@code2rich/jpage 1.5.0

package/public/js/theme.js

@@ -0,0 +1,44 @@
+const STORAGE_KEY = 'jpage-theme';
+
+function getSystemPreference() {
+  return window.matchMedia('(prefers-color-scheme: light)').matches ? 'light' : 'dark';
+}
+
+function getStoredTheme() {
+  try {
+    return localStorage.getItem(STORAGE_KEY);
+  } catch {
+    return null;
+  }
+}
+
+function getCurrentTheme() {
+  return getStoredTheme() || getSystemPreference();
+}
+
+function applyTheme(theme) {
+  document.documentElement.classList.toggle('light', theme === 'light');
+}
+
+function toggleTheme() {
+  const current = getCurrentTheme();
+  const next = current === 'dark' ? 'light' : 'dark';
+  applyTheme(next);
+  try { localStorage.setItem(STORAGE_KEY, next); } catch {}
+}
+
+function initTheme() {
+  applyTheme(getCurrentTheme());
+
+  document.querySelectorAll('.theme-toggle').forEach(btn => {
+    btn.addEventListener('click', toggleTheme);
+  });
+}
+
+function setupThemeToggle(container) {
+  container.querySelectorAll('.theme-toggle').forEach(btn => {
+    btn.addEventListener('click', toggleTheme);
+  });
+}
+
+export { initTheme, setupThemeToggle, toggleTheme };

package/public/js/utils.js

@@ -0,0 +1,67 @@
+// 工具函数：HTML 转义、文件大小格式化、相对时间、骨架屏等
+
+function escapeHtml(text) {
+  return String(text)
+    .replace(/&/g, '&')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function formatSize(bytes) {
+  if (bytes < 1024) return bytes + ' B';
+  if (bytes < 1024 * 1024) return (bytes / 1024).toFixed(1) + ' KB';
+  return (bytes / (1024 * 1024)).toFixed(1) + ' MB';
+}
+
+function relativeTime(dateStr) {
+  if (!dateStr) return '';
+  const now = Date.now();
+  const then = new Date(dateStr).getTime();
+  if (isNaN(then)) return '';
+  const diff = now - then;
+  const seconds = Math.floor(diff / 1000);
+  if (seconds < 60) return '刚刚';
+  const minutes = Math.floor(seconds / 60);
+  if (minutes < 60) return `${minutes} 分钟前`;
+  const hours = Math.floor(minutes / 60);
+  if (hours < 24) return `${hours} 小时前`;
+  const days = Math.floor(hours / 24);
+  if (days === 1) return '昨天';
+  if (days < 30) return `${days} 天前`;
+  return new Date(dateStr).toLocaleDateString('zh-CN');
+}
+
+function formatDate(iso) {
+  if (!iso) return '-';
+  const d = new Date(iso);
+  return d.getFullYear() + '-' + String(d.getMonth() + 1).padStart(2, '0') + '-' + String(d.getDate()).padStart(2, '0');
+}
+
+function esc(s) { const d = document.createElement('div'); d.textContent = s || ''; return d.innerHTML; }
+
+function buildSkeletonCards(n) {
+  let html = '';
+  for (let i = 0; i < n; i++) {
+    html += '<div class="skeleton-item" aria-hidden="true">'
+      + '<div class="skeleton-icon"></div>'
+      + '<div class="skeleton-lines">'
+      + '<div class="skeleton-line skeleton-w60"></div>'
+      + '<div class="skeleton-line skeleton-w40"></div>'
+      + '</div></div>';
+  }
+  return html;
+}
+
+function openModal(el) {
+  el.hidden = false;
+  el.setAttribute('aria-hidden', 'false');
+}
+
+function closeModal(el) {
+  el.hidden = true;
+  el.setAttribute('aria-hidden', 'true');
+}
+
+export { escapeHtml, formatSize, relativeTime, formatDate, esc, buildSkeletonCards, openModal, closeModal };

package/routes/admin.js

@@ -0,0 +1,136 @@
+// 管理员路由：数据备份导出 / 导入恢复 / 存储统计。从 server.js 提取，行为保持不变。
+// 挂载点：/api/admin
+
+const express = require('express');
+const fs = require('fs');
+const path = require('path');
+const multer = require('multer');
+const archiver = require('archiver');
+const JSZip = require('jszip');
+const sqlite3 = require('sqlite3').verbose();
+const { getDb, dbGet, configureDatabase } = require('../lib/db');
+const { DATA_DIR, UPLOAD_DIR } = require('../lib/paths');
+const { requireAuth, requireAdmin } = require('../lib/middleware/auth');
+const { clientIp } = require('../lib/util');
+const { loadTemplateNameMap } = require('../lib/templates');
+const { reloadCategoryNameCache } = require('../lib/categories');
+const { clearRenderCache } = require('../lib/render-cache');
+const logger = require('../logger');
+
+const router = express.Router();
+
+// 用于 import 的独立 multer 实例（不限文件类型）
+const adminUpload = multer({
+  storage: multer.diskStorage({
+    destination: (req, file, cb) => cb(null, DATA_DIR),
+    filename: (req, file, cb) => cb(null, 'import-' + Date.now() + '.zip')
+  }),
+  limits: { fileSize: 500 * 1024 * 1024 }
+});
+
+function createBackupArchive() {
+  const archive = archiver('zip', { zlib: { level: 9 } });
+  const db = getDb();
+  db.run('PRAGMA wal_checkpoint(FULL)', (err) => {
+    if (err) logger.warn({ type: 'app', message: 'WAL checkpoint 失败', error: err.message });
+  });
+  archive.file(path.join(DATA_DIR, 'database.sqlite'), { name: 'database.sqlite' });
+  const sessionFile = path.join(DATA_DIR, 'sessions.sqlite');
+  if (fs.existsSync(sessionFile)) archive.file(sessionFile, { name: 'sessions.sqlite' });
+  if (fs.existsSync(UPLOAD_DIR)) archive.directory(UPLOAD_DIR, 'uploads');
+  return archive;
+}
+
+router.get('/export', requireAuth, requireAdmin, (req, res) => {
+  try {
+    const date = new Date().toISOString().slice(0, 10);
+    const fname = `jpage-backup-${date}.zip`;
+    const encoded = encodeURIComponent(fname);
+    res.setHeader('Content-Type', 'application/zip');
+    res.setHeader('Content-Disposition', `attachment; filename="${encoded}"; filename*=UTF-8''${encoded}`);
+    const archive = createBackupArchive();
+    archive.on('end', () => res.end());
+    archive.pipe(res);
+    archive.finalize().catch(e => {
+      logger.error({ type: 'app', message: '备份导出失败', error: e.message });
+      if (!res.headersSent) res.status(500).json({ error: '导出失败' });
+    });
+    logger.audit('backup.export', { ip: clientIp(req) });
+  } catch (e) {
+    res.status(500).json({ error: '导出失败' });
+  }
+});
+
+router.post('/import', requireAuth, requireAdmin, adminUpload.single('file'), async (req, res) => {
+  if (!req.file) return res.status(400).json({ error: '请上传 ZIP 文件' });
+  const zipPath = req.file.path;
+  try {
+    const zipBuf = fs.readFileSync(zipPath);
+    const zip = await JSZip.loadAsync(zipBuf);
+    if (!zip.file('database.sqlite')) {
+      fs.unlinkSync(zipPath);
+      return res.status(400).json({ error: '无效的备份文件：缺少 database.sqlite' });
+    }
+    const backupDate = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19);
+    const backupDir = path.join(path.dirname(DATA_DIR), `data-backup-${backupDate}`);
+    fs.cpSync(DATA_DIR, backupDir, { recursive: true });
+    logger.info({ type: 'app', message: '导入前备份已创建', backupDir });
+    for (const entry of fs.readdirSync(DATA_DIR)) {
+      fs.rmSync(path.join(DATA_DIR, entry), { recursive: true, force: true });
+    }
+    for (const [relPath, entry] of Object.entries(zip.files)) {
+      if (entry.dir) {
+        fs.mkdirSync(path.join(DATA_DIR, relPath), { recursive: true });
+      } else {
+        const buf = await entry.async('nodebuffer');
+        const filePath = path.join(DATA_DIR, relPath);
+        fs.mkdirSync(path.dirname(filePath), { recursive: true });
+        fs.writeFileSync(filePath, buf);
+      }
+    }
+    if (!fs.existsSync(UPLOAD_DIR)) fs.mkdirSync(UPLOAD_DIR, { recursive: true });
+    // 导入替换数据库连接：在同一个 db 实例上替换方法，使所有持有该引用的模块继续生效
+    const db = getDb();
+    db.close();
+    const newDb = new sqlite3.Database(path.join(DATA_DIR, 'database.sqlite'));
+    db.run = newDb.run.bind(newDb);
+    db.get = newDb.get.bind(newDb);
+    db.all = newDb.all.bind(newDb);
+    db.close = newDb.close.bind(newDb);
+    db.exec = newDb.exec.bind(newDb);
+    // 导入替换了连接：重新应用性能 PRAGMA 与刷新分类缓存
+    await configureDatabase();
+    await loadTemplateNameMap();
+    await reloadCategoryNameCache();
+    clearRenderCache();
+    logger.audit('backup.import', { ip: clientIp(req), backupDir });
+    res.json({ success: true, message: '数据已恢复，建议刷新页面重新加载' });
+  } catch (e) {
+    logger.error({ type: 'app', message: '数据导入失败', error: e.message });
+    res.status(500).json({ error: '导入失败: ' + e.message });
+  } finally {
+    if (fs.existsSync(zipPath)) fs.unlinkSync(zipPath);
+  }
+});
+
+router.get('/stats', requireAuth, requireAdmin, async (req, res) => {
+  try {
+    const fileCount = await dbGet('SELECT COUNT(*) AS c FROM files');
+    let dbSize = 0;
+    const dbPath = path.join(DATA_DIR, 'database.sqlite');
+    if (fs.existsSync(dbPath)) dbSize = fs.statSync(dbPath).size;
+    let uploadsSize = 0;
+    if (fs.existsSync(UPLOAD_DIR)) {
+      for (const f of fs.readdirSync(UPLOAD_DIR)) {
+        const s = fs.statSync(path.join(UPLOAD_DIR, f));
+        if (s.isFile()) uploadsSize += s.size;
+      }
+    }
+    res.json({ fileCount: fileCount.c, dbSize, uploadsSize, totalSize: dbSize + uploadsSize });
+  } catch (e) {
+    res.status(500).json({ error: '获取统计失败' });
+  }
+});
+
+module.exports = router;
+module.exports.createBackupArchive = createBackupArchive;

package/routes/auth.js

@@ -0,0 +1,365 @@
+// 认证路由：me / login / register / logout / change-password / profile /
+// verify-email / resend-verification / send-register-code / smtp-status / registration-status。
+// 从 server.js 提取，行为保持不变。挂载点：/api/auth
+
+const express = require('express');
+const bcrypt = require('bcryptjs');
+const crypto = require('crypto');
+const rateLimit = require('express-rate-limit');
+const { dbGet, dbRun } = require('../lib/db');
+const { requireAuth } = require('../lib/middleware/auth');
+const { clientIp } = require('../lib/util');
+const { sendMail, getAppUrl, isMailerConfigured } = require('../mailer');
+const logger = require('../logger');
+
+const router = express.Router();
+
+const ALLOW_REGISTRATION = process.env.ALLOW_REGISTRATION === 'true';
+
+const loginLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 10,
+  message: { error: '登录尝试过于频繁，请稍后再试' },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+
+const registerLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 5,
+  message: { error: '注册请求过于频繁，请稍后再试' },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+
+const sendCodeLimiter = rateLimit({
+  windowMs: 60 * 1000,
+  max: 1,
+  message: { error: '发送过于频繁，请 1 分钟后再试' },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+
+const resendLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000,
+  max: 5,
+  standardHeaders: true,
+  legacyHeaders: false,
+  message: { error: '请求过于频繁，请稍后再试' }
+});
+
+// --- 邮箱验证 ---
+
+function generateVerifyToken() {
+  const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789';
+  const bytes = crypto.randomBytes(32);
+  let token = 'jv_';
+  for (let i = 0; i < 32; i++) token += chars[bytes[i] % chars.length];
+  return token;
+}
+
+async function sendVerificationEmail(userId, email, type, newEmail) {
+  const token = generateVerifyToken();
+  const hash = crypto.createHash('sha256').update(token).digest('hex');
+  const prefix = token.slice(0, 8);
+  const expiresAt = new Date(Date.now() + 24 * 60 * 60 * 1000).toISOString();
+
+  await dbRun("DELETE FROM email_verifications WHERE user_id = ? AND type = ?", [userId, type]);
+  await dbRun(
+    'INSERT INTO email_verifications (user_id, token_hash, token_prefix, type, new_email, expires_at) VALUES (?, ?, ?, ?, ?, ?)',
+    [userId, hash, prefix, type, newEmail || null, expiresAt]
+  );
+
+  if (!isMailerConfigured()) return { sent: false };
+
+  const targetEmail = newEmail || email;
+  const appUrl = getAppUrl();
+  const link = `${appUrl}/api/auth/verify-email?token=${token}`;
+  try {
+    await sendMail(targetEmail, '验证你的邮箱 — 即页',
+      `<div style="max-width:480px;margin:0 auto;font-family:system-ui,sans-serif;padding:24px">
+        <h2 style="color:#1a1a1a">验证你的邮箱</h2>
+        <p style="color:#555;font-size:15px">请点击以下按钮验证你的邮箱地址：</p>
+        <p style="margin:24px 0"><a href="${link}" style="display:inline-block;padding:12px 28px;background:#4f46e5;color:#fff;border-radius:6px;text-decoration:none;font-size:15px">验证邮箱</a></p>
+        <p style="color:#888;font-size:13px">或复制链接到浏览器：<br><a href="${link}" style="word-break:break-all">${link}</a></p>
+        <p style="color:#888;font-size:13px">链接 24 小时内有效。</p>
+      </div>`
+    );
+    return { sent: true };
+  } catch (e) {
+    logger.error({ type: 'app', message: '发送验证邮件失败', error: e.message, userId });
+    return { sent: false, error: e.message };
+  }
+}
+
+// 从邮箱前缀生成唯一用户名
+async function generateUsernameFromEmail(email) {
+  let base = email.split('@')[0].replace(/[^a-zA-Z0-9_]/g, '').slice(0, 24);
+  if (!base) base = 'user';
+  let username = base;
+  let suffix = 1;
+  while (await dbGet('SELECT id FROM users WHERE username = ?', [username])) {
+    username = base + suffix;
+    suffix++;
+    if (username.length > 30) username = base.slice(0, 24) + suffix;
+  }
+  return username;
+}
+
+// --- 路由 ---
+
+router.get('/me', async (req, res) => {
+  if (!req.session || !req.session.userId) return res.status(401).json({ error: '未登录' });
+  try {
+    const user = await dbGet('SELECT id, username, email, email_verified, role FROM users WHERE id = ?', [req.session.userId]);
+    if (!user) {
+      req.session.destroy(() => {});
+      return res.status(401).json({ error: '未登录' });
+    }
+    res.json({ id: user.id, username: user.username, email: user.email || null, emailVerified: !!user.email_verified, role: user.role });
+  } catch (e) {
+    res.status(500).json({ error: '查询失败' });
+  }
+});
+
+router.post('/login', loginLimiter, async (req, res) => {
+  const { username, account, password } = req.body || {};
+  const input = account || username;
+  if (!input || !password) return res.status(400).json({ error: '用户名和密码不能为空' });
+  try {
+    // 统一入口：自动识别用户名或邮箱
+    const isEmail = input.includes('@');
+    const user = isEmail
+      ? await dbGet('SELECT * FROM users WHERE email = ?', [input])
+      : await dbGet('SELECT * FROM users WHERE username = ?', [input]);
+    if (!user) return res.status(401).json({ error: '登录失败' });
+    const ok = await bcrypt.compare(password, user.password_hash);
+    if (!ok) {
+      logger.audit('login', { username: input, ip: clientIp(req), success: false });
+      return res.status(401).json({ error: '登录失败' });
+    }
+    req.session.userId = user.id;
+    req.session.username = user.username;
+    req.session.userRole = user.role;
+    logger.audit('login', { username: user.username, ip: clientIp(req), success: true });
+    res.json({ id: user.id, username: user.username, email: user.email || null, emailVerified: !!user.email_verified, role: user.role });
+  } catch (e) {
+    res.status(500).json({ error: '登录失败' });
+  }
+});
+
+router.post('/register', registerLimiter, async (req, res) => {
+  if (!ALLOW_REGISTRATION) return res.status(403).json({ error: '注册功能未开放' });
+  const { email, username, password, confirmPassword, code } = req.body || {};
+  if (!email) return res.status(400).json({ error: '请填写邮箱' });
+  if (!code) return res.status(400).json({ error: '请填写验证码' });
+  if (!password || !confirmPassword) return res.status(400).json({ error: '请填写密码' });
+  if (password.length < 8) return res.status(400).json({ error: '密码至少 8 位' });
+  if (password !== confirmPassword) return res.status(400).json({ error: '两次密码不一致' });
+
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  if (!emailRegex.test(email)) return res.status(400).json({ error: '邮箱格式不正确' });
+
+  // 验证码校验（仅验证，不删除）
+  const codeHash = crypto.createHash('sha256').update(code + email).digest('hex');
+  const codeRow = await dbGet(
+    "SELECT * FROM email_verifications WHERE type = 'register_code' AND new_email = ? AND token_hash = ? AND expires_at > datetime('now')",
+    [email, codeHash]
+  );
+  if (!codeRow) return res.status(400).json({ error: '验证码无效或已过期' });
+
+  let finalUsername = username;
+
+  try {
+    // 邮箱唯一性检查
+    const emailConflict = await dbGet('SELECT id FROM users WHERE email = ? OR username = ?', [email, email]);
+    if (emailConflict) return res.status(409).json({ error: '该邮箱已被使用' });
+
+    // 如果没提供 username，从邮箱自动生成
+    if (!finalUsername) {
+      finalUsername = await generateUsernameFromEmail(email);
+    } else {
+      if (finalUsername.length < 2 || finalUsername.length > 30 || !/^[a-zA-Z0-9_]+$/.test(finalUsername)) {
+        return res.status(400).json({ error: '用户名只能包含字母、数字和下划线，2-30 位' });
+      }
+      const nameConflict = await dbGet('SELECT id FROM users WHERE username = ? OR email = ?', [finalUsername, finalUsername]);
+      if (nameConflict) return res.status(409).json({ error: '该用户名已被使用' });
+    }
+
+    // 所有校验通过，消费验证码
+    await dbRun('DELETE FROM email_verifications WHERE id = ?', [codeRow.id]);
+
+    const hash = await bcrypt.hash(password, 10);
+    const result = await dbRun(
+      'INSERT INTO users (username, email, email_verified, password_hash, role) VALUES (?, ?, 1, ?, ?)',
+      [finalUsername, email, hash, 'user']
+    );
+    req.session.userId = result.lastID;
+    req.session.username = finalUsername;
+    req.session.userRole = 'user';
+    logger.audit('register', { username: finalUsername, email, userId: result.lastID, ip: clientIp(req) });
+    res.status(201).json({ id: result.lastID, username: finalUsername, email, emailVerified: true, role: 'user' });
+  } catch (e) {
+    logger.error({ type: 'app', msg: 'register error', error: e.message });
+    if (e.message && e.message.includes('UNIQUE')) return res.status(409).json({ error: '用户名或邮箱已存在' });
+    res.status(500).json({ error: '注册失败，请稍后重试' });
+  }
+});
+
+router.post('/logout', (req, res) => {
+  const userId = req.session?.userId;
+  req.session.destroy(() => {
+    res.clearCookie('jpage.sid');
+    logger.audit('logout', { userId, ip: clientIp(req) });
+    res.json({ success: true });
+  });
+});
+
+router.post('/change-password', requireAuth, async (req, res) => {
+  const { currentPassword, newPassword } = req.body || {};
+  if (!currentPassword || !newPassword) return res.status(400).json({ error: '当前密码和新密码不能为空' });
+  if (newPassword.length < 8) return res.status(400).json({ error: '新密码至少 8 位' });
+  try {
+    const user = await dbGet('SELECT * FROM users WHERE id = ?', [req.userId]);
+    if (!user) return res.status(401).json({ error: '未登录' });
+    const ok = await bcrypt.compare(currentPassword, user.password_hash);
+    if (!ok) return res.status(400).json({ error: '当前密码错误' });
+    const hash = await bcrypt.hash(newPassword, 10);
+    await dbRun('UPDATE users SET password_hash = ? WHERE id = ?', [hash, req.userId]);
+    logger.audit('password.change', { userId: req.userId, ip: clientIp(req) });
+    res.json({ success: true });
+  } catch (e) {
+    res.status(500).json({ error: '修改密码失败' });
+  }
+});
+
+router.post('/profile', requireAuth, async (req, res) => {
+  const { username, email } = req.body || {};
+  if (!username && email === undefined) return res.status(400).json({ error: '无更新字段' });
+  try {
+    const user = await dbGet('SELECT * FROM users WHERE id = ?', [req.userId]);
+    if (!user) return res.status(401).json({ error: '未登录' });
+    const changes = {};
+    if (username && username !== user.username) {
+      if (username.length > 30 || username.length < 2 || !/^[a-zA-Z0-9_]+$/.test(username)) {
+        return res.status(400).json({ error: '用户名 2-30 位，只能包含字母、数字和下划线' });
+      }
+      const conflict = await dbGet('SELECT id FROM users WHERE username = ? AND id != ?', [username, req.userId]);
+      if (conflict) return res.status(409).json({ error: '该用户名已被使用' });
+      await dbRun('UPDATE users SET username = ? WHERE id = ?', [username, req.userId]);
+      req.session.username = username;
+      changes.username = username;
+    }
+    if (email !== undefined && email !== user.email) {
+      if (email) {
+        const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+        if (!emailRegex.test(email)) return res.status(400).json({ error: '邮箱格式不正确' });
+        const conflict = await dbGet('SELECT id FROM users WHERE (email = ? OR username = ?) AND id != ?', [email, email, req.userId]);
+        if (conflict) return res.status(409).json({ error: '该邮箱已被使用' });
+        await dbRun('UPDATE users SET email = ?, email_verified = 0 WHERE id = ?', [email, req.userId]);
+        changes.email = email;
+        changes.emailVerified = false;
+        await sendVerificationEmail(req.userId, email, 'verify_email');
+      } else {
+        await dbRun('UPDATE users SET email = NULL, email_verified = 0 WHERE id = ?', [req.userId]);
+        changes.email = null;
+        changes.emailVerified = false;
+      }
+    }
+    logger.audit('profile.update', { userId: req.userId, changes, ip: clientIp(req) });
+    const updated = await dbGet('SELECT username, email, email_verified FROM users WHERE id = ?', [req.userId]);
+    res.json({ username: updated.username, email: updated.email || null, emailVerified: !!updated.email_verified });
+  } catch (e) {
+    res.status(500).json({ error: '更新失败' });
+  }
+});
+
+// GET /api/auth/verify-email?token=...
+router.get('/verify-email', async (req, res) => {
+  const { token } = req.query;
+  if (!token) return res.redirect('/#/email-verify-failed');
+  try {
+    const hash = crypto.createHash('sha256').update(token).digest('hex');
+    const row = await dbGet('SELECT * FROM email_verifications WHERE token_hash = ?', [hash]);
+    if (!row) return res.redirect('/#/email-verify-failed');
+    if (new Date(row.expires_at) < new Date()) {
+      await dbRun('DELETE FROM email_verifications WHERE id = ?', [row.id]);
+      return res.redirect('/#/email-verify-expired');
+    }
+    if (row.type === 'verify_email') {
+      await dbRun('UPDATE users SET email_verified = 1 WHERE id = ?', [row.user_id]);
+    } else if (row.type === 'change_email' && row.new_email) {
+      await dbRun('UPDATE users SET email = ?, email_verified = 1 WHERE id = ?', [row.new_email, row.user_id]);
+    }
+    await dbRun('DELETE FROM email_verifications WHERE id = ?', [row.id]);
+    logger.audit('email.verify', { userId: row.user_id, type: row.type });
+    res.redirect('/#/email-verified');
+  } catch (e) {
+    logger.error({ type: 'app', message: '邮箱验证失败', error: e.message });
+    res.redirect('/#/email-verify-failed');
+  }
+});
+
+router.post('/resend-verification', requireAuth, resendLimiter, async (req, res) => {
+  try {
+    const user = await dbGet('SELECT * FROM users WHERE id = ?', [req.userId]);
+    if (!user) return res.status(401).json({ error: '未登录' });
+    if (!user.email) return res.status(400).json({ error: '未设置邮箱' });
+    if (user.email_verified) return res.status(400).json({ error: '邮箱已验证' });
+    const result = await sendVerificationEmail(user.id, user.email, 'verify_email');
+    res.json({ success: true, sent: result.sent });
+  } catch (e) {
+    res.status(500).json({ error: '发送失败' });
+  }
+});
+
+router.post('/send-register-code', sendCodeLimiter, async (req, res) => {
+  if (!ALLOW_REGISTRATION) return res.status(403).json({ error: '注册功能未开放' });
+  const { email } = req.body || {};
+  if (!email) return res.status(400).json({ error: '请填写邮箱' });
+  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  if (!emailRegex.test(email)) return res.status(400).json({ error: '邮箱格式不正确' });
+
+  // 邮箱唯一性检查
+  const conflict = await dbGet('SELECT id FROM users WHERE email = ? OR username = ?', [email, email]);
+  if (conflict) return res.status(409).json({ error: '该邮箱已被使用' });
+
+  if (!isMailerConfigured()) return res.status(503).json({ error: '邮件服务未配置，无法注册' });
+
+  // 生成 6 位数字验证码
+  const code = String(Math.floor(100000 + Math.random() * 900000));
+  const hash = crypto.createHash('sha256').update(code + email).digest('hex');
+  const expiresAt = new Date(Date.now() + 10 * 60 * 1000).toISOString();
+
+  // 删除该邮箱之前的注册验证码
+  await dbRun("DELETE FROM email_verifications WHERE type = 'register_code' AND new_email = ?", [email]);
+  await dbRun(
+    'INSERT INTO email_verifications (user_id, token_hash, token_prefix, type, new_email, expires_at) VALUES (?, ?, ?, ?, ?, ?)',
+    [0, hash, code.slice(0, 3) + '***', 'register_code', email, expiresAt]
+  );
+
+  try {
+    await sendMail(email, '注册验证码 — 即页',
+      `<div style="max-width:480px;margin:0 auto;padding:32px 24px;font-family:system-ui,-apple-system,sans-serif;color:#333">
+        <h2 style="margin:0 0 24px;font-size:20px;color:#111">注册验证码</h2>
+        <p style="margin:0 0 16px;font-size:15px">你的注册验证码是：</p>
+        <p style="margin:0 0 24px;font-size:32px;font-weight:700;letter-spacing:6px;color:#4f46e5">${code}</p>
+        <p style="margin:0;font-size:13px;color:#888">验证码 10 分钟内有效。如非本人操作请忽略。</p>
+      </div>`
+    );
+    res.json({ sent: true });
+  } catch (e) {
+    logger.error({ type: 'app', message: '发送注册验证码失败', error: e.message });
+    res.status(500).json({ error: '验证码发送失败，请稍后重试' });
+  }
+});
+
+router.get('/smtp-status', (req, res) => {
+  res.json({ configured: isMailerConfigured() });
+});
+
+router.get('/registration-status', (req, res) => {
+  res.json({ enabled: ALLOW_REGISTRATION });
+});
+
+module.exports = router;