chore: initial commit

internal/config/config.go

@@ -0,0 +1,106 @@
+package config
+
+import (
+	"fmt"
+	"log/slog"
+	"os"
+	"time"
+
+	"github.com/knadh/koanf"
+	"github.com/knadh/koanf/parsers/yaml"
+	"github.com/knadh/koanf/providers/file"
+)
+
+const (
+	Development = "development"
+	Production  = "production"
+)
+
+var K = koanf.New(".")
+
+type Server struct {
+	Port string `koanf:"port"`
+	Host string `koanf:"host"`
+}
+
+type Database struct {
+	Host     string `koanf:"host"`
+	Port     int    `koanf:"port"`
+	User     string `koanf:"user"`
+	Password string `koanf:"password"`
+	DBName   string `koanf:"dbname"`
+	SSLMode  string `koanf:"sslMode"`
+}
+
+type JWTConfig struct {
+	Secret        string        `koanf:"secret"`
+	SigningMethod string        `koanf:"signing_method"`
+	Expire        time.Duration `koanf:"expire"`
+	RefreshExpire time.Duration `koanf:"refresh_expire"`
+	Issuer        string        `koanf:"issuer"`
+	Audience      string        `koanf:"audience"`
+	TokenHeader   string        `koanf:"token_header"`
+	TokenPrefix   string        `koanf:"token_prefix"`
+}
+
+type LogConfig struct {
+	Level      string `koanf:"level"`
+	Filename   string `koanf:"filename"`
+	MaxSize    int    `koanf:"max_size"`
+	MaxBackups int    `koanf:"max_backups"`
+	MaxAge     int    `koanf:"max_age"`
+	Compress   bool   `koanf:"compress"`
+	Console    bool   `koanf:"console"`
+}
+
+type Config struct {
+	Server    Server    `koanf:"server"`
+	Database  Database  `koanf:"database"`
+	JWTConfig JWTConfig `koanf:"jwt"`
+	Log       LogConfig `koanf:"log"`
+}
+
+// GetEnv 获取环境变量，确保环境变量始终有效
+func GetEnv() string {
+	env := os.Getenv("APP_ENV")
+	if env == "" {
+		env = Development
+	}
+
+	switch env {
+	case Development, Production:
+		return env
+	default:
+		return Development
+	}
+}
+
+func IsDev() bool {
+	return GetEnv() == Development
+}
+
+func NewConfig() (*Config, error) {
+	env := GetEnv()
+	filepath := fmt.Sprintf("%s.yaml", env)
+
+	if err := K.Load(file.Provider(filepath), yaml.Parser()); err != nil {
+		slog.Error("error loading config", "error", err)
+		return nil, err
+	}
+
+	var cfg Config
+	if err := K.Unmarshal("", &cfg); err != nil {
+		slog.Error("error unmarshaling config", "error", err)
+		return nil, err
+	}
+
+	return &cfg, nil
+}
+
+func GetString(key string) string {
+	return K.String(key)
+}
+
+func GetInt(key string) int {
+	return K.Int(key)
+}

internal/db/db.go

@@ -0,0 +1,48 @@
+package db
+
+import (
+	"context"
+	"fmt"
+	"server/internal/config"
+	"server/internal/db/sqlc"
+
+	"github.com/jackc/pgx/v5/pgxpool"
+	"go.uber.org/fx"
+)
+
+func NewDB(lc fx.Lifecycle, cfg *config.Config) (*pgxpool.Pool, error) {
+	ctx := context.Background()
+	dbConfig := cfg.Database
+
+	dsn := fmt.Sprintf("host=%s port=%d user=%s password=%s dbname=%s sslmode=%s",
+		dbConfig.Host, dbConfig.Port, dbConfig.User, dbConfig.Password, dbConfig.DBName, dbConfig.SSLMode)
+
+	// 创建连接池
+	pool, err := pgxpool.New(ctx, dsn)
+	if err != nil {
+		return nil, err
+	}
+
+	// 注册fx生命周期钩子
+	lc.Append(fx.Hook{
+		OnStart: func(ctx context.Context) error {
+			return nil
+		},
+		OnStop: func(ctx context.Context) error {
+			pool.Close()
+			return nil
+		},
+	})
+
+	// 测试连接
+	if err = pool.Ping(ctx); err != nil {
+		pool.Close()
+		return nil, fmt.Errorf("failed to ping database: %w", err)
+	}
+
+	return pool, nil
+}
+
+func NewQueries(pool *pgxpool.Pool) *db.Queries {
+	return db.New(pool)
+}

internal/db/migrations/000001_init.down.sql

@@ -0,0 +1,32 @@
+-- migrate/down.sql
+-- 此文件用于撤销 up.sql 文件的所有操作
+-- 注意：执行此脚本将会永久删除相关表和数据！
+
+-- 移除表上的触发器
+-- 必须在删除表和函数之前移除依赖它们的触发器
+DROP TRIGGER IF EXISTS update_sys_users_updated_at ON sys_users;
+DROP TRIGGER IF EXISTS update_sys_roles_updated_at ON sys_roles;
+DROP TRIGGER IF EXISTS update_sys_menus_updated_at ON sys_menus;
+DROP TRIGGER IF EXISTS update_sys_permissions_updated_at ON sys_permissions;
+DROP TRIGGER IF EXISTS update_sys_apis_updated_at ON sys_apis;
+DROP TRIGGER IF EXISTS update_files_updated_at ON files;
+
+-- 删除索引
+DROP INDEX IF EXISTS idx_sys_users_account;
+
+-- 移除表
+-- 按照与创建相反的顺序删除，先删除依赖其他表的表
+DROP TABLE IF EXISTS sys_api_permission;
+DROP TABLE IF EXISTS sys_apis;
+DROP TABLE IF EXISTS sys_menu_permission;
+DROP TABLE IF EXISTS sys_role_permission;
+DROP TABLE IF EXISTS sys_user_role;
+DROP TABLE IF EXISTS sys_permissions;
+DROP TABLE IF EXISTS sys_menus;
+DROP TABLE IF EXISTS sys_roles;
+DROP TABLE IF EXISTS sys_users;
+DROP TABLE IF EXISTS files;
+
+-- 移除触发器函数
+-- 在所有使用此函数的触发器都被移除后，可以安全地删除此函数
+DROP FUNCTION IF EXISTS update_updated_at_column;

internal/db/migrations/000001_init.up.sql

@@ -0,0 +1,221 @@
+--------------------------------------------------------------------------------------------------------------
+-- function
+CREATE
+    OR REPLACE FUNCTION update_updated_at_column()
+    RETURNS TRIGGER AS
+$$
+BEGIN
+    NEW.updated_at
+        := NOW();
+    RETURN NEW;
+END;
+$$
+    language 'plpgsql';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_users
+(
+    id            INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    account       TEXT      NOT NULL UNIQUE,
+    username      TEXT      NOT NULL,
+    password_hash TEXT      NOT NULL,
+    avatar_id     INTEGER,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at    TIMESTAMPTZ
+);
+
+CREATE INDEX idx_sys_users_account ON sys_users (account);
+
+CREATE TRIGGER update_sys_users_updated_at
+    BEFORE UPDATE
+    ON sys_users
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+
+COMMENT ON COLUMN sys_users.id IS '主键ID';
+COMMENT ON COLUMN sys_users.account IS '用户账号';
+COMMENT ON COLUMN sys_users.username IS '用户名称';
+COMMENT ON COLUMN sys_users.password_hash IS 'hash密码';
+COMMENT ON COLUMN sys_users.avatar_id IS '头像文件id';
+COMMENT ON COLUMN sys_users.created_at IS '创建时间';
+COMMENT ON COLUMN sys_users.updated_at IS '更新时间';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_roles
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    name       TEXT      NOT NULL,
+    code       TEXT      NOT NULL UNIQUE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ
+);
+
+CREATE TRIGGER update_sys_roles_updated_at
+    BEFORE UPDATE
+    ON sys_roles
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_roles.id IS '主键ID';
+COMMENT ON COLUMN sys_roles.name IS '角色名称';
+COMMENT ON COLUMN sys_roles.code IS '角色编码，唯一';
+COMMENT ON COLUMN sys_roles.created_at IS '创建时间';
+COMMENT ON COLUMN sys_roles.updated_at IS '更新时间';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_permissions
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    code       TEXT UNIQUE,
+    type       SMALLINT  NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ,
+
+    CONSTRAINT unique_type_code UNIQUE (type, code)
+);
+
+CREATE TRIGGER update_sys_permissions_updated_at
+    BEFORE UPDATE
+    ON sys_permissions
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_permissions.id IS '主键ID';
+COMMENT ON COLUMN sys_permissions.code IS '权限字符，唯一';
+COMMENT ON COLUMN sys_permissions.code IS '权限类型，0: 菜单 1: api';
+COMMENT ON COLUMN sys_permissions.created_at IS '创建时间';
+COMMENT ON COLUMN sys_permissions.updated_at IS '更新时间';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_menus
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    name       TEXT      NOT NULL,
+    path       TEXT      NOT NULL,
+    component  TEXT,
+    type       SMALLINT  NOT NULL,
+    hidden     BOOLEAN            DEFAULT FALSE,
+    sort       INTEGER            DEFAULT 0,
+    status     SMALLINT  NOT NULL DEFAULT 1,
+    parent_id  INTEGER,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ,
+
+    CHECK (type IN (0, 1, 2)),
+    CHECK (status IN (0, 1))
+);
+
+
+CREATE TRIGGER update_sys_menus_updated_at
+    BEFORE UPDATE
+    ON sys_menus
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_menus.id IS '主键ID';
+COMMENT ON COLUMN sys_menus.name IS '菜单名称';
+COMMENT ON COLUMN sys_menus.path IS '菜单路径';
+COMMENT ON COLUMN sys_menus.component IS '组件路径';
+COMMENT ON COLUMN sys_menus.type IS '菜单类型 0: 目录 1: 菜单 2: button';
+COMMENT ON COLUMN sys_menus.sort IS '菜单排序';
+COMMENT ON COLUMN sys_menus.hidden IS '是否隐藏菜单';
+COMMENT ON COLUMN sys_menus.status IS '菜单状态 1: 启用 0: 禁用';
+COMMENT ON COLUMN sys_menus.parent_id IS '父级id';
+COMMENT ON COLUMN sys_menus.created_at IS '创建时间';
+COMMENT ON COLUMN sys_menus.updated_at IS '更新时间';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_apis
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    group_name TEXT      NOT NULL,
+    name       TEXT      NOT NULL,
+    method     TEXT      NOT NULL,
+    path       TEXT      NOT NULL,
+    sort       INTEGER            DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ,
+
+    UNIQUE (method, path)
+);
+
+CREATE TRIGGER update_sys_apis_updated_at
+    BEFORE UPDATE
+    ON sys_apis
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_apis.id IS '主键ID';
+COMMENT ON COLUMN sys_apis.group_name IS '分组名称';
+COMMENT ON COLUMN sys_apis.name IS '接口名称';
+COMMENT ON COLUMN sys_apis.method IS 'api方法';
+COMMENT ON COLUMN sys_apis.path IS 'api路径';
+COMMENT ON COLUMN sys_apis.sort IS '排序';
+COMMENT ON COLUMN sys_apis.created_at IS '创建时间';
+COMMENT ON COLUMN sys_apis.updated_at IS '更新时间';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE files
+(
+    id            INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    file_name     TEXT      NOT NULL,
+    file_path     TEXT      NOT NULL,
+    original_name TEXT      NOT NULL,
+    folder_name   TEXT      NOT NULL,
+    mime_type     TEXT      NOT NULL,
+    file_size     BIGINT    NOT NULL,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at    TIMESTAMPTZ
+);
+
+CREATE TRIGGER update_files_updated_at
+    BEFORE UPDATE
+    ON files
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN files.id IS '主键ID';
+COMMENT ON COLUMN files.file_name IS '文件名 xxx.jpg';
+COMMENT ON COLUMN files.file_path IS '文件路径 带path /xxx/xxx.jpg';
+COMMENT ON COLUMN files.original_name IS '原始文件名';
+COMMENT ON COLUMN files.folder_name IS '文件夹名称';
+COMMENT ON COLUMN files.mime_type IS 'mime_type';
+COMMENT ON COLUMN files.file_size IS '文件大小';
+COMMENT ON COLUMN files.created_at IS '上传时间';
+COMMENT ON COLUMN files.updated_at IS '修改时间';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_user_role
+(
+    user_id INTEGER NOT NULL,
+    role_id INTEGER NOT NULL,
+    PRIMARY KEY (user_id, role_id)
+);
+
+COMMENT ON COLUMN sys_user_role.user_id IS '用户ID';
+COMMENT ON COLUMN sys_user_role.role_id IS '角色ID';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_role_permission
+(
+    role_id       INTEGER NOT NULL,
+    permission_id INTEGER NOT NULL,
+    PRIMARY KEY (role_id, permission_id)
+);
+
+COMMENT ON COLUMN sys_role_permission.role_id IS '角色id';
+COMMENT ON COLUMN sys_role_permission.permission_id IS '权限id';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_menu_permission
+(
+    menu_id       INTEGER NOT NULL,
+    permission_id INTEGER NOT NULL,
+    PRIMARY KEY (menu_id, permission_id)
+);
+
+COMMENT ON COLUMN sys_menu_permission.menu_id IS '菜单id';
+COMMENT ON COLUMN sys_menu_permission.permission_id IS '权限id';
+--------------------------------------------------------------------------------------------------------------
+CREATE TABLE sys_api_permission
+(
+    api_id        INTEGER NOT NULL,
+    permission_id INTEGER NOT NULL,
+    PRIMARY KEY (api_id, permission_id)
+);
+
+COMMENT ON COLUMN sys_api_permission.api_id IS 'api ID';
+COMMENT ON COLUMN sys_api_permission.permission_id IS '权限id';
+--------------------------------------------------------------------------------------------------------------

internal/db/migrations/000002_seed.up.sql

@@ -0,0 +1,83 @@
+-- 创建用户
+INSERT INTO sys_users (account, username, password_hash, avatar_id, created_at)
+VALUES ('admin', '管理员', '$2a$10$d/xYJVUFTmpSVUaV3uawZ.7hj6FanbooMJ9YjsFOmQKNopWc6oR9i', NULL,
+        '2025-10-18 03:05:54.692714');
+
+-- 批量插入菜单及关联权限
+WITH input(name, path, component, type, sort, status, code)
+         AS (VALUES ('首页', '/', '/system/home/index', 1, 0, 1, 'home'),
+                    ('用户管理', '/user', '/system/user/index', 1, 1, 1, 'user'),
+                    ('角色管理', '/role', '/system/role/index', 1, 2, 1, 'role'),
+                    ('菜单管理', '/menu', '/system/menu/index', 1, 3, 1, 'menu'),
+                    ('接口管理', '/sys_api', '/system/api/index', 1, 4, 1, 'api'),
+                    ('文件管理', '/file', '/system/file/index', 1, 5, 1, 'file')),
+     -- 插入菜单
+     inserted_menus AS (
+         INSERT INTO sys_menus (name, path, component, type, sort, status)
+             SELECT name, path, component, type, sort, status FROM input RETURNING id),
+     menu_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn FROM inserted_menus),
+     -- 插入权限
+     inserted_permissions AS (
+         INSERT INTO sys_permissions (type, code)
+             SELECT 0, code FROM input RETURNING id),
+     permission_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn FROM inserted_permissions)
+-- 关联权限
+INSERT
+INTO sys_menu_permission(menu_id, permission_id)
+SELECT m.id, p.id
+FROM menu_rows m
+         JOIN permission_rows p ON m.rn = p.rn;
+
+-- 批量插入接口及关联权限
+WITH inserted_apis AS (
+    -- 插入菜单
+    INSERT INTO sys_apis (group_name, name, method, path)
+        VALUES ('用户管理', '用户列表', 'GET', '/admin/user'),
+               ('用户管理', '用户信息', 'GET', '/admin/user/info'),
+               ('用户管理', '查询用户', 'GET', '/admin/user/{id}'),
+               ('用户管理', '用户角色', 'GET', '/admin/user/{id}/roles'),
+               ('用户管理', '创建用户', 'POST', '/admin/user'),
+               ('用户管理', '修改用户', 'PATCH', '/admin/user/{id}'),
+               ('用户管理', '删除用户', 'DELETE', '/admin/user/{id}'),
+               ('用户管理', '分配用户角色', 'PUT', '/admin/user/{id}/roles'),
+               ('用户管理', '修改密码', 'PATCH', '/admin/user/{id}/password'),
+               --
+               ('角色管理', '角色列表', 'GET', '/admin/role'),
+               ('角色管理', '创建角色', 'POST', '/admin/role'),
+               ('角色管理', '所有角色', 'GET', '/admin/role/all'),
+               ('角色管理', '单个角色', 'GET', '/admin/role/{id}'),
+               ('角色管理', '角色菜单', 'GET', '/admin/role/{id}/menus'),
+               ('角色管理', '角色接口', 'GET', '/admin/role/{id}/apis'),
+               ('角色管理', '修改角色', 'PATCH', '/admin/role/{id}'),
+               ('角色管理', '删除角色', 'DELETE', '/admin/role/{id}'),
+               ('角色管理', '分配角色菜单', 'PUT', '/admin/role/{id}/menus'),
+               ('角色管理', '分配角色接口', 'PUT', '/admin/role/{id}/apis'),
+               --
+               ('接口管理', '接口列表', 'GET', '/admin/api'),
+               ('接口管理', '所有接口', 'GET', '/admin/api/all'),
+               ('接口管理', '接口分组', 'GET', '/admin/api/group_names'),
+               ('接口管理', '创建接口', 'POST', '/admin/api'),
+               ('接口管理', '修改接口', 'PATCH', '/admin/api/{id}'),
+               ('接口管理', '删除接口', 'DELETE', '/admin/api/{id}'),
+               --
+               ('菜单管理', '菜单列表', 'GET', '/admin/menu'),
+               ('菜单管理', '创建菜单', 'POST', '/admin/menu'),
+               ('菜单管理', '所有菜单', 'GET', '/admin/menu/all'),
+               ('菜单管理', '修改菜单', 'PATCH', '/admin/menu/{id}'),
+               ('菜单管理', '删除菜单', 'DELETE', '/admin/menu/{id}'),
+               --
+               ('文件管理', '文件列表', 'GET', '/admin/file'),
+               ('文件管理', '上传文件', 'POST', '/admin/file') RETURNING id),
+     api_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn
+                  FROM inserted_apis),
+     -- 创建权限
+     inserted_permissions AS (
+         INSERT INTO sys_permissions (type)
+             SELECT 1 FROM api_rows RETURNING id),
+     permission_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn
+                         FROM inserted_permissions)
+INSERT
+INTO sys_api_permission(api_id, permission_id)
+SELECT a.id, b.id
+FROM api_rows a
+         INNER JOIN permission_rows b ON a.rn = b.rn;

internal/db/migrations/000003_add_posts.down.sql

@@ -0,0 +1,19 @@
+DELETE FROM sys_api_permission
+WHERE api_id IN (SELECT id FROM sys_apis WHERE group_name = '文章管理');
+
+DELETE FROM sys_permissions
+WHERE id IN (
+    SELECT permission_id FROM sys_api_permission
+    WHERE api_id IN (SELECT id FROM sys_apis WHERE group_name = '文章管理')
+);
+
+DELETE FROM sys_apis WHERE group_name = '文章管理';
+
+DELETE FROM sys_menu_permission
+WHERE menu_id IN (SELECT id FROM sys_menus WHERE path = '/post');
+
+DELETE FROM sys_permissions WHERE code = 'post' AND type = 1;
+
+DELETE FROM sys_menus WHERE path = '/post';
+
+DROP TABLE IF EXISTS posts;

internal/db/migrations/000003_add_posts.up.sql

@@ -0,0 +1,82 @@
+CREATE TABLE posts
+(
+    id           INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    title        TEXT        NOT NULL,
+    cover_id     INTEGER,
+    slug         TEXT UNIQUE NOT NULL,
+    content      TEXT       NOT NULL,
+    summary      TEXT        NOT NULL,
+    status       SMALLINT    NOT NULL DEFAULT 1,
+    view         INTEGER              DEFAULT 0,
+    sort         INTEGER              DEFAULT 0,
+    published_at TIMESTAMPTZ   NOT NULL DEFAULT NOW(),
+    created_at   TIMESTAMPTZ   NOT NULL DEFAULT NOW(),
+    updated_at   TIMESTAMPTZ,
+
+    CHECK (status IN (0, 1, 2))
+);
+
+CREATE TRIGGER update_posts_updated_at
+    BEFORE UPDATE
+    ON posts
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+
+COMMENT ON COLUMN posts.id IS '主键ID';
+COMMENT ON COLUMN posts.title IS '文章标题';
+COMMENT ON COLUMN posts.cover_id IS '文章封面图片id';
+COMMENT ON COLUMN posts.slug IS 'URL友好地址';
+COMMENT ON COLUMN posts.content IS '文章正文';
+COMMENT ON COLUMN posts.summary IS '摘要';
+COMMENT ON COLUMN posts.status IS '状态 0:草稿 1:已发布 2:已下线';
+COMMENT ON COLUMN posts.view IS '阅读量';
+COMMENT ON COLUMN posts.sort IS '文章排序';
+COMMENT ON COLUMN posts.published_at IS '发布时间';
+COMMENT ON COLUMN posts.created_at IS '创建时间';
+COMMENT ON COLUMN posts.updated_at IS '修改时间';
+
+-- 批量插入菜单及关联权限
+WITH input(name, path, component, type, sort, status, code)
+         AS (VALUES ('文章管理', '/post', '/blog/post/index', 1, 6, 1, 'post'),
+                    ('文章编辑', '/post/edit', '/blog/post-edit/index', 1, 7, 1, 'post:edit')
+             ),
+     -- 插入菜单
+     inserted_menus AS (
+         INSERT INTO sys_menus (name, path, component, type, sort, status)
+             SELECT name, path, component, type, sort, status FROM input RETURNING id),
+     menu_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn FROM inserted_menus),
+     -- 插入权限
+     inserted_permissions AS (
+         INSERT INTO sys_permissions (type, code)
+             SELECT 0, code FROM input RETURNING id),
+     permission_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn FROM inserted_permissions)
+-- 关联权限
+INSERT
+INTO sys_menu_permission(menu_id, permission_id)
+SELECT m.id, p.id
+FROM menu_rows m
+         JOIN permission_rows p ON m.rn = p.rn;
+
+-- 批量插入接口及关联权限
+WITH inserted_apis AS (
+-- 插入菜单
+    INSERT INTO sys_apis (group_name, name, method, path)
+        VALUES ('文章管理', '文章列表', 'GET', '/admin/post'),
+               ('文章管理', '创建文章', 'POST', '/admin/post'),
+               ('文章管理', '修改文章', 'PATCH', '/admin/post/{id}'),
+               ('文章管理', '删除文章', 'DELETE', '/admin/post/{id}')
+        RETURNING id),
+     api_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn
+                  FROM inserted_apis),
+     -- 创建权限
+     inserted_permissions AS (
+         INSERT INTO sys_permissions (type)
+             SELECT 1 FROM api_rows RETURNING id),
+     permission_rows AS (SELECT id, ROW_NUMBER() OVER () AS rn
+                         FROM inserted_permissions)
+INSERT
+INTO sys_api_permission(api_id, permission_id)
+SELECT a.id, b.id
+FROM api_rows a
+         INNER JOIN permission_rows b ON a.rn = b.rn;

internal/db/migrations/000004_add_categories.down.sql

@@ -0,0 +1,2 @@
+DROP TABLE IF EXISTS categories;
+DROP TABLE IF EXISTS post_category;

internal/db/migrations/000004_add_categories.up.sql

@@ -0,0 +1,30 @@
+-- 分类表
+CREATE TABLE categories
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    name       TEXT        NOT NULL,
+    code       TEXT UNIQUE NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ
+);
+
+CREATE TRIGGER update_categories_updated_at
+    BEFORE UPDATE
+    ON categories
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN categories.id IS '分类ID';
+COMMENT ON COLUMN categories.name IS '分类名称';
+COMMENT ON COLUMN categories.code IS '分类编码';
+
+-- 关联表
+CREATE TABLE post_category
+(
+    post_id INT NOT NULL,
+    category_id INT NOT NULL,
+    PRIMARY KEY (post_id, category_id)
+);
+
+COMMENT ON COLUMN post_category.post_id IS '文章ID';
+COMMENT ON COLUMN post_category.category_id IS '分类ID';

internal/db/migrations/000005_add_post_stats_drop_posts_view.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS post_stats;

internal/db/migrations/000005_add_post_stats_drop_posts_view.up.sql

@@ -0,0 +1,12 @@
+CREATE TABLE post_stats
+(
+    post_id INTEGER PRIMARY KEY,
+    view    INTEGER NOT NULL DEFAULT 0
+);
+
+COMMENT ON COLUMN post_stats.post_id IS '文章id';
+COMMENT ON COLUMN post_stats.view IS '文章阅读量';
+
+-- 删除view字段
+ALTER TABLE posts
+    DROP COLUMN IF EXISTS view;

internal/db/migrations/000006_add_icon_column_to_sys_menus.down.sql

@@ -0,0 +1,2 @@
+ALTER TABLE sys_menus
+DROP COLUMN IF EXISTS icon;

internal/db/migrations/000006_add_icon_column_to_sys_menus.up.sql

@@ -0,0 +1,2 @@
+ALTER TABLE sys_menus
+ADD COLUMN IF NOT EXISTS icon INTEGER;

internal/db/migrations/000007_add_post_viewers.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS post_viewers;

internal/db/migrations/000007_add_post_viewers.up.sql

@@ -0,0 +1,12 @@
+CREATE TABLE post_viewers
+(
+    post_id INTEGER NOT NULL,
+    ip INET NOT NULL,
+    last_viewed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    PRIMARY KEY(post_id, ip)
+);
+
+COMMENT ON COLUMN post_viewers.post_id IS '文章id';
+COMMENT ON COLUMN post_viewers.ip IS '访问ip';
+COMMENT ON COLUMN post_viewers.last_viewed_at IS '最后访问时间';

internal/db/query/category.sql

@@ -0,0 +1,42 @@
+-- name: CreateCategory :exec
+INSERT INTO categories(name, code)
+VALUES ($1, $2);
+
+-- name: ListCategories :many
+SELECT *
+FROM categories
+ORDER BY id LIMIT $1
+OFFSET $2;
+
+-- name: CountCategories :one
+SELECT COUNT(*)
+FROM categories;
+
+-- name: ListAllCategories :many
+SELECT *
+FROM categories;
+
+-- name: GetCategoryById :one
+SELECT *
+FROM categories
+WHERE id = $1;
+
+-- name: UpdateCategory :execrows
+UPDATE categories
+SET name = coalesce(sqlc.narg('name'), name),
+    code = coalesce(sqlc.narg('code'), code)
+WHERE id = sqlc.arg('id');
+
+-- name: DeleteCategory :execrows
+DELETE
+FROM categories
+WHERE id = $1;
+
+-- name: CreatePostCategory :exec
+INSERT INTO post_category(post_id, category_id)
+VALUES ($1, $2);
+
+-- name: DeletePostCategory :exec
+DELETE
+FROM post_category
+WHERE post_id = $1;

internal/db/query/file.sql

@@ -0,0 +1,13 @@
+-- name: CreateFile :one
+INSERT INTO files(file_name, file_path, original_name, folder_name, mime_type, file_size)
+VALUES ($1, $2, $3, $4, $5, $6) RETURNING id,file_path,file_name;
+
+-- name: GetFiles :many
+SELECT *
+FROM files
+ORDER BY id LIMIT $1
+OFFSET $2;
+
+-- name: CountFiles :one
+SELECT COUNT(*)
+FROM files;

internal/db/query/post.sql

@@ -0,0 +1,145 @@
+-- name: CreatePost :one
+INSERT INTO posts(title, cover_id, slug, content, summary, status, sort, published_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+RETURNING id;
+
+-- name: ListPosts :many
+WITH paginated_posts AS (
+    -- 第一步：先精准查出当前页需要的文章 ID
+    SELECT id,
+           title,
+           cover_id,
+           slug,
+           summary,
+           status,
+           sort,
+           published_at,
+           created_at,
+           updated_at
+    FROM posts
+    ORDER BY sort DESC, published_at DESC, id DESC
+    LIMIT $1 OFFSET $2)
+-- 第二步：用这极少量的记录去进行 JOIN
+SELECT p.*,
+       f.file_path          AS cover,
+       c.name               AS category_name,
+       c.id                 AS category_id,
+       COALESCE(ps.view, 0) AS view
+FROM paginated_posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_category pc ON pc.post_id = p.id
+         LEFT JOIN categories c ON c.id = pc.category_id
+         LEFT JOIN post_stats ps ON ps.post_id = p.id
+ORDER BY p.sort DESC, p.published_at DESC, p.id DESC;
+
+-- name: CountPosts :one
+SELECT COUNT(*)
+FROM posts;
+
+-- name: GetPostById :one
+SELECT p.*,
+       f.file_path AS cover,
+       c.name      AS category_name,
+       c.id        AS category_id
+FROM posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_category pc ON pc.post_id = p.id
+         LEFT JOIN categories c ON c.id = pc.category_id
+WHERE p.id = $1
+LIMIT 1;
+
+-- name: UpdatePost :execrows
+UPDATE posts
+SET title        = coalesce(sqlc.narg('title'), title),
+    cover_id     = coalesce(sqlc.narg('cover_id'), cover_id),
+    slug         = coalesce(sqlc.narg('slug'), slug),
+    content      = coalesce(sqlc.narg('content'), content),
+    summary      = coalesce(sqlc.narg('summary'), summary),
+    status       = coalesce(sqlc.narg('status'), status),
+    sort         = coalesce(sqlc.narg('sort'), sort),
+    published_at = coalesce(sqlc.narg('published_at'), published_at)
+WHERE id = sqlc.arg('id');
+
+-- name: DeletePost :execrows
+DELETE
+FROM posts
+WHERE id = $1;
+
+-- web -------------------------------------------------------
+
+-- name: GetPublicPostBySlug :one
+SELECT p.*,
+       f.file_path          AS cover,
+       COALESCE(ps.view, 0) AS view
+FROM posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_stats ps ON ps.post_id = p.id
+WHERE p.slug = $1
+  AND p.status = 1
+  AND p.published_at < NOW()
+LIMIT 1;
+
+-- name: ListPublishedPosts :many
+WITH paginated_posts AS (
+    -- 第一步：先精准查出当前页需要的文章 ID
+    SELECT id,
+           title,
+           cover_id,
+           slug,
+           summary,
+           sort,
+           published_at
+    FROM posts
+    WHERE status = 1
+      AND published_at < NOW()
+    ORDER BY sort DESC, published_at DESC, id DESC
+    LIMIT $1 OFFSET $2)
+SELECT p.*,
+       f.file_path          AS cover,
+       c.name               AS category_name,
+       c.id                 AS category_id,
+       COALESCE(ps.view, 0) AS view
+FROM paginated_posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_category pc ON pc.post_id = p.id
+         LEFT JOIN categories c ON c.id = pc.category_id
+         LEFT JOIN post_stats ps ON ps.post_id = p.id
+ORDER BY p.sort DESC, p.published_at DESC, p.id DESC;
+
+-- name: CountPublishedPosts :one
+SELECT COUNT(*)
+FROM posts
+WHERE status = 1
+  AND published_at < NOW();
+
+-- name: ListArchives :many
+SELECT
+  p.id,
+  p.slug,
+  p.title,
+  p.published_at,
+  c."name" AS category_name
+FROM
+  posts p
+  LEFT JOIN post_category pc ON p.id = pc.post_id
+  LEFT JOIN categories c ON c.id = pc.category_id
+WHERE
+  p.status = 1
+  AND p.published_at < NOW()
+ORDER BY
+  p.published_at DESC, p.id DESC;
+
+-- name: ListCategoryStats :many
+SELECT
+  c.id,
+  c.name,
+  COUNT(p.id) AS post_count
+FROM
+  categories c
+  LEFT JOIN post_category pc ON c.id = pc.category_id
+  LEFT JOIN posts p ON p.id = pc.post_id
+  AND p.status = 1
+  AND p.published_at < NOW()
+GROUP BY
+  c.id,
+  c.name;

internal/db/query/post_stats.sql

@@ -0,0 +1,29 @@
+-- name: IncrementPostStatsView :exec
+WITH visitor AS (
+    INSERT INTO post_viewers (
+        post_id,
+        ip,
+        last_viewed_at
+    )
+    VALUES (
+        $1,
+        $2,
+        NOW()
+    )
+    ON CONFLICT (post_id, ip)
+    DO UPDATE
+    SET last_viewed_at = NOW()
+    WHERE post_viewers.last_viewed_at < NOW() - INTERVAL '30 minutes'
+    RETURNING post_id
+)
+INSERT INTO post_stats (
+    post_id,
+    view
+)
+SELECT
+    post_id,
+    1
+FROM visitor
+ON CONFLICT (post_id)
+DO UPDATE
+SET view = post_stats.view + 1;

internal/db/query/sys_api.sql

@@ -0,0 +1,58 @@
+-- name: CreateSysApi :one
+INSERT INTO sys_apis (name, group_name, method, path, sort)
+VALUES ($1, $2, $3, $4, $5)
+RETURNING id;
+
+-- name: GetSysApis :many
+SELECT *
+FROM sys_apis
+ORDER BY id
+LIMIT $1 OFFSET $2;
+
+-- name: CountSysApis :one
+SELECT COUNT(*)
+FROM sys_apis;
+
+-- name: GetSysApiByID :one
+SELECT *
+FROM sys_apis
+WHERE id = $1;
+
+-- name: UpdateSysApi :execrows
+UPDATE sys_apis
+SET name       = $2,
+    method     = $3,
+    path       = $4,
+    sort       = $5,
+    group_name = $6
+WHERE id = $1;
+
+-- name: DeleteSysApi :execrows
+DELETE
+FROM sys_apis
+WHERE id = $1;
+
+-- name: CreateSysApiPermission :exec
+INSERT INTO sys_api_permission (api_id, permission_id)
+VALUES ($1, $2);
+
+-- name: DeleteSysApiPermission :exec
+DELETE
+FROM sys_api_permission
+WHERE api_id = $1;
+
+-- name: DeleteSysPermissionBySysApiID :exec
+DELETE
+FROM sys_permissions
+WHERE id IN (SELECT permission_id
+             FROM sys_api_permission
+             WHERE api_id = $1);
+
+-- name: GetSysApiGroupNames :many
+SELECT DISTINCT group_name
+FROM sys_apis;
+
+-- name: GetAllSysApis :many
+SELECT *
+FROM sys_apis
+ORDER BY sort ASC;

internal/db/query/sys_menu.sql

@@ -0,0 +1,71 @@
+-- name: CreateSysMenu :one
+INSERT INTO sys_menus (name, path, component, type, hidden, sort, status, parent_id, icon)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+RETURNING id;
+
+-- name: ListSysMenus :many
+SELECT m.*, p.code AS permission_code
+FROM sys_menus m
+         LEFT JOIN sys_menu_permission mp ON m.id = mp.menu_id
+         LEFT JOIN sys_permissions p ON mp.permission_id = p.id
+ORDER BY m.id
+LIMIT $1 OFFSET $2;
+
+-- name: CountSysMenus :one
+SELECT COUNT(*)
+FROM sys_menus;
+
+-- name: GetAllSysMenus :many
+SELECT m.*,
+       p.code AS permission_code
+FROM sys_menus m
+         LEFT JOIN sys_menu_permission mp ON m.id = mp.menu_id
+         LEFT JOIN sys_permissions p ON p.id = mp.permission_id
+ORDER BY m.sort ASC,
+         m.id ASC;
+
+-- name: GetSysMenuByID :one
+SELECT *
+FROM sys_menus
+WHERE id = $1;
+
+-- name: UpdateSysMenu :execrows
+UPDATE sys_menus
+SET name      = coalesce(sqlc.narg('name'), name),
+    path      = coalesce(sqlc.narg('path'), path),
+    component = coalesce(sqlc.narg('component'), component),
+    type      = coalesce(sqlc.narg('type'), type),
+    hidden    = coalesce(sqlc.narg('hidden'), hidden),
+    sort      = coalesce(sqlc.narg('sort'), sort),
+    status    = coalesce(sqlc.narg('status'), status),
+    icon      = coalesce(sqlc.narg('icon'), status),
+    parent_id = CASE WHEN @update_parent_id::boolean THEN @parent_id ELSE parent_id END
+WHERE id = sqlc.arg('id');
+
+-- name: DeleteSysMenu :execrows
+DELETE
+FROM sys_menus
+WHERE id = $1;
+
+-- name: CreateSysMenuPermission :exec
+INSERT INTO sys_menu_permission (menu_id, permission_id)
+VALUES ($1, $2);
+
+-- name: DeleteSysMenuPermission :exec
+DELETE
+FROM sys_menu_permission
+WHERE menu_id = $1;
+
+-- name: DeleteSysPermissionByMenuID :exec
+DELETE
+FROM sys_permissions
+WHERE id IN (SELECT permission_id
+             FROM sys_menu_permission
+             WHERE menu_id = $1);
+
+-- name: UpdateSysMenuPermissionCode :exec
+UPDATE sys_permissions p
+SET code = coalesce(sqlc.narg('code'), code)
+FROM sys_menu_permission mp
+WHERE p.id = mp.permission_id
+  AND mp.menu_id = $1;

internal/db/query/sys_permission.sql

@@ -0,0 +1,14 @@
+-- name: CreateSysPermission :one
+INSERT INTO sys_permissions(type,code)
+VALUES ($1,$2) RETURNING id;
+
+-- name: UpdateSysPermission :exec
+UPDATE sys_permissions
+SET code = $2
+WHERE id = $1;
+
+-- name: DeleteSysPermission :exec
+DELETE
+FROM sys_permissions
+WHERE id = $1;
+

internal/db/query/sys_role.sql

@@ -0,0 +1,76 @@
+-- name: CreateSysRole :exec
+INSERT INTO sys_roles (name, code)
+VALUES ($1, $2);
+
+-- name: ListSysRoles :many
+SELECT *
+FROM sys_roles
+ORDER BY id
+LIMIT $1 OFFSET $2;
+
+-- name: CountSysRoles :one
+SELECT COUNT(*)
+FROM sys_roles;
+
+-- name: GetSysRoleByID :one
+SELECT *
+FROM sys_roles
+WHERE id = $1;
+
+-- name: ExistsSysRoleCode :one
+SELECT EXISTS(SELECT 1
+              FROM sys_roles
+              WHERE code = sqlc.arg(code)
+                AND (
+                  sqlc.narg(id)::integer IS NULL
+                      OR id <> sqlc.narg(id)::integer
+                  ));
+
+-- name: UpdateSysRole :execrows
+UPDATE sys_roles
+SET name = coalesce(sqlc.narg('name'), name)
+WHERE id = sqlc.arg('id');
+
+-- name: DeleteSysRole :execrows
+DELETE
+FROM sys_roles
+WHERE id = $1;
+
+-- name: CreateSysRolePermission :copyfrom
+INSERT INTO sys_role_permission (role_id, permission_id)
+VALUES ($1, $2);
+
+-- name: GetSysPermissionIdsByMenuIDs :many
+SELECT permission_id
+FROM sys_menu_permission
+WHERE menu_id = ANY ($1::int[]);
+
+-- name: GetSysPermissionIdsByApiIDs :many
+SELECT permission_id
+FROM sys_api_permission
+WHERE api_id = ANY ($1::int[]);
+
+-- name: GetAllSysRoles :many
+SELECT *
+from sys_roles;
+
+-- name: GetSysRoleMenus :many
+SELECT m.id, m.name
+FROM sys_role_permission rp
+         JOIN sys_menu_permission mp ON mp.permission_id = rp.permission_id
+         JOIN sys_menus m ON m.id = mp.menu_id
+WHERE rp.role_id = $1;
+
+-- name: GetSysRoleApis :many
+SELECT a.id, a."name"
+FROM sys_role_permission rp
+         JOIN sys_api_permission ap ON ap.permission_id = rp.permission_id
+         JOIN sys_apis a ON a.id = ap.api_id
+WHERE rp.role_id = $1;
+
+-- name: DeleteSysRolePermission :exec
+DELETE
+FROM sys_role_permission rp USING sys_permissions p
+WHERE rp.permission_id = p.id
+  AND p."type" = $2
+  AND rp.role_id = $1;

internal/db/query/sys_user.sql

@@ -0,0 +1,107 @@
+-- name: CreateSysUser :exec
+INSERT INTO sys_users (account, username, password_hash, avatar_id)
+VALUES ($1, $2, $3, $4);
+
+-- name: GetSysUserByID :one
+SELECT u.id,
+       u.account,
+       u.username,
+       u.avatar_id,
+       f.file_path AS avatar_url,
+       u.created_at,
+       u.updated_at
+FROM sys_users u
+         LEFT JOIN files f ON u.avatar_id = f.id
+WHERE u.id = $1;
+
+-- name: GetSysUserByAccount :one
+SELECT u.id,
+       u.account,
+       u.username,
+       u.password_hash,
+       u.avatar_id,
+       f.file_path AS avatar_url,
+       u.created_at,
+       u.updated_at
+FROM sys_users u
+         LEFT JOIN files f ON u.avatar_id = f.id
+WHERE u.account = $1;
+
+-- name: ListSysUsers :many
+SELECT u.id,
+       u.account,
+       u.username,
+       u.avatar_id,
+       f.file_path AS avatar_url,
+       u.created_at,
+       u.updated_at
+FROM sys_users u
+         LEFT JOIN files f ON u.avatar_id = f.id
+ORDER BY u.id
+LIMIT $1 OFFSET $2;
+
+-- name: CountSysUsers :one
+SELECT COUNT(*)
+FROM sys_users;
+
+-- name: UpdateSysUser :execrows
+UPDATE sys_users
+SET username  = coalesce(sqlc.narg('username'), username),
+    avatar_id = CASE WHEN @update_avatar_id::boolean THEN @avatar_id ELSE avatar_id END
+WHERE id = sqlc.arg('id');
+
+-- name: UpdateSysUserPassword :execrows
+UPDATE sys_users
+SET password_hash = $2
+WHERE id = $1;
+
+-- name: DeleteSysUser :execrows
+DELETE
+FROM sys_users
+WHERE id = $1
+  AND id <> 1;
+
+-- name: ClearSysUserRoles :exec
+DELETE
+FROM sys_user_role
+WHERE user_id = $1;
+
+-- name: CreateSysUserRole :exec
+INSERT INTO sys_user_role (user_id, role_id)
+VALUES ($1, $2);
+
+-- name: GetSysUserRoles :many
+SELECT r.*
+FROM sys_roles r
+         JOIN sys_user_role ur ON r.id = ur.role_id
+WHERE ur.user_id = $1;
+
+-- name: GetSysAdminMenus :many
+SELECT *
+FROM sys_menus
+ORDER BY sort, id;
+
+-- name: GetSysUserMenus :many
+SELECT DISTINCT m.*
+FROM sys_users u
+         JOIN sys_user_role ur ON ur.user_id = u.id
+         JOIN sys_roles r ON r.id = ur.role_id
+         JOIN sys_role_permission rp ON rp.role_id = r.id
+         JOIN sys_permissions p ON p.id = rp.permission_id
+         JOIN sys_menu_permission mp ON mp.permission_id = p.id
+         JOIN sys_menus m ON m.id = mp.menu_id
+WHERE u.id = $1
+ORDER BY m.sort, m.id;
+
+-- name: GetSysUserApis :many
+SELECT DISTINCT a.id,
+                a.PATH,
+                a.METHOD
+FROM sys_users u
+         JOIN sys_user_role ur ON u.id = ur.user_id
+         JOIN sys_role_permission rp ON rp.role_id = ur.role_id
+         JOIN sys_permissions p ON p.id = rp.permission_id
+    AND p.TYPE = 1
+         JOIN sys_api_permission ap ON ap.permission_id = p.id
+         JOIN sys_apis a ON a.id = ap.api_id
+WHERE u.id = $1;

internal/db/schema/categories.sql

@@ -0,0 +1,19 @@
+-- 分类表
+CREATE TABLE categories
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    name       TEXT        NOT NULL,
+    code       TEXT UNIQUE NOT NULL,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ
+);
+
+CREATE TRIGGER update_categories_updated_at
+    BEFORE UPDATE
+    ON categories
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN categories.id IS '分类ID';
+COMMENT ON COLUMN categories.name IS '分类名称';
+COMMENT ON COLUMN categories.code IS '分类编码';

internal/db/schema/files.sql

@@ -0,0 +1,28 @@
+CREATE TABLE files
+(
+    id            INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    file_name     TEXT      NOT NULL,
+    file_path     TEXT      NOT NULL,
+    original_name TEXT      NOT NULL,
+    folder_name   TEXT      NOT NULL,
+    mime_type     TEXT      NOT NULL,
+    file_size     BIGINT    NOT NULL,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at    TIMESTAMPTZ
+);
+
+CREATE TRIGGER update_files_updated_at
+    BEFORE UPDATE
+    ON files
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN files.id IS '主键ID';
+COMMENT ON COLUMN files.file_name IS '文件名 xxx.jpg';
+COMMENT ON COLUMN files.file_path IS '文件路径 带path /xxx/xxx.jpg';
+COMMENT ON COLUMN files.original_name IS '原始文件名';
+COMMENT ON COLUMN files.folder_name IS '文件夹名称';
+COMMENT ON COLUMN files.mime_type IS 'mime_type';
+COMMENT ON COLUMN files.file_size IS '文件大小';
+COMMENT ON COLUMN files.created_at IS '上传时间';
+COMMENT ON COLUMN files.updated_at IS '修改时间';

internal/db/schema/func.sql

@@ -0,0 +1,11 @@
+CREATE
+    OR REPLACE FUNCTION update_updated_at_column()
+    RETURNS TRIGGER AS
+$$
+BEGIN
+    NEW.updated_at
+        := NOW();
+    RETURN NEW;
+END;
+$$
+    language 'plpgsql';

internal/db/schema/post_category.sql

@@ -0,0 +1,9 @@
+CREATE TABLE post_category
+(
+    post_id INT NOT NULL,
+    category_id INT NOT NULL,
+    PRIMARY KEY (post_id, category_id)
+);
+
+COMMENT ON COLUMN post_category.post_id IS '文章ID';
+COMMENT ON COLUMN post_category.category_id IS '分类ID';

internal/db/schema/post_stats.sql

@@ -0,0 +1,8 @@
+CREATE TABLE post_stats
+(
+    post_id        INTEGER PRIMARY KEY,
+    view           INTEGER     NOT NULL DEFAULT 0
+);
+
+COMMENT ON COLUMN post_stats.post_id IS '文章id';
+COMMENT ON COLUMN post_stats.view IS '文章阅读量';

internal/db/schema/post_viewers.sql

@@ -0,0 +1,12 @@
+CREATE TABLE post_viewers
+(
+    post_id INTEGER NOT NULL,
+    ip INET NOT NULL,
+    last_viewed_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+
+    PRIMARY KEY(post_id, ip)
+);
+
+COMMENT ON COLUMN post_viewers.post_id IS '文章id';
+COMMENT ON COLUMN post_viewers.ip IS '访问ip';
+COMMENT ON COLUMN post_viewers.last_viewed_at IS '最后访问时间';

internal/db/schema/posts.sql

@@ -0,0 +1,35 @@
+CREATE TABLE posts
+(
+    id           INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    title        TEXT        NOT NULL,
+    cover_id     INTEGER,
+    slug         TEXT UNIQUE NOT NULL,
+    content      TEXT        NOT NULL,
+    summary      TEXT        NOT NULL,
+    status       SMALLINT    NOT NULL DEFAULT 1,
+    sort         INTEGER              DEFAULT 0,
+    published_at TIMESTAMPTZ   NOT NULL DEFAULT NOW(),
+    created_at   TIMESTAMPTZ   NOT NULL DEFAULT NOW(),
+    updated_at   TIMESTAMPTZ,
+
+    CHECK (status IN (0, 1, 2))
+);
+
+CREATE TRIGGER update_posts_updated_at
+    BEFORE UPDATE
+    ON posts
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+
+COMMENT ON COLUMN posts.id IS '主键ID';
+COMMENT ON COLUMN posts.title IS '文章标题';
+COMMENT ON COLUMN posts.cover_id IS '文章封面图片id';
+COMMENT ON COLUMN posts.slug IS 'URL友好地址';
+COMMENT ON COLUMN posts.content IS '文章正文';
+COMMENT ON COLUMN posts.summary IS '摘要';
+COMMENT ON COLUMN posts.status IS '状态 0:草稿 1:已发布 2:已下线';
+COMMENT ON COLUMN posts.sort IS '文章排序';
+COMMENT ON COLUMN posts.published_at IS '发布时间';
+COMMENT ON COLUMN posts.created_at IS '创建时间';
+COMMENT ON COLUMN posts.updated_at IS '修改时间';

internal/db/schema/sys_api_permission.sql

@@ -0,0 +1,9 @@
+CREATE TABLE sys_api_permission
+(
+    api_id        INTEGER NOT NULL,
+    permission_id INTEGER NOT NULL,
+    PRIMARY KEY (api_id, permission_id)
+);
+
+COMMENT ON COLUMN sys_api_permission.api_id IS 'api ID';
+COMMENT ON COLUMN sys_api_permission.permission_id IS '权限id';

internal/db/schema/sys_apis.sql

@@ -0,0 +1,28 @@
+CREATE TABLE sys_apis
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    group_name TEXT      NOT NULL,
+    name       TEXT      NOT NULL,
+    method     TEXT      NOT NULL,
+    path       TEXT      NOT NULL,
+    sort       INTEGER            DEFAULT 0,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ,
+
+    UNIQUE (method, path)
+);
+
+CREATE TRIGGER update_sys_apis_updated_at
+    BEFORE UPDATE
+    ON sys_apis
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_apis.id IS '主键ID';
+COMMENT ON COLUMN sys_apis.group_name IS '分组名称';
+COMMENT ON COLUMN sys_apis.name IS '接口名称';
+COMMENT ON COLUMN sys_apis.method IS 'api方法';
+COMMENT ON COLUMN sys_apis.path IS 'api路径';
+COMMENT ON COLUMN sys_apis.sort IS '排序';
+COMMENT ON COLUMN sys_apis.created_at IS '创建时间';
+COMMENT ON COLUMN sys_apis.updated_at IS '更新时间';

internal/db/schema/sys_menu_permission.sql

@@ -0,0 +1,9 @@
+CREATE TABLE sys_menu_permission
+(
+    menu_id       INTEGER NOT NULL,
+    permission_id INTEGER NOT NULL,
+    PRIMARY KEY (menu_id, permission_id)
+);
+
+COMMENT ON COLUMN sys_menu_permission.menu_id IS '菜单id';
+COMMENT ON COLUMN sys_menu_permission.permission_id IS '权限id';

internal/db/schema/sys_menus.sql

@@ -0,0 +1,38 @@
+CREATE TABLE sys_menus
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    name       TEXT        NOT NULL,
+    path       TEXT        NOT NULL,
+    component  TEXT,
+    type       SMALLINT    NOT NULL,
+    hidden     BOOLEAN              DEFAULT FALSE,
+    sort       INTEGER              DEFAULT 0,
+    status     SMALLINT    NOT NULL DEFAULT 1,
+    parent_id  INTEGER,
+    icon       INTEGER,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ,
+
+    CHECK (type IN (0, 1, 2)),
+    CHECK (status IN (0, 1))
+);
+
+
+CREATE TRIGGER update_sys_menus_updated_at
+    BEFORE UPDATE
+    ON sys_menus
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_menus.id IS '主键ID';
+COMMENT ON COLUMN sys_menus.name IS '菜单名称';
+COMMENT ON COLUMN sys_menus.path IS '菜单路径';
+COMMENT ON COLUMN sys_menus.component IS '组件路径';
+COMMENT ON COLUMN sys_menus.type IS '菜单类型 0: 目录 1: 菜单 2: button';
+COMMENT ON COLUMN sys_menus.sort IS '菜单排序';
+COMMENT ON COLUMN sys_menus.hidden IS '是否隐藏菜单';
+COMMENT ON COLUMN sys_menus.status IS '菜单状态 1: 启用 0: 禁用';
+COMMENT ON COLUMN sys_menus.parent_id IS '父级id';
+COMMENT ON COLUMN sys_menus.icon IS '菜单icon';
+COMMENT ON COLUMN sys_menus.created_at IS '创建时间';
+COMMENT ON COLUMN sys_menus.updated_at IS '更新时间';

internal/db/schema/sys_permissions.sql

@@ -0,0 +1,22 @@
+CREATE TABLE sys_permissions
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    code       TEXT UNIQUE,
+    type       SMALLINT  NOT NULL,
+    created_at TIMESTAMPTZtz NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ,
+
+    CONSTRAINT unique_type_code UNIQUE (type, code)
+);
+
+CREATE TRIGGER update_sys_permissions_updated_at
+    BEFORE UPDATE
+    ON sys_permissions
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_permissions.id IS '主键ID';
+COMMENT ON COLUMN sys_permissions.code IS '权限字符，唯一';
+COMMENT ON COLUMN sys_permissions.code IS '权限类型，0: 菜单 1: api';
+COMMENT ON COLUMN sys_permissions.created_at IS '创建时间';
+COMMENT ON COLUMN sys_permissions.updated_at IS '更新时间';

internal/db/schema/sys_role_permission.sql

@@ -0,0 +1,9 @@
+CREATE TABLE sys_role_permission
+(
+    role_id       INTEGER NOT NULL,
+    permission_id INTEGER NOT NULL,
+    PRIMARY KEY (role_id, permission_id)
+);
+
+COMMENT ON COLUMN sys_role_permission.role_id IS '角色id';
+COMMENT ON COLUMN sys_role_permission.permission_id IS '权限id';

internal/db/schema/sys_roles.sql

@@ -0,0 +1,20 @@
+CREATE TABLE sys_roles
+(
+    id         INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    name       TEXT      NOT NULL,
+    code       TEXT      NOT NULL UNIQUE,
+    created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at TIMESTAMPTZ
+);
+
+CREATE TRIGGER update_sys_roles_updated_at
+    BEFORE UPDATE
+    ON sys_roles
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+COMMENT ON COLUMN sys_roles.id IS '主键ID';
+COMMENT ON COLUMN sys_roles.name IS '角色名称';
+COMMENT ON COLUMN sys_roles.code IS '角色编码，唯一';
+COMMENT ON COLUMN sys_roles.created_at IS '创建时间';
+COMMENT ON COLUMN sys_roles.updated_at IS '更新时间';

internal/db/schema/sys_user_role.sql

@@ -0,0 +1,9 @@
+CREATE TABLE sys_user_role
+(
+    user_id INTEGER NOT NULL,
+    role_id INTEGER NOT NULL,
+    PRIMARY KEY (user_id, role_id)
+);
+
+COMMENT ON COLUMN sys_user_role.user_id IS '用户ID';
+COMMENT ON COLUMN sys_user_role.role_id IS '角色ID';

internal/db/schema/sys_users.sql

@@ -0,0 +1,27 @@
+CREATE TABLE sys_users
+(
+    id            INTEGER PRIMARY KEY GENERATED ALWAYS AS IDENTITY,
+    account       TEXT      NOT NULL UNIQUE,
+    username      TEXT      NOT NULL,
+    password_hash TEXT      NOT NULL,
+    avatar_id     INTEGER,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+    updated_at    TIMESTAMPTZ
+);
+
+CREATE INDEX idx_sys_users_account ON sys_users (account);
+
+CREATE TRIGGER update_sys_users_updated_at
+    BEFORE UPDATE
+    ON sys_users
+    FOR EACH ROW
+EXECUTE FUNCTION update_updated_at_column();
+
+
+COMMENT ON COLUMN sys_users.id IS '主键ID';
+COMMENT ON COLUMN sys_users.account IS '用户账号';
+COMMENT ON COLUMN sys_users.username IS '用户名称';
+COMMENT ON COLUMN sys_users.password_hash IS 'hash密码';
+COMMENT ON COLUMN sys_users.avatar_id IS '头像文件id';
+COMMENT ON COLUMN sys_users.created_at IS '创建时间';
+COMMENT ON COLUMN sys_users.updated_at IS '更新时间';

internal/db/sqlc/category.sql.go

@@ -0,0 +1,186 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: category.sql
+
+package db
+
+import (
+	"context"
+)
+
+const countCategories = `-- name: CountCategories :one
+SELECT COUNT(*)
+FROM categories
+`
+
+func (q *Queries) CountCategories(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countCategories)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createCategory = `-- name: CreateCategory :exec
+INSERT INTO categories(name, code)
+VALUES ($1, $2)
+`
+
+type CreateCategoryParams struct {
+	Name string `json:"name"`
+	Code string `json:"code"`
+}
+
+func (q *Queries) CreateCategory(ctx context.Context, arg CreateCategoryParams) error {
+	_, err := q.db.Exec(ctx, createCategory, arg.Name, arg.Code)
+	return err
+}
+
+const createPostCategory = `-- name: CreatePostCategory :exec
+INSERT INTO post_category(post_id, category_id)
+VALUES ($1, $2)
+`
+
+type CreatePostCategoryParams struct {
+	PostID     int32 `json:"post_id"`
+	CategoryID int32 `json:"category_id"`
+}
+
+func (q *Queries) CreatePostCategory(ctx context.Context, arg CreatePostCategoryParams) error {
+	_, err := q.db.Exec(ctx, createPostCategory, arg.PostID, arg.CategoryID)
+	return err
+}
+
+const deleteCategory = `-- name: DeleteCategory :execrows
+DELETE
+FROM categories
+WHERE id = $1
+`
+
+func (q *Queries) DeleteCategory(ctx context.Context, id int32) (int64, error) {
+	result, err := q.db.Exec(ctx, deleteCategory, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const deletePostCategory = `-- name: DeletePostCategory :exec
+DELETE
+FROM post_category
+WHERE post_id = $1
+`
+
+func (q *Queries) DeletePostCategory(ctx context.Context, postID int32) error {
+	_, err := q.db.Exec(ctx, deletePostCategory, postID)
+	return err
+}
+
+const getCategoryById = `-- name: GetCategoryById :one
+SELECT id, name, code, created_at, updated_at
+FROM categories
+WHERE id = $1
+`
+
+func (q *Queries) GetCategoryById(ctx context.Context, id int32) (Category, error) {
+	row := q.db.QueryRow(ctx, getCategoryById, id)
+	var i Category
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.Code,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listAllCategories = `-- name: ListAllCategories :many
+SELECT id, name, code, created_at, updated_at
+FROM categories
+`
+
+func (q *Queries) ListAllCategories(ctx context.Context) ([]Category, error) {
+	rows, err := q.db.Query(ctx, listAllCategories)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []Category{}
+	for rows.Next() {
+		var i Category
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Code,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listCategories = `-- name: ListCategories :many
+SELECT id, name, code, created_at, updated_at
+FROM categories
+ORDER BY id LIMIT $1
+OFFSET $2
+`
+
+type ListCategoriesParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+func (q *Queries) ListCategories(ctx context.Context, arg ListCategoriesParams) ([]Category, error) {
+	rows, err := q.db.Query(ctx, listCategories, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []Category{}
+	for rows.Next() {
+		var i Category
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Code,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateCategory = `-- name: UpdateCategory :execrows
+UPDATE categories
+SET name = coalesce($1, name),
+    code = coalesce($2, code)
+WHERE id = $3
+`
+
+type UpdateCategoryParams struct {
+	Name *string `json:"name"`
+	Code *string `json:"code"`
+	ID   int32   `json:"id"`
+}
+
+func (q *Queries) UpdateCategory(ctx context.Context, arg UpdateCategoryParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateCategory, arg.Name, arg.Code, arg.ID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}

internal/db/sqlc/copyfrom.go

@@ -0,0 +1,43 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: copyfrom.go
+
+package db
+
+import (
+	"context"
+)
+
+// iteratorForCreateSysRolePermission implements pgx.CopyFromSource.
+type iteratorForCreateSysRolePermission struct {
+	rows                 []CreateSysRolePermissionParams
+	skippedFirstNextCall bool
+}
+
+func (r *iteratorForCreateSysRolePermission) Next() bool {
+	if len(r.rows) == 0 {
+		return false
+	}
+	if !r.skippedFirstNextCall {
+		r.skippedFirstNextCall = true
+		return true
+	}
+	r.rows = r.rows[1:]
+	return len(r.rows) > 0
+}
+
+func (r iteratorForCreateSysRolePermission) Values() ([]interface{}, error) {
+	return []interface{}{
+		r.rows[0].RoleID,
+		r.rows[0].PermissionID,
+	}, nil
+}
+
+func (r iteratorForCreateSysRolePermission) Err() error {
+	return nil
+}
+
+func (q *Queries) CreateSysRolePermission(ctx context.Context, arg []CreateSysRolePermissionParams) (int64, error) {
+	return q.db.CopyFrom(ctx, []string{"sys_role_permission"}, []string{"role_id", "permission_id"}, &iteratorForCreateSysRolePermission{rows: arg})
+}

internal/db/sqlc/db.go

@@ -0,0 +1,33 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+
+package db
+
+import (
+	"context"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+type DBTX interface {
+	Exec(context.Context, string, ...interface{}) (pgconn.CommandTag, error)
+	Query(context.Context, string, ...interface{}) (pgx.Rows, error)
+	QueryRow(context.Context, string, ...interface{}) pgx.Row
+	CopyFrom(ctx context.Context, tableName pgx.Identifier, columnNames []string, rowSrc pgx.CopyFromSource) (int64, error)
+}
+
+func New(db DBTX) *Queries {
+	return &Queries{db: db}
+}
+
+type Queries struct {
+	db DBTX
+}
+
+func (q *Queries) WithTx(tx pgx.Tx) *Queries {
+	return &Queries{
+		db: tx,
+	}
+}

internal/db/sqlc/file.sql.go

@@ -0,0 +1,98 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: file.sql
+
+package db
+
+import (
+	"context"
+)
+
+const countFiles = `-- name: CountFiles :one
+SELECT COUNT(*)
+FROM files
+`
+
+func (q *Queries) CountFiles(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countFiles)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createFile = `-- name: CreateFile :one
+INSERT INTO files(file_name, file_path, original_name, folder_name, mime_type, file_size)
+VALUES ($1, $2, $3, $4, $5, $6) RETURNING id,file_path,file_name
+`
+
+type CreateFileParams struct {
+	FileName     string `json:"file_name"`
+	FilePath     string `json:"file_path"`
+	OriginalName string `json:"original_name"`
+	FolderName   string `json:"folder_name"`
+	MimeType     string `json:"mime_type"`
+	FileSize     int64  `json:"file_size"`
+}
+
+type CreateFileRow struct {
+	ID       int32  `json:"id"`
+	FilePath string `json:"file_path"`
+	FileName string `json:"file_name"`
+}
+
+func (q *Queries) CreateFile(ctx context.Context, arg CreateFileParams) (CreateFileRow, error) {
+	row := q.db.QueryRow(ctx, createFile,
+		arg.FileName,
+		arg.FilePath,
+		arg.OriginalName,
+		arg.FolderName,
+		arg.MimeType,
+		arg.FileSize,
+	)
+	var i CreateFileRow
+	err := row.Scan(&i.ID, &i.FilePath, &i.FileName)
+	return i, err
+}
+
+const getFiles = `-- name: GetFiles :many
+SELECT id, file_name, file_path, original_name, folder_name, mime_type, file_size, created_at, updated_at
+FROM files
+ORDER BY id LIMIT $1
+OFFSET $2
+`
+
+type GetFilesParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+func (q *Queries) GetFiles(ctx context.Context, arg GetFilesParams) ([]File, error) {
+	rows, err := q.db.Query(ctx, getFiles, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []File{}
+	for rows.Next() {
+		var i File
+		if err := rows.Scan(
+			&i.ID,
+			&i.FileName,
+			&i.FilePath,
+			&i.OriginalName,
+			&i.FolderName,
+			&i.MimeType,
+			&i.FileSize,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}

internal/db/sqlc/models.go

@@ -0,0 +1,206 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+
+package db
+
+import (
+	"net/netip"
+	"time"
+)
+
+type Category struct {
+	// 分类ID
+	ID int32 `json:"id"`
+	// 分类名称
+	Name string `json:"name"`
+	// 分类编码
+	Code      string     `json:"code"`
+	CreatedAt time.Time  `json:"created_at"`
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type File struct {
+	// 主键ID
+	ID int32 `json:"id"`
+	// 文件名 xxx.jpg
+	FileName string `json:"file_name"`
+	// 文件路径 带path /xxx/xxx.jpg
+	FilePath string `json:"file_path"`
+	// 原始文件名
+	OriginalName string `json:"original_name"`
+	// 文件夹名称
+	FolderName string `json:"folder_name"`
+	// mime_type
+	MimeType string `json:"mime_type"`
+	// 文件大小
+	FileSize int64 `json:"file_size"`
+	// 上传时间
+	CreatedAt time.Time `json:"created_at"`
+	// 修改时间
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type Post struct {
+	// 主键ID
+	ID int32 `json:"id"`
+	// 文章标题
+	Title string `json:"title"`
+	// 文章封面图片id
+	CoverID *int32 `json:"cover_id"`
+	// URL友好地址
+	Slug string `json:"slug"`
+	// 文章正文
+	Content string `json:"content"`
+	// 摘要
+	Summary string `json:"summary"`
+	// 状态 0:草稿 1:已发布 2:已下线
+	Status int16 `json:"status"`
+	// 文章排序
+	Sort *int32 `json:"sort"`
+	// 发布时间
+	PublishedAt time.Time `json:"published_at"`
+	// 创建时间
+	CreatedAt time.Time `json:"created_at"`
+	// 修改时间
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type PostCategory struct {
+	// 文章ID
+	PostID int32 `json:"post_id"`
+	// 分类ID
+	CategoryID int32 `json:"category_id"`
+}
+
+type PostStat struct {
+	// 文章id
+	PostID int32 `json:"post_id"`
+	// 文章阅读量
+	View int32 `json:"view"`
+}
+
+type PostViewer struct {
+	// 文章id
+	PostID int32 `json:"post_id"`
+	// 访问ip
+	Ip netip.Addr `json:"ip"`
+	// 最后访问时间
+	LastViewedAt time.Time `json:"last_viewed_at"`
+}
+
+type SysApi struct {
+	// 主键ID
+	ID int32 `json:"id"`
+	// 分组名称
+	GroupName string `json:"group_name"`
+	// 接口名称
+	Name string `json:"name"`
+	// api方法
+	Method string `json:"method"`
+	// api路径
+	Path string `json:"path"`
+	// 排序
+	Sort *int32 `json:"sort"`
+	// 创建时间
+	CreatedAt time.Time `json:"created_at"`
+	// 更新时间
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type SysApiPermission struct {
+	// api ID
+	ApiID int32 `json:"api_id"`
+	// 权限id
+	PermissionID int32 `json:"permission_id"`
+}
+
+type SysMenu struct {
+	// 主键ID
+	ID int32 `json:"id"`
+	// 菜单名称
+	Name string `json:"name"`
+	// 菜单路径
+	Path string `json:"path"`
+	// 组件路径
+	Component *string `json:"component"`
+	// 菜单类型 0: 目录 1: 菜单 2: button
+	Type int16 `json:"type"`
+	// 是否隐藏菜单
+	Hidden *bool `json:"hidden"`
+	// 菜单排序
+	Sort *int32 `json:"sort"`
+	// 菜单状态 1: 启用 0: 禁用
+	Status int16 `json:"status"`
+	// 父级id
+	ParentID *int32 `json:"parent_id"`
+	// 菜单icon
+	Icon *int32 `json:"icon"`
+	// 创建时间
+	CreatedAt time.Time `json:"created_at"`
+	// 更新时间
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type SysMenuPermission struct {
+	// 菜单id
+	MenuID int32 `json:"menu_id"`
+	// 权限id
+	PermissionID int32 `json:"permission_id"`
+}
+
+type SysPermission struct {
+	// 主键ID
+	ID int32 `json:"id"`
+	// 权限类型，0: 菜单 1: api
+	Code *string `json:"code"`
+	Type int16   `json:"type"`
+	// 创建时间
+	CreatedAt interface{} `json:"created_at"`
+	// 更新时间
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type SysRole struct {
+	// 主键ID
+	ID int32 `json:"id"`
+	// 角色名称
+	Name string `json:"name"`
+	// 角色编码，唯一
+	Code string `json:"code"`
+	// 创建时间
+	CreatedAt time.Time `json:"created_at"`
+	// 更新时间
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type SysRolePermission struct {
+	// 角色id
+	RoleID int32 `json:"role_id"`
+	// 权限id
+	PermissionID int32 `json:"permission_id"`
+}
+
+type SysUser struct {
+	// 主键ID
+	ID int32 `json:"id"`
+	// 用户账号
+	Account string `json:"account"`
+	// 用户名称
+	Username string `json:"username"`
+	// hash密码
+	PasswordHash string `json:"password_hash"`
+	// 头像文件id
+	AvatarID *int32 `json:"avatar_id"`
+	// 创建时间
+	CreatedAt time.Time `json:"created_at"`
+	// 更新时间
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+type SysUserRole struct {
+	// 用户ID
+	UserID int32 `json:"user_id"`
+	// 角色ID
+	RoleID int32 `json:"role_id"`
+}

internal/db/sqlc/post.sql.go

@@ -0,0 +1,491 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: post.sql
+
+package db
+
+import (
+	"context"
+	"time"
+)
+
+const countPosts = `-- name: CountPosts :one
+SELECT COUNT(*)
+FROM posts
+`
+
+func (q *Queries) CountPosts(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countPosts)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const countPublishedPosts = `-- name: CountPublishedPosts :one
+SELECT COUNT(*)
+FROM posts
+WHERE status = 1
+  AND published_at < NOW()
+`
+
+func (q *Queries) CountPublishedPosts(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countPublishedPosts)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createPost = `-- name: CreatePost :one
+INSERT INTO posts(title, cover_id, slug, content, summary, status, sort, published_at)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8)
+RETURNING id
+`
+
+type CreatePostParams struct {
+	Title       string    `json:"title"`
+	CoverID     *int32    `json:"cover_id"`
+	Slug        string    `json:"slug"`
+	Content     string    `json:"content"`
+	Summary     string    `json:"summary"`
+	Status      int16     `json:"status"`
+	Sort        *int32    `json:"sort"`
+	PublishedAt time.Time `json:"published_at"`
+}
+
+func (q *Queries) CreatePost(ctx context.Context, arg CreatePostParams) (int32, error) {
+	row := q.db.QueryRow(ctx, createPost,
+		arg.Title,
+		arg.CoverID,
+		arg.Slug,
+		arg.Content,
+		arg.Summary,
+		arg.Status,
+		arg.Sort,
+		arg.PublishedAt,
+	)
+	var id int32
+	err := row.Scan(&id)
+	return id, err
+}
+
+const deletePost = `-- name: DeletePost :execrows
+DELETE
+FROM posts
+WHERE id = $1
+`
+
+func (q *Queries) DeletePost(ctx context.Context, id int32) (int64, error) {
+	result, err := q.db.Exec(ctx, deletePost, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const getPostById = `-- name: GetPostById :one
+SELECT p.id, p.title, p.cover_id, p.slug, p.content, p.summary, p.status, p.sort, p.published_at, p.created_at, p.updated_at,
+       f.file_path AS cover,
+       c.name      AS category_name,
+       c.id        AS category_id
+FROM posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_category pc ON pc.post_id = p.id
+         LEFT JOIN categories c ON c.id = pc.category_id
+WHERE p.id = $1
+LIMIT 1
+`
+
+type GetPostByIdRow struct {
+	ID           int32      `json:"id"`
+	Title        string     `json:"title"`
+	CoverID      *int32     `json:"cover_id"`
+	Slug         string     `json:"slug"`
+	Content      string     `json:"content"`
+	Summary      string     `json:"summary"`
+	Status       int16      `json:"status"`
+	Sort         *int32     `json:"sort"`
+	PublishedAt  time.Time  `json:"published_at"`
+	CreatedAt    time.Time  `json:"created_at"`
+	UpdatedAt    *time.Time `json:"updated_at"`
+	Cover        *string    `json:"cover"`
+	CategoryName *string    `json:"category_name"`
+	CategoryID   *int32     `json:"category_id"`
+}
+
+func (q *Queries) GetPostById(ctx context.Context, id int32) (GetPostByIdRow, error) {
+	row := q.db.QueryRow(ctx, getPostById, id)
+	var i GetPostByIdRow
+	err := row.Scan(
+		&i.ID,
+		&i.Title,
+		&i.CoverID,
+		&i.Slug,
+		&i.Content,
+		&i.Summary,
+		&i.Status,
+		&i.Sort,
+		&i.PublishedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Cover,
+		&i.CategoryName,
+		&i.CategoryID,
+	)
+	return i, err
+}
+
+const getPublicPostBySlug = `-- name: GetPublicPostBySlug :one
+
+SELECT p.id, p.title, p.cover_id, p.slug, p.content, p.summary, p.status, p.sort, p.published_at, p.created_at, p.updated_at,
+       f.file_path          AS cover,
+       COALESCE(ps.view, 0) AS view
+FROM posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_stats ps ON ps.post_id = p.id
+WHERE p.slug = $1
+  AND p.status = 1
+  AND p.published_at < NOW()
+LIMIT 1
+`
+
+type GetPublicPostBySlugRow struct {
+	ID          int32      `json:"id"`
+	Title       string     `json:"title"`
+	CoverID     *int32     `json:"cover_id"`
+	Slug        string     `json:"slug"`
+	Content     string     `json:"content"`
+	Summary     string     `json:"summary"`
+	Status      int16      `json:"status"`
+	Sort        *int32     `json:"sort"`
+	PublishedAt time.Time  `json:"published_at"`
+	CreatedAt   time.Time  `json:"created_at"`
+	UpdatedAt   *time.Time `json:"updated_at"`
+	Cover       *string    `json:"cover"`
+	View        int32      `json:"view"`
+}
+
+// web -------------------------------------------------------
+func (q *Queries) GetPublicPostBySlug(ctx context.Context, slug string) (GetPublicPostBySlugRow, error) {
+	row := q.db.QueryRow(ctx, getPublicPostBySlug, slug)
+	var i GetPublicPostBySlugRow
+	err := row.Scan(
+		&i.ID,
+		&i.Title,
+		&i.CoverID,
+		&i.Slug,
+		&i.Content,
+		&i.Summary,
+		&i.Status,
+		&i.Sort,
+		&i.PublishedAt,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+		&i.Cover,
+		&i.View,
+	)
+	return i, err
+}
+
+const listArchives = `-- name: ListArchives :many
+SELECT
+  p.id,
+  p.slug,
+  p.title,
+  p.published_at,
+  c."name" AS category_name
+FROM
+  posts p
+  LEFT JOIN post_category pc ON p.id = pc.post_id
+  LEFT JOIN categories c ON c.id = pc.category_id
+WHERE
+  p.status = 1
+  AND p.published_at < NOW()
+ORDER BY
+  p.published_at DESC, p.id DESC
+`
+
+type ListArchivesRow struct {
+	ID           int32     `json:"id"`
+	Slug         string    `json:"slug"`
+	Title        string    `json:"title"`
+	PublishedAt  time.Time `json:"published_at"`
+	CategoryName *string   `json:"category_name"`
+}
+
+func (q *Queries) ListArchives(ctx context.Context) ([]ListArchivesRow, error) {
+	rows, err := q.db.Query(ctx, listArchives)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListArchivesRow{}
+	for rows.Next() {
+		var i ListArchivesRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Slug,
+			&i.Title,
+			&i.PublishedAt,
+			&i.CategoryName,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listCategoryStats = `-- name: ListCategoryStats :many
+SELECT
+  c.id,
+  c.name,
+  COUNT(p.id) AS post_count
+FROM
+  categories c
+  LEFT JOIN post_category pc ON c.id = pc.category_id
+  LEFT JOIN posts p ON p.id = pc.post_id
+  AND p.status = 1
+  AND p.published_at < NOW()
+GROUP BY
+  c.id,
+  c.name
+`
+
+type ListCategoryStatsRow struct {
+	ID        int32  `json:"id"`
+	Name      string `json:"name"`
+	PostCount int64  `json:"post_count"`
+}
+
+func (q *Queries) ListCategoryStats(ctx context.Context) ([]ListCategoryStatsRow, error) {
+	rows, err := q.db.Query(ctx, listCategoryStats)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListCategoryStatsRow{}
+	for rows.Next() {
+		var i ListCategoryStatsRow
+		if err := rows.Scan(&i.ID, &i.Name, &i.PostCount); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listPosts = `-- name: ListPosts :many
+WITH paginated_posts AS (
+    -- 第一步：先精准查出当前页需要的文章 ID
+    SELECT id,
+           title,
+           cover_id,
+           slug,
+           summary,
+           status,
+           sort,
+           published_at,
+           created_at,
+           updated_at
+    FROM posts
+    ORDER BY sort DESC, published_at DESC, id DESC
+    LIMIT $1 OFFSET $2)
+SELECT p.id, p.title, p.cover_id, p.slug, p.summary, p.status, p.sort, p.published_at, p.created_at, p.updated_at,
+       f.file_path          AS cover,
+       c.name               AS category_name,
+       c.id                 AS category_id,
+       COALESCE(ps.view, 0) AS view
+FROM paginated_posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_category pc ON pc.post_id = p.id
+         LEFT JOIN categories c ON c.id = pc.category_id
+         LEFT JOIN post_stats ps ON ps.post_id = p.id
+ORDER BY p.sort DESC, p.published_at DESC, p.id DESC
+`
+
+type ListPostsParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+type ListPostsRow struct {
+	ID           int32      `json:"id"`
+	Title        string     `json:"title"`
+	CoverID      *int32     `json:"cover_id"`
+	Slug         string     `json:"slug"`
+	Summary      string     `json:"summary"`
+	Status       int16      `json:"status"`
+	Sort         *int32     `json:"sort"`
+	PublishedAt  time.Time  `json:"published_at"`
+	CreatedAt    time.Time  `json:"created_at"`
+	UpdatedAt    *time.Time `json:"updated_at"`
+	Cover        *string    `json:"cover"`
+	CategoryName *string    `json:"category_name"`
+	CategoryID   *int32     `json:"category_id"`
+	View         int32      `json:"view"`
+}
+
+// 第二步：用这极少量的记录去进行 JOIN
+func (q *Queries) ListPosts(ctx context.Context, arg ListPostsParams) ([]ListPostsRow, error) {
+	rows, err := q.db.Query(ctx, listPosts, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListPostsRow{}
+	for rows.Next() {
+		var i ListPostsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Title,
+			&i.CoverID,
+			&i.Slug,
+			&i.Summary,
+			&i.Status,
+			&i.Sort,
+			&i.PublishedAt,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.Cover,
+			&i.CategoryName,
+			&i.CategoryID,
+			&i.View,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listPublishedPosts = `-- name: ListPublishedPosts :many
+WITH paginated_posts AS (
+    -- 第一步：先精准查出当前页需要的文章 ID
+    SELECT id,
+           title,
+           cover_id,
+           slug,
+           summary,
+           sort,
+           published_at
+    FROM posts
+    WHERE status = 1
+      AND published_at < NOW()
+    ORDER BY sort DESC, published_at DESC, id DESC
+    LIMIT $1 OFFSET $2)
+SELECT p.id, p.title, p.cover_id, p.slug, p.summary, p.sort, p.published_at,
+       f.file_path          AS cover,
+       c.name               AS category_name,
+       c.id                 AS category_id,
+       COALESCE(ps.view, 0) AS view
+FROM paginated_posts p
+         LEFT JOIN files f ON f.id = p.cover_id
+         LEFT JOIN post_category pc ON pc.post_id = p.id
+         LEFT JOIN categories c ON c.id = pc.category_id
+         LEFT JOIN post_stats ps ON ps.post_id = p.id
+ORDER BY p.sort DESC, p.published_at DESC, p.id DESC
+`
+
+type ListPublishedPostsParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+type ListPublishedPostsRow struct {
+	ID           int32     `json:"id"`
+	Title        string    `json:"title"`
+	CoverID      *int32    `json:"cover_id"`
+	Slug         string    `json:"slug"`
+	Summary      string    `json:"summary"`
+	Sort         *int32    `json:"sort"`
+	PublishedAt  time.Time `json:"published_at"`
+	Cover        *string   `json:"cover"`
+	CategoryName *string   `json:"category_name"`
+	CategoryID   *int32    `json:"category_id"`
+	View         int32     `json:"view"`
+}
+
+func (q *Queries) ListPublishedPosts(ctx context.Context, arg ListPublishedPostsParams) ([]ListPublishedPostsRow, error) {
+	rows, err := q.db.Query(ctx, listPublishedPosts, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListPublishedPostsRow{}
+	for rows.Next() {
+		var i ListPublishedPostsRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Title,
+			&i.CoverID,
+			&i.Slug,
+			&i.Summary,
+			&i.Sort,
+			&i.PublishedAt,
+			&i.Cover,
+			&i.CategoryName,
+			&i.CategoryID,
+			&i.View,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updatePost = `-- name: UpdatePost :execrows
+UPDATE posts
+SET title        = coalesce($1, title),
+    cover_id     = coalesce($2, cover_id),
+    slug         = coalesce($3, slug),
+    content      = coalesce($4, content),
+    summary      = coalesce($5, summary),
+    status       = coalesce($6, status),
+    sort         = coalesce($7, sort),
+    published_at = coalesce($8, published_at)
+WHERE id = $9
+`
+
+type UpdatePostParams struct {
+	Title       *string    `json:"title"`
+	CoverID     *int32     `json:"cover_id"`
+	Slug        *string    `json:"slug"`
+	Content     *string    `json:"content"`
+	Summary     *string    `json:"summary"`
+	Status      *int16     `json:"status"`
+	Sort        *int32     `json:"sort"`
+	PublishedAt *time.Time `json:"published_at"`
+	ID          int32      `json:"id"`
+}
+
+func (q *Queries) UpdatePost(ctx context.Context, arg UpdatePostParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updatePost,
+		arg.Title,
+		arg.CoverID,
+		arg.Slug,
+		arg.Content,
+		arg.Summary,
+		arg.Status,
+		arg.Sort,
+		arg.PublishedAt,
+		arg.ID,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}

internal/db/sqlc/post_stats.sql.go

@@ -0,0 +1,52 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: post_stats.sql
+
+package db
+
+import (
+	"context"
+	"net/netip"
+)
+
+const incrementPostStatsView = `-- name: IncrementPostStatsView :exec
+WITH visitor AS (
+    INSERT INTO post_viewers (
+        post_id,
+        ip,
+        last_viewed_at
+    )
+    VALUES (
+        $1,
+        $2,
+        NOW()
+    )
+    ON CONFLICT (post_id, ip)
+    DO UPDATE
+    SET last_viewed_at = NOW()
+    WHERE post_viewers.last_viewed_at < NOW() - INTERVAL '30 minutes'
+    RETURNING post_id
+)
+INSERT INTO post_stats (
+    post_id,
+    view
+)
+SELECT
+    post_id,
+    1
+FROM visitor
+ON CONFLICT (post_id)
+DO UPDATE
+SET view = post_stats.view + 1
+`
+
+type IncrementPostStatsViewParams struct {
+	PostID int32      `json:"post_id"`
+	Ip     netip.Addr `json:"ip"`
+}
+
+func (q *Queries) IncrementPostStatsView(ctx context.Context, arg IncrementPostStatsViewParams) error {
+	_, err := q.db.Exec(ctx, incrementPostStatsView, arg.PostID, arg.Ip)
+	return err
+}

internal/db/sqlc/sys_api.sql.go

@@ -0,0 +1,259 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: sys_api.sql
+
+package db
+
+import (
+	"context"
+)
+
+const countSysApis = `-- name: CountSysApis :one
+SELECT COUNT(*)
+FROM sys_apis
+`
+
+func (q *Queries) CountSysApis(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countSysApis)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createSysApi = `-- name: CreateSysApi :one
+INSERT INTO sys_apis (name, group_name, method, path, sort)
+VALUES ($1, $2, $3, $4, $5)
+RETURNING id
+`
+
+type CreateSysApiParams struct {
+	Name      string `json:"name"`
+	GroupName string `json:"group_name"`
+	Method    string `json:"method"`
+	Path      string `json:"path"`
+	Sort      *int32 `json:"sort"`
+}
+
+func (q *Queries) CreateSysApi(ctx context.Context, arg CreateSysApiParams) (int32, error) {
+	row := q.db.QueryRow(ctx, createSysApi,
+		arg.Name,
+		arg.GroupName,
+		arg.Method,
+		arg.Path,
+		arg.Sort,
+	)
+	var id int32
+	err := row.Scan(&id)
+	return id, err
+}
+
+const createSysApiPermission = `-- name: CreateSysApiPermission :exec
+INSERT INTO sys_api_permission (api_id, permission_id)
+VALUES ($1, $2)
+`
+
+type CreateSysApiPermissionParams struct {
+	ApiID        int32 `json:"api_id"`
+	PermissionID int32 `json:"permission_id"`
+}
+
+func (q *Queries) CreateSysApiPermission(ctx context.Context, arg CreateSysApiPermissionParams) error {
+	_, err := q.db.Exec(ctx, createSysApiPermission, arg.ApiID, arg.PermissionID)
+	return err
+}
+
+const deleteSysApi = `-- name: DeleteSysApi :execrows
+DELETE
+FROM sys_apis
+WHERE id = $1
+`
+
+func (q *Queries) DeleteSysApi(ctx context.Context, id int32) (int64, error) {
+	result, err := q.db.Exec(ctx, deleteSysApi, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const deleteSysApiPermission = `-- name: DeleteSysApiPermission :exec
+DELETE
+FROM sys_api_permission
+WHERE api_id = $1
+`
+
+func (q *Queries) DeleteSysApiPermission(ctx context.Context, apiID int32) error {
+	_, err := q.db.Exec(ctx, deleteSysApiPermission, apiID)
+	return err
+}
+
+const deleteSysPermissionBySysApiID = `-- name: DeleteSysPermissionBySysApiID :exec
+DELETE
+FROM sys_permissions
+WHERE id IN (SELECT permission_id
+             FROM sys_api_permission
+             WHERE api_id = $1)
+`
+
+func (q *Queries) DeleteSysPermissionBySysApiID(ctx context.Context, apiID int32) error {
+	_, err := q.db.Exec(ctx, deleteSysPermissionBySysApiID, apiID)
+	return err
+}
+
+const getAllSysApis = `-- name: GetAllSysApis :many
+SELECT id, group_name, name, method, path, sort, created_at, updated_at
+FROM sys_apis
+ORDER BY sort ASC
+`
+
+func (q *Queries) GetAllSysApis(ctx context.Context) ([]SysApi, error) {
+	rows, err := q.db.Query(ctx, getAllSysApis)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []SysApi{}
+	for rows.Next() {
+		var i SysApi
+		if err := rows.Scan(
+			&i.ID,
+			&i.GroupName,
+			&i.Name,
+			&i.Method,
+			&i.Path,
+			&i.Sort,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysApiByID = `-- name: GetSysApiByID :one
+SELECT id, group_name, name, method, path, sort, created_at, updated_at
+FROM sys_apis
+WHERE id = $1
+`
+
+func (q *Queries) GetSysApiByID(ctx context.Context, id int32) (SysApi, error) {
+	row := q.db.QueryRow(ctx, getSysApiByID, id)
+	var i SysApi
+	err := row.Scan(
+		&i.ID,
+		&i.GroupName,
+		&i.Name,
+		&i.Method,
+		&i.Path,
+		&i.Sort,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getSysApiGroupNames = `-- name: GetSysApiGroupNames :many
+SELECT DISTINCT group_name
+FROM sys_apis
+`
+
+func (q *Queries) GetSysApiGroupNames(ctx context.Context) ([]string, error) {
+	rows, err := q.db.Query(ctx, getSysApiGroupNames)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []string{}
+	for rows.Next() {
+		var group_name string
+		if err := rows.Scan(&group_name); err != nil {
+			return nil, err
+		}
+		items = append(items, group_name)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysApis = `-- name: GetSysApis :many
+SELECT id, group_name, name, method, path, sort, created_at, updated_at
+FROM sys_apis
+ORDER BY id
+LIMIT $1 OFFSET $2
+`
+
+type GetSysApisParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+func (q *Queries) GetSysApis(ctx context.Context, arg GetSysApisParams) ([]SysApi, error) {
+	rows, err := q.db.Query(ctx, getSysApis, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []SysApi{}
+	for rows.Next() {
+		var i SysApi
+		if err := rows.Scan(
+			&i.ID,
+			&i.GroupName,
+			&i.Name,
+			&i.Method,
+			&i.Path,
+			&i.Sort,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateSysApi = `-- name: UpdateSysApi :execrows
+UPDATE sys_apis
+SET name       = $2,
+    method     = $3,
+    path       = $4,
+    sort       = $5,
+    group_name = $6
+WHERE id = $1
+`
+
+type UpdateSysApiParams struct {
+	ID        int32  `json:"id"`
+	Name      string `json:"name"`
+	Method    string `json:"method"`
+	Path      string `json:"path"`
+	Sort      *int32 `json:"sort"`
+	GroupName string `json:"group_name"`
+}
+
+func (q *Queries) UpdateSysApi(ctx context.Context, arg UpdateSysApiParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateSysApi,
+		arg.ID,
+		arg.Name,
+		arg.Method,
+		arg.Path,
+		arg.Sort,
+		arg.GroupName,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}

internal/db/sqlc/sys_menu.sql.go

@@ -0,0 +1,327 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: sys_menu.sql
+
+package db
+
+import (
+	"context"
+	"time"
+)
+
+const countSysMenus = `-- name: CountSysMenus :one
+SELECT COUNT(*)
+FROM sys_menus
+`
+
+func (q *Queries) CountSysMenus(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countSysMenus)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createSysMenu = `-- name: CreateSysMenu :one
+INSERT INTO sys_menus (name, path, component, type, hidden, sort, status, parent_id, icon)
+VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)
+RETURNING id
+`
+
+type CreateSysMenuParams struct {
+	Name      string  `json:"name"`
+	Path      string  `json:"path"`
+	Component *string `json:"component"`
+	Type      int16   `json:"type"`
+	Hidden    *bool   `json:"hidden"`
+	Sort      *int32  `json:"sort"`
+	Status    int16   `json:"status"`
+	ParentID  *int32  `json:"parent_id"`
+	Icon      *int32  `json:"icon"`
+}
+
+func (q *Queries) CreateSysMenu(ctx context.Context, arg CreateSysMenuParams) (int32, error) {
+	row := q.db.QueryRow(ctx, createSysMenu,
+		arg.Name,
+		arg.Path,
+		arg.Component,
+		arg.Type,
+		arg.Hidden,
+		arg.Sort,
+		arg.Status,
+		arg.ParentID,
+		arg.Icon,
+	)
+	var id int32
+	err := row.Scan(&id)
+	return id, err
+}
+
+const createSysMenuPermission = `-- name: CreateSysMenuPermission :exec
+INSERT INTO sys_menu_permission (menu_id, permission_id)
+VALUES ($1, $2)
+`
+
+type CreateSysMenuPermissionParams struct {
+	MenuID       int32 `json:"menu_id"`
+	PermissionID int32 `json:"permission_id"`
+}
+
+func (q *Queries) CreateSysMenuPermission(ctx context.Context, arg CreateSysMenuPermissionParams) error {
+	_, err := q.db.Exec(ctx, createSysMenuPermission, arg.MenuID, arg.PermissionID)
+	return err
+}
+
+const deleteSysMenu = `-- name: DeleteSysMenu :execrows
+DELETE
+FROM sys_menus
+WHERE id = $1
+`
+
+func (q *Queries) DeleteSysMenu(ctx context.Context, id int32) (int64, error) {
+	result, err := q.db.Exec(ctx, deleteSysMenu, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const deleteSysMenuPermission = `-- name: DeleteSysMenuPermission :exec
+DELETE
+FROM sys_menu_permission
+WHERE menu_id = $1
+`
+
+func (q *Queries) DeleteSysMenuPermission(ctx context.Context, menuID int32) error {
+	_, err := q.db.Exec(ctx, deleteSysMenuPermission, menuID)
+	return err
+}
+
+const deleteSysPermissionByMenuID = `-- name: DeleteSysPermissionByMenuID :exec
+DELETE
+FROM sys_permissions
+WHERE id IN (SELECT permission_id
+             FROM sys_menu_permission
+             WHERE menu_id = $1)
+`
+
+func (q *Queries) DeleteSysPermissionByMenuID(ctx context.Context, menuID int32) error {
+	_, err := q.db.Exec(ctx, deleteSysPermissionByMenuID, menuID)
+	return err
+}
+
+const getAllSysMenus = `-- name: GetAllSysMenus :many
+SELECT m.id, m.name, m.path, m.component, m.type, m.hidden, m.sort, m.status, m.parent_id, m.icon, m.created_at, m.updated_at,
+       p.code AS permission_code
+FROM sys_menus m
+         LEFT JOIN sys_menu_permission mp ON m.id = mp.menu_id
+         LEFT JOIN sys_permissions p ON p.id = mp.permission_id
+ORDER BY m.sort ASC,
+         m.id ASC
+`
+
+type GetAllSysMenusRow struct {
+	ID             int32      `json:"id"`
+	Name           string     `json:"name"`
+	Path           string     `json:"path"`
+	Component      *string    `json:"component"`
+	Type           int16      `json:"type"`
+	Hidden         *bool      `json:"hidden"`
+	Sort           *int32     `json:"sort"`
+	Status         int16      `json:"status"`
+	ParentID       *int32     `json:"parent_id"`
+	Icon           *int32     `json:"icon"`
+	CreatedAt      time.Time  `json:"created_at"`
+	UpdatedAt      *time.Time `json:"updated_at"`
+	PermissionCode *string    `json:"permission_code"`
+}
+
+func (q *Queries) GetAllSysMenus(ctx context.Context) ([]GetAllSysMenusRow, error) {
+	rows, err := q.db.Query(ctx, getAllSysMenus)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetAllSysMenusRow{}
+	for rows.Next() {
+		var i GetAllSysMenusRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Path,
+			&i.Component,
+			&i.Type,
+			&i.Hidden,
+			&i.Sort,
+			&i.Status,
+			&i.ParentID,
+			&i.Icon,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.PermissionCode,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysMenuByID = `-- name: GetSysMenuByID :one
+SELECT id, name, path, component, type, hidden, sort, status, parent_id, icon, created_at, updated_at
+FROM sys_menus
+WHERE id = $1
+`
+
+func (q *Queries) GetSysMenuByID(ctx context.Context, id int32) (SysMenu, error) {
+	row := q.db.QueryRow(ctx, getSysMenuByID, id)
+	var i SysMenu
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.Path,
+		&i.Component,
+		&i.Type,
+		&i.Hidden,
+		&i.Sort,
+		&i.Status,
+		&i.ParentID,
+		&i.Icon,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const listSysMenus = `-- name: ListSysMenus :many
+SELECT m.id, m.name, m.path, m.component, m.type, m.hidden, m.sort, m.status, m.parent_id, m.icon, m.created_at, m.updated_at, p.code AS permission_code
+FROM sys_menus m
+         LEFT JOIN sys_menu_permission mp ON m.id = mp.menu_id
+         LEFT JOIN sys_permissions p ON mp.permission_id = p.id
+ORDER BY m.id
+LIMIT $1 OFFSET $2
+`
+
+type ListSysMenusParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+type ListSysMenusRow struct {
+	ID             int32      `json:"id"`
+	Name           string     `json:"name"`
+	Path           string     `json:"path"`
+	Component      *string    `json:"component"`
+	Type           int16      `json:"type"`
+	Hidden         *bool      `json:"hidden"`
+	Sort           *int32     `json:"sort"`
+	Status         int16      `json:"status"`
+	ParentID       *int32     `json:"parent_id"`
+	Icon           *int32     `json:"icon"`
+	CreatedAt      time.Time  `json:"created_at"`
+	UpdatedAt      *time.Time `json:"updated_at"`
+	PermissionCode *string    `json:"permission_code"`
+}
+
+func (q *Queries) ListSysMenus(ctx context.Context, arg ListSysMenusParams) ([]ListSysMenusRow, error) {
+	rows, err := q.db.Query(ctx, listSysMenus, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSysMenusRow{}
+	for rows.Next() {
+		var i ListSysMenusRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Path,
+			&i.Component,
+			&i.Type,
+			&i.Hidden,
+			&i.Sort,
+			&i.Status,
+			&i.ParentID,
+			&i.Icon,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+			&i.PermissionCode,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateSysMenu = `-- name: UpdateSysMenu :execrows
+UPDATE sys_menus
+SET name      = coalesce($1, name),
+    path      = coalesce($2, path),
+    component = coalesce($3, component),
+    type      = coalesce($4, type),
+    hidden    = coalesce($5, hidden),
+    sort      = coalesce($6, sort),
+    status    = coalesce($7, status),
+    icon      = coalesce($8, status),
+    parent_id = CASE WHEN $9::boolean THEN $10 ELSE parent_id END
+WHERE id = $11
+`
+
+type UpdateSysMenuParams struct {
+	Name           *string `json:"name"`
+	Path           *string `json:"path"`
+	Component      *string `json:"component"`
+	Type           *int16  `json:"type"`
+	Hidden         *bool   `json:"hidden"`
+	Sort           *int32  `json:"sort"`
+	Status         *int16  `json:"status"`
+	Icon           *int32  `json:"icon"`
+	UpdateParentID bool    `json:"update_parent_id"`
+	ParentID       *int32  `json:"parent_id"`
+	ID             int32   `json:"id"`
+}
+
+func (q *Queries) UpdateSysMenu(ctx context.Context, arg UpdateSysMenuParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateSysMenu,
+		arg.Name,
+		arg.Path,
+		arg.Component,
+		arg.Type,
+		arg.Hidden,
+		arg.Sort,
+		arg.Status,
+		arg.Icon,
+		arg.UpdateParentID,
+		arg.ParentID,
+		arg.ID,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const updateSysMenuPermissionCode = `-- name: UpdateSysMenuPermissionCode :exec
+UPDATE sys_permissions p
+SET code = coalesce($2, code)
+FROM sys_menu_permission mp
+WHERE p.id = mp.permission_id
+  AND mp.menu_id = $1
+`
+
+type UpdateSysMenuPermissionCodeParams struct {
+	MenuID int32   `json:"menu_id"`
+	Code   *string `json:"code"`
+}
+
+func (q *Queries) UpdateSysMenuPermissionCode(ctx context.Context, arg UpdateSysMenuPermissionCodeParams) error {
+	_, err := q.db.Exec(ctx, updateSysMenuPermissionCode, arg.MenuID, arg.Code)
+	return err
+}

internal/db/sqlc/sys_permission.sql.go

@@ -0,0 +1,54 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: sys_permission.sql
+
+package db
+
+import (
+	"context"
+)
+
+const createSysPermission = `-- name: CreateSysPermission :one
+INSERT INTO sys_permissions(type,code)
+VALUES ($1,$2) RETURNING id
+`
+
+type CreateSysPermissionParams struct {
+	Type int16   `json:"type"`
+	Code *string `json:"code"`
+}
+
+func (q *Queries) CreateSysPermission(ctx context.Context, arg CreateSysPermissionParams) (int32, error) {
+	row := q.db.QueryRow(ctx, createSysPermission, arg.Type, arg.Code)
+	var id int32
+	err := row.Scan(&id)
+	return id, err
+}
+
+const deleteSysPermission = `-- name: DeleteSysPermission :exec
+DELETE
+FROM sys_permissions
+WHERE id = $1
+`
+
+func (q *Queries) DeleteSysPermission(ctx context.Context, id int32) error {
+	_, err := q.db.Exec(ctx, deleteSysPermission, id)
+	return err
+}
+
+const updateSysPermission = `-- name: UpdateSysPermission :exec
+UPDATE sys_permissions
+SET code = $2
+WHERE id = $1
+`
+
+type UpdateSysPermissionParams struct {
+	ID   int32   `json:"id"`
+	Code *string `json:"code"`
+}
+
+func (q *Queries) UpdateSysPermission(ctx context.Context, arg UpdateSysPermissionParams) error {
+	_, err := q.db.Exec(ctx, updateSysPermission, arg.ID, arg.Code)
+	return err
+}

internal/db/sqlc/sys_role.sql.go

@@ -0,0 +1,321 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: sys_role.sql
+
+package db
+
+import (
+	"context"
+)
+
+const countSysRoles = `-- name: CountSysRoles :one
+SELECT COUNT(*)
+FROM sys_roles
+`
+
+func (q *Queries) CountSysRoles(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countSysRoles)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createSysRole = `-- name: CreateSysRole :exec
+INSERT INTO sys_roles (name, code)
+VALUES ($1, $2)
+`
+
+type CreateSysRoleParams struct {
+	Name string `json:"name"`
+	Code string `json:"code"`
+}
+
+func (q *Queries) CreateSysRole(ctx context.Context, arg CreateSysRoleParams) error {
+	_, err := q.db.Exec(ctx, createSysRole, arg.Name, arg.Code)
+	return err
+}
+
+type CreateSysRolePermissionParams struct {
+	RoleID       int32 `json:"role_id"`
+	PermissionID int32 `json:"permission_id"`
+}
+
+const deleteSysRole = `-- name: DeleteSysRole :execrows
+DELETE
+FROM sys_roles
+WHERE id = $1
+`
+
+func (q *Queries) DeleteSysRole(ctx context.Context, id int32) (int64, error) {
+	result, err := q.db.Exec(ctx, deleteSysRole, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const deleteSysRolePermission = `-- name: DeleteSysRolePermission :exec
+DELETE
+FROM sys_role_permission rp USING sys_permissions p
+WHERE rp.permission_id = p.id
+  AND p."type" = $2
+  AND rp.role_id = $1
+`
+
+type DeleteSysRolePermissionParams struct {
+	RoleID int32 `json:"role_id"`
+	Type   int16 `json:"type"`
+}
+
+func (q *Queries) DeleteSysRolePermission(ctx context.Context, arg DeleteSysRolePermissionParams) error {
+	_, err := q.db.Exec(ctx, deleteSysRolePermission, arg.RoleID, arg.Type)
+	return err
+}
+
+const existsSysRoleCode = `-- name: ExistsSysRoleCode :one
+SELECT EXISTS(SELECT 1
+              FROM sys_roles
+              WHERE code = $1
+                AND (
+                  $2::integer IS NULL
+                      OR id <> $2::integer
+                  ))
+`
+
+type ExistsSysRoleCodeParams struct {
+	Code string `json:"code"`
+	ID   *int32 `json:"id"`
+}
+
+func (q *Queries) ExistsSysRoleCode(ctx context.Context, arg ExistsSysRoleCodeParams) (bool, error) {
+	row := q.db.QueryRow(ctx, existsSysRoleCode, arg.Code, arg.ID)
+	var exists bool
+	err := row.Scan(&exists)
+	return exists, err
+}
+
+const getAllSysRoles = `-- name: GetAllSysRoles :many
+SELECT id, name, code, created_at, updated_at
+from sys_roles
+`
+
+func (q *Queries) GetAllSysRoles(ctx context.Context) ([]SysRole, error) {
+	rows, err := q.db.Query(ctx, getAllSysRoles)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []SysRole{}
+	for rows.Next() {
+		var i SysRole
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Code,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysPermissionIdsByApiIDs = `-- name: GetSysPermissionIdsByApiIDs :many
+SELECT permission_id
+FROM sys_api_permission
+WHERE api_id = ANY ($1::int[])
+`
+
+func (q *Queries) GetSysPermissionIdsByApiIDs(ctx context.Context, dollar_1 []int32) ([]int32, error) {
+	rows, err := q.db.Query(ctx, getSysPermissionIdsByApiIDs, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []int32{}
+	for rows.Next() {
+		var permission_id int32
+		if err := rows.Scan(&permission_id); err != nil {
+			return nil, err
+		}
+		items = append(items, permission_id)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysPermissionIdsByMenuIDs = `-- name: GetSysPermissionIdsByMenuIDs :many
+SELECT permission_id
+FROM sys_menu_permission
+WHERE menu_id = ANY ($1::int[])
+`
+
+func (q *Queries) GetSysPermissionIdsByMenuIDs(ctx context.Context, dollar_1 []int32) ([]int32, error) {
+	rows, err := q.db.Query(ctx, getSysPermissionIdsByMenuIDs, dollar_1)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []int32{}
+	for rows.Next() {
+		var permission_id int32
+		if err := rows.Scan(&permission_id); err != nil {
+			return nil, err
+		}
+		items = append(items, permission_id)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysRoleApis = `-- name: GetSysRoleApis :many
+SELECT a.id, a."name"
+FROM sys_role_permission rp
+         JOIN sys_api_permission ap ON ap.permission_id = rp.permission_id
+         JOIN sys_apis a ON a.id = ap.api_id
+WHERE rp.role_id = $1
+`
+
+type GetSysRoleApisRow struct {
+	ID   int32  `json:"id"`
+	Name string `json:"name"`
+}
+
+func (q *Queries) GetSysRoleApis(ctx context.Context, roleID int32) ([]GetSysRoleApisRow, error) {
+	rows, err := q.db.Query(ctx, getSysRoleApis, roleID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetSysRoleApisRow{}
+	for rows.Next() {
+		var i GetSysRoleApisRow
+		if err := rows.Scan(&i.ID, &i.Name); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysRoleByID = `-- name: GetSysRoleByID :one
+SELECT id, name, code, created_at, updated_at
+FROM sys_roles
+WHERE id = $1
+`
+
+func (q *Queries) GetSysRoleByID(ctx context.Context, id int32) (SysRole, error) {
+	row := q.db.QueryRow(ctx, getSysRoleByID, id)
+	var i SysRole
+	err := row.Scan(
+		&i.ID,
+		&i.Name,
+		&i.Code,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getSysRoleMenus = `-- name: GetSysRoleMenus :many
+SELECT m.id, m.name
+FROM sys_role_permission rp
+         JOIN sys_menu_permission mp ON mp.permission_id = rp.permission_id
+         JOIN sys_menus m ON m.id = mp.menu_id
+WHERE rp.role_id = $1
+`
+
+type GetSysRoleMenusRow struct {
+	ID   int32  `json:"id"`
+	Name string `json:"name"`
+}
+
+func (q *Queries) GetSysRoleMenus(ctx context.Context, roleID int32) ([]GetSysRoleMenusRow, error) {
+	rows, err := q.db.Query(ctx, getSysRoleMenus, roleID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetSysRoleMenusRow{}
+	for rows.Next() {
+		var i GetSysRoleMenusRow
+		if err := rows.Scan(&i.ID, &i.Name); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSysRoles = `-- name: ListSysRoles :many
+SELECT id, name, code, created_at, updated_at
+FROM sys_roles
+ORDER BY id
+LIMIT $1 OFFSET $2
+`
+
+type ListSysRolesParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+func (q *Queries) ListSysRoles(ctx context.Context, arg ListSysRolesParams) ([]SysRole, error) {
+	rows, err := q.db.Query(ctx, listSysRoles, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []SysRole{}
+	for rows.Next() {
+		var i SysRole
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Code,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateSysRole = `-- name: UpdateSysRole :execrows
+UPDATE sys_roles
+SET name = coalesce($1, name)
+WHERE id = $2
+`
+
+type UpdateSysRoleParams struct {
+	Name *string `json:"name"`
+	ID   int32   `json:"id"`
+}
+
+func (q *Queries) UpdateSysRole(ctx context.Context, arg UpdateSysRoleParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateSysRole, arg.Name, arg.ID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}

internal/db/sqlc/sys_user.sql.go

@@ -0,0 +1,426 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: sys_user.sql
+
+package db
+
+import (
+	"context"
+	"time"
+)
+
+const clearSysUserRoles = `-- name: ClearSysUserRoles :exec
+DELETE
+FROM sys_user_role
+WHERE user_id = $1
+`
+
+func (q *Queries) ClearSysUserRoles(ctx context.Context, userID int32) error {
+	_, err := q.db.Exec(ctx, clearSysUserRoles, userID)
+	return err
+}
+
+const countSysUsers = `-- name: CountSysUsers :one
+SELECT COUNT(*)
+FROM sys_users
+`
+
+func (q *Queries) CountSysUsers(ctx context.Context) (int64, error) {
+	row := q.db.QueryRow(ctx, countSysUsers)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const createSysUser = `-- name: CreateSysUser :exec
+INSERT INTO sys_users (account, username, password_hash, avatar_id)
+VALUES ($1, $2, $3, $4)
+`
+
+type CreateSysUserParams struct {
+	Account      string `json:"account"`
+	Username     string `json:"username"`
+	PasswordHash string `json:"password_hash"`
+	AvatarID     *int32 `json:"avatar_id"`
+}
+
+func (q *Queries) CreateSysUser(ctx context.Context, arg CreateSysUserParams) error {
+	_, err := q.db.Exec(ctx, createSysUser,
+		arg.Account,
+		arg.Username,
+		arg.PasswordHash,
+		arg.AvatarID,
+	)
+	return err
+}
+
+const createSysUserRole = `-- name: CreateSysUserRole :exec
+INSERT INTO sys_user_role (user_id, role_id)
+VALUES ($1, $2)
+`
+
+type CreateSysUserRoleParams struct {
+	UserID int32 `json:"user_id"`
+	RoleID int32 `json:"role_id"`
+}
+
+func (q *Queries) CreateSysUserRole(ctx context.Context, arg CreateSysUserRoleParams) error {
+	_, err := q.db.Exec(ctx, createSysUserRole, arg.UserID, arg.RoleID)
+	return err
+}
+
+const deleteSysUser = `-- name: DeleteSysUser :execrows
+DELETE
+FROM sys_users
+WHERE id = $1
+  AND id <> 1
+`
+
+func (q *Queries) DeleteSysUser(ctx context.Context, id int32) (int64, error) {
+	result, err := q.db.Exec(ctx, deleteSysUser, id)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const getSysAdminMenus = `-- name: GetSysAdminMenus :many
+SELECT id, name, path, component, type, hidden, sort, status, parent_id, icon, created_at, updated_at
+FROM sys_menus
+ORDER BY sort, id
+`
+
+func (q *Queries) GetSysAdminMenus(ctx context.Context) ([]SysMenu, error) {
+	rows, err := q.db.Query(ctx, getSysAdminMenus)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []SysMenu{}
+	for rows.Next() {
+		var i SysMenu
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Path,
+			&i.Component,
+			&i.Type,
+			&i.Hidden,
+			&i.Sort,
+			&i.Status,
+			&i.ParentID,
+			&i.Icon,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysUserApis = `-- name: GetSysUserApis :many
+SELECT DISTINCT a.id,
+                a.PATH,
+                a.METHOD
+FROM sys_users u
+         JOIN sys_user_role ur ON u.id = ur.user_id
+         JOIN sys_role_permission rp ON rp.role_id = ur.role_id
+         JOIN sys_permissions p ON p.id = rp.permission_id
+    AND p.TYPE = 1
+         JOIN sys_api_permission ap ON ap.permission_id = p.id
+         JOIN sys_apis a ON a.id = ap.api_id
+WHERE u.id = $1
+`
+
+type GetSysUserApisRow struct {
+	ID     int32  `json:"id"`
+	Path   string `json:"path"`
+	Method string `json:"method"`
+}
+
+func (q *Queries) GetSysUserApis(ctx context.Context, id int32) ([]GetSysUserApisRow, error) {
+	rows, err := q.db.Query(ctx, getSysUserApis, id)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []GetSysUserApisRow{}
+	for rows.Next() {
+		var i GetSysUserApisRow
+		if err := rows.Scan(&i.ID, &i.Path, &i.Method); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysUserByAccount = `-- name: GetSysUserByAccount :one
+SELECT u.id,
+       u.account,
+       u.username,
+       u.password_hash,
+       u.avatar_id,
+       f.file_path AS avatar_url,
+       u.created_at,
+       u.updated_at
+FROM sys_users u
+         LEFT JOIN files f ON u.avatar_id = f.id
+WHERE u.account = $1
+`
+
+type GetSysUserByAccountRow struct {
+	ID           int32      `json:"id"`
+	Account      string     `json:"account"`
+	Username     string     `json:"username"`
+	PasswordHash string     `json:"password_hash"`
+	AvatarID     *int32     `json:"avatar_id"`
+	AvatarUrl    *string    `json:"avatar_url"`
+	CreatedAt    time.Time  `json:"created_at"`
+	UpdatedAt    *time.Time `json:"updated_at"`
+}
+
+func (q *Queries) GetSysUserByAccount(ctx context.Context, account string) (GetSysUserByAccountRow, error) {
+	row := q.db.QueryRow(ctx, getSysUserByAccount, account)
+	var i GetSysUserByAccountRow
+	err := row.Scan(
+		&i.ID,
+		&i.Account,
+		&i.Username,
+		&i.PasswordHash,
+		&i.AvatarID,
+		&i.AvatarUrl,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getSysUserByID = `-- name: GetSysUserByID :one
+SELECT u.id,
+       u.account,
+       u.username,
+       u.avatar_id,
+       f.file_path AS avatar_url,
+       u.created_at,
+       u.updated_at
+FROM sys_users u
+         LEFT JOIN files f ON u.avatar_id = f.id
+WHERE u.id = $1
+`
+
+type GetSysUserByIDRow struct {
+	ID        int32      `json:"id"`
+	Account   string     `json:"account"`
+	Username  string     `json:"username"`
+	AvatarID  *int32     `json:"avatar_id"`
+	AvatarUrl *string    `json:"avatar_url"`
+	CreatedAt time.Time  `json:"created_at"`
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+func (q *Queries) GetSysUserByID(ctx context.Context, id int32) (GetSysUserByIDRow, error) {
+	row := q.db.QueryRow(ctx, getSysUserByID, id)
+	var i GetSysUserByIDRow
+	err := row.Scan(
+		&i.ID,
+		&i.Account,
+		&i.Username,
+		&i.AvatarID,
+		&i.AvatarUrl,
+		&i.CreatedAt,
+		&i.UpdatedAt,
+	)
+	return i, err
+}
+
+const getSysUserMenus = `-- name: GetSysUserMenus :many
+SELECT DISTINCT m.id, m.name, m.path, m.component, m.type, m.hidden, m.sort, m.status, m.parent_id, m.icon, m.created_at, m.updated_at
+FROM sys_users u
+         JOIN sys_user_role ur ON ur.user_id = u.id
+         JOIN sys_roles r ON r.id = ur.role_id
+         JOIN sys_role_permission rp ON rp.role_id = r.id
+         JOIN sys_permissions p ON p.id = rp.permission_id
+         JOIN sys_menu_permission mp ON mp.permission_id = p.id
+         JOIN sys_menus m ON m.id = mp.menu_id
+WHERE u.id = $1
+ORDER BY m.sort, m.id
+`
+
+func (q *Queries) GetSysUserMenus(ctx context.Context, id int32) ([]SysMenu, error) {
+	rows, err := q.db.Query(ctx, getSysUserMenus, id)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []SysMenu{}
+	for rows.Next() {
+		var i SysMenu
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Path,
+			&i.Component,
+			&i.Type,
+			&i.Hidden,
+			&i.Sort,
+			&i.Status,
+			&i.ParentID,
+			&i.Icon,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const getSysUserRoles = `-- name: GetSysUserRoles :many
+SELECT r.id, r.name, r.code, r.created_at, r.updated_at
+FROM sys_roles r
+         JOIN sys_user_role ur ON r.id = ur.role_id
+WHERE ur.user_id = $1
+`
+
+func (q *Queries) GetSysUserRoles(ctx context.Context, userID int32) ([]SysRole, error) {
+	rows, err := q.db.Query(ctx, getSysUserRoles, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []SysRole{}
+	for rows.Next() {
+		var i SysRole
+		if err := rows.Scan(
+			&i.ID,
+			&i.Name,
+			&i.Code,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const listSysUsers = `-- name: ListSysUsers :many
+SELECT u.id,
+       u.account,
+       u.username,
+       u.avatar_id,
+       f.file_path AS avatar_url,
+       u.created_at,
+       u.updated_at
+FROM sys_users u
+         LEFT JOIN files f ON u.avatar_id = f.id
+ORDER BY u.id
+LIMIT $1 OFFSET $2
+`
+
+type ListSysUsersParams struct {
+	Limit  int32 `json:"limit"`
+	Offset int32 `json:"offset"`
+}
+
+type ListSysUsersRow struct {
+	ID        int32      `json:"id"`
+	Account   string     `json:"account"`
+	Username  string     `json:"username"`
+	AvatarID  *int32     `json:"avatar_id"`
+	AvatarUrl *string    `json:"avatar_url"`
+	CreatedAt time.Time  `json:"created_at"`
+	UpdatedAt *time.Time `json:"updated_at"`
+}
+
+func (q *Queries) ListSysUsers(ctx context.Context, arg ListSysUsersParams) ([]ListSysUsersRow, error) {
+	rows, err := q.db.Query(ctx, listSysUsers, arg.Limit, arg.Offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	items := []ListSysUsersRow{}
+	for rows.Next() {
+		var i ListSysUsersRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.Account,
+			&i.Username,
+			&i.AvatarID,
+			&i.AvatarUrl,
+			&i.CreatedAt,
+			&i.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const updateSysUser = `-- name: UpdateSysUser :execrows
+UPDATE sys_users
+SET username  = coalesce($1, username),
+    avatar_id = CASE WHEN $2::boolean THEN $3 ELSE avatar_id END
+WHERE id = $4
+`
+
+type UpdateSysUserParams struct {
+	Username       *string `json:"username"`
+	UpdateAvatarID bool    `json:"update_avatar_id"`
+	AvatarID       *int32  `json:"avatar_id"`
+	ID             int32   `json:"id"`
+}
+
+func (q *Queries) UpdateSysUser(ctx context.Context, arg UpdateSysUserParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateSysUser,
+		arg.Username,
+		arg.UpdateAvatarID,
+		arg.AvatarID,
+		arg.ID,
+	)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}
+
+const updateSysUserPassword = `-- name: UpdateSysUserPassword :execrows
+UPDATE sys_users
+SET password_hash = $2
+WHERE id = $1
+`
+
+type UpdateSysUserPasswordParams struct {
+	ID           int32  `json:"id"`
+	PasswordHash string `json:"password_hash"`
+}
+
+func (q *Queries) UpdateSysUserPassword(ctx context.Context, arg UpdateSysUserPasswordParams) (int64, error) {
+	result, err := q.db.Exec(ctx, updateSysUserPassword, arg.ID, arg.PasswordHash)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected(), nil
+}

internal/handler/category.go

@@ -0,0 +1,96 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+)
+
+type CategoryHandler struct {
+	categoryService *service.CategoryService
+}
+
+func NewCategoryHandler(categoryService *service.CategoryService) *CategoryHandler {
+	return &CategoryHandler{categoryService: categoryService}
+}
+
+func (h *CategoryHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+	list, total, err := h.categoryService.ListPage(r.Context(), pagination)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *CategoryHandler) ListAll(w http.ResponseWriter, r *http.Request) {
+	list, err := h.categoryService.ListAll(r.Context())
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *CategoryHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req request.CreateCategoryRequest
+
+	if err := httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err := h.categoryService.Create(r.Context(), req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *CategoryHandler) Update(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	var req request.UpdateCategoryRequest
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.categoryService.Update(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *CategoryHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.categoryService.Delete(r.Context(), id); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}

internal/handler/module.go

@@ -0,0 +1,20 @@
+package handler
+
+import (
+	"go.uber.org/fx"
+)
+
+var Module = fx.Module("handlers",
+	fx.Provide(
+		NewSysUserHandler,
+		NewSysRoleHandler,
+		NewSysMenuHandler,
+		NewSysApiHandler,
+		NewSysFileHandler,
+		NewSysPostHandler,
+		NewCategoryHandler,
+
+		NewPostHandler,
+		NewWebHandler,
+	),
+)

internal/handler/post.go

@@ -0,0 +1,83 @@
+package handler
+
+import (
+	"net/http"
+	"net/netip"
+	"server/internal/model/common"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+	"server/internal/utils"
+
+	"github.com/go-chi/chi/v5"
+)
+
+type PostHandler struct {
+	postService *service.PostService
+}
+
+func NewPostHandler(postService *service.PostService) *PostHandler {
+	return &PostHandler{postService: postService}
+}
+
+func (h *PostHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+
+	list, total, err := h.postService.ListPage(r.Context(), pagination)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *PostHandler) GetPost(w http.ResponseWriter, r *http.Request) {
+	slug := chi.URLParam(r, "slug")
+
+	if slug == "" {
+		httputil.Fail(w, errs.ErrSlugRequired)
+		return
+	}
+
+	ip, err := netip.ParseAddr(utils.ClientIP(r))
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	post, err := h.postService.GetPost(r.Context(), slug, ip)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, post)
+}
+
+func (h *PostHandler) ListCategoryStats(w http.ResponseWriter, r *http.Request) {
+	list, err := h.postService.ListCategoryStats(r.Context())
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *PostHandler) ListArchives(w http.ResponseWriter, r *http.Request) {
+	list, err := h.postService.ListArchives(r.Context())
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}

internal/handler/sys_api.go

@@ -0,0 +1,112 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+)
+
+type SysApiHandler struct {
+	apiService *service.SysApiService
+}
+
+func NewSysApiHandler(apiService *service.SysApiService) *SysApiHandler {
+	return &SysApiHandler{apiService: apiService}
+}
+
+func (h *SysApiHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+
+	list, total, err := h.apiService.ListPage(r.Context(), pagination)
+
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *SysApiHandler) GetAllSysApis(w http.ResponseWriter, r *http.Request) {
+	list, err := h.apiService.GetAllSysApis(r.Context())
+
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *SysApiHandler) GetApiGroupNames(w http.ResponseWriter, r *http.Request) {
+	list, err := h.apiService.GetApiGroupNames(r.Context())
+
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *SysApiHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req request.CreateSysApiRequest
+
+	if err := httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err := h.apiService.Create(r.Context(), req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysApiHandler) Update(w http.ResponseWriter, r *http.Request) {
+	var req request.UpdateSysApiRequest
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.apiService.Update(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysApiHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.apiService.Delete(r.Context(), id); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}

internal/handler/sys_file.go

@@ -0,0 +1,58 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+)
+
+type SysFileHandler struct {
+	service *service.SysFileService
+}
+
+func NewSysFileHandler(service *service.SysFileService) *SysFileHandler {
+	return &SysFileHandler{
+		service: service,
+	}
+}
+
+func (h *SysFileHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+
+	list, total, err := h.service.ListPage(r.Context(), pagination)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *SysFileHandler) Upload(w http.ResponseWriter, r *http.Request) {
+	folder := r.FormValue("folder")
+	if folder == "" {
+		folder = "/"
+	}
+
+	_, header, err := r.FormFile("file")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	file, err := h.service.Upload(r.Context(), folder, header)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, file)
+}

internal/handler/sys_menu.go

@@ -0,0 +1,100 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+)
+
+type SysMenuHandler struct {
+	menuService *service.SysMenuService
+}
+
+func NewSysMenuHandler(menuService *service.SysMenuService) *SysMenuHandler {
+	return &SysMenuHandler{menuService: menuService}
+}
+
+func (h *SysMenuHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+
+	list, total, err := h.menuService.ListPage(r.Context(), pagination)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *SysMenuHandler) GetMenus(w http.ResponseWriter, r *http.Request) {
+	list, err := h.menuService.GetMenus(r.Context())
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *SysMenuHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req request.CreateSysMenuRequest
+
+	if err := httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err := h.menuService.Create(r.Context(), req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysMenuHandler) Update(w http.ResponseWriter, r *http.Request) {
+	var req request.UpdateSysMenuRequest
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.menuService.Update(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysMenuHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.menuService.Delete(r.Context(), id); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+
+}

internal/handler/sys_post.go

@@ -0,0 +1,108 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+)
+
+type SysPostHandler struct {
+	sysPostService *service.SysPostService
+}
+
+func NewSysPostHandler(postService *service.SysPostService) *SysPostHandler {
+	return &SysPostHandler{sysPostService: postService}
+}
+
+func (h *SysPostHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+
+	list, total, err := h.sysPostService.ListPage(r.Context(), pagination)
+	if err != nil {
+		httputil.Fail(w, err)
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *SysPostHandler) GetPostById(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	post, err := h.sysPostService.FindByID(r.Context(), id)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, post)
+}
+
+func (h *SysPostHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req request.CreatePostRequest
+
+	if err := httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	postID, err := h.sysPostService.Create(r.Context(), req)
+
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, map[string]int32{
+		"post_id": postID,
+	})
+}
+
+func (h *SysPostHandler) Update(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	var req request.UpdatePostRequest
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.sysPostService.Update(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysPostHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.sysPostService.Delete(r.Context(), id); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}

internal/handler/sys_role.go

@@ -0,0 +1,177 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+)
+
+type SysRoleHandler struct {
+	roleService *service.SysRoleService
+}
+
+func NewSysRoleHandler(roleService *service.SysRoleService) *SysRoleHandler {
+	return &SysRoleHandler{roleService: roleService}
+}
+
+func (h *SysRoleHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+
+	list, total, err := h.roleService.ListPage(r.Context(), pagination)
+
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *SysRoleHandler) GetRoleMenus(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	list, err := h.roleService.GetRoleMenus(r.Context(), id)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *SysRoleHandler) GetRoleApis(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	list, err := h.roleService.GetRoleApis(r.Context(), id)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *SysRoleHandler) GetRoles(w http.ResponseWriter, r *http.Request) {
+	roles, err := h.roleService.GetRoles(r.Context())
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, roles)
+}
+
+func (h *SysRoleHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req request.CreateSysRoleRequest
+
+	if err := httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err := h.roleService.Create(r.Context(), req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysRoleHandler) Update(w http.ResponseWriter, r *http.Request) {
+	var req request.UpdateSysRoleRequest
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.roleService.Update(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysRoleHandler) SetRoleMenus(w http.ResponseWriter, r *http.Request) {
+	var req request.SetSysRoleMenusRequest
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.roleService.SetRoleMenus(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysRoleHandler) SetRoleApis(w http.ResponseWriter, r *http.Request) {
+	var req request.SetSysRoleApisRequest
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.roleService.SetRoleApis(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+
+}
+
+func (h *SysRoleHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.roleService.Delete(r.Context(), id); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}

internal/handler/sys_user.go

@@ -0,0 +1,239 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/middleware"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/httputil"
+	"server/internal/service"
+	"time"
+)
+
+type SysUserHandler struct {
+	userService *service.SysUserService
+}
+
+func NewSysUserHandler(userService *service.SysUserService) *SysUserHandler {
+	return &SysUserHandler{
+		userService: userService,
+	}
+}
+
+func (h *SysUserHandler) Login(w http.ResponseWriter, r *http.Request) {
+	var req request.LoginRequest
+
+	if err := httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, errs.ErrInvalidCredentials)
+		return
+	}
+
+	res, err := h.userService.Login(r.Context(), req)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	http.SetCookie(w, &http.Cookie{
+		Name:     "refresh_token",
+		Value:    res.RefreshToken,
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteNoneMode,
+		Expires:  res.RefreshTokenExp,
+	})
+
+	httputil.Ok(w, map[string]any{
+		"access_token":     res.AccessToken,
+		"access_token_exp": res.AccessTokenExp,
+	})
+}
+
+func (h *SysUserHandler) Logout(w http.ResponseWriter, r *http.Request) {
+	http.SetCookie(w, &http.Cookie{
+		Name:     "refresh_token",
+		Value:    "",
+		Path:     "/",
+		HttpOnly: true,
+		Secure:   true,
+		SameSite: http.SameSiteNoneMode,
+		MaxAge:   -1,
+		Expires:  time.Unix(0, 0),
+	})
+
+	httputil.Ok(w)
+}
+
+func (h *SysUserHandler) RefreshToken(w http.ResponseWriter, r *http.Request) {
+	cookie, err := r.Cookie("refresh_token")
+	if err != nil {
+		httputil.Fail(w, errs.ErrInvalidRefreshToken)
+		return
+	}
+
+	res, err := h.userService.RefreshToken(r.Context(), cookie.Value)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, map[string]any{
+		"access_token":     res.AccessToken,
+		"access_token_exp": res.AccessTokenExp,
+	})
+}
+
+func (h *SysUserHandler) ListPage(w http.ResponseWriter, r *http.Request) {
+	pagination := httputil.Pagination(r)
+
+	list, total, err := h.userService.ListPage(r.Context(), pagination)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	resp := common.PageResponse{
+		Page:     pagination.Page,
+		PageSize: pagination.PageSize,
+		List:     list,
+		Total:    total,
+	}
+
+	httputil.OkWithPage(w, &resp)
+}
+
+func (h *SysUserHandler) GetUserInfo(w http.ResponseWriter, r *http.Request) {
+	claims, ok := middleware.GetClaims(r.Context())
+
+	if !ok || claims.UserID == 0 {
+		httputil.Fail(w, errs.ErrUnauthorized)
+		return
+	}
+
+	isAdmin, _ := r.Context().Value(middleware.IsAdminKey).(bool)
+	uid := claims.UserID
+
+	user, err := h.userService.GetUserInfo(r.Context(), uid, isAdmin)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, user)
+}
+
+func (h *SysUserHandler) GetRoles(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	list, err := h.userService.GetRoles(r.Context(), id)
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w, list)
+}
+
+func (h *SysUserHandler) Create(w http.ResponseWriter, r *http.Request) {
+	var req request.CreateSysUserRequest
+
+	if err := httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err := h.userService.Create(r.Context(), req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysUserHandler) Update(w http.ResponseWriter, r *http.Request) {
+	var req request.UpdateSysUserRequest
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.userService.Update(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysUserHandler) SetRoles(w http.ResponseWriter, r *http.Request) {
+	var req request.SetSysUserRolesRequest
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.userService.SetRoles(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+
+}
+
+func (h *SysUserHandler) UpdatePassword(w http.ResponseWriter, r *http.Request) {
+	var req request.UpdateSysUserPassword
+
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = httputil.BindJson(r, &req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.userService.UpdatePassword(r.Context(), id, req); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}
+
+func (h *SysUserHandler) Delete(w http.ResponseWriter, r *http.Request) {
+	id, err := httputil.URLParamInt32(r, "id")
+	if err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	if err = h.userService.Delete(r.Context(), id); err != nil {
+		httputil.Fail(w, err)
+		return
+	}
+
+	httputil.Ok(w)
+}

internal/handler/web.go

@@ -0,0 +1,30 @@
+package handler
+
+import (
+	"net/http"
+	"server/internal/pkg/httputil"
+	"server/internal/utils"
+)
+
+type WebHandler struct {
+}
+
+func NewWebHandler() *WebHandler {
+	return &WebHandler{}
+}
+
+func (h *WebHandler) GetClientInfo(w http.ResponseWriter, r *http.Request) {
+	ip := utils.ClientIP(r)
+	userAgent := r.UserAgent()
+
+	httputil.Ok(w, map[string]any{
+		"ip":             ip,
+		"userAgent":      userAgent,
+		"method":         r.Method,
+		"host":           r.Host,
+		"path":           r.URL.Path,
+		"origin":         r.Header.Get("Origin"),
+		"accept":         r.Header.Get("Accept"),
+		"acceptLanguage": r.Header.Get("Accept-Language"),
+	})
+}

internal/middleware/auth.go

@@ -0,0 +1,101 @@
+package middleware
+
+import (
+	"context"
+	"net/http"
+	db "server/internal/db/sqlc"
+	"server/internal/pkg/cache"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/httputil"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+)
+
+const (
+	IsAdminKey contextKey = "is_admin"
+)
+
+type AuthMiddleware struct {
+	queries *db.Queries
+	cache   *cache.Caches
+}
+
+func NewAuthMiddleware(queries *db.Queries, cache *cache.Caches) *AuthMiddleware {
+	return &AuthMiddleware{
+		cache:   cache,
+		queries: queries,
+	}
+}
+
+func (m *AuthMiddleware) Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+
+		claims, ok := GetClaims(ctx)
+		if !ok || claims.UserID == 0 {
+			httputil.Fail(w, errs.ErrUnauthorized)
+			return
+		}
+
+		// 判断是否有管理员权限 目前只判断uid是否为1
+		isAdmin := userIsAdmin(claims.UserID)
+
+		if isAdmin {
+			ctx = context.WithValue(ctx, IsAdminKey, isAdmin)
+			next.ServeHTTP(w, r.WithContext(ctx))
+			return
+		}
+
+		hasPermission, err := userHasApiPermission(ctx, r, m.queries, claims.UserID, m.cache)
+		if err != nil {
+			httputil.Fail(w, err)
+			return
+		}
+
+		if !hasPermission {
+			httputil.Fail(w, errs.ErrPermissionDenied)
+			return
+		}
+
+		next.ServeHTTP(w, r)
+	})
+}
+
+func userIsAdmin(uid int32) bool {
+	if uid == 1 {
+		return true
+	}
+
+	return false
+}
+
+func userHasApiPermission(ctx context.Context, r *http.Request, queries *db.Queries, uid int32, cache *cache.Caches) (bool, error) {
+	var (
+		apis []db.GetSysUserApisRow
+		err  error
+	)
+
+	apis, ok := cache.SysUserApisCache.GetIfPresent(uid)
+
+	if !ok {
+		apis, err = queries.GetSysUserApis(ctx, uid)
+
+		if err != nil {
+			return false, err
+		}
+		cache.SysUserApisCache.Set(uid, apis)
+	}
+
+	requestPath := chi.RouteContext(r.Context()).RoutePattern()
+	requestPath = strings.TrimPrefix(requestPath, "/api")
+	requestMethod := r.Method
+
+	for _, api := range apis {
+		if api.Path == requestPath && api.Method == requestMethod {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}

internal/middleware/jwt.go

@@ -0,0 +1,184 @@
+package middleware
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"server/internal/config"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/httputil"
+	"strings"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type JWTMiddleware struct {
+	cfg *config.JWTConfig
+}
+
+type contextKey string
+
+const UserContextKey contextKey = "user"
+
+const RefreshTokenType = "refresh"
+
+type Claims struct {
+	UserID int32 `json:"user_id"`
+	jwt.RegisteredClaims
+}
+
+type RefreshClaims struct {
+	UserID int32  `json:"user_id"`
+	Type   string `json:"type"`
+	jwt.RegisteredClaims
+}
+
+func NewJWTMiddleware(cfg *config.Config) *JWTMiddleware {
+	jwtCfg := cfg.JWTConfig
+
+	return &JWTMiddleware{cfg: &jwtCfg}
+}
+
+func GetClaims(ctx context.Context) (*Claims, bool) {
+	claims, ok := ctx.Value(UserContextKey).(*Claims)
+	return claims, ok
+}
+
+// ParseToken 解析accessToken
+func (m *JWTMiddleware) ParseToken(tokenStr string) (*Claims, error) {
+	token, err := jwt.ParseWithClaims(
+		tokenStr,
+		&Claims{},
+		func(token *jwt.Token) (interface{}, error) {
+			return []byte(m.cfg.Secret), nil
+		},
+	)
+
+	if err != nil || !token.Valid {
+		return nil, errs.ErrInvalidToken
+	}
+
+	claims, ok := token.Claims.(*Claims)
+	if !ok {
+		return nil, errs.ErrInvalidTokenClaims
+	}
+
+	if claims.UserID == 0 {
+		return nil, errs.ErrInvalidTokenClaims
+	}
+
+	return claims, nil
+}
+
+// ParseRefreshToken 解析RefreshToken
+func (m *JWTMiddleware) ParseRefreshToken(tokenStr string) (*RefreshClaims, error) {
+	token, err := jwt.ParseWithClaims(
+		tokenStr,
+		&RefreshClaims{},
+		func(token *jwt.Token) (interface{}, error) {
+			return []byte(m.cfg.Secret), nil
+		},
+	)
+
+	if err != nil {
+		// Token 已过期
+		if errors.Is(err, jwt.ErrTokenExpired) {
+			return nil, errs.ErrExpiredRefreshToken
+		}
+
+		// 签名错误、格式错误、非法 Token
+		return nil, errs.ErrInvalidRefreshToken
+	}
+
+	if !token.Valid {
+		return nil, errs.ErrInvalidRefreshToken
+	}
+
+	claims, ok := token.Claims.(*RefreshClaims)
+	if !ok {
+		return nil, errs.ErrInvalidRefreshToken
+	}
+
+	if claims.UserID == 0 {
+		return nil, errs.ErrInvalidRefreshToken
+	}
+
+	if claims.Type != RefreshTokenType {
+		return nil, errs.ErrInvalidRefreshToken
+	}
+
+	return claims, nil
+}
+
+func (m *JWTMiddleware) Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		auth := r.Header.Get("Authorization")
+
+		if auth == "" {
+			httputil.Fail(w, errs.ErrUnauthenticated)
+			return
+		}
+
+		parts := strings.SplitN(auth, " ", 2)
+		if len(parts) != 2 || parts[0] != "Bearer" {
+			httputil.Fail(w, errs.ErrUnauthenticated)
+			return
+		}
+
+		tokenStr := parts[1]
+
+		claims, err := m.ParseToken(tokenStr)
+		if err != nil {
+			httputil.Fail(w, errs.ErrInvalidToken)
+			return
+		}
+
+		ctx := context.WithValue(r.Context(), UserContextKey, claims)
+
+		next.ServeHTTP(w, r.WithContext(ctx))
+	})
+}
+
+func (m *JWTMiddleware) GenerateAccessToken(userID int32) (string, time.Time, error) {
+	now := time.Now()
+	expiresAt := now.Add(m.cfg.Expire)
+
+	accessClaims := Claims{
+		UserID: userID,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			IssuedAt:  jwt.NewNumericDate(now),
+		},
+	}
+
+	accessToken := jwt.NewWithClaims(jwt.SigningMethodHS256, accessClaims)
+	token, err := accessToken.SignedString([]byte(m.cfg.Secret))
+	if err != nil {
+		return "", time.Time{}, err
+	}
+
+	return token, expiresAt, nil
+}
+
+func (m *JWTMiddleware) GenerateRefreshToken(userID int32) (string, time.Time, error) {
+	now := time.Now()
+	expiresAt := now.Add(m.cfg.RefreshExpire)
+
+	refreshClaims := RefreshClaims{
+		UserID: userID,
+		Type:   RefreshTokenType,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(expiresAt),
+			IssuedAt:  jwt.NewNumericDate(now),
+		},
+	}
+
+	refreshToken := jwt.NewWithClaims(jwt.SigningMethodHS256, refreshClaims)
+	token, err := refreshToken.SignedString([]byte(m.cfg.Secret))
+	if err != nil {
+		return "", time.Time{}, err
+	}
+
+	return token, expiresAt, nil
+}

internal/middleware/logger.go

@@ -0,0 +1,103 @@
+package middleware
+
+import (
+	"encoding/json"
+	"log/slog"
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/utils"
+	"time"
+
+	gonanoid "github.com/matoous/go-nanoid/v2"
+)
+
+type LoggerMiddleware struct {
+}
+
+type responseWriter struct {
+	http.ResponseWriter
+	statusCode int
+	bytes      int
+	errorMsg   string
+}
+
+func (rw *responseWriter) WriteHeader(code int) {
+	rw.statusCode = code
+	rw.ResponseWriter.WriteHeader(code)
+}
+
+func generateRequestID() string {
+	id, _ := gonanoid.New(16) // 16字符
+	return id
+}
+
+// extractErrorMessage 从响应体中提取错误信息
+func (rw *responseWriter) extractErrorMessage(body []byte) string {
+	var resp common.Response
+	if err := json.Unmarshal(body, &resp); err == nil && resp.Message != "" {
+		return resp.Message
+	}
+	return string(body)
+}
+
+func (rw *responseWriter) Write(b []byte) (int, error) {
+	n, err := rw.ResponseWriter.Write(b)
+	rw.bytes += n
+
+	// 只在错误状态码且未记录错误时处理
+	if rw.statusCode >= 400 && rw.errorMsg == "" && n > 0 {
+		rw.errorMsg = rw.extractErrorMessage(b[:n])
+	}
+
+	return n, err
+}
+
+func NewLoggerMiddleware() *LoggerMiddleware {
+	return &LoggerMiddleware{}
+}
+
+func (m *LoggerMiddleware) Middleware(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		start := time.Now()
+
+		reqID := generateRequestID()
+
+		wrapped := &responseWriter{
+			ResponseWriter: w,
+			statusCode:     http.StatusOK,
+		}
+
+		next.ServeHTTP(wrapped, r)
+
+		duration := time.Since(start)
+
+		ip := utils.ClientIP(r)
+
+		fullPath := r.URL.Path
+		if r.URL.RawQuery != "" {
+			fullPath = fullPath + "?" + r.URL.RawQuery
+		}
+
+		fields := []any{
+			"request_id", reqID,
+			"method", r.Method,
+			"path", fullPath,
+			"status", wrapped.statusCode,
+			"duration", duration,
+			"client_ip", ip,
+		}
+
+		if wrapped.errorMsg != "" {
+			fields = append(fields, "error", wrapped.errorMsg)
+		}
+
+		switch {
+		case wrapped.statusCode >= 500:
+			slog.Error("request", fields...)
+		case wrapped.statusCode >= 400:
+			slog.Warn("request", fields...)
+		default:
+			slog.Info("request", fields...)
+		}
+	})
+}

internal/model/common/request.go

@@ -0,0 +1,6 @@
+package common
+
+type Pagination struct {
+	Page     int32 `form:"page,default=1" validate:"gte=1"`
+	PageSize int32 `form:"page_size,default=10" validate:"gte=1,lte=100"`
+}

internal/model/common/response.go

@@ -0,0 +1,16 @@
+package common
+
+// Response 通用响应结构体
+type Response struct {
+	Message string      `json:"msg,omitempty"`  // 消息说明
+	Data    interface{} `json:"data,omitempty"` // 业务数据
+}
+
+// PageResponse 分页查询通用相应结构体
+type PageResponse struct {
+	Message  string      `json:"msg,omitempty"`  // 消息说明
+	Page     int32       `json:"page"`           // 当前页码
+	PageSize int32       `json:"page_size"`      // 每页数量
+	List     interface{} `json:"list,omitempty"` // 业务数据
+	Total    int64       `json:"total"`          // 总记录数
+}

internal/model/enum/enum.go

@@ -0,0 +1,33 @@
+package enum
+
+// Status 通用状态枚举
+type Status int16
+
+const (
+	StatusDisabled Status = iota // 0
+	StatusEnabled                // 1
+)
+
+// MenuType 菜单类型枚举
+type MenuType int16
+
+const (
+	MenuTypeDirectory MenuType = iota // 0
+	MenuTypeMenu                      // 1
+	MenuTypeButton                    // 2
+)
+
+type PermissionType int16
+
+const (
+	PermissionTypeMenu PermissionType = iota // 0
+	PermissionTypeApi                        // 1
+)
+
+type PostStatus int16
+
+const (
+	PostStatusDraft     PostStatus = iota // 0: 草稿
+	PostStatusPublished                   // 1: 已发布
+	PostStatusOffline                     // 2: 已下线
+)

internal/model/request/category.go

@@ -0,0 +1,11 @@
+package request
+
+type CreateCategoryRequest struct {
+	Name string `json:"name" validate:"required,min=1"`
+	Code string `json:"code" validate:"required,min=1"`
+}
+
+type UpdateCategoryRequest struct {
+	Name *string `json:"name" validate:"omitempty,min=1"`
+	Code *string `json:"code" validate:"omitempty,min=1"`
+}

internal/model/request/post.go

@@ -0,0 +1,30 @@
+package request
+
+import (
+	"time"
+)
+
+type CreatePostRequest struct {
+	Title       string    `json:"title" validate:"required,min=1"`
+	CoverID     *int32    `json:"cover_id" validate:"required,min=1"`
+	Slug        string    `json:"slug" validate:"required,min=0"`
+	Content     string    `json:"content" validate:"required,min=0"`
+	Summary     string    `json:"summary" validate:"required,min=0"`
+	Status      *int16    `json:"status" validate:"required,oneof=0 1 2"`
+	Sort        *int32    `json:"sort" validate:"required,min=0"`
+	PublishedAt time.Time `json:"published_at" validate:"required"`
+	CategoryID  *int32    `json:"category_id" validate:"required,min=1"`
+}
+
+type UpdatePostRequest struct {
+	Title       *string    `json:"title" validate:"omitempty,min=1"`
+	CoverID     *int32     `json:"cover_id" validate:"omitempty,min=1"`
+	Slug        *string    `json:"slug" validate:"omitempty,min=1"`
+	Content     *string    `json:"content" validate:"required,min=0"`
+	Summary     *string    `json:"summary" validate:"omitempty,min=1"`
+	Status      *int16     `json:"status" validate:"omitempty,oneof=0 1 2"`
+	View        *int32     `json:"view" validate:"omitempty,min=1"`
+	Sort        *int32     `json:"sort" validate:"omitempty,min=0"`
+	PublishedAt *time.Time `json:"published_at" validate:"omitempty"`
+	CategoryID  *int32     `json:"category_id" validate:"required,min=1"`
+}

internal/model/request/sys_api.go

@@ -0,0 +1,17 @@
+package request
+
+type CreateSysApiRequest struct {
+	Name      string `json:"name" validate:"required,min=1,max=100"`
+	GroupName string `json:"group_name" validate:"required,min=1,max=100"`
+	Path      string `json:"path" validate:"required,min=1,max=100"`
+	Method    string `json:"method" validate:"required,oneof=GET POST PUT PATCH DELETE"`
+	Sort      *int32 `json:"sort" validate:"required,min=0"`
+}
+
+type UpdateSysApiRequest struct {
+	Name      string `json:"name" validate:"required,min=1,max=100"`
+	GroupName string `json:"group_name" validate:"required,min=1,max=100"`
+	Path      string `json:"path" validate:"required,min=1,max=100"`
+	Method    string `json:"method" validate:"required,oneof=GET POST PUT PATCH DELETE"`
+	Sort      *int32 `json:"sort" validate:"required,min=0"`
+}

internal/model/request/sys_menu.go

@@ -0,0 +1,31 @@
+package request
+
+import (
+	"server/internal/pkg/validator"
+)
+
+type CreateSysMenuRequest struct {
+	Name           string  `json:"name" validate:"required,min=1,max=100"`
+	Path           string  `json:"path" validate:"required,min=1,max=100"`
+	Type           *int16  `json:"type" validate:"required,oneof=0 1 2"`
+	Component      *string `json:"component" validate:"omitempty"`
+	Hidden         *bool   `json:"hidden" validate:"omitempty"`
+	Sort           *int32  `json:"sort" validate:"required,min=0"`
+	Status         *int16  `json:"status" validate:"required,oneof=0 1"`
+	ParentID       *int32  `json:"parent_id" validate:"omitempty,gt=0"`
+	Icon           *int32  `json:"icon" validate:"omitempty"`
+	PermissionCode string  `json:"permission_code" validate:"required,min=1,max=100"`
+}
+
+type UpdateSysMenuRequest struct {
+	Name           *string             `json:"name" validate:"omitempty,min=1,max=100"`
+	Path           *string             `json:"path" validate:"omitempty,min=1,max=100"`
+	Type           *int16              `json:"type" validate:"omitempty,oneof=0 1 2"`
+	Component      *string             `json:"component" validate:"omitempty"`
+	Hidden         *bool               `json:"hidden" validate:"omitempty"`
+	Sort           *int32              `json:"sort" validate:"omitempty,min=0"`
+	Status         *int16              `json:"status" validate:"omitempty,oneof=0 1"`
+	ParentID       validator.NullInt32 `json:"parent_id" validate:"omitempty"`
+	Icon           *int32              `json:"icon" validate:"omitempty"`
+	PermissionCode *string             `json:"permission_code" validate:"omitempty,min=1,max=100"`
+}

internal/model/request/sys_permission.go

@@ -0,0 +1 @@
+package request

internal/model/request/sys_role.go

@@ -0,0 +1,18 @@
+package request
+
+type CreateSysRoleRequest struct {
+	Name string `json:"name" validate:"required,min=1,max=100"`
+	Code string `json:"code" validate:"required,max=100"`
+}
+
+type UpdateSysRoleRequest struct {
+	Name *string `json:"name" validate:"min=1,max=100"`
+}
+
+type SetSysRoleMenusRequest struct {
+	MenuIDs []int32 `json:"menu_ids" validate:"required,dive,gt=0"`
+}
+
+type SetSysRoleApisRequest struct {
+	ApiIDs []int32 `json:"api_ids" validate:"required,dive,gt=0"`
+}

internal/model/request/sys_user.go

@@ -0,0 +1,30 @@
+package request
+
+import (
+	"server/internal/pkg/validator"
+)
+
+type CreateSysUserRequest struct {
+	Username string `json:"username" validate:"required"`
+	Account  string `json:"account" validate:"required,min=5,max=100"`
+	Password string `json:"password" validate:"required,min=6,max=255"`
+	AvatarID *int32 `json:"avatar_id" validate:"omitempty"`
+}
+
+type UpdateSysUserRequest struct {
+	Username *string             `json:"username" validate:"omitempty,min=0,max=50"`
+	AvatarID validator.NullInt32 `json:"avatar_id" validate:"omitempty"`
+}
+
+type UpdateSysUserPassword struct {
+	Password string `json:"password" validate:"required,min=6,max=255"`
+}
+
+type SetSysUserRolesRequest struct {
+	RoleIDs []int32 `json:"role_ids" validate:"required,dive,gt=0"`
+}
+
+type LoginRequest struct {
+	Account  string `json:"account" validate:"required,min=5,max=100"`
+	Password string `json:"password" validate:"required,min=6,max=255"`
+}

internal/model/response/post.go

@@ -0,0 +1,25 @@
+package response
+
+import (
+	"time"
+)
+
+type ArchivePost struct {
+	ID                 int32     `json:"id"`
+	Slug               string    `json:"slug"`
+	Title              string    `json:"title"`
+	PublishedAt        time.Time `json:"published_at"`
+	PublishedAtDisplay string    `json:"published_at_display"`
+	CategoryName       string    `json:"category_name"`
+}
+
+type ArchiveMonth struct {
+	Month   int           `json:"month"`
+	Archive []ArchivePost `json:"list"`
+}
+
+type ArchiveYear struct {
+	Year         int            `json:"year"`
+	Total        int            `json:"total"`
+	ArchiveMonth []ArchiveMonth `json:"list"`
+}

internal/model/response/sys_file.go

@@ -0,0 +1,15 @@
+package response
+
+import (
+	db "server/internal/db/sqlc"
+	"server/internal/pkg/httputil"
+)
+
+func ToFiles(files []db.File) []db.File {
+	result := make([]db.File, len(files))
+	for i := range files {
+		result[i] = files[i]
+		result[i].FilePath = httputil.BuildFileUrl(&files[i].FilePath)
+	}
+	return result
+}

internal/model/response/sys_user.go

@@ -0,0 +1,45 @@
+package response
+
+import (
+	db "server/internal/db/sqlc"
+	"server/internal/pkg/httputil"
+	"time"
+)
+
+type SysUserRolesResponse struct {
+	ID          uint   `json:"id"`
+	Code        string `json:"code"`
+	Description string `json:"description"`
+}
+
+type SysUserInfo struct {
+	ID        int32        `json:"id"`
+	Account   string       `json:"account"`
+	Username  string       `json:"username"`
+	AvatarUrl string       `json:"avatar_url"`
+	Roles     []string     `json:"roles"`
+	Menus     []db.SysMenu `json:"menus"`
+}
+
+type LoginResponse struct {
+	AccessToken     string    `json:"access_token"`
+	AccessTokenExp  time.Time `json:"access_token_exp"`
+	RefreshToken    string    `json:"refresh_token"`
+	RefreshTokenExp time.Time `json:"refresh_token_exp"`
+}
+
+func NewSysUserInfo(user db.GetSysUserByIDRow, roles []db.SysRole, menus []db.SysMenu) *SysUserInfo {
+	roleCodes := make([]string, len(roles))
+	for i, role := range roles {
+		roleCodes[i] = role.Code
+	}
+
+	return &SysUserInfo{
+		ID:        user.ID,
+		Account:   user.Account,
+		Username:  user.Username,
+		AvatarUrl: httputil.BuildFileUrl(user.AvatarUrl),
+		Roles:     roleCodes,
+		Menus:     menus,
+	}
+}

internal/pkg/cache/cache.go

@@ -0,0 +1,31 @@
+package cache
+
+import (
+	"server/internal/db/sqlc"
+
+	"github.com/maypok86/otter/v2"
+)
+
+type Caches struct {
+	SysUserApisCache *otter.Cache[int32, []db.GetSysUserApisRow]
+}
+
+func NewCaches() *Caches {
+	sysUserApisCache := otter.Must(&otter.Options[int32, []db.GetSysUserApisRow]{
+		MaximumSize: 1_000,
+	})
+
+	return &Caches{
+		SysUserApisCache: sysUserApisCache,
+	}
+}
+
+// ClearSysUserCache 清理单个用户缓存
+func (c *Caches) ClearSysUserCache(userID int32) {
+	c.SysUserApisCache.Invalidate(userID)
+}
+
+// ClearAllSysUserCache 清理所有用户缓存
+func (c *Caches) ClearAllSysUserCache() {
+	c.SysUserApisCache.InvalidateAll()
+}

internal/pkg/dberr/postgres.go

@@ -0,0 +1,49 @@
+package dberr
+
+import (
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgconn"
+)
+
+const (
+	SysUserAccountKey     = "sys_users_account_key"
+	SysRoleCodeKey        = "sys_roles_code_key"
+	PostSlugKey           = "posts_slug_key"
+	SysPermissionsCodeKey = "sys_permissions_code_key"
+	SysApisMethodPathKey  = "sys_apis_method_path_key"
+	CategoryCodeKey       = "categories_code_key"
+)
+
+func MapRowsAffected(rows int64, err error, notFoundErr error) error {
+	if err != nil {
+		return err
+	}
+	if rows == 0 {
+		return notFoundErr
+	}
+	return nil
+}
+
+func MapNoRows(err error, notFoundErr error) error {
+	if errors.Is(err, pgx.ErrNoRows) {
+		return notFoundErr
+	}
+	return err
+}
+
+func MapUniqueViolation(err error, constraint string, uniqueErr error) error {
+	if err == nil {
+		return nil
+	}
+
+	var pgErr *pgconn.PgError
+	if errors.As(err, &pgErr) &&
+		pgErr.Code == "23505" &&
+		pgErr.ConstraintName == constraint {
+		return uniqueErr
+	}
+
+	return err
+}

internal/pkg/errs/errs.go

@@ -0,0 +1,48 @@
+package errs
+
+import "net/http"
+
+type AppError struct {
+	HTTPCode int
+	Msg      string
+}
+
+func (e *AppError) Error() string {
+	return e.Msg
+}
+
+func New(httpCode int, msg string) *AppError {
+	return &AppError{
+		HTTPCode: httpCode,
+		Msg:      msg,
+	}
+}
+
+var (
+	ErrInvalidCredentials            = New(http.StatusUnauthorized, "用户名或密码错误")
+	ErrUnauthenticated               = New(http.StatusUnauthorized, "用户未登录或登录已失效")
+	ErrUnauthorized                  = New(http.StatusUnauthorized, "认证失败：无法获取当前用户信息")
+	ErrInvalidToken                  = New(http.StatusUnauthorized, "登录凭证无效")
+	ErrInvalidTokenClaims            = New(http.StatusUnauthorized, "登录凭证解析失败")
+	ErrInvalidRefreshToken           = New(http.StatusBadRequest, "invalid_grant")
+	ErrExpiredRefreshToken           = New(http.StatusBadRequest, "invalid_grant")
+	ErrUserNotFound                  = New(http.StatusNotFound, "用户数据不存在")
+	ErrCategoryNotFound              = New(http.StatusNotFound, "分类数据不存在")
+	ErrSysApiNotFound                = New(http.StatusNotFound, "接口数据不存在")
+	ErrPostNotFound                  = New(http.StatusNotFound, "文章数据不存在")
+	ErrSysMenuNotFound               = New(http.StatusNotFound, "菜单数据不存在")
+	ErrSysRoleNotFound               = New(http.StatusNotFound, "角色数据不存在")
+	ErrCannotDeleteSuperAdmin        = New(http.StatusForbidden, "超级管理员账号无法被删除")
+	ErrSlugRequired                  = New(http.StatusBadRequest, "slug不能为空")
+	ErrIDRequired                    = New(http.StatusBadRequest, "id不能为空")
+	ErrPermissionDenied              = New(http.StatusForbidden, "没有权限访问该资源")
+	ErrInvalidID                     = New(http.StatusBadRequest, "id非法请检查传入的id")
+	ErrEmptyBody                     = New(http.StatusBadRequest, "请求内容(body)不能为空")
+	ErrInvalidJSON                   = New(http.StatusBadRequest, "请求数据格式错误")
+	ErrAccountAlreadyExists          = New(http.StatusBadRequest, "账号已存在")
+	ErrCodeAlreadyExists             = New(http.StatusBadRequest, "角色编码已存在")
+	ErrSlugAlreadyExists             = New(http.StatusBadRequest, "slug已存在")
+	ErrPermissionCodeAlreadyExists   = New(http.StatusBadRequest, "权限编码已存在")
+	ErrCategoryCodeAlreadyExists     = New(http.StatusBadRequest, "分类编码已存在")
+	ErrSysApiMethodPathAlreadyExists = New(http.StatusBadRequest, "接口方法(method)路径(path)已存在")
+)

internal/pkg/httputil/request.go

@@ -0,0 +1,90 @@
+package httputil
+
+import (
+	"encoding/json"
+	"errors"
+	"io"
+	"net/http"
+	"net/url"
+	"server/internal/config"
+	"server/internal/model/common"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/validator"
+	"strconv"
+
+	"github.com/go-chi/chi/v5"
+)
+
+// Pagination 分页请求参数
+func Pagination(r *http.Request) *common.Pagination {
+	q := r.URL.Query()
+
+	// page 默认 1
+	page := int32(1)
+	if p := q.Get("page"); p != "" {
+		if v, err := strconv.Atoi(p); err == nil && v >= 1 {
+			page = int32(v)
+		}
+	}
+
+	// pageSize 默认 10
+	pageSize := int32(10)
+	if ps := q.Get("page_size"); ps != "" {
+		if v, err := strconv.Atoi(ps); err == nil && v >= 1 && v <= 100 {
+			pageSize = int32(v)
+		}
+	}
+
+	return &common.Pagination{
+		Page:     page,
+		PageSize: pageSize,
+	}
+}
+
+func URLParamInt32(r *http.Request, key string) (int32, error) {
+	v := chi.URLParam(r, key)
+
+	if v == "" {
+		return 0, errs.ErrIDRequired
+	}
+
+	n, err := strconv.ParseInt(v, 10, 32)
+	if err != nil {
+		return 0, errs.ErrInvalidID
+	}
+
+	return int32(n), nil
+}
+
+func BindJson(r *http.Request, dest any) error {
+	if err := json.NewDecoder(r.Body).Decode(dest); err != nil {
+		if errors.Is(err, io.EOF) {
+			return errs.ErrEmptyBody
+		}
+		return errs.ErrInvalidJSON
+	}
+
+	if err := validator.Struct(dest); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func BuildFileUrl(path *string) string {
+	if path == nil || *path == "" {
+		return ""
+	}
+
+	baseURL := config.GetString("file.base_url")
+	if baseURL == "" {
+		return ""
+	}
+
+	result, err := url.JoinPath(baseURL, *path)
+	if err != nil {
+		return ""
+	}
+
+	return result
+}

internal/pkg/httputil/response.go

@@ -0,0 +1,65 @@
+package httputil
+
+import (
+	"encoding/json"
+	"errors"
+	"log/slog"
+	"net/http"
+	"server/internal/model/common"
+	"server/internal/pkg/errs"
+	validatorI18 "server/internal/pkg/validator"
+	"strings"
+
+	"github.com/go-playground/validator/v10"
+)
+
+func respondWithJSON(w http.ResponseWriter, code int, data any) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(code)
+	if err := json.NewEncoder(w).Encode(data); err != nil {
+		slog.Error("respondWithJSON: failed to encode response", "error", err)
+	}
+}
+
+func Ok(w http.ResponseWriter, data ...any) {
+	resp := common.Response{
+		Message: "ok",
+	}
+
+	if len(data) > 0 && data[0] != nil {
+		resp.Data = data[0]
+	}
+
+	respondWithJSON(w, http.StatusOK, resp)
+}
+
+func OkWithPage(w http.ResponseWriter, pageResp *common.PageResponse) {
+	pageResp.Message = "ok"
+	respondWithJSON(w, http.StatusOK, pageResp)
+}
+
+// Fail 响应失败
+func Fail(w http.ResponseWriter, err error) {
+	var msg string
+	// 默认code 500
+	httpStatusCode := http.StatusInternalServerError
+
+	var validationErrs validator.ValidationErrors
+	var appErr *errs.AppError
+	if errors.As(err, &validationErrs) {
+		httpStatusCode = http.StatusBadRequest
+		msgs := validatorI18.Translate(err)
+		msg = strings.Join(msgs, "; ")
+	} else if errors.As(err, &appErr) {
+		httpStatusCode = appErr.HTTPCode
+		msg = appErr.Msg
+	} else {
+		msg = err.Error()
+	}
+
+	resp := common.Response{
+		Message: msg,
+	}
+
+	respondWithJSON(w, httpStatusCode, resp)
+}

internal/pkg/logger/logger.go

@@ -0,0 +1,76 @@
+package logger
+
+import (
+	"io"
+	"log/slog"
+	"os"
+	"strings"
+
+	"server/internal/config"
+
+	"gopkg.in/natefinch/lumberjack.v2"
+)
+
+// New 根据配置创建 slog.Logger，并将其设置为默认 logger。
+// 日志会写入文件（自动按大小/时间滚动），并可选同时输出到控制台。
+func New(cfg *config.Config) *slog.Logger {
+	logCfg := cfg.Log
+
+	// 文件滚动写入
+	fileWriter := &lumberjack.Logger{
+		Filename:   defaultStr(logCfg.Filename, "logs/app.log"),
+		MaxSize:    defaultInt(logCfg.MaxSize, 100), // MB
+		MaxBackups: defaultInt(logCfg.MaxBackups, 30),
+		MaxAge:     defaultInt(logCfg.MaxAge, 30), // days
+		Compress:   logCfg.Compress,
+	}
+
+	var writer io.Writer = fileWriter
+	if logCfg.Console {
+		writer = io.MultiWriter(os.Stdout, fileWriter)
+	}
+
+	opts := &slog.HandlerOptions{
+		Level:     parseLevel(logCfg.Level),
+		AddSource: false,
+	}
+
+	// 生产环境用 JSON，便于日志采集/检索；开发环境用文本更易读
+	var handler slog.Handler
+	if config.IsDev() {
+		handler = slog.NewTextHandler(writer, opts)
+	} else {
+		handler = slog.NewJSONHandler(writer, opts)
+	}
+
+	l := slog.New(handler)
+	slog.SetDefault(l) // 让全局 slog.Info/Error 也走同一套配置
+	return l
+}
+
+func parseLevel(level string) slog.Level {
+	switch strings.ToLower(level) {
+	case "debug":
+		return slog.LevelDebug
+	case "warn", "warning":
+		return slog.LevelWarn
+	case "error":
+		return slog.LevelError
+	default:
+		return slog.LevelInfo
+	}
+}
+
+func defaultStr(v, def string) string {
+	if v == "" {
+		return def
+	}
+	return v
+}
+
+func defaultInt(v, def int) int {
+	if v <= 0 {
+		return def
+	}
+	return v
+}

internal/pkg/validator/null_int32.go

@@ -0,0 +1,28 @@
+package validator
+
+import "encoding/json"
+
+// NullInt32 Valid(false) + Set(true) = null | Valid(false) + Set(false) = nil
+type NullInt32 struct {
+	Value int32
+	Valid bool
+	Set   bool
+}
+
+func (i *NullInt32) UnmarshalJSON(data []byte) error {
+	i.Set = true
+
+	if string(data) == "null" {
+		i.Valid = false
+		return nil
+	}
+
+	var temp int32
+	if err := json.Unmarshal(data, &temp); err != nil {
+		return err
+	}
+
+	i.Value = temp
+	i.Valid = true
+	return nil
+}

internal/pkg/validator/validator.go

@@ -0,0 +1,66 @@
+package validator
+
+import (
+	"errors"
+	"reflect"
+
+	"github.com/go-playground/locales/zh"
+	ut "github.com/go-playground/universal-translator"
+	"github.com/go-playground/validator/v10"
+	zhtranslations "github.com/go-playground/validator/v10/translations/zh"
+)
+
+var (
+	trans    ut.Translator
+	validate *validator.Validate
+)
+
+func InitValidatorZh() {
+	langZh := zh.New()
+	uni := ut.New(langZh, langZh)
+	var found bool
+	trans, found = uni.GetTranslator("zh")
+
+	if !found {
+		panic("translator 'zh' not found")
+	}
+
+	err := zhtranslations.RegisterDefaultTranslations(validate, trans)
+	if err != nil {
+		panic("failed to register zh translations: " + err.Error())
+	}
+}
+
+func init() {
+	validate = validator.New()
+
+	// 注册自定义标签名称
+	validate.RegisterTagNameFunc(func(field reflect.StructField) string {
+		name := field.Tag.Get("json")
+		if name == "-" {
+			return ""
+		}
+		return name
+	})
+
+	// 初始化中文翻译器
+	InitValidatorZh()
+}
+
+func Translate(err error) []string {
+	var validateErrs validator.ValidationErrors
+	if errors.As(err, &validateErrs) {
+		messages := make([]string, 0, len(validateErrs))
+		for _, e := range validateErrs {
+			messages = append(messages, e.Translate(trans))
+		}
+		return messages
+	}
+
+	// 非校验错误 直接返回
+	return []string{err.Error()}
+}
+
+func Struct(s any) error {
+	return validate.Struct(s)
+}

internal/router/client.go

@@ -0,0 +1,18 @@
+package router
+
+import (
+	"server/internal/handler"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func SetupPostRoutes(r chi.Router, h *handler.PostHandler) {
+	r.Get("/post", h.ListPage)
+	r.Get("/post/{slug}", h.GetPost)
+	r.Get("/category/stats", h.ListCategoryStats)
+	r.Get("/post/archive", h.ListArchives)
+}
+
+func SetupWebRoutes(r chi.Router, h *handler.WebHandler) {
+
+}

internal/router/router.go

@@ -0,0 +1,80 @@
+package router
+
+import (
+	"net/http"
+	"os"
+	"path/filepath"
+	"server/internal/config"
+	"server/internal/handler"
+	"server/internal/middleware"
+
+	"github.com/go-chi/chi/v5"
+	"go.uber.org/fx"
+)
+
+type Handlers struct {
+	fx.In
+	// auth
+	JwtMiddleware    *middleware.JWTMiddleware
+	AuthMiddleware   *middleware.AuthMiddleware
+	LoggerMiddleware *middleware.LoggerMiddleware
+	// system
+	SysUserHandler  *handler.SysUserHandler
+	SysRoleHandler  *handler.SysRoleHandler
+	SysMenuHandler  *handler.SysMenuHandler
+	SysApiHandler   *handler.SysApiHandler
+	SysFileHandler  *handler.SysFileHandler
+	SysPostHandler  *handler.SysPostHandler
+	CategoryHandler *handler.CategoryHandler
+	// web
+	PostHandler *handler.PostHandler
+	WebHandler  *handler.WebHandler
+}
+
+func setupStaticFiles(r chi.Router) {
+	rootDir, _ := os.Getwd()
+
+	uploadsDir := filepath.Join(rootDir, "uploads")
+
+	r.Handle("/static/*", http.StripPrefix("/static/", http.FileServer(http.Dir(uploadsDir))))
+}
+
+func NewRouter(m Handlers) *chi.Mux {
+	r := chi.NewRouter()
+
+	r.Use(m.LoggerMiddleware.Middleware)
+
+	if config.IsDev() {
+		// 开放静态目录
+		setupStaticFiles(r)
+	}
+
+	r.Route("/api/admin", func(r chi.Router) {
+		r.Post("/auth/login", m.SysUserHandler.Login)
+		r.Post("/auth/refresh-token", m.SysUserHandler.RefreshToken)
+		r.Post("/auth/logout", m.SysUserHandler.Logout)
+
+		r.Group(func(r chi.Router) {
+			r.Use(m.JwtMiddleware.Middleware)
+			r.Use(m.AuthMiddleware.Middleware)
+
+			SetupSysUserRoutes(r, m.SysUserHandler)
+			SetupSysRoleRoutes(r, m.SysRoleHandler)
+			SetupSysMenuRoutes(r, m.SysMenuHandler)
+			SetupSysApiRoutes(r, m.SysApiHandler)
+			SetupSysFileRoutes(r, m.SysFileHandler)
+			SetupCategoryRoutes(r, m.CategoryHandler)
+			SetupSysPostRoutes(r, m.SysPostHandler)
+		})
+
+	})
+
+	// web api
+	r.Route("/api", func(r chi.Router) {
+		r.Group(func(r chi.Router) {
+			SetupPostRoutes(r, m.PostHandler)
+			SetupWebRoutes(r, m.WebHandler)
+		})
+	})
+	return r
+}

internal/router/system.go

@@ -0,0 +1,68 @@
+package router
+
+import (
+	"server/internal/handler"
+
+	"github.com/go-chi/chi/v5"
+)
+
+func SetupSysUserRoutes(r chi.Router, h *handler.SysUserHandler) {
+	r.Get("/user", h.ListPage)
+	r.Get("/user/info", h.GetUserInfo)
+	r.Get("/user/{id}/roles", h.GetRoles)
+	r.Post("/user", h.Create)
+	r.Patch("/user/{id}", h.Update)
+	r.Put("/user/{id}/roles", h.SetRoles)
+	r.Patch("/user/{id}/password", h.UpdatePassword)
+	r.Delete("/user/{id}", h.Delete)
+}
+
+func SetupSysRoleRoutes(r chi.Router, h *handler.SysRoleHandler) {
+	r.Get("/role", h.ListPage)
+	r.Get("/role/{id}/menus", h.GetRoleMenus)
+	r.Get("/role/{id}/apis", h.GetRoleApis)
+	r.Get("/role/all", h.GetRoles)
+	r.Post("/role", h.Create)
+	r.Patch("/role/{id}", h.Update)
+	r.Put("/role/{id}/menus", h.SetRoleMenus)
+	r.Put("/role/{id}/apis", h.SetRoleApis)
+	r.Delete("/role/{id}", h.Delete)
+}
+
+func SetupSysMenuRoutes(r chi.Router, h *handler.SysMenuHandler) {
+	r.Get("/menu", h.ListPage)
+	r.Get("/menu/all", h.GetMenus)
+	r.Post("/menu", h.Create)
+	r.Patch("/menu/{id}", h.Update)
+	r.Delete("/menu/{id}", h.Delete)
+}
+
+func SetupSysApiRoutes(r chi.Router, h *handler.SysApiHandler) {
+	r.Get("/api", h.ListPage)
+	r.Get("/api/all", h.GetAllSysApis)
+	r.Get("/api/group-names", h.GetApiGroupNames)
+	r.Post("/api", h.Create)
+	r.Patch("/api/{id}", h.Update)
+	r.Delete("/api/{id}", h.Delete)
+}
+
+func SetupSysFileRoutes(r chi.Router, h *handler.SysFileHandler) {
+	r.Get("/file", h.ListPage)
+	r.Post("/file", h.Upload)
+}
+
+func SetupSysPostRoutes(r chi.Router, h *handler.SysPostHandler) {
+	r.Get("/post", h.ListPage)
+	r.Get("/post/{id}", h.GetPostById)
+	r.Post("/post", h.Create)
+	r.Patch("/post/{id}", h.Update)
+	r.Delete("/post/{id}", h.Delete)
+}
+
+func SetupCategoryRoutes(r chi.Router, h *handler.CategoryHandler) {
+	r.Get("/category", h.ListPage)
+	r.Get("/category/all", h.ListAll)
+	r.Post("/category", h.Create)
+	r.Patch("/category/{id}", h.Update)
+	r.Delete("/category/{id}", h.Delete)
+}

internal/service/category.go

@@ -0,0 +1,74 @@
+package service
+
+import (
+	"context"
+	db "server/internal/db/sqlc"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/dberr"
+	"server/internal/pkg/errs"
+)
+
+type CategoryService struct {
+	queries *db.Queries
+}
+
+func NewCategoryService(queries *db.Queries) *CategoryService {
+	return &CategoryService{
+		queries: queries,
+	}
+}
+
+func (s *CategoryService) ListPage(ctx context.Context, p *common.Pagination) ([]db.Category, int64, error) {
+	params := db.ListCategoriesParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountCategories(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	list, err := s.queries.ListCategories(ctx, params)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return list, total, nil
+}
+
+func (s *CategoryService) ListAll(ctx context.Context) ([]db.Category, error) {
+	return s.queries.ListAllCategories(ctx)
+}
+
+func (s *CategoryService) Create(ctx context.Context, req request.CreateCategoryRequest) error {
+	params := db.CreateCategoryParams{
+		Name: req.Name,
+		Code: req.Code,
+	}
+
+	err := s.queries.CreateCategory(ctx, params)
+	return dberr.MapUniqueViolation(err, dberr.CategoryCodeKey, errs.ErrCategoryCodeAlreadyExists)
+}
+
+func (s *CategoryService) Update(ctx context.Context, id int32, req request.UpdateCategoryRequest) error {
+	params := db.UpdateCategoryParams{
+		ID:   id,
+		Name: req.Name,
+		Code: req.Code,
+	}
+	rows, err := s.queries.UpdateCategory(ctx, params)
+	// 先判断数据条目是否存在
+	if err = dberr.MapRowsAffected(rows, err, errs.ErrCategoryNotFound); err != nil {
+		// 再判断code是否重复
+		return dberr.MapUniqueViolation(err, dberr.CategoryCodeKey, errs.ErrCategoryCodeAlreadyExists)
+	}
+
+	return nil
+}
+
+func (s *CategoryService) Delete(ctx context.Context, id int32) error {
+	rows, err := s.queries.DeleteCategory(ctx, id)
+	return dberr.MapRowsAffected(rows, err, errs.ErrCategoryNotFound)
+}

internal/service/module.go

@@ -0,0 +1,19 @@
+package service
+
+import (
+	"go.uber.org/fx"
+)
+
+var Module = fx.Module("services",
+	fx.Provide(
+		NewSysUserService,
+		NewSysRoleService,
+		NewSysMenuService,
+		NewSysApiService,
+		NewSysFileService,
+		NewSysPostService,
+
+		NewPostService,
+		NewCategoryService,
+	),
+)

internal/service/post.go

@@ -0,0 +1,113 @@
+package service
+
+import (
+	"context"
+	"net/netip"
+	db "server/internal/db/sqlc"
+	"server/internal/model/common"
+	"server/internal/model/response"
+	"server/internal/pkg/dberr"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/httputil"
+)
+
+type PostService struct {
+	queries *db.Queries
+}
+
+func NewPostService(queries *db.Queries) *PostService {
+	return &PostService{
+		queries: queries,
+	}
+}
+
+func (s *PostService) ListPage(ctx context.Context, p *common.Pagination) ([]db.ListPublishedPostsRow, int64, error) {
+	params := db.ListPublishedPostsParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountPublishedPosts(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	list, err := s.queries.ListPublishedPosts(ctx, params)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	for i := range list {
+		url := httputil.BuildFileUrl(list[i].Cover)
+		list[i].Cover = &url
+	}
+
+	return list, total, nil
+}
+
+func (s *PostService) GetPost(ctx context.Context, slug string, ip netip.Addr) (*db.GetPublicPostBySlugRow, error) {
+	post, err := s.queries.GetPublicPostBySlug(ctx, slug)
+	if err != nil {
+		return nil, dberr.MapNoRows(err, errs.ErrPostNotFound)
+	}
+
+	_ = s.queries.IncrementPostStatsView(ctx, db.IncrementPostStatsViewParams{
+		PostID: post.ID,
+		Ip:     ip,
+	})
+
+	return &post, nil
+}
+
+func (s *PostService) ListCategoryStats(ctx context.Context) ([]db.ListCategoryStatsRow, error) {
+	return s.queries.ListCategoryStats(ctx)
+}
+
+func (s *PostService) ListArchives(ctx context.Context) ([]response.ArchiveYear, error) {
+	list, err := s.queries.ListArchives(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	archive := make([]response.ArchiveYear, 0)
+
+	for _, item := range list {
+		y := item.PublishedAt.Year()
+		m := int(item.PublishedAt.Month())
+
+		if len(archive) == 0 || archive[len(archive)-1].Year != y {
+			archive = append(archive, response.ArchiveYear{
+				Year:         y,
+				Total:        0,
+				ArchiveMonth: make([]response.ArchiveMonth, 0),
+			})
+		}
+
+		// 获取索引
+		lastYearIndex := len(archive) - 1
+
+		months := archive[lastYearIndex].ArchiveMonth
+		if len(months) == 0 || months[len(months)-1].Month != m {
+			archive[lastYearIndex].ArchiveMonth = append(archive[lastYearIndex].ArchiveMonth, response.ArchiveMonth{
+				Month:   m,
+				Archive: make([]response.ArchivePost, 0),
+			})
+		}
+
+		lastMonthIndex := len(archive[lastYearIndex].ArchiveMonth) - 1
+
+		archive[lastYearIndex].ArchiveMonth[lastMonthIndex].Archive =
+			append(archive[lastYearIndex].ArchiveMonth[lastMonthIndex].Archive, response.ArchivePost{
+				ID:                 item.ID,
+				Slug:               item.Slug,
+				Title:              item.Title,
+				PublishedAt:        item.PublishedAt,
+				PublishedAtDisplay: item.PublishedAt.Format("01-02"),
+				CategoryName:       *item.CategoryName,
+			})
+
+		archive[lastYearIndex].Total++
+	}
+
+	return archive, nil
+}

internal/service/sys_api.go

@@ -0,0 +1,158 @@
+package service
+
+import (
+	"context"
+	db "server/internal/db/sqlc"
+	"server/internal/model/common"
+	"server/internal/model/enum"
+	"server/internal/model/request"
+	"server/internal/pkg/cache"
+	"server/internal/pkg/dberr"
+	"server/internal/pkg/errs"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type SysApiService struct {
+	queries *db.Queries
+	pool    *pgxpool.Pool
+	cache   *cache.Caches
+}
+
+func NewSysApiService(queries *db.Queries, pool *pgxpool.Pool, cache *cache.Caches) *SysApiService {
+	return &SysApiService{queries: queries, pool: pool, cache: cache}
+}
+
+func (s *SysApiService) ListPage(ctx context.Context, p *common.Pagination) ([]db.SysApi, int64, error) {
+	params := db.GetSysApisParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountSysApis(ctx)
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	list, err := s.queries.GetSysApis(ctx, params)
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return list, total, nil
+}
+
+func (s *SysApiService) GetAllSysApis(ctx context.Context) ([]db.SysApi, error) {
+	return s.queries.GetAllSysApis(ctx)
+}
+
+func (s *SysApiService) GetApiGroupNames(ctx context.Context) ([]string, error) {
+	return s.queries.GetSysApiGroupNames(ctx)
+}
+
+func (s *SysApiService) Create(ctx context.Context, req request.CreateSysApiRequest) error {
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return err
+	}
+
+	defer func(ctx context.Context) {
+		_ = tx.Rollback(ctx)
+	}(ctx)
+
+	q := db.New(tx)
+
+	api := db.CreateSysApiParams{
+		Name:      req.Name,
+		GroupName: req.GroupName,
+		Method:    req.Method,
+		Path:      req.Path,
+		Sort:      req.Sort,
+	}
+
+	// 创建权限
+	permissionId, err := q.CreateSysPermission(ctx, db.CreateSysPermissionParams{
+		Type: int16(enum.PermissionTypeApi),
+	})
+
+	if err != nil {
+		return err
+	}
+
+	// 创建api
+	apiId, err := q.CreateSysApi(ctx, api)
+	if err != nil {
+		return dberr.MapUniqueViolation(err, dberr.SysApisMethodPathKey, errs.ErrSysApiMethodPathAlreadyExists)
+	}
+
+	// 关联权限
+	if err = q.CreateSysApiPermission(ctx, db.CreateSysApiPermissionParams{
+		ApiID:        apiId,
+		PermissionID: permissionId,
+	}); err != nil {
+		return err
+	}
+
+	if err = tx.Commit(ctx); err != nil {
+		return err
+	}
+
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+
+	return nil
+}
+
+func (s *SysApiService) Update(ctx context.Context, id int32, req request.UpdateSysApiRequest) error {
+	api := db.UpdateSysApiParams{
+		ID:        id,
+		Name:      req.Name,
+		GroupName: req.GroupName,
+		Method:    req.Method,
+		Path:      req.Path,
+		Sort:      req.Sort,
+	}
+
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+
+	rows, err := s.queries.UpdateSysApi(ctx, api)
+	if err = dberr.MapRowsAffected(rows, err, errs.ErrSysApiNotFound); err != nil {
+		return dberr.MapUniqueViolation(err, dberr.SysApisMethodPathKey, errs.ErrSysApiMethodPathAlreadyExists)
+	}
+
+	return nil
+}
+
+func (s *SysApiService) Delete(ctx context.Context, id int32) error {
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+
+	if err != nil {
+		return err
+	}
+
+	defer tx.Rollback(ctx)
+
+	q := db.New(tx)
+
+	rows, err := q.DeleteSysApi(ctx, id)
+	if err = dberr.MapRowsAffected(rows, err, errs.ErrSysApiNotFound); err != nil {
+		return err
+	}
+
+	if err = q.DeleteSysPermissionBySysApiID(ctx, id); err != nil {
+		return err
+	}
+
+	if err = q.DeleteSysApiPermission(ctx, id); err != nil {
+		return err
+	}
+
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+
+	return tx.Commit(ctx)
+}

internal/service/sys_file.go

@@ -0,0 +1,118 @@
+package service
+
+import (
+	"context"
+	"mime/multipart"
+	"os"
+	"path/filepath"
+	db "server/internal/db/sqlc"
+	"server/internal/model/common"
+	"server/internal/model/response"
+	"server/internal/pkg/httputil"
+
+	gonanoid "github.com/matoous/go-nanoid/v2"
+)
+
+type SysFileService struct {
+	queries *db.Queries
+}
+
+func NewSysFileService(queries *db.Queries) *SysFileService {
+	return &SysFileService{
+		queries: queries,
+	}
+}
+
+// MakeSavedDir 创建目录并返回
+func MakeSavedDir(folder string) (string, error) {
+	rootDir, err := os.Getwd()
+
+	if err != nil {
+		return "", err
+	}
+
+	uploadDir := filepath.Join(rootDir, "uploads", folder)
+
+	if err = os.MkdirAll(uploadDir, 0755); err != nil {
+		return "", err
+	}
+
+	return uploadDir, nil
+}
+
+func (s *SysFileService) ListPage(ctx context.Context, p *common.Pagination) ([]db.File, int64, error) {
+	params := db.GetFilesParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountFiles(ctx)
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	list, err := s.queries.GetFiles(ctx, params)
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return response.ToFiles(list), total, nil
+}
+
+func (s *SysFileService) Upload(ctx context.Context, folder string, file *multipart.FileHeader) (*db.CreateFileRow, error) {
+	// 生成文件名
+	fileID, err := gonanoid.New()
+	if err != nil {
+		return nil, err
+	}
+
+	savedDir, err := MakeSavedDir(folder)
+	if err != nil {
+		return nil, err
+	}
+
+	fileExt := filepath.Ext(file.Filename)
+	filename := fileID + fileExt
+	filePath := filepath.Join(folder, filename)
+	// 用于保存文件
+	savedPath := filepath.Join(savedDir, filename)
+
+	// 打开上传的文件
+	src, err := file.Open()
+	if err != nil {
+		return nil, err
+	}
+	defer src.Close()
+
+	// 创建目标文件
+	dst, err := os.Create(savedPath)
+	if err != nil {
+		return nil, err
+	}
+	defer dst.Close()
+
+	// 复制文件内容
+	if _, err = dst.ReadFrom(src); err != nil {
+		return nil, err
+	}
+
+	params := db.CreateFileParams{
+		FileName:     filename,
+		FilePath:     filePath,
+		OriginalName: file.Filename,
+		FolderName:   folder,
+		MimeType:     file.Header.Get("Content-Type"),
+		FileSize:     file.Size,
+	}
+
+	result, err := s.queries.CreateFile(ctx, params)
+	if err != nil {
+		return nil, err
+	}
+
+	result.FilePath = httputil.BuildFileUrl(&result.FilePath)
+
+	return &result, nil
+}

internal/service/sys_menu.go

@@ -0,0 +1,178 @@
+package service
+
+import (
+	"context"
+	db "server/internal/db/sqlc"
+	"server/internal/model/common"
+	"server/internal/model/enum"
+	"server/internal/model/request"
+	"server/internal/pkg/dberr"
+	"server/internal/pkg/errs"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type SysMenuService struct {
+	pool    *pgxpool.Pool
+	queries *db.Queries
+}
+
+func NewSysMenuService(queries *db.Queries, pool *pgxpool.Pool) *SysMenuService {
+	return &SysMenuService{
+		queries: queries,
+		pool:    pool,
+	}
+}
+
+func (s *SysMenuService) Create(ctx context.Context, req request.CreateSysMenuRequest) error {
+	// 开启事务
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return err
+	}
+
+	defer func(ctx context.Context) {
+		_ = tx.Rollback(ctx)
+	}(ctx)
+
+	q := db.New(tx)
+
+	menu := db.CreateSysMenuParams{
+		Name:      req.Name,
+		Path:      req.Path,
+		Component: req.Component,
+		Type:      *req.Type,
+		Status:    *req.Status,
+		Hidden:    req.Hidden,
+		Sort:      req.Sort,
+		Icon:      req.Icon,
+	}
+
+	permissionId, err := q.CreateSysPermission(ctx, db.CreateSysPermissionParams{
+		Type: int16(enum.PermissionTypeMenu),
+		Code: &req.PermissionCode,
+	})
+
+	if err != nil {
+		return dberr.MapUniqueViolation(err, dberr.SysPermissionsCodeKey, errs.ErrPermissionCodeAlreadyExists)
+	}
+
+	menuId, err := q.CreateSysMenu(ctx, menu)
+	if err != nil {
+		return err
+	}
+
+	if err = q.CreateSysMenuPermission(ctx, db.CreateSysMenuPermissionParams{
+		MenuID:       menuId,
+		PermissionID: permissionId,
+	}); err != nil {
+		return err
+	}
+
+	if err = tx.Commit(ctx); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *SysMenuService) Update(ctx context.Context, id int32, req request.UpdateSysMenuRequest) error {
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return err
+	}
+	defer tx.Rollback(ctx)
+
+	q := db.New(tx)
+
+	// 构造 menu 参数
+	menu := db.UpdateSysMenuParams{
+		ID:        id,
+		Name:      req.Name,
+		Path:      req.Path,
+		Component: req.Component,
+		Hidden:    req.Hidden,
+		Sort:      req.Sort,
+		Type:      req.Type,
+		Status:    req.Status,
+		Icon:      req.Icon,
+	}
+
+	if req.ParentID.Set {
+		menu.UpdateParentID = true
+		if req.ParentID.Valid {
+			menu.ParentID = &req.ParentID.Value
+		}
+	}
+
+	// 执行更新
+	rows, err := q.UpdateSysMenu(ctx, menu)
+
+	if err = dberr.MapRowsAffected(rows, err, errs.ErrSysMenuNotFound); err != nil {
+		return err
+	}
+
+	permission := db.UpdateSysMenuPermissionCodeParams{
+		MenuID: id,
+		Code:   req.PermissionCode,
+	}
+
+	if err = q.UpdateSysMenuPermissionCode(ctx, permission); err != nil {
+		return dberr.MapUniqueViolation(err, dberr.SysPermissionsCodeKey, errs.ErrPermissionCodeAlreadyExists)
+	}
+
+	return tx.Commit(ctx)
+}
+
+func (s *SysMenuService) ListPage(ctx context.Context, p *common.Pagination) ([]db.ListSysMenusRow, int64, error) {
+	params := db.ListSysMenusParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountSysMenus(ctx)
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	list, err := s.queries.ListSysMenus(ctx, params)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return list, total, nil
+}
+
+func (s *SysMenuService) GetMenus(ctx context.Context) ([]db.GetAllSysMenusRow, error) {
+	return s.queries.GetAllSysMenus(ctx)
+}
+
+func (s *SysMenuService) Delete(ctx context.Context, id int32) error {
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+
+	if err != nil {
+		return err
+	}
+
+	defer tx.Rollback(ctx)
+
+	q := db.New(tx)
+
+	rows, err := q.DeleteSysMenu(ctx, id)
+
+	if err = dberr.MapRowsAffected(rows, err, errs.ErrSysMenuNotFound); err != nil {
+		return err
+	}
+
+	if err = q.DeleteSysPermissionByMenuID(ctx, id); err != nil {
+		return err
+	}
+
+	if err = q.DeleteSysMenuPermission(ctx, id); err != nil {
+		return err
+	}
+
+	return tx.Commit(ctx)
+}

internal/service/sys_post.go

@@ -0,0 +1,163 @@
+package service
+
+import (
+	"context"
+	db "server/internal/db/sqlc"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/pkg/dberr"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/httputil"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type SysPostService struct {
+	queries *db.Queries
+	pool    *pgxpool.Pool
+}
+
+func NewSysPostService(queries *db.Queries, pool *pgxpool.Pool) *SysPostService {
+	return &SysPostService{
+		queries: queries,
+		pool:    pool,
+	}
+}
+
+func (s *SysPostService) ListPage(ctx context.Context, p *common.Pagination) ([]db.ListPostsRow, int64, error) {
+	params := db.ListPostsParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountPosts(ctx)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	list, err := s.queries.ListPosts(ctx, params)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	for i := range list {
+		url := httputil.BuildFileUrl(list[i].Cover)
+		list[i].Cover = &url
+	}
+
+	return list, total, nil
+}
+
+func (s *SysPostService) FindByID(ctx context.Context, id int32) (*db.GetPostByIdRow, error) {
+	post, err := s.queries.GetPostById(ctx, id)
+	if err != nil {
+		return nil, dberr.MapNoRows(err, errs.ErrPostNotFound)
+	}
+	url := httputil.BuildFileUrl(post.Cover)
+	post.Cover = &url
+
+	return &post, nil
+}
+
+func (s *SysPostService) Create(ctx context.Context, req request.CreatePostRequest) (int32, error) {
+	// 开启事务
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return 0, err
+	}
+
+	defer func() {
+		_ = tx.Rollback(ctx)
+	}()
+
+	q := db.New(tx)
+
+	params := db.CreatePostParams{
+		Title:       req.Title,
+		CoverID:     req.CoverID,
+		Slug:        req.Slug,
+		Content:     req.Content,
+		Summary:     req.Summary,
+		Status:      *req.Status,
+		Sort:        req.Sort,
+		PublishedAt: req.PublishedAt,
+	}
+
+	postId, err := q.CreatePost(ctx, params)
+	if err != nil {
+		return 0, dberr.MapUniqueViolation(err, dberr.PostSlugKey, errs.ErrSlugAlreadyExists)
+	}
+
+	if err = q.CreatePostCategory(ctx, db.CreatePostCategoryParams{
+		PostID:     postId,
+		CategoryID: *req.CategoryID,
+	}); err != nil {
+		return 0, err
+	}
+
+	// 提交
+	if err = tx.Commit(ctx); err != nil {
+		return 0, err
+	}
+
+	return postId, nil
+}
+
+func (s *SysPostService) Update(ctx context.Context, id int32, req request.UpdatePostRequest) error {
+	// 开启事务
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return err
+	}
+
+	defer func() {
+		_ = tx.Rollback(ctx)
+	}()
+
+	q := db.New(tx)
+
+	params := db.UpdatePostParams{
+		Title:       req.Title,
+		CoverID:     req.CoverID,
+		Slug:        req.Slug,
+		Content:     req.Content,
+		Summary:     req.Summary,
+		Status:      req.Status,
+		Sort:        req.Sort,
+		PublishedAt: req.PublishedAt,
+		ID:          id,
+	}
+
+	rows, err := q.UpdatePost(ctx, params)
+	if err != nil {
+		return dberr.MapUniqueViolation(err, dberr.PostSlugKey, errs.ErrSlugAlreadyExists)
+	}
+
+	if err = dberr.MapRowsAffected(rows, nil, errs.ErrPostNotFound); err != nil {
+		return err
+	}
+
+	if err = q.DeletePostCategory(ctx, id); err != nil {
+		return err
+	}
+
+	if err = q.CreatePostCategory(ctx, db.CreatePostCategoryParams{
+		PostID:     id,
+		CategoryID: *req.CategoryID,
+	}); err != nil {
+		return err
+	}
+
+	// 提交
+	if err = tx.Commit(ctx); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+func (s *SysPostService) Delete(ctx context.Context, id int32) error {
+	rows, err := s.queries.DeletePost(ctx, id)
+	return dberr.MapRowsAffected(rows, err, errs.ErrPostNotFound)
+}

internal/service/sys_role.go

@@ -0,0 +1,211 @@
+package service
+
+import (
+	"context"
+	db "server/internal/db/sqlc"
+	"server/internal/model/common"
+	"server/internal/model/enum"
+	"server/internal/model/request"
+	"server/internal/pkg/cache"
+	"server/internal/pkg/dberr"
+	"server/internal/pkg/errs"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type SysRoleService struct {
+	queries *db.Queries
+	pool    *pgxpool.Pool
+	cache   *cache.Caches
+}
+
+func NewSysRoleService(queries *db.Queries, pool *pgxpool.Pool, cache *cache.Caches) *SysRoleService {
+	return &SysRoleService{
+		queries: queries,
+		pool:    pool,
+		cache:   cache,
+	}
+}
+
+func (s *SysRoleService) ListPage(ctx context.Context, p *common.Pagination) ([]db.SysRole, int64, error) {
+	params := db.ListSysRolesParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountSysRoles(ctx)
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	list, err := s.queries.ListSysRoles(ctx, params)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	return list, total, nil
+}
+
+func (s *SysRoleService) GetRoles(ctx context.Context) ([]db.SysRole, error) {
+	return s.queries.GetAllSysRoles(ctx)
+}
+
+func (s *SysRoleService) GetRoleMenus(ctx context.Context, id int32) ([]db.GetSysRoleMenusRow, error) {
+	_, err := s.queries.GetSysRoleByID(ctx, id)
+	if err != nil {
+		return nil, dberr.MapNoRows(err, errs.ErrSysRoleNotFound)
+	}
+
+	return s.queries.GetSysRoleMenus(ctx, id)
+}
+
+func (s *SysRoleService) GetRoleApis(ctx context.Context, id int32) ([]db.GetSysRoleApisRow, error) {
+	_, err := s.queries.GetSysRoleByID(ctx, id)
+	if err != nil {
+		return nil, dberr.MapNoRows(err, errs.ErrSysRoleNotFound)
+	}
+
+	return s.queries.GetSysRoleApis(ctx, id)
+}
+
+func (s *SysRoleService) Create(ctx context.Context, req request.CreateSysRoleRequest) error {
+	params := db.CreateSysRoleParams{
+		Name: req.Name,
+		Code: req.Code,
+	}
+
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+
+	err := s.queries.CreateSysRole(ctx, params)
+	if err != nil {
+		return dberr.MapUniqueViolation(err, dberr.SysRoleCodeKey, errs.ErrCodeAlreadyExists)
+	}
+	return nil
+}
+
+func (s *SysRoleService) Update(ctx context.Context, id int32, req request.UpdateSysRoleRequest) error {
+	params := db.UpdateSysRoleParams{
+		ID:   id,
+		Name: req.Name,
+	}
+
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+
+	rows, err := s.queries.UpdateSysRole(ctx, params)
+	return dberr.MapRowsAffected(rows, err, errs.ErrSysRoleNotFound)
+}
+
+func (s *SysRoleService) SetRoleMenus(ctx context.Context, roleID int32, req request.SetSysRoleMenusRequest) error {
+	_, err := s.queries.GetSysRoleByID(ctx, roleID)
+	if err != nil {
+		return dberr.MapNoRows(err, errs.ErrSysRoleNotFound)
+	}
+
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return err
+	}
+
+	defer func(ctx context.Context) {
+		_ = tx.Rollback(ctx)
+	}(ctx)
+
+	q := db.New(tx)
+
+	permissionIds, err := s.queries.GetSysPermissionIdsByMenuIDs(ctx, req.MenuIDs)
+	if err != nil {
+		return err
+	}
+
+	params := make([]db.CreateSysRolePermissionParams, 0, len(permissionIds))
+	for _, id := range permissionIds {
+		params = append(params, db.CreateSysRolePermissionParams{
+			RoleID:       roleID,
+			PermissionID: id,
+		})
+	}
+
+	if err = q.DeleteSysRolePermission(ctx, db.DeleteSysRolePermissionParams{
+		RoleID: roleID,
+		Type:   int16(enum.PermissionTypeMenu),
+	}); err != nil {
+		return err
+	}
+
+	_, err = q.CreateSysRolePermission(ctx, params)
+	if err != nil {
+		return err
+	}
+
+	if err = tx.Commit(ctx); err != nil {
+		return err
+	}
+
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+
+	return err
+}
+
+func (s *SysRoleService) SetRoleApis(ctx context.Context, roleID int32, req request.SetSysRoleApisRequest) error {
+	_, err := s.queries.GetSysRoleByID(ctx, roleID)
+	if err != nil {
+		return dberr.MapNoRows(err, errs.ErrSysRoleNotFound)
+	}
+
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return err
+	}
+
+	defer func(ctx context.Context) {
+		_ = tx.Rollback(ctx)
+	}(ctx)
+
+	q := db.New(tx)
+
+	permissionIds, err := s.queries.GetSysPermissionIdsByApiIDs(ctx, req.ApiIDs)
+	if err != nil {
+		return err
+	}
+
+	params := make([]db.CreateSysRolePermissionParams, 0, len(permissionIds))
+	for _, id := range permissionIds {
+		params = append(params, db.CreateSysRolePermissionParams{
+			RoleID:       roleID,
+			PermissionID: id,
+		})
+	}
+
+	if err = q.DeleteSysRolePermission(ctx, db.DeleteSysRolePermissionParams{
+		RoleID: roleID,
+		Type:   int16(enum.PermissionTypeApi),
+	}); err != nil {
+		return err
+	}
+
+	_, err = q.CreateSysRolePermission(ctx, params)
+	if err != nil {
+		return err
+	}
+
+	if err = tx.Commit(ctx); err != nil {
+		return err
+	}
+
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+
+	return err
+}
+
+func (s *SysRoleService) Delete(ctx context.Context, id int32) error {
+	// 清理缓存
+	s.cache.ClearAllSysUserCache()
+	rows, err := s.queries.DeleteSysRole(ctx, id)
+	return dberr.MapRowsAffected(rows, err, errs.ErrSysRoleNotFound)
+}

internal/service/sys_user.go

@@ -0,0 +1,290 @@
+package service
+
+import (
+	"context"
+	db "server/internal/db/sqlc"
+	"server/internal/middleware"
+	"server/internal/model/common"
+	"server/internal/model/request"
+	"server/internal/model/response"
+	"server/internal/pkg/cache"
+	"server/internal/pkg/dberr"
+	"server/internal/pkg/errs"
+	"server/internal/pkg/httputil"
+
+	"github.com/jackc/pgx/v5"
+	"github.com/jackc/pgx/v5/pgxpool"
+	"golang.org/x/crypto/bcrypt"
+	"golang.org/x/sync/errgroup"
+)
+
+type SysUserService struct {
+	queries *db.Queries
+	pool    *pgxpool.Pool
+	jwt     *middleware.JWTMiddleware
+	cache   *cache.Caches
+}
+
+func NewSysUserService(queries *db.Queries, pool *pgxpool.Pool, jwt *middleware.JWTMiddleware, cache *cache.Caches) *SysUserService {
+	return &SysUserService{
+		queries: queries,
+		pool:    pool,
+		jwt:     jwt,
+		cache:   cache,
+	}
+}
+
+// generatePasswordHash 生成密码哈希
+func generatePasswordHash(password string) (string, error) {
+	hashed, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost)
+	if err != nil {
+		return "", err
+	}
+	return string(hashed), nil
+}
+
+// comparePasswordHash 比较密码哈希
+func comparePasswordHash(passwordHash, inputPassword string) error {
+	return bcrypt.CompareHashAndPassword([]byte(passwordHash), []byte(inputPassword))
+}
+
+func (s *SysUserService) Login(ctx context.Context, req request.LoginRequest) (*response.LoginResponse, error) {
+	user, err := s.queries.GetSysUserByAccount(ctx, req.Account)
+
+	if err != nil {
+		return nil, errs.ErrInvalidCredentials
+	}
+
+	if err = comparePasswordHash(user.PasswordHash, req.Password); err != nil {
+		return nil, errs.ErrInvalidCredentials
+	}
+
+	accessToken, accessTokenExp, err := s.jwt.GenerateAccessToken(user.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	refreshToken, refreshTokenExp, err := s.jwt.GenerateRefreshToken(user.ID)
+	if err != nil {
+		return nil, err
+	}
+
+	return &response.LoginResponse{
+		AccessToken:     accessToken,
+		AccessTokenExp:  accessTokenExp,
+		RefreshToken:    refreshToken,
+		RefreshTokenExp: refreshTokenExp,
+	}, nil
+}
+
+func (s *SysUserService) RefreshToken(ctx context.Context, refreshToken string) (*response.LoginResponse, error) {
+	claims, err := s.jwt.ParseRefreshToken(refreshToken)
+	if err != nil {
+		return nil, errs.ErrInvalidRefreshToken
+	}
+
+	accessToken, accessTokenExp, err := s.jwt.GenerateAccessToken(claims.UserID)
+	if err != nil {
+		return nil, err
+	}
+
+	return &response.LoginResponse{
+		AccessToken:    accessToken,
+		AccessTokenExp: accessTokenExp,
+	}, nil
+}
+
+func (s *SysUserService) GetUserInfo(ctx context.Context, id int32, isAdmin bool) (*response.SysUserInfo, error) {
+	g, ctx := errgroup.WithContext(ctx)
+
+	var (
+		user  db.GetSysUserByIDRow
+		roles []db.SysRole
+		menus []db.SysMenu
+	)
+
+	g.Go(func() error {
+		u, err := s.queries.GetSysUserByID(ctx, id)
+		if err != nil {
+			return dberr.MapNoRows(err, errs.ErrUserNotFound)
+		}
+		user = u
+		return nil
+	})
+
+	g.Go(func() error {
+		r, err := s.queries.GetSysUserRoles(ctx, id)
+		if err != nil {
+			return err
+		}
+		roles = r
+		return nil
+	})
+
+	g.Go(func() error {
+		var (
+			m   []db.SysMenu
+			err error
+		)
+		if isAdmin {
+			m, err = s.queries.GetSysAdminMenus(ctx)
+		} else {
+			m, err = s.queries.GetSysUserMenus(ctx, id)
+		}
+		if err != nil {
+			return err
+		}
+		menus = m
+		return nil
+	})
+
+	if err := g.Wait(); err != nil {
+		return nil, err
+	}
+
+	// 处理角色
+	userInfo := response.NewSysUserInfo(user, roles, menus)
+
+	return userInfo, nil
+}
+
+func (s *SysUserService) ListPage(ctx context.Context, p *common.Pagination) ([]db.ListSysUsersRow, int64, error) {
+	params := db.ListSysUsersParams{
+		Limit:  p.PageSize,
+		Offset: (p.Page - 1) * p.PageSize,
+	}
+
+	total, err := s.queries.CountSysUsers(ctx)
+
+	if err != nil {
+		return nil, 0, err
+	}
+
+	users, err := s.queries.ListSysUsers(ctx, params)
+	if err != nil {
+		return nil, 0, err
+	}
+
+	// 处理每个用户的头像URL
+	for i := range users {
+		url := httputil.BuildFileUrl(users[i].AvatarUrl)
+		users[i].AvatarUrl = &url
+	}
+
+	return users, total, nil
+}
+
+func (s *SysUserService) GetRoles(ctx context.Context, id int32) ([]db.SysRole, error) {
+	// 先查询用户是否存在
+	_, err := s.queries.GetSysUserByID(ctx, id)
+	if err != nil {
+		return nil, dberr.MapNoRows(err, errs.ErrUserNotFound)
+	}
+
+	return s.queries.GetSysUserRoles(ctx, id)
+}
+
+func (s *SysUserService) Create(ctx context.Context, req request.CreateSysUserRequest) error {
+	passwordHash, err := generatePasswordHash(req.Password)
+	if err != nil {
+		return err
+	}
+
+	user := db.CreateSysUserParams{
+		Account:      req.Account,
+		Username:     req.Username,
+		PasswordHash: passwordHash,
+		AvatarID:     req.AvatarID,
+	}
+
+	if err = s.queries.CreateSysUser(ctx, user); err != nil {
+		return dberr.MapUniqueViolation(err, dberr.SysUserAccountKey, errs.ErrAccountAlreadyExists)
+	}
+
+	return nil
+}
+
+func (s *SysUserService) Update(ctx context.Context, id int32, req request.UpdateSysUserRequest) error {
+	user := db.UpdateSysUserParams{
+		Username: req.Username,
+		ID:       id,
+	}
+
+	if req.AvatarID.Set {
+		user.UpdateAvatarID = true
+		if req.AvatarID.Valid {
+			user.AvatarID = &req.AvatarID.Value
+		}
+	}
+
+	rows, err := s.queries.UpdateSysUser(ctx, user)
+	return dberr.MapRowsAffected(rows, err, errs.ErrUserNotFound)
+}
+
+func (s *SysUserService) SetRoles(ctx context.Context, userID int32, req request.SetSysUserRolesRequest) error {
+	// 先查询用户是否存在
+	_, err := s.queries.GetSysUserByID(ctx, userID)
+	if err != nil {
+		return dberr.MapNoRows(err, errs.ErrUserNotFound)
+	}
+
+	tx, err := s.pool.BeginTx(ctx, pgx.TxOptions{})
+	if err != nil {
+		return err
+	}
+
+	defer func(ctx context.Context) {
+		_ = tx.Rollback(ctx)
+	}(ctx)
+
+	q := db.New(tx)
+
+	if err = q.ClearSysUserRoles(ctx, userID); err != nil {
+		return err
+	}
+
+	for _, roleID := range req.RoleIDs {
+		if err = q.CreateSysUserRole(ctx, db.CreateSysUserRoleParams{
+			UserID: userID,
+			RoleID: roleID,
+		}); err != nil {
+			return err
+		}
+	}
+
+	if err = tx.Commit(ctx); err != nil {
+		return err
+	}
+
+	// 清理缓存
+	s.cache.ClearSysUserCache(userID)
+
+	return nil
+}
+
+func (s *SysUserService) UpdatePassword(ctx context.Context, id int32, req request.UpdateSysUserPassword) error {
+	passwordHash, err := generatePasswordHash(req.Password)
+	if err != nil {
+		return err
+	}
+
+	params := db.UpdateSysUserPasswordParams{
+		ID:           id,
+		PasswordHash: passwordHash,
+	}
+
+	rows, err := s.queries.UpdateSysUserPassword(ctx, params)
+	return dberr.MapRowsAffected(rows, err, errs.ErrUserNotFound)
+}
+
+func (s *SysUserService) Delete(ctx context.Context, id int32) error {
+	if id == 1 {
+		return errs.ErrCannotDeleteSuperAdmin
+	}
+
+	// 清理缓存
+	s.cache.ClearSysUserCache(id)
+
+	rows, err := s.queries.DeleteSysUser(ctx, id)
+	return dberr.MapRowsAffected(rows, err, errs.ErrUserNotFound)
+}

internal/utils/utils.go

@@ -0,0 +1,28 @@
+package utils
+
+import (
+	"net"
+	"net/http"
+	"strings"
+)
+
+func ClientIP(r *http.Request) string {
+	if xff := r.Header.Get("X-Forwarded-For"); xff != "" {
+		parts := strings.Split(xff, ",")
+		if len(parts) > 0 {
+			return strings.TrimSpace(parts[0])
+		}
+	}
+
+	if ip := r.Header.Get("X-Real-IP"); ip != "" {
+		return ip
+	}
+
+	// RemoteAddr: IP:port
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err == nil {
+		return host
+	}
+
+	return r.RemoteAddr
+}