feat: add invite link generation and copy

feat: add invite token support

backend/open-isle.env.example

@@ -3,6 +3,12 @@ MYSQL_URL=jdbc:mysql://<数据库地址>:<端口>/<数据库名>?useUnicode=yes&
 MYSQL_USER=<数据库用户名>
 MYSQL_PASSWORD=<数据库密码>
 
+# === JWT ===
+JWT_SECRET=<jwt secret>
+JWT_REASON_SECRET=<jwt reason secret>
+JWT_RESET_SECRET=<jwt reset secret>
+JWT_INVITE_SECRET=<jwt invite secret>
+JWT_EXPIRATION=2592000000
 
 # === Resend ===
 RESEND_API_KEY=<你的resend-api-key>
@@ -30,4 +36,4 @@ OPENAI_API_KEY=<你的openai-api-key>
 WEBPUSH_PUBLIC_KEY=<你的webpush-public-key>
 WEBPUSH_PRIVATE_KEY=<你的webpush-private-key>
 
-# LOG_LEVEL=DEBUG
+# LOG_LEVEL=DEBUG

backend/src/main/java/com/openisle/config/ActivityInitializer.java

@@ -6,6 +6,8 @@ import com.openisle.repository.ActivityRepository;
 import lombok.RequiredArgsConstructor;
 import org.springframework.boot.CommandLineRunner;
 import org.springframework.stereotype.Component;
+import java.time.LocalDate;
+import java.time.LocalDateTime;
 
 @Component
 @RequiredArgsConstructor
@@ -22,5 +24,16 @@ public class ActivityInitializer implements CommandLineRunner {
             a.setContent("为了有利于建站推广以及激励发布内容，我们推出了建站送奶茶的活动，前50名达到level 1的用户，可以联系站长获取奶茶/咖啡一杯");
             activityRepository.save(a);
         }
+
+        if (activityRepository.findByType(ActivityType.INVITE_POINTS) == null) {
+            Activity a = new Activity();
+            a.setTitle("🎁邀请码送积分活动");
+            a.setType(ActivityType.INVITE_POINTS);
+            a.setIcon("https://img.icons8.com/color/96/gift.png");
+            a.setContent("使用邀请码注册或邀请好友即可获得积分奖励，快来参与吧！");
+            a.setStartTime(LocalDateTime.now());
+            a.setEndTime(LocalDate.of(LocalDate.now().getYear(), 10, 1).atStartOfDay());
+            activityRepository.save(a);
+        }
     }
 }

backend/src/main/java/com/openisle/config/PointGoodInitializer.java

@@ -0,0 +1,31 @@
+package com.openisle.config;
+
+import com.openisle.model.PointGood;
+import com.openisle.repository.PointGoodRepository;
+import lombok.RequiredArgsConstructor;
+import org.springframework.boot.CommandLineRunner;
+import org.springframework.stereotype.Component;
+
+/** Initialize default point mall goods. */
+@Component
+@RequiredArgsConstructor
+public class PointGoodInitializer implements CommandLineRunner {
+    private final PointGoodRepository pointGoodRepository;
+
+    @Override
+    public void run(String... args) {
+        if (pointGoodRepository.count() == 0) {
+            PointGood g1 = new PointGood();
+            g1.setName("GPT Plus 1 个月");
+            g1.setCost(20000);
+            g1.setImage("https://openisle-1307107697.cos.ap-guangzhou.myqcloud.com/assert/icons/chatgpt.png");
+            pointGoodRepository.save(g1);
+
+            PointGood g2 = new PointGood();
+            g2.setName("奶茶");
+            g2.setCost(5000);
+            g2.setImage("https://openisle-1307107697.cos.ap-guangzhou.myqcloud.com/assert/icons/coffee.png");
+            pointGoodRepository.save(g2);
+        }
+    }
+}

backend/src/main/java/com/openisle/config/SecurityConfig.java

@@ -119,6 +119,8 @@ public class SecurityConfig {
                     .requestMatchers(HttpMethod.GET, "/api/reaction-types").permitAll()
                     .requestMatchers(HttpMethod.GET, "/api/activities/**").permitAll()
                     .requestMatchers(HttpMethod.GET, "/api/sitemap.xml").permitAll()
+                    .requestMatchers(HttpMethod.GET, "/api/point-goods").permitAll()
+                    .requestMatchers(HttpMethod.POST, "/api/point-goods").permitAll()
                     .requestMatchers(HttpMethod.POST, "/api/categories/**").hasAuthority("ADMIN")
                     .requestMatchers(HttpMethod.POST, "/api/tags/**").authenticated()
                     .requestMatchers(HttpMethod.DELETE, "/api/categories/**").hasAuthority("ADMIN")
@@ -151,6 +153,7 @@ public class SecurityConfig {
                         uri.startsWith("/api/search") || uri.startsWith("/api/users") ||
                          uri.startsWith("/api/reaction-types") || uri.startsWith("/api/config") ||
                          uri.startsWith("/api/activities") || uri.startsWith("/api/push/public-key") ||
+                                uri.startsWith("/api/point-goods") ||
                          uri.startsWith("/api/sitemap.xml") || uri.startsWith("/api/medals"));
 
                 if (authHeader != null && authHeader.startsWith("Bearer ")) {

backend/src/main/java/com/openisle/controller/AuthController.java

@@ -29,6 +29,7 @@ public class AuthController {
     private final RegisterModeService registerModeService;
     private final NotificationService notificationService;
     private final UserRepository userRepository;
+    private final InviteService inviteService;
 
 
     @Value("${app.captcha.enabled:false}")
@@ -45,6 +46,25 @@ public class AuthController {
         if (captchaEnabled && registerCaptchaEnabled && !captchaService.verify(req.getCaptcha())) {
             return ResponseEntity.badRequest().body(Map.of("error", "Invalid captcha"));
         }
+        if (req.getInviteToken() != null && !req.getInviteToken().isEmpty()) {
+            if (!inviteService.validate(req.getInviteToken())) {
+                return ResponseEntity.badRequest().body(Map.of("error", "Invalid invite token"));
+            }
+            try {
+                User user = userService.registerWithInvite(
+                        req.getUsername(), req.getEmail(), req.getPassword());
+                inviteService.consume(req.getInviteToken());
+                return ResponseEntity.ok(Map.of(
+                        "token", jwtService.generateToken(user.getUsername()),
+                        "reason_code", "INVITE_APPROVED"
+                ));
+            } catch (FieldException e) {
+                return ResponseEntity.badRequest().body(Map.of(
+                        "field", e.getField(),
+                        "error", e.getMessage()
+                ));
+            }
+        }
         User user = userService.register(
                 req.getUsername(), req.getEmail(), req.getPassword(), "", registerModeService.getRegisterMode());
         emailService.sendEmail(user.getEmail(), "在网站填写验证码以验证", "您的验证码是 " + user.getVerificationCode());
@@ -106,27 +126,42 @@ public class AuthController {
 
     @PostMapping("/google")
     public ResponseEntity<?> loginWithGoogle(@RequestBody GoogleLoginRequest req) {
-        Optional<User> user = googleAuthService.authenticate(req.getIdToken(), registerModeService.getRegisterMode());
-        if (user.isPresent()) {
-            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
-                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+        boolean viaInvite = req.getInviteToken() != null && !req.getInviteToken().isEmpty();
+        if (viaInvite && !inviteService.validate(req.getInviteToken())) {
+            return ResponseEntity.badRequest().body(Map.of("error", "Invalid invite token"));
+        }
+        Optional<AuthResult> resultOpt = googleAuthService.authenticate(
+                req.getIdToken(),
+                registerModeService.getRegisterMode(),
+                viaInvite);
+        if (resultOpt.isPresent()) {
+            AuthResult result = resultOpt.get();
+            if (viaInvite && result.isNewUser()) {
+                inviteService.consume(req.getInviteToken());
+                return ResponseEntity.ok(Map.of(
+                        "token", jwtService.generateToken(result.getUser().getUsername()),
+                        "reason_code", "INVITE_APPROVED"
+                ));
             }
-            if (!user.get().isApproved()) {
-                if (user.get().getRegisterReason() != null && !user.get().getRegisterReason().isEmpty()) {
+            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
+                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
+            }
+            if (!result.getUser().isApproved()) {
+                if (result.getUser().getRegisterReason() != null && !result.getUser().getRegisterReason().isEmpty()) {
                     return ResponseEntity.badRequest().body(Map.of(
                             "error", "Account awaiting approval",
                             "reason_code", "IS_APPROVING",
-                            "token", jwtService.generateReasonToken(user.get().getUsername())
+                            "token", jwtService.generateReasonToken(result.getUser().getUsername())
                     ));
                 }
                 return ResponseEntity.badRequest().body(Map.of(
                         "error", "Account awaiting approval",
                         "reason_code", "NOT_APPROVED",
-                        "token", jwtService.generateReasonToken(user.get().getUsername())
+                        "token", jwtService.generateReasonToken(result.getUser().getUsername())
                 ));
             }
 
-            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
         }
         return ResponseEntity.badRequest().body(Map.of(
                 "error", "Invalid google token",
@@ -165,28 +200,44 @@ public class AuthController {
 
     @PostMapping("/github")
     public ResponseEntity<?> loginWithGithub(@RequestBody GithubLoginRequest req) {
-        Optional<User> user = githubAuthService.authenticate(req.getCode(), registerModeService.getRegisterMode(), req.getRedirectUri());
-        if (user.isPresent()) {
-            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
-                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+        boolean viaInvite = req.getInviteToken() != null && !req.getInviteToken().isEmpty();
+        if (viaInvite && !inviteService.validate(req.getInviteToken())) {
+            return ResponseEntity.badRequest().body(Map.of("error", "Invalid invite token"));
+        }
+        Optional<AuthResult> resultOpt = githubAuthService.authenticate(
+                req.getCode(),
+                registerModeService.getRegisterMode(),
+                req.getRedirectUri(),
+                viaInvite);
+        if (resultOpt.isPresent()) {
+            AuthResult result = resultOpt.get();
+            if (viaInvite && result.isNewUser()) {
+                inviteService.consume(req.getInviteToken());
+                return ResponseEntity.ok(Map.of(
+                        "token", jwtService.generateToken(result.getUser().getUsername()),
+                        "reason_code", "INVITE_APPROVED"
+                ));
             }
-            if (!user.get().isApproved()) {
-                if (user.get().getRegisterReason() != null && !user.get().getRegisterReason().isEmpty()) {
+            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
+                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
+            }
+            if (!result.getUser().isApproved()) {
+                if (result.getUser().getRegisterReason() != null && !result.getUser().getRegisterReason().isEmpty()) {
                     // 已填写注册理由
                     return ResponseEntity.badRequest().body(Map.of(
                             "error", "Account awaiting approval",
                             "reason_code", "IS_APPROVING",
-                            "token", jwtService.generateReasonToken(user.get().getUsername())
+                            "token", jwtService.generateReasonToken(result.getUser().getUsername())
                     ));
                 }
                 return ResponseEntity.badRequest().body(Map.of(
                         "error", "Account awaiting approval",
                         "reason_code", "NOT_APPROVED",
-                        "token", jwtService.generateReasonToken(user.get().getUsername())
+                        "token", jwtService.generateReasonToken(result.getUser().getUsername())
                 ));
             }
 
-            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
         }
         return ResponseEntity.badRequest().body(Map.of(
                 "error", "Invalid github code",
@@ -196,27 +247,43 @@ public class AuthController {
 
     @PostMapping("/discord")
     public ResponseEntity<?> loginWithDiscord(@RequestBody DiscordLoginRequest req) {
-        Optional<User> user = discordAuthService.authenticate(req.getCode(), registerModeService.getRegisterMode(), req.getRedirectUri());
-        if (user.isPresent()) {
-            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
-                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+        boolean viaInvite = req.getInviteToken() != null && !req.getInviteToken().isEmpty();
+        if (viaInvite && !inviteService.validate(req.getInviteToken())) {
+            return ResponseEntity.badRequest().body(Map.of("error", "Invalid invite token"));
+        }
+        Optional<AuthResult> resultOpt = discordAuthService.authenticate(
+                req.getCode(),
+                registerModeService.getRegisterMode(),
+                req.getRedirectUri(),
+                viaInvite);
+        if (resultOpt.isPresent()) {
+            AuthResult result = resultOpt.get();
+            if (viaInvite && result.isNewUser()) {
+                inviteService.consume(req.getInviteToken());
+                return ResponseEntity.ok(Map.of(
+                        "token", jwtService.generateToken(result.getUser().getUsername()),
+                        "reason_code", "INVITE_APPROVED"
+                ));
             }
-            if (!user.get().isApproved()) {
-                if (user.get().getRegisterReason() != null && !user.get().getRegisterReason().isEmpty()) {
+            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
+                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
+            }
+            if (!result.getUser().isApproved()) {
+                if (result.getUser().getRegisterReason() != null && !result.getUser().getRegisterReason().isEmpty()) {
                     return ResponseEntity.badRequest().body(Map.of(
                             "error", "Account awaiting approval",
                             "reason_code", "IS_APPROVING",
-                            "token", jwtService.generateReasonToken(user.get().getUsername())
+                            "token", jwtService.generateReasonToken(result.getUser().getUsername())
                     ));
                 }
                 return ResponseEntity.badRequest().body(Map.of(
                         "error", "Account awaiting approval",
                         "reason_code", "NOT_APPROVED",
-                        "token", jwtService.generateReasonToken(user.get().getUsername())
+                        "token", jwtService.generateReasonToken(result.getUser().getUsername())
                 ));
             }
 
-            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
         }
         return ResponseEntity.badRequest().body(Map.of(
                 "error", "Invalid discord code",
@@ -226,31 +293,44 @@ public class AuthController {
       
     @PostMapping("/twitter")
     public ResponseEntity<?> loginWithTwitter(@RequestBody TwitterLoginRequest req) {
-        Optional<User> user = twitterAuthService.authenticate(
+        boolean viaInvite = req.getInviteToken() != null && !req.getInviteToken().isEmpty();
+        if (viaInvite && !inviteService.validate(req.getInviteToken())) {
+            return ResponseEntity.badRequest().body(Map.of("error", "Invalid invite token"));
+        }
+        Optional<AuthResult> resultOpt = twitterAuthService.authenticate(
                 req.getCode(),
                 req.getCodeVerifier(),
                 registerModeService.getRegisterMode(),
-                req.getRedirectUri());
-        if (user.isPresent()) {
-            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
-                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+                req.getRedirectUri(),
+                viaInvite);
+        if (resultOpt.isPresent()) {
+            AuthResult result = resultOpt.get();
+            if (viaInvite && result.isNewUser()) {
+                inviteService.consume(req.getInviteToken());
+                return ResponseEntity.ok(Map.of(
+                        "token", jwtService.generateToken(result.getUser().getUsername()),
+                        "reason_code", "INVITE_APPROVED"
+                ));
             }
-            if (!user.get().isApproved()) {
-                if (user.get().getRegisterReason() != null && !user.get().getRegisterReason().isEmpty()) {
+            if (RegisterMode.DIRECT.equals(registerModeService.getRegisterMode())) {
+                return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
+            }
+            if (!result.getUser().isApproved()) {
+                if (result.getUser().getRegisterReason() != null && !result.getUser().getRegisterReason().isEmpty()) {
                     return ResponseEntity.badRequest().body(Map.of(
                             "error", "Account awaiting approval",
                             "reason_code", "IS_APPROVING",
-                            "token", jwtService.generateReasonToken(user.get().getUsername())
+                            "token", jwtService.generateReasonToken(result.getUser().getUsername())
                     ));
                 }
                 return ResponseEntity.badRequest().body(Map.of(
                         "error", "Account awaiting approval",
                         "reason_code", "NOT_APPROVED",
-                        "token", jwtService.generateReasonToken(user.get().getUsername())
+                        "token", jwtService.generateReasonToken(result.getUser().getUsername())
                 ));
             }
 
-            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(user.get().getUsername())));
+            return ResponseEntity.ok(Map.of("token", jwtService.generateToken(result.getUser().getUsername())));
         }
         return ResponseEntity.badRequest().body(Map.of(
                 "error", "Invalid twitter code",

backend/src/main/java/com/openisle/controller/InviteController.java

@@ -0,0 +1,23 @@
+package com.openisle.controller;
+
+import com.openisle.service.InviteService;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.PostMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.util.Map;
+
+@RestController
+@RequestMapping("/api/invite")
+@RequiredArgsConstructor
+public class InviteController {
+    private final InviteService inviteService;
+
+    @PostMapping("/generate")
+    public Map<String, String> generate(Authentication auth) {
+        String token = inviteService.generate(auth.getName());
+        return Map.of("token", token);
+    }
+}

backend/src/main/java/com/openisle/controller/PointMallController.java

@@ -0,0 +1,39 @@
+package com.openisle.controller;
+
+import com.openisle.dto.PointGoodDto;
+import com.openisle.dto.PointRedeemRequest;
+import com.openisle.mapper.PointGoodMapper;
+import com.openisle.model.User;
+import com.openisle.service.PointMallService;
+import com.openisle.service.UserService;
+import lombok.RequiredArgsConstructor;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+/** REST controller for point mall. */
+@RestController
+@RequestMapping("/api/point-goods")
+@RequiredArgsConstructor
+public class PointMallController {
+    private final PointMallService pointMallService;
+    private final UserService userService;
+    private final PointGoodMapper pointGoodMapper;
+
+    @GetMapping
+    public List<PointGoodDto> list() {
+        return pointMallService.listGoods().stream()
+                .map(pointGoodMapper::toDto)
+                .collect(Collectors.toList());
+    }
+
+    @PostMapping("/redeem")
+    public Map<String, Integer> redeem(@RequestBody PointRedeemRequest req, Authentication auth) {
+        User user = userService.findByIdentifier(auth.getName()).orElseThrow();
+        int point = pointMallService.redeem(user, req.getGoodId(), req.getContact());
+        return Map.of("point", point);
+    }
+}

backend/src/main/java/com/openisle/dto/DiscordLoginRequest.java

@@ -7,4 +7,5 @@ import lombok.Data;
 public class DiscordLoginRequest {
     private String code;
     private String redirectUri;
+    private String inviteToken;
 }

backend/src/main/java/com/openisle/dto/GithubLoginRequest.java

@@ -7,4 +7,5 @@ import lombok.Data;
 public class GithubLoginRequest {
     private String code;
     private String redirectUri;
+    private String inviteToken;
 }

backend/src/main/java/com/openisle/dto/GoogleLoginRequest.java

@@ -6,4 +6,5 @@ import lombok.Data;
 @Data
 public class GoogleLoginRequest {
     private String idToken;
+    private String inviteToken;
 }

backend/src/main/java/com/openisle/dto/PointGoodDto.java

@@ -0,0 +1,12 @@
+package com.openisle.dto;
+
+import lombok.Data;
+
+/** Point mall good info. */
+@Data
+public class PointGoodDto {
+    private Long id;
+    private String name;
+    private int cost;
+    private String image;
+}

backend/src/main/java/com/openisle/dto/PointRedeemRequest.java

@@ -0,0 +1,10 @@
+package com.openisle.dto;
+
+import lombok.Data;
+
+/** Request to redeem a point mall good. */
+@Data
+public class PointRedeemRequest {
+    private Long goodId;
+    private String contact;
+}

backend/src/main/java/com/openisle/dto/RegisterRequest.java

@@ -9,4 +9,5 @@ public class RegisterRequest {
     private String email;
     private String password;
     private String captcha;
+    private String inviteToken;
 }

backend/src/main/java/com/openisle/dto/TwitterLoginRequest.java

@@ -8,4 +8,5 @@ public class TwitterLoginRequest {
     private String code;
     private String redirectUri;
     private String codeVerifier;
+    private String inviteToken;
 }

backend/src/main/java/com/openisle/mapper/PointGoodMapper.java

@@ -0,0 +1,18 @@
+package com.openisle.mapper;
+
+import com.openisle.dto.PointGoodDto;
+import com.openisle.model.PointGood;
+import org.springframework.stereotype.Component;
+
+/** Mapper for point mall goods. */
+@Component
+public class PointGoodMapper {
+    public PointGoodDto toDto(PointGood good) {
+        PointGoodDto dto = new PointGoodDto();
+        dto.setId(good.getId());
+        dto.setName(good.getName());
+        dto.setCost(good.getCost());
+        dto.setImage(good.getImage());
+        return dto;
+    }
+}

backend/src/main/java/com/openisle/model/ActivityType.java

@@ -3,5 +3,6 @@ package com.openisle.model;
 /** Activity type enumeration. */
 public enum ActivityType {
     NORMAL,
-    MILK_TEA
+    MILK_TEA,
+    INVITE_POINTS
 }

backend/src/main/java/com/openisle/model/InviteToken.java

@@ -0,0 +1,23 @@
+package com.openisle.model;
+
+import jakarta.persistence.*;
+import lombok.Data;
+
+import java.time.LocalDate;
+
+/**
+ * Invite token entity tracking usage counts.
+ */
+@Data
+@Entity
+public class InviteToken {
+    @Id
+    private String token;
+
+    @ManyToOne
+    private User inviter;
+
+    private LocalDate createdDate;
+
+    private int usageCount;
+}

backend/src/main/java/com/openisle/model/NotificationType.java

@@ -32,6 +32,8 @@ public enum NotificationType {
     REGISTER_REQUEST,
     /** A user redeemed an activity reward */
     ACTIVITY_REDEEM,
+    /** A user redeemed a point good */
+    POINT_REDEEM,
     /** You won a lottery post */
     LOTTERY_WIN,
     /** Your lottery post was drawn */

backend/src/main/java/com/openisle/model/PointGood.java

@@ -0,0 +1,26 @@
+package com.openisle.model;
+
+import jakarta.persistence.*;
+import lombok.Getter;
+import lombok.NoArgsConstructor;
+import lombok.Setter;
+
+/** Item available in the point mall. */
+@Entity
+@Getter
+@Setter
+@NoArgsConstructor
+@Table(name = "point_goods")
+public class PointGood {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    private Long id;
+
+    @Column(nullable = false)
+    private String name;
+
+    @Column(nullable = false)
+    private int cost;
+
+    private String image;
+}

backend/src/main/java/com/openisle/repository/InviteTokenRepository.java

@@ -0,0 +1,12 @@
+package com.openisle.repository;
+
+import com.openisle.model.InviteToken;
+import com.openisle.model.User;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+import java.time.LocalDate;
+import java.util.Optional;
+
+public interface InviteTokenRepository extends JpaRepository<InviteToken, String> {
+    Optional<InviteToken> findByInviterAndCreatedDate(User inviter, LocalDate createdDate);
+}

backend/src/main/java/com/openisle/repository/PointGoodRepository.java

@@ -0,0 +1,8 @@
+package com.openisle.repository;
+
+import com.openisle.model.PointGood;
+import org.springframework.data.jpa.repository.JpaRepository;
+
+/** Repository for point mall goods. */
+public interface PointGoodRepository extends JpaRepository<PointGood, Long> {
+}

backend/src/main/java/com/openisle/service/AuthResult.java

@@ -0,0 +1,12 @@
+package com.openisle.service;
+
+import com.openisle.model.User;
+import lombok.Value;
+
+/** Result for OAuth authentication indicating whether a new user was created. */
+@Value
+public class AuthResult {
+    User user;
+    boolean newUser;
+}
+

backend/src/main/java/com/openisle/service/DiscordAuthService.java

@@ -26,7 +26,7 @@ public class DiscordAuthService {
     @Value("${discord.client-secret:}")
     private String clientSecret;
 
-    public Optional<User> authenticate(String code, com.openisle.model.RegisterMode mode, String redirectUri) {
+    public Optional<AuthResult> authenticate(String code, com.openisle.model.RegisterMode mode, String redirectUri, boolean viaInvite) {
         try {
             String tokenUrl = "https://discord.com/api/oauth2/token";
             HttpHeaders headers = new HttpHeaders();
@@ -67,13 +67,13 @@ public class DiscordAuthService {
             if (email == null) {
                 email = (username != null ? username : id) + "@users.noreply.discord.com";
             }
-            return Optional.of(processUser(email, username, avatar, mode));
+            return Optional.of(processUser(email, username, avatar, mode, viaInvite));
         } catch (Exception e) {
             return Optional.empty();
         }
     }
 
-    private User processUser(String email, String username, String avatar, com.openisle.model.RegisterMode mode) {
+    private AuthResult processUser(String email, String username, String avatar, com.openisle.model.RegisterMode mode, boolean viaInvite) {
         Optional<User> existing = userRepository.findByEmail(email);
         if (existing.isPresent()) {
             User user = existing.get();
@@ -82,7 +82,7 @@ public class DiscordAuthService {
                 user.setVerificationCode(null);
                 userRepository.save(user);
             }
-            return user;
+            return new AuthResult(user, false);
         }
         String baseUsername = username != null ? username : email.split("@")[0];
         String finalUsername = baseUsername;
@@ -96,12 +96,12 @@ public class DiscordAuthService {
         user.setPassword("");
         user.setRole(Role.USER);
         user.setVerified(true);
-        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT);
+        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT || viaInvite);
         if (avatar != null) {
             user.setAvatar(avatar);
         } else {
             user.setAvatar("https://cdn.discordapp.com/embed/avatars/0.png");
         }
-        return userRepository.save(user);
+        return new AuthResult(userRepository.save(user), true);
     }
 }

backend/src/main/java/com/openisle/service/GithubAuthService.java

@@ -30,7 +30,7 @@ public class GithubAuthService {
     @Value("${github.client-secret:}")
     private String clientSecret;
 
-    public Optional<User> authenticate(String code, com.openisle.model.RegisterMode mode, String redirectUri) {
+    public Optional<AuthResult> authenticate(String code, com.openisle.model.RegisterMode mode, String redirectUri, boolean viaInvite) {
         try {
             String tokenUrl = "https://github.com/login/oauth/access_token";
             HttpHeaders headers = new HttpHeaders();
@@ -86,13 +86,13 @@ public class GithubAuthService {
             if (email == null) {
                 email = username + "@users.noreply.github.com";
             }
-            return Optional.of(processUser(email, username, avatarUrl, mode));
+            return Optional.of(processUser(email, username, avatarUrl, mode, viaInvite));
         } catch (Exception e) {
             return Optional.empty();
         }
     }
 
-    private User processUser(String email, String username, String avatar, com.openisle.model.RegisterMode mode) {
+    private AuthResult processUser(String email, String username, String avatar, com.openisle.model.RegisterMode mode, boolean viaInvite) {
         Optional<User> existing = userRepository.findByEmail(email);
         if (existing.isPresent()) {
             User user = existing.get();
@@ -101,7 +101,7 @@ public class GithubAuthService {
                 user.setVerificationCode(null);
                 userRepository.save(user);
             }
-            return user;
+            return new AuthResult(user, false);
         }
         String baseUsername = username != null ? username : email.split("@")[0];
         String finalUsername = baseUsername;
@@ -115,12 +115,12 @@ public class GithubAuthService {
         user.setPassword("");
         user.setRole(Role.USER);
         user.setVerified(true);
-        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT);
+        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT || viaInvite);
         if (avatar != null) {
             user.setAvatar(avatar);
         } else {
             user.setAvatar(avatarGenerator.generate(finalUsername));
         }
-        return userRepository.save(user);
+        return new AuthResult(userRepository.save(user), true);
     }
 }

backend/src/main/java/com/openisle/service/GoogleAuthService.java

@@ -25,7 +25,7 @@ public class GoogleAuthService {
     @Value("${google.client-id:}")
     private String clientId;
 
-    public Optional<User> authenticate(String idTokenString, com.openisle.model.RegisterMode mode) {
+    public Optional<AuthResult> authenticate(String idTokenString, com.openisle.model.RegisterMode mode, boolean viaInvite) {
         GoogleIdTokenVerifier verifier = new GoogleIdTokenVerifier.Builder(new NetHttpTransport(), new JacksonFactory())
                 .setAudience(Collections.singletonList(clientId))
                 .build();
@@ -38,13 +38,13 @@ public class GoogleAuthService {
             String email = payload.getEmail();
             String name = (String) payload.get("name");
             String picture = (String) payload.get("picture");
-            return Optional.of(processUser(email, name, picture, mode));
+            return Optional.of(processUser(email, name, picture, mode, viaInvite));
         } catch (Exception e) {
             return Optional.empty();
         }
     }
 
-    private User processUser(String email, String name, String avatar, com.openisle.model.RegisterMode mode) {
+    private AuthResult processUser(String email, String name, String avatar, com.openisle.model.RegisterMode mode, boolean viaInvite) {
         Optional<User> existing = userRepository.findByEmail(email);
         if (existing.isPresent()) {
             User user = existing.get();
@@ -53,8 +53,7 @@ public class GoogleAuthService {
                 user.setVerificationCode(null);
                 userRepository.save(user);
             }
-
-            return user;
+            return new AuthResult(user, false);
         }
         User user = new User();
         String baseUsername = email.split("@")[0];
@@ -68,12 +67,12 @@ public class GoogleAuthService {
         user.setPassword("");
         user.setRole(Role.USER);
         user.setVerified(true);
-        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT);
+        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT || viaInvite);
         if (avatar != null) {
             user.setAvatar(avatar);
         } else {
             user.setAvatar(avatarGenerator.generate(username));
         }
-        return userRepository.save(user);
+        return new AuthResult(userRepository.save(user), true);
     }
 }

backend/src/main/java/com/openisle/service/InviteService.java

@@ -0,0 +1,54 @@
+package com.openisle.service;
+
+import com.openisle.model.InviteToken;
+import com.openisle.model.User;
+import com.openisle.repository.InviteTokenRepository;
+import com.openisle.repository.UserRepository;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.time.LocalDate;
+import java.util.Optional;
+
+@Service
+@RequiredArgsConstructor
+public class InviteService {
+    private final InviteTokenRepository inviteTokenRepository;
+    private final UserRepository userRepository;
+    private final JwtService jwtService;
+    private final PointService pointService;
+
+    public String generate(String username) {
+        User inviter = userRepository.findByUsername(username).orElseThrow();
+        LocalDate today = LocalDate.now();
+        Optional<InviteToken> existing = inviteTokenRepository.findByInviterAndCreatedDate(inviter, today);
+        if (existing.isPresent()) {
+            return existing.get().getToken();
+        }
+        String token = jwtService.generateInviteToken(username);
+        InviteToken inviteToken = new InviteToken();
+        inviteToken.setToken(token);
+        inviteToken.setInviter(inviter);
+        inviteToken.setCreatedDate(today);
+        inviteToken.setUsageCount(0);
+        inviteTokenRepository.save(inviteToken);
+        return token;
+    }
+
+    public boolean validate(String token) {
+        try {
+            jwtService.validateAndGetSubjectForInvite(token);
+        } catch (Exception e) {
+            return false;
+        }
+        InviteToken invite = inviteTokenRepository.findById(token).orElse(null);
+        return invite != null && invite.getUsageCount() < 3;
+    }
+
+    public void consume(String token) {
+        InviteToken invite = inviteTokenRepository.findById(token).orElseThrow();
+        invite.setUsageCount(invite.getUsageCount() + 1);
+        inviteTokenRepository.save(invite);
+        pointService.awardForInvite(invite.getInviter().getUsername());
+    }
+}

backend/src/main/java/com/openisle/service/JwtService.java

@@ -24,6 +24,9 @@ public class JwtService {
     @Value("${app.jwt.reset-secret}")
     private String resetSecret;
 
+    @Value("${app.jwt.invite-secret}")
+    private String inviteSecret;
+
     @Value("${app.jwt.expiration}")
     private long expiration;
 
@@ -70,6 +73,17 @@ public class JwtService {
                 .compact();
     }
 
+    public String generateInviteToken(String subject) {
+        Date now = new Date();
+        Date expiryDate = new Date(now.getTime() + expiration);
+        return Jwts.builder()
+                .setSubject(subject)
+                .setIssuedAt(now)
+                .setExpiration(expiryDate)
+                .signWith(getSigningKeyForSecret(inviteSecret))
+                .compact();
+    }
+
     public String validateAndGetSubject(String token) {
         Claims claims = Jwts.parserBuilder()
                 .setSigningKey(getSigningKeyForSecret(secret))
@@ -96,4 +110,13 @@ public class JwtService {
                 .getBody();
         return claims.getSubject();
     }
+
+    public String validateAndGetSubjectForInvite(String token) {
+        Claims claims = Jwts.parserBuilder()
+                .setSigningKey(getSigningKeyForSecret(inviteSecret))
+                .build()
+                .parseClaimsJws(token)
+                .getBody();
+        return claims.getSubject();
+    }
 }

backend/src/main/java/com/openisle/service/NotificationService.java

@@ -141,6 +141,19 @@ public class NotificationService {
         }
     }
 
+    /**
+     * Create notifications for all admins when a user redeems a point good.
+     * Old redeem notifications from the same user are removed first.
+     */
+    @org.springframework.transaction.annotation.Transactional
+    public void createPointRedeemNotifications(User user, String content) {
+//        notificationRepository.deleteByTypeAndFromUser(NotificationType.POINT_REDEEM, user);
+        for (User admin : userRepository.findByRole(Role.ADMIN)) {
+            createNotification(admin, NotificationType.POINT_REDEEM, null, null,
+                    null, user, null, content);
+        }
+    }
+
     public List<NotificationPreferenceDto> listPreferences(String username) {
         User user = userRepository.findByUsername(username)
                 .orElseThrow(() -> new com.openisle.exception.NotFoundException("User not found"));

backend/src/main/java/com/openisle/service/PointMallService.java

@@ -0,0 +1,37 @@
+package com.openisle.service;
+
+import com.openisle.exception.FieldException;
+import com.openisle.exception.NotFoundException;
+import com.openisle.model.PointGood;
+import com.openisle.model.User;
+import com.openisle.repository.PointGoodRepository;
+import com.openisle.repository.UserRepository;
+import lombok.RequiredArgsConstructor;
+import org.springframework.stereotype.Service;
+
+import java.util.List;
+
+/** Service for point mall operations. */
+@Service
+@RequiredArgsConstructor
+public class PointMallService {
+    private final PointGoodRepository pointGoodRepository;
+    private final UserRepository userRepository;
+    private final NotificationService notificationService;
+
+    public List<PointGood> listGoods() {
+        return pointGoodRepository.findAll();
+    }
+
+    public int redeem(User user, Long goodId, String contact) {
+        PointGood good = pointGoodRepository.findById(goodId)
+                .orElseThrow(() -> new NotFoundException("Good not found"));
+        if (user.getPoint() < good.getCost()) {
+            throw new FieldException("point", "Insufficient points");
+        }
+        user.setPoint(user.getPoint() - good.getCost());
+        userRepository.save(user);
+        notificationService.createPointRedeemNotifications(user, good.getName() + ": " + contact);
+        return user.getPoint();
+    }
+}

backend/src/main/java/com/openisle/service/PointService.java

@@ -26,6 +26,11 @@ public class PointService {
         return addPoint(user, 30);
     }
 
+    public int awardForInvite(String userName) {
+        User user = userRepository.findByUsername(userName).orElseThrow();
+        return addPoint(user, 500);
+    }
+
     private PointLog getTodayLog(User user) {
         LocalDate today = LocalDate.now();
         return pointLogRepository.findByUserAndLogDate(user, today)

backend/src/main/java/com/openisle/service/TwitterAuthService.java

@@ -33,11 +33,12 @@ public class TwitterAuthService {
     @Value("${twitter.client-secret:}")
     private String clientSecret;
 
-    public Optional<User> authenticate(
+    public Optional<AuthResult> authenticate(
             String code,
             String codeVerifier,
             RegisterMode mode,
-            String redirectUri) {
+            String redirectUri,
+            boolean viaInvite) {
 
         logger.debug("Starting authentication with code {} and verifier {}", code, codeVerifier);
 
@@ -106,10 +107,10 @@ public class TwitterAuthService {
         // Twitter v2 默认拿不到 email；如果你申请到 email.scope，可改用 /2/users/:id?user.fields=email
         String email = username + "@twitter.com";
         logger.debug("Processing user {} with email {}", username, email);
-        return Optional.of(processUser(email, username, avatar, mode));
+        return Optional.of(processUser(email, username, avatar, mode, viaInvite));
     }
 
-    private User processUser(String email, String username, String avatar, com.openisle.model.RegisterMode mode) {
+    private AuthResult processUser(String email, String username, String avatar, com.openisle.model.RegisterMode mode, boolean viaInvite) {
         Optional<User> existing = userRepository.findByEmail(email);
         if (existing.isPresent()) {
             User user = existing.get();
@@ -119,7 +120,7 @@ public class TwitterAuthService {
                 userRepository.save(user);
             }
             logger.debug("Existing user {} authenticated", user.getUsername());
-            return user;
+            return new AuthResult(user, false);
         }
         String baseUsername = username != null ? username : email.split("@")[0];
         String finalUsername = baseUsername;
@@ -133,13 +134,13 @@ public class TwitterAuthService {
         user.setPassword("");
         user.setRole(Role.USER);
         user.setVerified(true);
-        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT);
+        user.setApproved(mode == com.openisle.model.RegisterMode.DIRECT || viaInvite);
         if (avatar != null) {
             user.setAvatar(avatar);
         } else {
             user.setAvatar("https://twitter.com/" + finalUsername + "/profile_image");
         }
         logger.debug("Creating new user {}", finalUsername);
-        return userRepository.save(user);
+        return new AuthResult(userRepository.save(user), true);
     }
 }

backend/src/main/java/com/openisle/service/UserService.java

@@ -74,6 +74,13 @@ public class UserService {
         return userRepository.save(user);
     }
 
+    public User registerWithInvite(String username, String email, String password) {
+        User user = register(username, email, password, "", com.openisle.model.RegisterMode.DIRECT);
+        user.setVerified(true);
+        user.setVerificationCode(null);
+        return userRepository.save(user);
+    }
+
     private String genCode() {
         return String.format("%06d", new Random().nextInt(1000000));
     }

backend/src/main/resources/application.properties

@@ -10,6 +10,7 @@ spring.jpa.hibernate.ddl-auto=update
 app.jwt.secret=${JWT_SECRET:jwt_sec}
 app.jwt.reason-secret=${JWT_REASON_SECRET:jwt_reason_sec}
 app.jwt.reset-secret=${JWT_RESET_SECRET:jwt_reset_sec}
+app.jwt.invite-secret=${JWT_INVITE_SECRET:jwt_invite_sec}
 # 30 days
 app.jwt.expiration=${JWT_EXPIRATION:2592000000}
 # Password strength: LOW, MEDIUM or HIGH

backend/src/test/java/com/openisle/service/NotificationServiceTest.java

@@ -144,6 +144,30 @@ class NotificationServiceTest {
         verify(nRepo).save(any(Notification.class));
     }
 
+    @Test
+    void createPointRedeemNotificationsDeletesOldOnes() {
+        NotificationRepository nRepo = mock(NotificationRepository.class);
+        UserRepository uRepo = mock(UserRepository.class);
+        ReactionRepository rRepo = mock(ReactionRepository.class);
+        EmailSender email = mock(EmailSender.class);
+        PushNotificationService push = mock(PushNotificationService.class);
+        Executor executor = Runnable::run;
+        NotificationService service = new NotificationService(nRepo, uRepo, email, push, rRepo, executor);
+        org.springframework.test.util.ReflectionTestUtils.setField(service, "websiteUrl", "https://ex.com");
+
+        User admin = new User();
+        admin.setId(10L);
+        User user = new User();
+        user.setId(20L);
+
+        when(uRepo.findByRole(Role.ADMIN)).thenReturn(List.of(admin));
+
+        service.createPointRedeemNotifications(user, "contact");
+
+        verify(nRepo).deleteByTypeAndFromUser(NotificationType.POINT_REDEEM, user);
+        verify(nRepo).save(any(Notification.class));
+    }
+
     @Test
     void createNotificationSendsEmailForCommentReply() {
         NotificationRepository nRepo = mock(NotificationRepository.class);

frontend_nuxt/app.vue

@@ -131,7 +131,7 @@ const goToNewPost = () => {
   cursor: pointer;
   z-index: 1000;
   display: flex;
-  backdrop-filter: blur(5px);
+  backdrop-filter: var(--blur-5);
   justify-content: center;
   align-items: center;
 }

frontend_nuxt/assets/global.css

@@ -7,11 +7,15 @@
   --header-background-color: white;
   --header-border-color: lightgray;
   --header-text-color: black;
+  --blur-1: blur(1px);
+  --blur-2: blur(2px);
+  --blur-4: blur(4px);
+  --blur-5: blur(5px);
+  --blur-10: blur(10px);
   /* 加一个app前缀防止与firefox的userChrome.css中的--menu-background-color冲突 */
   --app-menu-background-color: white;
   --background-color: white;
-  /* --background-color-blur: rgba(255, 255, 255, 0.57); */
-  --background-color-blur: var(--background-color);
+  --background-color-blur: rgba(255, 255, 255, 0.57);
   --menu-border-color: lightgray;
   --normal-border-color: lightgray;
   --menu-selected-background-color: rgba(208, 250, 255, 0.659);
@@ -59,6 +63,15 @@
   --activity-card-background-color: #585858;
 }
 
+:root[data-frosted='off'] {
+  --blur-1: none;
+  --blur-2: none;
+  --blur-4: none;
+  --blur-5: none;
+  --blur-10: none;
+  --background-color-blur: var(--background-color);
+}
+
 body {
   margin: 0;
   padding: 0;

frontend_nuxt/components/BasePopup.vue

@@ -41,8 +41,8 @@ export default {
   left: 0;
   right: 0;
   bottom: 0;
-  backdrop-filter: blur(2px);
-  -webkit-backdrop-filter: blur(2px);
+  backdrop-filter: var(--blur-2);
+  -webkit-backdrop-filter: var(--blur-2);
 }
 .popup-content {
   position: relative;

frontend_nuxt/components/HeaderComponent.vue

@@ -188,7 +188,7 @@ onMounted(async () => {
   justify-content: center;
   height: var(--header-height);
   background-color: var(--background-color-blur);
-  backdrop-filter: blur(10px);
+  backdrop-filter: var(--blur-10);
   color: var(--header-text-color);
   border-bottom: 1px solid var(--header-border-color);
 }
@@ -210,6 +210,7 @@ onMounted(async () => {
   width: 100%;
   height: 100%;
   max-width: var(--page-max-width);
+  backdrop-filter: var(--blur-10);
 }
 
 .header-content-left {
@@ -317,7 +318,6 @@ onMounted(async () => {
 .new-post-icon {
   font-size: 18px;
   cursor: pointer;
-  margin-right: 10px;
 }
 
 @media (max-width: 1200px) {

frontend_nuxt/components/InviteCodeActivityComponent.vue

@@ -0,0 +1,186 @@
+<template>
+  <div class="invite-code-activity">
+    <div class="invite-code-description">
+      <div class="invite-code-description-title">
+        <i class="fas fa-info-circle"></i>
+        <span class="invite-code-description-title-text">邀请规则说明</span>
+      </div>
+      <div class="invite-code-description-content">
+        <p>邀请好友注册并登录，每次可以获得500积分</p>
+        <p>邀请链接的有效期为1个月</p>
+        <p>每一个邀请链接的邀请人数上限为3人</p>
+        <p>通过邀请链接注册，无需注册审核</p>
+        <p>每人每天仅能生产3个邀请链接</p>
+      </div>
+    </div>
+
+    <div v-if="inviteLink" class="invite-code-link-content">
+      <p>
+        邀请链接：{{ inviteLink }}
+        <span @click="copyLink"><i class="fas fa-copy copy-icon"></i></span>
+      </p>
+    </div>
+
+    <div :class="['generate-button', { disabled: !user || loadingInvite }]" @click="generateInvite">
+      生成邀请链接
+    </div>
+  </div>
+</template>
+
+<script setup>
+import { toast } from '~/main'
+import { fetchCurrentUser, getToken } from '~/utils/auth'
+
+const config = useRuntimeConfig()
+const API_BASE_URL = config.public.apiBaseUrl
+const WEBSITE_BASE_URL = config.public.websiteBaseUrl
+
+const user = ref(null)
+const isLoadingUser = ref(true)
+const inviteCode = ref('')
+const loadingInvite = ref(false)
+
+const inviteLink = computed(() =>
+  inviteCode.value ? `${WEBSITE_BASE_URL}/signup?invite_token=${inviteCode.value}` : '',
+)
+
+onMounted(async () => {
+  isLoadingUser.value = true
+  user.value = await fetchCurrentUser()
+  isLoadingUser.value = false
+  if (user.value) {
+    await fetchInvite(false)
+  }
+})
+
+const fetchInvite = async (showToast = true) => {
+  loadingInvite.value = true
+  const token = getToken()
+  if (!token) {
+    toast.error('请先登录')
+    loadingInvite.value = false
+    return
+  }
+  try {
+    const res = await fetch(`${API_BASE_URL}/api/invite/generate`, {
+      method: 'POST',
+      headers: { Authorization: `Bearer ${token}` },
+    })
+    if (res.ok) {
+      const data = await res.json()
+      inviteCode.value = data.token
+      if (showToast) toast.success('邀请链接已生成')
+    } else {
+      const data = await res.json().catch(() => ({}))
+      toast.error(data.error || '生成邀请链接失败')
+    }
+  } catch (e) {
+    toast.error('生成邀请链接失败')
+  } finally {
+    loadingInvite.value = false
+  }
+}
+
+const generateInvite = () => fetchInvite(true)
+
+const copyLink = async () => {
+  if (!inviteLink.value) return
+  try {
+    await navigator.clipboard.writeText(inviteLink.value)
+    toast.success('已复制')
+  } catch (e) {
+    toast.error('复制失败')
+  }
+}
+</script>
+
+<style scoped>
+.invite-code-description-title-text {
+  font-size: 14px;
+  font-weight: bold;
+  margin-left: 5px;
+}
+
+.invite-code-description-content {
+  font-size: 12px;
+  opacity: 0.8;
+}
+
+.status-title {
+  font-weight: bold;
+}
+
+.status-text {
+  font-size: 12px;
+  opacity: 0.8;
+}
+
+.invite-code-activity {
+  margin-top: 20px;
+  padding: 20px;
+}
+
+.generate-button {
+  margin-top: 20px;
+  background-color: var(--primary-color);
+  color: #fff;
+  padding: 8px 16px;
+  border-radius: 10px;
+  width: fit-content;
+  cursor: pointer;
+}
+
+.generate-button:hover {
+  background-color: var(--primary-color-hover);
+}
+
+.generate-button.disabled {
+  background-color: var(--primary-color-disabled);
+  cursor: not-allowed;
+}
+
+.generate-button.disabled:hover {
+  background-color: var(--primary-color-disabled);
+}
+
+.invite-code-status-container {
+  display: flex;
+  flex-direction: row;
+  align-items: center;
+  gap: 30px;
+  margin-top: 20px;
+}
+
+.invite-code-status {
+  display: flex;
+  flex-direction: column;
+  gap: 4px;
+  margin-top: 10px;
+  font-size: 14px;
+}
+
+.user-level-text {
+  opacity: 0.8;
+  font-size: 12px;
+  color: var(--primary-color);
+}
+
+.invite-code-link-content {
+  margin-top: 20px;
+  font-size: 12px;
+  opacity: 0.8;
+}
+
+.copy-icon {
+  cursor: pointer;
+  margin-left: 5px;
+}
+
+@media screen and (max-width: 768px) {
+  .invite-code-status-container {
+    flex-direction: column;
+    align-items: flex-start;
+    gap: 10px;
+  }
+}
+</style>

frontend_nuxt/components/LoginOverlay.vue

@@ -35,7 +35,7 @@ const goLogin = () => {
   left: 0;
   right: 0;
   bottom: 0;
-  backdrop-filter: blur(4px);
+  backdrop-filter: var(--blur-4);
   z-index: 1;
 }
 

frontend_nuxt/components/MenuComponent.vue

@@ -56,6 +56,19 @@
             <i class="menu-item-icon fas fa-chart-line"></i>
             <span class="menu-item-text">站点统计</span>
           </NuxtLink>
+          <NuxtLink
+            v-if="authState.loggedIn"
+            class="menu-item"
+            exact-active-class="selected"
+            to="/points"
+            @click="handleItemClick"
+          >
+            <i class="menu-item-icon fas fa-coins"></i>
+            <span class="menu-item-text">
+              积分商城
+              <span v-if="myPoint !== null" class="point-count">{{ myPoint }}</span>
+            </span>
+          </NuxtLink>
         </div>
 
         <div class="menu-section">
@@ -130,7 +143,7 @@
 
 <script setup>
 import { computed, onMounted, ref, watch } from 'vue'
-import { authState } from '~/utils/auth'
+import { authState, fetchCurrentUser } from '~/utils/auth'
 import { fetchUnreadCount, notificationState } from '~/utils/notification'
 import { useIsMobile } from '~/utils/screen'
 import { cycleTheme, ThemeMode, themeState } from '~/utils/theme'
@@ -147,6 +160,7 @@ const emit = defineEmits(['item-click'])
 
 const categoryOpen = ref(true)
 const tagOpen = ref(true)
+const myPoint = ref(null)
 
 /** ✅ 用 useAsyncData 替换原生 fetch，避免 SSR+CSR 二次请求 */
 const {
@@ -191,6 +205,15 @@ const unreadCount = computed(() => notificationState.unreadCount)
 const showUnreadCount = computed(() => (unreadCount.value > 99 ? '99+' : unreadCount.value))
 const shouldShowStats = computed(() => authState.role === 'ADMIN')
 
+const loadPoint = async () => {
+  if (authState.loggedIn) {
+    const user = await fetchCurrentUser()
+    myPoint.value = user ? user.point : null
+  } else {
+    myPoint.value = null
+  }
+}
+
 const updateCount = async () => {
   if (authState.loggedIn) {
     await fetchUnreadCount()
@@ -200,9 +223,15 @@ const updateCount = async () => {
 }
 
 onMounted(async () => {
-  await updateCount()
-  // 登录态变化时再拉一次未读数；与 useAsyncData 无关
-  watch(() => authState.loggedIn, updateCount)
+  await Promise.all([updateCount(), loadPoint()])
+  // 登录态变化时再拉一次未读数和积分；与 useAsyncData 无关
+  watch(
+    () => authState.loggedIn,
+    () => {
+      updateCount()
+      loadPoint()
+    },
+  )
 })
 
 const handleItemClick = () => {
@@ -239,6 +268,7 @@ const gotoTag = (t) => {
   flex-direction: column;
   overflow-y: auto;
   scrollbar-width: none;
+  backdrop-filter: var(--blur-10);
 }
 
 .menu-content {
@@ -291,6 +321,12 @@ const gotoTag = (t) => {
   font-weight: bold;
 }
 
+.point-count {
+  margin-left: 4px;
+  font-size: 12px;
+  color: var(--primary-color);
+}
+
 .menu-item-icon {
   margin-right: 10px;
   opacity: 0.5;

frontend_nuxt/components/MilkTeaActivityComponent.vue

@@ -40,30 +40,22 @@
       兑换
     </div>
     <div v-else class="redeem-button disabled">兑换</div>
-    <BasePopup :visible="dialogVisible" @close="closeDialog">
-      <div class="redeem-dialog-content">
-        <BaseInput
-          textarea=""
-          rows="5"
-          v-model="contact"
-          placeholder="联系方式 (手机号/Email/微信/instagram/telegram等, 务必注明来源)"
-        />
-        <div class="redeem-actions">
-          <div class="redeem-submit-button" @click="submitRedeem" :disabled="loading">提交</div>
-          <div class="redeem-cancel-button" @click="closeDialog">取消</div>
-        </div>
-      </div>
-    </BasePopup>
+    <RedeemPopup
+      :visible="dialogVisible"
+      v-model="contact"
+      :loading="loading"
+      @close="closeDialog"
+      @submit="submitRedeem"
+    />
   </div>
 </template>
 
 <script setup>
 import { toast } from '~/main'
 import { fetchCurrentUser, getToken } from '~/utils/auth'
-import BaseInput from '~/components/BaseInput.vue'
-import BasePopup from '~/components/BasePopup.vue'
 import LevelProgress from '~/components/LevelProgress.vue'
 import ProgressBar from '~/components/ProgressBar.vue'
+import RedeemPopup from '~/components/RedeemPopup.vue'
 const config = useRuntimeConfig()
 const API_BASE_URL = config.public.apiBaseUrl
 
@@ -185,56 +177,6 @@ const submitRedeem = async () => {
   font-size: 14px;
 }
 
-.redeem-dialog-content {
-  position: relative;
-  z-index: 2;
-  background-color: var(--background-color);
-  display: flex;
-  flex-direction: column;
-  gap: 10px;
-  min-width: 400px;
-}
-
-.redeem-actions {
-  margin-top: 10px;
-  display: flex;
-  flex-direction: row;
-  justify-content: flex-end;
-  gap: 20px;
-  align-items: center;
-}
-
-.redeem-submit-button {
-  background-color: var(--primary-color);
-  color: #fff;
-  padding: 10px 20px;
-  border-radius: 10px;
-  cursor: pointer;
-}
-
-.redeem-submit-button:disabled {
-  background-color: var(--primary-color-disabled);
-  cursor: not-allowed;
-}
-
-.redeem-submit-button:hover {
-  background-color: var(--primary-color-hover);
-}
-
-.redeem-submit-button:disabled:hover {
-  background-color: var(--primary-color-disabled);
-}
-
-.redeem-cancel-button {
-  color: var(--primary-color);
-  border-radius: 10px;
-  cursor: pointer;
-}
-
-.redeem-cancel-button:hover {
-  text-decoration: underline;
-}
-
 .user-level-text {
   opacity: 0.8;
   font-size: 12px;
@@ -247,9 +189,5 @@ const submitRedeem = async () => {
     align-items: flex-start;
     gap: 10px;
   }
-
-  .redeem-dialog-content {
-    min-width: 300px;
-  }
 }
 </style>

frontend_nuxt/components/RedeemPopup.vue

@@ -0,0 +1,103 @@
+<template>
+  <BasePopup :visible="visible" @close="onClose">
+    <div class="redeem-dialog-content">
+      <BaseInput
+        textarea
+        rows="5"
+        v-model="innerContact"
+        placeholder="联系方式 (手机号/Email/微信/instagram/telegram等, 务必注明来源)"
+      />
+      <div class="redeem-actions">
+        <div class="redeem-submit-button" @click="submit" :disabled="loading">提交</div>
+        <div class="redeem-cancel-button" @click="onClose">取消</div>
+      </div>
+    </div>
+  </BasePopup>
+</template>
+
+<script setup>
+import { ref, watch } from 'vue'
+import BaseInput from '~/components/BaseInput.vue'
+import BasePopup from '~/components/BasePopup.vue'
+
+const props = defineProps({
+  visible: { type: Boolean, default: false },
+  loading: { type: Boolean, default: false },
+  modelValue: { type: String, default: '' },
+})
+const emit = defineEmits(['update:modelValue', 'submit', 'close'])
+
+const innerContact = ref(props.modelValue)
+watch(
+  () => props.modelValue,
+  (v) => {
+    innerContact.value = v
+  },
+)
+watch(innerContact, (v) => emit('update:modelValue', v))
+
+const submit = () => {
+  emit('submit')
+}
+const onClose = () => {
+  emit('close')
+}
+</script>
+
+<style scoped>
+.redeem-dialog-content {
+  position: relative;
+  z-index: 2;
+  background-color: var(--background-color);
+  display: flex;
+  flex-direction: column;
+  gap: 10px;
+  min-width: 400px;
+}
+
+.redeem-actions {
+  margin-top: 10px;
+  display: flex;
+  flex-direction: row;
+  justify-content: flex-end;
+  gap: 20px;
+  align-items: center;
+}
+
+.redeem-submit-button {
+  background-color: var(--primary-color);
+  color: #fff;
+  padding: 10px 20px;
+  border-radius: 10px;
+  cursor: pointer;
+}
+
+.redeem-submit-button:disabled {
+  background-color: var(--primary-color-disabled);
+  cursor: not-allowed;
+}
+
+.redeem-submit-button:hover {
+  background-color: var(--primary-color-hover);
+}
+
+.redeem-submit-button:disabled:hover {
+  background-color: var(--primary-color-disabled);
+}
+
+.redeem-cancel-button {
+  color: var(--primary-color);
+  border-radius: 10px;
+  cursor: pointer;
+}
+
+.redeem-cancel-button:hover {
+  text-decoration: underline;
+}
+
+@media screen and (max-width: 768px) {
+  .redeem-dialog-content {
+    min-width: 300px;
+  }
+}
+</style>

frontend_nuxt/components/ToolTip.vue

@@ -3,304 +3,379 @@
     <!-- 触发器 -->
     <div
       class="tooltip-trigger"
-      @mouseenter="handleMouseEnter"
-      @mouseleave="handleMouseLeave"
-      @click="handleClick"
-      @focus="handleFocus"
-      @blur="handleBlur"
       :tabindex="focusable ? 0 : -1"
+      :aria-describedby="visible ? ariaId : undefined"
+      @mouseenter="onTriggerMouseEnter"
+      @mouseleave="onTriggerMouseLeave"
+      @click="onTriggerClick"
+      @focus="onTriggerFocus"
+      @blur="onTriggerBlur"
     >
       <slot />
     </div>
 
-    <!-- 提示内容 -->
-    <Transition name="tooltip-fade">
-      <div
-        v-if="visible"
-        ref="tooltipRef"
-        class="tooltip-content"
-        :class="[
-          `tooltip-${placement}`,
-          { 'tooltip-dark': dark },
-          { 'tooltip-light': !dark }
-        ]"
-        :style="tooltipStyle"
-        role="tooltip"
-        :aria-describedby="ariaId"
-      >
-        <div class="tooltip-inner">
-          <slot name="content">
-            {{ content }}
-          </slot>
+    <!-- 提示内容（Teleport 到 body） -->
+    <Teleport to="body" v-if="mounted">
+      <Transition name="tooltip-fade">
+        <div
+          v-show="visible"
+          :id="ariaId"
+          ref="tooltipRef"
+          class="tooltip-content"
+          :class="[
+            `tooltip-${currentPlacement}`,
+            dark ? 'tooltip-dark' : 'tooltip-light',
+            props.trigger === 'hover' ? 'tooltip-noninteractive' : '',
+          ]"
+          :style="tooltipInlineStyle"
+          role="tooltip"
+        >
+          <div class="tooltip-inner">
+            <slot name="content">
+              {{ content }}
+            </slot>
+          </div>
+
+          <!-- 箭头 -->
+          <div
+            class="tooltip-arrow"
+            :class="`tooltip-arrow-${currentPlacement}`"
+            :style="arrowStyle"
+          ></div>
         </div>
-        <div class="tooltip-arrow" :class="`tooltip-arrow-${placement}`"></div>
-      </div>
-    </Transition>
+      </Transition>
+    </Teleport>
   </div>
 </template>
 
-<script>
-import { ref, computed, onMounted, onBeforeUnmount, nextTick, useId, watch } from 'vue'
+<script setup lang="ts">
+import {
+  ref,
+  computed,
+  onMounted,
+  onBeforeUnmount,
+  nextTick,
+  watch,
+  defineProps,
+  defineEmits,
+  defineOptions,
+  useId,
+} from 'vue'
 
-export default {
-  name: 'ToolTip',
-  props: {
-    // 提示内容
-    content: {
-      type: String,
-      default: ''
-    },
-    // 触发方式：hover、click、focus
-    trigger: {
-      type: String,
-      default: 'hover',
-      validator: (value) => ['hover', 'click', 'focus', 'manual'].includes(value)
-    },
-    // 位置：top、bottom、left、right
-    placement: {
-      type: String,
-      default: 'top',
-      validator: (value) => ['top', 'bottom', 'left', 'right'].includes(value)
-    },
-    // 是否启用暗色主题
-    dark: {
-      type: Boolean,
-      default: false
-    },
-    // 延迟显示时间（毫秒）
-    delay: {
-      type: Number,
-      default: 100
-    },
-    // 是否禁用
-    disabled: {
-      type: Boolean,
-      default: false
-    },
-    // 是否可通过Tab键聚焦
-    focusable: {
-      type: Boolean,
-      default: true
-    },
-    // 偏移距离
-    offset: {
-      type: Number,
-      default: 8
-    },
-    // 最大宽度
-    maxWidth: {
-      type: [String, Number],
-      default: '200px'
-    }
+defineOptions({ name: 'Tooltip' })
+
+type Trigger = 'hover' | 'click' | 'focus' | 'manual'
+type Placement = 'top' | 'bottom' | 'left' | 'right'
+
+const props = defineProps({
+  content: { type: String, default: '' },
+  trigger: {
+    type: String as () => Trigger,
+    default: 'hover',
+    validator: (v: string) => ['hover', 'click', 'focus', 'manual'].includes(v),
   },
-  emits: ['show', 'hide'],
-  setup(props, { emit }) {
-    const wrapperRef = ref(null)
-    const tooltipRef = ref(null)
-    const visible = ref(false)
-    const ariaId = ref(`tooltip-${useId()}`)
-    
-    let showTimer = null
-    let hideTimer = null
+  placement: {
+    type: String as () => Placement,
+    default: 'top',
+    validator: (v: string) => ['top', 'bottom', 'left', 'right'].includes(v),
+  },
+  dark: { type: Boolean, default: false },
+  delay: { type: Number, default: 100 },
+  disabled: { type: Boolean, default: false },
+  focusable: { type: Boolean, default: true },
+  offset: { type: Number, default: 8 },
+  maxWidth: { type: [String, Number], default: '200px' },
+  /** 隐藏延时（毫秒），hover 离开后等待一点点以防抖 */
+  hideDelay: { type: Number, default: 80 },
+})
 
-    // 计算tooltip样式
-    const tooltipStyle = computed(() => {
-      const maxWidth = typeof props.maxWidth === 'number' 
-        ? `${props.maxWidth}px` 
-        : props.maxWidth
-      
-      return {
-        maxWidth,
-        zIndex: 2000
-      }
-    })
+const emit = defineEmits<{
+  (e: 'show'): void
+  (e: 'hide'): void
+}>()
 
-    // 显示tooltip
-    const show = () => {
-      if (props.disabled) return
-      
-      clearTimeout(hideTimer)
-      showTimer = setTimeout(() => {
-        visible.value = true
-        emit('show')
-        nextTick(() => {
-          updatePosition()
-        })
-      }, props.delay)
-    }
+const wrapperRef = ref<HTMLElement | null>(null)
+const tooltipRef = ref<HTMLElement | null>(null)
+const visible = ref(false)
+const currentPlacement = ref<Placement>(props.placement)
+const ariaId = ref(`tooltip-${useId()}`)
+const mounted = ref(false)
 
-    // 隐藏tooltip
-    const hide = () => {
-      clearTimeout(showTimer)
-      hideTimer = setTimeout(() => {
-        visible.value = false
-        emit('hide')
-      }, 100)
-    }
+let showTimer: number | null = null
+let hideTimer: number | null = null
+let ro: ResizeObserver | null = null
+let rafId: number | null = null
 
-    // 立即显示（用于manual模式）
-    const showImmediately = () => {
-      if (props.disabled) return
-      clearTimeout(hideTimer)
-      clearTimeout(showTimer)
-      visible.value = true
-      emit('show')
-      nextTick(() => {
-        updatePosition()
-      })
-    }
+const maxWidthValue = computed(() => {
+  return typeof props.maxWidth === 'number' ? `${props.maxWidth}px` : props.maxWidth
+})
 
-    // 立即隐藏（用于manual模式）
-    const hideImmediately = () => {
-      clearTimeout(showTimer)
-      clearTimeout(hideTimer)
-      visible.value = false
-      emit('hide')
-    }
+const tooltipTransform = ref('translate3d(-9999px, -9999px, 0)')
 
-    // 更新位置
-    const updatePosition = () => {
-      if (!wrapperRef.value || !tooltipRef.value) return
+const tooltipInlineStyle = computed(() => ({
+  position: 'fixed',
+  top: '0px',
+  left: '0px',
+  zIndex: 2000,
+  maxWidth: maxWidthValue.value,
+  transform: tooltipTransform.value,
+}))
 
-      const trigger = wrapperRef.value.querySelector('.tooltip-trigger')
-      const tooltip = tooltipRef.value
-      
-      if (!trigger) return
+const arrowStyle = ref<Record<string, string>>({})
 
-      const triggerRect = trigger.getBoundingClientRect()
-      const tooltipRect = tooltip.getBoundingClientRect()
-      
-      let top = 0
-      let left = 0
-
-      switch (props.placement) {
-        case 'top':
-          top = triggerRect.top - tooltipRect.height - props.offset
-          left = triggerRect.left + (triggerRect.width - tooltipRect.width) / 2
-          break
-        case 'bottom':
-          top = triggerRect.bottom + props.offset
-          left = triggerRect.left + (triggerRect.width - tooltipRect.width) / 2
-          break
-        case 'left':
-          top = triggerRect.top + (triggerRect.height - tooltipRect.height) / 2
-          left = triggerRect.left - tooltipRect.width - props.offset
-          break
-        case 'right':
-          top = triggerRect.top + (triggerRect.height - tooltipRect.height) / 2
-          left = triggerRect.right + props.offset
-          break
-      }
-
-      // 边界检测
-      const padding = 8
-      const viewportWidth = window.innerWidth
-      const viewportHeight = window.innerHeight
-
-      if (left < padding) {
-        left = padding
-      } else if (left + tooltipRect.width > viewportWidth - padding) {
-        left = viewportWidth - tooltipRect.width - padding
-      }
-
-      if (top < padding) {
-        top = padding
-      } else if (top + tooltipRect.height > viewportHeight - padding) {
-        top = viewportHeight - tooltipRect.height - padding
-      }
-
-      tooltip.style.position = 'fixed'
-      tooltip.style.top = `${top}px`
-      tooltip.style.left = `${left}px`
-    }
-
-    // 事件处理
-    const handleMouseEnter = () => {
-      if (props.trigger === 'hover') {
-        show()
-      }
-    }
-
-    const handleMouseLeave = () => {
-      if (props.trigger === 'hover') {
-        hide()
-      }
-    }
-
-    const handleClick = () => {
-      if (props.trigger === 'click') {
-        if (visible.value) {
-          hide()
-        } else {
-          show()
-        }
-      }
-    }
-
-    const handleFocus = () => {
-      if (props.trigger === 'focus') {
-        show()
-      }
-    }
-
-    const handleBlur = () => {
-      if (props.trigger === 'focus') {
-        hide()
-      }
-    }
-
-    // 点击外部隐藏
-    const handleClickOutside = (event) => {
-      if (props.trigger === 'click' && wrapperRef.value && !wrapperRef.value.contains(event.target)) {
-        hide()
-      }
-    }
-
-    // 窗口大小改变时重新计算位置
-    const handleResize = () => {
-      if (visible.value) {
-        updatePosition()
-      }
-    }
-
-    // 监听禁用状态变化
-    watch(() => props.disabled, (newVal) => {
-      if (newVal && visible.value) {
-        hideImmediately()
-      }
-    })
-
-    onMounted(() => {
-      document.addEventListener('click', handleClickOutside)
-      window.addEventListener('resize', handleResize)
-      window.addEventListener('scroll', handleResize)
-    })
-
-    onBeforeUnmount(() => {
-      clearTimeout(showTimer)
-      clearTimeout(hideTimer)
-      document.removeEventListener('click', handleClickOutside)
-      window.removeEventListener('resize', handleResize)
-      window.removeEventListener('scroll', handleResize)
-    })
-
-    return {
-      wrapperRef,
-      tooltipRef,
-      visible,
-      ariaId,
-      tooltipStyle,
-      handleMouseEnter,
-      handleMouseLeave,
-      handleClick,
-      handleFocus,
-      handleBlur,
-      // 暴露给父组件的方法
-      show: showImmediately,
-      hide: hideImmediately
-    }
+const clearTimers = () => {
+  if (showTimer) {
+    window.clearTimeout(showTimer)
+    showTimer = null
+  }
+  if (hideTimer) {
+    window.clearTimeout(hideTimer)
+    hideTimer = null
   }
 }
+
+const show = async () => {
+  if (props.disabled) return
+  clearTimers()
+  showTimer = window.setTimeout(async () => {
+    visible.value = true
+    emit('show')
+    await nextTick()
+    updatePosition()
+  }, props.delay)
+}
+
+const hide = () => {
+  clearTimers()
+  hideTimer = window.setTimeout(() => {
+    visible.value = false
+    emit('hide')
+  }, props.hideDelay)
+}
+
+const showImmediately = async () => {
+  if (props.disabled) return
+  clearTimers()
+  visible.value = true
+  emit('show')
+  await nextTick()
+  updatePosition()
+}
+const hideImmediately = () => {
+  clearTimers()
+  visible.value = false
+  emit('hide')
+}
+
+// 触发器事件
+const onTriggerMouseEnter = () => {
+  if (props.trigger === 'hover') show()
+}
+const onTriggerMouseLeave = () => {
+  // 关键修改：hover 模式下，离开触发区即开始隐藏计时，不再保持可交互
+  if (props.trigger === 'hover') hide()
+}
+const onTriggerClick = () => {
+  if (props.trigger !== 'click') return
+  visible.value ? hideImmediately() : showImmediately()
+}
+const onTriggerFocus = () => {
+  if (props.trigger === 'focus') showImmediately()
+}
+const onTriggerBlur = () => {
+  if (props.trigger === 'focus') hideImmediately()
+}
+
+// 点击外部关闭（只对 click 模式）
+const onClickOutside = (e: MouseEvent) => {
+  if (props.trigger !== 'click') return
+  const w = wrapperRef.value
+  const t = tooltipRef.value
+  const target = e.target as Node
+  if (w && !w.contains(target) && t && !t.contains(target)) {
+    hideImmediately()
+  }
+}
+
+// 定位算法
+function clamp(n: number, min: number, max: number) {
+  return Math.max(min, Math.min(max, n))
+}
+
+function computeBasePosition(
+  placement: Placement,
+  triggerRect: DOMRect,
+  tooltipRect: DOMRect,
+  offset: number,
+) {
+  const centerX = triggerRect.left + triggerRect.width / 2
+  const centerY = triggerRect.top + triggerRect.height / 2
+
+  switch (placement) {
+    case 'top':
+      return {
+        top: triggerRect.top - tooltipRect.height - offset,
+        left: centerX - tooltipRect.width / 2,
+      }
+    case 'bottom':
+      return {
+        top: triggerRect.bottom + offset,
+        left: centerX - tooltipRect.width / 2,
+      }
+    case 'left':
+      return {
+        top: centerY - tooltipRect.height / 2,
+        left: triggerRect.left - tooltipRect.width - offset,
+      }
+    case 'right':
+      return {
+        top: centerY - tooltipRect.height / 2,
+        left: triggerRect.right + offset,
+      }
+  }
+}
+
+function positionWithSmartFlip(
+  preferred: Placement,
+  triggerRect: DOMRect,
+  tooltipRect: DOMRect,
+  offset: number,
+) {
+  const padding = 8
+  const vw = window.innerWidth
+  const vh = window.innerHeight
+
+  let placement: Placement = preferred
+  let { top, left } = computeBasePosition(placement, triggerRect, tooltipRect, offset)!
+
+  const outTop = top < padding
+  const outBottom = top + tooltipRect.height > vh - padding
+  const outLeft = left < padding
+  const outRight = left + tooltipRect.width > vw - padding
+
+  if (
+    placement === 'top' &&
+    outTop &&
+    triggerRect.bottom + offset + tooltipRect.height <= vh - padding
+  ) {
+    placement = 'bottom'
+    ;({ top, left } = computeBasePosition(placement, triggerRect, tooltipRect, offset)!)
+  } else if (
+    placement === 'bottom' &&
+    outBottom &&
+    triggerRect.top - offset - tooltipRect.height >= padding
+  ) {
+    placement = 'top'
+    ;({ top, left } = computeBasePosition(placement, triggerRect, tooltipRect, offset)!)
+  } else if (
+    placement === 'left' &&
+    outLeft &&
+    triggerRect.right + offset + tooltipRect.width <= vw - padding
+  ) {
+    placement = 'right'
+    ;({ top, left } = computeBasePosition(placement, triggerRect, tooltipRect, offset)!)
+  } else if (
+    placement === 'right' &&
+    outRight &&
+    triggerRect.left - offset - tooltipRect.width >= padding
+  ) {
+    placement = 'left'
+    ;({ top, left } = computeBasePosition(placement, triggerRect, tooltipRect, offset)!)
+  }
+
+  top = clamp(top, padding, vh - tooltipRect.height - padding)
+  left = clamp(left, padding, vw - tooltipRect.width - padding)
+
+  const triggerCenterX = triggerRect.left + triggerRect.width / 2
+  const triggerCenterY = triggerRect.top + triggerRect.height / 2
+  const arrowLeft = clamp(triggerCenterX - left, 10, tooltipRect.width - 10)
+  const arrowTop = clamp(triggerCenterY - top, 10, tooltipRect.height - 10)
+
+  return { placement, top, left, arrowLeft, arrowTop }
+}
+
+const updatePosition = () => {
+  if (!wrapperRef.value || !tooltipRef.value || !visible.value) return
+  if (rafId) cancelAnimationFrame(rafId)
+  rafId = requestAnimationFrame(() => {
+    const triggerEl = wrapperRef.value!.querySelector('.tooltip-trigger') as HTMLElement | null
+    const tooltipEl = tooltipRef.value!
+    if (!triggerEl) return
+
+    const triggerRect = triggerEl.getBoundingClientRect()
+    const tooltipRect = tooltipEl.getBoundingClientRect()
+    const { placement, top, left, arrowLeft, arrowTop } = positionWithSmartFlip(
+      props.placement,
+      triggerRect,
+      tooltipRect,
+      props.offset,
+    )
+
+    currentPlacement.value = placement
+    tooltipTransform.value = `translate3d(${Math.round(left)}px, ${Math.round(top)}px, 0)`
+    if (placement === 'top' || placement === 'bottom') {
+      arrowStyle.value = { '--arrow-left': `${Math.round(arrowLeft)}px` } as any
+    } else {
+      arrowStyle.value = { '--arrow-top': `${Math.round(arrowTop)}px` } as any
+    }
+  })
+}
+
+const onEnvChanged = () => {
+  if (visible.value) updatePosition()
+}
+
+watch(
+  () => props.disabled,
+  (v) => {
+    if (v && visible.value) hideImmediately()
+  },
+)
+watch(
+  () => props.placement,
+  () => {
+    if (visible.value) nextTick(updatePosition)
+  },
+)
+watch(visible, (v) => {
+  if (!mounted.value) return
+  if (v) {
+    if ('ResizeObserver' in window && !ro) {
+      ro = new ResizeObserver(() => updatePosition())
+      if (tooltipRef.value) ro.observe(tooltipRef.value)
+      const triggerEl = wrapperRef.value?.querySelector('.tooltip-trigger') as HTMLElement | null
+      if (triggerEl) ro.observe(triggerEl)
+    }
+    updatePosition()
+  } else {
+    if (ro) {
+      ro.disconnect()
+      ro = null
+    }
+  }
+})
+
+onMounted(() => {
+  mounted.value = true
+  window.addEventListener('resize', onEnvChanged, { passive: true })
+  window.addEventListener('scroll', onEnvChanged, { passive: true, capture: true })
+  document.addEventListener('click', onClickOutside, true)
+})
+
+onBeforeUnmount(() => {
+  clearTimers()
+  if (rafId) cancelAnimationFrame(rafId)
+  if (ro) {
+    ro.disconnect()
+    ro = null
+  }
+  document.removeEventListener('click', onClickOutside, true)
+  window.removeEventListener('resize', onEnvChanged)
+  window.removeEventListener('scroll', onEnvChanged, true)
+})
+
+// 暴露给父组件（manual 可用）
+defineExpose({ show: showImmediately, hide: hideImmediately, updatePosition })
 </script>
 
 <style scoped>
@@ -308,16 +383,23 @@ export default {
   position: relative;
   display: inline-block;
 }
-
 .tooltip-trigger {
   display: inline-block;
   outline: none;
 }
+.tooltip-trigger:focus-visible {
+  outline: 2px solid var(--primary-color);
+  outline-offset: 2px;
+  border-radius: 4px;
+}
 
 .tooltip-content {
-  position: fixed;
+  will-change: transform;
+  pointer-events: auto; /* 默认允许交互（click/focus 模式） */
+}
+.tooltip-noninteractive {
+  /* hover 模式下禁用指针事件，避免移入浮层导致保持显示 */
   pointer-events: none;
-  z-index: 2000;
 }
 
 .tooltip-inner {
@@ -326,23 +408,22 @@ export default {
   font-size: 14px;
   line-height: 1.4;
   word-wrap: break-word;
+  border: 1px solid transparent;
   box-shadow: 0 2px 8px rgba(0, 0, 0, 0.15);
 }
 
-/* 亮色主题 */
+/* 主题 */
 .tooltip-light .tooltip-inner {
   background-color: var(--background-color);
   color: var(--text-color);
-  border: 1px solid var(--normal-border-color);
+  border-color: var(--normal-border-color);
 }
-
-/* 暗色主题 */
 .tooltip-dark .tooltip-inner {
   background-color: rgba(0, 0, 0, 0.9);
-  color: white;
+  color: #fff;
 }
 
-/* 箭头基础样式 */
+/* 箭头（用 CSS 变量控制偏移） */
 .tooltip-arrow {
   position: absolute;
   width: 0;
@@ -350,18 +431,16 @@ export default {
   border-style: solid;
 }
 
-/* 顶部箭头 */
+/* 顶部 */
 .tooltip-top .tooltip-arrow-top {
   bottom: -6px;
-  left: 50%;
+  left: var(--arrow-left, 50%);
   transform: translateX(-50%);
   border-width: 6px 6px 0 6px;
 }
-
 .tooltip-light.tooltip-top .tooltip-arrow-top {
   border-color: var(--normal-border-color) transparent transparent transparent;
 }
-
 .tooltip-light.tooltip-top .tooltip-arrow-top::after {
   content: '';
   position: absolute;
@@ -371,23 +450,20 @@ export default {
   border-style: solid;
   border-color: var(--background-color) transparent transparent transparent;
 }
-
 .tooltip-dark.tooltip-top .tooltip-arrow-top {
   border-color: rgba(0, 0, 0, 0.9) transparent transparent transparent;
 }
 
-/* 底部箭头 */
+/* 底部 */
 .tooltip-bottom .tooltip-arrow-bottom {
   top: -6px;
-  left: 50%;
+  left: var(--arrow-left, 50%);
   transform: translateX(-50%);
   border-width: 0 6px 6px 6px;
 }
-
 .tooltip-light.tooltip-bottom .tooltip-arrow-bottom {
   border-color: transparent transparent var(--normal-border-color) transparent;
 }
-
 .tooltip-light.tooltip-bottom .tooltip-arrow-bottom::after {
   content: '';
   position: absolute;
@@ -397,23 +473,20 @@ export default {
   border-style: solid;
   border-color: transparent transparent var(--background-color) transparent;
 }
-
 .tooltip-dark.tooltip-bottom .tooltip-arrow-bottom {
   border-color: transparent transparent rgba(0, 0, 0, 0.9) transparent;
 }
 
-/* 左侧箭头 */
+/* 左侧 */
 .tooltip-left .tooltip-arrow-left {
   right: -6px;
-  top: 50%;
+  top: var(--arrow-top, 50%);
   transform: translateY(-50%);
   border-width: 6px 0 6px 6px;
 }
-
 .tooltip-light.tooltip-left .tooltip-arrow-left {
   border-color: transparent transparent transparent var(--normal-border-color);
 }
-
 .tooltip-light.tooltip-left .tooltip-arrow-left::after {
   content: '';
   position: absolute;
@@ -423,23 +496,20 @@ export default {
   border-style: solid;
   border-color: transparent transparent transparent var(--background-color);
 }
-
 .tooltip-dark.tooltip-left .tooltip-arrow-left {
   border-color: transparent transparent transparent rgba(0, 0, 0, 0.9);
 }
 
-/* 右侧箭头 */
+/* 右侧 */
 .tooltip-right .tooltip-arrow-right {
   left: -6px;
-  top: 50%;
+  top: var(--arrow-top, 50%);
   transform: translateY(-50%);
   border-width: 6px 6px 6px 0;
 }
-
 .tooltip-light.tooltip-right .tooltip-arrow-right {
   border-color: transparent var(--normal-border-color) transparent transparent;
 }
-
 .tooltip-light.tooltip-right .tooltip-arrow-right::after {
   content: '';
   position: absolute;
@@ -449,7 +519,6 @@ export default {
   border-style: solid;
   border-color: transparent var(--background-color) transparent transparent;
 }
-
 .tooltip-dark.tooltip-right .tooltip-arrow-right {
   border-color: transparent rgba(0, 0, 0, 0.9) transparent transparent;
 }
@@ -457,20 +526,17 @@ export default {
 /* 过渡动画 */
 .tooltip-fade-enter-active,
 .tooltip-fade-leave-active {
-  transition: all 0.2s ease;
+  transition:
+    opacity 0.18s ease,
+    transform 0.18s ease;
 }
-
-.tooltip-fade-enter-from {
-  opacity: 0;
-  transform: scale(0.8);
-}
-
+.tooltip-fade-enter-from,
 .tooltip-fade-leave-to {
   opacity: 0;
-  transform: scale(0.8);
+  transform: translate3d(0, 4px, 0) scale(0.98);
 }
 
-/* 响应式调整 */
+/* 响应式微调 */
 @media (max-width: 768px) {
   .tooltip-inner {
     padding: 6px 10px;
@@ -478,11 +544,4 @@ export default {
     max-width: 250px;
   }
 }
-
-/* 键盘导航样式 */
-.tooltip-trigger:focus-visible {
-  outline: 2px solid var(--primary-color);
-  outline-offset: 2px;
-  border-radius: 4px;
-}
 </style>

frontend_nuxt/pages/activities.vue

@@ -25,6 +25,7 @@
         </div>
       </div>
       <MilkTeaActivityComponent v-if="a.type === 'MILK_TEA'" />
+      <InviteCodeActivityComponent v-if="a.type === 'INVITE_POINTS'" />
     </div>
   </div>
 </template>
@@ -32,6 +33,7 @@
 <script setup>
 import TimeManager from '~/utils/time'
 import MilkTeaActivityComponent from '~/components/MilkTeaActivityComponent.vue'
+import InviteCodeActivityComponent from '~/components/InviteCodeActivityComponent.vue'
 const config = useRuntimeConfig()
 const API_BASE_URL = config.public.apiBaseUrl
 
@@ -75,6 +77,7 @@ onMounted(async () => {
   background-color: var(--activity-card-background-color);
   border-radius: 20px;
   box-shadow: 0 0 10px 0 rgba(0, 0, 0, 0.1);
+  margin-bottom: 10px;
 }
 
 .activity-card-left-avatar-img {
@@ -141,6 +144,10 @@ onMounted(async () => {
   color: inherit;
 }
 
+.activity-card-normal-right {
+  width: calc(100% - 150px);
+}
+
 @media screen and (max-width: 768px) {
   .activity-card-left-avatar-img {
     width: 80px;

frontend_nuxt/pages/discord-callback.vue

@@ -1,3 +1,4 @@
+<!-- pages/discord-callback.vue -->
 <template>
   <CallbackPage />
 </template>
@@ -8,9 +9,30 @@ import { discordExchange } from '~/utils/discord'
 
 onMounted(async () => {
   const url = new URL(window.location.href)
-  const code = url.searchParams.get('code')
-  const state = url.searchParams.get('state')
-  const result = await discordExchange(code, state, '')
+  const code = url.searchParams.get('code') || ''
+  const stateStr = url.searchParams.get('state') || ''
+
+  // 从 state 解析 invite_token；兜底支持 query ?invite_token=
+  let inviteToken = ''
+  if (stateStr) {
+    try {
+      const s = new URLSearchParams(stateStr)
+      inviteToken = s.get('invite_token') || s.get('invitetoken') || ''
+    } catch {}
+  }
+  // if (!inviteToken) {
+  //   inviteToken =
+  //     url.searchParams.get('invite_token') ||
+  //     url.searchParams.get('invitetoken') ||
+  //     ''
+  // }
+
+  if (!code) {
+    navigateTo('/login', { replace: true })
+    return
+  }
+
+  const result = await discordExchange(code, inviteToken, '')
 
   if (result.needReason) {
     navigateTo(`/signup-reason?token=${result.token}`, { replace: true })

frontend_nuxt/pages/github-callback.vue

@@ -1,3 +1,4 @@
+<!-- pages/github-callback.vue -->
 <template>
   <CallbackPage />
 </template>
@@ -8,9 +9,31 @@ import { githubExchange } from '~/utils/github'
 
 onMounted(async () => {
   const url = new URL(window.location.href)
-  const code = url.searchParams.get('code')
-  const state = url.searchParams.get('state')
-  const result = await githubExchange(code, state, '')
+  const code = url.searchParams.get('code') || ''
+  const state = url.searchParams.get('state') || ''
+
+  // 从 state 中解析 invite_token（githubAuthorize 已把它放进 state）
+  let inviteToken = ''
+  if (state) {
+    try {
+      const s = new URLSearchParams(state)
+      inviteToken = s.get('invite_token') || s.get('invitetoken') || ''
+    } catch {}
+  }
+  // 兜底：也支持直接跟在回调URL的查询参数上
+  // if (!inviteToken) {
+  //   inviteToken =
+  //     url.searchParams.get('invite_token') ||
+  //     url.searchParams.get('invitetoken') ||
+  //     ''
+  // }
+
+  if (!code) {
+    navigateTo('/login', { replace: true })
+    return
+  }
+
+  const result = await githubExchange(code, inviteToken, '')
 
   if (result.needReason) {
     navigateTo(`/signup-reason?token=${result.token}`, { replace: true })

frontend_nuxt/pages/google-callback.vue

@@ -9,6 +9,21 @@ import { googleAuthWithToken } from '~/utils/google'
 onMounted(async () => {
   const hash = new URLSearchParams(window.location.hash.substring(1))
   const idToken = hash.get('id_token')
+
+  // 优先从 state 中解析
+  let inviteToken = ''
+  const stateStr = hash.get('state') || ''
+  if (stateStr) {
+    const state = new URLSearchParams(stateStr)
+    inviteToken = state.get('invite_token') || ''
+  }
+
+  // 兜底：如果之前把 invite_token 放在回调 URL 的查询参数中
+  // if (!inviteToken) {
+  //   const query = new URLSearchParams(window.location.search)
+  //   inviteToken = query.get('invite_token') || ''
+  // }
+
   if (idToken) {
     await googleAuthWithToken(
       idToken,
@@ -18,6 +33,7 @@ onMounted(async () => {
       (token) => {
         navigateTo(`/signup-reason?token=${token}`, { replace: true })
       },
+      { inviteToken },
     )
   } else {
     navigateTo('/login', { replace: true })

frontend_nuxt/pages/index.vue

@@ -147,16 +147,17 @@ const categoryOptions = ref([])
 const isLoadingMore = ref(false)
 
 const topics = ref(['最新回复', '最新', '排行榜' /*, '热门', '类别'*/])
+const selectedTopicCookie = useCookie('homeTab')
 const selectedTopic = ref(
-  route.query.view === 'ranking' ? '排行榜' : route.query.view === 'latest' ? '最新' : '最新回复',
+  selectedTopicCookie.value
+    ? selectedTopicCookie.value
+    : route.query.view === 'ranking'
+      ? '排行榜'
+      : route.query.view === 'latest'
+        ? '最新'
+        : '最新回复',
 )
-
-if (import.meta.client) {
-  const storedTopic = localStorage.getItem('home-selected-topic')
-  if (storedTopic && topics.value.includes(storedTopic)) {
-    selectedTopic.value = storedTopic
-  }
-}
+if (!selectedTopicCookie.value) selectedTopicCookie.value = selectedTopic.value
 const articles = ref([])
 const page = ref(0)
 const pageSize = 10
@@ -182,6 +183,11 @@ onMounted(() => {
   const { category, tags } = route.query
   if (category) selectedCategorySet(category)
   if (tags) selectedTagsSet(tags)
+
+  const saved = localStorage.getItem('homeTab')
+  if (saved) {
+    selectedTopic.value = saved
+  }
 })
 
 /** 路由变更时同步筛选 **/
@@ -347,12 +353,13 @@ watch(
 watch([selectedCategory, selectedTags], () => {
   loadOptions()
 })
-watch(selectedTopic, (topic) => {
-  if (import.meta.client) {
-    localStorage.setItem('home-selected-topic', topic)
-  }
+watch(selectedTopic, (val) => {
   // 仅当需要额外选项时加载
   loadOptions()
+  selectedTopicCookie.value = val
+  if (process.client) {
+    localStorage.setItem('homeTab', val)
+  }
 })
 
 /** 选项首屏加载：服务端执行一次；客户端兜底 **/
@@ -427,6 +434,7 @@ const sanitizeDescription = (text) => stripMarkdown(text)
   gap: 10px;
   width: 100%;
   padding: 10px 0;
+  backdrop-filter: var(--blur-10);
 }
 
 .topic-item-container {

frontend_nuxt/pages/login.vue

@@ -27,6 +27,10 @@
             >找回密码</a
           >
         </div>
+        <div class="hint-message">
+          <i class="fas fa-info-circle"></i>
+          使用右侧第三方OAuth注册/登录的用户可使用对应的邮箱进行重设密码
+        </div>
       </div>
     </div>
 
@@ -259,6 +263,11 @@ const loginWithTwitter = () => {
   color: var(--primary-color);
 }
 
+.hint-message {
+  font-size: 12px;
+  opacity: 0.7;
+}
+
 @media (max-width: 768px) {
   .login-page {
     flex-direction: column;

frontend_nuxt/pages/message.vue

@@ -130,6 +130,12 @@
                     申请进行奶茶兑换，联系方式是：{{ item.content }}
                   </NotificationContainer>
                 </template>
+                <template v-else-if="item.type === 'POINT_REDEEM' && !item.parentComment">
+                  <NotificationContainer :item="item" :markRead="markRead">
+                    <span class="notif-user">{{ item.fromUser.username }} </span>
+                    申请积分兑换，联系方式是：{{ item.content }}
+                  </NotificationContainer>
+                </template>
                 <template v-else-if="item.type === 'REACTION' && item.post && !item.comment">
                   <NotificationContainer :item="item" :markRead="markRead">
                     <span class="notif-user">{{ item.fromUser.username }} </span> 对我的文章
@@ -610,6 +616,8 @@ const formatType = (t) => {
       return '有人申请注册'
     case 'ACTIVITY_REDEEM':
       return '有人申请兑换奶茶'
+    case 'POINT_REDEEM':
+      return '有人申请积分兑换'
     case 'LOTTERY_WIN':
       return '抽奖中奖了'
     case 'LOTTERY_DRAW':
@@ -649,6 +657,7 @@ onActivated(() => {
   flex-direction: row;
   justify-content: space-between;
   align-items: center;
+  backdrop-filter: var(--blur-10);
 }
 
 .message-page-header-right {

frontend_nuxt/pages/points.vue

@@ -0,0 +1,229 @@
+<template>
+  <div class="point-mall-page">
+    <section class="rules">
+      <div class="section-title">🎉 积分规则</div>
+      <div class="section-content">
+        <div class="section-item" v-for="(rule, idx) in pointRules" :key="idx">{{ rule }}</div>
+      </div>
+    </section>
+
+    <div class="loading-points-container" v-if="isLoading">
+      <l-hatch size="28" stroke="4" speed="3.5" color="var(--primary-color)"></l-hatch>
+    </div>
+
+    <div class="point-info">
+      <p v-if="authState.loggedIn && point !== null">
+        <span><i class="fas fa-coins coin-icon"></i></span>我的积分：<span class="point-value">{{
+          point
+        }}</span>
+      </p>
+    </div>
+
+    <section class="goods">
+      <div class="goods-item" v-for="(good, idx) in goods" :key="idx">
+        <img class="goods-item-image" :src="good.image" alt="good.name" />
+        <div class="goods-item-name">{{ good.name }}</div>
+        <div class="goods-item-cost">
+          <i class="fas fa-coins"></i>
+          {{ good.cost }} 积分
+        </div>
+        <div
+          class="goods-item-button"
+          :class="{ disabled: !authState.loggedIn || point === null || point < good.cost }"
+          @click="openRedeem(good)"
+        >
+          兑换
+        </div>
+      </div>
+    </section>
+    <RedeemPopup
+      :visible="dialogVisible"
+      v-model="contact"
+      :loading="loading"
+      @close="closeRedeem"
+      @submit="submitRedeem"
+    />
+  </div>
+</template>
+
+<script setup>
+import { onMounted, ref } from 'vue'
+import { authState, fetchCurrentUser, getToken } from '~/utils/auth'
+import { toast } from '~/main'
+import RedeemPopup from '~/components/RedeemPopup.vue'
+
+const config = useRuntimeConfig()
+const API_BASE_URL = config.public.apiBaseUrl
+
+const point = ref(null)
+const isLoading = ref(false)
+
+const pointRules = [
+  '发帖：每天前两次，每次 30 积分',
+  '评论：每天前四条评论可获 10 积分，你的帖子被评论也可获 10 积分',
+  '帖子被点赞：每次 10 积分',
+  '评论被点赞：每次 10 积分',
+]
+
+const goods = ref([])
+const dialogVisible = ref(false)
+const contact = ref('')
+const loading = ref(false)
+const selectedGood = ref(null)
+
+onMounted(async () => {
+  isLoading.value = true
+  if (authState.loggedIn) {
+    const user = await fetchCurrentUser()
+    point.value = user ? user.point : null
+  }
+  await loadGoods()
+  isLoading.value = false
+})
+
+const loadGoods = async () => {
+  const res = await fetch(`${API_BASE_URL}/api/point-goods`)
+  if (res.ok) {
+    goods.value = await res.json()
+  }
+}
+
+const openRedeem = (good) => {
+  if (!authState.loggedIn || point.value === null || point.value < good.cost) {
+    toast.error('积分不足')
+    return
+  }
+  selectedGood.value = good
+  dialogVisible.value = true
+}
+
+const closeRedeem = () => {
+  dialogVisible.value = false
+}
+
+const submitRedeem = async () => {
+  if (!selectedGood.value || !contact.value) return
+  loading.value = true
+  const token = getToken()
+  const res = await fetch(`${API_BASE_URL}/api/point-goods/redeem`, {
+    method: 'POST',
+    headers: {
+      'Content-Type': 'application/json',
+      Authorization: `Bearer ${token}`,
+    },
+    body: JSON.stringify({ goodId: selectedGood.value.id, contact: contact.value }),
+  })
+  if (res.ok) {
+    const data = await res.json()
+    point.value = data.point
+    toast.success('兑换成功！')
+    dialogVisible.value = false
+    contact.value = ''
+  } else {
+    toast.error('兑换失败')
+  }
+  loading.value = false
+}
+</script>
+
+<style scoped>
+.point-mall-page {
+  padding-left: 20px;
+  max-width: var(--page-max-width);
+  background-color: var(--background-color);
+  margin: 0 auto;
+}
+
+.loading-points-container {
+  margin-top: 100px;
+  display: flex;
+  justify-content: center;
+  align-items: center;
+}
+
+.point-info {
+  font-size: 18px;
+}
+
+.point-value {
+  font-weight: bold;
+  color: var(--primary-color);
+}
+
+.coin-icon {
+  margin-right: 5px;
+}
+
+.rules,
+.goods {
+  margin-top: 20px;
+}
+
+.goods {
+  display: flex;
+  gap: 10px;
+}
+
+.goods-item {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 10px;
+  border: 1px solid var(--normal-border-color);
+  border-radius: 10px;
+  overflow: hidden;
+}
+
+.goods-item-name {
+  font-size: 20px;
+  font-weight: bold;
+}
+
+.goods-item-image {
+  width: 200px;
+  height: 200px;
+  border-bottom: 1px solid var(--normal-border-color);
+}
+
+.goods-item-cost {
+  display: flex;
+  align-items: center;
+  gap: 5px;
+  font-size: 14px;
+  opacity: 0.7;
+}
+
+.goods-item-button {
+  background-color: var(--primary-color);
+  color: white;
+  padding: 7px 10px;
+  border-radius: 10px;
+  width: calc(100% - 40px);
+  text-align: center;
+  cursor: pointer;
+  margin-bottom: 10px;
+}
+
+.goods-item-button:hover {
+  background-color: var(--primary-color-hover);
+}
+
+.goods-item-button.disabled,
+.goods-item-button.disabled:hover {
+  background-color: var(--primary-color-disabled);
+  cursor: not-allowed;
+}
+
+.section-title {
+  font-size: 18px;
+  font-weight: bold;
+  margin-bottom: 10px;
+}
+
+.section-content {
+  display: flex;
+  flex-direction: column;
+  font-size: 14px;
+  opacity: 0.7;
+}
+</style>

frontend_nuxt/pages/settings.vue

@@ -36,6 +36,13 @@
           <BaseInput v-model="introduction" textarea rows="3" placeholder="说些什么..." />
           <div class="setting-description">自我介绍会出现在你的个人主页，可以简要介绍自己</div>
         </div>
+        <div class="form-row switch-row">
+          <div class="setting-title">毛玻璃效果</div>
+          <label class="switch">
+            <input type="checkbox" v-model="frosted" />
+            <span class="slider"></span>
+          </label>
+        </div>
       </div>
       <div v-if="role === 'ADMIN'" class="admin-section">
         <h3>管理员设置</h3>
@@ -65,12 +72,13 @@
 </template>
 
 <script setup>
-import { ref, onMounted } from 'vue'
+import { ref, onMounted, watch } from 'vue'
 import AvatarCropper from '~/components/AvatarCropper.vue'
 import BaseInput from '~/components/BaseInput.vue'
 import Dropdown from '~/components/Dropdown.vue'
 import { toast } from '~/main'
 import { fetchCurrentUser, getToken, setToken } from '~/utils/auth'
+import { frostedState, setFrosted } from '~/utils/frosted'
 const config = useRuntimeConfig()
 const API_BASE_URL = config.public.apiBaseUrl
 const username = ref('')
@@ -87,6 +95,7 @@ const aiFormatLimit = ref(3)
 const registerMode = ref('DIRECT')
 const isLoadingPage = ref(false)
 const isSaving = ref(false)
+const frosted = ref(true)
 
 onMounted(async () => {
   isLoadingPage.value = true
@@ -105,6 +114,7 @@ onMounted(async () => {
     navigateTo('/login', { replace: true })
   }
   isLoadingPage.value = false
+  frosted.value = frostedState.enabled
 })
 
 const onAvatarChange = (e) => {
@@ -118,6 +128,7 @@ const onAvatarChange = (e) => {
     reader.readAsDataURL(file)
   }
 }
+watch(frosted, (val) => setFrosted(val))
 const onCropped = ({ file, url }) => {
   avatarFile.value = file
   avatar.value = url
@@ -300,6 +311,58 @@ const save = async () => {
   max-width: 200px;
 }
 
+.switch-row {
+  flex-direction: row;
+  align-items: center;
+  justify-content: space-between;
+  max-width: 200px;
+}
+
+.switch {
+  position: relative;
+  display: inline-block;
+  width: 40px;
+  height: 20px;
+}
+
+.switch input {
+  opacity: 0;
+  width: 0;
+  height: 0;
+}
+
+.slider {
+  position: absolute;
+  cursor: pointer;
+  top: 0;
+  left: 0;
+  right: 0;
+  bottom: 0;
+  background-color: #ccc;
+  transition: 0.2s;
+  border-radius: 20px;
+}
+
+.slider:before {
+  position: absolute;
+  content: '';
+  height: 16px;
+  width: 16px;
+  left: 2px;
+  bottom: 2px;
+  background-color: white;
+  transition: 0.2s;
+  border-radius: 50%;
+}
+
+input:checked + .slider {
+  background-color: var(--primary-color);
+}
+
+input:checked + .slider:before {
+  transform: translateX(20px);
+}
+
 .profile-section {
   margin-bottom: 30px;
 }

frontend_nuxt/pages/signup-reason.vue

@@ -28,6 +28,7 @@ const reason = ref('')
 const error = ref('')
 const isWaitingForRegister = ref(false)
 const token = ref('')
+const route = useRoute()
 
 onMounted(async () => {
   token.value = route.query.token || ''
@@ -50,8 +51,8 @@ const submit = async () => {
         'Content-Type': 'application/json',
       },
       body: JSON.stringify({
-        token: this.token,
-        reason: this.reason,
+        token: token.value,
+        reason: reason.value,
       }),
     })
     isWaitingForRegister.value = false

frontend_nuxt/pages/signup.vue

@@ -69,7 +69,7 @@
     </div>
 
     <div class="other-signup-page-content">
-      <div class="signup-page-button" @click="googleAuthorize">
+      <div class="signup-page-button" @click="signupWithGoogle">
         <img class="signup-page-button-icon" src="~/assets/icons/google.svg" alt="Google Logo" />
         <div class="signup-page-button-text">Google 注册</div>
       </div>
@@ -96,6 +96,8 @@ import { discordAuthorize } from '~/utils/discord'
 import { githubAuthorize } from '~/utils/github'
 import { googleAuthorize } from '~/utils/google'
 import { twitterAuthorize } from '~/utils/twitter'
+
+const route = useRoute()
 const config = useRuntimeConfig()
 const API_BASE_URL = config.public.apiBaseUrl
 const emailStep = ref(0)
@@ -109,9 +111,11 @@ const passwordError = ref('')
 const code = ref('')
 const isWaitingForEmailSent = ref(false)
 const isWaitingForEmailVerified = ref(false)
+const inviteToken = ref('')
 
 onMounted(async () => {
   username.value = route.query.u || ''
+  inviteToken.value = route.query.invite_token || ''
   try {
     const res = await fetch(`${API_BASE_URL}/api/config`)
     if (res.ok) {
@@ -203,14 +207,17 @@ const verifyCode = async () => {
     isWaitingForEmailVerified.value = false
   }
 }
+const signupWithGoogle = () => {
+  googleAuthorize(inviteToken.value)
+}
 const signupWithGithub = () => {
-  githubAuthorize()
+  githubAuthorize(inviteToken.value)
 }
 const signupWithDiscord = () => {
-  discordAuthorize()
+  discordAuthorize(inviteToken.value)
 }
 const signupWithTwitter = () => {
-  twitterAuthorize()
+  twitterAuthorize(inviteToken.value)
 }
 </script>
 

frontend_nuxt/pages/users/[id].vue

@@ -35,10 +35,12 @@
           />
           <div class="profile-level-target">
             目标 Lv.{{ levelInfo.currentLevel + 1 }}
-            <i
-              class="fas fa-info-circle profile-exp-info"
-              title="经验值可通过发帖、评论等操作获得，达到目标后即可提升等级，解锁更多功能。"
-            ></i>
+            <ToolTip
+              content="经验值可通过发帖、评论等操作获得，达到目标后即可提升等级，解锁更多功能。"
+              placement="bottom"
+            >
+              <i class="fas fa-info-circle profile-exp-info"></i>
+            </ToolTip>
           </div>
         </div>
       </div>
@@ -204,67 +206,89 @@
         </div>
 
         <div v-else-if="selectedTab === 'timeline'" class="profile-timeline">
+          <div class="timeline-tabs">
+            <div
+              :class="['timeline-tab-item', { selected: timelineFilter === 'all' }]"
+              @click="timelineFilter = 'all'"
+            >
+              全部
+            </div>
+            <div
+              :class="['timeline-tab-item', { selected: timelineFilter === 'articles' }]"
+              @click="timelineFilter = 'articles'"
+            >
+              文章
+            </div>
+            <div
+              :class="['timeline-tab-item', { selected: timelineFilter === 'comments' }]"
+              @click="timelineFilter = 'comments'"
+            >
+              评论和回复
+            </div>
+          </div>
           <BasePlaceholder
-            v-if="timelineItems.length === 0"
+            v-if="filteredTimelineItems.length === 0"
             text="暂无时间线"
             icon="fas fa-inbox"
           />
-          <BaseTimeline :items="timelineItems">
-            <template #item="{ item }">
-              <template v-if="item.type === 'post'">
-                发布了文章
-                <router-link :to="`/posts/${item.post.id}`" class="timeline-link">
-                  {{ item.post.title }}
-                </router-link>
-                <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
+          <div class="timeline-list">
+            <BaseTimeline :items="filteredTimelineItems">
+              <template #item="{ item }">
+                <template v-if="item.type === 'post'">
+                  发布了文章
+                  <router-link :to="`/posts/${item.post.id}`" class="timeline-link">
+                    {{ item.post.title }}
+                  </router-link>
+                  <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
+                </template>
+                <template v-else-if="item.type === 'comment'">
+                  在
+                  <router-link :to="`/posts/${item.comment.post.id}`" class="timeline-link">
+                    {{ item.comment.post.title }}
+                  </router-link>
+                  下评论了
+                  <router-link
+                    :to="`/posts/${item.comment.post.id}#comment-${item.comment.id}`"
+                    class="timeline-link"
+                  >
+                    {{ stripMarkdownLength(item.comment.content, 200) }}
+                  </router-link>
+                  <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
+                </template>
+                <template v-else-if="item.type === 'reply'">
+                  在
+                  <router-link :to="`/posts/${item.comment.post.id}`" class="timeline-link">
+                    {{ item.comment.post.title }}
+                  </router-link>
+                  下对
+                  <router-link
+                    :to="`/posts/${item.comment.post.id}#comment-${item.comment.parentComment.id}`"
+                    class="timeline-link"
+                  >
+                    {{ stripMarkdownLength(item.comment.parentComment.content, 200) }}
+                  </router-link>
+                  回复了
+                  <router-link
+                    :to="`/posts/${item.comment.post.id}#comment-${item.comment.id}`"
+                    class="timeline-link"
+                  >
+                    {{ stripMarkdownLength(item.comment.content, 200) }}
+                  </router-link>
+                  <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
+                </template>
+                <template v-else-if="item.type === 'tag'">
+                  创建了标签
+                  <span class="timeline-link" @click="gotoTag(item.tag)">
+                    {{ item.tag.name }}<span v-if="item.tag.count"> x{{ item.tag.count }}</span>
+                  </span>
+                  <div class="timeline-snippet" v-if="item.tag.description">
+                    {{ item.tag.description }}
+                  </div>
+                  <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
+                </template>
               </template>
-              <template v-else-if="item.type === 'comment'">
-                在
-                <router-link :to="`/posts/${item.comment.post.id}`" class="timeline-link">
-                  {{ item.comment.post.title }}
-                </router-link>
-                下评论了
-                <router-link
-                  :to="`/posts/${item.comment.post.id}#comment-${item.comment.id}`"
-                  class="timeline-link"
-                >
-                  {{ stripMarkdownLength(item.comment.content, 200) }}
-                </router-link>
-                <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
-              </template>
-              <template v-else-if="item.type === 'reply'">
-                在
-                <router-link :to="`/posts/${item.comment.post.id}`" class="timeline-link">
-                  {{ item.comment.post.title }}
-                </router-link>
-                下对
-                <router-link
-                  :to="`/posts/${item.comment.post.id}#comment-${item.comment.parentComment.id}`"
-                  class="timeline-link"
-                >
-                  {{ stripMarkdownLength(item.comment.parentComment.content, 200) }}
-                </router-link>
-                回复了
-                <router-link
-                  :to="`/posts/${item.comment.post.id}#comment-${item.comment.id}`"
-                  class="timeline-link"
-                >
-                  {{ stripMarkdownLength(item.comment.content, 200) }}
-                </router-link>
-                <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
-              </template>
-              <template v-else-if="item.type === 'tag'">
-                创建了标签
-                <span class="timeline-link" @click="gotoTag(item.tag)">
-                  {{ item.tag.name }}<span v-if="item.tag.count"> x{{ item.tag.count }}</span>
-                </span>
-                <div class="timeline-snippet" v-if="item.tag.description">
-                  {{ item.tag.description }}
-                </div>
-                <div class="timeline-date">{{ formatDate(item.createdAt) }}</div>
-              </template>
-            </template>
-          </BaseTimeline>
+            </BaseTimeline>
+          </div>
         </div>
 
         <div v-else-if="selectedTab === 'following'" class="follow-container">
@@ -324,6 +348,15 @@ const hotPosts = ref([])
 const hotReplies = ref([])
 const hotTags = ref([])
 const timelineItems = ref([])
+const timelineFilter = ref('all')
+const filteredTimelineItems = computed(() => {
+  if (timelineFilter.value === 'articles') {
+    return timelineItems.value.filter((item) => item.type === 'post')
+  } else if (timelineFilter.value === 'comments') {
+    return timelineItems.value.filter((item) => item.type === 'comment' || item.type === 'reply')
+  }
+  return timelineItems.value
+})
 const followers = ref([])
 const followings = ref([])
 const medals = ref([])
@@ -654,12 +687,6 @@ watch(selectedTab, async (val) => {
   opacity: 0.8;
 }
 
-.profile-exp-info {
-  margin-left: 4px;
-  opacity: 0.5;
-  cursor: pointer;
-}
-
 .profile-info {
   display: flex;
   flex-direction: row;
@@ -700,6 +727,7 @@ watch(selectedTab, async (val) => {
   border-bottom: 1px solid var(--normal-border-color);
   scrollbar-width: none;
   overflow-x: auto;
+  backdrop-filter: var(--blur-10);
 }
 
 .profile-tabs-item {
@@ -777,8 +805,24 @@ watch(selectedTab, async (val) => {
   width: 40%;
 }
 
-.profile-timeline {
-  padding: 20px;
+.timeline-tabs {
+  display: flex;
+  flex-direction: row;
+  border-bottom: 1px solid var(--normal-border-color);
+}
+
+.timeline-list {
+  padding: 10px 20px;
+}
+
+.timeline-tab-item {
+  padding: 10px 20px;
+  cursor: pointer;
+}
+
+.timeline-tab-item.selected {
+  color: var(--primary-color);
+  border-bottom: 2px solid var(--primary-color);
 }
 
 .timeline-date {

frontend_nuxt/plugins/frosted.client.ts

@@ -0,0 +1,6 @@
+import { defineNuxtPlugin } from 'nuxt/app'
+import { initFrosted } from '~/utils/frosted'
+
+export default defineNuxtPlugin(() => {
+  initFrosted()
+})

frontend_nuxt/utils/discord.js

@@ -2,7 +2,7 @@ import { toast } from '../main'
 import { setToken, loadCurrentUser } from './auth'
 import { registerPush } from './push'
 
-export function discordAuthorize(state = '') {
+export function discordAuthorize(inviteToken = '') {
   const config = useRuntimeConfig()
   const WEBSITE_BASE_URL = config.public.websiteBaseUrl
   const DISCORD_CLIENT_ID = config.public.discordClientId
@@ -10,62 +10,60 @@ export function discordAuthorize(state = '') {
     toast.error('Discord 登录不可用')
     return
   }
+
   const redirectUri = `${WEBSITE_BASE_URL}/discord-callback`
-  const url = `https://discord.com/api/oauth2/authorize?client_id=${DISCORD_CLIENT_ID}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=code&scope=identify%20email&state=${state}`
+  // 用 state 明文携带 invite_token（仅用于回传，不再透传给后端）
+  const state = new URLSearchParams({ invite_token: inviteToken }).toString()
+
+  const url =
+    `https://discord.com/api/oauth2/authorize` +
+    `?client_id=${encodeURIComponent(DISCORD_CLIENT_ID)}` +
+    `&redirect_uri=${encodeURIComponent(redirectUri)}` +
+    `&response_type=code` +
+    `&scope=${encodeURIComponent('identify email')}` +
+    `&state=${encodeURIComponent(state)}`
+
   window.location.href = url
 }
 
-export async function discordExchange(code, state, reason) {
+export async function discordExchange(code, inviteToken = '', reason = '') {
   try {
     const config = useRuntimeConfig()
     const API_BASE_URL = config.public.apiBaseUrl
+
+    const payload = {
+      code,
+      redirectUri: `${window.location.origin}/discord-callback`,
+      reason,
+    }
+    if (inviteToken) payload.inviteToken = inviteToken // 明文传给后端
+
     const res = await fetch(`${API_BASE_URL}/api/auth/discord`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        code,
-        redirectUri: `${window.location.origin}/discord-callback`,
-        reason,
-        state,
-      }),
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify(payload),
     })
     const data = await res.json()
+
     if (res.ok && data.token) {
       setToken(data.token)
       await loadCurrentUser()
       toast.success('登录成功')
-      registerPush()
-      return {
-        success: true,
-        needReason: false,
-      }
+      registerPush?.()
+      return { success: true, needReason: false }
     } else if (data.reason_code === 'NOT_APPROVED') {
       toast.info('当前为注册审核模式，请填写注册理由')
-      return {
-        success: false,
-        needReason: true,
-        token: data.token,
-      }
+      return { success: false, needReason: true, token: data.token }
     } else if (data.reason_code === 'IS_APPROVING') {
       toast.info('您的注册理由正在审批中')
-      return {
-        success: true,
-        needReason: false,
-      }
+      return { success: true, needReason: false }
     } else {
       toast.error(data.error || '登录失败')
-      return {
-        success: false,
-        needReason: false,
-        error: data.error || '登录失败',
-      }
+      return { success: false, needReason: false, error: data.error || '登录失败' }
     }
   } catch (e) {
+    console.error(e)
     toast.error('登录失败')
-    return {
-      success: false,
-      needReason: false,
-      error: '登录失败',
-    }
+    return { success: false, needReason: false, error: '登录失败' }
   }
 }

frontend_nuxt/utils/frosted.js

@@ -0,0 +1,26 @@
+import { reactive } from 'vue'
+
+const FROSTED_KEY = 'frosted-glass'
+
+export const frostedState = reactive({
+  enabled: true,
+})
+
+function apply() {
+  if (!import.meta.client) return
+  document.documentElement.dataset.frosted = frostedState.enabled ? 'on' : 'off'
+}
+
+export function initFrosted() {
+  if (!import.meta.client) return
+  const saved = localStorage.getItem(FROSTED_KEY)
+  frostedState.enabled = saved !== 'false'
+  apply()
+}
+
+export function setFrosted(enabled) {
+  if (!import.meta.client) return
+  frostedState.enabled = enabled
+  localStorage.setItem(FROSTED_KEY, enabled ? 'true' : 'false')
+  apply()
+}

frontend_nuxt/utils/github.js

@@ -2,7 +2,7 @@ import { toast } from '../main'
 import { setToken, loadCurrentUser } from './auth'
 import { registerPush } from './push'
 
-export function githubAuthorize(state = '') {
+export function githubAuthorize(inviteToken = '') {
   const config = useRuntimeConfig()
   const WEBSITE_BASE_URL = config.public.websiteBaseUrl
   const GITHUB_CLIENT_ID = config.public.githubClientId
@@ -10,62 +10,58 @@ export function githubAuthorize(state = '') {
     toast.error('GitHub 登录不可用')
     return
   }
+
   const redirectUri = `${WEBSITE_BASE_URL}/github-callback`
-  const url = `https://github.com/login/oauth/authorize?client_id=${GITHUB_CLIENT_ID}&redirect_uri=${encodeURIComponent(redirectUri)}&scope=user:email&state=${state}`
+  const state = new URLSearchParams({ invite_token: inviteToken }).toString()
+
+  const url =
+    `https://github.com/login/oauth/authorize` +
+    `?client_id=${encodeURIComponent(GITHUB_CLIENT_ID)}` +
+    `&redirect_uri=${encodeURIComponent(redirectUri)}` +
+    `&scope=${encodeURIComponent('user:email')}` +
+    `&state=${encodeURIComponent(state)}`
+
   window.location.href = url
 }
 
-export async function githubExchange(code, state, reason) {
+export async function githubExchange(code, inviteToken = '', reason = '') {
   try {
     const config = useRuntimeConfig()
     const API_BASE_URL = config.public.apiBaseUrl
+
+    const payload = {
+      code,
+      redirectUri: `${window.location.origin}/github-callback`,
+      reason,
+    }
+    if (inviteToken) payload.inviteToken = inviteToken
+
     const res = await fetch(`${API_BASE_URL}/api/auth/github`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({
-        code,
-        redirectUri: `${window.location.origin}/github-callback`,
-        reason,
-        state,
-      }),
+      body: JSON.stringify(payload),
     })
     const data = await res.json()
+
     if (res.ok && data.token) {
       setToken(data.token)
       await loadCurrentUser()
       toast.success('登录成功')
-      registerPush()
-      return {
-        success: true,
-        needReason: false,
-      }
+      registerPush?.()
+      return { success: true, needReason: false }
     } else if (data.reason_code === 'NOT_APPROVED') {
       toast.info('当前为注册审核模式，请填写注册理由')
-      return {
-        success: false,
-        needReason: true,
-        token: data.token,
-      }
+      return { success: false, needReason: true, token: data.token }
     } else if (data.reason_code === 'IS_APPROVING') {
       toast.info('您的注册理由正在审批中')
-      return {
-        success: true,
-        needReason: false,
-      }
+      return { success: true, needReason: false }
     } else {
       toast.error(data.error || '登录失败')
-      return {
-        success: false,
-        needReason: false,
-        error: data.error || '登录失败',
-      }
+      return { success: false, needReason: false, error: data.error || '登录失败' }
     }
   } catch (e) {
+    console.error(e)
     toast.error('登录失败')
-    return {
-      success: false,
-      needReason: false,
-      error: '登录失败',
-    }
+    return { success: false, needReason: false, error: '登录失败' }
   }
 }

frontend_nuxt/utils/google.js

@@ -21,44 +21,85 @@ export async function googleGetIdToken() {
   })
 }
 
-export function googleAuthorize() {
+export function googleAuthorize(inviteToken = '') {
   const config = useRuntimeConfig()
   const GOOGLE_CLIENT_ID = config.public.googleClientId
   const WEBSITE_BASE_URL = config.public.websiteBaseUrl
+
   if (!GOOGLE_CLIENT_ID) {
     toast.error('Google 登录不可用, 请检查网络设置与VPN')
     return
   }
+
   const redirectUri = `${WEBSITE_BASE_URL}/google-callback`
-  const nonce = Math.random().toString(36).substring(2)
-  const url = `https://accounts.google.com/o/oauth2/v2/auth?client_id=${GOOGLE_CLIENT_ID}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=id_token&scope=openid%20email%20profile&nonce=${nonce}`
+  const nonce = Math.random().toString(36).slice(2)
+
+  // 明文放在 state（推荐；Google 会原样回传）
+  const state = new URLSearchParams({ invite_token: inviteToken }).toString()
+
+  const url =
+    `https://accounts.google.com/o/oauth2/v2/auth` +
+    `?client_id=${encodeURIComponent(GOOGLE_CLIENT_ID)}` +
+    `&redirect_uri=${encodeURIComponent(redirectUri)}` +
+    `&response_type=id_token` +
+    `&scope=${encodeURIComponent('openid email profile')}` +
+    `&nonce=${encodeURIComponent(nonce)}` +
+    `&state=${encodeURIComponent(state)}`
+
   window.location.href = url
 }
 
-export async function googleAuthWithToken(idToken, redirect_success, redirect_not_approved) {
+export async function googleAuthWithToken(
+  idToken,
+  redirect_success,
+  redirect_not_approved,
+  options = {}, // { inviteToken?: string }
+) {
   try {
+    if (!idToken) {
+      toast.error('缺少 id_token')
+      return
+    }
+
     const config = useRuntimeConfig()
     const API_BASE_URL = config.public.apiBaseUrl
+
+    const payload = { idToken }
+    if (options && options.inviteToken) {
+      payload.inviteToken = options.inviteToken
+    }
+
     const res = await fetch(`${API_BASE_URL}/api/auth/google`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ idToken }),
+      headers: { 'Content-Type': 'application/json', Accept: 'application/json' },
+      body: JSON.stringify(payload),
     })
-    const data = await res.json()
-    if (res.ok && data.token) {
+
+    const data = await res.json().catch(() => ({}))
+
+    if (res.ok && data && data.token) {
       setToken(data.token)
       await loadCurrentUser()
       toast.success('登录成功')
-      registerPush()
-      if (redirect_success) redirect_success()
-    } else if (data.reason_code === 'NOT_APPROVED') {
-      toast.info('当前为注册审核模式，请填写注册理由')
-      if (redirect_not_approved) redirect_not_approved(data.token)
-    } else if (data.reason_code === 'IS_APPROVING') {
-      toast.info('您的注册理由正在审批中')
-      if (redirect_success) redirect_success()
+      registerPush?.()
+      if (typeof redirect_success === 'function') redirect_success()
+      return
     }
+
+    if (data && data.reason_code === 'NOT_APPROVED') {
+      toast.info('当前为注册审核模式，请填写注册理由')
+      if (typeof redirect_not_approved === 'function') redirect_not_approved(data.token)
+      return
+    }
+
+    if (data && data.reason_code === 'IS_APPROVING') {
+      toast.info('您的注册理由正在审批中')
+      if (typeof redirect_success === 'function') redirect_success()
+      return
+    }
+    toast.error(data?.message || '登录失败')
   } catch (e) {
+    console.error(e)
     toast.error('登录失败')
   }
 }

frontend_nuxt/utils/notification.js

@@ -22,6 +22,7 @@ const iconMap = {
   POST_UNSUBSCRIBED: 'fas fa-bookmark',
   REGISTER_REQUEST: 'fas fa-user-clock',
   ACTIVITY_REDEEM: 'fas fa-coffee',
+  POINT_REDEEM: 'fas fa-gift',
   LOTTERY_WIN: 'fas fa-trophy',
   LOTTERY_DRAW: 'fas fa-bullhorn',
   MENTION: 'fas fa-at',

frontend_nuxt/utils/theme.js

@@ -143,7 +143,7 @@ function fallbackThemeTransition(applyFn) {
     background-color: ${currentBg};
     z-index: 9999;
     pointer-events: none;
-    backdrop-filter: blur(1px);
+    backdrop-filter: var(--blur-1);
   `
   document.body.appendChild(transitionElement)
 

frontend_nuxt/utils/twitter.js

@@ -20,7 +20,8 @@ async function generateCodeChallenge(codeVerifier) {
     .replace(/=+$/, '')
 }
 
-export async function twitterAuthorize(state = '') {
+// 邀请码明文放入 state；同时生成 csrf 放入 state 并在回调校验
+export async function twitterAuthorize(inviteToken = '') {
   const config = useRuntimeConfig()
   const WEBSITE_BASE_URL = config.public.websiteBaseUrl
   const TWITTER_CLIENT_ID = config.public.twitterClientId
@@ -28,17 +29,30 @@ export async function twitterAuthorize(state = '') {
     toast.error('Twitter 登录不可用')
     return
   }
-  if (state === '') {
-    state = Math.random().toString(36).substring(2, 15)
-  }
+
   const redirectUri = `${WEBSITE_BASE_URL}/twitter-callback`
+
+  // PKCE
   const codeVerifier = generateCodeVerifier()
   sessionStorage.setItem('twitter_code_verifier', codeVerifier)
   const codeChallenge = await generateCodeChallenge(codeVerifier)
+
+  // CSRF + 邀请码一起放入 state
+  const csrf = Math.random().toString(36).slice(2)
+  sessionStorage.setItem('twitter_csrf_state', csrf)
+  const state = new URLSearchParams({
+    csrf,
+    invite_token: inviteToken || '',
+  }).toString()
+
   const url =
-    `https://x.com/i/oauth2/authorize?response_type=code&client_id=${TWITTER_CLIENT_ID}` +
-    `&redirect_uri=${encodeURIComponent(redirectUri)}&scope=tweet.read%20users.read` +
-    `&state=${state}&code_challenge=${codeChallenge}&code_challenge_method=S256`
+    `https://x.com/i/oauth2/authorize?response_type=code&client_id=${encodeURIComponent(TWITTER_CLIENT_ID)}` +
+    `&redirect_uri=${encodeURIComponent(redirectUri)}` +
+    `&scope=${encodeURIComponent('tweet.read users.read')}` +
+    `&state=${encodeURIComponent(state)}` +
+    `&code_challenge=${encodeURIComponent(codeChallenge)}` +
+    `&code_challenge_method=S256`
+
   window.location.href = url
 }
 
@@ -46,8 +60,29 @@ export async function twitterExchange(code, state, reason) {
   try {
     const config = useRuntimeConfig()
     const API_BASE_URL = config.public.apiBaseUrl
+
+    // 取出并清理 PKCE/CSRF
     const codeVerifier = sessionStorage.getItem('twitter_code_verifier')
     sessionStorage.removeItem('twitter_code_verifier')
+
+    const savedCsrf = sessionStorage.getItem('twitter_csrf_state')
+    sessionStorage.removeItem('twitter_csrf_state')
+
+    // 从 state 解析 csrf 与 invite_token
+    let parsedCsrf = ''
+    let inviteToken = ''
+    try {
+      const sp = new URLSearchParams(state || '')
+      parsedCsrf = sp.get('csrf') || ''
+      inviteToken = sp.get('invite_token') || sp.get('invitetoken') || ''
+    } catch {}
+
+    // 简单 CSRF 校验（存在才校验，避免误杀老会话）
+    if (savedCsrf && parsedCsrf && savedCsrf !== parsedCsrf) {
+      toast.error('登录状态校验失败，请重试')
+      return { success: false, needReason: false, error: 'state mismatch' }
+    }
+
     const res = await fetch(`${API_BASE_URL}/api/auth/twitter`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
@@ -57,8 +92,10 @@ export async function twitterExchange(code, state, reason) {
         reason,
         state,
         codeVerifier,
+        inviteToken,
       }),
     })
+
     const data = await res.json()
     if (res.ok && data.token) {
       setToken(data.token)
@@ -77,6 +114,7 @@ export async function twitterExchange(code, state, reason) {
       return { success: false, needReason: false, error: data.error || '登录失败' }
     }
   } catch (e) {
+    console.error(e)
     toast.error('登录失败')
     return { success: false, needReason: false, error: '登录失败' }
   }