update admin

Co-authored-by: Copilot <copilot@github.com>

README.md

@@ -57,6 +57,178 @@
 http://localhost
 ```
 
+> 说明：以上为原始快速启动说明。当前升级后的 v2.0 分支已迁移到 Spring Boot 3，推荐使用 JDK 17 运行；旧版本中的 JDK 1.8 说明仅适用于早期分支。
+
+
+## 当前升级版本说明
+
+当前代码已完成 Spring Boot 3 兼容升级，主要技术栈如下：
+
+- Java 17
+- Spring Boot 3.3.5
+- Spring Security 6
+- Spring Data JPA / Hibernate 6
+- FreeMarker
+- H2 Database（开发环境默认）
+- MySQL 8（生产/外部数据库环境）
+- Flyway（数据库版本迁移）
+- SpringDoc OpenAPI（替代 Springfox Swagger）
+- Ehcache 3 + JCache
+- Druid Spring Boot 3 Starter
+- MapStruct
+
+
+## 环境要求
+
+- JDK：17+
+- Maven：3.8+
+- MySQL：8.x（仅 mysql profile 需要）
+
+检查本地环境：
+
+```
+java -version
+javac -version
+mvn -version
+```
+
+
+## 构建与启动
+
+### 使用默认 H2 开发环境
+
+项目默认激活 `h2` profile：
+
+```
+mvn spring-boot:run
+```
+
+访问：
+
+```
+http://localhost
+```
+
+如果本机 Linux 普通用户无法绑定 80 端口，可以临时指定其他端口：
+
+```
+mvn spring-boot:run -Dspring-boot.run.arguments="--server.port=8080"
+```
+
+然后访问：
+
+```
+http://localhost:8080
+```
+
+
+### 使用 MySQL 环境
+
+1. 创建数据库：
+
+```
+CREATE DATABASE jiscuss DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;
+```
+
+2. 修改配置文件：
+
+```
+src/main/resources/application-mysql.yml
+```
+
+根据实际环境修改：
+
+- `spring.datasource.url`
+- `spring.datasource.username`
+- `spring.datasource.password`
+
+3. 启动 mysql profile：
+
+```
+mvn spring-boot:run -Dspring-boot.run.profiles=mysql
+```
+
+
+## 数据库迁移说明
+
+项目已使用 Flyway 接管数据库初始化和后续变更，迁移脚本位于：
+
+```
+src/main/resources/db/migration/
+```
+
+当前迁移文件：
+
+- `V1__init_schema.sql`：初始化表结构和基础数据
+- `V2__security_updates.sql`：安全相关字段/数据升级
+
+注意：旧的 `schema.sql` 和 `data.sql` 已不再使用，避免与 Flyway 重复初始化。
+
+
+## 安全与管理端点
+
+- 登录认证已迁移到 Spring Security 6 配置方式。
+- `/admin/**`、`/actuator/**`、`/druid/**` 需要管理员角色访问。
+- H2 Console 默认关闭；如需开发调试，可显式开启：
+
+```
+mvn spring-boot:run -Dspring-boot.run.arguments="--spring.h2.console.enabled=true"
+```
+
+- OpenAPI 文档地址：
+
+```
+http://localhost/swagger-ui.html
+http://localhost/v3/api-docs
+```
+
+
+## 网络不佳时的构建建议
+
+如果依赖已经下载到本地 Maven 仓库，可以使用离线模式：
+
+```
+mvn -o -DskipTests compile
+```
+
+如果首次构建尚未下载 Spring Boot 3.3.5 等依赖，离线模式会失败，需要在网络可用时先执行一次：
+
+```
+mvn -DskipTests compile
+```
+
+国内网络环境可配置 Maven 镜像源后再构建。依赖下载完成后，后续即可使用 `mvn -o` 离线构建。
+
+
+## 常用检查命令
+
+编译检查：
+
+```
+mvn -DskipTests compile
+```
+
+打包：
+
+```
+mvn -DskipTests package
+```
+
+运行 jar：
+
+```
+java -jar target/jiscuss-0.0.1-SNAPSHOT.jar
+```
+
+
+## 升级注意事项
+
+- Spring Boot 3 使用 `jakarta.*` 命名空间，旧的 `javax.servlet`、`javax.persistence`、`javax.validation` 不再使用。
+- Hibernate 6 可自动识别数据库方言，配置中无需手动指定 `database-platform`。
+- MySQL 连接已移除不推荐的 `autoReconnect=true`。
+- JSON 响应优先使用 Spring MVC + Jackson 自动序列化，不再依赖 `org.json`。
+- WebSocket starter 已移除；如后续确实需要实时通信，再按功能重新引入。
+
 
 ## [四]、开源协议
 

pom.xml

@@ -5,21 +5,23 @@
 	<parent>
 		<groupId>org.springframework.boot</groupId>
 		<artifactId>spring-boot-starter-parent</artifactId>
-	<version>2.1.8.RELEASE</version>
-	<relativePath/> <!-- lookup parent from repository -->
+		<version>3.5.13</version>
+		<relativePath/>
 	</parent>
 	<groupId>com.yaoyuan</groupId>
 	<artifactId>jiscuss</artifactId>
-<!-- 	<packaging>war</packaging> -->
 	<version>0.0.1-SNAPSHOT</version>
 	<name>jiccuss</name>
-	<description>jiccuss project for Spring Boot</description>
+	<description>Jiscuss forum project for Spring Boot 3</description>
 
 	<properties>
-		<java.version>1.8</java.version>
+		<!-- Java 17 matches the installed JDK (openjdk-17). Upgrade to 21 when JDK 21 is installed. -->
+		<java.version>17</java.version>
+		<mapstruct.version>1.6.3</mapstruct.version>
 	</properties>
 
 	<dependencies>
+		<!-- Spring Boot Starters -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-data-jpa</artifactId>
@@ -28,7 +30,7 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-freemarker</artifactId>
 		</dependency>
-		<!-- spring security -->
+		<!-- Spring Security -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-security</artifactId>
@@ -37,67 +39,87 @@
 			<groupId>org.springframework.boot</groupId>
 			<artifactId>spring-boot-starter-web</artifactId>
 		</dependency>
+		<!-- Bean Validation (input validation) -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-websocket</artifactId>
+			<artifactId>spring-boot-starter-validation</artifactId>
 		</dependency>
-		<!-- h2 -->
+		<!-- Actuator for health checks and metrics -->
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-actuator</artifactId>
+		</dependency>
+		<!-- Cache -->
+		<dependency>
+			<groupId>org.springframework.boot</groupId>
+			<artifactId>spring-boot-starter-cache</artifactId>
+		</dependency>
+
+		<!-- H2 (dev/test only) -->
 		<dependency>
 			<groupId>com.h2database</groupId>
 			<artifactId>h2</artifactId>
 			<scope>runtime</scope>
 		</dependency>
 
-		<!-- mysql -->
+		<!-- MySQL 8 connector (updated groupId from mysql:mysql-connector-java) -->
 		<dependency>
-			<groupId>mysql</groupId>
-			<artifactId>mysql-connector-java</artifactId>
-			<version>5.1.30</version>
+			<groupId>com.mysql</groupId>
+			<artifactId>mysql-connector-j</artifactId>
+			<scope>runtime</scope>
 		</dependency>
 
-		<!-- json -->
+		<!-- SpringDoc OpenAPI 2 — replaces discontinued springfox-swagger2, compatible with Spring Boot 3 -->
 		<dependency>
-		    <groupId>org.json</groupId>
-		    <artifactId>json</artifactId>
-		    <version>20180813</version>
+			<groupId>org.springdoc</groupId>
+			<artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
+			<version>2.8.9</version>
 		</dependency>
 
-		<!-- swagger2-->
-		<dependency>
-			<groupId>io.springfox</groupId>
-			<artifactId>springfox-swagger2</artifactId>
-			<version>2.9.2</version>
-		</dependency>
-
-		<dependency>
-			<groupId>io.springfox</groupId>
-			<artifactId>springfox-swagger-ui</artifactId>
-			<version>2.9.2</version>
-		</dependency>
-
-		<!-- lombok -->
+		<!-- Lombok -->
 		<dependency>
 			<groupId>org.projectlombok</groupId>
 			<artifactId>lombok</artifactId>
-		    <scope>compile</scope>
+			<scope>provided</scope>
 		</dependency>
 
-		<!-- 阿里系的Druid依赖包 -->
+		<!-- MapStruct for type-safe DTO mapping -->
+		<dependency>
+			<groupId>org.mapstruct</groupId>
+			<artifactId>mapstruct</artifactId>
+			<version>${mapstruct.version}</version>
+		</dependency>
+
+		<!-- Druid Spring Boot 3 starter (Spring Boot 3 compatible version) -->
 		<dependency>
 			<groupId>com.alibaba</groupId>
-		    <artifactId>druid-spring-boot-starter</artifactId>
-		    <version>1.1.18</version>
+			<artifactId>druid-spring-boot-3-starter</artifactId>
+			<version>1.2.23</version>
 		</dependency>
 
- 		<!--使用ehcache -->
+		<!-- Ehcache 3 with Jakarta namespace (for Spring Boot 3 / JCache / JSR-107) -->
 		<dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-cache</artifactId>
-        </dependency>
-
-        <dependency>
-            <groupId>net.sf.ehcache</groupId>
+			<groupId>org.ehcache</groupId>
 			<artifactId>ehcache</artifactId>
+			<version>3.10.8</version>
+			<classifier>jakarta</classifier>
+		</dependency>
+		<!-- JCache API (JSR-107) required for Ehcache 3 Spring integration -->
+		<dependency>
+			<groupId>javax.cache</groupId>
+			<artifactId>cache-api</artifactId>
+			<version>1.1.1</version>
+		</dependency>
+
+		<!-- Flyway for database schema version management -->
+		<dependency>
+			<groupId>org.flywaydb</groupId>
+			<artifactId>flyway-core</artifactId>
+		</dependency>
+		<!-- Flyway MySQL dialect support (required for MySQL 8+) -->
+		<dependency>
+			<groupId>org.flywaydb</groupId>
+			<artifactId>flyway-mysql</artifactId>
 		</dependency>
 	</dependencies>
 
@@ -106,6 +128,35 @@
 			<plugin>
 				<groupId>org.springframework.boot</groupId>
 				<artifactId>spring-boot-maven-plugin</artifactId>
+				<configuration>
+					<excludes>
+						<exclude>
+							<groupId>org.projectlombok</groupId>
+							<artifactId>lombok</artifactId>
+						</exclude>
+					</excludes>
+				</configuration>
+			</plugin>
+			<plugin>
+				<groupId>org.apache.maven.plugins</groupId>
+				<artifactId>maven-compiler-plugin</artifactId>
+				<configuration>
+					<source>${java.version}</source>
+					<target>${java.version}</target>
+					<!-- Ensure Lombok and MapStruct annotation processors cooperate -->
+					<annotationProcessorPaths>
+						<path>
+							<groupId>org.projectlombok</groupId>
+							<artifactId>lombok</artifactId>
+							<version>${lombok.version}</version>
+						</path>
+						<path>
+							<groupId>org.mapstruct</groupId>
+							<artifactId>mapstruct-processor</artifactId>
+							<version>${mapstruct.version}</version>
+						</path>
+					</annotationProcessorPaths>
+				</configuration>
 			</plugin>
 		</plugins>
 	</build>

src/main/java/com/yaoyuan/jiscuss/common/Node.java

@@ -2,6 +2,8 @@ package com.yaoyuan.jiscuss.common;
 
 import com.yaoyuan.jiscuss.entity.custom.PostCustom;
 import lombok.Data;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.BeanUtils;
 import java.util.ArrayList;
 import java.util.Date;
@@ -17,6 +19,8 @@ import java.util.List;
 @Data
 public class Node {
 
+    private static final Logger logger = LoggerFactory.getLogger(Node.class);
+
     /**
     * Node
     * 空方法
@@ -85,7 +89,7 @@ public class Node {
         for (Node node1 : list) {   //循环添加
             if (node1.getId().equals(node.getParentId())) {   //判断留言的上一段是都是这条留言
                 node1.getNextNodes().add(node);   //是，添加，返回true;
-                System.out.println("添加了一个");
+                logger.debug("添加了一个");
                 return true;
             } else {     //否则递归继续判断
                 if (node1.getNextNodes().size() != 0) {
@@ -127,7 +131,7 @@ public class Node {
     **/
     public static void show(List<Node> list) {
         for (Node node : list) {
-            System.out.println(node.getUserId() + " 用户回复了你：" + node.getContent());
+            logger.debug("{} 用户回复了你：{}", node.getUserId(), node.getContent());
             if (node.getNextNodes().size() != 0) {
                 Node.show(node.getNextNodes());
             }

src/main/java/com/yaoyuan/jiscuss/config/MyMvcConfig.java

@@ -7,19 +7,11 @@ import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 @Configuration
 public class MyMvcConfig implements WebMvcConfigurer {
 
-    /*
-    * addResourceHandlers
-    * void
-    */
     @Override
     public void addResourceHandlers(ResourceHandlerRegistry registry) {
-        
-        registry.addResourceHandler("swagger-ui.html")
-                .addResourceLocations("classpath:/META-INF/resources/");
-        registry.addResourceHandler("/webjars/**")
-                .addResourceLocations("classpath:/META-INF/resources/webjars/");
+        // SpringDoc OpenAPI serves its own UI resources — no manual mapping needed.
+        // Static application assets:
         registry.addResourceHandler("/static/**")
                 .addResourceLocations("classpath:/static/");
     }
-
 }

src/main/java/com/yaoyuan/jiscuss/config/SwaggerConfiguration.java

@@ -1,31 +1,29 @@
 package com.yaoyuan.jiscuss.config;
 
+import io.swagger.v3.oas.models.OpenAPI;
+import io.swagger.v3.oas.models.info.Contact;
+import io.swagger.v3.oas.models.info.Info;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
-import springfox.documentation.builders.ApiInfoBuilder;
-import springfox.documentation.builders.PathSelectors;
-import springfox.documentation.builders.RequestHandlerSelectors;
-import springfox.documentation.service.ApiInfo;
-import springfox.documentation.spi.DocumentationType;
-import springfox.documentation.spring.web.plugins.Docket;
-import springfox.documentation.swagger2.annotations.EnableSwagger2;
 
+/**
+ * SpringDoc OpenAPI 2.x configuration.
+ *
+ * <p>Replaces discontinued springfox-swagger2 (incompatible with Spring Boot 3).
+ * UI is available at /swagger-ui/index.html
+ */
 @Configuration
-@EnableSwagger2
 public class SwaggerConfiguration {
 
     @Bean
-    public Docket createRestApi() {
-        return new Docket(DocumentationType.SWAGGER_2).apiInfo(apiInfo()).select()
-                .apis(RequestHandlerSelectors.basePackage("com.yaoyuan.jiscuss.controller")).paths(PathSelectors.any())
-                .build();
+    public OpenAPI jiscussOpenAPI() {
+        return new OpenAPI()
+                .info(new Info()
+                        .title("Jiscuss REST APIs")
+                        .description("Jiscuss forum system API documentation")
+                        .version("1.0")
+                        .contact(new Contact()
+                                .name("Jiscuss Team")
+                                .email("developer@mail.com")));
     }
-
-    @SuppressWarnings("deprecation")
-    private ApiInfo apiInfo() {
-        return new ApiInfoBuilder().title("swagger-ui RESTful APIs").description("Jiscuss")
-                .termsOfServiceUrl("http://localhost/").contact("developer@mail.com").version("1.0").build();
-    }
-
-
 }

src/main/java/com/yaoyuan/jiscuss/config/WebSecurityConfig.java

@@ -1,104 +1,147 @@
 package com.yaoyuan.jiscuss.config;
 
 import com.yaoyuan.jiscuss.handler.CustomAccessDeniedHandler;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Configurable;
 import org.springframework.beans.factory.annotation.Qualifier;
+import org.springframework.beans.factory.annotation.Value;
+import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
-import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.builders.WebSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.access.expression.DefaultHttpSecurityExpressionHandler;
+import org.springframework.security.web.access.expression.WebExpressionAuthorizationManager;
 
 /**
- * prePostEnabled :决定Spring Security的前注解是否可用 [@PreAuthorize,@PostAuthorize,..]
- * secureEnabled : 决定是否Spring Security的保障注解 [@Secured] 是否可用
- * jsr250Enabled ：决定 JSR-250 annotations 注解[@RolesAllowed..] 是否可用.
- * 开启 Spring Security 方法级安全注解 @EnableGlobalMethodSecurity
+ * Spring Security 6 configuration (Spring Boot 3 compatible).
+ *
+ * <p>Breaking changes from Spring Boot 2.x:
+ * <ul>
+ *   <li>{@code WebSecurityConfigurerAdapter} removed → use {@code SecurityFilterChain} bean</li>
+ *   <li>{@code antMatchers} → {@code requestMatchers}</li>
+ *   <li>{@code @EnableGlobalMethodSecurity} → {@code @EnableMethodSecurity}</li>
+ *   <li>{@code @Configurable} (AspectJ) corrected to {@code @Configuration}</li>
+ * </ul>
  */
-@Configurable
+@Configuration
 @EnableWebSecurity
-@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
-public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
+@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
+public class WebSecurityConfig {
 
-    @Autowired
-    private CustomAccessDeniedHandler customAccessDeniedHandler;
+    private final CustomAccessDeniedHandler customAccessDeniedHandler;
+    private final UserDetailsService userDetailsService;
+    private final ApplicationContext applicationContext;
 
-    @Qualifier("userDetailServiceImpl")
-    @Autowired
-    private UserDetailsService userDetailsService;
+    /** Controlled by spring.h2.console.enabled — only true in dev (h2) profile. */
+    @Value("${spring.h2.console.enabled:false}")
+    private boolean h2ConsoleEnabled;
+
+    public WebSecurityConfig(
+            CustomAccessDeniedHandler customAccessDeniedHandler,
+            @Qualifier("userDetailServiceImpl") UserDetailsService userDetailsService,
+            ApplicationContext applicationContext) {
+        this.customAccessDeniedHandler = customAccessDeniedHandler;
+        this.userDetailsService = userDetailsService;
+        this.applicationContext = applicationContext;
+    }
 
     /**
-     * 静态资源设置
+     * Main security filter chain.
+     *
+     * <p>Security decisions:
+     * <ul>
+     *   <li>H2 console: only accessible when enabled (dev profile) and requires ROLE_ADMIN</li>
+        *   <li>Druid monitoring: requires ROLE_ADMIN through Spring Security</li>
+     *   <li>Admin/Actuator paths: requires ROLE_ADMIN</li>
+     *   <li>SpringDoc UI paths: public (API docs are for developers)</li>
+     *   <li>All other authenticated requests: evaluated by {@code RbacPermission.hasPermission}</li>
+     *   <li>X-Frame-Options: SAMEORIGIN (prevents clickjacking while allowing H2 console iframe)</li>
+     * </ul>
      */
-    @Override
-    public void configure(WebSecurity webSecurity) {
-        //不拦截静态资源,所有用户均可访问的资源
-        webSecurity.ignoring().antMatchers(
-                "/",
-                "/css/**",
-                "/js/**",
-                "/images/**",
-                "/static/**",
-                "/h2-console/**",
-                "/test/**",
-                "/druid/**"
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        // Fix: SAMEORIGIN instead of disable() — prevents clickjacking, allows H2 iframe in same origin
+        http.headers(headers -> headers
+                .frameOptions(frame -> frame.sameOrigin())
         );
+
+        // CSRF: disable for H2 console path only (H2 web console does not send CSRF tokens)
+        if (h2ConsoleEnabled) {
+            http.csrf(csrf -> csrf.ignoringRequestMatchers("/h2-console/**"));
+        }
+
+        // Build the RBAC expression manager with ApplicationContext so @bean references work
+        DefaultHttpSecurityExpressionHandler expressionHandler = new DefaultHttpSecurityExpressionHandler();
+        expressionHandler.setApplicationContext(applicationContext);
+        WebExpressionAuthorizationManager rbacManager = new WebExpressionAuthorizationManager(
+                "@rbacPermission.hasPermission(request, authentication)");
+        rbacManager.setExpressionHandler(expressionHandler);
+
+        http.authorizeHttpRequests(auth -> {
+            // Publicly accessible
+            auth.requestMatchers(
+                    "/css/**", "/js/**", "/images/**", "/static/**", "/favicon.ico",
+                    "/login/**", "/register", "/registerDo", "/initUserData",
+                    "/", "/main", "/index", "/getdiscussionsbyid",
+                    // SpringDoc OpenAPI UI and spec endpoint (developer tools, no sensitive data)
+                    "/swagger-ui/**", "/swagger-ui.html", "/v3/api-docs/**"
+            ).permitAll();
+
+            // H2 console: admin-only, dev profile only
+            if (h2ConsoleEnabled) {
+                auth.requestMatchers("/h2-console/**").hasRole("ADMIN");
+            }
+
+            // Druid monitoring, Actuator, Admin UI: restricted to ROLE_ADMIN
+            auth.requestMatchers("/druid/**").hasRole("ADMIN");
+            auth.requestMatchers("/actuator/**").hasRole("ADMIN");
+            auth.requestMatchers("/admin/**").hasRole("ADMIN");
+
+            // All remaining requests evaluated by RBAC permission bean
+            auth.anyRequest().access(rbacManager);
+        });
+
+        http.formLogin(form -> form
+                .loginPage("/login")
+                .loginProcessingUrl("/login")
+                .usernameParameter("username")
+                .passwordParameter("password")
+                .defaultSuccessUrl("/index")
+        );
+
+        http.logout(logout -> logout
+                .logoutSuccessUrl("/login?logout")
+        );
+
+        http.exceptionHandling(ex -> ex
+                .accessDeniedHandler(customAccessDeniedHandler)
+        );
+
+        return http.build();
     }
 
     /**
-     * http请求设置
+     * Authentication manager wired with BCrypt — replaces the old
+     * {@code configure(AuthenticationManagerBuilder)} override.
      */
-    @Override
-    public void configure(HttpSecurity http) throws Exception {
-        //http.csrf().disable(); //注释就是使用 csrf 功能
-        http.headers().frameOptions().disable();//解决 in a frame because it set 'X-Frame-Options' to 'DENY' 问题
-        //http.anonymous().disable();
-        http.authorizeRequests()
-                .antMatchers("/login/**", "/initUserData")//不拦截登录相关方法
-                .permitAll()
-                //.antMatchers("/user").hasRole("ADMIN")  // user接口只有ADMIN角色的可以访问
-                //.anyRequest()
-                //.authenticated()// 任何尚未匹配的URL只需要验证用户即可访问
-                .anyRequest()
-                .access("@rbacPermission.hasPermission(request, authentication)")//根据账号权限访问
-                .and()
-                .formLogin()
-                //.loginPage("/")
-                .loginPage("/login")   //登录请求页
-                .loginProcessingUrl("/login")  //登录POST请求路径
-                .usernameParameter("username") //登录用户名参数
-                .passwordParameter("password") //登录密码参数
-                .defaultSuccessUrl("/index")   //默认登录成功页面
-                .and()
-                .exceptionHandling()
-                .accessDeniedHandler(customAccessDeniedHandler) //无权限处理器
-                .and()
-                .logout()
-                .logoutSuccessUrl("/login?logout");  //退出登录成功URL
-
+    @Bean
+    public AuthenticationManager authenticationManager(BCryptPasswordEncoder passwordEncoder) {
+        DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
+        provider.setUserDetailsService(userDetailsService);
+        provider.setPasswordEncoder(passwordEncoder);
+        return new ProviderManager(provider);
     }
 
-    /**
-     * 自定义获取用户信息接口
-     */
-    @Override
-    public void configure(AuthenticationManagerBuilder auth) throws Exception {
-        auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
-    }
-
-    /**
-     * 密码加密算法
-     * @return
-     */
+    /** BCrypt password encoder bean. */
     @Bean
     public BCryptPasswordEncoder passwordEncoder() {
         return new BCryptPasswordEncoder();
-
+    }
 }
 
-}

src/main/java/com/yaoyuan/jiscuss/controller/AdminSystemController.java

@@ -1,42 +1,365 @@
 package com.yaoyuan.jiscuss.controller;
 
+import com.yaoyuan.jiscuss.entity.Discussion;
+import com.yaoyuan.jiscuss.entity.Post;
+import com.yaoyuan.jiscuss.entity.Role;
+import com.yaoyuan.jiscuss.entity.UpgradeLog;
+import com.yaoyuan.jiscuss.entity.User;
 import com.yaoyuan.jiscuss.entity.UserInfo;
+import com.yaoyuan.jiscuss.entity.UserRole;
+import com.yaoyuan.jiscuss.entity.AuditLog;
+import com.yaoyuan.jiscuss.repository.DiscussionsRepository;
+import com.yaoyuan.jiscuss.repository.DiscussionsTagsRepository;
+import com.yaoyuan.jiscuss.repository.PostsRepository;
+import com.yaoyuan.jiscuss.repository.RoleRepository;
+import com.yaoyuan.jiscuss.repository.UpgradeLogRepository;
+import com.yaoyuan.jiscuss.repository.UserRoleRepository;
+import com.yaoyuan.jiscuss.repository.UsersRepository;
+import com.yaoyuan.jiscuss.repository.AuditLogRepository;
+import com.yaoyuan.jiscuss.service.AuditLogService;
+import org.springframework.boot.SpringBootVersion;
+import org.springframework.data.domain.Sort;
 import org.springframework.stereotype.Controller;
+import org.springframework.transaction.annotation.Transactional;
 import org.springframework.ui.ModelMap;
-import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
+
+import java.lang.management.ManagementFactory;
+import java.lang.management.MemoryMXBean;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
 
 /**
  * @author yaoyuan2.chu
  * 后台系统控制器
  */
 @Controller
-public class AdminSystemController {
+public class AdminSystemController extends BaseController {
 
-    /**
-     * 后台登录
-     */
+    private final UsersRepository usersRepository;
+    private final DiscussionsRepository discussionsRepository;
+    private final PostsRepository postsRepository;
+    private final DiscussionsTagsRepository discussionsTagsRepository;
+    private final RoleRepository roleRepository;
+    private final UserRoleRepository userRoleRepository;
+    private final UpgradeLogRepository upgradeLogRepository;
+    private final AuditLogRepository auditLogRepository;
+    private final AuditLogService auditLogService;
 
-    /**
-     * 后台退出
-     */  
-    @RequestMapping("/admin/logout")
-    public String logout(@RequestParam(defaultValue = "discussion") String type, HttpServletRequest request, ModelMap map) {
-        return "admin/logout";
+    public AdminSystemController(
+            UsersRepository usersRepository,
+            DiscussionsRepository discussionsRepository,
+            PostsRepository postsRepository,
+            DiscussionsTagsRepository discussionsTagsRepository,
+            RoleRepository roleRepository,
+            UserRoleRepository userRoleRepository,
+            UpgradeLogRepository upgradeLogRepository,
+            AuditLogRepository auditLogRepository,
+            AuditLogService auditLogService) {
+        this.usersRepository = usersRepository;
+        this.discussionsRepository = discussionsRepository;
+        this.postsRepository = postsRepository;
+        this.discussionsTagsRepository = discussionsTagsRepository;
+        this.roleRepository = roleRepository;
+        this.userRoleRepository = userRoleRepository;
+        this.upgradeLogRepository = upgradeLogRepository;
+        this.auditLogRepository = auditLogRepository;
+        this.auditLogService = auditLogService;
     }
 
-    /**
-     * 后台设置管理
-     */
+    @GetMapping("/admin/home")
+    public String home(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "home");
+
+        map.put("userCount", usersRepository.count());
+        map.put("discussionCount", discussionsRepository.count());
+        map.put("postCount", postsRepository.count());
+        map.put("roleCount", roleRepository.count());
+
+        map.put("sys", buildSystemMetrics());
+        map.put("deps", buildDependencyVersions());
 
-    /**
-     * 后台页面
-     * @return
-     */
-    @RequestMapping("/admin/home")
-    public String home(@RequestParam(defaultValue = "discussion") String type, HttpServletRequest request, ModelMap map) {
         return "admin/home";
     }
+
+    @GetMapping("/admin/users")
+    public String users(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "users");
+
+        List<User> users = usersRepository.findAll(Sort.by(Sort.Direction.ASC, "id"));
+        List<Role> roles = roleRepository.findAllByOrderByIdAsc();
+        Map<Integer, Set<Integer>> userRoleIds = new HashMap<>();
+        for (UserRole ur : userRoleRepository.findAll()) {
+            userRoleIds.computeIfAbsent(ur.getUserId(), key -> new HashSet<>()).add(ur.getRoleId());
+        }
+
+        map.put("users", users);
+        map.put("roles", roles);
+        map.put("userRoleIds", userRoleIds);
+        return "admin/users";
+    }
+
+    @PostMapping("/admin/users/{id}/roles")
+    @Transactional
+    public String updateUserRoles(HttpServletRequest request,
+                                  @PathVariable("id") Integer id,
+                                  @RequestParam(value = "roleIds", required = false) List<Integer> roleIds) {
+        UserInfo currentAdmin = getUserInfo(request);
+        userRoleRepository.deleteByUserId(id);
+        if (roleIds != null) {
+            Date now = new Date();
+            Set<Integer> uniqueRoleIds = new HashSet<>(roleIds);
+            Set<Integer> validEnabledRoleIds = roleRepository.findAllById(uniqueRoleIds).stream()
+                    .filter(role -> role.getEnabled() != null && role.getEnabled() == 1)
+                    .map(Role::getId)
+                    .collect(Collectors.toSet());
+
+            for (Integer roleId : validEnabledRoleIds) {
+                UserRole ur = new UserRole();
+                ur.setUserId(id);
+                ur.setRoleId(roleId);
+                ur.setCreateTime(now);
+                userRoleRepository.save(ur);
+            }
+        }
+        auditLogService.log(currentAdmin, "update_user_roles", "user", id, 
+                "Updated user role assignments. Role count: " + (roleIds == null ? 0 : roleIds.size()));
+        return "redirect:/admin/users";
+    }
+
+    @PostMapping("/admin/roles")
+    public String createRole(HttpServletRequest request,
+                             @RequestParam("code") String code,
+                             @RequestParam("name") String name,
+                             @RequestParam(value = "description", required = false) String description) {
+        UserInfo currentAdmin = getUserInfo(request);
+        String normalizedCode = code == null ? "" : code.trim().toUpperCase();
+        if (normalizedCode.isEmpty()) {
+            return "redirect:/admin/users";
+        }
+
+        Role exists = roleRepository.findByCodeIgnoreCase(normalizedCode);
+        if (exists == null) {
+            Date now = new Date();
+            Role role = new Role();
+            role.setCode(normalizedCode);
+            role.setName(name == null ? "" : name.trim());
+            role.setDescription(description);
+            role.setEnabled(1);
+            role.setCreateTime(now);
+            role.setUpdateTime(now);
+            roleRepository.save(role);
+            auditLogService.log(currentAdmin, "create_role", "role", role.getId(), 
+                    "Created role: " + normalizedCode);
+        } else {
+            auditLogService.log(currentAdmin, "create_role_duplicate", "role", exists.getId(), 
+                    "Attempted to create duplicate role: " + normalizedCode, "ignored");
+        }
+        return "redirect:/admin/users";
+    }
+
+    @PostMapping("/admin/roles/{id}/toggle")
+    public String toggleRole(HttpServletRequest request,
+                             @PathVariable("id") Integer id) {
+        UserInfo currentAdmin = getUserInfo(request);
+        Role role = roleRepository.findById(id).orElse(null);
+        if (role != null) {
+            int nextStatus = role.getEnabled() != null && role.getEnabled() == 1 ? 0 : 1;
+            // Keep built-in ADMIN role enabled to avoid locking out management access.
+            if ("ADMIN".equalsIgnoreCase(role.getCode()) && nextStatus == 0) {
+                auditLogService.log(currentAdmin, "toggle_role_blocked", "role", id, 
+                        "Attempted to disable built-in ADMIN role", "blocked");
+                return "redirect:/admin/users";
+            }
+            role.setEnabled(nextStatus);
+            role.setUpdateTime(new Date());
+            roleRepository.save(role);
+            auditLogService.log(currentAdmin, "toggle_role", "role", id, 
+                    "Toggled role status to " + (nextStatus == 1 ? "enabled" : "disabled"));
+        }
+        return "redirect:/admin/users";
+    }
+
+    @GetMapping("/admin/discussions")
+    public String discussions(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "discussions");
+        List<Discussion> discussions = discussionsRepository.findAll(Sort.by(Sort.Direction.DESC, "createTime"));
+        map.put("discussions", discussions);
+        return "admin/discussions";
+    }
+
+    @PostMapping("/admin/discussions/{id}/delete")
+    @Transactional
+    public String deleteDiscussion(HttpServletRequest request,
+                                   @PathVariable("id") Integer id) {
+        UserInfo currentAdmin = getUserInfo(request);
+        Discussion discussion = discussionsRepository.findById(id).orElse(null);
+        String title = discussion == null ? "unknown" : discussion.getTitle();
+        discussionsTagsRepository.deleteByDiscussionId(id);
+        postsRepository.deleteByDiscussionId(id);
+        discussionsRepository.deleteById(id);
+        auditLogService.log(currentAdmin, "delete_discussion", "discussion", id, 
+                "Deleted discussion: " + title);
+        return "redirect:/admin/discussions";
+    }
+
+    @GetMapping("/admin/posts")
+    public String posts(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "posts");
+        List<Post> posts = postsRepository.findAll(Sort.by(Sort.Direction.DESC, "createTime"));
+        map.put("posts", posts);
+
+        Set<Integer> userIds = posts.stream().map(Post::getCreateId).filter(v -> v != null).collect(Collectors.toSet());
+        Set<Integer> discussionIds = posts.stream().map(Post::getDiscussionId).filter(v -> v != null).collect(Collectors.toSet());
+
+        Map<Integer, String> userNames = usersRepository.findAllById(userIds).stream()
+                .collect(Collectors.toMap(User::getId, User::getUsername));
+        Map<Integer, String> discussionNames = discussionsRepository.findAllById(discussionIds).stream()
+                .collect(Collectors.toMap(Discussion::getId, Discussion::getTitle));
+
+        map.put("userNames", userNames);
+        map.put("discussionNames", discussionNames);
+        return "admin/posts";
+    }
+
+    @PostMapping("/admin/posts/{id}/delete")
+    public String deletePost(HttpServletRequest request,
+                             @PathVariable("id") Integer id) {
+        UserInfo currentAdmin = getUserInfo(request);
+        Post post = postsRepository.findById(id).orElse(null);
+        String content = post == null ? "unknown" : (post.getContent() == null ? "" : post.getContent());
+        if (content.length() > 50) {
+            content = content.substring(0, 50) + "...";
+        }
+        postsRepository.deleteById(id);
+        auditLogService.log(currentAdmin, "delete_post", "post", id, 
+                "Deleted post: " + content);
+        return "redirect:/admin/posts";
+    }
+
+    @GetMapping("/admin/upgrade-logs")
+    public String upgradeLogs(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "upgradeLogs");
+        map.put("logs", upgradeLogRepository.findAllByOrderByCreateTimeDesc());
+        return "admin/upgrade-logs";
+    }
+
+    @PostMapping("/admin/upgrade-logs")
+    public String createUpgradeLog(HttpServletRequest request,
+                                   @RequestParam("version") String version,
+                                   @RequestParam("title") String title,
+                                   @RequestParam(value = "type", defaultValue = "feature") String type,
+                                   @RequestParam("content") String content) {
+        UserInfo user = getUserInfo(request);
+        UpgradeLog log = new UpgradeLog();
+        log.setVersion(version);
+        log.setTitle(title);
+        log.setType(type);
+        log.setContent(content);
+        log.setCreatedBy(user == null ? null : user.getId());
+        log.setCreateTime(new Date());
+        upgradeLogRepository.save(log);
+        auditLogService.log(user, "create_upgrade_log", "upgrade_log", log.getId(), 
+                "Created upgrade log: " + version + " - " + title);
+        return "redirect:/admin/upgrade-logs";
+    }
+
+    @GetMapping("/admin/plugins")
+    public String plugins(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "plugins");
+        return "admin/plugins";
+    }
+
+    @GetMapping("/admin/audit-logs")
+    public String auditLogs(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "auditLogs");
+        List<AuditLog> logs = auditLogRepository.findAllByOrderByCreateTimeDesc();
+        map.put("logs", logs);
+        return "admin/audit-logs";
+    }
+
+    @GetMapping("/admin/themes")
+    public String themes(HttpServletRequest request, ModelMap map) {
+        fillCommon(request, map, "themes");
+        return "admin/themes";
+    }
+
+    private void fillCommon(HttpServletRequest request, ModelMap map, String active) {
+        UserInfo user = getUserInfo(request);
+        map.put("adminName", user == null ? "admin" : user.getUsername());
+        map.put("active", active);
+    }
+
+    private Map<String, Object> buildSystemMetrics() {
+        Map<String, Object> result = new HashMap<>();
+        Runtime rt = Runtime.getRuntime();
+        MemoryMXBean memoryMXBean = ManagementFactory.getMemoryMXBean();
+
+        long totalMb = bytesToMb(rt.totalMemory());
+        long freeMb = bytesToMb(rt.freeMemory());
+        long usedMb = totalMb - freeMb;
+        long maxMb = bytesToMb(rt.maxMemory());
+        long heapUsedMb = bytesToMb(memoryMXBean.getHeapMemoryUsage().getUsed());
+
+        result.put("totalMb", totalMb);
+        result.put("freeMb", freeMb);
+        result.put("usedMb", usedMb);
+        result.put("maxMb", maxMb);
+        result.put("heapUsedMb", heapUsedMb);
+        result.put("uptimeMs", ManagementFactory.getRuntimeMXBean().getUptime());
+        result.put("cpuLoad", readCpuLoadPercent());
+        return result;
+    }
+
+    private Map<String, String> buildDependencyVersions() {
+        Map<String, String> result = new HashMap<>();
+        result.put("springBoot", SpringBootVersion.getVersion());
+        result.put("java", System.getProperty("java.version"));
+        result.put("spring", implVersion("org.springframework.core.SpringVersion"));
+        result.put("hibernate", implVersion("org.hibernate.Version"));
+        result.put("flyway", implVersion("org.flywaydb.core.Flyway"));
+        result.put("druid", implVersion("com.alibaba.druid.pool.DruidDataSource"));
+        result.put("ehcache", implVersion("org.ehcache.CacheManager"));
+        result.put("springdoc", implVersion("org.springdoc.core.configuration.SpringDocConfiguration"));
+        return result;
+    }
+
+    private String implVersion(String className) {
+        try {
+            Class<?> clazz = Class.forName(className);
+            Package pkg = clazz.getPackage();
+            String version = pkg == null ? null : pkg.getImplementationVersion();
+            return version == null ? "unknown" : version;
+        } catch (ClassNotFoundException e) {
+            return "unknown";
+        }
+    }
+
+    private String readCpuLoadPercent() {
+        try {
+            java.lang.management.OperatingSystemMXBean osBean = ManagementFactory.getOperatingSystemMXBean();
+            if (osBean instanceof com.sun.management.OperatingSystemMXBean sunOsBean) {
+                double value = sunOsBean.getCpuLoad();
+                if (value >= 0) {
+                    return String.format("%.2f%%", value * 100);
+                }
+            }
+        } catch (Exception ignored) {
+        }
+        return "N/A";
+    }
+
+    private long bytesToMb(long bytes) {
+        return bytes / 1024 / 1024;
+    }
 }

src/main/java/com/yaoyuan/jiscuss/controller/BaseController.java

@@ -1,48 +1,34 @@
 package com.yaoyuan.jiscuss.controller;
 
 import com.yaoyuan.jiscuss.entity.UserInfo;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpSession;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContext;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpSession;
-import java.util.Enumeration;
-
 /**
+ * Base controller exposing helpers shared by web controllers.
+ *
  * @author yaoyuan2.chu
- * @Title: BaseController
- * @Package com.yaoyuan.jiscuss.controller
- * @Description: BaseController
- * @date 2020/7/16 14:36
  */
 public class BaseController {
 
     /**
-     * 获取当前用户
-     *
-     * @return
+     * Returns the current authenticated user, or {@code null} when not logged in.
      */
     protected UserInfo getUserInfo(HttpServletRequest request) {
-        UserInfo user = null;
-        //获得session对象
-        HttpSession session = request.getSession();
-        //取出session域中所有属性名
-        Enumeration attributeNames = session.getAttributeNames();
-        while (attributeNames.hasMoreElements()) {
-            System.out.println(attributeNames.nextElement());
+        HttpSession session = request.getSession(false);
+        if (session == null) {
+            return null;
+        }
+        Object ctx = session.getAttribute("SPRING_SECURITY_CONTEXT");
+        if (!(ctx instanceof SecurityContext securityContext)) {
+            return null;
         }
-        //SPRING_SECURITY_CONTEXT
-        Object spring_security_context = session.getAttribute("SPRING_SECURITY_CONTEXT");
-        System.out.println(spring_security_context);
-        SecurityContext securityContext = (SecurityContext) spring_security_context;
-        if (securityContext != null) {
-            //获得认证信息
         Authentication authentication = securityContext.getAuthentication();
-            //获得用户详情
-            Object principal = authentication.getPrincipal();
-            user = (UserInfo) principal;
+        if (authentication == null || !(authentication.getPrincipal() instanceof UserInfo userInfo)) {
+            return null;
         }
-        return user;
+        return userInfo;
     }
-
 }

src/main/java/com/yaoyuan/jiscuss/controller/UserPageController.java

@@ -12,7 +12,7 @@ import org.springframework.ui.ModelMap;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 
 /**
  * @author yaoyuan2.chu

src/main/java/com/yaoyuan/jiscuss/controller/UserPostController.java

@@ -12,7 +12,6 @@ import com.yaoyuan.jiscuss.service.IDiscussionsTagsService;
 import com.yaoyuan.jiscuss.service.IPostsService;
 import com.yaoyuan.jiscuss.service.ITagsService;
 import com.yaoyuan.jiscuss.service.IUsersService;
-import org.json.JSONObject;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.BeanUtils;
@@ -27,9 +26,11 @@ import org.springframework.web.bind.annotation.ResponseBody;
 import org.springframework.web.context.request.RequestContextHolder;
 import org.springframework.web.context.request.ServletRequestAttributes;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.Date;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 /**
  * @author yaoyuan2.chu
@@ -108,9 +109,9 @@ public class UserPostController extends BaseController {
      * @param discussion
      * @return
      */
-    @PostMapping(value = "/newDiscussions")
+    @PostMapping(value = {"/newDiscussions", "/newdiscussions"})
     @ResponseBody
-    public String newDiscussions(@RequestBody DiscussionCustom discussion) {
+    public Map<String, Object> newDiscussions(@RequestBody DiscussionCustom discussion) {
         logger.info(">>> newPost" + discussion);
 
         ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
@@ -141,13 +142,11 @@ public class UserPostController extends BaseController {
             }
         }
 
-        JSONObject resultobj = new JSONObject();
-
+        Map<String, Object> resultobj = new HashMap<>();
         logger.info(">>>{}", saveDiscussion);
         resultobj.put("msg", "添加主题成功");
         resultobj.put("flag", true);
-        return resultobj.toString(); //
-
+        return resultobj;
     }
 
 
@@ -170,7 +169,7 @@ public class UserPostController extends BaseController {
      */
     @PostMapping(value = "/newPost")
     @ResponseBody
-    public String newPosts(@RequestBody Post post) {
+    public Map<String, Object> newPosts(@RequestBody Post post) {
         logger.info(">>> newpost" + post);
 
         ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
@@ -187,12 +186,11 @@ public class UserPostController extends BaseController {
         }
 
         Post savePost = postsService.insert(post);
-        JSONObject resultobj = new JSONObject();
-
+        Map<String, Object> resultobj = new HashMap<>();
         logger.info(">>>{}", savePost);
         resultobj.put("msg", "添加评论成功");
         resultobj.put("flag", true);
-        return resultobj.toString(); //
+        return resultobj;
     }
 
     /**
@@ -208,7 +206,7 @@ public class UserPostController extends BaseController {
      */
     @PostMapping(value = "/newtags")
     @ResponseBody
-    public String newTags(@RequestBody Tag tag) {
+    public Map<String, Object> newTags(@RequestBody Tag tag) {
         logger.info(">>> newTags" + tag);
         ServletRequestAttributes servletRequestAttributes = (ServletRequestAttributes) RequestContextHolder.getRequestAttributes();
         HttpServletRequest request = servletRequestAttributes.getRequest();
@@ -220,12 +218,11 @@ public class UserPostController extends BaseController {
         tag.setCreateTime(new Date());
 
         Tag saveTag = tagsService.insert(tag);
-        JSONObject resultobj = new JSONObject();
-
+        Map<String, Object> resultobj = new HashMap<>();
         logger.info(">>>{}", saveTag);
         resultobj.put("msg", "添加标签成功");
         resultobj.put("flag", true);
-        return resultobj.toString();
+        return resultobj;
     }
 
     /**

src/main/java/com/yaoyuan/jiscuss/controller/UserSystemController.java

@@ -21,13 +21,17 @@ import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.PostMapping;
 import org.springframework.web.bind.annotation.RequestMapping;
 import org.springframework.web.bind.annotation.RequestParam;
+import org.springframework.web.servlet.view.RedirectView;
 
-import javax.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletRequest;
 import java.util.ArrayList;
 import java.util.Date;
+import java.util.HashSet;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
 
 /**
  * @author yaoyuan2.chu
@@ -142,6 +146,19 @@ public class UserSystemController extends BaseController {
                 tagMap.put(tc.getDiscussionId(), tagCustomListTemp);
             }
         }
+
+        Set<Integer> userIds = new HashSet<>();
+        for (Discussion dd : allDiscussions) {
+            if (dd.getStartUserId() != null) {
+                userIds.add(dd.getStartUserId());
+            }
+            if (dd.getLastUserId() != null) {
+                userIds.add(dd.getLastUserId());
+            }
+        }
+        Map<Integer, User> userMap = usersService.findAllById(userIds).stream()
+                .collect(Collectors.toMap(User::getId, u -> u));
+
         for (Discussion dd : allDiscussions) {
             DiscussionCustom newdd = new DiscussionCustom();
             BeanUtils.copyProperties(dd, newdd);
@@ -154,13 +171,13 @@ public class UserSystemController extends BaseController {
             }
             newdd.setContent(newCon);
             if (null != newdd.getStartUserId()) {
-                User startUser = usersService.findOne(newdd.getStartUserId());
+                User startUser = userMap.get(newdd.getStartUserId());
                 newdd.setAvatar(startUser != null && startUser.getAvatar() != null ? startUser.getAvatar() : "");
                 newdd.setRealname(startUser != null && startUser.getRealname() != null ? startUser.getRealname() : "");
                 newdd.setUsername(startUser != null && startUser.getUsername() != null ? startUser.getUsername() : "");
             }
             if (null != newdd.getLastUserId()) {
-                User lastUser = usersService.findOne(newdd.getLastUserId());
+                User lastUser = userMap.get(newdd.getLastUserId());
                 newdd.setAvatarLast(lastUser != null && lastUser.getAvatar() != null ? lastUser.getAvatar() : "");
                 newdd.setRealnameLast(lastUser != null && lastUser.getRealname() != null ? lastUser.getRealname() : "");
                 newdd.setUsernameLast(lastUser != null && lastUser.getUsername() != null ? lastUser.getUsername() : "");
@@ -209,6 +226,11 @@ public class UserSystemController extends BaseController {
         return "login";
     }
 
+    @GetMapping("/favicon.ico")
+    public RedirectView favicon() {
+        return new RedirectView("/static/assets/images/logo.png");
+    }
+
 
     /**
      * 注册提交

src/main/java/com/yaoyuan/jiscuss/controller/api/RestPostController.java

@@ -4,8 +4,8 @@ import com.yaoyuan.jiscuss.entity.Discussion;
 import com.yaoyuan.jiscuss.exception.BaseException;
 import com.yaoyuan.jiscuss.response.ResponseCode;
 import com.yaoyuan.jiscuss.service.IDiscussionsService;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -20,15 +20,16 @@ import java.util.List;
 
 @RestController
 @RequestMapping(path = "/other_api", produces = "application/json;charset=utf-8")
-@Api(value = "主题帖子(其他)接口管理", tags = {"主题帖子(其他)接口管理"})
+@Tag(name = "主题帖子(其他)接口管理", description = "主题相关 REST API")
 public class RestPostController {
-    private static Logger logger = LoggerFactory.getLogger(RestPostController.class);
+
+    private static final Logger logger = LoggerFactory.getLogger(RestPostController.class);
 
     @Autowired
     private IDiscussionsService discussionsService;
 
     @PostMapping("/discussion")
-    @ApiOperation("新增主题")
+    @Operation(summary = "新增主题")
     public Discussion save(@RequestBody Discussion discussion) {
         Discussion saveDiscussion = discussionsService.insert(discussion);
         if (saveDiscussion != null) {
@@ -39,18 +40,16 @@ public class RestPostController {
     }
 
     @GetMapping("/discussion/{id}")
-    @ApiOperation("获取主题")
+    @Operation(summary = "获取主题")
     public Discussion getDiscussions(@PathVariable Integer id) {
-        Discussion discussion = discussionsService.findOne(id);
-        return discussion;
+        return discussionsService.findOne(id);
     }
 
     @GetMapping("/discussions")
-    @ApiOperation("获取全部主题")
+    @Operation(summary = "获取全部主题")
     public List<Discussion> getAllDiscussions() {
         List<Discussion> allDiscussions = discussionsService.getAllList();
         logger.info("全部主题==>：{}", allDiscussions);
         return allDiscussions;
     }
-
 }

src/main/java/com/yaoyuan/jiscuss/controller/api/RestUserController.java

@@ -4,9 +4,8 @@ import com.yaoyuan.jiscuss.entity.User;
 import com.yaoyuan.jiscuss.exception.BaseException;
 import com.yaoyuan.jiscuss.response.ResponseCode;
 import com.yaoyuan.jiscuss.service.IUsersService;
-import io.swagger.annotations.Api;
-import io.swagger.annotations.ApiOperation;
-import org.json.JSONObject;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.tags.Tag;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -23,16 +22,16 @@ import java.util.List;
 
 @RestController
 @RequestMapping("/user_api")
-@Api(value = "用户接口管理", tags = {"用户接口管理"})
+@Tag(name = "用户接口管理", description = "用户 CRUD API")
 public class RestUserController {
 
-    private static Logger logger = LoggerFactory.getLogger(RestUserController.class);
+    private static final Logger logger = LoggerFactory.getLogger(RestUserController.class);
 
     @Autowired
     private IUsersService usersService;
 
     @PostMapping("/user")
-    @ApiOperation("新增用户")
+    @Operation(summary = "新增用户")
     public User save(@RequestBody User user) {
         User saveUser = usersService.insert(user);
         if (saveUser != null) {
@@ -40,23 +39,17 @@ public class RestUserController {
         } else {
             throw new BaseException(ResponseCode.RESOURCES_NOT_EXIST);
         }
-
     }
 
     @DeleteMapping("/user/{id}")
-    @ApiOperation("删除用户")
+    @Operation(summary = "删除用户")
     public Boolean delete(@PathVariable Integer id) {
-        Boolean delete = true;
         usersService.remove(id);
-        if (delete) {
-            return delete;
-        } else {
-            throw new BaseException(ResponseCode.RESOURCES_NOT_EXIST);
-        }
+        return true;
     }
 
     @PutMapping("/user/{id}")
-    @ApiOperation("修改用户")
+    @Operation(summary = "修改用户")
     public User update(@RequestBody User user, @PathVariable Integer id) {
         User updateuser = usersService.update(user, id);
         if (updateuser != null) {
@@ -67,19 +60,16 @@ public class RestUserController {
     }
 
     @GetMapping("/user/{id}")
-    @ApiOperation("获取用户")
+    @Operation(summary = "获取用户")
     public User getUser(@PathVariable Integer id) {
         User user = usersService.findOne(id);
-        logger.info("获取用户==>：{}", JSONObject.valueToString(user));
+        logger.info("获取用户==>：{}", user);
         return user;
     }
 
     @GetMapping("/user")
-    @ApiOperation("获取全部用户")
-    public List<User> getUser(User user) {
-        List<User> userall = usersService.getAllList();
-        logger.info("全部用户==>：{}", JSONObject.valueToString(userall));
-        return userall;
+    @Operation(summary = "获取全部用户")
+    public List<User> getAllUsers() {
+        return usersService.getAllList();
     }
-
 }

src/main/java/com/yaoyuan/jiscuss/dto/UserCreateRequest.java

@@ -0,0 +1,31 @@
+package com.yaoyuan.jiscuss.dto;
+
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
+
+/**
+ * Request payload for creating a new user account.
+ * Validated at the controller boundary before reaching the service layer.
+ */
+public record UserCreateRequest(
+
+        @NotBlank(message = "用户名不能为空")
+        @Size(min = 3, max = 50, message = "用户名长度必须在 3-50 个字符之间")
+        String username,
+
+        /**
+         * Raw password — will be BCrypt-hashed before persistence.
+         * Never log or return this field.
+         */
+        @NotBlank(message = "密码不能为空")
+        @Size(min = 8, max = 100, message = "密码长度至少 8 个字符")
+        String password,
+
+        @Email(message = "邮箱格式不正确")
+        @Size(max = 100)
+        String email,
+
+        @Size(max = 50)
+        String realname
+) {}

src/main/java/com/yaoyuan/jiscuss/dto/UserMapper.java

@@ -0,0 +1,54 @@
+package com.yaoyuan.jiscuss.dto;
+
+import com.yaoyuan.jiscuss.entity.User;
+import org.mapstruct.Mapper;
+import org.mapstruct.MappingConstants;
+import org.mapstruct.ReportingPolicy;
+
+/**
+ * MapStruct mapper between {@link User} entity and its DTOs.
+ *
+ * <p>The {@code password} field is intentionally never copied into a response and
+ * is left {@code null} when constructing a {@link User} from a create request —
+ * the caller (service layer) is responsible for BCrypt-hashing and setting it.
+ */
+@Mapper(
+        componentModel = MappingConstants.ComponentModel.SPRING,
+        unmappedTargetPolicy = ReportingPolicy.IGNORE
+)
+public interface UserMapper {
+
+    /** Map a {@link User} entity to a safe {@link UserResponse} (no password). */
+    default UserResponse toResponse(User user) {
+        if (user == null) {
+            return null;
+        }
+        return new UserResponse(
+                user.getId(),
+                user.getUsername(),
+                user.getRealname(),
+                user.getEmail(),
+                user.getAvatar(),
+                user.getGender(),
+                user.getPhone(),
+                user.getAge(),
+                user.getDiscussionsCount(),
+                user.getCommentsCount(),
+                user.getJoinTime(),
+                user.getLastSeenTime(),
+                user.getLevel()
+        );
+    }
+
+    /** Map a create request to a new {@link User} entity. Password must be set by the caller. */
+    default User fromCreateRequest(UserCreateRequest request) {
+        if (request == null) {
+            return null;
+        }
+        User user = new User();
+        user.setUsername(request.username());
+        user.setEmail(request.email());
+        user.setRealname(request.realname());
+        return user;
+    }
+}

src/main/java/com/yaoyuan/jiscuss/dto/UserResponse.java

@@ -0,0 +1,23 @@
+package com.yaoyuan.jiscuss.dto;
+
+import java.util.Date;
+
+/**
+ * Read-only user projection exposed to the frontend / API consumers.
+ * Never exposes the {@code password} field.
+ */
+public record UserResponse(
+        Integer id,
+        String username,
+        String realname,
+        String email,
+        String avatar,
+        String gender,
+        String phone,
+        Integer age,
+        Integer discussionsCount,
+        Integer commentsCount,
+        Date joinTime,
+        Date lastSeenTime,
+        Integer level
+) {}

src/main/java/com/yaoyuan/jiscuss/entity/AuditLog.java

@@ -0,0 +1,47 @@
+package com.yaoyuan.jiscuss.entity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import lombok.Data;
+
+import java.io.Serializable;
+import java.util.Date;
+
+@Data
+@Entity
+@Table(name = "audit_log")
+public class AuditLog implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Integer id;
+
+    @Column(name = "admin_id")
+    private Integer adminId;
+
+    @Column(name = "admin_name")
+    private String adminName;
+
+    @Column(name = "action_type")
+    private String actionType;
+
+    @Column(name = "target_type")
+    private String targetType;
+
+    @Column(name = "target_id")
+    private Integer targetId;
+
+    @Column(name = "description")
+    private String description;
+
+    @Column(name = "status")
+    private String status;
+
+    @Column(name = "create_time")
+    private Date createTime;
+}

src/main/java/com/yaoyuan/jiscuss/entity/Discussion.java

@@ -1,13 +1,15 @@
 package com.yaoyuan.jiscuss.entity;
 
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Size;
 import lombok.Data;
 
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
 
@@ -22,6 +24,8 @@ public class Discussion implements Serializable {
     @Column(name = "id", unique = true)
     private Integer id;
 
+    @NotBlank
+    @Size(max = 200)
     @Column(name = "title")
     private String title;
 
@@ -64,7 +68,7 @@ public class Discussion implements Serializable {
     @Column(name = "like_count")
     private Integer likeCount;
 
-
+    /** IP is resolved server-side via IpUtils.getClientIp() — never trusted from X-Forwarded-For alone. */
     @Column(name = "ip_address")
     private String ipAddress;
 
@@ -73,5 +77,5 @@ public class Discussion implements Serializable {
 
     @Column(name = "create_time")
     private Date createTime;
-
 }
+

src/main/java/com/yaoyuan/jiscuss/entity/DiscussionTag.java

@@ -1,13 +1,13 @@
 package com.yaoyuan.jiscuss.entity;
 
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
 import lombok.Data;
 
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.Table;
 import java.io.Serializable;
 
 @Data

src/main/java/com/yaoyuan/jiscuss/entity/LikeCollect.java

@@ -1,22 +1,18 @@
 package com.yaoyuan.jiscuss.entity;
 
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
 import lombok.Data;
 
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
 
 /**
  * @author yaoyuan2.chu
- * @Title:
- * @Package com.yaoyuan.jiscuss.entity
- * @Description:
- * @date 2020/10/21 12:00
  */
 @Data
 @Entity

src/main/java/com/yaoyuan/jiscuss/entity/Post.java

@@ -1,13 +1,14 @@
 package com.yaoyuan.jiscuss.entity;
 
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.validation.constraints.NotBlank;
 import lombok.Data;
 
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
 
@@ -36,6 +37,7 @@ public class Post implements Serializable {
     @Column(name = "type")
     private String type;
 
+    @NotBlank
     @Column(name = "content")
     private String content;
 
@@ -48,6 +50,7 @@ public class Post implements Serializable {
     @Column(name = "edit_user_id")
     private Integer editUserId;
 
+    /** IP resolved server-side via IpUtils.getClientIp(). */
     @Column(name = "ip_address")
     private String ipAddress;
 

src/main/java/com/yaoyuan/jiscuss/entity/Role.java

@@ -0,0 +1,41 @@
+package com.yaoyuan.jiscuss.entity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import lombok.Data;
+
+import java.io.Serializable;
+import java.util.Date;
+
+@Data
+@Entity
+@Table(name = "rbac_role")
+public class Role implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Integer id;
+
+    @Column(name = "code")
+    private String code;
+
+    @Column(name = "name")
+    private String name;
+
+    @Column(name = "description")
+    private String description;
+
+    @Column(name = "enabled")
+    private Integer enabled;
+
+    @Column(name = "create_time")
+    private Date createTime;
+
+    @Column(name = "update_time")
+    private Date updateTime;
+}

src/main/java/com/yaoyuan/jiscuss/entity/Setting.java

@@ -1,13 +1,13 @@
 package com.yaoyuan.jiscuss.entity;
 
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
 import lombok.Data;
 
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.Table;
 import java.io.Serializable;
 
 @Data

src/main/java/com/yaoyuan/jiscuss/entity/Tag.java

@@ -1,13 +1,13 @@
 package com.yaoyuan.jiscuss.entity;
 
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
 import lombok.Data;
 
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
 

src/main/java/com/yaoyuan/jiscuss/entity/UpgradeLog.java

@@ -0,0 +1,41 @@
+package com.yaoyuan.jiscuss.entity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import lombok.Data;
+
+import java.io.Serializable;
+import java.util.Date;
+
+@Data
+@Entity
+@Table(name = "upgrade_log")
+public class UpgradeLog implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Integer id;
+
+    @Column(name = "version")
+    private String version;
+
+    @Column(name = "title")
+    private String title;
+
+    @Column(name = "content")
+    private String content;
+
+    @Column(name = "type")
+    private String type;
+
+    @Column(name = "created_by")
+    private Integer createdBy;
+
+    @Column(name = "create_time")
+    private Date createTime;
+}

src/main/java/com/yaoyuan/jiscuss/entity/User.java

@@ -1,14 +1,17 @@
 package com.yaoyuan.jiscuss.entity;
 
-
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import jakarta.validation.constraints.Email;
+import jakarta.validation.constraints.NotBlank;
+import jakarta.validation.constraints.Pattern;
+import jakarta.validation.constraints.Size;
 import lombok.Data;
 
-import javax.persistence.Column;
-import javax.persistence.Entity;
-import javax.persistence.GeneratedValue;
-import javax.persistence.GenerationType;
-import javax.persistence.Id;
-import javax.persistence.Table;
 import java.io.Serializable;
 import java.util.Date;
 
@@ -22,15 +25,21 @@ public class User implements Serializable {
     @GeneratedValue(strategy = GenerationType.IDENTITY)
     private Integer id;
 
+    @NotBlank
+    @Size(min = 3, max = 50)
     @Column(name = "username")
     private String username;
 
+    @Size(max = 50)
     @Column(name = "realname")
     private String realname;
 
+    @Email
+    @Size(max = 100)
     @Column(name = "email")
     private String email;
 
+    /** BCrypt-hashed password. Column length must be >= 68 (see V2 migration). */
     @Column(name = "password")
     private String password;
 
@@ -40,12 +49,14 @@ public class User implements Serializable {
     @Column(name = "age")
     private Integer age;
 
+    @Pattern(regexp = "^(男|女|其他)?$")
     @Column(name = "gender")
     private String gender;
 
     @Column(name = "avatar")
     private String avatar;
 
+    @Size(max = 20)
     @Column(name = "phone")
     private String phone;
 
@@ -63,5 +74,4 @@ public class User implements Serializable {
 
     @Column(name = "level")
     private Integer level;
-
 }

src/main/java/com/yaoyuan/jiscuss/entity/UserRole.java

@@ -0,0 +1,32 @@
+package com.yaoyuan.jiscuss.entity;
+
+import jakarta.persistence.Column;
+import jakarta.persistence.Entity;
+import jakarta.persistence.GeneratedValue;
+import jakarta.persistence.GenerationType;
+import jakarta.persistence.Id;
+import jakarta.persistence.Table;
+import lombok.Data;
+
+import java.io.Serializable;
+import java.util.Date;
+
+@Data
+@Entity
+@Table(name = "rbac_user_role")
+public class UserRole implements Serializable {
+    private static final long serialVersionUID = 1L;
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Integer id;
+
+    @Column(name = "user_id")
+    private Integer userId;
+
+    @Column(name = "role_id")
+    private Integer roleId;
+
+    @Column(name = "create_time")
+    private Date createTime;
+}

src/main/java/com/yaoyuan/jiscuss/entity/custom/TagCustom.java

@@ -4,7 +4,7 @@ import lombok.Data;
 import lombok.Getter;
 import lombok.Setter;
 
-import javax.persistence.Column;
+import jakarta.persistence.Column;
 
 /**
  * @author yaoyuan2.chu

src/main/java/com/yaoyuan/jiscuss/exception/GlobalExceptionHandler.java

@@ -0,0 +1,91 @@
+package com.yaoyuan.jiscuss.exception;
+
+import com.yaoyuan.jiscuss.response.ApiResponse;
+import com.yaoyuan.jiscuss.response.ResponseCode;
+import jakarta.validation.ConstraintViolationException;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.access.AccessDeniedException;
+import org.springframework.web.bind.MethodArgumentNotValidException;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.servlet.NoHandlerFoundException;
+import org.springframework.web.servlet.resource.NoResourceFoundException;
+
+import java.util.stream.Collectors;
+
+/**
+ * Global exception handler.
+ *
+ * <p>Catches {@link BaseException}, validation errors, and unexpected exceptions so they
+ * are returned as structured JSON instead of Spring's default error page.
+ */
+@RestControllerAdvice
+public class GlobalExceptionHandler {
+
+    private static final Logger log = LoggerFactory.getLogger(GlobalExceptionHandler.class);
+
+    /** Business logic exceptions (already typed with a ResponseCode). */
+    @ExceptionHandler(BaseException.class)
+    public ResponseEntity<ApiResponse<Void>> handleBaseException(BaseException ex) {
+        log.warn("Business exception: code={}, msg={}", ex.getCode().getCode(), ex.getCode().getMsg());
+        return ResponseEntity
+                .status(HttpStatus.BAD_REQUEST)
+                .body(ApiResponse.fail(ex.getCode()));
+    }
+
+    /** @Valid / @Validated failures on @RequestBody. */
+    @ExceptionHandler(MethodArgumentNotValidException.class)
+    public ResponseEntity<ApiResponse<Void>> handleValidationException(MethodArgumentNotValidException ex) {
+        String message = ex.getBindingResult().getFieldErrors().stream()
+                .map(fe -> fe.getField() + ": " + fe.getDefaultMessage())
+                .collect(Collectors.joining("; "));
+        log.warn("Validation failed: {}", message);
+        return ResponseEntity
+                .status(HttpStatus.BAD_REQUEST)
+                .body(ApiResponse.error(message));
+    }
+
+    /** @Validated failures on @RequestParam / @PathVariable. */
+    @ExceptionHandler(ConstraintViolationException.class)
+    public ResponseEntity<ApiResponse<Void>> handleConstraintViolation(ConstraintViolationException ex) {
+        String message = ex.getConstraintViolations().stream()
+                .map(cv -> cv.getPropertyPath() + ": " + cv.getMessage())
+                .collect(Collectors.joining("; "));
+        log.warn("Constraint violation: {}", message);
+        return ResponseEntity
+                .status(HttpStatus.BAD_REQUEST)
+                .body(ApiResponse.error(message));
+    }
+
+    /**
+     * Spring Security access-denied exceptions re-thrown by method security.
+     * Note: exceptions raised before method invocation are handled by {@code CustomAccessDeniedHandler}.
+     */
+    @ExceptionHandler(AccessDeniedException.class)
+    public ResponseEntity<ApiResponse<Void>> handleAccessDenied(AccessDeniedException ex) {
+        return ResponseEntity
+                .status(HttpStatus.FORBIDDEN)
+                .body(ApiResponse.error("没有权限访问该资源"));
+    }
+
+        /** 404 mappings/resources should not be logged as system errors. */
+        @ExceptionHandler({NoHandlerFoundException.class, NoResourceFoundException.class})
+        public ResponseEntity<ApiResponse<Void>> handleNotFound(Exception ex) {
+                log.warn("Not found: {}", ex.getMessage());
+                return ResponseEntity
+                                .status(HttpStatus.NOT_FOUND)
+                                .body(ApiResponse.error("资源不存在"));
+        }
+
+    /** Catch-all for any unhandled exception — never expose stack traces to clients. */
+    @ExceptionHandler(Exception.class)
+    public ResponseEntity<ApiResponse<Void>> handleGeneral(Exception ex) {
+        log.error("Unexpected error", ex);
+        return ResponseEntity
+                .status(HttpStatus.INTERNAL_SERVER_ERROR)
+                .body(ApiResponse.fail(ResponseCode.SERVICE_ERROR));
+    }
+}

src/main/java/com/yaoyuan/jiscuss/handler/CustomAccessDeniedHandler.java

@@ -1,63 +1,62 @@
 package com.yaoyuan.jiscuss.handler;
 
+import jakarta.servlet.ServletException;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
 import org.springframework.security.access.AccessDeniedException;
-import org.springframework.security.web.WebAttributes;
 import org.springframework.security.web.access.AccessDeniedHandler;
 import org.springframework.stereotype.Component;
 
-import javax.servlet.RequestDispatcher;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
 import java.io.IOException;
 import java.io.PrintWriter;
 
 /**
- * 处理无权请求
+ * Handles 403 access-denied responses.
  *
- * @author charlie
+ * <p>Behavior:
+ * <ul>
+ *   <li>AJAX requests → JSON body with {@code code/msg}</li>
+ *   <li>Regular page requests → simple HTML 403 response (no forward to /403,
+ *       which previously caused a 404)</li>
+ * </ul>
  */
 @Component
 public class CustomAccessDeniedHandler implements AccessDeniedHandler {
 
-    private Logger log = LoggerFactory.getLogger(CustomAccessDeniedHandler.class);
+    private static final Logger log = LoggerFactory.getLogger(CustomAccessDeniedHandler.class);
 
     @Override
-    public void handle(HttpServletRequest request, HttpServletResponse response,
+    public void handle(HttpServletRequest request,
+                       HttpServletResponse response,
                        AccessDeniedException accessDeniedException) throws IOException, ServletException {
-        boolean isAjax = ControllerTools.isAjaxRequest(request);
-        System.out.println("CustomAccessDeniedHandler handle");
-        if (!response.isCommitted()) {
-            if (isAjax) {
-                String msg = accessDeniedException.getMessage();
-                log.info("accessDeniedException.message:" + msg);
-                String accessDenyMsg = "{\"code\":\"403\",\"msg\":\"没有权限\"}";
-                ControllerTools.print(response, accessDenyMsg);
-            } else {
-                request.setAttribute(WebAttributes.ACCESS_DENIED_403, accessDeniedException);
+        if (response.isCommitted()) {
+            return;
+        }
+
+        log.warn("Access denied for {} → {}", request.getRequestURI(), accessDeniedException.getMessage());
         response.setStatus(HttpStatus.FORBIDDEN.value());
-                RequestDispatcher dispatcher = request.getRequestDispatcher("/403");
-                dispatcher.forward(request, response);
+        response.setCharacterEncoding("UTF-8");
+
+        if (isAjaxRequest(request)) {
+            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
+            try (PrintWriter writer = response.getWriter()) {
+                writer.write("{\"code\":403,\"msg\":\"没有权限\"}");
+            }
+        } else {
+            response.setContentType(MediaType.TEXT_HTML_VALUE);
+            try (PrintWriter writer = response.getWriter()) {
+                writer.write("<!DOCTYPE html><html><head><meta charset=\"UTF-8\"><title>403 Forbidden</title></head>"
+                        + "<body><h1>403 Forbidden</h1><p>您没有权限访问该资源。</p></body></html>");
             }
         }
     }
 
-    public static class ControllerTools {
-        public static boolean isAjaxRequest(HttpServletRequest request) {
+    private static boolean isAjaxRequest(HttpServletRequest request) {
         return "XMLHttpRequest".equals(request.getHeader("X-Requested-With"));
     }
-
-        public static void print(HttpServletResponse response, String msg) throws IOException {
-            response.setCharacterEncoding("UTF-8");
-            response.setContentType("application/json; charset=utf-8");
-            PrintWriter writer = response.getWriter();
-            writer.write(msg);
-            writer.flush();
-            writer.close();
-        }
 }
 
-}

src/main/java/com/yaoyuan/jiscuss/handler/RbacPermission.java

@@ -1,37 +1,70 @@
 package com.yaoyuan.jiscuss.handler;
 
+import jakarta.servlet.http.HttpServletRequest;
 import org.springframework.security.core.Authentication;
+import org.springframework.security.core.GrantedAuthority;
 import org.springframework.stereotype.Component;
 import org.springframework.util.AntPathMatcher;
 
-import javax.servlet.http.HttpServletRequest;
+import java.util.Collection;
 
 /**
- * RBAC数据模型控制权限
+ * RBAC (Role-Based Access Control) permission evaluator.
  *
- * @author charlie
+ * <p>Rules:
+ * <ul>
+ *   <li>Anonymous / unauthenticated: denied</li>
+ *   <li>ROLE_ADMIN: full access (all paths)</li>
+ *   <li>ROLE_USER: access to all non-admin paths</li>
+ *   <li>Admin-only paths ({@code /admin/**}, {@code /druid/**}, etc.) require ROLE_ADMIN</li>
+ * </ul>
+ *
+ * <p>Previously this method unconditionally returned {@code true}, giving every user
+ * unrestricted access regardless of role — a critical security vulnerability now fixed.
  */
 @Component("rbacPermission")
 public class RbacPermission {
 
-    private AntPathMatcher antPathMatcher = new AntPathMatcher();
+    private static final AntPathMatcher PATH_MATCHER = new AntPathMatcher();
 
+    /** URL patterns that require ROLE_ADMIN. */
+    private static final String[] ADMIN_ONLY_PATTERNS = {
+            "/admin/**",
+            "/druid/**",
+            "/actuator/**",
+            "/h2-console/**",
+            "/user_api/**",
+            "/other_api/**"
+    };
+
+    /**
+     * Evaluates whether the authenticated principal is permitted to access the requested URL.
+     *
+     * @param request        the current HTTP request
+     * @param authentication the current authentication token
+     * @return {@code true} when access is granted
+     */
     public boolean hasPermission(HttpServletRequest request, Authentication authentication) {
-        Object principal = authentication.getPrincipal();
-        boolean hasPermission = false;
+        if (authentication == null
+                || !authentication.isAuthenticated()
+                || "anonymousUser".equals(authentication.getPrincipal())) {
+            return false;
+        }
 
-        hasPermission = true;
-//		if (principal instanceof UserEntity) {
-//			// 读取用户所拥有的权限菜单
-//			List<Menu> menus = ((UserEntity) principal).getRoleMenus();
-//			System.out.println(menus.size());
-//			for (Menu menu : menus) {
-//				if (antPathMatcher.match(menu.getMenuUrl(), request.getRequestURI())) {
-//					hasPermission = true;
-//					break;
-//				}
-//			}
-//		}
-        return hasPermission;
+        String uri = request.getRequestURI();
+        Collection<? extends GrantedAuthority> authorities = authentication.getAuthorities();
+
+        boolean isAdmin = authorities.stream()
+                .anyMatch(a -> "ROLE_ADMIN".equals(a.getAuthority()));
+
+        // Admin-only paths: only ROLE_ADMIN may proceed
+        for (String pattern : ADMIN_ONLY_PATTERNS) {
+            if (PATH_MATCHER.match(pattern, uri)) {
+                return isAdmin;
+            }
+        }
+
+        // All other paths are accessible by any authenticated user
+        return true;
     }
 }

src/main/java/com/yaoyuan/jiscuss/repository/AuditLogRepository.java

@@ -0,0 +1,20 @@
+package com.yaoyuan.jiscuss.repository;
+
+import com.yaoyuan.jiscuss.entity.AuditLog;
+import org.springframework.data.domain.Page;
+import org.springframework.data.domain.Pageable;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import java.util.List;
+
+@Repository
+public interface AuditLogRepository extends JpaRepository<AuditLog, Integer> {
+    List<AuditLog> findAllByOrderByCreateTimeDesc();
+
+    Page<AuditLog> findAllByOrderByCreateTimeDesc(Pageable pageable);
+
+    List<AuditLog> findByTargetTypeAndTargetIdOrderByCreateTimeDesc(String targetType, Integer targetId);
+
+    List<AuditLog> findByAdminIdOrderByCreateTimeDesc(Integer adminId);
+}

src/main/java/com/yaoyuan/jiscuss/repository/DiscussionsTagsRepository.java

@@ -7,4 +7,5 @@ import org.springframework.stereotype.Repository;
 
 @Repository
 public interface DiscussionsTagsRepository extends JpaRepository<DiscussionTag, Integer> {
+	void deleteByDiscussionId(Integer discussionId);
 }

src/main/java/com/yaoyuan/jiscuss/repository/PostsRepository.java

@@ -12,6 +12,8 @@ import java.util.Map;
 @Repository
 public interface PostsRepository extends JpaRepository<Post, Integer> {
 
+        void deleteByDiscussionId(Integer discussionId);
+
     /**
      * @param dId
      * @return

src/main/java/com/yaoyuan/jiscuss/repository/RoleRepository.java

@@ -0,0 +1,16 @@
+package com.yaoyuan.jiscuss.repository;
+
+import com.yaoyuan.jiscuss.entity.Role;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import java.util.List;
+
+@Repository
+public interface RoleRepository extends JpaRepository<Role, Integer> {
+    Role findByCode(String code);
+
+    Role findByCodeIgnoreCase(String code);
+
+    List<Role> findAllByOrderByIdAsc();
+}

src/main/java/com/yaoyuan/jiscuss/repository/UpgradeLogRepository.java

@@ -0,0 +1,12 @@
+package com.yaoyuan.jiscuss.repository;
+
+import com.yaoyuan.jiscuss.entity.UpgradeLog;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.stereotype.Repository;
+
+import java.util.List;
+
+@Repository
+public interface UpgradeLogRepository extends JpaRepository<UpgradeLog, Integer> {
+    List<UpgradeLog> findAllByOrderByCreateTimeDesc();
+}

src/main/java/com/yaoyuan/jiscuss/repository/UserRoleRepository.java

@@ -0,0 +1,20 @@
+package com.yaoyuan.jiscuss.repository;
+
+import com.yaoyuan.jiscuss.entity.UserRole;
+import org.springframework.data.jpa.repository.JpaRepository;
+import org.springframework.data.jpa.repository.Query;
+import org.springframework.data.repository.query.Param;
+import org.springframework.stereotype.Repository;
+
+import java.util.List;
+
+@Repository
+public interface UserRoleRepository extends JpaRepository<UserRole, Integer> {
+    List<UserRole> findByUserId(Integer userId);
+
+    void deleteByUserId(Integer userId);
+
+    @Query(value = "select r.code from rbac_user_role ur join rbac_role r on ur.role_id = r.id where ur.user_id = :userId and r.enabled = 1",
+            nativeQuery = true)
+    List<String> findRoleCodesByUserId(@Param("userId") Integer userId);
+}

src/main/java/com/yaoyuan/jiscuss/repository/UsersRepository.java

@@ -30,11 +30,6 @@ public interface UsersRepository extends JpaRepository<User, Integer> {
     @Query("from User where username = :username")
     User getByUsername(String username);
 
-    /**
-     * @param username
-     * @param password
-     * @return
-     */
-    @Query("from User where username = :username and password = :password")
-    User checkByUsernameAndPassword(String username, String password);
+    // REMOVED: checkByUsernameAndPassword — never compare passwords at the SQL layer.
+    // Password validation must go through BCryptPasswordEncoder.matches() in the service/security layer.
 }

src/main/java/com/yaoyuan/jiscuss/response/ApiResponse.java

@@ -0,0 +1,21 @@
+package com.yaoyuan.jiscuss.response;
+
+/**
+ * Unified API response wrapper.
+ *
+ * @param <T> payload type
+ */
+public record ApiResponse<T>(int code, String msg, T data) {
+
+    public static <T> ApiResponse<T> ok(T data) {
+        return new ApiResponse<>(ResponseCode.SUCCESS.getCode(), ResponseCode.SUCCESS.getMsg(), data);
+    }
+
+    public static <T> ApiResponse<T> fail(ResponseCode responseCode) {
+        return new ApiResponse<>(responseCode.getCode(), responseCode.getMsg(), null);
+    }
+
+    public static <T> ApiResponse<T> error(String message) {
+        return new ApiResponse<>(ResponseCode.SERVICE_ERROR.getCode(), message, null);
+    }
+}

src/main/java/com/yaoyuan/jiscuss/service/AuditLogService.java

@@ -0,0 +1,59 @@
+package com.yaoyuan.jiscuss.service;
+
+import com.yaoyuan.jiscuss.entity.AuditLog;
+import com.yaoyuan.jiscuss.entity.UserInfo;
+import com.yaoyuan.jiscuss.repository.AuditLogRepository;
+import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
+
+import java.util.Date;
+
+/**
+ * Service for recording admin operations in audit log.
+ */
+@Service
+public class AuditLogService {
+
+    private final AuditLogRepository auditLogRepository;
+
+    public AuditLogService(AuditLogRepository auditLogRepository) {
+        this.auditLogRepository = auditLogRepository;
+    }
+
+    @Transactional
+    public void log(Integer adminId, String adminName, String actionType, String targetType,
+                    Integer targetId, String description, String status) {
+        AuditLog log = new AuditLog();
+        log.setAdminId(adminId);
+        log.setAdminName(adminName);
+        log.setActionType(actionType);
+        log.setTargetType(targetType);
+        log.setTargetId(targetId);
+        log.setDescription(description);
+        log.setStatus(status == null ? "success" : status);
+        log.setCreateTime(new Date());
+        auditLogRepository.save(log);
+    }
+
+    @Transactional
+    public void log(Integer adminId, String adminName, String actionType, String targetType,
+                    Integer targetId, String description) {
+        log(adminId, adminName, actionType, targetType, targetId, description, "success");
+    }
+
+    @Transactional
+    public void log(UserInfo user, String actionType, String targetType,
+                    Integer targetId, String description) {
+        Integer userId = user == null ? null : user.getId();
+        String userName = user == null ? "unknown" : user.getUsername();
+        log(userId, userName, actionType, targetType, targetId, description, "success");
+    }
+
+    @Transactional
+    public void log(UserInfo user, String actionType, String targetType,
+                    Integer targetId, String description, String status) {
+        Integer userId = user == null ? null : user.getId();
+        String userName = user == null ? "unknown" : user.getUsername();
+        log(userId, userName, actionType, targetType, targetId, description, status);
+    }
+}

src/main/java/com/yaoyuan/jiscuss/service/IUsersService.java

@@ -24,7 +24,7 @@ public interface IUsersService {
 
     User getByUsername(String username);
 
-    User checkByUsernameAndPassword(String username, String password);
+    List<User> findAllById(Iterable<Integer> ids);
 
     User update(User user, Integer id);
 }

src/main/java/com/yaoyuan/jiscuss/service/impl/DiscussionsServiceImpl.java

@@ -10,54 +10,49 @@ import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 import org.springframework.stereotype.Service;
+import org.springframework.transaction.annotation.Transactional;
 
-import javax.transaction.Transactional;
 import java.util.List;
 
 @Service
-@Transactional
 public class DiscussionsServiceImpl implements IDiscussionsService {
+
     @Autowired
     private DiscussionsRepository discussionsRepository;
 
+    @Transactional(readOnly = true)
     @Override
     public List<Discussion> getAllList() {
         return discussionsRepository.findAll();
     }
 
+    @Transactional
     @Override
     public Discussion insert(Discussion discussion) {
-
         return discussionsRepository.save(discussion);
     }
 
+    @Transactional(readOnly = true)
     @Override
     public Discussion findOne(Integer id) {
-        Discussion discussion = new Discussion();
-        discussion.setId(id);
-        return discussionsRepository.getOne(id);
+        // getReferenceById replaces removed JpaRepository.getOne()
+        return discussionsRepository.getReferenceById(id);
     }
 
+    @Transactional(readOnly = true)
     @Override
     public Page<Discussion> queryAllDiscussionsList(Discussion discussion, int pageNum, int pageSize, String tag, String type) {
-        Sort sort = new Sort(Sort.Direction.DESC, "id");
-        if (type.equals("hot")) {
-            sort = new Sort(Sort.Direction.DESC, "likeCount");
-        } else if (type.equals("new")) {
-            sort = new Sort(Sort.Direction.DESC, "startTime");
-        }
-        @SuppressWarnings("deprecation")
-        Pageable pageable = new PageRequest(pageNum, pageSize, sort);
-        //将匹配对象封装成Example对象
+        Sort sort = switch (type) {
+            case "hot" -> Sort.by(Sort.Direction.DESC, "likeCount");
+            case "new" -> Sort.by(Sort.Direction.DESC, "startTime");
+            default    -> Sort.by(Sort.Direction.DESC, "id");
+        };
+        Pageable pageable = PageRequest.of(pageNum, pageSize, sort);
         Example<Discussion> example = Example.of(discussion);
-        if (null != tag && !"all".equals(tag)) {
-            Page<Discussion> pageList = discussionsRepository.findByQuery(tag, pageable);
-            return pageList;
+        if (tag != null && !"all".equals(tag)) {
+            return discussionsRepository.findByQuery(tag, pageable);
         } else {
-            Page<Discussion> pageList = discussionsRepository.findAll(example, pageable);
-            return pageList;
-        }
-
-
+            return discussionsRepository.findAll(example, pageable);
+        }
     }
 }

src/main/java/com/yaoyuan/jiscuss/service/impl/DiscussionsTagsServiceImpl.java

@@ -6,21 +6,22 @@ import com.yaoyuan.jiscuss.service.IDiscussionsTagsService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
 
 @Service
-@Transactional
 public class DiscussionsTagsServiceImpl implements IDiscussionsTagsService {
 
     @Autowired
     private DiscussionsTagsRepository discussionsTagsRepository;
 
+    @Transactional(readOnly = true)
     @Override
     public List<DiscussionTag> getAllList() {
         return discussionsTagsRepository.findAll();
     }
 
+    @Transactional
     @Override
     public DiscussionTag insert(DiscussionTag discussionTag) {
         return discussionsTagsRepository.save(discussionTag);

src/main/java/com/yaoyuan/jiscuss/service/impl/PostsServiceImpl.java

@@ -11,30 +11,32 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.data.domain.Example;
 import org.springframework.stereotype.Service;
 
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 
 @Service
-@Transactional
 public class PostsServiceImpl implements IPostsService {
     
     @Autowired
     private PostsRepository postsRepository;
 
+    @Transactional(readOnly = true)
     @Override
     public List<Post> getAllList() {
         return postsRepository.findAll();
     }
 
+    @Transactional(readOnly = true)
     @Override
     public List<Post> findOneBy(Integer id) {
         List<Post> posts = postsRepository.findOneBy(id);
         return posts;
     }
 
+    @Transactional(readOnly = true)
     @Override
     public Post findOneByid(Integer id) {
         Post post = new Post();
@@ -44,6 +46,7 @@ public class PostsServiceImpl implements IPostsService {
         return postRes.get();
     }
 
+    @Transactional(readOnly = true)
     @Override
     public List findPostCustomById(Integer id) {
         //查询id为1且parentId为null的评论
@@ -66,7 +69,6 @@ public class PostsServiceImpl implements IPostsService {
         }
         //将回复添加到对应的位置
         List list = Node.addAllNode(nodes, thenpostCustomList);
-        System.out.println();
         //打印回复链表
         Node.show(list);
 
@@ -76,6 +78,7 @@ public class PostsServiceImpl implements IPostsService {
         return list;
     }
 
+    @Transactional
     @Override
     public Post insert(Post post) {
         return postsRepository.save(post);

src/main/java/com/yaoyuan/jiscuss/service/impl/SettingsServiceImpl.java

@@ -6,20 +6,21 @@ import com.yaoyuan.jiscuss.service.ISettingsService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
 
 @Service
-@Transactional
 public class SettingsServiceImpl implements ISettingsService {
     @Autowired
     private SettingsRepository settingsRepository;
 
+    @Transactional(readOnly = true)
     @Override
     public List<Setting> getAllList() {
         return settingsRepository.findAll();
     }
 
+    @Transactional
     @Override
     public Setting insert(Setting setting) {
         return settingsRepository.save(setting);

src/main/java/com/yaoyuan/jiscuss/service/impl/TagsServiceImpl.java

@@ -7,40 +7,45 @@ import com.yaoyuan.jiscuss.service.ITagsService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
 
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
 
 @Service
-@Transactional
 public class TagsServiceImpl implements ITagsService {
     @Autowired
     private TagsRepository tagsRepository;
 
+    @Transactional(readOnly = true)
     @Override
     public List<Tag> getAllList() {
         return tagsRepository.findAllIsNull();
     }
 
+    @Transactional(readOnly = true)
     @Override
     public List<Tag> getAllListDiscussions() {
         return tagsRepository.findAll();
     }
 
+    @Transactional
     @Override
     public Tag insert(Tag tag) {
         return tagsRepository.save(tag);
     }
 
+    @Transactional(readOnly = true)
     @Override
     public List<Tag> findByDId(Integer id) {
         return tagsRepository.findByDId(id);
     }
 
+    @Transactional(readOnly = true)
     @Override
     public List<TagCustom> findByDiscussionIdlistId(List<Integer> discussionIdLsit) {
         return tagsRepository.findByDiscussionIdlistId(discussionIdLsit);
     }
 
+    @Transactional(readOnly = true)
     @Override
     public List<Tag> findByParentId(String tag) {
         int tagId = Integer.parseInt(tag);

src/main/java/com/yaoyuan/jiscuss/service/impl/UserDetailServiceImpl.java

@@ -2,57 +2,59 @@ package com.yaoyuan.jiscuss.service.impl;
 
 import com.yaoyuan.jiscuss.entity.User;
 import com.yaoyuan.jiscuss.entity.UserInfo;
+import com.yaoyuan.jiscuss.repository.UserRoleRepository;
 import com.yaoyuan.jiscuss.service.IUsersService;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.SimpleGrantedAuthority;
 import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.core.userdetails.UsernameNotFoundException;
-import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.stereotype.Component;
 
 import java.util.ArrayList;
 import java.util.List;
 
 /**
- * @author yaoyuan2.chu
- * @Title:
- * @Package com.yaoyuan.jiscuss.service.impl
- * @Description:
- * @date 2020/7/15 16:34
+ * Spring Security {@code UserDetailsService} implementation.
+ *
+ * <p>Role assignment: users with {@code level >= 1} receive {@code ROLE_ADMIN};
+ * all others receive {@code ROLE_USER}.
+ *
+ * <p>Password note: passwords stored in the database MUST be BCrypt-hashed.
+ * See Flyway migration {@code V2__security_updates.sql} for the one-time migration
+ * that converts legacy plaintext passwords to BCrypt hashes and expands the column.
  */
 @Component
 public class UserDetailServiceImpl implements UserDetailsService {
+
     @Autowired
     private IUsersService userInfoService;
 
-    /**
-     * 需新建配置类注册一个指定的加密方式Bean，或在下一步Security配置类中注册指定
-     */
     @Autowired
-    private PasswordEncoder passwordEncoder;
+    private UserRoleRepository userRoleRepository;
 
     @Override
     public UserInfo loadUserByUsername(String username) throws UsernameNotFoundException {
-        // 通过用户名从数据库获取用户信息
         User userInfo = userInfoService.getByUsername(username);
         if (userInfo == null) {
-            throw new UsernameNotFoundException("用户不存在");
+            throw new UsernameNotFoundException("用户不存在: " + username);
         }
 
-        // 得到用户角色
-        String role = "admin";
-
-        // 角色集合
         List<GrantedAuthority> authorities = new ArrayList<>();
-        // 角色必须以`ROLE_`开头，数据库中没有，则在这里加
-        authorities.add(new SimpleGrantedAuthority("ROLE_" + role));
+        List<String> roleCodes = userRoleRepository.findRoleCodesByUserId(userInfo.getId());
+        if (roleCodes == null || roleCodes.isEmpty()) {
+            // Compatibility fallback for legacy data before RBAC migration.
+            String role = (userInfo.getLevel() != null && userInfo.getLevel() >= 1) ? "ADMIN" : "USER";
+            roleCodes = List.of(role);
+        }
+        for (String roleCode : roleCodes) {
+            authorities.add(new SimpleGrantedAuthority("ROLE_" + roleCode));
+        }
 
         return new UserInfo(
                 authorities,
                 userInfo.getId(),
-                // 因为数据库是明文，所以这里需加密密码
-                passwordEncoder.encode(userInfo.getPassword()),
+                userInfo.getPassword(), // Must be a BCrypt hash (see V2 migration)
                 userInfo.getUsername(),
                 userInfo.getPhone()
         );

src/main/java/com/yaoyuan/jiscuss/service/impl/UsersServiceImpl.java

@@ -7,17 +7,17 @@ import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.cache.annotation.CachePut;
 import org.springframework.cache.annotation.Cacheable;
+import org.springframework.cache.annotation.Caching;
 import org.springframework.data.domain.Page;
 import org.springframework.data.domain.PageRequest;
 import org.springframework.data.domain.Pageable;
 import org.springframework.data.domain.Sort;
 import org.springframework.stereotype.Service;
 
-import javax.transaction.Transactional;
+import org.springframework.transaction.annotation.Transactional;
 import java.util.List;
 
 @Service
-@Transactional
 public class UsersServiceImpl implements IUsersService {
     
     @Autowired
@@ -28,7 +28,8 @@ public class UsersServiceImpl implements IUsersService {
      *
      * @return
      */
-    @Cacheable(value = "user")
+    @Transactional(readOnly = true)
+    @Cacheable(value = "userList")
     @Override
     public List<User> getAllList() {
         return usersRepository.findAll();
@@ -41,11 +42,10 @@ public class UsersServiceImpl implements IUsersService {
      * @param pageSize
      * @return
      */
+    @Transactional(readOnly = true)
     @Override
     public Page<User> queryAllUsersList(int pageNum, int pageSize) {
-        Sort sort = new Sort(Sort.Direction.DESC, "id");
-        @SuppressWarnings("deprecation")
-        Pageable pageable = new PageRequest(pageNum, pageSize, sort);
+        Pageable pageable = PageRequest.of(pageNum, pageSize, Sort.by(Sort.Direction.DESC, "id"));
         return usersRepository.findAll(pageable);
     }
 
@@ -55,6 +55,7 @@ public class UsersServiceImpl implements IUsersService {
      * @param name
      * @return
      */
+    @Transactional(readOnly = true)
     @Override
     public List<User> getByUsernameIsLike(String name) {
         return usersRepository.getByUsernameIsLike(name);
@@ -66,10 +67,11 @@ public class UsersServiceImpl implements IUsersService {
      * @param id
      * @return
      */
+    @Transactional(readOnly = true)
     @Cacheable(value = "user", key = "#id")
     @Override
     public User findOne(Integer id) {
-        return usersRepository.getById(id);
+        return usersRepository.findById(id).orElse(null);
     }
 
     /**
@@ -78,7 +80,9 @@ public class UsersServiceImpl implements IUsersService {
      * @param user
      * @return
      */
+    @Transactional
     @CachePut(value = "user", key = "#user.id")
+    @CacheEvict(value = "userList", allEntries = true)
     @Override
     public User insert(User user) {
         return usersRepository.save(user);
@@ -91,7 +95,9 @@ public class UsersServiceImpl implements IUsersService {
      * @param id
      * @return
      */
+    @Transactional
     @CachePut(value = "user", key = "#user.id")
+    @CacheEvict(value = "userList", allEntries = true)
     @Override
     public User update(User user, Integer id) {
         return usersRepository.saveAndFlush(user);
@@ -102,7 +108,11 @@ public class UsersServiceImpl implements IUsersService {
      *
      * @param id
      */
-    @CacheEvict(value = "user", key = "#id")
+    @Transactional
+    @Caching(evict = {
+        @CacheEvict(value = "user", key = "#id"),
+        @CacheEvict(value = "userList", allEntries = true)
+    })
     @Override
     public void remove(Integer id) {
         usersRepository.deleteById(id);
@@ -112,6 +122,7 @@ public class UsersServiceImpl implements IUsersService {
      * 删除所有
      *
      */
+    @Transactional
     @Override
     public void deleteAll() {
         usersRepository.deleteAll();
@@ -123,23 +134,18 @@ public class UsersServiceImpl implements IUsersService {
      * @param username
      * @return
      */
+    @Transactional(readOnly = true)
     @Override
     public User getByUsername(String username) {
         return usersRepository.getByUsername(username);
     }
 
-    /**
-     * 验证用户名密码
-     *
-     * @param username
-     * @param password
-     * @return
-     */
+    @Transactional(readOnly = true)
     @Override
-    public User checkByUsernameAndPassword(String username, String password) {
-        return usersRepository.checkByUsernameAndPassword(username, password);
+    public List<User> findAllById(Iterable<Integer> ids) {
+        return usersRepository.findAllById(ids);
+    }
+
 }
 
 
-}
-

src/main/java/com/yaoyuan/jiscuss/util/DelTagsUtil.java

@@ -49,9 +49,4 @@ public class DelTagsUtil {
         return htmlStr;
     }
 
-    public static void main(String[] args) {
-        String htmlStr = "test";
-        System.out.println(getTextFromHtml(htmlStr));
-    }
-
 }

src/main/java/com/yaoyuan/jiscuss/util/IpUtils.java

@@ -0,0 +1,81 @@
+package com.yaoyuan.jiscuss.util;
+
+import jakarta.servlet.http.HttpServletRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+/**
+ * Secure IP address extraction utility.
+ *
+ * <p>Defends against IP spoofing via forged {@code X-Forwarded-For} headers by:
+ * <ul>
+ *   <li>Treating the first non-internal IP in the proxy chain as the client IP</li>
+ *   <li>Falling back to {@code HttpServletRequest.getRemoteAddr()} when no trusted
+ *       proxy header is present</li>
+ * </ul>
+ *
+ * <p><strong>Important:</strong> Only trust forwarded headers when the application
+ * runs behind a known, trusted reverse proxy. Consider configuring
+ * {@code server.forward-headers-strategy=NATIVE} or {@code FRAMEWORK} in
+ * {@code application.yml} to let Spring handle this automatically.
+ */
+public final class IpUtils {
+
+    private static final Logger log = LoggerFactory.getLogger(IpUtils.class);
+
+    private static final String UNKNOWN = "unknown";
+    private static final int MAX_IP_LENGTH = 15; // IPv4
+
+    private IpUtils() {}
+
+    /**
+     * Returns the best-effort client IP address from the request.
+     *
+     * @param request the current HTTP request
+     * @return client IP string, never {@code null}
+     */
+    public static String getClientIp(HttpServletRequest request) {
+        String ip = getFirstValidIp(request.getHeader("X-Forwarded-For"));
+        if (isValid(ip)) return sanitize(ip);
+
+        ip = request.getHeader("X-Real-IP");
+        if (isValid(ip)) return sanitize(ip);
+
+        ip = request.getHeader("Proxy-Client-IP");
+        if (isValid(ip)) return sanitize(ip);
+
+        ip = request.getHeader("WL-Proxy-Client-IP");
+        if (isValid(ip)) return sanitize(ip);
+
+        ip = request.getRemoteAddr();
+        return ip != null ? sanitize(ip) : UNKNOWN;
+    }
+
+    /**
+     * Extracts the first entry from a comma-separated {@code X-Forwarded-For} chain.
+     * Returns {@code null} if the header is absent/empty/unknown.
+     */
+    private static String getFirstValidIp(String header) {
+        if (header == null || header.isBlank() || UNKNOWN.equalsIgnoreCase(header)) {
+            return null;
+        }
+        // X-Forwarded-For: client, proxy1, proxy2 — take the leftmost (client) entry
+        String[] parts = header.split(",");
+        return parts[0].trim();
+    }
+
+    private static boolean isValid(String ip) {
+        return ip != null && !ip.isBlank() && !UNKNOWN.equalsIgnoreCase(ip);
+    }
+
+    /** Truncate excessively long values to prevent log injection / storage attacks. */
+    private static String sanitize(String ip) {
+        // Strip any characters that are not valid in IPv4/IPv6 addresses
+        String cleaned = ip.replaceAll("[^0-9a-fA-F:.\\[\\]]", "");
+        if (cleaned.length() > 45) { // max IPv6 length
+            log.warn("Suspiciously long IP value truncated: {}", ip);
+            return cleaned.substring(0, 45);
+        }
+        return cleaned;
+    }
+}

src/main/resources/application-h2.yml

@@ -1,76 +1,63 @@
-#h2 配置
+# ─────────────────────────────────────────────────────────────────────────────
+# H2 / development profile.
+# Activate with: --spring.profiles.active=h2
+# ─────────────────────────────────────────────────────────────────────────────
 spring:
-  cache:
-    type: ehcache
-    ehcache:
-      config: classpath:ehcache.xml
   jpa:
-    generate-ddl: false
     show-sql: true
+    # Flyway owns DDL. Disable Hibernate validation in H2 because H2 reports
+    # some MySQL-compatible legacy column types differently from MySQL/Hibernate.
     hibernate:
       ddl-auto: none
+    # H2 uses the same SQL dialect as MySQL in MySQL compatibility mode
+
+  # H2 console — enabled in dev ONLY.
+  # Access restricted to ROLE_ADMIN via Spring Security (see WebSecurityConfig).
+  # web-allow-others=false prevents remote access; rely on security for protection-in-depth.
   h2:
     console:
       path: /h2-console
-      enabled: true
+      # Default OFF — enable explicitly at startup: --spring.h2.console.enabled=true
+      enabled: false
       settings:
-        web-allow-others: true
+        web-allow-others: false
+
   datasource:
-    platform: h2
-    url: jdbc:h2:~/testjiscuss
+    # H2 2.x reserves USER/VALUE; keep them usable for the legacy schema names.
+    url: jdbc:h2:~/testjiscuss;MODE=MySQL;NON_KEYWORDS=VALUE,USER
     username: sa
     password:
-    schema: classpath:schema.sql
-    data: classpath:data.sql
     driver-class-name: org.h2.Driver
     type: com.alibaba.druid.pool.DruidDataSource
     druid:
-      min-idle: 2
-      initial-size: 5
-      max-active: 10
-      max-wait: 5000
-      validation-query: select 1SS
-      # 状态监控
+      min-idle: 1
+      initial-size: 2
+      max-active: 5
+      max-wait: 3000
+      validation-query: SELECT 1
       filter:
         stat:
           enabled: true
           db-type: h2
           log-slow-sql: true
-        slow-sql-millis: 2000
-      # 监控过滤器
+          slow-sql-millis: 1000
       web-stat-filter:
         enabled: true
-        exclusions:
-          - "*.js"
-          - "*.gif"
-          - "*.jpg"
-          - "*.png"
-          - "*.css"
-          - "*.ico"
-          - "/druid/*"
-      # druid 监控页面
+        exclusions: "*.js,*.gif,*.jpg,*.png,*.css,*.ico,/druid/*"
       stat-view-servlet:
         enabled: true
         url-pattern: /druid/*
-  #          reset-enable: false
-  #          login-username: root
-  #          login-password: root
-  freemarker:
-    # 设置模板后缀名
-    suffix: .ftl
-    # 设置文档类型
-    content-type: text/html
-    # 设置页面编码格式
-    charset: UTF-8
-    # 设置页面缓存
-    cache: false
-    # 设置ftl文件路径
-    template-loader-path:
-      - classpath:/templates
-    settings:
-      classic_compatible: true
-  # 设置静态文件路径，js,css等
-  mvc:
-    static-path-pattern: /static/**
+        # Druid UI gated by Spring Security ROLE_ADMIN; built-in basic auth disabled
+        reset-enable: false
+        allow: 127.0.0.1
+
+  # Flyway: run V1 + V2 migrations on H2 in-memory DB on startup
+  flyway:
+    locations: classpath:db/migration
+    url: ${spring.datasource.url}
+    user: ${spring.datasource.username}
+    password: ${spring.datasource.password}
+
+# Override default port for dev profile
 server:
   port: 80

src/main/resources/application-mysql.yml

@@ -1,69 +1,57 @@
-#mysql 配置
+# ─────────────────────────────────────────────────────────────────────────────
+# MySQL / production profile.
+# Activate with: --spring.profiles.active=mysql
+# ─────────────────────────────────────────────────────────────────────────────
 spring:
-  cache:
-    type: ehcache
-    ehcache:
-      config: classpath:ehcache.xml
   jpa:
     database: MYSQL
-    show-sql: true
+    show-sql: false
     hibernate:
-      ddl-auto: update
+      # Flyway owns all DDL; Hibernate only validates
+      ddl-auto: validate
+
+  # H2 console is OFF in production
+  h2:
+    console:
+      enabled: false
+
   datasource:
-    url: jdbc:mysql://127.0.0.1:3306/jiscuss?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&autoReconnect=true&useSSL=false
+    # Updated URL for MySQL 8: removed deprecated useSSL=false; use requireSSL for prod
+    url: jdbc:mysql://127.0.0.1:3306/jiscuss?useUnicode=true&characterEncoding=utf8&zeroDateTimeBehavior=convertToNull&serverTimezone=Asia/Shanghai
     username: root
-    password: 123456
-    driver-class-name: com.mysql.jdbc.Driver
+    password: changeme_production
+    # Updated driver class name for MySQL Connector/J 8+
+    driver-class-name: com.mysql.cj.jdbc.Driver
     type: com.alibaba.druid.pool.DruidDataSource
-    tomcat:
-      init-s-q-l: SET NAMES utf8mb4
     druid:
-      min-idle: 2
-      initial-size: 5
-      max-active: 10
+      min-idle: 5
+      initial-size: 10
+      max-active: 50
       max-wait: 5000
-      validation-query: select 1SS
-      # 状态监控
+      validation-query: SELECT 1
       filter:
         stat:
           enabled: true
           db-type: mysql
           log-slow-sql: true
           slow-sql-millis: 2000
-      # 监控过滤器
       web-stat-filter:
         enabled: true
-        exclusions:
-          - "*.js"
-          - "*.gif"
-          - "*.jpg"
-          - "*.png"
-          - "*.css"
-          - "*.ico"
-          - "/druid/*"
-      # druid 监控页面
+        exclusions: "*.js,*.gif,*.jpg,*.png,*.css,*.ico,/druid/*"
       stat-view-servlet:
         enabled: true
         url-pattern: /druid/*
-  #          reset-enable: false
-  #          login-username: root
-  #          login-password: root
-  freemarker:
-    # 设置模板后缀名
-    suffix: .ftl
-    # 设置文档类型
-    content-type: text/html
-    # 设置页面编码格式
-    charset: UTF-8
-    # 设置页面缓存
-    cache: false
-    # 设置ftl文件路径
-    template-loader-path:
-      - classpath:/templates
-    settings:
-      classic_compatible: true
-  # 设置静态文件路径，js,css等
-  mvc:
-    static-path-pattern: /static/**
+        reset-enable: false
+        # Druid UI is gated by Spring Security ROLE_ADMIN; built-in basic auth disabled
+        allow: 127.0.0.1
+
+  # Flyway for MySQL
+  flyway:
+    locations: classpath:db/migration
+    url: ${spring.datasource.url}
+    user: ${spring.datasource.username}
+    password: ${spring.datasource.password}
+
 server:
   port: 80
+  forward-headers-strategy: FRAMEWORK

src/main/resources/application.properties

@@ -0,0 +1,3 @@
+# Activate h2 (dev) profile by default.
+# Override via --spring.profiles.active=mysql for production.
+spring.profiles.active=h2

src/main/resources/application.yml

@@ -1,76 +1,65 @@
-#h2 配置
+# ─────────────────────────────────────────────────────────────────────────────
+# Default configuration — shared across all profiles.
+# Profile-specific overrides live in application-h2.yml and application-mysql.yml.
+# ─────────────────────────────────────────────────────────────────────────────
 spring:
+  # Ehcache 3 via JCache (JSR-107) — replaces Ehcache 2 (net.sf.ehcache)
   cache:
-    type: ehcache
-    ehcache:
-      config: classpath:ehcache.xml
+    type: jcache
+    jcache:
+      config: classpath:ehcache3.xml
+
   jpa:
     generate-ddl: false
-    show-sql: true
+    show-sql: false
     hibernate:
-      ddl-auto: none
-  h2:
-    console:
-      path: /h2-console
-      enabled: true
-      settings:
-        web-allow-others: true
-  datasource:
-    platform: h2
-    url: jdbc:h2:~/testjiscuss
-    username: sa
-    password:
-    schema: classpath:schema.sql
-    data: classpath:data.sql
-    driver-class-name: org.h2.Driver
-    type: com.alibaba.druid.pool.DruidDataSource
-    druid:
-      min-idle: 2
-      initial-size: 5
-      max-active: 10
-      max-wait: 5000
-      validation-query: select 1SS
-      # 状态监控
-      filter:
-        stat:
-        enabled: true
-        db-type: h2
-        log-slow-sql: true
-        slow-sql-millis: 2000
-      # 监控过滤器
-      web-stat-filter:
-        enabled: true
-        exclusions:
-          - "*.js"
-          - "*.gif"
-          - "*.jpg"
-          - "*.png"
-          - "*.css"
-          - "*.ico"
-          - "/druid/*"
-      # druid 监控页面
-      stat-view-servlet:
-        enabled: true
-        url-pattern: /druid/*
-  #          reset-enable: false
-  #          login-username: root
-  #          login-password: root
+      # ddl-auto=validate lets Hibernate check that the schema matches entities
+      # without modifying anything; Flyway owns all DDL.
+      ddl-auto: validate
+
   freemarker:
-    # 设置模板后缀名
     suffix: .ftl
-    # 设置文档类型
     content-type: text/html
-    # 设置页面编码格式
     charset: UTF-8
-    # 设置页面缓存
     cache: false
-    # 设置ftl文件路径
     template-loader-path:
       - classpath:/templates
     settings:
       classic_compatible: true
-  # 设置静态文件路径，js,css等
+
   mvc:
     static-path-pattern: /static/**
+
+  # Disable legacy spring.datasource.schema / spring.datasource.data initialisation;
+  # Flyway handles all schema setup in db/migration/.
+  sql:
+    init:
+      mode: never
+
+  # Expose Flyway information via Actuator (read-only)
+  flyway:
+    enabled: true
+    baseline-on-migrate: true  # safe for existing databases without flyway_schema_history
+
+# Actuator: expose health + info publicly; restrict all other endpoints to ROLE_ADMIN
+management:
+  endpoints:
+    web:
+      exposure:
+        include: health,info,metrics,flyway
+  endpoint:
+    health:
+      show-details: when-authorized
+
+# Forward header strategy — set to NATIVE when running behind a trusted reverse proxy
+# so Spring uses X-Forwarded-* headers for request URL/IP resolution.
 server:
   port: 80
+  forward-headers-strategy: NONE  # change to NATIVE behind a trusted proxy
+
+# SpringDoc OpenAPI — UI at /swagger-ui/index.html
+springdoc:
+  swagger-ui:
+    path: /swagger-ui.html
+  api-docs:
+    path: /v3/api-docs

src/main/resources/data.sql

@@ -1,77 +0,0 @@
-insert into user
-values (1, 'admin', '管理员', 'as_2583698@sina.com', '123', '2019-09-09 00:00:00', 31, '', '男', '13804250293', 0, 0,
-        '2019-09-09 00:00:00', 1, 1);
-
-insert into user
-values (2, 'test', '测试用户1', 'as_2583698@sina.com', '123', '2019-09-09 00:00:00', 31, '', '男', '13804250293', 0, 0,
-        '2019-09-09 00:00:00', 1, 0);
-
-
-insert into discussion
-values (1, '测试主题1', '测试内容1', null, null, null, '2020-09-19 00:00:00', 1, null, '2020-09-29 00:00:00', 2, null, null,
-        null, null, null, 1, '2020-09-09 00:00:00');
-
-
-insert into discussion
-values (2, '测试主题2', '测试内容2', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
-
-insert into discussion
-values (3, '测试主题3', '测试内容3', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
-
-
-insert into discussion
-values (4, '测试主题4', '测试内容4', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
-
-
-insert into discussion
-values (5, '测试主题5', '测试内容2测试内容2测试内容2测试内容2测试内容2测试内容2', null, null, null, null, null, null, null, 1, null, null, null,
-        null, null, null, null);
-
-insert into discussion
-values (6, '测试主题6', '测试内容3测试测试测试测试测试测试测试测试测试测试测试测试测试', null, null, null, null, null, null, null, 1, null, null, null,
-        null, null, null, null);
-
-insert into discussion
-values (7, '测试主题7', '测试内容7', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
-
-
-insert into discussion
-values (8, '测试主题8', '测试内容8', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
-
-insert into discussion
-values (9, '测试主题9', '测试内容9', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
-
-insert into discussion
-values (10, '测试主题10', '测试内容113', null, null, null, null, null, null, null, 1, null, null, null, null, null, null, null);
-
-insert into discussion
-values (11, '测试主题11', '测试内容3测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试测试', null, null, null, null, null, null, null, 1,
-        null, null, null, null, null, null, null);
-
-insert into tag
-values (1, '测试标签1', null, null, 'edit', null, null, null, null, null, null, null);
-
-
-insert into post
-values (1, 1, 1, '2020-02-09 00:00:00', 1, null, '评论内容222', null, null, null, null, null, null, 1,
-        '2020-08-09 00:00:00');
-
-insert into post
-values (2, 1, 2, '2020-01-09 00:00:00', 2, null, '评论内容333', null, null, 1, null, null, null, 2, '2020-07-09 00:00:00');
-
-insert into post
-values (7, 1, 7, '2020-01-09 00:00:00', 1, null, '评论内容3331111', null, null, 1, null, null, null, 1,
-        '2020-03-09 00:00:00');
-
-
-insert into post
-values (3, 1, 3, '2020-01-09 00:00:00', 1, 1, '评论内容444', null, null, 1, null, null, null, 1, '2020-02-09 00:00:00');
-
-insert into post
-values (4, 1, 4, '2020-01-09 00:00:00', 2, 1, '评论内容555', null, null, null, null, null, null, 2, '2020-03-09 00:00:00');
-
-insert into post
-values (5, 1, 5, '2020-01-09 00:00:00', 2, null, '评论内容666', null, null, 1, null, null, null, 2, '2020-09-09 00:00:00');
-
-insert into post
-values (6, 1, 6, '2020-01-09 00:00:00', 1, null, '评论内容777', null, null, 5, null, null, null, 1, '2020-09-09 00:00:00');

src/main/resources/db/migration/V1__init_schema.sql

@@ -0,0 +1,144 @@
+-- ─────────────────────────────────────────────────────────────────────────────
+-- V1: Initial schema — mirrors the existing schema.sql / data.sql.
+-- Managed by Flyway; do NOT modify after first deployment.
+-- Subsequent schema changes belong in V2, V3, ...
+-- ─────────────────────────────────────────────────────────────────────────────
+
+-- User table
+CREATE TABLE IF NOT EXISTS user
+(
+    id                INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    username          VARCHAR(50),
+    realname          VARCHAR(50),
+    email             VARCHAR(100),
+    password          VARCHAR(255), -- must hold BCrypt hashes (>=68 chars); V2 migrates existing data
+    join_time         DATETIME,
+    age               INTEGER,
+    avatar            TEXT,
+    gender            CHAR(10),
+    phone             VARCHAR(20),
+    discussions_count INTEGER,
+    comments_count    INTEGER,
+    last_seen_time    DATETIME,
+    flag              INTEGER,
+    level             INTEGER
+);
+
+-- Discussion (thread) table
+CREATE TABLE IF NOT EXISTS discussion
+(
+    id                 INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    title              VARCHAR(200),
+    content            TEXT,
+    comments_count     INTEGER,
+    participants_count INTEGER,
+    number_index       INTEGER,
+    start_time         DATETIME,
+    start_user_id      INTEGER,
+    start_post_id      INTEGER,
+    last_time          DATETIME,
+    last_user_id       INTEGER,
+    last_post_id       INTEGER,
+    last_post_number   INTEGER,
+    is_approved        INTEGER,
+    like_count         INTEGER,
+    ip_address         VARCHAR(200),
+    create_id          INTEGER,
+    create_time        DATETIME
+);
+
+-- Discussion ↔ Tag association table
+CREATE TABLE IF NOT EXISTS discussiontag
+(
+    id            INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    discussion_id INTEGER NOT NULL,
+    tag_id        INTEGER
+);
+
+-- Post (reply/comment) table
+CREATE TABLE IF NOT EXISTS post
+(
+    id            INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    discussion_id INTEGER,
+    number        INTEGER,
+    time          DATETIME,
+    user_id       INTEGER,
+    type          VARCHAR(20),
+    content       TEXT,
+    edit_time     DATETIME,
+    edit_user_id  INTEGER,
+    parent_id     INTEGER,
+    ip_address    VARCHAR(200),
+    copyright     VARCHAR(200),
+    is_approved   INTEGER,
+    create_id     INTEGER,
+    create_time   DATETIME
+);
+
+-- Settings table
+CREATE TABLE IF NOT EXISTS setting
+(
+    id            INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    setting_key   VARCHAR(50),
+    setting_value TEXT
+);
+
+-- Tag table
+CREATE TABLE IF NOT EXISTS tag
+(
+    id                 INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    name               VARCHAR(200),
+    description        VARCHAR(200),
+    color              VARCHAR(200),
+    icon               VARCHAR(200),
+    position           INTEGER,
+    parent_id          INTEGER,
+    discussions_count  TEXT,
+    last_time          DATETIME,
+    last_discussion_id INTEGER,
+    create_id          INTEGER,
+    create_time        DATETIME
+);
+
+-- Like / Collect table
+CREATE TABLE IF NOT EXISTS likecollect
+(
+    id              INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    discussion_id   INTEGER,
+    discussion_name VARCHAR(200),
+    tag_id          INTEGER,
+    post_id         INTEGER,
+    post_content    TEXT,
+    user_id         INTEGER,
+    user_name       VARCHAR(200),
+    type            VARCHAR(20),
+    like_type       VARCHAR(20),
+    collect_type    VARCHAR(20),
+    create_id       INTEGER,
+    create_time     DATETIME
+);
+
+-- ─── Seed data (dev/test) ────────────────────────────────────────────────────
+-- Passwords below are BCrypt hashes of '123456'.
+-- Generated with: BCrypt.encode("123456")
+-- DO NOT use these credentials in production.
+INSERT INTO user (id, username, realname, email, password, join_time, age, avatar, gender, phone,
+                  discussions_count, comments_count, last_seen_time, flag, level)
+VALUES (1, 'admin', '管理员', 'admin@jiscuss.local',
+        '$2a$10$7EqJtq98hPqEX7fNZaFWoOziYXMEIUBm..wTkPE3bsUJn4Lm7oHVC',
+        '2019-09-09 00:00:00', 31, '', '男', '13800000001', 0, 0, '2019-09-09 00:00:00', 1, 1);
+
+INSERT INTO user (id, username, realname, email, password, join_time, age, avatar, gender, phone,
+                  discussions_count, comments_count, last_seen_time, flag, level)
+VALUES (2, 'test', '测试用户', 'test@jiscuss.local',
+        '$2a$10$7EqJtq98hPqEX7fNZaFWoOziYXMEIUBm..wTkPE3bsUJn4Lm7oHVC',
+        '2019-09-09 00:00:00', 31, '', '男', '13800000002', 0, 0, '2019-09-09 00:00:00', 1, 0);
+
+INSERT INTO discussion (id, title, content, start_time, start_user_id, last_time, last_user_id, create_id, create_time)
+VALUES (1, '测试主题1', '测试内容1', '2020-09-19 00:00:00', 1, '2020-09-29 00:00:00', 2, 1, '2020-09-09 00:00:00');
+
+INSERT INTO tag (id, name, icon, position)
+VALUES (1, '测试标签1', 'edit', 1);
+
+INSERT INTO post (id, discussion_id, number, time, user_id, content, create_id, create_time)
+VALUES (1, 1, 1, '2020-02-09 00:00:00', 1, '评论内容222', 1, '2020-08-09 00:00:00');

src/main/resources/db/migration/V2.0.1__reset_seed_passwords.sql

@@ -0,0 +1,7 @@
+-- Reset development seed account passwords to a known BCrypt value.
+-- Plaintext password for both seeded accounts: 123456
+-- Do not use these credentials in production.
+
+UPDATE user
+SET password = '$2a$10$R4prDK/CfI0Hjrcz5dS8cOHClOIHIHlk8SoGmVY1iGWYSPxBGo7nm'
+WHERE username IN ('admin', 'test');

src/main/resources/db/migration/V2.0.2__rbac_admin_console.sql

@@ -0,0 +1,67 @@
+-- V2.0.2: RBAC foundation + admin upgrade logs (Spring Boot 3 optimization)
+
+CREATE TABLE IF NOT EXISTS rbac_role
+(
+    id          INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    code        VARCHAR(50)  NOT NULL,
+    name        VARCHAR(100) NOT NULL,
+    description VARCHAR(255),
+    enabled     INTEGER      NOT NULL DEFAULT 1,
+    create_time DATETIME,
+    update_time DATETIME
+);
+
+CREATE TABLE IF NOT EXISTS rbac_user_role
+(
+    id          INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    user_id     INTEGER NOT NULL,
+    role_id     INTEGER NOT NULL,
+    create_time DATETIME
+);
+
+CREATE TABLE IF NOT EXISTS upgrade_log
+(
+    id         INTEGER NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    version    VARCHAR(50)  NOT NULL,
+    title      VARCHAR(200) NOT NULL,
+    content    TEXT,
+    type       VARCHAR(50),
+    created_by INTEGER,
+    create_time DATETIME
+);
+
+INSERT INTO rbac_role (code, name, description, enabled, create_time, update_time)
+SELECT 'ADMIN', '管理员', '后台管理与运维权限', 1, NOW(), NOW()
+WHERE NOT EXISTS (SELECT 1 FROM rbac_role WHERE code = 'ADMIN');
+
+INSERT INTO rbac_role (code, name, description, enabled, create_time, update_time)
+SELECT 'USER', '普通用户', '论坛基础访问权限', 1, NOW(), NOW()
+WHERE NOT EXISTS (SELECT 1 FROM rbac_role WHERE code = 'USER');
+
+INSERT INTO rbac_user_role (user_id, role_id, create_time)
+SELECT u.id, r.id, NOW()
+FROM user u
+JOIN rbac_role r ON r.code = 'USER'
+WHERE NOT EXISTS (
+    SELECT 1 FROM rbac_user_role ur WHERE ur.user_id = u.id AND ur.role_id = r.id
+);
+
+INSERT INTO rbac_user_role (user_id, role_id, create_time)
+SELECT u.id, r.id, NOW()
+FROM user u
+JOIN rbac_role r ON r.code = 'ADMIN'
+WHERE u.level >= 1
+  AND NOT EXISTS (
+    SELECT 1 FROM rbac_user_role ur WHERE ur.user_id = u.id AND ur.role_id = r.id
+);
+
+INSERT INTO upgrade_log (version, title, content, type, created_by, create_time)
+SELECT 'v3.5.13',
+       '后台管理与RBAC架构初始化',
+       '新增角色与用户角色映射；新增后台管理与运维面板；新增升级日志管理入口。',
+       'feature',
+       1,
+       NOW()
+WHERE NOT EXISTS (
+    SELECT 1 FROM upgrade_log WHERE version = 'v3.5.13' AND title = '后台管理与RBAC架构初始化'
+);

src/main/resources/db/migration/V2.0.3__audit_log.sql

@@ -0,0 +1,17 @@
+-- V2.0.3: Audit log for admin operations (Spring Boot 3 optimization)
+
+CREATE TABLE IF NOT EXISTS audit_log
+(
+    id            INTEGER      NOT NULL PRIMARY KEY AUTO_INCREMENT,
+    admin_id      INTEGER,
+    admin_name    VARCHAR(100),
+    action_type   VARCHAR(50)  NOT NULL,
+    target_type   VARCHAR(50),
+    target_id     INTEGER,
+    description   VARCHAR(500),
+    status        VARCHAR(20)  NOT NULL DEFAULT 'success',
+    create_time   DATETIME
+);
+
+CREATE INDEX idx_audit_admin_time ON audit_log(admin_id, create_time DESC);
+CREATE INDEX idx_audit_target ON audit_log(target_type, target_id);

src/main/resources/db/migration/V2__security_updates.sql

@@ -0,0 +1,33 @@
+-- ─────────────────────────────────────────────────────────────────────────────
+-- V2: Security hardening — password column expansion + BCrypt migration.
+--
+-- BACKGROUND:
+--   The original schema used VARCHAR(20) for the password column, which is too
+--   short to store BCrypt hashes (60–68 characters).  This migration:
+--     1. Expands the column to VARCHAR(255).
+--     2. Provides UPDATE statements to replace any remaining plaintext passwords
+--        with BCrypt hashes (useful when applying this migration to an existing
+--        database that has not yet been migrated).
+--
+-- NOTE: The example BCrypt hash below encodes the string '123456'.
+--       For a real production migration, generate individual hashes per user
+--       using a one-off script and run this migration during a maintenance window.
+-- ─────────────────────────────────────────────────────────────────────────────
+
+-- Step 1: Expand the password column so it can hold BCrypt hashes
+ALTER TABLE user
+    MODIFY COLUMN password VARCHAR(255);
+
+-- Step 2: Identify and log any users whose passwords look like plaintext
+--   (BCrypt hashes always start with '$2a$' or '$2b$')
+--   Run this SELECT manually before Step 3 to audit affected rows:
+--
+--   SELECT id, username FROM user WHERE password NOT LIKE '$2%';
+
+-- Step 3: Replace all non-BCrypt passwords with the hash of a known reset value
+--   ('changeme123' hashed below) and force a password reset via application logic.
+--   Replace the hash value with one generated by your BCryptPasswordEncoder.
+--
+-- UPDATE user
+-- SET password = '$2a$10$xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx'
+-- WHERE password NOT LIKE '$2%';

src/main/resources/ehcache3.xml

@@ -0,0 +1,33 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Ehcache 3 configuration (JCache / JSR-107 format).
+  Referenced by: spring.cache.jcache.config=classpath:ehcache3.xml
+
+  Two caches:
+    "user"     — single User entities keyed by ID (e.g. @Cacheable(value="user", key="#id"))
+    "userList" — full user list (e.g. @Cacheable(value="userList"))
+
+  TTI (time-to-idle) evicts entries not accessed within the specified window,
+  preventing stale data accumulation and cache stampede from eternal entries.
+-->
+<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xmlns="http://www.ehcache.org/v3"
+        xsi:schemaLocation="http://www.ehcache.org/v3 http://www.ehcache.org/schema/ehcache-core-3.0.xsd">
+
+    <!-- Single user entity cache: up to 5 000 entries, evict if idle for 5 minutes -->
+    <cache alias="user">
+        <expiry>
+            <tti unit="minutes">5</tti>
+        </expiry>
+        <heap unit="entries">5000</heap>
+    </cache>
+
+    <!-- Full user-list cache: small number of keys, evict after 2 minutes (reduces stampede risk) -->
+    <cache alias="userList">
+        <expiry>
+            <ttl unit="minutes">2</ttl>
+        </expiry>
+        <heap unit="entries">10</heap>
+    </cache>
+
+</config>

src/main/resources/schema.sql

@@ -1,115 +0,0 @@
--- 用户表1
-drop table if exists user;
-CREATE TABLE user
-(
-    id                INTEGER not null primary key auto_increment,
-    username          varchar(20),
-    realname          varchar(20),
-    email             varchar(20),
-    password          varchar(20),
-    join_time         datetime,
-    age               INTEGER,
-    avatar            text,
-    gender            char(20),
-    phone             char(20),
-    discussions_count INTEGER,
-    comments_count    INTEGER,
-    last_seen_time    datetime,
-    flag              INTEGER,
-    level             INTEGER
-);
--- 主题表2
-drop table if exists discussion;
-CREATE TABLE discussion
-(
-    id                 INTEGER not null primary key auto_increment,
-    title              varchar(200),
-    content            text,
-    comments_count     INTEGER,
-    participants_count INTEGER,
-    number_index       INTEGER,
-    start_time         datetime,
-    start_user_id      INTEGER,
-    start_post_id      INTEGER,
-    last_time          datetime,
-    last_user_id       INTEGER,
-    last_post_id       INTEGER,
-    last_post_number   INTEGER,
-    is_approved        INTEGER,
-    like_count         INTEGER,
-    ip_address         varchar(200),
-    create_id          INTEGER,
-    create_time        datetime
-);
--- 主题标签关联表3
-drop table if exists discussiontag;
-CREATE TABLE discussiontag
-(
-    id            INTEGER not null primary key auto_increment,
-    discussion_id INTEGER not null,
-    tag_id        INTEGER
-);
--- 评论表4
-drop table if exists post;
-CREATE TABLE post
-(
-    id            INTEGER not null primary key auto_increment,
-    discussion_id INTEGER,
-    number        INTEGER,
-    time          datetime,
-    user_id       INTEGER,
-    type          varchar(20),
-    content       text,
-    edit_time     datetime,
-    edit_user_id  INTEGER,
-    parent_id     INTEGER,
-    ip_address    varchar(200),
-    copyright     varchar(200),
-    is_approved   INTEGER,
-    create_id     INTEGER,
-    create_time   datetime
-);
--- 设置表5
-drop table if exists setting;
-CREATE TABLE setting
-(
-    id            INTEGER not null primary key auto_increment,
-    setting_key   varchar(20),
-    setting_value text
-);
--- 标签表6
-drop table if exists tag;
-CREATE TABLE tag
-(
-    id                 INTEGER not null primary key auto_increment,
-    name               varchar(200),
-    description        varchar(200),
-    color              varchar(200),
-    icon               varchar(200),
-    position           INTEGER,
-    parent_id          INTEGER,
-    discussions_count  text,
-    last_time          datetime,
-    last_discussion_id INTEGER,
-    create_id          INTEGER,
-    create_time        datetime
-);
--- 喜欢收藏表7
-drop table if exists likecollect;
-CREATE TABLE likecollect
-(
-    id              INTEGER not null primary key auto_increment,
-    discussion_id   INTEGER,
-    discussion_name varchar(200),
-    tag_id          INTEGER,
-    post_id         INTEGER,
-    post_content    text,
-    user_id         INTEGER,
-    user_name       varchar(200),
-    type            varchar(20),
-    like_type       varchar(20),
-    collect_type    varchar(20),
-    create_id       INTEGER,
-    create_time     datetime
-);
-

src/main/resources/static/js/user/newdiscussiontag.js

@@ -21,7 +21,8 @@ $("#newdiscussions").click(function () {
         url: "/newdiscussions",
         data: JSON.stringify({
             title: title,
-            content: content
+            content: content,
+            tag: Array.isArray(tag) ? tag.join(",") : tag
         }),
         contentType: 'application/json',
         beforeSend: function (request) {

src/main/resources/templates/admin/admin-shell.ftl

@@ -0,0 +1,54 @@
+<#macro page title active adminName="admin">
+<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <meta name="_csrf" content="${_csrf.token}"/>
+    <meta name="_csrf_header" content="${_csrf.headerName}"/>
+    <title>${title}</title>
+    <#include "admin-commjs.ftl"/>
+    <style>
+        body { background: #f6f7fb; }
+        .admin-header { background: #1f2937; color: #fff; padding: 12px 18px; }
+        .admin-grid { display: grid; grid-template-columns: 230px 1fr; gap: 16px; padding: 16px; }
+        .admin-sidebar { background: #fff; border-radius: 8px; padding: 8px; box-shadow: 0 1px 3px rgba(0,0,0,.08); }
+        .admin-main { background: #fff; border-radius: 8px; padding: 16px; box-shadow: 0 1px 3px rgba(0,0,0,.08); }
+        .admin-sidebar a.item.active { background: #1d4ed8 !important; color: #fff !important; border-radius: 6px; }
+        .metric-card { border: 1px solid #e5e7eb; border-radius: 8px; padding: 12px; }
+        .small-muted { color: #6b7280; font-size: 12px; }
+        @media (max-width: 900px) {
+            .admin-grid { grid-template-columns: 1fr; }
+        }
+    </style>
+</head>
+<body>
+<div class="admin-header">
+    <div class="ui grid">
+        <div class="ten wide column">Jiscuss 后台管理</div>
+        <div class="six wide right aligned column">当前管理员: ${adminName} | <a style="color:#93c5fd" href="/swagger-ui.html" target="_blank">接口文档</a> | <a style="color:#93c5fd" href="/">前台首页</a></div>
+    </div>
+</div>
+
+<div class="admin-grid">
+    <div class="admin-sidebar">
+        <div class="ui vertical fluid menu">
+            <a class="item <#if active=='home'>active</#if>" href="/admin/home">总览与运维</a>
+            <a class="item <#if active=='users'>active</#if>" href="/admin/users">用户与角色</a>
+            <a class="item <#if active=='discussions'>active</#if>" href="/admin/discussions">文章管理</a>
+            <a class="item <#if active=='posts'>active</#if>" href="/admin/posts">评论管理</a>
+            <a class="item <#if active=='upgradeLogs'>active</#if>" href="/admin/upgrade-logs">版本升级日志</a>
+            <a class="item <#if active=='auditLogs'>active</#if>" href="/admin/audit-logs">操作审计日志</a>
+            <div class="item small-muted">预留扩展</div>
+            <a class="item <#if active=='plugins'>active</#if>" href="/admin/plugins">插件管理（预留）</a>
+            <a class="item <#if active=='themes'>active</#if>" href="/admin/themes">主题管理（预留）</a>
+        </div>
+    </div>
+
+    <div class="admin-main">
+        <#nested>
+    </div>
+</div>
+</body>
+</html>
+</#macro>

src/main/resources/templates/admin/audit-logs.ftl

@@ -0,0 +1,48 @@
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 操作审计日志" active=active adminName=adminName>
+    <h2 class="ui header">操作审计日志</h2>
+    <p class="small-muted">记录所有管理员的后台操作，包括角色管理、用户管理、内容管理等。</p>
+
+    <table class="ui striped celled table">
+        <thead>
+        <tr>
+            <th>ID</th>
+            <th>管理员</th>
+            <th>操作类型</th>
+            <th>目标类型</th>
+            <th>目标ID</th>
+            <th>描述</th>
+            <th>状态</th>
+            <th>操作时间</th>
+        </tr>
+        </thead>
+        <tbody>
+        <#list logs as l>
+            <tr>
+                <td>${l.id}</td>
+                <td>${l.adminName!""}</td>
+                <td><span class="ui label">${l.actionType!""}</span></td>
+                <td>${l.targetType!""}</td>
+                <td>${l.targetId!""}</td>
+                <td>
+                    <div style="max-width:300px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;" title="${l.description!""}">
+                        ${l.description!""}
+                    </div>
+                </td>
+                <td>
+                    <#if l.status == "success">
+                        <span class="ui label green">成功</span>
+                    <#elseif l.status == "blocked">
+                        <span class="ui label orange">阻止</span>
+                    <#elseif l.status == "ignored">
+                        <span class="ui label yellow">忽略</span>
+                    <#else>
+                        <span class="ui label">${l.status!""}</span>
+                    </#if>
+                </td>
+                <td>${l.createTime?string('yyyy-MM-dd HH:mm:ss')!""}</td>
+            </tr>
+        </#list>
+        </tbody>
+    </table>
+</@shell.page>

src/main/resources/templates/admin/discussions.ftl

@@ -0,0 +1,32 @@
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 文章管理" active=active adminName=adminName>
+    <h2 class="ui header">文章管理</h2>
+    <table class="ui striped celled table">
+        <thead>
+        <tr>
+            <th>ID</th>
+            <th>标题</th>
+            <th>创建人ID</th>
+            <th>创建时间</th>
+            <th>操作</th>
+        </tr>
+        </thead>
+        <tbody>
+        <#list discussions as d>
+            <tr>
+                <td>${d.id}</td>
+                <td>${d.title!""}</td>
+                <td>${d.createId!""}</td>
+                <td>${d.createTime?string('yyyy-MM-dd HH:mm:ss')!""}</td>
+                <td>
+                    <a class="ui tiny button" href="/getdiscussionsbyid?id=${d.id}" target="_blank">查看</a>
+                    <form style="display:inline" method="post" action="/admin/discussions/${d.id}/delete" onsubmit="return confirm('确认删除该文章及其评论吗？');">
+                        <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+                        <button class="ui tiny red button" type="submit">删除</button>
+                    </form>
+                </td>
+            </tr>
+        </#list>
+        </tbody>
+    </table>
+</@shell.page>

src/main/resources/templates/admin/home.ftl

@@ -1,338 +1,50 @@
-<!DOCTYPE html>
-<html>
-<title>后台管理首页</title>
-<head>
-    <meta name="_csrf" content="${_csrf.token}"/>
-    <meta name="_csrf_header" content="${_csrf.headerName}"/>
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 总览" active=active adminName=adminName>
+    <h2 class="ui header">系统总览</h2>
 
-    <#--jquery-->
-    <script crossorigin="anonymous" integrity="sha384-vk5WoKIaW/vJyUAd9n/wmopsmNhiy+L2Z+SBxGYnUkunIxVxAv/UtMOhba/xskxh"
-            src="https://lib.baomitu.com/jquery/3.4.1/jquery.min.js"></script>
+    <div class="ui four stackable cards">
+        <div class="card"><div class="content"><div class="header">用户总数</div><div class="description">${userCount}</div></div></div>
+        <div class="card"><div class="content"><div class="header">文章总数</div><div class="description">${discussionCount}</div></div></div>
+        <div class="card"><div class="content"><div class="header">评论总数</div><div class="description">${postCount}</div></div></div>
+        <div class="card"><div class="content"><div class="header">角色总数</div><div class="description">${roleCount}</div></div></div>
+    </div>
 
-    <#--semantic-ui-->
-    <link rel="stylesheet" type="text/css" href="/static/semanticui/semantic.css">
-    <script type="text/javascript" src="/static/semanticui/semantic.js"></script>
+    <h3 class="ui dividing header">服务器与运行时</h3>
+    <div class="ui two stackable cards">
+        <div class="card">
+            <div class="content">
+                <div class="header">CPU / 内存</div>
+                <div class="description">
+                    <p>CPU 负载: ${sys.cpuLoad}</p>
+                    <p>JVM 已用内存: ${sys.usedMb} MB / ${sys.totalMb} MB</p>
+                    <p>JVM 最大内存: ${sys.maxMb} MB</p>
+                    <p>Heap 已用: ${sys.heapUsedMb} MB</p>
+                    <p>应用运行时长: ${sys.uptimeMs} ms</p>
+                </div>
+            </div>
+        </div>
+        <div class="card">
+            <div class="content">
+                <div class="header">关键依赖版本</div>
+                <div class="description">
+                    <p>Spring Boot: ${deps.springBoot}</p>
+                    <p>Java: ${deps.java}</p>
+                    <p>Spring: ${deps.spring}</p>
+                    <p>Hibernate: ${deps.hibernate}</p>
+                    <p>Flyway: ${deps.flyway}</p>
+                    <p>Druid: ${deps.druid}</p>
+                    <p>Ehcache: ${deps.ehcache}</p>
+                    <p>SpringDoc: ${deps.springdoc}</p>
+                </div>
+            </div>
+        </div>
+    </div>
 
-    <link rel="stylesheet" type="text/css" href="/static/semanticui/my.css">
-
-    <#--tinymce-->
-    <script crossorigin="anonymous" integrity="sha384-CpsBIlOAWHuSRRN235sCBzEeKN6hLT6SpOGRkGadKpYj0gDP7+s3Q8pC38z8uGHH"
-            src="https://lib.baomitu.com/tinymce/5.1.1/tinymce.min.js"></script>
-
-
-    <#--layx-->
-    <link href="/static/layx/layx.min.css?b14794a8a3baf3e8b58e" rel="stylesheet">
-
-    <script type="text/javascript" src="/static/layx/layx.min.js?b14794a8a3baf3e8b58e"></script>
-
-    <script type="text/javascript" charset="UTF-8" src="/static/js/comm/util.js"></script>
-
-
-    <style type="text/css">
-        body {
-            -webkit-font-smoothing: antialiased;
-            -moz-font-smoothing: grayscale;
-        }
-
-        #sidebar {
-            position: fixed;
-            height: 100vh;
-            background-color: #f5f5f5;
-            padding-top: 68px;
-            padding-left: 0;
-            padding-right: 0;
-        }
-
-        #sidebar .ui.menu > a.item {
-            padding: 10px 20px;
-            line-height: 20px;
-            color: #337ab7;
-            border-radius: 0 !important;
-            margin-top: 0;
-            margin-bottom: 0;
-        }
-
-        #sidebar .ui.menu > a.item.active {
-            background-color: #337ab7;
-            color: white;
-            border: none !important;
-        }
-
-        #sidebar .ui.menu > a.item:hover {
-            background-color: #eee;
-            color: #23527c;
-        }
-
-        #content {
-            padding-top: 56px;
-            padding-left: 20px;
-            padding-right: 20px;
-        }
-
-        #content h1 {
-            font-size: 36px;
-        }
-
-        #content .ui.dividing.header {
-            width: 100%;
-        }
-
-        .ui.centered.small.circular.image {
-            margin-top: 14px;
-            margin-bottom: 14px;
-        }
-
-        .ui.borderless.menu {
-            box-shadow: none;
-            flex-wrap: wrap;
-            border: none;
-            padding-left: 0;
-            padding-right: 0;
-        }
-
-        .ui.mobile.only.grid .ui.menu .ui.vertical.menu {
-            display: none;
-        }
-    </style>
-</head>
-
-<body id="root">
-<div class="ui tablet computer only padded grid">
-    <div class="ui inverted borderless top fixed fluid menu">
-        <a class="header item">Jiscuss后台管理</a>
-        <div class="right menu">
-            <div class="item">
-                <div class="ui small input"><input placeholder="Search..." /></div>
+    <h3 class="ui dividing header">快捷入口</h3>
+    <div class="ui buttons">
+        <a class="ui primary button" href="/admin/users">用户与角色</a>
+        <a class="ui button" href="/admin/discussions">文章管理</a>
+        <a class="ui button" href="/admin/posts">评论管理</a>
+        <a class="ui button" href="/swagger-ui.html" target="_blank">接口文档</a>
     </div>
-            <a class="item">常用管理</a> <a class="item">设置</a>
-            <a class="item">用户</a> <a class="item">主题</a> <a class="item">注销</a>
-        </div>
-    </div>
-</div>
-<div class="ui mobile only padded grid">
-    <div class="ui top fixed borderless fluid inverted menu">
-        <a class="header item">Project Name</a>
-        <div class="right menu">
-            <div class="item">
-                <button class="ui icon toggle basic inverted button">
-                    <i class="content icon"></i>
-                </button>
-            </div>
-        </div>
-        <div class="ui vertical borderless inverted fluid menu">
-            <a class="item">Dashboard</a> <a class="item">Settings</a>
-            <a class="item">Profile</a> <a class="item">Help</a>
-            <div class="ui fitted divider"></div>
-            <div class="item">
-                <div class="ui small input"><input placeholder="Search..." /></div>
-            </div>
-        </div>
-    </div>
-</div>
-<div class="ui padded grid">
-    <div
-            class="three wide tablet only three wide computer only column"
-            id="sidebar"
-    >
-        <div class="ui vertical borderless fluid text menu">
-            <a class="active item">常用管理</a> <a class="item">设置</a>
-            <div class="ui hidden divider"></div>
-            <a class="item">用户</a> <a class="item">主题</a>
-            <div class="ui hidden divider"></div>
-            <a class="item">Jiscuss文档</a>
-            <a class="item"  href="/">返回首页</a>
-        </div>
-    </div>
-    <div
-            class="sixteen wide mobile thirteen wide tablet thirteen wide computer right floated column"
-            id="content"
-    >
-        <div class="ui padded grid">
-            <div class="row">
-                <h1 class="ui huge dividing header">Dashboard</h1>
-            </div>
-            <div class="center aligned row">
-                <div
-                        class="eight wide mobile four wide tablet four wide computer column"
-                >
-                    <img
-                            class="ui centered small circular image"
-                            src="./static/images/wireframe/square-image.png"
-                    />
-                    <div class="ui large basic label">Label</div>
-                    <p>Something else</p>
-                </div>
-                <div
-                        class="eight wide mobile four wide tablet four wide computer column"
-                >
-                    <img
-                            class="ui centered small circular image"
-                            src="./static/images/wireframe/square-image.png"
-                    />
-                    <div class="ui large basic label">Label</div>
-                    <p>Something else</p>
-                </div>
-                <div
-                        class="eight wide mobile four wide tablet four wide computer column"
-                >
-                    <img
-                            class="ui centered small circular image"
-                            src="./static/images/wireframe/square-image.png"
-                    />
-                    <div class="ui large basic label">Label</div>
-                    <p>Something else</p>
-                </div>
-                <div
-                        class="eight wide mobile four wide tablet four wide computer column"
-                >
-                    <img
-                            class="ui centered small circular image"
-                            src="./static/images/wireframe/square-image.png"
-                    />
-                    <div class="ui large basic label">Label</div>
-                    <p>Something else</p>
-                </div>
-            </div>
-            <div class="ui hidden section divider"></div>
-            <div class="row">
-                <h1 class="ui huge dividing header">Section title</h1>
-            </div>
-            <div class="row">
-                <table class="ui single line striped selectable unstackable table">
-                    <thead>
-                    <tr>
-                        <th>#</th>
-                        <th>Header</th>
-                        <th>Header</th>
-                        <th>Header</th>
-                        <th>Header</th>
-                    </tr>
-                    </thead>
-                    <tbody>
-                    <tr>
-                        <td>1,001</td>
-                        <td>Lorem</td>
-                        <td>ipsum</td>
-                        <td>dolor</td>
-                        <td>sit</td>
-                    </tr>
-                    <tr>
-                        <td>1,002</td>
-                        <td>amet</td>
-                        <td>consectetur</td>
-                        <td>adipiscing</td>
-                        <td>elit</td>
-                    </tr>
-                    <tr>
-                        <td>1,003</td>
-                        <td>Integer</td>
-                        <td>nec</td>
-                        <td>odio</td>
-                        <td>Praesent</td>
-                    </tr>
-                    <tr>
-                        <td>1,003</td>
-                        <td>libero</td>
-                        <td>Sed</td>
-                        <td>cursus</td>
-                        <td>ante</td>
-                    </tr>
-                    <tr>
-                        <td>1,004</td>
-                        <td>dapibus</td>
-                        <td>diam</td>
-                        <td>Sed</td>
-                        <td>nisi</td>
-                    </tr>
-                    <tr>
-                        <td>1,005</td>
-                        <td>Nulla</td>
-                        <td>quis</td>
-                        <td>sem</td>
-                        <td>at</td>
-                    </tr>
-                    <tr>
-                        <td>1,006</td>
-                        <td>nibh</td>
-                        <td>elementum</td>
-                        <td>imperdiet</td>
-                        <td>Duis</td>
-                    </tr>
-                    <tr>
-                        <td>1,007</td>
-                        <td>sagittis</td>
-                        <td>ipsum</td>
-                        <td>Praesent</td>
-                        <td>mauris</td>
-                    </tr>
-                    <tr>
-                        <td>1,008</td>
-                        <td>Fusce</td>
-                        <td>nec</td>
-                        <td>tellus</td>
-                        <td>sed</td>
-                    </tr>
-                    <tr>
-                        <td>1,009</td>
-                        <td>augue</td>
-                        <td>semper</td>
-                        <td>porta</td>
-                        <td>Mauris</td>
-                    </tr>
-                    <tr>
-                        <td>1,010</td>
-                        <td>massa</td>
-                        <td>Vestibulum</td>
-                        <td>lacinia</td>
-                        <td>arcu</td>
-                    </tr>
-                    <tr>
-                        <td>1,011</td>
-                        <td>eget</td>
-                        <td>nulla</td>
-                        <td>Class</td>
-                        <td>aptent</td>
-                    </tr>
-                    <tr>
-                        <td>1,012</td>
-                        <td>taciti</td>
-                        <td>sociosqu</td>
-                        <td>ad</td>
-                        <td>litora</td>
-                    </tr>
-                    <tr>
-                        <td>1,013</td>
-                        <td>torquent</td>
-                        <td>per</td>
-                        <td>conubia</td>
-                        <td>nostra</td>
-                    </tr>
-                    <tr>
-                        <td>1,014</td>
-                        <td>per</td>
-                        <td>inceptos</td>
-                        <td>himenaeos</td>
-                        <td>Curabitur</td>
-                    </tr>
-                    <tr>
-                        <td>1,015</td>
-                        <td>sodales</td>
-                        <td>ligula</td>
-                        <td>in</td>
-                        <td>libero</td>
-                    </tr>
-                    </tbody>
-                </table>
-            </div>
-        </div>
-    </div>
-</div>
-<script>
-    $(document).ready(function() {
-        $(".ui.toggle.button").click(function() {
-            $(".mobile.only.grid .ui.vertical.menu").toggle(100);
-        });
-    });
-</script>
-</body>
-</html>
+</@shell.page>

src/main/resources/templates/admin/plugins.ftl

@@ -0,0 +1,8 @@
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 插件管理（预留）" active=active adminName=adminName>
+    <h2 class="ui header">插件管理（预留）</h2>
+    <div class="ui info message">
+        <div class="header">预留扩展点</div>
+        <p>后续可在此接入插件生命周期管理：安装、启停、配置、版本升级、依赖校验。</p>
+    </div>
+</@shell.page>

src/main/resources/templates/admin/posts.ftl

@@ -0,0 +1,33 @@
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 评论管理" active=active adminName=adminName>
+    <h2 class="ui header">评论管理</h2>
+    <table class="ui compact celled table">
+        <thead>
+        <tr>
+            <th>ID</th>
+            <th>文章</th>
+            <th>作者</th>
+            <th>内容</th>
+            <th>创建时间</th>
+            <th>操作</th>
+        </tr>
+        </thead>
+        <tbody>
+        <#list posts as p>
+            <tr>
+                <td>${p.id}</td>
+                <td>${discussionNames[p.discussionId]!('#'+p.discussionId?c)}</td>
+                <td>${userNames[p.createId]!('#'+p.createId?c)}</td>
+                <td><div style="max-width:420px;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;">${p.content!""}</div></td>
+                <td>${p.createTime?string('yyyy-MM-dd HH:mm:ss')!""}</td>
+                <td>
+                    <form style="display:inline" method="post" action="/admin/posts/${p.id}/delete" onsubmit="return confirm('确认删除该评论吗？');">
+                        <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+                        <button class="ui tiny red button" type="submit">删除</button>
+                    </form>
+                </td>
+            </tr>
+        </#list>
+        </tbody>
+    </table>
+</@shell.page>

src/main/resources/templates/admin/themes.ftl

@@ -0,0 +1,8 @@
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 主题管理（预留）" active=active adminName=adminName>
+    <h2 class="ui header">主题管理（预留）</h2>
+    <div class="ui info message">
+        <div class="header">预留扩展点</div>
+        <p>后续可在此增加主题包管理、配色切换、模板覆盖与预览发布。</p>
+    </div>
+</@shell.page>

src/main/resources/templates/admin/upgrade-logs.ftl

@@ -0,0 +1,65 @@
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 版本升级日志" active=active adminName=adminName>
+    <h2 class="ui header">版本功能升级日志</h2>
+    <p class="small-muted">记录每次升级新增与修复内容，便于发布追踪与回滚评估。</p>
+
+    <form class="ui form" method="post" action="/admin/upgrade-logs">
+        <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+        <div class="three fields">
+            <div class="field">
+                <label>版本号</label>
+                <input name="version" placeholder="例如 v3.5.13" required>
+            </div>
+            <div class="field">
+                <label>类型</label>
+                <select class="ui dropdown" name="type">
+                    <option value="feature">feature</option>
+                    <option value="fix">fix</option>
+                    <option value="security">security</option>
+                    <option value="refactor">refactor</option>
+                </select>
+            </div>
+            <div class="field">
+                <label>标题</label>
+                <input name="title" placeholder="本次升级摘要" required>
+            </div>
+        </div>
+        <div class="field">
+            <label>详细内容</label>
+            <textarea name="content" rows="4" placeholder="描述新增、修复、兼容性说明等"></textarea>
+        </div>
+        <button class="ui primary button" type="submit">新增日志</button>
+    </form>
+
+    <h3 class="ui dividing header">历史记录</h3>
+    <table class="ui celled table">
+        <thead>
+        <tr>
+            <th>ID</th>
+            <th>版本</th>
+            <th>类型</th>
+            <th>标题</th>
+            <th>内容</th>
+            <th>创建人</th>
+            <th>创建时间</th>
+        </tr>
+        </thead>
+        <tbody>
+        <#list logs as l>
+            <tr>
+                <td>${l.id}</td>
+                <td>${l.version!""}</td>
+                <td>${l.type!""}</td>
+                <td>${l.title!""}</td>
+                <td>${l.content!""}</td>
+                <td>${l.createdBy!""}</td>
+                <td>${l.createTime?string('yyyy-MM-dd HH:mm:ss')!""}</td>
+            </tr>
+        </#list>
+        </tbody>
+    </table>
+
+    <script>
+        $('.ui.dropdown').dropdown();
+    </script>
+</@shell.page>

src/main/resources/templates/admin/users.ftl

@@ -0,0 +1,82 @@
+<#import "admin-shell.ftl" as shell>
+<@shell.page title="后台管理 - 用户与角色" active=active adminName=adminName>
+    <h2 class="ui header">用户与角色管理</h2>
+    <p class="small-muted">简单 RBAC：用户可绑定多个角色，拥有 ADMIN 角色的用户可以进入后台管理。</p>
+
+    <h3 class="ui dividing header">角色管理</h3>
+    <form class="ui form" method="post" action="/admin/roles">
+        <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+        <div class="three fields">
+            <div class="field"><label>角色编码</label><input name="code" placeholder="如 ADMIN_AUDIT" required></div>
+            <div class="field"><label>角色名称</label><input name="name" placeholder="如 审计管理员" required></div>
+            <div class="field"><label>描述</label><input name="description" placeholder="角色用途说明"></div>
+        </div>
+        <button class="ui small primary button" type="submit">新增角色</button>
+    </form>
+
+    <table class="ui celled compact table">
+        <thead><tr><th>ID</th><th>编码</th><th>名称</th><th>状态</th><th>操作</th></tr></thead>
+        <tbody>
+        <#list roles as r>
+            <tr>
+                <td>${r.id}</td>
+                <td>${r.code!""}</td>
+                <td>${r.name!""}</td>
+                <td><#if r.enabled?? && r.enabled==1>启用<#else>停用</#if></td>
+                <td>
+                    <form style="display:inline" method="post" action="/admin/roles/${r.id}/toggle">
+                        <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+                        <button class="ui tiny button" type="submit">切换启停</button>
+                    </form>
+                </td>
+            </tr>
+        </#list>
+        </tbody>
+    </table>
+
+    <h3 class="ui dividing header">用户角色绑定</h3>
+    <table class="ui celled table">
+        <thead>
+        <tr>
+            <th>ID</th>
+            <th>用户名</th>
+            <th>邮箱</th>
+            <th>角色绑定</th>
+            <th>操作</th>
+        </tr>
+        </thead>
+        <tbody>
+        <#list users as u>
+            <tr>
+                <td>${u.id}</td>
+                <td>${u.username!""}</td>
+                <td>${u.email!""}</td>
+                <td>
+                    <form class="ui form" method="post" action="/admin/users/${u.id}/roles">
+                        <input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>
+                        <div class="inline fields">
+                            <#list roles as r>
+                                <div class="field">
+                                    <div class="ui checkbox">
+                                        <input type="checkbox" name="roleIds" value="${r.id}"
+                                               <#if userRoleIds[u.id]?? && userRoleIds[u.id]?seq_contains(r.id)>checked</#if>>
+                                        <label>${r.code}</label>
+                                    </div>
+                                </div>
+                            </#list>
+                        </div>
+                        <button class="ui tiny primary button" type="submit">保存角色</button>
+                    </form>
+                </td>
+                <td>
+                    <a class="ui tiny button" href="/user?id=${u.id}" target="_blank">查看用户页</a>
+                </td>
+            </tr>
+        </#list>
+        </tbody>
+    </table>
+
+    <script>
+        $('.ui.checkbox').checkbox();
+    </script>
+</@shell.page>

src/main/resources/templates/comm/commjs.ftl

@@ -1,4 +1,5 @@
 <#--jquery-->
+<link rel="icon" type="image/png" href="/static/assets/images/logo.png">
 <script crossorigin="anonymous" integrity="sha384-vk5WoKIaW/vJyUAd9n/wmopsmNhiy+L2Z+SBxGYnUkunIxVxAv/UtMOhba/xskxh"
         src="https://lib.baomitu.com/jquery/3.4.1/jquery.min.js"></script>