hd-garden 0.3.0

package/app/api/admin/distribution/route.ts

@@ -0,0 +1,120 @@
+import { requireAdminApi, requireAdminMutation } from "../../../lib/admin-auth";
+import { findColumnEntry, findPost } from "../../../lib/content";
+import { absoluteUrl, getSiteUrl } from "../../../lib/site";
+
+type Platform = "x" | "csdn" | "zhihu" | "juejin";
+
+const platformLabel: Record<Platform, string> = {
+  x: "X",
+  csdn: "CSDN",
+  zhihu: "知乎",
+  juejin: "掘金",
+};
+
+function platformWebhook(platform: Exclude<Platform, "x">) {
+  const keys = {
+    csdn: "CSDN_SYNC_WEBHOOK",
+    zhihu: "ZHIHU_SYNC_WEBHOOK",
+    juejin: "JUEJIN_SYNC_WEBHOOK",
+  } as const;
+  return process.env[keys[platform]];
+}
+
+export async function POST(request: Request) {
+  const user = await requireAdminMutation(request);
+  if (user instanceof Response) return user;
+  const payload = (await request.json()) as {
+    kind?: unknown;
+    path?: unknown;
+    column?: unknown;
+    platform?: unknown;
+  };
+  const kind = payload.kind === "column" ? "column" : payload.kind === "post" ? "post" : null;
+  const path = typeof payload.path === "string" ? payload.path : "";
+  const platform = ["x", "csdn", "zhihu", "juejin"].includes(String(payload.platform))
+    ? (payload.platform as Platform)
+    : null;
+  if (!kind || !path || !platform) {
+    return Response.json({ error: "分发参数不完整。" }, { status: 400 });
+  }
+
+  const entry = kind === "post" ? findPost(path) : undefined;
+  const column = typeof payload.column === "string" ? payload.column : "";
+  const columnEntry = kind === "column" ? findColumnEntry(column, path) : undefined;
+  const source = entry ?? columnEntry;
+  if (!source) return Response.json({ error: "未找到对应内容。" }, { status: 404 });
+
+  const publicPath = kind === "post" ? `/blog/${source.path}` : `/columns/${source.column}/${source.path}`;
+  const canonicalUrl = absoluteUrl(publicPath, await getSiteUrl());
+  let status: "queued" | "published" | "needs_credentials" | "failed" = "queued";
+  let externalUrl: string | null = null;
+  let error: string | null = null;
+
+  try {
+    if (platform === "x") {
+      const token = process.env.X_USER_ACCESS_TOKEN;
+      if (!token) {
+        status = "needs_credentials";
+        error = "缺少 X_USER_ACCESS_TOKEN。";
+      } else {
+        const text = `${source.title}\n${source.description ?? ""}\n${canonicalUrl}`.slice(0, 280);
+        const response = await fetch("https://api.x.com/2/tweets", {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+          },
+          body: JSON.stringify({ text }),
+        });
+        const result = (await response.json()) as { data?: { id?: string }; detail?: string };
+        if (!response.ok || !result.data?.id) {
+          status = "failed";
+          error = result.detail ?? "X 未接受这次发布请求。";
+        } else {
+          status = "published";
+          externalUrl = `https://x.com/i/web/status/${result.data.id}`;
+        }
+      }
+    } else {
+      const webhook = platformWebhook(platform);
+      if (!webhook) {
+        status = "needs_credentials";
+        error = `缺少 ${platformLabel[platform]} 的同步 Webhook。`;
+      } else {
+        const response = await fetch(webhook, {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            platform,
+            title: source.title,
+            markdown: source.content,
+            summary: source.description ?? "",
+            canonicalUrl,
+            tags: source.tags ?? [],
+          }),
+        });
+        const result = (await response.json().catch(() => ({}))) as { url?: string; error?: string };
+        if (!response.ok) {
+          status = "failed";
+          error = result.error ?? `${platformLabel[platform]} 同步服务返回失败。`;
+        } else {
+          status = "published";
+          externalUrl = result.url ?? null;
+        }
+      }
+    }
+
+    return Response.json({
+      job: { platform, status, canonicalUrl, externalUrl, error },
+    });
+  } catch (exception) {
+    const message = exception instanceof Error ? exception.message : "分发服务暂不可用。";
+    return Response.json({ error: message }, { status: 503 });
+  }
+}
+
+export async function GET() {
+  const user = await requireAdminApi();
+  if (user instanceof Response) return user;
+  return Response.json({ jobs: [] });
+}

package/app/api/admin/posts/pin/route.ts

@@ -0,0 +1,32 @@
+import { requireAdminMutation } from "../../../../lib/admin-auth";
+import { updateRepositoryPostPinned } from "../../../../lib/github-content";
+import { findPost } from "../../../../lib/content";
+
+export async function PATCH(request: Request) {
+  const user = await requireAdminMutation(request);
+  if (user instanceof Response) return user;
+  const payload = (await request.json().catch(() => null)) as {
+    path?: unknown;
+    pinned?: unknown;
+  } | null;
+  if (typeof payload?.path !== "string" || typeof payload.pinned !== "boolean") {
+    return Response.json({ error: "博文路径和置顶状态必须正确填写。" }, { status: 400 });
+  }
+  const post = findPost(payload.path);
+  if (!post) return Response.json({ error: "未找到对应博文。" }, { status: 404 });
+  try {
+    return Response.json({
+      post: await updateRepositoryPostPinned({
+        sourcePath: post.sourcePath,
+        slug: post.slug,
+        title: post.title,
+        pinned: payload.pinned,
+      }),
+    });
+  } catch (error) {
+    return Response.json(
+      { error: error instanceof Error ? error.message : "置顶状态更新失败。" },
+      { status: 503 },
+    );
+  }
+}

package/app/api/admin/thoughts/[id]/route.ts

@@ -0,0 +1,44 @@
+import { requireAdminMutation } from "../../../../lib/admin-auth";
+import {
+  deleteRepositoryThought,
+  updateRepositoryThought,
+} from "../../../../lib/github-content";
+
+export async function PATCH(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const user = await requireAdminMutation(request);
+  if (user instanceof Response) return user;
+  const { id } = await params;
+  const payload = (await request.json()) as { status?: unknown };
+  if (payload.status !== "draft" && payload.status !== "published") {
+    return Response.json({ error: "无效的状态。" }, { status: 400 });
+  }
+  try {
+    return Response.json({ thought: await updateRepositoryThought(id, payload.status) });
+  } catch (error) {
+    return Response.json(
+      { error: error instanceof Error ? error.message : "更新失败，请稍后重试。" },
+      { status: 503 },
+    );
+  }
+}
+
+export async function DELETE(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const user = await requireAdminMutation(request);
+  if (user instanceof Response) return user;
+  const { id } = await params;
+  try {
+    await deleteRepositoryThought(id);
+    return Response.json({ ok: true });
+  } catch (error) {
+    return Response.json(
+      { error: error instanceof Error ? error.message : "删除失败，请稍后重试。" },
+      { status: 503 },
+    );
+  }
+}

package/app/api/admin/thoughts/route.ts

@@ -0,0 +1,120 @@
+import { requireAdminApi, requireAdminMutation } from "../../../lib/admin-auth";
+import {
+  createRepositoryThought,
+  listRepositoryThoughts,
+} from "../../../lib/github-content";
+import type { MediaItem } from "../../../lib/content";
+
+type ThoughtPayload = {
+  title?: unknown;
+  content?: unknown;
+  tags?: unknown;
+  media?: unknown;
+  status?: unknown;
+};
+
+function createThoughtSlug() {
+  return `thought-${Date.now().toString(36)}-${crypto.randomUUID().slice(0, 6)}`;
+}
+
+function isHttpUrl(value: unknown) {
+  if (typeof value !== "string") return false;
+  try {
+    const url = new URL(value);
+    return url.protocol === "https:" || url.protocol === "http:";
+  } catch {
+    return false;
+  }
+}
+
+function parseMedia(value: unknown): MediaItem[] | null {
+  if (!Array.isArray(value) || value.length > 12) return null;
+  const media: MediaItem[] = [];
+  for (const item of value) {
+    if (!item || typeof item !== "object") return null;
+    const candidate = item as Record<string, unknown>;
+    if (
+      !["image", "audio", "video", "link"].includes(String(candidate.type)) ||
+      !isHttpUrl(candidate.src)
+    ) {
+      return null;
+    }
+    media.push({
+      type: candidate.type as MediaItem["type"],
+      src: String(candidate.src),
+      ...(typeof candidate.alt === "string" && candidate.alt.trim()
+        ? { alt: candidate.alt.trim().slice(0, 200) }
+        : {}),
+      ...(typeof candidate.poster === "string" && isHttpUrl(candidate.poster)
+        ? { poster: candidate.poster }
+        : {}),
+      ...(typeof candidate.mime === "string" && candidate.mime.trim()
+        ? { mime: candidate.mime.trim().slice(0, 100) }
+        : {}),
+      ...(typeof candidate.title === "string" && candidate.title.trim()
+        ? { title: candidate.title.trim().slice(0, 200) }
+        : {}),
+      ...(typeof candidate.description === "string" && candidate.description.trim()
+        ? { description: candidate.description.trim().slice(0, 400) }
+        : {}),
+    });
+  }
+  return media;
+}
+
+function parsePayload(payload: ThoughtPayload) {
+  const title = typeof payload.title === "string" ? payload.title.trim() : "";
+  const content = typeof payload.content === "string" ? payload.content.trim() : "";
+  const tags = Array.isArray(payload.tags)
+    ? payload.tags
+        .filter((tag): tag is string => typeof tag === "string")
+        .map((tag) => tag.trim())
+        .filter(Boolean)
+        .slice(0, 12)
+    : [];
+  const media = parseMedia(payload.media ?? []);
+  const status = payload.status === "draft" ? "draft" : "published";
+
+  if (!title || title.length > 120) return { error: "标题不能为空，且不得超过 120 个字符。" };
+  if (!content || content.length > 20_000) return { error: "正文不能为空，且不得超过 20,000 个字符。" };
+  if (!media) return { error: "附件最多 12 个，且必须是 http(s) 地址。" };
+  return { value: { title, content, tags, media, status } };
+}
+
+export async function GET() {
+  const user = await requireAdminApi();
+  if (user instanceof Response) return user;
+  try {
+    return Response.json({ thoughts: await listRepositoryThoughts() });
+  } catch (error) {
+    return Response.json(
+      { error: error instanceof Error ? error.message : "读取 GitHub 内容失败。" },
+      { status: 503 },
+    );
+  }
+}
+
+export async function POST(request: Request) {
+  const user = await requireAdminMutation(request);
+  if (user instanceof Response) return user;
+  const parsed = parsePayload((await request.json()) as ThoughtPayload);
+  if ("error" in parsed) return Response.json(parsed, { status: 400 });
+
+  try {
+    const thought = await createRepositoryThought({
+      slug: createThoughtSlug(),
+      title: parsed.value.title,
+      content: parsed.value.content,
+      tags: parsed.value.tags,
+      media: parsed.value.media,
+      status: parsed.value.status,
+      date: new Date().toISOString(),
+    });
+    return Response.json({ thought }, { status: 201 });
+  } catch (error) {
+    return Response.json(
+      { error: error instanceof Error ? error.message : "保存到 GitHub 失败。" },
+      { status: 503 },
+    );
+  }
+}

package/app/api/admin/uploads/route.ts

@@ -0,0 +1,20 @@
+import { requireAdminMutation } from "../../../lib/admin-auth";
+import { createOssUploadPolicy } from "../../../lib/oss";
+
+export async function POST(request: Request) {
+  const user = await requireAdminMutation(request);
+  if (user instanceof Response) return user;
+
+  try {
+    const payload = (await request.json()) as { name?: unknown; type?: unknown; size?: unknown };
+    if (typeof payload.name !== "string" || typeof payload.type !== "string" || typeof payload.size !== "number") {
+      return Response.json({ error: "附件元数据不完整。" }, { status: 400 });
+    }
+    return Response.json(await createOssUploadPolicy({ name: payload.name, type: payload.type, size: payload.size }));
+  } catch (error) {
+    return Response.json(
+      { error: error instanceof Error ? error.message : "附件上传失败。" },
+      { status: 503 },
+    );
+  }
+}

package/app/api/auth/github/callback/route.ts

@@ -0,0 +1,136 @@
+import {
+  createAdminSession,
+  isGitHubLoginAllowed,
+  isGitHubOAuthConfigured,
+  sessionCookie,
+} from "../../../../lib/admin-auth";
+
+const STATE_COOKIE = "hedon_github_oauth_state";
+
+function cookieValue(request: Request, name: string) {
+  return request.headers
+    .get("cookie")
+    ?.split(";")
+    .map((part) => part.trim().split("="))
+    .find(([key]) => key === name)
+    ?.slice(1)
+    .join("=");
+}
+
+function redirectToAdmin(request: Request, reason: string) {
+  const target = new URL("/admin", request.url);
+  target.searchParams.set("auth", reason);
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: target.toString(),
+      "Set-Cookie": `${STATE_COOKIE}=; Path=/api/auth/github; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
+    },
+  });
+}
+
+function deniedRedirect(request: Request, login: string) {
+  const target = new URL("/admin", request.url);
+  target.searchParams.set("auth", "denied");
+  // This is only reflected to the person who just completed GitHub OAuth. It
+  // makes an allow-list mismatch actionable without exposing tokens or secrets.
+  target.searchParams.set("account", login);
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: target.toString(),
+      "Set-Cookie": `${STATE_COOKIE}=; Path=/api/auth/github; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
+    },
+  });
+}
+
+export async function GET(request: Request) {
+  const url = new URL(request.url);
+  const code = url.searchParams.get("code");
+  const state = url.searchParams.get("state");
+  if (!isGitHubOAuthConfigured()) {
+    console.error("GitHub OAuth callback failed", { stage: "configuration" });
+    return redirectToAdmin(request, "failed");
+  }
+  if (!code || !state) {
+    console.error("GitHub OAuth callback failed", { stage: "parameters" });
+    return redirectToAdmin(request, "failed");
+  }
+  if (state !== cookieValue(request, STATE_COOKIE)) {
+    console.error("GitHub OAuth callback failed", { stage: "state" });
+    return redirectToAdmin(request, "failed");
+  }
+
+  let stage = "token";
+  try {
+    // GitHub's OAuth endpoint formally accepts an URL-encoded POST body.
+    // Keep provider failures inside this boundary so a rejected/expired code
+    // sends the reader back to the sign-in page instead of producing a 500.
+    const tokenResponse = await fetch("https://github.com/login/oauth/access_token", {
+      method: "POST",
+      headers: {
+        Accept: "application/json",
+        "Content-Type": "application/x-www-form-urlencoded",
+      },
+      body: new URLSearchParams({
+        client_id: process.env.GITHUB_OAUTH_CLIENT_ID ?? "",
+        client_secret: process.env.GITHUB_OAUTH_CLIENT_SECRET ?? "",
+        code,
+      }),
+    });
+    const token = (await tokenResponse.json().catch(() => null)) as {
+      access_token?: string;
+    } | null;
+    if (!tokenResponse.ok || !token?.access_token) {
+      console.error("GitHub OAuth callback failed", { stage });
+      return redirectToAdmin(request, "failed");
+    }
+
+    stage = "profile";
+    const profileResponse = await fetch("https://api.github.com/user", {
+      headers: {
+        Accept: "application/vnd.github+json",
+        Authorization: `Bearer ${token.access_token}`,
+        "User-Agent": "Markdown-Blog-Admin",
+        "X-GitHub-Api-Version": "2022-11-28",
+      },
+    });
+    const profile = (await profileResponse.json().catch(() => null)) as {
+      login?: string;
+      avatar_url?: string;
+    } | null;
+    if (!profileResponse.ok || !profile?.login) {
+      console.error("GitHub OAuth callback failed", { stage });
+      return redirectToAdmin(request, "failed");
+    }
+
+    const login = profile.login.trim();
+    if (!isGitHubLoginAllowed(login)) return deniedRedirect(request, login);
+
+    stage = "session";
+    const session = await createAdminSession({
+      login,
+      avatarUrl: profile.avatar_url ?? `https://github.com/${encodeURIComponent(login)}.png?size=96`,
+    });
+    if (!session) {
+      console.error("GitHub OAuth callback failed", { stage });
+      return redirectToAdmin(request, "failed");
+    }
+    const headers = new Headers({ Location: new URL("/admin", request.url).toString() });
+    headers.append("Set-Cookie", sessionCookie(session));
+    headers.append(
+      "Set-Cookie",
+      `${STATE_COOKIE}=; Path=/api/auth/github; HttpOnly; Secure; SameSite=Lax; Max-Age=0`,
+    );
+    return new Response(null, {
+      status: 302,
+      headers,
+    });
+  } catch (error) {
+    console.error("GitHub OAuth callback failed", {
+      stage,
+      message: error instanceof Error ? error.message : "unknown error",
+    });
+    return redirectToAdmin(request, "failed");
+  }
+}

package/app/api/auth/github/route.ts

@@ -0,0 +1,29 @@
+import { isGitHubOAuthConfigured } from "../../../lib/admin-auth";
+
+const STATE_COOKIE = "hedon_github_oauth_state";
+
+function redirectUri(request: Request) {
+  return process.env.GITHUB_OAUTH_REDIRECT_URI ?? `${new URL(request.url).origin}/api/auth/github/callback`;
+}
+
+export async function GET(request: Request) {
+  if (!isGitHubOAuthConfigured()) {
+    return Response.json(
+      { error: "GitHub OAuth 尚未配置。" },
+      { status: 503 },
+    );
+  }
+  const state = crypto.randomUUID();
+  const authorizeUrl = new URL("https://github.com/login/oauth/authorize");
+  authorizeUrl.searchParams.set("client_id", process.env.GITHUB_OAUTH_CLIENT_ID!);
+  authorizeUrl.searchParams.set("redirect_uri", redirectUri(request));
+  authorizeUrl.searchParams.set("scope", "read:user");
+  authorizeUrl.searchParams.set("state", state);
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: authorizeUrl.toString(),
+      "Set-Cookie": `${STATE_COOKIE}=${state}; Path=/api/auth/github; HttpOnly; Secure; SameSite=Lax; Max-Age=600`,
+    },
+  });
+}

package/app/api/auth/logout/route.ts

@@ -0,0 +1,13 @@
+import { clearSessionCookie, requireAdminMutation } from "../../../lib/admin-auth";
+
+export async function POST(request: Request) {
+  const user = await requireAdminMutation(request);
+  if (user instanceof Response) return user;
+  return new Response(null, {
+    status: 302,
+    headers: {
+      Location: new URL("/admin", request.url).toString(),
+      "Set-Cookie": clearSessionCookie(),
+    },
+  });
+}

package/app/blog/[...path]/page.tsx

@@ -0,0 +1,135 @@
+import Link from "next/link";
+import type { Metadata } from "next";
+import { notFound } from "next/navigation";
+import {
+  extractHeadings,
+  estimateWordCount,
+  findPost,
+  formatDate,
+  postHref,
+  posts,
+} from "../../lib/content";
+import { MarkdownArticle } from "../../components/MarkdownArticle";
+import { TableOfContents } from "../../components/TableOfContents";
+import { Comments } from "../../components/Comments";
+import { Webmentions } from "../../components/Webmentions";
+import {
+  absoluteUrl,
+  getSiteUrl,
+  webmentionApiEndpoint,
+} from "../../lib/site";
+import { githubUrl, siteConfig } from "../../site.config";
+
+export function generateStaticParams() {
+  return posts.map((post) => ({ path: post.path.split("/") }));
+}
+
+export async function generateMetadata({
+  params,
+}: {
+  params: Promise<{ path: string[] }>;
+}) {
+  const { path } = await params;
+  const post = findPost(path.join("/"));
+  if (!post) return {};
+  const baseUrl = await getSiteUrl();
+  const pathname = postHref(post);
+  return {
+    title: post.title,
+    description: post.description,
+    alternates: { canonical: pathname },
+    openGraph: {
+      type: "article",
+      url: absoluteUrl(pathname, baseUrl),
+      title: post.title,
+      description: post.description,
+      publishedTime: new Date(post.date).toISOString(),
+      modifiedTime: post.updated
+        ? new Date(post.updated).toISOString()
+        : undefined,
+      tags: post.tags,
+      images: post.cover ? [{ url: post.cover, alt: post.coverAlt }] : undefined,
+    },
+    twitter: {
+      card: "summary_large_image",
+      title: post.title,
+      description: post.description,
+      images: post.cover ? [post.cover] : ["/og.png"],
+    },
+  } satisfies Metadata;
+}
+
+export default async function PostPage({
+  params,
+}: {
+  params: Promise<{ path: string[] }>;
+}) {
+  const { path } = await params;
+  const post = findPost(path.join("/"));
+  if (!post) notFound();
+  const headings = extractHeadings(post.content);
+  const baseUrl = await getSiteUrl();
+  const pathname = postHref(post);
+  const canonicalUrl = absoluteUrl(pathname, baseUrl);
+  const wordCount = estimateWordCount(post.content);
+
+  return (
+    <main className="reading-page post-reading-page">
+      <article className="post-article h-entry">
+        <Link className="u-url sr-only" href={pathname}>
+          {post.title} 永久链接
+        </Link>
+        <a
+          className="p-author h-card sr-only"
+          href={githubUrl}
+          rel="author"
+        >
+          {siteConfig.author.name}
+        </a>
+        {post.cover && (
+          <figure className="article-hero article-cover">
+            {/* eslint-disable-next-line @next/next/no-img-element */}
+            <img
+              className="u-photo"
+              src={post.cover}
+              alt={post.coverAlt ?? `${post.title} 封面`}
+            />
+          </figure>
+        )}
+        <header className="article-header article-summary-row">
+          <p className="eyebrow">{post.topic}</p>
+          <h1 className="p-name">{post.title}</h1>
+          <p className="article-deck p-summary">{post.description}</p>
+          <div className="article-meta">
+            <time className="dt-published" dateTime={post.date}>
+              发布于 {formatDate(post.date)}
+            </time>
+            {post.updated && <span>更新于 {formatDate(post.updated)}</span>}
+            <span>{post.readingTime}</span>
+            <span>约 {wordCount.toLocaleString("zh-CN")} 字</span>
+          </div>
+        </header>
+        <div className="article-reading-layout">
+          <div className="article-reading-column">
+            <div className="e-content">
+              <MarkdownArticle content={post.content} />
+            </div>
+            <div className="article-tags">
+              {post.tags?.map((tag) => (
+                <span className="p-category" key={tag}>
+                  #{tag}
+                </span>
+              ))}
+            </div>
+            <Webmentions
+              target={canonicalUrl}
+              endpoint={webmentionApiEndpoint()}
+            />
+            <Comments slug={post.path} />
+          </div>
+          <TableOfContents headings={headings} />
+        </div>
+      </article>
+    </main>
+  );
+}