feat(framework): 回灌 OpenFlare 分层、安全与运行时改进

将平台域持久化收敛为 repository 唯一入口，model 去掉 IO。
邮件头写入前清除 CR/LF，防止 header 注入。
httppool 支持可配置 Transport；batchwriter 增加 MinBatchSize/Stats，flush 失败交回批次；任务 PermanentError 作为 SkipRetry 终态。
设置与推送页的确认改为 AlertDialog；axios 去尾斜杠并按 Gin 数组序列化查询参数。
升级共享 Go 依赖（Gin、Asynq、OTel、GORM、Redis 等）。

pkg/httppool/httppool.go

@@ -5,9 +5,11 @@
 package httppool
 
 import (
+	"context"
 	"crypto/tls"
 	"net"
 	"net/http"
+	"net/url"
 	"sync"
 	"time"
 
@@ -30,28 +32,66 @@ var (
 	once             sync.Once
 )
 
+// TransportOptions configures the request-specific parts of a pooled HTTP
+// transport. Pool sizes and timeout defaults remain managed by this package.
+// A nil Proxy explicitly disables proxy use.
+type TransportOptions struct {
+	Proxy                 func(*http.Request) (*url.URL, error)
+	DialContext           func(context.Context, string, string) (net.Conn, error)
+	TLSClientConfig       *tls.Config
+	ResponseHeaderTimeout time.Duration
+	TraceFilter           func(*http.Request) bool
+}
+
+// NewTransport returns an independently configurable pooled transport wrapped
+// with OTel instrumentation. The supplied TLS configuration is cloned before
+// use so later caller mutations cannot change an active transport.
+func NewTransport(options TransportOptions) http.RoundTripper {
+	dialContext := options.DialContext
+	if dialContext == nil {
+		dialContext = (&net.Dialer{
+			Timeout:   dialTimeout,
+			KeepAlive: dialKeepAlive,
+		}).DialContext
+	}
+
+	tlsConfig := options.TLSClientConfig
+	if tlsConfig == nil {
+		tlsConfig = &tls.Config{}
+	} else {
+		tlsConfig = tlsConfig.Clone()
+	}
+	if tlsConfig.ClientSessionCache == nil {
+		tlsConfig.ClientSessionCache = tls.NewLRUClientSessionCache(tlsSessionCacheSize)
+	}
+
+	transport := &http.Transport{
+		Proxy:                 options.Proxy,
+		DialContext:           dialContext,
+		ForceAttemptHTTP2:     true,
+		MaxIdleConns:          maxIdleConns,
+		MaxIdleConnsPerHost:   maxIdleConnsPerHost,
+		IdleConnTimeout:       idleConnTimeout,
+		TLSHandshakeTimeout:   tlsHandshakeTimeout,
+		ResponseHeaderTimeout: options.ResponseHeaderTimeout,
+		ExpectContinueTimeout: expectContinueTimeout,
+		TLSClientConfig:       tlsConfig,
+	}
+	otelOptions := make([]otelhttp.Option, 0, 1)
+	if options.TraceFilter != nil {
+		otelOptions = append(otelOptions, otelhttp.WithFilter(options.TraceFilter))
+	}
+	return otelhttp.NewTransport(transport, otelOptions...)
+}
+
 // DefaultTransport returns a globally shared, optimized http.RoundTripper
 // with OTel instrumentation. It maintains a pool of idle TCP connections
 // across hosts.
 func DefaultTransport() http.RoundTripper {
 	once.Do(func() {
-		transport := &http.Transport{
+		defaultTransport = NewTransport(TransportOptions{
 			Proxy: http.ProxyFromEnvironment,
-			DialContext: (&net.Dialer{
-				Timeout:   dialTimeout,
-				KeepAlive: dialKeepAlive,
-			}).DialContext,
-			ForceAttemptHTTP2:     true,
-			MaxIdleConns:          maxIdleConns,
-			MaxIdleConnsPerHost:   maxIdleConnsPerHost,
-			IdleConnTimeout:       idleConnTimeout,
-			TLSHandshakeTimeout:   tlsHandshakeTimeout,
-			ExpectContinueTimeout: expectContinueTimeout,
-			TLSClientConfig: &tls.Config{
-				ClientSessionCache: tls.NewLRUClientSessionCache(tlsSessionCacheSize),
-			},
-		}
-		defaultTransport = otelhttp.NewTransport(transport)
+		})
 	})
 	return defaultTransport
 }

pkg/httppool/httppool_test.go

@@ -4,6 +4,12 @@
 package httppool
 
 import (
+	"context"
+	"crypto/tls"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
 	"testing"
 	"time"
 )
@@ -35,3 +41,60 @@ func TestNewClient(t *testing.T) {
 		t.Error("NewClient() is not configured with the default transport")
 	}
 }
+
+func TestNewTransportUsesConfiguredDirectDialer(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		_, _ = writer.Write([]byte("ok"))
+	}))
+	t.Cleanup(server.Close)
+
+	var dialedAddress string
+	dialer := &net.Dialer{}
+	transport := NewTransport(TransportOptions{
+		Proxy: nil,
+		DialContext: func(ctx context.Context, network string, address string) (net.Conn, error) {
+			dialedAddress = address
+			return dialer.DialContext(ctx, network, server.Listener.Addr().String())
+		},
+	})
+	client := &http.Client{Transport: transport}
+	t.Cleanup(client.CloseIdleConnections)
+
+	request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, "http://artifact.example/site.zip", nil)
+	if err != nil {
+		t.Fatalf("NewRequestWithContext() error = %v", err)
+	}
+	response, err := client.Do(request)
+	if err != nil {
+		t.Fatalf("client.Do() error = %v", err)
+	}
+	defer func() { _ = response.Body.Close() }()
+	if _, err := io.ReadAll(response.Body); err != nil {
+		t.Fatalf("ReadAll() error = %v", err)
+	}
+	if dialedAddress != "artifact.example:80" {
+		t.Fatalf("DialContext address = %q, want direct target", dialedAddress)
+	}
+}
+
+func TestNewTransportClonesTLSConfig(t *testing.T) {
+	server := httptest.NewTLSServer(http.HandlerFunc(func(writer http.ResponseWriter, _ *http.Request) {
+		writer.WriteHeader(http.StatusNoContent)
+	}))
+	t.Cleanup(server.Close)
+
+	tlsConfig := &tls.Config{InsecureSkipVerify: true} //nolint:gosec // test-only self-signed server
+	client := &http.Client{Transport: NewTransport(TransportOptions{TLSClientConfig: tlsConfig})}
+	t.Cleanup(client.CloseIdleConnections)
+	tlsConfig.InsecureSkipVerify = false
+
+	request, err := http.NewRequestWithContext(t.Context(), http.MethodGet, server.URL, nil)
+	if err != nil {
+		t.Fatalf("NewRequestWithContext() error = %v", err)
+	}
+	response, err := client.Do(request)
+	if err != nil {
+		t.Fatalf("client.Do() error = %v", err)
+	}
+	_ = response.Body.Close()
+}

pkg/mail/mail.go

@@ -12,6 +12,7 @@ import (
 	"net"
 	"net/smtp"
 	"strconv"
+	"strings"
 	"time"
 )
 
@@ -29,6 +30,14 @@ type Config struct {
 	Password string
 }
 
+// sanitizeHeaderValue removes CR/LF bytes so untrusted values cannot inject
+// additional email headers (email header injection).
+func sanitizeHeaderValue(v string) string {
+	v = strings.ReplaceAll(v, "\r", "")
+	v = strings.ReplaceAll(v, "\n", "")
+	return v
+}
+
 // SendMail sends an HTML email using the provided config and message details
 func SendMail(ctx context.Context, cfg Config, to string, subject, body string) error {
 	return SendMailHTML(ctx, cfg, to, subject, body)
@@ -40,9 +49,9 @@ func SendMailHTML(ctx context.Context, cfg Config, to string, subject, body stri
 
 	// Header & MIME settings for HTML email
 	header := make(map[string]string)
-	header["From"] = cfg.Username
-	header["To"] = to
-	header["Subject"] = subject
+	header["From"] = sanitizeHeaderValue(cfg.Username)
+	header["To"] = sanitizeHeaderValue(to)
+	header["Subject"] = sanitizeHeaderValue(subject)
 	header["MIME-Version"] = "1.0"
 	header["Content-Type"] = "text/html; charset=UTF-8"
 
@@ -212,9 +221,9 @@ func SendMailWithLog(ctx context.Context, cfg Config, to string, subject, body s
 
 	// Header & MIME settings for HTML email
 	header := make(map[string]string)
-	header["From"] = cfg.Username
-	header["To"] = to
-	header["Subject"] = subject
+	header["From"] = sanitizeHeaderValue(cfg.Username)
+	header["To"] = sanitizeHeaderValue(to)
+	header["Subject"] = sanitizeHeaderValue(subject)
 	header["MIME-Version"] = "1.0"
 	header["Content-Type"] = "text/html; charset=UTF-8"
 

pkg/mail/mail_test.go

@@ -90,3 +90,23 @@ func TestSendMailMock(t *testing.T) {
 		t.Errorf("failed to send mail: %v", err)
 	}
 }
+
+func TestSanitizeHeaderValue(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"plain", "System Notification", "System Notification"},
+		{"crlf stripped", "alert\r\nBcc: attacker@example.com", "alertBcc: attacker@example.com"},
+		{"cr stripped", "a\rb", "ab"},
+		{"lf stripped", "a\nb", "ab"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sanitizeHeaderValue(tt.input); got != tt.want {
+				t.Errorf("sanitizeHeaderValue(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}

pkg/push/email.go

@@ -19,6 +19,14 @@ func init() {
 // EmailPusher 极简 SMTP 邮件推送实现 (静态、解耦)
 type EmailPusher struct{}
 
+// sanitizeEmailHeader removes CR/LF bytes so untrusted values cannot inject
+// additional email headers (email header injection).
+func sanitizeEmailHeader(v string) string {
+	v = strings.ReplaceAll(v, "\r", "")
+	v = strings.ReplaceAll(v, "\n", "")
+	return v
+}
+
 // Send 发送邮件
 func (p *EmailPusher) Send(ctx context.Context, cfg Config, target string, body map[string]any, _ string, ext map[string]any) (string, error) {
 	if cfg.URL == "" || cfg.Key == "" || cfg.Secret == "" {
@@ -57,9 +65,9 @@ func (p *EmailPusher) Send(ctx context.Context, cfg Config, target string, body
 		}
 	}
 
-	subjectHeader := fmt.Sprintf("Subject: %s\r\n", title)
-	fromHeader := fmt.Sprintf("From: %s <%s>\r\n", fromName, from)
-	toHeader := fmt.Sprintf("To: %s\r\n", to)
+	subjectHeader := fmt.Sprintf("Subject: %s\r\n", sanitizeEmailHeader(title))
+	fromHeader := fmt.Sprintf("From: %s <%s>\r\n", sanitizeEmailHeader(fromName), sanitizeEmailHeader(from))
+	toHeader := fmt.Sprintf("To: %s\r\n", sanitizeEmailHeader(to))
 	mimeHeader := "MIME-version: 1.0;\r\nContent-Type: text/html; charset=\"UTF-8\";\r\n\r\n"
 
 	// 拼装完整的邮件报文

pkg/push/email_test.go

@@ -0,0 +1,26 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package push
+
+import "testing"
+
+func TestSanitizeEmailHeader(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{"plain", "System Notification", "System Notification"},
+		{"crlf stripped", "alert\r\nBcc: attacker@example.com", "alertBcc: attacker@example.com"},
+		{"cr stripped", "a\rb", "ab"},
+		{"lf stripped", "a\nb", "ab"},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := sanitizeEmailHeader(tt.input); got != tt.want {
+				t.Errorf("sanitizeEmailHeader(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}