Mock 地址安全加固：空间 ID → 16 位随机 mock_token

- 问题：/mock/{自增空间ID} 可枚举且服务绑定所有网卡，局域网可猜他人空间
- workspaces 新增 mock_token（UNIQUE，随机 8 字节 hex；老库自动 ALTER + 回填）
- /mock/{token}/path：解析失败统一 404（不暴露存在性）；限流 key 沿用 token
- /api/me 与发布响应返回 token 形态 base；弹窗 URL 改用 token
- 验证：token URL 正常随机生成；旧数字 ID 与任意伪造 token 均 404

apps/server/internal/store/store.go

@@ -80,7 +80,8 @@ CREATE TABLE IF NOT EXISTS workspaces (
   team_id INTEGER REFERENCES teams(id) ON DELETE CASCADE,
   owner_id INTEGER NOT NULL REFERENCES users(id),
   data TEXT NOT NULL DEFAULT '',
-  updated_at INTEGER NOT NULL
+  updated_at INTEGER NOT NULL,
+  mock_token TEXT UNIQUE
 );
 CREATE INDEX IF NOT EXISTS idx_tokens_user ON tokens(user_id);
 CREATE INDEX IF NOT EXISTS idx_members_user ON team_members(user_id);
@@ -99,7 +100,40 @@ CREATE TABLE IF NOT EXISTS mock_endpoints (
 CREATE INDEX IF NOT EXISTS idx_mock_ws ON mock_endpoints(workspace_id);
 CREATE INDEX IF NOT EXISTS idx_workspaces_owner ON workspaces(owner_id);
 `)
-	return err
+	if err != nil {
+		return err
+	}
+	// 老库补列 + 回填随机 token（幂等）
+	if _, err := s.db.Exec(`ALTER TABLE workspaces ADD COLUMN mock_token TEXT`); err == nil {
+		_, _ = s.db.Exec(`CREATE UNIQUE INDEX IF NOT EXISTS idx_workspaces_mock_token ON workspaces(mock_token)`)
+	}
+	rows, err := s.db.Query(`SELECT id FROM workspaces WHERE mock_token IS NULL OR mock_token = ''`)
+	if err != nil {
+		return err
+	}
+	var ids []int64
+	for rows.Next() {
+		var id int64
+		if err := rows.Scan(&id); err != nil {
+			rows.Close()
+			return err
+		}
+		ids = append(ids, id)
+	}
+	rows.Close()
+	for _, id := range ids {
+		if _, err := s.db.Exec(`UPDATE workspaces SET mock_token = ? WHERE id = ?`, newMockToken(), id); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// newMockToken 16 位随机 hex（URL 片段，不可枚举）
+func newMockToken() string {
+	raw := make([]byte, 8)
+	_, _ = rand.Read(raw)
+	return hex.EncodeToString(raw)
 }
 
 /* ---------------- 密码 ---------------- */
@@ -227,8 +261,8 @@ func (s *Store) CreateTeam(ownerID int64, name string) (*Team, error) {
 		return nil, err
 	}
 	if _, err := s.db.Exec(
-		`INSERT INTO workspaces(name, team_id, owner_id, data, updated_at) VALUES(?,?,?,'',?)`,
-		name, id, ownerID, now,
+		`INSERT INTO workspaces(name, team_id, owner_id, data, updated_at, mock_token) VALUES(?,?,?,'',?,?)`,
+		name, id, ownerID, now, newMockToken(),
 	); err != nil {
 		return nil, err
 	}
@@ -285,6 +319,7 @@ type Workspace struct {
 	OwnerID   int64  `json:"ownerId"`
 	Data      string `json:"data"`
 	UpdatedAt int64  `json:"updatedAt"`
+	MockToken string `json:"mockToken"`
 }
 
 // WorkspacesOfUser：个人空间 + 所在团队的空间（含个人空间自动补齐）
@@ -294,8 +329,8 @@ func (s *Store) WorkspacesOfUser(userID int64) ([]Workspace, error) {
 	err := s.db.QueryRow(`SELECT 1 FROM workspaces WHERE owner_id = ? AND team_id IS NULL`, userID).Scan(&one)
 	if errors.Is(err, sql.ErrNoRows) {
 		if _, err := s.db.Exec(
-			`INSERT INTO workspaces(name, team_id, owner_id, data, updated_at) VALUES(?,NULL,?,'',?)`,
-			"我的空间", userID, time.Now().Unix(),
+			`INSERT INTO workspaces(name, team_id, owner_id, data, updated_at, mock_token) VALUES(?,NULL,?,'',?,?)`,
+			"我的空间", userID, time.Now().Unix(), newMockToken(),
 		); err != nil {
 			return nil, err
 		}
@@ -304,7 +339,7 @@ func (s *Store) WorkspacesOfUser(userID int64) ([]Workspace, error) {
 	}
 
 	rows, err := s.db.Query(`
-SELECT w.id, w.name, w.team_id, w.owner_id, IFNULL(w.data,''), w.updated_at
+SELECT w.id, w.name, w.team_id, w.owner_id, IFNULL(w.data,''), w.updated_at, IFNULL(w.mock_token,'')
 FROM workspaces w
 WHERE w.owner_id = ?
    OR w.team_id IN (SELECT team_id FROM team_members WHERE user_id = ?)
@@ -316,7 +351,7 @@ ORDER BY w.team_id IS NOT NULL, w.id`, userID, userID)
 	var out []Workspace
 	for rows.Next() {
 		var w Workspace
-		if err := rows.Scan(&w.ID, &w.Name, &w.TeamID, &w.OwnerID, &w.Data, &w.UpdatedAt); err != nil {
+		if err := rows.Scan(&w.ID, &w.Name, &w.TeamID, &w.OwnerID, &w.Data, &w.UpdatedAt, &w.MockToken); err != nil {
 			return nil, err
 		}
 		out = append(out, w)
@@ -341,8 +376,8 @@ WHERE w.id = ? AND (w.owner_id = ?
 func (s *Store) WorkspaceByID(wsID int64) (*Workspace, error) {
 	w := &Workspace{}
 	err := s.db.QueryRow(
-		`SELECT id, name, team_id, owner_id, IFNULL(data,''), updated_at FROM workspaces WHERE id = ?`, wsID,
-	).Scan(&w.ID, &w.Name, &w.TeamID, &w.OwnerID, &w.Data, &w.UpdatedAt)
+		`SELECT id, name, team_id, owner_id, IFNULL(data,''), updated_at, IFNULL(mock_token,'') FROM workspaces WHERE id = ?`, wsID,
+	).Scan(&w.ID, &w.Name, &w.TeamID, &w.OwnerID, &w.Data, &w.UpdatedAt, &w.MockToken)
 	if errors.Is(err, sql.ErrNoRows) {
 		return nil, ErrNotFound
 	}
@@ -393,6 +428,19 @@ func (s *Store) FindMockEndpoint(workspaceID int64, method, path string) (*mocks
 	return e, true, nil
 }
 
+// ResolveMockToken：mock token → workspace id（不存在返回 false，不暴露信息）
+func (s *Store) ResolveMockToken(token string) (int64, bool, error) {
+	var id int64
+	err := s.db.QueryRow(`SELECT id FROM workspaces WHERE mock_token = ?`, token).Scan(&id)
+	if errors.Is(err, sql.ErrNoRows) {
+		return 0, false, nil
+	}
+	if err != nil {
+		return 0, false, err
+	}
+	return id, true, nil
+}
+
 func (s *Store) SaveWorkspace(wsID int64, data string) (int64, error) {
 	now := time.Now().Unix()
 	_, err := s.db.Exec(`UPDATE workspaces SET data = ?, updated_at = ? WHERE id = ?`, data, now, wsID)