feat: update template

internal/pkg/httputil/request.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"net"
 	"net/http"
+	"net/netip"
 	"net/url"
 	"server/internal/config"
 	"server/internal/model/common"
@@ -58,8 +59,19 @@ func URLParamInt32(r *http.Request, key string) (int32, error) {
 	return int32(n), nil
 }
 
-func BindJson(r *http.Request, dest any) error {
+// maxJSONBodySize JSON 请求体上限（1MB）
+const maxJSONBodySize = 1 << 20
+
+func BindJson(w http.ResponseWriter, r *http.Request, dest any) error {
+	// 超限时 Decode 返回 *http.MaxBytesError → 413
+	r.Body = http.MaxBytesReader(w, r.Body, maxJSONBodySize)
+
 	if err := json.NewDecoder(r.Body).Decode(dest); err != nil {
+		var maxBytesErr *http.MaxBytesError
+		if errors.As(err, &maxBytesErr) {
+			return errs.ErrBodyTooLarge
+		}
+
 		if errors.Is(err, io.EOF) {
 			return errs.ErrEmptyBody
 		}
@@ -73,17 +85,28 @@ func BindJson(r *http.Request, dest any) error {
 	return nil
 }
 
-// ClientIP 获取客户端 IP，依次从 X-Forwarded-For、X-Real-IP、RemoteAddr 取值
-func ClientIP(r *http.Request) string {
-	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
-		parts := strings.Split(xff, ",")
-		if len(parts) > 0 {
-			return strings.TrimSpace(parts[0])
-		}
-	}
+// ClientIP 获取客户端 IP；trust_proxy=true 时信任代理头，否则用 RemoteAddr（防伪造）
+func ClientIP(r *http.Request) netip.Addr {
+	addr, _ := netip.ParseAddr(clientIPString(r))
+	return addr
+}
 
-	if ip := r.Header.Get("X-Real-IP"); ip != "" {
-		return ip
+func clientIPString(r *http.Request) string {
+	// 只在 trust_proxy=true 时信任代理头（防伪造）
+	if config.GetBool("server.trust_proxy") {
+		if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+			parts := strings.Split(xff, ",")
+			for _, v := range parts {
+				if ip := strings.TrimSpace(v); ip != "" {
+					return ip
+				}
+			}
+		}
+
+		// 再取 X-Real-IP（nginx 单层代理覆盖时最准）
+		if realIP := strings.TrimSpace(r.Header.Get("X-Real-IP")); realIP != "" {
+			return realIP
+		}
 	}
 
 	// RemoteAddr: IP:port
@@ -91,7 +114,6 @@ func ClientIP(r *http.Request) string {
 	if err == nil {
 		return host
 	}
-
 	return r.RemoteAddr
 }