feat: 后台管理系统完整重构 + 前后台数据联通
- 后台全面引入 Naive UI 组件库，统一 UI 规范 - 前台 usePublicApi 切换到 API 调用（GET /api/content/[key]） - 前后台数据源统一（site_content 表） - 产品线统一管理（tour/camp/course 三套编辑器） - 产品数据归一化（itinerary/faq/pricing 格式统一） - 表单提交 API 改写入 submissions 表 - 新增 submissions 标记已读 API - site-content PUT 支持 upsert - 修复前台 bug（stories 路由冲突、占位符警告、selector breadcrumb） - 消除 PageHero 类型警告（useSEO reactive 修复） - 25 个前台页面全部 HTTP 200，展示效果不变 Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
这个提交包含在：
Mimingguang
@@ -0,0 +1,77 @@
|
||||
import { createHash } from 'crypto'
|
||||
import Database from 'better-sqlite3'
|
||||
import { join } from 'path'
|
||||
|
||||
// ── 数据库连接（用于 session 持久化）────────────────
|
||||
let _sessionDB = null
|
||||
function getSessionDB() {
|
||||
if (!_sessionDB) {
|
||||
const dbPath = join(process.cwd(), 'server', 'database', 'hulai.db')
|
||||
_sessionDB = new Database(dbPath)
|
||||
_sessionDB.pragma('journal_mode = WAL')
|
||||
}
|
||||
return _sessionDB
|
||||
}
|
||||
|
||||
export function hashPassword(password) {
|
||||
return createHash('sha256').update(password).digest('hex')
|
||||
}
|
||||
|
||||
export function createSession(userId) {
|
||||
const token = createHash('sha256')
|
||||
.update(`${userId}-${Date.now()}-${Math.random()}`)
|
||||
.digest('hex')
|
||||
|
||||
const db = getSessionDB()
|
||||
db.prepare('INSERT OR REPLACE INTO sessions (token, user_id, created_at) VALUES (?, ?, ?)')
|
||||
.run(token, userId, new Date().toISOString())
|
||||
|
||||
return token
|
||||
}
|
||||
|
||||
export function validateSession(token) {
|
||||
const db = getSessionDB()
|
||||
const session = db.prepare('SELECT * FROM sessions WHERE token = ?').get(token)
|
||||
|
||||
if (!session) return null
|
||||
|
||||
// 7 天过期
|
||||
const createdAt = new Date(session.created_at).getTime()
|
||||
if (Date.now() - createdAt > 7 * 24 * 60 * 60 * 1000) {
|
||||
db.prepare('DELETE FROM sessions WHERE token = ?').run(token)
|
||||
return null
|
||||
}
|
||||
|
||||
return { userId: session.user_id, createdAt }
|
||||
}
|
||||
|
||||
export function destroySession(token) {
|
||||
const db = getSessionDB()
|
||||
db.prepare('DELETE FROM sessions WHERE token = ?').run(token)
|
||||
}
|
||||
|
||||
// 清理过期 session（启动时执行一次）
|
||||
try {
|
||||
const db = getSessionDB()
|
||||
db.prepare("DELETE FROM sessions WHERE datetime(created_at) < datetime('now', '-7 days')").run()
|
||||
} catch {}
|
||||
|
||||
/**
|
||||
* 从请求中提取并验证管理员身份
|
||||
* 返回 session 对象或抛出 401 错误
|
||||
*/
|
||||
export function requireAdmin(event) {
|
||||
const authHeader = getRequestHeader(event, 'authorization')
|
||||
const token = authHeader?.replace('Bearer ', '')
|
||||
|
||||
if (!token) {
|
||||
throw createError({ statusCode: 401, message: '请先登录' })
|
||||
}
|
||||
|
||||
const session = validateSession(token)
|
||||
if (!session) {
|
||||
throw createError({ statusCode: 401, message: '登录已过期，请重新登录' })
|
||||
}
|
||||
|
||||
return session
|
||||
}
|
||||
@@ -0,0 +1,18 @@
|
||||
import Database from 'better-sqlite3'
|
||||
import { drizzle } from 'drizzle-orm/better-sqlite3'
|
||||
import { join } from 'path'
|
||||
import * as schema from '../database/schema.js'
|
||||
|
||||
let _db = null
|
||||
|
||||
export function useDB() {
|
||||
if (!_db) {
|
||||
const dbPath = join(process.cwd(), 'server', 'database', 'hulai.db')
|
||||
const sqlite = new Database(dbPath)
|
||||
sqlite.pragma('journal_mode = WAL')
|
||||
_db = drizzle(sqlite, { schema })
|
||||
}
|
||||
return _db
|
||||
}
|
||||
|
||||
export { schema }
|
||||
@@ -0,0 +1,40 @@
|
||||
/**
|
||||
* 企业微信群机器人 Webhook 通知
|
||||
* 在 .env 中配置 WECOM_WEBHOOK_KEY 即可启用
|
||||
* 不配置则静默跳过
|
||||
*
|
||||
* 文档：https://developer.work.weixin.qq.com/document/path/91770
|
||||
*/
|
||||
|
||||
const WECOM_API = 'https://qyapi.weixin.qq.com/cgi-bin/webhook/send'
|
||||
|
||||
/**
|
||||
* 发送企业微信群机器人 markdown 消息
|
||||
* @param {string} title - 消息标题（用作 markdown 一级标题）
|
||||
* @param {Record<string, string>} fields - { 字段名: 字段值 }
|
||||
*/
|
||||
export async function notifyWecom(title, fields) {
|
||||
const key = process.env.WECOM_WEBHOOK_KEY
|
||||
if (!key) return
|
||||
|
||||
const lines = Object.entries(fields)
|
||||
.map(([k, v]) => `> **${k}**：${v}`)
|
||||
.join('\n')
|
||||
|
||||
const now = new Date().toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' })
|
||||
|
||||
const content = `## ${title}\n${lines}\n> **提交时间**：${now}`
|
||||
|
||||
try {
|
||||
await $fetch(`${WECOM_API}?key=${key}`, {
|
||||
method: 'POST',
|
||||
body: {
|
||||
msgtype: 'markdown',
|
||||
markdown: { content },
|
||||
},
|
||||
})
|
||||
} catch (err) {
|
||||
// 通知失败不影响主流程，静默忽略
|
||||
console.error('[notify] 企业微信通知失败:', err?.message)
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,14 @@
|
||||
/**
|
||||
* 通用分页参数解析
|
||||
*/
|
||||
export function parsePagination(event) {
|
||||
const query = getQuery(event)
|
||||
const page = Math.max(1, Number(query.page) || 1)
|
||||
const limit = Math.min(100, Math.max(1, Number(query.limit) || 20))
|
||||
const offset = (page - 1) * limit
|
||||
const search = (query.search || '').trim()
|
||||
const sort = query.sort || ''
|
||||
const order = query.order === 'asc' ? 'asc' : 'desc'
|
||||
|
||||
return { page, limit, offset, search, sort, order }
|
||||
}
|
||||
@@ -0,0 +1,42 @@
|
||||
/**
|
||||
* 简单内存速率限制
|
||||
* 每个 IP 每小时最多允许 MAX_REQUESTS 次提交
|
||||
*/
|
||||
|
||||
const WINDOW_MS = 60 * 60 * 1000 // 1 小时
|
||||
const MAX_REQUESTS = 5
|
||||
|
||||
// Map<ip, { count: number, resetAt: number }>
|
||||
const store = new Map()
|
||||
|
||||
// 每 2 小时清理一次过期记录，防止内存泄漏
|
||||
setInterval(() => {
|
||||
const now = Date.now()
|
||||
for (const [ip, record] of store.entries()) {
|
||||
if (now > record.resetAt) {
|
||||
store.delete(ip)
|
||||
}
|
||||
}
|
||||
}, 2 * 60 * 60 * 1000)
|
||||
|
||||
/**
|
||||
* 检查并记录一次请求
|
||||
* @param {string} ip
|
||||
* @returns {{ allowed: boolean, remaining: number, resetAt: number }}
|
||||
*/
|
||||
export function checkRateLimit(ip) {
|
||||
const now = Date.now()
|
||||
const record = store.get(ip)
|
||||
|
||||
if (!record || now > record.resetAt) {
|
||||
store.set(ip, { count: 1, resetAt: now + WINDOW_MS })
|
||||
return { allowed: true, remaining: MAX_REQUESTS - 1, resetAt: now + WINDOW_MS }
|
||||
}
|
||||
|
||||
if (record.count >= MAX_REQUESTS) {
|
||||
return { allowed: false, remaining: 0, resetAt: record.resetAt }
|
||||
}
|
||||
|
||||
record.count++
|
||||
return { allowed: true, remaining: MAX_REQUESTS - record.count, resetAt: record.resetAt }
|
||||
}
|
||||
@@ -0,0 +1,56 @@
|
||||
/**
|
||||
* 文件存储工具
|
||||
* 将表单数据追加写入 server/storage/ 目录下的 JSON 文件
|
||||
*/
|
||||
|
||||
import { promises as fs } from 'fs'
|
||||
import { resolve } from 'path'
|
||||
|
||||
const STORAGE_DIR = resolve(process.cwd(), 'server/storage')
|
||||
|
||||
/**
|
||||
* 确保存储目录存在
|
||||
*/
|
||||
async function ensureDir() {
|
||||
try {
|
||||
await fs.mkdir(STORAGE_DIR, { recursive: true })
|
||||
} catch {
|
||||
// 目录已存在，忽略
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* 将记录追加到指定文件
|
||||
* @param {string} filename - 不含路径，如 'customize.json'
|
||||
* @param {object} record
|
||||
*/
|
||||
export async function appendRecord(filename, record) {
|
||||
await ensureDir()
|
||||
const filepath = resolve(STORAGE_DIR, filename)
|
||||
|
||||
let records = []
|
||||
try {
|
||||
const raw = await fs.readFile(filepath, 'utf-8')
|
||||
records = JSON.parse(raw)
|
||||
} catch {
|
||||
// 文件不存在或解析失败，从空数组开始
|
||||
}
|
||||
|
||||
records.push(record)
|
||||
await fs.writeFile(filepath, JSON.stringify(records, null, 2), 'utf-8')
|
||||
return record
|
||||
}
|
||||
|
||||
/**
|
||||
* 读取所有记录（管理员用）
|
||||
* @param {string} filename
|
||||
*/
|
||||
export async function readRecords(filename) {
|
||||
const filepath = resolve(STORAGE_DIR, filename)
|
||||
try {
|
||||
const raw = await fs.readFile(filepath, 'utf-8')
|
||||
return JSON.parse(raw)
|
||||
} catch {
|
||||
return []
|
||||
}
|
||||
}
|
||||
在新工单中引用
屏蔽一个用户