更新 update 门户站点界面和后台功能

server/unified-management/internal/web/admin_feedback_routes.go

@@ -117,10 +117,21 @@ func (r *router) handleAdminFeedbacks(w http.ResponseWriter, req *http.Request)
 		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "comment": comment})
 		return
 	}
+	if req.Method == http.MethodPost && strings.HasPrefix(path, "/api/admin/feedbacks/") && strings.HasSuffix(path, "/mail/retry") {
+		code := strings.TrimSuffix(strings.TrimPrefix(path, "/api/admin/feedbacks/"), "/mail/retry")
+		if err := r.feedback.RetryMail(code); err != nil {
+			writeError(w, http.StatusBadGateway, "MAIL_RETRY_FAILED", err)
+			return
+		}
+		_ = r.store.InsertAudit(db.AuditLog{Actor: "admin", Type: "feedback.mail.retry", Target: code, Message: "反馈邮件已重试发送", IP: req.RemoteAddr, UserAgent: req.UserAgent()})
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+		return
+	}
 	if req.Method == http.MethodPatch && strings.HasPrefix(path, "/api/admin/feedbacks/") {
 		code := strings.TrimPrefix(path, "/api/admin/feedbacks/")
 		var body struct {
 			Status       string `json:"status"`
+			Priority     string `json:"priority"`
 			StatusDetail string `json:"statusDetail"`
 			PublicReply  string `json:"publicReply"`
 		}
@@ -128,7 +139,7 @@ func (r *router) handleAdminFeedbacks(w http.ResponseWriter, req *http.Request)
 			writeError(w, http.StatusBadRequest, "INVALID_PAYLOAD", err)
 			return
 		}
-		if err := r.store.UpdateFeedbackTicket(code, db.FeedbackUpdate{Status: firstNonEmpty(body.Status, "new"), StatusDetail: body.StatusDetail, PublicReply: body.PublicReply, Actor: "admin"}); err != nil {
+		if err := r.store.UpdateFeedbackTicket(code, db.FeedbackUpdate{Status: firstNonEmpty(body.Status, "new"), Priority: body.Priority, StatusDetail: body.StatusDetail, PublicReply: body.PublicReply, Actor: "admin"}); err != nil {
 			writeError(w, http.StatusInternalServerError, "FEEDBACK_UPDATE_FAILED", err)
 			return
 		}

server/unified-management/internal/web/admin_legacy_routes.go

@@ -50,6 +50,9 @@ func (r *router) handleAdminLegacy(w http.ResponseWriter, req *http.Request) {
 		if name == "media-types" {
 			_ = r.sources.ImportLegacyMediaTypes(req.Context())
 		}
+		if name == "update-info" {
+			r.syncNoticeFromLegacyUpdateInfo(req, doc.Raw)
+		}
 		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "document": doc})
 		return
 	}
@@ -83,8 +86,18 @@ func (r *router) handleAdminLegacy(w http.ResponseWriter, req *http.Request) {
 		if name == "media-types" {
 			_ = r.sources.ImportLegacyMediaTypes(req.Context())
 		}
+		if name == "update-info" {
+			r.syncNoticeFromLegacyUpdateInfo(req, doc.Raw)
+		}
 		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "document": doc})
 		return
 	}
 	http.NotFound(w, req)
 }
+
+func (r *router) syncNoticeFromLegacyUpdateInfo(req *http.Request, raw string) {
+	if r.notices == nil {
+		return
+	}
+	_ = r.notices.SyncFromLegacyUpdateInfo(req.Context(), raw, "admin")
+}

server/unified-management/internal/web/admin_source_routes.go

@@ -56,13 +56,17 @@ func (r *router) handleAdminSources(w http.ResponseWriter, req *http.Request) {
 			writeError(w, http.StatusInternalServerError, "SOURCE_SAVE_FAILED", err)
 			return
 		}
+		_ = r.sources.PublishLegacyMediaTypes(req.Context(), "admin")
+		_ = r.releases.PublishLegacyUpdateInfo(req, "admin")
+		_ = r.store.InsertAudit(db.AuditLog{Actor: "admin", Type: "source.saved", Target: saved.SourceID, Message: "客户端接口已保存并同步兼容 media-types.json", IP: req.RemoteAddr, UserAgent: req.UserAgent()})
 		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "source": saved})
 	case req.Method == http.MethodDelete && strings.HasPrefix(path, "/api/admin/sources/"):
 		sourceID := strings.TrimPrefix(path, "/api/admin/sources/")
-		if err := r.store.DeleteSource(sourceID); err != nil {
+		if err := r.sources.DeleteSourceAndPublishCompatibility(req.Context(), sourceID, "admin"); err != nil {
 			writeError(w, http.StatusInternalServerError, "SOURCE_DELETE_FAILED", err)
 			return
 		}
+		_ = r.releases.PublishLegacyUpdateInfo(req, "admin")
 		writeJSON(w, http.StatusOK, map[string]any{"ok": true})
 	default:
 		http.NotFound(w, req)

server/unified-management/internal/web/admin_system_routes.go

@@ -4,38 +4,57 @@ import (
 	"encoding/json"
 	"errors"
 	"net/http"
+	"path/filepath"
+	"strconv"
 	"time"
 
 	"ymhut-box/server/unified-management/internal/config"
 	"ymhut-box/server/unified-management/internal/db"
 	"ymhut-box/server/unified-management/internal/health"
+	feedbackmail "ymhut-box/server/unified-management/internal/mail"
 )
 
 func (r *router) handleAdminDatabase(w http.ResponseWriter, req *http.Request) {
 	path := cleanPath(req.URL.Path)
 	switch {
+	case req.Method == http.MethodGet && path == "/api/admin/database/config":
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "config": config.SafeDatabase(r.cfg.BaseDir, r.cfg.Database)})
 	case req.Method == http.MethodGet && path == "/api/admin/database/status":
-		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "database": r.store.Status()})
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "database": r.store.Status(), "config": config.SafeDatabase(r.cfg.BaseDir, r.cfg.Database)})
 	case req.Method == http.MethodPost && path == "/api/admin/database/test":
-		var body config.DatabaseConfig
-		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+		body, err := decodeAdminDatabaseConfig(req, r.cfg.BaseDir, r.cfg.Database, true)
+		if err != nil {
 			writeError(w, http.StatusBadRequest, "INVALID_PAYLOAD", err)
 			return
 		}
-		if body.Provider == "" {
-			body.Provider = r.cfg.Database.Provider
-		}
-		if body.SQLitePath == "" {
-			body.SQLitePath = r.cfg.Database.SQLitePath
-		}
-		if body.MySQLDSN == "" {
-			body.MySQLDSN = r.cfg.Database.MySQLDSN
-		}
 		if err := db.TestDatabase(body); err != nil {
 			writeError(w, http.StatusBadGateway, "DATABASE_TEST_FAILED", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "config": config.SafeDatabase(r.cfg.BaseDir, body)})
+	case req.Method == http.MethodPost && path == "/api/admin/database/save":
+		body, err := decodeAdminDatabaseConfig(req, r.cfg.BaseDir, r.cfg.Database, true)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "INVALID_PAYLOAD", err)
+			return
+		}
+		if err := db.TestDatabase(body); err != nil {
+			writeError(w, http.StatusBadGateway, "DATABASE_TEST_FAILED", err)
+			return
+		}
+		next := *r.cfg
+		next.Database = body
+		if err := config.Save(&next); err != nil {
+			writeError(w, http.StatusInternalServerError, "DATABASE_SAVE_FAILED", err)
+			return
+		}
+		r.cfg.Database = next.Database
+		if err := r.store.ReconfigureDatabase(r.cfg); err != nil {
+			writeError(w, http.StatusInternalServerError, "DATABASE_SAVE_FAILED", err)
+			return
+		}
+		_ = r.store.InsertAudit(db.AuditLog{Actor: "admin", Type: "system.database.saved", Target: body.Provider, Message: "数据库配置已保存并热切换", IP: req.RemoteAddr, UserAgent: req.UserAgent()})
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "database": r.store.Status(), "config": config.SafeDatabase(r.cfg.BaseDir, r.cfg.Database)})
 	case req.Method == http.MethodPost && path == "/api/admin/database/import-sqlite":
 		result, err := r.store.ImportSQLiteToRemote()
 		if err != nil {
@@ -55,6 +74,52 @@ func (r *router) handleAdminDatabase(w http.ResponseWriter, req *http.Request) {
 	}
 }
 
+type adminDatabaseRequest struct {
+	Provider      string            `json:"provider"`
+	SQLitePath    string            `json:"sqlite_path"`
+	SQLitePathAlt string            `json:"sqlitePath"`
+	MySQLDSN      string            `json:"mysql_dsn"`
+	MySQLDSNAlt   string            `json:"mysqlDsn"`
+	MySQLHost     string            `json:"mysql_host"`
+	MySQLHostAlt  string            `json:"mysqlHost"`
+	MySQLPort     int               `json:"mysql_port"`
+	MySQLPortAlt  int               `json:"mysqlPort"`
+	MySQLDatabase string            `json:"mysql_database"`
+	MySQLDBAlt    string            `json:"mysqlDatabase"`
+	MySQLUser     string            `json:"mysql_user"`
+	MySQLUserAlt  string            `json:"mysqlUser"`
+	MySQLPassword string            `json:"mysql_password"`
+	MySQLPassAlt  string            `json:"mysqlPassword"`
+	MySQL         config.MySQLInput `json:"mysql"`
+}
+
+func decodeAdminDatabaseConfig(req *http.Request, baseDir string, current config.DatabaseConfig, keepPassword bool) (config.DatabaseConfig, error) {
+	var body adminDatabaseRequest
+	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+		return config.DatabaseConfig{}, err
+	}
+	incoming := config.DatabaseConfig{
+		Provider:      body.Provider,
+		SQLitePath:    firstNonEmpty(body.SQLitePath, body.SQLitePathAlt),
+		MySQLDSN:      firstNonEmpty(body.MySQLDSN, body.MySQLDSNAlt),
+		MySQLHost:     firstNonEmpty(body.MySQLHost, body.MySQLHostAlt, body.MySQL.Host),
+		MySQLPort:     firstPositive(body.MySQLPort, body.MySQLPortAlt, body.MySQL.Port),
+		MySQLDatabase: firstNonEmpty(body.MySQLDatabase, body.MySQLDBAlt, body.MySQL.Database),
+		MySQLUser:     firstNonEmpty(body.MySQLUser, body.MySQLUserAlt, body.MySQL.Username),
+		MySQLPassword: firstNonEmpty(body.MySQLPassword, body.MySQLPassAlt, body.MySQL.Password),
+	}
+	return config.NormalizeDatabase(baseDir, current, incoming, keepPassword)
+}
+
+func firstPositive(values ...int) int {
+	for _, value := range values {
+		if value > 0 {
+			return value
+		}
+	}
+	return 0
+}
+
 func (r *router) handleAdminDashboard(w http.ResponseWriter, req *http.Request) {
 	path := cleanPath(req.URL.Path)
 	if req.Method != http.MethodGet || path != "/api/admin/dashboard/overview" {
@@ -141,12 +206,26 @@ func (r *router) handleAdminSystem(w http.ResponseWriter, req *http.Request) {
 	case "/api/admin/system/health":
 		writeJSON(w, http.StatusOK, health.Snapshot(r.cfg, r.store))
 	case "/api/admin/system/audit":
-		items, err := r.store.ListAuditLogs(100)
+		page, err := r.store.ListAuditLogsPage(db.AuditFilters{
+			Page:    queryInt(req, "page", 1),
+			PerPage: queryInt(req, "perPage", 35),
+			Type:    req.URL.Query().Get("type"),
+			Target:  req.URL.Query().Get("target"),
+			Query:   req.URL.Query().Get("q"),
+		})
 		if err != nil {
 			writeError(w, http.StatusInternalServerError, "AUDIT_FAILED", err)
 			return
 		}
-		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "items": items})
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "items": page.Items, "page": page})
+	case "/api/admin/system/mail/config":
+		r.handleMailConfig(w, req)
+	case "/api/admin/system/mail/test":
+		r.handleMailTest(w, req)
+	case "/api/admin/system/branding":
+		r.handleBranding(w, req)
+	case "/api/admin/system/migration":
+		r.handleMigrationStatus(w, req)
 	case "/api/admin/system/database/sync":
 		if req.Method != http.MethodPost {
 			writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", errors.New("POST required"))
@@ -162,3 +241,188 @@ func (r *router) handleAdminSystem(w http.ResponseWriter, req *http.Request) {
 		http.NotFound(w, req)
 	}
 }
+
+func queryInt(req *http.Request, key string, fallback int) int {
+	value, err := strconv.Atoi(req.URL.Query().Get(key))
+	if err != nil || value <= 0 {
+		return fallback
+	}
+	return value
+}
+
+func (r *router) handleMigrationStatus(w http.ResponseWriter, req *http.Request) {
+	if req.Method != http.MethodGet {
+		writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", errors.New("GET required"))
+		return
+	}
+	status := r.store.Status()
+	writeJSON(w, http.StatusOK, map[string]any{
+		"ok": true,
+		"migration": map[string]any{
+			"strategy": "database_first_with_file_assets",
+			"databaseCovers": []string{
+				"系统设置与品牌",
+				"管理员与会话元数据",
+				"反馈工单、附件元数据与邮件记录",
+				"来源目录、客户端接口与健康记录",
+				"发布元数据、版本公告与兼容 JSON 修订",
+				"审计日志、旧项目同步记录与数据库同步状态",
+			},
+			"fileAssets": []map[string]string{
+				{"name": "downloads", "path": r.cfg.DownloadsDir, "description": "发布包和下载文件"},
+				{"name": "update public", "path": r.cfg.UpdatePublicDir, "description": "旧客户端兼容 JSON 生成物"},
+				{"name": "feedback packages", "path": filepath.Join(r.cfg.StorageDir, "feedback-packages"), "description": "反馈附件包"},
+			},
+			"sqlitePath":     r.store.Path(),
+			"mysql":          config.SafeDatabase(r.cfg.BaseDir, r.cfg.Database),
+			"lastSyncAt":     status.LastSyncAt,
+			"lastSyncError":  status.LastSyncError,
+			"activeProvider": status.ActiveProvider,
+		},
+	})
+}
+
+func (r *router) handleBranding(w http.ResponseWriter, req *http.Request) {
+	switch req.Method {
+	case http.MethodGet:
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "branding": config.SafeBranding(r.effectiveBranding())})
+	case http.MethodPost:
+		var body struct {
+			SiteIconURL        string `json:"siteIconUrl"`
+			SiteIconURLSnake   string `json:"site_icon_url"`
+			DeveloperAvatarURL string `json:"developerAvatarUrl"`
+			DeveloperAvatarAlt string `json:"developer_avatar_url"`
+			DeveloperName      string `json:"developerName"`
+			DeveloperNameSnake string `json:"developer_name"`
+			FeedbackEmail      string `json:"feedbackEmail"`
+			FeedbackEmailSnake string `json:"feedback_email"`
+		}
+		if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+			writeError(w, http.StatusBadRequest, "INVALID_PAYLOAD", err)
+			return
+		}
+		next := config.BrandingConfig{
+			SiteIconURL:        firstNonEmpty(body.SiteIconURL, body.SiteIconURLSnake),
+			DeveloperAvatarURL: firstNonEmpty(body.DeveloperAvatarURL, body.DeveloperAvatarAlt),
+			DeveloperName:      firstNonEmpty(body.DeveloperName, body.DeveloperNameSnake),
+			FeedbackEmail:      firstNonEmpty(body.FeedbackEmail, body.FeedbackEmailSnake),
+		}
+		if err := r.saveBranding(next); err != nil {
+			writeError(w, http.StatusInternalServerError, "BRANDING_SAVE_FAILED", err)
+			return
+		}
+		_ = r.store.InsertAudit(db.AuditLog{Actor: "admin", Type: "system.branding.saved", Target: r.cfg.Branding.DeveloperName, Message: "站点品牌信息已保存", IP: req.RemoteAddr, UserAgent: req.UserAgent()})
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "branding": config.SafeBranding(r.effectiveBranding())})
+	default:
+		writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", errors.New("GET or POST required"))
+	}
+}
+
+func (r *router) handleMailConfig(w http.ResponseWriter, req *http.Request) {
+	switch req.Method {
+	case http.MethodGet:
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "config": feedbackmail.SafeConfig(r.cfg.Mail)})
+	case http.MethodPost:
+		nextMail, err := decodeMailConfig(req, r.cfg.Mail)
+		if err != nil {
+			writeError(w, http.StatusBadRequest, "INVALID_PAYLOAD", err)
+			return
+		}
+		next := *r.cfg
+		next.Mail = nextMail
+		if err := config.Save(&next); err != nil {
+			writeError(w, http.StatusInternalServerError, "MAIL_CONFIG_FAILED", err)
+			return
+		}
+		r.cfg.Mail = next.Mail
+		_ = r.store.InsertAudit(db.AuditLog{Actor: "admin", Type: "system.mail.saved", Target: nextMail.Host, Message: "邮件通知配置已保存", IP: req.RemoteAddr, UserAgent: req.UserAgent()})
+		writeJSON(w, http.StatusOK, map[string]any{"ok": true, "config": feedbackmail.SafeConfig(r.cfg.Mail)})
+	default:
+		writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", errors.New("GET or POST required"))
+	}
+}
+
+func (r *router) handleMailTest(w http.ResponseWriter, req *http.Request) {
+	if req.Method != http.MethodPost {
+		writeError(w, http.StatusMethodNotAllowed, "METHOD_NOT_ALLOWED", errors.New("POST required"))
+		return
+	}
+	message, err := feedbackmail.BuildTestMessage(r.cfg)
+	if err != nil {
+		writeError(w, http.StatusBadRequest, "MAIL_TEST_FAILED", err)
+		return
+	}
+	if err := feedbackmail.Send(r.cfg, message); err != nil {
+		writeError(w, http.StatusBadGateway, "MAIL_TEST_FAILED", err)
+		return
+	}
+	_ = r.store.InsertAudit(db.AuditLog{Actor: "admin", Type: "system.mail.test", Target: message.To, Message: "测试邮件已发送", IP: req.RemoteAddr, UserAgent: req.UserAgent()})
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}
+
+type mailConfigRequest struct {
+	Host             string `json:"host"`
+	Port             int    `json:"port"`
+	Secure           string `json:"secure"`
+	Username         string `json:"username"`
+	Password         string `json:"password"`
+	FromAddress      string `json:"from_address"`
+	FromAddressAlt   string `json:"fromAddress"`
+	FromName         string `json:"from_name"`
+	FromNameAlt      string `json:"fromName"`
+	DeveloperAddress string `json:"developer_address"`
+	DeveloperAlt     string `json:"developerAddress"`
+	TimeoutSeconds   int    `json:"timeout_seconds"`
+	TimeoutAlt       int    `json:"timeoutSeconds"`
+}
+
+func decodeMailConfig(req *http.Request, current config.MailConfig) (config.MailConfig, error) {
+	var body mailConfigRequest
+	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
+		return config.MailConfig{}, err
+	}
+	next := current
+	if body.Host != "" {
+		next.Host = body.Host
+	}
+	if body.Port > 0 {
+		next.Port = body.Port
+	}
+	if body.Secure != "" {
+		next.Secure = body.Secure
+	}
+	if body.Username != "" {
+		next.Username = body.Username
+	}
+	if body.Password != "" {
+		next.Password = body.Password
+	}
+	if value := firstNonEmpty(body.FromAddress, body.FromAddressAlt); value != "" {
+		next.FromAddress = value
+	}
+	if value := firstNonEmpty(body.FromName, body.FromNameAlt); value != "" {
+		next.FromName = value
+	}
+	if value := firstNonEmpty(body.DeveloperAddress, body.DeveloperAlt); value != "" {
+		next.DeveloperAddress = value
+	}
+	if timeout := firstPositive(body.TimeoutSeconds, body.TimeoutAlt); timeout > 0 {
+		next.TimeoutSeconds = timeout
+	}
+	if next.Port <= 0 {
+		next.Port = 465
+	}
+	if next.Secure == "" {
+		next.Secure = "ssl"
+	}
+	if next.FromName == "" {
+		next.FromName = "YMhut Box Feedback"
+	}
+	if next.FromAddress == "" {
+		next.FromAddress = next.Username
+	}
+	if next.TimeoutSeconds <= 0 {
+		next.TimeoutSeconds = 20
+	}
+	return next, nil
+}

server/unified-management/internal/web/branding.go

@@ -0,0 +1,42 @@
+package web
+
+import (
+	"encoding/json"
+
+	"ymhut-box/server/unified-management/internal/config"
+)
+
+const brandingSettingKey = "branding"
+
+func (r *router) effectiveBranding() config.BrandingConfig {
+	branding := config.NormalizeBranding(config.BrandingConfig{}, r.cfg.Branding)
+	if r.store == nil {
+		return branding
+	}
+	raw, err := r.store.GetSetting(brandingSettingKey)
+	if err != nil || raw == "" {
+		return branding
+	}
+	var stored config.BrandingConfig
+	if json.Unmarshal([]byte(raw), &stored) != nil {
+		return branding
+	}
+	return config.NormalizeBranding(branding, stored)
+}
+
+func (r *router) saveBranding(branding config.BrandingConfig) error {
+	branding = config.NormalizeBranding(r.cfg.Branding, branding)
+	next := *r.cfg
+	next.Branding = branding
+	next.Mail.DeveloperAddress = firstNonEmpty(next.Mail.DeveloperAddress, branding.FeedbackEmail)
+	if err := config.Save(&next); err != nil {
+		return err
+	}
+	r.cfg.Branding = next.Branding
+	r.cfg.Mail = next.Mail
+	data, err := json.Marshal(r.cfg.Branding)
+	if err != nil {
+		return err
+	}
+	return r.store.UpsertSetting(brandingSettingKey, string(data))
+}

server/unified-management/internal/web/client_routes.go

@@ -42,6 +42,7 @@ func (r *router) handleClientBootstrap(w http.ResponseWriter, req *http.Request)
 		"release":      release,
 		"sources":      sourceCatalog,
 		"feedback":     map[string]any{"submit": "/", "status": "/?api=status&code=:code"},
+		"branding":     config.SafeBranding(r.effectiveBranding()),
 		"health":       health.Snapshot(r.cfg, r.store),
 	})
 }

server/unified-management/internal/web/response.go

@@ -60,10 +60,18 @@ func localizedErrorMessage(code, message string) string {
 		"database is not available":                            "数据库当前不可用",
 		"provider must be sqlite or mysql":                     "数据库类型必须是 SQLite 或 MySQL",
 		"mysql connection is required":                         "请填写 MySQL 连接信息",
+		"mysql database is required":                           "请填写 MySQL 数据库名",
+		"mysql username is required":                           "请填写 MySQL 数据库用户",
 		"sqlite path is required":                              "请填写 SQLite 路径",
 		"mysql_dsn is required":                                "请填写 MySQL DSN",
+		"remote database is not configured":                    "远端 MySQL 未配置",
+		"database sync is already running":                     "数据库同步正在执行，请稍后再试",
+		"mail is not configured":                               "邮件通知尚未配置完整",
 		"release notices are not configured":                   "版本日志功能尚未配置",
 		"legacy sync service is not configured":                "旧项目同步服务尚未配置",
+		"update-info requires app_version or title":            "更新 JSON 需要填写 app_version 或 title",
+		"media-types requires categories array":                "媒体源 JSON 需要包含 categories 数组",
+		"version or app_version is required":                   "版本日志需要填写 version 或 app_version",
 	}
 	if translated, ok := exact[lower]; ok {
 		return translated
@@ -74,6 +82,7 @@ func localizedErrorMessage(code, message string) string {
 		"PASSWORD_CHANGE_FAILED":    "密码修改失败",
 		"INVALID_PAYLOAD":           "提交内容格式不正确",
 		"DATABASE_TEST_FAILED":      "数据库连接测试失败",
+		"DATABASE_SAVE_FAILED":      "数据库配置保存失败",
 		"DATABASE_IMPORT_FAILED":    "SQLite 导入远端库失败",
 		"DATABASE_SYNC_FAILED":      "远端库同步回本地失败",
 		"LEGACY_SAVE_FAILED":        "兼容 JSON 保存失败",
@@ -97,6 +106,9 @@ func localizedErrorMessage(code, message string) string {
 		"AUDIT_FAILED":              "审计日志加载失败",
 		"FEEDBACK_LIST_FAILED":      "反馈列表加载失败",
 		"FEEDBACK_UPDATE_FAILED":    "反馈工单更新失败",
+		"MAIL_CONFIG_FAILED":        "邮件配置保存失败",
+		"MAIL_TEST_FAILED":          "测试邮件发送失败",
+		"MAIL_RETRY_FAILED":         "反馈邮件重试失败",
 		"NOTICE_NOT_FOUND":          "未找到版本日志",
 		"NOTICES_FAILED":            "版本日志加载失败",
 		"MEDIA_TYPES_FAILED":        "媒体源 JSON 加载失败",

server/unified-management/internal/web/router_test.go

@@ -130,12 +130,111 @@ func TestClientBootstrapAndEndpointsShape(t *testing.T) {
 			}
 			continue
 		}
+		if path == "/api/client/bootstrap" {
+			branding, ok := payload["branding"].(map[string]any)
+			if !ok {
+				t.Fatalf("bootstrap missing branding: %#v", payload)
+			}
+			if branding["developerName"] != "YMhut" || branding["feedbackEmail"] != "support@ymhut.cn" {
+				t.Fatalf("unexpected branding defaults: %#v", branding)
+			}
+		}
 		if payload["ok"] != true {
 			t.Fatalf("%s missing ok=true: %#v", path, payload)
 		}
 	}
 }
 
+func TestAdminDeleteSourcePublishesCompatibilityJSON(t *testing.T) {
+	handler, cleanup := testRouter(t)
+	defer cleanup()
+	session, csrf, err := loginForTest(handler)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/admin/sources/demo", nil)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	req.Header.Set("X-CSRF-Token", csrf)
+	res := httptest.NewRecorder()
+	handler.ServeHTTP(res, req)
+	if res.Code != http.StatusOK {
+		t.Fatalf("delete source returned %d: %s", res.Code, res.Body.String())
+	}
+
+	mediaReq := httptest.NewRequest(http.MethodGet, "/media-types.json", nil)
+	mediaRes := httptest.NewRecorder()
+	handler.ServeHTTP(mediaRes, mediaReq)
+	if mediaRes.Code != http.StatusOK {
+		t.Fatalf("media-types returned %d: %s", mediaRes.Code, mediaRes.Body.String())
+	}
+	if strings.Contains(mediaRes.Body.String(), `"demo"`) {
+		t.Fatalf("deleted source leaked into media-types.json: %s", mediaRes.Body.String())
+	}
+
+	updateReq := httptest.NewRequest(http.MethodGet, "/update-info.json", nil)
+	updateRes := httptest.NewRecorder()
+	handler.ServeHTTP(updateRes, updateReq)
+	if updateRes.Code != http.StatusOK {
+		t.Fatalf("update-info returned %d: %s", updateRes.Code, updateRes.Body.String())
+	}
+	var updatePayload map[string]any
+	if err := json.Unmarshal(updateRes.Body.Bytes(), &updatePayload); err != nil {
+		t.Fatal(err)
+	}
+	assertJSONKeys(t, "update-info after source delete", updatePayload, []string{"app_version", "manifest_version", "packages", "modules"})
+}
+
+func TestAdminAuditPaginationAndBranding(t *testing.T) {
+	handler, cleanup := testRouter(t)
+	defer cleanup()
+	session, csrf, err := loginForTest(handler)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	for i := 0; i < 40; i++ {
+		body := strings.NewReader(`{"developerName":"YMhut","feedbackEmail":"support@ymhut.cn"}`)
+		req := httptest.NewRequest(http.MethodPost, "/api/admin/system/branding", body)
+		req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+		req.Header.Set("X-CSRF-Token", csrf)
+		req.Header.Set("Content-Type", "application/json")
+		res := httptest.NewRecorder()
+		handler.ServeHTTP(res, req)
+		if res.Code != http.StatusOK {
+			t.Fatalf("branding save %d returned %d: %s", i, res.Code, res.Body.String())
+		}
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "/api/admin/system/audit?page=1&perPage=35&type=system.branding.saved", nil)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	res := httptest.NewRecorder()
+	handler.ServeHTTP(res, req)
+	if res.Code != http.StatusOK {
+		t.Fatalf("audit returned %d: %s", res.Code, res.Body.String())
+	}
+	var payload struct {
+		Items []any `json:"items"`
+		Page  struct {
+			Total   int `json:"total"`
+			Page    int `json:"page"`
+			PerPage int `json:"perPage"`
+		} `json:"page"`
+	}
+	if err := json.Unmarshal(res.Body.Bytes(), &payload); err != nil {
+		t.Fatal(err)
+	}
+	if payload.Page.Page != 1 || payload.Page.PerPage != 35 {
+		t.Fatalf("unexpected audit page metadata: %#v", payload.Page)
+	}
+	if payload.Page.Total < 40 {
+		t.Fatalf("expected at least 40 branding audit records, got %d", payload.Page.Total)
+	}
+	if len(payload.Items) > 35 {
+		t.Fatalf("expected at most 35 audit items, got %d", len(payload.Items))
+	}
+}
+
 func TestLegacyFeedbackStatusDTOContract(t *testing.T) {
 	payload := legacyFeedbackStatus(db.Feedback{
 		Code:                 "FB-20260626-ABCDEF",
@@ -419,6 +518,80 @@ func TestAdminLegacyRequiresAuth(t *testing.T) {
 	}
 }
 
+func TestAdminLegacyUpdateInfoSyncsReleaseNotice(t *testing.T) {
+	handler, cleanup := testRouter(t)
+	defer cleanup()
+
+	session, csrf, err := loginForTest(handler)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := json.Marshal(map[string]string{
+		"raw": `{"app_version":"2.0.7.5","title":"YMhut Box 2.0.7.5","message":"随机放映室优化","release_notes":"修复图片源和全屏预览"}`,
+	})
+	req := httptest.NewRequest(http.MethodPut, "/api/admin/legacy/update-info", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-CSRF-Token", csrf)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	res := httptest.NewRecorder()
+	handler.ServeHTTP(res, req)
+	if res.Code != http.StatusOK {
+		t.Fatalf("save update-info returned %d: %s", res.Code, res.Body.String())
+	}
+
+	listReq := httptest.NewRequest(http.MethodGet, "/api/admin/releases/notices", nil)
+	listReq.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	listRes := httptest.NewRecorder()
+	handler.ServeHTTP(listRes, listReq)
+	if listRes.Code != http.StatusOK {
+		t.Fatalf("notice list returned %d: %s", listRes.Code, listRes.Body.String())
+	}
+	var payload struct {
+		Items []struct {
+			Version string `json:"version"`
+			Title   string `json:"title"`
+		} `json:"items"`
+	}
+	if err := json.Unmarshal(listRes.Body.Bytes(), &payload); err != nil {
+		t.Fatal(err)
+	}
+	found := false
+	for _, item := range payload.Items {
+		if item.Version == "2.0.7.5" && item.Title == "YMhut Box 2.0.7.5" {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("synced release notice not found: %#v", payload.Items)
+	}
+}
+
+func TestAdminLegacyValidationErrorIsChinese(t *testing.T) {
+	handler, cleanup := testRouter(t)
+	defer cleanup()
+
+	session, csrf, err := loginForTest(handler)
+	if err != nil {
+		t.Fatal(err)
+	}
+	body, _ := json.Marshal(map[string]string{"raw": `{"message":"missing version and title"}`})
+	req := httptest.NewRequest(http.MethodPost, "/api/admin/legacy/update-info/validate", bytes.NewReader(body))
+	req.Header.Set("Content-Type", "application/json")
+	req.Header.Set("X-CSRF-Token", csrf)
+	req.AddCookie(&http.Cookie{Name: auth.SessionCookie, Value: session})
+	res := httptest.NewRecorder()
+	handler.ServeHTTP(res, req)
+	if res.Code != http.StatusBadRequest {
+		t.Fatalf("expected validation failure, got %d: %s", res.Code, res.Body.String())
+	}
+	if strings.Contains(res.Body.String(), "update-info requires app_version or title") {
+		t.Fatalf("english validation leaked: %s", res.Body.String())
+	}
+	if !strings.Contains(res.Body.String(), "更新 JSON 需要填写 app_version 或 title") {
+		t.Fatalf("missing chinese validation message: %s", res.Body.String())
+	}
+}
+
 func TestAdminWriteRequiresCSRF(t *testing.T) {
 	handler, cleanup := testRouter(t)
 	defer cleanup()
@@ -599,9 +772,12 @@ func testRouter(t *testing.T) (http.Handler, func()) {
 	})
 	mustWriteJSON(t, filepath.Join(noticeDir, "2.0.0.json"), map[string]any{"app_version": "2.0.0", "title": "YMhut Box 2.0.0", "release_notes": "Initial release", "release_notes_md": "## Initial"})
 	cfg := &config.Config{
+		BaseDir:                root,
+		ConfigPath:             filepath.Join(root, "config.json"),
 		Listen:                 ":0",
 		BaseURL:                "https://update.ymhut.cn",
 		StorageDir:             filepath.Join(root, "storage"),
+		DataDir:                filepath.Join(root, "data"),
 		UpdatePublicDir:        public,
 		UpdateNoticeDir:        noticeDir,
 		DownloadsDir:           filepath.Join(public, "downloads"),

server/unified-management/internal/web/setup.go

@@ -3,11 +3,8 @@ package web
 import (
 	"encoding/json"
 	"errors"
-	"fmt"
 	"net/http"
-	"net/url"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"time"
 
@@ -24,18 +21,7 @@ type setupRequest struct {
 	BaseURL    string           `json:"baseUrl"`
 	SQLitePath string           `json:"sqlitePath"`
 	MySQLDSN   string           `json:"mysqlDsn"`
-	MySQL      setupMySQLConfig `json:"mysql"`
-}
-
-type setupMySQLConfig struct {
-	Host      string `json:"host"`
-	Port      int    `json:"port"`
-	Database  string `json:"database"`
-	Username  string `json:"username"`
-	Password  string `json:"password"`
-	Charset   string `json:"charset"`
-	ParseTime bool   `json:"parseTime"`
-	TLS       string `json:"tls"`
+	MySQL      config.MySQLInput `json:"mysql"`
 }
 
 func NewSetupRouter(cfg *config.Config) http.Handler {
@@ -73,7 +59,7 @@ func (r *setupRouter) status() map[string]any {
 		"defaults": map[string]any{
 			"provider":   firstNonEmpty(r.cfg.Database.Provider, "sqlite"),
 			"sqlitePath": relativeToBase(r.cfg.BaseDir, r.cfg.Database.SQLitePath),
-			"mysqlDsn":   maskDSN(r.cfg.Database.MySQLDSN),
+			"mysqlDsn":   config.MaskDSN(r.cfg.Database.MySQLDSN),
 			"baseUrl":    r.cfg.BaseURL,
 		},
 	}
@@ -103,7 +89,7 @@ func (r *setupRouter) handleDatabaseTest(w http.ResponseWriter, req *http.Reques
 			"provider":   next.Provider,
 			"baseUrl":    firstNonEmpty(body.BaseURL, r.cfg.BaseURL),
 			"sqlitePath": relativeToBase(r.cfg.BaseDir, next.SQLitePath),
-			"mysqlDsn":   maskDSN(next.MySQLDSN),
+			"mysqlDsn":   config.MaskDSN(next.MySQLDSN),
 		},
 	})
 }
@@ -153,44 +139,18 @@ func (r *setupRouter) decodeSetupDatabase(req *http.Request) (config.DatabaseCon
 	if err := json.NewDecoder(req.Body).Decode(&body); err != nil {
 		return config.DatabaseConfig{}, body, err
 	}
-	next := r.cfg.Database
-	next.Provider = strings.ToLower(strings.TrimSpace(firstNonEmpty(body.Provider, next.Provider, "sqlite")))
-	if body.SQLitePath != "" {
-		next.SQLitePath = body.SQLitePath
+	incoming := config.DatabaseConfig{
+		Provider:      body.Provider,
+		SQLitePath:    body.SQLitePath,
+		MySQLDSN:      body.MySQLDSN,
+		MySQLHost:     body.MySQL.Host,
+		MySQLPort:     body.MySQL.Port,
+		MySQLDatabase: body.MySQL.Database,
+		MySQLUser:     body.MySQL.Username,
+		MySQLPassword: body.MySQL.Password,
 	}
-	if next.SQLitePath != "" && !filepath.IsAbs(next.SQLitePath) && !strings.HasPrefix(strings.ToLower(next.SQLitePath), "file:") {
-		next.SQLitePath = filepath.Join(r.cfg.BaseDir, next.SQLitePath)
-	}
-	if next.Provider == "sqlite" {
-		next.MySQLDSN = ""
-	} else if body.MySQLDSN != "" {
-		next.MySQLDSN = body.MySQLDSN
-	} else if body.MySQL.Host != "" || body.MySQL.Database != "" || body.MySQL.Username != "" {
-		dsn, err := buildMySQLDSN(body.MySQL)
-		if err != nil {
-			return config.DatabaseConfig{}, body, err
-		}
-		next.MySQLDSN = dsn
-	}
-	if next.Provider != "sqlite" && next.Provider != "mysql" {
-		return config.DatabaseConfig{}, body, errors.New("provider must be sqlite or mysql")
-	}
-	if next.Provider == "mysql" && strings.TrimSpace(next.MySQLDSN) == "" {
-		return config.DatabaseConfig{}, body, errors.New("mysql connection is required")
-	}
-	if next.MaxOpenConns <= 0 {
-		next.MaxOpenConns = 10
-	}
-	if next.MaxIdleConns <= 0 {
-		next.MaxIdleConns = 4
-	}
-	if next.ConnMaxLifetimeSeconds <= 0 {
-		next.ConnMaxLifetimeSeconds = 300
-	}
-	if next.HealthIntervalSec <= 0 {
-		next.HealthIntervalSec = 30
-	}
-	return next, body, nil
+	next, err := config.NormalizeDatabase(r.cfg.BaseDir, r.cfg.Database, incoming, false)
+	return next, body, err
 }
 
 func (r *setupRouter) serveSetup(w http.ResponseWriter, req *http.Request) {
@@ -205,48 +165,9 @@ func (r *setupRouter) serveSetup(w http.ResponseWriter, req *http.Request) {
 	_, _ = w.Write([]byte(`<!doctype html><html lang="zh-CN"><head><meta charset="utf-8"><title>YMhut Setup</title></head><body><main><h1>YMhut Setup</h1><p>Setup frontend is not built. Run npm install && npm run build in web/setup.</p><p>` + index + `</p></main></body></html>`))
 }
 
-func buildMySQLDSN(input setupMySQLConfig) (string, error) {
-	host := strings.TrimSpace(input.Host)
-	if host == "" {
-		host = "127.0.0.1"
-	}
-	port := input.Port
-	if port <= 0 {
-		port = 3306
-	}
-	database := strings.TrimSpace(input.Database)
-	username := strings.TrimSpace(input.Username)
-	if database == "" {
-		return "", errors.New("mysql database is required")
-	}
-	if username == "" {
-		return "", errors.New("mysql username is required")
-	}
-	params := url.Values{}
-	params.Set("charset", firstNonEmpty(strings.TrimSpace(input.Charset), "utf8mb4"))
-	params.Set("parseTime", strconv.FormatBool(input.ParseTime))
-	if tls := strings.TrimSpace(input.TLS); tls != "" {
-		params.Set("tls", tls)
-	}
-	return fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?%s", username, input.Password, host, port, database, params.Encode()), nil
-}
-
-func maskDSN(value string) string {
-	value = strings.TrimSpace(value)
-	if value == "" {
-		return ""
-	}
-	at := strings.Index(value, "@")
-	colon := strings.Index(value, ":")
-	if at > -1 && colon > -1 && colon < at {
-		return value[:colon+1] + "******" + value[at:]
-	}
-	return value
-}
-
 func maskedDatabaseTarget(base string, cfg config.DatabaseConfig) string {
 	if strings.EqualFold(cfg.Provider, "mysql") {
-		return maskDSN(cfg.MySQLDSN)
+		return config.MaskDSN(cfg.MySQLDSN)
 	}
 	return relativeToBase(base, cfg.SQLitePath)
 }