FileCodeBox Go 重写版 v2.5.6（安全审计修复版）

Go 1.27.1 (Gin+GORM) + Vue 3 文件快传服务：

- 安全审计全部修复（docs/security-audit-2026-09-05.md）：
  bcrypt 密码哈希与自动升级、presign 直传服务端大小/内容校验、
  全局请求体上限、依赖升级（govulncheck 0 命中）、janitor 后台清理、
  管理端审计动作落库、/admin CORS 收紧、通知内容白名单净化、
  会话默认 7 天、限流缓存故障降级、robots.txt 端点等
- 前端：取件链接复制修复（不再重复拼接提取码）、markdown 净化器加固
- Redis 支持库号（FCB_REDIS_DB / redis://…/db URL）
- 文档：docs/api/* 与 openapi.yaml 同步最新行为（robots.txt、
  提码 5 位起、chunk 32MiB 上限、admin 审计动作等）

验证：gofmt/go vet/go test 全绿；二进制端到端冒烟通过

server/internal/middleware/ratelimit_test.go

@@ -0,0 +1,126 @@
+package middleware
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+
+	"filecodebox/internal/cache"
+)
+
+func rateLimitRouter(rl *RateLimiter, kind string) *gin.Engine {
+	r := gin.New()
+	r.Use(ClientIP(nil))
+	r.GET("/limited", rl.RequireRateLimit(kind), func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+	return r
+}
+
+func TestRateLimiterBlocksAfterCount(t *testing.T) {
+	mem := cache.NewMemory()
+	defer mem.Close()
+	rl := NewRateLimiter(mem, map[string]LimitRule{
+		LimitMeta: {Count: 3, Window: time.Minute},
+	})
+	r := rateLimitRouter(rl, LimitMeta)
+
+	// 前 3 次通过
+	for i := 0; i < 3; i++ {
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, httptest.NewRequest("GET", "/limited", nil))
+		if w.Code != http.StatusOK {
+			t.Fatalf("第 %d 次应通过: %d", i+1, w.Code)
+		}
+	}
+	// 第 4 次 423
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest("GET", "/limited", nil))
+	if w.Code != http.StatusLocked {
+		t.Fatalf("超限应 423: %d", w.Code)
+	}
+}
+
+func TestRateLimiterAddAfterSuccess(t *testing.T) {
+	// 模拟 upload 语义：Check 放行 + handler 成功后 Add
+	mem := cache.NewMemory()
+	defer mem.Close()
+	rl := NewRateLimiter(mem, map[string]LimitRule{
+		LimitUpload: {Count: 2, Window: time.Minute},
+	})
+	r := gin.New()
+	r.Use(ClientIP(nil))
+	r.POST("/upload", func(c *gin.Context) {
+		if allowed, _ := rl.Check(c, LimitUpload); !allowed {
+			c.JSON(http.StatusLocked, gin.H{"err": "too many"})
+			return
+		}
+		rl.Add(c, LimitUpload) // 成功上传计数
+		c.JSON(http.StatusOK, gin.H{"ok": true})
+	})
+
+	for i := 0; i < 2; i++ {
+		w := httptest.NewRecorder()
+		r.ServeHTTP(w, httptest.NewRequest("POST", "/upload", nil))
+		if w.Code != http.StatusOK {
+			t.Fatalf("第 %d 次上传应通过", i+1)
+		}
+	}
+	w := httptest.NewRecorder()
+	r.ServeHTTP(w, httptest.NewRequest("POST", "/upload", nil))
+	if w.Code != http.StatusLocked {
+		t.Fatalf("第 3 次上传应被拒绝: %d", w.Code)
+	}
+}
+
+func TestParseTrustedProxies(t *testing.T) {
+	nets := ParseTrustedProxies([]string{"10.0.0.0/8", "192.168.1.1", "", "bad-input"})
+	if len(nets) != 2 {
+		t.Fatalf("应解析出 2 个可信网段: %d", len(nets))
+	}
+}
+
+func TestClientIPFromTrustedProxy(t *testing.T) {
+	// 对齐参考语义：仅当直连地址可信时才解析 XFF，
+	// 且从右往左返回第一个"非可信代理"地址（该地址即最近可信代理看到的客户端）。
+	nets := ParseTrustedProxies([]string{"127.0.0.0/8", "10.0.0.0/8"})
+	r := gin.New()
+	r.Use(ClientIP(nets))
+	var seen string
+	r.GET("/ip", func(c *gin.Context) { seen = GetClientIP(c) })
+
+	req := httptest.NewRequest("GET", "/ip", nil)
+	req.RemoteAddr = "127.0.0.1:5000"
+	req.Header.Set("X-Forwarded-For", "203.0.113.9, 10.0.0.1")
+	r.ServeHTTP(httptest.NewRecorder(), req)
+	if seen != "203.0.113.9" {
+		t.Fatalf("多级可信代理下应取最左非可信地址: %s", seen)
+	}
+
+	// 仅直连可信：XFF 右起第一个（10.0.0.1）非可信 → 取它
+	nets2 := ParseTrustedProxies([]string{"127.0.0.0/8"})
+	r2 := gin.New()
+	r2.Use(ClientIP(nets2))
+	var seen2 string
+	r2.GET("/ip", func(c *gin.Context) { seen2 = GetClientIP(c) })
+	req2 := httptest.NewRequest("GET", "/ip", nil)
+	req2.RemoteAddr = "127.0.0.1:5000"
+	req2.Header.Set("X-Forwarded-For", "203.0.113.9, 10.0.0.1")
+	r2.ServeHTTP(httptest.NewRecorder(), req2)
+	if seen2 != "10.0.0.1" {
+		t.Fatalf("右起第一个非可信地址应为 10.0.0.1: %s", seen2)
+	}
+
+	// 非可信直连：忽略伪造头
+	seen = ""
+	req = httptest.NewRequest("GET", "/ip", nil)
+	req.RemoteAddr = "8.8.8.8:1234"
+	req.Header.Set("X-Forwarded-For", "1.2.3.4")
+	r.ServeHTTP(httptest.NewRecorder(), req)
+	if seen != "8.8.8.8" {
+		t.Fatalf("非可信直连应忽略 XFF: %s", seen)
+	}
+}