refactor(repo): conform structure to AGENTS.md (web->frontend, internal/api->cmd/webui/{api,handlers}, docs/README+CHANGELOGs, module .gitignores, drop stray library/ and committed debug bins)

backend/cmd/webui/handlers/auth.go

@@ -0,0 +1,57 @@
+package handlers
+
+import (
+	"errors"
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/jackc/pgx/v5"
+
+	"booklib/internal/auth"
+)
+
+const loginWindow = time.Minute
+const loginMax = 5
+
+func (h *H) Login(c *gin.Context) {
+	var req struct{ Username, Password string }
+	if c.ShouldBindJSON(&req) != nil || req.Username == "" || req.Password == "" {
+		err(c, http.StatusBadRequest, "bad_request", "username and password required")
+		return
+	}
+	if n := h.rdb.IncrWindow(c, "loginrl:"+c.ClientIP(), loginWindow); n > loginMax {
+		err(c, http.StatusTooManyRequests, "rate_limited", "too many login attempts")
+		return
+	}
+	u, qerr := h.st.GetUserByName(c, req.Username)
+	if qerr != nil {
+		if !errors.Is(qerr, pgx.ErrNoRows) {
+			dbErr(c, qerr)
+			return
+		}
+		// 用户不存在也走一次 bcrypt，防用户名枚举时序差
+		auth.CheckPassword("$2a$12$V5TmlpkEi9G/DFAmnkt9YunNdGLnnW921/5TcSo4OeE6iaaLDPN1K", req.Password)
+		err(c, http.StatusUnauthorized, "unauthorized", "bad credentials")
+		return
+	}
+	if !auth.CheckPassword(u.PasswordHash, req.Password) {
+		err(c, http.StatusUnauthorized, "unauthorized", "bad credentials")
+		return
+	}
+	tok, serr := auth.Sign(h.cfg.JWTSecret, u.ID, u.Role)
+	if serr != nil {
+		err(c, http.StatusInternalServerError, "internal", "sign")
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"token": tok})
+}
+
+func (h *H) Me(c *gin.Context) {
+	u, qerr := h.st.GetUserByID(c, uid(c))
+	if qerr != nil {
+		err(c, http.StatusUnauthorized, "unauthorized", "no such user")
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"id": u.ID, "username": u.Username, "role": u.Role})
+}