feat(admin): 系统公告 - 支持配图草稿与自动回收

Adapted from ddcat-ai/open-ai-canvas#339

Original commit: fcdbe2aa833f31f683f709b7f409a0534ed78e20

Refs #339

Co-authored-by: 宇熙 <101980758+yuxiwl@users.noreply.github.com>

backend/internal/handler/announcement.go

@@ -3,6 +3,7 @@ package handler
 import (
 	"net/http"
 	"strconv"
+	"time"
 
 	"infinite-canvas/backend/internal/service"
 
@@ -23,6 +24,31 @@ func RegisterAnnouncementRoutes(r *gin.RouterGroup, svc *service.Service) {
 		}
 		ok(c, feed)
 	})
+	r.GET("/announcements/:id/image", func(c *gin.Context) {
+		user, err := currentUser(c, svc)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		stream, err := svc.OpenAnnouncementImage(user, c.Param("id"), c.GetHeader("Range"))
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		defer stream.Body.Close()
+		mimeType := stream.Resource.MimeType
+		if mimeType == "" {
+			mimeType = "application/octet-stream"
+		}
+		c.Header("Cache-Control", "private, max-age=3600")
+		c.Header("Referrer-Policy", "no-referrer")
+		c.Header("Accept-Ranges", stream.AcceptRanges)
+		c.Header("X-Content-Type-Options", "nosniff")
+		if stream.ContentRange != "" {
+			c.Header("Content-Range", stream.ContentRange)
+		}
+		c.DataFromReader(stream.StatusCode, stream.ContentLength, mimeType, stream.Body, nil)
+	})
 
 	r.POST("/announcements/read", func(c *gin.Context) {
 		user, err := currentUser(c, svc)
@@ -80,6 +106,43 @@ func RegisterAnnouncementRoutes(r *gin.RouterGroup, svc *service.Service) {
 		ok(c, gin.H{"announcement": announcement})
 	})
 
+	r.POST("/admin/announcement-images", func(c *gin.Context) {
+		user, err := currentUser(c, svc)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		policy, available := loadRuntimePolicy(c, svc)
+		if !available || !enforceRateLimit(c, "admin-announcement-image-upload:"+user.ID, policy.Request.ResourceUploadPerMinute, time.Minute) {
+			return
+		}
+		c.Request.Body = http.MaxBytesReader(c.Writer, c.Request.Body, service.AnnouncementImageMaxBytes+(1<<20))
+		file, err := c.FormFile("file")
+		if err != nil {
+			fail(c, http.StatusBadRequest, err)
+			return
+		}
+		resource, err := svc.UploadAnnouncementImage(user, file)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		ok(c, gin.H{"resource": resource})
+	})
+
+	r.DELETE("/admin/announcement-images/:id", func(c *gin.Context) {
+		user, err := currentUser(c, svc)
+		if err != nil {
+			failService(c, err)
+			return
+		}
+		if err := svc.DiscardAnnouncementImage(user, c.Param("id")); err != nil {
+			failService(c, err)
+			return
+		}
+		ok(c, gin.H{"ok": true})
+	})
+
 	r.PATCH("/admin/announcements/:id", func(c *gin.Context) {
 		user, err := currentUser(c, svc)
 		if err != nil {