fix

internal/biz/api_token.go

@@ -41,9 +41,6 @@ func (uc *SettingsUsecase) PrepareAPIToken(ctx context.Context, userID, authorit
 	if days == -1 {
 		duration = 100 * 365 * 24 * time.Hour
 	}
-	if duration <= 0 {
-		return nil, 0, errors.New("有效天数必须大于0或为-1")
-	}
 	return user, duration, nil
 }
 

internal/biz/data_scope.go

@@ -4,8 +4,15 @@ import "context"
 
 type DataScope struct {
 	All           bool
+	Scope         int
+	UserID        uint
+	AuthorityID   uint
+	PrimaryDeptID uint
 	OwnerUserID   uint
 	DepartmentIDs []uint
+	RequestID     string
+	Method        string
+	Path          string
 }
 
 type dataScopeKey struct{}

internal/biz/email.go

@@ -16,23 +16,8 @@ type EmailUsecase struct{ repo EmailRepo }
 
 func NewEmailUsecase(repo EmailRepo) *EmailUsecase { return &EmailUsecase{repo: repo} }
 
-func splitRecipients(value string) []string {
-	parts := strings.Split(value, ",")
-	result := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if recipient := strings.TrimSpace(part); recipient != "" {
-			result = append(result, recipient)
-		}
-	}
-	return result
-}
-
 func (uc *EmailUsecase) Send(ctx context.Context, to, subject, body string) error {
-	recipients := splitRecipients(to)
-	if len(recipients) == 0 || subject == "" {
-		return errors.New("收件人和邮件标题不能为空")
-	}
-	return uc.repo.Send(ctx, recipients, subject, body)
+	return uc.repo.Send(ctx, strings.Split(to, ","), subject, body)
 }
 
 func (uc *EmailUsecase) Test(ctx context.Context) error {

internal/biz/media.go

@@ -1,11 +1,13 @@
 package biz
 
 import (
+	"bufio"
 	"context"
 	"crypto/md5"
 	"encoding/hex"
 	"errors"
 	"io"
+	"net/http"
 	"path/filepath"
 	"strings"
 	"time"
@@ -50,9 +52,13 @@ func (uc *MediaUsecase) Upload(ctx context.Context, userID uint, name, mime stri
 		return nil, err
 	}
 	ext := strings.ToLower(filepath.Ext(name))
+	buffered := bufio.NewReader(reader)
+	if header, _ := buffered.Peek(512); len(header) > 0 {
+		mime = http.DetectContentType(header)
+	}
 	key := time.Now().Format("20060102") + "/" + uuid.NewString() + ext
 	hash := md5.New()
-	stored, err := uc.files.Put(ctx, key, io.TeeReader(reader, hash))
+	stored, err := uc.files.Put(ctx, key, io.TeeReader(buffered, hash))
 	if err != nil {
 		return nil, err
 	}

internal/biz/security.go

@@ -34,9 +34,6 @@ type SecurityRepo interface {
 }
 
 func (uc *SettingsUsecase) UpdateSecurity(ctx context.Context, value *SecurityConfig) error {
-	if value.KeyLong < 1 || value.ImgWidth < 1 || value.ImgHeight < 1 || value.PwdMinLength < 1 || value.LimitWindow < 1 || value.LimitCount < 1 || value.LockThreshold < 1 || value.LockDuration < 1 || value.PwdExpireDays < 1 {
-		return errors.New("安全配置数值必须大于0")
-	}
 	return uc.SaveSecurityConfig(ctx, value)
 }
 

internal/conf/conf.proto

@@ -1,10 +1,10 @@
 syntax = "proto3";
 package kratos.api;
 
-option go_package = "kra/internal/conf;conf";
-
 import "google/protobuf/duration.proto";
 
+option go_package = "kra/internal/conf;conf";
+
 message Bootstrap {
   Server server = 1;
   Data data = 2;
@@ -33,16 +33,48 @@ message Data {
     string path = 9;
     string alias_name = 10;
     bool disable = 11;
+    string prefix = 12;
+    string engine = 13;
+    string log_mode = 14;
+    int32 max_idle_conns = 15;
+    int32 max_open_conns = 16;
+    int32 conn_max_lifetime = 17;
+    bool singular = 18;
   }
   message Redis {
     string network = 1;
     string addr = 2;
     google.protobuf.Duration read_timeout = 3;
     google.protobuf.Duration write_timeout = 4;
+    string name = 5;
+    string password = 6;
+    int32 db = 7;
+    bool use_cluster = 8;
+    repeated string cluster_addrs = 9;
+  }
+  message MongoHost {
+    string host = 1;
+    string port = 2;
+  }
+  message Mongo {
+    string coll = 1;
+    string options = 2;
+    string database = 3;
+    string username = 4;
+    string password = 5;
+    string auth_source = 6;
+    uint64 min_pool_size = 7;
+    uint64 max_pool_size = 8;
+    int64 socket_timeout_ms = 9;
+    int64 connect_timeout_ms = 10;
+    bool is_zap = 11;
+    repeated MongoHost hosts = 12;
   }
   Database database = 1;
   Redis redis = 2;
   repeated Database database_list = 3;
+  repeated Redis redis_list = 4;
+  Mongo mongo = 5;
 }
 
 // AdminBackend contains settings for the administration HTTP transport.
@@ -58,6 +90,9 @@ message AdminBackend {
   Media media = 8;
   repeated Disk disk_list = 9;
   System system = 10;
+  Zap zap = 11;
+  CORS cors = 12;
+  App app = 13;
 
   message JWT {
     string signing_key = 1;
@@ -102,6 +137,41 @@ message AdminBackend {
     bool use_multipoint = 2;
     bool use_strict_auth = 3;
     bool disable_auto_migrate = 4;
+    bool use_mongo = 5;
+  }
+
+  message Zap {
+    string level = 1;
+    string prefix = 2;
+    string format = 3;
+    string director = 4;
+    string encode_level = 5;
+    string stacktrace_key = 6;
+    bool show_line = 7;
+    bool log_in_console = 8;
+    int32 retention_day = 9;
+    bool access_req_body = 10;
+    bool access_resp_data = 11;
+    bool access_req_headers = 12;
+    int32 access_log_max_bytes = 13;
+    repeated string file_only_modules = 14;
+  }
+
+  message CORS {
+    string mode = 1;
+    repeated CORSRule whitelist = 2;
+  }
+  message CORSRule {
+    string allow_origin = 1;
+    string allow_methods = 2;
+    string allow_headers = 3;
+    string expose_headers = 4;
+    bool allow_credentials = 5;
+  }
+  message App {
+    string node = 1;
+    string app_id = 2;
+    string env = 3;
   }
 
   message Storage {

internal/data/api.go

@@ -19,10 +19,10 @@ type apiPO struct {
 	CreatedAt   time.Time
 	UpdatedAt   time.Time
 	DeletedAt   gorm.DeletedAt `gorm:"index"`
-	Path        string         `gorm:"uniqueIndex:idx_api_path_method"`
+	Path        string
 	Description string
 	APIGroup    string `gorm:"column:api_group"`
-	Method      string `gorm:"uniqueIndex:idx_api_path_method"`
+	Method      string
 }
 
 func (apiPO) TableName() string { return "sys_apis" }

internal/data/api_token.go

@@ -17,7 +17,7 @@ type apiTokenPO struct {
 	DeletedAt   gorm.DeletedAt `gorm:"index"`
 	UserID      uint
 	AuthorityID uint
-	Token       string `gorm:"type:text;uniqueIndex"`
+	Token       string `gorm:"type:text"`
 	Status      bool
 	ExpiresAt   time.Time
 	Remark      string

internal/data/authority.go

@@ -318,53 +318,52 @@ func (r *accessRepo) DataScopeDepartmentIDs(ctx context.Context, id uint) ([]uin
 	return ids, err
 }
 func (r *accessRepo) ResolveDataScope(ctx context.Context, authorityID, userID uint) (biz.DataScope, error) {
-	if authorityID == 888 {
-		return biz.DataScope{All: true}, nil
-	}
+	identity := biz.DataScope{UserID: userID, AuthorityID: authorityID}
+	var user userPO
+	_ = r.data.gormDB.WithContext(ctx).Select("id", "dept_id").First(&user, userID).Error
+	identity.PrimaryDeptID = user.DeptID
 	var authority authorityPO
-	if err := r.data.gormDB.WithContext(ctx).First(&authority, "authority_id = ?", authorityID).Error; err != nil {
-		return biz.DataScope{}, err
+	_ = r.data.gormDB.WithContext(ctx).Select("authority_id", "data_scope").First(&authority, "authority_id = ?", authorityID).Error
+	identity.Scope = authority.DataScope
+	if identity.Scope == 0 {
+		identity.Scope = 1
 	}
-	if authority.DataScope == 1 {
-		return biz.DataScope{All: true}, nil
-	}
-	if authority.DataScope == 4 {
-		return biz.DataScope{OwnerUserID: userID}, nil
+	identity.All = identity.Scope == 1
+	if identity.Scope == 4 {
+		identity.OwnerUserID = userID
 	}
 	var ids []uint
-	if authority.DataScope == 5 {
-		var err error
-		ids, err = r.DataScopeDepartmentIDs(ctx, authorityID)
-		if err != nil {
-			return biz.DataScope{}, err
-		}
-	} else {
-		if err := r.data.gormDB.WithContext(ctx).Model(&userDepartmentPO{}).Where("sys_user_id = ?", userID).Pluck("sys_department_id", &ids).Error; err != nil {
-			return biz.DataScope{}, err
-		}
-		if authority.DataScope == 2 && len(ids) > 0 {
-			var departments []departmentPO
-			if err := r.data.gormDB.WithContext(ctx).Find(&departments).Error; err != nil {
-				return biz.DataScope{}, err
-			}
-			selected := make(map[uint]bool, len(ids))
-			for _, id := range ids {
-				selected[id] = true
-			}
-			for _, department := range departments {
-				for _, part := range strings.Split(department.Ancestors, ",") {
-					value, _ := strconv.ParseUint(part, 10, 64)
-					if selected[uint(value)] {
-						selected[department.ID] = true
-						break
-					}
+	_ = r.data.gormDB.WithContext(ctx).Model(&userDepartmentPO{}).Where("sys_user_id = ?", userID).Pluck("sys_department_id", &ids).Error
+	selected := make(map[uint]bool, len(ids)+1)
+	for _, id := range ids {
+		selected[id] = true
+	}
+	if user.DeptID != 0 {
+		selected[user.DeptID] = true
+	}
+	ids = ids[:0]
+	for id := range selected {
+		ids = append(ids, id)
+	}
+	if identity.Scope == 2 && len(ids) > 0 {
+		var departments []departmentPO
+		_ = r.data.gormDB.WithContext(ctx).Find(&departments).Error
+		for _, department := range departments {
+			for _, part := range strings.Split(department.Ancestors, ",") {
+				value, _ := strconv.ParseUint(part, 10, 64)
+				if selected[uint(value)] {
+					selected[department.ID] = true
+					break
 				}
 			}
-			ids = ids[:0]
-			for id := range selected {
-				ids = append(ids, id)
-			}
 		}
+		ids = ids[:0]
+		for id := range selected {
+			ids = append(ids, id)
+		}
+	} else if identity.Scope == 5 {
+		ids, _ = r.DataScopeDepartmentIDs(ctx, authorityID)
 	}
-	return biz.DataScope{DepartmentIDs: ids}, nil
+	identity.DepartmentIDs = ids
+	return identity, nil
 }

internal/data/cache.go

@@ -28,7 +28,7 @@ func NewCache(data *Data) biz.Cache {
 	return &cacheStore{data: data, memory: make(map[string]memoryCacheEntry)}
 }
 
-func (s *cacheStore) client() *redis.Client {
+func (s *cacheStore) client() redis.UniversalClient {
 	return s.data.redis.load()
 }
 

internal/data/config_store.go

@@ -160,6 +160,14 @@ func (d *Data) reloadConfig(ctx context.Context) error {
 	}
 	useRedis := next.Admin.System != nil && next.Admin.System.UseRedis
 	candidateRedis := openRedis(next.Data.Redis, useRedis)
+	useMongo := next.Admin.System != nil && next.Admin.System.UseMongo
+	candidateMongo, mongoErr := openMongo(next.Data.Mongo, useMongo)
+	mongoAccepted := false
+	defer func() {
+		if !mongoAccepted && candidateMongo != nil {
+			_ = candidateMongo.Disconnect(context.Background())
+		}
+	}()
 	candidateDBList, err := openDatabaseList(next.Data.DatabaseList)
 	if err != nil {
 		return err
@@ -168,6 +176,10 @@ func (d *Data) reloadConfig(ctx context.Context) error {
 	d.gormDB.replace(candidateDB)
 	d.replaceDatabaseList(candidateDBList)
 	d.redis.replace(candidateRedis)
+	if mongoErr == nil {
+		d.mongo.replace(candidateMongo)
+		mongoAccepted = true
+	}
 	d.runtime.Replace(next.Data, next.Admin)
 	if d.storage != nil {
 		d.storage.replace(candidateStorage)

internal/data/data.go

@@ -20,6 +20,7 @@ type Data struct {
 	configMu sync.Mutex
 	gormDB   *reloadableDB
 	redis    *reloadableRedis
+	mongo    *reloadableMongo
 	runtime  *conf.Runtime
 	storage  *reloadableStorage
 	dbListMu sync.RWMutex
@@ -41,6 +42,7 @@ func openDatabaseList(configs []*conf.Data_Database) (map[string]*gorm.DB, error
 			}
 			return nil, fmt.Errorf("open database %q: %w", config.AliasName, err)
 		}
+		registerDataScopeCallbacks(db)
 		items[config.AliasName] = db
 	}
 	return items, nil
@@ -108,28 +110,45 @@ func NewData(runtime *conf.Runtime) (*Data, func(), error) {
 	}
 	useRedis := admin != nil && admin.System != nil && admin.System.UseRedis
 	d.redis = newReloadableRedis(openRedis(c.Redis, useRedis))
+	useMongo := admin != nil && admin.System != nil && admin.System.UseMongo
+	mongoClient, err := openMongo(c.Mongo, useMongo)
+	if err != nil {
+		log.Printf("mongo unavailable: %v", err)
+		mongoClient = nil
+	}
+	d.mongo = newReloadableMongo(mongoClient)
 	stopConfigWatcher := d.watchConfig()
 	cleanup := func() {
 		stopConfigWatcher()
 		d.gormDB.close()
 		closeDatabaseList(d.dbList)
 		d.redis.close()
+		d.mongo.close()
 	}
 	return d, cleanup, nil
 }
 
-func openRedis(config *conf.Data_Redis, enabled bool) *redis.Client {
-	if !enabled || config == nil || config.Addr == "" {
+func openRedis(config *conf.Data_Redis, enabled bool) redis.UniversalClient {
+	if !enabled || config == nil || (config.Addr == "" && len(config.ClusterAddrs) == 0) {
 		return nil
 	}
-	options := &redis.Options{Addr: config.Addr, Network: config.Network}
-	if config.ReadTimeout != nil {
-		options.ReadTimeout = config.ReadTimeout.AsDuration()
+	var candidate redis.UniversalClient
+	if config.UseCluster {
+		addresses := config.ClusterAddrs
+		if len(addresses) == 0 && config.Addr != "" {
+			addresses = []string{config.Addr}
+		}
+		candidate = redis.NewClusterClient(&redis.ClusterOptions{Addrs: addresses, Password: config.Password})
+	} else {
+		options := &redis.Options{Addr: config.Addr, Network: config.Network, Password: config.Password, DB: int(config.Db)}
+		if config.ReadTimeout != nil {
+			options.ReadTimeout = config.ReadTimeout.AsDuration()
+		}
+		if config.WriteTimeout != nil {
+			options.WriteTimeout = config.WriteTimeout.AsDuration()
+		}
+		candidate = redis.NewClient(options)
 	}
-	if config.WriteTimeout != nil {
-		options.WriteTimeout = config.WriteTimeout.AsDuration()
-	}
-	candidate := redis.NewClient(options)
 	pingCtx, cancel := context.WithTimeout(context.Background(), 800*time.Millisecond)
 	defer cancel()
 	if err := candidate.Ping(pingCtx).Err(); err != nil {

internal/data/data_scope.go

@@ -0,0 +1,230 @@
+package data
+
+import (
+	"database/sql"
+	"log"
+	"reflect"
+	"strings"
+
+	"kra/internal/biz"
+
+	"gorm.io/gorm"
+	"gorm.io/gorm/clause"
+	"gorm.io/gorm/schema"
+)
+
+// registerDataScopeCallbacks installs the global GORM data-scope engine.
+// System tables are deliberately excluded: their access is controlled by
+// Casbin, while ownership columns on business tables are row-level scope.
+func registerDataScopeCallbacks(db *gorm.DB) {
+	if db == nil {
+		return
+	}
+	q := db.Callback().Query()
+	if q.Get("data_scope:query") == nil {
+		_ = q.Before("gorm:query").Register("data_scope:query", applyDataScope("query"))
+	}
+	u := db.Callback().Update()
+	if u.Get("data_scope:update") == nil {
+		_ = u.Before("gorm:update").Register("data_scope:update", applyDataScope("update"))
+		_ = u.Before("gorm:update").Register("data_scope:stamp_update", stampUpdatedBy)
+		_ = u.After("gorm:update").Register("data_scope:audit_update", auditBlockedWrite("update"))
+	}
+	d := db.Callback().Delete()
+	if d.Get("data_scope:delete") == nil {
+		_ = d.Before("gorm:delete").Register("data_scope:delete", applyDataScope("delete"))
+		_ = d.Before("gorm:delete").After("data_scope:delete").Register("data_scope:stamp_delete", stampDeletedBy)
+		_ = d.After("gorm:delete").Register("data_scope:audit_delete", auditBlockedWrite("delete"))
+	}
+	c := db.Callback().Create()
+	if c.Get("data_scope:stamp") == nil {
+		_ = c.Before("gorm:create").Register("data_scope:stamp", stampOwnership)
+	}
+}
+
+func hasScopeField(db *gorm.DB, name string) bool {
+	return db.Statement.Schema != nil && db.Statement.Schema.LookUpField(name) != nil
+}
+
+func isControlledTable(db *gorm.DB) bool {
+	return db.Statement.Schema != nil && !strings.HasPrefix(db.Statement.Table, "sys_") && (hasScopeField(db, "dept_id") || hasScopeField(db, "created_by"))
+}
+
+func applyDataScope(operation string) func(*gorm.DB) {
+	return func(db *gorm.DB) {
+		if !isControlledTable(db) {
+			return
+		}
+		if _, done := db.Statement.Clauses["data_scope:applied"]; done {
+			return
+		}
+		if skip, ok := db.Get("data_scope:skip"); ok {
+			if value, _ := skip.(bool); value {
+				return
+			}
+		}
+		scope, ok := biz.DataScopeFromContext(db.Statement.Context)
+		if !ok {
+			log.Printf("数据权限: 业务表[%s]访问无身份上下文, 已放行(待补 ctx / 或使用系统上下文)", db.Statement.Table)
+			recordDataScopeEvent(db, "no_identity", operation, "无身份上下文访问受控表, 已放行", biz.DataScope{})
+			return
+		}
+		if (operation == "update" || operation == "delete") && !db.AllowGlobalUpdate && !hasWriteConditions(db) {
+			return
+		}
+		db.Statement.Clauses["data_scope:applied"] = clause.Clause{}
+		if scope.All {
+			return
+		}
+		table := db.Statement.Table
+		if scope.OwnerUserID != 0 && hasScopeField(db, "created_by") {
+			db.Where(table+".created_by = ?", scope.OwnerUserID)
+			return
+		}
+		if hasScopeField(db, "dept_id") {
+			ids := scope.DepartmentIDs
+			if len(ids) == 0 {
+				ids = []uint{0}
+			}
+			db.Where(table+".dept_id IN ?", ids)
+		}
+	}
+}
+
+func recordDataScopeEvent(db *gorm.DB, eventType, operation, detail string, scope biz.DataScope) {
+	record := &dataAccessLogPO{EventType: eventType, TargetTable: db.Statement.Table, Operation: operation, UserID: scope.UserID, AuthorityID: scope.AuthorityID, Scope: scope.Scope, RequestID: scope.RequestID, Method: scope.Method, Path: scope.Path, Detail: detail}
+	_ = db.Session(&gorm.Session{NewDB: true, SkipHooks: true}).Create(record).Error
+}
+
+func auditBlockedWrite(operation string) func(*gorm.DB) {
+	return func(db *gorm.DB) {
+		if _, applied := db.Statement.Clauses["data_scope:applied"]; !applied || db.Error != nil || db.RowsAffected != 0 {
+			return
+		}
+		if scope, ok := biz.DataScopeFromContext(db.Statement.Context); ok && !scope.All {
+			recordDataScopeEvent(db, "blocked_write", operation, "数据范围过滤后写操作影响 0 行(疑似越权尝试)", scope)
+		}
+	}
+}
+
+func stampOwnership(db *gorm.DB) {
+	if !isControlledTable(db) {
+		return
+	}
+	scope, ok := biz.DataScopeFromContext(db.Statement.Context)
+	if !ok {
+		return
+	}
+	if hasScopeField(db, "created_by") && scope.UserID != 0 {
+		db.Statement.SetColumn("created_by", scope.UserID, true)
+	}
+	if hasScopeField(db, "dept_id") && scope.PrimaryDeptID != 0 {
+		db.Statement.SetColumn("dept_id", scope.PrimaryDeptID, true)
+	}
+}
+
+func stampUpdatedBy(db *gorm.DB) {
+	stmt := db.Statement
+	if !isControlledTable(db) || stmt.SkipHooks || !hasScopeField(db, "updated_by") {
+		return
+	}
+	scope, ok := biz.DataScopeFromContext(db.Statement.Context)
+	if !ok || scope.UserID == 0 {
+		return
+	}
+	if _, isMap := stmt.Dest.(map[string]interface{}); !isMap {
+		if _, isMaps := stmt.Dest.([]map[string]interface{}); !isMaps && stmt.ReflectValue.Kind() == reflect.Struct && !stmt.ReflectValue.CanAddr() {
+			return
+		}
+	}
+	for _, omitted := range stmt.Omits {
+		if omitted == "updated_by" {
+			return
+		}
+	}
+	if len(stmt.Selects) > 0 {
+		found := false
+		for _, selected := range stmt.Selects {
+			if selected == "updated_by" || selected == "*" {
+				found = true
+				break
+			}
+		}
+		if !found {
+			stmt.Selects = append(stmt.Selects, "updated_by")
+		}
+	}
+	stmt.SetColumn("updated_by", scope.UserID, true)
+}
+
+func stampDeletedBy(db *gorm.DB) {
+	stmt := db.Statement
+	if db.Error != nil || !isControlledTable(db) || stmt.SQL.Len() != 0 || stmt.Unscoped || !hasScopeField(db, "deleted_by") {
+		return
+	}
+	deletedAtType := reflect.TypeOf(gorm.DeletedAt{})
+	var deletedAt *schema.Field
+	for _, field := range stmt.Schema.Fields {
+		if field.FieldType == deletedAtType || field.IndirectFieldType == deletedAtType {
+			deletedAt = field
+			break
+		}
+	}
+	if deletedAt == nil {
+		return
+	}
+	if _, customZero := deletedAt.TagSettings["ZEROVALUE"]; customZero {
+		return
+	}
+	scope, ok := biz.DataScopeFromContext(stmt.Context)
+	if !ok || scope.UserID == 0 {
+		return
+	}
+	var primaryExpressions []clause.Expression
+	_, queryValues := schema.GetIdentityFieldValuesMap(stmt.Context, stmt.ReflectValue, stmt.Schema.PrimaryFields)
+	column, values := schema.ToQueryValues(stmt.Table, stmt.Schema.PrimaryFieldDBNames, queryValues)
+	if len(values) > 0 {
+		primaryExpressions = append(primaryExpressions, clause.IN{Column: column, Values: values})
+	}
+	if stmt.ReflectValue.CanAddr() && stmt.Dest != stmt.Model && stmt.Model != nil {
+		_, queryValues = schema.GetIdentityFieldValuesMap(stmt.Context, reflect.ValueOf(stmt.Model), stmt.Schema.PrimaryFields)
+		column, values = schema.ToQueryValues(stmt.Table, stmt.Schema.PrimaryFieldDBNames, queryValues)
+		if len(values) > 0 {
+			primaryExpressions = append(primaryExpressions, clause.IN{Column: column, Values: values})
+		}
+	}
+	if _, hasWhere := stmt.Clauses["WHERE"]; !hasWhere && len(primaryExpressions) == 0 && !db.AllowGlobalUpdate {
+		return
+	}
+	now := db.NowFunc()
+	stmt.AddClause(clause.Set{{Column: clause.Column{Name: deletedAt.DBName}, Value: now}, {Column: clause.Column{Name: "deleted_by"}, Value: scope.UserID}})
+	stmt.SetColumn(deletedAt.DBName, now, true)
+	stmt.SetColumn("deleted_by", scope.UserID, true)
+	if len(primaryExpressions) > 0 {
+		stmt.AddClause(clause.Where{Exprs: primaryExpressions})
+	}
+	gorm.SoftDeleteQueryClause{ZeroValue: sql.NullString{Valid: false}, Field: deletedAt}.ModifyStatement(stmt)
+	stmt.AddClauseIfNotExists(clause.Update{})
+	stmt.Build(stmt.DB.Callback().Update().Clauses...)
+}
+
+func hasWriteConditions(db *gorm.DB) bool {
+	if value, ok := db.Statement.Clauses["WHERE"]; ok {
+		if where, ok := value.Expression.(clause.Where); ok && len(where.Exprs) > 0 {
+			return true
+		}
+	}
+	if db.Statement.Schema == nil || !db.Statement.ReflectValue.IsValid() {
+		return false
+	}
+	_, values := schema.GetIdentityFieldValuesMap(db.Statement.Context, db.Statement.ReflectValue, db.Statement.Schema.PrimaryFields)
+	if _, query := schema.ToQueryValues(db.Statement.Table, db.Statement.Schema.PrimaryFieldDBNames, values); len(query) > 0 {
+		return true
+	}
+	if db.Statement.ReflectValue.CanAddr() && db.Statement.Dest != db.Statement.Model && db.Statement.Model != nil {
+		_, values = schema.GetIdentityFieldValuesMap(db.Statement.Context, reflect.ValueOf(db.Statement.Model), db.Statement.Schema.PrimaryFields)
+		_, query := schema.ToQueryValues(db.Statement.Table, db.Statement.Schema.PrimaryFieldDBNames, values)
+		return len(query) > 0
+	}
+	return false
+}

internal/data/database.go

@@ -8,6 +8,7 @@ import (
 	"path/filepath"
 	"regexp"
 	"strings"
+	"time"
 
 	oracle "github.com/dzwvip/gorm-oracle"
 	"github.com/glebarez/sqlite"
@@ -15,6 +16,8 @@ import (
 	"gorm.io/driver/postgres"
 	"gorm.io/driver/sqlserver"
 	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+	"gorm.io/gorm/schema"
 	"kra/internal/conf"
 )
 
@@ -99,21 +102,61 @@ func databaseDSN(c *conf.Data_Database, name string) (string, error) {
 	return "", fmt.Errorf("unsupported database driver %q", c.Driver)
 }
 
+func gormConfig(config *conf.Data_Database) *gorm.Config {
+	level := logger.Info
+	switch strings.ToLower(config.LogMode) {
+	case "silent":
+		level = logger.Silent
+	case "error":
+		level = logger.Error
+	case "warn":
+		level = logger.Warn
+	}
+	return &gorm.Config{Logger: logger.Default.LogMode(level), NamingStrategy: schema.NamingStrategy{TablePrefix: config.Prefix, SingularTable: config.Singular}}
+}
+
 func openWithDriver(driver, dsn string) (*gorm.DB, error) {
+	return openWithDriverConfig(driver, dsn, &conf.Data_Database{Driver: driver})
+}
+
+func openWithDriverConfig(driver, dsn string, config *conf.Data_Database) (*gorm.DB, error) {
+	gormConfig := gormConfig(config)
+	var db *gorm.DB
+	var err error
 	switch normalizedDriver(driver) {
 	case "mysql":
-		return gorm.Open(mysql.Open(dsn), &gorm.Config{})
+		db, err = gorm.Open(mysql.Open(dsn), gormConfig)
 	case "pgsql":
-		return gorm.Open(postgres.Open(dsn), &gorm.Config{})
+		db, err = gorm.Open(postgres.Open(dsn), gormConfig)
 	case "mssql":
-		return gorm.Open(sqlserver.Open(dsn), &gorm.Config{})
+		db, err = gorm.Open(sqlserver.Open(dsn), gormConfig)
 	case "oracle":
-		return gorm.Open(oracle.Open(dsn), &gorm.Config{})
+		db, err = gorm.Open(oracle.Open(dsn), gormConfig)
 	case "sqlite":
-		return gorm.Open(sqlite.Open(dsn), &gorm.Config{})
+		db, err = gorm.Open(sqlite.Open(dsn), gormConfig)
 	default:
 		return nil, fmt.Errorf("unsupported database driver %q", driver)
 	}
+	if err != nil {
+		return nil, err
+	}
+	sqlDB, err := db.DB()
+	if err != nil {
+		return nil, err
+	}
+	if config.MaxIdleConns > 0 {
+		sqlDB.SetMaxIdleConns(int(config.MaxIdleConns))
+	}
+	if config.MaxOpenConns > 0 {
+		sqlDB.SetMaxOpenConns(int(config.MaxOpenConns))
+	}
+	if config.ConnMaxLifetime > 0 {
+		sqlDB.SetConnMaxLifetime(time.Duration(config.ConnMaxLifetime) * time.Second)
+	}
+	if config.Engine != "" && (normalizedDriver(driver) == "mysql" || normalizedDriver(driver) == "mssql") {
+		db = db.Set("gorm:table_options", "ENGINE="+config.Engine)
+	}
+	return db, nil
 }
 
 func openDatabase(c *conf.Data_Database, create bool, template string) (*gorm.DB, error) {
@@ -129,7 +172,7 @@ func openDatabase(c *conf.Data_Database, create bool, template string) (*gorm.DB
 		if err = os.MkdirAll(filepath.Dir(dsn), 0o755); err != nil {
 			return nil, err
 		}
-		return openWithDriver(driver, dsn)
+		return openWithDriverConfig(driver, dsn, c)
 	}
 	if create && driver != "oracle" {
 		if !databaseNamePattern.MatchString(c.Name) {
@@ -146,7 +189,7 @@ func openDatabase(c *conf.Data_Database, create bool, template string) (*gorm.DB
 		if err != nil {
 			return nil, err
 		}
-		adminDB, err := openWithDriver(driver, dsn)
+		adminDB, err := openWithDriverConfig(driver, dsn, c)
 		if err != nil {
 			return nil, fmt.Errorf("connect database server: %w", err)
 		}
@@ -182,7 +225,7 @@ func openDatabase(c *conf.Data_Database, create bool, template string) (*gorm.DB
 	if err != nil {
 		return nil, err
 	}
-	return openWithDriver(driver, dsn)
+	return openWithDriverConfig(driver, dsn, c)
 }
 
 func openFallbackDatabase() (*gorm.DB, error) {

internal/data/dictionary.go

@@ -18,7 +18,7 @@ type dictionaryPO struct {
 	UpdatedAt time.Time
 	DeletedAt gorm.DeletedAt `gorm:"index"`
 	Name      string
-	Type      string `gorm:"uniqueIndex"`
+	Type      string
 	Status    bool
 	Desc      string
 	ParentID  *uint

internal/data/email.go

@@ -45,14 +45,7 @@ func (r *emailRepo) DefaultRecipients() []string {
 	if config == nil {
 		return nil
 	}
-	parts := strings.Split(config.To, ",")
-	result := make([]string, 0, len(parts))
-	for _, part := range parts {
-		if recipient := strings.TrimSpace(part); recipient != "" {
-			result = append(result, recipient)
-		}
-	}
-	return result
+	return []string{config.To}
 }
 
 func cleanHeader(value string) string {

internal/data/export.go

@@ -20,7 +20,7 @@ type exportTemplatePO struct {
 	DBName       string
 	Name         string
 	DBTableName  string `gorm:"column:table_name"`
-	TemplateID   string `gorm:"uniqueIndex"`
+	TemplateID   string
 	TemplateInfo string `gorm:"type:text"`
 	SQL          string `gorm:"type:text"`
 	ImportSQL    string `gorm:"type:text"`

internal/data/migrations.go

@@ -1,9 +1,13 @@
 package data
 
-import "gorm.io/gorm"
+import (
+	"fmt"
+
+	"gorm.io/gorm"
+)
 
 func migrateAll(db *gorm.DB) error {
-	return db.AutoMigrate(
+	if err := db.AutoMigrate(
 		&userPO{}, &authorityPO{}, &menuPO{}, &userAuthorityPO{}, &authorityMenuPO{}, &menuParameterPO{},
 		&apiPO{}, &ignoredAPIPO{}, &authorityAPIPO{}, &menuButtonPO{}, &authorityButtonPO{},
 		&departmentPO{}, &positionPO{}, &userDepartmentPO{}, &userPositionPO{}, &authorityDepartmentPO{},
@@ -12,5 +16,66 @@ func migrateAll(db *gorm.DB) error {
 		&operationPO{}, &loginLogPO{}, &dataAccessLogPO{}, &errorRecordPO{},
 		&taskPO{}, &taskLogPO{}, &mediaPO{}, &categoryPO{}, &uploadSessionPO{}, &uploadChunkPO{},
 		&announcementPO{},
-	)
+	); err != nil {
+		return err
+	}
+	return reconcileReferenceIndexes(db)
+}
+
+// reconcileReferenceIndexes removes constraints created by older Kra builds
+// that are not part of the administration data model. Business services own
+// duplicate checks and their user-facing error messages.
+func reconcileReferenceIndexes(db *gorm.DB) error {
+	obsolete := []struct {
+		model any
+		name  string
+	}{
+		{&apiPO{}, "idx_api_path_method"},
+		{&dictionaryPO{}, "idx_sys_dictionaries_type"},
+		{&parameterPO{}, "idx_sys_params_key"},
+		{&apiTokenPO{}, "idx_sys_api_tokens_token"},
+		{&exportTemplatePO{}, "idx_sys_export_templates_template_id"},
+	}
+	for _, item := range obsolete {
+		if db.Migrator().HasIndex(item.model, item.name) {
+			if err := db.Migrator().DropIndex(item.model, item.name); err != nil {
+				return fmt.Errorf("drop obsolete index %s: %w", item.name, err)
+			}
+		}
+	}
+	for _, item := range []struct {
+		name  string
+		field string
+	}{{"idx_sys_users_uuid", "UUID"}, {"idx_sys_users_username", "Username"}} {
+		unique, err := indexIsUnique(db, &userPO{}, item.name)
+		if err != nil {
+			return err
+		}
+		if !unique {
+			continue
+		}
+		if err = db.Migrator().DropIndex(&userPO{}, item.name); err != nil {
+			return fmt.Errorf("drop legacy unique index %s: %w", item.name, err)
+		}
+		if err = db.Migrator().CreateIndex(&userPO{}, item.field); err != nil {
+			return fmt.Errorf("create reference index %s: %w", item.name, err)
+		}
+	}
+	return nil
+}
+
+func indexIsUnique(db *gorm.DB, model any, name string) (bool, error) {
+	indexes, err := db.Migrator().GetIndexes(model)
+	if err != nil {
+		// Some third-party GORM drivers do not implement index inspection.
+		// Fresh schemas are already correct; skip only the legacy repair there.
+		return false, nil
+	}
+	for _, index := range indexes {
+		if index.Name() == name {
+			unique, known := index.Unique()
+			return known && unique, nil
+		}
+	}
+	return false, nil
 }

internal/data/mongo.go

@@ -0,0 +1,63 @@
+package data
+
+import (
+	"context"
+	"fmt"
+	"strings"
+	"time"
+
+	"kra/internal/conf"
+
+	"go.mongodb.org/mongo-driver/mongo"
+	"go.mongodb.org/mongo-driver/mongo/options"
+)
+
+func mongoURI(config *conf.Data_Mongo) string {
+	hosts := make([]string, 0, len(config.Hosts))
+	for _, host := range config.Hosts {
+		if host != nil && host.Host != "" && host.Port != "" {
+			hosts = append(hosts, host.Host+":"+host.Port)
+		}
+	}
+	uri := "mongodb://" + strings.Join(hosts, ",") + "/" + config.Database
+	if config.Options != "" {
+		uri += "?" + config.Options
+	}
+	return uri
+}
+
+func openMongo(config *conf.Data_Mongo, enabled bool) (*mongo.Client, error) {
+	if !enabled {
+		return nil, nil
+	}
+	if config == nil || len(config.Hosts) == 0 {
+		return nil, fmt.Errorf("mongo hosts are required")
+	}
+	clientOptions := options.Client().ApplyURI(mongoURI(config))
+	if config.Username != "" && config.Password != "" {
+		clientOptions.SetAuth(options.Credential{Username: config.Username, Password: config.Password, AuthSource: config.AuthSource})
+	}
+	if config.MinPoolSize > 0 {
+		clientOptions.SetMinPoolSize(config.MinPoolSize)
+	}
+	if config.MaxPoolSize > 0 {
+		clientOptions.SetMaxPoolSize(config.MaxPoolSize)
+	}
+	if config.ConnectTimeoutMs > 0 {
+		clientOptions.SetConnectTimeout(time.Duration(config.ConnectTimeoutMs) * time.Millisecond)
+	}
+	if config.SocketTimeoutMs > 0 {
+		clientOptions.SetSocketTimeout(time.Duration(config.SocketTimeoutMs) * time.Millisecond)
+	}
+	ctx, cancel := context.WithTimeout(context.Background(), 3*time.Second)
+	defer cancel()
+	client, err := mongo.Connect(ctx, clientOptions)
+	if err != nil {
+		return nil, err
+	}
+	if err = client.Ping(ctx, nil); err != nil {
+		_ = client.Disconnect(context.Background())
+		return nil, err
+	}
+	return client, nil
+}

internal/data/parameter.go

@@ -16,7 +16,7 @@ type parameterPO struct {
 	UpdatedAt time.Time
 	DeletedAt gorm.DeletedAt `gorm:"index"`
 	Name      string
-	Key       string `gorm:"uniqueIndex"`
+	Key       string
 	Value     string
 	Desc      string
 }

internal/data/runtime_clients.go

@@ -6,6 +6,7 @@ import (
 	"sync/atomic"
 
 	"github.com/redis/go-redis/v9"
+	"go.mongodb.org/mongo-driver/mongo"
 	"gorm.io/gorm"
 )
 
@@ -17,8 +18,40 @@ type reloadableDB struct {
 	retired []*gorm.DB
 }
 
+type reloadableMongo struct {
+	mu      sync.RWMutex
+	current *mongo.Client
+	retired []*mongo.Client
+}
+
+func newReloadableMongo(client *mongo.Client) *reloadableMongo {
+	return &reloadableMongo{current: client}
+}
+func (r *reloadableMongo) replace(client *mongo.Client) {
+	r.mu.Lock()
+	old := r.current
+	r.current = client
+	if old != nil && old != client {
+		r.retired = append(r.retired, old)
+	}
+	r.mu.Unlock()
+}
+func (r *reloadableMongo) close() {
+	r.mu.Lock()
+	all := append([]*mongo.Client{r.current}, r.retired...)
+	r.current = nil
+	r.retired = nil
+	r.mu.Unlock()
+	for _, client := range all {
+		if client != nil {
+			_ = client.Disconnect(context.Background())
+		}
+	}
+}
+
 func newReloadableDB(db *gorm.DB) *reloadableDB {
 	r := &reloadableDB{}
+	registerDataScopeCallbacks(db)
 	r.current.Store(db)
 	return r
 }
@@ -30,6 +63,7 @@ func (r *reloadableDB) WithContext(ctx context.Context) *gorm.DB {
 func (r *reloadableDB) DB() *gorm.DB { return r.current.Load() }
 
 func (r *reloadableDB) replace(db *gorm.DB) {
+	registerDataScopeCallbacks(db)
 	old := r.current.Swap(db)
 	if old != nil && old != db {
 		r.mu.Lock()
@@ -60,45 +94,41 @@ func (r *reloadableDB) close() {
 }
 
 type reloadableRedis struct {
-	current atomic.Pointer[redis.Client]
-	mu      sync.Mutex
-	retired []*redis.Client
+	mu      sync.RWMutex
+	current redis.UniversalClient
+	retired []redis.UniversalClient
 }
 
-func newReloadableRedis(client *redis.Client) *reloadableRedis {
-	r := &reloadableRedis{}
-	if client != nil {
-		r.current.Store(client)
-	}
-	return r
+func newReloadableRedis(client redis.UniversalClient) *reloadableRedis {
+	return &reloadableRedis{current: client}
 }
 
-func (r *reloadableRedis) load() *redis.Client { return r.current.Load() }
+func (r *reloadableRedis) load() redis.UniversalClient {
+	r.mu.RLock()
+	defer r.mu.RUnlock()
+	return r.current
+}
 
-func (r *reloadableRedis) replace(client *redis.Client) {
-	old := r.current.Swap(client)
+func (r *reloadableRedis) replace(client redis.UniversalClient) {
+	r.mu.Lock()
+	old := r.current
+	r.current = client
 	if old != nil && old != client {
-		r.mu.Lock()
 		r.retired = append(r.retired, old)
-		r.mu.Unlock()
 	}
+	r.mu.Unlock()
 }
 
 func (r *reloadableRedis) close() {
-	current := r.current.Load()
 	r.mu.Lock()
-	all := append([]*redis.Client{current}, r.retired...)
+	all := append([]redis.UniversalClient{r.current}, r.retired...)
+	r.current = nil
 	r.retired = nil
 	r.mu.Unlock()
-	seen := map[*redis.Client]struct{}{}
 	for _, client := range all {
 		if client == nil {
 			continue
 		}
-		if _, ok := seen[client]; ok {
-			continue
-		}
-		seen[client] = struct{}{}
 		_ = client.Close()
 	}
 }

internal/data/system.go

@@ -13,8 +13,8 @@ type userPO struct {
 	CreatedAt          time.Time
 	UpdatedAt          time.Time
 	DeletedAt          gorm.DeletedAt `gorm:"index"`
-	UUID               string         `gorm:"type:char(36);uniqueIndex"`
-	Username           string         `gorm:"index;uniqueIndex"`
+	UUID               string         `gorm:"type:char(36);index"`
+	Username           string         `gorm:"index"`
 	Password           string
 	NickName           string `gorm:"column:nick_name"`
 	HeaderImg          string `gorm:"column:header_img"`

internal/data/system_init.go

@@ -182,6 +182,17 @@ func (r *systemRepo) Initialize(ctx context.Context, input *biz.DatabaseConfig)
 				return err
 			}
 		}
+		for _, ignored := range []ignoredAPIPO{
+			{Method: "GET", Path: "/api/freshCasbin"}, {Method: "GET", Path: "/health"},
+			{Method: "POST", Path: "/system/reloadSystem"}, {Method: "POST", Path: "/base/login"},
+			{Method: "POST", Path: "/base/captcha"}, {Method: "POST", Path: "/init/initdb"},
+			{Method: "POST", Path: "/init/checkdb"}, {Method: "GET", Path: "/info/getInfoDataSource"},
+			{Method: "GET", Path: "/info/getInfoPublic"},
+		} {
+			if err := tx.FirstOrCreate(&ignored, ignored).Error; err != nil {
+				return err
+			}
+		}
 		return nil
 	}); err != nil {
 		return err
@@ -204,11 +215,16 @@ func defaultMenus() []menuPO {
 	child := func(parent, path, name, component, title, icon string, sort int) menuPO {
 		return menuPO{MenuLevel: 1, Path: path, Name: name, Component: component, Title: title, Icon: icon, Sort: sort, ActiveName: parent}
 	}
+	cachedChild := func(parent, path, name, component, title, icon string, sort int) menuPO {
+		value := child(parent, path, name, component, title, icon, sort)
+		value.KeepAlive = true
+		return value
+	}
 	return []menuPO{
 		{Path: "dashboard", Name: "dashboard", Component: "view/dashboard/index.vue", Title: "仪表盘", Icon: "odometer", Sort: 1},
 		root("permission", "permission", "权限管理", "perm-kra", 2), root("org", "org", "组织管理", "share", 3), root("systemConfig", "systemConfig", "系统设置", "config-kra", 4), root("monitor", "monitor", "运维监控", "monitor-kra", 5), root("media", "media", "媒体管理", "folder-opened", 6), root("extensions", "extensions", "扩展功能", "cherry", 10),
 		{Path: "person", Name: "person", Component: "view/person/person.vue", Title: "个人信息", Icon: "postcard", Hidden: true, Sort: 13},
-		child("permission", "authority", "authority", "view/superAdmin/authority/authority.vue", "角色管理", "role-kra", 1), child("permission", "menu", "menu", "view/superAdmin/menu/menu.vue", "菜单管理", "tickets", 2), child("permission", "api", "api", "view/superAdmin/api/api.vue", "api管理", "api-kra", 3), child("permission", "apiToken", "apiToken", "view/systemTools/apiToken/index.vue", "API Token", "key", 4),
+		child("permission", "authority", "authority", "view/superAdmin/authority/authority.vue", "角色管理", "role-kra", 1), cachedChild("permission", "menu", "menu", "view/superAdmin/menu/menu.vue", "菜单管理", "tickets", 2), cachedChild("permission", "api", "api", "view/superAdmin/api/api.vue", "api管理", "api-kra", 3), child("permission", "apiToken", "apiToken", "view/systemTools/apiToken/index.vue", "API Token", "key", 4),
 		child("org", "user", "user", "view/superAdmin/user/user.vue", "用户管理", "user", 1), child("org", "department", "department", "view/superAdmin/department/department.vue", "部门管理", "office-building", 2), child("org", "position", "position", "view/superAdmin/position/position.vue", "岗位管理", "postcard", 3),
 		child("systemConfig", "system", "system", "view/systemTools/system/system.vue", "配置文件", "config-file-kra", 1), child("systemConfig", "dictionary", "dictionary", "view/superAdmin/dictionary/sysDictionary.vue", "字典管理", "notebook", 2), child("systemConfig", "sysParams", "sysParams", "view/superAdmin/params/sysParams.vue", "参数管理", "set-up", 3), child("systemConfig", "security", "security", "view/system/security/index.vue", "安全配置", "security-kra", 4),
 		child("monitor", "operation", "operation", "view/superAdmin/operation/sysOperationRecord.vue", "操作历史", "document", 1), child("monitor", "loginLog", "loginLog", "view/systemTools/loginLog/index.vue", "登录日志", "clock", 2), child("monitor", "sysError", "sysError", "view/systemTools/sysError/sysError.vue", "错误日志", "error-kra", 3), child("monitor", "sysVersion", "sysVersion", "view/systemTools/version/version.vue", "版本管理", "version-kra", 4), child("monitor", "state", "state", "view/system/state.vue", "服务器状态", "server", 5), child("monitor", "dataAccessLog", "dataAccessLog", "view/superAdmin/dataAccessLog/dataAccessLog.vue", "数据权限审计", "warning", 6), child("monitor", "timedTask", "timedTask", "view/systemTools/timedTask/index.vue", "定时任务", "timer", 7), child("monitor", "logViewer", "logViewer", "view/systemTools/logViewer/index.vue", "文件日志", "document", 8),

internal/server/gin.go

@@ -20,10 +20,10 @@ import (
 	kratoshttp "github.com/go-kratos/kratos/v3/transport/http"
 )
 
-func NewGinServer(c *conf.Server, runtime *conf.Runtime, system *service.SystemService, access *service.AccessService, authority *handler.Authority, menu *handler.Menu, api *handler.API, permission *handler.Permission, organization *handler.Organization, announcement *handler.Announcement, email *handler.Email, task *handler.Task, media *handler.Media, auditHandler *handler.Audit, export *handler.Export, version *handler.Version, dictionary *handler.Dictionary, parameter *handler.Parameter, apiToken *handler.APIToken, systemConfig *handler.SystemConfig, publicHandler *handler.Public, user *handler.User, navigation *handler.Navigation, session *handler.Session, settings *service.SettingsService, audit *service.AuditService, emails *service.EmailService, logger *slog.Logger) *kratoshttp.Server {
+func NewGinServer(c *conf.Server, runtime *conf.Runtime, system *service.SystemService, access *service.AccessService, authority *handler.Authority, menu *handler.Menu, api *handler.API, permission *handler.Permission, organization *handler.Organization, announcement *handler.Announcement, email *handler.Email, task *handler.Task, media *handler.Media, auditHandler *handler.Audit, export *handler.Export, version *handler.Version, dictionary *handler.Dictionary, parameter *handler.Parameter, apiToken *handler.APIToken, systemConfig *handler.SystemConfig, publicHandler *handler.Public, user *handler.User, navigation *handler.Navigation, session *handler.Session, settings *service.SettingsService, audit *service.AuditService, logger *slog.Logger) *kratoshttp.Server {
 	gin.SetMode(gin.ReleaseMode)
 	engine := gin.New()
-	engine.Use(servermiddleware.RequestMeta(), servermiddleware.EmailErrorAlert(emails, logger), gin.Recovery(), servermiddleware.SecurityRateLimit(system, settings), servermiddleware.OperationAudit(audit))
+	engine.Use(servermiddleware.RequestMeta(), servermiddleware.Recovery(audit, logger), servermiddleware.AccessLog(runtime, logger), servermiddleware.ErrorAudit(audit), servermiddleware.SecurityRateLimit(system, settings), servermiddleware.OperationAudit(runtime, audit))
 
 	prefix := ""
 	config := runtime.Admin()

internal/server/handler/media.go

@@ -83,7 +83,11 @@ func (h *Media) DeleteMany(c *gin.Context) {
 	httpx.Write(c, httpx.CodeSuccess, gin.H{}, "批量删除成功")
 }
 func (h *Media) Find(c *gin.Context) {
-	id, _ := strconv.ParseUint(c.Query("id"), 10, 64)
+	id, parseErr := strconv.ParseUint(c.Query("id"), 10, 64)
+	if parseErr != nil {
+		httpx.Fail(c, "文件ID非法")
+		return
+	}
 	item, err := h.service.Media(c.Request.Context(), uint(id))
 	if err != nil {
 		httpx.Fail(c, "查询失败")

internal/server/handler/public.go

@@ -100,7 +100,13 @@ func (h *Public) Login(c *gin.Context) {
 	if err != nil {
 		_, _ = h.system.CacheIncrement(c.Request.Context(), c.ClientIP(), ipTTL)
 		if errors.Is(err, biz.ErrUserDisabled) {
-			_ = h.audit.RecordLoginRequest(c.Request.Context(), &dto.LoginLogRequest{Username: req.Username, IP: c.ClientIP(), Status: false, ErrorMessage: "用户被禁止登录", Agent: c.Request.UserAgent()})
+			var disabled *service.UserDisabledError
+			errors.As(err, &disabled)
+			userID := uint(0)
+			if disabled != nil {
+				userID = disabled.UserID
+			}
+			_ = h.audit.RecordLoginRequest(c.Request.Context(), &dto.LoginLogRequest{Username: req.Username, IP: c.ClientIP(), Status: false, ErrorMessage: "用户被禁止登录", Agent: c.Request.UserAgent(), UserID: userID})
 			httpx.Fail(c, "用户被禁止登录")
 			return
 		}

internal/server/middleware/access.go

@@ -1,7 +1,6 @@
 package middleware
 
 import (
-	"net/http"
 	"strings"
 
 	"kra/internal/biz"
@@ -33,13 +32,19 @@ func AccessControl(runtime *conf.Runtime, access *service.AccessService, audit *
 			requestID, _ := c.Get("request_id")
 			requestIDText, _ := requestID.(string)
 			_ = audit.RecordDataAccessRequest(c.Request.Context(), &dto.DataAccessRecordRequest{EventType: "blocked_access", Operation: c.Request.Method, UserID: claims.ID, AuthorityID: claims.AuthorityID, RequestID: requestIDText, Method: c.Request.Method, Path: path, Detail: "Casbin policy denied the request"})
-			c.AbortWithStatusJSON(http.StatusForbidden, httpx.Response{Code: httpx.CodeError, Data: nil, Msg: "权限不足"})
+			httpx.Write(c, httpx.CodeError, gin.H{}, "权限不足")
+			c.Abort()
 			return
 		}
 		requestContext, err := access.ContextWithDataScope(c.Request.Context(), claims.AuthorityID, claims.ID)
 		if err != nil {
-			httpx.Fail(c, "数据权限加载失败")
-			return
+			requestContext = c.Request.Context()
+		}
+		if scope, ok := biz.DataScopeFromContext(requestContext); ok {
+			requestID, _ := c.Get("request_id")
+			scope.RequestID, _ = requestID.(string)
+			scope.Method, scope.Path = c.Request.Method, path
+			requestContext = biz.NewDataScopeContext(requestContext, scope)
 		}
 		requestContext = biz.NewActorContext(requestContext, biz.Actor{UserID: claims.ID, AuthorityID: claims.AuthorityID})
 		c.Request = c.Request.WithContext(requestContext)

internal/server/middleware/access_log.go

@@ -0,0 +1,86 @@
+package middleware
+
+import (
+	"bytes"
+	"io"
+	"log/slog"
+	"strings"
+	"time"
+
+	"kra/internal/conf"
+
+	"github.com/gin-gonic/gin"
+)
+
+// AccessLog is the single global request/response capture point, matching
+// the reference middleware ordering and making every HTTP request observable.
+func AccessLog(runtime *conf.Runtime, logger *slog.Logger) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var requestBody []byte
+		multipart := strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data")
+		if c.Request.Body != nil && !multipart {
+			requestBody, _ = io.ReadAll(c.Request.Body)
+			c.Request.Body = io.NopCloser(bytes.NewReader(requestBody))
+		}
+		maxBytes := 1 << 20
+		writer := &captureWriter{ResponseWriter: c.Writer, maxBytes: maxBytes}
+		c.Writer = writer
+		started := time.Now()
+		c.Next()
+		if logger == nil {
+			return
+		}
+		requestText, responseText := "", ""
+		config := runtime.Admin()
+		logLimit := 32768
+		if config != nil && config.Zap != nil && config.Zap.AccessLogMaxBytes > 0 {
+			logLimit = int(config.Zap.AccessLogMaxBytes)
+		}
+		if config == nil || config.Zap == nil || config.Zap.AccessReqBody {
+			if multipart {
+				requestText = "[文件]"
+			} else {
+				requestText = redactJSONLimit(requestBody, logLimit)
+			}
+		}
+		if config == nil || config.Zap == nil || config.Zap.AccessRespData {
+			responseText = redactJSONLimit(writer.body.Bytes(), logLimit)
+		}
+		userID, authorityID := uint(0), uint(0)
+		if claims := Claims(c); claims != nil {
+			userID, authorityID = claims.ID, claims.AuthorityID
+		}
+		route := c.FullPath()
+		if route == "" {
+			route = "unmatched"
+		}
+		attributes := []any{
+			"ip", c.ClientIP(), "method", c.Request.Method, "path", c.Request.URL.Path, "http_route", route,
+			"status", c.Writer.Status(), "latency_ms", time.Since(started).Milliseconds(),
+			"request_id", stringValueFromContext(c, "request_id"), "trace_id", stringValueFromContext(c, "trace_id"),
+			"bytes_in", len(requestBody), "bytes_out", c.Writer.Size(), "user_id", userID, "authority_id", authorityID,
+			"ua", c.Request.UserAgent(), "query", c.Request.URL.RawQuery, "request", requestText, "response", responseText}
+		if config != nil && config.Zap != nil && config.Zap.AccessReqHeaders {
+			attributes = append(attributes, "headers", redactHeaders(c.Request.Header))
+		}
+		logger.InfoContext(c.Request.Context(), "http access", attributes...)
+	}
+}
+
+func redactHeaders(headers map[string][]string) map[string][]string {
+	out := make(map[string][]string, len(headers))
+	for key, values := range headers {
+		lower := strings.ToLower(key)
+		if strings.Contains(lower, "token") || lower == "authorization" || lower == "cookie" {
+			out[key] = []string{"******"}
+		} else {
+			out[key] = values
+		}
+	}
+	return out
+}
+
+func stringValueFromContext(c *gin.Context, key string) string {
+	value, _ := c.Get(key)
+	return stringValue(value)
+}

internal/server/middleware/audit.go

@@ -6,29 +6,34 @@ import (
 	"strings"
 	"time"
 
+	"kra/internal/conf"
 	"kra/internal/service"
 	"kra/internal/service/dto"
 
 	"github.com/gin-gonic/gin"
 )
 
-func OperationAudit(service *service.AuditService) gin.HandlerFunc {
+func OperationAudit(runtime *conf.Runtime, service *service.AuditService) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		if isBootstrapPath(c.Request.URL.Path) || c.Request.Method == "GET" || c.Request.Method == "HEAD" || c.Request.Method == "OPTIONS" {
-			c.Next()
-			return
-		}
 		path := c.Request.URL.Path
-		if strings.Contains(path, "sysOperationRecord") || strings.Contains(path, "sysLoginLog") || strings.Contains(path, "dataAccessLog") {
+		if !recordsOperation(c.Request.Method, path) {
 			c.Next()
 			return
 		}
 		var requestBody []byte
-		if c.Request.Body != nil {
-			requestBody, _ = io.ReadAll(io.LimitReader(c.Request.Body, 32769))
-			c.Request.Body = io.NopCloser(bytes.NewReader(requestBody))
+		maxBytes := 32768
+		if config := runtime.Admin(); config != nil && config.Zap != nil && config.Zap.AccessLogMaxBytes > 0 {
+			maxBytes = int(config.Zap.AccessLogMaxBytes)
 		}
-		writer := &captureWriter{ResponseWriter: c.Writer}
+		if c.Request.Body != nil {
+			if strings.Contains(c.GetHeader("Content-Type"), "multipart/form-data") {
+				requestBody = []byte("[文件]")
+			} else {
+				requestBody, _ = io.ReadAll(c.Request.Body)
+				c.Request.Body = io.NopCloser(bytes.NewReader(requestBody))
+			}
+		}
+		writer := &captureWriter{ResponseWriter: c.Writer, maxBytes: maxBytes}
 		c.Writer = writer
 		started := time.Now()
 		c.Next()
@@ -41,6 +46,49 @@ func OperationAudit(service *service.AuditService) gin.HandlerFunc {
 		if status >= 400 {
 			errorMessage = writer.body.String()
 		}
-		_ = service.RecordOperationRequest(c.Request.Context(), &dto.OperationRecordRequest{IP: c.ClientIP(), Method: c.Request.Method, Path: path, Status: status, LatencyMS: time.Since(started).Milliseconds(), Agent: c.Request.UserAgent(), ErrorMessage: errorMessage, Body: redactJSON(requestBody), Response: redactJSON(writer.body.Bytes()), UserID: userID, RequestID: stringValue(requestID), TraceID: c.GetHeader("traceparent"), DeviceID: c.GetHeader("X-Device-Id")})
+		_ = service.RecordOperationRequest(c.Request.Context(), &dto.OperationRecordRequest{IP: c.ClientIP(), Method: c.Request.Method, Path: path, Status: status, LatencyMS: time.Since(started).Milliseconds(), Agent: c.Request.UserAgent(), ErrorMessage: errorMessage, Body: redactJSONLimit(requestBody, maxBytes), Response: writer.body.String(), UserID: userID, RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id"), DeviceID: c.GetHeader("X-Device-Id")})
 	}
 }
+
+// recordsOperation mirrors the routes on which operation records are enabled.
+// Matching by suffix keeps the behavior stable when router-prefix is configured.
+func recordsOperation(method, path string) bool {
+	_, ok := operationRoutes[method+" "+routeSuffix(path)]
+	return ok
+}
+
+func routeSuffix(path string) string {
+	for _, marker := range []string{"/user/", "/api/", "/casbin/", "/authority/", "/menu/", "/department/", "/position/", "/sysDictionary/", "/sysDictionaryDetail/", "/sysParams/", "/securityConfig/", "/system/", "/sysApiToken/", "/sysVersion/", "/sysExportTemplate/", "/sysError/", "/sysLoginLog/", "/sysOperationRecord/", "/dataAccessLog/", "/timedTask/", "/info/", "/email/"} {
+		if index := strings.Index(path, marker); index >= 0 {
+			return path[index:]
+		}
+	}
+	return path
+}
+
+var operationRoutes = func() map[string]struct{} {
+	values := []string{
+		"POST /user/admin_register", "POST /user/changePassword", "POST /user/setUserAuthority", "DELETE /user/deleteUser", "PUT /user/setUserInfo", "PUT /user/setSelfInfo", "POST /user/setUserAuthorities", "POST /user/setUserDepartments", "POST /user/setUserPositions", "POST /user/resetPassword", "PUT /user/setSelfSetting",
+		"GET /api/getApiGroups", "GET /api/syncApi", "POST /api/ignoreApi", "POST /api/enterSyncApi", "POST /api/createApi", "POST /api/deleteApi", "POST /api/getApiById", "POST /api/updateApi", "DELETE /api/deleteApisByIds", "POST /api/setApiRoles", "POST /casbin/updateCasbin",
+		"POST /authority/createAuthority", "POST /authority/deleteAuthority", "PUT /authority/updateAuthority", "POST /authority/copyAuthority", "POST /authority/setDataScope", "POST /authority/setRoleUsers",
+		"POST /menu/addBaseMenu", "POST /menu/addMenuAuthority", "POST /menu/deleteBaseMenu", "POST /menu/updateBaseMenu", "POST /menu/setMenuRoles",
+		"POST /department/createDepartment", "PUT /department/updateDepartment", "DELETE /department/deleteDepartment", "POST /department/setDepartmentUsers",
+		"POST /position/createPosition", "PUT /position/updatePosition", "DELETE /position/deletePosition", "POST /position/setPositionUsers",
+		"POST /sysDictionary/createSysDictionary", "DELETE /sysDictionary/deleteSysDictionary", "PUT /sysDictionary/updateSysDictionary", "POST /sysDictionary/importSysDictionary", "GET /sysDictionary/exportSysDictionary",
+		"POST /sysDictionaryDetail/createSysDictionaryDetail", "DELETE /sysDictionaryDetail/deleteSysDictionaryDetail", "PUT /sysDictionaryDetail/updateSysDictionaryDetail",
+		"POST /sysParams/createSysParams", "DELETE /sysParams/deleteSysParams", "DELETE /sysParams/deleteSysParamsByIds", "PUT /sysParams/updateSysParams",
+		"POST /securityConfig/setSecurityConfig", "POST /system/setSystemConfig", "POST /system/reloadSystem",
+		"POST /sysApiToken/createApiToken", "POST /sysApiToken/getApiTokenList", "POST /sysApiToken/deleteApiToken",
+		"DELETE /sysVersion/deleteSysVersion", "DELETE /sysVersion/deleteSysVersionByIds", "POST /sysVersion/exportVersion", "POST /sysVersion/importVersion",
+		"POST /sysExportTemplate/createSysExportTemplate", "DELETE /sysExportTemplate/deleteSysExportTemplate", "DELETE /sysExportTemplate/deleteSysExportTemplateByIds", "PUT /sysExportTemplate/updateSysExportTemplate", "POST /sysExportTemplate/importExcel",
+		"DELETE /sysError/deleteSysError", "DELETE /sysError/deleteSysErrorByIds", "PUT /sysError/updateSysError",
+		"DELETE /sysLoginLog/deleteLoginLog", "DELETE /sysLoginLog/deleteLoginLogByIds", "DELETE /sysOperationRecord/deleteSysOperationRecord", "DELETE /sysOperationRecord/deleteSysOperationRecordByIds", "DELETE /dataAccessLog/deleteDataAccessLogByIds",
+		"POST /timedTask/createTimedTask", "PUT /timedTask/updateTimedTask", "DELETE /timedTask/deleteTimedTask", "POST /timedTask/toggleTimedTask", "POST /timedTask/triggerTimedTask",
+		"POST /info/createInfo", "DELETE /info/deleteInfo", "DELETE /info/deleteInfoByIds", "PUT /info/updateInfo", "POST /email/emailTest", "POST /email/sendEmail",
+	}
+	out := make(map[string]struct{}, len(values))
+	for _, value := range values {
+		out[value] = struct{}{}
+	}
+	return out
+}()

internal/server/middleware/auth.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"errors"
 	"net/http"
 	"strconv"
 	"strings"
@@ -12,16 +13,28 @@ import (
 	"kra/pkg/adminauth"
 
 	"github.com/gin-gonic/gin"
+	"golang.org/x/sync/singleflight"
 )
 
 const claimsKey = "admin_claims"
 
+var refreshTokens singleflight.Group
+
+type refreshedToken struct {
+	token     string
+	expiresAt int64
+}
+
 func Auth(runtime *conf.Runtime, settings *service.SettingsService) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		token := c.GetHeader("x-token")
 		if token == "" {
 			token, _ = c.Cookie("x-token")
 		}
+		if token == "" {
+			httpx.NoAuth(c, "未登录或非法访问，请登录")
+			return
+		}
 		secret := ""
 		config := runtime.Admin()
 		if config != nil && config.Jwt != nil {
@@ -29,15 +42,24 @@ func Auth(runtime *conf.Runtime, settings *service.SettingsService) gin.HandlerF
 		}
 		claims, err := adminauth.Parse(token, secret)
 		if err != nil {
-			httpx.NoAuth(c, "未登录或非法访问")
+			message := "无法处理此token"
+			switch {
+			case errors.Is(err, adminauth.ErrTokenExpired):
+				message = "登录已过期，请重新登录"
+			case errors.Is(err, adminauth.ErrTokenMalformed):
+				message = "这不是一个token"
+			case errors.Is(err, adminauth.ErrTokenSignatureInvalid):
+				message = "无效签名"
+			case errors.Is(err, adminauth.ErrTokenNotValidYet):
+				message = "token尚未激活"
+			}
+			httpx.SetTokenCookie(c, "", -1)
+			httpx.NoAuth(c, message)
 			return
 		}
 		if disabled, checkErr := settings.IsTokenDisabled(c.Request.Context(), token); checkErr != nil || disabled {
-			httpx.NoAuth(c, "登录状态已失效")
-			return
-		}
-		if active, checkErr := settings.ActiveTokenMatches(c.Request.Context(), claims.Username, token); checkErr != nil || !active {
-			httpx.NoAuth(c, "登录状态已失效")
+			httpx.SetTokenCookie(c, "", -1)
+			httpx.NoAuth(c, "您的帐户异地登陆或令牌失效")
 			return
 		}
 		if claims.ExpiresAt != nil && claims.BufferTime > 0 && time.Until(claims.ExpiresAt.Time) < time.Duration(claims.BufferTime)*time.Second {
@@ -55,11 +77,21 @@ func Auth(runtime *conf.Runtime, settings *service.SettingsService) gin.HandlerF
 					issuer = config.Jwt.Issuer
 				}
 			}
-			newToken, newClaims, refreshErr := adminauth.Generate(secret, issuer, expires, buffer, claims.ID, claims.AuthorityID, claims.UUID, claims.Username, claims.NickName, claims.MustChangePwd)
-			if refreshErr == nil && settings.RotateActiveToken(c.Request.Context(), claims.Username, token, newToken, expires) == nil {
-				c.Header("new-token", newToken)
-				c.Header("new-expires-at", strconv.FormatInt(newClaims.ExpiresAt.Unix(), 10))
-				httpx.SetTokenCookie(c, newToken, int(expires.Seconds()))
+			value, refreshErr, _ := refreshTokens.Do(token, func() (any, error) {
+				newToken, newClaims, generateErr := adminauth.Generate(secret, issuer, expires, buffer, claims.ID, claims.AuthorityID, claims.UUID, claims.Username, claims.NickName, claims.MustChangePwd)
+				if generateErr != nil {
+					return nil, generateErr
+				}
+				if rotateErr := settings.RotateActiveToken(c.Request.Context(), claims.Username, token, newToken, expires); rotateErr != nil {
+					return nil, rotateErr
+				}
+				return refreshedToken{token: newToken, expiresAt: newClaims.ExpiresAt.Unix()}, nil
+			})
+			if refreshErr == nil {
+				refreshed := value.(refreshedToken)
+				c.Header("new-token", refreshed.token)
+				c.Header("new-expires-at", strconv.FormatInt(refreshed.expiresAt, 10))
+				httpx.SetTokenCookie(c, refreshed.token, int(expires.Seconds()))
 			}
 		}
 		c.Set(claimsKey, claims)
@@ -85,6 +117,6 @@ func MustChangePassword() gin.HandlerFunc {
 			c.Next()
 			return
 		}
-		c.AbortWithStatusJSON(http.StatusConflict, httpx.Response{Code: httpx.CodePasswordChangeRequired, Data: gin.H{"needChangePassword": true}, Msg: "请先修改初始密码"})
+		c.AbortWithStatusJSON(http.StatusConflict, httpx.Response{Code: httpx.CodePasswordChangeRequired, Data: gin.H{"needChangePassword": true}, Msg: "密码已过期，请先修改密码"})
 	}
 }

internal/server/middleware/capture.go

@@ -10,12 +10,17 @@ import (
 
 type captureWriter struct {
 	gin.ResponseWriter
-	body bytes.Buffer
+	body     bytes.Buffer
+	maxBytes int
 }
 
 func (w *captureWriter) Write(data []byte) (int, error) {
-	if w.body.Len() < 32768 {
-		remaining := 32768 - w.body.Len()
+	limit := w.maxBytes
+	if limit <= 0 {
+		limit = 32768
+	}
+	if w.body.Len() < limit {
+		remaining := limit - w.body.Len()
 		if len(data) > remaining {
 			_, _ = w.body.Write(data[:remaining])
 		} else {
@@ -26,11 +31,18 @@ func (w *captureWriter) Write(data []byte) (int, error) {
 }
 
 func redactJSON(raw []byte) string {
+	return redactJSONLimit(raw, 32768)
+}
+
+func redactJSONLimit(raw []byte, limit int) string {
 	if len(raw) == 0 {
 		return ""
 	}
-	if len(raw) > 32768 {
-		raw = raw[:32768]
+	if limit <= 0 {
+		limit = 32768
+	}
+	if len(raw) > limit {
+		raw = raw[:limit]
 	}
 	var value any
 	if json.Unmarshal(raw, &value) != nil {

internal/server/middleware/email.go

@@ -1,48 +0,0 @@
-package middleware
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"log/slog"
-	"strings"
-	"time"
-
-	"kra/internal/server/httpx"
-	"kra/internal/service"
-
-	"github.com/gin-gonic/gin"
-)
-
-func EmailErrorAlert(service *service.EmailService, logger *slog.Logger) gin.HandlerFunc {
-	return func(c *gin.Context) {
-		if strings.Contains(c.Request.URL.Path, "/email/") {
-			c.Next()
-			return
-		}
-		writer := &captureWriter{ResponseWriter: c.Writer}
-		c.Writer = writer
-		started := time.Now()
-		c.Next()
-		failed := c.Writer.Status() >= 400
-		if !failed {
-			var result struct {
-				Code int `json:"code"`
-			}
-			failed = json.Unmarshal(writer.body.Bytes(), &result) == nil && result.Code != httpx.CodeSuccess
-		}
-		if !failed {
-			return
-		}
-		username := "Unknown"
-		if claims := Claims(c); claims != nil && claims.Username != "" {
-			username = claims.Username
-		}
-		subject := fmt.Sprintf("%s %s 调用 %s 报错", username, c.ClientIP(), c.Request.URL.Path)
-		body := bytes.NewBuffer(nil)
-		fmt.Fprintf(body, "请求方式：%s<br>请求路径：%s<br>状态码：%d<br>耗时：%s<br>错误响应：<pre>%s</pre>", c.Request.Method, c.Request.URL.Path, c.Writer.Status(), time.Since(started), redactJSON(writer.body.Bytes()))
-		if err := service.Alert(c.Request.Context(), subject, body.String()); err != nil && logger != nil {
-			logger.Error("send HTTP error email", "error", err)
-		}
-	}
-}

internal/server/middleware/error_audit.go

@@ -0,0 +1,41 @@
+package middleware
+
+import (
+	"encoding/json"
+	"strings"
+
+	"kra/internal/server/httpx"
+	"kra/internal/service"
+	"kra/internal/service/dto"
+
+	"github.com/gin-gonic/gin"
+)
+
+// ErrorAudit supplies the database sink that the Error-level logging core
+// provides. Expected authentication, permission and input failures are not
+// system errors and therefore are not inserted into sys_error.
+func ErrorAudit(audit *service.AuditService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		writer := &captureWriter{ResponseWriter: c.Writer, maxBytes: 1 << 20}
+		c.Writer = writer
+		c.Next()
+		if strings.Contains(c.Request.URL.Path, "/sysError/") || c.Writer.Status() >= 300 && c.Writer.Status() < 500 {
+			return
+		}
+		var response httpx.Response
+		if json.Unmarshal(writer.body.Bytes(), &response) != nil || response.Code == httpx.CodeSuccess || expectedClientFailure(response.Msg) {
+			return
+		}
+		requestID, _ := c.Get("request_id")
+		_ = audit.CreateErrorRequest(c.Request.Context(), &dto.ErrorRecordRequest{Form: c.Request.URL.Path, Info: response.Msg, Level: "error", RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id"), Status: "未解决"})
+	}
+}
+
+func expectedClientFailure(message string) bool {
+	for _, value := range []string{"参数错误", "请输入用户名和密码", "验证码错误", "用户名不存在或者密码错误", "用户被禁止登录", "账号已锁定", "权限不足", "密码已过期", "未登录", "token", "令牌失效"} {
+		if strings.Contains(message, value) {
+			return true
+		}
+	}
+	return false
+}

internal/server/middleware/rate_limit.go

@@ -1,6 +1,7 @@
 package middleware
 
 import (
+	"strings"
 	"time"
 
 	"kra/internal/server/httpx"
@@ -11,7 +12,8 @@ import (
 
 func SecurityRateLimit(system *service.SystemService, settings *service.SettingsService) gin.HandlerFunc {
 	return func(c *gin.Context) {
-		if isBootstrapPath(c.Request.URL.Path) {
+		path := strings.TrimSuffix(c.Request.URL.Path, "/")
+		if !strings.HasSuffix(path, "/base/login") && !strings.HasSuffix(path, "/base/captcha") {
 			c.Next()
 			return
 		}

internal/server/middleware/recovery.go

@@ -0,0 +1,51 @@
+package middleware
+
+import (
+	"fmt"
+	"log/slog"
+	"net"
+	"net/http"
+	"net/http/httputil"
+	"os"
+	"runtime/debug"
+	"strings"
+
+	"kra/internal/service"
+	"kra/internal/service/dto"
+
+	"github.com/gin-gonic/gin"
+)
+
+func Recovery(audit *service.AuditService, logger *slog.Logger) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		defer func() {
+			panicValue := recover()
+			if panicValue == nil {
+				return
+			}
+			brokenPipe := false
+			if networkError, ok := panicValue.(*net.OpError); ok {
+				if syscallError, ok := networkError.Err.(*os.SyscallError); ok {
+					message := strings.ToLower(syscallError.Error())
+					brokenPipe = strings.Contains(message, "broken pipe") || strings.Contains(message, "connection reset by peer")
+				}
+			}
+			request, _ := httputil.DumpRequest(c.Request, false)
+			info := fmt.Sprintf("error=%v request=%s stack=%s", panicValue, request, debug.Stack())
+			if logger != nil {
+				logger.ErrorContext(c.Request.Context(), "recovery from panic", "error", panicValue, "request", string(request), "stack", string(debug.Stack()))
+			}
+			requestID, _ := c.Get("request_id")
+			_ = audit.CreateErrorRequest(c.Request.Context(), &dto.ErrorRecordRequest{Form: c.Request.URL.Path, Info: info, Level: "error", RequestID: stringValue(requestID), TraceID: stringValueFromContext(c, "trace_id"), Status: "未解决"})
+			if brokenPipe {
+				if err, ok := panicValue.(error); ok {
+					_ = c.Error(err)
+				}
+				c.Abort()
+				return
+			}
+			c.AbortWithStatus(http.StatusInternalServerError)
+		}()
+		c.Next()
+	}
+}

internal/server/middleware/request.go

@@ -1,18 +1,48 @@
 package middleware
 
 import (
+	"crypto/rand"
+	"encoding/hex"
+	"regexp"
+	"strings"
+
 	"github.com/gin-gonic/gin"
 	"github.com/google/uuid"
 )
 
+var traceParentPattern = regexp.MustCompile(`^00-([0-9a-f]{32})-([0-9a-f]{16})-[0-9a-f]{2}$`)
+
+func randomHex(bytes int) string {
+	value := make([]byte, bytes)
+	_, _ = rand.Read(value)
+	return hex.EncodeToString(value)
+}
+
 func RequestMeta() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		requestID := c.GetHeader("X-Request-Id")
-		if requestID == "" {
+		if requestID == "" || len(requestID) > 128 || strings.ContainsAny(requestID, "\r\n") {
 			requestID = uuid.NewString()
 		}
+		traceID, parentSpanID := "", ""
+		if match := traceParentPattern.FindStringSubmatch(strings.ToLower(c.GetHeader("traceparent"))); len(match) == 3 {
+			traceID, parentSpanID = match[1], match[2]
+		} else if candidate := c.GetHeader("X-Trace-Id"); len(candidate) <= 128 && !strings.ContainsAny(candidate, "\r\n") {
+			traceID = candidate
+		}
+		if traceID == "" {
+			traceID = randomHex(16)
+		}
+		spanID := randomHex(8)
 		c.Header("X-Request-Id", requestID)
+		c.Header("X-Trace-Id", traceID)
+		if len(traceID) == 32 {
+			c.Header("traceparent", "00-"+traceID+"-"+spanID+"-01")
+		}
 		c.Set("request_id", requestID)
+		c.Set("trace_id", traceID)
+		c.Set("span_id", spanID)
+		c.Set("parent_span_id", parentSpanID)
 		c.Next()
 	}
 }

internal/service/access.go

@@ -2,14 +2,34 @@ package service
 
 import (
 	"context"
+	"strings"
 
 	"kra/internal/biz"
+	"kra/internal/conf"
 	"kra/internal/service/dto"
 )
 
-type AccessService struct{ uc *biz.AccessUsecase }
+type AccessService struct {
+	uc      *biz.AccessUsecase
+	runtime *conf.Runtime
+}
 
-func NewAccessService(uc *biz.AccessUsecase) *AccessService { return &AccessService{uc: uc} }
+func NewAccessService(uc *biz.AccessUsecase, runtime *conf.Runtime) *AccessService {
+	return &AccessService{uc: uc, runtime: runtime}
+}
+
+func (s *AccessService) NormalizeRoutePath(path string) string {
+	config := s.runtime.Admin()
+	if config == nil || config.RouterPrefix == "" {
+		return path
+	}
+	prefix := strings.TrimSuffix(config.RouterPrefix, "/")
+	normalized := strings.TrimPrefix(path, prefix)
+	if normalized == "" {
+		return "/"
+	}
+	return normalized
+}
 func (s *AccessService) Authorize(ctx context.Context, aid uint, path, method string) (bool, error) {
 	return s.uc.Authorize(ctx, aid, path, method)
 }

internal/service/api.go

@@ -88,6 +88,16 @@ func (s *AccessService) PolicyPathResponses(ctx context.Context, authorityID uin
 func (s *AccessService) SyncAPIResponses(ctx context.Context, routes []dto.APIRequest) (*dto.APISyncResponse, error) {
 	items := make([]*biz.API, 0, len(routes))
 	for i := range routes {
+		routes[i].Path = s.NormalizeRoutePath(routes[i].Path)
+		if routes[i].APIGroup == "" || routes[i].Description == "" {
+			group, description := routeMetadata(routes[i].Method, routes[i].Path)
+			if routes[i].APIGroup == "" {
+				routes[i].APIGroup = group
+			}
+			if routes[i].Description == "" {
+				routes[i].Description = description
+			}
+		}
 		items = append(items, apiDomain(&routes[i]))
 	}
 	return s.SyncAPIs(ctx, items)

internal/service/api_metadata.go

@@ -0,0 +1,191 @@
+package service
+
+import "strings"
+
+type apiMetadataValue struct{ group, description string }
+
+var apiMetadata = map[string]apiMetadataValue{
+	"DELETE /api/deleteApisByIds":                              {group: "api", description: "批量删除api"},
+	"DELETE /customer/customer":                                {group: "客户", description: "删除客户"},
+	"DELETE /dataAccessLog/deleteDataAccessLogByIds":           {group: "数据权限审计", description: "批量删除数据权限审计日志"},
+	"DELETE /department/deleteDepartment":                      {group: "部门", description: "删除部门"},
+	"DELETE /info/deleteInfo":                                  {group: "公告", description: "删除公告"},
+	"DELETE /info/deleteInfoByIds":                             {group: "公告", description: "批量删除公告"},
+	"DELETE /mediaUpload/:uploadId":                            {group: "媒体上传", description: "取消大文件上传"},
+	"DELETE /position/deletePosition":                          {group: "岗位", description: "删除岗位"},
+	"DELETE /sysDictionary/deleteSysDictionary":                {group: "系统字典", description: "删除字典"},
+	"DELETE /sysDictionaryDetail/deleteSysDictionaryDetail":    {group: "系统字典详情", description: "删除字典内容"},
+	"DELETE /sysError/deleteSysError":                          {group: "错误日志", description: "删除错误日志"},
+	"DELETE /sysError/deleteSysErrorByIds":                     {group: "错误日志", description: "批量删除错误日志"},
+	"DELETE /sysExportTemplate/deleteSysExportTemplate":        {group: "导出模板", description: "删除导出模板"},
+	"DELETE /sysExportTemplate/deleteSysExportTemplateByIds":   {group: "导出模板", description: "批量删除导出模板"},
+	"DELETE /sysLoginLog/deleteLoginLog":                       {group: "登录日志", description: "删除登录日志"},
+	"DELETE /sysLoginLog/deleteLoginLogByIds":                  {group: "登录日志", description: "批量删除登录日志"},
+	"DELETE /sysOperationRecord/deleteSysOperationRecord":      {group: "操作记录", description: "删除操作记录"},
+	"DELETE /sysOperationRecord/deleteSysOperationRecordByIds": {group: "操作记录", description: "批量删除操作历史"},
+	"DELETE /sysParams/deleteSysParams":                        {group: "参数管理", description: "删除参数"},
+	"DELETE /sysParams/deleteSysParamsByIds":                   {group: "参数管理", description: "批量删除参数"},
+	"DELETE /sysVersion/deleteSysVersion":                      {group: "版本控制", description: "删除版本"},
+	"DELETE /sysVersion/deleteSysVersionByIds":                 {group: "版本控制", description: "批量删除版本"},
+	"DELETE /timedTask/deleteTimedTask":                        {group: "定时任务", description: "删除定时任务"},
+	"DELETE /user/deleteUser":                                  {group: "系统用户", description: "删除用户"},
+	"GET /api/getApiGroups":                                    {group: "api", description: "获取路由组"},
+	"GET /api/getApiRoles":                                     {group: "api", description: "获取指定API关联角色列表"},
+	"GET /api/syncApi":                                         {group: "api", description: "获取待同步API"},
+	"GET /attachmentCategory/getCategoryList":                  {group: "媒体库分类", description: "分类列表"},
+	"GET /authority/getDataScopeDepts":                         {group: "角色", description: "获取角色自定义部门集"},
+	"GET /authority/getUsersByAuthority":                       {group: "角色", description: "获取角色关联用户ID列表"},
+	"GET /customer/customer":                                   {group: "客户", description: "获取单一客户"},
+	"GET /customer/customerList":                               {group: "客户", description: "获取客户列表"},
+	"GET /department/findDepartment":                           {group: "部门", description: "根据ID获取部门"},
+	"GET /department/getDepartmentUsers":                       {group: "部门", description: "获取部门成员ID列表"},
+	"GET /info/findInfo":                                       {group: "公告", description: "根据ID获取公告"},
+	"GET /info/getInfoList":                                    {group: "公告", description: "获取公告列表"},
+	"GET /logViewer/content":                                   {group: "文件日志", description: "分块读取日志文件内容"},
+	"GET /logViewer/dates":                                     {group: "文件日志", description: "获取存在日志的日期"},
+	"GET /logViewer/files":                                     {group: "文件日志", description: "获取日期下的日志文件"},
+	"GET /menu/getMenuRoles":                                   {group: "菜单", description: "获取菜单关联角色列表"},
+	"GET /position/findPosition":                               {group: "岗位", description: "根据ID获取岗位"},
+	"GET /position/getPositionUsers":                           {group: "岗位", description: "获取岗位成员ID列表"},
+	"GET /securityConfig/getSecurityConfig":                    {group: "安全配置", description: "获取安全配置"},
+	"GET /simpleUploader/checkFileMd5":                         {group: "断点续传(插件版)", description: "文件完整度验证"},
+	"GET /simpleUploader/mergeFileMd5":                         {group: "断点续传(插件版)", description: "上传完成合并文件"},
+	"GET /sysDictionary/exportSysDictionary":                   {group: "系统字典", description: "导出字典JSON"},
+	"GET /sysDictionary/findSysDictionary":                     {group: "系统字典", description: "根据ID获取字典（建议选择）"},
+	"GET /sysDictionary/getSysDictionaryList":                  {group: "系统字典", description: "获取字典列表"},
+	"GET /sysDictionary/getSysDictionaryListWithDetails":       {group: "系统字典", description: "获取字典列表(含明细)"},
+	"GET /sysDictionaryDetail/findSysDictionaryDetail":         {group: "系统字典详情", description: "根据ID获取字典内容"},
+	"GET /sysDictionaryDetail/getDictionaryDetailsByParent":    {group: "系统字典详情", description: "根据父级ID获取字典详情"},
+	"GET /sysDictionaryDetail/getDictionaryPath":               {group: "系统字典详情", description: "获取字典详情的完整路径"},
+	"GET /sysDictionaryDetail/getDictionaryTreeList":           {group: "系统字典详情", description: "获取字典数列表"},
+	"GET /sysDictionaryDetail/getDictionaryTreeListByType":     {group: "系统字典详情", description: "根据分类获取字典数列表"},
+	"GET /sysDictionaryDetail/getSysDictionaryDetailList":      {group: "系统字典详情", description: "获取字典内容列表"},
+	"GET /sysError/findSysError":                               {group: "错误日志", description: "根据ID获取错误日志"},
+	"GET /sysError/getSysErrorList":                            {group: "错误日志", description: "获取错误日志列表"},
+	"GET /sysError/getSysErrorSolution":                        {group: "错误日志", description: "触发错误处理(异步)"},
+	"GET /sysExportTemplate/exportExcel":                       {group: "导出模板", description: "导出Excel"},
+	"GET /sysExportTemplate/exportTemplate":                    {group: "导出模板", description: "下载模板"},
+	"GET /sysExportTemplate/findSysExportTemplate":             {group: "导出模板", description: "根据ID获取导出模板"},
+	"GET /sysExportTemplate/getSysExportTemplateList":          {group: "导出模板", description: "获取导出模板列表"},
+	"GET /sysExportTemplate/previewSQL":                        {group: "导出模板", description: "预览SQL"},
+	"GET /sysLoginLog/findLoginLog":                            {group: "登录日志", description: "根据ID获取登录日志"},
+	"GET /sysLoginLog/getLoginLogList":                         {group: "登录日志", description: "获取登录日志列表"},
+	"GET /sysOperationRecord/findSysOperationRecord":           {group: "操作记录", description: "根据ID获取操作记录"},
+	"GET /sysOperationRecord/getSysOperationRecordList":        {group: "操作记录", description: "获取操作记录列表"},
+	"GET /sysParams/findSysParams":                             {group: "参数管理", description: "根据ID获取参数"},
+	"GET /sysParams/getSysParam":                               {group: "参数管理", description: "获取参数列表"},
+	"GET /sysParams/getSysParamsList":                          {group: "参数管理", description: "获取参数列表"},
+	"GET /sysVersion/downloadVersionJson":                      {group: "版本控制", description: "下载版本json"},
+	"GET /sysVersion/findSysVersion":                           {group: "版本控制", description: "获取单一版本"},
+	"GET /sysVersion/getSysVersionList":                        {group: "版本控制", description: "获取版本列表"},
+	"GET /timedTask/alertStream":                               {group: "定时任务", description: "订阅定时任务失败告警(SSE)"},
+	"GET /timedTask/getRegisteredMethods":                      {group: "定时任务", description: "获取已注册方法列表"},
+	"GET /timedTask/getTimedTaskList":                          {group: "定时任务", description: "获取定时任务列表"},
+	"GET /timedTask/getTimedTaskLogList":                       {group: "定时任务", description: "获取定时任务执行日志"},
+	"GET /user/getUserInfo":                                    {group: "系统用户", description: "获取自身信息(必选)"},
+	"POST /api/createApi":                                      {group: "api", description: "创建api"},
+	"POST /api/deleteApi":                                      {group: "api", description: "删除Api"},
+	"POST /api/enterSyncApi":                                   {group: "api", description: "确认同步API"},
+	"POST /api/getAllApis":                                     {group: "api", description: "获取所有api"},
+	"POST /api/getApiById":                                     {group: "api", description: "获取api详细信息"},
+	"POST /api/getApiList":                                     {group: "api", description: "获取api列表"},
+	"POST /api/ignoreApi":                                      {group: "api", description: "忽略API"},
+	"POST /api/setApiRoles":                                    {group: "api", description: "全量覆盖API关联角色列表"},
+	"POST /api/updateApi":                                      {group: "api", description: "更新Api"},
+	"POST /attachmentCategory/addCategory":                     {group: "媒体库分类", description: "添加/编辑分类"},
+	"POST /attachmentCategory/deleteCategory":                  {group: "媒体库分类", description: "删除分类"},
+	"POST /authority/copyAuthority":                            {group: "角色", description: "拷贝角色"},
+	"POST /authority/createAuthority":                          {group: "角色", description: "创建角色"},
+	"POST /authority/deleteAuthority":                          {group: "角色", description: "删除角色"},
+	"POST /authority/getAuthorityList":                         {group: "角色", description: "获取角色列表"},
+	"POST /authority/setDataScope":                             {group: "角色", description: "设置角色数据权限"},
+	"POST /authority/setRoleUsers":                             {group: "角色", description: "全量覆盖角色关联用户"},
+	"POST /authorityBtn/canRemoveAuthorityBtn":                 {group: "按钮权限", description: "删除按钮"},
+	"POST /authorityBtn/getAuthorityBtn":                       {group: "按钮权限", description: "获取已有按钮权限"},
+	"POST /authorityBtn/setAuthorityBtn":                       {group: "按钮权限", description: "设置按钮权限"},
+	"POST /autoCode/initAPI":                                   {group: "代码生成器", description: "生成插件 API 初始化文件"},
+	"POST /autoCode/initDictionary":                            {group: "代码生成器", description: "生成插件字典初始化文件"},
+	"POST /autoCode/initMenu":                                  {group: "代码生成器", description: "生成插件菜单初始化文件"},
+	"POST /casbin/getPolicyPathByAuthorityId":                  {group: "casbin", description: "获取权限列表"},
+	"POST /casbin/updateCasbin":                                {group: "casbin", description: "更改角色api权限"},
+	"POST /customer/customer":                                  {group: "客户", description: "创建客户"},
+	"POST /dataAccessLog/getDataAccessLogList":                 {group: "数据权限审计", description: "获取数据权限审计日志"},
+	"POST /department/createDepartment":                        {group: "部门", description: "创建部门"},
+	"POST /department/getDepartmentList":                       {group: "部门", description: "获取部门树"},
+	"POST /department/setDepartmentUsers":                      {group: "部门", description: "设置部门成员(反向分配)"},
+	"POST /email/emailTest":                                    {group: "email", description: "发送测试邮件"},
+	"POST /email/sendEmail":                                    {group: "email", description: "发送邮件"},
+	"POST /fileUploadAndDownload/deleteFile":                   {group: "文件上传与下载", description: "删除文件"},
+	"POST /fileUploadAndDownload/editFileName":                 {group: "文件上传与下载", description: "文件名或者备注编辑"},
+	"POST /fileUploadAndDownload/getFileList":                  {group: "文件上传与下载", description: "获取上传文件列表"},
+	"POST /fileUploadAndDownload/importURL":                    {group: "文件上传与下载", description: "导入URL"},
+	"POST /fileUploadAndDownload/upload":                       {group: "文件上传与下载", description: "文件上传（建议选择）"},
+	"POST /info/createInfo":                                    {group: "公告", description: "新建公告"},
+	"POST /jwt/jsonInBlacklist":                                {group: "jwt", description: "jwt加入黑名单(退出，必选)"},
+	"POST /mediaUpload/chunk":                                  {group: "媒体上传", description: "上传分片"},
+	"POST /mediaUpload/complete":                               {group: "媒体上传", description: "完成大文件上传"},
+	"POST /mediaUpload/init":                                   {group: "媒体上传", description: "初始化大文件上传"},
+	"POST /menu/addBaseMenu":                                   {group: "菜单", description: "新增菜单"},
+	"POST /menu/addMenuAuthority":                              {group: "菜单", description: "增加menu和角色关联关系"},
+	"POST /menu/deleteBaseMenu":                                {group: "菜单", description: "删除菜单"},
+	"POST /menu/getBaseMenuById":                               {group: "菜单", description: "根据id获取菜单"},
+	"POST /menu/getBaseMenuTree":                               {group: "菜单", description: "获取用户动态路由"},
+	"POST /menu/getMenu":                                       {group: "菜单", description: "获取菜单树(必选)"},
+	"POST /menu/getMenuAuthority":                              {group: "菜单", description: "获取指定角色menu"},
+	"POST /menu/getMenuList":                                   {group: "菜单", description: "分页获取基础menu列表"},
+	"POST /menu/setMenuRoles":                                  {group: "菜单", description: "全量覆盖菜单关联角色列表"},
+	"POST /menu/updateBaseMenu":                                {group: "菜单", description: "更新菜单"},
+	"POST /position/createPosition":                            {group: "岗位", description: "创建岗位"},
+	"POST /position/getPositionList":                           {group: "岗位", description: "获取岗位列表"},
+	"POST /position/setPositionUsers":                          {group: "岗位", description: "设置岗位成员(反向分配)"},
+	"POST /securityConfig/setSecurityConfig":                   {group: "安全配置", description: "设置安全配置"},
+	"POST /simpleUploader/upload":                              {group: "断点续传(插件版)", description: "插件版分片上传"},
+	"POST /sysApiToken/createApiToken":                         {group: "API Token", description: "签发API Token"},
+	"POST /sysApiToken/deleteApiToken":                         {group: "API Token", description: "作废API Token"},
+	"POST /sysApiToken/getApiTokenList":                        {group: "API Token", description: "获取API Token列表"},
+	"POST /sysDictionary/createSysDictionary":                  {group: "系统字典", description: "新增字典"},
+	"POST /sysDictionary/importSysDictionary":                  {group: "系统字典", description: "导入字典JSON"},
+	"POST /sysDictionaryDetail/createSysDictionaryDetail":      {group: "系统字典详情", description: "新增字典内容"},
+	"POST /sysError/createSysError":                            {group: "错误日志", description: "新建错误日志"},
+	"POST /sysExportTemplate/createSysExportTemplate":          {group: "导出模板", description: "新增导出模板"},
+	"POST /sysExportTemplate/importExcel":                      {group: "导出模板", description: "导入Excel"},
+	"POST /sysOperationRecord/createSysOperationRecord":        {group: "操作记录", description: "新增操作记录"},
+	"POST /sysParams/createSysParams":                          {group: "参数管理", description: "新建参数"},
+	"POST /system/getServerInfo":                               {group: "系统服务", description: "获取服务器信息"},
+	"POST /system/getSystemConfig":                             {group: "系统服务", description: "获取配置文件内容"},
+	"POST /system/setSystemConfig":                             {group: "系统服务", description: "设置配置文件内容"},
+	"POST /sysVersion/exportVersion":                           {group: "版本控制", description: "创建版本"},
+	"POST /sysVersion/importVersion":                           {group: "版本控制", description: "同步版本"},
+	"POST /timedTask/createTimedTask":                          {group: "定时任务", description: "创建定时任务"},
+	"POST /timedTask/toggleTimedTask":                          {group: "定时任务", description: "启用/停用定时任务"},
+	"POST /timedTask/triggerTimedTask":                         {group: "定时任务", description: "手动触发定时任务"},
+	"POST /user/admin_register":                                {group: "系统用户", description: "用户注册"},
+	"POST /user/changePassword":                                {group: "系统用户", description: "修改密码（建议选择)"},
+	"POST /user/getUserList":                                   {group: "系统用户", description: "获取用户列表"},
+	"POST /user/resetPassword":                                 {group: "系统用户", description: "重置用户密码"},
+	"POST /user/setUserAuthorities":                            {group: "系统用户", description: "设置权限组"},
+	"POST /user/setUserAuthority":                              {group: "系统用户", description: "修改用户角色(必选)"},
+	"POST /user/setUserDepartments":                            {group: "系统用户", description: "设置用户归属部门"},
+	"POST /user/setUserPositions":                              {group: "系统用户", description: "设置用户岗位"},
+	"PUT /authority/updateAuthority":                           {group: "角色", description: "更新角色信息"},
+	"PUT /customer/customer":                                   {group: "客户", description: "更新客户"},
+	"PUT /department/updateDepartment":                         {group: "部门", description: "更新部门"},
+	"PUT /info/updateInfo":                                     {group: "公告", description: "更新公告"},
+	"PUT /position/updatePosition":                             {group: "岗位", description: "更新岗位"},
+	"PUT /sysDictionary/updateSysDictionary":                   {group: "系统字典", description: "更新字典"},
+	"PUT /sysDictionaryDetail/updateSysDictionaryDetail":       {group: "系统字典详情", description: "更新字典内容"},
+	"PUT /sysError/updateSysError":                             {group: "错误日志", description: "更新错误日志"},
+	"PUT /sysExportTemplate/updateSysExportTemplate":           {group: "导出模板", description: "更新导出模板"},
+	"PUT /sysParams/updateSysParams":                           {group: "参数管理", description: "更新参数"},
+	"PUT /timedTask/updateTimedTask":                           {group: "定时任务", description: "更新定时任务"},
+	"PUT /user/setSelfInfo":                                    {group: "系统用户", description: "设置自身信息(必选)"},
+	"PUT /user/setSelfSetting":                                 {group: "系统用户", description: "用户界面配置"},
+	"PUT /user/setUserInfo":                                    {group: "系统用户", description: "设置用户信息"},
+}
+
+func routeMetadata(method, path string) (string, string) {
+	if value, ok := apiMetadata[strings.ToUpper(method)+" "+path]; ok {
+		return value.group, value.description
+	}
+	return routeGroup(path), ""
+}

internal/service/authentication.go

@@ -8,6 +8,11 @@ import (
 	"kra/pkg/adminauth"
 )
 
+type UserDisabledError struct{ UserID uint }
+
+func (e *UserDisabledError) Error() string { return biz.ErrUserDisabled.Error() }
+func (e *UserDisabledError) Unwrap() error { return biz.ErrUserDisabled }
+
 type LoginResult struct {
 	User               map[string]any `json:"user"`
 	Token              string         `json:"token"`
@@ -34,7 +39,7 @@ func (s *SystemService) Login(ctx context.Context, username, password string) (*
 		return nil, err
 	}
 	if u.Enable != 1 {
-		return nil, biz.ErrUserDisabled
+		return nil, &UserDisabledError{UserID: u.ID}
 	}
 	if security, securityErr := s.settings.CurrentSecurity(ctx); securityErr == nil && security.PwdExpireEnable && u.PasswordUpdatedAt != nil && time.Since(*u.PasswordUpdatedAt) > time.Duration(security.PwdExpireDays)*24*time.Hour {
 		u.MustChangePassword = true

internal/service/dto/system_config.go

@@ -29,22 +29,37 @@ type SetSystemConfigRequest struct {
 	Config struct {
 		Data *struct {
 			Database *struct {
-				Driver   string `json:"driver"`
-				Source   string `json:"source"`
-				Host     string `json:"host"`
-				Port     string `json:"port"`
-				User     string `json:"user"`
-				Password string `json:"password"`
-				Name     string `json:"name"`
-				Config   string `json:"config"`
-				Path     string `json:"path"`
+				Driver          string `json:"driver"`
+				Source          string `json:"source"`
+				Host            string `json:"host"`
+				Port            string `json:"port"`
+				User            string `json:"user"`
+				Password        string `json:"password"`
+				Name            string `json:"name"`
+				Config          string `json:"config"`
+				Path            string `json:"path"`
+				Prefix          string `json:"prefix"`
+				Engine          string `json:"engine"`
+				LogMode         string `json:"log_mode"`
+				MaxIdleConns    int32  `json:"max_idle_conns"`
+				MaxOpenConns    int32  `json:"max_open_conns"`
+				ConnMaxLifetime int32  `json:"conn_max_lifetime"`
+				Singular        bool   `json:"singular"`
 			} `json:"database"`
 			Redis *struct {
-				Network      string `json:"network"`
-				Addr         string `json:"addr"`
-				ReadTimeout  string `json:"read_timeout"`
-				WriteTimeout string `json:"write_timeout"`
+				Network      string   `json:"network"`
+				Addr         string   `json:"addr"`
+				ReadTimeout  string   `json:"read_timeout"`
+				WriteTimeout string   `json:"write_timeout"`
+				Name         string   `json:"name"`
+				Password     string   `json:"password"`
+				DB           int32    `json:"db"`
+				UseCluster   bool     `json:"use_cluster"`
+				ClusterAddrs []string `json:"cluster_addrs"`
 			} `json:"redis"`
+			DatabaseList []*conf.Data_Database `json:"database_list"`
+			RedisList    []*conf.Data_Redis    `json:"redis_list"`
+			Mongo        *conf.Data_Mongo      `json:"mongo"`
 		} `json:"data"`
 		Admin struct {
 			RouterPrefix string `json:"routerPrefix"`
@@ -53,6 +68,7 @@ type SetSystemConfigRequest struct {
 				UseMultipoint      bool `json:"useMultipoint"`
 				UseStrictAuth      bool `json:"useStrictAuth"`
 				DisableAutoMigrate bool `json:"disableAutoMigrate"`
+				UseMongo           bool `json:"useMongo"`
 			} `json:"system"`
 			JWT struct {
 				SigningKey  string `json:"signingKey"`
@@ -74,6 +90,9 @@ type SetSystemConfigRequest struct {
 				SessionTTL int32 `json:"sessionTtl"`
 			} `json:"media"`
 			Storage *conf.AdminBackend_Storage `json:"storage"`
+			Zap     *conf.AdminBackend_Zap     `json:"zap"`
+			Cors    *conf.AdminBackend_CORS    `json:"cors"`
+			App     *conf.AdminBackend_App     `json:"app"`
 		} `json:"admin"`
 		Email *struct {
 			To          string `json:"to"`

internal/service/system_config.go

@@ -48,7 +48,7 @@ func (s *SystemService) SystemConfig() map[string]any {
 	}
 	admin["routerPrefix"] = config.RouterPrefix
 	if config.System != nil {
-		admin["system"] = map[string]any{"useRedis": config.System.UseRedis, "useMultipoint": config.System.UseMultipoint, "useStrictAuth": config.System.UseStrictAuth, "disableAutoMigrate": config.System.DisableAutoMigrate}
+		admin["system"] = map[string]any{"useRedis": config.System.UseRedis, "useMultipoint": config.System.UseMultipoint, "useStrictAuth": config.System.UseStrictAuth, "disableAutoMigrate": config.System.DisableAutoMigrate, "useMongo": config.System.UseMongo}
 	}
 	if config.Jwt != nil {
 		admin["jwt"] = map[string]any{"signingKey": "******", "expiresTime": config.Jwt.ExpiresTime.AsDuration().String(), "bufferTime": config.Jwt.BufferTime.AsDuration().String(), "issuer": config.Jwt.Issuer}
@@ -70,16 +70,36 @@ func (s *SystemService) SystemConfig() map[string]any {
 		maskStorageSecrets(storage)
 		admin["storage"] = storage
 	}
+	if config.Zap != nil {
+		admin["zap"] = config.Zap
+	}
+	if config.Cors != nil {
+		admin["cors"] = config.Cors
+	}
+	if config.App != nil {
+		admin["app"] = config.App
+	}
 	data := s.runtime.Data()
 	if data != nil {
 		if data.Database != nil {
 			data.Database.Password = "******"
 		}
+		if data.Redis != nil {
+			data.Redis.Password = "******"
+		}
+		if data.Mongo != nil {
+			data.Mongo.Password = "******"
+		}
 		for _, database := range data.DatabaseList {
 			if database != nil {
 				database.Password = "******"
 			}
 		}
+		for _, redis := range data.RedisList {
+			if redis != nil {
+				redis.Password = "******"
+			}
+		}
 	}
 	dataMap := map[string]any{}
 	if raw, err := (protojson.MarshalOptions{UseProtoNames: true}).Marshal(data); err == nil {
@@ -103,6 +123,16 @@ func (s *SystemService) SaveSystemConfig(ctx context.Context, req *dto.SetSystem
 	next.System.UseMultipoint = req.Config.Admin.System.UseMultipoint
 	next.System.UseStrictAuth = req.Config.Admin.System.UseStrictAuth
 	next.System.DisableAutoMigrate = req.Config.Admin.System.DisableAutoMigrate
+	next.System.UseMongo = req.Config.Admin.System.UseMongo
+	if req.Config.Admin.Zap != nil {
+		next.Zap = req.Config.Admin.Zap
+	}
+	if req.Config.Admin.Cors != nil {
+		next.Cors = req.Config.Admin.Cors
+	}
+	if req.Config.Admin.App != nil {
+		next.App = req.Config.Admin.App
+	}
 	if next.Jwt != nil {
 		if req.Config.Admin.JWT.SigningKey != "" && req.Config.Admin.JWT.SigningKey != "******" {
 			next.Jwt.SigningKey = req.Config.Admin.JWT.SigningKey
@@ -163,10 +193,14 @@ func (s *SystemService) SaveSystemConfig(ctx context.Context, req *dto.SetSystem
 			if data.Database != nil && (password == "" || password == "******") {
 				password = data.Database.Password
 			}
-			data.Database = &conf.Data_Database{Driver: value.Driver, Source: value.Source, Host: value.Host, Port: value.Port, User: value.User, Password: password, Name: value.Name, Config: value.Config, Path: value.Path}
+			data.Database = &conf.Data_Database{Driver: value.Driver, Source: value.Source, Host: value.Host, Port: value.Port, User: value.User, Password: password, Name: value.Name, Config: value.Config, Path: value.Path, Prefix: value.Prefix, Engine: value.Engine, LogMode: value.LogMode, MaxIdleConns: value.MaxIdleConns, MaxOpenConns: value.MaxOpenConns, ConnMaxLifetime: value.ConnMaxLifetime, Singular: value.Singular}
 		}
 		if value := req.Config.Data.Redis; value != nil {
-			redis := &conf.Data_Redis{Network: value.Network, Addr: value.Addr}
+			password := value.Password
+			if data.Redis != nil && (password == "" || password == "******") {
+				password = data.Redis.Password
+			}
+			redis := &conf.Data_Redis{Network: value.Network, Addr: value.Addr, Name: value.Name, Password: password, Db: value.DB, UseCluster: value.UseCluster, ClusterAddrs: value.ClusterAddrs}
 			if duration, parseErr := time.ParseDuration(value.ReadTimeout); parseErr == nil && duration >= 0 {
 				redis.ReadTimeout = durationpb.New(duration)
 			}
@@ -175,6 +209,28 @@ func (s *SystemService) SaveSystemConfig(ctx context.Context, req *dto.SetSystem
 			}
 			data.Redis = redis
 		}
+		if req.Config.Data.DatabaseList != nil {
+			for i, item := range req.Config.Data.DatabaseList {
+				if item != nil && (item.Password == "" || item.Password == "******") && i < len(data.DatabaseList) && data.DatabaseList[i] != nil {
+					item.Password = data.DatabaseList[i].Password
+				}
+			}
+			data.DatabaseList = req.Config.Data.DatabaseList
+		}
+		if req.Config.Data.RedisList != nil {
+			for i, item := range req.Config.Data.RedisList {
+				if item != nil && (item.Password == "" || item.Password == "******") && i < len(data.RedisList) && data.RedisList[i] != nil {
+					item.Password = data.RedisList[i].Password
+				}
+			}
+			data.RedisList = req.Config.Data.RedisList
+		}
+		if req.Config.Data.Mongo != nil {
+			if data.Mongo != nil && (req.Config.Data.Mongo.Password == "" || req.Config.Data.Mongo.Password == "******") {
+				req.Config.Data.Mongo.Password = data.Mongo.Password
+			}
+			data.Mongo = req.Config.Data.Mongo
+		}
 	}
 	dataRaw, err := protojson.MarshalOptions{UseProtoNames: true}.Marshal(data)
 	if err != nil {

internal/service/system_init.go

@@ -14,10 +14,10 @@ type DatabaseInit struct {
 	Port          string `json:"port"`
 	UserName      string `json:"userName"`
 	Password      string `json:"password"`
-	DBName        string `json:"dbName"`
+	DBName        string `json:"dbName" binding:"required"`
 	DBPath        string `json:"dbPath"`
 	Template      string `json:"template"`
-	AdminPassword string `json:"adminPassword"`
+	AdminPassword string `json:"adminPassword" binding:"required"`
 }
 
 func (s *SystemService) Initialize(ctx context.Context, input *DatabaseInit, apis []*biz.API) error {
@@ -34,7 +34,15 @@ func (s *SystemService) Initialize(ctx context.Context, input *DatabaseInit, api
 func (s *SystemService) InitializeRoutes(ctx context.Context, input *DatabaseInit, routes []dto.Route) error {
 	apis := make([]*biz.API, 0, len(routes))
 	for _, route := range routes {
-		apis = append(apis, &biz.API{Path: route.Path, Method: route.Method, APIGroup: routeGroup(route.Path)})
+		path := route.Path
+		if config := s.runtime.Admin(); config != nil && config.RouterPrefix != "" {
+			path = strings.TrimPrefix(path, strings.TrimSuffix(config.RouterPrefix, "/"))
+			if path == "" {
+				path = "/"
+			}
+		}
+		group, description := routeMetadata(route.Method, path)
+		apis = append(apis, &biz.API{Path: path, Method: route.Method, APIGroup: group, Description: description})
 	}
 	return s.Initialize(ctx, input, apis)
 }