Initial commit: Gitea Project Management System

Features:
- Complete project management system with Epic/Story/Task hierarchy
- Vue.js 3 + Element Plus frontend with kanban board
- Go backend with Gin framework and GORM
- OAuth2 integration with Gitea
- Docker containerization with MySQL
- RESTful API for project, task, and user management
- JWT authentication and authorization
- Responsive web interface with dashboard

internal/api/handlers/auth.go

@@ -0,0 +1,159 @@
+package handlers
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/oauth2"
+)
+
+type GiteaUser struct {
+	ID        int    `json:"id"`
+	Login     string `json:"login"`
+	FullName  string `json:"full_name"`
+	Email     string `json:"email"`
+	AvatarURL string `json:"avatar_url"`
+}
+
+func (h *Handlers) GiteaLogin(c *gin.Context) {
+	config := &oauth2.Config{
+		ClientID:     h.Cfg.Gitea.ClientID,
+		ClientSecret: h.Cfg.Gitea.ClientSecret,
+		RedirectURL:  h.Cfg.Gitea.RedirectURL,
+		Scopes:       []string{"read:user"},
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  h.Cfg.Gitea.BaseURL + "/login/oauth/authorize",
+			TokenURL: h.Cfg.Gitea.BaseURL + "/login/oauth/access_token",
+		},
+	}
+
+	state := "random-state-string"
+	url := config.AuthCodeURL(state, oauth2.AccessTypeOffline)
+	
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{
+		"auth_url": url,
+	}))
+}
+
+func (h *Handlers) GiteaCallback(c *gin.Context) {
+	// 记录所有查询参数用于调试
+	fmt.Printf("OAuth回调收到的所有参数: %v\n", c.Request.URL.Query())
+	
+	code := c.Query("code")
+	state := c.Query("state")
+	errorParam := c.Query("error")
+	
+	fmt.Printf("OAuth回调 - code: %s, state: %s, error: %s\n", code, state, errorParam)
+	
+	if errorParam != "" {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, fmt.Sprintf("OAuth授权失败: %s", errorParam)))
+		return
+	}
+	
+	if code == "" {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "缺少授权码"))
+		return
+	}
+
+	config := &oauth2.Config{
+		ClientID:     h.Cfg.Gitea.ClientID,
+		ClientSecret: h.Cfg.Gitea.ClientSecret,
+		RedirectURL:  h.Cfg.Gitea.RedirectURL,
+		Scopes:       []string{"read:user"},
+		Endpoint: oauth2.Endpoint{
+			AuthURL:  h.Cfg.Gitea.BaseURL + "/login/oauth/authorize",
+			TokenURL: h.Cfg.Gitea.BaseURL + "/login/oauth/access_token",
+		},
+	}
+
+	token, err := config.Exchange(c.Request.Context(), code)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "授权码交换失败"))
+		return
+	}
+
+	client := config.Client(c.Request.Context(), token)
+	resp, err := client.Get(h.Cfg.Gitea.BaseURL + "/api/v1/user")
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取用户信息失败"))
+		return
+	}
+	defer resp.Body.Close()
+
+	body, err := io.ReadAll(resp.Body)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "读取用户信息失败"))
+		return
+	}
+
+	var giteaUser GiteaUser
+	if err := json.Unmarshal(body, &giteaUser); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "解析用户信息失败"))
+		return
+	}
+
+	user, err := models.GetUserByGiteaID(uint(giteaUser.ID))
+	if err != nil {
+		user = &models.User{
+			GiteaUserID: func() *uint { id := uint(giteaUser.ID); return &id }(),
+			Username:    giteaUser.Login,
+			Email:       giteaUser.Email,
+			FullName:    giteaUser.FullName,
+			AvatarURL:   giteaUser.AvatarURL,
+			Role:        "developer",
+		}
+		if err := models.CreateUser(user); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse(500, "创建用户失败"))
+			return
+		}
+	} else {
+		user.Username = giteaUser.Login
+		user.Email = giteaUser.Email
+		user.FullName = giteaUser.FullName
+		user.AvatarURL = giteaUser.AvatarURL
+		if err := models.UpdateUser(user); err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新用户失败"))
+			return
+		}
+	}
+
+	jwtToken, err := h.generateJWT(user)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "生成JWT失败"))
+		return
+	}
+
+	// 重定向到前端页面，并通过URL参数传递token
+	redirectURL := fmt.Sprintf("/?token=%s", jwtToken)
+	c.Redirect(http.StatusFound, redirectURL)
+}
+
+func (h *Handlers) Logout(c *gin.Context) {
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{
+		"message": "登出成功",
+	}))
+}
+
+func (h *Handlers) generateJWT(user *models.User) (string, error) {
+	claims := &middleware.Claims{
+		UserID:   user.ID,
+		Username: user.Username,
+		Role:     user.Role,
+		RegisteredClaims: jwt.RegisteredClaims{
+			ExpiresAt: jwt.NewNumericDate(time.Now().Add(time.Duration(h.Cfg.JWT.ExpireHour) * time.Hour)),
+			IssuedAt:  jwt.NewNumericDate(time.Now()),
+			Subject:   fmt.Sprintf("%d", user.ID),
+		},
+	}
+
+	token := jwt.NewWithClaims(jwt.SigningMethodHS256, claims)
+	return token.SignedString([]byte(h.Cfg.JWT.Secret))
+}

internal/api/handlers/comments.go

@@ -0,0 +1,40 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) GetComments(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) CreateComment(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) UpdateComment(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteComment(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) ListTags(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) CreateTag(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) UpdateTag(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteTag(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+

internal/api/handlers/epics.go

@@ -0,0 +1,59 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListEpics(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+
+	epics, total, err := models.ListEpics(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取Epic列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(epics, total, page, limit))
+}
+
+func (h *Handlers) CreateEpic(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetEpic(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的Epic ID"))
+		return
+	}
+
+	epic, err := models.GetEpicByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "Epic不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(epic))
+}
+
+func (h *Handlers) UpdateEpic(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteEpic(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}

internal/api/handlers/handlers.go

@@ -0,0 +1,60 @@
+package handlers
+
+import (
+	"giteapm/config"
+
+	"gorm.io/gorm"
+)
+
+type Handlers struct {
+	DB  *gorm.DB
+	Cfg *config.Config
+}
+
+func NewHandlers(db *gorm.DB, cfg *config.Config) *Handlers {
+	return &Handlers{
+		DB:  db,
+		Cfg: cfg,
+	}
+}
+
+type Response struct {
+	Code    int         `json:"code"`
+	Message string      `json:"message"`
+	Data    interface{} `json:"data,omitempty"`
+}
+
+type PaginatedResponse struct {
+	Code    int         `json:"code"`
+	Message string      `json:"message"`
+	Data    interface{} `json:"data"`
+	Total   int64       `json:"total"`
+	Page    int         `json:"page"`
+	Limit   int         `json:"limit"`
+}
+
+func SuccessResponse(data interface{}) Response {
+	return Response{
+		Code:    200,
+		Message: "success",
+		Data:    data,
+	}
+}
+
+func ErrorResponse(code int, message string) Response {
+	return Response{
+		Code:    code,
+		Message: message,
+	}
+}
+
+func PaginatedSuccessResponse(data interface{}, total int64, page, limit int) PaginatedResponse {
+	return PaginatedResponse{
+		Code:    200,
+		Message: "success",
+		Data:    data,
+		Total:   total,
+		Page:    page,
+		Limit:   limit,
+	}
+}

internal/api/handlers/projects.go

@@ -0,0 +1,244 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type CreateProjectRequest struct {
+	Name        string     `json:"name" binding:"required"`
+	Description string     `json:"description"`
+	GiteaOrg    string     `json:"gitea_org"`
+	Priority    string     `json:"priority"`
+	StartDate   *time.Time `json:"start_date"`
+	EndDate     *time.Time `json:"end_date"`
+}
+
+type AddMemberRequest struct {
+	UserID uint   `json:"user_id" binding:"required"`
+	Role   string `json:"role" binding:"required"`
+}
+
+func (h *Handlers) ListProjects(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if status := c.Query("status"); status != "" {
+		filters["status"] = status
+	}
+	if priority := c.Query("priority"); priority != "" {
+		filters["priority"] = priority
+	}
+
+	currentUser, _ := middleware.GetCurrentUser(c)
+	if currentUser.Role != "admin" {
+		projects, err := models.GetProjectsByUser(currentUser.ID)
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取项目列表失败"))
+			return
+		}
+		c.JSON(http.StatusOK, SuccessResponse(projects))
+		return
+	}
+
+	projects, total, err := models.ListProjects(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取项目列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(projects, total, page, limit))
+}
+
+func (h *Handlers) CreateProject(c *gin.Context) {
+	var req CreateProjectRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	currentUser, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	project := &models.Project{
+		Name:        req.Name,
+		Description: req.Description,
+		GiteaOrg:    req.GiteaOrg,
+		Status:      "planning",
+		Priority:    req.Priority,
+		StartDate:   req.StartDate,
+		EndDate:     req.EndDate,
+		OwnerID:     currentUser.ID,
+	}
+
+	if project.Priority == "" {
+		project.Priority = "medium"
+	}
+
+	if err := models.CreateProject(project); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "创建项目失败"))
+		return
+	}
+
+	project.AddMember(currentUser.ID, "owner")
+
+	c.JSON(http.StatusCreated, SuccessResponse(project))
+}
+
+func (h *Handlers) GetProject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(project))
+}
+
+func (h *Handlers) UpdateProject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if name, ok := updateData["name"].(string); ok {
+		project.Name = name
+	}
+	if description, ok := updateData["description"].(string); ok {
+		project.Description = description
+	}
+	if status, ok := updateData["status"].(string); ok {
+		project.Status = status
+	}
+	if priority, ok := updateData["priority"].(string); ok {
+		project.Priority = priority
+	}
+
+	if err := models.UpdateProject(project); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新项目失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(project))
+}
+
+func (h *Handlers) DeleteProject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	if err := models.DeleteProject(uint(id)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "删除项目失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "删除成功"}))
+}
+
+func (h *Handlers) AddProjectMember(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	var req AddMemberRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	if err := project.AddMember(req.UserID, req.Role); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "添加成员失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "添加成员成功"}))
+}
+
+func (h *Handlers) RemoveProjectMember(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	userID, err := strconv.ParseUint(c.Param("user_id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	if err := project.RemoveMember(uint(userID)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "移除成员失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "移除成员成功"}))
+}
+
+func (h *Handlers) GetProjectMembers(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的项目ID"))
+		return
+	}
+
+	project, err := models.GetProjectByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "项目不存在"))
+		return
+	}
+
+	members, err := project.GetMembers()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取成员列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(members))
+}

internal/api/handlers/sprints.go

@@ -0,0 +1,81 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListSprints(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+
+	sprints, total, err := models.ListSprints(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取迭代列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(sprints, total, page, limit))
+}
+
+func (h *Handlers) CreateSprint(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetSprint(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的迭代ID"))
+		return
+	}
+
+	sprint, err := models.GetSprintByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "迭代不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(sprint))
+}
+
+func (h *Handlers) UpdateSprint(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteSprint(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetSprintBurndown(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的迭代ID"))
+		return
+	}
+
+	sprint, err := models.GetSprintByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "迭代不存在"))
+		return
+	}
+
+	burndownData, err := sprint.GetBurndownData()
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取燃尽图数据失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(burndownData))
+}

internal/api/handlers/stories.go

@@ -0,0 +1,64 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListStories(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+	if epicID := c.Query("epic_id"); epicID != "" {
+		if id, err := strconv.ParseUint(epicID, 10, 32); err == nil {
+			filters["epic_id"] = uint(id)
+		}
+	}
+
+	stories, total, err := models.ListStories(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取Story列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(stories, total, page, limit))
+}
+
+func (h *Handlers) CreateStory(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) GetStory(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的Story ID"))
+		return
+	}
+
+	story, err := models.GetStoryByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "Story不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(story))
+}
+
+func (h *Handlers) UpdateStory(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}
+
+func (h *Handlers) DeleteStory(c *gin.Context) {
+	c.JSON(http.StatusNotImplemented, ErrorResponse(501, "功能暂未实现"))
+}

internal/api/handlers/tasks.go

@@ -0,0 +1,291 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+	"time"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type CreateTaskRequest struct {
+	StoryID        *uint      `json:"story_id"`
+	ProjectID      uint       `json:"project_id" binding:"required"`
+	Title          string     `json:"title" binding:"required"`
+	Description    string     `json:"description"`
+	Priority       string     `json:"priority"`
+	TaskType       string     `json:"task_type"`
+	AssigneeID     *uint      `json:"assignee_id"`
+	EstimatedHours *float64   `json:"estimated_hours"`
+	DueDate        *time.Time `json:"due_date"`
+}
+
+type LogTimeRequest struct {
+	Hours       float64   `json:"hours" binding:"required"`
+	Description string    `json:"description"`
+	LogDate     time.Time `json:"log_date" binding:"required"`
+}
+
+type LinkGiteaObjectRequest struct {
+	RepoID       uint   `json:"repo_id" binding:"required"`
+	RepoName     string `json:"repo_name" binding:"required"`
+	RelationType string `json:"relation_type" binding:"required"`
+	ObjectID     string `json:"object_id" binding:"required"`
+	ObjectNumber *uint  `json:"object_number"`
+	Title        string `json:"title"`
+	URL          string `json:"url"`
+}
+
+func (h *Handlers) ListTasks(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	filters := make(map[string]interface{})
+	if projectID := c.Query("project_id"); projectID != "" {
+		if id, err := strconv.ParseUint(projectID, 10, 32); err == nil {
+			filters["project_id"] = uint(id)
+		}
+	}
+	if storyID := c.Query("story_id"); storyID != "" {
+		if id, err := strconv.ParseUint(storyID, 10, 32); err == nil {
+			filters["story_id"] = uint(id)
+		}
+	}
+	if status := c.Query("status"); status != "" {
+		filters["status"] = status
+	}
+	if assigneeID := c.Query("assignee_id"); assigneeID != "" {
+		if id, err := strconv.ParseUint(assigneeID, 10, 32); err == nil {
+			filters["assignee_id"] = uint(id)
+		}
+	}
+
+	tasks, total, err := models.ListTasks(offset, limit, filters)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取任务列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(tasks, total, page, limit))
+}
+
+func (h *Handlers) CreateTask(c *gin.Context) {
+	var req CreateTaskRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	currentUser, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	task := &models.Task{
+		StoryID:        req.StoryID,
+		ProjectID:      req.ProjectID,
+		Title:          req.Title,
+		Description:    req.Description,
+		Status:         "todo",
+		Priority:       req.Priority,
+		TaskType:       req.TaskType,
+		AssigneeID:     req.AssigneeID,
+		ReporterID:     currentUser.ID,
+		EstimatedHours: req.EstimatedHours,
+		DueDate:        req.DueDate,
+	}
+
+	if task.Priority == "" {
+		task.Priority = "medium"
+	}
+	if task.TaskType == "" {
+		task.TaskType = "feature"
+	}
+
+	if err := models.CreateTask(task); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "创建任务失败"))
+		return
+	}
+
+	c.JSON(http.StatusCreated, SuccessResponse(task))
+}
+
+func (h *Handlers) GetTask(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(task))
+}
+
+func (h *Handlers) UpdateTask(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if title, ok := updateData["title"].(string); ok {
+		task.Title = title
+	}
+	if description, ok := updateData["description"].(string); ok {
+		task.Description = description
+	}
+	if status, ok := updateData["status"].(string); ok {
+		task.Status = status
+	}
+	if priority, ok := updateData["priority"].(string); ok {
+		task.Priority = priority
+	}
+	if assigneeID, ok := updateData["assignee_id"].(float64); ok {
+		id := uint(assigneeID)
+		task.AssigneeID = &id
+	}
+
+	if err := models.UpdateTask(task); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新任务失败"))
+		return
+	}
+
+	if task.StoryID != nil {
+		story, err := models.GetStoryByID(*task.StoryID)
+		if err == nil {
+			story.UpdateProgress()
+		}
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(task))
+}
+
+func (h *Handlers) DeleteTask(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	if err := models.DeleteTask(uint(id)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "删除任务失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "删除成功"}))
+}
+
+func (h *Handlers) LogTime(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	var req LogTimeRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	currentUser, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	if err := task.LogTime(currentUser.ID, req.Hours, req.Description, req.LogDate); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "记录工时失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "工时记录成功"}))
+}
+
+func (h *Handlers) GetTimeLogs(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	timeLogs, err := models.GetTimeLogsByTask(uint(id))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取工时记录失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(timeLogs))
+}
+
+func (h *Handlers) LinkGiteaObject(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	var req LinkGiteaObjectRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	task, err := models.GetTaskByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "任务不存在"))
+		return
+	}
+
+	if err := task.LinkGiteaObject(req.RepoID, req.RepoName, req.RelationType, 
+		req.ObjectID, req.ObjectNumber, req.Title, req.URL); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "关联Gitea对象失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "关联成功"}))
+}
+
+func (h *Handlers) GetGiteaRelations(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的任务ID"))
+		return
+	}
+
+	relations, err := models.GetGiteaRelationsByTask(uint(id))
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取Gitea关联失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(relations))
+}

internal/api/handlers/users.go

@@ -0,0 +1,131 @@
+package handlers
+
+import (
+	"net/http"
+	"strconv"
+
+	"giteapm/internal/middleware"
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+func (h *Handlers) ListUsers(c *gin.Context) {
+	page, _ := strconv.Atoi(c.DefaultQuery("page", "1"))
+	limit, _ := strconv.Atoi(c.DefaultQuery("limit", "20"))
+	offset := (page - 1) * limit
+
+	users, total, err := models.ListUsers(offset, limit)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "获取用户列表失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, PaginatedSuccessResponse(users, total, page, limit))
+}
+
+func (h *Handlers) GetUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	user, err := models.GetUserByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "用户不存在"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}
+
+func (h *Handlers) UpdateUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	user, err := models.GetUserByID(uint(id))
+	if err != nil {
+		c.JSON(http.StatusNotFound, ErrorResponse(404, "用户不存在"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if fullName, ok := updateData["full_name"].(string); ok {
+		user.FullName = fullName
+	}
+	if email, ok := updateData["email"].(string); ok {
+		user.Email = email
+	}
+	if role, ok := updateData["role"].(string); ok {
+		user.Role = role
+	}
+
+	if err := models.UpdateUser(user); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}
+
+func (h *Handlers) DeleteUser(c *gin.Context) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 32)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "无效的用户ID"))
+		return
+	}
+
+	if err := models.DeleteUser(uint(id)); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "删除用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "删除成功"}))
+}
+
+func (h *Handlers) GetCurrentUser(c *gin.Context) {
+	user, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}
+
+func (h *Handlers) UpdateCurrentUser(c *gin.Context) {
+	user, err := middleware.GetCurrentUser(c)
+	if err != nil {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "获取当前用户失败"))
+		return
+	}
+
+	var updateData map[string]interface{}
+	if err := c.ShouldBindJSON(&updateData); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "请求参数无效"))
+		return
+	}
+
+	if fullName, ok := updateData["full_name"].(string); ok {
+		user.FullName = fullName
+	}
+	if email, ok := updateData["email"].(string); ok {
+		user.Email = email
+	}
+
+	if err := models.UpdateUser(user); err != nil {
+		c.JSON(http.StatusInternalServerError, ErrorResponse(500, "更新用户失败"))
+		return
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(user))
+}

internal/api/handlers/webhook.go

@@ -0,0 +1,218 @@
+package handlers
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"io"
+	"net/http"
+	"strconv"
+	"strings"
+
+	"giteapm/internal/models"
+
+	"github.com/gin-gonic/gin"
+)
+
+type GiteaWebhookPayload struct {
+	Action     string `json:"action"`
+	Number     int    `json:"number"`
+	Repository struct {
+		ID       int    `json:"id"`
+		Name     string `json:"name"`
+		FullName string `json:"full_name"`
+	} `json:"repository"`
+	PullRequest *struct {
+		ID     int    `json:"id"`
+		Number int    `json:"number"`
+		Title  string `json:"title"`
+		State  string `json:"state"`
+		HTMLURL string `json:"html_url"`
+	} `json:"pull_request,omitempty"`
+	Commits []struct {
+		ID      string `json:"id"`
+		Message string `json:"message"`
+		URL     string `json:"url"`
+	} `json:"commits,omitempty"`
+	Pusher struct {
+		ID       int    `json:"id"`
+		Username string `json:"username"`
+	} `json:"pusher,omitempty"`
+}
+
+func (h *Handlers) HandleGiteaWebhook(c *gin.Context) {
+	// 验证 webhook 签名
+	if !h.verifyWebhookSignature(c) {
+		c.JSON(http.StatusUnauthorized, ErrorResponse(401, "Invalid webhook signature"))
+		return
+	}
+
+	// 读取请求体
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "Failed to read request body"))
+		return
+	}
+
+	// 解析 payload
+	var payload GiteaWebhookPayload
+	if err := json.Unmarshal(body, &payload); err != nil {
+		c.JSON(http.StatusBadRequest, ErrorResponse(400, "Invalid JSON payload"))
+		return
+	}
+
+	// 获取事件类型
+	eventType := c.GetHeader("X-Gitea-Event")
+	
+	// 处理不同类型的事件
+	switch eventType {
+	case "push":
+		h.handlePushEvent(payload)
+	case "pull_request":
+		h.handlePullRequestEvent(payload)
+	case "issues":
+		h.handleIssueEvent(payload)
+	default:
+		// 忽略其他事件类型
+	}
+
+	c.JSON(http.StatusOK, SuccessResponse(gin.H{"message": "Webhook processed successfully"}))
+}
+
+func (h *Handlers) verifyWebhookSignature(c *gin.Context) bool {
+	signature := c.GetHeader("X-Gitea-Signature")
+	if signature == "" {
+		return false
+	}
+
+	// 读取请求体
+	body, err := io.ReadAll(c.Request.Body)
+	if err != nil {
+		return false
+	}
+
+	// 重新设置请求体，以便后续读取
+	c.Request.Body = io.NopCloser(strings.NewReader(string(body)))
+
+	// 计算 HMAC-SHA256
+	mac := hmac.New(sha256.New, []byte(h.Cfg.Gitea.WebhookSecret))
+	mac.Write(body)
+	expectedSignature := hex.EncodeToString(mac.Sum(nil))
+
+	// 比较签名
+	return hmac.Equal([]byte(signature), []byte(expectedSignature))
+}
+
+func (h *Handlers) handlePushEvent(payload GiteaWebhookPayload) {
+	// 处理推送事件
+	repoID := uint(payload.Repository.ID)
+	
+	for _, commit := range payload.Commits {
+		// 查找关联的任务
+		_, err := models.GetGiteaRelationsByRepo(repoID, "commit")
+		if err != nil {
+			continue
+		}
+
+		// 检查提交消息中是否包含任务引用（如 #123）
+		commitMessage := commit.Message
+		taskNumbers := extractTaskNumbers(commitMessage)
+
+		for _, taskNumber := range taskNumbers {
+			// 创建或更新 Git 关联
+			relation := &models.GiteaRelation{
+				GiteaRepoID:       repoID,
+				GiteaRepoName:     payload.Repository.FullName,
+				RelationType:      "commit",
+				GiteaObjectID:     commit.ID,
+				GiteaObjectTitle:  commitMessage,
+				GiteaObjectURL:    commit.URL,
+			}
+
+			// 根据任务号查找任务
+			if task := findTaskByNumber(taskNumber); task != nil {
+				relation.TaskID = task.ID
+				models.CreateGiteaRelation(relation)
+
+				// 可以根据提交消息自动更新任务状态
+				if strings.Contains(strings.ToLower(commitMessage), "fix") ||
+				   strings.Contains(strings.ToLower(commitMessage), "resolve") {
+					task.Status = "review"
+					models.UpdateTask(task)
+				}
+			}
+		}
+	}
+}
+
+func (h *Handlers) handlePullRequestEvent(payload GiteaWebhookPayload) {
+	if payload.PullRequest == nil {
+		return
+	}
+
+	pr := payload.PullRequest
+	repoID := uint(payload.Repository.ID)
+
+	// 检查 PR 标题中的任务引用
+	taskNumbers := extractTaskNumbers(pr.Title)
+
+	for _, taskNumber := range taskNumbers {
+		if task := findTaskByNumber(taskNumber); task != nil {
+			relation := &models.GiteaRelation{
+				TaskID:            task.ID,
+				GiteaRepoID:       repoID,
+				GiteaRepoName:     payload.Repository.FullName,
+				RelationType:      "pull_request",
+				GiteaObjectID:     strconv.Itoa(pr.ID),
+				GiteaObjectNumber: func() *uint { n := uint(pr.Number); return &n }(),
+				GiteaObjectTitle:  pr.Title,
+				GiteaObjectURL:    pr.HTMLURL,
+			}
+
+			models.CreateGiteaRelation(relation)
+
+			// 根据 PR 状态自动更新任务状态
+			switch payload.Action {
+			case "opened":
+				task.Status = "review"
+			case "closed":
+				if pr.State == "merged" {
+					task.Status = "done"
+				}
+			}
+			models.UpdateTask(task)
+		}
+	}
+}
+
+func (h *Handlers) handleIssueEvent(payload GiteaWebhookPayload) {
+	// 处理 Issue 事件，可以将 Gitea Issue 同步为任务
+	// 这里可以根据需要实现
+}
+
+// 从文本中提取任务编号（如 #123, fixes #456）
+func extractTaskNumbers(text string) []int {
+	var numbers []int
+	// 简单的正则匹配，实际可以使用更复杂的逻辑
+	words := strings.Fields(text)
+	for _, word := range words {
+		if strings.HasPrefix(word, "#") {
+			if num, err := strconv.Atoi(strings.TrimPrefix(word, "#")); err == nil {
+				numbers = append(numbers, num)
+			}
+		}
+	}
+	return numbers
+}
+
+// 根据任务编号查找任务（这里简化实现）
+func findTaskByNumber(taskNumber int) *models.Task {
+	// 这里应该实现根据任务编号查找任务的逻辑
+	// 可以在数据库中添加 task_number 字段，或者使用 ID
+	task, err := models.GetTaskByID(uint(taskNumber))
+	if err != nil {
+		return nil
+	}
+	return task
+}