feat: 初始化慧遇书院官网一期

server/api/admin/audit.get.ts

@@ -0,0 +1,13 @@
+import { requireAdmin } from '../../utils/auth'
+import { useDatabase } from '../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+  const rows = useDatabase().prepare(`
+    SELECT audit_logs.id, audit_logs.action, audit_logs.entity_type, audit_logs.entity_key,
+      audit_logs.ip_address, audit_logs.created_at, admin_users.display_name
+    FROM audit_logs LEFT JOIN admin_users ON admin_users.id = audit_logs.operator_id
+    ORDER BY audit_logs.id DESC LIMIT 50
+  `).all() as Array<Record<string, string | number | null>>
+  return { data: rows.map(row => ({ id: row.id, action: row.action, entityType: row.entity_type, entityKey: row.entity_key, ipAddress: row.ip_address, createdAt: row.created_at, operator: row.display_name || '系统' })) }
+})

server/api/admin/media.post.ts

@@ -0,0 +1,81 @@
+import { randomUUID } from 'node:crypto'
+import { mkdir, rm, writeFile } from 'node:fs/promises'
+import { extname } from 'node:path'
+import sharp from 'sharp'
+import { z } from 'zod'
+import { mediaUrl, safeUploadPath, serializeMedia, type MediaAssetRow } from '../../utils/media'
+import { useDatabase } from '../../utils/db'
+
+const allowedTypes = {
+  'image/jpeg': { extension: '.jpg', inputExtensions: ['.jpg', '.jpeg'] },
+  'image/png': { extension: '.png', inputExtensions: ['.png'] },
+  'image/webp': { extension: '.webp', inputExtensions: ['.webp'] },
+} as const
+
+const metadataSchema = z.object({
+  altText: z.string().trim().max(160).default(''),
+  source: z.string().trim().max(200).default(''),
+  copyright: z.string().trim().max(200).default(''),
+  authorizationStatus: z.enum(['pending', 'authorized', 'restricted']).default('pending'),
+})
+
+function detectImageType(data: Buffer) {
+  if (data.length >= 3 && data[0] === 0xff && data[1] === 0xd8 && data[2] === 0xff) return 'image/jpeg'
+  if (data.length >= 8 && data.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) return 'image/png'
+  if (data.length >= 12 && data.toString('ascii', 0, 4) === 'RIFF' && data.toString('ascii', 8, 12) === 'WEBP') return 'image/webp'
+}
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const parts = await readMultipartFormData(event)
+  const file = parts?.find(part => part.name === 'file' && part.filename)
+  if (!file?.data?.length) throw createError({ statusCode: 400, statusMessage: '请选择图片文件' })
+  if (file.data.length > 8 * 1024 * 1024) throw createError({ statusCode: 413, statusMessage: '单张图片不能超过 8MB' })
+
+  const detectedType = detectImageType(file.data)
+  if (!detectedType || !(detectedType in allowedTypes)) throw createError({ statusCode: 415, statusMessage: '仅支持 JPG、PNG、WebP 图片' })
+  const typeConfig = allowedTypes[detectedType as keyof typeof allowedTypes]
+  const inputExtension = extname(file.filename || '').toLowerCase()
+  if (!typeConfig.inputExtensions.includes(inputExtension as never)) throw createError({ statusCode: 415, statusMessage: '文件扩展名与实际图片类型不一致' })
+
+  let imageMetadata
+  try { imageMetadata = await sharp(file.data, { limitInputPixels: 40_000_000 }).metadata() }
+  catch { throw createError({ statusCode: 415, statusMessage: '图片内容损坏或无法解析' }) }
+  const width = imageMetadata.width || 0
+  const height = imageMetadata.height || 0
+  if (!width || !height || width > 10_000 || height > 10_000 || width * height > 40_000_000) {
+    throw createError({ statusCode: 413, statusMessage: '图片尺寸不能超过 10000×10000 或 4000 万像素' })
+  }
+
+  const fields = Object.fromEntries((parts || []).filter(part => !part.filename && part.name).map(part => [part.name!, part.data.toString('utf8')]))
+  const metadata = metadataSchema.parse(fields)
+  const now = new Date()
+  const dateDir = `${now.getUTCFullYear()}/${String(now.getUTCMonth() + 1).padStart(2, '0')}`
+  const assetKey = randomUUID()
+  const originalPath = `original/${dateDir}/${assetKey}${typeConfig.extension}`
+  const derivedPath = `derived/${dateDir}/${assetKey}-large.webp`
+  const thumbnailPath = `derived/${dateDir}/${assetKey}-thumb.webp`
+  const writtenPaths = [originalPath, derivedPath, thumbnailPath]
+
+  await Promise.all(writtenPaths.map(path => mkdir(safeUploadPath(path).replace(/\/[^/]+$/, ''), { recursive: true })))
+  try {
+    await writeFile(safeUploadPath(originalPath), file.data, { flag: 'wx' })
+    await sharp(file.data).rotate().resize({ width: 2400, height: 2400, fit: 'inside', withoutEnlargement: true }).webp({ quality: 84 }).toFile(safeUploadPath(derivedPath))
+    await sharp(file.data).rotate().resize({ width: 480, height: 480, fit: 'inside', withoutEnlargement: true }).webp({ quality: 78 }).toFile(safeUploadPath(thumbnailPath))
+
+    const timestamp = now.toISOString()
+    const db = useDatabase()
+    const row = db.transaction(() => {
+      const result = db.prepare(`
+        INSERT INTO media_assets (asset_key, original_name, mime_type, extension, bytes, width, height, original_path, derived_path, thumbnail_path, alt_text, source_text, copyright_text, authorization_status, status, created_by, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 'active', ?, ?, ?)
+      `).run(assetKey, file.filename, detectedType, typeConfig.extension, file.data.length, width, height, originalPath, derivedPath, thumbnailPath, metadata.altText, metadata.source, metadata.copyright, metadata.authorizationStatus, user.id, timestamp, timestamp)
+      writeAuditLog(event, { operatorId: user.id, action: 'media.upload', entityType: 'media', entityKey: assetKey, metadata: { originalName: file.filename, bytes: file.data.length, width, height, derivedUrl: mediaUrl(derivedPath) } })
+      return db.prepare('SELECT * FROM media_assets WHERE id = ?').get(result.lastInsertRowid) as MediaAssetRow
+    })()
+    return { url: mediaUrl(derivedPath), media: serializeMedia(row) }
+  } catch (error) {
+    await Promise.all(writtenPaths.map(path => rm(safeUploadPath(path), { force: true })))
+    throw error
+  }
+})

server/api/admin/media/[id].delete.ts

@@ -0,0 +1,17 @@
+import { isMediaReferenced, moveMediaFiles, serializeMedia, type MediaAssetRow } from '../../../utils/media'
+import { useDatabase } from '../../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const id = Number(getRouterParam(event, 'id'))
+  if (!Number.isSafeInteger(id) || id < 1) throw createError({ statusCode: 400, statusMessage: '无效的素材编号' })
+  const db = useDatabase()
+  const row = db.prepare("SELECT * FROM media_assets WHERE id = ? AND status = 'active'").get(id) as MediaAssetRow | undefined
+  if (!row) throw createError({ statusCode: 404, statusMessage: '素材不存在' })
+  if (isMediaReferenced(db, row)) throw createError({ statusCode: 409, statusMessage: '素材正在被草稿或已发布页面引用，不能删除' })
+  await moveMediaFiles(row, 'trash')
+  const timestamp = new Date().toISOString()
+  db.prepare("UPDATE media_assets SET status = 'trash', deleted_at = ?, updated_at = ? WHERE id = ?").run(timestamp, timestamp, id)
+  writeAuditLog(event, { operatorId: user.id, action: 'media.trash', entityType: 'media', entityKey: row.asset_key })
+  return { data: serializeMedia({ ...row, status: 'trash', deleted_at: timestamp, updated_at: timestamp }) }
+})

server/api/admin/media/[id].patch.ts

@@ -0,0 +1,25 @@
+import { z } from 'zod'
+import { serializeMedia, type MediaAssetRow } from '../../../utils/media'
+import { useDatabase } from '../../../utils/db'
+
+const updateSchema = z.object({
+  altText: z.string().trim().max(160),
+  source: z.string().trim().max(200),
+  copyright: z.string().trim().max(200),
+  authorizationStatus: z.enum(['pending', 'authorized', 'restricted']),
+})
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const id = Number(getRouterParam(event, 'id'))
+  if (!Number.isSafeInteger(id) || id < 1) throw createError({ statusCode: 400, statusMessage: '无效的素材编号' })
+  const input = updateSchema.parse(await readBody(event))
+  const db = useDatabase()
+  const timestamp = new Date().toISOString()
+  const result = db.prepare(`UPDATE media_assets SET alt_text = ?, source_text = ?, copyright_text = ?, authorization_status = ?, updated_at = ? WHERE id = ? AND status = 'active'`)
+    .run(input.altText, input.source, input.copyright, input.authorizationStatus, timestamp, id)
+  if (!result.changes) throw createError({ statusCode: 404, statusMessage: '素材不存在' })
+  const row = db.prepare('SELECT * FROM media_assets WHERE id = ?').get(id) as MediaAssetRow
+  writeAuditLog(event, { operatorId: user.id, action: 'media.update', entityType: 'media', entityKey: row.asset_key })
+  return { data: serializeMedia(row) }
+})

server/api/admin/media/[id]/restore.post.ts

@@ -0,0 +1,16 @@
+import { moveMediaFiles, serializeMedia, type MediaAssetRow } from '../../../../utils/media'
+import { useDatabase } from '../../../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const id = Number(getRouterParam(event, 'id'))
+  if (!Number.isSafeInteger(id) || id < 1) throw createError({ statusCode: 400, statusMessage: '无效的素材编号' })
+  const db = useDatabase()
+  const row = db.prepare("SELECT * FROM media_assets WHERE id = ? AND status = 'trash'").get(id) as MediaAssetRow | undefined
+  if (!row) throw createError({ statusCode: 404, statusMessage: '回收站中不存在该素材' })
+  await moveMediaFiles(row, 'restore')
+  const timestamp = new Date().toISOString()
+  db.prepare("UPDATE media_assets SET status = 'active', deleted_at = NULL, updated_at = ? WHERE id = ?").run(timestamp, id)
+  writeAuditLog(event, { operatorId: user.id, action: 'media.restore', entityType: 'media', entityKey: row.asset_key })
+  return { data: serializeMedia({ ...row, status: 'active', deleted_at: null, updated_at: timestamp }) }
+})

server/api/admin/media/index.get.ts

@@ -0,0 +1,11 @@
+import { isMediaReferenced, serializeMedia, type MediaAssetRow } from '../../../utils/media'
+import { useDatabase } from '../../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+  const query = getQuery(event)
+  const status = query.status === 'trash' ? 'trash' : 'active'
+  const db = useDatabase()
+  const rows = db.prepare('SELECT * FROM media_assets WHERE status = ? ORDER BY created_at DESC LIMIT 200').all(status) as MediaAssetRow[]
+  return { data: rows.map(row => serializeMedia(row, isMediaReferenced(db, row))) }
+})

server/api/admin/site/index.get.ts

@@ -0,0 +1,7 @@
+import { requireAdmin } from '../../../utils/auth'
+import { readSiteDocument } from '../../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+  return readSiteDocument('draft')
+})

server/api/admin/site/index.put.ts

@@ -0,0 +1,19 @@
+import { requireAdmin } from '../../../utils/auth'
+import { writeAuditLog } from '../../../utils/audit'
+import { useDatabase } from '../../../utils/db'
+import { siteDocumentSchema } from '../../../utils/site-schema'
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const parsed = siteDocumentSchema.safeParse(await readBody(event))
+  if (!parsed.success) {
+    throw createError({ statusCode: 422, statusMessage: '内容校验失败', data: { issues: parsed.error.issues } })
+  }
+  const document = parsed.data
+  const timestamp = new Date().toISOString()
+  const db = useDatabase()
+  db.prepare('UPDATE site_documents SET draft_json = ?, updated_by = ?, updated_at = ? WHERE document_key = ?')
+    .run(JSON.stringify(document), user.id, timestamp, 'website')
+  writeAuditLog(event, { operatorId: user.id, action: 'save_draft', entityType: 'site_document', entityKey: 'website' })
+  return { data: document, updatedAt: timestamp }
+})

server/api/admin/site/publish.post.ts

@@ -0,0 +1,35 @@
+import { requireAdmin } from '../../../utils/auth'
+import { writeAuditLog } from '../../../utils/audit'
+import { useDatabase } from '../../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const db = useDatabase()
+  const timestamp = new Date().toISOString()
+
+  const publish = db.transaction(() => {
+    const row = db.prepare('SELECT draft_json FROM site_documents WHERE document_key = ?').get('website') as { draft_json: string }
+    const versionRow = db.prepare(`
+      SELECT COALESCE(MAX(version), 0) + 1 AS version FROM revisions
+      WHERE entity_type = ? AND entity_key = ?
+    `).get('site_document', 'website') as { version: number }
+    db.prepare(`
+      INSERT INTO revisions (entity_type, entity_key, version, snapshot_json, operator_id, action, created_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `).run('site_document', 'website', versionRow.version, row.draft_json, user.id, 'publish', timestamp)
+    db.prepare(`
+      UPDATE site_documents SET published_json = draft_json, updated_by = ?, updated_at = ?, published_at = ?
+      WHERE document_key = ?
+    `).run(user.id, timestamp, timestamp, 'website')
+    db.prepare(`
+      DELETE FROM revisions WHERE entity_type = ? AND entity_key = ? AND id NOT IN (
+        SELECT id FROM revisions WHERE entity_type = ? AND entity_key = ? ORDER BY version DESC LIMIT 20
+      )
+    `).run('site_document', 'website', 'site_document', 'website')
+    return versionRow.version
+  })
+
+  const version = publish()
+  writeAuditLog(event, { operatorId: user.id, action: 'publish', entityType: 'site_document', entityKey: 'website', metadata: { version } })
+  return { success: true, publishedAt: timestamp, version }
+})

server/api/admin/site/revisions.get.ts

@@ -0,0 +1,11 @@
+import { useDatabase } from '../../../utils/db'
+
+export default defineEventHandler(async (event) => {
+  await requireAdmin(event)
+  const rows = useDatabase().prepare(`
+    SELECT version, action, comment, created_at AS createdAt
+    FROM revisions WHERE entity_type = 'site_document' AND entity_key = 'website'
+    ORDER BY version DESC LIMIT 20
+  `).all() as Array<{ version: number; action: string; comment: string | null; createdAt: string }>
+  return { data: rows }
+})

server/api/admin/site/revisions/[version]/restore.post.ts

@@ -0,0 +1,16 @@
+import { useDatabase } from '../../../../../utils/db'
+import { siteDocumentSchema } from '../../../../../utils/site-schema'
+
+export default defineEventHandler(async (event) => {
+  const user = await requireAdmin(event)
+  const version = Number(getRouterParam(event, 'version'))
+  if (!Number.isSafeInteger(version) || version < 1) throw createError({ statusCode: 400, statusMessage: '无效的版本号' })
+  const db = useDatabase()
+  const revision = db.prepare(`SELECT snapshot_json FROM revisions WHERE entity_type = 'site_document' AND entity_key = 'website' AND version = ?`).get(version) as { snapshot_json: string } | undefined
+  if (!revision) throw createError({ statusCode: 404, statusMessage: '历史版本不存在' })
+  const snapshot = siteDocumentSchema.parse(JSON.parse(revision.snapshot_json))
+  const timestamp = new Date().toISOString()
+  db.prepare('UPDATE site_documents SET draft_json = ?, updated_by = ?, updated_at = ? WHERE document_key = ?').run(JSON.stringify(snapshot), user.id, timestamp, 'website')
+  writeAuditLog(event, { operatorId: user.id, action: 'revision.restore_to_draft', entityType: 'site_document', entityKey: 'website', metadata: { version } })
+  return { data: snapshot, restoredVersion: version, updatedAt: timestamp }
+})