fix: add missing ip_preference column to PostgreSQL tunnel table

.github/ISSUES/forward-show-tunnel-ratio.md

@@ -1,62 +0,0 @@
-# 功能请求：在规则页面显示隧道倍率
-
-## 问题描述
-
-当前规则（Forward）页面在列表中显示隧道名称，但**不显示隧道的流量倍率（trafficRatio）**。管理员在管理规则时无法快速查看该规则所使用的隧道倍率信息，需要跳转到隧道页面才能查看。
-
-## 期望行为
-
-在规则列表页面中，在隧道名称旁边或单独列显示该隧道的流量倍率（例如：`1x`, `0.5x`, `2x`）。
-
-## 建议实现位置
-
-### 前端修改
-
-1. **`vite-frontend/src/pages/forward.tsx`**
-   - 在 `Forward` interface 中添加 `tunnelTrafficRatio?: number` 字段
-   - 在表格列中添加倍率显示（可以在隧道名称 Chip 旁边或单独一列）
-   - 从 `userTunnel` 或 `getTunnelList` API 获取隧道倍率信息
-
-2. **显示格式建议**
-   ```tsx
-   <Chip className="...">
-     {forward.tunnelName} ({forward.tunnelTrafficRatio}x)
-   </Chip>
-   ```
-   或者单独一列：
-   ```tsx
-   <TableCell>
-     {forward.tunnelTrafficRatio}x
-   </TableCell>
-   ```
-
-### 后端修改
-
-1. **`go-backend/internal/http/handler/handler.go`**
-   - 在 `forwardList` 接口返回中添加隧道的 `trafficRatio` 字段
-   - 需要在查询 Forward 时 JOIN Tunnel 表获取倍率信息
-
-2. **或者在前端加载规则后，批量获取隧道信息**
-   - 调用 `getTunnelList` 获取所有隧道信息
-   - 根据 `tunnelId` 匹配倍率
-
-## 相关文件
-
-- 前端：`vite-frontend/src/pages/forward.tsx`
-- 前端类型：`vite-frontend/src/api/types.ts`
-- 后端：`go-backend/internal/http/handler/handler.go`
-- 隧道类型定义：`vite-frontend/src/api/types.ts` (TunnelApiItem)
-
-## 优先级
-
-中等 - 不影响核心功能，但能提升管理效率
-
-## 截图参考
-
-隧道页面已显示倍率：
-- 位置：隧道卡片统计信息区域
-- 显示格式：`流量倍率 {trafficRatio}x`
-
----
-
-**Labels**: `enhancement`, `frontend`, `backend`, `ui/ux`

.github/workflows/publish-skill.yml

@@ -1,48 +0,0 @@
-name: Publish Skill to npm
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: write
-      id-token: write
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Get version from tag
-        id: version
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            VERSION=$(node -p "require('./skills/flvx-api/package.json').version")
-          else
-            VERSION="${GITHUB_REF#refs/tags/v}"
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
-          echo "Publishing skill version: $VERSION"
-
-      - name: Publish to npm
-        working-directory: skills/flvx-api
-        run: npm publish --provenance --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Create GitHub Release
-        if: github.event_name == 'push'
-        uses: softprops/action-gh-release@v1
-        with:
-          name: Skill v${{ steps.version.outputs.version }}
-          generate_release_notes: true
-          files: skills/flvx-api/package.json

.gitignore

@@ -62,9 +62,6 @@ go-gost/ss/
 .classpath
 .project
 .settings/
-
-# OpenCode session metadata
-.entire/
 bin/
 tmp/
 *.swp
@@ -262,8 +259,6 @@ gitee/
 doraemon.jks
 device.id
 commit.sh
-.opencode/
-analysis/
 sql/
 !go-backend/internal/store/sqlite/sql/
 !go-backend/internal/store/sqlite/sql/schema.sql
@@ -271,6 +266,3 @@ sql/
 !go-backend/internal/store/postgres/sql/
 !go-backend/internal/store/postgres/sql/schema.sql
 !go-backend/internal/store/postgres/sql/data.sql
-go-backend/gost.db-shm
-.gitignore
-go-backend/gost.db-wal

.sisyphus/plans/001-setup-dev-environment.md

@@ -0,0 +1,71 @@
+# Plan: 搭建开发环境
+
+## 目标
+为 Flux Panel 项目安装所有缺失的开发依赖，使 3 个子项目都能本地开发和构建。
+
+## 当前状态
+
+### ✅ 已安装
+| 工具 | 版本 | 用途 |
+|------|------|------|
+| Node.js | v20.19.2 | vite-frontend |
+| npm | 9.2.0 | vite-frontend |
+| Go | 1.24.4 | go-gost |
+| Docker | 29.1.4 | 容器化部署 |
+
+### ❌ 缺失
+| 工具 | 需求版本 | 用途 |
+|------|----------|------|
+| Java | 21 | springboot-backend |
+| Maven | 3.x | 构建后端 |
+| Docker Compose | v2 | 容器编排 |
+
+---
+
+## 执行任务
+
+### Task 1: 安装 Java 21
+```bash
+apt-get update && apt-get install -y openjdk-21-jdk
+```
+**验证**: `java -version` 应显示 openjdk 21
+
+### Task 2: 安装 Maven
+```bash
+apt-get install -y maven
+```
+**验证**: `mvn -v` 应显示 Maven 3.x
+
+### Task 3: 安装 Docker Compose Plugin
+```bash
+apt-get install -y docker-compose-plugin
+```
+**验证**: `docker compose version` 应显示版本号
+
+### Task 4: 安装前端依赖
+```bash
+cd /root/flux-panel/vite-frontend && npm install
+```
+**验证**: `node_modules/` 目录存在
+
+### Task 5: 验证后端可构建
+```bash
+cd /root/flux-panel/springboot-backend && mvn clean compile -q
+```
+**验证**: 编译成功无错误
+
+### Task 6: 验证 Go 模块
+```bash
+cd /root/flux-panel/go-gost && go mod download
+```
+**验证**: 依赖下载成功
+
+---
+
+## 完成标准
+- [ ] `java -version` → openjdk 21
+- [ ] `mvn -v` → Maven 3.x
+- [ ] `docker compose version` → v2.x
+- [ ] 前端: `npm run dev` 可启动
+- [ ] 后端: `mvn compile` 成功
+- [ ] Go: `go build .` 成功

AGENTS.md

@@ -1,27 +1,24 @@
 # PROJECT KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
+**Generated:** Sun Feb 15 2026
+**Commit:** e5e22ba
 **Branch:** main
-**Tag:** 2.1.9-beta8
 
 ## OVERVIEW
-FLVX (formerly Flux Panel) is a traffic forwarding management system built on a forked GOST v3 stack. It ships as a Go-based admin API (SQLite/PostgreSQL) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.
+FLVX (formerly Flux Panel) is a traffic forwarding management system built on a forked GOST v3 stack. It ships as a Go-based admin API (SQLite) + Vite/React UI + Go forwarding agent, with optional mobile WebView wrappers.
 
 ## STRUCTURE
 ```
 ./
 ├── go-gost/               # Go forwarding agent (forked gost + local x/)
 │   └── x/                 # Local fork of github.com/go-gost/x (replace => ./x)
-├── go-backend/            # Go Admin API (GORM + SQLite/PostgreSQL, net/http)
-│   └── tests/contract/    # Integration/contract tests
-├── vite-frontend/         # React/Vite dashboard (shadcn bridge + Tailwind v4)
-│   └── src/shadcn-bridge/heroui/  # HeroUI-compatible facade
+├── go-backend/            # Go Admin API (SQLite, net/http)
+├── vite-frontend/         # React/Vite dashboard (HeroUI + Tailwind)
 ├── docker-compose-v4.yml  # Panel deploy (IPv4-only bridge)
 ├── docker-compose-v6.yml  # Panel deploy (IPv6-enabled bridge)
 ├── panel_install.sh       # Panel installer/upgrader (downloads compose)
 ├── install.sh             # Node installer/upgrader (downloads gost binary)
-└── .github/workflows/     # CI: build/test + Docker push + release artifacts
+└── .github/workflows/     # CI: build/push images + release artifacts
 ```
 
 ## WHERE TO LOOK
@@ -31,15 +28,10 @@ FLVX (formerly Flux Panel) is a traffic forwarding management system built on a
 | **Deploy (IPv6)** | `docker-compose-v6.yml` | Same as v4 + IPv6-enabled bridge |
 | **Panel install** | `panel_install.sh` | Picks v4/v6, generates `JWT_SECRET`, downloads compose |
 | **Node install** | `install.sh` | Installs `/etc/flux_agent/flux_agent` + writes `config.json`/`gost.json` + systemd `flux_agent.service` |
-| **Admin API** | `go-backend/` | Go Admin API (SQLite/PostgreSQL) |
-| **Web UI** | `vite-frontend/` | React/Vite dashboard (shadcn bridge + Tailwind v4) |
-| **UI Compatibility** | `vite-frontend/src/shadcn-bridge/heroui/` | HeroUI-compatible API wrappers backed by shadcn/radix |
-| **Theme Tokens** | `vite-frontend/src/styles/tailwind-theme.pcss` | Tailwind v4 `@theme inline` semantic color mapping |
+| **Admin API** | `go-backend/` | Go Admin API (SQLite) |
+| **Web UI** | `vite-frontend/` | React/Vite dashboard (HeroUI + Tailwind) |
 | **Go Agent** | `go-gost/` | Forwarding agent (forked gost + local x/) |
 | **Go Core** | `go-gost/x/` | Handlers/listeners/dialers + management API |
-| **Repository Layer** | `go-backend/internal/store/repo/` | GORM data access (repository.go 83k LOC) |
-| **Contract Tests** | `go-backend/tests/contract/` | Integration tests for auth, federation, tunnels |
-| **CI Workflows** | `.github/workflows/` | ci-build.yml, docker-build.yml, deploy-docs.yml |
 
 ## CODE MAP
 | Symbol | Type | Location | Role |
@@ -48,29 +40,20 @@ FLVX (formerly Flux Panel) is a traffic forwarding management system built on a
 | `main` | Func | `go-backend/cmd/paneld/main.go` | Backend Entry |
 | `App` | Component | `vite-frontend/src/App.tsx` | Frontend Entry |
 | `main` | Func | `go-gost/main.go` | Agent Entry |
-| `Repository` | Struct | `go-backend/internal/store/repo/repository.go` | Data Access Layer |
-| `Handler` | Struct | `go-backend/internal/http/handler/handler.go` | HTTP Handlers |
-| `websocket_reporter` | Func | `go-gost/x/socket/websocket_reporter.go` | Panel Telemetry |
+
 
 ## CONVENTIONS
-- **Skills & MCP**: Always prefer using available skills (via `skill` tool) and MCP tools when applicable. Check for relevant skills before implementing from scratch.
 - **Auth**: `Authorization` header carries the raw JWT token (no `Bearer` prefix) between `vite-frontend/` and `go-backend/`.
 - **Module Fork**: `go-gost/` uses `replace github.com/go-gost/x => ./x` and `go-gost/x/` is also its own Go module.
 - **Encryption**: Agent-to-panel communication uses AES encryption with node `secret` as PSK.
 - **API Envelope**: All REST responses follow `{code, msg, data, ts}` structure (code 0 = success).
-- **Frontend UI Layer**: Import UI primitives from `src/shadcn-bridge/heroui/*` (legacy-compatible facade), not direct `@heroui/*` packages.
-- **Tailwind v4 Semantic Colors**: `src/styles/globals.css` must import `src/styles/tailwind-theme.pcss`; removing it breaks semantic classes like `bg-primary`, `text-foreground`, and `border-input`.
-- **Go Versions**: `go-backend` uses Go 1.24, `go-gost` uses Go 1.23, `go-gost/x` uses Go 1.22.
 
 ## ANTI-PATTERNS (THIS PROJECT)
 - **DO NOT EDIT** generated protobuf output: `go-gost/x/internal/util/grpc/proto/*.pb.go`, `go-gost/x/internal/util/grpc/proto/*_grpc.pb.go`.
 - **DO NOT ADD** `Bearer` prefix to Authorization header - expects raw JWT token.
 - **DO NOT MODIFY** `install.sh` or `panel_install.sh` locally - CI overwrites these on release.
-- **DO NOT** let backend handlers call `repo.DB()` directly — add a Repository method instead.
+- **DO NOT USE** ORM in backend - uses raw SQL with `database/sql`.
 - **DO NOT ADD** frontend tests - project has no test infrastructure (Vitest/Jest not configured).
-- **DO NOT REINTRODUCE** `@heroui/*` or `@nextui-org/*` dependencies; migration is now shadcn bridge-based.
-- **DO NOT** use `type:jsonb` or `type:serial` in GORM tags (SQLite incompatible).
-- **DO NOT** omit `TableName()` on new models — GORM pluralizes by default.
 
 ## COMMANDS
 ```bash
@@ -86,21 +69,15 @@ docker compose -f docker-compose-v6.yml up -d
 (cd go-backend && make build)
 (cd vite-frontend && npm run dev)
 (cd go-gost && go run .)
-
-# Testing
-(cd go-backend && go test ./...)
-(cd go-backend && go test ./tests/contract/...)
 ```
 
 ## UNIQUE STYLES
 - **Flat Monorepo**: Language-prefixed dirs (`go-backend`, `go-gost`, `vite-frontend`) instead of `apps/`/`libs/`.
 - **Asymmetric Go Layout**: `go-backend` follows `cmd/<app>/main.go` while `go-gost` uses `root/main.go`.
 - **Frontend Hybrid Mode**: `App.tsx` detects "H5 mode" (mobile WebView) vs desktop, dictating layout strategy.
-- **Experimental Bundler**: `vite-frontend` uses `rolldown-vite` (Rust-based) instead of standard Vite.
-- **Non-minified Builds**: `vite.config.ts` sets `minify: false`, `treeshake: false` for debugging.
 
 ## NOTES
-- LSP servers are not installed in this environment (gopls/typescript-language-server); rely on grep-based navigation.
+- LSP servers are not installed in this environment (gopls/jdtls/typescript-language-server); rely on grep-based navigation.
 - `vite-frontend/vite.config.ts` sets `minify: false` and disables treeshake; expect larger bundles.
 - `vite-frontend` uses `rolldown-vite` (experimental Rust bundler) instead of standard Vite.
 - Install scripts (`install.sh`, `panel_install.sh`) self-delete after execution - common pattern in one-liner installs.
@@ -108,16 +85,5 @@ docker compose -f docker-compose-v6.yml up -d
 - CI dynamically injects `PINNED_VERSION` into install scripts and docker-compose files during releases.
 - `panel_install.sh` auto-detects IPv6 and modifies `/etc/docker/daemon.json` to enable IPv6 bridge.
 - Download proxy `https://gcode.hostcentral.cc/` used for GitHub downloads in China/restricted environments.
-- Backend has contract tests in `go-backend/tests/contract/` - frontend has no test infrastructure.
+- Backend has contract tests in `go-backend/tests/contract/` - frontend has no test infrastructure (Vitest/Jest not configured).
 - `analysis/3x-ui/` contains a separate git repo for reference/comparison - not part of FLVX core.
-- CI workflows: `ci-build.yml` (build check), `docker-build.yml` (multi-arch images + release), `deploy-docs.yml` (MkDocs).
-- PostgreSQL migration supported via `panel_install.sh` menu option using pgloader.
-- Repository layer is large: `repository.go` (83k LOC), `repository_mutations.go` (43k LOC).
-- Button visual parity relies on `vite-frontend/src/shadcn-bridge/heroui/button.tsx` color mapping + `vite-frontend/src/styles/tailwind-theme.pcss` token export.
-
-## PLAN DOCUMENT RULE
-- Every new implementation plan must have a dedicated Markdown plan document.
-- Store plan documents under `plans/`.
-- Use an incrementing numeric prefix and a short plan-summary name: `NNN-<plan-summary>.md` (for example, `001-auth-refactor.md`, `002-federation-api-cleanup.md`).
-- The numeric prefix must increase by 1 for each new plan.
-- In each plan document, keep a task checklist and mark each task as completed immediately after finishing it.

README.md

@@ -33,13 +33,13 @@ curl -L https://raw.githubusercontent.com/Sagit-chu/flux-panel/main/install.sh -
 #### 安装特定版本
 从 [Releases](https://github.com/Sagit-chu/flux-panel/releases) 页面复制对应版本的安装命令，脚本会自动安装该版本而非最新版。
 
-面板端（以 2.1.9-beta6 为例）：
+面板端（以 2.1.0 为例）：
 ```bash
-curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.9-beta6/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
+curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.0/panel_install.sh -o panel_install.sh && chmod +x panel_install.sh && ./panel_install.sh
 ```
-节点端（以 2.1.9-beta6 为例）：
+节点端（以 2.1.0 为例）：
 ```bash
-curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.9-beta6/install.sh -o install.sh && chmod +x install.sh && ./install.sh
+curl -L https://github.com/Sagit-chu/flux-panel/releases/download/2.1.0/install.sh -o install.sh && chmod +x install.sh && ./install.sh
 ```
 
 #### PostgreSQL 部署（Docker Compose）
@@ -129,28 +129,27 @@ docker compose up -d
 - **License**: Apache License 2.0
 
 ## Modifications
-This fork (FLVX) is no longer a light patch on top of the upstream project. It has been deeply reworked, with both backend and frontend rebuilt around a Go-based architecture.
+The following major changes and additions have been made in this fork (FLVX):
 
-### 1. Backend (Rewritten)
-- **Removed**: The original `springboot-backend/` (Java/Spring Boot) implementation.
-- **Added**: A fully rewritten `go-backend/` service (Go), including updated data and API handling for panel management.
+### 1. Backend Architecture (Replaced)
+- **Removed**: The original `springboot-backend/` (Java/Spring Boot) has been entirely removed.
+- **Added**: A new `go-backend/` (Go/SQLite) implementation replaces the original backend.
 
-### 2. Frontend (Reworked)
-- **Reworked**: `vite-frontend/` has been substantially rebuilt to match the new backend contract and current UI layer architecture.
-- **Updated**: Dashboard pages/components and interaction flows for the current React/Vite stack.
+### 2. Forwarding Agent (Modified)
+- **Modified**: `go-gost/` - Modified forwarding agent wrapper.
+- **Modified**: `go-gost/x/` - Modified local fork of the `gost` extensions library.
 
-### 3. Forwarding Stack (Modified)
-- **Modified**: `go-gost/` forwarding agent wrapper.
-- **Modified**: `go-gost/x/` local fork of `github.com/go-gost/x`.
+### 3. Frontend (Modified)
+- **Modified**: `vite-frontend/` - Significant updates to the React/Vite dashboard to compatible with the new Go backend, including UI/UX improvements (HeroUI + Tailwind).
 
-### 4. Mobile Clients (Removed)
-- **Removed**: `android-app/` source code.
-- **Removed**: `ios-app/` source code.
+### 4. Mobile Applications (Removed)
+- **Removed**: `android-app/` - Source code for the Android client.
+- **Removed**: `ios-app/` - Source code for the iOS client.
 
-### 5. Deployment & Project Infrastructure
-- **Updated**: Docker deployment templates and installer output flow (IPv4/IPv6 compose variants).
-- **Updated**: Release installation scripts (`install.sh`, `panel_install.sh`) and supporting automation.
-- **Added/Updated**: Project-level engineering documentation (for example `AGENTS.md`).
+### 5. Infrastructure & Scripts
+- **Modified**: `docker-compose.yml` (installer output name, auto-selects IPv4/IPv6 template, updated for Go backend).
+- **Modified**: `install.sh`, `panel_install.sh` (Updated installation logic).
+- **Added**: `AGENTS.md` (Project documentation).
 
 ---
 

doc/ai-skill.md

@@ -1,220 +0,0 @@
-# AI Skill 使用指南
-
-让大模型直接操作 FLVX 面板的技能包。支持 OpenCode、OpenClaw、Claude Code 等工具。
-
-## 安装
-
-### 方式 1: npm (推荐)
-
-```bash
-npm install -g @flvx/skill-api
-```
-
-postinstall 脚本会自动链接到 `~/.agents/skills/flvx-api/`。
-
-### 方式 2: 手动链接
-
-```bash
-# 从 FLVX 源码
-cd /path/to/flvx
-mkdir -p ~/.agents/skills
-ln -sf $(pwd)/skills/flvx-api ~/.agents/skills/
-
-# 或从 GitHub
-git clone https://github.com/Sagit-chu/flvx.git
-cd flvx
-ln -sf $(pwd)/skills/flvx-api ~/.agents/skills/
-```
-
-## 配置
-
-设置环境变量：
-
-```bash
-export FLVX_BASE_URL="https://your-panel.example.com"
-export FLVX_USERNAME="admin"
-export FLVX_PASSWORD="your-password"
-```
-
-或使用凭证文件：
-
-```bash
-mkdir -p ~/.flvx
-cat > ~/.flvx/.env << 'EOF'
-export FLVX_BASE_URL="https://panel.example.com"
-export FLVX_USERNAME="admin"
-export FLVX_PASSWORD="your-password"
-EOF
-chmod 600 ~/.flvx/.env
-source ~/.flvx/.env
-```
-
----
-
-## 工具接入方法
-
-### OpenCode
-
-OpenCode 是命令行 AI 编程助手，支持通过 skills 扩展能力。
-
-**安装 skill:**
-```bash
-npm install -g @flvx/skill-api
-```
-
-**使用:**
-```bash
-export FLVX_BASE_URL="https://panel.example.com"
-export FLVX_USERNAME="admin"
-export FLVX_PASSWORD="your-password"
-
-opencode
-```
-
-**示例对话:**
-```
-你: 查看我的转发列表
-你: 创建一个转发到 192.168.1.100:80 使用隧道 1
-你: 检查节点状态
-你: 查看流量使用情况
-```
-
----
-
-### OpenClaw
-
-OpenClaw 同样支持 skills 机制。
-
-**安装 skill:**
-```bash
-npm install -g @flvx/skill-api
-
-# 或手动链接
-mkdir -p ~/.openclaw/skills
-ln -sf /path/to/flvx/skills/flvx-api ~/.openclaw/skills/flvx-api
-```
-
-**使用:**
-```bash
-openclaw
-
->>> 查看所有节点状态
->>> 给用户 alice 分配 50GB 流量
->>> 导出系统备份
-```
-
----
-
-### Claude Code
-
-Claude Code 是 Anthropic 官方的命令行工具，支持通过 CLAUDE.md 扩展。
-
-#### 方式 1: 项目级 CLAUDE.md
-
-在项目根目录创建 `CLAUDE.md`：
-
-```markdown
-# FLVX API Skill
-
-你可以通过 REST API 操作 FLVX 面板。
-
-## 环境变量
-- FLVX_BASE_URL: 面板地址
-- FLVX_USERNAME: 用户名
-- FLVX_PASSWORD: 密码
-
-## 认证规则
-- Authorization 头使用原始 JWT token，不加 "Bearer " 前缀
-- 所有 API 使用 POST 方法
-
-## 常用 API
-
-### 登录获取 token
-POST /api/v1/user/login
-{"username": "...", "password": "..."}
-
-### 查看转发列表
-POST /api/v1/forward/list
-Authorization: <token>
-{}
-
-### 创建转发
-POST /api/v1/forward/create
-{"name": "xxx", "tunnelId": 1, "remoteAddr": "1.2.3.4:80"}
-
-### 查看节点
-POST /api/v1/node/list
-{}
-```
-
-**使用:**
-```bash
-cd /path/to/your/project
-claude
-```
-
-#### 方式 2: 全局 CLAUDE.md
-
-```bash
-mkdir -p ~/.claude
-cat > ~/.claude/CLAUDE.md << 'EOF'
-# FLVX Panel Operations
-
-使用 FLVX REST API 操作流量转发面板。
-
-环境变量: FLVX_BASE_URL, FLVX_USERNAME, FLVX_PASSWORD
-调用方式: curl -X POST "$FLVX_BASE_URL/api/v1/..." -H "Authorization: $TOKEN"
-注意: Authorization 不要加 Bearer 前缀
-EOF
-```
-
-#### 方式 3: 复制 SKILL.md
-
-```bash
-cat ~/.agents/skills/flvx-api/SKILL.md >> ~/.claude/CLAUDE.md
-```
-
-**示例对话:**
-```
->>> 帮我查看 FLVX 面板上有哪些节点
->>> 创建一个名为 test 的转发，目标地址 10.0.0.1:80
->>> 查看我的流量使用情况
-```
-
----
-
-## API 覆盖
-
-| 模块 | 操作 |
-|------|------|
-| 认证 | 登录、Token 管理 |
-| 用户 | 增删改查、流量重置、密码 |
-| 节点 | 增删改查、安装、升级、状态 |
-| 隧道 | 增删改查、用户分配 |
-| 转发 | 增删改查、暂停/恢复、诊断 |
-| 分组 | 用户/隧道分组、权限 |
-| 限速 | 增删改查 |
-| 联邦 | 节点共享、远程节点 |
-| 备份 | 导出/导入 |
-
-## 安全提示
-
-- ⚠️ 环境变量在进程列表中可见
-- 使用 `~/.flvx/.env` 文件并设置 `chmod 600`
-- 添加 `export HISTIGNORE="*FLVX_PASSWORD*"` 防止密码进入历史记录
-- Token 仅在会话内存中缓存，不写入磁盘
-
-## 发布
-
-维护者可通过以下方式发布新版本：
-
-```bash
-# 方式 1: 推送 tag
-git tag skill-v2.1.6
-git push --tags
-
-# 方式 2: GitHub Actions 手动触发
-# 在 Actions 页面运行 publish-skill workflow
-```
-
-需要在 GitHub 仓库设置 `NPM_TOKEN` secret。

doc/index.md

@@ -18,7 +18,6 @@
 - [安装部署](./install.md)
 - [使用指南](./usage.md)
 - [PostgreSQL 数据库指南](./postgresql.md)
-- [AI Skill 接入](./ai-skill.md) - 让大模型直接操作面板
 - [常见问题](./faq.md)
 
 ## 免责声明

go-backend/AGENTS.md

@@ -1,13 +1,8 @@
 # GO BACKEND KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
-
 ## OVERVIEW
 Go-based Admin API for FLVX. Replaced legacy Spring Boot backend.
-**Stack:** Go 1.24, net/http (std lib), GORM + SQLite/PostgreSQL (glebarez/sqlite - CGO-free).
+**Stack:** Go 1.23, net/http (std lib), SQLite/PostgreSQL (modernc.org/sqlite - CGO-free).
 
 ## STRUCTURE
 ```
@@ -19,18 +14,12 @@ go-backend/
 │   │   ├── handler/          # API Handlers (User, Tunnel, Node, etc.)
 │   │   ├── middleware/       # JWT, CORS, Logging, Recover
 │   │   └── response/         # JSON response helpers
-│   ├── store/
-│   │   ├── model/model.go    # GORM model structs (single source of truth)
-│   │   └── repo/             # Data Access Layer (Repository pattern, GORM)
-│   │       ├── repository.go           # Core queries, Open/OpenPostgres, AutoMigrate (83k LOC)
-│   │       ├── repository_mutations.go # Mutation helpers (user/node/tunnel/forward CRUD, 43k LOC)
-│   │       ├── repository_federation.go # Federation-specific queries
-│   │       ├── repository_flow.go      # Flow/forward status queries
-│   │       ├── repository_control.go   # Control plane queries
-│   │       └── repository_groups.go    # Group management queries
+│   ├── store/sqlite/         # Data Access Layer (Repository pattern)
+│   │   ├── repository.go     # SQL queries & Struct definitions
+│   │   └── sql/              # Embedded schema.sql & data.sql
 │   └── auth/                 # Auth logic
-├── tests/contract/            # Integration/contract tests (14 tests)
-├── Dockerfile                # Multi-stage build (golang:1.24-bookworm → debian:bookworm-slim)
+├── tests/                    # Integration/Contract tests
+├── Dockerfile                # Multi-stage build (alpine)
 └── Makefile                  # Build commands
 ```
 
@@ -38,35 +27,28 @@ go-backend/
 | Task | Location | Notes |
 |------|----------|-------|
 | **API Routes** | `go-backend/internal/http/router.go` | Registers handlers to `http.ServeMux` |
-| **DB Models** | `go-backend/internal/store/model/model.go` | GORM structs with `TableName()` methods |
-| **Repository** | `go-backend/internal/store/repo/` | GORM-based queries, all DB ops encapsulated |
+| **DB Schema** | `go-backend/internal/store/sqlite/sql/schema.sql` | Embedded in binary |
+| **SQL Queries** | `go-backend/internal/store/sqlite/repository.go` | Raw SQL, no ORM |
 | **Auth Middleware** | `go-backend/internal/http/middleware/jwt.go` | Extracts `Authorization` header |
 | **WebSocket** | `go-backend/internal/ws/` | Real-time updates (traffic, status) |
-| **Contract Tests** | `go-backend/tests/contract/` | Integration tests for auth, federation, tunnels |
 
 ## CONVENTIONS
-- **GORM ORM**: Uses GORM with `glebarez/sqlite` (CGO-free) and `gorm.io/driver/postgres`.
-- **AutoMigrate**: Schema created at startup via `autoMigrateAll()` — no hand-written DDL.
-- **TableName()**: All models define explicit `TableName()` returning singular snake_case names.
-- **Repository Pattern**: Handlers never access `*gorm.DB` directly — all queries go through `repo.Repository` methods.
+- **No ORM**: Uses raw SQL with `database/sql` and `modernc.org/sqlite`.
+- **CGO-Free SQLite**: `modernc.org/sqlite` instead of `mattn/go-sqlite3` - builds without CGO.
 - **Standard Lib**: Uses `net/http` for routing (Go 1.22+ patterns).
 - **Auth**: Expects raw JWT in `Authorization` header (no `Bearer` prefix).
 - **API Envelope**: All responses use `response.R{code, msg, data, ts}` structure.
 - **Config**: Loaded from environment variables (see `cmd/paneld/main.go`).
-- **SQLite Constraints**: `MaxOpenConns(1)`, WAL mode, busy_timeout=5000.
-- **PostgreSQL**: Supported via `DB_TYPE=postgres` and `DATABASE_URL` env vars.
+- **SQL Idempotency**: Prefer `ON CONFLICT DO NOTHING` for inserts in migrations/sync.
 
 ## ANTI-PATTERNS
-- **DO NOT** let handlers call `repo.DB()` directly — add a Repository method instead.
+- **DO NOT USE** ORM - uses raw SQL throughout.
 - **DO NOT CHANGE** handler signatures without updating `router.go`.
-- **DO NOT** use `type:jsonb` or `type:serial` in GORM tags (SQLite incompatible).
-- **DO NOT** omit `TableName()` on new models — GORM pluralizes by default.
 
 ## COMMANDS
 ```bash
 cd go-backend
 go run ./cmd/paneld       # Default: SERVER_ADDR=:6365
-go test ./...             # Unit tests
-go test ./tests/contract/... # Contract tests
+go test ./...
 make build
 ```

go-backend/MIGRATION_PLAN.md

@@ -1,536 +0,0 @@
-# 数据库 GORM ORM 迁移计划
-
-**创建时间:** 2026-02-15
-**更新时间:** 2026-02-17 (实施：完成 P1 + P2 + P3 + P5(Repo 查询层 + schema 收尾) + 测试/构建收尾)
-**分支:** main (commit e5e22ba)
-**状态:** 基本完成（保留 4 处 PG 序列修复 DDL `Exec`）
-
----
-
-## 一、现状分析
-
-### 1.1 迁移前架构 (已归档)
-
-项目原使用 `database/sql` + 手写 raw SQL，通过 `internal/store/db.go` 中的运行时 SQL 重写层实现 SQLite/PostgreSQL 双数据库兼容。
-
-| 组件 | 行数 | 角色 | 当前状态 |
-|------|------|------|----------|
-| `store/db.go` | ~520 | SQL 方言重写层 | **已删除** |
-| `store/sqlite/repository.go` | ~3118 | Repository 查询方法 | **已重写为 store/repo/** |
-| `handler/mutations.go` | ~3748 | Handler 内直接写 raw SQL | **已迁移到 repo（生产 SQL=0）** |
-| `handler/handler.go` | ~1283 | 部分方法用 `repo.DB()` | **大部分已迁移** |
-| `handler/federation.go` | ~若干 | Federation 相关 SQL | **已迁移到 repo** |
-| `handler/control_plane.go` | ~若干 | 控制面相关 SQL | **已迁移到 repo** |
-| `handler/flow_policy.go` | ~若干 | 流量策略相关 SQL | **已迁移到 repo** |
-| `handler/jobs.go` | ~若干 | 后台任务相关 SQL | **已迁移到 repo** |
-| `store/postgres/` | 目录 | PostgreSQL 专用 schema/data | **已删除** |
-
-### 1.2 痛点 (迁移目标)
-
-1. ~~**双 Schema 维护**~~：已通过 AutoMigrate 解决
-2. ~~**SQL 重写层复杂**~~：db.go 已删除
-3. ~~**handler 直接写 SQL**~~：`mutations.go` 生产路径 `tx.Exec`/`tx.Raw` 已清零（测试代码除外）
-4. ~~**无类型安全**~~：repo 业务查询已 GORM 化；剩余 4 处为 PG 序列修复 DDL `Exec`（设计保留）
-5. ~~**模型定义分散**~~：已集中到 model/model.go
-
----
-
-## 二、方案：引入 GORM ORM（全面重写）
-
-### 2.1 方案变更说明
-
-原计划为 **方案 D（扩展现有 DDL 重写层）**，现变更为 **方案 A（GORM 全面重写）**。
-
-### 2.2 选择 GORM 的理由
-
-1. Go 生态最成熟的 ORM，社区庞大，文档完善
-2. 原生支持 SQLite + PostgreSQL 双数据库，自动处理方言差异
-3. AutoMigrate 消除双 schema 维护，自动处理 AUTOINCREMENT ↔ SERIAL 等
-4. 类型安全的模型定义，编译期检查字段映射
-5. 内置事务管理（closure pattern 自动 rollback/commit）
-6. 自动处理 `"user"` 保留字引号
-
-### 2.3 GORM 驱动选择
-
-| 数据库 | 驱动 | 包 | 备注 |
-|--------|------|-----|------|
-| SQLite | modernc.org/sqlite (CGO-free) | `github.com/glebarez/sqlite` | 纯 Go，无需 CGO |
-| PostgreSQL | pgx/v5 | `gorm.io/driver/postgres` | 默认使用 pgx |
-
-> **注意**：标准 `gorm.io/driver/sqlite` 依赖 CGO，必须使用 `glebarez/sqlite` 包装器。
-
-### 2.4 核心设计原则
-
-1. **Model 集中定义**：所有 GORM Model 在 `internal/store/model/` 包中
-2. **Repository 模式保留**：Repository struct 持有 `*gorm.DB`，对外方法签名尽量不变
-3. **Handler 不直接操作 DB**：所有数据库操作必须封装在 Repository 方法中
-4. **AutoMigrate 替代 schema.sql**：启动时自动迁移，不再维护手写 DDL
-5. **保留 PG 序列修复**：pgloader 迁移场景仍需 `ensurePostgresIDDefaults()`
-6. **Package 重命名**：`store/sqlite` → `store/repo`
-
----
-
-## 三、Model 设计
-
-### 3.1 GORM 类型映射
-
-| Go 类型 | GORM 行为 | PostgreSQL | SQLite |
-|---------|-----------|------------|--------|
-| `int64` + `primaryKey` | 自增主键 | `bigserial` | `INTEGER PRIMARY KEY AUTOINCREMENT` |
-| `int64` | 64位整数 | `bigint` | `integer` (SQLite 自动 64位) |
-| `int` | 整数 | `integer` | `integer` |
-| `float64` | 浮点 | `double precision` | `real` |
-| `string` + `size:100` | 变长字符 | `varchar(100)` | `varchar(100)` |
-| `string` (无 size) | 文本 | `text` | `text` |
-| `sql.NullInt64` | 可空整数 | `bigint NULL` | `integer NULL` |
-| `sql.NullString` | 可空文本 | `text NULL` | `text NULL` |
-
-### 3.2 表清单（21 张表）
-
-| 表名 | Model | 特殊处理 |
-|------|-------|----------|
-| `user` | `User` | `TableName()` 返回 `"user"` (PG 保留字) |
-| `forward` | `Forward` | |
-| `forward_port` | `ForwardPort` | |
-| `node` | `Node` | |
-| `speed_limit` | `SpeedLimit` | |
-| `statistics_flow` | `StatisticsFlow` | |
-| `tunnel` | `Tunnel` | |
-| `chain_tunnel` | `ChainTunnel` | |
-| `user_tunnel` | `UserTunnel` | 复合唯一索引 (user_id, tunnel_id) |
-| `tunnel_group` | `TunnelGroup` | |
-| `user_group` | `UserGroup` | |
-| `tunnel_group_tunnel` | `TunnelGroupTunnel` | 复合唯一索引 |
-| `user_group_user` | `UserGroupUser` | 复合唯一索引 |
-| `group_permission` | `GroupPermission` | 复合唯一索引 |
-| `group_permission_grant` | `GroupPermissionGrant` | 复合唯一索引 |
-| `vite_config` | `ViteConfig` | name 唯一 |
-| `peer_share` | `PeerShare` | token 唯一 |
-| `peer_share_runtime` | `PeerShareRuntime` | reservation_id, resource_key 唯一 |
-| `federation_tunnel_binding` | `FederationTunnelBinding` | 复合唯一索引 + resource_key 唯一 |
-| `announcement` | `Announcement` | |
-| `schema_version` | `SchemaVersion` | |
-
----
-
-## 四、详细实施步骤
-
-### 阶段 1：基础设施 — 添加依赖 + 定义 Model ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 1.1 | `go get gorm.io/gorm gorm.io/driver/postgres github.com/glebarez/sqlite` | `go.mod` | ✅ |
-| 1.2 | 创建 `internal/store/model/model.go`，定义全部 21 个表 Model | 新文件 | ✅ |
-| 1.3 | 为 `user` 表添加 `TableName()` 处理 PG 保留字 | model.go | ✅ |
-| 1.4 | 为复合唯一索引的表添加 GORM 索引 tag | model.go | ✅ |
-| 1.5 | 将 Backup 相关 struct 也迁移到 model/ | model.go | ✅ |
-| 1.6 | 验证 `go build ./...` 编译通过 | - | ✅ |
-
-### 阶段 2：GORM DB 初始化 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 2.1 | 修改 Repository struct，`*store.DB` → `*gorm.DB` | repository.go | ✅ |
-| 2.2 | 重写 `Open()` — 用 `glebarez/sqlite` 打开 SQLite | repository.go | ✅ |
-| 2.3 | 重写 `OpenPostgres()` — 用 `gorm.io/driver/postgres` 打开 PG | repository.go | ✅ |
-| 2.4 | 用 `db.AutoMigrate()` 替代 `bootstrapSchema()` | repository.go | ✅ |
-| 2.5 | 实现种子数据逻辑（FirstOrCreate 替代 data.sql） | repository.go | ✅ |
-| 2.6 | 保留并适配 `ensurePostgresIDDefaults()`（用 `db.Exec()`） | repository.go | ✅ |
-| 2.7 | 保留并适配 `migrateSchema()` 增量迁移 | repository.go | ✅ |
-| 2.8 | `DB()` 方法返回 `*gorm.DB` | repository.go | ✅ |
-| 2.9 | SQLite 连接池设置 `MaxOpenConns(1)` 防锁 | repository.go | ✅ |
-
-### 阶段 3：重写 repository 查询方法 ⚠️ ~97% 完成
-
-将所有 raw SQL 查询替换为 GORM 链式调用。
-
-> **2026-02-16 审计**：基础 CRUD 查询已 GORM 化，但 mutation、JOIN 查询、import/export 仍大量使用 raw SQL。
-> **2026-02-17 更新**：已完成 `repository_mutations.go`、Import、以及 `repository_federation/control/flow` 查询层 GORM 化；`repository.go` 中 Raw 已清零，当前仅保留 4 处 PG 序列修复 DDL `Exec`。
-
-| 步骤 | 任务 | 方法数 | 状态 |
-|------|------|--------|------|
-| 3.1 | 用户查询：GetUserByUsername, GetUserByID, UsernameExists* 等 | ~5 | ✅ |
-| 3.2 | 配置查询：GetConfigByName, ListConfigs, UpsertConfig | ~3 | ✅ |
-| 3.3 | 公告查询：GetAnnouncement, UpsertAnnouncement | ~2 | ✅ |
-| 3.4 | 节点查询：GetNodeBy*, ListNodes, UpdateNode* | ~6 | ✅ |
-| 3.5 | 隧道查询：ListTunnels, ListTunnelGroups 等 (含 chain_tunnel 关联) | ~5 | ✅ |
-| 3.6 | 转发查询：ListForwards, resolveForwardIngress | ~3 | ✅ |
-| 3.7 | 用户隧道：GetUserPackageTunnels, GetUserPackageForwards | ~3 | ✅ |
-| 3.8 | 统计/限速：GetStatisticsFlows, ListSpeedLimits, AddFlow | ~4 | ✅ |
-| 3.9 | 分组查询：ListUserGroups, ListGroupPermissions 等 | ~4 | ✅ |
-| 3.10 | PeerShare 全部方法 (CRUD + Runtime) | ~15 | ✅ |
-| 3.11 | FederationTunnelBinding 全部方法 | ~4 | ✅ (Upsert 用 clause.OnConflict) |
-| 3.12 | Export 全部方法 | ~10 | ✅ |
-| 3.13 | Import 全部方法 | ~10 | ✅ 已全部改为 GORM `Clauses(clause.OnConflict)`（见 §9.6） |
-| **3.14** | **repository_mutations.go 全部方法 (~40 个)** | **~40** | **✅ 已全量改为 GORM 链式调用（见 §9.3）** |
-| **3.15** | **repository_federation.go 查询方法** | **~8** | **✅ 已全部改为 GORM 链式调用** |
-| **3.16** | **repository_control.go 复杂查询** | **~5** | **✅ 已全部改为 GORM 链式调用** |
-| **3.17** | **repository_flow.go 查询方法** | **~5** | **✅ 已全部改为 GORM 链式调用** |
-| **3.18** | **Jobs 查询方法 (repository.go 尾部)** | **~8** | **✅ 已 GORM 化** |
-
-### 阶段 4：消除 handler 中直接 SQL — 提取为 Repository 方法 ✅ 已完成
-
-> **2026-02-16 审计**：handler 中的 SQL 已大部分提取到 repo 层，但这些 repo 方法本身仍使用 raw SQL（见阶段 3）。
-> **2026-02-17 更新**：`mutations.go` 直接 `tx.Exec`/`tx.Raw` 已从 27 处降至 0 处（生产代码），详见 §9.4。
-
-mutations.go 和其他 handler 文件中大量直接操作 `h.repo.DB()` 执行 raw SQL，需要：
-1. 将 SQL 逻辑提取为 Repository 方法
-2. Handler 只调用 Repository 方法
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 4.1 | 用户 CRUD：userCreate, userUpdate, userDelete, userResetFlow | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.2 | 节点 CRUD：nodeCreate, nodeUpdate, nodeDelete, nodeBatch* | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.3 | 隧道 CRUD：tunnelCreate, tunnelUpdate, tunnelDelete, tunnelBatch* | mutations.go | ✅ tunnelCreate/Update 的 SQL 已下沉 repo |
-| 4.4 | 转发 CRUD：forwardCreate, forwardUpdate, forwardDelete, forwardBatch* | mutations.go | ✅ 已提取到 repo (CreateForwardTx 等) |
-| 4.5 | 限速 CRUD：speedLimitCreate, speedLimitUpdate, speedLimitDelete | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.6 | 分组 CRUD：所有 group* 方法 | mutations.go | ✅ 成员同步/权限管理 SQL 已下沉 repo |
-| 4.7 | 用户隧道：userTunnelAssign, userTunnelRemove, userTunnelUpdate | mutations.go | ✅ 已提取到 repo 方法 |
-| 4.8 | handler.go 中的直接 SQL (openAPISubStore 等) | handler.go | ✅ 已迁移（含 nil 检查清理） |
-| 4.9 | federation.go 中的 raw SQL | federation.go | ✅ 已提取到 repo_federation.go |
-| 4.10 | control_plane.go 中的 raw SQL | control_plane.go | ✅ 已提取到 repo_control.go |
-| 4.11 | flow_policy.go 中的 raw SQL | flow_policy.go | ✅ 已提取到 repo_flow.go |
-| 4.12 | jobs.go 中的 raw SQL | jobs.go | ✅ 已提取到 repo 方法（含 nil 检查清理） |
-
-### 阶段 5：清理旧代码 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 5.1 | 删除 `internal/store/postgres/` 整个目录 | 目录删除 | ✅ |
-| 5.2 | 删除 `internal/store/sqlite/sql/` 目录 | 目录删除 | ✅ |
-| 5.3 | 删除 `internal/store/db.go` SQL 重写层 | 文件删除 | ✅ |
-| 5.4 | 删除 `internal/store/db_test.go` | 文件删除 | ✅ |
-| 5.5 | 清理 repository.go 中不再需要的 embed 指令 | 清理 | ✅ |
-
-### 阶段 6：Package 重命名 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 6.1 | `internal/store/sqlite/` → `internal/store/repo/` | 目录重命名 | ✅ |
-| 6.2 | 更新所有 import 路径：`store/sqlite` → `store/repo` (13处) | 全局替换 | ✅ |
-
-### 阶段 7：测试 + 验证 ⚠️ 部分完成
-
-| 步骤 | 任务 | 状态 |
-|------|------|------|
-| 7.1 | 更新所有现有测试适配 GORM | ✅ 测试已适配 (使用 repo.DB() 做数据准备) |
-| 7.2 | `go test ./...` 全部通过 | ✅ 已通过（含 `internal/http/handler`、`tests/contract`） |
-| 7.3 | `make build` 构建成功 | ✅ 已通过 |
-
-### 阶段 8：文档更新 ✅ 已完成
-
-| 步骤 | 任务 | 文件 | 状态 |
-|------|------|------|------|
-| 8.1 | 更新 `go-backend/AGENTS.md` — 移除 "DO NOT USE ORM"，记录 GORM 规范 | AGENTS.md | ✅ |
-| 8.2 | 更新根 `AGENTS.md` | AGENTS.md | ✅ |
-| 8.3 | 更新 `handler/AGENTS.md` | AGENTS.md | ✅ |
-
----
-
-## 五、GORM 使用规范
-
-### 5.1 查询模式
-
-```go
-// 单条查询 - 未找到返回 nil, nil (保持现有语义)
-var user model.User
-err := r.db.Where("id = ?", id).First(&user).Error
-if errors.Is(err, gorm.ErrRecordNotFound) {
-    return nil, nil
-}
-
-// 列表查询
-var users []model.User
-err := r.db.Where("role_id != ?", 0).Order("id ASC").Find(&users).Error
-
-// 创建
-err := r.db.Create(&user).Error
-
-// 更新 (部分字段)
-err := r.db.Model(&model.User{}).Where("id = ?", id).Updates(map[string]interface{}{
-    "user": username, "flow": flow, "updated_time": now,
-}).Error
-
-// 事务 (closure pattern - 自动 rollback/commit)
-err := r.db.Transaction(func(tx *gorm.DB) error {
-    if err := tx.Where("user_id = ?", id).Delete(&model.Forward{}).Error; err != nil {
-        return err
-    }
-    return tx.Where("id = ?", id).Delete(&model.User{}).Error
-})
-
-// 原生 SQL (仅用于复杂查询和 PG 特有操作)
-r.db.Exec("SELECT setval(?::regclass, ?, ?)", seqRef, maxID, true)
-```
-
-### 5.2 关键注意事项
-
-1. **user 保留字**：通过 `TableName()` 返回 `"user"`，GORM 自动处理引号
-2. **SQLite MaxOpenConns**：必须设为 1 防止 "database locked"
-3. **SQLite WAL 模式**：DSN 中配置 `_pragma=journal_mode(WAL)`
-4. **不要用 `type:jsonb`**：SQLite 不支持，用 `serializer:json`
-5. **不要用 `type:serial`**：让 GORM 从 `primaryKey` 自动推断
-6. **AutoMigrate 在 SQLite 中使用 copy-swap-drop**：大表慎用
-
----
-
-## 六、影响范围
-
-### 需要修改的文件
-
-| 文件 | 修改类型 | 描述 | 当前状态 |
-|------|----------|------|----------|
-| `go.mod` / `go.sum` | 修改 | 添加 GORM + 驱动依赖 | ✅ |
-| `internal/store/model/model.go` | **新增** | 全部 21 个 GORM Model | ✅ |
-| `internal/store/repo/repository.go` | **重写** | 全部查询 GORM 化 | ⚠️ 业务查询已 GORM；仅剩 PG 序列修复 DDL `Exec` 4 处 |
-| `internal/store/repo/repository_mutations.go` | **重写** | Mutation helpers | ✅ 全量 GORM（Raw=0） |
-| `internal/store/repo/repository_federation.go` | **重写** | Federation 查询 | ✅ 已 GORM 化（Raw=0） |
-| `internal/store/repo/repository_control.go` | **重写** | 控制面查询 | ✅ 已 GORM 化（Raw=0） |
-| `internal/store/repo/repository_flow.go` | **重写** | 流量/转发查询 | ✅ 已 GORM 化（Raw=0） |
-| `internal/http/handler/mutations.go` | **重写** | 全部 CRUD 提取到 repo | ✅ 生产代码 `tx.Exec/tx.Raw` = 0 |
-| `internal/http/handler/handler.go` | 修改 | 更新 import、移除直接 SQL | ✅ (仅剩 nil check) |
-| `internal/http/handler/federation.go` | 修改 | GORM 替代 raw SQL | ✅ |
-| `internal/http/handler/control_plane.go` | 修改 | GORM 替代 raw SQL | ✅ |
-| `internal/http/handler/flow_policy.go` | 修改 | GORM 替代 raw SQL | ✅ |
-| `internal/http/handler/jobs.go` | 修改 | GORM 替代 raw SQL | ✅ (仅剩 nil check) |
-| `internal/ws/server.go` | 修改 | 更新 import | ✅ |
-| `internal/app/app.go` | 修改 | 更新 import | ✅ |
-| `internal/store/postgres/` | **删除** | 不再需要 | ✅ |
-| `internal/store/db.go` | **删除** | GORM 自动处理方言 | ✅ |
-| `internal/store/db_test.go` | **删除** | 旧重写层测试 | ✅ |
-| `internal/store/sqlite/sql/` | **删除** | AutoMigrate 替代 | ✅ |
-| `tests/contract/*.go` | 修改 | 适配 GORM | ✅ |
-| `AGENTS.md` (3处) | 更新 | 反映新架构 | ✅ |
-
-### 不需要修改的文件
-
-- `internal/http/router.go` — 路由不变
-- `internal/config/config.go` — 配置不变
-- `internal/auth/` — 认证不变
-- `internal/security/` — 加密不变
-- `internal/http/middleware/` — 中间件不变
-- `internal/http/response/` — 响应格式不变
-- `Dockerfile`, `Makefile` — 构建不变
-
----
-
-## 七、风险与缓解
-
-| 风险 | 可能性 | 影响 | 缓解措施 |
-|------|--------|------|----------|
-| GORM AutoMigrate SQLite/PG 行为差异 | 中 | 高 | 先写 Model 验证双数据库 AutoMigrate |
-| handler 中散落 raw SQL 遗漏 | 中 | 高 | 全局搜索 `.Exec(`, `.Query(`, `.QueryRow(` |
-| 事务语义变化 | 低 | 中 | 逐方法对比旧代码事务边界 |
-| 大量代码变更导致回归 | 高 | 高 | 分阶段提交，每阶段 `go test` |
-| GORM 性能开销 | 低 | 低 | 此场景下可忽略 |
-| SQLite "database locked" | 中 | 高 | `MaxOpenConns(1)` + WAL 模式 |
-
----
-
-## 八、迁移顺序原则
-
-1. **先 Model 后查询**：确保 AutoMigrate 双数据库通过
-2. **先 Repository 后 Handler**：Handler 依赖 Repository
-3. **先核心后边缘**：User → Node → Tunnel → Forward → 分组 → Federation
-4. **每步编译**：每完成一组方法确保 `go build ./...` 通过
-5. **最后清理**：全部重写完成后再删除旧代码和重命名 package
-
----
-
----
-
-## 九、2026-02-16 审计发现 + 2026-02-17 进展记录
-
-### 9.1 总体完成度
-
-| 指标 | 数值 |
-|------|------|
-| 阶段完成数 | 7/8 完成 (1, 2, 4, 5, 6, 7, 8)，1/8 部分完成 (3) |
-| GORM 链式调用 | ~226 处 |
-| Raw SQL 调用 (`.Exec`/`.Raw`+`.Scan`) | 4 处（生产代码） |
-| GORM 占比 | ~98% |
-| Handler 内 `tx.Exec`/`tx.Raw` | 0 处（生产代码） |
-| `last_insert_rowid()` 生产代码 | 0 处（已消灭） |
-
-### 9.2 ✅ P0：`last_insert_rowid()`（生产代码）已清零
-
-`last_insert_rowid()` 已从生产路径移除，创建主键统一改为 `Create(&model)` 自动回填 ID，
-确保 SQLite / PostgreSQL 双数据库行为一致。
-
-> 备注：测试代码中的历史 SQL 兼容性用例可在后续测试清理阶段单独处理。
-
-### 9.3 ✅ P1：`repository_mutations.go` 已全量 GORM 化
-
-本次已完成 `repository_mutations.go` 的集中清理：
-
-1. User / Node / Tunnel / Forward / UserTunnel / SpeedLimit / Group / Permission 全部 mutation 方法改为 GORM 链式调用。
-2. 事务内级联删除统一为 `tx.Where(...).Delete(&Model{})` 模式。
-3. `ON CONFLICT DO NOTHING` 统一替换为 `Clauses(clause.OnConflict{DoNothing: true})`。
-4. 保留原有调用语义（含 `sql.ErrNoRows` 行为兼容）并完成 `go build ./...` 验证。
-
-> 当前 `repository_mutations.go` 中生产代码 `.Raw(`/`.Exec(` 调用已降为 0。
-
-### 9.4 ✅ P2：Handler `mutations.go` 直接 SQL 已清零
-
-2026-02-17 本轮静态扫描结果：`mutations.go` **0 处** `tx.Exec`/`tx.Raw`（生产代码）。
-
-本轮完成下沉到 repo 的逻辑：
-
-- `tunnelUpdate` 中 `UPDATE tunnel` + `DELETE chain_tunnel`
-- `isRemoteNodeTx` 查询
-- `pickNodePortTx` 的 node/chain_tunnel/forward_port 端口占用查询
-- `replaceTunnelChainsTx` 的 chain_tunnel 写入
-- 分组成员同步（`tunnel_group_tunnel` / `user_group_user`）
-- 权限删除与 grant 回收（`group_permission` / `group_permission_grant` / `user_tunnel`）
-- federation 绑定替换（`federation_tunnel_binding`）
-
-### 9.5 ✅ P3（部分）：已移除 `QueryInt64List` / `QueryPairs` SQL 透传
-
-- `repository_mutations.go` 中两个 SQL 透传入口已删除。
-- Handler 已切换为语义化 repo 方法：
-  - `ListUserIDsByUserGroup`
-  - `ListTunnelIDsByTunnelGroup`
-  - `ListGroupPermissionPairsByUserGroup`
-  - `ListGroupPermissionPairsByTunnelGroup`
-
-### 9.6 ✅ P3：Import 函数已全部 GORM 化
-
-`repository.go` 中 Import 相关函数已完成迁移：
-
-- `importUsers`
-- `importNodes`
-- `importTunnels`（含 `chain_tunnel` 子项 upsert）
-- `importForwards`（含 `forward_port` 覆盖写入）
-- `importUserTunnels`
-- `importSpeedLimits`
-- `importTunnelGroups`
-- `importUserGroups`
-- `importPermissions`
-- `importConfigs`（原本已是 GORM）
-
-迁移后统一采用 `Clauses(clause.OnConflict{Columns: id/name, DoUpdates: ...}).Create(&model)` 模式，
-保留原 `ON CONFLICT ... DO UPDATE` 语义；Import 区段 `tx.Exec`/`tx.Raw` 已清零。
-
-### 9.7 ✅ P4：`h.repo.DB() == nil` 检查已清理
-
-`internal/http/handler/` 下已无 `h.repo.DB()` 直接访问；handler 仅通过语义化 repo 方法进行数据访问。
-
-### 9.8 ✅ P5：Repository 层 Raw 已收敛（仅保留 PG 序列修复 DDL）
-
-当前生产代码中 `.Raw()` 已清零；仅剩 `repository.go` 的 4 处 `Exec()`，全部位于 PG 序列修复 DDL：
-
-- `CREATE SEQUENCE IF NOT EXISTS ...`
-- `ALTER TABLE ... ALTER COLUMN id SET DEFAULT nextval(...)`
-- `ALTER SEQUENCE ... OWNED BY ...`
-- `SELECT setval(...::regclass, ?, ?)`
-
-以上 4 处属于数据库管理 DDL/序列同步语义，当前保留，不再继续向 GORM 链式调用替换。
-
-`repository_federation.go` / `repository_control.go` / `repository_flow.go` 已完成 GORM 化（Raw=0）。
-
----
-
-## 十、后续工作优先级
-
-| 优先级 | 任务 | 影响范围 | 工作量 |
-|--------|------|----------|--------|
-| **P0** | ✅ 已完成：生产代码中 `last_insert_rowid()` 清零（测试用例待单独清理） | 6 处生产（已完成） | 完成 |
-| **P1** | ✅ 已完成：`repository_mutations.go` ~40 方法改为 GORM 链式调用 | 659 行（已完成） | 完成 |
-| **P2** | ✅ 已完成：`mutations.go` handler 直接 SQL 全部提取为 repo 方法 | mutations.go | 完成 |
-| **P3** | ✅ 已完成：移除 `QueryInt64List`/`QueryPairs` 透传，切换语义化 repo 方法 | 2 个方法 + 调用方（已完成） | 完成 |
-| **P3** | ✅ 已完成：Import 函数 Raw SQL 改为 GORM `Clauses(clause.OnConflict{}).Create()` | 9 个函数（已完成） | 完成 |
-| **P4** | ✅ 已完成：`h.repo.DB() == nil` 检查清理完毕 | 4 处（已完成） | 完成 |
-| **P5** | ✅ 已完成：repo 查询层 Raw 清零，`repository.go` 保留 4 处 PG 序列修复 DDL `Exec`（设计保留） | repository.go | 完成 |
-| **P5** | ✅ 已完成：更新 MIGRATION_PLAN.md 状态标记与收尾记录 | 本文件 | 完成 |
-
-### 10.5 本轮执行记录（2026-02-17，P5 schema 收尾）
-
-1. 完成 `repository.go` schema 迁移段去 Raw：
-   - `normalizeStrategy` 改为 `Model(...).Where(...).Update(...)`
-   - `ensurePostgresIDDefaults`/`ensurePostgresTableIDDefault` 的 information_schema 查询改为 GORM `Table+Joins+Where+Scan`
-   - `syncPostgresTableIDSequence` 的 `MAX(id)` 查询改为 GORM `Table+Select+Scan`
-2. 复扫结果：
-   - `repository.go` `.Raw()` = 0
-   - repo 生产路径剩余 `.Exec()` = 4（全部为 PG 序列修复 DDL）
-3. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.6 本轮执行记录（2026-02-17，测试/构建收尾）
-
-1. 修复事务内 SQLite 连接阻塞（`MaxOpenConns(1)` 场景）：
-   - 新增 `GetNodeRecordTx` 并在 `prepareTunnelCreateState` 使用事务句柄读取节点。
-   - 新增 `GetNodeRemoteFieldsTx` 并在 `tunnelCreate` 事务内改用事务句柄读取远端字段。
-   - `applyFederationRuntime` 改为显式接收 `localDomain`，避免事务内再次走 `repo.GetConfigByName`。
-2. 修复 legacy SQLite schema 迁移契约：
-   - 新增 `prepareSQLiteLegacyColumns` 预补齐 `node/tunnel` 关键列。
-   - SQLite 模式下对已存在 `node/tunnel` 表跳过对应 `AutoMigrate` 重建流程，避免 `node__temp.name` 约束失败。
-3. 验证结果：
-   - `go test ./internal/http/handler/...` ✅
-   - `go test ./tests/contract/...` ✅
-   - `go test ./...` ✅
-   - `go build ./...` ✅
-   - `make build` ✅
-
-### 10.1 本轮执行记录（2026-02-17，P5 查询层）
-
-1. 完成 `repository_federation.go` 全量 GORM 化：
-   - `ListRemoteNodes` / `UpdateNodeRemoteConfig`
-   - `ListActiveBindingsForNode` / `GetNodeBasicInfo`
-   - `ListUsedPortsOnNode` / `ListTunnelIDsByNamePrefix` / `NextIndex`
-2. 完成 `repository_control.go` 全量 GORM 化：
-   - `ListForwardsByTunnel` / `ListForwardPorts` / `GetTunnelOutProtocol`
-   - `ResolveUserTunnelAndLimiter` / `ListChainNodesForTunnel`
-3. 完成 `repository_flow.go` 全量 GORM 化：
-   - `ListActiveForwardsByUser` / `ListActiveForwardsByUserTunnel`
-   - `GetForwardRecord` / `GetTunnelRecord`
-4. 复扫结果：
-   - `repository_federation.go` Raw/Exec = 0
-   - `repository_control.go` Raw/Exec = 0
-   - `repository_flow.go` Raw/Exec = 0
-   - repo 生产路径剩余 Raw/Exec = 9（全部在 `repository.go`）
-5. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.2 本轮执行记录（2026-02-17）
-
-1. 完成 P3 Import 9 个函数的 GORM 化（`repository.go`），并保持 `ON CONFLICT` 语义一致。
-2. 复扫确认：`repository.go` Import 区段 `tx.Exec`/`tx.Raw` 已清零。
-3. 验证结果：
-   - `go build ./...` ✅（使用显式 `GOMODCACHE/GOPATH/GOCACHE/HOME` 环境）
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.3 本轮执行记录（2026-02-17，P2 部分）
-
-1. 将 tunnel 更新/chain 重建路径 SQL 下沉到 `repository_mutations.go`：
-   - 新增 `UpdateTunnelTx`
-   - 新增 `DeleteChainTunnelsByTunnelTx`
-   - 新增 `CreateChainTunnelTx`
-2. 将 handler 内部 SQL helper 迁移到 repo：
-   - 新增 `IsRemoteNodeTx`
-   - 新增 `PickNodePortTx`
-   - `replaceTunnelChainsTx` 改为 handler 方法并改用 repo 调用，不再直接 SQL
-3. 复扫结果：`mutations.go` 直接 SQL 从 27 处降至 17 处。
-4. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
-### 10.4 本轮执行记录（2026-02-17，P2 收尾）
-
-1. 新增并落地事务语义化 repo 方法：
-   - `ReplaceTunnelGroupMembersTx` / `ReplaceUserGroupMembersTx`
-   - `ListUserIDsByUserGroupTx`
-   - `GetGroupPermissionPairByIDTx` / `DeleteGroupPermissionByIDTx`
-   - `RevokeGroupGrantsForRemovedUsersTx` / `RevokeGroupPermissionPairTx`
-   - `ReplaceFederationTunnelBindingsTx`
-2. 删除 handler 内 SQL helper（`queryInt64ListTx` / `revokeGroupGrantsForRemovedUsersTx` / `revokeGroupPermissionPairTx` / `replaceFederationTunnelBindingsTx`）。
-3. 复扫确认：`mutations.go` 生产路径 `tx.Exec`/`tx.Raw` = 0。
-4. 验证结果：
-   - `go build ./...` ✅
-   - `go test ./internal/store/repo/...` ✅
-
----
-
-*本文档将随迁移进展实时更新状态标记。*
-*最后审计时间：2026-02-17，审计工具：代码静态分析 (grep/AST) + go build/go test 验证*

go-backend/go.mod

@@ -12,14 +12,10 @@ require (
 
 require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
-	github.com/glebarez/go-sqlite v1.21.2 // indirect
-	github.com/glebarez/sqlite v1.11.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
-	github.com/jinzhu/inflection v1.0.0 // indirect
-	github.com/jinzhu/now v1.1.5 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/ncruces/go-strftime v0.1.9 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
@@ -28,8 +24,6 @@ require (
 	golang.org/x/sync v0.17.0 // indirect
 	golang.org/x/sys v0.33.0 // indirect
 	golang.org/x/text v0.29.0 // indirect
-	gorm.io/driver/postgres v1.6.0 // indirect
-	gorm.io/gorm v1.31.1 // indirect
 	modernc.org/libc v1.65.7 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect

go-backend/go.sum

@@ -3,10 +3,6 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/dustin/go-humanize v1.0.1 h1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=
 github.com/dustin/go-humanize v1.0.1/go.mod h1:Mu1zIs6XwVuF/gI1OepvI0qD18qycQx+mFykh5fBlto=
-github.com/glebarez/go-sqlite v1.21.2 h1:3a6LFC4sKahUunAmynQKLZceZCOzUthkRkEAl9gAXWo=
-github.com/glebarez/go-sqlite v1.21.2/go.mod h1:sfxdZyhQjTM2Wry3gVYWaW072Ri1WMdWJi0k6+3382k=
-github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw=
-github.com/glebarez/sqlite v1.11.0/go.mod h1:h8/o8j5wiAsqSPoWELDUdJXhjAhsVliSn7bWZjOhrgQ=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e h1:ijClszYn+mADRFY17kjQEVQ1XRhq2/JR1M3sGqeJoxs=
 github.com/google/pprof v0.0.0-20250317173921-a4b03ec1a45e/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
@@ -21,10 +17,6 @@ github.com/jackc/pgx/v5 v5.7.3 h1:PO1wNKj/bTAwxSJnO1Z4Ai8j4magtqg2SLNjEDzcXQo=
 github.com/jackc/pgx/v5 v5.7.3/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
-github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
-github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
-github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
-github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
 github.com/ncruces/go-strftime v0.1.9 h1:bY0MQC28UADQmHmaF5dgpLmImcShSi2kHU9XLdhx/f4=
@@ -57,10 +49,6 @@ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gorm.io/driver/postgres v1.6.0 h1:2dxzU8xJ+ivvqTRph34QX+WrRaJlmfyPqXmoGVjMBa4=
-gorm.io/driver/postgres v1.6.0/go.mod h1:vUw0mrGgrTK+uPHEhAdV4sfFELrByKVGnaVRkXDhtWo=
-gorm.io/gorm v1.31.1 h1:7CA8FTFz/gRfgqgpeKIBcervUn3xSyPUmr6B2WXJ7kg=
-gorm.io/gorm v1.31.1/go.mod h1:XyQVbO2k6YkOis7C2437jSit3SsDK72s7n7rsSHd+Gs=
 modernc.org/cc/v4 v4.26.1 h1:+X5NtzVBn0KgsBCBe+xkDC7twLb/jNVj9FPgiwSQO3s=
 modernc.org/cc/v4 v4.26.1/go.mod h1:uVtb5OGqUKpoLWhqwNQo/8LwvoiEBLvZXIQ/SmO6mL0=
 modernc.org/ccgo/v4 v4.28.0 h1:rjznn6WWehKq7dG4JtLRKxb52Ecv8OUGah8+Z/SfpNU=

go-backend/internal/app/app.go

@@ -10,30 +10,30 @@ import (
 	"go-backend/internal/config"
 	httpserver "go-backend/internal/http"
 	"go-backend/internal/http/handler"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 type App struct {
 	cfg    config.Config
 	server *http.Server
-	repo   *repo.Repository
+	repo   *sqlite.Repository
 	h      *handler.Handler
 }
 
 func New(cfg config.Config) (*App, error) {
 	var (
-		r   *repo.Repository
-		err error
+		repo *sqlite.Repository
+		err  error
 	)
 
 	switch strings.ToLower(strings.TrimSpace(cfg.DBType)) {
 	case "", "sqlite":
-		r, err = repo.Open(cfg.DBPath)
+		repo, err = sqlite.Open(cfg.DBPath)
 		if err != nil {
 			return nil, fmt.Errorf("open sqlite: %w", err)
 		}
 	case "postgres", "postgresql":
-		r, err = repo.OpenPostgres(cfg.DatabaseURL)
+		repo, err = sqlite.OpenPostgres(cfg.DatabaseURL)
 		if err != nil {
 			return nil, fmt.Errorf("open postgres: %w", err)
 		}
@@ -41,7 +41,7 @@ func New(cfg config.Config) (*App, error) {
 		return nil, fmt.Errorf("unsupported DB_TYPE %q", cfg.DBType)
 	}
 
-	h := handler.New(r, cfg.JWTSecret)
+	h := handler.New(repo, cfg.JWTSecret)
 	router := httpserver.NewRouter(h, cfg.JWTSecret)
 
 	s := &http.Server{
@@ -49,11 +49,11 @@ func New(cfg config.Config) (*App, error) {
 		Handler:           router,
 		ReadTimeout:       30 * time.Second,
 		ReadHeaderTimeout: 5 * time.Second,
-		WriteTimeout:      2 * time.Minute,
+		WriteTimeout:      30 * time.Second,
 		IdleTimeout:       60 * time.Second,
 	}
 
-	return &App{cfg: cfg, server: s, repo: r, h: h}, nil
+	return &App{cfg: cfg, server: s, repo: repo, h: h}, nil
 }
 
 func (a *App) Run() error {

go-backend/internal/health/checker.go

@@ -1,360 +0,0 @@
-package health
-
-import (
-	"context"
-	"errors"
-	"fmt"
-	"log"
-	"net"
-	"strings"
-	"sync"
-	"time"
-
-	"go-backend/internal/monitoring"
-	"go-backend/internal/store/model"
-	"go-backend/internal/store/repo"
-	"go-backend/internal/ws"
-)
-
-type nodeCommander interface {
-	SendCommand(nodeID int64, cmdType string, data interface{}, timeout time.Duration) (ws.CommandResult, error)
-}
-
-type Checker struct {
-	repo      *repo.Repository
-	commander nodeCommander
-	lastRun   map[int64]int64
-	inFlight  map[int64]struct{}
-
-	mu     sync.RWMutex
-	cancel context.CancelFunc
-	wg     sync.WaitGroup
-}
-
-func NewChecker(repo *repo.Repository, commander nodeCommander) *Checker {
-	return &Checker{
-		repo:      repo,
-		commander: commander,
-		lastRun:   make(map[int64]int64),
-		inFlight:  make(map[int64]struct{}),
-	}
-}
-
-func (c *Checker) Start(ctx context.Context) {
-	c.mu.Lock()
-	ctx, cancel := context.WithCancel(ctx)
-	c.cancel = cancel
-	c.mu.Unlock()
-
-	c.runChecks(ctx)
-
-	for {
-		limits := c.loadServiceMonitorLimits()
-		scanInterval := time.Duration(limits.CheckerScanIntervalSec) * time.Second
-		if scanInterval <= 0 {
-			scanInterval = 30 * time.Second
-		}
-
-		timer := time.NewTimer(scanInterval)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			return
-		case <-timer.C:
-			c.runChecks(ctx)
-		}
-	}
-}
-
-func (c *Checker) Stop() {
-	c.mu.Lock()
-	if c.cancel != nil {
-		c.cancel()
-	}
-	c.mu.Unlock()
-	c.wg.Wait()
-}
-
-func (c *Checker) RunOnce(m *model.ServiceMonitor) (*model.ServiceMonitorResult, error) {
-	if c == nil {
-		return nil, errors.New("checker not initialized")
-	}
-	if m == nil {
-		return nil, errors.New("monitor is nil")
-	}
-	limits := c.loadServiceMonitorLimits()
-	return c.executeCheck(m, time.Now().UnixMilli(), limits), nil
-}
-
-func (c *Checker) runChecks(ctx context.Context) {
-	if c == nil || c.repo == nil {
-		return
-	}
-
-	limits := c.loadServiceMonitorLimits()
-	monitors, err := c.repo.ListEnabledServiceMonitors()
-	if err != nil {
-		log.Printf("service monitor scheduler failed op=list_enabled err=%v", err)
-		return
-	}
-	if len(monitors) == 0 {
-		return
-	}
-
-	// Use persisted result timestamps to avoid restart bursts.
-	latest, err := c.repo.GetLatestServiceMonitorResults()
-	if err != nil {
-		log.Printf("service monitor scheduler failed op=get_latest_results err=%v", err)
-		latest = nil
-	}
-	persistedLast := make(map[int64]int64, len(latest))
-	for _, r := range latest {
-		if r.MonitorID <= 0 || r.Timestamp <= 0 {
-			continue
-		}
-		persistedLast[r.MonitorID] = r.Timestamp
-	}
-
-	now := time.Now().UnixMilli()
-	due := make([]model.ServiceMonitor, 0, len(monitors))
-	for _, m := range monitors {
-		select {
-		case <-ctx.Done():
-			return
-		default:
-		}
-
-		intervalSec := m.IntervalSec
-		if intervalSec <= 0 {
-			intervalSec = limits.DefaultIntervalSec
-		}
-		if intervalSec < limits.MinIntervalSec {
-			intervalSec = limits.MinIntervalSec
-		}
-		intervalMs := int64(intervalSec) * 1000
-
-		c.mu.Lock()
-		if _, ok := c.inFlight[m.ID]; ok {
-			c.mu.Unlock()
-			continue
-		}
-
-		lastSeen := persistedLast[m.ID]
-		if v := c.lastRun[m.ID]; v > lastSeen {
-			lastSeen = v
-		}
-		if lastSeen > 0 && intervalMs > 0 && now-lastSeen < intervalMs {
-			c.mu.Unlock()
-			continue
-		}
-
-		c.inFlight[m.ID] = struct{}{}
-		// Use now as a best-effort guard against overlapping scans; the final
-		// timestamp is updated again when the result is persisted.
-		c.lastRun[m.ID] = now
-		c.mu.Unlock()
-
-		due = append(due, m)
-	}
-	if len(due) == 0 {
-		return
-	}
-
-	workerLimit := limits.WorkerLimit
-	if workerLimit <= 0 {
-		workerLimit = 1
-	}
-	if workerLimit > len(due) {
-		workerLimit = len(due)
-	}
-
-	jobs := make(chan model.ServiceMonitor, len(due))
-	for _, m := range due {
-		jobs <- m
-	}
-	close(jobs)
-
-	for i := 0; i < workerLimit; i++ {
-		c.wg.Add(1)
-		go func() {
-			defer c.wg.Done()
-			for {
-				select {
-				case <-ctx.Done():
-					return
-				case m, ok := <-jobs:
-					if !ok {
-						return
-					}
-					ts := time.Now().UnixMilli()
-					result := c.executeCheck(&m, ts, limits)
-					if err := c.repo.InsertServiceMonitorResult(result); err != nil {
-						log.Printf("monitoring write failed op=service_monitor_result.insert monitor_id=%d err=%v", result.MonitorID, err)
-					}
-
-					c.mu.Lock()
-					c.lastRun[m.ID] = result.Timestamp
-					delete(c.inFlight, m.ID)
-					c.mu.Unlock()
-				}
-			}
-		}()
-	}
-}
-
-func (c *Checker) executeCheck(m *model.ServiceMonitor, timestamp int64, limits monitoring.ServiceMonitorLimits) *model.ServiceMonitorResult {
-	result := &model.ServiceMonitorResult{
-		MonitorID: m.ID,
-		NodeID:    m.NodeID,
-		Timestamp: timestamp,
-	}
-
-	timeoutSec := m.TimeoutSec
-	if timeoutSec <= 0 {
-		timeoutSec = limits.DefaultTimeoutSec
-	}
-	if timeoutSec < limits.MinTimeoutSec {
-		timeoutSec = limits.MinTimeoutSec
-	}
-	if timeoutSec > limits.MaxTimeoutSec {
-		timeoutSec = limits.MaxTimeoutSec
-	}
-
-	timeout := time.Duration(timeoutSec) * time.Second
-
-	// When nodeId is set, run checks on the specified node.
-	if m.NodeID > 0 {
-		c.checkOnNode(m, timeoutSec, timeout, result)
-		return result
-	}
-
-	switch strings.ToLower(strings.TrimSpace(m.Type)) {
-	case "tcp":
-		c.checkTCP(m.Target, timeout, result)
-	case "icmp":
-		result.Success = 0
-		result.ErrorMessage = "ICMP 监控必须指定执行节点"
-	default:
-		result.Success = 0
-		result.ErrorMessage = fmt.Sprintf("不支持的检查类型: %s", m.Type)
-	}
-
-	return result
-}
-
-func (c *Checker) loadServiceMonitorLimits() monitoring.ServiceMonitorLimits {
-	defaults := monitoring.DefaultServiceMonitorLimits()
-	if c == nil || c.repo == nil {
-		return defaults
-	}
-	cfg, err := c.repo.GetConfigsByNames([]string{
-		monitoring.ConfigServiceMonitorCheckerScanIntervalSec,
-		monitoring.ConfigServiceMonitorWorkerLimit,
-		monitoring.ConfigServiceMonitorMinIntervalSec,
-		monitoring.ConfigServiceMonitorDefaultIntervalSec,
-		monitoring.ConfigServiceMonitorMinTimeoutSec,
-		monitoring.ConfigServiceMonitorDefaultTimeoutSec,
-		monitoring.ConfigServiceMonitorMaxTimeoutSec,
-	})
-	if err != nil {
-		return defaults
-	}
-	return monitoring.ServiceMonitorLimitsFromConfigMap(cfg)
-}
-
-type serviceMonitorCheckRequest struct {
-	MonitorID  int64  `json:"monitorId"`
-	Type       string `json:"type"`
-	Target     string `json:"target"`
-	TimeoutSec int    `json:"timeoutSec"`
-}
-
-func (c *Checker) checkOnNode(m *model.ServiceMonitor, timeoutSec int, timeout time.Duration, result *model.ServiceMonitorResult) {
-	if c == nil || m == nil || result == nil {
-		return
-	}
-	if c.commander == nil {
-		result.Success = 0
-		result.ErrorMessage = "节点检查不可用"
-		return
-	}
-
-	checkType := strings.ToLower(strings.TrimSpace(m.Type))
-	if checkType != "tcp" && checkType != "icmp" {
-		result.Success = 0
-		result.ErrorMessage = fmt.Sprintf("不支持的检查类型: %s", m.Type)
-		return
-	}
-	if strings.TrimSpace(m.Target) == "" {
-		result.Success = 0
-		result.ErrorMessage = "检查目标为空"
-		return
-	}
-
-	req := serviceMonitorCheckRequest{
-		MonitorID:  m.ID,
-		Type:       checkType,
-		Target:     m.Target,
-		TimeoutSec: timeoutSec,
-	}
-
-	cmdTimeout := timeout
-	if cmdTimeout < 2*time.Second {
-		cmdTimeout = 2 * time.Second
-	}
-	cmdTimeout = cmdTimeout + 2*time.Second
-
-	cmdRes, err := c.commander.SendCommand(m.NodeID, "ServiceMonitorCheck", req, cmdTimeout)
-	if err != nil {
-		result.Success = 0
-		result.ErrorMessage = err.Error()
-		return
-	}
-	if cmdRes.Data == nil {
-		result.Success = 0
-		result.ErrorMessage = "节点返回为空"
-		return
-	}
-
-	if v, ok := cmdRes.Data["success"]; ok {
-		if b, ok := v.(bool); ok {
-			if b {
-				result.Success = 1
-			} else {
-				result.Success = 0
-			}
-		}
-	}
-	if v, ok := cmdRes.Data["latencyMs"]; ok {
-		if f, ok := v.(float64); ok {
-			result.LatencyMs = f
-		}
-	}
-	if v, ok := cmdRes.Data["statusCode"]; ok {
-		if f, ok := v.(float64); ok {
-			result.StatusCode = int(f)
-		}
-	}
-	if v, ok := cmdRes.Data["errorMessage"]; ok {
-		if s, ok := v.(string); ok {
-			result.ErrorMessage = s
-		}
-	}
-}
-
-func (c *Checker) checkTCP(target string, timeout time.Duration, result *model.ServiceMonitorResult) {
-	start := time.Now()
-
-	conn, err := net.DialTimeout("tcp", target, timeout)
-	latency := time.Since(start)
-
-	result.LatencyMs = float64(latency.Milliseconds())
-
-	if err != nil {
-		result.Success = 0
-		result.ErrorMessage = err.Error()
-		return
-	}
-	_ = conn.Close()
-	result.Success = 1
-}

go-backend/internal/health/checker_test.go

@@ -1,477 +0,0 @@
-package health
-
-import (
-	"context"
-	"net"
-	"testing"
-	"time"
-
-	"go-backend/internal/monitoring"
-	"go-backend/internal/store/model"
-	"go-backend/internal/store/repo"
-	"go-backend/internal/ws"
-)
-
-type fakeCommander struct {
-	lastNodeID int64
-	lastType   string
-	lastData   interface{}
-	res        ws.CommandResult
-	err        error
-}
-
-type delayedCommander struct {
-	delayByMonitorID map[int64]time.Duration
-}
-
-func (d *delayedCommander) SendCommand(nodeID int64, cmdType string, data interface{}, _ time.Duration) (ws.CommandResult, error) {
-	_ = nodeID
-	_ = cmdType
-	if req, ok := data.(serviceMonitorCheckRequest); ok {
-		if delay := d.delayByMonitorID[req.MonitorID]; delay > 0 {
-			time.Sleep(delay)
-		}
-	}
-	return ws.CommandResult{
-		Success: true,
-		Data: map[string]interface{}{
-			"success":   true,
-			"latencyMs": float64(1),
-		},
-	}, nil
-}
-
-func (f *fakeCommander) SendCommand(nodeID int64, cmdType string, data interface{}, _ time.Duration) (ws.CommandResult, error) {
-	f.lastNodeID = nodeID
-	f.lastType = cmdType
-	f.lastData = data
-	return f.res, f.err
-}
-
-func TestTCPHealthCheckViaMonitor(t *testing.T) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	defer listener.Close()
-	addr := listener.Addr().String()
-
-	go func() {
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-			conn.Close()
-		}
-	}()
-
-	t.Run("successful tcp check", func(t *testing.T) {
-		checker := NewChecker(nil, nil)
-		limits := checker.loadServiceMonitorLimits()
-		now := time.Now().UnixMilli()
-		monitor := &model.ServiceMonitor{
-			Type:       "tcp",
-			Target:     addr,
-			TimeoutSec: 5,
-		}
-		result := checker.executeCheck(monitor, now, limits)
-		if result.Success != 1 {
-			t.Fatalf("expected success, got error: %s", result.ErrorMessage)
-		}
-		if result.LatencyMs < 0 {
-			t.Fatalf("expected non-negative latency, got %f", result.LatencyMs)
-		}
-	})
-
-	t.Run("failed tcp check - connection refused", func(t *testing.T) {
-		checker := NewChecker(nil, nil)
-		limits := checker.loadServiceMonitorLimits()
-		now := time.Now().UnixMilli()
-		monitor := &model.ServiceMonitor{
-			Type:       "tcp",
-			Target:     "127.0.0.1:1",
-			TimeoutSec: 1,
-		}
-		result := checker.executeCheck(monitor, now, limits)
-		if result.Success == 1 {
-			t.Fatalf("expected failure for connection refused")
-		}
-		if result.ErrorMessage == "" {
-			t.Fatalf("expected error message")
-		}
-	})
-}
-
-func TestCheckerRunChecks(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	defer listener.Close()
-	tcpAddr := listener.Addr().String()
-
-	go func() {
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-			conn.Close()
-		}
-	}()
-
-	now := time.Now().UnixMilli()
-
-	monitors := []*model.ServiceMonitor{
-		{
-			Name:        "TCP Monitor",
-			Type:        "tcp",
-			Target:      tcpAddr,
-			IntervalSec: 60,
-			TimeoutSec:  5,
-			NodeID:      0,
-			Enabled:     1,
-			CreatedTime: now,
-			UpdatedTime: now,
-		},
-		{
-			Name:        "TCP Monitor 2",
-			Type:        "tcp",
-			Target:      tcpAddr,
-			IntervalSec: 60,
-			TimeoutSec:  5,
-			NodeID:      0,
-			Enabled:     1,
-			CreatedTime: now,
-			UpdatedTime: now,
-		},
-		{
-			Name:        "Disabled Monitor",
-			Type:        "tcp",
-			Target:      "127.0.0.1:1",
-			IntervalSec: 60,
-			TimeoutSec:  5,
-			NodeID:      0,
-			Enabled:     0,
-			CreatedTime: now,
-			UpdatedTime: now,
-		},
-	}
-
-	for _, m := range monitors {
-		if err := r.CreateServiceMonitor(m); err != nil {
-			t.Fatalf("create monitor: %v", err)
-		}
-	}
-
-	monitors[2].Enabled = 0
-	if err := r.UpdateServiceMonitor(monitors[2]); err != nil {
-		t.Fatalf("update disabled monitor: %v", err)
-	}
-
-	enabledMonitors, err := r.ListEnabledServiceMonitors()
-	if err != nil {
-		t.Fatalf("list enabled monitors: %v", err)
-	}
-	if len(enabledMonitors) != 2 {
-		t.Fatalf("expected 2 enabled monitors, got %d", len(enabledMonitors))
-	}
-
-	checker := NewChecker(r, nil)
-
-	ctx, cancel := context.WithTimeout(context.Background(), 2*time.Second)
-	defer cancel()
-
-	go checker.Start(ctx)
-	time.Sleep(500 * time.Millisecond)
-
-	results, err := r.GetServiceMonitorResults(monitors[0].ID, 10)
-	if err != nil {
-		t.Fatalf("get tcp results: %v", err)
-	}
-	if len(results) == 0 {
-		t.Fatalf("expected at least one result for tcp monitor")
-	}
-	for _, res := range results {
-		if res.Success != 1 {
-			t.Fatalf("expected success for tcp monitor, got failure: %s", res.ErrorMessage)
-		}
-	}
-
-	results2, err := r.GetServiceMonitorResults(monitors[1].ID, 10)
-	if err != nil {
-		t.Fatalf("get tcp results 2: %v", err)
-	}
-	if len(results2) == 0 {
-		t.Fatalf("expected at least one result for tcp monitor 2")
-	}
-	for _, res := range results2 {
-		if res.Success != 1 {
-			t.Fatalf("expected success for tcp monitor 2, got failure: %s", res.ErrorMessage)
-		}
-	}
-
-	disabledResults, err := r.GetServiceMonitorResults(monitors[2].ID, 10)
-	if err != nil {
-		t.Fatalf("get disabled results: %v", err)
-	}
-	if len(disabledResults) != 0 {
-		t.Fatalf("expected no results for disabled monitor, got %d", len(disabledResults))
-	}
-}
-
-func TestCheckerUnsupportedType(t *testing.T) {
-	checker := NewChecker(nil, nil)
-	limits := checker.loadServiceMonitorLimits()
-	now := time.Now().UnixMilli()
-	monitor := &model.ServiceMonitor{
-		Type:       "http",
-		Target:     "https://example.com",
-		TimeoutSec: 5,
-	}
-	result := checker.executeCheck(monitor, now, limits)
-	if result.Success == 1 {
-		t.Fatalf("expected failure for unsupported type")
-	}
-	if result.ErrorMessage == "" {
-		t.Fatalf("expected error message for unsupported type")
-	}
-}
-
-func TestCheckerDefaultTimeout(t *testing.T) {
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	defer listener.Close()
-	addr := listener.Addr().String()
-
-	go func() {
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-			conn.Close()
-		}
-	}()
-
-	checker := NewChecker(nil, nil)
-	limits := checker.loadServiceMonitorLimits()
-	now := time.Now().UnixMilli()
-	monitor := &model.ServiceMonitor{
-		Type:       "tcp",
-		Target:     addr,
-		TimeoutSec: 0,
-	}
-	result := checker.executeCheck(monitor, now, limits)
-	if result.Success != 1 {
-		t.Fatalf("expected success with default timeout, got error: %s", result.ErrorMessage)
-	}
-}
-
-func TestCheckerStop(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	listener, err := net.Listen("tcp", "127.0.0.1:0")
-	if err != nil {
-		t.Fatalf("listen: %v", err)
-	}
-	defer listener.Close()
-
-	go func() {
-		for {
-			conn, err := listener.Accept()
-			if err != nil {
-				return
-			}
-			conn.Close()
-		}
-	}()
-
-	now := time.Now().UnixMilli()
-	monitor := &model.ServiceMonitor{
-		Name:        "Test Monitor",
-		Type:        "tcp",
-		Target:      listener.Addr().String(),
-		IntervalSec: 60,
-		TimeoutSec:  5,
-		NodeID:      0,
-		Enabled:     1,
-		CreatedTime: now,
-		UpdatedTime: now,
-	}
-	if err := r.CreateServiceMonitor(monitor); err != nil {
-		t.Fatalf("create monitor: %v", err)
-	}
-
-	checker := NewChecker(r, nil)
-
-	ctx := context.Background()
-	go checker.Start(ctx)
-
-	time.Sleep(100 * time.Millisecond)
-	checker.Stop()
-
-	results, err := r.GetServiceMonitorResults(monitor.ID, 10)
-	if err != nil {
-		t.Fatalf("get results: %v", err)
-	}
-	if len(results) == 0 {
-		t.Fatalf("expected at least one result before stop")
-	}
-}
-
-func TestCheckerRunsOnNodeWhenNodeIDSet(t *testing.T) {
-	fake := &fakeCommander{
-		res: ws.CommandResult{
-			Success: true,
-			Data: map[string]interface{}{
-				"success":      false,
-				"latencyMs":    float64(12),
-				"errorMessage": "unreachable",
-			},
-		},
-	}
-	checker := NewChecker(nil, fake)
-	limits := checker.loadServiceMonitorLimits()
-	now := time.Now().UnixMilli()
-	monitor := &model.ServiceMonitor{
-		ID:         99,
-		Type:       "icmp",
-		Target:     "8.8.8.8",
-		TimeoutSec: 2,
-		NodeID:     123,
-	}
-	res := checker.executeCheck(monitor, now, limits)
-	if fake.lastNodeID != 123 {
-		t.Fatalf("expected command to be sent to node 123, got %d", fake.lastNodeID)
-	}
-	if fake.lastType != "ServiceMonitorCheck" {
-		t.Fatalf("expected ServiceMonitorCheck command, got %s", fake.lastType)
-	}
-	if res.Success != 0 {
-		t.Fatalf("expected failed result from node check")
-	}
-	if res.ErrorMessage != "unreachable" {
-		t.Fatalf("expected errorMessage unreachable, got %q", res.ErrorMessage)
-	}
-}
-
-func TestCheckerDoesNotBurstOnRestartWhenRecentResultsExist(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	monitor := &model.ServiceMonitor{
-		Name:        "recent-monitor",
-		Type:        "tcp",
-		Target:      "127.0.0.1:1",
-		IntervalSec: 60,
-		TimeoutSec:  1,
-		NodeID:      0,
-		Enabled:     1,
-		CreatedTime: now,
-		UpdatedTime: now,
-	}
-	if err := r.CreateServiceMonitor(monitor); err != nil {
-		t.Fatalf("create monitor: %v", err)
-	}
-	if err := r.InsertServiceMonitorResult(&model.ServiceMonitorResult{
-		MonitorID: monitor.ID,
-		NodeID:    0,
-		Timestamp: now - 10_000,
-		Success:   1,
-	}); err != nil {
-		t.Fatalf("seed recent result: %v", err)
-	}
-
-	checker := NewChecker(r, nil)
-	ctx, cancel := context.WithCancel(context.Background())
-	go checker.Start(ctx)
-	// Give the initial scan a chance to run.
-	time.Sleep(200 * time.Millisecond)
-	cancel()
-	checker.Stop()
-
-	results, err := r.GetServiceMonitorResults(monitor.ID, 10)
-	if err != nil {
-		t.Fatalf("get results: %v", err)
-	}
-	if len(results) != 1 {
-		t.Fatalf("expected no immediate rerun (1 result), got %d", len(results))
-	}
-}
-
-func TestCheckerConcurrencyPreventsSlowMonitorBlockingOthers(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	// Force worker limit to at least 2 for this test.
-	_ = r.UpsertConfig(monitoring.ConfigServiceMonitorWorkerLimit, "2", now)
-
-	slow := &model.ServiceMonitor{
-		Name:        "slow",
-		Type:        "icmp",
-		Target:      "8.8.8.8",
-		IntervalSec: 60,
-		TimeoutSec:  1,
-		NodeID:      123,
-		Enabled:     1,
-		CreatedTime: now,
-		UpdatedTime: now,
-	}
-	if err := r.CreateServiceMonitor(slow); err != nil {
-		t.Fatalf("create slow monitor: %v", err)
-	}
-	fast := &model.ServiceMonitor{
-		Name:        "fast",
-		Type:        "icmp",
-		Target:      "1.1.1.1",
-		IntervalSec: 60,
-		TimeoutSec:  1,
-		NodeID:      123,
-		Enabled:     1,
-		CreatedTime: now,
-		UpdatedTime: now,
-	}
-	if err := r.CreateServiceMonitor(fast); err != nil {
-		t.Fatalf("create fast monitor: %v", err)
-	}
-
-	cmd := &delayedCommander{delayByMonitorID: map[int64]time.Duration{slow.ID: 800 * time.Millisecond}}
-	checker := NewChecker(r, cmd)
-	ctx, cancel := context.WithCancel(context.Background())
-	go checker.Start(ctx)
-
-	// Fast monitor should complete even while slow one is still running.
-	time.Sleep(250 * time.Millisecond)
-	results, err := r.GetServiceMonitorResults(fast.ID, 10)
-	if err != nil {
-		t.Fatalf("get fast results: %v", err)
-	}
-	if len(results) == 0 {
-		t.Fatalf("expected fast monitor to have results without waiting for slow")
-	}
-
-	cancel()
-	checker.Stop()
-}

go-backend/internal/http/handler/AGENTS.md

@@ -1,13 +1,10 @@
 # BACKEND HTTP HANDLER KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
+**Generated:** Sun Feb 15 2026
 
 ## OVERVIEW
 HTTP request handlers for FLVX Admin API. Core business logic layer.
-**Stack:** Go 1.24, net/http, GORM via Repository pattern.
+**Stack:** Go 1.23, net/http, raw SQL (no ORM).
 
 ## STRUCTURE
 ```
@@ -17,7 +14,7 @@ handler/
 ├── federation.go     # Federation/cluster sync API
 ├── flow_policy.go    # Traffic policy API
 ├── jobs.go           # Background job management (sync, cleanup)
-├── mutations.go      # CRUD for users, tunnels, forwards (~3700 LOC)
+├── mutations.go      # CRUD for users, tunnels, forwards (largest: 100k+ LOC)
 └── upgrade.go        # System upgrade API
 ```
 
@@ -29,17 +26,15 @@ handler/
 | **Federation Sync** | `federation.go` | Panel-to-panel sync |
 | **Traffic Policies** | `flow_policy.go` | Flow limiting, quota management |
 | **Background Jobs** | `jobs.go` | Scheduled sync/cleanup tasks |
-| **Node Control** | `control_plane.go` | Node add/delete/list operations |
 
 ## CONVENTIONS
-- Inherits from parent: GORM via Repository pattern, JWT in Authorization header.
-- Large files expected (`mutations.go` ~3700 LOC - central mutation hub).
-- Uses `repo.Repository` for DB access via `h.repo.XXX()` methods.
-- Handlers never call `repo.DB()` directly — all queries go through Repository methods.
+- Inherits from parent: raw SQL, no ORM, JWT in Authorization header.
+- Large files expected (`mutations.go` 3716 LOC - central mutation hub).
+- Uses `sqlite.Repository` for DB access via `repo.XXX()` methods.
 - Domain-driven file split: one file per functional area (federation, jobs, etc.).
 
 ## ANTI-PATTERNS
-- Do NOT let handlers call `repo.DB()` directly — add a Repository method instead.
+- Do NOT add ORM here - uses raw SQL throughout.
 - Do NOT change handler signatures without updating router.go.
 
 ## COMMANDS

go-backend/internal/http/handler/control_plane_test.go

@@ -1,11 +1,8 @@
 package handler
 
 import (
-	"errors"
 	"reflect"
 	"testing"
-
-	"go-backend/internal/store/repo"
 )
 
 func TestBuildForwardControlServiceNamesPauseResume(t *testing.T) {
@@ -45,20 +42,6 @@ func TestBuildForwardServiceBaseCandidatesWithZeroPreferred(t *testing.T) {
 	}
 }
 
-func TestBuildForwardServiceBaseWithResolvedUserTunnel(t *testing.T) {
-	got := buildForwardServiceBaseWithResolvedUserTunnel(12, 34, 56)
-	if got != "12_34_56" {
-		t.Fatalf("expected 12_34_56, got %s", got)
-	}
-}
-
-func TestBuildForwardServiceBaseWithResolvedUserTunnelFallbackToZero(t *testing.T) {
-	got := buildForwardServiceBaseWithResolvedUserTunnel(12, 34, 0)
-	if got != "12_34_0" {
-		t.Fatalf("expected 12_34_0, got %s", got)
-	}
-}
-
 func TestShouldTryLegacySingleService(t *testing.T) {
 	if !shouldTryLegacySingleService("PauseService") {
 		t.Fatalf("PauseService should require legacy fallback")
@@ -70,418 +53,3 @@ func TestShouldTryLegacySingleService(t *testing.T) {
 		t.Fatalf("DeleteService should not require legacy fallback")
 	}
 }
-
-func TestShouldSelfHealForwardServiceControl(t *testing.T) {
-	if !shouldSelfHealForwardServiceControl("PauseService") {
-		t.Fatalf("PauseService should trigger self-heal")
-	}
-	if !shouldSelfHealForwardServiceControl(" resumeService ") {
-		t.Fatalf("ResumeService should trigger self-heal")
-	}
-	if shouldSelfHealForwardServiceControl("DeleteService") {
-		t.Fatalf("DeleteService should not trigger self-heal")
-	}
-}
-
-func TestControlForwardServiceCommandHandledOnKnownVariant(t *testing.T) {
-	bases := []string{"12_34_56"}
-	called := make([]string, 0)
-	handled, lastNotFoundErr, err := controlForwardServiceCommand(bases, "PauseService", func(name string) error {
-		called = append(called, name)
-		if name == "12_34_56_udp" {
-			return nil
-		}
-		return errors.New("service " + name + " not found")
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if !handled {
-		t.Fatalf("expected handled=true")
-	}
-	if lastNotFoundErr != nil {
-		t.Fatalf("expected lastNotFoundErr=nil when handled")
-	}
-	wantCalls := []string{"12_34_56_tcp", "12_34_56_udp", "12_34_56"}
-	if !reflect.DeepEqual(called, wantCalls) {
-		t.Fatalf("expected calls %v, got %v", wantCalls, called)
-	}
-}
-
-func TestControlForwardServiceCommandReturnsLastNotFoundWhenAllMissing(t *testing.T) {
-	bases := []string{"12_34_56"}
-	handled, lastNotFoundErr, err := controlForwardServiceCommand(bases, "PauseService", func(name string) error {
-		return errors.New("service " + name + " not found")
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if handled {
-		t.Fatalf("expected handled=false")
-	}
-	if lastNotFoundErr == nil {
-		t.Fatalf("expected lastNotFoundErr when all variants are missing")
-	}
-}
-
-func TestDeleteForwardServiceCandidatesSkipsNotFoundUntilLegacyMatch(t *testing.T) {
-	bases := []string{"12_34_56", "12_34_0"}
-	called := make([]string, 0)
-	err := deleteForwardServiceCandidates(bases, func(name string) error {
-		called = append(called, name)
-		if name == "12_34_0" {
-			return nil
-		}
-		return errors.New("service " + name + " not found")
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	wantCalls := []string{"12_34_56_tcp", "12_34_56_udp", "12_34_56", "12_34_0_tcp", "12_34_0_udp", "12_34_0"}
-	if !reflect.DeepEqual(called, wantCalls) {
-		t.Fatalf("expected calls %v, got %v", wantCalls, called)
-	}
-}
-
-func TestDeleteForwardServiceCandidatesTreatsAllMissingAsSuccess(t *testing.T) {
-	bases := []string{"12_34_56", "12_34_0"}
-	err := deleteForwardServiceCandidates(bases, func(name string) error {
-		return errors.New("service " + name + " not found")
-	})
-	if err != nil {
-		t.Fatalf("all-missing delete should be tolerated, got %v", err)
-	}
-}
-
-func TestForwardServiceBaseCandidatesIncludesResolvedAndLegacyZero(t *testing.T) {
-	bases := buildForwardServiceBaseCandidates(46, 9, 123, []int64{123, 77, 0})
-	want := []string{"46_9_123", "46_9_77", "46_9_0"}
-	if !reflect.DeepEqual(bases, want) {
-		t.Fatalf("expected %v, got %v", want, bases)
-	}
-}
-
-func TestDeleteForwardServiceBasesOnNodeRetriesLegacyZeroResidue(t *testing.T) {
-	bases := []string{"46_9_123", "46_9_0"}
-	called := make([]string, 0)
-	err := deleteForwardServiceCandidates(bases, func(name string) error {
-		called = append(called, name)
-		if name == "46_9_0_tcp" || name == "46_9_0_udp" {
-			return nil
-		}
-		return errors.New("service " + name + " not found")
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	want := []string{"46_9_123_tcp", "46_9_123_udp", "46_9_123", "46_9_0_tcp", "46_9_0_udp", "46_9_0"}
-	if !reflect.DeepEqual(called, want) {
-		t.Fatalf("expected calls %v, got %v", want, called)
-	}
-}
-
-func TestDeleteForwardServiceCandidatesDeletesAllMatchingVariants(t *testing.T) {
-	bases := []string{"57_7_7", "57_7_0"}
-	called := make([]string, 0)
-	err := deleteForwardServiceCandidates(bases, func(name string) error {
-		called = append(called, name)
-		switch name {
-		case "57_7_7_tcp", "57_7_7_udp", "57_7_0_tcp", "57_7_0_udp":
-			return nil
-		default:
-			return errors.New("service " + name + " not found")
-		}
-	})
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	want := []string{"57_7_7_tcp", "57_7_7_udp", "57_7_7", "57_7_0_tcp", "57_7_0_udp", "57_7_0"}
-	if !reflect.DeepEqual(called, want) {
-		t.Fatalf("expected calls %v, got %v", want, called)
-	}
-}
-
-func TestValidateForwardPortAvailabilityRejectsOtherForwardOccupancy(t *testing.T) {
-	h := &Handler{repo: nil}
-	node := &nodeRecord{ID: 9, Name: "test-node"}
-	_ = h
-	_ = node
-
-	rawRepo, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	h = &Handler{repo: rawRepo}
-	if err := rawRepo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(1, 9, 2000)`).Error; err != nil {
-		t.Fatalf("insert forward port: %v", err)
-	}
-
-	err = h.validateForwardPortAvailability(&nodeRecord{ID: 9, Name: "test-node"}, 2000, 2)
-	if err == nil {
-		t.Fatalf("expected occupancy error")
-	}
-	if err.Error() != "节点 test-node 端口 2000 已被其他转发占用" {
-		t.Fatalf("unexpected error: %v", err)
-	}
-
-	err = h.validateForwardPortAvailability(&nodeRecord{ID: 9, Name: "test-node"}, 2000, 1)
-	if err != nil {
-		t.Fatalf("same forward should be allowed, got %v", err)
-	}
-}
-
-func TestControlForwardServiceCommandReturnsHardError(t *testing.T) {
-	bases := []string{"12_34_56"}
-	handled, lastNotFoundErr, err := controlForwardServiceCommand(bases, "PauseService", func(name string) error {
-		if name == "12_34_56_tcp" {
-			return errors.New("network timeout")
-		}
-		return nil
-	})
-	if err == nil {
-		t.Fatalf("expected hard error")
-	}
-	if handled {
-		t.Fatalf("expected handled=false on hard error")
-	}
-	if lastNotFoundErr != nil {
-		t.Fatalf("did not expect not-found error alongside hard error")
-	}
-}
-
-func TestIsAlreadyExistsMessage(t *testing.T) {
-	if !isAlreadyExistsMessage("service demo already exists") {
-		t.Fatalf("expected already exists message to be tolerated")
-	}
-	if !isAlreadyExistsMessage("服务已存在") {
-		t.Fatalf("expected Chinese already exists message to be tolerated")
-	}
-	if !isAlreadyExistsMessage("service demo alreadyexists") {
-		t.Fatalf("missing-space alreadyexists should be tolerated")
-	}
-	if isAlreadyExistsMessage("listen tcp [::]:10001: bind: address already in use") {
-		t.Fatalf("address already in use must not be treated as already exists")
-	}
-	if isAlreadyExistsMessage("create service 57_7_7_tcp failed: listen tcp4 0.0.0.0:46222: bind: address alreadyin use") {
-		t.Fatalf("alreadyin-use variant must not be treated as already exists")
-	}
-}
-
-func TestIsBindAddressInUseError(t *testing.T) {
-	if !isBindAddressInUseError(errors.New("listen tcp [::]:10001: bind: address already in use")) {
-		t.Fatalf("address already in use should be detected")
-	}
-	if !isBindAddressInUseError(errors.New("listen tcp4 13.228.170.187:16765: bind: cannot assign requested address")) {
-		t.Fatalf("cannot assign requested address should be detected")
-	}
-	if isBindAddressInUseError(errors.New("service demo already exists")) {
-		t.Fatalf("already exists should not be treated as bind conflict")
-	}
-	if isBindAddressInUseError(nil) {
-		t.Fatalf("nil error should not be treated as bind conflict")
-	}
-}
-
-func TestIsAddressAlreadyInUseError(t *testing.T) {
-	if !isAddressAlreadyInUseError(errors.New("listen tcp [::]:10001: bind: address already in use")) {
-		t.Fatalf("address already in use should be detected")
-	}
-	if !isAddressAlreadyInUseError(errors.New("create service 57_7_7_tcp failed: listen tcp4 0.0.0.0:46222: bind: address alreadyin use")) {
-		t.Fatalf("missing-space alreadyin-use variant should be detected")
-	}
-	if isAddressAlreadyInUseError(errors.New("listen tcp4 13.228.170.187:16765: bind: cannot assign requested address")) {
-		t.Fatalf("cannot assign requested address should not be treated as address-in-use")
-	}
-}
-
-func TestIsCannotAssignRequestedAddressError(t *testing.T) {
-	if !isCannotAssignRequestedAddressError(errors.New("listen tcp4 13.228.170.187:16765: bind: cannot assign requested address")) {
-		t.Fatalf("cannot assign requested address should be detected")
-	}
-	if !isCannotAssignRequestedAddressError(errors.New("listen tcp4 13.228.170.187:16765: bind: cannotassignrequestedaddress")) {
-		t.Fatalf("missing-space cannotassignrequestedaddress variant should be detected")
-	}
-	if isCannotAssignRequestedAddressError(errors.New("listen tcp [::]:10001: bind: address already in use")) {
-		t.Fatalf("address already in use should not be treated as cannot-assign")
-	}
-}
-
-func TestRetryTunnelServiceAddWithCleanupRetriesOnAddressInUse(t *testing.T) {
-	addCalls := 0
-	cleanupCalls := 0
-	err := retryTunnelServiceAddWithCleanup(
-		func() error {
-			addCalls++
-			if addCalls == 1 {
-				return errors.New("listen tcp 10.0.0.1:32000: bind: address already in use")
-			}
-			return nil
-		},
-		func() error {
-			cleanupCalls++
-			return nil
-		},
-		0,
-	)
-	if err != nil {
-		t.Fatalf("expected retry to succeed, got %v", err)
-	}
-	if addCalls != 2 {
-		t.Fatalf("expected 2 add attempts, got %d", addCalls)
-	}
-	if cleanupCalls != 1 {
-		t.Fatalf("expected 1 cleanup attempt, got %d", cleanupCalls)
-	}
-}
-
-func TestRetryTunnelServiceAddWithCleanupSkipsCleanupOnNonBindError(t *testing.T) {
-	addCalls := 0
-	cleanupCalls := 0
-	err := retryTunnelServiceAddWithCleanup(
-		func() error {
-			addCalls++
-			return errors.New("network timeout")
-		},
-		func() error {
-			cleanupCalls++
-			return nil
-		},
-		0,
-	)
-	if err == nil {
-		t.Fatalf("expected hard error")
-	}
-	if addCalls != 1 {
-		t.Fatalf("expected 1 add attempt, got %d", addCalls)
-	}
-	if cleanupCalls != 0 {
-		t.Fatalf("expected 0 cleanup attempts, got %d", cleanupCalls)
-	}
-}
-
-func TestRetryTunnelServiceAddWithCleanupReturnsCleanupError(t *testing.T) {
-	cleanupErr := errors.New("delete failed")
-	err := retryTunnelServiceAddWithCleanup(
-		func() error {
-			return errors.New("listen tcp 10.0.0.1:32000: bind: address already in use")
-		},
-		func() error {
-			return cleanupErr
-		},
-		0,
-	)
-	if !errors.Is(err, cleanupErr) {
-		t.Fatalf("expected cleanup error %v, got %v", cleanupErr, err)
-	}
-}
-
-func TestBuildForwardServiceConfigs_UsesBindIPForListen(t *testing.T) {
-	forward := &forwardRecord{RemoteAddr: "1.2.3.4:80", Strategy: "fifo", TunnelID: 7}
-	node := &nodeRecord{TCPListenAddr: "[::]", UDPListenAddr: "[::]"}
-	services := buildForwardServiceConfigs("1_2_0", forward, nil, node, 22000, "10.9.8.7", nil, false)
-	if len(services) != 2 {
-		t.Fatalf("expected 2 services, got %d", len(services))
-	}
-	for _, svc := range services {
-		addr, _ := svc["addr"].(string)
-		if addr != "10.9.8.7:22000" {
-			t.Fatalf("expected bind IP address 10.9.8.7:22000, got %q", addr)
-		}
-	}
-}
-
-func TestBuildForwardServiceConfigs_DefaultListenAddrWhenBindIPEmpty(t *testing.T) {
-	forward := &forwardRecord{RemoteAddr: "1.2.3.4:80", Strategy: "fifo", TunnelID: 7}
-	node := &nodeRecord{TCPListenAddr: "0.0.0.0", UDPListenAddr: "[::]"}
-	services := buildForwardServiceConfigs("1_2_0", forward, nil, node, 22001, "", nil, false)
-	if len(services) != 2 {
-		t.Fatalf("expected 2 services, got %d", len(services))
-	}
-	tcpAddr, _ := services[0]["addr"].(string)
-	udpAddr, _ := services[1]["addr"].(string)
-	if tcpAddr != "0.0.0.0:22001" {
-		t.Fatalf("expected tcp addr 0.0.0.0:22001, got %q", tcpAddr)
-	}
-	if udpAddr != "[::]:22001" {
-		t.Fatalf("expected udp addr [::]:22001, got %q", udpAddr)
-	}
-}
-func TestBuildForwardServiceConfigs_BindIPAlreadyContainsPort(t *testing.T) {
-	forward := &forwardRecord{RemoteAddr: "1.2.3.4:80", Strategy: "fifo", TunnelID: 7}
-	node := &nodeRecord{TCPListenAddr: "[::]", UDPListenAddr: "[::]"}
-	services := buildForwardServiceConfigs("1_2_0", forward, nil, node, 55555, "3.3.3.3:12345", nil, false)
-	if len(services) != 2 {
-		t.Fatalf("expected 2 services, got %d", len(services))
-	}
-	for _, svc := range services {
-		addr, _ := svc["addr"].(string)
-		if addr != "3.3.3.3:12345" {
-			t.Fatalf("expected bind IP with port 3.3.3.3:12345, got %q", addr)
-		}
-	}
-}
-
-func TestProcessServerAddress_StripsURLSchemeAndPath(t *testing.T) {
-	tests := []struct {
-		name string
-		in   string
-		want string
-	}{
-		{
-			name: "https with path",
-			in:   "https://panel.example.com:8443/api/v1",
-			want: "panel.example.com:8443",
-		},
-		{
-			name: "wss with query",
-			in:   "wss://panel.example.com:443/system-info?x=1",
-			want: "panel.example.com:443",
-		},
-		{
-			name: "http without port",
-			in:   "http://panel.example.com",
-			want: "panel.example.com",
-		},
-		{
-			name: "manual host with trailing path",
-			in:   "panel.example.com:8080/path",
-			want: "panel.example.com:8080",
-		},
-	}
-
-	for _, tt := range tests {
-		if got := processServerAddress(tt.in); got != tt.want {
-			t.Fatalf("%s: expected %q, got %q", tt.name, tt.want, got)
-		}
-	}
-}
-
-func TestProcessServerAddress_NormalizesIPv6(t *testing.T) {
-	tests := []struct {
-		name string
-		in   string
-		want string
-	}{
-		{
-			name: "ipv6 host only",
-			in:   "2001:db8::1",
-			want: "[2001:db8::1]",
-		},
-		{
-			name: "ipv6 host and port",
-			in:   "https://[2001:db8::1]:8443/path",
-			want: "[2001:db8::1]:8443",
-		},
-		{
-			name: "already bracketed",
-			in:   "[2001:db8::2]:9000",
-			want: "[2001:db8::2]:9000",
-		},
-	}
-
-	for _, tt := range tests {
-		if got := processServerAddress(tt.in); got != tt.want {
-			t.Fatalf("%s: expected %q, got %q", tt.name, tt.want, got)
-		}
-	}
-}

go-backend/internal/http/handler/db_test_helper_test.go

@@ -1,50 +0,0 @@
-package handler
-
-import (
-	"testing"
-
-	"go-backend/internal/store/repo"
-)
-
-func mustLastInsertID(t *testing.T, r *repo.Repository, label string) int64 {
-	t.Helper()
-	var id int64
-	if err := r.DB().Raw("SELECT last_insert_rowid()").Row().Scan(&id); err != nil {
-		t.Fatalf("read last_insert_rowid for %s: %v", label, err)
-	}
-	if id <= 0 {
-		t.Fatalf("invalid last_insert_rowid for %s: %d", label, id)
-	}
-	return id
-}
-
-func mustQueryInt(t *testing.T, r *repo.Repository, query string, args ...interface{}) int {
-	t.Helper()
-	var v int
-	if err := r.DB().Raw(query, args...).Row().Scan(&v); err != nil {
-		t.Fatalf("query int failed: %v (query=%q)", err, query)
-	}
-	return v
-}
-
-func mustQueryInt64Int64String(t *testing.T, r *repo.Repository, query string, args ...interface{}) (int64, int64, string) {
-	t.Helper()
-	var a int64
-	var b int64
-	var c string
-	if err := r.DB().Raw(query, args...).Row().Scan(&a, &b, &c); err != nil {
-		t.Fatalf("query int64+int64+string failed: %v (query=%q)", err, query)
-	}
-	return a, b, c
-}
-
-func mustQueryInt64Int64Int(t *testing.T, r *repo.Repository, query string, args ...interface{}) (int64, int64, int) {
-	t.Helper()
-	var a int64
-	var b int64
-	var c int
-	if err := r.DB().Raw(query, args...).Row().Scan(&a, &b, &c); err != nil {
-		t.Fatalf("query int64+int64+int failed: %v (query=%q)", err, query)
-	}
-	return a, b, c
-}

go-backend/internal/http/handler/diagnosis_stream.go

@@ -1,209 +0,0 @@
-package handler
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"net/http"
-	"strings"
-	"time"
-
-	"go-backend/internal/http/response"
-)
-
-type diagnosisStreamEvent struct {
-	Type string      `json:"type"`
-	Data interface{} `json:"data,omitempty"`
-	TS   int64       `json:"ts"`
-}
-
-func prepareDiagnosisStreamResponse(w http.ResponseWriter) (http.Flusher, error) {
-	flusher, ok := w.(http.Flusher)
-	if !ok {
-		return nil, errors.New("当前服务不支持流式响应")
-	}
-	w.Header().Set("Content-Type", "application/x-ndjson; charset=utf-8")
-	w.Header().Set("Cache-Control", "no-cache")
-	w.Header().Set("Connection", "keep-alive")
-	w.Header().Set("X-Accel-Buffering", "no")
-	return flusher, nil
-}
-
-func writeDiagnosisStreamEvent(encoder *json.Encoder, flusher http.Flusher, eventType string, data interface{}) error {
-	if encoder == nil || flusher == nil {
-		return errors.New("流式响应写入器未初始化")
-	}
-	event := diagnosisStreamEvent{Type: eventType, Data: data, TS: time.Now().UnixMilli()}
-	if err := encoder.Encode(event); err != nil {
-		return err
-	}
-	flusher.Flush()
-	return nil
-}
-
-func summarizeDiagnosisProgress(results []map[string]interface{}) diagnosisProgress {
-	progress := diagnosisProgress{Total: len(results)}
-	for _, item := range results {
-		progress.Completed++
-		if asBool(item["success"], false) {
-			progress.Success++
-		} else {
-			progress.Failed++
-		}
-	}
-	return progress
-}
-
-func shouldIgnoreDiagnosisStreamError(err error) bool {
-	if err == nil {
-		return false
-	}
-	if errors.Is(err, context.Canceled) {
-		return true
-	}
-	msg := strings.ToLower(strings.TrimSpace(err.Error()))
-	if strings.Contains(msg, "broken pipe") || strings.Contains(msg, "connection reset by peer") {
-		return true
-	}
-	if strings.Contains(msg, "stream already closed") {
-		return true
-	}
-	return false
-}
-
-func (h *Handler) streamDiagnosisRuntime(ctx context.Context, cancel context.CancelFunc, w http.ResponseWriter, startPayload map[string]interface{}, workItems []diagnosisWorkItem) error {
-	flusher, err := prepareDiagnosisStreamResponse(w)
-	if err != nil {
-		return err
-	}
-	encoder := json.NewEncoder(w)
-
-	payload := map[string]interface{}{
-		"total":     len(workItems),
-		"timestamp": time.Now().UnixMilli(),
-		"items":     h.buildDiagnosisStreamStartItems(workItems),
-	}
-	for key, value := range startPayload {
-		payload[key] = value
-	}
-	if err := writeDiagnosisStreamEvent(encoder, flusher, "start", payload); err != nil {
-		return err
-	}
-
-	streamBroken := false
-	emitter := func(index int, item map[string]interface{}, progress diagnosisProgress) {
-		if streamBroken {
-			return
-		}
-		itemPayload := map[string]interface{}{
-			"index":    index,
-			"result":   item,
-			"progress": progress,
-		}
-		if err := writeDiagnosisStreamEvent(encoder, flusher, "item", itemPayload); err != nil {
-			streamBroken = true
-			if cancel != nil {
-				cancel()
-			}
-		}
-	}
-
-	results := h.runDiagnosisWorkItems(ctx, workItems, emitter)
-	if streamBroken {
-		return context.Canceled
-	}
-
-	progress := summarizeDiagnosisProgress(results)
-	donePayload := map[string]interface{}{
-		"progress": progress,
-		"timedOut": errors.Is(ctx.Err(), context.DeadlineExceeded),
-	}
-	return writeDiagnosisStreamEvent(encoder, flusher, "done", donePayload)
-}
-
-func (h *Handler) tunnelDiagnoseStream(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	id := asInt64FromBodyKey(r, w, "tunnelId")
-	if id <= 0 {
-		return
-	}
-
-	tunnelName, tunnelType, workItems, err := h.prepareTunnelDiagnosis(id)
-	if err != nil {
-		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不完整") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
-	defer cancel()
-
-	startPayload := map[string]interface{}{
-		"tunnelName": tunnelName,
-		"tunnelType": tunnelType,
-	}
-	if err := h.streamDiagnosisRuntime(ctx, cancel, w, startPayload, workItems); err != nil {
-		if shouldIgnoreDiagnosisStreamError(err) {
-			return
-		}
-		if strings.Contains(err.Error(), "不支持流式响应") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		return
-	}
-}
-
-func (h *Handler) forwardDiagnoseStream(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	id := asInt64FromBodyKey(r, w, "forwardId")
-	if id <= 0 {
-		return
-	}
-
-	forward, _, _, err := h.resolveForwardAccess(r, id)
-	if err != nil {
-		if errors.Is(err, errForwardNotFound) {
-			response.WriteJSON(w, response.ErrDefault("转发不存在"))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	forwardName, workItems, err := h.prepareForwardDiagnosis(forward)
-	if err != nil {
-		if strings.Contains(err.Error(), "不存在") || strings.Contains(err.Error(), "不能为空") || strings.Contains(err.Error(), "错误") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	ctx, cancel := context.WithTimeout(r.Context(), diagnosisRequestTimeout)
-	defer cancel()
-
-	startPayload := map[string]interface{}{
-		"forwardName": forwardName,
-	}
-	if err := h.streamDiagnosisRuntime(ctx, cancel, w, startPayload, workItems); err != nil {
-		if shouldIgnoreDiagnosisStreamError(err) {
-			return
-		}
-		if strings.Contains(err.Error(), "不支持流式响应") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		return
-	}
-}

go-backend/internal/http/handler/dual_stack_test.go

@@ -8,100 +8,9 @@ import (
 // nodeSupportsV4 / nodeSupportsV6
 // ---------------------------------------------------------------------------
 
-func TestSelectTunnelDialHost_ConnectIpPriority(t *testing.T) {
-	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
-	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-
-	// Empty connectIp should be ignored, IP preference takes effect
-	host, err := selectTunnelDialHost(from, to, "", "")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if host != "10.0.0.2" {
-		t.Fatalf("empty connectIp should be ignored (v4 preference applies), got %q", host)
-	}
-	// Non-empty connectIp should override IP preference
-	host, err = selectTunnelDialHost(from, to, "v6", "192.168.0.3")
-	if err != nil {
-		t.Fatalf("unexpected error: %v", err)
-	}
-	if host != "192.168.0.3" {
-		t.Fatalf("connectIp should override v6 preference, got %q", host)
-	}
-}
-
-func TestBuildTunnelChainServiceConfig_UsesConnectIPForListen(t *testing.T) {
-	node := &nodeRecord{TCPListenAddr: "[::]"}
-	chain := tunnelRuntimeNode{Protocol: "tls", Port: 21000, ConnectIP: "2001:db8::88"}
-	services := buildTunnelChainServiceConfig(99, chain, node, 1)
-	if len(services) != 1 {
-		t.Fatalf("expected 1 service, got %d", len(services))
-	}
-	addr, _ := services[0]["addr"].(string)
-	if addr != "[2001:db8::88]:21000" {
-		t.Fatalf("expected connectIp listen [2001:db8::88]:21000, got %q", addr)
-	}
-}
-
-func TestBuildTunnelChainServiceConfig_FallsBackToNodeListenAddr(t *testing.T) {
-	node := &nodeRecord{TCPListenAddr: "10.8.0.5"}
-	chain := tunnelRuntimeNode{Protocol: "tls", Port: 21002}
-	services := buildTunnelChainServiceConfig(99, chain, node, 1)
-	if len(services) != 1 {
-		t.Fatalf("expected 1 service, got %d", len(services))
-	}
-	addr, _ := services[0]["addr"].(string)
-	if addr != "10.8.0.5:21002" {
-		t.Fatalf("expected node listen addr 10.8.0.5:21002, got %q", addr)
-	}
-}
-
-func TestBuildTunnelChainServiceConfig_DefaultListenAddrWhenConnectIPEmpty(t *testing.T) {
-	node := &nodeRecord{TCPListenAddr: "[::]"}
-	chain := tunnelRuntimeNode{Protocol: "tls", Port: 21001}
-	services := buildTunnelChainServiceConfig(99, chain, node, 1)
-	if len(services) != 1 {
-		t.Fatalf("expected 1 service, got %d", len(services))
-	}
-	addr, _ := services[0]["addr"].(string)
-	if addr != "[::]:21001" {
-		t.Fatalf("expected default listen [::]:21001, got %q", addr)
-	}
-}
-
-func TestBuildTunnelChainServiceConfig_SetsRetriesWhenMultipleCandidates(t *testing.T) {
-	node := &nodeRecord{TCPListenAddr: "[::]"}
-	chain := tunnelRuntimeNode{Protocol: "tls", Port: 21001}
-	services := buildTunnelChainServiceConfig(99, chain, node, 3)
-	if len(services) != 1 {
-		t.Fatalf("expected 1 service, got %d", len(services))
-	}
-	handler, _ := services[0]["handler"].(map[string]interface{})
-	if handler == nil {
-		t.Fatal("expected handler config")
-	}
-	retries, ok := handler["retries"].(int)
-	if !ok {
-		t.Fatal("expected retries to be set when nextHopCandidateCount > 1")
-	}
-	if retries != 2 {
-		t.Fatalf("expected retries=2 (candidates-1), got %d", retries)
-	}
-}
-
-func TestBuildTunnelChainServiceConfig_NoRetriesWhenSingleCandidate(t *testing.T) {
-	node := &nodeRecord{TCPListenAddr: "[::]"}
-	chain := tunnelRuntimeNode{Protocol: "tls", Port: 21001}
-	services := buildTunnelChainServiceConfig(99, chain, node, 1)
-	if len(services) != 1 {
-		t.Fatalf("expected 1 service, got %d", len(services))
-	}
-	handler, _ := services[0]["handler"].(map[string]interface{})
-	if handler == nil {
-		t.Fatal("expected handler config")
-	}
-	if _, hasRetries := handler["retries"]; hasRetries {
-		t.Fatal("expected no retries when nextHopCandidateCount is 1")
+func TestNodeSupportsV4_Nil(t *testing.T) {
+	if nodeSupportsV4(nil) {
+		t.Fatal("nil node must not support v4")
 	}
 }
 
@@ -114,14 +23,14 @@ func TestNodeSupportsV6_Nil(t *testing.T) {
 func TestNodeSupportsV4_ExplicitV4(t *testing.T) {
 	n := &nodeRecord{ServerIPv4: "10.0.0.1"}
 	if !nodeSupportsV4(n) {
-		t.Fatal("explicit server_ip_v4 needs support v4")
+		t.Fatal("explicit server_ip_v4 must support v4")
 	}
 }
 
 func TestNodeSupportsV6_ExplicitV6(t *testing.T) {
 	n := &nodeRecord{ServerIPv6: "2001:db8::1"}
 	if !nodeSupportsV6(n) {
-		t.Fatal("explicit server_ip_v6 needs support v6")
+		t.Fatal("explicit server_ip_v6 must support v6")
 	}
 }
 
@@ -159,7 +68,7 @@ func TestNodeSupportsV4_LegacyV4Only(t *testing.T) {
 		t.Fatal("legacy v4 ip in server_ip must support v4")
 	}
 	if nodeSupportsV6(n) {
-		t.Fatal("legacy v4 ip in server_ip should not support v6")
+		t.Fatal("legacy v4 ip in server_ip must not support v6")
 	}
 }
 
@@ -169,7 +78,7 @@ func TestNodeSupportsV6_LegacyV6Only(t *testing.T) {
 		t.Fatal("legacy v6 ip in server_ip must support v6")
 	}
 	if nodeSupportsV4(n) {
-		t.Fatal("legacy v6 ip in server_ip should not support v4")
+		t.Fatal("legacy v6 ip in server_ip must not support v4")
 	}
 }
 
@@ -268,15 +177,15 @@ func v6OnlyNode(name, v6 string) *nodeRecord {
 }
 
 func TestSelectTunnelDialHost_NilNodes(t *testing.T) {
-	_, err := selectTunnelDialHost(nil, nil, "", "")
+	_, err := selectTunnelDialHost(nil, nil, "")
 	if err == nil {
 		t.Fatal("expected error for nil nodes")
 	}
-	_, err = selectTunnelDialHost(dualStackNode("a", "1.1.1.1", "::1"), nil, "", "")
+	_, err = selectTunnelDialHost(dualStackNode("a", "1.1.1.1", "::1"), nil, "")
 	if err == nil {
 		t.Fatal("expected error for nil toNode")
 	}
-	_, err = selectTunnelDialHost(nil, dualStackNode("b", "1.1.1.1", "::1"), "", "")
+	_, err = selectTunnelDialHost(nil, dualStackNode("b", "1.1.1.1", "::1"), "")
 	if err == nil {
 		t.Fatal("expected error for nil fromNode")
 	}
@@ -285,7 +194,8 @@ func TestSelectTunnelDialHost_NilNodes(t *testing.T) {
 func TestSelectTunnelDialHost_DualStack_DefaultPreference(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-	host, err := selectTunnelDialHost(from, to, "", "")
+
+	host, err := selectTunnelDialHost(from, to, "")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -298,7 +208,8 @@ func TestSelectTunnelDialHost_DualStack_DefaultPreference(t *testing.T) {
 func TestSelectTunnelDialHost_DualStack_PreferV4(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -310,7 +221,8 @@ func TestSelectTunnelDialHost_DualStack_PreferV4(t *testing.T) {
 func TestSelectTunnelDialHost_DualStack_PreferV6(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -322,8 +234,9 @@ func TestSelectTunnelDialHost_DualStack_PreferV6(t *testing.T) {
 func TestSelectTunnelDialHost_V4Only_PreferV6Fallback(t *testing.T) {
 	from := v4OnlyNode("from", "10.0.0.1")
 	to := v4OnlyNode("to", "10.0.0.2")
+
 	// User prefers v6, but both nodes are v4-only — should fallback to v4
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -335,8 +248,9 @@ func TestSelectTunnelDialHost_V4Only_PreferV6Fallback(t *testing.T) {
 func TestSelectTunnelDialHost_V6Only_PreferV4Fallback(t *testing.T) {
 	from := v6OnlyNode("from", "2001:db8::1")
 	to := v6OnlyNode("to", "2001:db8::2")
+
 	// User prefers v4, but both nodes are v6-only — should fallback to v6
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -348,7 +262,8 @@ func TestSelectTunnelDialHost_V6Only_PreferV4Fallback(t *testing.T) {
 func TestSelectTunnelDialHost_Incompatible(t *testing.T) {
 	from := v4OnlyNode("from", "10.0.0.1")
 	to := v6OnlyNode("to", "2001:db8::2")
-	_, err := selectTunnelDialHost(from, to, "", "")
+
+	_, err := selectTunnelDialHost(from, to, "")
 	if err == nil {
 		t.Fatal("expected error for incompatible nodes (v4-only -> v6-only)")
 	}
@@ -357,7 +272,8 @@ func TestSelectTunnelDialHost_Incompatible(t *testing.T) {
 func TestSelectTunnelDialHost_Incompatible_Reverse(t *testing.T) {
 	from := v6OnlyNode("from", "2001:db8::1")
 	to := v4OnlyNode("to", "10.0.0.2")
-	_, err := selectTunnelDialHost(from, to, "", "")
+
+	_, err := selectTunnelDialHost(from, to, "")
 	if err == nil {
 		t.Fatal("expected error for incompatible nodes (v6-only -> v4-only)")
 	}
@@ -366,8 +282,9 @@ func TestSelectTunnelDialHost_Incompatible_Reverse(t *testing.T) {
 func TestSelectTunnelDialHost_WhitespacePreference(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
+
 	// Whitespace should be trimmed, treated as "v6"
-	host, err := selectTunnelDialHost(from, to, "  v6  ", "")
+	host, err := selectTunnelDialHost(from, to, "  v6  ")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -379,8 +296,9 @@ func TestSelectTunnelDialHost_WhitespacePreference(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromDualToV4(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := v4OnlyNode("to", "10.0.0.2")
+
 	// v6 preferred, but target only has v4 — should succeed with v4
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -392,8 +310,9 @@ func TestSelectTunnelDialHost_MixedStack_FromDualToV4(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromDualToV6(t *testing.T) {
 	from := dualStackNode("from", "10.0.0.1", "2001:db8::1")
 	to := v6OnlyNode("to", "2001:db8::2")
+
 	// v4 preferred, but target only has v6 — should succeed with v6
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -405,8 +324,9 @@ func TestSelectTunnelDialHost_MixedStack_FromDualToV6(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromV4ToDual(t *testing.T) {
 	from := v4OnlyNode("from", "10.0.0.1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
+
 	// v6 preferred, but from only has v4 — should use v4 (from can only reach v4 of target)
-	host, err := selectTunnelDialHost(from, to, "v6", "")
+	host, err := selectTunnelDialHost(from, to, "v6")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -418,8 +338,9 @@ func TestSelectTunnelDialHost_MixedStack_FromV4ToDual(t *testing.T) {
 func TestSelectTunnelDialHost_MixedStack_FromV6ToDual(t *testing.T) {
 	from := v6OnlyNode("from", "2001:db8::1")
 	to := dualStackNode("to", "10.0.0.2", "2001:db8::2")
+
 	// v4 preferred, but from only has v6 — should use v6
-	host, err := selectTunnelDialHost(from, to, "v4", "")
+	host, err := selectTunnelDialHost(from, to, "v4")
 	if err != nil {
 		t.Fatalf("unexpected error: %v", err)
 	}
@@ -446,6 +367,7 @@ func TestNodeDisplayName_Named(t *testing.T) {
 		t.Fatalf("expected 'hk-node', got %q", got)
 	}
 }
+
 func TestNodeDisplayName_Unnamed(t *testing.T) {
 	n := &nodeRecord{ID: 42}
 	got := nodeDisplayName(n)

go-backend/internal/http/handler/federation.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"database/sql"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -13,7 +14,7 @@ import (
 
 	"go-backend/internal/http/client"
 	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 type federationTunnelRequest struct {
@@ -107,7 +108,7 @@ type peerShareUsedPort struct {
 }
 
 type peerShareListItem struct {
-	repo.PeerShare
+	sqlite.PeerShare
 	UsedPorts        []int               `json:"usedPorts"`
 	UsedPortDetails  []peerShareUsedPort `json:"usedPortDetails"`
 	ActiveRuntimeNum int                 `json:"activeRuntimeNum"`
@@ -141,32 +142,6 @@ type remoteUsageNodeItem struct {
 	SyncError        string                   `json:"syncError,omitempty"`
 }
 
-func buildFederationServiceConfig(serviceName, addr, protocol, role, chainName string, targetCount int, interfaceName string) map[string]interface{} {
-	service := map[string]interface{}{
-		"name": serviceName,
-		"addr": addr,
-		"handler": map[string]interface{}{
-			"type": "relay",
-		},
-		"listener": map[string]interface{}{
-			"type": protocol,
-		},
-	}
-	if isTLSTunnelProtocol(protocol) {
-		service["handler"].(map[string]interface{})["metadata"] = map[string]interface{}{"nodelay": true}
-	}
-	if role == "middle" {
-		service["handler"].(map[string]interface{})["chain"] = chainName
-		if targetCount > 1 {
-			service["handler"].(map[string]interface{})["retries"] = targetCount - 1
-		}
-	}
-	if role == "exit" && strings.TrimSpace(interfaceName) != "" {
-		service["metadata"] = map[string]interface{}{"interface": interfaceName}
-	}
-	return service
-}
-
 func (h *Handler) federationShareList(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("Invalid method"))
@@ -289,7 +264,7 @@ func (h *Handler) federationShareCreate(w http.ResponseWriter, r *http.Request)
 	now := time.Now().UnixMilli()
 	token := randomToken(32)
 
-	share := &repo.PeerShare{
+	share := &sqlite.PeerShare{
 		Name:           req.Name,
 		NodeID:         req.NodeID,
 		Token:          token,
@@ -455,25 +430,40 @@ func (h *Handler) federationRemoteUsageList(w http.ResponseWriter, r *http.Reque
 		return
 	}
 
-	remoteNodes, err := h.repo.ListRemoteNodes()
+	rows, err := h.repo.DB().Query(`
+		SELECT id, name, remote_url, remote_token, remote_config
+		FROM node
+		WHERE is_remote = 1
+		ORDER BY id DESC
+	`)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
+	defer rows.Close()
 
 	fc := client.NewFederationClient()
 	localDomain := h.federationLocalDomain()
 
 	items := make([]remoteUsageNodeItem, 0)
-	for _, node := range remoteNodes {
-		nodeID := node.ID
-		nodeName := node.Name
+	for rows.Next() {
+		var (
+			nodeID       int64
+			nodeName     string
+			remoteURL    sql.NullString
+			remoteToken  sql.NullString
+			remoteConfig sql.NullString
+		)
+		if err := rows.Scan(&nodeID, &nodeName, &remoteURL, &remoteToken, &remoteConfig); err != nil {
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
+		}
 
-		shareID, maxBandwidth, currentFlow, expiryTime, portRangeStart, portRangeEnd := parseRemoteShareUsageConfig(node.RemoteConfig.String)
+		shareID, maxBandwidth, currentFlow, expiryTime, portRangeStart, portRangeEnd := parseRemoteShareUsageConfig(remoteConfig.String)
 
 		var syncError string
-		url := strings.TrimSpace(node.RemoteURL.String)
-		token := strings.TrimSpace(node.RemoteToken.String)
+		url := strings.TrimSpace(remoteURL.String)
+		token := strings.TrimSpace(remoteToken.String)
 		if url != "" && token != "" {
 			info, connectErr := fc.Connect(url, token, localDomain)
 			if connectErr != nil {
@@ -494,62 +484,42 @@ func (h *Handler) federationRemoteUsageList(w http.ResponseWriter, r *http.Reque
 					"portRangeStart": info.PortRangeStart,
 					"portRangeEnd":   info.PortRangeEnd,
 				})
-				_ = h.repo.UpdateNodeRemoteConfig(nodeID, string(configData))
+				_, _ = h.repo.DB().Exec(`UPDATE node SET remote_config = ? WHERE id = ?`, string(configData), nodeID)
 			}
 		}
 
-		bindingRows, err := h.repo.ListActiveBindingsForNode(nodeID)
-		if err != nil {
-			response.WriteJSON(w, response.Err(-2, err.Error()))
-			return
-		}
-		forwardPortRows, err := h.repo.ListActiveForwardPortsForNode(nodeID)
+		bindingRows, err := h.repo.DB().Query(`
+			SELECT fb.id, fb.tunnel_id, COALESCE(t.name, ''), fb.chain_type, fb.hop_inx, fb.allocated_port, fb.resource_key, fb.remote_binding_id, fb.updated_time
+			FROM federation_tunnel_binding fb
+			LEFT JOIN tunnel t ON t.id = fb.tunnel_id
+			WHERE fb.node_id = ? AND fb.status = 1
+			ORDER BY fb.allocated_port ASC, fb.id ASC
+		`, nodeID)
 		if err != nil {
 			response.WriteJSON(w, response.Err(-2, err.Error()))
 			return
 		}
 
 		usedSet := make(map[int]struct{})
-		bindings := make([]remoteUsageBindingItem, 0, len(bindingRows)+len(forwardPortRows))
-		for _, b := range bindingRows {
-			bindings = append(bindings, remoteUsageBindingItem{
-				BindingID:       b.ID,
-				TunnelID:        b.TunnelID,
-				TunnelName:      b.TunnelName,
-				ChainType:       b.ChainType,
-				HopInx:          b.HopInx,
-				AllocatedPort:   b.AllocatedPort,
-				ResourceKey:     b.ResourceKey,
-				RemoteBindingID: b.RemoteBindingID,
-				UpdatedTime:     b.UpdatedTime,
-			})
-			if b.AllocatedPort > 0 {
-				usedSet[b.AllocatedPort] = struct{}{}
+		bindings := make([]remoteUsageBindingItem, 0)
+		for bindingRows.Next() {
+			var item remoteUsageBindingItem
+			if err := bindingRows.Scan(&item.BindingID, &item.TunnelID, &item.TunnelName, &item.ChainType, &item.HopInx, &item.AllocatedPort, &item.ResourceKey, &item.RemoteBindingID, &item.UpdatedTime); err != nil {
+				_ = bindingRows.Close()
+				response.WriteJSON(w, response.Err(-2, err.Error()))
+				return
+			}
+			bindings = append(bindings, item)
+			if item.AllocatedPort > 0 {
+				usedSet[item.AllocatedPort] = struct{}{}
 			}
 		}
-		for _, fp := range forwardPortRows {
-			bindings = append(bindings, remoteUsageBindingItem{
-				BindingID:       -fp.ForwardID,
-				TunnelID:        fp.TunnelID,
-				TunnelName:      fp.TunnelName,
-				ChainType:       1,
-				HopInx:          0,
-				AllocatedPort:   fp.Port,
-				ResourceKey:     fmt.Sprintf("forward:%d", fp.ForwardID),
-				RemoteBindingID: "",
-				UpdatedTime:     fp.UpdatedTime,
-			})
-			if fp.Port > 0 {
-				usedSet[fp.Port] = struct{}{}
-			}
+		if err := bindingRows.Err(); err != nil {
+			_ = bindingRows.Close()
+			response.WriteJSON(w, response.Err(-2, err.Error()))
+			return
 		}
-
-		sort.Slice(bindings, func(i, j int) bool {
-			if bindings[i].AllocatedPort == bindings[j].AllocatedPort {
-				return bindings[i].BindingID < bindings[j].BindingID
-			}
-			return bindings[i].AllocatedPort < bindings[j].AllocatedPort
-		})
+		_ = bindingRows.Close()
 
 		usedPorts := make([]int, 0, len(usedSet))
 		for port := range usedSet {
@@ -573,6 +543,10 @@ func (h *Handler) federationRemoteUsageList(w http.ResponseWriter, r *http.Reque
 			SyncError:        syncError,
 		})
 	}
+	if err := rows.Err(); err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
+	}
 
 	response.WriteJSON(w, response.OK(items))
 }
@@ -665,21 +639,31 @@ func (h *Handler) nodeImport(w http.ResponseWriter, r *http.Request) {
 		portRange = fmt.Sprintf("%d-%d", info.PortRangeStart, info.PortRangeEnd)
 	}
 
-	inx := h.repo.NextIndex("node")
+	db := h.repo.DB()
+	inx := nextIndex(db, "node")
 	now := time.Now().UnixMilli()
 
-	if err = h.repo.CreateRemoteNode(
+	_, err = db.Exec(`
+		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
+		VALUES(?, ?, ?, ?, ?, ?, ?, ?, 0, 0, 0, ?, ?, ?, ?, ?, ?, 1, ?, ?, ?)
+	`,
 		fmt.Sprintf("%s (Remote)", info.NodeName),
-		randomToken(16),
+		randomToken(16), // Dummy secret
 		info.ServerIP,
+		"", "", // v4/v6 unknown, use server_ip
 		portRange,
-		now,
+		"",
+		"",
+		now, now,
 		info.Status,
+		"[::]", "[::]",
 		inx,
 		req.RemoteURL,
 		req.Token,
 		string(configBytes),
-	); err != nil {
+	)
+
+	if err != nil {
 		response.WriteJSON(w, response.Err(-2, "Database error: "+err.Error()))
 		return
 	}
@@ -771,7 +755,11 @@ func (h *Handler) federationConnect(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	nodeInfo, err := h.repo.GetNodeBasicInfo(share.NodeID)
+	var nodeName string
+	var serverIP string
+	var status int
+
+	err = h.repo.DB().QueryRow("SELECT name, server_ip, status FROM node WHERE id = ?", share.NodeID).Scan(&nodeName, &serverIP, &status)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, "Node not found"))
 		return
@@ -781,9 +769,9 @@ func (h *Handler) federationConnect(w http.ResponseWriter, r *http.Request) {
 		"shareId":        share.ID,
 		"shareName":      share.Name,
 		"nodeId":         share.NodeID,
-		"nodeName":       nodeInfo.Name,
-		"serverIp":       nodeInfo.ServerIP,
-		"status":         nodeInfo.Status,
+		"nodeName":       nodeName,
+		"serverIp":       serverIP,
+		"status":         status,
 		"maxBandwidth":   share.MaxBandwidth,
 		"currentFlow":    share.CurrentFlow,
 		"expiryTime":     share.ExpiryTime,
@@ -820,71 +808,41 @@ func (h *Handler) federationTunnelCreate(w http.ResponseWriter, r *http.Request)
 		return
 	}
 
-	usedPorts, err := h.repo.ListUsedPortsOnNode(share.NodeID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	for _, port := range usedPorts {
-		if port == req.RemotePort {
-			response.WriteJSON(w, response.Err(403, "Port already in use"))
-			return
-		}
-	}
+	tunnelType := 1
 
-	runtimeOnPort, err := h.repo.GetActiveForwardPeerShareRuntimeByPort(share.ID, req.RemotePort)
+	tx, err := h.repo.DB().Begin()
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	if runtimeOnPort != nil {
-		response.WriteJSON(w, response.Err(403, "Port already in use"))
-		return
-	}
-	existsOnNodePort, err := h.repo.ExistsActivePeerShareRuntimeOnNodePort(share.NodeID, req.RemotePort)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if existsOnNodePort {
-		response.WriteJSON(w, response.Err(403, "Port already in use"))
-		return
-	}
+	defer tx.Rollback()
 
 	now := time.Now().UnixMilli()
-	tunnelID, err := h.repo.CreateFederationTunnel(
+	tunnelID, err := tx.ExecReturningID(`INSERT INTO tunnel (name, type, protocol, flow, created_time, updated_time, status, in_ip) VALUES (?, ?, ?, 0, ?, ?, 1, ?)`,
 		fmt.Sprintf("Share-%d-Port-%d", share.ID, req.RemotePort),
-		1,
+		tunnelType,
 		req.Protocol,
 		now,
-		share.NodeID,
-		req.RemotePort,
+		now,
+		"",
 	)
 	if err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
 
-	runtime := &repo.PeerShareRuntime{
-		ShareID:       share.ID,
-		NodeID:        share.NodeID,
-		ReservationID: randomToken(24),
-		ResourceKey:   fmt.Sprintf("federation-forward-%d-%d-%d", share.ID, tunnelID, req.RemotePort),
-		BindingID:     "",
-		Role:          "forward",
-		ChainName:     "",
-		ServiceName:   "",
-		Protocol:      defaultString(req.Protocol, "tcp"),
-		Strategy:      "fifo",
-		Port:          req.RemotePort,
-		Target:        strings.TrimSpace(req.Target),
-		Applied:       0,
-		Status:        1,
-		CreatedTime:   now,
-		UpdatedTime:   now,
+	_, err = tx.Exec(`INSERT INTO chain_tunnel (tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES (?, '1', ?, ?, 'fifo', 0, ?)`,
+		tunnelID,
+		share.NodeID,
+		req.RemotePort,
+		req.Protocol,
+	)
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, err.Error()))
+		return
 	}
-	if err := h.repo.CreatePeerShareRuntime(runtime); err != nil {
-		_ = h.deleteTunnelByID(tunnelID)
+
+	if err := tx.Commit(); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
@@ -969,7 +927,7 @@ func (h *Handler) federationRuntimeReservePort(w http.ResponseWriter, r *http.Re
 		return
 	}
 
-	runtime := &repo.PeerShareRuntime{
+	runtime := &sqlite.PeerShareRuntime{
 		ShareID:       share.ID,
 		NodeID:        share.NodeID,
 		ReservationID: randomToken(24),
@@ -1023,7 +981,7 @@ func (h *Handler) federationRuntimeApplyRole(w http.ResponseWriter, r *http.Requ
 		return
 	}
 
-	var runtime *repo.PeerShareRuntime
+	var runtime *sqlite.PeerShareRuntime
 	if strings.TrimSpace(req.ReservationID) != "" {
 		runtime, err = h.repo.GetPeerShareRuntimeByReservationID(share.ID, strings.TrimSpace(req.ReservationID))
 	} else {
@@ -1122,16 +1080,25 @@ func (h *Handler) federationRuntimeApplyRole(w http.ResponseWriter, r *http.Requ
 		}
 	}
 
-	targetCount := len(req.Targets)
-	service := buildFederationServiceConfig(
-		serviceName,
-		fmt.Sprintf("%s:%d", node.TCPListenAddr, runtime.Port),
-		protocol,
-		req.Role,
-		chainName,
-		targetCount,
-		node.InterfaceName,
-	)
+	service := map[string]interface{}{
+		"name": serviceName,
+		"addr": fmt.Sprintf("%s:%d", node.TCPListenAddr, runtime.Port),
+		"handler": map[string]interface{}{
+			"type": "relay",
+		},
+		"listener": map[string]interface{}{
+			"type": protocol,
+		},
+	}
+	if isTLSTunnelProtocol(protocol) {
+		service["handler"].(map[string]interface{})["metadata"] = map[string]interface{}{"nodelay": true}
+	}
+	if req.Role == "middle" {
+		service["handler"].(map[string]interface{})["chain"] = chainName
+	}
+	if req.Role == "exit" && strings.TrimSpace(node.InterfaceName) != "" {
+		service["metadata"] = map[string]interface{}{"interface": node.InterfaceName}
+	}
 	if _, err := h.sendNodeCommand(share.NodeID, "AddService", []map[string]interface{}{service}, true, false); err != nil {
 		if req.Role == "middle" {
 			_, _ = h.sendNodeCommand(share.NodeID, "DeleteChains", map[string]interface{}{"chain": chainName}, false, true)
@@ -1185,7 +1152,7 @@ func (h *Handler) federationRuntimeReleaseRole(w http.ResponseWriter, r *http.Re
 		return
 	}
 
-	var runtime *repo.PeerShareRuntime
+	var runtime *sqlite.PeerShareRuntime
 	if strings.TrimSpace(req.BindingID) != "" {
 		runtime, err = h.repo.GetPeerShareRuntimeByBindingID(share.ID, strings.TrimSpace(req.BindingID))
 	} else if strings.TrimSpace(req.ReservationID) != "" {
@@ -1249,20 +1216,16 @@ func (h *Handler) federationRuntimeDiagnose(w http.ResponseWriter, r *http.Reque
 	if req.Count <= 0 {
 		req.Count = 4
 	}
-	if req.Timeout <= 0 || req.Timeout > int(diagnosisCommandTimeout/time.Millisecond) {
-		req.Timeout = int(diagnosisCommandTimeout / time.Millisecond)
-	}
-	commandTimeout := time.Duration(req.Timeout) * time.Millisecond
-	if commandTimeout <= 0 || commandTimeout > diagnosisCommandTimeout {
-		commandTimeout = diagnosisCommandTimeout
+	if req.Timeout <= 0 {
+		req.Timeout = 5000
 	}
 
-	res, err := h.sendNodeCommandWithTimeout(share.NodeID, "TcpPing", map[string]interface{}{
+	res, err := h.sendNodeCommand(share.NodeID, "TcpPing", map[string]interface{}{
 		"ip":      req.IP,
 		"port":    req.Port,
 		"count":   req.Count,
 		"timeout": req.Timeout,
-	}, commandTimeout, false, false)
+	}, false, false)
 	if err != nil {
 		response.WriteJSON(w, response.ErrDefault(err.Error()))
 		return
@@ -1315,185 +1278,12 @@ func (h *Handler) federationRuntimeCommand(w http.ResponseWriter, r *http.Reques
 		response.WriteJSON(w, response.ErrDefault(err.Error()))
 		return
 	}
-	if strings.EqualFold(cmd, "addservice") || strings.EqualFold(cmd, "updateservice") {
-		h.bindPeerShareForwardRuntimeServices(share, req.Data)
-	} else if strings.EqualFold(cmd, "deleteservice") {
-		h.releasePeerShareForwardRuntimeServices(share, req.Data)
-	}
 	response.WriteJSON(w, response.OK(res))
 }
 
-type federationForwardServiceBinding struct {
-	Name string
-	Port int
-}
-
-func extractFederationServiceEntries(data interface{}) []map[string]interface{} {
-	if data == nil {
-		return nil
-	}
-
-	if entries := asMapSlice(data); len(entries) > 0 {
-		return entries
-	}
-
-	dataMap, ok := data.(map[string]interface{})
-	if !ok {
-		return nil
-	}
-
-	if entries := asMapSlice(dataMap["services"]); len(entries) > 0 {
-		return entries
-	}
-
-	return nil
-}
-
-func parseFederationForwardServiceBindings(data interface{}) []federationForwardServiceBinding {
-	serviceList := extractFederationServiceEntries(data)
-	bindings := make([]federationForwardServiceBinding, 0, len(serviceList))
-	for _, svcMap := range serviceList {
-		name := normalizeForwardRuntimeServiceName(asString(svcMap["name"]))
-		if name == "" {
-			continue
-		}
-		if _, _, _, ok := parseFlowServiceIDs(name); !ok {
-			continue
-		}
-		addr := strings.TrimSpace(asString(svcMap["addr"]))
-		if addr == "" {
-			continue
-		}
-		_, portStr, err := net.SplitHostPort(addr)
-		if err != nil {
-			continue
-		}
-		port, err := strconv.Atoi(portStr)
-		if err != nil || port <= 0 {
-			continue
-		}
-		bindings = append(bindings, federationForwardServiceBinding{Name: name, Port: port})
-	}
-	return bindings
-}
-
-func parseFederationForwardServiceNamesForRelease(data interface{}) []string {
-	names := make(map[string]struct{})
-	appendName := func(raw string) {
-		name := normalizeForwardRuntimeServiceName(raw)
-		if name == "" {
-			return
-		}
-		if _, _, _, ok := parseFlowServiceIDs(name); !ok {
-			return
-		}
-		names[name] = struct{}{}
-	}
-
-	for _, svcMap := range extractFederationServiceEntries(data) {
-		appendName(asString(svcMap["name"]))
-	}
-
-	if dataMap, ok := data.(map[string]interface{}); ok {
-		for _, item := range asAnySlice(dataMap["services"]) {
-			appendName(asString(item))
-		}
-	}
-
-	for _, item := range asAnySlice(data) {
-		appendName(asString(item))
-	}
-
-	if len(names) == 0 {
-		return nil
-	}
-
-	out := make([]string, 0, len(names))
-	for name := range names {
-		out = append(out, name)
-	}
-	sort.Strings(out)
-	return out
-}
-
-func (h *Handler) bindPeerShareForwardRuntimeServices(share *repo.PeerShare, data interface{}) {
-	if h == nil || h.repo == nil || share == nil {
-		return
-	}
-	bindings := parseFederationForwardServiceBindings(data)
-	if len(bindings) == 0 {
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	for _, binding := range bindings {
-		runtime, err := h.repo.GetActiveForwardPeerShareRuntimeByPort(share.ID, binding.Port)
-		if err != nil {
-			continue
-		}
-		if runtime == nil {
-			runtime, err = h.repo.GetActiveForwardPeerShareRuntimeByServiceName(share.ID, binding.Name)
-			if err != nil {
-				continue
-			}
-		}
-		if runtime == nil {
-			_ = h.repo.CreatePeerShareRuntime(&repo.PeerShareRuntime{
-				ShareID:       share.ID,
-				NodeID:        share.NodeID,
-				ReservationID: randomToken(24),
-				ResourceKey:   fmt.Sprintf("forward-runtime:%d:%s:%d:%s", share.ID, binding.Name, binding.Port, randomToken(8)),
-				BindingID:     "",
-				Role:          "forward",
-				ChainName:     "",
-				ServiceName:   binding.Name,
-				Protocol:      "tcp",
-				Strategy:      "fifo",
-				Port:          binding.Port,
-				Target:        "",
-				Applied:       1,
-				Status:        1,
-				CreatedTime:   now,
-				UpdatedTime:   now,
-			})
-			continue
-		}
-		if runtime.ServiceName == binding.Name && runtime.Applied == 1 && runtime.Port == binding.Port && runtime.Status == 1 {
-			continue
-		}
-		runtime.ServiceName = binding.Name
-		runtime.Port = binding.Port
-		runtime.Applied = 1
-		runtime.Status = 1
-		runtime.UpdatedTime = now
-		if strings.TrimSpace(runtime.Protocol) == "" {
-			runtime.Protocol = "tcp"
-		}
-		if strings.TrimSpace(runtime.Strategy) == "" {
-			runtime.Strategy = "fifo"
-		}
-		_ = h.repo.UpdatePeerShareRuntime(runtime)
-	}
-}
-
-func (h *Handler) releasePeerShareForwardRuntimeServices(share *repo.PeerShare, data interface{}) {
-	if h == nil || h.repo == nil || share == nil {
-		return
-	}
-	names := parseFederationForwardServiceNamesForRelease(data)
-	if len(names) == 0 {
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	for _, name := range names {
-		_ = h.repo.MarkForwardPeerShareRuntimeReleasedByServiceName(share.ID, name, now)
-	}
-}
-
 func isFederationRuntimeCommandAllowed(commandType string) bool {
 	switch strings.ToLower(strings.TrimSpace(commandType)) {
-	case "addservice", "updateservice", "deleteservice", "pauseservice", "resumeservice", "addchains", "deletechains", "addlimiters", "updatelimiters", "deletelimiters", "tcpping", "reload":
+	case "addservice", "updateservice", "deleteservice", "pauseservice", "resumeservice", "addchains", "deletechains", "addlimiters", "deletelimiters", "tcpping", "reload":
 		return true
 	default:
 		return false
@@ -1509,37 +1299,47 @@ func isFederationServiceCommand(commandType string) bool {
 	}
 }
 
-func validateFederationCommandPorts(share *repo.PeerShare, data interface{}) error {
+func validateFederationCommandPorts(share *sqlite.PeerShare, data interface{}) error {
 	if share == nil || (share.PortRangeStart <= 0 && share.PortRangeEnd <= 0) {
 		return nil
 	}
-
-	serviceList := extractFederationServiceEntries(data)
-	if len(serviceList) == 0 {
+	dataMap, ok := data.(map[string]interface{})
+	if !ok {
 		return nil
 	}
-	for _, svcMap := range serviceList {
-		addr := asString(svcMap["addr"])
-		if addr == "" {
-			continue
+
+	if services, ok := dataMap["services"]; ok {
+		serviceList, ok := services.([]interface{})
+		if !ok {
+			return fmt.Errorf("invalid services format")
 		}
-		_, portStr, err := net.SplitHostPort(addr)
-		if err != nil {
-			return fmt.Errorf("invalid service address: %s", addr)
-		}
-		port, err := strconv.Atoi(portStr)
-		if err != nil || port <= 0 {
-			return fmt.Errorf("invalid port in service address: %s", addr)
-		}
-		if port < share.PortRangeStart || port > share.PortRangeEnd {
-			return fmt.Errorf("port %d out of allowed range %d-%d", port, share.PortRangeStart, share.PortRangeEnd)
+		for _, svc := range serviceList {
+			svcMap, ok := svc.(map[string]interface{})
+			if !ok {
+				return fmt.Errorf("invalid service entry format")
+			}
+			addr, ok := svcMap["addr"].(string)
+			if !ok || addr == "" {
+				continue
+			}
+			_, portStr, err := net.SplitHostPort(addr)
+			if err != nil {
+				return fmt.Errorf("invalid service address: %s", addr)
+			}
+			port, err := strconv.Atoi(portStr)
+			if err != nil || port <= 0 {
+				return fmt.Errorf("invalid port in service address: %s", addr)
+			}
+			if port < share.PortRangeStart || port > share.PortRangeEnd {
+				return fmt.Errorf("port %d out of allowed range %d-%d", port, share.PortRangeStart, share.PortRangeEnd)
+			}
 		}
 	}
 
 	return nil
 }
 
-func (h *Handler) pickPeerSharePort(share *repo.PeerShare, requestedPort int) (int, error) {
+func (h *Handler) pickPeerSharePort(share *sqlite.PeerShare, requestedPort int) (int, error) {
 	if share == nil {
 		return 0, fmt.Errorf("share not found")
 	}
@@ -1549,13 +1349,29 @@ func (h *Handler) pickPeerSharePort(share *repo.PeerShare, requestedPort int) (i
 
 	used := make(map[int]struct{})
 
-	nodePorts, err := h.repo.ListUsedPortsOnNode(share.NodeID)
+	rows, err := h.repo.DB().Query(`SELECT port FROM chain_tunnel WHERE node_id = ? AND port IS NOT NULL AND port > 0`, share.NodeID)
 	if err != nil {
 		return 0, err
 	}
-	for _, p := range nodePorts {
-		used[p] = struct{}{}
+	for rows.Next() {
+		var p sql.NullInt64
+		if scanErr := rows.Scan(&p); scanErr == nil && p.Valid && p.Int64 > 0 {
+			used[int(p.Int64)] = struct{}{}
+		}
 	}
+	_ = rows.Close()
+
+	rows, err = h.repo.DB().Query(`SELECT port FROM forward_port WHERE node_id = ? AND port > 0`, share.NodeID)
+	if err != nil {
+		return 0, err
+	}
+	for rows.Next() {
+		var p sql.NullInt64
+		if scanErr := rows.Scan(&p); scanErr == nil && p.Valid && p.Int64 > 0 {
+			used[int(p.Int64)] = struct{}{}
+		}
+	}
+	_ = rows.Close()
 
 	ports, err := h.repo.ListActivePeerShareRuntimePorts(share.ID, share.NodeID)
 	if err != nil {
@@ -1596,7 +1412,7 @@ func extractBearerToken(r *http.Request) string {
 	return ""
 }
 
-func isPeerShareFlowExceeded(share *repo.PeerShare) bool {
+func isPeerShareFlowExceeded(share *sqlite.PeerShare) bool {
 	if share == nil {
 		return false
 	}
@@ -1839,10 +1655,19 @@ func (h *Handler) cleanupFederationTunnels(shareID int64) {
 		return
 	}
 	namePrefix := fmt.Sprintf("Share-%d-Port-", shareID)
-	tunnelIDs, err := h.repo.ListTunnelIDsByNamePrefix(namePrefix)
-	if err != nil || len(tunnelIDs) == 0 {
+	rows, err := h.repo.DB().Query(`SELECT id FROM tunnel WHERE name LIKE ?`, namePrefix+"%")
+	if err != nil {
 		return
 	}
+	defer rows.Close()
+
+	var tunnelIDs []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err == nil {
+			tunnelIDs = append(tunnelIDs, id)
+		}
+	}
 
 	for _, tid := range tunnelIDs {
 		_ = h.deleteTunnelByID(tid)

go-backend/internal/http/handler/federation_runtime_test.go

@@ -10,33 +10,33 @@ import (
 	"time"
 
 	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 func TestPickPeerSharePortUsesRuntimeReservations(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()
 
-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()
 
-	if err := r.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, ?, ?, ?, ?, ?, ?)`, 1, 2, 1, 3000, "round", 1, "tls").Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol) VALUES(?, ?, ?, ?, ?, ?, ?)`, 1, 2, 1, 3000, "round", 1, "tls"); err != nil {
 		t.Fatalf("insert chain_tunnel: %v", err)
 	}
-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, 1, 3001).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, 1, 3001); err != nil {
 		t.Fatalf("insert forward_port: %v", err)
 	}
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 77, 1, "res-1", "rk-1", "b-1", "exit", "", "fed_svc_1", "tls", "round", 3002, "", 1, 1, now, now).Error; err != nil {
+	`, 77, 1, "res-1", "rk-1", "b-1", "exit", "", "fed_svc_1", "tls", "round", 3002, "", 1, 1, now, now); err != nil {
 		t.Fatalf("insert peer_share_runtime: %v", err)
 	}
 
-	share := &repo.PeerShare{
+	share := &sqlite.PeerShare{
 		ID:             77,
 		NodeID:         1,
 		PortRangeStart: 3000,
@@ -57,13 +57,13 @@ func TestPickPeerSharePortUsesRuntimeReservations(t *testing.T) {
 }
 
 func TestApplyTunnelRuntimeSkipsRemoteChainAndOutNodes(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "rt-skip.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "rt-skip.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()
 
-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()
 	for _, n := range []struct {
 		id   int64
@@ -73,10 +73,10 @@ func TestApplyTunnelRuntimeSkipsRemoteChainAndOutNodes(t *testing.T) {
 		{12, "remote-chain", "10.99.0.2"},
 		{13, "remote-out", "10.99.0.3"},
 	} {
-		if err := r.DB().Exec(`
+		if _, err := repo.DB().Exec(`
 			INSERT INTO node(id, name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, n.id, n.name, n.name+"-secret", n.ip, n.ip, "", "40000-40010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://remote-peer", "remote-token").Error; err != nil {
+		`, n.id, n.name, n.name+"-secret", n.ip, n.ip, "", "40000-40010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://remote-peer", "remote-token"); err != nil {
 			t.Fatalf("insert node %s: %v", n.name, err)
 		}
 	}
@@ -112,34 +112,39 @@ func TestApplyTunnelRuntimeSkipsRemoteChainAndOutNodes(t *testing.T) {
 }
 
 func TestPrepareTunnelCreateStateRemoteAutoPortDefersToFederation(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()
 
-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()
 
 	insertNode := func(name string, status int, portRange string, isRemote int) int64 {
-		if execErr := r.DB().Exec(`
+		res, execErr := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":1}`).Error; execErr != nil {
+		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":1}`)
+		if execErr != nil {
 			t.Fatalf("insert node %s: %v", name, execErr)
 		}
-		return mustLastInsertID(t, r, name)
+		id, idErr := res.LastInsertId()
+		if idErr != nil {
+			t.Fatalf("node id %s: %v", name, idErr)
+		}
+		return id
 	}
 
 	entryID := insertNode("entry", 1, "31000-31010", 0)
 	remoteOutID := insertNode("remote-out", 1, "30000", 1)
 
-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, remoteOutID, 30000).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, 1, remoteOutID, 30000); err != nil {
 		t.Fatalf("insert forward_port: %v", err)
 	}
 
-	tx := r.DB().Begin()
-	if tx.Error != nil {
+	tx, err := repo.DB().Begin()
+	if err != nil {
 		t.Fatalf("begin tx: %v", err)
 	}
 	defer tx.Rollback()
@@ -168,31 +173,36 @@ func TestPrepareTunnelCreateStateRemoteAutoPortDefersToFederation(t *testing.T)
 }
 
 func TestPrepareTunnelCreateStateAllowsOfflineRemoteMiddleNode(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()
 
-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()
 
 	insertNode := func(name string, status int, portRange string, isRemote int) int64 {
-		if execErr := r.DB().Exec(`
+		res, execErr := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":2}`).Error; execErr != nil {
+		`, name, name+"-secret", "10.0.0.1", "10.0.0.1", "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0, isRemote, "http://peer", "peer-token", `{"shareId":2}`)
+		if execErr != nil {
 			t.Fatalf("insert node %s: %v", name, execErr)
 		}
-		return mustLastInsertID(t, r, name)
+		id, idErr := res.LastInsertId()
+		if idErr != nil {
+			t.Fatalf("node id %s: %v", name, idErr)
+		}
+		return id
 	}
 
 	entryID := insertNode("entry-local", 1, "32000-32010", 0)
 	remoteMiddleID := insertNode("middle-remote", 0, "33000-33010", 1)
 	outID := insertNode("out-local", 1, "34000-34010", 0)
 
-	tx := r.DB().Begin()
-	if tx.Error != nil {
+	tx, err := repo.DB().Begin()
+	if err != nil {
 		t.Fatalf("begin tx: %v", err)
 	}
 	defer tx.Rollback()
@@ -227,71 +237,17 @@ func TestPrepareTunnelCreateStateAllowsOfflineRemoteMiddleNode(t *testing.T) {
 	}
 }
 
-func TestBuildFederationServiceConfig_MiddleRoleWithMultipleTargets_SetsRetries(t *testing.T) {
-	service := buildFederationServiceConfig("svc-middle", ":40000", "tls", "middle", "chain-next", 3, "")
-	handler := service["handler"].(map[string]interface{})
-	if handler["chain"] != "chain-next" {
-		t.Fatalf("expected chain 'chain-next', got %v", handler["chain"])
-	}
-	if handler["retries"] != 2 {
-		t.Fatalf("expected retries 2 for 3 targets, got %v", handler["retries"])
-	}
-}
-
-func TestBuildFederationServiceConfig_MiddleRoleWithSingleTarget_NoRetries(t *testing.T) {
-	service := buildFederationServiceConfig("svc-middle", ":40000", "tls", "middle", "chain-next", 1, "")
-	handler := service["handler"].(map[string]interface{})
-	if handler["chain"] != "chain-next" {
-		t.Fatalf("expected chain 'chain-next', got %v", handler["chain"])
-	}
-	if _, hasRetries := handler["retries"]; hasRetries {
-		t.Fatalf("expected no retries for single target, got %v", handler["retries"])
-	}
-}
-
-func TestBuildFederationServiceConfig_ExitRole_NoRetriesRegardlessOfTargets(t *testing.T) {
-	service := buildFederationServiceConfig("svc-exit", ":40000", "tls", "exit", "", 3, "eth0")
-	handler := service["handler"].(map[string]interface{})
-	if _, hasChain := handler["chain"]; hasChain {
-		t.Fatalf("expected no chain for exit role, got %v", handler["chain"])
-	}
-	if _, hasRetries := handler["retries"]; hasRetries {
-		t.Fatalf("expected no retries for exit role, got %v", handler["retries"])
-	}
-	metadata := service["metadata"].(map[string]interface{})
-	if metadata["interface"] != "eth0" {
-		t.Fatalf("expected interface 'eth0', got %v", metadata["interface"])
-	}
-}
-
-func TestBuildFederationServiceConfig_TLSTunnelProtocol_SetsNodelay(t *testing.T) {
-	service := buildFederationServiceConfig("svc-tls", ":40000", "tls", "middle", "chain-next", 2, "")
-	handler := service["handler"].(map[string]interface{})
-	meta := handler["metadata"].(map[string]interface{})
-	if meta["nodelay"] != true {
-		t.Fatalf("expected nodelay=true for TLS protocol, got %v", meta["nodelay"])
-	}
-}
-
-func TestBuildFederationServiceConfig_NonTLSProtocol_NoNodelay(t *testing.T) {
-	service := buildFederationServiceConfig("svc-tcp", ":40000", "tcp", "middle", "chain-next", 2, "")
-	handler := service["handler"].(map[string]interface{})
-	if _, hasMeta := handler["metadata"]; hasMeta {
-		t.Fatalf("expected no metadata for non-TLS protocol, got %v", handler["metadata"])
-	}
-}
-
 func TestFederationRuntimeReservePortRejectsWhenShareFlowExceeded(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()
 
-	h := &Handler{repo: r}
+	h := &Handler{repo: repo}
 	now := time.Now().UnixMilli()
 
-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "limited-share",
 		NodeID:         1,
 		Token:          "limited-token",

go-backend/internal/http/handler/federation_share_test.go

@@ -12,26 +12,30 @@ import (
 	"time"
 
 	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 func TestFederationShareCreateRejectsRemoteNode(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := r.DB().Exec(`
+	insertRes, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "remote-share-node", "remote-share-secret", "10.10.10.1", "10.10.10.1", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":1}`).Error; err != nil {
+	`, "remote-share-node", "remote-share-secret", "10.10.10.1", "10.10.10.1", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":1}`)
+	if err != nil {
 		t.Fatalf("insert remote node: %v", err)
 	}
-	remoteNodeID := mustLastInsertID(t, r, "remote-share-node")
+	remoteNodeID, err := insertRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get remote node id: %v", err)
+	}
 
 	body, err := json.Marshal(createPeerShareRequest{
 		Name:           "remote-node-share",
@@ -66,29 +70,36 @@ func TestFederationShareCreateRejectsRemoteNode(t *testing.T) {
 		t.Fatalf("expected rejection message %q, got %q", "Only local nodes can be shared", payload.Msg)
 	}
 
-	shareCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, remoteNodeID)
+	var shareCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, remoteNodeID).Scan(&shareCount); err != nil {
+		t.Fatalf("query peer_share count: %v", err)
+	}
 	if shareCount != 0 {
 		t.Fatalf("expected no share rows for remote node, got %d", shareCount)
 	}
 }
 
 func TestFederationShareCreateRejectsInvalidAllowedIPs(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := r.DB().Exec(`
+	insertRes, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "local-share-node", "local-share-secret", "10.20.30.40", "10.20.30.40", "", "21000-21010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
+	`, "local-share-node", "local-share-secret", "10.20.30.40", "10.20.30.40", "", "21000-21010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "")
+	if err != nil {
 		t.Fatalf("insert local node: %v", err)
 	}
-	localNodeID := mustLastInsertID(t, r, "local-share-node")
+	localNodeID, err := insertRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get local node id: %v", err)
+	}
 
 	body, err := json.Marshal(createPeerShareRequest{
 		Name:           "local-node-share",
@@ -124,23 +135,26 @@ func TestFederationShareCreateRejectsInvalidAllowedIPs(t *testing.T) {
 		t.Fatalf("expected invalid IP message, got %q", payload.Msg)
 	}
 
-	shareCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, localNodeID)
+	var shareCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE node_id = ?`, localNodeID).Scan(&shareCount); err != nil {
+		t.Fatalf("query peer_share count: %v", err)
+	}
 	if shareCount != 0 {
 		t.Fatalf("expected no share rows for node, got %d", shareCount)
 	}
 }
 
 func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "provider-share",
 		NodeID:         9,
 		Token:          "share-list-token",
@@ -155,12 +169,12 @@ func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
 		t.Fatalf("create peer share: %v", err)
 	}
 
-	share, err := r.GetPeerShareByToken("share-list-token")
+	share, err := repo.GetPeerShareByToken("share-list-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
 		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
@@ -169,7 +183,7 @@ func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
 		share.ID, share.NodeID, "r-1", "rk-1", "b-1", "middle", "fed_chain_1", "fed_svc_1", "tls", "round", 22001, "", 1, 1, now, now,
 		share.ID, share.NodeID, "r-2", "rk-2", "b-2", "exit", "", "fed_svc_2", "tls", "round", 22002, "", 1, 1, now, now,
 		share.ID, share.NodeID, "r-3", "rk-3", "", "", "", "", "tls", "round", 22003, "", 0, 0, now, now,
-	).Error; err != nil {
+	); err != nil {
 		t.Fatalf("insert peer_share_runtime rows: %v", err)
 	}
 
@@ -224,16 +238,16 @@ func TestFederationShareListIncludesRemoteUsedPorts(t *testing.T) {
 }
 
 func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "delete-cleanup-share",
 		NodeID:         99,
 		Token:          "delete-cleanup-token",
@@ -247,23 +261,26 @@ func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
 		t.Fatalf("create peer share: %v", err)
 	}
 
-	share, err := r.GetPeerShareByToken("delete-cleanup-token")
+	share, err := repo.GetPeerShareByToken("delete-cleanup-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
 		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`,
 		share.ID, 99, "dc-r1", "dc-rk1", "dc-b1", "exit", "", "fed_svc_dc1", "tls", "round", 40001, "", 1, 1, now, now,
 		share.ID, 99, "dc-r2", "dc-rk2", "dc-b2", "middle", "fed_chain_dc2", "fed_svc_dc2", "tls", "round", 40002, "", 1, 1, now, now,
-	).Error; err != nil {
+	); err != nil {
 		t.Fatalf("insert peer_share_runtime rows: %v", err)
 	}
 
-	runtimeCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1`, share.ID)
+	var runtimeCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1`, share.ID).Scan(&runtimeCount); err != nil {
+		t.Fatalf("count active runtimes before: %v", err)
+	}
 	if runtimeCount != 2 {
 		t.Fatalf("expected 2 active runtimes before delete, got %d", runtimeCount)
 	}
@@ -289,31 +306,37 @@ func TestFederationShareDeleteCleansUpRuntimes(t *testing.T) {
 		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
 	}
 
-	shareCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share WHERE id = ?`, share.ID)
+	var shareCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share WHERE id = ?`, share.ID).Scan(&shareCount); err != nil {
+		t.Fatalf("count peer_share after: %v", err)
+	}
 	if shareCount != 0 {
 		t.Fatalf("expected peer_share deleted, got %d rows", shareCount)
 	}
 
-	runtimeCountAfter := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, share.ID)
+	var runtimeCountAfter int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, share.ID).Scan(&runtimeCountAfter); err != nil {
+		t.Fatalf("count peer_share_runtime after: %v", err)
+	}
 	if runtimeCountAfter != 0 {
 		t.Fatalf("expected all peer_share_runtime rows deleted, got %d", runtimeCountAfter)
 	}
 }
 
 func TestFederationRemoteUsageListSyncErrorFallback(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "sync-error-node", "sync-error-secret", "10.50.60.70", "10.50.60.70", "", "32000-32010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://unreachable.invalid:9999", "bad-token", `{"shareId":42,"maxBandwidth":5368709120,"currentFlow":999999,"portRangeStart":32000,"portRangeEnd":32010}`).Error; err != nil {
+	`, "sync-error-node", "sync-error-secret", "10.50.60.70", "10.50.60.70", "", "32000-32010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://unreachable.invalid:9999", "bad-token", `{"shareId":42,"maxBandwidth":5368709120,"currentFlow":999999,"portRangeStart":32000,"portRangeEnd":32010}`); err != nil {
 		t.Fatalf("insert remote node: %v", err)
 	}
 
@@ -357,15 +380,15 @@ func TestFederationRemoteUsageListSyncErrorFallback(t *testing.T) {
 }
 
 func TestFederationShareResetFlow(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "reset-flow-share",
 		NodeID:         11,
 		Token:          "reset-flow-token",
@@ -379,7 +402,7 @@ func TestFederationShareResetFlow(t *testing.T) {
 	}); err != nil {
 		t.Fatalf("create peer share: %v", err)
 	}
-	share, err := r.GetPeerShareByToken("reset-flow-token")
+	share, err := repo.GetPeerShareByToken("reset-flow-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}
@@ -405,7 +428,7 @@ func TestFederationShareResetFlow(t *testing.T) {
 		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
 	}
 
-	updated, err := r.GetPeerShare(share.ID)
+	updated, err := repo.GetPeerShare(share.ID)
 	if err != nil || updated == nil {
 		t.Fatalf("reload peer share: %v", err)
 	}
@@ -414,481 +437,48 @@ func TestFederationShareResetFlow(t *testing.T) {
 	}
 }
 
-func TestFederationTunnelCreateCreatesPeerShareRuntime(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "federation-forward-node", "federation-forward-secret", "10.90.80.70", "10.90.80.70", "", "24000-24020", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	nodeID := mustLastInsertID(t, r, "federation-forward-node")
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "federation-forward-share",
-		NodeID:         nodeID,
-		Token:          "federation-forward-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 24000,
-		PortRangeEnd:   24020,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("federation-forward-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	body, err := json.Marshal(federationTunnelRequest{
-		Protocol:   "tcp",
-		RemotePort: 24001,
-		Target:     "1.1.1.1:443",
-	})
-	if err != nil {
-		t.Fatalf("marshal request: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/tunnel/create", bytes.NewReader(body))
-	req.Header.Set("Authorization", "Bearer "+share.Token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	h.federationTunnelCreate(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	runtimeCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND port = ? AND status = 1`, share.ID, 24001)
-	if runtimeCount != 1 {
-		t.Fatalf("expected 1 runtime row for new federation forward tunnel, got %d", runtimeCount)
-	}
-}
-
-func TestFederationTunnelCreateRejectsOccupiedPort(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "federation-port-check-node", "federation-port-check-secret", "10.91.80.70", "10.91.80.70", "", "24100-24120", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	nodeID := mustLastInsertID(t, r, "federation-port-check-node")
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "federation-port-check-share",
-		NodeID:         nodeID,
-		Token:          "federation-port-check-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 24100,
-		PortRangeEnd:   24120,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-
-	create := func() response.R {
-		body, err := json.Marshal(federationTunnelRequest{Protocol: "tcp", RemotePort: 24101, Target: "1.1.1.1:443"})
-		if err != nil {
-			t.Fatalf("marshal request: %v", err)
-		}
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/tunnel/create", bytes.NewReader(body))
-		req.Header.Set("Authorization", "Bearer federation-port-check-token")
-		req.Header.Set("Content-Type", "application/json")
-		res := httptest.NewRecorder()
-		h.federationTunnelCreate(res, req)
-		if res.Code != http.StatusOK {
-			t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-		}
-		var payload response.R
-		if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		return payload
-	}
-
-	first := create()
-	if first.Code != 0 {
-		t.Fatalf("expected first create success, got %d (%s)", first.Code, first.Msg)
-	}
-
-	second := create()
-	if second.Code != 403 {
-		t.Fatalf("expected second create to be rejected with 403, got %d (%s)", second.Code, second.Msg)
-	}
-	if second.Msg != "Port already in use" {
-		t.Fatalf("expected occupied port message, got %q", second.Msg)
-	}
-}
-
-func TestDeleteTunnelReleasesFederationForwardRuntimeByPort(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "delete-forward-share",
-		NodeID:         1,
-		Token:          "delete-forward-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 25000,
-		PortRangeEnd:   25020,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("delete-forward-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	tunnelName := fmt.Sprintf("Share-%d-Port-%d", share.ID, 25001)
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 1, tunnelName, 1.0, 1, "tcp", 1, now, now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "del-r1", "del-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 25001, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert runtime: %v", err)
-	}
-
-	if err := h.deleteTunnelByID(1); err != nil {
-		t.Fatalf("delete tunnel: %v", err)
-	}
-
-	activeCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND port = ? AND status = 1`, share.ID, 25001)
-	if activeCount != 0 {
-		t.Fatalf("expected runtime released after tunnel delete, active rows=%d", activeCount)
-	}
-}
-
-func TestBindPeerShareForwardRuntimeServicesOnlyBindsForwardRole(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "bind-forward-role-share",
-		NodeID:         1,
-		Token:          "bind-forward-role-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26000,
-		PortRangeEnd:   26020,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("bind-forward-role-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		1, share.ID, share.NodeID, "bind-r1", "bind-rk1", "", "forward", "", "", "tcp", "fifo", 26001, "", 0, 1, now, now,
-		2, share.ID, share.NodeID, "bind-r2", "bind-rk2", "", "middle", "", "", "tcp", "round", 26002, "", 0, 1, now, now,
-	).Error; err != nil {
-		t.Fatalf("insert runtimes: %v", err)
-	}
-
-	h.bindPeerShareForwardRuntimeServices(share, map[string]interface{}{
-		"services": []interface{}{
-			map[string]interface{}{"name": "77_2_10_tcp", "addr": "[::]:26001"},
-			map[string]interface{}{"name": "88_2_10_tcp", "addr": "[::]:26002"},
-		},
-	})
-
-	forwardServiceName := ""
-	middleServiceName := ""
-	if err := r.DB().Raw(`SELECT service_name FROM peer_share_runtime WHERE id = 1`).Scan(&forwardServiceName).Error; err != nil {
-		t.Fatalf("load forward runtime service name: %v", err)
-	}
-	if err := r.DB().Raw(`SELECT service_name FROM peer_share_runtime WHERE id = 2`).Scan(&middleServiceName).Error; err != nil {
-		t.Fatalf("load middle runtime service name: %v", err)
-	}
-
-	if forwardServiceName != "77_2_10" {
-		t.Fatalf("expected forward runtime service name bound, got %q", forwardServiceName)
-	}
-	if middleServiceName != "" {
-		t.Fatalf("expected non-forward runtime unchanged, got %q", middleServiceName)
-	}
-}
-
-func TestBindPeerShareForwardRuntimeServicesAcceptsTopLevelServiceArray(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "bind-array-share",
-		NodeID:         1,
-		Token:          "bind-array-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26100,
-		PortRangeEnd:   26120,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("bind-array-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		1, share.ID, share.NodeID, "bind-array-r1", "bind-array-rk1", "", "forward", "", "", "tcp", "fifo", 26101, "", 0, 1, now, now,
-	).Error; err != nil {
-		t.Fatalf("insert runtime: %v", err)
-	}
-
-	h.bindPeerShareForwardRuntimeServices(share, []interface{}{
-		map[string]interface{}{"name": "99_2_10_tcp", "addr": "[::]:26101"},
-		map[string]interface{}{"name": "99_2_10_udp", "addr": "[::]:26101"},
-	})
-
-	forwardServiceName := ""
-	if err := r.DB().Raw(`SELECT service_name FROM peer_share_runtime WHERE id = 1`).Scan(&forwardServiceName).Error; err != nil {
-		t.Fatalf("load forward runtime service name: %v", err)
-	}
-	if forwardServiceName != "99_2_10" {
-		t.Fatalf("expected forward runtime service name bound from top-level array, got %q", forwardServiceName)
-	}
-}
-
-func TestBindPeerShareForwardRuntimeServicesCreatesRuntimeWhenMissing(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-bind-create-runtime.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "bind-create-runtime-share",
-		NodeID:         1,
-		Token:          "bind-create-runtime-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26300,
-		PortRangeEnd:   26320,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("bind-create-runtime-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	h.bindPeerShareForwardRuntimeServices(share, map[string]interface{}{
-		"services": []interface{}{
-			map[string]interface{}{"name": "55_2_10_tcp", "addr": "[::]:26301"},
-		},
-	})
-
-	var count int64
-	if err := r.DB().Raw(`SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND role = ? AND status = 1`, share.ID, "forward").Scan(&count).Error; err != nil {
-		t.Fatalf("query runtime count: %v", err)
-	}
-	if count != 1 {
-		t.Fatalf("expected 1 active forward runtime row, got %d", count)
-	}
-
-	var serviceName string
-	var port int
-	var applied int
-	if err := r.DB().Raw(`SELECT service_name, port, applied FROM peer_share_runtime WHERE share_id = ? AND role = ? ORDER BY id DESC LIMIT 1`, share.ID, "forward").Row().Scan(&serviceName, &port, &applied); err != nil {
-		t.Fatalf("query created runtime: %v", err)
-	}
-	if serviceName != "55_2_10" {
-		t.Fatalf("expected service_name=55_2_10, got %q", serviceName)
-	}
-	if port != 26301 {
-		t.Fatalf("expected port=26301, got %d", port)
-	}
-	if applied != 1 {
-		t.Fatalf("expected applied=1, got %d", applied)
-	}
-}
-
-func TestReleasePeerShareForwardRuntimeServicesMarksRuntimeReleased(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-release-runtime.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "release-runtime-share",
-		NodeID:         1,
-		Token:          "release-runtime-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 26400,
-		PortRangeEnd:   26420,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("release-runtime-token")
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "release-r1", "release-rk1", "", "forward", "", "77_2_10", "tcp", "fifo", 26401, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert runtime: %v", err)
-	}
-
-	h.releasePeerShareForwardRuntimeServices(share, map[string]interface{}{
-		"services": []interface{}{"77_2_10_tcp"},
-	})
-
-	var status int
-	var applied int
-	var serviceName string
-	if err := r.DB().Raw(`SELECT status, applied, service_name FROM peer_share_runtime WHERE share_id = ? AND role = ? ORDER BY id DESC LIMIT 1`, share.ID, "forward").Row().Scan(&status, &applied, &serviceName); err != nil {
-		t.Fatalf("query released runtime: %v", err)
-	}
-	if status != 0 {
-		t.Fatalf("expected status=0 after release, got %d", status)
-	}
-	if applied != 0 {
-		t.Fatalf("expected applied=0 after release, got %d", applied)
-	}
-	if serviceName != "" {
-		t.Fatalf("expected service_name cleared after release, got %q", serviceName)
-	}
-}
-
-func TestValidateFederationCommandPortsAcceptsTopLevelServiceArray(t *testing.T) {
-	share := &repo.PeerShare{
-		PortRangeStart: 26200,
-		PortRangeEnd:   26210,
-	}
-	err := validateFederationCommandPorts(share, []interface{}{
-		map[string]interface{}{"name": "11_2_10_tcp", "addr": "[::]:26201"},
-		map[string]interface{}{"name": "11_2_10_udp", "addr": "[::]:26201"},
-	})
-	if err != nil {
-		t.Fatalf("expected top-level service array to pass port validation, got: %v", err)
-	}
-}
-
 func TestFederationRemoteUsageList(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := r.DB().Exec(`
+	resNode, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "remote-consumer-node", "remote-consumer-secret", "10.30.40.50", "10.30.40.50", "", "31000-31010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":88,"maxBandwidth":2147483648,"currentFlow":1073741824,"portRangeStart":31000,"portRangeEnd":31010}`).Error; err != nil {
+	`, "remote-consumer-node", "remote-consumer-secret", "10.30.40.50", "10.30.40.50", "", "31000-31010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "http://peer.example", "peer-token", `{"shareId":88,"maxBandwidth":2147483648,"currentFlow":1073741824,"portRangeStart":31000,"portRangeEnd":31010}`)
+	if err != nil {
 		t.Fatalf("insert remote node: %v", err)
 	}
-	nodeID := mustLastInsertID(t, r, "remote-consumer-node")
+	nodeID, err := resNode.LastInsertId()
+	if err != nil {
+		t.Fatalf("remote node id: %v", err)
+	}
 
-	if err := r.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-a", 2, "tls", 1, now, now, 1, "", 0).Error; err != nil {
+	resTunnelA, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-a", 2, "tls", 1, now, now, 1, "", 0)
+	if err != nil {
 		t.Fatalf("insert tunnel a: %v", err)
 	}
-	tunnelAID := mustLastInsertID(t, r, "consumer-tunnel-a")
+	tunnelAID, _ := resTunnelA.LastInsertId()
 
-	if err := r.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-b", 2, "tls", 1, now, now, 1, "", 0).Error; err != nil {
+	resTunnelB, err := repo.DB().Exec(`INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)`, "consumer-tunnel-b", 2, "tls", 1, now, now, 1, "", 0)
+	if err != nil {
 		t.Fatalf("insert tunnel b: %v", err)
 	}
-	tunnelBID := mustLastInsertID(t, r, "consumer-tunnel-b")
+	tunnelBID, _ := resTunnelB.LastInsertId()
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx, remote_url, resource_key, remote_binding_id, allocated_port, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
 		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
 	`,
 		tunnelAID, nodeID, 2, 1, "http://peer.example", "rk-a", "rb-a", 31001, 1, now, now,
 		tunnelBID, nodeID, 3, 0, "http://peer.example", "rk-b", "rb-b", 31002, 1, now, now,
-	).Error; err != nil {
+	); err != nil {
 		t.Fatalf("insert federation bindings: %v", err)
 	}
 
@@ -941,118 +531,14 @@ func TestFederationRemoteUsageList(t *testing.T) {
 	}
 }
 
-func TestFederationRemoteUsageListIncludesForwardPorts(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-usage.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "test-jwt-secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "forward-usage-remote-node", "forward-usage-secret", "10.60.70.80", "10.60.70.80", "", "33000-33010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "", "", `{"shareId":99,"maxBandwidth":0,"currentFlow":0,"portRangeStart":33000,"portRangeEnd":33010}`).Error; err != nil {
-		t.Fatalf("insert remote node: %v", err)
-	}
-
-	var nodeID int64
-	if err := r.DB().Raw(`SELECT id FROM node WHERE name = ? ORDER BY id DESC LIMIT 1`, "forward-usage-remote-node").Row().Scan(&nodeID); err != nil {
-		t.Fatalf("query node id: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "forward-usage-tunnel", 1, "tls", 1, now, now, 1, "", 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	var tunnelID int64
-	if err := r.DB().Raw(`SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, "forward-usage-tunnel").Row().Scan(&tunnelID); err != nil {
-		t.Fatalf("query tunnel id: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 1, "tester", "forward-usage-item", tunnelID, "1.1.1.1:443", "fifo", 0, 0, now, now, 1, 0).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	var forwardID int64
-	if err := r.DB().Raw(`SELECT id FROM forward WHERE name = ? ORDER BY id DESC LIMIT 1`, "forward-usage-item").Row().Scan(&forwardID); err != nil {
-		t.Fatalf("query forward id: %v", err)
-	}
-
-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeID, 33001).Error; err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/federation/share/remote-usage/list", nil)
-	res := httptest.NewRecorder()
-	h.federationRemoteUsageList(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status %d, got %d", http.StatusOK, res.Code)
-	}
-
-	var payload response.R
-	if err := json.NewDecoder(res.Body).Decode(&payload); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if payload.Code != 0 {
-		t.Fatalf("expected response code 0, got %d (%s)", payload.Code, payload.Msg)
-	}
-
-	rows, ok := payload.Data.([]interface{})
-	if !ok || len(rows) == 0 {
-		t.Fatalf("expected non-empty usage list, got %T", payload.Data)
-	}
-
-	first, ok := rows[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected usage row map, got %T", rows[0])
-	}
-
-	usedPortsRaw, ok := first["usedPorts"].([]interface{})
-	if !ok {
-		t.Fatalf("expected usedPorts array, got %T", first["usedPorts"])
-	}
-	if len(usedPortsRaw) != 1 || int(usedPortsRaw[0].(float64)) != 33001 {
-		t.Fatalf("expected usedPorts [33001], got %v", usedPortsRaw)
-	}
-
-	bindingsRaw, ok := first["bindings"].([]interface{})
-	if !ok {
-		t.Fatalf("expected bindings array, got %T", first["bindings"])
-	}
-	if len(bindingsRaw) != 1 {
-		t.Fatalf("expected 1 binding row from forward usage, got %d", len(bindingsRaw))
-	}
-
-	binding, ok := bindingsRaw[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected binding row object, got %T", bindingsRaw[0])
-	}
-	if int(binding["allocatedPort"].(float64)) != 33001 {
-		t.Fatalf("expected allocatedPort=33001, got %v", binding["allocatedPort"])
-	}
-	if int(binding["chainType"].(float64)) != 1 {
-		t.Fatalf("expected chainType=1 for forward usage row, got %v", binding["chainType"])
-	}
-}
-
 func TestAuthPeerAllowedIPs(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "test-jwt-secret")
+	h := New(repo, "test-jwt-secret")
 	now := time.Now().UnixMilli()
 
 	tests := []struct {
@@ -1099,7 +585,7 @@ func TestAuthPeerAllowedIPs(t *testing.T) {
 	for idx, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			token := fmt.Sprintf("share-token-%d", idx)
-			if err := r.CreatePeerShare(&repo.PeerShare{
+			if err := repo.CreatePeerShare(&sqlite.PeerShare{
 				Name:           "share-" + tt.name,
 				NodeID:         1,
 				Token:          token,

go-backend/internal/http/handler/flow_policy.go

@@ -1,14 +1,11 @@
 package handler
 
 import (
+	"database/sql"
 	"encoding/json"
-	"errors"
-	"log"
 	"strconv"
 	"strings"
 	"time"
-
-	"go-backend/internal/store/model"
 )
 
 const bytesPerGB int64 = 1024 * 1024 * 1024
@@ -34,7 +31,7 @@ type namedConfigItem struct {
 	Name string `json:"name"`
 }
 
-func (h *Handler) processFlowItem(nodeID int64, item flowItem) {
+func (h *Handler) processFlowItem(item flowItem) {
 	serviceName := strings.TrimSpace(item.N)
 	if serviceName == "" || serviceName == "web_api" {
 		return
@@ -44,10 +41,6 @@ func (h *Handler) processFlowItem(nodeID int64, item flowItem) {
 	if ok {
 		inFlow, outFlow := h.scaleFlowByTunnel(forwardID, item.D, item.U)
 		_ = h.repo.AddFlow(forwardID, userID, userTunnelID, inFlow, outFlow)
-		if quota, quotaErr := h.repo.AddUserQuotaUsage(userID, inFlow+outFlow, time.Now()); quotaErr == nil {
-			h.enforceUserQuotaIfNeeded(userID, quota)
-		}
-		h.processPeerShareFlowFromForward(forwardID, nodeID, serviceName, item)
 
 		if userTunnelID > 0 {
 			h.enforceFlowPolicies(userID, userTunnelID)
@@ -95,45 +88,6 @@ func parsePeerShareRuntimeServiceID(serviceName string) (int64, bool) {
 	return runtimeID, true
 }
 
-func parsePeerShareInfoFromFederationTunnelName(tunnelName string) (int64, int, bool) {
-	tunnelName = strings.TrimSpace(tunnelName)
-	if !strings.HasPrefix(tunnelName, "Share-") {
-		return 0, 0, false
-	}
-	raw := strings.TrimPrefix(tunnelName, "Share-")
-	idx := strings.Index(raw, "-Port-")
-	if idx <= 0 {
-		return 0, 0, false
-	}
-	shareID, err := strconv.ParseInt(raw[:idx], 10, 64)
-	if err != nil || shareID <= 0 {
-		return 0, 0, false
-	}
-	portValue := strings.TrimSpace(raw[idx+len("-Port-"):])
-	port, err := strconv.Atoi(portValue)
-	if err != nil || port <= 0 {
-		return 0, 0, false
-	}
-	return shareID, port, true
-}
-
-func parsePeerShareIDFromFederationTunnelName(tunnelName string) (int64, bool) {
-	tunnelName = strings.TrimSpace(tunnelName)
-	if !strings.HasPrefix(tunnelName, "Share-") {
-		return 0, false
-	}
-	raw := strings.TrimPrefix(tunnelName, "Share-")
-	idx := strings.Index(raw, "-Port-")
-	if idx <= 0 {
-		return 0, false
-	}
-	shareID, err := strconv.ParseInt(raw[:idx], 10, 64)
-	if err != nil || shareID <= 0 {
-		return 0, false
-	}
-	return shareID, true
-}
-
 func (h *Handler) processPeerShareFlow(runtimeID int64, item flowItem) {
 	if h == nil || h.repo == nil || runtimeID <= 0 {
 		return
@@ -160,121 +114,6 @@ func (h *Handler) processPeerShareFlow(runtimeID int64, item flowItem) {
 	h.enforcePeerShareFlowLimit(share.ID)
 }
 
-func (h *Handler) processPeerShareFlowFromForward(forwardID int64, nodeID int64, serviceName string, item flowItem) {
-	if h == nil || h.repo == nil || forwardID <= 0 {
-		return
-	}
-
-	delta := item.D + item.U
-	if delta <= 0 {
-		return
-	}
-
-	forward, err := h.getForwardRecord(forwardID)
-	if err != nil || forward == nil {
-		// Forward not found in local database - might be a federation port-forward
-		// Try to find by service name in peer_share_runtime
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-	tunnelName, err := h.repo.GetTunnelName(forward.TunnelID)
-	if err != nil {
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-	shareID, ok := parsePeerShareIDFromFederationTunnelName(tunnelName)
-	if !ok {
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-
-	if err := h.repo.AddPeerShareCurrentFlow(shareID, delta); err != nil {
-		h.processPeerShareFlowByServiceName(nodeID, serviceName, item)
-		return
-	}
-
-	share, err := h.repo.GetPeerShare(shareID)
-	if err != nil || share == nil {
-		return
-	}
-	if !isPeerShareFlowExceeded(share) {
-		return
-	}
-	h.enforcePeerShareFlowLimit(share.ID)
-}
-
-func normalizeForwardRuntimeServiceName(serviceName string) string {
-	name := strings.TrimSpace(serviceName)
-	if strings.HasSuffix(name, "_tcp") {
-		return strings.TrimSuffix(name, "_tcp")
-	}
-	if strings.HasSuffix(name, "_udp") {
-		return strings.TrimSuffix(name, "_udp")
-	}
-	return name
-}
-
-func (h *Handler) processPeerShareFlowByServiceName(nodeID int64, serviceName string, item flowItem) {
-	if h == nil || h.repo == nil || strings.TrimSpace(serviceName) == "" {
-		return
-	}
-
-	delta := item.D + item.U
-	if delta <= 0 {
-		return
-	}
-
-	normalized := normalizeForwardRuntimeServiceName(serviceName)
-	var runtimes []model.PeerShareRuntime
-	var err error
-
-	// Try node-scoped query first if nodeID is valid
-	if nodeID > 0 {
-		runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByNodeAndServiceName(nodeID, normalized)
-		if err != nil {
-			return
-		}
-		if len(runtimes) == 0 && normalized != serviceName {
-			runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByNodeAndServiceName(nodeID, serviceName)
-			if err != nil {
-				return
-			}
-		}
-	}
-
-	// Fallback to global query if node-scoped query returned nothing or nodeID is invalid
-	if len(runtimes) == 0 {
-		runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByServiceName(normalized)
-		if err != nil {
-			return
-		}
-		if len(runtimes) == 0 && normalized != serviceName {
-			runtimes, err = h.repo.ListActiveForwardPeerShareRuntimesByServiceName(serviceName)
-			if err != nil {
-				return
-			}
-		}
-	}
-
-	if len(runtimes) != 1 {
-		if len(runtimes) > 1 {
-			log.Printf("WARN: ambiguous peer share runtime match for service=%s nodeID=%d count=%d", serviceName, nodeID, len(runtimes))
-		}
-		return
-	}
-	runtime := runtimes[0]
-
-	_ = h.repo.AddPeerShareCurrentFlow(runtime.ShareID, delta)
-
-	matchedShare, err := h.repo.GetPeerShare(runtime.ShareID)
-	if err != nil || matchedShare == nil {
-		return
-	}
-	if isPeerShareFlowExceeded(matchedShare) {
-		h.enforcePeerShareFlowLimit(matchedShare.ID)
-	}
-}
-
 func (h *Handler) enforcePeerShareFlowLimit(shareID int64) {
 	if h == nil || h.repo == nil || shareID <= 0 {
 		return
@@ -331,70 +170,6 @@ func (h *Handler) enforceFlowPolicies(userID int64, userTunnelID int64) {
 	}
 }
 
-func (h *Handler) ensureUserTunnelForwardAllowed(userID int64, tunnelID int64, now int64) error {
-	if h == nil || h.repo == nil {
-		return errors.New("invalid flow policy context")
-	}
-	if userID <= 0 || tunnelID <= 0 {
-		return nil
-	}
-
-	user, err := h.repo.GetUserByID(userID)
-	if err != nil {
-		return err
-	}
-	if user == nil {
-		return errors.New("用户不存在")
-	}
-
-	if user.Status != 1 {
-		return errors.New("账号已禁用")
-	}
-	if user.ExpTime > 0 && user.ExpTime <= now {
-		return errors.New("账号已过期")
-	}
-
-	flowLimit := user.Flow * bytesPerGB
-	current := user.InFlow + user.OutFlow
-	if flowLimit < current {
-		return errors.New("流量已超额，禁止开启转发")
-	}
-	if err := h.ensureUserForwardAllowedByQuota(userID, now); err != nil {
-		return err
-	}
-
-	userTunnelID, _, _, err := h.resolveUserTunnelAndLimiter(userID, tunnelID)
-	if err != nil {
-		return err
-	}
-	if userTunnelID <= 0 {
-		return nil
-	}
-
-	policy, err := h.getUserTunnelPolicy(userTunnelID)
-	if err != nil {
-		return err
-	}
-	if policy == nil {
-		return nil
-	}
-
-	if policy.Status != 1 {
-		return errors.New("该隧道已禁用")
-	}
-	if policy.ExpTime > 0 && policy.ExpTime <= now {
-		return errors.New("该隧道已过期")
-	}
-
-	utFlowLimit := policy.Flow * bytesPerGB
-	utCurrent := policy.InFlow + policy.OutFlow
-	if utCurrent >= utFlowLimit {
-		return errors.New("该隧道流量已超额，禁止开启转发")
-	}
-
-	return nil
-}
-
 func (h *Handler) shouldPauseUser(userID int64, now int64) bool {
 	user, err := h.repo.GetUserByID(userID)
 	if err != nil || user == nil {
@@ -432,18 +207,22 @@ func (h *Handler) getUserTunnelPolicy(userTunnelID int64) (*userTunnelPolicy, er
 	if userTunnelID <= 0 {
 		return nil, nil
 	}
-	ut, err := h.repo.GetUserTunnelByID(userTunnelID)
-	if err != nil {
+
+	row := h.repo.DB().QueryRow(`
+		SELECT id, user_id, tunnel_id, flow, in_flow, out_flow, exp_time, status
+		FROM user_tunnel
+		WHERE id = ?
+		LIMIT 1
+	`, userTunnelID)
+
+	var policy userTunnelPolicy
+	if err := row.Scan(&policy.ID, &policy.UserID, &policy.TunnelID, &policy.Flow, &policy.InFlow, &policy.OutFlow, &policy.ExpTime, &policy.Status); err != nil {
+		if err == sql.ErrNoRows {
+			return nil, nil
+		}
 		return nil, err
 	}
-	if ut == nil {
-		return nil, nil
-	}
-	return &userTunnelPolicy{
-		ID: ut.ID, UserID: ut.UserID, TunnelID: ut.TunnelID,
-		Flow: ut.Flow, InFlow: ut.InFlow, OutFlow: ut.OutFlow,
-		ExpTime: ut.ExpTime, Status: ut.Status,
-	}, nil
+	return &policy, nil
 }
 
 func (h *Handler) pauseUserForwards(userID int64, now int64) {
@@ -466,20 +245,60 @@ func (h *Handler) pauseForwardRecords(forwards []forwardRecord, now int64) {
 	for i := range forwards {
 		forward := forwards[i]
 		_ = h.controlForwardServices(&forward, "PauseService", false)
-		_ = h.repo.UpdateForwardStatus(forward.ID, 0, now)
+		_, _ = h.repo.DB().Exec(`UPDATE forward SET status = 0, updated_time = ? WHERE id = ?`, now, forward.ID)
 	}
 }
 
 func (h *Handler) listActiveForwardsByUser(userID int64) ([]forwardRecord, error) {
-	return h.repo.ListActiveForwardsByUser(userID)
+	rows, err := h.repo.DB().Query(`
+		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, COALESCE(strategy, 'fifo'), status
+		FROM forward
+		WHERE user_id = ? AND status = 1
+		ORDER BY id ASC
+	`, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanForwardRecords(rows)
 }
 
 func (h *Handler) listActiveForwardsByUserTunnel(userID int64, tunnelID int64) ([]forwardRecord, error) {
-	return h.repo.ListActiveForwardsByUserTunnel(userID, tunnelID)
+	rows, err := h.repo.DB().Query(`
+		SELECT id, user_id, user_name, name, tunnel_id, remote_addr, COALESCE(strategy, 'fifo'), status
+		FROM forward
+		WHERE user_id = ? AND tunnel_id = ? AND status = 1
+		ORDER BY id ASC
+	`, userID, tunnelID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	return scanForwardRecords(rows)
+}
+
+func scanForwardRecords(rows *sql.Rows) ([]forwardRecord, error) {
+	out := make([]forwardRecord, 0)
+	for rows.Next() {
+		var record forwardRecord
+		if err := rows.Scan(&record.ID, &record.UserID, &record.UserName, &record.Name, &record.TunnelID, &record.RemoteAddr, &record.Strategy, &record.Status); err != nil {
+			return nil, err
+		}
+		if strings.TrimSpace(record.Strategy) == "" {
+			record.Strategy = "fifo"
+		}
+		out = append(out, record)
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return out, nil
 }
 
 func (h *Handler) cleanNodeConfigs(nodeID int64, rawConfig string) {
-	if h == nil || h.repo == nil || nodeID <= 0 {
+	if h == nil || h.repo == nil || h.repo.DB() == nil || nodeID <= 0 {
 		return
 	}
 	if strings.TrimSpace(rawConfig) == "" {
@@ -497,46 +316,15 @@ func (h *Handler) cleanNodeConfigs(nodeID int64, rawConfig string) {
 }
 
 func (h *Handler) cleanOrphanedServices(nodeID int64, services []namedConfigItem) {
-	runtimeServiceNames, err := h.repo.ListActiveForwardPeerShareRuntimeServiceNamesByNode(nodeID)
-	if err != nil {
-		return
-	}
-	minUpdatedTime := time.Now().Add(-10 * time.Minute).UnixMilli()
-	hasUnboundForwardPeerRuntime, err := h.repo.HasRecentUnboundForwardPeerShareRuntimeOnNode(nodeID, minUpdatedTime)
-	if err != nil {
-		hasUnboundForwardPeerRuntime = false
-	}
-	runtimeServiceSet := make(map[string]struct{}, len(runtimeServiceNames))
-	for _, serviceName := range runtimeServiceNames {
-		serviceName = strings.TrimSpace(serviceName)
-		if serviceName == "" {
-			continue
-		}
-		runtimeServiceSet[serviceName] = struct{}{}
-	}
-
 	for _, item := range services {
 		name := strings.TrimSpace(item.Name)
 		if name == "" || name == "web_api" {
 			continue
 		}
-		if strings.HasPrefix(name, "fed_svc_") {
-			continue
-		}
-		normalizedName := normalizeForwardRuntimeServiceName(name)
-		if _, ok := runtimeServiceSet[normalizedName]; ok {
-			continue
-		}
-		if _, ok := runtimeServiceSet[name]; ok {
-			continue
-		}
 
 		parts := strings.Split(name, "_")
 		if len(parts) >= 3 {
 			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
-			if err == nil && forwardID > 0 && hasUnboundForwardPeerRuntime {
-				continue
-			}
 			if err == nil && forwardID > 0 && !h.forwardExists(forwardID) {
 				_, _ = h.sendNodeCommand(nodeID, "DeleteService", map[string]interface{}{"services": []string{name, parts[0] + "_" + parts[1] + "_" + parts[2], parts[0] + "_" + parts[1] + "_" + parts[2] + "_tcp", parts[0] + "_" + parts[1] + "_" + parts[2] + "_udp"}}, false, true)
 				continue
@@ -556,9 +344,6 @@ func (h *Handler) cleanOrphanedServices(nodeID int64, services []namedConfigItem
 				continue
 			}
 			forwardID, err := strconv.ParseInt(parts[0], 10, 64)
-			if err == nil && forwardID > 0 && hasUnboundForwardPeerRuntime {
-				continue
-			}
 			if err != nil || forwardID <= 0 || h.forwardExists(forwardID) {
 				continue
 			}
@@ -598,13 +383,15 @@ func (h *Handler) cleanOrphanedLimiters(nodeID int64, limiters []namedConfigItem
 }
 
 func (h *Handler) tunnelExists(tunnelID int64) bool {
-	ok, _ := h.repo.TunnelExists(tunnelID)
-	return ok
+	var count int
+	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM tunnel WHERE id = ?`, tunnelID).Scan(&count)
+	return err == nil && count > 0
 }
 
 func (h *Handler) forwardExists(forwardID int64) bool {
-	ok, _ := h.repo.ForwardExists(forwardID)
-	return ok
+	var count int
+	err := h.repo.DB().QueryRow(`SELECT COUNT(1) FROM forward WHERE id = ?`, forwardID).Scan(&count)
+	return err == nil && count > 0
 }
 
 func (h *Handler) speedLimiterExists(name string) bool {
@@ -615,6 +402,8 @@ func (h *Handler) speedLimiterExists(name string) bool {
 	if err != nil || id <= 0 {
 		return false
 	}
-	ok, _ := h.repo.SpeedLimitExists(id)
-	return ok
+
+	var count int
+	err = h.repo.DB().QueryRow(`SELECT COUNT(1) FROM speed_limit WHERE id = ?`, id).Scan(&count)
+	return err == nil && count > 0
 }

go-backend/internal/http/handler/flow_policy_federation_test.go

@@ -2,22 +2,21 @@ package handler
 
 import (
 	"path/filepath"
-	"strconv"
 	"testing"
 	"time"
 
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
+	repo, err := sqlite.Open(filepath.Join(t.TempDir(), "panel.db"))
 	if err != nil {
 		t.Fatalf("open repo: %v", err)
 	}
-	defer r.Close()
+	defer repo.Close()
 
 	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
+	if err := repo.CreatePeerShare(&sqlite.PeerShare{
 		Name:           "flow-share",
 		NodeID:         1,
 		Token:          "flow-share-token",
@@ -31,22 +30,22 @@ func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
 	}); err != nil {
 		t.Fatalf("create peer share: %v", err)
 	}
-	share, err := r.GetPeerShareByToken("flow-share-token")
+	share, err := repo.GetPeerShareByToken("flow-share-token")
 	if err != nil || share == nil {
 		t.Fatalf("load peer share: %v", err)
 	}
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO peer_share_runtime(id, share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 17, share.ID, share.NodeID, "res-17", "rk-17", "17", "exit", "", "fed_svc_17", "tls", "round", 32001, "", 1, 1, now, now).Error; err != nil {
+	`, 17, share.ID, share.NodeID, "res-17", "rk-17", "17", "exit", "", "fed_svc_17", "tls", "round", 32001, "", 1, 1, now, now); err != nil {
 		t.Fatalf("insert peer_share_runtime: %v", err)
 	}
 
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "fed_svc_17", U: 1200, D: 900})
+	h := &Handler{repo: repo}
+	h.processFlowItem(flowItem{N: "fed_svc_17", U: 1200, D: 900})
 
-	updatedShare, err := r.GetPeerShare(share.ID)
+	updatedShare, err := repo.GetPeerShare(share.ID)
 	if err != nil || updatedShare == nil {
 		t.Fatalf("reload share: %v", err)
 	}
@@ -54,7 +53,7 @@ func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
 		t.Fatalf("expected current_flow=3100, got %d", updatedShare.CurrentFlow)
 	}
 
-	runtime, err := r.GetPeerShareRuntimeByID(17)
+	runtime, err := repo.GetPeerShareRuntimeByID(17)
 	if err != nil || runtime == nil {
 		t.Fatalf("reload runtime: %v", err)
 	}
@@ -62,345 +61,3 @@ func TestProcessFlowItemTracksPeerShareFlowAndEnforcesLimit(t *testing.T) {
 		t.Fatalf("expected runtime status=0 after limit enforcement, got %d", runtime.Status)
 	}
 }
-
-func TestProcessFlowItemTracksPeerShareFlowForFederationPortForward(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "forward-share",
-		NodeID:         1,
-		Token:          "forward-share-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 30000,
-		PortRangeEnd:   30010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("forward-share-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'u2', 'x', 1, ?, 99999, 0, 0, 1, 1, ?, ?, 1)
-	`, now+24*60*60*1000, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	tunnelName := "Share-" + strconv.FormatInt(share.ID, 10) + "-Port-30001"
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(1, ?, 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, tunnelName, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, 2, 1, NULL, 1, 99999, 0, 0, 1, ?, 1)
-	`, now+24*60*60*1000).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(20, 2, 'u2', 'f20', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "20_2_10", U: 120, D: 80})
-
-	updatedShare, err := r.GetPeerShare(share.ID)
-	if err != nil || updatedShare == nil {
-		t.Fatalf("reload share: %v", err)
-	}
-	if updatedShare.CurrentFlow != 200 {
-		t.Fatalf("expected current_flow=200, got %d", updatedShare.CurrentFlow)
-	}
-}
-
-func TestProcessFlowItemTracksPeerShareFlowByForwardServiceName(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-service.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "forward-service-share",
-		NodeID:         1,
-		Token:          "forward-service-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31000,
-		PortRangeEnd:   31010,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("forward-service-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "svc-r1", "svc-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 31001, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "20_2_10_tcp", U: 120, D: 80})
-
-	updatedShare, err := r.GetPeerShare(share.ID)
-	if err != nil || updatedShare == nil {
-		t.Fatalf("reload share: %v", err)
-	}
-	if updatedShare.CurrentFlow != 200 {
-		t.Fatalf("expected current_flow=200, got %d", updatedShare.CurrentFlow)
-	}
-}
-
-func TestProcessFlowItemFallsBackToServiceNameWhenForwardIDCollidesAcrossPanels(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-collision.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "collision-share",
-		NodeID:         1,
-		Token:          "collision-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31400,
-		PortRangeEnd:   31410,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("collision-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "collision-r1", "collision-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 31401, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(2, 'local-tunnel-with-colliding-forward-id', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert local tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(20, 1, 'local-user', 'local-f20', 2, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert local forward: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "20_2_10_tcp", U: 120, D: 80})
-
-	updatedShare, err := r.GetPeerShare(share.ID)
-	if err != nil || updatedShare == nil {
-		t.Fatalf("reload share: %v", err)
-	}
-	if updatedShare.CurrentFlow != 200 {
-		t.Fatalf("expected current_flow=200, got %d", updatedShare.CurrentFlow)
-	}
-}
-
-func TestProcessFlowItemSkipsPeerShareFlowWhenServiceNameIsAmbiguous(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-forward-ambiguous.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "ambiguous-share-a",
-		NodeID:         1,
-		Token:          "ambiguous-token-a",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31100,
-		PortRangeEnd:   31110,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share A: %v", err)
-	}
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "ambiguous-share-b",
-		NodeID:         1,
-		Token:          "ambiguous-token-b",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31200,
-		PortRangeEnd:   31210,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share B: %v", err)
-	}
-	shareA, _ := r.GetPeerShareByToken("ambiguous-token-a")
-	shareB, _ := r.GetPeerShareByToken("ambiguous-token-b")
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?),
-		      (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		shareA.ID, 1, "amb-r1", "amb-rk1", "", "forward", "", "99_2_10", "tcp", "fifo", 31101, "", 1, 1, now, now,
-		shareB.ID, 1, "amb-r2", "amb-rk2", "", "forward", "", "99_2_10", "tcp", "fifo", 31201, "", 1, 1, now, now,
-	).Error; err != nil {
-		t.Fatalf("insert ambiguous runtimes: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.processFlowItem(1, flowItem{N: "99_2_10_tcp", U: 120, D: 80})
-
-	updatedA, _ := r.GetPeerShare(shareA.ID)
-	updatedB, _ := r.GetPeerShare(shareB.ID)
-	if updatedA.CurrentFlow != 0 || updatedB.CurrentFlow != 0 {
-		t.Fatalf("expected ambiguous service flow to be skipped, got shareA=%d shareB=%d", updatedA.CurrentFlow, updatedB.CurrentFlow)
-	}
-}
-
-func TestCleanOrphanedServicesSkipsActiveSharedForwardRuntimeServices(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-cleanup-runtime.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "cleanup-runtime-share",
-		NodeID:         1,
-		Token:          "cleanup-runtime-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31300,
-		PortRangeEnd:   31310,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("cleanup-runtime-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "cleanup-r1", "cleanup-rk1", "", "forward", "", "20_2_10", "tcp", "fifo", 31301, "", 1, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime: %v", err)
-	}
-
-	h := &Handler{repo: r}
-
-	defer func() {
-		if rec := recover(); rec != nil {
-			t.Fatalf("cleanOrphanedServices should skip active shared runtime service; got panic: %v", rec)
-		}
-	}()
-
-	h.cleanOrphanedServices(share.NodeID, []namedConfigItem{{Name: "20_2_10_tcp"}})
-}
-
-func TestCleanOrphanedServicesSkipsFederationServicePrefix(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-cleanup-fed-svc.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	h := &Handler{repo: r}
-
-	defer func() {
-		if rec := recover(); rec != nil {
-			t.Fatalf("cleanOrphanedServices should skip fed_svc_ service names; got panic: %v", rec)
-		}
-	}()
-
-	h.cleanOrphanedServices(1, []namedConfigItem{{Name: "fed_svc_999_tcp"}})
-}
-
-func TestCleanOrphanedServicesSkipsForwardPatternWhenNodeHasActivePeerShareForwardRuntime(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel-cleanup-forward-runtime-empty-service.db"))
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	now := time.Now().UnixMilli()
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "cleanup-forward-runtime-empty-service",
-		NodeID:         1,
-		Token:          "cleanup-forward-runtime-empty-service-token",
-		MaxBandwidth:   0,
-		CurrentFlow:    0,
-		PortRangeStart: 31420,
-		PortRangeEnd:   31430,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create peer share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken("cleanup-forward-runtime-empty-service-token")
-	if err != nil || share == nil {
-		t.Fatalf("load peer share: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO peer_share_runtime(share_id, node_id, reservation_id, resource_key, binding_id, role, chain_name, service_name, protocol, strategy, port, target, applied, status, created_time, updated_time)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, share.ID, share.NodeID, "cleanup-forward-empty-r1", "cleanup-forward-empty-rk1", "", "forward", "", "", "tcp", "fifo", 31421, "", 0, 1, now, now).Error; err != nil {
-		t.Fatalf("insert peer_share_runtime with empty service name: %v", err)
-	}
-
-	h := &Handler{repo: r}
-
-	defer func() {
-		if rec := recover(); rec != nil {
-			t.Fatalf("cleanOrphanedServices should skip forward-pattern services when active peer-share forward runtime exists; got panic: %v", rec)
-		}
-	}()
-
-	h.cleanOrphanedServices(share.NodeID, []namedConfigItem{{Name: "20_2_10_tcp"}})
-}

go-backend/internal/http/handler/handler.go

@@ -3,7 +3,6 @@ package handler
 import (
 	"context"
 	"database/sql"
-	"encoding/base64"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -16,21 +15,17 @@ import (
 	"time"
 
 	"go-backend/internal/auth"
-	"go-backend/internal/health"
 	"go-backend/internal/http/middleware"
 	"go-backend/internal/http/response"
-	"go-backend/internal/metrics"
 	"go-backend/internal/security"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 	"go-backend/internal/ws"
 )
 
 type Handler struct {
-	repo        *repo.Repository
-	jwtSecret   string
-	wsServer    *ws.Server
-	metrics     *metrics.IngestionService
-	healthCheck *health.Checker
+	repo      *sqlite.Repository
+	jwtSecret string
+	wsServer  *ws.Server
 
 	captchaMu     sync.Mutex
 	captchaTokens map[string]int64
@@ -39,11 +34,6 @@ type Handler struct {
 	jobsCancel  context.CancelFunc
 	jobsStarted bool
 	jobsWG      sync.WaitGroup
-
-	upgradeMu              sync.Mutex
-	pendingUpgradeRedeploy map[int64]struct{}
-
-	qualityProber *tunnelQualityProber
 }
 
 type loginRequest struct {
@@ -79,43 +69,13 @@ type flowItem struct {
 	D int64  `json:"d"`
 }
 
-const (
-	pngDataURLPrefix          = "data:image/png;base64,"
-	maxBrandAssetDataURLBytes = 1024 * 1024
-)
-
-func New(repo *repo.Repository, jwtSecret string) *Handler {
-	h := &Handler{
-		repo:                   repo,
-		jwtSecret:              jwtSecret,
-		wsServer:               ws.NewServer(repo, jwtSecret),
-		metrics:                metrics.NewIngestionService(repo),
-		healthCheck:            nil,
-		captchaTokens:          make(map[string]int64),
-		pendingUpgradeRedeploy: make(map[int64]struct{}),
+func New(repo *sqlite.Repository, jwtSecret string) *Handler {
+	return &Handler{
+		repo:          repo,
+		jwtSecret:     jwtSecret,
+		wsServer:      ws.NewServer(repo, jwtSecret),
+		captchaTokens: make(map[string]int64),
 	}
-	h.healthCheck = health.NewChecker(repo, h.wsServer)
-	h.qualityProber = newTunnelQualityProber(h)
-	h.wsServer.SetNodeOnlineHook(h.onNodeOnline)
-	h.wsServer.SetNodeMetricHook(func(nodeID int64, info ws.SystemInfo) {
-		metricInfo := metrics.SystemInfo{
-			Uptime:           info.Uptime,
-			BytesReceived:    info.BytesReceived,
-			BytesTransmitted: info.BytesTransmitted,
-			CPUUsage:         info.CPUUsage,
-			MemoryUsage:      info.MemoryUsage,
-			DiskUsage:        info.DiskUsage,
-			Load1:            info.Load1,
-			Load5:            info.Load5,
-			Load15:           info.Load15,
-			TCPConns:         info.TCPConns,
-			UDPConns:         info.UDPConns,
-			NetInSpeed:       info.NetInSpeed,
-			NetOutSpeed:      info.NetOutSpeed,
-		}
-		h.metrics.RecordNodeMetric(nodeID, metricInfo)
-	})
-	return h
 }
 
 func (h *Handler) WebSocketHandler() http.Handler {
@@ -129,8 +89,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/user/update", h.userUpdate)
 	mux.HandleFunc("/api/v1/user/delete", h.userDelete)
 	mux.HandleFunc("/api/v1/user/reset", h.userResetFlow)
-	mux.HandleFunc("/api/v1/user/quota/reset", h.userQuotaReset)
-	mux.HandleFunc("/api/v1/user/groups", h.userGroups)
 	mux.HandleFunc("/api/v1/config/get", h.getConfigByName)
 	mux.HandleFunc("/api/v1/config/list", h.getConfigs)
 	mux.HandleFunc("/api/v1/config/update", h.updateConfigs)
@@ -151,7 +109,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/node/delete", h.nodeDelete)
 	mux.HandleFunc("/api/v1/node/install", h.nodeInstall)
 	mux.HandleFunc("/api/v1/node/update-order", h.nodeUpdateOrder)
-	mux.HandleFunc("/api/v1/node/dismiss-expiry-reminder", h.nodeDismissExpiryReminder)
 	mux.HandleFunc("/api/v1/node/batch-delete", h.nodeBatchDelete)
 	mux.HandleFunc("/api/v1/node/check-status", h.nodeCheckStatus)
 	mux.HandleFunc("/api/v1/node/upgrade", h.nodeUpgrade)
@@ -163,12 +120,7 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/tunnel/get", h.tunnelGet)
 	mux.HandleFunc("/api/v1/tunnel/update", h.tunnelUpdate)
 	mux.HandleFunc("/api/v1/tunnel/delete", h.tunnelDelete)
-	mux.HandleFunc("/api/v1/tunnel/delete-preview", h.tunnelDeletePreview)
-	mux.HandleFunc("/api/v1/tunnel/delete-with-forwards", h.tunnelDeleteWithForwards)
-	mux.HandleFunc("/api/v1/tunnel/batch-delete-preview", h.tunnelBatchDeletePreview)
-	mux.HandleFunc("/api/v1/tunnel/batch-delete-with-forwards", h.tunnelBatchDeleteWithForwards)
 	mux.HandleFunc("/api/v1/tunnel/diagnose", h.tunnelDiagnose)
-	mux.HandleFunc("/api/v1/tunnel/diagnose/stream", h.tunnelDiagnoseStream)
 	mux.HandleFunc("/api/v1/tunnel/update-order", h.tunnelUpdateOrder)
 	mux.HandleFunc("/api/v1/tunnel/batch-delete", h.tunnelBatchDelete)
 	mux.HandleFunc("/api/v1/tunnel/batch-redeploy", h.tunnelBatchRedeploy)
@@ -184,7 +136,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/forward/pause", h.forwardPause)
 	mux.HandleFunc("/api/v1/forward/resume", h.forwardResume)
 	mux.HandleFunc("/api/v1/forward/diagnose", h.forwardDiagnose)
-	mux.HandleFunc("/api/v1/forward/diagnose/stream", h.forwardDiagnoseStream)
 	mux.HandleFunc("/api/v1/forward/update-order", h.forwardUpdateOrder)
 	mux.HandleFunc("/api/v1/forward/batch-delete", h.forwardBatchDelete)
 	mux.HandleFunc("/api/v1/forward/batch-pause", h.forwardBatchPause)
@@ -195,6 +146,7 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/speed-limit/create", h.speedLimitCreate)
 	mux.HandleFunc("/api/v1/speed-limit/update", h.speedLimitUpdate)
 	mux.HandleFunc("/api/v1/speed-limit/delete", h.speedLimitDelete)
+	mux.HandleFunc("/api/v1/speed-limit/tunnels", h.tunnelList)
 	mux.HandleFunc("/api/v1/tunnel/user/tunnel", h.userTunnelVisibleList)
 	mux.HandleFunc("/api/v1/tunnel/user/list", h.userTunnelList)
 	mux.HandleFunc("/api/v1/group/tunnel/list", h.tunnelGroupList)
@@ -225,26 +177,6 @@ func (h *Handler) Register(mux *http.ServeMux) {
 	mux.HandleFunc("/api/v1/federation/runtime/diagnose", h.authPeer(h.federationRuntimeDiagnose))
 	mux.HandleFunc("/api/v1/federation/runtime/command", h.authPeer(h.federationRuntimeCommand))
 	mux.HandleFunc("/api/v1/federation/node/import", h.nodeImport)
-	mux.HandleFunc("/api/v1/announcement/get", h.getAnnouncement)
-	mux.HandleFunc("/api/v1/announcement/update", h.updateAnnouncement)
-
-	mux.HandleFunc("/api/v1/monitor/access", h.monitorAccessHandler)
-	mux.HandleFunc("/api/v1/monitor/nodes/", h.monitorNodeMetricsHandler)
-	mux.HandleFunc("/api/v1/monitor/nodes", h.monitorNodeListHandler)
-	mux.HandleFunc("/api/v1/monitor/tunnels", h.monitorTunnelListHandler)
-	mux.HandleFunc("/api/v1/monitor/tunnels/quality", h.monitorTunnelQualityHandler)
-	mux.HandleFunc("/api/v1/monitor/tunnels/", h.monitorTunnelMetrics)
-	mux.HandleFunc("/api/v1/monitor/services", h.monitorServiceListHandler)
-	mux.HandleFunc("/api/v1/monitor/services/create", h.monitorServiceCreate)
-	mux.HandleFunc("/api/v1/monitor/services/update", h.monitorServiceUpdate)
-	mux.HandleFunc("/api/v1/monitor/services/delete", h.monitorServiceDelete)
-	mux.HandleFunc("/api/v1/monitor/services/run", h.monitorServiceRun)
-	mux.HandleFunc("/api/v1/monitor/services/latest-results", h.monitorServiceLatestResultsHandler)
-	mux.HandleFunc("/api/v1/monitor/services/limits", h.monitorServiceLimitsHandler)
-	mux.HandleFunc("/api/v1/monitor/services/", h.monitorServiceResultsHandler)
-	mux.HandleFunc("/api/v1/monitor/permission/list", h.monitorPermissionList)
-	mux.HandleFunc("/api/v1/monitor/permission/assign", h.monitorPermissionAssign)
-	mux.HandleFunc("/api/v1/monitor/permission/remove", h.monitorPermissionRemove)
 
 	mux.HandleFunc("/flow/test", h.flowTest)
 	mux.HandleFunc("/flow/config", h.flowConfig)
@@ -278,7 +210,7 @@ func (h *Handler) login(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
-	if captchaEnabled && !h.apiClientCaptchaBypassEnabled(r) {
+	if captchaEnabled {
 		captchaID := strings.TrimSpace(req.CaptchaID)
 		if captchaID == "" {
 			response.WriteJSON(w, response.ErrDefault("验证码校验失败"))
@@ -492,7 +424,7 @@ func (h *Handler) openAPISubStore(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))
 		return
 	}
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		response.WriteJSON(w, response.Err(-2, "database unavailable"))
 		return
 	}
@@ -535,21 +467,27 @@ func (h *Handler) openAPISubStore(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
-		ut, err := h.repo.GetUserTunnelByID(tunnelID)
+		var userID int64
+		var inFlow int64
+		var outFlow int64
+		var flow int64
+		var expTime int64
+		err = h.repo.DB().QueryRow(`SELECT user_id, in_flow, out_flow, flow, exp_time FROM user_tunnel WHERE id = ? LIMIT 1`, tunnelID).
+			Scan(&userID, &inFlow, &outFlow, &flow, &expTime)
 		if err != nil {
+			if err == sql.ErrNoRows {
+				response.WriteJSON(w, response.ErrDefault("隧道不存在"))
+				return
+			}
 			response.WriteJSON(w, response.Err(-2, err.Error()))
 			return
 		}
-		if ut == nil {
-			response.WriteJSON(w, response.ErrDefault("隧道不存在"))
-			return
-		}
-		if ut.UserID != user.ID {
+		if userID != user.ID {
 			response.WriteJSON(w, response.ErrDefault("隧道不存在"))
 			return
 		}
 
-		headerValue = buildSubscriptionHeader(ut.OutFlow, ut.InFlow, ut.Flow*giga, ut.ExpTime/1000)
+		headerValue = buildSubscriptionHeader(outFlow, inFlow, flow*giga, expTime/1000)
 	}
 
 	w.Header().Set("subscription-userinfo", headerValue)
@@ -623,7 +561,7 @@ func (h *Handler) userTunnelList(w http.ResponseWriter, r *http.Request) {
 			"userId":         t.UserID,
 			"tunnelId":       t.TunnelID,
 			"tunnelName":     t.TunnelName,
-			"status":         t.Status,
+			"status":         1,
 			"flow":           t.Flow,
 			"num":            t.Num,
 			"expTime":        t.ExpTime,
@@ -763,8 +701,7 @@ func (h *Handler) flowConfig(w http.ResponseWriter, r *http.Request) {
 
 func (h *Handler) flowUpload(w http.ResponseWriter, r *http.Request) {
 	secret := r.URL.Query().Get("secret")
-	node, _ := h.repo.GetNodeBySecret(secret)
-	if node == nil {
+	if ok, _ := h.repo.NodeExistsBySecret(secret); !ok {
 		w.Header().Set("Content-Type", "text/plain; charset=utf-8")
 		_, _ = w.Write([]byte("ok"))
 		return
@@ -774,10 +711,8 @@ func (h *Handler) flowUpload(w http.ResponseWriter, r *http.Request) {
 	if err == nil && strings.TrimSpace(raw) != "" {
 		var items []flowItem
 		if json.Unmarshal([]byte(raw), &items) == nil {
-			nowMs := time.Now().UnixMilli()
-			h.recordTunnelMetricsFromFlowItems(node.ID, items, nowMs)
 			for _, item := range items {
-				h.processFlowItem(node.ID, item)
+				h.processFlowItem(item)
 			}
 		}
 	}
@@ -808,14 +743,7 @@ func (h *Handler) updateConfigs(w http.ResponseWriter, r *http.Request) {
 		if key == "" {
 			continue
 		}
-
-		value, err := normalizeAndValidateConfigValue(key, v)
-		if err != nil {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-
-		if err := h.repo.UpsertConfig(key, value, now); err != nil {
+		if err := h.repo.UpsertConfig(key, v, now); err != nil {
 			response.WriteJSON(w, response.Err(-2, err.Error()))
 			return
 		}
@@ -835,24 +763,16 @@ func (h *Handler) updateSingleConfig(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
 		return
 	}
-	name := strings.TrimSpace(req.Name)
-	if name == "" {
+	if strings.TrimSpace(req.Name) == "" {
 		response.WriteJSON(w, response.ErrDefault("配置名称不能为空"))
 		return
 	}
-
-	value, err := normalizeAndValidateConfigValue(name, req.Value)
-	if err != nil {
-		response.WriteJSON(w, response.ErrDefault(err.Error()))
-		return
-	}
-
-	if value == "" && name != "app_logo" && name != "app_favicon" {
+	if strings.TrimSpace(req.Value) == "" {
 		response.WriteJSON(w, response.ErrDefault("配置值不能为空"))
 		return
 	}
 
-	if err := h.repo.UpsertConfig(name, value, time.Now().UnixMilli()); err != nil {
+	if err := h.repo.UpsertConfig(strings.TrimSpace(req.Name), req.Value, time.Now().UnixMilli()); err != nil {
 		response.WriteJSON(w, response.Err(-2, err.Error()))
 		return
 	}
@@ -860,37 +780,6 @@ func (h *Handler) updateSingleConfig(w http.ResponseWriter, r *http.Request) {
 	response.WriteJSON(w, response.OKEmpty())
 }
 
-func normalizeAndValidateConfigValue(key, value string) (string, error) {
-	switch strings.TrimSpace(key) {
-	case "app_logo", "app_favicon":
-		normalized := strings.TrimSpace(value)
-		if normalized == "" {
-			return "", nil
-		}
-
-		if !strings.HasPrefix(normalized, pngDataURLPrefix) {
-			return "", fmt.Errorf("品牌图片必须通过上传生成 PNG 数据")
-		}
-
-		if len(normalized) > maxBrandAssetDataURLBytes {
-			return "", fmt.Errorf("品牌图片过大，请上传更小图片")
-		}
-
-		payload := strings.TrimSpace(strings.TrimPrefix(normalized, pngDataURLPrefix))
-		if payload == "" {
-			return "", fmt.Errorf("品牌图片数据不能为空")
-		}
-
-		if _, err := base64.StdEncoding.DecodeString(payload); err != nil {
-			return "", fmt.Errorf("品牌图片数据格式无效")
-		}
-
-		return pngDataURLPrefix + payload, nil
-	default:
-		return value, nil
-	}
-}
-
 func (h *Handler) userPackage(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))
@@ -1096,41 +985,10 @@ func (h *Handler) captchaEnabled() (bool, error) {
 	if err != nil {
 		return false, err
 	}
-	if cfg == nil || !strings.EqualFold(strings.TrimSpace(cfg.Value), "true") {
+	if cfg == nil {
 		return false, nil
 	}
-
-	siteCfg, err := h.repo.GetConfigByName("cloudflare_site_key")
-	if err != nil {
-		return false, err
-	}
-	if siteCfg == nil || strings.TrimSpace(siteCfg.Value) == "" {
-		return false, nil
-	}
-
-	secretCfg, err := h.repo.GetConfigByName("cloudflare_secret_key")
-	if err != nil {
-		return false, err
-	}
-	if secretCfg == nil || strings.TrimSpace(secretCfg.Value) == "" {
-		return false, nil
-	}
-
-	return true, nil
-}
-
-func (h *Handler) apiClientCaptchaBypassEnabled(r *http.Request) bool {
-	if r == nil {
-		return false
-	}
-
-	client := strings.ToLower(strings.TrimSpace(r.Header.Get("X-FLVX-API-Client")))
-	switch client {
-	case "whmcs", "whmcs-module":
-		return true
-	default:
-		return false
-	}
+	return strings.EqualFold(cfg.Value, "true"), nil
 }
 
 func (h *Handler) markCaptchaToken(token string) {
@@ -1238,21 +1096,6 @@ func nullableNullInt64(v sql.NullInt64) interface{} {
 	return nil
 }
 
-// flowCryptoCache caches AES crypto instances by secret to avoid per-request SHA256+GCM init.
-var flowCryptoCache sync.Map
-
-func getOrCreateFlowCrypto(secret string) *security.AESCrypto {
-	if v, ok := flowCryptoCache.Load(secret); ok {
-		return v.(*security.AESCrypto)
-	}
-	c, err := security.NewAESCrypto(secret)
-	if err != nil {
-		return nil
-	}
-	flowCryptoCache.Store(secret, c)
-	return c
-}
-
 func readAndDecryptFlowBody(body io.ReadCloser, secret string) (string, error) {
 	defer body.Close()
 	raw, err := io.ReadAll(body)
@@ -1273,8 +1116,8 @@ func readAndDecryptFlowBody(body io.ReadCloser, secret string) (string, error) {
 		return text, nil
 	}
 
-	crypto := getOrCreateFlowCrypto(secret)
-	if crypto == nil {
+	crypto, err := security.NewAESCrypto(secret)
+	if err != nil {
 		return text, nil
 	}
 	plain, err := crypto.Decrypt(wrap.Data)
@@ -1345,7 +1188,7 @@ func (h *Handler) backupExport(w http.ResponseWriter, r *http.Request) {
 
 type backupImportRequest struct {
 	Types []string `json:"types"`
-	repo.BackupData
+	sqlite.BackupData
 }
 
 func (h *Handler) backupImport(w http.ResponseWriter, r *http.Request) {
@@ -1385,53 +1228,3 @@ func (h *Handler) backupImport(w http.ResponseWriter, r *http.Request) {
 	result.AutoBackup = autoBackup
 	response.WriteJSON(w, response.OK(result))
 }
-
-func (h *Handler) getAnnouncement(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	ann, err := h.repo.GetAnnouncement()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-1, fmt.Sprintf("获取公告失败: %v", err)))
-		return
-	}
-
-	if ann == nil {
-		response.WriteJSON(w, response.OK(map[string]interface{}{
-			"content": "",
-			"enabled": 0,
-		}))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(map[string]interface{}{
-		"content": ann.Content,
-		"enabled": ann.Enabled,
-	}))
-}
-
-func (h *Handler) updateAnnouncement(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	var req struct {
-		Content string `json:"content"`
-		Enabled int    `json:"enabled"`
-	}
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.Err(500, "请求参数错误"))
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	if err := h.repo.UpsertAnnouncement(req.Content, req.Enabled, now); err != nil {
-		response.WriteJSON(w, response.Err(-1, fmt.Sprintf("更新公告失败: %v", err)))
-		return
-	}
-
-	response.WriteJSON(w, response.OKEmpty())
-}

go-backend/internal/http/handler/jobs.go

@@ -2,11 +2,12 @@ package handler
 
 import (
 	"context"
+	"database/sql"
 	"time"
 )
 
 func (h *Handler) StartBackgroundJobs() {
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		return
 	}
 
@@ -18,15 +19,11 @@ func (h *Handler) StartBackgroundJobs() {
 	ctx, cancel := context.WithCancel(context.Background())
 	h.jobsCancel = cancel
 	h.jobsStarted = true
-	h.jobsWG.Add(6)
+	h.jobsWG.Add(2)
 	h.jobsMu.Unlock()
 
 	go h.runHourlyStatsLoop(ctx)
 	go h.runDailyMaintenanceLoop(ctx)
-	go h.runNodeRenewalCycleLoop(ctx)
-	go h.runMetricsIngestion(ctx)
-	go h.runHealthChecks(ctx)
-	go h.runTunnelQualityProber(ctx)
 }
 
 func (h *Handler) StopBackgroundJobs() {
@@ -50,27 +47,6 @@ func (h *Handler) StopBackgroundJobs() {
 	h.jobsWG.Wait()
 }
 
-func (h *Handler) runMetricsIngestion(ctx context.Context) {
-	defer h.jobsWG.Done()
-	if h.metrics != nil {
-		h.metrics.Start(ctx)
-	}
-}
-
-func (h *Handler) runHealthChecks(ctx context.Context) {
-	defer h.jobsWG.Done()
-	if h.healthCheck != nil {
-		h.healthCheck.Start(ctx)
-	}
-}
-
-func (h *Handler) runTunnelQualityProber(ctx context.Context) {
-	defer h.jobsWG.Done()
-	if h.qualityProber != nil {
-		h.qualityProber.Start(ctx)
-	}
-}
-
 func (h *Handler) runHourlyStatsLoop(ctx context.Context) {
 	defer h.jobsWG.Done()
 
@@ -121,28 +97,47 @@ func durationUntilNextDailyMaintenance(now time.Time) time.Duration {
 }
 
 func (h *Handler) runStatisticsFlowJob(now time.Time) {
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		return
 	}
 
+	db := h.repo.DB()
 	nowMs := now.UnixMilli()
 	cutoffMs := nowMs - int64((48*time.Hour)/time.Millisecond)
-	_ = h.repo.PurgeOldStatisticsFlows(cutoffMs)
+	_, _ = db.Exec(`DELETE FROM statistics_flow WHERE created_time < ?`, cutoffMs)
 
 	hourMark := now.Truncate(time.Hour)
 	hourText := hourMark.Format("15:04")
 	createdTime := hourMark.UnixMilli()
 
-	users, err := h.repo.ListAllUserFlowSnapshots()
+	rows, err := db.Query(`SELECT id, in_flow, out_flow FROM user ORDER BY id ASC`)
 	if err != nil {
 		return
 	}
+	type userFlowSnapshot struct {
+		userID  int64
+		inFlow  int64
+		outFlow int64
+	}
+	users := make([]userFlowSnapshot, 0)
+
+	for rows.Next() {
+		var userID int64
+		var inFlow int64
+		var outFlow int64
+		if err := rows.Scan(&userID, &inFlow, &outFlow); err != nil {
+			continue
+		}
+		users = append(users, userFlowSnapshot{userID: userID, inFlow: inFlow, outFlow: outFlow})
+	}
+	_ = rows.Close()
 
 	for _, user := range users {
-		currentTotal := user.InFlow + user.OutFlow
+		currentTotal := user.inFlow + user.outFlow
 		increment := currentTotal
 
-		lastTotal, err := h.repo.GetLastStatisticsFlowTotal(user.UserID)
+		var lastTotal sql.NullInt64
+		err := db.QueryRow(`SELECT total_flow FROM statistics_flow WHERE user_id = ? ORDER BY id DESC LIMIT 1`, user.userID).Scan(&lastTotal)
 		if err == nil && lastTotal.Valid {
 			increment = currentTotal - lastTotal.Int64
 			if increment < 0 {
@@ -150,91 +145,126 @@ func (h *Handler) runStatisticsFlowJob(now time.Time) {
 			}
 		}
 
-		_ = h.repo.CreateStatisticsFlow(user.UserID, increment, currentTotal, hourText, createdTime)
+		_, _ = db.Exec(`
+			INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time)
+			VALUES(?, ?, ?, ?, ?)
+		`, user.userID, increment, currentTotal, hourText, createdTime)
 	}
 }
 
 func (h *Handler) runResetAndExpiryJob(now time.Time) {
-	if h == nil || h.repo == nil {
+	if h == nil || h.repo == nil || h.repo.DB() == nil {
 		return
 	}
 
 	h.resetMonthlyFlow(now)
-	h.resetUserQuotaWindows(now)
 	h.disableExpiredUsers(now.UnixMilli())
 	h.disableExpiredUserTunnels(now.UnixMilli())
 }
 
 func (h *Handler) resetMonthlyFlow(now time.Time) {
+	db := h.repo.DB()
 	currentDay := now.Day()
 	lastDay := time.Date(now.Year(), now.Month()+1, 0, 0, 0, 0, 0, now.Location()).Day()
 
-	_ = h.repo.ResetUserMonthlyFlow(currentDay, lastDay)
-	_ = h.repo.ResetUserTunnelMonthlyFlow(currentDay, lastDay)
+	if currentDay == lastDay {
+		_, _ = db.Exec(`
+			UPDATE user
+			SET in_flow = 0, out_flow = 0
+			WHERE flow_reset_time != 0
+			  AND (flow_reset_time = ? OR flow_reset_time > ?)
+		`, currentDay, lastDay)
+		_, _ = db.Exec(`
+			UPDATE user_tunnel
+			SET in_flow = 0, out_flow = 0
+			WHERE flow_reset_time != 0
+			  AND (flow_reset_time = ? OR flow_reset_time > ?)
+		`, currentDay, lastDay)
+		return
+	}
+
+	_, _ = db.Exec(`
+		UPDATE user
+		SET in_flow = 0, out_flow = 0
+		WHERE flow_reset_time != 0
+		  AND flow_reset_time = ?
+	`, currentDay)
+	_, _ = db.Exec(`
+		UPDATE user_tunnel
+		SET in_flow = 0, out_flow = 0
+		WHERE flow_reset_time != 0
+		  AND flow_reset_time = ?
+	`, currentDay)
 }
 
 func (h *Handler) disableExpiredUsers(nowMs int64) {
-	userIDs, err := h.repo.ListExpiredActiveUserIDs(nowMs)
+	db := h.repo.DB()
+	rows, err := db.Query(`
+		SELECT id
+		FROM user
+		WHERE role_id != 0
+		  AND status = 1
+		  AND exp_time IS NOT NULL
+		  AND exp_time < ?
+	`, nowMs)
 	if err != nil {
 		return
 	}
+	userIDs := make([]int64, 0)
+
+	for rows.Next() {
+		var userID int64
+		if err := rows.Scan(&userID); err != nil {
+			continue
+		}
+		userIDs = append(userIDs, userID)
+	}
+	_ = rows.Close()
 
 	for _, userID := range userIDs {
 		forwards, err := h.listActiveForwardsByUser(userID)
 		if err == nil {
 			h.pauseForwardRecords(forwards, nowMs)
 		}
-		_ = h.repo.DisableUser(userID)
+		_, _ = db.Exec(`UPDATE user SET status = 0 WHERE id = ?`, userID)
 	}
 }
 
 func (h *Handler) disableExpiredUserTunnels(nowMs int64) {
-	items, err := h.repo.ListExpiredActiveUserTunnels(nowMs)
+	db := h.repo.DB()
+	rows, err := db.Query(`
+		SELECT id, user_id, tunnel_id
+		FROM user_tunnel
+		WHERE status = 1
+		  AND exp_time IS NOT NULL
+		  AND exp_time < ?
+	`, nowMs)
 	if err != nil {
 		return
 	}
+	type expiredUserTunnel struct {
+		userTunnelID int64
+		userID       int64
+		tunnelID     int64
+	}
+	items := make([]expiredUserTunnel, 0)
+
+	for rows.Next() {
+		var userTunnelID int64
+		var userID int64
+		var tunnelID int64
+		if err := rows.Scan(&userTunnelID, &userID, &tunnelID); err != nil {
+			continue
+		}
+		items = append(items, expiredUserTunnel{userTunnelID: userTunnelID, userID: userID, tunnelID: tunnelID})
+	}
+	_ = rows.Close()
 
 	for _, item := range items {
-		forwards, err := h.listActiveForwardsByUserTunnel(item.UserID, item.TunnelID)
+		forwards, err := h.listActiveForwardsByUserTunnel(item.userID, item.tunnelID)
 		if err == nil {
 			h.pauseForwardRecords(forwards, nowMs)
 		}
-		_ = h.repo.DisableUserTunnel(item.ID)
+		_, _ = db.Exec(`UPDATE user_tunnel SET status = 0 WHERE id = ?`, item.userTunnelID)
 	}
 }
-
-func (h *Handler) runNodeRenewalCycleLoop(ctx context.Context) {
-	defer h.jobsWG.Done()
-
-	for {
-		wait := durationUntilNextNodeRenewalCycle(time.Now())
-		timer := time.NewTimer(wait)
-		select {
-		case <-ctx.Done():
-			if !timer.Stop() {
-				<-timer.C
-			}
-			return
-		case <-timer.C:
-			h.runNodeRenewalCycleJob(time.Now())
-		}
-	}
-}
-
-func durationUntilNextNodeRenewalCycle(now time.Time) time.Duration {
-	next := now.Truncate(6 * time.Hour).Add(6 * time.Hour)
-	return next.Sub(now)
-}
-
-func (h *Handler) runNodeRenewalCycleJob(now time.Time) {
-	if h == nil || h.repo == nil {
-		return
-	}
-
-	advanced, err := h.repo.AdvanceNodeRenewalCycles(now.UnixMilli())
-	if err != nil {
-		return
-	}
-
-	_ = advanced
-}

go-backend/internal/http/handler/jobs_renewal_test.go

@@ -1,55 +0,0 @@
-package handler
-
-import (
-	"database/sql"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestRunNodeRenewalCycleJob_AdvancesOverdueAnchorTimes(t *testing.T) {
-	dbPath := t.TempDir() + "/renewal-test.db"
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = r.Close()
-	})
-
-	now := time.Date(2026, 3, 8, 12, 0, 0, 0, time.UTC)
-	nowMs := now.UnixMilli()
-
-	nodeID := int64(101)
-	err = r.DB().Exec(`
-		INSERT INTO node (id, name, secret, server_ip, port, http, tls, socks, created_time, status, renewal_cycle, expiry_time)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, nodeID, "no-cycle-node", "test-secret", "192.168.1.1", "1000-65535", 1, 1, 1, nowMs, 1, "", nil).Error
-	if err != nil {
-		t.Fatalf("insert test node: %v", err)
-	}
-
-	quarterNodeID := int64(102)
-	err = r.DB().Exec(`
-		INSERT INTO node (id, name, secret, server_ip, port, http, tls, socks, created_time, status, renewal_cycle, expiry_time)
-		VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, quarterNodeID, "quarter-node", "test-secret", "192.168.1.1", "1000-65535", 1, 1, 1, nowMs, 1, "quarter", now.AddDate(0, -4, 0).UnixMilli()).Error
-	if err != nil {
-		t.Fatalf("insert test node: %v", err)
-	}
-
-	h := &Handler{repo: r}
-	h.runNodeRenewalCycleJob(now)
-
-	var anchor sql.NullInt64
-	err = r.DB().Raw(`SELECT expiry_time FROM node WHERE id = ?`, quarterNodeID).Row().Scan(&anchor)
-	if err != nil {
-		t.Fatalf("query expiry_time: %v", err)
-	}
-
-	expectedAnchor := now.AddDate(0, 2, 0).UnixMilli()
-	if !anchor.Valid || anchor.Int64 != expectedAnchor {
-		t.Fatalf("expected anchor %d (2026-05-08), got %d", expectedAnchor, anchor.Int64)
-	}
-}

go-backend/internal/http/handler/jobs_test.go

@@ -5,40 +5,48 @@ import (
 	"testing"
 	"time"
 
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 func TestRunStatisticsFlowJobTracksIncrementAndPrunes(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "jobs-stats.db")
-	r, err := repo.Open(dbPath)
+	repo, err := sqlite.Open(dbPath)
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "secret")
+	h := New(repo, "secret")
 	now := time.Date(2026, 2, 7, 12, 0, 0, 0, time.UTC)
 	nowMs := now.UnixMilli()
 
-	if err := r.DB().Exec(`UPDATE user SET in_flow = 100, out_flow = 200 WHERE id = 1`).Error; err != nil {
+	if _, err := repo.DB().Exec(`UPDATE user SET in_flow = 100, out_flow = 200 WHERE id = 1`); err != nil {
 		t.Fatalf("seed user flow: %v", err)
 	}
 
-	if err := r.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 250, 250, '11:00', ?)`, now.Add(-time.Hour).UnixMilli()).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 250, 250, '11:00', ?)`, now.Add(-time.Hour).UnixMilli()); err != nil {
 		t.Fatalf("seed recent statistics row: %v", err)
 	}
-	if err := r.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 10, 10, '00:00', ?)`, now.Add(-49*time.Hour).UnixMilli()).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO statistics_flow(user_id, flow, total_flow, time, created_time) VALUES(1, 10, 10, '00:00', ?)`, now.Add(-49*time.Hour).UnixMilli()); err != nil {
 		t.Fatalf("seed stale statistics row: %v", err)
 	}
 
 	h.runStatisticsFlowJob(now)
 
-	staleCount := mustQueryInt(t, r, `SELECT COUNT(1) FROM statistics_flow WHERE created_time < ?`, nowMs-int64((48*time.Hour)/time.Millisecond))
+	var staleCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM statistics_flow WHERE created_time < ?`, nowMs-int64((48*time.Hour)/time.Millisecond)).Scan(&staleCount); err != nil {
+		t.Fatalf("query stale statistics rows: %v", err)
+	}
 	if staleCount != 0 {
 		t.Fatalf("expected stale statistics rows to be pruned, got %d", staleCount)
 	}
 
-	flow, total, hour := mustQueryInt64Int64String(t, r, `SELECT flow, total_flow, time FROM statistics_flow WHERE user_id = 1 ORDER BY id DESC LIMIT 1`)
+	var flow int64
+	var total int64
+	var hour string
+	if err := repo.DB().QueryRow(`SELECT flow, total_flow, time FROM statistics_flow WHERE user_id = 1 ORDER BY id DESC LIMIT 1`).Scan(&flow, &total, &hour); err != nil {
+		t.Fatalf("query latest statistics row: %v", err)
+	}
 	if flow != 50 {
 		t.Fatalf("expected increment flow 50, got %d", flow)
 	}
@@ -52,131 +60,69 @@ func TestRunStatisticsFlowJobTracksIncrementAndPrunes(t *testing.T) {
 
 func TestRunResetAndExpiryJobResetsFlowAndDisablesExpiredRecords(t *testing.T) {
 	dbPath := filepath.Join(t.TempDir(), "jobs-reset.db")
-	r, err := repo.Open(dbPath)
+	repo, err := sqlite.Open(dbPath)
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
-	t.Cleanup(func() { _ = r.Close() })
+	t.Cleanup(func() { _ = repo.Close() })
 
-	h := New(r, "secret")
+	h := New(repo, "secret")
 	now := time.Date(2026, 3, 15, 0, 0, 5, 0, time.UTC)
 	nowMs := now.UnixMilli()
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
 		VALUES(2, 'expired_user', 'x', 1, ?, 100, 1000, 2000, 15, 1, ?, ?, 1)
-	`, nowMs-1000, nowMs, nowMs).Error; err != nil {
+	`, nowMs-1000, nowMs, nowMs); err != nil {
 		t.Fatalf("insert expired user: %v", err)
 	}
 
-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(3, 'non_expiring_user', 'x', 1, 0, 100, 1000, 2000, 15, 1, ?, ?, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert non-expiring user: %v", err)
-	}
-
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES(1, 't1', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, nowMs, nowMs).Error; err != nil {
+	`, nowMs, nowMs); err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
 		VALUES(10, 2, 1, NULL, 1, 1, 300, 400, 15, ?, 1)
-	`, nowMs-1000).Error; err != nil {
+	`, nowMs-1000); err != nil {
 		t.Fatalf("insert expired user_tunnel: %v", err)
 	}
 
-	if err := r.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(11, 3, 1, NULL, 1, 1, 300, 400, 15, 0, 1)
-	`).Error; err != nil {
-		t.Fatalf("insert non-expiring user_tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
 		VALUES(20, 2, 'expired_user', 'f1', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, nowMs, nowMs).Error; err != nil {
+	`, nowMs, nowMs); err != nil {
 		t.Fatalf("insert forward: %v", err)
 	}
 
-	if err := r.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(21, 3, 'non_expiring_user', 'f2', 1, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert non-expiring forward: %v", err)
-	}
-
 	h.runResetAndExpiryJob(now)
 
-	userIn, userOut, userStatus := mustQueryInt64Int64Int(t, r, `SELECT in_flow, out_flow, status FROM user WHERE id = 2`)
+	var userIn, userOut int64
+	var userStatus int
+	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user WHERE id = 2`).Scan(&userIn, &userOut, &userStatus); err != nil {
+		t.Fatalf("query user after maintenance: %v", err)
+	}
 	if userIn != 0 || userOut != 0 || userStatus != 0 {
 		t.Fatalf("expected user reset+disabled, got in=%d out=%d status=%d", userIn, userOut, userStatus)
 	}
 
-	utIn, utOut, utStatus := mustQueryInt64Int64Int(t, r, `SELECT in_flow, out_flow, status FROM user_tunnel WHERE id = 10`)
+	var utIn, utOut int64
+	var utStatus int
+	if err := repo.DB().QueryRow(`SELECT in_flow, out_flow, status FROM user_tunnel WHERE id = 10`).Scan(&utIn, &utOut, &utStatus); err != nil {
+		t.Fatalf("query user_tunnel after maintenance: %v", err)
+	}
 	if utIn != 0 || utOut != 0 || utStatus != 0 {
 		t.Fatalf("expected user_tunnel reset+disabled, got in=%d out=%d status=%d", utIn, utOut, utStatus)
 	}
 
-	forwardStatus := mustQueryInt(t, r, `SELECT status FROM forward WHERE id = 20`)
+	var forwardStatus int
+	if err := repo.DB().QueryRow(`SELECT status FROM forward WHERE id = 20`).Scan(&forwardStatus); err != nil {
+		t.Fatalf("query forward after maintenance: %v", err)
+	}
 	if forwardStatus != 0 {
 		t.Fatalf("expected forward status=0 after expiry handling, got %d", forwardStatus)
 	}
-
-	nonExpUserStatus := mustQueryInt(t, r, `SELECT status FROM user WHERE id = 3`)
-	if nonExpUserStatus != 1 {
-		t.Fatalf("expected non-expiring user to remain enabled, got status=%d", nonExpUserStatus)
-	}
-
-	nonExpTunnelStatus := mustQueryInt(t, r, `SELECT status FROM user_tunnel WHERE id = 11`)
-	if nonExpTunnelStatus != 1 {
-		t.Fatalf("expected non-expiring user_tunnel to remain enabled, got status=%d", nonExpTunnelStatus)
-	}
-
-	nonExpForwardStatus := mustQueryInt(t, r, `SELECT status FROM forward WHERE id = 21`)
-	if nonExpForwardStatus != 1 {
-		t.Fatalf("expected non-expiring forward to remain enabled, got status=%d", nonExpForwardStatus)
-	}
-}
-
-func TestRunResetAndExpiryJobResetsUserQuotaAndUnblocksUser(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "jobs-quota-reset.db")
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "secret")
-	now := time.Date(2026, 3, 12, 0, 0, 5, 0, time.UTC)
-	nowMs := now.UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'quota-reset-user', 'x', 1, 0, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO user_quota(user_id, daily_limit_gb, monthly_limit_gb, daily_used_bytes, monthly_used_bytes, day_key, month_key, disabled_by_quota, disabled_at, paused_forward_ids, created_time, updated_time)
-		VALUES(2, 10, 0, ?, ?, 20260311, 202603, 1, ?, '', ?, ?)
-	`, 11*int64(1024*1024*1024), 11*int64(1024*1024*1024), nowMs, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user quota: %v", err)
-	}
-
-	h.runResetAndExpiryJob(now)
-
-	dailyUsed := mustQueryInt(t, r, `SELECT daily_used_bytes FROM user_quota WHERE user_id = 2`)
-	if dailyUsed != 0 {
-		t.Fatalf("expected daily quota usage reset, got %d", dailyUsed)
-	}
-	quotaDisabled := mustQueryInt(t, r, `SELECT disabled_by_quota FROM user_quota WHERE user_id = 2`)
-	if quotaDisabled != 0 {
-		t.Fatalf("expected quota disabled flag cleared, got %d", quotaDisabled)
-	}
 }

go-backend/internal/http/handler/monitoring.go

@@ -1,927 +0,0 @@
-package handler
-
-import (
-	"log"
-	"net/http"
-	"strconv"
-	"strings"
-	"time"
-
-	"go-backend/internal/http/response"
-	"go-backend/internal/monitoring"
-	"go-backend/internal/store/model"
-)
-
-const (
-	defaultMetricsRangeMs = int64(60 * 60 * 1000)      // 1h
-	maxMetricsRangeMs     = int64(24 * 60 * 60 * 1000) // 24h
-)
-
-func (h *Handler) resolveServiceMonitorLimits() monitoring.ServiceMonitorLimits {
-	defaults := monitoring.DefaultServiceMonitorLimits()
-	if h == nil || h.repo == nil {
-		return defaults
-	}
-	cfg, err := h.repo.GetConfigsByNames([]string{
-		monitoring.ConfigServiceMonitorCheckerScanIntervalSec,
-		monitoring.ConfigServiceMonitorWorkerLimit,
-		monitoring.ConfigServiceMonitorMinIntervalSec,
-		monitoring.ConfigServiceMonitorDefaultIntervalSec,
-		monitoring.ConfigServiceMonitorMinTimeoutSec,
-		monitoring.ConfigServiceMonitorDefaultTimeoutSec,
-		monitoring.ConfigServiceMonitorMaxTimeoutSec,
-	})
-	if err != nil {
-		return defaults
-	}
-	return monitoring.ServiceMonitorLimitsFromConfigMap(cfg)
-}
-
-func (h *Handler) monitorNodeMetricsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	path := r.URL.Path
-	prefix := "/api/v1/monitor/nodes/"
-	if !strings.HasPrefix(path, prefix) {
-		response.WriteJSON(w, response.ErrDefault("无效的路径"))
-		return
-	}
-
-	rest := strings.TrimPrefix(path, prefix)
-	if strings.HasSuffix(rest, "/metrics/latest") {
-		h.handleNodeMetricsLatest(w, r, strings.TrimSuffix(rest, "/metrics/latest"))
-		return
-	}
-	if strings.HasSuffix(rest, "/metrics") {
-		h.handleNodeMetrics(w, r, strings.TrimSuffix(rest, "/metrics"))
-		return
-	}
-
-	response.WriteJSON(w, response.ErrDefault("无效的路径"))
-}
-
-type monitorNodeListItem struct {
-	ID          int64  `json:"id"`
-	Inx         int    `json:"inx"`
-	Name        string `json:"name"`
-	Status      int    `json:"status"`
-	UpdatedTime int64  `json:"updatedTime"`
-}
-
-func (h *Handler) monitorNodeListHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	nodes, err := h.repo.ListMonitorNodes()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	items := make([]monitorNodeListItem, 0, len(nodes))
-	for _, n := range nodes {
-		updated := int64(0)
-		if n.UpdatedTime.Valid {
-			updated = n.UpdatedTime.Int64
-		}
-		items = append(items, monitorNodeListItem{
-			ID:          n.ID,
-			Inx:         n.Inx,
-			Name:        n.Name,
-			Status:      n.Status,
-			UpdatedTime: updated,
-		})
-	}
-
-	response.WriteJSON(w, response.OK(items))
-}
-
-type monitorTunnelListItem struct {
-	ID          int64  `json:"id"`
-	Inx         int    `json:"inx"`
-	Name        string `json:"name"`
-	Status      int    `json:"status"`
-	UpdatedTime int64  `json:"updatedTime"`
-}
-
-func (h *Handler) monitorTunnelListHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	tunnels, err := h.repo.ListMonitorTunnels()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	items := make([]monitorTunnelListItem, 0, len(tunnels))
-	for _, t := range tunnels {
-		items = append(items, monitorTunnelListItem{
-			ID:          t.ID,
-			Inx:         t.Inx,
-			Name:        t.Name,
-			Status:      t.Status,
-			UpdatedTime: t.UpdatedTime,
-		})
-	}
-
-	response.WriteJSON(w, response.OK(items))
-}
-
-func (h *Handler) handleNodeMetrics(w http.ResponseWriter, r *http.Request, nodeIDStr string) {
-	nodeID, err := strconv.ParseInt(nodeIDStr, 10, 64)
-	if err != nil || nodeID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的节点ID"))
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	startMs := now - defaultMetricsRangeMs
-	endMs := now
-
-	if s := r.URL.Query().Get("start"); s != "" {
-		if v, err := strconv.ParseInt(s, 10, 64); err == nil {
-			startMs = v
-		}
-	}
-	if e := r.URL.Query().Get("end"); e != "" {
-		if v, err := strconv.ParseInt(e, 10, 64); err == nil {
-			endMs = v
-		}
-	}
-	if startMs <= 0 || endMs <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的时间范围"))
-		return
-	}
-	if endMs < startMs {
-		response.WriteJSON(w, response.ErrDefault("无效的时间范围"))
-		return
-	}
-	if endMs-startMs > maxMetricsRangeMs {
-		response.WriteJSON(w, response.ErrDefault("时间范围过大"))
-		return
-	}
-
-	metrics, err := h.repo.GetNodeMetrics(nodeID, startMs, endMs)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(metrics))
-}
-
-func (h *Handler) handleNodeMetricsLatest(w http.ResponseWriter, _ *http.Request, nodeIDStr string) {
-	nodeID, err := strconv.ParseInt(nodeIDStr, 10, 64)
-	if err != nil || nodeID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的节点ID"))
-		return
-	}
-
-	metric, err := h.repo.GetLatestNodeMetric(nodeID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if metric == nil {
-		response.WriteJSON(w, response.OK(nil))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(metric))
-}
-
-func (h *Handler) monitorTunnelQualityHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	// Try in-memory cache first
-	if h.qualityProber != nil {
-		items := h.qualityProber.GetAll()
-		if len(items) > 0 {
-			response.WriteJSON(w, response.OK(items))
-			return
-		}
-	}
-
-	// Fallback to database (latest per tunnel)
-	qualities, err := h.repo.GetLatestTunnelQualities()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	snapshots := make([]tunnelQualitySnapshot, 0, len(qualities))
-	for _, q := range qualities {
-		snapshots = append(snapshots, tunnelQualitySnapshot{
-			TunnelID:           q.TunnelID,
-			EntryToExitLatency: q.EntryToExitLatency,
-			ExitToBingLatency:  q.ExitToBingLatency,
-			EntryToExitLoss:    q.EntryToExitLoss,
-			ExitToBingLoss:     q.ExitToBingLoss,
-			Success:            q.Success == 1,
-			ErrorMessage:       q.ErrorMessage,
-			Timestamp:          q.Timestamp,
-		})
-	}
-	response.WriteJSON(w, response.OK(snapshots))
-}
-
-// monitorTunnelQualityHistory returns quality probe history for charting.
-// GET /api/v1/monitor/tunnels/{id}/quality?start=...&end=...
-// Mirrors monitorTunnelMetrics / monitorServiceResultsHandler pattern.
-func (h *Handler) monitorTunnelQualityHistory(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	tunnelIDStr := extractPathParam(r.URL.Path, "/api/v1/monitor/tunnels/", "/quality")
-	tunnelID, err := strconv.ParseInt(tunnelIDStr, 10, 64)
-	if err != nil || tunnelID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的隧道ID"))
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	startMs := now - defaultMetricsRangeMs
-	endMs := now
-
-	if s := r.URL.Query().Get("start"); s != "" {
-		if v, err := strconv.ParseInt(s, 10, 64); err == nil {
-			startMs = v
-		}
-	}
-	if e := r.URL.Query().Get("end"); e != "" {
-		if v, err := strconv.ParseInt(e, 10, 64); err == nil {
-			endMs = v
-		}
-	}
-	if startMs <= 0 || endMs <= 0 || endMs < startMs {
-		response.WriteJSON(w, response.ErrDefault("无效的时间范围"))
-		return
-	}
-	if endMs-startMs > maxMetricsRangeMs {
-		response.WriteJSON(w, response.ErrDefault("时间范围过大"))
-		return
-	}
-
-	results, err := h.repo.GetTunnelQualityHistory(tunnelID, startMs, endMs)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(results))
-}
-
-func (h *Handler) monitorTunnelMetrics(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	path := r.URL.Path
-	prefix := "/api/v1/monitor/tunnels/"
-	if !strings.HasPrefix(path, prefix) {
-		response.WriteJSON(w, response.ErrDefault("无效的路径"))
-		return
-	}
-
-	rest := strings.TrimPrefix(path, prefix)
-
-	// Route: /api/v1/monitor/tunnels/{id}/quality
-	if strings.HasSuffix(rest, "/quality") {
-		h.monitorTunnelQualityHistory(w, r)
-		return
-	}
-
-	// Route: /api/v1/monitor/tunnels/{id}/metrics (original)
-	tunnelIDStr := extractPathParam(path, prefix, "/metrics")
-	tunnelID, err := strconv.ParseInt(tunnelIDStr, 10, 64)
-	if err != nil || tunnelID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的隧道ID"))
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	startMs := now - defaultMetricsRangeMs
-	endMs := now
-
-	if s := r.URL.Query().Get("start"); s != "" {
-		if v, err := strconv.ParseInt(s, 10, 64); err == nil {
-			startMs = v
-		}
-	}
-	if e := r.URL.Query().Get("end"); e != "" {
-		if v, err := strconv.ParseInt(e, 10, 64); err == nil {
-			endMs = v
-		}
-	}
-	if startMs <= 0 || endMs <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的时间范围"))
-		return
-	}
-	if endMs < startMs {
-		response.WriteJSON(w, response.ErrDefault("无效的时间范围"))
-		return
-	}
-	if endMs-startMs > maxMetricsRangeMs {
-		response.WriteJSON(w, response.ErrDefault("时间范围过大"))
-		return
-	}
-
-	metrics, err := h.repo.GetTunnelMetricsAggregated(tunnelID, startMs, endMs)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(metrics))
-}
-
-func (h *Handler) monitorServiceListHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	monitors, err := h.repo.ListServiceMonitors()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(monitors))
-}
-
-type createServiceMonitorRequest struct {
-	Name        string `json:"name"`
-	Type        string `json:"type"`
-	Target      string `json:"target"`
-	IntervalSec int    `json:"intervalSec"`
-	TimeoutSec  int    `json:"timeoutSec"`
-	NodeID      int64  `json:"nodeId"`
-	Enabled     *int   `json:"enabled"`
-}
-
-func (h *Handler) monitorServiceCreate(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	var req createServiceMonitorRequest
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-
-	name := strings.TrimSpace(req.Name)
-	if name == "" {
-		response.WriteJSON(w, response.ErrDefault("名称不能为空"))
-		return
-	}
-
-	monitorType := strings.ToLower(strings.TrimSpace(req.Type))
-	if monitorType != "tcp" && monitorType != "icmp" {
-		response.WriteJSON(w, response.ErrDefault("类型必须是 tcp 或 icmp"))
-		return
-	}
-
-	target := strings.TrimSpace(req.Target)
-	if target == "" {
-		response.WriteJSON(w, response.ErrDefault("目标地址不能为空"))
-		return
-	}
-
-	limits := h.resolveServiceMonitorLimits()
-
-	intervalSec := req.IntervalSec
-	if intervalSec <= 0 {
-		intervalSec = limits.DefaultIntervalSec
-	}
-	if intervalSec < limits.MinIntervalSec {
-		intervalSec = limits.MinIntervalSec
-	}
-
-	timeoutSec := req.TimeoutSec
-	if timeoutSec <= 0 {
-		timeoutSec = limits.DefaultTimeoutSec
-	}
-	if timeoutSec < limits.MinTimeoutSec {
-		timeoutSec = limits.MinTimeoutSec
-	}
-	if timeoutSec > limits.MaxTimeoutSec {
-		timeoutSec = limits.MaxTimeoutSec
-	}
-
-	enabled := 1
-	if req.Enabled != nil {
-		if *req.Enabled == 0 || *req.Enabled == 1 {
-			enabled = *req.Enabled
-		}
-	}
-
-	now := time.Now().UnixMilli()
-	if req.NodeID > 0 {
-		n, err := h.repo.GetNodeByID(req.NodeID)
-		if err != nil {
-			response.WriteJSON(w, response.Err(-2, err.Error()))
-			return
-		}
-		if n == nil {
-			response.WriteJSON(w, response.ErrDefault("节点不存在"))
-			return
-		}
-	}
-	m := &model.ServiceMonitor{
-		Name:        name,
-		Type:        monitorType,
-		Target:      target,
-		IntervalSec: intervalSec,
-		TimeoutSec:  timeoutSec,
-		NodeID:      req.NodeID,
-		Enabled:     enabled,
-		CreatedTime: now,
-		UpdatedTime: now,
-	}
-	if m.Type == "icmp" && m.NodeID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("ICMP 监控必须选择执行节点"))
-		return
-	}
-	// enabled is already normalized above.
-
-	if err := h.repo.CreateServiceMonitor(m); err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(m))
-}
-
-type updateServiceMonitorRequest struct {
-	ID          int64  `json:"id"`
-	Name        string `json:"name"`
-	Type        string `json:"type"`
-	Target      string `json:"target"`
-	IntervalSec int    `json:"intervalSec"`
-	TimeoutSec  int    `json:"timeoutSec"`
-	NodeID      *int64 `json:"nodeId"`
-	Enabled     *int   `json:"enabled"`
-}
-
-func (h *Handler) monitorServiceUpdate(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	var req updateServiceMonitorRequest
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-
-	if req.ID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的监控ID"))
-		return
-	}
-
-	existing, err := h.repo.GetServiceMonitor(req.ID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if existing == nil {
-		response.WriteJSON(w, response.ErrDefault("监控不存在"))
-		return
-	}
-
-	name := strings.TrimSpace(req.Name)
-	if name != "" {
-		existing.Name = name
-	}
-
-	monitorType := strings.ToLower(strings.TrimSpace(req.Type))
-	if monitorType == "tcp" || monitorType == "icmp" {
-		existing.Type = monitorType
-	}
-
-	target := strings.TrimSpace(req.Target)
-	if target != "" {
-		existing.Target = target
-	}
-
-	limits := h.resolveServiceMonitorLimits()
-
-	if req.IntervalSec > 0 {
-		intervalSec := req.IntervalSec
-		if intervalSec < limits.MinIntervalSec {
-			intervalSec = limits.MinIntervalSec
-		}
-		existing.IntervalSec = intervalSec
-	}
-	if req.TimeoutSec > 0 {
-		timeoutSec := req.TimeoutSec
-		if timeoutSec < limits.MinTimeoutSec {
-			timeoutSec = limits.MinTimeoutSec
-		}
-		if timeoutSec > limits.MaxTimeoutSec {
-			timeoutSec = limits.MaxTimeoutSec
-		}
-		existing.TimeoutSec = timeoutSec
-	}
-
-	if req.NodeID != nil {
-		existing.NodeID = *req.NodeID
-	}
-	if req.Enabled != nil {
-		if *req.Enabled == 0 || *req.Enabled == 1 {
-			existing.Enabled = *req.Enabled
-		}
-	}
-
-	existing.UpdatedTime = time.Now().UnixMilli()
-	if existing.Type == "icmp" && existing.NodeID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("ICMP 监控必须选择执行节点"))
-		return
-	}
-	if existing.NodeID > 0 {
-		n, err := h.repo.GetNodeByID(existing.NodeID)
-		if err != nil {
-			response.WriteJSON(w, response.Err(-2, err.Error()))
-			return
-		}
-		if n == nil {
-			response.WriteJSON(w, response.ErrDefault("节点不存在"))
-			return
-		}
-	}
-
-	if err := h.repo.UpdateServiceMonitor(existing); err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(existing))
-}
-
-type deleteServiceMonitorRequest struct {
-	ID int64 `json:"id"`
-}
-
-func (h *Handler) monitorServiceDelete(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	var req deleteServiceMonitorRequest
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-
-	if req.ID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的监控ID"))
-		return
-	}
-
-	if err := h.repo.DeleteServiceMonitor(req.ID); err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OKEmpty())
-}
-
-func (h *Handler) monitorServiceRun(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-	if h.healthCheck == nil {
-		response.WriteJSON(w, response.ErrDefault("监控服务不可用"))
-		return
-	}
-
-	var req deleteServiceMonitorRequest
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	if req.ID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的监控ID"))
-		return
-	}
-
-	m, err := h.repo.GetServiceMonitor(req.ID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if m == nil {
-		response.WriteJSON(w, response.ErrDefault("监控不存在"))
-		return
-	}
-
-	res, err := h.healthCheck.RunOnce(m)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if err := h.repo.InsertServiceMonitorResult(res); err != nil {
-		log.Printf("monitoring write failed op=service_monitor_result.manual_insert monitor_id=%d err=%v", res.MonitorID, err)
-	}
-	response.WriteJSON(w, response.OK(res))
-}
-
-func (h *Handler) monitorServiceResultsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	monitorIDStr := extractPathParam(r.URL.Path, "/api/v1/monitor/services/", "/results")
-	monitorID, err := strconv.ParseInt(monitorIDStr, 10, 64)
-	if err != nil || monitorID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的监控ID"))
-		return
-	}
-
-	// If start/end time range is provided, use time-based query (mirrors node metrics / tunnel quality pattern).
-	startStr := r.URL.Query().Get("start")
-	endStr := r.URL.Query().Get("end")
-	if startStr != "" && endStr != "" {
-		startMs, err1 := strconv.ParseInt(startStr, 10, 64)
-		endMs, err2 := strconv.ParseInt(endStr, 10, 64)
-		if err1 != nil || err2 != nil || startMs <= 0 || endMs <= 0 || endMs < startMs {
-			response.WriteJSON(w, response.ErrDefault("无效的时间范围"))
-			return
-		}
-		if endMs-startMs > maxMetricsRangeMs {
-			response.WriteJSON(w, response.ErrDefault("时间范围过大"))
-			return
-		}
-		results, err := h.repo.GetServiceMonitorResultsByTimeRange(monitorID, startMs, endMs)
-		if err != nil {
-			response.WriteJSON(w, response.Err(-2, err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.OK(results))
-		return
-	}
-
-	// Fallback: count-based limit query (backward compat).
-	limit := 100
-	if l := r.URL.Query().Get("limit"); l != "" {
-		if v, err := strconv.Atoi(l); err == nil && v > 0 && v <= 1000 {
-			limit = v
-		}
-	}
-
-	results, err := h.repo.GetServiceMonitorResults(monitorID, limit)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(results))
-}
-
-func (h *Handler) monitorServiceLatestResultsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-
-	results, err := h.repo.GetLatestServiceMonitorResults()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	response.WriteJSON(w, response.OK(results))
-}
-
-func (h *Handler) monitorServiceLimitsHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureMonitoringAccess(w, r) {
-		return
-	}
-	response.WriteJSON(w, response.OK(h.resolveServiceMonitorLimits()))
-}
-
-func extractPathParam(path, prefix, suffix string) string {
-	if !strings.HasPrefix(path, prefix) {
-		return ""
-	}
-	rest := strings.TrimPrefix(path, prefix)
-	if suffix != "" {
-		rest = strings.TrimSuffix(rest, suffix)
-	}
-	return rest
-}
-
-type monitorAccessData struct {
-	Allowed bool   `json:"allowed"`
-	Reason  string `json:"reason,omitempty"`
-}
-
-// monitorAccessHandler is a lightweight capability check for frontend navigation.
-// It does NOT replace authorization on the actual monitoring endpoints.
-func (h *Handler) monitorAccessHandler(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	userID, roleID, err := userRoleFromRequest(r)
-	if err != nil {
-		response.WriteJSON(w, response.Err(401, "未登录或token已过期"))
-		return
-	}
-	if roleID == 0 {
-		response.WriteJSON(w, response.OK(monitorAccessData{Allowed: true}))
-		return
-	}
-
-	allowed, err := h.repo.HasMonitorPermission(userID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	data := monitorAccessData{Allowed: allowed}
-	if !allowed {
-		data.Reason = "need_admin_grant"
-	}
-	response.WriteJSON(w, response.OK(data))
-}
-
-func (h *Handler) ensureAdminAccess(w http.ResponseWriter, r *http.Request) bool {
-	_, roleID, err := userRoleFromRequest(r)
-	if err != nil {
-		response.WriteJSON(w, response.Err(401, "未登录或token已过期"))
-		return false
-	}
-	if roleID != 0 {
-		response.WriteJSON(w, response.Err(403, "权限不足，仅管理员可操作"))
-		return false
-	}
-	return true
-}
-
-func (h *Handler) ensureMonitoringAccess(w http.ResponseWriter, r *http.Request) bool {
-	userID, roleID, err := userRoleFromRequest(r)
-	if err != nil {
-		response.WriteJSON(w, response.Err(401, "未登录或token已过期"))
-		return false
-	}
-	if roleID == 0 {
-		return true
-	}
-	allowed, err := h.repo.HasMonitorPermission(userID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return false
-	}
-	if !allowed {
-		response.WriteJSON(w, response.Err(403, "权限不足：当前账户非管理员，且未被授予监控权限。请联系管理员在用户管理中授权监控权限。"))
-		return false
-	}
-	return true
-}
-
-func (h *Handler) monitorPermissionList(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodGet {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureAdminAccess(w, r) {
-		return
-	}
-
-	items, err := h.repo.ListMonitorPermissions()
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	response.WriteJSON(w, response.OK(items))
-}
-
-type monitorPermissionMutationRequest struct {
-	UserID int64 `json:"userId"`
-}
-
-func (h *Handler) monitorPermissionAssign(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureAdminAccess(w, r) {
-		return
-	}
-
-	var req monitorPermissionMutationRequest
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	if req.UserID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的用户ID"))
-		return
-	}
-
-	u, err := h.repo.GetUserByID(req.UserID)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if u == nil {
-		response.WriteJSON(w, response.ErrDefault("用户不存在"))
-		return
-	}
-
-	if err := h.repo.InsertMonitorPermission(req.UserID, time.Now().UnixMilli()); err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	response.WriteJSON(w, response.OKEmpty())
-}
-
-func (h *Handler) monitorPermissionRemove(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	if !h.ensureAdminAccess(w, r) {
-		return
-	}
-
-	var req monitorPermissionMutationRequest
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	if req.UserID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("无效的用户ID"))
-		return
-	}
-
-	if err := h.repo.DeleteMonitorPermission(req.UserID); err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	response.WriteJSON(w, response.OKEmpty())
-}

go-backend/internal/http/handler/mutations_forward_ports_test.go

@@ -1,39 +0,0 @@
-package handler
-
-import "testing"
-
-func TestBuildForwardPortEntriesWithPreservedInIP(t *testing.T) {
-	entryNodeIDs := []int64{10, 20, 30}
-	oldPorts := []forwardPortRecord{
-		{NodeID: 10, Port: 10001, InIP: ""},
-		{NodeID: 10, Port: 10002, InIP: "10.0.0.10"},
-		{NodeID: 20, Port: 10003, InIP: "10.0.0.20"},
-	}
-
-	entries := buildForwardPortEntriesWithPreservedInIP(entryNodeIDs, oldPorts, 18080)
-	if len(entries) != 3 {
-		t.Fatalf("expected 3 entries, got %d", len(entries))
-	}
-
-	if entries[0].NodeID != 10 || entries[0].Port != 18080 || entries[0].InIP != "10.0.0.10" {
-		t.Fatalf("unexpected first entry: %+v", entries[0])
-	}
-	if entries[1].NodeID != 20 || entries[1].Port != 18080 || entries[1].InIP != "10.0.0.20" {
-		t.Fatalf("unexpected second entry: %+v", entries[1])
-	}
-	if entries[2].NodeID != 30 || entries[2].Port != 18080 || entries[2].InIP != "" {
-		t.Fatalf("unexpected third entry: %+v", entries[2])
-	}
-}
-
-func TestBuildForwardPortEntriesWithPreservedInIP_EmptyOldPorts(t *testing.T) {
-	entryNodeIDs := []int64{99}
-	entries := buildForwardPortEntriesWithPreservedInIP(entryNodeIDs, nil, 17000)
-
-	if len(entries) != 1 {
-		t.Fatalf("expected 1 entry, got %d", len(entries))
-	}
-	if entries[0].NodeID != 99 || entries[0].Port != 17000 || entries[0].InIP != "" {
-		t.Fatalf("unexpected entry: %+v", entries[0])
-	}
-}

go-backend/internal/http/handler/reconstruct_tunnel_state_test.go

@@ -1,79 +0,0 @@
-package handler
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestReconstructTunnelState_PreservesConnectIP(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "reconstruct-connect-ip.db")
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	h := New(r, "secret")
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(1, 'reconstruct-tunnel', 1.0, 2, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	insertNode := func(id int64, name, ip string) {
-		if err := r.DB().Exec(`
-			INSERT INTO node(id, name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, id, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-	}
-
-	insertNode(101, "entry", "10.90.0.10")
-	insertNode(102, "middle", "10.90.0.20")
-	insertNode(103, "exit", "10.90.0.30")
-
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(1, '1', 101, 30001, 'round', 1, 'tls')
-	`).Error; err != nil {
-		t.Fatalf("insert entry chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol, connect_ip)
-		VALUES(1, '2', 102, 30002, 'round', 1, 'tls', '10.99.9.22')
-	`).Error; err != nil {
-		t.Fatalf("insert middle chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol, connect_ip)
-		VALUES(1, '3', 103, 30003, 'round', 1, 'tls', '10.99.9.33')
-	`).Error; err != nil {
-		t.Fatalf("insert exit chain: %v", err)
-	}
-
-	state, err := h.reconstructTunnelState(1)
-	if err != nil {
-		t.Fatalf("reconstructTunnelState: %v", err)
-	}
-
-	if len(state.ChainHops) != 1 || len(state.ChainHops[0]) != 1 {
-		t.Fatalf("unexpected chain hops: %+v", state.ChainHops)
-	}
-	if got := state.ChainHops[0][0].ConnectIP; got != "10.99.9.22" {
-		t.Fatalf("expected middle connectIp 10.99.9.22, got %q", got)
-	}
-
-	if len(state.OutNodes) != 1 {
-		t.Fatalf("unexpected out nodes: %+v", state.OutNodes)
-	}
-	if got := state.OutNodes[0].ConnectIP; got != "10.99.9.33" {
-		t.Fatalf("expected exit connectIp 10.99.9.33, got %q", got)
-	}
-}

go-backend/internal/http/handler/tunnel_delete_resolution.go

@@ -1,655 +0,0 @@
-package handler
-
-import (
-	"errors"
-	"fmt"
-	"net/http"
-	"strings"
-	"time"
-
-	"go-backend/internal/http/response"
-)
-
-const tunnelDeletePreviewSampleLimit = 5
-
-const (
-	tunnelDeleteActionReplace        = "replace"
-	tunnelDeleteActionDeleteForwards = "delete_forwards"
-)
-
-var (
-	errInvalidTunnelDeleteTarget = errors.New("invalid tunnel delete target")
-)
-
-type tunnelDeleteForwardPreviewItem struct {
-	ID       int64  `json:"id"`
-	Name     string `json:"name"`
-	UserID   int64  `json:"userId"`
-	UserName string `json:"userName"`
-	InPort   int    `json:"inPort"`
-}
-
-type tunnelDeletePreviewData struct {
-	TunnelID       int64                            `json:"tunnelId"`
-	TunnelName     string                           `json:"tunnelName"`
-	ForwardCount   int                              `json:"forwardCount"`
-	SampleForwards []tunnelDeleteForwardPreviewItem `json:"sampleForwards"`
-}
-
-type tunnelBatchDeletePreviewData struct {
-	TunnelCount       int                       `json:"tunnelCount"`
-	TotalForwardCount int                       `json:"totalForwardCount"`
-	Items             []tunnelDeletePreviewData `json:"items"`
-}
-
-type tunnelDeleteWithForwardsRequest struct {
-	ID             int64  `json:"id"`
-	Action         string `json:"action"`
-	TargetTunnelID int64  `json:"targetTunnelId"`
-}
-
-type tunnelBatchDeleteWithForwardsRequest struct {
-	IDs            []int64 `json:"ids"`
-	Action         string  `json:"action"`
-	TargetTunnelID int64   `json:"targetTunnelId"`
-}
-
-type tunnelDeleteWithForwardsResult struct {
-	ForwardCount        int      `json:"forwardCount"`
-	MigratedCount       int      `json:"migratedCount"`
-	DeletedForwardCount int      `json:"deletedForwardCount"`
-	PortAdjustedCount   int      `json:"portAdjustedCount"`
-	Warnings            []string `json:"warnings,omitempty"`
-}
-
-type tunnelBatchDeleteWithForwardsResult struct {
-	SuccessCount        int                  `json:"successCount"`
-	FailCount           int                  `json:"failCount"`
-	Failures            []batchFailureDetail `json:"failures,omitempty"`
-	DeletedForwardCount int                  `json:"deletedForwardCount"`
-	MigratedCount       int                  `json:"migratedCount"`
-	PortAdjustedCount   int                  `json:"portAdjustedCount"`
-	Warnings            []string             `json:"warnings,omitempty"`
-}
-
-type tunnelForwardMigrationPlan struct {
-	forward        *forwardRecord
-	oldPorts       []forwardPortRecord
-	targetTunnelID int64
-	targetPort     int
-	keptNodeIDs    []int64
-	removedNodeIDs []int64
-	portAdjusted   bool
-}
-
-func (h *Handler) tunnelDeletePreview(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	id := idFromBody(r, w)
-	if id <= 0 {
-		return
-	}
-
-	preview, err := h.buildTunnelDeletePreview(id)
-	if err != nil {
-		if strings.Contains(err.Error(), "不存在") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(preview))
-}
-
-func (h *Handler) tunnelBatchDeletePreview(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	var req struct {
-		IDs []int64 `json:"ids"`
-	}
-	if err := decodeJSON(r.Body, &req); err != nil || len(req.IDs) == 0 {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-
-	preview, err := h.buildTunnelBatchDeletePreview(req.IDs)
-	if err != nil {
-		if strings.Contains(err.Error(), "不存在") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-
-	response.WriteJSON(w, response.OK(preview))
-}
-
-func (h *Handler) tunnelDeleteWithForwards(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	var req tunnelDeleteWithForwardsRequest
-	if err := decodeJSON(r.Body, &req); err != nil || req.ID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-
-	action, err := normalizeTunnelDeleteAction(req.Action)
-	if err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	if action == tunnelDeleteActionReplace {
-		if _, _, authErr := userRoleFromRequest(r); authErr != nil {
-			response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
-			return
-		}
-	}
-
-	result, failures, err := h.processTunnelDeleteWithForwards(req.ID, action, req.TargetTunnelID)
-	if err != nil {
-		if err == errInvalidTunnelDeleteTarget {
-			response.WriteJSON(w, response.ErrDefault("目标隧道不能为空"))
-			return
-		}
-		if strings.Contains(err.Error(), "目标隧道不能与当前隧道相同") || strings.Contains(err.Error(), "目标隧道不存在") || strings.Contains(err.Error(), "目标隧道已禁用") || strings.Contains(err.Error(), "隧道不存在") {
-			response.WriteJSON(w, response.ErrDefault(err.Error()))
-			return
-		}
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	if len(failures) > 0 {
-		response.WriteJSON(w, response.R{
-			Code: -2,
-			Msg:  "部分规则迁移失败",
-			TS:   time.Now().UnixMilli(),
-			Data: batchOperationResult{SuccessCount: 0, FailCount: len(failures), Failures: failures},
-		})
-		return
-	}
-
-	response.WriteJSON(w, response.OK(result))
-}
-
-func (h *Handler) tunnelBatchDeleteWithForwards(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-
-	var req tunnelBatchDeleteWithForwardsRequest
-	if err := decodeJSON(r.Body, &req); err != nil || len(req.IDs) == 0 {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-
-	action, err := normalizeTunnelDeleteAction(req.Action)
-	if err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	if action == tunnelDeleteActionReplace {
-		if _, _, authErr := userRoleFromRequest(r); authErr != nil {
-			response.WriteJSON(w, response.Err(401, "无效的token或token已过期"))
-			return
-		}
-	}
-
-	normalizedIDs := normalizeTunnelIDs(req.IDs)
-	if len(normalizedIDs) == 0 {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-
-	if action == tunnelDeleteActionReplace {
-		if req.TargetTunnelID <= 0 {
-			response.WriteJSON(w, response.ErrDefault("目标隧道不能为空"))
-			return
-		}
-		for _, id := range normalizedIDs {
-			if id == req.TargetTunnelID {
-				response.WriteJSON(w, response.ErrDefault("目标隧道不能包含在删除列表中"))
-				return
-			}
-		}
-	}
-
-	result := tunnelBatchDeleteWithForwardsResult{}
-	for _, tunnelID := range normalizedIDs {
-		tunnelName, _ := h.repo.GetTunnelName(tunnelID)
-		singleResult, failures, processErr := h.processTunnelDeleteWithForwards(tunnelID, action, req.TargetTunnelID)
-		if processErr != nil {
-			result.FailCount++
-			result.Failures = appendBatchFailure(result.Failures, tunnelID, tunnelName, processErr)
-			continue
-		}
-		if len(failures) > 0 {
-			result.FailCount++
-			result.Failures = appendBatchFailureReason(
-				result.Failures,
-				tunnelID,
-				tunnelName,
-				summarizeTunnelDeleteRuleFailures(failures),
-			)
-			continue
-		}
-
-		result.SuccessCount++
-		result.DeletedForwardCount += singleResult.DeletedForwardCount
-		result.MigratedCount += singleResult.MigratedCount
-		result.PortAdjustedCount += singleResult.PortAdjustedCount
-		if len(singleResult.Warnings) > 0 {
-			result.Warnings = append(result.Warnings, singleResult.Warnings...)
-		}
-	}
-
-	response.WriteJSON(w, response.OK(result))
-}
-
-func (h *Handler) buildTunnelDeletePreview(tunnelID int64) (*tunnelDeletePreviewData, error) {
-	if _, err := h.getTunnelRecord(tunnelID); err != nil {
-		return nil, err
-	}
-
-	tunnelName, err := h.repo.GetTunnelName(tunnelID)
-	if err != nil {
-		return nil, err
-	}
-
-	forwards, err := h.listForwardsByTunnel(tunnelID)
-	if err != nil {
-		return nil, err
-	}
-
-	samples := make([]tunnelDeleteForwardPreviewItem, 0, minInt(len(forwards), tunnelDeletePreviewSampleLimit))
-	for i, forward := range forwards {
-		if i >= tunnelDeletePreviewSampleLimit {
-			break
-		}
-		ports, portsErr := h.listForwardPorts(forward.ID)
-		if portsErr != nil {
-			return nil, portsErr
-		}
-		inPort := 0
-		if len(ports) > 0 {
-			inPort = ports[0].Port
-		}
-		samples = append(samples, tunnelDeleteForwardPreviewItem{
-			ID:       forward.ID,
-			Name:     forward.Name,
-			UserID:   forward.UserID,
-			UserName: forward.UserName,
-			InPort:   inPort,
-		})
-	}
-
-	return &tunnelDeletePreviewData{
-		TunnelID:       tunnelID,
-		TunnelName:     tunnelName,
-		ForwardCount:   len(forwards),
-		SampleForwards: samples,
-	}, nil
-}
-
-func (h *Handler) buildTunnelBatchDeletePreview(ids []int64) (*tunnelBatchDeletePreviewData, error) {
-	normalizedIDs := normalizeTunnelIDs(ids)
-	items := make([]tunnelDeletePreviewData, 0, len(normalizedIDs))
-	totalForwardCount := 0
-	for _, id := range normalizedIDs {
-		preview, err := h.buildTunnelDeletePreview(id)
-		if err != nil {
-			return nil, err
-		}
-		items = append(items, *preview)
-		totalForwardCount += preview.ForwardCount
-	}
-	return &tunnelBatchDeletePreviewData{
-		TunnelCount:       len(items),
-		TotalForwardCount: totalForwardCount,
-		Items:             items,
-	}, nil
-}
-
-func normalizeTunnelDeleteAction(action string) (string, error) {
-	normalized := strings.TrimSpace(action)
-	if normalized == "" {
-		return tunnelDeleteActionDeleteForwards, nil
-	}
-	if normalized != tunnelDeleteActionReplace && normalized != tunnelDeleteActionDeleteForwards {
-		return "", errors.New("invalid tunnel delete action")
-	}
-	return normalized, nil
-}
-
-func normalizeTunnelIDs(ids []int64) []int64 {
-	seen := make(map[int64]struct{}, len(ids))
-	out := make([]int64, 0, len(ids))
-	for _, id := range ids {
-		if id <= 0 {
-			continue
-		}
-		if _, exists := seen[id]; exists {
-			continue
-		}
-		seen[id] = struct{}{}
-		out = append(out, id)
-	}
-	return out
-}
-
-func summarizeTunnelDeleteRuleFailures(failures []batchFailureDetail) string {
-	if len(failures) == 0 {
-		return "未知错误"
-	}
-	parts := make([]string, 0, minInt(len(failures), 3))
-	for i, failure := range failures {
-		if i >= 3 {
-			break
-		}
-		name := strings.TrimSpace(failure.Name)
-		if name == "" {
-			name = fmt.Sprintf("规则 #%d", failure.ID)
-		}
-		parts = append(parts, fmt.Sprintf("%s: %s", name, strings.TrimSpace(failure.Reason)))
-	}
-	if len(failures) > 3 {
-		parts = append(parts, fmt.Sprintf("另有 %d 条规则失败", len(failures)-3))
-	}
-	return strings.Join(parts, "；")
-}
-
-func (h *Handler) processTunnelDeleteWithForwards(tunnelID int64, action string, targetTunnelID int64) (tunnelDeleteWithForwardsResult, []batchFailureDetail, error) {
-	preview, err := h.buildTunnelDeletePreview(tunnelID)
-	if err != nil {
-		return tunnelDeleteWithForwardsResult{}, nil, err
-	}
-
-	result := tunnelDeleteWithForwardsResult{ForwardCount: preview.ForwardCount}
-	if preview.ForwardCount == 0 {
-		if err := h.deleteTunnelAndCleanup(tunnelID); err != nil {
-			return tunnelDeleteWithForwardsResult{}, nil, err
-		}
-		return result, nil, nil
-	}
-
-	if action == tunnelDeleteActionDeleteForwards {
-		result.DeletedForwardCount = preview.ForwardCount
-		if err := h.deleteTunnelAndCleanup(tunnelID); err != nil {
-			return tunnelDeleteWithForwardsResult{}, nil, err
-		}
-		return result, nil, nil
-	}
-
-	if targetTunnelID <= 0 {
-		return tunnelDeleteWithForwardsResult{}, nil, errInvalidTunnelDeleteTarget
-	}
-	if targetTunnelID == tunnelID {
-		return tunnelDeleteWithForwardsResult{}, nil, errors.New("目标隧道不能与当前隧道相同")
-	}
-	return h.processTunnelDeleteReplaceAction(tunnelID, targetTunnelID, result)
-}
-
-func (h *Handler) processTunnelDeleteReplaceAction(tunnelID, targetTunnelID int64, result tunnelDeleteWithForwardsResult) (tunnelDeleteWithForwardsResult, []batchFailureDetail, error) {
-	targetTunnel, err := h.getTunnelRecord(targetTunnelID)
-	if err != nil {
-		return tunnelDeleteWithForwardsResult{}, nil, errors.New("目标隧道不存在")
-	}
-	if targetTunnel.Status != 1 {
-		return tunnelDeleteWithForwardsResult{}, nil, errors.New("目标隧道已禁用")
-	}
-
-	plans, failures, err := h.planTunnelDeleteForwardMigrations(tunnelID, targetTunnelID)
-	if err != nil {
-		return tunnelDeleteWithForwardsResult{}, nil, err
-	}
-	if len(failures) > 0 {
-		return tunnelDeleteWithForwardsResult{}, failures, nil
-	}
-
-	portAdjustedCount := 0
-	warnings, execErr, execFailure := h.executeTunnelDeleteForwardMigrations(plans)
-	for _, plan := range plans {
-		if plan.portAdjusted {
-			portAdjustedCount++
-		}
-	}
-	if execErr != nil {
-		failures = append(failures, execFailure)
-		return tunnelDeleteWithForwardsResult{}, failures, nil
-	}
-
-	if err := h.deleteTunnelAndCleanup(tunnelID); err != nil {
-		h.rollbackTunnelForwardMigrationPlans(plans)
-		_ = h.redeployTunnelAndForwards(tunnelID)
-		return tunnelDeleteWithForwardsResult{}, nil, err
-	}
-
-	result.MigratedCount = len(plans)
-	result.PortAdjustedCount = portAdjustedCount
-	if len(warnings) > 0 {
-		result.Warnings = warnings
-	}
-	return result, nil, nil
-}
-
-func (h *Handler) planTunnelDeleteForwardMigrations(sourceTunnelID, targetTunnelID int64) ([]tunnelForwardMigrationPlan, []batchFailureDetail, error) {
-	forwards, err := h.listForwardsByTunnel(sourceTunnelID)
-	if err != nil {
-		return nil, nil, err
-	}
-
-	entryNodes, err := h.tunnelEntryNodeIDs(targetTunnelID)
-	if err != nil {
-		return nil, nil, err
-	}
-	if len(entryNodes) == 0 {
-		return nil, nil, errors.New("目标隧道缺少入口节点")
-	}
-
-	plans := make([]tunnelForwardMigrationPlan, 0, len(forwards))
-	failures := make([]batchFailureDetail, 0)
-	reservedPorts := make(map[int64]map[int]bool)
-
-	for _, forward := range forwards {
-		plan, planErr := h.planSingleTunnelDeleteForwardMigration(&forward, targetTunnelID, entryNodes, reservedPorts)
-		if planErr != nil {
-			failures = appendBatchFailure(failures, forward.ID, forward.Name, planErr)
-			continue
-		}
-		plans = append(plans, plan)
-	}
-
-	return plans, failures, nil
-}
-
-func (h *Handler) planSingleTunnelDeleteForwardMigration(forward *forwardRecord, targetTunnelID int64, targetEntryNodes []int64, reservedPorts map[int64]map[int]bool) (tunnelForwardMigrationPlan, error) {
-	if forward == nil {
-		return tunnelForwardMigrationPlan{}, errors.New("转发不存在")
-	}
-
-	oldPorts, err := h.listForwardPorts(forward.ID)
-	if err != nil {
-		return tunnelForwardMigrationPlan{}, err
-	}
-	if len(oldPorts) == 0 {
-		return tunnelForwardMigrationPlan{}, errors.New("转发入口端口不存在")
-	}
-
-	minPort := h.repo.GetMinForwardPort(forward.ID)
-	targetPort := 0
-	if minPort.Valid {
-		targetPort = int(minPort.Int64)
-	}
-	if targetPort <= 0 {
-		targetPort = h.pickTunnelPort(targetTunnelID)
-	}
-	if targetPort <= 0 {
-		targetPort = 10000
-	}
-
-	hasCustomInIP := false
-	for _, oldPort := range oldPorts {
-		if strings.TrimSpace(oldPort.InIP) != "" {
-			hasCustomInIP = true
-			break
-		}
-	}
-	if hasCustomInIP && len(targetEntryNodes) > 1 {
-		return tunnelForwardMigrationPlan{}, errors.New("多入口隧道的转发不支持保留自定义监听IP，请先手动调整该规则")
-	}
-
-	for _, nodeID := range targetEntryNodes {
-		node, nodeErr := h.getNodeRecord(nodeID)
-		if nodeErr != nil {
-			return tunnelForwardMigrationPlan{}, nodeErr
-		}
-		if err := validateRemoteNodePort(node, targetPort); err != nil {
-			return tunnelForwardMigrationPlan{}, err
-		}
-		if err := validateLocalNodePort(node, targetPort); err != nil {
-			return tunnelForwardMigrationPlan{}, err
-		}
-		if err := h.validateForwardPortAvailability(node, targetPort, forward.ID); err != nil {
-			return tunnelForwardMigrationPlan{}, err
-		}
-		if reservedOnNode, ok := reservedPorts[nodeID]; ok && reservedOnNode[targetPort] {
-			return tunnelForwardMigrationPlan{}, fmt.Errorf("目标隧道入口节点端口 %d 已被本次迁移中的其他规则占用", targetPort)
-		}
-	}
-
-	for _, nodeID := range targetEntryNodes {
-		reservedOnNode := reservedPorts[nodeID]
-		if reservedOnNode == nil {
-			reservedOnNode = make(map[int]bool)
-			reservedPorts[nodeID] = reservedOnNode
-		}
-		reservedOnNode[targetPort] = true
-	}
-
-	oldNodeIDs := forwardPortNodeIDs(oldPorts)
-	newNodeIDs := uniqueInt64s(targetEntryNodes)
-	removedNodeIDs := diffInt64s(oldNodeIDs, newNodeIDs)
-	keptNodeIDs := diffInt64s(oldNodeIDs, removedNodeIDs)
-
-	previousPort := 0
-	if len(oldPorts) > 0 {
-		previousPort = oldPorts[0].Port
-	}
-
-	return tunnelForwardMigrationPlan{
-		forward:        forward,
-		oldPorts:       oldPorts,
-		targetTunnelID: targetTunnelID,
-		targetPort:     targetPort,
-		keptNodeIDs:    keptNodeIDs,
-		removedNodeIDs: removedNodeIDs,
-		portAdjusted:   previousPort > 0 && previousPort != targetPort,
-	}, nil
-}
-
-func (h *Handler) executeTunnelDeleteForwardMigrations(plans []tunnelForwardMigrationPlan) ([]string, error, batchFailureDetail) {
-	warnings := make([]string, 0)
-	completed := make([]tunnelForwardMigrationPlan, 0, len(plans))
-
-	for _, plan := range plans {
-		migrationWarnings, err := h.applyTunnelDeleteForwardMigration(plan)
-		if err != nil {
-			h.rollbackTunnelForwardMigrationPlans(completed)
-			return warnings, err, batchFailureDetail{ID: plan.forward.ID, Name: plan.forward.Name, Reason: normalizeBatchFailureReason(errString(err))}
-		}
-		warnings = append(warnings, migrationWarnings...)
-		completed = append(completed, plan)
-	}
-
-	return warnings, nil, batchFailureDetail{}
-}
-
-func (h *Handler) applyTunnelDeleteForwardMigration(plan tunnelForwardMigrationPlan) ([]string, error) {
-	if plan.forward == nil {
-		return nil, errors.New("转发不存在")
-	}
-
-	if err := h.repo.UpdateForwardTunnel(plan.forward.ID, plan.targetTunnelID, time.Now().UnixMilli()); err != nil {
-		return nil, err
-	}
-	if err := h.replaceForwardPorts(plan.forward.ID, plan.targetTunnelID, plan.targetPort, ""); err != nil {
-		h.rollbackForwardMutation(plan.forward, plan.oldPorts)
-		return nil, err
-	}
-
-	updatedForward, err := h.getForwardRecord(plan.forward.ID)
-	if err != nil {
-		h.rollbackForwardMutation(plan.forward, plan.oldPorts)
-		return nil, err
-	}
-
-	warnings := make([]string, 0)
-	if len(plan.keptNodeIDs) > 0 {
-		for _, nodeID := range plan.keptNodeIDs {
-			if delErr := h.deleteForwardServicesOnNodeBatch(plan.forward, nodeID); delErr != nil {
-				nodeLabel := fmt.Sprintf("%d", nodeID)
-				if n, nErr := h.getNodeRecord(nodeID); nErr == nil && n != nil && strings.TrimSpace(n.Name) != "" {
-					nodeLabel = strings.TrimSpace(n.Name)
-				}
-				warnings = append(warnings, fmt.Sprintf("节点 %s 清理旧转发监听失败: %v", nodeLabel, delErr))
-			}
-		}
-		time.Sleep(tunnelServiceBindRetryDelay)
-	}
-
-	syncWarnings, err := h.syncForwardServicesWithWarnings(updatedForward, "UpdateService", true)
-	if err != nil {
-		h.rollbackForwardMutation(plan.forward, plan.oldPorts)
-		return nil, err
-	}
-	warnings = append(warnings, syncWarnings...)
-
-	if len(plan.removedNodeIDs) > 0 {
-		for _, nodeID := range plan.removedNodeIDs {
-			if delErr := h.deleteForwardServicesOnNodeBatch(plan.forward, nodeID); delErr != nil {
-				nodeLabel := fmt.Sprintf("%d", nodeID)
-				if n, nErr := h.getNodeRecord(nodeID); nErr == nil && n != nil && strings.TrimSpace(n.Name) != "" {
-					nodeLabel = strings.TrimSpace(n.Name)
-				}
-				warnings = append(warnings, fmt.Sprintf("节点 %s 清理旧隧道残留服务失败: %v", nodeLabel, delErr))
-			}
-		}
-	}
-
-	return warnings, nil
-}
-
-func (h *Handler) rollbackTunnelForwardMigrationPlans(plans []tunnelForwardMigrationPlan) {
-	for i := len(plans) - 1; i >= 0; i-- {
-		plan := plans[i]
-		h.rollbackForwardMutation(plan.forward, plan.oldPorts)
-	}
-}
-
-func (h *Handler) deleteTunnelAndCleanup(tunnelID int64) error {
-	h.cleanupTunnelRuntime(tunnelID)
-	h.cleanupFederationRuntime(tunnelID)
-	if err := h.deleteTunnelByID(tunnelID); err != nil {
-		return err
-	}
-	return nil
-}
-
-func minInt(a, b int) int {
-	if a < b {
-		return a
-	}
-	return b
-}

go-backend/internal/http/handler/tunnel_entry_sqlite_test.go

@@ -1,104 +0,0 @@
-package handler
-
-import (
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestValidateTunnelEntryPortConflictsForNewEntriesDoesNotBlockOnSQLiteTx(t *testing.T) {
-	r, err := repo.Open(filepath.Join(t.TempDir(), "panel.db"))
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = r.Close()
-	})
-	h := &Handler{repo: r}
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, port, created_time, status, tcp_listen_addr, udp_listen_addr, is_remote)
-		VALUES
-			('entry-old', 'secret-old', '10.0.0.1', '12000-12010', ?, 1, '[::]', '[::]', 0),
-			('entry-new', 'secret-new', '10.0.0.2', '12000-12010', ?, 1, '[::]', '[::]', 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert nodes: %v", err)
-	}
-	var oldEntryID, newEntryID int64
-	if err := r.DB().Raw(`SELECT id FROM node WHERE name = 'entry-old'`).Scan(&oldEntryID).Error; err != nil {
-		t.Fatalf("load old entry id: %v", err)
-	}
-	if err := r.DB().Raw(`SELECT id FROM node WHERE name = 'entry-new'`).Scan(&newEntryID).Error; err != nil {
-		t.Fatalf("load new entry id: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, inx, ip_preference)
-		VALUES('sqlite-tunnel', 1, 1, 'tls', 1, ?, ?, 1, 1, '')
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	var tunnelID int64
-	if err := r.DB().Raw(`SELECT id FROM tunnel WHERE name = 'sqlite-tunnel'`).Scan(&tunnelID).Error; err != nil {
-		t.Fatalf("load tunnel id: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, inx, protocol)
-		VALUES(?, '1', ?, 1, 'tls')
-	`, tunnelID, oldEntryID).Error; err != nil {
-		t.Fatalf("insert chain_tunnel: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, created_time, updated_time, status, inx)
-		VALUES(1, 'tester', 'forward-a', ?, '127.0.0.1:8080', 'fifo', ?, ?, 1, 1)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	var forwardID int64
-	if err := r.DB().Raw(`SELECT id FROM forward WHERE name = 'forward-a'`).Scan(&forwardID).Error; err != nil {
-		t.Fatalf("load forward id: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward_port(forward_id, node_id, port)
-		VALUES(?, ?, 12001)
-	`, forwardID, oldEntryID).Error; err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	tx := r.BeginTx()
-	if tx == nil {
-		t.Fatal("begin tx: nil transaction")
-	}
-	if tx.Error != nil {
-		t.Fatalf("begin tx: %v", tx.Error)
-	}
-
-	errCh := make(chan error, 1)
-	doneCh := make(chan struct{})
-	go func() {
-		defer close(doneCh)
-		errCh <- h.validateTunnelEntryPortConflictsForNewEntriesTx(tx, tunnelID, []int64{oldEntryID}, []int64{oldEntryID, newEntryID})
-	}()
-
-	select {
-	case err := <-errCh:
-		if err != nil {
-			_ = tx.Rollback().Error
-			t.Fatalf("unexpected validation error: %v", err)
-		}
-	case <-time.After(500 * time.Millisecond):
-		_ = tx.Rollback().Error
-		<-doneCh
-		t.Fatal("validation blocked while transaction was open on sqlite")
-	}
-
-	if err := tx.Rollback().Error; err != nil {
-		t.Fatalf("rollback tx: %v", err)
-	}
-}

go-backend/internal/http/handler/tunnel_metrics_ingestion.go

@@ -1,111 +0,0 @@
-package handler
-
-import (
-	"log"
-	"strings"
-	"time"
-
-	"go-backend/internal/store/model"
-)
-
-type tunnelTrafficDelta struct {
-	bytesIn  int64
-	bytesOut int64
-}
-
-func unixMilliBucketMinute(nowMs int64) int64 {
-	if nowMs <= 0 {
-		return 0
-	}
-	const minuteMs = int64(time.Minute / time.Millisecond)
-	return nowMs - (nowMs % minuteMs)
-}
-
-func (h *Handler) recordTunnelMetricsFromFlowItems(nodeID int64, items []flowItem, nowMs int64) {
-	if h == nil || h.repo == nil {
-		return
-	}
-	if nodeID <= 0 || len(items) == 0 {
-		return
-	}
-
-	bucketTs := unixMilliBucketMinute(nowMs)
-	if bucketTs <= 0 {
-		return
-	}
-
-	forwardDeltas := make(map[int64]tunnelTrafficDelta)
-	for _, item := range items {
-		name := strings.TrimSpace(item.N)
-		if name == "" || name == "web_api" {
-			continue
-		}
-		forwardID, _, _, ok := parseFlowServiceIDs(name)
-		if !ok {
-			continue
-		}
-		if item.D == 0 && item.U == 0 {
-			continue
-		}
-		d := forwardDeltas[forwardID]
-		d.bytesIn += item.D
-		d.bytesOut += item.U
-		forwardDeltas[forwardID] = d
-	}
-	if len(forwardDeltas) == 0 {
-		return
-	}
-
-	forwardIDs := make([]int64, 0, len(forwardDeltas))
-	for id := range forwardDeltas {
-		forwardIDs = append(forwardIDs, id)
-	}
-
-	forwardTunnelMap, err := h.repo.MapForwardIDsToTunnelIDs(forwardIDs)
-	if err != nil {
-		log.Printf("monitoring write skipped op=tunnel_metric.map_forward_to_tunnel node_id=%d err=%v", nodeID, err)
-		return
-	}
-	if len(forwardTunnelMap) == 0 {
-		return
-	}
-
-	tunnelAgg := make(map[int64]tunnelTrafficDelta)
-	for forwardID, delta := range forwardDeltas {
-		tunnelID := forwardTunnelMap[forwardID]
-		if tunnelID <= 0 {
-			continue
-		}
-		a := tunnelAgg[tunnelID]
-		a.bytesIn += delta.bytesIn
-		a.bytesOut += delta.bytesOut
-		tunnelAgg[tunnelID] = a
-	}
-	if len(tunnelAgg) == 0 {
-		return
-	}
-
-	metrics := make([]*model.TunnelMetric, 0, len(tunnelAgg))
-	for tunnelID, delta := range tunnelAgg {
-		if delta.bytesIn == 0 && delta.bytesOut == 0 {
-			continue
-		}
-		metrics = append(metrics, &model.TunnelMetric{
-			TunnelID:     tunnelID,
-			NodeID:       nodeID,
-			Timestamp:    bucketTs,
-			BytesIn:      delta.bytesIn,
-			BytesOut:     delta.bytesOut,
-			Connections:  0,
-			Errors:       0,
-			AvgLatencyMs: 0,
-		})
-	}
-	if len(metrics) == 0 {
-		return
-	}
-
-	if err := h.repo.UpsertTunnelMetricBuckets(metrics); err != nil {
-		log.Printf("monitoring write failed op=tunnel_metric.upsert_buckets node_id=%d bucket_ts=%d count=%d err=%v", nodeID, bucketTs, len(metrics), err)
-	}
-}

go-backend/internal/http/handler/tunnel_quality_prober.go

@@ -1,332 +0,0 @@
-package handler
-
-import (
-	"context"
-	"log"
-	"sync"
-	"time"
-
-	"go-backend/internal/store/model"
-)
-
-const (
-	tunnelQualityProbeInterval = 10 * time.Second
-	tunnelQualityProbeTimeout  = 8 * time.Second
-	tunnelQualityPingTimeoutMs = 5000
-	tunnelQualityRetention     = 24 * time.Hour // keep 24h of history
-	tunnelQualityPruneInterval = 10 * time.Minute
-)
-
-// tunnelQualitySnapshot is the in-memory latest probe result for a tunnel.
-type tunnelQualitySnapshot struct {
-	TunnelID           int64   `json:"tunnelId"`
-	EntryToExitLatency float64 `json:"entryToExitLatency"`
-	ExitToBingLatency  float64 `json:"exitToBingLatency"`
-	EntryToExitLoss    float64 `json:"entryToExitLoss"`
-	ExitToBingLoss     float64 `json:"exitToBingLoss"`
-	Success            bool    `json:"success"`
-	ErrorMessage       string  `json:"errorMessage,omitempty"`
-	Timestamp          int64   `json:"timestamp"`
-}
-
-// tunnelQualityProber runs periodic TCP ping probes against all enabled tunnels.
-// Design mirrors health.Checker: background goroutine with worker pool + scheduled cleanup.
-type tunnelQualityProber struct {
-	handler   *Handler
-	cache     sync.Map // tunnelID (int64) → *tunnelQualitySnapshot
-	ctx       context.Context
-	cancel    context.CancelFunc
-	interval  time.Duration
-	lastPrune int64
-}
-
-// newTunnelQualityProber creates a new prober (not yet running).
-func newTunnelQualityProber(h *Handler) *tunnelQualityProber {
-	ctx, cancel := context.WithCancel(context.Background())
-	return &tunnelQualityProber{
-		handler:  h,
-		ctx:      ctx,
-		cancel:   cancel,
-		interval: tunnelQualityProbeInterval,
-	}
-}
-
-// Start launches the background probe loop (call from jobs.go).
-func (p *tunnelQualityProber) Start(ctx context.Context) {
-	// Use the provided context so we stop with other background jobs.
-	p.ctx, p.cancel = context.WithCancel(ctx)
-	p.loop()
-}
-
-// Stop halts the background probe loop.
-func (p *tunnelQualityProber) Stop() {
-	p.cancel()
-}
-
-// GetAll returns all cached quality snapshots (latest per tunnel).
-func (p *tunnelQualityProber) GetAll() []tunnelQualitySnapshot {
-	var items []tunnelQualitySnapshot
-	p.cache.Range(func(_, value interface{}) bool {
-		if snap, ok := value.(*tunnelQualitySnapshot); ok {
-			items = append(items, *snap)
-		}
-		return true
-	})
-	return items
-}
-
-func (p *tunnelQualityProber) loop() {
-	// Initial delay to let the system boot up
-	select {
-	case <-time.After(5 * time.Second):
-	case <-p.ctx.Done():
-		return
-	}
-
-	// Run once immediately
-	p.probeAll()
-
-	ticker := time.NewTicker(p.interval)
-	defer ticker.Stop()
-
-	for {
-		select {
-		case <-p.ctx.Done():
-			return
-		case <-ticker.C:
-			p.probeAll()
-			p.maybePrune()
-		}
-	}
-}
-
-// maybePrune deletes old quality rows periodically (mirrors PruneServiceMonitorResults).
-func (p *tunnelQualityProber) maybePrune() {
-	now := time.Now().UnixMilli()
-	if p.lastPrune > 0 && now-p.lastPrune < int64(tunnelQualityPruneInterval/time.Millisecond) {
-		return
-	}
-	p.lastPrune = now
-
-	h := p.handler
-	if h == nil || h.repo == nil {
-		return
-	}
-
-	cutoff := now - int64(tunnelQualityRetention/time.Millisecond)
-	if err := h.repo.PruneTunnelQualityResults(cutoff); err != nil {
-		log.Printf("tunnel_quality_prober: prune err=%v", err)
-	}
-}
-
-func (p *tunnelQualityProber) probeAll() {
-	h := p.handler
-	if h == nil || h.repo == nil {
-		return
-	}
-
-	tunnelIDs, err := h.repo.ListEnabledTunnelIDs()
-	if err != nil {
-		log.Printf("tunnel_quality_prober: list enabled tunnels err=%v", err)
-		return
-	}
-	if len(tunnelIDs) == 0 {
-		return
-	}
-
-	// Probe tunnels concurrently with a worker limit
-	// (mirrors health.Checker worker pool pattern)
-	const maxWorkers = 4
-	sem := make(chan struct{}, maxWorkers)
-	var wg sync.WaitGroup
-
-	for _, tunnelID := range tunnelIDs {
-		select {
-		case <-p.ctx.Done():
-			return
-		default:
-		}
-
-		wg.Add(1)
-		sem <- struct{}{}
-		go func(tid int64) {
-			defer wg.Done()
-			defer func() { <-sem }()
-			p.probeTunnel(tid)
-		}(tunnelID)
-	}
-	wg.Wait()
-}
-
-func (p *tunnelQualityProber) probeTunnel(tunnelID int64) {
-	h := p.handler
-	if h == nil || h.repo == nil {
-		return
-	}
-
-	now := time.Now().UnixMilli()
-	snap := &tunnelQualitySnapshot{
-		TunnelID:  tunnelID,
-		Timestamp: now,
-	}
-
-	// Get tunnel chain info
-	tunnel, err := h.getTunnelRecord(tunnelID)
-	if err != nil {
-		snap.ErrorMessage = "隧道不存在"
-		p.storeResult(snap)
-		return
-	}
-
-	chainRows, err := h.listChainNodesForTunnel(tunnelID)
-	if err != nil || len(chainRows) == 0 {
-		snap.ErrorMessage = "隧道配置不完整"
-		p.storeResult(snap)
-		return
-	}
-
-	ipPreference := h.repo.GetTunnelIPPreference(tunnelID)
-	inNodes, _, outNodes := splitChainNodeGroups(chainRows)
-
-	options := diagnosisExecOptions{
-		commandTimeout: tunnelQualityProbeTimeout,
-		pingTimeoutMS:  tunnelQualityPingTimeoutMs,
-		timeoutMessage: "探测超时",
-	}
-
-	switch tunnel.Type {
-	case 1:
-		// Port forwarding: entry → Bing only
-		if len(inNodes) > 0 {
-			lat, loss, err := p.tcpPingNode(inNodes[0].NodeID, "www.bing.com", 443, options)
-			if err == nil {
-				snap.ExitToBingLatency = lat
-				snap.ExitToBingLoss = loss
-				snap.Success = true
-			} else {
-				snap.ErrorMessage = err.Error()
-			}
-		}
-	case 2:
-		// Tunnel forwarding: entry → exit + exit → Bing
-		probeOK := true
-
-		if len(inNodes) > 0 && len(outNodes) > 0 {
-			// Entry → Exit
-			targetNode, nodeErr := h.getNodeRecord(outNodes[0].NodeID)
-			if nodeErr == nil && targetNode != nil {
-				fromNode, _ := h.getNodeRecord(inNodes[0].NodeID)
-				targetIP, targetPort, resolveErr := resolveChainProbeTarget(fromNode, targetNode, outNodes[0].Port, ipPreference, outNodes[0].ConnectIP)
-				if resolveErr == nil {
-					lat, loss, err := p.tcpPingNode(inNodes[0].NodeID, targetIP, targetPort, options)
-					if err == nil {
-						snap.EntryToExitLatency = lat
-						snap.EntryToExitLoss = loss
-					} else {
-						snap.EntryToExitLatency = -1
-						snap.EntryToExitLoss = 100
-						probeOK = false
-					}
-				} else {
-					snap.ErrorMessage = resolveErr.Error()
-					probeOK = false
-				}
-			} else {
-				snap.ErrorMessage = "出口节点不可用"
-				probeOK = false
-			}
-		}
-
-		// Exit → Bing
-		if len(outNodes) > 0 {
-			lat, loss, err := p.tcpPingNode(outNodes[0].NodeID, "www.bing.com", 443, options)
-			if err == nil {
-				snap.ExitToBingLatency = lat
-				snap.ExitToBingLoss = loss
-			} else {
-				if snap.ErrorMessage == "" {
-					snap.ErrorMessage = err.Error()
-				}
-				probeOK = false
-			}
-		}
-
-		snap.Success = probeOK
-	default:
-		// Unknown type: entry → Bing
-		if len(inNodes) > 0 {
-			lat, loss, err := p.tcpPingNode(inNodes[0].NodeID, "www.bing.com", 443, options)
-			if err == nil {
-				snap.ExitToBingLatency = lat
-				snap.ExitToBingLoss = loss
-				snap.Success = true
-			} else {
-				snap.ErrorMessage = err.Error()
-			}
-		}
-	}
-
-	p.storeResult(snap)
-}
-
-func (p *tunnelQualityProber) tcpPingNode(nodeID int64, ip string, port int, options diagnosisExecOptions) (latency float64, loss float64, err error) {
-	h := p.handler
-	if h == nil {
-		return 0, 100, nil
-	}
-
-	node, nodeErr := h.getNodeRecord(nodeID)
-	if nodeErr != nil {
-		return 0, 100, nodeErr
-	}
-
-	var pingData map[string]interface{}
-	var pingErr error
-	if node != nil && node.IsRemote == 1 {
-		pingData, pingErr = h.tcpPingViaRemoteNode(node, ip, port, options)
-	} else {
-		pingData, pingErr = h.tcpPingViaNode(nodeID, ip, port, options)
-	}
-	if pingErr != nil {
-		return 0, 100, pingErr
-	}
-
-	avgTime := asFloat(pingData["averageTime"], 0)
-	packetLoss := asFloat(pingData["packetLoss"], 100)
-
-	return avgTime, packetLoss, nil
-}
-
-func (p *tunnelQualityProber) storeResult(snap *tunnelQualitySnapshot) {
-	if snap == nil {
-		return
-	}
-
-	// Update in-memory cache (latest per tunnel)
-	p.cache.Store(snap.TunnelID, snap)
-
-	// Persist to database (history)
-	h := p.handler
-	if h == nil || h.repo == nil {
-		return
-	}
-
-	successInt := 0
-	if snap.Success {
-		successInt = 1
-	}
-
-	q := &model.TunnelQuality{
-		TunnelID:           snap.TunnelID,
-		EntryToExitLatency: snap.EntryToExitLatency,
-		ExitToBingLatency:  snap.ExitToBingLatency,
-		EntryToExitLoss:    snap.EntryToExitLoss,
-		ExitToBingLoss:     snap.ExitToBingLoss,
-		Success:            successInt,
-		ErrorMessage:       snap.ErrorMessage,
-		Timestamp:          snap.Timestamp,
-	}
-	if err := h.repo.InsertTunnelQuality(q); err != nil {
-		log.Printf("tunnel_quality_prober: insert db err=%v tunnel_id=%d", err, snap.TunnelID)
-	}
-}

go-backend/internal/http/handler/upgrade.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"io"
 	"net/http"
-	"regexp"
 	"strings"
 	"sync"
 	"time"
@@ -20,104 +19,8 @@ const (
 	githubHTMLBase = "https://github.com"
 	upgradeTimeout = 5 * time.Minute
 	batchWorkers   = 5
-
-	releaseChannelStable = "stable"
-	releaseChannelDev    = "dev"
 )
 
-var (
-	stableVersionPattern = regexp.MustCompile(`^\d+(?:\.\d+)+$`)
-	testKeywordPattern   = regexp.MustCompile(`(?i)(alpha|beta|rc)`)
-)
-
-type githubRelease struct {
-	TagName     string `json:"tag_name"`
-	Name        string `json:"name"`
-	PublishedAt string `json:"published_at"`
-	Prerelease  bool   `json:"prerelease"`
-	Draft       bool   `json:"draft"`
-}
-
-func normalizeReleaseChannel(channel string) string {
-	switch strings.ToLower(strings.TrimSpace(channel)) {
-	case releaseChannelDev:
-		return releaseChannelDev
-	default:
-		return releaseChannelStable
-	}
-}
-
-func releaseChannelFromTag(tag string) string {
-	normalized := strings.ToLower(strings.TrimSpace(tag))
-	if normalized == "" {
-		return releaseChannelDev
-	}
-	if testKeywordPattern.MatchString(normalized) {
-		return releaseChannelDev
-	}
-	if stableVersionPattern.MatchString(normalized) {
-		return releaseChannelStable
-	}
-
-	return releaseChannelDev
-}
-
-func releaseChannelLabel(channel string) string {
-	if normalizeReleaseChannel(channel) == releaseChannelDev {
-		return "测试版"
-	}
-
-	return "正式版"
-}
-
-func fetchGitHubReleases(perPage int) ([]githubRelease, error) {
-	if perPage <= 0 {
-		perPage = 20
-	}
-
-	client := &http.Client{Timeout: 15 * time.Second}
-	resp, err := client.Get(fmt.Sprintf("%s/repos/%s/releases?per_page=%d", githubAPIBase, githubRepo, perPage))
-	if err != nil {
-		return nil, fmt.Errorf("请求GitHub API失败: %v", err)
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
-		return nil, fmt.Errorf("GitHub API返回 %d: %s", resp.StatusCode, string(body))
-	}
-
-	var releases []githubRelease
-	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
-		return nil, fmt.Errorf("解析GitHub API响应失败: %v", err)
-	}
-
-	return releases, nil
-}
-
-func resolveLatestReleaseByChannel(channel string) (string, error) {
-	normalizedChannel := normalizeReleaseChannel(channel)
-	releases, err := fetchGitHubReleases(50)
-	if err != nil {
-		return "", err
-	}
-
-	for _, r := range releases {
-		if r.Draft {
-			continue
-		}
-		tag := strings.TrimSpace(r.TagName)
-		if tag == "" {
-			continue
-		}
-		if releaseChannelFromTag(tag) == normalizedChannel {
-			return tag, nil
-		}
-	}
-
-	return "", fmt.Errorf("未找到%s版本号", releaseChannelLabel(normalizedChannel))
-}
-
 func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 	if r.Method != http.MethodPost {
 		response.WriteJSON(w, response.ErrDefault("请求失败"))
@@ -127,7 +30,6 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 	var req struct {
 		ID      int64  `json:"id"`
 		Version string `json:"version"`
-		Channel string `json:"channel"`
 	}
 	if err := decodeJSON(r.Body, &req); err != nil {
 		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
@@ -138,13 +40,12 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	channel := normalizeReleaseChannel(req.Channel)
 	version := strings.TrimSpace(req.Version)
 	if version == "" {
 		var err error
-		version, err = resolveLatestReleaseByChannel(channel)
+		version, err = resolveLatestRelease()
 		if err != nil {
-			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新%s失败: %v", releaseChannelLabel(channel), err)))
+			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新版本失败: %v", err)))
 			return
 		}
 	}
@@ -166,7 +67,6 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("升级失败: %v", err)))
 		return
 	}
-	h.markNodePendingUpgradeRedeploy(req.ID)
 
 	response.WriteJSON(w, response.OK(map[string]interface{}{
 		"version": version,
@@ -175,11 +75,61 @@ func (h *Handler) nodeUpgrade(w http.ResponseWriter, r *http.Request) {
 }
 
 func resolveLatestRelease() (string, error) {
-	return resolveLatestReleaseByChannel(releaseChannelStable)
+	client := &http.Client{
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return http.ErrUseLastResponse
+		},
+		Timeout: 10 * time.Second,
+	}
+
+	resp, err := client.Get(githubProxy + "/" + githubHTMLBase + "/" + githubRepo + "/releases/latest")
+	if err != nil {
+		return "", fmt.Errorf("请求GitHub失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusFound && resp.StatusCode != http.StatusMovedPermanently {
+		return resolveLatestReleaseAPI()
+	}
+
+	location := resp.Header.Get("Location")
+	if location == "" {
+		return resolveLatestReleaseAPI()
+	}
+
+	parts := strings.Split(location, "/")
+	tag := parts[len(parts)-1]
+	if tag == "" || tag == "latest" {
+		return resolveLatestReleaseAPI()
+	}
+
+	return tag, nil
 }
 
 func resolveLatestReleaseAPI() (string, error) {
-	return resolveLatestReleaseByChannel(releaseChannelStable)
+	client := &http.Client{Timeout: 10 * time.Second}
+	resp, err := client.Get(githubAPIBase + "/repos/" + githubRepo + "/releases/latest")
+	if err != nil {
+		return "", fmt.Errorf("请求GitHub API失败: %v", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		return "", fmt.Errorf("GitHub API返回 %d: %s", resp.StatusCode, string(body))
+	}
+
+	var release struct {
+		TagName string `json:"tag_name"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&release); err != nil {
+		return "", fmt.Errorf("解析GitHub API响应失败: %v", err)
+	}
+	if strings.TrimSpace(release.TagName) == "" {
+		return "", fmt.Errorf("无法从GitHub获取最新版本号")
+	}
+
+	return release.TagName, nil
 }
 
 func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
@@ -191,7 +141,6 @@ func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
 	var req struct {
 		IDs     []int64 `json:"ids"`
 		Version string  `json:"version"`
-		Channel string  `json:"channel"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
@@ -202,13 +151,12 @@ func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	channel := normalizeReleaseChannel(req.Channel)
 	version := strings.TrimSpace(req.Version)
 	if version == "" {
 		var err error
-		version, err = resolveLatestReleaseByChannel(channel)
+		version, err = resolveLatestRelease()
 		if err != nil {
-			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新%s失败: %v", releaseChannelLabel(channel), err)))
+			response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取最新版本失败: %v", err)))
 			return
 		}
 	}
@@ -247,7 +195,6 @@ func (h *Handler) nodeBatchUpgrade(w http.ResponseWriter, r *http.Request) {
 				results[index] = upgradeResult{ID: nodeID, Success: false, Message: err.Error()}
 				return
 			}
-			h.markNodePendingUpgradeRedeploy(nodeID)
 			results[index] = upgradeResult{ID: nodeID, Success: true, Message: result.Message}
 		}(i, id)
 	}
@@ -265,19 +212,29 @@ func (h *Handler) listReleases(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	var req struct {
-		Channel string `json:"channel"`
+	client := &http.Client{Timeout: 15 * time.Second}
+	resp, err := client.Get(githubAPIBase + "/repos/" + githubRepo + "/releases?per_page=20")
+	if err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: %v", err)))
+		return
 	}
-	if err := decodeJSON(r.Body, &req); err != nil && err != io.EOF {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		body, _ := io.ReadAll(io.LimitReader(resp.Body, 512))
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: GitHub API返回 %d: %s", resp.StatusCode, string(body))))
 		return
 	}
 
-	channel := normalizeReleaseChannel(req.Channel)
-
-	releases, err := fetchGitHubReleases(50)
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("获取版本列表失败: %v", err)))
+	var releases []struct {
+		TagName     string `json:"tag_name"`
+		Name        string `json:"name"`
+		PublishedAt string `json:"published_at"`
+		Prerelease  bool   `json:"prerelease"`
+		Draft       bool   `json:"draft"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&releases); err != nil {
+		response.WriteJSON(w, response.Err(-2, fmt.Sprintf("解析版本列表失败: %v", err)))
 		return
 	}
 
@@ -286,7 +243,6 @@ func (h *Handler) listReleases(w http.ResponseWriter, r *http.Request) {
 		Name        string `json:"name"`
 		PublishedAt string `json:"publishedAt"`
 		Prerelease  bool   `json:"prerelease"`
-		Channel     string `json:"channel"`
 	}
 
 	items := make([]releaseItem, 0, len(releases))
@@ -294,20 +250,11 @@ func (h *Handler) listReleases(w http.ResponseWriter, r *http.Request) {
 		if r.Draft {
 			continue
 		}
-		tag := strings.TrimSpace(r.TagName)
-		if tag == "" {
-			continue
-		}
-		itemChannel := releaseChannelFromTag(tag)
-		if itemChannel != channel {
-			continue
-		}
 		items = append(items, releaseItem{
-			Version:     tag,
+			Version:     r.TagName,
 			Name:        r.Name,
 			PublishedAt: r.PublishedAt,
-			Prerelease:  itemChannel == releaseChannelDev,
-			Channel:     itemChannel,
+			Prerelease:  r.Prerelease,
 		})
 	}
 
@@ -342,66 +289,3 @@ func (h *Handler) nodeRollback(w http.ResponseWriter, r *http.Request) {
 		"message": result.Message,
 	}))
 }
-
-func (h *Handler) markNodePendingUpgradeRedeploy(nodeID int64) {
-	if h == nil || nodeID <= 0 {
-		return
-	}
-	h.upgradeMu.Lock()
-	h.pendingUpgradeRedeploy[nodeID] = struct{}{}
-	h.upgradeMu.Unlock()
-}
-
-func (h *Handler) consumeNodePendingUpgradeRedeploy(nodeID int64) bool {
-	if h == nil || nodeID <= 0 {
-		return false
-	}
-	h.upgradeMu.Lock()
-	_, ok := h.pendingUpgradeRedeploy[nodeID]
-	if ok {
-		delete(h.pendingUpgradeRedeploy, nodeID)
-	}
-	h.upgradeMu.Unlock()
-	return ok
-}
-
-func (h *Handler) onNodeOnline(nodeID int64) {
-	if !h.consumeNodePendingUpgradeRedeploy(nodeID) {
-		return
-	}
-	h.redeployNodeRuntimeAfterUpgrade(nodeID)
-}
-
-func (h *Handler) redeployNodeRuntimeAfterUpgrade(nodeID int64) {
-	tunnelIDs, err := h.repo.ListActiveTunnelIDsByNode(nodeID)
-	if err != nil {
-		fmt.Printf("post-upgrade redeploy: list tunnels for node %d failed: %v\n", nodeID, err)
-		return
-	}
-	forwardIDs, err := h.repo.ListActiveForwardIDsByNode(nodeID)
-	if err != nil {
-		fmt.Printf("post-upgrade redeploy: list forwards for node %d failed: %v\n", nodeID, err)
-		return
-	}
-
-	tunnelFailed := make(map[int64]struct{})
-	for _, tunnelID := range tunnelIDs {
-		if err := h.redeployTunnelAndForwards(tunnelID); err != nil {
-			tunnelFailed[tunnelID] = struct{}{}
-			fmt.Printf("post-upgrade redeploy: tunnel %d failed on node %d: %v\n", tunnelID, nodeID, err)
-		}
-	}
-
-	for _, forwardID := range forwardIDs {
-		forward, getErr := h.getForwardRecord(forwardID)
-		if getErr != nil || forward == nil {
-			continue
-		}
-		if _, skipped := tunnelFailed[forward.TunnelID]; skipped {
-			continue
-		}
-		if err := h.syncForwardServices(forward, "UpdateService", true); err != nil {
-			fmt.Printf("post-upgrade redeploy: forward %d failed on node %d: %v\n", forwardID, nodeID, err)
-		}
-	}
-}

go-backend/internal/http/handler/upgrade_release_channel_test.go

@@ -1,46 +0,0 @@
-package handler
-
-import "testing"
-
-func TestReleaseChannelFromTag(t *testing.T) {
-	tests := []struct {
-		name    string
-		tag     string
-		expects string
-	}{
-		{name: "stable semantic version", tag: "2.1.4", expects: releaseChannelStable},
-		{name: "v prefix should be dev", tag: "v2.1.4", expects: releaseChannelDev},
-		{name: "rc release", tag: "2.1.4-rc2", expects: releaseChannelDev},
-		{name: "beta release", tag: "2.1.4-beta.1", expects: releaseChannelDev},
-		{name: "alpha release", tag: "2.1.4-alpha", expects: releaseChannelDev},
-		{name: "non numeric tag", tag: "nightly", expects: releaseChannelDev},
-		{name: "empty tag", tag: "", expects: releaseChannelDev},
-	}
-
-	for _, tc := range tests {
-		t.Run(tc.name, func(t *testing.T) {
-			if got := releaseChannelFromTag(tc.tag); got != tc.expects {
-				t.Fatalf("releaseChannelFromTag(%q) = %q, want %q", tc.tag, got, tc.expects)
-			}
-		})
-	}
-}
-
-func TestNormalizeReleaseChannel(t *testing.T) {
-	tests := []struct {
-		input   string
-		expects string
-	}{
-		{input: "", expects: releaseChannelStable},
-		{input: "stable", expects: releaseChannelStable},
-		{input: "dev", expects: releaseChannelDev},
-		{input: "DEV", expects: releaseChannelDev},
-		{input: "preview", expects: releaseChannelStable},
-	}
-
-	for _, tc := range tests {
-		if got := normalizeReleaseChannel(tc.input); got != tc.expects {
-			t.Fatalf("normalizeReleaseChannel(%q) = %q, want %q", tc.input, got, tc.expects)
-		}
-	}
-}

go-backend/internal/http/handler/user_quota.go

@@ -1,139 +0,0 @@
-package handler
-
-import (
-	"errors"
-	"net/http"
-	"time"
-
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/model"
-	"go-backend/internal/store/repo"
-)
-
-func isUserQuotaExceeded(view *model.UserQuotaView) bool {
-	if view == nil {
-		return false
-	}
-	if view.DailyLimitGB > 0 && view.DailyUsedBytes >= view.DailyLimitGB*bytesPerGB {
-		return true
-	}
-	if view.MonthlyLimitGB > 0 && view.MonthlyUsedBytes >= view.MonthlyLimitGB*bytesPerGB {
-		return true
-	}
-	return false
-}
-
-func (h *Handler) userQuotaBlockReason(userID int64, now int64) (string, error) {
-	if h == nil || h.repo == nil || userID <= 0 {
-		return "", nil
-	}
-	quota, err := h.repo.GetUserQuotaView(userID, time.UnixMilli(now))
-	if err != nil || quota == nil {
-		return "", err
-	}
-	if quota.DisabledByQuota == 1 || isUserQuotaExceeded(quota) {
-		return "该用户流量配额已超额，禁止开启转发", nil
-	}
-	return "", nil
-}
-
-func (h *Handler) enforceUserQuotaIfNeeded(userID int64, quota *model.UserQuotaView) {
-	if h == nil || h.repo == nil || userID <= 0 || quota == nil {
-		return
-	}
-	if quota.DisabledByQuota == 1 || !isUserQuotaExceeded(quota) {
-		return
-	}
-
-	forwards, err := h.listActiveForwardsByUser(userID)
-	if err != nil {
-		return
-	}
-	pausedIDs := make([]int64, 0, len(forwards))
-	now := time.Now().UnixMilli()
-	for i := range forwards {
-		forward := &forwards[i]
-		if forward.Status != 1 {
-			continue
-		}
-		if err := h.controlForwardServices(forward, "PauseService", false); err != nil {
-			continue
-		}
-		if err := h.repo.UpdateForwardStatus(forward.ID, 0, now); err != nil {
-			continue
-		}
-		pausedIDs = append(pausedIDs, forward.ID)
-	}
-	_ = h.repo.MarkUserQuotaDisabled(userID, pausedIDs, now)
-}
-
-func (h *Handler) applyUserQuotaRelease(release *repo.UserQuotaRelease, now int64) {
-	if h == nil || h.repo == nil || release == nil || release.UserID <= 0 || !release.UnblockUser {
-		return
-	}
-	for _, forwardID := range release.ForwardIDs {
-		forward, err := h.getForwardRecord(forwardID)
-		if err != nil || forward == nil {
-			continue
-		}
-		if err := h.ensureUserTunnelForwardAllowed(forward.UserID, forward.TunnelID, now); err != nil {
-			continue
-		}
-		if err := h.controlForwardServices(forward, "ResumeService", false); err != nil {
-			continue
-		}
-		_ = h.repo.UpdateForwardStatus(forwardID, 1, now)
-	}
-}
-
-func (h *Handler) resetUserQuotaWindows(now time.Time) {
-	if h == nil || h.repo == nil {
-		return
-	}
-	releases, err := h.repo.RollUserQuotaWindows(now)
-	if err != nil {
-		return
-	}
-	nowMs := now.UnixMilli()
-	for i := range releases {
-		h.applyUserQuotaRelease(&releases[i], nowMs)
-	}
-}
-
-func (h *Handler) userQuotaReset(w http.ResponseWriter, r *http.Request) {
-	if r.Method != http.MethodPost {
-		response.WriteJSON(w, response.ErrDefault("请求失败"))
-		return
-	}
-	var req struct {
-		UserID int64  `json:"userId"`
-		Scope  string `json:"scope"`
-	}
-	if err := decodeJSON(r.Body, &req); err != nil {
-		response.WriteJSON(w, response.ErrDefault("请求参数错误"))
-		return
-	}
-	if req.UserID <= 0 {
-		response.WriteJSON(w, response.ErrDefault("用户ID不能为空"))
-		return
-	}
-	release, err := h.repo.ResetUserQuotaUsage(req.UserID, req.Scope, time.Now())
-	if err != nil {
-		response.WriteJSON(w, response.Err(-2, err.Error()))
-		return
-	}
-	nowMs := time.Now().UnixMilli()
-	h.applyUserQuotaRelease(release, nowMs)
-	response.WriteJSON(w, response.OKEmpty())
-}
-
-func (h *Handler) ensureUserForwardAllowedByQuota(userID int64, now int64) error {
-	reason, err := h.userQuotaBlockReason(userID, now)
-	if err != nil {
-		return err
-	}
-	if reason != "" {
-		return errors.New(reason)
-	}
-	return nil
-}

go-backend/internal/http/middleware/auth.go

@@ -101,10 +101,6 @@ func shouldSkip(path string) bool {
 }
 
 func requiresAdmin(path string) bool {
-	if strings.HasPrefix(path, "/api/v1/monitor/permission/") {
-		return true
-	}
-
 	if strings.HasPrefix(path, "/api/v1/group/") {
 		return true
 	}
@@ -141,8 +137,6 @@ func requiresAdmin(path string) bool {
 		return true
 	case "/api/v1/config/update", "/api/v1/config/update-single":
 		return true
-	case "/api/v1/announcement/update":
-		return true
 	default:
 		return false
 	}

go-backend/internal/metrics/ingestion.go

@@ -1,135 +0,0 @@
-package metrics
-
-import (
-	"context"
-	"log"
-	"sync"
-	"time"
-
-	"go-backend/internal/store/model"
-	"go-backend/internal/store/repo"
-)
-
-type SystemInfo struct {
-	Uptime           uint64  `json:"uptime"`
-	BytesReceived    uint64  `json:"bytes_received"`
-	BytesTransmitted uint64  `json:"bytes_transmitted"`
-	CPUUsage         float64 `json:"cpu_usage"`
-	MemoryUsage      float64 `json:"memory_usage"`
-	DiskUsage        float64 `json:"disk_usage"`
-	Load1            float64 `json:"load1"`
-	Load5            float64 `json:"load5"`
-	Load15           float64 `json:"load15"`
-	TCPConns         int64   `json:"tcp_conns"`
-	UDPConns         int64   `json:"udp_conns"`
-	NetInSpeed       int64   `json:"net_in_speed"`
-	NetOutSpeed      int64   `json:"net_out_speed"`
-}
-
-type IngestionService struct {
-	repo          *repo.Repository
-	nodeBuffer    []*model.NodeMetric
-	nodeBufferMu  sync.Mutex
-	flushInterval time.Duration
-	retentionDays int
-}
-
-func NewIngestionService(repo *repo.Repository) *IngestionService {
-	return &IngestionService{
-		repo:          repo,
-		nodeBuffer:    make([]*model.NodeMetric, 0, 500),
-		flushInterval: 30 * time.Second,
-		retentionDays: 7,
-	}
-}
-
-func (s *IngestionService) Start(ctx context.Context) {
-	flushTicker := time.NewTicker(s.flushInterval)
-	defer flushTicker.Stop()
-
-	pruneTicker := time.NewTicker(1 * time.Hour)
-	defer pruneTicker.Stop()
-
-	for {
-		select {
-		case <-ctx.Done():
-			s.flushNodeMetrics()
-			return
-		case <-flushTicker.C:
-			s.flushNodeMetrics()
-		case <-pruneTicker.C:
-			s.pruneMetrics()
-		}
-	}
-}
-
-func (s *IngestionService) RecordNodeMetric(nodeID int64, info SystemInfo) {
-	m := &model.NodeMetric{
-		NodeID:      nodeID,
-		Timestamp:   time.Now().UnixMilli(),
-		CPUUsage:    info.CPUUsage,
-		MemUsage:    info.MemoryUsage,
-		DiskUsage:   info.DiskUsage,
-		NetInBytes:  int64(info.BytesReceived),
-		NetOutBytes: int64(info.BytesTransmitted),
-		NetInSpeed:  info.NetInSpeed,
-		NetOutSpeed: info.NetOutSpeed,
-		Load1:       info.Load1,
-		Load5:       info.Load5,
-		Load15:      info.Load15,
-		TCPConns:    info.TCPConns,
-		UDPConns:    info.UDPConns,
-		Uptime:      int64(info.Uptime),
-	}
-
-	s.nodeBufferMu.Lock()
-	s.nodeBuffer = append(s.nodeBuffer, m)
-	shouldFlush := len(s.nodeBuffer) >= 200
-	s.nodeBufferMu.Unlock()
-
-	if shouldFlush {
-		go s.flushNodeMetrics()
-	}
-}
-
-func (s *IngestionService) flushNodeMetrics() {
-	s.nodeBufferMu.Lock()
-	if len(s.nodeBuffer) == 0 {
-		s.nodeBufferMu.Unlock()
-		return
-	}
-	buffer := s.nodeBuffer
-	s.nodeBuffer = make([]*model.NodeMetric, 0, 500)
-	s.nodeBufferMu.Unlock()
-
-	if s.repo == nil {
-		return
-	}
-	if err := s.repo.InsertNodeMetricBatch(buffer); err != nil {
-		log.Printf("monitoring write failed op=node_metric.flush count=%d err=%v", len(buffer), err)
-	}
-}
-
-func (s *IngestionService) pruneMetrics() {
-	cutoff := time.Now().Add(-time.Duration(s.retentionDays) * 24 * time.Hour).UnixMilli()
-	if s.repo == nil {
-		return
-	}
-	if err := s.repo.PruneNodeMetrics(cutoff); err != nil {
-		log.Printf("monitoring prune failed op=node_metric cutoff=%d err=%v", cutoff, err)
-	}
-	if err := s.repo.PruneTunnelMetrics(cutoff); err != nil {
-		log.Printf("monitoring prune failed op=tunnel_metric cutoff=%d err=%v", cutoff, err)
-	}
-	if err := s.repo.PruneServiceMonitorResults(cutoff); err != nil {
-		log.Printf("monitoring prune failed op=service_monitor_result cutoff=%d err=%v", cutoff, err)
-	}
-}
-
-func (s *IngestionService) GetLatestMetric(nodeID int64) (*model.NodeMetric, error) {
-	return s.repo.GetLatestNodeMetric(nodeID)
-}
-
-func (s *IngestionService) GetMetrics(nodeID int64, startMs, endMs int64) ([]model.NodeMetric, error) {
-	return s.repo.GetNodeMetrics(nodeID, startMs, endMs)
-}

go-backend/internal/metrics/ingestion_test.go

@@ -1,294 +0,0 @@
-package metrics
-
-import (
-	"context"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/repo"
-)
-
-func TestRecordNodeMetric(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-
-	info := SystemInfo{
-		Uptime:           86400,
-		BytesReceived:    1024000,
-		BytesTransmitted: 2048000,
-		CPUUsage:         45.5,
-		MemoryUsage:      60.2,
-		DiskUsage:        30.1,
-		Load1:            1.5,
-		Load5:            1.2,
-		Load15:           0.9,
-		TCPConns:         100,
-		UDPConns:         50,
-		NetInSpeed:       51200,
-		NetOutSpeed:      102400,
-	}
-
-	svc.RecordNodeMetric(1, info)
-	svc.flushNodeMetrics()
-
-	metrics, err := r.GetNodeMetrics(1, 0, time.Now().UnixMilli()+1000)
-	if err != nil {
-		t.Fatalf("get metrics: %v", err)
-	}
-	if len(metrics) != 1 {
-		t.Fatalf("expected 1 metric, got %d", len(metrics))
-	}
-
-	m := metrics[0]
-	if m.CPUUsage != 45.5 {
-		t.Fatalf("expected CPUUsage 45.5, got %f", m.CPUUsage)
-	}
-	if m.MemUsage != 60.2 {
-		t.Fatalf("expected MemUsage 60.2, got %f", m.MemUsage)
-	}
-	if m.DiskUsage != 30.1 {
-		t.Fatalf("expected DiskUsage 30.1, got %f", m.DiskUsage)
-	}
-	if m.Load1 != 1.5 {
-		t.Fatalf("expected Load1 1.5, got %f", m.Load1)
-	}
-	if m.TCPConns != 100 {
-		t.Fatalf("expected TCPConns 100, got %d", m.TCPConns)
-	}
-	if m.UDPConns != 50 {
-		t.Fatalf("expected UDPConns 50, got %d", m.UDPConns)
-	}
-}
-
-func TestRecordNodeMetricAutoFlush(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-
-	info := SystemInfo{
-		CPUUsage:    50.0,
-		MemoryUsage: 60.0,
-		DiskUsage:   30.0,
-	}
-
-	for i := 0; i < 250; i++ {
-		svc.RecordNodeMetric(1, info)
-	}
-
-	time.Sleep(100 * time.Millisecond)
-
-	metrics, err := r.GetNodeMetrics(1, 0, time.Now().UnixMilli()+1000)
-	if err != nil {
-		t.Fatalf("get metrics: %v", err)
-	}
-	if len(metrics) < 200 {
-		t.Fatalf("expected at least 200 metrics after auto-flush, got %d", len(metrics))
-	}
-}
-
-func TestIngestionServiceStart(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-	svc.flushInterval = 100 * time.Millisecond
-
-	ctx, cancel := context.WithTimeout(context.Background(), 500*time.Millisecond)
-	defer cancel()
-
-	info := SystemInfo{
-		CPUUsage:    45.0,
-		MemoryUsage: 55.0,
-		DiskUsage:   35.0,
-	}
-
-	go svc.Start(ctx)
-
-	for i := 0; i < 10; i++ {
-		svc.RecordNodeMetric(1, info)
-		time.Sleep(50 * time.Millisecond)
-	}
-
-	<-ctx.Done()
-
-	metrics, err := r.GetNodeMetrics(1, 0, time.Now().UnixMilli()+1000)
-	if err != nil {
-		t.Fatalf("get metrics: %v", err)
-	}
-	if len(metrics) == 0 {
-		t.Fatalf("expected metrics after service run")
-	}
-}
-
-func TestGetLatestMetric(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-
-	now := time.Now().UnixMilli()
-
-	info1 := SystemInfo{CPUUsage: 40.0, MemoryUsage: 50.0, DiskUsage: 30.0}
-	svc.RecordNodeMetric(1, info1)
-
-	time.Sleep(5 * time.Millisecond)
-
-	info2 := SystemInfo{CPUUsage: 60.0, MemoryUsage: 70.0, DiskUsage: 40.0}
-	svc.RecordNodeMetric(1, info2)
-
-	svc.flushNodeMetrics()
-
-	latest, err := svc.GetLatestMetric(1)
-	if err != nil {
-		t.Fatalf("get latest: %v", err)
-	}
-	if latest == nil {
-		t.Fatalf("expected latest metric")
-	}
-	if latest.CPUUsage != 60.0 {
-		t.Fatalf("expected latest CPUUsage 60.0, got %f", latest.CPUUsage)
-	}
-
-	_ = now
-
-	latestNone, err := svc.GetLatestMetric(999)
-	if err != nil {
-		t.Fatalf("get latest for non-existent: %v", err)
-	}
-	if latestNone != nil {
-		t.Fatalf("expected nil for non-existent node")
-	}
-}
-
-func TestGetMetricsWithTimeRange(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-
-	now := time.Now().UnixMilli()
-
-	for i := 0; i < 5; i++ {
-		info := SystemInfo{
-			CPUUsage:    float64(40 + i*5),
-			MemoryUsage: 50.0,
-			DiskUsage:   30.0,
-		}
-		svc.RecordNodeMetric(1, info)
-		time.Sleep(10 * time.Millisecond)
-	}
-
-	svc.flushNodeMetrics()
-
-	metrics, err := svc.GetMetrics(1, 0, now+1000)
-	if err != nil {
-		t.Fatalf("get metrics: %v", err)
-	}
-	if len(metrics) != 5 {
-		t.Fatalf("expected 5 metrics, got %d", len(metrics))
-	}
-}
-
-func TestPruneMetrics(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-	svc.retentionDays = 1
-
-	info := SystemInfo{CPUUsage: 50.0, MemoryUsage: 60.0, DiskUsage: 30.0}
-
-	svc.RecordNodeMetric(1, info)
-	svc.flushNodeMetrics()
-
-	svc.pruneMetrics()
-
-	metrics, err := r.GetNodeMetrics(1, 0, time.Now().UnixMilli()+1000)
-	if err != nil {
-		t.Fatalf("get metrics: %v", err)
-	}
-	if len(metrics) != 1 {
-		t.Fatalf("expected 1 metric (not pruned), got %d", len(metrics))
-	}
-}
-
-func TestMultipleNodes(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-
-	info := SystemInfo{
-		CPUUsage:    50.0,
-		MemoryUsage: 60.0,
-		DiskUsage:   30.0,
-	}
-
-	svc.RecordNodeMetric(1, info)
-	svc.RecordNodeMetric(2, info)
-	svc.RecordNodeMetric(3, info)
-
-	svc.flushNodeMetrics()
-
-	for nodeID := int64(1); nodeID <= 3; nodeID++ {
-		metrics, err := r.GetNodeMetrics(nodeID, 0, time.Now().UnixMilli()+1000)
-		if err != nil {
-			t.Fatalf("get metrics for node %d: %v", nodeID, err)
-		}
-		if len(metrics) != 1 {
-			t.Fatalf("expected 1 metric for node %d, got %d", nodeID, len(metrics))
-		}
-	}
-}
-
-func TestZeroValues(t *testing.T) {
-	r, err := repo.Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	svc := NewIngestionService(r)
-
-	info := SystemInfo{}
-
-	svc.RecordNodeMetric(1, info)
-	svc.flushNodeMetrics()
-
-	metrics, err := r.GetNodeMetrics(1, 0, time.Now().UnixMilli()+1000)
-	if err != nil {
-		t.Fatalf("get metrics: %v", err)
-	}
-	if len(metrics) != 1 {
-		t.Fatalf("expected 1 metric, got %d", len(metrics))
-	}
-
-	m := metrics[0]
-	if m.CPUUsage != 0 || m.MemUsage != 0 || m.DiskUsage != 0 {
-		t.Fatalf("expected zero values, got CPU=%f Mem=%f Disk=%f", m.CPUUsage, m.MemUsage, m.DiskUsage)
-	}
-}

go-backend/internal/monitoring/limits.go

@@ -1,114 +0,0 @@
-package monitoring
-
-import (
-	"strconv"
-	"strings"
-)
-
-type ServiceMonitorLimits struct {
-	CheckerScanIntervalSec int `json:"checkerScanIntervalSec"`
-	WorkerLimit            int `json:"workerLimit"`
-
-	MinIntervalSec     int `json:"minIntervalSec"`
-	DefaultIntervalSec int `json:"defaultIntervalSec"`
-
-	MinTimeoutSec     int `json:"minTimeoutSec"`
-	DefaultTimeoutSec int `json:"defaultTimeoutSec"`
-	MaxTimeoutSec     int `json:"maxTimeoutSec"`
-}
-
-const (
-	ConfigServiceMonitorCheckerScanIntervalSec = "service_monitor_checker_scan_interval_sec"
-	ConfigServiceMonitorWorkerLimit            = "service_monitor_worker_limit"
-	ConfigServiceMonitorMinIntervalSec         = "service_monitor_min_interval_sec"
-	ConfigServiceMonitorDefaultIntervalSec     = "service_monitor_default_interval_sec"
-	ConfigServiceMonitorMinTimeoutSec          = "service_monitor_min_timeout_sec"
-	ConfigServiceMonitorDefaultTimeoutSec      = "service_monitor_default_timeout_sec"
-	ConfigServiceMonitorMaxTimeoutSec          = "service_monitor_max_timeout_sec"
-)
-
-func DefaultServiceMonitorLimits() ServiceMonitorLimits {
-	return ServiceMonitorLimits{
-		CheckerScanIntervalSec: 30,
-		WorkerLimit:            5,
-		MinIntervalSec:         30,
-		DefaultIntervalSec:     60,
-		MinTimeoutSec:          1,
-		DefaultTimeoutSec:      5,
-		MaxTimeoutSec:          60,
-	}
-}
-
-// ServiceMonitorLimitsFromConfigMap parses limits from vite_config values.
-// Missing/invalid values fall back to defaults.
-func ServiceMonitorLimitsFromConfigMap(cfg map[string]string) ServiceMonitorLimits {
-	limits := DefaultServiceMonitorLimits()
-	if cfg == nil {
-		return limits
-	}
-
-	limits.CheckerScanIntervalSec = parseConfigInt(cfg, ConfigServiceMonitorCheckerScanIntervalSec, limits.CheckerScanIntervalSec)
-	limits.WorkerLimit = parseConfigInt(cfg, ConfigServiceMonitorWorkerLimit, limits.WorkerLimit)
-	limits.MinIntervalSec = parseConfigInt(cfg, ConfigServiceMonitorMinIntervalSec, limits.MinIntervalSec)
-	limits.DefaultIntervalSec = parseConfigInt(cfg, ConfigServiceMonitorDefaultIntervalSec, limits.DefaultIntervalSec)
-	limits.MinTimeoutSec = parseConfigInt(cfg, ConfigServiceMonitorMinTimeoutSec, limits.MinTimeoutSec)
-	limits.DefaultTimeoutSec = parseConfigInt(cfg, ConfigServiceMonitorDefaultTimeoutSec, limits.DefaultTimeoutSec)
-	limits.MaxTimeoutSec = parseConfigInt(cfg, ConfigServiceMonitorMaxTimeoutSec, limits.MaxTimeoutSec)
-
-	return normalizeServiceMonitorLimits(limits)
-}
-
-func normalizeServiceMonitorLimits(limits ServiceMonitorLimits) ServiceMonitorLimits {
-	if limits.CheckerScanIntervalSec <= 0 {
-		limits.CheckerScanIntervalSec = 30
-	}
-	if limits.WorkerLimit <= 0 {
-		limits.WorkerLimit = 5
-	}
-	if limits.WorkerLimit > 50 {
-		limits.WorkerLimit = 50
-	}
-
-	if limits.MinIntervalSec <= 0 {
-		limits.MinIntervalSec = limits.CheckerScanIntervalSec
-	}
-	if limits.MinIntervalSec < limits.CheckerScanIntervalSec {
-		limits.MinIntervalSec = limits.CheckerScanIntervalSec
-	}
-	if limits.DefaultIntervalSec <= 0 {
-		limits.DefaultIntervalSec = 60
-	}
-	if limits.DefaultIntervalSec < limits.MinIntervalSec {
-		limits.DefaultIntervalSec = limits.MinIntervalSec
-	}
-
-	if limits.MinTimeoutSec <= 0 {
-		limits.MinTimeoutSec = 1
-	}
-	if limits.DefaultTimeoutSec <= 0 {
-		limits.DefaultTimeoutSec = 5
-	}
-	if limits.DefaultTimeoutSec < limits.MinTimeoutSec {
-		limits.DefaultTimeoutSec = limits.MinTimeoutSec
-	}
-	if limits.MaxTimeoutSec <= 0 {
-		limits.MaxTimeoutSec = 60
-	}
-	if limits.MaxTimeoutSec < limits.DefaultTimeoutSec {
-		limits.MaxTimeoutSec = limits.DefaultTimeoutSec
-	}
-
-	return limits
-}
-
-func parseConfigInt(cfg map[string]string, key string, fallback int) int {
-	v := strings.TrimSpace(cfg[key])
-	if v == "" {
-		return fallback
-	}
-	n, err := strconv.Atoi(v)
-	if err != nil {
-		return fallback
-	}
-	return n
-}

go-backend/internal/store/db.go

@@ -0,0 +1,466 @@
+// Package store provides a thin dialect-aware wrapper around database/sql,
+// enabling transparent use of both SQLite and PostgreSQL.
+package store
+
+import (
+	"database/sql"
+	"strconv"
+	"strings"
+)
+
+// Dialect identifies the underlying database engine.
+type Dialect int
+
+const (
+	DialectSQLite Dialect = iota
+	DialectPostgres
+)
+
+// String returns a human-readable dialect name.
+func (d Dialect) String() string {
+	switch d {
+	case DialectSQLite:
+		return "sqlite"
+	case DialectPostgres:
+		return "postgres"
+	default:
+		return "unknown"
+	}
+}
+
+// DB wraps *sql.DB with dialect awareness.
+type DB struct {
+	raw     *sql.DB
+	dialect Dialect
+}
+
+// Wrap creates a new dialect-aware DB from an existing *sql.DB.
+func Wrap(raw *sql.DB, dialect Dialect) *DB {
+	return &DB{raw: raw, dialect: dialect}
+}
+
+// Dialect returns the database dialect.
+func (db *DB) Dialect() Dialect {
+	if db == nil {
+		return DialectSQLite
+	}
+	return db.dialect
+}
+
+// RawDB returns the underlying *sql.DB.
+func (db *DB) RawDB() *sql.DB {
+	if db == nil {
+		return nil
+	}
+	return db.raw
+}
+
+// Close closes the underlying connection.
+func (db *DB) Close() error {
+	if db == nil || db.raw == nil {
+		return nil
+	}
+	return db.raw.Close()
+}
+
+// Ping verifies the connection is alive.
+func (db *DB) Ping() error {
+	return db.raw.Ping()
+}
+
+// Exec executes a query with transparent placeholder and syntax rewriting.
+func (db *DB) Exec(query string, args ...any) (sql.Result, error) {
+	return db.raw.Exec(db.rewrite(query), args...)
+}
+
+// Query executes a query that returns rows, with transparent rewriting.
+func (db *DB) Query(query string, args ...any) (*sql.Rows, error) {
+	return db.raw.Query(db.rewrite(query), args...)
+}
+
+// QueryRow executes a query that returns at most one row, with transparent rewriting.
+func (db *DB) QueryRow(query string, args ...any) *sql.Row {
+	return db.raw.QueryRow(db.rewrite(query), args...)
+}
+
+// Begin starts a transaction, returning a dialect-aware Tx.
+func (db *DB) Begin() (*Tx, error) {
+	tx, err := db.raw.Begin()
+	if err != nil {
+		return nil, err
+	}
+	return &Tx{raw: tx, dialect: db.dialect}, nil
+}
+
+// ExecReturningID executes an INSERT and returns the auto-generated id.
+//   - SQLite: uses LastInsertId()
+//   - PostgreSQL: appends RETURNING id and uses QueryRow().Scan()
+func (db *DB) ExecReturningID(query string, args ...any) (int64, error) {
+	q := db.rewrite(query)
+	if db.dialect == DialectPostgres {
+		q = ensureReturningID(q)
+		var id int64
+		if err := db.raw.QueryRow(q, args...).Scan(&id); err != nil {
+			return 0, err
+		}
+		return id, nil
+	}
+	res, err := db.raw.Exec(q, args...)
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+// Tx wraps *sql.Tx with dialect awareness.
+type Tx struct {
+	raw     *sql.Tx
+	dialect Dialect
+}
+
+// Exec executes a query inside the transaction with transparent rewriting.
+func (tx *Tx) Exec(query string, args ...any) (sql.Result, error) {
+	return tx.raw.Exec(rewriteQuery(tx.dialect, query), args...)
+}
+
+// Query executes a query that returns rows inside the transaction.
+func (tx *Tx) Query(query string, args ...any) (*sql.Rows, error) {
+	return tx.raw.Query(rewriteQuery(tx.dialect, query), args...)
+}
+
+// QueryRow executes a query that returns at most one row inside the transaction.
+func (tx *Tx) QueryRow(query string, args ...any) *sql.Row {
+	return tx.raw.QueryRow(rewriteQuery(tx.dialect, query), args...)
+}
+
+// Commit commits the transaction.
+func (tx *Tx) Commit() error { return tx.raw.Commit() }
+
+// Rollback aborts the transaction.
+func (tx *Tx) Rollback() error { return tx.raw.Rollback() }
+
+// ExecReturningID executes an INSERT inside the transaction and returns the id.
+func (tx *Tx) ExecReturningID(query string, args ...any) (int64, error) {
+	q := rewriteQuery(tx.dialect, query)
+	if tx.dialect == DialectPostgres {
+		q = ensureReturningID(q)
+		var id int64
+		if err := tx.raw.QueryRow(q, args...).Scan(&id); err != nil {
+			return 0, err
+		}
+		return id, nil
+	}
+	res, err := tx.raw.Exec(q, args...)
+	if err != nil {
+		return 0, err
+	}
+	return res.LastInsertId()
+}
+
+func (db *DB) rewrite(query string) string {
+	return rewriteQuery(db.dialect, query)
+}
+
+func rewriteQuery(dialect Dialect, query string) string {
+	if dialect != DialectPostgres {
+		return query
+	}
+	query = rewriteUserIdentifier(query)
+	query = rewriteInsertOrIgnore(query)
+	query = rewritePlaceholders(query)
+	return query
+}
+
+func rewriteUserIdentifier(query string) string {
+	var buf strings.Builder
+	buf.Grow(len(query) + 16)
+	i := 0
+	for i < len(query) {
+		if end, ok := skipSQLProtectedSegment(query, i); ok {
+			buf.WriteString(query[i:end])
+			i = end
+			continue
+		}
+
+		ch := query[i]
+		if isIdentifierChar(ch) {
+			j := i + 1
+			for j < len(query) && isIdentifierChar(query[j]) {
+				j++
+			}
+			tok := query[i:j]
+			if strings.EqualFold(tok, "user") {
+				buf.WriteString(`"user"`)
+			} else {
+				buf.WriteString(tok)
+			}
+			i = j
+			continue
+		}
+
+		buf.WriteByte(ch)
+		i++
+	}
+	return buf.String()
+}
+
+func isIdentifierChar(ch byte) bool {
+	if ch >= 'a' && ch <= 'z' {
+		return true
+	}
+	if ch >= 'A' && ch <= 'Z' {
+		return true
+	}
+	if ch >= '0' && ch <= '9' {
+		return true
+	}
+	return ch == '_'
+}
+
+func rewriteInsertOrIgnore(query string) string {
+	start, end, ok := findKeywordSequenceOutside(query, []string{"INSERT", "OR", "IGNORE", "INTO"}, 0)
+	if !ok {
+		return query
+	}
+
+	rewritten := query[:start] + "INSERT INTO" + query[end:]
+	rewritten = strings.TrimRight(rewritten, "; \t\n")
+
+	insertIntoEnd := start + len("INSERT INTO")
+	if _, _, hasOnConflict := findKeywordSequenceOutside(rewritten, []string{"ON", "CONFLICT"}, insertIntoEnd); hasOnConflict {
+		return rewritten
+	}
+
+	if retStart, _, hasReturning := findKeywordSequenceOutside(rewritten, []string{"RETURNING"}, insertIntoEnd); hasReturning {
+		prefix := strings.TrimRight(rewritten[:retStart], " \t\n")
+		suffix := strings.TrimLeft(rewritten[retStart:], " \t\n")
+		return prefix + " ON CONFLICT DO NOTHING " + suffix
+	}
+
+	return rewritten + " ON CONFLICT DO NOTHING"
+}
+
+func rewritePlaceholders(query string) string {
+	var buf strings.Builder
+	buf.Grow(len(query) + 16)
+	n := 1
+	for i := 0; i < len(query); i++ {
+		if end, ok := skipSQLProtectedSegment(query, i); ok {
+			buf.WriteString(query[i:end])
+			i = end - 1
+			continue
+		}
+
+		ch := query[i]
+		if ch == '?' {
+			buf.WriteByte('$')
+			buf.WriteString(strconv.Itoa(n))
+			n++
+			continue
+		}
+		buf.WriteByte(ch)
+	}
+	return buf.String()
+}
+
+func ensureReturningID(query string) string {
+	trimmed := strings.TrimRight(query, "; \t\n")
+	if _, _, ok := findKeywordSequenceOutside(trimmed, []string{"RETURNING"}, 0); ok {
+		return trimmed
+	}
+	return trimmed + " RETURNING id"
+}
+
+func findKeywordSequenceOutside(query string, keywords []string, from int) (int, int, bool) {
+	if len(keywords) == 0 {
+		return 0, 0, false
+	}
+	if from < 0 {
+		from = 0
+	}
+	if from >= len(query) {
+		return 0, 0, false
+	}
+
+	matched := 0
+	seqStart := -1
+
+	for i := from; i < len(query); {
+		if end, ok := skipSQLProtectedSegment(query, i); ok {
+			i = end
+			continue
+		}
+
+		ch := query[i]
+		if isIdentifierChar(ch) {
+			j := i + 1
+			for j < len(query) && isIdentifierChar(query[j]) {
+				j++
+			}
+			tok := query[i:j]
+
+			if strings.EqualFold(tok, keywords[matched]) {
+				if matched == 0 {
+					seqStart = i
+				}
+				matched++
+				if matched == len(keywords) {
+					return seqStart, j, true
+				}
+			} else if strings.EqualFold(tok, keywords[0]) {
+				seqStart = i
+				matched = 1
+			} else {
+				matched = 0
+				seqStart = -1
+			}
+
+			i = j
+			continue
+		}
+
+		if !isSQLSpace(ch) {
+			matched = 0
+			seqStart = -1
+		}
+		i++
+	}
+
+	return 0, 0, false
+}
+
+func skipSQLProtectedSegment(query string, i int) (int, bool) {
+	if i < 0 || i >= len(query) {
+		return 0, false
+	}
+
+	switch query[i] {
+	case '\'':
+		return skipSingleQuotedLiteral(query, i), true
+	case '"':
+		return skipDoubleQuotedIdentifier(query, i), true
+	case '-':
+		if i+1 < len(query) && query[i+1] == '-' {
+			return skipLineComment(query, i), true
+		}
+	case '/':
+		if i+1 < len(query) && query[i+1] == '*' {
+			return skipBlockComment(query, i), true
+		}
+	case '$':
+		if end, ok := skipDollarQuotedLiteral(query, i); ok {
+			return end, true
+		}
+	}
+
+	return 0, false
+}
+
+func skipSingleQuotedLiteral(query string, i int) int {
+	for j := i + 1; j < len(query); j++ {
+		if query[j] != '\'' {
+			continue
+		}
+		if j+1 < len(query) && query[j+1] == '\'' {
+			j++
+			continue
+		}
+		return j + 1
+	}
+	return len(query)
+}
+
+func skipDoubleQuotedIdentifier(query string, i int) int {
+	for j := i + 1; j < len(query); j++ {
+		if query[j] != '"' {
+			continue
+		}
+		if j+1 < len(query) && query[j+1] == '"' {
+			j++
+			continue
+		}
+		return j + 1
+	}
+	return len(query)
+}
+
+func skipLineComment(query string, i int) int {
+	for j := i + 2; j < len(query); j++ {
+		if query[j] == '\n' {
+			return j
+		}
+	}
+	return len(query)
+}
+
+func skipBlockComment(query string, i int) int {
+	depth := 1
+	for j := i + 2; j < len(query)-1; j++ {
+		if query[j] == '/' && query[j+1] == '*' {
+			depth++
+			j++
+			continue
+		}
+		if query[j] == '*' && query[j+1] == '/' {
+			depth--
+			j++
+			if depth == 0 {
+				return j + 1
+			}
+		}
+	}
+	return len(query)
+}
+
+func skipDollarQuotedLiteral(query string, i int) (int, bool) {
+	if i < 0 || i >= len(query) || query[i] != '$' {
+		return 0, false
+	}
+
+	if i+1 >= len(query) {
+		return 0, false
+	}
+
+	var endTag int
+	if query[i+1] == '$' {
+		endTag = i + 1
+	} else {
+		if !isDollarTagStart(query[i+1]) {
+			return 0, false
+		}
+		j := i + 2
+		for j < len(query) && isDollarTagChar(query[j]) {
+			j++
+		}
+		if j >= len(query) || query[j] != '$' {
+			return 0, false
+		}
+		endTag = j
+	}
+
+	tag := query[i : endTag+1]
+	if closeIdx := strings.Index(query[endTag+1:], tag); closeIdx >= 0 {
+		return endTag + 1 + closeIdx + len(tag), true
+	}
+	return len(query), true
+}
+
+func isDollarTagStart(ch byte) bool {
+	return ch == '_' || (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z')
+}
+
+func isDollarTagChar(ch byte) bool {
+	if isDollarTagStart(ch) {
+		return true
+	}
+	return ch >= '0' && ch <= '9'
+}
+
+func isSQLSpace(ch byte) bool {
+	switch ch {
+	case ' ', '\t', '\n', '\r', '\f':
+		return true
+	default:
+		return false
+	}
+}

go-backend/internal/store/db_test.go

@@ -0,0 +1,116 @@
+package store
+
+import "testing"
+
+func TestRewritePlaceholdersSkipsProtectedSegments(t *testing.T) {
+	q := `SELECT ?, '?', "id?", $$body ? $$, $tag$X?$tag$, col -- comment ?
+FROM t /* block ? */ WHERE id = ?`
+	got := rewritePlaceholders(q)
+	want := `SELECT $1, '?', "id?", $$body ? $$, $tag$X?$tag$, col -- comment ?
+FROM t /* block ? */ WHERE id = $2`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreBasic(t *testing.T) {
+	q := `INSERT OR IGNORE INTO user_group_user(user_group_id, user_id, created_time) VALUES(?, ?, ?)`
+	got := rewriteInsertOrIgnore(q)
+	want := `INSERT INTO user_group_user(user_group_id, user_id, created_time) VALUES(?, ?, ?) ON CONFLICT DO NOTHING`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreBeforeReturning(t *testing.T) {
+	q := `INSERT OR IGNORE INTO x(a) VALUES(?) RETURNING id`
+	got := rewriteInsertOrIgnore(q)
+	want := `INSERT INTO x(a) VALUES(?) ON CONFLICT DO NOTHING RETURNING id`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreNotDuplicatingOnConflict(t *testing.T) {
+	q := `INSERT OR IGNORE INTO x(a) VALUES(?) ON CONFLICT(a) DO UPDATE SET a=excluded.a`
+	got := rewriteInsertOrIgnore(q)
+	want := `INSERT INTO x(a) VALUES(?) ON CONFLICT(a) DO UPDATE SET a=excluded.a`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestEnsureReturningID(t *testing.T) {
+	if got := ensureReturningID(`INSERT INTO x(a) VALUES($1)`); got != `INSERT INTO x(a) VALUES($1) RETURNING id` {
+		t.Fatalf("missing RETURNING append: %s", got)
+	}
+	if got := ensureReturningID(`INSERT INTO x(a) VALUES($1) RETURNING other_id`); got != `INSERT INTO x(a) VALUES($1) RETURNING other_id` {
+		t.Fatalf("RETURNING should not be duplicated: %s", got)
+	}
+}
+
+func TestRewriteUserIdentifierSafety(t *testing.T) {
+	q := `SELECT user, user_id, 'user', "user", note FROM user -- user
+WHERE owner='user'`
+	got := rewriteUserIdentifier(q)
+	want := `SELECT "user", user_id, 'user', "user", note FROM "user" -- user
+WHERE owner='user'`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteQueryPostgresPipeline(t *testing.T) {
+	q := `INSERT OR IGNORE INTO user(name, note) VALUES(?, '?')`
+	got := rewriteQuery(DialectPostgres, q)
+	want := `INSERT INTO "user"(name, note) VALUES($1, '?') ON CONFLICT DO NOTHING`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreSkipsStringLiteral(t *testing.T) {
+	q := `SELECT 'INSERT OR IGNORE INTO t(a) VALUES(?)' AS q`
+	got := rewriteInsertOrIgnore(q)
+	if got != q {
+		t.Fatalf("string literal should stay unchanged\nwant: %s\ngot:  %s", q, got)
+	}
+}
+
+func TestRewriteInsertOrIgnoreSkipsCommentedKeyword(t *testing.T) {
+	q := `-- INSERT OR IGNORE INTO ignored(a) VALUES(?)
+INSERT OR IGNORE INTO real_t(a) VALUES(?)`
+	got := rewriteInsertOrIgnore(q)
+	want := `-- INSERT OR IGNORE INTO ignored(a) VALUES(?)
+INSERT INTO real_t(a) VALUES(?) ON CONFLICT DO NOTHING`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewritePlaceholdersSkipsNestedBlockComment(t *testing.T) {
+	q := `SELECT ? /* outer ? /* inner ? */ still_outer ? */ FROM t WHERE id = ?`
+	got := rewritePlaceholders(q)
+	want := `SELECT $1 /* outer ? /* inner ? */ still_outer ? */ FROM t WHERE id = $2`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewritePlaceholdersSkipsUnterminatedBlockComment(t *testing.T) {
+	q := `SELECT ? /* unterminated ? comment`
+	got := rewritePlaceholders(q)
+	want := `SELECT $1 /* unterminated ? comment`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}
+
+func TestRewriteUserIdentifierSkipsDollarQuotedAndComment(t *testing.T) {
+	q := `SELECT user, $$user ?$$ AS body, col FROM user /* user */ -- user`
+	got := rewriteUserIdentifier(q)
+	want := `SELECT "user", $$user ?$$ AS body, col FROM "user" /* user */ -- user`
+	if got != want {
+		t.Fatalf("unexpected rewrite\nwant: %s\ngot:  %s", want, got)
+	}
+}

go-backend/internal/store/model/model.go

@@ -1,733 +0,0 @@
-// Package model defines GORM model structs for all database tables,
-// providing a single source of truth for the schema that works
-// transparently with both SQLite and PostgreSQL.
-package model
-
-import "database/sql"
-
-// ─── Core Business Tables ────────────────────────────────────────────
-
-// User maps to the "user" table. PostgreSQL treats "user" as a reserved
-// word, so TableName() is required for correct quoting.
-type User struct {
-	ID            int64         `gorm:"primaryKey;autoIncrement"`
-	User          string        `gorm:"column:user;type:varchar(100);not null"`
-	Pwd           string        `gorm:"type:varchar(100);not null"`
-	RoleID        int           `gorm:"column:role_id;not null"`
-	ExpTime       int64         `gorm:"column:exp_time;not null"`
-	Flow          int64         `gorm:"not null"`
-	InFlow        int64         `gorm:"column:in_flow;not null;default:0"`
-	OutFlow       int64         `gorm:"column:out_flow;not null;default:0"`
-	FlowResetTime int64         `gorm:"column:flow_reset_time;not null"`
-	Num           int           `gorm:"not null"`
-	CreatedTime   int64         `gorm:"column:created_time;not null"`
-	UpdatedTime   sql.NullInt64 `gorm:"column:updated_time"`
-	Status        int           `gorm:"not null"`
-}
-
-func (User) TableName() string { return "user" }
-
-// Forward maps to the "forward" table.
-type Forward struct {
-	ID          int64         `gorm:"primaryKey;autoIncrement"`
-	UserID      int64         `gorm:"column:user_id;not null"`
-	UserName    string        `gorm:"column:user_name;type:varchar(100);not null"`
-	Name        string        `gorm:"type:varchar(100);not null"`
-	TunnelID    int64         `gorm:"column:tunnel_id;not null"`
-	RemoteAddr  string        `gorm:"column:remote_addr;type:text;not null"`
-	Strategy    string        `gorm:"type:varchar(100);not null;default:'fifo'"`
-	InFlow      int64         `gorm:"not null;default:0"`
-	OutFlow     int64         `gorm:"column:out_flow;not null;default:0"`
-	CreatedTime int64         `gorm:"column:created_time;not null"`
-	UpdatedTime int64         `gorm:"column:updated_time;not null"`
-	Status      int           `gorm:"not null"`
-	Inx         int           `gorm:"not null;default:0"`
-	SpeedID     sql.NullInt64 `gorm:"column:speed_id"`
-}
-
-func (Forward) TableName() string { return "forward" }
-
-type ForwardPort struct {
-	ID        int64          `gorm:"primaryKey;autoIncrement"`
-	ForwardID int64          `gorm:"column:forward_id;not null"`
-	NodeID    int64          `gorm:"column:node_id;not null"`
-	Port      int            `gorm:"not null"`
-	InIP      sql.NullString `gorm:"column:in_ip;type:text"`
-}
-
-func (ForwardPort) TableName() string { return "forward_port" }
-
-type Node struct {
-	ID                      int64          `gorm:"primaryKey;autoIncrement"`
-	Name                    string         `gorm:"type:varchar(100);not null"`
-	Remark                  sql.NullString `gorm:"column:remark;type:text"`
-	ExpiryTime              sql.NullInt64  `gorm:"column:expiry_time"`
-	RenewalCycle            sql.NullString `gorm:"column:renewal_cycle;type:varchar(20)"`
-	Secret                  string         `gorm:"type:varchar(100);not null"`
-	ServerIP                string         `gorm:"column:server_ip;type:varchar(100);not null"`
-	ServerIPV4              sql.NullString `gorm:"column:server_ip_v4;type:varchar(100)"`
-	ServerIPV6              sql.NullString `gorm:"column:server_ip_v6;type:varchar(100)"`
-	ExtraIPs                sql.NullString `gorm:"column:extra_ips;type:text"`
-	Port                    string         `gorm:"type:text;not null"`
-	InterfaceName           sql.NullString `gorm:"column:interface_name;type:varchar(200)"`
-	Version                 sql.NullString `gorm:"type:varchar(100)"`
-	HTTP                    int            `gorm:"column:http;not null;default:0"`
-	TLS                     int            `gorm:"column:tls;not null;default:0"`
-	Socks                   int            `gorm:"not null;default:0"`
-	CreatedTime             int64          `gorm:"column:created_time;not null"`
-	UpdatedTime             sql.NullInt64  `gorm:"column:updated_time"`
-	Status                  int            `gorm:"not null"`
-	TCPListenAddr           string         `gorm:"column:tcp_listen_addr;type:varchar(100);not null;default:'[::]'"`
-	UDPListenAddr           string         `gorm:"column:udp_listen_addr;type:varchar(100);not null;default:'[::]'"`
-	Inx                     int            `gorm:"not null;default:0"`
-	IsRemote                int            `gorm:"column:is_remote;default:0"`
-	RemoteURL               sql.NullString `gorm:"column:remote_url;type:text"`
-	RemoteToken             sql.NullString `gorm:"column:remote_token;type:text"`
-	RemoteConfig            sql.NullString `gorm:"column:remote_config;type:text"`
-	ExpiryReminderDismissed int            `gorm:"column:expiry_reminder_dismissed;not null;default:0"`
-}
-
-func (Node) TableName() string { return "node" }
-
-type SpeedLimit struct {
-	ID          int64          `gorm:"primaryKey;autoIncrement"`
-	Name        string         `gorm:"type:varchar(100);not null"`
-	Speed       int            `gorm:"not null"`
-	TunnelID    sql.NullInt64  `gorm:"column:tunnel_id"`
-	TunnelName  sql.NullString `gorm:"column:tunnel_name;type:varchar(100)"`
-	CreatedTime int64          `gorm:"column:created_time;not null"`
-	UpdatedTime sql.NullInt64  `gorm:"column:updated_time"`
-	Status      int            `gorm:"not null"`
-}
-
-func (SpeedLimit) TableName() string { return "speed_limit" }
-
-type StatisticsFlow struct {
-	ID          int64  `gorm:"primaryKey;autoIncrement" json:"id"`
-	UserID      int64  `gorm:"column:user_id;not null" json:"userId"`
-	Flow        int64  `gorm:"not null" json:"flow"`
-	TotalFlow   int64  `gorm:"column:total_flow;not null" json:"totalFlow"`
-	Time        string `gorm:"type:varchar(100);not null" json:"time"`
-	CreatedTime int64  `gorm:"column:created_time;not null" json:"-"`
-}
-
-func (StatisticsFlow) TableName() string { return "statistics_flow" }
-
-type Tunnel struct {
-	ID           int64          `gorm:"primaryKey;autoIncrement"`
-	Name         string         `gorm:"type:varchar(100);not null"`
-	TrafficRatio float64        `gorm:"column:traffic_ratio;not null;default:1.0"`
-	Type         int            `gorm:"not null"`
-	Protocol     string         `gorm:"type:varchar(10);not null;default:'tls'"`
-	Flow         int64          `gorm:"not null"`
-	CreatedTime  int64          `gorm:"column:created_time;not null"`
-	UpdatedTime  int64          `gorm:"column:updated_time;not null"`
-	Status       int            `gorm:"not null"`
-	InIP         sql.NullString `gorm:"column:in_ip;type:text"`
-	Inx          int            `gorm:"not null;default:0"`
-	IPPreference string         `gorm:"column:ip_preference;type:varchar(10);not null;default:''"`
-}
-
-func (Tunnel) TableName() string { return "tunnel" }
-
-type UserQuota struct {
-	UserID           int64  `gorm:"column:user_id;primaryKey"`
-	DailyLimitGB     int64  `gorm:"column:daily_limit_gb;not null;default:0"`
-	MonthlyLimitGB   int64  `gorm:"column:monthly_limit_gb;not null;default:0"`
-	DailyUsedBytes   int64  `gorm:"column:daily_used_bytes;not null;default:0"`
-	MonthlyUsedBytes int64  `gorm:"column:monthly_used_bytes;not null;default:0"`
-	DayKey           int64  `gorm:"column:day_key;not null;default:0"`
-	MonthKey         int64  `gorm:"column:month_key;not null;default:0"`
-	DisabledByQuota  int    `gorm:"column:disabled_by_quota;not null;default:0"`
-	DisabledAt       int64  `gorm:"column:disabled_at;not null;default:0"`
-	PausedForwardIDs string `gorm:"column:paused_forward_ids;type:text;not null;default:''"`
-	CreatedTime      int64  `gorm:"column:created_time;not null"`
-	UpdatedTime      int64  `gorm:"column:updated_time;not null"`
-}
-
-func (UserQuota) TableName() string { return "user_quota" }
-
-type ChainTunnel struct {
-	ID        int64          `gorm:"primaryKey;autoIncrement"`
-	TunnelID  int64          `gorm:"column:tunnel_id;not null"`
-	ChainType string         `gorm:"column:chain_type;type:varchar(10);not null"`
-	NodeID    int64          `gorm:"column:node_id;not null"`
-	Port      sql.NullInt64  `gorm:"column:port"`
-	Strategy  sql.NullString `gorm:"type:varchar(10)"`
-	Inx       sql.NullInt64  `gorm:"column:inx"`
-	Protocol  sql.NullString `gorm:"type:varchar(10)"`
-	ConnectIP sql.NullString `gorm:"column:connect_ip;type:varchar(45)"`
-}
-
-func (ChainTunnel) TableName() string { return "chain_tunnel" }
-
-type UserTunnel struct {
-	ID            int64         `gorm:"primaryKey;autoIncrement"`
-	UserID        int64         `gorm:"column:user_id;not null;uniqueIndex:idx_user_tunnel_unique"`
-	TunnelID      int64         `gorm:"column:tunnel_id;not null;uniqueIndex:idx_user_tunnel_unique"`
-	SpeedID       sql.NullInt64 `gorm:"column:speed_id"`
-	Num           int           `gorm:"not null"`
-	Flow          int64         `gorm:"not null"`
-	InFlow        int64         `gorm:"column:in_flow;not null;default:0"`
-	OutFlow       int64         `gorm:"column:out_flow;not null;default:0"`
-	FlowResetTime int64         `gorm:"column:flow_reset_time;not null"`
-	ExpTime       int64         `gorm:"column:exp_time;not null"`
-	Status        int           `gorm:"not null"`
-}
-
-func (UserTunnel) TableName() string { return "user_tunnel" }
-
-type TunnelGroup struct {
-	ID          int64  `gorm:"primaryKey;autoIncrement"`
-	Name        string `gorm:"type:varchar(100);not null;uniqueIndex:idx_tunnel_group_name"`
-	CreatedTime int64  `gorm:"column:created_time;not null"`
-	UpdatedTime int64  `gorm:"column:updated_time;not null"`
-	Status      int    `gorm:"not null"`
-}
-
-func (TunnelGroup) TableName() string { return "tunnel_group" }
-
-type UserGroup struct {
-	ID          int64  `gorm:"primaryKey;autoIncrement"`
-	Name        string `gorm:"type:varchar(100);not null;uniqueIndex:idx_user_group_name"`
-	CreatedTime int64  `gorm:"column:created_time;not null"`
-	UpdatedTime int64  `gorm:"column:updated_time;not null"`
-	Status      int    `gorm:"not null"`
-}
-
-func (UserGroup) TableName() string { return "user_group" }
-
-type TunnelGroupTunnel struct {
-	ID            int64 `gorm:"primaryKey;autoIncrement"`
-	TunnelGroupID int64 `gorm:"column:tunnel_group_id;not null;uniqueIndex:idx_tunnel_group_tunnel_unique"`
-	TunnelID      int64 `gorm:"column:tunnel_id;not null;uniqueIndex:idx_tunnel_group_tunnel_unique"`
-	CreatedTime   int64 `gorm:"column:created_time;not null"`
-}
-
-func (TunnelGroupTunnel) TableName() string { return "tunnel_group_tunnel" }
-
-type UserGroupUser struct {
-	ID          int64 `gorm:"primaryKey;autoIncrement"`
-	UserGroupID int64 `gorm:"column:user_group_id;not null;uniqueIndex:idx_user_group_user_unique"`
-	UserID      int64 `gorm:"column:user_id;not null;uniqueIndex:idx_user_group_user_unique"`
-	CreatedTime int64 `gorm:"column:created_time;not null"`
-}
-
-func (UserGroupUser) TableName() string { return "user_group_user" }
-
-type GroupPermission struct {
-	ID            int64 `gorm:"primaryKey;autoIncrement"`
-	UserGroupID   int64 `gorm:"column:user_group_id;not null;uniqueIndex:idx_group_permission_unique"`
-	TunnelGroupID int64 `gorm:"column:tunnel_group_id;not null;uniqueIndex:idx_group_permission_unique"`
-	CreatedTime   int64 `gorm:"column:created_time;not null"`
-}
-
-func (GroupPermission) TableName() string { return "group_permission" }
-
-type GroupPermissionGrant struct {
-	ID             int64 `gorm:"primaryKey;autoIncrement"`
-	UserGroupID    int64 `gorm:"column:user_group_id;not null;uniqueIndex:idx_group_permission_grant_unique"`
-	TunnelGroupID  int64 `gorm:"column:tunnel_group_id;not null;uniqueIndex:idx_group_permission_grant_unique"`
-	UserTunnelID   int64 `gorm:"column:user_tunnel_id;not null;uniqueIndex:idx_group_permission_grant_unique"`
-	CreatedByGroup int   `gorm:"column:created_by_group;not null;default:0"`
-	CreatedTime    int64 `gorm:"column:created_time;not null"`
-}
-
-func (GroupPermissionGrant) TableName() string { return "group_permission_grant" }
-
-// MonitorPermission grants a non-admin user access to monitoring endpoints.
-// One row per user_id.
-type MonitorPermission struct {
-	ID          int64 `gorm:"primaryKey;autoIncrement" json:"id"`
-	UserID      int64 `gorm:"column:user_id;not null;uniqueIndex:idx_monitor_permission_user" json:"userId"`
-	CreatedTime int64 `gorm:"column:created_time;not null" json:"createdTime"`
-}
-
-func (MonitorPermission) TableName() string { return "monitor_permission" }
-
-type ViteConfig struct {
-	ID    int64  `gorm:"primaryKey;autoIncrement" json:"id"`
-	Name  string `gorm:"type:varchar(200);not null;uniqueIndex" json:"name"`
-	Value string `gorm:"type:text;not null" json:"value"`
-	Time  int64  `gorm:"not null" json:"time"`
-}
-
-func (ViteConfig) TableName() string { return "vite_config" }
-
-type Announcement struct {
-	ID          int64         `gorm:"primaryKey;autoIncrement" json:"id"`
-	Content     string        `gorm:"type:text;not null" json:"content"`
-	Enabled     int           `gorm:"not null;default:1" json:"enabled"`
-	CreatedTime int64         `gorm:"column:created_time;not null" json:"created_time"`
-	UpdatedTime sql.NullInt64 `gorm:"column:updated_time" json:"updated_time,omitempty"`
-}
-
-func (Announcement) TableName() string { return "announcement" }
-
-type SchemaVersion struct {
-	Version int `gorm:"not null;default:0"`
-}
-
-func (SchemaVersion) TableName() string { return "schema_version" }
-
-type PeerShare struct {
-	ID             int64  `gorm:"primaryKey;autoIncrement" json:"id"`
-	Name           string `gorm:"type:text;not null" json:"name"`
-	NodeID         int64  `gorm:"column:node_id;not null" json:"nodeId"`
-	Token          string `gorm:"type:text;not null;uniqueIndex" json:"token"`
-	MaxBandwidth   int64  `gorm:"column:max_bandwidth;default:0" json:"maxBandwidth"`
-	ExpiryTime     int64  `gorm:"column:expiry_time;default:0" json:"expiryTime"`
-	PortRangeStart int    `gorm:"column:port_range_start;default:0" json:"portRangeStart"`
-	PortRangeEnd   int    `gorm:"column:port_range_end;default:0" json:"portRangeEnd"`
-	CurrentFlow    int64  `gorm:"column:current_flow;default:0" json:"currentFlow"`
-	IsActive       int    `gorm:"column:is_active;default:1" json:"isActive"`
-	CreatedTime    int64  `gorm:"column:created_time;not null" json:"createdTime"`
-	UpdatedTime    int64  `gorm:"column:updated_time;not null" json:"updatedTime"`
-	AllowedDomains string `gorm:"column:allowed_domains;type:text;default:''" json:"allowedDomains"`
-	AllowedIPs     string `gorm:"column:allowed_ips;type:text;default:''" json:"allowedIps"`
-}
-
-func (PeerShare) TableName() string { return "peer_share" }
-
-type PeerShareRuntime struct {
-	ID            int64  `gorm:"primaryKey;autoIncrement"`
-	ShareID       int64  `gorm:"column:share_id;not null;index:idx_peer_share_runtime_share_node_status"`
-	NodeID        int64  `gorm:"column:node_id;not null;index:idx_peer_share_runtime_share_node_status"`
-	ReservationID string `gorm:"column:reservation_id;type:text;not null;uniqueIndex"`
-	ResourceKey   string `gorm:"column:resource_key;type:text;not null;uniqueIndex"`
-	BindingID     string `gorm:"column:binding_id;type:text;not null;default:'';index:idx_peer_share_runtime_binding_id"`
-	Role          string `gorm:"type:text;not null;default:''"`
-	ChainName     string `gorm:"column:chain_name;type:text;not null;default:''"`
-	ServiceName   string `gorm:"column:service_name;type:text;not null;default:''"`
-	Protocol      string `gorm:"type:text;not null;default:'tls'"`
-	Strategy      string `gorm:"type:text;not null;default:'round'"`
-	Port          int    `gorm:"not null;default:0"`
-	Target        string `gorm:"type:text;not null;default:''"`
-	Applied       int    `gorm:"not null;default:0"`
-	Status        int    `gorm:"not null;default:1;index:idx_peer_share_runtime_share_node_status"`
-	CreatedTime   int64  `gorm:"column:created_time;not null"`
-	UpdatedTime   int64  `gorm:"column:updated_time;not null"`
-}
-
-func (PeerShareRuntime) TableName() string { return "peer_share_runtime" }
-
-type FederationTunnelBinding struct {
-	ID              int64  `gorm:"primaryKey;autoIncrement"`
-	TunnelID        int64  `gorm:"column:tunnel_id;not null;uniqueIndex:idx_federation_tunnel_binding_unique;index:idx_federation_tunnel_binding_tunnel"`
-	NodeID          int64  `gorm:"column:node_id;not null;uniqueIndex:idx_federation_tunnel_binding_unique"`
-	ChainType       int    `gorm:"column:chain_type;not null;uniqueIndex:idx_federation_tunnel_binding_unique"`
-	HopInx          int    `gorm:"column:hop_inx;not null;default:0;uniqueIndex:idx_federation_tunnel_binding_unique"`
-	RemoteURL       string `gorm:"column:remote_url;type:text;not null"`
-	ResourceKey     string `gorm:"column:resource_key;type:text;not null;uniqueIndex"`
-	RemoteBindingID string `gorm:"column:remote_binding_id;type:text;not null"`
-	AllocatedPort   int    `gorm:"column:allocated_port;not null"`
-	Status          int    `gorm:"not null;default:1;index:idx_federation_tunnel_binding_tunnel"`
-	CreatedTime     int64  `gorm:"column:created_time;not null"`
-	UpdatedTime     int64  `gorm:"column:updated_time;not null"`
-}
-
-func (FederationTunnelBinding) TableName() string { return "federation_tunnel_binding" }
-
-// ─── Backup / Import-Export Structs ──────────────────────────────────
-// These are not GORM models; they define the JSON wire format for the
-// backup/restore API and MUST keep their existing json tags unchanged.
-
-// BackupData represents the full backup structure.
-type BackupData struct {
-	Version      string              `json:"version"`
-	ExportedAt   int64               `json:"exportedAt"`
-	Users        []UserBackup        `json:"users,omitempty"`
-	Nodes        []NodeBackup        `json:"nodes,omitempty"`
-	Tunnels      []TunnelBackup      `json:"tunnels,omitempty"`
-	Forwards     []ForwardBackup     `json:"forwards,omitempty"`
-	UserTunnels  []UserTunnelBackup  `json:"userTunnels,omitempty"`
-	SpeedLimits  []SpeedLimitBackup  `json:"speedLimits,omitempty"`
-	TunnelGroups []TunnelGroupBackup `json:"tunnelGroups,omitempty"`
-	UserGroups   []UserGroupBackup   `json:"userGroups,omitempty"`
-	Permissions  []PermissionBackup  `json:"permissions,omitempty"`
-	Configs      map[string]string   `json:"configs,omitempty"`
-}
-
-type UserBackup struct {
-	ID              int64  `json:"id"`
-	User            string `json:"user"`
-	Pwd             string `json:"pwd"`
-	RoleID          int    `json:"roleId"`
-	ExpTime         int64  `json:"expTime"`
-	Flow            int64  `json:"flow"`
-	InFlow          int64  `json:"inFlow"`
-	OutFlow         int64  `json:"outFlow"`
-	FlowResetTime   int64  `json:"flowResetTime"`
-	DailyQuotaGB    int64  `json:"dailyQuotaGB,omitempty"`
-	MonthlyQuotaGB  int64  `json:"monthlyQuotaGB,omitempty"`
-	DisabledByQuota int    `json:"disabledByQuota,omitempty"`
-	QuotaDisabledAt int64  `json:"quotaDisabledAt,omitempty"`
-	Num             int    `json:"num"`
-	CreatedTime     int64  `json:"createdTime"`
-	UpdatedTime     int64  `json:"updatedTime,omitempty"`
-	Status          int    `json:"status"`
-}
-
-type NodeBackup struct {
-	ID            int64  `json:"id"`
-	Name          string `json:"name"`
-	Remark        string `json:"remark,omitempty"`
-	ExpiryTime    int64  `json:"expiryTime,omitempty"`
-	RenewalCycle  string `json:"renewalCycle,omitempty"`
-	Secret        string `json:"secret"`
-	ServerIP      string `json:"serverIp"`
-	ServerIPv4    string `json:"serverIpV4,omitempty"`
-	ServerIPv6    string `json:"serverIpV6,omitempty"`
-	ExtraIPs      string `json:"extraIPs,omitempty"`
-	Port          string `json:"port"`
-	InterfaceName string `json:"interfaceName,omitempty"`
-	Version       string `json:"version,omitempty"`
-	HTTP          int    `json:"http"`
-	TLS           int    `json:"tls"`
-	Socks         int    `json:"socks"`
-	CreatedTime   int64  `json:"createdTime"`
-	UpdatedTime   int64  `json:"updatedTime,omitempty"`
-	Status        int    `json:"status"`
-	TCPListenAddr string `json:"tcpListenAddr"`
-	UDPListenAddr string `json:"udpListenAddr"`
-	Inx           int    `json:"inx"`
-	IsRemote      int    `json:"isRemote"`
-	RemoteURL     string `json:"remoteUrl,omitempty"`
-	RemoteToken   string `json:"remoteToken,omitempty"`
-	RemoteConfig  string `json:"remoteConfig,omitempty"`
-}
-
-type TunnelBackup struct {
-	ID           int64               `json:"id"`
-	Name         string              `json:"name"`
-	TrafficRatio float64             `json:"trafficRatio"`
-	Type         int                 `json:"type"`
-	Protocol     string              `json:"protocol"`
-	Flow         int64               `json:"flow"`
-	CreatedTime  int64               `json:"createdTime"`
-	UpdatedTime  int64               `json:"updatedTime"`
-	Status       int                 `json:"status"`
-	InIP         string              `json:"inIp,omitempty"`
-	Inx          int                 `json:"inx"`
-	IPPreference string              `json:"ipPreference,omitempty"`
-	ChainTunnels []ChainTunnelBackup `json:"chainTunnels,omitempty"`
-}
-
-type ChainTunnelBackup struct {
-	ID        int64  `json:"id"`
-	TunnelID  int64  `json:"tunnelId"`
-	ChainType string `json:"chainType"`
-	NodeID    int64  `json:"nodeId"`
-	Port      int    `json:"port,omitempty"`
-	Strategy  string `json:"strategy,omitempty"`
-	Inx       int    `json:"inx,omitempty"`
-	Protocol  string `json:"protocol,omitempty"`
-}
-
-type ForwardBackup struct {
-	ID           int64                `json:"id"`
-	UserID       int64                `json:"userId"`
-	UserName     string               `json:"userName"`
-	Name         string               `json:"name"`
-	TunnelID     int64                `json:"tunnelId"`
-	RemoteAddr   string               `json:"remoteAddr"`
-	Strategy     string               `json:"strategy"`
-	InFlow       int64                `json:"inFlow"`
-	OutFlow      int64                `json:"outFlow"`
-	CreatedTime  int64                `json:"createdTime"`
-	UpdatedTime  int64                `json:"updatedTime"`
-	Status       int                  `json:"status"`
-	Inx          int                  `json:"inx"`
-	SpeedID      *int64               `json:"speedId,omitempty"`
-	ForwardPorts *[]ForwardPortBackup `json:"forwardPorts,omitempty"`
-}
-
-type ForwardPortBackup struct {
-	NodeID int64 `json:"nodeId"`
-	Port   int   `json:"port"`
-}
-
-type UserTunnelBackup struct {
-	ID            int64 `json:"id"`
-	UserID        int64 `json:"userId"`
-	TunnelID      int64 `json:"tunnelId"`
-	SpeedID       int64 `json:"speedId,omitempty"`
-	Num           int   `json:"num"`
-	Flow          int64 `json:"flow"`
-	InFlow        int64 `json:"inFlow"`
-	OutFlow       int64 `json:"outFlow"`
-	FlowResetTime int64 `json:"flowResetTime"`
-	ExpTime       int64 `json:"expTime"`
-	Status        int   `json:"status"`
-}
-
-type SpeedLimitBackup struct {
-	ID          int64  `json:"id"`
-	Name        string `json:"name"`
-	Speed       int64  `json:"speed"`
-	TunnelID    *int64 `json:"tunnelId,omitempty"`
-	TunnelName  string `json:"tunnelName,omitempty"`
-	CreatedTime int64  `json:"createdTime"`
-	UpdatedTime int64  `json:"updatedTime,omitempty"`
-	Status      int    `json:"status"`
-}
-
-type TunnelGroupBackup struct {
-	ID          int64   `json:"id"`
-	Name        string  `json:"name"`
-	CreatedTime int64   `json:"createdTime"`
-	UpdatedTime int64   `json:"updatedTime"`
-	Status      int     `json:"status"`
-	Tunnels     []int64 `json:"tunnels,omitempty"`
-}
-
-type UserGroupBackup struct {
-	ID          int64   `json:"id"`
-	Name        string  `json:"name"`
-	CreatedTime int64   `json:"createdTime"`
-	UpdatedTime int64   `json:"updatedTime"`
-	Status      int     `json:"status"`
-	Users       []int64 `json:"users,omitempty"`
-}
-
-type PermissionBackup struct {
-	ID             int64                   `json:"id"`
-	UserGroupID    int64                   `json:"userGroupId"`
-	TunnelGroupID  int64                   `json:"tunnelGroupId"`
-	CreatedTime    int64                   `json:"createdTime"`
-	CreatedByGroup int                     `json:"createdByGroup"`
-	Grants         []PermissionGrantBackup `json:"grants,omitempty"`
-}
-
-type PermissionGrantBackup struct {
-	ID             int64 `json:"id"`
-	UserGroupID    int64 `json:"userGroupId"`
-	TunnelGroupID  int64 `json:"tunnelGroupId"`
-	UserTunnelID   int64 `json:"userTunnelId"`
-	CreatedTime    int64 `json:"createdTime"`
-	CreatedByGroup int   `json:"createdByGroup"`
-}
-
-// ImportResult contains the result of an import operation.
-type ImportResult struct {
-	UsersImported        int         `json:"usersImported"`
-	NodesImported        int         `json:"nodesImported"`
-	TunnelsImported      int         `json:"tunnelsImported"`
-	ForwardsImported     int         `json:"forwardsImported"`
-	UserTunnelsImported  int         `json:"userTunnelsImported"`
-	SpeedLimitsImported  int         `json:"speedLimitsImported"`
-	TunnelGroupsImported int         `json:"tunnelGroupsImported"`
-	UserGroupsImported   int         `json:"userGroupsImported"`
-	PermissionsImported  int         `json:"permissionsImported"`
-	ConfigsImported      int         `json:"configsImported"`
-	AutoBackup           *BackupData `json:"autoBackup,omitempty"`
-}
-
-// ─── View Structs (used by Repository, not GORM models) ─────────────
-// These are used for JOIN query results that don't map 1:1 to a table.
-
-// ForwardRecord is a minimal forward view used by control plane and flow policy.
-type ForwardRecord struct {
-	ID         int64
-	UserID     int64
-	UserName   string
-	Name       string
-	TunnelID   int64
-	RemoteAddr string
-	Strategy   string
-	Status     int
-	SpeedID    sql.NullInt64
-}
-
-// TunnelRecord is a minimal tunnel view used by control plane.
-type TunnelRecord struct {
-	ID           int64
-	Type         int
-	Status       int
-	Flow         int64
-	TrafficRatio float64
-}
-
-type UserQuotaView struct {
-	UserID           int64
-	DailyLimitGB     int64
-	MonthlyLimitGB   int64
-	DailyUsedBytes   int64
-	MonthlyUsedBytes int64
-	DayKey           int64
-	MonthKey         int64
-	DisabledByQuota  int
-	DisabledAt       int64
-	PausedForwardIDs string
-}
-
-// ForwardPortRecord is a forward port mapping used by control plane.
-type ForwardPortRecord struct {
-	NodeID int64
-	Port   int
-	InIP   string
-}
-
-// NodeRecord is a node view used by control plane.
-type NodeRecord struct {
-	ID            int64
-	Name          string
-	ServerIP      string
-	ServerIPv4    string
-	ServerIPv6    string
-	ExtraIPs      string
-	Status        int
-	PortRange     string
-	TCPListenAddr string
-	UDPListenAddr string
-	InterfaceName string
-	IsRemote      int
-	RemoteURL     string
-	RemoteToken   string
-	RemoteConfig  string
-}
-
-type ChainNodeRecord struct {
-	ChainType int
-	Inx       int64
-	NodeID    int64
-	Port      int
-	NodeName  string
-	Protocol  string
-	Strategy  string
-	ConnectIP string
-}
-
-type UserTunnelLimiterInfo struct {
-	UserTunnelID int64
-	LimiterID    *int64
-	Speed        *int
-}
-
-// UserFlowSnapshot holds a user's current flow counters (used by stats job).
-type UserFlowSnapshot struct {
-	UserID  int64
-	InFlow  int64
-	OutFlow int64
-}
-
-// ExpiredUserTunnel holds minimal info for an expired user_tunnel row.
-type ExpiredUserTunnel struct {
-	ID       int64
-	UserID   int64
-	TunnelID int64
-}
-
-// UserTunnelDetail is a joined view of user_tunnel + tunnel + speed_limit.
-type UserTunnelDetail struct {
-	ID            int64
-	UserID        int64
-	TunnelID      int64
-	TunnelName    string
-	Status        int
-	TunnelFlow    int
-	Flow          int64
-	InFlow        int64
-	OutFlow       int64
-	Num           int
-	FlowResetTime int64
-	ExpTime       int64
-	SpeedID       sql.NullInt64
-	SpeedLimit    sql.NullString
-	Speed         sql.NullInt64
-}
-
-// UserForwardDetail is a joined view of forward + tunnel.
-type UserForwardDetail struct {
-	ID         int64
-	Name       string
-	TunnelID   int64
-	TunnelName string
-	InIP       string
-	InPort     sql.NullInt64
-	RemoteAddr string
-	InFlow     int64
-	OutFlow    int64
-	Status     int
-	CreatedAt  int64
-}
-
-type NodeMetric struct {
-	ID          int64   `gorm:"primaryKey;autoIncrement" json:"id"`
-	NodeID      int64   `gorm:"column:node_id;not null;index:idx_node_metric_node_time,priority:1" json:"nodeId"`
-	Timestamp   int64   `gorm:"not null;index:idx_node_metric_node_time,priority:2;index:idx_node_metric_time" json:"timestamp"`
-	CPUUsage    float64 `gorm:"column:cpu_usage" json:"cpuUsage"`
-	MemUsage    float64 `gorm:"column:mem_usage" json:"memoryUsage"`
-	DiskUsage   float64 `gorm:"column:disk_usage" json:"diskUsage"`
-	NetInBytes  int64   `gorm:"column:net_in_bytes" json:"netInBytes"`
-	NetOutBytes int64   `gorm:"column:net_out_bytes" json:"netOutBytes"`
-	NetInSpeed  int64   `gorm:"column:net_in_speed" json:"netInSpeed"`
-	NetOutSpeed int64   `gorm:"column:net_out_speed" json:"netOutSpeed"`
-	Load1       float64 `gorm:"column:load1" json:"load1"`
-	Load5       float64 `gorm:"column:load5" json:"load5"`
-	Load15      float64 `gorm:"column:load15" json:"load15"`
-	TCPConns    int64   `gorm:"column:tcp_conns" json:"tcpConns"`
-	UDPConns    int64   `gorm:"column:udp_conns" json:"udpConns"`
-	Uptime      int64   `gorm:"column:uptime" json:"uptime"`
-}
-
-func (NodeMetric) TableName() string { return "node_metric" }
-
-type TunnelMetric struct {
-	ID           int64   `gorm:"primaryKey;autoIncrement" json:"id"`
-	TunnelID     int64   `gorm:"column:tunnel_id;not null;uniqueIndex:idx_tunnel_metric_tunnel_time,priority:1" json:"tunnelId"`
-	NodeID       int64   `gorm:"column:node_id;not null;uniqueIndex:idx_tunnel_metric_tunnel_time,priority:2" json:"nodeId"`
-	Timestamp    int64   `gorm:"not null;uniqueIndex:idx_tunnel_metric_tunnel_time,priority:3;index:idx_tunnel_metric_time" json:"timestamp"`
-	BytesIn      int64   `gorm:"column:bytes_in" json:"bytesIn"`
-	BytesOut     int64   `gorm:"column:bytes_out" json:"bytesOut"`
-	Connections  int64   `gorm:"column:connections" json:"connections"`
-	Errors       int64   `gorm:"column:errors" json:"errors"`
-	AvgLatencyMs float64 `gorm:"column:avg_latency_ms" json:"avgLatencyMs"`
-}
-
-func (TunnelMetric) TableName() string { return "tunnel_metric" }
-
-type ServiceMonitor struct {
-	ID          int64  `gorm:"primaryKey;autoIncrement" json:"id"`
-	Name        string `gorm:"type:varchar(100);not null" json:"name"`
-	Type        string `gorm:"type:varchar(20);not null" json:"type"`
-	Target      string `gorm:"type:text;not null" json:"target"`
-	IntervalSec int    `gorm:"column:interval_sec;not null;default:60" json:"intervalSec"`
-	TimeoutSec  int    `gorm:"column:timeout_sec;not null;default:5" json:"timeoutSec"`
-	NodeID      int64  `gorm:"column:node_id;index" json:"nodeId"`
-	Enabled     int    `gorm:"not null;default:1" json:"enabled"`
-	CreatedTime int64  `gorm:"column:created_time;not null" json:"createdTime"`
-	UpdatedTime int64  `gorm:"column:updated_time;not null" json:"updatedTime"`
-}
-
-func (ServiceMonitor) TableName() string { return "service_monitor" }
-
-type ServiceMonitorResult struct {
-	ID           int64   `gorm:"primaryKey;autoIncrement" json:"id"`
-	MonitorID    int64   `gorm:"column:monitor_id;not null;index:idx_monitor_result_monitor_time,priority:1" json:"monitorId"`
-	NodeID       int64   `gorm:"column:node_id;not null;index" json:"nodeId"`
-	Timestamp    int64   `gorm:"not null;index:idx_monitor_result_monitor_time,priority:2" json:"timestamp"`
-	Success      int     `gorm:"not null" json:"success"`
-	LatencyMs    float64 `gorm:"column:latency_ms" json:"latencyMs"`
-	StatusCode   int     `gorm:"column:status_code" json:"statusCode"`
-	ErrorMessage string  `gorm:"column:error_message;type:text" json:"errorMessage"`
-}
-
-func (ServiceMonitorResult) TableName() string { return "service_monitor_result" }
-
-// TunnelQuality stores periodic probe results for a tunnel.
-// Unlike the old upsert model, rows accumulate for history/charting.
-// Old rows are pruned periodically (default: keep 24h).
-type TunnelQuality struct {
-	ID                 int64   `gorm:"primaryKey;autoIncrement" json:"id"`
-	TunnelID           int64   `gorm:"column:tunnel_id;not null;index:idx_tunnel_quality_tunnel_time,priority:1" json:"tunnelId"`
-	EntryToExitLatency float64 `gorm:"column:entry_to_exit_latency" json:"entryToExitLatency"`
-	ExitToBingLatency  float64 `gorm:"column:exit_to_bing_latency" json:"exitToBingLatency"`
-	EntryToExitLoss    float64 `gorm:"column:entry_to_exit_loss" json:"entryToExitLoss"`
-	ExitToBingLoss     float64 `gorm:"column:exit_to_bing_loss" json:"exitToBingLoss"`
-	Success            int     `gorm:"not null;default:1" json:"success"`
-	ErrorMessage       string  `gorm:"column:error_message;type:text" json:"errorMessage,omitempty"`
-	Timestamp          int64   `gorm:"not null;index:idx_tunnel_quality_tunnel_time,priority:2;index:idx_tunnel_quality_time" json:"timestamp"`
-}
-
-func (TunnelQuality) TableName() string { return "tunnel_quality" }

go-backend/internal/store/postgres/embed.go

@@ -0,0 +1,9 @@
+package postgres
+
+import _ "embed"
+
+//go:embed sql/schema.sql
+var EmbeddedSchema string
+
+//go:embed sql/data.sql
+var EmbeddedSeedData string

go-backend/internal/store/postgres/sql/data.sql

@@ -0,0 +1,18 @@
+INSERT INTO "user" (id, "user", pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+VALUES (1, 'admin_user', '3c85cdebade1c51cf64ca9f3c09d182d', 0, 2727251700000, 99999, 0, 0, 1, 99999, 1748914865000, 1754011744252, 1)
+ON CONFLICT DO NOTHING;
+
+INSERT INTO vite_config (id, name, value, time)
+VALUES (1, 'app_name', 'flux', 1755147963000)
+ON CONFLICT DO NOTHING;
+
+DO $$
+BEGIN
+    IF to_regclass('public.user_id_seq') IS NOT NULL THEN
+        PERFORM setval('user_id_seq', (SELECT COALESCE(MAX(id), 0) FROM "user"));
+    END IF;
+    IF to_regclass('public.vite_config_id_seq') IS NOT NULL THEN
+        PERFORM setval('vite_config_id_seq', (SELECT COALESCE(MAX(id), 0) FROM vite_config));
+    END IF;
+END
+$$;

go-backend/internal/store/postgres/sql/schema.sql

@@ -0,0 +1,242 @@
+CREATE TABLE IF NOT EXISTS forward (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  user_name VARCHAR(100) NOT NULL,
+  name VARCHAR(100) NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  remote_addr TEXT NOT NULL,
+  strategy VARCHAR(100) NOT NULL DEFAULT 'fifo',
+  in_flow BIGINT NOT NULL DEFAULT 0,
+  out_flow BIGINT NOT NULL DEFAULT 0,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL,
+  inx INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS forward_port (
+  id SERIAL PRIMARY KEY,
+  forward_id INTEGER NOT NULL,
+  node_id INTEGER NOT NULL,
+  port INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS node (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  secret VARCHAR(100) NOT NULL,
+  server_ip VARCHAR(100) NOT NULL,
+  server_ip_v4 VARCHAR(100),
+  server_ip_v6 VARCHAR(100),
+  port TEXT NOT NULL,
+  interface_name VARCHAR(200),
+  version VARCHAR(100),
+  http INTEGER NOT NULL DEFAULT 0,
+  tls INTEGER NOT NULL DEFAULT 0,
+  socks INTEGER NOT NULL DEFAULT 0,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT,
+  status INTEGER NOT NULL,
+  tcp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  udp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  inx INTEGER NOT NULL DEFAULT 0,
+  is_remote INTEGER DEFAULT 0,
+  remote_url TEXT,
+  remote_token TEXT,
+  remote_config TEXT
+);
+
+CREATE TABLE IF NOT EXISTS speed_limit (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  speed INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  tunnel_name VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS statistics_flow (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  flow BIGINT NOT NULL,
+  total_flow BIGINT NOT NULL,
+  time VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  traffic_ratio DOUBLE PRECISION NOT NULL DEFAULT 1.0,
+  type INTEGER NOT NULL,
+  protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
+  flow BIGINT NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL,
+  in_ip TEXT,
+  inx INTEGER NOT NULL DEFAULT 0,
+  ip_preference VARCHAR(10) NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS chain_tunnel (
+    id SERIAL PRIMARY KEY,
+    tunnel_id INTEGER NOT NULL,
+    chain_type VARCHAR(10) NOT NULL,
+    node_id INTEGER NOT NULL,
+    port INTEGER,
+    strategy VARCHAR(10),
+    inx INTEGER,
+    protocol VARCHAR(10)
+);
+
+CREATE TABLE IF NOT EXISTS "user" (
+  id SERIAL PRIMARY KEY,
+  "user" VARCHAR(100) NOT NULL,
+  pwd VARCHAR(100) NOT NULL,
+  role_id INTEGER NOT NULL,
+  exp_time BIGINT NOT NULL,
+  flow BIGINT NOT NULL,
+  in_flow BIGINT NOT NULL DEFAULT 0,
+  out_flow BIGINT NOT NULL DEFAULT 0,
+  flow_reset_time BIGINT NOT NULL,
+  num INTEGER NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_tunnel (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  speed_id INTEGER,
+  num INTEGER NOT NULL,
+  flow BIGINT NOT NULL,
+  in_flow BIGINT NOT NULL DEFAULT 0,
+  out_flow BIGINT NOT NULL DEFAULT 0,
+  flow_reset_time BIGINT NOT NULL,
+  exp_time BIGINT NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL,
+  created_time BIGINT NOT NULL,
+  updated_time BIGINT NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group_tunnel (
+  id SERIAL PRIMARY KEY,
+  tunnel_group_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group_user (
+  id SERIAL PRIMARY KEY,
+  user_group_id INTEGER NOT NULL,
+  user_id INTEGER NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission (
+  id SERIAL PRIMARY KEY,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  created_time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission_grant (
+  id SERIAL PRIMARY KEY,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  user_tunnel_id INTEGER NOT NULL,
+  created_by_group INTEGER NOT NULL DEFAULT 0,
+  created_time BIGINT NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_name ON tunnel_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_name ON user_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_tunnel_unique ON tunnel_group_tunnel(tunnel_group_id, tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_user_unique ON user_group_user(user_group_id, user_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_unique ON group_permission(user_group_id, tunnel_group_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_grant_unique ON group_permission_grant(user_group_id, tunnel_group_id, user_tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_tunnel_unique ON user_tunnel(user_id, tunnel_id);
+
+CREATE TABLE IF NOT EXISTS vite_config (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(200) NOT NULL UNIQUE,
+  value VARCHAR(200) NOT NULL,
+  time BIGINT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS peer_share (
+    id SERIAL PRIMARY KEY,
+    name TEXT NOT NULL,
+    node_id INTEGER NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    max_bandwidth INTEGER DEFAULT 0,
+    expiry_time BIGINT DEFAULT 0,
+    port_range_start INTEGER DEFAULT 0,
+    port_range_end INTEGER DEFAULT 0,
+    current_flow BIGINT DEFAULT 0,
+    is_active INTEGER DEFAULT 1,
+    created_time BIGINT NOT NULL,
+    updated_time BIGINT NOT NULL,
+    allowed_domains TEXT DEFAULT '',
+    allowed_ips TEXT DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS peer_share_runtime (
+    id SERIAL PRIMARY KEY,
+    share_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    reservation_id TEXT NOT NULL UNIQUE,
+    resource_key TEXT NOT NULL UNIQUE,
+    binding_id TEXT NOT NULL DEFAULT '',
+    role TEXT NOT NULL DEFAULT '',
+    chain_name TEXT NOT NULL DEFAULT '',
+    service_name TEXT NOT NULL DEFAULT '',
+    protocol TEXT NOT NULL DEFAULT 'tls',
+    strategy TEXT NOT NULL DEFAULT 'round',
+    port INTEGER NOT NULL DEFAULT 0,
+    target TEXT NOT NULL DEFAULT '',
+    applied INTEGER NOT NULL DEFAULT 0,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time BIGINT NOT NULL,
+    updated_time BIGINT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_share_node_status ON peer_share_runtime(share_id, node_id, status);
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_binding_id ON peer_share_runtime(binding_id);
+
+CREATE TABLE IF NOT EXISTS federation_tunnel_binding (
+    id SERIAL PRIMARY KEY,
+    tunnel_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    chain_type INTEGER NOT NULL,
+    hop_inx INTEGER NOT NULL DEFAULT 0,
+    remote_url TEXT NOT NULL,
+    resource_key TEXT NOT NULL UNIQUE,
+    remote_binding_id TEXT NOT NULL,
+    allocated_port INTEGER NOT NULL,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time BIGINT NOT NULL,
+    updated_time BIGINT NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_federation_tunnel_binding_unique ON federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx);
+CREATE INDEX IF NOT EXISTS idx_federation_tunnel_binding_tunnel ON federation_tunnel_binding(tunnel_id, status);

go-backend/internal/store/repo/repository_control.go

@@ -1,397 +0,0 @@
-package repo
-
-import (
-	"database/sql"
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-
-	"gorm.io/gorm"
-
-	"go-backend/internal/store/model"
-)
-
-func (r *Repository) UserTunnelExistsByUserAndTunnel(userID, tunnelID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.UserTunnel{}).
-		Where("user_id = ? AND tunnel_id = ? AND status = 1", userID, tunnelID).
-		Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) ListForwardsByTunnel(tunnelID int64) ([]model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	return r.ListForwardsByTunnelTx(r.db, tunnelID)
-}
-
-func (r *Repository) ListForwardsByTunnelTx(tx *gorm.DB, tunnelID int64) ([]model.ForwardRecord, error) {
-	if tx == nil {
-		return nil, errors.New("database unavailable")
-	}
-	var forwards []model.Forward
-	err := tx.Where("tunnel_id = ?", tunnelID).Order("id ASC").Find(&forwards).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardRecord, 0, len(forwards))
-	for _, f := range forwards {
-		rows = append(rows, model.ForwardRecord{
-			ID:         f.ID,
-			UserID:     f.UserID,
-			UserName:   f.UserName,
-			Name:       f.Name,
-			TunnelID:   f.TunnelID,
-			RemoteAddr: f.RemoteAddr,
-			Strategy:   f.Strategy,
-			Status:     f.Status,
-			SpeedID:    f.SpeedID,
-		})
-	}
-	for i := range rows {
-		if strings.TrimSpace(rows[i].Strategy) == "" {
-			rows[i].Strategy = "fifo"
-		}
-	}
-	return rows, nil
-}
-
-
-func (r *Repository) ListActiveTunnelIDsByNode(nodeID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.ChainTunnel{}).
-		Joins("JOIN tunnel ON tunnel.id = chain_tunnel.tunnel_id").
-		Where("chain_tunnel.node_id = ? AND tunnel.status = 1", nodeID).
-		Select("DISTINCT chain_tunnel.tunnel_id").
-		Order("chain_tunnel.tunnel_id ASC").
-		Pluck("chain_tunnel.tunnel_id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) ListActiveForwardIDsByNode(nodeID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.ForwardPort{}).
-		Joins("JOIN forward ON forward.id = forward_port.forward_id").
-		Where("forward_port.node_id = ? AND forward.status = 1", nodeID).
-		Select("DISTINCT forward_port.forward_id").
-		Order("forward_port.forward_id ASC").
-		Pluck("forward_port.forward_id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) ListForwardPorts(forwardID int64) ([]model.ForwardPortRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	return r.ListForwardPortsTx(r.db, forwardID)
-}
-
-func (r *Repository) ListForwardPortsTx(tx *gorm.DB, forwardID int64) ([]model.ForwardPortRecord, error) {
-	if tx == nil {
-		return nil, errors.New("database unavailable")
-	}
-	var ports []model.ForwardPort
-	err := tx.Where("forward_id = ?", forwardID).Order("id ASC").Find(&ports).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardPortRecord, 0, len(ports))
-	for _, p := range ports {
-		inIP := ""
-		if p.InIP.Valid {
-			inIP = p.InIP.String
-		}
-		rows = append(rows, model.ForwardPortRecord{NodeID: p.NodeID, Port: p.Port, InIP: inIP})
-	}
-	return rows, nil
-}
-
-
-func (r *Repository) HasOtherForwardOnNodePort(nodeID int64, port int, currentForwardID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	return r.HasOtherForwardOnNodePortTx(r.db, nodeID, port, currentForwardID)
-}
-
-func (r *Repository) HasOtherForwardOnNodePortTx(tx *gorm.DB, nodeID int64, port int, currentForwardID int64) (bool, error) {
-	if tx == nil {
-		return false, errors.New("database unavailable")
-	}
-	if nodeID <= 0 || port <= 0 {
-		return false, nil
-	}
-
-	var count int64
-	err := tx.Model(&model.ForwardPort{}).
-		Where("node_id = ? AND port = ? AND forward_id <> ?", nodeID, port, currentForwardID).
-		Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-
-	return count > 0, nil
-}
-
-
-func (r *Repository) GetTunnelOutProtocol(tunnelID int64) (string, error) {
-	if r == nil || r.db == nil {
-		return "", errors.New("repository not initialized")
-	}
-	var ct model.ChainTunnel
-	err := r.db.Select("protocol").
-		Where("tunnel_id = ? AND chain_type = ?", tunnelID, "3").
-		Order("id ASC").
-		Take(&ct).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return "", nil
-		}
-		return "", err
-	}
-	if ct.Protocol.Valid {
-		return ct.Protocol.String, nil
-	}
-	return "", nil
-}
-
-func (r *Repository) GetNodeRecord(nodeID int64) (*model.NodeRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var n model.Node
-	err := r.db.Where("id = ?", nodeID).First(&n).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	return nodeRecordFromModel(&n), nil
-}
-
-func (r *Repository) GetNodeRecordTx(tx *gorm.DB, nodeID int64) (*model.NodeRecord, error) {
-	if tx == nil {
-		return nil, errors.New("database unavailable")
-	}
-	var n model.Node
-	err := tx.Where("id = ?", nodeID).First(&n).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	return nodeRecordFromModel(&n), nil
-}
-
-func nodeRecordFromModel(n *model.Node) *model.NodeRecord {
-	if n == nil {
-		return nil
-	}
-	rec := &model.NodeRecord{
-		ID:            n.ID,
-		Name:          n.Name,
-		ServerIP:      n.ServerIP,
-		Status:        n.Status,
-		PortRange:     n.Port,
-		TCPListenAddr: n.TCPListenAddr, UDPListenAddr: n.UDPListenAddr,
-		IsRemote: n.IsRemote,
-	}
-	if n.ServerIPV4.Valid {
-		rec.ServerIPv4 = strings.TrimSpace(n.ServerIPV4.String)
-	}
-	if n.ServerIPV6.Valid {
-		rec.ServerIPv6 = strings.TrimSpace(n.ServerIPV6.String)
-	}
-	if n.ExtraIPs.Valid {
-		rec.ExtraIPs = strings.TrimSpace(n.ExtraIPs.String)
-	}
-	if n.InterfaceName.Valid {
-		rec.InterfaceName = strings.TrimSpace(n.InterfaceName.String)
-	}
-	if n.RemoteURL.Valid {
-		rec.RemoteURL = strings.TrimSpace(n.RemoteURL.String)
-	}
-	if n.RemoteToken.Valid {
-		rec.RemoteToken = strings.TrimSpace(n.RemoteToken.String)
-	}
-	if n.RemoteConfig.Valid {
-		rec.RemoteConfig = strings.TrimSpace(n.RemoteConfig.String)
-	}
-	if rec.TCPListenAddr == "" {
-		rec.TCPListenAddr = "[::]"
-	}
-	if rec.UDPListenAddr == "" {
-		rec.UDPListenAddr = "[::]"
-	}
-	if strings.TrimSpace(rec.Name) == "" {
-		rec.Name = fmt.Sprintf("node_%d", rec.ID)
-	}
-	return rec
-}
-
-func (r *Repository) ResolveUserTunnelAndLimiter(userID, tunnelID int64) (*model.UserTunnelLimiterInfo, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	type row struct {
-		UserTunnelID int64         `gorm:"column:user_tunnel_id"`
-		LimiterID    sql.NullInt64 `gorm:"column:limiter_id"`
-		Speed        sql.NullInt64 `gorm:"column:speed"`
-	}
-	var rec row
-	err := r.db.Model(&model.UserTunnel{}).
-		Select("user_tunnel.id AS user_tunnel_id, speed_limit.id AS limiter_id, speed_limit.speed AS speed").
-		Joins("LEFT JOIN speed_limit ON speed_limit.id = user_tunnel.speed_id").
-		Where("user_tunnel.user_id = ? AND user_tunnel.tunnel_id = ?", userID, tunnelID).
-		Order("user_tunnel.id ASC").
-		Limit(1).
-		Take(&rec).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return &model.UserTunnelLimiterInfo{}, nil
-		}
-		return nil, err
-	}
-	info := &model.UserTunnelLimiterInfo{UserTunnelID: rec.UserTunnelID}
-	if rec.LimiterID.Valid && rec.LimiterID.Int64 > 0 {
-		v := rec.LimiterID.Int64
-		info.LimiterID = &v
-		s := int(rec.Speed.Int64)
-		info.Speed = &s
-	}
-	return info, nil
-}
-
-func (r *Repository) ListUserTunnelIDs(userID, tunnelID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserTunnel{}).
-		Where("user_id = ? AND tunnel_id = ?", userID, tunnelID).
-		Order("id ASC").Pluck("id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) ListUserTunnelIDsByUser(userID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserTunnel{}).
-		Where("user_id = ?", userID).
-		Order("id ASC").Pluck("id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	return ids, nil
-}
-
-func (r *Repository) GetTunnelName(tunnelID int64) (string, error) {
-	if r == nil || r.db == nil {
-		return "", errors.New("repository not initialized")
-	}
-	var name string
-	err := r.db.Model(&model.Tunnel{}).Where("id = ?", tunnelID).Pluck("name", &name).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return "", nil
-		}
-		return "", err
-	}
-	return name, nil
-}
-
-func (r *Repository) ListChainNodesForTunnel(tunnelID int64) ([]model.ChainNodeRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	type row struct {
-		ChainType string
-		Inx       sql.NullInt64
-		NodeID    int64
-		Port      sql.NullInt64
-		Name      sql.NullString
-		Protocol  sql.NullString
-		Strategy  sql.NullString
-		ConnectIP sql.NullString
-	}
-	var rows []row
-	err := r.db.Model(&model.ChainTunnel{}).
-		Select("chain_tunnel.chain_type, chain_tunnel.inx, chain_tunnel.node_id, chain_tunnel.port, node.name, chain_tunnel.protocol, chain_tunnel.strategy, chain_tunnel.connect_ip").
-		Joins("LEFT JOIN node ON node.id = chain_tunnel.node_id").
-		Where("chain_tunnel.tunnel_id = ?", tunnelID).
-		Order("chain_tunnel.chain_type ASC, chain_tunnel.inx ASC, chain_tunnel.id ASC").
-		Find(&rows).Error
-	if err != nil {
-		return nil, err
-	}
-	result := make([]model.ChainNodeRecord, 0, len(rows))
-	for _, row := range rows {
-		chainType := 0
-		if v := strings.TrimSpace(row.ChainType); v != "" {
-			if parsed, parseErr := strconv.Atoi(v); parseErr == nil {
-				chainType = parsed
-			}
-		}
-		inx := int64(0)
-		if row.Inx.Valid {
-			inx = row.Inx.Int64
-		}
-		port := 0
-		if row.Port.Valid {
-			port = int(row.Port.Int64)
-		}
-		item := model.ChainNodeRecord{
-			ChainType: chainType,
-			Inx:       inx,
-			NodeID:    row.NodeID,
-			Port:      port,
-		}
-		if strings.TrimSpace(row.Name.String) == "" {
-			item.NodeName = fmt.Sprintf("node_%d", row.NodeID)
-		} else {
-			item.NodeName = row.Name.String
-		}
-		if strings.TrimSpace(row.Protocol.String) == "" {
-			item.Protocol = "tls"
-		} else {
-			item.Protocol = row.Protocol.String
-		}
-		if strings.TrimSpace(row.Strategy.String) == "" {
-			item.Strategy = "round"
-		} else {
-			item.Strategy = row.Strategy.String
-		}
-		if row.ConnectIP.Valid {
-			item.ConnectIP = row.ConnectIP.String
-		}
-		result = append(result, item)
-	}
-	return result, nil
-}

go-backend/internal/store/repo/repository_federation.go

@@ -1,294 +0,0 @@
-package repo
-
-import (
-	"database/sql"
-	"errors"
-
-	"go-backend/internal/store/model"
-
-	"gorm.io/gorm"
-)
-
-// RemoteNodeRow holds the columns fetched for a remote node listing.
-type RemoteNodeRow struct {
-	ID           int64
-	Name         string
-	RemoteURL    sql.NullString
-	RemoteToken  sql.NullString
-	RemoteConfig sql.NullString
-}
-
-// NodeBasicInfo holds name, server_ip, and status for a node.
-type NodeBasicInfo struct {
-	Name     string
-	ServerIP string
-	Status   int
-}
-
-// FederationBindingRow holds the columns for an active federation tunnel binding.
-type FederationBindingRow struct {
-	ID              int64
-	TunnelID        int64
-	TunnelName      string
-	ChainType       int
-	HopInx          int
-	AllocatedPort   int
-	ResourceKey     string
-	RemoteBindingID string
-	UpdatedTime     int64
-}
-
-type ActiveForwardPortRow struct {
-	ForwardID   int64
-	TunnelID    int64
-	TunnelName  string
-	Port        int
-	UpdatedTime int64
-}
-
-// ListRemoteNodes returns all nodes with is_remote=1, ordered by id desc.
-func (r *Repository) ListRemoteNodes() ([]RemoteNodeRow, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var result []RemoteNodeRow
-	err := r.db.Model(&model.Node{}).
-		Select("id, name, remote_url, remote_token, remote_config").
-		Where("is_remote = 1").
-		Order("id DESC").
-		Find(&result).Error
-	if err != nil {
-		return nil, err
-	}
-	if result == nil {
-		result = make([]RemoteNodeRow, 0)
-	}
-	return result, nil
-}
-
-// UpdateNodeRemoteConfig sets the remote_config JSON for a given node.
-func (r *Repository) UpdateNodeRemoteConfig(nodeID int64, configJSON string) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	return r.db.Model(&model.Node{}).Where("id = ?", nodeID).Update("remote_config", configJSON).Error
-}
-
-// ListActiveBindingsForNode returns active federation tunnel bindings for a node.
-func (r *Repository) ListActiveBindingsForNode(nodeID int64) ([]FederationBindingRow, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var result []FederationBindingRow
-	err := r.db.Model(&model.FederationTunnelBinding{}).
-		Select("federation_tunnel_binding.id, federation_tunnel_binding.tunnel_id, COALESCE(tunnel.name, '') AS tunnel_name, federation_tunnel_binding.chain_type, federation_tunnel_binding.hop_inx, federation_tunnel_binding.allocated_port, federation_tunnel_binding.resource_key, federation_tunnel_binding.remote_binding_id, federation_tunnel_binding.updated_time").
-		Joins("LEFT JOIN tunnel ON tunnel.id = federation_tunnel_binding.tunnel_id").
-		Where("federation_tunnel_binding.node_id = ? AND federation_tunnel_binding.status = 1", nodeID).
-		Order("federation_tunnel_binding.allocated_port ASC, federation_tunnel_binding.id ASC").
-		Find(&result).Error
-	if err != nil {
-		return nil, err
-	}
-	if result == nil {
-		result = make([]FederationBindingRow, 0)
-	}
-	return result, nil
-}
-
-func (r *Repository) ListActiveForwardPortsForNode(nodeID int64) ([]ActiveForwardPortRow, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var result []ActiveForwardPortRow
-	err := r.db.Model(&model.ForwardPort{}).
-		Select("forward_port.forward_id, forward.tunnel_id, COALESCE(tunnel.name, '') AS tunnel_name, forward_port.port, forward.updated_time").
-		Joins("JOIN forward ON forward.id = forward_port.forward_id").
-		Joins("LEFT JOIN tunnel ON tunnel.id = forward.tunnel_id").
-		Where("forward_port.node_id = ? AND forward_port.port > 0", nodeID).
-		Order("forward_port.port ASC, forward_port.id ASC").
-		Find(&result).Error
-	if err != nil {
-		return nil, err
-	}
-	if result == nil {
-		result = make([]ActiveForwardPortRow, 0)
-	}
-	return result, nil
-}
-
-// GetNodeBasicInfo returns the name, server_ip, and status for a given node.
-func (r *Repository) GetNodeBasicInfo(nodeID int64) (*NodeBasicInfo, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var n model.Node
-	err := r.db.Select("name", "server_ip", "status").Where("id = ?", nodeID).First(&n).Error
-	if err != nil {
-		return nil, err
-	}
-	return &NodeBasicInfo{Name: n.Name, ServerIP: n.ServerIP, Status: n.Status}, nil
-}
-
-// CreateFederationTunnel creates a tunnel and chain_tunnel entry in a transaction,
-// returning the new tunnel ID.
-func (r *Repository) CreateFederationTunnel(name string, tunnelType int, protocol string, now int64, nodeID int64, remotePort int) (int64, error) {
-	if r == nil || r.db == nil {
-		return 0, errors.New("repository not initialized")
-	}
-	tunnel := model.Tunnel{
-		Name:        name,
-		Type:        tunnelType,
-		Protocol:    protocol,
-		Flow:        0,
-		CreatedTime: now,
-		UpdatedTime: now,
-		Status:      1,
-		InIP:        sql.NullString{String: "", Valid: false},
-	}
-	err := r.db.Transaction(func(tx *gorm.DB) error {
-		if err := tx.Create(&tunnel).Error; err != nil {
-			return err
-		}
-		ct := model.ChainTunnel{
-			TunnelID:  tunnel.ID,
-			ChainType: "1",
-			NodeID:    nodeID,
-			Port:      sql.NullInt64{Int64: int64(remotePort), Valid: true},
-			Strategy:  sql.NullString{String: "fifo", Valid: true},
-			Inx:       sql.NullInt64{Int64: 0, Valid: true},
-			Protocol:  sql.NullString{String: protocol, Valid: true},
-		}
-		if err := tx.Create(&ct).Error; err != nil {
-			return err
-		}
-		return nil
-	})
-	if err != nil {
-		return 0, err
-	}
-	return tunnel.ID, nil
-}
-
-// ListUsedPortsOnNode returns all ports in use on a given node from chain_tunnel and forward_port tables.
-func (r *Repository) ListUsedPortsOnNode(nodeID int64) ([]int, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	used := make(map[int]struct{})
-
-	var chainPorts []int
-	err := r.db.Model(&model.ChainTunnel{}).
-		Where("node_id = ? AND port > 0", nodeID).
-		Pluck("port", &chainPorts).Error
-	if err != nil {
-		return nil, err
-	}
-	for _, p := range chainPorts {
-		if p > 0 {
-			used[p] = struct{}{}
-		}
-	}
-
-	var forwardPorts []int
-	err = r.db.Model(&model.ForwardPort{}).
-		Where("node_id = ? AND port > 0", nodeID).
-		Pluck("port", &forwardPorts).Error
-	if err != nil {
-		return nil, err
-	}
-	for _, p := range forwardPorts {
-		if p > 0 {
-			used[p] = struct{}{}
-		}
-	}
-
-	result := make([]int, 0, len(used))
-	for p := range used {
-		result = append(result, p)
-	}
-	return result, nil
-}
-
-// ListTunnelIDsByNamePrefix returns all tunnel IDs whose name starts with the given prefix.
-func (r *Repository) ListTunnelIDsByNamePrefix(prefix string) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.Tunnel{}).
-		Where("name LIKE ?", prefix+"%").
-		Order("id ASC").
-		Pluck("id", &ids).Error
-	if err != nil {
-		return nil, err
-	}
-	if ids == nil {
-		ids = make([]int64, 0)
-	}
-	return ids, nil
-}
-
-func (r *Repository) NextIndex(table string) int {
-	if r == nil || r.db == nil {
-		return 0
-	}
-	var modelRef interface{}
-	switch table {
-	case "node":
-		modelRef = &model.Node{}
-	case "tunnel":
-		modelRef = &model.Tunnel{}
-	case "forward":
-		modelRef = &model.Forward{}
-	default:
-		return 0
-	}
-
-	type inxRow struct {
-		Inx int
-	}
-	var row inxRow
-	err := r.db.Model(modelRef).
-		Select("inx").
-		Order("inx ASC, id ASC").
-		Limit(1).
-		Take(&row).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return 0
-	}
-	if err != nil {
-		return 0
-	}
-	return row.Inx - 1
-}
-
-// CreateRemoteNode inserts a new remote node.
-func (r *Repository) CreateRemoteNode(name, secret, serverIP, portRange string, now int64, status int, inx int, remoteURL, remoteToken, remoteConfigJSON string) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	node := model.Node{
-		Name:          name,
-		Secret:        secret,
-		ServerIP:      serverIP,
-		ServerIPV4:    sql.NullString{},
-		ServerIPV6:    sql.NullString{},
-		Port:          portRange,
-		InterfaceName: sql.NullString{},
-		Version:       sql.NullString{},
-		HTTP:          0,
-		TLS:           0,
-		Socks:         0,
-		CreatedTime:   now,
-		UpdatedTime:   sql.NullInt64{Int64: now, Valid: true},
-		Status:        status,
-		TCPListenAddr: "[::]",
-		UDPListenAddr: "[::]",
-		Inx:           inx,
-		IsRemote:      1,
-		RemoteURL:     sql.NullString{String: remoteURL, Valid: remoteURL != ""},
-		RemoteToken:   sql.NullString{String: remoteToken, Valid: remoteToken != ""},
-		RemoteConfig:  sql.NullString{String: remoteConfigJSON, Valid: remoteConfigJSON != ""},
-	}
-	return r.db.Create(&node).Error
-}

go-backend/internal/store/repo/repository_flow.go

@@ -1,244 +0,0 @@
-package repo
-
-import (
-	"errors"
-	"strings"
-
-	"gorm.io/gorm"
-
-	"go-backend/internal/store/model"
-)
-
-func (r *Repository) UpdateForwardStatus(forwardID int64, status int, now int64) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	return r.db.Model(&model.Forward{}).Where("id = ?", forwardID).Updates(map[string]interface{}{
-		"status": status, "updated_time": now,
-	}).Error
-}
-
-func (r *Repository) ListActiveForwardsByUser(userID int64) ([]model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var forwards []model.Forward
-	err := r.db.Where("user_id = ? AND status = 1", userID).Order("id ASC").Find(&forwards).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardRecord, 0, len(forwards))
-	for _, f := range forwards {
-		rows = append(rows, model.ForwardRecord{
-			ID:         f.ID,
-			UserID:     f.UserID,
-			UserName:   f.UserName,
-			Name:       f.Name,
-			TunnelID:   f.TunnelID,
-			RemoteAddr: f.RemoteAddr,
-			Strategy:   f.Strategy,
-			Status:     f.Status,
-			SpeedID:    f.SpeedID,
-		})
-	}
-	for i := range rows {
-		if strings.TrimSpace(rows[i].Strategy) == "" {
-			rows[i].Strategy = "fifo"
-		}
-	}
-	return rows, nil
-}
-
-func (r *Repository) ListActiveForwardsByUserTunnel(userID, tunnelID int64) ([]model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var forwards []model.Forward
-	err := r.db.Where("user_id = ? AND tunnel_id = ? AND status = 1", userID, tunnelID).Order("id ASC").Find(&forwards).Error
-	if err != nil {
-		return nil, err
-	}
-	rows := make([]model.ForwardRecord, 0, len(forwards))
-	for _, f := range forwards {
-		rows = append(rows, model.ForwardRecord{
-			ID:         f.ID,
-			UserID:     f.UserID,
-			UserName:   f.UserName,
-			Name:       f.Name,
-			TunnelID:   f.TunnelID,
-			RemoteAddr: f.RemoteAddr,
-			Strategy:   f.Strategy,
-			Status:     f.Status,
-			SpeedID:    f.SpeedID,
-		})
-	}
-	for i := range rows {
-		if strings.TrimSpace(rows[i].Strategy) == "" {
-			rows[i].Strategy = "fifo"
-		}
-	}
-	return rows, nil
-}
-
-func (r *Repository) GetForwardRecord(forwardID int64) (*model.ForwardRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var f model.Forward
-	err := r.db.Where("id = ?", forwardID).First(&f).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, nil
-		}
-		return nil, err
-	}
-	fr := model.ForwardRecord{
-		ID:         f.ID,
-		UserID:     f.UserID,
-		UserName:   f.UserName,
-		Name:       f.Name,
-		TunnelID:   f.TunnelID,
-		RemoteAddr: f.RemoteAddr,
-		Strategy:   f.Strategy,
-		Status:     f.Status,
-		SpeedID:    f.SpeedID,
-	}
-	if strings.TrimSpace(fr.Strategy) == "" {
-		fr.Strategy = "fifo"
-	}
-	return &fr, nil
-}
-
-func (r *Repository) GetTunnelRecord(tunnelID int64) (*model.TunnelRecord, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var t model.Tunnel
-	err := r.db.Where("id = ?", tunnelID).First(&t).Error
-	if err != nil {
-		if errors.Is(err, gorm.ErrRecordNotFound) {
-			return nil, nil
-		}
-		return nil, err
-	}
-	tr := model.TunnelRecord{
-		ID:           t.ID,
-		Type:         t.Type,
-		Status:       t.Status,
-		Flow:         t.Flow,
-		TrafficRatio: t.TrafficRatio,
-	}
-	if tr.Flow <= 0 {
-		tr.Flow = 1
-	}
-	if tr.TrafficRatio <= 0 {
-		tr.TrafficRatio = 1
-	}
-	return &tr, nil
-}
-
-func (r *Repository) TunnelExists(tunnelID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.Tunnel{}).Where("id = ?", tunnelID).Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) ForwardExists(forwardID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.Forward{}).Where("id = ?", forwardID).Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-// MapForwardIDsToTunnelIDs returns a mapping from forward.id to forward.tunnel_id.
-// Missing forward IDs are omitted from the returned map.
-func (r *Repository) MapForwardIDsToTunnelIDs(forwardIDs []int64) (map[int64]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	if len(forwardIDs) == 0 {
-		return map[int64]int64{}, nil
-	}
-
-	// Deduplicate and filter invalid IDs.
-	ids := make([]int64, 0, len(forwardIDs))
-	seen := make(map[int64]struct{}, len(forwardIDs))
-	for _, id := range forwardIDs {
-		if id <= 0 {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		ids = append(ids, id)
-	}
-	if len(ids) == 0 {
-		return map[int64]int64{}, nil
-	}
-
-	type row struct {
-		ID       int64 `gorm:"column:id"`
-		TunnelID int64 `gorm:"column:tunnel_id"`
-	}
-
-	out := make(map[int64]int64, len(ids))
-	const chunkSize = 500
-	for start := 0; start < len(ids); start += chunkSize {
-		end := start + chunkSize
-		if end > len(ids) {
-			end = len(ids)
-		}
-
-		var rows []row
-		if err := r.db.Model(&model.Forward{}).
-			Select("id", "tunnel_id").
-			Where("id IN ?", ids[start:end]).
-			Find(&rows).Error; err != nil {
-			return nil, err
-		}
-		for _, r := range rows {
-			if r.ID <= 0 || r.TunnelID <= 0 {
-				continue
-			}
-			out[r.ID] = r.TunnelID
-		}
-	}
-
-	return out, nil
-}
-
-func (r *Repository) SpeedLimitExists(id int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	var count int64
-	err := r.db.Model(&model.SpeedLimit{}).Where("id = ?", id).Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) GetSpeedLimitSpeed(id int64) (int, error) {
-	if r == nil || r.db == nil {
-		return 0, errors.New("repository not initialized")
-	}
-	var sl model.SpeedLimit
-	err := r.db.Select("speed").Where("id = ?", id).First(&sl).Error
-	if err != nil {
-		return 0, err
-	}
-	return sl.Speed, nil
-}

go-backend/internal/store/repo/repository_groups.go

@@ -1,78 +0,0 @@
-package repo
-
-import (
-	"errors"
-
-	"go-backend/internal/store/model"
-)
-
-// ─── Semantic Group Queries (replacing QueryInt64List/QueryPairs passthrough) ─
-
-// ListUserIDsByUserGroup returns all user IDs belonging to a user group.
-func (r *Repository) ListUserIDsByUserGroup(userGroupID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserGroupUser{}).
-		Where("user_group_id = ?", userGroupID).
-		Pluck("user_id", &ids).Error
-	return ids, err
-}
-
-// ListTunnelIDsByTunnelGroup returns all tunnel IDs belonging to a tunnel group.
-func (r *Repository) ListTunnelIDsByTunnelGroup(tunnelGroupID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.TunnelGroupTunnel{}).
-		Where("tunnel_group_id = ?", tunnelGroupID).
-		Pluck("tunnel_id", &ids).Error
-	return ids, err
-}
-
-// ListGroupPermissionPairsByUserGroup returns [userGroupID, tunnelGroupID] pairs
-// for all group permissions associated with a user group.
-func (r *Repository) ListGroupPermissionPairsByUserGroup(userGroupID int64) ([][2]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var perms []model.GroupPermission
-	err := r.db.Where("user_group_id = ?", userGroupID).Find(&perms).Error
-	if err != nil {
-		return nil, err
-	}
-	result := make([][2]int64, len(perms))
-	for i, p := range perms {
-		result[i] = [2]int64{p.UserGroupID, p.TunnelGroupID}
-	}
-	return result, err
-}
-
-func (r *Repository) GetUserGroupIDsByUserID(userID int64) ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.UserGroupUser{}).
-		Where("user_id = ?", userID).
-		Pluck("user_group_id", &ids).Error
-	return ids, err
-}
-
-func (r *Repository) ListGroupPermissionPairsByTunnelGroup(tunnelGroupID int64) ([][2]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var perms []model.GroupPermission
-	err := r.db.Where("tunnel_group_id = ?", tunnelGroupID).Find(&perms).Error
-	if err != nil {
-		return nil, err
-	}
-	result := make([][2]int64, len(perms))
-	for i, p := range perms {
-		result[i] = [2]int64{p.UserGroupID, p.TunnelGroupID}
-	}
-	return result, err
-}

go-backend/internal/store/repo/repository_migrate_test.go

@@ -1,412 +0,0 @@
-package repo
-
-import (
-	"database/sql"
-	"errors"
-	"strings"
-	"testing"
-
-	gsqlite "github.com/glebarez/sqlite"
-	"go-backend/internal/store/model"
-	"gorm.io/gorm"
-	"gorm.io/gorm/logger"
-)
-
-func TestPrepareSQLiteLegacyColumnsAddsNodeMetadataColumns(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`
-		CREATE TABLE node (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			secret VARCHAR(100) NOT NULL,
-			server_ip VARCHAR(100) NOT NULL,
-			port TEXT NOT NULL,
-			interface_name VARCHAR(200),
-			version VARCHAR(100),
-			http INTEGER NOT NULL DEFAULT 0,
-			tls INTEGER NOT NULL DEFAULT 0,
-			socks INTEGER NOT NULL DEFAULT 0,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER,
-			status INTEGER NOT NULL
-		)
-	`).Error; err != nil {
-		t.Fatalf("create legacy node table: %v", err)
-	}
-
-	if err := prepareSQLiteLegacyColumns(db); err != nil {
-		t.Fatalf("prepareSQLiteLegacyColumns: %v", err)
-	}
-
-	m := db.Migrator()
-	for _, field := range []string{"Remark", "ExpiryTime", "RenewalCycle"} {
-		if !m.HasColumn(&model.Node{}, field) {
-			t.Fatalf("expected node.%s column to exist", field)
-		}
-	}
-}
-
-func TestMigrateSchemaRunsPostgresIDRepairEvenAtCurrentVersion(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	called := 0
-	original := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		called++
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = original
-	})
-
-	if err := migrateSchema(db); err != nil {
-		t.Fatalf("migrateSchema: %v", err)
-	}
-	if called != 1 {
-		t.Fatalf("expected postgres id repair to run once, got %d", called)
-	}
-}
-
-func TestMigrateSchemaReturnsPostgresIDRepairError(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	wantErr := errors.New("repair failed")
-	original := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return wantErr
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = original
-	})
-
-	err = migrateSchema(db)
-	if !errors.Is(err, wantErr) {
-		t.Fatalf("expected error %v, got %v", wantErr, err)
-	}
-}
-
-func TestMigrateSchemaRunsViteConfigValueMigrationForLegacySchema(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 2).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	called := 0
-	originalMigrate := migrateViteConfigValueColumnTypeFn
-	migrateViteConfigValueColumnTypeFn = func(db *gorm.DB) error {
-		called++
-		return nil
-	}
-	t.Cleanup(func() {
-		migrateViteConfigValueColumnTypeFn = originalMigrate
-	})
-
-	if err := migrateSchema(db); err != nil {
-		t.Fatalf("migrateSchema: %v", err)
-	}
-
-	if called != 1 {
-		t.Fatalf("expected vite_config migration to run once, got %d", called)
-	}
-}
-
-func TestMigrateSchemaReturnsViteConfigMigrationError(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 2).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	wantErr := errors.New("vite config migration failed")
-	originalMigrate := migrateViteConfigValueColumnTypeFn
-	migrateViteConfigValueColumnTypeFn = func(db *gorm.DB) error {
-		return wantErr
-	}
-	t.Cleanup(func() {
-		migrateViteConfigValueColumnTypeFn = originalMigrate
-	})
-
-	err = migrateSchema(db)
-	if !errors.Is(err, wantErr) {
-		t.Fatalf("expected error %v, got %v", wantErr, err)
-	}
-}
-
-func TestMigrateSchemaClearsSpeedLimitTunnelBinding(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 3).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-	if err := db.Exec(`
-		CREATE TABLE speed_limit (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			speed INTEGER NOT NULL,
-			tunnel_id INTEGER,
-			tunnel_name VARCHAR(100),
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER,
-			status INTEGER NOT NULL
-		)
-	`).Error; err != nil {
-		t.Fatalf("create speed_limit: %v", err)
-	}
-	if err := db.Exec(`
-		INSERT INTO speed_limit(name, speed, tunnel_id, tunnel_name, created_time, updated_time, status)
-		VALUES(?, ?, ?, ?, ?, ?, ?)
-	`, "legacy-speed-limit", 100, 101, "legacy-tunnel", 1, 1, 1).Error; err != nil {
-		t.Fatalf("seed speed_limit: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	if err := migrateSchema(db); err != nil {
-		t.Fatalf("migrateSchema: %v", err)
-	}
-
-	var tunnelID sql.NullInt64
-	var tunnelName sql.NullString
-	if err := db.Raw(`SELECT tunnel_id, tunnel_name FROM speed_limit WHERE name = ?`, "legacy-speed-limit").Row().Scan(&tunnelID, &tunnelName); err != nil {
-		t.Fatalf("query speed_limit: %v", err)
-	}
-	if tunnelID.Valid {
-		t.Fatalf("expected tunnel_id cleared to NULL, got %d", tunnelID.Int64)
-	}
-	if tunnelName.Valid {
-		t.Fatalf("expected tunnel_name cleared to NULL, got %q", tunnelName.String)
-	}
-
-	var schemaVersion int
-	if err := db.Raw(`SELECT version FROM schema_version LIMIT 1`).Row().Scan(&schemaVersion); err != nil {
-		t.Fatalf("query schema_version: %v", err)
-	}
-	if schemaVersion != currentSchemaVersion {
-		t.Fatalf("expected schema version %d, got %d", currentSchemaVersion, schemaVersion)
-	}
-}
-
-func TestMigrateSchemaRunsTrafficInt64MigrationForLegacySchema(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 4).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	called := 0
-	originalMigrate := migratePostgresTrafficInt64ColumnsFn
-	migratePostgresTrafficInt64ColumnsFn = func(db *gorm.DB) error {
-		called++
-		return nil
-	}
-	t.Cleanup(func() {
-		migratePostgresTrafficInt64ColumnsFn = originalMigrate
-	})
-
-	if err := migrateSchema(db); err != nil {
-		t.Fatalf("migrateSchema: %v", err)
-	}
-
-	if called != 1 {
-		t.Fatalf("expected traffic bigint migration to run once, got %d", called)
-	}
-
-	var schemaVersion int
-	if err := db.Raw(`SELECT version FROM schema_version LIMIT 1`).Row().Scan(&schemaVersion); err != nil {
-		t.Fatalf("query schema_version: %v", err)
-	}
-	if schemaVersion != currentSchemaVersion {
-		t.Fatalf("expected schema version %d, got %d", currentSchemaVersion, schemaVersion)
-	}
-}
-
-func TestMigrateSchemaReturnsTrafficInt64MigrationError(t *testing.T) {
-	db, err := gorm.Open(gsqlite.Open(":memory:"), &gorm.Config{
-		Logger: logger.Default.LogMode(logger.Silent),
-	})
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		sqlDB, _ := db.DB()
-		if sqlDB != nil {
-			_ = sqlDB.Close()
-		}
-	})
-
-	if err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`).Error; err != nil {
-		t.Fatalf("create schema_version: %v", err)
-	}
-	if err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, 4).Error; err != nil {
-		t.Fatalf("seed schema_version: %v", err)
-	}
-
-	originalIDRepair := ensurePostgresIDDefaultsFn
-	ensurePostgresIDDefaultsFn = func(db *gorm.DB) error {
-		return nil
-	}
-	t.Cleanup(func() {
-		ensurePostgresIDDefaultsFn = originalIDRepair
-	})
-
-	wantErr := errors.New("traffic bigint migration failed")
-	originalMigrate := migratePostgresTrafficInt64ColumnsFn
-	migratePostgresTrafficInt64ColumnsFn = func(db *gorm.DB) error {
-		return wantErr
-	}
-	t.Cleanup(func() {
-		migratePostgresTrafficInt64ColumnsFn = originalMigrate
-	})
-
-	err = migrateSchema(db)
-	if !errors.Is(err, wantErr) {
-		t.Fatalf("expected error %v, got %v", wantErr, err)
-	}
-}
-
-func TestAlterPostgresColumnToBigIntIfNeededValidatesNames(t *testing.T) {
-	if err := alterPostgresColumnToBigIntIfNeeded(nil, "peer_share", "max_bandwidth"); err == nil || !strings.Contains(err.Error(), "nil db") {
-		t.Fatalf("expected nil db error, got %v", err)
-	}
-	if err := alterPostgresColumnToBigIntIfNeeded(&gorm.DB{}, "", "max_bandwidth"); err == nil || !strings.Contains(err.Error(), "empty table or column name") {
-		t.Fatalf("expected empty name error, got %v", err)
-	}
-	if err := alterPostgresColumnToBigIntIfNeeded(&gorm.DB{}, "peer_share", ""); err == nil || !strings.Contains(err.Error(), "empty table or column name") {
-		t.Fatalf("expected empty name error, got %v", err)
-	}
-}

go-backend/internal/store/repo/repository_monitor_nodes.go

@@ -1,19 +0,0 @@
-package repo
-
-import (
-	"errors"
-
-	"go-backend/internal/store/model"
-)
-
-func (r *Repository) ListMonitorNodes() ([]model.Node, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var nodes []model.Node
-	err := r.db.Select("id", "inx", "name", "status", "updated_time").
-		Where("is_remote = ?", 0).
-		Order("inx ASC, id ASC").
-		Find(&nodes).Error
-	return nodes, err
-}

go-backend/internal/store/repo/repository_monitor_permission.go

@@ -1,54 +0,0 @@
-package repo
-
-import (
-	"errors"
-
-	"go-backend/internal/store/model"
-
-	"gorm.io/gorm/clause"
-)
-
-func (r *Repository) InsertMonitorPermission(userID int64, now int64) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	if userID <= 0 {
-		return nil
-	}
-	row := model.MonitorPermission{UserID: userID, CreatedTime: now}
-	return r.db.Clauses(clause.OnConflict{DoNothing: true}).Create(&row).Error
-}
-
-func (r *Repository) DeleteMonitorPermission(userID int64) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	if userID <= 0 {
-		return nil
-	}
-	return r.db.Where("user_id = ?", userID).Delete(&model.MonitorPermission{}).Error
-}
-
-func (r *Repository) HasMonitorPermission(userID int64) (bool, error) {
-	if r == nil || r.db == nil {
-		return false, errors.New("repository not initialized")
-	}
-	if userID <= 0 {
-		return false, nil
-	}
-	var count int64
-	err := r.db.Model(&model.MonitorPermission{}).Where("user_id = ?", userID).Count(&count).Error
-	if err != nil {
-		return false, err
-	}
-	return count > 0, nil
-}
-
-func (r *Repository) ListMonitorPermissions() ([]model.MonitorPermission, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var items []model.MonitorPermission
-	err := r.db.Order("id ASC").Find(&items).Error
-	return items, err
-}

go-backend/internal/store/repo/repository_monitor_tunnels.go

@@ -1,18 +0,0 @@
-package repo
-
-import (
-	"errors"
-
-	"go-backend/internal/store/model"
-)
-
-func (r *Repository) ListMonitorTunnels() ([]model.Tunnel, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var tunnels []model.Tunnel
-	err := r.db.Select("id", "inx", "name", "status", "updated_time").
-		Order("inx ASC, id ASC").
-		Find(&tunnels).Error
-	return tunnels, err
-}

go-backend/internal/store/repo/repository_monitoring_test.go

@@ -1,134 +0,0 @@
-package repo
-
-import (
-	"sync"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/model"
-)
-
-func TestGetTunnelMetricsAggregatedSumsAcrossNodes(t *testing.T) {
-	r, err := Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	ts := time.Now().UnixMilli()
-
-	if err := r.InsertTunnelMetric(&model.TunnelMetric{
-		TunnelID:  1,
-		NodeID:    1,
-		Timestamp: ts,
-		BytesIn:   100,
-		BytesOut:  200,
-	}); err != nil {
-		t.Fatalf("insert tunnel metric n1: %v", err)
-	}
-	if err := r.InsertTunnelMetric(&model.TunnelMetric{
-		TunnelID:  1,
-		NodeID:    2,
-		Timestamp: ts,
-		BytesIn:   300,
-		BytesOut:  400,
-	}); err != nil {
-		t.Fatalf("insert tunnel metric n2: %v", err)
-	}
-
-	metrics, err := r.GetTunnelMetricsAggregated(1, ts-1000, ts+1000)
-	if err != nil {
-		t.Fatalf("get aggregated tunnel metrics: %v", err)
-	}
-	if len(metrics) != 1 {
-		t.Fatalf("expected 1 aggregated point, got %d", len(metrics))
-	}
-	if metrics[0].Timestamp != ts {
-		t.Fatalf("expected timestamp %d, got %d", ts, metrics[0].Timestamp)
-	}
-	if metrics[0].BytesIn != 400 {
-		t.Fatalf("expected bytesIn 400, got %d", metrics[0].BytesIn)
-	}
-	if metrics[0].BytesOut != 600 {
-		t.Fatalf("expected bytesOut 600, got %d", metrics[0].BytesOut)
-	}
-}
-
-func TestUpsertTunnelMetricBucketsAggregatesDuplicateKeysInBatch(t *testing.T) {
-	r, err := Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	ts := time.Now().UnixMilli()
-
-	items := []*model.TunnelMetric{
-		{TunnelID: 1, NodeID: 1, Timestamp: ts, BytesIn: 10, BytesOut: 20},
-		{TunnelID: 1, NodeID: 1, Timestamp: ts, BytesIn: 30, BytesOut: 40},
-	}
-	if err := r.UpsertTunnelMetricBuckets(items); err != nil {
-		t.Fatalf("upsert buckets: %v", err)
-	}
-
-	rows, err := r.GetTunnelMetrics(1, ts-1000, ts+1000)
-	if err != nil {
-		t.Fatalf("get tunnel metrics: %v", err)
-	}
-	if len(rows) != 1 {
-		t.Fatalf("expected 1 stored row, got %d", len(rows))
-	}
-	if rows[0].BytesIn != 40 {
-		t.Fatalf("expected bytesIn 40, got %d", rows[0].BytesIn)
-	}
-	if rows[0].BytesOut != 60 {
-		t.Fatalf("expected bytesOut 60, got %d", rows[0].BytesOut)
-	}
-}
-
-func TestUpsertTunnelMetricBucketsIsSafeUnderConcurrency(t *testing.T) {
-	r, err := Open(":memory:")
-	if err != nil {
-		t.Fatalf("open repo: %v", err)
-	}
-	defer r.Close()
-
-	ts := time.Now().UnixMilli()
-
-	const workers = 20
-	const perWorkerIn = int64(5)
-	const perWorkerOut = int64(7)
-
-	var wg sync.WaitGroup
-	wg.Add(workers)
-	for i := 0; i < workers; i++ {
-		go func() {
-			defer wg.Done()
-			_ = r.UpsertTunnelMetricBuckets([]*model.TunnelMetric{{
-				TunnelID:  1,
-				NodeID:    1,
-				Timestamp: ts,
-				BytesIn:   perWorkerIn,
-				BytesOut:  perWorkerOut,
-			}})
-		}()
-	}
-	wg.Wait()
-
-	rows, err := r.GetTunnelMetrics(1, ts-1000, ts+1000)
-	if err != nil {
-		t.Fatalf("get tunnel metrics: %v", err)
-	}
-	if len(rows) != 1 {
-		t.Fatalf("expected 1 stored row, got %d", len(rows))
-	}
-
-	wantIn := int64(workers) * perWorkerIn
-	wantOut := int64(workers) * perWorkerOut
-	if rows[0].BytesIn != wantIn {
-		t.Fatalf("expected bytesIn %d, got %d", wantIn, rows[0].BytesIn)
-	}
-	if rows[0].BytesOut != wantOut {
-		t.Fatalf("expected bytesOut %d, got %d", wantOut, rows[0].BytesOut)
-	}
-}

go-backend/internal/store/repo/repository_tunnel_quality.go

@@ -1,98 +0,0 @@
-package repo
-
-import (
-	"errors"
-
-	"go-backend/internal/store/model"
-)
-
-// InsertTunnelQuality appends a tunnel quality probe result.
-// (Follows the same pattern as InsertServiceMonitorResult.)
-func (r *Repository) InsertTunnelQuality(q *model.TunnelQuality) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	if q == nil || q.TunnelID <= 0 {
-		return nil
-	}
-	return r.db.Create(q).Error
-}
-
-// GetTunnelQualityHistory returns quality probe results for a tunnel
-// within a time range, ordered by timestamp ascending.
-// (Mirrors GetServiceMonitorResults pattern.)
-func (r *Repository) GetTunnelQualityHistory(tunnelID int64, startMs, endMs int64) ([]model.TunnelQuality, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var results []model.TunnelQuality
-	err := r.db.Where("tunnel_id = ? AND timestamp >= ? AND timestamp <= ?", tunnelID, startMs, endMs).
-		Order("timestamp ASC").
-		Find(&results).Error
-	return results, err
-}
-
-// GetLatestTunnelQualities returns the newest quality result per tunnel_id.
-// (Mirrors GetLatestServiceMonitorResults pattern.)
-func (r *Repository) GetLatestTunnelQualities() ([]model.TunnelQuality, error) {
-	if r == nil || r.db == nil {
-		return nil, nil
-	}
-
-	var results []model.TunnelQuality
-
-	// Use window function (works on modern SQLite 3.25+ and PostgreSQL).
-	q := `
-		SELECT id, tunnel_id, entry_to_exit_latency, exit_to_bing_latency,
-		       entry_to_exit_loss, exit_to_bing_loss, success, error_message, timestamp
-		FROM (
-			SELECT *, ROW_NUMBER() OVER (PARTITION BY tunnel_id ORDER BY timestamp DESC, id DESC) AS rn
-			FROM tunnel_quality
-		) t
-		WHERE rn = 1
-		ORDER BY tunnel_id ASC
-	`
-	if err := r.db.Raw(q).Scan(&results).Error; err == nil {
-		return results, nil
-	}
-
-	// Fallback for older SQLite
-	results = nil
-	err := r.db.Order("timestamp DESC, id DESC").Limit(5000).Find(&results).Error
-	if err != nil {
-		return nil, err
-	}
-
-	seen := make(map[int64]struct{}, len(results))
-	out := make([]model.TunnelQuality, 0, len(results))
-	for _, row := range results {
-		if row.TunnelID <= 0 {
-			continue
-		}
-		if _, ok := seen[row.TunnelID]; ok {
-			continue
-		}
-		seen[row.TunnelID] = struct{}{}
-		out = append(out, row)
-	}
-	return out, nil
-}
-
-// PruneTunnelQualityResults deletes quality results older than the given timestamp.
-// (Mirrors PruneServiceMonitorResults pattern.)
-func (r *Repository) PruneTunnelQualityResults(olderThanMs int64) error {
-	if r == nil || r.db == nil {
-		return nil
-	}
-	return r.db.Where("timestamp < ?", olderThanMs).Delete(&model.TunnelQuality{}).Error
-}
-
-// ListEnabledTunnelIDs returns IDs of all tunnels with status=1.
-func (r *Repository) ListEnabledTunnelIDs() ([]int64, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var ids []int64
-	err := r.db.Model(&model.Tunnel{}).Where("status = ?", 1).Pluck("id", &ids).Error
-	return ids, err
-}

go-backend/internal/store/repo/repository_user_quota.go

@@ -1,378 +0,0 @@
-package repo
-
-import (
-	"errors"
-	"fmt"
-	"strconv"
-	"strings"
-	"time"
-
-	"go-backend/internal/store/model"
-
-	"gorm.io/gorm"
-	"gorm.io/gorm/clause"
-)
-
-const userQuotaBytesPerGB int64 = 1024 * 1024 * 1024
-
-type UserQuotaRelease struct {
-	UserID      int64
-	ForwardIDs  []int64
-	UnblockUser bool
-}
-
-func userQuotaWindowKeys(now time.Time) (int64, int64) {
-	return int64(now.Year()*10000 + int(now.Month())*100 + now.Day()), int64(now.Year()*100 + int(now.Month()))
-}
-
-func cloneUserQuotaView(q model.UserQuota) *model.UserQuotaView {
-	return &model.UserQuotaView{
-		UserID:           q.UserID,
-		DailyLimitGB:     q.DailyLimitGB,
-		MonthlyLimitGB:   q.MonthlyLimitGB,
-		DailyUsedBytes:   q.DailyUsedBytes,
-		MonthlyUsedBytes: q.MonthlyUsedBytes,
-		DayKey:           q.DayKey,
-		MonthKey:         q.MonthKey,
-		DisabledByQuota:  q.DisabledByQuota,
-		DisabledAt:       q.DisabledAt,
-		PausedForwardIDs: q.PausedForwardIDs,
-	}
-}
-
-func normalizeUserQuotaView(view *model.UserQuotaView, now time.Time) *model.UserQuotaView {
-	if view == nil {
-		return nil
-	}
-	dayKey, monthKey := userQuotaWindowKeys(now)
-	out := *view
-	if out.DayKey != dayKey {
-		out.DayKey = dayKey
-		out.DailyUsedBytes = 0
-	}
-	if out.MonthKey != monthKey {
-		out.MonthKey = monthKey
-		out.MonthlyUsedBytes = 0
-	}
-	return &out
-}
-
-func userQuotaExceeded(view *model.UserQuotaView) bool {
-	if view == nil {
-		return false
-	}
-	if view.DailyLimitGB > 0 && view.DailyUsedBytes >= view.DailyLimitGB*userQuotaBytesPerGB {
-		return true
-	}
-	if view.MonthlyLimitGB > 0 && view.MonthlyUsedBytes >= view.MonthlyLimitGB*userQuotaBytesPerGB {
-		return true
-	}
-	return false
-}
-
-func parsePausedForwardIDs(raw string) []int64 {
-	parts := strings.Split(strings.TrimSpace(raw), ",")
-	out := make([]int64, 0, len(parts))
-	seen := make(map[int64]struct{}, len(parts))
-	for _, part := range parts {
-		id, err := strconv.ParseInt(strings.TrimSpace(part), 10, 64)
-		if err != nil || id <= 0 {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		out = append(out, id)
-	}
-	return out
-}
-
-func joinPausedForwardIDs(ids []int64) string {
-	if len(ids) == 0 {
-		return ""
-	}
-	parts := make([]string, 0, len(ids))
-	seen := make(map[int64]struct{}, len(ids))
-	for _, id := range ids {
-		if id <= 0 {
-			continue
-		}
-		if _, ok := seen[id]; ok {
-			continue
-		}
-		seen[id] = struct{}{}
-		parts = append(parts, strconv.FormatInt(id, 10))
-	}
-	return strings.Join(parts, ",")
-}
-
-func (r *Repository) loadOrCreateUserQuotaTx(tx *gorm.DB, userID int64, now time.Time) (*model.UserQuota, error) {
-	if tx == nil {
-		return nil, errors.New("database unavailable")
-	}
-	dayKey, monthKey := userQuotaWindowKeys(now)
-	q := &model.UserQuota{}
-	err := tx.Clauses(clause.Locking{Strength: "UPDATE"}).Where("user_id = ?", userID).First(q).Error
-	if err == nil {
-		return q, nil
-	}
-	if !errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, err
-	}
-	nowMs := now.UnixMilli()
-	q = &model.UserQuota{
-		UserID:           userID,
-		DayKey:           dayKey,
-		MonthKey:         monthKey,
-		CreatedTime:      nowMs,
-		UpdatedTime:      nowMs,
-		PausedForwardIDs: "",
-	}
-	if err := tx.Create(q).Error; err != nil {
-		return nil, err
-	}
-	return q, nil
-}
-
-func applyUserQuotaWindowRoll(q *model.UserQuota, now time.Time) bool {
-	if q == nil {
-		return false
-	}
-	changed := false
-	dayKey, monthKey := userQuotaWindowKeys(now)
-	if q.DayKey != dayKey {
-		q.DayKey = dayKey
-		q.DailyUsedBytes = 0
-		changed = true
-	}
-	if q.MonthKey != monthKey {
-		q.MonthKey = monthKey
-		q.MonthlyUsedBytes = 0
-		changed = true
-	}
-	return changed
-}
-
-func (r *Repository) SaveUserQuotaConfigTx(tx *gorm.DB, userID, dailyLimitGB, monthlyLimitGB int64, now int64) error {
-	if tx == nil {
-		return errors.New("database unavailable")
-	}
-	if userID <= 0 {
-		return errors.New("user id is required")
-	}
-	if dailyLimitGB < 0 || monthlyLimitGB < 0 {
-		return errors.New("quota limit cannot be negative")
-	}
-	current := time.UnixMilli(now)
-	q, err := r.loadOrCreateUserQuotaTx(tx, userID, current)
-	if err != nil {
-		return err
-	}
-	updates := map[string]interface{}{
-		"daily_limit_gb":   dailyLimitGB,
-		"monthly_limit_gb": monthlyLimitGB,
-		"updated_time":     now,
-	}
-	if q.DayKey == 0 || q.MonthKey == 0 {
-		dayKey, monthKey := userQuotaWindowKeys(current)
-		updates["day_key"] = dayKey
-		updates["month_key"] = monthKey
-	}
-	return tx.Model(&model.UserQuota{}).Where("user_id = ?", userID).Updates(updates).Error
-}
-
-func (r *Repository) ListUserQuotaViewsByUserIDs(userIDs []int64, now time.Time) (map[int64]*model.UserQuotaView, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	out := make(map[int64]*model.UserQuotaView)
-	if len(userIDs) == 0 {
-		return out, nil
-	}
-	var rows []model.UserQuota
-	if err := r.db.Where("user_id IN ?", userIDs).Find(&rows).Error; err != nil {
-		return nil, err
-	}
-	for _, row := range rows {
-		out[row.UserID] = normalizeUserQuotaView(cloneUserQuotaView(row), now)
-	}
-	return out, nil
-}
-
-func (r *Repository) GetUserQuotaView(userID int64, now time.Time) (*model.UserQuotaView, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	if userID <= 0 {
-		return nil, nil
-	}
-	var row model.UserQuota
-	err := r.db.Where("user_id = ?", userID).First(&row).Error
-	if errors.Is(err, gorm.ErrRecordNotFound) {
-		return nil, nil
-	}
-	if err != nil {
-		return nil, err
-	}
-	return normalizeUserQuotaView(cloneUserQuotaView(row), now), nil
-}
-
-func (r *Repository) AddUserQuotaUsage(userID int64, usedBytes int64, now time.Time) (*model.UserQuotaView, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	if userID <= 0 {
-		return nil, nil
-	}
-	result := &model.UserQuotaView{}
-	err := r.db.Transaction(func(tx *gorm.DB) error {
-		q, err := r.loadOrCreateUserQuotaTx(tx, userID, now)
-		if err != nil {
-			return err
-		}
-		applyUserQuotaWindowRoll(q, now)
-		if usedBytes > 0 {
-			q.DailyUsedBytes += usedBytes
-			q.MonthlyUsedBytes += usedBytes
-		}
-		q.UpdatedTime = now.UnixMilli()
-		if err := tx.Model(&model.UserQuota{}).Where("user_id = ?", userID).Updates(map[string]interface{}{
-			"daily_used_bytes":   q.DailyUsedBytes,
-			"monthly_used_bytes": q.MonthlyUsedBytes,
-			"day_key":            q.DayKey,
-			"month_key":          q.MonthKey,
-			"updated_time":       q.UpdatedTime,
-		}).Error; err != nil {
-			return err
-		}
-		*result = *cloneUserQuotaView(*q)
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	return normalizeUserQuotaView(result, now), nil
-}
-
-func (r *Repository) MarkUserQuotaDisabled(userID int64, pausedForwardIDs []int64, now int64) error {
-	if r == nil || r.db == nil {
-		return errors.New("repository not initialized")
-	}
-	if userID <= 0 {
-		return errors.New("user id is required")
-	}
-	return r.db.Model(&model.UserQuota{}).Where("user_id = ?", userID).Updates(map[string]interface{}{
-		"disabled_by_quota":  1,
-		"disabled_at":        now,
-		"paused_forward_ids": joinPausedForwardIDs(pausedForwardIDs),
-		"updated_time":       now,
-	}).Error
-}
-
-func (r *Repository) ResetUserQuotaUsage(userID int64, scope string, now time.Time) (*UserQuotaRelease, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	if userID <= 0 {
-		return nil, errors.New("user id is required")
-	}
-	scope = strings.TrimSpace(strings.ToLower(scope))
-	if scope == "" {
-		scope = "all"
-	}
-	if scope != "daily" && scope != "monthly" && scope != "all" {
-		return nil, fmt.Errorf("unsupported quota reset scope: %s", scope)
-	}
-	var release *UserQuotaRelease
-	err := r.db.Transaction(func(tx *gorm.DB) error {
-		q, err := r.loadOrCreateUserQuotaTx(tx, userID, now)
-		if err != nil {
-			return err
-		}
-		applyUserQuotaWindowRoll(q, now)
-		switch scope {
-		case "daily":
-			q.DailyUsedBytes = 0
-		case "monthly":
-			q.MonthlyUsedBytes = 0
-		case "all":
-			q.DailyUsedBytes = 0
-			q.MonthlyUsedBytes = 0
-		}
-		q.UpdatedTime = now.UnixMilli()
-		release = &UserQuotaRelease{UserID: userID}
-		if q.DisabledByQuota == 1 && !userQuotaExceeded(cloneUserQuotaView(*q)) {
-			release.UnblockUser = true
-			release.ForwardIDs = parsePausedForwardIDs(q.PausedForwardIDs)
-			q.DisabledByQuota = 0
-			q.DisabledAt = 0
-			q.PausedForwardIDs = ""
-		}
-		return tx.Model(&model.UserQuota{}).Where("user_id = ?", userID).Updates(map[string]interface{}{
-			"daily_used_bytes":   q.DailyUsedBytes,
-			"monthly_used_bytes": q.MonthlyUsedBytes,
-			"day_key":            q.DayKey,
-			"month_key":          q.MonthKey,
-			"disabled_by_quota":  q.DisabledByQuota,
-			"disabled_at":        q.DisabledAt,
-			"paused_forward_ids": q.PausedForwardIDs,
-			"updated_time":       q.UpdatedTime,
-		}).Error
-	})
-	if err != nil {
-		return nil, err
-	}
-	return release, nil
-}
-
-func (r *Repository) RollUserQuotaWindows(now time.Time) ([]UserQuotaRelease, error) {
-	if r == nil || r.db == nil {
-		return nil, errors.New("repository not initialized")
-	}
-	var releases []UserQuotaRelease
-	err := r.db.Transaction(func(tx *gorm.DB) error {
-		var rows []model.UserQuota
-		if err := tx.Find(&rows).Error; err != nil {
-			return err
-		}
-		nowMs := now.UnixMilli()
-		for _, row := range rows {
-			q := row
-			changed := applyUserQuotaWindowRoll(&q, now)
-			release := UserQuotaRelease{UserID: q.UserID}
-			if q.DisabledByQuota == 1 && !userQuotaExceeded(cloneUserQuotaView(q)) {
-				release.UnblockUser = true
-				release.ForwardIDs = parsePausedForwardIDs(q.PausedForwardIDs)
-				q.DisabledByQuota = 0
-				q.DisabledAt = 0
-				q.PausedForwardIDs = ""
-				changed = true
-			}
-			if !changed {
-				continue
-			}
-			q.UpdatedTime = nowMs
-			if err := tx.Model(&model.UserQuota{}).Where("user_id = ?", q.UserID).Updates(map[string]interface{}{
-				"daily_used_bytes":   q.DailyUsedBytes,
-				"monthly_used_bytes": q.MonthlyUsedBytes,
-				"day_key":            q.DayKey,
-				"month_key":          q.MonthKey,
-				"disabled_by_quota":  q.DisabledByQuota,
-				"disabled_at":        q.DisabledAt,
-				"paused_forward_ids": q.PausedForwardIDs,
-				"updated_time":       q.UpdatedTime,
-			}).Error; err != nil {
-				return err
-			}
-			if release.UnblockUser {
-				releases = append(releases, release)
-			}
-		}
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	return releases, nil
-}

go-backend/internal/store/sqlite/repository_migrate_test.go

@@ -0,0 +1,78 @@
+package sqlite
+
+import (
+	"database/sql"
+	"errors"
+	"testing"
+
+	"go-backend/internal/store"
+
+	_ "modernc.org/sqlite"
+)
+
+func TestMigrateSchemaRunsPostgresIDRepairEvenAtCurrentVersion(t *testing.T) {
+	raw, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = raw.Close()
+	})
+
+	db := store.Wrap(raw, store.DialectPostgres)
+	if _, err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`); err != nil {
+		t.Fatalf("create schema_version: %v", err)
+	}
+	if _, err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion); err != nil {
+		t.Fatalf("seed schema_version: %v", err)
+	}
+
+	called := 0
+	original := ensurePostgresIDDefaultsFn
+	ensurePostgresIDDefaultsFn = func(db *store.DB) error {
+		called++
+		return nil
+	}
+	t.Cleanup(func() {
+		ensurePostgresIDDefaultsFn = original
+	})
+
+	if err := migrateSchema(db); err != nil {
+		t.Fatalf("migrateSchema: %v", err)
+	}
+	if called != 1 {
+		t.Fatalf("expected postgres id repair to run once, got %d", called)
+	}
+}
+
+func TestMigrateSchemaReturnsPostgresIDRepairError(t *testing.T) {
+	raw, err := sql.Open("sqlite", ":memory:")
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = raw.Close()
+	})
+
+	db := store.Wrap(raw, store.DialectPostgres)
+	if _, err := db.Exec(`CREATE TABLE schema_version (version INTEGER NOT NULL DEFAULT 0)`); err != nil {
+		t.Fatalf("create schema_version: %v", err)
+	}
+	if _, err := db.Exec(`INSERT INTO schema_version(version) VALUES(?)`, currentSchemaVersion); err != nil {
+		t.Fatalf("seed schema_version: %v", err)
+	}
+
+	wantErr := errors.New("repair failed")
+	original := ensurePostgresIDDefaultsFn
+	ensurePostgresIDDefaultsFn = func(db *store.DB) error {
+		return wantErr
+	}
+	t.Cleanup(func() {
+		ensurePostgresIDDefaultsFn = original
+	})
+
+	err = migrateSchema(db)
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("expected error %v, got %v", wantErr, err)
+	}
+}

go-backend/internal/store/sqlite/sql/data.sql

@@ -0,0 +1,5 @@
+INSERT OR IGNORE INTO user (id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
+VALUES (1, 'admin_user', '3c85cdebade1c51cf64ca9f3c09d182d', 0, 2727251700000, 99999, 0, 0, 1, 99999, 1748914865000, 1754011744252, 1);
+
+INSERT OR IGNORE INTO vite_config (id, name, value, time)
+VALUES (1, 'app_name', 'flux', 1755147963000);

go-backend/internal/store/sqlite/sql/schema.sql

@@ -0,0 +1,246 @@
+-- SQLite Auto-generated schema
+-- This will be executed automatically on startup if tables don't exist
+
+CREATE TABLE IF NOT EXISTS forward (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  user_name VARCHAR(100) NOT NULL,
+  name VARCHAR(100) NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  remote_addr TEXT NOT NULL,
+  strategy VARCHAR(100) NOT NULL DEFAULT 'fifo',
+  in_flow INTEGER NOT NULL DEFAULT 0,
+  out_flow INTEGER NOT NULL DEFAULT 0,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL,
+  inx INTEGER NOT NULL DEFAULT 0
+);
+
+CREATE TABLE IF NOT EXISTS forward_port (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  forward_id INTEGER NOT NULL,
+  node_id INTEGER NOT NULL,
+  port INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS node (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  secret VARCHAR(100) NOT NULL,
+  server_ip VARCHAR(100) NOT NULL,
+  server_ip_v4 VARCHAR(100),
+  server_ip_v6 VARCHAR(100),
+  port TEXT NOT NULL,
+  interface_name VARCHAR(200),
+  version VARCHAR(100),
+  http INTEGER NOT NULL DEFAULT 0,
+  tls INTEGER NOT NULL DEFAULT 0,
+  socks INTEGER NOT NULL DEFAULT 0,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER,
+  status INTEGER NOT NULL,
+  tcp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  udp_listen_addr VARCHAR(100) NOT NULL DEFAULT '[::]',
+  inx INTEGER NOT NULL DEFAULT 0,
+  is_remote INTEGER DEFAULT 0,
+  remote_url TEXT,
+  remote_token TEXT,
+  remote_config TEXT
+);
+
+CREATE TABLE IF NOT EXISTS speed_limit (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  speed INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  tunnel_name VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS statistics_flow (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  flow INTEGER NOT NULL,
+  total_flow INTEGER NOT NULL,
+  time VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  traffic_ratio REAL NOT NULL DEFAULT 1.0,
+  type INTEGER NOT NULL,
+  protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
+  flow INTEGER NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL,
+  in_ip TEXT,
+  inx INTEGER NOT NULL DEFAULT 0,
+  ip_preference VARCHAR(10) NOT NULL DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS chain_tunnel (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    tunnel_id INTEGER NOT NULL ,
+    chain_type VARCHAR(10) NOT NULL,
+    node_id INTEGER NOT NULL ,
+    port INTEGER,
+    strategy VARCHAR(10),
+    inx  INTEGER,
+    protocol  VARCHAR(10)
+);
+
+
+CREATE TABLE IF NOT EXISTS user (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user VARCHAR(100) NOT NULL,
+  pwd VARCHAR(100) NOT NULL,
+  role_id INTEGER NOT NULL,
+  exp_time INTEGER NOT NULL,
+  flow INTEGER NOT NULL,
+  in_flow INTEGER NOT NULL DEFAULT 0,
+  out_flow INTEGER NOT NULL DEFAULT 0,
+  flow_reset_time INTEGER NOT NULL,
+  num INTEGER NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_tunnel (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  speed_id INTEGER,
+  num INTEGER NOT NULL,
+  flow INTEGER NOT NULL,
+  in_flow INTEGER NOT NULL DEFAULT 0,
+  out_flow INTEGER NOT NULL DEFAULT 0,
+  flow_reset_time INTEGER NOT NULL,
+  exp_time INTEGER NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(100) NOT NULL,
+  created_time INTEGER NOT NULL,
+  updated_time INTEGER NOT NULL,
+  status INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS tunnel_group_tunnel (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  tunnel_group_id INTEGER NOT NULL,
+  tunnel_id INTEGER NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS user_group_user (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_group_id INTEGER NOT NULL,
+  user_id INTEGER NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  created_time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS group_permission_grant (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  user_group_id INTEGER NOT NULL,
+  tunnel_group_id INTEGER NOT NULL,
+  user_tunnel_id INTEGER NOT NULL,
+  created_by_group INTEGER NOT NULL DEFAULT 0,
+  created_time INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_name ON tunnel_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_name ON user_group(name);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_tunnel_group_tunnel_unique ON tunnel_group_tunnel(tunnel_group_id, tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_group_user_unique ON user_group_user(user_group_id, user_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_unique ON group_permission(user_group_id, tunnel_group_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_group_permission_grant_unique ON group_permission_grant(user_group_id, tunnel_group_id, user_tunnel_id);
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_tunnel_unique ON user_tunnel(user_id, tunnel_id);
+
+CREATE TABLE IF NOT EXISTS vite_config (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  name VARCHAR(200) NOT NULL UNIQUE,
+  value VARCHAR(200) NOT NULL,
+  time INTEGER NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS peer_share (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    name TEXT NOT NULL,
+    node_id INTEGER NOT NULL,
+    token TEXT NOT NULL UNIQUE,
+    max_bandwidth INTEGER DEFAULT 0,
+    expiry_time INTEGER DEFAULT 0,
+    port_range_start INTEGER DEFAULT 0,
+    port_range_end INTEGER DEFAULT 0,
+    current_flow INTEGER DEFAULT 0,
+    is_active INTEGER DEFAULT 1,
+    created_time INTEGER NOT NULL,
+    updated_time INTEGER NOT NULL,
+    allowed_domains TEXT DEFAULT '',
+    allowed_ips TEXT DEFAULT ''
+);
+
+CREATE TABLE IF NOT EXISTS peer_share_runtime (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    share_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    reservation_id TEXT NOT NULL UNIQUE,
+    resource_key TEXT NOT NULL UNIQUE,
+    binding_id TEXT NOT NULL DEFAULT '',
+    role TEXT NOT NULL DEFAULT '',
+    chain_name TEXT NOT NULL DEFAULT '',
+    service_name TEXT NOT NULL DEFAULT '',
+    protocol TEXT NOT NULL DEFAULT 'tls',
+    strategy TEXT NOT NULL DEFAULT 'round',
+    port INTEGER NOT NULL DEFAULT 0,
+    target TEXT NOT NULL DEFAULT '',
+    applied INTEGER NOT NULL DEFAULT 0,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time INTEGER NOT NULL,
+    updated_time INTEGER NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_share_node_status ON peer_share_runtime(share_id, node_id, status);
+CREATE INDEX IF NOT EXISTS idx_peer_share_runtime_binding_id ON peer_share_runtime(binding_id);
+
+CREATE TABLE IF NOT EXISTS federation_tunnel_binding (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    tunnel_id INTEGER NOT NULL,
+    node_id INTEGER NOT NULL,
+    chain_type INTEGER NOT NULL,
+    hop_inx INTEGER NOT NULL DEFAULT 0,
+    remote_url TEXT NOT NULL,
+    resource_key TEXT NOT NULL UNIQUE,
+    remote_binding_id TEXT NOT NULL,
+    allocated_port INTEGER NOT NULL,
+    status INTEGER NOT NULL DEFAULT 1,
+    created_time INTEGER NOT NULL,
+    updated_time INTEGER NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS idx_federation_tunnel_binding_unique ON federation_tunnel_binding(tunnel_id, node_id, chain_type, hop_inx);
+CREATE INDEX IF NOT EXISTS idx_federation_tunnel_binding_tunnel ON federation_tunnel_binding(tunnel_id, status);

go-backend/internal/ws/server.go

@@ -15,7 +15,7 @@ import (
 
 	"go-backend/internal/auth"
 	"go-backend/internal/security"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 type encryptedMessage struct {
@@ -39,7 +39,6 @@ type nodeSession struct {
 	nodeID int64
 	secret string
 	conn   *connWrap
-	crypto *security.AESCrypto // 缓存的 AES 加密器，避免每条消息重建
 }
 
 type commandResponse struct {
@@ -69,11 +68,9 @@ type CommandResult struct {
 }
 
 type Server struct {
-	repo         *repo.Repository
-	jwtSecret    string
-	upgrader     websocket.Upgrader
-	onNodeOnline func(nodeID int64)
-	onNodeMetric func(nodeID int64, info SystemInfo)
+	repo      *sqlite.Repository
+	jwtSecret string
+	upgrader  websocket.Upgrader
 
 	mu      sync.RWMutex
 	admins  map[*connWrap]struct{}
@@ -82,41 +79,7 @@ type Server struct {
 	pending map[string]pendingRequest
 }
 
-type SystemInfo struct {
-	Uptime           uint64  `json:"uptime"`
-	BytesReceived    uint64  `json:"bytes_received"`
-	BytesTransmitted uint64  `json:"bytes_transmitted"`
-	CPUUsage         float64 `json:"cpu_usage"`
-	MemoryUsage      float64 `json:"memory_usage"`
-	DiskUsage        float64 `json:"disk_usage"`
-	Load1            float64 `json:"load1"`
-	Load5            float64 `json:"load5"`
-	Load15           float64 `json:"load15"`
-	TCPConns         int64   `json:"tcp_conns"`
-	UDPConns         int64   `json:"udp_conns"`
-	NetInSpeed       int64   `json:"net_in_speed"`
-	NetOutSpeed      int64   `json:"net_out_speed"`
-}
-
-func (s *Server) SetNodeOnlineHook(fn func(nodeID int64)) {
-	if s == nil {
-		return
-	}
-	s.mu.Lock()
-	s.onNodeOnline = fn
-	s.mu.Unlock()
-}
-
-func (s *Server) SetNodeMetricHook(fn func(nodeID int64, info SystemInfo)) {
-	if s == nil {
-		return
-	}
-	s.mu.Lock()
-	s.onNodeMetric = fn
-	s.mu.Unlock()
-}
-
-func NewServer(repo *repo.Repository, jwtSecret string) *Server {
+func NewServer(repo *sqlite.Repository, jwtSecret string) *Server {
 	return &Server{
 		repo:      repo,
 		jwtSecret: jwtSecret,
@@ -212,12 +175,7 @@ func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64
 		_ = old.conn.conn.Close()
 		delete(s.byConn, old.conn.conn)
 	}
-	// 初始化 AES 加密器并缓存（仅创建一次）
-	var nodeCrypto *security.AESCrypto
-	if strings.TrimSpace(secret) != "" {
-		nodeCrypto, _ = security.NewAESCrypto(secret)
-	}
-	ns := &nodeSession{nodeID: nodeID, secret: secret, conn: cw, crypto: nodeCrypto}
+	ns := &nodeSession{nodeID: nodeID, secret: secret, conn: cw}
 	s.nodes[nodeID] = ns
 	s.byConn[conn] = ns
 	s.mu.Unlock()
@@ -225,13 +183,6 @@ func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64
 	_ = s.repo.UpdateNodeOnline(nodeID, 1, version, httpVal, tlsVal, socksVal)
 	s.broadcastStatus(nodeID, 1)
 
-	s.mu.RLock()
-	onlineHook := s.onNodeOnline
-	s.mu.RUnlock()
-	if onlineHook != nil {
-		go onlineHook(nodeID)
-	}
-
 	defer func() {
 		close(done)
 		needOfflineBroadcast := false
@@ -257,100 +208,18 @@ func (s *Server) handleNode(w http.ResponseWriter, r *http.Request, nodeID int64
 			return
 		}
 
-		msg := decryptIfNeeded(payload, ns.crypto, secret)
+		msg := decryptIfNeeded(payload, secret)
 		s.tryResolvePending(nodeID, msg)
 
 		var parsed struct {
 			Type string `json:"type"`
 		}
-		if json.Unmarshal([]byte(msg), &parsed) == nil && parsed.Type != "" {
-			switch parsed.Type {
-			case "metric":
-				// Agent 新版指标消息：{type:"metric", data:{...}}
-				var envelope struct {
-					Data json.RawMessage `json:"data"`
-				}
-				if err := json.Unmarshal([]byte(msg), &envelope); err == nil && len(envelope.Data) > 0 {
-					// 解析 SystemInfo 并调用 hook
-					var sysInfo SystemInfo
-					if json.Unmarshal(envelope.Data, &sysInfo) == nil {
-						s.mu.RLock()
-						onMetric := s.onNodeMetric
-						s.mu.RUnlock()
-						if onMetric != nil {
-							go onMetric(nodeID, sysInfo)
-						}
-					}
-					// 广播内层 data 给前端（保持平坦结构兼容性）
-					s.broadcastTyped(nodeID, "metric", string(envelope.Data))
-				}
-				continue
-			case "UpgradeProgress":
-				s.broadcastTyped(nodeID, "upgrade_progress", msg)
-				continue
-			default:
-				// Unknown typed messages still get broadcast so future
-				// agent message types are not silently lost.
-				s.broadcastInfo(nodeID, msg)
-				continue
-			}
-		}
-
-		// 兼容旧版 Agent：无 type 字段的系统信息消息
-		if looksLikeSystemInfoMessage(msg) {
-			var sysInfo SystemInfo
-			if err := json.Unmarshal([]byte(msg), &sysInfo); err == nil {
-				s.mu.RLock()
-				onMetric := s.onNodeMetric
-				s.mu.RUnlock()
-				if onMetric != nil {
-					go onMetric(nodeID, sysInfo)
-				}
-				s.broadcastTyped(nodeID, "metric", msg)
-				continue
-			}
-		}
-
-		s.broadcastInfo(nodeID, msg)
-	}
-}
-
-func looksLikeSystemInfoMessage(msg string) bool {
-	// Keep this as a cheap heuristic so that arbitrary JSON objects don't get
-	// misclassified as metrics (SystemInfo unmarshal would otherwise succeed with
-	// all-zero values).
-	if strings.TrimSpace(msg) == "" {
-		return false
-	}
-	if !strings.Contains(msg, "{") {
-		return false
-	}
-
-	keys := []string{
-		"\"uptime\"",
-		"\"cpu_usage\"",
-		"\"memory_usage\"",
-		"\"disk_usage\"",
-		"\"bytes_received\"",
-		"\"bytes_transmitted\"",
-		"\"net_in_speed\"",
-		"\"net_out_speed\"",
-		"\"tcp_conns\"",
-		"\"udp_conns\"",
-		"\"load1\"",
-		"\"load5\"",
-		"\"load15\"",
-	}
-	matched := 0
-	for _, k := range keys {
-		if strings.Contains(msg, k) {
-			matched++
-			if matched >= 3 {
-				return true
-			}
+		if json.Unmarshal([]byte(msg), &parsed) == nil && parsed.Type == "UpgradeProgress" {
+			s.broadcastTyped(nodeID, "upgrade_progress", msg)
+		} else {
+			s.broadcastInfo(nodeID, msg)
 		}
 	}
-	return false
 }
 
 func (s *Server) SendCommand(nodeID int64, cmdType string, data interface{}, timeout time.Duration) (CommandResult, error) {
@@ -399,8 +268,13 @@ func (s *Server) SendCommand(nodeID int64, cmdType string, data interface{}, tim
 	}
 
 	messageData := rawCmd
-	if ns.crypto != nil {
-		encrypted, err := ns.crypto.Encrypt(rawCmd)
+	if strings.TrimSpace(ns.secret) != "" {
+		crypto, err := security.NewAESCrypto(ns.secret)
+		if err != nil {
+			cleanup()
+			return CommandResult{}, err
+		}
+		encrypted, err := crypto.Encrypt(rawCmd)
 		if err != nil {
 			cleanup()
 			return CommandResult{}, err
@@ -450,11 +324,6 @@ func (s *Server) tryResolvePending(nodeID int64, message string) {
 		return
 	}
 
-	// 快速短路：指标消息永远不含 requestId，跳过完整 JSON 解析
-	if !strings.Contains(message, "\"requestId\"") {
-		return
-	}
-
 	var resp commandResponse
 	if err := json.Unmarshal([]byte(message), &resp); err != nil {
 		return
@@ -572,22 +441,18 @@ func (s *Server) broadcastToAdmins(message string) {
 	}
 }
 
-func decryptIfNeeded(payload []byte, crypto *security.AESCrypto, secret string) string {
+func decryptIfNeeded(payload []byte, secret string) string {
 	text := string(payload)
 	var wrap encryptedMessage
 	if err := json.Unmarshal(payload, &wrap); err != nil || !wrap.Encrypted || strings.TrimSpace(wrap.Data) == "" {
 		return text
 	}
 
-	// 优先使用缓存的 crypto 实例
-	c := crypto
-	if c == nil && strings.TrimSpace(secret) != "" {
-		c, _ = security.NewAESCrypto(secret)
-	}
-	if c == nil {
+	crypto, err := security.NewAESCrypto(secret)
+	if err != nil {
 		return text
 	}
-	plain, err := c.Decrypt(wrap.Data)
+	plain, err := crypto.Decrypt(wrap.Data)
 	if err != nil {
 		return text
 	}

go-backend/tests/contract/batch_action_failure_details_contract_test.go

@@ -1,202 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
-)
-
-func TestForwardBatchDeleteReturnsFailureReasonsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, _ := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-
-	out := postBatchRequest(t, router, adminToken, "/api/v1/forward/batch-delete", `{"ids":[999]}`)
-	result := mustBatchResult(t, out)
-	assertBatchFailureReasonContains(t, result, "转发不存在")
-}
-
-func TestForwardBatchPauseReturnsFailureReasonsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, _ := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-
-	out := postBatchRequest(t, router, adminToken, "/api/v1/forward/batch-pause", `{"ids":[999]}`)
-	result := mustBatchResult(t, out)
-	assertBatchFailureReasonContains(t, result, "转发不存在")
-}
-
-func TestForwardBatchResumeReturnsFailureReasonsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-	now := time.Now().UnixMilli()
-
-	forwardID := seedForwardForBatchAction(t, repo, batchForwardSeedOptions{
-		Now:              now,
-		TunnelName:       "resume-detail-tunnel",
-		ForwardName:      "resume-detail-forward",
-		CreateUserTunnel: true,
-		UserTunnelStatus: 0,
-	})
-
-	out := postBatchRequest(t, router, adminToken, "/api/v1/forward/batch-resume", `{"ids":[`+jsonNumber(forwardID)+`]}`)
-	result := mustBatchResult(t, out)
-	assertBatchFailureNameAndReason(t, result, "resume-detail-forward", "该隧道已禁用")
-}
-
-func TestForwardBatchChangeTunnelReturnsFailureReasonsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-	now := time.Now().UnixMilli()
-
-	forwardID := seedForwardForBatchAction(t, repo, batchForwardSeedOptions{
-		Now:         now,
-		TunnelName:  "change-detail-tunnel",
-		ForwardName: "change-detail-forward",
-	})
-	tunnelID := mustQueryInt64(t, repo, `SELECT tunnel_id FROM forward WHERE id = ?`, forwardID)
-
-	payload := `{"forwardIds":[` + jsonNumber(forwardID) + `],"targetTunnelId":` + jsonNumber(tunnelID) + `}`
-	out := postBatchRequest(t, router, adminToken, "/api/v1/forward/batch-change-tunnel", payload)
-	result := mustBatchResult(t, out)
-	assertBatchFailureNameAndReason(t, result, "change-detail-forward", "规则已在目标隧道中")
-}
-
-func TestTunnelBatchDeleteReturnsFailureReasonsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, _ := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-
-	out := postBatchRequest(t, router, adminToken, "/api/v1/tunnel/batch-delete", `{"ids":[999]}`)
-	result := mustBatchResult(t, out)
-	assertBatchFailureReasonContains(t, result, "隧道不存在")
-}
-
-type batchForwardSeedOptions struct {
-	Now              int64
-	TunnelName       string
-	ForwardName      string
-	CreateUserTunnel bool
-	UserTunnelStatus int
-}
-
-func mustAdminToken(t *testing.T, secret string) string {
-	t.Helper()
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-	return token
-}
-
-func postBatchRequest(t *testing.T, router http.Handler, token, path, payload string) response.R {
-	t.Helper()
-	req := httptest.NewRequest(http.MethodPost, path, bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected API success envelope, got code=%d msg=%q", out.Code, out.Msg)
-	}
-	return out
-}
-
-func mustBatchResult(t *testing.T, out response.R) map[string]interface{} {
-	t.Helper()
-	result, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected map result, got %T", out.Data)
-	}
-	if int(result["failCount"].(float64)) != 1 {
-		t.Fatalf("expected failCount=1, got %v", result["failCount"])
-	}
-	return result
-}
-
-func assertBatchFailureReasonContains(t *testing.T, result map[string]interface{}, snippet string) {
-	t.Helper()
-	failures, ok := result["failures"].([]interface{})
-	if !ok || len(failures) != 1 {
-		t.Fatalf("expected exactly one failure detail, got %#v", result["failures"])
-	}
-	first, ok := failures[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected failure detail object, got %T", failures[0])
-	}
-	reason, _ := first["reason"].(string)
-	if !strings.Contains(reason, snippet) {
-		t.Fatalf("expected failure reason to contain %q, got %q", snippet, reason)
-	}
-}
-
-func assertBatchFailureNameAndReason(t *testing.T, result map[string]interface{}, expectedName, reasonSnippet string) {
-	t.Helper()
-	failures, ok := result["failures"].([]interface{})
-	if !ok || len(failures) != 1 {
-		t.Fatalf("expected exactly one failure detail, got %#v", result["failures"])
-	}
-	first, ok := failures[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected failure detail object, got %T", failures[0])
-	}
-	gotName, _ := first["name"].(string)
-	if strings.TrimSpace(gotName) != expectedName {
-		t.Fatalf("expected failure name %q, got %q", expectedName, gotName)
-	}
-	reason, _ := first["reason"].(string)
-	if !strings.Contains(reason, reasonSnippet) {
-		t.Fatalf("expected failure reason to contain %q, got %q", reasonSnippet, reason)
-	}
-}
-
-func seedForwardForBatchAction(t *testing.T, repo *repo.Repository, opts batchForwardSeedOptions) int64 {
-	t.Helper()
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'batch_action_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, opts.Now, opts.Now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, opts.TunnelName, 1.0, 1, "tls", 99999, opts.Now, opts.Now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID := mustLastInsertID(t, repo, opts.TunnelName)
-
-	if opts.CreateUserTunnel {
-		if err := repo.DB().Exec(`
-			INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-			VALUES(20, 2, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, ?)
-		`, tunnelID, opts.UserTunnelStatus).Error; err != nil {
-			t.Fatalf("insert user_tunnel: %v", err)
-		}
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(2, 'batch_action_user', ?, ?, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, opts.ForwardName, tunnelID, opts.Now, opts.Now).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	return mustLastInsertID(t, repo, opts.ForwardName)
-}

go-backend/tests/contract/batch_redeploy_error_details_contract_test.go

@@ -1,161 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-func TestForwardBatchRedeployReturnsFailureReasonsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'batch_redeploy_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "batch-redeploy-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID := mustLastInsertID(t, repo, "batch-redeploy-tunnel")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, 0)
-	`, 2, "batch_redeploy_user", "redeploy-forward", tunnelID, "1.1.1.1:443", "fifo", now, now).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	forwardID := mustLastInsertID(t, repo, "redeploy-forward")
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/batch-redeploy", bytes.NewBufferString(`{"ids":[`+jsonNumber(forwardID)+`]}`))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected API success envelope, got code=%d msg=%q", out.Code, out.Msg)
-	}
-
-	result, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected map result, got %T", out.Data)
-	}
-	if int(result["failCount"].(float64)) != 1 {
-		t.Fatalf("expected failCount=1, got %v", result["failCount"])
-	}
-	if int(result["successCount"].(float64)) != 0 {
-		t.Fatalf("expected successCount=0, got %v", result["successCount"])
-	}
-
-	failures, ok := result["failures"].([]interface{})
-	if !ok || len(failures) != 1 {
-		t.Fatalf("expected exactly one failure detail, got %#v", result["failures"])
-	}
-	first, ok := failures[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected failure detail object, got %T", failures[0])
-	}
-	if gotName := strings.TrimSpace(first["name"].(string)); gotName != "redeploy-forward" {
-		t.Fatalf("expected failure name redeploy-forward, got %q", gotName)
-	}
-	reason, _ := first["reason"].(string)
-	if !strings.Contains(reason, "转发入口端口不存在") {
-		t.Fatalf("expected forward failure reason to mention missing entry port, got %q", reason)
-	}
-}
-
-func TestTunnelBatchRedeployReturnsFailureReasonsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "broken-redeploy-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID := mustLastInsertID(t, repo, "broken-redeploy-tunnel")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "entry-only-node", "entry-only-secret", "10.0.0.20", "10.0.0.20", "", "20000-20010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
-		t.Fatalf("insert node: %v", err)
-	}
-	entryNodeID := mustLastInsertID(t, repo, "entry-only-node")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 20001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID).Error; err != nil {
-		t.Fatalf("insert chain_tunnel: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/batch-redeploy", bytes.NewBufferString(`{"ids":[`+jsonNumber(tunnelID)+`]}`))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected API success envelope, got code=%d msg=%q", out.Code, out.Msg)
-	}
-
-	result, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected map result, got %T", out.Data)
-	}
-	if int(result["failCount"].(float64)) != 1 {
-		t.Fatalf("expected failCount=1, got %v", result["failCount"])
-	}
-
-	failures, ok := result["failures"].([]interface{})
-	if !ok || len(failures) != 1 {
-		t.Fatalf("expected exactly one failure detail, got %#v", result["failures"])
-	}
-	first, ok := failures[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected failure detail object, got %T", failures[0])
-	}
-	if gotName := strings.TrimSpace(first["name"].(string)); gotName != "broken-redeploy-tunnel" {
-		t.Fatalf("expected failure name broken-redeploy-tunnel, got %q", gotName)
-	}
-	reason, _ := first["reason"].(string)
-	if !strings.Contains(reason, "转发链目标不能为空") {
-		t.Fatalf("expected tunnel failure reason to mention missing target, got %q", reason)
-	}
-}

go-backend/tests/contract/db_test_helper_test.go

@@ -1,161 +0,0 @@
-package contract_test
-
-import (
-	"database/sql"
-	"strconv"
-	"strings"
-	"testing"
-
-	"go-backend/internal/store/repo"
-)
-
-func mustLastInsertID(t *testing.T, r *repo.Repository, label string) int64 {
-	t.Helper()
-	var id int64
-	if err := r.DB().Raw("SELECT last_insert_rowid()").Row().Scan(&id); err != nil {
-		t.Fatalf("read last_insert_rowid for %s: %v", label, err)
-	}
-	if id <= 0 {
-		t.Fatalf("invalid last_insert_rowid for %s: %d", label, id)
-	}
-	return id
-}
-
-func mustQueryInt(t *testing.T, r *repo.Repository, query string, args ...interface{}) int {
-	t.Helper()
-	var v int
-	if err := r.DB().Raw(query, args...).Row().Scan(&v); err != nil {
-		t.Fatalf("query int failed: %v (query=%q)", err, query)
-	}
-	return v
-}
-
-func mustQueryInt64(t *testing.T, r *repo.Repository, query string, args ...interface{}) int64 {
-	t.Helper()
-	var v int64
-	if err := r.DB().Raw(query, args...).Row().Scan(&v); err != nil {
-		t.Fatalf("query int64 failed: %v (query=%q)", err, query)
-	}
-	return v
-}
-
-func mustQueryString(t *testing.T, r *repo.Repository, query string, args ...interface{}) string {
-	t.Helper()
-	var v string
-	if err := r.DB().Raw(query, args...).Row().Scan(&v); err != nil {
-		t.Fatalf("query string failed: %v (query=%q)", err, query)
-	}
-	return v
-}
-
-func mustQueryInt64Int(t *testing.T, r *repo.Repository, query string, args ...interface{}) (int64, int) {
-	t.Helper()
-	var a int64
-	var b int
-	if err := r.DB().Raw(query, args...).Row().Scan(&a, &b); err != nil {
-		t.Fatalf("query int64+int failed: %v (query=%q)", err, query)
-	}
-	return a, b
-}
-
-func tryQueryString(t *testing.T, r *repo.Repository, query string, args ...interface{}) (string, error) {
-	t.Helper()
-	var v string
-	err := r.DB().Raw(query, args...).Row().Scan(&v)
-	if err != nil {
-		return "", err
-	}
-	return v, nil
-}
-
-func mustQueryNullString(t *testing.T, r *repo.Repository, query string, args ...interface{}) sql.NullString {
-	t.Helper()
-	var v sql.NullString
-	if err := r.DB().Raw(query, args...).Row().Scan(&v); err != nil {
-		t.Fatalf("query null string failed: %v (query=%q)", err, query)
-	}
-	return v
-}
-
-func mustQueryTwoNullStrings(t *testing.T, r *repo.Repository, query string, args ...interface{}) (sql.NullString, sql.NullString) {
-	t.Helper()
-	var a sql.NullString
-	var b sql.NullString
-	if err := r.DB().Raw(query, args...).Row().Scan(&a, &b); err != nil {
-		t.Fatalf("query two null strings failed: %v (query=%q)", err, query)
-	}
-	return a, b
-}
-
-func mustQueryNodePorts(t *testing.T, r *repo.Repository, query string, args ...interface{}) map[int64]int {
-	t.Helper()
-	rows, err := r.DB().Raw(query, args...).Rows()
-	if err != nil {
-		t.Fatalf("query node ports failed: %v (query=%q)", err, query)
-	}
-	defer rows.Close()
-
-	out := make(map[int64]int)
-	for rows.Next() {
-		var nodeID int64
-		var port int
-		if err := rows.Scan(&nodeID, &port); err != nil {
-			t.Fatalf("scan node ports row failed: %v (query=%q)", err, query)
-		}
-		out[nodeID] = port
-	}
-	if err := rows.Err(); err != nil {
-		t.Fatalf("iterate node ports rows failed: %v (query=%q)", err, query)
-	}
-	return out
-}
-
-func tryQueryInt(t *testing.T, r *repo.Repository, query string, args ...interface{}) (int, error) {
-	t.Helper()
-	var v int
-	err := r.DB().Raw(query, args...).Row().Scan(&v)
-	if err != nil {
-		return 0, err
-	}
-	return v, nil
-}
-
-func valueAsInt(v interface{}) int {
-	switch n := v.(type) {
-	case float64:
-		return int(n)
-	case int:
-		return n
-	case int64:
-		return int(n)
-	default:
-		return 0
-	}
-}
-
-func valueAsString(v interface{}) string {
-	s, _ := v.(string)
-	return s
-}
-
-func valueAsBool(v interface{}) bool {
-	switch b := v.(type) {
-	case bool:
-		return b
-	case float64:
-		return b != 0
-	case int:
-		return b != 0
-	case int64:
-		return b != 0
-	case string:
-		s := strings.TrimSpace(strings.ToLower(b))
-		return s == "1" || s == "t" || s == "true" || s == "yes" || s == "y"
-	default:
-		return false
-	}
-}
-
-func jsonInt64(v int64) string {
-	return strconv.FormatInt(v, 10)
-}

go-backend/tests/contract/diagnosis_contract_test.go

@@ -1,11 +1,11 @@
-package contract_test
+package contract
 
 import (
-	"bufio"
 	"bytes"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"sync/atomic"
@@ -13,69 +13,85 @@ import (
 	"time"
 
 	"go-backend/internal/auth"
+	httpserver "go-backend/internal/http"
+	"go-backend/internal/http/handler"
 	"go-backend/internal/http/response"
+	"go-backend/internal/store/sqlite"
 )
 
 func TestDiagnosisChainCoverageContracts(t *testing.T) {
 	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
+	router, repo := setupDiagnosisContractRouter(t, secret)
 	now := time.Now().UnixMilli()
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
 		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now).Error; err != nil {
+	`, now, now); err != nil {
 		t.Fatalf("insert user: %v", err)
 	}
 
-	if err := r.DB().Exec(`
+	tunnelRes, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "diagnose-chain-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
+	`, "diagnose-chain-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
-	tunnelID := mustLastInsertID(t, r, "diagnose-chain-tunnel")
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
 
 	insertNode := func(name, ip string) int64 {
-		if err := r.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
+		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
 			t.Fatalf("insert node %s: %v", name, err)
 		}
-		return mustLastInsertID(t, r, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
 	}
 
 	entryNodeID := insertNode("entry-node", "10.0.1.10")
 	chainNodeID := insertNode("chain-node", "10.0.1.20")
 	exitNodeID := insertNode("exit-node", "10.0.1.30")
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
 		VALUES(?, 1, ?, 30001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID).Error; err != nil {
+	`, tunnelID, entryNodeID); err != nil {
 		t.Fatalf("insert entry chain: %v", err)
 	}
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
 		VALUES(?, 2, ?, 30002, 'round', 1, 'tls')
-	`, tunnelID, chainNodeID).Error; err != nil {
+	`, tunnelID, chainNodeID); err != nil {
 		t.Fatalf("insert middle chain: %v", err)
 	}
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
 		VALUES(?, 3, ?, 30003, 'round', 1, 'tls')
-	`, tunnelID, exitNodeID).Error; err != nil {
+	`, tunnelID, exitNodeID); err != nil {
 		t.Fatalf("insert exit chain: %v", err)
 	}
 
-	if err := r.DB().Exec(`
+	forwardRes, err := repo.DB().Exec(`
 		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
 		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
-	`, 2, "normal_user", "chain-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 0).Error; err != nil {
+	`, 2, "normal_user", "chain-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 0)
+	if err != nil {
 		t.Fatalf("insert forward: %v", err)
 	}
-	forwardID := mustLastInsertID(t, r, "chain-forward")
+	forwardID, err := forwardRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get forward id: %v", err)
+	}
 
 	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
 	if err != nil {
@@ -190,129 +206,9 @@ func TestDiagnosisChainCoverageContracts(t *testing.T) {
 	})
 }
 
-func TestForwardDiagnosisRespectsTunnelIPPreferenceContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx, ip_preference)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "diagnose-ip-pref-forward", 1.0, 2, "tls", 99999, now, now, 1, nil, 0, "v6").Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID := mustLastInsertID(t, r, "diagnose-ip-pref-forward")
-
-	insertNode := func(name, v4, v6 string) int64 {
-		if err := r.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", v4, v4, v6, "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-		return mustLastInsertID(t, r, name)
-	}
-
-	entryNodeID := insertNode("entry-node-v6", "10.10.1.10", "2001:db8:10::10")
-	chainNodeID := insertNode("chain-node-v6", "10.10.1.20", "2001:db8:10::20")
-	exitNodeID := insertNode("exit-node-v6", "10.10.1.30", "2001:db8:10::30")
-
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 30001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID).Error; err != nil {
-		t.Fatalf("insert entry chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 2, ?, 30002, 'round', 1, 'tls')
-	`, tunnelID, chainNodeID).Error; err != nil {
-		t.Fatalf("insert middle chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 3, ?, 30003, 'round', 1, 'tls')
-	`, tunnelID, exitNodeID).Error; err != nil {
-		t.Fatalf("insert exit chain: %v", err)
-	}
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, 0, 0, ?, ?, 1, ?)
-	`, 2, "normal_user", "ip-pref-forward", tunnelID, "8.8.8.8:53", "fifo", now, now, 0).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	forwardID := mustLastInsertID(t, r, "ip-pref-forward")
-
-	userToken, err := auth.GenerateToken(2, "normal_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate user token: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/diagnose", bytes.NewBufferString(`{"forwardId":`+strconv.FormatInt(forwardID, 10)+`}`))
-	req.Header.Set("Authorization", userToken)
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-	}
-
-	payload, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected object payload, got %T", out.Data)
-	}
-	results, ok := payload["results"].([]interface{})
-	if !ok || len(results) == 0 {
-		t.Fatalf("expected non-empty results, got %v", payload["results"])
-	}
-
-	hasEntryToChain := false
-	hasChainToExit := false
-	for _, raw := range results {
-		item, ok := raw.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		from := valueAsInt(item["fromChainType"])
-		to := valueAsInt(item["toChainType"])
-		targetIP := strings.TrimSpace(valueAsString(item["targetIp"]))
-
-		if from == 1 && to == 2 {
-			hasEntryToChain = true
-			if targetIP != "2001:db8:10::20" {
-				t.Fatalf("expected entry->chain diagnosis target to use IPv6, got %q", targetIP)
-			}
-		}
-
-		if from == 2 && to == 3 {
-			hasChainToExit = true
-			if targetIP != "2001:db8:10::30" {
-				t.Fatalf("expected chain->exit diagnosis target to use IPv6, got %q", targetIP)
-			}
-		}
-	}
-
-	if !hasEntryToChain || !hasChainToExit {
-		t.Fatalf("expected entry->chain and chain->exit steps, got entry=%v chain=%v", hasEntryToChain, hasChainToExit)
-	}
-}
-
 func TestDiagnosisUsesFederationRuntimeForRemoteNodes(t *testing.T) {
 	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
+	router, repo := setupDiagnosisContractRouter(t, secret)
 	now := time.Now().UnixMilli()
 
 	remoteToken := "remote-diagnose-token"
@@ -360,53 +256,67 @@ func TestDiagnosisUsesFederationRuntimeForRemoteNodes(t *testing.T) {
 	defer remoteServer.Close()
 
 	insertLocalNode := func(name, ip string) int64 {
-		if err := r.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
+		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
 			t.Fatalf("insert local node %s: %v", name, err)
 		}
-		return mustLastInsertID(t, r, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get local node id %s: %v", name, err)
+		}
+		return id
 	}
 
 	insertRemoteNode := func(name, ip string) int64 {
-		if err := r.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, 0, 0, 0, ?, ?, 1, ?, ?, ?, 1, ?, ?, ?)
-		`, name, name+"-secret", ip, "", "", "31000-31010", "", "", now, now, "[::]", "[::]", 1, remoteServer.URL, remoteToken, `{"shareId": 123}`).Error; err != nil {
+		`, name, name+"-secret", ip, "", "", "31000-31010", "", "", now, now, "[::]", "[::]", 1, remoteServer.URL, remoteToken, `{"shareId": 123}`)
+		if err != nil {
 			t.Fatalf("insert remote node %s: %v", name, err)
 		}
-		return mustLastInsertID(t, r, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get remote node id %s: %v", name, err)
+		}
+		return id
 	}
 
 	entryNodeID := insertLocalNode("entry-local", "10.50.0.10")
 	remoteChainNodeID := insertRemoteNode("middle-remote", "10.50.0.20")
 	exitNodeID := insertLocalNode("exit-local", "10.50.0.30")
 
-	if err := r.DB().Exec(`
+	tunnelRes, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "diagnose-remote-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
+	`, "diagnose-remote-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
-	tunnelID := mustLastInsertID(t, r, "diagnose-remote-tunnel")
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
 
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
 		VALUES(?, 1, ?, 30001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID).Error; err != nil {
+	`, tunnelID, entryNodeID); err != nil {
 		t.Fatalf("insert entry chain: %v", err)
 	}
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
 		VALUES(?, 2, ?, 30002, 'round', 1, 'tls')
-	`, tunnelID, remoteChainNodeID).Error; err != nil {
+	`, tunnelID, remoteChainNodeID); err != nil {
 		t.Fatalf("insert middle chain: %v", err)
 	}
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
 		VALUES(?, 3, ?, 30003, 'round', 1, 'tls')
-	`, tunnelID, exitNodeID).Error; err != nil {
+	`, tunnelID, exitNodeID); err != nil {
 		t.Fatalf("insert exit chain: %v", err)
 	}
 
@@ -463,166 +373,53 @@ func TestDiagnosisUsesFederationRuntimeForRemoteNodes(t *testing.T) {
 	}
 }
 
-func TestTunnelDiagnosisUsesConfiguredConnectIPContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	insertNode := func(name, ip string) int64 {
-		if err := r.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", "30000-30010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-		return mustLastInsertID(t, r, name)
+func valueAsInt(v interface{}) int {
+	switch n := v.(type) {
+	case float64:
+		return int(n)
+	case int:
+		return n
+	case int64:
+		return int(n)
+	default:
+		return 0
 	}
-
-	entryNodeID := insertNode("entry-connectip", "10.80.0.10")
-	middleNodeID := insertNode("middle-connectip", "10.80.0.20")
-	exitNodeID := insertNode("exit-connectip", "10.80.0.30")
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "diagnose-connectip-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	tunnelID := mustLastInsertID(t, r, "diagnose-connectip-tunnel")
-
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 30001, 'round', 1, 'tls')
-	`, tunnelID, entryNodeID).Error; err != nil {
-		t.Fatalf("insert entry chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol, connect_ip)
-		VALUES(?, 2, ?, 30002, 'round', 1, 'tls', ?)
-	`, tunnelID, middleNodeID, "10.99.0.22").Error; err != nil {
-		t.Fatalf("insert middle chain: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol, connect_ip)
-		VALUES(?, 3, ?, 30003, 'round', 1, 'tls', ?)
-	`, tunnelID, exitNodeID, "10.99.0.33").Error; err != nil {
-		t.Fatalf("insert exit chain: %v", err)
-	}
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	t.Run("normal diagnose should use configured connectIp", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose", bytes.NewBufferString(`{"tunnelId":`+strconv.FormatInt(tunnelID, 10)+`}`))
-		req.Header.Set("Authorization", adminToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		var out response.R
-		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-		}
-
-		payload, ok := out.Data.(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected object payload, got %T", out.Data)
-		}
-		results, ok := payload["results"].([]interface{})
-		if !ok || len(results) == 0 {
-			t.Fatalf("expected non-empty results, got %v", payload["results"])
-		}
-
-		entryToMiddleOK := false
-		middleToExitOK := false
-		for _, raw := range results {
-			item, ok := raw.(map[string]interface{})
-			if !ok {
-				continue
-			}
-			from := valueAsInt(item["fromChainType"])
-			to := valueAsInt(item["toChainType"])
-			targetIP := strings.TrimSpace(valueAsString(item["targetIp"]))
-
-			if from == 1 && to == 2 && targetIP == "10.99.0.22" {
-				entryToMiddleOK = true
-			}
-			if from == 2 && to == 3 && targetIP == "10.99.0.33" {
-				middleToExitOK = true
-			}
-		}
-
-		if !entryToMiddleOK || !middleToExitOK {
-			t.Fatalf("expected connectIp targets 10.99.0.22/10.99.0.33, got entry=%v middle=%v", entryToMiddleOK, middleToExitOK)
-		}
-	})
-
-	t.Run("stream diagnose start items should use configured connectIp", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/diagnose/stream", bytes.NewBufferString(`{"tunnelId":`+strconv.FormatInt(tunnelID, 10)+`}`))
-		req.Header.Set("Authorization", adminToken)
-		res := httptest.NewRecorder()
-
-		router.ServeHTTP(res, req)
-
-		if res.Code != http.StatusOK {
-			t.Fatalf("expected status 200, got %d", res.Code)
-		}
-
-		scanner := bufio.NewScanner(bytes.NewReader(res.Body.Bytes()))
-		startFound := false
-		entryToMiddleOK := false
-		middleToExitOK := false
-		for scanner.Scan() {
-			line := strings.TrimSpace(scanner.Text())
-			if line == "" {
-				continue
-			}
-			var event map[string]interface{}
-			if err := json.Unmarshal([]byte(line), &event); err != nil {
-				continue
-			}
-			if strings.TrimSpace(valueAsString(event["type"])) != "start" {
-				continue
-			}
-			startFound = true
-			data, ok := event["data"].(map[string]interface{})
-			if !ok {
-				break
-			}
-			items, ok := data["items"].([]interface{})
-			if !ok {
-				break
-			}
-			for _, raw := range items {
-				item, ok := raw.(map[string]interface{})
-				if !ok {
-					continue
-				}
-				from := valueAsInt(item["fromChainType"])
-				to := valueAsInt(item["toChainType"])
-				targetIP := strings.TrimSpace(valueAsString(item["targetIp"]))
-				if from == 1 && to == 2 && targetIP == "10.99.0.22" {
-					entryToMiddleOK = true
-				}
-				if from == 2 && to == 3 && targetIP == "10.99.0.33" {
-					middleToExitOK = true
-				}
-			}
-			break
-		}
-		if err := scanner.Err(); err != nil {
-			t.Fatalf("scan stream body: %v", err)
-		}
-		if !startFound {
-			t.Fatalf("expected start event in stream response")
-		}
-		if !entryToMiddleOK || !middleToExitOK {
-			t.Fatalf("expected start items with connectIp targets 10.99.0.22/10.99.0.33, got entry=%v middle=%v", entryToMiddleOK, middleToExitOK)
-		}
-	})
+}
+
+func valueAsString(v interface{}) string {
+	s, _ := v.(string)
+	return s
+}
+
+func valueAsBool(v interface{}) bool {
+	switch b := v.(type) {
+	case bool:
+		return b
+	case float64:
+		return b != 0
+	case int:
+		return b != 0
+	case int64:
+		return b != 0
+	case string:
+		s := strings.TrimSpace(strings.ToLower(b))
+		return s == "1" || s == "t" || s == "true" || s == "yes" || s == "y"
+	default:
+		return false
+	}
+}
+
+func setupDiagnosisContractRouter(t *testing.T, jwtSecret string) (http.Handler, *sqlite.Repository) {
+	t.Helper()
+	dbPath := filepath.Join(t.TempDir(), "diagnosis-contract.db")
+	repo, err := sqlite.Open(dbPath)
+	if err != nil {
+		t.Fatalf("open sqlite: %v", err)
+	}
+	t.Cleanup(func() {
+		_ = repo.Close()
+	})
+
+	h := handler.New(repo, jwtSecret)
+	return httpserver.NewRouter(h, jwtSecret), repo
 }

go-backend/tests/contract/federation_dual_panel_contract_test.go

@@ -17,7 +17,7 @@ import (
 	"go-backend/internal/auth"
 	"go-backend/internal/http/response"
 	"go-backend/internal/security"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 func TestFederationDualPanelMiddleExitAutoPortContract(t *testing.T) {
@@ -39,7 +39,7 @@ func TestFederationDualPanelMiddleExitAutoPortContract(t *testing.T) {
 	providerMiddleNodeID := insertContractNode(t, providerRepo, "provider-middle", "198.51.100.12", "44000-44010", "provider-middle-secret", 1)
 	providerExitNodeID := insertContractNode(t, providerRepo, "provider-exit", "198.51.100.13", "45000-45010", "provider-exit-secret", 1)
 
-	entryShareID := insertPeerShare(t, providerRepo, &repo.PeerShare{
+	entryShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "entry-share",
 		NodeID:         providerEntryNodeID,
 		Token:          "share-entry-token",
@@ -49,7 +49,7 @@ func TestFederationDualPanelMiddleExitAutoPortContract(t *testing.T) {
 		CreatedTime:    now,
 		UpdatedTime:    now,
 	})
-	middleShareID := insertPeerShare(t, providerRepo, &repo.PeerShare{
+	middleShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "middle-share",
 		NodeID:         providerMiddleNodeID,
 		Token:          "share-middle-token",
@@ -59,7 +59,7 @@ func TestFederationDualPanelMiddleExitAutoPortContract(t *testing.T) {
 		CreatedTime:    now,
 		UpdatedTime:    now,
 	})
-	exitShareID := insertPeerShare(t, providerRepo, &repo.PeerShare{
+	exitShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "exit-share",
 		NodeID:         providerExitNodeID,
 		Token:          "share-exit-token",
@@ -112,7 +112,10 @@ func TestFederationDualPanelMiddleExitAutoPortContract(t *testing.T) {
 		consumerRouter.ServeHTTP(res, req)
 		assertCode(t, res, 0)
 
-		tunnelID := mustQueryInt64(t, consumerRepo, `SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, name)
+		var tunnelID int64
+		if err := consumerRepo.DB().QueryRow(`SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, name).Scan(&tunnelID); err != nil {
+			t.Fatalf("query tunnel id (%s): %v", name, err)
+		}
 		if tunnelID <= 0 {
 			t.Fatalf("invalid tunnel id for %s", name)
 		}
@@ -166,7 +169,7 @@ func TestFederationDualPanelMiddleExitAutoPortContract(t *testing.T) {
 
 	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, middleShareID, 1)
 	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, exitShareID, 1)
-	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ? AND status = 1 AND applied = 1`, entryShareID, 1)
+	assertCount(t, providerRepo, `SELECT COUNT(1) FROM peer_share_runtime WHERE share_id = ?`, entryShareID, 0)
 }
 
 func TestFederationDualPanelRemoteDiagnosisContract(t *testing.T) {
@@ -188,7 +191,7 @@ func TestFederationDualPanelRemoteDiagnosisContract(t *testing.T) {
 	providerMiddleNodeID := insertContractNode(t, providerRepo, "provider-middle-dx", "203.0.113.12", "54000-54010", "provider-middle-dx-secret", 1)
 	providerExitNodeID := insertContractNode(t, providerRepo, "provider-exit-dx", "203.0.113.13", "55000-55010", "provider-exit-dx-secret", 1)
 
-	entryShareID := insertPeerShare(t, providerRepo, &repo.PeerShare{
+	entryShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "entry-share-dx",
 		NodeID:         providerEntryNodeID,
 		Token:          "share-entry-dx-token",
@@ -198,7 +201,7 @@ func TestFederationDualPanelRemoteDiagnosisContract(t *testing.T) {
 		CreatedTime:    now,
 		UpdatedTime:    now,
 	})
-	middleShareID := insertPeerShare(t, providerRepo, &repo.PeerShare{
+	middleShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "middle-share-dx",
 		NodeID:         providerMiddleNodeID,
 		Token:          "share-middle-dx-token",
@@ -208,7 +211,7 @@ func TestFederationDualPanelRemoteDiagnosisContract(t *testing.T) {
 		CreatedTime:    now,
 		UpdatedTime:    now,
 	})
-	exitShareID := insertPeerShare(t, providerRepo, &repo.PeerShare{
+	exitShareID := insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "exit-share-dx",
 		NodeID:         providerExitNodeID,
 		Token:          "share-exit-dx-token",
@@ -258,7 +261,10 @@ func TestFederationDualPanelRemoteDiagnosisContract(t *testing.T) {
 	consumerRouter.ServeHTTP(createRes, createReq)
 	assertCode(t, createRes, 0)
 
-	tunnelID := mustQueryInt64(t, consumerRepo, `SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, "dual-panel-diagnose-remote")
+	var tunnelID int64
+	if err := consumerRepo.DB().QueryRow(`SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, "dual-panel-diagnose-remote").Scan(&tunnelID); err != nil {
+		t.Fatalf("query tunnel id: %v", err)
+	}
 	if tunnelID <= 0 {
 		t.Fatalf("invalid tunnel id")
 	}
@@ -329,7 +335,7 @@ func TestFederationDualPanelRemoteEntryRuntimeContract(t *testing.T) {
 	providerMiddleNodeID := insertContractNode(t, providerRepo, "provider-middle-rt", "198.51.100.22", "44020-44030", "provider-middle-rt-secret", 1)
 	providerExitNodeID := insertContractNode(t, providerRepo, "provider-exit-rt", "198.51.100.23", "45020-45030", "provider-exit-rt-secret", 1)
 
-	insertPeerShare(t, providerRepo, &repo.PeerShare{
+	insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "entry-share-rt",
 		NodeID:         providerEntryNodeID,
 		Token:          "share-entry-rt-token",
@@ -339,7 +345,7 @@ func TestFederationDualPanelRemoteEntryRuntimeContract(t *testing.T) {
 		CreatedTime:    now,
 		UpdatedTime:    now,
 	})
-	insertPeerShare(t, providerRepo, &repo.PeerShare{
+	insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "middle-share-rt",
 		NodeID:         providerMiddleNodeID,
 		Token:          "share-middle-rt-token",
@@ -349,7 +355,7 @@ func TestFederationDualPanelRemoteEntryRuntimeContract(t *testing.T) {
 		CreatedTime:    now,
 		UpdatedTime:    now,
 	})
-	insertPeerShare(t, providerRepo, &repo.PeerShare{
+	insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "exit-share-rt",
 		NodeID:         providerExitNodeID,
 		Token:          "share-exit-rt-token",
@@ -408,7 +414,10 @@ func TestFederationDualPanelRemoteEntryRuntimeContract(t *testing.T) {
 		consumerRouter.ServeHTTP(res, req)
 		assertCode(t, res, 0)
 
-		tunnelID := mustQueryInt64(t, consumerRepo, `SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, name)
+		var tunnelID int64
+		if err := consumerRepo.DB().QueryRow(`SELECT id FROM tunnel WHERE name = ? ORDER BY id DESC LIMIT 1`, name).Scan(&tunnelID); err != nil {
+			t.Fatalf("query tunnel id (%s): %v", name, err)
+		}
 		if tunnelID <= 0 {
 			t.Fatalf("invalid tunnel id for %s", name)
 		}
@@ -437,27 +446,32 @@ func TestFederationDualPanelRemoteEntryRuntimeContract(t *testing.T) {
 	createTunnel("dual-panel-remote-entry-offline")
 }
 
-func insertContractNode(t *testing.T, r *repo.Repository, name, ip, portRange, secret string, status int) int64 {
+func insertContractNode(t *testing.T, repo *sqlite.Repository, name, ip, portRange, secret string, status int) int64 {
 	t.Helper()
 	now := time.Now().UnixMilli()
-	if err := r.DB().Exec(`
+	res, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, name, secret, ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0).Error; err != nil {
+	`, name, secret, ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, status, "[::]", "[::]", 0)
+	if err != nil {
 		t.Fatalf("insert node %s: %v", name, err)
 	}
-	return mustLastInsertID(t, r, name)
+	id, err := res.LastInsertId()
+	if err != nil {
+		t.Fatalf("node id %s: %v", name, err)
+	}
+	return id
 }
 
-func insertPeerShare(t *testing.T, r *repo.Repository, share *repo.PeerShare) int64 {
+func insertPeerShare(t *testing.T, repo *sqlite.Repository, share *sqlite.PeerShare) int64 {
 	t.Helper()
 	if share == nil {
 		t.Fatalf("share is nil")
 	}
-	if err := r.CreatePeerShare(share); err != nil {
+	if err := repo.CreatePeerShare(share); err != nil {
 		t.Fatalf("create peer share %s: %v", share.Name, err)
 	}
-	saved, err := r.GetPeerShareByToken(share.Token)
+	saved, err := repo.GetPeerShareByToken(share.Token)
 	if err != nil {
 		t.Fatalf("query peer share %s: %v", share.Name, err)
 	}
@@ -484,26 +498,41 @@ func importRemoteNodeForContract(t *testing.T, router http.Handler, adminToken,
 	assertCode(t, res, 0)
 }
 
-func queryRemoteNodeIDByToken(t *testing.T, r *repo.Repository, token string) int64 {
+func queryRemoteNodeIDByToken(t *testing.T, repo *sqlite.Repository, token string) int64 {
 	t.Helper()
-	id := mustQueryInt64(t, r, `SELECT id FROM node WHERE is_remote = 1 AND remote_token = ? ORDER BY id DESC LIMIT 1`, token)
+	var id int64
+	if err := repo.DB().QueryRow(`SELECT id FROM node WHERE is_remote = 1 AND remote_token = ? ORDER BY id DESC LIMIT 1`, token).Scan(&id); err != nil {
+		t.Fatalf("query remote node by token %s: %v", token, err)
+	}
 	if id <= 0 {
 		t.Fatalf("invalid remote node id for token %s", token)
 	}
 	return id
 }
 
-func assertTunnelPortInRange(t *testing.T, r *repo.Repository, tunnelID int64, chainType int, nodeID int64, minPort int, maxPort int) {
+func assertTunnelPortInRange(t *testing.T, repo *sqlite.Repository, tunnelID int64, chainType int, nodeID int64, minPort int, maxPort int) {
 	t.Helper()
-	port := mustQueryInt(t, r, `SELECT port FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = ? AND node_id = ? LIMIT 1`, tunnelID, chainType, nodeID)
+	var port int
+	err := repo.DB().QueryRow(`
+		SELECT port
+		FROM chain_tunnel
+		WHERE tunnel_id = ? AND chain_type = ? AND node_id = ?
+		LIMIT 1
+	`, tunnelID, chainType, nodeID).Scan(&port)
+	if err != nil {
+		t.Fatalf("query tunnel=%d chainType=%d node=%d port: %v", tunnelID, chainType, nodeID, err)
+	}
 	if port < minPort || port > maxPort {
 		t.Fatalf("expected port in range [%d,%d], got %d", minPort, maxPort, port)
 	}
 }
 
-func assertCount(t *testing.T, r *repo.Repository, query string, arg interface{}, expected int) {
+func assertCount(t *testing.T, repo *sqlite.Repository, query string, arg interface{}, expected int) {
 	t.Helper()
-	got := mustQueryInt(t, r, query, arg)
+	var got int
+	if err := repo.DB().QueryRow(query, arg).Scan(&got); err != nil {
+		t.Fatalf("count query failed: %v", err)
+	}
 	if got != expected {
 		t.Fatalf("expected count %d, got %d (query: %s, arg: %v)", expected, got, query, arg)
 	}
@@ -609,12 +638,12 @@ func startMockNodeSessionWithHook(t *testing.T, baseURL string, nodeSecret strin
 	}
 }
 
-func waitNodeStatus(t *testing.T, r *repo.Repository, nodeID int64, expectedStatus int) {
+func waitNodeStatus(t *testing.T, repo *sqlite.Repository, nodeID int64, expectedStatus int) {
 	t.Helper()
 	deadline := time.Now().Add(2 * time.Second)
 	for {
-		status, err := tryQueryInt(t, r, `SELECT status FROM node WHERE id = ?`, nodeID)
-		if err == nil && status == expectedStatus {
+		var status int
+		if err := repo.DB().QueryRow(`SELECT status FROM node WHERE id = ?`, nodeID).Scan(&status); err == nil && status == expectedStatus {
 			return
 		}
 		if time.Now().After(deadline) {
@@ -624,6 +653,42 @@ func waitNodeStatus(t *testing.T, r *repo.Repository, nodeID int64, expectedStat
 	}
 }
 
+func valueAsInt(v interface{}) int {
+	switch n := v.(type) {
+	case float64:
+		return int(n)
+	case int:
+		return n
+	case int64:
+		return int(n)
+	default:
+		return 0
+	}
+}
+
+func valueAsString(v interface{}) string {
+	s, _ := v.(string)
+	return s
+}
+
+func valueAsBool(v interface{}) bool {
+	switch b := v.(type) {
+	case bool:
+		return b
+	case float64:
+		return b != 0
+	case int:
+		return b != 0
+	case int64:
+		return b != 0
+	case string:
+		s := strings.TrimSpace(strings.ToLower(b))
+		return s == "1" || s == "t" || s == "true" || s == "yes" || s == "y"
+	default:
+		return false
+	}
+}
+
 func TestFederationRuntimeCommandPortRangeEnforcement(t *testing.T) {
 	providerSecret := "provider-portrange-jwt"
 	providerRouter, providerRepo := setupContractRouter(t, providerSecret)
@@ -633,7 +698,7 @@ func TestFederationRuntimeCommandPortRangeEnforcement(t *testing.T) {
 	now := time.Now().UnixMilli()
 	providerNodeID := insertContractNode(t, providerRepo, "provider-portrange-node", "198.51.100.50", "44000-44010", "provider-portrange-secret", 1)
 
-	insertPeerShare(t, providerRepo, &repo.PeerShare{
+	insertPeerShare(t, providerRepo, &sqlite.PeerShare{
 		Name:           "portrange-share",
 		NodeID:         providerNodeID,
 		Token:          "share-portrange-token",
@@ -723,21 +788,6 @@ func TestFederationRuntimeCommandPortRangeEnforcement(t *testing.T) {
 	}
 
 	// Test: Non-service commands should pass through without port validation
-	res = sendCommand("share-portrange-token", "UpdateLimiters", map[string]interface{}{
-		"limiter": "federation-limit-test",
-		"data": map[string]interface{}{
-			"name":   "federation-limit-test",
-			"limits": []string{"$ 1MB 1MB"},
-		},
-	})
-	out = response.R{}
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected code 0 for UpdateLimiters command, got %d (msg: %s)", out.Code, out.Msg)
-	}
-
 	res = sendCommand("share-portrange-token", "reload", nil)
 	out = response.R{}
 	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {

go-backend/tests/contract/federation_forward_flow_linkage_contract_test.go

@@ -1,693 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"net/http"
-	"net/http/httptest"
-	"strconv"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
-)
-
-func TestFederationForwardCardFlowLinkageContract(t *testing.T) {
-	secret := "federation-forward-flow-contract-jwt"
-	router, r := setupContractRouter(t, secret)
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "flow-local-node", "flow-local-secret", "10.20.30.40", "10.20.30.40", "", "32000-32020", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
-		t.Fatalf("insert local node: %v", err)
-	}
-	nodeID := mustLastInsertID(t, r, "flow-local-node")
-
-	shareToken := "flow-linkage-share-token"
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "flow-linkage-share",
-		NodeID:         nodeID,
-		Token:          shareToken,
-		MaxBandwidth:   0,
-		CurrentFlow:    1536,
-		ExpiryTime:     0,
-		PortRangeStart: 32000,
-		PortRangeEnd:   32020,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken(shareToken)
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	tunnelName := fmt.Sprintf("Share-%d-Port-%d", share.ID, 32001)
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, tunnelName, 1, "tcp", 1, now, now, 1, "", 0).Error; err != nil {
-		t.Fatalf("insert share tunnel: %v", err)
-	}
-	tunnelID := mustLastInsertID(t, r, "flow-share-tunnel")
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 1, "admin_user", "flow-linkage-forward", tunnelID, "1.1.1.1:443", "fifo", 0, 0, now, now, 1, 0).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	forwardID := mustLastInsertID(t, r, "flow-linkage-forward")
-
-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeID, 32001).Error; err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	forwardOut := requestContractEnvelope(t, router, adminToken, "/api/v1/forward/list", nil)
-	if forwardOut.Code != 0 {
-		t.Fatalf("forward list failed: code=%d msg=%q", forwardOut.Code, forwardOut.Msg)
-	}
-	forwardRows := mustContractSlice(t, forwardOut.Data, "forward list data")
-
-	var targetForward map[string]interface{}
-	for _, row := range forwardRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if contractValueAsInt64(m["id"]) == forwardID {
-			targetForward = m
-			break
-		}
-	}
-	if targetForward == nil {
-		t.Fatalf("target forward %d not found in /forward/list response", forwardID)
-	}
-
-	shareOut := requestContractEnvelope(t, router, adminToken, "/api/v1/federation/share/list", nil)
-	if shareOut.Code != 0 {
-		t.Fatalf("share list failed: code=%d msg=%q", shareOut.Code, shareOut.Msg)
-	}
-	localShareRows := mustContractSlice(t, shareOut.Data, "share list data")
-
-	remoteUsageOut := requestContractEnvelope(t, router, adminToken, "/api/v1/federation/share/remote-usage/list", nil)
-	if remoteUsageOut.Code != 0 {
-		t.Fatalf("remote usage list failed: code=%d msg=%q", remoteUsageOut.Code, remoteUsageOut.Msg)
-	}
-	remoteUsageRows := mustContractSlice(t, remoteUsageOut.Data, "remote usage data")
-	if len(remoteUsageRows) != 0 {
-		t.Fatalf("expected no remote usage rows in local-only fixture, got %d", len(remoteUsageRows))
-	}
-
-	flowByShare := make(map[int64]int64)
-	for _, row := range remoteUsageRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		shareID := contractValueAsInt64(m["shareId"])
-		currentFlow := contractValueAsInt64(m["currentFlow"])
-		if shareID > 0 && currentFlow > 0 {
-			if currentFlow > flowByShare[shareID] {
-				flowByShare[shareID] = currentFlow
-			}
-		}
-	}
-	for _, row := range localShareRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		shareID := contractValueAsInt64(m["id"])
-		currentFlow := contractValueAsInt64(m["currentFlow"])
-		if shareID > 0 && currentFlow > 0 {
-			if currentFlow > flowByShare[shareID] {
-				flowByShare[shareID] = currentFlow
-			}
-		}
-	}
-
-	parsedShareID := contractParseShareIDFromTunnelName(contractValueAsString(targetForward["tunnelName"]))
-	if parsedShareID != share.ID {
-		t.Fatalf("expected parsed shareID=%d, got %d (tunnelName=%q)", share.ID, parsedShareID, contractValueAsString(targetForward["tunnelName"]))
-	}
-
-	forwardCountByShare := make(map[int64]int)
-	for _, row := range forwardRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		sid := contractParseShareIDFromTunnelName(contractValueAsString(m["tunnelName"]))
-		if sid > 0 && flowByShare[sid] > 0 {
-			forwardCountByShare[sid] = forwardCountByShare[sid] + 1
-		}
-	}
-
-	directFlow := contractValueAsInt64(targetForward["inFlow"]) + contractValueAsInt64(targetForward["outFlow"])
-	if directFlow != 0 {
-		t.Fatalf("fixture expectation failed: directFlow should be 0, got %d", directFlow)
-	}
-
-	shareFlow := flowByShare[parsedShareID]
-	if shareFlow <= 0 {
-		t.Fatalf("expected merged share flow > 0 for share %d", parsedShareID)
-	}
-
-	count := forwardCountByShare[parsedShareID]
-	if count <= 0 {
-		count = 1
-	}
-	estimated := shareFlow / int64(count)
-	if estimated < 1 {
-		estimated = 1
-	}
-	displayFlow := estimated
-
-	if displayFlow <= 0 {
-		t.Fatalf("expected displayFlow > 0 after frontend-style merge, got %d", displayFlow)
-	}
-	if displayFlow != share.CurrentFlow {
-		t.Fatalf("expected displayFlow=%d, got %d", share.CurrentFlow, displayFlow)
-	}
-}
-
-func TestFederationForwardCardFlowLinkageContractSplitShareFlowAcrossMultipleForwards(t *testing.T) {
-	secret := "federation-forward-split-flow-contract-jwt"
-	router, r := setupContractRouter(t, secret)
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	now := time.Now().UnixMilli()
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "flow-split-local-node", "flow-split-local-secret", "10.21.31.41", "10.21.31.41", "", "32100-32120", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 0, "", "", "").Error; err != nil {
-		t.Fatalf("insert local node: %v", err)
-	}
-	nodeID := mustLastInsertID(t, r, "flow-split-local-node")
-
-	shareToken := "flow-split-share-token"
-	if err := r.CreatePeerShare(&repo.PeerShare{
-		Name:           "flow-split-share",
-		NodeID:         nodeID,
-		Token:          shareToken,
-		MaxBandwidth:   0,
-		CurrentFlow:    4097,
-		ExpiryTime:     0,
-		PortRangeStart: 32100,
-		PortRangeEnd:   32120,
-		IsActive:       1,
-		CreatedTime:    now,
-		UpdatedTime:    now,
-	}); err != nil {
-		t.Fatalf("create share: %v", err)
-	}
-	share, err := r.GetPeerShareByToken(shareToken)
-	if err != nil || share == nil {
-		t.Fatalf("load share: %v", err)
-	}
-
-	createShareForward := func(name string, port int) int64 {
-		t.Helper()
-
-		tunnelName := fmt.Sprintf("Share-%d-Port-%d", share.ID, port)
-		if err := r.DB().Exec(`
-			INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, tunnelName, 1, "tcp", 1, now, now, 1, "", 0).Error; err != nil {
-			t.Fatalf("insert share tunnel: %v", err)
-		}
-		tunnelID := mustLastInsertID(t, r, "flow-split-tunnel")
-
-		if err := r.DB().Exec(`
-			INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, 1, "admin_user", name, tunnelID, "1.1.1.1:443", "fifo", 0, 0, now, now, 1, 0).Error; err != nil {
-			t.Fatalf("insert forward: %v", err)
-		}
-		forwardID := mustLastInsertID(t, r, name)
-
-		if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeID, port).Error; err != nil {
-			t.Fatalf("insert forward_port: %v", err)
-		}
-
-		return forwardID
-	}
-
-	forwardIDA := createShareForward("flow-split-forward-a", 32101)
-	forwardIDB := createShareForward("flow-split-forward-b", 32102)
-
-	forwardOut := requestContractEnvelope(t, router, adminToken, "/api/v1/forward/list", nil)
-	if forwardOut.Code != 0 {
-		t.Fatalf("forward list failed: code=%d msg=%q", forwardOut.Code, forwardOut.Msg)
-	}
-	forwardRows := mustContractSlice(t, forwardOut.Data, "forward list data")
-
-	shareOut := requestContractEnvelope(t, router, adminToken, "/api/v1/federation/share/list", nil)
-	if shareOut.Code != 0 {
-		t.Fatalf("share list failed: code=%d msg=%q", shareOut.Code, shareOut.Msg)
-	}
-	localShareRows := mustContractSlice(t, shareOut.Data, "share list data")
-
-	remoteUsageOut := requestContractEnvelope(t, router, adminToken, "/api/v1/federation/share/remote-usage/list", nil)
-	if remoteUsageOut.Code != 0 {
-		t.Fatalf("remote usage list failed: code=%d msg=%q", remoteUsageOut.Code, remoteUsageOut.Msg)
-	}
-	remoteUsageRows := mustContractSlice(t, remoteUsageOut.Data, "remote usage data")
-	if len(remoteUsageRows) != 0 {
-		t.Fatalf("expected no remote usage rows in local-only fixture, got %d", len(remoteUsageRows))
-	}
-
-	flowByShare := make(map[int64]int64)
-	for _, row := range remoteUsageRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		shareID := contractValueAsInt64(m["shareId"])
-		currentFlow := contractValueAsInt64(m["currentFlow"])
-		if shareID > 0 && currentFlow > 0 {
-			if currentFlow > flowByShare[shareID] {
-				flowByShare[shareID] = currentFlow
-			}
-		}
-	}
-	for _, row := range localShareRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		shareID := contractValueAsInt64(m["id"])
-		currentFlow := contractValueAsInt64(m["currentFlow"])
-		if shareID > 0 && currentFlow > 0 {
-			if currentFlow > flowByShare[shareID] {
-				flowByShare[shareID] = currentFlow
-			}
-		}
-	}
-
-	shareFlow := flowByShare[share.ID]
-	if shareFlow <= 0 {
-		t.Fatalf("expected merged share flow > 0 for share %d", share.ID)
-	}
-
-	forwardCountByShare := make(map[int64]int)
-	for _, row := range forwardRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		sid := contractParseShareIDFromTunnelName(contractValueAsString(m["tunnelName"]))
-		if sid > 0 && flowByShare[sid] > 0 {
-			forwardCountByShare[sid] = forwardCountByShare[sid] + 1
-		}
-	}
-
-	count := forwardCountByShare[share.ID]
-	if count != 2 {
-		t.Fatalf("expected 2 forwards sharing share %d, got %d", share.ID, count)
-	}
-
-	expectedEach := shareFlow / int64(count)
-	if expectedEach < 1 {
-		expectedEach = 1
-	}
-
-	findForward := func(forwardID int64) map[string]interface{} {
-		t.Helper()
-		for _, row := range forwardRows {
-			m, ok := row.(map[string]interface{})
-			if !ok {
-				continue
-			}
-			if contractValueAsInt64(m["id"]) == forwardID {
-				return m
-			}
-		}
-		t.Fatalf("forward %d not found in /forward/list response", forwardID)
-		return nil
-	}
-
-	for _, forwardID := range []int64{forwardIDA, forwardIDB} {
-		forward := findForward(forwardID)
-		sid := contractParseShareIDFromTunnelName(contractValueAsString(forward["tunnelName"]))
-		if sid != share.ID {
-			t.Fatalf("expected parsed shareID=%d, got %d for forward %d", share.ID, sid, forwardID)
-		}
-
-		directFlow := contractValueAsInt64(forward["inFlow"]) + contractValueAsInt64(forward["outFlow"])
-		if directFlow != 0 {
-			t.Fatalf("fixture expectation failed: directFlow should be 0 for forward %d, got %d", forwardID, directFlow)
-		}
-
-		displayFlow := int64(0)
-		if directFlow > 0 {
-			displayFlow = directFlow
-		} else {
-			shareFlowForForward := flowByShare[sid]
-			if shareFlowForForward > 0 {
-				cnt := forwardCountByShare[sid]
-				if cnt <= 0 {
-					cnt = 1
-				}
-				estimated := shareFlowForForward / int64(cnt)
-				if estimated < 1 {
-					estimated = 1
-				}
-				displayFlow = estimated
-			}
-		}
-
-		if displayFlow <= 0 {
-			t.Fatalf("expected displayFlow > 0 for forward %d, got %d", forwardID, displayFlow)
-		}
-		if displayFlow != expectedEach {
-			t.Fatalf("expected displayFlow=%d for forward %d, got %d", expectedEach, forwardID, displayFlow)
-		}
-	}
-}
-
-func TestFederationForwardCardFlowLinkageContractResolvesShareByTunnelBindingWhenTunnelNameIsCustom(t *testing.T) {
-	secret := "federation-forward-binding-flow-contract-jwt"
-	router, r := setupContractRouter(t, secret)
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	now := time.Now().UnixMilli()
-	remoteShareID := int64(901)
-	remoteShareFlow := int64(5000)
-
-	if err := r.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx, is_remote, remote_url, remote_token, remote_config)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`,
-		"flow-binding-remote-node", "flow-binding-remote-secret", "10.31.41.51", "10.31.41.51", "", "33000-33020", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0, 1, "", "", fmt.Sprintf(`{"shareId":%d,"maxBandwidth":0,"currentFlow":%d,"portRangeStart":33000,"portRangeEnd":33020}`, remoteShareID, remoteShareFlow),
-	).Error; err != nil {
-		t.Fatalf("insert remote node: %v", err)
-	}
-	remoteNodeID := mustLastInsertID(t, r, "flow-binding-remote-node")
-
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "federation-port-forward-custom-name", 1, "tcp", 1, now, now, 1, "", 0).Error; err != nil {
-		t.Fatalf("insert custom tunnel: %v", err)
-	}
-	tunnelID := mustLastInsertID(t, r, "flow-binding-custom-tunnel")
-
-	if err := r.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, 1, "admin_user", "flow-binding-forward", tunnelID, "1.1.1.1:443", "fifo", 0, 0, now, now, 1, 0).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	forwardID := mustLastInsertID(t, r, "flow-binding-forward")
-
-	if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, remoteNodeID, 33001).Error; err != nil {
-		t.Fatalf("insert forward_port: %v", err)
-	}
-
-	forwardOut := requestContractEnvelope(t, router, adminToken, "/api/v1/forward/list", nil)
-	if forwardOut.Code != 0 {
-		t.Fatalf("forward list failed: code=%d msg=%q", forwardOut.Code, forwardOut.Msg)
-	}
-	forwardRows := mustContractSlice(t, forwardOut.Data, "forward list data")
-
-	shareOut := requestContractEnvelope(t, router, adminToken, "/api/v1/federation/share/list", nil)
-	if shareOut.Code != 0 {
-		t.Fatalf("share list failed: code=%d msg=%q", shareOut.Code, shareOut.Msg)
-	}
-	localShareRows := mustContractSlice(t, shareOut.Data, "share list data")
-
-	remoteUsageOut := requestContractEnvelope(t, router, adminToken, "/api/v1/federation/share/remote-usage/list", nil)
-	if remoteUsageOut.Code != 0 {
-		t.Fatalf("remote usage list failed: code=%d msg=%q", remoteUsageOut.Code, remoteUsageOut.Msg)
-	}
-	remoteUsageRows := mustContractSlice(t, remoteUsageOut.Data, "remote usage data")
-	if len(remoteUsageRows) == 0 {
-		t.Fatalf("expected non-empty remote usage rows")
-	}
-
-	findForward := func(id int64) map[string]interface{} {
-		t.Helper()
-		for _, row := range forwardRows {
-			m, ok := row.(map[string]interface{})
-			if !ok {
-				continue
-			}
-			if contractValueAsInt64(m["id"]) == id {
-				return m
-			}
-		}
-		t.Fatalf("forward %d not found in /forward/list response", id)
-		return nil
-	}
-
-	flowByShare := make(map[int64]int64)
-	shareIDsByTunnel := make(map[int64]map[int64]struct{})
-
-	for _, row := range remoteUsageRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		shareID := contractValueAsInt64(m["shareId"])
-		currentFlow := contractValueAsInt64(m["currentFlow"])
-		if shareID > 0 && currentFlow > 0 {
-			if currentFlow > flowByShare[shareID] {
-				flowByShare[shareID] = currentFlow
-			}
-		}
-
-		bindings, _ := m["bindings"].([]interface{})
-		for _, bindingRaw := range bindings {
-			binding, ok := bindingRaw.(map[string]interface{})
-			if !ok {
-				continue
-			}
-			tunnelIDVal := contractValueAsInt64(binding["tunnelId"])
-			chainType := contractValueAsInt64(binding["chainType"])
-			if shareID <= 0 || tunnelIDVal <= 0 {
-				continue
-			}
-			if chainType != 1 {
-				continue
-			}
-			setByTunnel, ok := shareIDsByTunnel[tunnelIDVal]
-			if !ok {
-				setByTunnel = make(map[int64]struct{})
-				shareIDsByTunnel[tunnelIDVal] = setByTunnel
-			}
-			setByTunnel[shareID] = struct{}{}
-		}
-	}
-
-	for _, row := range localShareRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		shareID := contractValueAsInt64(m["id"])
-		currentFlow := contractValueAsInt64(m["currentFlow"])
-		if shareID > 0 && currentFlow > 0 {
-			if currentFlow > flowByShare[shareID] {
-				flowByShare[shareID] = currentFlow
-			}
-		}
-	}
-
-	targetForward := findForward(forwardID)
-	parsedByName := contractParseShareIDFromTunnelName(contractValueAsString(targetForward["tunnelName"]))
-	if parsedByName != 0 {
-		t.Fatalf("expected custom tunnel name cannot be parsed as Share-*-Port-*, got %d", parsedByName)
-	}
-
-	resolveShareIDForForward := func(forward map[string]interface{}) int64 {
-		candidates := make(map[int64]struct{})
-
-		shareIDFromName := contractParseShareIDFromTunnelName(contractValueAsString(forward["tunnelName"]))
-		if shareIDFromName > 0 {
-			candidates[shareIDFromName] = struct{}{}
-		}
-
-		tunnelIDVal := contractValueAsInt64(forward["tunnelId"])
-		if setByTunnel, ok := shareIDsByTunnel[tunnelIDVal]; ok {
-			for sid := range setByTunnel {
-				candidates[sid] = struct{}{}
-			}
-		}
-
-		var bestShareID int64
-		bestFlow := int64(0)
-		for sid := range candidates {
-			flow := flowByShare[sid]
-			if flow > bestFlow {
-				bestFlow = flow
-				bestShareID = sid
-			}
-		}
-		return bestShareID
-	}
-
-	resolvedShareID := resolveShareIDForForward(targetForward)
-	if resolvedShareID != remoteShareID {
-		t.Fatalf("expected resolved shareID=%d via tunnel binding, got %d", remoteShareID, resolvedShareID)
-	}
-
-	forwardCountByShare := make(map[int64]int)
-	resolvedByForwardID := make(map[int64]int64)
-	for _, row := range forwardRows {
-		m, ok := row.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		fid := contractValueAsInt64(m["id"])
-		sid := resolveShareIDForForward(m)
-		if sid > 0 {
-			resolvedByForwardID[fid] = sid
-		}
-		if sid > 0 && flowByShare[sid] > 0 {
-			forwardCountByShare[sid] = forwardCountByShare[sid] + 1
-		}
-	}
-
-	directFlow := contractValueAsInt64(targetForward["inFlow"]) + contractValueAsInt64(targetForward["outFlow"])
-	if directFlow != 0 {
-		t.Fatalf("fixture expectation failed: directFlow should be 0, got %d", directFlow)
-	}
-
-	shareFlow := flowByShare[resolvedByForwardID[forwardID]]
-	if shareFlow <= 0 {
-		t.Fatalf("expected merged share flow > 0 for resolved share %d", resolvedByForwardID[forwardID])
-	}
-
-	count := forwardCountByShare[resolvedByForwardID[forwardID]]
-	if count <= 0 {
-		count = 1
-	}
-	estimated := shareFlow / int64(count)
-	if estimated < 1 {
-		estimated = 1
-	}
-
-	displayFlow := estimated
-	if displayFlow <= 0 {
-		t.Fatalf("expected displayFlow > 0 after tunnel-binding-based merge, got %d", displayFlow)
-	}
-	if displayFlow != remoteShareFlow {
-		t.Fatalf("expected displayFlow=%d, got %d", remoteShareFlow, displayFlow)
-	}
-}
-
-func requestContractEnvelope(t *testing.T, router http.Handler, token string, path string, body interface{}) response.R {
-	t.Helper()
-
-	payload := []byte("{}")
-	if body != nil {
-		raw, err := json.Marshal(body)
-		if err != nil {
-			t.Fatalf("marshal request body for %s: %v", path, err)
-		}
-		payload = raw
-	}
-
-	req := httptest.NewRequest(http.MethodPost, path, bytes.NewReader(payload))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected http 200 for %s, got %d", path, res.Code)
-	}
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response for %s: %v", path, err)
-	}
-
-	return out
-}
-
-func mustContractSlice(t *testing.T, data interface{}, label string) []interface{} {
-	t.Helper()
-
-	rows, ok := data.([]interface{})
-	if !ok {
-		t.Fatalf("expected %s to be []interface{}, got %T", label, data)
-	}
-	return rows
-}
-
-func contractParseShareIDFromTunnelName(tunnelName string) int64 {
-	normalized := strings.TrimSpace(tunnelName)
-	if !strings.HasPrefix(normalized, "Share-") {
-		return 0
-	}
-	raw := strings.TrimPrefix(normalized, "Share-")
-	idx := strings.Index(raw, "-Port-")
-	if idx <= 0 {
-		return 0
-	}
-	shareID, err := strconv.ParseInt(strings.TrimSpace(raw[:idx]), 10, 64)
-	if err != nil || shareID <= 0 {
-		return 0
-	}
-	return shareID
-}
-
-func contractValueAsInt64(v interface{}) int64 {
-	switch n := v.(type) {
-	case int64:
-		return n
-	case int:
-		return int64(n)
-	case float64:
-		return int64(n)
-	case json.Number:
-		i, err := n.Int64()
-		if err == nil {
-			return i
-		}
-		f, err := n.Float64()
-		if err == nil {
-			return int64(f)
-		}
-		return 0
-	case string:
-		i, err := strconv.ParseInt(strings.TrimSpace(n), 10, 64)
-		if err == nil {
-			return i
-		}
-		return 0
-	default:
-		return 0
-	}
-}
-
-func contractValueAsString(v interface{}) string {
-	s, _ := v.(string)
-	return s
-}

go-backend/tests/contract/flow_limit_forward_enable_contract_test.go

@@ -1,201 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-const contractBytesPerGB int64 = 1024 * 1024 * 1024
-
-func TestForwardResumeBlockedWhenUserFlowExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(2)
-	tunnelID := int64(1)
-	forwardID := int64(1)
-
-	flowGB := int64(120)
-	used := flowGB*contractBytesPerGB + 1
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'flow_user', 'pwd', 1, 2727251700000, ?, ?, 0, 1, 99999, ?, ?, 1)
-	`, userID, flowGB, used, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'flow_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, 'flow_user', 'flow_forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 0, 0)
-	`, forwardID, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "flow_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/resume", bytes.NewBufferString(`{"id":1}`))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when flow exceeded")
-	}
-	if !strings.Contains(out.Msg, "流量") {
-		t.Fatalf("expected flow exceeded message, got %q", out.Msg)
-	}
-
-	status := mustQueryInt(t, repo, `SELECT status FROM forward WHERE id = ?`, forwardID)
-	if status != 0 {
-		t.Fatalf("expected forward status to remain 0, got %d", status)
-	}
-}
-
-func TestForwardResumeBlockedWhenUserTunnelFlowExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(2)
-	tunnelID := int64(1)
-	forwardID := int64(1)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'ut_flow_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, userID, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'ut_flow_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-
-	utFlowGB := int64(120)
-	utUsed := utFlowGB * contractBytesPerGB
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 99999, ?, ?, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID, utFlowGB, utUsed).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(?, ?, 'ut_flow_user', 'ut_flow_forward', ?, '8.8.8.8:53', 'fifo', 0, 0, ?, ?, 0, 0)
-	`, forwardID, userID, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "ut_flow_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/resume", bytes.NewBufferString(`{"id":1}`))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when tunnel flow exceeded")
-	}
-	if !strings.Contains(out.Msg, "隧道") || !strings.Contains(out.Msg, "流量") {
-		t.Fatalf("expected tunnel flow exceeded message, got %q", out.Msg)
-	}
-}
-
-func TestForwardCreateBlockedWhenFlowExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	userID := int64(2)
-	tunnelID := int64(1)
-
-	flowGB := int64(120)
-	used := flowGB*contractBytesPerGB + 1
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(?, 'create_flow_user', 'pwd', 1, 2727251700000, ?, ?, 0, 1, 99999, ?, ?, 1)
-	`, userID, flowGB, used, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 'create_flow_tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, ?, ?, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, userID, tunnelID).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-
-	token, err := auth.GenerateToken(userID, "create_flow_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-
-	payload := `{"tunnelId":1,"name":"n","remoteAddr":"1.1.1.1:53"}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewBufferString(payload))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when flow exceeded")
-	}
-	if !strings.Contains(out.Msg, "流量") {
-		t.Fatalf("expected flow exceeded message, got %q", out.Msg)
-	}
-}

go-backend/tests/contract/group_permission_contract_test.go

@@ -15,35 +15,47 @@ func TestGroupUserUnbindRevokesInheritedTunnelPermission(t *testing.T) {
 	router, repo := setupContractRouter(t, secret)
 	now := time.Now().UnixMilli()
 
-	if err := repo.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
 		VALUES(200, 'group_user_contract', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now).Error; err != nil {
+	`, now, now); err != nil {
 		t.Fatalf("insert test user: %v", err)
 	}
 
-	if err := repo.DB().Exec(`
+	tunnelRes, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES('group-contract-tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, now, now).Error; err != nil {
+	`, now, now)
+	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
-	tunnelID := mustLastInsertID(t, repo, "group-contract-tunnel")
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel id: %v", err)
+	}
 
-	if err := repo.DB().Exec(`INSERT INTO user_group(name, created_time, updated_time, status) VALUES('ug-contract', ?, ?, 1)`, now, now).Error; err != nil {
+	ugRes, err := repo.DB().Exec(`INSERT INTO user_group(name, created_time, updated_time, status) VALUES('ug-contract', ?, ?, 1)`, now, now)
+	if err != nil {
 		t.Fatalf("insert user_group: %v", err)
 	}
-	userGroupID := mustLastInsertID(t, repo, "ug-contract")
+	userGroupID, err := ugRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read user_group id: %v", err)
+	}
 
-	if err := repo.DB().Exec(`INSERT INTO tunnel_group(name, created_time, updated_time, status) VALUES('tg-contract', ?, ?, 1)`, now, now).Error; err != nil {
+	tgRes, err := repo.DB().Exec(`INSERT INTO tunnel_group(name, created_time, updated_time, status) VALUES('tg-contract', ?, ?, 1)`, now, now)
+	if err != nil {
 		t.Fatalf("insert tunnel_group: %v", err)
 	}
-	tunnelGroupID := mustLastInsertID(t, repo, "tg-contract")
+	tunnelGroupID, err := tgRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel_group id: %v", err)
+	}
 
-	if err := repo.DB().Exec(`INSERT INTO tunnel_group_tunnel(tunnel_group_id, tunnel_id, created_time) VALUES(?, ?, ?)`, tunnelGroupID, tunnelID, now).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO tunnel_group_tunnel(tunnel_group_id, tunnel_id, created_time) VALUES(?, ?, ?)`, tunnelGroupID, tunnelID, now); err != nil {
 		t.Fatalf("insert tunnel_group_tunnel: %v", err)
 	}
-	if err := repo.DB().Exec(`INSERT INTO group_permission(user_group_id, tunnel_group_id, created_time) VALUES(?, ?, ?)`, userGroupID, tunnelGroupID, now).Error; err != nil {
+	if _, err := repo.DB().Exec(`INSERT INTO group_permission(user_group_id, tunnel_group_id, created_time) VALUES(?, ?, ?)`, userGroupID, tunnelGroupID, now); err != nil {
 		t.Fatalf("insert group_permission: %v", err)
 	}
 
@@ -58,9 +70,15 @@ func TestGroupUserUnbindRevokesInheritedTunnelPermission(t *testing.T) {
 	router.ServeHTTP(bindRes, bindReq)
 	assertCode(t, bindRes, 0)
 
-	userTunnelID := mustQueryInt64(t, repo, `SELECT id FROM user_tunnel WHERE user_id = 200 AND tunnel_id = ?`, tunnelID)
+	var userTunnelID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 200 AND tunnel_id = ?`, tunnelID).Scan(&userTunnelID); err != nil {
+		t.Fatalf("query user_tunnel after bind: %v", err)
+	}
 
-	grantCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID)
+	var grantCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after bind: %v", err)
+	}
 	if grantCount == 0 {
 		t.Fatalf("expected non-zero grants after bind")
 	}
@@ -71,12 +89,17 @@ func TestGroupUserUnbindRevokesInheritedTunnelPermission(t *testing.T) {
 	router.ServeHTTP(unbindRes, unbindReq)
 	assertCode(t, unbindRes, 0)
 
-	grantCount = mustQueryInt(t, repo, `SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID)
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after unbind: %v", err)
+	}
 	if grantCount != 0 {
 		t.Fatalf("expected grants revoked after unbind, got %d", grantCount)
 	}
 
-	userTunnelCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM user_tunnel WHERE id = ?`, userTunnelID)
+	var userTunnelCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM user_tunnel WHERE id = ?`, userTunnelID).Scan(&userTunnelCount); err != nil {
+		t.Fatalf("query user_tunnel after unbind: %v", err)
+	}
 	if userTunnelCount != 0 {
 		t.Fatalf("expected user_tunnel revoked after unbind, got %d", userTunnelCount)
 	}
@@ -87,30 +110,42 @@ func TestGroupPermissionRemoveRevokesInheritedTunnelPermission(t *testing.T) {
 	router, repo := setupContractRouter(t, secret)
 	now := time.Now().UnixMilli()
 
-	if err := repo.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
 		VALUES(201, 'group_user_permission_remove', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now).Error; err != nil {
+	`, now, now); err != nil {
 		t.Fatalf("insert test user: %v", err)
 	}
 
-	if err := repo.DB().Exec(`
+	tunnelRes, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES('group-remove-tunnel', 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, now, now).Error; err != nil {
+	`, now, now)
+	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
-	tunnelID := mustLastInsertID(t, repo, "group-remove-tunnel")
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel id: %v", err)
+	}
 
-	if err := repo.DB().Exec(`INSERT INTO user_group(name, created_time, updated_time, status) VALUES('ug-remove-contract', ?, ?, 1)`, now, now).Error; err != nil {
+	ugRes, err := repo.DB().Exec(`INSERT INTO user_group(name, created_time, updated_time, status) VALUES('ug-remove-contract', ?, ?, 1)`, now, now)
+	if err != nil {
 		t.Fatalf("insert user_group: %v", err)
 	}
-	userGroupID := mustLastInsertID(t, repo, "ug-remove-contract")
+	userGroupID, err := ugRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read user_group id: %v", err)
+	}
 
-	if err := repo.DB().Exec(`INSERT INTO tunnel_group(name, created_time, updated_time, status) VALUES('tg-remove-contract', ?, ?, 1)`, now, now).Error; err != nil {
+	tgRes, err := repo.DB().Exec(`INSERT INTO tunnel_group(name, created_time, updated_time, status) VALUES('tg-remove-contract', ?, ?, 1)`, now, now)
+	if err != nil {
 		t.Fatalf("insert tunnel_group: %v", err)
 	}
-	tunnelGroupID := mustLastInsertID(t, repo, "tg-remove-contract")
+	tunnelGroupID, err := tgRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("read tunnel_group id: %v", err)
+	}
 
 	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
 	if err != nil {
@@ -135,11 +170,20 @@ func TestGroupPermissionRemoveRevokesInheritedTunnelPermission(t *testing.T) {
 	router.ServeHTTP(assignPermissionRes, assignPermissionReq)
 	assertCode(t, assignPermissionRes, 0)
 
-	permissionID := mustQueryInt64(t, repo, `SELECT id FROM group_permission WHERE user_group_id = ? AND tunnel_group_id = ?`, userGroupID, tunnelGroupID)
+	var permissionID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM group_permission WHERE user_group_id = ? AND tunnel_group_id = ?`, userGroupID, tunnelGroupID).Scan(&permissionID); err != nil {
+		t.Fatalf("query group_permission id: %v", err)
+	}
 
-	userTunnelID := mustQueryInt64(t, repo, `SELECT id FROM user_tunnel WHERE user_id = 201 AND tunnel_id = ?`, tunnelID)
+	var userTunnelID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM user_tunnel WHERE user_id = 201 AND tunnel_id = ?`, tunnelID).Scan(&userTunnelID); err != nil {
+		t.Fatalf("query user_tunnel after assign: %v", err)
+	}
 
-	grantCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID)
+	var grantCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after assign: %v", err)
+	}
 	if grantCount == 0 {
 		t.Fatalf("expected non-zero grants after permission assign")
 	}
@@ -150,17 +194,25 @@ func TestGroupPermissionRemoveRevokesInheritedTunnelPermission(t *testing.T) {
 	router.ServeHTTP(removeRes, removeReq)
 	assertCode(t, removeRes, 0)
 
-	permissionCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM group_permission WHERE id = ?`, permissionID)
+	var permissionCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission WHERE id = ?`, permissionID).Scan(&permissionCount); err != nil {
+		t.Fatalf("query group_permission after remove: %v", err)
+	}
 	if permissionCount != 0 {
 		t.Fatalf("expected group_permission removed, got %d", permissionCount)
 	}
 
-	grantCount = mustQueryInt(t, repo, `SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID)
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM group_permission_grant WHERE user_tunnel_id = ?`, userTunnelID).Scan(&grantCount); err != nil {
+		t.Fatalf("query group_permission_grant after remove: %v", err)
+	}
 	if grantCount != 0 {
 		t.Fatalf("expected grants removed after permission remove, got %d", grantCount)
 	}
 
-	userTunnelCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM user_tunnel WHERE id = ?`, userTunnelID)
+	var userTunnelCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM user_tunnel WHERE id = ?`, userTunnelID).Scan(&userTunnelCount); err != nil {
+		t.Fatalf("query user_tunnel after permission remove: %v", err)
+	}
 	if userTunnelCount != 0 {
 		t.Fatalf("expected user_tunnel revoked after permission remove, got %d", userTunnelCount)
 	}

go-backend/tests/contract/issue313_entry_port_conflict_contract_test.go

@@ -1,193 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-func TestIssue313_EntryPortCrossTunnelConflictContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	insertNode := func(name, ip, portRange string) int64 {
-		if err := repo.DB().Exec(`
-			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
-			t.Fatalf("insert node %s: %v", name, err)
-		}
-		return mustLastInsertID(t, repo, name)
-	}
-
-	entryB1 := insertNode("issue313-entry-b1", "10.100.0.2", "2000-2010")
-	entryB2 := insertNode("issue313-entry-b2", "10.100.0.3", "2000-2010")
-	chainA := insertNode("issue313-chain-a", "10.100.0.4", "3000-3010")
-	chainB := insertNode("issue313-chain-b", "10.100.0.5", "3000-3010")
-	exitA := insertNode("issue313-exit-a", "10.100.0.6", "4000-4010")
-	exitB := insertNode("issue313-exit-b", "10.100.0.7", "4000-4010")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "issue313-tunnel-a", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel a: %v", err)
-	}
-	tunnelAID := mustLastInsertID(t, repo, "issue313-tunnel-a")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 2000, 'round', 1, 'tls')
-	`, tunnelAID, entryB2).Error; err != nil {
-		t.Fatalf("insert chain_tunnel entry a: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 2, ?, 3000, 'round', 1, 'tls')
-	`, tunnelAID, chainA).Error; err != nil {
-		t.Fatalf("insert chain_tunnel chain a: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 3, ?, 4000, 'round', 1, 'tls')
-	`, tunnelAID, exitA).Error; err != nil {
-		t.Fatalf("insert chain_tunnel exit a: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "issue313-tunnel-b", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
-		t.Fatalf("insert tunnel b: %v", err)
-	}
-	tunnelBID := mustLastInsertID(t, repo, "issue313-tunnel-b")
-
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 2000, 'round', 1, 'tls')
-	`, tunnelBID, entryB1).Error; err != nil {
-		t.Fatalf("insert chain_tunnel entry b1: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 2, ?, 3000, 'round', 1, 'tls')
-	`, tunnelBID, chainB).Error; err != nil {
-		t.Fatalf("insert chain_tunnel chain b: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 3, ?, 4000, 'round', 1, 'tls')
-	`, tunnelBID, exitB).Error; err != nil {
-		t.Fatalf("insert chain_tunnel exit b: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(3131, 1, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, tunnelAID).Error; err != nil {
-		t.Fatalf("insert user_tunnel for tunnel a: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, 'admin_user', 'issue313-forward-a', ?, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, tunnelAID, now, now).Error; err != nil {
-		t.Fatalf("insert forward a: %v", err)
-	}
-	forwardAID := mustLastInsertID(t, repo, "issue313-forward-a")
-
-	if err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardAID, entryB2, 2000).Error; err != nil {
-		t.Fatalf("insert forward_port a: %v", err)
-	}
-
-	// Simulate legacy dirty data: tunnel A already occupies port 2000 on entryB2.
-	// When tunnel B adds entryB2, the inherited forward port should conflict cross-tunnel.
-	if err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardAID, entryB2, 2000).Error; err != nil {
-		t.Fatalf("insert forward_port a on entryB2: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(3132, 1, ?, NULL, 999, 99999, 0, 0, 1, 2727251700000, 1)
-	`, tunnelBID).Error; err != nil {
-		t.Fatalf("insert user_tunnel for tunnel b: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, 'admin_user', 'issue313-forward-b', ?, '2.2.2.2:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, tunnelBID, now, now).Error; err != nil {
-		t.Fatalf("insert forward b: %v", err)
-	}
-	forwardBID := mustLastInsertID(t, repo, "issue313-forward-b")
-
-	if err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardBID, entryB1, 2000).Error; err != nil {
-		t.Fatalf("insert forward_port b: %v", err)
-	}
-
-	payload := map[string]interface{}{
-		"id":           tunnelBID,
-		"name":         "issue313-tunnel-b",
-		"type":         2,
-		"flow":         99999,
-		"trafficRatio": 1.0,
-		"status":       1,
-		"inNodeId": []map[string]interface{}{
-			{"nodeId": entryB1, "protocol": "tls", "strategy": "round"},
-			{"nodeId": entryB2, "protocol": "tls", "strategy": "round"},
-		},
-		"chainNodes": []interface{}{
-			[]map[string]interface{}{{"nodeId": chainB, "protocol": "tls", "strategy": "round"}},
-		},
-		"outNodeId": []map[string]interface{}{
-			{"nodeId": exitB, "protocol": "tls", "strategy": "round"},
-		},
-	}
-	body, err := json.Marshal(payload)
-	if err != nil {
-		t.Fatalf("marshal payload: %v", err)
-	}
-
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", bytes.NewReader(body))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-
-	if out.Code == 0 {
-		t.Fatalf("expected update failure due to cross-tunnel port conflict, got success with code 0")
-	}
-
-	msgBytes := []byte(out.Msg)
-	if !bytes.Contains(msgBytes, []byte("端口")) && !bytes.Contains(msgBytes, []byte("占用")) {
-		t.Fatalf("expected port conflict error message, got %q", out.Msg)
-	}
-
-	countB2 := mustQueryInt(t, repo, `SELECT COUNT(1) FROM forward_port WHERE forward_id = ? AND node_id = ?`, forwardBID, entryB2)
-	if countB2 > 0 {
-		t.Fatalf("expected no forward_port record for entryB2, but found %d", countB2)
-	}
-
-	chainCountB2 := mustQueryInt(t, repo, `SELECT COUNT(1) FROM chain_tunnel WHERE tunnel_id = ? AND node_id = ?`, tunnelBID, entryB2)
-	if chainCountB2 > 0 {
-		t.Fatalf("expected no chain_tunnel record for entryB2, but found %d", chainCountB2)
-	}
-}

go-backend/tests/contract/migration_contract_test.go

@@ -17,25 +17,26 @@ import (
 	httpserver "go-backend/internal/http"
 	"go-backend/internal/http/handler"
 	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store"
+	"go-backend/internal/store/sqlite"
 
-	"gorm.io/gorm"
+	_ "modernc.org/sqlite"
 )
 
 func TestCaptchaVerifyLoginContract(t *testing.T) {
 	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
-	verifiedToken := ""
+	router, repo := setupContractRouter(t, secret)
 
-	if err := r.DB().Exec(`
+	_, err := repo.DB().Exec(`
 		INSERT INTO vite_config(name, value, time)
 		VALUES(?, ?, ?)
 		ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-	`, "captcha_enabled", "true", time.Now().UnixMilli()).Error; err != nil {
+	`, "captcha_enabled", "true", time.Now().UnixMilli())
+	if err != nil {
 		t.Fatalf("enable captcha: %v", err)
 	}
 
-	t.Run("login allowed when cloudflare keys are missing", func(t *testing.T) {
+	t.Run("login denied without verified captcha token", func(t *testing.T) {
 		body := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":""}`)
 		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
 		req.Header.Set("Content-Type", "application/json")
@@ -43,10 +44,10 @@ func TestCaptchaVerifyLoginContract(t *testing.T) {
 
 		router.ServeHTTP(resp, req)
 
-		assertCode(t, resp, 0)
+		assertCodeMsg(t, resp, -1, "验证码校验失败")
 	})
 
-	t.Run("captcha verify remains compatible without cloudflare secret", func(t *testing.T) {
+	t.Run("captcha token is one-time and consumed by login", func(t *testing.T) {
 		verifyReq := httptest.NewRequest(http.MethodPost, "/api/v1/captcha/verify", bytes.NewBufferString(`{"id":"captcha-token-1","data":"ok"}`))
 		verifyReq.Header.Set("Content-Type", "application/json")
 		verifyResp := httptest.NewRecorder()
@@ -66,60 +67,14 @@ func TestCaptchaVerifyLoginContract(t *testing.T) {
 			t.Fatalf("unexpected captcha verify payload: success=%v token=%q", verifyOut.Success, verifyOut.Data.ValidToken)
 		}
 
-		verifiedToken = verifyOut.Data.ValidToken
-	})
-
-	if err := r.DB().Exec(`
-		INSERT INTO vite_config(name, value, time)
-		VALUES(?, ?, ?)
-		ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-	`, "cloudflare_site_key", "test-site-key", time.Now().UnixMilli()).Error; err != nil {
-		t.Fatalf("set cloudflare site key: %v", err)
-	}
-	if err := r.DB().Exec(`
-		INSERT INTO vite_config(name, value, time)
-		VALUES(?, ?, ?)
-		ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-	`, "cloudflare_secret_key", "test-secret-key", time.Now().UnixMilli()).Error; err != nil {
-		t.Fatalf("set cloudflare secret key: %v", err)
-	}
-
-	t.Run("login denied without verified captcha token", func(t *testing.T) {
-		body := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":""}`)
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
-		req.Header.Set("Content-Type", "application/json")
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		assertCodeMsg(t, resp, -1, "验证码校验失败")
-	})
-
-	t.Run("whmcs api client bypasses captcha", func(t *testing.T) {
-		body := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":""}`)
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", body)
-		req.Header.Set("Content-Type", "application/json")
-		req.Header.Set("X-FLVX-API-Client", "whmcs")
-		resp := httptest.NewRecorder()
-
-		router.ServeHTTP(resp, req)
-
-		assertCode(t, resp, 0)
-	})
-
-	t.Run("captcha token is one-time and consumed by login", func(t *testing.T) {
-		if strings.TrimSpace(verifiedToken) == "" {
-			t.Fatalf("expected verified token from compatibility captcha verify")
-		}
-
-		loginBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"` + verifiedToken + `"}`)
+		loginBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"captcha-token-1"}`)
 		loginReq := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", loginBody)
 		loginReq.Header.Set("Content-Type", "application/json")
 		loginResp := httptest.NewRecorder()
 		router.ServeHTTP(loginResp, loginReq)
 		assertCode(t, loginResp, 0)
 
-		replayBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"` + verifiedToken + `"}`)
+		replayBody := bytes.NewBufferString(`{"username":"admin_user","password":"admin_user","captchaId":"captcha-token-1"}`)
 		replayReq := httptest.NewRequest(http.MethodPost, "/api/v1/user/login", replayBody)
 		replayReq.Header.Set("Content-Type", "application/json")
 		replayResp := httptest.NewRecorder()
@@ -129,7 +84,7 @@ func TestCaptchaVerifyLoginContract(t *testing.T) {
 }
 
 func TestOpenAPISubStoreContracts(t *testing.T) {
-	router, r := setupContractRouter(t, "contract-jwt-secret")
+	router, repo := setupContractRouter(t, "contract-jwt-secret")
 
 	const tunnelFlowGB = int64(500)
 	const tunnelInFlow = int64(123)
@@ -137,13 +92,17 @@ func TestOpenAPISubStoreContracts(t *testing.T) {
 	const tunnelExpTimeMs = int64(2727251700000)
 
 	now := time.Now().UnixMilli()
-	if err := r.DB().Exec(`INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
-		"contract-tunnel", 1.0, 1, "tls", 1, now, now, 1, nil, 0).Error; err != nil {
+	res, err := repo.DB().Exec(`INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx) VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+		"contract-tunnel", 1.0, 1, "tls", 1, now, now, 1, nil, 0)
+	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
-	tunnelID := mustLastInsertID(t, r, "contract-tunnel")
-	if err := r.DB().Exec(`INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(?, ?, NULL, ?, ?, ?, ?, ?, ?, ?)`,
-		1, tunnelID, 99999, tunnelFlowGB, tunnelInFlow, tunnelOutFlow, 1, tunnelExpTimeMs, 1).Error; err != nil {
+	tunnelID, err := res.LastInsertId()
+	if err != nil {
+		t.Fatalf("last insert id: %v", err)
+	}
+	if _, err := repo.DB().Exec(`INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status) VALUES(?, ?, NULL, ?, ?, ?, ?, ?, ?, ?)`,
+		1, tunnelID, 99999, tunnelFlowGB, tunnelInFlow, tunnelOutFlow, 1, tunnelExpTimeMs, 1); err != nil {
 		t.Fatalf("insert user_tunnel: %v", err)
 	}
 
@@ -209,29 +168,44 @@ func TestOpenAPISubStoreContracts(t *testing.T) {
 	})
 }
 
-func TestSpeedLimitTunnelsRouteRemoved(t *testing.T) {
+func TestSpeedLimitTunnelsRouteAlias(t *testing.T) {
 	secret := "contract-jwt-secret"
 	router, _ := setupContractRouter(t, secret)
 
-	token, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
+	t.Run("missing token blocked", func(t *testing.T) {
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
+		resp := httptest.NewRecorder()
 
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
-	req.Header.Set("Authorization", token)
-	resp := httptest.NewRecorder()
+		router.ServeHTTP(resp, req)
 
-	router.ServeHTTP(resp, req)
+		assertCodeMsg(t, resp, 401, "未登录或token已过期")
+	})
 
-	if resp.Code != http.StatusNotFound {
-		t.Fatalf("expected status 404 after route removal, got %d", resp.Code)
-	}
+	t.Run("admin token receives success envelope", func(t *testing.T) {
+		token, err := auth.GenerateToken(1, "admin_user", 0, secret)
+		if err != nil {
+			t.Fatalf("generate token: %v", err)
+		}
+
+		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/tunnels", nil)
+		req.Header.Set("Authorization", token)
+		resp := httptest.NewRecorder()
+
+		router.ServeHTTP(resp, req)
+
+		var out response.R
+		if err := json.NewDecoder(resp.Body).Decode(&out); err != nil {
+			t.Fatalf("decode response: %v", err)
+		}
+		if out.Code != 0 {
+			t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
+		}
+	})
 }
 
 func TestBackupExportImportRestoreContracts(t *testing.T) {
 	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
+	router, repo := setupContractRouter(t, secret)
 
 	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
 	if err != nil {
@@ -243,11 +217,11 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 	}
 
 	key := "backup_contract_key"
-	if err := r.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO vite_config(name, value, time)
 		VALUES(?, ?, ?)
 		ON CONFLICT(name) DO UPDATE SET value = excluded.value, time = excluded.time
-	`, key, "v1", time.Now().UnixMilli()).Error; err != nil {
+	`, key, "v1", time.Now().UnixMilli()); err != nil {
 		t.Fatalf("seed config for backup contract: %v", err)
 	}
 
@@ -297,7 +271,7 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 			t.Fatalf("expected import code 0, got %d (%s)", out.Code, out.Msg)
 		}
 
-		cfg, err := r.GetConfigByName(key)
+		cfg, err := repo.GetConfigByName(key)
 		if err != nil {
 			t.Fatalf("query imported config: %v", err)
 		}
@@ -328,7 +302,7 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 			t.Fatalf("expected restore code 0, got %d (%s)", out.Code, out.Msg)
 		}
 
-		cfg, err := r.GetConfigByName(key)
+		cfg, err := repo.GetConfigByName(key)
 		if err != nil {
 			t.Fatalf("query restored config: %v", err)
 		}
@@ -340,28 +314,36 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 	t.Run("backup export and import preserve forward ports", func(t *testing.T) {
 		now := time.Now().UnixMilli()
 
-		if err := r.DB().Exec(`
+		tunnelRes, err := repo.DB().Exec(`
 			INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, "backup-forward-tunnel", 1.0, 1, "tls", 0, now, now, 1, "", 88).Error; err != nil {
+		`, "backup-forward-tunnel", 1.0, 1, "tls", 0, now, now, 1, "", 88)
+		if err != nil {
 			t.Fatalf("seed tunnel for forward backup: %v", err)
 		}
-		tunnelID := mustLastInsertID(t, r, "backup-forward-tunnel")
+		tunnelID, err := tunnelRes.LastInsertId()
+		if err != nil {
+			t.Fatalf("read tunnel id for forward backup: %v", err)
+		}
 
-		if err := r.DB().Exec(`
+		forwardRes, err := repo.DB().Exec(`
 			INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, 1, "admin_user", "backup-forward", tunnelID, "127.0.0.1:9000", "fifo", 0, 0, now, now, 1, 88).Error; err != nil {
+		`, 1, "admin_user", "backup-forward", tunnelID, "127.0.0.1:9000", "fifo", 0, 0, now, now, 1, 88)
+		if err != nil {
 			t.Fatalf("seed forward for backup: %v", err)
 		}
-		forwardID := mustLastInsertID(t, r, "backup-forward")
+		forwardID, err := forwardRes.LastInsertId()
+		if err != nil {
+			t.Fatalf("read forward id for backup: %v", err)
+		}
 
 		expected := map[int64]int{
 			2001: 21001,
 			2002: 21002,
 		}
 		for nodeID, port := range expected {
-			if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeID, port).Error; err != nil {
+			if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeID, port); err != nil {
 				t.Fatalf("seed forward_port %d:%d: %v", nodeID, port, err)
 			}
 		}
@@ -438,10 +420,10 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 			}
 		}
 
-		if err := r.DB().Exec(`DELETE FROM forward_port WHERE forward_id = ?`, forwardID).Error; err != nil {
+		if _, err := repo.DB().Exec(`DELETE FROM forward_port WHERE forward_id = ?`, forwardID); err != nil {
 			t.Fatalf("clear forward_port before import: %v", err)
 		}
-		if err := r.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, 9999, 39999).Error; err != nil {
+		if _, err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, 9999, 39999); err != nil {
 			t.Fatalf("seed wrong forward_port before import: %v", err)
 		}
 
@@ -465,7 +447,24 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 			t.Fatalf("expected forwards import code 0, got %d (%s)", out.Code, out.Msg)
 		}
 
-		after := mustQueryNodePorts(t, r, `SELECT node_id, port FROM forward_port WHERE forward_id = ? ORDER BY id ASC`, forwardID)
+		rows, err := repo.DB().Query(`SELECT node_id, port FROM forward_port WHERE forward_id = ? ORDER BY id ASC`, forwardID)
+		if err != nil {
+			t.Fatalf("query forward ports after import: %v", err)
+		}
+		defer rows.Close()
+
+		after := make(map[int64]int)
+		for rows.Next() {
+			var nodeID int64
+			var port int
+			if err := rows.Scan(&nodeID, &port); err != nil {
+				t.Fatalf("scan forward_port row: %v", err)
+			}
+			after[nodeID] = port
+		}
+		if err := rows.Err(); err != nil {
+			t.Fatalf("iterate forward_port rows: %v", err)
+		}
 
 		if len(after) != len(expected) {
 			t.Fatalf("expected %d forward ports after import, got %d (%v)", len(expected), len(after), after)
@@ -479,18 +478,22 @@ func TestBackupExportImportRestoreContracts(t *testing.T) {
 
 	t.Run("backup export tolerates nullable legacy tunnel chain fields", func(t *testing.T) {
 		now := time.Now().UnixMilli()
-		if err := r.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, "legacy-null-chain", 1.0, 1, "tls", 1000, now, now, 1, nil, 1).Error; err != nil {
+		`, "legacy-null-chain", 1.0, 1, "tls", 1000, now, now, 1, nil, 1)
+		if err != nil {
 			t.Fatalf("seed tunnel for nullable chain export: %v", err)
 		}
-		tunnelID := mustLastInsertID(t, r, "legacy-null-chain")
+		tunnelID, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("read tunnel id for nullable chain export: %v", err)
+		}
 
-		if err := r.DB().Exec(`
+		if _, err := repo.DB().Exec(`
 			INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
 			VALUES(?, ?, ?, ?, ?, ?, ?)
-		`, tunnelID, "1", 1, nil, nil, nil, nil).Error; err != nil {
+		`, tunnelID, "1", 1, nil, nil, nil, nil); err != nil {
 			t.Fatalf("seed nullable chain_tunnel row: %v", err)
 		}
 
@@ -593,19 +596,19 @@ func exportBackupPayload(t *testing.T, router http.Handler, path, token string)
 	return payload
 }
 
-func setupContractRouter(t *testing.T, jwtSecret string) (http.Handler, *repo.Repository) {
+func setupContractRouter(t *testing.T, jwtSecret string) (http.Handler, *sqlite.Repository) {
 	t.Helper()
 	dbPath := filepath.Join(t.TempDir(), "contract.db")
-	r, err := repo.Open(dbPath)
+	repo, err := sqlite.Open(dbPath)
 	if err != nil {
 		t.Fatalf("open sqlite: %v", err)
 	}
 	t.Cleanup(func() {
-		_ = r.Close()
+		_ = repo.Close()
 	})
 
-	h := handler.New(r, jwtSecret)
-	return httpserver.NewRouter(h, jwtSecret), r
+	h := handler.New(repo, jwtSecret)
+	return httpserver.NewRouter(h, jwtSecret), repo
 }
 
 func TestOpenMigratesLegacyNodeDualStackColumns(t *testing.T) {
@@ -666,15 +669,15 @@ func TestOpenMigratesLegacyNodeDualStackColumns(t *testing.T) {
 		t.Fatalf("seed legacy node row: %v", err)
 	}
 
-	r, err := repo.Open(dbPath)
+	repo, err := sqlite.Open(dbPath)
 	if err != nil {
 		t.Fatalf("open migrated sqlite: %v", err)
 	}
 	t.Cleanup(func() {
-		_ = r.Close()
+		_ = repo.Close()
 	})
 
-	nodes, err := r.ListNodes()
+	nodes, err := repo.ListNodes()
 	if err != nil {
 		t.Fatalf("list nodes after migration: %v", err)
 	}
@@ -682,128 +685,42 @@ func TestOpenMigratesLegacyNodeDualStackColumns(t *testing.T) {
 		t.Fatalf("expected 1 node after migration, got %d", len(nodes))
 	}
 
-	columns := readTableColumns(t, r.DB(), "node")
+	columns := readTableColumns(t, repo.DB(), "node")
 
-	for _, required := range []string{"server_ip_v4", "server_ip_v6", "inx", "extra_ips"} {
+	for _, required := range []string{"server_ip_v4", "server_ip_v6", "inx"} {
 		if !columns[required] {
 			t.Fatalf("expected node column %q to exist after migration", required)
 		}
 	}
 
-	tunnelColumns := readTableColumns(t, r.DB(), "tunnel")
-	for _, required := range []string{"inx", "ip_preference"} {
-		if !tunnelColumns[required] {
-			t.Fatalf("expected tunnel column %q to exist after migration", required)
-		}
+	tunnelColumns := readTableColumns(t, repo.DB(), "tunnel")
+	if !tunnelColumns["inx"] {
+		t.Fatalf("expected tunnel column %q to exist after migration", "inx")
 	}
 }
 
-func TestOpenMigratesVeryLegacyNodeAndTunnelColumns(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "legacy-1.x.db")
-	legacyDB, err := sql.Open("sqlite", dbPath)
-	if err != nil {
-		t.Fatalf("open legacy sqlite: %v", err)
-	}
-
-	t.Cleanup(func() {
-		_ = legacyDB.Close()
-	})
-
-	if _, err := legacyDB.Exec(`
-		CREATE TABLE IF NOT EXISTS node (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			secret VARCHAR(100) NOT NULL,
-			server_ip VARCHAR(100) NOT NULL,
-			port TEXT NOT NULL,
-			interface_name VARCHAR(200),
-			version VARCHAR(100),
-			http INTEGER NOT NULL DEFAULT 0,
-			tls INTEGER NOT NULL DEFAULT 0,
-			socks INTEGER NOT NULL DEFAULT 0,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER,
-			status INTEGER NOT NULL
-		)
-	`); err != nil {
-		t.Fatalf("create very legacy node table: %v", err)
-	}
-
-	if _, err := legacyDB.Exec(`
-		CREATE TABLE IF NOT EXISTS tunnel (
-			id INTEGER PRIMARY KEY AUTOINCREMENT,
-			name VARCHAR(100) NOT NULL,
-			traffic_ratio REAL NOT NULL DEFAULT 1.0,
-			type INTEGER NOT NULL,
-			protocol VARCHAR(10) NOT NULL DEFAULT 'tls',
-			flow INTEGER NOT NULL,
-			created_time INTEGER NOT NULL,
-			updated_time INTEGER NOT NULL,
-			status INTEGER NOT NULL,
-			in_ip TEXT
-		)
-	`); err != nil {
-		t.Fatalf("create very legacy tunnel table: %v", err)
-	}
-
-	now := time.Now().UnixMilli()
-	if _, err := legacyDB.Exec(`
-		INSERT INTO node(name, secret, server_ip, port, interface_name, version, http, tls, socks, created_time, updated_time, status)
-		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "legacy-node", "legacy-secret", "10.10.0.1", "10000-10010", "eth0", "v-old", 1, 1, 1, now, now, 1); err != nil {
-		t.Fatalf("seed legacy node row: %v", err)
-	}
-
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open migrated sqlite: %v", err)
-	}
-	t.Cleanup(func() {
-		_ = r.Close()
-	})
-
-	columns := readTableColumns(t, r.DB(), "node")
-	for _, required := range []string{
-		"server_ip_v4",
-		"server_ip_v6",
-		"extra_ips",
-		"tcp_listen_addr",
-		"udp_listen_addr",
-		"inx",
-		"is_remote",
-		"remote_url",
-		"remote_token",
-		"remote_config",
-	} {
-		if !columns[required] {
-			t.Fatalf("expected node column %q to exist after migration", required)
-		}
-	}
-
-	tunnelColumns := readTableColumns(t, r.DB(), "tunnel")
-	for _, required := range []string{"inx", "ip_preference"} {
-		if !tunnelColumns[required] {
-			t.Fatalf("expected tunnel column %q to exist after migration", required)
-		}
-	}
-}
-
-func readTableColumns(t *testing.T, db *gorm.DB, table string) map[string]bool {
+func readTableColumns(t *testing.T, db *store.DB, table string) map[string]bool {
 	t.Helper()
 
-	columnTypes, err := db.Migrator().ColumnTypes(table)
+	rows, err := db.Query("PRAGMA table_info(" + table + ")")
 	if err != nil {
 		t.Fatalf("inspect %s columns: %v", table, err)
 	}
+	defer rows.Close()
 
 	columns := map[string]bool{}
-	for _, col := range columnTypes {
-		name := strings.TrimSpace(col.Name())
-		if name == "" {
-			continue
+	for rows.Next() {
+		var cid, notNull, pk int
+		var name, typ string
+		var defaultValue sql.NullString
+		if err := rows.Scan(&cid, &name, &typ, &notNull, &defaultValue, &pk); err != nil {
+			t.Fatalf("scan %s pragma row: %v", table, err)
 		}
 		columns[name] = true
 	}
+	if err := rows.Err(); err != nil {
+		t.Fatalf("iterate %s pragma rows: %v", table, err)
+	}
 
 	return columns
 }

go-backend/tests/contract/postgres_node_id_repair_contract_test.go

@@ -16,7 +16,7 @@ import (
 	"go-backend/internal/auth"
 	httpserver "go-backend/internal/http"
 	"go-backend/internal/http/handler"
-	"go-backend/internal/store/repo"
+	"go-backend/internal/store/sqlite"
 )
 
 func TestPostgresNodeCreateRepairsMissingIDDefaultContract(t *testing.T) {
@@ -44,40 +44,43 @@ func TestPostgresNodeCreateRepairsMissingIDDefaultContract(t *testing.T) {
 		t.Fatalf("build schema dsn: %v", err)
 	}
 
-	r, err := repo.OpenPostgres(testDSN)
+	repo, err := sqlite.OpenPostgres(testDSN)
 	if err != nil {
 		t.Fatalf("open postgres repository: %v", err)
 	}
-	if err := r.DB().Exec(`ALTER TABLE node ALTER COLUMN id DROP DEFAULT`).Error; err != nil {
-		_ = r.Close()
+	if _, err := repo.DB().Exec(`ALTER TABLE node ALTER COLUMN id DROP DEFAULT`); err != nil {
+		_ = repo.Close()
 		t.Fatalf("drop node.id default to simulate drift: %v", err)
 	}
-	if err := r.Close(); err != nil {
+	if err := repo.Close(); err != nil {
 		t.Fatalf("close repository before reopen: %v", err)
 	}
 
-	r, err = repo.OpenPostgres(testDSN)
+	repo, err = sqlite.OpenPostgres(testDSN)
 	if err != nil {
 		t.Fatalf("reopen postgres repository: %v", err)
 	}
 	t.Cleanup(func() {
-		_ = r.Close()
+		_ = repo.Close()
 	})
 
-	columnDefault := mustQueryNullString(t, r, `
+	var columnDefault sql.NullString
+	if err := repo.DB().QueryRow(`
 		SELECT column_default
 		FROM information_schema.columns
 		WHERE table_schema = current_schema()
 		  AND table_name = 'node'
 		  AND column_name = 'id'
 		LIMIT 1
-	`)
+	`).Scan(&columnDefault); err != nil {
+		t.Fatalf("query node.id default: %v", err)
+	}
 	if !columnDefault.Valid || !strings.Contains(strings.ToLower(columnDefault.String), "nextval(") {
 		t.Fatalf("expected node.id default to be nextval(...), got %q", columnDefault.String)
 	}
 
 	jwtSecret := "postgres-contract-secret"
-	router := httpserver.NewRouter(handler.New(r, jwtSecret), jwtSecret)
+	router := httpserver.NewRouter(handler.New(repo, jwtSecret), jwtSecret)
 	token, err := auth.GenerateToken(1, "admin_user", 0, jwtSecret)
 	if err != nil {
 		t.Fatalf("generate admin token: %v", err)
@@ -91,7 +94,10 @@ func TestPostgresNodeCreateRepairsMissingIDDefaultContract(t *testing.T) {
 	router.ServeHTTP(resp, req)
 	assertCode(t, resp, 0)
 
-	nodeID := mustQueryInt64(t, r, `SELECT id FROM node WHERE name = ? ORDER BY id DESC LIMIT 1`, "pg-repair-node")
+	var nodeID int64
+	if err := repo.DB().QueryRow(`SELECT id FROM node WHERE name = ? ORDER BY id DESC LIMIT 1`, "pg-repair-node").Scan(&nodeID); err != nil {
+		t.Fatalf("query created node: %v", err)
+	}
 	if nodeID <= 0 {
 		t.Fatalf("expected positive node id, got %d", nodeID)
 	}

go-backend/tests/contract/speed_limit_contract_test.go

@@ -1,313 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"database/sql"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"path/filepath"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-	"go-backend/internal/store/repo"
-)
-
-func TestSpeedLimitWithoutTunnelContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, _ := setupContractRouter(t, secret)
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	t.Run("create speed limit", func(t *testing.T) {
-		body := `{"name":"test-limit-no-tunnel","speed":100,"status":1}`
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/create", bytes.NewBufferString(body))
-		req.Header.Set("Authorization", adminToken)
-		req.Header.Set("Content-Type", "application/json")
-		res := httptest.NewRecorder()
-		router.ServeHTTP(res, req)
-
-		assertCode(t, res, 0)
-	})
-
-	t.Run("list does not expose tunnel binding fields", func(t *testing.T) {
-		req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/list", nil)
-		req.Header.Set("Authorization", adminToken)
-		res := httptest.NewRecorder()
-		router.ServeHTTP(res, req)
-
-		var out response.R
-		if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-			t.Fatalf("decode response: %v", err)
-		}
-		if out.Code != 0 {
-			t.Fatalf("expected code 0, got %d", out.Code)
-		}
-
-		data, ok := out.Data.([]interface{})
-		if !ok {
-			t.Fatalf("expected data to be array, got %T", out.Data)
-		}
-
-		for _, item := range data {
-			m, ok := item.(map[string]interface{})
-			if !ok {
-				continue
-			}
-			if m["name"] != "test-limit-no-tunnel" {
-				continue
-			}
-			if tunnelID, exists := m["tunnelId"]; exists && tunnelID != nil {
-				t.Fatalf("expected tunnelId to be absent or nil, got %v", tunnelID)
-			}
-			if tunnelName, exists := m["tunnelName"]; exists && tunnelName != nil && tunnelName != "" {
-				t.Fatalf("expected tunnelName to be absent or empty, got %v", tunnelName)
-			}
-			return
-		}
-
-		t.Fatal("speed limit 'test-limit-no-tunnel' not found in list")
-	})
-}
-
-func TestSpeedLimitCreateIgnoresTunnelBindingContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	tunnelID := mustCreateSpeedLimitTunnel(t, r, "test-speed-limit-create-ignore-tunnel")
-
-	body := `{"name":"test-limit-ignore-tunnel","speed":200,"tunnelId":` + jsonInt(tunnelID) + `,"status":1}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/create", bytes.NewBufferString(body))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	assertCode(t, res, 0)
-
-	req = httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/list", nil)
-	req.Header.Set("Authorization", adminToken)
-	res = httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected code 0, got %d", out.Code)
-	}
-
-	data, ok := out.Data.([]interface{})
-	if !ok {
-		t.Fatalf("expected data to be array, got %T", out.Data)
-	}
-
-	for _, item := range data {
-		m, ok := item.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if m["name"] != "test-limit-ignore-tunnel" {
-			continue
-		}
-		if tunnelIDVal, exists := m["tunnelId"]; exists && tunnelIDVal != nil {
-			t.Fatalf("expected tunnelId ignored and nil, got %v", tunnelIDVal)
-		}
-		if tunnelNameVal, exists := m["tunnelName"]; exists && tunnelNameVal != nil && tunnelNameVal != "" {
-			t.Fatalf("expected tunnelName ignored and empty, got %v", tunnelNameVal)
-		}
-		return
-	}
-
-	t.Fatal("speed limit 'test-limit-ignore-tunnel' not found in list")
-}
-
-func TestSpeedLimitUpdateIgnoresTunnelBindingContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, r := setupContractRouter(t, secret)
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	tunnelID := mustCreateSpeedLimitTunnel(t, r, "test-speed-limit-update-ignore-tunnel")
-	speedLimitID := mustCreateSpeedLimitRepo(t, r, "test-limit-update-ignore-tunnel")
-
-	body := `{"id":` + jsonInt(speedLimitID) + `,"name":"test-limit-update-ignore-tunnel","speed":256,"tunnelId":` + jsonInt(tunnelID) + `,"status":1}`
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/update", bytes.NewBufferString(body))
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	assertCode(t, res, 0)
-
-	req = httptest.NewRequest(http.MethodPost, "/api/v1/speed-limit/list", nil)
-	req.Header.Set("Authorization", adminToken)
-	res = httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected code 0, got %d", out.Code)
-	}
-
-	data, ok := out.Data.([]interface{})
-	if !ok {
-		t.Fatalf("expected data to be array, got %T", out.Data)
-	}
-
-	for _, item := range data {
-		m, ok := item.(map[string]interface{})
-		if !ok {
-			continue
-		}
-		if m["name"] != "test-limit-update-ignore-tunnel" {
-			continue
-		}
-		if tunnelIDVal, exists := m["tunnelId"]; exists && tunnelIDVal != nil {
-			t.Fatalf("expected tunnelId ignored and nil after update, got %v", tunnelIDVal)
-		}
-		if speedVal, ok := m["speed"].(float64); !ok || int(speedVal) != 256 {
-			t.Fatalf("expected speed 256 after update, got %v", m["speed"])
-		}
-		return
-	}
-
-	t.Fatal("speed limit 'test-limit-update-ignore-tunnel' not found in list")
-}
-
-func TestSpeedLimitDatabaseNullableFields(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "speed-limit-null.db")
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	id, err := r.CreateSpeedLimit("db-test-limit", 100, 1, 1)
-	if err != nil {
-		t.Fatalf("CreateSpeedLimit failed: %v", err)
-	}
-	if id <= 0 {
-		t.Fatalf("expected valid id, got %d", id)
-	}
-
-	var tunnelID sql.NullInt64
-	var tunnelName sql.NullString
-	err = r.DB().Raw("SELECT tunnel_id, tunnel_name FROM speed_limit WHERE id = ?", id).Row().Scan(&tunnelID, &tunnelName)
-	if err != nil {
-		t.Fatalf("query failed: %v", err)
-	}
-	if tunnelID.Valid {
-		t.Fatalf("expected TunnelID to be NULL, got %d", tunnelID.Int64)
-	}
-	if tunnelName.Valid && tunnelName.String != "" {
-		t.Fatalf("expected TunnelName to be NULL or empty, got %s", tunnelName.String)
-	}
-}
-
-func TestSpeedLimitUpdateClearsHistoricalBinding(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "speed-limit-update-clear.db")
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	tunnelID := mustCreateSpeedLimitTunnel(t, r, "speed-limit-update-clear-tunnel")
-	now := time.Now().UnixMilli()
-	if err := r.DB().Exec(`
-		INSERT INTO speed_limit(name, speed, tunnel_id, tunnel_name, created_time, updated_time, status)
-		VALUES(?, ?, ?, ?, ?, ?, ?)
-	`, "speed-limit-update-clear", 300, tunnelID, "speed-limit-update-clear-tunnel", now, now, 1).Error; err != nil {
-		t.Fatalf("insert speed limit with tunnel binding: %v", err)
-	}
-	speedLimitID := mustLastInsertID(t, r, "speed-limit-update-clear")
-
-	err = r.UpdateSpeedLimit(speedLimitID, "speed-limit-update-clear", 512, 1, time.Now().UnixMilli())
-	if err != nil {
-		t.Fatalf("UpdateSpeedLimit failed: %v", err)
-	}
-
-	var dbTunnelID sql.NullInt64
-	var dbTunnelName sql.NullString
-	err = r.DB().Raw("SELECT tunnel_id, tunnel_name FROM speed_limit WHERE id = ?", speedLimitID).Row().Scan(&dbTunnelID, &dbTunnelName)
-	if err != nil {
-		t.Fatalf("query updated speed limit failed: %v", err)
-	}
-	if dbTunnelID.Valid {
-		t.Fatalf("expected tunnel_id cleared after update, got %d", dbTunnelID.Int64)
-	}
-	if dbTunnelName.Valid && dbTunnelName.String != "" {
-		t.Fatalf("expected tunnel_name cleared after update, got %q", dbTunnelName.String)
-	}
-}
-
-func TestSpeedLimitGetSpeed(t *testing.T) {
-	dbPath := filepath.Join(t.TempDir(), "speed-limit-getspeed.db")
-	r, err := repo.Open(dbPath)
-	if err != nil {
-		t.Fatalf("open sqlite: %v", err)
-	}
-	t.Cleanup(func() { _ = r.Close() })
-
-	speedLimitID, err := r.CreateSpeedLimit("get-speed-test", 500, 1, 1)
-	if err != nil {
-		t.Fatalf("create speed limit: %v", err)
-	}
-
-	t.Run("GetSpeedLimitSpeed returns correct speed", func(t *testing.T) {
-		speed, err := r.GetSpeedLimitSpeed(speedLimitID)
-		if err != nil {
-			t.Fatalf("GetSpeedLimitSpeed failed: %v", err)
-		}
-		if speed != 500 {
-			t.Fatalf("expected speed 500, got %d", speed)
-		}
-	})
-
-	t.Run("GetSpeedLimitSpeed returns error for non-existent id", func(t *testing.T) {
-		_, err := r.GetSpeedLimitSpeed(99999)
-		if err == nil {
-			t.Fatal("expected error for non-existent speed limit ID")
-		}
-	})
-}
-
-func mustCreateSpeedLimitTunnel(t *testing.T, r *repo.Repository, name string) int64 {
-	t.Helper()
-	now := time.Now().UnixMilli()
-	if err := r.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(?, 1.0, 1, 'tls', 99999, ?, ?, 1, NULL, 0)
-	`, name, now, now).Error; err != nil {
-		t.Fatalf("create tunnel failed: %v", err)
-	}
-	return mustLastInsertID(t, r, name)
-}
-
-func mustCreateSpeedLimitRepo(t *testing.T, r *repo.Repository, name string) int64 {
-	t.Helper()
-	now := time.Now().UnixMilli()
-	id, err := r.CreateSpeedLimit(name, 100, now, 1)
-	if err != nil {
-		t.Fatalf("create speed limit failed: %v", err)
-	}
-	return id
-}

go-backend/tests/contract/tunnel_create_contract_test.go

@@ -2,6 +2,7 @@ package contract_test
 
 import (
 	"bytes"
+	"database/sql"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@@ -25,13 +26,18 @@ func TestTunnelCreateRuntimeRollbackContract(t *testing.T) {
 	}
 
 	insertNode := func(name, ip, portRange string) int64 {
-		if err := repo.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
+		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
 			t.Fatalf("insert node %s: %v", name, err)
 		}
-		return mustLastInsertID(t, repo, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
 	}
 
 	entryID := insertNode("create-entry", "10.20.0.1", "30000-30010")
@@ -57,12 +63,18 @@ func TestTunnelCreateRuntimeRollbackContract(t *testing.T) {
 		t.Fatalf("expected node-related error, got %q", out.Msg)
 	}
 
-	tunnelCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM tunnel WHERE name = ?`, "runtime-rollback-tunnel")
+	var tunnelCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM tunnel WHERE name = ?`, "runtime-rollback-tunnel").Scan(&tunnelCount); err != nil {
+		t.Fatalf("count tunnel: %v", err)
+	}
 	if tunnelCount != 0 {
 		t.Fatalf("expected tunnel rollback, found %d records", tunnelCount)
 	}
 
-	chainCount := mustQueryInt(t, repo, `SELECT COUNT(1) FROM chain_tunnel`)
+	var chainCount int
+	if err := repo.DB().QueryRow(`SELECT COUNT(1) FROM chain_tunnel`).Scan(&chainCount); err != nil {
+		t.Fatalf("count chain_tunnel: %v", err)
+	}
 	if chainCount != 0 {
 		t.Fatalf("expected chain_tunnel rollback, found %d records", chainCount)
 	}
@@ -79,26 +91,35 @@ func TestTunnelUpdateAssignsChainPortsContract(t *testing.T) {
 	}
 
 	insertNode := func(name, ip, portRange string) int64 {
-		if err := repo.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
+		`, name, name+"-secret", ip, ip, "", portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
 			t.Fatalf("insert node %s: %v", name, err)
 		}
-		return mustLastInsertID(t, repo, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
 	}
 
 	entryID := insertNode("update-entry", "10.30.0.1", "40000-40010")
 	chainID := insertNode("update-chain", "10.30.0.2", "41000-41010")
 	exitID := insertNode("update-exit", "10.30.0.3", "42000-42010")
 
-	if err := repo.DB().Exec(`
+	tunnelRes, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "update-port-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
+	`, "update-port-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
-	tunnelID := mustLastInsertID(t, repo, "update-port-tunnel")
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
 
 	payload := `{"id":` + jsonInt(tunnelID) + `,"name":"update-port-tunnel","type":2,"flow":99999,"trafficRatio":1.0,"status":1,"inNodeId":[{"nodeId":` + jsonInt(entryID) + `,"protocol":"tls"}],"chainNodes":[[{"nodeId":` + jsonInt(chainID) + `,"protocol":"tls","strategy":"round"}]],"outNodeId":[{"nodeId":` + jsonInt(exitID) + `,"protocol":"tls"}]}`
 	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", bytes.NewBufferString(payload))
@@ -109,17 +130,26 @@ func TestTunnelUpdateAssignsChainPortsContract(t *testing.T) {
 	router.ServeHTTP(res, req)
 	assertCode(t, res, 0)
 
-	chainPort := mustQueryInt(t, repo, `SELECT port FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 2 LIMIT 1`, tunnelID)
+	var chainPort int
+	if err := repo.DB().QueryRow(`SELECT port FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 2 LIMIT 1`, tunnelID).Scan(&chainPort); err != nil {
+		t.Fatalf("query chain port: %v", err)
+	}
 	if chainPort <= 0 {
 		t.Fatalf("expected chain node port to be assigned, got %d", chainPort)
 	}
 
-	outPort := mustQueryInt(t, repo, `SELECT port FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 3 LIMIT 1`, tunnelID)
+	var outPort int
+	if err := repo.DB().QueryRow(`SELECT port FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 3 LIMIT 1`, tunnelID).Scan(&outPort); err != nil {
+		t.Fatalf("query out port: %v", err)
+	}
 	if outPort <= 0 {
 		t.Fatalf("expected out node port to be assigned, got %d", outPort)
 	}
 
-	entryStrategy := mustQueryNullString(t, repo, `SELECT strategy FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 1 LIMIT 1`, tunnelID)
+	var entryStrategy sql.NullString
+	if err := repo.DB().QueryRow(`SELECT strategy FROM chain_tunnel WHERE tunnel_id = ? AND chain_type = 1 LIMIT 1`, tunnelID).Scan(&entryStrategy); err != nil {
+		t.Fatalf("query entry strategy: %v", err)
+	}
 	if !entryStrategy.Valid || strings.TrimSpace(entryStrategy.String) == "" {
 		t.Fatalf("expected entry strategy to be non-null and non-empty")
 	}

go-backend/tests/contract/tunnel_delete_resolution_contract_test.go

@@ -1,235 +0,0 @@
-package contract_test
-
-import (
-	"testing"
-	"time"
-
-	"go-backend/internal/http/response"
-	storeRepo "go-backend/internal/store/repo"
-)
-
-func TestTunnelDeletePreviewIncludesDependentRulesContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-	now := time.Now().UnixMilli()
-
-	sourceTunnelID, sourceNodeID := seedTunnelDeleteTunnelWithNode(t, repo, now, "preview-source-tunnel", "preview-source-node", "21000-21010")
-	seedTunnelDeleteForward(t, repo, now, sourceTunnelID, sourceNodeID, "preview-forward", 21001)
-
-	out := requestContractEnvelope(t, router, adminToken, "/api/v1/tunnel/delete-preview", map[string]interface{}{"id": sourceTunnelID})
-	if out.Code != 0 {
-		t.Fatalf("expected success, got code=%d msg=%q", out.Code, out.Msg)
-	}
-
-	data, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected preview data object, got %T", out.Data)
-	}
-	if contractValueAsInt64(data["tunnelId"]) != sourceTunnelID {
-		t.Fatalf("unexpected tunnelId: %#v", data["tunnelId"])
-	}
-	if contractValueAsInt64(data["forwardCount"]) != 1 {
-		t.Fatalf("expected forwardCount=1, got %#v", data["forwardCount"])
-	}
-
-	samples, ok := data["sampleForwards"].([]interface{})
-	if !ok || len(samples) != 1 {
-		t.Fatalf("expected one sample forward, got %#v", data["sampleForwards"])
-	}
-	first, ok := samples[0].(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected sample object, got %T", samples[0])
-	}
-	if first["name"] != "preview-forward" {
-		t.Fatalf("unexpected sample name: %#v", first["name"])
-	}
-	if contractValueAsInt64(first["inPort"]) != 21001 {
-		t.Fatalf("unexpected sample inPort: %#v", first["inPort"])
-	}
-}
-
-func TestTunnelDeleteWithForwardsDeleteActionRemovesTunnelAndRulesContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-	now := time.Now().UnixMilli()
-
-	sourceTunnelID, sourceNodeID := seedTunnelDeleteTunnelWithNode(t, repo, now, "delete-source-tunnel", "delete-source-node", "22000-22010")
-	forwardID := seedTunnelDeleteForward(t, repo, now, sourceTunnelID, sourceNodeID, "delete-forward", 22001)
-
-	out := requestContractEnvelope(t, router, adminToken, "/api/v1/tunnel/delete-with-forwards", map[string]interface{}{
-		"id":     sourceTunnelID,
-		"action": "delete_forwards",
-	})
-	if out.Code != 0 {
-		t.Fatalf("expected success, got code=%d msg=%q", out.Code, out.Msg)
-	}
-
-	if count := mustQueryInt(t, repo, `SELECT COUNT(1) FROM tunnel WHERE id = ?`, sourceTunnelID); count != 0 {
-		t.Fatalf("expected tunnel deleted, got count=%d", count)
-	}
-	if count := mustQueryInt(t, repo, `SELECT COUNT(1) FROM forward WHERE id = ?`, forwardID); count != 0 {
-		t.Fatalf("expected forward deleted, got count=%d", count)
-	}
-	if count := mustQueryInt(t, repo, `SELECT COUNT(1) FROM forward_port WHERE forward_id = ?`, forwardID); count != 0 {
-		t.Fatalf("expected forward ports deleted, got count=%d", count)
-	}
-}
-
-func TestTunnelDeleteWithForwardsReplaceReturnsFailureDetailsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-	now := time.Now().UnixMilli()
-
-	sourceTunnelID, sourceNodeID := seedTunnelDeleteTunnelWithNode(t, repo, now, "replace-source-tunnel", "replace-source-node", "23000-23010")
-	forwardID := seedTunnelDeleteForward(t, repo, now, sourceTunnelID, sourceNodeID, "replace-forward", 23001)
-	targetTunnelID, targetNodeID := seedTunnelDeleteTunnelWithNode(t, repo, now, "replace-target-tunnel", "replace-target-node", "23000-23010")
-	seedTunnelDeleteForward(t, repo, now, targetTunnelID, targetNodeID, "occupied-forward", 23001)
-
-	out := requestContractEnvelope(t, router, adminToken, "/api/v1/tunnel/delete-with-forwards", map[string]interface{}{
-		"id":             sourceTunnelID,
-		"action":         "replace",
-		"targetTunnelId": targetTunnelID,
-	})
-	if out.Code != -2 {
-		t.Fatalf("expected failure code -2, got code=%d msg=%q", out.Code, out.Msg)
-	}
-
-	result := mustTunnelDeleteFailureResult(t, out)
-	if contractValueAsInt64(result["failCount"]) != 1 {
-		t.Fatalf("expected failCount=1, got %#v", result["failCount"])
-	}
-	assertBatchFailureNameAndReason(t, result, "replace-forward", "节点 replace-target-node 端口 23001 已被其他转发占用")
-
-	if count := mustQueryInt(t, repo, `SELECT COUNT(1) FROM tunnel WHERE id = ?`, sourceTunnelID); count != 1 {
-		t.Fatalf("expected source tunnel kept, got count=%d", count)
-	}
-	if tunnelAfter := mustQueryInt64(t, repo, `SELECT tunnel_id FROM forward WHERE id = ?`, forwardID); tunnelAfter != sourceTunnelID {
-		t.Fatalf("expected forward tunnel unchanged, got %d", tunnelAfter)
-	}
-}
-
-func TestTunnelBatchDeletePreviewIncludesTotalsContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-	now := time.Now().UnixMilli()
-
-	tunnelA, nodeA := seedTunnelDeleteTunnelWithNode(t, repo, now, "batch-preview-a", "batch-preview-node-a", "24000-24010")
-	tunnelB, _ := seedTunnelDeleteTunnelWithNode(t, repo, now, "batch-preview-b", "batch-preview-node-b", "24100-24110")
-	seedTunnelDeleteForward(t, repo, now, tunnelA, nodeA, "batch-preview-forward", 24001)
-
-	out := requestContractEnvelope(t, router, adminToken, "/api/v1/tunnel/batch-delete-preview", map[string]interface{}{
-		"ids": []int64{tunnelA, tunnelB},
-	})
-	if out.Code != 0 {
-		t.Fatalf("expected success, got code=%d msg=%q", out.Code, out.Msg)
-	}
-	data, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected preview object, got %T", out.Data)
-	}
-	if contractValueAsInt64(data["tunnelCount"]) != 2 {
-		t.Fatalf("expected tunnelCount=2, got %#v", data["tunnelCount"])
-	}
-	if contractValueAsInt64(data["totalForwardCount"]) != 1 {
-		t.Fatalf("expected totalForwardCount=1, got %#v", data["totalForwardCount"])
-	}
-}
-
-func TestTunnelBatchDeleteWithForwardsReturnsTunnelLevelFailuresContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	adminToken := mustAdminToken(t, secret)
-	now := time.Now().UnixMilli()
-
-	sourceTunnelA, _ := seedTunnelDeleteTunnelWithNode(t, repo, now, "batch-replace-source-a", "batch-replace-source-node-a", "25000-25010")
-	sourceTunnelB, sourceNodeB := seedTunnelDeleteTunnelWithNode(t, repo, now, "batch-replace-source-b", "batch-replace-source-node-b", "25100-25110")
-	targetTunnelID, targetNodeID := seedTunnelDeleteTunnelWithNode(t, repo, now, "batch-replace-target", "batch-replace-target-node", "25000-25010")
-
-	seedTunnelDeleteForward(t, repo, now, sourceTunnelB, sourceNodeB, "batch-replace-forward-b", 25002)
-	seedTunnelDeleteForward(t, repo, now, targetTunnelID, targetNodeID, "batch-replace-occupied", 25002)
-
-	out := requestContractEnvelope(t, router, adminToken, "/api/v1/tunnel/batch-delete-with-forwards", map[string]interface{}{
-		"ids":            []int64{sourceTunnelA, sourceTunnelB},
-		"action":         "replace",
-		"targetTunnelId": targetTunnelID,
-	})
-	if out.Code != 0 {
-		t.Fatalf("expected success envelope, got code=%d msg=%q", out.Code, out.Msg)
-	}
-
-	result := mustTunnelDeleteFailureResult(t, out)
-	if contractValueAsInt64(result["successCount"]) != 1 {
-		t.Fatalf("expected successCount=1, got %#v", result["successCount"])
-	}
-	if contractValueAsInt64(result["failCount"]) != 1 {
-		t.Fatalf("expected failCount=1, got %#v", result["failCount"])
-	}
-	assertBatchFailureNameAndReason(t, result, "batch-replace-source-b", "batch-replace-forward-b: 节点 batch-replace-target-node 端口 25002 已被其他转发占用")
-
-	if count := mustQueryInt(t, repo, `SELECT COUNT(1) FROM tunnel WHERE id = ?`, sourceTunnelA); count != 0 {
-		t.Fatalf("expected source tunnel A deleted, got count=%d", count)
-	}
-	if count := mustQueryInt(t, repo, `SELECT COUNT(1) FROM tunnel WHERE id = ?`, sourceTunnelB); count != 1 {
-		t.Fatalf("expected source tunnel B kept, got count=%d", count)
-	}
-}
-
-func seedTunnelDeleteTunnelWithNode(t *testing.T, repo *storeRepo.Repository, now int64, tunnelName, nodeName, portRange string) (int64, int64) {
-	t.Helper()
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, status, created_time, updated_time, in_ip, inx, ip_preference)
-		VALUES(?, 1.0, 1, 'tls', 1, 1, ?, ?, NULL, 0, '')
-	`, tunnelName, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel %s: %v", tunnelName, err)
-	}
-	tunnelID := mustLastInsertID(t, repo, tunnelName)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
-		VALUES(?, ?, '10.0.0.1', '10.0.0.1', '', ?, '', 'v1', 1, 1, 1, ?, ?, 1, '[::]', '[::]', 0)
-	`, nodeName, nodeName+"-secret", portRange, now, now).Error; err != nil {
-		t.Fatalf("insert node %s: %v", nodeName, err)
-	}
-	nodeID := mustLastInsertID(t, repo, nodeName)
-
-	if err := repo.DB().Exec(`
-		INSERT INTO chain_tunnel(tunnel_id, chain_type, node_id, port, strategy, inx, protocol)
-		VALUES(?, 1, ?, 0, 'round', 1, 'tls')
-	`, tunnelID, nodeID).Error; err != nil {
-		t.Fatalf("insert chain_tunnel for %s: %v", tunnelName, err)
-	}
-
-	return tunnelID, nodeID
-}
-
-func seedTunnelDeleteForward(t *testing.T, repo *storeRepo.Repository, now int64, tunnelID, nodeID int64, forwardName string, port int) int64 {
-	t.Helper()
-
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(2, 'contract-user', ?, ?, '1.1.1.1:443', 'fifo', 0, 0, ?, ?, 1, 0)
-	`, forwardName, tunnelID, now, now).Error; err != nil {
-		t.Fatalf("insert forward %s: %v", forwardName, err)
-	}
-	forwardID := mustLastInsertID(t, repo, forwardName)
-
-	if err := repo.DB().Exec(`INSERT INTO forward_port(forward_id, node_id, port) VALUES(?, ?, ?)`, forwardID, nodeID, port).Error; err != nil {
-		t.Fatalf("insert forward_port for %s: %v", forwardName, err)
-	}
-
-	return forwardID
-}
-
-func mustTunnelDeleteFailureResult(t *testing.T, out response.R) map[string]interface{} {
-	t.Helper()
-	result, ok := out.Data.(map[string]interface{})
-	if !ok {
-		t.Fatalf("expected result object, got %T", out.Data)
-	}
-	return result
-}

go-backend/tests/contract/tunnel_ip_preference_contract_test.go

@@ -24,13 +24,18 @@ func TestTunnelCreateWithIPPreferenceContract(t *testing.T) {
 	}
 
 	insertDualStackNode := func(name, v4, v6, portRange string) int64 {
-		if err := repo.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", v4, v4, v6, portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
+		`, name, name+"-secret", v4, v4, v6, portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
 			t.Fatalf("insert node %s: %v", name, err)
 		}
-		return mustLastInsertID(t, repo, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
 	}
 
 	entryID := insertDualStackNode("ip-pref-entry", "10.50.0.1", "2001:db8::1", "50000-50010")
@@ -57,7 +62,8 @@ func TestTunnelCreateWithIPPreferenceContract(t *testing.T) {
 				t.Fatalf("decode response: %v", err)
 			}
 
-			stored, err := tryQueryString(t, repo, `SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, "tunnel-"+tc.name)
+			var stored string
+			err := repo.DB().QueryRow(`SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, "tunnel-"+tc.name).Scan(&stored)
 			if err != nil {
 				if err == sql.ErrNoRows {
 					t.Skipf("tunnel not created (nodes offline), skipping DB verification")
@@ -82,25 +88,34 @@ func TestTunnelUpdateIPPreferenceContract(t *testing.T) {
 	}
 
 	insertDualStackNode := func(name, v4, v6, portRange string) int64 {
-		if err := repo.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, name+"-secret", v4, v4, v6, portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
+		`, name, name+"-secret", v4, v4, v6, portRange, "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+		if err != nil {
 			t.Fatalf("insert node %s: %v", name, err)
 		}
-		return mustLastInsertID(t, repo, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get node id %s: %v", name, err)
+		}
+		return id
 	}
 
 	entryID := insertDualStackNode("upd-entry", "10.60.0.1", "2001:db8:1::1", "60000-60010")
 	exitID := insertDualStackNode("upd-exit", "10.60.0.2", "2001:db8:1::2", "61000-61010")
 
-	if err := repo.DB().Exec(`
+	tunnelRes, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx, ip_preference)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "update-ip-pref-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0, "").Error; err != nil {
+	`, "update-ip-pref-tunnel", 1.0, 1, "tls", 99999, now, now, 1, nil, 0, "")
+	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
-	tunnelID := mustLastInsertID(t, repo, "update-ip-pref-tunnel")
+	tunnelID, err := tunnelRes.LastInsertId()
+	if err != nil {
+		t.Fatalf("get tunnel id: %v", err)
+	}
 
 	payload := `{"id":` + jsonInt(tunnelID) + `,"name":"update-ip-pref-tunnel","type":2,"flow":99999,"trafficRatio":1.0,"status":1,"ipPreference":"v6","inNodeId":[{"nodeId":` + jsonInt(entryID) + `,"protocol":"tls"}],"chainNodes":[],"outNodeId":[{"nodeId":` + jsonInt(exitID) + `,"protocol":"tls"}]}`
 	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/update", bytes.NewBufferString(payload))
@@ -114,7 +129,10 @@ func TestTunnelUpdateIPPreferenceContract(t *testing.T) {
 		t.Fatalf("decode response: %v", err)
 	}
 
-	stored := mustQueryString(t, repo, `SELECT COALESCE(ip_preference, '') FROM tunnel WHERE id = ?`, tunnelID)
+	var stored string
+	if err := repo.DB().QueryRow(`SELECT COALESCE(ip_preference, '') FROM tunnel WHERE id = ?`, tunnelID).Scan(&stored); err != nil {
+		t.Fatalf("query ip_preference: %v", err)
+	}
 	if stored != "v6" {
 		t.Fatalf("expected ip_preference='v6' after update, got %q", stored)
 	}
@@ -130,10 +148,10 @@ func TestTunnelListReturnsIPPreferenceContract(t *testing.T) {
 		t.Fatalf("generate admin token: %v", err)
 	}
 
-	err = repo.DB().Exec(`
+	_, err = repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx, ip_preference)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "list-ip-pref-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0, "v6").Error
+	`, "list-ip-pref-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0, "v6")
 	if err != nil {
 		t.Fatalf("insert tunnel: %v", err)
 	}
@@ -180,14 +198,18 @@ func TestIPPreferenceColumnDefaultContract(t *testing.T) {
 	_, repo := setupContractRouter(t, "contract-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := repo.DB().Exec(`
+	_, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "no-pref-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
+	`, "no-pref-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
 		t.Fatalf("insert tunnel without ip_preference: %v", err)
 	}
 
-	stored := mustQueryString(t, repo, `SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, "no-pref-tunnel")
+	var stored string
+	if err := repo.DB().QueryRow(`SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, "no-pref-tunnel").Scan(&stored); err != nil {
+		t.Fatalf("query ip_preference: %v", err)
+	}
 	if stored != "" {
 		t.Fatalf("expected default ip_preference='', got %q", stored)
 	}
@@ -196,7 +218,11 @@ func TestIPPreferenceColumnDefaultContract(t *testing.T) {
 func TestIPPreferenceColumnMigrationContract(t *testing.T) {
 	_, repo := setupContractRouter(t, "contract-jwt-secret")
 
-	colCount := mustQueryInt(t, repo, `SELECT COUNT(*) FROM pragma_table_info('tunnel') WHERE name = 'ip_preference'`)
+	var colCount int
+	err := repo.DB().QueryRow(`SELECT COUNT(*) FROM pragma_table_info('tunnel') WHERE name = 'ip_preference'`).Scan(&colCount)
+	if err != nil {
+		t.Fatalf("check column existence: %v", err)
+	}
 	if colCount != 1 {
 		t.Fatalf("expected ip_preference column to exist in tunnel table, found %d", colCount)
 	}
@@ -206,14 +232,18 @@ func TestIPPreferenceCoalesceNullSafety(t *testing.T) {
 	_, repo := setupContractRouter(t, "contract-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := repo.DB().Exec(`
+	_, err := repo.DB().Exec(`
 		INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx, ip_preference)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL)
-	`, "null-pref-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0).Error; err != nil {
+	`, "null-pref-tunnel", 1.0, 2, "tls", 99999, now, now, 1, nil, 0)
+	if err != nil {
 		t.Skipf("DB does not allow NULL ip_preference (NOT NULL constraint): %v", err)
 	}
 
-	stored := mustQueryString(t, repo, `SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, "null-pref-tunnel")
+	var stored string
+	if err := repo.DB().QueryRow(`SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, "null-pref-tunnel").Scan(&stored); err != nil {
+		t.Fatalf("query ip_preference: %v", err)
+	}
 	if stored != "" {
 		t.Fatalf("COALESCE should convert NULL to empty string, got %q", stored)
 	}
@@ -223,14 +253,18 @@ func TestDualStackNodeIPFieldsStoredContract(t *testing.T) {
 	_, repo := setupContractRouter(t, "contract-jwt-secret")
 	now := time.Now().UnixMilli()
 
-	if err := repo.DB().Exec(`
+	_, err := repo.DB().Exec(`
 		INSERT INTO node(name, secret, server_ip, server_ip_v4, server_ip_v6, port, interface_name, version, http, tls, socks, created_time, updated_time, status, tcp_listen_addr, udp_listen_addr, inx)
 		VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-	`, "ds-verify-node", "ds-secret", "10.70.0.1", "10.70.0.1", "2001:db8:2::1", "70000-70010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0).Error; err != nil {
+	`, "ds-verify-node", "ds-secret", "10.70.0.1", "10.70.0.1", "2001:db8:2::1", "70000-70010", "", "v1", 1, 1, 1, now, now, 1, "[::]", "[::]", 0)
+	if err != nil {
 		t.Fatalf("insert dual-stack node: %v", err)
 	}
 
-	v4, v6 := mustQueryTwoNullStrings(t, repo, `SELECT server_ip_v4, server_ip_v6 FROM node WHERE name = ?`, "ds-verify-node")
+	var v4, v6 sql.NullString
+	if err := repo.DB().QueryRow(`SELECT server_ip_v4, server_ip_v6 FROM node WHERE name = ?`, "ds-verify-node").Scan(&v4, &v6); err != nil {
+		t.Fatalf("query node IPs: %v", err)
+	}
 	if !v4.Valid || v4.String != "10.70.0.1" {
 		t.Fatalf("expected server_ip_v4='10.70.0.1', got %v", v4)
 	}
@@ -248,14 +282,18 @@ func TestIPPreferenceValidValuesContract(t *testing.T) {
 		if pref == "" {
 			name = "valid-pref-empty"
 		}
-		if err := repo.DB().Exec(`
+		_, err := repo.DB().Exec(`
 			INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx, ip_preference)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, 1.0, 2, "tls", 99999, now, now, 1, nil, 0, pref).Error; err != nil {
+		`, name, 1.0, 2, "tls", 99999, now, now, 1, nil, 0, pref)
+		if err != nil {
 			t.Fatalf("insert tunnel with ip_preference=%q: %v", pref, err)
 		}
 
-		stored := mustQueryString(t, repo, `SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, name)
+		var stored string
+		if err := repo.DB().QueryRow(`SELECT COALESCE(ip_preference, '') FROM tunnel WHERE name = ?`, name).Scan(&stored); err != nil {
+			t.Fatalf("query ip_preference for %s: %v", name, err)
+		}
 		if stored != pref {
 			t.Fatalf("expected ip_preference=%q, got %q for %s", pref, stored, name)
 		}

go-backend/tests/contract/tunnel_metrics_ingestion_contract_test.go

@@ -1,97 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"go-backend/internal/store/model"
-)
-
-func TestFlowUploadInsertsTunnelMetrics(t *testing.T) {
-	secret := "monitoring-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-
-	now := time.Now().UnixMilli()
-
-	node := &model.Node{
-		Name:          "node-1",
-		Secret:        "node-secret",
-		ServerIP:      "127.0.0.1",
-		Port:          "10000-10010",
-		TCPListenAddr: "[::]",
-		UDPListenAddr: "[::]",
-		CreatedTime:   now,
-		Status:        1,
-	}
-	if err := repo.DB().Create(node).Error; err != nil {
-		t.Fatalf("seed node: %v", err)
-	}
-
-	tunnel := &model.Tunnel{
-		Name:         "tunnel-1",
-		TrafficRatio: 1.0,
-		Type:         1,
-		Protocol:     "tls",
-		Flow:         1,
-		CreatedTime:  now,
-		UpdatedTime:  now,
-		Status:       1,
-	}
-	if err := repo.DB().Create(tunnel).Error; err != nil {
-		t.Fatalf("seed tunnel: %v", err)
-	}
-
-	forward := &model.Forward{
-		UserID:      123,
-		UserName:    "user-123",
-		Name:        "forward-1",
-		TunnelID:    tunnel.ID,
-		RemoteAddr:  "1.1.1.1:80",
-		CreatedTime: now,
-		UpdatedTime: now,
-		Status:      1,
-	}
-	if err := repo.DB().Create(forward).Error; err != nil {
-		t.Fatalf("seed forward: %v", err)
-	}
-
-	serviceName := jsonNumber(forward.ID) + "_123_0"
-	body, _ := json.Marshal([]map[string]interface{}{{
-		"n": serviceName,
-		"u": 200,
-		"d": 100,
-	}})
-
-	req := httptest.NewRequest(http.MethodPost, "/flow/upload?secret="+node.Secret, bytes.NewReader(body))
-	res := httptest.NewRecorder()
-	router.ServeHTTP(res, req)
-
-	if res.Code != http.StatusOK {
-		t.Fatalf("expected status 200, got %d", res.Code)
-	}
-
-	metrics, err := repo.GetTunnelMetrics(tunnel.ID, 0, now+60_000)
-	if err != nil {
-		t.Fatalf("get tunnel metrics: %v", err)
-	}
-	if len(metrics) != 1 {
-		t.Fatalf("expected 1 tunnel metric row, got %d", len(metrics))
-	}
-
-	if metrics[0].TunnelID != tunnel.ID {
-		t.Fatalf("expected tunnelId %d, got %d", tunnel.ID, metrics[0].TunnelID)
-	}
-	if metrics[0].NodeID != node.ID {
-		t.Fatalf("expected nodeId %d, got %d", node.ID, metrics[0].NodeID)
-	}
-	if metrics[0].BytesIn != 100 {
-		t.Fatalf("expected bytesIn 100, got %d", metrics[0].BytesIn)
-	}
-	if metrics[0].BytesOut != 200 {
-		t.Fatalf("expected bytesOut 200, got %d", metrics[0].BytesOut)
-	}
-}

go-backend/tests/contract/tunnel_visibility_contract_test.go

@@ -1,4 +1,4 @@
-package contract_test
+package contract
 
 import (
 	"encoding/json"
@@ -13,46 +13,51 @@ import (
 
 func TestUserTunnelVisibleListContracts(t *testing.T) {
 	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
+	router, repo := setupDiagnosisContractRouter(t, secret)
 	now := time.Now().UnixMilli()
 
-	if err := repo.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
 		VALUES(2, 'normal_user', '3c85cdebade1c51cf64ca9f3c09d182d', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now).Error; err != nil {
+	`, now, now); err != nil {
 		t.Fatalf("insert user: %v", err)
 	}
 
 	insertTunnel := func(name string, status int, inx int64) int64 {
-		if err := repo.DB().Exec(`
+		res, err := repo.DB().Exec(`
 			INSERT INTO tunnel(name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
 			VALUES(?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-		`, name, 1.0, 1, "tls", 99999, now, now, status, nil, inx).Error; err != nil {
+		`, name, 1.0, 1, "tls", 99999, now, now, status, nil, inx)
+		if err != nil {
 			t.Fatalf("insert tunnel %s: %v", name, err)
 		}
-		return mustLastInsertID(t, repo, name)
+		id, err := res.LastInsertId()
+		if err != nil {
+			t.Fatalf("get tunnel id %s: %v", name, err)
+		}
+		return id
 	}
 
 	enabledA := insertTunnel("enabled-A", 1, 1)
 	enabledB := insertTunnel("enabled-B", 1, 2)
 	disabledC := insertTunnel("disabled-C", 0, 3)
 
-	if err := repo.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
 		VALUES(?, ?, NULL, ?, ?, 0, 0, ?, ?, ?)
-	`, 2, enabledA, 100, 1000, 1, 2727251700000, 0).Error; err != nil {
+	`, 2, enabledA, 100, 1000, 1, 2727251700000, 0); err != nil {
 		t.Fatalf("insert user_tunnel enabledA: %v", err)
 	}
-	if err := repo.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
 		VALUES(?, ?, NULL, ?, ?, 0, 0, ?, ?, ?)
-	`, 2, enabledB, 100, 1000, 1, 2727251700000, 1).Error; err != nil {
+	`, 2, enabledB, 100, 1000, 1, 2727251700000, 1); err != nil {
 		t.Fatalf("insert user_tunnel enabledB: %v", err)
 	}
-	if err := repo.DB().Exec(`
+	if _, err := repo.DB().Exec(`
 		INSERT INTO user_tunnel(user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
 		VALUES(?, ?, NULL, ?, ?, 0, 0, ?, ?, ?)
-	`, 2, disabledC, 100, 1000, 1, 2727251700000, 1).Error; err != nil {
+	`, 2, disabledC, 100, 1000, 1, 2727251700000, 1); err != nil {
 		t.Fatalf("insert user_tunnel disabledC: %v", err)
 	}
 
@@ -126,11 +131,8 @@ func collectTunnelIDs(t *testing.T, data interface{}) map[int64]bool {
 		if !ok {
 			t.Fatalf("expected object item, got %T", item)
 		}
-		idFloat, ok := obj["id"].(float64)
-		if !ok {
-			t.Fatalf("expected id to be float64, got %T", obj["id"])
-		}
-		ids[int64(idFloat)] = true
+		id := int64(obj["id"].(float64))
+		ids[id] = true
 	}
 	return ids
 }

go-backend/tests/contract/user_quota_contract_test.go

@@ -1,181 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-func TestForwardCreateBlockedWhenUserQuotaExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now()
-	nowMs := now.UnixMilli()
-	dayKey := int64(now.Year()*10000 + int(now.Month())*100 + now.Day())
-	monthKey := int64(now.Year()*100 + int(now.Month()))
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'quota_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(1, 'quota_tunnel', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, 2, 1, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
-	`).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_quota(user_id, daily_limit_gb, monthly_limit_gb, daily_used_bytes, monthly_used_bytes, day_key, month_key, disabled_by_quota, disabled_at, paused_forward_ids, created_time, updated_time)
-		VALUES(2, 10, 0, ?, ?, ?, ?, 1, ?, '', ?, ?)
-	`, 11*contractBytesPerGB, 11*contractBytesPerGB, dayKey, monthKey, nowMs, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user_quota: %v", err)
-	}
-
-	token, err := auth.GenerateToken(2, "quota_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/create", bytes.NewBufferString(`{"tunnelId":1,"name":"quota-forward","remoteAddr":"1.1.1.1:53"}`))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when user quota exceeded")
-	}
-	if !strings.Contains(out.Msg, "配额") {
-		t.Fatalf("expected quota error, got %q", out.Msg)
-	}
-}
-
-func TestForwardResumeBlockedWhenUserQuotaExceeded(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now()
-	nowMs := now.UnixMilli()
-	dayKey := int64(now.Year()*10000 + int(now.Month())*100 + now.Day())
-	monthKey := int64(now.Year()*100 + int(now.Month()))
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'quota_resume_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(1, 'quota_resume_tunnel', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(10, 2, 1, NULL, 99999, 99999, 0, 0, 1, 2727251700000, 1)
-	`).Error; err != nil {
-		t.Fatalf("insert user_tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO forward(id, user_id, user_name, name, tunnel_id, remote_addr, strategy, in_flow, out_flow, created_time, updated_time, status, inx)
-		VALUES(1, 2, 'quota_resume_user', 'quota_resume_forward', 1, '1.1.1.1:53', 'fifo', 0, 0, ?, ?, 0, 0)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert forward: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_quota(user_id, daily_limit_gb, monthly_limit_gb, daily_used_bytes, monthly_used_bytes, day_key, month_key, disabled_by_quota, disabled_at, paused_forward_ids, created_time, updated_time)
-		VALUES(2, 10, 0, ?, ?, ?, ?, 1, ?, '1', ?, ?)
-	`, 11*contractBytesPerGB, 11*contractBytesPerGB, dayKey, monthKey, nowMs, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user_quota: %v", err)
-	}
-
-	token, err := auth.GenerateToken(2, "quota_resume_user", 1, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/forward/resume", bytes.NewBufferString(`{"id":1}`))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code == 0 {
-		t.Fatalf("expected non-zero code when user quota exceeded")
-	}
-	if !strings.Contains(out.Msg, "配额") {
-		t.Fatalf("expected quota error, got %q", out.Msg)
-	}
-	status := mustQueryInt(t, repo, `SELECT status FROM forward WHERE id = 1`)
-	if status != 0 {
-		t.Fatalf("expected forward to remain paused, got %d", status)
-	}
-}
-
-func TestUserQuotaResetClearsDisableFlag(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now()
-	nowMs := now.UnixMilli()
-	dayKey := int64(now.Year()*10000 + int(now.Month())*100 + now.Day())
-	monthKey := int64(now.Year()*100 + int(now.Month()))
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(2, 'quota_reset_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_quota(user_id, daily_limit_gb, monthly_limit_gb, daily_used_bytes, monthly_used_bytes, day_key, month_key, disabled_by_quota, disabled_at, paused_forward_ids, created_time, updated_time)
-		VALUES(2, 10, 0, ?, ?, ?, ?, 1, ?, '', ?, ?)
-	`, 11*contractBytesPerGB, 11*contractBytesPerGB, dayKey, monthKey, nowMs, nowMs, nowMs).Error; err != nil {
-		t.Fatalf("insert user_quota: %v", err)
-	}
-
-	token, err := auth.GenerateToken(1, "admin", 0, secret)
-	if err != nil {
-		t.Fatalf("generate token: %v", err)
-	}
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/user/quota/reset", bytes.NewBufferString(`{"userId":2,"scope":"all"}`))
-	req.Header.Set("Authorization", token)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected reset success, got code=%d msg=%q", out.Code, out.Msg)
-	}
-	quotaDisabled := mustQueryInt(t, repo, `SELECT disabled_by_quota FROM user_quota WHERE user_id = 2`)
-	if quotaDisabled != 0 {
-		t.Fatalf("expected quota disable flag cleared, got %d", quotaDisabled)
-	}
-}

go-backend/tests/contract/user_tunnel_status_contract_test.go

@@ -1,105 +0,0 @@
-package contract_test
-
-import (
-	"bytes"
-	"encoding/json"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-	"time"
-
-	"go-backend/internal/auth"
-	"go-backend/internal/http/response"
-)
-
-func TestUserTunnelListReturnsStoredStatusContract(t *testing.T) {
-	secret := "contract-jwt-secret"
-	router, repo := setupContractRouter(t, secret)
-	now := time.Now().UnixMilli()
-
-	adminToken, err := auth.GenerateToken(1, "admin_user", 0, secret)
-	if err != nil {
-		t.Fatalf("generate admin token: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user(id, user, pwd, role_id, exp_time, flow, in_flow, out_flow, flow_reset_time, num, created_time, updated_time, status)
-		VALUES(201, 'user_tunnel_status_user', 'pwd', 1, 2727251700000, 99999, 0, 0, 1, 99999, ?, ?, 1)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert user: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(301, 'user-tunnel-status-enabled', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 0)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel enabled: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO tunnel(id, name, traffic_ratio, type, protocol, flow, created_time, updated_time, status, in_ip, inx)
-		VALUES(302, 'user-tunnel-status-disabled', 1.0, 1, 'tls', 1, ?, ?, 1, NULL, 1)
-	`, now, now).Error; err != nil {
-		t.Fatalf("insert tunnel disabled: %v", err)
-	}
-
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(401, 201, 301, NULL, 10, 500, 0, 0, 1, 2727251700000, 1)
-	`).Error; err != nil {
-		t.Fatalf("insert enabled user_tunnel: %v", err)
-	}
-	if err := repo.DB().Exec(`
-		INSERT INTO user_tunnel(id, user_id, tunnel_id, speed_id, num, flow, in_flow, out_flow, flow_reset_time, exp_time, status)
-		VALUES(402, 201, 302, NULL, 10, 500, 0, 0, 1, 2727251700000, 0)
-	`).Error; err != nil {
-		t.Fatalf("insert disabled user_tunnel: %v", err)
-	}
-
-	body := bytes.NewBufferString(`{"userId":201}`)
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/tunnel/user/list", body)
-	req.Header.Set("Authorization", adminToken)
-	req.Header.Set("Content-Type", "application/json")
-	res := httptest.NewRecorder()
-
-	router.ServeHTTP(res, req)
-
-	var out response.R
-	if err := json.NewDecoder(res.Body).Decode(&out); err != nil {
-		t.Fatalf("decode response: %v", err)
-	}
-	if out.Code != 0 {
-		t.Fatalf("expected code 0, got %d (%s)", out.Code, out.Msg)
-	}
-
-	items, ok := out.Data.([]interface{})
-	if !ok {
-		t.Fatalf("expected array data, got %T", out.Data)
-	}
-	if len(items) != 2 {
-		t.Fatalf("expected 2 items, got %d", len(items))
-	}
-
-	statusByTunnelID := make(map[int64]int, len(items))
-	for _, item := range items {
-		obj, ok := item.(map[string]interface{})
-		if !ok {
-			t.Fatalf("expected object item, got %T", item)
-		}
-		tunnelID, ok := obj["tunnelId"].(float64)
-		if !ok {
-			t.Fatalf("expected tunnelId to be float64, got %T", obj["tunnelId"])
-		}
-		status, ok := obj["status"].(float64)
-		if !ok {
-			t.Fatalf("expected status to be float64, got %T", obj["status"])
-		}
-		statusByTunnelID[int64(tunnelID)] = int(status)
-	}
-
-	if statusByTunnelID[301] != 1 {
-		t.Fatalf("expected enabled tunnel status 1, got %d", statusByTunnelID[301])
-	}
-	if statusByTunnelID[302] != 0 {
-		t.Fatalf("expected disabled tunnel status 0, got %d", statusByTunnelID[302])
-	}
-}

go-gost/AGENTS.md

@@ -1,9 +1,6 @@
 # GO-GOST SERVICE KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
+**Generated:** Sun Feb 15 2026
 
 ## OVERVIEW
 Forwarding agent built on GOST v3 with a local fork of `github.com/go-gost/x` under `x/`.
@@ -22,18 +19,16 @@ go-gost/
 ## WHERE TO LOOK
 | Task | Location | Notes |
 |------|----------|-------|
-| **Panel integration config** | `go-gost/config.go` | Expects `config.json` in cwd by default |
-| **Service lifecycle/reload** | `go-gost/program.go` | Parses config; handles SIGHUP reload |
-| **WebSocket reporting** | `go-gost/main.go` | Starts reporter + sets HTTP report URL |
-| **Protocol behaviors** | `go-gost/x/` | Handlers/listeners/dialers live here |
-| **Build** | `go-gost/Makefile` | Cross-compile targets for amd64/arm64 |
+| Panel integration config | `go-gost/config.go` | Expects `config.json` in cwd by default |
+| Service lifecycle/reload | `go-gost/program.go` | Parses config; handles SIGHUP reload |
+| WebSocket reporting | `go-gost/main.go` | Starts reporter + sets HTTP report URL |
+| Protocol behaviors | `go-gost/x/` | Handlers/listeners/dialers live here |
 
 ## CONVENTIONS
 - Two configs exist: panel integration uses `config.json`; forwarding services use GOST config (defaults to `gost.{json,yaml}` via viper search paths).
 - `go-gost/x/` is the primary extension surface; avoid editing vendored deps.
 - Agent communicates with panel via WebSocket (real-time commands) + HTTP (batch traffic reports).
 - All panel communication uses AES encryption with node `secret` as PSK.
-- CI builds with `CGO_ENABLED=0` for static binaries, then compresses with UPX.
 
 ## ANTI-PATTERNS
 - **DO NOT EDIT** generated protobuf in `x/internal/util/grpc/proto/`.

go-gost/main.go

@@ -109,12 +109,12 @@ func main() {
 	// 加载配置文件
 	config, err := LoadConfig("config.json")
 	if err != nil {
-		fmt.Printf("❌ 配置加载失败: %v\n", err)
+		fmt.Println("❌ 配置加载失败: %v\n", err)
 		fmt.Println("请确保当前目录存在 config.json 文件")
 		os.Exit(1)
 	}
 
-	fmt.Printf("✅ 配置加载成功 - addr: %s\n", config.Addr)
+	fmt.Println("✅ 配置加载成功 - addr: %s", config.Addr)
 
 	log := xlogger.NewLogger()
 	logger.SetDefault(log)

go-gost/x/AGENTS.md

@@ -1,38 +1,32 @@
 # GO-GOST/X KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
-
 ## OVERVIEW
 Local fork of `github.com/go-gost/x` used by `go-gost/` via `replace github.com/go-gost/x => ./x`. Most protocol/runtime behavior changes happen here. 30+ top-level packages - framework-style layout.
 
 ## STRUCTURE
 ```
 go-gost/x/
-├── api/        # Gin management API + embedded swagger docs (22 files)
+├── api/        # Gin management API + embedded swagger docs
 ├── config/     # Config model + parsing/load/reload
 ├── connector/  # Outbound connect implementations
-├── dialer/     # Outbound dialers (tcp/tls/ws/quic/...)
+├── dialer/     # Outbound dialers (tcp/tls/ws/quic/...) 
 ├── handler/    # Protocol handlers (socks/http/tunnel/relay/...)
 ├── listener/   # Inbound listeners (tcp/udp/tun/tap/redirect/...)
 ├── limiter/    # Traffic/rate/conn limiters
-├── registry/   # Registries for services/handlers/listeners/etc (20 files)
+├── registry/   # Registries for services/handlers/listeners/etc
 ├── service/    # Service wrappers + reporting hooks
-├── socket/     # WebSocket reporter / panel integration (6 files)
+├── socket/     # WebSocket reporter / panel integration
 └── internal/   # Shared internals (grpc proto, net utils, sniffing, tls, ...)
 ```
 
 ## WHERE TO LOOK
 | Task | Location | Notes |
 |------|----------|-------|
-| **Management API routes/auth** | `go-gost/x/api/api.go` | `/docs`, `/config/*`; BasicAuth + interceptor |
-| **Service config parsing** | `go-gost/x/config/parsing/` | Converts config to running services |
-| **Add a handler** | `go-gost/x/handler/` | Per-protocol subdirs |
-| **Add a listener/dialer** | `go-gost/x/listener/`, `go-gost/x/dialer/` | Transport variants |
-| **Panel reporting** | `go-gost/x/socket/` | WebSocket + HTTP report URL hooks |
-| **Register new component** | `go-gost/x/registry/` | `Register{Type}(name, creator)` |
+| Management API routes/auth | `go-gost/x/api/api.go` | `/docs`, `/config/*`; BasicAuth + interceptor |
+| Service config parsing | `go-gost/x/config/parsing/` | Converts config to running services |
+| Add a handler | `go-gost/x/handler/` | Per-protocol subdirs |
+| Add a listener/dialer | `go-gost/x/listener/`, `go-gost/x/dialer/` | Transport variants |
+| Panel reporting | `go-gost/x/socket/` | WebSocket + HTTP report URL hooks |
 
 ## CONVENTIONS
 - `go-gost/x/` is a standalone Go module (`go-gost/x/go.mod`); run go tooling from this dir when debugging module resolution.
@@ -47,4 +41,4 @@ go-gost/x/
 ```bash
 cd go-gost/x
 go test ./...
-```
+```

go-gost/x/api/AGENTS.md

@@ -1,10 +1,5 @@
 # GO-GOST/X API KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
-
 ## OVERVIEW
 Gin-based management API for reading/writing config and controlling services at runtime.
 

go-gost/x/config/AGENTS.md

@@ -1,10 +1,5 @@
 # GO-GOST/X CONFIG KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
-
 ## OVERVIEW
 Config model + parsing/loading pipeline for the `go-gost/x` runtime. This is the bridge between `gost.json`/`gost.yaml` and in-memory registries/services.
 

go-gost/x/connector/AGENTS.md

@@ -1,9 +1,6 @@
 # GOST CONNECTOR KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
+**Generated:** Fri Feb 13 2026
 
 ## OVERVIEW
 Connection initiators (clients) for various protocols in GOST forwarding.

go-gost/x/dialer/AGENTS.md

@@ -1,10 +1,5 @@
 # GO-GOST/X DIALERS KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
-
 ## OVERVIEW
 Outbound dialers (client-side connection establishment) used by connectors/handlers.
 

go-gost/x/handler/AGENTS.md

@@ -1,10 +1,5 @@
 # GO-GOST/X HANDLERS KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
-
 ## OVERVIEW
 Protocol handlers (server-side request handling) used by services defined in the GOST config.
 

go-gost/x/listener/AGENTS.md

@@ -1,10 +1,5 @@
 # GO-GOST/X LISTENERS KNOWLEDGE BASE
 
-**Generated:** Fri Mar 20 2026
-**Commit:** f45f960
-**Branch:** main
-**Tag:** 2.1.9-beta6
-
 ## OVERVIEW
 Inbound listeners (transport-level accept loops) used by services defined in the GOST config.