From f19412953fbec09eb25b9e06dcbb393df5881d60 Mon Sep 17 00:00:00 2001
From: npmrun <1549469775@qq.com>
Date: Fri, 24 Apr 2026 22:30:58 +0800
Subject: [PATCH] feat(global-config): add showDiscoverInHeaderForGuest option
 and update related components

- Introduced a new configuration option `showDiscoverInHeaderForGuest` to control the visibility of the "Discover" navigation link for guests.
- Updated the AppShell component to conditionally render the "Discover" link based on the user's login status and the new config option.
- Modified global configuration handling to include the new option, ensuring it is fetched and saved correctly.
- Enhanced middleware to allow guest access to the "Discover" route if the new config option is enabled.

These changes improve the user experience by providing guests with access to discover content while maintaining control over navigation visibility.
---
 app/components/AppShell.vue         |  17 ++++++++++++++---
 app/composables/useGlobalConfig.ts  |   3 +++
 app/middleware/auth.global.ts       |   6 +++++-
 app/pages/me/admin/config/index.vue |  12 +++++++++++-
 app/pages/me/posts/[id].vue         |  14 ++++++--------
 app/pages/me/posts/new.vue          |   9 ++-------
 app/utils/post-slug.ts              |  11 +++++++++++
 packages/drizzle-pkg/db.sqlite      | Bin 163840 -> 163840 bytes
 server/api/config/global.get.ts     |   6 +++++-
 server/api/discover/users.get.ts    |  10 +++++++++-
 server/service/config/registry.ts   |   7 +++++++
 server/utils/auth-api-routes.ts     |   1 +
 12 files changed, 74 insertions(+), 22 deletions(-)

diff --git a/app/components/AppShell.vue b/app/components/AppShell.vue
index b12d5c9..c86d8dc 100644
--- a/app/components/AppShell.vue
+++ b/app/components/AppShell.vue
@@ -12,7 +12,7 @@ withDefaults(
 const route = useRoute()
 const { loggedIn, user, clear, initialized, ensureClientMeSynced } = useAuthSession()
 const { fetchData } = useClientApi()
-const { allowRegister, siteName } = useGlobalConfig()
+const { allowRegister, siteName, showDiscoverInHeaderForGuest } = useGlobalConfig()
 
 const logoutLoading = ref(false)
 
@@ -63,6 +63,7 @@ function navActive(to: string) {
 
 const consoleNavActive = computed(() => navActive('/me'))
 const showQuickCreate = computed(() => loggedIn.value && initialized.value)
+const showGuestDiscoverNav = computed(() => !loggedIn.value && showDiscoverInHeaderForGuest.value)
 
 const accountMenuItems = computed(() => {
   const u = user.value
@@ -122,11 +123,12 @@ async function logout() {
             </NuxtLink>
 
             <nav
-              v-if="loggedIn"
+              v-if="loggedIn || showGuestDiscoverNav"
               class="hidden min-w-0 flex-1 items-center gap-0.5 overflow-x-auto md:flex"
               aria-label="主导航"
             >
               <UButton
+                v-if="loggedIn"
                 :to="homeNav.to"
                 :icon="homeNav.icon"
                 :label="homeNav.label"
@@ -139,6 +141,7 @@ async function logout() {
                 ]"
               />
               <UButton
+                v-if="loggedIn || showGuestDiscoverNav"
                 :to="discoverNav.to"
                 :icon="discoverNav.icon"
                 :label="discoverNav.label"
@@ -150,7 +153,7 @@ async function logout() {
                   navActive(discoverNav.to) ? 'bg-elevated text-highlighted' : 'text-muted',
                 ]"
               />
-              <UDropdownMenu :items="consoleDropdownItems" :content="{ align: 'start' }">
+              <UDropdownMenu v-if="loggedIn" :items="consoleDropdownItems" :content="{ align: 'start' }">
                 <UButton
                   color="neutral"
                   variant="ghost"
@@ -241,6 +244,14 @@ async function logout() {
             <template v-else>
               <UButton to="/login" color="neutral" variant="ghost" label="登录" />
               <UButton
+                v-if="showGuestDiscoverNav"
+                to="/discover"
+                color="neutral"
+                variant="ghost"
+                label="发现"
+                class="md:hidden"
+              />
+              <UButton
                 v-if="allowRegister"
                 to="/register"
                 color="neutral"
diff --git a/app/composables/useGlobalConfig.ts b/app/composables/useGlobalConfig.ts
index 43dea96..f39dd33 100644
--- a/app/composables/useGlobalConfig.ts
+++ b/app/composables/useGlobalConfig.ts
@@ -3,6 +3,7 @@ import { request, unwrapApiBody, type ApiResponse } from '../utils/http/factory'
 export type GlobalConfig = {
   siteName: string
   allowRegister: boolean
+  showDiscoverInHeaderForGuest: boolean
   commentEmailNotifyEnabled: boolean
   commentMailFromEmail: string
   commentSmtpHost: string
@@ -19,6 +20,7 @@ type GlobalConfigResult = {
 const DEFAULT_GLOBAL_CONFIG: GlobalConfig = {
   siteName: 'Person Panel',
   allowRegister: true,
+  showDiscoverInHeaderForGuest: true,
   commentEmailNotifyEnabled: false,
   commentMailFromEmail: '',
   commentSmtpHost: '',
@@ -53,6 +55,7 @@ export function useGlobalConfig() {
       return n && n.length > 0 ? n : DEFAULT_GLOBAL_CONFIG.siteName
     }),
     allowRegister: computed(() => config.value.allowRegister),
+    showDiscoverInHeaderForGuest: computed(() => config.value.showDiscoverInHeaderForGuest),
     pending,
     error,
     refresh,
diff --git a/app/middleware/auth.global.ts b/app/middleware/auth.global.ts
index 453620c..4e83b55 100644
--- a/app/middleware/auth.global.ts
+++ b/app/middleware/auth.global.ts
@@ -5,6 +5,7 @@ import {
   normalizeSafeRedirect,
 } from "../utils/auth-routes";
 import { useAuthSession } from "../composables/useAuthSession";
+import { useGlobalConfig } from "../composables/useGlobalConfig";
 
 export default defineNuxtRouteMiddleware(async (to) => {
   if(to.path.startsWith("/__nuxt_error")) {
@@ -24,8 +25,11 @@ export default defineNuxtRouteMiddleware(async (to) => {
   const currentPath = to.path;
   const currentFullPath = to.fullPath;
   const isLoggedIn = loggedIn.value;
+  const { showDiscoverInHeaderForGuest } = useGlobalConfig();
+  const isDiscoverRoute = currentPath === "/discover" || currentPath.startsWith("/discover/");
+  const canGuestAccessDiscover = isDiscoverRoute && showDiscoverInHeaderForGuest.value;
 
-  if (!isLoggedIn && !isPublicRoute(currentPath)) {
+  if (!isLoggedIn && !isPublicRoute(currentPath) && !canGuestAccessDiscover) {
     return navigateTo({
       path: "/login",
       query: { redirect: currentFullPath },
diff --git a/app/pages/me/admin/config/index.vue b/app/pages/me/admin/config/index.vue
index ffe74c7..58522e0 100644
--- a/app/pages/me/admin/config/index.vue
+++ b/app/pages/me/admin/config/index.vue
@@ -7,6 +7,7 @@ type GlobalConfigPayload = {
   config: {
     siteName: string
     allowRegister: boolean
+    showDiscoverInHeaderForGuest: boolean
     mediaOrphanAutoSweepEnabled: boolean
     mediaOrphanAutoSweepIntervalMinutes: number
     commentEmailNotifyEnabled: boolean
@@ -30,6 +31,7 @@ const saving = ref(false)
 const testingEmail = ref(false)
 const siteName = ref('')
 const allowRegister = ref(true)
+const showDiscoverInHeaderForGuest = ref(true)
 const mediaOrphanAutoSweepEnabled = ref(false)
 const mediaOrphanAutoSweepIntervalMinutes = ref(60)
 const commentEmailNotifyEnabled = ref(false)
@@ -72,6 +74,7 @@ async function load() {
     const { config: cfg } = await fetchData<GlobalConfigPayload>('/api/config/global')
     siteName.value = cfg.siteName
     allowRegister.value = cfg.allowRegister
+    showDiscoverInHeaderForGuest.value = cfg.showDiscoverInHeaderForGuest
     mediaOrphanAutoSweepEnabled.value = cfg.mediaOrphanAutoSweepEnabled
     mediaOrphanAutoSweepIntervalMinutes.value = cfg.mediaOrphanAutoSweepIntervalMinutes
     commentEmailNotifyEnabled.value = cfg.commentEmailNotifyEnabled
@@ -106,6 +109,7 @@ async function save() {
   try {
     await putKey('siteName', siteName.value.trim())
     await putKey('allowRegister', allowRegister.value)
+    await putKey('showDiscoverInHeaderForGuest', showDiscoverInHeaderForGuest.value)
     await putKey('mediaOrphanAutoSweepEnabled', mediaOrphanAutoSweepEnabled.value)
     await putKey('mediaOrphanAutoSweepIntervalMinutes', mediaOrphanAutoSweepIntervalMinutes.value)
     await putKey('commentEmailNotifyEnabled', commentEmailNotifyEnabled.value)
@@ -151,7 +155,7 @@ async function sendTestEmail() {
         应用配置
       </h1>
       <p class="mt-1 text-sm text-muted">
-        管理全局设置：站点名称、注册开关、媒体自动清扫与评论通知邮件。
+        管理全局设置：站点名称、注册与导航开关、媒体自动清扫与评论通知邮件。
       </p>
     </div>
 
@@ -175,6 +179,12 @@ async function sendTestEmail() {
           <UCheckbox v-model="allowRegister" label="开启" />
         </UFormField>
         <UFormField
+          label="未登录时在 Header 显示发现入口"
+          description="关闭后，游客将不再在顶栏看到“发现”导航入口。"
+        >
+          <UCheckbox v-model="showDiscoverInHeaderForGuest" label="显示发现入口" />
+        </UFormField>
+        <UFormField
           label="媒体孤儿自动清扫"
           description="全站生效、仅删除已过宽限期且无引用的图片、建议先在「图片孤儿审查」确认。"
         >
diff --git a/app/pages/me/posts/[id].vue b/app/pages/me/posts/[id].vue
index 9ef0640..6aaad97 100644
--- a/app/pages/me/posts/[id].vue
+++ b/app/pages/me/posts/[id].vue
@@ -1,6 +1,6 @@
 <script setup lang="ts">
 import { useAuthSession } from '../../../composables/useAuthSession'
-import { normalizePostSlugCandidate } from '../../../utils/post-slug'
+import { generateRandomPostSlug } from '../../../utils/post-slug'
 
 const route = useRoute()
 const id = computed(() => route.params.id as string)
@@ -18,6 +18,7 @@ const state = reactive({
 })
 const loading = ref(true)
 const saving = ref(false)
+const persistedSlug = ref('')
 const visibilityItems = [
   { label: '私密', value: 'private' },
   { label: '公开', value: 'public' },
@@ -26,7 +27,8 @@ const visibilityItems = [
 const bodyLength = computed(() => state.bodyMarkdown.trim().length)
 
 const publicPostHref = computed(() => {
-  if (state.visibility !== 'public') {
+  const hasUnsavedSlugChange = state.slug !== persistedSlug.value
+  if (state.visibility !== 'public' || hasUnsavedSlugChange) {
     return `/me/posts/preview/${id.value}`
   }
   const ps = user.value?.publicSlug
@@ -51,6 +53,7 @@ async function load(options?: { silent?: boolean }) {
       visibility: p.visibility,
       shareToken: p.shareToken ?? null,
     })
+    persistedSlug.value = p.slug
   } finally {
     if (!silent) {
       loading.value = false
@@ -72,13 +75,8 @@ usePageTitle(() => {
 })
 
 function generateSlugFromTitle() {
-  if (!state.title.trim()) {
-    toast.add({ title: '请先填写标题', color: 'warning' })
-    return
-  }
-
   const previous = state.slug
-  const normalized = normalizePostSlugCandidate(state.title)
+  const normalized = generateRandomPostSlug()
 
   state.slug = normalized
 
diff --git a/app/pages/me/posts/new.vue b/app/pages/me/posts/new.vue
index bf46425..299ac05 100644
--- a/app/pages/me/posts/new.vue
+++ b/app/pages/me/posts/new.vue
@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import { normalizePostSlugCandidate } from '../../../utils/post-slug'
+import { generateRandomPostSlug } from '../../../utils/post-slug'
 
 usePageTitle('新建文章')
 
@@ -23,13 +23,8 @@ const visibilityItems = [
 const bodyLength = computed(() => state.bodyMarkdown.trim().length)
 
 function generateSlugFromTitle() {
-  if (!state.title.trim()) {
-    toast.add({ title: '请先填写标题', color: 'warning' })
-    return
-  }
-
   const previous = state.slug
-  const normalized = normalizePostSlugCandidate(state.title)
+  const normalized = generateRandomPostSlug()
 
   state.slug = normalized
 
diff --git a/app/utils/post-slug.ts b/app/utils/post-slug.ts
index 6c115d5..d559339 100644
--- a/app/utils/post-slug.ts
+++ b/app/utils/post-slug.ts
@@ -14,3 +14,14 @@ export function normalizePostSlugCandidate(input: string): string {
   return limited
 }
 
+export function generateRandomPostSlug(): string {
+  // 输出如 post-a1b2c3d4e5，满足现有 slug 校验规则。
+  const alphabet = 'abcdefghijklmnopqrstuvwxyz0123456789'
+  let suffix = ''
+  for (let i = 0; i < 10; i += 1) {
+    const idx = Math.floor(Math.random() * alphabet.length)
+    suffix += alphabet[idx]
+  }
+  return `post-${suffix}`
+}
+
diff --git a/packages/drizzle-pkg/db.sqlite b/packages/drizzle-pkg/db.sqlite
index 2870691248a97106267608d80b31ad93d5f6446f..053f98e7447c7ef4d493645ef4e9743af514a5d7 100644
GIT binary patch
delta 670
zcmZo@;A&{#njp=XKT*b+F@Iyi5`AVCewEGa25<SyO-xe_%`K8GbWPJz(sWIXjgxhg
z5)+Md&CCsqjm(YAlannC8RtHJkeSIicmL(5S*9$kp`5I&lN0?_Ci~lO<zeBEW#EtH
zzro+ezkaiTg9g6}F(yuq@m~RS!`sd50e|)7czOMq`ET-X;TPfe;JeS?!26nSBVQq(
z2k%ziW?uiziV8Zsrp89RtgfQcti>7m<t~}U$@yieMV@&csfj76MQ-^;?xm^4B_&0r
zsY&_yIjM<xK*wHTxjDJHH-%;Y6;|iTuY1iw4F1V#eeNKJ(d5EDMG!-6^0Yoz5JPhE
z{k~KngXP&|kA4#n<MZT(eqE3h)8vi)Dj<<FlW+Dbs{$DZxfmE2c==8-@IT_u;t%Av
z<$KMq$uG?JpZ^g5EdCC@Q~a9+7tH3H7{I5f!0gJ1&(XY_U(b_t6k_FH#lU}xe?R{h
z{#C%xJj#C*=<g}~q9QDu+KdJH#U;9hDJB_NmRX4frfi${zjxojGM9mW?sl#PjFb8K
z6B&6KI13e-85qP_8CXT9pWDx9H2wa1MlNQC>k`{vuV<8W;9=pcW8ewlVdebES+`kH
zAdj=Yl8ujnQ(N2LkU@}Dl7W@=>AHE(IwwQO=j*1U+4{79;`1r<pKYEBWIUa-;n}pE
zFPry1o3Z}+nl(>$bOO20J2pPq(e-T8OrQb?8669Zhcoq_1*J(jnaN<bH;_EP;6rl^
MEC2StKN*?Z0BI`tZ2$lO

delta 435
zcma*ize@sP90u_B&3lu(?%uETgOVDuBx*Rk?Cf%giioU13u-G!OTjk(g9|}g{829?
z6iHM=G*ohlLy-`)G_+PrLNo+N1kvIU<^2b3AD-did30USbs^V@gIisbI9Oac_Sgvh
zFzm_))dr*furd-+<cOlFvg#k!<cLr8$+7UznzlOZ_YTGsykC|2X7K(MI-K=!WRWL?
zg+p!@8Y_teR0PZL1S+Hq$9O-u|I^5pLMJu??}mNu$I~TBNgF)FCA30-Rza6cTBHdY
zkV;b0aCNUrESX;8uHvkNnQ5(#?HksYnYI$b5*e43e6gL(l!ZrD%|tD1us~L|u*dYQ
zY~hR*vu+D<_MGkQsUs*LghXm0c!hPChf!+60JP9wxP@KVG`e%Alqrs0!z?%_nmMQ-
zxQ7aS*Z;o39o*H|9YJFg$2)P@sC-Uea0LW~vT%SIIM51~5T9^0Ak<C}Y0E!Uus8p5
ij)na78RpAh=eT)Xu<<n{E{KG$87_y(muod_PyGQ(mydk_

diff --git a/server/api/config/global.get.ts b/server/api/config/global.get.ts
index 41e04f5..5080be9 100644
--- a/server/api/config/global.get.ts
+++ b/server/api/config/global.get.ts
@@ -1,7 +1,11 @@
 import { KNOWN_CONFIG_KEYS } from "#server/service/config/registry";
 import type { KnownConfigKey, KnownConfigValue } from "#server/service/config/registry";
 
-const PUBLIC_GLOBAL_CONFIG_KEYS = ["siteName", "allowRegister"] as const satisfies readonly KnownConfigKey[];
+const PUBLIC_GLOBAL_CONFIG_KEYS = [
+    "siteName",
+    "allowRegister",
+    "showDiscoverInHeaderForGuest",
+] as const satisfies readonly KnownConfigKey[];
 const SECRET_MASKED_GLOBAL_CONFIG_KEYS = new Set<KnownConfigKey>(["commentSmtpPass"]);
 
 export default defineWrappedResponseHandler(async (event) => {
diff --git a/server/api/discover/users.get.ts b/server/api/discover/users.get.ts
index db887c7..9c44f15 100644
--- a/server/api/discover/users.get.ts
+++ b/server/api/discover/users.get.ts
@@ -1,7 +1,15 @@
+import { getRequestIP } from "h3";
 import { listDiscoverUsersPage } from "#server/service/discover";
+import { assertUnderRateLimit } from "#server/utils/simple-rate-limit";
 
 export default defineWrappedResponseHandler(async (event) => {
-  await event.context.auth.requireUser();
+  const ip = getRequestIP(event, { xForwardedFor: true }) ?? "unknown";
+  assertUnderRateLimit(`discover-users:${ip}`, 120, 60_000);
+
+  const showDiscoverInHeaderForGuest = await event.context.config.getGlobal("showDiscoverInHeaderForGuest");
+  if (!showDiscoverInHeaderForGuest) {
+    await event.context.auth.requireUser();
+  }
   const q = getQuery(event);
   const payload = await listDiscoverUsersPage(q.page);
   return R.success(payload);
diff --git a/server/service/config/registry.ts b/server/service/config/registry.ts
index a2a38d9..7b9e77c 100644
--- a/server/service/config/registry.ts
+++ b/server/service/config/registry.ts
@@ -39,6 +39,13 @@ const CONFIG_REGISTRY = {
     defaultValue: true,
     userOverridable: false,
   }),
+  showDiscoverInHeaderForGuest: defineConfig<boolean>({
+    key: "showDiscoverInHeaderForGuest",
+    scope: "global",
+    valueType: "boolean",
+    defaultValue: true,
+    userOverridable: false,
+  }),
   mediaOrphanAutoSweepEnabled: defineConfig<boolean>({
     key: "mediaOrphanAutoSweepEnabled",
     scope: "global",
diff --git a/server/utils/auth-api-routes.ts b/server/utils/auth-api-routes.ts
index ec0ba6b..4840340 100644
--- a/server/utils/auth-api-routes.ts
+++ b/server/utils/auth-api-routes.ts
@@ -10,6 +10,7 @@ const API_ALLOWLIST: RouteRule[] = [
   /** 访客可读：无 Cookie 时不查库，用于客户端与 SSR 会话对齐 */
   { path: "/api/auth/session", methods: ["GET"] },
   { path: "/api/config/global", methods: ["GET"] },
+  { path: "/api/discover/users", methods: ["GET"] },
 ];
 
 /** 允许访客发表评论的公开 POST（其余 /api/public/ 写操作仍拒绝） */