优化: Keep-Alive/rate-limiter/dead-code清理 + deploy.sh蓝绿自动检测 + 压测文档

src/handlers/auth.rs

@@ -149,7 +149,31 @@ pub async fn refresh_token(
     pool: web::Data<PgPool>,
     req: web::Json<RefreshTokenRequest>,
     app_state: web::Data<AppState>,
+    http_req: HttpRequest,
 ) -> impl Responder {
+    let client_ip = http_req
+        .headers()
+        .get("X-Forwarded-For")
+        .and_then(|v| v.to_str().ok())
+        .map(|s| s.split(',').next().unwrap_or(s).trim().to_string())
+        .or_else(|| {
+            http_req
+                .headers()
+                .get("X-Real-IP")
+                .and_then(|v| v.to_str().ok())
+                .map(|s| s.to_string())
+        })
+        .unwrap_or_else(|| {
+            http_req
+                .peer_addr()
+                .map(|a| a.ip().to_string())
+                .unwrap_or_else(|| "unknown".to_string())
+        });
+    if let Err(e) = LOGIN_RATE_LIMITER.check_rate_limit(&client_ip).await {
+        warn!("refresh_token 请求被限流: client_ip={}", client_ip);
+        return HttpResponse::TooManyRequests().json(ErrorResponse::<()>::error(e.to_string()));
+    }
+
     let refresh_token = &req.refresh_token;
 
     let refresh_token_record = match db::verify_refresh_token(pool.get_ref(), refresh_token).await {
@@ -247,15 +271,13 @@ pub async fn mock_login(
     }
 
     // 如果设置了 MOCK_LOGIN_KEY，验证请求头
-    if let Ok(key) = std::env::var("MOCK_LOGIN_KEY") {
-        if !key.is_empty() {
-            let header_key = req.headers()
-                .get("X-Mock-Key")
-                .and_then(|v| v.to_str().ok())
-                .unwrap_or("");
-            if header_key != key {
-                return HttpResponse::Forbidden().json(ErrorResponse::<()>::error("模拟登录密钥错误"));
-            }
+    if let Ok(key) = std::env::var("MOCK_LOGIN_KEY") && !key.is_empty() {
+        let header_key = req.headers()
+            .get("X-Mock-Key")
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("");
+        if header_key != key {
+            return HttpResponse::Forbidden().json(ErrorResponse::<()>::error("模拟登录密钥错误"));
         }
     }
 
@@ -613,7 +635,7 @@ pub async fn web_login_confirm(
         .await
         {
             Ok(Some((is_member, expires))) => {
-                let active = is_member && expires.map_or(true, |e| e > Utc::now());
+                let active = is_member && expires.is_none_or(|e| e > Utc::now());
                 (active, expires.map(|e| e.to_rfc3339()))
             }
             _ => (false, None),
@@ -745,7 +767,7 @@ pub async fn web_login_auto_confirm(
 
     let (is_active_member, membership_expires_at): (bool, Option<String>) = match paid_info {
         Some((is_member, expires)) => {
-            let active = is_member && expires.map_or(true, |e| e > Utc::now());
+            let active = is_member && expires.is_none_or(|e| e > Utc::now());
             (active, expires.map(|e| e.to_rfc3339()))
         }
         None => (false, None),