release: v1.4.2

Fix batch tagging and upload token auth; single API token and tagNames-only upload; tag management sort and responsive layout.

.env.example

@@ -30,6 +30,16 @@
 # 服务端 WebP 压缩质量 1-100（默认 80；也可在设置页配置）
 # WEBP_QUALITY=80
 
+# 上传限制（也可在设置 → 访问控制配置；环境变量优先级更高）
+# UPLOAD_MAX_FILE_SIZE_MB=10
+# ALLOWED_MIME_TYPES=image/jpeg,image/png,image/webp,image/gif,image/svg+xml,image/x-icon
+# UPLOAD_RATE_IP_MAX=60
+# UPLOAD_RATE_TOKEN_MAX=120
+# UPLOAD_RATE_WINDOW_MINUTES=15
+# LOGIN_RATE_MAX=10
+# LOGIN_RATE_WINDOW_MINUTES=15
+# PRESERVE_ORIGINAL_UPLOAD=false
+
 # 自动删除超过 N 天的图片（0 表示关闭；也可在设置页配置）
 # AUTO_DELETE_DAYS=0
 

CHANGELOG.md

@@ -4,6 +4,33 @@
 
 ## [Unreleased]
 
+## [1.4.2] - 2026-09-23
+
+### 修复
+
+- 图库批量打标：管理员/跨归属场景下标签解析与失败提示
+- 上传鉴权：`Auth-Token` 与表单 `token` 优先于会话；兼容全局 `API_UPLOAD_TOKEN`（上传归属首位管理员）
+
+### 改进
+
+- **API 页**：每账号单一 API Token，界面与文档统一
+- **上传 API**：仅支持 `tagNames`（按名创建或复用标签）；Twikoo 兼容路由同步
+- **标签管理**：按图片数/最近使用排序；桌面列布局；窄屏卡片列表
+- **API 文档**：参数表列宽，避免 form-data 列异常换行
+
+## [1.4.1] - 2026-09-16
+
+### 新增
+
+- **上传策略（设置 → 基础）**：单文件大小、允许格式、上传/登录限流、保留原图（关闭服务端 WebP 转换）；支持 `.env` 覆盖
+- **上传 API**：可选 `tagNames`（名称不存在则创建，存在则复用）；与 `tagIds` 可并用
+
+### 改进
+
+- 登录接口接入可配置的登录限流
+- 设置页将全站上传策略并入「上传偏好 / 图片处理」；访问控制保留登录限流
+- API 文档补充 `tagIds` / `tagNames` 参数说明
+
 ## [1.4.0] - 2026-09-09
 
 ### 新增

app/components/TagManagePanel.vue

@@ -8,12 +8,15 @@ import {
   TAG_COLOR_EDIT_CANDIDATE_COUNT
 } from '~/utils/tag-colors'
 
-const props = withDefaults(defineProps<{
+const props = withDefaults(
+  defineProps<{
     tags: ImageTag[]
     embedded?: boolean
-}>(), {
+  }>(),
+  {
     embedded: false
-})
+  }
+)
 
 const emit = defineEmits<{
   changed: []
@@ -27,7 +30,9 @@ const { createTag, updateTag, deleteTag, mergeTags } = useTags()
 const creating = ref(false)
 const newName = ref('')
 const newColorCandidates = ref<string[]>(pickTagColorCandidates([]))
-const newColor = ref(pickDefaultTagColorFromCandidates(newColorCandidates.value, []))
+const newColor = ref(
+  pickDefaultTagColorFromCandidates(newColorCandidates.value, [])
+)
 const search = ref('')
 const statusFilter = ref<'all' | 'used' | 'unused'>('all')
 const selectedIds = ref<Set<number>>(new Set())
@@ -47,6 +52,10 @@ const saving = ref(false)
 const page = ref(1)
 const pageSize = ref(10)
 
+type TagSortKey = 'imageCount' | 'lastUsedAt'
+const sortKey = ref<TagSortKey>('imageCount')
+const sortDir = ref<'asc' | 'desc'>('desc')
+
 const stats = computed(() => {
   const now = Date.now()
   const sevenDaysAgo = now - 7 * 24 * 60 * 60 * 1000
@@ -71,15 +80,31 @@ const stats = computed(() => {
 
 const filteredTags = computed(() => {
   const q = search.value.trim().toLowerCase()
-  return props.tags.filter((tag) => {
+  const list = props.tags.filter((tag) => {
-    if (statusFilter.value === 'used' && (tag.imageCount ?? 0) === 0) return false
+    if (statusFilter.value === 'used' && (tag.imageCount ?? 0) === 0)
-    if (statusFilter.value === 'unused' && (tag.imageCount ?? 0) > 0) return false
+      return false
+    if (statusFilter.value === 'unused' && (tag.imageCount ?? 0) > 0)
+      return false
     if (q && !tag.name.toLowerCase().includes(q)) return false
     return true
-  }).sort((a, b) => (b.imageCount ?? 0) - (a.imageCount ?? 0) || a.name.localeCompare(b.name))
   })
 
-const totalPages = computed(() => Math.max(1, Math.ceil(filteredTags.value.length / pageSize.value)))
+  const dir = sortDir.value === 'asc' ? 1 : -1
+  return list.sort((a, b) => {
+    let cmp = 0
+    if (sortKey.value === 'imageCount') {
+      cmp = (a.imageCount ?? 0) - (b.imageCount ?? 0)
+    } else {
+      cmp = lastUsedSortTime(a) - lastUsedSortTime(b)
+    }
+    if (cmp !== 0) return cmp * dir
+    return a.name.localeCompare(b.name)
+  })
+})
+
+const totalPages = computed(() =>
+  Math.max(1, Math.ceil(filteredTags.value.length / pageSize.value))
+)
 
 const paginatedTags = computed(() => {
   const start = (page.value - 1) * pageSize.value
@@ -96,7 +121,8 @@ watch(filteredTags, (list) => {
   }
 })
 
-const selectedList = computed(() =>
+const selectedList = computed(
+  () =>
     [...selectedIds.value]
       .map(id => props.tags.find(tag => tag.id === id))
       .filter(Boolean) as ImageTag[]
@@ -104,12 +130,14 @@ const selectedList = computed(() =>
 
 const selectedCount = computed(() => selectedIds.value.size)
 
-const allPageSelected = computed(() =>
+const allPageSelected = computed(
+  () =>
     paginatedTags.value.length > 0
     && paginatedTags.value.every(tag => selectedIds.value.has(tag.id))
 )
 
-const mergeSourceTags = computed(() =>
+const mergeSourceTags = computed(
+  () =>
     mergeSourceIds.value
       .map(id => props.tags.find(tag => tag.id === id))
       .filter(Boolean) as ImageTag[]
@@ -119,7 +147,11 @@ const mergeTargetCandidates = computed(() => {
   const sourceSet = new Set(mergeSourceIds.value)
   return props.tags
     .filter(tag => !sourceSet.has(tag.id))
-    .sort((a, b) => (b.imageCount ?? 0) - (a.imageCount ?? 0) || a.name.localeCompare(b.name))
+    .sort(
+      (a, b) =>
+        (b.imageCount ?? 0) - (a.imageCount ?? 0)
+        || a.name.localeCompare(b.name)
+    )
 })
 
 const mergeTagsToDelete = computed(() => {
@@ -127,8 +159,8 @@ const mergeTagsToDelete = computed(() => {
   return mergeSourceTags.value.filter(tag => tag.id !== mergeTargetId.value)
 })
 
-const mergeKeepTag = computed(() =>
+const mergeKeepTag = computed(
-  props.tags.find(tag => tag.id === mergeTargetId.value) ?? null
+  () => props.tags.find(tag => tag.id === mergeTargetId.value) ?? null
 )
 
 const statusItems = computed(() => [
@@ -137,28 +169,71 @@ const statusItems = computed(() => [
   { label: t('tags.filterStatusUnused'), value: 'unused' }
 ])
 
-const statValueClass = computed(() =>
+function tagSortTime(iso: string | null | undefined): number {
-  'mt-2 text-2xl font-semibold tabular-nums text-highlighted'
+  if (!iso) return 0
+  const time = new Date(iso).getTime()
+  return Number.isNaN(time) ? 0 : time
+}
+
+function lastUsedSortTime(tag: ImageTag): number {
+  if ((tag.imageCount ?? 0) === 0) return 0
+  return tagSortTime(tag.lastUsedAt)
+}
+
+function toggleSort(key: TagSortKey) {
+  if (sortKey.value === key) {
+    sortDir.value = sortDir.value === 'asc' ? 'desc' : 'asc'
+  } else {
+    sortKey.value = key
+    sortDir.value = 'desc'
+  }
+  page.value = 1
+}
+
+function sortIcon(key: TagSortKey): string {
+  if (sortKey.value !== key) return 'i-lucide-arrow-up-down'
+  return sortDir.value === 'asc' ? 'i-lucide-arrow-up' : 'i-lucide-arrow-down'
+}
+
+function sortIconClass(key: TagSortKey): string {
+  const base = 'size-3 shrink-0'
+  return sortKey.value === key
+    ? `${base} opacity-70`
+    : `${base} opacity-40`
+}
+
+const statValueClass = computed(
+  () => 'mt-2 text-2xl font-semibold tabular-nums text-highlighted'
 )
 
 const tableTextClass = computed(() => 'text-sm')
 
+const tagRowClass = 'flex items-center gap-x-3 px-3'
+
+const tagNameColClass = 'min-w-0 flex-1 basis-0 pr-8 sm:pr-12'
+
+const tagRightGroupClass
+  = 'ml-auto flex shrink-0 items-center gap-x-8 sm:gap-x-10'
+
+const tagCountColClass
+  = 'w-44 shrink-0 text-left tabular-nums whitespace-nowrap sm:w-48'
+
+const tagLastColClass
+  = 'w-[10.5rem] shrink-0 whitespace-nowrap text-xs text-muted'
+
+const tagActionsColClass = 'w-[9.5rem] shrink-0'
+
 function formatLastUsed(tag: ImageTag) {
   if (!tag.lastUsedAt || (tag.imageCount ?? 0) === 0) {
     return t('tags.neverUsed')
   }
-  const date = new Date(tag.lastUsedAt)
+  try {
-  if (Number.isNaN(date.getTime())) {
+    return new Date(tag.lastUsedAt).toLocaleString(locale.value, {
-    return t('tags.neverUsed')
-  }
-  return date.toLocaleString(locale.value, {
-    year: 'numeric',
-    month: 'numeric',
-    day: 'numeric',
-    hour: '2-digit',
-    minute: '2-digit',
       hour12: false
     })
+  } catch {
+    return t('tags.neverUsed')
+  }
 }
 
 function toggleSelect(id: number) {
@@ -191,7 +266,10 @@ function usedColorsExcept(tagId?: number) {
 function refreshNewTagColor() {
   const used = usedColorsExcept()
   newColorCandidates.value = pickTagColorCandidates(used)
-  newColor.value = pickDefaultTagColorFromCandidates(newColorCandidates.value, used)
+  newColor.value = pickDefaultTagColorFromCandidates(
+    newColorCandidates.value,
+    used
+  )
 }
 
 function toggleCreating() {
@@ -303,7 +381,10 @@ async function confirmDelete() {
     selectedIds.value.delete(tag.id)
     selectedIds.value = new Set(selectedIds.value)
     emit('changed')
-    toast.add({ title: t('tags.deleted', { name: tag.name }), color: 'success' })
+    toast.add({
+      title: t('tags.deleted', { name: tag.name }),
+      color: 'success'
+    })
   } catch {
     toast.add({ title: t('tags.deleteFailed'), color: 'error' })
   } finally {
@@ -318,7 +399,9 @@ function openBatchMerge() {
   }
   mergeMode.value = 'batch'
   mergeSourceIds.value = [...selectedIds.value]
-  const sorted = selectedList.value.sort((a, b) => (b.imageCount ?? 0) - (a.imageCount ?? 0))
+  const sorted = selectedList.value.sort(
+    (a, b) => (b.imageCount ?? 0) - (a.imageCount ?? 0)
+  )
   mergeTargetId.value = sorted[0]?.id ?? null
   mergeOpen.value = true
 }
@@ -335,14 +418,18 @@ function openSingleMerge(tag: ImageTag) {
 
 function requestMergeConfirm() {
   if (!mergeTargetId.value) return
-  const sourceIds = mergeSourceIds.value.filter(id => id !== mergeTargetId.value)
+  const sourceIds = mergeSourceIds.value.filter(
+    id => id !== mergeTargetId.value
+  )
   if (!sourceIds.length) return
   mergeConfirmOpen.value = true
 }
 
 async function confirmMerge() {
   if (!mergeTargetId.value || saving.value) return
-  const sourceIds = mergeSourceIds.value.filter(id => id !== mergeTargetId.value)
+  const sourceIds = mergeSourceIds.value.filter(
+    id => id !== mergeTargetId.value
+  )
   if (!sourceIds.length) return
   saving.value = true
   try {
@@ -365,13 +452,15 @@ async function confirmMerge() {
     <div class="grid grid-cols-2 gap-3 lg:grid-cols-4">
       <div class="rounded-xl border border-default bg-elevated p-4">
         <div class="flex items-center gap-2 text-xs text-muted">
-          <span class="flex size-7 items-center justify-center rounded-lg bg-primary/10 text-primary">
+          <span
+            class="flex size-7 items-center justify-center rounded-lg bg-primary/10 text-primary"
+          >
             <UIcon
               name="i-lucide-tags"
               class="size-4"
             />
           </span>
-          {{ t('tags.statTotal') }}
+          {{ t("tags.statTotal") }}
         </div>
         <p :class="statValueClass">
           {{ stats.total }}
@@ -379,13 +468,15 @@ async function confirmMerge() {
       </div>
       <div class="rounded-xl border border-default bg-elevated p-4">
         <div class="flex items-center gap-2 text-xs text-muted">
-          <span class="flex size-7 items-center justify-center rounded-lg bg-blue-500/10 text-blue-600 dark:text-blue-400">
+          <span
+            class="flex size-7 items-center justify-center rounded-lg bg-blue-500/10 text-blue-600 dark:text-blue-400"
+          >
             <UIcon
               name="i-lucide-image"
               class="size-4"
             />
           </span>
-          {{ t('tags.statUsed') }}
+          {{ t("tags.statUsed") }}
         </div>
         <p :class="statValueClass">
           {{ stats.used }}
@@ -393,13 +484,15 @@ async function confirmMerge() {
       </div>
       <div class="rounded-xl border border-default bg-elevated p-4">
         <div class="flex items-center gap-2 text-xs text-muted">
-          <span class="flex size-7 items-center justify-center rounded-lg bg-orange-500/10 text-orange-600 dark:text-orange-400">
+          <span
+            class="flex size-7 items-center justify-center rounded-lg bg-orange-500/10 text-orange-600 dark:text-orange-400"
+          >
             <UIcon
               name="i-lucide-tag"
               class="size-4"
             />
           </span>
-          {{ t('tags.statUnused') }}
+          {{ t("tags.statUnused") }}
         </div>
         <p :class="statValueClass">
           {{ stats.unused }}
@@ -407,13 +500,15 @@ async function confirmMerge() {
       </div>
       <div class="rounded-xl border border-default bg-elevated p-4">
         <div class="flex items-center gap-2 text-xs text-muted">
-          <span class="flex size-7 items-center justify-center rounded-lg bg-violet-500/10 text-violet-600 dark:text-violet-400">
+          <span
+            class="flex size-7 items-center justify-center rounded-lg bg-violet-500/10 text-violet-600 dark:text-violet-400"
+          >
             <UIcon
               name="i-lucide-trending-up"
               class="size-4"
             />
           </span>
-          {{ t('tags.statNew7d') }}
+          {{ t("tags.statNew7d") }}
         </div>
         <p :class="statValueClass">
           {{ stats.newIn7Days }}
@@ -443,7 +538,7 @@ async function confirmMerge() {
           icon="i-lucide-plus"
           @click="toggleCreating"
         >
-          {{ t('tags.addTag') }}
+          {{ t("tags.addTag") }}
         </UButton>
         <UButton
           type="button"
@@ -454,7 +549,7 @@ async function confirmMerge() {
           :disabled="selectedCount < 2"
           @click="openBatchMerge"
         >
-          {{ t('tags.mergeTags') }}
+          {{ t("tags.mergeTags") }}
         </UButton>
       </div>
     </div>
@@ -464,7 +559,7 @@ async function confirmMerge() {
       class="flex flex-wrap items-center justify-between gap-2 rounded-lg border border-primary/25 bg-primary/5 px-3 py-2"
     >
       <span class="text-xs font-medium text-highlighted">
-        {{ t('tags.mergeSelected', { n: selectedCount }) }}
+        {{ t("tags.mergeSelected", { n: selectedCount }) }}
       </span>
       <UButton
         size="xs"
@@ -472,7 +567,7 @@ async function confirmMerge() {
         color="neutral"
         @click="clearSelection"
       >
-        {{ t('tags.mergeClear') }}
+        {{ t("tags.mergeClear") }}
       </UButton>
     </div>
 
@@ -498,11 +593,9 @@ async function confirmMerge() {
           class="shrink-0 pt-1"
         >
           <p class="mb-1.5 text-xs text-muted">
-            {{ t('tags.preview') }}
+            {{ t("tags.preview") }}
           </p>
-          <TagBadge
+          <TagBadge :tag="{ id: 0, name: newName.trim(), color: newColor }" />
-            :tag="{ id: 0, name: newName.trim(), color: newColor }"
-          />
         </div>
       </div>
       <div class="flex justify-end gap-2 border-t border-default pt-3">
@@ -510,9 +603,13 @@ async function confirmMerge() {
           size="sm"
           variant="ghost"
           color="neutral"
-          @click="() => { creating = false }"
+          @click="
+            () => {
+              creating = false;
+            }
+          "
         >
-          {{ t('common.cancel') }}
+          {{ t("common.cancel") }}
         </UButton>
         <UButton
           size="sm"
@@ -521,59 +618,73 @@ async function confirmMerge() {
           :disabled="!newName.trim()"
           @click="handleCreate"
         >
-          {{ t('common.save') }}
+          {{ t("common.save") }}
         </UButton>
       </div>
     </div>
 
     <div class="overflow-hidden rounded-xl border border-default">
-      <div class="overflow-x-auto">
+      <div
-        <table
+        v-if="!paginatedTags.length"
-          class="min-w-full"
+        class="px-3 py-12 text-center text-sm text-muted"
-          :class="tableTextClass"
+      >
+        {{ tags.length ? t("tags.noMatch") : t("tags.emptyHint") }}
+      </div>
+
+      <!-- 手机：卡片列表 -->
+      <template v-else>
+        <div class="sm:hidden">
+          <div
+            class="flex items-center gap-2 border-b border-default bg-elevated/60 px-3 py-2.5 text-xs text-muted"
           >
-          <thead class="border-b border-default bg-elevated/60 text-xs text-muted">
-            <tr>
-              <th class="w-10 px-3 py-3">
             <UCheckbox
               :model-value="allPageSelected"
               :disabled="!paginatedTags.length"
               @update:model-value="toggleSelectAll"
             />
-              </th>
+            <span class="min-w-0 flex-1 font-medium">{{ t("tags.colName") }}</span>
-              <th class="px-3 py-3 text-left font-medium">
+            <button
-                {{ t('tags.colName') }}
+              type="button"
-              </th>
+              class="inline-flex shrink-0 items-center gap-0.5 font-medium text-inherit"
-              <th class="px-3 py-3 text-left font-medium">
+              @click="toggleSort('imageCount')"
-                {{ t('tags.colImageCount') }}
-              </th>
-              <th class="px-3 py-3 text-left font-medium">
-                {{ t('tags.colLastUsed') }}
-              </th>
-              <th class="px-3 py-3 text-right font-medium">
-                {{ t('tags.colActions') }}
-              </th>
-            </tr>
-          </thead>
-          <tbody>
-            <tr
-              v-for="tag in paginatedTags"
-              :key="tag.id"
-              class="border-b border-default last:border-b-0"
-              :class="selectedIds.has(tag.id) ? 'bg-primary/5' : 'hover:bg-elevated/40'"
             >
-              <td class="px-3 py-3 align-middle">
+              {{ t("tags.colImageCount") }}
+              <UIcon
+                :name="sortIcon('imageCount')"
+                :class="sortIconClass('imageCount')"
+              />
+            </button>
+            <button
+              type="button"
+              class="inline-flex shrink-0 items-center gap-0.5 font-medium text-inherit"
+              @click="toggleSort('lastUsedAt')"
+            >
+              {{ t("tags.colLastUsed") }}
+              <UIcon
+                :name="sortIcon('lastUsedAt')"
+                :class="sortIconClass('lastUsedAt')"
+              />
+            </button>
+          </div>
+
+          <article
+            v-for="tag in paginatedTags"
+            :key="`mobile-${tag.id}`"
+            class="border-b border-default px-3 py-3 last:border-b-0"
+            :class="selectedIds.has(tag.id) ? 'bg-primary/5' : ''"
+          >
+            <div class="flex items-start gap-2">
               <UCheckbox
+                class="mt-0.5"
                 :model-value="selectedIds.has(tag.id)"
                 @update:model-value="toggleSelect(tag.id)"
               />
-              </td>
+              <div class="min-w-0 flex-1">
-              <td class="px-3 py-3 align-middle">
                 <UInput
                   v-if="renamingId === tag.id"
                   v-model="renameValue"
                   size="sm"
-                  class="max-w-xs"
+                  class="w-full max-w-none"
                   autofocus
                   @keydown.enter.prevent="finishRename(tag.id)"
                   @keydown.esc.prevent="cancelRename"
@@ -583,16 +694,21 @@ async function confirmMerge() {
                   v-else
                   :tag="tag"
                   size="sm"
+                  class="max-w-full truncate"
                 />
-              </td>
+                <div
-              <td class="px-3 py-3 align-middle tabular-nums text-muted">
+                  class="mt-2 flex flex-wrap items-center gap-x-3 gap-y-1 text-xs text-muted"
-                {{ tag.imageCount ?? 0 }}
+                >
-              </td>
+                  <span class="tabular-nums">
-              <td class="px-3 py-3 align-middle text-muted">
+                    {{ t("tags.colImageCount") }} {{ tag.imageCount ?? 0 }}
+                  </span>
+                  <span class="min-w-0 break-all">
                     {{ formatLastUsed(tag) }}
-              </td>
+                  </span>
-              <td class="px-3 py-3 align-middle">
+                </div>
-                <div class="flex items-center justify-end gap-0.5">
+              </div>
+            </div>
+            <div class="mt-2 flex flex-wrap justify-end gap-0.5">
               <UButton
                 type="button"
                 size="xs"
@@ -605,7 +721,11 @@ async function confirmMerge() {
               <UPopover
                 :open="colorPickerId === tag.id"
                 :content="{ side: 'bottom', align: 'end' }"
-                    @update:open="(open) => { colorPickerId = open ? tag.id : null }"
+                @update:open="
+                  (open) => {
+                    colorPickerId = open ? tag.id : null;
+                  }
+                "
               >
                 <UButton
                   type="button"
@@ -658,19 +778,178 @@ async function confirmMerge() {
                 @click="openDeleteConfirm(tag)"
               />
             </div>
-              </td>
+          </article>
-            </tr>
-            <tr v-if="!paginatedTags.length">
-              <td
-                colspan="5"
-                class="px-3 py-12 text-center text-sm text-muted"
-              >
-                {{ tags.length ? t('tags.noMatch') : t('tags.emptyHint') }}
-              </td>
-            </tr>
-          </tbody>
-        </table>
         </div>
+
+        <!-- 桌面：表格 -->
+        <div class="hidden sm:block">
+          <div
+            class="border-b border-default bg-elevated/60 text-xs text-muted"
+            :class="[tagRowClass, tableTextClass, 'py-2.5']"
+          >
+            <div class="flex w-10 shrink-0 justify-center">
+              <UCheckbox
+                :model-value="allPageSelected"
+                :disabled="!paginatedTags.length"
+                @update:model-value="toggleSelectAll"
+              />
+            </div>
+            <div :class="[tagNameColClass, 'font-medium']">
+              {{ t("tags.colName") }}
+            </div>
+            <div :class="tagRightGroupClass">
+              <div :class="[tagCountColClass, 'font-medium']">
+                <button
+                  type="button"
+                  class="inline-flex items-center gap-0.5 font-medium text-inherit"
+                  @click="toggleSort('imageCount')"
+                >
+                  {{ t("tags.colImageCount") }}
+                  <UIcon
+                    :name="sortIcon('imageCount')"
+                    :class="sortIconClass('imageCount')"
+                  />
+                </button>
+              </div>
+              <div :class="[tagLastColClass, 'font-medium text-muted']">
+                <button
+                  type="button"
+                  class="inline-flex items-center gap-0.5 font-medium text-inherit"
+                  @click="toggleSort('lastUsedAt')"
+                >
+                  {{ t("tags.colLastUsed") }}
+                  <UIcon
+                    :name="sortIcon('lastUsedAt')"
+                    :class="sortIconClass('lastUsedAt')"
+                  />
+                </button>
+              </div>
+              <div :class="[tagActionsColClass, 'text-right font-medium']">
+                {{ t("tags.colActions") }}
+              </div>
+            </div>
+          </div>
+
+          <div
+            v-for="tag in paginatedTags"
+            :key="tag.id"
+            class="border-b border-default last:border-b-0"
+            :class="[
+              tagRowClass,
+              tableTextClass,
+              'py-0',
+              selectedIds.has(tag.id) ? 'bg-primary/5' : 'hover:bg-elevated/40'
+            ]"
+          >
+            <div class="flex w-10 shrink-0 justify-center py-3">
+              <UCheckbox
+                :model-value="selectedIds.has(tag.id)"
+                @update:model-value="toggleSelect(tag.id)"
+              />
+            </div>
+            <div :class="[tagNameColClass, 'py-3']">
+              <UInput
+                v-if="renamingId === tag.id"
+                v-model="renameValue"
+                size="sm"
+                class="max-w-xs"
+                autofocus
+                @keydown.enter.prevent="finishRename(tag.id)"
+                @keydown.esc.prevent="cancelRename"
+                @blur="onRenameBlur(tag.id)"
+              />
+              <TagBadge
+                v-else
+                :tag="tag"
+                size="sm"
+              />
+            </div>
+            <div :class="[tagRightGroupClass, 'py-3']">
+              <div :class="[tagCountColClass, 'text-muted']">
+                {{ tag.imageCount ?? 0 }}
+              </div>
+              <div :class="tagLastColClass">
+                {{ formatLastUsed(tag) }}
+              </div>
+              <div
+                :class="[
+                  tagActionsColClass,
+                  'flex items-center justify-end gap-0.5'
+                ]"
+              >
+                <UButton
+                  type="button"
+                  size="xs"
+                  variant="ghost"
+                  color="primary"
+                  icon="i-lucide-pencil"
+                  :aria-label="t('common.edit')"
+                  @click="startRename(tag)"
+                />
+                <UPopover
+                  :open="colorPickerId === tag.id"
+                  :content="{ side: 'bottom', align: 'end' }"
+                  @update:open="
+                    (open) => {
+                      colorPickerId = open ? tag.id : null;
+                    }
+                  "
+                >
+                  <UButton
+                    type="button"
+                    size="xs"
+                    variant="ghost"
+                    color="primary"
+                    icon="i-lucide-palette"
+                    :aria-label="t('tags.pickColor')"
+                    @click="() => openColorPicker(tag)"
+                  />
+                  <template #content>
+                    <div
+                      class="flex items-center gap-2 p-2"
+                      @click.stop
+                    >
+                      <TagColorPicker
+                        v-model="colorValue"
+                        :candidates="editColorCandidates"
+                        compact
+                      />
+                      <UButton
+                        icon="i-lucide-check"
+                        size="sm"
+                        color="primary"
+                        class="shrink-0"
+                        :aria-label="t('common.save')"
+                        :loading="saving"
+                        @click="saveColor(tag.id)"
+                      />
+                    </div>
+                  </template>
+                </UPopover>
+                <UButton
+                  type="button"
+                  size="xs"
+                  variant="ghost"
+                  color="primary"
+                  icon="i-lucide-merge"
+                  :aria-label="t('tags.mergeIntoAction')"
+                  :disabled="tags.length < 2"
+                  @click="openSingleMerge(tag)"
+                />
+                <UButton
+                  type="button"
+                  size="xs"
+                  variant="ghost"
+                  color="error"
+                  icon="i-lucide-trash-2"
+                  :aria-label="t('common.delete')"
+                  @click="openDeleteConfirm(tag)"
+                />
+              </div>
+            </div>
+          </div>
+        </div>
+      </template>
     </div>
 
     <PaginationBar
@@ -680,28 +959,46 @@ async function confirmMerge() {
       :total="filteredTags.length"
       :page-size="pageSize"
       :page-size-options="[10, 20, 30, 50]"
-      @update:page="(value) => { page = value }"
+      @update:page="
-      @update:page-size="(value) => { pageSize = value }"
+        (value) => {
+          page = value;
+        }
+      "
+      @update:page-size="
+        (value) => {
+          pageSize = value;
+        }
+      "
     />
 
     <UModal
       v-model:open="mergeOpen"
-      :title="mergeMode === 'single' ? t('tags.mergeIntoTitle') : t('tags.mergeTitle')"
+      :title="
-      :description="mergeMode === 'single'
+        mergeMode === 'single' ? t('tags.mergeIntoTitle') : t('tags.mergeTitle')
-        ? t('tags.mergeIntoSubtitle', { name: mergeSourceTags[0]?.name ?? '' })
+      "
-        : t('tags.mergeSubtitle')"
+      :description="
+        mergeMode === 'single'
+          ? t('tags.mergeIntoSubtitle', {
+            name: mergeSourceTags[0]?.name ?? ''
+          })
+          : t('tags.mergeSubtitle')
+      "
     >
       <template #body>
         <template v-if="mergeMode === 'batch'">
           <p class="mb-2 text-sm text-muted">
-            {{ t('tags.mergeChooseTarget') }}
+            {{ t("tags.mergeChooseTarget") }}
           </p>
           <div class="merge-tag-list max-h-[16.5rem] space-y-2 overflow-y-auto">
             <label
               v-for="tag in mergeSourceTags"
               :key="tag.id"
               class="flex cursor-pointer items-center gap-3 rounded-lg border border-default px-3 py-2.5 transition-colors"
-              :class="mergeTargetId === tag.id ? 'border-primary/40 bg-primary/5' : 'hover:bg-elevated'"
+              :class="
+                mergeTargetId === tag.id
+                  ? 'border-primary/40 bg-primary/5'
+                  : 'hover:bg-elevated'
+              "
             >
               <input
                 v-model="mergeTargetId"
@@ -711,7 +1008,7 @@ async function confirmMerge() {
               >
               <TagBadge :tag="tag" />
               <span class="ml-auto text-sm text-muted">
-                {{ t('common.countImages', { count: tag.imageCount ?? 0 }) }}
+                {{ t("common.countImages", { count: tag.imageCount ?? 0 }) }}
               </span>
             </label>
           </div>
@@ -719,14 +1016,18 @@ async function confirmMerge() {
 
         <template v-else>
           <p class="mb-2 text-sm text-muted">
-            {{ t('tags.mergeIntoChoose') }}
+            {{ t("tags.mergeIntoChoose") }}
           </p>
           <div class="merge-tag-list max-h-[16.5rem] space-y-2 overflow-y-auto">
             <label
               v-for="tag in mergeTargetCandidates"
               :key="tag.id"
               class="flex cursor-pointer items-center gap-3 rounded-lg border border-default px-3 py-2.5 transition-colors"
-              :class="mergeTargetId === tag.id ? 'border-primary/40 bg-primary/5' : 'hover:bg-elevated'"
+              :class="
+                mergeTargetId === tag.id
+                  ? 'border-primary/40 bg-primary/5'
+                  : 'hover:bg-elevated'
+              "
             >
               <input
                 v-model="mergeTargetId"
@@ -736,7 +1037,7 @@ async function confirmMerge() {
               >
               <TagBadge :tag="tag" />
               <span class="ml-auto text-sm text-muted">
-                {{ t('common.countImages', { count: tag.imageCount ?? 0 }) }}
+                {{ t("common.countImages", { count: tag.imageCount ?? 0 }) }}
               </span>
             </label>
           </div>
@@ -748,9 +1049,13 @@ async function confirmMerge() {
           <UButton
             variant="outline"
             color="neutral"
-            @click="() => { mergeOpen = false }"
+            @click="
+              () => {
+                mergeOpen = false;
+              }
+            "
           >
-            {{ t('common.cancel') }}
+            {{ t("common.cancel") }}
           </UButton>
           <UButton
             color="primary"
@@ -758,7 +1063,7 @@ async function confirmMerge() {
             :disabled="!mergeTargetId"
             @click="requestMergeConfirm"
           >
-            {{ t('tags.mergeConfirm') }}
+            {{ t("tags.mergeConfirm") }}
           </UButton>
         </div>
       </template>
@@ -772,12 +1077,14 @@ async function confirmMerge() {
       <template #body>
         <div class="space-y-3 text-sm">
           <p v-if="mergeKeepTag">
-            {{ t('tags.mergeConfirmKeep', { name: mergeKeepTag.name }) }}
+            {{ t("tags.mergeConfirmKeep", { name: mergeKeepTag.name }) }}
           </p>
           <p v-if="mergeTagsToDelete.length">
-            {{ t('tags.mergeWillDelete', {
+            {{
-              names: mergeTagsToDelete.map(tag => tag.name).join('、')
+              t("tags.mergeWillDelete", {
-            }) }}
+                names: mergeTagsToDelete.map((tag) => tag.name).join("、")
+              })
+            }}
           </p>
         </div>
       </template>
@@ -787,9 +1094,13 @@ async function confirmMerge() {
           <UButton
             variant="outline"
             color="neutral"
-            @click="() => { mergeConfirmOpen = false }"
+            @click="
+              () => {
+                mergeConfirmOpen = false;
+              }
+            "
           >
-            {{ t('common.cancel') }}
+            {{ t("common.cancel") }}
           </UButton>
           <UButton
             color="primary"
@@ -797,7 +1108,7 @@ async function confirmMerge() {
             :loading="saving"
             @click="confirmMerge"
           >
-            {{ t('tags.mergeConfirm') }}
+            {{ t("tags.mergeConfirm") }}
           </UButton>
         </div>
       </template>
@@ -806,16 +1117,24 @@ async function confirmMerge() {
     <UModal
       v-model:open="deleteOpen"
       :title="t('tags.deleteConfirmTitle')"
-      :description="deleteTarget ? t('tags.deleteConfirmDesc', { name: deleteTarget.name }) : ''"
+      :description="
+        deleteTarget
+          ? t('tags.deleteConfirmDesc', { name: deleteTarget.name })
+          : ''
+      "
     >
       <template #footer>
         <div class="flex w-full justify-end gap-2">
           <UButton
             variant="outline"
             color="neutral"
-            @click="() => { deleteOpen = false }"
+            @click="
+              () => {
+                deleteOpen = false;
+              }
+            "
           >
-            {{ t('common.cancel') }}
+            {{ t("common.cancel") }}
           </UButton>
           <UButton
             color="error"
@@ -823,7 +1142,7 @@ async function confirmMerge() {
             :loading="saving"
             @click="confirmDelete"
           >
-            {{ t('common.delete') }}
+            {{ t("common.delete") }}
           </UButton>
         </div>
       </template>

app/components/api/ApiDocView.vue

@@ -38,19 +38,26 @@ const { t } = useI18n()
         </h3>
       </div>
       <div class="overflow-x-auto">
-        <table class="w-full min-w-[32rem] text-left text-sm">
+        <table class="w-full min-w-[36rem] table-fixed text-left text-sm">
+          <colgroup>
+            <col class="w-[5.5rem]">
+            <col class="w-[3.5rem]">
+            <col class="w-[5.75rem]">
+            <col class="w-[3.25rem]">
+            <col>
+          </colgroup>
           <thead>
             <tr class="border-b border-default text-xs text-muted">
               <th class="px-4 py-2.5 font-medium">
                 {{ t('api.paramName') }}
               </th>
-              <th class="px-4 py-2.5 font-medium">
+              <th class="whitespace-nowrap px-4 py-2.5 font-medium">
                 {{ t('api.paramType') }}
               </th>
-              <th class="px-4 py-2.5 font-medium">
+              <th class="whitespace-nowrap px-4 py-2.5 font-medium">
                 {{ t('api.paramLocation') }}
               </th>
-              <th class="px-4 py-2.5 font-medium">
+              <th class="whitespace-nowrap px-4 py-2.5 font-medium">
                 {{ t('api.paramRequired') }}
               </th>
               <th class="px-4 py-2.5 font-medium">
@@ -64,20 +71,20 @@ const { t } = useI18n()
               :key="param.name"
               class="border-b border-default last:border-b-0"
             >
-              <td class="px-4 py-2.5 font-mono text-xs">
+              <td class="whitespace-nowrap px-4 py-2.5 font-mono text-xs">
                 {{ param.name }}
                 <span
                   v-if="param.required"
                   class="text-error"
                 >*</span>
               </td>
-              <td class="px-4 py-2.5 text-muted">
+              <td class="whitespace-nowrap px-4 py-2.5 text-muted">
                 {{ param.type }}
               </td>
-              <td class="px-4 py-2.5 text-muted">
+              <td class="whitespace-nowrap px-4 py-2.5 text-muted">
                 {{ param.location }}
               </td>
-              <td class="px-4 py-2.5">
+              <td class="whitespace-nowrap px-4 py-2.5">
                 <UBadge
                   :color="param.required ? 'primary' : 'neutral'"
                   variant="subtle"
@@ -86,7 +93,7 @@ const { t } = useI18n()
                   {{ param.required ? t('api.required') : t('api.optional') }}
                 </UBadge>
               </td>
-              <td class="px-4 py-2.5 text-muted">
+              <td class="px-4 py-2.5 leading-relaxed text-muted break-words">
                 {{ t(param.descriptionKey) }}
               </td>
             </tr>

app/components/api/ApiTokenCard.vue

@@ -75,15 +75,6 @@ async function copyToken() {
         :description="t('api.envOverrideDesc')"
       />
 
-      <UAlert
-        v-else-if="!isAdmin"
-        color="info"
-        variant="subtle"
-        icon="i-lucide-info"
-        :title="t('api.personalTitle')"
-        :description="t('api.personalDesc')"
-      />
-
       <UAlert
         v-else-if="!token && !loading"
         color="info"

app/components/settings/SettingsUploadPolicyFields.vue

@@ -0,0 +1,329 @@
+<script setup lang="ts">
+type PolicySource = 'env' | 'db' | 'default'
+type MimeType = 'image/jpeg' | 'image/png' | 'image/webp' | 'image/gif' | 'image/svg+xml' | 'image/x-icon'
+
+defineProps<{
+  part: 'upload-preference' | 'image-processing' | 'login-rate'
+  uploadMaxFileSizeMbSource?: PolicySource
+  allowedMimeTypesSource?: PolicySource
+  uploadRateIpMaxSource?: PolicySource
+  uploadRateTokenMaxSource?: PolicySource
+  uploadRateWindowMinutesSource?: PolicySource
+  loginRateMaxSource?: PolicySource
+  loginRateWindowMinutesSource?: PolicySource
+  preserveOriginalUploadSource?: PolicySource
+  mimeTypeOptions?: ReadonlyArray<{ mime: MimeType, label: string }>
+}>()
+
+const uploadMaxFileSizeMbDraft = defineModel<number>('uploadMaxFileSizeMb')
+const allowedMimeTypesDraft = defineModel<MimeType[]>('allowedMimeTypes')
+const uploadRateIpMaxDraft = defineModel<number>('uploadRateIpMax')
+const uploadRateTokenMaxDraft = defineModel<number>('uploadRateTokenMax')
+const uploadRateWindowMinutesDraft = defineModel<number>('uploadRateWindowMinutes')
+const loginRateMaxDraft = defineModel<number>('loginRateMax')
+const loginRateWindowMinutesDraft = defineModel<number>('loginRateWindowMinutes')
+const preserveOriginalUploadDraft = defineModel<boolean>('preserveOriginalUpload')
+
+const { t } = useI18n()
+
+function sourceBadge(source: PolicySource) {
+  switch (source) {
+    case 'env':
+      return { label: t('settings.badgeEnv'), color: 'warning' as const }
+    case 'db':
+      return { label: t('settings.badgeSaved'), color: 'success' as const }
+    default:
+      return { label: t('settings.badgeDefault'), color: 'neutral' as const }
+  }
+}
+
+function toggleMime(mime: MimeType, checked: boolean) {
+  if (!allowedMimeTypesDraft.value) return
+  if (checked) {
+    if (!allowedMimeTypesDraft.value.includes(mime)) {
+      allowedMimeTypesDraft.value = [...allowedMimeTypesDraft.value, mime]
+    }
+    return
+  }
+  if (allowedMimeTypesDraft.value.length <= 1) return
+  allowedMimeTypesDraft.value = allowedMimeTypesDraft.value.filter(item => item !== mime)
+}
+
+function isMimeChecked(mime: MimeType): boolean {
+  return allowedMimeTypesDraft.value?.includes(mime) ?? false
+}
+
+function clampUploadMaxFileSizeMb(value: unknown): number {
+  const num = Number(value)
+  if (!Number.isFinite(num)) return uploadMaxFileSizeMbDraft.value ?? 10
+  return Math.min(100, Math.max(1, Math.round(num)))
+}
+
+function onUploadMaxFileSizeInput(event: Event) {
+  uploadMaxFileSizeMbDraft.value = clampUploadMaxFileSizeMb(
+    (event.target as HTMLInputElement).value
+  )
+}
+
+function onUploadMaxFileSizeNumberInput(value: string | number) {
+  uploadMaxFileSizeMbDraft.value = clampUploadMaxFileSizeMb(value)
+}
+</script>
+
+<template>
+  <template v-if="part === 'upload-preference'">
+    <div class="py-4">
+      <div class="flex flex-wrap items-center gap-2">
+        <p class="text-sm font-medium text-highlighted">
+          {{ t('settings.uploadMaxFileSize') }}
+        </p>
+        <UBadge
+          v-if="uploadMaxFileSizeMbSource"
+          :color="sourceBadge(uploadMaxFileSizeMbSource).color"
+          variant="subtle"
+          size="xs"
+        >
+          {{ sourceBadge(uploadMaxFileSizeMbSource).label }}
+        </UBadge>
+      </div>
+      <p class="mt-1 text-xs leading-relaxed text-muted">
+        {{ t('settings.uploadMaxFileSizeHint') }}
+      </p>
+      <div
+        class="mt-3 flex items-center gap-3"
+        :class="uploadMaxFileSizeMbSource === 'env' ? 'pointer-events-none opacity-60' : ''"
+      >
+        <input
+          type="range"
+          min="1"
+          max="100"
+          :value="uploadMaxFileSizeMbDraft"
+          class="h-1.5 min-w-0 flex-1 cursor-pointer appearance-none rounded-full bg-muted accent-primary"
+          :disabled="uploadMaxFileSizeMbSource === 'env'"
+          @input="onUploadMaxFileSizeInput"
+        >
+        <div class="flex shrink-0 items-center gap-1.5">
+          <UInput
+            :model-value="uploadMaxFileSizeMbDraft"
+            type="number"
+            :min="1"
+            :max="100"
+            size="xs"
+            class="w-14 tabular-nums"
+            :disabled="uploadMaxFileSizeMbSource === 'env'"
+            @update:model-value="onUploadMaxFileSizeNumberInput"
+          />
+          <span class="text-xs text-muted">MB</span>
+        </div>
+      </div>
+    </div>
+
+    <div class="py-4">
+      <div class="flex flex-wrap items-center gap-2">
+        <p class="text-sm font-medium text-highlighted">
+          {{ t('settings.allowedMimeTypes') }}
+        </p>
+        <UBadge
+          v-if="allowedMimeTypesSource"
+          :color="sourceBadge(allowedMimeTypesSource).color"
+          variant="subtle"
+          size="xs"
+        >
+          {{ sourceBadge(allowedMimeTypesSource).label }}
+        </UBadge>
+      </div>
+      <p class="mt-1 text-xs leading-relaxed text-muted">
+        {{ t('settings.allowedMimeTypesHint') }}
+      </p>
+      <div
+        class="mt-3 flex flex-wrap gap-2"
+        :class="allowedMimeTypesSource === 'env' ? 'pointer-events-none opacity-60' : ''"
+      >
+        <label
+          v-for="option in mimeTypeOptions ?? []"
+          :key="option.mime"
+          class="inline-flex cursor-pointer items-center gap-2 rounded-lg border px-3 py-2 text-sm transition-colors"
+          :class="isMimeChecked(option.mime)
+            ? 'border-primary/40 bg-primary/5'
+            : 'border-default bg-muted/20 hover:bg-muted/40'"
+          :title="option.mime"
+        >
+          <UCheckbox
+            :model-value="isMimeChecked(option.mime)"
+            @update:model-value="(v) => toggleMime(option.mime, v === true)"
+            @click.stop
+          />
+          <span class="font-medium text-highlighted">{{ option.label }}</span>
+        </label>
+      </div>
+    </div>
+
+    <div class="py-4">
+      <p class="text-sm font-medium text-highlighted">
+        {{ t('settings.uploadRateGroup') }}
+      </p>
+      <p class="mt-1 text-xs leading-relaxed text-muted">
+        {{ t('settings.uploadRateFootnote') }}
+      </p>
+      <div class="mt-3 grid gap-4 sm:grid-cols-3">
+        <div>
+          <div class="flex flex-wrap items-center gap-2">
+            <p class="text-xs font-medium text-muted">
+              {{ t('settings.uploadRateIpMax') }}
+            </p>
+            <UBadge
+              v-if="uploadRateIpMaxSource"
+              :color="sourceBadge(uploadRateIpMaxSource).color"
+              variant="subtle"
+              size="xs"
+            >
+              {{ sourceBadge(uploadRateIpMaxSource).label }}
+            </UBadge>
+          </div>
+          <UInput
+            v-model.number="uploadRateIpMaxDraft"
+            type="number"
+            :min="1"
+            :max="1000"
+            size="sm"
+            class="mt-2 w-full tabular-nums"
+            :disabled="uploadRateIpMaxSource === 'env'"
+          />
+        </div>
+        <div>
+          <div class="flex flex-wrap items-center gap-2">
+            <p class="text-xs font-medium text-muted">
+              {{ t('settings.uploadRateTokenMax') }}
+            </p>
+            <UBadge
+              v-if="uploadRateTokenMaxSource"
+              :color="sourceBadge(uploadRateTokenMaxSource).color"
+              variant="subtle"
+              size="xs"
+            >
+              {{ sourceBadge(uploadRateTokenMaxSource).label }}
+            </UBadge>
+          </div>
+          <UInput
+            v-model.number="uploadRateTokenMaxDraft"
+            type="number"
+            :min="1"
+            :max="5000"
+            size="sm"
+            class="mt-2 w-full tabular-nums"
+            :disabled="uploadRateTokenMaxSource === 'env'"
+          />
+        </div>
+        <div>
+          <div class="flex flex-wrap items-center gap-2">
+            <p class="text-xs font-medium text-muted">
+              {{ t('settings.uploadRateWindowMinutes') }}
+            </p>
+            <UBadge
+              v-if="uploadRateWindowMinutesSource"
+              :color="sourceBadge(uploadRateWindowMinutesSource).color"
+              variant="subtle"
+              size="xs"
+            >
+              {{ sourceBadge(uploadRateWindowMinutesSource).label }}
+            </UBadge>
+          </div>
+          <div class="mt-2 flex items-center gap-2">
+            <UInput
+              v-model.number="uploadRateWindowMinutesDraft"
+              type="number"
+              :min="1"
+              :max="1440"
+              size="sm"
+              class="w-full tabular-nums"
+              :disabled="uploadRateWindowMinutesSource === 'env'"
+            />
+            <span class="shrink-0 text-xs text-muted">{{ t('settings.minutesUnit') }}</span>
+          </div>
+        </div>
+      </div>
+    </div>
+  </template>
+
+  <SettingsToggleRow
+    v-else-if="part === 'image-processing'"
+    v-model="preserveOriginalUploadDraft!"
+    :disabled="preserveOriginalUploadSource === 'env'"
+  >
+    <template #title>
+      <span class="inline-flex flex-wrap items-center gap-2">
+        {{ t('settings.preserveOriginalUpload') }}
+        <UBadge
+          v-if="preserveOriginalUploadSource"
+          :color="sourceBadge(preserveOriginalUploadSource).color"
+          variant="subtle"
+          size="xs"
+        >
+          {{ sourceBadge(preserveOriginalUploadSource).label }}
+        </UBadge>
+      </span>
+    </template>
+    <template #hint>
+      {{ t('settings.preserveOriginalUploadHint') }}
+    </template>
+  </SettingsToggleRow>
+
+  <template v-else-if="part === 'login-rate'">
+    <div class="grid gap-4 py-4 sm:grid-cols-2">
+      <div>
+        <div class="flex flex-wrap items-center gap-2">
+          <p class="text-sm font-medium text-highlighted">
+            {{ t('settings.loginRateMax') }}
+          </p>
+          <UBadge
+            v-if="loginRateMaxSource"
+            :color="sourceBadge(loginRateMaxSource).color"
+            variant="subtle"
+            size="xs"
+          >
+            {{ sourceBadge(loginRateMaxSource).label }}
+          </UBadge>
+        </div>
+        <UInput
+          v-model.number="loginRateMaxDraft"
+          type="number"
+          :min="1"
+          :max="100"
+          size="sm"
+          class="mt-2 w-full tabular-nums"
+          :disabled="loginRateMaxSource === 'env'"
+        />
+      </div>
+      <div>
+        <div class="flex flex-wrap items-center gap-2">
+          <p class="text-sm font-medium text-highlighted">
+            {{ t('settings.loginRateWindowMinutes') }}
+          </p>
+          <UBadge
+            v-if="loginRateWindowMinutesSource"
+            :color="sourceBadge(loginRateWindowMinutesSource).color"
+            variant="subtle"
+            size="xs"
+          >
+            {{ sourceBadge(loginRateWindowMinutesSource).label }}
+          </UBadge>
+        </div>
+        <div class="mt-2 flex items-center gap-2">
+          <UInput
+            v-model.number="loginRateWindowMinutesDraft"
+            type="number"
+            :min="1"
+            :max="1440"
+            size="sm"
+            class="w-full tabular-nums"
+            :disabled="loginRateWindowMinutesSource === 'env'"
+          />
+          <span class="shrink-0 text-xs text-muted">{{ t('settings.minutesUnit') }}</span>
+        </div>
+      </div>
+    </div>
+    <p class="pb-4 text-xs leading-relaxed text-muted">
+      {{ t('settings.loginRateFootnote') }}
+    </p>
+  </template>
+</template>

app/components/settings/SettingsUserPreferencesFields.vue

@@ -1,4 +1,8 @@
 <script setup lang="ts">
+defineProps<{
+  part: 'upload-preference' | 'image-processing'
+}>()
+
 const {
   compressEnabled,
   autoCopyMarkdown,
@@ -44,8 +48,7 @@ onMounted(() => {
 </script>
 
 <template>
-  <SettingsSection :title="t('preferences.processing')">
+  <template v-if="part === 'image-processing'">
-    <SettingsGroup>
     <SettingsToggleRow
       v-model="compressEnabled"
       :title="t('preferences.clientCompress')"
@@ -116,11 +119,9 @@ onMounted(() => {
         />
       </div>
     </div>
-    </SettingsGroup>
+  </template>
-  </SettingsSection>
 
-  <SettingsSection :title="t('preferences.title')">
+  <template v-else>
-    <SettingsGroup>
     <SettingsToggleRow
       v-model="autoCopyMarkdown"
       :title="t('preferences.autoCopy')"
@@ -149,6 +150,5 @@ onMounted(() => {
         />
       </div>
     </div>
-    </SettingsGroup>
+  </template>
-  </SettingsSection>
 </template>

app/composables/useApiDocs.ts

@@ -73,11 +73,19 @@ export function buildApiDocs(ctx: ApiDocsContext): ApiDocEndpoint[] {
           location: 'form-data',
           required: false,
           descriptionKey: 'api.params.upload.token'
+        },
+        {
+          name: 'tagNames',
+          type: 'string',
+          location: 'form-data',
+          required: false,
+          descriptionKey: 'api.params.upload.tagNames'
         }
       ],
       curl: `curl -X POST "${baseUrl}/api/images/upload" \\
   ${auth} \\
-  -F "image=@./demo.png"`,
+  -F "image=@./demo.png" \\
+  -F 'tagNames=["博客","截图"]'`,
       responseExample: `{
   "success": true,
   "items": [

app/composables/useImageUpload.ts

@@ -11,6 +11,7 @@ export function useImageUpload() {
   const toast = useToast()
   const { t } = useI18n()
   const { compressEnabled, clientWebpQuality, lastTagIds } = useUploadPreferences()
+  const { items: tagItems } = useTags()
   const uploading = ref(false)
   const progressItems = ref<UploadProgressItem[]>([])
   const lastUploadResult = ref<UploadResponse | null>(null)
@@ -60,7 +61,12 @@ export function useImageUpload() {
 
       const tagIds = options?.tagIds ?? lastTagIds.value
       if (tagIds.length) {
-        formData.append('tagIds', JSON.stringify(tagIds))
+        const names = tagIds
+          .map(id => tagItems.value.find(tag => tag.id === id)?.name)
+          .filter((name): name is string => Boolean(name))
+        if (names.length) {
+          formData.append('tagNames', JSON.stringify(names))
+        }
         lastTagIds.value = tagIds
       }
 

app/pages/api.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-interface SettingsResponse {
+interface UserTokenResponse {
   apiUploadToken: string
   tokenSource: 'env' | 'db' | 'none'
   envTokenOverride: boolean
@@ -16,7 +16,7 @@ const { isChecking, isAuthenticated, checkSession, handleAuthError, fetchStatus,
 const toast = useToast()
 const { t } = useI18n()
 
-const settings = ref<SettingsResponse | null>(null)
+const tokenSettings = ref<UserTokenResponse | null>(null)
 const loading = ref(false)
 const regenerating = ref(false)
 const confirmRegenerateOpen = ref(false)
@@ -25,19 +25,17 @@ const newToken = ref('')
 const activeEndpointId = ref('upload')
 
 const baseUrl = computed(() => {
-  const configured = settings.value?.env.siteBaseUrl
+  const configured = tokenSettings.value?.env.siteBaseUrl
   if (configured) return configured
   if (import.meta.client) {
     return window.location.origin
   }
-  return settings.value?.env.imageBaseUrl ?? ''
+  return tokenSettings.value?.env.imageBaseUrl ?? ''
 })
 
-const tokenDisplay = computed(() => settings.value?.apiUploadToken ?? '')
+const tokenDisplay = computed(() => tokenSettings.value?.apiUploadToken ?? '')
 const hasToken = computed(() => tokenDisplay.value.length > 0)
-const canRegenerate = computed(() =>
+const canRegenerate = computed(() => !loading.value)
-  !settings.value?.envTokenOverride && !loading.value
-)
 
 const authHeader = computed(() =>
   hasToken.value ? tokenDisplay.value : 'YOUR-TOKEN'
@@ -54,11 +52,10 @@ const activeEndpoint = computed(() =>
   apiDocs.value.find(endpoint => endpoint.id === activeEndpointId.value) ?? apiDocs.value[0]
 )
 
-async function loadSettings() {
+async function loadTokenSettings() {
   loading.value = true
   try {
-    const endpoint = isAdmin.value ? '/api/settings' : '/api/user/api-token'
+    tokenSettings.value = await $fetch<UserTokenResponse>('/api/user/api-token', {
-    settings.value = await $fetch<SettingsResponse>(endpoint, {
       credentials: 'include'
     })
   } catch (error: unknown) {
@@ -66,6 +63,7 @@ async function loadSettings() {
     if (isAuthenticated.value) {
       toast.add({ title: t('api.loadFailed'), color: 'error' })
     }
+    tokenSettings.value = null
   } finally {
     loading.value = false
   }
@@ -80,31 +78,18 @@ async function confirmRegenerate() {
   confirmRegenerateOpen.value = false
   regenerating.value = true
   try {
-    const endpoint = isAdmin.value
-      ? '/api/settings/api-token/regenerate'
-      : '/api/user/api-token/regenerate'
     const response = await $fetch<{ apiUploadToken: string }>(
-      endpoint,
+      '/api/user/api-token/regenerate',
       { method: 'POST', credentials: 'include' }
     )
     newToken.value = response.apiUploadToken
     regenerateResultOpen.value = true
-    await loadSettings()
+    await loadTokenSettings()
   } catch (error: unknown) {
     handleAuthError(error)
     if (isAuthenticated.value) {
-      const status = typeof error === 'object' && error !== null && 'statusCode' in error
-        ? (error as { statusCode: number }).statusCode
-        : 0
-      if (status === 409) {
-        toast.add({
-          title: t('api.regenerateEnvBlocked'),
-          color: 'warning'
-        })
-      } else {
       toast.add({ title: t('api.regenerateFailed'), color: 'error' })
     }
-    }
   } finally {
     regenerating.value = false
   }
@@ -126,16 +111,16 @@ onMounted(async () => {
   }
   await checkSession()
   if (isAuthenticated.value) {
-    await loadSettings()
+    await loadTokenSettings()
   }
 })
 
 watch(isAuthenticated, async (authed, prev) => {
   if (authed && prev === false) {
     await nextTick()
-    await loadSettings()
+    await loadTokenSettings()
   } else {
-    settings.value = null
+    tokenSettings.value = null
   }
 })
 </script>
@@ -174,8 +159,7 @@ watch(isAuthenticated, async (authed, prev) => {
               :loading="loading"
               :regenerating="regenerating"
               :can-regenerate="canRegenerate"
-              :token-source="settings?.tokenSource"
+              token-source="db"
-              :env-token-override="settings?.envTokenOverride"
               :is-admin="isAdmin"
               @regenerate="requestRegenerate"
             />

app/pages/gallery.vue

@@ -57,7 +57,7 @@ const {
 
 const { items: tagItems, fetchTags, batchUpdateTags } = useTags()
 
-const { isChecking, isAuthenticated, checkSession, handleAuthError, fetchStatus } = useAuth()
+const { isChecking, isAuthenticated, checkSession, handleAuthError, fetchStatus, getFetchErrorMessage } = useAuth()
 const toast = useToast()
 const { t } = useI18n()
 
@@ -256,7 +256,10 @@ async function confirmBatchTags(tagIds: number[], action: 'add' | 'remove') {
     await Promise.all([reloadGallery(), fetchStats(), fetchTags(true)])
   } catch (error: unknown) {
     handleAuthError(error)
-    toast.add({ title: t('tags.batchFailed'), color: 'error' })
+    toast.add({
+      title: getFetchErrorMessage(error, t('tags.batchFailed')),
+      color: 'error'
+    })
   }
 }
 

app/pages/settings/index.vue

@@ -3,10 +3,13 @@ import type { SettingsTab } from '~/types/settings'
 import { ADMIN_SETTINGS_TABS, USER_SETTINGS_TABS } from '~/types/settings'
 import { willActivateDomainSeparation } from '~/utils/domain-separation'
 import SettingsUserPreferencesFields from '~/components/settings/SettingsUserPreferencesFields.vue'
+import SettingsUploadPolicyFields from '~/components/settings/SettingsUploadPolicyFields.vue'
 
 type SettingSource = 'env' | 'db' | 'none'
 type WebpQualitySource = 'env' | 'db' | 'default'
+type PolicySource = 'env' | 'db' | 'default'
 type LoginVerificationMethod = 'slider' | 'turnstile' | 'cap'
+type MimeType = 'image/jpeg' | 'image/png' | 'image/webp' | 'image/gif' | 'image/svg+xml' | 'image/x-icon'
 
 interface SettingsResponse {
   apiUploadToken: string
@@ -42,6 +45,23 @@ interface SettingsResponse {
   capApiEndpoint: string
   capSecret: string
   appVersion: string
+  uploadMaxFileSizeMb: number
+  uploadMaxFileSizeMbSource: PolicySource
+  allowedMimeTypes: MimeType[]
+  allowedMimeTypesSource: PolicySource
+  uploadRateIpMax: number
+  uploadRateIpMaxSource: PolicySource
+  uploadRateTokenMax: number
+  uploadRateTokenMaxSource: PolicySource
+  uploadRateWindowMinutes: number
+  uploadRateWindowMinutesSource: PolicySource
+  loginRateMax: number
+  loginRateMaxSource: PolicySource
+  loginRateWindowMinutes: number
+  loginRateWindowMinutesSource: PolicySource
+  preserveOriginalUpload: boolean
+  preserveOriginalUploadSource: PolicySource
+  mimeTypeOptions: ReadonlyArray<{ mime: MimeType, label: string }>
 }
 
 const { isChecking, isAuthenticated, checkSession, handleAuthError, fetchStatus, isAdmin } = useAuth()
@@ -143,6 +163,15 @@ const disableDomainSeparationOpen = ref(false)
 const pendingDomainSeparationDisable = ref(false)
 const domainSeparationSaveConfirmOpen = ref(false)
 
+const uploadMaxFileSizeMbDraft = ref(10)
+const allowedMimeTypesDraft = ref<MimeType[]>([])
+const uploadRateIpMaxDraft = ref(60)
+const uploadRateTokenMaxDraft = ref(120)
+const uploadRateWindowMinutesDraft = ref(15)
+const loginRateMaxDraft = ref(10)
+const loginRateWindowMinutesDraft = ref(15)
+const preserveOriginalUploadDraft = ref(false)
+
 interface ReleaseCheckResponse {
   currentVersion: string
   latestVersion: string | null
@@ -152,6 +181,10 @@ interface ReleaseCheckResponse {
 
 const releaseCheck = ref<ReleaseCheckResponse | null>(null)
 
+function mimeListsEqual(left: readonly string[], right: readonly string[]): boolean {
+  return left.slice().sort().join(',') === right.slice().sort().join(',')
+}
+
 const hasServerChanges = computed(() => {
   if (!settings.value) return false
   return refererDraft.value !== settings.value.allowedRefererHosts
@@ -166,6 +199,14 @@ const hasServerChanges = computed(() => {
     || turnstileSecretKeyDraft.value !== settings.value.turnstileSecretKey
     || capApiEndpointDraft.value !== settings.value.capApiEndpoint
     || capSecretDraft.value !== settings.value.capSecret
+    || uploadMaxFileSizeMbDraft.value !== settings.value.uploadMaxFileSizeMb
+    || !mimeListsEqual(allowedMimeTypesDraft.value, settings.value.allowedMimeTypes)
+    || uploadRateIpMaxDraft.value !== settings.value.uploadRateIpMax
+    || uploadRateTokenMaxDraft.value !== settings.value.uploadRateTokenMax
+    || uploadRateWindowMinutesDraft.value !== settings.value.uploadRateWindowMinutes
+    || loginRateMaxDraft.value !== settings.value.loginRateMax
+    || loginRateWindowMinutesDraft.value !== settings.value.loginRateWindowMinutes
+    || preserveOriginalUploadDraft.value !== settings.value.preserveOriginalUpload
 })
 
 const domainSeparationWouldActivate = computed(() =>
@@ -221,6 +262,14 @@ function applySettings(data: SettingsResponse) {
   capApiEndpointDraft.value = data.capApiEndpoint
   capSecretDraft.value = data.capSecret
   domainSeparationDraft.value = data.domainSeparation
+  uploadMaxFileSizeMbDraft.value = data.uploadMaxFileSizeMb
+  allowedMimeTypesDraft.value = [...data.allowedMimeTypes]
+  uploadRateIpMaxDraft.value = data.uploadRateIpMax
+  uploadRateTokenMaxDraft.value = data.uploadRateTokenMax
+  uploadRateWindowMinutesDraft.value = data.uploadRateWindowMinutes
+  loginRateMaxDraft.value = data.loginRateMax
+  loginRateWindowMinutesDraft.value = data.loginRateWindowMinutes
+  preserveOriginalUploadDraft.value = data.preserveOriginalUpload
 }
 
 async function patchSettings(body: Record<string, unknown>) {
@@ -296,6 +345,11 @@ async function performSaveServerSettings() {
 
   savingServer.value = true
   try {
+    if (allowedMimeTypesDraft.value.length === 0) {
+      toast.add({ title: t('settings.allowedMimeTypesHint'), color: 'error' })
+      return
+    }
+
     await patchSettings({
       allowedRefererHosts: refererDraft.value,
       domainSeparation: domainSeparationDraft.value,
@@ -308,7 +362,15 @@ async function performSaveServerSettings() {
       turnstileSiteKey: turnstileSiteKeyDraft.value,
       turnstileSecretKey: turnstileSecretKeyDraft.value,
       capApiEndpoint: capApiEndpointDraft.value,
-      capSecret: capSecretDraft.value
+      capSecret: capSecretDraft.value,
+      uploadMaxFileSizeMb: uploadMaxFileSizeMbDraft.value,
+      allowedMimeTypes: allowedMimeTypesDraft.value,
+      uploadRateIpMax: uploadRateIpMaxDraft.value,
+      uploadRateTokenMax: uploadRateTokenMaxDraft.value,
+      uploadRateWindowMinutes: uploadRateWindowMinutesDraft.value,
+      loginRateMax: loginRateMaxDraft.value,
+      loginRateWindowMinutes: loginRateWindowMinutesDraft.value,
+      preserveOriginalUpload: preserveOriginalUploadDraft.value
     })
     toast.add({ title: t('settings.saved'), color: 'success' })
   } catch (error: unknown) {
@@ -492,7 +554,42 @@ watch(isAdmin, () => {
                     </SettingsGroup>
                   </SettingsSection>
 
-                  <SettingsUserPreferencesFields />
+                  <SettingsSection
+                    :title="t('preferences.title')"
+                    :hint="t('settings.uploadLimitsHint')"
+                  >
+                    <SettingsGroup>
+                      <SettingsUploadPolicyFields
+                        v-model:upload-max-file-size-mb="uploadMaxFileSizeMbDraft"
+                        v-model:allowed-mime-types="allowedMimeTypesDraft"
+                        v-model:upload-rate-ip-max="uploadRateIpMaxDraft"
+                        v-model:upload-rate-token-max="uploadRateTokenMaxDraft"
+                        v-model:upload-rate-window-minutes="uploadRateWindowMinutesDraft"
+                        part="upload-preference"
+                        :upload-max-file-size-mb-source="settings.uploadMaxFileSizeMbSource"
+                        :allowed-mime-types-source="settings.allowedMimeTypesSource"
+                        :upload-rate-ip-max-source="settings.uploadRateIpMaxSource"
+                        :upload-rate-token-max-source="settings.uploadRateTokenMaxSource"
+                        :upload-rate-window-minutes-source="settings.uploadRateWindowMinutesSource"
+                        :mime-type-options="settings.mimeTypeOptions"
+                      />
+                      <SettingsUserPreferencesFields part="upload-preference" />
+                    </SettingsGroup>
+                  </SettingsSection>
+
+                  <SettingsSection
+                    :title="t('preferences.processing')"
+                    :hint="t('settings.imageProcessingHint')"
+                  >
+                    <SettingsGroup>
+                      <SettingsUploadPolicyFields
+                        v-model:preserve-original-upload="preserveOriginalUploadDraft"
+                        part="image-processing"
+                        :preserve-original-upload-source="settings.preserveOriginalUploadSource"
+                      />
+                      <SettingsUserPreferencesFields part="image-processing" />
+                    </SettingsGroup>
+                  </SettingsSection>
 
                   <SettingsSection :title="t('settings.systemInfo')">
                     <SettingsGroup>
@@ -897,6 +994,21 @@ watch(isAdmin, () => {
                       </div>
                     </SettingsGroup>
                   </SettingsSection>
+
+                  <SettingsSection
+                    :title="t('settings.rateLimits')"
+                    :hint="t('settings.loginRateLimitsHint')"
+                  >
+                    <SettingsGroup>
+                      <SettingsUploadPolicyFields
+                        v-model:login-rate-max="loginRateMaxDraft"
+                        v-model:login-rate-window-minutes="loginRateWindowMinutesDraft"
+                        part="login-rate"
+                        :login-rate-max-source="settings.loginRateMaxSource"
+                        :login-rate-window-minutes-source="settings.loginRateWindowMinutesSource"
+                      />
+                    </SettingsGroup>
+                  </SettingsSection>
                 </SettingsPanel>
                 <div
                   v-else

docs-site/en/guide/api.md

@@ -12,10 +12,10 @@ All REST calls use:
 Auth-Token: YOUR_TOKEN
 ```
 
-| Token type | How to obtain | Notes |
+| Token | How to obtain | Notes |
-| ---------- | ------------- | ----- |
+| ----- | ------------- | ----- |
-| **Global** | Admin **API** page or `API_UPLOAD_TOKEN` env | Env wins and blocks UI regenerate |
+| **API token** | **API** page after sign-in (one per account, auto-created) | `Auth-Token` header; uploads and tagNames belong to that account |
-| **Personal** | Each user’s **API** page | Uploads belong to that user |
+| **Legacy site token** | `API_UPLOAD_TOKEN` env or old admin setting | Still accepted; uploads belong to the **first admin**. Twikoo form `token` also accepts each user’s API token |
 
 Form uploads may use field `token` (Twikoo protocol).
 
@@ -31,10 +31,10 @@ Upload one or more images via `image`; also accepts `file`, `files`. Stored unde
 curl -X POST "https://admin.example.com/api/images/upload" \
   -H "Auth-Token: YOUR_TOKEN" \
   -F "image=@./demo.png" \
-  -F 'tagIds=[1,2]'
+  -F 'tagNames=["blog","screenshot"]'
 ```
 
-Optional form field `tagIds`: JSON array string or repeated fields. Tags do **not** change storage paths under `images/`.
+Optional form field `tagNames`: JSON array or comma-separated names. Tags apply to the user bound to the token (**global token cannot tag**). Tags do **not** change storage paths under `images/`.
 
 ### 2. List images
 

docs-site/en/guide/changelog.md

@@ -4,6 +4,27 @@ Version history and notable changes. The full log is also in the repo root [CHAN
 
 ---
 
+## [1.4.2] — 2026-09-23
+
+### Fixed
+
+- Gallery batch tagging and upload token auth (incl. legacy `API_UPLOAD_TOKEN`)
+
+### Improved
+
+- Single API token per account; upload `tagNames` only; tag management sort/mobile layout; API doc table layout
+
+## [1.4.1] — 2026-09-16
+
+### Added
+
+- **Upload policy (Settings → Basic)**: max size, allowed formats, rate limits, preserve originals; env override
+- **Upload API**: optional `tagNames` for tagging by name (create or reuse)
+
+### Improved
+
+- Configurable login rate limits; settings layout updates
+
 ## [1.4.0] — 2026-09-09
 
 ### Added

docs-site/guide/api.md

@@ -12,10 +12,10 @@ PicHost 提供 REST 接口与 Twikoo 兼容端点。登录后打开顶栏 **API*
 Auth-Token: YOUR_TOKEN
 ```
 
-| Token 类型 | 获取方式 | 说明 |
+| Token | 获取方式 | 说明 |
-| ---------- | -------- | ---- |
+| ----- | -------- | ---- |
-| **全局 Token** | 管理员 **API** 页生成；或 `API_UPLOAD_TOKEN` 环境变量 | 环境变量优先且锁定后台重新生成 |
+| **API Token** | 登录后 **API** 页（每账号一个，自动生成） | 请求头 `Auth-Token`；上传与 tagNames 归属该账号 |
-| **个人 Token** | 各用户 **API** 页 | 仅用于该用户脚本，上传归属本人 |
+| **遗留全站 Token** | 环境变量 `API_UPLOAD_TOKEN` 或旧版后台配置 | 仍可用；上传归属**首个管理员**账号。Twikoo 表单 `token` 亦支持各账号 API Token |
 
 表单上传仍可使用字段 `token`（Twikoo 协议）。
 
@@ -31,10 +31,10 @@ Auth-Token: YOUR_TOKEN
 curl -X POST "https://admin.example.com/api/images/upload" \
   -H "Auth-Token: YOUR_TOKEN" \
   -F "image=@./demo.png" \
-  -F 'tagIds=[1,2]'
+  -F 'tagNames=["博客","截图"]'
 ```
 
-可选表单字段 `tagIds`：JSON 数组字符串（如 `[1,2]`）或重复字段，上传成功后自动打标。存储路径仍为 `images/年/月/id.webp`，**不会**因标签创建子目录。
+可选表单字段 `tagNames`：JSON 数组或逗号分隔名称；上传成功后自动打标。存储路径仍为 `images/年/月/id.webp`，**不会**因标签创建子目录。
 
 ### 2. 获取图片列表
 

docs-site/guide/changelog.md

@@ -4,6 +4,27 @@ PicHost 版本历史与重要变更说明。完整记录亦见仓库根目录 [C
 
 ---
 
+## [1.4.2] — 2026-09-23
+
+### 修复
+
+- 图库批量打标与上传 Token 鉴权（含 `API_UPLOAD_TOKEN` 兼容）
+
+### 改进
+
+- API 页单 Token；上传 `tagNames`；标签管理排序与移动端布局；API 文档表格式
+
+## [1.4.1] — 2026-09-16
+
+### 新增
+
+- **上传策略（设置 → 基础）**：大小、格式、限流、保留原图；环境变量可覆盖
+- **上传 API**：可选 `tagNames` 按名称打标（自动创建或复用）
+
+### 改进
+
+- 登录限流可配置；设置页布局调整
+
 ## [1.4.0] — 2026-09-09
 
 ### 新增

docs-site/guide/users-and-permissions.md

@@ -13,8 +13,7 @@ PicHost 使用基于角色的访问控制（RBAC）：**管理员（admin）**
 | 系统设置（`/settings`） | ✓ | — |
 | 开放注册开关 | ✓ | — |
 | 登录人机验证方式（滑块 / Turnstile / Cap） | ✓ | — |
-| 全局 API Token 管理 | ✓ | — |
+| API Token（每账号一个） | ✓ | ✓ |
-| 个人 API Token | ✓ | ✓ |
 | 图库统计概览（含注册用户数） | ✓ | 部分 |
 | 标签管理（设置 → 标签管理） | ✓ | — |
 | 操作日志（设置 → 操作日志） | ✓ | — |
@@ -26,9 +25,8 @@ PicHost 使用基于角色的访问控制（RBAC）：**管理员（admin）**
 | 场景 | 鉴权方式 | 图片归属 / 可见范围 |
 | ---- | -------- | ------------------- |
 | 网页上传 | Session Cookie | 当前登录用户 |
-| API 上传 + **个人 Token** | `Auth-Token` 头 | Token 所属用户 |
+| API 上传 | `Auth-Token` 或表单 `token` | Token 对应账号（遗留 `API_UPLOAD_TOKEN` 归属首个管理员） |
-| API 上传 + **全局 Token** | `Auth-Token` 头 | 管理员（`userId` 为空） |
+| Twikoo `POST /api/index.php` | 表单 `token` | 同上 |
-| Twikoo `POST /api/index.php` | 表单 `token` | 与全局 Token 相同 |
 | 图库列表 / 搜索 / 删除 | Session 或 Token | 普通用户仅自己；管理员全部 |
 | 图片直链 `GET /images/...` | 无（Referer 防盗链） | 知道 URL 即可访问 |
 
@@ -59,14 +57,11 @@ PicHost 使用基于角色的访问控制（RBAC）：**管理员（admin）**
 - **上传偏好**：管理员在 **设置 → 基础设置** 配置客户端预压缩、自动复制链接等；普通用户可在首页上传卡片背面调整个人偏好
 - **自动删除**：管理员可设全局策略；用户可设个人策略。启用后仅影响 **之后新上传** 的图片
 
-## API Token 说明
+## API Token
 
-| 类型 | 谁管理 | 上传归属 | 典型用途 |
+- **每个账号一个 Token**（含管理员），在 **API** 页查看或重新生成；首次打开会自动创建
-| ---- | ------ | -------- | -------- |
+- 上传、`tagNames` 打标、图库接口均归属 **该 Token 所属账号**
-| **全局 Token** | 管理员（API 页） | 管理员账号 | Twikoo、站点级脚本 |
+- 环境变量 **`API_UPLOAD_TOKEN`**（旧部署）仍可作为鉴权密钥，上传归属 **首个管理员**，见 [环境变量](./configuration.md)
-| **个人 Token** | 各用户（API 页） | 该用户 | 个人博客、私有脚本 |
-
-若设置了环境变量 `API_UPLOAD_TOKEN`，则全局 Token 被锁定，见 [环境变量](./configuration.md)。
 
 ## 相关
 

i18n/locales/en.json

@@ -196,6 +196,7 @@
     "colName": "Tag name",
     "colImageCount": "Images",
     "colLastUsed": "Last used",
+    "colCreatedAt": "Created",
     "neverUsed": "Never used",
     "colActions": "Actions",
     "mergeIntoAction": "Merge into…",
@@ -286,12 +287,12 @@
     "back": "Back to upload",
     "processing": "Image processing",
     "clientCompress": "Client-side compression",
-    "clientCompressHint": "Compress in the browser before upload (server still converts to WebP)",
+    "clientCompressHint": "Compress in the browser before upload. The server may still convert to WebP unless “Preserve originals” is enabled above.",
     "autoDeletePrefix": "Auto-delete after",
     "autoDeleteSuffix": "days",
     "autoDeleteHint": "Only affects images uploaded after enabling; existing images are kept",
     "webpQuality": "WebP quality",
-    "webpQualityHint": "Client compression quality (1–100); requires client-side compression",
+    "webpQualityHint": "Quality for client-side WebP pre-compression; higher values mean better quality and larger files.",
     "current": "Current: {n}",
     "qualityHigh": "High quality",
     "qualityMedium": "Medium quality",
@@ -414,7 +415,31 @@
     "envOverride": "Overridden by environment variable; cannot edit in UI",
     "saved": "Settings saved",
     "saveFailed": "Failed to save settings",
-    "loadFailed": "Failed to load settings"
+    "loadFailed": "Failed to load settings",
+    "uploadLimits": "Upload limits",
+    "uploadLimitsHint": "Site-wide upload policy and your personal convenience options. Applies after save.",
+    "imageProcessingHint": "Site-wide format conversion and personal compression/cleanup.",
+    "serverPolicy": "Site-wide",
+    "personalPreference": "Personal",
+    "uploadRateGroup": "Upload rate limits",
+    "minutesUnit": "min",
+    "uploadMaxFileSize": "Max file size",
+    "uploadMaxFileSizeHint": "Uploads larger than this are rejected (1–100 MB).",
+    "allowedMimeTypes": "Allowed image formats",
+    "allowedMimeTypesHint": "Keep at least one format enabled. The server validates file signatures, not just extensions.",
+    "preserveOriginalUpload": "Preserve originals (disable WebP conversion)",
+    "preserveOriginalUploadHint": "When enabled, JPEG/PNG/GIF uploads are stored as-is instead of converting to WebP.",
+    "rateLimits": "Rate limits",
+    "rateLimitsHint": "Protect against upload abuse and login brute force.",
+    "loginRateLimitsHint": "Protect the login endpoint from brute-force attempts.",
+    "uploadRateFootnote": "Returns 429 when exceeded within the window. Token uploads are counted separately.",
+    "loginRateFootnote": "Returns 429 when exceeded within the window.",
+    "uploadRateIpMax": "Upload limit (per IP)",
+    "uploadRateTokenMax": "Upload limit (per token)",
+    "uploadRateWindowMinutes": "Upload window (minutes)",
+    "loginRateMax": "Login limit (per IP)",
+    "loginRateWindowMinutes": "Login window (minutes)",
+    "rateLimitsFootnote": "Exceeding the limit within the window returns HTTP 429. Token uploads are counted separately."
   },
   "storage": {
     "title": "Storage",
@@ -800,13 +825,13 @@
     "pagePlaceholder": "Page"
   },
   "api": {
-    "tokenTitle": "API Token",
+    "tokenTitle": "API token",
     "envOverrideTitle": "Token overridden by environment",
     "envOverrideDesc": "Restart after changing API_UPLOAD_TOKEN; cannot regenerate in UI.",
     "personalTitle": "Personal API token",
     "personalDesc": "For your scripts only; uploads belong to your account.",
     "notConfiguredTitle": "No token configured",
-    "notConfiguredDesc": "Click Regenerate to create a token for Auth-Token on all endpoints below.",
+    "notConfiguredDesc": "A token is created automatically on first visit, or click Regenerate.",
     "regenerate": "Regenerate",
     "tokenSourceEnv": "Source: API_UPLOAD_TOKEN environment variable",
     "tokenSourceDb": "Source: generated in app (can regenerate)",
@@ -854,7 +879,8 @@
         "image": "Primary upload field",
         "file": "Compatibility field, single file",
         "files": "Compatibility field, multiple files",
-        "token": "Twikoo protocol form token"
+        "token": "Twikoo protocol form token",
+        "tagNames": "Optional JSON array or comma-separated names; creates or reuses tags"
       },
       "list": {
         "limit": "Page size, default 20, max 100",

i18n/locales/zh-CN.json

@@ -196,6 +196,7 @@
     "colName": "标签名称",
     "colImageCount": "图片数",
     "colLastUsed": "最近使用",
+    "colCreatedAt": "创建时间",
     "neverUsed": "从未使用",
     "colActions": "操作",
     "mergeIntoAction": "合并到…",
@@ -286,12 +287,12 @@
     "back": "返回上传",
     "processing": "图片处理",
     "clientCompress": "客户端预压缩",
-    "clientCompressHint": "在上传前于浏览器端压缩图片，减少上传体积（服务端仍会转 WebP）。",
+    "clientCompressHint": "上传前在浏览器端压缩以减小体积；若未开启上方「保留原图」，服务端仍可能转为 WebP。",
     "autoDeletePrefix": "自动删除超过",
     "autoDeleteSuffix": "天的图片",
     "autoDeleteHint": "自动清理指定天数前上传的图片，仅对开启后新上传的图片生效。",
     "webpQuality": "WebP 压缩质量",
-    "webpQualityHint": "转换为 WebP 格式时的图片质量，数值越高画质越好、体积越大。",
+    "webpQualityHint": "客户端预压缩为 WebP 时的质量；数值越高画质越好、体积越大。",
     "current": "当前：{n}",
     "qualityHigh": "高质量",
     "qualityMedium": "中等质量",
@@ -414,7 +415,31 @@
     "envOverride": "该项已由环境变量覆盖，无法在后台修改",
     "saved": "服务器配置已保存",
     "saveFailed": "保存服务器配置失败",
-    "loadFailed": "加载设置失败"
+    "loadFailed": "加载设置失败",
+    "uploadLimits": "上传限制",
+    "uploadLimitsHint": "全站上传策略与个人上传便捷选项，保存后立即生效。",
+    "imageProcessingHint": "全站格式转换与个人端压缩、清理策略。",
+    "serverPolicy": "全站策略",
+    "personalPreference": "个人偏好",
+    "uploadRateGroup": "上传限流",
+    "minutesUnit": "分钟",
+    "uploadMaxFileSize": "单文件大小上限",
+    "uploadMaxFileSizeHint": "超过此大小的图片将被拒绝上传（1–100 MB）。",
+    "allowedMimeTypes": "允许的图片格式",
+    "allowedMimeTypesHint": "至少保留一种格式；服务端会校验文件签名，不仅看扩展名。",
+    "preserveOriginalUpload": "保留原图（关闭 WebP 转换）",
+    "preserveOriginalUploadHint": "开启后上传的 JPEG/PNG/GIF 不再转为 WebP，按原格式存储；关闭时可节省空间。",
+    "rateLimits": "限流",
+    "rateLimitsHint": "防止恶意刷上传或暴力登录。",
+    "loginRateLimitsHint": "防止登录接口被暴力尝试。",
+    "uploadRateFootnote": "窗口期内超过次数将返回 429；带 Token 的上传单独计数。",
+    "loginRateFootnote": "窗口期内超过次数将返回 429。",
+    "uploadRateIpMax": "上传限流（每 IP）",
+    "uploadRateTokenMax": "上传限流（每 Token）",
+    "uploadRateWindowMinutes": "上传限流窗口（分钟）",
+    "loginRateMax": "登录限流（每 IP）",
+    "loginRateWindowMinutes": "登录限流窗口（分钟）",
+    "rateLimitsFootnote": "窗口期内超过次数将返回 429。带 Token 的上传单独计数。"
   },
   "storage": {
     "title": "存储设置",
@@ -806,7 +831,7 @@
     "personalTitle": "个人 API Token",
     "personalDesc": "此 Token 仅用于您自己的脚本上传，上传的图片归属您的账号。",
     "notConfiguredTitle": "尚未配置 Token",
-    "notConfiguredDesc": "点击「重新生成」创建 Token，用于下方所有接口的 Auth-Token 鉴权。",
+    "notConfiguredDesc": "首次打开会自动创建 Token，或点击「重新生成」。",
     "regenerate": "重新生成",
     "tokenSourceEnv": "来源：环境变量 API_UPLOAD_TOKEN",
     "tokenSourceDb": "来源：后台生成（可重新生成）",
@@ -855,7 +880,7 @@
         "file": "兼容字段，单图上传",
         "files": "兼容字段，多图上传",
         "token": "Twikoo 协议兼容，表单 token",
-        "tagIds": "可选，JSON 数组或重复字段，上传后自动打标"
+        "tagNames": "可选，JSON 数组或逗号分隔；名称不存在则创建，存在则复用"
       },
       "list": {
         "limit": "每页条数，默认 20，最大 100",

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "pichost",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "pichost",
-      "version": "1.4.0",
+      "version": "1.4.2",
       "hasInstallScript": true,
       "license": "GPL-3.0-only",
       "dependencies": {

package.json

@@ -1,6 +1,6 @@
 {
   "name": "pichost",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "Self-hosted image hosting for your NAS / home server — Nuxt admin UI, local disk or S3-compatible storage, server-side WebP compression, referer protection, Twikoo/EasyImage compatible.",
   "homepage": "https://github.com/O96u/PicHost#readme",
   "repository": {

server/api/auth/login.post.ts

@@ -14,6 +14,7 @@ import { getAdminSecret } from '../../utils/env'
 import { verifyLoginVerification, type VerificationBody } from '../../utils/login-verification'
 import { logActivity } from '../../utils/activity-log'
 import { clientIp, logInfo, logWarn } from '../../utils/logger'
+import { checkLoginRateLimit } from '../../utils/rate-limit'
 
 interface LoginBody extends VerificationBody {
   username?: string
@@ -21,29 +22,9 @@ interface LoginBody extends VerificationBody {
   secret?: string
 }
 
-const loginAttempts = new Map<string, { count: number, resetAt: number }>()
-const MAX_ATTEMPTS = 10
-const WINDOW_MS = 15 * 60 * 1000
-
-function checkRateLimit(ip: string): void {
-  const now = Date.now()
-  const entry = loginAttempts.get(ip)
-  if (!entry || now > entry.resetAt) {
-    loginAttempts.set(ip, { count: 1, resetAt: now + WINDOW_MS })
-    return
-  }
-  entry.count += 1
-  if (entry.count > MAX_ATTEMPTS) {
-    throw createError({
-      statusCode: 429,
-      statusMessage: '登录尝试过于频繁，请稍后再试'
-    })
-  }
-}
-
 export default defineEventHandler(async (event) => {
   const ip = clientIp(event)
-  checkRateLimit(ip)
+  checkLoginRateLimit(ip)
 
   const body = await readBody<LoginBody>(event)
   await verifyLoginVerification(event, body ?? {})

server/api/images/batch-tags.post.ts

@@ -32,6 +32,9 @@ function validateKeys(keys: string[]): void {
 export default defineEventHandler(async (event) => {
   await requireApiOrAdminAuth(event)
   const user = await getCurrentUser(event)
+  if (!user) {
+    createApiError(event, 'UNAUTHORIZED', '批量打标需要登录', 401)
+  }
   const body = await readBody<BatchTagsBody>(event)
 
   const keys = Array.isArray(body?.keys)
@@ -70,10 +73,10 @@ export default defineEventHandler(async (event) => {
   try {
     for (const key of keys) {
       if (action === 'add') {
-        addTagsToImage(key, tagIds, user!.id, user!.role === 'admin')
+        addTagsToImage(key, tagIds, user.id, user.role === 'admin')
       } else {
         for (const tagId of tagIds) {
-          removeTagFromImage(key, tagId, user!.id, user!.role === 'admin')
+          removeTagFromImage(key, tagId, user.id, user.role === 'admin')
         }
       }
       updated++
@@ -88,7 +91,7 @@ export default defineEventHandler(async (event) => {
     originalName: action === 'add'
       ? `批量打标（${keys.length} 张）`
       : `批量移除标签（${keys.length} 张）`,
-    userId: user!.id
+    userId: user.id
   })
 
   return { success: true, updated }

server/api/images/upload.post.ts

@@ -12,7 +12,11 @@ import {
 } from '../../utils/process-image-upload'
 import { createApiError } from '../../utils/api-error'
 import { checkUploadRateLimit } from '../../utils/rate-limit'
-import { parseTagIdsParam } from '../../utils/tags'
+import { readMultipartFormFieldValues } from '../../utils/multipart-form'
+import {
+  parseTagNamesParam,
+  resolveUploadTagIds
+} from '../../utils/tags'
 
 export default defineEventHandler(async (event) => {
   await requireUploadAuth(event)
@@ -29,26 +33,15 @@ export default defineEventHandler(async (event) => {
   checkUploadRateLimit(event, formToken)
 
   const source = verifyApiUploadToken(event) ? 'api' : 'web'
-  const uploadUserId = await getUploadUserId(event)
+  const uploadUserId = await getUploadUserId(event, formToken)
 
-  const tagIdsField = formData.find(part => part.name === 'tagIds')
+  const tagNamesRaw = readMultipartFormFieldValues(formData, 'tagNames')
-  let uploadTagIds: number[] = []
+  const uploadTagNames = parseTagNamesParam(tagNamesRaw.length === 1 ? tagNamesRaw[0] : tagNamesRaw)
-  if (tagIdsField?.data?.length) {
+  const resolvedTags = resolveUploadTagIds(uploadUserId, uploadTagNames)
-    const raw = new TextDecoder().decode(tagIdsField.data).trim()
+  if ('message' in resolvedTags) {
-    try {
+    createApiError(event, 'INVALID_REQUEST', resolvedTags.message, 400)
-      const parsed = JSON.parse(raw) as unknown
-      uploadTagIds = parseTagIdsParam(parsed)
-    } catch {
-      uploadTagIds = parseTagIdsParam(raw)
-    }
-  } else {
-    const repeatFields = formData.filter(part => part.name === 'tagIds' && part.data?.length)
-    if (repeatFields.length) {
-      uploadTagIds = parseTagIdsParam(
-        repeatFields.map(part => new TextDecoder().decode(part.data!).trim())
-      )
-    }
   }
+  const uploadTagIds = resolvedTags.tagIds
 
   // 兼容 image / file / files 字段名（图床脚本 / 通用客户端 / 网页多图）
   const fileParts = formData.filter(

server/api/settings/index.patch.ts

@@ -34,6 +34,16 @@ import {
   validateLoginVerificationSettings,
   validateSettingsDomainPatch
 } from '../../utils/env'
+import {
+  normalizeAllowedMimeTypes,
+  parseLoginRateMax,
+  parseLoginRateWindowMinutes,
+  parseUploadMaxFileSizeMb,
+  parseUploadRateIpMax,
+  parseUploadRateTokenMax,
+  parseUploadRateWindowMinutes,
+  setUploadPolicySettings
+} from '../../utils/upload-policy'
 
 interface SettingsPatchBody {
   webpQuality?: unknown
@@ -50,6 +60,14 @@ interface SettingsPatchBody {
   turnstileSecretKey?: unknown
   capApiEndpoint?: unknown
   capSecret?: unknown
+  uploadMaxFileSizeMb?: unknown
+  allowedMimeTypes?: unknown
+  uploadRateIpMax?: unknown
+  uploadRateTokenMax?: unknown
+  uploadRateWindowMinutes?: unknown
+  loginRateMax?: unknown
+  loginRateWindowMinutes?: unknown
+  preserveOriginalUpload?: unknown
 }
 
 export default defineEventHandler(async (event) => {
@@ -249,6 +267,72 @@ export default defineEventHandler(async (event) => {
     setSetting(SETTINGS_CAP_SECRET, nextCapSecret)
   }
 
+  if (body.uploadMaxFileSizeMb !== undefined) {
+    const mb = parseUploadMaxFileSizeMb(String(body.uploadMaxFileSizeMb))
+    if (mb === null) {
+      createApiError(event, 'INVALID_REQUEST', '单文件大小需为 1–100 MB 的整数', 400)
+    }
+    setUploadPolicySettings({ uploadMaxFileSizeMb: mb })
+  }
+
+  if (body.allowedMimeTypes !== undefined) {
+    const raw = Array.isArray(body.allowedMimeTypes)
+      ? body.allowedMimeTypes.map(item => String(item))
+      : String(body.allowedMimeTypes).split(',')
+    const normalized = normalizeAllowedMimeTypes(raw.join(','))
+    if (normalized.length === 0) {
+      createApiError(event, 'INVALID_REQUEST', '至少选择一种允许上传的图片格式', 400)
+    }
+    setUploadPolicySettings({ allowedMimeTypes: normalized })
+  }
+
+  if (body.uploadRateIpMax !== undefined) {
+    const value = parseUploadRateIpMax(String(body.uploadRateIpMax))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '上传 IP 限流次数无效', 400)
+    }
+    setUploadPolicySettings({ uploadRateIpMax: value })
+  }
+
+  if (body.uploadRateTokenMax !== undefined) {
+    const value = parseUploadRateTokenMax(String(body.uploadRateTokenMax))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '上传 Token 限流次数无效', 400)
+    }
+    setUploadPolicySettings({ uploadRateTokenMax: value })
+  }
+
+  if (body.uploadRateWindowMinutes !== undefined) {
+    const value = parseUploadRateWindowMinutes(String(body.uploadRateWindowMinutes))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '上传限流窗口无效', 400)
+    }
+    setUploadPolicySettings({ uploadRateWindowMinutes: value })
+  }
+
+  if (body.loginRateMax !== undefined) {
+    const value = parseLoginRateMax(String(body.loginRateMax))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '登录限流次数无效', 400)
+    }
+    setUploadPolicySettings({ loginRateMax: value })
+  }
+
+  if (body.loginRateWindowMinutes !== undefined) {
+    const value = parseLoginRateWindowMinutes(String(body.loginRateWindowMinutes))
+    if (value === null) {
+      createApiError(event, 'INVALID_REQUEST', '登录限流窗口无效', 400)
+    }
+    setUploadPolicySettings({ loginRateWindowMinutes: value })
+  }
+
+  if (body.preserveOriginalUpload !== undefined) {
+    if (typeof body.preserveOriginalUpload !== 'boolean') {
+      createApiError(event, 'INVALID_REQUEST', '保留原图设置无效', 400)
+    }
+    setUploadPolicySettings({ preserveOriginalUpload: body.preserveOriginalUpload })
+  }
+
   logActivity(event, {
     action: 'settings',
     key: 'settings/system',

server/routes/api/index.php.post.ts

@@ -1,5 +1,5 @@
 import { readMultipartFormData } from 'h3'
-import { verifyUploadTokenValue } from '../../utils/access'
+import { verifyUploadTokenValue, getUploadUserId } from '../../utils/access'
 import { checkUploadRateLimit } from '../../utils/rate-limit'
 import {
   detectMimeFromSignature,
@@ -9,7 +9,6 @@ import {
   mimeMatchesDeclared,
   processSingleImageUpload
 } from '../../utils/process-image-upload'
-import { getApiUploadToken } from '../../utils/env'
 
 /** EasyImages 2.0 兼容上传（Twikoo IMAGE_CDN=easyimage） */
 export default defineEventHandler(async (event) => {
@@ -29,15 +28,14 @@ export default defineEventHandler(async (event) => {
     : ''
 
   if (!devBypass) {
-    if (!getApiUploadToken(event)) {
+    if (!token || !verifyUploadTokenValue(event, token)) {
-      return easyImageError(500, '服务端未配置 API_UPLOAD_TOKEN')
-    }
-    if (!verifyUploadTokenValue(event, token)) {
       return easyImageError(401, 'token 错误或无效')
     }
     checkUploadRateLimit(event, token)
   }
 
+  const uploadUserId = await getUploadUserId(event, token)
+
   const imagePart = formData.find(
     part => part.name === 'image' && part.data?.length
   )
@@ -60,7 +58,8 @@ export default defineEventHandler(async (event) => {
   const result = await processSingleImageUpload(event, {
     bytes,
     filename: imagePart.filename,
-    source: 'api'
+    source: 'api',
+    userId: uploadUserId
   })
 
   if ('error' in result) {

server/utils/access.ts

@@ -1,5 +1,5 @@
 import type { H3Event } from 'h3'
-import { findUserByApiToken } from './db'
+import { findUserByApiToken, getPrimaryAdminUserId } from './db'
 import { getAdminSecret, getApiUploadToken } from './env'
 import { createApiError } from './api-error'
 import {
@@ -85,10 +85,29 @@ export function verifyGlobalApiUploadToken(event: H3Event): boolean {
   return timingSafeEqual(token, expected)
 }
 
-export function resolveUserIdFromApiToken(event: H3Event): number | null {
+function resolveUserIdFromTokenValue(token: string): number | null {
-  const token = extractApiToken(event)
+  const trimmed = token.trim()
-  if (!token) return null
+  if (!trimmed) return null
-  return findUserByApiToken(token)?.id ?? null
+  return findUserByApiToken(trimmed)?.id ?? null
+}
+
+/** 从 Auth-Token 请求头或表单 token 解析个人 API Token 对应用户（非全站 Token） */
+export function resolveUserIdFromApiToken(
+  event: H3Event,
+  extraToken?: string
+): number | null {
+  const headerToken = extractApiToken(event)
+  if (headerToken) {
+    const fromHeader = resolveUserIdFromTokenValue(headerToken)
+    if (fromHeader !== null) return fromHeader
+  }
+
+  if (extraToken) {
+    const fromForm = resolveUserIdFromTokenValue(extraToken)
+    if (fromForm !== null) return fromForm
+  }
+
+  return null
 }
 
 export function verifyApiUploadToken(event: H3Event): boolean {
@@ -222,20 +241,48 @@ export function resolveActivitySource(event: H3Event): 'api' | 'web' {
   return verifyApiUploadToken(event) ? 'api' : 'web'
 }
 
-export async function getUploadUserId(event: H3Event): Promise<number | null> {
+function resolveUploadOwnerFromGlobalToken(
+  event: H3Event,
+  formToken?: string
+): number | null {
+  const expected = getApiUploadToken(event)
+  if (!expected) return null
+
+  const headerToken = extractApiToken(event)
+  if (headerToken && timingSafeEqual(headerToken, expected)) {
+    return getPrimaryAdminUserId()
+  }
+
+  const trimmedForm = formToken?.trim()
+  if (trimmedForm && timingSafeEqual(trimmedForm, expected)) {
+    return getPrimaryAdminUserId()
+  }
+
+  return null
+}
+
+export async function getUploadUserId(
+  event: H3Event,
+  formToken?: string
+): Promise<number | null> {
   if (devBypass(event)) {
     return null
   }
 
-  const userIdFromToken = resolveUserIdFromApiToken(event)
+  const userIdFromToken = resolveUserIdFromApiToken(event, formToken)
   if (userIdFromToken !== null) {
     return userIdFromToken
   }
 
-  if (verifyGlobalApiUploadToken(event)) {
+  const user = await getCurrentUser(event)
-    return null
+  if (user) {
+    return user.id
   }
 
-  const user = await getCurrentUser(event)
+  const globalOwnerId = resolveUploadOwnerFromGlobalToken(event, formToken)
-  return user?.id ?? null
+  if (globalOwnerId !== null) {
+    return globalOwnerId
+  }
+
+  return null
 }

server/utils/activity-log.smoke.test.ts

@@ -95,15 +95,17 @@ describe('activity log smoke', () => {
     await new Promise(resolve => setTimeout(resolve, 50))
   })
 
-  it('opens the project data database without throwing', async () => {
+  it('lists activity logs on a fresh database without throwing', async () => {
-    const projectData = join(process.cwd(), 'data')
+    useTempDataDir()
-    process.env.DATA_DIR = projectData
 
     const { getDb, listActivityLogs, closeDb } = await loadDbModule()
     getDb()
+    const { ensureStorageSchema } = await import('./storage-backends')
+    ensureStorageSchema()
+
     const result = listActivityLogs({ limit: 5, page: 1 })
-    expect(result.page).toBeGreaterThan(0)
+    expect(result.page).toBe(1)
-    expect(Array.isArray(result.items)).toBe(true)
+    expect(result.items).toEqual([])
     closeDb()
     await new Promise(resolve => setTimeout(resolve, 50))
   })

server/utils/db.ts

@@ -414,6 +414,14 @@ export function listAdminUserIds(): Set<number> {
   return new Set(rows.map(row => row.id))
 }
 
+/** 首个管理员（按 id），用于遗留全站 Token 上传归属 */
+export function getPrimaryAdminUserId(): number | null {
+  const row = getDb().prepare(`
+    SELECT id FROM users WHERE role = 'admin' ORDER BY id ASC LIMIT 1
+  `).get() as { id: number } | undefined
+  return row?.id ?? null
+}
+
 export function setUserAutoDeleteDays(userId: number, days: number): void {
   setUserAutoDeletePolicy(userId, days)
 }

server/utils/env.ts

@@ -18,6 +18,7 @@ import {
   SETTINGS_CAP_SECRET,
   isAllowRegistration
 } from './db'
+import { getUploadPolicySettingsPayload } from './upload-policy'
 
 export function getRuntimeEnv(
   event: H3Event,
@@ -694,6 +695,7 @@ export function getSettingsPayload(event: H3Event) {
     capApiEndpoint: getCapApiEndpointConfigured(event),
     capSecret: getCapSecret(event),
     appVersion,
+    ...getUploadPolicySettingsPayload(),
     env: {
       webpQuality,
       refererConfigured: allowedRefererHosts.length > 0,

server/utils/host-isolation.test.ts

@@ -34,7 +34,8 @@ describe('shouldBlockImageHostRequest', () => {
       imageHost,
       requestHost: imageHost,
       method: 'GET',
-      pathname: '/settings'
+      pathname: '/settings',
+      hideFolder: false
     })).toBe(true)
   })
 
@@ -45,7 +46,8 @@ describe('shouldBlockImageHostRequest', () => {
       imageHost,
       requestHost: imageHost,
       method: 'GET',
-      pathname: '/images/2026/08/demo.webp'
+      pathname: '/images/2026/08/demo.webp',
+      hideFolder: false
     })).toBe(false)
   })
 
@@ -93,7 +95,8 @@ describe('shouldBlockSiteHostImageRequest', () => {
       siteHost,
       requestHost: siteHost,
       method: 'GET',
-      pathname: '/images/2026/08/demo.webp'
+      pathname: '/images/2026/08/demo.webp',
+      hideFolder: false
     })).toBe(true)
   })
 

server/utils/image-query.ts

@@ -1,5 +1,5 @@
 import { getStorageBackendRow } from './storage-backends'
-import { ALLOWED_MIME_TYPES } from './constants'
+import { getAllowedMimeTypesList } from './upload-policy'
 import { parseTagIdsParam, type TagFilterInput } from './tags'
 
 export function readBackendIdQuery(
@@ -15,7 +15,7 @@ export function readContentTypeQuery(
 ): string | undefined | null {
   const raw = typeof query.contentType === 'string' ? query.contentType.trim() : ''
   if (!raw || raw === 'all') return undefined
-  if (!(ALLOWED_MIME_TYPES as readonly string[]).includes(raw)) return null
+  if (!(getAllowedMimeTypesList() as readonly string[]).includes(raw)) return null
   return raw
 }
 

server/utils/multipart-form.ts

@@ -0,0 +1,30 @@
+import type { MultiPartData } from 'h3'
+
+export function readMultipartFormFieldValues(
+  formData: MultiPartData[],
+  fieldName: string
+): string[] {
+  const field = formData.find(part => part.name === fieldName)
+  if (field?.data?.length) {
+    const raw = new TextDecoder().decode(field.data).trim()
+    if (!raw) return []
+    try {
+      const parsed = JSON.parse(raw) as unknown
+      if (Array.isArray(parsed)) {
+        return parsed.map(item => String(item).trim()).filter(Boolean)
+      }
+    } catch {
+      // fall through to comma-separated parsing
+    }
+    return raw.split(',').map(item => item.trim()).filter(Boolean)
+  }
+
+  const repeatFields = formData.filter(
+    part => part.name === fieldName && part.data?.length
+  )
+  if (!repeatFields.length) return []
+
+  return repeatFields
+    .map(part => new TextDecoder().decode(part.data!).trim())
+    .filter(Boolean)
+}

server/utils/process-image-upload.ts

@@ -2,10 +2,6 @@ import sharp from 'sharp'
 import type { H3Event } from 'h3'
 import type { ImageItem, UploadErrorItem } from '~/types/image'
 import type { AllowedMimeType } from './constants'
-import {
-  ALLOWED_MIME_TYPES,
-  MAX_FILE_SIZE
-} from './constants'
 import {
   detectMimeFromSignature,
   isAllowedMimeType,
@@ -15,6 +11,12 @@ import type { LogSource } from './db'
 import { generateImageKey } from './image-key'
 import { buildImageItem, sanitizeOriginalName } from './image-response'
 import { getStorageLayout, getWebpQuality } from './env'
+import {
+  formatMaxFileSizeMessage,
+  getMaxFileSizeBytes,
+  isMimeTypeAllowed,
+  isPreserveOriginalUpload
+} from './upload-policy'
 import { logActivity } from './activity-log'
 import { attachTagsAfterUpload, getTagsForImageKeys } from './tags'
 import { putImage } from './storage'
@@ -71,13 +73,13 @@ export async function processSingleImageUpload(
   const originalName = sanitizeOriginalName(input.filename ?? 'image')
   const bytes = input.bytes
 
-  if (bytes.byteLength > MAX_FILE_SIZE) {
+  if (bytes.byteLength > getMaxFileSizeBytes()) {
     return {
       error: {
         name: originalName,
         error: {
           code: 'FILE_TOO_LARGE',
-          message: '图片大小不能超过 10 MB'
+          message: formatMaxFileSizeMessage()
         }
       }
     }
@@ -96,7 +98,7 @@ export async function processSingleImageUpload(
     }
   }
 
-  if (!ALLOWED_MIME_TYPES.includes(detectedMime)) {
+  if (!isMimeTypeAllowed(detectedMime)) {
     return {
       error: {
         name: originalName,
@@ -120,7 +122,9 @@ export async function processSingleImageUpload(
     }
   }
 
-  const compressed = await compressToWebp(bytes, detectedMime, getWebpQuality(event))
+  const compressed = isPreserveOriginalUpload()
+    ? { bytes, mime: detectedMime }
+    : await compressToWebp(bytes, detectedMime, getWebpQuality(event))
 
   const uploadedAt = new Date().toISOString()
   const layout = getStorageLayout(event)

server/utils/rate-limit.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it, vi } from 'vitest'
 
 import { checkUploadRateLimit } from './rate-limit'
+import { getUploadRateLimitSettings } from './upload-policy'
 
 vi.mock('./logger', () => ({
   clientIp: (event: { __ip?: string }) => event.__ip ?? '127.0.0.1'
@@ -27,7 +28,8 @@ describe('checkUploadRateLimit', () => {
 
   it('limits repeated uploads by IP', () => {
     const event = mockEvent('10.0.0.3')
-    for (let i = 0; i < 60; i++) {
+    const { ipMax } = getUploadRateLimitSettings()
+    for (let i = 0; i < ipMax; i++) {
       checkUploadRateLimit(event)
     }
     expect(() => checkUploadRateLimit(event)).toThrow()
@@ -35,7 +37,8 @@ describe('checkUploadRateLimit', () => {
 
   it('limits repeated API token uploads', () => {
     const token = 'token-a'
-    for (let i = 0; i < 120; i++) {
+    const { tokenMax } = getUploadRateLimitSettings()
+    for (let i = 0; i < tokenMax; i++) {
       checkUploadRateLimit(mockEvent(`10.0.${i % 200}`), token)
     }
     expect(() => checkUploadRateLimit(mockEvent('10.0.250'), token)).toThrow()

server/utils/rate-limit.ts

@@ -1,10 +1,7 @@
 import { createHash } from 'node:crypto'
 import { createError, getHeader, type H3Event } from 'h3'
 import { clientIp } from './logger'
-
+import { getUploadRateLimitSettings, getLoginRateLimitSettings } from './upload-policy'
-const UPLOAD_IP_MAX = 60
-const UPLOAD_TOKEN_MAX = 120
-const UPLOAD_WINDOW_MS = 15 * 60 * 1000
 
 const stores = new Map<string, Map<string, { count: number, resetAt: number }>>()
 
@@ -43,12 +40,13 @@ function assertRateLimit(
 }
 
 export function checkUploadRateLimit(event: H3Event, apiToken?: string): void {
+  const { ipMax, tokenMax, windowMs } = getUploadRateLimitSettings()
   const ip = clientIp(event)
   assertRateLimit(
     'upload-ip',
     ip,
-    UPLOAD_IP_MAX,
+    ipMax,
-    UPLOAD_WINDOW_MS,
+    windowMs,
     '上传过于频繁，请稍后再试'
   )
 
@@ -60,8 +58,27 @@ export function checkUploadRateLimit(event: H3Event, apiToken?: string): void {
   assertRateLimit(
     'upload-token',
     hash,
-    UPLOAD_TOKEN_MAX,
+    tokenMax,
-    UPLOAD_WINDOW_MS,
+    windowMs,
     '上传过于频繁，请稍后再试'
   )
 }
+
+const loginAttempts = new Map<string, { count: number, resetAt: number }>()
+
+export function checkLoginRateLimit(ip: string): void {
+  const { max, windowMs } = getLoginRateLimitSettings()
+  const now = Date.now()
+  const entry = loginAttempts.get(ip)
+  if (!entry || now > entry.resetAt) {
+    loginAttempts.set(ip, { count: 1, resetAt: now + windowMs })
+    return
+  }
+  entry.count += 1
+  if (entry.count > max) {
+    throw createError({
+      statusCode: 429,
+      statusMessage: '登录尝试过于频繁，请稍后再试'
+    })
+  }
+}

server/utils/tags.test.ts

@@ -4,7 +4,9 @@ import {
   isValidTagColor,
   isValidTagName,
   normalizeTagName,
-  parseTagIdsParam
+  parseTagIdsParam,
+  parseTagNamesParam,
+  resolveUploadTagIds
 } from './tags'
 
 describe('normalizeTagName', () => {
@@ -51,6 +53,30 @@ describe('parseTagIdsParam', () => {
   })
 })
 
+describe('parseTagNamesParam', () => {
+  it('parses comma-separated and json array values', () => {
+    expect(parseTagNamesParam('博客, 截图')).toEqual(['博客', '截图'])
+    expect(parseTagNamesParam('["工作","截图"]')).toEqual(['工作', '截图'])
+    expect(parseTagNamesParam(['A', 'B'])).toEqual(['A', 'B'])
+  })
+
+  it('deduplicates normalized names', () => {
+    expect(parseTagNamesParam('博客, 博客 ,截图')).toEqual(['博客', '截图'])
+  })
+})
+
+describe('resolveUploadTagIds', () => {
+  it('returns empty when no tags requested', () => {
+    expect(resolveUploadTagIds(1, [])).toEqual({ tagIds: [] })
+  })
+
+  it('requires user when tag names are requested', () => {
+    expect(resolveUploadTagIds(null, ['博客'])).toMatchObject({
+      message: expect.stringContaining('API Token')
+    })
+  })
+})
+
 describe('buildTagFilterSql', () => {
   it('returns empty sql without filter', () => {
     const params: Array<string | number> = []

server/utils/tags.ts

@@ -1,5 +1,6 @@
 import { getDb } from './db'
 import { getImageIndexRow } from './image-index'
+import { toCanonicalImageKey } from './image-key'
 
 export const TAG_COLOR_PRESETS = [
   '#22c55e',
@@ -310,17 +311,65 @@ function assertTagsOwnedByUser(userId: number, tagIds: number[]): void {
   }
 }
 
-function resolveImageOwnerUserId(key: string): number | null {
+function resolveIndexedImageKey(key: string): string | null {
-  const row = getImageIndexRow(key)
+  if (getImageIndexRow(key)) return key
-  return row?.user_id ?? null
+  const canonical = toCanonicalImageKey(key)
+  if (canonical && getImageIndexRow(canonical)) return canonical
+  return null
+}
+
+/** 打标时标签归属的用户：无上传者的索引图用操作者自己的标签 */
+function resolveTagOwnerUserId(
+  imageOwnerUserId: number | null,
+  actorUserId: number
+): number {
+  return imageOwnerUserId ?? actorUserId
+}
+
+/**
+ * 管理员给他人图片打标时，将操作者选中的 tagId 按名称映射到图片所有者的标签。
+ */
+export function resolveTagIdsForImageTagging(
+  actorUserId: number,
+  tagIds: number[],
+  imageOwnerUserId: number | null,
+  isAdmin: boolean
+): number[] {
+  const tagOwnerUserId = resolveTagOwnerUserId(imageOwnerUserId, actorUserId)
+  const unique = [...new Set(tagIds)]
+  if (!unique.length) return []
+
+  if (tagOwnerUserId === actorUserId || !isAdmin) {
+    assertTagsOwnedByUser(tagOwnerUserId, unique)
+    return unique
+  }
+
+  const resolved: number[] = []
+  for (const tagId of unique) {
+    const row = getTagById(tagId)
+    if (!row) {
+      throw new Error('TAG_NOT_FOUND')
+    }
+    if (row.user_id === tagOwnerUserId) {
+      resolved.push(tagId)
+      continue
+    }
+    if (row.user_id === actorUserId) {
+      resolved.push(findOrCreateTagByName(tagOwnerUserId, row.name).id)
+      continue
+    }
+    throw new Error('TAG_NOT_FOUND')
+  }
+  return [...new Set(resolved)]
 }
 
 export function assertCanTagImage(key: string, actorUserId: number, isAdmin: boolean): void {
-  const ownerId = resolveImageOwnerUserId(key)
+  const indexedKey = resolveIndexedImageKey(key)
-  if (ownerId == null) {
+  if (!indexedKey) {
     throw new Error('IMAGE_NOT_FOUND')
   }
-  if (!isAdmin && ownerId !== actorUserId) {
+  const ownerId = getImageIndexRow(indexedKey)!.user_id
+  if (!isAdmin && (ownerId === null || ownerId !== actorUserId)) {
     throw new Error('FORBIDDEN')
   }
 }
@@ -332,19 +381,27 @@ export function addTagsToImage(
   isAdmin: boolean
 ): TagItem[] {
   ensureTagSchema()
-  assertCanTagImage(key, actorUserId, isAdmin)
+  const indexedKey = resolveIndexedImageKey(key)
-  const ownerId = resolveImageOwnerUserId(key)!
+  if (!indexedKey) {
-  const uniqueTagIds = [...new Set(tagIds)]
+    throw new Error('IMAGE_NOT_FOUND')
-  assertTagsOwnedByUser(ownerId, uniqueTagIds)
+  }
+  assertCanTagImage(indexedKey, actorUserId, isAdmin)
+  const imageOwnerUserId = getImageIndexRow(indexedKey)!.user_id
+  const uniqueTagIds = resolveTagIdsForImageTagging(
+    actorUserId,
+    tagIds,
+    imageOwnerUserId,
+    isAdmin
+  )
 
   const insert = getDb().prepare(`
     INSERT OR IGNORE INTO image_tags (image_key, tag_id) VALUES (?, ?)
   `)
   for (const tagId of uniqueTagIds) {
-    insert.run(key, tagId)
+    insert.run(indexedKey, tagId)
   }
 
-  return getTagsForImageKeys([key]).get(key) ?? []
+  return getTagsForImageKeys([indexedKey]).get(indexedKey) ?? []
 }
 
 export function removeTagFromImage(
@@ -354,15 +411,27 @@ export function removeTagFromImage(
   isAdmin: boolean
 ): TagItem[] {
   ensureTagSchema()
-  assertCanTagImage(key, actorUserId, isAdmin)
+  const indexedKey = resolveIndexedImageKey(key)
-  const ownerId = resolveImageOwnerUserId(key)!
+  if (!indexedKey) {
-  assertTagsOwnedByUser(ownerId, [tagId])
+    throw new Error('IMAGE_NOT_FOUND')
+  }
+  assertCanTagImage(indexedKey, actorUserId, isAdmin)
+  const imageOwnerUserId = getImageIndexRow(indexedKey)!.user_id
+  const [resolvedTagId] = resolveTagIdsForImageTagging(
+    actorUserId,
+    [tagId],
+    imageOwnerUserId,
+    isAdmin
+  )
+  if (resolvedTagId == null) {
+    return getTagsForImageKeys([indexedKey]).get(indexedKey) ?? []
+  }
 
   getDb().prepare(`
     DELETE FROM image_tags WHERE image_key = ? AND tag_id = ?
-  `).run(key, tagId)
+  `).run(indexedKey, resolvedTagId)
 
-  return getTagsForImageKeys([key]).get(key) ?? []
+  return getTagsForImageKeys([indexedKey]).get(indexedKey) ?? []
 }
 
 export function setImageTags(
@@ -372,20 +441,28 @@ export function setImageTags(
   isAdmin: boolean
 ): TagItem[] {
   ensureTagSchema()
-  assertCanTagImage(key, actorUserId, isAdmin)
+  const indexedKey = resolveIndexedImageKey(key)
-  const ownerId = resolveImageOwnerUserId(key)!
+  if (!indexedKey) {
-  const uniqueTagIds = [...new Set(tagIds)]
+    throw new Error('IMAGE_NOT_FOUND')
-  assertTagsOwnedByUser(ownerId, uniqueTagIds)
+  }
+  assertCanTagImage(indexedKey, actorUserId, isAdmin)
+  const imageOwnerUserId = getImageIndexRow(indexedKey)!.user_id
+  const uniqueTagIds = resolveTagIdsForImageTagging(
+    actorUserId,
+    tagIds,
+    imageOwnerUserId,
+    isAdmin
+  )
 
   const db = getDb()
   db.exec('BEGIN')
   try {
-    db.prepare('DELETE FROM image_tags WHERE image_key = ?').run(key)
+    db.prepare('DELETE FROM image_tags WHERE image_key = ?').run(indexedKey)
     const insert = db.prepare(`
       INSERT INTO image_tags (image_key, tag_id) VALUES (?, ?)
     `)
     for (const tagId of uniqueTagIds) {
-      insert.run(key, tagId)
+      insert.run(indexedKey, tagId)
     }
     db.exec('COMMIT')
   } catch (error) {
@@ -393,7 +470,7 @@ export function setImageTags(
     throw error
   }
 
-  return getTagsForImageKeys([key]).get(key) ?? []
+  return getTagsForImageKeys([indexedKey]).get(indexedKey) ?? []
 }
 
 export function attachTagsAfterUpload(
@@ -471,3 +548,89 @@ export function parseTagIdsParam(raw: unknown): number[] {
   }
   return [...new Set(ids)]
 }
+
+export function parseTagNamesParam(raw: unknown): string[] {
+  if (raw == null || raw === '') return []
+
+  let parts: string[]
+  if (Array.isArray(raw)) {
+    parts = raw.flatMap(item => String(item).split(','))
+  } else {
+    const str = String(raw).trim()
+    if (str.startsWith('[')) {
+      try {
+        const parsed = JSON.parse(str) as unknown
+        parts = Array.isArray(parsed)
+          ? parsed.map(item => String(item))
+          : str.split(',')
+      } catch {
+        parts = str.split(',')
+      }
+    } else {
+      parts = str.split(',')
+    }
+  }
+
+  const names: string[] = []
+  for (const part of parts) {
+    const normalized = normalizeTagName(part)
+    if (normalized) names.push(normalized)
+  }
+  return [...new Set(names)]
+}
+
+export function findOrCreateTagByName(userId: number, name: string): TagRow {
+  const normalized = normalizeTagName(name)
+  if (!isValidTagName(normalized)) {
+    throw new Error('INVALID_TAG_NAME')
+  }
+
+  const existing = findTagByName(userId, normalized)
+  if (existing) return existing
+
+  const created = createTag(userId, normalized)
+  const row = getTagById(created.id)
+  if (!row) {
+    throw new Error('TAG_CREATE_FAILED')
+  }
+  return row
+}
+
+export function resolveTagIdsFromNames(userId: number, names: readonly string[]): number[] {
+  const ids: number[] = []
+  for (const name of names) {
+    ids.push(findOrCreateTagByName(userId, name).id)
+  }
+  return [...new Set(ids)]
+}
+
+export function resolveUploadTagIds(
+  userId: number | null,
+  tagNames: string[]
+): { tagIds: number[] } | { message: string } {
+  if (!tagNames.length) {
+    return { tagIds: [] }
+  }
+
+  if (userId == null) {
+    return {
+      message: '使用 tagNames 时请登录或通过 Auth-Token / 表单 token 提供有效 API Token'
+    }
+  }
+
+  try {
+    return { tagIds: resolveTagIdsFromNames(userId, tagNames) }
+  } catch (error) {
+    if (error instanceof Error) {
+      switch (error.message) {
+        case 'INVALID_TAG_NAME':
+          return { message: '标签名称无效' }
+        case 'TAG_LIMIT_REACHED':
+          return { message: '标签数量已达上限' }
+        default:
+          break
+      }
+    }
+    throw error
+  }
+}

server/utils/upload-policy.test.ts

@@ -0,0 +1,49 @@
+import { describe, expect, it } from 'vitest'
+
+import {
+  DEFAULT_UPLOAD_MAX_FILE_SIZE_MB,
+  normalizeAllowedMimeTypes,
+  parseLoginRateMax,
+  parsePreserveOriginalUpload,
+  parseUploadMaxFileSizeMb,
+  parseUploadRateIpMax,
+  serializeAllowedMimeTypes,
+  serializePreserveOriginalUpload
+} from './upload-policy'
+
+describe('upload-policy parsers', () => {
+  it('parses upload max file size mb', () => {
+    expect(parseUploadMaxFileSizeMb('10')).toBe(10)
+    expect(parseUploadMaxFileSizeMb('0')).toBeNull()
+    expect(parseUploadMaxFileSizeMb('101')).toBeNull()
+  })
+
+  it('normalizes allowed mime types', () => {
+    expect(normalizeAllowedMimeTypes('image/png, image/jpeg, image/png')).toEqual([
+      'image/png',
+      'image/jpeg'
+    ])
+    expect(normalizeAllowedMimeTypes('image/bmp')).toEqual([])
+  })
+
+  it('serializes allowed mime types in canonical order', () => {
+    expect(serializeAllowedMimeTypes(['image/webp', 'image/jpeg'])).toBe('image/jpeg,image/webp')
+  })
+
+  it('parses rate limit values', () => {
+    expect(parseUploadRateIpMax('60')).toBe(60)
+    expect(parseLoginRateMax('10')).toBe(10)
+    expect(parseUploadRateIpMax('0')).toBeNull()
+  })
+
+  it('defaults max file size mb constant matches legacy 10MB', () => {
+    expect(DEFAULT_UPLOAD_MAX_FILE_SIZE_MB).toBe(10)
+  })
+
+  it('parses preserve original upload flag', () => {
+    expect(parsePreserveOriginalUpload('true')).toBe(true)
+    expect(parsePreserveOriginalUpload('0')).toBe(false)
+    expect(parsePreserveOriginalUpload('')).toBeNull()
+    expect(serializePreserveOriginalUpload(true)).toBe('true')
+  })
+})

server/utils/upload-policy.ts

@@ -0,0 +1,347 @@
+import {
+  ALLOWED_MIME_TYPES,
+  type AllowedMimeType
+} from './constants'
+import { getSetting, setSetting } from './db'
+
+export const SETTINGS_UPLOAD_MAX_FILE_SIZE_MB = 'upload_max_file_size_mb'
+export const SETTINGS_ALLOWED_MIME_TYPES = 'allowed_mime_types'
+export const SETTINGS_UPLOAD_RATE_IP_MAX = 'upload_rate_ip_max'
+export const SETTINGS_UPLOAD_RATE_TOKEN_MAX = 'upload_rate_token_max'
+export const SETTINGS_UPLOAD_RATE_WINDOW_MINUTES = 'upload_rate_window_minutes'
+export const SETTINGS_LOGIN_RATE_MAX = 'login_rate_max'
+export const SETTINGS_LOGIN_RATE_WINDOW_MINUTES = 'login_rate_window_minutes'
+export const SETTINGS_PRESERVE_ORIGINAL_UPLOAD = 'preserve_original_upload'
+
+export const DEFAULT_UPLOAD_MAX_FILE_SIZE_MB = 10
+export const MIN_UPLOAD_MAX_FILE_SIZE_MB = 1
+export const MAX_UPLOAD_MAX_FILE_SIZE_MB = 100
+
+export const DEFAULT_UPLOAD_RATE_IP_MAX = 60
+export const DEFAULT_UPLOAD_RATE_TOKEN_MAX = 120
+export const DEFAULT_UPLOAD_RATE_WINDOW_MINUTES = 15
+export const MIN_UPLOAD_RATE_MAX = 1
+export const MAX_UPLOAD_RATE_IP_MAX = 1000
+export const MAX_UPLOAD_RATE_TOKEN_MAX = 5000
+export const MIN_RATE_WINDOW_MINUTES = 1
+export const MAX_RATE_WINDOW_MINUTES = 1440
+
+export const DEFAULT_LOGIN_RATE_MAX = 10
+export const DEFAULT_LOGIN_RATE_WINDOW_MINUTES = 15
+export const MAX_LOGIN_RATE_MAX = 100
+
+export const ALL_MIME_TYPE_OPTIONS = [
+  { mime: 'image/jpeg', label: 'JPEG' },
+  { mime: 'image/png', label: 'PNG' },
+  { mime: 'image/webp', label: 'WebP' },
+  { mime: 'image/gif', label: 'GIF' },
+  { mime: 'image/svg+xml', label: 'SVG' },
+  { mime: 'image/x-icon', label: 'ICO' }
+] as const satisfies ReadonlyArray<{ mime: AllowedMimeType, label: string }>
+
+export type PolicySource = 'env' | 'db' | 'default'
+
+function readEnv(name: string): string {
+  try {
+    return process.env[name]?.trim() ?? ''
+  } catch {
+    return ''
+  }
+}
+
+function parsePositiveInt(raw: string, min: number, max: number): number | null {
+  const trimmed = raw.trim()
+  if (!trimmed) return null
+  const value = Number(trimmed)
+  if (!Number.isFinite(value) || !Number.isInteger(value)) return null
+  if (value < min || value > max) return null
+  return value
+}
+
+export function parseUploadMaxFileSizeMb(raw: string): number | null {
+  return parsePositiveInt(raw, MIN_UPLOAD_MAX_FILE_SIZE_MB, MAX_UPLOAD_MAX_FILE_SIZE_MB)
+}
+
+export function parseUploadRateIpMax(raw: string): number | null {
+  return parsePositiveInt(raw, MIN_UPLOAD_RATE_MAX, MAX_UPLOAD_RATE_IP_MAX)
+}
+
+export function parseUploadRateTokenMax(raw: string): number | null {
+  return parsePositiveInt(raw, MIN_UPLOAD_RATE_MAX, MAX_UPLOAD_RATE_TOKEN_MAX)
+}
+
+export function parseUploadRateWindowMinutes(raw: string): number | null {
+  return parsePositiveInt(raw, MIN_RATE_WINDOW_MINUTES, MAX_RATE_WINDOW_MINUTES)
+}
+
+export function parseLoginRateMax(raw: string): number | null {
+  return parsePositiveInt(raw, MIN_UPLOAD_RATE_MAX, MAX_LOGIN_RATE_MAX)
+}
+
+export function parseLoginRateWindowMinutes(raw: string): number | null {
+  return parsePositiveInt(raw, MIN_RATE_WINDOW_MINUTES, MAX_RATE_WINDOW_MINUTES)
+}
+
+export function parsePreserveOriginalUpload(raw: string): boolean | null {
+  const trimmed = raw.trim().toLowerCase()
+  if (!trimmed) return null
+  if (trimmed === 'true' || trimmed === '1' || trimmed === 'yes') return true
+  if (trimmed === 'false' || trimmed === '0' || trimmed === 'no') return false
+  return null
+}
+
+export function serializePreserveOriginalUpload(value: boolean): string {
+  return value ? 'true' : 'false'
+}
+
+export function normalizeAllowedMimeTypes(raw: string): AllowedMimeType[] {
+  const allowedSet = new Set<string>(ALLOWED_MIME_TYPES)
+  const seen = new Set<string>()
+  const result: AllowedMimeType[] = []
+
+  for (const part of raw.split(',')) {
+    const mime = part.trim().toLowerCase()
+    if (!mime || seen.has(mime) || !allowedSet.has(mime)) continue
+    seen.add(mime)
+    result.push(mime as AllowedMimeType)
+  }
+
+  return result
+}
+
+export function serializeAllowedMimeTypes(mimes: readonly string[]): string {
+  const normalized = new Set(normalizeAllowedMimeTypes(mimes.join(',')))
+  return ALL_MIME_TYPE_OPTIONS
+    .map(option => option.mime)
+    .filter(mime => normalized.has(mime))
+    .join(',')
+}
+
+function getUploadMaxFileSizeMbSource(): PolicySource {
+  if (getSetting(SETTINGS_UPLOAD_MAX_FILE_SIZE_MB) !== null) return 'db'
+  if (parseUploadMaxFileSizeMb(readEnv('UPLOAD_MAX_FILE_SIZE_MB')) !== null) return 'env'
+  return 'default'
+}
+
+function getAllowedMimeTypesSource(): PolicySource {
+  if (getSetting(SETTINGS_ALLOWED_MIME_TYPES) !== null) return 'db'
+  if (normalizeAllowedMimeTypes(readEnv('ALLOWED_MIME_TYPES')).length > 0) return 'env'
+  return 'default'
+}
+
+function getUploadRateIpMaxSource(): PolicySource {
+  if (getSetting(SETTINGS_UPLOAD_RATE_IP_MAX) !== null) return 'db'
+  if (parseUploadRateIpMax(readEnv('UPLOAD_RATE_IP_MAX')) !== null) return 'env'
+  return 'default'
+}
+
+function getUploadRateTokenMaxSource(): PolicySource {
+  if (getSetting(SETTINGS_UPLOAD_RATE_TOKEN_MAX) !== null) return 'db'
+  if (parseUploadRateTokenMax(readEnv('UPLOAD_RATE_TOKEN_MAX')) !== null) return 'env'
+  return 'default'
+}
+
+function getUploadRateWindowMinutesSource(): PolicySource {
+  if (getSetting(SETTINGS_UPLOAD_RATE_WINDOW_MINUTES) !== null) return 'db'
+  if (parseUploadRateWindowMinutes(readEnv('UPLOAD_RATE_WINDOW_MINUTES')) !== null) return 'env'
+  return 'default'
+}
+
+function getLoginRateMaxSource(): PolicySource {
+  if (getSetting(SETTINGS_LOGIN_RATE_MAX) !== null) return 'db'
+  if (parseLoginRateMax(readEnv('LOGIN_RATE_MAX')) !== null) return 'env'
+  return 'default'
+}
+
+function getLoginRateWindowMinutesSource(): PolicySource {
+  if (getSetting(SETTINGS_LOGIN_RATE_WINDOW_MINUTES) !== null) return 'db'
+  if (parseLoginRateWindowMinutes(readEnv('LOGIN_RATE_WINDOW_MINUTES')) !== null) return 'env'
+  return 'default'
+}
+
+function getPreserveOriginalUploadSource(): PolicySource {
+  if (getSetting(SETTINGS_PRESERVE_ORIGINAL_UPLOAD) !== null) return 'db'
+  if (parsePreserveOriginalUpload(readEnv('PRESERVE_ORIGINAL_UPLOAD')) !== null) return 'env'
+  return 'default'
+}
+
+export function getUploadMaxFileSizeMb(): number {
+  const dbRaw = getSetting(SETTINGS_UPLOAD_MAX_FILE_SIZE_MB)
+  if (dbRaw !== null) {
+    const parsed = parseUploadMaxFileSizeMb(dbRaw)
+    if (parsed !== null) return parsed
+  }
+  const fromEnv = parseUploadMaxFileSizeMb(readEnv('UPLOAD_MAX_FILE_SIZE_MB'))
+  if (fromEnv !== null) return fromEnv
+  return DEFAULT_UPLOAD_MAX_FILE_SIZE_MB
+}
+
+export function getMaxFileSizeBytes(): number {
+  return getUploadMaxFileSizeMb() * 1024 * 1024
+}
+
+export function getAllowedMimeTypesList(): AllowedMimeType[] {
+  const dbRaw = getSetting(SETTINGS_ALLOWED_MIME_TYPES)
+  if (dbRaw !== null) {
+    const parsed = normalizeAllowedMimeTypes(dbRaw)
+    if (parsed.length > 0) return parsed
+  }
+  const fromEnv = normalizeAllowedMimeTypes(readEnv('ALLOWED_MIME_TYPES'))
+  if (fromEnv.length > 0) return fromEnv
+  return [...ALLOWED_MIME_TYPES]
+}
+
+export function isMimeTypeAllowed(mime: string): mime is AllowedMimeType {
+  return getAllowedMimeTypesList().includes(mime as AllowedMimeType)
+}
+
+export function isPreserveOriginalUpload(): boolean {
+  const dbRaw = getSetting(SETTINGS_PRESERVE_ORIGINAL_UPLOAD)
+  if (dbRaw !== null) {
+    const parsed = parsePreserveOriginalUpload(dbRaw)
+    if (parsed !== null) return parsed
+  }
+  const fromEnv = parsePreserveOriginalUpload(readEnv('PRESERVE_ORIGINAL_UPLOAD'))
+  if (fromEnv !== null) return fromEnv
+  return false
+}
+
+export function getUploadRateLimitSettings(): {
+  ipMax: number
+  tokenMax: number
+  windowMs: number
+} {
+  const ipMax = (() => {
+    const dbRaw = getSetting(SETTINGS_UPLOAD_RATE_IP_MAX)
+    if (dbRaw !== null) {
+      const parsed = parseUploadRateIpMax(dbRaw)
+      if (parsed !== null) return parsed
+    }
+    return parseUploadRateIpMax(readEnv('UPLOAD_RATE_IP_MAX')) ?? DEFAULT_UPLOAD_RATE_IP_MAX
+  })()
+
+  const tokenMax = (() => {
+    const dbRaw = getSetting(SETTINGS_UPLOAD_RATE_TOKEN_MAX)
+    if (dbRaw !== null) {
+      const parsed = parseUploadRateTokenMax(dbRaw)
+      if (parsed !== null) return parsed
+    }
+    return parseUploadRateTokenMax(readEnv('UPLOAD_RATE_TOKEN_MAX')) ?? DEFAULT_UPLOAD_RATE_TOKEN_MAX
+  })()
+
+  const windowMinutes = (() => {
+    const dbRaw = getSetting(SETTINGS_UPLOAD_RATE_WINDOW_MINUTES)
+    if (dbRaw !== null) {
+      const parsed = parseUploadRateWindowMinutes(dbRaw)
+      if (parsed !== null) return parsed
+    }
+    return parseUploadRateWindowMinutes(readEnv('UPLOAD_RATE_WINDOW_MINUTES'))
+      ?? DEFAULT_UPLOAD_RATE_WINDOW_MINUTES
+  })()
+
+  return {
+    ipMax,
+    tokenMax,
+    windowMs: windowMinutes * 60 * 1000
+  }
+}
+
+export function getLoginRateLimitSettings(): {
+  max: number
+  windowMs: number
+} {
+  const max = (() => {
+    const dbRaw = getSetting(SETTINGS_LOGIN_RATE_MAX)
+    if (dbRaw !== null) {
+      const parsed = parseLoginRateMax(dbRaw)
+      if (parsed !== null) return parsed
+    }
+    return parseLoginRateMax(readEnv('LOGIN_RATE_MAX')) ?? DEFAULT_LOGIN_RATE_MAX
+  })()
+
+  const windowMinutes = (() => {
+    const dbRaw = getSetting(SETTINGS_LOGIN_RATE_WINDOW_MINUTES)
+    if (dbRaw !== null) {
+      const parsed = parseLoginRateWindowMinutes(dbRaw)
+      if (parsed !== null) return parsed
+    }
+    return parseLoginRateWindowMinutes(readEnv('LOGIN_RATE_WINDOW_MINUTES'))
+      ?? DEFAULT_LOGIN_RATE_WINDOW_MINUTES
+  })()
+
+  return {
+    max,
+    windowMs: windowMinutes * 60 * 1000
+  }
+}
+
+export function formatMaxFileSizeMessage(): string {
+  return `图片大小不能超过 ${getUploadMaxFileSizeMb()} MB`
+}
+
+export function getUploadPolicySettingsPayload() {
+  return {
+    uploadMaxFileSizeMb: getUploadMaxFileSizeMb(),
+    uploadMaxFileSizeMbSource: getUploadMaxFileSizeMbSource(),
+    uploadMaxFileSizeMbEnvFallback: parseUploadMaxFileSizeMb(readEnv('UPLOAD_MAX_FILE_SIZE_MB'))
+      ?? DEFAULT_UPLOAD_MAX_FILE_SIZE_MB,
+    allowedMimeTypes: getAllowedMimeTypesList(),
+    allowedMimeTypesSource: getAllowedMimeTypesSource(),
+    allowedMimeTypesEnvFallback: normalizeAllowedMimeTypes(readEnv('ALLOWED_MIME_TYPES')),
+    uploadRateIpMax: getUploadRateLimitSettings().ipMax,
+    uploadRateIpMaxSource: getUploadRateIpMaxSource(),
+    uploadRateTokenMax: getUploadRateLimitSettings().tokenMax,
+    uploadRateTokenMaxSource: getUploadRateTokenMaxSource(),
+    uploadRateWindowMinutes: getUploadRateLimitSettings().windowMs / (60 * 1000),
+    uploadRateWindowMinutesSource: getUploadRateWindowMinutesSource(),
+    loginRateMax: getLoginRateLimitSettings().max,
+    loginRateMaxSource: getLoginRateMaxSource(),
+    loginRateWindowMinutes: getLoginRateLimitSettings().windowMs / (60 * 1000),
+    loginRateWindowMinutesSource: getLoginRateWindowMinutesSource(),
+    preserveOriginalUpload: isPreserveOriginalUpload(),
+    preserveOriginalUploadSource: getPreserveOriginalUploadSource(),
+    mimeTypeOptions: ALL_MIME_TYPE_OPTIONS.map(option => ({
+      mime: option.mime,
+      label: option.label
+    }))
+  }
+}
+
+export function setUploadPolicySettings(input: {
+  uploadMaxFileSizeMb?: number
+  allowedMimeTypes?: readonly string[]
+  uploadRateIpMax?: number
+  uploadRateTokenMax?: number
+  uploadRateWindowMinutes?: number
+  loginRateMax?: number
+  loginRateWindowMinutes?: number
+  preserveOriginalUpload?: boolean
+}): void {
+  if (input.uploadMaxFileSizeMb !== undefined) {
+    setSetting(SETTINGS_UPLOAD_MAX_FILE_SIZE_MB, String(input.uploadMaxFileSizeMb))
+  }
+  if (input.allowedMimeTypes !== undefined) {
+    setSetting(SETTINGS_ALLOWED_MIME_TYPES, serializeAllowedMimeTypes(input.allowedMimeTypes))
+  }
+  if (input.uploadRateIpMax !== undefined) {
+    setSetting(SETTINGS_UPLOAD_RATE_IP_MAX, String(input.uploadRateIpMax))
+  }
+  if (input.uploadRateTokenMax !== undefined) {
+    setSetting(SETTINGS_UPLOAD_RATE_TOKEN_MAX, String(input.uploadRateTokenMax))
+  }
+  if (input.uploadRateWindowMinutes !== undefined) {
+    setSetting(SETTINGS_UPLOAD_RATE_WINDOW_MINUTES, String(input.uploadRateWindowMinutes))
+  }
+  if (input.loginRateMax !== undefined) {
+    setSetting(SETTINGS_LOGIN_RATE_MAX, String(input.loginRateMax))
+  }
+  if (input.loginRateWindowMinutes !== undefined) {
+    setSetting(SETTINGS_LOGIN_RATE_WINDOW_MINUTES, String(input.loginRateWindowMinutes))
+  }
+  if (input.preserveOriginalUpload !== undefined) {
+    setSetting(
+      SETTINGS_PRESERVE_ORIGINAL_UPLOAD,
+      serializePreserveOriginalUpload(input.preserveOriginalUpload)
+    )
+  }
+}