feat: add Web UI for notification config (feishu + email)

- New config/notify_store.go: persistent notification config (notify.json)
- New API: GET/PUT /api/notify/config, POST /api/notify/test-feishu, POST /api/notify/test-email
- New Vue page: NotifyConfig.vue with feishu webhook and SMTP settings
- Updated cron/init to read from persistent store instead of env vars
- Password masked as ******** in API responses, preserved on updates

backend/main.go

@@ -21,8 +21,8 @@ import (
 func main() {
 	cfg := config.Load()
 
-	// Initialize certificate store (JSON file persistence)
-	config.InitStore(cfg)
+	// Initialize all stores (certificates + notify config)
+	config.InitAll(cfg)
 
 	// Setup Gin
 	gin.SetMode(gin.ReleaseMode)
@@ -63,6 +63,12 @@ func main() {
 		api.POST("/certificates/:id/renew", certHandler.RenewCertificate)
 		api.GET("/certificates/:id/files", certHandler.GetCertFiles)
 
+		// Notification configuration
+		api.GET("/notify/config", handleGetNotifyConfig)
+		api.PUT("/notify/config", handleUpdateNotifyConfig)
+		api.POST("/notify/test-feishu", handleTestFeishu)
+		api.POST("/notify/test-email", handleTestEmail)
+
 		// Utility
 		api.GET("/renewals/check", certHandler.CheckRenewals)
 		api.GET("/stats", certHandler.Stats)
@@ -108,7 +114,8 @@ func main() {
 
 	// Certificate expiry notification check at 8:00 AM daily
 	c.AddFunc("0 8 * * *", func() {
-		notifyCfg := notify.LoadNotifyConfig()
+		nc := config.NotifyCfg.GetConfig()
+		notifyCfg := notify.ConfigFromStore(nc)
 		if !notifyCfg.IsConfigured() {
 			log.Println("Notification not configured, skipping expiry check notification")
 			return
@@ -119,7 +126,6 @@ func main() {
 	c.Start()
 
 	// Set ACME HTTP-01 challenge port from env (default 8082)
-	// Nginx on port 80 should proxy .well-known/acme-challenge/ to this port
 	acmePort := os.Getenv("ACME_PORT")
 	if acmePort == "" {
 		acmePort = "8082"
@@ -133,7 +139,8 @@ func main() {
 	}
 }
 
-// handleLogin authenticates user and returns JWT token
+// ===================== Login Handler =====================
+
 func handleLogin(c *gin.Context) {
 	var req auth.LoginRequest
 	if err := c.ShouldBindJSON(&req); err != nil {
@@ -159,18 +166,17 @@ func handleLogin(c *gin.Context) {
 	})
 }
 
-// authMiddleware validates JWT token on protected routes
+// ===================== Auth Middleware =====================
+
 func authMiddleware() gin.HandlerFunc {
 	return func(c *gin.Context) {
 		authHeader := c.GetHeader("Authorization")
 		if authHeader == "" {
-			// Also check query param (for websocket / event-stream compatibility)
 			authHeader = c.Query("token")
 			if authHeader == "" {
 				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "未授权，请先登录"})
 				return
 			}
-			// Validate as-is (query param is the raw token)
 			claims, err := auth.ValidateToken(authHeader)
 			if err != nil {
 				c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{"error": "token已过期或无效"})
@@ -181,7 +187,6 @@ func authMiddleware() gin.HandlerFunc {
 			return
 		}
 
-		// Extract Bearer token
 		tokenString := strings.TrimPrefix(authHeader, "Bearer ")
 		if tokenString == authHeader {
 			tokenString = authHeader
@@ -198,11 +203,88 @@ func authMiddleware() gin.HandlerFunc {
 	}
 }
 
-// runExpiryNotification checks all certificates and sends notifications for expiring ones
+// ===================== Notification Config Handlers =====================
+
+func handleGetNotifyConfig(c *gin.Context) {
+	nc := config.NotifyCfg.Get()
+	c.JSON(http.StatusOK, nc)
+}
+
+func handleUpdateNotifyConfig(c *gin.Context) {
+	var req config.NotifyConfig
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	if err := config.NotifyCfg.Update(&req); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "通知配置已更新"})
+}
+
+func handleTestFeishu(c *gin.Context) {
+	nc := config.NotifyCfg.GetConfig()
+	if !nc.FeishuEnabled || nc.FeishuURL == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "飞书通知未配置，请先保存配置"})
+		return
+	}
+
+	notifyCfg := notify.ConfigFromStore(nc)
+	testCerts := []notify.CertInfo{
+		{
+			Domain:   "test.example.com",
+			Status:   "active",
+			DaysLeft: 15,
+		},
+	}
+
+	if err := notifyCfg.NotifyCertExpiring(testCerts); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "飞书测试消息发送失败: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "飞书测试消息发送成功"})
+}
+
+func handleTestEmail(c *gin.Context) {
+	nc := config.NotifyCfg.GetConfig()
+	if !nc.SMTPEnabled || nc.SMTPHost == "" || nc.NotifyTo == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "邮件通知未配置，请先保存配置"})
+		return
+	}
+
+	notifyCfg := notify.ConfigFromStore(nc)
+	testCerts := []notify.CertInfo{
+		{
+			Domain:   "test.example.com",
+			Status:   "active",
+			DaysLeft: 15,
+		},
+	}
+
+	if err := notifyCfg.NotifyCertExpiring(testCerts); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "邮件测试消息发送失败: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"message": "邮件测试消息发送成功"})
+}
+
+// ===================== Expiry Notification =====================
+
 func runExpiryNotification(notifyCfg *notify.Config) {
 	certs := config.Store.GetAll()
 
 	var expiringCerts []notify.CertInfo
+	nc := config.NotifyCfg.GetConfig()
+	expiryDays := nc.ExpiryDays
+	if expiryDays <= 0 {
+		expiryDays = 30
+	}
+
 	for _, cert := range certs {
 		if cert.Status != "active" || cert.ExpiresAt == nil {
 			continue
@@ -210,8 +292,7 @@ func runExpiryNotification(notifyCfg *notify.Config) {
 
 		daysLeft := int(time.Until(*cert.ExpiresAt).Hours() / 24)
 
-		// Notify if within 30 days of expiry (or already expired)
-		if daysLeft <= 30 {
+		if daysLeft <= expiryDays {
 			info := notify.CertInfo{
 				Domain:    cert.Domain,
 				Status:    cert.Status,
@@ -236,12 +317,15 @@ func runExpiryNotification(notifyCfg *notify.Config) {
 }
 
 func init() {
-	// Check if notification is configured and run once at startup
+	// Run startup certificate expiry check after 10 seconds
 	time.AfterFunc(10*time.Second, func() {
-		notifyCfg := notify.LoadNotifyConfig()
-		if notifyCfg.IsConfigured() {
-			log.Println("Running startup certificate expiry check...")
-			runExpiryNotification(notifyCfg)
+		if config.NotifyCfg != nil {
+			nc := config.NotifyCfg.GetConfig()
+			notifyCfg := notify.ConfigFromStore(nc)
+			if notifyCfg.IsConfigured() {
+				log.Println("Running startup certificate expiry check...")
+				runExpiryNotification(notifyCfg)
+			}
 		}
 	})
 
@@ -251,5 +335,5 @@ func init() {
 	if adminUser != "" || adminPass != "" {
 		log.Printf("Admin credentials configured via environment (user: %s)", adminUser)
 	}
-	_ = fmt.Sprintf // import usage, prevent unused import error
+	_ = fmt.Sprintf
 }