feat: activity logs, gallery storage filter, and upload rate limits

Add per-user activity logs with storage backend tracking, gallery
storage filter, and IP/token upload rate limiting. Fix storage delete
modal flash, pin local backend in filter order, and link settings
version to GitHub releases.

server/api/images/batch-delete.post.ts

@@ -72,7 +72,9 @@ export default defineEventHandler(async (event) => {
           originalName: existing.originalName,
           size: existing.size,
           contentType: existing.contentType,
-          source: resolveActivitySource(event)
+          source: resolveActivitySource(event),
+          userId: existing.userId ?? null,
+          backendId: existing.backendId ?? null
         })
 
         logInfo('delete success', { key, size: existing.size })

server/api/images/count.get.ts

@@ -1,5 +1,7 @@
 import { getImageUserFilter, requireApiOrAdminAuth } from '../../utils/access'
 import { isValidFolderName } from '../../utils/image-key'
+import { readBackendIdQuery } from '../../utils/image-query'
+import { createApiError } from '../../utils/api-error'
 import { countImages } from '../../utils/storage'
 
 export default defineEventHandler(async (event) => {
@@ -9,8 +11,12 @@ export default defineEventHandler(async (event) => {
   const query = getQuery(event)
   const raw = typeof query.folder === 'string' ? query.folder.trim() : ''
   const folder = raw && raw !== 'all' && isValidFolderName(raw) ? raw : undefined
+  const backendId = readBackendIdQuery(query)
+  if (backendId === null) {
+    createApiError(event, 'INVALID_REQUEST', '无效的存储后端', 400)
+  }
 
-  const total = await countImages(folder, userFilter)
+  const total = await countImages(folder, userFilter, backendId)
 
   return { total }
 })

server/api/images/index.delete.ts

@@ -42,7 +42,9 @@ export default defineEventHandler(async (event) => {
       originalName: existing.originalName,
       size: existing.size,
       contentType: existing.contentType,
-      source: resolveActivitySource(event)
+      source: resolveActivitySource(event),
+      userId: existing.userId ?? null,
+      backendId: existing.backendId ?? null
     })
 
     logInfo('delete success', { key, size: existing.size })

server/api/images/index.get.ts

@@ -5,9 +5,12 @@ import {
   DEFAULT_LIST_LIMIT,
   MAX_LIST_LIMIT
 } from '../../utils/constants'
+import { createApiError } from '../../utils/api-error'
 import { listUserIdUsernameMap } from '../../utils/db'
 import { mapStoredImageToItem } from '../../utils/image-response'
+import { listStorageBackendNameMap } from '../../utils/storage-backends'
 import { isValidFolderName } from '../../utils/image-key'
+import { readBackendIdQuery } from '../../utils/image-query'
 import { listImages } from '../../utils/storage'
 
 function readFolderQuery(query: Record<string, unknown>): string | undefined {
@@ -32,14 +35,19 @@ export default defineEventHandler(async (event) => {
     : 1
 
   const folder = readFolderQuery(query)
+  const backendId = readBackendIdQuery(query)
+  if (backendId === null) {
+    createApiError(event, 'INVALID_REQUEST', '无效的存储后端', 400)
+  }
   const userFilter = await getImageUserFilter(event)
 
-  const listing = await listImages({ limit, page, folder, userFilter })
+  const listing = await listImages({ limit, page, folder, userFilter, backendId })
 
   const user = await getCurrentUser(event)
   const ownerMap = user?.role === 'admin' ? listUserIdUsernameMap() : undefined
+  const backendMap = listStorageBackendNameMap()
   const items = listing.items.map(stored =>
-    mapStoredImageToItem(event, stored, { ownerMap })
+    mapStoredImageToItem(event, stored, { ownerMap, backendMap })
   )
 
   items.sort((a, b) => b.uploadedAt.localeCompare(a.uploadedAt))

server/api/images/search.get.ts

@@ -8,7 +8,9 @@ import {
 import { createApiError } from '../../utils/api-error'
 import { listUserIdUsernameMap } from '../../utils/db'
 import { mapStoredImageToItem } from '../../utils/image-response'
+import { listStorageBackendNameMap } from '../../utils/storage-backends'
 import { isValidFolderName } from '../../utils/image-key'
+import { readBackendIdQuery } from '../../utils/image-query'
 import { searchImages } from '../../utils/storage'
 
 function readFolderQuery(query: Record<string, unknown>): string | undefined {
@@ -42,14 +44,19 @@ export default defineEventHandler(async (event) => {
     : 1
 
   const folder = readFolderQuery(query)
+  const backendId = readBackendIdQuery(query)
+  if (backendId === null) {
+    createApiError(event, 'INVALID_REQUEST', '无效的存储后端', 400)
+  }
   const userFilter = await getImageUserFilter(event)
 
-  const result = await searchImages({ query: q, limit, page, folder, userFilter })
+  const result = await searchImages({ query: q, limit, page, folder, userFilter, backendId })
 
   const user = await getCurrentUser(event)
   const ownerMap = user?.role === 'admin' ? listUserIdUsernameMap() : undefined
+  const backendMap = listStorageBackendNameMap()
   const items = result.items.map(stored =>
-    mapStoredImageToItem(event, stored, { ownerMap })
+    mapStoredImageToItem(event, stored, { ownerMap, backendMap })
   )
 
   items.sort((a, b) => b.uploadedAt.localeCompare(a.uploadedAt))

server/api/images/upload.post.ts

@@ -16,6 +16,7 @@ import {
   isValidFolderName,
   normalizeFolderName
 } from '../../utils/image-key'
+import { checkUploadRateLimit } from '../../utils/rate-limit'
 
 function readFormText(
   formData: { name?: string, data?: Buffer | Uint8Array }[],
@@ -29,14 +30,20 @@ function readFormText(
 export default defineEventHandler(async (event) => {
   await requireUploadAuth(event)
 
-  const source = verifyApiUploadToken(event) ? 'api' : 'web'
-  const uploadUserId = await getUploadUserId(event)
-
   const formData = await readMultipartFormData(event)
   if (!formData?.length) {
     createApiError(event, 'INVALID_REQUEST', '未收到上传文件', 400)
   }
 
+  const tokenField = formData.find(part => part.name === 'token')
+  const formToken = tokenField?.data?.length
+    ? new TextDecoder().decode(tokenField.data).trim()
+    : ''
+  checkUploadRateLimit(event, formToken)
+
+  const source = verifyApiUploadToken(event) ? 'api' : 'web'
+  const uploadUserId = await getUploadUserId(event)
+
   const query = getQuery(event)
   const folderFromForm = readFormText(formData, 'folder') || readFormText(formData, 'type')
   const folderFromQuery = typeof query.folder === 'string'