feat: require advanced permission for large uploads

app.go

@@ -27,6 +27,7 @@ import (
 )
 
 const sessionCookie = "ufile_session"
+const basicUploadMaxSize = 10 * 1024 * 1024
 
 var usernamePattern = regexp.MustCompile(`^[A-Za-z0-9_.-]{3,32}$`)
 var pickupCodePattern = regexp.MustCompile(`^[0-9]{6}$`)
@@ -397,6 +398,10 @@ func (a *App) uploadFile(c *gin.Context) {
 		c.JSON(http.StatusBadRequest, gin.H{"error": "请选择文件"})
 		return
 	}
+	if header.Size > basicUploadMaxSize && !user.CanAdvancedUpload {
+		c.JSON(http.StatusForbidden, gin.H{"error": "超过 10 MB 的文件需要高级上传权限"})
+		return
+	}
 
 	a.uploadMu.Lock()
 	defer a.uploadMu.Unlock()