release: v1.4.1 — 上传策略设置、保留原图与上传 tagNames

管理员可在设置页配置上传大小、格式、限流与保留原图；上传 API 支持按标签名称打标。

server/api/auth/login.post.ts

@@ -14,6 +14,7 @@ import { getAdminSecret } from '../../utils/env'
 import { verifyLoginVerification, type VerificationBody } from '../../utils/login-verification'
 import { logActivity } from '../../utils/activity-log'
 import { clientIp, logInfo, logWarn } from '../../utils/logger'
+import { checkLoginRateLimit } from '../../utils/rate-limit'
 
 interface LoginBody extends VerificationBody {
   username?: string
@@ -21,29 +22,9 @@ interface LoginBody extends VerificationBody {
   secret?: string
 }
 
-const loginAttempts = new Map<string, { count: number, resetAt: number }>()
-const MAX_ATTEMPTS = 10
-const WINDOW_MS = 15 * 60 * 1000
-
-function checkRateLimit(ip: string): void {
-  const now = Date.now()
-  const entry = loginAttempts.get(ip)
-  if (!entry || now > entry.resetAt) {
-    loginAttempts.set(ip, { count: 1, resetAt: now + WINDOW_MS })
-    return
-  }
-  entry.count += 1
-  if (entry.count > MAX_ATTEMPTS) {
-    throw createError({
-      statusCode: 429,
-      statusMessage: '登录尝试过于频繁，请稍后再试'
-    })
-  }
-}
-
 export default defineEventHandler(async (event) => {
   const ip = clientIp(event)
-  checkRateLimit(ip)
+  checkLoginRateLimit(ip)
 
   const body = await readBody<LoginBody>(event)
   await verifyLoginVerification(event, body ?? {})

server/api/images/upload.post.ts

@@ -12,7 +12,12 @@ import {
 } from '../../utils/process-image-upload'
 import { createApiError } from '../../utils/api-error'
 import { checkUploadRateLimit } from '../../utils/rate-limit'
-import { parseTagIdsParam } from '../../utils/tags'
+import { readMultipartFormFieldValues } from '../../utils/multipart-form'
+import {
+  parseTagIdsParam,
+  parseTagNamesParam,
+  resolveUploadTagIds
+} from '../../utils/tags'
 
 export default defineEventHandler(async (event) => {
   await requireUploadAuth(event)
@@ -31,24 +36,15 @@ export default defineEventHandler(async (event) => {
   const source = verifyApiUploadToken(event) ? 'api' : 'web'
   const uploadUserId = await getUploadUserId(event)
 
-  const tagIdsField = formData.find(part => part.name === 'tagIds')
-  let uploadTagIds: number[] = []
-  if (tagIdsField?.data?.length) {
-    const raw = new TextDecoder().decode(tagIdsField.data).trim()
-    try {
-      const parsed = JSON.parse(raw) as unknown
-      uploadTagIds = parseTagIdsParam(parsed)
-    } catch {
-      uploadTagIds = parseTagIdsParam(raw)
-    }
-  } else {
-    const repeatFields = formData.filter(part => part.name === 'tagIds' && part.data?.length)
-    if (repeatFields.length) {
-      uploadTagIds = parseTagIdsParam(
-        repeatFields.map(part => new TextDecoder().decode(part.data!).trim())
-      )
-    }
+  const tagIdsRaw = readMultipartFormFieldValues(formData, 'tagIds')
+  const tagNamesRaw = readMultipartFormFieldValues(formData, 'tagNames')
+  const uploadTagIdsInput = parseTagIdsParam(tagIdsRaw.length === 1 ? tagIdsRaw[0] : tagIdsRaw)
+  const uploadTagNames = parseTagNamesParam(tagNamesRaw.length === 1 ? tagNamesRaw[0] : tagNamesRaw)
+  const resolvedTags = resolveUploadTagIds(uploadUserId, uploadTagIdsInput, uploadTagNames)
+  if ('message' in resolvedTags) {
+    createApiError(event, 'INVALID_REQUEST', resolvedTags.message, 400)
   }
+  const uploadTagIds = resolvedTags.tagIds
 
   // 兼容 image / file / files 字段名（图床脚本 / 通用客户端 / 网页多图）
   const fileParts = formData.filter(

server/api/settings/index.patch.ts

@@ -34,6 +34,16 @@ import {
   validateLoginVerificationSettings,
   validateSettingsDomainPatch
 } from '../../utils/env'
+import {
+  normalizeAllowedMimeTypes,
+  parseLoginRateMax,
+  parseLoginRateWindowMinutes,
+  parseUploadMaxFileSizeMb,
+  parseUploadRateIpMax,
+  parseUploadRateTokenMax,
+  parseUploadRateWindowMinutes,
+  setUploadPolicySettings
+} from '../../utils/upload-policy'
 
 interface SettingsPatchBody {
   webpQuality?: unknown
@@ -50,6 +60,14 @@ interface SettingsPatchBody {
   turnstileSecretKey?: unknown
   capApiEndpoint?: unknown
   capSecret?: unknown
+  uploadMaxFileSizeMb?: unknown
+  allowedMimeTypes?: unknown
+  uploadRateIpMax?: unknown
+  uploadRateTokenMax?: unknown
+  uploadRateWindowMinutes?: unknown
+  loginRateMax?: unknown
+  loginRateWindowMinutes?: unknown
+  preserveOriginalUpload?: unknown
 }
 
 export default defineEventHandler(async (event) => {
@@ -249,6 +267,72 @@ export default defineEventHandler(async (event) => {
     setSetting(SETTINGS_CAP_SECRET, nextCapSecret)
   }
 
+  if (body.uploadMaxFileSizeMb !== undefined) {
+    const mb = parseUploadMaxFileSizeMb(String(body.uploadMaxFileSizeMb))
+    if (mb === null) {
+      createApiError(event, 'INVALID_REQUEST', '单文件大小需为 1–100 MB 的整数', 400)
+    }
+    setUploadPolicySettings({ uploadMaxFileSizeMb: mb })
+  }
+
+  if (body.allowedMimeTypes !== undefined) {
+    const raw = Array.isArray(body.allowedMimeTypes)
+      ? body.allowedMimeTypes.map(item => String(item))
+      : String(body.allowedMimeTypes).split(',')
+    const normalized = normalizeAllowedMimeTypes(raw.join(','))
+    if (normalized.length === 0) {
+      createApiError(event, 'INVALID_REQUEST', '至少选择一种允许上传的图片格式', 400)
+    }
+    setUploadPolicySettings({ allowedMimeTypes: normalized })
+  }
+
+  if (body.uploadRateIpMax !== undefined) {
+    const value = parseUploadRateIpMax(String(body.uploadRateIpMax))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '上传 IP 限流次数无效', 400)
+    }
+    setUploadPolicySettings({ uploadRateIpMax: value })
+  }
+
+  if (body.uploadRateTokenMax !== undefined) {
+    const value = parseUploadRateTokenMax(String(body.uploadRateTokenMax))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '上传 Token 限流次数无效', 400)
+    }
+    setUploadPolicySettings({ uploadRateTokenMax: value })
+  }
+
+  if (body.uploadRateWindowMinutes !== undefined) {
+    const value = parseUploadRateWindowMinutes(String(body.uploadRateWindowMinutes))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '上传限流窗口无效', 400)
+    }
+    setUploadPolicySettings({ uploadRateWindowMinutes: value })
+  }
+
+  if (body.loginRateMax !== undefined) {
+    const value = parseLoginRateMax(String(body.loginRateMax))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '登录限流次数无效', 400)
+    }
+    setUploadPolicySettings({ loginRateMax: value })
+  }
+
+  if (body.loginRateWindowMinutes !== undefined) {
+    const value = parseLoginRateWindowMinutes(String(body.loginRateWindowMinutes))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '登录限流窗口无效', 400)
+    }
+    setUploadPolicySettings({ loginRateWindowMinutes: value })
+  }
+
+  if (body.preserveOriginalUpload !== undefined) {
+    if (typeof body.preserveOriginalUpload !== 'boolean') {
+      createApiError(event, 'INVALID_REQUEST', '保留原图设置无效', 400)
+    }
+    setUploadPolicySettings({ preserveOriginalUpload: body.preserveOriginalUpload })
+  }
+
   logActivity(event, {
     action: 'settings',
     key: 'settings/system',