cdrop — 跨 OS 剪贴板与文件传输服务

Commilitia Drop：自托管的跨设备剪贴板同步与点对点文件传输。

- 后端 Go（chi / SQLite WAL / SSE Hub / WebRTC signaling + 状态机 / Relay ring buffer），编译进单个 distroless 镜像（前端 go:embed）。
- 前端 React + TanStack Router + Zustand，自实现 SSE + WebRTC P2P，NAT 受阻时回退服务端中继；聚珍（Juzhen）CJK 综合排版。
- 桌面端 Wails v2（macOS / Windows），瘦客户端复用 web。
- 鉴权 OIDC PKCE（自建 Casdoor 等），refresh_token 信封加密存系统密钥库；iOS Shortcut 用 HS256 scoped token。

架构文档与变更记录见 docs 分支（PROJECT_BRIEF / FRONTEND_DESIGN / CHANGELOG）。

本次为公开发布初始提交：完整开发历史（含部署细节）留存于私有归档，公开仓库自此干净起步。

internal/db/shortcut_tokens.sql.go

@@ -0,0 +1,153 @@
+// Code generated by sqlc. DO NOT EDIT.
+// versions:
+//   sqlc v1.31.1
+// source: shortcut_tokens.sql
+
+package db
+
+import (
+	"context"
+)
+
+const countActiveShortcutTokensByUser = `-- name: CountActiveShortcutTokensByUser :one
+SELECT COUNT(*) FROM shortcut_tokens
+WHERE user_id = ? AND revoked = 0 AND expires_at > ?
+`
+
+type CountActiveShortcutTokensByUserParams struct {
+	UserID    string `json:"user_id"`
+	ExpiresAt int64  `json:"expires_at"`
+}
+
+func (q *Queries) CountActiveShortcutTokensByUser(ctx context.Context, arg CountActiveShortcutTokensByUserParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countActiveShortcutTokensByUser, arg.UserID, arg.ExpiresAt)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
+const getShortcutToken = `-- name: GetShortcutToken :one
+SELECT jti, user_id, label, scopes, created_at, expires_at, last_used_at, revoked
+FROM shortcut_tokens
+WHERE jti = ?
+`
+
+func (q *Queries) GetShortcutToken(ctx context.Context, jti string) (ShortcutToken, error) {
+	row := q.db.QueryRowContext(ctx, getShortcutToken, jti)
+	var i ShortcutToken
+	err := row.Scan(
+		&i.Jti,
+		&i.UserID,
+		&i.Label,
+		&i.Scopes,
+		&i.CreatedAt,
+		&i.ExpiresAt,
+		&i.LastUsedAt,
+		&i.Revoked,
+	)
+	return i, err
+}
+
+const insertShortcutToken = `-- name: InsertShortcutToken :exec
+
+INSERT INTO shortcut_tokens (jti, user_id, label, scopes, created_at, expires_at)
+VALUES (?, ?, ?, ?, ?, ?)
+`
+
+type InsertShortcutTokenParams struct {
+	Jti       string `json:"jti"`
+	UserID    string `json:"user_id"`
+	Label     string `json:"label"`
+	Scopes    string `json:"scopes"`
+	CreatedAt int64  `json:"created_at"`
+	ExpiresAt int64  `json:"expires_at"`
+}
+
+// shortcut_tokens: long-lived, scope-limited, revocable HS256 tokens for the
+// iOS Shortcut clipboard sync. Count backs the per-user cap; Revoke is scoped by
+// user_id to block cross-user revocation; Touch records last use asynchronously.
+func (q *Queries) InsertShortcutToken(ctx context.Context, arg InsertShortcutTokenParams) error {
+	_, err := q.db.ExecContext(ctx, insertShortcutToken,
+		arg.Jti,
+		arg.UserID,
+		arg.Label,
+		arg.Scopes,
+		arg.CreatedAt,
+		arg.ExpiresAt,
+	)
+	return err
+}
+
+const listShortcutTokensByUser = `-- name: ListShortcutTokensByUser :many
+SELECT jti, user_id, label, scopes, created_at, expires_at, last_used_at, revoked
+FROM shortcut_tokens
+WHERE user_id = ?
+ORDER BY created_at DESC
+`
+
+func (q *Queries) ListShortcutTokensByUser(ctx context.Context, userID string) ([]ShortcutToken, error) {
+	rows, err := q.db.QueryContext(ctx, listShortcutTokensByUser, userID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []ShortcutToken
+	for rows.Next() {
+		var i ShortcutToken
+		if err := rows.Scan(
+			&i.Jti,
+			&i.UserID,
+			&i.Label,
+			&i.Scopes,
+			&i.CreatedAt,
+			&i.ExpiresAt,
+			&i.LastUsedAt,
+			&i.Revoked,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
+const revokeShortcutToken = `-- name: RevokeShortcutToken :execrows
+UPDATE shortcut_tokens
+SET revoked = 1
+WHERE jti = ? AND user_id = ?
+`
+
+type RevokeShortcutTokenParams struct {
+	Jti    string `json:"jti"`
+	UserID string `json:"user_id"`
+}
+
+func (q *Queries) RevokeShortcutToken(ctx context.Context, arg RevokeShortcutTokenParams) (int64, error) {
+	result, err := q.db.ExecContext(ctx, revokeShortcutToken, arg.Jti, arg.UserID)
+	if err != nil {
+		return 0, err
+	}
+	return result.RowsAffected()
+}
+
+const touchShortcutTokenUsed = `-- name: TouchShortcutTokenUsed :exec
+UPDATE shortcut_tokens
+SET last_used_at = ?
+WHERE jti = ?
+`
+
+type TouchShortcutTokenUsedParams struct {
+	LastUsedAt *int64 `json:"last_used_at"`
+	Jti        string `json:"jti"`
+}
+
+func (q *Queries) TouchShortcutTokenUsed(ctx context.Context, arg TouchShortcutTokenUsedParams) error {
+	_, err := q.db.ExecContext(ctx, touchShortcutTokenUsed, arg.LastUsedAt, arg.Jti)
+	return err
+}