初始提交: ScriptForge 脚本快速转运行链接服务

- Go 后端 (Gin + GORM + SQLite) 提供 API 和纯文本脚本服务 - Vite + React + TypeScript + Tailwind 前端 - 单二进制部署 (Go embed 前端静态文件) - Gitea Actions CI/CD: 打标签自动构建多平台 Release - 支持 bash/zsh/sh/fish/python3/node/ruby/php 8种运行环境 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-05-28 23:48:19 +08:00
commit 10a200b96c
37 changed files with 4400 additions and 0 deletions
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -0,0 +1,129 @@
+package main
+
+import (
+	"io/fs"
+	"log"
+	"net/http"
+	"os"
+	"os/signal"
+	"strings"
+	"syscall"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"gorm.io/driver/sqlite"
+	"gorm.io/gorm"
+
+	"gitea.kmux.cn/zhilv/scriptforge/internal/assets"
+	"gitea.kmux.cn/zhilv/scriptforge/internal/handler"
+	"gitea.kmux.cn/zhilv/scriptforge/internal/middleware"
+	"gitea.kmux.cn/zhilv/scriptforge/internal/model"
+	"gitea.kmux.cn/zhilv/scriptforge/internal/service"
+)
+
+func main() {
+	gin.SetMode(gin.ReleaseMode)
+
+	db := initDB()
+	syncDB(db)
+	svc := service.NewScriptService(db)
+
+	go cleanupLoop(svc)
+
+	r := gin.New()
+	r.Use(gin.Recovery(), middleware.Logger())
+
+	api := r.Group("/api")
+	{
+		api.Use(middleware.RateLimit(60))
+		api.POST("/scripts", middleware.RateLimit(10), handler.CreateScript(svc))
+		api.GET("/scripts/:id", handler.GetScript(svc))
+		api.DELETE("/scripts/:id", handler.DeleteScript(svc))
+	}
+
+	r.GET("/raw/:id", handler.GetRawScript(svc))
+	r.GET("/health", func(c *gin.Context) {
+		c.JSON(http.StatusOK, gin.H{"status": "ok"})
+	})
+
+	serveStaticOrSPA(r)
+
+	port := getPort()
+	log.Printf("Listening on :%s", port)
+	go func() {
+		if err := r.Run(":" + port); err != nil {
+			log.Fatalf("server error: %v", err)
+		}
+	}()
+
+	quit := make(chan os.Signal, 1)
+	signal.Notify(quit, syscall.SIGINT, syscall.SIGTERM)
+	<-quit
+	log.Println("Shutting down...")
+}
+
+func initDB() *gorm.DB {
+	dbPath := os.Getenv("DB_PATH")
+	if dbPath == "" {
+		dbPath = "scriptforge.db"
+	}
+	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{})
+	if err != nil {
+		log.Fatalf("failed to connect database: %v", err)
+	}
+	return db
+}
+
+func syncDB(db *gorm.DB) {
+	if err := db.AutoMigrate(&model.Script{}); err != nil {
+		log.Fatalf("failed to migrate database: %v", err)
+	}
+}
+
+func cleanupLoop(svc *service.ScriptService) {
+	for {
+		time.Sleep(1 * time.Hour)
+		if n, err := svc.CleanupExpired(); err != nil {
+			log.Printf("cleanup error: %v", err)
+		} else if n > 0 {
+			log.Printf("cleaned up %d expired scripts", n)
+		}
+	}
+}
+
+func getPort() string {
+	if p := os.Getenv("PORT"); p != "" {
+		return p
+	}
+	return "8080"
+}
+
+func serveStaticOrSPA(r *gin.Engine) {
+	staticFS, err := fs.Sub(assets.FS, "dist")
+	if err != nil {
+		log.Printf("no embedded static files, API-only mode: %v", err)
+		return
+	}
+
+	r.NoRoute(func(c *gin.Context) {
+		path := c.Request.URL.Path
+
+		if strings.HasPrefix(path, "/api") || strings.HasPrefix(path, "/raw") {
+			c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+			return
+		}
+
+		file, err := staticFS.Open(path)
+		if err != nil {
+			c.FileFromFS("index.html", http.FS(staticFS))
+			return
+		}
+		file.Close()
+
+		c.FileFromFS(path, http.FS(staticFS))
+	})
+
+	r.GET("/", func(c *gin.Context) {
+		c.FileFromFS("index.html", http.FS(staticFS))
+	})
+}
--- a/backend/go.mod
+++ b/backend/go.mod
@@ -0,0 +1,41 @@
+module gitea.kmux.cn/zhilv/scriptforge
+
+go 1.22
+
+require (
+	github.com/gin-gonic/gin v1.10.0
+	gorm.io/driver/sqlite v1.5.6
+	gorm.io/gorm v1.25.11
+)
+
+require (
+	github.com/bytedance/sonic v1.11.6 // indirect
+	github.com/bytedance/sonic/loader v0.1.1 // indirect
+	github.com/cloudwego/base64x v0.1.4 // indirect
+	github.com/cloudwego/iasm v0.2.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.3 // indirect
+	github.com/gin-contrib/sse v0.1.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
+	github.com/go-playground/validator/v10 v10.20.0 // indirect
+	github.com/goccy/go-json v0.10.2 // indirect
+	github.com/jinzhu/inflection v1.0.0 // indirect
+	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/klauspost/cpuid/v2 v2.2.7 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
+	github.com/mattn/go-isatty v0.0.20 // indirect
+	github.com/mattn/go-sqlite3 v1.14.22 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.2 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
+	github.com/ugorji/go/codec v1.2.12 // indirect
+	golang.org/x/arch v0.8.0 // indirect
+	golang.org/x/crypto v0.23.0 // indirect
+	golang.org/x/net v0.25.0 // indirect
+	golang.org/x/sys v0.20.0 // indirect
+	golang.org/x/text v0.15.0 // indirect
+	google.golang.org/protobuf v1.34.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
--- a/backend/go.sum
+++ b/backend/go.sum
@@ -0,0 +1,99 @@
+github.com/bytedance/sonic v1.11.6 h1:oUp34TzMlL+OY1OUWxHqsdkgC/Zfc85zGqw9siXjrc0=
+github.com/bytedance/sonic v1.11.6/go.mod h1:LysEHSvpvDySVdC2f87zGWf6CIKJcAvqab1ZaiQtds4=
+github.com/bytedance/sonic/loader v0.1.1 h1:c+e5Pt1k/cy5wMveRDyk2X4B9hF4g7an8N3zCYjJFNM=
+github.com/bytedance/sonic/loader v0.1.1/go.mod h1:ncP89zfokxS5LZrJxl5z0UJcsk4M4yY2JpfqGeCtNLU=
+github.com/cloudwego/base64x v0.1.4 h1:jwCgWpFanWmN8xoIUHa2rtzmkd5J2plF/dnLS6Xd/0Y=
+github.com/cloudwego/base64x v0.1.4/go.mod h1:0zlkT4Wn5C6NdauXdJRhSKRlJvmclQ1hhJgA0rcu/8w=
+github.com/cloudwego/iasm v0.2.0 h1:1KNIy1I1H9hNNFEEH3DVnI4UujN+1zjpuk6gwHLTssg=
+github.com/cloudwego/iasm v0.2.0/go.mod h1:8rXZaNYT2n95jn+zTI1sDr+IgcD2GVs0nlbbQPiEFhY=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/gabriel-vasile/mimetype v1.4.3 h1:in2uUcidCuFcDKtdcBxlR0rJ1+fsokWf+uqxgUFjbI0=
+github.com/gabriel-vasile/mimetype v1.4.3/go.mod h1:d8uq/6HKRL6CGdk+aubisF/M5GcPfT7nKyLpA0lbSSk=
+github.com/gin-contrib/sse v0.1.0 h1:Y/yl/+YNO8GZSjAhjMsSuLt29uWRFHdHYUb5lYOV9qE=
+github.com/gin-contrib/sse v0.1.0/go.mod h1:RHrZQHXnP2xjPF+u1gW/2HnVO7nvIa9PG3Gm+fLHvGI=
+github.com/gin-gonic/gin v1.10.0 h1:nTuyha1TYqgedzytsKYqna+DfLos46nTv2ygFy86HFU=
+github.com/gin-gonic/gin v1.10.0/go.mod h1:4PMNQiOhvDRa013RKVbsiNwoyezlm2rm0uX/T7kzp5Y=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.20.0 h1:K9ISHbSaI0lyB2eWMPJo+kOS/FBExVwjEviJTixqxL8=
+github.com/go-playground/validator/v10 v10.20.0/go.mod h1:dbuPbCMFw/DrkbEynArYaCwl3amGuJotoKCe95atGMM=
+github.com/goccy/go-json v0.10.2 h1:CrxCmQqYDkv1z7lO7Wbh2HN93uovUHgrECaO5ZrCXAU=
+github.com/goccy/go-json v0.10.2/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
+github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/jinzhu/inflection v1.0.0 h1:K317FqzuhWc8YvSVlFMCCUb36O/S9MCKRDI7QkRKD/E=
+github.com/jinzhu/inflection v1.0.0/go.mod h1:h+uFLlag+Qp1Va5pdKtLDYj+kHp5pxUVkryuEj+Srlc=
+github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
+github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
+github.com/klauspost/cpuid/v2 v2.2.7 h1:ZWSB3igEs+d0qvnxR/ZBzXVmxkgt8DdzP6m9pfuVLDM=
+github.com/klauspost/cpuid/v2 v2.2.7/go.mod h1:Lcz8mBdAVJIBVzewtcLocK12l3Y+JytZYpaMropDUws=
+github.com/knz/go-libedit v1.10.1/go.mod h1:MZTVkCWyz0oBc7JOWP3wNAzd002ZbM/5hgShxwh4x8M=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
+github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
+github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
+github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
+github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2 h1:xBagoLtFs94CBntxluKeaWgTMpvLxC4ur3nMaC9Gz0M=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pelletier/go-toml/v2 v2.2.2 h1:aYUidT7k73Pcl9nb2gScu7NSrKCSHIDE89b3+6Wq+LM=
+github.com/pelletier/go-toml/v2 v2.2.2/go.mod h1:1t835xjRzz80PqgE6HHgN2JOsmgYu/h4qDAS4n929Rs=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
+github.com/stretchr/objx v0.5.0/go.mod h1:Yh+to48EsGEfYuaHDzXPcE3xhTkx73EhmCGUpEOglKo=
+github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
+github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
+github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS4MhqMhdFk5YI=
+github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
+github.com/ugorji/go/codec v1.2.12 h1:9LC83zGrHhuUA9l16C9AHXAqEV/2wBQ4nkvumAE65EE=
+github.com/ugorji/go/codec v1.2.12/go.mod h1:UNopzCgEMSXjBc6AOMqYvWC1ktqTAfzJZUZgYf6w6lg=
+golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8=
+golang.org/x/arch v0.8.0 h1:3wRIsP3pM4yUptoR96otTUOXI367OS0+c9eeRi9doIc=
+golang.org/x/arch v0.8.0/go.mod h1:FEVrYAQjsQXMVJ1nsMoVVXPZg6p2JE2mx8psSWTDQys=
+golang.org/x/crypto v0.23.0 h1:dIJU/v2J8Mdglj/8rJ6UUOM3Zc9zLZxVZwwxMooUSAI=
+golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
+golang.org/x/net v0.25.0 h1:d/OCCoBEUq33pjydKrGQhw7IlUPI2Oylr+8qLx49kac=
+golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
+golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
+golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.15.0 h1:h1V/4gjBv8v9cjcR6+AR5+/cIYK5N/WAgiv4xlsEtAk=
+golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
+golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+google.golang.org/protobuf v1.34.1 h1:9ddQBjfCyZPOHPUiPxpYESBLc+T8P3E+Vo4IbKZgFWg=
+google.golang.org/protobuf v1.34.1/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gorm.io/driver/sqlite v1.5.6 h1:fO/X46qn5NUEEOZtnjJRWRzZMe8nqJiQ9E+0hi+hKQE=
+gorm.io/driver/sqlite v1.5.6/go.mod h1:U+J8craQU6Fzkcvu8oLeAQmi50TkwPEhHDEjQZXDah4=
+gorm.io/gorm v1.25.11 h1:/Wfyg1B/je1hnDx3sMkX+gAlxrlZpn6X0BXRlwXlvHg=
+gorm.io/gorm v1.25.11/go.mod h1:xh7N7RHfYlNc5EmcI/El95gXusucDrQnHXe0+CgWcLQ=
+nullprogram.com/x/optparse v1.0.0/go.mod h1:KdyPE+Igbe0jQUrVfMqDMeJQIJZEuyV7pjYmp6pbG50=
+rsc.io/pdf v0.1.1/go.mod h1:n8OzWcQ6Sp37PL01nO98y4iUCRdTGarVfzxY20ICaU4=
--- a/backend/internal/assets/assets.go
+++ b/backend/internal/assets/assets.go
@@ -0,0 +1,6 @@
+package assets
+
+import "embed"
+
+//go:embed dist/*
+var FS embed.FS
--- a/backend/internal/assets/dist/.gitkeep
+++ b/backend/internal/assets/dist/.gitkeep
--- a/backend/internal/config/runtime.go
+++ b/backend/internal/config/runtime.go
@@ -0,0 +1,37 @@
+package config
+
+type RuntimeConfig struct {
+	Name      string
+	Extension string
+	MIMEType  string
+}
+
+var Runtimes = []RuntimeConfig{
+	{Name: "bash", Extension: ".sh", MIMEType: "text/x-shellscript"},
+	{Name: "zsh", Extension: ".zsh", MIMEType: "text/x-shellscript"},
+	{Name: "sh", Extension: ".sh", MIMEType: "text/x-shellscript"},
+	{Name: "fish", Extension: ".fish", MIMEType: "text/x-shellscript"},
+	{Name: "python3", Extension: ".py", MIMEType: "text/x-python"},
+	{Name: "node", Extension: ".js", MIMEType: "text/javascript"},
+	{Name: "ruby", Extension: ".rb", MIMEType: "text/x-ruby"},
+	{Name: "php", Extension: ".php", MIMEType: "text/x-php"},
+}
+
+var RuntimeMap map[string]RuntimeConfig
+
+func init() {
+	RuntimeMap = make(map[string]RuntimeConfig, len(Runtimes))
+	for _, rt := range Runtimes {
+		RuntimeMap[rt.Name] = rt
+	}
+}
+
+func IsValidRuntime(name string) bool {
+	_, ok := RuntimeMap[name]
+	return ok
+}
+
+func GetRuntime(name string) (RuntimeConfig, bool) {
+	rt, ok := RuntimeMap[name]
+	return rt, ok
+}
--- a/backend/internal/handler/raw.go
+++ b/backend/internal/handler/raw.go
@@ -0,0 +1,41 @@
+package handler
+
+import (
+	"errors"
+	"fmt"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+
+	"gitea.kmux.cn/zhilv/scriptforge/internal/config"
+	"gitea.kmux.cn/zhilv/scriptforge/internal/service"
+)
+
+func GetRawScript(svc *service.ScriptService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		id := c.Param("id")
+
+		script, err := svc.GetByID(id)
+		if errors.Is(err, service.ErrNotFound) {
+			c.String(http.StatusNotFound, "script not found or expired\n")
+			return
+		}
+		if err != nil {
+			c.String(http.StatusInternalServerError, "internal error\n")
+			return
+		}
+
+		rt, _ := config.GetRuntime(script.Runtime)
+		mime := rt.MIMEType
+		ext := rt.Extension
+		if mime == "" {
+			mime = "text/plain"
+			ext = ".sh"
+		}
+
+		c.Header("Content-Type", mime+"; charset=utf-8")
+		c.Header("Content-Disposition", fmt.Sprintf(`attachment; filename="script%s"`, ext))
+		c.Header("X-Content-Type-Options", "nosniff")
+		c.String(http.StatusOK, script.Content)
+	}
+}
--- a/backend/internal/handler/script.go
+++ b/backend/internal/handler/script.go
@@ -0,0 +1,103 @@
+package handler
+
+import (
+	"errors"
+	"net/http"
+	"strings"
+
+	"github.com/gin-gonic/gin"
+
+	"gitea.kmux.cn/zhilv/scriptforge/internal/service"
+)
+
+type createRequest struct {
+	Content   string `json:"content" binding:"required,max=16384"`
+	Runtime   string `json:"runtime" binding:"required"`
+	ExpiresIn string `json:"expires_in" binding:"required,oneof=1h 24h 7d 30d"`
+}
+
+func CreateScript(svc *service.ScriptService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		var req createRequest
+		if err := c.ShouldBindJSON(&req); err != nil {
+			c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+			return
+		}
+
+		scheme := "https"
+		if strings.HasPrefix(c.Request.Host, "localhost") || strings.HasPrefix(c.Request.Host, "127.0.0.1") {
+			scheme = "http"
+		}
+
+		result, err := svc.Create(service.CreateInput{
+			Content:   req.Content,
+			Runtime:   req.Runtime,
+			ExpiresIn: req.ExpiresIn,
+		}, scheme, c.Request.Host)
+
+		if errors.Is(err, service.ErrInvalidRuntime) {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "invalid runtime, supported: bash, zsh, sh, fish, python3, node, ruby, php"})
+			return
+		}
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
+			return
+		}
+
+		c.JSON(http.StatusCreated, gin.H{
+			"id":          result.Script.ID,
+			"admin_token": result.AdminToken,
+			"url":         result.RawURL,
+			"command":     result.Command,
+			"runtime":     result.Script.Runtime,
+			"expires_at":  result.Script.ExpiresAt,
+		})
+	}
+}
+
+func GetScript(svc *service.ScriptService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		id := c.Param("id")
+
+		script, err := svc.GetByID(id)
+		if errors.Is(err, service.ErrNotFound) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "script not found or expired"})
+			return
+		}
+		if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
+			return
+		}
+
+		c.JSON(http.StatusOK, gin.H{
+			"id":             script.ID,
+			"runtime":        script.Runtime,
+			"content":        script.Content,
+			"content_length": len(script.Content),
+			"created_at":     script.CreatedAt,
+			"expires_at":     script.ExpiresAt,
+			"expired":        false,
+		})
+	}
+}
+
+func DeleteScript(svc *service.ScriptService) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		id := c.Param("id")
+		token := c.Query("token")
+		if token == "" {
+			c.JSON(http.StatusBadRequest, gin.H{"error": "token query parameter is required"})
+			return
+		}
+
+		if err := svc.Delete(id, token); errors.Is(err, service.ErrNotFound) {
+			c.JSON(http.StatusNotFound, gin.H{"error": "script not found or invalid token"})
+			return
+		} else if err != nil {
+			c.JSON(http.StatusInternalServerError, gin.H{"error": "internal error"})
+			return
+		}
+
+		c.Status(http.StatusNoContent)
+	}
+}
--- a/backend/internal/idgen/idgen.go
+++ b/backend/internal/idgen/idgen.go
@@ -0,0 +1,30 @@
+package idgen
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"math/big"
+)
+
+const idChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"
+
+func GenerateID(length int) (string, error) {
+	result := make([]byte, length)
+	for i := range result {
+		n, err := rand.Int(rand.Reader, big.NewInt(int64(len(idChars))))
+		if err != nil {
+			return "", err
+		}
+		result[i] = idChars[n.Int64()]
+	}
+	return string(result), nil
+}
+
+func GenerateToken() (string, error) {
+	token := make([]byte, 48)
+	_, err := rand.Read(token)
+	if err != nil {
+		return "", err
+	}
+	return base64.URLEncoding.EncodeToString(token), nil
+}
--- a/backend/internal/middleware/logger.go
+++ b/backend/internal/middleware/logger.go
@@ -0,0 +1,21 @@
+package middleware
+
+import (
+	"log"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func Logger() gin.HandlerFunc {
+	return func(c *gin.Context) {
+		start := time.Now()
+		path := c.Request.URL.Path
+
+		c.Next()
+
+		latency := time.Since(start)
+		status := c.Writer.Status()
+		log.Printf("[%d] %s %s (%s)", status, c.Request.Method, path, latency)
+	}
+}
--- a/backend/internal/middleware/ratelimit.go
+++ b/backend/internal/middleware/ratelimit.go
@@ -0,0 +1,89 @@
+package middleware
+
+import (
+	"net/http"
+	"sync"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+type visitor struct {
+	count    int
+	lastSeen time.Time
+}
+
+type rateLimiter struct {
+	visitors map[string]*visitor
+	mu       sync.Mutex
+	limit    int
+	window   time.Duration
+}
+
+func newRateLimiter(limit int, window time.Duration) *rateLimiter {
+	rl := &rateLimiter{
+		visitors: make(map[string]*visitor),
+		limit:    limit,
+		window:   window,
+	}
+	go rl.cleanup()
+	return rl
+}
+
+func (rl *rateLimiter) allow(ip string) bool {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+
+	v, exists := rl.visitors[ip]
+	if !exists {
+		rl.visitors[ip] = &visitor{count: 1, lastSeen: time.Now()}
+		return true
+	}
+
+	if time.Since(v.lastSeen) > rl.window {
+		v.count = 1
+		v.lastSeen = time.Now()
+		return true
+	}
+
+	v.count++
+	v.lastSeen = time.Now()
+	return v.count <= rl.limit
+}
+
+func (rl *rateLimiter) cleanup() {
+	for {
+		time.Sleep(10 * time.Minute)
+		rl.mu.Lock()
+		for ip, v := range rl.visitors {
+			if time.Since(v.lastSeen) > rl.window*2 {
+				delete(rl.visitors, ip)
+			}
+		}
+		rl.mu.Unlock()
+	}
+}
+
+var (
+	createLimiter   = newRateLimiter(10, 1*time.Minute)
+	generalLimiter  = newRateLimiter(60, 1*time.Minute)
+)
+
+func RateLimit(limit int) gin.HandlerFunc {
+	if limit == 10 {
+		return func(c *gin.Context) {
+			if !createLimiter.allow(c.ClientIP()) {
+				c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"error": "rate limit exceeded"})
+				return
+			}
+			c.Next()
+		}
+	}
+	return func(c *gin.Context) {
+		if !generalLimiter.allow(c.ClientIP()) {
+			c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{"error": "rate limit exceeded"})
+			return
+		}
+		c.Next()
+	}
+}
--- a/backend/internal/model/script.go
+++ b/backend/internal/model/script.go
@@ -0,0 +1,12 @@
+package model
+
+import "time"
+
+type Script struct {
+	ID         string    `gorm:"primaryKey;size:8"`
+	Content    string    `gorm:"type:text;not null"`
+	Runtime    string    `gorm:"size:16;not null;index"`
+	AdminToken string    `gorm:"size:64;not null"`
+	ExpiresAt  time.Time `gorm:"not null;index"`
+	CreatedAt  time.Time `gorm:"not null;autoCreateTime"`
+}
--- a/backend/internal/service/script.go
+++ b/backend/internal/service/script.go
@@ -0,0 +1,113 @@
+package service
+
+import (
+	"errors"
+	"time"
+
+	"gorm.io/gorm"
+
+	"gitea.kmux.cn/zhilv/scriptforge/internal/config"
+	"gitea.kmux.cn/zhilv/scriptforge/internal/idgen"
+	"gitea.kmux.cn/zhilv/scriptforge/internal/model"
+)
+
+var (
+	ErrInvalidRuntime = errors.New("invalid runtime")
+	ErrNotFound       = errors.New("script not found or expired")
+)
+
+type ScriptService struct {
+	db *gorm.DB
+}
+
+func NewScriptService(db *gorm.DB) *ScriptService {
+	return &ScriptService{db: db}
+}
+
+type CreateInput struct {
+	Content   string
+	Runtime   string
+	ExpiresIn string
+}
+
+type CreateResult struct {
+	Script     model.Script
+	AdminToken string
+	Command    string
+	RawURL     string
+}
+
+func (s *ScriptService) Create(input CreateInput, scheme, host string) (*CreateResult, error) {
+	if !config.IsValidRuntime(input.Runtime) {
+		return nil, ErrInvalidRuntime
+	}
+
+	var d time.Duration
+	switch input.ExpiresIn {
+	case "1h":
+		d = 1 * time.Hour
+	case "24h":
+		d = 24 * time.Hour
+	case "7d":
+		d = 7 * 24 * time.Hour
+	case "30d":
+		d = 30 * 24 * time.Hour
+	default:
+		d = 24 * time.Hour
+	}
+
+	id, err := idgen.GenerateID(8)
+	if err != nil {
+		return nil, err
+	}
+
+	adminToken, err := idgen.GenerateToken()
+	if err != nil {
+		return nil, err
+	}
+
+	script := model.Script{
+		ID:         id,
+		Content:    input.Content,
+		Runtime:    input.Runtime,
+		AdminToken: adminToken,
+		ExpiresAt:  time.Now().Add(d),
+		CreatedAt:  time.Now(),
+	}
+
+	if err := s.db.Create(&script).Error; err != nil {
+		return nil, err
+	}
+
+	rawURL := scheme + "://" + host + "/raw/" + id
+	command := "curl " + rawURL + " | " + input.Runtime
+
+	return &CreateResult{
+		Script:     script,
+		AdminToken: adminToken,
+		Command:    command,
+		RawURL:     rawURL,
+	}, nil
+}
+
+func (s *ScriptService) GetByID(id string) (*model.Script, error) {
+	var script model.Script
+	err := s.db.Where("id = ? AND expires_at > ?", id, time.Now()).First(&script).Error
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		return nil, ErrNotFound
+	}
+	return &script, err
+}
+
+func (s *ScriptService) Delete(id, token string) error {
+	result := s.db.Where("id = ? AND admin_token = ?", id, token).Delete(&model.Script{})
+	if result.RowsAffected == 0 {
+		return ErrNotFound
+	}
+	return result.Error
+}
+
+func (s *ScriptService) CleanupExpired() (int64, error) {
+	result := s.db.Where("expires_at <= ?", time.Now()).Delete(&model.Script{})
+	return result.RowsAffected, result.Error
+}