build: 升级go版本到1.26并添加限流中间件

1.  调整go.mod将Go版本升级至1.26
2.  新增速率限制和并发限制中间件，将其加入路由中间件链
3.  重构TTS处理逻辑，将限流逻辑迁移至中间件统一处理
4.  优化CORS中间件代码，移除冗余日志和格式调整

middleware/cors.go

@@ -1,4 +1,4 @@
-package middleware
+package middleware
 
 import (
 	"log"
@@ -8,8 +8,8 @@ import (
 )
 
 var (
-	allowedOrigins  []string
-	allowAllOrigins bool
+	allowedOrigins   []string
+	allowAllOrigins  bool
 	corsMaxAgeHeader = "86400"
 )
 
@@ -46,9 +46,6 @@ func InitCORSConfig() {
 	}
 	if len(allowedOrigins) > 0 {
 		log.Printf("已配置 %d 个允许的跨域来源白名单", len(allowedOrigins))
-		for _, o := range allowedOrigins {
-			log.Printf("  - %s", o)
-		}
 	}
 }
 
@@ -56,9 +53,7 @@ func isValidOrigin(origin string) bool {
 	if origin == "" || origin == "null" || origin == "nil" {
 		return false
 	}
-	// 使用小写比较，避免大小写问题
-	lowerOrigin := strings.ToLower(origin)
-	if !strings.HasPrefix(lowerOrigin, "http://") && !strings.HasPrefix(lowerOrigin, "https://") {
+	if !strings.HasPrefix(origin, "http://") && !strings.HasPrefix(origin, "https://") {
 		return false
 	}
 	return true
@@ -66,28 +61,24 @@ func isValidOrigin(origin string) bool {
 
 func matchOrigin(origin string) (string, bool) {
 	if !isValidOrigin(origin) {
-		log.Printf("[CORS] Origin %q 验证失败", origin)
 		return "", false
 	}
 	if allowAllOrigins {
-		log.Printf("[CORS] Origin %q 匹配 allowAllOrigins", origin)
 		return "*", true
 	}
 	normalized := normalizeOrigin(origin)
-	log.Printf("[CORS] 检查 origin %q (normalized: %q) 对比白名单: %v", origin, normalized, allowedOrigins)
 	for _, allowed := range allowedOrigins {
 		if allowed == normalized {
-			log.Printf("[CORS] Origin %q 匹配白名单 %q", origin, allowed)
 			return origin, true
 		}
 	}
-	log.Printf("[CORS] Origin %q 未匹配任何白名单", origin)
 	return "", false
 }
 
 func CORS(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		origin := r.Header.Get("Origin")
+		isPreflight := r.Method == http.MethodOptions
 
 		if origin != "" {
 			allowOrigin, matched := matchOrigin(origin)
@@ -107,16 +98,20 @@ func CORS(next http.Handler) http.Handler {
 					w.Header().Set("Vary", vary+", Origin")
 				}
 			} else {
-				log.Printf("CORS拦截: 来源=%q 路径=%s 方法=%s 客户端IP=%s",
+				log.Printf("CORS拦截: 来源=%q 路径=%s 方法=%s 客户端=%s",
 					origin, r.URL.Path, r.Method, GetClientIP(r))
+				if isPreflight {
+					w.WriteHeader(http.StatusForbidden)
+					return
+				}
 			}
 		}
 
-		if r.Method == http.MethodOptions {
+		if isPreflight {
 			w.WriteHeader(http.StatusNoContent)
 			return
 		}
 
 		next.ServeHTTP(w, r)
 	})
-}
+}