fix: harden one-click installer

main was a 4-commit January 2026 orphan snapshot that also committed
node_modules/, backend/.env and backend/data/database.db. Its only
source features (OSS traffic stats via @alicloud/cms20190101, /s/:code
share route, quota display fixes) are all superseded by master's
360-commit history — master implements download traffic via the
reservation + OSS log reconcile system instead.

Merge records main's history as an ancestor; the resulting tree is
master's unchanged.

.gitea/workflows/backend-tests.yml

@@ -0,0 +1,42 @@
+name: Build and tests
+
+on:
+  push:
+    branches: [master, main]
+  pull_request:
+    branches: [master, main]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: backend
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v4
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+          cache-dependency-path: |
+            backend/package-lock.json
+            frontend/package-lock.json
+      - name: Install dependencies
+        run: npm ci
+      - name: Audit production dependencies
+        run: npm audit --omit=dev
+      - name: Run backend tests
+        run: npm test
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: npm ci
+      - name: Audit frontend dependencies
+        working-directory: frontend
+        run: npm audit
+      - name: Build frontend
+        working-directory: frontend
+        run: npm run build
+      - name: Validate deployment script syntax
+        run: bash -n ../install.sh

.gitignore

@@ -1,5 +1,6 @@
 # 依赖
 node_modules/
+frontend/dist/
 __pycache__/
 *.pyc
 *.pyo
@@ -15,9 +16,11 @@ __pycache__/
 
 # 临时文件
 backend/uploads/
-backend/storage/  # 本地存储数据
+# 本地存储数据目录（保留 .gitkeep）
+backend/storage/*
 !backend/storage/.gitkeep
-backend/data/     # 数据库目录
+# 数据库目录（保留 .gitkeep）
+backend/data/*
 !backend/data/.gitkeep
 *.log
 .DS_Store
@@ -87,9 +90,7 @@ package-lock.json.bak
 # Claude配置
 .claude/
 
-# 测试脚本和报告
-backend/test-*.js
-backend/verify-*.js
+# 测试报告和本地验证产物
 backend/verify-*.sh
 backend/test-results-*.json
 backend/*最终*.js
@@ -128,9 +129,9 @@ backend/fix-env.js
 backend/create-admin.js
 backend/*.backup.*
 
-# 维护和调试脚本
-backend/check-*.js
-backend/cleanup-*.js
-backend/rebuild-*.js
-backend/update-*.js
-backend/upgrade-*.js
+# 本地协作与设计验收产物
+/work/
+/desktop-client/design-qa.md
+
+# 桌面安装包通过 Gitea Release 发布，Git 仅保存校验元数据
+/frontend/downloads/*.exe

.nvmrc

@@ -0,0 +1 @@
+20.19.0

CONTRIBUTING.md

@@ -0,0 +1,37 @@
+# 贡献与工程约束
+
+## 本地验证
+
+项目要求 Node.js `20.19` 至 `24.x`。后端与 Web 前端分别维护锁文件，依赖变更后必须同步提交对应的 `package-lock.json`。
+
+```bash
+cd backend
+npm ci
+npm test
+npm audit --omit=dev
+
+cd ../frontend
+npm ci
+npm run build
+npm audit
+```
+
+开发 Web 前端时分别运行后端 `npm run dev` 与前端 `npm run dev`。生产环境只服务 `frontend/dist/`，不要手工修改构建产物或给资源 URL 追加版本号。
+
+## 不可破坏的约束
+
+1. `app.use(expressErrorHandler)` 必须保持为最后一个 `app.use`；CI 的架构测试会检查这一点。
+2. Express 4 使用 `express-async-errors` 捕获异步路由拒绝；该补丁必须在注册任何路由前加载。
+3. 限流器、下载安全计数和 OSS 用量缓存仍是进程内状态，PM2 必须保持单实例 `fork` 模式。扩容前先迁移到共享状态存储。
+4. `npm ci` 依赖严格同步的 lock 文件；禁止在部署脚本中删除 `package-lock.json`。
+5. Express 中间件顺序是安全边界：requestId/安全头/CORS/HTTPS/静态资源/API 限流/请求体/CSRF，不得无验证调整。
+6. 桌面安装包目录 `frontend/downloads/` 是运行时发布目录，更新前必须备份且不得放进 `frontend/dist/` 的清理生命周期。
+7. 桌面安装包必须作为 Gitea Release 附件发布；Git 只提交 `frontend/desktop-release.json`，禁止提交 `.exe`。
+8. 更新 Release 元数据时必须核对标签、文件名、字节数和 SHA256，并运行 `npm run check:desktop-release`。
+
+## 改动原则
+
+- 路由继续按业务域渐进迁移，每次只迁移一个域并运行全部测试。
+- 新抽取的纯函数必须直接测试生产模块；禁止在测试文件复制实现。
+- 安全或配额核心逻辑应做一次变异验证：临时改坏生产实现，确认对应测试失败后立即还原。
+- 日志使用 `req.log` 或公共 logger，禁止记录密码、令牌、Cookie、Access Key 或完整授权头。

INSTALL_GUIDE.md

@@ -10,7 +10,7 @@
 - **磁盘空间**: 至少 2GB 可用空间
 
 ### 软件依赖
-- **Node.js**: 20.x LTS
+- **Node.js**: 20.19+（支持 20.19-24）
 - **Nginx**: 1.18+
 - **Git**: 2.x
 
@@ -27,7 +27,7 @@ curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash -
 sudo apt-get install -y nodejs
 
 # 验证安装
-node -v  # 应显示 v20.x.x
+node -v  # 应显示 v20.19.0 或更高版本
 npm -v
 ```
 
@@ -81,13 +81,26 @@ sudo chown -R $USER:$USER /var/www/wanwanyun
 ```bash
 cd /var/www/wanwanyun/backend
 
-# 安装依赖
-npm install --production
+# 严格按锁文件安装生产依赖
+npm ci --omit=dev
 
 # 创建数据目录
 mkdir -p data storage
 ```
 
+### 4.1 构建 Web 前端
+
+```bash
+cd /var/www/wanwanyun/frontend
+
+# Vite 是构建依赖，生产构建时也必须安装 devDependencies
+npm ci --include=dev
+npm run build
+
+# Nginx 只需要 dist，可按需释放依赖占用
+rm -rf node_modules
+```
+
 ### 5. 配置环境变量
 
 ```bash
@@ -115,7 +128,8 @@ ADMIN_PASSWORD=你的强密码
 sudo cp /var/www/wanwanyun/nginx/nginx.conf /etc/nginx/sites-available/wanwanyun
 
 # 修改配置中的路径
-sudo sed -i 's|/usr/share/nginx/html|/var/www/wanwanyun/frontend|g' /etc/nginx/sites-available/wanwanyun
+sudo sed -i 's|/usr/share/nginx/html|/var/www/wanwanyun/frontend/dist|g' /etc/nginx/sites-available/wanwanyun
+sudo sed -i 's|/runtime/downloads|/var/www/wanwanyun/frontend/downloads|g' /etc/nginx/sites-available/wanwanyun
 sudo sed -i 's|backend:40001|127.0.0.1:40001|g' /etc/nginx/sites-available/wanwanyun
 
 # 创建软链接启用配置
@@ -133,6 +147,8 @@ sudo systemctl reload nginx
 
 ### 7. 配置系统服务
 
+> 后端当前使用进程内限流器与用量缓存，只能运行一个实例。不要使用 PM2 cluster 模式或同时启动多个 systemd 实例。
+
 创建 systemd 服务文件：
 
 ```bash
@@ -242,7 +258,8 @@ sudo tail -f /var/log/nginx/error.log
 ```bash
 cd /var/www/wanwanyun
 sudo git pull
-cd backend && npm install --production
+cd backend && npm ci --omit=dev
+cd ../frontend && npm ci --include=dev && npm run build && rm -rf node_modules
 sudo systemctl restart wanwanyun
 ```
 
@@ -292,14 +309,9 @@ sudo chown -R www-data:www-data /var/www/wanwanyun/backend/data/
 
 ## 性能优化
 
-### 启用 Nginx 缓存
-在 Nginx 配置的 `location /` 中添加：
-```nginx
-location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2)$ {
-    expires 30d;
-    add_header Cache-Control "public, immutable";
-}
-```
+### Nginx 静态缓存
+
+仓库配置已经对 Vite 哈希资源 `/assets/` 设置一年缓存，对兼容库 `/libs/` 设置 30 天缓存。不要在子 `location` 中单独使用 `add_header Cache-Control`，否则会覆盖上层继承的安全响应头。
 
 ### 配置日志轮转
 ```bash

README.md

@@ -6,7 +6,7 @@
 
 ![Version](https://img.shields.io/badge/version-3.1.0-blue.svg)
 ![License](https://img.shields.io/badge/license-Personal%20Use-green.svg)
-![Node](https://img.shields.io/badge/node-20.x-brightgreen.svg)
+![Node](https://img.shields.io/badge/node-20.19%2B-brightgreen.svg)
 ![Vue](https://img.shields.io/badge/vue-3.x-42b883.svg)
 
 </div>
@@ -54,11 +54,11 @@
 - 支持SMTP配置
 - 邮件模板可自定义
 
-#### 🖥️ 桌面上传工具
-- 拖拽上传，简单易用
-- 实时显示上传进度
-- 自动配置，无需手动设置
-- 支持大文件上传
+#### 🖥️ 桌面客户端
+- Tauri + Vue 桌面端，默认对接网页端账号体系
+- 支持文件浏览、搜索、上传、下载、分享/直链管理
+- 支持断点下载、本地目录同步和客户端更新检测
+- Windows 安装包可通过 `/api/client/desktop-update` 发布和下载
 
 #### ⚡ 一键部署
 - 全自动安装脚本（install.sh）
@@ -72,8 +72,10 @@
 ### 环境要求
 
 - **操作系统**: Linux (Ubuntu 18.04+ / Debian 10+ / CentOS 7+)
+- **Node.js**: 20.19+（支持 20.19-24，推荐与 `.nvmrc` 保持一致）
 - **内存**: 最低 1GB RAM（推荐 2GB+）
 - **磁盘空间**: 至少 2GB 可用空间
+- **后端实例数**: 当前限流与用量缓存为进程内状态，PM2 必须保持单实例 `fork` 模式
 
 ### 方式1: 一键部署（推荐）⭐
 
@@ -123,10 +125,10 @@ docker-compose logs -f
 部署完成后，访问系统：
 
 - **访问地址**: http://你的服务器IP
-- **默认管理员账号**:
-  - 用户名: `admin`
-  - 密码: `admin123`
-  - ⚠️ **请立即登录并修改密码！**
+- **管理员账号**:
+  - 安装脚本会要求你设置管理员用户名和强密码
+  - 密码至少 8 位，并且需要包含字母、数字、特殊字符中的至少两类
+  - 生产环境禁止使用 `admin123`、`12345678` 等默认弱密码
 
 ## 📖 使用指南
 
@@ -210,12 +212,21 @@ SMTP密码: 你的授权码
 3. 复制分享链接发送给他人
 4. 在"我的分享"中管理所有分享链接
 
-### 使用桌面上传工具
+### 使用桌面客户端
 
-1. 进入"上传工具"页面
-2. 下载适合你系统的上传工具
-3. 输入服务器地址和API密钥
-4. 拖拽文件即可上传
+1. 在登录页点击"下载桌面客户端"，或访问后端更新接口获取安装包信息
+2. 安装后使用网页端账号登录
+3. 在客户端中浏览文件、上传/下载、创建分享或直链
+4. 桌面安装包由 Gitea Release 发布，部署脚本会按 `frontend/desktop-release.json` 下载并校验 SHA256
+
+发布新桌面版本时，先创建对应的 `vX.Y.Z` Release 并上传安装包，再更新
+`frontend/desktop-release.json` 的版本、文件名、大小和 SHA256。不要把 `.exe`
+提交到 Git。可用以下命令同步当前版本：
+
+```bash
+cd frontend
+npm run sync:desktop-release
+```
 
 ## 📁 项目结构
 
@@ -232,23 +243,25 @@ vue-driven-cloud-storage/
 │   ├── data/                # 数据库目录
 │   └── storage/             # 本地存储目录
 │
-├── frontend/                # 前端代码
+├── frontend/                # Vite 多页面 Web 前端
 │   ├── index.html          # 登录注册页面
 │   ├── app.html            # 主应用页面
 │   ├── share.html          # 分享页面
 │   ├── verify.html         # 邮箱验证页面
 │   ├── reset-password.html # 密码重置页面
-│   └── libs/               # 第三方库 (Vue.js, Axios, FontAwesome)
+│   ├── package.json        # Vue/Axios/Vite 依赖
+│   ├── vite.config.js      # 多页面生产构建
+│   ├── dist/               # 构建产物（不入库）
+│   └── libs/               # 分享页兼容静态资源与 Font Awesome
 │
 ├── nginx/                   # Nginx 配置
 │   ├── nginx.conf          # 反向代理配置
 │   └── nginx.conf.example  # 配置模板
 │
-├── upload-tool/             # 桌面上传工具
-│   ├── upload_tool.py      # Python 上传工具源码
-│   ├── requirements.txt    # Python 依赖
-│   ├── build.bat           # Windows 打包脚本
-│   └── build.sh            # Linux/Mac 打包脚本
+├── desktop-client/          # Tauri 桌面客户端
+│   ├── src/                # Vue/TypeScript 前端
+│   ├── src-tauri/          # Rust/Tauri 原生能力
+│   └── package.json        # 桌面端依赖和构建脚本
 │
 ├── install.sh              # 一键安装脚本
 ├── docker-compose.yml      # Docker 编排文件
@@ -267,11 +280,11 @@ vue-driven-cloud-storage/
 - **bcrypt** - 密码加密
 - **nodemailer** - 邮件发送
 - **svg-captcha** - 验证码生成
-- **express-session** - Session 管理
 
 ### 前端技术
 - **Vue.js 3** - 渐进式 JavaScript 框架
 - **Axios** - HTTP 请求库
+- **Vite 8** - 多页面构建、依赖打包与哈希缓存
 - **Font Awesome** - 图标库
 - **原生 CSS** - 现代化界面设计
 
@@ -286,7 +299,7 @@ vue-driven-cloud-storage/
 ### 认证与授权
 - ✅ bcrypt 密码加密（10轮盐值）
 - ✅ JWT 令牌认证
-- ✅ Session 安全管理
+- ✅ HttpOnly Cookie + CSRF 双提交令牌
 - ✅ CORS 跨域配置
 - ✅ SQL 注入防护（参数化查询）
 - ✅ XSS 防护（输入过滤）
@@ -310,7 +323,7 @@ vue-driven-cloud-storage/
 
 ```bash
 # Systemd 部署
-sudo systemctl status vue-cloud-storage
+sudo systemctl status wanwanyun
 
 # Docker 部署
 docker-compose ps
@@ -320,7 +333,7 @@ docker-compose ps
 
 ```bash
 # Systemd 部署
-sudo journalctl -u vue-cloud-storage -f
+sudo journalctl -u wanwanyun -f
 
 # Docker 部署
 docker-compose logs -f backend
@@ -330,7 +343,7 @@ docker-compose logs -f backend
 
 ```bash
 # Systemd 部署
-sudo systemctl restart vue-cloud-storage
+sudo systemctl restart wanwanyun
 
 # Docker 部署
 docker-compose restart
@@ -340,23 +353,28 @@ docker-compose restart
 
 ```bash
 # 备份数据库
-sudo cp /var/www/vue-driven-cloud-storage/backend/data/database.db \
+sudo cp /var/www/wanwanyun/backend/data/database.db \
         /backup/database.db.$(date +%Y%m%d)
 
 # 备份上传文件（本地存储模式）
 sudo tar -czf /backup/uploads-$(date +%Y%m%d).tar.gz \
-        /var/www/vue-driven-cloud-storage/backend/uploads/
+        /var/www/wanwanyun/backend/storage/
 ```
 
 ### 更新系统
 
 ```bash
-cd /var/www/vue-driven-cloud-storage
+cd /var/www/wanwanyun
 git pull
-cd backend && npm install
-sudo systemctl restart vue-cloud-storage
+cd backend && npm ci --omit=dev
+cd ../frontend && npm ci --include=dev && npm run build
+sudo systemctl restart wanwanyun
 ```
 
+`install.sh --update` 会在替换线上文件前同步并校验 Gitea Release、构建前端，
+同时保留 `frontend/downloads/` 中已验证的运行时安装包。完整工程约束见
+[CONTRIBUTING.md](./CONTRIBUTING.md)。
+
 ## 📊 性能优化建议
 
 ### 生产环境配置
@@ -396,12 +414,12 @@ A: 登录后进入"管理面板" → "存储管理"，点击切换按钮即可
 A: 点击登录页的"忘记密码"，通过邮箱重置密码。如未配置邮箱，需要手动重置数据库。
 
 **Q: 上传文件大小限制是多少？**
-A: 默认限制 5GB，可在 Nginx 配置中修改 `client_max_body_size`。
+A: 当前默认限制 10GB，可在系统设置和 Nginx 配置中同步调整。
 
 ### 故障排查
 
 **Q: 无法访问系统**
-1. 检查服务是否启动：`sudo systemctl status vue-cloud-storage`
+1. 检查服务是否启动：`sudo systemctl status wanwanyun`
 2. 检查防火墙是否开放端口
 3. 查看 Nginx 日志：`sudo tail -f /var/log/nginx/error.log`
 
@@ -424,6 +442,16 @@ A: 默认限制 5GB，可在 Nginx 配置中修改 `client_max_body_size`。
 
 ## 📝 更新日志
 
+### v3.1.1 (2026-06-13)
+- 🔐 统一文件虚拟路径校验，修复列表、上传、下载、分享相关路径边界问题
+- 🔐 上传参数校验失败时清理临时文件，避免失败上传残留
+- 🔐 密码策略统一为 8-128 字符且至少两类字符，安装脚本和前端提示同步更新
+- 🔐 邮箱验证和重置密码链接使用后清理 URL token
+- 🔐 分享页外部下载窗口增加 `noopener,noreferrer`
+- 🧪 新增隔离 API 审计回归脚本，覆盖登录、CSRF、文件、分享、直链和管理端脱敏
+- 🛠️ 清理已废弃的 `SESSION_SECRET` / `express-session` 文档和安装脚本残留
+- 🖥️ 明确桌面客户端更新接口和 Windows 安装包发布流程
+
 ### v3.1.0 (2025-01-18)
 - 🚀 **重大架构优化**：OSS 直连上传下载（不经过后端）
   - 上传速度提升 50%，服务器流量节省 50%
@@ -474,11 +502,14 @@ A: 默认限制 5GB，可在 Nginx 配置中修改 `client_max_body_size`。
 git clone https://git.workyai.cn/237899745/vue-driven-cloud-storage.git
 cd vue-driven-cloud-storage
 
-# 安装依赖
-cd backend && npm install
+# 安装并测试后端
+cd backend && npm ci && npm test
 
-# 启动开发服务器
-node server.js
+# 终端一：启动后端
+npm run dev
+
+# 终端二：启动 Vite（项目根目录执行）
+cd ../frontend && npm ci && npm run dev
 ```
 
 ### 提交规范

backend/.dockerignore

@@ -1,14 +1,15 @@
 # 依赖目录
 node_modules
 
-# 数据目录
-data/
-storage/
+# 数据目录（仅保留占位文件）
+data/*
+!data/.gitkeep
+storage/*
+!storage/.gitkeep
 
 # 环境配置
 .env
-.env.local
-.env.*.local
+.env.*
 
 # 日志
 *.log
@@ -30,6 +31,7 @@ Thumbs.db
 *.spec.js
 test/
 tests/
+test_*.js
 coverage/
 
 # 文档
@@ -40,7 +42,8 @@ coverage/
 .git
 .gitignore
 
-# 临时文件
+# 临时和平台脚本
 *.tmp
 *.temp
 .cache/
+*.bat

backend/.env.example

@@ -20,7 +20,15 @@ NODE_ENV=production
 
 # 强制HTTPS访问（生产环境建议开启）
 # 设置为 true 时，仅接受 HTTPS 访问
-ENFORCE_HTTPS=false
+ENFORCE_HTTPS=true
+
+# 公开访问地址（生产环境必须配置，用于邮件、分享、直链等外部链接）
+# 示例: PUBLIC_BASE_URL=https://cs.workyai.cn
+PUBLIC_BASE_URL=https://your-domain.example
+
+# Host 白名单（可选；未配置 PUBLIC_BASE_URL 时生产环境必须配置）
+# 示例: ALLOWED_HOSTS=cs.workyai.cn
+ALLOWED_HOSTS=your-domain.example
 
 # 公开访问端口（nginx监听的端口，用于生成分享链接）
 # 标准端口(80/443)可不配置
@@ -33,20 +41,20 @@ PUBLIC_PORT=80
 # 加密密钥（必须配置！）
 # 用于加密 OSS Access Key Secret 等敏感数据
 # 生成方法: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
-ENCRYPTION_KEY=your-encryption-key-please-change-this
+ENCRYPTION_KEY=REPLACE_WITH_64_HEX_CHARACTERS_GENERATED_BY_COMMAND
 
 # JWT密钥（必须修改！）
 # 生成方法: openssl rand -base64 32
 # 或使用: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"
-JWT_SECRET=your-secret-key-PLEASE-CHANGE-THIS-IN-PRODUCTION
+JWT_SECRET=REPLACE_WITH_RANDOM_SECRET_AT_LEAST_32_CHARS
 
 # Refresh Token 密钥（可选，默认使用 JWT_SECRET 派生）
 # 建议生产环境设置独立的密钥
-# REFRESH_SECRET=your-refresh-secret-key
+# REFRESH_SECRET=REPLACE_WITH_SEPARATE_RANDOM_REFRESH_SECRET
 
 # 管理员账号配置（首次启动时创建）
 ADMIN_USERNAME=admin
-ADMIN_PASSWORD=admin123
+ADMIN_PASSWORD=REPLACE_WITH_STRONG_ADMIN_PASSWORD
 
 # ============================================
 # CORS 跨域配置（重要！）
@@ -69,17 +77,24 @@ ADMIN_PASSWORD=admin123
 #   ALLOWED_ORIGINS=https://pan.example.com,https://admin.example.com
 #   ALLOWED_ORIGINS=http://localhost:8080  # 开发环境
 #
-ALLOWED_ORIGINS=
+ALLOWED_ORIGINS=https://your-domain.example
 
 # Cookie 安全配置
 # 使用 HTTPS 时必须设置为 true
 # HTTP 环境设置为 false
-COOKIE_SECURE=false
+COOKIE_SECURE=true
 
 # CSRF 防护配置
 # 启用 CSRF 保护（建议生产环境开启）
 # 前端会自动从 Cookie 读取 csrf_token 并在请求头中发送
-ENABLE_CSRF=false
+ENABLE_CSRF=true
+
+# 全局 API IP 限流（现有登录/分享细粒度限流之外的连接兜底）
+API_RATE_LIMIT_WINDOW_MS=60000
+API_RATE_LIMIT_MAX=600
+
+# 健康检查判定磁盘空间不足的阈值（默认 256MB）
+HEALTH_MIN_DISK_FREE_BYTES=268435456
 
 # ============================================
 # 反向代理配置（Nginx/Cloudflare等）
@@ -97,7 +112,7 @@ ENABLE_CSRF=false
 # ⚠️ 重要: 如果使用 Nginx 反向代理并开启 ENFORCE_HTTPS=true
 #          必须配置 TRUST_PROXY=1，否则后端无法正确识别HTTPS请求
 #
-TRUST_PROXY=false
+TRUST_PROXY=1
 
 # ============================================
 # 存储配置
@@ -126,15 +141,11 @@ STORAGE_ROOT=./storage
 # OSS_ENDPOINT=                # 自定义 Endpoint（可选）
 
 # ============================================
-# Session 配置
+# 验证码票据配置
 # ============================================
 
-# Session 密钥（用于验证码等功能）
-# 默认使用随机生成的密钥
-# SESSION_SECRET=your-session-secret
-
-# Session 过期时间（毫秒），默认 30 分钟
-# SESSION_MAX_AGE=1800000
+# 验证码票据签名密钥（可选；默认复用 JWT_SECRET）
+# CAPTCHA_SECRET=replace-with-random-32-byte-hex
 
 # ============================================
 # 开发调试配置
@@ -143,6 +154,9 @@ STORAGE_ROOT=./storage
 # 日志级别 (error, warn, info, debug)
 # LOG_LEVEL=info
 
+# production 默认输出 JSON；开发环境可显式开启
+# LOG_FORMAT=json
+
 # 是否启用调试模式
 # DEBUG=false
 

backend/Dockerfile

@@ -1,28 +1,27 @@
-FROM node:20-alpine
+FROM node:20-alpine AS dependencies
 
 WORKDIR /app
 
-# 安装编译工具和健康检查所需的 wget
+# 原生依赖使用镜像内置 Node headers，避免构建时依赖外部 headers 下载站点。
 RUN apk add --no-cache python3 make g++ wget
+ENV npm_config_nodedir=/usr/local
 
-# 复制 package 文件
 COPY package*.json ./
+RUN npm ci --omit=dev
 
-# 安装依赖
-RUN npm install --production
+FROM node:20-alpine AS runtime
 
-# 复制应用代码
+WORKDIR /app
+
+RUN apk add --no-cache libstdc++ wget
+COPY --from=dependencies /app/node_modules ./node_modules
 COPY . .
 
-# 创建数据目录
 RUN mkdir -p /app/data /app/storage
 
-# 暴露端口
 EXPOSE 40001
 
-# 健康检查
 HEALTHCHECK --interval=30s --timeout=10s --start-period=40s --retries=3 \
     CMD wget --spider -q http://localhost:40001/api/health || exit 1
 
-# 启动应用
 CMD ["node", "server.js"]

backend/auth.js

@@ -1,7 +1,26 @@
 const jwt = require('jsonwebtoken');
 const crypto = require('crypto');
-const { UserDB } = require('./database');
+const { UserDB, DeviceSessionDB, SystemLogDB } = require('./database');
 const { decryptSecret } = require('./utils/encryption');
+const DEFAULT_LOCAL_STORAGE_QUOTA_BYTES = 1024 * 1024 * 1024; // 1GB
+const DEFAULT_OSS_STORAGE_QUOTA_BYTES = 1024 * 1024 * 1024; // 1GB
+
+function normalizeDownloadTrafficQuotaForAuth(rawQuota) {
+  if (rawQuota === null || rawQuota === undefined || rawQuota === '') {
+    return -1; // 未设置时默认不限流量
+  }
+
+  const parsedQuota = Number(rawQuota);
+  if (!Number.isFinite(parsedQuota)) {
+    return -1;
+  }
+
+  if (parsedQuota < 0) {
+    return -1; // -1 表示不限流量
+  }
+
+  return Math.max(0, Math.floor(parsedQuota)); // 0 表示禁止下载
+}
 
 // JWT密钥（必须在环境变量中设置）
 const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key-change-in-production';
@@ -15,7 +34,8 @@ const REFRESH_TOKEN_EXPIRES = '7d';   // Refresh token 7天
 // 安全检查：验证JWT密钥配置
 const DEFAULT_SECRETS = [
   'your-secret-key-change-in-production',
-  'your-secret-key-change-in-production-PLEASE-CHANGE-THIS'
+  'your-secret-key-change-in-production-PLEASE-CHANGE-THIS',
+  'your-secret-key-PLEASE-CHANGE-THIS-IN-PRODUCTION'
 ];
 
 // 安全修复：增强 JWT_SECRET 验证逻辑
@@ -62,13 +82,16 @@ if (JWT_SECRET.length < 32) {
 console.log('[安全] ✓ JWT密钥验证通过');
 
 // 生成Access Token（短期）
-function generateToken(user) {
+function generateToken(user, sessionId = null) {
+  const safeSessionId = typeof sessionId === 'string' && sessionId.trim() ? sessionId.trim() : null;
   return jwt.sign(
     {
       id: user.id,
       username: user.username,
       is_admin: user.is_admin,
-      type: 'access'
+      type: 'access',
+      sid: safeSessionId,
+      jti: crypto.randomBytes(12).toString('hex')
     },
     JWT_SECRET,
     { expiresIn: ACCESS_TOKEN_EXPIRES }
@@ -76,11 +99,13 @@ function generateToken(user) {
 }
 
 // 生成Refresh Token（长期）
-function generateRefreshToken(user) {
+function generateRefreshToken(user, sessionId = null) {
+  const safeSessionId = typeof sessionId === 'string' && sessionId.trim() ? sessionId.trim() : null;
   return jwt.sign(
     {
       id: user.id,
       type: 'refresh',
+      sid: safeSessionId,
       // 添加随机标识，使每次生成的refresh token不同
       jti: crypto.randomBytes(16).toString('hex')
     },
@@ -89,8 +114,26 @@ function generateRefreshToken(user) {
   );
 }
 
+function decodeAccessToken(token) {
+  if (!token || typeof token !== 'string') return null;
+  try {
+    return jwt.verify(token, JWT_SECRET);
+  } catch {
+    return null;
+  }
+}
+
+function decodeRefreshToken(token) {
+  if (!token || typeof token !== 'string') return null;
+  try {
+    return jwt.verify(token, REFRESH_SECRET);
+  } catch {
+    return null;
+  }
+}
+
 // 验证Refresh Token并返回新的Access Token
-function refreshAccessToken(refreshToken) {
+function refreshAccessToken(refreshToken, context = {}) {
   try {
     const decoded = jwt.verify(refreshToken, REFRESH_SECRET);
 
@@ -98,6 +141,18 @@ function refreshAccessToken(refreshToken) {
       return { success: false, message: '无效的刷新令牌类型' };
     }
 
+    const sessionId = typeof decoded.sid === 'string' ? decoded.sid.trim() : '';
+    if (sessionId) {
+      const activeSession = DeviceSessionDB.findActiveBySessionId(sessionId);
+      if (!activeSession || Number(activeSession.user_id) !== Number(decoded.id)) {
+        return { success: false, message: '当前设备会话已失效，请重新登录' };
+      }
+      DeviceSessionDB.touch(sessionId, {
+        ipAddress: context.ipAddress,
+        userAgent: context.userAgent
+      });
+    }
+
     const user = UserDB.findById(decoded.id);
 
     if (!user) {
@@ -113,11 +168,12 @@ function refreshAccessToken(refreshToken) {
     }
 
     // 生成新的access token
-    const newAccessToken = generateToken(user);
+    const newAccessToken = generateToken(user, sessionId || null);
 
     return {
       success: true,
       token: newAccessToken,
+      sessionId: sessionId || null,
       user: {
         id: user.id,
         username: user.username,
@@ -146,6 +202,29 @@ function authMiddleware(req, res, next) {
 
   try {
     const decoded = jwt.verify(token, JWT_SECRET);
+
+    if (decoded.type !== 'access') {
+      return res.status(401).json({
+        success: false,
+        message: '无效的令牌类型'
+      });
+    }
+
+    const sessionId = typeof decoded.sid === 'string' ? decoded.sid.trim() : '';
+    if (sessionId) {
+      const activeSession = DeviceSessionDB.findActiveBySessionId(sessionId);
+      if (!activeSession || Number(activeSession.user_id) !== Number(decoded.id)) {
+        return res.status(401).json({
+          success: false,
+          message: '当前设备已下线，请重新登录'
+        });
+      }
+      DeviceSessionDB.touch(sessionId, {
+        ipAddress: req.ip || req.socket?.remoteAddress || '',
+        userAgent: req.get('user-agent') || ''
+      });
+    }
+
     const user = UserDB.findById(decoded.id);
 
     if (!user) {
@@ -169,6 +248,19 @@ function authMiddleware(req, res, next) {
       });
     }
 
+    const rawOssQuota = Number(user.oss_storage_quota);
+    const effectiveOssQuota = Number.isFinite(rawOssQuota) && rawOssQuota > 0
+      ? rawOssQuota
+      : DEFAULT_OSS_STORAGE_QUOTA_BYTES;
+    const effectiveDownloadTrafficQuota = normalizeDownloadTrafficQuotaForAuth(user.download_traffic_quota);
+    const rawDownloadTrafficUsed = Number(user.download_traffic_used);
+    const normalizedDownloadTrafficUsed = Number.isFinite(rawDownloadTrafficUsed) && rawDownloadTrafficUsed > 0
+      ? Math.floor(rawDownloadTrafficUsed)
+      : 0;
+    const cappedDownloadTrafficUsed = effectiveDownloadTrafficQuota > 0
+      ? Math.min(normalizedDownloadTrafficUsed, effectiveDownloadTrafficQuota)
+      : normalizedDownloadTrafficUsed;
+
     // 将用户信息附加到请求对象（包含所有存储相关字段）
     req.user = {
       id: user.id,
@@ -180,18 +272,31 @@ function authMiddleware(req, res, next) {
       oss_provider: user.oss_provider,
       oss_region: user.oss_region,
       oss_access_key_id: user.oss_access_key_id,
-      // 安全修复：解密 OSS Access Key Secret（如果存在）
-      oss_access_key_secret: user.oss_access_key_secret ? decryptSecret(user.oss_access_key_secret) : null,
       oss_bucket: user.oss_bucket,
       oss_endpoint: user.oss_endpoint,
       // 存储相关字段
       storage_permission: user.storage_permission || 'oss_only',
       current_storage_type: user.current_storage_type || 'oss',
-      local_storage_quota: user.local_storage_quota || 1073741824,
+      local_storage_quota: user.local_storage_quota || DEFAULT_LOCAL_STORAGE_QUOTA_BYTES,
       local_storage_used: user.local_storage_used || 0,
+      oss_storage_quota: effectiveOssQuota,
+      storage_used: user.storage_used || 0,
+      download_traffic_quota: effectiveDownloadTrafficQuota,
+      download_traffic_used: cappedDownloadTrafficUsed,
+      download_traffic_quota_expires_at: user.download_traffic_quota_expires_at || null,
+      download_traffic_reset_cycle: user.download_traffic_reset_cycle || 'none',
+      download_traffic_last_reset_at: user.download_traffic_last_reset_at || null,
       // 主题偏好
       theme_preference: user.theme_preference || null
     };
+    Object.defineProperty(req.user, 'oss_access_key_secret', {
+      value: user.oss_access_key_secret ? decryptSecret(user.oss_access_key_secret) : null,
+      enumerable: false,
+      configurable: false,
+      writable: false
+    });
+    req.authSessionId = sessionId || null;
+    req.authTokenJti = typeof decoded.jti === 'string' ? decoded.jti : null;
 
     next();
   } catch (error) {
@@ -235,14 +340,21 @@ function adminMiddleware(req, res, next) {
  * );
  */
 function requirePasswordConfirmation(req, res, next) {
-  const { password } = req.body;
+  const password = String(
+    req.body?.current_password ||
+    req.body?.admin_password ||
+    req.body?.password_confirmation ||
+    req.body?.password ||
+    ''
+  );
 
   // 检查是否提供了密码
   if (!password) {
     return res.status(400).json({
       success: false,
       message: '执行此操作需要验证密码',
-      require_password: true
+      require_password: true,
+      requirePasswordConfirmation: true
     });
   }
 
@@ -269,7 +381,6 @@ function requirePasswordConfirmation(req, res, next) {
 
   if (!isPasswordValid) {
     // 记录安全日志：密码验证失败
-    SystemLogDB = require('./database').SystemLogDB;
     SystemLogDB.log({
       level: SystemLogDB.LEVELS.WARN,
       category: SystemLogDB.CATEGORIES.SECURITY,
@@ -304,6 +415,8 @@ module.exports = {
   JWT_SECRET,
   generateToken,
   generateRefreshToken,
+  decodeAccessToken,
+  decodeRefreshToken,
   refreshAccessToken,
   authMiddleware,
   adminMiddleware,

backend/fix_expires_at_format.js

@@ -19,8 +19,20 @@ shares.forEach(share => {
   
   // 如果是ISO格式(包含T和Z),需要转换
   if (oldFormat.includes('T') || oldFormat.includes('Z')) {
-    // 转换为 SQLite datetime 格式: YYYY-MM-DD HH:MM:SS
-    const newFormat = oldFormat.replace('T', ' ').replace(/\.\d+Z$/, '');
+    const parsed = new Date(oldFormat);
+    if (Number.isNaN(parsed.getTime())) {
+      console.warn(`跳过无法解析的时间: ${share.share_code} -> ${oldFormat}`);
+      return;
+    }
+
+    // 转换为本地时区 SQLite datetime 格式: YYYY-MM-DD HH:MM:SS
+    const year = parsed.getFullYear();
+    const month = String(parsed.getMonth() + 1).padStart(2, '0');
+    const day = String(parsed.getDate()).padStart(2, '0');
+    const hours = String(parsed.getHours()).padStart(2, '0');
+    const minutes = String(parsed.getMinutes()).padStart(2, '0');
+    const seconds = String(parsed.getSeconds()).padStart(2, '0');
+    const newFormat = `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
     
     updateStmt.run(newFormat, share.id);
     fixed++;

backend/middleware/csrf.js

@@ -0,0 +1,68 @@
+const crypto = require('crypto');
+
+const { logger } = require('../utils/logger');
+
+const CSRF_COOKIE_NAME = 'csrf_token';
+const CSRF_COOKIE_MAX_AGE_MS = 24 * 60 * 60 * 1000;
+
+function generateCsrfToken() {
+  return crypto.randomBytes(32).toString('hex');
+}
+
+function setCsrfCookie(res, token, secureCookies) {
+  res.cookie(CSRF_COOKIE_NAME, token, {
+    httpOnly: false,
+    secure: secureCookies,
+    sameSite: secureCookies ? 'strict' : 'lax',
+    maxAge: CSRF_COOKIE_MAX_AGE_MS
+  });
+}
+
+function createCsrfCookieMiddleware({ secureCookies = false } = {}) {
+  return (req, res, next) => {
+    if (!req.cookies[CSRF_COOKIE_NAME]) {
+      setCsrfCookie(res, generateCsrfToken(), secureCookies);
+    }
+    next();
+  };
+}
+
+function tokensEqual(left, right) {
+  if (typeof left !== 'string' || typeof right !== 'string') return false;
+  const leftBuffer = Buffer.from(left);
+  const rightBuffer = Buffer.from(right);
+  return leftBuffer.length === rightBuffer.length && crypto.timingSafeEqual(leftBuffer, rightBuffer);
+}
+
+function csrfProtection(req, res, next) {
+  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();
+
+  const hasCookieAuth = Boolean(req.cookies?.token || req.cookies?.refreshToken);
+  if (!hasCookieAuth) return next();
+
+  const cookieToken = req.cookies[CSRF_COOKIE_NAME];
+  const headerToken = req.headers['x-csrf-token'];
+  if (!tokensEqual(cookieToken, headerToken)) {
+    (req.log || logger).warn({
+      path: req.path,
+      hasCookieToken: Boolean(cookieToken),
+      hasHeaderToken: Boolean(headerToken)
+    }, 'CSRF validation failed');
+    return res.status(403).json({
+      success: false,
+      message: 'CSRF 验证失败，请刷新页面后重试',
+      requestId: req.id
+    });
+  }
+
+  return next();
+}
+
+module.exports = {
+  CSRF_COOKIE_NAME,
+  createCsrfCookieMiddleware,
+  csrfProtection,
+  generateCsrfToken,
+  setCsrfCookie,
+  tokensEqual
+};

backend/middleware/error-handler.js

@@ -0,0 +1,26 @@
+const { getRequestId, logger } = require('../utils/logger');
+
+function expressErrorHandler(err, req, res, next) {
+  if (res.headersSent) return next(err);
+
+  const requestedStatus = Number(err?.statusCode || err?.status);
+  const status = Number.isInteger(requestedStatus) && requestedStatus >= 400 && requestedStatus <= 599
+    ? requestedStatus
+    : 500;
+
+  const requestId = getRequestId(req);
+  (req.log || logger).error({
+    err,
+    method: req.method,
+    path: req.path || req.originalUrl,
+    statusCode: status
+  }, 'unhandled request error');
+
+  return res.status(status).json({
+    success: false,
+    message: status >= 500 ? '服务器内部错误' : (err?.message || '请求处理失败'),
+    ...(requestId ? { requestId } : {})
+  });
+}
+
+module.exports = { expressErrorHandler };

backend/middleware/rate-limit.js

@@ -0,0 +1,149 @@
+const { rateLimit } = require('express-rate-limit');
+
+const { logger } = require('../utils/logger');
+
+function parsePositiveInteger(value, fallback) {
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed > 0 ? parsed : fallback;
+}
+
+function createGlobalApiLimiter(options = {}) {
+  const windowMs = parsePositiveInteger(options.windowMs ?? process.env.API_RATE_LIMIT_WINDOW_MS, 60_000);
+  const limit = parsePositiveInteger(options.limit ?? process.env.API_RATE_LIMIT_MAX, 600);
+
+  return rateLimit({
+    windowMs,
+    limit,
+    standardHeaders: 'draft-8',
+    legacyHeaders: false,
+    skip: (req) => req.method === 'OPTIONS' || req.path === '/health',
+    handler: (req, res) => {
+      (req.log || logger).warn({ method: req.method, path: req.path }, 'global API rate limit exceeded');
+      res.status(429).json({
+        success: false,
+        message: '请求过于频繁，请稍后再试',
+        requestId: req.id
+      });
+    }
+  });
+}
+
+class RateLimiter {
+  constructor(options = {}) {
+    this.maxAttempts = options.maxAttempts || 5;
+    this.windowMs = options.windowMs || 15 * 60 * 1000;
+    this.blockDuration = options.blockDuration || 30 * 60 * 1000;
+    this.attempts = new Map();
+    this.blockedKeys = new Map();
+    this.cleanupInterval = setInterval(() => this.cleanup(), 5 * 60 * 1000);
+    this.cleanupInterval.unref?.();
+  }
+
+  getClientKey(req) {
+    return req.ip || req.socket?.remoteAddress || 'unknown';
+  }
+
+  isBlocked(key) {
+    const blockInfo = this.blockedKeys.get(key);
+    if (!blockInfo) return false;
+
+    if (Date.now() > blockInfo.expiresAt) {
+      this.blockedKeys.delete(key);
+      this.attempts.delete(key);
+      return false;
+    }
+    return true;
+  }
+
+  recordFailure(key) {
+    const now = Date.now();
+    if (this.isBlocked(key)) {
+      const blockInfo = this.blockedKeys.get(key);
+      return {
+        blocked: true,
+        remainingAttempts: 0,
+        resetTime: blockInfo.expiresAt,
+        waitMinutes: Math.ceil((blockInfo.expiresAt - now) / 60_000),
+        needCaptcha: true
+      };
+    }
+
+    let attemptInfo = this.attempts.get(key);
+    if (!attemptInfo || now > attemptInfo.windowEnd) {
+      attemptInfo = { count: 0, windowEnd: now + this.windowMs, firstAttempt: now };
+    }
+
+    attemptInfo.count += 1;
+    this.attempts.set(key, attemptInfo);
+    if (attemptInfo.count >= this.maxAttempts) {
+      const blockExpiresAt = now + this.blockDuration;
+      this.blockedKeys.set(key, { expiresAt: blockExpiresAt, blockedAt: now });
+      logger.warn({ key, attempts: attemptInfo.count, blockDuration: this.blockDuration }, 'failure limiter blocked key');
+      return {
+        blocked: true,
+        remainingAttempts: 0,
+        resetTime: blockExpiresAt,
+        waitMinutes: Math.ceil(this.blockDuration / 60_000),
+        needCaptcha: true
+      };
+    }
+
+    return {
+      blocked: false,
+      remainingAttempts: this.maxAttempts - attemptInfo.count,
+      resetTime: attemptInfo.windowEnd,
+      waitMinutes: 0,
+      needCaptcha: attemptInfo.count >= 2
+    };
+  }
+
+  getFailureCount(key) {
+    const attemptInfo = this.attempts.get(key);
+    if (!attemptInfo || Date.now() > attemptInfo.windowEnd) return 0;
+    return attemptInfo.count;
+  }
+
+  recordSuccess(key) {
+    this.attempts.delete(key);
+    this.blockedKeys.delete(key);
+  }
+
+  cleanup() {
+    const now = Date.now();
+    let cleanedAttempts = 0;
+    let cleanedBlocks = 0;
+
+    for (const [key, info] of this.attempts.entries()) {
+      if (now > info.windowEnd) {
+        this.attempts.delete(key);
+        cleanedAttempts += 1;
+      }
+    }
+    for (const [key, info] of this.blockedKeys.entries()) {
+      if (now > info.expiresAt) {
+        this.blockedKeys.delete(key);
+        cleanedBlocks += 1;
+      }
+    }
+
+    if (cleanedAttempts || cleanedBlocks) {
+      logger.info({ cleanedAttempts, cleanedBlocks }, 'failure limiter cleanup completed');
+    }
+  }
+
+  getStats() {
+    return {
+      activeAttempts: this.attempts.size,
+      blockedKeys: this.blockedKeys.size
+    };
+  }
+
+  destroy() {
+    if (this.cleanupInterval) clearInterval(this.cleanupInterval);
+  }
+}
+
+module.exports = {
+  RateLimiter,
+  createGlobalApiLimiter
+};

backend/middleware/security.js

@@ -0,0 +1,49 @@
+const LOCAL_HEALTH_ADDRESSES = new Set([
+  '127.0.0.1',
+  '::1',
+  '::ffff:127.0.0.1'
+]);
+
+function applySecurityHeaders(req, res, options = {}) {
+  res.setHeader('X-Frame-Options', 'SAMEORIGIN');
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('X-XSS-Protection', '1; mode=block');
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+  res.setHeader('Permissions-Policy', 'camera=(), geolocation=(), microphone=()');
+  res.setHeader(
+    'Content-Security-Policy',
+    "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; media-src 'self' blob: https:; connect-src 'self' https: ws: wss:; worker-src 'self' blob:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self';"
+  );
+
+  if (req?.secure || (!req && options.secureByDefault)) {
+    res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+  }
+  res.removeHeader('X-Powered-By');
+}
+
+function securityHeadersMiddleware(options = {}) {
+  return (req, res, next) => {
+    applySecurityHeaders(req, res, options);
+    next();
+  };
+}
+
+function createHttpsEnforcementMiddleware({ enabled = false } = {}) {
+  return (req, res, next) => {
+    const remoteAddress = req.socket?.remoteAddress || '';
+    const isLocalHealthCheck = req.path === '/api/health' && LOCAL_HEALTH_ADDRESSES.has(remoteAddress);
+    if (!enabled || isLocalHealthCheck || req.secure) return next();
+
+    return res.status(400).json({
+      success: false,
+      message: '仅支持HTTPS访问，请使用HTTPS',
+      requestId: req.id
+    });
+  };
+}
+
+module.exports = {
+  applySecurityHeaders,
+  createHttpsEnforcementMiddleware,
+  securityHeadersMiddleware
+};

backend/package.json

@@ -3,9 +3,15 @@
   "version": "3.1.0",
   "description": "玩玩云 - 云存储管理平台后端服务",
   "main": "server.js",
+  "engines": {
+    "node": ">=20.19 <25"
+  },
   "scripts": {
     "start": "node server.js",
-    "dev": "nodemon server.js"
+    "dev": "node --watch server.js",
+    "test": "npm run test:unit && npm run test:integration && node test_download_quota_defaults.js",
+    "test:unit": "node tests/run-all-tests.js",
+    "test:integration": "node tests/full-audit-regression.js"
   },
   "keywords": [
     "cloud-storage",
@@ -18,23 +24,23 @@
   "author": "玩玩云团队",
   "license": "MIT",
   "dependencies": {
-    "archiver": "^7.0.1",
+    "@aws-sdk/client-s3": "^3.985.0",
+    "@aws-sdk/s3-request-presigner": "^3.985.0",
+    "archiver": "^8.0.0",
     "bcryptjs": "^3.0.3",
     "better-sqlite3": "^11.8.1",
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
     "dotenv": "^16.3.1",
     "express": "^4.18.2",
-    "express-session": "^1.18.2",
+    "express-async-errors": "3.1.1",
+    "express-rate-limit": "8.6.1",
     "express-validator": "^7.3.0",
     "jsonwebtoken": "^9.0.2",
-    "multer": "^2.0.2",
-    "nodemailer": "^6.9.14",
-    "@aws-sdk/client-s3": "^3.600.0",
-    "@aws-sdk/s3-request-presigner": "^3.600.0",
+    "lodash": "^4.17.23",
+    "multer": "^2.2.0",
+    "nodemailer": "^9.0.3",
+    "pino": "10.3.1",
     "svg-captcha": "^1.4.0"
-  },
-  "devDependencies": {
-    "nodemon": "^3.0.1"
   }
 }

backend/routes/health.js

@@ -1,52 +0,0 @@
-/**
- * 健康检查和公共配置路由
- * 提供服务健康状态和公共配置信息
- */
-
-const express = require('express');
-const router = express.Router();
-const { SettingsDB } = require('../database');
-
-/**
- * 健康检查端点
- * GET /api/health
- */
-router.get('/health', (req, res) => {
-  res.json({ success: true, message: 'Server is running' });
-});
-
-/**
- * 获取公开的系统配置（不需要登录）
- * GET /api/config
- */
-router.get('/config', (req, res) => {
-  const maxUploadSize = parseInt(SettingsDB.get('max_upload_size') || '10737418240');
-  res.json({
-    success: true,
-    config: {
-      max_upload_size: maxUploadSize
-    }
-  });
-});
-
-/**
- * 获取公开的全局主题设置（不需要登录）
- * GET /api/public/theme
- */
-router.get('/public/theme', (req, res) => {
-  try {
-    const globalTheme = SettingsDB.get('global_theme') || 'dark';
-    res.json({
-      success: true,
-      theme: globalTheme
-    });
-  } catch (error) {
-    console.error('获取全局主题失败:', error);
-    res.status(500).json({
-      success: false,
-      message: '获取主题失败'
-    });
-  }
-});
-
-module.exports = router;

backend/routes/index.js

@@ -1,90 +0,0 @@
-/**
- * 路由模块索引
- *
- * 本项目的路由目前主要定义在 server.js 中。
- * 此目录用于未来路由拆分的模块化重构。
- *
- * 建议的路由模块拆分方案：
- *
- * 1. routes/health.js - 健康检查和公共配置
- *    - GET /api/health
- *    - GET /api/config
- *    - GET /api/public/theme
- *
- * 2. routes/auth.js - 认证相关
- *    - POST /api/login
- *    - POST /api/register
- *    - POST /api/logout
- *    - POST /api/refresh-token
- *    - POST /api/password/forgot
- *    - POST /api/password/reset
- *    - GET /api/verify-email
- *    - POST /api/resend-verification
- *    - GET /api/captcha
- *    - GET /api/csrf-token
- *
- * 3. routes/user.js - 用户相关
- *    - GET /api/user/profile
- *    - GET /api/user/theme
- *    - POST /api/user/theme
- *    - POST /api/user/update-oss
- *    - POST /api/user/test-oss
- *    - GET /api/user/oss-usage
- *    - POST /api/user/change-password
- *    - POST /api/user/update-username
- *    - POST /api/user/switch-storage
- *
- * 4. routes/files.js - 文件操作
- *    - GET /api/files
- *    - POST /api/files/rename
- *    - POST /api/files/mkdir
- *    - POST /api/files/folder-info
- *    - POST /api/files/delete
- *    - GET /api/files/upload-signature
- *    - POST /api/files/upload-complete
- *    - GET /api/files/download-url
- *    - GET /api/files/download
- *    - POST /api/upload
- *
- * 5. routes/share.js - 分享功能
- *    - POST /api/share/create
- *    - GET /api/share/my
- *    - DELETE /api/share/:id
- *    - GET /api/share/:code/theme
- *    - POST /api/share/:code/verify
- *    - POST /api/share/:code/list
- *    - POST /api/share/:code/download
- *    - GET /api/share/:code/download-url
- *    - GET /api/share/:code/download-file
- *
- * 6. routes/admin.js - 管理员功能
- *    - GET /api/admin/settings
- *    - POST /api/admin/settings
- *    - POST /api/admin/settings/test-smtp
- *    - GET /api/admin/health-check
- *    - GET /api/admin/storage-stats
- *    - GET /api/admin/users
- *    - GET /api/admin/logs
- *    - GET /api/admin/logs/stats
- *    - POST /api/admin/logs/cleanup
- *    - POST /api/admin/users/:id/ban
- *    - DELETE /api/admin/users/:id
- *    - POST /api/admin/users/:id/storage-permission
- *    - GET /api/admin/users/:id/files
- *    - GET /api/admin/shares
- *    - DELETE /api/admin/shares/:id
- *    - GET /api/admin/check-upload-tool
- *    - POST /api/admin/upload-tool
- *
- * 使用示例（在 server.js 中）：
- * ```javascript
- * const healthRoutes = require('./routes/health');
- * app.use('/api', healthRoutes);
- * ```
- */
-
-const healthRoutes = require('./health');
-
-module.exports = {
-  healthRoutes
-};

backend/routes/system.routes.js

@@ -0,0 +1,35 @@
+const express = require('express');
+
+function createSystemRouter({ SettingsDB, healthService }) {
+  const router = express.Router();
+
+  router.get('/health', (req, res) => {
+    const result = healthService.check();
+    res.status(result.healthy ? 200 : 503).json({
+      success: result.healthy,
+      status: result.status,
+      uptimeSeconds: Math.floor(process.uptime()),
+      timestamp: new Date().toISOString(),
+      requestId: req.id,
+      checks: result.checks
+    });
+  });
+
+  router.get('/config', (req, res) => {
+    const maxUploadSize = parseInt(SettingsDB.get('max_upload_size') || '10737418240', 10);
+    res.json({ success: true, config: { max_upload_size: maxUploadSize } });
+  });
+
+  router.get('/public/theme', (req, res) => {
+    try {
+      const globalTheme = SettingsDB.get('global_theme') || 'dark';
+      res.json({ success: true, theme: globalTheme });
+    } catch {
+      res.json({ success: true, theme: 'dark' });
+    }
+  });
+
+  return router;
+}
+
+module.exports = { createSystemRouter };

backend/services/health-service.js

@@ -0,0 +1,59 @@
+const fs = require('fs');
+
+const DEFAULT_MIN_FREE_BYTES = 256 * 1024 * 1024;
+
+function normalizeMinimumFreeBytes(value) {
+  const parsed = Number(value);
+  return Number.isSafeInteger(parsed) && parsed >= 0 ? parsed : DEFAULT_MIN_FREE_BYTES;
+}
+
+function createHealthService({ db, diskPath, minimumFreeBytes = process.env.HEALTH_MIN_DISK_FREE_BYTES }) {
+  const diskThreshold = normalizeMinimumFreeBytes(minimumFreeBytes);
+
+  function checkDatabase() {
+    const startedAt = process.hrtime.bigint();
+    try {
+      const row = db.prepare('SELECT 1 AS ok').get();
+      return {
+        status: row?.ok === 1 ? 'ok' : 'error',
+        latencyMs: Number((Number(process.hrtime.bigint() - startedAt) / 1e6).toFixed(2))
+      };
+    } catch (error) {
+      return { status: 'error', message: error.code || error.name || 'database_error' };
+    }
+  }
+
+  function checkDisk() {
+    try {
+      const stats = fs.statfsSync(diskPath);
+      const freeBytes = Number(BigInt(stats.bavail) * BigInt(stats.bsize));
+      return {
+        status: freeBytes >= diskThreshold ? 'ok' : 'low',
+        freeBytes,
+        minimumFreeBytes: diskThreshold
+      };
+    } catch (error) {
+      return { status: 'error', message: error.code || error.name || 'disk_error' };
+    }
+  }
+
+  function check() {
+    const checks = {
+      database: checkDatabase(),
+      disk: checkDisk()
+    };
+    const healthy = checks.database.status === 'ok' && checks.disk.status === 'ok';
+    return {
+      healthy,
+      status: healthy ? 'ok' : 'degraded',
+      checks
+    };
+  }
+
+  return { check };
+}
+
+module.exports = {
+  createHealthService,
+  normalizeMinimumFreeBytes
+};

backend/storage.js

@@ -1,4 +1,16 @@
-const { S3Client, PutObjectCommand, GetObjectCommand, DeleteObjectsCommand, ListObjectsV2Command, HeadObjectCommand, CopyObjectCommand } = require('@aws-sdk/client-s3');
+const {
+  S3Client,
+  PutObjectCommand,
+  GetObjectCommand,
+  DeleteObjectsCommand,
+  ListObjectsV2Command,
+  HeadObjectCommand,
+  CopyObjectCommand,
+  CreateMultipartUploadCommand,
+  UploadPartCommand,
+  CompleteMultipartUploadCommand,
+  AbortMultipartUploadCommand
+} = require('@aws-sdk/client-s3');
 const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');
 const fs = require('fs');
 const path = require('path');
@@ -18,6 +30,26 @@ function formatFileSize(bytes) {
   return Math.round(bytes / Math.pow(k, i) * 100) / 100 + ' ' + sizes[i];
 }
 
+function parsePositiveInteger(value, fallback) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0) {
+    return fallback;
+  }
+  return Math.floor(parsed);
+}
+
+const OSS_MULTIPART_MAX_PARTS = 10000;
+const OSS_MULTIPART_MIN_PART_SIZE = 5 * 1024 * 1024; // S3 协议要求最小 5MB（最后一片除外）
+const OSS_MULTIPART_DEFAULT_PART_SIZE = Math.max(
+  OSS_MULTIPART_MIN_PART_SIZE,
+  parsePositiveInteger(process.env.OSS_MULTIPART_PART_SIZE_BYTES, 16 * 1024 * 1024)
+);
+const OSS_SINGLE_UPLOAD_THRESHOLD = Math.max(
+  OSS_MULTIPART_MIN_PART_SIZE,
+  parsePositiveInteger(process.env.OSS_SINGLE_UPLOAD_THRESHOLD_BYTES, 64 * 1024 * 1024)
+);
+const OSS_RENAME_RECOVERY_KEYS = new Set();
+
 /**
  * 将 OSS/网络错误转换为友好的错误信息
  * @param {Error} error - 原始错误
@@ -199,8 +231,10 @@ class LocalStorageClient {
 
     // 检查配额：只检查净增量（新文件大小 - 旧文件大小）
     const netIncrease = newFileSize - oldFileSize;
+    let reservedDelta = 0;
     if (netIncrease > 0) {
       this.checkQuota(netIncrease);
+      reservedDelta = netIncrease;
     }
 
     // 确保目标目录存在
@@ -211,27 +245,54 @@ class LocalStorageClient {
 
     // 使用临时文件+重命名模式，避免文件被占用问题
     const tempPath = `${destPath}.uploading_${Date.now()}`;
+    const backupPath = `${destPath}.backup_${Date.now()}`;
+    let backupCreated = false;
+    let destReplaced = false;
 
     try {
-      // 复制到临时文件
-      fs.copyFileSync(localPath, tempPath);
-
-      // 如果目标文件存在，先删除
       if (fs.existsSync(destPath)) {
-        fs.unlinkSync(destPath);
+        fs.renameSync(destPath, backupPath);
+        backupCreated = true;
       }
 
-      // 重命名临时文件为目标文件
-      fs.renameSync(tempPath, destPath);
+      // 优先尝试 rename（同文件系统下瞬时完成，大文件不再需要逐字节复制）
+      try {
+        fs.renameSync(localPath, destPath);
+        destReplaced = true;
+      } catch (renameErr) {
+        if (renameErr.code === 'EXDEV') {
+          // 跨文件系统，回退到 copy + rename
+          fs.copyFileSync(localPath, tempPath);
+          fs.renameSync(tempPath, destPath);
+          destReplaced = true;
+        } else {
+          throw renameErr;
+        }
+      }
 
-      // 更新已使用空间（使用净增量）
-      if (netIncrease !== 0) {
+      if (backupCreated) {
+        try { fs.unlinkSync(backupPath); } catch (_) {}
+      }
+
+      // 正向净增已在写入前原子预留，这里只处理覆盖变小时的扣减。
+      if (netIncrease < 0) {
         this.updateUsedSpace(netIncrease);
       }
     } catch (error) {
       // 清理临时文件
       if (fs.existsSync(tempPath)) {
-        fs.unlinkSync(tempPath);
+        try { fs.unlinkSync(tempPath); } catch (_) {}
+      }
+      if (destReplaced && fs.existsSync(destPath)) {
+        try { fs.unlinkSync(destPath); } catch (_) {}
+      }
+      if (backupCreated && fs.existsSync(backupPath) && !fs.existsSync(destPath)) {
+        try { fs.renameSync(backupPath, destPath); } catch (restoreError) {
+          console.error(`[本地存储] 恢复旧文件失败: ${restoreError.message}`);
+        }
+      }
+      if (reservedDelta > 0) {
+        this.updateUsedSpace(-reservedDelta);
       }
       throw error;
     }
@@ -372,14 +433,14 @@ class LocalStorageClient {
    * @param {string} filePath - 文件路径
    * @returns {ReadStream} 文件读取流
    */
-  createReadStream(filePath) {
+  createReadStream(filePath, options = undefined) {
     const fullPath = this.getFullPath(filePath);
 
     if (!fs.existsSync(fullPath)) {
       throw new Error(`文件不存在: ${filePath}`);
     }
 
-    return fs.createReadStream(fullPath);
+    return fs.createReadStream(fullPath, options);
   }
 
   /**
@@ -467,12 +528,13 @@ class LocalStorageClient {
     // 5. 拼接完整路径
     const fullPath = path.join(this.basePath, normalized);
 
-    // 6. 解析真实路径（处理符号链接）后再次验证
+    // 6. 解析绝对路径后再次验证
     const resolvedBasePath = path.resolve(this.basePath);
     const resolvedFullPath = path.resolve(fullPath);
+    const relativeToBase = path.relative(resolvedBasePath, resolvedFullPath);
 
     // 7. 安全检查：确保路径在用户目录内（防止目录遍历攻击）
-    if (!resolvedFullPath.startsWith(resolvedBasePath)) {
+    if (relativeToBase.startsWith('..') || path.isAbsolute(relativeToBase)) {
       console.warn('[安全] 检测到路径遍历攻击:', {
         input: relativePath,
         resolved: resolvedFullPath,
@@ -488,225 +550,26 @@ class LocalStorageClient {
    * 检查配额
    */
   checkQuota(additionalSize) {
-    const newUsed = (this.user.local_storage_used || 0) + additionalSize;
-    if (newUsed > this.user.local_storage_quota) {
-      const used = this.formatSize(this.user.local_storage_used);
+    const amount = Math.max(0, Math.trunc(Number(additionalSize) || 0));
+    if (amount === 0) return;
+
+    const updatedUser = UserDB.reserveLocalStorageSpace(this.user.id, amount);
+    if (!updatedUser) {
+      const latestUser = UserDB.findById(this.user.id) || this.user;
+      const used = this.formatSize(latestUser.local_storage_used || 0);
       const quota = this.formatSize(this.user.local_storage_quota);
-      const need = this.formatSize(additionalSize);
+      const need = this.formatSize(amount);
       throw new Error(`存储配额不足。已使用: ${used}, 配额: ${quota}, 需要: ${need}`);
     }
+    this.user.local_storage_used = Number(updatedUser.local_storage_used || 0);
   }
 
   /**
    * 更新已使用空间
    */
   updateUsedSpace(delta) {
-    const newUsed = Math.max(0, (this.user.local_storage_used || 0) + delta);
-    UserDB.update(this.user.id, { local_storage_used: newUsed });
-    // 更新内存中的值
-    this.user.local_storage_used = newUsed;
-  }
-
-  /**
-   * 恢复未完成的重命名操作（启动时调用）
-   * 扫描OSS存储中的待处理重命名标记文件，执行回滚或完成操作
-   *
-   * **重命名操作的两个阶段：**
-   * 1. copying 阶段：正在复制文件到新位置
-   *    - 恢复策略：删除已复制的目标文件，保留原文件
-   * 2. deleting 阶段：正在删除原文件
-   *    - 恢复策略：确保原文件被完全删除（补充删除逻辑）
-   *
-   * @private
-   */
-  async recoverPendingRenames() {
-    try {
-      console.log('[OSS存储] 检查未完成的重命名操作...');
-
-      const bucket = this.getBucket();
-      const markerPrefix = this.prefix + '.rename_pending_';
-
-      // 列出所有待处理的标记文件
-      const listCommand = new ListObjectsV2Command({
-        Bucket: bucket,
-        Prefix: markerPrefix,
-        MaxKeys: 100
-      });
-
-      const response = await this.s3Client.send(listCommand);
-
-      if (!response.Contents || response.Contents.length === 0) {
-        console.log('[OSS存储] 没有未完成的重命名操作');
-        return;
-      }
-
-      console.log(`[OSS存储] 发现 ${response.Contents.length} 个未完成的重命名操作，开始恢复...`);
-
-      for (const marker of response.Contents) {
-        try {
-          // 从标记文件名中解析元数据
-          // 格式: .rename_pending_{timestamp}_{oldKeyHash}.json
-          const markerKey = marker.Key;
-
-          // 读取标记文件内容
-          const getMarkerCommand = new GetObjectCommand({
-            Bucket: bucket,
-            Key: markerKey
-          });
-
-          const markerResponse = await this.s3Client.send(getMarkerCommand);
-          const markerContent = await streamToBuffer(markerResponse.Body);
-          const metadata = JSON.parse(markerContent.toString());
-
-          const { oldPrefix, newPrefix, timestamp, phase } = metadata;
-
-          // 检查标记是否过期（超过1小时视为失败，需要恢复）
-          const age = Date.now() - timestamp;
-          const TIMEOUT = 60 * 60 * 1000; // 1小时
-
-          if (age > TIMEOUT) {
-            console.warn(`[OSS存储] 检测到超时的重命名操作: ${oldPrefix} -> ${newPrefix}, 阶段: ${phase}`);
-
-            // 根据不同阶段执行不同的恢复策略
-            if (phase === 'copying') {
-              // ===== 第一阶段：复制阶段超时 =====
-              // 策略：删除已复制的目标文件，保留原文件
-              console.log(`[OSS存储] [copying阶段] 执行回滚: 删除已复制的文件 ${newPrefix}`);
-              await this._rollbackRename(oldPrefix, newPrefix);
-
-            } else if (phase === 'deleting') {
-              // ===== 第二阶段：删除阶段超时（第二轮修复） =====
-              // 策略：补充完整的删除逻辑，确保原文件被清理干净
-              console.log(`[OSS存储] [deleting阶段] 执行补充删除: 清理剩余原文件 ${oldPrefix}`);
-
-              try {
-                // 步骤1：列出原位置的所有剩余文件
-                let continuationToken = null;
-                let remainingCount = 0;
-                const MAX_KEYS_PER_REQUEST = 1000;
-
-                do {
-                  const listOldCommand = new ListObjectsV2Command({
-                    Bucket: bucket,
-                    Prefix: oldPrefix,
-                    MaxKeys: MAX_KEYS_PER_REQUEST,
-                    ContinuationToken: continuationToken
-                  });
-
-                  const listOldResponse = await this.s3Client.send(listOldCommand);
-                  continuationToken = listOldResponse.NextContinuationToken;
-
-                  if (listOldResponse.Contents && listOldResponse.Contents.length > 0) {
-                    // 步骤2：批量删除剩余的原文件
-                    const deleteCommand = new DeleteObjectsCommand({
-                      Bucket: bucket,
-                      Delete: {
-                        Objects: listOldResponse.Contents.map(obj => ({ Key: obj.Key })),
-                        Quiet: true
-                      }
-                    });
-
-                    const deleteResult = await this.s3Client.send(deleteCommand);
-                    remainingCount += listOldResponse.Contents.length;
-
-                    console.log(`[OSS存储] [deleting阶段] 已删除 ${listOldResponse.Contents.length} 个剩余原文件`);
-
-                    // 检查删除结果
-                    if (deleteResult.Errors && deleteResult.Errors.length > 0) {
-                      console.warn(`[OSS存储] [deleting阶段] 部分文件删除失败:`, deleteResult.Errors);
-                    }
-                  }
-                } while (continuationToken);
-
-                if (remainingCount > 0) {
-                  console.log(`[OSS存储] [deleting阶段] 补充删除完成: 清理了 ${remainingCount} 个原文件`);
-                } else {
-                  console.log(`[OSS存储] [deleting阶段] 原位置 ${oldPrefix} 已是空的，无需清理`);
-                }
-
-              } catch (cleanupError) {
-                console.error(`[OSS存储] [deleting阶段] 补充删除失败: ${cleanupError.message}`);
-                // 继续执行，不中断流程
-              }
-
-            } else {
-              // 未知阶段，记录警告
-              console.warn(`[OSS存储] 未知阶段 ${phase}，跳过恢复`);
-            }
-
-            // 删除标记文件（完成恢复后清理）
-            await this.s3Client.send(new DeleteObjectsCommand({
-              Bucket: bucket,
-              Delete: {
-                Objects: [{ Key: markerKey }],
-                Quiet: true
-              }
-            }));
-
-            console.log(`[OSS存储] 已清理超时的重命名标记: ${markerKey}`);
-          } else {
-            console.log(`[OSS存储] 重命名操作仍在进行中: ${oldPrefix} -> ${newPrefix} (阶段: ${phase}, 剩余: ${Math.floor((TIMEOUT - age) / 1000)}秒)`);
-          }
-        } catch (error) {
-          console.error(`[OSS存储] 恢复重命名操作失败: ${marker.Key}`, error.message);
-          // 继续处理下一个标记文件
-        }
-      }
-
-      console.log('[OSS存储] 重命名操作恢复完成');
-    } catch (error) {
-      console.error('[OSS存储] 恢复重命名操作时出错:', error.message);
-    }
-  }
-
-  /**
-   * 回滚重命名操作（删除已复制的目标文件）
-   * @param {string} oldPrefix - 原前缀
-   * @param {string} newPrefix - 新前缀
-   * @private
-   */
-  async _rollbackRename(oldPrefix, newPrefix) {
-    const bucket = this.getBucket();
-    const newPrefixWithSlash = newPrefix.endsWith('/') ? newPrefix : `${newPrefix}/`;
-
-    try {
-      // 列出所有已复制的对象
-      let continuationToken = null;
-      let deletedCount = 0;
-
-      do {
-        const listCommand = new ListObjectsV2Command({
-          Bucket: bucket,
-          Prefix: newPrefixWithSlash,
-          ContinuationToken: continuationToken,
-          MaxKeys: 1000
-        });
-
-        const listResponse = await this.s3Client.send(listCommand);
-        continuationToken = listResponse.NextContinuationToken;
-
-        if (listResponse.Contents && listResponse.Contents.length > 0) {
-          // 批量删除
-          const deleteCommand = new DeleteObjectsCommand({
-            Bucket: bucket,
-            Delete: {
-              Objects: listResponse.Contents.map(obj => ({ Key: obj.Key })),
-              Quiet: true
-            }
-          });
-
-          await this.s3Client.send(deleteCommand);
-          deletedCount += listResponse.Contents.length;
-        }
-      } while (continuationToken);
-
-      if (deletedCount > 0) {
-        console.log(`[OSS存储] 回滚完成: 删除了 ${deletedCount} 个对象`);
-      }
-    } catch (error) {
-      console.error(`[OSS存储] 回滚失败: ${error.message}`);
-      throw error;
-    }
+    const updatedUser = UserDB.adjustLocalStorageUsed(this.user.id, delta);
+    this.user.local_storage_used = Number(updatedUser?.local_storage_used || 0);
   }
 
   /**
@@ -888,6 +751,16 @@ class OssStorageClient {
 
       this.s3Client = new S3Client(s3Config);
       console.log(`[OSS存储] 已连接: ${ossConfig.oss_provider}, bucket: ${ossConfig.oss_bucket}, 使用统一配置: ${this.useUnifiedConfig}`);
+
+      const recoveryKey = `${ossConfig.oss_bucket}:${this.prefix}`;
+      if (!OSS_RENAME_RECOVERY_KEYS.has(recoveryKey)) {
+        OSS_RENAME_RECOVERY_KEYS.add(recoveryKey);
+        this.recoverPendingRenames().catch(error => {
+          OSS_RENAME_RECOVERY_KEYS.delete(recoveryKey);
+          console.error('[OSS存储] 重命名恢复任务失败:', error.message);
+        });
+      }
+
       return this;
     } catch (error) {
       console.error(`[OSS存储] 连接失败:`, error.message);
@@ -895,6 +768,113 @@ class OssStorageClient {
     }
   }
 
+  /**
+   * 恢复未完成的重命名操作。
+   * 扫描 OSS 中的 .rename_pending_* 标记，回滚 copying 阶段或补删 deleting 阶段。
+   */
+  async recoverPendingRenames() {
+    try {
+      console.log('[OSS存储] 检查未完成的重命名操作...');
+
+      const bucket = this.getBucket();
+      const markerPrefix = this.prefix + '.rename_pending_';
+      const listCommand = new ListObjectsV2Command({
+        Bucket: bucket,
+        Prefix: markerPrefix,
+        MaxKeys: 100
+      });
+
+      const response = await this.s3Client.send(listCommand);
+      if (!response.Contents || response.Contents.length === 0) {
+        console.log('[OSS存储] 没有未完成的重命名操作');
+        return;
+      }
+
+      console.log(`[OSS存储] 发现 ${response.Contents.length} 个未完成的重命名操作，开始恢复...`);
+
+      for (const marker of response.Contents) {
+        try {
+          const markerKey = marker.Key;
+          const markerResponse = await this.s3Client.send(new GetObjectCommand({
+            Bucket: bucket,
+            Key: markerKey
+          }));
+          const markerContent = await streamToBuffer(markerResponse.Body);
+          const metadata = JSON.parse(markerContent.toString());
+          const { oldPrefix, newPrefix, timestamp, phase } = metadata;
+
+          const age = Date.now() - Number(timestamp || 0);
+          const timeoutMs = 60 * 60 * 1000;
+          if (age <= timeoutMs) {
+            console.log(`[OSS存储] 重命名操作仍在进行中: ${oldPrefix} -> ${newPrefix} (阶段: ${phase})`);
+            continue;
+          }
+
+          console.warn(`[OSS存储] 检测到超时的重命名操作: ${oldPrefix} -> ${newPrefix}, 阶段: ${phase}`);
+          if (phase === 'copying') {
+            await this._rollbackRename(oldPrefix, newPrefix);
+          } else if (phase === 'deleting') {
+            await this._deletePrefixObjects(oldPrefix);
+          } else {
+            console.warn(`[OSS存储] 未知阶段 ${phase}，仅清理标记文件`);
+          }
+
+          await this.s3Client.send(new DeleteObjectsCommand({
+            Bucket: bucket,
+            Delete: {
+              Objects: [{ Key: markerKey }],
+              Quiet: true
+            }
+          }));
+          console.log(`[OSS存储] 已清理超时的重命名标记: ${markerKey}`);
+        } catch (error) {
+          console.error(`[OSS存储] 恢复重命名操作失败: ${marker.Key}`, error.message);
+        }
+      }
+
+      console.log('[OSS存储] 重命名操作恢复完成');
+    } catch (error) {
+      console.error('[OSS存储] 恢复重命名操作时出错:', error.message);
+    }
+  }
+
+  async _rollbackRename(oldPrefix, newPrefix) {
+    const newPrefixWithSlash = newPrefix.endsWith('/') ? newPrefix : `${newPrefix}/`;
+    await this._deletePrefixObjects(newPrefixWithSlash);
+  }
+
+  async _deletePrefixObjects(prefix) {
+    const bucket = this.getBucket();
+    const safePrefix = prefix.endsWith('/') ? prefix : `${prefix}/`;
+    let continuationToken = null;
+    let deletedCount = 0;
+
+    do {
+      const listResponse = await this.s3Client.send(new ListObjectsV2Command({
+        Bucket: bucket,
+        Prefix: safePrefix,
+        ContinuationToken: continuationToken,
+        MaxKeys: 1000
+      }));
+      continuationToken = listResponse.NextContinuationToken;
+
+      if (listResponse.Contents && listResponse.Contents.length > 0) {
+        await this.s3Client.send(new DeleteObjectsCommand({
+          Bucket: bucket,
+          Delete: {
+            Objects: listResponse.Contents.map(obj => ({ Key: obj.Key })),
+            Quiet: true
+          }
+        }));
+        deletedCount += listResponse.Contents.length;
+      }
+    } while (continuationToken);
+
+    if (deletedCount > 0) {
+      console.log(`[OSS存储] 已删除前缀 ${safePrefix} 下 ${deletedCount} 个对象`);
+    }
+  }
+
   /**
    * 获取当前使用的 bucket 名称
    * @returns {string}
@@ -939,22 +919,27 @@ class OssStorageClient {
       throw new Error('路径包含非法字符');
     }
 
-    // 2. 先进行 URL 解码（防止双重编码绕过）
-    let decoded = relativePath;
+    // 2. 仅将 URL 解码结果用于安全检查，不用于生成对象 key。
+    // 文件名中的字面量 "%2F" 应保留为普通字符，不能变成路径分隔符。
+    let decodedForSecurity = relativePath;
     try {
-      decoded = decodeURIComponent(relativePath);
+      decodedForSecurity = decodeURIComponent(relativePath);
     } catch (e) {
-      // 解码失败使用原始值
+      // 解码失败使用原始值做后续检查
     }
 
     // 3. 检查解码后的空字节
-    if (decoded.includes('\x00')) {
+    if (decodedForSecurity.includes('\x00')) {
       console.warn('[OSS安全] 检测到编码的空字节注入:', relativePath);
       throw new Error('路径包含非法字符');
     }
+    if (decodedForSecurity.includes('..')) {
+      console.warn('[OSS安全] 检测到编码的目录遍历尝试:', relativePath);
+      throw new Error('路径包含非法字符');
+    }
 
     // 4. 规范化路径：统一使用正斜杠（OSS 使用正斜杠作为分隔符）
-    let normalized = decoded
+    let normalized = relativePath
       .replace(/\\/g, '/')  // 将反斜杠转换为正斜杠
       .replace(/\/+/g, '/'); // 合并多个连续斜杠
 
@@ -1090,9 +1075,13 @@ class OssStorageClient {
    * @param {string} remotePath - 远程文件路径
    */
   async put(localPath, remotePath) {
+    let bucket = '';
+    let key = '';
+    let uploadId = null;
+    let fileHandle = null;
     try {
-      const key = this.getObjectKey(remotePath);
-      const bucket = this.getBucket();
+      key = this.getObjectKey(remotePath);
+      bucket = this.getBucket();
 
       // 检查本地文件是否存在
       if (!fs.existsSync(localPath)) {
@@ -1102,30 +1091,107 @@ class OssStorageClient {
       const fileStats = fs.statSync(localPath);
       const fileSize = fileStats.size;
 
-      // 检查文件大小（AWS S3 单次上传最大 5GB）
-      const MAX_SINGLE_UPLOAD_SIZE = 5 * 1024 * 1024 * 1024; // 5GB
-      if (fileSize > MAX_SINGLE_UPLOAD_SIZE) {
-        throw new Error(`文件过大 (${formatFileSize(fileSize)})，单次上传最大支持 5GB，请使用分片上传`);
+      if (fileSize <= OSS_SINGLE_UPLOAD_THRESHOLD) {
+        // 小文件保持单请求上传，兼容性更高。
+        const fileContent = fs.readFileSync(localPath);
+        const command = new PutObjectCommand({
+          Bucket: bucket,
+          Key: key,
+          Body: fileContent,
+          ContentLength: fileSize,
+          ChecksumAlgorithm: undefined
+        });
+        await this.s3Client.send(command);
+        console.log(`[OSS存储] 上传成功: ${key} (${formatFileSize(fileSize)})`);
+        return;
       }
 
-      // 使用Buffer上传而非流式上传，避免AWS SDK使用aws-chunked编码
-      // 这样可以确保与阿里云OSS的兼容性
-      const fileContent = fs.readFileSync(localPath);
+      // 大文件自动切换到分片上传，避免整文件读入内存和 5GB 单请求上限。
+      const minPartSizeByCount = Math.ceil(fileSize / OSS_MULTIPART_MAX_PARTS);
+      const alignedMinPartSize = Math.ceil(
+        Math.max(minPartSizeByCount, OSS_MULTIPART_MIN_PART_SIZE) / (1024 * 1024)
+      ) * 1024 * 1024;
+      const partSize = Math.max(OSS_MULTIPART_DEFAULT_PART_SIZE, alignedMinPartSize);
+      const estimatedParts = Math.ceil(fileSize / partSize);
+      if (estimatedParts > OSS_MULTIPART_MAX_PARTS) {
+        throw new Error(`文件过大，分片数量超限 (${estimatedParts}/${OSS_MULTIPART_MAX_PARTS})`);
+      }
 
-      // 直接上传
-      const command = new PutObjectCommand({
+      const createResp = await this.s3Client.send(new CreateMultipartUploadCommand({
+        Bucket: bucket,
+        Key: key
+      }));
+      uploadId = createResp?.UploadId || null;
+      if (!uploadId) {
+        throw new Error('创建分片上传会话失败：缺少 UploadId');
+      }
+
+      const uploadedParts = [];
+      let offset = 0;
+      let partNumber = 1;
+      fileHandle = await fs.promises.open(localPath, 'r');
+
+      while (offset < fileSize) {
+        const remaining = fileSize - offset;
+        const currentPartSize = Math.min(partSize, remaining);
+        const buffer = Buffer.allocUnsafe(currentPartSize);
+        const { bytesRead } = await fileHandle.read(buffer, 0, currentPartSize, offset);
+        if (bytesRead <= 0) {
+          throw new Error('读取本地文件失败，分片上传中断');
+        }
+
+        const body = bytesRead === currentPartSize ? buffer : buffer.subarray(0, bytesRead);
+        const partResp = await this.s3Client.send(new UploadPartCommand({
+          Bucket: bucket,
+          Key: key,
+          UploadId: uploadId,
+          PartNumber: partNumber,
+          Body: body,
+          ContentLength: bytesRead
+        }));
+
+        if (!partResp?.ETag) {
+          throw new Error(`分片 ${partNumber} 上传失败：服务端未返回 ETag`);
+        }
+        uploadedParts.push({
+          ETag: partResp.ETag,
+          PartNumber: partNumber
+        });
+
+        offset += bytesRead;
+        if (partNumber === 1 || partNumber % 10 === 0 || offset >= fileSize) {
+          console.log(
+            `[OSS存储] 上传分片进度: ${key} ${partNumber}/${estimatedParts} (${formatFileSize(offset)}/${formatFileSize(fileSize)})`
+          );
+        }
+        partNumber += 1;
+      }
+
+      await this.s3Client.send(new CompleteMultipartUploadCommand({
         Bucket: bucket,
         Key: key,
-        Body: fileContent,
-        ContentLength: fileSize, // 明确指定内容长度，避免某些服务端问题
-        // 禁用checksum算法（阿里云OSS不完全支持AWS的x-amz-content-sha256头）
-        ChecksumAlgorithm: undefined
-      });
-
-      await this.s3Client.send(command);
-      console.log(`[OSS存储] 上传成功: ${key} (${formatFileSize(fileSize)})`);
+        UploadId: uploadId,
+        MultipartUpload: { Parts: uploadedParts }
+      }));
+      uploadId = null;
+      console.log(
+        `[OSS存储] 分片上传完成: ${key} (${formatFileSize(fileSize)}, ${uploadedParts.length} 片)`
+      );
 
     } catch (error) {
+      if (uploadId && bucket && key) {
+        try {
+          await this.s3Client.send(new AbortMultipartUploadCommand({
+            Bucket: bucket,
+            Key: key,
+            UploadId: uploadId
+          }));
+          console.warn(`[OSS存储] 已中止失败的分片上传: ${key}`);
+        } catch (abortError) {
+          console.error(`[OSS存储] 中止分片上传失败: ${key}`, abortError.message);
+        }
+      }
+
       console.error(`[OSS存储] 上传失败: ${remotePath}`, error.message);
 
       // 判断错误类型并给出友好的错误信息
@@ -1139,6 +1205,10 @@ class OssStorageClient {
         throw new Error(`本地文件不存在: ${localPath}`);
       }
       throw new Error(`文件上传失败: ${error.message}`);
+    } finally {
+      if (fileHandle) {
+        await fileHandle.close().catch(() => {});
+      }
     }
   }
 
@@ -1157,7 +1227,7 @@ class OssStorageClient {
       try {
         statResult = await this.stat(filePath);
       } catch (statError) {
-        if (statError.message && statResult?.message.includes('不存在')) {
+        if (statError.message && statError.message.includes('不存在')) {
           console.warn(`[OSS存储] 文件不存在，跳过删除: ${key}`);
           return { size: 0 }; // 文件不存在，返回大小为 0
         }
@@ -1167,6 +1237,7 @@ class OssStorageClient {
       let totalDeletedSize = 0;
 
       if (statResult.isDirectory) {
+        const directoryPrefix = key.endsWith('/') ? key : `${key}/`;
         // 删除目录：列出所有对象并批量删除
         // 使用分页循环处理超过 1000 个对象的情况
         let continuationToken = null;
@@ -1176,7 +1247,7 @@ class OssStorageClient {
         do {
           const listCommand = new ListObjectsV2Command({
             Bucket: bucket,
-            Prefix: key,
+            Prefix: directoryPrefix,
             MaxKeys: MAX_DELETE_BATCH,
             ContinuationToken: continuationToken
           });
@@ -1211,7 +1282,7 @@ class OssStorageClient {
         } while (continuationToken);
 
         if (totalDeletedCount > 0) {
-          console.log(`[OSS存储] 删除目录: ${key} (${totalDeletedCount} 个对象, ${totalDeletedSize} 字节)`);
+          console.log(`[OSS存储] 删除目录: ${directoryPrefix} (${totalDeletedCount} 个对象, ${totalDeletedSize} 字节)`);
         }
 
         return { size: totalDeletedSize };
@@ -1534,7 +1605,7 @@ class OssStorageClient {
    */
   async createReadStream(filePath) {
     const key = this.getObjectKey(filePath);
-    const bucket = this.user.oss_bucket;
+    const bucket = this.getBucket();
 
     const command = new GetObjectCommand({
       Bucket: bucket,
@@ -1589,7 +1660,7 @@ class OssStorageClient {
    */
   async getPresignedUrl(filePath, expiresIn = 3600) {
     const key = this.getObjectKey(filePath);
-    const bucket = this.user.oss_bucket;
+    const bucket = this.getBucket();
 
     try {
       const command = new GetObjectCommand({
@@ -1617,7 +1688,7 @@ class OssStorageClient {
     const key = this.getObjectKey(filePath);
     const bucket = this.getBucket();
     const provider = this.getProvider();
-    const region = this.s3Client.config.region;
+    const region = String(this.currentConfig?.oss_region || this.user.oss_region || 'us-east-1');
 
     let baseUrl;
     if (provider === 'aliyun') {
@@ -1646,7 +1717,7 @@ class OssStorageClient {
    */
   async getUploadPresignedUrl(filePath, expiresIn = 900, contentType = 'application/octet-stream') {
     const key = this.getObjectKey(filePath);
-    const bucket = this.user.oss_bucket;
+    const bucket = this.getBucket();
 
     try {
       const command = new PutObjectCommand({

backend/storage/user_1/test_upload.txt

@@ -0,0 +1 @@
+This is a test file for upload testing

backend/test_admin.js

@@ -0,0 +1,586 @@
+/**
+ * 管理员功能完整性测试脚本（Cookie + CSRF 认证模型）
+ *
+ * 覆盖范围：
+ * 1. 鉴权与权限校验
+ * 2. 用户管理（列表、封禁/删除自保护、存储权限）
+ * 3. 系统设置（获取/更新/参数校验）
+ * 4. 分享管理
+ * 5. 系统监控（健康、存储、日志）
+ * 6. 上传工具接口
+ */
+
+const http = require('http');
+const https = require('https');
+const { UserDB } = require('./database');
+
+const BASE_URL = process.env.TEST_BASE_URL || 'http://127.0.0.1:40001';
+
+const state = {
+  adminSession: {
+    cookies: {},
+    csrfToken: ''
+  },
+  adminUserId: null,
+  testUserId: null,
+  latestSettings: null
+};
+
+const testResults = {
+  passed: [],
+  failed: [],
+  warnings: []
+};
+
+function makeCookieHeader(cookies) {
+  return Object.entries(cookies || {})
+    .map(([k, v]) => `${k}=${v}`)
+    .join('; ');
+}
+
+function storeSetCookies(session, setCookieHeader) {
+  if (!session || !setCookieHeader) return;
+  const list = Array.isArray(setCookieHeader) ? setCookieHeader : [setCookieHeader];
+  for (const raw of list) {
+    const first = String(raw || '').split(';')[0];
+    const idx = first.indexOf('=');
+    if (idx <= 0) continue;
+    const key = first.slice(0, idx).trim();
+    const value = first.slice(idx + 1).trim();
+    session.cookies[key] = value;
+    if (key === 'csrf_token') {
+      session.csrfToken = value;
+    }
+  }
+}
+
+function isSafeMethod(method) {
+  const upper = String(method || '').toUpperCase();
+  return upper === 'GET' || upper === 'HEAD' || upper === 'OPTIONS';
+}
+
+function request(method, path, options = {}) {
+  const {
+    data = null,
+    session = null,
+    headers = {},
+    requireCsrf = true
+  } = options;
+
+  return new Promise((resolve, reject) => {
+    const url = new URL(path, BASE_URL);
+    const transport = url.protocol === 'https:' ? https : http;
+
+    const requestHeaders = { ...headers };
+    if (session) {
+      const cookieHeader = makeCookieHeader(session.cookies);
+      if (cookieHeader) {
+        requestHeaders.Cookie = cookieHeader;
+      }
+
+      if (requireCsrf && !isSafeMethod(method)) {
+        const csrfToken = session.csrfToken || session.cookies.csrf_token;
+        if (csrfToken) {
+          requestHeaders['X-CSRF-Token'] = csrfToken;
+        }
+      }
+    }
+
+    let payload = null;
+    if (data !== null && data !== undefined) {
+      payload = JSON.stringify(data);
+      requestHeaders['Content-Type'] = 'application/json';
+      requestHeaders['Content-Length'] = Buffer.byteLength(payload);
+    }
+
+    const req = transport.request({
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: url.port || (url.protocol === 'https:' ? 443 : 80),
+      path: url.pathname + url.search,
+      method,
+      headers: requestHeaders
+    }, (res) => {
+      let body = '';
+      res.on('data', chunk => {
+        body += chunk;
+      });
+      res.on('end', () => {
+        if (session) {
+          storeSetCookies(session, res.headers['set-cookie']);
+        }
+
+        let parsed = body;
+        try {
+          parsed = body ? JSON.parse(body) : {};
+        } catch (e) {
+          // keep raw text
+        }
+
+        resolve({
+          status: res.statusCode,
+          data: parsed,
+          headers: res.headers
+        });
+      });
+    });
+
+    req.on('error', reject);
+
+    if (payload) {
+      req.write(payload);
+    }
+    req.end();
+  });
+}
+
+async function initCsrf(session) {
+  const res = await request('GET', '/api/csrf-token', {
+    session,
+    requireCsrf: false
+  });
+
+  if (res.status === 200 && res.data && res.data.csrfToken) {
+    session.csrfToken = res.data.csrfToken;
+  }
+
+  return res;
+}
+
+function assert(condition, message) {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+function warn(message) {
+  testResults.warnings.push(message);
+  console.log(`[WARN] ${message}`);
+}
+
+async function test(name, fn) {
+  try {
+    await fn();
+    testResults.passed.push(name);
+    console.log(`[PASS] ${name}`);
+  } catch (error) {
+    testResults.failed.push({ name, error: error.message });
+    console.log(`[FAIL] ${name}: ${error.message}`);
+  }
+}
+
+function ensureTestUser() {
+  if (state.testUserId) {
+    return;
+  }
+
+  const suffix = Date.now();
+  const username = `admin_test_user_${suffix}`;
+  const email = `${username}@test.local`;
+  const password = `AdminTest#${suffix}`;
+
+  const id = UserDB.create({
+    username,
+    email,
+    password,
+    is_verified: 1
+  });
+
+  UserDB.update(id, {
+    is_active: 1,
+    is_banned: 0,
+    storage_permission: 'user_choice',
+    current_storage_type: 'oss'
+  });
+
+  state.testUserId = id;
+}
+
+function cleanupTestUser() {
+  if (!state.testUserId) return;
+  try {
+    UserDB.delete(state.testUserId);
+  } catch (error) {
+    warn(`清理测试用户失败: ${error.message}`);
+  } finally {
+    state.testUserId = null;
+  }
+}
+
+// 1. 安全检查：未认证访问应被拒绝
+async function testUnauthorizedAccess() {
+  const res = await request('GET', '/api/admin/users');
+  assert(res.status === 401, `未认证访问应返回401，实际返回: ${res.status}`);
+}
+
+// 2. 安全检查：无效 Token 应被拒绝
+async function testInvalidTokenAccess() {
+  const res = await request('GET', '/api/admin/users', {
+    headers: {
+      Authorization: 'Bearer invalid-token'
+    }
+  });
+  assert(res.status === 401, `无效token应返回401，实际: ${res.status}`);
+}
+
+// 3. 管理员登录（基于 Cookie）
+async function testAdminLogin() {
+  await initCsrf(state.adminSession);
+
+  const res = await request('POST', '/api/login', {
+    data: {
+      username: 'admin',
+      password: 'admin123'
+    },
+    session: state.adminSession,
+    requireCsrf: false
+  });
+
+  assert(res.status === 200, `登录应返回200，实际: ${res.status}`);
+  assert(res.data && res.data.success === true, `登录失败: ${res.data?.message || 'unknown'}`);
+  assert(!!state.adminSession.cookies.token, '登录后应写入 token Cookie');
+
+  await initCsrf(state.adminSession);
+
+  const profileRes = await request('GET', '/api/user/profile', {
+    session: state.adminSession
+  });
+
+  assert(profileRes.status === 200, `读取profile应返回200，实际: ${profileRes.status}`);
+  assert(profileRes.data?.success === true, '读取profile应成功');
+  assert(profileRes.data?.user?.is_admin === 1, '登录账号应为管理员');
+
+  state.adminUserId = profileRes.data.user.id;
+  assert(Number.isInteger(state.adminUserId) && state.adminUserId > 0, '应获取管理员ID');
+}
+
+// 4. 用户列表获取（分页）
+async function testGetUsers() {
+  const res = await request('GET', '/api/admin/users?paged=1&page=1&pageSize=20&sort=created_desc', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(Array.isArray(res.data?.users), 'users应为数组');
+  assert(!!res.data?.pagination, '分页模式应返回pagination');
+}
+
+// 5. 系统设置获取
+async function testGetSettings() {
+  const res = await request('GET', '/api/admin/settings', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(res.data?.settings && typeof res.data.settings === 'object', '应包含settings对象');
+  assert(res.data?.settings?.smtp && typeof res.data.settings.smtp === 'object', '应包含smtp配置');
+  assert(res.data?.settings?.global_theme !== undefined, '应包含全局主题设置');
+
+  state.latestSettings = res.data.settings;
+}
+
+// 6. 更新系统设置（写回当前值，避免影响测试环境）
+async function testUpdateSettings() {
+  const current = state.latestSettings || {};
+  const payload = {
+    global_theme: current.global_theme || 'dark',
+    max_upload_size: Number(current.max_upload_size || 10737418240)
+  };
+
+  const res = await request('POST', '/api/admin/settings', {
+    data: payload,
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+}
+
+// 7. 健康检查
+async function testHealthCheck() {
+  const res = await request('GET', '/api/admin/health-check', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(Array.isArray(res.data?.checks), '应包含checks数组');
+  assert(res.data?.summary && typeof res.data.summary === 'object', '应包含summary');
+}
+
+// 8. 存储统计
+async function testStorageStats() {
+  const res = await request('GET', '/api/admin/storage-stats', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(res.data?.stats && typeof res.data.stats === 'object', '应包含stats对象');
+}
+
+// 9. 系统日志获取
+async function testGetLogs() {
+  const res = await request('GET', '/api/admin/logs?page=1&pageSize=10', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(Array.isArray(res.data?.logs), 'logs应为数组');
+}
+
+// 10. 日志统计
+async function testLogStats() {
+  const res = await request('GET', '/api/admin/logs/stats', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(res.data?.stats && typeof res.data.stats === 'object', '应包含stats对象');
+}
+
+// 11. 分享列表获取
+async function testGetShares() {
+  const res = await request('GET', '/api/admin/shares', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(Array.isArray(res.data?.shares), 'shares应为数组');
+}
+
+// 12. 不能封禁自己
+async function testCannotBanSelf() {
+  assert(state.adminUserId, '管理员ID未初始化');
+
+  const res = await request('POST', `/api/admin/users/${state.adminUserId}/ban`, {
+    data: { banned: true },
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `封禁自己应返回400，实际: ${res.status}`);
+  assert(String(res.data?.message || '').includes('不能封禁自己'), '应提示不能封禁自己');
+}
+
+// 13. 不能删除自己
+async function testCannotDeleteSelf() {
+  assert(state.adminUserId, '管理员ID未初始化');
+
+  const res = await request('DELETE', `/api/admin/users/${state.adminUserId}`, {
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `删除自己应返回400，实际: ${res.status}`);
+  assert(String(res.data?.message || '').includes('不能删除自己'), '应提示不能删除自己');
+}
+
+// 14. 参数验证：无效用户ID
+async function testInvalidUserId() {
+  const res = await request('POST', '/api/admin/users/invalid/ban', {
+    data: { banned: true },
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
+}
+
+// 15. 参数验证：无效分享ID
+async function testInvalidShareId() {
+  const res = await request('DELETE', '/api/admin/shares/invalid', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `无效分享ID应返回400，实际: ${res.status}`);
+}
+
+// 16. 存储权限设置
+async function testSetStoragePermission() {
+  ensureTestUser();
+
+  const res = await request('POST', `/api/admin/users/${state.testUserId}/storage-permission`, {
+    data: {
+      storage_permission: 'local_only',
+      local_storage_quota: 2147483648,
+      download_traffic_quota: 3221225472
+    },
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+}
+
+// 17. 参数验证：无效的存储权限值
+async function testInvalidStoragePermission() {
+  ensureTestUser();
+
+  const res = await request('POST', `/api/admin/users/${state.testUserId}/storage-permission`, {
+    data: { storage_permission: 'invalid_permission' },
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `无效存储权限应返回400，实际: ${res.status}`);
+}
+
+// 18. 主题设置验证
+async function testInvalidTheme() {
+  const res = await request('POST', '/api/admin/settings', {
+    data: { global_theme: 'invalid_theme' },
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `无效主题应返回400，实际: ${res.status}`);
+}
+
+// 19. 日志清理测试
+async function testLogCleanup() {
+  const res = await request('POST', '/api/admin/logs/cleanup', {
+    data: { keepDays: 90 },
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(typeof res.data?.deletedCount === 'number', 'deletedCount应为数字');
+}
+
+// 20. SMTP测试（未配置时返回400，配置后可能200/500）
+async function testSmtpTest() {
+  const res = await request('POST', '/api/admin/settings/test-smtp', {
+    data: { to: 'test@example.com' },
+    session: state.adminSession
+  });
+
+  if (res.status === 400 && String(res.data?.message || '').includes('SMTP未配置')) {
+    console.log('  - SMTP未配置，这是预期的');
+    return;
+  }
+
+  assert(res.status === 200 || res.status === 500, `应返回200或500，实际: ${res.status}`);
+}
+
+// 21. 上传工具配置生成（替代已移除的 /api/admin/check-upload-tool）
+async function testGenerateUploadToolConfig() {
+  const res = await request('POST', '/api/upload/generate-tool', {
+    data: {},
+    session: state.adminSession
+  });
+
+  assert(res.status === 200, `应返回200，实际: ${res.status}`);
+  assert(res.data?.success === true, '应返回success: true');
+  assert(res.data?.config && typeof res.data.config === 'object', '应包含config对象');
+  assert(typeof res.data?.config?.api_key === 'string' && res.data.config.api_key.length > 0, '应返回有效api_key');
+}
+
+// 22. 用户文件查看 - 无效用户ID验证
+async function testInvalidUserIdForFiles() {
+  const res = await request('GET', '/api/admin/users/invalid/files', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
+}
+
+// 23. 删除用户 - 无效用户ID验证
+async function testInvalidUserIdForDelete() {
+  const res = await request('DELETE', '/api/admin/users/invalid', {
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
+}
+
+// 24. 存储权限设置 - 无效用户ID验证
+async function testInvalidUserIdForPermission() {
+  const res = await request('POST', '/api/admin/users/invalid/storage-permission', {
+    data: {
+      storage_permission: 'local_only'
+    },
+    session: state.adminSession
+  });
+
+  assert(res.status === 400, `无效用户ID应返回400，实际: ${res.status}`);
+}
+
+async function runTests() {
+  console.log('========================================');
+  console.log('管理员功能完整性测试（Cookie + CSRF）');
+  console.log('========================================\n');
+
+  console.log('\n--- 安全检查 ---');
+  await test('未认证访问应被拒绝', testUnauthorizedAccess);
+  await test('无效token应被拒绝', testInvalidTokenAccess);
+
+  await test('管理员登录', testAdminLogin);
+
+  console.log('\n--- 用户管理 ---');
+  await test('获取用户列表', testGetUsers);
+  await test('不能封禁自己', testCannotBanSelf);
+  await test('不能删除自己', testCannotDeleteSelf);
+  await test('无效用户ID验证', testInvalidUserId);
+  await test('设置存储权限', testSetStoragePermission);
+  await test('无效存储权限验证', testInvalidStoragePermission);
+
+  console.log('\n--- 系统设置 ---');
+  await test('获取系统设置', testGetSettings);
+  await test('更新系统设置', testUpdateSettings);
+  await test('无效主题验证', testInvalidTheme);
+  await test('SMTP测试', testSmtpTest);
+
+  console.log('\n--- 分享管理 ---');
+  await test('获取分享列表', testGetShares);
+  await test('无效分享ID验证', testInvalidShareId);
+
+  console.log('\n--- 系统监控 ---');
+  await test('健康检查', testHealthCheck);
+  await test('存储统计', testStorageStats);
+  await test('获取系统日志', testGetLogs);
+  await test('日志统计', testLogStats);
+  await test('日志清理', testLogCleanup);
+
+  console.log('\n--- 其他功能 ---');
+  await test('上传工具配置生成', testGenerateUploadToolConfig);
+
+  console.log('\n--- 参数验证增强 ---');
+  await test('用户文件查看无效ID验证', testInvalidUserIdForFiles);
+  await test('删除用户无效ID验证', testInvalidUserIdForDelete);
+  await test('存储权限设置无效ID验证', testInvalidUserIdForPermission);
+
+  cleanupTestUser();
+
+  console.log('\n========================================');
+  console.log('测试结果汇总');
+  console.log('========================================');
+  console.log(`通过: ${testResults.passed.length}`);
+  console.log(`失败: ${testResults.failed.length}`);
+  console.log(`警告: ${testResults.warnings.length}`);
+
+  if (testResults.failed.length > 0) {
+    console.log('\n失败的测试:');
+    for (const f of testResults.failed) {
+      console.log(`  - ${f.name}: ${f.error}`);
+    }
+  }
+
+  if (testResults.warnings.length > 0) {
+    console.log('\n警告:');
+    for (const w of testResults.warnings) {
+      console.log(`  - ${w}`);
+    }
+  }
+
+  console.log('\n========================================');
+
+  process.exit(testResults.failed.length > 0 ? 1 : 0);
+}
+
+runTests().catch((error) => {
+  cleanupTestUser();
+  console.error('测试执行异常:', error);
+  process.exit(1);
+});

backend/test_download_quota_defaults.js

@@ -0,0 +1,105 @@
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const crypto = require('crypto');
+
+function assert(condition, message) {
+  if (!condition) {
+    throw new Error(message);
+  }
+}
+
+const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'wanwanyun-download-quota-'));
+const tempDbPath = path.join(tempDir, 'database.db');
+
+process.env.DATABASE_PATH = tempDbPath;
+process.env.ENCRYPTION_KEY = crypto.randomBytes(32).toString('hex');
+process.env.JWT_SECRET = crypto.randomBytes(32).toString('hex');
+process.env.REFRESH_SECRET = crypto.randomBytes(32).toString('hex');
+process.env.WAL_CHECKPOINT_ENABLED = 'false';
+
+let db;
+
+try {
+  const { db: loadedDb, UserDB } = require('./database');
+  const { authMiddleware, generateToken } = require('./auth');
+
+  db = loadedDb;
+
+  const adminUser = UserDB.findByUsername(process.env.ADMIN_USERNAME || 'admin');
+  assert(adminUser, '应自动创建默认管理员账号');
+  assert(
+    Number(adminUser.download_traffic_quota) === -1,
+    `默认管理员下载配额应为 -1，实际: ${adminUser.download_traffic_quota}`
+  );
+
+  const username = `quota_test_${Date.now()}`;
+  const userId = UserDB.create({
+    username,
+    email: `${username}@example.com`,
+    password: 'secret123',
+    is_verified: 1
+  });
+  const createdUser = UserDB.findById(userId);
+
+  assert(createdUser, '新用户应创建成功');
+  assert(
+    Number(createdUser.download_traffic_quota) === -1,
+    `新用户默认下载配额应为 -1，实际: ${createdUser.download_traffic_quota}`
+  );
+
+  const token = generateToken(createdUser);
+  const req = {
+    headers: {
+      authorization: `Bearer ${token}`
+    },
+    cookies: {},
+    ip: '127.0.0.1',
+    socket: {
+      remoteAddress: '127.0.0.1'
+    },
+    get() {
+      return 'quota-test-agent';
+    }
+  };
+
+  let nextCalled = false;
+  const res = {
+    statusCode: 200,
+    payload: null,
+    status(code) {
+      this.statusCode = code;
+      return this;
+    },
+    json(body) {
+      this.payload = body;
+      return this;
+    }
+  };
+
+  authMiddleware(req, res, () => {
+    nextCalled = true;
+  });
+
+  assert(nextCalled, `authMiddleware 应放行不限流量用户，实际状态码: ${res.statusCode}`);
+  assert(req.user, 'authMiddleware 应写入 req.user');
+  assert(
+    Number(req.user.download_traffic_quota) === -1,
+    `authMiddleware 中的下载配额应保留 -1，实际: ${req.user.download_traffic_quota}`
+  );
+
+  console.log('PASS test_download_quota_defaults');
+  process.exit(0);
+} catch (error) {
+  console.error('FAIL test_download_quota_defaults');
+  console.error(error && error.stack ? error.stack : error);
+  process.exit(1);
+} finally {
+  if (db) {
+    try {
+      db.close();
+    } catch (closeError) {
+      console.error('关闭测试数据库失败:', closeError.message);
+    }
+  }
+}

backend/test_expire.js

@@ -0,0 +1,27 @@
+const { ShareDB } = require('./database');
+
+// 测试过期验证
+console.log('=== 测试分享过期验证 ===\n');
+
+// 获取所有分享
+const { db } = require('./database');
+const allShares = db.prepare('SELECT share_code, created_at, expires_at, datetime("now") as current_time FROM shares LIMIT 5').all();
+
+console.log('数据库中的分享:');
+allShares.forEach(share => {
+  console.log(`\n分享码: ${share.share_code}`);
+  console.log(`创建时间: ${share.created_at}`);
+  console.log(`到期时间: ${share.expires_at || '永久'}`);
+  console.log(`当前时间: ${share.current_time}`);
+
+  if (share.expires_at) {
+    const isExpired = share.expires_at <= share.current_time;
+    console.log(`是否过期: ${isExpired ? '是' : '否'}`);
+  }
+
+  // 测试findByCode
+  const found = ShareDB.findByCode(share.share_code);
+  console.log(`findByCode结果: ${found ? '找到' : '未找到(已过滤)'}`);
+});
+
+console.log('\n=== 测试完成 ===');

backend/test_share.js

@@ -0,0 +1,863 @@
+/**
+ * 分享功能完整性测试
+ *
+ * 测试范围:
+ * 1. 创建分享 - 单文件/文件夹/密码保护/过期时间
+ * 2. 访问分享 - 链接验证/密码验证/过期检查
+ * 3. 下载分享文件 - 单文件/多文件
+ * 4. 管理分享 - 查看/删除/统计
+ * 5. 边界条件 - 不存在/已过期/密码错误/文件已删除
+ */
+
+const http = require('http');
+const https = require('https');
+const { URL } = require('url');
+
+// 测试配置
+const BASE_URL = process.env.TEST_BASE_URL || 'http://localhost:3000';
+const TEST_USERNAME = process.env.TEST_USERNAME || 'admin';
+const TEST_PASSWORD = process.env.TEST_PASSWORD || 'admin123';
+
+// 测试结果
+const results = {
+  passed: 0,
+  failed: 0,
+  errors: []
+};
+
+// HTTP 请求工具
+function request(method, path, data = null, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const url = new URL(path, BASE_URL);
+    const isHttps = url.protocol === 'https:';
+    const lib = isHttps ? https : http;
+
+    // 确保端口号被正确解析
+    const port = url.port ? parseInt(url.port, 10) : (isHttps ? 443 : 80);
+
+    const options = {
+      hostname: url.hostname,
+      port: port,
+      path: url.pathname + url.search,
+      method: method,
+      headers: {
+        'Content-Type': 'application/json',
+        ...headers
+      }
+    };
+
+    const req = lib.request(options, (res) => {
+      let body = '';
+      res.on('data', chunk => body += chunk);
+      res.on('end', () => {
+        try {
+          const json = JSON.parse(body);
+          resolve({ status: res.statusCode, data: json, headers: res.headers });
+        } catch (e) {
+          resolve({ status: res.statusCode, data: body, headers: res.headers });
+        }
+      });
+    });
+
+    req.on('error', reject);
+
+    if (data) {
+      req.write(JSON.stringify(data));
+    }
+    req.end();
+  });
+}
+
+// 测试工具
+function assert(condition, message) {
+  if (condition) {
+    results.passed++;
+    console.log(`  [PASS] ${message}`);
+  } else {
+    results.failed++;
+    results.errors.push(message);
+    console.log(`  [FAIL] ${message}`);
+  }
+}
+
+// 保存 Cookie 的辅助函数
+function extractCookies(headers) {
+  const cookies = [];
+  const setCookie = headers['set-cookie'];
+  if (setCookie) {
+    for (const cookie of setCookie) {
+      cookies.push(cookie.split(';')[0]);
+    }
+  }
+  return cookies.join('; ');
+}
+
+// 全局状态
+let authCookie = '';
+let testShareCode = '';
+let testShareId = null;
+let passwordShareCode = '';
+let passwordShareId = null;
+let expiryShareCode = '';
+let directoryShareCode = '';
+
+// ========== 测试用例 ==========
+
+async function testLogin() {
+  console.log('\n[测试] 登录获取认证...');
+
+  try {
+    const res = await request('POST', '/api/login', {
+      username: TEST_USERNAME,
+      password: TEST_PASSWORD
+    });
+
+    assert(res.status === 200, `登录状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '登录应成功');
+
+    if (res.data.success) {
+      authCookie = extractCookies(res.headers);
+      console.log(`  认证Cookie已获取`);
+    }
+
+    return res.data.success;
+  } catch (error) {
+    console.log(`  [ERROR] 登录失败: ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+// ===== 1. 创建分享测试 =====
+
+async function testCreateFileShare() {
+  console.log('\n[测试] 创建单文件分享...');
+
+  try {
+    const res = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: '/test-file.txt',
+      file_name: 'test-file.txt'
+    }, { Cookie: authCookie });
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '创建分享应成功');
+    assert(res.data.share_code && res.data.share_code.length >= 8, '应返回有效的分享码');
+    assert(res.data.share_type === 'file', '分享类型应为 file');
+
+    if (res.data.success) {
+      testShareCode = res.data.share_code;
+      console.log(`  分享码: ${testShareCode}`);
+    }
+
+    return res.data.success;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testCreateDirectoryShare() {
+  console.log('\n[测试] 创建文件夹分享...');
+
+  try {
+    const res = await request('POST', '/api/share/create', {
+      share_type: 'directory',
+      file_path: '/test-folder'
+    }, { Cookie: authCookie });
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '创建文件夹分享应成功');
+    assert(res.data.share_type === 'directory', '分享类型应为 directory');
+
+    if (res.data.success) {
+      directoryShareCode = res.data.share_code;
+      console.log(`  分享码: ${directoryShareCode}`);
+    }
+
+    return res.data.success;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testCreatePasswordShare() {
+  console.log('\n[测试] 创建密码保护分享...');
+
+  try {
+    const res = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: '/test-file-password.txt',
+      file_name: 'test-file-password.txt',
+      password: 'test123'
+    }, { Cookie: authCookie });
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '创建密码保护分享应成功');
+
+    if (res.data.success) {
+      passwordShareCode = res.data.share_code;
+      console.log(`  分享码: ${passwordShareCode}`);
+    }
+
+    return res.data.success;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testCreateExpiryShare() {
+  console.log('\n[测试] 创建带过期时间的分享...');
+
+  try {
+    const res = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: '/test-file-expiry.txt',
+      file_name: 'test-file-expiry.txt',
+      expiry_days: 7
+    }, { Cookie: authCookie });
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '创建带过期时间分享应成功');
+    assert(res.data.expires_at !== null, '应返回过期时间');
+
+    if (res.data.success) {
+      expiryShareCode = res.data.share_code;
+      console.log(`  分享码: ${expiryShareCode}`);
+      console.log(`  过期时间: ${res.data.expires_at}`);
+    }
+
+    return res.data.success;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testCreateShareValidation() {
+  console.log('\n[测试] 创建分享参数验证...');
+
+  // 测试无效的分享类型
+  try {
+    const res1 = await request('POST', '/api/share/create', {
+      share_type: 'invalid_type',
+      file_path: '/test.txt'
+    }, { Cookie: authCookie });
+
+    assert(res1.status === 400, '无效分享类型应返回 400');
+    assert(res1.data.success === false, '无效分享类型应失败');
+  } catch (error) {
+    console.log(`  [ERROR] 测试无效分享类型: ${error.message}`);
+  }
+
+  // 测试空路径
+  try {
+    const res2 = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: ''
+    }, { Cookie: authCookie });
+
+    assert(res2.status === 400, '空路径应返回 400');
+    assert(res2.data.success === false, '空路径应失败');
+  } catch (error) {
+    console.log(`  [ERROR] 测试空路径: ${error.message}`);
+  }
+
+  // 测试无效的过期天数
+  try {
+    const res3 = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: '/test.txt',
+      expiry_days: 0
+    }, { Cookie: authCookie });
+
+    assert(res3.status === 400, '无效过期天数应返回 400');
+  } catch (error) {
+    console.log(`  [ERROR] 测试无效过期天数: ${error.message}`);
+  }
+
+  // 测试过长密码
+  try {
+    const res4 = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: '/test.txt',
+      password: 'a'.repeat(100)
+    }, { Cookie: authCookie });
+
+    assert(res4.status === 400, '过长密码应返回 400');
+  } catch (error) {
+    console.log(`  [ERROR] 测试过长密码: ${error.message}`);
+  }
+
+  // 测试路径遍历攻击
+  try {
+    const res5 = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: '../../../etc/passwd'
+    }, { Cookie: authCookie });
+
+    assert(res5.status === 400, '路径遍历攻击应返回 400');
+  } catch (error) {
+    console.log(`  [ERROR] 测试路径遍历: ${error.message}`);
+  }
+}
+
+// ===== 2. 访问分享测试 =====
+
+async function testVerifyShareNoPassword() {
+  console.log('\n[测试] 验证无密码分享...');
+
+  if (!testShareCode) {
+    console.log('  [SKIP] 无测试分享码');
+    return false;
+  }
+
+  try {
+    const res = await request('POST', `/api/share/${testShareCode}/verify`, {});
+
+    // 注意: 如果文件不存在，可能返回 500
+    // 这里我们主要测试 API 逻辑
+    if (res.status === 500 && res.data.message && res.data.message.includes('不存在')) {
+      console.log('  [INFO] 测试文件不存在 (预期行为，需创建测试文件)');
+      assert(true, '文件不存在时返回适当错误');
+      return true;
+    }
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '验证应成功');
+
+    if (res.data.share) {
+      assert(res.data.share.share_type === 'file', '分享类型应正确');
+      assert(res.data.share.share_path, '应返回分享路径');
+    }
+
+    return res.data.success;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testVerifyShareWithPassword() {
+  console.log('\n[测试] 验证需要密码的分享...');
+
+  if (!passwordShareCode) {
+    console.log('  [SKIP] 无密码保护分享码');
+    return false;
+  }
+
+  // 测试不提供密码
+  try {
+    const res1 = await request('POST', `/api/share/${passwordShareCode}/verify`, {});
+
+    assert(res1.status === 401, '无密码应返回 401');
+    assert(res1.data.needPassword === true, '应提示需要密码');
+  } catch (error) {
+    console.log(`  [ERROR] 测试无密码访问: ${error.message}`);
+  }
+
+  // 测试错误密码
+  try {
+    const res2 = await request('POST', `/api/share/${passwordShareCode}/verify`, {
+      password: 'wrong_password'
+    });
+
+    assert(res2.status === 401, '错误密码应返回 401');
+    assert(res2.data.message === '密码错误', '应提示密码错误');
+  } catch (error) {
+    console.log(`  [ERROR] 测试错误密码: ${error.message}`);
+  }
+
+  // 测试正确密码
+  try {
+    const res3 = await request('POST', `/api/share/${passwordShareCode}/verify`, {
+      password: 'test123'
+    });
+
+    // 如果文件存在
+    if (res3.status === 200) {
+      assert(res3.data.success === true, '正确密码应验证成功');
+    } else if (res3.status === 500 && res3.data.message && res3.data.message.includes('不存在')) {
+      console.log('  [INFO] 密码验证通过，但文件不存在');
+      assert(true, '密码验证逻辑正确');
+    }
+  } catch (error) {
+    console.log(`  [ERROR] 测试正确密码: ${error.message}`);
+  }
+
+  return true;
+}
+
+async function testVerifyShareNotFound() {
+  console.log('\n[测试] 访问不存在的分享...');
+
+  try {
+    const res = await request('POST', '/api/share/nonexistent123/verify', {});
+
+    assert(res.status === 404, `状态码应为 404, 实际: ${res.status}`);
+    assert(res.data.success === false, '应返回失败');
+    assert(res.data.message === '分享不存在', '应提示分享不存在');
+
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testGetShareTheme() {
+  console.log('\n[测试] 获取分享主题...');
+
+  if (!testShareCode) {
+    console.log('  [SKIP] 无测试分享码');
+    return false;
+  }
+
+  try {
+    const res = await request('GET', `/api/share/${testShareCode}/theme`);
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '获取主题应成功');
+    assert(['dark', 'light'].includes(res.data.theme), '主题应为 dark 或 light');
+
+    console.log(`  主题: ${res.data.theme}`);
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+// ===== 3. 下载分享文件测试 =====
+
+async function testGetDownloadUrl() {
+  console.log('\n[测试] 获取下载链接...');
+
+  if (!testShareCode) {
+    console.log('  [SKIP] 无测试分享码');
+    return false;
+  }
+
+  try {
+    const res = await request('POST', `/api/share/${testShareCode}/download-url`, { path: '/test-file.txt' });
+
+    // 如果文件存在
+    if (res.status === 200) {
+      assert(res.data.success === true, '获取下载链接应成功');
+      assert(res.data.downloadUrl, '应返回下载链接');
+      console.log(`  下载方式: ${res.data.direct ? 'OSS直连' : '后端代理'}`);
+    } else if (res.status === 404) {
+      console.log('  [INFO] 分享不存在或已过期');
+      assert(true, '分享不存在时返回 404');
+    } else if (res.status === 403) {
+      console.log('  [INFO] 路径验证失败 (预期行为)');
+      assert(true, '路径不在分享范围内返回 403');
+    }
+
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testDownloadWithPassword() {
+  console.log('\n[测试] 带密码下载...');
+
+  if (!passwordShareCode) {
+    console.log('  [SKIP] 无密码保护分享码');
+    return false;
+  }
+
+  // 测试无密码
+  try {
+    const res1 = await request('POST', `/api/share/${passwordShareCode}/download-url`, { path: '/test-file-password.txt' });
+    assert(res1.status === 401, '无密码应返回 401');
+  } catch (error) {
+    console.log(`  [ERROR] 测试无密码下载: ${error.message}`);
+  }
+
+  // 测试带密码
+  try {
+    const res2 = await request('POST', `/api/share/${passwordShareCode}/download-url`, { path: '/test-file-password.txt', password: 'test123' });
+    // 密码正确，根据文件是否存在返回不同结果
+    if (res2.status === 200) {
+      assert(res2.data.downloadUrl, '应返回下载链接');
+    } else {
+      console.log(`  [INFO] 状态码: ${res2.status}, 消息: ${res2.data.message}`);
+    }
+  } catch (error) {
+    console.log(`  [ERROR] 测试带密码下载: ${error.message}`);
+  }
+
+  return true;
+}
+
+async function testRecordDownload() {
+  console.log('\n[测试] 记录下载次数...');
+
+  if (!testShareCode) {
+    console.log('  [SKIP] 无测试分享码');
+    return false;
+  }
+
+  try {
+    const res = await request('POST', `/api/share/${testShareCode}/download`, {});
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '记录下载应成功');
+
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testDownloadPathValidation() {
+  console.log('\n[测试] 下载路径验证 (防越权)...');
+
+  if (!testShareCode) {
+    console.log('  [SKIP] 无测试分享码');
+    return false;
+  }
+
+  // 测试越权访问
+  try {
+    const res = await request('POST', `/api/share/${testShareCode}/download-url`, { path: '/other-file.txt' });
+
+    // 单文件分享应该禁止访问其他文件
+    assert(res.status === 403 || res.status === 404, '越权访问应被拒绝');
+    console.log(`  越权访问返回状态码: ${res.status}`);
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+  }
+
+  // 测试路径遍历
+  try {
+    const res2 = await request('POST', `/api/share/${testShareCode}/download-url`, { path: '/../../../etc/passwd' });
+    assert(res2.status === 403 || res2.status === 400, '路径遍历应被拒绝');
+  } catch (error) {
+    console.log(`  [ERROR] 路径遍历测试: ${error.message}`);
+  }
+
+  return true;
+}
+
+// ===== 4. 管理分享测试 =====
+
+async function testGetMyShares() {
+  console.log('\n[测试] 获取我的分享列表...');
+
+  try {
+    const res = await request('GET', '/api/share/my', null, { Cookie: authCookie });
+
+    assert(res.status === 200, `状态码应为 200, 实际: ${res.status}`);
+    assert(res.data.success === true, '获取分享列表应成功');
+    assert(Array.isArray(res.data.shares), '应返回分享数组');
+
+    console.log(`  分享数量: ${res.data.shares.length}`);
+
+    // 查找我们创建的测试分享
+    if (testShareCode) {
+      const testShare = res.data.shares.find(s => s.share_code === testShareCode);
+      if (testShare) {
+        testShareId = testShare.id;
+        console.log(`  找到测试分享 ID: ${testShareId}`);
+      }
+    }
+
+    if (passwordShareCode) {
+      const pwShare = res.data.shares.find(s => s.share_code === passwordShareCode);
+      if (pwShare) {
+        passwordShareId = pwShare.id;
+      }
+    }
+
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testDeleteShare() {
+  console.log('\n[测试] 删除分享...');
+
+  // 先创建一个用于删除测试的分享
+  try {
+    const createRes = await request('POST', '/api/share/create', {
+      share_type: 'file',
+      file_path: '/delete-test.txt'
+    }, { Cookie: authCookie });
+
+    if (!createRes.data.success) {
+      console.log('  [SKIP] 无法创建测试分享');
+      return false;
+    }
+
+    // 获取分享ID
+    const mySharesRes = await request('GET', '/api/share/my', null, { Cookie: authCookie });
+    const deleteShare = mySharesRes.data.shares.find(s => s.share_code === createRes.data.share_code);
+
+    if (!deleteShare) {
+      console.log('  [SKIP] 找不到测试分享');
+      return false;
+    }
+
+    // 删除分享
+    const deleteRes = await request('DELETE', `/api/share/${deleteShare.id}`, null, { Cookie: authCookie });
+
+    assert(deleteRes.status === 200, `删除状态码应为 200, 实际: ${deleteRes.status}`);
+    assert(deleteRes.data.success === true, '删除应成功');
+
+    // 验证已删除
+    const verifyRes = await request('POST', `/api/share/${createRes.data.share_code}/verify`, {});
+    assert(verifyRes.status === 404, '已删除分享应返回 404');
+
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    return false;
+  }
+}
+
+async function testDeleteShareValidation() {
+  console.log('\n[测试] 删除分享权限验证...');
+
+  // 测试删除不存在的分享
+  try {
+    const res1 = await request('DELETE', '/api/share/99999999', null, { Cookie: authCookie });
+    assert(res1.status === 404, '删除不存在的分享应返回 404');
+  } catch (error) {
+    console.log(`  [ERROR] 测试删除不存在: ${error.message}`);
+  }
+
+  // 测试无效的分享ID
+  try {
+    const res2 = await request('DELETE', '/api/share/invalid', null, { Cookie: authCookie });
+    assert(res2.status === 400, '无效ID应返回 400');
+  } catch (error) {
+    console.log(`  [ERROR] 测试无效ID: ${error.message}`);
+  }
+
+  return true;
+}
+
+// ===== 5. 边界条件测试 =====
+
+async function testShareNotExists() {
+  console.log('\n[测试] 分享不存在场景...');
+
+  const nonExistentCode = 'XXXXXXXXXX';
+
+  // 验证
+  try {
+    const res1 = await request('POST', `/api/share/${nonExistentCode}/verify`, {});
+    assert(res1.status === 404, '验证不存在分享应返回 404');
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+  }
+
+  // 获取文件列表
+  try {
+    const res2 = await request('POST', `/api/share/${nonExistentCode}/list`, {});
+    assert(res2.status === 404, '获取列表不存在分享应返回 404');
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+  }
+
+  // 下载
+  try {
+    const res3 = await request('POST', `/api/share/${nonExistentCode}/download-url`, { path: '/test.txt' });
+    assert(res3.status === 404, '下载不存在分享应返回 404');
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+  }
+
+  return true;
+}
+
+async function testShareExpired() {
+  console.log('\n[测试] 分享已过期场景...');
+
+  // 注意: 需要直接操作数据库创建过期分享才能完整测试
+  // 这里我们测试 API 对过期检查的处理逻辑
+
+  console.log('  [INFO] 过期检查在 ShareDB.findByCode 中实现');
+  console.log('  [INFO] 使用 SQL: expires_at IS NULL OR expires_at > datetime(\'now\', \'localtime\')');
+  assert(true, '过期检查逻辑已实现');
+
+  return true;
+}
+
+async function testPasswordErrors() {
+  console.log('\n[测试] 密码错误场景...');
+
+  if (!passwordShareCode) {
+    console.log('  [SKIP] 无密码保护分享码');
+    return false;
+  }
+
+  // 多次错误密码尝试 (测试限流)
+  for (let i = 0; i < 3; i++) {
+    try {
+      const res = await request('POST', `/api/share/${passwordShareCode}/verify`, {
+        password: `wrong${i}`
+      });
+
+      if (i < 2) {
+        assert(res.status === 401, `第${i+1}次错误密码应返回 401`);
+      } else {
+        // 可能触发限流
+        console.log(`  第${i+1}次尝试状态码: ${res.status}`);
+      }
+    } catch (error) {
+      console.log(`  [ERROR] 第${i+1}次尝试: ${error.message}`);
+    }
+  }
+
+  return true;
+}
+
+async function testFileDeleted() {
+  console.log('\n[测试] 文件已删除场景...');
+
+  // 当分享的文件被删除时，验证接口应该返回适当错误
+  console.log('  [INFO] 文件删除检查在 verify 接口的存储查询中实现');
+  console.log('  [INFO] 当 fileInfo 不存在时抛出 "分享的文件已被删除或不存在" 错误');
+  assert(true, '文件删除检查逻辑已实现');
+
+  return true;
+}
+
+async function testRateLimiting() {
+  console.log('\n[测试] 访问限流...');
+
+  // 快速发送多个请求测试限流
+  const promises = [];
+  for (let i = 0; i < 10; i++) {
+    promises.push(request('POST', '/api/share/test123/verify', {}));
+  }
+
+  const results = await Promise.all(promises);
+  const rateLimited = results.some(r => r.status === 429);
+
+  console.log(`  发送10个并发请求，限流触发: ${rateLimited ? '是' : '否'}`);
+
+  // 限流不是必须触发的，取决于配置
+  assert(true, '限流机制已实现 (shareRateLimitMiddleware)');
+
+  return true;
+}
+
+// ===== 清理测试数据 =====
+
+async function cleanup() {
+  console.log('\n[清理] 删除测试分享...');
+
+  const sharesToDelete = [testShareId, passwordShareId].filter(id => id);
+
+  for (const id of sharesToDelete) {
+    try {
+      await request('DELETE', `/api/share/${id}`, null, { Cookie: authCookie });
+      console.log(`  已删除分享 ID: ${id}`);
+    } catch (error) {
+      console.log(`  [WARN] 清理分享 ${id} 失败: ${error.message}`);
+    }
+  }
+}
+
+// ===== 主测试流程 =====
+
+async function runTests() {
+  console.log('========================================');
+  console.log(' 分享功能完整性测试');
+  console.log('========================================');
+  console.log(`测试服务器: ${BASE_URL}`);
+  console.log(`测试用户: ${TEST_USERNAME}`);
+
+  // 登录
+  const loggedIn = await testLogin();
+  if (!loggedIn) {
+    console.log('\n[FATAL] 登录失败，无法继续测试');
+    return;
+  }
+
+  // 1. 创建分享测试
+  console.log('\n======== 1. 创建分享测试 ========');
+  await testCreateFileShare();
+  await testCreateDirectoryShare();
+  await testCreatePasswordShare();
+  await testCreateExpiryShare();
+  await testCreateShareValidation();
+
+  // 2. 访问分享测试
+  console.log('\n======== 2. 访问分享测试 ========');
+  await testVerifyShareNoPassword();
+  await testVerifyShareWithPassword();
+  await testVerifyShareNotFound();
+  await testGetShareTheme();
+
+  // 3. 下载分享文件测试
+  console.log('\n======== 3. 下载分享文件测试 ========');
+  await testGetDownloadUrl();
+  await testDownloadWithPassword();
+  await testRecordDownload();
+  await testDownloadPathValidation();
+
+  // 4. 管理分享测试
+  console.log('\n======== 4. 管理分享测试 ========');
+  await testGetMyShares();
+  await testDeleteShare();
+  await testDeleteShareValidation();
+
+  // 5. 边界条件测试
+  console.log('\n======== 5. 边界条件测试 ========');
+  await testShareNotExists();
+  await testShareExpired();
+  await testPasswordErrors();
+  await testFileDeleted();
+  await testRateLimiting();
+
+  // 清理
+  await cleanup();
+
+  // 结果统计
+  console.log('\n========================================');
+  console.log(' 测试结果统计');
+  console.log('========================================');
+  console.log(`通过: ${results.passed}`);
+  console.log(`失败: ${results.failed}`);
+
+  if (results.errors.length > 0) {
+    console.log('\n失败的测试:');
+    results.errors.forEach((err, i) => {
+      console.log(`  ${i + 1}. ${err}`);
+    });
+  }
+
+  console.log('\n========================================');
+
+  // 返回退出码
+  process.exit(results.failed > 0 ? 1 : 0);
+}
+
+// 运行测试
+runTests().catch(error => {
+  console.error('测试执行失败:', error);
+  process.exit(1);
+});

backend/test_share_edge_cases.js

@@ -0,0 +1,614 @@
+/**
+ * 分享功能边界条件深度测试（兼容 Cookie + CSRF）
+ *
+ * 测试场景：
+ * 1. 已过期的分享
+ * 2. 分享文件不存在
+ * 3. 被封禁用户的分享
+ * 4. 路径遍历攻击
+ * 5. 特殊字符路径
+ * 6. 并发密码尝试
+ * 7. 分享统计
+ * 8. 分享码唯一性
+ * 9. 过期时间格式
+ */
+
+const http = require('http');
+const https = require('https');
+const bcrypt = require('bcryptjs');
+const { db, ShareDB, UserDB } = require('./database');
+
+const BASE_URL = process.env.TEST_BASE_URL || 'http://127.0.0.1:40001';
+
+const results = {
+  passed: 0,
+  failed: 0,
+  errors: []
+};
+
+const adminSession = {
+  cookies: {},
+  csrfToken: ''
+};
+
+let adminUserId = 1;
+
+function makeCookieHeader(cookies) {
+  return Object.entries(cookies || {})
+    .map(([k, v]) => `${k}=${v}`)
+    .join('; ');
+}
+
+function storeSetCookies(session, setCookieHeader) {
+  if (!session || !setCookieHeader) return;
+  const list = Array.isArray(setCookieHeader) ? setCookieHeader : [setCookieHeader];
+  for (const raw of list) {
+    const first = String(raw || '').split(';')[0];
+    const idx = first.indexOf('=');
+    if (idx <= 0) continue;
+    const key = first.slice(0, idx).trim();
+    const value = first.slice(idx + 1).trim();
+    session.cookies[key] = value;
+    if (key === 'csrf_token') {
+      session.csrfToken = value;
+    }
+  }
+}
+
+function isSafeMethod(method) {
+  const upper = String(method || '').toUpperCase();
+  return upper === 'GET' || upper === 'HEAD' || upper === 'OPTIONS';
+}
+
+function request(method, path, options = {}) {
+  const {
+    data = null,
+    session = null,
+    headers = {},
+    requireCsrf = true
+  } = options;
+
+  return new Promise((resolve, reject) => {
+    const url = new URL(path, BASE_URL);
+    const transport = url.protocol === 'https:' ? https : http;
+
+    const requestHeaders = { ...headers };
+
+    if (session) {
+      const cookieHeader = makeCookieHeader(session.cookies);
+      if (cookieHeader) {
+        requestHeaders.Cookie = cookieHeader;
+      }
+
+      if (requireCsrf && !isSafeMethod(method)) {
+        const csrfToken = session.csrfToken || session.cookies.csrf_token;
+        if (csrfToken) {
+          requestHeaders['X-CSRF-Token'] = csrfToken;
+        }
+      }
+    }
+
+    let payload = null;
+    if (data !== null && data !== undefined) {
+      payload = JSON.stringify(data);
+      requestHeaders['Content-Type'] = 'application/json';
+      requestHeaders['Content-Length'] = Buffer.byteLength(payload);
+    }
+
+    const req = transport.request({
+      protocol: url.protocol,
+      hostname: url.hostname,
+      port: url.port || (url.protocol === 'https:' ? 443 : 80),
+      path: url.pathname + url.search,
+      method,
+      headers: requestHeaders
+    }, (res) => {
+      let body = '';
+      res.on('data', chunk => {
+        body += chunk;
+      });
+      res.on('end', () => {
+        if (session) {
+          storeSetCookies(session, res.headers['set-cookie']);
+        }
+
+        let parsed = body;
+        try {
+          parsed = body ? JSON.parse(body) : {};
+        } catch (e) {
+          // keep raw text
+        }
+
+        resolve({
+          status: res.statusCode,
+          data: parsed,
+          headers: res.headers
+        });
+      });
+    });
+
+    req.on('error', reject);
+
+    if (payload) {
+      req.write(payload);
+    }
+    req.end();
+  });
+}
+
+async function initCsrf(session) {
+  const res = await request('GET', '/api/csrf-token', {
+    session,
+    requireCsrf: false
+  });
+
+  if (res.status === 200 && res.data && res.data.csrfToken) {
+    session.csrfToken = res.data.csrfToken;
+  }
+
+  return res;
+}
+
+function assert(condition, message) {
+  if (condition) {
+    results.passed++;
+    console.log(`  [PASS] ${message}`);
+  } else {
+    results.failed++;
+    results.errors.push(message);
+    console.log(`  [FAIL] ${message}`);
+  }
+}
+
+function createValidShareCode(prefix = '') {
+  for (let i = 0; i < 20; i++) {
+    const generated = ShareDB.generateShareCode();
+    const code = (prefix + generated).replace(/[^A-Za-z0-9]/g, '').slice(0, 16);
+    if (!code || code.length < 6) continue;
+    const exists = db.prepare('SELECT 1 FROM shares WHERE share_code = ?').get(code);
+    if (!exists) return code;
+  }
+
+  return ShareDB.generateShareCode();
+}
+
+async function testExpiredShare() {
+  console.log('\n[测试] 已过期的分享...');
+
+  const expiredShareCode = createValidShareCode('E');
+
+  try {
+    const yesterday = new Date();
+    yesterday.setDate(yesterday.getDate() - 1);
+    const expiresAt = yesterday.toISOString().replace('T', ' ').substring(0, 19);
+
+    db.prepare(`
+      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type, expires_at)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(adminUserId, expiredShareCode, '/expired-test.txt', 'file', 'local', expiresAt);
+
+    console.log(`  创建过期分享: ${expiredShareCode}, 过期时间: ${expiresAt}`);
+
+    const res = await request('POST', `/api/share/${expiredShareCode}/verify`, {
+      data: {},
+      requireCsrf: false
+    });
+
+    assert(res.status === 404, `过期分享应返回 404, 实际: ${res.status}`);
+    assert(res.data && res.data.message === '分享不存在', '应提示分享不存在');
+
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(expiredShareCode);
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    results.failed++;
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(expiredShareCode);
+    return false;
+  }
+}
+
+async function testShareWithDeletedFile() {
+  console.log('\n[测试] 分享的文件不存在...');
+
+  const shareCode = createValidShareCode('N');
+
+  try {
+    db.prepare(`
+      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(adminUserId, shareCode, '/non_existent_file_xyz.txt', 'file', 'local');
+
+    console.log(`  创建分享: ${shareCode}, 路径: /non_existent_file_xyz.txt`);
+
+    const res = await request('POST', `/api/share/${shareCode}/verify`, {
+      data: {},
+      requireCsrf: false
+    });
+
+    assert(res.status === 500 || res.status === 200, `应返回500或200，实际: ${res.status}`);
+    if (res.status === 500) {
+      assert(!!res.data?.message, '500时应返回错误消息');
+    }
+
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return false;
+  }
+}
+
+async function testShareByBannedUser() {
+  console.log('\n[测试] 被封禁用户的分享...');
+
+  let testUserId = null;
+  const shareCode = createValidShareCode('B');
+
+  try {
+    testUserId = UserDB.create({
+      username: `test_banned_${Date.now()}`,
+      email: `test_banned_${Date.now()}@test.com`,
+      password: 'test123',
+      is_verified: 1
+    });
+
+    db.prepare(`
+      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(testUserId, shareCode, '/test.txt', 'file', 'local');
+
+    console.log(`  创建测试用户 ID: ${testUserId}`);
+    console.log(`  创建分享: ${shareCode}`);
+
+    UserDB.setBanStatus(testUserId, true);
+    console.log(`  封禁用户: ${testUserId}`);
+
+    const res = await request('POST', `/api/share/${shareCode}/verify`, {
+      data: {},
+      requireCsrf: false
+    });
+
+    console.log(`  被封禁用户分享访问状态码: ${res.status}`);
+
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    UserDB.delete(testUserId);
+
+    assert(true, '被封禁用户分享测试完成');
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    if (shareCode) db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    if (testUserId) UserDB.delete(testUserId);
+    return false;
+  }
+}
+
+async function testPathTraversalAttacks() {
+  console.log('\n[测试] 路径遍历攻击防护...');
+
+  const shareCode = createValidShareCode('T');
+
+  try {
+    db.prepare(`
+      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type)
+      VALUES (?, ?, ?, ?, ?)
+    `).run(adminUserId, shareCode, '/allowed-folder', 'directory', 'local');
+
+    const attackPaths = [
+      '../../../etc/passwd',
+      '..\\..\\..\\etc\\passwd',
+      '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd',
+      '/allowed-folder/../../../etc/passwd',
+      '/allowed-folder/./../../etc/passwd',
+      '....//....//....//etc/passwd',
+      '/allowed-folder%00.txt/../../../etc/passwd'
+    ];
+
+    let blocked = 0;
+    for (const attackPath of attackPaths) {
+      const res = await request('POST', `/api/share/${shareCode}/download-url`, {
+        data: { path: attackPath },
+        requireCsrf: false
+      });
+
+      if (res.status === 403 || res.status === 400) {
+        blocked++;
+        console.log(`  [BLOCKED] ${attackPath.substring(0, 40)}...`);
+      } else {
+        console.log(`  [WARN] 可能未阻止: ${attackPath}, 状态: ${res.status}`);
+      }
+    }
+
+    assert(blocked >= attackPaths.length - 1, `路径遍历攻击应被阻止 (${blocked}/${attackPaths.length})`);
+
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return false;
+  }
+}
+
+async function testSpecialCharactersInPath() {
+  console.log('\n[测试] 特殊字符路径处理...');
+
+  if (!adminSession.cookies.token) {
+    console.log('  [WARN] 未登录，跳过特殊字符路径测试');
+    assert(true, '未登录时跳过特殊字符路径测试');
+    return true;
+  }
+
+  const specialPaths = [
+    '/文件夹/中文文件.txt',
+    '/folder with spaces/file.txt',
+    '/folder-with-dashes/file_underscore.txt',
+    '/folder.with.dots/file.name.ext.txt',
+    "/folder'with'quotes/file.txt"
+  ];
+
+  let handled = 0;
+
+  for (const virtualPath of specialPaths) {
+    try {
+      const createRes = await request('POST', '/api/share/create', {
+        data: {
+          share_type: 'file',
+          file_path: virtualPath
+        },
+        session: adminSession
+      });
+
+      if (createRes.status === 200 || createRes.status === 400) {
+        handled++;
+        console.log(`  [OK] ${virtualPath.substring(0, 30)}... - 状态: ${createRes.status}`);
+
+        if (createRes.status === 200 && createRes.data?.share_code) {
+          const mySharesRes = await request('GET', '/api/share/my', {
+            session: adminSession
+          });
+
+          const share = mySharesRes.data?.shares?.find(s => s.share_code === createRes.data.share_code);
+          if (share) {
+            await request('DELETE', `/api/share/${share.id}`, {
+              session: adminSession
+            });
+          }
+        }
+      }
+    } catch (error) {
+      console.log(`  [ERROR] ${virtualPath}: ${error.message}`);
+    }
+  }
+
+  assert(handled === specialPaths.length, '特殊字符路径处理完成');
+  return true;
+}
+
+async function testConcurrentPasswordAttempts() {
+  console.log('\n[测试] 并发密码尝试限流...');
+
+  const shareCode = createValidShareCode('C');
+
+  try {
+    const hashedPassword = bcrypt.hashSync('correct123', 10);
+
+    db.prepare(`
+      INSERT INTO shares (user_id, share_code, share_path, share_type, share_password, storage_type)
+      VALUES (?, ?, ?, ?, ?, ?)
+    `).run(adminUserId, shareCode, '/test.txt', 'file', hashedPassword, 'local');
+
+    const promises = [];
+    for (let i = 0; i < 20; i++) {
+      promises.push(
+        request('POST', `/api/share/${shareCode}/verify`, {
+          data: { password: `wrong${i}` },
+          requireCsrf: false
+        })
+      );
+    }
+
+    const responses = await Promise.all(promises);
+
+    const rateLimited = responses.filter(r => r.status === 429).length;
+    const unauthorized = responses.filter(r => r.status === 401).length;
+
+    console.log(`  并发请求: 20, 限流: ${rateLimited}, 401错误: ${unauthorized}`);
+
+    if (rateLimited > 0) {
+      assert(true, '限流机制生效');
+    } else {
+      console.log('  [INFO] 限流未触发（可能配置较宽松）');
+      assert(true, '并发测试完成');
+    }
+
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return false;
+  }
+}
+
+async function testShareStatistics() {
+  console.log('\n[测试] 分享统计功能...');
+
+  const shareCode = createValidShareCode('S');
+
+  try {
+    db.prepare(`
+      INSERT INTO shares (user_id, share_code, share_path, share_type, storage_type, view_count, download_count)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `).run(adminUserId, shareCode, '/test.txt', 'file', 'local', 0, 0);
+
+    for (let i = 0; i < 3; i++) {
+      await request('POST', `/api/share/${shareCode}/verify`, {
+        data: {},
+        requireCsrf: false
+      });
+    }
+
+    for (let i = 0; i < 2; i++) {
+      await request('POST', `/api/share/${shareCode}/download`, {
+        data: {},
+        requireCsrf: false
+      });
+    }
+
+    const share = db.prepare('SELECT view_count, download_count FROM shares WHERE share_code = ?').get(shareCode);
+
+    assert(share.view_count === 3, `查看次数应为 3, 实际: ${share.view_count}`);
+    assert(share.download_count === 2, `下载次数应为 2, 实际: ${share.download_count}`);
+
+    console.log(`  查看次数: ${share.view_count}, 下载次数: ${share.download_count}`);
+
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    db.prepare('DELETE FROM shares WHERE share_code = ?').run(shareCode);
+    return false;
+  }
+}
+
+async function testShareCodeUniqueness() {
+  console.log('\n[测试] 分享码唯一性...');
+
+  try {
+    const codes = new Set();
+
+    for (let i = 0; i < 10; i++) {
+      const code = ShareDB.generateShareCode();
+      if (codes.has(code)) {
+        console.log(`  [WARN] 发现重复分享码: ${code}`);
+      }
+      codes.add(code);
+    }
+
+    assert(codes.size === 10, `应生成 10 个唯一分享码, 实际: ${codes.size}`);
+    console.log(`  生成了 ${codes.size} 个唯一分享码`);
+
+    const sampleCode = ShareDB.generateShareCode();
+    assert(sampleCode.length === 8, `分享码长度应为 8, 实际: ${sampleCode.length}`);
+    assert(/^[a-zA-Z0-9]+$/.test(sampleCode), '分享码应只包含字母数字');
+
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    return false;
+  }
+}
+
+async function testExpiryTimeFormat() {
+  console.log('\n[测试] 过期时间格式...');
+
+  try {
+    const testDays = [1, 7, 30, 365];
+
+    for (const days of testDays) {
+      const result = ShareDB.create(adminUserId, {
+        share_type: 'file',
+        file_path: `/test_${days}_days.txt`,
+        expiry_days: days
+      });
+
+      const share = db.prepare('SELECT expires_at FROM shares WHERE share_code = ?').get(result.share_code);
+
+      const expiresAt = new Date(share.expires_at);
+      const now = new Date();
+      const diffDays = Math.round((expiresAt - now) / (1000 * 60 * 60 * 24));
+
+      assert(Math.abs(diffDays - days) <= 1, `${days}天过期应正确设置, 实际差异: ${diffDays}天`);
+
+      db.prepare('DELETE FROM shares WHERE share_code = ?').run(result.share_code);
+    }
+
+    return true;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    return false;
+  }
+}
+
+async function login() {
+  console.log('\n[准备] 登录获取认证...');
+
+  try {
+    await initCsrf(adminSession);
+
+    const res = await request('POST', '/api/login', {
+      data: {
+        username: 'admin',
+        password: 'admin123'
+      },
+      session: adminSession,
+      requireCsrf: false
+    });
+
+    if (res.status === 200 && res.data?.success && adminSession.cookies.token) {
+      await initCsrf(adminSession);
+
+      const profileRes = await request('GET', '/api/user/profile', {
+        session: adminSession
+      });
+
+      if (profileRes.status === 200 && profileRes.data?.user?.id) {
+        adminUserId = profileRes.data.user.id;
+      }
+
+      console.log('  认证成功');
+      return true;
+    }
+
+    console.log(`  认证失败: status=${res.status}, message=${res.data?.message || 'unknown'}`);
+    return false;
+  } catch (error) {
+    console.log(`  [ERROR] ${error.message}`);
+    return false;
+  }
+}
+
+async function runTests() {
+  console.log('========================================');
+  console.log(' 分享功能边界条件深度测试（Cookie + CSRF）');
+  console.log('========================================');
+
+  const loggedIn = await login();
+  if (!loggedIn) {
+    console.log('\n[WARN] 登录失败，部分测试可能无法执行');
+  }
+
+  await testExpiredShare();
+  await testShareWithDeletedFile();
+  await testShareByBannedUser();
+  await testPathTraversalAttacks();
+  await testSpecialCharactersInPath();
+  await testConcurrentPasswordAttempts();
+  await testShareStatistics();
+  await testShareCodeUniqueness();
+  await testExpiryTimeFormat();
+
+  console.log('\n========================================');
+  console.log(' 测试结果统计');
+  console.log('========================================');
+  console.log(`通过: ${results.passed}`);
+  console.log(`失败: ${results.failed}`);
+
+  if (results.errors.length > 0) {
+    console.log('\n失败的测试:');
+    results.errors.forEach((err, i) => {
+      console.log(`  ${i + 1}. ${err}`);
+    });
+  }
+
+  console.log('\n========================================');
+
+  process.exit(results.failed > 0 ? 1 : 0);
+}
+
+runTests().catch(error => {
+  console.error('测试执行失败:', error);
+  process.exit(1);
+});

backend/tests/architecture-tests.js

@@ -0,0 +1,186 @@
+const assert = require('assert');
+const fs = require('fs');
+const path = require('path');
+
+const projectRoot = path.resolve(__dirname, '..', '..');
+const serverPath = path.join(projectRoot, 'backend', 'server.js');
+const source = fs.readFileSync(serverPath, 'utf8');
+const results = { passed: 0, failed: 0 };
+
+function test(name, fn) {
+  try {
+    fn();
+    results.passed += 1;
+    console.log(`  [PASS] ${name}`);
+  } catch (error) {
+    results.failed += 1;
+    console.error(`  [FAIL] ${name}: ${error.message}`);
+  }
+}
+
+console.log('\n========== 架构约束测试 ==========\n');
+
+test('Express async 错误补丁在所有路由之前加载', () => {
+  const patchIndex = source.indexOf("require('express-async-errors')");
+  const routeIndex = source.search(/\bapp\.(get|post|put|delete|patch)\s*\(/);
+  assert.ok(patchIndex >= 0);
+  assert.ok(routeIndex > patchIndex);
+});
+
+test('全局错误中间件保持为最后一个 app.use', () => {
+  const errorHandlerIndex = source.indexOf('app.use(expressErrorHandler);');
+  assert.ok(errorHandlerIndex >= 0);
+  assert.strictEqual(source.lastIndexOf('app.use('), errorHandlerIndex);
+});
+
+test('抽取的纯函数不在 server.js 保留第二份定义', () => {
+  const extractedFunctions = [
+    'normalizeVersion',
+    'normalizeSha256',
+    'normalizeVirtualPath',
+    'buildHttpDownloadUrl',
+    'parseDownloadTrafficLine',
+    'isShareIpAllowed',
+    'resolveClientType',
+    'parseBooleanLike'
+  ];
+  for (const functionName of extractedFunctions) {
+    assert.strictEqual(new RegExp(`function\\s+${functionName}\\s*\\(`).test(source), false, functionName);
+  }
+});
+
+test('旧占位路由已清除且真实系统路由已挂载', () => {
+  assert.strictEqual(fs.existsSync(path.join(projectRoot, 'backend', 'routes', 'health.js')), false);
+  assert.strictEqual(fs.existsSync(path.join(projectRoot, 'backend', 'routes', 'index.js')), false);
+  assert.ok(source.includes("require('./routes/system.routes')"));
+  assert.ok(source.includes("app.use('/api', createSystemRouter"));
+});
+
+test('package.json 与 package-lock.json 顶层依赖同步', () => {
+  const packageJson = require('../package.json');
+  const packageLock = require('../package-lock.json');
+  assert.deepStrictEqual(packageLock.packages[''].dependencies, packageJson.dependencies);
+});
+
+test('前端 package.json 与 lock 文件依赖同步且没有手工缓存版本号', () => {
+  const frontendPackage = require('../../frontend/package.json');
+  const frontendLock = require('../../frontend/package-lock.json');
+  assert.deepStrictEqual(frontendLock.packages[''].dependencies, frontendPackage.dependencies);
+  assert.deepStrictEqual(frontendLock.packages[''].devDependencies, frontendPackage.devDependencies);
+
+  const frontendDirectory = path.join(projectRoot, 'frontend');
+  for (const fileName of fs.readdirSync(frontendDirectory).filter((name) => name.endsWith('.html'))) {
+    const html = fs.readFileSync(path.join(frontendDirectory, fileName), 'utf8');
+    assert.strictEqual(/\?v=\d+/.test(html), false, fileName);
+  }
+});
+
+test('生产部署统一使用 Vite dist 且不会删除 lock 文件', () => {
+  const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
+  const nginxConfig = fs.readFileSync(path.join(projectRoot, 'nginx', 'nginx.conf'), 'utf8');
+  const nginxExample = fs.readFileSync(path.join(projectRoot, 'nginx', 'nginx.conf.example'), 'utf8');
+  assert.ok(installer.includes('npm ci --include=dev'));
+  assert.ok(installer.includes('npm run build'));
+  assert.ok(installer.includes('frontend/dist'));
+  assert.strictEqual(/rm\s+-rf\s+node_modules\s+package-lock\.json/.test(installer), false);
+  assert.ok(nginxConfig.includes('root /usr/share/nginx/html;'));
+  assert.ok(nginxConfig.includes('alias /runtime/downloads/;'));
+  for (const config of [installer, nginxConfig, nginxExample]) {
+    assert.ok(config.includes('proxy_hide_header X-Request-ID;'));
+    assert.ok(config.includes('proxy_hide_header Content-Security-Policy;'));
+  }
+});
+
+test('桌面安装包由 Gitea Release 发布且不会再次提交到 Git', () => {
+  const gitignore = fs.readFileSync(path.join(projectRoot, '.gitignore'), 'utf8');
+  const release = JSON.parse(fs.readFileSync(
+    path.join(projectRoot, 'frontend', 'desktop-release.json'),
+    'utf8'
+  ));
+  const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
+  const compose = fs.readFileSync(path.join(projectRoot, 'docker-compose.yml'), 'utf8');
+
+  assert.ok(gitignore.split(/\r?\n/).includes('/frontend/downloads/*.exe'));
+  assert.strictEqual(gitignore.includes('!/frontend/downloads/'), false);
+  assert.match(release.sha256, /^[a-f0-9]{64}$/);
+  assert.ok(Number.isSafeInteger(release.size) && release.size > 0);
+  assert.strictEqual(release.tag, `v${release.version}`);
+  assert.strictEqual(release.publicPath, `/downloads/${release.asset}`);
+  assert.ok(installer.includes('sync_desktop_release'));
+  assert.ok(compose.includes('desktop-release:'));
+});
+
+test('Docker 构建上下文排除依赖、环境配置和运行时数据', () => {
+  const dockerIgnore = fs.readFileSync(path.join(projectRoot, 'backend', '.dockerignore'), 'utf8');
+  for (const requiredEntry of ['node_modules', '.env', 'data/*', 'storage/*']) {
+    assert.ok(dockerIgnore.split(/\r?\n/).includes(requiredEntry), requiredEntry);
+  }
+
+  const dockerfile = fs.readFileSync(path.join(projectRoot, 'backend', 'Dockerfile'), 'utf8');
+  assert.ok(dockerfile.includes('AS dependencies'));
+  assert.ok(dockerfile.includes('AS runtime'));
+  assert.ok(dockerfile.includes('npm_config_nodedir=/usr/local'));
+});
+
+test('install.sh 生成的 Nginx server 块花括号平衡', () => {
+  const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
+  const templates = [...installer.matchAll(/cat > .*?<< EOF\r?\n([\s\S]*?)\r?\nEOF/g)]
+    .map((match) => match[1])
+    .filter((template) => template.includes('server {'));
+  assert.strictEqual(templates.length, 3);
+  for (const template of templates) {
+    const openingBraces = (template.match(/\{/g) || []).length;
+    const closingBraces = (template.match(/\}/g) || []).length;
+    assert.strictEqual(openingBraces, closingBraces);
+  }
+});
+
+test('PM2 部署没有启用 cluster 或多实例参数', () => {
+  const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
+  assert.strictEqual(/pm2\s+start[^\n]*(?:\s-i\s|--instances)/.test(installer), false);
+});
+
+test('install.sh 可在最小化系统完成预检且不会吞掉 NodeSource 下载错误', () => {
+  const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
+  assert.ok(installer.includes("/dev/tcp/git.workyai.cn/443"));
+  assert.strictEqual(installer.includes('ping -c 1 git.workyai.cn'), false);
+  assert.strictEqual(/^\s*clear\s*$/m.test(installer), false);
+  assert.ok(installer.includes('clear_screen'));
+  assert.ok(installer.includes('main "$@"'));
+  assert.ok(installer.includes('/etc/apt/sources.list.d/ubuntu.sources'));
+  for (const dependency of ['ca-certificates', 'iproute2', 'dnsutils', 'procps']) {
+    assert.ok(installer.includes(dependency), dependency);
+  }
+  assert.ok(installer.includes('download_and_run_setup_script'));
+  assert.strictEqual(/curl[^\n]+\|\s*(?:ba)?sh/.test(installer), false);
+  assert.ok(installer.includes('verify_nodejs_installation'));
+});
+
+test('install.sh 生成可用且受保护的生产环境配置', () => {
+  const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
+  assert.ok(installer.includes('PUBLIC_BASE_URL=${PUBLIC_BASE_URL_VALUE}'));
+  assert.ok(installer.includes('ALLOWED_HOSTS=${ALLOWED_HOSTS_VALUE}'));
+  assert.ok(installer.includes('ALLOWED_ORIGINS=${ALLOWED_ORIGINS_VALUE}'));
+  assert.ok(installer.includes('chmod 600 "${PROJECT_DIR}/backend/.env"'));
+  assert.ok(installer.includes('dotenv_quote'));
+  assert.strictEqual(installer.includes('ALLOWED_ORIGINS_VALUE=""'), false);
+  assert.strictEqual(installer.includes('type_count++'), false);
+  assert.ok(installer.includes('/api/health'));
+});
+
+test('install.sh 只展示已实现的 SSL 方案且 Certbot 分支可达', () => {
+  const installer = fs.readFileSync(path.join(projectRoot, 'install.sh'), 'utf8');
+  assert.ok(installer.includes('deploy_certbot || ssl_fallback "1"'));
+  assert.ok(installer.includes('download_and_run_setup_script "https://get.acme.sh"'));
+  assert.strictEqual(installer.includes('证书申请功能开发中'), false);
+  assert.strictEqual(installer.includes('阿里云AccessKey ID'), false);
+  assert.strictEqual(installer.includes('腾讯云SecretId'), false);
+});
+
+console.log('\n========================================');
+console.log('测试总结');
+console.log('========================================');
+console.log(`通过: ${results.passed}`);
+console.log(`失败: ${results.failed}`);
+
+process.exit(results.failed > 0 ? 1 : 0);

backend/tests/archive-tests.js

@@ -0,0 +1,31 @@
+const assert = require('assert');
+const { PassThrough } = require('stream');
+const { finished } = require('stream/promises');
+const { createZipArchive } = require('../utils/archive');
+
+async function run() {
+  const archive = await createZipArchive({ store: true });
+  const output = new PassThrough();
+  const chunks = [];
+  output.on('data', (chunk) => chunks.push(chunk));
+  archive.pipe(output);
+  archive.append(Buffer.from('wanwanyun archive smoke test'), { name: 'smoke.txt' });
+
+  await archive.finalize();
+  await finished(output);
+
+  const zip = Buffer.concat(chunks);
+  assert.ok(zip.length > 30, 'ZIP output should not be empty');
+  assert.strictEqual(zip.subarray(0, 2).toString('ascii'), 'PK');
+  assert.ok(zip.includes(Buffer.from('smoke.txt')), 'ZIP should contain the requested entry');
+
+  console.log('通过: 1');
+  console.log('失败: 0');
+}
+
+run().catch((error) => {
+  console.error(error.stack || error.message);
+  console.log('通过: 0');
+  console.log('失败: 1');
+  process.exit(1);
+});

backend/tests/boundary-tests.js

@@ -12,6 +12,12 @@
 const assert = require('assert');
 const path = require('path');
 const fs = require('fs');
+const {
+  sanitizeInput,
+  decodeHtmlEntities,
+  isSafePathSegment,
+  isFileExtensionSafe
+} = require('../utils/input-security');
 
 // 主函数包装器（支持 async/await）
 async function runTests() {
@@ -58,28 +64,6 @@ console.log('\n========== 1. 输入边界测试 ==========\n');
 function testSanitizeInput() {
   console.log('--- 测试 XSS 过滤函数 sanitizeInput ---');
 
-  // 从 server.js 复制的 sanitizeInput 函数
-  function sanitizeInput(str) {
-    if (typeof str !== 'string') return str;
-
-    let sanitized = str
-      .replace(/[&<>"']/g, (char) => {
-        const map = {
-          '&': '&amp;',
-          '<': '&lt;',
-          '>': '&gt;',
-          '"': '&quot;',
-          "'": '&#x27;'
-        };
-        return map[char];
-      });
-
-    sanitized = sanitized.replace(/(?:javascript|data|vbscript|expression|on\w+)\s*:/gi, '');
-    sanitized = sanitized.replace(/\x00/g, '');
-
-    return sanitized;
-  }
-
   // 空字符串测试
   test('空字符串输入应该返回空字符串', () => {
     assert.strictEqual(sanitizeInput(''), '');
@@ -263,17 +247,6 @@ console.log('\n========== 2. 文件操作边界测试 ==========\n');
 function testPathSecurity() {
   console.log('--- 测试路径安全校验 ---');
 
-  function isSafePathSegment(name) {
-    return (
-      typeof name === 'string' &&
-      name.length > 0 &&
-      name.length <= 255 &&
-      !name.includes('..') &&
-      !/[/\\]/.test(name) &&
-      !/[\x00-\x1F]/.test(name)
-    );
-  }
-
   test('空文件名应该被拒绝', () => {
     assert.strictEqual(isSafePathSegment(''), false);
   });
@@ -312,32 +285,6 @@ testPathSecurity();
 function testFileExtensionSecurity() {
   console.log('\n--- 测试文件扩展名安全 ---');
 
-  const DANGEROUS_EXTENSIONS = [
-    '.php', '.php3', '.php4', '.php5', '.phtml', '.phar',
-    '.jsp', '.jspx', '.jsw', '.jsv', '.jspf',
-    '.asp', '.aspx', '.asa', '.asax', '.ascx', '.ashx', '.asmx',
-    '.htaccess', '.htpasswd'
-  ];
-
-  function isFileExtensionSafe(filename) {
-    if (!filename || typeof filename !== 'string') return false;
-
-    const ext = path.extname(filename).toLowerCase();
-
-    if (DANGEROUS_EXTENSIONS.includes(ext)) {
-      return false;
-    }
-
-    const nameLower = filename.toLowerCase();
-    for (const dangerExt of DANGEROUS_EXTENSIONS) {
-      if (nameLower.includes(dangerExt + '.')) {
-        return false;
-      }
-    }
-
-    return true;
-  }
-
   test('PHP 文件应该被拒绝', () => {
     assert.strictEqual(isFileExtensionSafe('test.php'), false);
     assert.strictEqual(isFileExtensionSafe('shell.phtml'), false);
@@ -360,36 +307,8 @@ function testFileExtensionSecurity() {
   });
 
   test('.htaccess 和 .htpasswd 文件应该被拒绝', () => {
-    // 更新测试以匹配修复后的 isFileExtensionSafe 函数
-    // 现在会检查 dangerousFilenames 列表
-    const dangerousFilenames = ['.htaccess', '.htpasswd'];
-
-    function isFileExtensionSafeFixed(filename) {
-      if (!filename || typeof filename !== 'string') return false;
-
-      const ext = path.extname(filename).toLowerCase();
-      const nameLower = filename.toLowerCase();
-
-      if (DANGEROUS_EXTENSIONS.includes(ext)) {
-        return false;
-      }
-
-      // 特殊处理：检查以危险名称开头的文件
-      if (dangerousFilenames.includes(nameLower)) {
-        return false;
-      }
-
-      for (const dangerExt of DANGEROUS_EXTENSIONS) {
-        if (nameLower.includes(dangerExt + '.')) {
-          return false;
-        }
-      }
-
-      return true;
-    }
-
-    assert.strictEqual(isFileExtensionSafeFixed('.htaccess'), false);
-    assert.strictEqual(isFileExtensionSafeFixed('.htpasswd'), false);
+    assert.strictEqual(isFileExtensionSafe('.htaccess'), false);
+    assert.strictEqual(isFileExtensionSafe('.htpasswd'), false);
   });
 
   test('正常文件应该被接受', () => {
@@ -473,7 +392,7 @@ function testLocalStoragePath() {
     return fullPath;
   }
 
-  const basePath = '/tmp/storage/user_1';
+  const basePath = path.join(path.resolve('/tmp'), 'storage', 'user_1');
 
   test('正常相对路径应该被接受', () => {
     const result = getFullPath(basePath, 'documents/file.txt');
@@ -703,7 +622,7 @@ function testDatabaseFieldWhitelist() {
   const ALLOWED_FIELDS = [
     'username', 'email', 'password',
     'oss_provider', 'oss_region', 'oss_access_key_id', 'oss_access_key_secret', 'oss_bucket', 'oss_endpoint',
-    'upload_api_key', 'is_admin', 'is_active', 'is_banned', 'has_oss_config',
+    'upload_api_key', 'is_active', 'is_banned', 'has_oss_config',
     'is_verified', 'verification_token', 'verification_expires_at',
     'storage_permission', 'current_storage_type', 'local_storage_quota', 'local_storage_used',
     'theme_preference'
@@ -730,14 +649,14 @@ function testDatabaseFieldWhitelist() {
     const updates = {
       username: 'newname',
       id: 999,  // 尝试修改 ID
-      is_admin: 1,  // 合法字段
+      is_admin: 1,  // 权限字段不允许通过通用更新入口修改
       sql_injection: "'; DROP TABLE users; --"  // 非法字段
     };
     const filtered = filterUpdates(updates);
     assert.ok(!('id' in filtered));
+    assert.ok(!('is_admin' in filtered));
     assert.ok(!('sql_injection' in filtered));
     assert.strictEqual(filtered.username, 'newname');
-    assert.strictEqual(filtered.is_admin, 1);
   });
 
   test('原型污染尝试应该被阻止', () => {
@@ -771,43 +690,6 @@ console.log('\n========== 7. HTML 实体解码测试 ==========\n');
 function testHtmlEntityDecoding() {
   console.log('--- 测试 HTML 实体解码 ---');
 
-  function decodeHtmlEntities(str) {
-    if (typeof str !== 'string') return str;
-
-    const entityMap = {
-      amp: '&',
-      lt: '<',
-      gt: '>',
-      quot: '"',
-      apos: "'",
-      '#x27': "'",
-      '#x2F': '/',
-      '#x60': '`'
-    };
-
-    const decodeOnce = (input) =>
-      input.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (match, code) => {
-        if (code[0] === '#') {
-          const isHex = code[1]?.toLowerCase() === 'x';
-          const num = isHex ? parseInt(code.slice(2), 16) : parseInt(code.slice(1), 10);
-          if (!Number.isNaN(num)) {
-            return String.fromCharCode(num);
-          }
-          return match;
-        }
-        const mapped = entityMap[code];
-        return mapped !== undefined ? mapped : match;
-      });
-
-    let output = str;
-    let decoded = decodeOnce(output);
-    while (decoded !== output) {
-      output = decoded;
-      decoded = decodeOnce(output);
-    }
-    return output;
-  }
-
   test('基本 HTML 实体应该被解码', () => {
     assert.strictEqual(decodeHtmlEntities('&lt;'), '<');
     assert.strictEqual(decodeHtmlEntities('&gt;'), '>');

backend/tests/domain-utils-tests.js

@@ -0,0 +1,155 @@
+const assert = require('assert');
+
+const { normalizeNonNegativeInteger, parseBooleanLike } = require('../utils/coerce');
+const {
+  buildDeviceName,
+  detectDeviceTypeFromUserAgent,
+  inferPlatformFromUserAgent,
+  normalizeClientIp,
+  normalizeClientType,
+  resolveClientType,
+  sanitizeDeviceText
+} = require('../utils/device');
+const { parseDownloadTrafficLine, parseDownloadTrafficLogTime } = require('../utils/oss-log-parser');
+const { isPathInside, normalizeVirtualPath } = require('../utils/path-safety');
+const { isPathWithinShare, isShareIpAllowed, isValidShareCode, parseShareIpWhitelist } = require('../utils/share');
+const { buildHttpDownloadUrl, sanitizeHttpBaseUrl } = require('../utils/url');
+const {
+  compareLooseVersion,
+  normalizeReleaseNotes,
+  normalizeSha256,
+  normalizeVersion
+} = require('../utils/version');
+
+const results = { passed: 0, failed: 0 };
+
+function test(name, fn) {
+  try {
+    fn();
+    results.passed += 1;
+    console.log(`  [PASS] ${name}`);
+  } catch (error) {
+    results.failed += 1;
+    console.error(`  [FAIL] ${name}: ${error.message}`);
+  }
+}
+
+console.log('\n========== 领域纯函数测试 ==========\n');
+
+test('版本号规范化与宽松比较', () => {
+  assert.strictEqual(normalizeVersion('  v1.2.3  '), 'v1.2.3');
+  assert.strictEqual(normalizeVersion('', '1.0.0'), '1.0.0');
+  assert.strictEqual(compareLooseVersion('v1.10.0', '1.9.9'), 1);
+  assert.strictEqual(compareLooseVersion('1.2', '1.2.0'), 0);
+  assert.strictEqual(compareLooseVersion('1.2.0', '2.0.0'), -1);
+});
+
+test('发布说明转义换行被还原', () => {
+  assert.strictEqual(normalizeReleaseNotes('first\\r\\nsecond\\n'), 'first\nsecond');
+});
+
+test('SHA256 只接受完整十六进制摘要', () => {
+  assert.strictEqual(normalizeSha256(' A'.repeat(64)), '');
+  assert.strictEqual(normalizeSha256('A'.repeat(64)), 'a'.repeat(64));
+  assert.strictEqual(normalizeSha256('a'.repeat(63)), '');
+});
+
+test('非负整数与布尔配置规范化', () => {
+  assert.strictEqual(normalizeNonNegativeInteger(12.9), 12);
+  assert.strictEqual(normalizeNonNegativeInteger(-1, 4), 4);
+  assert.strictEqual(parseBooleanLike('YES'), true);
+  assert.strictEqual(parseBooleanLike('off', true), false);
+  assert.strictEqual(parseBooleanLike('invalid', true), true);
+});
+
+test('物理路径边界不接受兄弟目录', () => {
+  const parent = require('path').resolve('/tmp/root');
+  assert.strictEqual(isPathInside(parent, require('path').join(parent, 'child')), true);
+  assert.strictEqual(isPathInside(parent, require('path').resolve('/tmp/root-other')), false);
+});
+
+test('虚拟路径统一分隔符并拒绝遍历和空字节', () => {
+  assert.strictEqual(normalizeVirtualPath('folder\\file.txt'), '/folder/file.txt');
+  assert.strictEqual(normalizeVirtualPath('/folder/../secret'), null);
+  assert.strictEqual(normalizeVirtualPath('/folder/%2e%2e/secret'), null);
+  assert.strictEqual(normalizeVirtualPath('/folder/%2500.txt'), null);
+  assert.strictEqual(normalizeVirtualPath('/'), '/');
+});
+
+test('HTTP 基础地址拒绝危险协议并移除查询参数', () => {
+  assert.strictEqual(sanitizeHttpBaseUrl('javascript:alert(1)'), null);
+  assert.strictEqual(sanitizeHttpBaseUrl('https://example.test/base/?token=x#hash'), 'https://example.test/base');
+});
+
+test('下载地址逐段编码且不继承查询参数', () => {
+  assert.strictEqual(
+    buildHttpDownloadUrl('https://example.test/base?token=x', '/目录/a b.txt'),
+    'https://example.test/base/%E7%9B%AE%E5%BD%95/a%20b.txt'
+  );
+});
+
+test('OSS 日志时间正确应用时区', () => {
+  const date = parseDownloadTrafficLogTime('[27/Jul/2026:12:34:56 +0800]');
+  assert.strictEqual(date.toISOString(), '2026-07-27T04:34:56.000Z');
+  assert.strictEqual(parseDownloadTrafficLogTime('[31/Feb/2026:12:00:00 +0800]'), null);
+  assert.strictEqual(parseDownloadTrafficLogTime('[27/Jul/2026:12:00:00 +2460]'), null);
+});
+
+test('OSS 下载日志解析用户、对象键、字节和时间', () => {
+  const line = '1.2.3.4 - - [27/Jul/2026:12:34:56 +0800] "GET /user_42/folder/a%20b.txt?signature=x HTTP/1.1" 206 1024 "-" "ua"';
+  const result = parseDownloadTrafficLine(line);
+  assert.strictEqual(result.userId, 42);
+  assert.strictEqual(result.bytes, 1024);
+  assert.strictEqual(result.objectKey, 'user_42/folder/a b.txt');
+  assert.strictEqual(result.eventAt.toISOString(), '2026-07-27T04:34:56.000Z');
+});
+
+test('OSS 日志只统计成功 GET 下载', () => {
+  const fallback = new Date('2026-01-01T00:00:00Z');
+  assert.strictEqual(parseDownloadTrafficLine('"HEAD /user_1/a HTTP/1.1" 200 10', fallback), null);
+  assert.strictEqual(parseDownloadTrafficLine('"GET /user_1/a HTTP/1.1" 404 10', fallback), null);
+  assert.strictEqual(parseDownloadTrafficLine('"GET /public/a HTTP/1.1" 200 10', fallback), null);
+  assert.strictEqual(parseDownloadTrafficLine('"GET /user_1/a HTTP/1.1" 200 -', fallback), null);
+});
+
+test('分享码与分享路径严格限定', () => {
+  assert.strictEqual(isValidShareCode('Abc123'), true);
+  assert.strictEqual(isValidShareCode('../bad'), false);
+  assert.strictEqual(isPathWithinShare('/folder/a.txt', { share_type: 'folder', share_path: '/folder' }), true);
+  assert.strictEqual(isPathWithinShare('/folder-other/a.txt', { share_type: 'folder', share_path: '/folder' }), false);
+  assert.strictEqual(isPathWithinShare('/folder/a.txt', { share_type: 'file', share_path: '/folder/a.txt' }), true);
+  assert.strictEqual(isPathWithinShare('/folder/b.txt', { share_type: 'file', share_path: '/folder/a.txt' }), false);
+});
+
+test('IP 白名单支持分隔符、精确匹配与前缀规则', () => {
+  const whitelist = parseShareIpWhitelist('127.0.0.1, 10.0.*;192.168.1.5');
+  assert.deepStrictEqual(whitelist, ['127.0.0.1', '10.0.*', '192.168.1.5']);
+  assert.strictEqual(isShareIpAllowed('10.0.2.3', whitelist), true);
+  assert.strictEqual(isShareIpAllowed('192.168.1.6', whitelist), false);
+  assert.strictEqual(isShareIpAllowed('', whitelist), false);
+  assert.strictEqual(isShareIpAllowed('', []), true);
+});
+
+test('客户端 IP 与设备类型被稳定规范化', () => {
+  assert.strictEqual(normalizeClientIp('::ffff:127.0.0.1'), '127.0.0.1');
+  assert.strictEqual(normalizeClientIp('::1'), '127.0.0.1');
+  assert.strictEqual(detectDeviceTypeFromUserAgent('Mozilla/5.0 iPhone'), 'mobile');
+  assert.strictEqual(inferPlatformFromUserAgent('Mozilla/5.0 (Windows NT 10.0)'), 'Windows');
+  assert.strictEqual(normalizeClientType(' DESKTOP '), 'desktop');
+  assert.strictEqual(normalizeClientType('bot'), '');
+  assert.strictEqual(resolveClientType('', 'wanwan-cloud-desktop/1.0'), 'desktop');
+});
+
+test('设备名称限制长度并按客户端类型回退', () => {
+  assert.strictEqual(sanitizeDeviceText('  abc  ', 2), 'ab');
+  assert.strictEqual(buildDeviceName({ clientType: 'mobile', platform: 'iOS' }), '移动端浏览器 · iOS');
+  assert.strictEqual(buildDeviceName({ clientType: 'web', deviceName: ' 我的设备 ', platform: 'Windows' }), '我的设备');
+});
+
+console.log('\n========================================');
+console.log('测试总结');
+console.log('========================================');
+console.log(`通过: ${results.passed}`);
+console.log(`失败: ${results.failed}`);
+
+process.exit(results.failed > 0 ? 1 : 0);

backend/tests/full-audit-regression.js

@@ -0,0 +1,500 @@
+/**
+ * Full project audit regression harness.
+ *
+ * Starts the backend with an isolated database/storage root and exercises the
+ * highest-risk public HTTP flows through real routes, cookies and CSRF.
+ */
+
+const assert = require('assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const http = require('http');
+const os = require('os');
+const path = require('path');
+const { spawn } = require('child_process');
+
+const BACKEND_DIR = path.resolve(__dirname, '..');
+const SERVER_PATH = path.join(BACKEND_DIR, 'server.js');
+const AUDIT_PREFIX = `audit_${Date.now()}_${crypto.randomBytes(3).toString('hex')}`;
+
+function randomHex(bytes = 32) {
+  return crypto.randomBytes(bytes).toString('hex');
+}
+
+function delay(ms) {
+  return new Promise(resolve => setTimeout(resolve, ms));
+}
+
+function countRegularFiles(dir) {
+  if (!fs.existsSync(dir)) return 0;
+  let count = 0;
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    if (entry.isFile()) count += 1;
+  }
+  return count;
+}
+
+class CookieJar {
+  constructor() {
+    this.cookies = new Map();
+  }
+
+  store(setCookie) {
+    const list = Array.isArray(setCookie) ? setCookie : (setCookie ? [setCookie] : []);
+    for (const raw of list) {
+      const first = String(raw).split(';')[0];
+      const idx = first.indexOf('=');
+      if (idx <= 0) continue;
+      this.cookies.set(first.slice(0, idx), first.slice(idx + 1));
+    }
+  }
+
+  header() {
+    return Array.from(this.cookies.entries())
+      .map(([key, value]) => `${key}=${value}`)
+      .join('; ');
+  }
+
+  get(name) {
+    return this.cookies.get(name) || '';
+  }
+}
+
+async function request(baseUrl, jar, method, route, options = {}) {
+  const url = new URL(route, baseUrl);
+  const headers = { ...(options.headers || {}) };
+  const cookieHeader = jar?.header();
+  if (cookieHeader) headers.Cookie = cookieHeader;
+
+  const upperMethod = method.toUpperCase();
+  if (!['GET', 'HEAD', 'OPTIONS'].includes(upperMethod) && options.csrf !== false) {
+    const csrf = jar?.get('csrf_token');
+    if (csrf) headers['X-CSRF-Token'] = csrf;
+  }
+
+  let body = options.body;
+  if (options.json !== undefined) {
+    headers['Content-Type'] = 'application/json';
+    body = JSON.stringify(options.json);
+  }
+
+  const response = await fetch(url, {
+    method: upperMethod,
+    headers,
+    body,
+    redirect: options.redirect || 'manual'
+  });
+
+  jar?.store(response.headers.getSetCookie ? response.headers.getSetCookie() : response.headers.get('set-cookie'));
+
+  const contentType = response.headers.get('content-type') || '';
+  const buffer = Buffer.from(await response.arrayBuffer());
+  let data = buffer;
+  if (contentType.includes('application/json')) {
+    data = JSON.parse(buffer.toString('utf8') || '{}');
+  } else if (contentType.includes('text/') || contentType.includes('image/svg')) {
+    data = buffer.toString('utf8');
+  }
+
+  return {
+    status: response.status,
+    headers: response.headers,
+    data,
+    raw: buffer
+  };
+}
+
+async function waitForHealth(baseUrl, timeoutMs = 15000) {
+  const startedAt = Date.now();
+  while (Date.now() - startedAt < timeoutMs) {
+    try {
+      const res = await request(baseUrl, null, 'GET', '/api/health');
+      if (res.status === 200 && res.data?.success === true) return;
+    } catch {}
+    await delay(250);
+  }
+  throw new Error('server did not become healthy');
+}
+
+function getFreePort() {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer();
+    server.listen(0, '127.0.0.1', () => {
+      const address = server.address();
+      server.close(() => resolve(address.port));
+    });
+    server.on('error', reject);
+  });
+}
+
+async function run() {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'wanwanyun-full-audit-'));
+  const storageRoot = path.join(tempRoot, 'storage');
+  const dbPath = path.join(tempRoot, 'database.db');
+  const port = await getFreePort();
+  const baseUrl = `http://127.0.0.1:${port}`;
+  const uploadsDir = path.join(BACKEND_DIR, 'uploads');
+  const adminPassword = `${AUDIT_PREFIX}_Pass123!`;
+
+  const env = {
+    ...process.env,
+    PORT: String(port),
+    NODE_ENV: 'development',
+    DATABASE_PATH: dbPath,
+    STORAGE_ROOT: storageRoot,
+    JWT_SECRET: randomHex(32),
+    ENCRYPTION_KEY: randomHex(32),
+    ADMIN_USERNAME: 'admin',
+    ADMIN_PASSWORD: adminPassword,
+    PUBLIC_BASE_URL: baseUrl,
+    ALLOWED_ORIGINS: baseUrl,
+    COOKIE_SECURE: 'false',
+    ENABLE_CSRF: 'true',
+    ENFORCE_HTTPS: 'false',
+    TRUST_PROXY: 'false',
+    WAL_CHECKPOINT_ENABLED: 'false'
+  };
+
+  const child = spawn(process.execPath, [SERVER_PATH], {
+    cwd: BACKEND_DIR,
+    env,
+    stdio: ['ignore', 'pipe', 'pipe']
+  });
+
+  let stdout = '';
+  let stderr = '';
+  child.stdout.on('data', chunk => {
+    stdout += chunk.toString();
+  });
+  child.stderr.on('data', chunk => {
+    stderr += chunk.toString();
+  });
+
+  const tests = [];
+  const test = (name, fn) => tests.push({ name, fn });
+
+  try {
+    await waitForHealth(baseUrl);
+
+    const jar = new CookieJar();
+    let userId = 1;
+    let shareId = null;
+    let shareCode = '';
+    let directLinkId = null;
+    let directLinkCode = '';
+    let artifactDirName = AUDIT_PREFIX;
+
+    test('public health/config/csrf endpoints are reachable', async () => {
+      const health = await request(baseUrl, jar, 'GET', '/api/health');
+      assert.strictEqual(health.status, 200);
+      assert.strictEqual(health.data.success, true);
+
+      const config = await request(baseUrl, jar, 'GET', '/api/config');
+      assert.strictEqual(config.status, 200);
+      assert.strictEqual(config.data.success, true);
+
+      const csrf = await request(baseUrl, jar, 'GET', '/api/csrf-token');
+      assert.strictEqual(csrf.status, 200);
+      assert.ok(csrf.data.csrfToken);
+      assert.ok(jar.get('csrf_token'));
+    });
+
+    test('malformed JSON receives the global JSON error response', async () => {
+      const malformed = await request(baseUrl, new CookieJar(), 'POST', '/api/login', {
+        csrf: false,
+        headers: { 'Content-Type': 'application/json' },
+        body: '{"invalid":}'
+      });
+      assert.strictEqual(malformed.status, 400);
+      assert.strictEqual(malformed.data.success, false);
+      assert.strictEqual(typeof malformed.data.message, 'string');
+    });
+
+    test('auth endpoints login with real cookies and enforce CSRF after authentication', async () => {
+      const login = await request(baseUrl, jar, 'POST', '/api/login', {
+        json: { username: 'admin', password: adminPassword }
+      });
+      assert.strictEqual(login.status, 200);
+      assert.strictEqual(login.data.success, true);
+      assert.ok(jar.get('token'));
+      assert.ok(jar.get('refreshToken'));
+      userId = login.data.user.id;
+
+      const profile = await request(baseUrl, jar, 'GET', '/api/user/profile');
+      assert.strictEqual(profile.status, 200);
+      assert.strictEqual(profile.data.success, true);
+      assert.strictEqual(profile.data.user.id, userId);
+      assert.strictEqual(profile.data.user.oss_access_key_secret, undefined);
+
+      const csrfBlocked = await request(baseUrl, jar, 'POST', '/api/user/theme', {
+        csrf: false,
+        json: { theme: 'light' }
+      });
+      assert.strictEqual(csrfBlocked.status, 403);
+    });
+
+    test('admin can move isolated audit user to local storage only', async () => {
+      const res = await request(baseUrl, jar, 'POST', `/api/admin/users/${userId}/storage-permission`, {
+        json: {
+          storage_permission: 'local_only',
+          local_storage_quota: 10 * 1024 * 1024,
+          download_traffic_quota: -1,
+          reset_download_traffic_used: true
+        }
+      });
+      assert.strictEqual(res.status, 200);
+      assert.strictEqual(res.data.success, true);
+      assert.strictEqual(res.data.user.current_storage_type, 'local');
+    });
+
+    test('file manager rejects unsafe folder names and handles normal local file flow', async () => {
+      const badMkdir = await request(baseUrl, jar, 'POST', '/api/files/mkdir', {
+        json: { path: '/', folderName: '../bad' }
+      });
+      assert.strictEqual(badMkdir.status, 400);
+
+      const badList = await request(baseUrl, jar, 'GET', '/api/files?path=/../secret');
+      assert.strictEqual(badList.status, 400);
+
+      const mkdir = await request(baseUrl, jar, 'POST', '/api/files/mkdir', {
+        json: { path: '/', folderName: AUDIT_PREFIX }
+      });
+      assert.strictEqual(mkdir.status, 200);
+      assert.strictEqual(mkdir.data.success, true);
+
+      const file = new Blob([`hello ${AUDIT_PREFIX}`], { type: 'text/plain' });
+      const form = new FormData();
+      form.append('path', `/${AUDIT_PREFIX}`);
+      form.append('file', file, 'hello.txt');
+      const upload = await request(baseUrl, jar, 'POST', '/api/upload', { body: form });
+      assert.strictEqual(upload.status, 200);
+      assert.strictEqual(upload.data.success, true);
+      assert.strictEqual(upload.data.path, `/${AUDIT_PREFIX}/hello.txt`);
+
+      const list = await request(baseUrl, jar, 'GET', `/api/files?path=/${encodeURIComponent(AUDIT_PREFIX)}`);
+      assert.strictEqual(list.status, 200);
+      assert.ok(list.data.items.some(item => item.name === 'hello.txt'));
+
+      const search = await request(baseUrl, jar, 'GET', `/api/files/search?keyword=hello&path=/${encodeURIComponent(AUDIT_PREFIX)}`);
+      assert.strictEqual(search.status, 200);
+      assert.ok(search.data.items.some(item => item.name === 'hello.txt'));
+    });
+
+    test('failed normal upload validation must not leave multer temp files', async () => {
+      fs.mkdirSync(uploadsDir, { recursive: true });
+      const before = countRegularFiles(uploadsDir);
+      const form = new FormData();
+      form.append('path', '/../blocked');
+      form.append('file', new Blob(['leak candidate'], { type: 'text/plain' }), 'leak.txt');
+      const res = await request(baseUrl, jar, 'POST', '/api/upload', { body: form });
+      assert.strictEqual(res.status, 400);
+      const after = countRegularFiles(uploadsDir);
+      assert.strictEqual(after, before, `uploads temp leak: before=${before}, after=${after}`);
+    });
+
+    test('download URL/check/download work for local file and reject traversal', async () => {
+      const traversal = await request(baseUrl, jar, 'GET', '/api/files/download-check?path=/../secret.txt');
+      assert.strictEqual(traversal.status, 400);
+
+      const check = await request(baseUrl, jar, 'GET', `/api/files/download-check?path=/${encodeURIComponent(AUDIT_PREFIX)}/hello.txt`);
+      assert.strictEqual(check.status, 200);
+      assert.strictEqual(check.data.success, true);
+
+      const url = await request(baseUrl, jar, 'GET', `/api/files/download-url?path=/${encodeURIComponent(AUDIT_PREFIX)}/hello.txt&mode=download`);
+      assert.strictEqual(url.status, 200);
+      assert.strictEqual(url.data.storageType, 'local');
+      assert.match(url.data.downloadUrl, /\/api\/files\/download/);
+
+      const tokenDownload = await request(baseUrl, null, 'GET', url.data.downloadUrl);
+      assert.strictEqual(tokenDownload.status, 200);
+      assert.ok(tokenDownload.raw.toString('utf8').includes(AUDIT_PREFIX));
+
+      const legacyDownload = await request(baseUrl, jar, 'GET', `/api/files/download?path=/${encodeURIComponent(AUDIT_PREFIX)}/hello.txt`);
+      assert.strictEqual(legacyDownload.status, 302);
+      const legacyLocation = legacyDownload.headers.get('location') || '';
+      assert.match(legacyLocation, /\/api\/files\/download\?.*token=/);
+
+      const download = await request(baseUrl, null, 'GET', legacyLocation);
+      assert.strictEqual(download.status, 200);
+      assert.ok(download.raw.toString('utf8').includes(AUDIT_PREFIX));
+
+      const partialUrl = new URL(url.data.downloadUrl);
+      const partial = await request(baseUrl, null, 'GET', partialUrl.toString(), {
+        headers: { Range: 'bytes=6-' }
+      });
+      assert.strictEqual(partial.status, 206);
+      assert.match(partial.headers.get('content-range') || '', /^bytes 6-/);
+      assert.strictEqual(partial.raw.toString('utf8'), download.raw.subarray(6).toString('utf8'));
+    });
+
+    test('share and direct-link flows preserve path boundaries', async () => {
+      const createShare = await request(baseUrl, jar, 'POST', '/api/share/create', {
+        json: {
+          share_type: 'directory',
+          file_path: `/${AUDIT_PREFIX}`,
+          file_name: AUDIT_PREFIX,
+          password: `${AUDIT_PREFIX}_pw`,
+          expiry_days: 1,
+          max_downloads: 5,
+          device_limit: 'all'
+        }
+      });
+      assert.strictEqual(createShare.status, 200);
+      assert.strictEqual(createShare.data.success, true);
+      shareId = createShare.data.share_id;
+      shareCode = createShare.data.share_code;
+
+      const badVerify = await request(baseUrl, new CookieJar(), 'POST', `/api/share/${shareCode}/verify`, {
+        json: { password: 'wrong' }
+      });
+      assert.strictEqual(badVerify.status, 401);
+
+      const publicJar = new CookieJar();
+      const verify = await request(baseUrl, publicJar, 'POST', `/api/share/${shareCode}/verify`, {
+        json: { password: `${AUDIT_PREFIX}_pw` }
+      });
+      assert.strictEqual(verify.status, 200);
+      assert.strictEqual(verify.data.success, true);
+
+      const list = await request(baseUrl, publicJar, 'POST', `/api/share/${shareCode}/list`, {
+        json: { path: '', password: `${AUDIT_PREFIX}_pw` }
+      });
+      assert.strictEqual(list.status, 200);
+      assert.strictEqual(list.data.success, true);
+      assert.ok(list.data.items.some(item => item.name === 'hello.txt'));
+
+      const traversal = await request(baseUrl, publicJar, 'POST', `/api/share/${shareCode}/download-url`, {
+        json: { path: '/../database.db', mode: 'download', password: `${AUDIT_PREFIX}_pw` }
+      });
+      assert.ok([400, 403, 404].includes(traversal.status));
+
+      const shareUrl = await request(baseUrl, publicJar, 'POST', `/api/share/${shareCode}/download-url`, {
+        json: {
+          path: `/${AUDIT_PREFIX}/hello.txt`,
+          mode: 'download',
+          password: `${AUDIT_PREFIX}_pw`
+        }
+      });
+      assert.strictEqual(shareUrl.status, 200);
+      assert.match(shareUrl.data.downloadUrl, /\/api\/share\/[^/]+\/download-file\?.*token=/);
+
+      const shareDownload = await request(baseUrl, null, 'GET', shareUrl.data.downloadUrl);
+      assert.strictEqual(shareDownload.status, 200);
+      assert.ok(shareDownload.raw.toString('utf8').includes(AUDIT_PREFIX));
+
+      const sharePartial = await request(baseUrl, null, 'GET', shareUrl.data.downloadUrl, {
+        headers: { Range: 'bytes=6-' }
+      });
+      assert.strictEqual(sharePartial.status, 206);
+      assert.strictEqual(
+        sharePartial.raw.toString('utf8'),
+        shareDownload.raw.subarray(6).toString('utf8')
+      );
+
+      const direct = await request(baseUrl, jar, 'POST', '/api/direct-link/create', {
+        json: {
+          file_path: `/${AUDIT_PREFIX}/hello.txt`,
+          file_name: 'hello.txt',
+          expiry_days: 1
+        }
+      });
+      assert.strictEqual(direct.status, 200);
+      assert.strictEqual(direct.data.success, true);
+      directLinkId = direct.data.link_id;
+      directLinkCode = direct.data.link_code;
+    });
+
+    test('renaming a directory preserves shares and direct links', async () => {
+      const renamedDir = `${AUDIT_PREFIX}_renamed`;
+      const rename = await request(baseUrl, jar, 'POST', '/api/files/rename', {
+        json: { path: '/', oldName: AUDIT_PREFIX, newName: renamedDir }
+      });
+      assert.strictEqual(rename.status, 200);
+      assert.strictEqual(rename.data.success, true);
+      artifactDirName = renamedDir;
+
+      const shares = await request(baseUrl, jar, 'GET', '/api/share/my');
+      const share = shares.data.shares.find(item => item.share_code === shareCode);
+      assert.strictEqual(share.share_path, `/${renamedDir}`);
+
+      const publicJar = new CookieJar();
+      const list = await request(baseUrl, publicJar, 'POST', `/api/share/${shareCode}/list`, {
+        json: { path: '', password: `${AUDIT_PREFIX}_pw` }
+      });
+      assert.strictEqual(list.status, 200);
+      assert.ok(list.data.items.some(item => item.name === 'hello.txt'));
+
+      const directDownload = await request(baseUrl, null, 'GET', `/d/${directLinkCode}`);
+      assert.strictEqual(directDownload.status, 200);
+      assert.ok(directDownload.raw.toString('utf8').includes(AUDIT_PREFIX));
+    });
+
+    test('admin listing/logging endpoints are authenticated and sanitized', async () => {
+      const noAuth = await request(baseUrl, new CookieJar(), 'GET', '/api/admin/users');
+      assert.strictEqual(noAuth.status, 401);
+
+      const users = await request(baseUrl, jar, 'GET', '/api/admin/users?page=1&pageSize=10');
+      assert.strictEqual(users.status, 200);
+      assert.strictEqual(users.data.success, true);
+      const adminRow = users.data.users.find(user => user.id === userId);
+      assert.ok(adminRow);
+      assert.strictEqual(adminRow.password, undefined);
+      assert.strictEqual(adminRow.oss_access_key_secret, undefined);
+
+      const logs = await request(baseUrl, jar, 'GET', '/api/admin/logs?page=1&pageSize=5');
+      assert.strictEqual(logs.status, 200);
+      assert.strictEqual(logs.data.success, true);
+    });
+
+    test('cleanup via public APIs succeeds for audit artifacts', async () => {
+      if (directLinkId) {
+        const res = await request(baseUrl, jar, 'DELETE', `/api/direct-link/${directLinkId}`);
+        assert.ok([200, 404].includes(res.status));
+      }
+      if (shareId) {
+        const res = await request(baseUrl, jar, 'DELETE', `/api/share/${shareId}`);
+        assert.ok([200, 404].includes(res.status));
+      }
+      const del = await request(baseUrl, jar, 'POST', '/api/files/delete', {
+        json: { path: '/', fileName: artifactDirName }
+      });
+      assert.strictEqual(del.status, 200);
+      assert.strictEqual(del.data.success, true);
+    });
+
+    const failures = [];
+    for (const item of tests) {
+      try {
+        await item.fn();
+        console.log(`[PASS] ${item.name}`);
+      } catch (error) {
+        failures.push({ name: item.name, error });
+        console.error(`[FAIL] ${item.name}`);
+        console.error(error.stack || error.message);
+      }
+    }
+
+    if (failures.length > 0) {
+      const summary = failures.map(item => `- ${item.name}: ${item.error.message}`).join('\n');
+      throw new Error(`full audit regression failed:\n${summary}`);
+    }
+
+    console.log(`PASS full-audit-regression (${tests.length} tests)`);
+  } catch (error) {
+    console.error('--- backend stdout tail ---');
+    console.error(stdout.split(/\r?\n/).slice(-80).join('\n'));
+    console.error('--- backend stderr tail ---');
+    console.error(stderr.split(/\r?\n/).slice(-80).join('\n'));
+    throw error;
+  } finally {
+    child.kill('SIGTERM');
+    await delay(500);
+    if (!child.killed) child.kill('SIGKILL');
+    fs.rmSync(tempRoot, { recursive: true, force: true });
+  }
+}
+
+run().catch(error => {
+  console.error(error.stack || error.message);
+  process.exit(1);
+});

backend/tests/middleware-tests.js

@@ -0,0 +1,180 @@
+process.env.LOG_LEVEL = 'silent';
+
+const assert = require('assert');
+const { EventEmitter } = require('events');
+const fs = require('fs');
+
+const {
+  createCsrfCookieMiddleware,
+  csrfProtection,
+  generateCsrfToken,
+  tokensEqual
+} = require('../middleware/csrf');
+const { RateLimiter } = require('../middleware/rate-limit');
+const { applySecurityHeaders, createHttpsEnforcementMiddleware } = require('../middleware/security');
+const { expressErrorHandler } = require('../middleware/error-handler');
+const { requestContextMiddleware, redactLogValue } = require('../utils/logger');
+const { createHealthService, normalizeMinimumFreeBytes } = require('../services/health-service');
+
+const results = { passed: 0, failed: 0 };
+
+function test(name, fn) {
+  try {
+    fn();
+    results.passed += 1;
+    console.log(`  [PASS] ${name}`);
+  } catch (error) {
+    results.failed += 1;
+    console.error(`  [FAIL] ${name}: ${error.message}`);
+  }
+}
+
+function createResponse() {
+  const response = new EventEmitter();
+  response.headers = {};
+  response.statusCode = 200;
+  response.payload = null;
+  response.cookies = [];
+  response.setHeader = (name, value) => { response.headers[name] = value; };
+  response.removeHeader = (name) => { delete response.headers[name]; };
+  response.status = (code) => { response.statusCode = code; return response; };
+  response.json = (payload) => { response.payload = payload; return response; };
+  response.cookie = (name, value, options) => { response.cookies.push({ name, value, options }); };
+  return response;
+}
+
+console.log('\n========== 中间件与可观测性测试 ==========\n');
+
+test('安全响应头覆盖 CSP、HSTS、Referrer 与 Permissions Policy', () => {
+  const response = createResponse();
+  applySecurityHeaders({ secure: true }, response);
+  assert.ok(response.headers['Content-Security-Policy'].includes("object-src 'none'"));
+  assert.ok(response.headers['Strict-Transport-Security']);
+  assert.strictEqual(response.headers['X-Content-Type-Options'], 'nosniff');
+  assert.strictEqual(response.headers['Referrer-Policy'], 'strict-origin-when-cross-origin');
+  assert.ok(response.headers['Permissions-Policy']);
+});
+
+test('HTTPS 中间件阻止不安全请求但放行本机健康检查', () => {
+  const middleware = createHttpsEnforcementMiddleware({ enabled: true });
+  const blockedResponse = createResponse();
+  middleware({ path: '/api/config', secure: false, socket: { remoteAddress: '10.0.0.1' }, id: 'req-1' }, blockedResponse, () => assert.fail('不应放行'));
+  assert.strictEqual(blockedResponse.statusCode, 400);
+  assert.strictEqual(blockedResponse.payload.requestId, 'req-1');
+
+  let nextCalled = false;
+  middleware({ path: '/api/health', secure: false, socket: { remoteAddress: '127.0.0.1' } }, createResponse(), () => { nextCalled = true; });
+  assert.strictEqual(nextCalled, true);
+});
+
+test('请求上下文接受安全 requestId 并回写响应头', () => {
+  const request = { headers: { 'x-request-id': 'trace-123' }, method: 'GET', path: '/api/config' };
+  const response = createResponse();
+  requestContextMiddleware(request, response, () => {});
+  assert.strictEqual(request.id, 'trace-123');
+  assert.strictEqual(response.headers['X-Request-ID'], 'trace-123');
+  response.emit('finish');
+});
+
+test('非法 requestId 被替换，日志敏感字段被脱敏', () => {
+  const request = { headers: { 'x-request-id': 'bad id\n' }, method: 'GET', path: '/' };
+  const response = createResponse();
+  requestContextMiddleware(request, response, () => {});
+  assert.notStrictEqual(request.id, 'bad id\n');
+  assert.match(request.id, /^[0-9a-f-]{36}$/);
+  const redacted = redactLogValue({ password: 'secret', note: 'token=abc', nested: { authorization: 'Bearer value' } });
+  assert.strictEqual(redacted.password, '[REDACTED]');
+  assert.strictEqual(redacted.note, 'token=[REDACTED]');
+  assert.strictEqual(redacted.nested.authorization, '[REDACTED]');
+  response.emit('finish');
+});
+
+test('CSRF token 使用固定长度并支持常量时间比较', () => {
+  const token = generateCsrfToken();
+  assert.match(token, /^[a-f0-9]{64}$/);
+  assert.strictEqual(tokensEqual(token, token), true);
+  assert.strictEqual(tokensEqual(token, `${token}0`), false);
+});
+
+test('CSRF Cookie 中间件只在缺少 token 时设置 Cookie', () => {
+  const middleware = createCsrfCookieMiddleware({ secureCookies: true });
+  const response = createResponse();
+  middleware({ cookies: {} }, response, () => {});
+  assert.strictEqual(response.cookies.length, 1);
+  assert.strictEqual(response.cookies[0].options.secure, true);
+  assert.strictEqual(response.cookies[0].options.sameSite, 'strict');
+});
+
+test('Cookie 会话的写请求必须通过 CSRF 校验', () => {
+  const response = createResponse();
+  csrfProtection({
+    method: 'POST',
+    path: '/api/example',
+    id: 'req-2',
+    cookies: { token: 'session', csrf_token: 'a' },
+    headers: { 'x-csrf-token': 'b' }
+  }, response, () => assert.fail('不应放行'));
+  assert.strictEqual(response.statusCode, 403);
+  assert.strictEqual(response.payload.requestId, 'req-2');
+});
+
+test('失败限流器达到阈值后封锁并可在成功后清除', () => {
+  const limiter = new RateLimiter({ maxAttempts: 2, windowMs: 1000, blockDuration: 1000 });
+  try {
+    assert.strictEqual(limiter.recordFailure('key').blocked, false);
+    assert.strictEqual(limiter.recordFailure('key').blocked, true);
+    assert.strictEqual(limiter.isBlocked('key'), true);
+    limiter.recordSuccess('key');
+    assert.strictEqual(limiter.isBlocked('key'), false);
+  } finally {
+    limiter.destroy();
+  }
+});
+
+test('健康检查同时验证数据库与磁盘', () => {
+  const service = createHealthService({
+    db: { prepare: () => ({ get: () => ({ ok: 1 }) }) },
+    diskPath: __dirname,
+    minimumFreeBytes: 0
+  });
+  const result = service.check();
+  assert.strictEqual(result.healthy, true);
+  assert.strictEqual(result.checks.database.status, 'ok');
+  assert.strictEqual(result.checks.disk.status, 'ok');
+  assert.ok(result.checks.disk.freeBytes > 0);
+  assert.strictEqual(fs.existsSync(__dirname), true);
+  assert.strictEqual(normalizeMinimumFreeBytes(-1), 256 * 1024 * 1024);
+});
+
+test('数据库异常会让健康状态降级', () => {
+  const service = createHealthService({
+    db: { prepare: () => { throw Object.assign(new Error('down'), { code: 'SQLITE_DOWN' }); } },
+    diskPath: __dirname,
+    minimumFreeBytes: 0
+  });
+  const result = service.check();
+  assert.strictEqual(result.healthy, false);
+  assert.strictEqual(result.checks.database.status, 'error');
+});
+
+test('错误响应携带 requestId 并隐藏服务端异常', () => {
+  const response = createResponse();
+  expressErrorHandler(new Error('secret detail'), {
+    id: 'req-3',
+    method: 'GET',
+    path: '/api/example'
+  }, response, () => assert.fail('不应继续'));
+  assert.deepStrictEqual(response.payload, {
+    success: false,
+    message: '服务器内部错误',
+    requestId: 'req-3'
+  });
+});
+
+console.log('\n========================================');
+console.log('测试总结');
+console.log('========================================');
+console.log(`通过: ${results.passed}`);
+console.log(`失败: ${results.failed}`);
+
+process.exit(results.failed > 0 ? 1 : 0);

backend/tests/production-utils-tests.js

@@ -0,0 +1,246 @@
+process.env.LOG_LEVEL = 'silent';
+
+const assert = require('assert');
+const {
+  parseDateTimeValue,
+  formatDateTimeForSqlite,
+  getDateKeyFromDate,
+  getRecentDateKeys,
+  getNextDownloadResetTime,
+  normalizeTimeHHmm,
+  isCurrentTimeInWindow
+} = require('../utils/datetime');
+const {
+  MAX_DOWNLOAD_TRAFFIC_BYTES,
+  normalizeDownloadTrafficQuota,
+  normalizeDownloadTrafficUsed,
+  getDownloadTrafficState,
+  resolveDownloadTrafficPolicyUpdates
+} = require('../utils/download-quota');
+const { expressErrorHandler } = require('../middleware/error-handler');
+
+const results = { passed: 0, failed: 0 };
+
+function test(name, fn) {
+  try {
+    fn();
+    results.passed += 1;
+    console.log(`  [PASS] ${name}`);
+  } catch (error) {
+    results.failed += 1;
+    console.error(`  [FAIL] ${name}: ${error.message}`);
+  }
+}
+
+function createResponse(headersSent = false) {
+  return {
+    headersSent,
+    statusCode: null,
+    payload: null,
+    status(code) {
+      this.statusCode = code;
+      return this;
+    },
+    json(payload) {
+      this.payload = payload;
+      return this;
+    }
+  };
+}
+
+console.log('\n========== 生产工具模块测试 ==========\n');
+
+test('SQLite 日期时间可以被解析', () => {
+  const parsed = parseDateTimeValue('2026-07-27 12:34:56');
+  assert.ok(parsed instanceof Date);
+  assert.strictEqual(parsed.getFullYear(), 2026);
+  assert.strictEqual(parsed.getMonth(), 6);
+  assert.strictEqual(parsed.getDate(), 27);
+});
+
+test('非法日期时间返回 null', () => {
+  assert.strictEqual(parseDateTimeValue('not-a-date'), null);
+  assert.strictEqual(parseDateTimeValue(null), null);
+});
+
+test('日期时间按 SQLite 格式输出', () => {
+  const value = new Date(2026, 6, 27, 3, 4, 5);
+  assert.strictEqual(formatDateTimeForSqlite(value), '2026-07-27 03:04:05');
+});
+
+test('日期键校验有效和无效日期', () => {
+  assert.strictEqual(getDateKeyFromDate(new Date(2026, 0, 2)), '2026-01-02');
+  assert.strictEqual(getDateKeyFromDate('invalid'), null);
+});
+
+test('最近日期键按时间顺序生成', () => {
+  const keys = getRecentDateKeys(3, new Date(2026, 0, 2, 12, 0, 0));
+  assert.deepStrictEqual(keys, ['2025-12-31', '2026-01-01', '2026-01-02']);
+});
+
+test('下载配额重置时间支持日周月周期', () => {
+  assert.strictEqual(
+    formatDateTimeForSqlite(getNextDownloadResetTime('2026-01-01 00:00:00', 'daily')),
+    '2026-01-02 00:00:00'
+  );
+  assert.strictEqual(
+    formatDateTimeForSqlite(getNextDownloadResetTime('2026-01-01 00:00:00', 'weekly')),
+    '2026-01-08 00:00:00'
+  );
+  assert.strictEqual(
+    formatDateTimeForSqlite(getNextDownloadResetTime('2026-01-01 00:00:00', 'monthly')),
+    '2026-02-01 00:00:00'
+  );
+  assert.strictEqual(getNextDownloadResetTime('2026-01-01 00:00:00', 'none'), null);
+});
+
+test('访问时间格式被严格规范化', () => {
+  assert.strictEqual(normalizeTimeHHmm(' 09:05 '), '09:05');
+  assert.strictEqual(normalizeTimeHHmm('9:05'), null);
+  assert.strictEqual(normalizeTimeHHmm('24:00'), null);
+});
+
+test('同日访问时间窗口正确判断', () => {
+  assert.strictEqual(isCurrentTimeInWindow('09:00', '18:00', new Date(2026, 0, 1, 12, 0)), true);
+  assert.strictEqual(isCurrentTimeInWindow('09:00', '18:00', new Date(2026, 0, 1, 18, 0)), false);
+});
+
+test('跨日访问时间窗口正确判断', () => {
+  assert.strictEqual(isCurrentTimeInWindow('22:00', '06:00', new Date(2026, 0, 1, 23, 0)), true);
+  assert.strictEqual(isCurrentTimeInWindow('22:00', '06:00', new Date(2026, 0, 1, 12, 0)), false);
+});
+
+test('非法下载配额被禁止而负数统一为不限', () => {
+  assert.strictEqual(normalizeDownloadTrafficQuota('invalid'), 0);
+  assert.strictEqual(normalizeDownloadTrafficQuota(-99), -1);
+});
+
+test('下载配额被取整并限制在 10TB', () => {
+  assert.strictEqual(normalizeDownloadTrafficQuota(10.9), 10);
+  assert.strictEqual(normalizeDownloadTrafficQuota(MAX_DOWNLOAD_TRAFFIC_BYTES + 1), MAX_DOWNLOAD_TRAFFIC_BYTES);
+});
+
+test('已用流量按有限配额封顶', () => {
+  assert.strictEqual(normalizeDownloadTrafficUsed(150, 100), 100);
+  assert.strictEqual(normalizeDownloadTrafficUsed(150, -1), 150);
+  assert.strictEqual(normalizeDownloadTrafficUsed(-1, 100), 0);
+});
+
+test('不限流量状态保留无限剩余额度', () => {
+  const state = getDownloadTrafficState({ download_traffic_quota: -1, download_traffic_used: 123 });
+  assert.strictEqual(state.isUnlimited, true);
+  assert.strictEqual(state.used, 123);
+  assert.strictEqual(state.remaining, Number.POSITIVE_INFINITY);
+});
+
+test('空用户不会产生配额更新', () => {
+  assert.deepStrictEqual(resolveDownloadTrafficPolicyUpdates(null), {
+    updates: {},
+    hasUpdates: false,
+    expired: false,
+    resetApplied: false
+  });
+});
+
+test('非法重置周期会被规范化', () => {
+  const result = resolveDownloadTrafficPolicyUpdates({
+    download_traffic_quota: 100,
+    download_traffic_used: 0,
+    download_traffic_reset_cycle: 'yearly'
+  });
+  assert.strictEqual(result.updates.download_traffic_reset_cycle, 'none');
+});
+
+test('周期配额首次运行时记录重置时间', () => {
+  const now = new Date(2026, 6, 27, 12, 0, 0);
+  const result = resolveDownloadTrafficPolicyUpdates({
+    download_traffic_quota: 100,
+    download_traffic_used: 10,
+    download_traffic_reset_cycle: 'daily',
+    download_traffic_last_reset_at: null
+  }, now);
+  assert.strictEqual(result.updates.download_traffic_last_reset_at, '2026-07-27 12:00:00');
+});
+
+test('到达周期时已用流量归零', () => {
+  const result = resolveDownloadTrafficPolicyUpdates({
+    download_traffic_quota: 100,
+    download_traffic_used: 90,
+    download_traffic_reset_cycle: 'daily',
+    download_traffic_last_reset_at: '2026-07-26 12:00:00'
+  }, new Date(2026, 6, 27, 12, 0, 0));
+  assert.strictEqual(result.resetApplied, true);
+  assert.strictEqual(result.updates.download_traffic_used, 0);
+});
+
+test('限时配额到期后恢复为不限流量', () => {
+  const result = resolveDownloadTrafficPolicyUpdates({
+    download_traffic_quota: 100,
+    download_traffic_used: 90,
+    download_traffic_quota_expires_at: '2026-07-26 12:00:00',
+    download_traffic_reset_cycle: 'daily',
+    download_traffic_last_reset_at: '2026-07-26 12:00:00'
+  }, new Date(2026, 6, 27, 12, 0, 0));
+  assert.strictEqual(result.expired, true);
+  assert.strictEqual(result.updates.download_traffic_quota, -1);
+  assert.strictEqual(result.updates.download_traffic_used, 0);
+  assert.strictEqual(result.updates.download_traffic_quota_expires_at, null);
+});
+
+test('Express 错误处理器保留四参数签名', () => {
+  assert.strictEqual(expressErrorHandler.length, 4);
+});
+
+test('Express 错误处理器返回客户端错误 JSON', () => {
+  const response = createResponse();
+  const originalConsoleError = console.error;
+  console.error = () => {};
+  try {
+    expressErrorHandler(
+      Object.assign(new Error('请求 JSON 无效'), { status: 400 }),
+      { method: 'POST', originalUrl: '/api/login' },
+      response,
+      () => assert.fail('不应调用 next')
+    );
+  } finally {
+    console.error = originalConsoleError;
+  }
+  assert.strictEqual(response.statusCode, 400);
+  assert.deepStrictEqual(response.payload, { success: false, message: '请求 JSON 无效' });
+});
+
+test('Express 错误处理器隐藏服务端异常详情', () => {
+  const response = createResponse();
+  const originalConsoleError = console.error;
+  console.error = () => {};
+  try {
+    expressErrorHandler(
+      new Error('sensitive detail'),
+      { method: 'GET', originalUrl: '/api/example' },
+      response,
+      () => assert.fail('不应调用 next')
+    );
+  } finally {
+    console.error = originalConsoleError;
+  }
+  assert.strictEqual(response.statusCode, 500);
+  assert.deepStrictEqual(response.payload, { success: false, message: '服务器内部错误' });
+});
+
+test('响应头已发送时错误处理器继续交给 Express', () => {
+  const response = createResponse(true);
+  const error = new Error('stream failed');
+  let forwarded = null;
+  expressErrorHandler(error, {}, response, (received) => {
+    forwarded = received;
+  });
+  assert.strictEqual(forwarded, error);
+});
+
+console.log('\n========================================');
+console.log('测试总结');
+console.log('========================================');
+console.log(`通过: ${results.passed}`);
+console.log(`失败: ${results.failed}`);
+
+process.exit(results.failed > 0 ? 1 : 0);

backend/tests/release-sync-tests.js

@@ -0,0 +1,73 @@
+const assert = require('assert');
+const crypto = require('crypto');
+const fs = require('fs');
+const os = require('os');
+const path = require('path');
+const { spawnSync } = require('child_process');
+
+const projectRoot = path.resolve(__dirname, '..', '..');
+const syncScript = path.join(projectRoot, 'frontend', 'scripts', 'sync-desktop-release.js');
+const results = { passed: 0, failed: 0 };
+
+function test(name, fn) {
+  try {
+    fn();
+    results.passed += 1;
+    console.log(`  [PASS] ${name}`);
+  } catch (error) {
+    results.failed += 1;
+    console.error(`  [FAIL] ${name}: ${error.message}`);
+  }
+}
+
+console.log('\n========== 桌面安装包发布同步测试 ==========\n');
+
+const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'wanwanyun-release-sync-'));
+try {
+  const destinationDirectory = path.join(tempRoot, 'downloads');
+  const asset = 'wanwan-cloud-desktop_v9.9.9_x64-setup.exe';
+  const assetContent = Buffer.from('verified desktop release fixture');
+  const sha256 = crypto.createHash('sha256').update(assetContent).digest('hex');
+  const metadataPath = path.join(tempRoot, 'desktop-release.json');
+  fs.mkdirSync(destinationDirectory, { recursive: true });
+  fs.writeFileSync(path.join(destinationDirectory, asset), assetContent);
+  fs.writeFileSync(metadataPath, JSON.stringify({
+    version: '9.9.9',
+    tag: 'v9.9.9',
+    asset,
+    downloadUrl: `https://example.test/releases/download/v9.9.9/${asset}`,
+    publicPath: `/downloads/${asset}`,
+    sha256,
+    size: assetContent.length
+  }));
+
+  const runCheck = () => spawnSync(process.execPath, [
+    syncScript,
+    '--metadata', metadataPath,
+    '--destination-dir', destinationDirectory,
+    '--check-only'
+  ], { encoding: 'utf8' });
+
+  test('已缓存安装包通过大小与 SHA256 校验', () => {
+    const result = runCheck();
+    assert.strictEqual(result.status, 0, result.stderr);
+    assert.match(result.stdout, /Desktop release verified/);
+  });
+
+  test('损坏的安装包会让只读校验失败', () => {
+    fs.appendFileSync(path.join(destinationDirectory, asset), 'corrupt');
+    const result = runCheck();
+    assert.notStrictEqual(result.status, 0);
+    assert.match(result.stderr, /Desktop release check failed/);
+  });
+} finally {
+  fs.rmSync(tempRoot, { recursive: true, force: true });
+}
+
+console.log('\n========================================');
+console.log('测试总结');
+console.log('========================================');
+console.log(`通过: ${results.passed}`);
+console.log(`失败: ${results.failed}`);
+
+process.exit(results.failed > 0 ? 1 : 0);

backend/tests/run-all-tests.js

@@ -7,6 +7,12 @@ const path = require('path');
 
 const testFiles = [
   'boundary-tests.js',
+  'production-utils-tests.js',
+  'domain-utils-tests.js',
+  'middleware-tests.js',
+  'architecture-tests.js',
+  'release-sync-tests.js',
+  'archive-tests.js',
   'network-concurrent-tests.js',
   'state-consistency-tests.js'
 ];
@@ -42,7 +48,9 @@ function runTest(file) {
       const failMatch = output.match(/失败:\s*(\d+)/);
 
       const passed = passMatch ? parseInt(passMatch[1]) : 0;
-      const failed = failMatch ? parseInt(failMatch[1]) : 0;
+      const parsedFailed = failMatch ? parseInt(failMatch[1]) : 0;
+      // A syntax error or early crash may not print the normal summary.
+      const failed = code !== 0 && parsedFailed === 0 ? 1 : parsedFailed;
 
       results.files.push({
         file,
@@ -91,7 +99,8 @@ async function runAllTests() {
   console.log(`总计: 通过 ${results.total.passed}, 失败 ${results.total.failed}`);
   console.log('');
 
-  if (results.total.failed > 0) {
+  const hasProcessFailure = results.files.some(file => file.exitCode !== 0);
+  if (results.total.failed > 0 || hasProcessFailure) {
     console.log('存在失败的测试，请检查输出以了解详情。');
     process.exit(1);
   } else {

backend/utils/archive.js

@@ -0,0 +1,9 @@
+let archiverModulePromise = null;
+
+async function createZipArchive(options = {}) {
+  archiverModulePromise ||= import('archiver');
+  const { ZipArchive } = await archiverModulePromise;
+  return new ZipArchive(options);
+}
+
+module.exports = { createZipArchive };

backend/utils/coerce.js

@@ -0,0 +1,26 @@
+function normalizeNonNegativeInteger(rawValue, fallback = 0) {
+  const value = Number(rawValue);
+  if (!Number.isFinite(value) || value < 0) {
+    return Math.max(0, Number(fallback) || 0);
+  }
+  return Math.floor(value);
+}
+
+function parseBooleanLike(rawValue, fallback = false) {
+  if (rawValue === null || rawValue === undefined || rawValue === '') {
+    return fallback;
+  }
+  if (typeof rawValue === 'boolean') {
+    return rawValue;
+  }
+
+  const normalized = String(rawValue).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+  return fallback;
+}
+
+module.exports = {
+  normalizeNonNegativeInteger,
+  parseBooleanLike
+};

backend/utils/datetime.js

@@ -0,0 +1,92 @@
+function parseDateTimeValue(value) {
+  if (!value || typeof value !== 'string') return null;
+
+  const directDate = new Date(value);
+  if (!Number.isNaN(directDate.getTime())) return directDate;
+
+  const normalizedDate = new Date(value.replace(' ', 'T'));
+  return Number.isNaN(normalizedDate.getTime()) ? null : normalizedDate;
+}
+
+function formatDateTimeForSqlite(date = new Date()) {
+  const target = date instanceof Date ? date : new Date(date);
+  const year = target.getFullYear();
+  const month = String(target.getMonth() + 1).padStart(2, '0');
+  const day = String(target.getDate()).padStart(2, '0');
+  const hours = String(target.getHours()).padStart(2, '0');
+  const minutes = String(target.getMinutes()).padStart(2, '0');
+  const seconds = String(target.getSeconds()).padStart(2, '0');
+  return `${year}-${month}-${day} ${hours}:${minutes}:${seconds}`;
+}
+
+function getDateKeyFromDate(date = new Date()) {
+  const target = date instanceof Date ? date : new Date(date);
+  if (Number.isNaN(target.getTime())) return null;
+  const year = target.getFullYear();
+  const month = String(target.getMonth() + 1).padStart(2, '0');
+  const day = String(target.getDate()).padStart(2, '0');
+  return `${year}-${month}-${day}`;
+}
+
+function getRecentDateKeys(days = 30, now = new Date()) {
+  const safeDays = Math.max(1, Math.floor(Number(days) || 30));
+  const keys = [];
+  for (let i = safeDays - 1; i >= 0; i -= 1) {
+    const date = new Date(now.getTime());
+    date.setDate(date.getDate() - i);
+    const key = getDateKeyFromDate(date);
+    if (key) keys.push(key);
+  }
+  return keys;
+}
+
+function getNextDownloadResetTime(lastResetAt, resetCycle) {
+  const baseDate = parseDateTimeValue(lastResetAt);
+  if (!baseDate) return null;
+
+  const next = new Date(baseDate.getTime());
+  if (resetCycle === 'daily') next.setDate(next.getDate() + 1);
+  else if (resetCycle === 'weekly') next.setDate(next.getDate() + 7);
+  else if (resetCycle === 'monthly') next.setMonth(next.getMonth() + 1);
+  else return null;
+  return next;
+}
+
+function normalizeTimeHHmm(value) {
+  if (typeof value !== 'string') return null;
+  const match = value.trim().match(/^(\d{2}):(\d{2})$/);
+  if (!match) return null;
+  const hours = Number(match[1]);
+  const minutes = Number(match[2]);
+  if (hours < 0 || hours > 23 || minutes < 0 || minutes > 59) return null;
+  return `${String(hours).padStart(2, '0')}:${String(minutes).padStart(2, '0')}`;
+}
+
+function toMinutesOfDay(hhmm) {
+  const normalized = normalizeTimeHHmm(hhmm);
+  if (!normalized) return null;
+  const [hours, minutes] = normalized.split(':').map(Number);
+  return hours * 60 + minutes;
+}
+
+function isCurrentTimeInWindow(startTime, endTime, now = new Date()) {
+  const start = toMinutesOfDay(startTime);
+  const end = toMinutesOfDay(endTime);
+  if (start === null || end === null) return true;
+
+  const nowMinutes = now.getHours() * 60 + now.getMinutes();
+  if (start === end) return true;
+  if (start < end) return nowMinutes >= start && nowMinutes < end;
+  return nowMinutes >= start || nowMinutes < end;
+}
+
+module.exports = {
+  parseDateTimeValue,
+  formatDateTimeForSqlite,
+  getDateKeyFromDate,
+  getRecentDateKeys,
+  getNextDownloadResetTime,
+  normalizeTimeHHmm,
+  toMinutesOfDay,
+  isCurrentTimeInWindow
+};

backend/utils/device.js

@@ -0,0 +1,68 @@
+function normalizeClientIp(rawIp) {
+  const ip = String(rawIp || '').trim();
+  if (!ip) return '';
+  if (ip.startsWith('::ffff:')) return ip.slice(7);
+  return ip === '::1' ? '127.0.0.1' : ip;
+}
+
+function detectDeviceTypeFromUserAgent(userAgent = '') {
+  const mobilePattern = /(Mobile|Android|iPhone|iPad|iPod|Windows Phone|HarmonyOS|Mobi)/i;
+  return mobilePattern.test(String(userAgent || '')) ? 'mobile' : 'desktop';
+}
+
+function inferPlatformFromUserAgent(userAgent = '') {
+  const value = String(userAgent || '');
+  if (!value) return '未知平台';
+  if (/windows/i.test(value)) return 'Windows';
+  if (/macintosh|mac os x/i.test(value)) return 'macOS';
+  if (/android/i.test(value)) return 'Android';
+  if (/iphone|ipad|ios/i.test(value)) return 'iOS';
+  if (/linux/i.test(value)) return 'Linux';
+  return '未知平台';
+}
+
+function normalizeClientType(value = '') {
+  const normalized = String(value || '').trim().toLowerCase();
+  return ['web', 'desktop', 'mobile', 'api'].includes(normalized) ? normalized : '';
+}
+
+function resolveClientType(clientType, userAgent = '') {
+  const normalized = normalizeClientType(clientType);
+  if (normalized) return normalized;
+
+  const userAgentValue = String(userAgent || '').toLowerCase();
+  if (
+    userAgentValue.includes('tauri')
+    || userAgentValue.includes('electron')
+    || userAgentValue.includes('wanwan-cloud-desktop')
+    || userAgentValue.includes('玩玩云')
+  ) {
+    return 'desktop';
+  }
+  return detectDeviceTypeFromUserAgent(userAgentValue) === 'mobile' ? 'mobile' : 'web';
+}
+
+function sanitizeDeviceText(value, maxLength = 120) {
+  return typeof value === 'string' ? value.trim().slice(0, maxLength) : '';
+}
+
+function buildDeviceName({ clientType, deviceName, platform }) {
+  const preferred = sanitizeDeviceText(deviceName, 120);
+  if (preferred) return preferred;
+
+  const platformText = sanitizeDeviceText(platform, 80) || '未知平台';
+  if (clientType === 'desktop') return `桌面客户端 · ${platformText}`;
+  if (clientType === 'mobile') return `移动端浏览器 · ${platformText}`;
+  if (clientType === 'api') return `API 客户端 · ${platformText}`;
+  return `网页端浏览器 · ${platformText}`;
+}
+
+module.exports = {
+  buildDeviceName,
+  detectDeviceTypeFromUserAgent,
+  inferPlatformFromUserAgent,
+  normalizeClientIp,
+  normalizeClientType,
+  resolveClientType,
+  sanitizeDeviceText
+};

backend/utils/download-quota.js

@@ -0,0 +1,107 @@
+const {
+  parseDateTimeValue,
+  formatDateTimeForSqlite,
+  getNextDownloadResetTime
+} = require('./datetime');
+
+const MAX_DOWNLOAD_TRAFFIC_BYTES = 10 * 1024 * 1024 * 1024 * 1024;
+
+function normalizeDownloadTrafficQuota(rawQuota) {
+  const parsedQuota = Number(rawQuota);
+  if (!Number.isFinite(parsedQuota)) return 0;
+  if (parsedQuota < 0) return -1;
+  return Math.min(MAX_DOWNLOAD_TRAFFIC_BYTES, Math.floor(parsedQuota));
+}
+
+function normalizeDownloadTrafficUsed(rawUsed, quota = 0) {
+  const parsedUsed = Number(rawUsed);
+  const normalizedUsed = Number.isFinite(parsedUsed) && parsedUsed > 0
+    ? Math.floor(parsedUsed)
+    : 0;
+  return quota >= 0 ? Math.min(normalizedUsed, quota) : normalizedUsed;
+}
+
+function getDownloadTrafficState(user) {
+  const quota = normalizeDownloadTrafficQuota(user?.download_traffic_quota);
+  const used = normalizeDownloadTrafficUsed(user?.download_traffic_used, quota);
+  const isUnlimited = quota < 0;
+  return {
+    quota,
+    used,
+    isUnlimited,
+    remaining: isUnlimited ? Number.POSITIVE_INFINITY : Math.max(0, quota - used)
+  };
+}
+
+function resolveDownloadTrafficPolicyUpdates(user, now = new Date()) {
+  if (!user) {
+    return { updates: {}, hasUpdates: false, expired: false, resetApplied: false };
+  }
+
+  const updates = {};
+  let hasUpdates = false;
+  let expired = false;
+  let resetApplied = false;
+
+  const normalizedQuota = normalizeDownloadTrafficQuota(user.download_traffic_quota);
+  const normalizedUsed = normalizeDownloadTrafficUsed(user.download_traffic_used, normalizedQuota);
+  if (normalizedQuota !== Number(user.download_traffic_quota || 0)) {
+    updates.download_traffic_quota = normalizedQuota;
+    hasUpdates = true;
+  }
+  if (normalizedUsed !== Number(user.download_traffic_used || 0)) {
+    updates.download_traffic_used = normalizedUsed;
+    hasUpdates = true;
+  }
+
+  const resetCycle = ['none', 'daily', 'weekly', 'monthly'].includes(user.download_traffic_reset_cycle)
+    ? user.download_traffic_reset_cycle
+    : 'none';
+  if (resetCycle !== (user.download_traffic_reset_cycle || 'none')) {
+    updates.download_traffic_reset_cycle = resetCycle;
+    hasUpdates = true;
+  }
+
+  const expiresAt = parseDateTimeValue(user.download_traffic_quota_expires_at);
+  if (normalizedQuota <= 0 && user.download_traffic_quota_expires_at) {
+    updates.download_traffic_quota_expires_at = null;
+    hasUpdates = true;
+  } else if (normalizedQuota > 0 && expiresAt && now >= expiresAt) {
+    updates.download_traffic_quota = -1;
+    updates.download_traffic_used = 0;
+    updates.download_traffic_quota_expires_at = null;
+    updates.download_traffic_reset_cycle = 'none';
+    updates.download_traffic_last_reset_at = null;
+    hasUpdates = true;
+    expired = true;
+  }
+
+  if (!expired && resetCycle !== 'none') {
+    const lastResetAt = user.download_traffic_last_reset_at;
+    if (!lastResetAt) {
+      updates.download_traffic_last_reset_at = formatDateTimeForSqlite(now);
+      hasUpdates = true;
+    } else {
+      const nextResetAt = getNextDownloadResetTime(lastResetAt, resetCycle);
+      if (nextResetAt && now >= nextResetAt) {
+        updates.download_traffic_used = 0;
+        updates.download_traffic_last_reset_at = formatDateTimeForSqlite(now);
+        hasUpdates = true;
+        resetApplied = true;
+      }
+    }
+  } else if (resetCycle === 'none' && user.download_traffic_last_reset_at) {
+    updates.download_traffic_last_reset_at = null;
+    hasUpdates = true;
+  }
+
+  return { updates, hasUpdates, expired, resetApplied };
+}
+
+module.exports = {
+  MAX_DOWNLOAD_TRAFFIC_BYTES,
+  normalizeDownloadTrafficQuota,
+  normalizeDownloadTrafficUsed,
+  getDownloadTrafficState,
+  resolveDownloadTrafficPolicyUpdates
+};

backend/utils/encryption.js

@@ -16,6 +16,7 @@
  */
 
 const crypto = require('crypto');
+const ENCRYPTION_PREFIX = 'enc:v1:';
 
 /**
  * 从环境变量获取加密密钥
@@ -111,8 +112,8 @@ function encryptSecret(plaintext) {
       authTag
     ]);
 
-    // 返回 Base64 编码的结果
-    return combined.toString('base64');
+    // 返回带版本前缀的 Base64 编码结果，避免旧明文被误判为密文。
+    return ENCRYPTION_PREFIX + combined.toString('base64');
   } catch (error) {
     console.error('[加密] 加密失败:', error);
     throw new Error('数据加密失败: ' + error.message);
@@ -134,24 +135,26 @@ function encryptSecret(plaintext) {
  * // 输出: 'my-secret-key'
  */
 function decryptSecret(ciphertext) {
+  // 如果是 null 或 undefined，直接返回
+  if (!ciphertext) {
+    return ciphertext;
+  }
+
+  const rawValue = String(ciphertext);
+  const hasPrefix = rawValue.startsWith(ENCRYPTION_PREFIX);
+  const encodedValue = hasPrefix ? rawValue.slice(ENCRYPTION_PREFIX.length) : rawValue;
+
+  if (!hasPrefix && !isEncrypted(encodedValue)) {
+    if (/[+/=]/.test(rawValue)) {
+      throw new Error('数据解密失败: 疑似密文格式无效');
+    }
+    console.warn('[加密] 检测到未加密的旧密钥，建议重新保存以完成加密');
+    return rawValue;
+  }
+
   try {
-    // 如果是 null 或 undefined，直接返回
-    if (!ciphertext) {
-      return ciphertext;
-    }
-
-    // 检查是否为加密格式（Base64）
-    // 如果不是 Base64，可能是旧数据（明文），直接返回
-    if (!/^[A-Za-z0-9+/=]+$/.test(ciphertext)) {
-      console.warn('[加密] 检测到未加密的密钥，建议重新加密');
-      return ciphertext;
-    }
-
-    // 获取加密密钥
     const key = getEncryptionKey();
-
-    // 解析 Base64
-    const combined = Buffer.from(ciphertext, 'base64');
+    const combined = Buffer.from(encodedValue, 'base64');
 
     // 提取各部分
     // IV: 前 12 字节
@@ -175,13 +178,9 @@ function decryptSecret(ciphertext) {
 
     return decrypted;
   } catch (error) {
-    // 如果解密失败，可能是旧数据（明文），直接返回
-    console.error('[加密] 解密失败，可能是未加密的旧数据:', error.message);
-
-    // 在开发环境抛出错误，生产环境尝试返回原值
-    if (process.env.NODE_ENV === 'production') {
-      console.error('[加密] 生产环境中解密失败，返回原值（可能导致 OSS 连接失败）');
-      return ciphertext;
+    if (!hasPrefix && !/[+/=]/.test(rawValue)) {
+      console.warn('[加密] 旧格式数据解密失败，按未加密旧密钥处理:', error.message);
+      return rawValue;
     }
 
     throw new Error('数据解密失败: ' + error.message);
@@ -240,6 +239,10 @@ function isEncrypted(data) {
     return false;
   }
 
+  const encodedValue = data.startsWith(ENCRYPTION_PREFIX)
+    ? data.slice(ENCRYPTION_PREFIX.length)
+    : data;
+
   // 加密后的数据特征：
   // 1. 是有效的 Base64
   // 2. 长度至少为 (12 + 16) * 4/3 = 38 字符（IV + authTag 的 Base64）
@@ -247,7 +250,11 @@ function isEncrypted(data) {
 
   try {
     // 尝试解码 Base64
-    const buffer = Buffer.from(data, 'base64');
+    if (!/^[A-Za-z0-9+/=]+$/.test(encodedValue) || encodedValue.length % 4 !== 0) {
+      return false;
+    }
+
+    const buffer = Buffer.from(encodedValue, 'base64');
 
     // 检查长度（至少包含 IV + authTag）
     // AES-GCM: 12字节IV + 至少1字节密文 + 16字节authTag = 29字节

backend/utils/input-security.js

@@ -0,0 +1,98 @@
+const path = require('path');
+
+const DANGEROUS_EXTENSIONS = [
+  '.php', '.php3', '.php4', '.php5', '.phtml', '.phar',
+  '.jsp', '.jspx', '.jsw', '.jsv', '.jspf',
+  '.asp', '.aspx', '.asa', '.asax', '.ascx', '.ashx', '.asmx',
+  '.htaccess', '.htpasswd'
+];
+
+function sanitizeInput(str) {
+  if (typeof str !== 'string') return str;
+
+  let sanitized = str.replace(/[&<>"']/g, (char) => ({
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;'
+  }[char]));
+
+  sanitized = sanitized.replace(/(?:javascript|data|vbscript|expression|on\w+)\s*:/gi, '');
+  return sanitized.replace(/\x00/g, '');
+}
+
+function decodeHtmlEntities(str) {
+  if (typeof str !== 'string') return str;
+
+  const entityMap = {
+    amp: '&',
+    lt: '<',
+    gt: '>',
+    quot: '"',
+    apos: "'",
+    '#x27': "'",
+    '#x2F': '/',
+    '#x60': '`'
+  };
+
+  const decodeOnce = (input) =>
+    input.replace(/&(#x[0-9a-fA-F]+|#\d+|[a-zA-Z]+);/g, (match, code) => {
+      if (code[0] === '#') {
+        const isHex = code[1]?.toLowerCase() === 'x';
+        const num = isHex ? parseInt(code.slice(2), 16) : parseInt(code.slice(1), 10);
+        return Number.isNaN(num) ? match : String.fromCharCode(num);
+      }
+      const mapped = entityMap[code];
+      return mapped !== undefined ? mapped : match;
+    });
+
+  let output = str;
+  let decoded = decodeOnce(output);
+  while (decoded !== output) {
+    output = decoded;
+    decoded = decodeOnce(output);
+  }
+  return output;
+}
+
+function escapeHtml(str) {
+  if (typeof str !== 'string') return str;
+  return str.replace(/[&<>"']/g, (char) => ({
+    '&': '&amp;',
+    '<': '&lt;',
+    '>': '&gt;',
+    '"': '&quot;',
+    "'": '&#x27;'
+  }[char]));
+}
+
+function isSafePathSegment(name) {
+  return (
+    typeof name === 'string' &&
+    name.length > 0 &&
+    name.length <= 255 &&
+    !name.includes('..') &&
+    !/[/\\]/.test(name) &&
+    !/[\x00-\x1F]/.test(name)
+  );
+}
+
+function isFileExtensionSafe(filename) {
+  if (!filename || typeof filename !== 'string') return false;
+
+  const ext = path.extname(filename).toLowerCase();
+  const nameLower = filename.toLowerCase();
+  if (DANGEROUS_EXTENSIONS.includes(ext)) return false;
+  if (['.htaccess', '.htpasswd'].includes(nameLower)) return false;
+
+  return !DANGEROUS_EXTENSIONS.some((dangerExt) => nameLower.includes(`${dangerExt}.`));
+}
+
+module.exports = {
+  sanitizeInput,
+  decodeHtmlEntities,
+  escapeHtml,
+  isSafePathSegment,
+  isFileExtensionSafe
+};

backend/utils/logger.js

@@ -0,0 +1,137 @@
+const { AsyncLocalStorage } = require('async_hooks');
+const { randomUUID } = require('crypto');
+const pino = require('pino');
+
+const requestStorage = new AsyncLocalStorage();
+const SENSITIVE_KEY_PATTERN = /(authorization|cookie|password|passwd|secret|token|api[_-]?key|access[_-]?key)/i;
+const REQUEST_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+
+const logger = pino({
+  level: process.env.LOG_LEVEL || (process.env.NODE_ENV === 'production' ? 'info' : 'debug'),
+  base: {
+    service: 'wanwanyun-backend',
+    pid: process.pid
+  },
+  timestamp: pino.stdTimeFunctions.isoTime,
+  redact: {
+    paths: [
+      '*.authorization',
+      '*.cookie',
+      '*.password',
+      '*.token',
+      '*.refreshToken',
+      '*.access_key_secret',
+      '*.oss_access_key_secret',
+      '*.smtp_password',
+      'req.headers.authorization',
+      'req.headers.cookie'
+    ],
+    censor: '[REDACTED]'
+  }
+});
+
+function redactString(value) {
+  return value
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, 'Bearer [REDACTED]')
+    .replace(/\b(password|passwd|secret|token|api[_-]?key|access[_-]?key)\s*[:=]\s*[^\s,;&]+/gi, '$1=[REDACTED]');
+}
+
+function redactLogValue(value, depth = 0, seen = new WeakSet()) {
+  if (depth > 5) return '[MAX_DEPTH]';
+  if (typeof value === 'string') return redactString(value);
+  if (value === null || value === undefined || typeof value !== 'object') return value;
+  if (value instanceof Error) {
+    return {
+      type: value.name,
+      message: redactString(value.message || ''),
+      stack: redactString(value.stack || ''),
+      code: value.code
+    };
+  }
+  if (seen.has(value)) return '[CIRCULAR]';
+  seen.add(value);
+
+  if (Array.isArray(value)) {
+    return value.map((item) => redactLogValue(item, depth + 1, seen));
+  }
+
+  const result = {};
+  for (const [key, child] of Object.entries(value)) {
+    result[key] = SENSITIVE_KEY_PATTERN.test(key)
+      ? '[REDACTED]'
+      : redactLogValue(child, depth + 1, seen);
+  }
+  return result;
+}
+
+function getRequestContext() {
+  return requestStorage.getStore() || {};
+}
+
+function getRequestId(req) {
+  return req?.id || getRequestContext().requestId || null;
+}
+
+function normalizeRequestId(value) {
+  const candidate = Array.isArray(value) ? value[0] : value;
+  return typeof candidate === 'string' && REQUEST_ID_PATTERN.test(candidate)
+    ? candidate
+    : randomUUID();
+}
+
+function requestContextMiddleware(req, res, next) {
+  const requestId = normalizeRequestId(req.headers['x-request-id']);
+  const startedAt = process.hrtime.bigint();
+  req.id = requestId;
+  req.log = logger.child({ requestId });
+  res.setHeader('X-Request-ID', requestId);
+
+  requestStorage.run({ requestId }, () => {
+    res.once('finish', () => {
+      const durationMs = Number(process.hrtime.bigint() - startedAt) / 1e6;
+      const level = res.statusCode >= 500 ? 'error' : (res.statusCode >= 400 ? 'warn' : 'info');
+      req.log[level]({
+        method: req.method,
+        path: req.path,
+        statusCode: res.statusCode,
+        durationMs: Number(durationMs.toFixed(2))
+      }, 'request completed');
+    });
+    next();
+  });
+}
+
+let consoleBridgeInstalled = false;
+
+function installConsoleBridge() {
+  if (consoleBridgeInstalled) return;
+  if (process.env.NODE_ENV !== 'production' && process.env.LOG_FORMAT !== 'json') return;
+  consoleBridgeInstalled = true;
+
+  const levels = {
+    log: 'info',
+    info: 'info',
+    warn: 'warn',
+    error: 'error',
+    debug: 'debug'
+  };
+
+  for (const [consoleMethod, level] of Object.entries(levels)) {
+    console[consoleMethod] = (...args) => {
+      const values = redactLogValue(args);
+      const firstMessage = typeof values[0] === 'string' ? values[0] : 'console message';
+      logger[level]({
+        requestId: getRequestId(),
+        values
+      }, firstMessage);
+    };
+  }
+}
+
+module.exports = {
+  getRequestId,
+  installConsoleBridge,
+  logger,
+  redactLogValue,
+  requestContextMiddleware
+};

backend/utils/oss-log-parser.js

@@ -0,0 +1,115 @@
+const MONTHS = Object.freeze({
+  Jan: 0,
+  Feb: 1,
+  Mar: 2,
+  Apr: 3,
+  May: 4,
+  Jun: 5,
+  Jul: 6,
+  Aug: 7,
+  Sep: 8,
+  Oct: 9,
+  Nov: 10,
+  Dec: 11
+});
+
+function parseDownloadTrafficLogTime(line) {
+  if (!line || typeof line !== 'string') return null;
+
+  const match = line.match(/\[(\d{2})\/([A-Za-z]{3})\/(\d{4}):(\d{2}):(\d{2}):(\d{2})\s*([+-]\d{4})?\]/);
+  if (!match) return null;
+
+  const month = MONTHS[match[2]];
+  if (month === undefined) return null;
+
+  const year = Number(match[3]);
+  const day = Number(match[1]);
+  const hour = Number(match[4]);
+  const minute = Number(match[5]);
+  const second = Number(match[6]);
+  if ([year, day, hour, minute, second].some((value) => !Number.isFinite(value))) return null;
+
+  let utcMillis = Date.UTC(year, month, day, hour, minute, second);
+  const timezone = match[7];
+  if (timezone && /^[+-]\d{4}$/.test(timezone)) {
+    const sign = timezone[0] === '+' ? 1 : -1;
+    const timezoneHours = Number(timezone.slice(1, 3));
+    const timezoneMinutes = Number(timezone.slice(3, 5));
+    if (timezoneHours > 23 || timezoneMinutes > 59) return null;
+    utcMillis -= sign * ((timezoneHours * 60) + timezoneMinutes) * 60 * 1000;
+  }
+
+  const parsed = new Date(utcMillis);
+  if (Number.isNaN(parsed.getTime())) return null;
+
+  // Date.UTC normalizes impossible dates; reject them instead of charging the wrong day.
+  const offsetMinutes = timezone
+    ? (timezone[0] === '+' ? 1 : -1) * ((Number(timezone.slice(1, 3)) * 60) + Number(timezone.slice(3, 5)))
+    : 0;
+  const localDate = new Date(parsed.getTime() + (offsetMinutes * 60 * 1000));
+  if (
+    localDate.getUTCFullYear() !== year
+    || localDate.getUTCMonth() !== month
+    || localDate.getUTCDate() !== day
+    || localDate.getUTCHours() !== hour
+    || localDate.getUTCMinutes() !== minute
+    || localDate.getUTCSeconds() !== second
+  ) {
+    return null;
+  }
+
+  return parsed;
+}
+
+function parseDownloadTrafficLine(line, fallbackDate = new Date()) {
+  if (!line || typeof line !== 'string') return null;
+
+  const trimmed = line.trim();
+  if (!trimmed || !/\bGET\b/i.test(trimmed)) return null;
+
+  const statusMatch = trimmed.match(/"\s*(\d{3})\s+(\d+|-)\b/);
+  if (!statusMatch) return null;
+
+  const statusCode = Number(statusMatch[1]);
+  const bytesSent = statusMatch[2] === '-' ? 0 : Number(statusMatch[2]);
+  if (![200, 206].includes(statusCode) || !Number.isFinite(bytesSent) || bytesSent <= 0) return null;
+
+  let objectKey = null;
+  const requestMatch = trimmed.match(/"(?:GET|HEAD)\s+([^" ]+)\s+HTTP\//i);
+  if (requestMatch?.[1]) {
+    let requestPath = requestMatch[1];
+    const queryIndex = requestPath.indexOf('?');
+    if (queryIndex >= 0) requestPath = requestPath.slice(0, queryIndex);
+    requestPath = requestPath.replace(/^https?:\/\/[^/]+/i, '').replace(/^\/+/, '');
+    try {
+      requestPath = decodeURIComponent(requestPath);
+    } catch {
+      // Keep the raw path when the log contains malformed percent encoding.
+    }
+    objectKey = requestPath || null;
+  }
+
+  if (!objectKey) {
+    const keyMatch = trimmed.match(/\buser_(\d+)\/[^\s"]+/);
+    objectKey = keyMatch?.[0] || null;
+  }
+  if (!objectKey) return null;
+
+  const userMatch = objectKey.match(/(?:^|\/)user_(\d+)\//);
+  if (!userMatch) return null;
+
+  const userId = Number(userMatch[1]);
+  if (!Number.isSafeInteger(userId) || userId <= 0) return null;
+
+  return {
+    userId,
+    bytes: Math.floor(bytesSent),
+    objectKey,
+    eventAt: parseDownloadTrafficLogTime(trimmed) || fallbackDate
+  };
+}
+
+module.exports = {
+  parseDownloadTrafficLine,
+  parseDownloadTrafficLogTime
+};

backend/utils/path-safety.js

@@ -0,0 +1,34 @@
+const path = require('path');
+
+function isPathInside(parent, child) {
+  const relativePath = path.relative(parent, child);
+  return relativePath === '' || (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));
+}
+
+function normalizeVirtualPath(rawPath) {
+  if (typeof rawPath !== 'string') return null;
+
+  let decoded = rawPath;
+  try {
+    decoded = decodeURIComponent(rawPath);
+  } catch {
+    // The traversal checks below still apply to malformed encoded input.
+  }
+
+  if (decoded.includes('\x00') || decoded.toLowerCase().includes('%00')) return null;
+
+  const unifiedPath = decoded.replace(/\\/g, '/');
+  if (/(^|\/)\.\.(\/|$)/.test(unifiedPath)) return null;
+
+  let normalized = path.posix.normalize(unifiedPath);
+  if (normalized === '' || normalized === '.') normalized = '/';
+  if (!normalized.startsWith('/')) normalized = `/${normalized}`;
+
+  normalized = normalized.replace(/\/+$/g, '');
+  return normalized || '/';
+}
+
+module.exports = {
+  isPathInside,
+  normalizeVirtualPath
+};

backend/utils/share.js

@@ -0,0 +1,54 @@
+const { normalizeVirtualPath } = require('./path-safety');
+
+const SHARE_CODE_PATTERN = /^[A-Za-z0-9]{6,32}$/;
+
+function isValidShareCode(code) {
+  return typeof code === 'string' && SHARE_CODE_PATTERN.test(code);
+}
+
+function isPathWithinShare(requestPath, share) {
+  if (!requestPath || !share) return false;
+
+  const normalizedRequest = normalizeVirtualPath(requestPath);
+  const normalizedShare = normalizeVirtualPath(share.share_path);
+  if (!normalizedRequest || !normalizedShare) return false;
+
+  if (share.share_type === 'file') return normalizedRequest === normalizedShare;
+
+  const sharePrefix = normalizedShare.endsWith('/') ? normalizedShare : `${normalizedShare}/`;
+  return normalizedRequest === normalizedShare || normalizedRequest.startsWith(sharePrefix);
+}
+
+function parseShareIpWhitelist(rawValue) {
+  if (typeof rawValue !== 'string') return [];
+  return rawValue
+    .split(/[\s,;]+/)
+    .map((item) => item.trim())
+    .filter(Boolean)
+    .slice(0, 100);
+}
+
+function isShareIpAllowed(clientIp, whitelist = []) {
+  if (!Array.isArray(whitelist) || whitelist.length === 0) return true;
+  if (!clientIp) return false;
+
+  for (const rule of whitelist) {
+    const normalizedRule = String(rule || '').trim();
+    if (!normalizedRule) continue;
+    if (normalizedRule === clientIp) return true;
+
+    if (normalizedRule.endsWith('*')) {
+      const prefix = normalizedRule.slice(0, -1);
+      if (prefix && clientIp.startsWith(prefix)) return true;
+    }
+  }
+
+  return false;
+}
+
+module.exports = {
+  isPathWithinShare,
+  isShareIpAllowed,
+  isValidShareCode,
+  parseShareIpWhitelist
+};

backend/utils/storage-cache.js

@@ -53,21 +53,20 @@ class StorageUsageCache {
    */
   static async updateUsage(userId, deltaSize) {
     try {
-      // 使用 SQL 原子操作，避免并发问题
-      const result = UserDB.update(userId, {
-        // 使用原始 SQL，因为 update 方法不支持表达式
-        // 注意：这里需要在数据库层执行 UPDATE ... SET storage_used = storage_used + ?
-      });
+      const numericDelta = Number(deltaSize);
+      if (!Number.isFinite(numericDelta)) {
+        throw new Error('deltaSize 必须是有效数字');
+      }
 
-      // 直接执行 SQL 更新
+      // 直接执行 SQL 原子更新，并保证不小于 0
       const { db } = require('../database');
       db.prepare(`
         UPDATE users
-        SET storage_used = storage_used + ?
+        SET storage_used = MAX(COALESCE(storage_used, 0) + ?, 0)
         WHERE id = ?
-      `).run(deltaSize, userId);
+      `).run(numericDelta, userId);
 
-      console.log(`[存储缓存] 用户 ${userId} 存储变化: ${deltaSize > 0 ? '+' : ''}${deltaSize} 字节`);
+      console.log(`[存储缓存] 用户 ${userId} 存储变化: ${numericDelta > 0 ? '+' : ''}${numericDelta} 字节`);
       return true;
     } catch (error) {
       console.error('[存储缓存] 更新失败:', error);

backend/utils/url.js

@@ -0,0 +1,43 @@
+function sanitizeHttpBaseUrl(rawValue) {
+  if (!rawValue) return null;
+
+  try {
+    const url = new URL(rawValue);
+    if (!['http:', 'https:'].includes(url.protocol)) return null;
+
+    url.search = '';
+    url.hash = '';
+    url.pathname = url.pathname.replace(/\/+$/, '');
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
+function buildHttpDownloadUrl(rawBaseUrl, filePath) {
+  const baseUrl = sanitizeHttpBaseUrl(rawBaseUrl);
+  if (!baseUrl || !filePath) return null;
+
+  try {
+    const url = new URL(baseUrl);
+    const normalizedPath = filePath.startsWith('/') ? filePath : `/${filePath}`;
+    const safeSegments = normalizedPath
+      .split('/')
+      .filter(Boolean)
+      .map((segment) => encodeURIComponent(segment));
+    const safePath = safeSegments.length ? `/${safeSegments.join('/')}` : '';
+
+    const basePath = url.pathname.replace(/\/+$/, '');
+    url.pathname = `${basePath}${safePath || '/'}` || '/';
+    url.search = '';
+    url.hash = '';
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
+module.exports = {
+  buildHttpDownloadUrl,
+  sanitizeHttpBaseUrl
+};

backend/utils/version.js

@@ -0,0 +1,45 @@
+const SHA256_PATTERN = /^[a-f0-9]{64}$/;
+
+function normalizeVersion(rawVersion, fallback = '0.0.0') {
+  const value = String(rawVersion || '').trim();
+  return value || fallback;
+}
+
+function compareLooseVersion(left, right) {
+  const normalize = (value) => normalizeVersion(value, '0.0.0')
+    .replace(/^v/i, '')
+    .split('.')
+    .map((part) => parseInt(part, 10))
+    .map((num) => (Number.isFinite(num) ? num : 0));
+
+  const a = normalize(left);
+  const b = normalize(right);
+  const size = Math.max(a.length, b.length);
+  for (let i = 0; i < size; i += 1) {
+    const av = a[i] || 0;
+    const bv = b[i] || 0;
+    if (av > bv) return 1;
+    if (av < bv) return -1;
+  }
+  return 0;
+}
+
+function normalizeReleaseNotes(rawValue) {
+  return String(rawValue || '')
+    .replace(/\\r\\n/g, '\n')
+    .replace(/\\n/g, '\n')
+    .replace(/\\r/g, '\n')
+    .trim();
+}
+
+function normalizeSha256(rawValue) {
+  const digest = String(rawValue || '').trim().toLowerCase();
+  return SHA256_PATTERN.test(digest) ? digest : '';
+}
+
+module.exports = {
+  compareLooseVersion,
+  normalizeReleaseNotes,
+  normalizeSha256,
+  normalizeVersion
+};

design-qa.md

@@ -0,0 +1,8 @@
+# Design QA
+
+final result: passed
+
+- File workspace: verified at 1280x720 with a full-height drop target and unboxed icon layout.
+- Share center: verified resource tabs, filters, compact table, and direct-link empty state.
+- Settings center: verified storage, appearance, and security tabs plus the seven-day traffic chart.
+- Runtime: no browser console warnings or errors during the final visual pass.

desktop-client/.gitignore

@@ -0,0 +1,24 @@
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+pnpm-debug.log*
+lerna-debug.log*
+
+node_modules
+dist
+dist-ssr
+*.local
+
+# Editor directories and files
+.vscode/*
+!.vscode/extensions.json
+.idea
+.DS_Store
+*.suo
+*.ntvs*
+*.njsproj
+*.sln
+*.sw?

desktop-client/README.md

@@ -0,0 +1,118 @@
+# 玩玩云桌面客户端（Tauri + Vue + TypeScript）
+
+这是玩玩云网盘的桌面端，基于 `Tauri 2 + Vue 3 + TypeScript` 开发。
+
+默认对接地址：`https://cs.workyai.cn`。
+
+## 功能概览
+
+- 账号登录（复用网页端账号体系）
+- 文件列表浏览、目录切换、全局搜索
+- 新建文件夹、重命名、删除
+- 分享链接 / 直链创建与管理
+- 下载（支持断点续传）
+- 本地目录同步（手动/定时）
+- 客户端版本检测与更新下载
+
+## 环境要求
+
+- Node.js 18+（建议 20 LTS）
+- Rust stable（建议通过 `rustup` 安装）
+- Tauri CLI（项目已在 `package.json` 中声明）
+
+可选：Linux 交叉编译 Windows 时还需要：
+
+- `mingw-w64`
+- `nsis`
+
+## 开发运行
+
+```bash
+cd desktop-client
+npm install
+npm run tauri dev
+```
+
+## 对接你的网盘后端
+
+### 1. 修改 API 基础地址
+
+当前默认地址在 `desktop-client/src/App.vue`：
+
+- `appConfig.baseUrl`（默认 `https://cs.workyai.cn`）
+
+改成你的服务地址后重新运行/打包。
+
+### 2. 后端需提供的核心接口
+
+桌面端通过现有 Web API 工作，至少需要这些接口：
+
+- `POST /api/login`
+- `POST /api/logout`
+- `GET /api/user/profile`
+- `GET /api/files`
+- `GET /api/files/search`
+- `POST /api/files/mkdir`
+- `POST /api/files/rename`
+- `POST /api/files/delete`
+- `POST /api/share/create`
+- `GET /api/share/my`
+- `DELETE /api/share/:id`
+- `POST /api/direct-link/create`
+- `GET /api/client/desktop-update`
+- 分片上传相关接口（客户端走 `api_upload_file_resumable`）
+
+### 3. 鉴权与跨域要求
+
+- 使用 Cookie / Session 鉴权
+- 服务端允许桌面端跨域并携带凭据（credentials）
+- 建议启用 HTTPS
+
+## 构建打包
+
+```bash
+cd desktop-client
+npm install
+npm run tauri build
+```
+
+构建产物示例：
+
+- `desktop-client/src-tauri/target/release/bundle/nsis/*.exe`
+
+## Linux 交叉编译 Windows（x64）
+
+```bash
+cd desktop-client
+rustup target add x86_64-pc-windows-gnu
+npm run tauri build -- --target x86_64-pc-windows-gnu
+```
+
+如需生成安装包，请确保系统安装 `mingw-w64` 与 `nsis`。
+
+## 更新发布接入（与本项目后端配合）
+
+1. 把新安装包上传到服务端下载目录（示例：`frontend/downloads/`）。
+2. 在后台设置中更新：
+   - `desktop_update.latest_version`
+   - `desktop_update.installer_url`
+   - `desktop_update.release_notes`
+3. 客户端会通过 `GET /api/client/desktop-update` 检查更新并下载新包。
+
+## 常见问题
+
+### Q1：改了接口地址但还是连旧地址？
+
+确认修改的是 `desktop-client/src/App.vue` 中的 `appConfig.baseUrl`，并重新构建。
+
+### Q2：为什么更新接口返回有新版本，但客户端不弹更新？
+
+检查：
+
+- `latest_version` 是否确实大于客户端当前版本
+- `installer_url` 是否可访问
+- 客户端能否访问后端 `desktop-update` 接口
+
+### Q3：分享/直链重复创建问题
+
+当前后端已支持“同一用户同一路径复用已有链接”。若要生成新链接，请先删除旧链接再创建。

desktop-client/index.html

@@ -0,0 +1,14 @@
+<!doctype html>
+<html lang="zh-CN">
+  <head>
+    <meta charset="UTF-8" />
+    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+    <meta name="theme-color" content="#f7f9fc" />
+    <title>玩玩云 Desktop</title>
+  </head>
+
+  <body>
+    <div id="app"></div>
+    <script type="module" src="/src/main.ts"></script>
+  </body>
+</html>

desktop-client/package.json

@@ -0,0 +1,27 @@
+{
+  "name": "desktop-client",
+  "private": true,
+  "version": "0.1.38",
+  "type": "module",
+  "scripts": {
+    "dev": "vite",
+    "build": "vue-tsc --noEmit && vite build",
+    "preview": "vite preview",
+    "tauri": "tauri"
+  },
+  "dependencies": {
+    "@fontsource-variable/noto-sans-sc": "^5.3.0",
+    "@phosphor-icons/vue": "^2.2.1",
+    "@tauri-apps/api": "^2",
+    "@tauri-apps/plugin-dialog": "^2.6.0",
+    "@tauri-apps/plugin-opener": "^2",
+    "vue": "^3.5.13"
+  },
+  "devDependencies": {
+    "@tauri-apps/cli": "^2",
+    "@vitejs/plugin-vue": "^5.2.1",
+    "typescript": "~5.6.2",
+    "vite": "^6.0.3",
+    "vue-tsc": "^2.1.10"
+  }
+}

desktop-client/public/tauri.svg

@@ -0,0 +1,6 @@
+<svg width="206" height="231" viewBox="0 0 206 231" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M143.143 84C143.143 96.1503 133.293 106 121.143 106C108.992 106 99.1426 96.1503 99.1426 84C99.1426 71.8497 108.992 62 121.143 62C133.293 62 143.143 71.8497 143.143 84Z" fill="#FFC131"/>
+<ellipse cx="84.1426" cy="147" rx="22" ry="22" transform="rotate(180 84.1426 147)" fill="#24C8DB"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M166.738 154.548C157.86 160.286 148.023 164.269 137.757 166.341C139.858 160.282 141 153.774 141 147C141 144.543 140.85 142.121 140.558 139.743C144.975 138.204 149.215 136.139 153.183 133.575C162.73 127.404 170.292 118.608 174.961 108.244C179.63 97.8797 181.207 86.3876 179.502 75.1487C177.798 63.9098 172.884 53.4021 165.352 44.8883C157.82 36.3744 147.99 30.2165 137.042 27.1546C126.095 24.0926 114.496 24.2568 103.64 27.6274C92.7839 30.998 83.1319 37.4317 75.8437 46.1553C74.9102 47.2727 74.0206 48.4216 73.176 49.5993C61.9292 50.8488 51.0363 54.0318 40.9629 58.9556C44.2417 48.4586 49.5653 38.6591 56.679 30.1442C67.0505 17.7298 80.7861 8.57426 96.2354 3.77762C111.685 -1.01901 128.19 -1.25267 143.769 3.10474C159.348 7.46215 173.337 16.2252 184.056 28.3411C194.775 40.457 201.767 55.4101 204.193 71.404C206.619 87.3978 204.374 103.752 197.73 118.501C191.086 133.25 180.324 145.767 166.738 154.548ZM41.9631 74.275L62.5557 76.8042C63.0459 72.813 63.9401 68.9018 65.2138 65.1274C57.0465 67.0016 49.2088 70.087 41.9631 74.275Z" fill="#FFC131"/>
+<path fill-rule="evenodd" clip-rule="evenodd" d="M38.4045 76.4519C47.3493 70.6709 57.2677 66.6712 67.6171 64.6132C65.2774 70.9669 64 77.8343 64 85.0001C64 87.1434 64.1143 89.26 64.3371 91.3442C60.0093 92.8732 55.8533 94.9092 51.9599 97.4256C42.4128 103.596 34.8505 112.392 30.1816 122.756C25.5126 133.12 23.9357 144.612 25.6403 155.851C27.3449 167.09 32.2584 177.598 39.7906 186.112C47.3227 194.626 57.153 200.784 68.1003 203.846C79.0476 206.907 90.6462 206.743 101.502 203.373C112.359 200.002 122.011 193.568 129.299 184.845C130.237 183.722 131.131 182.567 131.979 181.383C143.235 180.114 154.132 176.91 164.205 171.962C160.929 182.49 155.596 192.319 148.464 200.856C138.092 213.27 124.357 222.426 108.907 227.222C93.458 232.019 76.9524 232.253 61.3736 227.895C45.7948 223.538 31.8055 214.775 21.0867 202.659C10.3679 190.543 3.37557 175.59 0.949823 159.596C-1.47592 143.602 0.768139 127.248 7.41237 112.499C14.0566 97.7497 24.8183 85.2327 38.4045 76.4519ZM163.062 156.711L163.062 156.711C162.954 156.773 162.846 156.835 162.738 156.897C162.846 156.835 162.954 156.773 163.062 156.711Z" fill="#24C8DB"/>
+</svg>

desktop-client/public/vite.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" aria-hidden="true" role="img" class="iconify iconify--logos" width="31.88" height="32" preserveAspectRatio="xMidYMid meet" viewBox="0 0 256 257"><defs><linearGradient id="IconifyId1813088fe1fbc01fb466" x1="-.828%" x2="57.636%" y1="7.652%" y2="78.411%"><stop offset="0%" stop-color="#41D1FF"></stop><stop offset="100%" stop-color="#BD34FE"></stop></linearGradient><linearGradient id="IconifyId1813088fe1fbc01fb467" x1="43.376%" x2="50.316%" y1="2.242%" y2="89.03%"><stop offset="0%" stop-color="#FFEA83"></stop><stop offset="8.333%" stop-color="#FFDD35"></stop><stop offset="100%" stop-color="#FFA800"></stop></linearGradient></defs><path fill="url(#IconifyId1813088fe1fbc01fb466)" d="M255.153 37.938L134.897 252.976c-2.483 4.44-8.862 4.466-11.382.048L.875 37.958c-2.746-4.814 1.371-10.646 6.827-9.67l120.385 21.517a6.537 6.537 0 0 0 2.322-.004l117.867-21.483c5.438-.991 9.574 4.796 6.877 9.62Z"></path><path fill="url(#IconifyId1813088fe1fbc01fb467)" d="M185.432.063L96.44 17.501a3.268 3.268 0 0 0-2.634 3.014l-5.474 92.456a3.268 3.268 0 0 0 3.997 3.378l24.777-5.718c2.318-.535 4.413 1.507 3.936 3.838l-7.361 36.047c-.495 2.426 1.782 4.5 4.151 3.78l15.304-4.649c2.372-.72 4.652 1.36 4.15 3.788l-11.698 56.621c-.732 3.542 3.979 5.473 5.943 2.437l1.313-2.028l72.516-144.72c1.215-2.423-.88-5.186-3.54-4.672l-25.505 4.922c-2.396.462-4.435-1.77-3.759-4.114l16.646-57.705c.677-2.35-1.37-4.583-3.769-4.113Z"></path></svg>

desktop-client/src-tauri/.gitignore

@@ -0,0 +1,7 @@
+# Generated by Cargo
+# will have compiled files and executables
+/target/
+
+# Generated by Tauri
+# will have schema files for capabilities auto-completion
+/gen/schemas

desktop-client/src-tauri/Cargo.toml

@@ -0,0 +1,34 @@
+[package]
+name = "desktop-client"
+version = "0.1.38"
+description = "A Tauri App"
+authors = ["you"]
+edition = "2021"
+
+# See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
+
+[lib]
+# The `_lib` suffix may seem redundant but it is necessary
+# to make the lib name unique and wouldn't conflict with the bin name.
+# This seems to be only an issue on Windows, see https://github.com/rust-lang/cargo/issues/8519
+name = "desktop_client_lib"
+crate-type = ["staticlib", "cdylib", "rlib"]
+
+[build-dependencies]
+tauri-build = { version = "2", features = [] }
+
+[dependencies]
+tauri = { version = "2", features = [] }
+tauri-plugin-opener = "2"
+tauri-plugin-dialog = "2"
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
+sha2 = "0.10"
+tokio = { version = "1", features = ["time"] }
+reqwest = { version = "0.12", default-features = false, features = ["json", "cookies", "multipart", "stream", "rustls-tls"] }
+urlencoding = "2.1"
+walkdir = "2.5"
+rusqlite = { version = "0.31", features = ["bundled"] }
+
+[target.'cfg(target_os = "windows")'.dependencies]
+windows-sys = { version = "0.59", features = ["Win32_Foundation", "Win32_Security_Cryptography"] }

desktop-client/src-tauri/build.rs

@@ -0,0 +1,3 @@
+fn main() {
+    tauri_build::build()
+}

desktop-client/src-tauri/capabilities/default.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "../gen/schemas/desktop-schema.json",
+  "identifier": "default",
+  "description": "Capability for the main window",
+  "windows": ["main"],
+  "permissions": [
+    "core:default",
+    "opener:default",
+    "dialog:default"
+  ]
+}

desktop-client/src-tauri/icons/android/mipmap-anydpi-v26/ic_launcher.xml

@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="utf-8"?>
+<adaptive-icon xmlns:android="http://schemas.android.com/apk/res/android">
+  <foreground android:drawable="@mipmap/ic_launcher_foreground"/>
+  <background android:drawable="@color/ic_launcher_background"/>
+</adaptive-icon>

desktop-client/src-tauri/icons/android/values/ic_launcher_background.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+  <color name="ic_launcher_background">#fff</color>
+</resources>