@polardbx/pxbaas 0.0.0-stage → 0.1.0-beta.1

package/templates/webapp/ssr-blog/backend/index.ts

@@ -0,0 +1,764 @@
+// mpa-blog-ssr — 全站服务端渲染（SSR）博客 worker。
+//
+// 与 CSR/MPA 版的本质区别：浏览器请求任意页面时，worker 先在【服务端】通过内网
+// base(SUPABASE_INTERNAL_URL) 访问 /rest/v1/posts_ssr 与 /auth/v1 取数，拼好【完整 HTML】
+// 再返回；首屏即内容，几乎不依赖客户端 JS。
+//
+// 会话：登录成功后把 GoTrue access_token 写进 HttpOnly Cookie（ssr_blog_session）。
+// 后续请求 worker 读出该 token：本地用 JWT_SECRET 验签得到用户身份用于渲染，
+// 并把它作为 Authorization 附到服务端 REST 调用上，由 RLS 强制「已发布 + 本人草稿」可见性。
+//
+// 数据面（RLS，见 supabase._mysqlrest_rls_policies / posts_ssr）：
+//   anon:         SELECT status='published'
+//   authenticated: SELECT published OR author_id=jwt.sub; INSERT/UPDATE/DELETE 限 author_id=jwt.sub
+//
+// 路由：路径形态 /posts、/post/:id、/blogger/:id、/login、/signup、/admin、/profile、/logout；
+//       链接前缀 base 由请求路径按深度算出（"../".repeat(depth-1)），因此同一份 HTML 在
+//       /apps/{mount}/、/apps/{mount}/api/ 与 /functions/v1/{slug}/ 三种前缀下都正确。
+//       兼容旧 query 形态 ?page=index|article&id=…（便于历史链接与 curl 复验）。
+
+const TABLE = "posts_ssr";
+// 方案 A：函数入口（PRESERVE_USER_AUTH 保留 Cookie，SSR 登录态可用）。/apps mount 入口剥离
+// Cookie、不保持登录态，故登录/注册/写作一律引导到此入口。root-relative，同 host 直达。
+
+// ---------- 基础工具 ----------
+function cors(): Record<string, string> {
+  return {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, apikey, X-Tenant-Id",
+  };
+}
+
+// parse-safe 转义（用 split/join，避免正则/替换函数在嵌套模板里的解析坑）。
+function esc(s: unknown): string {
+  return String(s == null ? "" : s)
+    .split("&").join("&amp;")
+    .split("<").join("&lt;")
+    .split(">").join("&gt;")
+    .split('"').join("&quot;")
+    .split("'").join("&#39;");
+}
+
+// 已转义文本里的换行转 <br>，并折叠连续空行为段落间距。
+function nl2br(escaped: string): string {
+  return escaped.split("\r").join("").split("\n").join("<br>");
+}
+
+function b64UrlDecode(s: string): Uint8Array {
+  const b64 = s.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - (b64.length % 4)) % 4);
+  const bin = atob(padded);
+  const out = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+
+type Session = { token: string; sub: string; email: string; displayName: string };
+
+// 不验签解码 JWT payload（/apps 无 JWT_SECRET 时用；令牌有效性交由 GoTrue/MysqlREST 判定）。
+function decodeNoVerify(token: string): Record<string, any> | null {
+  const parts = (token || "").split(".");
+  if (parts.length !== 3) return null;
+  try { return JSON.parse(new TextDecoder().decode(b64UrlDecode(parts[1]))); } catch { return null; }
+}
+
+// 会话：只认平台注入的可信头（方案 C）。
+// /apps/{mount}/api/* 走 TRUSTED_INTERNAL，客户端 cookie/authorization 会被 proxy 剥离；
+// proxy 校验 per-mount 会话 cookie 后注入 X-App-User-*，worker 只读它们即可。
+// 令牌有效性由 proxy 验签 + 下游 GoTrue/MysqlREST(RLS) 强制，worker 不做本地验签，也不需要 JWT_SECRET。
+// 严禁自行读 cookie（拿到的是 proxy 共享 jar 的串味残留）或把 token 放进 URL（泄漏到历史/日志/Referer）。
+async function resolveSession(req: Request): Promise<Session | null> {
+  const token = req.headers.get("x-app-user-token") || "";
+  if (!token) return null;
+  const payload = decodeNoVerify(token);
+  if (!payload) return null;
+  if (typeof payload.exp === "number" && payload.exp * 1000 < Date.now()) return null;
+  const role = String(payload.role || "");
+  if (role !== "authenticated" && role !== "service_role") return null;
+  const meta = (payload.user_metadata || {}) as Record<string, any>;
+  const email = req.headers.get("x-app-user-email") || (typeof payload.email === "string" ? payload.email : "");
+  const sub = req.headers.get("x-app-user-id") || (typeof payload.sub === "string" ? payload.sub : "");
+  return {
+    token,
+    sub,
+    email,
+    displayName: String(meta.display_name || "") || (email ? email.split("@")[0] : ""),
+  };
+}
+
+// ─── DEPLOY CONFIG（平台注入优先；缺失则明确 503，绝不回落到任何真实实例）─────────
+// env 契约（MR #30497903 起）：平台按三键白名单向 App candidate 注入 SUPABASE_INTERNAL_URL /
+//   SUPABASE_ANON_KEY / SUPABASE_URL，spec-lint 的 deno-env-not-allowed 放行这三键。本模板直读
+//   SUPABASE_INTERNAL_URL（数据面唯一可达基址）与 SUPABASE_ANON_KEY（数据面凭据），无需手填明文 key。
+//   若目标实例 sandbox 镜像尚未含该 MR，两值为空 → configError 明确 503，绝不静默连到别的实例/租户。
+//   INTERNAL_BASE —— 平台注入的内网基址（把公网 host 的 http./https. 中缀去掉）；公网 VIP 在沙箱内
+//                    因 egress 过滤全端口 TIMEOUT（非 hairpin），切勿改填公网地址。
+//   ANON_KEY      —— 单租户=实例 anon key；多租户=**该租户** anon key（自带 tenant_id claim）。
+// anon 是公开值（随页面下发给浏览器）；service_role key 严禁出现在 worker 里。
+const INTERNAL_BASE = Deno.env.get("SUPABASE_INTERNAL_URL") ?? "";
+const ANON_KEY = Deno.env.get("SUPABASE_ANON_KEY") ?? "";
+
+function configError(): string | null {
+  if (!INTERNAL_BASE) return "SUPABASE_INTERNAL_URL 未注入：目标实例 sandbox 镜像早于 MR #30497903，需平台注入内网基址后本 SSR 才能取数。";
+  if (!ANON_KEY) return "SUPABASE_ANON_KEY 未注入：目标实例 sandbox 镜像早于 MR #30497903，需平台注入 anon key。";
+  return null;
+}
+const ANON = () => ANON_KEY;
+const BASE = () => INTERNAL_BASE.replace(/\/+$/, "");
+
+// 带超时的 fetch（默认 6s），超时/网络错误抛异常，绝不无限挂起。
+async function fetchT(url: string, opts: RequestInit = {}, ms = 6000): Promise<Response> {
+  const ac = new AbortController();
+  const t = setTimeout(() => ac.abort(), ms);
+  try {
+    return await fetch(url, { ...opts, signal: ac.signal });
+  } finally {
+    clearTimeout(t);
+  }
+}
+
+// 保留异步签名以兼容既有调用点；基址来自 DEPLOY CONFIG，无需探测。
+async function resolveBase(): Promise<string> {
+  return BASE();
+}
+
+// ---------- 服务端数据访问（worker → 内部 Kong） ----------
+type Post = {
+  id: number; title: string; content: string | null; status: string;
+  author_id: string; author_name: string | null; created_at: string;
+};
+
+async function restGetPosts(query: string, token?: string): Promise<Post[]> {
+  const headers: Record<string, string> = {
+    apikey: ANON(),
+    Authorization: "Bearer " + (token || ANON()),
+    "Content-Type": "application/json",
+  };
+  const r = await fetch(`${BASE()}/rest/v1/${TABLE}?${query}`, { headers });
+  if (!r.ok) throw new Error(`REST ${r.status}`);
+  return (await r.json()) as Post[];
+}
+
+async function restWrite(
+  method: string, path: string, body: unknown, token: string,
+): Promise<{ ok: boolean; status: number; text: string }> {
+  const headers: Record<string, string> = {
+    apikey: ANON(),
+    Authorization: "Bearer " + token,
+    "Content-Type": "application/json",
+  };
+  const r = await fetch(`${BASE()}/rest/v1/${TABLE}${path}`, {
+    method, headers, body: body == null ? undefined : JSON.stringify(body),
+  });
+  const text = await r.text();
+  return { ok: r.ok, status: r.status, text };
+}
+
+async function gotrue(
+  path: string, method = "GET", body?: unknown, token?: string,
+): Promise<{ ok: boolean; status: number; json: Record<string, any> }> {
+  const headers: Record<string, string> = { apikey: ANON(), "Content-Type": "application/json" };
+  if (token) headers.Authorization = "Bearer " + token;
+  const r = await fetch(`${BASE()}/auth/v1${path}`, {
+    method, headers, body: body == null ? undefined : JSON.stringify(body),
+  });
+  let json: Record<string, any> = {};
+  try { json = await r.json(); } catch { json = {}; }
+  return { ok: r.ok, status: r.status, json };
+}
+
+// ---------- HTTP 响应助手 ----------
+function html(body: string, status = 200, extraHeaders: Record<string, string> = {}): Response {
+  return new Response(body, {
+    status,
+    headers: { "Content-Type": "text/html; charset=utf-8", ...cors(), ...extraHeaders },
+  });
+}
+function jsonResp(body: unknown, status = 200): Response {
+  return new Response(JSON.stringify(body), {
+    status, headers: { "Content-Type": "application/json; charset=utf-8", ...cors() },
+  });
+}
+// 通过 edge-function-proxy 时不能用 3xx 跳转：proxy 的 httpx 客户端 follow_redirects=True，
+//  会在【服务端内部跟随】worker 返回的 3xx，浏览器拿不到跳转语义。
+//  因此站内跳转统一返回 200 + 页内客户端跳转（location.replace / meta refresh）。
+// 注意：worker 绝不签发任何会话 Cookie——会话 Cookie 由平台的 per-mount 端点持有。
+function redirect(target: string, extraHeaders: Record<string, string> = {}): Response {
+  const safe = target.split("&").join("&amp;");
+  const body = `<!DOCTYPE html>
+<html lang="zh"><head><meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta http-equiv="refresh" content="0; url=${safe}">
+<title>跳转中… — SSR Blog</title></head>
+<body style="margin:0;font:16px/1.6 -apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,'PingFang SC',sans-serif;color:#6b7280;background:#f5f6fa">
+<div style="max-width:420px;margin:80px auto;text-align:center;background:#fff;border:1px solid #e7e9f0;border-radius:16px;padding:32px;box-shadow:0 8px 30px rgba(16,24,40,.08)">
+<div style="font-size:34px">📚</div>正在跳转…<br>
+<a href="${safe}" style="color:#5b6cff;font-weight:600">点此继续</a></div>
+<script>location.replace(${JSON.stringify(target)});</script>
+</body></html>`;
+  return new Response(body, {
+    status: 200,
+    headers: { "Content-Type": "text/html; charset=utf-8", ...cors(), ...extraHeaders },
+  });
+}
+// ---------- 样式（内联；单文件 SSR 不外链 CDN） ----------
+const CSS = `
+:root{--bg:#f5f6fa;--card:#fff;--ink:#1e2330;--muted:#6b7280;--line:#e7e9f0;--accent:#5b6cff;--accent2:#9333ea;--ok:#12a150;--warn:#d98600;--danger:#e5484d}
+*{box-sizing:border-box}
+body{margin:0;background:var(--bg);color:var(--ink);font:16px/1.7 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Microsoft YaHei",sans-serif;-webkit-font-smoothing:antialiased}
+a{color:var(--accent)}
+header.site{background:linear-gradient(120deg,var(--accent),var(--accent2));color:#fff;box-shadow:0 4px 24px rgba(91,108,255,.28);position:sticky;top:0;z-index:10}
+header.site .bar{max-width:920px;margin:0 auto;padding:14px 20px;display:flex;align-items:center;gap:18px;flex-wrap:wrap}
+header.site .brand{font-weight:800;font-size:19px;letter-spacing:.3px;text-decoration:none;color:#fff}
+header.site nav{margin-left:auto;display:flex;gap:16px;align-items:center;flex-wrap:wrap;font-size:14.5px}
+header.site nav a{color:#fff;text-decoration:none;opacity:.94}
+header.site nav a:hover{opacity:1;text-decoration:underline}
+header.site nav .who{opacity:.9}
+.wrap{max-width:920px;margin:26px auto 60px;padding:0 20px}
+h1.page{font-size:26px;margin:6px 0 4px}
+.sub{color:var(--muted);margin:0 0 18px;font-size:14.5px}
+.card{background:var(--card);border:1px solid var(--line);border-radius:16px;padding:18px 20px;margin:14px 0;box-shadow:0 1px 3px rgba(16,24,40,.05);transition:box-shadow .18s,transform .18s}
+.card:hover{box-shadow:0 8px 26px rgba(16,24,40,.09);transform:translateY(-1px)}
+.card h2{margin:0 0 6px;font-size:19px}
+.card h2 a{color:var(--ink);text-decoration:none}
+.card h2 a:hover{color:var(--accent)}
+.row{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
+.row.between{justify-content:space-between}
+.muted{color:var(--muted);font-size:13.5px}
+.excerpt{color:#3b4152;margin:8px 0 10px}
+.content{white-space:normal;color:#2a2f3c}
+.badge{display:inline-block;font-size:12px;font-weight:700;padding:2px 10px;border-radius:999px;vertical-align:middle}
+.badge.published{background:rgba(18,161,80,.12);color:var(--ok)}
+.badge.draft{background:rgba(217,134,0,.14);color:var(--warn)}
+.avatar{width:34px;height:34px;border-radius:50%;background:linear-gradient(135deg,var(--accent),var(--accent2));color:#fff;display:inline-flex;align-items:center;justify-content:center;font-weight:700;font-size:15px;flex:0 0 auto}
+.blogger-head{display:flex;align-items:center;gap:12px}
+.postlist{list-style:none;padding:0;margin:8px 0 0}
+.postlist li{padding:7px 0;border-top:1px dashed var(--line)}
+.postlist li:first-child{border-top:0}
+.postlist a{font-weight:600;text-decoration:none;color:var(--ink)}
+.postlist a:hover{color:var(--accent)}
+.more{font-size:14px;font-weight:600;text-decoration:none}
+.btn,button{appearance:none;border:0;border-radius:10px;padding:9px 16px;font-size:14.5px;font-weight:600;cursor:pointer;text-decoration:none;display:inline-block;background:linear-gradient(120deg,var(--accent),var(--accent2));color:#fff;transition:filter .15s,transform .05s}
+.btn:hover,button:hover{filter:brightness(1.06)}
+.btn:active,button:active{transform:translateY(1px)}
+.btn.ghost,button.ghost{background:#eef0f7;color:#39405a}
+.btn.danger,button.danger{background:linear-gradient(120deg,#f0616a,var(--danger))}
+.btn.sm,button.sm{padding:6px 12px;font-size:13px}
+label{display:block;font-size:13.5px;color:var(--muted);margin:12px 0 5px;font-weight:600}
+input,textarea,select{width:100%;padding:11px 13px;border:1px solid var(--line);border-radius:10px;font:inherit;background:#fbfbfe;color:var(--ink)}
+input:focus,textarea:focus,select:focus{outline:none;border-color:var(--accent);box-shadow:0 0 0 3px rgba(91,108,255,.15);background:#fff}
+textarea{resize:vertical;min-height:120px}
+.banner{background:rgba(91,108,255,.1);border:1px solid rgba(91,108,255,.25);color:#3a3f7a;padding:10px 14px;border-radius:12px;margin:12px 0;font-size:14px}
+.error{background:rgba(229,72,77,.1);border:1px solid rgba(229,72,77,.3);color:#b42328;padding:10px 14px;border-radius:12px;margin:12px 0;font-size:14px}
+.ok{background:rgba(18,161,80,.1);border:1px solid rgba(18,161,80,.3);color:#0b7a3c;padding:10px 14px;border-radius:12px;margin:12px 0;font-size:14px}
+.hero{background:linear-gradient(120deg,rgba(91,108,255,.1),rgba(147,51,234,.1));border:1px solid var(--line);border-radius:18px;padding:22px 24px;margin-bottom:8px}
+.hero h1{margin:0 0 6px;font-size:28px}
+.hero p{margin:0;color:var(--muted)}
+.form-card{max-width:520px;margin:20px auto}
+.inline-form{display:inline}
+footer.site{max-width:920px;margin:0 auto;padding:20px;color:var(--muted);font-size:13px;text-align:center}
+.tag{display:inline-block;background:#eef0f7;color:#4a5070;border-radius:999px;padding:2px 10px;font-size:12px;font-weight:600}
+`;
+
+// ---------- 布局 ----------
+function layout(opts: { title: string; body: string; session: Session | null; shared?: boolean; base?: string }): string {
+  const s = opts.session;
+  const base = opts.base ?? "";
+  const nav = s
+    ? `<a href="${base}posts">广场</a>
+       <a href="${base}admin">写作管理</a>
+       <a href="${base}profile">我的资料</a>
+       <span class="who">· ${esc(s.displayName || s.email)}</span>
+       <a class="btn sm ghost" href="${base}logout">退出</a>`
+    : `<a href="${base}posts">广场</a>
+       <a href="${base}login">登录</a>
+       <a href="${base}signup">注册</a>`;
+  const banner = opts.shared
+    ? `<div class="banner">当前为分享只读视图：可浏览已发布文章；登录/写作请通过函数原始 URL 打开。</div>`
+    : "";
+  return `<!DOCTYPE html>
+<html lang="zh">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${esc(opts.title)}</title>
+<style>${CSS}</style>
+</head>
+<body id="__ssr" data-ssr="v1">
+<header class="site"><div class="bar">
+  <a class="brand" href="${base}posts">📚 SSR 博客广场</a>
+  <nav>${nav}</nav>
+</div></header>
+<main class="wrap">
+${banner}
+${opts.body}
+</main>
+<footer class="site">由 PolarDB-X BaaS Edge Function 服务端渲染（SSR）· 表 <code>${TABLE}</code> · RLS 强制可见性</footer>
+</body>
+</html>`;
+}
+
+function fmtDate(s: string): string {
+  return s ? String(s).replace("T", " ").slice(0, 19) : "";
+}
+function authorLabel(p: Post): string {
+  return p && p.author_name ? p.author_name : "匿名博主";
+}
+function initial(name: string): string {
+  const n = (name || "?").trim();
+  return n ? Array.from(n)[0].toUpperCase() : "?";
+}
+
+// 把已发布文章按博主聚合（入参需已按 created_at desc 排序）。
+function groupByAuthor(rows: Post[]) {
+  const order: string[] = [];
+  const map: Record<string, { author_id: string; author_name: string; posts: Post[]; count: number }> = {};
+  (rows || []).forEach((p) => {
+    const aid = p.author_id || "";
+    if (!map[aid]) { map[aid] = { author_id: aid, author_name: "", posts: [], count: 0 }; order.push(aid); }
+    const g = map[aid];
+    g.posts.push(p); g.count += 1;
+    if (!g.author_name && p.author_name) g.author_name = p.author_name;
+  });
+  return order.map((aid) => map[aid]);
+}
+
+// ---------- 各页面渲染 ----------
+function renderIndex(posts: Post[], session: Session | null, shared: boolean, base = ""): string {
+  const published = posts.filter((p) => p.status === "published");
+  const groups = groupByAuthor(published);
+  let list: string;
+  if (!groups.length) {
+    list = `<div class="card"><div class="muted">广场暂无已发布文章。注册成为博主，写下第一篇吧。</div></div>`;
+  } else {
+    list = groups.map((g) => {
+      const name = g.author_name || "匿名博主";
+      const latest = g.posts.slice(0, 2).map((p) =>
+        `<li><a href="${base}post/${encodeURIComponent(String(p.id))}">${esc(p.title)}</a>
+         <span class="muted"> · ${esc(fmtDate(p.created_at))}</span></li>`).join("");
+      const more = g.count > 2
+        ? `<span class="muted">共 ${g.count} 篇（显示最新 2 篇）</span>`
+        : `<span class="muted">${g.count} 篇</span>`;
+      return `<div class="card">
+        <div class="row between">
+          <div class="blogger-head"><span class="avatar">${esc(initial(name))}</span>
+            <h2 style="margin:0"><a href="${base}blogger/${encodeURIComponent(g.author_id)}">${esc(name)}</a></h2></div>
+          <a class="more" href="${base}blogger/${encodeURIComponent(g.author_id)}">更多文章 →</a>
+        </div>
+        <div class="muted" style="margin:6px 0 4px">${more}</div>
+        <ul class="postlist">${latest}</ul>
+      </div>`;
+    }).join("");
+  }
+  const body = `<div class="hero">
+      <h1>📚 博客广场</h1>
+      <p>按博主展示每位作者的最新文章。本页由服务端渲染 —— 你看到的已是完整内容，无需等待浏览器再取数。</p>
+    </div>
+    <div class="row" style="margin:6px 0 2px"><span class="tag">SSR</span><span class="muted">共 ${groups.length} 位博主 · ${published.length} 篇已发布</span></div>
+    ${list}`;
+  return layout({ title: "博客广场 — SSR Blog", body, session, shared, base });
+}
+
+function renderArticle(p: Post | null, session: Session | null, shared: boolean, base = "", notFoundMsg?: string): string {
+  let inner: string;
+  if (!p) {
+    inner = `<div class="error">${esc(notFoundMsg || "文章不存在或不可见（未发布且非作者本人）。")}</div>
+      <p><a class="btn ghost" href="${base}posts">← 返回广场</a></p>`;
+  } else {
+    if (shared && p.status !== "published") {
+      inner = `<div class="error">该文章尚未发布，分享只读视图不可见。</div>
+        <p><a class="btn ghost" href="${base}posts">← 返回广场</a></p>`;
+    } else {
+      const name = authorLabel(p);
+      inner = `<p><a href="${base}posts" class="muted">← 返回广场</a></p>
+        <article class="card">
+          <h1 class="page">${esc(p.title)} <span class="badge ${esc(p.status)}">${esc(p.status)}</span></h1>
+          <div class="row" style="margin:8px 0 14px">
+            <span class="avatar">${esc(initial(name))}</span>
+            <span><a href="${base}blogger/${encodeURIComponent(p.author_id)}" style="text-decoration:none;font-weight:600">${esc(name)}</a>
+            <span class="muted"> · #${esc(String(p.id))} · ${esc(fmtDate(p.created_at))}</span></span>
+          </div>
+          <div class="content">${nl2br(esc(p.content || ""))}</div>
+        </article>`;
+    }
+  }
+  return layout({ title: p ? `${p.title} — SSR Blog` : "文章 — SSR Blog", body: inner, session, shared, base });
+}
+
+function renderBlogger(authorId: string, posts: Post[], session: Session | null, shared: boolean, base = ""): string {
+  const published = posts.filter((p) => p.status === "published");
+  const name = (published[0] && published[0].author_name) || (posts[0] && posts[0].author_name) || "匿名博主";
+  const list = published.length
+    ? published.map((p) => `<div class="card">
+        <h2><a href="${base}post/${encodeURIComponent(String(p.id))}">${esc(p.title)}</a></h2>
+        <p class="excerpt">${esc(String(p.content || "").slice(0, 140))}${(p.content || "").length > 140 ? "…" : ""}</p>
+        <div class="muted">#${esc(String(p.id))} · ${esc(fmtDate(p.created_at))}</div>
+      </div>`).join("")
+    : `<div class="card"><div class="muted">该博主暂无已发布文章。</div></div>`;
+  const body = `<p><a href="${base}posts" class="muted">← 返回广场</a></p>
+    <div class="card"><div class="blogger-head"><span class="avatar">${esc(initial(name))}</span>
+      <div><h1 class="page" style="margin:0">👤 ${esc(name)}</h1>
+      <div class="muted">${published.length ? `共 ${published.length} 篇已发布文章（新→旧）` : "暂无已发布文章"}</div></div>
+    </div></div>
+    ${list}`;
+  return layout({ title: `${name} — SSR Blog`, body, session, shared, base });
+}
+
+// 方案 A：/apps mount 入口命中需要会话的页面时，渲染引导页（不尝试在此入口登录）。
+function renderLogin(session: Session | null, errorMsg?: string, base = ""): string {
+  const body = `<div class="card form-card">
+    <h1 class="page">博主登录</h1>
+    <p class="sub">登录后可写作、管理自己的文章。</p>
+    ${errorMsg ? `<div class="error">${esc(errorMsg)}</div>` : ""}
+    <form id="lf" method="post" action="${base}login">
+      <label>邮箱</label>
+      <input name="email" type="email" placeholder="you@example.com" autocomplete="username" required>
+      <label>密码</label>
+      <input name="password" type="password" placeholder="••••••" autocomplete="current-password" required>
+      <div class="row" style="margin-top:16px">
+        <button type="submit">登录</button>
+        <span class="muted">还没有账号？<a href="${base}signup">注册新博主</a></span>
+      </div>
+      <div id="lmsg" class="muted" style="margin-top:10px"></div>
+    </form>
+    ${`<script>
+    document.getElementById('lf').addEventListener('submit', function (e) {
+      e.preventDefault();
+      var f = e.target, msg = document.getElementById('lmsg');
+      // 方案 C：优先走 proxy 的 per-mount 会话端点（设 HttpOnly cookie，后续由 proxy 注入身份头）。
+      fetch('${base}_session/login', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email: f.email.value, password: f.password.value }) })
+        .then(function (r) {
+          if (r.ok) { location.href = '${base}admin'; return; }
+          msg.textContent = '登录失败 HTTP ' + r.status + '（需实例支持 App 会话注入：capabilities.sessionMode=proxy-injected-header）';
+        })
+        .catch(function (e) { msg.textContent = '请求异常：' + e; });
+    });
+    </script>`}
+  </div>`;
+  return layout({ title: "登录 — SSR Blog", body, session });
+}
+
+function renderSignup(session: Session | null, errorMsg?: string, infoMsg?: string, base = ""): string {
+  const body = `<div class="card form-card">
+    <h1 class="page">注册新博主</h1>
+    <p class="sub">注册成功后即可登录写作。</p>
+    ${errorMsg ? `<div class="error">${esc(errorMsg)}</div>` : ""}
+    ${infoMsg ? `<div class="ok">${esc(infoMsg)}</div>` : ""}
+    <form id="sf" method="post" action="${base}signup">
+      <label>邮箱</label>
+      <input name="email" type="email" placeholder="you@example.com" autocomplete="username" required>
+      <label>密码</label>
+      <input name="password" type="password" placeholder="至少 6 位" autocomplete="new-password" minlength="6" required>
+      <div class="row" style="margin-top:16px">
+        <button type="submit">注册</button>
+        <span class="muted">已有账号？<a href="${base}login">登录</a></span>
+      </div>
+      <div id="smsg" class="muted" style="margin-top:10px"></div>
+    </form>
+    ${`<script>
+    document.getElementById('sf').addEventListener('submit', function (e) {
+      e.preventDefault();
+      var f = e.target, msg = document.getElementById('smsg');
+      var creds = { email: f.email.value, password: f.password.value };
+      // 先经 worker 建号，再用 proxy 会话端点设 per-mount cookie（方案 C）。
+      fetch('${base}signup', { method: 'POST', body: new URLSearchParams(creds) })
+        .then(function (r) { return r.ok ? r.text() : Promise.reject(new Error('HTTP ' + r.status)); })
+        .then(function () {
+          return fetch('${base}_session/login', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(creds) });
+        })
+        .then(function (r) { if (r.ok) { location.href = '${base}admin'; } else { msg.textContent = '注册成功但建立会话失败，请前往登录。'; } })
+        .catch(function (err) { msg.textContent = String(err && err.message || err); });
+    });
+    </script>`}
+  </div>`;
+  return layout({ title: "注册 — SSR Blog", body, session });
+}
+
+function renderAdmin(session: Session, myPosts: Post[], msg?: string, err?: string, base = ""): string {
+  const list = myPosts.length
+    ? myPosts.map((p) => {
+      const toggle = p.status === "draft"
+        ? `<form class="inline-form" method="post" action="${base}admin">
+             <input type="hidden" name="do" value="publish"><input type="hidden" name="id" value="${esc(String(p.id))}">
+             <button class="btn sm ghost" type="submit">发布</button></form>`
+        : `<form class="inline-form" method="post" action="${base}admin">
+             <input type="hidden" name="do" value="unpublish"><input type="hidden" name="id" value="${esc(String(p.id))}">
+             <button class="btn sm ghost" type="submit">转草稿</button></form>`;
+      const del = `<form class="inline-form" method="post" action="${base}admin" onsubmit="return confirm('删除这篇文章？')">
+             <input type="hidden" name="do" value="delete"><input type="hidden" name="id" value="${esc(String(p.id))}">
+             <button class="btn sm danger" type="submit">删除</button></form>`;
+      return `<div class="card">
+        <div class="row between">
+          <h2 style="margin:0"><a href="${base}post/${encodeURIComponent(String(p.id))}">${esc(p.title)}</a></h2>
+          <span class="badge ${esc(p.status)}">${esc(p.status)}</span>
+        </div>
+        <div class="row between" style="margin-top:8px">
+          <span class="muted">#${esc(String(p.id))} · ${esc(fmtDate(p.created_at))}</span>
+          <span class="row">${toggle}${del}</span>
+        </div>
+      </div>`;
+    }).join("")
+    : `<div class="card"><div class="muted">你还没有文章，写下第一篇吧。</div></div>`;
+  const body = `<h1 class="page">写作管理</h1>
+    <p class="sub">当前博主：${esc(session.displayName || session.email)}（${esc(session.email)}）</p>
+    ${msg ? `<div class="ok">${esc(msg)}</div>` : ""}
+    ${err ? `<div class="error">${esc(err)}</div>` : ""}
+    <div class="card">
+      <h2>写文章</h2>
+      <form method="post" action="${base}admin">
+        <input type="hidden" name="do" value="create">
+        <label>标题</label>
+        <input name="title" maxlength="200" placeholder="文章标题" required>
+        <label>正文</label>
+        <textarea name="content" placeholder="正文（纯文本，渲染时转义、换行保留）"></textarea>
+        <label>状态</label>
+        <select name="status"><option value="draft">draft（草稿）</option><option value="published">published（发布）</option></select>
+        <div class="row" style="margin-top:14px"><button type="submit">创建</button></div>
+      </form>
+    </div>
+    <h1 class="page" style="margin-top:24px">我的文章</h1>
+    ${list}`;
+  return layout({ title: "写作管理 — SSR Blog", body, session });
+}
+
+function renderProfile(session: Session, user: Record<string, any>, msg?: string, err?: string, base = ""): string {
+  const meta = (user && user.user_metadata) || {};
+  const body = `<div class="card form-card">
+    <h1 class="page">我的资料</h1>
+    ${msg ? `<div class="ok">${esc(msg)}</div>` : ""}
+    ${err ? `<div class="error">${esc(err)}</div>` : ""}
+    <label>邮箱</label>
+    <div style="font-size:16px;margin-bottom:6px">${esc(user.email || session.email)}</div>
+    <label>注册时间</label>
+    <div class="muted" style="margin-bottom:6px">${esc(fmtDate(user.created_at || ""))}</div>
+    <form method="post" action="${base}profile">
+      <input type="hidden" name="do" value="update">
+      <label>展示名（发文署名）</label>
+      <input name="display_name" maxlength="40" placeholder="留空则用邮箱前缀" value="${esc(meta.display_name || "")}">
+      <div class="row" style="margin-top:14px"><button type="submit">保存资料</button></div>
+    </form>
+  </div>`;
+  return layout({ title: "我的资料 — SSR Blog", body, session });
+}
+
+function authError(j: Record<string, any>, status: number): string {
+  const raw = String(j && (j.msg || j.error_description || j.error) || "");
+  if (!raw) return `请求失败（HTTP ${status}）`;
+  const s = raw.toLowerCase();
+  if (s.indexOf("invalid login credentials") >= 0 || s.indexOf("invalid credentials") >= 0) return "邮箱或密码错误";
+  if (s.indexOf("email not confirmed") >= 0) return "邮箱未确认，无法登录（该实例通常已开免验证，若出现此提示请联系管理员）";
+  if (s.indexOf("already registered") >= 0 || s.indexOf("already exists") >= 0) return "该邮箱已注册，请直接登录";
+  if (s.indexOf("invalid email") >= 0 || s.indexOf("unable to validate email") >= 0) return "邮箱格式不正确";
+  if (s.indexOf("password") >= 0 && (s.indexOf("character") >= 0 || s.indexOf("short") >= 0)) return "密码长度不足（至少 6 位）";
+  if (s.indexOf("rate limit") >= 0 || s.indexOf("too many") >= 0) return "操作过于频繁，请稍后再试";
+  return raw;
+}
+
+// ---------- 路由 ----------
+Deno.serve(async (req: Request): Promise<Response> => {
+  if (req.method === "OPTIONS") return new Response(null, { status: 204, headers: cors() });
+
+  const url = new URL(req.url);
+  // 方案 A：proxy 在 /apps 派发时注入 X-App-Mount-Id 头（/functions 入口没有），据此区分入口。
+  const onApps = req.headers.get("x-app-mount-id") != null;
+  const action = url.searchParams.get("action") || "";
+  // 内置 JSON API（供 pxbaas app verify / 健康探测）。
+  if (action === "health" || action === "time") return jsonResp({ ok: true, now: new Date().toISOString() });
+ if (action === "diag") {
+    // 探测已配置基址的可达性（4s 超时），用于判定沙箱能否服务端取数。
+    const out: Record<string, string> = {};
+    for (const base of (BASE() ? [BASE()] : [])) {
+      try {
+        const r = await fetchT(`${base}/rest/v1/${TABLE}?select=id&limit=1`, {
+          headers: { apikey: ANON(), Authorization: "Bearer " + ANON() },
+        }, 4000);
+        out[base] = "HTTP " + r.status;
+      } catch (e) {
+        out[base] = "ERR " + String((e as Error)?.name || e);
+      }
+    }
+    return jsonResp({ ok: true, onApps, anonPresent: !!ANON(), configReady: !configError(), bases: out });
+  }
+
+  // 路由解析（三种派发形态均兼容）：
+  //   a) 静态未命中回落：worker 收到完整路径 /apps/{mount}/post/1
+  //   b) /api 派发（strip 后）：worker 收到候选前缀形式 /app_<uuid>_r_<rev>/posts
+  //   c) legacy 函数入口：/functions/v1/{slug}/posts
+  // 统一做法：先剔除候选前缀与 api 标记，再从第一个已知路由名开始取 tail；
+  // 链接前缀 base 在有 X-App-Mount-Id 时用挂载根（/apps/{mount}/），否则从真实路径回推。
+  const ROUTES = ["posts", "post", "blogger", "login", "signup", "admin", "profile", "logout", "page"];
+  const rawSegs = url.pathname.split("/").filter(Boolean);
+  const apiIdx = rawSegs.lastIndexOf("api");
+  const segs = (rawSegs[0] || "").startsWith("app_") ? rawSegs.slice(1) : rawSegs;
+  let cut = segs.findIndex((x) => ROUTES.indexOf(x.toLowerCase()) >= 0);
+  if (cut < 0) cut = apiIdx >= 0 ? segs.length : Math.max(0, segs.length - 1);
+  const tail = segs.slice(cut);
+  const depth = (apiIdx >= 0 ? 1 : 0) + tail.length;
+  const mountId = req.headers.get("x-app-mount-id") || "";
+  let base: string;
+  if (mountId) {
+    base = `/apps/${mountId}/`;          // 挂载根绝对前缀：与派发形态/页面深度无关
+  } else {
+    const keep = Math.max(0, rawSegs.length - tail.length);
+    base = "/" + rawSegs.slice(0, keep).join("/") + (keep > 0 ? "/" : "");
+  }
+  void depth;
+  const ALIAS: Record<string, string> = { index: "posts", article: "post" };
+  const seg0 = (tail[0] || "").toLowerCase();
+  const legacyPage = url.searchParams.get("page") || "";
+  const rawRoute = (seg0 === "page" || seg0 === "") ? legacyPage : seg0;
+  const page = (ALIAS[rawRoute] || rawRoute || "posts").toLowerCase();
+  const arg = decodeURIComponent(tail.length > 1 ? tail[1] : (url.searchParams.get("id") || ""));
+  const shared = url.pathname.indexOf("/published/") >= 0;
+  let session: Session | null = null;
+  try { session = await resolveSession(req); } catch { session = null; }
+
+  const doRoute = async (): Promise<Response> => {
+  try {
+    // ---- 广场 ----
+    if (page === "posts" || page === "") {
+      const posts = await restGetPosts(
+        "select=id,title,content,status,author_id,author_name,created_at&order=created_at.desc&limit=200",
+      );
+      return html(renderIndex(posts, session, shared, base));
+    }
+
+    // ---- 文章详情 ----
+    if (page === "post") {
+      const id = arg;
+      if (!/^\d+$/.test(id)) return html(renderArticle(null, session, shared, base, "缺少文章 ID（正确形式：/post/1）"));
+      const rows = await restGetPosts(
+        `id=eq.${encodeURIComponent(id)}&select=id,title,content,status,author_id,author_name,created_at`,
+        session?.token,
+      );
+      return html(renderArticle(rows && rows.length ? rows[0] : null, session, shared, base));
+    }
+
+    // ---- 博主主页 ----
+    if (page === "blogger") {
+      const authorId = arg;
+      if (!authorId) return html(renderBlogger("", [], session, shared, base));
+      const rows = await restGetPosts(
+        `author_id=eq.${encodeURIComponent(authorId)}&select=id,title,content,status,author_id,author_name,created_at&order=created_at.desc&limit=200`,
+      );
+      return html(renderBlogger(authorId, rows, session, shared, base));
+    }
+
+    // ---- 登录 ----
+    // 方案 C：登录由平台的 per-mount 会话端点完成（页面脚本 fetch '../_session/login'），
+    // worker 不校验密码、也不签发任何 cookie（proxy 拥有会话 cookie 并会剥离客户端凭据）。
+    if (page === "login") {
+      if (req.method === "POST") {
+        return html(renderLogin(session, "请用页面上的登录按钮（提交到平台会话端点 _session/login）；worker 不再处理密码。", base), 400);
+      }
+      if (session) return redirect(base + "admin");
+      return html(renderLogin(session, undefined, base));
+    }
+
+    // ---- 注册 ----
+    if (page === "signup") {
+      if (req.method === "POST") {
+        const fd = await req.formData();
+        const email = String(fd.get("email") || "").trim();
+        const password = String(fd.get("password") || "");
+        if (!email || !password) return html(renderSignup(session, "请填写邮箱和密码", undefined, base));
+        const r = await gotrue("/signup", "POST", { email, password });
+        if (!r.ok) return html(renderSignup(session, authError(r.json, r.status), undefined, base));
+        // 建号成功；会话由页面脚本接着调 ../_session/login 建立（per-mount HttpOnly cookie）。
+        return jsonResp({ ok: true, needEmailConfirm: !(r.json && r.json.access_token) });
+      }
+      if (session) return redirect(base + "admin");
+      return html(renderSignup(session, undefined, undefined, base));
+    }
+
+    // ---- 退出 ----
+    if (page === "logout") {
+      // 方案 C：会话 cookie 由平台持有，worker 无法也不应自行清除；
+      // 返回一个过渡页，由页面脚本调平台的 per-mount 退出端点后再回广场。
+      // （用 curl 复验时不会执行 JS，需直接 POST ../_session/logout。）
+      return html(`<!DOCTYPE html><html lang="zh"><head><meta charset="utf-8"><title>退出中…</title></head>
+<body style="font:16px system-ui,sans-serif;color:#6b7280;text-align:center;padding-top:60px">正在退出…
+<script>fetch('${base}_session/logout',{method:'POST'}).finally(function(){location.replace('${base}posts');});</script>
+</body></html>`);
+    }
+
+    // ---- 写作管理 ----
+    if (page === "admin") {
+      if (!session) return redirect(base + "login");
+      if (req.method === "POST") {
+        const fd = await req.formData();
+        const op = String(fd.get("do") || "");
+        if (op === "create") {
+          const title = String(fd.get("title") || "").trim();
+          const content = String(fd.get("content") || "");
+          const status = String(fd.get("status") || "draft") === "published" ? "published" : "draft";
+          if (!title) {
+            const rows = await restGetPosts("select=id,title,content,status,author_id,author_name,created_at&order=created_at.desc&limit=200", session.token);
+            return html(renderAdmin(session, rows.filter((p) => p.author_id === session!.sub), undefined, "标题不能为空", base));
+          }
+          const w = await restWrite("POST", "", {
+            title, content, status, author_id: session.sub,
+            author_name: session.displayName || (session.email ? session.email.split("@")[0] : "匿名博主"),
+          }, session.token);
+          if (!w.ok) return html(renderAdmin(session, [], undefined, `创建失败：HTTP ${w.status} ${w.text.slice(0, 120)}`, base));
+          return redirect(base + "admin?msg=" + encodeURIComponent("已创建"));
+        }
+        const id = String(fd.get("id") || "");
+        if (/^\d+$/.test(id)) {
+          let w: { ok: boolean; status: number; text: string };
+          if (op === "publish") w = await restWrite("PATCH", `?id=eq.${encodeURIComponent(id)}`, { status: "published" }, session.token);
+          else if (op === "unpublish") w = await restWrite("PATCH", `?id=eq.${encodeURIComponent(id)}`, { status: "draft" }, session.token);
+          else if (op === "delete") w = await restWrite("DELETE", `?id=eq.${encodeURIComponent(id)}`, null, session.token);
+          else return redirect(base + "admin");
+          if (!w.ok) return redirect(base + "admin?err=" + encodeURIComponent(`操作失败：HTTP ${w.status}`));
+        }
+        return redirect(base + "admin");
+      }
+      const rows = await restGetPosts(
+        "select=id,title,content,status,author_id,author_name,created_at&order=created_at.desc&limit=200",
+        session.token,
+      );
+      const my = rows.filter((p) => p.author_id === session.sub);
+      const msg = url.searchParams.get("msg") || undefined;
+      const err = url.searchParams.get("err") || undefined;
+      return html(renderAdmin(session, my, msg, err, base));
+    }
+
+    // ---- 我的资料 ----
+    if (page === "profile") {
+      if (!session) return redirect(base + "login");
+      if (req.method === "POST") {
+        const fd = await req.formData();
+        const name = String(fd.get("display_name") || "").trim();
+        const r = await gotrue("/user", "PUT", { data: { display_name: name } }, session.token);
+        if (!r.ok) return redirect(base + "profile?err=" + encodeURIComponent(authError(r.json, r.status)));
+        // user_metadata 变更后旧 token 内的 display_name 会滞后；重新登录换取新 token 以刷新 Cookie。
+        return redirect(base + "profile?msg=" + encodeURIComponent("已保存；新发文章将使用该署名"));
+      }
+      const r = await gotrue("/user", "GET", undefined, session.token);
+      const user = r.ok ? r.json : { email: session.email, user_metadata: {} };
+      const msg = url.searchParams.get("msg") || undefined;
+      const err = url.searchParams.get("err") || undefined;
+      return html(renderProfile(session, user, msg, err, base));
+    }
+
+    // ---- 兜底 ----
+    return html(layout({
+      title: "未找到 — SSR Blog",
+      body: `<div class="error">未知页面：${esc(page)}</div><p><a class="btn ghost" href="${base}posts">← 返回广场</a></p>`,
+      session, shared, base,
+    }), 404);
+  } catch (e) {
+    return html(layout({
+      title: "服务端错误 — SSR Blog",
+      body: `<div class="error">服务端渲染出错：${esc(String(e && (e as Error).message || e))}</div>
+        <p class="muted">提示：worker 通过内部 SUPABASE_URL 访问 /rest/v1 与 /auth/v1，若此处报网络错误请检查沙箱到实例的连通性。</p>
+        <p><a class="btn ghost" href="${base}posts">← 返回广场</a></p>`,
+      session, shared, base,
+    }), 500);
+  }
+  };
+  return await doRoute();
+});