feat: merge conflict resolution, site management, UI fixes

internal/middleware/middleware.go

@@ -1,5 +1,5 @@
-// Package middleware exposes Gin middlewares used by the HTTP server:
-// request logging, CORS, JWT authentication and admin guard.
+// Package middleware 暴露 Gin 中间件，用于 HTTP 服务器：
+// 请求日志、CORS、JWT 认证、管理员守卫和权限检查。
 package middleware
 
 import (
@@ -17,6 +17,7 @@ import (
 const (
 	CtxUserID   = "ctx_user_id"
 	CtxUserRole = "ctx_user_role"
+	CtxUserTier = "ctx_user_tier"
 )
 
 // RequestLogger logs one structured line per request.
@@ -65,6 +66,7 @@ func CORS(origins []string) gin.HandlerFunc {
 type Claims struct {
 	UserID string `json:"uid"`
 	Role   string `json:"role"`
+	Tier   string `json:"tier,omitempty"`
 	jwt.RegisteredClaims
 }
 
@@ -74,7 +76,7 @@ func AuthRequired(secret string) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		raw := extractToken(c)
 		if raw == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "missing token"})
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": 40101, "message": "missing token"})
 			return
 		}
 		claims := &Claims{}
@@ -85,11 +87,12 @@ func AuthRequired(secret string) gin.HandlerFunc {
 			return []byte(secret), nil
 		})
 		if err != nil || claims.UserID == "" {
-			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "invalid token"})
+			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"code": 40101, "message": "invalid token"})
 			return
 		}
 		c.Set(CtxUserID, claims.UserID)
 		c.Set(CtxUserRole, claims.Role)
+		c.Set(CtxUserTier, claims.Tier)
 		c.Next()
 	}
 }
@@ -99,13 +102,65 @@ func AdminRequired() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		role, _ := c.Get(CtxUserRole)
 		if role != "admin" {
-			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"error": "admin only"})
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"code": 40301, "message": "admin only"})
 			return
 		}
 		c.Next()
 	}
 }
 
+// PlusOrAdminRequired enforces role == "admin" or tier == "plus".
+func PlusOrAdminRequired() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		role, _ := c.Get(CtxUserRole)
+		tier, _ := c.Get(CtxUserTier)
+		if role != "admin" && tier != "plus" {
+			c.AbortWithStatusJSON(http.StatusForbidden, gin.H{"code": 40301, "message": "plus or admin only"})
+			return
+		}
+		c.Next()
+	}
+}
+
+// GetUserID extracts the user ID from the Gin context.
+func GetUserID(c *gin.Context) string {
+	if uid, exists := c.Get(CtxUserID); exists {
+		return uid.(string)
+	}
+	return ""
+}
+
+// GetUserRole extracts the user role from the Gin context.
+func GetUserRole(c *gin.Context) string {
+	if role, exists := c.Get(CtxUserRole); exists {
+		return role.(string)
+	}
+	return ""
+}
+
+// GetUserTier extracts the user tier from the Gin context.
+func GetUserTier(c *gin.Context) string {
+	if tier, exists := c.Get(CtxUserTier); exists {
+		return tier.(string)
+	}
+	return ""
+}
+
+// IsAdmin checks if the current user is an admin.
+func IsAdmin(c *gin.Context) bool {
+	return GetUserRole(c) == "admin"
+}
+
+// IsPlus checks if the current user is a plus subscriber.
+func IsPlus(c *gin.Context) bool {
+	return GetUserTier(c) == "plus" || GetUserRole(c) == "admin"
+}
+
+// IsSuperUser checks if the current user is a super user (admin or plus).
+func IsSuperUser(c *gin.Context) bool {
+	return IsAdmin(c) || IsPlus(c)
+}
+
 func extractToken(c *gin.Context) string {
 	if h := c.GetHeader("Authorization"); strings.HasPrefix(h, "Bearer ") {
 		return strings.TrimSpace(strings.TrimPrefix(h, "Bearer "))