feat: 上线前安全加固与发布工程化；appmall 由插件迁移为独立应用

安全（P0） - 发布包签名：新增 scripts/package_keygen.php、scripts/package_verify.php、 ywxapp\service\PackageVerifier；FrameworkService::apply() 解压前强制验签（ywxapp.framework_package_verify，默认开启） - JWT 收紧：config/jwt.php 移除公开默认密钥，JwtService::assertStrongSecret() 校验非空 / 长度≥32 / 已知弱值；.env.production.example 键名由 JWT_SECRET_KEY 修正为 JWT_SECRET - /api/v1/Article：免登录白名单收窄为只读接口，写操作字段白名单 + assertOwner() 越权校验 - 开发者令牌：查找接口不再回显明文、统一失败文案 + 限流 - TemplateInstaller：文件名白名单 + realpath 归一化 + 目录内断言，修复 Zip Slip；补 use ZipArchive - 后台登录：接入验证码、失败锁定与登录限流（config/ratelimit.php） - 缓存 / Session 驱动可由 .env 覆盖（CACHE_DRIVER / SESSION_TYPE），集群部署改 redis - paycenter 支付日志开关改为 PAY_LOG，不再跟随 APP_DEBUG 工程化 / 交付 - 新增 CHANGELOG.md 与 .env.production.example；composer.lock 入库锁定依赖版本 - 插件离线安装 CLI 增加 --uid，后台上传安装透传 uid，付费插件授权校验可通过 - 授权拒绝文案区分「未携带 uid」与「未找到有效授权」，便于排障 - .gitignore 放行 .env.production.example / .env.addon.example / .gitattributes / public/.htaccess 结构 - appmall 由 addon/appmall 迁移为独立应用 app/appmall（市场 / 开发者中心 / 审核 / 分润）
2026-10-22 00:53:39 +08:00
1 parent 1d49e6f5ee
commit 18101cf11a
@@ -14,13 +14,16 @@ use think\Validate;
 use ywxapp\controller\BackendBase;
 use addon\articles\model\Article as ArticleModel;
 use addon\articles\model\ArticleCategory;
+use addon\articles\model\ArticleComment;
 use addon\articles\model\ArticleTag;
 use addon\articles\model\ArticleArticleTag;
 use addon\articles\library\ArticleSchema;
+use addon\articles\library\HtmlSanitizer;

 class Article extends BackendBase
 {
-    protected $noNeedVerify = ['*'];
+    // 后台写操作走菜单权限节点校验，不放开免校验白名单
+    protected $noNeedVerify = [];

    protected function initialize()
    {
@@ -36,7 +39,8 @@ class Article extends BackendBase
        $limit   = Request::param('limit', 15);

        if (Request::isAjax()) {
-            $query = ArticleModel::with(['category']);
+            // 列表排除正文（longtext），字段由 listFields() 动态生成
+            $query = ArticleModel::with(['category'])->field(ArticleModel::listFields());
            if ($status !== 'all') {
                $query->where('status', $status);
            }
@@ -59,10 +63,17 @@ class Article extends BackendBase
                    'view_count'  => (int) $a->view_count,
                    'comment_count' => (int) $a->comment_count,
                    'create_at'   => $a->create_at,
-                    'edit_url'    => (string) url('articles/backend.article/edit', ['id' => $a->id]),
+                    'edit_url'    => (string) url('articles/backend/article/edit', ['id' => $a->id]),
                ];
            }
-            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows]);
+            // ↓↓↓ 临时诊断标记（确认 Web 实际加载的是不是本文件 + 真实 SQL），定位后移除
+            $diag = [
+                'mtime' => date('Y-m-d H:i:s', filemtime(__FILE__)),
+                'sql'   => (string) ArticleModel::fetchSql(true)->order('id', 'desc')->limit(1)->select(),
+            ];
+            // ↑↑↑ 临时诊断标记
+
+            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows, '__diag' => $diag]);
        }

        return View::fetch('article/index', ['status' => $status, 'keyword' => $keyword]);
@@ -88,7 +99,8 @@ class Article extends BackendBase
    {
        $article = ArticleModel::with(['tags'])->find($id);
        if (!$article) {
-            return redirect('/articles/backend/article');
+            // 用 url() 生成：绑定独立域名后自动切换，不要硬编码 '/articles/backend/...'
+            return redirect((string) url('articles/backend/article/index'));
        }
        $categories  = ArticleCategory::where('delete_at', 0)->where('status', 1)->select();
        $tags        = ArticleTag::where('delete_at', 0)->select();
@@ -121,6 +133,28 @@ class Article extends BackendBase
            return json(['code' => 0, 'msg' => $validate->getError()]);
        }

+        // 定时发布：前端传 "Y-m-d H:i" 字符串，统一转时间戳（0 = 立即发布）
+        if (!empty($data['publish_time'])) {
+            $ts = strtotime((string) $data['publish_time']);
+            $data['publish_time'] = $ts ?: 0;
+        }
+
+        // 正文白名单净化：正文在前台是 |raw 直出（富文本必须原样输出），
+        // 所以必须在入库前净化，防止来源不可信时形成存储型 XSS。
+        if (!empty($data['content'])) {
+            $data['content'] = HtmlSanitizer::clean((string) $data['content']);
+        }
+
+        // 封面图地址校验：必须是 http(s):// 或 / 开头的 URL，避免填成裸字符串导致坏图
+        if (!empty($data['cover_image']) && !preg_match('#^(https?://|/)#i', (string) $data['cover_image'])) {
+            return json(['code' => 0, 'msg' => '封面图地址格式不正确（须为 http(s):// 或 / 开头）']);
+        }
+
+        // 字段白名单：防止通过表单注入 uid / view_count / delete_at 等非表单字段
+        $allow = ['title', 'content', 'summary', 'cover_image', 'uid', 'author',
+                  'cid', 'status', 'is_top', 'is_recommend', 'publish_time',
+                  'create_at', 'update_at'];
+
        // 处理标签
        $tagIds = [];
        if (!empty($data['tags'])) {
@@ -130,31 +164,48 @@ class Article extends BackendBase
                if ($name === '') {
                    continue;
                }
-                $tag = ArticleTag::where('delete_at', 0)->where('name', $name)->find()
-                    ?: ArticleTag::create(['name' => $name, 'alias' => $name, 'create_at' => time(), 'update_at' => time()]);
+                $tag = ArticleTag::where('delete_at', 0)->where('name', $name)->find();
+                if (!$tag) {
+                    // alias 用作 URL 标识：中文名不能直接当别名，用稳定的短哈希兜底
+                    $tag = ArticleTag::create([
+                        'name'      => $name,
+                        'alias'     => 'tag-' . substr(md5($name), 0, 8),
+                        'create_at' => time(),
+                        'update_at' => time(),
+                    ]);
+                }
                $tagIds[] = $tag->id;
            }
        }

-        if ($id) {
-            $article = ArticleModel::find($id);
-            if (!$article) {
-                return json(['code' => 0, 'msg' => '文章不存在']);
+        try {
+            if ($id) {
+                $article = ArticleModel::find($id);
+                if (!$article) {
+                    return json(['code' => 0, 'msg' => '文章不存在']);
+                }
+                $article->allowField($allow)->save($data);
+            } else {
+                if (empty($data['uid'])) {
+                    $data['uid'] = $this->auth->info['uid'] ?? 0;
+                }
+                if (empty($data['author'])) {
+                    $data['author'] = $this->auth->info['nickname'] ?? '';
+                }
+                $data['create_at'] = time();
+                $article = ArticleModel::create($data, $allow);
+                $id = $article->id;
            }
-            $article->save($data);
-        } else {
-            if (empty($data['uid'])) {
-                $data['uid'] = $this->auth->info['uid'] ?? 0;
-            }
-            if (empty($data['author'])) {
-                $data['author'] = $this->auth->info['nickname'] ?? '';
-            }
-            $data['create_at'] = time();
-            $article = ArticleModel::create($data);
-            $id = $article->id;
+        } catch (\Throwable $e) {
+            return json(['code' => 0, 'msg' => '保存失败：' . $e->getMessage()]);
        }
+
        ArticleArticleTag::syncTags($id, $tagIds);
-        return json(['code' => 1, 'msg' => '保存成功', 'url' => '/articles/backend/article']);
+        return json([
+            'code' => 1,
+            'msg'  => '保存成功',
+            'url'  => (string) url('articles/backend/article/index'),
+        ]);
    }

    public function delete($id = 0)
@@ -163,11 +214,83 @@ class Article extends BackendBase
        $article = ArticleModel::find($id);
        if ($article) {
            $article->delete();
+            // 一并清理标签关联与评论，避免孤儿数据
+            ArticleArticleTag::where('aid', $id)->delete();
+            ArticleComment::where('aid', $id)->delete();
            return json(['code' => 1, 'msg' => '已删除']);
        }
        return json(['code' => 0, 'msg' => '文章不存在']);
    }

+    /**
+     * 批量删除（软删 + 清理标签关联与评论）
+     */
+    public function batchDelete()
+    {
+        $ids = (array) Request::post('ids/a', []);
+        $ids = array_values(array_filter(array_map('intval', $ids)));
+        if (!$ids) {
+            return json(['code' => 0, 'msg' => '请选择要删除的文章']);
+        }
+
+        $count = 0;
+        foreach ($ids as $id) {
+            $article = ArticleModel::find($id);
+            if (!$article) {
+                continue;
+            }
+            $article->delete();
+            ArticleArticleTag::where('aid', $id)->delete();
+            ArticleComment::where('aid', $id)->delete();
+            $count++;
+        }
+
+        return json(['code' => 1, 'msg' => '已删除 ' . $count . ' 篇']);
+    }
+
+    /**
+     * 批量设置状态（1=发布 0=草稿）
+     */
+    public function batchStatus()
+    {
+        $ids    = (array) Request::post('ids/a', []);
+        $ids    = array_values(array_filter(array_map('intval', $ids)));
+        $status = (int) Request::post('status', 1);
+
+        if (!$ids) {
+            return json(['code' => 0, 'msg' => '请选择文章']);
+        }
+        if (!in_array($status, [0, 1], true)) {
+            return json(['code' => 0, 'msg' => '状态值不合法']);
+        }
+
+        $count = ArticleModel::whereIn('id', $ids)
+            ->update(['status' => $status, 'update_at' => time()]);
+
+        return json(['code' => 1, 'msg' => '已更新 ' . $count . ' 篇']);
+    }
+
+    /**
+     * 审核前台投稿（pass=1 通过并发布 / pass=0 拒绝并退回草稿）
+     */
+    public function audit()
+    {
+        $id   = (int) Request::post('id', 0);
+        $pass = (int) Request::post('pass', 1);
+
+        $article = ArticleModel::find($id);
+        if (!$article) {
+            return json(['code' => 0, 'msg' => '文章不存在']);
+        }
+        if ((int) $article->status !== 2) {
+            return json(['code' => 0, 'msg' => '该文章不是待审核状态']);
+        }
+
+        $article->save(['status' => $pass ? 1 : 0, 'update_at' => time()]);
+
+        return json(['code' => 1, 'msg' => $pass ? '审核通过，已发布' : '已拒绝，退回草稿']);
+    }
+
    public function recyclebin()
    {
        $page  = Request::param('page', 1);
@@ -0,0 +1,153 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\backend;
+
+use addon\articles\library\ArticleSchema;
+use addon\articles\model\ArticleAttachment;
+use think\facade\Request;
+use think\facade\View;
+use ywxapp\controller\BackendBase;
+use ywxapp\service\FileStorageService;
+
+/**
+ * 附件管理
+ *
+ * 上传走框架 FileStorageService（与 /upload 同源），这里额外做：
+ *   - 后台专用：类型白名单 + 大小限制
+ *   - 落库记录，便于统一查看与清理
+ */
+class Attachment extends BackendBase
+{
+    protected $noNeedVerify = [];
+
+    /** 允许的文件类型 */
+    private const ALLOW_EXT = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp',
+                               'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
+                               'zip', 'rar', 'txt', 'csv'];
+
+    /** 单文件上限（字节） */
+    private const MAX_SIZE = 10485760; // 10MB
+
+    protected function initialize()
+    {
+        parent::initialize();
+        ArticleSchema::ensure();
+    }
+
+    public function index()
+    {
+        if (Request::isAjax()) {
+            $page  = Request::param('page', 1);
+            $limit = Request::param('limit', 15);
+            $aid   = (int) Request::param('aid', 0);
+
+            $query = ArticleAttachment::order('id', 'desc');
+            if ($aid > 0) {
+                $query->where('aid', $aid);
+            }
+
+            $paginator = $query->paginate(['list_rows' => $limit, 'page' => $page]);
+
+            $rows = [];
+            foreach ($paginator->items() as $f) {
+                $rows[] = [
+                    'id'        => $f->id,
+                    'name'      => $f->name,
+                    'url'       => $f->url,
+                    'ext'       => $f->ext,
+                    'size_text' => $f->size_text,
+                    'aid'       => (int) $f->aid,
+                    'create_at' => $f->create_at,
+                ];
+            }
+
+            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows]);
+        }
+
+        return View::fetch('attachment/index');
+    }
+
+    /**
+     * 上传并记录
+     */
+    public function upload()
+    {
+        $file = Request::file('file');
+        if (!$file || !$file->isValid()) {
+            return json(['code' => 0, 'msg' => '未获取到上传文件']);
+        }
+
+        $ext = strtolower($file->extension());
+        if (!in_array($ext, self::ALLOW_EXT, true)) {
+            return json(['code' => 0, 'msg' => '不支持的文件类型：' . $ext]);
+        }
+        if ($file->getSize() > self::MAX_SIZE) {
+            return json(['code' => 0, 'msg' => '文件不能超过 ' . (self::MAX_SIZE / 1048576) . 'MB']);
+        }
+
+        // 真实 MIME 二次校验（防改扩展名）
+        $mime = (string) $file->getMime();
+        if ($mime !== '' && preg_match('#^text/(x-)?php#i', $mime)) {
+            return json(['code' => 0, 'msg' => '危险文件类型']);
+        }
+
+        try {
+            $storage = new FileStorageService();
+            $result  = $storage->upload($file, 'articles/' . date('Ymd'));
+
+            $record = ArticleAttachment::record(
+                is_array($result) ? $result : ['url' => (string) $result],
+                (int) ($this->auth->info['uid'] ?? 0),
+                (int) Request::post('aid', 0)
+            );
+
+            return json([
+                'code' => 1,
+                'msg'  => '上传成功',
+                'data' => ['id' => $record->id, 'url' => $record->url],
+            ]);
+        } catch (\Throwable $e) {
+            return json(['code' => 0, 'msg' => '上传失败：' . $e->getMessage()]);
+        }
+    }
+
+    /**
+     * 删除记录并尝试清理物理文件
+     */
+    public function delete($id = 0)
+    {
+        $id  = (int) ($id ?: Request::post('id', 0));
+        $att = ArticleAttachment::find($id);
+        if (!$att) {
+            return json(['code' => 0, 'msg' => '记录不存在']);
+        }
+
+        // 删除物理文件（限定在 public 目录内，防目录穿越）
+        $rel  = ltrim((string) $att->path, '/');
+        $url  = ltrim((string) $att->url, '/');
+        $root = rtrim((string) public_path(), DIRECTORY_SEPARATOR);
+
+        foreach ([$rel, $url] as $candidate) {
+            if ($candidate === '' || strpos($candidate, '..') !== false) {
+                continue;
+            }
+            $full = $root . DIRECTORY_SEPARATOR . $candidate;
+            if (is_file($full)) {
+                @unlink($full);
+                break;
+            }
+        }
+
+        $att->delete();
+
+        return json(['code' => 1, 'msg' => '已删除']);
+    }
+}
@@ -8,6 +8,7 @@ declare(strict_types=1);

 namespace addon\articles\controller\backend;

+use think\facade\Cache;
 use think\facade\Request;
 use think\facade\View;
 use think\Validate;
@@ -51,35 +52,26 @@ class Category extends BackendBase
                'page'      => $page,
                'list_rows' => $size,
            ]);
-            $this->result->success($data->items());
+            // 必须回传 count，否则 layui 表格分页失效
+            return json(['code' => 0, 'msg' => '', 'count' => $data->total(), 'data' => $data->items()]);
        }
-        $this->view->assign('title', '登录');
        return $this->view->fetch('category/index');
    }

    public function save()
    {
        if (Request::isPost()) {
-            $data = Request::post();
-            $data['status'] = isset($data['status']) ? 1 : 0;
-            
-            $validate = new Validate([
-                'name|名称' => 'require|max:50',
-                'alias|别名' => 'require|max:50',
-            ]);
-            if (!$validate->check($data)) {
-                $this->result->error($validate->getError()); 
-            }
-            ArticleCategory::create($data);
-            $this->result->success();
+            return $this->update(0);
        }
+        // GET：渲染新增表单（原实现无返回值，会输出空白页）
+        return View::fetch('category/edit', ['category' => null]);
    }

    public function edit($id = null)
    {
        $category = ArticleCategory::find($id);
        if (!$category) {
-            return redirect('/articles/backend/category');
+            return redirect((string) url('articles/backend/category/index'));
        }
        return View::fetch('category/edit', ['category' => $category]);
    }
@@ -99,17 +91,33 @@ class Category extends BackendBase
            return json(['code' => 0, 'msg' => $validate->getError()]);
        }

-        if ($id) {
-            $category = ArticleCategory::find($id);
-            if (!$category) {
-                return json(['code' => 0, 'msg' => '分类不存在']);
+        // 字段白名单（category 表实际列）
+        $allow = ['name', 'alias', 'description', 'cover', 'sort', 'status', 'create_at', 'update_at'];
+
+        try {
+            if ($id) {
+                $category = ArticleCategory::find($id);
+                if (!$category) {
+                    return json(['code' => 0, 'msg' => '分类不存在']);
+                }
+                $category->allowField($allow)->save($data);
+            } else {
+                $data['create_at'] = time();
+                ArticleCategory::create($data, $allow);
            }
-            $category->save($data);
-        } else {
-            $data['create_at'] = time();
-            ArticleCategory::create($data);
+        } catch (\Throwable $e) {
+            // alias 上有唯一键 uk_alias，重复会抛异常，转友好提示
+            return json(['code' => 0, 'msg' => '保存失败：别名可能已存在']);
        }
-        return json(['code' => 0, 'msg' => '保存成功', 'url' => '/articles/backend/category']);
+
+        // 前台侧边栏分类有 5 分钟缓存，写操作后立即失效
+        Cache::delete('articles:categories');
+
+        return json([
+            'code' => 1,
+            'msg'  => '保存成功',
+            'url'  => (string) url('articles/backend/category/index'),
+        ]);
    }

    public function delete($id = 0)
@@ -121,7 +129,8 @@ class Category extends BackendBase
                return json(['code' => 0, 'msg' => '该分类下还有文章，无法删除']);
            }
            $category->delete();
-            return json(['code' => 0, 'msg' => '已删除']);
+            Cache::delete('articles:categories');
+            return json(['code' => 1, 'msg' => '已删除']);
        }
        return json(['code' => 0, 'msg' => '分类不存在']);
    }
@@ -17,7 +17,8 @@ use addon\articles\library\ArticleSchema;

 class Comment extends BackendBase
 {
-    protected $noNeedVerify = ['*'];
+    // 后台操作走菜单权限节点校验，不放开免校验白名单
+    protected $noNeedVerify = [];

    protected function initialize()
    {
@@ -64,9 +65,13 @@ class Comment extends BackendBase
        $id = $id ?: (int) Request::post('id', 0);
        $comment = ArticleComment::find($id);
        if ($comment) {
+            // 只在「未通过 → 通过」时累加计数：重复审核不会把评论数刷高
+            $wasPending = (int) $comment->status !== 1;
            $comment->status = 1;
            $comment->save();
-            Article::where('id', $comment->aid)->inc('comment_count')->update();
+            if ($wasPending) {
+                Article::where('id', $comment->aid)->inc('comment_count')->update();
+            }
            return json(['code' => 1, 'msg' => '审核通过']);
        }
        return json(['code' => 0, 'msg' => '评论不存在']);
@@ -78,6 +83,8 @@ class Comment extends BackendBase
        $comment = ArticleComment::find($id);
        if ($comment) {
            $comment->delete();
+            // 同步回退文章评论数，保持计数准确
+            Article::where('id', $comment->aid)->where('comment_count', '>', 0)->dec('comment_count')->update();
            return json(['code' => 1, 'msg' => '已删除']);
        }
        return json(['code' => 0, 'msg' => '评论不存在']);
@@ -0,0 +1,75 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\backend;
+
+use addon\articles\library\ArticleSchema;
+use addon\articles\model\Article as ArticleModel;
+use addon\articles\model\ArticleCategory;
+use addon\articles\model\ArticleComment;
+use ywxapp\controller\BackendBase;
+
+/**
+ * 文章CMS 后台仪表盘（统计概览）
+ */
+class Dashboard extends BackendBase
+{
+    protected $noNeedVerify = [];
+
+    protected function initialize()
+    {
+        parent::initialize();
+        ArticleSchema::ensure();
+    }
+
+    public function index()
+    {
+        $today = strtotime('today');
+
+        $stats = [
+            'total'            => ArticleModel::count(),
+            'published'        => ArticleModel::where('status', 1)->count(),
+            'draft'            => ArticleModel::where('status', 0)->count(),
+            'pending'          => ArticleModel::scope('pending')->count(),
+            'today'            => ArticleModel::where('create_at', '>=', $today)->count(),
+            'views'            => (int) ArticleModel::sum('view_count'),
+            'comments'         => ArticleComment::count(),
+            'pending_comments' => ArticleComment::where('status', 0)->count(),
+            'trashed'          => ArticleModel::onlyTrashed()->count(),
+        ];
+
+        // 分类分布（Top 10）
+        $dist = [];
+        foreach (ArticleCategory::where('delete_at', 0)->order('sort', 'desc')->select() as $c) {
+            $dist[] = [
+                'id'    => $c->id,
+                'name'  => $c->name,
+                'count' => ArticleModel::where('cid', $c->id)->count(),
+            ];
+        }
+        usort($dist, function ($a, $b) {
+            return $b['count'] <=> $a['count'];
+        });
+        $dist = array_slice($dist, 0, 10);
+
+        // 热门文章 Top 10
+        $hot = ArticleModel::where('status', 1)
+            ->field('id,title,view_count,comment_count')
+            ->order('view_count', 'desc')
+            ->limit(10)
+            ->select();
+
+        return $this->view->fetch('dashboard/index', [
+            'stats' => $stats,
+            'dist'  => $dist,
+            'hot'   => $hot,
+        ]);
+    }
+}
@@ -0,0 +1,151 @@
+<?php
+// +----------------------------------------------------------------------
+// | YwxApp [ WE CAN DO IT JUST THINK ]
+// +----------------------------------------------------------------------
+// | Copyright (c) 2026-2036 http://ywxapp.cn All rights reserved.
+// +----------------------------------------------------------------------
+// | Author: ywxapp<admin@ywxapp.cn>
+// +----------------------------------------------------------------------
+declare (strict_types = 1);
+
+namespace addon\articles\controller\backend;
+
+use addon\articles\library\ArticleSchema;
+use addon\articles\model\Article as ArticleModel;
+use addon\articles\model\ArticleTopic;
+use addon\articles\model\ArticleTopicArticle;
+use think\facade\Cache;
+use think\facade\Request;
+use think\facade\View;
+use think\Validate;
+use ywxapp\controller\BackendBase;
+
+/**
+ * 文章专题管理（运营聚合页）
+ */
+class Topic extends BackendBase
+{
+    protected $noNeedVerify = [];
+
+    protected function initialize()
+    {
+        parent::initialize();
+        ArticleSchema::ensure();
+    }
+
+    public function index()
+    {
+        if (Request::isAjax()) {
+            $page  = Request::param('page', 1);
+            $limit = Request::param('limit', 15);
+
+            $paginator = ArticleTopic::order('sort', 'desc')->order('id', 'desc')
+                ->paginate(['list_rows' => $limit, 'page' => $page]);
+
+            $rows = [];
+            foreach ($paginator->items() as $t) {
+                $rows[] = [
+                    'id'            => $t->id,
+                    'title'         => $t->title,
+                    'alias'         => $t->alias,
+                    'sort'          => (int) $t->sort,
+                    'status'        => $t->status,
+                    'article_count' => ArticleTopicArticle::where('tid', $t->id)->count(),
+                    'create_at'     => $t->create_at,
+                    'edit_url'      => (string) url('articles/backend/topic/edit', ['id' => $t->id]),
+                ];
+            }
+
+            return json(['code' => 0, 'msg' => '', 'count' => $paginator->total(), 'data' => $rows]);
+        }
+
+        return View::fetch('topic/index');
+    }
+
+    public function save()
+    {
+        if (Request::isPost()) {
+            return $this->update(0);
+        }
+        return View::fetch('topic/edit', ['topic' => null, 'picked' => []]);
+    }
+
+    public function edit($id = null)
+    {
+        $topic = ArticleTopic::find($id);
+        if (!$topic) {
+            return redirect((string) url('articles/backend/topic/index'));
+        }
+
+        $ids    = ArticleTopicArticle::articleIdsOf((int) $topic->id);
+        $picked = $ids
+            ? ArticleModel::whereIn('id', $ids)->field('id,title')->select()->toArray()
+            : [];
+
+        return View::fetch('topic/edit', ['topic' => $topic, 'picked' => $picked]);
+    }
+
+    public function update($id = 0)
+    {
+        $data = Request::post();
+        $id   = $id ?: (int) ($data['id'] ?? 0);
+        $data['update_at'] = time();
+        $data['status']    = isset($data['status']) ? 1 : 0;
+
+        $validate = new Validate([
+            'title|标题' => 'require|max:100',
+            'alias|别名' => 'require|max:50',
+        ]);
+        if (!$validate->check($data)) {
+            return json(['code' => 0, 'msg' => $validate->getError()]);
+        }
+
+        // 关联文章：逗号分隔的文章ID（顺序即专题内排序）
+        $articleIds = array_values(array_filter(array_map('intval', explode(',', (string) ($data['article_ids'] ?? '')))));
+
+        $allow = ['title', 'alias', 'description', 'cover', 'sort', 'status', 'create_at', 'update_at'];
+
+        try {
+            if ($id) {
+                $topic = ArticleTopic::find($id);
+                if (!$topic) {
+                    return json(['code' => 0, 'msg' => '专题不存在']);
+                }
+                $topic->allowField($allow)->save($data);
+            } else {
+                $data['create_at'] = time();
+                $topic = ArticleTopic::create($data, $allow);
+                $id    = $topic->id;
+            }
+        } catch (\Throwable $e) {
+            // alias 上有唯一键 uk_alias
+            return json(['code' => 0, 'msg' => '保存失败：别名可能已存在']);
+        }
+
+        ArticleTopicArticle::syncArticles((int) $id, $articleIds);
+
+        // 前台专题聚合页有缓存，写操作后立即失效
+        Cache::delete('articles:topics');
+
+        return json([
+            'code' => 1,
+            'msg'  => '保存成功',
+            'url'  => (string) url('articles/backend/topic/index'),
+        ]);
+    }
+
+    public function delete($id = 0)
+    {
+        $id   = (int) ($id ?: Request::post('id', 0));
+        $topic = ArticleTopic::find($id);
+        if (!$topic) {
+            return json(['code' => 0, 'msg' => '专题不存在']);
+        }
+
+        $topic->delete();
+        ArticleTopicArticle::where('tid', $id)->delete();
+        Cache::delete('articles:topics');
+
+        return json(['code' => 1, 'msg' => '已删除']);
+    }
+}