feat(framework): 回灌 OpenFlare 分层、安全与运行时改进

将平台域持久化收敛为 repository 唯一入口，model 去掉 IO。
邮件头写入前清除 CR/LF，防止 header 注入。
httppool 支持可配置 Transport；batchwriter 增加 MinBatchSize/Stats，flush 失败交回批次；任务 PermanentError 作为 SkipRetry 终态。
设置与推送页的确认改为 AlertDialog；axios 去尾斜杠并按 Gin 数组序列化查询参数。
升级共享 Go 依赖（Gin、Asynq、OTel、GORM、Redis 等）。

internal/apps/admin/auth_source/routers.go

@@ -49,7 +49,7 @@ type ToggleAuthSourceRequest struct {
 // @Failure 500 {object} response.Any "内部错误"
 // @Router /api/v1/admin/auth-sources [get]
 func ListAuthSources(c *gin.Context) {
-	sources, err := model.GetAuthSources(c.Request.Context())
+	sources, err := repository.GetAuthSources(c.Request.Context())
 	if err != nil {
 		response.AbortInternal(c, err.Error())
 		return
@@ -88,7 +88,7 @@ func CreateAuthSource(c *gin.Context) {
 		Scopes:             req.Scopes,
 		IconURL:            req.IconURL,
 	}
-	if err := model.CreateAuthSource(c.Request.Context(), &source); err != nil {
+	if err := repository.CreateAuthSource(c.Request.Context(), &source); err != nil {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
@@ -126,7 +126,7 @@ func UpdateAuthSource(c *gin.Context) {
 	}
 
 	// 记录更新前的 Discovery URL，以便更新成功后清除旧缓存条目。
-	existing, _ := model.GetAuthSourceByID(c.Request.Context(), id)
+	existing, _ := repository.GetAuthSourceByID(c.Request.Context(), id)
 
 	source := model.AuthSource{
 		ID:                 id,
@@ -141,7 +141,7 @@ func UpdateAuthSource(c *gin.Context) {
 		IconURL:            req.IconURL,
 	}
 	keepSecret := source.ClientSecret == ""
-	if err := model.UpdateAuthSource(c.Request.Context(), &source, keepSecret); err != nil {
+	if err := repository.UpdateAuthSource(c.Request.Context(), &source, keepSecret); err != nil {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
@@ -154,7 +154,7 @@ func UpdateAuthSource(c *gin.Context) {
 	oauth.InvalidateOIDCProviderCache(normalizeIssuer(req.OpenIDDiscoveryURL))
 	_ = repository.InvalidateAuthSourceCache(c.Request.Context())
 
-	updated, err := model.GetAuthSourceByID(c.Request.Context(), id)
+	updated, err := repository.GetAuthSourceByID(c.Request.Context(), id)
 	if err != nil {
 		response.AbortInternal(c, err.Error())
 		return
@@ -190,7 +190,7 @@ func ToggleAuthSource(c *gin.Context) {
 		return
 	}
 
-	if err := model.ToggleAuthSource(c.Request.Context(), id, req.IsActive); err != nil {
+	if err := repository.ToggleAuthSource(c.Request.Context(), id, req.IsActive); err != nil {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
@@ -216,7 +216,7 @@ func DeleteAuthSource(c *gin.Context) {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
-	if err := model.DeleteAuthSource(c.Request.Context(), id); err != nil {
+	if err := repository.DeleteAuthSource(c.Request.Context(), id); err != nil {
 		response.AbortBadRequest(c, err.Error())
 		return
 	}
@@ -229,7 +229,7 @@ func parseSourceID(c *gin.Context) (uint64, error) {
 	if raw == "" {
 		return 0, errors.New(admin.InvalidAuthSourceID)
 	}
-	source, err := model.GetAuthSourceByName(c.Request.Context(), raw)
+	source, err := repository.GetAuthSourceByName(c.Request.Context(), raw)
 	if err == nil {
 		return source.ID, nil
 	}

internal/apps/admin/logs/routers.go

@@ -16,7 +16,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/apps/admin"
 	"github.com/Rain-kl/Wavelet/internal/infra/config"
 	"github.com/Rain-kl/Wavelet/internal/infra/persistence"
-	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 	analyticsrepo "github.com/Rain-kl/Wavelet/internal/repository/analytics"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
 	"github.com/gin-gonic/gin"
@@ -163,10 +163,7 @@ func buildAccessLogFilter(ctx context.Context, c *gin.Context) (analyticsrepo.Ac
 
 	username := c.Query("username")
 	if username != "" {
-		var userIDs []uint64
-		err := db.DB(ctx).Model(&model.User{}).
-			Where("username LIKE ?", "%"+username+"%").
-			Pluck("id", &userIDs).Error
+		userIDs, err := repository.ListUserIDsByUsernameContains(ctx, username)
 		if err != nil {
 			return filter, fmt.Errorf("查询用户信息失败: %w", err)
 		}
@@ -215,8 +212,7 @@ func enrichAccessLogsWithUsers(ctx context.Context, list []accessLogItem) {
 	}
 
 	userMap := make(map[uint64]struct{ Username, Nickname string })
-	var users []model.User
-	if err := db.DB(ctx).Where("id IN ?", userIDs).Find(&users).Error; err == nil {
+	if users, err := repository.ListUsersByIDs(ctx, userIDs); err == nil {
 		for _, u := range users {
 			userMap[u.ID] = struct{ Username, Nickname string }{Username: u.Username, Nickname: u.Nickname}
 		}
@@ -402,8 +398,8 @@ func GetLogsAnalytics(c *gin.Context) {
 			Username string
 			Nickname string
 		})
-		var users []model.User
-		if errProfile := db.DB(ctx).Where("id IN ?", userIDs).Find(&users).Error; errProfile == nil {
+		users, errProfile := repository.ListUsersByIDs(ctx, userIDs)
+		if errProfile == nil {
 			for _, u := range users {
 				userProfileMap[u.ID] = struct {
 					Username string

internal/apps/admin/system_config/logics.go

@@ -116,13 +116,12 @@ func resolveStorageMigrationTasksOnDirectDriverUpdate(
 		return
 	}
 
-	if err := tx.Model(&model.TaskExecution{}).
-		Where("task_type = ? AND status = ?", "storage:migrate", model.TaskExecutionStatusFailed).
-		Updates(map[string]any{
-			"status":      model.TaskExecutionStatusSucceeded,
-			"result":      "存储配置直接更新，故障迁移任务自动标记为已解决",
-			"finished_at": time.Now(),
-		}).Error; err != nil {
+	if err := repository.MarkFailedTaskExecutionsSucceededTx(
+		tx,
+		"storage:migrate",
+		"存储配置直接更新，故障迁移任务自动标记为已解决",
+		time.Now(),
+	); err != nil {
 		logger.ErrorF(ctx, "自动更新迁移任务状态失败: %v", err)
 	}
 }

internal/apps/admin/task/routers.go

@@ -15,6 +15,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/infra/task"
 	"github.com/Rain-kl/Wavelet/internal/infra/task/scheduler"
 	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
 	"github.com/gin-gonic/gin"
 	"github.com/robfig/cron/v3"
@@ -119,7 +120,7 @@ func ListTaskExecutions(c *gin.Context) {
 		}
 	}
 
-	executions, total, err := model.ListTaskExecutions(c.Request.Context(), req)
+	executions, total, err := repository.ListTaskExecutions(c.Request.Context(), req)
 	if err != nil {
 		response.AbortInternal(c, err.Error())
 		return
@@ -153,7 +154,7 @@ func GetTaskExecution(c *gin.Context) {
 		return
 	}
 
-	execution, err := model.GetTaskExecutionByID(c.Request.Context(), id)
+	execution, err := repository.GetTaskExecutionByID(c.Request.Context(), id)
 	if err != nil {
 		response.AbortNotFound(c, TaskNotFound)
 		return
@@ -211,7 +212,7 @@ func RetryTask(c *gin.Context) {
 // @Failure 403 {object} response.Any "无管理员权限"
 // @Router /api/v1/admin/tasks/schedules [get]
 func ListSchedules(c *gin.Context) {
-	schedules, err := model.ListSchedules(c.Request.Context())
+	schedules, err := repository.ListSchedules(c.Request.Context())
 	if err != nil {
 		response.AbortInternal(c, err.Error())
 		return
@@ -281,7 +282,7 @@ func CreateSchedule(c *gin.Context) {
 		IsActive: *req.IsActive,
 	}
 
-	if err := model.CreateSchedule(c.Request.Context(), schedule); err != nil {
+	if err := repository.CreateSchedule(c.Request.Context(), schedule); err != nil {
 		response.AbortInternal(c, fmt.Sprintf("%s: %v", ScheduleSaveFailed, err))
 		return
 	}
@@ -333,7 +334,7 @@ func UpdateSchedule(c *gin.Context) {
 	}
 
 	// 检查定时任务是否存在
-	schedule, err := model.GetScheduleByID(c.Request.Context(), id)
+	schedule, err := repository.GetScheduleByID(c.Request.Context(), id)
 	if err != nil {
 		response.AbortNotFound(c, ScheduleNotFound)
 		return
@@ -369,7 +370,7 @@ func UpdateSchedule(c *gin.Context) {
 	schedule.Payload = string(validated)
 	schedule.IsActive = *req.IsActive
 
-	if err := model.UpdateSchedule(c.Request.Context(), schedule); err != nil {
+	if err := repository.UpdateSchedule(c.Request.Context(), schedule); err != nil {
 		response.AbortInternal(c, fmt.Sprintf("%s: %v", ScheduleSaveFailed, err))
 		return
 	}
@@ -402,7 +403,7 @@ func DeleteSchedule(c *gin.Context) {
 		return
 	}
 
-	if err := model.DeleteSchedule(c.Request.Context(), id); err != nil {
+	if err := repository.DeleteSchedule(c.Request.Context(), id); err != nil {
 		response.AbortInternal(c, fmt.Sprintf("%s: %v", ScheduleDeleteFailed, err))
 		return
 	}

internal/apps/admin/task/routers_test.go

@@ -20,6 +20,7 @@ import (
 	"github.com/Rain-kl/Wavelet/internal/infra/task"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/platform/bootstrap"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/internal/testhelper"
 	"github.com/gin-gonic/gin"
 	"github.com/hibiken/asynq"
@@ -234,7 +235,7 @@ func TestListTaskExecutions(t *testing.T) {
 		{TaskID: "exec_003", TaskType: "system:cleanup", TaskName: "系统垃圾清理", Status: model.TaskExecutionStatusPending, TriggeredBy: "manual", Retryable: true, MaxRetry: 3},
 	}
 	for _, r := range records {
-		err := model.CreateTaskExecution(ctx, r)
+		err := repository.CreateTaskExecution(ctx, r)
 		require.NoError(t, err)
 	}
 
@@ -345,7 +346,7 @@ func TestGetTaskExecution(t *testing.T) {
 		MaxRetry:    3,
 		TriggeredBy: "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	t.Run("get existing execution", func(t *testing.T) {
@@ -410,7 +411,7 @@ func TestRetryTask(t *testing.T) {
 			StartedAt:    &now,
 			FinishedAt:   &now,
 		}
-		err := model.CreateTaskExecution(ctx, execution)
+		err := repository.CreateTaskExecution(ctx, execution)
 		require.NoError(t, err)
 
 		url := fmt.Sprintf("/api/v1/admin/tasks/executions/%d/retry", execution.ID)
@@ -430,7 +431,7 @@ func TestRetryTask(t *testing.T) {
 		assert.True(t, ok)
 		assert.NotEmpty(t, newTaskID)
 
-		newExecution, err := model.GetTaskExecutionByTaskID(ctx, newTaskID)
+		newExecution, err := repository.GetTaskExecutionByTaskID(ctx, newTaskID)
 		require.NoError(t, err)
 		assert.Equal(t, 1, newExecution.RetryCount)
 		assert.Equal(t, "retry", newExecution.TriggeredBy)
@@ -446,7 +447,7 @@ func TestRetryTask(t *testing.T) {
 			MaxRetry:    3,
 			TriggeredBy: "manual",
 		}
-		err := model.CreateTaskExecution(ctx, execution)
+		err := repository.CreateTaskExecution(ctx, execution)
 		require.NoError(t, err)
 
 		url := fmt.Sprintf("/api/v1/admin/tasks/executions/%d/retry", execution.ID)
@@ -466,7 +467,7 @@ func TestRetryTask(t *testing.T) {
 			Retryable:   false,
 			TriggeredBy: "manual",
 		}
-		err := model.CreateTaskExecution(ctx, execution)
+		err := repository.CreateTaskExecution(ctx, execution)
 		require.NoError(t, err)
 
 		url := fmt.Sprintf("/api/v1/admin/tasks/executions/%d/retry", execution.ID)

internal/apps/admin/user/logics.go

@@ -10,7 +10,6 @@ import (
 	"time"
 
 	"github.com/Rain-kl/Wavelet/internal/apps/oauth"
-	"github.com/Rain-kl/Wavelet/internal/infra/persistence"
 	"github.com/Rain-kl/Wavelet/internal/infra/persistence/idgen"
 	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/repository"
@@ -41,7 +40,7 @@ func updateUserStatus(ctx context.Context, id uint64, active bool) error {
 
 	var tokens []model.AccessToken
 	if !active {
-		_ = db.DB(ctx).Where("user_id = ?", id).Find(&tokens).Error
+		tokens, _ = repository.ListAccessTokensByUserID(ctx, id)
 	}
 
 	err = repository.UpdateUserActive(ctx, id, active)
@@ -68,8 +67,7 @@ func deleteUser(ctx context.Context, currentUserID, targetID uint64) error {
 		return errors.New(cannotDelete)
 	}
 
-	var tokens []model.AccessToken
-	_ = db.DB(ctx).Where("user_id = ?", targetID).Find(&tokens).Error
+	tokens, _ := repository.ListAccessTokensByUserID(ctx, targetID)
 
 	err = repository.DeleteUserWithRelations(ctx, targetID)
 	if err == nil {
@@ -181,7 +179,7 @@ func updateUser(ctx context.Context, currentUserID uint64, param updateUserParam
 	needRevokeTokens := (param.Password != "") || (targetUser.IsAdmin && !param.IsAdmin)
 	var tokens []model.AccessToken
 	if needRevokeTokens {
-		_ = db.DB(ctx).Where("user_id = ?", param.ID).Find(&tokens).Error
+		tokens, _ = repository.ListAccessTokensByUserID(ctx, param.ID)
 	}
 
 	// 更新字段