release: PicHost v1.0.0

Multi-user image hosting with RBAC, upload preferences, and admin settings.

server/api/images/batch-delete.post.ts

@@ -0,0 +1,104 @@
+import type { BatchDeleteResponse } from '~/types/image'
+import { requireApiOrAdminAuth, assertImageOwnership, resolveActivitySource } from '../../utils/access'
+import { createApiError } from '../../utils/api-error'
+import { MAX_DELETE_BATCH } from '../../utils/constants'
+import { insertActivityLog } from '../../utils/db'
+import { validateImageKey } from '../../utils/image-key'
+import { deleteImage, headImage } from '../../utils/storage'
+import { logInfo } from '../../utils/logger'
+
+interface BatchDeleteBody {
+  keys?: string[]
+}
+
+// POST 版本：避免部分环境下 DELETE 请求体丢失
+export default defineEventHandler(async (event) => {
+  try {
+    await requireApiOrAdminAuth(event)
+
+    const body = await readBody<BatchDeleteBody>(event)
+    const keys = body?.keys
+
+    if (!Array.isArray(keys) || !keys.length) {
+      createApiError(event, 'INVALID_REQUEST', '请提供要删除的图片列表', 400)
+    }
+
+    if (keys.length > MAX_DELETE_BATCH) {
+      createApiError(
+        event,
+        'INVALID_REQUEST',
+        `每次最多删除 ${MAX_DELETE_BATCH} 张图片`,
+        400
+      )
+    }
+
+    for (const key of keys) {
+      if (!validateImageKey(key)) {
+        createApiError(event, 'INVALID_IMAGE_KEY', `无效的图片路径: ${key}`, 400)
+      }
+    }
+
+    const deleted: string[] = []
+    const failed: BatchDeleteResponse['failed'] = []
+
+    for (const key of keys) {
+      try {
+        const existing = await headImage(key)
+
+        if (!existing) {
+          failed.push({
+            key,
+            error: { code: 'IMAGE_NOT_FOUND', message: '图片不存在' }
+          })
+          continue
+        }
+
+        try {
+          await assertImageOwnership(event, existing.userId)
+        } catch {
+          failed.push({
+            key,
+            error: { code: 'FORBIDDEN', message: '无权操作此图片' }
+          })
+          continue
+        }
+
+        await deleteImage(key)
+        deleted.push(key)
+
+        insertActivityLog({
+          action: 'delete',
+          key,
+          originalName: existing.originalName,
+          size: existing.size,
+          contentType: existing.contentType,
+          source: resolveActivitySource(event)
+        })
+
+        logInfo('delete success', { key, size: existing.size })
+      } catch {
+        failed.push({
+          key,
+          error: { code: 'DELETE_FAILED', message: '删除失败' }
+        })
+      }
+    }
+
+    const response: BatchDeleteResponse = {
+      success: failed.length === 0,
+      deleted,
+      failed
+    }
+
+    if (!deleted.length && failed.length) {
+      setResponseStatus(event, 400)
+    }
+
+    return response
+  } catch (error: unknown) {
+    if (error && typeof error === 'object' && 'statusCode' in error) {
+      throw error
+    }
+    createApiError(event, 'DELETE_FAILED', '删除失败', 500)
+  }
+})

server/api/images/count.get.ts

@@ -0,0 +1,16 @@
+import { getImageUserFilter, requireApiOrAdminAuth } from '../../utils/access'
+import { isValidFolderName } from '../../utils/image-key'
+import { countImages } from '../../utils/storage'
+
+export default defineEventHandler(async (event) => {
+  await requireApiOrAdminAuth(event)
+  const userFilter = await getImageUserFilter(event)
+
+  const query = getQuery(event)
+  const raw = typeof query.folder === 'string' ? query.folder.trim() : ''
+  const folder = raw && raw !== 'all' && isValidFolderName(raw) ? raw : undefined
+
+  const total = await countImages(folder, userFilter)
+
+  return { total }
+})

server/api/images/index.delete.ts

@@ -0,0 +1,58 @@
+import type { DeleteResponse } from '~/types/image'
+import { requireApiOrAdminAuth, assertImageOwnership, resolveActivitySource } from '../../utils/access'
+import { createApiError } from '../../utils/api-error'
+import { insertActivityLog } from '../../utils/db'
+import { validateImageKey } from '../../utils/image-key'
+import { deleteImage, headImage } from '../../utils/storage'
+import { logInfo } from '../../utils/logger'
+
+interface DeleteBody {
+  key?: string
+}
+
+export default defineEventHandler(async (event) => {
+  try {
+    await requireApiOrAdminAuth(event)
+
+    const query = getQuery(event)
+    const body = await readBody<DeleteBody>(event).catch(() => null)
+    const key = (typeof query.key === 'string' ? query.key : undefined)
+      ?? body?.key
+
+    if (!key || !validateImageKey(key)) {
+      createApiError(event, 'INVALID_IMAGE_KEY', '无效的图片路径', 400)
+    }
+
+    const existing = await headImage(key)
+    if (!existing) {
+      createApiError(event, 'IMAGE_NOT_FOUND', '图片不存在', 404)
+    }
+
+    await assertImageOwnership(event, existing.userId)
+
+    try {
+      await deleteImage(key)
+    } catch {
+      createApiError(event, 'DELETE_FAILED', '删除失败', 500)
+    }
+
+    insertActivityLog({
+      action: 'delete',
+      key,
+      originalName: existing.originalName,
+      size: existing.size,
+      contentType: existing.contentType,
+      source: resolveActivitySource(event)
+    })
+
+    logInfo('delete success', { key, size: existing.size })
+
+    const response: DeleteResponse = { success: true }
+    return response
+  } catch (error: unknown) {
+    if (error && typeof error === 'object' && 'statusCode' in error) {
+      throw error
+    }
+    createApiError(event, 'DELETE_FAILED', '删除失败', 500)
+  }
+})

server/api/images/index.get.ts

@@ -0,0 +1,56 @@
+import type { ImageListResponse } from '~/types/image'
+import { requireApiOrAdminAuth, getImageUserFilter } from '../../utils/access'
+import { getCurrentUser } from '../../utils/auth'
+import {
+  DEFAULT_LIST_LIMIT,
+  MAX_LIST_LIMIT
+} from '../../utils/constants'
+import { listUserIdUsernameMap } from '../../utils/db'
+import { mapStoredImageToItem } from '../../utils/image-response'
+import { isValidFolderName } from '../../utils/image-key'
+import { listImages } from '../../utils/storage'
+
+function readFolderQuery(query: Record<string, unknown>): string | undefined {
+  const raw = typeof query.folder === 'string' ? query.folder.trim() : ''
+  if (!raw || raw === 'all') return undefined
+  return isValidFolderName(raw) ? raw : undefined
+}
+
+export default defineEventHandler(async (event) => {
+  await requireApiOrAdminAuth(event)
+
+  const query = getQuery(event)
+
+  const limitRaw = Number(query.limit ?? DEFAULT_LIST_LIMIT)
+  const limit = Number.isFinite(limitRaw)
+    ? Math.min(Math.max(1, Math.floor(limitRaw)), MAX_LIST_LIMIT)
+    : DEFAULT_LIST_LIMIT
+
+  const pageRaw = Number(query.page ?? 1)
+  const page = Number.isFinite(pageRaw) && pageRaw > 0
+    ? Math.floor(pageRaw)
+    : 1
+
+  const folder = readFolderQuery(query)
+  const userFilter = await getImageUserFilter(event)
+
+  const listing = await listImages({ limit, page, folder, userFilter })
+
+  const user = await getCurrentUser(event)
+  const ownerMap = user?.role === 'admin' ? listUserIdUsernameMap() : undefined
+  const items = listing.items.map(stored =>
+    mapStoredImageToItem(event, stored, { ownerMap })
+  )
+
+  items.sort((a, b) => b.uploadedAt.localeCompare(a.uploadedAt))
+
+  const response: ImageListResponse = {
+    items,
+    total: listing.total,
+    page: listing.page,
+    pageSize: listing.pageSize,
+    totalPages: listing.totalPages
+  }
+
+  return response
+})

server/api/images/search.get.ts

@@ -0,0 +1,66 @@
+import type { ImageListResponse } from '~/types/image'
+import { requireApiOrAdminAuth, getImageUserFilter } from '../../utils/access'
+import { getCurrentUser } from '../../utils/auth'
+import {
+  DEFAULT_LIST_LIMIT,
+  MAX_LIST_LIMIT
+} from '../../utils/constants'
+import { createApiError } from '../../utils/api-error'
+import { listUserIdUsernameMap } from '../../utils/db'
+import { mapStoredImageToItem } from '../../utils/image-response'
+import { isValidFolderName } from '../../utils/image-key'
+import { searchImages } from '../../utils/storage'
+
+function readFolderQuery(query: Record<string, unknown>): string | undefined {
+  const raw = typeof query.folder === 'string' ? query.folder.trim() : ''
+  if (!raw || raw === 'all') return undefined
+  return isValidFolderName(raw) ? raw : undefined
+}
+
+export default defineEventHandler(async (event) => {
+  await requireApiOrAdminAuth(event)
+
+  const query = getQuery(event)
+  const q = typeof query.q === 'string' ? query.q.trim() : ''
+
+  if (!q) {
+    createApiError(event, 'INVALID_REQUEST', '请提供搜索关键词 q', 400)
+  }
+
+  if (q.length > 200) {
+    createApiError(event, 'INVALID_REQUEST', '搜索关键词过长', 400)
+  }
+
+  const limitRaw = Number(query.limit ?? DEFAULT_LIST_LIMIT)
+  const limit = Number.isFinite(limitRaw)
+    ? Math.min(Math.max(1, Math.floor(limitRaw)), MAX_LIST_LIMIT)
+    : DEFAULT_LIST_LIMIT
+
+  const pageRaw = Number(query.page ?? 1)
+  const page = Number.isFinite(pageRaw) && pageRaw > 0
+    ? Math.floor(pageRaw)
+    : 1
+
+  const folder = readFolderQuery(query)
+  const userFilter = await getImageUserFilter(event)
+
+  const result = await searchImages({ query: q, limit, page, folder, userFilter })
+
+  const user = await getCurrentUser(event)
+  const ownerMap = user?.role === 'admin' ? listUserIdUsernameMap() : undefined
+  const items = result.items.map(stored =>
+    mapStoredImageToItem(event, stored, { ownerMap })
+  )
+
+  items.sort((a, b) => b.uploadedAt.localeCompare(a.uploadedAt))
+
+  const response: ImageListResponse = {
+    items,
+    total: result.total,
+    page: result.page,
+    pageSize: result.pageSize,
+    totalPages: result.totalPages
+  }
+
+  return response
+})

server/api/images/upload.post.ts

@@ -0,0 +1,145 @@
+import { readMultipartFormData } from 'h3'
+import type { UploadResponse, UploadErrorItem, ImageItem } from '~/types/image'
+import { requireUploadAuth, verifyApiUploadToken, getUploadUserId, canUseCustomUploadFolder } from '../../utils/access'
+import { MAX_FILES_PER_UPLOAD } from '../../utils/constants'
+import {
+  detectMimeFromSignature,
+  isAllowedMimeType
+} from '../../utils/file-signature'
+import {
+  mimeMatchesDeclared,
+  processSingleImageUpload
+} from '../../utils/process-image-upload'
+import { createApiError } from '../../utils/api-error'
+import {
+  DEFAULT_FOLDER,
+  isValidFolderName,
+  normalizeFolderName
+} from '../../utils/image-key'
+
+function readFormText(
+  formData: { name?: string, data?: Buffer | Uint8Array }[],
+  name: string
+): string {
+  const part = formData.find(item => item.name === name && item.data?.length)
+  if (!part?.data) return ''
+  return new TextDecoder().decode(part.data).trim()
+}
+
+export default defineEventHandler(async (event) => {
+  await requireUploadAuth(event)
+
+  const source = verifyApiUploadToken(event) ? 'api' : 'web'
+  const uploadUserId = await getUploadUserId(event)
+
+  const formData = await readMultipartFormData(event)
+  if (!formData?.length) {
+    createApiError(event, 'INVALID_REQUEST', '未收到上传文件', 400)
+  }
+
+  const query = getQuery(event)
+  const folderFromForm = readFormText(formData, 'folder') || readFormText(formData, 'type')
+  const folderFromQuery = typeof query.folder === 'string'
+    ? query.folder
+    : typeof query.type === 'string'
+      ? query.type
+      : ''
+  const requestedFolder = normalizeFolderName(folderFromForm || folderFromQuery)
+  const canCustomFolder = await canUseCustomUploadFolder(event)
+
+  if (!canCustomFolder && requestedFolder && requestedFolder !== DEFAULT_FOLDER) {
+    createApiError(
+      event,
+      'FORBIDDEN',
+      '当前账号不支持自定义上传目录',
+      403
+    )
+  }
+
+  const folder = canCustomFolder ? requestedFolder : ''
+
+  if (folder && !isValidFolderName(folder)) {
+    createApiError(
+      event,
+      'INVALID_REQUEST',
+      '无效的 folder：仅允许字母数字开头，可含 - _，最长 32 位，且不能是 api/stats 等保留名',
+      400
+    )
+  }
+
+  // 兼容 image / file / files 字段名（图床脚本 / 通用客户端 / 网页多图）
+  const fileParts = formData.filter(
+    part => (part.name === 'image' || part.name === 'file' || part.name === 'files')
+      && part.data?.length
+  )
+  if (!fileParts.length) {
+    createApiError(event, 'INVALID_REQUEST', '未收到上传文件', 400)
+  }
+
+  if (fileParts.length > MAX_FILES_PER_UPLOAD) {
+    createApiError(
+      event,
+      'TOO_MANY_FILES',
+      `每次最多上传 ${MAX_FILES_PER_UPLOAD} 张图片`,
+      400
+    )
+  }
+
+  const items: ImageItem[] = []
+  const errors: UploadErrorItem[] = []
+
+  for (const part of fileParts) {
+    const originalName = part.filename ?? 'image'
+    const bytes = new Uint8Array(part.data)
+    const declaredMime = part.type?.toLowerCase() ?? ''
+    const detectedMime = detectMimeFromSignature(bytes)
+
+    if (detectedMime && !mimeMatchesDeclared(declaredMime, detectedMime)) {
+      errors.push({
+        name: originalName,
+        error: {
+          code: 'INVALID_FILE_SIGNATURE',
+          message: '文件类型与内容不匹配'
+        }
+      })
+      continue
+    }
+
+    if (declaredMime && isAllowedMimeType(declaredMime) && !detectedMime) {
+      errors.push({
+        name: originalName,
+        error: {
+          code: 'INVALID_FILE_SIGNATURE',
+          message: '无法识别的图片格式'
+        }
+      })
+      continue
+    }
+
+    const result = await processSingleImageUpload(event, {
+      bytes,
+      filename: part.filename,
+      source,
+      prefix: folder || DEFAULT_FOLDER,
+      userId: uploadUserId
+    })
+
+    if ('error' in result) {
+      errors.push(result.error)
+    } else {
+      items.push(result.item)
+    }
+  }
+
+  const response: UploadResponse = {
+    success: items.length > 0,
+    items,
+    errors
+  }
+
+  if (!items.length && errors.length) {
+    setResponseStatus(event, 400)
+  }
+
+  return response
+})