Initial commit: Gitea Project Management System

Features: - Complete project management system with Epic/Story/Task hierarchy - Vue.js 3 + Element Plus frontend with kanban board - Go backend with Gin framework and GORM - OAuth2 integration with Gitea - Docker containerization with MySQL - RESTful API for project, task, and user management - JWT authentication and authorization - Responsive web interface with dashboard
2025-09-22 14:53:53 +08:00
commit 885fad6c64
33 changed files with 4128 additions and 0 deletions
--- a/internal/api/handlers/auth.go
+++ b/internal/api/handlers/auth.go
@@ -0,0 +1,159 @@
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/oauth2"
+)
+
+type GiteaUser struct {
+	ID        int    `json:"id"`
+	Login     string `json:"login"`
+	FullName  string `json:"full_name"`
+	Email     string `json:"email"`
+	AvatarURL string `json:"avatar_url"`
+}
+
+func (h *Handlers) GiteaLogin(c *gin.Context) {
+	config := &oauth2.Config{
+		ClientID:     h.Cfg.Gitea.ClientID,
+		ClientSecret: h.Cfg.Gitea.ClientSecret,
+		RedirectURL:  h.Cfg.Gitea.RedirectURL,
+		Scopes:       []string{"read:user"},
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  h.Cfg.Gitea.BaseURL + "/login/oauth/authorize",
+			TokenURL: h.Cfg.Gitea.BaseURL + "/login/oauth/access_token",
+		},
+	}
+
+	state := "random-state-string"
+	url := config.AuthCodeURL(state, oauth2.AccessTypeOffline)
+	
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{
+		"auth_url": url,
+	}))
+}
+
+func (h *Handlers) GiteaCallback(c *gin.Context) {
+	// 记录所有查询参数用于调试
+	fmt.Printf("OAuth回调收到的所有参数: %v\n", c.Request.URL.Query())
+	
+	code := c.Query("code")
+	state := c.Query("state")
+	errorParam := c.Query("error")
+	
+	fmt.Printf("OAuth回调 - code: %s, state: %s, error: %s\n", code, state, errorParam)
+	
+	if errorParam != "" {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, fmt.Sprintf("OAuth授权失败: %s", errorParam)))
+		return
+	}
+	
+	if code == "" {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "缺少授权码"))
+		return
+	}
+
+	config := &oauth2.Config{
+		ClientID:     h.Cfg.Gitea.ClientID,
+		ClientSecret: h.Cfg.Gitea.ClientSecret,
+		RedirectURL:  h.Cfg.Gitea.RedirectURL,
+		Scopes:       []string{"read:user"},
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  h.Cfg.Gitea.BaseURL + "/login/oauth/authorize",
+			TokenURL: h.Cfg.Gitea.BaseURL + "/login/oauth/access_token",
+		},
+	}
+
+	token, err := config.Exchange(c.Request.Context(), code)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "授权码交换失败"))
+		return
+	}
+
+	client := config.Client(c.Request.Context(), token)
+	resp, err := client.Get(h.Cfg.Gitea.BaseURL + "/api/v1/user")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取用户信息失败"))
+		return
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "读取用户信息失败"))
+		return
+	}
+
+	var giteaUser GiteaUser
+	if err := json.Unmarshal(body, &giteaUser); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "解析用户信息失败"))
+		return
+	}
+
+	user, err := models.GetUserByGiteaID(uint(giteaUser.ID))
+	if err != nil {
+		user = &models.User{
+			GiteaUserID: func() *uint { id := uint(giteaUser.ID); return &id }(),
+			Username:    giteaUser.Login,
+			Email:       giteaUser.Email,
+			FullName:    giteaUser.FullName,
+			AvatarURL:   giteaUser.AvatarURL,
+			Role:        "developer",
+		}
+		if err := models.CreateUser(user); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse(500, "创建用户失败"))
+			return
+		}
+	} else {
+		user.Username = giteaUser.Login
+		user.Email = giteaUser.Email
+		user.FullName = giteaUser.FullName
+		user.AvatarURL = giteaUser.AvatarURL
+		if err := models.UpdateUser(user); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新用户失败"))
+			return
+		}
+	}
+
+	jwtToken, err := h.generateJWT(user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "生成JWT失败"))
+		return
+	}
+
+	// 重定向到前端页面，并通过URL参数传递token
+	redirectURL := fmt.Sprintf("/?token=%s", jwtToken)
+	c.Redirect(http.StatusFound, redirectURL)
+}
+
+func (h *Handlers) Logout(c *gin.Context) {
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{
+		"message": "登出成功",
+	}))
+}
+
+func (h *Handlers) generateJWT(user *models.User) (string, error) {
+	claims := &middleware.Claims{
+		UserID:   user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(h.Cfg.JWT.ExpireHour) * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			Subject:   fmt.Sprintf("%d", user.ID),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(h.Cfg.JWT.Secret))
+}
--- a/internal/api/handlers/comments.go
+++ b/internal/api/handlers/comments.go
@@ -0,0 +1,40 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) GetComments(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) CreateComment(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) UpdateComment(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteComment(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) ListTags(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) CreateTag(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) UpdateTag(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteTag(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
--- a/internal/api/handlers/epics.go
+++ b/internal/api/handlers/epics.go
@@ -0,0 +1,59 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListEpics(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+
+	epics, total, err := models.ListEpics(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取Epic列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(epics, total, page, limit))
+}
+
+func (h *Handlers) CreateEpic(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetEpic(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的Epic ID"))
+		return
+	}
+
+	epic, err := models.GetEpicByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "Epic不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(epic))
+}
+
+func (h *Handlers) UpdateEpic(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteEpic(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
--- a/internal/api/handlers/handlers.go
+++ b/internal/api/handlers/handlers.go
@@ -0,0 +1,60 @@
+package handlers
+
+import (
+	"giteapm/config"
+
+	"gorm.io/gorm"
+)
+
+type Handlers struct {
+	DB  *gorm.DB
+	Cfg *config.Config
+}
+
+func NewHandlers(db *gorm.DB, cfg *config.Config) *Handlers {
+	return &Handlers{
+		DB:  db,
+		Cfg: cfg,
+	}
+}
+
+type Response struct {
+	Code    int         `json:"code"`
+	Message string      `json:"message"`
+	Data    interface{} `json:"data,omitempty"`
+}
+
+type PaginatedResponse struct {
+	Code    int         `json:"code"`
+	Message string      `json:"message"`
+	Data    interface{} `json:"data"`
+	Total   int64       `json:"total"`
+	Page    int         `json:"page"`
+	Limit   int         `json:"limit"`
+}
+
+func SuccessResponse(data interface{}) Response {
+	return Response{
+		Code:    200,
+		Message: "success",
+		Data:    data,
+	}
+}
+
+func ErrorResponse(code int, message string) Response {
+	return Response{
+		Code:    code,
+		Message: message,
+	}
+}
+
+func PaginatedSuccessResponse(data interface{}, total int64, page, limit int) PaginatedResponse {
+	return PaginatedResponse{
+		Code:    200,
+		Message: "success",
+		Data:    data,
+		Total:   total,
+		Page:    page,
+		Limit:   limit,
+	}
+}
--- a/internal/api/handlers/projects.go
+++ b/internal/api/handlers/projects.go
@@ -0,0 +1,244 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type CreateProjectRequest struct {
+	Name        string     `json:"name" binding:"required"`
+	Description string     `json:"description"`
+	GiteaOrg    string     `json:"gitea_org"`
+	Priority    string     `json:"priority"`
+	StartDate   *time.Time `json:"start_date"`
+	EndDate     *time.Time `json:"end_date"`
+}
+
+type AddMemberRequest struct {
+	UserID uint   `json:"user_id" binding:"required"`
+	Role   string `json:"role" binding:"required"`
+}
+
+func (h *Handlers) ListProjects(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if status := c.Query("status"); status != "" {
+		filters["status"] = status
+	}
+	if priority := c.Query("priority"); priority != "" {
+		filters["priority"] = priority
+	}
+
+	currentUser, _ := middleware.GetCurrentUser(c)
+	if currentUser.Role != "admin" {
+		projects, err := models.GetProjectsByUser(currentUser.ID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取项目列表失败"))
+			return
+		}
+		c.JSON(http.StatusOK, SuccessResponse(projects))
+		return
+	}
+
+	projects, total, err := models.ListProjects(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取项目列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(projects, total, page, limit))
+}
+
+func (h *Handlers) CreateProject(c *gin.Context) {
+	var req CreateProjectRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	currentUser, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	project := &models.Project{
+		Name:        req.Name,
+		Description: req.Description,
+		GiteaOrg:    req.GiteaOrg,
+		Status:      "planning",
+		Priority:    req.Priority,
+		StartDate:   req.StartDate,
+		EndDate:     req.EndDate,
+		OwnerID:     currentUser.ID,
+	}
+
+	if project.Priority == "" {
+		project.Priority = "medium"
+	}
+
+	if err := models.CreateProject(project); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "创建项目失败"))
+		return
+	}
+
+	project.AddMember(currentUser.ID, "owner")
+
+	c.JSON(http.StatusCreated, SuccessResponse(project))
+}
+
+func (h *Handlers) GetProject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(project))
+}
+
+func (h *Handlers) UpdateProject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if name, ok := updateData["name"].(string); ok {
+		project.Name = name
+	}
+	if description, ok := updateData["description"].(string); ok {
+		project.Description = description
+	}
+	if status, ok := updateData["status"].(string); ok {
+		project.Status = status
+	}
+	if priority, ok := updateData["priority"].(string); ok {
+		project.Priority = priority
+	}
+
+	if err := models.UpdateProject(project); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新项目失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(project))
+}
+
+func (h *Handlers) DeleteProject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	if err := models.DeleteProject(uint(id)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "删除项目失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "删除成功"}))
+}
+
+func (h *Handlers) AddProjectMember(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	var req AddMemberRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	if err := project.AddMember(req.UserID, req.Role); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "添加成员失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "添加成员成功"}))
+}
+
+func (h *Handlers) RemoveProjectMember(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	userID, err := strconv.ParseUint(c.Param("user_id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	if err := project.RemoveMember(uint(userID)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "移除成员失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "移除成员成功"}))
+}
+
+func (h *Handlers) GetProjectMembers(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	members, err := project.GetMembers()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取成员列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(members))
+}
--- a/internal/api/handlers/sprints.go
+++ b/internal/api/handlers/sprints.go
@@ -0,0 +1,81 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListSprints(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+
+	sprints, total, err := models.ListSprints(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取迭代列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(sprints, total, page, limit))
+}
+
+func (h *Handlers) CreateSprint(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetSprint(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的迭代ID"))
+		return
+	}
+
+	sprint, err := models.GetSprintByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "迭代不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(sprint))
+}
+
+func (h *Handlers) UpdateSprint(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteSprint(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetSprintBurndown(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的迭代ID"))
+		return
+	}
+
+	sprint, err := models.GetSprintByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "迭代不存在"))
+		return
+	}
+
+	burndownData, err := sprint.GetBurndownData()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取燃尽图数据失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(burndownData))
+}
--- a/internal/api/handlers/stories.go
+++ b/internal/api/handlers/stories.go
@@ -0,0 +1,64 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListStories(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+	if epicID := c.Query("epic_id"); epicID != "" {
+		if id, err := strconv.ParseUint(epicID, 10, 32); err == nil {
+			filters["epic_id"] = uint(id)
+		}
+	}
+
+	stories, total, err := models.ListStories(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取Story列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(stories, total, page, limit))
+}
+
+func (h *Handlers) CreateStory(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetStory(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的Story ID"))
+		return
+	}
+
+	story, err := models.GetStoryByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "Story不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(story))
+}
+
+func (h *Handlers) UpdateStory(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteStory(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
--- a/internal/api/handlers/tasks.go
+++ b/internal/api/handlers/tasks.go
@@ -0,0 +1,291 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type CreateTaskRequest struct {
+	StoryID        *uint      `json:"story_id"`
+	ProjectID      uint       `json:"project_id" binding:"required"`
+	Title          string     `json:"title" binding:"required"`
+	Description    string     `json:"description"`
+	Priority       string     `json:"priority"`
+	TaskType       string     `json:"task_type"`
+	AssigneeID     *uint      `json:"assignee_id"`
+	EstimatedHours *float64   `json:"estimated_hours"`
+	DueDate        *time.Time `json:"due_date"`
+}
+
+type LogTimeRequest struct {
+	Hours       float64   `json:"hours" binding:"required"`
+	Description string    `json:"description"`
+	LogDate     time.Time `json:"log_date" binding:"required"`
+}
+
+type LinkGiteaObjectRequest struct {
+	RepoID       uint   `json:"repo_id" binding:"required"`
+	RepoName     string `json:"repo_name" binding:"required"`
+	RelationType string `json:"relation_type" binding:"required"`
+	ObjectID     string `json:"object_id" binding:"required"`
+	ObjectNumber *uint  `json:"object_number"`
+	Title        string `json:"title"`
+	URL          string `json:"url"`
+}
+
+func (h *Handlers) ListTasks(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+	if storyID := c.Query("story_id"); storyID != "" {
+		if id, err := strconv.ParseUint(storyID, 10, 32); err == nil {
+			filters["story_id"] = uint(id)
+		}
+	}
+	if status := c.Query("status"); status != "" {
+		filters["status"] = status
+	}
+	if assigneeID := c.Query("assignee_id"); assigneeID != "" {
+		if id, err := strconv.ParseUint(assigneeID, 10, 32); err == nil {
+			filters["assignee_id"] = uint(id)
+		}
+	}
+
+	tasks, total, err := models.ListTasks(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取任务列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(tasks, total, page, limit))
+}
+
+func (h *Handlers) CreateTask(c *gin.Context) {
+	var req CreateTaskRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	currentUser, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	task := &models.Task{
+		StoryID:        req.StoryID,
+		ProjectID:      req.ProjectID,
+		Title:          req.Title,
+		Description:    req.Description,
+		Status:         "todo",
+		Priority:       req.Priority,
+		TaskType:       req.TaskType,
+		AssigneeID:     req.AssigneeID,
+		ReporterID:     currentUser.ID,
+		EstimatedHours: req.EstimatedHours,
+		DueDate:        req.DueDate,
+	}
+
+	if task.Priority == "" {
+		task.Priority = "medium"
+	}
+	if task.TaskType == "" {
+		task.TaskType = "feature"
+	}
+
+	if err := models.CreateTask(task); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "创建任务失败"))
+		return
+	}
+
+	c.JSON(http.StatusCreated, SuccessResponse(task))
+}
+
+func (h *Handlers) GetTask(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(task))
+}
+
+func (h *Handlers) UpdateTask(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if title, ok := updateData["title"].(string); ok {
+		task.Title = title
+	}
+	if description, ok := updateData["description"].(string); ok {
+		task.Description = description
+	}
+	if status, ok := updateData["status"].(string); ok {
+		task.Status = status
+	}
+	if priority, ok := updateData["priority"].(string); ok {
+		task.Priority = priority
+	}
+	if assigneeID, ok := updateData["assignee_id"].(float64); ok {
+		id := uint(assigneeID)
+		task.AssigneeID = &id
+	}
+
+	if err := models.UpdateTask(task); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新任务失败"))
+		return
+	}
+
+	if task.StoryID != nil {
+		story, err := models.GetStoryByID(*task.StoryID)
+		if err == nil {
+			story.UpdateProgress()
+		}
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(task))
+}
+
+func (h *Handlers) DeleteTask(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	if err := models.DeleteTask(uint(id)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "删除任务失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "删除成功"}))
+}
+
+func (h *Handlers) LogTime(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	var req LogTimeRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	currentUser, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	if err := task.LogTime(currentUser.ID, req.Hours, req.Description, req.LogDate); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "记录工时失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "工时记录成功"}))
+}
+
+func (h *Handlers) GetTimeLogs(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	timeLogs, err := models.GetTimeLogsByTask(uint(id))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取工时记录失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(timeLogs))
+}
+
+func (h *Handlers) LinkGiteaObject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	var req LinkGiteaObjectRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	if err := task.LinkGiteaObject(req.RepoID, req.RepoName, req.RelationType, 
+		req.ObjectID, req.ObjectNumber, req.Title, req.URL); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "关联Gitea对象失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "关联成功"}))
+}
+
+func (h *Handlers) GetGiteaRelations(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	relations, err := models.GetGiteaRelationsByTask(uint(id))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取Gitea关联失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(relations))
+}
--- a/internal/api/handlers/users.go
+++ b/internal/api/handlers/users.go
@@ -0,0 +1,131 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListUsers(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	users, total, err := models.ListUsers(offset, limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取用户列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(users, total, page, limit))
+}
+
+func (h *Handlers) GetUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	user, err := models.GetUserByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "用户不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}
+
+func (h *Handlers) UpdateUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	user, err := models.GetUserByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "用户不存在"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if fullName, ok := updateData["full_name"].(string); ok {
+		user.FullName = fullName
+	}
+	if email, ok := updateData["email"].(string); ok {
+		user.Email = email
+	}
+	if role, ok := updateData["role"].(string); ok {
+		user.Role = role
+	}
+
+	if err := models.UpdateUser(user); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}
+
+func (h *Handlers) DeleteUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	if err := models.DeleteUser(uint(id)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "删除用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "删除成功"}))
+}
+
+func (h *Handlers) GetCurrentUser(c *gin.Context) {
+	user, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}
+
+func (h *Handlers) UpdateCurrentUser(c *gin.Context) {
+	user, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if fullName, ok := updateData["full_name"].(string); ok {
+		user.FullName = fullName
+	}
+	if email, ok := updateData["email"].(string); ok {
+		user.Email = email
+	}
+
+	if err := models.UpdateUser(user); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}
--- a/internal/api/handlers/webhook.go
+++ b/internal/api/handlers/webhook.go
@@ -0,0 +1,218 @@
+package handlers
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type GiteaWebhookPayload struct {
+	Action     string `json:"action"`
+	Number     int    `json:"number"`
+	Repository struct {
+		ID       int    `json:"id"`
+		Name     string `json:"name"`
+		FullName string `json:"full_name"`
+	} `json:"repository"`
+	PullRequest *struct {
+		ID     int    `json:"id"`
+		Number int    `json:"number"`
+		Title  string `json:"title"`
+		State  string `json:"state"`
+		HTMLURL string `json:"html_url"`
+	} `json:"pull_request,omitempty"`
+	Commits []struct {
+		ID      string `json:"id"`
+		Message string `json:"message"`
+		URL     string `json:"url"`
+	} `json:"commits,omitempty"`
+	Pusher struct {
+		ID       int    `json:"id"`
+		Username string `json:"username"`
+	} `json:"pusher,omitempty"`
+}
+
+func (h *Handlers) HandleGiteaWebhook(c *gin.Context) {
+	// 验证 webhook 签名
+	if !h.verifyWebhookSignature(c) {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "Invalid webhook signature"))
+		return
+	}
+
+	// 读取请求体
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "Failed to read request body"))
+		return
+	}
+
+	// 解析 payload
+	var payload GiteaWebhookPayload
+	if err := json.Unmarshal(body, &payload); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "Invalid JSON payload"))
+		return
+	}
+
+	// 获取事件类型
+	eventType := c.GetHeader("X-Gitea-Event")
+	
+	// 处理不同类型的事件
+	switch eventType {
+	case "push":
+		h.handlePushEvent(payload)
+	case "pull_request":
+		h.handlePullRequestEvent(payload)
+	case "issues":
+		h.handleIssueEvent(payload)
+	default:
+		// 忽略其他事件类型
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "Webhook processed successfully"}))
+}
+
+func (h *Handlers) verifyWebhookSignature(c *gin.Context) bool {
+	signature := c.GetHeader("X-Gitea-Signature")
+	if signature == "" {
+		return false
+	}
+
+	// 读取请求体
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		return false
+	}
+
+	// 重新设置请求体，以便后续读取
+	c.Request.Body = io.NopCloser(strings.NewReader(string(body)))
+
+	// 计算 HMAC-SHA256
+	mac := hmac.New(sha256.New, []byte(h.Cfg.Gitea.WebhookSecret))
+	mac.Write(body)
+	expectedSignature := hex.EncodeToString(mac.Sum(nil))
+
+	// 比较签名
+	return hmac.Equal([]byte(signature), []byte(expectedSignature))
+}
+
+func (h *Handlers) handlePushEvent(payload GiteaWebhookPayload) {
+	// 处理推送事件
+	repoID := uint(payload.Repository.ID)
+	
+	for _, commit := range payload.Commits {
+		// 查找关联的任务
+		_, err := models.GetGiteaRelationsByRepo(repoID, "commit")
+		if err != nil {
+			continue
+		}
+
+		// 检查提交消息中是否包含任务引用（如 #123）
+		commitMessage := commit.Message
+		taskNumbers := extractTaskNumbers(commitMessage)
+
+		for _, taskNumber := range taskNumbers {
+			// 创建或更新 Git 关联
+			relation := &models.GiteaRelation{
+				GiteaRepoID:       repoID,
+				GiteaRepoName:     payload.Repository.FullName,
+				RelationType:      "commit",
+				GiteaObjectID:     commit.ID,
+				GiteaObjectTitle:  commitMessage,
+				GiteaObjectURL:    commit.URL,
+			}
+
+			// 根据任务号查找任务
+			if task := findTaskByNumber(taskNumber); task != nil {
+				relation.TaskID = task.ID
+				models.CreateGiteaRelation(relation)
+
+				// 可以根据提交消息自动更新任务状态
+				if strings.Contains(strings.ToLower(commitMessage), "fix") ||
+				   strings.Contains(strings.ToLower(commitMessage), "resolve") {
+					task.Status = "review"
+					models.UpdateTask(task)
+				}
+			}
+		}
+	}
+}
+
+func (h *Handlers) handlePullRequestEvent(payload GiteaWebhookPayload) {
+	if payload.PullRequest == nil {
+		return
+	}
+
+	pr := payload.PullRequest
+	repoID := uint(payload.Repository.ID)
+
+	// 检查 PR 标题中的任务引用
+	taskNumbers := extractTaskNumbers(pr.Title)
+
+	for _, taskNumber := range taskNumbers {
+		if task := findTaskByNumber(taskNumber); task != nil {
+			relation := &models.GiteaRelation{
+				TaskID:            task.ID,
+				GiteaRepoID:       repoID,
+				GiteaRepoName:     payload.Repository.FullName,
+				RelationType:      "pull_request",
+				GiteaObjectID:     strconv.Itoa(pr.ID),
+				GiteaObjectNumber: func() *uint { n := uint(pr.Number); return &n }(),
+				GiteaObjectTitle:  pr.Title,
+				GiteaObjectURL:    pr.HTMLURL,
+			}
+
+			models.CreateGiteaRelation(relation)
+
+			// 根据 PR 状态自动更新任务状态
+			switch payload.Action {
+			case "opened":
+				task.Status = "review"
+			case "closed":
+				if pr.State == "merged" {
+					task.Status = "done"
+				}
+			}
+			models.UpdateTask(task)
+		}
+	}
+}
+
+func (h *Handlers) handleIssueEvent(payload GiteaWebhookPayload) {
+	// 处理 Issue 事件，可以将 Gitea Issue 同步为任务
+	// 这里可以根据需要实现
+}
+
+// 从文本中提取任务编号（如 #123, fixes #456）
+func extractTaskNumbers(text string) []int {
+	var numbers []int
+	// 简单的正则匹配，实际可以使用更复杂的逻辑
+	words := strings.Fields(text)
+	for _, word := range words {
+		if strings.HasPrefix(word, "#") {
+			if num, err := strconv.Atoi(strings.TrimPrefix(word, "#")); err == nil {
+				numbers = append(numbers, num)
+			}
+		}
+	}
+	return numbers
+}
+
+// 根据任务编号查找任务（这里简化实现）
+func findTaskByNumber(taskNumber int) *models.Task {
+	// 这里应该实现根据任务编号查找任务的逻辑
+	// 可以在数据库中添加 task_number 字段，或者使用 ID
+	task, err := models.GetTaskByID(uint(taskNumber))
+	if err != nil {
+		return nil
+	}
+	return task
+}
--- a/internal/api/router.go
+++ b/internal/api/router.go
@@ -0,0 +1,112 @@
+package api
+
+import (
+	"giteapm/config"
+	"giteapm/internal/api/handlers"
+	"giteapm/internal/middleware"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/gorm"
+)
+
+func SetupRoutes(router *gin.Engine, db *gorm.DB, cfg *config.Config) {
+	h := handlers.NewHandlers(db, cfg)
+
+	v1 := router.Group("/api/v1")
+	{
+		auth := v1.Group("/auth")
+		{
+			auth.GET("/login", h.GiteaLogin)
+			auth.GET("/callback", h.GiteaCallback)
+			auth.POST("/logout", h.Logout)
+		}
+
+		v1.Use(middleware.AuthMiddleware(cfg))
+		{
+			users := v1.Group("/users")
+			{
+				users.GET("", h.ListUsers)
+				users.GET("/:id", h.GetUser)
+				users.PUT("/:id", h.UpdateUser)
+				users.DELETE("/:id", middleware.RequireRole("admin"), h.DeleteUser)
+				users.GET("/me", h.GetCurrentUser)
+				users.PUT("/me", h.UpdateCurrentUser)
+			}
+
+			projects := v1.Group("/projects")
+			{
+				projects.GET("", h.ListProjects)
+				projects.POST("", h.CreateProject)
+				projects.GET("/:id", h.GetProject)
+				projects.PUT("/:id", h.UpdateProject)
+				projects.DELETE("/:id", h.DeleteProject)
+				projects.POST("/:id/members", h.AddProjectMember)
+				projects.DELETE("/:id/members/:user_id", h.RemoveProjectMember)
+				projects.GET("/:id/members", h.GetProjectMembers)
+			}
+
+			epics := v1.Group("/epics")
+			{
+				epics.GET("", h.ListEpics)
+				epics.POST("", h.CreateEpic)
+				epics.GET("/:id", h.GetEpic)
+				epics.PUT("/:id", h.UpdateEpic)
+				epics.DELETE("/:id", h.DeleteEpic)
+			}
+
+			stories := v1.Group("/stories")
+			{
+				stories.GET("", h.ListStories)
+				stories.POST("", h.CreateStory)
+				stories.GET("/:id", h.GetStory)
+				stories.PUT("/:id", h.UpdateStory)
+				stories.DELETE("/:id", h.DeleteStory)
+			}
+
+			tasks := v1.Group("/tasks")
+			{
+				tasks.GET("", h.ListTasks)
+				tasks.POST("", h.CreateTask)
+				tasks.GET("/:id", h.GetTask)
+				tasks.PUT("/:id", h.UpdateTask)
+				tasks.DELETE("/:id", h.DeleteTask)
+				tasks.POST("/:id/time-logs", h.LogTime)
+				tasks.GET("/:id/time-logs", h.GetTimeLogs)
+				tasks.POST("/:id/gitea-relations", h.LinkGiteaObject)
+				tasks.GET("/:id/gitea-relations", h.GetGiteaRelations)
+			}
+
+			sprints := v1.Group("/sprints")
+			{
+				sprints.GET("", h.ListSprints)
+				sprints.POST("", h.CreateSprint)
+				sprints.GET("/:id", h.GetSprint)
+				sprints.PUT("/:id", h.UpdateSprint)
+				sprints.DELETE("/:id", h.DeleteSprint)
+				sprints.GET("/:id/burndown", h.GetSprintBurndown)
+			}
+
+			comments := v1.Group("/comments")
+			{
+				comments.GET("", h.GetComments)
+				comments.POST("", h.CreateComment)
+				comments.PUT("/:id", h.UpdateComment)
+				comments.DELETE("/:id", h.DeleteComment)
+			}
+
+			tags := v1.Group("/tags")
+			{
+				tags.GET("", h.ListTags)
+				tags.POST("", h.CreateTag)
+				tags.PUT("/:id", h.UpdateTag)
+				tags.DELETE("/:id", h.DeleteTag)
+			}
+
+			webhooks := v1.Group("/webhooks")
+			{
+				webhooks.POST("/gitea", h.HandleGiteaWebhook)
+			}
+		}
+	}
+
+}
--- a/internal/middleware/auth.go
+++ b/internal/middleware/auth.go
@@ -0,0 +1,93 @@
+package middleware
+
+import (
+	"net/http"
+	"strings"
+
+	"giteapm/config"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+)
+
+type Claims struct {
+	UserID   uint   `json:"user_id"`
+	Username string `json:"username"`
+	Role     string `json:"role"`
+	jwt.RegisteredClaims
+}
+
+func AuthMiddleware(cfg *config.Config) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		tokenString := c.GetHeader("Authorization")
+		if tokenString == "" {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "缺少授权令牌"})
+			c.Abort()
+			return
+		}
+
+		if strings.HasPrefix(tokenString, "Bearer ") {
+			tokenString = tokenString[7:]
+		}
+
+		token, err := jwt.ParseWithClaims(tokenString, &Claims{}, func(token *jwt.Token) (interface{}, error) {
+			return []byte(cfg.JWT.Secret), nil
+		})
+
+		if err != nil || !token.Valid {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "无效的授权令牌"})
+			c.Abort()
+			return
+		}
+
+		claims, ok := token.Claims.(*Claims)
+		if !ok {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "无效的令牌格式"})
+			c.Abort()
+			return
+		}
+
+		user, err := models.GetUserByID(claims.UserID)
+		if err != nil {
+			c.JSON(http.StatusUnauthorized, gin.H{"error": "用户不存在"})
+			c.Abort()
+			return
+		}
+
+		c.Set("user", user)
+		c.Set("user_id", claims.UserID)
+		c.Set("username", claims.Username)
+		c.Set("role", claims.Role)
+		c.Next()
+	}
+}
+
+func RequireRole(roles ...string) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		userRole, exists := c.Get("role")
+		if !exists {
+			c.JSON(http.StatusForbidden, gin.H{"error": "无法获取用户角色"})
+			c.Abort()
+			return
+		}
+
+		for _, role := range roles {
+			if userRole == role {
+				c.Next()
+				return
+			}
+		}
+
+		c.JSON(http.StatusForbidden, gin.H{"error": "权限不足"})
+		c.Abort()
+	}
+}
+
+func GetCurrentUser(c *gin.Context) (*models.User, error) {
+	user, exists := c.Get("user")
+	if !exists {
+		return nil, jwt.ErrTokenMalformed
+	}
+	return user.(*models.User), nil
+}
--- a/internal/models/common.go
+++ b/internal/models/common.go
@@ -0,0 +1,152 @@
+package models
+
+import (
+	"time"
+)
+
+type Comment struct {
+	ID         uint      `json:"id" gorm:"primaryKey"`
+	EntityType string    `json:"entity_type" gorm:"type:varchar(50)"`
+	EntityID   uint      `json:"entity_id"`
+	UserID     uint      `json:"user_id"`
+	Content    string    `json:"content"`
+	User       User      `json:"user" gorm:"foreignKey:UserID"`
+	CreatedAt  time.Time `json:"created_at"`
+	UpdatedAt  time.Time `json:"updated_at"`
+}
+
+type EntityType string
+
+const (
+	EntityTypeProject EntityType = "project"
+	EntityTypeEpic    EntityType = "epic"
+	EntityTypeStory   EntityType = "story"
+	EntityTypeTask    EntityType = "task"
+)
+
+type Tag struct {
+	ID        uint      `json:"id" gorm:"primaryKey"`
+	Name      string    `json:"name" gorm:"unique;not null"`
+	Color     string    `json:"color" gorm:"default:'#1890ff'"`
+	CreatedAt time.Time `json:"created_at"`
+}
+
+type EntityTag struct {
+	ID         uint       `json:"id" gorm:"primaryKey"`
+	EntityType EntityType `json:"entity_type" gorm:"type:varchar(50)"`
+	EntityID   uint       `json:"entity_id"`
+	TagID      uint       `json:"tag_id"`
+	Tag        Tag        `json:"tag" gorm:"foreignKey:TagID"`
+	CreatedAt  time.Time  `json:"created_at"`
+}
+
+type TimeLog struct {
+	ID          uint      `json:"id" gorm:"primaryKey"`
+	TaskID      uint      `json:"task_id"`
+	UserID      uint      `json:"user_id"`
+	Hours       float64   `json:"hours"`
+	Description string    `json:"description"`
+	LogDate     time.Time `json:"log_date"`
+	Task        Task      `json:"task" gorm:"foreignKey:TaskID"`
+	User        User      `json:"user" gorm:"foreignKey:UserID"`
+	CreatedAt   time.Time `json:"created_at"`
+}
+
+func CreateComment(comment *Comment) error {
+	return DB.Create(comment).Error
+}
+
+func GetCommentsByEntity(entityType string, entityID uint) ([]Comment, error) {
+	var comments []Comment
+	err := DB.Where("entity_type = ? AND entity_id = ?", entityType, entityID).
+		Preload("User").
+		Order("created_at DESC").
+		Find(&comments).Error
+	return comments, err
+}
+
+func UpdateComment(comment *Comment) error {
+	return DB.Save(comment).Error
+}
+
+func DeleteComment(id uint) error {
+	return DB.Delete(&Comment{}, id).Error
+}
+
+func CreateTag(tag *Tag) error {
+	return DB.Create(tag).Error
+}
+
+func GetAllTags() ([]Tag, error) {
+	var tags []Tag
+	err := DB.Find(&tags).Error
+	return tags, err
+}
+
+func GetTagByName(name string) (*Tag, error) {
+	var tag Tag
+	err := DB.Where("name = ?", name).First(&tag).Error
+	return &tag, err
+}
+
+func UpdateTag(tag *Tag) error {
+	return DB.Save(tag).Error
+}
+
+func DeleteTag(id uint) error {
+	return DB.Delete(&Tag{}, id).Error
+}
+
+func AddTagToEntity(entityType EntityType, entityID, tagID uint) error {
+	entityTag := EntityTag{
+		EntityType: entityType,
+		EntityID:   entityID,
+		TagID:      tagID,
+	}
+	return DB.Create(&entityTag).Error
+}
+
+func RemoveTagFromEntity(entityType EntityType, entityID, tagID uint) error {
+	return DB.Where("entity_type = ? AND entity_id = ? AND tag_id = ?", 
+		entityType, entityID, tagID).Delete(&EntityTag{}).Error
+}
+
+func GetTagsByEntity(entityType EntityType, entityID uint) ([]Tag, error) {
+	var tags []Tag
+	err := DB.Joins("JOIN entity_tags ON tags.id = entity_tags.tag_id").
+		Where("entity_tags.entity_type = ? AND entity_tags.entity_id = ?", 
+			entityType, entityID).
+		Find(&tags).Error
+	return tags, err
+}
+
+func CreateTimeLog(timeLog *TimeLog) error {
+	return DB.Create(timeLog).Error
+}
+
+func GetTimeLogsByTask(taskID uint) ([]TimeLog, error) {
+	var timeLogs []TimeLog
+	err := DB.Where("task_id = ?", taskID).
+		Preload("User").
+		Order("log_date DESC").
+		Find(&timeLogs).Error
+	return timeLogs, err
+}
+
+func GetTimeLogsByUser(userID uint, startDate, endDate time.Time) ([]TimeLog, error) {
+	var timeLogs []TimeLog
+	err := DB.Where("user_id = ? AND log_date BETWEEN ? AND ?", 
+		userID, startDate, endDate).
+		Preload("Task.Project").
+		Order("log_date DESC").
+		Find(&timeLogs).Error
+	return timeLogs, err
+}
+
+func UpdateTimeLog(timeLog *TimeLog) error {
+	return DB.Save(timeLog).Error
+}
+
+func DeleteTimeLog(id uint) error {
+	return DB.Delete(&TimeLog{}, id).Error
+}
--- a/internal/models/database.go
+++ b/internal/models/database.go
@@ -0,0 +1,60 @@
+package models
+
+import (
+	"fmt"
+	"time"
+
+	"giteapm/config"
+
+	"gorm.io/driver/mysql"
+	"gorm.io/gorm"
+	"gorm.io/gorm/logger"
+)
+
+var DB *gorm.DB
+
+func InitDB(cfg config.DatabaseConfig) (*gorm.DB, error) {
+	dsn := fmt.Sprintf("%s:%s@tcp(%s:%d)/%s?charset=%s&parseTime=True&loc=Local",
+		cfg.Username, cfg.Password, cfg.Host, cfg.Port, cfg.Database, cfg.Charset)
+
+	var err error
+	DB, err = gorm.Open(mysql.Open(dsn), &gorm.Config{
+		Logger: logger.Default.LogMode(logger.Info),
+	})
+	if err != nil {
+		return nil, fmt.Errorf("连接数据库失败: %v", err)
+	}
+
+	sqlDB, err := DB.DB()
+	if err != nil {
+		return nil, fmt.Errorf("获取底层数据库连接失败: %v", err)
+	}
+
+	sqlDB.SetMaxIdleConns(10)
+	sqlDB.SetMaxOpenConns(100)
+	sqlDB.SetConnMaxLifetime(time.Hour)
+
+	if err := autoMigrate(); err != nil {
+		return nil, fmt.Errorf("数据库迁移失败: %v", err)
+	}
+
+	return DB, nil
+}
+
+func autoMigrate() error {
+	return DB.AutoMigrate(
+		&User{},
+		&Project{},
+		&ProjectMember{},
+		&Epic{},
+		&Story{},
+		&Task{},
+		&GiteaRelation{},
+		&Sprint{},
+		&Comment{},
+		&Tag{},
+		&EntityTag{},
+		&TimeLog{},
+		&WebhookConfig{},
+	)
+}
--- a/internal/models/epic.go
+++ b/internal/models/epic.go
@@ -0,0 +1,129 @@
+package models
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type Epic struct {
+	ID                 uint       `json:"id" gorm:"primaryKey"`
+	ProjectID          uint       `json:"project_id"`
+	Title              string     `json:"title" gorm:"not null"`
+	Description        string     `json:"description"`
+	Status             string     `json:"status" gorm:"default:'backlog'"`
+	Priority           string     `json:"priority" gorm:"default:'medium'"`
+	AssigneeID         *uint      `json:"assignee_id"`
+	ReporterID         uint       `json:"reporter_id"`
+	StartDate          *time.Time `json:"start_date"`
+	DueDate            *time.Time `json:"due_date"`
+	EstimatedHours     *float64   `json:"estimated_hours"`
+	ActualHours        float64    `json:"actual_hours" gorm:"default:0"`
+	ProgressPercentage int        `json:"progress_percentage" gorm:"default:0"`
+	Project            Project    `json:"project" gorm:"foreignKey:ProjectID"`
+	Assignee           *User      `json:"assignee" gorm:"foreignKey:AssigneeID"`
+	Reporter           User       `json:"reporter" gorm:"foreignKey:ReporterID"`
+	Stories            []Story    `json:"stories" gorm:"foreignKey:EpicID"`
+	CreatedAt          time.Time  `json:"created_at"`
+	UpdatedAt          time.Time  `json:"updated_at"`
+}
+
+type EpicStatus string
+
+const (
+	EpicStatusBacklog    EpicStatus = "backlog"
+	EpicStatusPlanning   EpicStatus = "planning"
+	EpicStatusInProgress EpicStatus = "in_progress"
+	EpicStatusTesting    EpicStatus = "testing"
+	EpicStatusDone       EpicStatus = "done"
+	EpicStatusCancelled  EpicStatus = "cancelled"
+)
+
+func (e *Epic) BeforeCreate(tx *gorm.DB) error {
+	return nil
+}
+
+func (e *Epic) UpdateProgress() error {
+	var totalStories int64
+	var completedStories int64
+
+	err := DB.Model(&Story{}).Where("epic_id = ?", e.ID).Count(&totalStories).Error
+	if err != nil {
+		return err
+	}
+
+	if totalStories == 0 {
+		e.ProgressPercentage = 0
+		return DB.Save(e).Error
+	}
+
+	err = DB.Model(&Story{}).Where("epic_id = ? AND status = 'done'", e.ID).Count(&completedStories).Error
+	if err != nil {
+		return err
+	}
+
+	e.ProgressPercentage = int(float64(completedStories) / float64(totalStories) * 100)
+	return DB.Save(e).Error
+}
+
+func (e *Epic) GetStories() ([]Story, error) {
+	var stories []Story
+	err := DB.Where("epic_id = ?", e.ID).Preload("Assignee").Find(&stories).Error
+	return stories, err
+}
+
+func CreateEpic(epic *Epic) error {
+	return DB.Create(epic).Error
+}
+
+func GetEpicByID(id uint) (*Epic, error) {
+	var epic Epic
+	err := DB.Preload("Project").Preload("Assignee").Preload("Reporter").
+		Preload("Stories").First(&epic, id).Error
+	return &epic, err
+}
+
+func GetEpicsByProject(projectID uint) ([]Epic, error) {
+	var epics []Epic
+	err := DB.Where("project_id = ?", projectID).
+		Preload("Assignee").Preload("Reporter").
+		Find(&epics).Error
+	return epics, err
+}
+
+func UpdateEpic(epic *Epic) error {
+	return DB.Save(epic).Error
+}
+
+func DeleteEpic(id uint) error {
+	return DB.Delete(&Epic{}, id).Error
+}
+
+func ListEpics(offset, limit int, filters map[string]interface{}) ([]Epic, int64, error) {
+	var epics []Epic
+	var total int64
+
+	query := DB.Model(&Epic{})
+	
+	for key, value := range filters {
+		switch key {
+		case "project_id":
+			query = query.Where("project_id = ?", value)
+		case "status":
+			query = query.Where("status = ?", value)
+		case "priority":
+			query = query.Where("priority = ?", value)
+		case "assignee_id":
+			query = query.Where("assignee_id = ?", value)
+		}
+	}
+
+	err := query.Count(&total).Error
+	if err != nil {
+		return nil, 0, err
+	}
+
+	err = query.Preload("Project").Preload("Assignee").Preload("Reporter").
+		Offset(offset).Limit(limit).Find(&epics).Error
+	return epics, total, err
+}
--- a/internal/models/gitea.go
+++ b/internal/models/gitea.go
@@ -0,0 +1,88 @@
+package models
+
+import (
+	"time"
+)
+
+type GiteaRelation struct {
+	ID                uint      `json:"id" gorm:"primaryKey"`
+	TaskID            uint      `json:"task_id"`
+	GiteaRepoID       uint      `json:"gitea_repo_id"`
+	GiteaRepoName     string    `json:"gitea_repo_name"`
+	RelationType      string    `json:"relation_type" gorm:"type:varchar(50)"`
+	GiteaObjectID     string    `json:"gitea_object_id" gorm:"type:varchar(255)"`
+	GiteaObjectNumber *uint     `json:"gitea_object_number"`
+	GiteaObjectTitle  string    `json:"gitea_object_title"`
+	GiteaObjectURL    string    `json:"gitea_object_url"`
+	Task              Task      `json:"task" gorm:"foreignKey:TaskID"`
+	CreatedAt         time.Time `json:"created_at"`
+}
+
+type GiteaRelationType string
+
+const (
+	RelationTypeBranch      GiteaRelationType = "branch"
+	RelationTypeCommit      GiteaRelationType = "commit"
+	RelationTypePullRequest GiteaRelationType = "pull_request"
+	RelationTypeIssue       GiteaRelationType = "issue"
+)
+
+type WebhookConfig struct {
+	ID            uint      `json:"id" gorm:"primaryKey"`
+	ProjectID     uint      `json:"project_id"`
+	GiteaRepoID   uint      `json:"gitea_repo_id"`
+	GiteaRepoName string    `json:"gitea_repo_name"`
+	WebhookURL    string    `json:"webhook_url"`
+	Secret        string    `json:"secret"`
+	Events        string    `json:"events"` // JSON string
+	Active        bool      `json:"active" gorm:"default:true"`
+	Project       Project   `json:"project" gorm:"foreignKey:ProjectID"`
+	CreatedAt     time.Time `json:"created_at"`
+	UpdatedAt     time.Time `json:"updated_at"`
+}
+
+func CreateGiteaRelation(relation *GiteaRelation) error {
+	return DB.Create(relation).Error
+}
+
+func GetGiteaRelationsByTask(taskID uint) ([]GiteaRelation, error) {
+	var relations []GiteaRelation
+	err := DB.Where("task_id = ?", taskID).Find(&relations).Error
+	return relations, err
+}
+
+func GetGiteaRelationsByRepo(repoID uint, relationType string) ([]GiteaRelation, error) {
+	var relations []GiteaRelation
+	query := DB.Where("gitea_repo_id = ?", repoID)
+	if relationType != "" {
+		query = query.Where("relation_type = ?", relationType)
+	}
+	err := query.Preload("Task").Find(&relations).Error
+	return relations, err
+}
+
+func UpdateGiteaRelation(relation *GiteaRelation) error {
+	return DB.Save(relation).Error
+}
+
+func DeleteGiteaRelation(id uint) error {
+	return DB.Delete(&GiteaRelation{}, id).Error
+}
+
+func CreateWebhookConfig(config *WebhookConfig) error {
+	return DB.Create(config).Error
+}
+
+func GetWebhookConfigByRepo(repoID uint) (*WebhookConfig, error) {
+	var config WebhookConfig
+	err := DB.Where("gitea_repo_id = ?", repoID).First(&config).Error
+	return &config, err
+}
+
+func UpdateWebhookConfig(config *WebhookConfig) error {
+	return DB.Save(config).Error
+}
+
+func DeleteWebhookConfig(id uint) error {
+	return DB.Delete(&WebhookConfig{}, id).Error
+}
--- a/internal/models/project.go
+++ b/internal/models/project.go
@@ -0,0 +1,163 @@
+package models
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type Project struct {
+	ID          uint             `json:"id" gorm:"primaryKey"`
+	Name        string           `json:"name" gorm:"not null"`
+	Description string           `json:"description"`
+	GiteaOrg    string           `json:"gitea_org"`
+	Status      string           `json:"status" gorm:"default:'planning'"`
+	Priority    string           `json:"priority" gorm:"default:'medium'"`
+	StartDate   *time.Time       `json:"start_date"`
+	EndDate     *time.Time       `json:"end_date"`
+	OwnerID     uint             `json:"owner_id"`
+	Owner       User             `json:"owner" gorm:"foreignKey:OwnerID"`
+	Members     []ProjectMember  `json:"members" gorm:"foreignKey:ProjectID"`
+	Epics       []Epic           `json:"epics" gorm:"foreignKey:ProjectID"`
+	Stories     []Story          `json:"stories" gorm:"foreignKey:ProjectID"`
+	Tasks       []Task           `json:"tasks" gorm:"foreignKey:ProjectID"`
+	Sprints     []Sprint         `json:"sprints" gorm:"foreignKey:ProjectID"`
+	CreatedAt   time.Time        `json:"created_at"`
+	UpdatedAt   time.Time        `json:"updated_at"`
+}
+
+type ProjectMember struct {
+	ID        uint      `json:"id" gorm:"primaryKey"`
+	ProjectID uint      `json:"project_id"`
+	UserID    uint      `json:"user_id"`
+	Role      string    `json:"role" gorm:"default:'developer'"`
+	User      User      `json:"user" gorm:"foreignKey:UserID"`
+	JoinedAt  time.Time `json:"joined_at"`
+}
+
+type ProjectStatus string
+
+const (
+	ProjectStatusActive   ProjectStatus = "active"
+	ProjectStatusArchived ProjectStatus = "archived"
+	ProjectStatusPlanning ProjectStatus = "planning"
+)
+
+type ProjectPriority string
+
+const (
+	PriorityLow      ProjectPriority = "low"
+	PriorityMedium   ProjectPriority = "medium"
+	PriorityHigh     ProjectPriority = "high"
+	PriorityCritical ProjectPriority = "critical"
+)
+
+type ProjectMemberRole string
+
+const (
+	ProjectRoleOwner     ProjectMemberRole = "owner"
+	ProjectRoleManager   ProjectMemberRole = "manager"
+	ProjectRoleDeveloper ProjectMemberRole = "developer"
+	ProjectRoleTester    ProjectMemberRole = "tester"
+	ProjectRoleViewer    ProjectMemberRole = "viewer"
+)
+
+func (p *Project) BeforeCreate(tx *gorm.DB) error {
+	return nil
+}
+
+func (p *Project) GetMembers() ([]User, error) {
+	var users []User
+	err := DB.Joins("JOIN project_members ON users.id = project_members.user_id").
+		Where("project_members.project_id = ?", p.ID).
+		Find(&users).Error
+	return users, err
+}
+
+func (p *Project) AddMember(userID uint, role string) error {
+	member := ProjectMember{
+		ProjectID: p.ID,
+		UserID:    userID,
+		Role:      role,
+		JoinedAt:  time.Now(),
+	}
+	return DB.Create(&member).Error
+}
+
+func (p *Project) RemoveMember(userID uint) error {
+	return DB.Where("project_id = ? AND user_id = ?", p.ID, userID).Delete(&ProjectMember{}).Error
+}
+
+func (p *Project) GetProgress() (float64, error) {
+	var totalTasks int64
+	var completedTasks int64
+
+	err := DB.Model(&Task{}).Where("project_id = ?", p.ID).Count(&totalTasks).Error
+	if err != nil {
+		return 0, err
+	}
+
+	if totalTasks == 0 {
+		return 0, nil
+	}
+
+	err = DB.Model(&Task{}).Where("project_id = ? AND status = 'done'", p.ID).Count(&completedTasks).Error
+	if err != nil {
+		return 0, err
+	}
+
+	return float64(completedTasks) / float64(totalTasks) * 100, nil
+}
+
+func CreateProject(project *Project) error {
+	return DB.Create(project).Error
+}
+
+func GetProjectByID(id uint) (*Project, error) {
+	var project Project
+	err := DB.Preload("Owner").Preload("Members.User").First(&project, id).Error
+	return &project, err
+}
+
+func GetProjectsByUser(userID uint) ([]Project, error) {
+	var projects []Project
+	err := DB.Where("owner_id = ?", userID).
+		Or("id IN (SELECT project_id FROM project_members WHERE user_id = ?)", userID).
+		Preload("Owner").
+		Find(&projects).Error
+	return projects, err
+}
+
+func UpdateProject(project *Project) error {
+	return DB.Save(project).Error
+}
+
+func DeleteProject(id uint) error {
+	return DB.Delete(&Project{}, id).Error
+}
+
+func ListProjects(offset, limit int, filters map[string]interface{}) ([]Project, int64, error) {
+	var projects []Project
+	var total int64
+
+	query := DB.Model(&Project{})
+	
+	for key, value := range filters {
+		switch key {
+		case "status":
+			query = query.Where("status = ?", value)
+		case "priority":
+			query = query.Where("priority = ?", value)
+		case "owner_id":
+			query = query.Where("owner_id = ?", value)
+		}
+	}
+
+	err := query.Count(&total).Error
+	if err != nil {
+		return nil, 0, err
+	}
+
+	err = query.Preload("Owner").Offset(offset).Limit(limit).Find(&projects).Error
+	return projects, total, err
+}
--- a/internal/models/sprint.go
+++ b/internal/models/sprint.go
@@ -0,0 +1,139 @@
+package models
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type Sprint struct {
+	ID          uint      `json:"id" gorm:"primaryKey"`
+	ProjectID   uint      `json:"project_id"`
+	Name        string    `json:"name" gorm:"not null"`
+	Description string    `json:"description"`
+	Status      string    `json:"status" gorm:"default:'planning'"`
+	StartDate   *time.Time `json:"start_date"`
+	EndDate     *time.Time `json:"end_date"`
+	Goal        string    `json:"goal"`
+	Project     Project   `json:"project" gorm:"foreignKey:ProjectID"`
+	Stories     []Story   `json:"stories" gorm:"foreignKey:SprintID"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+type SprintStatus string
+
+const (
+	SprintStatusPlanning  SprintStatus = "planning"
+	SprintStatusActive    SprintStatus = "active"
+	SprintStatusCompleted SprintStatus = "completed"
+)
+
+func (s *Sprint) BeforeCreate(tx *gorm.DB) error {
+	return nil
+}
+
+func (s *Sprint) GetVelocity() (int, error) {
+	var totalStoryPoints int
+	err := DB.Model(&Story{}).
+		Where("sprint_id = ? AND status = 'done'", s.ID).
+		Select("COALESCE(SUM(story_points), 0)").
+		Scan(&totalStoryPoints).Error
+	return totalStoryPoints, err
+}
+
+func (s *Sprint) GetBurndownData() ([]map[string]interface{}, error) {
+	var stories []Story
+	err := DB.Where("sprint_id = ?", s.ID).Find(&stories).Error
+	if err != nil {
+		return nil, err
+	}
+
+	var burndownData []map[string]interface{}
+	
+	// Calculate total story points
+	totalPoints := 0
+	for _, story := range stories {
+		if story.StoryPoints != nil {
+			totalPoints += *story.StoryPoints
+		}
+	}
+
+	// This is a simplified version - in a real implementation,
+	// you'd track daily progress
+	burndownData = append(burndownData, map[string]interface{}{
+		"date":      s.StartDate,
+		"remaining": totalPoints,
+		"ideal":     totalPoints,
+	})
+
+	if s.EndDate != nil {
+		burndownData = append(burndownData, map[string]interface{}{
+			"date":      s.EndDate,
+			"remaining": 0,
+			"ideal":     0,
+		})
+	}
+
+	return burndownData, nil
+}
+
+func CreateSprint(sprint *Sprint) error {
+	return DB.Create(sprint).Error
+}
+
+func GetSprintByID(id uint) (*Sprint, error) {
+	var sprint Sprint
+	err := DB.Preload("Project").Preload("Stories.Assignee").
+		First(&sprint, id).Error
+	return &sprint, err
+}
+
+func GetSprintsByProject(projectID uint) ([]Sprint, error) {
+	var sprints []Sprint
+	err := DB.Where("project_id = ?", projectID).
+		Preload("Stories").
+		Find(&sprints).Error
+	return sprints, err
+}
+
+func GetActiveSprintByProject(projectID uint) (*Sprint, error) {
+	var sprint Sprint
+	err := DB.Where("project_id = ? AND status = 'active'", projectID).
+		Preload("Stories.Assignee").
+		First(&sprint).Error
+	return &sprint, err
+}
+
+func UpdateSprint(sprint *Sprint) error {
+	return DB.Save(sprint).Error
+}
+
+func DeleteSprint(id uint) error {
+	return DB.Delete(&Sprint{}, id).Error
+}
+
+func ListSprints(offset, limit int, filters map[string]interface{}) ([]Sprint, int64, error) {
+	var sprints []Sprint
+	var total int64
+
+	query := DB.Model(&Sprint{})
+	
+	for key, value := range filters {
+		switch key {
+		case "project_id":
+			query = query.Where("project_id = ?", value)
+		case "status":
+			query = query.Where("status = ?", value)
+		}
+	}
+
+	err := query.Count(&total).Error
+	if err != nil {
+		return nil, 0, err
+	}
+
+	err = query.Preload("Project").
+		Offset(offset).Limit(limit).Find(&sprints).Error
+	return sprints, total, err
+}
--- a/internal/models/story.go
+++ b/internal/models/story.go
@@ -0,0 +1,159 @@
+package models
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type Story struct {
+	ID                 uint      `json:"id" gorm:"primaryKey"`
+	EpicID             *uint     `json:"epic_id"`
+	ProjectID          uint      `json:"project_id"`
+	Title              string    `json:"title" gorm:"not null"`
+	Description        string    `json:"description"`
+	AcceptanceCriteria string    `json:"acceptance_criteria"`
+	Status             string    `json:"status" gorm:"default:'backlog'"`
+	Priority           string    `json:"priority" gorm:"default:'medium'"`
+	StoryPoints        *int      `json:"story_points"`
+	AssigneeID         *uint     `json:"assignee_id"`
+	ReporterID         uint      `json:"reporter_id"`
+	SprintID           *uint     `json:"sprint_id"`
+	EstimatedHours     *float64  `json:"estimated_hours"`
+	ActualHours        float64   `json:"actual_hours" gorm:"default:0"`
+	Epic               *Epic     `json:"epic" gorm:"foreignKey:EpicID"`
+	Project            Project   `json:"project" gorm:"foreignKey:ProjectID"`
+	Assignee           *User     `json:"assignee" gorm:"foreignKey:AssigneeID"`
+	Reporter           User      `json:"reporter" gorm:"foreignKey:ReporterID"`
+	Sprint             *Sprint   `json:"sprint" gorm:"foreignKey:SprintID"`
+	Tasks              []Task    `json:"tasks" gorm:"foreignKey:StoryID"`
+	CreatedAt          time.Time `json:"created_at"`
+	UpdatedAt          time.Time `json:"updated_at"`
+}
+
+type StoryStatus string
+
+const (
+	StoryStatusBacklog    StoryStatus = "backlog"
+	StoryStatusTodo       StoryStatus = "todo"
+	StoryStatusInProgress StoryStatus = "in_progress"
+	StoryStatusReview     StoryStatus = "review"
+	StoryStatusTesting    StoryStatus = "testing"
+	StoryStatusDone       StoryStatus = "done"
+	StoryStatusCancelled  StoryStatus = "cancelled"
+)
+
+func (s *Story) BeforeCreate(tx *gorm.DB) error {
+	return nil
+}
+
+func (s *Story) GetTasks() ([]Task, error) {
+	var tasks []Task
+	err := DB.Where("story_id = ?", s.ID).Preload("Assignee").Find(&tasks).Error
+	return tasks, err
+}
+
+func (s *Story) UpdateProgress() error {
+	var totalTasks int64
+	var completedTasks int64
+
+	err := DB.Model(&Task{}).Where("story_id = ?", s.ID).Count(&totalTasks).Error
+	if err != nil {
+		return err
+	}
+
+	if totalTasks == 0 {
+		return nil
+	}
+
+	err = DB.Model(&Task{}).Where("story_id = ? AND status = 'done'", s.ID).Count(&completedTasks).Error
+	if err != nil {
+		return err
+	}
+
+	if completedTasks == totalTasks {
+		s.Status = string(StoryStatusDone)
+	} else if completedTasks > 0 {
+		s.Status = string(StoryStatusInProgress)
+	}
+
+	return DB.Save(s).Error
+}
+
+func CreateStory(story *Story) error {
+	return DB.Create(story).Error
+}
+
+func GetStoryByID(id uint) (*Story, error) {
+	var story Story
+	err := DB.Preload("Epic").Preload("Project").Preload("Assignee").
+		Preload("Reporter").Preload("Sprint").Preload("Tasks").
+		First(&story, id).Error
+	return &story, err
+}
+
+func GetStoriesByProject(projectID uint) ([]Story, error) {
+	var stories []Story
+	err := DB.Where("project_id = ?", projectID).
+		Preload("Epic").Preload("Assignee").Preload("Reporter").
+		Find(&stories).Error
+	return stories, err
+}
+
+func GetStoriesByEpic(epicID uint) ([]Story, error) {
+	var stories []Story
+	err := DB.Where("epic_id = ?", epicID).
+		Preload("Assignee").Preload("Reporter").
+		Find(&stories).Error
+	return stories, err
+}
+
+func GetStoriesBySprint(sprintID uint) ([]Story, error) {
+	var stories []Story
+	err := DB.Where("sprint_id = ?", sprintID).
+		Preload("Assignee").Preload("Reporter").
+		Find(&stories).Error
+	return stories, err
+}
+
+func UpdateStory(story *Story) error {
+	return DB.Save(story).Error
+}
+
+func DeleteStory(id uint) error {
+	return DB.Delete(&Story{}, id).Error
+}
+
+func ListStories(offset, limit int, filters map[string]interface{}) ([]Story, int64, error) {
+	var stories []Story
+	var total int64
+
+	query := DB.Model(&Story{})
+	
+	for key, value := range filters {
+		switch key {
+		case "project_id":
+			query = query.Where("project_id = ?", value)
+		case "epic_id":
+			query = query.Where("epic_id = ?", value)
+		case "sprint_id":
+			query = query.Where("sprint_id = ?", value)
+		case "status":
+			query = query.Where("status = ?", value)
+		case "priority":
+			query = query.Where("priority = ?", value)
+		case "assignee_id":
+			query = query.Where("assignee_id = ?", value)
+		}
+	}
+
+	err := query.Count(&total).Error
+	if err != nil {
+		return nil, 0, err
+	}
+
+	err = query.Preload("Epic").Preload("Project").Preload("Assignee").
+		Preload("Reporter").Preload("Sprint").
+		Offset(offset).Limit(limit).Find(&stories).Error
+	return stories, total, err
+}
--- a/internal/models/task.go
+++ b/internal/models/task.go
@@ -0,0 +1,166 @@
+package models
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type Task struct {
+	ID             uint             `json:"id" gorm:"primaryKey"`
+	StoryID        *uint            `json:"story_id"`
+	ProjectID      uint             `json:"project_id"`
+	Title          string           `json:"title" gorm:"not null"`
+	Description    string           `json:"description"`
+	Status         string           `json:"status" gorm:"default:'todo'"`
+	Priority       string           `json:"priority" gorm:"default:'medium'"`
+	TaskType       string           `json:"task_type" gorm:"default:'feature'"`
+	AssigneeID     *uint            `json:"assignee_id"`
+	ReporterID     uint             `json:"reporter_id"`
+	EstimatedHours *float64         `json:"estimated_hours"`
+	ActualHours    float64          `json:"actual_hours" gorm:"default:0"`
+	DueDate        *time.Time       `json:"due_date"`
+	Story          *Story           `json:"story" gorm:"foreignKey:StoryID"`
+	Project        Project          `json:"project" gorm:"foreignKey:ProjectID"`
+	Assignee       *User            `json:"assignee" gorm:"foreignKey:AssigneeID"`
+	Reporter       User             `json:"reporter" gorm:"foreignKey:ReporterID"`
+	GiteaRelations []GiteaRelation  `json:"gitea_relations" gorm:"foreignKey:TaskID"`
+	TimeLogs       []TimeLog        `json:"time_logs" gorm:"foreignKey:TaskID"`
+	CreatedAt      time.Time        `json:"created_at"`
+	UpdatedAt      time.Time        `json:"updated_at"`
+}
+
+type TaskStatus string
+
+const (
+	TaskStatusTodo       TaskStatus = "todo"
+	TaskStatusInProgress TaskStatus = "in_progress"
+	TaskStatusReview     TaskStatus = "review"
+	TaskStatusTesting    TaskStatus = "testing"
+	TaskStatusDone       TaskStatus = "done"
+	TaskStatusBlocked    TaskStatus = "blocked"
+)
+
+type TaskType string
+
+const (
+	TaskTypeFeature       TaskType = "feature"
+	TaskTypeBug          TaskType = "bug"
+	TaskTypeImprovement  TaskType = "improvement"
+	TaskTypeResearch     TaskType = "research"
+	TaskTypeDocumentation TaskType = "documentation"
+)
+
+func (t *Task) BeforeCreate(tx *gorm.DB) error {
+	return nil
+}
+
+func (t *Task) LogTime(userID uint, hours float64, description string, logDate time.Time) error {
+	timeLog := TimeLog{
+		TaskID:      t.ID,
+		UserID:      userID,
+		Hours:       hours,
+		Description: description,
+		LogDate:     logDate,
+	}
+	
+	if err := DB.Create(&timeLog).Error; err != nil {
+		return err
+	}
+
+	t.ActualHours += hours
+	return DB.Save(t).Error
+}
+
+func (t *Task) LinkGiteaObject(repoID uint, repoName, relationType, objectID string, objectNumber *uint, title, url string) error {
+	relation := GiteaRelation{
+		TaskID:            t.ID,
+		GiteaRepoID:       repoID,
+		GiteaRepoName:     repoName,
+		RelationType:      relationType,
+		GiteaObjectID:     objectID,
+		GiteaObjectNumber: objectNumber,
+		GiteaObjectTitle:  title,
+		GiteaObjectURL:    url,
+	}
+	
+	return DB.Create(&relation).Error
+}
+
+func CreateTask(task *Task) error {
+	return DB.Create(task).Error
+}
+
+func GetTaskByID(id uint) (*Task, error) {
+	var task Task
+	err := DB.Preload("Story").Preload("Project").Preload("Assignee").
+		Preload("Reporter").Preload("GiteaRelations").Preload("TimeLogs").
+		First(&task, id).Error
+	return &task, err
+}
+
+func GetTasksByProject(projectID uint) ([]Task, error) {
+	var tasks []Task
+	err := DB.Where("project_id = ?", projectID).
+		Preload("Story").Preload("Assignee").Preload("Reporter").
+		Find(&tasks).Error
+	return tasks, err
+}
+
+func GetTasksByStory(storyID uint) ([]Task, error) {
+	var tasks []Task
+	err := DB.Where("story_id = ?", storyID).
+		Preload("Assignee").Preload("Reporter").
+		Find(&tasks).Error
+	return tasks, err
+}
+
+func GetTasksByAssignee(assigneeID uint) ([]Task, error) {
+	var tasks []Task
+	err := DB.Where("assignee_id = ?", assigneeID).
+		Preload("Story").Preload("Project").
+		Find(&tasks).Error
+	return tasks, err
+}
+
+func UpdateTask(task *Task) error {
+	return DB.Save(task).Error
+}
+
+func DeleteTask(id uint) error {
+	return DB.Delete(&Task{}, id).Error
+}
+
+func ListTasks(offset, limit int, filters map[string]interface{}) ([]Task, int64, error) {
+	var tasks []Task
+	var total int64
+
+	query := DB.Model(&Task{})
+	
+	for key, value := range filters {
+		switch key {
+		case "project_id":
+			query = query.Where("project_id = ?", value)
+		case "story_id":
+			query = query.Where("story_id = ?", value)
+		case "status":
+			query = query.Where("status = ?", value)
+		case "priority":
+			query = query.Where("priority = ?", value)
+		case "task_type":
+			query = query.Where("task_type = ?", value)
+		case "assignee_id":
+			query = query.Where("assignee_id = ?", value)
+		}
+	}
+
+	err := query.Count(&total).Error
+	if err != nil {
+		return nil, 0, err
+	}
+
+	err = query.Preload("Story").Preload("Project").Preload("Assignee").
+		Preload("Reporter").Preload("GiteaRelations").
+		Offset(offset).Limit(limit).Find(&tasks).Error
+	return tasks, total, err
+}
--- a/internal/models/user.go
+++ b/internal/models/user.go
@@ -0,0 +1,96 @@
+package models
+
+import (
+	"time"
+
+	"gorm.io/gorm"
+)
+
+type User struct {
+	ID          uint      `json:"id" gorm:"primaryKey"`
+	GiteaUserID *uint     `json:"gitea_user_id" gorm:"uniqueIndex"`
+	Username    string    `json:"username" gorm:"unique;not null"`
+	Email       string    `json:"email" gorm:"not null"`
+	FullName    string    `json:"full_name"`
+	AvatarURL   string    `json:"avatar_url"`
+	Role        string    `json:"role" gorm:"default:'developer'"`
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+}
+
+type UserRole string
+
+const (
+	RoleAdmin     UserRole = "admin"
+	RoleManager   UserRole = "manager"
+	RoleDeveloper UserRole = "developer"
+	RoleTester    UserRole = "tester"
+	RoleViewer    UserRole = "viewer"
+)
+
+func (u *User) BeforeCreate(tx *gorm.DB) error {
+	return nil
+}
+
+func (u *User) GetOwnedProjects() ([]Project, error) {
+	var projects []Project
+	err := DB.Where("owner_id = ?", u.ID).Find(&projects).Error
+	return projects, err
+}
+
+func (u *User) GetJoinedProjects() ([]Project, error) {
+	var projects []Project
+	err := DB.Joins("JOIN project_members ON projects.id = project_members.project_id").
+		Where("project_members.user_id = ?", u.ID).
+		Find(&projects).Error
+	return projects, err
+}
+
+func (u *User) GetAssignedTasks() ([]Task, error) {
+	var tasks []Task
+	err := DB.Where("assignee_id = ?", u.ID).Find(&tasks).Error
+	return tasks, err
+}
+
+func CreateUser(user *User) error {
+	return DB.Create(user).Error
+}
+
+func GetUserByID(id uint) (*User, error) {
+	var user User
+	err := DB.First(&user, id).Error
+	return &user, err
+}
+
+func GetUserByUsername(username string) (*User, error) {
+	var user User
+	err := DB.Where("username = ?", username).First(&user).Error
+	return &user, err
+}
+
+func GetUserByGiteaID(giteaUserID uint) (*User, error) {
+	var user User
+	err := DB.Where("gitea_user_id = ?", giteaUserID).First(&user).Error
+	return &user, err
+}
+
+func UpdateUser(user *User) error {
+	return DB.Save(user).Error
+}
+
+func DeleteUser(id uint) error {
+	return DB.Delete(&User{}, id).Error
+}
+
+func ListUsers(offset, limit int) ([]User, int64, error) {
+	var users []User
+	var total int64
+
+	err := DB.Model(&User{}).Count(&total).Error
+	if err != nil {
+		return nil, 0, err
+	}
+
+	err = DB.Offset(offset).Limit(limit).Find(&users).Error
+	return users, total, err
+}