[新增] OpenFlare Pages

openflare_server/service/config_version.go

@@ -93,6 +93,19 @@ type snapshotRoute struct {
 	TunnelNodeID       *uint                         `json:"tunnel_node_id,omitempty"`
 	TunnelTargetAddr   string                        `json:"tunnel_target_addr,omitempty"`
 	TunnelTargetProto  string                        `json:"tunnel_target_protocol,omitempty"`
+	PagesProjectID     *uint                         `json:"pages_project_id,omitempty"`
+	PagesDeployment    *snapshotPagesDeployment      `json:"pages_deployment,omitempty"`
+}
+
+type snapshotPagesDeployment struct {
+	ProjectID          uint   `json:"project_id"`
+	ProjectSlug        string `json:"project_slug"`
+	DeploymentID       uint   `json:"deployment_id"`
+	DeploymentNumber   int    `json:"deployment_number"`
+	Checksum           string `json:"checksum"`
+	EntryFile          string `json:"entry_file"`
+	SPAFallbackEnabled bool   `json:"spa_fallback_enabled"`
+	LocalRoot          string `json:"local_root"`
 }
 
 type snapshotWAFRuleGroup struct {
@@ -515,12 +528,23 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 		var tunnelNodeID *uint
 		var tunnelTargetAddr string
 		var tunnelTargetProtocol string
+		var pagesProjectID *uint
+		var pagesDeployment *snapshotPagesDeployment
 		if upstreamType == "tunnel" {
 			originURL = resolveTunnelOpenRestyUpstreamURL()
 			upstreams = []string{originURL}
 			tunnelNodeID = route.TunnelNodeID
 			tunnelTargetAddr = strings.TrimSpace(route.TunnelTargetAddr)
 			tunnelTargetProtocol = normalizeTunnelTargetProtocol(route.TunnelTargetProtocol)
+		} else if upstreamType == "pages" {
+			deployment, err := buildSnapshotPagesDeployment(route.PagesProjectID)
+			if err != nil {
+				return nil, fmt.Errorf("路由 %s Pages 配置无效: %w", route.Domain, err)
+			}
+			originURL = fmt.Sprintf("openflare-pages://project/%d", deployment.ProjectID)
+			upstreams = []string{originURL}
+			pagesProjectID = route.PagesProjectID
+			pagesDeployment = deployment
 		}
 		cacheRules, err := decodeStoredCacheRules(route.CacheRules)
 		if err != nil {
@@ -564,11 +588,46 @@ func buildSnapshotRoutes(routes []*model.ProxyRoute) ([]snapshotRoute, error) {
 			TunnelNodeID:       tunnelNodeID,
 			TunnelTargetAddr:   tunnelTargetAddr,
 			TunnelTargetProto:  tunnelTargetProtocol,
+			PagesProjectID:     pagesProjectID,
+			PagesDeployment:    pagesDeployment,
 		})
 	}
 	return items, nil
 }
 
+func buildSnapshotPagesDeployment(projectID *uint) (*snapshotPagesDeployment, error) {
+	if projectID == nil || *projectID == 0 {
+		return nil, errors.New("pages_project_id is required")
+	}
+	project, err := model.GetPagesProjectByID(*projectID)
+	if err != nil {
+		return nil, err
+	}
+	if !project.Enabled {
+		return nil, errors.New("Pages 项目未启用")
+	}
+	if project.ActiveDeploymentID == nil || *project.ActiveDeploymentID == 0 {
+		return nil, errors.New("Pages 项目没有激活部署")
+	}
+	deployment, err := model.GetPagesDeploymentByID(*project.ActiveDeploymentID)
+	if err != nil {
+		return nil, err
+	}
+	if deployment.ProjectID != project.ID {
+		return nil, errors.New("Pages 激活部署不属于当前项目")
+	}
+	return &snapshotPagesDeployment{
+		ProjectID:          project.ID,
+		ProjectSlug:        project.Slug,
+		DeploymentID:       deployment.ID,
+		DeploymentNumber:   deployment.DeploymentNumber,
+		Checksum:           deployment.Checksum,
+		EntryFile:          deployment.EntryFile,
+		SPAFallbackEnabled: project.SPAFallbackEnabled,
+		LocalRoot:          fmt.Sprintf("%s/deployments/%d/current", openrestyrender.PagesDirPlaceholder, deployment.ID),
+	}, nil
+}
+
 func resolveTunnelOpenRestyUpstreamURL() string {
 	relayNodes, err := model.ListNodesByType("tunnel_relay")
 	if err == nil && len(relayNodes) > 0 {
@@ -819,10 +878,18 @@ func normalizeSnapshotRoutes(routes []snapshotRoute) []snapshotRoute {
 		if routes[index].UpstreamType == "tunnel" {
 			routes[index].TunnelTargetAddr = strings.TrimSpace(routes[index].TunnelTargetAddr)
 			routes[index].TunnelTargetProto = normalizeTunnelTargetProtocol(routes[index].TunnelTargetProto)
+			routes[index].PagesProjectID = nil
+			routes[index].PagesDeployment = nil
+		} else if routes[index].UpstreamType == "pages" {
+			routes[index].TunnelNodeID = nil
+			routes[index].TunnelTargetAddr = ""
+			routes[index].TunnelTargetProto = ""
 		} else {
 			routes[index].TunnelNodeID = nil
 			routes[index].TunnelTargetAddr = ""
 			routes[index].TunnelTargetProto = ""
+			routes[index].PagesProjectID = nil
+			routes[index].PagesDeployment = nil
 		}
 	}
 	return routes
@@ -849,7 +916,7 @@ func flattenSnapshotRoutesByDomain(routes []snapshotRoute) map[string]snapshotRo
 }
 
 func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
-	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || left.PoWEnabled != right.PoWEnabled || left.BasicAuthEnabled != right.BasicAuthEnabled || left.BasicAuthUsername != right.BasicAuthUsername || left.BasicAuthPassword != right.BasicAuthPassword || left.UpstreamType != right.UpstreamType || !uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) || left.TunnelTargetAddr != right.TunnelTargetAddr || left.TunnelTargetProto != right.TunnelTargetProto || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
+	if left.SiteName != right.SiteName || left.Domain != right.Domain || left.OriginURL != right.OriginURL || left.OriginHost != right.OriginHost || left.EnableHTTPS != right.EnableHTTPS || left.RedirectHTTP != right.RedirectHTTP || left.LimitConnPerServer != right.LimitConnPerServer || left.LimitConnPerIP != right.LimitConnPerIP || left.LimitRate != right.LimitRate || left.CacheEnabled != right.CacheEnabled || left.CachePolicy != right.CachePolicy || left.PoWEnabled != right.PoWEnabled || left.BasicAuthEnabled != right.BasicAuthEnabled || left.BasicAuthUsername != right.BasicAuthUsername || left.BasicAuthPassword != right.BasicAuthPassword || left.UpstreamType != right.UpstreamType || !uintPtrEqual(left.TunnelNodeID, right.TunnelNodeID) || left.TunnelTargetAddr != right.TunnelTargetAddr || left.TunnelTargetProto != right.TunnelTargetProto || !uintPtrEqual(left.PagesProjectID, right.PagesProjectID) || !snapshotPagesDeploymentEqual(left.PagesDeployment, right.PagesDeployment) || !uintSliceEqual(left.CertIDs, right.CertIDs) || !uintSliceEqual(left.DomainCertIDs, right.DomainCertIDs) {
 		return false
 	}
 	if len(left.Domains) != len(right.Domains) {
@@ -890,6 +957,21 @@ func snapshotRouteConfigEqual(left snapshotRoute, right snapshotRoute) bool {
 	return true
 }
 
+func snapshotPagesDeploymentEqual(left *snapshotPagesDeployment, right *snapshotPagesDeployment) bool {
+	if left == nil || right == nil {
+		return left == nil && right == nil
+	}
+	leftJSON, err := json.Marshal(left)
+	if err != nil {
+		return false
+	}
+	rightJSON, err := json.Marshal(right)
+	if err != nil {
+		return false
+	}
+	return string(leftJSON) == string(rightJSON)
+}
+
 func snapshotWAFConfigEqual(left snapshotWAFDocument, right snapshotWAFDocument) bool {
 	leftJSON, err := json.Marshal(left)
 	if err != nil {

openflare_server/service/pages.go

@@ -0,0 +1,635 @@
+package service
+
+import (
+	"archive/zip"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"mime/multipart"
+	"openflare/common"
+	"openflare/model"
+	"os"
+	"path"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"time"
+
+	"gorm.io/gorm"
+)
+
+const (
+	pagesMaxDeploymentFiles = 1000
+	pagesMaxDeploymentBytes = 25 * 1024 * 1024
+	defaultPagesEntryFile   = "index.html"
+)
+
+var pagesSlugPattern = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,126}[a-z0-9]$|^[a-z0-9]$`)
+
+type PagesProjectInput struct {
+	Name               string `json:"name"`
+	Slug               string `json:"slug"`
+	Description        string `json:"description"`
+	Enabled            bool   `json:"enabled"`
+	SPAFallbackEnabled bool   `json:"spa_fallback_enabled"`
+}
+
+type PagesProjectView struct {
+	ID                 uint                 `json:"id"`
+	Name               string               `json:"name"`
+	Slug               string               `json:"slug"`
+	Description        string               `json:"description"`
+	Enabled            bool                 `json:"enabled"`
+	SPAFallbackEnabled bool                 `json:"spa_fallback_enabled"`
+	ActiveDeploymentID *uint                `json:"active_deployment_id"`
+	ActiveDeployment   *PagesDeploymentView `json:"active_deployment,omitempty"`
+	DeploymentCount    int64                `json:"deployment_count"`
+	CreatedAt          time.Time            `json:"created_at"`
+	UpdatedAt          time.Time            `json:"updated_at"`
+}
+
+type PagesDeploymentView struct {
+	ID               uint       `json:"id"`
+	ProjectID        uint       `json:"project_id"`
+	DeploymentNumber int        `json:"deployment_number"`
+	Checksum         string     `json:"checksum"`
+	Status           string     `json:"status"`
+	FileCount        int        `json:"file_count"`
+	TotalSize        int64      `json:"total_size"`
+	EntryFile        string     `json:"entry_file"`
+	CreatedBy        string     `json:"created_by"`
+	CreatedAt        time.Time  `json:"created_at"`
+	ActivatedAt      *time.Time `json:"activated_at"`
+}
+
+type PagesDeploymentFileView struct {
+	ID           uint      `json:"id"`
+	DeploymentID uint      `json:"deployment_id"`
+	Path         string    `json:"path"`
+	Size         int64     `json:"size"`
+	Checksum     string    `json:"checksum"`
+	CreatedAt    time.Time `json:"created_at"`
+}
+
+type pagesDeploymentManifest struct {
+	Files     []model.PagesDeploymentFile
+	FileCount int
+	TotalSize int64
+	EntryFile string
+}
+
+func ListPagesProjects() ([]*PagesProjectView, error) {
+	projects, err := model.ListPagesProjects()
+	if err != nil {
+		return nil, err
+	}
+	views := make([]*PagesProjectView, 0, len(projects))
+	for _, project := range projects {
+		view, err := buildPagesProjectView(project)
+		if err != nil {
+			return nil, err
+		}
+		views = append(views, view)
+	}
+	return views, nil
+}
+
+func GetPagesProject(id uint) (*PagesProjectView, error) {
+	project, err := model.GetPagesProjectByID(id)
+	if err != nil {
+		return nil, err
+	}
+	return buildPagesProjectView(project)
+}
+
+func CreatePagesProject(input PagesProjectInput) (*PagesProjectView, error) {
+	project, err := buildPagesProject(nil, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = model.DB.Create(project).Error; err != nil {
+		if model.IsUniqueConstraintError(err) {
+			return nil, errors.New("Pages 项目标识已存在")
+		}
+		return nil, err
+	}
+	return buildPagesProjectView(project)
+}
+
+func UpdatePagesProject(id uint, input PagesProjectInput) (*PagesProjectView, error) {
+	project, err := model.GetPagesProjectByID(id)
+	if err != nil {
+		return nil, err
+	}
+	project, err = buildPagesProject(project, input)
+	if err != nil {
+		return nil, err
+	}
+	if err = model.DB.Model(project).Updates(map[string]any{
+		"name":                 project.Name,
+		"slug":                 project.Slug,
+		"description":          project.Description,
+		"enabled":              project.Enabled,
+		"spa_fallback_enabled": project.SPAFallbackEnabled,
+	}).Error; err != nil {
+		if model.IsUniqueConstraintError(err) {
+			return nil, errors.New("Pages 项目标识已存在")
+		}
+		return nil, err
+	}
+	return buildPagesProjectView(project)
+}
+
+func DeletePagesProject(id uint) error {
+	project, err := model.GetPagesProjectByID(id)
+	if err != nil {
+		return err
+	}
+	var routeCount int64
+	if err = model.DB.Model(&model.ProxyRoute{}).Where("pages_project_id = ?", project.ID).Count(&routeCount).Error; err != nil {
+		return err
+	}
+	if routeCount > 0 {
+		return errors.New("Pages 项目已被规则引用，不能删除")
+	}
+	deployments, err := model.ListPagesDeployments(project.ID)
+	if err != nil {
+		return err
+	}
+	return model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("deployment_id IN (?)", tx.Model(&model.PagesDeployment{}).Select("id").Where("project_id = ?", project.ID)).Delete(&model.PagesDeploymentFile{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Where("project_id = ?", project.ID).Delete(&model.PagesDeployment{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(project).Error; err != nil {
+			return err
+		}
+		for _, deployment := range deployments {
+			_ = os.Remove(deployment.ArtifactPath)
+		}
+		return nil
+	})
+}
+
+func ListPagesProjectDeployments(projectID uint) ([]*PagesDeploymentView, error) {
+	if _, err := model.GetPagesProjectByID(projectID); err != nil {
+		return nil, err
+	}
+	deployments, err := model.ListPagesDeployments(projectID)
+	if err != nil {
+		return nil, err
+	}
+	views := make([]*PagesDeploymentView, 0, len(deployments))
+	for _, deployment := range deployments {
+		views = append(views, buildPagesDeploymentView(deployment))
+	}
+	return views, nil
+}
+
+func ListPagesDeploymentFiles(deploymentID uint) ([]*PagesDeploymentFileView, error) {
+	if _, err := model.GetPagesDeploymentByID(deploymentID); err != nil {
+		return nil, err
+	}
+	files, err := model.ListPagesDeploymentFiles(deploymentID)
+	if err != nil {
+		return nil, err
+	}
+	views := make([]*PagesDeploymentFileView, 0, len(files))
+	for _, file := range files {
+		views = append(views, &PagesDeploymentFileView{
+			ID:           file.ID,
+			DeploymentID: file.DeploymentID,
+			Path:         file.Path,
+			Size:         file.Size,
+			Checksum:     file.Checksum,
+			CreatedAt:    file.CreatedAt,
+		})
+	}
+	return views, nil
+}
+
+func UploadPagesDeployment(projectID uint, fileHeader *multipart.FileHeader, entryFile string, createdBy string) (*PagesDeploymentView, error) {
+	project, err := model.GetPagesProjectByID(projectID)
+	if err != nil {
+		return nil, err
+	}
+	if fileHeader == nil {
+		return nil, errors.New("缺少 Pages 部署包")
+	}
+	if !strings.EqualFold(filepath.Ext(fileHeader.Filename), ".zip") {
+		return nil, errors.New("Pages 部署包必须是 .zip 文件")
+	}
+	entryFile = normalizePagesEntryFile(entryFile)
+	tempPath, checksum, err := persistPagesUploadTemp(fileHeader)
+	if err != nil {
+		return nil, err
+	}
+	defer os.Remove(tempPath)
+	manifest, err := inspectPagesZip(tempPath, entryFile)
+	if err != nil {
+		return nil, err
+	}
+	artifactPath, err := pagesArtifactPath(project.Slug, checksum)
+	if err != nil {
+		return nil, err
+	}
+	if err = os.MkdirAll(filepath.Dir(artifactPath), 0o755); err != nil {
+		return nil, fmt.Errorf("创建 Pages 存储目录失败: %w", err)
+	}
+	if err = copyFile(tempPath, artifactPath); err != nil {
+		return nil, err
+	}
+	deployment := &model.PagesDeployment{}
+	err = model.DB.Transaction(func(tx *gorm.DB) error {
+		var maxNumber int
+		if err := tx.Model(&model.PagesDeployment{}).
+			Where("project_id = ?", project.ID).
+			Select("COALESCE(MAX(deployment_number), 0)").
+			Scan(&maxNumber).Error; err != nil {
+			return err
+		}
+		deployment = &model.PagesDeployment{
+			ProjectID:        project.ID,
+			DeploymentNumber: maxNumber + 1,
+			Checksum:         checksum,
+			Status:           model.PagesDeploymentStatusUploaded,
+			ArtifactPath:     artifactPath,
+			FileCount:        manifest.FileCount,
+			TotalSize:        manifest.TotalSize,
+			EntryFile:        manifest.EntryFile,
+			CreatedBy:        strings.TrimSpace(createdBy),
+		}
+		if err := tx.Create(deployment).Error; err != nil {
+			return err
+		}
+		for index := range manifest.Files {
+			manifest.Files[index].DeploymentID = deployment.ID
+		}
+		if len(manifest.Files) > 0 {
+			if err := tx.Create(&manifest.Files).Error; err != nil {
+				return err
+			}
+		}
+		return nil
+	})
+	if err != nil {
+		_ = os.Remove(artifactPath)
+		return nil, err
+	}
+	return buildPagesDeploymentView(deployment), nil
+}
+
+func ActivatePagesDeployment(projectID uint, deploymentID uint) (*PagesProjectView, error) {
+	project, err := model.GetPagesProjectByID(projectID)
+	if err != nil {
+		return nil, err
+	}
+	deployment, err := model.GetPagesDeploymentByID(deploymentID)
+	if err != nil {
+		return nil, err
+	}
+	if deployment.ProjectID != project.ID {
+		return nil, errors.New("Pages 部署不属于该项目")
+	}
+	now := time.Now()
+	if err = model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Model(&model.PagesDeployment{}).
+			Where("project_id = ?", project.ID).
+			Update("status", model.PagesDeploymentStatusUploaded).Error; err != nil {
+			return err
+		}
+		if err := tx.Model(deployment).Updates(map[string]any{
+			"status":       model.PagesDeploymentStatusActive,
+			"activated_at": &now,
+		}).Error; err != nil {
+			return err
+		}
+		return tx.Model(project).Updates(map[string]any{
+			"active_deployment_id": deployment.ID,
+		}).Error
+	}); err != nil {
+		return nil, err
+	}
+	return GetPagesProject(project.ID)
+}
+
+func DeletePagesDeployment(projectID uint, deploymentID uint) error {
+	project, err := model.GetPagesProjectByID(projectID)
+	if err != nil {
+		return err
+	}
+	deployment, err := model.GetPagesDeploymentByID(deploymentID)
+	if err != nil {
+		return err
+	}
+	if deployment.ProjectID != project.ID {
+		return errors.New("Pages 部署不属于该项目")
+	}
+	if project.ActiveDeploymentID != nil && *project.ActiveDeploymentID == deployment.ID {
+		return errors.New("不能删除当前激活的 Pages 部署")
+	}
+	return model.DB.Transaction(func(tx *gorm.DB) error {
+		if err := tx.Where("deployment_id = ?", deployment.ID).Delete(&model.PagesDeploymentFile{}).Error; err != nil {
+			return err
+		}
+		if err := tx.Delete(deployment).Error; err != nil {
+			return err
+		}
+		_ = os.Remove(deployment.ArtifactPath)
+		return nil
+	})
+}
+
+func GetPagesDeploymentPackagePath(deploymentID uint) (string, string, error) {
+	deployment, err := model.GetPagesDeploymentByID(deploymentID)
+	if err != nil {
+		return "", "", err
+	}
+	if err = ensurePagesDeploymentInActiveSnapshot(deployment.ID); err != nil {
+		return "", "", err
+	}
+	if strings.TrimSpace(deployment.ArtifactPath) == "" {
+		return "", "", errors.New("Pages 部署包路径为空")
+	}
+	if _, err = os.Stat(deployment.ArtifactPath); err != nil {
+		return "", "", fmt.Errorf("Pages 部署包不存在: %w", err)
+	}
+	return deployment.ArtifactPath, fmt.Sprintf("pages-deployment-%d.zip", deployment.ID), nil
+}
+
+func ensurePagesDeploymentInActiveSnapshot(deploymentID uint) error {
+	version, err := model.GetActiveConfigVersion()
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return errors.New("Pages 部署尚未进入激活配置")
+		}
+		return err
+	}
+	snapshot, err := parseSnapshotDocument(version.SnapshotJSON)
+	if err != nil {
+		return err
+	}
+	for _, route := range snapshot.Routes {
+		if route.UpstreamType != "pages" || route.PagesDeployment == nil {
+			continue
+		}
+		if route.PagesDeployment.DeploymentID == deploymentID {
+			return nil
+		}
+	}
+	return errors.New("Pages 部署尚未进入激活配置")
+}
+
+func buildPagesProject(project *model.PagesProject, input PagesProjectInput) (*model.PagesProject, error) {
+	name := strings.TrimSpace(input.Name)
+	if name == "" {
+		return nil, errors.New("Pages 项目名称不能为空")
+	}
+	slug := normalizePagesSlug(input.Slug)
+	if slug == "" {
+		slug = normalizePagesSlug(name)
+	}
+	if !pagesSlugPattern.MatchString(slug) {
+		return nil, errors.New("Pages 项目标识只能包含小写字母、数字和连字符")
+	}
+	if project == nil {
+		project = &model.PagesProject{}
+	}
+	project.Name = name
+	project.Slug = slug
+	project.Description = strings.TrimSpace(input.Description)
+	project.Enabled = input.Enabled
+	project.SPAFallbackEnabled = input.SPAFallbackEnabled
+	return project, nil
+}
+
+func buildPagesProjectView(project *model.PagesProject) (*PagesProjectView, error) {
+	if project == nil {
+		return nil, errors.New("Pages 项目为空")
+	}
+	view := &PagesProjectView{
+		ID:                 project.ID,
+		Name:               project.Name,
+		Slug:               project.Slug,
+		Description:        project.Description,
+		Enabled:            project.Enabled,
+		SPAFallbackEnabled: project.SPAFallbackEnabled,
+		ActiveDeploymentID: project.ActiveDeploymentID,
+		CreatedAt:          project.CreatedAt,
+		UpdatedAt:          project.UpdatedAt,
+	}
+	if err := model.DB.Model(&model.PagesDeployment{}).Where("project_id = ?", project.ID).Count(&view.DeploymentCount).Error; err != nil {
+		return nil, err
+	}
+	if project.ActiveDeploymentID != nil && *project.ActiveDeploymentID != 0 {
+		deployment, err := model.GetPagesDeploymentByID(*project.ActiveDeploymentID)
+		if err == nil {
+			view.ActiveDeployment = buildPagesDeploymentView(deployment)
+		}
+	}
+	return view, nil
+}
+
+func buildPagesDeploymentView(deployment *model.PagesDeployment) *PagesDeploymentView {
+	if deployment == nil {
+		return nil
+	}
+	return &PagesDeploymentView{
+		ID:               deployment.ID,
+		ProjectID:        deployment.ProjectID,
+		DeploymentNumber: deployment.DeploymentNumber,
+		Checksum:         deployment.Checksum,
+		Status:           deployment.Status,
+		FileCount:        deployment.FileCount,
+		TotalSize:        deployment.TotalSize,
+		EntryFile:        deployment.EntryFile,
+		CreatedBy:        deployment.CreatedBy,
+		CreatedAt:        deployment.CreatedAt,
+		ActivatedAt:      deployment.ActivatedAt,
+	}
+}
+
+func normalizePagesSlug(raw string) string {
+	value := strings.ToLower(strings.TrimSpace(raw))
+	var builder strings.Builder
+	lastDash := false
+	for _, r := range value {
+		valid := (r >= 'a' && r <= 'z') || (r >= '0' && r <= '9')
+		if valid {
+			builder.WriteRune(r)
+			lastDash = false
+			continue
+		}
+		if !lastDash {
+			builder.WriteByte('-')
+			lastDash = true
+		}
+	}
+	return strings.Trim(builder.String(), "-")
+}
+
+func normalizePagesEntryFile(raw string) string {
+	value := path.Clean(strings.TrimSpace(filepath.ToSlash(raw)))
+	if value == "." || value == "/" {
+		return defaultPagesEntryFile
+	}
+	return strings.TrimPrefix(value, "/")
+}
+
+func persistPagesUploadTemp(fileHeader *multipart.FileHeader) (string, string, error) {
+	file, err := fileHeader.Open()
+	if err != nil {
+		return "", "", err
+	}
+	defer file.Close()
+	temp, err := os.CreateTemp("", "openflare-pages-*.zip")
+	if err != nil {
+		return "", "", err
+	}
+	defer temp.Close()
+	hash := sha256.New()
+	limited := io.LimitReader(file, pagesMaxDeploymentBytes+1)
+	written, err := io.Copy(io.MultiWriter(temp, hash), limited)
+	if err != nil {
+		_ = os.Remove(temp.Name())
+		return "", "", err
+	}
+	if written > pagesMaxDeploymentBytes {
+		_ = os.Remove(temp.Name())
+		return "", "", fmt.Errorf("Pages 部署包不能超过 %d MiB", pagesMaxDeploymentBytes/1024/1024)
+	}
+	return temp.Name(), hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func inspectPagesZip(zipPath string, entryFile string) (*pagesDeploymentManifest, error) {
+	reader, err := zip.OpenReader(zipPath)
+	if err != nil {
+		return nil, errors.New("Pages 部署包不是有效 zip 文件")
+	}
+	defer reader.Close()
+	manifest := &pagesDeploymentManifest{
+		Files:     []model.PagesDeploymentFile{},
+		EntryFile: entryFile,
+	}
+	entrySeen := false
+	for _, item := range reader.File {
+		normalizedPath, skip, err := normalizePagesZipPath(item.Name)
+		if err != nil {
+			return nil, err
+		}
+		if skip {
+			continue
+		}
+		if item.FileInfo().Mode()&os.ModeSymlink != 0 {
+			return nil, fmt.Errorf("Pages 部署包不支持符号链接: %s", normalizedPath)
+		}
+		if item.UncompressedSize64 > pagesMaxDeploymentBytes {
+			return nil, fmt.Errorf("Pages 文件过大: %s", normalizedPath)
+		}
+		manifest.FileCount++
+		if manifest.FileCount > pagesMaxDeploymentFiles {
+			return nil, fmt.Errorf("Pages 部署文件数不能超过 %d", pagesMaxDeploymentFiles)
+		}
+		manifest.TotalSize += int64(item.UncompressedSize64)
+		if manifest.TotalSize > pagesMaxDeploymentBytes {
+			return nil, fmt.Errorf("Pages 部署展开后不能超过 %d MiB", pagesMaxDeploymentBytes/1024/1024)
+		}
+		checksum, err := checksumZipFile(item)
+		if err != nil {
+			return nil, err
+		}
+		if normalizedPath == entryFile {
+			entrySeen = true
+		}
+		manifest.Files = append(manifest.Files, model.PagesDeploymentFile{
+			Path:     normalizedPath,
+			Size:     int64(item.UncompressedSize64),
+			Checksum: checksum,
+		})
+	}
+	if manifest.FileCount == 0 {
+		return nil, errors.New("Pages 部署包不能为空")
+	}
+	if !entrySeen {
+		return nil, fmt.Errorf("Pages 部署包缺少入口文件 %s", entryFile)
+	}
+	return manifest, nil
+}
+
+func normalizePagesZipPath(raw string) (string, bool, error) {
+	name := strings.TrimSpace(filepath.ToSlash(raw))
+	if name == "" {
+		return "", true, nil
+	}
+	if strings.HasSuffix(name, "/") {
+		return "", true, nil
+	}
+	if strings.HasPrefix(name, "/") || path.IsAbs(name) {
+		return "", false, fmt.Errorf("Pages 部署包不能包含绝对路径: %s", raw)
+	}
+	cleaned := path.Clean(name)
+	if cleaned == "." {
+		return "", true, nil
+	}
+	if cleaned == ".." || strings.HasPrefix(cleaned, "../") || strings.Contains(cleaned, "/../") {
+		return "", false, fmt.Errorf("Pages 部署包路径不能逃逸目录: %s", raw)
+	}
+	return cleaned, false, nil
+}
+
+func checksumZipFile(item *zip.File) (string, error) {
+	file, err := item.Open()
+	if err != nil {
+		return "", err
+	}
+	defer file.Close()
+	hash := sha256.New()
+	if _, err = io.Copy(hash, file); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(hash.Sum(nil)), nil
+}
+
+func pagesArtifactPath(projectSlug string, checksum string) (string, error) {
+	root, err := pagesStorageRoot()
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(root, "artifacts", projectSlug, checksum+".zip"), nil
+}
+
+func pagesStorageRoot() (string, error) {
+	if common.SQLDSN != "" {
+		return filepath.Abs(filepath.Join("data", "pages"))
+	}
+	dbPath := strings.TrimSpace(common.SQLitePath)
+	if dbPath == "" {
+		return filepath.Abs(filepath.Join("data", "pages"))
+	}
+	dir := filepath.Dir(dbPath)
+	if dir == "." || dir == "" {
+		dir = "data"
+	}
+	return filepath.Abs(filepath.Join(dir, "pages"))
+}
+
+func copyFile(src string, dst string) error {
+	input, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	defer input.Close()
+	output, err := os.OpenFile(dst, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0o644)
+	if err != nil {
+		return err
+	}
+	defer output.Close()
+	if _, err = io.Copy(output, input); err != nil {
+		return err
+	}
+	return output.Sync()
+}

openflare_server/service/pages_test.go

@@ -0,0 +1,226 @@
+package service
+
+import (
+	"archive/zip"
+	"bytes"
+	"mime/multipart"
+	"net/http/httptest"
+	"openflare/model"
+	"strings"
+	"testing"
+)
+
+func TestPagesUploadActivateAndPublishStaticRoute(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{
+		Name:               "Marketing Site",
+		Slug:               "marketing-site",
+		Enabled:            true,
+		SPAFallbackEnabled: true,
+	})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	uploadHeader := multipartFileHeader(t, "site.zip", testPagesZip(t, map[string]string{
+		"index.html":       "<h1>Hello Pages</h1>",
+		"assets/app.js":    "console.log('pages')",
+		"assets/style.css": "body{color:#111}",
+	}))
+	deployment, err := UploadPagesDeployment(project.ID, uploadHeader, "index.html", "root")
+	if err != nil {
+		t.Fatalf("UploadPagesDeployment failed: %v", err)
+	}
+	if deployment.FileCount != 3 || deployment.TotalSize == 0 {
+		t.Fatalf("unexpected deployment manifest: %+v", deployment)
+	}
+	project, err = ActivatePagesDeployment(project.ID, deployment.ID)
+	if err != nil {
+		t.Fatalf("ActivatePagesDeployment failed: %v", err)
+	}
+	if project.ActiveDeploymentID == nil || *project.ActiveDeploymentID != deployment.ID {
+		t.Fatalf("expected active deployment %d, got %+v", deployment.ID, project.ActiveDeploymentID)
+	}
+
+	route, err := CreateProxyRoute(ProxyRouteInput{
+		Domain:         "pages.example.com",
+		Enabled:        true,
+		UpstreamType:   "pages",
+		PagesProjectID: &project.ID,
+	})
+	if err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if route.UpstreamType != "pages" || route.PagesProjectID == nil || *route.PagesProjectID != project.ID {
+		t.Fatalf("expected route to bind Pages project, got %+v", route)
+	}
+
+	result, err := PublishConfigVersion("root", false)
+	if err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"upstream_type":"pages"`) {
+		t.Fatalf("expected snapshot to include pages route, got %s", result.Version.SnapshotJSON)
+	}
+	if !strings.Contains(result.Version.SnapshotJSON, `"deployment_id":`) {
+		t.Fatalf("expected snapshot to include pages deployment, got %s", result.Version.SnapshotJSON)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "root \"__OPENFLARE_PAGES_DIR__/deployments/") {
+		t.Fatalf("expected rendered config to use pages dir placeholder, got:\n%s", result.Version.RenderedConfig)
+	}
+	if !strings.Contains(result.Version.RenderedConfig, "try_files $uri $uri/ /index.html;") {
+		t.Fatalf("expected SPA fallback try_files, got:\n%s", result.Version.RenderedConfig)
+	}
+	if strings.Contains(result.Version.RenderedConfig, "proxy_pass") {
+		t.Fatalf("Pages route must not render proxy_pass, got:\n%s", result.Version.RenderedConfig)
+	}
+}
+
+func TestUploadPagesDeploymentRejectsZipSlip(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{
+		Name:    "Unsafe Site",
+		Slug:    "unsafe-site",
+		Enabled: true,
+	})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	_, err = UploadPagesDeployment(project.ID, multipartFileHeader(t, "bad.zip", testPagesZip(t, map[string]string{
+		"../escape.html": "bad",
+		"index.html":     "ok",
+	})), "index.html", "root")
+	if err == nil || !strings.Contains(err.Error(), "逃逸目录") {
+		t.Fatalf("expected zip-slip rejection, got %v", err)
+	}
+}
+
+func TestPagesRouteRequiresActiveDeployment(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{
+		Name:    "Draft Site",
+		Slug:    "draft-site",
+		Enabled: true,
+	})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	if _, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:         "draft.example.com",
+		Enabled:        true,
+		UpstreamType:   "pages",
+		PagesProjectID: &project.ID,
+	}); err == nil || !strings.Contains(err.Error(), "没有激活部署") {
+		t.Fatalf("expected active deployment validation, got %v", err)
+	}
+}
+
+func TestPagesDeploymentPackageRequiresActiveConfigSnapshot(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{Name: "Published Site", Slug: "published-site", Enabled: true})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	deployment, err := UploadPagesDeployment(project.ID, multipartFileHeader(t, "site.zip", testPagesZip(t, map[string]string{
+		"index.html": "ok",
+	})), "index.html", "root")
+	if err != nil {
+		t.Fatalf("UploadPagesDeployment failed: %v", err)
+	}
+	if _, err = ActivatePagesDeployment(project.ID, deployment.ID); err != nil {
+		t.Fatalf("ActivatePagesDeployment failed: %v", err)
+	}
+	if _, _, err = GetPagesDeploymentPackagePath(deployment.ID); err == nil || !strings.Contains(err.Error(), "激活配置") {
+		t.Fatalf("expected package download to require active config, got %v", err)
+	}
+	if _, err = CreateProxyRoute(ProxyRouteInput{
+		Domain:         "published.example.com",
+		Enabled:        true,
+		UpstreamType:   "pages",
+		PagesProjectID: &project.ID,
+	}); err != nil {
+		t.Fatalf("CreateProxyRoute failed: %v", err)
+	}
+	if _, err = PublishConfigVersion("root", false); err != nil {
+		t.Fatalf("PublishConfigVersion failed: %v", err)
+	}
+	filePath, fileName, err := GetPagesDeploymentPackagePath(deployment.ID)
+	if err != nil {
+		t.Fatalf("GetPagesDeploymentPackagePath failed after publish: %v", err)
+	}
+	if filePath == "" || fileName == "" {
+		t.Fatalf("expected package path and file name, got path=%q name=%q", filePath, fileName)
+	}
+}
+
+func testPagesZip(t *testing.T, files map[string]string) []byte {
+	t.Helper()
+	var buffer bytes.Buffer
+	writer := zip.NewWriter(&buffer)
+	for name, content := range files {
+		file, err := writer.Create(name)
+		if err != nil {
+			t.Fatalf("create zip entry failed: %v", err)
+		}
+		if _, err := file.Write([]byte(content)); err != nil {
+			t.Fatalf("write zip entry failed: %v", err)
+		}
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("close zip failed: %v", err)
+	}
+	return buffer.Bytes()
+}
+
+func multipartFileHeader(t *testing.T, fileName string, content []byte) *multipart.FileHeader {
+	t.Helper()
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	part, err := writer.CreateFormFile("package", fileName)
+	if err != nil {
+		t.Fatalf("CreateFormFile failed: %v", err)
+	}
+	if _, err = part.Write(content); err != nil {
+		t.Fatalf("write multipart file failed: %v", err)
+	}
+	if err = writer.Close(); err != nil {
+		t.Fatalf("close multipart writer failed: %v", err)
+	}
+	req := httptest.NewRequest("POST", "/", &body)
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+	if err = req.ParseMultipartForm(int64(len(content)) + 1024); err != nil {
+		t.Fatalf("ParseMultipartForm failed: %v", err)
+	}
+	file, header, err := req.FormFile("package")
+	if err != nil {
+		t.Fatalf("FormFile failed: %v", err)
+	}
+	file.Close()
+	return header
+}
+
+func TestDeletePagesDeploymentRejectsActiveDeployment(t *testing.T) {
+	setupServiceTestDB(t)
+
+	project, err := CreatePagesProject(PagesProjectInput{Name: "Active", Slug: "active", Enabled: true})
+	if err != nil {
+		t.Fatalf("CreatePagesProject failed: %v", err)
+	}
+	deployment, err := UploadPagesDeployment(project.ID, multipartFileHeader(t, "site.zip", testPagesZip(t, map[string]string{"index.html": "ok"})), "index.html", "root")
+	if err != nil {
+		t.Fatalf("UploadPagesDeployment failed: %v", err)
+	}
+	if _, err = ActivatePagesDeployment(project.ID, deployment.ID); err != nil {
+		t.Fatalf("ActivatePagesDeployment failed: %v", err)
+	}
+	if err = DeletePagesDeployment(project.ID, deployment.ID); err == nil {
+		t.Fatal("expected active deployment deletion to fail")
+	}
+	var stored model.PagesDeployment
+	if err = model.DB.First(&stored, deployment.ID).Error; err != nil {
+		t.Fatalf("expected active deployment to remain: %v", err)
+	}
+}

openflare_server/service/proxy_route.go

@@ -66,6 +66,7 @@ type ProxyRouteInput struct {
 	TunnelID             *uint                         `json:"tunnel_id"`
 	TunnelTargetAddr     string                        `json:"tunnel_target_addr"`
 	TunnelTargetProtocol string                        `json:"tunnel_target_protocol"`
+	PagesProjectID       *uint                         `json:"pages_project_id"`
 }
 
 type ProxyRouteView struct {
@@ -106,6 +107,7 @@ type ProxyRouteView struct {
 	TunnelID             *uint                         `json:"tunnel_id"`
 	TunnelTargetAddr     string                        `json:"tunnel_target_addr"`
 	TunnelTargetProtocol string                        `json:"tunnel_target_protocol"`
+	PagesProjectID       *uint                         `json:"pages_project_id"`
 	CreatedAt            time.Time                     `json:"created_at"`
 	UpdatedAt            time.Time                     `json:"updated_at"`
 }
@@ -183,6 +185,13 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 		// Tunnel type: origin URL is auto-filled during config rendering
 		originURL = "http://127.0.0.1"
 		upstreams = []string{originURL}
+	} else if upstreamType == "pages" {
+		if err := validatePagesRouteInput(input.PagesProjectID); err != nil {
+			return nil, err
+		}
+		// Keep persisted upstreams HTTP-compatible; Pages rendering uses pages_project_id.
+		originURL = "http://127.0.0.1"
+		upstreams = []string{originURL}
 	} else {
 		originURL, originID, err = resolveProxyRoutePrimaryOrigin(input)
 		if err != nil {
@@ -339,10 +348,17 @@ func buildProxyRoute(route *model.ProxyRoute, input ProxyRouteInput) (*model.Pro
 		route.TunnelNodeID = tunnelNodeID
 		route.TunnelTargetAddr = strings.TrimSpace(input.TunnelTargetAddr)
 		route.TunnelTargetProtocol = normalizeTunnelTargetProtocol(input.TunnelTargetProtocol)
+		route.PagesProjectID = nil
+	} else if upstreamType == "pages" {
+		route.TunnelNodeID = nil
+		route.TunnelTargetAddr = ""
+		route.TunnelTargetProtocol = ""
+		route.PagesProjectID = input.PagesProjectID
 	} else {
 		route.TunnelNodeID = nil
 		route.TunnelTargetAddr = ""
 		route.TunnelTargetProtocol = ""
+		route.PagesProjectID = nil
 	}
 	return route, nil
 }
@@ -434,6 +450,7 @@ func buildProxyRouteView(route *model.ProxyRoute) (*ProxyRouteView, error) {
 		TunnelID:             route.TunnelNodeID,
 		TunnelTargetAddr:     route.TunnelTargetAddr,
 		TunnelTargetProtocol: route.TunnelTargetProtocol,
+		PagesProjectID:       route.PagesProjectID,
 		CreatedAt:            route.CreatedAt,
 		UpdatedAt:            route.UpdatedAt,
 	}, nil
@@ -474,6 +491,26 @@ func validateTunnelRouteInput(tunnelNodeID *uint, targetAddr string, targetProto
 	}
 }
 
+func validatePagesRouteInput(projectID *uint) error {
+	if projectID == nil || *projectID == 0 {
+		return errors.New("pages_project_id is required for Pages upstream")
+	}
+	project, err := model.GetPagesProjectByID(*projectID)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return errors.New("Pages 项目不存在")
+		}
+		return err
+	}
+	if !project.Enabled {
+		return errors.New("Pages 项目未启用")
+	}
+	if project.ActiveDeploymentID == nil || *project.ActiveDeploymentID == 0 {
+		return errors.New("Pages 项目没有激活部署")
+	}
+	return nil
+}
+
 func normalizeProxyRouteSiteNameInput(route *model.ProxyRoute, raw string, primaryDomain string) string {
 	siteName := strings.TrimSpace(raw)
 	if siteName != "" {
@@ -1291,6 +1328,8 @@ func normalizeUpstreamType(raw string) string {
 	switch strings.ToLower(strings.TrimSpace(raw)) {
 	case "tunnel":
 		return "tunnel"
+	case "pages":
+		return "pages"
 	default:
 		return "direct"
 	}