# API

所有 JSON API 返回统一信封：

```json
{ "success": true, "data": {} }
```

写接口必须携带 `X-CSRF-Token`，值等于 `wm_csrf` cookie。HTML 页面会把 token 注入到 `window.WEMOMENTS_CONFIG.csrfToken`。

## Auth

```bash
curl -X POST http://localhost:8787/api/auth/register \
  -H "Content-Type: application/json" -H "X-CSRF-Token: <token>" \
  -d '{"username":"demo","email":"demo@example.com","password":"password123","displayName":"Demo"}'
```

- `POST /api/auth/register` `{ username, email, password, displayName }`
- `POST /api/auth/login` `{ identifier, password }`
- `POST /api/auth/logout`
- `GET /api/auth/me`
- `POST /api/auth/password` `{ oldPassword, newPassword }`

## Posts

- `GET /api/posts?cursor=&limit=20&author=&type=&q=`
- `GET /api/posts/:id`
- `POST /api/posts`
- `PATCH /api/posts/:id`
- `DELETE /api/posts/:id`
- `GET /api/posts/:id/edit`

发布示例：

```bash
curl -X POST http://localhost:8787/api/posts \
  -H "Content-Type: application/json" -H "X-CSRF-Token: <token>" \
  -d '{"type":"moment","visibility":"public","content":"hello","images":[],"isTop":false,"isAd":false}'
```

## Comments

- `GET /api/posts/:id/comments`
- `POST /api/comments` `{ postId, parentId?, content, guestName?, guestEmail?, guestUrl? }`
- `DELETE /api/comments/:id`

## Likes

- `POST /api/posts/:id/like`
- `DELETE /api/posts/:id/like`
- `GET /api/posts/:id/likes`

## Uploads

- `POST /api/uploads/sign` `{ kind, filename, size, mime }`
- `PUT /api/uploads/direct/:token`
- `POST /api/uploads/confirm` `{ key }`

`sign` 返回同源限时 PUT URL。前端将文件 `PUT` 到该 URL，Worker 校验 token、类型和大小后写入 R2。

## Links And Users

- `GET /api/links`
- `GET /api/users/:username`
- `PATCH /api/users/me`

## Admin API

所有 `/admin/api/**` 需要管理员权限，并写入 `wm_audit_log`。

- `POST /admin/api/users/:id/role` `{ role }`
- `POST /admin/api/users/:id/ban`
- `POST /admin/api/posts/bulk` `{ ids, action }`
- `POST /admin/api/settings` `{ key: value }`
- `POST /admin/api/comments/:id/status` `{ status }`
- `DELETE /admin/api/comments/:id`
- `POST /admin/api/links`
- `PATCH /admin/api/links/:id`
- `DELETE /admin/api/links/:id`
