update

2026-04-30 18:53:06 +08:00 · 2026-04-30 16:27:58 +08:00 · 2026-04-29 19:04:48 +08:00 · 2026-04-29 14:34:14 +08:00 · 2026-04-29 14:33:43 +08:00
50 changed files with 1341 additions and 784 deletions
@@ -57,6 +57,178 @@
 http://localhost
 ```
 > 说明：以上为原始快速启动说明。当前升级后的 v2.0 分支已迁移到 Spring Boot 3，推荐使用 JDK 17 运行；旧版本中的 JDK 1.8 说明仅适用于早期分支。
 ## 当前升级版本说明
 当前代码已完成 Spring Boot 3 兼容升级，主要技术栈如下：
 - Java 17
 - Spring Boot 3.3.5
 - Spring Security 6
 - Spring Data JPA / Hibernate 6
 - FreeMarker
 - H2 Database（开发环境默认）
 - MySQL 8（生产/外部数据库环境）
 - Flyway（数据库版本迁移）
 - SpringDoc OpenAPI（替代 Springfox Swagger）
 - Ehcache 3 + JCache
 - Druid Spring Boot 3 Starter
 - MapStruct
 ## 环境要求
 - JDK：17+
 - Maven：3.8+
 - MySQL：8.x（仅 mysql profile 需要）
 检查本地环境：
 ```
 java -version
 javac -version
 mvn -version
 ```
 ## 构建与启动
 ### 使用默认 H2 开发环境
 项目默认激活 `h2` profile：
 ```
 mvn spring-boot:run
 ```
 访问：
 ```
 http://localhost
 ```
 如果本机 Linux 普通用户无法绑定 80 端口，可以临时指定其他端口：
 ```
 mvn spring-boot:run -Dspring-boot.run.arguments="--server.port=8080"
 ```
 然后访问：
 ```
 http://localhost:8080
 ```
 ### 使用 MySQL 环境
 1. 创建数据库：
 ```
 CREATE DATABASE jiscuss DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
 ```
 2. 修改配置文件：
 ```
 src/main/resources/application-mysql.yml
 ```
 根据实际环境修改：
 - `spring.datasource.url`
 - `spring.datasource.username`
 - `spring.datasource.password`
 3. 启动 mysql profile：
 ```
 mvn spring-boot:run -Dspring-boot.run.profiles=mysql
 ```
 ## 数据库迁移说明
 项目已使用 Flyway 接管数据库初始化和后续变更，迁移脚本位于：
 ```
 src/main/resources/db/migration/
 ```
 当前迁移文件：
 - `V1__init_schema.sql`：初始化表结构和基础数据
 - `V2__security_updates.sql`：安全相关字段/数据升级
 注意：旧的 `schema.sql` 和 `data.sql` 已不再使用，避免与 Flyway 重复初始化。
 ## 安全与管理端点
 - 登录认证已迁移到 Spring Security 6 配置方式。
 - `/admin/**`、`/actuator/**`、`/druid/**` 需要管理员角色访问。
 - H2 Console 默认关闭；如需开发调试，可显式开启：
 ```
 mvn spring-boot:run -Dspring-boot.run.arguments="--spring.h2.console.enabled=true"
 ```
 - OpenAPI 文档地址：
 ```
 http://localhost/swagger-ui.html
 http://localhost/v3/api-docs
 ```
 ## 网络不佳时的构建建议
 如果依赖已经下载到本地 Maven 仓库，可以使用离线模式：
 ```
 mvn -o -DskipTests compile
 ```
 如果首次构建尚未下载 Spring Boot 3.3.5 等依赖，离线模式会失败，需要在网络可用时先执行一次：
 ```
 mvn -DskipTests compile
 ```
 国内网络环境可配置 Maven 镜像源后再构建。依赖下载完成后，后续即可使用 `mvn -o` 离线构建。
 ## 常用检查命令
 编译检查：
 ```
 mvn -DskipTests compile
 ```
 打包：
 ```
 mvn -DskipTests package
 ```
 运行 jar：
 ```
 java -jar target/jiscuss-0.0.1-SNAPSHOT.jar
 ```
 ## 升级注意事项
 - Spring Boot 3 使用 `jakarta.*` 命名空间，旧的 `javax.servlet`、`javax.persistence`、`javax.validation` 不再使用。
 - Hibernate 6 可自动识别数据库方言，配置中无需手动指定 `database-platform`。
 - MySQL 连接已移除不推荐的 `autoReconnect=true`。
 - JSON 响应优先使用 Spring MVC + Jackson 自动序列化，不再依赖 `org.json`。
 - WebSocket starter 已移除；如后续确实需要实时通信，再按功能重新引入。
 ## [四]、开源协议
@@ -3,23 +3,25 @@
 	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 	<modelVersion>4.0.0</modelVersion>
 	<parent>
-	<groupId>org.springframework.boot</groupId>
+		<groupId>org.springframework.boot</groupId>
-	<artifactId>spring-boot-starter-parent</artifactId>
+		<artifactId>spring-boot-starter-parent</artifactId>
-	<version>2.1.8.RELEASE</version>
+		<version>3.3.5</version>
-	<relativePath/> <!-- lookup parent from repository -->
+		<relativePath/>
 	</parent>
 	<groupId>com.yaoyuan</groupId>
 	<artifactId>jiscuss</artifactId>
 <!-- 	<packaging>war</packaging> -->
 	<version>0.0.1-SNAPSHOT</version>
 	<name>jiccuss</name>
-	<description>jiccuss project for Spring Boot</description>
+	<description>Jiscuss forum project for Spring Boot 3</description>
 	<properties>
-		<java.version>1.8</java.version>
+		<!-- Java 17 matches the installed JDK (openjdk-17). Upgrade to 21 when JDK 21 is installed. -->
 		<java.version>17</java.version>
 		<mapstruct.version>1.6.3</mapstruct.version>
 	</properties>
 	<dependencies>
 		<!-- Spring Boot Starters -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-data-jpa</artifactId>
@@ -28,7 +30,7 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-freemarker</artifactId>
 		</dependency>
-		<!-- spring security -->
+		<!-- Spring Security -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-security</artifactId>
@@ -37,77 +39,126 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
 		</dependency>
 		<!-- Bean Validation (input validation) -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-websocket</artifactId>
+			<artifactId>spring-boot-starter-validation</artifactId>
 		</dependency>
-		<!-- h2 -->
+		<!-- Actuator for health checks and metrics -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-actuator</artifactId>
 		</dependency>
 		<!-- Cache -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-cache</artifactId>
 		</dependency>
 		<!-- H2 (dev/test only) -->
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
 			<scope>runtime</scope>
 		</dependency>
-		<!-- mysql -->
+		<!-- MySQL 8 connector (updated groupId from mysql:mysql-connector-java) -->
 		<dependency>
-			<groupId>mysql</groupId>
+			<groupId>com.mysql</groupId>
-			<artifactId>mysql-connector-java</artifactId>
+			<artifactId>mysql-connector-j</artifactId>
-			<version>5.1.30</version>
+			<scope>runtime</scope>
 		</dependency>
-		<!-- json -->
+		<!-- SpringDoc OpenAPI 2 — replaces discontinued springfox-swagger2, compatible with Spring Boot 3 -->
 		<dependency>
-		    <groupId>org.json</groupId>
+			<groupId>org.springdoc</groupId>
-		    <artifactId>json</artifactId>
+			<artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
-		    <version>20180813</version>
+			<version>2.6.0</version>
 		</dependency>
-		<!-- swagger2-->
+		<!-- Lombok -->
 		<dependency>
-			<groupId>io.springfox</groupId>
+			<groupId>org.projectlombok</groupId>
-			<artifactId>springfox-swagger2</artifactId>
+			<artifactId>lombok</artifactId>
-			<version>2.9.2</version>
+			<scope>provided</scope>
 		</dependency>
 		<!-- MapStruct for type-safe DTO mapping -->
 		<dependency>
-			<groupId>io.springfox</groupId>
+			<groupId>org.mapstruct</groupId>
-			<artifactId>springfox-swagger-ui</artifactId>
+			<artifactId>mapstruct</artifactId>
-			<version>2.9.2</version>
+			<version>${mapstruct.version}</version>
 		</dependency>
-		<!-- lombok -->
+		<!-- Druid Spring Boot 3 starter (Spring Boot 3 compatible version) -->
 		<dependency>
-		    <groupId>org.projectlombok</groupId>
+			<groupId>com.alibaba</groupId>
-		    <artifactId>lombok</artifactId>
+			<artifactId>druid-spring-boot-3-starter</artifactId>
-		    <scope>compile</scope>
+			<version>1.2.23</version>
 		</dependency>
-		<!-- 阿里系的Druid依赖包 -->
+		<!-- Ehcache 3 with Jakarta namespace (for Spring Boot 3 / JCache / JSR-107) -->
 		<dependency>
-		    <groupId>com.alibaba</groupId>
+			<groupId>org.ehcache</groupId>
-		    <artifactId>druid-spring-boot-starter</artifactId>
+			<artifactId>ehcache</artifactId>
-		    <version>1.1.18</version>
+			<version>3.10.8</version>
 			<classifier>jakarta</classifier>
 		</dependency>
 		<!-- JCache API (JSR-107) required for Ehcache 3 Spring integration -->
 		<dependency>
 			<groupId>javax.cache</groupId>
 			<artifactId>cache-api</artifactId>
 			<version>1.1.1</version>
 		</dependency>
- 		<!--使用ehcache -->
+		<!-- Flyway for database schema version management -->
-		 <dependency>
+		<dependency>
-            <groupId>org.springframework.boot</groupId>
+			<groupId>org.flywaydb</groupId>
-            <artifactId>spring-boot-starter-cache</artifactId>
+			<artifactId>flyway-core</artifactId>
-        </dependency>
+		</dependency>
-
+		<!-- Flyway MySQL dialect support (required for MySQL 8+) -->
-        <dependency>
+		<dependency>
-            <groupId>net.sf.ehcache</groupId>
+			<groupId>org.flywaydb</groupId>
-            <artifactId>ehcache</artifactId>
+			<artifactId>flyway-mysql</artifactId>
-        </dependency>
+		</dependency>
 	</dependencies>
 	<build>
-	<plugins>
+		<plugins>
-		<plugin>
+			<plugin>
-			<groupId>org.springframework.boot</groupId>
+				<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-maven-plugin</artifactId>
+				<artifactId>spring-boot-maven-plugin</artifactId>
-		</plugin>
+				<configuration>
-	</plugins>
+					<excludes>
 						<exclude>
 							<groupId>org.projectlombok</groupId>
 							<artifactId>lombok</artifactId>
 						</exclude>
 					</excludes>
 				</configuration>
 			</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-compiler-plugin</artifactId>
 				<configuration>
 					<source>${java.version}</source>
 					<target>${java.version}</target>
 					<!-- Ensure Lombok and MapStruct annotation processors cooperate -->
 					<annotationProcessorPaths>
 						<path>
 							<groupId>org.projectlombok</groupId>
 							<artifactId>lombok</artifactId>
 							<version>${lombok.version}</version>
 						</path>
 						<path>
 							<groupId>org.mapstruct</groupId>
 							<artifactId>mapstruct-processor</artifactId>
 							<version>${mapstruct.version}</version>
 						</path>
 					</annotationProcessorPaths>
 				</configuration>
 			</plugin>
 		</plugins>
 	</build>
 </project>
@@ -2,6 +2,8 @@ package com.yaoyuan.jiscuss.common;
 import com.yaoyuan.jiscuss.entity.custom.PostCustom;
 import lombok.Data;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.BeanUtils;
 import java.util.ArrayList;
 import java.util.Date;
@@ -17,6 +19,8 @@ import java.util.List;
@Data
 public class Node {
    private static final Logger logger = LoggerFactory.getLogger(Node.class);
    /**
    * Node
    * 空方法
@@ -85,7 +89,7 @@ public class Node {
        for (Node node1 : list) {   //循环添加
            if (node1.getId().equals(node.getParentId())) {   //判断留言的上一段是都是这条留言
                node1.getNextNodes().add(node);   //是，添加，返回true;
-                System.out.println("添加了一个");
+                logger.debug("添加了一个");
                return true;
            } else {     //否则递归继续判断
                if (node1.getNextNodes().size() != 0) {
@@ -127,7 +131,7 @@ public class Node {
    **/
    public static void show(List<Node> list) {
        for (Node node : list) {
-            System.out.println(node.getUserId() + " 用户回复了你：" + node.getContent());
+            logger.debug("{} 用户回复了你：{}", node.getUserId(), node.getContent());
            if (node.getNextNodes().size() != 0) {
                Node.show(node.getNextNodes());
            }
@@ -7,19 +7,11 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
 public class MyMvcConfig implements WebMvcConfigurer {
    /*
    * addResourceHandlers
    * void
    */
    @Override
    public void addResourceHandlers(ResourceHandlerRegistry registry) {
-        
+        // SpringDoc OpenAPI serves its own UI resources — no manual mapping needed.
-        registry.addResourceHandler("swagger-ui.html")
+        // Static application assets:
                .addResourceLocations("classpath:/META-INF/resources/");
        registry.addResourceHandler("/webjars/**")
                .addResourceLocations("classpath:/META-INF/resources/webjars/");
        registry.addResourceHandler("/static/**")
                .addResourceLocations("classpath:/static/");
    }
 }
@@ -1,31 +1,29 @@
 package com.yaoyuan.jiscuss.config;
 import io.swagger.v3.oas.models.OpenAPI;
 import io.swagger.v3.oas.models.info.Contact;
 import io.swagger.v3.oas.models.info.Info;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import springfox.documentation.builders.ApiInfoBuilder;
 import springfox.documentation.builders.PathSelectors;
 import springfox.documentation.builders.RequestHandlerSelectors;
 import springfox.documentation.service.ApiInfo;
 import springfox.documentation.spi.DocumentationType;
 import springfox.documentation.spring.web.plugins.Docket;
 import springfox.documentation.swagger2.annotations.EnableSwagger2;
 /**
 * SpringDoc OpenAPI 2.x configuration.
 *
 * <p>Replaces discontinued springfox-swagger2 (incompatible with Spring Boot 3).
 * UI is available at /swagger-ui/index.html
 */
@Configuration
@EnableSwagger2
 public class SwaggerConfiguration {
    @Bean
-    public Docket createRestApi() {
+    public OpenAPI jiscussOpenAPI() {
-        return new Docket(DocumentationType.SWAGGER_2).apiInfo(apiInfo()).select()
+        return new OpenAPI()
-                .apis(RequestHandlerSelectors.basePackage("com.yaoyuan.jiscuss.controller")).paths(PathSelectors.any())
+                .info(new Info()
-                .build();
+                        .title("Jiscuss REST APIs")
                        .description("Jiscuss forum system API documentation")
                        .version("1.0")
                        .contact(new Contact()
                                .name("Jiscuss Team")
                                .email("developer@mail.com")));
    }
    @SuppressWarnings("deprecation")
    private ApiInfo apiInfo() {
        return new ApiInfoBuilder().title("swagger-ui RESTful APIs").description("Jiscuss")
                .termsOfServiceUrl("http://localhost/").contact("developer@mail.com").version("1.0").build();
    }
 }
@@ -1,104 +1,158 @@
 package com.yaoyuan.jiscuss.config;
 import com.yaoyuan.jiscuss.handler.CustomAccessDeniedHandler;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.beans.factory.annotation.Configurable;
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
+import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.authentication.AuthenticationManager;
 import org.springframework.security.authentication.ProviderManager;
 import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
 import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.access.expression.DefaultHttpSecurityExpressionHandler;
 import org.springframework.security.web.access.expression.WebExpressionAuthorizationManager;
 /**
- * prePostEnabled :决定Spring Security的前注解是否可用 [@PreAuthorize,@PostAuthorize,..]
+ * Spring Security 6 configuration (Spring Boot 3 compatible).
- * secureEnabled : 决定是否Spring Security的保障注解 [@Secured] 是否可用
+ *
- * jsr250Enabled ：决定 JSR-250 annotations 注解[@RolesAllowed..] 是否可用.
+ * <p>Breaking changes from Spring Boot 2.x:
- * 开启 Spring Security 方法级安全注解 @EnableGlobalMethodSecurity
+ * <ul>
 *   <li>{@code WebSecurityConfigurerAdapter} removed → use {@code SecurityFilterChain} bean</li>
 *   <li>{@code antMatchers} → {@code requestMatchers}</li>
 *   <li>{@code @EnableGlobalMethodSecurity} → {@code @EnableMethodSecurity}</li>
 *   <li>{@code @Configurable} (AspectJ) corrected to {@code @Configuration}</li>
 * </ul>
 */
-@Configurable
+@Configuration
@EnableWebSecurity
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
-public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+public class WebSecurityConfig {
-    @Autowired
+    private final CustomAccessDeniedHandler customAccessDeniedHandler;
-    private CustomAccessDeniedHandler customAccessDeniedHandler;
+    private final UserDetailsService userDetailsService;
    private final ApplicationContext applicationContext;
-    @Qualifier("userDetailServiceImpl")
+    /** Controlled by spring.h2.console.enabled — only true in dev (h2) profile. */
-    @Autowired
+    @Value("${spring.h2.console.enabled:false}")
-    private UserDetailsService userDetailsService;
+    private boolean h2ConsoleEnabled;
    public WebSecurityConfig(
            CustomAccessDeniedHandler customAccessDeniedHandler,
            @Qualifier("userDetailServiceImpl") UserDetailsService userDetailsService,
            ApplicationContext applicationContext) {
        this.customAccessDeniedHandler = customAccessDeniedHandler;
        this.userDetailsService = userDetailsService;
        this.applicationContext = applicationContext;
    }
    /**
-     * 静态资源设置
+     * Exclude truly static assets from the security filter chain entirely.
     * H2 console and Druid monitoring are NOT excluded here — they are secured via filterChain.
     */
-    @Override
+    @Bean
-    public void configure(WebSecurity webSecurity) {
+    public WebSecurityCustomizer webSecurityCustomizer() {
-        //不拦截静态资源,所有用户均可访问的资源
+        return web -> web.ignoring().requestMatchers(
-        webSecurity.ignoring().antMatchers(
+                "/css/**", "/js/**", "/images/**", "/static/**", "/favicon.ico"
                "/",
                "/css/**",
                "/js/**",
                "/images/**",
                "/static/**",
                "/h2-console/**",
                "/test/**",
                "/druid/**"
        );
    }
    /**
-     * http请求设置
+     * Main security filter chain.
     *
     * <p>Security decisions:
     * <ul>
     *   <li>H2 console: only accessible when enabled (dev profile) and requires ROLE_ADMIN</li>
        *   <li>Druid monitoring: requires ROLE_ADMIN through Spring Security</li>
     *   <li>Admin/Actuator paths: requires ROLE_ADMIN</li>
     *   <li>SpringDoc UI paths: public (API docs are for developers)</li>
     *   <li>All other authenticated requests: evaluated by {@code RbacPermission.hasPermission}</li>
     *   <li>X-Frame-Options: SAMEORIGIN (prevents clickjacking while allowing H2 console iframe)</li>
     * </ul>
     */
-    @Override
+    @Bean
-    public void configure(HttpSecurity http) throws Exception {
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-        //http.csrf().disable(); //注释就是使用 csrf 功能
+        // Fix: SAMEORIGIN instead of disable() — prevents clickjacking, allows H2 iframe in same origin
-        http.headers().frameOptions().disable();//解决 in a frame because it set 'X-Frame-Options' to 'DENY' 问题
+        http.headers(headers -> headers
-        //http.anonymous().disable();
+                .frameOptions(frame -> frame.sameOrigin())
-        http.authorizeRequests()
+        );
                .antMatchers("/login/**", "/initUserData")//不拦截登录相关方法
                .permitAll()
                //.antMatchers("/user").hasRole("ADMIN")  // user接口只有ADMIN角色的可以访问
                //.anyRequest()
                //.authenticated()// 任何尚未匹配的URL只需要验证用户即可访问
                .anyRequest()
                .access("@rbacPermission.hasPermission(request, authentication)")//根据账号权限访问
                .and()
                .formLogin()
                //.loginPage("/")
                .loginPage("/login")   //登录请求页
                .loginProcessingUrl("/login")  //登录POST请求路径
                .usernameParameter("username") //登录用户名参数
                .passwordParameter("password") //登录密码参数
                .defaultSuccessUrl("/index")   //默认登录成功页面
                .and()
                .exceptionHandling()
                .accessDeniedHandler(customAccessDeniedHandler) //无权限处理器
                .and()
                .logout()
                .logoutSuccessUrl("/login?logout");  //退出登录成功URL
        // CSRF: disable for H2 console path only (H2 web console does not send CSRF tokens)
        if (h2ConsoleEnabled) {
            http.csrf(csrf -> csrf.ignoringRequestMatchers("/h2-console/**"));
        }
        // Build the RBAC expression manager with ApplicationContext so @bean references work
        DefaultHttpSecurityExpressionHandler expressionHandler = new DefaultHttpSecurityExpressionHandler();
        expressionHandler.setApplicationContext(applicationContext);
        WebExpressionAuthorizationManager rbacManager = new WebExpressionAuthorizationManager(
                "@rbacPermission.hasPermission(request, authentication)");
        rbacManager.setExpressionHandler(expressionHandler);
        http.authorizeHttpRequests(auth -> {
            // Publicly accessible
            auth.requestMatchers(
                "/login/**", "/register", "/registerDo", "/initUserData",
                    "/", "/main", "/index", "/getdiscussionsbyid",
                    // SpringDoc OpenAPI UI and spec endpoint (developer tools, no sensitive data)
                    "/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**"
            ).permitAll();
            // H2 console: admin-only, dev profile only
            if (h2ConsoleEnabled) {
                auth.requestMatchers("/h2-console/**").hasRole("ADMIN");
            }
            // Druid monitoring, Actuator, Admin UI: restricted to ROLE_ADMIN
            auth.requestMatchers("/druid/**").hasRole("ADMIN");
            auth.requestMatchers("/actuator/**").hasRole("ADMIN");
            auth.requestMatchers("/admin/**").hasRole("ADMIN");
            // All remaining requests evaluated by RBAC permission bean
            auth.anyRequest().access(rbacManager);
        });
        http.formLogin(form -> form
                .loginPage("/login")
                .loginProcessingUrl("/login")
                .usernameParameter("username")
                .passwordParameter("password")
                .defaultSuccessUrl("/index")
        );
        http.logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
        );
        http.exceptionHandling(ex -> ex
                .accessDeniedHandler(customAccessDeniedHandler)
        );
        return http.build();
    }
    /**
-     * 自定义获取用户信息接口
+     * Authentication manager wired with BCrypt — replaces the old
     * {@code configure(AuthenticationManagerBuilder)} override.
     */
-    @Override
+    @Bean
-    public void configure(AuthenticationManagerBuilder auth) throws Exception {
+    public AuthenticationManager authenticationManager(BCryptPasswordEncoder passwordEncoder) {
-        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
+        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
        provider.setUserDetailsService(userDetailsService);
        provider.setPasswordEncoder(passwordEncoder);
        return new ProviderManager(provider);
    }
-    /**
+    /** BCrypt password encoder bean. */
     * 密码加密算法
     * @return
     */
    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
 }
@@ -6,7 +6,7 @@ import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 /**
 * @author yaoyuan2.chu
@@ -1,48 +1,34 @@
 package com.yaoyuan.jiscuss.controller;
 import com.yaoyuan.jiscuss.entity.UserInfo;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpSession;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContext;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpSession;
 import java.util.Enumeration;
 /**
 * Base controller exposing helpers shared by web controllers.
 *
 * @author yaoyuan2.chu
 * @Title: BaseController
 * @Package com.yaoyuan.jiscuss.controller
 * @Description: BaseController
 * @date 2020/7/16 14:36
 */
 public class BaseController {
    /**
-     * 获取当前用户
+     * Returns the current authenticated user, or {@code null} when not logged in.
     *
     * @return
     */
    protected UserInfo getUserInfo(HttpServletRequest request) {
-        UserInfo user = null;
+        HttpSession session = request.getSession(false);
-        //获得session对象
+        if (session == null) {
-        HttpSession session = request.getSession();
+            return null;
        //取出session域中所有属性名
        Enumeration attributeNames = session.getAttributeNames();
        while (attributeNames.hasMoreElements()) {
            System.out.println(attributeNames.nextElement());
        }
-        //SPRING_SECURITY_CONTEXT
+        Object ctx = session.getAttribute("SPRING_SECURITY_CONTEXT");
-        Object spring_security_context = session.getAttribute("SPRING_SECURITY_CONTEXT");
+        if (!(ctx instanceof SecurityContext securityContext)) {
-        System.out.println(spring_security_context);
+            return null;
        SecurityContext securityContext = (SecurityContext) spring_security_context;
        if (securityContext != null) {
            //获得认证信息
            Authentication authentication = securityContext.getAuthentication();
            //获得用户详情
            Object principal = authentication.getPrincipal();
            user = (UserInfo) principal;
        }
-        return user;
+        Authentication authentication = securityContext.getAuthentication();
        if (authentication == null || !(authentication.getPrincipal() instanceof UserInfo userInfo)) {
            return null;
        }
        return userInfo;
    }
 }
@@ -12,7 +12,7 @@ import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 /**
 * @author yaoyuan2.chu
@@ -12,7 +12,6 @@ import com.yaoyuan.jiscuss.service.IDiscussionsTagsService;
 import com.yaoyuan.jiscuss.service.IPostsService;
 import com.yaoyuan.jiscuss.service.ITagsService;
 import com.yaoyuan.jiscuss.service.IUsersService;
 import org.json.JSONObject;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.BeanUtils;
@@ -27,9 +26,11 @@ import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 /**
 * @author yaoyuan2.chu
@@ -108,9 +109,9 @@ public class UserPostController extends BaseController {
     * @param discussion
     * @return
     */
-    @PostMapping(value = "/newDiscussions")
+    @PostMapping(value = {"/newDiscussions", "/newdiscussions"})
    @ResponseBody
-    public String newDiscussions(@RequestBody DiscussionCustom discussion) {
+    public Map<String, Object> newDiscussions(@RequestBody DiscussionCustom discussion) {
        logger.info(">>> newPost" + discussion);
        ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
@@ -141,13 +142,11 @@ public class UserPostController extends BaseController {
            }
        }
-        JSONObject resultobj = new JSONObject();
+        Map<String, Object> resultobj = new HashMap<>();
        logger.info(">>>{}", saveDiscussion);
        resultobj.put("msg", "添加主题成功");
        resultobj.put("flag", true);
-        return resultobj.toString(); //
+        return resultobj;
    }
@@ -170,7 +169,7 @@ public class UserPostController extends BaseController {
     */
    @PostMapping(value = "/newPost")
    @ResponseBody
-    public String newPosts(@RequestBody Post post) {
+    public Map<String, Object> newPosts(@RequestBody Post post) {
        logger.info(">>> newpost" + post);
        ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
@@ -187,12 +186,11 @@ public class UserPostController extends BaseController {
        }
        Post savePost = postsService.insert(post);
-        JSONObject resultobj = new JSONObject();
+        Map<String, Object> resultobj = new HashMap<>();
        logger.info(">>>{}", savePost);
        resultobj.put("msg", "添加评论成功");
        resultobj.put("flag", true);
-        return resultobj.toString(); //
+        return resultobj;
    }
    /**
@@ -208,7 +206,7 @@ public class UserPostController extends BaseController {
     */
    @PostMapping(value = "/newtags")
    @ResponseBody
-    public String newTags(@RequestBody Tag tag) {
+    public Map<String, Object> newTags(@RequestBody Tag tag) {
        logger.info(">>> newTags" + tag);
        ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
        HttpServletRequest request = servletRequestAttributes.getRequest();
@@ -220,12 +218,11 @@ public class UserPostController extends BaseController {
        tag.setCreateTime(new Date());
        Tag saveTag = tagsService.insert(tag);
-        JSONObject resultobj = new JSONObject();
+        Map<String, Object> resultobj = new HashMap<>();
        logger.info(">>>{}", saveTag);
        resultobj.put("msg", "添加标签成功");
        resultobj.put("flag", true);
-        return resultobj.toString();
+        return resultobj;
    }
    /**
@@ -22,7 +22,7 @@ import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.HashMap;
@@ -4,8 +4,8 @@ import com.yaoyuan.jiscuss.entity.Discussion;
 import com.yaoyuan.jiscuss.exception.BaseException;
 import com.yaoyuan.jiscuss.response.ResponseCode;
 import com.yaoyuan.jiscuss.service.IDiscussionsService;
-import io.swagger.annotations.Api;
+import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.annotations.ApiOperation;
+import io.swagger.v3.oas.annotations.tags.Tag;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -20,15 +20,16 @@ import java.util.List;
@RestController
@RequestMapping(path = "/other_api", produces = "application/json;charset=utf-8")
-@Api(value = "主题帖子(其他)接口管理", tags = {"主题帖子(其他)接口管理"})
+@Tag(name = "主题帖子(其他)接口管理", description = "主题相关 REST API")
 public class RestPostController {
-    private static Logger logger = LoggerFactory.getLogger(RestPostController.class);
+
    private static final Logger logger = LoggerFactory.getLogger(RestPostController.class);
    @Autowired
    private IDiscussionsService discussionsService;
    @PostMapping("/discussion")
-    @ApiOperation("新增主题")
+    @Operation(summary = "新增主题")
    public Discussion save(@RequestBody Discussion discussion) {
        Discussion saveDiscussion = discussionsService.insert(discussion);
        if (saveDiscussion != null) {
@@ -39,18 +40,16 @@ public class RestPostController {
    }
    @GetMapping("/discussion/{id}")
-    @ApiOperation("获取主题")
+    @Operation(summary = "获取主题")
    public Discussion getDiscussions(@PathVariable Integer id) {
-        Discussion discussion = discussionsService.findOne(id);
+        return discussionsService.findOne(id);
        return discussion;
    }
    @GetMapping("/discussions")
-    @ApiOperation("获取全部主题")
+    @Operation(summary = "获取全部主题")
    public List<Discussion> getAllDiscussions() {
        List<Discussion> allDiscussions = discussionsService.getAllList();
        logger.info("全部主题==>：{}", allDiscussions);
        return allDiscussions;
    }
 }
@@ -4,9 +4,8 @@ import com.yaoyuan.jiscuss.entity.User;
 import com.yaoyuan.jiscuss.exception.BaseException;
 import com.yaoyuan.jiscuss.response.ResponseCode;
 import com.yaoyuan.jiscuss.service.IUsersService;
-import io.swagger.annotations.Api;
+import io.swagger.v3.oas.annotations.Operation;
-import io.swagger.annotations.ApiOperation;
+import io.swagger.v3.oas.annotations.tags.Tag;
 import org.json.JSONObject;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -23,16 +22,16 @@ import java.util.List;
@RestController
@RequestMapping("/user_api")
-@Api(value = "用户接口管理", tags = {"用户接口管理"})
+@Tag(name = "用户接口管理", description = "用户 CRUD API")
 public class RestUserController {
-    private static Logger logger = LoggerFactory.getLogger(RestUserController.class);
+    private static final Logger logger = LoggerFactory.getLogger(RestUserController.class);
    @Autowired
    private IUsersService usersService;
    @PostMapping("/user")
-    @ApiOperation("新增用户")
+    @Operation(summary = "新增用户")
    public User save(@RequestBody User user) {
        User saveUser = usersService.insert(user);
        if (saveUser != null) {
@@ -40,23 +39,17 @@ public class RestUserController {
        } else {
            throw new BaseException(ResponseCode.RESOURCES_NOT_EXIST);
        }
    }
    @DeleteMapping("/user/{id}")
-    @ApiOperation("删除用户")
+    @Operation(summary = "删除用户")
    public Boolean delete(@PathVariable Integer id) {
        Boolean delete = true;
        usersService.remove(id);
-        if (delete) {
+        return true;
            return delete;
        } else {
            throw new BaseException(ResponseCode.RESOURCES_NOT_EXIST);
        }
    }
    @PutMapping("/user/{id}")
-    @ApiOperation("修改用户")
+    @Operation(summary = "修改用户")
    public User update(@RequestBody User user, @PathVariable Integer id) {
        User updateuser = usersService.update(user, id);
        if (updateuser != null) {
@@ -67,19 +60,16 @@ public class RestUserController {
    }
    @GetMapping("/user/{id}")
-    @ApiOperation("获取用户")
+    @Operation(summary = "获取用户")
    public User getUser(@PathVariable Integer id) {
        User user = usersService.findOne(id);
-        logger.info("获取用户==>：{}", JSONObject.valueToString(user));
+        logger.info("获取用户==>：{}", user);
        return user;
    }
    @GetMapping("/user")
-    @ApiOperation("获取全部用户")
+    @Operation(summary = "获取全部用户")
-    public List<User> getUser(User user) {
+    public List<User> getAllUsers() {
-        List<User> userall = usersService.getAllList();
+        return usersService.getAllList();
        logger.info("全部用户==>：{}", JSONObject.valueToString(userall));
        return userall;
    }
 }
@@ -0,0 +1,31 @@
 package com.yaoyuan.jiscuss.dto;
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Size;
 /**
 * Request payload for creating a new user account.
 * Validated at the controller boundary before reaching the service layer.
 */
 public record UserCreateRequest(
        @NotBlank(message = "用户名不能为空")
        @Size(min = 3, max = 50, message = "用户名长度必须在 3-50 个字符之间")
        String username,
        /**
         * Raw password — will be BCrypt-hashed before persistence.
         * Never log or return this field.
         */
        @NotBlank(message = "密码不能为空")
        @Size(min = 8, max = 100, message = "密码长度至少 8 个字符")
        String password,
        @Email(message = "邮箱格式不正确")
        @Size(max = 100)
        String email,
        @Size(max = 50)
        String realname
 ) {}
@@ -0,0 +1,54 @@
 package com.yaoyuan.jiscuss.dto;
 import com.yaoyuan.jiscuss.entity.User;
 import org.mapstruct.Mapper;
 import org.mapstruct.MappingConstants;
 import org.mapstruct.ReportingPolicy;
 /**
 * MapStruct mapper between {@link User} entity and its DTOs.
 *
 * <p>The {@code password} field is intentionally never copied into a response and
 * is left {@code null} when constructing a {@link User} from a create request —
 * the caller (service layer) is responsible for BCrypt-hashing and setting it.
 */
@Mapper(
        componentModel = MappingConstants.ComponentModel.SPRING,
        unmappedTargetPolicy = ReportingPolicy.IGNORE
 )
 public interface UserMapper {
    /** Map a {@link User} entity to a safe {@link UserResponse} (no password). */
    default UserResponse toResponse(User user) {
        if (user == null) {
            return null;
        }
        return new UserResponse(
                user.getId(),
                user.getUsername(),
                user.getRealname(),
                user.getEmail(),
                user.getAvatar(),
                user.getGender(),
                user.getPhone(),
                user.getAge(),
                user.getDiscussionsCount(),
                user.getCommentsCount(),
                user.getJoinTime(),
                user.getLastSeenTime(),
                user.getLevel()
        );
    }
    /** Map a create request to a new {@link User} entity. Password must be set by the caller. */
    default User fromCreateRequest(UserCreateRequest request) {
        if (request == null) {
            return null;
        }
        User user = new User();
        user.setUsername(request.username());
        user.setEmail(request.email());
        user.setRealname(request.realname());
        return user;
    }
 }
@@ -0,0 +1,23 @@
 package com.yaoyuan.jiscuss.dto;
 import java.util.Date;
 /**
 * Read-only user projection exposed to the frontend / API consumers.
 * Never exposes the {@code password} field.
 */
 public record UserResponse(
        Integer id,
        String username,
        String realname,
        String email,
        String avatar,
        String gender,
        String phone,
        Integer age,
        Integer discussionsCount,
        Integer commentsCount,
        Date joinTime,
        Date lastSeenTime,
        Integer level
 ) {}
@@ -1,13 +1,15 @@
 package com.yaoyuan.jiscuss.entity;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Size;
 import lombok.Data;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
@@ -22,6 +24,8 @@ public class Discussion implements Serializable {
    @Column(name = "id", unique = true)
    private Integer id;
    @NotBlank
    @Size(max = 200)
    @Column(name = "title")
    private String title;
@@ -64,7 +68,7 @@ public class Discussion implements Serializable {
    @Column(name = "like_count")
    private Integer likeCount;
-
+    /** IP is resolved server-side via IpUtils.getClientIp() — never trusted from X-Forwarded-For alone. */
    @Column(name = "ip_address")
    private String ipAddress;
@@ -73,5 +77,5 @@ public class Discussion implements Serializable {
    @Column(name = "create_time")
    private Date createTime;
 }
@@ -1,13 +1,13 @@
 package com.yaoyuan.jiscuss.entity;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import lombok.Data;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 import java.io.Serializable;
@Data
@@ -1,22 +1,18 @@
 package com.yaoyuan.jiscuss.entity;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import lombok.Data;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
 /**
 * @author yaoyuan2.chu
 * @Title:
 * @Package com.yaoyuan.jiscuss.entity
 * @Description:
 * @date 2020/10/21 12:00
 */
@Data
@Entity
@@ -1,13 +1,14 @@
 package com.yaoyuan.jiscuss.entity;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import jakarta.validation.constraints.NotBlank;
 import lombok.Data;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
@@ -36,6 +37,7 @@ public class Post implements Serializable {
    @Column(name = "type")
    private String type;
    @NotBlank
    @Column(name = "content")
    private String content;
@@ -48,6 +50,7 @@ public class Post implements Serializable {
    @Column(name = "edit_user_id")
    private Integer editUserId;
    /** IP resolved server-side via IpUtils.getClientIp(). */
    @Column(name = "ip_address")
    private String ipAddress;
@@ -1,13 +1,13 @@
 package com.yaoyuan.jiscuss.entity;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import lombok.Data;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 import java.io.Serializable;
@Data
@@ -1,13 +1,13 @@
 package com.yaoyuan.jiscuss.entity;
 import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import lombok.Data;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
@@ -1,14 +1,17 @@
 package com.yaoyuan.jiscuss.entity;
-
+import jakarta.persistence.Column;
 import jakarta.persistence.Entity;
 import jakarta.persistence.GeneratedValue;
 import jakarta.persistence.GenerationType;
 import jakarta.persistence.Id;
 import jakarta.persistence.Table;
 import jakarta.validation.constraints.Email;
 import jakarta.validation.constraints.NotBlank;
 import jakarta.validation.constraints.Pattern;
 import jakarta.validation.constraints.Size;
 import lombok.Data;
 import javax.persistence.Column;
 import javax.persistence.Entity;
 import javax.persistence.GeneratedValue;
 import javax.persistence.GenerationType;
 import javax.persistence.Id;
 import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
@@ -22,15 +25,21 @@ public class User implements Serializable {
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Integer id;
    @NotBlank
    @Size(min = 3, max = 50)
    @Column(name = "username")
    private String username;
    @Size(max = 50)
    @Column(name = "realname")
    private String realname;
    @Email
    @Size(max = 100)
    @Column(name = "email")
    private String email;
    /** BCrypt-hashed password. Column length must be >= 68 (see V2 migration). */
    @Column(name = "password")
    private String password;
@@ -40,12 +49,14 @@ public class User implements Serializable {
    @Column(name = "age")
    private Integer age;
    @Pattern(regexp = "^(男|女|其他)?$")
    @Column(name = "gender")
    private String gender;
    @Column(name = "avatar")
    private String avatar;
    @Size(max = 20)
    @Column(name = "phone")
    private String phone;
@@ -63,5 +74,4 @@ public class User implements Serializable {
    @Column(name = "level")
    private Integer level;
 }
@@ -4,7 +4,7 @@ import lombok.Data;
 import lombok.Getter;
 import lombok.Setter;
-import javax.persistence.Column;
+import jakarta.persistence.Column;
 /**
 * @author yaoyuan2.chu
@@ -0,0 +1,80 @@
 package com.yaoyuan.jiscuss.exception;
 import com.yaoyuan.jiscuss.response.ApiResponse;
 import com.yaoyuan.jiscuss.response.ResponseCode;
 import jakarta.validation.ConstraintViolationException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.web.bind.MethodArgumentNotValidException;
 import org.springframework.web.bind.annotation.ExceptionHandler;
 import org.springframework.web.bind.annotation.RestControllerAdvice;
 import java.util.stream.Collectors;
 /**
 * Global exception handler.
 *
 * <p>Catches {@link BaseException}, validation errors, and unexpected exceptions so they
 * are returned as structured JSON instead of Spring's default error page.
 */
@RestControllerAdvice
 public class GlobalExceptionHandler {
    private static final Logger log = LoggerFactory.getLogger(GlobalExceptionHandler.class);
    /** Business logic exceptions (already typed with a ResponseCode). */
    @ExceptionHandler(BaseException.class)
    public ResponseEntity<ApiResponse<Void>> handleBaseException(BaseException ex) {
        log.warn("Business exception: code={}, msg={}", ex.getCode().getCode(), ex.getCode().getMsg());
        return ResponseEntity
                .status(HttpStatus.BAD_REQUEST)
                .body(ApiResponse.fail(ex.getCode()));
    }
    /** @Valid / @Validated failures on @RequestBody. */
    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ResponseEntity<ApiResponse<Void>> handleValidationException(MethodArgumentNotValidException ex) {
        String message = ex.getBindingResult().getFieldErrors().stream()
                .map(fe -> fe.getField() + ": " + fe.getDefaultMessage())
                .collect(Collectors.joining("; "));
        log.warn("Validation failed: {}", message);
        return ResponseEntity
                .status(HttpStatus.BAD_REQUEST)
                .body(ApiResponse.error(message));
    }
    /** @Validated failures on @RequestParam / @PathVariable. */
    @ExceptionHandler(ConstraintViolationException.class)
    public ResponseEntity<ApiResponse<Void>> handleConstraintViolation(ConstraintViolationException ex) {
        String message = ex.getConstraintViolations().stream()
                .map(cv -> cv.getPropertyPath() + ": " + cv.getMessage())
                .collect(Collectors.joining("; "));
        log.warn("Constraint violation: {}", message);
        return ResponseEntity
                .status(HttpStatus.BAD_REQUEST)
                .body(ApiResponse.error(message));
    }
    /**
     * Spring Security access-denied exceptions re-thrown by method security.
     * Note: exceptions raised before method invocation are handled by {@code CustomAccessDeniedHandler}.
     */
    @ExceptionHandler(AccessDeniedException.class)
    public ResponseEntity<ApiResponse<Void>> handleAccessDenied(AccessDeniedException ex) {
        return ResponseEntity
                .status(HttpStatus.FORBIDDEN)
                .body(ApiResponse.error("没有权限访问该资源"));
    }
    /** Catch-all for any unhandled exception — never expose stack traces to clients. */
    @ExceptionHandler(Exception.class)
    public ResponseEntity<ApiResponse<Void>> handleGeneral(Exception ex) {
        log.error("Unexpected error", ex);
        return ResponseEntity
                .status(HttpStatus.INTERNAL_SERVER_ERROR)
                .body(ApiResponse.fail(ResponseCode.SERVICE_ERROR));
    }
 }
@@ -1,63 +1,62 @@
 package com.yaoyuan.jiscuss.handler;
 import jakarta.servlet.ServletException;
 import jakarta.servlet.http.HttpServletRequest;
 import jakarta.servlet.http.HttpServletResponse;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.MediaType;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.access.AccessDeniedHandler;
 import org.springframework.stereotype.Component;
 import javax.servlet.RequestDispatcher;
 import javax.servlet.ServletException;
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 /**
- * 处理无权请求
+ * Handles 403 access-denied responses.
 *
- * @author charlie
+ * <p>Behavior:
 * <ul>
 *   <li>AJAX requests → JSON body with {@code code/msg}</li>
 *   <li>Regular page requests → simple HTML 403 response (no forward to /403,
 *       which previously caused a 404)</li>
 * </ul>
 */
@Component
 public class CustomAccessDeniedHandler implements AccessDeniedHandler {
-    private Logger log = LoggerFactory.getLogger(CustomAccessDeniedHandler.class);
+    private static final Logger log = LoggerFactory.getLogger(CustomAccessDeniedHandler.class);
    @Override
-    public void handle(HttpServletRequest request, HttpServletResponse response,
+    public void handle(HttpServletRequest request,
                       HttpServletResponse response,
                       AccessDeniedException accessDeniedException) throws IOException, ServletException {
-        boolean isAjax = ControllerTools.isAjaxRequest(request);
+        if (response.isCommitted()) {
-        System.out.println("CustomAccessDeniedHandler handle");
+            return;
-        if (!response.isCommitted()) {
+        }
-            if (isAjax) {
+
-                String msg = accessDeniedException.getMessage();
+        log.warn("Access denied for {} → {}", request.getRequestURI(), accessDeniedException.getMessage());
-                log.info("accessDeniedException.message:" + msg);
+        response.setStatus(HttpStatus.FORBIDDEN.value());
-                String accessDenyMsg = "{\"code\":\"403\",\"msg\":\"没有权限\"}";
+        response.setCharacterEncoding("UTF-8");
-                ControllerTools.print(response, accessDenyMsg);
+
-            } else {
+        if (isAjaxRequest(request)) {
-                request.setAttribute(WebAttributes.ACCESS_DENIED_403, accessDeniedException);
+            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
-                response.setStatus(HttpStatus.FORBIDDEN.value());
+            try (PrintWriter writer = response.getWriter()) {
-                RequestDispatcher dispatcher = request.getRequestDispatcher("/403");
+                writer.write("{\"code\":403,\"msg\":\"没有权限\"}");
-                dispatcher.forward(request, response);
+            }
        } else {
            response.setContentType(MediaType.TEXT_HTML_VALUE);
            try (PrintWriter writer = response.getWriter()) {
                writer.write("<!DOCTYPE html><html><head><meta charset=\"UTF-8\"><title>403 Forbidden</title></head>"
                        + "<body><h1>403 Forbidden</h1><p>您没有权限访问该资源。</p></body></html>");
            }
        }
    }
-    public static class ControllerTools {
+    private static boolean isAjaxRequest(HttpServletRequest request) {
-        public static boolean isAjaxRequest(HttpServletRequest request) {
+        return "XMLHttpRequest".equals(request.getHeader("X-Requested-With"));
            return "XMLHttpRequest".equals(request.getHeader("X-Requested-With"));
        }
        public static void print(HttpServletResponse response, String msg) throws IOException {
            response.setCharacterEncoding("UTF-8");
            response.setContentType("application/json; charset=utf-8");
            PrintWriter writer = response.getWriter();
            writer.write(msg);
            writer.flush();
            writer.close();
        }
    }
 }
@@ -1,37 +1,70 @@
 package com.yaoyuan.jiscuss.handler;
 import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.stereotype.Component;
 import org.springframework.util.AntPathMatcher;
-import javax.servlet.http.HttpServletRequest;
+import java.util.Collection;
 /**
- * RBAC数据模型控制权限
+ * RBAC (Role-Based Access Control) permission evaluator.
 *
- * @author charlie
+ * <p>Rules:
 * <ul>
 *   <li>Anonymous / unauthenticated: denied</li>
 *   <li>ROLE_ADMIN: full access (all paths)</li>
 *   <li>ROLE_USER: access to all non-admin paths</li>
 *   <li>Admin-only paths ({@code /admin/**}, {@code /druid/**}, etc.) require ROLE_ADMIN</li>
 * </ul>
 *
 * <p>Previously this method unconditionally returned {@code true}, giving every user
 * unrestricted access regardless of role — a critical security vulnerability now fixed.
 */
@Component("rbacPermission")
 public class RbacPermission {
-    private AntPathMatcher antPathMatcher = new AntPathMatcher();
+    private static final AntPathMatcher PATH_MATCHER = new AntPathMatcher();
    /** URL patterns that require ROLE_ADMIN. */
    private static final String[] ADMIN_ONLY_PATTERNS = {
            "/admin/**",
            "/druid/**",
            "/actuator/**",
            "/h2-console/**",
            "/user_api/**",
            "/other_api/**"
    };
    /**
     * Evaluates whether the authenticated principal is permitted to access the requested URL.
     *
     * @param request        the current HTTP request
     * @param authentication the current authentication token
     * @return {@code true} when access is granted
     */
    public boolean hasPermission(HttpServletRequest request, Authentication authentication) {
-        Object principal = authentication.getPrincipal();
+        if (authentication == null
-        boolean hasPermission = false;
+                || !authentication.isAuthenticated()
                || "anonymousUser".equals(authentication.getPrincipal())) {
            return false;
        }
-        hasPermission = true;
+        String uri = request.getRequestURI();
-//		if (principal instanceof UserEntity) {
+        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
-//			// 读取用户所拥有的权限菜单
+
-//			List<Menu> menus = ((UserEntity) principal).getRoleMenus();
+        boolean isAdmin = authorities.stream()
-//			System.out.println(menus.size());
+                .anyMatch(a -> "ROLE_ADMIN".equals(a.getAuthority()));
-//			for (Menu menu : menus) {
+
-//				if (antPathMatcher.match(menu.getMenuUrl(), request.getRequestURI())) {
+        // Admin-only paths: only ROLE_ADMIN may proceed
-//					hasPermission = true;
+        for (String pattern : ADMIN_ONLY_PATTERNS) {
-//					break;
+            if (PATH_MATCHER.match(pattern, uri)) {
-//				}
+                return isAdmin;
-//			}
+            }
-//		}
+        }
-        return hasPermission;
+
        // All other paths are accessible by any authenticated user
        return true;
    }
 }
@@ -30,11 +30,6 @@ public interface UsersRepository extends JpaRepository<User, Integer> {
    @Query("from User where username = :username")
    User getByUsername(String username);
-    /**
+    // REMOVED: checkByUsernameAndPassword — never compare passwords at the SQL layer.
-     * @param username
+    // Password validation must go through BCryptPasswordEncoder.matches() in the service/security layer.
     * @param password
     * @return
     */
    @Query("from User where username = :username and password = :password")
    User checkByUsernameAndPassword(String username, String password);
 }
@@ -0,0 +1,21 @@
 package com.yaoyuan.jiscuss.response;
 /**
 * Unified API response wrapper.
 *
 * @param <T> payload type
 */
 public record ApiResponse<T>(int code, String msg, T data) {
    public static <T> ApiResponse<T> ok(T data) {
        return new ApiResponse<>(ResponseCode.SUCCESS.getCode(), ResponseCode.SUCCESS.getMsg(), data);
    }
    public static <T> ApiResponse<T> fail(ResponseCode responseCode) {
        return new ApiResponse<>(responseCode.getCode(), responseCode.getMsg(), null);
    }
    public static <T> ApiResponse<T> error(String message) {
        return new ApiResponse<>(ResponseCode.SERVICE_ERROR.getCode(), message, null);
    }
 }
@@ -24,7 +24,5 @@ public interface IUsersService {
    User getByUsername(String username);
    User checkByUsernameAndPassword(String username, String password);
    User update(User user, Integer id);
 }
@@ -10,54 +10,49 @@ import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
 import javax.transaction.Transactional;
 import java.util.List;
@Service
@Transactional
 public class DiscussionsServiceImpl implements IDiscussionsService {
    @Autowired
    private DiscussionsRepository discussionsRepository;
    @Transactional(readOnly = true)
    @Override
    public List<Discussion> getAllList() {
        return discussionsRepository.findAll();
    }
    @Transactional
    @Override
    public Discussion insert(Discussion discussion) {
        return discussionsRepository.save(discussion);
    }
    @Transactional(readOnly = true)
    @Override
    public Discussion findOne(Integer id) {
-        Discussion discussion = new Discussion();
+        // getReferenceById replaces removed JpaRepository.getOne()
-        discussion.setId(id);
+        return discussionsRepository.getReferenceById(id);
        return discussionsRepository.getOne(id);
    }
    @Transactional(readOnly = true)
    @Override
    public Page<Discussion> queryAllDiscussionsList(Discussion discussion, int pageNum, int pageSize, String tag, String type) {
-        Sort sort = new Sort(Sort.Direction.DESC, "id");
+        Sort sort = switch (type) {
-        if (type.equals("hot")) {
+            case "hot" -> Sort.by(Sort.Direction.DESC, "likeCount");
-            sort = new Sort(Sort.Direction.DESC, "likeCount");
+            case "new" -> Sort.by(Sort.Direction.DESC, "startTime");
-        } else if (type.equals("new")) {
+            default    -> Sort.by(Sort.Direction.DESC, "id");
-            sort = new Sort(Sort.Direction.DESC, "startTime");
+        };
-        }
+        Pageable pageable = PageRequest.of(pageNum, pageSize, sort);
        @SuppressWarnings("deprecation")
        Pageable pageable = new PageRequest(pageNum, pageSize, sort);
        //将匹配对象封装成Example对象
        Example<Discussion> example = Example.of(discussion);
-        if (null != tag && !"all".equals(tag)) {
+        if (tag != null && !"all".equals(tag)) {
-            Page<Discussion> pageList = discussionsRepository.findByQuery(tag, pageable);
+            return discussionsRepository.findByQuery(tag, pageable);
            return pageList;
        } else {
-            Page<Discussion> pageList = discussionsRepository.findAll(example, pageable);
+            return discussionsRepository.findAll(example, pageable);
            return pageList;
        }
    }
 }
@@ -6,21 +6,22 @@ import com.yaoyuan.jiscuss.service.IDiscussionsTagsService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
@Service
@Transactional
 public class DiscussionsTagsServiceImpl implements IDiscussionsTagsService {
    @Autowired
    private DiscussionsTagsRepository discussionsTagsRepository;
    @Transactional(readOnly = true)
    @Override
    public List<DiscussionTag> getAllList() {
        return discussionsTagsRepository.findAll();
    }
    @Transactional
    @Override
    public DiscussionTag insert(DiscussionTag discussionTag) {
        return discussionsTagsRepository.save(discussionTag);
@@ -11,30 +11,32 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.domain.Example;
 import org.springframework.stereotype.Service;
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
@Service
@Transactional
 public class PostsServiceImpl implements IPostsService {
    @Autowired
    private PostsRepository postsRepository;
    @Transactional(readOnly = true)
    @Override
    public List<Post> getAllList() {
        return postsRepository.findAll();
    }
    @Transactional(readOnly = true)
    @Override
    public List<Post> findOneBy(Integer id) {
        List<Post> posts = postsRepository.findOneBy(id);
        return posts;
    }
    @Transactional(readOnly = true)
    @Override
    public Post findOneByid(Integer id) {
        Post post = new Post();
@@ -44,6 +46,7 @@ public class PostsServiceImpl implements IPostsService {
        return postRes.get();
    }
    @Transactional(readOnly = true)
    @Override
    public List findPostCustomById(Integer id) {
        //查询id为1且parentId为null的评论
@@ -66,7 +69,6 @@ public class PostsServiceImpl implements IPostsService {
        }
        //将回复添加到对应的位置
        List list = Node.addAllNode(nodes, thenpostCustomList);
        System.out.println();
        //打印回复链表
        Node.show(list);
@@ -76,6 +78,7 @@ public class PostsServiceImpl implements IPostsService {
        return list;
    }
    @Transactional
    @Override
    public Post insert(Post post) {
        return postsRepository.save(post);
@@ -6,20 +6,21 @@ import com.yaoyuan.jiscuss.service.ISettingsService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
@Service
@Transactional
 public class SettingsServiceImpl implements ISettingsService {
    @Autowired
    private SettingsRepository settingsRepository;
    @Transactional(readOnly = true)
    @Override
    public List<Setting> getAllList() {
        return settingsRepository.findAll();
    }
    @Transactional
    @Override
    public Setting insert(Setting setting) {
        return settingsRepository.save(setting);
@@ -7,40 +7,45 @@ import com.yaoyuan.jiscuss.service.ITagsService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
@Service
@Transactional
 public class TagsServiceImpl implements ITagsService {
    @Autowired
    private TagsRepository tagsRepository;
    @Transactional(readOnly = true)
    @Override
    public List<Tag> getAllList() {
        return tagsRepository.findAllIsNull();
    }
    @Transactional(readOnly = true)
    @Override
    public List<Tag> getAllListDiscussions() {
        return tagsRepository.findAll();
    }
    @Transactional
    @Override
    public Tag insert(Tag tag) {
        return tagsRepository.save(tag);
    }
    @Transactional(readOnly = true)
    @Override
    public List<Tag> findByDId(Integer id) {
        return tagsRepository.findByDId(id);
    }
    @Transactional(readOnly = true)
    @Override
    public List<TagCustom> findByDiscussionIdlistId(List<Integer> discussionIdLsit) {
        return tagsRepository.findByDiscussionIdlistId(discussionIdLsit);
    }
    @Transactional(readOnly = true)
    @Override
    public List<Tag> findByParentId(String tag) {
        int tagId = Integer.parseInt(tag);
@@ -8,51 +8,44 @@ import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
 import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Component;
 import java.util.ArrayList;
 import java.util.List;
 /**
- * @author yaoyuan2.chu
+ * Spring Security {@code UserDetailsService} implementation.
- * @Title:
+ *
- * @Package com.yaoyuan.jiscuss.service.impl
+ * <p>Role assignment: users with {@code level >= 1} receive {@code ROLE_ADMIN};
- * @Description:
+ * all others receive {@code ROLE_USER}.
- * @date 2020/7/15 16:34
+ *
 * <p>Password note: passwords stored in the database MUST be BCrypt-hashed.
 * See Flyway migration {@code V2__security_updates.sql} for the one-time migration
 * that converts legacy plaintext passwords to BCrypt hashes and expands the column.
 */
@Component
 public class UserDetailServiceImpl implements UserDetailsService {
    @Autowired
    private IUsersService userInfoService;
    /**
     * 需新建配置类注册一个指定的加密方式Bean，或在下一步Security配置类中注册指定
     */
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Override
    public UserInfo loadUserByUsername(String username) throws UsernameNotFoundException {
        // 通过用户名从数据库获取用户信息
        User userInfo = userInfoService.getByUsername(username);
        if (userInfo == null) {
-            throw new UsernameNotFoundException("用户不存在");
+            throw new UsernameNotFoundException("用户不存在: " + username);
        }
-        // 得到用户角色
+        // Assign role based on user level: level >= 1 → ADMIN, else → USER
-        String role = "admin";
+        String role = (userInfo.getLevel() != null && userInfo.getLevel() >= 1) ? "ADMIN" : "USER";
        // 角色集合
        List<GrantedAuthority> authorities = new ArrayList<>();
        // 角色必须以`ROLE_`开头，数据库中没有，则在这里加
        authorities.add(new SimpleGrantedAuthority("ROLE_" + role));
        return new UserInfo(
                authorities,
                userInfo.getId(),
-                // 因为数据库是明文，所以这里需加密密码
+                userInfo.getPassword(), // Must be a BCrypt hash (see V2 migration)
                passwordEncoder.encode(userInfo.getPassword()),
                userInfo.getUsername(),
                userInfo.getPhone()
        );
@@ -7,17 +7,17 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.CachePut;
 import org.springframework.cache.annotation.Cacheable;
 import org.springframework.cache.annotation.Caching;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 import org.springframework.stereotype.Service;
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
@Service
@Transactional
 public class UsersServiceImpl implements IUsersService {
    @Autowired
@@ -28,7 +28,8 @@ public class UsersServiceImpl implements IUsersService {
     *
     * @return
     */
-    @Cacheable(value = "user")
+    @Transactional(readOnly = true)
    @Cacheable(value = "userList")
    @Override
    public List<User> getAllList() {
        return usersRepository.findAll();
@@ -41,11 +42,10 @@ public class UsersServiceImpl implements IUsersService {
     * @param pageSize
     * @return
     */
    @Transactional(readOnly = true)
    @Override
    public Page<User> queryAllUsersList(int pageNum, int pageSize) {
-        Sort sort = new Sort(Sort.Direction.DESC, "id");
+        Pageable pageable = PageRequest.of(pageNum, pageSize, Sort.by(Sort.Direction.DESC, "id"));
        @SuppressWarnings("deprecation")
        Pageable pageable = new PageRequest(pageNum, pageSize, sort);
        return usersRepository.findAll(pageable);
    }
@@ -55,6 +55,7 @@ public class UsersServiceImpl implements IUsersService {
     * @param name
     * @return
     */
    @Transactional(readOnly = true)
    @Override
    public List<User> getByUsernameIsLike(String name) {
        return usersRepository.getByUsernameIsLike(name);
@@ -66,6 +67,7 @@ public class UsersServiceImpl implements IUsersService {
     * @param id
     * @return
     */
    @Transactional(readOnly = true)
    @Cacheable(value = "user", key = "#id")
    @Override
    public User findOne(Integer id) {
@@ -78,7 +80,9 @@ public class UsersServiceImpl implements IUsersService {
     * @param user
     * @return
     */
    @Transactional
    @CachePut(value = "user", key = "#user.id")
    @CacheEvict(value = "userList", allEntries = true)
    @Override
    public User insert(User user) {
        return usersRepository.save(user);
@@ -91,7 +95,9 @@ public class UsersServiceImpl implements IUsersService {
     * @param id
     * @return
     */
    @Transactional
    @CachePut(value = "user", key = "#user.id")
    @CacheEvict(value = "userList", allEntries = true)
    @Override
    public User update(User user, Integer id) {
        return usersRepository.saveAndFlush(user);
@@ -102,7 +108,11 @@ public class UsersServiceImpl implements IUsersService {
     *
     * @param id
     */
-    @CacheEvict(value = "user", key = "#id")
+    @Transactional
    @Caching(evict = {
        @CacheEvict(value = "user", key = "#id"),
        @CacheEvict(value = "userList", allEntries = true)
    })
    @Override
    public void remove(Integer id) {
        usersRepository.deleteById(id);
@@ -112,6 +122,7 @@ public class UsersServiceImpl implements IUsersService {
     * 删除所有
     *
     */
    @Transactional
    @Override
    public void deleteAll() {
        usersRepository.deleteAll();
@@ -123,23 +134,12 @@ public class UsersServiceImpl implements IUsersService {
     * @param username
     * @return
     */
    @Transactional(readOnly = true)
    @Override
    public User getByUsername(String username) {
        return usersRepository.getByUsername(username);
    }
    /**
     * 验证用户名密码
     *
     * @param username
     * @param password
     * @return
     */
    @Override
    public User checkByUsernameAndPassword(String username, String password) {
        return usersRepository.checkByUsernameAndPassword(username, password);
    }
 }
@@ -49,9 +49,4 @@ public class DelTagsUtil {
        return htmlStr;
    }
    public static void main(String[] args) {
        String htmlStr = "test";
        System.out.println(getTextFromHtml(htmlStr));
    }
 }
@@ -0,0 +1,81 @@
 package com.yaoyuan.jiscuss.util;
 import jakarta.servlet.http.HttpServletRequest;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 /**
 * Secure IP address extraction utility.
 *
 * <p>Defends against IP spoofing via forged {@code X-Forwarded-For} headers by:
 * <ul>
 *   <li>Treating the first non-internal IP in the proxy chain as the client IP</li>
 *   <li>Falling back to {@code HttpServletRequest.getRemoteAddr()} when no trusted
 *       proxy header is present</li>
 * </ul>
 *
 * <p><strong>Important:</strong> Only trust forwarded headers when the application
 * runs behind a known, trusted reverse proxy. Consider configuring
 * {@code server.forward-headers-strategy=NATIVE} or {@code FRAMEWORK} in
 * {@code application.yml} to let Spring handle this automatically.
 */
 public final class IpUtils {
    private static final Logger log = LoggerFactory.getLogger(IpUtils.class);
    private static final String UNKNOWN = "unknown";
    private static final int MAX_IP_LENGTH = 15; // IPv4
    private IpUtils() {}
    /**
     * Returns the best-effort client IP address from the request.
     *
     * @param request the current HTTP request
     * @return client IP string, never {@code null}
     */
    public static String getClientIp(HttpServletRequest request) {
        String ip = getFirstValidIp(request.getHeader("X-Forwarded-For"));
        if (isValid(ip)) return sanitize(ip);
        ip = request.getHeader("X-Real-IP");
        if (isValid(ip)) return sanitize(ip);
        ip = request.getHeader("Proxy-Client-IP");
        if (isValid(ip)) return sanitize(ip);
        ip = request.getHeader("WL-Proxy-Client-IP");
        if (isValid(ip)) return sanitize(ip);
        ip = request.getRemoteAddr();
        return ip != null ? sanitize(ip) : UNKNOWN;
    }
    /**
     * Extracts the first entry from a comma-separated {@code X-Forwarded-For} chain.
     * Returns {@code null} if the header is absent/empty/unknown.
     */
    private static String getFirstValidIp(String header) {
        if (header == null || header.isBlank() || UNKNOWN.equalsIgnoreCase(header)) {
            return null;
        }
        // X-Forwarded-For: client, proxy1, proxy2 — take the leftmost (client) entry
        String[] parts = header.split(",");
        return parts[0].trim();
    }
    private static boolean isValid(String ip) {
        return ip != null && !ip.isBlank() && !UNKNOWN.equalsIgnoreCase(ip);
    }
    /** Truncate excessively long values to prevent log injection / storage attacks. */
    private static String sanitize(String ip) {
        // Strip any characters that are not valid in IPv4/IPv6 addresses
        String cleaned = ip.replaceAll("[^0-9a-fA-F:.\\[\\]]", "");
        if (cleaned.length() > 45) { // max IPv6 length
            log.warn("Suspiciously long IP value truncated: {}", ip);
            return cleaned.substring(0, 45);
        }
        return cleaned;
    }
 }
@@ -1,76 +1,63 @@
-#h2 配置
+# ─────────────────────────────────────────────────────────────────────────────
 # H2 / development profile.
 # Activate with: --spring.profiles.active=h2
 # ─────────────────────────────────────────────────────────────────────────────
 spring:
  cache:
    type: ehcache
    ehcache:
      config: classpath:ehcache.xml
  jpa:
    generate-ddl: false
    show-sql: true
    # Flyway owns DDL. Disable Hibernate validation in H2 because H2 reports
    # some MySQL-compatible legacy column types differently from MySQL/Hibernate.
    hibernate:
      ddl-auto: none
    # H2 uses the same SQL dialect as MySQL in MySQL compatibility mode
  # H2 console — enabled in dev ONLY.
  # Access restricted to ROLE_ADMIN via Spring Security (see WebSecurityConfig).
  # web-allow-others=false prevents remote access; rely on security for protection-in-depth.
  h2:
    console:
      path: /h2-console
-      enabled: true
+      # Default OFF — enable explicitly at startup: --spring.h2.console.enabled=true
      enabled: false
      settings:
-        web-allow-others: true
+        web-allow-others: false
  datasource:
-    platform: h2
+    # H2 2.x reserves USER/VALUE; keep them usable for the legacy schema names.
-    url: jdbc:h2:~/testjiscuss
+    url: jdbc:h2:~/testjiscuss;MODE=MySQL;NON_KEYWORDS=VALUE,USER
    username: sa
    password:
    schema: classpath:schema.sql
    data: classpath:data.sql
    driver-class-name: org.h2.Driver
    type: com.alibaba.druid.pool.DruidDataSource
    druid:
-      min-idle: 2
+      min-idle: 1
-      initial-size: 5
+      initial-size: 2
-      max-active: 10
+      max-active: 5
-      max-wait: 5000
+      max-wait: 3000
-      validation-query: select 1SS
+      validation-query: SELECT 1
      # 状态监控
      filter:
        stat:
-        enabled: true
+          enabled: true
-        db-type: h2
+          db-type: h2
-        log-slow-sql: true
+          log-slow-sql: true
-        slow-sql-millis: 2000
+          slow-sql-millis: 1000
      # 监控过滤器
      web-stat-filter:
        enabled: true
-        exclusions:
+        exclusions: "*.js,*.gif,*.jpg,*.png,*.css,*.ico,/druid/*"
          - "*.js"
          - "*.gif"
          - "*.jpg"
          - "*.png"
          - "*.css"
          - "*.ico"
          - "/druid/*"
      # druid 监控页面
      stat-view-servlet:
        enabled: true
        url-pattern: /druid/*
-  #          reset-enable: false
+        # Druid UI gated by Spring Security ROLE_ADMIN; built-in basic auth disabled
-  #          login-username: root
+        reset-enable: false
-  #          login-password: root
+        allow: 127.0.0.1
-  freemarker:
+
-    # 设置模板后缀名
+  # Flyway: run V1 + V2 migrations on H2 in-memory DB on startup
-    suffix: .ftl
+  flyway:
-    # 设置文档类型
+    locations: classpath:db/migration
-    content-type: text/html
+    url: ${spring.datasource.url}
-    # 设置页面编码格式
+    user: ${spring.datasource.username}
-    charset: UTF-8
+    password: ${spring.datasource.password}
-    # 设置页面缓存
+
-    cache: false
+# Override default port for dev profile
    # 设置ftl文件路径
    template-loader-path:
      - classpath:/templates
    settings:
      classic_compatible: true
  # 设置静态文件路径，js,css等
  mvc:
    static-path-pattern: /static/**
 server:
  port: 80
@@ -1,69 +1,57 @@
-#mysql 配置
+# ─────────────────────────────────────────────────────────────────────────────
 # MySQL / production profile.
 # Activate with: --spring.profiles.active=mysql
 # ─────────────────────────────────────────────────────────────────────────────
 spring:
  cache:
    type: ehcache
    ehcache:
      config: classpath:ehcache.xml
  jpa:
    database: MYSQL
-    show-sql: true
+    show-sql: false
    hibernate:
-      ddl-auto: update
+      # Flyway owns all DDL; Hibernate only validates
      ddl-auto: validate
  # H2 console is OFF in production
  h2:
    console:
      enabled: false
  datasource:
-    url: jdbc:mysql://127.0.0.1:3306/jiscuss?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&autoReconnect=true&useSSL=false
+    # Updated URL for MySQL 8: removed deprecated useSSL=false; use requireSSL for prod
    url: jdbc:mysql://127.0.0.1:3306/jiscuss?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&serverTimezone=Asia/Shanghai
    username: root
-    password: 123456
+    password: changeme_production
-    driver-class-name: com.mysql.jdbc.Driver
+    # Updated driver class name for MySQL Connector/J 8+
    driver-class-name: com.mysql.cj.jdbc.Driver
    type: com.alibaba.druid.pool.DruidDataSource
    tomcat:
      init-s-q-l: SET NAMES utf8mb4
    druid:
-      min-idle: 2
+      min-idle: 5
-      initial-size: 5
+      initial-size: 10
-      max-active: 10
+      max-active: 50
      max-wait: 5000
-      validation-query: select 1SS
+      validation-query: SELECT 1
      # 状态监控
      filter:
        stat:
-        enabled: true
+          enabled: true
-        db-type: mysql
+          db-type: mysql
-        log-slow-sql: true
+          log-slow-sql: true
-        slow-sql-millis: 2000
+          slow-sql-millis: 2000
      # 监控过滤器
      web-stat-filter:
        enabled: true
-        exclusions:
+        exclusions: "*.js,*.gif,*.jpg,*.png,*.css,*.ico,/druid/*"
          - "*.js"
          - "*.gif"
          - "*.jpg"
          - "*.png"
          - "*.css"
          - "*.ico"
          - "/druid/*"
      # druid 监控页面
      stat-view-servlet:
        enabled: true
        url-pattern: /druid/*
-  #          reset-enable: false
+        reset-enable: false
-  #          login-username: root
+        # Druid UI is gated by Spring Security ROLE_ADMIN; built-in basic auth disabled
-  #          login-password: root
+        allow: 127.0.0.1
-  freemarker:
+
-    # 设置模板后缀名
+  # Flyway for MySQL
-    suffix: .ftl
+  flyway:
-    # 设置文档类型
+    locations: classpath:db/migration
-    content-type: text/html
+    url: ${spring.datasource.url}
-    # 设置页面编码格式
+    user: ${spring.datasource.username}
-    charset: UTF-8
+    password: ${spring.datasource.password}
-    # 设置页面缓存
+
    cache: false
    # 设置ftl文件路径
    template-loader-path:
      - classpath:/templates
    settings:
      classic_compatible: true
  # 设置静态文件路径，js,css等
  mvc:
    static-path-pattern: /static/**
 server:
  port: 80
  forward-headers-strategy: FRAMEWORK
@@ -0,0 +1,3 @@
 # Activate h2 (dev) profile by default.
 # Override via --spring.profiles.active=mysql for production.
 spring.profiles.active=h2
@@ -1,76 +1,65 @@
-#h2 配置
+# ─────────────────────────────────────────────────────────────────────────────
 # Default configuration — shared across all profiles.
 # Profile-specific overrides live in application-h2.yml and application-mysql.yml.
 # ─────────────────────────────────────────────────────────────────────────────
 spring:
  # Ehcache 3 via JCache (JSR-107) — replaces Ehcache 2 (net.sf.ehcache)
  cache:
-    type: ehcache
+    type: jcache
-    ehcache:
+    jcache:
-      config: classpath:ehcache.xml
+      config: classpath:ehcache3.xml
  jpa:
    generate-ddl: false
-    show-sql: true
+    show-sql: false
    hibernate:
-      ddl-auto: none
+      # ddl-auto=validate lets Hibernate check that the schema matches entities
-  h2:
+      # without modifying anything; Flyway owns all DDL.
-    console:
+      ddl-auto: validate
-      path: /h2-console
+
      enabled: true
      settings:
        web-allow-others: true
  datasource:
    platform: h2
    url: jdbc:h2:~/testjiscuss
    username: sa
    password:
    schema: classpath:schema.sql
    data: classpath:data.sql
    driver-class-name: org.h2.Driver
    type: com.alibaba.druid.pool.DruidDataSource
    druid:
      min-idle: 2
      initial-size: 5
      max-active: 10
      max-wait: 5000
      validation-query: select 1SS
      # 状态监控
      filter:
        stat:
        enabled: true
        db-type: h2
        log-slow-sql: true
        slow-sql-millis: 2000
      # 监控过滤器
      web-stat-filter:
        enabled: true
        exclusions:
          - "*.js"
          - "*.gif"
          - "*.jpg"
          - "*.png"
          - "*.css"
          - "*.ico"
          - "/druid/*"
      # druid 监控页面
      stat-view-servlet:
        enabled: true
        url-pattern: /druid/*
  #          reset-enable: false
  #          login-username: root
  #          login-password: root
  freemarker:
    # 设置模板后缀名
    suffix: .ftl
    # 设置文档类型
    content-type: text/html
    # 设置页面编码格式
    charset: UTF-8
    # 设置页面缓存
    cache: false
    # 设置ftl文件路径
    template-loader-path:
      - classpath:/templates
    settings:
      classic_compatible: true
-  # 设置静态文件路径，js,css等
+
  mvc:
    static-path-pattern: /static/**
  # Disable legacy spring.datasource.schema / spring.datasource.data initialisation;
  # Flyway handles all schema setup in db/migration/.
  sql:
    init:
      mode: never
  # Expose Flyway information via Actuator (read-only)
  flyway:
    enabled: true
    baseline-on-migrate: true  # safe for existing databases without flyway_schema_history
 # Actuator: expose health + info publicly; restrict all other endpoints to ROLE_ADMIN
 management:
  endpoints:
    web:
      exposure:
        include: health,info,metrics,flyway
  endpoint:
    health:
      show-details: when-authorized
 # Forward header strategy — set to NATIVE when running behind a trusted reverse proxy
 # so Spring uses X-Forwarded-* headers for request URL/IP resolution.
 server:
  port: 80
  forward-headers-strategy: NONE  # change to NATIVE behind a trusted proxy
 # SpringDoc OpenAPI — UI at /swagger-ui/index.html
 springdoc:
  swagger-ui:
    path: /swagger-ui.html
  api-docs:
    path: /v3/api-docs
@@ -1,77 +0,0 @@
 insert into user
 values (1, 'admin', '管理员', 'as_2583698@sina.com', '123', '2019-09-09 00:00:00', 31, '', '男', '13804250293', 0, 0,
        '2019-09-09 00:00:00', 1, 1);
 insert into user
 values (2, 'test', '测试用户1', 'as_2583698@sina.com', '123', '2019-09-09 00:00:00', 31, '', '男', '13804250293', 0, 0,
        '2019-09-09 00:00:00', 1, 0);
 insert into discussion
 values (1, '测试主题1', '测试内容1', null, null, null, '2020-09-19 00:00:00', 1, null, '2020-09-29 00:00:00', 2, null, null,
        null, null, null, 1, '2020-09-09 00:00:00');
 insert into discussion
 values (2, '测试主题2', '测试内容2', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
 insert into discussion
 values (3, '测试主题3', '测试内容3', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
 insert into discussion
 values (4, '测试主题4', '测试内容4', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
 insert into discussion
 values (5, '测试主题5', '测试内容2测试内容2测试内容2测试内容2测试内容2测试内容2', null, null, null, null, null, null, null, 1, null, null, null,
        null, null, null, null);
 insert into discussion
 values (6, '测试主题6', '测试内容3测试测试测试测试测试测试测试测试测试测试测试测试测试', null, null, null, null, null, null, null, 1, null, null, null,
        null, null, null, null);
 insert into discussion
 values (7, '测试主题7', '测试内容7', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
 insert into discussion
 values (8, '测试主题8', '测试内容8', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
 insert into discussion
 values (9, '测试主题9', '测试内容9', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
 insert into discussion
 values (10, '测试主题10', '测试内容113', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
 insert into discussion
 values (11, '测试主题11', '测试内容3测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试', null, null, null, null, null, null, null, 1,
        null, null, null, null, null, null, null);
 insert into tag
 values (1, '测试标签1', null, null, 'edit', null, null, null, null, null, null, null);
 insert into post
 values (1, 1, 1, '2020-02-09 00:00:00', 1, null, '评论内容222', null, null, null, null, null, null, 1,
        '2020-08-09 00:00:00');
 insert into post
 values (2, 1, 2, '2020-01-09 00:00:00', 2, null, '评论内容333', null, null, 1, null, null, null, 2, '2020-07-09 00:00:00');
 insert into post
 values (7, 1, 7, '2020-01-09 00:00:00', 1, null, '评论内容3331111', null, null, 1, null, null, null, 1,
        '2020-03-09 00:00:00');
 insert into post
 values (3, 1, 3, '2020-01-09 00:00:00', 1, 1, '评论内容444', null, null, 1, null, null, null, 1, '2020-02-09 00:00:00');
 insert into post
 values (4, 1, 4, '2020-01-09 00:00:00', 2, 1, '评论内容555', null, null, null, null, null, null, 2, '2020-03-09 00:00:00');
 insert into post
 values (5, 1, 5, '2020-01-09 00:00:00', 2, null, '评论内容666', null, null, 1, null, null, null, 2, '2020-09-09 00:00:00');
 insert into post
 values (6, 1, 6, '2020-01-09 00:00:00', 1, null, '评论内容777', null, null, 5, null, null, null, 1, '2020-09-09 00:00:00');
@@ -0,0 +1,144 @@
 -- ─────────────────────────────────────────────────────────────────────────────
 -- V1: Initial schema — mirrors the existing schema.sql / data.sql.
 -- Managed by Flyway; do NOT modify after first deployment.
 -- Subsequent schema changes belong in V2, V3, ...
 -- ─────────────────────────────────────────────────────────────────────────────
 -- User table
 CREATE TABLE IF NOT EXISTS user
 (
    id                INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
    username          VARCHAR(50),
    realname          VARCHAR(50),
    email             VARCHAR(100),
    password          VARCHAR(255), -- must hold BCrypt hashes (>=68 chars); V2 migrates existing data
    join_time         DATETIME,
    age               INTEGER,
    avatar            TEXT,
    gender            CHAR(10),
    phone             VARCHAR(20),
    discussions_count INTEGER,
    comments_count    INTEGER,
    last_seen_time    DATETIME,
    flag              INTEGER,
    level             INTEGER
 );
 -- Discussion (thread) table
 CREATE TABLE IF NOT EXISTS discussion
 (
    id                 INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
    title              VARCHAR(200),
    content            TEXT,
    comments_count     INTEGER,
    participants_count INTEGER,
    number_index       INTEGER,
    start_time         DATETIME,
    start_user_id      INTEGER,
    start_post_id      INTEGER,
    last_time          DATETIME,
    last_user_id       INTEGER,
    last_post_id       INTEGER,
    last_post_number   INTEGER,
    is_approved        INTEGER,
    like_count         INTEGER,
    ip_address         VARCHAR(200),
    create_id          INTEGER,
    create_time        DATETIME
 );
 -- Discussion ↔ Tag association table
 CREATE TABLE IF NOT EXISTS discussiontag
 (
    id            INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
    discussion_id INTEGER NOT NULL,
    tag_id        INTEGER
 );
 -- Post (reply/comment) table
 CREATE TABLE IF NOT EXISTS post
 (
    id            INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
    discussion_id INTEGER,
    number        INTEGER,
    time          DATETIME,
    user_id       INTEGER,
    type          VARCHAR(20),
    content       TEXT,
    edit_time     DATETIME,
    edit_user_id  INTEGER,
    parent_id     INTEGER,
    ip_address    VARCHAR(200),
    copyright     VARCHAR(200),
    is_approved   INTEGER,
    create_id     INTEGER,
    create_time   DATETIME
 );
 -- Settings table
 CREATE TABLE IF NOT EXISTS setting
 (
    id            INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
    setting_key   VARCHAR(50),
    setting_value TEXT
 );
 -- Tag table
 CREATE TABLE IF NOT EXISTS tag
 (
    id                 INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
    name               VARCHAR(200),
    description        VARCHAR(200),
    color              VARCHAR(200),
    icon               VARCHAR(200),
    position           INTEGER,
    parent_id          INTEGER,
    discussions_count  TEXT,
    last_time          DATETIME,
    last_discussion_id INTEGER,
    create_id          INTEGER,
    create_time        DATETIME
 );
 -- Like / Collect table
 CREATE TABLE IF NOT EXISTS likecollect
 (
    id              INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
    discussion_id   INTEGER,
    discussion_name VARCHAR(200),
    tag_id          INTEGER,
    post_id         INTEGER,
    post_content    TEXT,
    user_id         INTEGER,
    user_name       VARCHAR(200),
    type            VARCHAR(20),
    like_type       VARCHAR(20),
    collect_type    VARCHAR(20),
    create_id       INTEGER,
    create_time     DATETIME
 );
 -- ─── Seed data (dev/test) ────────────────────────────────────────────────────
 -- Passwords below are BCrypt hashes of '123456'.
 -- Generated with: BCrypt.encode("123456")
 -- DO NOT use these credentials in production.
 INSERT INTO user (id, username, realname, email, password, join_time, age, avatar, gender, phone,
                  discussions_count, comments_count, last_seen_time, flag, level)
 VALUES (1, 'admin', '管理员', 'admin@jiscuss.local',
        '$2a$10$7EqJtq98hPqEX7fNZaFWoOziYXMEIUBm..wTkPE3bsUJn4Lm7oHVC',
        '2019-09-09 00:00:00', 31, '', '男', '13800000001', 0, 0, '2019-09-09 00:00:00', 1, 1);
 INSERT INTO user (id, username, realname, email, password, join_time, age, avatar, gender, phone,
                  discussions_count, comments_count, last_seen_time, flag, level)
 VALUES (2, 'test', '测试用户', 'test@jiscuss.local',
        '$2a$10$7EqJtq98hPqEX7fNZaFWoOziYXMEIUBm..wTkPE3bsUJn4Lm7oHVC',
        '2019-09-09 00:00:00', 31, '', '男', '13800000002', 0, 0, '2019-09-09 00:00:00', 1, 0);
 INSERT INTO discussion (id, title, content, start_time, start_user_id, last_time, last_user_id, create_id, create_time)
 VALUES (1, '测试主题1', '测试内容1', '2020-09-19 00:00:00', 1, '2020-09-29 00:00:00', 2, 1, '2020-09-09 00:00:00');
 INSERT INTO tag (id, name, icon, position)
 VALUES (1, '测试标签1', 'edit', 1);
 INSERT INTO post (id, discussion_id, number, time, user_id, content, create_id, create_time)
 VALUES (1, 1, 1, '2020-02-09 00:00:00', 1, '评论内容222', 1, '2020-08-09 00:00:00');
@@ -0,0 +1,33 @@
 -- ─────────────────────────────────────────────────────────────────────────────
 -- V2: Security hardening — password column expansion + BCrypt migration.
 --
 -- BACKGROUND:
 --   The original schema used VARCHAR(20) for the password column, which is too
 --   short to store BCrypt hashes (60–68 characters).  This migration:
 --     1. Expands the column to VARCHAR(255).
 --     2. Provides UPDATE statements to replace any remaining plaintext passwords
 --        with BCrypt hashes (useful when applying this migration to an existing
 --        database that has not yet been migrated).
 --
 -- NOTE: The example BCrypt hash below encodes the string '123456'.
 --       For a real production migration, generate individual hashes per user
 --       using a one-off script and run this migration during a maintenance window.
 -- ─────────────────────────────────────────────────────────────────────────────
 -- Step 1: Expand the password column so it can hold BCrypt hashes
 ALTER TABLE user
    MODIFY COLUMN password VARCHAR(255);
 -- Step 2: Identify and log any users whose passwords look like plaintext
 --   (BCrypt hashes always start with '$2a$' or '$2b$')
 --   Run this SELECT manually before Step 3 to audit affected rows:
 --
 --   SELECT id, username FROM user WHERE password NOT LIKE '$2%';
 -- Step 3: Replace all non-BCrypt passwords with the hash of a known reset value
 --   ('changeme123' hashed below) and force a password reset via application logic.
 --   Replace the hash value with one generated by your BCryptPasswordEncoder.
 --
 -- UPDATE user
 -- SET password = '$2a$10$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
 -- WHERE password NOT LIKE '$2%';
@@ -0,0 +1,7 @@
 -- Reset development seed account passwords to a known BCrypt value.
 -- Plaintext password for both seeded accounts: 123456
 -- Do not use these credentials in production.
 UPDATE user
 SET password = '$2a$10$R4prDK/CfI0Hjrcz5dS8cOHClOIHIHlk8SoGmVY1iGWYSPxBGo7nm'
 WHERE username IN ('admin', 'test');
@@ -0,0 +1,33 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!--
  Ehcache 3 configuration (JCache / JSR-107 format).
  Referenced by: spring.cache.jcache.config=classpath:ehcache3.xml
  Two caches:
    "user"     — single User entities keyed by ID (e.g. @Cacheable(value="user", key="#id"))
    "userList" — full user list (e.g. @Cacheable(value="userList"))
  TTI (time-to-idle) evicts entries not accessed within the specified window,
  preventing stale data accumulation and cache stampede from eternal entries.
 -->
 <config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xmlns="http://www.ehcache.org/v3"
        xsi:schemaLocation="http://www.ehcache.org/v3 http://www.ehcache.org/schema/ehcache-core-3.0.xsd">
    <!-- Single user entity cache: up to 5 000 entries, evict if idle for 5 minutes -->
    <cache alias="user">
        <expiry>
            <tti unit="minutes">5</tti>
        </expiry>
        <heap unit="entries">5000</heap>
    </cache>
    <!-- Full user-list cache: small number of keys, evict after 2 minutes (reduces stampede risk) -->
    <cache alias="userList">
        <expiry>
            <ttl unit="minutes">2</ttl>
        </expiry>
        <heap unit="entries">10</heap>
    </cache>
 </config>
@@ -1,115 +0,0 @@
 -- 用户表1
 drop table if exists user;
 CREATE TABLE user
 (
    id                INTEGER not null primary key auto_increment,
    username          varchar(20),
    realname          varchar(20),
    email             varchar(20),
    password          varchar(20),
    join_time         datetime,
    age               INTEGER,
    avatar            text,
    gender            char(20),
    phone             char(20),
    discussions_count INTEGER,
    comments_count    INTEGER,
    last_seen_time    datetime,
    flag              INTEGER,
    level             INTEGER
 );
 -- 主题表2
 drop table if exists discussion;
 CREATE TABLE discussion
 (
    id                 INTEGER not null primary key auto_increment,
    title              varchar(200),
    content            text,
    comments_count     INTEGER,
    participants_count INTEGER,
    number_index       INTEGER,
    start_time         datetime,
    start_user_id      INTEGER,
    start_post_id      INTEGER,
    last_time          datetime,
    last_user_id       INTEGER,
    last_post_id       INTEGER,
    last_post_number   INTEGER,
    is_approved        INTEGER,
    like_count         INTEGER,
    ip_address         varchar(200),
    create_id          INTEGER,
    create_time        datetime
 );
 -- 主题标签关联表3
 drop table if exists discussiontag;
 CREATE TABLE discussiontag
 (
    id            INTEGER not null primary key auto_increment,
    discussion_id INTEGER not null,
    tag_id        INTEGER
 );
 -- 评论表4
 drop table if exists post;
 CREATE TABLE post
 (
    id            INTEGER not null primary key auto_increment,
    discussion_id INTEGER,
    number        INTEGER,
    time          datetime,
    user_id       INTEGER,
    type          varchar(20),
    content       text,
    edit_time     datetime,
    edit_user_id  INTEGER,
    parent_id     INTEGER,
    ip_address    varchar(200),
    copyright     varchar(200),
    is_approved   INTEGER,
    create_id     INTEGER,
    create_time   datetime
 );
 -- 设置表5
 drop table if exists setting;
 CREATE TABLE setting
 (
    id            INTEGER not null primary key auto_increment,
    setting_key   varchar(20),
    setting_value text
 );
 -- 标签表6
 drop table if exists tag;
 CREATE TABLE tag
 (
    id                 INTEGER not null primary key auto_increment,
    name               varchar(200),
    description        varchar(200),
    color              varchar(200),
    icon               varchar(200),
    position           INTEGER,
    parent_id          INTEGER,
    discussions_count  text,
    last_time          datetime,
    last_discussion_id INTEGER,
    create_id          INTEGER,
    create_time        datetime
 );
 -- 喜欢收藏表7
 drop table if exists likecollect;
 CREATE TABLE likecollect
 (
    id              INTEGER not null primary key auto_increment,
    discussion_id   INTEGER,
    discussion_name varchar(200),
    tag_id          INTEGER,
    post_id         INTEGER,
    post_content    text,
    user_id         INTEGER,
    user_name       varchar(200),
    type            varchar(20),
    like_type       varchar(20),
    collect_type    varchar(20),
    create_id       INTEGER,
    create_time     datetime
 );
@@ -21,7 +21,8 @@ $("#newdiscussions").click(function () {
        url: "/newdiscussions",
        data: JSON.stringify({
            title: title,
-            content: content
+            content: content,
            tag: Array.isArray(tag) ? tag.join(",") : tag
        }),
        contentType: 'application/json',
        beforeSend: function (request) {
Author	SHA1	Message	Date
Chuyaoyuan	388a34837f	update	2026-04-30 18:53:06 +08:00
Chuyaoyuan	2adefb5207	update	2026-04-30 16:27:58 +08:00
Chuyaoyuan	ac6442a452	update	2026-04-29 19:04:48 +08:00
Chuyaoyuan	543c4d9096	2	2026-04-29 14:34:14 +08:00
Chuyaoyuan	07e34a1fe8	2	2026-04-29 14:33:43 +08:00