server: Go 服务器（REST+WSS 网关+JWT+Argon2+配对+素材直链+任务状态机）；修复并发下线 send-on-closed-channel、下发查询 SQL 优先级、配对码原子占用、上传体积上限、JWT 默认密钥告警

server/internal/api/router.go

@@ -0,0 +1,156 @@
+package api
+
+import (
+	"crypto/ed25519"
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+
+	"everypublish/server/internal/api/handlers"
+	"everypublish/server/internal/api/middleware"
+	"everypublish/server/internal/cache"
+	"everypublish/server/internal/config"
+	"everypublish/server/internal/ws"
+)
+
+// Router 装配 gin 路由
+func Router(cfg *config.Config, db *gorm.DB, rds *cache.Redis, hub *ws.Hub, serverKey ed25519.PrivateKey, dsp *ws.Dispatcher) *gin.Engine {
+	r := gin.New()
+	r.Use(gin.Logger(), gin.Recovery())
+
+	r.GET("/health", func(c *gin.Context) {
+		dbOK := false
+		if sqlDB, err := db.DB(); err == nil {
+			dbOK = sqlDB.Ping() == nil
+		}
+		redisOK := rds.Ping() == nil
+		c.JSON(http.StatusOK, gin.H{
+			"status":  "ok",
+			"service": "everypublish-server",
+			"time":    time.Now().Format(time.RFC3339),
+			"db":      dbOK,
+			"redis":   redisOK,
+		})
+	})
+
+	// WSS 双通道：Agent 设备签名 / 浏览器 JWT
+	r.GET("/ws/agent", ws.HandleAgent(cfg, db, hub, serverKey))
+	r.GET("/ws/browser", ws.HandleBrowser(cfg, hub))
+
+	api := r.Group("/api/v1")
+	api.Use(middleware.Audit(db))
+
+	authH := &handlers.AuthHandler{DB: db, Rds: rds, Cfg: cfg}
+	wsH := &handlers.WorkspaceHandler{DB: db}
+	mbH := &handlers.MemberHandler{DB: db, Cfg: cfg}
+	adH := &handlers.AuditHandler{DB: db}
+	accH := &handlers.AccountHandler{DB: db, Hub: hub}
+	matH := &handlers.MaterialHandler{DB: db, Cfg: cfg}
+	tskH := &handlers.TaskHandler{DB: db, Dispatcher: dsp}
+	chlH := &handlers.ChallengeHandler{DB: db}
+	ntfH := &handlers.NotificationHandler{DB: db}
+	agH := &handlers.AgentHandler{DB: db, Hub: hub}
+
+	auth := api.Group("/auth")
+	{
+		auth.POST("/register", authH.Register)
+		auth.POST("/login", authH.Login)
+		auth.POST("/refresh", authH.Refresh)
+		auth.POST("/logout", middleware.AuthRequired(cfg), authH.Logout)
+		auth.GET("/me", middleware.AuthRequired(cfg), authH.Me)
+	}
+
+	wsg := api.Group("/workspaces", middleware.AuthRequired(cfg))
+	{
+		wsg.POST("", wsH.Create)
+		wsg.GET("", wsH.List)
+		wsg.PUT("/:id", wsH.Update)
+	}
+
+	mb := api.Group("/members", middleware.AuthRequired(cfg))
+	{
+		mb.GET("", mbH.List)
+		mb.POST("/invite", mbH.Invite)
+		mb.POST("/join", mbH.Join)
+		mb.PUT("/:id/role", mbH.UpdateRole)
+		mb.DELETE("/:id", mbH.Remove)
+	}
+
+	ad := api.Group("/audit-logs", middleware.AuthRequired(cfg))
+	{
+		ad.GET("", adH.List)
+	}
+
+	acc := api.Group("/accounts", middleware.AuthRequired(cfg))
+	{
+		acc.GET("", accH.List)
+		acc.POST("", accH.Create)
+		acc.PUT("/:id", accH.Update)
+		acc.DELETE("/:id", accH.Delete)
+		acc.POST("/:id/bind", accH.Bind)
+	}
+
+	mat := api.Group("/materials", middleware.AuthRequired(cfg))
+	{
+		mat.GET("", matH.List)
+		mat.POST("", matH.Upload)
+		mat.DELETE("/:id", matH.Delete)
+		mat.GET("/:id/url", matH.URL)
+	}
+
+	files := api.Group("/files")
+	{
+		files.GET("/:token", matH.ServeFile)
+	}
+
+	tsk := api.Group("/tasks", middleware.AuthRequired(cfg))
+	{
+		tsk.GET("", tskH.List)
+		tsk.POST("", tskH.Create)
+		tsk.GET("/:id", tskH.Get)
+		tsk.PUT("/:id", tskH.Update)
+		tsk.DELETE("/:id", tskH.Delete)
+		tsk.POST("/:id/submit", tskH.Submit)
+		tsk.POST("/:id/approve", tskH.Approve)
+		tsk.POST("/:id/reject", tskH.Reject)
+		tsk.POST("/:id/resubmit", tskH.Resubmit)
+		tsk.POST("/:id/retry", tskH.Retry)
+		tsk.POST("/:id/cancel", tskH.Cancel)
+	}
+
+	chl := api.Group("/challenges", middleware.AuthRequired(cfg))
+	{
+		chl.GET("", chlH.List)
+		chl.POST("/:id/solve", chlH.Solve)
+		chl.POST("/:id/resend", chlH.Resend)
+		chl.POST("/:id/suspend", chlH.Suspend)
+	}
+
+	ntf := api.Group("/notifications", middleware.AuthRequired(cfg))
+	{
+		ntf.GET("", ntfH.List)
+		ntf.POST("/:id/read", ntfH.Read)
+		ntf.POST("/read-all", ntfH.ReadAll)
+	}
+
+	ag := api.Group("/agent")
+	{
+		ag.POST("/pair-code", middleware.AuthRequired(cfg), agH.PairCode)
+		ag.GET("/devices", middleware.AuthRequired(cfg), agH.Devices)
+		ag.PUT("/devices/:id/revoke", middleware.AuthRequired(cfg), agH.Revoke)
+	}
+	api.POST("/agent/pair", agH.Pair)
+
+	admH := &handlers.AdminHandler{DB: db, Hub: hub}
+	adm := api.Group("/admin", middleware.AuthRequired(cfg), middleware.AdminRequired())
+	{
+		adm.GET("/tenants", admH.Tenants)
+		adm.PUT("/tenants/:id/status", admH.TenantStatus)
+		adm.GET("/agents", admH.Agents)
+		adm.PUT("/agents/:id/revoke", admH.AgentRevoke)
+	}
+
+	return r
+}