feat: add Google account sign-in

internal/app/httpserver/middleware/rate_limit.go

@@ -234,6 +234,19 @@ func KeyByIP(c *gin.Context) string {
 	return c.ClientIP()
 }
 
+// KeyByUserIDAndIP isolates authenticated mutation limits by both account and
+// source IP. It falls back to IP when authentication context is unavailable.
+func KeyByUserIDAndIP(c *gin.Context) string {
+	if c == nil {
+		return ""
+	}
+	userID, exists := c.Get("user_id")
+	if !exists {
+		return c.ClientIP()
+	}
+	return fmt.Sprintf("%v|%s", userID, c.ClientIP())
+}
+
 // KeyByUpstreamApiKey 使用上游 API Key 作为限流 key
 func KeyByUpstreamApiKey(c *gin.Context) string {
 	apiKey := c.GetHeader("Dujiao-Next-Api-Key")

internal/app/httpserver/route_structure_test.go

@@ -72,6 +72,9 @@ func TestRouteDomainFilesPreserveTrustBoundaries(t *testing.T) {
 				`userauthtransport.RegisterUserTelegramRoutes(user, userTelegramHandler)`,
 				`userauthtransport.RegisterUserTelegramOIDCAuthRoutes(auth, userTelegramOIDCHandler, middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByIP))`,
 				`userauthtransport.RegisterUserTelegramOIDCRoutes(user, userTelegramOIDCHandler)`,
+				`userauthtransport.RegisterUserGoogleAuthRoutes(auth, userGoogleHandler, middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByIP))`,
+				`userauthtransport.RegisterUserGoogleRoutes(`,
+				`middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByUserIDAndIP)`,
 				`userauthtransport.RegisterUserPasswordAuthRoutes(auth, userPasswordHandler)`,
 				`userauthtransport.RegisterUserPasswordRoutes(user, userPasswordHandler)`,
 				`memberleveltransport.RegisterPublicRoutes(public, publicMemberLevelHandler)`,
@@ -145,6 +148,7 @@ func TestRouteDomainFilesPreserveTrustBoundaries(t *testing.T) {
 				`settingstransport.RegisterAdminSMTPRoutes(authorized,`,
 				`settingstransport.RegisterAdminCaptchaRoutes(authorized,`,
 				`settingstransport.RegisterAdminTelegramAuthRoutes(authorized,`,
+				`settingstransport.RegisterAdminGoogleAuthRoutes(authorized,`,
 				`settingstransport.RegisterAdminOrderEmailTemplateRoutes(authorized,`,
 				`settingstransport.RegisterAdminAffiliateRoutes(authorized,`,
 				`settingstransport.RegisterAdminTelegramBotRoutes(authorized,`,

internal/app/httpserver/router.go

@@ -122,6 +122,7 @@ func SetupRouter(cfg *config.Config, c *container.Container) *gin.Engine {
 	user2FAHandler := userAuthHandlers.TwoFA
 	userTelegramOIDCHandler := userAuthHandlers.TelegramOIDC
 	userTelegramHandler := userAuthHandlers.Telegram
+	userGoogleHandler := userAuthHandlers.Google
 	walletHandlers := walletbootstrap.New(c)
 	userWalletHandler := walletHandlers.User
 	adminWalletHandler := walletHandlers.Admin
@@ -222,7 +223,7 @@ func SetupRouter(cfg *config.Config, c *container.Container) *gin.Engine {
 	sitemaptransport.RegisterRoutes(r, sitemaptransport.NewHandler(c.SitemapService, sitemapbrand.New(c.SettingService)))
 
 	apiV1 := r.Group("/api/v1")
-	registerStorefrontRoutes(apiV1, cfg, c, publicContentHandler, publicCatalogHandler, publicCategoryHandler, userResellerHandler, userResellerProductSettingHandler, userResellerFinanceHandler, userResellerOrderHandler, userApiCredentialHandler, userAuditLogHandler, userGiftCardHandler, publicMemberLevelHandler, userProfileHandler, userEmailHandler, userPasswordHandler, userVerifyHandler, userTelegramOIDCHandler, userTelegramHandler, userLoginHandler, user2FAHandler, publicConfigHandler, userCartHandler, userOrderHandler, guestOrderHandler, orderPreviewHandler, orderCreateHandler, paymentLatestHandler, paymentWriteHandler, userWalletHandler, redisClient, loginRule, guestReadRule, guestWriteRule)
+	registerStorefrontRoutes(apiV1, cfg, c, publicContentHandler, publicCatalogHandler, publicCategoryHandler, userResellerHandler, userResellerProductSettingHandler, userResellerFinanceHandler, userResellerOrderHandler, userApiCredentialHandler, userAuditLogHandler, userGiftCardHandler, publicMemberLevelHandler, userProfileHandler, userEmailHandler, userPasswordHandler, userVerifyHandler, userTelegramOIDCHandler, userTelegramHandler, userGoogleHandler, userLoginHandler, user2FAHandler, publicConfigHandler, userCartHandler, userOrderHandler, guestOrderHandler, orderPreviewHandler, orderCreateHandler, paymentLatestHandler, paymentWriteHandler, userWalletHandler, redisClient, loginRule, guestReadRule, guestWriteRule)
 	registerUpstreamRoutes(apiV1, c, upstreamHandler, redisClient, upstreamAPIRule)
 	registerChannelRoutes(apiV1, c, channelHandler, channelMemberLevelHandler, channelGiftCardHandler, channelAffiliateHandler, channelTelegramBotHandler, channelWalletHandler)
 	registerPaymentCallbackRoutes(apiV1, paymentCallbackHandler, paymentWebhookHandler)

internal/app/httpserver/routes_admin.go

@@ -115,6 +115,7 @@ func registerAdminRoutes(
 	settingstransport.RegisterAdminSMTPRoutes(authorized, settingsbootstrap.NewSMTPHandler(c, cfg))
 	settingstransport.RegisterAdminCaptchaRoutes(authorized, settingsbootstrap.NewCaptchaHandler(c, cfg))
 	settingstransport.RegisterAdminTelegramAuthRoutes(authorized, settingsbootstrap.NewTelegramAuthHandler(c, cfg))
+	settingstransport.RegisterAdminGoogleAuthRoutes(authorized, settingsbootstrap.NewGoogleAuthHandler(c, cfg))
 	notificationtransport.RegisterAdminRoutes(authorized, adminNotificationHandler)
 	settingstransport.RegisterAdminOrderEmailTemplateRoutes(authorized, settingstransport.NewOrderEmailTemplateHandler(c.SettingService))
 	settingstransport.RegisterAdminAffiliateRoutes(authorized, settingstransport.NewAffiliateHandler(c.SettingService))

internal/app/httpserver/routes_storefront.go

@@ -48,6 +48,7 @@ func registerStorefrontRoutes(
 	userVerifyHandler *userauthtransport.UserVerifyHandler,
 	userTelegramOIDCHandler *userauthtransport.UserTelegramOIDCHandler,
 	userTelegramHandler *userauthtransport.UserTelegramHandler,
+	userGoogleHandler *userauthtransport.UserGoogleHandler,
 	userLoginHandler *userauthtransport.UserLoginHandler,
 	user2FAHandler *userauthtransport.User2FAHandler,
 	publicConfigHandler *publicconfigtransport.Handler,
@@ -106,6 +107,7 @@ func registerStorefrontRoutes(
 		userauthtransport.RegisterUser2FAAuthRoutes(auth, user2FAHandler, middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByIP))
 		userauthtransport.RegisterUserTelegramAuthRoutes(auth, userTelegramHandler, middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByIP))
 		userauthtransport.RegisterUserTelegramOIDCAuthRoutes(auth, userTelegramOIDCHandler, middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByIP))
+		userauthtransport.RegisterUserGoogleAuthRoutes(auth, userGoogleHandler, middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByIP))
 		userauthtransport.RegisterUserPasswordAuthRoutes(auth, userPasswordHandler)
 	}
 
@@ -118,6 +120,11 @@ func registerStorefrontRoutes(
 		userauthtransport.RegisterUserPasswordRoutes(user, userPasswordHandler)
 		userauthtransport.RegisterUserTelegramRoutes(user, userTelegramHandler)
 		userauthtransport.RegisterUserTelegramOIDCRoutes(user, userTelegramOIDCHandler)
+		userauthtransport.RegisterUserGoogleRoutes(
+			user,
+			userGoogleHandler,
+			middleware.RateLimitMiddleware(redisClient, loginRule, middleware.KeyByUserIDAndIP),
+		)
 		userauthtransport.RegisterUserEmailRoutes(user, userEmailHandler)
 		userauthtransport.RegisterUser2FARoutes(user, user2FAHandler)
 		carttransport.RegisterUserRoutes(user, userCartHandler)