Initialize AutoLibrary website with Gitea deployment

backend/handlers/themes_handler/auth.go

@@ -0,0 +1,226 @@
+package themes_handler
+
+import (
+	"bytes"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"strings"
+
+	"github.com/dchest/captcha"
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) GetUserRole(c *gin.Context) {
+	userID, _ := c.Get("user_id")
+	userName, _ := c.Get("user_name")
+	displayName, _ := c.Get("display_name")
+	isAdmin, _ := c.Get("is_admin")
+	userTag, _ := c.Get("user_tag")
+
+	isAdminBool := false
+	if isAdmin != nil {
+		isAdminBool = isAdmin.(bool)
+	}
+	displayNameStr := ""
+	if displayName != nil {
+		displayNameStr = displayName.(string)
+	}
+	userTagStr := ""
+	if userTag != nil {
+		userTagStr = userTag.(string)
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > user role",
+		"data": gin.H{
+			"user_id":      userID,
+			"user_name":    userName,
+			"display_name": displayNameStr,
+			"is_admin":     isAdminBool,
+			"is_verified":  isAdminBool || userTagStr == "verified",
+		},
+	})
+}
+
+// GET /api/user/downloads (stretch goal)
+
+func (h *Handler) GetUserDownloads(c *gin.Context) {
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > download history not yet implemented",
+		"data": []interface{}{},
+	})
+}
+
+// GET /api/marketplace/auth/captcha
+
+func (h *Handler) GetCaptcha(c *gin.Context) {
+	id := captcha.NewLen(4)
+	var buf bytes.Buffer
+	if err := captcha.WriteImage(&buf, id, 150, 50); err != nil {
+		log.Printf("[E] CAPTCHA > failed to generate: %v", err)
+		c.JSON(http.StatusInternalServerError, gin.H{"code": http.StatusInternalServerError, "msg": "captcha generation failed", "data": nil})
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > captcha",
+		"data": gin.H{
+			"captchaId":    id,
+			"captchaImage": "data:image/png;base64," + base64.StdEncoding.EncodeToString(buf.Bytes()),
+		},
+	})
+}
+
+// GET /api/marketplace/auth/config
+
+func (h *Handler) GetAuthConfig(c *gin.Context) {
+	cfg := h.Config
+	casdoorConfigured := cfg.Backend.Casdoor.Endpoint != "" && cfg.Backend.Casdoor.ClientID != ""
+
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > auth config",
+		"data": gin.H{
+			"casdoor_configured":   casdoorConfigured,
+			"casdoor_endpoint":     cfg.Backend.Casdoor.Endpoint,
+			"casdoor_client_id":    cfg.Backend.Casdoor.ClientID,
+			"casdoor_organization": cfg.Backend.Casdoor.Organization,
+			"casdoor_application":  cfg.Backend.Casdoor.Application,
+		},
+	})
+}
+
+// POST /api/marketplace/auth/login
+
+func (h *Handler) LoginProxy(c *gin.Context) {
+	cfg := h.Config
+
+	var req struct {
+		Username string `json:"username"`
+		Password string `json:"password"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"code": http.StatusBadRequest, "msg": "PUT > invalid request body", "data": nil})
+		return
+	}
+
+	// Proxy to Casdoor OAuth token endpoint
+	tokenURL := cfg.Backend.Casdoor.Endpoint + "/api/login/oauth/access_token"
+	values := url.Values{
+		"grant_type":    {"password"},
+		"client_id":     {cfg.Backend.Casdoor.ClientID},
+		"client_secret": {cfg.Backend.Casdoor.ClientSecret},
+		"username":      {req.Username},
+		"password":      {req.Password},
+		"scope":         {"read"},
+	}
+	reqHTTP, err := http.NewRequestWithContext(c.Request.Context(), http.MethodPost, tokenURL, strings.NewReader(values.Encode()))
+	if err != nil {
+		fail(c, http.StatusBadGateway, "Invalid authentication server configuration")
+		return
+	}
+	reqHTTP.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	resp, err := h.HTTP.Do(reqHTTP)
+	if err != nil {
+		log.Printf("[E] AUTH > login proxy error: %v", err)
+		c.JSON(http.StatusBadGateway, gin.H{"code": http.StatusBadGateway, "msg": "auth server unreachable", "data": nil})
+		return
+	}
+	defer resp.Body.Close()
+
+	body, readErr := io.ReadAll(io.LimitReader(resp.Body, 2<<20))
+	if readErr != nil {
+		fail(c, http.StatusBadGateway, "Unable to read authentication response")
+		return
+	}
+	if resp.StatusCode != http.StatusOK {
+		c.JSON(http.StatusUnauthorized, gin.H{"code": http.StatusUnauthorized, "msg": "invalid credentials", "data": nil})
+		return
+	}
+
+	c.Header("Content-Type", "application/json")
+	c.String(http.StatusOK, string(body))
+}
+
+// POST /api/marketplace/auth/signup
+
+func (h *Handler) SignupProxy(c *gin.Context) {
+	cfg := h.Config
+
+	var req struct {
+		Username    string `json:"username"`
+		Password    string `json:"password"`
+		Email       string `json:"email"`
+		Name        string `json:"name"`
+		CaptchaId   string `json:"captchaId"`
+		CaptchaCode string `json:"captchaCode"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"code": http.StatusBadRequest, "msg": "PUT > invalid request body", "data": nil})
+		return
+	}
+	if req.Username == "" || req.Password == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"code": http.StatusBadRequest, "msg": "用户名和密码为必填项", "data": nil})
+		return
+	}
+
+	// Validate captcha
+	if !captcha.VerifyString(req.CaptchaId, req.CaptchaCode) {
+		c.JSON(http.StatusBadRequest, gin.H{"code": http.StatusBadRequest, "msg": "验证码错误或已过期", "data": nil})
+		return
+	}
+
+	// Proxy to Casdoor signup API
+	signupData := map[string]interface{}{
+		"organization": cfg.Backend.Casdoor.Organization,
+		"username":     req.Username,
+		"password":     req.Password,
+		"application":  cfg.Backend.Casdoor.Application,
+	}
+	if req.Email != "" {
+		signupData["email"] = req.Email
+	}
+	if req.Name != "" {
+		signupData["name"] = req.Name
+	}
+	signupURL := cfg.Backend.Casdoor.Endpoint + "/api/signup"
+	signupBody, _ := json.Marshal(signupData)
+	reqHTTP, err := http.NewRequestWithContext(c.Request.Context(), http.MethodPost, signupURL, bytes.NewReader(signupBody))
+	if err != nil {
+		fail(c, http.StatusBadGateway, "Invalid authentication server configuration")
+		return
+	}
+	reqHTTP.Header.Set("Content-Type", "application/json")
+	resp, err := h.HTTP.Do(reqHTTP)
+	if err != nil {
+		log.Printf("[E] AUTH > signup proxy error: %v", err)
+		c.JSON(http.StatusBadGateway, gin.H{"code": http.StatusBadGateway, "msg": "auth server unreachable", "data": nil})
+		return
+	}
+	defer resp.Body.Close()
+
+	body, _ := io.ReadAll(resp.Body)
+
+	var result map[string]interface{}
+	json.Unmarshal(body, &result)
+
+	if status, ok := result["status"]; !ok || status != "ok" {
+		msg := "注册失败"
+		if m, ok := result["msg"]; ok {
+			msg = fmt.Sprintf("%v", m)
+		}
+		c.JSON(http.StatusBadRequest, gin.H{"code": http.StatusBadRequest, "msg": msg, "data": nil})
+		return
+	}
+
+	log.Printf("[I] AUTH > signup successful for user: %s", req.Username)
+	c.Header("Content-Type", "application/json")
+	c.String(http.StatusOK, string(body))
+}

backend/handlers/themes_handler/dependencies.go

@@ -0,0 +1,28 @@
+package themes_handler
+
+import (
+	"net/http"
+	"time"
+
+	"autolibrary.top/webserver/backend/services/theme_files"
+	"autolibrary.top/webserver/backend/services/themes_service"
+	"autolibrary.top/webserver/backend/services/users_service"
+	"autolibrary.top/webserver/config"
+
+	"gorm.io/gorm"
+)
+
+// Handler shares explicit dependencies across the marketplace HTTP handlers.
+// A separate instance can be constructed for each database and storage root.
+type Handler struct {
+	DB     *gorm.DB
+	Config *config.Config
+	Files  *theme_files.Store
+	Users  *users_service.Cache
+	HTTP   *http.Client
+	Themes *themes_service.Service
+}
+
+func New(db *gorm.DB, cfg *config.Config, files *theme_files.Store, users *users_service.Cache) *Handler {
+	return &Handler{DB: db, Config: cfg, Files: files, Users: users, Themes: &themes_service.Service{DB: db, Files: files}, HTTP: &http.Client{Timeout: 15 * time.Second}}
+}

backend/handlers/themes_handler/download.go

@@ -0,0 +1,71 @@
+package themes_handler
+
+import (
+	"errors"
+	"fmt"
+	"mime"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"autolibrary.top/webserver/backend/models/themes_model"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func (h *Handler) DownloadTheme(c *gin.Context)      { h.serveTheme(c, true) }
+func (h *Handler) AdminDownloadTheme(c *gin.Context) { h.serveTheme(c, false) }
+
+func (h *Handler) serveTheme(c *gin.Context, public bool) {
+	id, err := parseThemeID(c)
+	if err != nil {
+		fail(c, http.StatusBadRequest, "Invalid theme ID")
+		return
+	}
+	var theme themes_model.Theme
+	query := h.DB
+	if public {
+		query = query.Where("status = ?", themes_model.ThemeApproved)
+	}
+	err = query.First(&theme, id).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		fail(c, 404, "Theme not found")
+		return
+	}
+	if err != nil {
+		fail(c, 500, "Unable to load theme")
+		return
+	}
+	path := h.Themes.ArchivePath(theme.ID)
+	info, err := os.Stat(path)
+	if err != nil || info.IsDir() {
+		fail(c, 404, "Theme file not found")
+		return
+	}
+	if public {
+		h.DB.Model(&theme).UpdateColumn("download_count", gorm.Expr("download_count + 1"))
+	}
+	version := strings.TrimLeft(theme.Version, "vV")
+	name := fmt.Sprintf("%s_v%s.altheme", theme.Name, version)
+	c.Header("Content-Disposition", mime.FormatMediaType("attachment", map[string]string{"filename": name}))
+	c.Header("Content-Type", "application/zip")
+	c.File(path)
+}
+
+func (h *Handler) ServePreview(c *gin.Context) {
+	name := c.Param("filename")
+	if name == "." || name == ".." || strings.ContainsAny(name, `/\`) || filepath.Base(name) != name {
+		fail(c, 400, "Invalid preview filename")
+		return
+	}
+	path := filepath.Join(h.Files.Root(), "previews", name)
+	info, err := os.Stat(path)
+	if err != nil || info.IsDir() {
+		fail(c, 404, "Preview not found")
+		return
+	}
+	c.Header("Cache-Control", "public, max-age=3600")
+	c.File(path)
+}

backend/handlers/themes_handler/query.go

@@ -0,0 +1,228 @@
+package themes_handler
+
+import (
+	"fmt"
+	"log"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"autolibrary.top/webserver/backend/models/themes_model"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) GetFeaturedThemes(c *gin.Context) {
+	limitStr := c.Query("limit")
+	limit := 6
+	if limitStr != "" {
+		if v, err := strconv.Atoi(limitStr); err == nil && v > 0 && v <= 20 {
+			limit = v
+		}
+	}
+
+	var themes []themes_model.Theme
+	result := h.DB.
+		Where("status = ?", themes_model.ThemeApproved).
+		Order("download_count DESC").
+		Limit(limit).
+		Find(&themes)
+	if result.Error != nil {
+		log.Printf("[E] GET > occur an error when get featured themes: %v", result.Error)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code": http.StatusInternalServerError,
+			"msg":  "GET > occur an error when get featured themes",
+			"data": nil,
+		})
+		return
+	}
+
+	for i := range themes {
+		themes[i].Author = h.Users.ResolveAuthor(themes[i].UserID, themes[i].Author)
+		themes[i].Verified = h.Users.IsVerified(themes[i].UserID)
+	}
+
+	log.Printf("[I] GET > get featured themes (limit=%d) successful", limit)
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > get featured themes successful",
+		"data": themes,
+	})
+}
+
+// GET /api/themes?page=1&per_page=9&need_theme=&tags=&search=&sort=popular
+
+func (h *Handler) GetThemes(c *gin.Context) {
+	pageStr := c.Query("page")
+	perPageStr := c.Query("per_page")
+	needTheme := c.Query("need_theme")
+	tagsStr := c.Query("tags")
+	search := c.Query("search")
+	sort := c.Query("sort")
+
+	if pageStr == "" {
+		pageStr = "1"
+	}
+	if perPageStr == "" {
+		perPageStr = "9"
+	}
+	if sort == "" {
+		sort = "popular"
+	}
+
+	page, err := strconv.Atoi(pageStr)
+	if err != nil || page <= 0 {
+		page = 1
+	}
+	perPage, err := strconv.Atoi(perPageStr)
+	if err != nil || perPage <= 0 || perPage > 50 {
+		perPage = 9
+	}
+
+	offset := (page - 1) * perPage
+
+	query := h.DB.Where("status = ?", themes_model.ThemeApproved)
+
+	if needTheme != "" {
+		if needTheme == "both" {
+			query = query.Where("need_theme = ?", "both")
+		} else if needTheme == "dark" || needTheme == "light" {
+			query = query.Where("need_theme = ? OR need_theme = ?", needTheme, "both")
+		}
+	}
+
+	if tagsStr != "" {
+		tags := strings.Split(tagsStr, ",")
+		for _, tag := range tags {
+			tag = strings.TrimSpace(tag)
+			if tag != "" {
+				query = query.Where("tags LIKE ?", fmt.Sprintf("%%%s%%", tag))
+			}
+		}
+	}
+
+	if search != "" {
+		like := fmt.Sprintf("%%%s%%", search)
+		query = query.Where("name LIKE ? OR brief LIKE ? OR author LIKE ?", like, like, like)
+	}
+
+	switch sort {
+	case "newest":
+		query = query.Order("created_at DESC")
+	case "name":
+		query = query.Order("name ASC")
+	default: // popular
+		query = query.Order("download_count DESC")
+	}
+
+	var total int64
+	if result := query.Model(&themes_model.Theme{}).Count(&total); result.Error != nil {
+		log.Printf("[E] GET > occur an error when count themes: %v", result.Error)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code": http.StatusInternalServerError,
+			"msg":  "GET > occur an error when get themes",
+			"data": nil,
+		})
+		return
+	}
+
+	var themes []themes_model.Theme
+	result := query.Limit(perPage).Offset(offset).Find(&themes)
+	if result.Error != nil {
+		log.Printf("[E] GET > occur an error when get themes (page=%d, per_page=%d): %v", page, perPage, result.Error)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code": http.StatusInternalServerError,
+			"msg":  "GET > occur an error when get themes",
+			"data": nil,
+		})
+		return
+	}
+
+	for i := range themes {
+		themes[i].Author = h.Users.ResolveAuthor(themes[i].UserID, themes[i].Author)
+		themes[i].Verified = h.Users.IsVerified(themes[i].UserID)
+	}
+
+	totalPages := int(total) / perPage
+	if int(total)%perPage != 0 {
+		totalPages++
+	}
+
+	log.Printf("[I] GET > get themes (page=%d, per_page=%d, total=%d) successful", page, perPage, total)
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > get themes successful",
+		"data": gin.H{
+			"themes": themes,
+			"meta": gin.H{
+				"page":        page,
+				"per_page":    perPage,
+				"total":       total,
+				"total_pages": totalPages,
+				"has_next":    page < totalPages,
+			},
+		},
+	})
+}
+
+// GET /api/themes/:id
+
+func (h *Handler) GetThemeByID(c *gin.Context) {
+	id, err := strconv.Atoi(c.Param("id"))
+	if err != nil {
+		log.Printf("[E] GET > try to get theme, but got invalid id: '%s'", c.Param("id"))
+		c.JSON(http.StatusBadRequest, gin.H{
+			"code": http.StatusBadRequest,
+			"msg":  "GET > invalid id",
+			"data": nil,
+		})
+		return
+	}
+
+	var theme themes_model.Theme
+	result := h.DB.Where("status = ?", themes_model.ThemeApproved).First(&theme, id)
+	if result.Error != nil {
+		log.Printf("[E] GET > theme (id=%d) can not found: %v", id, result.Error)
+		c.JSON(http.StatusNotFound, gin.H{
+			"code": http.StatusNotFound,
+			"msg":  "GET > theme not found",
+			"data": nil,
+		})
+		return
+	}
+
+	theme.Author = h.Users.ResolveAuthor(theme.UserID, theme.Author)
+	theme.Verified = h.Users.IsVerified(theme.UserID)
+
+	log.Printf("[I] GET > get theme (id=%d) successful", id)
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > get theme successful",
+		"data": theme,
+	})
+}
+
+// GET /api/themes/:id/download
+
+func (h *Handler) GetUserThemes(c *gin.Context) {
+	userID, _ := c.Get("user_id")
+
+	var themes []themes_model.Theme
+	result := h.DB.
+		Where("user_id = ?", userID.(string)).
+		Order("created_at DESC").
+		Find(&themes)
+	if result.Error != nil {
+		log.Printf("[E] GET > occur an error when get user themes: %v", result.Error)
+		c.JSON(http.StatusInternalServerError, gin.H{"code": http.StatusInternalServerError, "msg": "获取用户主题失败", "data": nil})
+		return
+	}
+
+	for i := range themes {
+		themes[i].Author = h.Users.ResolveAuthor(themes[i].UserID, themes[i].Author)
+		themes[i].Verified = h.Users.IsVerified(themes[i].UserID)
+	}
+
+	log.Printf("[I] GET > get user themes (user_id=%s, count=%d) successful", userID.(string), len(themes))
+	c.JSON(http.StatusOK, gin.H{"code": http.StatusOK, "msg": "GET > get user themes successful", "data": themes})
+}

backend/handlers/themes_handler/review.go

@@ -0,0 +1,121 @@
+package themes_handler
+
+import (
+	"log"
+	"net/http"
+	"strconv"
+
+	"autolibrary.top/webserver/backend/models/themes_model"
+	"autolibrary.top/webserver/utils"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handler) GetPendingThemes(c *gin.Context) {
+	var themes []themes_model.Theme
+	result := h.DB.
+		Where("status = ?", themes_model.ThemePending).
+		Order("created_at ASC").
+		Find(&themes)
+	if result.Error != nil {
+		log.Printf("[E] GET > occur an error when get pending themes: %v", result.Error)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code": http.StatusInternalServerError,
+			"msg":  "GET > occur an error when get pending themes",
+			"data": nil,
+		})
+		return
+	}
+
+	for i := range themes {
+		themes[i].Author = h.Users.ResolveAuthor(themes[i].UserID, themes[i].Author)
+		themes[i].Verified = h.Users.IsVerified(themes[i].UserID)
+	}
+
+	log.Printf("[I] GET > get pending themes (count=%d) successful", len(themes))
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "GET > get pending themes successful",
+		"data": themes,
+	})
+}
+
+// PUT /api/admin/themes/:id/review
+
+func (h *Handler) ReviewTheme(c *gin.Context) {
+	id, err := strconv.Atoi(c.Param("id"))
+	if err != nil {
+		log.Printf("[E] PUT > try to review theme, but got invalid id: '%s'", c.Param("id"))
+		c.JSON(http.StatusBadRequest, gin.H{
+			"code": http.StatusBadRequest,
+			"msg":  "GET > invalid id",
+			"data": nil,
+		})
+		return
+	}
+
+	var body struct {
+		Action  string `json:"action"`
+		Comment string `json:"comment"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		log.Printf("[E] PUT > try to review theme (id=%d), but got invalid request data: %v", id, err)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"code": http.StatusBadRequest,
+			"msg":  "PUT > invalid request body",
+			"data": nil,
+		})
+		return
+	}
+
+	if body.Action != "approved" && body.Action != "rejected" {
+		log.Printf("[E] PUT > try to review theme (id=%d), but got invalid action: '%s'", id, body.Action)
+		c.JSON(http.StatusBadRequest, gin.H{
+			"code": http.StatusBadRequest,
+			"msg":  "操作必须为通过或退回",
+			"data": nil,
+		})
+		return
+	}
+
+	var theme themes_model.Theme
+	result := h.DB.First(&theme, id)
+	if result.Error != nil {
+		log.Printf("[E] PUT > theme (id=%d) can not found for review: %v", id, result.Error)
+		c.JSON(http.StatusNotFound, gin.H{
+			"code": http.StatusNotFound,
+			"msg":  "GET > theme not found",
+			"data": nil,
+		})
+		return
+	}
+
+	theme.Status = themes_model.ThemeStatus(body.Action)
+	theme.ReviewComment = body.Comment
+	theme.ReviewedBy = c.GetString("user_name")
+	if theme.ReviewedBy == "" {
+		theme.ReviewedBy = "api-key"
+	}
+	theme.UpdatedAt = utils.NowInShanghai()
+
+	result = h.DB.Save(&theme)
+	if result.Error != nil {
+		log.Printf("[E] PUT > occur an error when review theme (id=%d): %v", id, result.Error)
+		c.JSON(http.StatusInternalServerError, gin.H{
+			"code": http.StatusInternalServerError,
+			"msg":  "审核操作失败",
+			"data": nil,
+		})
+		return
+	}
+
+	theme.Author = h.Users.ResolveAuthor(theme.UserID, theme.Author)
+	theme.Verified = h.Users.IsVerified(theme.UserID)
+
+	log.Printf("[I] PUT > review theme (id=%d, action=%s) successful", id, body.Action)
+	c.JSON(http.StatusOK, gin.H{
+		"code": http.StatusOK,
+		"msg":  "PUT > review theme successful",
+		"data": theme,
+	})
+}

backend/handlers/themes_handler/update.go

@@ -0,0 +1,100 @@
+package themes_handler
+
+import (
+	"strconv"
+	"strings"
+	"unicode/utf8"
+
+	"autolibrary.top/webserver/backend/models/themes_model"
+	"autolibrary.top/webserver/utils"
+
+	"github.com/gin-gonic/gin"
+)
+
+func parseThemeID(c *gin.Context) (uint, error) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil || id == 0 {
+		return 0, strconv.ErrSyntax
+	}
+	return uint(id), nil
+}
+
+func (h *Handler) PutThemeByID(c *gin.Context) {
+	theme, ok := h.ownTheme(c)
+	if !ok {
+		return
+	}
+	var update struct {
+		Name          string   `json:"name"`
+		Brief         string   `json:"brief"`
+		Description   string   `json:"description"`
+		NeedTheme     string   `json:"need_theme"`
+		Tags          []string `json:"tags"`
+		Version       string   `json:"version"`
+		CompatVersion string   `json:"compat_version"`
+		PreviewURL    string   `json:"preview_url"`
+	}
+	if err := c.ShouldBindJSON(&update); err != nil {
+		fail(c, 400, "Invalid theme metadata")
+		return
+	}
+	if update.Name != "" && strings.TrimSpace(update.Name) != theme.Name {
+		var count int64
+		if err := h.DB.Model(&themes_model.Theme{}).Where("user_id = ? AND name = ? AND id != ?", theme.UserID, strings.TrimSpace(update.Name), theme.ID).Count(&count).Error; err != nil {
+			fail(c, 500, "Unable to check theme name")
+			return
+		}
+		if count > 0 {
+			fail(c, 409, "You already have a theme with this name")
+			return
+		}
+		theme.Name = strings.TrimSpace(update.Name)
+	}
+	if update.NeedTheme != "" && update.NeedTheme != "dark" && update.NeedTheme != "light" && update.NeedTheme != "both" {
+		fail(c, 400, "Invalid theme mode")
+		return
+	}
+	if utf8.RuneCountInString(update.Brief) > 50 || utf8.RuneCountInString(update.Description) > 100 {
+		fail(c, 400, "Theme description is too long")
+		return
+	}
+	if strings.TrimSpace(update.Brief) != "" {
+		theme.Brief = strings.TrimSpace(update.Brief)
+	}
+	theme.Description = update.Description
+	if update.NeedTheme != "" {
+		theme.NeedTheme = update.NeedTheme
+	}
+	if update.Tags != nil {
+		theme.Tags = update.Tags
+	}
+	if update.Version != "" {
+		theme.Version = update.Version
+	}
+	theme.CompatVersion = update.CompatVersion
+	// Preview changes go through the authenticated image upload endpoint. Preserve
+	// the legacy field only when it refers to the theme's existing preview.
+	if update.PreviewURL != "" && update.PreviewURL != theme.PreviewURL {
+		fail(c, 400, "Use the preview upload endpoint to replace an image")
+		return
+	}
+	theme.Status = themes_model.ThemePending
+	theme.UpdatedAt = utils.NowInShanghai()
+	if err := h.Themes.Save(theme, nil); err != nil {
+		fail(c, 500, "Unable to save theme and archive")
+		return
+	}
+	success(c, 200, "Theme updated; review required", theme)
+}
+
+func (h *Handler) DeleteThemeByID(c *gin.Context) {
+	theme, ok := h.ownTheme(c)
+	if !ok {
+		return
+	}
+	if err := h.Themes.Delete(theme); err != nil {
+		fail(c, 500, "Unable to delete theme")
+		return
+	}
+	success(c, 200, "Theme deleted", nil)
+}

backend/handlers/themes_handler/upload.go

@@ -0,0 +1,223 @@
+package themes_handler
+
+import (
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"path/filepath"
+	"strings"
+	"unicode/utf8"
+
+	"autolibrary.top/webserver/backend/models/themes_model"
+	"autolibrary.top/webserver/backend/services/theme_files"
+	"autolibrary.top/webserver/utils"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func fail(c *gin.Context, status int, message string) {
+	c.JSON(status, gin.H{"code": status, "msg": message, "data": nil})
+}
+func success(c *gin.Context, status int, message string, data interface{}) {
+	c.JSON(status, gin.H{"code": status, "msg": message, "data": data})
+}
+
+func (h *Handler) ownTheme(c *gin.Context) (*themes_model.Theme, bool) {
+	var theme themes_model.Theme
+	id, err := parseThemeID(c)
+	if err != nil {
+		fail(c, http.StatusBadRequest, "Invalid theme ID")
+		return nil, false
+	}
+	err = h.DB.First(&theme, id).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		fail(c, http.StatusNotFound, "Theme not found")
+		return nil, false
+	}
+	if err != nil {
+		fail(c, http.StatusInternalServerError, "Unable to load theme")
+		return nil, false
+	}
+	if theme.UserID != c.GetString("user_id") {
+		fail(c, http.StatusForbidden, "You can only edit your own themes")
+		return nil, false
+	}
+	return &theme, true
+}
+
+// readUpload enforces the same limits advertised by the web form.
+func readUpload(c *gin.Context, field string, extensions []string, max int64) ([]byte, error) {
+	file, header, err := c.Request.FormFile(field)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	ext := strings.ToLower(filepath.Ext(header.Filename))
+	valid := false
+	for _, candidate := range extensions {
+		if ext == candidate {
+			valid = true
+		}
+	}
+	if !valid {
+		return nil, fmt.Errorf("invalid %s file type", field)
+	}
+	if header.Size > max {
+		return nil, fmt.Errorf("%s file is too large", field)
+	}
+	data, err := io.ReadAll(io.LimitReader(file, max+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(data)) > max {
+		return nil, fmt.Errorf("%s file is too large", field)
+	}
+	if len(data) == 0 {
+		return nil, fmt.Errorf("%s file is empty", field)
+	}
+	return data, nil
+}
+
+func (h *Handler) savePreview(data []byte) (string, error) {
+	compressed, err := theme_files.CompressPreviewImage(data)
+	if err != nil {
+		return "", err
+	}
+	name := fmt.Sprintf("preview_%d.jpg", utils.NowInShanghai().UnixNano())
+	if err := h.Files.WriteFile(filepath.Join(h.Files.Root(), "previews", name), compressed, 0644); err != nil {
+		return "", err
+	}
+	return "/marketplace/themes/preview/" + name, nil
+}
+
+func (h *Handler) PostTheme(c *gin.Context) {
+	var metadata struct {
+		Name          string   `json:"name"`
+		Brief         string   `json:"brief"`
+		Description   string   `json:"description"`
+		NeedTheme     string   `json:"need_theme"`
+		Tags          []string `json:"tags"`
+		Version       string   `json:"version"`
+		CompatVersion string   `json:"compat_version"`
+	}
+	if err := json.Unmarshal([]byte(c.PostForm("metadata")), &metadata); err != nil {
+		fail(c, 400, "Invalid theme metadata")
+		return
+	}
+	metadata.Name = strings.TrimSpace(metadata.Name)
+	metadata.Brief = strings.TrimSpace(metadata.Brief)
+	if metadata.Name == "" || metadata.Brief == "" || utf8.RuneCountInString(metadata.Brief) > 50 || utf8.RuneCountInString(metadata.Description) > 100 {
+		fail(c, 400, "Invalid name, brief or description")
+		return
+	}
+	if metadata.NeedTheme != "dark" && metadata.NeedTheme != "light" && metadata.NeedTheme != "both" {
+		fail(c, 400, "Invalid theme mode")
+		return
+	}
+	var count int64
+	if err := h.DB.Model(&themes_model.Theme{}).Where("user_id = ? AND name = ?", c.GetString("user_id"), metadata.Name).Count(&count).Error; err != nil {
+		fail(c, 500, "Unable to check theme name")
+		return
+	}
+	if count > 0 {
+		fail(c, 409, "You already have a theme with this name")
+		return
+	}
+	qss, err := readUpload(c, "file", []string{".qss"}, 8<<20)
+	if err != nil {
+		fail(c, 400, err.Error())
+		return
+	}
+	previewData, err := readUpload(c, "preview", []string{".png", ".jpg", ".jpeg"}, 4<<20)
+	if err != nil && !errors.Is(err, http.ErrMissingFile) {
+		fail(c, 400, err.Error())
+		return
+	}
+	var preview string
+	if len(previewData) > 0 {
+		preview, err = h.savePreview(previewData)
+		if err != nil {
+			fail(c, 400, "Unable to process preview image")
+			return
+		}
+	}
+	author := c.GetString("display_name")
+	if author == "" {
+		author = c.GetString("user_name")
+	}
+	theme := themes_model.Theme{Name: metadata.Name, Brief: metadata.Brief, Description: metadata.Description, NeedTheme: metadata.NeedTheme, Tags: metadata.Tags, Version: metadata.Version, CompatVersion: metadata.CompatVersion, UserID: c.GetString("user_id"), Author: author, Status: themes_model.ThemePending, PreviewURL: preview, CreatedAt: utils.NowInShanghai(), UpdatedAt: utils.NowInShanghai()}
+	if err := h.Themes.Create(&theme, qss); err != nil {
+		if preview != "" {
+			_ = h.Files.Remove(filepath.Join(h.Files.Root(), "previews", filepath.Base(preview)))
+		}
+		fail(c, 500, "Unable to save theme and archive")
+		return
+	}
+	success(c, http.StatusCreated, "Theme submitted for review", theme)
+}
+
+func (h *Handler) CheckThemeName(c *gin.Context) {
+	name := strings.TrimSpace(c.Query("name"))
+	if name == "" {
+		fail(c, 400, "Name is required")
+		return
+	}
+	var count int64
+	if err := h.DB.Model(&themes_model.Theme{}).Where("user_id = ? AND name = ?", c.GetString("user_id"), name).Count(&count).Error; err != nil {
+		fail(c, 500, "Unable to check theme name")
+		return
+	}
+	success(c, 200, "Theme name checked", count > 0)
+}
+
+func (h *Handler) UploadPreview(c *gin.Context) {
+	theme, ok := h.ownTheme(c)
+	if !ok {
+		return
+	}
+	data, err := readUpload(c, "preview", []string{".png", ".jpg", ".jpeg"}, 4<<20)
+	if err != nil {
+		fail(c, 400, err.Error())
+		return
+	}
+	preview, err := h.savePreview(data)
+	if err != nil {
+		fail(c, 400, "Unable to process preview image")
+		return
+	}
+	previous := theme.PreviewURL
+	theme.PreviewURL = preview
+	theme.Status = themes_model.ThemePending
+	theme.UpdatedAt = utils.NowInShanghai()
+	if err := h.Themes.Save(theme, nil); err != nil {
+		_ = h.Files.Remove(filepath.Join(h.Files.Root(), "previews", filepath.Base(preview)))
+		fail(c, 500, "Unable to save preview")
+		return
+	}
+	if previous != "" {
+		_ = h.Files.Remove(filepath.Join(h.Files.Root(), "previews", filepath.Base(previous)))
+	}
+	success(c, 200, "Preview updated; review required", gin.H{"preview_url": preview})
+}
+
+func (h *Handler) ReplaceThemeFile(c *gin.Context) {
+	theme, ok := h.ownTheme(c)
+	if !ok {
+		return
+	}
+	qss, err := readUpload(c, "file", []string{".qss"}, 8<<20)
+	if err != nil {
+		fail(c, 400, err.Error())
+		return
+	}
+	theme.Status = themes_model.ThemePending
+	theme.UpdatedAt = utils.NowInShanghai()
+	if err := h.Themes.Save(theme, qss); err != nil {
+		fail(c, 500, "Unable to replace theme file")
+		return
+	}
+	success(c, 200, "File replaced; review required", theme)
+}