+
+
+- {{ item.type === 'SONG' ? '鍏蜂綋姝屾洸' : '鍏抽敭璇? }}
++ {{ getTypeLabel(item.type) }}
+
+
+ {{ item.value }}
+@@ -318,7 +335,7 @@
+
+
+
+-
+
+
+diff --git a/app/components/Admin/SchedulePrinter.vue b/app/components/Admin/SchedulePrinter.vue
+index 71bf445..9b26695 100644
+--- a/app/components/Admin/SchedulePrinter.vue
++++ b/app/components/Admin/SchedulePrinter.vue
+@@ -1383,15 +1383,15 @@ watch(
+ /* 棰勮鍖哄煙鍜屾墦鍗版牱寮忕殑鏍稿績CSS - 淇濇寔鍘熺敓CSS浠ョ‘淇濈簿纭帶鍒?*/
+
+ .preview-content {
+- background: #ffffff;
++ background: var(--card-bg, #ffffff);
+ padding: 0;
+ position: relative;
+ }
+
+ /* 鎵撳嵃椤甸潰鏍峰紡 */
+ .print-page {
+- background: #ffffff;
+- color: #000000;
++ background: var(--card-bg, #ffffff);
++ color: var(--text-primary, #000000);
+ width: 100%;
+ margin: 0 auto;
+ padding: 30px;
+@@ -1426,7 +1426,7 @@ watch(
+ .logo-divider {
+ width: 2px;
+ height: 60px;
+- background: linear-gradient(to bottom, #ddd, #999, #ddd);
++ background: linear-gradient(to bottom, var(--border-secondary, #dddddd), #999, #ddd);
+ border-radius: 1px;
+ margin: 0 4px;
+ }
+@@ -1445,19 +1445,19 @@ watch(
+ font-size: 24px;
+ font-weight: normal;
+ margin: 0 0 4px 0;
+- color: #000;
++ color: var(--text-primary, #000);
+ }
+
+ .title-section h2 {
+ font-size: 18px;
+ font-weight: 500;
+ margin: 0;
+- color: #666;
++ color: var(--text-quaternary, #666666);
+ }
+
+ .date-info {
+ font-size: 14px;
+- color: #666;
++ color: var(--text-quaternary, #666666);
+ text-align: right;
+ display: flex;
+ align-items: flex-start;
+@@ -1477,14 +1477,14 @@ watch(
+ .no-data-message {
+ text-align: center;
+ padding: 60px 20px;
+- color: #666;
++ color: var(--text-quaternary, #666666);
+ }
+
+ .no-data-icon {
+ width: 64px;
+ height: 64px;
+ margin: 0 auto 20px;
+- color: #ccc;
++ color: var(--text-secondary, #cccccc);
+ }
+
+ .no-data-icon svg {
+@@ -1496,7 +1496,7 @@ watch(
+ font-size: 18px;
+ font-weight: 500;
+ margin: 0 0 12px 0;
+- color: #333;
++ color: var(--text-quaternary, #333333);
+ }
+
+ .no-data-message p {
+@@ -1512,15 +1512,15 @@ watch(
+ font-weight: bold;
+ margin: 24px 0 12px 0;
+ padding: 8px 12px;
+- border-bottom: 2px solid #ddd;
++ border-bottom: 2px solid var(--border-secondary, #ddd);
+ background: #f8f9fa;
+- color: #333;
++ color: var(--text-quaternary, #333333);
+ border-radius: 4px 4px 0 0;
+ }
+
+ .playtime-group .group-title {
+ background: #e3f2fd;
+- border-bottom-color: #2196f3;
++ border-bottom-color: var(--border-secondary, #2196f3);
+ color: #1565c0;
+ }
+
+@@ -1533,7 +1533,7 @@ watch(
+ .group-count {
+ font-size: 14px;
+ font-weight: normal;
+- color: #666;
++ color: var(--text-quaternary, #666666);
+ margin-left: 8px;
+ }
+
+@@ -1547,7 +1547,7 @@ watch(
+ margin: 16px 0 8px 0;
+ padding: 6px 10px;
+ background: #f0f8ff;
+- border-left: 3px solid #2196f3;
++ border-left: 3px solid var(--border-secondary, #2196f3);
+ color: #1565c0;
+ border-radius: 0 4px 4px 0;
+ }
+@@ -1555,7 +1555,7 @@ watch(
+ .playtime-count {
+ font-size: 12px;
+ font-weight: normal;
+- color: #666;
++ color: var(--text-quaternary, #666666);
+ margin-left: 6px;
+ }
+
+@@ -1570,7 +1570,7 @@ watch(
+ padding-top: 16px;
+ border-top: 1px solid #e5e5e5;
+ font-size: 12px;
+- color: #666;
++ color: var(--text-quaternary, #666666);
+ }
+
+ .footer-left {
+diff --git a/app/components/Admin/Sidebar.vue b/app/components/Admin/Sidebar.vue
+index d4dc22a..369f26c 100644
+--- a/app/components/Admin/Sidebar.vue
++++ b/app/components/Admin/Sidebar.vue
+@@ -279,7 +279,7 @@ const getRoleDisplayName = (role) => {
+ background: transparent;
+ }
+ .custom-scrollbar::-webkit-scrollbar-thumb {
+- background: #27272a;
++ background: var(--bg-tertiary, #27272a);
+ border-radius: 10px;
+ }
+ .custom-scrollbar::-webkit-scrollbar-thumb:hover {
+diff --git a/app/components/Admin/SongDownloadDialog.vue b/app/components/Admin/SongDownloadDialog.vue
+index bb81bf2..9268c5a 100644
+--- a/app/components/Admin/SongDownloadDialog.vue
++++ b/app/components/Admin/SongDownloadDialog.vue
+@@ -1228,7 +1228,7 @@ onUnmounted(() => {
+ background: transparent;
+ }
+ .custom-scrollbar::-webkit-scrollbar-thumb {
+- background: #27272a;
++ background: var(--bg-tertiary, #27272a);
+ border-radius: 10px;
+ }
+ .custom-scrollbar::-webkit-scrollbar-thumb:hover {
+diff --git a/app/components/Admin/SongManagement.vue b/app/components/Admin/SongManagement.vue
+index ad4445c..a630cc2 100644
+--- a/app/components/Admin/SongManagement.vue
++++ b/app/components/Admin/SongManagement.vue
+@@ -61,6 +61,12 @@
+ >
+
鏈挱鏀?({{ selectedSongs.length }})
+
++
++
+
+
+-
椹冲洖姝屾洸
++
{{ isBatchReject ? `鎵归噺椹冲洖姝屾洸 (${selectedSongs.length} 棣?` : '椹冲洖姝屾洸' }}
+
+
+
+-
++
+
+@@ -429,6 +435,17 @@
+
鎶曠浜? {{ rejectSongInfo.requester }}
+
+
++
++
++
++
++
鍗冲皢鎵归噺椹冲洖 {{ selectedSongs.length }} 棣栨瓕鏇?/h4>
++ 椹冲洖鍚庡皢涓€骞舵竻鐞嗘姇绁ㄣ€佹帓鏈熻褰曞苟鍙戦€侀€氱煡缁欏搴旀姇绋夸汉
++
++
+
+
+
+
+
+-
++
++
+diff --git a/app/components/Auth/ProfileForm.vue b/app/components/Auth/ProfileForm.vue
+index 3c23d2d..1403f16 100644
+--- a/app/components/Auth/ProfileForm.vue
++++ b/app/components/Auth/ProfileForm.vue
+@@ -224,24 +224,24 @@ const handleUpdateProfile = async () => {
+
+diff --git a/app/components/SiteFooter.vue b/app/components/SiteFooter.vue
+index 0b3adc7..c5d528d 100644
+--- a/app/components/SiteFooter.vue
++++ b/app/components/SiteFooter.vue
+@@ -23,11 +23,16 @@
+
+
+
+-
++
+
+
+
+
+@@ -578,15 +571,6 @@
+ @confirm="handleConfirmAction"
+ />
+
+-
+-
+-
+
+
+
++
++
+diff --git a/app/pages/index.vue b/app/pages/index.vue
+index 33fe93f..7ec75dd 100644
+--- a/app/pages/index.vue
++++ b/app/pages/index.vue
+@@ -33,6 +33,18 @@
+
+
+
++
++
++ 涓婚
++
++
+
+
+ {{ user?.name || '鐢ㄦ埛' }}
+@@ -653,6 +665,13 @@
+
+
+
++
++
+
/dev/null || service ssh reload || true
++ ok "sshd 閰嶇疆宸插姞鍥猴紙deploy 鍙厑璁稿叕閽ョ櫥褰曪紝骞剁鐢ㄧ鍙ｈ浆鍙戯級"
++fi
++
++# -------- 5. 鍒涘缓閮ㄧ讲鐩綍骞剁粰 deploy 鏉冮檺 --------
++mkdir -p "${DEPLOY_DIR}"
++# 鏃㈣缁勬潈闄愶紝鍙堝姞 ACL锛岀‘淇濆悗缁柊寤烘枃浠朵篃鏈?+setfacl -R -m "u:${DEPLOY_USER}:rwX" "${DEPLOY_DIR}"
++setfacl -R -d -m "u:${DEPLOY_USER}:rwX" "${DEPLOY_DIR}"
++ok "閮ㄧ讲鐩綍 ${DEPLOY_DIR} 宸茬粰 ${DEPLOY_USER} 瀹屾暣璇诲啓鏉冮檺锛? 鏂板缓鏂囦欢缁ф壙鏉冮檺锛?
++
++# 濡傛灉鐩綍閲屾湁 compose/鐜鏂囦欢锛岄『渚挎敼涓€涓嬪睘缁勶紝閬垮厤銆宺oot 寤虹殑鏂囦欢 deploy 鏀逛笉浜嗐€?+chgrp -R docker "${DEPLOY_DIR}" 2>/dev/null || true
++chmod -R g+rwX "${DEPLOY_DIR}" 2>/dev/null || true
++
++# -------- 6. 楠岃瘉 docker 鏄惁鐪熻兘鐢紙涓嶆姤閿欙級--------
++DOCKER_RC=0
++sudo -u "${DEPLOY_USER}" docker ps >/dev/null 2>&1 || DOCKER_RC=$?
++if [[ ${DOCKER_RC} -eq 0 ]]; then
++ ok "鉁?${DEPLOY_USER} 鍙互鎵ц docker 鍛戒护"
++else
++ warn "鈿狅笍 ${DEPLOY_USER} 鏆傛椂璺戜笉浜?docker锛堝彲鑳介渶瑕侀噸鏂扮櫥褰曚竴娆″埛鏂扮粍锛夛紝閮ㄧ讲鏃朵笉浼氭湁褰卞搷锛堜絾楠岃瘉鏃朵細鍐嶈Е鍙戜竴娆★級"
++fi
++
++# -------- 7. 鎵撳嵃淇℃伅 --------
++FINGERPRINT="$(ssh-keygen -l -f "${KEY_PATH}.pub" 2>/dev/null || true)"
++PUBKEY_CONTENT="$(cat "${KEY_PATH}.pub")"
++PRIVATE_CONTENT="$(cat "${KEY_PATH}")"
++
++clear
++echo -e "${GREEN}================================================================================${NC}"
++echo -e "${GREEN} 馃帀 閮ㄧ讲鐢ㄦ埛 & SSH 瀵嗛挜 閰嶇疆瀹屾垚锛?{NC}"
++echo -e "${GREEN}================================================================================${NC}"
++echo -e " 馃懁 閮ㄧ讲鐢ㄦ埛鍚? 锛?{CYAN}${DEPLOY_USER}${NC}"
++echo -e " 馃搨 閮ㄧ讲鐩綍 锛?{CYAN}${DEPLOY_DIR}${NC}"
++echo -e " 馃攽 绉侀挜鏂囦欢璺緞 锛?{CYAN}${KEY_PATH}${NC}"
++echo -e " 馃Ь 鍏挜鎸囩汗 锛?{FINGERPRINT}"
++echo -e " 馃Ь 鍏挜鍐呭锛堟柟渚挎牳瀵癸級锛?
++echo -e " ${PUBKEY_CONTENT}"
++echo ""
++echo -e "${YELLOW}================================================================================${NC}"
++echo -e "${YELLOW} 鈿狅笍 涓嬮潰杩欎竴鏁存鏄€愮閽ャ€戯紝瀹屾暣澶嶅埗锛堜粠 BEGIN 鍒?END 鍖呮嫭涓よ锛夊埌锛?{NC}"
++echo -e "${YELLOW} Gitea 浠撳簱 鈫?Settings 鈫?Secrets and variables 鈫?Actions 鈫?New Secret${NC}"
++echo -e "${YELLOW} Name = DEPLOY_SSH_KEY${NC}"
++echo -e "${YELLOW} Value = 绮樿创涓嬮潰涓€鏁存锛堝寘鎷?-----BEGIN/END-----锛?{NC}"
++echo -e "${YELLOW}================================================================================${NC}"
++echo ""
++echo "${PRIVATE_CONTENT}"
++echo ""
++echo -e "${YELLOW}================================================================================${NC}"
++echo -e "${YELLOW} 鈿狅笍 涓婇潰灏辨槸 DEPLOY_SSH_KEY锛屼笉瑕佸湪浠讳綍鍦版柟璐村埌鍒殑鏂囨。鎴栬亰澶┿€傜湅瀹?Ctrl+L 娓呭睆銆?{NC}"
++echo -e "${YELLOW}================================================================================${NC}"
++echo ""
++echo -e "${CYAN}馃憠 鍚屾椂浣犺繕闇€瑕佽ˉ浠ヤ笅鍑犱釜 Repository Secrets锛堥兘鍦ㄥ悓涓€椤垫坊鍔狅級锛?{NC}"
++echo -e " 鈥?DEPLOY_HOST = 浣犵殑鏈嶅姟鍣ㄥ叕缃?IP 鎴栧煙鍚?
++echo -e " 鈥?DEPLOY_PORT = SSH 绔彛锛堜竴鑸?22锛?
++echo -e " 鈥?DEPLOY_USER = ${DEPLOY_USER}锛堝氨鏄繖涓敤鎴峰悕锛?
++echo -e " 鈥?REGISTRY_TOKEN = 浣犵殑 Gitea 涓汉璁块棶浠ょ墝锛圥ackage 璇诲啓鏉冮檺锛?
++echo -e " 鈥?REGISTRY_PULL_USER = 鍚?REGISTRY_USER锛堟湇鍔″櫒涓婃媺闀滃儚鐢紝涓€鑸拰 REGISTRY_USER 涓€鏍凤級"
++echo -e " 鈥?REGISTRY_PULL_TOKEN= 涓婇潰浠ょ墝鍚屼竴涓垨鏂板缓涓€涓粎 pull 鏉冮檺鐨勬洿瀹夊叏"
++echo -e " 鈥?NUXT_PUBLIC_SITE_URL = https://浣犵殑鍩熷悕.com锛堢敤鏉ユ樉绀洪儴缃叉垚鍔熷悗鐨勮烦杞寜閽級"
++echo ""
+diff --git a/scripts/setup-runner.sh b/scripts/setup-runner.sh
+new file mode 100644
+index 0000000..5ee9b05
+--- /dev/null
++++ b/scripts/setup-runner.sh
+@@ -0,0 +1,380 @@
++#!/usr/bin/env bash
++# ============================================================================
++# setup-runner.sh 鈥斺€?涓€閿畨瑁呭苟娉ㄥ唽 Gitea Actions Runner锛坅ct_runner锛?+#
++# 鉁?鍏煎 Gitea 1.21 ~ 鏈€鏂帮紙鍚?1.27.x锛夛紝鏂扮増娌℃湁 Platform 涓嬫媺鑿滃崟銆?+#
++# 浣跨敤鏂规硶锛堜袱绉嶆ā寮忎换閫夊叾涓€锛屾帹鑽?妯″紡 A 鏈€鐪佷簨锛夛細
++#
++# 鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣
++# 妯″紡 A锛氫粨搴撶骇 Runner锛堝彧缁欒繖涓?VoiceHub 浠撳簱鐢紝鏈€甯哥敤銆佹潈闄愭渶灏忥級
++# 璺緞锛氫綘鐨勪粨搴?鈫?Settings 鈫?Actions 鈫?Runners 鈫?鍙充笂瑙?+# 鈫?鏂扮増锛?.21+锛夎繖閲屾病鏈?Platform 閫夋嫨锛岀洿鎺ユ湁涓€涓緭鍏ユ
++# 鍐欑潃銆孯egistration token銆嶆垨銆屾敞鍐屼护鐗屻€?+# 鈫?鐐瑰彸杈圭殑 馃搵 澶嶅埗鎸夐挳锛屽緱鍒颁竴涓蹭互 R 寮€澶寸殑 token
++# 渚嬶細 RGT8FZxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxV
++#
++# 鏈哄櫒涓婃墽琛岋細
++# sudo bash scripts/setup-runner.sh \
++# --scope repo --gitea https://浣犵殑-gitea --token RGTxxxx...
++#
++# 鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣
++# 妯″紡 B锛氱粍缁囩骇 Runner锛堝悓涓€涓?Gitea 缁勭粐涓嬫墍鏈変粨搴撻兘鑳界敤锛?+# 璺緞锛氱粍缁囦富椤?鈫?Settings 鈫?Actions 鈫?Runners 鈫?澶嶅埗 Registration token
++# 锛圱oken 寮€澶翠竴鑸槸 RGOxxxx锛?+#
++# 鎵ц锛?+# sudo bash scripts/setup-runner.sh \
++# --scope org --gitea https://浣犵殑-gitea --token RGOxxxx...
++#
++# 鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣
++# 妯″紡 C锛氬叏灞€/绔欑偣绾?Runner锛圙itea 鍏ㄧ珯鎵€鏈変粨搴撻兘鑳界敤锛岄渶绔欑偣绠＄悊鍛橈級
++# 璺緞锛氱珯鐐圭鐞嗗悗鍙帮紙Site Administration锛夆啋 Actions 鈫?Runners
++# 鈫?澶嶅埗 Registration token锛堝紑澶翠竴鑸槸 RGxxxx锛?+#
++# 鎵ц锛?+# sudo bash scripts/setup-runner.sh \
++# --scope global --gitea https://浣犵殑-gitea --token RGxxxx...
++#
++# 鍏朵粬鍙€夊弬鏁帮細
++# --name "my-runner-01" 鑷畾涔?Runner 鍚嶅瓧锛堥粯璁ゆ槸 runner-涓绘満鍚嶏級
++# --user gitrunner 杩愯鐢ㄦ埛锛堥粯璁?gitrunner锛?+# --dir /opt/act_runner 瀹夎鐩綍锛堥粯璁?/opt/act_runner锛?+# --version 3.3.2 銆愬彲閫夈€戝浐瀹氬畨瑁呮煇鐗堟湰锛屼笉鍐欓粯璁ょ敤 Gitea 瀹樻柟 latest
++# ============================================================================
++set -euo pipefail
++
++# ---------- 棰滆壊 ----------
++RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'; CYAN='\033[1;36m'; NC='\033[0m'
++info() { echo -e "${GREEN}[INFO]${NC} $*"; }
++warn() { echo -e "${YELLOW}[WARN]${NC} $*"; }
++err() { echo -e "${RED}[ERROR]${NC} $*" >&2; exit 1; }
++ok() { echo -e "${CYAN}[ OK ]${NC} $*"; }
++
++# ---------- 瑙ｆ瀽鍙傛暟 ----------
++GITEA_URL=""
++REG_TOKEN=""
++SCOPE="repo" # repo | org | global锛堥粯璁?repo锛岀粷澶у鏁颁汉鐨勫満鏅級
++RUNNER_NAME="runner-$(hostname | tr '[:upper:]' '[:lower:]')"
++RUNNER_USER="gitrunner"
++INSTALL_DIR="/opt/act_runner"
++PINNED_VERSION="" # 绌?= latest锛屽惁鍒欐瘮濡?"3.3.2" 鍥哄畾鐗堟湰
++while [[ $# -gt 0 ]]; do
++ case "$1" in
++ --gitea) GITEA_URL="${2}"; shift 2 ;;
++ --token) REG_TOKEN="${2}"; shift 2 ;;
++ --scope) SCOPE="${2}"; shift 2 ;;
++ --name) RUNNER_NAME="${2}"; shift 2 ;;
++ --user) RUNNER_USER="${2}"; shift 2 ;;
++ --dir) INSTALL_DIR="${2}"; shift 2 ;;
++ --version) PINNED_VERSION="${2#v}"; shift 2 ;;
++ -h|--help)
++ sed -n '2,60p' "$0" | sed 's/^# \{0,1\}//'
++ exit 0
++ ;;
++ *) err "鏈煡鍙傛暟锛?1锛?-help 鏌ョ湅甯姪锛? ;;
++ esac
++done
++
++[[ -n "${GITEA_URL}" ]] || err "蹇呴』浼?--gitea https://浣犵殑-gitea-鍦板潃"
++[[ -n "${REG_TOKEN}" ]] || err "蹇呴』浼?--token锛堜粠 Gitea 椤甸潰鐨?Registration token 澶嶅埗锛孯xx 寮€澶寸殑涓€涓诧級"
++case "${SCOPE}" in
++ repo|org|global) ;;
++ *) err "--scope 蹇呴』鏄?repo | org | global 鍏朵腑涔嬩竴" ;;
++esac
++[[ $EUID -eq 0 ]] || err "璇风敤 sudo 杩愯鏈剼鏈紙闇€瑕佸啓 /opt / /etc/systemd/system锛?
++
++# 鍘绘帀鏈熬 /
++GITEA_URL="${GITEA_URL%/}"
++
++echo ""
++echo -e "${CYAN}鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣${NC}"
++echo -e "${CYAN} 馃殌 寮€濮嬮儴缃?Gitea Actions Runner (鍏煎 1.21 ~ 1.27+)${NC}"
++echo -e "${CYAN} 鈥?缁戝畾 Gitea : ${GITEA_URL}${NC}"
++echo -e "${CYAN} 鈥?浣滅敤鍩? : ${SCOPE}${NC}"
++echo -e "${CYAN} 鈥?Runner 鍚嶇О : ${RUNNER_NAME}${NC}"
++echo -e "${CYAN}鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣${NC}"
++echo ""
++
++# ---------- 0. 鏋舵瀯妫€娴?----------
++ARCH="$(uname -m)"
++case "${ARCH}" in
++ x86_64|amd64) PLATFORM="linux-amd64" ;;
++ aarch64|arm64) PLATFORM="linux-arm64" ;;
++ armv7l) PLATFORM="linux-arm" ;;
++ *) err "鏆備笉鏀寔鐨勬灦鏋勶細${ARCH}锛堥渶瑕?x86_64 / aarch64 / armv7锛? ;;
++esac
++ok "妫€娴嬪埌鏋舵瀯锛?{ARCH} 鈫?涓嬭浇鐗堟湰锛?{PLATFORM}"
++
++# ---------- 0.5 缁欐柊鐗?Gitea 鐢ㄦ埛鐨?Token 鏍煎紡鎻愮ず ----------
++# 涓嶅悓鐗堟湰 / 璇█鍖呯殑 Token 鍓嶇紑涓嶄竴鏍凤紝鍏煎 4 绉嶇湡瀹炲瓨鍦ㄧ殑鏍煎紡锛?+# 鈥?鑻辨枃 1.21+ 浠撳簱绾?RGTxxxx / 缁勭粐绾?RGOxxxx / 鍏ㄥ眬 RGxxxx
++# 鈥?涓枃璇█鍖?/ 鏌愪簺浜屾鍒嗗彂鐗堟湰锛氱函瀛楁瘝鏁板瓧 20~64 浣嶏紙濡?LHLDAwsho7vVSukoEeKhft锛?+TOKEN_LEN="${#REG_TOKEN}"
++ok "Token 闀垮害 = ${TOKEN_LEN} 浣?
++case "${REG_TOKEN}" in
++ # 鑻辨枃鍘熺増鍓嶇紑
++ RG*) info "鈥?Token 鍓嶇紑 RG锛氬叏灞€/绔欑偣绾э紙鑻辨枃鍘熺増锛夆渽" ;;
++ RGO*) info "鈥?Token 鍓嶇紑 RGO锛氱粍缁囩骇锛堣嫳鏂囧師鐗堬級鉁? ;;
++ RGT*) info "鈥?Token 鍓嶇紑 RGT锛氫粨搴撶骇锛堣嫳鏂囧師鐗堬級鉁? ;;
++ # 绾瓧姣嶆暟瀛楋紙涓枃 UI / 浜屽紑鐗堟湰甯歌锛?+ [A-Za-z0-9]\{16,128\})
++ ok "鈥?绾瓧姣嶆暟瀛?Token锛堜腑鏂?UI / 鏌愪簺浜屽紑鐗堟湰甯歌锛夆渽锛屽拰鎴浘閲岀殑銆屾敞鍐屼护鐗屻€嶄竴鑷?
++ ;;
++ # 鍏朵粬
++ *)
++ warn "鈥?Token 鐪嬭捣鏉ヤ笉鏄?Gitea 甯歌鏍煎紡銆備笉杩囦篃鍙兘鏄柊鐗堟敼鍔紝缁х画灏濊瘯娉ㄥ唽..."
++ warn " 濡傛灉娉ㄥ唽鎶?401/403锛屽缓璁洖鍒伴〉闈㈢偣涓€娆°€岄噸缃敞鍐屼护鐗屻€嶉噸鏂板鍒躲€?
++ ;;
++esac
++# 鍩烘湰瀛楃闆嗘牎楠岋紙闃叉澶嶅埗鏃剁矘浜嗙┖鏍兼垨鎹㈣锛?+if [[ ! "${REG_TOKEN}" =~ ^[A-Za-z0-9]+$ ]]; then
++ warn "鈿狅笍 Token 閲屽惈鏈夐潪瀛楁瘝鏁板瓧鐨勫瓧绗︼紝寰堝彲鑳芥槸澶嶅埗鏃跺甯︿簡绌烘牸/鎹㈣/鏍囩偣锛?
++ warn " 寤鸿鍥炲埌浠撳簱椤甸潰鐐?馃搵 澶嶅埗鎸夐挳锛堜笉瑕佹墜閫夋枃瀛楋級銆?
++fi
++
++# ---------- 1. 瀹夎渚濊禆锛歞ocker锛圧unner 瑕佺敤 Docker-in-Docker 鎵ц buildx 绛夛級----------
++if ! command -v docker >/dev/null 2>&1; then
++ info "妫€娴嬪埌娌¤ Docker锛岀幇鍦ㄧ敤瀹樻柟涓€閿剼鏈畨瑁咃紙鍥藉唴鑷姩鎹㈡竻鍗庢簮锛?.."
++ curl -fsSL https://get.docker.com -o /tmp/get-docker.sh || err "涓嬭浇 docker-install 鑴氭湰澶辫触"
++ if curl -sI https://mirrors.tuna.tsinghua.edu.cn >/dev/null; then
++ bash /tmp/get-docker.sh --mirror Aliyun || bash /tmp/get-docker.sh
++ else
++ bash /tmp/get-docker.sh
++ fi
++ systemctl enable --now docker
++ info "鉁?Docker 瀹夎瀹屾垚锛?(docker --version)"
++else
++ info "鉁?Docker 宸插瓨鍦細$(docker --version)"
++fi
++
++# ---------- 2. 寤鸿繍琛岀敤鎴?gitrunner锛屽姞鍏?docker 缁?----------
++if ! id -u "${RUNNER_USER}" >/dev/null 2>&1; then
++ useradd -r -s /usr/sbin/nologin -d "${INSTALL_DIR}" "${RUNNER_USER}"
++ info "鉁?鏂板缓绯荤粺鐢ㄦ埛 ${RUNNER_USER}"
++else
++ info "鈩癸笍 鐢ㄦ埛 ${RUNNER_USER} 宸插瓨鍦紝璺宠繃鍒涘缓"
++fi
++usermod -aG docker "${RUNNER_USER}"
++info "鉁?鎶?${RUNNER_USER} 鍔犲叆 docker 缁勶紙鍏佽鎿嶄綔 Docker daemon锛?
++
++mkdir -p "${INSTALL_DIR}"
++chown -R "${RUNNER_USER}:${RUNNER_USER}" "${INSTALL_DIR}"
++
++# ---------- 3. 涓嬭浇鏈€鏂?Gitea Runner锛坅ct_runner 0.x 鈫?3.x 鏀瑰悕 gitea-runner锛?+# 娉ㄦ剰锛氬畼鏂逛粠 v3 璧凤紝浠撳簱浠?gitea/act_runner 鏀瑰埌浜?gitea/runner锛屼笖鏂囦欢鍚嶅墠缂€浠?act_runner-* 鈫?gitea-runner-*銆?+# 涓洪伩鍏嶅悗缁増鏈啀鏀瑰懡鍚嶅鑷?404锛岃繖閲?*鐩存帴鐢?API 杩斿洖鐨?assets[].browser_download_url**锛屼笉鍐嶇‖缂栫爜鎷兼枃浠跺悕銆?+# ----------
++# 3.1 鍐冲畾 release URL锛堝浐瀹氱増鏈?or latest锛?+if [[ -n "${PINNED_VERSION}" ]]; then
++ REL_URL="https://gitea.com/api/v1/repos/gitea/runner/releases/tags/v${PINNED_VERSION}"
++ info "猬囷笍 浣犳寚瀹氫簡鍥哄畾鐗堟湰锛歷${PINNED_VERSION}"
++else
++ REL_URL="https://gitea.com/api/v1/repos/gitea/runner/releases/latest"
++ info "猬囷笍 姝ｅ湪鑾峰彇 Gitea Runner 鏈€鏂?release 鍏冩暟鎹?.."
++fi
++LATEST_JSON="$(curl -fsSL "${REL_URL}" 2>/dev/null || true)"
++
++# 3.2 濡傛灉 gitea.com 涓嶉€氾紙绾唴缃戯級锛岀洿鎺ュ洖閫€鍒颁竴涓垜浠凡鐭ュ彲鐢ㄧ殑鐗堟湰
++if [[ -z "${LATEST_JSON}" ]]; then
++ if [[ -z "${PINNED_VERSION}" ]]; then
++ warn "gitea.com 璁块棶涓嶅埌锛堝彲鑳芥槸鍐呯綉鐜锛夛紝鑷姩鍥為€€鍒板凡鐭ョǔ瀹氱増鏈細v3.3.2"
++ PINNED_VERSION="3.3.2"
++ fi
++ TAG="v${PINNED_VERSION}"
++ FALLBACK_MODE=1
++else
++ TAG="$(echo "${LATEST_JSON}" | grep -oE '"tag_name":\s*"[^"]+"' | head -1 | cut -d'"' -f4)"
++ FALLBACK_MODE=0
++fi
++[[ -n "${TAG}" ]] || TAG="v3.3.2"
++VERSION="${TAG#v}"
++
++# 3.3 浼樺厛浠?assets 鍖归厤姝ｇ‘ platform 鐨?browser_download_url
++BIN_URL=""
++ASSET_NAME=""
++if [[ "${FALLBACK_MODE}" -eq 0 && -n "${LATEST_JSON}" ]]; then
++ # 鐢?awk 杩囨护锛?+ # - 鍖归厤 PLATFORM锛堜緥濡?linux-amd64锛?+ # - 鎺掗櫎 .xz / .sha256 / .exe 绛夋牎楠屽拰/鍘嬬缉鍖?+ # - 涓ょ鍓嶇紑閮藉吋瀹癸細gitea-runner-X.X.X- (鏂扮増) 鎴?act_runner-X.X.X- (鏃х増)
++ while IFS='|' read -r name url; do
++ [[ -z "${name}" ]] && continue
++ case "${name}" in
++ *"${PLATFORM}"* | *"${PLATFORM//-/_}"*) ;;
++ *) continue ;;
++ esac
++ case "${name}" in
++ *.xz|*.sha256|*.exe|*.tar.gz|*.zip|*checksums*) continue ;;
++ esac
++ ASSET_NAME="${name}"
++ BIN_URL="${url}"
++ break
++ done < <(echo "${LATEST_JSON}" | awk '
++ /"assets": *\[/ {inA=1; next}
++ inA && /"browser_download_url"/ { gsub(/[",]/,"",$2); url=$2 }
++ inA && /"name"/ {
++ gsub(/[",]/,"",$2)
++ if (url!="") { print $2 "|" url; url="" }
++ }
++ inA && /^\]/ {inA=0}
++ ')
++fi
++
++# 3.4 濡傛灉 assets 鍖归厤澶辫触锛堣€佺増鏈?JSON 鏍煎紡鐗规畩锛夛紝鎵嬪姩鎷?4 涓€欓€?URL 椤哄簭灏濊瘯
++if [[ -z "${BIN_URL}" ]]; then
++ info "assets 鑷姩鍖归厤涓虹┖锛屾敼鐢ㄦ墜鍔ㄥ€欓€夊垪琛紙鍏煎鏂版棫鍛藉悕锛?.."
++ CANDIDATES=(
++ # 鏂扮増锛坴3+锛塯itea-runner
++ "https://gitea.com/gitea/runner/releases/download/v${VERSION}/gitea-runner-${VERSION}-${PLATFORM}"
++ # github 闀滃儚锛堟湁鏃?gitea.com 鎱㈡垨鎸傦級
++ "https://github.com/go-gitea/runner/releases/download/v${VERSION}/gitea-runner-${VERSION}-${PLATFORM}"
++ # 鏃х増 act_runner锛坴0.2.x 閬楃暀鍛藉悕锛?+ "https://dl.gitea.com/act_runner/${VERSION}/act_runner-${VERSION}-${PLATFORM}"
++ # 鏃х増 gitea.com
++ "https://gitea.com/gitea/act_runner/releases/download/v${VERSION}/act_runner-${VERSION}-${PLATFORM}"
++ )
++ for C in "${CANDIDATES[@]}"; do
++ info " 鈫?灏濊瘯锛?{C}"
++ if curl -fsSI "${C}" >/dev/null 2>&1; then
++ BIN_URL="${C}"
++ ASSET_NAME="$(basename "${C}")"
++ break
++ fi
++ done
++fi
++
++# 3.5 杩樻病鎷垮埌 URL 鈫?鎵撳嵃鎵嬪姩涓嬭浇鎸囧紩锛堜竴瀹氳鐢ㄦ埛鑳芥晳鍥炴潵锛?+if [[ -z "${BIN_URL}" ]]; then
++ {
++ echo ""
++ echo -e "${RED}鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣${NC}"
++ echo -e "${RED} 鉂?鑷姩涓嬭浇 Gitea Runner 澶辫触${NC}"
++ echo -e "${RED}鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣鈹佲攣${NC}"
++ echo " 浣犵殑鏋舵瀯锛?{PLATFORM} 锛?鐩爣鐗堟湰锛?{TAG}"
++ echo ""
++ echo " 璇峰湪鑳藉嚭缃戠殑鏈哄櫒涓婏紝鎵嬪姩鎵撳紑涓嬮潰 2 涓?URL 涔嬩竴锛屼笅杞藉搴旂殑浜岃繘鍒讹細"
++ echo " 鈥?https://gitea.com/gitea/runner/releases/tag/${TAG}"
++ echo " 鈥?https://github.com/go-gitea/runner/releases/tag/${TAG}"
++ echo " 鎵炬枃浠跺悕绫讳技锛歡itea-runner-${VERSION}-${PLATFORM}锛堜笉瑕佷笅 .xz / .sha256锛?
++ echo ""
++ echo " 涓嬭浇瀹屾垚鍚?scp 鍒版湰鏈嶅姟鍣ㄥ苟鎵ц锛?
++ echo " sudo cp ./gitea-runner-* /usr/local/bin/act_runner"
++ echo " sudo chmod +x /usr/local/bin/act_runner"
++ echo " # 鐒跺悗閲嶆柊璺戞湰鑴氭湰锛堝凡鏈夌殑鐢ㄦ埛/缁?config 涓嶄細閲嶅鐢熸垚锛?
++ echo ""
++ } >&2
++ exit 1
++fi
++
++# 3.6 鐪熸涓嬭浇
++info "猬囷笍 涓嬭浇 Gitea Runner ${TAG}锛?{ASSET_NAME}"
++info " URL锛?{BIN_URL}"
++curl -fsSL "${BIN_URL}" -o /usr/local/bin/act_runner \
++ || err "涓嬭浇澶辫触锛佸彲鑳芥槸 DNS/缃戠粶/璇佷功闂銆傚彲浠ユ墜鍔ㄦ妸涓婇潰 URL 鐨勬枃浠朵笅杞戒笅鏉?scp 鍒版湇鍔″櫒鏀惧埌 /usr/local/bin/act_runner锛屽啀閲嶆柊璺戞湰鑴氭湰銆?
++chmod +x /usr/local/bin/act_runner
++INSTALLED_VER="$(act_runner --version 2>&1 || echo "${TAG}")"
++ok "鉁?宸插畨瑁呭埌 /usr/local/bin/act_runner锛岀増鏈細${INSTALLED_VER}"
++
++# ---------- 4. 娉ㄥ唽 Runner ----------
++cd "${INSTALL_DIR}"
++info "馃敆 寮€濮嬫敞鍐?Runner 鍒?${GITEA_URL}锛堝悕绉帮細${RUNNER_NAME}锛?
++
++# 鍒囧埌 gitrunner 鐢ㄦ埛娉ㄥ唽锛岄伩鍏?root 璺戯紙瀹夊叏锛?+rm -f .runner 2>/dev/null || true
++sudo -u "${RUNNER_USER}" env HOME="${INSTALL_DIR}" \
++ act_runner register \
++ --instance "${GITEA_URL}" \
++ --token "${REG_TOKEN}" \
++ --name "${RUNNER_NAME}" \
++ --labels "ubuntu-latest:docker://catthehacker/ubuntu:act-22.04" \
++ --no-interactive \
++ || err "娉ㄥ唽澶辫触锛佸父瑙佸師鍥狅細\n 1) token 涓嶅锛堝鍒舵椂鍒甫绌烘牸锛塡n 2) Runner 鏈哄櫒鍑轰笉浜嗙綉鍒?${GITEA_URL}\n 3) Gitea 绔欑偣鏃堕棿鍜岃繖鍙版満鍣ㄥ樊澶繙锛堣瘉涔﹂獙璇佸け璐ワ級"
++
++chown "${RUNNER_USER}:${RUNNER_USER}" .runner 2>/dev/null || true
++
++# ---------- 5. 鐢熸垚閰嶇疆鏂囦欢锛堝缓璁紑鍚?docker.host 鐗规潈锛?---------
++CONFIG_FILE="${INSTALL_DIR}/config.yaml"
++if [[ ! -f "${CONFIG_FILE}" ]]; then
++ cat > "${CONFIG_FILE}" <<'YAML'
++log:
++ level: info
++runner:
++ file: .runner
++ capacity: 2 # 鍚屼竴鍙?Runner 鏈€澶氬悓鏃惰窇 2 涓?Job
++ envs:
++ GOPROXY: https://goproxy.cn,direct
++ NPM_CONFIG_REGISTRY: https://registry.npmmirror.com
++ timeout: 3h
++cache:
++ enabled: true
++ dir: /opt/act_runner/cache
++container:
++ network: "bridge"
++ privileged: true # build-push-action 鐢ㄥ埌 Docker daemon
++ options: |
++ --add-host "host.docker.internal:host-gateway"
++YAML
++ chown "${RUNNER_USER}:${RUNNER_USER}" "${CONFIG_FILE}"
++ mkdir -p "${INSTALL_DIR}/cache"
++ chown -R "${RUNNER_USER}:${RUNNER_USER}" "${INSTALL_DIR}/cache"
++ info "鉁?榛樿 config 鍐欏叆 ${CONFIG_FILE}"
++fi
++
++# ---------- 6. 鍐?systemd 鏈嶅姟锛屽紑鏈鸿嚜鍚?----------
++UNIT_FILE="/etc/systemd/system/gitea-act-runner.service"
++cat > "${UNIT_FILE}" < {
+ })
+ }
+
+- if (!['SONG', 'KEYWORD'].includes(type)) {
++ if (!['SONG', 'KEYWORD', 'LANGUAGE', 'GENRE'].includes(type)) {
+ throw createError({
+ statusCode: 400,
+ message: '鏃犳晥鐨勯粦鍚嶅崟绫诲瀷'
+diff --git a/server/api/admin/roles/index.get.ts b/server/api/admin/roles/index.get.ts
+index b11097b..f7d2c68 100644
+--- a/server/api/admin/roles/index.get.ts
++++ b/server/api/admin/roles/index.get.ts
+@@ -1,4 +1,4 @@
+-import { ROLES } from '../../../utils/permissions.js'
++import { ROLES } from '~~/server/utils/permissions'
+
+ export default defineEventHandler((event) => {
+ const user = event.context.user
+diff --git a/server/api/admin/roles/index.put.ts b/server/api/admin/roles/index.put.ts
+index b3b4920..c2f8007 100644
+--- a/server/api/admin/roles/index.put.ts
++++ b/server/api/admin/roles/index.put.ts
+@@ -1,4 +1,4 @@
+-import { ROLES, saveRolesConfig } from '../../../utils/permissions.js'
++import { ROLES, saveRolesConfig } from '~~/server/utils/permissions'
+
+ export default defineEventHandler(async (event) => {
+ const user = event.context.user
+diff --git a/server/api/admin/schedule.post.ts b/server/api/admin/schedule.post.ts
+index 16d0e40..44f6905 100644
+--- a/server/api/admin/schedule.post.ts
++++ b/server/api/admin/schedule.post.ts
+@@ -1,5 +1,13 @@
+ import { db } from '~/drizzle/db'
+-import { playTimes, schedules, songs, users, votes, songReplayRequests } from '~/drizzle/schema'
++import {
++ playTimes,
++ schedules,
++ songs,
++ users,
++ votes,
++ songReplayRequests,
++ scheduleSongPool
++} from '~/drizzle/schema'
+ import { and, asc, count, desc, eq, gte, lte } from 'drizzle-orm'
+ import { createSongSelectedNotification } from '../../services/notificationService'
+ import { cacheService } from '~~/server/services/cacheService'
+@@ -126,6 +134,19 @@ export default defineEventHandler(async (event) => {
+ // 鑾峰彇瀹㈡埛绔疘P鍦板潃
+ const clientIP = getClientIP(event)
+
++ await tx
++ .update(scheduleSongPool)
++ .set({
++ status: 'ASSIGNED',
++ targetPlayDate: playDate
++ })
++ .where(
++ and(
++ eq(scheduleSongPool.songId, body.songId),
++ eq(scheduleSongPool.status, 'PENDING')
++ )
++ )
++
+ // 鍙湁鍦ㄩ潪鑽夌妯″紡涓嬫墠鍒涘缓閫氱煡
+ if (!isDraft) {
+ await createSongSelectedNotification(
+diff --git a/server/api/admin/schedule/draft-bulk.post.ts b/server/api/admin/schedule/draft-bulk.post.ts
+index fb63559..980fa22 100644
+--- a/server/api/admin/schedule/draft-bulk.post.ts
++++ b/server/api/admin/schedule/draft-bulk.post.ts
+@@ -1,5 +1,5 @@
+ import { db } from '~/drizzle/db'
+-import { schedules, songReplayRequests } from '~/drizzle/schema'
++import { schedules, songReplayRequests, scheduleSongPool } from '~/drizzle/schema'
+ import { and, eq, gte, inArray, lte } from 'drizzle-orm'
+ import { cacheService } from '~~/server/services/cacheService'
+
+@@ -80,6 +80,21 @@ export default defineEventHandler(async (event) => {
+
+ const inserted = await tx.insert(schedules).values(rows).returning({ id: schedules.id })
+
++ if (songIds.length > 0) {
++ await tx
++ .update(scheduleSongPool)
++ .set({
++ status: 'ASSIGNED',
++ targetPlayDate: startOfDay
++ })
++ .where(
++ and(
++ inArray(scheduleSongPool.songId, songIds),
++ eq(scheduleSongPool.status, 'PENDING')
++ )
++ )
++ }
++
+ return { deletedCount: existingSchedules.length, insertedCount: inserted.length }
+ })
+
+diff --git a/server/api/admin/songs/batch-reject.post.ts b/server/api/admin/songs/batch-reject.post.ts
+new file mode 100644
+index 0000000..2f0af7a
+--- /dev/null
++++ b/server/api/admin/songs/batch-reject.post.ts
+@@ -0,0 +1,135 @@
++import { db } from '~/drizzle/db'
++import { schedules, songBlacklists, songs, votes, requestTimes } from '~/drizzle/schema'
++import { and, eq, inArray, sql } from 'drizzle-orm'
++import { cacheService } from '../../../services/cacheService'
++import { createSongRejectedNotification } from '../../../services/notificationService'
++import { requireSongAdmin } from '~~/server/utils/requireSongAdmin'
++import { createApiError } from '~~/server/utils/apiError'
++import { SERVER_ERROR_CODES } from '~~/server/config/constants'
++
++const MAX_BATCH_REJECT_COUNT = 1000
++
++export default defineEventHandler(async (event) => {
++ const user = requireSongAdmin(event)
++
++ const body = await readBody(event)
++
++ const songIds = Array.isArray(body?.songIds)
++ ? [...new Set(body.songIds.filter((id: any) => Number.isInteger(id) && id > 0))]
++ : []
++ const reason = typeof body?.reason === 'string' ? body.reason.trim() : ''
++ const addToBlacklist = body?.addToBlacklist === true
++
++ if (songIds.length === 0) {
++ throw createApiError(400, SERVER_ERROR_CODES.SONG_BATCH_REJECT_IDS_REQUIRED, '姝屾洸ID鍒楄〃涓嶈兘涓虹┖')
++ }
++
++ if (songIds.length > MAX_BATCH_REJECT_COUNT) {
++ throw createApiError(
++ 400,
++ SERVER_ERROR_CODES.SONG_BATCH_REJECT_LIMIT_EXCEEDED,
++ `鍗曟鏈€澶氶┏鍥?${MAX_BATCH_REJECT_COUNT} 棣栨瓕鏇瞏,
++ { params: [MAX_BATCH_REJECT_COUNT] }
++ )
++ }
++
++ if (!reason) {
++ throw createApiError(400, SERVER_ERROR_CODES.SONG_BATCH_REJECT_REASON_REQUIRED, '椹冲洖鍘熷洜涓嶈兘涓虹┖')
++ }
++
++ try {
++ let rejectedSongs: any[] = []
++
++ await db.transaction(async (tx) => {
++ const existingSongs = await tx.select().from(songs).where(inArray(songs.id, songIds))
++
++ if (existingSongs.length === 0) {
++ throw createApiError(404, SERVER_ERROR_CODES.SONG_NOT_FOUND, '姝屾洸涓嶅瓨鍦ㄦ垨宸茶鍒犻櫎')
++ }
++
++ const existingIds = existingSongs.map((song) => song.id)
++ console.log(`寮€濮嬫壒閲忛┏鍥炴瓕鏇诧紝鍏?${existingIds.length} 棣朻)
++
++ if (addToBlacklist) {
++ const blacklistValues = [...new Set(existingSongs.map((song: any) => `${song.title} - ${song.artist}`))]
++ const existingBlacklist = await tx
++ .select({ value: songBlacklists.value })
++ .from(songBlacklists)
++ .where(and(eq(songBlacklists.type, 'SONG'), inArray(songBlacklists.value, blacklistValues)))
++ const existingSet = new Set(existingBlacklist.map((item) => item.value))
++ const valuesToInsert = blacklistValues.filter((value) => !existingSet.has(value))
++ for (const value of valuesToInsert) {
++ try {
++ await tx.insert(songBlacklists).values({
++ type: 'SONG',
++ value,
++ reason: `姝屾洸椹冲洖: ${reason}`,
++ createdBy: user.id
++ })
++ } catch (error: any) {
++ console.log(`榛戝悕鍗曟坊鍔犲け璐ワ紝鍙兘宸插瓨鍦? ${error.message}`)
++ }
++ }
++ console.log(`榛戝悕鍗曟坊鍔犲鐞嗗畬鎴恅)
++ }
++
++ await tx.delete(votes).where(inArray(votes.songId, existingIds))
++ console.log(`鍒犻櫎浜嗘姇绁ㄨ褰昤)
++
++ await tx.delete(schedules).where(inArray(schedules.songId, existingIds))
++ console.log(`鍒犻櫎浜嗘帓鏈熻褰昤)
++
++ const hitRequestIds = [...new Set(existingSongs.map((song: any) => song.hitRequestId).filter(Boolean))]
++ for (const hitRequestId of hitRequestIds) {
++ const count = existingSongs.filter((song: any) => song.hitRequestId === hitRequestId).length
++ try {
++ await tx
++ .update(requestTimes)
++ .set({
++ accepted: sql`GREATEST(0, accepted - ${count})`
++ })
++ .where(eq(requestTimes.id, hitRequestId as any))
++ } catch (error: any) {
++ console.error(`鍑忓皯鎶曠鏃舵 ${hitRequestId} 鎺ョ撼鏁伴噺澶辫触: ${error.message}`)
++ }
++ }
++
++ rejectedSongs = await tx.delete(songs).where(inArray(songs.id, existingIds)).returning()
++ console.log(`姝屾洸鎵归噺鍒犻櫎瀹屾垚`)
++ })
++
++ const songsToNotify = rejectedSongs.filter((song) => song.requesterId)
++ for (const song of songsToNotify) {
++ createSongRejectedNotification(
++ song.requesterId,
++ { title: song.title, artist: song.artist },
++ reason
++ ).catch((error: any) => {
++ console.error(`鍙戦€侀┏鍥為€氱煡澶辫触: ${error.message}`)
++ })
++ }
++
++ await cacheService.clearSongsCache()
++ await cacheService.clearSchedulesCache()
++
++ console.log(`鎵归噺椹冲洖鎿嶄綔瀹屾垚锛屽叡 ${rejectedSongs.length} 棣朻)
++
++ return {
++ success: true,
++ message: '姝屾洸鎵归噺椹冲洖鎴愬姛',
++ data: {
++ rejected: rejectedSongs.length,
++ missing: songIds.length - rejectedSongs.length,
++ notificationSent: songsToNotify.length
++ }
++ }
++ } catch (error: any) {
++ console.error('鎵归噺椹冲洖姝屾洸澶辫触:', error)
++
++ if (error.statusCode) {
++ throw error
++ }
++
++ throw createApiError(500, SERVER_ERROR_CODES.SONG_OPERATION_FAILED, '鎵归噺椹冲洖澶辫触: ' + error.message)
++ }
++})
+diff --git a/server/api/admin/stats/active-users.get.ts b/server/api/admin/stats/active-users.get.ts
+index ac05201..e5fb760 100644
+--- a/server/api/admin/stats/active-users.get.ts
++++ b/server/api/admin/stats/active-users.get.ts
+@@ -1,10 +1,10 @@
+ import { createError, defineEventHandler, getQuery } from 'h3'
+ import { db } from '~/drizzle/db'
+-import { songs, users, votes } from '~/drizzle/schema'
+-import { CacheService } from '../../../services/cacheService'
++import { songs, users, votes, userIdentities } from '~/drizzle/schema'
++import { CacheService } from '~~/server/services/cacheService'
++import { getUserAvatarUrl } from '~~/server/utils/user-avatar'
+
+ export default defineEventHandler(async (event) => {
+- // 妫€鏌ヨ璇佸拰鏉冮檺
+ const user = event.context.user
+ if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+ throw createError({
+@@ -18,7 +18,6 @@ export default defineEventHandler(async (event) => {
+ const limit = parseInt(query.limit as string) || 20
+
+ try {
+- // 灏濊瘯浠庣紦瀛樿幏鍙栨暟鎹? const cacheService = CacheService.getInstance()
+ const cachedStats = await cacheService.getActiveUsersStats(semester, limit)
+ if (cachedStats) {
+@@ -26,18 +25,24 @@ export default defineEventHandler(async (event) => {
+ return cachedStats
+ }
+
+- // 鏋勫缓鏌ヨ鏉′欢 - 濡傛灉娌℃湁鎸囧畾瀛︽湡鎴栧鏈熶负'all'锛屾煡璇㈡墍鏈夌敤鎴? let songWhere = {}
+ if (semester && semester !== 'all') {
+ songWhere = { semester: semester }
+ }
+
+- // 鑾峰彇娲昏穬鐢ㄦ埛鏁版嵁 - 鏈夋姇绋挎瓕鏇茬殑鐢ㄦ埛
+ const allUsers = await db.select().from(users)
+ const allSongs = await db.select().from(songs)
+ const allVotes = await db.select().from(votes)
++ const allIdentities = await db.select().from(userIdentities)
++
++ const identitiesMap = new Map()
++ allIdentities.forEach((identity) => {
++ if (!identitiesMap.has(identity.userId)) {
++ identitiesMap.set(identity.userId, [])
++ }
++ identitiesMap.get(identity.userId)!.push(identity)
++ })
+
+- // 杩囨护鏈夋姇绋挎瓕鏇茬殑鐢ㄦ埛
+ const activeUsers = allUsers
+ .filter((user) => {
+ const userSongs = allSongs.filter((song) => {
+@@ -65,44 +70,48 @@ export default defineEventHandler(async (event) => {
+ }
+ })
+
+- // 濡傛灉娌℃湁娲昏穬鐢ㄦ埛锛岃繑鍥炵┖鏁扮粍
+ if (activeUsers.length === 0) {
+ const emptyResult = []
+- // 缂撳瓨绌虹粨鏋? await cacheService.setActiveUsersStats(semester, limit, emptyResult)
+ console.log('[Cache] 娲昏穬鐢ㄦ埛缁熻鏁版嵁宸茬紦瀛橈紙绌虹粨鏋滐級')
+ return emptyResult
+ }
+
+- // 璁＄畻姣忎釜鐢ㄦ埛鐨勬椿璺冨害鏁版嵁
+ const userStats = activeUsers.map((user) => {
+ const contributions = user.songs.length
+ const likes = user.songs.reduce((total, song) => total + song.votes.length, 0)
+-
+- // 娲昏穬搴﹁绠楋細鎶曠鏁?* 2 + 鐐硅禐鏁?* 0.5
+ const activityScore = Math.round(contributions * 2 + likes * 0.5)
++ const userIdentitiesData = identitiesMap.get(user.id) || []
++ const avatarUrl = getUserAvatarUrl(
++ {
++ id: user.id,
++ name: user.name,
++ username: user.username,
++ email: user.email,
++ avatarProvider: user.avatarProvider,
++ avatarProviderUserId: user.avatarProviderUserId
++ },
++ userIdentitiesData
++ )
+
+- const userStat = {
++ return {
+ id: user.id,
+- name: user.name || user.username, // 浼樺厛鏄剧ず鐪熷疄濮撳悕锛屽鏋滄病鏈夊垯鏄剧ず鐧诲綍鍚?+ name: user.name || user.username,
+ contributions,
+ likes,
+- activityScore
++ activityScore,
++ avatarUrl
+ }
+-
+- return userStat
+ })
+
+- // 鎸夋椿璺冨害鍒嗘暟闄嶅簭鎺掑垪骞堕檺鍒舵暟閲? const sortedUsers = userStats.sort((a, b) => b.activityScore - a.activityScore).slice(0, limit)
+
+- // 缂撳瓨缁撴灉
+ await cacheService.setActiveUsersStats(semester, limit, sortedUsers)
+ console.log('[Cache] 娲昏穬鐢ㄦ埛缁熻鏁版嵁宸茬紦瀛?)
+
+ return sortedUsers
+ } catch (error) {
+- // 杩斿洖绌烘暟缁勮€屼笉鏄姏鍑洪敊璇紝閬垮厤鍓嶇鏄剧ず閿欒
++ console.error('[Stats] 鑾峰彇娲昏穬鐢ㄦ埛澶辫触:', error)
+ return []
+ }
+ })
+diff --git a/server/api/admin/stats/realtime.get.ts b/server/api/admin/stats/realtime.get.ts
+index 030e2a8..7b4f449 100644
+--- a/server/api/admin/stats/realtime.get.ts
++++ b/server/api/admin/stats/realtime.get.ts
+@@ -1,12 +1,24 @@
+ import { createError, defineEventHandler } from 'h3'
+ import { db } from '~/drizzle/db'
+-import { CacheService } from '../../../services/cacheService'
+-import { songs, users, votes } from '~/drizzle/schema'
+-import { count, eq, gte } from 'drizzle-orm'
++import { CacheService } from '~~/server/services/cacheService'
++import { songs, users, votes, userIdentities } from '~/drizzle/schema'
++import { count, eq, gte, inArray } from 'drizzle-orm'
+ import { getBeijingHour, getBeijingStartOfDay } from '~/utils/timeUtils'
++import { getUserAvatarUrl } from '~~/server/utils/user-avatar'
++
++function formatRelativeTime(date: Date | null | undefined): string {
++ if (!date) return '鏈煡'
++ const now = new Date()
++ const diff = now.getTime() - new Date(date).getTime()
++ const minutes = Math.floor(diff / 60000)
++ if (minutes < 1) return '鍒氬垰'
++ if (minutes < 60) return `${minutes}鍒嗛挓鍓峘
++ const hours = Math.floor(minutes / 60)
++ if (hours < 24) return `${hours}灏忔椂鍓峘
++ return `${Math.floor(hours / 24)}澶╁墠`
++}
+
+ export default defineEventHandler(async (event) => {
+- // 妫€鏌ヨ璇佸拰鏉冮檺
+ const user = event.context.user
+ if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
+ throw createError({
+@@ -16,97 +28,172 @@ export default defineEventHandler(async (event) => {
+ }
+
+ try {
+- // 灏濊瘯浠庣紦瀛樿幏鍙栨暟鎹? const cacheService = CacheService.getInstance()
+ const cachedStats = await cacheService.getRealtimeStats()
+ if (cachedStats) {
+ console.log('[Cache] 瀹炴椂缁熻鏁版嵁缂撳瓨鍛戒腑')
+ return cachedStats
+ }
+- // 鑾峰彇褰撳墠鏃堕棿鐩稿叧鐨勬棩鏈? const now = new Date()
+- const today = getBeijingStartOfDay() // 浣跨敤鍖椾含鏃堕棿鐨勪竴澶╁紑濮?+ const today = getBeijingStartOfDay()
+ const oneHourAgo = new Date(now.getTime() - 60 * 60 * 1000)
+ const oneDayAgo = new Date(now.getTime() - 24 * 60 * 60 * 1000)
+
+- // 骞惰鑾峰彇瀹炴椂缁熻鏁版嵁
+ const [activeUsersData, todayRequests, popularGenres, peakHours] = await Promise.all([
+- // 娲昏穬鐢ㄦ埛鏁板拰鐢ㄦ埛鍒楄〃 (鏈€杩?灏忔椂鐐规瓕銆佺櫥褰曟垨鐐硅禐鐨勭敤鎴?
+ (async () => {
+ try {
+- // 鑾峰彇鏈€杩?灏忔椂鍐呯偣姝岀殑鐢ㄦ埛
+ const recentSongUsers = await db
+ .select({
+ requesterId: songs.requesterId,
+ requesterName: users.name,
+ requesterUsername: users.username,
+- requesterId2: users.id
++ requesterId2: users.id,
++ requesterLastActive: songs.createdAt,
++ requesterAvatarProvider: users.avatarProvider,
++ requesterAvatarProviderUserId: users.avatarProviderUserId,
++ requesterEmail: users.email
+ })
+ .from(songs)
+ .innerJoin(users, eq(songs.requesterId, users.id))
+ .where(gte(songs.createdAt, oneHourAgo))
+- .groupBy(songs.requesterId, users.id, users.name, users.username)
++ .groupBy(songs.requesterId, users.id, users.name, users.username, users.lastLogin, users.avatarProvider, users.avatarProviderUserId, users.email, songs.createdAt)
+
+- // 鑾峰彇鏈€杩?灏忔椂鍐呯櫥褰曠殑鐢ㄦ埛
+ const recentLoginUsers = await db
+ .select({
+ id: users.id,
+ username: users.username,
+- name: users.name
++ name: users.name,
++ lastLogin: users.lastLogin,
++ avatarProvider: users.avatarProvider,
++ avatarProviderUserId: users.avatarProviderUserId,
++ email: users.email
+ })
+ .from(users)
+ .where(gte(users.lastLogin, oneHourAgo))
+
+- // 鑾峰彇鏈€杩?灏忔椂鍐呯偣璧炶繃姝屾洸鐨勭敤鎴? const recentVoteUsers = await db
+ .select({
+ userId: votes.userId,
+ userName: users.name,
+ userUsername: users.username,
+- userId2: users.id
++ userId2: users.id,
++ voteCreatedAt: votes.createdAt,
++ userAvatarProvider: users.avatarProvider,
++ userAvatarProviderUserId: users.avatarProviderUserId,
++ userEmail: users.email
+ })
+ .from(votes)
+ .innerJoin(users, eq(votes.userId, users.id))
+ .where(gte(votes.createdAt, oneHourAgo))
+- .groupBy(votes.userId, users.id, users.name, users.username)
++ .groupBy(votes.userId, users.id, users.name, users.username, users.avatarProvider, users.avatarProviderUserId, users.email, votes.createdAt)
+
+- // 鍚堝苟骞跺幓閲嶇敤鎴峰垪琛?- const userMap = new Map()
++ const userMap = new Map()
+
+- // 娣诲姞鐐规瓕鐢ㄦ埛
+ recentSongUsers.forEach((song) => {
+- userMap.set(song.requesterId2, {
+- id: song.requesterId2,
++ const id = song.requesterId2
++ const existing = userMap.get(id)
++ const lastActive = existing?.lastActive
++ ? new Date(existing.lastActive) > new Date(song.requesterLastActive)
++ ? existing.lastActive
++ : song.requesterLastActive
++ : song.requesterLastActive
++ userMap.set(id, {
++ id,
+ username: song.requesterUsername,
+- name: song.requesterName
++ name: song.requesterName,
++ email: song.requesterEmail,
++ avatarProvider: song.requesterAvatarProvider,
++ avatarProviderUserId: song.requesterAvatarProviderUserId,
++ lastActive
+ })
+ })
+
+- // 娣诲姞鐧诲綍鐢ㄦ埛
+- recentLoginUsers.forEach((user) => {
+- userMap.set(user.id, {
+- id: user.id,
+- username: user.username,
+- name: user.name
++ recentLoginUsers.forEach((u) => {
++ const existing = userMap.get(u.id)
++ const lastActive = existing?.lastActive
++ ? new Date(existing.lastActive) > new Date(u.lastLogin)
++ ? existing.lastActive
++ : u.lastLogin
++ : u.lastLogin
++ userMap.set(u.id, {
++ id: u.id,
++ username: u.username,
++ name: u.name,
++ email: u.email,
++ avatarProvider: u.avatarProvider,
++ avatarProviderUserId: u.avatarProviderUserId,
++ lastActive
+ })
+ })
+
+- // 娣诲姞鐐硅禐鐢ㄦ埛
+ recentVoteUsers.forEach((vote) => {
+- userMap.set(vote.userId2, {
+- id: vote.userId2,
++ const id = vote.userId2
++ const existing = userMap.get(id)
++ const lastActive = existing?.lastActive
++ ? new Date(existing.lastActive) > new Date(vote.voteCreatedAt)
++ ? existing.lastActive
++ : vote.voteCreatedAt
++ : vote.voteCreatedAt
++ userMap.set(id, {
++ id,
+ username: vote.userUsername,
+- name: vote.userName
++ name: vote.userName,
++ email: vote.userEmail,
++ avatarProvider: vote.userAvatarProvider,
++ avatarProviderUserId: vote.userAvatarProviderUserId,
++ lastActive
+ })
+ })
+
+- const activeUsersList = Array.from(userMap.values())
++ const userIds = Array.from(userMap.keys())
++ let identitiesData: any[] = []
++ if (userIds.length > 0) {
++ try {
++ identitiesData = await db
++ .select()
++ .from(userIdentities)
++ .where(inArray(userIdentities.userId, userIds))
++ } catch (e) {
++ identitiesData = []
++ }
++ }
++
++ const identitiesMap = new Map()
++ identitiesData.forEach((identity) => {
++ if (!identitiesMap.has(identity.userId)) {
++ identitiesMap.set(identity.userId, [])
++ }
++ identitiesMap.get(identity.userId)!.push(identity)
++ })
++
++ const activeUsersList = Array.from(userMap.values()).map((u) => {
++ const userIdentitiesData = identitiesMap.get(u.id) || []
++ const avatarUrl = getUserAvatarUrl(
++ {
++ id: u.id,
++ name: u.name,
++ username: u.username,
++ email: u.email,
++ avatarProvider: u.avatarProvider,
++ avatarProviderUserId: u.avatarProviderUserId
++ },
++ userIdentitiesData
++ )
++ return {
++ id: u.id,
++ username: u.username,
++ name: u.name,
++ avatarUrl,
++ lastActive: formatRelativeTime(u.lastActive)
++ }
++ })
+
+ return {
+ count: activeUsersList.length,
+ users: activeUsersList
+ }
+ } catch (error) {
++ console.error('[Realtime] 鑾峰彇娲昏穬鐢ㄦ埛澶辫触:', error)
+ return {
+ count: 0,
+ users: []
+@@ -114,7 +201,6 @@ export default defineEventHandler(async (event) => {
+ }
+ })(),
+
+- // 浠婃棩鐐规瓕鏁? (async () => {
+ try {
+ const todayCountResult = await db
+@@ -127,12 +213,10 @@ export default defineEventHandler(async (event) => {
+ }
+ })(),
+
+- // 鐑棬娴佹淳 (Song妯″瀷涓病鏈塯enre瀛楁锛岃繑鍥炵┖鏁扮粍)
+ (async () => {
+ return []
+ })(),
+
+- // 楂樺嘲鏃舵 (鏈€杩?澶╃殑灏忔椂缁熻)
+ (async () => {
+ try {
+ const sevenDaysAgo = new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000)
+@@ -143,7 +227,6 @@ export default defineEventHandler(async (event) => {
+ .from(songs)
+ .where(gte(songs.createdAt, sevenDaysAgo))
+
+- // 鎸夊皬鏃剁粺璁? const hourCount = songsData.reduce(
+ (acc, song) => {
+ const hour = getBeijingHour(song.createdAt)
+@@ -153,7 +236,6 @@ export default defineEventHandler(async (event) => {
+ {} as Record
+ )
+
+- // 杩斿洖鍓?涓珮宄版椂娈? return Object.entries(hourCount)
+ .sort(([, a], [, b]) => b - a)
+ .slice(0, 3)
+@@ -177,12 +259,12 @@ export default defineEventHandler(async (event) => {
+ timestamp: now.toISOString()
+ }
+
+- // 缂撳瓨缁撴灉
+ await cacheService.setRealtimeStats(result)
+ console.log('[Cache] 瀹炴椂缁熻鏁版嵁宸茬紦瀛?)
+
+ return result
+ } catch (error) {
++ console.error('[Realtime] 鑾峰彇澶辫触:', error)
+ throw createError({
+ statusCode: 500,
+ message: '鑾峰彇瀹炴椂缁熻鏁版嵁澶辫触'
+diff --git a/server/api/admin/system-settings/index.post.ts b/server/api/admin/system-settings/index.post.ts
+index b33c4fe..1c25235 100644
+--- a/server/api/admin/system-settings/index.post.ts
++++ b/server/api/admin/system-settings/index.post.ts
+@@ -198,6 +198,520 @@ export default defineEventHandler(async (event) => {
+ updateData.forceBlockAllRequests = body.forceBlockAllRequests
+ }
+
++ if (body.submissionNoteRequiresApproval !== undefined) {
++ if (typeof body.submissionNoteRequiresApproval !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'submissionNoteRequiresApproval 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.submissionNoteRequiresApproval = body.submissionNoteRequiresApproval
++ }
++
++ if (body.telemetryEnabled !== undefined) {
++ if (typeof body.telemetryEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'telemetryEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.telemetryEnabled = body.telemetryEnabled
++ }
++
++ if (body.showBeianIcon !== undefined) {
++ if (typeof body.showBeianIcon !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'showBeianIcon 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.showBeianIcon = body.showBeianIcon
++ }
++
++ if (body.scheduleDaysDisplay !== undefined) {
++ if (body.scheduleDaysDisplay !== null && (!Number.isInteger(body.scheduleDaysDisplay) || body.scheduleDaysDisplay < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'scheduleDaysDisplay 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.scheduleDaysDisplay = body.scheduleDaysDisplay
++ }
++
++ if (body.scheduleDaysEditable !== undefined) {
++ if (body.scheduleDaysEditable !== null && (!Number.isInteger(body.scheduleDaysEditable) || body.scheduleDaysEditable < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'scheduleDaysEditable 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.scheduleDaysEditable = body.scheduleDaysEditable
++ }
++
++ if (body.scheduleDaysRequestable !== undefined) {
++ if (body.scheduleDaysRequestable !== null && (!Number.isInteger(body.scheduleDaysRequestable) || body.scheduleDaysRequestable < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'scheduleDaysRequestable 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.scheduleDaysRequestable = body.scheduleDaysRequestable
++ }
++
++ if (body.scheduleDaysBeforeEnabled !== undefined) {
++ if (typeof body.scheduleDaysBeforeEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'scheduleDaysBeforeEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.scheduleDaysBeforeEnabled = body.scheduleDaysBeforeEnabled
++ }
++
++ if (body.scheduleDaysBefore !== undefined) {
++ if (body.scheduleDaysBefore !== null && (!Number.isInteger(body.scheduleDaysBefore) || body.scheduleDaysBefore < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'scheduleDaysBefore 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.scheduleDaysBefore = body.scheduleDaysBefore
++ }
++
++ if (body.scheduleDaysAfterEnabled !== undefined) {
++ if (typeof body.scheduleDaysAfterEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'scheduleDaysAfterEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.scheduleDaysAfterEnabled = body.scheduleDaysAfterEnabled
++ }
++
++ if (body.scheduleDaysAfter !== undefined) {
++ if (body.scheduleDaysAfter !== null && (!Number.isInteger(body.scheduleDaysAfter) || body.scheduleDaysAfter < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'scheduleDaysAfter 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.scheduleDaysAfter = body.scheduleDaysAfter
++ }
++
++ if (body.forcePasswordChangeOnFirstLogin !== undefined) {
++ if (typeof body.forcePasswordChangeOnFirstLogin !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'forcePasswordChangeOnFirstLogin 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.forcePasswordChangeOnFirstLogin = body.forcePasswordChangeOnFirstLogin
++ }
++
++ if (body.enableSubmissionRestriction !== undefined) {
++ if (typeof body.enableSubmissionRestriction !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'enableSubmissionRestriction 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.enableSubmissionRestriction = body.enableSubmissionRestriction
++ }
++
++ if (body.submissionRestrictionScope !== undefined) {
++ updateData.submissionRestrictionScope = body.submissionRestrictionScope
++ }
++
++ if (body.cardCodeEnabled !== undefined) {
++ if (typeof body.cardCodeEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'cardCodeEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.cardCodeEnabled = body.cardCodeEnabled
++ }
++
++ if (body.cardCodeSubmissionRequired !== undefined) {
++ if (typeof body.cardCodeSubmissionRequired !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'cardCodeSubmissionRequired 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.cardCodeSubmissionRequired = body.cardCodeSubmissionRequired
++ }
++
++ if (body.cardCodeVoteEnabled !== undefined) {
++ if (typeof body.cardCodeVoteEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'cardCodeVoteEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.cardCodeVoteEnabled = body.cardCodeVoteEnabled
++ }
++
++ if (body.cardCodeReplayEnabled !== undefined) {
++ if (typeof body.cardCodeReplayEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'cardCodeReplayEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.cardCodeReplayEnabled = body.cardCodeReplayEnabled
++ }
++
++ if (body.enableCardCodeRequests !== undefined) {
++ if (typeof body.enableCardCodeRequests !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'enableCardCodeRequests 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.enableCardCodeRequests = body.enableCardCodeRequests
++ }
++
++ if (body.requireCardCodeForRequests !== undefined) {
++ if (typeof body.requireCardCodeForRequests !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'requireCardCodeForRequests 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.requireCardCodeForRequests = body.requireCardCodeForRequests
++ }
++
++ if (body.enableCardCodeLimitBypass !== undefined) {
++ if (typeof body.enableCardCodeLimitBypass !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'enableCardCodeLimitBypass 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.enableCardCodeLimitBypass = body.enableCardCodeLimitBypass
++ }
++
++ if (body.submissionRestrictionEnabled !== undefined) {
++ if (typeof body.submissionRestrictionEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'submissionRestrictionEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.submissionRestrictionEnabled = body.submissionRestrictionEnabled
++ }
++
++ if (body.submissionRestrictionGradeEnabled !== undefined) {
++ if (typeof body.submissionRestrictionGradeEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'submissionRestrictionGradeEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.submissionRestrictionGradeEnabled = body.submissionRestrictionGradeEnabled
++ }
++
++ if (body.submissionRestrictionClassEnabled !== undefined) {
++ if (typeof body.submissionRestrictionClassEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'submissionRestrictionClassEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.submissionRestrictionClassEnabled = body.submissionRestrictionClassEnabled
++ }
++
++ if (body.submissionRestrictionGraduateEnabled !== undefined) {
++ if (typeof body.submissionRestrictionGraduateEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'submissionRestrictionGraduateEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.submissionRestrictionGraduateEnabled = body.submissionRestrictionGraduateEnabled
++ }
++
++ if (body.submissionRestrictionWithdrawnEnabled !== undefined) {
++ if (typeof body.submissionRestrictionWithdrawnEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'submissionRestrictionWithdrawnEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.submissionRestrictionWithdrawnEnabled = body.submissionRestrictionWithdrawnEnabled
++ }
++
++ if (body.captchaProvider !== undefined) {
++ updateData.captchaProvider = body.captchaProvider
++ }
++
++ if (body.captchaEnabled !== undefined) {
++ if (typeof body.captchaEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'captchaEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.captchaEnabled = body.captchaEnabled
++ }
++
++ if (body.allowRegister !== undefined) {
++ if (typeof body.allowRegister !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'allowRegister 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.allowRegister = body.allowRegister
++ }
++
++ if (body.registerRequireEmail !== undefined) {
++ if (typeof body.registerRequireEmail !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'registerRequireEmail 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.registerRequireEmail = body.registerRequireEmail
++ }
++
++ if (body.registerRequireEmailVerify !== undefined) {
++ if (typeof body.registerRequireEmailVerify !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'registerRequireEmailVerify 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.registerRequireEmailVerify = body.registerRequireEmailVerify
++ }
++
++ if (body.registerDefaultRole !== undefined) {
++ updateData.registerDefaultRole = body.registerDefaultRole
++ }
++
++ if (body.registerRequiresApproval !== undefined) {
++ if (typeof body.registerRequiresApproval !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'registerRequiresApproval 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.registerRequiresApproval = body.registerRequiresApproval
++ }
++
++ if (body.oauthRegisterRequiresApproval !== undefined) {
++ if (typeof body.oauthRegisterRequiresApproval !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'oauthRegisterRequiresApproval 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.oauthRegisterRequiresApproval = body.oauthRegisterRequiresApproval
++ }
++
++ if (body.registerEmailRequired !== undefined) {
++ if (typeof body.registerEmailRequired !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'registerEmailRequired 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.registerEmailRequired = body.registerEmailRequired
++ }
++
++ if (body.registerRequiresGradeClass !== undefined) {
++ if (typeof body.registerRequiresGradeClass !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'registerRequiresGradeClass 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.registerRequiresGradeClass = body.registerRequiresGradeClass
++ }
++
++ if (body.oauthEnabled !== undefined) {
++ if (typeof body.oauthEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'oauthEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.oauthEnabled = body.oauthEnabled
++ }
++
++ if (body.oauthAllowRegister !== undefined) {
++ if (typeof body.oauthAllowRegister !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'oauthAllowRegister 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.oauthAllowRegister = body.oauthAllowRegister
++ }
++
++ if (body.oauthAllowLogin !== undefined) {
++ if (typeof body.oauthAllowLogin !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'oauthAllowLogin 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.oauthAllowLogin = body.oauthAllowLogin
++ }
++
++ if (body.oauthAllowBind !== undefined) {
++ if (typeof body.oauthAllowBind !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'oauthAllowBind 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.oauthAllowBind = body.oauthAllowBind
++ }
++
++ if (body.allowOAuthRegistration !== undefined) {
++ if (typeof body.allowOAuthRegistration !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'allowOAuthRegistration 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.allowOAuthRegistration = body.allowOAuthRegistration
++ }
++
++ if (body.oauthProviders !== undefined) {
++ updateData.oauthProviders = body.oauthProviders
++ }
++
++ if (body.githubOAuthEnabled !== undefined) {
++ if (typeof body.githubOAuthEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'githubOAuthEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.githubOAuthEnabled = body.githubOAuthEnabled
++ }
++
++ if (body.casdoorOAuthEnabled !== undefined) {
++ if (typeof body.casdoorOAuthEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'casdoorOAuthEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.casdoorOAuthEnabled = body.casdoorOAuthEnabled
++ }
++
++ if (body.googleOAuthEnabled !== undefined) {
++ if (typeof body.googleOAuthEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'googleOAuthEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.googleOAuthEnabled = body.googleOAuthEnabled
++ }
++
++ if (body.aggregateOAuthEnabled !== undefined) {
++ if (typeof body.aggregateOAuthEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'aggregateOAuthEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.aggregateOAuthEnabled = body.aggregateOAuthEnabled
++ }
++
++ if (body.aggregateOAuthLoginType !== undefined) {
++ updateData.aggregateOAuthLoginType = body.aggregateOAuthLoginType
++ }
++
++ if (body.customOAuthEnabled !== undefined) {
++ if (typeof body.customOAuthEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'customOAuthEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.customOAuthEnabled = body.customOAuthEnabled
++ }
++
++ if (body.captchaMaxFailures !== undefined) {
++ if (body.captchaMaxFailures !== null && (!Number.isInteger(body.captchaMaxFailures) || body.captchaMaxFailures < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'captchaMaxFailures 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.captchaMaxFailures = body.captchaMaxFailures
++ }
++
++ if (body.autoBackupEnabled !== undefined) {
++ if (typeof body.autoBackupEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'autoBackupEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.autoBackupEnabled = body.autoBackupEnabled
++ }
++
++ if (body.autoBackupIntervalHours !== undefined) {
++ if (body.autoBackupIntervalHours !== null && (!Number.isInteger(body.autoBackupIntervalHours) || body.autoBackupIntervalHours < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'autoBackupIntervalHours 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.autoBackupIntervalHours = body.autoBackupIntervalHours
++ }
++
++ if (body.autoBackupRetentionDays !== undefined) {
++ if (body.autoBackupRetentionDays !== null && (!Number.isInteger(body.autoBackupRetentionDays) || body.autoBackupRetentionDays < 0)) {
++ throw createError({
++ statusCode: 400,
++ message: 'autoBackupRetentionDays 蹇呴』鏄潪璐熸暣鏁版垨null'
++ })
++ }
++ updateData.autoBackupRetentionDays = body.autoBackupRetentionDays
++ }
++
++ if (body.statisticsCodeEnabled !== undefined) {
++ if (typeof body.statisticsCodeEnabled !== 'boolean') {
++ throw createError({
++ statusCode: 400,
++ message: 'statisticsCodeEnabled 蹇呴』鏄竷灏斿€?
++ })
++ }
++ updateData.statisticsCodeEnabled = body.statisticsCodeEnabled
++ }
++
++ if (body.statisticsCodeBody !== undefined) {
++ updateData.statisticsCodeBody = body.statisticsCodeBody
++ }
++
++ if (body.statisticsCodeHead !== undefined) {
++ updateData.statisticsCodeHead = body.statisticsCodeHead
++ }
++
++ if (body.defaultTheme !== undefined) {
++ updateData.defaultTheme =
++ typeof body.defaultTheme === 'string' && body.defaultTheme.trim()
++ ? body.defaultTheme.trim()
++ : null
++ }
++
++ if (body.enabledThemes !== undefined) {
++ updateData.enabledThemes =
++ body.enabledThemes === null || body.enabledThemes === undefined
++ ? null
++ : typeof body.enabledThemes === 'string'
++ ? body.enabledThemes
++ : JSON.stringify(body.enabledThemes)
++ }
++
+ // SMTP閰嶇疆瀛楁
+ if (body.smtpEnabled !== undefined) {
+ if (typeof body.smtpEnabled !== 'boolean') {
+@@ -266,10 +780,69 @@ export default defineEventHandler(async (event) => {
+ })
+ }
+
++ const DEFAULTS = {
++ submissionNoteRequiresApproval: false,
++ telemetryEnabled: true,
++ showBeianIcon: true,
++ scheduleDaysDisplay: 7,
++ scheduleDaysEditable: 3,
++ scheduleDaysRequestable: 14,
++ scheduleDaysBeforeEnabled: false,
++ scheduleDaysBefore: 1,
++ scheduleDaysAfterEnabled: false,
++ scheduleDaysAfter: 1,
++ forcePasswordChangeOnFirstLogin: false,
++ enableSubmissionRestriction: false,
++ submissionRestrictionScope: 'all',
++ cardCodeEnabled: false,
++ cardCodeSubmissionRequired: false,
++ cardCodeVoteEnabled: false,
++ cardCodeReplayEnabled: false,
++ enableCardCodeRequests: false,
++ requireCardCodeForRequests: false,
++ enableCardCodeLimitBypass: false,
++ submissionRestrictionEnabled: false,
++ submissionRestrictionGradeEnabled: false,
++ submissionRestrictionClassEnabled: false,
++ submissionRestrictionGraduateEnabled: false,
++ submissionRestrictionWithdrawnEnabled: false,
++ captchaProvider: 'TURNSTILE',
++ captchaEnabled: false,
++ allowRegister: true,
++ registerRequireEmail: false,
++ registerRequireEmailVerify: false,
++ registerDefaultRole: 'USER',
++ registerRequiresApproval: false,
++ oauthRegisterRequiresApproval: false,
++ registerEmailRequired: false,
++ registerRequiresGradeClass: false,
++ oauthEnabled: false,
++ oauthAllowRegister: true,
++ oauthAllowLogin: true,
++ oauthAllowBind: true,
++ allowOAuthRegistration: false,
++ oauthProviders: '[]',
++ githubOAuthEnabled: false,
++ casdoorOAuthEnabled: false,
++ googleOAuthEnabled: false,
++ aggregateOAuthEnabled: false,
++ aggregateOAuthLoginType: 'qq',
++ customOAuthEnabled: false,
++ captchaMaxFailures: 3,
++ autoBackupEnabled: false,
++ autoBackupIntervalHours: 24,
++ autoBackupRetentionDays: 30,
++ statisticsCodeEnabled: false,
++ defaultTheme: 'ClassicLight',
++ enabledThemes: '["ClassicLight","ModernLight"]'
++} as const
++
+ // 鑾峰彇褰撳墠璁剧疆锛屽鏋滀笉瀛樺湪鍒欏垱寤? const settingsResult = await db.select().from(systemSettings).limit(1)
+ let settings = settingsResult[0] || null
+
++ const fillDefaults = (obj: any) => ({ ...obj, ...Object.fromEntries(Object.entries(DEFAULTS).filter(([k]) => !Object.prototype.hasOwnProperty.call(obj || {}, k) || (obj && obj[k] === undefined || obj[k] === null))) })
++
+ if (!settings) {
+ // 濡傛灉涓嶅瓨鍦紝鍒涘缓鏂拌缃? const newSettingsResult = await db
+@@ -324,7 +897,7 @@ export default defineEventHandler(async (event) => {
+ .set(updateData)
+ .where(eq(systemSettings.id, settings.id))
+ .returning()
+- settings = updatedSettingsResult[0]
++ settings = fillDefaults(updatedSettingsResult[0])
+ }
+
+ // 娓呴櫎绯荤粺璁剧疆缂撳瓨
+diff --git a/server/api/admin/system-settings/index.ts b/server/api/admin/system-settings/index.ts
+index cbe9256..8603bf9 100644
+--- a/server/api/admin/system-settings/index.ts
++++ b/server/api/admin/system-settings/index.ts
+@@ -1,6 +1,7 @@
+ import { db } from '~/drizzle/db'
+ import { systemSettings } from '~/drizzle/schema'
+ import { CacheService } from '../../../services/cacheService'
++import { SYSTEM_SETTINGS_DEFAULTS } from '~~/server/utils/system-settings-defaults'
+
+ export default defineEventHandler(async (event) => {
+ // 妫€鏌ョ敤鎴疯璇佸拰鏉冮檺
+@@ -66,13 +67,15 @@ export default defineEventHandler(async (event) => {
+
+ // 灏嗚缃瓨鍏ョ紦瀛? try {
++ const merged: any = { ...SYSTEM_SETTINGS_DEFAULTS, ...(settings || {}) }
++ settings = merged
+ await cacheService.setSystemSettings(settings)
+ } catch (cacheError) {
+ console.warn('缂撳瓨绯荤粺璁剧疆澶辫触:', cacheError)
+ }
+
+ // 闅愯棌鏁忔劅瀛楁
+- if (settings.smtpPassword) {
++ if (settings && settings.smtpPassword) {
+ settings.smtpPassword = '****************'
+ }
+
+diff --git a/server/api/admin/users/[id].put.ts b/server/api/admin/users/[id].put.ts
+index a9cc874..4dbfec8 100644
+--- a/server/api/admin/users/[id].put.ts
++++ b/server/api/admin/users/[id].put.ts
+@@ -3,6 +3,7 @@ import { db } from '~/drizzle/db'
+ import { users, userStatusLogs } from '~/drizzle/schema'
+ import { eq } from 'drizzle-orm'
+ import { updateUserPassword } from '~~/server/services/userService'
++import { getRoleLevel, canChangeRoleOf, canResetPasswordFor } from '~~/server/utils/permissions'
+
+ export default defineEventHandler(async (event) => {
+ try {
+@@ -51,6 +52,8 @@ export default defineEventHandler(async (event) => {
+ }
+
+ const targetUser = existingUser[0]
++ const currentLevel = getRoleLevel(user.role)
++ const targetLevel = getRoleLevel(targetUser.role)
+
+ // 1. 绂佹淇敼绯荤粺鍒濆瓒呯骇绠＄悊鍛?(ID: 1)
+ if (targetUser.id === 1) {
+@@ -61,7 +64,6 @@ export default defineEventHandler(async (event) => {
+ }
+
+ // 2. 绂佹瀵硅嚜韬繘琛屼换浣曠敤鎴风鐞嗘搷浣滐紙鍖呮嫭瑙掕壊銆佽祫鏂欍€佺姸鎬併€佸瘑鐮佺瓑锛?- // 浣跨敤 String 杞崲纭繚 ID 姣旇緝鐨勫噯纭€? if (String(userId) === String(user.id)) {
+ throw createError({
+ statusCode: 400,
+@@ -69,12 +71,11 @@ export default defineEventHandler(async (event) => {
+ })
+ }
+
+- // 3. 瓒婄骇淇敼淇濇姢
+- // 濡傛灉鐩爣鐢ㄦ埛鏄?SUPER_ADMIN锛屾搷浣滆€呭繀椤绘槸 SUPER_ADMIN
+- if (targetUser.role === 'SUPER_ADMIN' && user.role !== 'SUPER_ADMIN') {
++ // 3. 闈炶秴绾х鐞嗗憳蹇呴』涓ユ牸楂樹簬鐩爣瑙掕壊绾у埆
++ if (user.role !== 'SUPER_ADMIN' && currentLevel <= targetLevel) {
+ throw createError({
+ statusCode: 403,
+- statusMessage: '鏉冮檺涓嶈冻锛氭櫘閫氱鐞嗗憳鏃犳硶淇敼瓒呯骇绠＄悊鍛樹俊鎭?
++ statusMessage: `鏉冮檺涓嶈冻锛?{user.role} 鏃犳硶鎿嶄綔鍚岀骇鎴栨洿楂樿鑹茬殑鐢ㄦ埛`
+ })
+ }
+
+@@ -94,31 +95,26 @@ export default defineEventHandler(async (event) => {
+ }
+ }
+
+- // 瑙掕壊鏉冮檺鎺у埗
+- let validRole = 'USER'
+- if (role && ['USER', 'TEACHER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(role)) {
+- // 瓒呯骇绠＄悊鍛樺彲浠ヨ缃换浣曡鑹?- if (user.role === 'SUPER_ADMIN') {
+- validRole = role
+- }
+- // 绠＄悊鍛樺彧鑳借缃鐞嗗憳浠ヤ笅鐨勮鑹诧紙USER, SONG_ADMIN锛?- else if (user.role === 'ADMIN') {
+- if (['USER', 'TEACHER', 'SONG_ADMIN'].includes(role)) {
+- validRole = role
+- } else {
+- throw createError({
+- statusCode: 403,
+- statusMessage: '绠＄悊鍛樺彧鑳借缃敤鎴枫€佹暀甯堝拰姝屾洸绠＄悊鍛樿鑹?
+- })
+- }
+- }
+- // 鍏朵粬瑙掕壊涓嶈兘璁剧疆瑙掕壊
+- else {
++ // 瑙掕壊鏉冮檺鎺у埗锛堢粺涓€浣跨敤 canChangeRoleOf 璇箟鍖栨鏌ワ級
++ let validRole = targetUser.role
++ if (role && role !== targetUser.role) {
++ if (!canChangeRoleOf(user, targetUser, role)) {
+ throw createError({
+ statusCode: 403,
+- statusMessage: '娌℃湁鏉冮檺璁剧疆鐢ㄦ埛瑙掕壊'
++ statusMessage: user.role === 'SUPER_ADMIN'
++ ? '瓒呯骇绠＄悊鍛樹笉鑳藉皢鐩爣鐢ㄦ埛鎻愬崌涓?SUPER_ADMIN'
++ : `鏉冮檺涓嶈冻锛?{user.role} 鏃犳硶灏嗙敤鎴疯鑹叉洿鏀逛负 ${role}`
+ })
+ }
++ validRole = role
++ }
++
++ // 濡傛灉璇锋眰涓寘鍚瘑鐮佹洿鏂帮紝鏍￠獙瀵嗙爜閲嶇疆鏉冮檺
++ if (password && !canResetPasswordFor(user, targetUser)) {
++ throw createError({
++ statusCode: 403,
++ statusMessage: `鏉冮檺涓嶈冻锛?{user.role} 鏃犳硶閲嶇疆鐩爣鐢ㄦ埛鐨勫瘑鐮乣
++ })
+ }
+
+ // 楠岃瘉status瀛楁鐨勬湁鏁堟€?diff --git a/server/api/admin/users/[id]/reset-password.post.ts b/server/api/admin/users/[id]/reset-password.post.ts
+index 18e9cc7..c421e5b 100644
+--- a/server/api/admin/users/[id]/reset-password.post.ts
++++ b/server/api/admin/users/[id]/reset-password.post.ts
+@@ -1,16 +1,18 @@
+ import { updateUserPassword } from '~~/server/services/userService'
++import { db } from '~/drizzle/db'
++import { users } from '~/drizzle/schema'
++import { eq } from 'drizzle-orm'
++import { canResetPasswordFor, getRoleLevel } from '~~/server/utils/permissions'
+
+ export default defineEventHandler(async (event) => {
+- // 妫€鏌ヨ璇佸拰鏉冮檺
+- const user = event.context.user
+- if (!user || !['ADMIN', 'SUPER_ADMIN'].includes(user.role)) {
++ const currentUser = event.context.user
++ if (!currentUser || !['ADMIN', 'SUPER_ADMIN'].includes(currentUser.role)) {
+ throw createError({
+ statusCode: 403,
+ message: '娌℃湁鏉冮檺璁块棶'
+ })
+ }
+
+- // 瀹夊叏鑾峰彇ID鍙傛暟
+ const params = event.context.params || {}
+ const id = parseInt(params.id || '')
+
+@@ -31,15 +33,54 @@ export default defineEventHandler(async (event) => {
+ }
+
+ try {
+- // 绂佹瀵硅嚜韬繘琛屽瘑鐮侀噸缃紙閫氳繃鐢ㄦ埛绠＄悊鐣岄潰锛?- if (id === user.id) {
++ if (id === currentUser.id) {
+ throw createError({
+ statusCode: 400,
+ message: '绂佹鍦ㄧ敤鎴风鐞嗕腑閲嶇疆鑷繁鐨勫瘑鐮?
+ })
+ }
+-
+- // 浣跨敤缁熶竴鏈嶅姟閲嶇疆瀵嗙爜 (forceReset = true)
++
++ const targetUserResult = await db
++ .select({ id: users.id, role: users.role, username: users.username })
++ .from(users)
++ .where(eq(users.id, id))
++ .limit(1)
++
++ if (targetUserResult.length === 0) {
++ throw createError({
++ statusCode: 404,
++ message: '鐢ㄦ埛涓嶅瓨鍦?
++ })
++ }
++
++ const targetUser = targetUserResult[0]
++
++ if (targetUser.id === 1) {
++ throw createError({
++ statusCode: 403,
++ message: '鏃犳硶閲嶇疆绯荤粺鍒濆瓒呯骇绠＄悊鍛樼殑瀵嗙爜'
++ })
++ }
++
++ const currentLevel = getRoleLevel(currentUser.role)
++ const targetLevel = getRoleLevel(targetUser.role)
++
++ if (currentUser.role !== 'SUPER_ADMIN') {
++ if (currentLevel <= targetLevel) {
++ throw createError({
++ statusCode: 403,
++ message: '鏉冮檺涓嶈冻锛氫笉鑳介噸缃鑹茬骇鍒ぇ浜庣瓑浜庤嚜宸辩殑鐢ㄦ埛瀵嗙爜'
++ })
++ }
++ }
++
++ if (!canResetPasswordFor(currentUser, targetUser)) {
++ throw createError({
++ statusCode: 403,
++ message: '鏉冮檺涓嶈冻锛氬綋鍓嶈鑹叉棤娉曢噸缃鐢ㄦ埛鐨勫瘑鐮?
++ })
++ }
++
+ await updateUserPassword(id, body.newPassword, true)
+
+ return {
+@@ -47,7 +88,10 @@ export default defineEventHandler(async (event) => {
+ message: '瀵嗙爜閲嶇疆鎴愬姛'
+ }
+ } catch (error) {
+- console.error('閲嶇疆瀵嗙爜澶辫触:', error)
++ console.error('[ResetPassword] 澶辫触:', error)
++ if (error.statusCode) {
++ throw error
++ }
+ throw createError({
+ statusCode: 500,
+ message: '閲嶇疆瀵嗙爜澶辫触'
+diff --git a/server/api/admin/users/index.get.ts b/server/api/admin/users/index.get.ts
+index 950aa84..9c2b06f 100644
+--- a/server/api/admin/users/index.get.ts
++++ b/server/api/admin/users/index.get.ts
+@@ -96,26 +96,36 @@ export default defineEventHandler(async (event) => {
+ meowNickname: true,
+ meowBoundAt: true,
+ createdAt: true,
+- updatedAt: true
++ updatedAt: true,
++ avatarProvider: true,
++ avatarProviderUserId: true,
++ email: true
+ },
+ with: {
+- identities: {
+- columns: {
+- provider: true,
+- providerUsername: true
+- },
+- where: (identities, { eq }) => eq(identities.provider, 'github')
+- }
++ identities: true
+ }
+ })
+
+- // 澶勭悊鐢ㄦ埛鍒楄〃锛屾坊鍔犲ご鍍忓瓧娈?- const formattedUsers = usersList.map((user) => ({
+- ...user,
+- avatar: user.identities?.[0]?.providerUsername
+- ? `https://github.com/${user.identities[0].providerUsername}.png`
+- : null
+- }))
++ const { getUserAvatarUrl } = await import('~~/server/utils/user-avatar')
++
++ const formattedUsers = usersList.map((user) => {
++ const avatarUrl = getUserAvatarUrl(
++ {
++ id: user.id,
++ name: user.name,
++ username: user.username,
++ email: user.email,
++ avatarProvider: user.avatarProvider,
++ avatarProviderUserId: user.avatarProviderUserId
++ },
++ user.identities || []
++ )
++ return {
++ ...user,
++ avatar: avatarUrl,
++ avatarUrl
++ }
++ })
+
+ // 璁＄畻鍒嗛〉淇℃伅
+ const totalPages = Math.ceil(total / limitNum)
+diff --git a/server/api/admin/users/index.post.ts b/server/api/admin/users/index.post.ts
+index dd11826..5f41903 100644
+--- a/server/api/admin/users/index.post.ts
++++ b/server/api/admin/users/index.post.ts
+@@ -2,6 +2,7 @@ import bcrypt from 'bcryptjs'
+ import { db } from '~/drizzle/db'
+ import { users } from '~/drizzle/schema'
+ import { eq } from 'drizzle-orm'
++import { getRoleLevel, isRoleHigher, canManageUserRole } from '~~/server/utils/permissions'
+
+ export default defineEventHandler(async (event) => {
+ // 妫€鏌ヨ璇佸拰鏉冮檺
+@@ -51,31 +52,21 @@ export default defineEventHandler(async (event) => {
+ // 鍔犲瘑瀵嗙爜
+ const hashedPassword = await bcrypt.hash(body.password, 10)
+
+- // 瑙掕壊鏉冮檺鎺у埗
++ // 瑙掕壊鏉冮檺鎺у埗锛堢粺涓€浣跨敤 canManageUserRole 鏁板€煎寲绾у埆妫€鏌ワ級
+ let validRole = 'USER'
+- if (body.role && ['USER', 'TEACHER', 'ADMIN', 'SONG_ADMIN', 'SUPER_ADMIN'].includes(body.role)) {
+- // 瓒呯骇绠＄悊鍛樺彲浠ュ垱寤轰换浣曡鑹茬殑鐢ㄦ埛
+- if (user.role === 'SUPER_ADMIN') {
+- validRole = body.role
+- }
+- // 绠＄悊鍛樺彧鑳藉垱寤虹鐞嗗憳浠ヤ笅鐨勮鑹诧紙USER, SONG_ADMIN锛?- else if (user.role === 'ADMIN') {
+- if (['USER', 'TEACHER', 'SONG_ADMIN'].includes(body.role)) {
+- validRole = body.role
+- } else {
+- throw createError({
+- statusCode: 403,
+- message: '绠＄悊鍛樺彧鑳藉垱寤虹敤鎴枫€佹暀甯堝拰姝屾洸绠＄悊鍛樿鑹?
+- })
+- }
+- }
+- // 鍏朵粬瑙掕壊涓嶈兘鍒涘缓鐢ㄦ埛
+- else {
++ const requestedRole = body.role
++ if (requestedRole) {
++ if (!canManageUserRole(user, requestedRole)) {
++ const currentLevel = getRoleLevel(user.role)
++ const targetLevel = getRoleLevel(requestedRole)
+ throw createError({
+ statusCode: 403,
+- message: '娌℃湁鏉冮檺鍒涘缓鐢ㄦ埛'
++ message: isRoleHigher(requestedRole, user.role) || currentLevel <= targetLevel
++ ? `鏉冮檺涓嶈冻锛?{user.role} 鏃犳硶鍒涘缓绾у埆楂樹簬鎴栫瓑浜庤嚜韬殑瑙掕壊锛?{requestedRole}锛塦
++ : `娌℃湁鏉冮檺鍒涘缓 ${requestedRole} 瑙掕壊鐨勭敤鎴穈
+ })
+ }
++ validRole = requestedRole
+ }
+
+ // 鐘舵€侀獙璇?diff --git a/server/api/auth/2fa/verify.post.ts b/server/api/auth/2fa/verify.post.ts
+index 14f191c..7f5fd7e 100644
+--- a/server/api/auth/2fa/verify.post.ts
++++ b/server/api/auth/2fa/verify.post.ts
+@@ -3,6 +3,7 @@ const { authenticator } = otplib
+ import { db, userIdentities, eq, and, users } from '~/drizzle/db'
+ import { twoFactorCodes } from '~~/server/utils/twoFactorStore'
+ import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
++import { createAuthSession } from '~~/server/utils/create-auth-session'
+ import { getClientIP } from '~~/server/utils/ip-utils'
+ import { getBeijingTime } from '~/utils/timeUtils'
+
+@@ -100,7 +101,12 @@ export default defineEventHandler(async (event) => {
+ .catch((err) => console.error('Error updating user login info:', err))
+
+ // 鐢熸垚Token
+- const authToken = JWTEnhanced.generateToken(user.id, user.role)
++ const { token: authToken, jti } = JWTEnhanced.generateTokenWithJti(user.id, user.role)
++ await createAuthSession(event, {
++ userId: user.id,
++ jti,
++ loginMethod: type === 'totp' ? 'totp_2fa' : 'email_2fa'
++ })
+
+ const isSecure =
+ getRequestURL(event).protocol === 'https:' ||
+diff --git a/server/api/auth/[provider]/callback.get.ts b/server/api/auth/[provider]/callback.get.ts
+index fe196ca..dc24044 100644
+--- a/server/api/auth/[provider]/callback.get.ts
++++ b/server/api/auth/[provider]/callback.get.ts
+@@ -2,6 +2,7 @@ import { parseState, getRedirectUri } from '~~/server/utils/oauth'
+ import { generateBindingToken } from '~~/server/utils/oauth-token'
+ import { db, eq, userIdentities } from '~/drizzle/db'
+ import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
++import { createAuthSession } from '~~/server/utils/create-auth-session'
+ import { getOAuthStrategy } from '~~/server/utils/oauth-strategies'
+ import { isUserBlocked, getUserBlockRemainingTime } from '~~/server/services/securityService'
+
+@@ -142,7 +143,13 @@ async function handleUserLoginOrBind(
+ }
+
+ // 鐧诲綍
+- const token = JWTEnhanced.generateToken(existingIdentity.user.id, existingIdentity.user.role)
++ const { token, jti } = JWTEnhanced.generateTokenWithJti(existingIdentity.user.id, existingIdentity.user.role)
++ await createAuthSession(event, {
++ userId: existingIdentity.user.id,
++ jti,
++ loginMethod: 'oauth',
++ oauthProvider: provider
++ })
+ setCookie(event, 'auth-token', token, {
+ httpOnly: true,
+ secure: process.env.NODE_ENV === 'production',
+diff --git a/server/api/auth/bind.post.ts b/server/api/auth/bind.post.ts
+index 1e31b27..43025d1 100644
+--- a/server/api/auth/bind.post.ts
++++ b/server/api/auth/bind.post.ts
+@@ -1,6 +1,7 @@
+ import bcrypt from 'bcryptjs'
+ import { db, eq, users, userIdentities } from '~/drizzle/db'
+ import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
++import { createAuthSession } from '~~/server/utils/create-auth-session'
+ import { verifyBindingToken } from '~~/server/utils/oauth-token'
+ import {
+ isAccountLocked,
+@@ -86,7 +87,13 @@ export default defineEventHandler(async (event) => {
+ recordLoginSuccess(username, clientIp)
+
+ // 鐧诲綍
+- const token = JWTEnhanced.generateToken(user.id, user.role)
++ const { token, jti } = JWTEnhanced.generateTokenWithJti(user.id, user.role)
++ await createAuthSession(event, {
++ userId: user.id,
++ jti,
++ loginMethod: 'oauth',
++ oauthProvider: payload.provider
++ })
+ setCookie(event, 'auth-token', token, {
+ httpOnly: true,
+ secure: process.env.NODE_ENV === 'production',
+diff --git a/server/api/auth/login.post.ts b/server/api/auth/login.post.ts
+index 5d3f3f9..2113caf 100644
+--- a/server/api/auth/login.post.ts
++++ b/server/api/auth/login.post.ts
+@@ -1,6 +1,7 @@
+ import bcrypt from 'bcryptjs'
+ import { db, eq, users, userIdentities, and } from '~/drizzle/db'
+ import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
++import { createAuthSession } from '~~/server/utils/create-auth-session'
+ import {
+ getAccountLockRemainingTime,
+ getIPBlockRemainingTime,
+@@ -187,7 +188,8 @@ export default defineEventHandler(async (event) => {
+ .catch((err) => console.error('Error updating user login info:', err))
+
+ // 鐢熸垚JWT
+- const token = JWTEnhanced.generateToken(user.id, user.role)
++ const { token, jti } = JWTEnhanced.generateTokenWithJti(user.id, user.role)
++ await createAuthSession(event, { userId: user.id, jti, loginMethod: 'password' })
+
+ // 鑷姩鍒ゆ柇鏄惁闇€瑕乻ecure
+ const isSecure =
+diff --git a/server/api/auth/register.post.ts b/server/api/auth/register.post.ts
+index 5e6ef73..7369928 100644
+--- a/server/api/auth/register.post.ts
++++ b/server/api/auth/register.post.ts
+@@ -1,6 +1,7 @@
+ import bcrypt from 'bcryptjs'
+ import { db, eq, users } from '~/drizzle/db'
+ import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
++import { createAuthSession } from '~~/server/utils/create-auth-session'
+ import { emailVerificationCodes } from '~~/server/api/user/email/send-code.post'
+
+ export default defineEventHandler(async (event) => {
+@@ -109,7 +110,8 @@ export default defineEventHandler(async (event) => {
+ }
+
+ // 绛惧彂 JWT Token
+- const token = JWTEnhanced.generateToken(newUser.id, newUser.role)
++ const { token, jti } = JWTEnhanced.generateTokenWithJti(newUser.id, newUser.role)
++ await createAuthSession(event, { userId: newUser.id, jti, loginMethod: 'password' })
+
+ const isSecure =
+ getRequestURL(event).protocol === 'https:' ||
+diff --git a/server/api/auth/verify.get.ts b/server/api/auth/verify.get.ts
+index d44065b..db98f63 100644
+--- a/server/api/auth/verify.get.ts
++++ b/server/api/auth/verify.get.ts
+@@ -3,6 +3,7 @@ import { db } from '~/drizzle/db'
+ import { users } from '~/drizzle/schema'
+ import { executeRedisCommand, isRedisReady } from '../../utils/redis'
+ import { eq } from 'drizzle-orm'
++import { isSessionRevokedByJti, touchAuthSession } from '~~/server/utils/create-auth-session'
+
+ // 鐢ㄦ埛璁よ瘉缂撳瓨锛堟案涔呯紦瀛橈紝鐧诲嚭鎴栨潈闄愬彉鏇存椂涓诲姩澶辨晥锛?
+@@ -19,9 +20,17 @@ export default defineEventHandler(async (event) => {
+ }
+
+ // 楠岃瘉JWT浠ょ墝
+- const decoded = jwt.verify(token, process.env.JWT_SECRET!) as { userId: number }
++ const decoded = jwt.verify(token, process.env.JWT_SECRET!) as { userId: number; jti?: string }
+ const userId = decoded.userId
+
++ if (await isSessionRevokedByJti(decoded.jti)) {
++ throw createError({
++ statusCode: 401,
++ statusMessage: '浼氳瘽宸叉挙閿€锛岃閲嶆柊鐧诲綍'
++ })
++ }
++ touchAuthSession(decoded.jti).catch(() => undefined)
++
+ // 浼樺厛浠嶳edis缂撳瓨鑾峰彇鐢ㄦ埛璁よ瘉鐘舵€? if (isRedisReady()) {
+ const cachedUser = await executeRedisCommand(async () => {
+diff --git a/server/api/auth/webauthn/login/verify.post.ts b/server/api/auth/webauthn/login/verify.post.ts
+index 1367427..a05d8d4 100644
+--- a/server/api/auth/webauthn/login/verify.post.ts
++++ b/server/api/auth/webauthn/login/verify.post.ts
+@@ -4,6 +4,7 @@ import { getWebAuthnConfig } from '~~/server/utils/webauthn-config'
+ import { db, eq, and, userIdentities } from '~/drizzle/db'
+ import { createError, defineEventHandler, setCookie } from 'h3'
+ import { JWTEnhanced } from '~~/server/utils/jwt-enhanced'
++import { createAuthSession } from '~~/server/utils/create-auth-session'
+
+ export default defineEventHandler(async (event) => {
+ const body = await readBody(event)
+@@ -84,7 +85,8 @@ export default defineEventHandler(async (event) => {
+ .where(eq(userIdentities.id, identity.id))
+
+ // 绛惧彂鐧诲綍 Token
+- const token = JWTEnhanced.generateToken(identity.user.id, identity.user.role)
++ const { token, jti } = JWTEnhanced.generateTokenWithJti(identity.user.id, identity.user.role)
++ await createAuthSession(event, { userId: identity.user.id, jti, loginMethod: 'webauthn' })
+ setCookie(event, 'auth-token', token, {
+ httpOnly: true,
+ secure: process.env.NODE_ENV === 'production',
+diff --git a/server/api/blacklist/check.post.ts b/server/api/blacklist/check.post.ts
+index b0a2922..f666348 100644
+--- a/server/api/blacklist/check.post.ts
++++ b/server/api/blacklist/check.post.ts
+@@ -3,9 +3,39 @@ import { db } from '~/drizzle/db'
+ import { songBlacklists, systemSettings } from '~/drizzle/schema'
+ import { eq } from 'drizzle-orm'
+
++function isCJK(text: string): boolean {
++ return /[\u4e00-\u9fa5]/.test(text)
++}
++function isLatin(text: string): boolean {
++ return /[A-Za-z]/.test(text)
++}
++function isKana(text: string): boolean {
++ return /[\u3040-\u30ff]/.test(text)
++}
++function isHangul(text: string): boolean {
++ return /[\uac00-\ud7af]/.test(text)
++}
++function isCyrillic(text: string): boolean {
++ return /[\u0400-\u04ff]/.test(text)
++}
++function isArabic(text: string): boolean {
++ return /[\u0600-\u06ff]/.test(text)
++}
++function detectLanguages(text: string): string[] {
++ const result: string[] = []
++ if (!text) return result
++ if (isCJK(text)) result.push('zh', '涓枃', 'chinese', 'cjk')
++ if (isLatin(text)) result.push('en', '鑻辨枃', 'english', 'latin')
++ if (isKana(text)) result.push('ja', '鏃ユ枃', 'japanese')
++ if (isHangul(text)) result.push('ko', '闊╂枃', 'korean')
++ if (isCyrillic(text)) result.push('ru', '淇勬枃', 'russian', 'cyrillic')
++ if (isArabic(text)) result.push('ar', '闃挎媺浼枃', 'arabic')
++ return result
++}
++
+ export default defineEventHandler(async (event) => {
+ const body = await readBody(event)
+- const { title, artist } = body
++ const { title, artist, genre } = body
+
+ if (!title) {
+ throw createError({
+@@ -15,24 +45,31 @@ export default defineEventHandler(async (event) => {
+ }
+
+ try {
+- // 鑾峰彇绯荤粺璁剧疆
+ const systemSettingsResult = await db.select().from(systemSettings).limit(1)
+ const systemSettingsData = systemSettingsResult[0]
+ const showBlacklistKeywords = systemSettingsData?.showBlacklistKeywords ?? false
+
+- // 鑾峰彇鎵€鏈夋椿璺冪殑榛戝悕鍗曢」
+ const blacklistItems = await db
+ .select()
+ .from(songBlacklists)
+ .where(eq(songBlacklists.isActive, true))
+
+ const songFullName = `${title} - ${artist || ''}`.toLowerCase()
+- const blocked = []
++ const genreLower = (genre || '').toLowerCase()
++ const combinedText = `${title} ${artist || ''} ${genre || ''}`
++ const textLanguages = new Set([
++ ...detectLanguages(title || ''),
++ ...detectLanguages(artist || ''),
++ ...detectLanguages(genre || '')
++ ])
++
++ const blocked: Array<{ type: string; value: string | null; reason: string }> = []
+
+ for (const item of blacklistItems) {
++ const valueLower = item.value.toLowerCase()
++
+ if (item.type === 'SONG') {
+- // 妫€鏌ュ叿浣撴瓕鏇?- if (songFullName.includes(item.value.toLowerCase())) {
++ if (songFullName.includes(valueLower)) {
+ blocked.push({
+ type: 'song',
+ value: item.value,
+@@ -40,15 +77,38 @@ export default defineEventHandler(async (event) => {
+ })
+ }
+ } else if (item.type === 'KEYWORD') {
+- // 妫€鏌ュ叧閿瘝
+- if (songFullName.includes(item.value.toLowerCase())) {
++ if (songFullName.includes(valueLower) || (genreLower && genreLower.includes(valueLower))) {
+ blocked.push({
+ type: 'keyword',
+- value: showBlacklistKeywords ? item.value : null, // 鏍规嵁璁剧疆鍐冲畾鏄惁鏄剧ず鍏蜂綋鍏抽敭璇?+ value: showBlacklistKeywords ? item.value : null,
+ reason:
+ item.reason || (showBlacklistKeywords ? `鍖呭惈鍏抽敭璇嶏細${item.value}` : '鍖呭惈鍏抽敭璇?)
+ })
+ }
++ } else if (item.type === 'LANGUAGE') {
++ const tokens = [
++ valueLower,
++ ...valueLower.split(/[,锛孿/|\s]+/).map((s) => s.trim()).filter(Boolean)
++ ]
++ const hit = tokens.some((lang) => textLanguages.has(lang))
++ if (hit) {
++ blocked.push({
++ type: 'language',
++ value: showBlacklistKeywords ? item.value : null,
++ reason: item.reason || `璇ヨ绉嶆瓕鏇插凡琚檺鍒讹細${showBlacklistKeywords ? item.value : ''}`.trim()
++ })
++ }
++ } else if (item.type === 'GENRE') {
++ const combinedForGenre = `${genreLower} ${combinedText}`.toLowerCase()
++ const tokens = valueLower.split(/[,锛孿/|\s]+/).map((s) => s.trim()).filter(Boolean)
++ const hit = tokens.some((tok) => combinedForGenre.includes(tok))
++ if (hit) {
++ blocked.push({
++ type: 'genre',
++ value: showBlacklistKeywords ? item.value : null,
++ reason: item.reason || `璇ユ洸椋庢瓕鏇插凡琚檺鍒讹細${showBlacklistKeywords ? item.value : ''}`.trim()
++ })
++ }
+ }
+ }
+
+@@ -57,7 +117,8 @@ export default defineEventHandler(async (event) => {
+ reasons: blocked,
+ song: {
+ title,
+- artist
++ artist,
++ genre: genre || null
+ }
+ }
+ } catch (error) {
+diff --git a/server/api/open/schedules.get.ts b/server/api/open/schedules.get.ts
+index 4139815..9744bd4 100644
+--- a/server/api/open/schedules.get.ts
++++ b/server/api/open/schedules.get.ts
+@@ -1,12 +1,17 @@
+ import { createError, defineEventHandler, getQuery } from 'h3'
+ import { db } from '~/drizzle/db'
+-import { playTimes, schedules, songCollaborators, songs, users } from '~/drizzle/schema'
++import { playTimes, schedules, songCollaborators, songs, systemSettings, users } from '~/drizzle/schema'
+ import { and, asc, desc, eq, gte, inArray, like, lt, or, sql } from 'drizzle-orm'
+ import { formatDateTime } from '~/utils/timeUtils'
+ import { openApiCache } from '~~/server/utils/open-api-cache'
+ import { CACHE_CONSTANTS } from '~~/server/config/constants'
+ import { cacheService } from '~~/server/services/cacheService'
+ import { executeRedisCommand, isRedisReady } from '~~/server/utils/redis'
++import {
++ resolveScheduleVisibilityRange,
++ isPlayDateInRange,
++ type VisibilitySettingsLike
++} from '~~/server/utils/schedule-visibility'
+
+ export default defineEventHandler(async (event) => {
+ try {
+@@ -36,6 +41,27 @@ export default defineEventHandler(async (event) => {
+ const sortBy = (query.sortBy as string) || 'playDate'
+ const sortOrder = (query.sortOrder as string) || 'asc'
+
++ // 璇诲彇绯荤粺璁剧疆锛氭帓鏈熷彲瑙佽寖鍥?+ let visibilityRange = { startAt: null as Date | null, endAt: null as Date | null }
++ try {
++ const systemSettingsDataResult = await db.select().from(systemSettings).limit(1)
++ const systemSettingsData = systemSettingsDataResult[0] || null
++ const visibilitySettings: VisibilitySettingsLike = {
++ scheduleDaysBeforeEnabled: systemSettingsData?.scheduleDaysBeforeEnabled,
++ scheduleDaysBefore: systemSettingsData?.scheduleDaysBefore,
++ scheduleDaysAfterEnabled: systemSettingsData?.scheduleDaysAfterEnabled,
++ scheduleDaysAfter: systemSettingsData?.scheduleDaysAfter
++ }
++ visibilityRange = resolveScheduleVisibilityRange(visibilitySettings)
++ } catch (err) {
++ console.warn('[Schedules API] 璇诲彇鎺掓湡鍙鑼冨洿璁剧疆澶辫触锛屽皢灞曠ず鍏ㄩ儴:', err)
++ }
++
++ const applyVisibilityFilter = (items: any[]): any[] => {
++ if (!visibilityRange.startAt && !visibilityRange.endAt) return items
++ return items.filter((s) => isPlayDateInRange(s.playDate, visibilityRange))
++ }
++
+ // 浼樺厛浠庢櫘閫欰PI缂撳瓨鑾峰彇鏁版嵁
+
+ // 灏濊瘯浠嶤acheService鑾峰彇鎺掓湡鏁版嵁
+@@ -49,6 +75,7 @@ export default defineEventHandler(async (event) => {
+ if (semester) {
+ filteredSchedules = cachedSchedules.filter((s) => s.song?.semester === semester)
+ }
++ filteredSchedules = applyVisibilityFilter(filteredSchedules)
+
+ // 杞崲涓哄紑鏀続PI鏍煎紡
+ const result = {
+@@ -105,11 +132,12 @@ export default defineEventHandler(async (event) => {
+ })
+
+ if (redisData) {
++ const filteredRedisData = applyVisibilityFilter(redisData)
+ // 杞崲涓哄紑鏀続PI鏍煎紡
+ const result = {
+ success: true,
+ data: {
+- schedules: redisData.map((schedule: any) => ({
++ schedules: filteredRedisData.map((schedule: any) => ({
+ id: schedule.id,
+ playDate: schedule.playDate,
+ sequence: schedule.sequence,
+@@ -133,7 +161,7 @@ export default defineEventHandler(async (event) => {
+ }
+ : null
+ })),
+- total: redisData.length,
++ total: filteredRedisData.length,
+ semester: semester || null
+ }
+ }
+@@ -175,6 +203,13 @@ export default defineEventHandler(async (event) => {
+ conditions.push(or(like(songs.title, `%${search}%`)!, like(songs.artist, `%${search}%`)!)!)
+ }
+
++ if (visibilityRange.startAt) {
++ conditions.push(gte(schedules.playDate, visibilityRange.startAt)!)
++ }
++ if (visibilityRange.endAt) {
++ conditions.push(lt(schedules.playDate, visibilityRange.endAt)!)
++ }
++
+ const whereCondition = conditions.length > 0 ? and(...conditions) : undefined
+
+ // 璁＄畻鍋忕Щ閲?diff --git a/server/api/roles.get.ts b/server/api/roles.get.ts
+index 415d3d7..7bd2a6c 100644
+--- a/server/api/roles.get.ts
++++ b/server/api/roles.get.ts
+@@ -1,4 +1,4 @@
+-import { ROLES } from '../utils/permissions.js'
++import { ROLES } from '~~/server/utils/permissions'
+
+ export default defineEventHandler(() => {
+ return ROLES
+diff --git a/server/api/site-config.get.ts b/server/api/site-config.get.ts
+index 8ead517..0ad6af9 100644
+--- a/server/api/site-config.get.ts
++++ b/server/api/site-config.get.ts
+@@ -2,6 +2,7 @@ import { db } from '~/drizzle/db'
+ import { systemSettings } from '~/drizzle/schema'
+ import { cacheService } from '../services/cacheService'
+ import { isRedisReady } from '../utils/redis'
++import { SYSTEM_SETTINGS_DEFAULTS } from '~~/server/utils/system-settings-defaults'
+
+ // 杩囨护鏁忔劅瀛楁锛屽彧杩斿洖鍏紑閰嶇疆
+ const publicFields = [
+@@ -26,17 +27,23 @@ const publicFields = [
+ 'enableSubmissionRemarks',
+ 'enableRequestTimeLimitation',
+ 'forceBlockAllRequests',
+- 'smtpEnabled'
++ 'smtpEnabled',
++ 'defaultTheme',
++ 'enabledThemes',
++ 'scheduleDaysBeforeEnabled',
++ 'scheduleDaysBefore',
++ 'scheduleDaysAfterEnabled',
++ 'scheduleDaysAfter',
++ 'statisticsCode',
++ 'statisticsCodeEnabled'
+ ]
+
+ const filterPublicSettings = (data: any) => {
+- if (!data) {
+- return {}
+- }
++ const merged: any = { ...SYSTEM_SETTINGS_DEFAULTS, ...(data || {}) }
+ const result: Record = {}
+ for (const key of publicFields) {
+- if (Object.prototype.hasOwnProperty.call(data, key)) {
+- result[key] = data[key]
++ if (Object.prototype.hasOwnProperty.call(merged, key)) {
++ result[key] = merged[key]
+ }
+ }
+ return result
+@@ -49,7 +56,7 @@ export default defineEventHandler(async (event) => {
+ const cachedSettings = await cacheService.getSystemSettings()
+ if (cachedSettings) {
+ console.log('[API] 绯荤粺璁剧疆缂撳瓨鍛戒腑')
+- return filterPublicSettings(cachedSettings)
++ return filterPublicSettings({ ...SYSTEM_SETTINGS_DEFAULTS, ...cachedSettings })
+ }
+ }
+
+@@ -70,7 +77,8 @@ export default defineEventHandler(async (event) => {
+ siteDescription: '鏍″洯骞挎挱绔欑偣姝岀郴缁?- 璁╀綘鐨勫０闊宠鍚',
+ siteVersion: process.env.NUXT_PUBLIC_SITE_VERSION || null,
+ submissionGuidelines: '璇烽伒瀹堟牎鍥瀹氾紝鎻愪氦鍋ュ悍鍚戜笂鐨勬瓕鏇层€?,
+- icpNumber: null,
++ icpNumber: '绮CP澶?025450093鍙?,
++ gonganNumber: null,
+ enableSubmissionLimit: false,
+ dailySubmissionLimit: null,
+ weeklySubmissionLimit: null,
+@@ -81,14 +89,20 @@ export default defineEventHandler(async (event) => {
+ enableRequestTimeLimitation: false,
+ forceBlockAllRequests: false,
+ enableReplayRequests: false,
+- smtpEnabled: false
++ smtpEnabled: false,
++ defaultTheme: 'ClassicLight',
++ enabledThemes: '["ClassicLight","ModernLight"]',
++ scheduleDaysBeforeEnabled: false,
++ scheduleDaysBefore: 30,
++ scheduleDaysAfterEnabled: false,
++ scheduleDaysAfter: 14
+ })
+ .returning()
+
+ settings = newSettings[0]
+ }
+
+- const publicSettings = filterPublicSettings(settings)
++ const publicSettings = filterPublicSettings({ ...SYSTEM_SETTINGS_DEFAULTS, ...(settings || {}) })
+
+ // 灏嗙粨鏋滅紦瀛樺埌Redis锛堝鏋滃彲鐢級- 姘镐箙缂撳瓨
+ if (settings && isRedisReady()) {
+diff --git a/server/api/songs/[id]/update.put.ts b/server/api/songs/[id]/update.put.ts
+index abe3c9c..3d5b70d 100644
+--- a/server/api/songs/[id]/update.put.ts
++++ b/server/api/songs/[id]/update.put.ts
+@@ -1,8 +1,16 @@
+ import { db } from '~/drizzle/db'
+-import { songs, users, songCollaborators, collaborationLogs } from '~/drizzle/schema'
+-import { eq, or } from 'drizzle-orm'
++import {
++ songs,
++ users,
++ songCollaborators,
++ collaborationLogs,
++ systemSettings,
++ songBlacklists
++} from '~/drizzle/schema'
++import { and, eq, inArray, or } from 'drizzle-orm'
+ import { cacheService } from '~~/server/services/cacheService'
+ import { createSubmissionNoteClearedNotification } from '~~/server/services/notificationService'
++import { moderateSubmissionNote } from '~~/server/utils/submissionNoteAutoModeration'
+
+ export default defineEventHandler(async (event) => {
+ try {
+@@ -122,6 +130,38 @@ export default defineEventHandler(async (event) => {
+ ? body.submissionNote.trim()
+ : null
+ }
++ if ('submissionNotePublic' in body) {
++ const wantPublic = updateData.submissionNote ? body.submissionNotePublic !== false : false
++ updateData.submissionNotePublic = wantPublic
++
++ // 鑷姩瀹℃煡锛堣嫢 systemSettings 鎵撳紑 submissionNoteRequiresApproval锛?+ try {
++ const sysSetRes = await db.select().from(systemSettings).limit(1)
++ const sysSet = sysSetRes[0]
++ if (sysSet?.submissionNoteRequiresApproval && wantPublic && updateData.submissionNote) {
++ const bl = await db
++ .select()
++ .from(songBlacklists)
++ .where(inArray(songBlacklists.type, ['KEYWORD', 'LANGUAGE', 'GENRE']))
++ const mod = moderateSubmissionNote(
++ updateData.submissionNote,
++ wantPublic,
++ true,
++ {
++ title: updateData.title || existingSong.title,
++ artist: updateData.artist || existingSong.artist
++ },
++ bl
++ )
++ updateData.submissionNotePublic = mod.notePublic
++ updateData.submissionNotePublicStatus = mod.publicStatus
++ } else {
++ updateData.submissionNotePublicStatus = null
++ }
++ } catch (err) {
++ console.warn('[Update API] 鎶曠鐣欒█鑷姩瀹℃煡澶辫触锛屼繚鎸佺敤鎴疯缃?', err)
++ }
++ }
+
+ const currentRequesterId = updateData.requesterId || existingSong.requesterId
+
+diff --git a/server/api/songs/add.post.ts b/server/api/songs/add.post.ts
+index ee7850c..b625176 100644
+--- a/server/api/songs/add.post.ts
++++ b/server/api/songs/add.post.ts
+@@ -2,6 +2,7 @@ import { db } from '~/drizzle/db'
+ import { songs, users } from '~/drizzle/schema'
+ import { and, eq, or } from 'drizzle-orm'
+ import { cacheService } from '~~/server/services/cacheService'
++import { normalizeCoverUrl } from '~~/server/utils/url'
+
+ export default defineEventHandler(async (event) => {
+ try {
+@@ -87,6 +88,8 @@ export default defineEventHandler(async (event) => {
+ })
+ }
+
++ const normalizedCover = normalizeCoverUrl(cover, `add-song:${title || ''}`)
++
+ // 鍒涘缓姝屾洸
+ const newSongResult = await db
+ .insert(songs)
+@@ -99,8 +102,8 @@ export default defineEventHandler(async (event) => {
+ musicPlatform: musicPlatform || null,
+ musicId: musicId || null,
+ kgHash: musicPlatform === 'kugou' ? musicId : null,
+- cover: cover || null,
+- coverUrl: cover || null,
++ cover: normalizedCover,
++ coverUrl: normalizedCover,
+ playUrl: playUrl || null
+ })
+ .returning()
+diff --git a/server/api/songs/import.post.ts b/server/api/songs/import.post.ts
+index fb48f03..6224ace 100644
+--- a/server/api/songs/import.post.ts
++++ b/server/api/songs/import.post.ts
+@@ -2,6 +2,7 @@ import { defineEventHandler, createError, readBody } from 'h3'
+ import { db } from '~/drizzle/db'
+ import { songs, semesters, songBlacklists } from '~/drizzle/schema'
+ import { eq, inArray, and, asc } from 'drizzle-orm'
++import { normalizeCoverUrl } from '~~/server/utils/url'
+
+ export default defineEventHandler(async (event) => {
+ const user = event.context.user
+@@ -120,6 +121,8 @@ export default defineEventHandler(async (event) => {
+ continue
+ }
+
++ const normalizedCover = normalizeCoverUrl(song.cover, `import-song:${song.title || ''}`)
++
+ // 3. 鍑嗗鎻掑叆鏁版嵁
+ songsToInsert.push({
+ title: song.title,
+@@ -129,7 +132,8 @@ export default defineEventHandler(async (event) => {
+ playedAt: null,
+ semester: currentSemesterName,
+ preferredPlayTimeId: null, // 閲嶇疆鍋忓ソ鏃堕棿
+- cover: song.cover,
++ cover: normalizedCover,
++ coverUrl: normalizedCover,
+ playUrl: song.playUrl,
+ musicPlatform: song.musicPlatform,
+ musicId: song.musicId,
+diff --git a/server/api/songs/index.get.ts b/server/api/songs/index.get.ts
+index cb817f6..a8274b4 100644
+--- a/server/api/songs/index.get.ts
++++ b/server/api/songs/index.get.ts
+@@ -8,9 +8,10 @@ import {
+ songs,
+ systemSettings,
+ users,
+- votes
++ votes,
++ scheduleSongPool
+ } from '~/drizzle/schema'
+-import { and, asc, count, desc, eq, inArray, like, or } from 'drizzle-orm'
++import { and, asc, count, desc, eq, inArray, like, or, isNull, notInArray } from 'drizzle-orm'
+ import { cacheService } from '~~/server/services/cacheService'
+ import { formatDateTime } from '~/utils/timeUtils'
+ import { maskSongsInfo, MaskableSong, MaskableUser } from '~~/server/utils/studentMask'
+@@ -67,6 +68,7 @@ export default defineEventHandler(async (event) => {
+ const sortBy = (query.sortBy as string) || 'createdAt'
+ const sortOrder = (query.sortOrder as string) || 'desc'
+ const bypassCache = query.bypass_cache === 'true'
++ const usePool = query.use_pool === 'true' || query.usePool === 'true'
+
+ // 鑾峰彇鐢ㄦ埛韬唤
+ const user = event.context.user || null
+@@ -203,6 +205,35 @@ export default defineEventHandler(async (event) => {
+ conditions.push(eq(songs.requesterId, user.id))
+ }
+
++ if (usePool) {
++ const poolRows = await db
++ .select({ songId: scheduleSongPool.songId })
++ .from(scheduleSongPool)
++ .where(
++ and(
++ eq(scheduleSongPool.status, 'PENDING'),
++ isNull(scheduleSongPool.targetPlayDate)
++ )
++ )
++ .groupBy(scheduleSongPool.songId)
++
++ const allScheduledSongIdsQuery = await db
++ .select({ songId: schedules.songId })
++ .from(schedules)
++
++ const scheduledIdsSet = new Set(allScheduledSongIdsQuery.map((r) => r.songId))
++ const candidateFromPool = new Set(
++ poolRows.map((r) => r.songId).filter((id) => !scheduledIdsSet.has(id))
++ )
++
++ if (candidateFromPool.size === 0) {
++ conditions.push(eq(songs.id, -1))
++ } else {
++ conditions.push(inArray(songs.id, Array.from(candidateFromPool)))
++ }
++ conditions.push(eq(songs.played, false))
++ }
++
+ const whereCondition = conditions.length > 0 ? and(...conditions) : undefined
+
+ // 鏌ヨ姝屾洸鎬绘暟
+diff --git a/server/api/songs/public.get.ts b/server/api/songs/public.get.ts
+index 6cd730c..d342e44 100644
+--- a/server/api/songs/public.get.ts
++++ b/server/api/songs/public.get.ts
+@@ -11,7 +11,12 @@ import {
+ users,
+ votes
+ } from '~/drizzle/schema'
+-import { and, count, desc, eq, inArray } from 'drizzle-orm'
++import { and, count, desc, eq, gte, inArray, lt, like, or } from 'drizzle-orm'
++import {
++ resolveScheduleVisibilityRange,
++ isPlayDateInRange,
++ type VisibilitySettingsLike
++} from '~~/server/utils/schedule-visibility'
+ import { cacheService } from '~~/server/services/cacheService'
+ import { executeRedisCommand, isRedisReady } from '../../utils/redis'
+ import { formatDateTime } from '~/utils/timeUtils'
+@@ -38,6 +43,13 @@ export default defineEventHandler(async (event) => {
+ .limit(1)
+ const systemSettingsData = systemSettingsDataResult[0] || null
+ const shouldHideStudentInfo = systemSettingsData?.hideStudentInfo ?? true
++ const visibilitySettings: VisibilitySettingsLike = {
++ scheduleDaysBeforeEnabled: systemSettingsData?.scheduleDaysBeforeEnabled,
++ scheduleDaysBefore: systemSettingsData?.scheduleDaysBefore,
++ scheduleDaysAfterEnabled: systemSettingsData?.scheduleDaysAfterEnabled,
++ scheduleDaysAfter: systemSettingsData?.scheduleDaysAfter
++ }
++ const visibilityRange = resolveScheduleVisibilityRange(visibilitySettings)
+
+ // 鍒濆鍖栫紦瀛樻湇鍔?
+@@ -73,7 +85,14 @@ export default defineEventHandler(async (event) => {
+ })
+
+ if (cachedData) {
+- return cachedData
++ const filtered = visibilityRange.startAt || visibilityRange.endAt
++ ? cachedData.filter((s) => isPlayDateInRange(s.playDate, visibilityRange))
++ : cachedData
++ const resultData = JSON.parse(JSON.stringify(filtered)) as PublicScheduleItem[]
++ if (shouldHideStudentInfo && !isAdmin) {
++ maskPublicScheduleData(resultData)
++ }
++ return resultData
+ }
+ }
+
+@@ -91,6 +110,12 @@ export default defineEventHandler(async (event) => {
+ filteredSchedules = cachedSchedules.filter((s) => s.song?.semester === semester)
+ console.log(`[Cache] 杩囨护瀛︽湡 ${semester} 鍚庣殑鏁伴噺: ${filteredSchedules.length}`)
+ }
++ // 搴旂敤鎺掓湡鍙鑼冨洿杩囨护
++ if (visibilityRange.startAt || visibilityRange.endAt) {
++ filteredSchedules = filteredSchedules.filter((s) =>
++ isPlayDateInRange(s.playDate, visibilityRange)
++ )
++ }
+
+ // 灏嗚繃婊ゅ悗鐨勬暟鎹紦瀛樺埌Redis锛堢紦瀛樺畬鏁存暟鎹紝涓嶈繘琛屾ā绯婂寲锛? if (isRedisReady()) {
+@@ -116,6 +141,13 @@ export default defineEventHandler(async (event) => {
+ }
+
+ // 鑾峰彇鎺掓湡鐨勬瓕鏇诧紝鍖呭惈鎾斁鏃舵淇℃伅锛堟煡璇㈡墍鏈夊鏈熺殑鏁版嵁锛?+ const scheduleWhere: any[] = [eq(schedules.isDraft, false)]
++ if (visibilityRange.startAt) {
++ scheduleWhere.push(gte(schedules.playDate, visibilityRange.startAt)!)
++ }
++ if (visibilityRange.endAt) {
++ scheduleWhere.push(lt(schedules.playDate, visibilityRange.endAt)!)
++ }
+ const schedulesData = await db
+ .select({
+ id: schedules.id,
+@@ -153,10 +185,9 @@ export default defineEventHandler(async (event) => {
+ .leftJoin(songs, eq(schedules.songId, songs.id))
+ .leftJoin(users, eq(songs.requesterId, users.id))
+ .leftJoin(playTimes, eq(schedules.playTimeId, playTimes.id))
+- .where(eq(schedules.isDraft, false)) // 鍙煡璇㈠凡鍙戝竷鐨勬帓鏈?+ .where(and(...scheduleWhere)) // 鍙煡璇㈠凡鍙戝竷鐨勬帓鏈燂紙+鍙鑼冨洿锛? .orderBy(schedules.playDate)
+
+- // 鑾峰彇姣忛姝岀殑鎶曠エ鏁? const voteCountsQuery = await db
+ .select({
+ songId: votes.songId,
+diff --git a/server/api/songs/request.post.ts b/server/api/songs/request.post.ts
+index 632859a..22f9761 100644
+--- a/server/api/songs/request.post.ts
++++ b/server/api/songs/request.post.ts
+@@ -4,14 +4,17 @@ import {
+ playTimes,
+ requestTimes,
+ semesters,
++ songBlacklists,
+ songCollaborators,
+ songs,
+ systemSettings
+ } from '~/drizzle/db'
+-import { and, eq, gt, gte, lt, lte, sql } from 'drizzle-orm'
++import { and, eq, gt, gte, inArray, lt, lte, sql } from 'drizzle-orm'
+ import { createCollaborationInvitationNotification } from '~~/server/services/notificationService'
+ import { isLimitReached } from '~~/server/utils/submissionLimit'
+ import { getBeijingTimeISOString } from '~/utils/timeUtils'
++import { moderateSubmissionNote } from '~~/server/utils/submissionNoteAutoModeration'
++import { normalizeCoverUrl } from '~~/server/utils/url'
+
+ export default defineEventHandler(async (event) => {
+ // 妫€鏌ョ敤鎴疯璇?@@ -132,6 +135,18 @@ export default defineEventHandler(async (event) => {
+ const systemSettingsData = systemSettingsResult[0]
+ const isAdmin = user.role === 'SUPER_ADMIN' || user.role === 'ADMIN'
+
++ // 鍔犺浇鑷姩瀹℃煡闇€瑕佺殑榛戝悕鍗曪紙KEYWORD / LANGUAGE / GENRE锛?+ let moderationBlacklists: any[] = []
++ try {
++ moderationBlacklists = await db
++ .select()
++ .from(songBlacklists)
++ .where(inArray(songBlacklists.type, ['KEYWORD', 'LANGUAGE', 'GENRE']))
++ } catch (err) {
++ console.warn('[Request API] 鍔犺浇鑷姩瀹℃煡榛戝悕鍗曞け璐ワ紝灏嗚烦杩囪嚜鍔ㄥ鏌?', err)
++ moderationBlacklists = []
++ }
++
+ // 1. 妫€鏌ュ己鍒跺叧闂? if (systemSettingsData?.forceBlockAllRequests && !isAdmin) {
+ throw createError({
+@@ -243,8 +258,34 @@ export default defineEventHandler(async (event) => {
+ }
+ const submissionNote =
+ systemSettingsData?.enableSubmissionRemarks && rawSubmissionNote ? rawSubmissionNote : null
+- const submissionNotePublic =
+- submissionNote !== null ? body.submissionNotePublic !== false : false
++ const rawSubmissionNotePublic = submissionNote !== null ? body.submissionNotePublic !== false : false
++ const requiresApproval = Boolean(systemSettingsData?.submissionNoteRequiresApproval)
++
++ let finalSubmissionNotePublic = rawSubmissionNotePublic
++ let submissionNotePublicStatus: string | null = null
++
++ if (submissionNote && rawSubmissionNotePublic && requiresApproval) {
++ const mod = moderateSubmissionNote(
++ submissionNote,
++ rawSubmissionNotePublic,
++ requiresApproval,
++ { title: body.title, artist: body.artist, genre: body.genre || null },
++ moderationBlacklists
++ )
++ finalSubmissionNotePublic = mod.notePublic
++ submissionNotePublicStatus = mod.publicStatus
++ if (mod.rejectedReasons.length > 0) {
++ console.log(
++ `[Request API] 鎶曠鐣欒█鑷姩瀹℃煡鏈€氳繃锛屾瓕鏇?${body.title} - ${body.artist}锛屽師鍥?`,
++ mod.rejectedReasons
++ )
++ }
++ } else if (submissionNote) {
++ // 娌″紑鑷姩瀹℃煡锛屼篃璁板綍涓€涓嬬姸鎬?+ submissionNotePublicStatus = null
++ }
++
++ const submissionNotePublic = finalSubmissionNotePublic
+
+ // 鍑嗗鍙戦€侀€氱煡鐨勫垪琛? const notificationsToSend: { userId: number; songId: number; songTitle: string }[] = []
+@@ -350,6 +391,8 @@ export default defineEventHandler(async (event) => {
+ }
+ }
+
++ const normalizedCover = normalizeCoverUrl(body.cover, `request-song:${body.title || ''}`)
++
+ const songResult = await tx
+ .insert(songs)
+ .values({
+@@ -359,14 +402,15 @@ export default defineEventHandler(async (event) => {
+ requesterId: user.id,
+ preferredPlayTimeId: preferredPlayTime?.id || null,
+ semester: currentSemester, // 浣跨敤澶栭儴鑾峰彇鐨勫鏈熷悕绉?- cover: body.cover || null,
+- coverUrl: body.cover || null,
++ cover: normalizedCover,
++ coverUrl: normalizedCover,
+ musicPlatform: isBilibili ? 'bilibili' : (body.musicPlatform || null),
+ musicId: finalMusicId,
+ kgHash: body.musicPlatform === 'kugou' ? body.musicId : null,
+ playUrl: body.playUrl || null,
+ submissionNote,
+ submissionNotePublic,
++ submissionNotePublicStatus,
+ hitRequestId: hitRequestTime?.id || null,
+ expectedPlayDate: body.expectedPlayDate || null,
+ expectedPlaySequence: body.expectedPlaySequence !== undefined ? Number(body.expectedPlaySequence) : null
+diff --git a/server/config/constants.ts b/server/config/constants.ts
+index daa4c29..f708722 100644
+--- a/server/config/constants.ts
++++ b/server/config/constants.ts
+@@ -180,3 +180,13 @@ export const RISK_CONTROL_CONSTANTS = {
+ SONG_IP_DOMINANCE_PERCENT: 0.6,
+ SONG_IP_MIN_SAMPLE: 8
+ } as const
++
++export const SERVER_ERROR_CODES = {
++ AUTH_UNAUTHORIZED: 'AUTH_UNAUTHORIZED',
++ AUTH_FORBIDDEN: 'AUTH_FORBIDDEN',
++ SONG_NOT_FOUND: 'SONG_NOT_FOUND',
++ SONG_OPERATION_FAILED: 'SONG_OPERATION_FAILED',
++ SONG_BATCH_REJECT_IDS_REQUIRED: 'SONG_BATCH_REJECT_IDS_REQUIRED',
++ SONG_BATCH_REJECT_LIMIT_EXCEEDED: 'SONG_BATCH_REJECT_LIMIT_EXCEEDED',
++ SONG_BATCH_REJECT_REASON_REQUIRED: 'SONG_BATCH_REJECT_REASON_REQUIRED'
++} as const
+diff --git a/server/plugins/sentry.ts b/server/plugins/sentry.ts
+new file mode 100644
+index 0000000..daec8c9
+--- /dev/null
++++ b/server/plugins/sentry.ts
+@@ -0,0 +1,24 @@
++import * as Sentry from '@sentry/node'
++
++export default defineNitroPlugin((nitroApp) => {
++ const config = useRuntimeConfig()
++ const dsn = config.sentry?.serverDsn || config.sentry?.dsn
++
++ if (!dsn) return
++
++ Sentry.init({
++ dsn,
++ environment: config.sentry?.environment || process.env.NODE_ENV || 'production',
++ release: config.sentry?.release || undefined,
++ tracesSampleRate: config.sentry?.errorSampleRate ?? 1.0,
++ sampleRate: config.sentry?.errorSampleRate ?? 1.0
++ })
++
++ nitroApp.hooks.hook('error', (error) => {
++ Sentry.captureException(error)
++ })
++
++ nitroApp.hooks.hook('request', (event) => {
++ event.context.sentry = Sentry
++ })
++})
+diff --git a/server/services/cacheService.ts b/server/services/cacheService.ts
+index 7c91700..c28cbad 100644
+--- a/server/services/cacheService.ts
++++ b/server/services/cacheService.ts
+@@ -16,7 +16,7 @@ const CACHE_TTL = {
+ SONG_COUNT: 180, // 3鍒嗛挓
+ USER_VOTES: 120, // 2鍒嗛挓
+ EMPTY_RESULT: 60, // 1鍒嗛挓锛堢┖缁撴灉缂撳瓨鏃堕棿杈冪煭锛?- SYSTEM_SETTINGS: 3600, // 60鍒嗛挓
++ SYSTEM_SETTINGS: 900, // 15鍒嗛挓锛堟柊鍔熻兘涓婄嚎鍚庨伩鍏?Redis 缂撳瓨鏃?DB 鍊煎鑷翠富棰?鎺掓湡绛夐厤缃け鏁堬級
+ RANDOM_OFFSET: 60, // 闅忔満鍋忕Щ閲忥紝闃叉缂撳瓨闆穿
+ LOCK_TIMEOUT: 30, // 鍒嗗竷寮忛攣瓒呮椂鏃堕棿
+ REFRESH_AHEAD: 60 // 鎻愬墠鍒锋柊鏃堕棿锛堢锛?diff --git a/server/services/cardCodeDeleteService.ts b/server/services/cardCodeDeleteService.ts
+new file mode 100644
+index 0000000..eecbfaf
+--- /dev/null
++++ b/server/services/cardCodeDeleteService.ts
+@@ -0,0 +1,20 @@
++import { inArray } from 'drizzle-orm'
++import { db } from '~/drizzle/db'
++import { cardCodes, cardCodeRedemptions, songs } from '~/drizzle/schema'
++
++export async function deleteCardCodesByIds(ids: number[]) {
++ return await db.transaction(async (tx) => {
++ await tx.update(songs)
++ .set({ cardCodeId: null })
++ .where(inArray(songs.cardCodeId, ids))
++
++ await tx.delete(cardCodeRedemptions)
++ .where(inArray(cardCodeRedemptions.cardCodeId, ids))
++
++ const deleted = await tx.delete(cardCodes)
++ .where(inArray(cardCodes.id, ids))
++ .returning()
++
++ return deleted
++ })
++}
+diff --git a/server/utils/admin-password-policy.ts b/server/utils/admin-password-policy.ts
+new file mode 100644
+index 0000000..9755036
+--- /dev/null
++++ b/server/utils/admin-password-policy.ts
+@@ -0,0 +1,35 @@
++import { PASSWORD_MAX_LENGTH, PASSWORD_MIN_LENGTH } from '~/utils/password-policy'
++
++interface AdminPasswordViolation {
++ code: string
++ message: string
++}
++
++export function getAdminPasswordViolation(password: unknown): AdminPasswordViolation | null {
++ if (typeof password !== 'string' || !password) {
++ return { code: 'AUTH_NEW_PASSWORD_REQUIRED', message: '鏂板瘑鐮佷笉鑳戒负绌? }
++ }
++
++ if (password.length < PASSWORD_MIN_LENGTH) {
++ return {
++ code: 'AUTH_PASSWORD_TOO_SHORT',
++ message: `瀵嗙爜闀垮害涓嶈兘灏戜簬${PASSWORD_MIN_LENGTH}涓瓧绗
++ }
++ }
++
++ if (password.length > PASSWORD_MAX_LENGTH) {
++ return {
++ code: 'AUTH_PASSWORD_TOO_LONG',
++ message: `瀵嗙爜闀垮害涓嶈兘瓒呰繃${PASSWORD_MAX_LENGTH}浣峘
++ }
++ }
++
++ if (new TextEncoder().encode(password).length > 72) {
++ return {
++ code: 'AUTH_PASSWORD_TOO_MANY_BYTES',
++ message: '瀵嗙爜鏈夋晥闀垮害涓嶈兘瓒呰繃72瀛楄妭'
++ }
++ }
++
++ return null
++}
+diff --git a/server/utils/apiError.ts b/server/utils/apiError.ts
+new file mode 100644
+index 0000000..cea7d95
+--- /dev/null
++++ b/server/utils/apiError.ts
+@@ -0,0 +1,15 @@
++import { createError } from 'h3'
++
++export function createApiError(
++ statusCode: number,
++ code: string,
++ message: string,
++ data?: Record
++) {
++ return createError({
++ statusCode,
++ statusMessage: code,
++ message,
++ data: { code, ...(data || {}) }
++ })
++}
+diff --git a/server/utils/auth-route-policy.ts b/server/utils/auth-route-policy.ts
+new file mode 100644
+index 0000000..b0ef35b
+--- /dev/null
++++ b/server/utils/auth-route-policy.ts
+@@ -0,0 +1,99 @@
++type HttpMethod = 'GET' | 'HEAD' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
++
++interface RoutePolicy {
++ path: string
++ methods: readonly HttpMethod[]
++}
++
++const GET_METHODS = ['GET', 'HEAD'] as const
++const WRITE_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'] as const
++
++export const PASSWORD_CHANGE_ALLOWED_ROUTES: readonly RoutePolicy[] = [
++ { path: '/api/auth/verify', methods: GET_METHODS },
++ { path: '/api/auth/logout', methods: ['POST'] },
++ { path: '/api/auth/change-password', methods: ['POST'] },
++ { path: '/api/auth/set-initial-password', methods: ['POST'] },
++ { path: '/api/auth/2fa/verify', methods: ['POST'] },
++ { path: '/api/auth/2fa/send-email', methods: ['POST'] },
++ { path: '/api/site-config', methods: GET_METHODS }
++]
++
++export const PUBLIC_API_EXACT_ROUTES: readonly RoutePolicy[] = [
++ { path: '/api/auth/login', methods: ['POST'] },
++ { path: '/api/auth/register', methods: ['POST'] },
++ { path: '/api/auth/email-code', methods: ['POST'] },
++ { path: '/api/auth/grade-class-options', methods: GET_METHODS },
++ { path: '/api/auth/oauth-register-options', methods: GET_METHODS },
++ { path: '/api/auth/bind', methods: ['POST'] },
++ { path: '/api/auth/oauth-register', methods: ['POST'] },
++ { path: '/api/auth/2fa/verify', methods: ['POST'] },
++ { path: '/api/auth/2fa/send-email', methods: ['POST'] },
++ { path: '/api/auth/forgot-password', methods: ['POST'] },
++ { path: '/api/auth/reset-password', methods: ['POST'] },
++ { path: '/api/auth/captcha', methods: GET_METHODS },
++ { path: '/api/semesters/current', methods: GET_METHODS },
++ { path: '/api/play-times', methods: GET_METHODS },
++ { path: '/api/schedules/public', methods: GET_METHODS },
++ { path: '/api/songs/count', methods: GET_METHODS },
++ { path: '/api/songs/public', methods: GET_METHODS },
++ { path: '/api/site-config', methods: GET_METHODS },
++ { path: '/api/system/location', methods: GET_METHODS },
++ { path: '/api/auth/webauthn/login', methods: ['POST'] },
++ { path: '/api/music/resolve-url', methods: ['POST'] },
++ { path: '/api/music/state', methods: ['POST'] },
++ { path: '/api/music/websocket', methods: GET_METHODS },
++ { path: '/api/sys/time', methods: GET_METHODS }
++]
++
++export const PUBLIC_API_PREFIX_ROUTES: readonly RoutePolicy[] = [
++ { path: '/api/proxy/', methods: GET_METHODS },
++ { path: '/api/api-enhanced/', methods: [...GET_METHODS, ...WRITE_METHODS] },
++ { path: '/api/native-api/', methods: [...GET_METHODS, 'POST'] },
++ { path: '/api/open/', methods: [...GET_METHODS, ...WRITE_METHODS] },
++ { path: '/api/auth/webauthn/login/', methods: ['POST'] }
++]
++
++function matchesMethod(policy: RoutePolicy, method: string): boolean {
++ return policy.methods.includes(method.toUpperCase() as HttpMethod)
++}
++
++export function isPublicApiPath(pathname: string, method: string): boolean {
++ return (
++ PUBLIC_API_EXACT_ROUTES.some(
++ (policy) => pathname === policy.path && matchesMethod(policy, method)
++ ) ||
++ PUBLIC_API_PREFIX_ROUTES.some(
++ (policy) => pathname.startsWith(policy.path) && matchesMethod(policy, method)
++ )
++ )
++}
++
++export function isAllowedDuringPasswordChange(pathname: string, method: string): boolean {
++ return PASSWORD_CHANGE_ALLOWED_ROUTES.some(
++ (policy) => pathname === policy.path && matchesMethod(policy, method)
++ )
++}
++
++export function shouldBlockDuringPasswordChange(
++ pathname: string,
++ method: string,
++ requirePasswordChange: boolean
++): boolean {
++ return (
++ requirePasswordChange &&
++ !isPublicApiPath(pathname, method) &&
++ !isAllowedDuringPasswordChange(pathname, method)
++ )
++}
++
++export function shouldBypassPublicApiAuthentication(
++ pathname: string,
++ method: string,
++ hasToken: boolean
++): boolean {
++ return isPublicApiPath(pathname, method) && !hasToken
++}
++
++export function canBindOAuthIdentity(requirePasswordChange: boolean): boolean {
++ return !requirePasswordChange
++}
+diff --git a/server/utils/card-code-delete-handler.ts b/server/utils/card-code-delete-handler.ts
+new file mode 100644
+index 0000000..682954d
+--- /dev/null
++++ b/server/utils/card-code-delete-handler.ts
+@@ -0,0 +1,68 @@
++import { createError, getQuery, readBody } from 'h3'
++import { z } from 'zod'
++import { deleteCardCodesByIds } from '~~/server/services/cardCodeDeleteService'
++
++const MAX_DELETE_COUNT = 500
++const idSchema = z.preprocess(
++ (value) => (typeof value === 'number' || typeof value === 'string' ? value : undefined),
++ z.coerce.number().int().positive()
++)
++
++const deleteCardCodesSchema = z.object({
++ id: idSchema.optional(),
++ ids: z.preprocess(
++ (value) => {
++ if (typeof value === 'string') {
++ return value.split(',').map((item) => item.trim()).filter(Boolean)
++ }
++ return value
++ },
++ z.array(idSchema).max(MAX_DELETE_COUNT, `鍗曟鏈€澶氬垹闄?${MAX_DELETE_COUNT} 涓偣姝屽埜`).optional()
++ )
++})
++
++export const handleOpenCardCodeDelete = async (event: any) => {
++ const apiKey = event.context.apiKey
++ if (!apiKey) {
++ throw createError({ statusCode: 401, message: 'API璁よ瘉澶辫触' })
++ }
++
++ try {
++ const query = getQuery(event)
++ const body = await readBody(event).catch(() => ({})) ?? {}
++ const validatedData = deleteCardCodesSchema.parse({ ...query, ...body })
++ const rawIds = [
++ ...(validatedData.id !== undefined ? [validatedData.id] : []),
++ ...(validatedData.ids || [])
++ ]
++ const ids = Array.from(new Set(rawIds))
++
++ if (!ids.length) {
++ throw createError({ statusCode: 400, message: '缂哄皯鏈夋晥鐐规瓕鍒窱D' })
++ }
++ if (ids.length > MAX_DELETE_COUNT) {
++ throw createError({ statusCode: 400, message: `鍗曟鏈€澶氬垹闄?${MAX_DELETE_COUNT} 涓偣姝屽埜` })
++ }
++
++ const deletedRows = await deleteCardCodesByIds(ids)
++ return {
++ success: true,
++ message: '鐐规瓕鍒稿垹闄ゆ垚鍔?,
++ data: {
++ cardCodes: deletedRows,
++ deleted: deletedRows.length,
++ requested: ids.length
++ }
++ }
++ } catch (err: any) {
++ if (err.statusCode) throw err
++ if (err.name === 'ZodError') {
++ throw createError({
++ statusCode: 400,
++ message: `璇锋眰鍙傛暟楠岃瘉澶辫触锛?{(err.issues || err.errors).map((issue: any) => issue.message).join(', ')}`
++ })
++ }
++ console.error('寮€鏀続PI鍒犻櫎鐐规瓕鍒稿け璐?, err)
++ throw createError({ statusCode: 500, message: '鍒犻櫎鐐规瓕鍒稿け璐? })
++ }
++}
+diff --git a/server/utils/create-auth-session.ts b/server/utils/create-auth-session.ts
+new file mode 100644
+index 0000000..bd45df1
+--- /dev/null
++++ b/server/utils/create-auth-session.ts
+@@ -0,0 +1,83 @@
++import { getHeader } from 'h3'
++import { db, eq, and } from '~/drizzle/db'
++import { authSessions } from '~/drizzle/schema'
++import { parseUserAgent, type LoginMethod } from './user-agent-info'
++import { getClientIP } from './ip-utils'
++import { randomUUID } from 'node:crypto'
++
++export interface CreateAuthSessionOptions {
++ userId: number
++ jti: string
++ loginMethod: LoginMethod
++ expiresAt?: Date
++ oauthProvider?: string
++}
++
++const DEFAULT_SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000
++
++export async function createAuthSession(
++ event: any,
++ options: CreateAuthSessionOptions
++): Promise {
++ const { userId, jti, loginMethod, oauthProvider } = options
++ const ua = getHeader(event, 'user-agent')
++ const { browser, operatingSystem, device } = parseUserAgent(ua)
++ const ip = getClientIP(event)
++ const now = new Date()
++ const expiresAt = options.expiresAt ?? new Date(now.getTime() + DEFAULT_SESSION_TTL_MS)
++
++ try {
++ let method = loginMethod
++ if (oauthProvider && method === 'oauth') {
++ method = `oauth:${oauthProvider}` as any
++ }
++
++ await db.insert(authSessions).values({
++ id: randomUUID(),
++ userId,
++ sessionToken: jti,
++ browser,
++ operatingSystem,
++ device,
++ loginMethod: method,
++ ipAddress: ip,
++ userAgent: ua ?? null,
++ createdAt: now,
++ lastActiveAt: now,
++ expiresAt,
++ isRevoked: false
++ })
++ } catch (error) {
++ console.warn('[AuthSession] 鍒涘缓浼氳瘽澶辫触锛岀户缁棤浼氳瘽鐧诲綍:', error)
++ }
++
++ return jti
++}
++
++export async function isSessionRevokedByJti(jti: string | undefined): Promise {
++ if (!jti) return false
++ try {
++ const row = await db.query.authSessions.findFirst({
++ where: and(eq(authSessions.sessionToken, jti)),
++ columns: { isRevoked: true, expiresAt: true }
++ })
++ if (!row) return false
++ if (row.expiresAt && row.expiresAt.getTime() < Date.now()) return true
++ return Boolean(row.isRevoked)
++ } catch (error) {
++ console.warn('[AuthSession] 浼氳瘽鐘舵€佹牎楠屽け璐ワ紝榛樿鏀捐:', error)
++ return false
++ }
++}
++
++export async function touchAuthSession(jti: string | undefined): Promise {
++ if (!jti) return
++ try {
++ await db
++ .update(authSessions)
++ .set({ lastActiveAt: new Date() })
++ .where(eq(authSessions.sessionToken, jti))
++ } catch (_error) {
++ // ignore
++ }
++}
+diff --git a/server/utils/email-verification.ts b/server/utils/email-verification.ts
+new file mode 100644
+index 0000000..d649217
+--- /dev/null
++++ b/server/utils/email-verification.ts
+@@ -0,0 +1,171 @@
++import { randomInt, timingSafeEqual } from 'node:crypto'
++import { getServerTimestamp } from '~~/server/utils/serverTime'
++import { getRedisClient, buildRedisKey } from '~~/server/utils/redis'
++
++const EMAIL_CODE_TTL_MS = 5 * 60 * 1000
++const EMAIL_CODE_COOLDOWN_MS = 60 * 1000
++const EMAIL_CODE_MAX_ATTEMPTS = 5
++const EMAIL_CODE_DAILY_LIMIT = 5
++const EMAIL_CODE_DAILY_WINDOW_MS = 24 * 60 * 60 * 1000
++
++type EmailCodeEntry = {
++ code: string
++ expiresAt: number
++ createdAt: number
++ attempts: number
++}
++
++const emailCodes = new Map()
++const dailySendCounts = new Map()
++
++const normalizeEmail = (email: string) => email.trim().toLowerCase()
++
++const getDayKey = () => {
++ const now = new Date(getServerTimestamp())
++ return `${now.getUTCFullYear()}-${now.getUTCMonth() + 1}-${now.getUTCDate()}`
++}
++
++const codeRedisKey = (email: string) => buildRedisKey('email-code', 'code', normalizeEmail(email))
++const attemptsRedisKey = (email: string) => buildRedisKey('email-code', 'attempts', normalizeEmail(email))
++const cooldownRedisKey = (email: string) => buildRedisKey('email-code', 'cooldown', normalizeEmail(email))
++const dailyRedisKey = (email: string) => buildRedisKey('email-code', 'daily', normalizeEmail(email), getDayKey())
++
++const VERIFY_EMAIL_CODE_SCRIPT = `
++local stored = redis.call('GET', KEYS[1])
++if not stored then
++ return { 0, 0 }
++end
++local attempts = redis.call('INCR', KEYS[2])
++if attempts == 1 then
++ redis.call('EXPIRE', KEYS[2], 300)
++end
++if ARGV[1] == stored then
++ redis.call('DEL', KEYS[1], KEYS[2])
++ return { 1, attempts }
++end
++if attempts >= tonumber(ARGV[2]) then
++ redis.call('DEL', KEYS[1], KEYS[2])
++ return { 2, attempts }
++end
++return { 0, attempts }
++`
++
++const safeCodeEqual = (a: string, b: string): boolean => {
++ if (a.length !== b.length) return false
++ return timingSafeEqual(Buffer.from(a), Buffer.from(b))
++}
++
++export function generateEmailCode(): string {
++ return String(randomInt(100000, 1000000))
++}
++
++export async function storeEmailCode(email: string, code: string): Promise {
++ const normalized = normalizeEmail(email)
++ const now = getServerTimestamp()
++ emailCodes.set(normalized, {
++ code,
++ expiresAt: now + EMAIL_CODE_TTL_MS,
++ createdAt: now,
++ attempts: 0
++ })
++
++ const dayKey = getDayKey()
++ const record = dailySendCounts.get(normalized)
++ if (!record || record.dayKey !== dayKey) {
++ dailySendCounts.set(normalized, { count: 1, dayKey })
++ } else {
++ record.count++
++ }
++
++ let client: Awaited 
+
+ ```
+- **同步规则**：新增主题时需在 `app/assets/css/themes/` 下创建对应的 CSS 文件，**同时**在 `public/themes/` 下创建对应的图片目录并放入 SVG 文件。如果只新增 CSS 主题而未同步图片，组件将无法加载主题图片。
+
+#### 自定义主题
+
+如需新增自定义主题：
+
+1. 在 `app/assets/css/themes/` 下创建新主题，如 `ocean.css`，使用 `:root[data-theme="ocean"]` 作为根选择器定义所有设计变量
+3. 在 `app/assets/css/main.css` 中添加对应的 `@import` 语句
+4. 在 `app/composables/useTheme.ts` 中将新主题 ID 加入 `Theme` 类型和 `THEMES` 数组
+5. 在 `public/themes/` 下创建对应主题的 SVG 图片文件夹（如 `public/themes/ocean/`），**放入与 `ClassicDark/` 和 `ClassicLight/` 相同的 SVG 图片**，否则使用该主题时组件无法加载主题图片。
+
+## 使用说明
+
+### 普通用户
+
+1. 访问主页，查看当前排期
+2. 注册/登录账号
+3. 在仪表盘中点歌或给喜欢的歌曲投票
+ - 支持搜索网易云音乐、QQ音乐和哔哩哔哩平台
+ - 可以试听歌曲并选择音质
+ - 支持给已有歌曲投票
+ - **网易云音乐登录功能**：
+ - 扫码登录网易云音乐账号
+ - 登录后可一键添加当前排期歌曲到个人歌单
+ - 支持从个人歌单中直接投稿歌曲
+ - 支持从最近播放记录中投稿歌曲
+ - 可搜索并投稿播客和电台内容
+4. 使用内置播放器播放歌曲
+ - 支持多种音质切换（标准、HQ、无损、Hi-Res等）
+ - 实时切换音质并保持播放进度
+5. 查看通知中心获取歌曲状态更新
+
+### 管理员
+
+1. 使用管理员账号登录（默认账号：admin，密码：admin123）
+2. 进入管理后台，选择相应功能标签
+3. **排期管理**：可以看到左侧"待排歌曲"和右侧"播放顺序"
+ - 通过拖拽将歌曲从左侧添加到右侧的排期列表
+ - 可以在右侧拖拽调整歌曲播放顺序
+ - 支持播出时段管理，可设置不同时段的播放安排
+ - **草稿功能**：支持保存排期草稿，允许管理员先保存未完成的排期安排
+ - 点击"保存草稿"按钮保存当前排期为草稿状态
+ - 草稿不会影响公开展示的排期，可以随时修改
+ - 点击"保存并发布"按钮将草稿发布为正式排期
+ - 点击"保存顺序"按钮保存排期
+4. **打印排期**：专业的排期打印和导出功能
+ - 选择纸张大小（A4、A3、Letter、Legal）和页面方向
+ - 自定义显示内容：歌曲封面、歌名、歌手、投稿人、热度等
+ - 快捷日期选择：今天、明天、本周、下周
+ - 智能分组显示：按日期分组，有多个播出时段时自动按时间排序
+ - 实时预览：所见即所得的打印预览
+ - PDF导出：支持导出高质量PDF文件，自动处理跨域图片
+5. **歌曲管理**：查看和管理所有歌曲
+ - 支持播放歌曲并实时切换音质
+ - 动态获取最新的音乐播放链接
+ - 提供歌曲下载功能，支持批量下载管理
+ - 批量更新歌曲信息和状态
+6. **数据分析**：查看系统使用统计和数据分析
+ - 实时统计数据：用户活跃度、歌曲热度、投票趋势
+ - 学期对比分析：不同学期的数据对比
+ - 用户参与度分析：用户行为和参与度统计
+ - 趋势分析：系统使用趋势和预测
+7. **数据库管理**：数据库备份恢复和维护
+ - 创建和下载数据库备份
+ - 上传和恢复备份文件
+ - 序列重置：修复数据库序列问题
+ - 数据库状态检查和完整性验证
+8. **学期管理**：设置和管理学期信息
+ - 创建新学期（如"2024-2025学年上学期"）
+ - 设置当前活跃学期
+ - 点歌记录自动关联到当前学期
+9. **用户管理**：添加、编辑和删除用户
+ - 单个添加：填写用户信息（包括姓名、账号、年级、班级）
+ - 批量导入：通过EXCEL文件批量添加用户
+ - 可以重置用户密码
+10. **黑名单管理**：管理歌曲和关键词黑名单
+ - 添加具体歌曲或关键词到黑名单
+ - 自动过滤包含黑名单内容的点歌请求
+ - 支持启用/禁用黑名单项
+11. **系统设置**：配置系统参数和功能开关
+ - 站点信息配置：标题、Logo、描述等
+ - 投稿限额设置：每日/每周投稿限制
+ - 播出时段管理：配置不同的播出时间段
+ - 功能开关：启用/禁用特定功能
+12. **通知管理**：向用户发送系统通知
+ - 支持按全体用户、年级、班级或多班级发送
+ - 实时显示发送进度和结果
+ - 通知历史记录和管理
+
+## 数据库管理
+
+### Drizzle ORM + Neon Database
+
+项目使用 Drizzle ORM 作为数据库 ORM，配合 Neon Database 提供现代化的数据库解决方案。
+
+#### 核心文件结构
+
+- **`drizzle.config.ts`** - Drizzle ORM 主配置文件
+- **`app/drizzle/db.ts`** - 数据库连接和客户端配置
+- **`app/drizzle/schema.ts`** - 数据库表结构定义（TypeScript 类型安全）
+- **`app/drizzle/migrations/`** - 数据库迁移脚本目录
+
+### 数据库初始化
+
+首次部署时，系统会自动初始化数据库结构。
+
+#### 自动初始化（推荐）
+
+使用部署脚本自动完成数据库初始化：
+
+```bash
+pnpm run deploy
+```
+
+该命令会：
+
+1. 检查环境变量配置
+2. 安装依赖
+3. 执行数据库迁移
+4. 创建默认管理员账户
+5. 构建应用
+
+#### 手动初始化
+
+如需手动管理数据库：
+
+1. 生成迁移文件
+
+```bash
+pnpm run db:generate
+```
+
+2. 执行数据库迁移
+
+```bash
+pnpm run db:migrate
+```
+
+3. 推送模式变更到数据库（开发环境）
+
+```bash
+pnpm run db:push
+```
+
+4. 启动 Drizzle Studio（数据库管理界面）
+
+```bash
+pnpm run db:studio
+```
+
+访问 https://local.drizzle.studio 查看和管理数据库
+
+5. 清空数据库并创建管理员
+
+```bash
+pnpm run clear-db
+```
+
+### 数据库备份与恢复
+
+#### 通过管理后台
+
+1. 创建备份
+ - 登录管理后台
+ - 进入"数据库管理"页面
+ - 点击"创建备份"按钮
+ - 选择备份类型（完整备份/用户数据备份）
+
+2. 下载备份
+ - 备份完成后在列表中找到备份文件
+ - 点击"下载"按钮保存到本地
+
+3. 恢复备份
+ - 点击"上传备份"按钮
+ - 选择备份文件
+ - 选择恢复模式：
+ - 增量恢复：合并备份数据与现有数据
+ - 完全恢复：替换所有现有数据（谨慎使用）
+ - 确认并执行恢复
+
+#### 使用 PostgreSQL 命令行
+
+```bash
+# 备份数据库
+pg_dump -h localhost -U username -d database_name > backup.sql
+
+# 恢复数据库
+psql -h localhost -U username -d database_name < backup.sql
+```
+
+### 备份文件格式
+
+- **完整备份**：包含所有数据表的 JSON 格式文件
+- **用户备份**：仅包含用户相关数据
+- **元数据**：包含创建时间、创建者、表信息等
+
+## 开发指南
+
+### 组合式API
+
+项目使用了Vue 3的组合式API，主要包括：
+
+- `useAuth`: 处理用户认证、登录、注册和权限控制
+- `useSongs`: 处理歌曲相关操作，包括获取歌曲列表、点歌和投票
+- `useAdmin`: 处理管理员操作，包括排期管理和标记播放
+- `useNotifications`: 处理通知系统，包括获取、标记已读和设置
+- `useAudioQuality`: 处理音质管理，包括音质设置和持久化
+- `useSemesters`: 处理学期管理，包括创建学期和设置活跃学期
+
+### 添加新功能
+
+1. 在 `server/api` 中添加新的API端点
+2. 在 `app/composables` 中添加相应的组合式函数
+3. 在 `app/components` 中创建UI组件
+4. 在 `app/pages` 中整合组件和功能
+
+### 数据库模型修改
+
+如需修改数据库模型：
+
+1. 编辑`app/drizzle/schema.ts`文件中的表结构定义
+2. 生成新的迁移文件：`pnpm run db:generate`
+3. 应用迁移到数据库：`pnpm run db:migrate`
+4. 确保同时更新 `types/index.ts` 中的TypeScript类型定义
+5. 使用Drizzle Studio查看数据库：`pnpm run db:studio`
+
+### 国际化 (i18n)
+
+VoiceHub 内置一套无第三方依赖的手写国际化方案，支持 `zh-CN`（简体中文）与 `en-US`（English）两种语言。
+
+#### 架构概览
+
+- **词典文件**：`app/utils/locale/zh-CN.ts`、`app/utils/locale/en-US.ts`。两者结构必须完全一致（键对齐），值可为字符串、带 `{0}`/`{1}` 占位符的模板或格式化函数。
+- **运行时**：`app/utils/locale/index.ts` 提供 `useLocale()`、`setLocale()`、`loadLocaleMessages()` 等。
+ - 中文（`FALLBACK_LOCALE`）作为**兜底与合并基底静态内置**；其余语言在被激活时才**动态按需加载**，默认语言用户不会下载多余语言包。
+ - `mergeLocaleFallback` 保证非兜底语言缺失某键时自动回退中文，不会出现空文本。
+ - 当前语言用 `useState('voicehub-locale')` 存储，**SSR 下按请求隔离**，避免跨请求语言串扰。
+- **初始化插件**：`app/plugins/locale.ts`（服务端 + 客户端通用）。仅当用户手动选择过语言（`manual` 偏好）时信任 `cookie`，否则每次进入按 `Accept-Language` / 浏览器语言**跟随系统语言**，系统语言变化后自动切换；手动选择长期保留。渲染前 `await` 目标语言词典以消除首屏闪烁与水合不匹配，并驱动 ``。
+
+#### 组件中使用
+
+```js
+// 取带兜底的响应式文案分区
+const { pages, songs } = useLocale()
+const locale = computed(() => pages.value?.forgotPassword || {})
+
+// 键查找 + {0}/{count} 占位符替换（复用共享助手，勿自行实现）
+const { t } = useLocaleText(locale)
+t('title')
+```
+
+- 文案访问统一复用 `~/composables/useLocaleText.ts`（`t`/`msg`/`nested`/`format`）与 `~/composables/useSafeLocale.ts`，**禁止**在组件内重复实现 `callLocale`、`getNestedMessage` 等私有取值函数。
+- 新增文案键时，**必须同时在 `zh-CN.ts` 和 `en-US.ts` 添加**，保持键结构完全一致。
+
+#### 服务端错误码本地化
+
+服务端错误消息与语言解耦，通过「稳定错误码 + 客户端词典」实现本地化：
+
+1. 服务端抛错使用 `createApiError`（`server/utils/apiError.ts`）而非裸 `createError`：
+
+ ```ts
+ import { createApiError } from '~~/server/utils/apiError'
+ // createApiError(statusCode, code, message, data?)
+ throw createApiError(429, 'AUTH_RATE_LIMITED_MINUTES', '操作过于频繁，请等待 ${waitMinutes} 分钟后再试', { params: [waitMinutes] })
+ ```
+
+ - `code` 建议取自 `server/config/constants.ts` 的 `SERVER_ERROR_CODES`；同时写入 `statusMessage` 与 `data.code`。
+ - `message` 为默认兜底文案（词典未命中时展示），动态值用 `data.params` 承载。
+2. 客户端统一用 `useServerErrors().localize(err, fallback)` 展示错误：按 `err.data.code` 命中 `serverErrors` 词典，用 `data.params` 替换 `{0}`/`{1}`，未命中再回退服务端 `message`。
+3. 新增错误码需在**三处同步**：`SERVER_ERROR_CODES`、`zh-CN.ts` 的 `serverErrors`、`en-US.ts` 的 `serverErrors`（键完全对齐）。
+
+### OAuth 平台扩展指南
+
+VoiceHub 采用配置化与策略模式（Strategy Pattern）相结合的灵活 OAuth 扩展机制，所有 OAuth 提供商及认证设置现均已迁移至管理员后台界面。你可以直接在后台动态配置，无需修改环境变量和重启服务。
+
+对于想要通过代码深度定制 OAuth 行为（如自定义用户信息解析逻辑等）的开发者，可参考以下机制：
+
+#### 扩展步骤
+
+##### 1. 定义 OAuth 策略
+
+在 `server/utils/oauth-strategies.ts` 文件中，实现 `OAuthStrategy` 接口。该接口定义了 OAuth 流程中的三个核心方法：
+
+```typescript
+export interface OAuthStrategy {
+ /**
+ * 获取授权跳转 URL
+ * @param redirectUri 回调地址（通常是 /api/auth/[provider]/callback）
+ * @param state 包含安全校验信息的加密字符串
+ */
+ getAuthorizeUrl(redirectUri: string, state: string): string
+
+ /**
+ * 使用 code 换取 access_token
+ * @param code 授权码
+ * @param redirectUri 回调地址
+ */
+ exchangeToken(code: string, redirectUri: string): Promise
+
diff --git a/app/components/Auth/Providers/GitHub/Icon.vue b/app/components/Auth/Providers/GitHub/Icon.vue
new file mode 100644
index 0000000..80bc99e
--- /dev/null
+++ b/app/components/Auth/Providers/GitHub/Icon.vue
@@ -0,0 +1,13 @@
+
+
+
diff --git a/app/components/Auth/Providers/Google/Icon.vue b/app/components/Auth/Providers/Google/Icon.vue
new file mode 100644
index 0000000..7747b02
--- /dev/null
+++ b/app/components/Auth/Providers/Google/Icon.vue
@@ -0,0 +1,22 @@
+
+
+
diff --git a/app/components/Auth/TurnstileWidget.vue b/app/components/Auth/TurnstileWidget.vue
new file mode 100644
index 0000000..fd41671
--- /dev/null
+++ b/app/components/Auth/TurnstileWidget.vue
@@ -0,0 +1,109 @@
+
+ 
+ 
+