完善论坛配置与发帖体验：TipTap 富文本、图片上传、修订历史、Feed 排序与后台参数管理。

同步更新 README 与 ROADMAP，反映最新功能与开发状态。

Co-authored-by: Cursor <cursoragent@cursor.com>

service/ratelimit.go

@@ -9,39 +9,44 @@ import (
 type RateLimiter struct {
 	mu       sync.Mutex
 	records  map[string][]time.Time
-	limit    int           // 窗口内最大次数
-	window   time.Duration // 时间窗口
+	settings *ForumSettingsService
 }
 
-func NewRateLimiter(limit int, window time.Duration) *RateLimiter {
+func NewRateLimiter(settings *ForumSettingsService) *RateLimiter {
 	r := &RateLimiter{
-		records: make(map[string][]time.Time),
-		limit:   limit,
-		window:  window,
+		records:  make(map[string][]time.Time),
+		settings: settings,
 	}
 	go r.cleanup()
 	return r
 }
 
-// Allow 检查 key（如 userID+action）是否允许操作
-func (r *RateLimiter) Allow(key string) bool {
+// Allow 检查 action+key 是否允许操作
+func (r *RateLimiter) Allow(action, key string) bool {
+	limit := r.settings.RateLimitFor(action)
+	window := time.Duration(r.settings.RateLimitWindowSec()) * time.Second
+	if limit <= 0 {
+		return true
+	}
+	fullKey := action + ":" + key
+
 	r.mu.Lock()
 	defer r.mu.Unlock()
 	now := time.Now()
-	cutoff := now.Add(-r.window)
-	times := r.records[key]
+	cutoff := now.Add(-window)
+	times := r.records[fullKey]
 	var valid []time.Time
 	for _, t := range times {
 		if t.After(cutoff) {
 			valid = append(valid, t)
 		}
 	}
-	if len(valid) >= r.limit {
-		r.records[key] = valid
+	if len(valid) >= limit {
+		r.records[fullKey] = valid
 		return false
 	}
 	valid = append(valid, now)
-	r.records[key] = valid
+	r.records[fullKey] = valid
 	return true
 }
 
@@ -49,8 +54,8 @@ func (r *RateLimiter) cleanup() {
 	ticker := time.NewTicker(5 * time.Minute)
 	for range ticker.C {
 		r.mu.Lock()
-		now := time.Now()
-		cutoff := now.Add(-r.window * 2)
+		window := time.Duration(r.settings.RateLimitWindowSec()) * time.Second
+		cutoff := time.Now().Add(-window * 2)
 		for k, times := range r.records {
 			var valid []time.Time
 			for _, t := range times {