feat: rename qiniu to oss, add admin upload proxy with thumbnail, add dev-login

- Rename all QINIU_* config/code/docs to OSS_* to match actual Alibaba Cloud OSS
- Refactor upload module from internal/common/qiniu to internal/common/upload
- Add backend proxy upload endpoint (POST /api/admin/marketing/upload) to avoid CORS
- Auto-generate compressed thumbnail (800px, JPEG 80%) on admin image upload
- Add dev-login endpoint (POST /api/v1/auth/dev-login) for H5 debugging
- Add imageutil package for server-side image resizing

Made-with: Cursor

internal/common/auth/handler/auth_handler.go

@@ -2,6 +2,7 @@ package handler
 
 import (
 	"errors"
+	"log"
 	"net/http"
 
 	"github.com/gin-gonic/gin"
@@ -107,3 +108,43 @@ func (h *AuthHandler) LoginWithWeChat(c *gin.Context) {
 		"mini_program": miniProgramPayload,
 	}))
 }
+
+type devLoginRequest struct {
+	MiniProgramID uint `json:"mini_program_id"`
+}
+
+// DevLogin 仅在非 release 模式下可用，用于 H5 开发调试。
+func (h *AuthHandler) DevLogin(c *gin.Context) {
+	if gin.Mode() == gin.ReleaseMode {
+		c.JSON(http.StatusNotFound, model.Error(http.StatusNotFound, "not found"))
+		return
+	}
+
+	var req devLoginRequest
+	_ = c.ShouldBindJSON(&req)
+	if req.MiniProgramID == 0 {
+		req.MiniProgramID = 3
+	}
+
+	result, err := h.authService.DevLogin(c.Request.Context(), req.MiniProgramID)
+	if err != nil {
+		log.Printf("[dev_login] error: %v", err)
+		c.JSON(http.StatusInternalServerError, model.Error(http.StatusInternalServerError, "dev login failed: "+err.Error()))
+		return
+	}
+
+	c.JSON(http.StatusOK, model.Success(gin.H{
+		"user": gin.H{
+			"id":              result.User.ID,
+			"mini_program_id": result.User.MiniProgramID,
+			"open_id":         result.User.OpenID,
+			"nickname":        result.User.NickName,
+			"avatar_url":      result.User.AvatarURL,
+		},
+		"session_key": result.SessionKey,
+		"mini_program": gin.H{
+			"id":   result.MiniProgram.ID,
+			"name": result.MiniProgram.Name,
+		},
+	}))
+}

internal/common/auth/service/auth_service.go

@@ -147,6 +147,51 @@ func (s *AuthService) LoginWithCode(ctx context.Context, req LoginRequest) (*Log
 	return result, nil
 }
 
+// DevLogin 开发模式专用：创建或查找测试用户，无需微信授权。
+func (s *AuthService) DevLogin(ctx context.Context, miniProgramID uint) (*LoginResult, error) {
+	if miniProgramID == 0 {
+		return nil, ErrMiniProgramRequired
+	}
+
+	miniProgram, err := s.miniProgramSvc.GetByID(ctx, miniProgramID)
+	if err != nil {
+		if errors.Is(err, gorm.ErrRecordNotFound) {
+			return nil, ErrMiniProgramNotFound
+		}
+		return nil, fmt.Errorf("load mini program: %w", err)
+	}
+
+	const devOpenID = "dev_test_user"
+	sessionKey := fmt.Sprintf("dev_session_%d", miniProgramID)
+
+	tx := s.db.WithContext(ctx)
+	var user model.User
+	err = tx.Where("mini_program_id = ? AND open_id = ?", miniProgramID, devOpenID).First(&user).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		user = model.User{
+			MiniProgramID: miniProgramID,
+			OpenID:        devOpenID,
+			NickName:      "开发测试用户",
+			AvatarURL:     defaultAvatarURL,
+			SessionKey:    sessionKey,
+		}
+		if err := tx.Create(&user).Error; err != nil {
+			return nil, fmt.Errorf("create dev user: %w", err)
+		}
+	} else if err != nil {
+		return nil, fmt.Errorf("query dev user: %w", err)
+	} else {
+		tx.Model(&user).Update("session_key", sessionKey)
+		user.SessionKey = sessionKey
+	}
+
+	return &LoginResult{
+		User:        &user,
+		SessionKey:  sessionKey,
+		MiniProgram: miniProgram,
+	}, nil
+}
+
 func (s *AuthService) getSmokeMode(ctx context.Context, uid int) (string, error) {
 	var profile smokemodel.SmokeUserProfile
 	err := s.db.WithContext(ctx).

internal/common/imageutil/resize.go

@@ -0,0 +1,72 @@
+package imageutil
+
+import (
+	"bytes"
+	"fmt"
+	"image"
+	"image/jpeg"
+	"image/png"
+	"io"
+	"strings"
+
+	"golang.org/x/image/draw"
+)
+
+type ResizeOptions struct {
+	MaxWidth int
+	Quality  int // JPEG quality 1-100
+}
+
+func DefaultResizeOptions() ResizeOptions {
+	return ResizeOptions{MaxWidth: 800, Quality: 80}
+}
+
+// GenerateThumbnail reads image data, resizes if wider than MaxWidth, and
+// re-encodes as JPEG. Returns the thumbnail bytes and whether the image
+// was actually resized (false if already small enough but still re-encoded).
+func GenerateThumbnail(data []byte, contentType string, opts ResizeOptions) ([]byte, error) {
+	if opts.MaxWidth <= 0 {
+		opts.MaxWidth = 800
+	}
+	if opts.Quality <= 0 || opts.Quality > 100 {
+		opts.Quality = 80
+	}
+
+	src, err := decodeImage(bytes.NewReader(data), contentType)
+	if err != nil {
+		return nil, fmt.Errorf("decode image: %w", err)
+	}
+
+	bounds := src.Bounds()
+	srcW := bounds.Dx()
+	srcH := bounds.Dy()
+
+	dstW := srcW
+	dstH := srcH
+	if srcW > opts.MaxWidth {
+		dstW = opts.MaxWidth
+		dstH = srcH * opts.MaxWidth / srcW
+	}
+
+	dst := image.NewRGBA(image.Rect(0, 0, dstW, dstH))
+	draw.BiLinear.Scale(dst, dst.Bounds(), src, bounds, draw.Over, nil)
+
+	var buf bytes.Buffer
+	if err := jpeg.Encode(&buf, dst, &jpeg.Options{Quality: opts.Quality}); err != nil {
+		return nil, fmt.Errorf("encode jpeg: %w", err)
+	}
+	return buf.Bytes(), nil
+}
+
+func decodeImage(r io.Reader, contentType string) (image.Image, error) {
+	ct := strings.ToLower(contentType)
+	switch {
+	case strings.Contains(ct, "png"):
+		return png.Decode(r)
+	case strings.Contains(ct, "jpeg"), strings.Contains(ct, "jpg"):
+		return jpeg.Decode(r)
+	default:
+		img, _, err := image.Decode(r)
+		return img, err
+	}
+}

internal/common/upload/handler/upload_handler.go

@@ -18,25 +18,24 @@ import (
 
 	"wx_service/config"
 	oss "wx_service/internal/common/oss"
-	qiniuservice "wx_service/internal/common/qiniu/service"
+	uploadservice "wx_service/internal/common/upload/service"
 	"wx_service/internal/middleware"
 	"wx_service/internal/model"
 )
 
 type UploadHandler struct {
-	qiniuService *qiniuservice.QiniuService
+	uploadService *uploadservice.UploadService
 }
 
-func NewUploadHandler(qiniuService *qiniuservice.QiniuService) *UploadHandler {
-	return &UploadHandler{qiniuService: qiniuService}
+func NewUploadHandler(uploadService *uploadservice.UploadService) *UploadHandler {
+	return &UploadHandler{uploadService: uploadService}
 }
 
-type qiniuTokenRequest struct {
-	// filename 用于保留文件后缀（可选），例如："a.png"、"video.mp4"
+type uploadTokenRequest struct {
 	Filename string `json:"filename"`
 }
 
-type qiniuCallbackPayload struct {
+type callbackPayload struct {
 	Key      string `json:"key"`
 	Hash     string `json:"hash"`
 	Fsize    int64  `json:"fsize"`
@@ -56,15 +55,14 @@ type uploadTokenResponse struct {
 
 var extPattern = regexp.MustCompile(`^\.[a-z0-9]{1,10}$`)
 
-// QiniuToken 返回直传所需的 token/key/upload_url；CDN 为阿里云 OSS 时返回 OSS PostObject 凭证。
-// 建议放在鉴权后：用当前登录用户生成 key，避免前端写入任意路径。
-func (h *UploadHandler) QiniuToken(c *gin.Context) {
+// GetUploadToken 返回直传所需的凭证；CDN 为阿里云 OSS 时返回 OSS PostObject 凭证。
+func (h *UploadHandler) GetUploadToken(c *gin.Context) {
 	user := middleware.MustCurrentUser(c)
 
-	var req qiniuTokenRequest
+	var req uploadTokenRequest
 	_ = c.ShouldBindJSON(&req)
 
-	cfg := config.AppConfig.Qiniu
+	cfg := config.AppConfig.OSS
 	cdnDomain := strings.TrimSpace(cfg.CDNDomain)
 
 	if oss.IsOSSDomain(cdnDomain) && cfg.AccessKey != "" && cfg.SecretKey != "" && cfg.Bucket != "" {
@@ -99,10 +97,10 @@ func (h *UploadHandler) QiniuToken(c *gin.Context) {
 		return
 	}
 
-	token, err := h.qiniuService.CreateUploadToken(user.MiniProgramID, user.ID, req.Filename)
+	token, err := h.uploadService.CreateUploadToken(user.MiniProgramID, user.ID, req.Filename)
 	if err != nil {
-		if errors.Is(err, qiniuservice.ErrQiniuNotConfigured) {
-			c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "未配置七牛上传服务，请联系管理员"))
+		if errors.Is(err, uploadservice.ErrUploadNotConfigured) {
+			c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "未配置上传服务，请联系管理员"))
 			return
 		}
 		c.JSON(http.StatusInternalServerError, model.Error(http.StatusInternalServerError, "获取上传凭证失败，请稍后重试"))
@@ -111,28 +109,25 @@ func (h *UploadHandler) QiniuToken(c *gin.Context) {
 	c.JSON(http.StatusOK, model.Success(token))
 }
 
-// QiniuCallback 处理七牛上传回调（无需登录），通过签名验签确保来源可信。
-// 说明：
-// - 验签失败返回 401（非可信请求，直接拒绝）
-// - 业务处理临时失败返回 503（触发七牛重试）
-func (h *UploadHandler) QiniuCallback(c *gin.Context) {
+// UploadCallback 处理上传回调（无需登录），通过签名验签确保来源可信。
+func (h *UploadHandler) UploadCallback(c *gin.Context) {
 	rawBody, err := io.ReadAll(c.Request.Body)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, model.Error(http.StatusBadRequest, "读取回调内容失败"))
 		return
 	}
 
-	if err := h.qiniuService.VerifyCallbackSignature(c.Request, rawBody); err != nil {
+	if err := h.uploadService.VerifyCallbackSignature(c.Request, rawBody); err != nil {
 		switch {
-		case errors.Is(err, qiniuservice.ErrQiniuNotConfigured):
-			c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "七牛服务未配置"))
+		case errors.Is(err, uploadservice.ErrUploadNotConfigured):
+			c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "上传服务未配置"))
 		default:
 			c.JSON(http.StatusUnauthorized, model.Error(http.StatusUnauthorized, "回调验签失败"))
 		}
 		return
 	}
 
-	payload, err := parseQiniuCallbackPayload(c.ContentType(), rawBody)
+	payload, err := parseCallbackPayload(c.ContentType(), rawBody)
 	if err != nil {
 		c.JSON(http.StatusBadRequest, model.Error(http.StatusBadRequest, "回调内容格式错误"))
 		return
@@ -142,24 +137,23 @@ func (h *UploadHandler) QiniuCallback(c *gin.Context) {
 		return
 	}
 
-	// 当前阶段先记录日志。后续如接入 DB/任务系统，处理失败可保持 503 以触发七牛重试。
-	log.Printf("[qiniu_callback] key=%s hash=%s fsize=%d mimeType=%s", payload.Key, payload.Hash, payload.Fsize, payload.MimeType)
+	log.Printf("[upload_callback] key=%s hash=%s fsize=%d mimeType=%s", payload.Key, payload.Hash, payload.Fsize, payload.MimeType)
 	c.JSON(http.StatusOK, model.Success(gin.H{"ok": true}))
 }
 
-func parseQiniuCallbackPayload(contentType string, raw []byte) (qiniuCallbackPayload, error) {
-	var payload qiniuCallbackPayload
+func parseCallbackPayload(contentType string, raw []byte) (callbackPayload, error) {
+	var payload callbackPayload
 	trimmed := strings.TrimSpace(strings.ToLower(contentType))
 	if strings.Contains(trimmed, "application/json") {
 		if err := json.Unmarshal(raw, &payload); err != nil {
-			return qiniuCallbackPayload{}, err
+			return callbackPayload{}, err
 		}
 		return payload, nil
 	}
 
 	values, err := url.ParseQuery(string(raw))
 	if err != nil {
-		return qiniuCallbackPayload{}, err
+		return callbackPayload{}, err
 	}
 	payload.Key = strings.TrimSpace(values.Get("key"))
 	payload.Hash = strings.TrimSpace(values.Get("hash"))
@@ -167,7 +161,7 @@ func parseQiniuCallbackPayload(contentType string, raw []byte) (qiniuCallbackPay
 	if rawFsize := strings.TrimSpace(values.Get("fsize")); rawFsize != "" {
 		fsize, parseErr := strconv.ParseInt(rawFsize, 10, 64)
 		if parseErr != nil {
-			return qiniuCallbackPayload{}, parseErr
+			return callbackPayload{}, parseErr
 		}
 		payload.Fsize = fsize
 	}

internal/common/upload/handler/upload_handler_test.go

@@ -12,25 +12,25 @@ import (
 	"github.com/gin-gonic/gin"
 
 	"wx_service/config"
-	qiniuservice "wx_service/internal/common/qiniu/service"
+	uploadservice "wx_service/internal/common/upload/service"
 )
 
-func TestQiniuCallbackSuccess(t *testing.T) {
+func TestUploadCallbackSuccess(t *testing.T) {
 	t.Parallel()
 	gin.SetMode(gin.TestMode)
 
-	cfg := config.QiniuConfig{AccessKey: "ak-test", SecretKey: "sk-test"}
-	h := NewUploadHandler(qiniuservice.NewQiniuService(cfg))
+	cfg := config.OSSConfig{AccessKey: "ak-test", SecretKey: "sk-test"}
+	h := NewUploadHandler(uploadservice.NewUploadService(cfg))
 
 	body := "key=uploads/test.png&hash=abc&fsize=12&mimeType=image%2Fpng"
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/common/upload/qiniu/callback", strings.NewReader(body))
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/common/upload/oss/callback", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Authorization", "QBox "+cfg.AccessKey+":"+signQiniu(req.URL.Path+"\n"+body, cfg.SecretKey))
+	req.Header.Set("Authorization", "QBox "+cfg.AccessKey+":"+signCallback(req.URL.Path+"\n"+body, cfg.SecretKey))
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Request = req
 
-	h.QiniuCallback(c)
+	h.UploadCallback(c)
 
 	if w.Code != http.StatusOK {
 		t.Fatalf("status=%d, want=200, body=%s", w.Code, w.Body.String())
@@ -40,63 +40,63 @@ func TestQiniuCallbackSuccess(t *testing.T) {
 	}
 }
 
-func TestQiniuCallbackInvalidSignature(t *testing.T) {
+func TestUploadCallbackInvalidSignature(t *testing.T) {
 	t.Parallel()
 	gin.SetMode(gin.TestMode)
 
-	cfg := config.QiniuConfig{AccessKey: "ak-test", SecretKey: "sk-test"}
-	h := NewUploadHandler(qiniuservice.NewQiniuService(cfg))
+	cfg := config.OSSConfig{AccessKey: "ak-test", SecretKey: "sk-test"}
+	h := NewUploadHandler(uploadservice.NewUploadService(cfg))
 
 	body := "key=uploads/test.png&hash=abc"
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/common/upload/qiniu/callback", strings.NewReader(body))
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/common/upload/oss/callback", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 	req.Header.Set("Authorization", "QBox ak-test:bad-sign")
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Request = req
 
-	h.QiniuCallback(c)
+	h.UploadCallback(c)
 
 	if w.Code != http.StatusUnauthorized {
 		t.Fatalf("status=%d, want=401, body=%s", w.Code, w.Body.String())
 	}
 }
 
-func TestQiniuCallbackMissingKey(t *testing.T) {
+func TestUploadCallbackMissingKey(t *testing.T) {
 	t.Parallel()
 	gin.SetMode(gin.TestMode)
 
-	cfg := config.QiniuConfig{AccessKey: "ak-test", SecretKey: "sk-test"}
-	h := NewUploadHandler(qiniuservice.NewQiniuService(cfg))
+	cfg := config.OSSConfig{AccessKey: "ak-test", SecretKey: "sk-test"}
+	h := NewUploadHandler(uploadservice.NewUploadService(cfg))
 
 	body := "hash=abc&fsize=12"
-	req := httptest.NewRequest(http.MethodPost, "/api/v1/common/upload/qiniu/callback", strings.NewReader(body))
+	req := httptest.NewRequest(http.MethodPost, "/api/v1/common/upload/oss/callback", strings.NewReader(body))
 	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.Header.Set("Authorization", "QBox "+cfg.AccessKey+":"+signQiniu(req.URL.Path+"\n"+body, cfg.SecretKey))
+	req.Header.Set("Authorization", "QBox "+cfg.AccessKey+":"+signCallback(req.URL.Path+"\n"+body, cfg.SecretKey))
 	w := httptest.NewRecorder()
 	c, _ := gin.CreateTestContext(w)
 	c.Request = req
 
-	h.QiniuCallback(c)
+	h.UploadCallback(c)
 
 	if w.Code != http.StatusBadRequest {
 		t.Fatalf("status=%d, want=400, body=%s", w.Code, w.Body.String())
 	}
 }
 
-func TestParseQiniuCallbackPayloadJSON(t *testing.T) {
+func TestParseCallbackPayloadJSON(t *testing.T) {
 	t.Parallel()
 	raw := []byte(`{"key":"uploads/test.png","hash":"abc","fsize":321,"mimeType":"image/png"}`)
-	got, err := parseQiniuCallbackPayload("application/json", raw)
+	got, err := parseCallbackPayload("application/json", raw)
 	if err != nil {
-		t.Fatalf("parseQiniuCallbackPayload: %v", err)
+		t.Fatalf("parseCallbackPayload: %v", err)
 	}
 	if got.Key != "uploads/test.png" || got.Hash != "abc" || got.Fsize != 321 {
 		t.Fatalf("unexpected payload: %+v", got)
 	}
 }
 
-func signQiniu(signing, secret string) string {
+func signCallback(signing, secret string) string {
 	mac := hmac.New(sha1.New, []byte(secret))
 	_, _ = mac.Write([]byte(signing))
 	return base64.URLEncoding.WithPadding(base64.NoPadding).EncodeToString(mac.Sum(nil))

internal/common/upload/service/upload_service.go

@@ -19,20 +19,20 @@ import (
 )
 
 var (
-	ErrQiniuNotConfigured         = errors.New("qiniu is not configured")
-	ErrQiniuCallbackUnauthorized  = errors.New("qiniu callback unauthorized")
-	ErrQiniuCallbackInvalidHeader = errors.New("qiniu callback authorization header is invalid")
+	ErrUploadNotConfigured  = errors.New("oss upload is not configured")
+	ErrCallbackUnauthorized = errors.New("upload callback unauthorized")
+	ErrCallbackInvalidHeader = errors.New("upload callback authorization header is invalid")
 )
 
-type QiniuService struct {
-	cfg config.QiniuConfig
+type UploadService struct {
+	cfg config.OSSConfig
 }
 
-func NewQiniuService(cfg config.QiniuConfig) *QiniuService {
-	return &QiniuService{cfg: cfg}
+func NewUploadService(cfg config.OSSConfig) *UploadService {
+	return &UploadService{cfg: cfg}
 }
 
-type QiniuUploadToken struct {
+type UploadToken struct {
 	Token     string `json:"token"`
 	Key       string `json:"key"`
 	UploadURL string `json:"upload_url"`
@@ -42,9 +42,9 @@ type QiniuUploadToken struct {
 
 var extPattern = regexp.MustCompile(`^\.[a-z0-9]{1,10}$`)
 
-func (s *QiniuService) CreateUploadToken(miniProgramID uint, userID uint, filename string) (QiniuUploadToken, error) {
+func (s *UploadService) CreateUploadToken(miniProgramID uint, userID uint, filename string) (UploadToken, error) {
 	if s.cfg.AccessKey == "" || s.cfg.SecretKey == "" || s.cfg.Bucket == "" {
-		return QiniuUploadToken{}, ErrQiniuNotConfigured
+		return UploadToken{}, ErrUploadNotConfigured
 	}
 
 	expireSeconds := s.cfg.TokenExpireSeconds
@@ -60,11 +60,9 @@ func (s *QiniuService) CreateUploadToken(miniProgramID uint, userID uint, filena
 
 	randomHex, err := randomHex(16)
 	if err != nil {
-		return QiniuUploadToken{}, fmt.Errorf("generate random key: %w", err)
+		return UploadToken{}, fmt.Errorf("generate random key: %w", err)
 	}
 
-	// 统一由后端生成 key，避免前端随意写入任意路径。
-	// 这里按“业务前缀/小程序/用户/日期/随机名”组织，便于后期排查与管理。
 	keyPrefix := strings.Trim(s.cfg.KeyPrefix, "/")
 	key := fmt.Sprintf("%s/mp_%d/user_%d/%s/%s%s",
 		keyPrefix,
@@ -76,10 +74,8 @@ func (s *QiniuService) CreateUploadToken(miniProgramID uint, userID uint, filena
 	)
 
 	putPolicy := map[string]interface{}{
-		// scope = "<bucket>:<key>" 表示只允许写入指定 key（更安全）
-		"scope":    fmt.Sprintf("%s:%s", s.cfg.Bucket, key),
-		"deadline": expireAt,
-		// 上传完成后返回给前端的 JSON（七牛会做变量替换）
+		"scope":      fmt.Sprintf("%s:%s", s.cfg.Bucket, key),
+		"deadline":   expireAt,
 		"returnBody": `{"key":"$(key)","hash":"$(etag)","fsize":$(fsize),"mimeType":"$(mimeType)"}`,
 	}
 	if callbackURL := strings.TrimSpace(s.cfg.CallbackURL); callbackURL != "" {
@@ -98,7 +94,7 @@ func (s *QiniuService) CreateUploadToken(miniProgramID uint, userID uint, filena
 
 	policyJSON, err := json.Marshal(putPolicy)
 	if err != nil {
-		return QiniuUploadToken{}, fmt.Errorf("marshal put policy: %w", err)
+		return UploadToken{}, fmt.Errorf("marshal put policy: %w", err)
 	}
 
 	encodedPolicy := urlSafeBase64NoPad(policyJSON)
@@ -107,7 +103,7 @@ func (s *QiniuService) CreateUploadToken(miniProgramID uint, userID uint, filena
 
 	token := fmt.Sprintf("%s:%s:%s", s.cfg.AccessKey, encodedSign, encodedPolicy)
 
-	return QiniuUploadToken{
+	return UploadToken{
 		Token:     token,
 		Key:       key,
 		UploadURL: s.cfg.UploadURL,
@@ -116,38 +112,37 @@ func (s *QiniuService) CreateUploadToken(miniProgramID uint, userID uint, filena
 	}, nil
 }
 
-func (s *QiniuService) VerifyCallbackSignature(req *http.Request, rawBody []byte) error {
+func (s *UploadService) VerifyCallbackSignature(req *http.Request, rawBody []byte) error {
 	if s.cfg.AccessKey == "" || s.cfg.SecretKey == "" {
-		return ErrQiniuNotConfigured
+		return ErrUploadNotConfigured
 	}
 
 	authHeader := strings.TrimSpace(req.Header.Get("Authorization"))
 	if authHeader == "" {
-		return ErrQiniuCallbackInvalidHeader
+		return ErrCallbackInvalidHeader
 	}
 
 	parts := strings.SplitN(authHeader, " ", 2)
 	if len(parts) != 2 {
-		return ErrQiniuCallbackInvalidHeader
+		return ErrCallbackInvalidHeader
 	}
 	scheme := strings.TrimSpace(parts[0])
 	if !strings.EqualFold(scheme, "QBox") {
-		// 七牛上传回调使用 QBox；其它 scheme 视为非法。
-		return ErrQiniuCallbackInvalidHeader
+		return ErrCallbackInvalidHeader
 	}
 
 	token := strings.TrimSpace(parts[1])
 	tokenParts := strings.SplitN(token, ":", 2)
 	if len(tokenParts) != 2 {
-		return ErrQiniuCallbackInvalidHeader
+		return ErrCallbackInvalidHeader
 	}
 	accessKey := strings.TrimSpace(tokenParts[0])
 	providedSign := strings.TrimSpace(tokenParts[1])
 	if accessKey == "" || providedSign == "" {
-		return ErrQiniuCallbackInvalidHeader
+		return ErrCallbackInvalidHeader
 	}
 	if accessKey != s.cfg.AccessKey {
-		return ErrQiniuCallbackUnauthorized
+		return ErrCallbackUnauthorized
 	}
 
 	signing := req.URL.Path
@@ -159,7 +154,7 @@ func (s *QiniuService) VerifyCallbackSignature(req *http.Request, rawBody []byte
 
 	expected := urlSafeBase64NoPad(hmacSHA1([]byte(s.cfg.SecretKey), []byte(signing)))
 	if !hmac.Equal([]byte(providedSign), []byte(expected)) {
-		return ErrQiniuCallbackUnauthorized
+		return ErrCallbackUnauthorized
 	}
 	return nil
 }

internal/common/upload/service/upload_service_test.go

@@ -13,13 +13,13 @@ import (
 func TestCreateUploadTokenWithCallbackPolicy(t *testing.T) {
 	t.Parallel()
 
-	svc := NewQiniuService(config.QiniuConfig{
+	svc := NewUploadService(config.OSSConfig{
 		AccessKey:        "ak-test",
 		SecretKey:        "sk-test",
 		Bucket:           "bucket-test",
-		UploadURL:        "https://upload.qiniup.com",
+		UploadURL:        "https://bucket.oss-cn-beijing.aliyuncs.com",
 		KeyPrefix:        "uploads/",
-		CallbackURL:      "https://api.example.com/api/v1/common/upload/qiniu/callback",
+		CallbackURL:      "https://api.example.com/api/v1/common/upload/oss/callback",
 		CallbackBody:     "key=$(key)&hash=$(etag)",
 		CallbackBodyType: "application/x-www-form-urlencoded",
 	})
@@ -44,7 +44,7 @@ func TestCreateUploadTokenWithCallbackPolicy(t *testing.T) {
 		t.Fatalf("unmarshal policy: %v", err)
 	}
 
-	if got, _ := policy["callbackUrl"].(string); got != "https://api.example.com/api/v1/common/upload/qiniu/callback" {
+	if got, _ := policy["callbackUrl"].(string); got != "https://api.example.com/api/v1/common/upload/oss/callback" {
 		t.Fatalf("callbackUrl=%q, want callback endpoint", got)
 	}
 	if got, _ := policy["callbackBody"].(string); got != "key=$(key)&hash=$(etag)" {
@@ -58,14 +58,14 @@ func TestCreateUploadTokenWithCallbackPolicy(t *testing.T) {
 func TestVerifyCallbackSignature(t *testing.T) {
 	t.Parallel()
 
-	cfg := config.QiniuConfig{
+	cfg := config.OSSConfig{
 		AccessKey: "ak-test",
 		SecretKey: "sk-test",
 	}
-	svc := NewQiniuService(cfg)
+	svc := NewUploadService(cfg)
 
 	body := []byte("key=uploads/test.png&hash=abc")
-	req := httptest.NewRequest("POST", "http://example.com/api/v1/common/upload/qiniu/callback?x=1", strings.NewReader(string(body)))
+	req := httptest.NewRequest("POST", "http://example.com/api/v1/common/upload/oss/callback?x=1", strings.NewReader(string(body)))
 	signing := req.URL.Path + "?" + req.URL.RawQuery + "\n" + string(body)
 	sign := urlSafeBase64NoPad(hmacSHA1([]byte(cfg.SecretKey), []byte(signing)))
 	req.Header.Set("Authorization", "QBox "+cfg.AccessKey+":"+sign)
@@ -78,21 +78,21 @@ func TestVerifyCallbackSignature(t *testing.T) {
 func TestVerifyCallbackSignatureInvalid(t *testing.T) {
 	t.Parallel()
 
-	cfg := config.QiniuConfig{
+	cfg := config.OSSConfig{
 		AccessKey: "ak-test",
 		SecretKey: "sk-test",
 	}
-	svc := NewQiniuService(cfg)
+	svc := NewUploadService(cfg)
 
 	body := []byte("key=uploads/test.png&hash=abc")
-	req := httptest.NewRequest("POST", "http://example.com/api/v1/common/upload/qiniu/callback", strings.NewReader(string(body)))
+	req := httptest.NewRequest("POST", "http://example.com/api/v1/common/upload/oss/callback", strings.NewReader(string(body)))
 	req.Header.Set("Authorization", "QBox ak-test:bad-sign")
 
 	err := svc.VerifyCallbackSignature(req, body)
 	if err == nil {
 		t.Fatalf("expected signature verification error")
 	}
-	if err != ErrQiniuCallbackUnauthorized {
-		t.Fatalf("error=%v, want=%v", err, ErrQiniuCallbackUnauthorized)
+	if err != ErrCallbackUnauthorized {
+		t.Fatalf("error=%v, want=%v", err, ErrCallbackUnauthorized)
 	}
 }

internal/marketing/handler/download_handler.go

@@ -1,18 +1,31 @@
 package handler
 
 import (
+	"bytes"
 	"errors"
+	"fmt"
+	"io"
+	"log"
+	"mime/multipart"
 	"net/http"
+	"path"
+	"regexp"
+	"strings"
+	"time"
 
 	"github.com/gin-gonic/gin"
 
 	"wx_service/config"
-	qiniuservice "wx_service/internal/common/qiniu/service"
+	"wx_service/internal/common/imageutil"
+	oss "wx_service/internal/common/oss"
+	uploadservice "wx_service/internal/common/upload/service"
 	"wx_service/internal/marketing/service"
 	"wx_service/internal/middleware"
 	"wx_service/internal/model"
 )
 
+var adminExtPattern = regexp.MustCompile(`^\.[a-z0-9]{1,10}$`)
+
 type DownloadHandler struct {
 	svc *service.DownloadService
 }
@@ -93,19 +106,69 @@ func (h *DownloadHandler) AdminStats(c *gin.Context) {
 	c.JSON(http.StatusOK, model.Success(stats))
 }
 
-type adminQiniuTokenRequest struct {
+type adminUploadTokenRequest struct {
 	Filename string `json:"filename"`
 }
 
-func (h *DownloadHandler) AdminQiniuToken(c *gin.Context) {
-	var req adminQiniuTokenRequest
+type adminUploadTokenResponse struct {
+	Token        string `json:"token,omitempty"`
+	Key          string `json:"key"`
+	UploadURL    string `json:"upload_url"`
+	ExpireAt     int64  `json:"expire,omitempty"`
+	CDNDomain    string `json:"cdn_domain,omitempty"`
+	OSSAccessKey string `json:"oss_access_key_id,omitempty"`
+	OSSPolicy    string `json:"oss_policy,omitempty"`
+	OSSSignature string `json:"oss_signature,omitempty"`
+}
+
+func (h *DownloadHandler) AdminUploadToken(c *gin.Context) {
+	var req adminUploadTokenRequest
 	_ = c.ShouldBindJSON(&req)
 
-	qiniuSvc := qiniuservice.NewQiniuService(config.AppConfig.Qiniu)
-	token, err := qiniuSvc.CreateUploadToken(0, 0, req.Filename)
+	cfg := config.AppConfig.OSS
+	if cfg.AccessKey == "" || cfg.SecretKey == "" || cfg.Bucket == "" {
+		c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "未配置上传服务"))
+		return
+	}
+
+	cdnDomain := strings.TrimSpace(cfg.CDNDomain)
+
+	if oss.IsOSSDomain(cdnDomain) {
+		ext := path.Ext(req.Filename)
+		if ext == "" || !adminExtPattern.MatchString(strings.ToLower(ext)) {
+			ext = ".jpg"
+		}
+		keyPrefix := strings.Trim(cfg.KeyPrefix, "/")
+		key := fmt.Sprintf("%s/admin/%s/%x%s",
+			keyPrefix, time.Now().Format("20060102"), time.Now().UnixNano()&0xffffffff, ext)
+		endpoint := oss.ParseOSSEndpoint(cdnDomain)
+		expireSeconds := cfg.TokenExpireSeconds
+		if expireSeconds <= 0 {
+			expireSeconds = 300
+		}
+		policy, signature, err := oss.PostPolicy(cfg.Bucket, endpoint, key, cfg.SecretKey, expireSeconds)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, model.Error(http.StatusInternalServerError, "生成上传凭证失败"))
+			return
+		}
+		uploadURL := oss.UploadHost(cfg.Bucket, endpoint)
+		cdnHost := "https://" + cfg.Bucket + "." + endpoint + ".aliyuncs.com"
+		c.JSON(http.StatusOK, model.Success(adminUploadTokenResponse{
+			Key:          key,
+			UploadURL:    uploadURL,
+			CDNDomain:    cdnHost,
+			OSSAccessKey: cfg.AccessKey,
+			OSSPolicy:    policy,
+			OSSSignature: signature,
+		}))
+		return
+	}
+
+	uploadSvc := uploadservice.NewUploadService(cfg)
+	token, err := uploadSvc.CreateUploadToken(0, 0, req.Filename)
 	if err != nil {
-		if errors.Is(err, qiniuservice.ErrQiniuNotConfigured) {
-			c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "未配置七牛上传服务"))
+		if errors.Is(err, uploadservice.ErrUploadNotConfigured) {
+			c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "未配置上传服务"))
 			return
 		}
 		c.JSON(http.StatusInternalServerError, model.Error(http.StatusInternalServerError, "获取上传凭证失败"))
@@ -114,3 +177,124 @@ func (h *DownloadHandler) AdminQiniuToken(c *gin.Context) {
 
 	c.JSON(http.StatusOK, model.Success(token))
 }
+
+// AdminUploadFile 接收管理后台上传的文件，服务端代理转发到 OSS，
+// 同时自动生成一张压缩缩略图一并上传，减少 CDN 占用。
+func (h *DownloadHandler) AdminUploadFile(c *gin.Context) {
+	file, header, err := c.Request.FormFile("file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, model.Error(http.StatusBadRequest, "请选择要上传的文件"))
+		return
+	}
+	defer file.Close()
+
+	if header.Size > 10*1024*1024 {
+		c.JSON(http.StatusBadRequest, model.Error(http.StatusBadRequest, "文件大小不能超过 10MB"))
+		return
+	}
+
+	cfg := config.AppConfig.OSS
+	if cfg.AccessKey == "" || cfg.SecretKey == "" || cfg.Bucket == "" {
+		c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "未配置上传服务"))
+		return
+	}
+
+	cdnDomain := strings.TrimSpace(cfg.CDNDomain)
+	if !oss.IsOSSDomain(cdnDomain) {
+		c.JSON(http.StatusServiceUnavailable, model.Error(http.StatusServiceUnavailable, "仅支持 OSS 上传"))
+		return
+	}
+
+	fileData, err := io.ReadAll(file)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, model.Error(http.StatusInternalServerError, "读取文件失败"))
+		return
+	}
+
+	ext := strings.ToLower(path.Ext(header.Filename))
+	if ext == "" || !adminExtPattern.MatchString(ext) {
+		ext = ".jpg"
+	}
+	keyPrefix := strings.Trim(cfg.KeyPrefix, "/")
+	ts := fmt.Sprintf("%x", time.Now().UnixNano()&0xffffffff)
+	origKey := fmt.Sprintf("%s/admin/%s/%s%s", keyPrefix, time.Now().Format("20060102"), ts, ext)
+	thumbKey := fmt.Sprintf("%s/admin/%s/%s_thumb.jpg", keyPrefix, time.Now().Format("20060102"), ts)
+
+	endpoint := oss.ParseOSSEndpoint(cdnDomain)
+	cdnHost := "https://" + cfg.Bucket + "." + endpoint + ".aliyuncs.com"
+
+	origURL, err := uploadToOSS(cfg, endpoint, origKey, header.Filename, fileData)
+	if err != nil {
+		log.Printf("[admin_upload] upload original error: %v", err)
+		c.JSON(http.StatusBadGateway, model.Error(http.StatusBadGateway, "上传原图到 OSS 失败"))
+		return
+	}
+
+	thumbURL := ""
+	thumbData, thumbErr := imageutil.GenerateThumbnail(fileData, header.Header.Get("Content-Type"), imageutil.DefaultResizeOptions())
+	if thumbErr != nil {
+		log.Printf("[admin_upload] thumbnail generation skipped: %v", thumbErr)
+	} else {
+		if url, err := uploadToOSS(cfg, endpoint, thumbKey, "thumb.jpg", thumbData); err != nil {
+			log.Printf("[admin_upload] upload thumbnail error: %v", err)
+		} else {
+			thumbURL = url
+		}
+	}
+
+	if origURL == "" {
+		origURL = cdnHost + "/" + origKey
+	}
+
+	result := gin.H{"url": origURL}
+	if thumbURL != "" {
+		result["thumbnail_url"] = thumbURL
+	}
+	c.JSON(http.StatusOK, model.Success(result))
+}
+
+func uploadToOSS(cfg config.OSSConfig, endpoint, key, filename string, data []byte) (string, error) {
+	expireSeconds := cfg.TokenExpireSeconds
+	if expireSeconds <= 0 {
+		expireSeconds = 300
+	}
+	policy, signature, err := oss.PostPolicy(cfg.Bucket, endpoint, key, cfg.SecretKey, expireSeconds)
+	if err != nil {
+		return "", fmt.Errorf("generate policy: %w", err)
+	}
+
+	uploadURL := oss.UploadHost(cfg.Bucket, endpoint)
+	var body bytes.Buffer
+	writer := multipart.NewWriter(&body)
+	writer.WriteField("key", key)
+	writer.WriteField("policy", policy)
+	writer.WriteField("OSSAccessKeyId", cfg.AccessKey)
+	writer.WriteField("Signature", signature)
+	fw, err := writer.CreateFormFile("file", filename)
+	if err != nil {
+		return "", fmt.Errorf("create form file: %w", err)
+	}
+	fw.Write(data)
+	writer.Close()
+
+	req, err := http.NewRequest(http.MethodPost, uploadURL, &body)
+	if err != nil {
+		return "", fmt.Errorf("new request: %w", err)
+	}
+	req.Header.Set("Content-Type", writer.FormDataContentType())
+
+	client := &http.Client{Timeout: 60 * time.Second}
+	resp, err := client.Do(req)
+	if err != nil {
+		return "", fmt.Errorf("do request: %w", err)
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		respBody, _ := io.ReadAll(resp.Body)
+		return "", fmt.Errorf("oss status=%d body=%s", resp.StatusCode, string(respBody))
+	}
+
+	cdnHost := "https://" + cfg.Bucket + "." + endpoint + ".aliyuncs.com"
+	return cdnHost + "/" + key, nil
+}

internal/routes/admin_routes.go

@@ -108,7 +108,8 @@ func registerAdminRoutes(
 					marketing.DELETE("/templates/:id", templateHandler.AdminDelete)
 
 					marketing.GET("/stats", downloadHandler.AdminStats)
-					marketing.POST("/upload/qiniu/token", downloadHandler.AdminQiniuToken)
+					marketing.POST("/upload/oss/token", downloadHandler.AdminUploadToken)
+				marketing.POST("/upload", downloadHandler.AdminUploadFile)
 				}
 			}
 		}

internal/routes/common_routes.go

@@ -3,19 +3,16 @@ package routes
 import (
 	"github.com/gin-gonic/gin"
 
-	qiniuhandler "wx_service/internal/common/qiniu/handler"
+	uploadhandler "wx_service/internal/common/upload/handler"
 )
 
-func registerCommonPublicRoutes(api *gin.RouterGroup, uploadHandler *qiniuhandler.UploadHandler) {
-	// 七牛上传回调：由七牛服务端调用，不能挂登录鉴权。
-	api.POST("/common/upload/qiniu/callback", uploadHandler.QiniuCallback)
+func registerCommonPublicRoutes(api *gin.RouterGroup, uploadHandler *uploadhandler.UploadHandler) {
+	api.POST("/common/upload/oss/callback", uploadHandler.UploadCallback)
 }
 
-func registerCommonRoutes(protected *gin.RouterGroup, uploadHandler *qiniuhandler.UploadHandler) {
-	// 公共接口（所有小程序共用）
+func registerCommonRoutes(protected *gin.RouterGroup, uploadHandler *uploadhandler.UploadHandler) {
 	common := protected.Group("/common")
 	{
-		// 七牛直传凭证：前端先拿 token，再直传文件到七牛 upload_url
-		common.POST("/upload/qiniu/token", uploadHandler.QiniuToken)
+		common.POST("/upload/oss/token", uploadHandler.GetUploadToken)
 	}
 }

internal/routes/marketing_routes.go

@@ -46,6 +46,7 @@ func registerMarketingRoutes(
 		admin.DELETE("/templates/:id", templateHandler.AdminDelete)
 
 		admin.GET("/stats", downloadHandler.AdminStats)
-		admin.POST("/upload/qiniu/token", downloadHandler.AdminQiniuToken)
+		admin.POST("/upload/oss/token", downloadHandler.AdminUploadToken)
+		admin.POST("/upload", downloadHandler.AdminUploadFile)
 	}
 }

internal/routes/routes.go

@@ -8,7 +8,7 @@ import (
 
 	adminhandler "wx_service/internal/admin"
 	authhandler "wx_service/internal/common/auth/handler"
-	qiniuhandler "wx_service/internal/common/qiniu/handler"
+	uploadhandler "wx_service/internal/common/upload/handler"
 	rediscache "wx_service/internal/common/redis/cache"
 	oahandler "wx_service/internal/common/wechat_official/handler"
 	expiryhandler "wx_service/internal/expiry"
@@ -29,7 +29,7 @@ func Register(
 	smokeHandler *smokehandler.SmokeHandler,
 	quitPlanHandler *smokehandler.QuitPlanHandler,
 	redeemCodeHandler *membershiphandler.RedeemCodeHandler,
-	uploadHandler *qiniuhandler.UploadHandler,
+	uploadHandler *uploadhandler.UploadHandler,
 	oaOAuthHandler *oahandler.OAuthHandler,
 	sessionCache *rediscache.SessionUserCache,
 	lawyerHandler *lawyerhandler.LawyerHandler,
@@ -48,6 +48,8 @@ func Register(
 	{
 		// 登录接口：用微信 code 换取/创建用户并返回 session_key（作为后续 Bearer Token）
 		api.POST("/auth/login", authHandler.LoginWithWeChat)
+		// H5 开发调试登录（仅 debug 模式可用）
+		api.POST("/auth/dev-login", authHandler.DevLogin)
 
 		// 公众号网页授权：不需要登录（code 本身来自微信授权回调）
 		registerWeChatOfficialRoutes(api, oaOAuthHandler)