Repository navigation
整合 SEO 与 DeepSeek 简介修复，更新文章阅读布局和手机导航 - #88
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f7e71c3a74
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| from pathlib import Path | ||
| ROOT=Path(__file__).resolve().parent.parent | ||
| def sha(data):return hashlib.sha256(data).hexdigest() | ||
| entries={p.relative_to(ROOT).as_posix():p.read_bytes() for p in (ROOT/'dist').rglob('*') if p.is_file()} |
There was a problem hiding this comment.
When this packager runs from a clean checkout, dist/ is absent because it is gitignored, so this comprehension adds no frontend files but the script still produces a checksummed archive; deployment then fails when it tries to install dist/index.html. If an older local dist/ exists, the archive can instead deploy assets from the wrong revision. Run the frontend build and require the expected entry/assets before creating the archive.
AGENTS.md reference: AGENTS.md:L25-L26
Useful? React with 👍 / 👎.
| // Body 大小限制 | ||
| app.use(express.json({ limit: '1mb' })); | ||
| app.get('/api/image-variants/:width/:name', rateLimit({ windowMs: 60000, max: 240, standardHeaders: true, legacyHeaders: false }), require('./lib/imageVariants')(uploadRoutes.uploadDir)); | ||
| app.get('/api/image-variants/:width/:name', require('./lib/imageVariants')(uploadRoutes.uploadDir)); |
There was a problem hiding this comment.
This makes the public image transformation endpoint unbounded by request rate. An unauthenticated client can cycle through enough valid upload names and widths to evict the 16 MiB in-memory cache and continuously keep both permitted sharp transformations active, consuming CPU indefinitely; the internal two-job limit only bounds concurrency, not sustained work. Keep the route rate limiter while exposing the URL to crawlers.
Useful? React with 👍 / 👎.
| return <article className={`article-presentation ${cover?'article-has-cover':'article-no-cover'} ${preview?'detail-preview':''}`} data-reading-content={preview?undefined:true}> | ||
| <header className="hero-band" style={bandStyle}><div className="hero-inner"> | ||
| {progress} | ||
| <div className="detail-intro"><nav className="detail-breadcrumb" aria-label="面包屑导航" data-reading-ignore><Link className="hero-pill" to="/articles">← 文章库</Link></nav><div className="detail-label"><Link className="hero-pill" to={`/category/${encodeURIComponent(post.category||'文章')}`}>{post.category||'文章'}</Link></div></div> |
There was a problem hiding this comment.
Articles are allowed to publish with an empty category—the review treats it only as a warning—but this fallback turns the displayed label into a link to /category/文章. Unless a real category with that exact name happens to exist, clicking the new hero label takes readers to a 404. For an empty category, render a non-link label or link back to the article list instead.
Useful? React with 👍 / 👎.
2 participants
首页及文章的 SEO 元信息、DeepSeek 自动简介与草稿保存修复此前已部署但尚未进入 main；本 PR 将这些提交与已确认的文章页、手机菜单和阅读设置更新一起整合，保留现有节点监控、匿名首页缓存和邮件配置修复。
文章顶部使用封面取色渐变、居中标题和分组作者信息；同日更新日期及零浏览量隐藏。正文居中并配轨道目录，阅读设置改为桌面弹层和手机底部面板，手机菜单保留现有主题、账号功能及键盘焦点。文章页底部订阅区和页脚沿用线上 1200px 最大宽度。
验证：本地 npm run check 通过（81 个前端单元测试、类型检查、前端与 SSR 构建、包体预算）；相关后端 17 项测试通过。GitHub 首轮 MySQL 集成检查通过。原有浏览器 CI 的布局、阅读控件与手机主题入口断言已同步到新版，完整 CI 继续验证。本地完整后端测试的 IP 数据库查找依赖未备齐，该项未记录为通过。
安全核对发现图片变体接口先于 JSON API 全局限流注册。本次为它加入每 IP 每分钟 300 次的独立预算，超额请求 302 回退原图，原始图片仍可访问。新增 HTTP 测试验证预算边界、回退及无效文件名处理，CodeQL 对该接口的告警现已 fixed。其余七项经二次复核，并获用户明确授权后标记为 false positive：实际渲染器阻止恶意标题/富文本执行，实际全局中间件在第 201 次请求起阻止四个相关 API 处理函数，密文 SHA256 仅用于请求去重，实际 AES-GCM 密文篡改被拒绝。每项告警保留具体核对说明。
发布采用经过单独审查的离线包：国内仅替换 dist、SSR runtime 及 API 入口 src/index.js（图片预算），重启 mooncci-api 刷新缓存；海外只同步静态资源。核对线上基线、逐文件 SHA256、LF 元数据及 SSR 资源引用，备份可回滚文件并保留旧哈希资源。其他后端源码、worker、环境配置、Nginx、上传文件与数据库保持现状。DEPLOY.md 包含构建、上传、nohup 部署、日志与回滚命令。