Compare commits
7 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 wangjia
|
7bbc944ae2 | ||
|
wangjia
|
0d967e899a | ||
|
wangjia
|
0a21ea5b2a | ||
|
wangjia
|
9b6dba4c2b | ||
|
wangjia
|
54451f0e52 | ||
|
wangjia
|
8fc24b5d36 | ||
|
wangjia
|
6ac6b52717 |
@@ -1,152 +0,0 @@
|
||||
---
|
||||
name: archive-design
|
||||
description: 将已确认上线的 Figma 设计稿存档到 docs/design/archive/。接收 Figma 文件链接，通过 Figma MCP 读取设计内容，自动整理并写入存档文档。在设计确认、功能上线后调用。
|
||||
allowed-tools: Read, Write, Glob, Grep
|
||||
user-invocable: true
|
||||
argument-hint: <figma-url> <功能名称> [版本号，默认v1]
|
||||
---
|
||||
|
||||
# 设计存档工作流
|
||||
|
||||
你正在执行 `/archive-design` 命令，将已确认的 Figma 设计存档。
|
||||
|
||||
## 参数解析
|
||||
|
||||
```
|
||||
$ARGUMENTS 格式：<figma-url> <功能名称> [版本]
|
||||
示例：https://figma.com/file/xxx 入库单 v1
|
||||
```
|
||||
|
||||
从 `$ARGUMENTS` 中提取：
|
||||
- `FIGMA_URL`：Figma 文件链接
|
||||
- `FEATURE_NAME`：功能名称（用于目录和文件命名）
|
||||
- `VERSION`：版本号，未提供则默认 `v1`
|
||||
|
||||
## 执行步骤
|
||||
|
||||
### Step 1：读取 Figma 文件
|
||||
|
||||
使用 Figma MCP 工具读取设计文件内容：
|
||||
- 获取所有页面列表
|
||||
- 获取主要页面的组件结构
|
||||
- 获取设计 Token（颜色、文字样式、间距）
|
||||
- 获取组件列表和说明
|
||||
|
||||
如果 Figma MCP 不可用，跳过此步骤，仅记录链接和手动填写的信息。
|
||||
|
||||
### Step 2：读取已有需求和架构文档
|
||||
|
||||
读取以下文件，补充存档上下文：
|
||||
- `docs/requirements/{功能名称}.md`（如存在）
|
||||
- `docs/api/{功能名称}.md`（如存在）
|
||||
- `docs/design/{功能名称}-design-brief.md`（如存在）
|
||||
|
||||
### Step 3：写入存档文档
|
||||
|
||||
创建 `docs/design/archive/{功能名称}/{版本}/design-archive.md`：
|
||||
|
||||
```markdown
|
||||
# {功能名称} — 设计存档 {版本}
|
||||
|
||||
**存档时间**：{当前日期}
|
||||
**Figma 文件**：{FIGMA_URL}
|
||||
**状态**：✅ 已确认上线
|
||||
|
||||
---
|
||||
|
||||
## 设计概览
|
||||
|
||||
### 页面清单
|
||||
|
||||
| 页面名称 | Figma 画板 | 说明 |
|
||||
|---------|-----------|------|
|
||||
| （从 Figma 读取或手动填写）|
|
||||
|
||||
### 核心设计决策
|
||||
|
||||
（从 docs/design/{功能名称}-design-brief.md 中提取设计目标和关键决策）
|
||||
|
||||
---
|
||||
|
||||
## 设计规范
|
||||
|
||||
### 颜色使用
|
||||
|
||||
```yaml
|
||||
（从 Figma 读取，或按项目基础规范填写）
|
||||
主色: #1565C0 用于：顶栏、主按钮、链接
|
||||
成功色: #2E7D32 用于：已审核状态标签
|
||||
危险色: #C62828 用于：删除操作、库存不足警告
|
||||
```
|
||||
|
||||
### 组件清单
|
||||
|
||||
```yaml
|
||||
（列出本功能使用的主要组件）
|
||||
复用现有组件:
|
||||
- AppDataTable：通用数据表格
|
||||
- StatusBadge：状态标签
|
||||
- FormDialog：弹窗表单
|
||||
|
||||
新增组件:
|
||||
- （从 Figma 读取或手动填写）
|
||||
```
|
||||
|
||||
### 关键尺寸
|
||||
|
||||
```yaml
|
||||
（从 Figma 读取，或手动填写关键布局尺寸）
|
||||
弹窗宽度: 720px
|
||||
表格行高: 48px
|
||||
工具栏高: 52px
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## 交互说明
|
||||
|
||||
（描述关键交互逻辑，如状态流转、操作确认弹窗等）
|
||||
|
||||
---
|
||||
|
||||
## 与需求的对应关系
|
||||
|
||||
| 用户故事 | 设计实现 |
|
||||
|---------|---------|
|
||||
| （从需求文档提取，对应到具体设计页面）|
|
||||
|
||||
---
|
||||
|
||||
## 历史版本
|
||||
|
||||
| 版本 | 时间 | 变更说明 |
|
||||
|------|------|---------|
|
||||
| {版本} | {当前日期} | 初始版本 |
|
||||
```
|
||||
|
||||
### Step 4：更新设计索引
|
||||
|
||||
在 `docs/design/archive/INDEX.md` 中追加一行记录（如文件不存在则创建）：
|
||||
|
||||
```markdown
|
||||
# 设计存档索引
|
||||
|
||||
| 功能 | 版本 | 存档时间 | Figma 链接 | 存档文档 |
|
||||
|------|------|---------|-----------|---------|
|
||||
| {功能名称} | {版本} | {日期} | [查看]({FIGMA_URL}) | [文档](/{功能名称}/{版本}/design-archive.md) |
|
||||
```
|
||||
|
||||
### Step 5：完成提示
|
||||
|
||||
输出：
|
||||
```
|
||||
✅ 设计存档完成
|
||||
|
||||
📁 存档路径：docs/design/archive/{功能名称}/{版本}/design-archive.md
|
||||
🔗 Figma 链接：{FIGMA_URL}
|
||||
📋 索引已更新：docs/design/archive/INDEX.md
|
||||
|
||||
下一步建议：
|
||||
- 运行 /design-review 对比实现与设计稿的差异
|
||||
- 提交存档文件到 git：git add docs/design/archive/
|
||||
```
|
||||
@@ -1,127 +0,0 @@
|
||||
---
|
||||
name: design-review
|
||||
description: 对比 Figma 设计稿与 Flutter 实现代码，输出还原度差异报告。在 flutter-coder 实现完成后、上线前调用，确保实现与设计一致。
|
||||
allowed-tools: Read, Write, Glob, Grep
|
||||
user-invocable: true
|
||||
argument-hint: <figma-url> <功能名称>
|
||||
---
|
||||
|
||||
# 设计还原度检查工作流
|
||||
|
||||
你正在执行 `/design-review` 命令，对比 Figma 设计稿与 Flutter 实现的差异。
|
||||
|
||||
## 参数解析
|
||||
|
||||
```
|
||||
$ARGUMENTS 格式：<figma-url> <功能名称>
|
||||
示例：https://figma.com/file/xxx 入库单
|
||||
```
|
||||
|
||||
## 执行步骤
|
||||
|
||||
### Step 1：读取 Figma 设计规范
|
||||
|
||||
使用 Figma MCP 读取：
|
||||
- 各页面的组件结构和层级
|
||||
- 颜色值（精确到 hex）
|
||||
- 字体大小、字重
|
||||
- 间距数值（padding、margin、gap）
|
||||
- 组件状态（hover、disabled、selected 等）
|
||||
|
||||
如果 Figma MCP 不可用，读取 `docs/design/{功能名称}-design-brief.md` 中的设计规范作为对照基准。
|
||||
|
||||
### Step 2：读取 Flutter 实现代码
|
||||
|
||||
查找并读取相关实现文件：
|
||||
|
||||
```
|
||||
client/lib/screens/ → 找到功能名称相关的 screen 文件
|
||||
client/lib/widgets/ → 找到使用的组件文件
|
||||
client/lib/models/ → 数据模型
|
||||
```
|
||||
|
||||
重点检查：
|
||||
- 颜色是否使用了正确的 hex 值或 Theme 变量
|
||||
- 字体大小、字重是否与设计一致
|
||||
- 间距（padding/margin）数值是否匹配
|
||||
- 组件状态样式是否完整实现
|
||||
- 布局结构是否与设计稿一致
|
||||
|
||||
### Step 3：生成差异报告
|
||||
|
||||
写入 `docs/review/{功能名称}-design-review.md`：
|
||||
|
||||
```markdown
|
||||
# {功能名称} — 设计还原度报告
|
||||
|
||||
**检查时间**：{当前日期}
|
||||
**Figma 设计稿**：{FIGMA_URL}
|
||||
**检查范围**：{列出检查的 Flutter 文件}
|
||||
|
||||
---
|
||||
|
||||
## 总体评分
|
||||
|
||||
还原度：**X / 10**
|
||||
（10分=完全一致，8分=细节有出入，6分=布局基本对但样式差异明显）
|
||||
|
||||
---
|
||||
|
||||
## 必须修复（影响视觉一致性）
|
||||
|
||||
### [DR-001] 颜色不一致
|
||||
**页面**：入库单列表 — 状态标签
|
||||
**设计稿**：已审核状态背景色 `#E8F5E9`，文字 `#2E7D32`
|
||||
**实现**：背景色 `Colors.green.shade100`（实际值 `#DCEDC8`，偏浅）
|
||||
**文件**：`client/lib/widgets/status_badge.dart:34`
|
||||
**修复**：改为 `Color(0xFFE8F5E9)`
|
||||
|
||||
### [DR-002] 间距不一致
|
||||
**页面**：新建入库单弹窗
|
||||
**设计稿**：表单字段间距 16px
|
||||
**实现**：`SizedBox(height: 12)` — 差了 4px
|
||||
**文件**：`client/lib/screens/stock_in/stock_in_form.dart:67`
|
||||
**修复**：改为 `SizedBox(height: 16)`
|
||||
|
||||
---
|
||||
|
||||
## 建议调整（不影响主要功能，但影响精细度）
|
||||
|
||||
### [DR-003] 字体字重
|
||||
**页面**：表格标题行
|
||||
**设计稿**：`FontWeight.w600`
|
||||
**实现**：`FontWeight.bold`（实际是 w700，略粗）
|
||||
**建议**：统一改为 `FontWeight.w600`
|
||||
|
||||
---
|
||||
|
||||
## 通过检查项
|
||||
|
||||
- ✅ 整体布局结构与设计稿一致
|
||||
- ✅ 主色 #1565C0 使用正确
|
||||
- ✅ 顶栏高度 56px 正确
|
||||
- ✅ 侧边栏宽度 200px 正确
|
||||
- ✅ 状态流转交互与设计一致
|
||||
|
||||
---
|
||||
|
||||
## 修复建议
|
||||
|
||||
优先处理 DR-001、DR-002（颜色和间距是最直观的差异）。
|
||||
修复后可再次运行 `/design-review` 验证。
|
||||
```
|
||||
|
||||
### Step 4：完成提示
|
||||
|
||||
输出：
|
||||
```
|
||||
✅ 设计还原度检查完成
|
||||
|
||||
📋 报告路径：docs/review/{功能名称}-design-review.md
|
||||
🔍 发现问题：必须修复 X 项，建议调整 Y 项
|
||||
|
||||
后续步骤：
|
||||
1. 将报告发给 flutter-coder 修复（必须修复项）
|
||||
2. 修复后再次运行 /design-review 验证
|
||||
3. 全部通过后运行 /archive-design 存档设计稿
|
||||
```
|
||||
@@ -55,6 +55,10 @@ coverage/
|
||||
|
||||
# 编译产物（后端可执行文件）
|
||||
backend/issue
|
||||
backend/gencode
|
||||
|
||||
# 全局 todo skill 的本地数据（看板/任务，不入库）
|
||||
/todo/
|
||||
|
||||
# Claude 私有文件
|
||||
.claude/commands/
|
||||
|
||||
@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
|
||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
||||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
## [1.0.59] - 2026-06-19
|
||||
|
||||
### 新功能
|
||||
- 授权到期后可在界面内直接续费：输入兑换码（形如 JIUKU-XXXX-XXXX）即可为门店叠加授权时长
|
||||
|
||||
### 改进
|
||||
- 品牌焕新：登录页启用「岩美酒库」品牌标识，桌面 / 移动 / 网页各端应用图标统一为品牌图标
|
||||
- 「激活授权」改为「兑换激活码」语义，文案与提示更贴合按时长续期的使用方式
|
||||
- 授权状态实时生效：续费、到期或授权被调整后无需重新登录即可刷新；账号被停用或在其他设备登录时及时自动退出
|
||||
- 「退出登录」收入右上角用户名下拉菜单，界面更聚焦
|
||||
|
||||
## [1.0.58] - 2026-06-18
|
||||
|
||||
### 修复
|
||||
|
||||
@@ -5,6 +5,21 @@
|
||||
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
|
||||
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
|
||||
|
||||
## [1.0.62] - 2026-06-19
|
||||
|
||||
### 新功能
|
||||
- 服务端新增多维限流防护：按客户端 IP、按门店分别限速，登录/注册/刷新令牌等敏感接口与公开查询接口各有独立速率上限，有效抵御恶意刷接口与流量冲击（DDoS），正常使用不受影响
|
||||
- 登录暴力破解加固：除按账号锁定外，新增按来源 IP 的失败次数限制，单一 IP 连续撞库多个账号会被整体拦截
|
||||
|
||||
### 改进
|
||||
- 在反向代理后正确识别真实客户端 IP，使限流与失败锁定按真实来源计数，避免误伤同一出口的正常用户
|
||||
- 门店可保存录入默认值（默认系列/规格等）等轻量配置，刷新页面后依然保留
|
||||
|
||||
## [1.0.61] - 2026-06-19
|
||||
|
||||
### 改进
|
||||
- 平台侧兑换券生成工具随服务端一并发布并部署到服务器，可直接在服务器上批量生成激活码，无需每次本地编译上传；同步清理已退役的授权签名相关配置项
|
||||
|
||||
## [1.0.60] - 2026-06-19
|
||||
|
||||
### 新功能
|
||||
|
||||
+38
-12
@@ -8,16 +8,17 @@ import (
|
||||
)
|
||||
|
||||
type Config struct {
|
||||
Server ServerConfig
|
||||
Database DatabaseConfig
|
||||
JWT JWTConfig
|
||||
Storage StorageConfig
|
||||
Session SessionConfig
|
||||
Server ServerConfig
|
||||
Database DatabaseConfig
|
||||
JWT JWTConfig
|
||||
Storage StorageConfig
|
||||
Session SessionConfig
|
||||
RateLimit RateLimitConfig
|
||||
}
|
||||
|
||||
type ServerConfig struct {
|
||||
Port string `mapstructure:"port"`
|
||||
Mode string `mapstructure:"mode"` // debug | release
|
||||
Mode string `mapstructure:"mode"` // debug | release
|
||||
CORSOrigin string `mapstructure:"cors_origin"` // 允许的 CORS 来源，生产设为具体域名
|
||||
}
|
||||
|
||||
@@ -35,12 +36,27 @@ type JWTConfig struct {
|
||||
|
||||
// SessionConfig 登录会话与并发限制（全局默认，可被每店 session_policy 覆盖）。
|
||||
type SessionConfig struct {
|
||||
LimitDesktop int `mapstructure:"limit_desktop"` // 桌面端(win/mac/linux)最大并发会话，0=禁止
|
||||
LimitMobile int `mapstructure:"limit_mobile"` // 移动端(android/ios)最大并发会话，0=禁止
|
||||
LimitWeb int `mapstructure:"limit_web"` // web 端最大并发会话，0=禁止
|
||||
MaxFailures int `mapstructure:"max_failures"` // 连续登录失败几次后锁定
|
||||
LockMinutes int `mapstructure:"lock_minutes"` // 锁定时长（分钟）
|
||||
RetentionDays int `mapstructure:"retention_days"` // 已撤销/过期会话与失败登录记录的保留天数，过期后台清理
|
||||
LimitDesktop int `mapstructure:"limit_desktop"` // 桌面端(win/mac/linux)最大并发会话，0=禁止
|
||||
LimitMobile int `mapstructure:"limit_mobile"` // 移动端(android/ios)最大并发会话，0=禁止
|
||||
LimitWeb int `mapstructure:"limit_web"` // web 端最大并发会话，0=禁止
|
||||
MaxFailures int `mapstructure:"max_failures"` // 同一账号连续登录失败几次后锁定
|
||||
IPMaxFailures int `mapstructure:"ip_max_failures"` // 同一 IP 跨账号累计失败几次后锁定该 IP（防单 IP 撞多账号）
|
||||
LockMinutes int `mapstructure:"lock_minutes"` // 锁定时长（分钟）
|
||||
RetentionDays int `mapstructure:"retention_days"` // 已撤销/过期会话与失败登录记录的保留天数，过期后台清理
|
||||
}
|
||||
|
||||
// RateLimitConfig 应用层限流（按真实客户端 IP / 按门店）。各 *PerMin 为每分钟允许次数，
|
||||
// burst 取同值（允许一分钟额度的突发，之后按速率回补）。Enabled=false 时所有限流放行。
|
||||
type RateLimitConfig struct {
|
||||
Enabled bool `mapstructure:"enabled"`
|
||||
LoginPerMin int `mapstructure:"login_per_min"` // 未鉴权 /auth/login，按 IP
|
||||
RefreshPerMin int `mapstructure:"refresh_per_min"` // 未鉴权 /auth/refresh，按 IP
|
||||
RegisterPerMin int `mapstructure:"register_per_min"` // 未鉴权 /public/register，按 IP
|
||||
ErrorsPerMin int `mapstructure:"errors_per_min"` // 未鉴权 /public/errors，按 IP
|
||||
ShopListPerMin int `mapstructure:"shop_list_per_min"` // 公开商品列表（主爬取入口），按 IP，最紧
|
||||
PublicReadPerMin int `mapstructure:"public_read_per_min"` // 其余公开读接口（单品/release），按 IP
|
||||
ShopRPS int `mapstructure:"shop_rps"` // 认证流量每店每秒，按 shop_id
|
||||
ShopBurst int `mapstructure:"shop_burst"` // 认证流量每店突发
|
||||
}
|
||||
|
||||
type StorageConfig struct {
|
||||
@@ -80,8 +96,18 @@ func Load() {
|
||||
viper.SetDefault("session.limit_mobile", 2)
|
||||
viper.SetDefault("session.limit_web", 2) // 默认不禁 web（官网挂着 Web 版 app）；设 0 可禁
|
||||
viper.SetDefault("session.max_failures", 5)
|
||||
viper.SetDefault("session.ip_max_failures", 20)
|
||||
viper.SetDefault("session.lock_minutes", 15)
|
||||
viper.SetDefault("session.retention_days", 90)
|
||||
viper.SetDefault("ratelimit.enabled", true)
|
||||
viper.SetDefault("ratelimit.login_per_min", 10)
|
||||
viper.SetDefault("ratelimit.refresh_per_min", 20)
|
||||
viper.SetDefault("ratelimit.register_per_min", 5)
|
||||
viper.SetDefault("ratelimit.errors_per_min", 30)
|
||||
viper.SetDefault("ratelimit.shop_list_per_min", 30)
|
||||
viper.SetDefault("ratelimit.public_read_per_min", 60)
|
||||
viper.SetDefault("ratelimit.shop_rps", 20)
|
||||
viper.SetDefault("ratelimit.shop_burst", 40)
|
||||
viper.SetDefault("database.max_idle_conns", 10)
|
||||
viper.SetDefault("database.max_open_conns", 100)
|
||||
viper.SetDefault("storage.upload_dir", "./uploads/images")
|
||||
|
||||
@@ -71,5 +71,6 @@ require (
|
||||
golang.org/x/net v0.51.0 // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/text v0.35.0 // indirect
|
||||
golang.org/x/time v0.15.0 // indirect
|
||||
google.golang.org/protobuf v1.36.10 // indirect
|
||||
)
|
||||
|
||||
@@ -150,6 +150,8 @@ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
|
||||
golang.org/x/text v0.35.0 h1:JOVx6vVDFokkpaq1AEptVzLTpDe9KGpj5tR4/X+ybL8=
|
||||
golang.org/x/text v0.35.0/go.mod h1:khi/HExzZJ2pGnjenulevKNX1W67CUy0AsXcNubPGCA=
|
||||
golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
|
||||
golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
|
||||
google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
|
||||
|
||||
@@ -42,12 +42,13 @@ func (h *ShopHandler) UpdateInfo(c *gin.Context) {
|
||||
shopID := middleware.GetShopID(c)
|
||||
|
||||
var req struct {
|
||||
Name string `json:"name"`
|
||||
Address string `json:"address"`
|
||||
Phone string `json:"phone"`
|
||||
ManagerName string `json:"manager_name"`
|
||||
LogoURL string `json:"logo_url"`
|
||||
WechatID string `json:"wechat_id"`
|
||||
Name string `json:"name"`
|
||||
Address string `json:"address"`
|
||||
Phone string `json:"phone"`
|
||||
ManagerName string `json:"manager_name"`
|
||||
LogoURL string `json:"logo_url"`
|
||||
WechatID string `json:"wechat_id"`
|
||||
CustomFields map[string]interface{} `json:"custom_fields"`
|
||||
}
|
||||
if err := c.ShouldBindJSON(&req); err != nil {
|
||||
c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
|
||||
@@ -64,6 +65,19 @@ func (h *ShopHandler) UpdateInfo(c *gin.Context) {
|
||||
if req.LogoURL != "" {
|
||||
updates["logo_url"] = req.LogoURL
|
||||
}
|
||||
// custom_fields 增量 merge：保留已有键（如其它店级配置），只覆盖本次传入的键。
|
||||
if req.CustomFields != nil {
|
||||
var cur model.Shop
|
||||
h.db.Select("custom_fields").Where("id = ?", shopID).First(&cur)
|
||||
merged := model.JSON{}
|
||||
for k, v := range cur.CustomFields {
|
||||
merged[k] = v
|
||||
}
|
||||
for k, v := range req.CustomFields {
|
||||
merged[k] = v
|
||||
}
|
||||
updates["custom_fields"] = merged
|
||||
}
|
||||
if err := h.db.Model(&model.Shop{}).Where("id = ?", shopID).Updates(updates).Error; err != nil {
|
||||
c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
|
||||
return
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
package handler
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"testing"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
"gorm.io/gorm"
|
||||
|
||||
"github.com/wangjia/jiu/backend/internal/middleware"
|
||||
"github.com/wangjia/jiu/backend/internal/model"
|
||||
"github.com/wangjia/jiu/backend/testutil"
|
||||
)
|
||||
|
||||
func setupShopRouter(db *gorm.DB) *gin.Engine {
|
||||
shopH := NewShopHandler(db)
|
||||
r := gin.New()
|
||||
r.Use(gin.Recovery())
|
||||
api := r.Group("/api/v1")
|
||||
api.Use(middleware.JWT(db))
|
||||
shop := api.Group("/shop")
|
||||
shop.GET("/info", shopH.GetInfo)
|
||||
shop.PUT("/info", shopH.UpdateInfo)
|
||||
return r
|
||||
}
|
||||
|
||||
// TestUpdateInfo_MergesCustomFields 钉死「设为默认」依赖的契约：
|
||||
// 传 custom_fields 会 merge 进本店已有 custom_fields（保留旧键），且只动本店。
|
||||
func TestUpdateInfo_MergesCustomFields(t *testing.T) {
|
||||
gin.SetMode(gin.TestMode)
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "S_CF1")
|
||||
admin := testutil.CreateTestUser(db, shop.ID, "admin", "pw", "admin")
|
||||
// 预置已有 custom_fields，验证 merge 不抹掉其它键
|
||||
require.NoError(t, db.Model(&model.Shop{}).Where("id = ?", shop.ID).
|
||||
Update("custom_fields", model.JSON{"foo": "bar"}).Error)
|
||||
// 另一店做隔离对照
|
||||
other := testutil.CreateTestShop(db, "S_CF2")
|
||||
require.NoError(t, db.Model(&model.Shop{}).Where("id = ?", other.ID).
|
||||
Update("custom_fields", model.JSON{"x": "y"}).Error)
|
||||
|
||||
r := setupShopRouter(db)
|
||||
token := getAuthToken(admin.ID, shop.ID, "admin")
|
||||
w := makeRequest(r, http.MethodPut, "/api/v1/shop/info", token, jsonBody(
|
||||
"name", "改名后",
|
||||
"custom_fields", map[string]interface{}{"default_series_id": 7},
|
||||
))
|
||||
assert.Equal(t, http.StatusOK, w.Code)
|
||||
|
||||
var got model.Shop
|
||||
require.NoError(t, db.First(&got, shop.ID).Error)
|
||||
assert.Equal(t, "改名后", got.Name)
|
||||
assert.Equal(t, "bar", got.CustomFields["foo"]) // 旧键保留
|
||||
assert.EqualValues(t, 7, got.CustomFields["default_series_id"]) // 新键写入
|
||||
|
||||
// 隔离：另一店的 custom_fields 不受影响
|
||||
var o model.Shop
|
||||
require.NoError(t, db.First(&o, other.ID).Error)
|
||||
assert.Equal(t, "y", o.CustomFields["x"])
|
||||
_, leaked := o.CustomFields["default_series_id"]
|
||||
assert.False(t, leaked)
|
||||
}
|
||||
@@ -0,0 +1,127 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"strconv"
|
||||
"sync"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"golang.org/x/time/rate"
|
||||
|
||||
"github.com/wangjia/jiu/backend/config"
|
||||
)
|
||||
|
||||
// 限流器内存条目的清理参数：每 5 分钟扫一次，淘汰超过 10 分钟未活动的 key。
|
||||
// 保证 map 不随攻击者构造的随机 key（IP/shop）无限增长。
|
||||
const (
|
||||
rateLimitSweep = 5 * time.Minute
|
||||
rateLimitIdleTTL = 10 * time.Minute
|
||||
rateLimitRetryHdr = "60" // Retry-After 秒数（提示客户端退避）
|
||||
)
|
||||
|
||||
// keyedLimiter 按任意字符串 key（IP 或 shop_id）维护独立令牌桶，内存有界（带 janitor）。
|
||||
// 单实例进程内状态，重启即清零；多实例水平扩展时需改为 Redis（见方案「暂不做」）。
|
||||
type keyedLimiter struct {
|
||||
mu sync.Mutex
|
||||
entries map[string]*limiterBucket
|
||||
r rate.Limit
|
||||
burst int
|
||||
}
|
||||
|
||||
type limiterBucket struct {
|
||||
lim *rate.Limiter
|
||||
lastSeen time.Time
|
||||
}
|
||||
|
||||
func newKeyedLimiter(r rate.Limit, burst int) *keyedLimiter {
|
||||
kl := &keyedLimiter{entries: map[string]*limiterBucket{}, r: r, burst: burst}
|
||||
go kl.janitor()
|
||||
return kl
|
||||
}
|
||||
|
||||
// get 取（或惰性创建）该 key 的令牌桶并刷新活动时间。
|
||||
func (kl *keyedLimiter) get(key string) *rate.Limiter {
|
||||
kl.mu.Lock()
|
||||
defer kl.mu.Unlock()
|
||||
b := kl.entries[key]
|
||||
if b == nil {
|
||||
b = &limiterBucket{lim: rate.NewLimiter(kl.r, kl.burst)}
|
||||
kl.entries[key] = b
|
||||
}
|
||||
b.lastSeen = time.Now()
|
||||
return b.lim
|
||||
}
|
||||
|
||||
func (kl *keyedLimiter) janitor() {
|
||||
t := time.NewTicker(rateLimitSweep)
|
||||
defer t.Stop()
|
||||
for range t.C {
|
||||
kl.sweep(rateLimitIdleTTL)
|
||||
}
|
||||
}
|
||||
|
||||
// sweep 淘汰超过 ttl 未活动的 key。拆出便于测试。
|
||||
func (kl *keyedLimiter) sweep(ttl time.Duration) {
|
||||
now := time.Now()
|
||||
kl.mu.Lock()
|
||||
defer kl.mu.Unlock()
|
||||
for k, b := range kl.entries {
|
||||
if now.Sub(b.lastSeen) > ttl {
|
||||
delete(kl.entries, k)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// PerMinute 把「每分钟 n 次」转成 rate.Limit（令牌/秒）。
|
||||
func PerMinute(n int) rate.Limit {
|
||||
return rate.Limit(float64(n) / 60.0)
|
||||
}
|
||||
|
||||
// PerSecond 把「每秒 n 次」转成 rate.Limit。
|
||||
func PerSecond(n int) rate.Limit {
|
||||
return rate.Limit(n)
|
||||
}
|
||||
|
||||
// rateLimit 通用工厂：keyFn 抽取限流维度的 key（返回空串表示无法判定 → 放行，不误伤）。
|
||||
// config.C.RateLimit.Enabled=false 时整体放行（应急/测试开关）。
|
||||
func rateLimit(r rate.Limit, burst int, keyFn func(*gin.Context) string) gin.HandlerFunc {
|
||||
kl := newKeyedLimiter(r, burst)
|
||||
return func(c *gin.Context) {
|
||||
if !config.C.RateLimit.Enabled {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
key := keyFn(c)
|
||||
if key == "" {
|
||||
c.Next()
|
||||
return
|
||||
}
|
||||
if !kl.get(key).Allow() {
|
||||
c.Header("Retry-After", rateLimitRetryHdr)
|
||||
c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"error": "请求过于频繁，请稍后再试"})
|
||||
return
|
||||
}
|
||||
c.Next()
|
||||
}
|
||||
}
|
||||
|
||||
// RateLimitByIP 按真实客户端 IP 限流（依赖 main.go 的 SetTrustedProxies + RemoteIPHeaders，
|
||||
// 使 c.ClientIP() 返回不可伪造的真实 IP）。
|
||||
func RateLimitByIP(r rate.Limit, burst int) gin.HandlerFunc {
|
||||
return rateLimit(r, burst, func(c *gin.Context) string {
|
||||
return "ip:" + c.ClientIP()
|
||||
})
|
||||
}
|
||||
|
||||
// RateLimitByShop 按门店（shop_id，取自 JWT）限流，须挂在 JWT 中间件之后。
|
||||
// 未取到 shop_id 时放行（交由 JWT 中间件拦截非法 token）。
|
||||
func RateLimitByShop(r rate.Limit, burst int) gin.HandlerFunc {
|
||||
return rateLimit(r, burst, func(c *gin.Context) string {
|
||||
id := GetShopID(c)
|
||||
if id == 0 {
|
||||
return ""
|
||||
}
|
||||
return "shop:" + strconv.FormatUint(id, 10)
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,194 @@
|
||||
package middleware
|
||||
|
||||
import (
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"strconv"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/gin-gonic/gin"
|
||||
"golang.org/x/time/rate"
|
||||
|
||||
"github.com/wangjia/jiu/backend/config"
|
||||
)
|
||||
|
||||
func init() {
|
||||
gin.SetMode(gin.TestMode)
|
||||
}
|
||||
|
||||
// enableRateLimit 临时打开限流开关，返回恢复函数。
|
||||
func enableRateLimit(t *testing.T) {
|
||||
t.Helper()
|
||||
prev := config.C.RateLimit.Enabled
|
||||
config.C.RateLimit.Enabled = true
|
||||
t.Cleanup(func() { config.C.RateLimit.Enabled = prev })
|
||||
}
|
||||
|
||||
// hit 发一个带指定客户端 IP 的请求，返回状态码。SetTrustedProxies 让 X-Forwarded-For 被采信，
|
||||
// 便于在测试里模拟不同来源 IP。
|
||||
func hit(r *gin.Engine, ip string) *httptest.ResponseRecorder {
|
||||
w := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
req.RemoteAddr = ip + ":12345"
|
||||
r.ServeHTTP(w, req)
|
||||
return w
|
||||
}
|
||||
|
||||
func newIPRouter(h gin.HandlerFunc) *gin.Engine {
|
||||
r := gin.New()
|
||||
r.GET("/", h, func(c *gin.Context) { c.String(http.StatusOK, "ok") })
|
||||
return r
|
||||
}
|
||||
|
||||
func TestRateLimitByIP_BurstThen429(t *testing.T) {
|
||||
enableRateLimit(t)
|
||||
// 每分钟 3 次，burst 3：前 3 个放行，第 4 个 429。
|
||||
r := newIPRouter(RateLimitByIP(PerMinute(3), 3))
|
||||
|
||||
for i := 0; i < 3; i++ {
|
||||
if w := hit(r, "1.1.1.1"); w.Code != http.StatusOK {
|
||||
t.Fatalf("第 %d 个请求应放行，得到 %d", i+1, w.Code)
|
||||
}
|
||||
}
|
||||
w := hit(r, "1.1.1.1")
|
||||
if w.Code != http.StatusTooManyRequests {
|
||||
t.Fatalf("超出 burst 应 429，得到 %d", w.Code)
|
||||
}
|
||||
if ra := w.Header().Get("Retry-After"); ra == "" {
|
||||
t.Fatal("429 响应应带 Retry-After 头")
|
||||
}
|
||||
}
|
||||
|
||||
func TestRateLimitByIP_KeysIndependent(t *testing.T) {
|
||||
enableRateLimit(t)
|
||||
r := newIPRouter(RateLimitByIP(PerMinute(1), 1))
|
||||
|
||||
// 不同 IP 各有独立令牌桶，互不影响。
|
||||
if w := hit(r, "2.2.2.2"); w.Code != http.StatusOK {
|
||||
t.Fatalf("IP A 首次应放行，得到 %d", w.Code)
|
||||
}
|
||||
if w := hit(r, "3.3.3.3"); w.Code != http.StatusOK {
|
||||
t.Fatalf("IP B 首次应放行（独立桶），得到 %d", w.Code)
|
||||
}
|
||||
// IP A 再来一发应 429（桶已空）。
|
||||
if w := hit(r, "2.2.2.2"); w.Code != http.StatusTooManyRequests {
|
||||
t.Fatalf("IP A 第二发应 429，得到 %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRateLimitByIP_Refill(t *testing.T) {
|
||||
enableRateLimit(t)
|
||||
// 每秒 50 次：耗尽 burst 后等一小会儿令牌补回，能再次放行。
|
||||
r := newIPRouter(RateLimitByIP(rate.Limit(50), 1))
|
||||
if w := hit(r, "4.4.4.4"); w.Code != http.StatusOK {
|
||||
t.Fatalf("首发应放行，得到 %d", w.Code)
|
||||
}
|
||||
if w := hit(r, "4.4.4.4"); w.Code != http.StatusTooManyRequests {
|
||||
t.Fatalf("紧接第二发应 429，得到 %d", w.Code)
|
||||
}
|
||||
time.Sleep(40 * time.Millisecond) // 50/s → 20ms 补一个令牌
|
||||
if w := hit(r, "4.4.4.4"); w.Code != http.StatusOK {
|
||||
t.Fatalf("等待补充后应放行，得到 %d", w.Code)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRateLimitDisabledPassthrough(t *testing.T) {
|
||||
prev := config.C.RateLimit.Enabled
|
||||
config.C.RateLimit.Enabled = false
|
||||
defer func() { config.C.RateLimit.Enabled = prev }()
|
||||
|
||||
r := newIPRouter(RateLimitByIP(PerMinute(1), 1))
|
||||
// 关闭时远超额度也全放行。
|
||||
for i := 0; i < 10; i++ {
|
||||
if w := hit(r, "5.5.5.5"); w.Code != http.StatusOK {
|
||||
t.Fatalf("限流关闭时第 %d 发应放行，得到 %d", i+1, w.Code)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestKeyedLimiterSweepEvictsIdle(t *testing.T) {
|
||||
kl := newKeyedLimiter(PerMinute(60), 1)
|
||||
kl.get("ip:a")
|
||||
kl.get("ip:b")
|
||||
if len(kl.entries) != 2 {
|
||||
t.Fatalf("应有 2 个 entry，得到 %d", len(kl.entries))
|
||||
}
|
||||
// 把 a 的活动时间推到很久以前，sweep 应只淘汰 a。
|
||||
kl.mu.Lock()
|
||||
kl.entries["ip:a"].lastSeen = time.Now().Add(-time.Hour)
|
||||
kl.mu.Unlock()
|
||||
|
||||
kl.sweep(10 * time.Minute)
|
||||
|
||||
kl.mu.Lock()
|
||||
defer kl.mu.Unlock()
|
||||
if _, ok := kl.entries["ip:a"]; ok {
|
||||
t.Fatal("空闲 key a 应被淘汰")
|
||||
}
|
||||
if _, ok := kl.entries["ip:b"]; !ok {
|
||||
t.Fatal("活跃 key b 不应被淘汰")
|
||||
}
|
||||
}
|
||||
|
||||
// TestTrustedProxyRealIP 复刻 main.go 的可信代理配置：只信任本机写的 X-Real-IP，
|
||||
// 客户端伪造的 X-Forwarded-For 不被采信 → c.ClientIP() 返回真实 IP，限流不可被请求头绕过。
|
||||
func TestTrustedProxyRealIP(t *testing.T) {
|
||||
r := gin.New()
|
||||
_ = r.SetTrustedProxies([]string{"127.0.0.1", "::1"})
|
||||
r.RemoteIPHeaders = []string{"X-Real-IP"}
|
||||
var got string
|
||||
r.GET("/", func(c *gin.Context) {
|
||||
got = c.ClientIP()
|
||||
c.Status(http.StatusOK)
|
||||
})
|
||||
|
||||
w := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/", nil)
|
||||
req.RemoteAddr = "127.0.0.1:9999" // 本机 nginx
|
||||
req.Header.Set("X-Real-IP", "9.9.9.9") // nginx 写入的真实 IP
|
||||
req.Header.Set("X-Forwarded-For", "1.2.3.4") // 客户端伪造，应被忽略
|
||||
r.ServeHTTP(w, req)
|
||||
|
||||
if got != "9.9.9.9" {
|
||||
t.Fatalf("ClientIP 应取可信的 X-Real-IP=9.9.9.9，得到 %q（伪造的 XFF 不应生效）", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestRateLimitByShop_NoShopPassthrough(t *testing.T) {
|
||||
enableRateLimit(t)
|
||||
// 未设置 shop_id（无 JWT 上下文）时放行，交由 JWT 中间件拦截。
|
||||
r := gin.New()
|
||||
r.GET("/", RateLimitByShop(PerSecond(1), 1), func(c *gin.Context) { c.String(http.StatusOK, "ok") })
|
||||
for i := 0; i < 5; i++ {
|
||||
if w := hit(r, "6.6.6.6"); w.Code != http.StatusOK {
|
||||
t.Fatalf("无 shop_id 时第 %d 发应放行，得到 %d", i+1, w.Code)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestRateLimitByShop_PerShop(t *testing.T) {
|
||||
enableRateLimit(t)
|
||||
r := gin.New()
|
||||
// 模拟 JWT 已注入 shop_id（取自 ?shop= 查询参数）。
|
||||
r.GET("/", func(c *gin.Context) {
|
||||
id, _ := strconv.ParseUint(c.Query("shop"), 10, 64)
|
||||
c.Set(CtxShopID, id)
|
||||
}, RateLimitByShop(PerSecond(1), 1), func(c *gin.Context) { c.String(http.StatusOK, "ok") })
|
||||
|
||||
shopHit := func(shop string) int {
|
||||
w := httptest.NewRecorder()
|
||||
req := httptest.NewRequest(http.MethodGet, "/?shop="+shop, nil)
|
||||
r.ServeHTTP(w, req)
|
||||
return w.Code
|
||||
}
|
||||
if c := shopHit("1"); c != http.StatusOK {
|
||||
t.Fatalf("shop1 首发应放行，得到 %d", c)
|
||||
}
|
||||
if c := shopHit("2"); c != http.StatusOK {
|
||||
t.Fatalf("shop2 首发应放行（独立桶），得到 %d", c)
|
||||
}
|
||||
if c := shopHit("1"); c != http.StatusTooManyRequests {
|
||||
t.Fatalf("shop1 第二发应 429，得到 %d", c)
|
||||
}
|
||||
}
|
||||
@@ -4,6 +4,7 @@ import (
|
||||
"github.com/gin-gonic/gin"
|
||||
"gorm.io/gorm"
|
||||
|
||||
"github.com/wangjia/jiu/backend/config"
|
||||
"github.com/wangjia/jiu/backend/internal/handler"
|
||||
"github.com/wangjia/jiu/backend/internal/middleware"
|
||||
"github.com/wangjia/jiu/backend/internal/service"
|
||||
@@ -46,31 +47,43 @@ func Setup(r *gin.Engine, db *gorm.DB) {
|
||||
// 版本信息（无需认证，用于客户端更新检查）
|
||||
r.GET("/version", handler.GetVersion)
|
||||
|
||||
// 限流维度（按真实客户端 IP，依赖 main.go 的 SetTrustedProxies）。
|
||||
// 防爆破/防刷写/防爬：未鉴权接口逐条挂 per-IP 限流，公开商品列表最紧。
|
||||
rl := config.C.RateLimit
|
||||
publicReadIP := middleware.RateLimitByIP(middleware.PerMinute(rl.PublicReadPerMin), rl.PublicReadPerMin)
|
||||
shopListIP := middleware.RateLimitByIP(middleware.PerMinute(rl.ShopListPerMin), rl.ShopListPerMin)
|
||||
loginIP := middleware.RateLimitByIP(middleware.PerMinute(rl.LoginPerMin), rl.LoginPerMin)
|
||||
refreshIP := middleware.RateLimitByIP(middleware.PerMinute(rl.RefreshPerMin), rl.RefreshPerMin)
|
||||
registerIP := middleware.RateLimitByIP(middleware.PerMinute(rl.RegisterPerMin), rl.RegisterPerMin)
|
||||
errorsIP := middleware.RateLimitByIP(middleware.PerMinute(rl.ErrorsPerMin), rl.ErrorsPerMin)
|
||||
|
||||
// 公开商品详情页（注入 OG 标签的 Flutter index.html，供社交分享爬虫读取）
|
||||
r.GET("/product/:public_id", publicH.ProductPage)
|
||||
r.GET("/product/:public_id", publicReadIP, publicH.ProductPage)
|
||||
|
||||
v1 := r.Group("/api/v1")
|
||||
|
||||
// 公开路由（无需登录）
|
||||
// 公开路由（无需登录）：登录/刷新按 IP 限流（与 service 层失败锁定互补）
|
||||
auth := v1.Group("/auth")
|
||||
{
|
||||
auth.POST("/login", authH.Login)
|
||||
auth.POST("/refresh", authH.Refresh)
|
||||
auth.POST("/login", loginIP, authH.Login)
|
||||
auth.POST("/refresh", refreshIP, authH.Refresh)
|
||||
}
|
||||
|
||||
// 公开接口（无需登录）
|
||||
// 公开接口（无需登录）：读接口防爬、写接口防刷
|
||||
public := v1.Group("/public")
|
||||
{
|
||||
public.GET("/products/:public_id", publicH.GetProduct)
|
||||
public.GET("/shops/:shop_code/products", publicH.ListShopProducts)
|
||||
public.GET("/release", publicH.GetRelease)
|
||||
public.POST("/errors", errorReportH.Submit)
|
||||
public.POST("/register", authH.Register)
|
||||
public.GET("/products/:public_id", publicReadIP, publicH.GetProduct)
|
||||
public.GET("/shops/:shop_code/products", shopListIP, publicH.ListShopProducts)
|
||||
public.GET("/release", publicReadIP, publicH.GetRelease)
|
||||
public.POST("/errors", errorsIP, errorReportH.Submit)
|
||||
public.POST("/register", registerIP, authH.Register)
|
||||
}
|
||||
|
||||
// 需要 JWT 的基础路由组
|
||||
api := v1.Group("")
|
||||
api.Use(middleware.JWT(db))
|
||||
// 每店限流（按 shop_id，挂在 JWT 之后）：防单店打爆共享后端，保障多租户公平
|
||||
api.Use(middleware.RateLimitByShop(middleware.PerSecond(rl.ShopRPS), rl.ShopBurst))
|
||||
|
||||
// 会话/在线状态（豁免 LicenseGuard：登出/心跳/在线列表在锁定期也要可用）
|
||||
{
|
||||
@@ -179,11 +192,11 @@ func Setup(r *gin.Engine, db *gorm.DB) {
|
||||
// 财务
|
||||
finance := api.Group("/finance")
|
||||
{
|
||||
finance.GET("/records", financeH.ListRecords)
|
||||
finance.POST("/records", financeH.Create)
|
||||
finance.PUT("/records/:id/close", financeH.Close)
|
||||
finance.PUT("/records/close-by-ref", financeH.CloseByRef)
|
||||
finance.GET("/summary", financeH.Summary)
|
||||
finance.GET("/records", financeH.ListRecords)
|
||||
finance.POST("/records", financeH.Create)
|
||||
finance.PUT("/records/:id/close", financeH.Close)
|
||||
finance.PUT("/records/close-by-ref", financeH.CloseByRef)
|
||||
finance.GET("/summary", financeH.Summary)
|
||||
}
|
||||
|
||||
// 酒行信息
|
||||
@@ -211,15 +224,15 @@ func Setup(r *gin.Engine, db *gorm.DB) {
|
||||
// 导入
|
||||
imp := api.Group("/import")
|
||||
{
|
||||
imp.POST("/products", importH.ImportProducts)
|
||||
imp.POST("/partners", importH.ImportPartners)
|
||||
imp.POST("/product-names", importH.ImportProductNames)
|
||||
imp.POST("/products", importH.ImportProducts)
|
||||
imp.POST("/partners", importH.ImportPartners)
|
||||
imp.POST("/product-names", importH.ImportProductNames)
|
||||
imp.POST("/product-series", importH.ImportProductSeries)
|
||||
imp.POST("/product-specs", importH.ImportProductSpecs)
|
||||
imp.POST("/product-codes", importH.ImportProductCodes)
|
||||
imp.POST("/stock-in", importH.ImportStockIn)
|
||||
imp.POST("/stock-out", importH.ImportStockOut)
|
||||
imp.POST("/inventory", importH.ImportInventory)
|
||||
imp.POST("/product-specs", importH.ImportProductSpecs)
|
||||
imp.POST("/product-codes", importH.ImportProductCodes)
|
||||
imp.POST("/stock-in", importH.ImportStockIn)
|
||||
imp.POST("/stock-out", importH.ImportStockOut)
|
||||
imp.POST("/inventory", importH.ImportInventory)
|
||||
}
|
||||
|
||||
// 基础数据选项（名称/系列/规格）
|
||||
|
||||
@@ -40,16 +40,23 @@ type DeviceInfo struct {
|
||||
}
|
||||
|
||||
// loginLimiter 内存登录失败限流器（单实例，重启即清零）。
|
||||
// 两个维度共用同一张表：账号维度 key="<shopCode>|<username>"，IP 维度 key="ip|<addr>"，
|
||||
// 分别用不同阈值锁定。带 janitor 清理空闲 entry，避免攻击者用随机 key 灌爆内存。
|
||||
type loginLimiter struct {
|
||||
mu sync.Mutex
|
||||
entries map[string]*limiterEntry
|
||||
mu sync.Mutex
|
||||
entries map[string]*limiterEntry
|
||||
janitorOnce sync.Once
|
||||
}
|
||||
|
||||
type limiterEntry struct {
|
||||
failures int
|
||||
lockedTill time.Time
|
||||
lastSeen time.Time
|
||||
}
|
||||
|
||||
// loginLimiterIdleTTL：已解锁且超过该时长未活动的 entry 会被 janitor 清理。
|
||||
const loginLimiterIdleTTL = 30 * time.Minute
|
||||
|
||||
var loginLim = &loginLimiter{entries: map[string]*limiterEntry{}}
|
||||
|
||||
// locked 返回该 key 是否处于锁定中。
|
||||
@@ -57,11 +64,16 @@ func (l *loginLimiter) locked(key string) bool {
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
e := l.entries[key]
|
||||
return e != nil && time.Now().Before(e.lockedTill)
|
||||
if e == nil {
|
||||
return false
|
||||
}
|
||||
e.lastSeen = time.Now()
|
||||
return time.Now().Before(e.lockedTill)
|
||||
}
|
||||
|
||||
// recordFailure 记一次失败，达到阈值则锁定。
|
||||
func (l *loginLimiter) recordFailure(key string) {
|
||||
// recordFailure 记一次失败，达到 max 阈值则锁定（max<=0 表示该维度不锁）。
|
||||
func (l *loginLimiter) recordFailure(key string, max int) {
|
||||
l.startJanitor()
|
||||
l.mu.Lock()
|
||||
defer l.mu.Unlock()
|
||||
e := l.entries[key]
|
||||
@@ -69,8 +81,8 @@ func (l *loginLimiter) recordFailure(key string) {
|
||||
e = &limiterEntry{}
|
||||
l.entries[key] = e
|
||||
}
|
||||
e.lastSeen = time.Now()
|
||||
e.failures++
|
||||
max := config.C.Session.MaxFailures
|
||||
if max > 0 && e.failures >= max {
|
||||
e.lockedTill = time.Now().Add(time.Duration(config.C.Session.LockMinutes) * time.Minute)
|
||||
e.failures = 0
|
||||
@@ -84,6 +96,26 @@ func (l *loginLimiter) reset(key string) {
|
||||
delete(l.entries, key)
|
||||
}
|
||||
|
||||
// startJanitor 惰性启动后台清理（仅一次）：每 5 分钟淘汰「未锁定且超过 TTL 未活动」的 entry。
|
||||
func (l *loginLimiter) startJanitor() {
|
||||
l.janitorOnce.Do(func() {
|
||||
go func() {
|
||||
t := time.NewTicker(5 * time.Minute)
|
||||
defer t.Stop()
|
||||
for range t.C {
|
||||
now := time.Now()
|
||||
l.mu.Lock()
|
||||
for k, e := range l.entries {
|
||||
if now.After(e.lockedTill) && now.Sub(e.lastSeen) > loginLimiterIdleTTL {
|
||||
delete(l.entries, k)
|
||||
}
|
||||
}
|
||||
l.mu.Unlock()
|
||||
}
|
||||
}()
|
||||
})
|
||||
}
|
||||
|
||||
type AuthService struct {
|
||||
db *gorm.DB
|
||||
}
|
||||
@@ -101,15 +133,27 @@ type TokenPair struct {
|
||||
|
||||
// Login 账号密码登录
|
||||
func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo) (*TokenPair, *model.User, error) {
|
||||
// 两个限流维度：账号维度防针对单账号的密码爆破；IP 维度（阈值更高）防单 IP 撞多个账号、
|
||||
// 以及用随机账号灌爆内存。IP 为空（本地/测试）时退化为仅账号维度。
|
||||
limiterKey := shopCode + "|" + username
|
||||
if loginLim.locked(limiterKey) {
|
||||
ipKey := ""
|
||||
if dev.IP != "" {
|
||||
ipKey = "ip|" + dev.IP
|
||||
}
|
||||
recordFail := func() {
|
||||
loginLim.recordFailure(limiterKey, config.C.Session.MaxFailures)
|
||||
if ipKey != "" {
|
||||
loginLim.recordFailure(ipKey, config.C.Session.IPMaxFailures)
|
||||
}
|
||||
}
|
||||
if loginLim.locked(limiterKey) || (ipKey != "" && loginLim.locked(ipKey)) {
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "locked")
|
||||
return nil, nil, ErrTooManyAttempts
|
||||
}
|
||||
|
||||
var shop model.Shop
|
||||
if err := s.db.Where("code = ?", shopCode).First(&shop).Error; err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
recordFail()
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "invalid_shop")
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
@@ -117,7 +161,7 @@ func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo)
|
||||
var user model.User
|
||||
if err := s.db.Where("shop_id = ? AND username = ? AND deleted_at IS NULL", shop.ID, username).
|
||||
First(&user).Error; err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
recordFail()
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "invalid_user")
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
@@ -128,7 +172,7 @@ func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo)
|
||||
}
|
||||
|
||||
if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
|
||||
loginLim.recordFailure(limiterKey)
|
||||
recordFail()
|
||||
s.recordLoginAttempt(shopCode, username, dev, false, "bad_password")
|
||||
return nil, nil, ErrInvalidCredentials
|
||||
}
|
||||
@@ -193,6 +237,9 @@ func (s *AuthService) Login(shopCode, username, password string, dev DeviceInfo)
|
||||
}
|
||||
|
||||
loginLim.reset(limiterKey)
|
||||
if ipKey != "" {
|
||||
loginLim.reset(ipKey)
|
||||
}
|
||||
user.LastLoginAt = &now
|
||||
|
||||
pair, err := s.issueTokens(user.ID, shop.ID, user.Role, sid, jti)
|
||||
|
||||
@@ -1,12 +1,14 @@
|
||||
package service
|
||||
|
||||
import (
|
||||
"strconv"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"github.com/wangjia/jiu/backend/config"
|
||||
"github.com/wangjia/jiu/backend/internal/model"
|
||||
"github.com/wangjia/jiu/backend/testutil"
|
||||
)
|
||||
@@ -146,6 +148,50 @@ func TestAuthService_RefreshTokens_Invalid(t *testing.T) {
|
||||
assert.Nil(t, newPair)
|
||||
}
|
||||
|
||||
// TestLogin_AccountLockoutAfterMaxFailures 同一账号连续失败达阈值后锁定（回归）。
|
||||
func TestLogin_AccountLockoutAfterMaxFailures(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
shop := testutil.CreateTestShop(db, "LOCK_ACC")
|
||||
testutil.CreateTestUser(db, shop.ID, "admin", "password123", "admin")
|
||||
config.C.Session.MaxFailures = 3
|
||||
svc := NewAuthService(db)
|
||||
defer loginLim.reset("LOCK_ACC|admin")
|
||||
|
||||
for i := 0; i < 3; i++ {
|
||||
_, _, err := svc.Login("LOCK_ACC", "admin", "wrong", DeviceInfo{Platform: "windows", IP: "10.0.0.1"})
|
||||
require.ErrorIs(t, err, ErrInvalidCredentials)
|
||||
}
|
||||
// 第 4 次即便密码正确也被锁定拒绝。
|
||||
_, _, err := svc.Login("LOCK_ACC", "admin", "password123", DeviceInfo{Platform: "windows", IP: "10.0.0.1"})
|
||||
assert.ErrorIs(t, err, ErrTooManyAttempts)
|
||||
}
|
||||
|
||||
// TestLogin_IPLockoutAcrossAccounts 单 IP 跨多个（不存在的）账号累计失败达 IP 阈值后锁该 IP。
|
||||
// 每次用不同用户名，账号维度永不触发锁定，只有 IP 维度会锁——验证 per-IP 防撞库 + 防内存灌爆。
|
||||
func TestLogin_IPLockoutAcrossAccounts(t *testing.T) {
|
||||
db := testutil.SetupTestDB()
|
||||
testutil.CreateTestShop(db, "LOCK_IP")
|
||||
config.C.Session.MaxFailures = 5
|
||||
config.C.Session.IPMaxFailures = 4
|
||||
const attackIP = "203.0.113.9"
|
||||
svc := NewAuthService(db)
|
||||
defer loginLim.reset("ip|" + attackIP)
|
||||
|
||||
// 4 次不同用户名（invalid_user），账号 key 各不相同永不锁；IP key 累计到 4 → 锁 IP。
|
||||
for i := 0; i < 4; i++ {
|
||||
uname := "ghost" + strconv.Itoa(i)
|
||||
_, _, err := svc.Login("LOCK_IP", uname, "whatever", DeviceInfo{Platform: "windows", IP: attackIP})
|
||||
require.ErrorIs(t, err, ErrInvalidCredentials)
|
||||
}
|
||||
// 同 IP 再来一发（仍是新用户名，账号维度无锁）→ 被 IP 锁拦下。
|
||||
_, _, err := svc.Login("LOCK_IP", "ghostX", "whatever", DeviceInfo{Platform: "windows", IP: attackIP})
|
||||
assert.ErrorIs(t, err, ErrTooManyAttempts)
|
||||
|
||||
// 另一 IP 不受影响。
|
||||
_, _, err = svc.Login("LOCK_IP", "ghostY", "whatever", DeviceInfo{Platform: "windows", IP: "198.51.100.7"})
|
||||
assert.ErrorIs(t, err, ErrInvalidCredentials)
|
||||
}
|
||||
|
||||
func TestHashPassword(t *testing.T) {
|
||||
hash, err := HashPassword("mypassword")
|
||||
require.NoError(t, err)
|
||||
|
||||
@@ -0,0 +1,94 @@
|
||||
package util
|
||||
|
||||
import (
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestNormalizeCode(t *testing.T) {
|
||||
cases := []struct {
|
||||
name string
|
||||
in string
|
||||
want string
|
||||
}{
|
||||
{"展示格式带连字符", "JIUKU-YD9S-7CAP", "JIUKUYD9S7CAP"},
|
||||
{"小写转大写", "jiuku-yd9s-7cap", "JIUKUYD9S7CAP"},
|
||||
{"去除空格", "JIUKU YD9S 7CAP", "JIUKUYD9S7CAP"},
|
||||
{"去除制表/换行/回车", "JIUKU\tYD9S\n7CAP\r", "JIUKUYD9S7CAP"},
|
||||
{"已归一化幂等", "JIUKUYD9S7CAP", "JIUKUYD9S7CAP"},
|
||||
{"空串", "", ""},
|
||||
{"混合大小写与分隔", " jiUKu--yd9s 7caP\n", "JIUKUYD9S7CAP"},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
if got := NormalizeCode(c.in); got != c.want {
|
||||
t.Fatalf("NormalizeCode(%q) = %q, want %q", c.in, got, c.want)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestNormalizeCodeIdempotent(t *testing.T) {
|
||||
// 二次归一化结果不变
|
||||
once := NormalizeCode("jiuku-yd9s-7cap")
|
||||
if twice := NormalizeCode(once); twice != once {
|
||||
t.Fatalf("NormalizeCode 非幂等: %q -> %q", once, twice)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateRedeemCodeFormat(t *testing.T) {
|
||||
for i := 0; i < 200; i++ {
|
||||
code := GenerateRedeemCode()
|
||||
|
||||
// 展示格式：JIUKU-XXXX-XXXX
|
||||
parts := strings.Split(code, "-")
|
||||
if len(parts) != 3 {
|
||||
t.Fatalf("码段数应为 3，得到 %d：%q", len(parts), code)
|
||||
}
|
||||
if parts[0] != "JIUKU" {
|
||||
t.Fatalf("前缀应为 JIUKU，得到 %q：%q", parts[0], code)
|
||||
}
|
||||
if len(parts[1]) != 4 || len(parts[2]) != 4 {
|
||||
t.Fatalf("随机段长度应各为 4，得到 %d/%d：%q", len(parts[1]), len(parts[2]), code)
|
||||
}
|
||||
|
||||
// 归一化后 = 前缀 + 8 位随机
|
||||
norm := NormalizeCode(code)
|
||||
if len(norm) != len("JIUKU")+8 {
|
||||
t.Fatalf("归一化长度应为 %d，得到 %d：%q", len("JIUKU")+8, len(norm), norm)
|
||||
}
|
||||
|
||||
// 随机段只含无歧义字母表字符（不含 0/O/1/I/L）
|
||||
random := parts[1] + parts[2]
|
||||
for _, r := range random {
|
||||
if !strings.ContainsRune(codeAlphabet, r) {
|
||||
t.Fatalf("出现字母表外字符 %q：%q", r, code)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestCodeAlphabetExcludesAmbiguous(t *testing.T) {
|
||||
for _, bad := range []rune{'0', 'O', '1', 'I', 'L'} {
|
||||
if strings.ContainsRune(codeAlphabet, bad) {
|
||||
t.Fatalf("字母表不应包含易混字符 %q", bad)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestGenerateRedeemCodeUnique(t *testing.T) {
|
||||
// 不要求绝对唯一，但大量生成应几乎无碰撞（31^8 空间）
|
||||
const n = 1000
|
||||
seen := make(map[string]struct{}, n)
|
||||
dup := 0
|
||||
for i := 0; i < n; i++ {
|
||||
c := NormalizeCode(GenerateRedeemCode())
|
||||
if _, ok := seen[c]; ok {
|
||||
dup++
|
||||
}
|
||||
seen[c] = struct{}{}
|
||||
}
|
||||
if dup > 0 {
|
||||
t.Fatalf("%d 次生成出现 %d 次重复，随机性可疑", n, dup)
|
||||
}
|
||||
}
|
||||
+7
-1
@@ -43,6 +43,13 @@ func main() {
|
||||
r := gin.New()
|
||||
r.Use(gin.Logger(), gin.Recovery())
|
||||
|
||||
// 真实客户端 IP：只信任本机 nginx（127.0.0.1/::1）写的 X-Real-IP，丢弃客户端伪造的
|
||||
// X-Forwarded-For。这样 c.ClientIP() 返回不可伪造的真实 IP，是所有按 IP 限流/审计的基础。
|
||||
// 代理链：client → nginx(127.0.0.1:8445) → 后端(127.0.0.1:8080)；将来若在 nginx 前再加
|
||||
// 一层代理，需把其地址并入下列可信网段。
|
||||
_ = r.SetTrustedProxies([]string{"127.0.0.1", "::1"})
|
||||
r.RemoteIPHeaders = []string{"X-Real-IP"}
|
||||
|
||||
// CORS
|
||||
corsOrigin := config.C.Server.CORSOrigin
|
||||
r.Use(func(c *gin.Context) {
|
||||
@@ -131,4 +138,3 @@ func autoMigrate(db *gorm.DB) {
|
||||
}
|
||||
log.Println("AutoMigrate completed")
|
||||
}
|
||||
|
||||
|
||||
@@ -28,12 +28,15 @@ func InitConfig() {
|
||||
RefreshExpireH: 168,
|
||||
},
|
||||
Session: config.SessionConfig{
|
||||
LimitDesktop: 2,
|
||||
LimitMobile: 2,
|
||||
LimitWeb: 2,
|
||||
MaxFailures: 5,
|
||||
LockMinutes: 15,
|
||||
LimitDesktop: 2,
|
||||
LimitMobile: 2,
|
||||
LimitWeb: 2,
|
||||
MaxFailures: 5,
|
||||
IPMaxFailures: 20,
|
||||
LockMinutes: 15,
|
||||
},
|
||||
// 测试默认关闭限流，避免压测式用例触发 429；限流逻辑由 ratelimit_test.go 显式开启验证。
|
||||
RateLimit: config.RateLimitConfig{Enabled: false},
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
Executable
+30
@@ -0,0 +1,30 @@
|
||||
#!/usr/bin/env bash
|
||||
# jiu-gencode.sh — 平台方在 EC2 上批量生成兑换券（激活码）的便捷封装。
|
||||
#
|
||||
# 自动读取 /opt/jiu/config/production.env 的数据库连接，调用同目录的
|
||||
# jiu-gencode 二进制写入码池 license_codes。随 server 发版部署到
|
||||
# /opt/jiu/backend/，无需再本地交叉编译 + scp。
|
||||
#
|
||||
# 远程一行用法（在你的 Mac 上）：
|
||||
# ssh -i ~/.ssh/wangjia.pem ec2-user@18.136.60.128 \
|
||||
# '/opt/jiu/backend/jiu-gencode.sh -type annual -days 365 -count 100 -batch 2026-summer'
|
||||
# ssh -i ~/.ssh/wangjia.pem ec2-user@18.136.60.128 \
|
||||
# '/opt/jiu/backend/jiu-gencode.sh -type trial -days 7 -count 1'
|
||||
#
|
||||
# 参数透传给 jiu-gencode：-type trial|monthly|annual|lifetime -days N(0=永久)
|
||||
# -devices N(0=不改门店现值) -count N -batch <批次> -note <备注>
|
||||
set -euo pipefail
|
||||
|
||||
ENV_FILE="${JIU_ENV_FILE:-/opt/jiu/config/production.env}"
|
||||
BIN="$(dirname "$0")/jiu-gencode"
|
||||
|
||||
[ -f "$ENV_FILE" ] || { echo "jiu-gencode: 找不到环境文件 $ENV_FILE" >&2; exit 1; }
|
||||
[ -x "$BIN" ] || { echo "jiu-gencode: 找不到可执行文件 $BIN" >&2; exit 1; }
|
||||
|
||||
# 加载 production.env：跳过注释/空行，逐行 export（不回显，避免泄漏密钥）。
|
||||
while IFS= read -r line; do
|
||||
case "$line" in \#*|'') continue ;; esac
|
||||
export "$line"
|
||||
done < "$ENV_FILE"
|
||||
|
||||
exec "$BIN" "$@"
|
||||
@@ -1,3 +1,9 @@
|
||||
# 粗粒度限流区（按客户端 IP）：仅作未鉴权公开接口的最外层泄洪，阈值远高于正常使用，
|
||||
# 真正的多维限流在后端 Go 中间件。本文件以 conf.d 形式 include 进 http{} 上下文，
|
||||
# 故 limit_req_zone 放在 server{} 之外。10m 约可容纳 16 万个 IP 的状态。
|
||||
limit_req_zone $binary_remote_addr zone=jiu_pub:10m rate=10r/s;
|
||||
limit_req_status 429;
|
||||
|
||||
server {
|
||||
listen 127.0.0.1:8445 ssl;
|
||||
server_name jiu.51yanmei.com;
|
||||
@@ -24,6 +30,16 @@ server {
|
||||
proxy_read_timeout 300s;
|
||||
}
|
||||
|
||||
# 未鉴权公开/登录接口：加最外层 per-IP 限流（鉴权后的业务 API 不在此限，交后端按店限流）。
|
||||
# 须定义在通用 /api 正则之前（nginx 正则 location 按书写顺序首个命中者生效）。
|
||||
location ~ ^/api/v1/(public|auth)/ {
|
||||
limit_req zone=jiu_pub burst=20 nodelay;
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_read_timeout 30s;
|
||||
}
|
||||
|
||||
# API 反向代理
|
||||
location ~ ^/(api|health|version) {
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
@@ -49,6 +65,7 @@ server {
|
||||
|
||||
# 公开商品详情页（扫码跳转）→ 后端注入 OG 标签后返回 Flutter index.html
|
||||
location ~ ^/product/ {
|
||||
limit_req zone=jiu_pub burst=20 nodelay;
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
@@ -58,6 +75,7 @@ server {
|
||||
# Flutter 路由会把 /product/:id 重写为 /app/product/:id（base-href=/app/）
|
||||
# 分享此 URL 时微信爬虫也需要 OG 标签 → 去掉 /app 前缀后转发后端
|
||||
location ~ ^/app/product/ {
|
||||
limit_req zone=jiu_pub burst=20 nodelay;
|
||||
rewrite ^/app(/product/.+)$ $1 break;
|
||||
proxy_pass http://127.0.0.1:8080;
|
||||
proxy_set_header Host $host;
|
||||
|
||||
@@ -5,9 +5,6 @@ DATABASE_DSN=root:CHANGE_ME_DB_PASS@tcp(127.0.0.1:3306)/jiu_db?charset=utf8mb4&p
|
||||
JWT_SECRET=CHANGE_ME_RANDOM_32CHARS
|
||||
JWT_ACCESS_EXPIRE_MIN=60
|
||||
JWT_REFRESH_EXPIRE_H=168
|
||||
LICENSE_HMAC_SECRET=CHANGE_ME_RANDOM_32CHARS
|
||||
LICENSE_ED25519_PUBLIC_KEY=zFkRV0E+oMjHbixiBamf2ZAq+n7En2V7EJRIurgtVxo=
|
||||
LICENSE_ED25519_PRIVATE_KEY=CHANGE_ME_ED25519_PRIVATE_FROM_BITWARDEN
|
||||
STORAGE_UPLOAD_DIR=/opt/jiu/images
|
||||
STORAGE_BASE_URL=https://jiu.51yanmei.com/images
|
||||
STORAGE_PUBLIC_URL=https://jiu.51yanmei.com
|
||||
|
||||
@@ -16,7 +16,7 @@ set -euo pipefail
|
||||
# ---- 可配置项 ----
|
||||
RBW="${RBW_BIN:-/opt/homebrew/bin/rbw}"
|
||||
BW_ITEM="${JIU_BW_ITEM:-jiu db password}" # 存放 jiu 密钥字段的 Bitwarden 条目
|
||||
SECRET_KEYS="DATABASE_DSN JWT_SECRET LICENSE_HMAC_SECRET LICENSE_ED25519_PRIVATE_KEY DB_PASSWORD"
|
||||
SECRET_KEYS="DATABASE_DSN JWT_SECRET DB_PASSWORD"
|
||||
|
||||
EC2_HOST="${EC2_HOST:-18.136.60.128}"
|
||||
EC2_USER="${EC2_USER:-ec2-user}"
|
||||
|
||||
@@ -13,10 +13,14 @@ echo "==> compile-backend: tag=${TAG}"
|
||||
# Build Go backend (linux/amd64 for EC2)
|
||||
cd backend
|
||||
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o jiu-server .
|
||||
# Platform code-minting CLI (gencode) ships alongside the server so codes can be
|
||||
# minted on EC2 without cross-compiling/scp each time.
|
||||
GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -o jiu-gencode ./cmd/gencode
|
||||
cd ..
|
||||
|
||||
mkdir -p dist
|
||||
mv backend/jiu-server dist/jiu-server
|
||||
mv backend/jiu-gencode dist/jiu-gencode
|
||||
|
||||
# Shared infrastructure (nginx/systemd/env/compose). version.yaml is NOT here —
|
||||
# it belongs to the client pipeline.
|
||||
@@ -26,7 +30,8 @@ tar -czf dist/configs.tar.gz \
|
||||
deploy/production.env.template \
|
||||
deploy/setup-ec2.sh \
|
||||
deploy/docker-compose.yml \
|
||||
deploy/docker-compose.jiu.yml
|
||||
deploy/docker-compose.jiu.yml \
|
||||
deploy/jiu-gencode.sh
|
||||
|
||||
echo "==> compile-backend: done — dist/ contents:"
|
||||
ls -lh dist/
|
||||
|
||||
@@ -27,6 +27,13 @@ echo "==> deploy-server: uploading files to EC2"
|
||||
${SCP} dist/jiu-server "${EC2_USER}@${EC2_HOST}:/tmp/jiu-server"
|
||||
${SCP} /tmp/jiu-configs/deploy/nginx-jiu.conf "${EC2_USER}@${EC2_HOST}:/tmp/nginx-jiu.conf"
|
||||
|
||||
# Platform code-minting CLI + wrapper (absent when rolling back to a pre-gencode
|
||||
# release — upload only when present).
|
||||
if [ -f dist/jiu-gencode ]; then
|
||||
${SCP} dist/jiu-gencode "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode"
|
||||
${SCP} /tmp/jiu-configs/deploy/jiu-gencode.sh "${EC2_USER}@${EC2_HOST}:/tmp/jiu-gencode.sh"
|
||||
fi
|
||||
|
||||
${SSH} "${EC2_USER}@${EC2_HOST}" << 'ENDSSH'
|
||||
set -e
|
||||
|
||||
@@ -35,6 +42,17 @@ sudo systemctl stop jiu
|
||||
cp /tmp/jiu-server /opt/jiu/backend/jiu-server
|
||||
chmod +x /opt/jiu/backend/jiu-server
|
||||
|
||||
# Refresh the code-minting CLI if shipped in this release (skip gracefully on
|
||||
# rollback to a pre-gencode release). Not a service — just a host-side binary.
|
||||
if [ -f /tmp/jiu-gencode ]; then
|
||||
cp /tmp/jiu-gencode /opt/jiu/backend/jiu-gencode
|
||||
chmod +x /opt/jiu/backend/jiu-gencode
|
||||
if [ -f /tmp/jiu-gencode.sh ]; then
|
||||
cp /tmp/jiu-gencode.sh /opt/jiu/backend/jiu-gencode.sh
|
||||
chmod +x /opt/jiu/backend/jiu-gencode.sh
|
||||
fi
|
||||
fi
|
||||
|
||||
# Start and health check
|
||||
sudo systemctl start jiu
|
||||
echo "Waiting for health check..."
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
# release-server.sh <tag> — create the Forgejo Release for the backend pipeline
|
||||
# and upload jiu-server + configs.tar.gz.
|
||||
# and upload jiu-server + jiu-gencode + configs.tar.gz.
|
||||
set -euo pipefail
|
||||
|
||||
# shellcheck source=scripts/ci/lib-forgejo.sh
|
||||
@@ -20,6 +20,7 @@ PYEOF
|
||||
|
||||
create_release "$TAG" "$BODY"
|
||||
upload_asset dist/jiu-server
|
||||
upload_asset dist/jiu-gencode
|
||||
upload_asset dist/configs.tar.gz
|
||||
|
||||
echo "==> release-server: done — Release ${TAG} created"
|
||||
|
||||
Reference in New Issue
Block a user