feat(P1): Account 模型扩展 + 头像上传 + 个人简介 + Refresh Token 机制

backend/internal/account/handler.go

@@ -1,7 +1,16 @@
 package account
 
 import (
+	"crypto/rand"
+	"encoding/hex"
 	"errors"
+	"fmt"
+	"net/http"
+	"os"
+	"path"
+	"path/filepath"
+	"strconv"
+	"strings"
 
 	"feedsystem_video_go/internal/apierror"
 
@@ -110,12 +119,17 @@ func (h *AccountHandler) Login(c *gin.Context) {
 		c.JSON(apierror.ClassifyHTTPStatus(err), gin.H{"error": err.Error()})
 		return
 	}
-	if token, err := h.accountService.Login(c.Request.Context(), req.Username, req.Password); err != nil {
+	account, err := h.accountService.FindByUsername(c.Request.Context(), req.Username)
+	if err != nil {
 		c.JSON(500, gin.H{"error": err.Error()})
 		return
-	} else {
-		c.JSON(200, gin.H{"token": token})
 	}
+	accessToken, refreshToken, err := h.accountService.Login(c.Request.Context(), req.Username, req.Password)
+	if err != nil {
+		c.JSON(500, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(200, LoginResponse{Token: accessToken, RefreshToken: refreshToken, AccountID: account.ID, Username: account.Username})
 }
 
 func (h *AccountHandler) Logout(c *gin.Context) {
@@ -131,6 +145,105 @@ func (h *AccountHandler) Logout(c *gin.Context) {
 	c.JSON(200, gin.H{"message": "account logged out"})
 }
 
+func (h *AccountHandler) UploadAvatar(c *gin.Context) {
+	accountID, err := getAccountID(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		return
+	}
+	f, err := c.FormFile("file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "missing file"})
+		return
+	}
+	const maxSize = 10 << 20
+	if f.Size <= 0 || f.Size > maxSize {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid file size"})
+		return
+	}
+	ext := strings.ToLower(filepath.Ext(f.Filename))
+	switch ext {
+	case ".jpg", ".jpeg", ".png", ".webp":
+	default:
+		c.JSON(http.StatusBadRequest, gin.H{"error": "only .jpg/.jpeg/.png/.webp allowed"})
+		return
+	}
+	dir := filepath.Join(".run", "uploads", "avatars", strconv.FormatUint(uint64(accountID), 10))
+	if err := os.MkdirAll(dir, 0o755); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	filename, err := randHex(16)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	filename = filename + ext
+	absPath := filepath.Join(dir, filename)
+	if err := c.SaveUploadedFile(f, absPath); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	urlPath := path.Join("/static", "avatars", strconv.FormatUint(uint64(accountID), 10), filename)
+	avatarURL := buildAbsoluteURL(c, urlPath)
+	if err := h.accountService.UpdateAvatar(c.Request.Context(), accountID, avatarURL); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"avatar_url": avatarURL})
+}
+
+func (h *AccountHandler) UpdateProfile(c *gin.Context) {
+	accountID, err := getAccountID(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": err.Error()})
+		return
+	}
+	var req UpdateProfileRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(apierror.ClassifyHTTPStatus(err), gin.H{"error": err.Error()})
+		return
+	}
+	if err := h.accountService.UpdateProfile(c.Request.Context(), accountID, &req); err != nil {
+		c.JSON(apierror.ClassifyHTTPStatus(err), gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"message": "profile updated"})
+}
+
+func (h *AccountHandler) Refresh(c *gin.Context) {
+	var req RefreshRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(apierror.ClassifyHTTPStatus(err), gin.H{"error": err.Error()})
+		return
+	}
+	newToken, accountID, username, err := h.accountService.RefreshAccessToken(c.Request.Context(), req.RefreshToken)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, gin.H{"error": "invalid refresh token"})
+		return
+	}
+	c.JSON(http.StatusOK, LoginResponse{Token: newToken, AccountID: accountID, Username: username})
+}
+
+func randHex(n int) (string, error) {
+	b := make([]byte, n)
+	if _, err := rand.Read(b); err != nil {
+		return "", fmt.Errorf("rand.Read: %w", err)
+	}
+	return hex.EncodeToString(b), nil
+}
+
+func buildAbsoluteURL(c *gin.Context, p string) string {
+	scheme := "http"
+	if c.Request.TLS != nil {
+		scheme = "https"
+	}
+	if xf := c.GetHeader("X-Forwarded-Proto"); xf != "" {
+		scheme = xf
+	}
+	return fmt.Sprintf("%s://%s%s", scheme, c.Request.Host, p)
+}
+
 func getAccountID(c *gin.Context) (uint, error) {
 	value, exists := c.Get("accountID")
 	if !exists {