b362bb4..50b4463 100644
--- a/server/internal/store/redis.go
+++ b/server/internal/store/redis.go
@@ -13,6 +13,8 @@ func KeyQuotaTrial(uid string, day string) string {
return "quota:" + uid + ":trial:" + day
}
func KeyAuthQr(state string) string { return "authqr:" + state }
+func KeyAuthEmail(email string) string { return "authmail:" + email }
+func KeyAuthEmailCd(email string) string { return "authmail:cd:" + email }
func KeyJwtBlock(jti string) string { return "jwt:block:" + jti }
func KeyRateCnt(did string) string { return "rate:" + did + ":asr:cnt" }
func KeyRateSecs(did string) string { return "rate:" + did + ":asr:secs" }
diff --git a/server/pkg/protocol/dto.go b/server/pkg/protocol/dto.go
index cbdc42b..1721b93 100644
--- a/server/pkg/protocol/dto.go
+++ b/server/pkg/protocol/dto.go
@@ -17,6 +17,16 @@ type AuthWechatRequest struct {
Code string `json:"code" binding:"required"`
}
+// 邮箱验证码登录（桌面端第二登录方式）
+type AuthEmailCodeRequest struct {
+ Email string `json:"email" binding:"required,email"`
+}
+
+type AuthEmailRequest struct {
+ Email string `json:"email" binding:"required,email"`
+ Code string `json:"code" binding:"required,len=6"`
+}
+
type AuthTokenResponse struct {
Token string `json:"token"`
User UserInfo `json:"user"`