From 95d4c7bdc24595c976ec694eb796af8bf7393f72 Mon Sep 17 00:00:00 2001
From: gjs <gaojiming1@163.com>
Date: Thu, 6 Aug 2026 22:20:48 +0800
Subject: [PATCH] check params

---
 .gitignore                          |   4 +-
 bff/etc/admin.pb                    | Bin 0 -> 68896 bytes
 bff/etc/bff.yaml                    |  16 ++++++
 bff/go.mod                          |  16 ++++--
 bff/go.sum                          |  38 ++++++++-----
 bff/internal/response/middleware.go |  15 ++++--
 bff/internal/response/response.go   |   9 ++++
 pkg/go.mod                          |  12 +++--
 pkg/go.sum                          |  26 ++++++---
 pkg/validate/validator_util.go      |  81 ++++++++++++++++++++++++++++
 product/proto/admin/product.proto   |  15 +-----
 11 files changed, 188 insertions(+), 44 deletions(-)
 create mode 100644 bff/etc/admin.pb
 create mode 100644 pkg/validate/validator_util.go

diff --git a/.gitignore b/.gitignore
index fbb46ee..2fac70b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,4 +9,6 @@ deploy/redis/data
 *.log
 **/logs/
 
-deploy/docker-compose.override.yml
\ No newline at end of file
+deploy/docker-compose.override.yml
+fresh.conf
+*/tmp
\ No newline at end of file
diff --git a/bff/etc/admin.pb b/bff/etc/admin.pb
new file mode 100644
index 0000000000000000000000000000000000000000..bb449a4139a8d6b725572a24849d1b121c7ad5e6
GIT binary patch
literal 68896
zcmdsgYj9)7b*2HnfF=oocU~Bb9vD~>$&rR5QR9(3lBEzsa6pMeGMD7&EeJzga-abL
z2moh>vTVy)Czj*5%Fe5lWSzvRO}xq4*(6nY*-4ym^VqnY*H$*`)FxY-$|iOmwaIQd
zTiI;wX1~*~+xOx@Qqquv(T@>t_v!9)PM_}n`kZqw*c&gg#9Fz$R&-8Ps^xn5(#Gnk
zyi;4L7Ao~}b)1)3LxMs)fg<@F8=fu{ohePY=+v!;S@$XmV}V51X#d1r<Gx1Y-WCfq
zn$26B7zn-ow_pC}K=i}(Z}QC^cAyEZWwGv3Zk_rMjD~Igw-sZ3mE6je+?o>$@?!O9
z-N9JisW_#)Q(D=Kb%Cd_ZIoE|vf;|crD9<vYmhOJ_1IBSF{PVZBW&oJle=P)_H)t*
z6&r--*uc6|tAU?veY4`ky16bA4Z3hOC-l%STP>lHHOazGX=7dV(8GIZ)MgqK{$4`V
zOm@*%bE;PhD^9GJcQDex!lJ16_o3QZ=fK7Fx>KqZ%B5Hz@8s@=PNoY^G4JofZD*Zf
zedS6WJ=9_$%uoNsZB4o;I`e|YR>al}i`L2;)fFeZQqDWsLTR-e3-b={Z0KN-6P^Rz
z49M(=XsDj8!>qTqS*qu*#|F5C$R}%p^*Q+h@fM4qA~F$c=s7LwZAF;;#a=e#leVc@
zKEirdNi#4?S_?bWn`q-zyqLWmc3>!elJ%FITHVPDD<b>vpV;0GnP}8#hQg3{Ylcs=
zA#Fq1YOaK3D(v}GgRXsQ9ZxIUv#FUK(f#meYl^XQ$tka5Nv;%OTg}xxPb9vc?J#dR
zg?83^UGwZ~VO<x*a&EBDWfrMAw8o%fAz7F+F}|&2wrnN@8&tgrx!%omL6+}!v?Yb@
z0Yx>39WeeXi+I&z9b`SVdahdMn`4hH9;_(q!Uo89#vYsgw7$s|xQh#XPXoK&p8ayi
zA7X<Z0d_ic@+;l!P}9Dxr`f@cQlV6Ls+FokCM&j#*w@6a(`a<dCbi(uKH%v>6k5-)
zezK2THOJSvSd9}q6M390M7B(Iy%7l7W?$ArEVSz6>KmAt*aTPQv4(!91py96TN7LB
zY~ZR>Evyz+1XDB*k%@;J8aLI|_(h}XVm()P&a&mXi)njidL}(3*z|NC|Ly?mHzc9$
z5QoGirz%ZFK3T_Dcy*&#6h<e`(hwDp!O<Sak2B&GM=$+t#aT!hB^GsHG-T^%QCETV
zP9EovtP{^qbced5J;~E-xIq+a2&|^h%}&~rOEdFx(RW!9W=IzeoCt@$-WPox{{@r3
z*2@kyJAIn&$F9&ML65D3o@716+$E=obDAdM-iAqNHp2KUHL*oY>oKVsQbA<m#Ljx4
z{Z*<FdM9-Xy_2rOc8ChN-l1cM_QAZP@Qr@9uv6rn)!at0p1qnYZa6rjsqug;yhvr%
zovdGMlLho~ogbk+w%9pmsD!5d<yyI<_8LAs74YF7a(4@Hdf(n$JpU#^c!?v&2jx=E
z6=TETE@VeUv1pJhCVwu-x=9%{^-Iqzq_b1=%c<FPG(c0&3#Mo1Czql@{X8?bbmnxl
zOE*{+1>GjWgA>snY<>fxgPEt(Q)trbEdfoRHORu8CN)1l8x83`7nkgrx%1Jm?(@7o
zzq}A-x`zwt#l^|<>1e;ENIkQZUW^XtE{H7*F{p<~&n;hwMyz2r$VXh9CbmE^<SPQF
zQQga;=w;Yb017L4j`eUegt<p%CsXO!?EC^Pn#oz{PM6u~h4kc7dJ6h7%D#Dd#zt8%
zxxx-MJ0Y7cA;T7Ecj%vJv<2Rm-xiX89%KiafYqjhJkENAEsLFctijx<BW~ILLtV5p
z@uoQ68u2D|;b+o%q2V+afagq84t#@;Q<t7Y(bk7}i&LFYkpEPFgbg=zwBytDUj$gJ
zm2#S@+T9XqI^8Yt5qHfC4IXc*0zL_TH6}kBV27LEE1L4~80%ek>X*w3CpUtT3%uH=
zZ(Fu9;hW&K$>l)YavC`OSdblR+Idq(Z)dDfs%+E+m=>pFn3wR)i+0(Kx~?Z)aM=_^
zoZw+ssdUoxPu$U<RKbj&PwRdbT`3lvQaxL%SDoB?p|mDW+p|5Zxnj++heY+Fs-+ej
zmR5}x{0!DDM73^_{Ct@8(}i0OZXIU>FXyi2vg&3nF5LZ8wjeIs7~~))fs9Ty3!GG|
zmFR9x$3)n+sBWIB&Z!#fJ?sE)v5o_)P$@cD@)gu#3=KkxvtgpRAPI=08gTyYyxE#l
za)9ETtn<nS<j&?w`RwIf?Q-lOb&v|i0`^fNJTK|eoNTg`&w$7}%MSBiphGAyyK>oC
zxsu(euRa_*W{%G}gkC^%j!2e4VJ)(OGOnlVg;&9IxysMb$VB7TWN2`lG)WCE;8J?F
zXK^8&p0fK@FVp3!1%p~EYX$dnt%cXhO1)6l%1V~Y3<m|x7jE*kSkz>8cx8nPTUe1R
zu7>q+$W@lvkRQHE%Unu-Q;b;IY#h<@j9A(9H@lmAS*i}OETG;IlbW0@vcejN6|ZES
zQtlEaK3Bybwb-4UxVv86!0m2jCCw`*d7X8F4VN#yydn%Mi*8m6*JF2~LD(Lm3T{>l
zyx1B;-?huRYK3E%8jRM7-7QE(IYAj-Oom;%R#>g89!EG?KQEKLjk0Lva>YCFC?|`c
z+#DD9izvzL#h_!HYygGsh^N_MBEl}0%jfDjgZe&BeGs)+`MlC?1wN}Amo~M1oD_Ug
znX-_#eEqm#m#ySkHelMl6=uTn0Z4$e&dpDyvx_s&rh(-E&1Pqo(ph_XZfWL1I@)Cb
zd)yCBMDNAF_e4i*Qcr_XCcn|eBHnAc^(Z@nY2bdhnp4kSD^&SnUC)UdvEE@0N-A8*
zo&pV)B1o)Rc4w)K?Gl?xu9}BSLHR$kxfQIt8dg2+`MQ_eN@d)=II(*)O-fSByC&!`
z&<)Ks0pz`&t6)*otD79V;{t_(G(B4v**)&^$rhcp+{$K_19k3Kf>*4x3g2bD7NfmG
z?0-qO#Vl{|1aLgRz?@Umo?9!q!}=$7cx%03X5*cDTn#bxJ<(qL+Z*k}zoBRt|AwP1
z`RPG6z{MdegGUj5(w-H%D)F0aWa8ZoXR1j(evVG!v%Lb_+oC1ihOuE>!QRCu*p^S$
zdDi=KjrUDQXQZh&8~#1X$@mkCyz}rAi`lt(`@-a`Et^|MS$8q_>ZbS1=0(^Phc-&W
z6#$<Hry4SiCF0i3qKlo{6-FedwD)A?Mb;?8?eNmZTDI!sb1QZ4c>?bSs%&0kJ;}o4
ziYalo37sC1iIeTsD^y{tMz-7D%CJ88rq&!->jB{2$V8)$%rjG>t0mrq^lGc-)>AAh
zeYRMn{O(%=03hGreeJoEp4=(X$R3it$mg18T^!oYx>#mI(hZcYZB!~{xZn=+_S-O|
zTtlLb9g&?Zisu{W5{o|z-=T18OW{pNIBixtafH*gL|xSAP!<pI?+vnuS1>FjOU)QO
zeARM(V+D(i5M{e@hGm->-Nfw3-RJnK-APANE*3e(4yX>Wi)63ms_-VRAwtBFt5Nlo
zsKGX)%mwRay$px1bQiS_7(^uhwxCa*Vm*BOu^5vZ5S&{f)_rc?p2G2n^H6L{*@c<(
zIh>Hm_pn~Er_j-<cNH`ekJ3TG4_2yOzK}}WXa;NatwZY&8@AI+X&kikbJ^v&C+Fs$
zBF~zqSe?TG%xl!8UYuXHIXB-CWKsX3w2rU?OOy8b^iq~PG~BMyhgmT_!~HpTvSVgx
z`f2dANIcn-bMT}D{rxEyOBb<fwuGZ|b}HKKFP@)E&riec;~Sm3U3%e=JZ$zsrCI32
zeg;k;pCF5A`{E454&iXH%tjZ|OPTqpXt>#lWknApKNkQ1qJV=?m3LDii@&K3+vFbv
zS-;^6Ay;9pSS(-5=86Ttb8#LrUNlK1J3W7P4qf=IlwaL;3tdF8=H`Mf04>R{Vxed+
zj4}f+9wb9(iU&<ZPs-o1wfIkU590Kk>P-$S;f}aT4=ZD(CI4f9MdU?SDc00jayJ_D
z&dBjrGqM+$H~D>CY|!KT@vXC#+`Ynv3wdX~QU*-J<)G+XMI3|F5SeI<u6jlopK;sG
zQnRxMW~R~?7Ur=fpL<3f5_Z(+o|Ab{(z|z~@EfMd<N}NOrJ)VIi99&;4zQuQd0awq
z6HQM~r_U`dia>*=Mxep8x$o~{2b#nhfe1t<itti50^=ra#_4vyfC#NjT!GgD>IJ@D
zEx>^$u#|uxLvA^DvRd~st5U8ZQ{gHlLa1mDE!=LTs>m83B~4wz?axO|(Wx#ws%kVf
zJPr9W(qJ6P0&U3w1Uh+{=#ZQy!fhtFq`h~*?iXc(1mT|C+FF%{RUHXOU_=*l!uS&`
zr1U_MrxJ7mCkGE(2LU5PR6t51Pfekg<*_fGe-catM?-dhp{Apv$<H#z6xc-e(WkIK
zK$pclId^JU66#vm#8aokvdBq73%GuGgVf`11Ojgcy59^0ek3qxh0;$i%+8#fS&Dt6
zk3Y{`kk4Ne&$|BWeLoZELTJ(+<Q%B}tfHC7LwkDDi=@j99UXMxNsVzvdO0KgR`0pl
z`Ni}UXCrKN&o89s5F3|6x;Z~@2H24*a+b&y2k$DW0%|Dd6}pW~JkWSaatF6%Q?8P<
zY?wOPppwbCDai{sTbMleB%U-khZF;zUaSw|staE#8Cd~-Fv__h`)wL8bvYvUE9^$L
zkV+A=12xP6@o|-a4ITi0#$_Wyqq$8nepI=Kv`R$4_TF|XkxnM9jC%}a9JGdJ({tyS
zGT8+?&4YPhM$XBQ985K|z6C*e;l1GwCms`zOf-f&Tzekp&KpjhdM_Wg>&<{Lh$EIY
zn?65@ojR3XT%w(9-WE2>te(l)+4-kjMKBswc)60#vq3&9+B^Y@IhZC17P0lG)z*)#
za)4>`#~z6%W&A+u*hVD-c3Q>~yOKDJmH84h=Lp+(F~Eg~Y#06E8YFBQcb1FnP*c-G
zfcs7rzsw3g!Q=cCBC`gc=t<b1;1Wxc+b8;+VG*wZVaGYLyfpoA_TuF1%oI;C@OC7u
z2m*ppvaV=XvO5%r29k?x$Y%=HZ7e2lD7Z&7aK$y`F%GbYtJ_q1cIE;+pA>w}Fy_uN
zomo#T;x>f2yfC?B@C7d_pHp;z`$*%&<HYKvtcZ`#;r}0>i++;+|H--Nr{<pM4SlUI
z`t`o#-*qv|wJh!Pc$$Us%84R!HXm)X7*w-yw<oV3!PdRejTwQe!a8yo<wbb=8?$U6
z`{Z5Zu6w!=3%1RrdtEe;UBv$pA<<UMz9px}96N~Hf3=DYiB8N_u~XH!Y}=sq14cv1
zQ_V`ziFKVeYt<8pxJ^$uV$ekO0oQ0C8pOZBXqTH~l>AvZV!UaQ2&9FIWtnm$W_z?@
zw!KZpXC=L@TgHDkz(T4R_Sjv?)i1-FgRI$9FdDG=GnFGEQo<Edm(w#vYKl&d&LjA*
z*Vlo5YSQg8B+JjqV#>~~S967;hn9|vupLzun)oa`s`||%mV)SB-W`AvD8u#<NiZer
zRa;-`@$U!OFb{Fj8LBf#FEExXmCDGrqJv8)uMzY$v>Tt)jclWX_}>H=bE{fv5%+PC
z$;u<8{63DLvM8chBl+MiIctRy*CBHL_yc@NJm-&eC3F647OFYxIbh8d?uL#`G-frl
zV}5*5wzhRY$x#+krFyq~m(|C*7Sl`EsraTfGr5S(>9axBrxrD~#q`vS&l7b34oO)k
zcDLw9`f$YP!UcPNX?`O5myLxFM!(jF?3n@8eB%Cz2eIGzicUxWiu-sJ)dN{%>MUjF
z=VqS)r`UH@#e`82M1=N;s(3H{d&sE#^e1}#)ejrhKiF9PUZeVlP<;Td7b)|F$)}_L
zjQ{#lA4Jf%yzXC=si+%b;<@6rOyJp*GPi!MTts&4c)7afX75wfqISxSVO1{uBk*jn
z>-<9MCxY?wJlB7m_k>LTaobrfIxA$@?EeJV9im^iv;2lgoow|Yz*!cWk|dOiUvm(c
z%GbDmx64+KWT~ZGsVtmIuvGq#Ldr^0fd^HOoXLg2vkz=5?UhpbTIrNx)+6y9eu<xQ
zip3|1o{)C!Qm@EJV}BWFd=Wx`==EIfN-Oz~voOb07eGT|(tb$d)1D(9Qs3G_%!qEN
z<eb={oSZG<>MaTS&jEI)f0~i4fMoI9dZm?|k04P_(d>GnTWUaexmyire&3P?zWh^N
z>=?c1BCjKk{zHmCKr2I4#<zVxCce$GY3#voSn=&<1b&Wgdjp$(gar#CeiF9v7tMvd
zY{(NrJ<<y>&ULyA^9!`_Ef^)q&%j+RQ7!dM{@uumQ^ciPHxgNDgD6ewLhCNpg#!LY
zP5*>7ZmMdWI<l$SI?Z}`;wiuph3D?@(#dhTx16^T!~)F#NET{@u=2@i7WI?jyzJ%b
zQ_D;~iJaqCHVTMsO6N85k;OBPE2hV)c__I%mNJ(m<)4#Rf$q+&baFdi+s$=ygv;7e
zCp=?Xa(EQyGtZb7&v5ee7S>ATs>3sqA`=I_3Y+0|wxmJ&RnKa%ER!4h@#czW7N)6+
z^PhQ_EeNd#S+8*FaNYDz9Q8Jt;tn6xMv~Gna5z0U!4XEoFmNJ0IH8&dLfPWXX^Dw_
zjG@Ju(`Jh^r-`u*F^B-aKE{?kqexQK2;-2$szDlR<PO9eiIHkzBoRLFjkM?;Ns!V=
z^cO}F8PH7{86yc&%0lHR9hws_Eycaso+b$I>P`{sb{LKF;`%3=wR49P?I78Ef$-FT
zln+8z2#-Z9`bN~`Zc~h@5<;3ZbqAGAG3rUyeW_e7#s>L_N4z7ZP@`s=lW|RQKO%qK
zs$tGV+MR0BE8L4@PnS09NPVNshz1KxQI%>U2#G5PZZw|T&_ChhiaZpGo|BRM%4HR!
zWVZ&@Dc^)@rpb|{)`ff>q%=^g!(Q<(<SMEG5fN>!w8@hd8)zp>o0=9x#F9cXF_nwp
znG%JMR4Ywxy^k^XXo=m%IlIlv8Q<IpuBg^w-hu;|NAWI#I^|^=gRiwdv2|<RAk{10
zguo^qiyp<l@#rx?z$=AH#mU<PVt30TU{T*pKFfySg@X5?P(mF)edMtsZda|g(4F-C
zlSi<F>mAVgNB~(v$QBZbV8K*rD|3YvSU=xC$9YZs+4|)|EphyP3FN47{ft(Lr~48k
zynbXX@pxineWO-S@a)sX-L;W%q=F)KZ1lNSO<ovFoK1|3Akl~hw>}+U!D5|nzQNSD
z2evZb7GMCtA;Ctm9=~=R>8xVh@wK`$mbmAhgr|s?j1s5gh1y)MG&+`e?X?8w{IT~X
zIK$(``k3PMl9PZ4H4x-V9)=aAWDrLL7_)vdz`BZchwt>k)c1kG?+LK)4B(|8QYAWe
z;vWfk_}L|knnR~Ki{+|RZoS-;UB~5@7`6Vej|JE2{G17<eywjS^UHk<I+Y4ttH)n8
zxP@MP`a~CP6#A%A=$c2N2ywtMP;I5twYuby{WAQ$LUC*LEGGB!0e5mGFKQYRdh*ul
z#N)OztY>{^OeT=0*wzx(>i6lnQT+c_fE_aU2PRx8ZqyKfYAea3vY!@$NaHTn6X2ZN
zEyU&jHzhHx!>8{AY^0q{H<RRdfN~8<ocJ$!ra~BjnhR%#lcDwHyuHb2Z}X-&%KF)V
z!W$N*JjT?tmu#n#<0Kw^2PS9tl4Sxm*0c4Q5bMJB#~oF{)OUooGH-+!wj#L?p(_4S
zb06CE%GNgO*@rxqwjJ|&GQMIMmqY9Piyq_R8;r6o)3lsjF7#dVyn{vWG_LwTGHi>)
zF>I@yV6J5~m#fXXHw0_B?!B|I{T|Rnus;c~LA7W|Fem<H&qTG^1)7T_PTgkPfFY4_
z61Oog-&A>}bzz1uBbdKCZQ2asx;o+!&zQLOg6??g8g~Ul(6=;oZ$VIO5wtg0AAk>}
z#J_71Os#KaUS^lov0o^~pFhq|&_tosh~^5Vkuev`0U?2?SOBbR3+SkoJQ(3}DOuO>
z26efPR1E%Aj9}`et;`GTId#m4s`!)KM9{yOI8mx$BpwqjhBxWes6C*c;R6FO7qC0h
zT{M)+Ze^Zl&#Hk%Rs0Fjfq24zP4NT}B)*ja1Zmi)XfeW3tHiEwt<Z3A=JYw&;T^=s
zUFahR!Bl)JbA%mIi%QnT#k)L;)JUXB^|LS?+*tynsR$d8>w!NffAt7n`*!^g7Tkpf
zVh^OsTbUwzStY9M9c2GO7qSOZ9|t1-Xn^515f*+FK;r$z?Elul?19wxgTwC)u<t^2
zNppC!f%ZRkL3<$en*i-weGFPvD&1$){wp}nrRq8pw*Pw^;HCh^IneF~;+_IcaY>u=
z+qfpRJOu8pZGUFFhnl*9AkaK$iqi4G{i`^nJpvh%b4wuiA2X19AoVFA_fLcvHYBwh
z-CWQe_d?gcZUO9$d!cJyw-k8)QzUlkg>ws{_pc#M$t$0+Gu(>s{ev352b4Ef0f0Th
z@7F!}J&?+6WnN@Rj+B#d0|7in7KmB`czJVBBa6Blg5cldMeu>tv8_yu9o8%BZ9@3}
za*#1MeCG4H_o!L!=h3&l1MqLS0KO-6bt_Y2udtBd0pQ&^?)qeLHu)XI@ca@Q5;uK?
zbBcB2!qm<cSyZlI>0bYS1FH8RC1fk};Q;#(!#6|_L*?G}>Mq!E9S=>}X@9kb`$K{(
z@Wx%~|F>7W(tA>W-Mf|f%U)JjngS-jY_Qha-{$w^8mxKTALd<Kc{LR3`#k*SLL~x#
zf7;`wY3WbXu+??4!ON_oBc^w`HB&x6OfxPUQR>gaPj2vQY}`N4hI1d@7E0L0E#8K4
zOm{m|G~LKb&xlV97<@bN&w1Ew;}0`b?ONg6Q+0cDHQ85&%YFkF9g}}U@jua4k`}6O
zbZ@B@-!=f`z1Zwt4(ap$GV&&|196{sPwHoJE&k~~hF1pU?m)nK<G8z7ZMOtn&s-~`
z*^X1K=U+1HgoEUN<I!%*1?hTCo3BWh#g^AbFONG|orY&rnfb39X5z!dKi)<V*GPmM
ztrzI-<$zf27i$wS5M~%u)-C|>7d+gzS+3?pG+VE`7r+}%^v=@G+|_@GtBOY)WA*+*
zTftgQOylz1y<DD&c?)7SI;VTIb6QBdC*aoWobJ)iX~Dt`#I}Zyn7+o_qkY6;<aY*O
z$}}V&!0a*s=9$y`0x-KwfC(P<6JU0E0Ve0hiQgOmv&#!G!P|ZSOg=0HY&!&CDt?Wf
zvLgVd;=5A;rsm&Je1`+fE+4?;BJMZ96im>9>_~vA**DCj0|BNM!-?Mt0Mix6n3h`!
zV0M`R6VmPj!0a*sCRo@TfJsRRT_(W9$Zr#1{{2DLZ@g>ZOF|gbNeJRyg}sBAA9H<}
zgQ;s<nL4Youw-JdG3LKCoS1{DkHU$G4CdDn;nV!=E6V&9H@RRi^>=V%{!K62(8}6V
zn2Bua0jZSEaAf`*JS8T>#*TS&15M;?44RC09Mb$vctbn_7^?3;sQG(_FLN;U1^6<5
zu8&@HP<zBaIy2$)c1@)Ny_s-&yOz?y?o6a!M6|`<0{%>VnJ(s)$5_Ihk2l?L{h;!*
zDFCu3fYTeUAJpM`sq!0$IE|n=xiklL&|D7v4na=k)b!@Pc6%Tv0Pdc>s%AjWZV%)H
z6Z;7{yZw-p^K-L6&Tb#%1atcWIr+Gq;M!D>Q!#98nw<eT72_QXIkf<W>N^~AcKabG
zmvP_Rn+kFYE;`S@sUWB3->{TUa&RihspaT!52u2ht~|!X+)9wM+XFcv?mj@yZV%)H
z4|@kWyFHK-L%#!%)A-Jb&&xTiA*cBG$-Y3&VGTJY6Z;7{hfT<-`MFsj=db}eC3AZY
zIrX@m0y#~FjZO3Bhnyzk9SJ!-0vM|AaL74qLQXB?zCuoyi_V0c9{vqW=`_gck>eJC
zoL+g1iMf>^=dgyHQrvxjoWmM&N*?wOat>?ADTjWCAZK$gr{#g10J!_%<+MDI6HM$U
z<h1;dlk;=4Ku*gCIl<h%Ku$hxCqYidu(4@&2IN$XcP!-80vM|AaL8%-At#q{-yx^q
zqH`gq=HIZCPK2CVj#~tBy7Cwkb1Okk%L6$f?mj?H%L6&V!`?wo%L6$v^xK4-A3j7s
z6zzUu*}`{0jW0^|r7ByQb#?`xuM$Li2Rgsq&F1V&UEj)Vuo``_m$SO(sPofCI%i+%
z4Wx78>sELzz29YMUt#A*-F(iz)HjgN`S-o-s;jO&#hv)nmbRA8$msleWQ(bZ<QyA&
z=go~gzl8iS59b{RJ@NV6m{$Tr`5lNo@vUY3f_h)-OGxVcVjq19Pwy1_nAM2{V8dEE
zFs%~_z=pAOa9$@q**4@_{VkB#`9}eE)F+U!jyoTKen@|asZY7#G#J?v1iI<@5>sF5
z(pDzRUU1j*4TPZhi4KV}@hzsV(Z1AeTbZNmh-<;`6b4m(PcH`T^<q$9-aT`C8W^<K
zi$TG~UVA=G4BFd(K{-P=3kL1=V^DCnKNyq`+zHN4jX@R1#`f7E7*uiIxfoPSU?{)C
zF=%fC2IWHTn*&s1P{Bs$c|bJ=)dCpC(n&5*jX|{_9qt3w7}OQWn3`J&gZ6qcDCFG-
z4BG3(pkQL}FletAgJSHri9x>$U+DMz@|%Tkts9Qeq0}o|nG!3qi2C)oy+ffNcRis)
zsm-m-ReW)>U$e2-F!TovSLjgcV{nDyWh{JwZ@}PaUvcPnxW3S#)c=Mr^dEZJHA7*0
z3PgVjE*Gts&hUo*0-P*fmW^HX=7yrb3b%@v^^U`$_+5gdJ`oJ{cOV$W?^tMu=uqm{
z;Sl}RK87vB-7oghBMSeyX)qn=5{3WVw3iO{iT+-IMGecp1)QSzp@FzxB4aUkJ|e{j
zZG!UWrG}K3&P67Bf=OTX_(g|OD_fbD*o(%hzJZ|hA+KX}D0TZ*CeC7p8NXwwRJlgI
zs5I(BrNF^^<{LFoY1D^G!Nz`~(r6<p<s98Cs5IJuO2OVfp;A6_C-_HQRH|4ucG6Bk
zrHb_qMx|N=L;W3&N~4XaluNm9K2jHz3O+i|N$R3fErDS#o#Z8TQK^=s!`-AVDs?3?
zCg+wyrBNR$g~a=SN~1nh3NH2zl}3H26obD_RQd<_xs6o0T(mdv^9&X~SZDZ2L+U%L
z>=G#U4vjwOLh&GS6hf(^TbaY`ARFLpY%6f`_a0~ci}h-uv?iqT;_R@(*#k9BBjtLY
z|Blb`_ci`{E=S=b?r+9AuWaOsiI?uKz2yGx!<ti{E;z-!_|3@s5+kya{6!91Xw|yP
zx{6LIb|4WL?M~&lGC7uIOtOKB_&3uRw!|;j)(WpWqxjWca3p_+!zr0RTZ^BUT)CX9
z=2q%XwdOLSY1POyp!KN$>sv3BvNU**4=$5%BXV$A8P7E`pniNpl9)W?>iAKQ9RD5R
zHq6L|ilJUS&w{5<5>L77oTo0%ll;u9=1Ek>Uuxv(F{u;T-pA8=d0Uo5*Dg!B>%<cM
z-a1s2y|h_(YO#Z+qN46BiRyTkv&BjIjE#*qn=(OcGKh)ejhf7vAXZ$3z)FfZvEZf;
zlNJSE-JGx2;jI4vdq3`{!isf$e61y8=2Y^&Ouo#?Y|5Y>K{JRF!63en8>YDs4EAsa
zKeUy3jlJsfr>f(tE%`I2wHbeEVw<z425{NST^H<;sa0}ytQ7kB?7(PP{b+?UHCY+Y
z9;aPkd_7lRx$M;B55USwz5(RRPA!4`KEX*6RcFn)o{$8-EkUeAS*LhXY*1=`Z>8!W
z%?`h&O&pcBGFMoE4a(^hb@8VKL$!LYTCY7-s9#n*@upsuF6XW~3DK@OE4+>3M2=2B
zDbicpSS3d2*R{i`;#Q`>)-)rcE`Cuk;*|0x8=|ra8=|5q8=^|HAs(&o4zLjR%zCa+
zs^Q1Bi4nO)4M~lt+W1R?74<ANq8`1>$kIe@<C5s6DNCxYVoGyDD{p{~cSR99!dZL&
zR^~c#@()PXOo}*u+#4pO8c6O;3eKUb--a`@o#L(^h3BNIEb)~}hGSBjP*`%cC*a8a
zN@YLiAt!%S($Ea}xDme!|6hSsob_Cx7#qNxgi^nS4e{Rv=m+WL*u2uZeSHI`0e*Bo
zm$;fM7V-&RoXF+#Rs1r0{J!I2or+TR(|PZEUt(lL{kj`|G(Jt^jE=E9v&_!3&U&T3
zX-%Nx4JT2kp>I6jm$-JhuyUE6F;gwZjW-<^hyBP1ex6VWX8jEo#bq33rQEs`8{|@c
z1yUlcl!a4N?E9+TiunaqHSq~KmMTz!CH!J$<XDi@VTXJJNMTRzNLV#g{PtF3D^az8
z7CyQbEL36<F6YlcPJB&#o@r~YSaH9EGYfhi?~&saDlMg(sX(shwBiaCDbcANNo0(5
zq;V`I4Fs@|y3$>!Ts<8d;*xv`l6*11E+T3zW{m2r+ZtuLdRj{}rbj?wE2D%wr^i^1
z4IBMRksjEgNXC#yn+>VN;_@iL&cvcE1v}GJurtjBJJU|EGd{u2>{c*$NJB7pNK>#g
z7V_A-HmZf#FqiAcF=0O%U{7jfjw<Vbf4-LOnfR#G83<Ymvs^8}>@I2?1X?M}=#D0d
z#)&l<M@c}8TUFLa{o;U+SzLyvwlYi1M!JG9Ia%4b8KU=u?W{Ugr?le4kGtbgUrHuy
zfXmea$VSJoH}#@3{B3<_koC!3G<Jv&`VUat{|Eq+s$pfdHR4yE+8*wsUy{U<RlD&w
zNe1MzVxY}NrAWXdU*A=BP|7U(kjj2^N6K!+*KIBMQj?$*VZ9k--5VQ)eC#mS$cKYl
zng1JLKZI9?)J&k#I_THO^7717{8goWkSMWyk}F_3^5S#%pL}ob<m%+f=@;Jr@CQzs
zkEeI@_`t*m?iv|m&*)u*xR*K`+mX&V?`n}zYt6gT4%dhU%jl_d-5lq-`6{dhKZ&@m
z&ud=UxPQQc*VmnVf{*jK)DfrE19{J}=1O`{2)d$AaNfnPwiOR2>Hzn0qC^&wTAvBB
zVVpD90Nk?znd43ui*xz^C*=R{0sO2<Oz+=5LhGpCPH+gxi@_sO5e>b!Pzo)N1+3}9
zb?iph*&VIMlnNQ&(bT)_xW}(g2F;Gr%uu01_ZYzov|;^8kR6~S(bq6`jBDw~v4Vay
z$UZ^QclY@8(ORb(73Cgn2~xkh7-7V<`sMgzT73-zYmU8EWhfA*?so=QqBTEKiBmgN
zVtZEAA=5-hnpLG-7~9p;P1SqGr?S{>t<~$NZK_^<z;2^ne`lKKmg>dX?^UnAi`}ZX
zEvtrl{o`m>P4%Afs`r1v^MN%eR%PsVuGBxm%Ki@lwyMv3P0(&dKcr1k_NIq#si}H(
z!x>|j*<o#pvgun~#dox1L1`dVkh_TWu^@i3oR+N={SGerUqJLf3$U`@WepPRSkqN1
z+Q%Q&W9vS*SHS7}5<&+hV;9x!r55hr`7)HeB--$zG{H!+1-_#yU7S(6xU;1$6iHKE
zoKc&*p$pYudtIDqsteVAx4O{07`jk>X<kfSoRPZtr63z57?s5jCTA<<YCV?V+V~!9
z<ev(%?+R#u=Ap74@f!zKCq@+_BcSMB!N&OSVpH#Mz7?u^JNI;{+4QfU40@g{<rmO=
zRG81EK3zOLNTofrBLkwAKDLt5jy#=ewv_hzsao=5eFK-r4Y(;{@8(+jQ>>>y4zSl;
z{D`_H_;D8a@hLePHP?f9W%od%hh8AmIC(Pj#FH217EUf*Jo#+y<mH#Itd}Y$>sL>{
z`ojAs-s1;{=vpdehv1MH)8No#Oi9nBwf-!~1}fEZy?kk7HM{ysDRws(|BEo1pARy8
zg+jU7Od{)~-)2@fip9;76rU-q7JwNSWS0r@pu`JOL1rJ@D{7L|@@n>l=j0#I*$XE|
zpMQQ_6?kjLP7t0(4*gNNDVw87-KBP9Q0;|LcQvznEsRobzp9;nrDT1ki$&FQHV>yJ
z>G>Y6=WjsIe;;J{T>KF~*OJisrd{b;fPx%_hw_NSCD2Q};#a@yT65jXR$J<NyIH_n
zwzs#CN6y6Z+n<SMqTaoosA_^DYC@*Ub(*8k^|0tQr&!EhDV494a0y3zAr`|NMJ8h7
zSQ~`P3;A5#8Gn)pY^qQFMK=!JZuZv!_HHSyzl-t9m<OktrDb3x{4<$ZT3Sd53b9ar
zI3S#&{%$B3`M@^Qb^LNp1x|>WmHHSp5dDdQ#N#6`o_$>0SYO4WI{xmv?!M>wkrVfx
z9DgzU+6SM%e&+rc?!9XyaTd4S7oXp_AOG=xC;7iqR5wN!g0US4E2sHAJDTPOJ&f%{
z4SXsYK+j#<@WXkqj<?f3Cy9Sg8}&~p_3I$j&J?aRd6FyfVWCj|@W3=ZJT(0RHm;UB
zr%esMp9oomYkAgT#E$qR$BxoIV#_DX_ywsX4+|XI%EZ`V?HJlNhMyW>%(cGcmo3J4
zD9`3;3iw!)k)|+^y0VqI47lCT<AO4t|J07-`G^hNecg@5?l6>J5utqY%6F$;+{!!$
zA4*s-fIDV<mIpa`D5zOj*bKb32?(o@4-euaN!J&|uWn_^aG(r|VJSXKLqFd*v>EsX
zi8=a?!oFyuSW)47d``g^zLzi6DQ-lFJ^oxHH)fc(k(+IUydGvm;2x+_MOI@J9uKP|
zX330-@2(sdYg7j86&w=F+>G<`Marw+MvNEPG%ChRA#rV|17g19WkW_*cOBw2ZB`1v
zZzFo5ME@2Riwf{k?0X<p*vhOTk|nti@z?m$TZ->C^3XiGiwqncQ|0k)t&50Wvpn>x
z_)y`|9R+tAxlqlOF7)6Q9Q*W^1AY5sAoblq*T@aPSrQU#AXNE!pkV_jltxr?N8+)>
z{fT?-NgU@Elqi%M(}jqdhj`US529j$XQZ^*WT=(m77SX~^s5l`qt65S=cWap6c)Zg
zVb#A9Q8)%u38kbbqonoIJ_t80VUHVxlQ}Wu#=c*lTw+6{G9BD9=pH!3USiTL;5ZQ>
z)?LTwRNS$V6`a@i<0zv@-G5V&x_&P0@4y^>n_{a>S_5wQjsEDF1=n8}e^5(|LK&zt
zWN9ihIfmQ;q=0WBVs~eov89kAZub{L%ri1j{<{$K%K<3a6?40=-D!6y9YfnjOiZIG
z=i3P28FDrZZpeAY!mmS#;EM>n{tD#$LV!K3<fPa`ldCg@UX*-h_+oqcUR3i)&E!1p
z@LEiRD!G~ss^sE4pLX*hBYZQ6Z)J`!yyPydXt!YMue(?{UD{X|SjwC7*`rfF9Z>9D
z%I9%5kVkN$<m9vEQgM?fDTeHRSvHR%>ovY{cR>L?Do3f0Gr1>uE?4z_+|4=2Ze^Zl
z&$52b!42Gwja=9sKCsG#<pXa!^~q0mvq9UbIJh$A#f1N`OeQSUo%LEQfSs>9^(|N`
zA7US1R#lRY6PV-_GM&(aWKB59i8P>;2XDefmH7lwjMm27!%v_UJ%T#+LMWLbrmP>6
z>4dy*nXu}9r`2E*7?ab)ue3**oT!1xQaQ0+t~!bO<y<KN6i!sl7*(UVjOMP-a7K~+
zv{5R&vf;!igEgd1=^?E~QEQE=0?I)`st|_;N>_r0k6w!_7rZP~M~ZkH9Yge;k7tdu
z9xfDzyZwIW0MA9{(`^f~6XDR;`=YPozhLrnT`Y7VR}t3mebO4pjjF8SwXMu1zOpd5
zo~v*>;B_)>v!xwyBCg_G#q}`g1YzV|m2gvZ8d8<X40u~tyM@vMabvwH&45=+Gmx2g
zf;UVIuZuhFr=Jrw;Z0mMTC=A5cUj9_7p&dKy018!wQaS}sjT~1FQ4~XjP3#LW=qnU
z)AaxgO_nyrY(@AUNJ;Tw0GN_>NbgFtFNW<N>_juA<li1<gHs#TT)j{(iH1L-Z_Jeb
z-9K@3e63twD>~!K|1_@XRd#$NFFV+~LjcP@SgiA<)Rsf_*%Zy;UcaFFi}JH6bk%Ij
zsqsY>gV}w3clER4iz>np+n9m-u@%kvp1;;=jNB=&wR%}LUd6ikUu*TU-jT1h`b03)
z-+`~SenWn2g}gRxcNyb5EQSL1^^I4PkIsDK)hB^rN}cw`t51?!;Eh+mM8@QF{u{49
zAUu?P0Ca6vz5Fqceyxl>xd-DFxn6PI<v!H59IDT^Xbx}SJ=u1BB;+t{%a{7Hi{@+F
zYjmogUJR_&@NQ48l!~x{wJP1HtNc0nZM`hQZ(J90wJQQ|<KtyUgsOic-hj7tgVZN*
z`Tkgd;f=5;k`{{j>^i!UsJqJVTZl|tu2Jx{!8MILWUUVGw4iuAAu_GS8>*u0ZsW$)
zzPY;P$ahuoYB_nz`DG*Zo8WOP!0<5x{2Ykp5f=CPfCwD$!NzmN;%Mc*M5U!;oP4AW
zTyX!oa~(eN+UP1;j~lU&)q6+A;ZJuR>f|0usH?LO5f1jYQu=-C$gxp2%&$$UKY?^#
z4KVl*hYjhZwSK9YgvUpl%P895W#MLWs!F`G-BwmtShUcx=1QCNrXdVrJ9*VOdO}e!
zQ?i!bB|<)|_C|T<R^~PqXO^LlZC6S1>ql5*sj%)~{??^`;a};6ATFMb3qdzX$#CXS
zU3IZ{SI>WKUOn6K`07^X8rxt4E{}VC`NX?KUB$X1T@USe{dSl&b`^Md2TgYO_4>Ka
zdW-cea#wg5FqB%_%6v24@`{=aQg!?h8Tu2{6mz4k5b-xux(fucd)k+U3lBBOV32Rn
z73*{5Yu4w@+ip8u{lDI=%s=%aGv1ilJ-zS#G`?QwDxovJE($-$Q6J9+6uY@^yuXIy
z*2jCtU3n3#jQeFUCZGfFy#M66^R`>Czm1QN{zf06CS!Bk$FGk9@p<g213y2C_liB{
z)WP2${e3_=b7kBDA0P!lJ=P$SvD!QT=38OCIQMXh^Dj|^Qt~BM&$8m!;4z5}1hvKn
zk2YWfc}?@fgMi($#^C`DuwHsQ4EG%R=0w|D<F^7$A(!ey<}w#;<5xH|;lrP-QikHV
zs8AUp0=3-hsZw_}AQ(xE2xNJcMDRySMZH4vl3{Dfh4b|Jhh}hoNdf899b1`W?5MdW
zwng*p@4RWoE*8o~9%8Cl4>5LCKOv?}>>TmtD{E@oAWh<(|FEvHPO=_;-;iN4Uk}rC
z@m#<S$QD%Ay{wy5%0KDSFrG`ziL4{6kBGB)wSsOUVY`<eXYy7Id5nONxit~Q4cqFG
znyi+qSp@nx*hYFQ9-nkJpXd$+qCp$K8Adl@x|1c(v#=h}I?F;%(OE~plOn35i#xo!
z(4=WWW^4N7SCFLdueOjKA;v;Z#wDl9gZ4c(euWU@&+#JbcKU%(Vuyb#LP!`E1eEhV
zqpIth6(MJ2;zV<w#FSH8sTL~ra&>{;o)}+33tMzWe_Cl4f=05uBMN}+uA@G*<=ucI
z9upNEQ8;RM9ff&o-qm5m!b^E1%9E$O8@XNL(K?2-HGH^?Pau6{Cxog#D#09DM_C`f
zwZ-e`yEk2^>qP-op&iAOc^z#F)MX!)Q01NKvjDuB(&WOZ4vV}}5YV!rug!2Bp7;zl
zn3=T_vJ8+bZOxpYo43>1<+;U$^tqYone<fjU9i7{vV3Mb`)t~t&t9CIT~0>>)-W5C
zHIuVXO+K?2?Milsg3;iK0a={Bu(0&ZiHLlfN>5KN&n}%f;&vyCM2{y9xfRQE3-b%h
zvy)5dsS_o}jFj$U?8uXI^H0rX?ezKd(>`7k>^8HK66Uj+^yF09&dyC<AfAu2+gnix
zv4UqW>IG-r*<gYf#8RBEQ0%%E`>5EK<KFcniEP?x^>RHs$9l>or@U(2-q7njmHYbi
zy-&eOM315y>W?p=CjCv*QfuEICz1W}ZqB~I7*cX&O4D|oz99s^-77fWv6JmZ&qjx-
z60<IC6pDFIi`3vn`N9Za%nN~M&(m8Zobc3|Q#!R)K7|7D%yR*-toREir})!Kxrl0f
zAEG8HDG`&`v;W-1hB?itTpmdrB9p-C;Scd+Xr)Q@AA%<N1Y?u=ybUiUJVn+Wtefvy
zl!+8hu`gu$sy)#_?De3{%dOj3SLK@Av^~{SoP3b=r}Krn>dZ1blO05j4s71&J#28X
zo~v)vcGql*g>0u*fn7Ql23jfS9k~_rzby>3UR#sL3;jt{cv&aMQyRiH|9b)n$32sz
zF>8!<K@ZmOxKN<0llYJ<(!=4XBQY&YRv0oj5}#tdLOkoBB=<<$&>$6lwr^a_;w2=k
JW7B`|{{vO$fz1E_

literal 0
HcmV?d00001

diff --git a/bff/etc/bff.yaml b/bff/etc/bff.yaml
index 685e713..bcfb0c4 100644
--- a/bff/etc/bff.yaml
+++ b/bff/etc/bff.yaml
@@ -20,3 +20,19 @@ Upstreams:
       Timeout: 5000
     ProtoSets:
       - etc/product.pb
+  - Name: admin
+    Grpc:
+      Target: admin-service
+      Timeout: 5000
+    ProtoSets:
+      - etc/admin.pb
+    Mappings:
+      - Method: post
+        Path: /admin/v3/admin/add
+        RpcPath: admin.Admin/Add
+      - Method: post
+        Path: /admin/v3/admin/edit
+        RpcPath: admin.Admin/Edit
+      - Method: post
+        Path: /admin/v3/admin/status
+        RpcPath: admin.Admin/Status
\ No newline at end of file
diff --git a/bff/go.mod b/bff/go.mod
index aed2efb..3ce36b6 100644
--- a/bff/go.mod
+++ b/bff/go.mod
@@ -3,6 +3,7 @@ module bff
 go 1.26
 
 require (
+	github.com/go-playground/validator/v10 v10.30.3
 	github.com/zeromicro/go-zero v1.10.2
 	google.golang.org/grpc v1.80.0
 	pkg.local v0.0.0
@@ -24,12 +25,15 @@ require (
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/fullstorydev/grpcurl v1.9.3 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
 	github.com/go-jose/go-jose/v4 v4.1.3 // indirect
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
@@ -44,6 +48,7 @@ require (
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.13 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
@@ -86,12 +91,13 @@ require (
 	go.uber.org/zap v1.24.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.2 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.50.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
 	golang.org/x/oauth2 v0.34.0 // indirect
-	golang.org/x/sync v0.19.0 // indirect
-	golang.org/x/sys v0.41.0 // indirect
-	golang.org/x/term v0.40.0 // indirect
-	golang.org/x/text v0.34.0 // indirect
+	golang.org/x/sync v0.20.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/term v0.43.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	golang.org/x/time v0.14.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260128011058-8636f8732409 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260128011058-8636f8732409 // indirect
diff --git a/bff/go.sum b/bff/go.sum
index 4716251..6370406 100644
--- a/bff/go.sum
+++ b/bff/go.sum
@@ -36,6 +36,8 @@ github.com/fullstorydev/grpcurl v1.9.3 h1:PC1Xi3w+JAvEE2Tg2Gf2RfVgPbf9+tbuQr1Zky
 github.com/fullstorydev/grpcurl v1.9.3/go.mod h1:/b4Wxe8bG6ndAjlfSUjwseQReUDUvBJiFEB7UllOlUE=
 github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
 github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
+github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
 github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
@@ -51,6 +53,14 @@ github.com/go-openapi/jsonreference v0.20.2/go.mod h1:Bl1zwGIM8/wsvqjsOQLJ/SH+En
 github.com/go-openapi/swag v0.22.3/go.mod h1:UzaqsxGiab7freDnrUUra0MwWfN/q7tE4j+VcZ0yl14=
 github.com/go-openapi/swag v0.23.0 h1:vsEVJDUo2hPJ2tu0/Xc+4noaxyEffXNIs3cOULZ+GrE=
 github.com/go-openapi/swag v0.23.0/go.mod h1:esZ8ITTYEsH1V2trKHjAN8Ai7xHb8RV+YSZ577vPjgQ=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.30.3 h1:4MU6YkEwx7GbcPJOZxrtbu+QfF3pJLJuaYTeAH0DYy8=
+github.com/go-playground/validator/v10 v10.30.3/go.mod h1:4Axh7oCNGcoGkqLoE4YWt6n20mcEIsPRlB7vPk3lpyc=
 github.com/go-task/slim-sprig v0.0.0-20230315185526-52ccab3ef572 h1:tfuBGBXKqDEevZMzYi5KSi8KkcZtzBcTgAUUtapy0OI=
 github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI=
 github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8=
@@ -101,6 +111,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
 github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA=
@@ -230,42 +242,44 @@ go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.50.0 h1:ucWh9eiCGyDR3vtzso0WMQinm2Dnt8cFMuQa9K33J60=
-golang.org/x/net v0.50.0/go.mod h1:UgoSli3F/pBgdJBHCTc+tp3gmrU4XswgGRgtnwWTfyM=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
 golang.org/x/oauth2 v0.34.0 h1:hqK/t4AKgbqWkdkcAeI8XLmbK+4m4G5YeQRrmiotGlw=
 golang.org/x/oauth2 v0.34.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.19.0 h1:vV+1eWNmZ5geRlYjzm2adRgW2/mcpevXNg50YZtPCE4=
-golang.org/x/sync v0.19.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
+golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
+golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.41.0 h1:Ivj+2Cp/ylzLiEU89QhWblYnOE9zerudt9Ftecq2C6k=
-golang.org/x/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
+golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.34.0 h1:oL/Qq0Kdaqxa1KbNeMKwQq0reLCCaFtqu2eNuSeNHbk=
-golang.org/x/text v0.34.0/go.mod h1:homfLqTYRFyVYemLBFl5GgL/DWEiH5wcsQ5gSh1yziA=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
 golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
-golang.org/x/tools v0.41.0 h1:a9b8iMweWG+S0OBnlU36rzLp20z1Rp10w+IY2czHTQc=
-golang.org/x/tools v0.41.0/go.mod h1:XSY6eDqxVNiYgezAVqqCeihT4j1U2CCsqvH3WhQpnlg=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/bff/internal/response/middleware.go b/bff/internal/response/middleware.go
index 441cd3e..4443f0c 100644
--- a/bff/internal/response/middleware.go
+++ b/bff/internal/response/middleware.go
@@ -3,6 +3,7 @@ package response
 import (
 	"bytes"
 	"encoding/json"
+	"log"
 	"net/http"
 	"strings"
 
@@ -16,6 +17,12 @@ type bodyWriter struct {
 	buf    bytes.Buffer
 }
 
+type responseData struct {
+	Code int32  `json:"code"`
+	Data any    `json:"data"`
+	Msg  string `json:"msg"`
+}
+
 func (w *bodyWriter) WriteHeader(statusCode int) {
 	w.status = statusCode
 }
@@ -28,22 +35,22 @@ func Wrap(next http.HandlerFunc) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		bw := &bodyWriter{ResponseWriter: w, status: http.StatusOK}
 		next(bw, r)
-
+		log.Printf("raw json: %s", bw.status)
 		ctrl := BaseController{}
-		if bw.status >= http.StatusBadRequest {
+		if bw.status != http.StatusOK {
 			ctrl.Error(w, mapHTTPError(bw.status, bw.buf.String()))
 			return
 		}
 
 		raw := bytes.TrimSpace(bw.buf.Bytes())
-		var data any
+		var data responseData
 		if len(raw) > 0 {
 			if err := json.Unmarshal(raw, &data); err != nil {
 				ctrl.Fail(w)
 				return
 			}
 		}
-		ctrl.Ok(w, data)
+		ctrl.OutPut(w, data.Code, data.Data, data.Msg)
 	}
 }
 
diff --git a/bff/internal/response/response.go b/bff/internal/response/response.go
index 2c52eb5..ae8b6bf 100644
--- a/bff/internal/response/response.go
+++ b/bff/internal/response/response.go
@@ -52,3 +52,12 @@ func (b *BaseController) Out(w http.ResponseWriter, data any, cm Error) {
 	w.WriteHeader(http.StatusOK)
 	_ = json.NewEncoder(w).Encode(out)
 }
+
+func (b *BaseController) OutPut(w http.ResponseWriter, code int32, data any, msg string) {
+	// 复制一份，避免并发请求改到包级 OK/Fail 单例
+	out := NewError(int(code), msg).WithData(data)
+
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(http.StatusOK)
+	_ = json.NewEncoder(w).Encode(out)
+}
diff --git a/pkg/go.mod b/pkg/go.mod
index 8ce6335..99ba190 100644
--- a/pkg/go.mod
+++ b/pkg/go.mod
@@ -4,6 +4,7 @@ go 1.26
 
 require (
 	buf.build/go/protovalidate v0.14.0
+	github.com/go-playground/validator/v10 v10.30.3
 	github.com/redis/go-redis/v9 v9.19.0
 	go.uber.org/zap v1.24.0
 	google.golang.org/grpc v1.80.0
@@ -20,17 +21,22 @@ require (
 	filippo.io/edwards25519 v1.1.0 // indirect
 	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.13 // indirect
+	github.com/go-playground/locales v0.14.1 // indirect
+	github.com/go-playground/universal-translator v0.18.1 // indirect
 	github.com/go-sql-driver/mysql v1.8.1 // indirect
 	github.com/google/cel-go v0.25.0 // indirect
 	github.com/jinzhu/inflection v1.0.0 // indirect
 	github.com/jinzhu/now v1.1.5 // indirect
+	github.com/leodido/go-urn v1.4.0 // indirect
 	github.com/stoewer/go-strcase v1.3.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.uber.org/multierr v1.6.0 // indirect
+	golang.org/x/crypto v0.52.0 // indirect
 	golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 // indirect
-	golang.org/x/net v0.49.0 // indirect
-	golang.org/x/sys v0.40.0 // indirect
-	golang.org/x/text v0.33.0 // indirect
+	golang.org/x/net v0.54.0 // indirect
+	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260120221211-b8f7ae30c516 // indirect
 )
diff --git a/pkg/go.sum b/pkg/go.sum
index fbd9614..7efd763 100644
--- a/pkg/go.sum
+++ b/pkg/go.sum
@@ -19,10 +19,20 @@ github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XL
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM=
+github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
+github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s=
+github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4=
+github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA=
+github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
+github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
+github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
+github.com/go-playground/validator/v10 v10.30.3 h1:4MU6YkEwx7GbcPJOZxrtbu+QfF3pJLJuaYTeAH0DYy8=
+github.com/go-playground/validator/v10 v10.30.3/go.mod h1:4Axh7oCNGcoGkqLoE4YWt6n20mcEIsPRlB7vPk3lpyc=
 github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
@@ -39,6 +49,8 @@ github.com/jinzhu/now v1.1.5 h1:/o9tlHleP7gOFmsnYNz3RGnqzefHA47wQpKrrdTIwXQ=
 github.com/jinzhu/now v1.1.5/go.mod h1:d3SSVoowX0Lcu0IBviAWJpolVfI5UJVZZ7cO71lE/z8=
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
+github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
+github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU=
 github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y=
 github.com/pkg/errors v0.8.1 h1:iURUrRGxPUNPdy5/HRSm+Yj6okJ6UtLINN0Q9M4+h3I=
@@ -81,14 +93,16 @@ go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4=
 go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU=
 go.uber.org/zap v1.24.0 h1:FiJd5l1UOLj0wCgbSE0rwwXHzEdAZS6hiiSnxJN/D60=
 go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg=
+golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
+golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
 golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw=
 golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ=
-golang.org/x/net v0.49.0 h1:eeHFmOGUTtaaPSGNmjBKpbng9MulQsJURQUAfUwY++o=
-golang.org/x/net v0.49.0/go.mod h1:/ysNB2EvaqvesRkuLAyjI1ycPZlQHM3q01F02UY/MV8=
-golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
-golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/text v0.33.0 h1:B3njUFyqtHDUI5jMn1YIr5B0IE2U0qck04r6d4KPAxE=
-golang.org/x/text v0.33.0/go.mod h1:LuMebE6+rBincTi9+xWTY8TztLzKHc/9C1uBCG27+q8=
+golang.org/x/net v0.54.0 h1:2zJIZAxAHV/OHCDTCOHAYehQzLfSXuf/5SoL/Dv6w/w=
+golang.org/x/net v0.54.0/go.mod h1:Sj4oj8jK6XmHpBZU/zWHw3BV3abl4Kvi+Ut7cQcY+cQ=
+golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
+golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260120221211-b8f7ae30c516 h1:vmC/ws+pLzWjj/gzApyoZuSVrDtF1aod4u/+bbj8hgM=
diff --git a/pkg/validate/validator_util.go b/pkg/validate/validator_util.go
new file mode 100644
index 0000000..d97d257
--- /dev/null
+++ b/pkg/validate/validator_util.go
@@ -0,0 +1,81 @@
+package validate
+
+import (
+	"fmt"
+	"reflect"
+
+	"github.com/go-playground/validator/v10"
+)
+
+// ValidatorMessages 自定义错误消息
+type ValidatorMessages map[string]string
+
+// IValidator 业务结构体实现该接口
+type IValidator interface {
+	GetMessage() ValidatorMessages
+}
+
+var v *validator.Validate
+
+func init() {
+	v = validator.New()
+}
+
+// CopySameField 反射自动拷贝同名字段：src(proto入参) → dst(校验model结构体指针)
+// src: proto message对象，传值in
+// dst: model校验结构体指针 &model.AdminGroupValidator{}
+func CopySameField(src interface{}, dst interface{}) {
+	srcVal := reflect.ValueOf(src)
+	dstVal := reflect.ValueOf(dst).Elem()
+
+	// 如果src是指针，取element
+	if srcVal.Kind() == reflect.Ptr {
+		srcVal = srcVal.Elem()
+	}
+
+	for i := 0; i < srcVal.NumField(); i++ {
+		srcField := srcVal.Field(i)
+		fieldName := srcVal.Type().Field(i).Name
+
+		// 查找dst中同名的字段
+		dstField := dstVal.FieldByName(fieldName)
+		if !dstField.IsValid() || !dstField.CanSet() {
+			continue
+		}
+		// 类型相同才赋值
+		if srcField.Type() == dstField.Type() {
+			dstField.Set(srcField)
+		}
+	}
+}
+
+// ValidateStruct 校验，返回 *admin.Response
+func ValidateStruct(obj IValidator) string {
+	err := v.Struct(obj)
+	if err == nil {
+		return ""
+	}
+
+	customMsg := obj.GetMessage()
+	var errMsg string
+	if ves, ok := err.(validator.ValidationErrors); ok {
+		ve := ves[0]
+		key := fmt.Sprintf("%s.%s", ve.Field(), ve.Tag())
+		if msg, exist := customMsg[key]; exist {
+			errMsg = msg
+		} else {
+			errMsg = fmt.Sprintf("%s校验失败:%s", ve.Field(), ve.Tag())
+		}
+	} else {
+		errMsg = err.Error()
+	}
+	return errMsg
+}
+
+// ValidateFromProto 一步到位：自动拷贝proto同名字段 + 校验
+// src: proto请求 in (*admin.XXXRequest)
+// dst: model校验结构体实例指针 &model.AdminGroupValidator{}
+func ValidateFromProto(src interface{}, dst IValidator) string {
+	CopySameField(src, dst)
+	return ValidateStruct(dst)
+}
diff --git a/product/proto/admin/product.proto b/product/proto/admin/product.proto
index e964f2f..ad78d49 100644
--- a/product/proto/admin/product.proto
+++ b/product/proto/admin/product.proto
@@ -4,21 +4,10 @@ package product;
 option go_package="./product";
 
 import "buf/validate/validate.proto";
-import "google/api/annotations.proto";
 
 service Product {
-  rpc Add(AddReq) returns (AddResp) {
-    option (google.api.http) = {
-      post: "/admin/v3/product"
-      body: "*"
-    };
-  }
-  rpc Edit(EditReq) returns (EditResp) {
-    option (google.api.http) = {
-      put: "/admin/v3/product"
-      body: "*"
-    };
-  }
+  rpc Add(AddReq) returns (AddResp);
+  rpc Edit(EditReq) returns (EditResp);
 }
 
 message AddReq {