feat: opsx-loki 全面升级 — 前端重构/用户与LDAP/部署向导/日志查询

基于 WEB-UI-Development-Guide 标准的整体升级,并更名 LokiDeploy → opsx-loki。

前端(Gin+React+shadcn/ui):
- 按 02/07 章重构:页面域化拆分(无超 400 行文件)、PageContainer/ListQuery、
  反馈分级(成功静默/失败 toast/危险确认)、401 单飞刷新+队列重放
- 暗色模式(next-themes)+ 语义 Token(--primary 品牌色/success/warning/info)
- 部署向导(状态推导四步:环境→存储→Loki→采集,内嵌表单闭环)
- 日志查询页:LogQL 标签构建器/拖拽直方图/日志上下文/Live Tail/查询历史
- 按用户+标签策略的查询授权(服务端强制合并策略)

后端(Go+Gin+JSON DB):
- 简单用户管理(仅 admin,无 RBAC)+ TokenVersion 会话吊销 + 登录 IP 限流
- LDAP 接入:配置(AES 加密存储/hasPassword 脱敏)/测试连接/批量导入/登录
- 存储配置测试连接(SigV4 零依赖)+ 桶不存在自动创建
- Loki 三模式部署修复:SSH 密钥认证、3.x 配置模板、ruler 对象存储嵌套块、
  凭证解密、孤儿 deploying 状态恢复、Grafana 部署(可选默认关)+面板导入
- DaemonSet 采集纯 YAML(去 helm 依赖)+ DNS 自愈回退 ClusterIP + 集群名标签
- 日志查询代理:cluster-svc 经 kube-apiserver proxy/url 直连 + cursor 翻页
- 统一 log 命名空间;部署就绪探活;Grafana 访问地址自动记录

修复:run.sh 增量编译检测、Sanitized 脱敏补全、LokiDeployment Update 白名单、
健康检查 CreatedAt 零值等 10+ 存量 bug。

数据兼容:DB 沿用旧 lokideploy.json(新名优先);localStorage 一次性迁移;
HKDF 加密前缀保留(已加密凭证不受影响)。

backend/controllers/auth.go

@@ -1,11 +1,11 @@
 package controllers
 
 import (
-	"lokideploy/dto"
-	"lokideploy/models"
-	"lokideploy/pkg/jwt"
-	"lokideploy/services"
-	"lokideploy/utils"
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/pkg/jwt"
+	"opsxloki/services"
+	"opsxloki/utils"
 
 	"github.com/gin-gonic/gin"
 )
@@ -41,11 +41,27 @@ func (ctrl *AuthController) RefreshToken(c *gin.Context) {
 	if !utils.BindAndValidate(c, &req) {
 		return
 	}
-	tokenPair, err := jwt.RefreshAccessToken(req.RefreshToken)
+	claims, err := jwt.ParseRefreshToken(req.RefreshToken)
 	if err != nil {
 		utils.Unauthorized(c, "invalid or expired refresh token")
 		return
 	}
+	// 对照数据库校验用户存在性与会话版本：改密/重置密码后旧 refresh token 立即失效
+	user, err := ctrl.service.GetUserByID(claims.UserID)
+	if err != nil {
+		utils.Unauthorized(c, "user no longer exists")
+		return
+	}
+	if claims.TokenVersion != user.TokenVersion {
+		utils.Unauthorized(c, "session revoked, please login again")
+		return
+	}
+	// 以用户当前 role 与版本签发，角色变更在刷新时即时生效
+	tokenPair, err := jwt.GenerateTokenPair(user.ID, user.Username, user.Role, user.TokenVersion)
+	if err != nil {
+		utils.Error(c, 500, err.Error())
+		return
+	}
 	utils.Success(c, gin.H{
 		"accessToken":  tokenPair.AccessToken,
 		"refreshToken": tokenPair.RefreshToken,
@@ -53,22 +69,6 @@ func (ctrl *AuthController) RefreshToken(c *gin.Context) {
 	})
 }
 
-func (ctrl *AuthController) Register(c *gin.Context) {
-	var req dto.RegisterRequest
-	if !utils.BindAndValidate(c, &req) {
-		return
-	}
-	if req.Role == "" {
-		req.Role = "user"
-	}
-	user, err := ctrl.service.Register(req.Username, req.Password, req.Nickname, req.Role)
-	if err != nil {
-		utils.Error(c, 400, err.Error())
-		return
-	}
-	utils.Success(c, models.SanitizedJSON(user))
-}
-
 func (ctrl *AuthController) GetUser(c *gin.Context) {
 	claims, ok := jwt.GetUserFromContext(c)
 	if !ok {

backend/controllers/cluster.go

@@ -1,10 +1,10 @@
 package controllers
 
 import (
-	"lokideploy/dto"
-	"lokideploy/models"
-	"lokideploy/services"
-	"lokideploy/utils"
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/services"
+	"opsxloki/utils"
 
 	"github.com/gin-gonic/gin"
 )

backend/controllers/collector.go

@@ -1,10 +1,10 @@
 package controllers
 
 import (
-	"lokideploy/dto"
-	"lokideploy/models"
-	"lokideploy/services"
-	"lokideploy/utils"
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/services"
+	"opsxloki/utils"
 
 	"github.com/gin-gonic/gin"
 )

backend/controllers/deployment.go

@@ -1,10 +1,12 @@
 package controllers
 
 import (
-	"lokideploy/dto"
-	"lokideploy/models"
-	"lokideploy/services"
-	"lokideploy/utils"
+	"context"
+	"time"
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/services"
+	"opsxloki/utils"
 
 	"github.com/gin-gonic/gin"
 )
@@ -37,6 +39,8 @@ func (ctrl *DeploymentController) Create(c *gin.Context) {
 		ResourcesCPU:    req.ResourcesCPU,
 		ResourcesMem:    req.ResourcesMem,
 		StorageSize:     req.StorageSize,
+		GrafanaEnabled:  req.GrafanaEnabled,
+		GrafanaVersion:  req.GrafanaVersion,
 	})
 	if err != nil {
 		utils.Error(c, 400, err.Error())
@@ -59,6 +63,34 @@ func (ctrl *DeploymentController) Get(c *gin.Context) {
 	utils.Success(c, models.SanitizedJSON(deployment))
 }
 
+// Ready 部署就绪探测(经自动注册的数据源访问 Loki /ready)
+func (ctrl *DeploymentController) Ready(c *gin.Context) {
+	id, err := utils.IntParam(c, "id")
+	if err != nil {
+		utils.BadRequest(c, "ID 无效")
+		return
+	}
+	d, err := ctrl.service.Get(uint(id))
+	if err != nil {
+		utils.NotFound(c, "部署不存在")
+		return
+	}
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 15*time.Second)
+	defer cancel()
+	ready, msg := services.DeploymentReady(ctx, d.Name)
+	utils.Success(c, gin.H{"ready": ready, "message": msg})
+}
+
+// Preflight 向导预检:聚合存储/集群/主机/Loki/采集器状态
+func (ctrl *DeploymentController) Preflight(c *gin.Context) {
+	utils.Success(c, ctrl.service.Preflight())
+}
+
+// GetVersions 返回支持的 Loki 版本列表（前端部署表单版本下拉数据源）
+func (ctrl *DeploymentController) GetVersions(c *gin.Context) {
+	utils.Success(c, gin.H{"versions": services.LokiVersionList})
+}
+
 func (ctrl *DeploymentController) List(c *gin.Context) {
 	page, pageSize := utils.Pagination(c)
 	deployments, total, err := ctrl.service.List(page, pageSize)

backend/controllers/host.go

@@ -1,11 +1,10 @@
 package controllers
 
 import (
-	"lokideploy/dto"
-	"lokideploy/models"
-	"lokideploy/pkg/crypto"
-	"lokideploy/services"
-	"lokideploy/utils"
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/services"
+	"opsxloki/utils"
 
 	"github.com/gin-gonic/gin"
 )
@@ -111,12 +110,7 @@ func (ctrl *HostController) GetInfo(c *gin.Context) {
 		return
 	}
 
-	password := host.Password
-	if len(password) > 4 && password[:4] == "ENC:" {
-		password, _ = crypto.Decrypt(password[4:])
-	}
-
-	client, err := services.NewSSHClient(host.HostIP, host.Port, host.User, password)
+	client, err := services.NewSSHClientWithAuth(services.HostSSHAuth(host))
 	if err != nil {
 		utils.Error(c, 500, err.Error())
 		return

backend/controllers/ldap.go

@@ -0,0 +1,81 @@
+package controllers
+
+import (
+	"opsxloki/dto"
+	"opsxloki/services"
+	"opsxloki/utils"
+
+	"github.com/gin-gonic/gin"
+)
+
+// LdapController LDAP 配置与用户导入(配置读写仅 admin)
+type LdapController struct{}
+
+func NewLdapController() *LdapController {
+	return &LdapController{}
+}
+
+// GetConfig LDAP 配置(密码剔除,附 hasPassword/configured)
+func (ctrl *LdapController) GetConfig(c *gin.Context) {
+	utils.Success(c, services.GetLDAPPublicConfig())
+}
+
+// UpdateConfig 保存配置(bindPassword 空则保留旧值)
+func (ctrl *LdapController) UpdateConfig(c *gin.Context) {
+	var req dto.LdapConfigRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	cfg := &services.LDAPConfig{
+		Enabled: req.Enabled, Host: req.Host, Port: req.Port, UseSSL: req.UseSSL,
+		BindDN: req.BindDN, BindPassword: req.BindPassword, BaseDN: req.BaseDN,
+		UserFilter: req.UserFilter, UsernameAttr: req.UsernameAttr,
+		NameAttr: req.NameAttr, EmailAttr: req.EmailAttr,
+	}
+	if err := services.SaveLDAPConfig(cfg); err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, services.GetLDAPPublicConfig())
+}
+
+// TestConnection 用表单参数测试(未保存也可测;密码空回退已存;可选用户级验证)
+func (ctrl *LdapController) TestConnection(c *gin.Context) {
+	var req dto.LdapConfigRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	cfg := &services.LDAPConfig{
+		Enabled: req.Enabled, Host: req.Host, Port: req.Port, UseSSL: req.UseSSL,
+		BindDN: req.BindDN, BindPassword: req.BindPassword, BaseDN: req.BaseDN,
+		UserFilter: req.UserFilter, UsernameAttr: req.UsernameAttr,
+		NameAttr: req.NameAttr, EmailAttr: req.EmailAttr,
+	}
+	if cfg.Port == 0 {
+		cfg.Port = 389
+	}
+	result := services.TestLDAPConnection(cfg, req.TestUsername, req.TestPassword)
+	utils.Success(c, result)
+}
+
+// ListUsers 导入预览:按 ouDN(空用 baseDN)搜索用户
+func (ctrl *LdapController) ListUsers(c *gin.Context) {
+	var req dto.LdapUsersRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	cfg := services.GetLDAPConfig()
+	if !cfg.Enabled || cfg.Host == "" {
+		utils.Error(c, 400, "LDAP 未启用或未配置")
+		return
+	}
+	if req.BindPassword != "" {
+		cfg.BindPassword = req.BindPassword
+	}
+	users, err := services.SearchLDAPUsersForImport(cfg, req.OUDN)
+	if err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, users)
+}

backend/controllers/log_policy.go

@@ -0,0 +1,59 @@
+package controllers
+
+import (
+	"strconv"
+
+	"opsxloki/models"
+	"opsxloki/services"
+	"opsxloki/utils"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (ctrl *LogsController) ListPolicyGroups(c *gin.Context) {
+	utils.Success(c, models.SanitizedJSON(services.ListLogPolicyGroups()))
+}
+
+func (ctrl *LogsController) CreatePolicyGroup(c *gin.Context) {
+	var group models.LogPolicyGroup
+	if !utils.BindAndValidate(c, &group) {
+		return
+	}
+	created, err := services.CreateLogPolicyGroup(group)
+	if err != nil {
+		utils.BadRequest(c, err.Error())
+		return
+	}
+	utils.Success(c, models.SanitizedJSON(created))
+}
+
+func (ctrl *LogsController) UpdatePolicyGroup(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		utils.BadRequest(c, "无效的策略组 ID")
+		return
+	}
+	var group models.LogPolicyGroup
+	if !utils.BindAndValidate(c, &group) {
+		return
+	}
+	updated, err := services.UpdateLogPolicyGroup(uint(id), group)
+	if err != nil {
+		utils.BadRequest(c, err.Error())
+		return
+	}
+	utils.Success(c, models.SanitizedJSON(updated))
+}
+
+func (ctrl *LogsController) DeletePolicyGroup(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		utils.BadRequest(c, "无效的策略组 ID")
+		return
+	}
+	if err := services.DeleteLogPolicyGroup(uint(id)); err != nil {
+		utils.BadRequest(c, err.Error())
+		return
+	}
+	utils.Success(c, gin.H{"message": "deleted"})
+}

backend/controllers/logs.go

@@ -0,0 +1,280 @@
+package controllers
+
+import (
+	"context"
+	"encoding/json"
+	"strconv"
+	"strings"
+	"time"
+
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/services"
+	"opsxloki/utils"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (ctrl *LogsController) Context(c *gin.Context) {
+	var req dto.LogContextRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	src := services.GetLogSource(req.SourceID)
+	if src == nil {
+		utils.BadRequest(c, "数据源不存在")
+		return
+	}
+	ts, err := strconv.ParseInt(req.TimestampNs, 10, 64)
+	if err != nil || ts < 1 {
+		utils.BadRequest(c, "时间戳无效")
+		return
+	}
+	parts := make([]string, 0, len(req.Labels))
+	for key, value := range req.Labels {
+		if !services.ValidLogLabelName(key) {
+			utils.BadRequest(c, "标签名无效")
+			return
+		}
+		encoded, _ := json.Marshal(value)
+		parts = append(parts, key+"="+string(encoded))
+	}
+	query, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", "{"+strings.Join(parts, ",")+"}")
+	if err != nil {
+		utils.Forbidden(c, err.Error())
+		return
+	}
+	span := int64(5 * time.Minute)
+	before, err := services.QueryLokiLogs(c.Request.Context(), src, query, ts-span, ts-1, 1, "backward", "")
+	if err != nil {
+		utils.Error(c, 502, err.Error())
+		return
+	}
+	after, err := services.QueryLokiLogs(c.Request.Context(), src, query, ts+1, ts+span, 1, "forward", "")
+	if err != nil {
+		utils.Error(c, 502, err.Error())
+		return
+	}
+	utils.Success(c, gin.H{"before": before.Entries, "after": after.Entries})
+}
+
+// LogsController 日志查询代理 + 数据源管理
+type LogsController struct{}
+
+func NewLogsController() *LogsController {
+	return &LogsController{}
+}
+
+// ==================== 数据源 ====================
+
+func (ctrl *LogsController) ListSources(c *gin.Context) {
+	list := services.ListVisibleLogSources(c.GetUint("userId"), c.GetString("role") == "admin")
+	utils.Success(c, utils.PageData{List: list, Total: int64(len(list)), Page: 1, PageSize: 100})
+}
+
+func (ctrl *LogsController) CreateSource(c *gin.Context) {
+	var req dto.LogSourceRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	if req.Name == "" || req.TargetType == "" {
+		utils.BadRequest(c, "名称与类型必填")
+		return
+	}
+	if err := services.ValidateSourceAccess(req.Access); err != nil {
+		utils.BadRequest(c, err.Error())
+		return
+	}
+	src := &models.LogSource{
+		Name: req.Name, TargetType: req.TargetType,
+		Namespace: req.Namespace, Service: req.Service, Port: req.Port,
+		URL: req.URL, AuthType: req.AuthType, BasicUser: req.BasicUser,
+		BasicPass: req.BasicPass, BearerToken: req.BearerToken, Headers: req.Headers, SkipTLSVerify: req.SkipTLSVerify, IsDefault: req.IsDefault, Access: req.Access,
+	}
+	if req.TargetType == "cluster-svc" {
+		if req.ClusterID > 0 {
+			id := req.ClusterID
+			src.ClusterID = &id
+		} else {
+			utils.BadRequest(c, "cluster-svc 类型必须选择集群")
+			return
+		}
+	}
+	created, err := services.CreateLogSource(src)
+	if err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, created.Sanitized())
+}
+
+func (ctrl *LogsController) UpdateSource(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		utils.BadRequest(c, "ID 无效")
+		return
+	}
+	var updates map[string]interface{}
+	if !utils.BindAndValidate(c, &updates) {
+		return
+	}
+	if err := services.UpdateLogSource(uint(id), updates); err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, gin.H{"message": "updated"})
+}
+
+func (ctrl *LogsController) DeleteSource(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		utils.BadRequest(c, "ID 无效")
+		return
+	}
+	if err := services.DeleteLogSource(uint(id)); err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, gin.H{"message": "deleted"})
+}
+
+// TestSource 数据源连通性测试(按 id 或表单参数)
+func (ctrl *LogsController) TestSource(c *gin.Context) {
+	var req dto.LogSourceRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	var src *models.LogSource
+	if req.ID > 0 {
+		src = services.GetLogSource(req.ID)
+		if src == nil {
+			utils.NotFound(c, "数据源不存在")
+			return
+		}
+	} else {
+		src = &models.LogSource{
+			TargetType: req.TargetType, Namespace: req.Namespace, Service: req.Service,
+			Port: req.Port, URL: req.URL, AuthType: req.AuthType,
+			BasicUser: req.BasicUser, BasicPass: req.BasicPass, BearerToken: req.BearerToken, Headers: req.Headers, SkipTLSVerify: req.SkipTLSVerify,
+		}
+		if req.TargetType == "cluster-svc" && req.ClusterID > 0 {
+			id := req.ClusterID
+			src.ClusterID = &id
+		}
+	}
+	utils.Success(c, services.TestLogSource(c.Request.Context(), src))
+}
+
+// ==================== 查询代理 ====================
+
+func (ctrl *LogsController) Query(c *gin.Context) {
+	var req dto.LogQueryRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	src := services.GetLogSource(req.SourceID)
+	if src == nil {
+		utils.BadRequest(c, "数据源不存在")
+		return
+	}
+	query, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", req.Query)
+	if err != nil {
+		utils.Forbidden(c, err.Error())
+		return
+	}
+	result, err := services.QueryLokiLogs(c.Request.Context(), src, query,
+		req.Start, req.End, req.Limit, req.Direction, req.Cursor)
+	if err != nil {
+		utils.Error(c, 502, err.Error())
+		return
+	}
+	utils.Success(c, result)
+}
+
+func (ctrl *LogsController) Labels(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Query("sourceId"), 10, 64)
+	src := services.GetLogSource(uint(id))
+	if src == nil {
+		utils.BadRequest(c, "数据源不存在")
+		return
+	}
+	if _, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", "{}"); err != nil {
+		utils.Forbidden(c, err.Error())
+		return
+	}
+	start, _ := strconv.ParseInt(c.Query("start"), 10, 64)
+	end, _ := strconv.ParseInt(c.Query("end"), 10, 64)
+	labels, err := services.LokiLabels(c.Request.Context(), src, start, end)
+	if err != nil {
+		utils.Error(c, 502, err.Error())
+		return
+	}
+	utils.Success(c, labels)
+}
+
+func (ctrl *LogsController) LabelValues(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Query("sourceId"), 10, 64)
+	src := services.GetLogSource(uint(id))
+	if src == nil {
+		utils.BadRequest(c, "数据源不存在")
+		return
+	}
+	start, _ := strconv.ParseInt(c.Query("start"), 10, 64)
+	end, _ := strconv.ParseInt(c.Query("end"), 10, 64)
+	requestedQuery := c.Query("query")
+	if strings.TrimSpace(requestedQuery) == "" {
+		requestedQuery = "{}"
+	}
+	query, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", requestedQuery)
+	if err != nil {
+		utils.Forbidden(c, err.Error())
+		return
+	}
+	values, err := services.LokiLabelValues(c.Request.Context(), src,
+		c.Param("name"), query, start, end)
+	if err != nil {
+		utils.Error(c, 502, err.Error())
+		return
+	}
+	utils.Success(c, values)
+}
+
+// Health Loki /ready 探活(查询页状态点)
+func (ctrl *LogsController) Health(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Query("sourceId"), 10, 64)
+	src := services.GetLogSource(uint(id))
+	if src == nil {
+		utils.BadRequest(c, "数据源不存在")
+		return
+	}
+	if _, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", "{}"); err != nil {
+		utils.Forbidden(c, err.Error())
+		return
+	}
+	ctx, cancel := context.WithTimeout(c.Request.Context(), 15*time.Second)
+	defer cancel()
+	utils.Success(c, gin.H{"ready": services.LokiReady(ctx, src)})
+}
+
+func (ctrl *LogsController) Histogram(c *gin.Context) {
+	var req dto.LogQueryRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	src := services.GetLogSource(req.SourceID)
+	if src == nil {
+		utils.BadRequest(c, "数据源不存在")
+		return
+	}
+	query, err := services.AuthorizedLogQuery(src, c.GetUint("userId"), c.GetString("role") == "admin", req.Query)
+	if err != nil {
+		utils.Forbidden(c, err.Error())
+		return
+	}
+	buckets, err := services.LokiHistogram(c.Request.Context(), src, query, req.Start, req.End)
+	if err != nil {
+		utils.Error(c, 502, err.Error())
+		return
+	}
+	utils.Success(c, buckets)
+}

backend/controllers/storage.go

@@ -1,10 +1,10 @@
 package controllers
 
 import (
-	"lokideploy/dto"
-	"lokideploy/models"
-	"lokideploy/services"
-	"lokideploy/utils"
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/services"
+	"opsxloki/utils"
 
 	"github.com/gin-gonic/gin"
 )
@@ -96,3 +96,22 @@ func (ctrl *StorageController) GetDefault(c *gin.Context) {
 	}
 	utils.Success(c, models.SanitizedJSON(storage))
 }
+
+// TestConnection 测试对象存储连接(凭证 + 桶存在性,可选自动创建;不落库)
+func (ctrl *StorageController) TestConnection(c *gin.Context) {
+	var req dto.StorageTestRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	result := services.TestStorageConnection(services.StorageTestParams{
+		StorageType:    req.StorageType,
+		Endpoint:       req.Endpoint,
+		Bucket:         req.Bucket,
+		Region:         req.Region,
+		AccessKey:      req.AccessKey,
+		SecretKey:      req.SecretKey,
+		Insecure:       req.Insecure,
+		CreateIfMissing: req.CreateIfMissing,
+	})
+	utils.Success(c, result)
+}

backend/controllers/user.go

@@ -0,0 +1,110 @@
+package controllers
+
+import (
+	"strconv"
+
+	"opsxloki/dto"
+	"opsxloki/models"
+	"opsxloki/pkg/jwt"
+	"opsxloki/services"
+	"opsxloki/utils"
+
+	"github.com/gin-gonic/gin"
+)
+
+// UserController 用户管理（全部端点仅 admin 可用，无 RBAC）
+type UserController struct {
+	service *services.AuthService
+}
+
+func NewUserController() *UserController {
+	return &UserController{service: services.NewAuthService()}
+}
+
+// List 分页返回用户列表（Sanitized 输出，密码哈希不出库）
+func (ctrl *UserController) List(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	pageSize, _ := strconv.Atoi(c.DefaultQuery("pageSize", "20"))
+	if page < 1 {
+		page = 1
+	}
+	if pageSize < 1 || pageSize > 100 {
+		pageSize = 20
+	}
+
+	users, total := ctrl.service.ListUsers(page, pageSize)
+	list := make([]map[string]interface{}, len(users))
+	for i := range users {
+		list[i] = users[i].Sanitized()
+	}
+	utils.Success(c, utils.PageData{List: list, Total: total, Page: page, PageSize: pageSize})
+}
+
+// Create 创建用户（原 /auth/register 逻辑收编至此）
+func (ctrl *UserController) Create(c *gin.Context) {
+	var req dto.UserCreateRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	role := req.Role
+	if role == "" {
+		role = "user"
+	}
+	user, err := ctrl.service.Register(req.Username, req.Password, req.Nickname, role)
+	if err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, models.SanitizedJSON(user))
+}
+
+// Delete 删除用户（守卫：不能删自己 / 最后一个 admin）
+func (ctrl *UserController) Delete(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		utils.BadRequest(c, "无效的用户 ID")
+		return
+	}
+	claims, ok := jwt.GetUserFromContext(c)
+	if !ok {
+		utils.Unauthorized(c, "")
+		return
+	}
+	if err := ctrl.service.DeleteUser(uint(id), claims.UserID); err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, gin.H{"message": "user deleted"})
+}
+
+// ResetPassword 管理员重置密码（递增 TokenVersion，目标用户旧会话全部失效）
+func (ctrl *UserController) ResetPassword(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		utils.BadRequest(c, "无效的用户 ID")
+		return
+	}
+	var req dto.ResetPasswordRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	if err := ctrl.service.ResetPassword(uint(id), req.NewPassword); err != nil {
+		utils.Error(c, 400, err.Error())
+		return
+	}
+	utils.Success(c, gin.H{"message": "password reset"})
+}
+
+// BatchImportLDAP 从 LDAP 批量导入用户(冲突策略见 services.BatchImportLDAPUsers)
+func (ctrl *UserController) BatchImportLDAP(c *gin.Context) {
+	var req dto.LdapImportRequest
+	if !utils.BindAndValidate(c, &req) {
+		return
+	}
+	users := make([]services.LDAPImportUser, 0, len(req.Users))
+	for _, u := range req.Users {
+		users = append(users, services.LDAPImportUser{DN: u.DN, Username: u.Username, Nickname: u.Nickname, Email: u.Email})
+	}
+	result := services.BatchImportLDAPUsers(users)
+	utils.Success(c, result)
+}