oyaegeli98668
c9a4404052
- 公开前端 SPA（根路径 /）：首页大搜索框、检索结果、只读商品详情、贡献档案表单 - 公开写入端点 POST /api/public/submissions（无需登录，基础频率限流），投稿进入 submission 待审核队列，不直接写 product - 迁移 0006：submission 投稿表 + community 来源(trust=0.50) - 后台审核队列：列表(待审核/已通过/已驳回) → 查看投稿 → 通过(创建/补全商品 + 记 source=community + 字段级溯源 + 审计 + 重算质量分) / 驳回(记原因) - 公开只读 api 服务内嵌公开 SPA；Dockerfile.prod 增加 node 构建阶段 + 内嵌 dist Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
42 lines
900 B
Go
42 lines
900 B
Go
package adminhandler
|
|
|
|
import (
|
|
"sync"
|
|
"time"
|
|
)
|
|
|
|
// rateLimiter is a simple fixed-window per-key limiter used to throttle
|
|
// anonymous public submissions (basic anti-spam; captcha can be added later).
|
|
type rateLimiter struct {
|
|
mu sync.Mutex
|
|
hits map[string][]time.Time
|
|
limit int
|
|
window time.Duration
|
|
}
|
|
|
|
func newRateLimiter(limit int, window time.Duration) *rateLimiter {
|
|
return &rateLimiter{hits: map[string][]time.Time{}, limit: limit, window: window}
|
|
}
|
|
|
|
// allow reports whether the key may proceed, recording the hit if so.
|
|
func (r *rateLimiter) allow(key string) bool {
|
|
now := time.Now()
|
|
cutoff := now.Add(-r.window)
|
|
|
|
r.mu.Lock()
|
|
defer r.mu.Unlock()
|
|
|
|
kept := r.hits[key][:0]
|
|
for _, t := range r.hits[key] {
|
|
if t.After(cutoff) {
|
|
kept = append(kept, t)
|
|
}
|
|
}
|
|
if len(kept) >= r.limit {
|
|
r.hits[key] = kept
|
|
return false
|
|
}
|
|
r.hits[key] = append(kept, now)
|
|
return true
|
|
}
|