fix: harden bot accounts and download handling

internal/handler/profile.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"errors"
 	"net/http"
+	"strings"
 
 	"github.com/gin-gonic/gin"
 
@@ -26,7 +27,12 @@ func updateProfileHandler(svc *service.Container) gin.HandlerFunc {
 			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
 			return
 		}
-		if hideAdultChanged {
+		usernameChanged, err := profileUsernameChanged(c.Request.Context(), svc, userID, patch)
+		if err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+		if hideAdultChanged || usernameChanged {
 			if err := svc.Auth.VerifyPassword(c.Request.Context(), userID, patch.Password); err != nil {
 				c.JSON(http.StatusUnauthorized, gin.H{"error": "需要输入当前账号密码确认"})
 				return
@@ -59,6 +65,20 @@ func profileHideAdultChanged(ctx context.Context, svc *service.Container, userID
 	return user.HideAdult != *patch.HideAdult, nil
 }
 
+func profileUsernameChanged(ctx context.Context, svc *service.Container, userID string, patch service.ProfileUpdate) (bool, error) {
+	if patch.Username == nil {
+		return false, nil
+	}
+	user, err := svc.Repo.User.FindByID(ctx, userID)
+	if err != nil {
+		return false, err
+	}
+	if user == nil {
+		return false, errors.New("user not found")
+	}
+	return user.Username != strings.TrimSpace(*patch.Username), nil
+}
+
 type adminUpdateRoleReq struct {
 	Role string `json:"role" binding:"required"`
 }