Document legacy RSA encryption compatibility

Signed-off-by: Sean Du <do4suki@gmail.com>
Report configuration and HTTP startup failures
2026-07-13 08:03:23 +08:00 · 2026-07-13 08:03:20 +08:00 · 2026-07-13 08:03:18 +08:00 · 2026-07-13 08:03:15 +08:00 · 2026-07-13 08:03:12 +08:00 · 2026-07-13 08:03:10 +08:00
636 changed files with 4025 additions and 569 deletions
@@ -2,7 +2,7 @@ package config

 import (
 	"encoding/json"
-	"honoka-chan/pkg/utils"
+	"fmt"
 	"os"
 	"strconv"
 	"time"
@@ -28,8 +28,13 @@ type Settings struct {
 	UnlockAllSpecialRotation bool   `json:"unlock_all_special_rotation"`
 }

-func InitConfig() {
-	Conf = Load("./config.json")
+func InitConfig() error {
+	conf, err := Load("./config.json")
+	if err != nil {
+		return err
+	}
+	Conf = conf
+	return nil
 }

 func DefaultConfigs() *AppConfigs {
@@ -43,26 +48,39 @@ func DefaultConfigs() *AppConfigs {
 	}
 }

-func Load(p string) *AppConfigs {
-	if !utils.PathExists(p) {
-		_ = DefaultConfigs().Save(p)
+func Load(p string) (*AppConfigs, error) {
+	data, err := os.ReadFile(p)
+	if os.IsNotExist(err) {
+		conf := DefaultConfigs()
+		if err := conf.Save(p); err != nil {
+			return nil, fmt.Errorf("create default config: %w", err)
+		}
+		return conf, nil
 	}
-	c := AppConfigs{}
-	err := json.Unmarshal([]byte(utils.ReadAllText(p)), &c)
 	if err != nil {
-		_ = os.Rename(p, p+".backup"+strconv.FormatInt(time.Now().Unix(), 10))
-		_ = DefaultConfigs().Save(p)
+		return nil, fmt.Errorf("read config: %w", err)
 	}
-	c = AppConfigs{}
-	_ = json.Unmarshal([]byte(utils.ReadAllText(p)), &c)
-	return &c
+
+	c := AppConfigs{}
+	if err := json.Unmarshal(data, &c); err == nil {
+		return &c, nil
+	}
+
+	backup := p + ".backup" + strconv.FormatInt(time.Now().Unix(), 10)
+	if err := os.Rename(p, backup); err != nil {
+		return nil, fmt.Errorf("backup invalid config: %w", err)
+	}
+	conf := DefaultConfigs()
+	if err := conf.Save(p); err != nil {
+		return nil, fmt.Errorf("write default config: %w", err)
+	}
+	return conf, nil
 }

 func (c *AppConfigs) Save(p string) error {
-	data, err := json.MarshalIndent(c, "", "	")
+	data, err := json.MarshalIndent(c, "", "    ")
 	if err != nil {
 		return err
 	}
-	utils.WriteAllText(p, string(data)+"\n")
-	return nil
+	return os.WriteFile(p, append(data, '\n'), 0644)
 }
@@ -0,0 +1,50 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestLoadCreatesDefaultConfig(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "config.json")
+
+	conf, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if conf.Settings.ListenPort != "8080" {
+		t.Fatalf("ListenPort = %q, want 8080", conf.Settings.ListenPort)
+	}
+	if _, err := os.Stat(path); err != nil {
+		t.Fatalf("default config was not written: %v", err)
+	}
+}
+
+func TestLoadBacksUpInvalidConfig(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "config.json")
+	if err := os.WriteFile(path, []byte("{"), 0644); err != nil {
+		t.Fatalf("write invalid config: %v", err)
+	}
+
+	conf, err := Load(path)
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if conf.Settings.ListenPort != "8080" {
+		t.Fatalf("ListenPort = %q, want 8080", conf.Settings.ListenPort)
+	}
+
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("ReadDir: %v", err)
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), "config.json.backup") {
+			return
+		}
+	}
+	t.Fatal("invalid config backup was not created")
+}
@@ -8,9 +8,9 @@ require (
 	github.com/gin-contrib/sessions v1.1.0
 	github.com/go-think/openssl v1.20.0
 	github.com/tidwall/gjson v1.19.0
-	modernc.org/sqlite v1.51.0
+	modernc.org/sqlite v1.53.0
 	xorm.io/builder v0.3.13
-	xorm.io/xorm v1.3.11
+	xorm.io/xorm v1.4.0
 )

 require (
@@ -29,15 +29,14 @@ require (
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/ncruces/go-strftime v1.0.0 // indirect
 	github.com/quic-go/qpack v0.6.0 // indirect
-	github.com/quic-go/quic-go v0.59.1 // indirect
+	github.com/quic-go/quic-go v0.60.0 // indirect
 	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
 	github.com/tidwall/match v1.2.0 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
-	go.mongodb.org/mongo-driver/v2 v2.6.0 // indirect
-	golang.org/x/arch v0.27.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
-	modernc.org/libc v1.72.5 // indirect
+	go.mongodb.org/mongo-driver/v2 v2.7.0 // indirect
+	golang.org/x/arch v0.28.0 // indirect
+	modernc.org/libc v1.73.5 // indirect
 	modernc.org/mathutil v1.7.1 // indirect
 	modernc.org/memory v1.11.0 // indirect
 )
@@ -53,13 +52,13 @@ require (
 	github.com/mattn/go-isatty v0.0.22 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.4.2 // indirect
 	github.com/syndtr/goleveldb v1.0.0 // indirect
 	github.com/ugorji/go/codec v1.3.1 // indirect
-	golang.org/x/crypto v0.52.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
-	golang.org/x/text v0.37.0 // indirect
+	golang.org/x/crypto v0.53.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
+	golang.org/x/text v0.38.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
@@ -85,14 +85,16 @@ github.com/onsi/ginkgo v1.7.0 h1:WSHQ+IS43OoUrWtD1/bbclrwK8TTH5hzp+umCiuxHgs=
 github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
 github.com/onsi/gomega v1.4.3 h1:RE1xgDvH7imwFD45h+u2SgIfERHlS2yNG4DObb5BSKU=
 github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
-github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
-github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
+github.com/pelletier/go-toml/v2 v2.4.2 h1:M2fKKbmyvI+hGId/D0W64qDBMVhJnNR10O5gIbMc//Q=
+github.com/pelletier/go-toml/v2 v2.4.2/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0 h1:APacT+iIaNF6fd8AGEiN3bT/Jtkd2jz4v4TzM7MFjy0=
+github.com/quic-go/go-ossfuzz-seeds v0.1.0/go.mod h1:3IOHRbJIc+L6YKMwfDtJAM9Vj9k0YY4muhuyUYk5tbk=
 github.com/quic-go/qpack v0.6.0 h1:g7W+BMYynC1LbYLSqRt8PBg5Tgwxn214ZZR34VIOjz8=
 github.com/quic-go/qpack v0.6.0/go.mod h1:lUpLKChi8njB4ty2bFLX2x4gzDqXwUpaO1DP9qMDZII=
-github.com/quic-go/quic-go v0.59.1 h1:0Gmua0HW1Tv7ANR7hUYwRyD0MG5OJfgvYSZasGZzBic=
-github.com/quic-go/quic-go v0.59.1/go.mod h1:upnsH4Ju1YkqpLXC305eW3yDZ4NfnNbmQRCMWS58IKU=
+github.com/quic-go/quic-go v0.60.0 h1:xcQioE8OM66UQLeUMHltK1CCcOu3JbVB4JAQdDQSB+0=
+github.com/quic-go/quic-go v0.60.0/go.mod h1:wpKpjmPpftl30sL6pFh7REVpjbcCVy4zt2vDyK1TuJk=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE=
 github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
@@ -118,30 +120,30 @@ github.com/twitchyliquid64/golang-asm v0.15.1 h1:SU5vSMR7hnwNxj24w34ZyCi/FmDZTkS
 github.com/twitchyliquid64/golang-asm v0.15.1/go.mod h1:a1lVb/DtPvCB8fslRZhAngC2+aY1QWCk3Cedj/Gdt08=
 github.com/ugorji/go/codec v1.3.1 h1:waO7eEiFDwidsBN6agj1vJQ4AG7lh2yqXyOXqhgQuyY=
 github.com/ugorji/go/codec v1.3.1/go.mod h1:pRBVtBSKl77K30Bv8R2P+cLSGaTtex6fsA2Wjqmfxj4=
-go.mongodb.org/mongo-driver/v2 v2.6.0 h1:b9sJOYrkmt4l8bY43ZenFBcPlhYIjaOfYHLtbB/5qi8=
-go.mongodb.org/mongo-driver/v2 v2.6.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
+go.mongodb.org/mongo-driver/v2 v2.7.0 h1:RO+zqavD2/GCL3cxOMyZhx6R9Irzr8/6gsoqx5tcY/c=
+go.mongodb.org/mongo-driver/v2 v2.7.0/go.mod h1:yOI9kBsufol30iFsl1slpdq1I0eHPzybRWdyYUs8K/0=
 go.uber.org/mock v0.6.0 h1:hyF9dfmbgIX5EfOdasqLsWD6xqpNZlXblLB/Dbnwv3Y=
 go.uber.org/mock v0.6.0/go.mod h1:KiVJ4BqZJaMj4svdfmHM0AUx4NJYO8ZNpPnZn1Z+BBU=
-golang.org/x/arch v0.27.0 h1:0WNVcR8u9yFz8j5FvdHpgwNp3FS5U4guYdzHwEiGjoU=
-golang.org/x/arch v0.27.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/arch v0.28.0 h1:wVwVdqsTuUbJvhYVCspQYwZXHNYeLSoZnmHD+ggddpQ=
+golang.org/x/arch v0.28.0/go.mod h1:0X+GdSIP+kL5wPmpK7sdkEVTt2XoYP0cSjQSbZBwOi8=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/tools v0.46.0 h1:7jTurBkPZu4moS/Uy4OQT1M+QBlsj3wejyZwsT8Z7rk=
+golang.org/x/tools v0.46.0/go.mod h1:FrD85F8l+NWL+9XWBSyVSHO6Ne4jutsfIFba7AWQ5Ys=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
@@ -155,20 +157,20 @@ gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-modernc.org/cc/v4 v4.28.2 h1:3tQ0lf2ADtoby2EtSP+J7IE2SHwEJdP8ioR59wx7XpY=
-modernc.org/cc/v4 v4.28.2/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
-modernc.org/ccgo/v4 v4.34.2 h1:mxsy2FdrB6+qG3NfXefz1AmWv0ehOSDO4jxgxd7h9yo=
-modernc.org/ccgo/v4 v4.34.2/go.mod h1:1L7us56+kAKu04p25EATpmBBvhbcqqZ85ibqWVwVgog=
+modernc.org/cc/v4 v4.29.0 h1:CXgwL8cvxmyzBQZzbSl/6xFtMCryb6u8IOqDci39cgc=
+modernc.org/cc/v4 v4.29.0/go.mod h1:OnovgIhbbMXMu1aISnJ0wvVD1KnW+cAUJkIrAWh+kVI=
+modernc.org/ccgo/v4 v4.34.5 h1:hcwnthv2/LBl+mRLOYwnQA/LuW44Oln1NQlWppNaS1Q=
+modernc.org/ccgo/v4 v4.34.5/go.mod h1:aow0HNkO30OSA/2NrtDXkis92ff8ZFiDOmDOPhqhF8U=
 modernc.org/fileutil v1.4.0 h1:j6ZzNTftVS054gi281TyLjHPp6CPHr2KCxEXjEbD6SM=
 modernc.org/fileutil v1.4.0/go.mod h1:EqdKFDxiByqxLk8ozOxObDSfcVOv/54xDs/DUHdvCUU=
 modernc.org/gc/v2 v2.6.5 h1:nyqdV8q46KvTpZlsw66kWqwXRHdjIlJOhG6kxiV/9xI=
 modernc.org/gc/v2 v2.6.5/go.mod h1:YgIahr1ypgfe7chRuJi2gD7DBQiKSLMPgBQe9oIiito=
-modernc.org/gc/v3 v3.1.3 h1:6QAplYyVO+KdPW3pGnqmJDUxtkec8ooEWvks/hhU3lc=
-modernc.org/gc/v3 v3.1.3/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
+modernc.org/gc/v3 v3.1.4 h1:2g65LGVSmFQrXeITAw97x7hCRvZFcyE1uDP+7Vng7JI=
+modernc.org/gc/v3 v3.1.4/go.mod h1:HFK/6AGESC7Ex+EZJhJ2Gni6cTaYpSMmU/cT9RmlfYY=
 modernc.org/goabi0 v0.2.0 h1:HvEowk7LxcPd0eq6mVOAEMai46V+i7Jrj13t4AzuNks=
 modernc.org/goabi0 v0.2.0/go.mod h1:CEFRnnJhKvWT1c1JTI3Avm+tgOWbkOu5oPA8eH8LnMI=
-modernc.org/libc v1.72.5 h1:m2OGx9Ser1VvTS4Z9ZJlWs+CBMxutLaTiAWkNz+NB9U=
-modernc.org/libc v1.72.5/go.mod h1:np0N7KDJ7eUtMZmOqVZNldrZyG+DHLl2B5pg8Hbar3U=
+modernc.org/libc v1.73.5 h1:G34rN/cRqL+zOUnrbz9uPq/+OxJ8/vzQ2CQwTJ42Wmw=
+modernc.org/libc v1.73.5/go.mod h1:+Aoyx4M0etg6GikzCrip1VtvAtUlMlo2Aq+GHwQSqOA=
 modernc.org/mathutil v1.7.1 h1:GCZVGXdaN8gTqB1Mf/usp1Y/hSqgI2vAGGP4jZMCxOU=
 modernc.org/mathutil v1.7.1/go.mod h1:4p5IwJITfppl0G4sUEDtCr4DthTaT47/N3aT6MhfgJg=
 modernc.org/memory v1.11.0 h1:o4QC8aMQzmcwCK3t3Ux/ZHmwFPzE6hf2Y5LbkRs+hbI=
@@ -177,13 +179,13 @@ modernc.org/opt v0.2.0 h1:tGyef5ApycA7FSEOMraay9SaTk5zmbx7Tu+cJs4QKZg=
 modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns=
 modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w=
 modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE=
-modernc.org/sqlite v1.51.0 h1:aH/MMSoayAIhozZ7uJbVTT9QO/VhzBf0J9tymmmuC/U=
-modernc.org/sqlite v1.51.0/go.mod h1:tcNzv5p84E0skkmJn038y+hWJbLQXQqEnQfeh5r2JLM=
+modernc.org/sqlite v1.53.0 h1:20WG8N9q4ji/dEqGk4uiI0c6OPjSeLTNYGFCc3+7c1M=
+modernc.org/sqlite v1.53.0/go.mod h1:xoEpOIpGrgT48H5iiyt/YXPCZPEzlfmfFwtk8Lklw8s=
 modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0=
 modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A=
 modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y=
 modernc.org/token v1.1.0/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
 xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=
 xorm.io/builder v0.3.13/go.mod h1:aUW0S9eb9VCaPohFCH3j7czOx1PMW3i1HrSzbLYGBSE=
-xorm.io/xorm v1.3.11 h1:i4tlVUASogb0ZZFJHA7dZqoRU2pUpUsutnNdaOlFyMI=
-xorm.io/xorm v1.3.11/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
+xorm.io/xorm v1.4.0 h1:MOZfMAH09FlAnpXcGHp6jS+Np1u9DL/qvRjoW+4YITY=
+xorm.io/xorm v1.4.0/go.mod h1:cs0ePc8O4a0jD78cNvD+0VFwhqotTvLQZv372QsDw7Q=
@@ -4,8 +4,9 @@ type ErrorCode int

 // https://github.com/DarkEnergyProcessor/NPPS4/blob/master/npps4/idol/error.py
 const (
-	ErrorCodeUnknown                 ErrorCode = 1
 	ErrorCodeNoUnitIsSellable        ErrorCode = 1205
 	ErrorCodeLivePreciseListNotFound ErrorCode = 3421
 	ErrorCodeEventNoEventData        ErrorCode = 10004
 )
+
+const ErrorCodeAcceptableError = 600
@@ -0,0 +1,46 @@
+package achievement
+
+import (
+	apiachievement "honoka-chan/internal/handler/api/achievement"
+	"honoka-chan/internal/middleware"
+	"honoka-chan/internal/router"
+	achievementschema "honoka-chan/internal/schema/achievement"
+	"honoka-chan/internal/session"
+	honokautils "honoka-chan/internal/utils"
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+const pagingAccomplishedPageSize = 10
+
+func pagingAccomplishedList(ctx *gin.Context) {
+	ss := session.Get(ctx)
+	defer ss.FinalizeOrRollback()
+
+	req := achievementschema.PagingAccomplishedListReq{}
+	err := honokautils.ParseRequestData(ctx, &req)
+	if ss.CheckErr(err) {
+		return
+	}
+
+	grouped, err := apiachievement.ListVisibleAccomplishedAchievements(ss)
+	if ss.CheckErr(err) {
+		return
+	}
+
+	items := grouped[req.FilterCategoryID]
+	start := min(max(req.FromCount, 0), len(items))
+
+	end := min(start+pagingAccomplishedPageSize, len(items))
+
+	ss.Respond(achievementschema.PagingAccomplishedListResp{
+		ResponseData: items[start:end],
+		ReleaseInfo:  []any{},
+		StatusCode:   http.StatusOK,
+	})
+}
+
+func init() {
+	router.AddHandler("main.php", "POST", "/achievement/pagingAccomplishedList", middleware.Common, pagingAccomplishedList)
+}
@@ -5,13 +5,14 @@ import (
 	"honoka-chan/internal/router"
 	albumschema "honoka-chan/internal/schema/album"
 	"honoka-chan/internal/session"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func seriesAll(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	var albumID []int
 	err := ss.MainEng.Table("album_series_m").Select("album_series_id").Find(&albumID)
@@ -81,7 +82,7 @@ func seriesAll(ctx *gin.Context) {
 	ss.Respond(albumschema.SeriesAllResp{
 		ResponseData: albumSeriesAllRes,
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -5,6 +5,7 @@ import (
 	"honoka-chan/internal/router"
 	announceschema "honoka-chan/internal/schema/announce"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -12,7 +13,7 @@ import (

 func checkState(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	ss.Respond(announceschema.CheckStateDataResp{
 		ResponseData: announceschema.CheckStateData{
@@ -20,7 +21,7 @@ func checkState(ctx *gin.Context) {
 			ServerTimestamp:   time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -0,0 +1,30 @@
+package achievement
+
+import (
+	honokautils "honoka-chan/internal/utils"
+
+	"github.com/gin-gonic/gin"
+)
+
+var achievementFilterCategoryList = []int{
+	1, // 重要
+	3, // 挑战
+	4, // 每日
+	5, // 期间限定
+	6, // 8周年限定/全世界5000万人突破纪念
+	7, // 回忆画廊
+	8, // 9周年限定
+	9, // 连携课题
+}
+
+func AchievementApi(ctx *gin.Context, action string) (res any, err error) {
+	switch action {
+	case "unaccomplishList":
+		res, err = unaccomplishList()
+	case "initialAccomplishedList":
+		res, err = initialAccomplishedList(ctx)
+	default:
+		err = honokautils.NewUnimplementedActionError("achievement", action)
+	}
+	return res, err
+}
@@ -0,0 +1,118 @@
+package achievement
+
+import (
+	"fmt"
+	achievementapischema "honoka-chan/internal/schema/api/achievement"
+	"honoka-chan/internal/session"
+	"sort"
+	"strings"
+	"time"
+)
+
+type achievementRow struct {
+	AchievementID               int `xorm:"achievement_id"`
+	AchievementFilterCategoryID int `xorm:"achievement_filter_category_id"`
+	DisplayFlag                 int `xorm:"display_flag"`
+	StartDate                   string
+	EndDate                     *string
+}
+
+func ListVisibleAccomplishedAchievements(ss *session.Session) (map[int][]achievementapischema.AchievementListItem, error) {
+	var achievementList []achievementRow
+	err := ss.MainEng.Table("achievement_m").
+		Cols("achievement_id,achievement_filter_category_id,display_flag,start_date,end_date").
+		Where("display_flag = ?", 1).
+		Find(&achievementList)
+	if err != nil {
+		return nil, err
+	}
+
+	now := time.Now()
+	grouped := make(map[int][]achievementapischema.AchievementListItem, len(achievementFilterCategoryList))
+	for _, achievement := range achievementList {
+		if !isAchievementVisible(now, achievement.StartDate, achievement.EndDate) {
+			continue
+		}
+
+		grouped[achievement.AchievementFilterCategoryID] = append(
+			grouped[achievement.AchievementFilterCategoryID],
+			achievementapischema.AchievementListItem{
+				AchievementID:  achievement.AchievementID,
+				Count:          1,
+				IsAccomplished: true,
+				InsertDate:     normalizeAchievementDate(achievement.StartDate),
+				EndDate:        normalizeAchievementDatePtr(achievement.EndDate),
+				RemainingTime:  "",
+				IsNew:          false,
+				ForDisplay:     achievement.DisplayFlag != 0,
+				RewardList: []achievementapischema.AchievementRewardItem{
+					{
+						AddType: 3001,
+						ItemID:  4,
+						Amount:  1,
+					},
+				},
+			},
+		)
+	}
+
+	for filterCategoryID, items := range grouped {
+		sort.Slice(items, func(i, j int) bool {
+			return items[i].InsertDate > items[j].InsertDate
+		})
+		grouped[filterCategoryID] = items
+	}
+
+	return grouped, nil
+}
+
+func normalizeAchievementDate(value string) string {
+	if value == "" {
+		return "1970-01-01 00:00:00"
+	}
+
+	return strings.ReplaceAll(value, "/", "-")
+}
+
+func normalizeAchievementDatePtr(value *string) *string {
+	if value == nil || *value == "" {
+		return nil
+	}
+
+	normalized := normalizeAchievementDate(*value)
+	return &normalized
+}
+
+func isAchievementVisible(now time.Time, startDate string, endDate *string) bool {
+	start, err := parseAchievementTime(startDate)
+	if err == nil && now.Before(start) {
+		return false
+	}
+
+	if endDate == nil || *endDate == "" {
+		return true
+	}
+
+	end, err := parseAchievementTime(*endDate)
+	if err != nil {
+		return true
+	}
+
+	return !now.After(end)
+}
+
+func parseAchievementTime(value string) (time.Time, error) {
+	layouts := []string{
+		"2006/01/02 15:04:05",
+		"2006/1/2 15:04:05",
+	}
+
+	for _, layout := range layouts {
+		parsed, err := time.ParseInLocation(layout, value, time.Local)
+		if err == nil {
+			return parsed, nil
+		}
+	}
+
+	return time.Time{}, fmt.Errorf("invalid achievement time: %s", value)
+}
@@ -0,0 +1,45 @@
+package achievement
+
+import (
+	achievementapischema "honoka-chan/internal/schema/api/achievement"
+	"honoka-chan/internal/session"
+	"net/http"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+func initialAccomplishedList(ctx *gin.Context) (res any, err error) {
+	ss := session.Get(ctx)
+
+	grouped, err := ListVisibleAccomplishedAchievements(ss)
+	if err != nil {
+		return nil, err
+	}
+
+	listData := make([]achievementapischema.UnaccomplishListData, 0, len(achievementFilterCategoryList))
+	for _, filterCategoryID := range achievementFilterCategoryList {
+		achievementItems := grouped[filterCategoryID]
+		if achievementItems == nil {
+			achievementItems = []achievementapischema.AchievementListItem{}
+		} else {
+			if len(achievementItems) > 5 {
+				achievementItems = achievementItems[:5]
+			}
+		}
+
+		listData = append(listData, achievementapischema.UnaccomplishListData{
+			FilterCategoryID: filterCategoryID,
+			AchievementList:  achievementItems,
+			Count:            len(grouped[filterCategoryID]),
+			IsLast:           true,
+		})
+	}
+
+	return achievementapischema.UnaccomplishListResp{
+		Result:     listData,
+		Status:     http.StatusOK,
+		CommandNum: false,
+		TimeStamp:  time.Now().Unix(),
+	}, nil
+}
@@ -0,0 +1,28 @@
+package achievement
+
+import (
+	achievementapischema "honoka-chan/internal/schema/api/achievement"
+	"net/http"
+	"time"
+)
+
+func unaccomplishList() (res any, err error) {
+	listData := make([]achievementapischema.UnaccomplishListData, 0, len(achievementFilterCategoryList))
+	for i := range achievementFilterCategoryList {
+		listData = append(listData, achievementapischema.UnaccomplishListData{
+			FilterCategoryID: achievementFilterCategoryList[i],
+			AchievementList:  []achievementapischema.AchievementListItem{},
+			Count:            0,
+			IsLast:           true,
+		})
+	}
+
+	res = achievementapischema.UnaccomplishListResp{
+		Result:     listData,
+		Status:     http.StatusOK,
+		CommandNum: false,
+		TimeStamp:  time.Now().Unix(),
+	}
+
+	return res, nil
+}
@@ -3,6 +3,7 @@ package album
 import (
 	albumapischema "honoka-chan/internal/schema/api/album"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -61,7 +62,7 @@ func albumAll(ctx *gin.Context) (res any, err error) {

 	res = albumapischema.AllResp{
 		Result:     albumLists,
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -1,7 +1,7 @@
 package api

 import (
-	"honoka-chan/internal/constant"
+	"honoka-chan/internal/handler/api/achievement"
 	"honoka-chan/internal/handler/api/album"
 	"honoka-chan/internal/handler/api/award"
 	"honoka-chan/internal/handler/api/background"
@@ -32,17 +32,16 @@ import (
 	"honoka-chan/internal/middleware"
 	"honoka-chan/internal/router"
 	apischema "honoka-chan/internal/schema/api"
-	commonschema "honoka-chan/internal/schema/common"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
-	"time"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func api(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	apiReq := []apischema.ApiReq{}
 	err := honokautils.ParseRequestData(ctx, &apiReq)
@@ -57,6 +56,8 @@ func api(ctx *gin.Context) {
 		switch v.Module {
 		case "album":
 			result, err = album.AlbumApi(ctx, v.Action)
+		case "achievement":
+			result, err = achievement.AchievementApi(ctx, v.Action)
 		case "award":
 			result, err = award.AwardApi(ctx, v.Action)
 		case "background":
@@ -114,15 +115,8 @@ func api(ctx *gin.Context) {
 		}

 		if honokautils.IsUnimplementedError(err) {
-			results = append(results, commonschema.ApiErrorResp{
-				Result: commonschema.ErrorData{
-					ErrorCode: constant.ErrorCodeUnknown,
-				},
-				Status:     600,
-				CommandNum: false,
-				TimeStamp:  time.Now().Unix(),
-			})
-			continue
+			ss.AbortWithStatus(http.StatusNotFound, honokautils.NewDetailContent(err.Error()))
+			return
 		}
 		if ss.CheckErr(err) {
 			return
@@ -133,7 +127,7 @@ func api(ctx *gin.Context) {
 	apiResp := apischema.ApiResp{
 		ResponseData: results,
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	}

 	ss.Respond(apiResp)
@@ -3,6 +3,7 @@ package award
 import (
 	awardapischema "honoka-chan/internal/schema/api/award"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -40,7 +41,7 @@ func awardInfo(ctx *gin.Context) (res any, err error) {
 		Result: awardapischema.InfoData{
 			AwardInfo: awardsList,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package background
 import (
 	backgroundapischema "honoka-chan/internal/schema/api/background"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -40,7 +41,7 @@ func backgroundInfo(ctx *gin.Context) (res any, err error) {
 		Result: backgroundapischema.InfoData{
 			BackgroundInfo: backgroundsList,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package banner

 import (
 	bannerapischema "honoka-chan/internal/schema/api/banner"
+	"net/http"
 	"time"
 )

@@ -63,7 +64,7 @@ func bannerList() (res any, err error) {
 				},
 			},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,13 +2,14 @@ package challenge

 import (
 	challengeapischema "honoka-chan/internal/schema/api/challenge"
+	"net/http"
 	"time"
 )

 func challengeInfo() (res any, err error) {
 	res = challengeapischema.InfoResp{
 		Result:     []any{},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package costume

 import (
 	costumeapischema "honoka-chan/internal/schema/api/costume"
+	"net/http"
 	"time"
 )

@@ -10,7 +11,7 @@ func costumeList() (res any, err error) {
 		Result: costumeapischema.ListData{
 			CostumeList: []costumeapischema.CostumeList{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -4,6 +4,7 @@ import (
 	"fmt"
 	eventscenarioapischema "honoka-chan/internal/schema/api/eventscenario"
 	"honoka-chan/internal/session"
+	"net/http"
 	"strings"
 	"time"

@@ -71,7 +72,7 @@ func eventScenarioStatus(ctx *gin.Context) (res any, err error) {
 		Result: eventscenarioapischema.StatusData{
 			EventScenarioList: eventsList,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package exchange
 import (
 	exchangeapischema "honoka-chan/internal/schema/api/exchange"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -28,7 +29,7 @@ func owningPoint(ctx *gin.Context) (res any, err error) {
 		Result: exchangeapischema.OwningPointData{
 			ExchangePointList: exPointsList,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package item
 import (
 	itemapischema "honoka-chan/internal/schema/api/item"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"
 )

@@ -14,7 +15,7 @@ func itemList() (res any, err error) {

 	res = itemapischema.ListResp{
 		Result:     itemData,
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package live
 import (
 	liveapischema "honoka-chan/internal/schema/api/live"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -36,7 +37,7 @@ func liveSchedule(ctx *gin.Context) (res any, err error) {
 			FreeLiveList:           []any{},
 			TrainingLiveList:       []liveapischema.TrainingLiveList{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package live
 import (
 	liveapischema "honoka-chan/internal/schema/api/live"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -46,7 +47,7 @@ func liveStatus(ctx *gin.Context) (res any, err error) {
 			FreeLiveStatusList:     []any{},
 			CanResumeLive:          true,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package liveicon

 import (
 	liveiconapischema "honoka-chan/internal/schema/api/liveicon"
+	"net/http"
 	"time"
 )

@@ -10,7 +11,7 @@ func liveIconInfo() (res any, err error) {
 		Result: liveiconapischema.InfoData{
 			LiveNotesIconList: []int{1, 2, 3},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package livese

 import (
 	liveseapischema "honoka-chan/internal/schema/api/livese"
+	"net/http"
 	"time"
 )

@@ -10,7 +11,7 @@ func LiveSeInfo() (res any, err error) {
 		Result: liveseapischema.InfoData{
 			LiveSeList: []int{1, 2, 3},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -4,6 +4,7 @@ import (
 	usermodel "honoka-chan/internal/model/user"
 	loginapischema "honoka-chan/internal/schema/api/login"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -68,7 +69,7 @@ func loginTopInfo(ctx *gin.Context) (res any, err error) {
 			AdFlag:            false,
 			HasAdReward:       false,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  now.Unix(),
 	}
@@ -3,6 +3,7 @@ package login
 import (
 	loginapischema "honoka-chan/internal/schema/api/login"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -36,7 +37,7 @@ func loginTopInfoOnce(ctx *gin.Context) (res any, err error) {
 			ArenaSiSkillUniqueCheck: true,
 			OpenV98:                 true,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,13 +2,14 @@ package marathon

 import (
 	marathonapischema "honoka-chan/internal/schema/api/marathon"
+	"net/http"
 	"time"
 )

 func marathonInfo() (res any, err error) {
 	res = marathonapischema.InfoResp{
 		Result:     []any{},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package multiunit
 import (
 	multiunitapischema "honoka-chan/internal/schema/api/multiunit"
 	"honoka-chan/internal/session"
+	"net/http"
 	"strings"
 	"time"

@@ -53,7 +54,7 @@ func MultiUnitScenarioStatus(ctx *gin.Context) (res any, err error) {
 			MultiUnitScenarioStatusList:  multiUnitsList,
 			UnlockedMultiUnitScenarioIds: []any{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package museum
 import (
 	museumapischema "honoka-chan/internal/schema/api/museum"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -42,7 +43,7 @@ func museumInfo(ctx *gin.Context) (res any, err error) {
 				ContentsIDList: museumID,
 			},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package navigation

 import (
 	navigationapischema "honoka-chan/internal/schema/api/navigation"
+	"net/http"
 	"time"
 )

@@ -10,7 +11,7 @@ func SpecialCutin() (res any, err error) {
 		Result: navigationapischema.SpecialCutinData{
 			SpecialCutinList: []any{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package notice

 import (
 	noticeapischema "honoka-chan/internal/schema/api/notice"
+	"net/http"
 	"time"
 )

@@ -11,7 +12,7 @@ func noticeMarquee() (res any, err error) {
 			ItemCount:   0,
 			MarqueeList: []any{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package payment
 import (
 	paymentapischema "honoka-chan/internal/schema/api/payment"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -27,7 +28,7 @@ func productList(ctx *gin.Context) (res any, err error) {
 			SubscriptionList: []paymentapischema.Subscription{},
 			ShowPointShop:    false,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package profile
 import (
 	profileapischema "honoka-chan/internal/schema/api/profile"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"
 )

@@ -14,7 +15,7 @@ func cardRanking() (res any, err error) {

 	res = profileapischema.CardRankingResp{
 		Result:     cardRankingData,
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -6,6 +6,7 @@ import (
 	usermodel "honoka-chan/internal/model/user"
 	profileapischema "honoka-chan/internal/schema/api/profile"
 	"honoka-chan/internal/session"
+	"net/http"
 	"strconv"
 	"time"

@@ -89,7 +90,7 @@ func profileInfo(ctx *gin.Context, targetUserID int) (res any, err error) {
 			SettingAwardID:      targetPref.AwardID,
 			SettingBackgroundID: targetPref.BackgroundID,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -325,17 +326,7 @@ func getAccessoryInfo(ss *session.Session, targetUserID, unitOwningUserID int) (
 		return nil, nil
 	}

-	accessoryData := struct {
-		AccessoryID int `xorm:"accessory_id"`
-		Exp         int `xorm:"exp"`
-	}{}
-	has, err = ss.MainEng.Table("common_accessory_m").
-		Where("accessory_owning_user_id = ?", accessoryOwningID).
-		Cols("accessory_id,exp").
-		Get(&accessoryData)
-	if err != nil {
-		return nil, err
-	}
+	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserIDForUser(targetUserID, accessoryOwningID)
 	if !has {
 		return nil, nil
 	}
@@ -345,9 +336,9 @@ func getAccessoryInfo(ss *session.Session, targetUserID, unitOwningUserID int) (
 		AccessoryID:           accessoryData.AccessoryID,
 		Exp:                   accessoryData.Exp,
 		NextExp:               0,
-		Level:                 8,
-		MaxLevel:              8,
-		RankUpCount:           4,
+		Level:                 accessoryData.MaxLevel,
+		MaxLevel:              accessoryData.MaxLevel,
+		RankUpCount:           accessoryData.MaxLevel - accessoryData.DefaultMaxLevel,
 		FavoriteFlag:          true,
 	}, nil
 }
@@ -4,6 +4,7 @@ import (
 	usermodel "honoka-chan/internal/model/user"
 	profileapischema "honoka-chan/internal/schema/api/profile"
 	"honoka-chan/internal/session"
+	"net/http"
 	"sort"
 	"time"

@@ -82,7 +83,7 @@ func liveCnt(ctx *gin.Context, targetUserID int) (res any, err error) {

 	res = profileapischema.LiveCntResp{
 		Result:     result,
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package reward

 import (
 	rewardapischema "honoka-chan/internal/schema/api/reward"
+	"net/http"
 	"time"
 )

@@ -12,7 +13,7 @@ func rewardHistory() (res any, err error) {
 			Limit:     20,
 			History:   []any{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package reward

 import (
 	rewardapischema "honoka-chan/internal/schema/api/reward"
+	"net/http"
 	"time"
 )

@@ -13,7 +14,7 @@ func rewardList() (res any, err error) {
 			Order:     0,
 			Items:     []any{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package scenario
 import (
 	scenarioapischema "honoka-chan/internal/schema/api/scenario"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -28,7 +29,7 @@ func scenarioStatus(ctx *gin.Context) (res any, err error) {
 		Result: scenarioapischema.StatusData{
 			ScenarioStatusList: scenarioLists,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package secretbox
 import (
 	secretboxapischema "honoka-chan/internal/schema/api/secretbox"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"
 )

@@ -35,7 +36,7 @@ func all() (res any, err error) {

 	res = secretboxapischema.AllResp{
 		Result:     secretBoxData,
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package stamp
 import (
 	stampapischema "honoka-chan/internal/schema/api/stamp"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"
 )

@@ -14,7 +15,7 @@ func stampInfo() (res any, err error) {

 	res = stampapischema.InfoResp{
 		Result:     stampData,
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package subscenario
 import (
 	subscenarioapischema "honoka-chan/internal/schema/api/subscenario"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -29,7 +30,7 @@ func subscenarioStatus(ctx *gin.Context) (res any, err error) {
 			SubscenarioStatusList:  subScenarioLists,
 			UnlockedSubscenarioIds: []any{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package unit
 import (
 	unitapischema "honoka-chan/internal/schema/api/unit"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -12,7 +13,7 @@ func unitAccessoryAll(ctx *gin.Context) (res any, err error) {
 	ss := session.Get(ctx)

 	accessoryList := []unitapischema.AccessoryList{}
-	err = ss.MainEng.Table("common_accessory_m").Find(&accessoryList)
+	err = ss.UserEng.Table("user_accessory").Where("user_id = ?", ss.UserID).Find(&accessoryList)
 	if err != nil {
 		return nil, err
 	}
@@ -34,7 +35,7 @@ func unitAccessoryAll(ctx *gin.Context) (res any, err error) {
 			WearingInfo:        wearingInfo,
 			EspecialCreateFlag: false,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,13 +2,14 @@ package unit

 import (
 	unitapischema "honoka-chan/internal/schema/api/unit"
+	"net/http"
 	"time"
 )

 func unitAccessoryMaterialAll() (res any, err error) {
 	res = unitapischema.AccessoryMaterialAllResp{
 		Result:     unitapischema.AccessoryMaterialAllData{},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package unit
 import (
 	unitapischema "honoka-chan/internal/schema/api/unit"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"
 )

@@ -16,7 +17,7 @@ func unitAccessoryTab() (res any, err error) {
 		Result: unitapischema.AccessoryTabData{
 			TabList: tabList,
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -4,6 +4,7 @@ import (
 	unitmodel "honoka-chan/internal/model/unit"
 	unitapischema "honoka-chan/internal/schema/api/unit"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -55,7 +56,7 @@ func unitAll(ctx *gin.Context) (res any, err error) {
 			Active:  unitsData,
 			Waiting: []unitapischema.Waiting{},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package unit
 import (
 	unitapischema "honoka-chan/internal/schema/api/unit"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -46,7 +47,7 @@ func unitDeckInfo(ctx *gin.Context) (res any, err error) {
 	}
 	res = unitapischema.DeckInfoResp{
 		Result:     unitDeckInfo,
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package unit
 import (
 	unitapischema "honoka-chan/internal/schema/api/unit"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -67,7 +68,7 @@ func unitRemovableSkillInfo(ctx *gin.Context) (res any, err error) {
 			OwningInfo:    owingInfo,
 			EquipmentInfo: equipInfo,
 		}, // 宝石
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -2,6 +2,7 @@ package unit

 import (
 	unitapischema "honoka-chan/internal/schema/api/unit"
+	"net/http"
 	"time"
 )

@@ -10,7 +11,7 @@ func unitSupporterAll() (res any, err error) {
 		Result: unitapischema.SupporterAllData{
 			UnitSupportList: []unitapischema.SupporterList{},
 		}, // 练习道具
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -3,6 +3,7 @@ package user
 import (
 	userapischema "honoka-chan/internal/schema/api/user"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -24,7 +25,7 @@ func userGetNavi(ctx *gin.Context) (res any, err error) {
 				UnitOwningUserID: oID,
 			},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -4,6 +4,7 @@ import (
 	userapischema "honoka-chan/internal/schema/api/user"
 	userschema "honoka-chan/internal/schema/user"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -20,7 +21,7 @@ func userInfo(ctx *gin.Context) (res any, err error) {
 				BirthDay:   ss.UserPref.EffectiveBirthDay(),
 			},
 		},
-		Status:     200,
+		Status:     http.StatusOK,
 		CommandNum: false,
 		TimeStamp:  time.Now().Unix(),
 	}
@@ -6,6 +6,7 @@ import (
 	"honoka-chan/internal/router"
 	awardschema "honoka-chan/internal/schema/award"
 	"honoka-chan/internal/session"
+	"net/http"

 	"github.com/gin-gonic/gin"
 	"github.com/tidwall/gjson"
@@ -13,7 +14,7 @@ import (

 func set(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	reqData := gjson.Parse(ctx.MustGet("request_data").(string))
 	pref := usermodel.UserPref{
@@ -28,7 +29,7 @@ func set(ctx *gin.Context) {
 	ss.Respond(awardschema.SetResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -6,6 +6,7 @@ import (
 	"honoka-chan/internal/router"
 	backgroundschema "honoka-chan/internal/schema/background"
 	"honoka-chan/internal/session"
+	"net/http"

 	"github.com/gin-gonic/gin"
 	"github.com/tidwall/gjson"
@@ -13,7 +14,7 @@ import (

 func set(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	reqData := gjson.Parse(ctx.MustGet("request_data").(string))
 	pref := usermodel.UserPref{
@@ -28,7 +29,7 @@ func set(ctx *gin.Context) {
 	ss.Respond(backgroundschema.SetResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -5,6 +5,7 @@ import (
 	"honoka-chan/internal/middleware"
 	"honoka-chan/internal/router"
 	"honoka-chan/internal/session"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )
@@ -17,7 +18,7 @@ type bannerResp struct {

 func list(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	data, err := apibanner.BannerApi("bannerList")
 	if ss.CheckErr(err) {
@@ -33,7 +34,7 @@ func list(ctx *gin.Context) {
 	ss.Respond(bannerResp{
 		ResponseData: extractBannerResult(data),
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -8,13 +8,14 @@ import (
 	downloadschema "honoka-chan/internal/schema/download"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func additional(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	downloadReq := downloadschema.AdditionalReq{}
 	err := honokautils.ParseRequestData(ctx, &downloadReq)
@@ -42,7 +43,7 @@ func additional(ctx *gin.Context) {
 	ss.Respond(downloadschema.AdditionalResp{
 		ResponseData: pkgList,
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -8,6 +8,7 @@ import (
 	downloadschema "honoka-chan/internal/schema/download"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"

 	"github.com/gin-gonic/gin"
 	"xorm.io/builder"
@@ -15,7 +16,7 @@ import (

 func batch(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	downloadReq := downloadschema.BatchReq{}
 	err := honokautils.ParseRequestData(ctx, &downloadReq)
@@ -57,7 +58,7 @@ func batch(ctx *gin.Context) {
 	ss.Respond(downloadschema.BatchResp{
 		ResponseData: pkgList,
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -5,18 +5,19 @@ import (
 	"honoka-chan/internal/router"
 	downloadschema "honoka-chan/internal/schema/download"
 	"honoka-chan/internal/session"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func event(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	ss.Respond(downloadschema.EventResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -8,6 +8,7 @@ import (
 	downloadschema "honoka-chan/internal/schema/download"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"strings"

 	"github.com/gin-gonic/gin"
@@ -15,7 +16,7 @@ import (

 func getUrl(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	downloadReq := downloadschema.UrlReq{}
 	err := honokautils.ParseRequestData(ctx, &downloadReq)
@@ -34,7 +35,7 @@ func getUrl(ctx *gin.Context) {
 			UrlList: urlList,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -19,7 +19,7 @@ const overrideServerConfigFileName = "99_0_115.zip"

 func update(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	downloadReq := downloadschema.UpdateReq{}
 	err := honokautils.ParseRequestData(ctx, &downloadReq)
@@ -64,7 +64,7 @@ func update(ctx *gin.Context) {
 	ss.Respond(downloadschema.UpdateResp{
 		ResponseData: pkgList,
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -13,7 +13,7 @@ import (

 func list(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	targets := []eventschema.TargetList{}
 	for i := range 6 {
@@ -28,7 +28,7 @@ func list(ctx *gin.Context) {
 			ErrorCode: constant.ErrorCodeEventNoEventData,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  600,
+		StatusCode:  constant.ErrorCodeAcceptableError,
 	})
 }

@@ -6,13 +6,14 @@ import (
 	eventscenarioschema "honoka-chan/internal/schema/eventscenario"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func startup(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	startReq := eventscenarioschema.StartUpReq{}
 	err := honokautils.ParseRequestData(ctx, &startReq)
@@ -23,7 +24,7 @@ func startup(ctx *gin.Context) {
 	ss.Respond(eventscenarioschema.StartUpResp{
 		ResponseData: eventscenarioschema.StartUpData{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -7,13 +7,14 @@ import (
 	friendschema "honoka-chan/internal/schema/friend"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func expel(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	req := friendschema.UserIDReq{}
 	err := honokautils.ParseRequestData(ctx, &req)
@@ -45,7 +46,7 @@ func expel(ctx *gin.Context) {
 	ss.Respond(friendschema.ExpelResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -9,6 +9,7 @@ import (
 	friendschema "honoka-chan/internal/schema/friend"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"strconv"
 	"time"

@@ -32,7 +33,7 @@ type friendListRow struct {

 func list(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	listReq := friendschema.ListReq{}
 	err := honokautils.ParseRequestData(ctx, &listReq)
@@ -121,7 +122,7 @@ func list(ctx *gin.Context) {
 			ServerTimestamp: time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -178,23 +179,18 @@ func buildCenterUnitInfo(ss *session.Session, userID, unitOwningUserID, awardID
 		return info, err
 	}
 	if has && accessoryWear.AccessoryOwningUserID > 0 {
-		var accessoryID, exp int
-		_, err = ss.MainEng.Table("common_accessory_m").
-			Where("accessory_owning_user_id = ?", accessoryWear.AccessoryOwningUserID).
-			Cols("accessory_id,exp").
-			Get(&accessoryID, &exp)
-		if err != nil {
-			return info, err
-		}
-		accessoryInfo = friendschema.AccessoryInfo{
-			AccessoryOwningUserID: accessoryWear.AccessoryOwningUserID,
-			AccessoryID:           accessoryID,
-			Exp:                   exp,
-			NextExp:               0,
-			Level:                 8,
-			MaxLevel:              8,
-			RankUpCount:           4,
-			FavoriteFlag:          true,
+		hasAccessory, accessoryData := ss.GetAccessoryByAccessoryOwningUserIDForUser(userID, accessoryWear.AccessoryOwningUserID)
+		if hasAccessory {
+			accessoryInfo = friendschema.AccessoryInfo{
+				AccessoryOwningUserID: accessoryWear.AccessoryOwningUserID,
+				AccessoryID:           accessoryData.AccessoryID,
+				Exp:                   accessoryData.Exp,
+				NextExp:               0,
+				Level:                 accessoryData.MaxLevel,
+				MaxLevel:              accessoryData.MaxLevel,
+				RankUpCount:           accessoryData.MaxLevel - accessoryData.DefaultMaxLevel,
+				FavoriteFlag:          true,
+			}
 		}
 	}

@@ -8,13 +8,14 @@ import (
 	friendschema "honoka-chan/internal/schema/friend"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func request(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	req := friendschema.UserIDReq{}
 	err := honokautils.ParseRequestData(ctx, &req)
@@ -41,7 +42,7 @@ func request(ctx *gin.Context) {
 				IsFriend: true,
 			},
 			ReleaseInfo: []any{},
-			StatusCode:  200,
+			StatusCode:  http.StatusOK,
 		})
 		return
 	}
@@ -75,7 +76,7 @@ func request(ctx *gin.Context) {
 				IsFriend: true,
 			},
 			ReleaseInfo: []any{},
-			StatusCode:  200,
+			StatusCode:  http.StatusOK,
 		})
 		return
 	}
@@ -94,7 +95,7 @@ func request(ctx *gin.Context) {
 			IsFriend: false,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -7,13 +7,14 @@ import (
 	friendschema "honoka-chan/internal/schema/friend"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func requestCancel(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	req := friendschema.UserIDReq{}
 	err := honokautils.ParseRequestData(ctx, &req)
@@ -54,7 +55,7 @@ func requestCancel(ctx *gin.Context) {
 			IsFriend: isFriend,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -8,13 +8,14 @@ import (
 	friendschema "honoka-chan/internal/schema/friend"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func response(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	req := friendschema.ResponseReq{}
 	err := honokautils.ParseRequestData(ctx, &req)
@@ -59,7 +60,7 @@ func response(ctx *gin.Context) {
 	ss.Respond(friendschema.ResponseResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -9,6 +9,7 @@ import (
 	friendschema "honoka-chan/internal/schema/friend"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -29,7 +30,7 @@ type friendSearchRow struct {

 func search(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	req := friendschema.SearchReq{}
 	err := honokautils.ParseRequestData(ctx, &req)
@@ -112,7 +113,7 @@ func search(ctx *gin.Context) {
 			ServerTimestamp: time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -5,6 +5,7 @@ import (
 	"honoka-chan/internal/router"
 	gdprschema "honoka-chan/internal/schema/gdpr"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -12,7 +13,7 @@ import (

 func get(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	ss.Respond(gdprschema.GetResp{
 		ResponseData: gdprschema.GetData{
@@ -21,7 +22,7 @@ func get(ctx *gin.Context) {
 			ServerTimestamp: time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -10,7 +10,10 @@ import (

 func active(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	ss.Respond(ghomeschema.ActiveResp{
 		Code: 0,
@@ -14,7 +14,10 @@ import (

 func initialize(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	initData := ghomeschema.InitializeData{
 		BrandLogo:                 "http://gskd.sdo.com/ghome/ztc/logo/og/logo_xhdpi.png",
@@ -34,7 +34,10 @@ const (

 func login(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	data, err := ctx.GetRawData()
 	if ss.CheckErr(err) {
@@ -290,6 +293,14 @@ func addUser(dbSession *xorm.Session, phone, password string, isDefault bool) (g
 				}
 				return loginData, loginCode, loginMsg, created, err
 			}
+
+			err = usermodel.EnsureUserAccessories(dbSession, db.MainEng, userID, nil)
+			if err != nil {
+				if localSession {
+					dbSession.Rollback()
+				}
+				return loginData, loginCode, loginMsg, created, err
+			}
 		}

 		// 检查用户卡组配置
@@ -16,7 +16,10 @@ import (

 func loginAuto(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	data, err := ctx.GetRawData()
 	if ss.CheckErr(err) {
@@ -12,7 +12,10 @@ import (

 func reportRole(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	randKey, err := ss.Get3DESRandKey()
 	if ss.CheckErr(err) {
@@ -11,7 +11,10 @@ import (

 func getCode(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	codeArray := `{"codeArray":[{"btntext":"好的","code":"-10264022","msg_from":2,"text":"","title":"短信验证码被阻止","type":1},{"btntext":"","code":"-10869623","msg_from":2,"text":"","title":"网络连接失败，无法一键登录","type":2},{"btntext":"","code":"10298300","msg_from":2,"text":"","title":"","type":3},{"btntext":"","code":"10298311","msg_from":2,"text":"","title":"","type":3},{"btntext":"","code":"10298312","msg_from":2,"text":"","title":"","type":3},{"btntext":"","code":"10298313","msg_from":2,"text":"","title":"","type":1},{"btntext":"","code":"10298321","msg_from":2,"text":"","title":"","type":3},{"btntext":"","code":"10298322","msg_from":2,"text":"","title":"","type":3}],"codeVersion":"1.0.5"}`
 	getCodeData := map[string]any{}
@@ -10,7 +10,10 @@ import (

 func getProductList(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	getProductListData := ghomeschema.GetProductListData{
 		Message: []string{},
@@ -18,7 +18,10 @@ import (

 func handshake(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	data, err := ctx.GetRawData()
 	if ss.CheckErr(err) {
@@ -30,7 +33,10 @@ func handshake(ctx *gin.Context) {
 		return
 	}

-	decryptedData := encrypt.RSADecrypt(data)
+	decryptedData, err := encrypt.RSADecrypt(data)
+	if ss.CheckErr(err) {
+		return
+	}

 	params, err := url.ParseQuery(string(decryptedData))
 	if ss.CheckErr(err) {
@@ -10,7 +10,10 @@ import (

 func loginArea(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	ss.Respond(ghomeschema.LoginAreaResp{
 		Code: 0,
@@ -14,7 +14,10 @@ import (

 func publicKey(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	publicKeyCode := 0
 	publicKeyMsg := "ok"
@@ -10,7 +10,10 @@ import (

 func status(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	ss.Respond(ghomeschema.GuestStatusResp{
 		Code: 0,
@@ -10,7 +10,10 @@ import (

 func agreement(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	ss.Respond(ghomeschema.AgreementResp{
 		ReturnCode:    0,
@@ -10,7 +10,10 @@ import (

 func appReport(ctx *gin.Context) {
 	ss := session.Attach(ctx)
-	defer ss.Finalize()
+	if ss.Done() {
+		return
+	}
+	defer ss.FinalizeOrRollback()

 	ss.Respond(ghomeschema.AppReportResp{
 		Code: 0,
@@ -2,6 +2,7 @@ package greet

 import (
 	"errors"
+	"net/http"

 	"honoka-chan/internal/middleware"
 	usermodel "honoka-chan/internal/model/user"
@@ -15,7 +16,7 @@ import (

 func deleteMail(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	req := greetschema.DeleteReq{}
 	err := honokautils.ParseRequestData(ctx, &req)
@@ -57,7 +58,7 @@ func deleteMail(ctx *gin.Context) {
 	ss.Respond(greetschema.EmptyResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -2,6 +2,7 @@ package greet

 import (
 	"errors"
+	"net/http"
 	"strings"
 	"time"

@@ -17,7 +18,7 @@ import (

 func user(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	req := greetschema.UserReq{}
 	err := honokautils.ParseRequestData(ctx, &req)
@@ -76,7 +77,7 @@ func user(ctx *gin.Context) {
 	ss.Respond(greetschema.EmptyResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -1,6 +1,7 @@
 package handler

 import (
+	_ "honoka-chan/internal/handler/achievement"
 	_ "honoka-chan/internal/handler/album"
 	_ "honoka-chan/internal/handler/announce"
 	_ "honoka-chan/internal/handler/api"
@@ -5,6 +5,7 @@ import (
 	"honoka-chan/internal/router"
 	lbonusschema "honoka-chan/internal/schema/lbonus"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -12,7 +13,7 @@ import (

 func execute(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	weeks := map[string]int{
 		"Monday":    1,
@@ -148,7 +149,7 @@ func execute(ctx *gin.Context) {
 			PresentCnt:       0,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	}

 	ss.Respond(resp)
@@ -5,6 +5,7 @@ import (
 	"honoka-chan/internal/router"
 	liveschema "honoka-chan/internal/schema/live"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -12,7 +13,7 @@ import (

 func continuee(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	ss.Respond(BuildContinueResp(ss))
 }
@@ -25,7 +26,7 @@ func BuildContinueResp(ss *session.Session) liveschema.ContinueResp {
 			ServerTimestamp: time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	}
 }

@@ -5,18 +5,18 @@ import (
 	"honoka-chan/internal/router"
 	liveschema "honoka-chan/internal/schema/live"
 	"honoka-chan/internal/session"
+	"net/http"

 	"github.com/gin-gonic/gin"
 )

 func gameOver(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer func() {
+	defer ss.FinalizeOrRollbackAfter(func() {
 		if ss.UserEng != nil {
 			ss.ClearLiveInProgress()
 		}
-		ss.Finalize()
-	}()
+	})

 	ss.Respond(BuildGameOverResp())
 }
@@ -25,7 +25,7 @@ func BuildGameOverResp() liveschema.GameOverResp {
 	return liveschema.GameOverResp{
 		ResponseData: []any{},
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	}
 }

@@ -47,6 +47,7 @@ type memberTagMatchKey struct {

 type accessoryBonusRow struct {
 	AccessoryOwningUserID int     `xorm:"accessory_owning_user_id"`
+	AccessoryID           int     `xorm:"accessory_id"`
 	Smile                 float64 `xorm:"smile_max"`
 	Pure                  float64 `xorm:"pure_max"`
 	Cool                  float64 `xorm:"cool_max"`
@@ -179,6 +180,7 @@ func matchMemberTag(ss *session.Session, cache map[memberTagMatchKey]bool, unitT
 func loadDeckUnitDataMap(ss *session.Session, unitOwningUserIDs []int) (map[int]unitmodel.UnitDataMap, error) {
 	unitRows := []unitmodel.UnitDataMap{}
 	err := ss.GetBasicUnitInfo().
+		Where("a.user_id = ?", ss.UserID).
 		In("a.unit_owning_user_id", unitOwningUserIDs).
 		Find(&unitRows)
 	if err != nil {
@@ -219,24 +221,52 @@ func loadAccessoryBonusMap(ss *session.Session, userID int, unitOwningUserIDs []
 	}

 	rows := []accessoryBonusRow{}
-	err = ss.MainEng.Table("common_accessory_m").
-		Join("LEFT", "accessory_m", "common_accessory_m.accessory_id = accessory_m.accessory_id").
-		In("common_accessory_m.accessory_owning_user_id", accessoryIDs).
-		Cols("common_accessory_m.accessory_owning_user_id,smile_max,pure_max,cool_max").
+	err = ss.UserEng.Table("user_accessory").
+		Where("user_id = ?", userID).
+		In("accessory_owning_user_id", accessoryIDs).
+		Cols("accessory_owning_user_id,accessory_id").
 		Find(&rows)
 	if err != nil {
 		return nil, err
 	}

-	accessoryMap := make(map[int]accessoryBonus, len(rows))
+	accessoryIDSet := make(map[int]struct{}, len(rows))
 	for _, row := range rows {
-		accessoryMap[row.AccessoryOwningUserID] = accessoryBonus{
+		accessoryIDSet[row.AccessoryID] = struct{}{}
+	}
+
+	accessoryIDList := make([]int, 0, len(accessoryIDSet))
+	for accessoryID := range accessoryIDSet {
+		accessoryIDList = append(accessoryIDList, accessoryID)
+	}
+
+	staticRows := []accessoryBonusRow{}
+	err = ss.MainEng.Table("accessory_m").
+		In("accessory_id", accessoryIDList).
+		Cols("accessory_id,smile_max,pure_max,cool_max").
+		Find(&staticRows)
+	if err != nil {
+		return nil, err
+	}
+
+	staticBonusMap := make(map[int]accessoryBonus, len(staticRows))
+	for _, row := range staticRows {
+		staticBonusMap[row.AccessoryID] = accessoryBonus{
 			Smile: row.Smile,
 			Pure:  row.Pure,
 			Cool:  row.Cool,
 		}
 	}

+	accessoryMap := make(map[int]accessoryBonus, len(rows))
+	for _, row := range rows {
+		bonus, ok := staticBonusMap[row.AccessoryID]
+		if !ok {
+			continue
+		}
+		accessoryMap[row.AccessoryOwningUserID] = bonus
+	}
+
 	result := make(map[int]accessoryBonus, len(unitToAccessoryID))
 	for unitOwningUserID, accessoryOwningUserID := range unitToAccessoryID {
 		if bonus, ok := accessoryMap[accessoryOwningUserID]; ok {
@@ -6,6 +6,7 @@ import (
 	"honoka-chan/internal/router"
 	liveschema "honoka-chan/internal/schema/live"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -13,7 +14,7 @@ import (

 func partyList(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()
 	partyListData, err := BuildPartyListData(ss)
 	if ss.CheckErr(err) {
 		return
@@ -22,7 +23,7 @@ func partyList(ctx *gin.Context) {
 	ss.Respond(liveschema.PartyListResp{
 		ResponseData: partyListData,
 		ReleaseInfo:  []any{},
-		StatusCode:   200,
+		StatusCode:   http.StatusOK,
 	})
 }

@@ -8,6 +8,7 @@ import (
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
 	"math"
+	"net/http"
 	"strconv"
 	"time"

@@ -16,7 +17,7 @@ import (

 func play(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	playReq := liveschema.PlayReq{}
 	err := honokautils.ParseRequestData(ctx, &playReq)
@@ -322,7 +323,7 @@ func BuildPlayResp(ss *session.Session, playReq liveschema.PlayReq, isRandom boo
 			ServerTimestamp:     time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	}, nil
 }

@@ -10,6 +10,7 @@ import (
 	liverecordschema "honoka-chan/internal/schema/liverecord"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -17,7 +18,7 @@ import (

 func preciseScore(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	playScoreReq := liveschema.PlayScoreReq{}
 	err := honokautils.ParseRequestData(ctx, &playScoreReq)
@@ -88,7 +89,7 @@ func preciseScore(ctx *gin.Context) {
 				ServerTimestamp:   time.Now().Unix(),
 			},
 			ReleaseInfo: []any{},
-			StatusCode:  200,
+			StatusCode:  http.StatusOK,
 		}
 	} else {
 		// 如果有 Live 记录
@@ -181,7 +182,7 @@ func preciseScore(ctx *gin.Context) {
 					ServerTimestamp:   time.Now().Unix(),
 				},
 				ReleaseInfo: []any{},
-				StatusCode:  200,
+				StatusCode:  http.StatusOK,
 			}
 		} else {
 			playResp = liveschema.PreciseScoreResp{
@@ -189,7 +190,7 @@ func preciseScore(ctx *gin.Context) {
 					ErrorCode: constant.ErrorCodeLivePreciseListNotFound,
 				},
 				ReleaseInfo: []any{},
-				StatusCode:  600,
+				StatusCode:  constant.ErrorCodeAcceptableError,
 			}
 		}
 	}
@@ -9,6 +9,7 @@ import (
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
 	"honoka-chan/pkg/utils"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -16,12 +17,11 @@ import (

 func reward(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer func() {
+	defer ss.FinalizeOrRollbackAfter(func() {
 		if ss.UserEng != nil {
 			ss.ClearLiveInProgress()
 		}
-		ss.Finalize()
-	}()
+	})

 	playRewardReq := liveschema.RewardReq{}
 	err := honokautils.ParseRequestData(ctx, &playRewardReq)
@@ -49,6 +49,9 @@ func BuildRewardResp(ss *session.Session, playRewardReq liveschema.RewardReq, is
 		return liveschema.RewardResp{}, errors.New("live progress not found")
 	}
 	_, deckInfo := ss.GetDeckInfo(progress.DeckID)
+	if deckInfo == nil {
+		return liveschema.RewardResp{}, errors.New("deck info not found")
+	}
 	deckInfo.LiveDifficultyID = difficultyID

 	unitsList := []liveschema.PlayRewardUnitList{}
@@ -169,7 +172,7 @@ func BuildRewardResp(ss *session.Session, playRewardReq liveschema.RewardReq, is
 			PresentCnt:                   0,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	}

 	if playRewardReq.MaxCombo >= liveInfo.SRankCombo {
@@ -9,6 +9,7 @@ import (
 	"honoka-chan/internal/session"
 	"honoka-chan/pkg/encrypt"
 	utils "honoka-chan/pkg/utils"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -17,14 +18,17 @@ import (

 func authKey(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	reqData := gjson.Parse(ctx.MustGet("request_data").(string))
 	dummyToken, err := base64.StdEncoding.DecodeString(reqData.Get("dummy_token").String())
 	if ss.CheckErr(err) {
 		return
 	}
-	dummyTokenDecrypted := encrypt.RSADecrypt(dummyToken)
+	dummyTokenDecrypted, err := encrypt.RSADecrypt(dummyToken)
+	if ss.CheckErr(err) {
+		return
+	}

 	// aesKey := dummyTokenDecrypted[0:16]
 	// authData, err := base64.StdEncoding.DecodeString(reqData.Get("auth_data").String())
@@ -51,7 +55,7 @@ func authKey(ctx *gin.Context) {
 			DummyToken:     serverToken,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -4,11 +4,14 @@ import (
 	"encoding/base64"
 	"errors"
 	"honoka-chan/internal/middleware"
+	loginmodel "honoka-chan/internal/model/login"
+	usermodel "honoka-chan/internal/model/user"
 	"honoka-chan/internal/router"
 	loginschema "honoka-chan/internal/schema/login"
 	"honoka-chan/internal/session"
 	"honoka-chan/pkg/encrypt"
 	"honoka-chan/pkg/utils"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -17,7 +20,7 @@ import (

 func login(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	has, authKeyData, err := ss.GetAuthKey(ctx.MustGet("token").(string))
 	if ss.CheckErr(err) {
@@ -38,6 +41,10 @@ func login(ctx *gin.Context) {
 	}

 	xmcKey := utils.XOR(clientToken, serverToken)
+	if len(xmcKey) < 16 {
+		ss.Abort(errors.New("invalid login token data"))
+		return
+	}
 	aesKey := xmcKey[0:16]

 	reqData := gjson.Parse(ctx.MustGet("request_data").(string))
@@ -45,7 +52,15 @@ func login(ctx *gin.Context) {
 	if ss.CheckErr(err) {
 		return
 	}
-	loginKey := encrypt.AESCBCDecrypt(key, aesKey)[16:]
+	decryptedLoginKey, err := encrypt.AESCBCDecrypt(key, aesKey)
+	if ss.CheckErr(err) {
+		return
+	}
+	if len(decryptedLoginKey) < 16 {
+		ss.Abort(errors.New("invalid login key"))
+		return
+	}
+	loginKey := decryptedLoginKey[16:]
 	// fmt.Println("loginKey", string(loginKey))

 	// password, err := base64.StdEncoding.DecodeString(reqData.Get("login_passwd").String())
@@ -68,6 +83,19 @@ func login(ctx *gin.Context) {
 		return
 	}

+	if err := usermodel.ClearUserForceRelogin(ss.UserEng, userID); ss.CheckErr(err) {
+		return
+	}
+
+	ss.SetAuthKey(&loginmodel.AuthKey{
+		AuthorizeToken: authorizeToken,
+		UserID:         userID,
+		InsertDate:     time.Now().Format("2006-01-02 15:04:05"),
+	})
+	if ss.Done() {
+		return
+	}
+
 	ss.Respond(loginschema.LoginResp{
 		ResponseData: loginschema.LoginData{
 			AuthorizeToken:  authorizeToken,
@@ -76,7 +104,7 @@ func login(ctx *gin.Context) {
 			AdultFlag:       2,
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -6,6 +6,7 @@ import (
 	multiunitschema "honoka-chan/internal/schema/multiunit"
 	"honoka-chan/internal/session"
 	honokautils "honoka-chan/internal/utils"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -13,7 +14,7 @@ import (

 func scenarioStartup(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	startReq := multiunitschema.ScenarioStartUpReq{}
 	err := honokautils.ParseRequestData(ctx, &startReq)
@@ -28,7 +29,7 @@ func scenarioStartup(ctx *gin.Context) {
 			ServerTimestamp:     time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	})
 }

@@ -5,6 +5,7 @@ import (
 	"honoka-chan/internal/router"
 	museumschema "honoka-chan/internal/schema/museum"
 	"honoka-chan/internal/session"
+	"net/http"
 	"time"

 	"github.com/gin-gonic/gin"
@@ -12,7 +13,7 @@ import (

 func info(ctx *gin.Context) {
 	ss := session.Get(ctx)
-	defer ss.Finalize()
+	defer ss.FinalizeOrRollback()

 	var contents []struct {
 		MuseumContentsId int `xorm:"museum_contents_id"`
@@ -46,7 +47,7 @@ func info(ctx *gin.Context) {
 			ServerTimestamp: time.Now().Unix(),
 		},
 		ReleaseInfo: []any{},
-		StatusCode:  200,
+		StatusCode:  http.StatusOK,
 	}

 	ss.Respond(museumResp)
@@ -134,17 +134,7 @@ func getGreetingAccessoryInfo(ss *session.Session, userID, unitOwningUserID int)
 		return nil, nil
 	}

-	accessoryData := struct {
-		AccessoryID int `xorm:"accessory_id"`
-		Exp         int `xorm:"exp"`
-	}{}
-	has, err = ss.MainEng.Table("common_accessory_m").
-		Where("accessory_owning_user_id = ?", accessoryWear.AccessoryOwningUserID).
-		Cols("accessory_id,exp").
-		Get(&accessoryData)
-	if err != nil {
-		return nil, err
-	}
+	has, accessoryData := ss.GetAccessoryByAccessoryOwningUserIDForUser(userID, accessoryWear.AccessoryOwningUserID)
 	if !has {
 		return nil, nil
 	}
@@ -154,9 +144,9 @@ func getGreetingAccessoryInfo(ss *session.Session, userID, unitOwningUserID int)
 		AccessoryID:           accessoryData.AccessoryID,
 		Exp:                   accessoryData.Exp,
 		NextExp:               0,
-		Level:                 8,
-		MaxLevel:              8,
-		RankUpCount:           4,
+		Level:                 accessoryData.MaxLevel,
+		MaxLevel:              accessoryData.MaxLevel,
+		RankUpCount:           accessoryData.MaxLevel - accessoryData.DefaultMaxLevel,
 		FavoriteFlag:          true,
 	}, nil
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
YumeMichi	2c075cd7bc	Document legacy RSA encryption compatibility Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:23 +08:00
YumeMichi	94d48cf82a	Report configuration and HTTP startup failures Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:20 +08:00
YumeMichi	b1dfc68a0f	Handle malformed encrypted requests without panics Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:18 +08:00
YumeMichi	aebbc4b889	Abort requests when session transactions cannot start Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:15 +08:00
YumeMichi	ff67c554f7	Rollback live sessions on panic Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:12 +08:00
YumeMichi	96b7951ee1	Scope unit and accessory data to owning users Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:10 +08:00
YumeMichi	16ab2549d7	Validate main PHP sessions against user IDs Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:07 +08:00
YumeMichi	683645be8e	Fix session cleanup on error paths Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-13 08:03:01 +08:00
YumeMichi	cb8f587e30	Unify error handling and HTTP statuses Signed-off-by: Sean Du <do4suki@gmail.com>	2026-07-11 16:18:17 +08:00
YumeMichi	61b33ae0e3	Improve session abort error context Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-28 18:13:59 +08:00
YumeMichi	36ccf46df5	Fix accessory exp lookup from user data Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-28 18:13:57 +08:00
YumeMichi	4410e53afa	Bump dependencies Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-28 01:35:07 +08:00
YumeMichi	46380513bc	Backfill migrated unit exp data Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-28 01:35:07 +08:00
YumeMichi	1bb8f20c88	Fix legacy unit schema migration Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-28 01:20:05 +08:00
YumeMichi	b276fada4b	webui: Fix subnav active state Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-13 18:12:19 +08:00
YumeMichi	af63f242da	Force relogin after server restart - Mark all users with force_relogin during startup - Ensure existing clients are returned to the login screen after a server update or restart Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-13 11:33:23 +08:00
YumeMichi	4b2c005222	Force relogin after webui data changes - Add a force_relogin flag to user_pref - Return 404 for main.php requests when the user must reauthenticate - Clear the relogin flag after successful client login - Mark users for relogin after webui card import, accessory changes, and profile updates Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-13 11:29:57 +08:00
YumeMichi	6264523c76	webui: Add accessory management Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-13 11:04:18 +08:00
YumeMichi	cb0200ff29	Migrate accessories to user data - Add user_accessory as the per-user accessory inventory table. - Migrate old accessory wear records to user-owned accessory ids, including legacy common_accessory_m lookups for old installs. - Allocate default accessories for newly created users and update accessory reads to use user_accessory at runtime. - Validate accessory ownership when wearing accessories and keep existing accessory-based responses working. Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-13 07:36:21 +08:00
YumeMichi	17336de1b7	Implement achievement list Signed-off-by: Sean Du <do4suki@gmail.com>	2026-06-13 06:54:32 +08:00