b0f209fdf8
Security fixes: - Fix sensitive data exposure: UserResponse no longer contains email/phone - Add UserSelfResponse for authenticated user's own data - Protect Gorse endpoints with admin role requirement - Add rate limiting (10 req/min) to auth endpoints - Fix CORS configuration to use allowed origins list - Add pagination parameter validation (max 100 per page) Changes: - dto/dto.go: Add UserSelfResponse type - dto/user_converter.go: Add ConvertUserToSelfResponse - handler/user_handler.go: Use secure response types - middleware/cors.go: Implement origin whitelist - middleware/ratelimit.go: Enhance rate limiter - router/router.go: Add auth rate limit, protect Gorse - service/admin_*.go: Use ConvertUserToResponse
251 lines
8.4 KiB
Go
251 lines
8.4 KiB
Go
package dto
|
||
|
||
import (
|
||
"carrot_bbs/internal/model"
|
||
"carrot_bbs/internal/pkg/utils"
|
||
)
|
||
|
||
// ==================== User 转换 ====================
|
||
|
||
// getAvatarOrDefault 获取头像URL，如果为空则返回在线头像生成服务的URL
|
||
func getAvatarOrDefault(user *model.User) string {
|
||
return utils.GetAvatarOrDefault(user.Username, user.Nickname, user.Avatar)
|
||
}
|
||
|
||
// ConvertUserToResponse 将User转换为UserResponse（公开信息，不包含敏感数据）
|
||
func ConvertUserToResponse(user *model.User) *UserResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
EmailVerified: user.EmailVerified,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: user.PostsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUserToSelfResponse 将User转换为UserSelfResponse（本人信息，包含敏感数据）
|
||
func ConvertUserToSelfResponse(user *model.User, postsCount int) *UserSelfResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserSelfResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
Email: user.Email,
|
||
Phone: user.Phone,
|
||
EmailVerified: user.EmailVerified,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: postsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
IsVerified: user.IsVerified,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUserToResponseWithFollowing 将User转换为UserResponse（包含关注状态，公开信息）
|
||
func ConvertUserToResponseWithFollowing(user *model.User, isFollowing bool) *UserResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
EmailVerified: user.EmailVerified,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: user.PostsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
IsFollowing: isFollowing,
|
||
IsFollowingMe: false,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUserToResponseWithPostsCount 将User转换为UserResponse（使用实时计算的帖子数量，公开信息）
|
||
func ConvertUserToResponseWithPostsCount(user *model.User, postsCount int) *UserResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
EmailVerified: user.EmailVerified,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: postsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUserToResponseWithMutualFollow 将User转换为UserResponse（包含双向关注状态，公开信息）
|
||
func ConvertUserToResponseWithMutualFollow(user *model.User, isFollowing, isFollowingMe bool) *UserResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
EmailVerified: user.EmailVerified,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: user.PostsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
IsFollowing: isFollowing,
|
||
IsFollowingMe: isFollowingMe,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUserToResponseWithMutualFollowAndPostsCount 将User转换为UserResponse（包含双向关注状态和实时计算的帖子数量，公开信息）
|
||
func ConvertUserToResponseWithMutualFollowAndPostsCount(user *model.User, isFollowing, isFollowingMe bool, postsCount int) *UserResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
EmailVerified: user.EmailVerified,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: postsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
IsFollowing: isFollowing,
|
||
IsFollowingMe: isFollowingMe,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUserToDetailResponse 将User转换为UserDetailResponse（仅本人可见，包含敏感信息）
|
||
func ConvertUserToDetailResponse(user *model.User) *UserDetailResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserDetailResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
Email: user.Email,
|
||
EmailVerified: user.EmailVerified,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: user.PostsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
IsVerified: user.IsVerified,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUserToDetailResponseWithPostsCount 将User转换为UserDetailResponse（使用实时计算的帖子数量，仅本人可见）
|
||
func ConvertUserToDetailResponseWithPostsCount(user *model.User, postsCount int) *UserDetailResponse {
|
||
if user == nil {
|
||
return nil
|
||
}
|
||
return &UserDetailResponse{
|
||
ID: user.ID,
|
||
Username: user.Username,
|
||
Nickname: user.Nickname,
|
||
Email: user.Email,
|
||
EmailVerified: user.EmailVerified,
|
||
Phone: user.Phone,
|
||
Avatar: getAvatarOrDefault(user),
|
||
CoverURL: user.CoverURL,
|
||
Bio: user.Bio,
|
||
Website: user.Website,
|
||
Location: user.Location,
|
||
PostsCount: postsCount,
|
||
FollowersCount: user.FollowersCount,
|
||
FollowingCount: user.FollowingCount,
|
||
IsVerified: user.IsVerified,
|
||
CreatedAt: FormatTime(user.CreatedAt),
|
||
}
|
||
}
|
||
|
||
// ConvertUsersToResponse 将User列表转换为响应列表
|
||
func ConvertUsersToResponse(users []*model.User) []*UserResponse {
|
||
result := make([]*UserResponse, 0, len(users))
|
||
for _, user := range users {
|
||
result = append(result, ConvertUserToResponse(user))
|
||
}
|
||
return result
|
||
}
|
||
|
||
// ConvertUsersToResponseWithMutualFollow 将User列表转换为响应列表（包含双向关注状态）
|
||
// followingStatusMap: key是用户ID，value是[isFollowing, isFollowingMe]
|
||
func ConvertUsersToResponseWithMutualFollow(users []*model.User, followingStatusMap map[string][2]bool) []*UserResponse {
|
||
result := make([]*UserResponse, 0, len(users))
|
||
for _, user := range users {
|
||
status, ok := followingStatusMap[user.ID]
|
||
if ok {
|
||
result = append(result, ConvertUserToResponseWithMutualFollow(user, status[0], status[1]))
|
||
} else {
|
||
result = append(result, ConvertUserToResponse(user))
|
||
}
|
||
}
|
||
return result
|
||
}
|
||
|
||
// ConvertUsersToResponseWithMutualFollowAndPostsCount 将User列表转换为响应列表（包含双向关注状态和实时计算的帖子数量）
|
||
// followingStatusMap: key是用户ID，value是[isFollowing, isFollowingMe]
|
||
// postsCountMap: key是用户ID，value是帖子数量
|
||
func ConvertUsersToResponseWithMutualFollowAndPostsCount(users []*model.User, followingStatusMap map[string][2]bool, postsCountMap map[string]int64) []*UserResponse {
|
||
result := make([]*UserResponse, 0, len(users))
|
||
for _, user := range users {
|
||
status, hasStatus := followingStatusMap[user.ID]
|
||
postsCount, hasPostsCount := postsCountMap[user.ID]
|
||
|
||
// 如果没有帖子数量，使用数据库中的值
|
||
if !hasPostsCount {
|
||
postsCount = int64(user.PostsCount)
|
||
}
|
||
|
||
if hasStatus {
|
||
result = append(result, ConvertUserToResponseWithMutualFollowAndPostsCount(user, status[0], status[1], int(postsCount)))
|
||
} else {
|
||
result = append(result, ConvertUserToResponseWithPostsCount(user, int(postsCount)))
|
||
}
|
||
}
|
||
return result
|
||
}
|