release: v1.2.2 — 双域名配置与 Host 隔离修复

修复设置页误清空管理域、配置与生效 URL 混淆及第三 Host 绕过隔离；加固 Settings API 与中间件，并更新文档站。

server/utils/image-public-path.test.ts

@@ -2,13 +2,16 @@ import { describe, expect, it } from 'vitest'
 import {
   isBareImageFilename,
   isHiddenImageDatePath,
-  toPublicImagePath
+  storageKeyToPublicPath,
+  toPublicImagePath,
+  toStorageKeyFromPublicPath
 } from './image-public-path'
 
 describe('toPublicImagePath', () => {
-  it('returns key unchanged when hideFolder is false', () => {
-    expect(toPublicImagePath('images/2026/08/a.webp', false)).toBe('images/2026/08/a.webp')
-    expect(toPublicImagePath('images/a.webp', false)).toBe('images/a.webp')
+  it('strips internal images/ prefix when hideFolder is false', () => {
+    expect(toPublicImagePath('images/2026/08/a.webp', false)).toBe('2026/08/a.webp')
+    expect(toPublicImagePath('images/a.webp', false)).toBe('a.webp')
+    expect(toPublicImagePath('images/blog/a.webp', false)).toBe('blog/a.webp')
   })
 
   it('returns basename when hideFolder is true', () => {
@@ -18,6 +21,29 @@ describe('toPublicImagePath', () => {
   })
 })
 
+describe('storageKeyToPublicPath', () => {
+  it('removes images/ prefix only', () => {
+    expect(storageKeyToPublicPath('images/2026/08/a.webp')).toBe('2026/08/a.webp')
+  })
+})
+
+describe('toStorageKeyFromPublicPath', () => {
+  it('maps public relative paths to storage keys', () => {
+    expect(toStorageKeyFromPublicPath('2026/08/a.webp')).toBe('images/2026/08/a.webp')
+    expect(toStorageKeyFromPublicPath('blog/a.webp')).toBe('images/blog/a.webp')
+    expect(toStorageKeyFromPublicPath('a.webp')).toBe('images/a.webp')
+  })
+
+  it('accepts legacy full storage keys', () => {
+    expect(toStorageKeyFromPublicPath('images/2026/08/a.webp')).toBe('images/2026/08/a.webp')
+  })
+
+  it('rejects invalid paths', () => {
+    expect(toStorageKeyFromPublicPath('')).toBeNull()
+    expect(toStorageKeyFromPublicPath('../../../etc/passwd')).toBeNull()
+  })
+})
+
 describe('isHiddenImageDatePath', () => {
   it('accepts YYYY/MM/file paths', () => {
     expect(isHiddenImageDatePath('2026/08/demo.webp')).toBe(true)