fix: harden struts auth responses

.gitignore

@@ -0,0 +1,2 @@
+target/
+*.log

pom.xml

@@ -0,0 +1,91 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.demo</groupId>
+    <artifactId>struts2-demo</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+    <packaging>war</packaging>
+
+    <name>Struts2 Demo Lab</name>
+    <description>Classic Struts2 learning project packaged as a runnable Maven WAR.</description>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <maven.compiler.release>17</maven.compiler.release>
+        <struts2.version>2.5.33</struts2.version>
+        <jetty.version>9.4.54.v20240208</jetty.version>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.struts</groupId>
+            <artifactId>struts2-core</artifactId>
+            <version>${struts2.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.struts</groupId>
+            <artifactId>struts2-json-plugin</artifactId>
+            <version>${struts2.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>commons-fileupload</groupId>
+            <artifactId>commons-fileupload</artifactId>
+            <version>1.5</version>
+        </dependency>
+        <dependency>
+            <groupId>javax.servlet</groupId>
+            <artifactId>javax.servlet-api</artifactId>
+            <version>4.0.1</version>
+            <scope>provided</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <sourceDirectory>${project.basedir}/web/WEB-INF/classes</sourceDirectory>
+        <resources>
+            <resource>
+                <directory>${project.basedir}/web/WEB-INF/classes</directory>
+                <excludes>
+                    <exclude>**/*.java</exclude>
+                </excludes>
+            </resource>
+        </resources>
+
+        <plugins>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-compiler-plugin</artifactId>
+                <version>3.11.0</version>
+                <configuration>
+                    <release>${maven.compiler.release}</release>
+                </configuration>
+            </plugin>
+
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-war-plugin</artifactId>
+                <version>3.4.0</version>
+                <configuration>
+                    <warSourceDirectory>${project.basedir}/web</warSourceDirectory>
+                    <packagingExcludes>WEB-INF/classes/**/*.java</packagingExcludes>
+                </configuration>
+            </plugin>
+
+            <plugin>
+                <groupId>org.eclipse.jetty</groupId>
+                <artifactId>jetty-maven-plugin</artifactId>
+                <version>${jetty.version}</version>
+                <configuration>
+                    <scanIntervalSeconds>0</scanIntervalSeconds>
+                    <webAppSourceDirectory>${project.basedir}/web</webAppSourceDirectory>
+                    <webApp>
+                        <contextPath>/</contextPath>
+                    </webApp>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+</project>

web/WEB-INF/classes/com/demo/action/AjaxAction.java

@@ -0,0 +1,48 @@
+package com.demo.action;
+
+import com.demo.model.User;
+import com.opensymphony.xwork2.ActionSupport;
+
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.Arrays;
+import java.util.List;
+
+public class AjaxAction extends ActionSupport {
+
+    private static final DateTimeFormatter TIME_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
+
+    private boolean success;
+    private String message;
+    private String serverTime;
+    private List<User> users;
+
+    @Override
+    public String execute() {
+        success = true;
+        message = "Mock AJAX response generated from the Struts2 action.";
+        serverTime = LocalDateTime.now().format(TIME_FORMATTER);
+        users = Arrays.asList(
+            new User(1L, "ops-admin", "ops-admin@example.com", "13800000001"),
+            new User(2L, "platform-owner", "platform-owner@example.com", "13800000002"),
+            new User(3L, "release-manager", "release-manager@example.com", "13800000003")
+        );
+        return SUCCESS;
+    }
+
+    public boolean isSuccess() {
+        return success;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public String getServerTime() {
+        return serverTime;
+    }
+
+    public List<User> getUsers() {
+        return users;
+    }
+}

web/WEB-INF/classes/com/demo/action/DashboardAction.java

@@ -0,0 +1,44 @@
+package com.demo.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
+
+import java.util.Map;
+
+public class DashboardAction extends ActionSupport implements SessionAware {
+
+    private Map<String, Object> session;
+    private String displayName;
+    private String role;
+    private String loginTime;
+
+    @Override
+    public String execute() {
+        displayName = value(LoginAction.SESSION_USER, "ops-admin");
+        role = value(LoginAction.SESSION_ROLE, "admin");
+        loginTime = value(LoginAction.SESSION_LOGIN_TIME, "--");
+        return SUCCESS;
+    }
+
+    private String value(String key, String fallback) {
+        Object value = session == null ? null : session.get(key);
+        return value == null ? fallback : String.valueOf(value);
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public String getRole() {
+        return role;
+    }
+
+    public String getLoginTime() {
+        return loginTime;
+    }
+
+    @Override
+    public void setSession(Map<String, Object> session) {
+        this.session = session;
+    }
+}

web/WEB-INF/classes/com/demo/action/FileUploadAction.java

@@ -0,0 +1,93 @@
+package com.demo.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+
+import java.io.File;
+import java.util.List;
+
+public class FileUploadAction extends ActionSupport {
+
+    private File upload;
+    private String uploadFileName;
+    private String uploadContentType;
+    private List<File> uploads;
+    private List<String> uploadsFileName;
+    private List<String> uploadsContentType;
+    private int fileCount;
+    private String summary;
+
+    @Override
+    public String execute() {
+        fileCount = 0;
+        if (upload != null) {
+            fileCount++;
+        }
+        if (uploads != null) {
+            fileCount += uploads.size();
+        }
+
+        if (fileCount == 0) {
+            addActionError("请至少选择一个文件再提交。/ Select at least one file before submitting the demo.");
+            return INPUT;
+        }
+
+        summary = "metadata-only";
+        return SUCCESS;
+    }
+
+    public File getUpload() {
+        return upload;
+    }
+
+    public void setUpload(File upload) {
+        this.upload = upload;
+    }
+
+    public String getUploadFileName() {
+        return uploadFileName;
+    }
+
+    public void setUploadFileName(String uploadFileName) {
+        this.uploadFileName = uploadFileName;
+    }
+
+    public String getUploadContentType() {
+        return uploadContentType;
+    }
+
+    public void setUploadContentType(String uploadContentType) {
+        this.uploadContentType = uploadContentType;
+    }
+
+    public List<File> getUploads() {
+        return uploads;
+    }
+
+    public void setUploads(List<File> uploads) {
+        this.uploads = uploads;
+    }
+
+    public List<String> getUploadsFileName() {
+        return uploadsFileName;
+    }
+
+    public void setUploadsFileName(List<String> uploadsFileName) {
+        this.uploadsFileName = uploadsFileName;
+    }
+
+    public List<String> getUploadsContentType() {
+        return uploadsContentType;
+    }
+
+    public void setUploadsContentType(List<String> uploadsContentType) {
+        this.uploadsContentType = uploadsContentType;
+    }
+
+    public int getFileCount() {
+        return fileCount;
+    }
+
+    public String getSummary() {
+        return summary;
+    }
+}

web/WEB-INF/classes/com/demo/action/HelloAction.java

@@ -0,0 +1,51 @@
+package com.demo.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+
+public class HelloAction extends ActionSupport {
+
+    private String name;
+    private String message;
+    private String tip;
+    private String nextStep;
+    private String requestSample;
+
+    @Override
+    public String execute() {
+        if (name == null || name.trim().isEmpty()) {
+            name = "World";
+        } else {
+            name = name.trim();
+        }
+
+        message = "Hello, " + name + "! Welcome to the Struts2 demo lab.";
+        tip = "Struts2 injected the request parameter into the action property before execute() ran.";
+        nextStep = "Try the login flow or open the demo catalog to compare different action patterns.";
+        requestSample = "/hello?name=Platform%20Team";
+        return SUCCESS;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public String getTip() {
+        return tip;
+    }
+
+    public String getNextStep() {
+        return nextStep;
+    }
+
+    public String getRequestSample() {
+        return requestSample;
+    }
+}

web/WEB-INF/classes/com/demo/action/LoginAction.java

@@ -0,0 +1,96 @@
+package com.demo.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
+
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+import java.util.Map;
+
+public class LoginAction extends ActionSupport implements SessionAware {
+
+    public static final String SESSION_USER = "demoUser";
+    public static final String SESSION_ROLE = "demoRole";
+    public static final String SESSION_LOGIN_TIME = "demoLoginTime";
+
+    private static final DateTimeFormatter TIME_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
+
+    private Map<String, Object> session;
+    private String username;
+    private String password;
+    private String displayName;
+    private String loginTime;
+
+    @Override
+    public String execute() {
+        username = normalize(username);
+        password = normalize(password);
+
+        if (!hasSubmitted()) {
+            return INPUT;
+        }
+
+        if ("admin".equals(username) && "123456".equals(password)) {
+            displayName = "ops-admin";
+            loginTime = LocalDateTime.now().format(TIME_FORMATTER);
+            session.put(SESSION_USER, displayName);
+            session.put(SESSION_ROLE, "admin");
+            session.put(SESSION_LOGIN_TIME, loginTime);
+            return SUCCESS;
+        }
+
+        addActionError("演示账号或密码不正确，请使用 admin / 123456。/ Invalid demo credentials. Use admin / 123456.");
+        return INPUT;
+    }
+
+    @Override
+    public void validate() {
+        if (!hasSubmitted()) {
+            return;
+        }
+        if (username == null || username.length() < 3) {
+            addFieldError("username", "用户名至少 3 个字符。/ Username must be at least 3 characters.");
+        }
+        if (password == null || password.length() < 6) {
+            addFieldError("password", "密码至少 6 个字符。/ Password must be at least 6 characters.");
+        }
+    }
+
+    private boolean hasSubmitted() {
+        return (username != null && !username.trim().isEmpty())
+            || (password != null && !password.trim().isEmpty());
+    }
+
+    private String normalize(String value) {
+        return value == null ? null : value.trim();
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public void setPassword(String password) {
+        this.password = password;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public String getLoginTime() {
+        return loginTime;
+    }
+
+    @Override
+    public void setSession(Map<String, Object> session) {
+        this.session = session;
+    }
+}

web/WEB-INF/classes/com/demo/action/LogoutAction.java

@@ -0,0 +1,26 @@
+package com.demo.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+import org.apache.struts2.interceptor.SessionAware;
+
+import java.util.Map;
+
+public class LogoutAction extends ActionSupport implements SessionAware {
+
+    private Map<String, Object> session;
+
+    @Override
+    public String execute() {
+        if (session != null) {
+            session.remove(LoginAction.SESSION_USER);
+            session.remove(LoginAction.SESSION_ROLE);
+            session.remove(LoginAction.SESSION_LOGIN_TIME);
+        }
+        return SUCCESS;
+    }
+
+    @Override
+    public void setSession(Map<String, Object> session) {
+        this.session = session;
+    }
+}

web/WEB-INF/classes/com/demo/action/UserAction.java

@@ -0,0 +1,90 @@
+package com.demo.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+
+public class UserAction extends ActionSupport {
+
+    private static final DateTimeFormatter TIME_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
+
+    private String username;
+    private String email;
+    private String phone;
+    private String submittedAt;
+    private String profileStage;
+    private boolean profileReady;
+
+    public String submit() {
+        username = normalize(username);
+        email = normalize(email);
+        phone = normalize(phone);
+
+        if (!isValid()) {
+            return INPUT;
+        }
+
+        submittedAt = LocalDateTime.now().format(TIME_FORMATTER);
+        profileReady = phone != null && phone.length() >= 7;
+        profileStage = profileReady ? "ready" : "review";
+        return SUCCESS;
+    }
+
+    private boolean isValid() {
+        boolean valid = true;
+        if (username == null || username.length() < 3) {
+            addFieldError("username", "用户名至少 3 个字符。/ Username must be at least 3 characters.");
+            valid = false;
+        }
+        if (email == null || !email.contains("@")) {
+            addFieldError("email", "请输入有效邮箱。/ Enter a valid email address.");
+            valid = false;
+        }
+        if (phone == null || phone.replaceAll("[^0-9]", "").length() < 7) {
+            addFieldError("phone", "手机号至少 7 位数字。/ Enter at least 7 digits for the phone number.");
+            valid = false;
+        }
+        return valid;
+    }
+
+    private String normalize(String value) {
+        return value == null ? null : value.trim();
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public String getPhone() {
+        return phone;
+    }
+
+    public void setPhone(String phone) {
+        this.phone = phone;
+    }
+
+    public String getSubmittedAt() {
+        return submittedAt;
+    }
+
+    public String getProfileStage() {
+        return profileStage;
+    }
+
+    public boolean isProfileReady() {
+        return profileReady;
+    }
+}

web/WEB-INF/classes/com/demo/action/ValidationAction.java

@@ -0,0 +1,94 @@
+package com.demo.action;
+
+import com.opensymphony.xwork2.ActionSupport;
+
+import java.time.LocalDateTime;
+import java.time.format.DateTimeFormatter;
+
+public class ValidationAction extends ActionSupport {
+
+    private static final DateTimeFormatter TIME_FORMATTER = DateTimeFormatter.ofPattern("yyyy-MM-dd HH:mm:ss");
+
+    private String username;
+    private String email;
+    private Integer age;
+    private String bio;
+    private String scoreBand;
+    private String submittedAt;
+    private boolean seniorTrack;
+
+    @Override
+    public String execute() {
+        username = normalize(username);
+        email = normalize(email);
+        bio = normalize(bio);
+        seniorTrack = age >= 30;
+        scoreBand = seniorTrack ? "mid" : "early";
+        submittedAt = LocalDateTime.now().format(TIME_FORMATTER);
+        return SUCCESS;
+    }
+
+    @Override
+    public void validate() {
+        if (username == null || username.trim().length() < 3 || username.trim().length() > 20) {
+            addFieldError("username", "用户名长度需在 3 到 20 个字符之间。/ Username must be between 3 and 20 characters.");
+        }
+        if (email == null || !email.contains("@") || email.indexOf('@') == email.length() - 1) {
+            addFieldError("email", "请输入有效邮箱。/ Enter a valid email address.");
+        }
+        if (age == null || age < 18 || age > 60) {
+            addFieldError("age", "年龄需在 18 到 60 岁之间。/ Age must be between 18 and 60.");
+        }
+        if (bio != null && bio.trim().length() > 240) {
+            addFieldError("bio", "简介不能超过 240 个字符。/ Bio must stay under 240 characters.");
+        }
+    }
+
+    private String normalize(String value) {
+        return value == null ? null : value.trim();
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public Integer getAge() {
+        return age;
+    }
+
+    public void setAge(Integer age) {
+        this.age = age;
+    }
+
+    public String getBio() {
+        return bio;
+    }
+
+    public void setBio(String bio) {
+        this.bio = bio;
+    }
+
+    public String getScoreBand() {
+        return scoreBand;
+    }
+
+    public String getSubmittedAt() {
+        return submittedAt;
+    }
+
+    public boolean isSeniorTrack() {
+        return seniorTrack;
+    }
+}

web/WEB-INF/classes/com/demo/action/interceptor/AuthInterceptor.java

@@ -0,0 +1,33 @@
+package com.demo.action.interceptor;
+
+import com.demo.action.LoginAction;
+import com.opensymphony.xwork2.ActionInvocation;
+import com.opensymphony.xwork2.interceptor.AbstractInterceptor;
+import org.apache.struts2.ServletActionContext;
+
+import javax.servlet.http.HttpServletResponse;
+import java.util.Map;
+
+public class AuthInterceptor extends AbstractInterceptor {
+
+    @Override
+    public String intercept(ActionInvocation invocation) throws Exception {
+        Map<String, Object> session = invocation.getInvocationContext().getSession();
+        if (session != null && session.get(LoginAction.SESSION_USER) != null) {
+            return invocation.invoke();
+        }
+
+        String namespace = invocation.getProxy().getNamespace();
+        if (namespace != null && namespace.startsWith("/api")) {
+            HttpServletResponse response = ServletActionContext.getResponse();
+            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+            response.setCharacterEncoding("UTF-8");
+            response.setContentType("application/json;charset=UTF-8");
+            response.getWriter().write("{\"success\":false,\"code\":401,\"message\":\"请先登录后再访问 API / Please log in before calling this API.\"}");
+            response.getWriter().flush();
+            return null;
+        }
+
+        return "login";
+    }
+}

web/WEB-INF/classes/com/demo/action/rest/UserRestAction.java

@@ -0,0 +1,38 @@
+package com.demo.action.rest;
+
+import com.demo.model.User;
+import com.opensymphony.xwork2.ActionSupport;
+
+import java.util.Arrays;
+import java.util.List;
+
+public class UserRestAction extends ActionSupport {
+
+    private boolean success;
+    private String message;
+    private List<User> users;
+
+    @Override
+    public String execute() {
+        success = true;
+        message = "REST-style demo payload";
+        users = Arrays.asList(
+            new User(101L, "alpha", "alpha@example.com", "13800001001"),
+            new User(102L, "beta", "beta@example.com", "13800001002"),
+            new User(103L, "gamma", "gamma@example.com", "13800001003")
+        );
+        return SUCCESS;
+    }
+
+    public boolean isSuccess() {
+        return success;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public List<User> getUsers() {
+        return users;
+    }
+}

web/WEB-INF/classes/com/demo/model/User.java

@@ -0,0 +1,54 @@
+package com.demo.model;
+
+public class User {
+    private Long id;
+    private String username;
+    private String email;
+    private String phone;
+
+    public User() {
+    }
+
+    public User(Long id, String username, String email) {
+        this(id, username, email, null);
+    }
+
+    public User(Long id, String username, String email, String phone) {
+        this.id = id;
+        this.username = username;
+        this.email = email;
+        this.phone = phone;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public void setUsername(String username) {
+        this.username = username;
+    }
+
+    public String getEmail() {
+        return email;
+    }
+
+    public void setEmail(String email) {
+        this.email = email;
+    }
+
+    public String getPhone() {
+        return phone;
+    }
+
+    public void setPhone(String phone) {
+        this.phone = phone;
+    }
+}

web/WEB-INF/classes/struts.xml

@@ -0,0 +1,105 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE struts PUBLIC
+    "-//Apache Software Foundation//DTD Struts Configuration 2.5//EN"
+    "http://struts.apache.org/dtds/struts-2.5.dtd">
+
+<struts>
+    <constant name="struts.devMode" value="false"/>
+    <constant name="struts.enable.DynamicMethodInvocation" value="false"/>
+    <constant name="struts.i18n.encoding" value="UTF-8"/>
+    <constant name="struts.action.extension" value="action"/>
+
+    <package name="default" namespace="/" extends="json-default">
+        <interceptors>
+            <interceptor name="auth" class="com.demo.action.interceptor.AuthInterceptor"/>
+            <interceptor-stack name="secureStack">
+                <interceptor-ref name="auth"/>
+                <interceptor-ref name="defaultStack"/>
+            </interceptor-stack>
+        </interceptors>
+
+        <global-results>
+            <result name="login" type="redirectAction">loginPage</result>
+        </global-results>
+
+        <action name="index">
+            <interceptor-ref name="secureStack"/>
+            <result>/WEB-INF/views/index.jsp</result>
+        </action>
+
+        <action name="loginPage">
+            <result>/WEB-INF/views/user/login.jsp</result>
+        </action>
+
+        <action name="hello" class="com.demo.action.HelloAction" method="execute">
+            <interceptor-ref name="secureStack"/>
+            <result>/hello.jsp</result>
+        </action>
+
+        <action name="login" class="com.demo.action.LoginAction" method="execute">
+            <result name="success" type="redirectAction">index</result>
+            <result name="input">/WEB-INF/views/user/login.jsp</result>
+        </action>
+
+        <action name="dashboard" class="com.demo.action.DashboardAction" method="execute">
+            <interceptor-ref name="secureStack"/>
+            <result>/WEB-INF/views/user/dashboard.jsp</result>
+        </action>
+
+        <action name="logout" class="com.demo.action.LogoutAction" method="execute">
+            <result type="redirectAction">loginPage</result>
+        </action>
+
+        <action name="userFormPage">
+            <interceptor-ref name="secureStack"/>
+            <result>/WEB-INF/views/user/form.jsp</result>
+        </action>
+
+        <action name="validationPage">
+            <interceptor-ref name="secureStack"/>
+            <result>/WEB-INF/views/validation/form.jsp</result>
+        </action>
+
+        <action name="uploadPage">
+            <interceptor-ref name="secureStack"/>
+            <result>/WEB-INF/views/upload/index.jsp</result>
+        </action>
+
+        <action name="submitUser" class="com.demo.action.UserAction" method="submit">
+            <interceptor-ref name="secureStack"/>
+            <result name="success">/WEB-INF/views/user/success.jsp</result>
+            <result name="input">/WEB-INF/views/user/form.jsp</result>
+        </action>
+
+        <action name="upload" class="com.demo.action.FileUploadAction" method="execute">
+            <interceptor-ref name="secureStack"/>
+            <result name="success">/WEB-INF/views/upload/success.jsp</result>
+            <result name="input">/WEB-INF/views/upload/index.jsp</result>
+        </action>
+
+        <action name="ajax" class="com.demo.action.AjaxAction" method="execute">
+            <interceptor-ref name="secureStack"/>
+            <result type="json"/>
+        </action>
+
+        <action name="validate" class="com.demo.action.ValidationAction" method="execute">
+            <interceptor-ref name="secureStack"/>
+            <result name="success">/WEB-INF/views/validation/success.jsp</result>
+            <result name="input">/WEB-INF/views/validation/form.jsp</result>
+        </action>
+    </package>
+
+    <package name="rest" namespace="/api" extends="json-default">
+        <interceptors>
+            <interceptor name="auth" class="com.demo.action.interceptor.AuthInterceptor"/>
+            <interceptor-stack name="secureStack">
+                <interceptor-ref name="auth"/>
+                <interceptor-ref name="defaultStack"/>
+            </interceptor-stack>
+        </interceptors>
+        <action name="users" class="com.demo.action.rest.UserRestAction" method="execute">
+            <interceptor-ref name="secureStack"/>
+            <result type="json"/>
+        </action>
+    </package>
+</struts>

web/WEB-INF/views/index.jsp

@@ -0,0 +1,286 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Struts2 学习门户</title>
+    <style>
+        :root {
+            --bg: #eff2f5;
+            --panel: rgba(255,255,255,0.97);
+            --line: #d4d9e6;
+            --text: #1f2b3d;
+            --muted: #52607a;
+            --brand: #1464c7;
+            --accent: #0d9488;
+        }
+        * { box-sizing: border-box; }
+        body {
+            margin: 0;
+            min-height: 100vh;
+            font-family: "Microsoft YaHei", "Segoe UI", sans-serif;
+            background: linear-gradient(135deg, #e3ebff 0%, #f1f5f9 55%, #effaf5 100%);
+            color: var(--text);
+        }
+        .shell {
+            width: min(1200px, 100%);
+            margin: 0 auto;
+            padding: 24px;
+        }
+        .card {
+            background: var(--panel);
+            border-radius: 26px;
+            padding: 28px;
+            box-shadow: 0 25px 50px rgba(15, 23, 42, 0.1);
+            border: 1px solid var(--line);
+            margin-bottom: 18px;
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: var(--accent);
+            margin-bottom: 6px;
+            font-weight: 700;
+        }
+        h1, h2, h3 {
+            margin: 8px 0 12px;
+            font-weight: 700;
+        }
+        p {
+            margin: 0;
+            color: var(--muted);
+            line-height: 1.7;
+        }
+        .hero-card {
+            display: flex;
+            flex-direction: column;
+            gap: 12px;
+        }
+        .hero-actions {
+            display: flex;
+            gap: 12px;
+            flex-wrap: wrap;
+        }
+        .btn, .btn-soft, .btn-ghost {
+            padding: 12px 18px;
+            border-radius: 999px;
+            font-weight: 700;
+            border: none;
+            cursor: pointer;
+        }
+        .btn {
+            background: linear-gradient(135deg, var(--brand), #3d6fe7);
+            color: white;
+        }
+        .btn-soft {
+            background: #f4f7ff;
+            color: var(--brand);
+            border: 1px solid var(--line);
+        }
+        .btn-ghost {
+            border: 1px solid var(--line);
+            background: transparent;
+            color: var(--text);
+        }
+        .lang-warning {
+            font-size: 14px;
+            color: var(--brand);
+        }
+        .portal-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(230px, 1fr));
+            gap: 16px;
+            margin-top: 16px;
+        }
+        .portal-card {
+            border: 1px solid var(--line);
+            border-radius: 18px;
+            background: rgba(255,255,255,0.85);
+            padding: 16px;
+            display: flex;
+            flex-direction: column;
+            gap: 10px;
+        }
+        .portal-links {
+            display: flex;
+            gap: 6px;
+            flex-wrap: wrap;
+        }
+        .portal-links .link-btn {
+            padding: 8px 12px;
+            border-radius: 12px;
+            border: 1px solid var(--line);
+            background: #fff;
+            color: var(--text);
+            text-decoration: none;
+            font-weight: 600;
+        }
+        .insight-grid {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(240px, 1fr));
+            gap: 16px;
+            margin-top: 16px;
+        }
+        .insight-card {
+            border: 1px solid var(--line);
+            border-radius: 18px;
+            padding: 16px;
+            background: rgba(255,255,255,0.95);
+            min-height: 150px;
+        }
+        .chain-pill {
+            display: inline-flex;
+            border-radius: 999px;
+            padding: 4px 10px;
+            border: 1px solid var(--line);
+            background: #f4f7ff;
+            margin-right: 6px;
+            font-size: 12px;
+        }
+        .session-note {
+            font-size: 14px;
+            color: var(--muted);
+        }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <section class="card hero-card">
+            <div class="eyebrow" id="heroEyebrow">Struts2 学习门户</div>
+            <h1 id="heroTitle">登录之后才能继续学习</h1>
+            <p id="heroDesc">所有课程模块（首页/实验/JSON 等）都由 AuthInterceptor 保护，未登录访问会自动跳转。请先登录再回来。</p>
+            <div class="lang-warning" id="heroWarning">登录后才能看到完整课程导航与实验入口。</div>
+            <div class="hero-actions">
+                <a class="btn" href="dashboard.action" id="heroActionPrimary">进入仪表盘</a>
+                <a class="btn-soft" href="logout.action" id="heroActionSecondary">退出登录</a>
+                <button class="btn-ghost" type="button" id="languageBtnHero">EN</button>
+            </div>
+            <div class="session-note" id="heroSessionNote">
+                <s:if test="#session.demoUser != null">
+                    当前：<s:property value="#session.demoUser"/>（<s:property value="#session.demoRole"/>）
+                </s:if>
+                <s:else>
+                    当前尚未登录，请先完成登录再浏览实验。
+                </s:else>
+            </div>
+        </section>
+
+        <section class="card portal-section">
+            <div class="eyebrow" id="portalEyebrow">学习模块导航</div>
+            <h2 id="portalTitle">分步骤理解 Struts2</h2>
+            <p id="portalDesc">每个模块都通过 `.action` 路由触达，由统一的 Session 鉴权链路保护。</p>
+            <div class="portal-grid">
+                <article class="portal-card">
+                    <h3 id="portalCard1Title">请求生命周期</h3>
+                    <p id="portalCard1Desc">Dispatcher → Action → Interceptor → Result，严格按链路走向。</p>
+                    <div>
+                        <span class="chain-pill">Dispatcher</span>
+                        <span class="chain-pill">Action</span>
+                        <span class="chain-pill">Interceptors</span>
+                        <span class="chain-pill">Result</span>
+                    </div>
+                </article>
+                <article class="portal-card">
+                    <h3 id="portalCard2Title">登录保护</h3>
+                    <p id="portalCard2Desc">`LoginAction` 写入 Session，`AuthInterceptor` 阻止任何未登录访问。</p>
+                    <div class="portal-links">
+                        <a class="link-btn" href="loginPage.action">登录页</a>
+                        <a class="link-btn" href="dashboard.action">仪表盘</a>
+                    </div>
+                </article>
+                <article class="portal-card">
+                    <h3 id="portalCard3Title">表单与校验</h3>
+                    <p id="portalCard3Desc">表单字段直接绑定到 Action，ValidationAction 负责完整校验流程。</p>
+                    <div class="portal-links">
+                        <a class="link-btn" href="userFormPage.action">表单</a>
+                        <a class="link-btn" href="validationPage.action">校验</a>
+                    </div>
+                </article>
+                <article class="portal-card">
+                    <h3 id="portalCard4Title">AJAX / REST 对照</h3>
+                    <p id="portalCard4Desc">对比 `ajax.action` 与 `api/users.action` 的 JSON 输出。</p>
+                    <div class="portal-links">
+                        <a class="link-btn" href="ajax.action">AJAX</a>
+                        <a class="link-btn" href="api/users.action">REST</a>
+                    </div>
+                </article>
+            </div>
+        </section>
+
+        <section class="card insight-section">
+            <div class="eyebrow">Insight</div>
+            <h2>安全学习链路速览</h2>
+            <div class="insight-grid">
+                <article class="insight-card">
+                    <h3>登录才能使用</h3>
+                    <p>未登录访问 `dashboard.action` 等任何端点都会被 AuthInterceptor 重定向至 `loginPage.action`。</p>
+                </article>
+                <article class="insight-card">
+                    <h3>表单绑定观察</h3>
+                    <p>`UserAction` 按字段绑定，`ValidationAction` 造成的字段错误会带回当前 JSP。</p>
+                </article>
+                <article class="insight-card">
+                    <h3>AJAX vs REST</h3>
+                    <p>`ajax.action` 返回对话式 JSON，`api/users.action` 呈现 REST 样式，便于教学对照。</p>
+                </article>
+            </div>
+        </section>
+    </div>
+
+    <script src="../assets/struts-lab.js"></script>
+    <script>
+        strutsLab.mount({
+            buttonId: "languageBtnHero",
+            messages: {
+                zh: {
+                    pageTitle: "Struts2 学习门户",
+                    text: {
+                        heroEyebrow: "Struts2 学习门户",
+                        heroTitle: "登录之后才能继续学习",
+                        heroDesc: "所有入口都由 Session + AuthInterceptor 保护，未登录将自动跳回登录页；登录成功后会先回到这个统一门户。",
+                        heroWarning: "当前门户本身也在登录保护之下，适合用来总览各实验模块。",
+                        heroActionPrimary: "进入仪表盘",
+                        heroActionSecondary: "退出登录",
+                        portalEyebrow: "学习模块导航",
+                        portalTitle: "分步骤理解 Struts2",
+                        portalDesc: "每个 `.action` 路径都在登录后才能访问，Session 鉴权串联整个体验。",
+                        portalCard1Title: "请求生命周期",
+                        portalCard1Desc: "Dispatcher → Action → Interceptor → Result，典型执行路径。",
+                        portalCard2Title: "登录保护",
+                        portalCard2Desc: "`LoginAction` 写入 Session，`AuthInterceptor` 拦截未登录。",
+                        portalCard3Title: "表单与校验",
+                        portalCard3Desc: "Action 字段绑定 + ValidationAction 校验，成功后进入汇总。",
+                        portalCard4Title: "AJAX / REST 对照",
+                        portalCard4Desc: "对比 `ajax.action`（AJAX）与 `api/users.action`（REST）。"
+                    }
+                },
+                en: {
+                    pageTitle: "Struts2 Learning Portal",
+                    text: {
+                        heroEyebrow: "Struts2 Learning Portal",
+                        heroTitle: "Login before you explore",
+                        heroDesc: "All modules are protected by Session + AuthInterceptor. After login, this protected portal becomes the unified entry.",
+                        heroWarning: "The portal itself is protected and serves as the overview for every lab module.",
+                        heroActionPrimary: "Go to dashboard",
+                        heroActionSecondary: "Log out",
+                        portalEyebrow: "Module guide",
+                        portalTitle: "Step-by-step Struts2",
+                        portalDesc: "Every `.action` route sits behind login; the session chain secures the experience.",
+                        portalCard1Title: "Request lifecycle",
+                        portalCard1Desc: "Dispatcher → Action → Interceptor → Result shows the execution path.",
+                        portalCard2Title: "Login protection",
+                        portalCard2Desc: "`LoginAction` writes Session, `AuthInterceptor` blocks unauthenticated hits.",
+                        portalCard3Title: "Forms & validation",
+                        portalCard3Desc: "Field binding plus `ValidationAction` determine success/failure views.",
+                        portalCard4Title: "AJAX / REST contrast",
+                        portalCard4Desc: "Compare `ajax.action` (AJAX) with `api/users.action` (REST) outputs."
+                    }
+                }
+            }
+        });
+    </script>
+</body>
+</html>

web/WEB-INF/views/upload/index.jsp

@@ -0,0 +1,129 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>上传元数据实验 - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #0ea5e9 0%, #38bdf8 55%, #dff4ff 100%);
+        }
+        .shell {
+            max-width: 860px;
+            margin: 0 auto;
+            background: rgba(255,255,255,0.95);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.18);
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #0284c7;
+            font-weight: 800;
+        }
+        h1 { margin: 10px 0 12px; }
+        p { margin: 0; color: #54687c; line-height: 1.85; }
+        .note {
+            margin-top: 16px;
+            padding: 16px;
+            border-radius: 18px;
+            background: #eef8ff;
+            border: 1px solid #d6e9f7;
+        }
+        .field { margin-top: 16px; }
+        label { display: block; margin-bottom: 8px; font-weight: 700; color: #173652; }
+        input[type="file"] {
+            width: 100%;
+            padding: 16px;
+            border-radius: 16px;
+            border: 1px dashed #5ab8f0;
+            background: #f8fcff;
+        }
+        button {
+            width: 100%;
+            margin-top: 18px;
+            padding: 14px;
+            border: 0;
+            border-radius: 14px;
+            background: linear-gradient(135deg, #0284c7, #38bdf8);
+            color: white;
+            font-size: 16px;
+            font-weight: 800;
+            cursor: pointer;
+        }
+        .action-error {
+            margin-top: 16px;
+            padding: 14px;
+            border-radius: 14px;
+            background: #fff1f1;
+            color: #b63a3a;
+            border: 1px solid #f1c4c4;
+        }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .link-btn {
+            display: inline-flex;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: #edf7ff;
+            color: #0284c7;
+            text-decoration: none;
+            font-weight: 700;
+        }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <div class="eyebrow">受保护上传页</div>
+        <h1>只采集上传元数据，不把文件真正落盘</h1>
+        <p>这个页面保留了 multipart 表单绑定的教学意义，但避免真实写盘，更适合本地、VPS 和课堂演示环境。</p>
+
+        <s:if test="#session.demoUser == null">
+            <div class="note">
+                <strong>当前未登录</strong>
+                <p style="margin-top: 8px;">上传页也已经接入 Session 保护。请先登录，再看 Struts2 对文件字段和元数据的绑定结果。</p>
+            </div>
+            <div class="links">
+                <a class="link-btn" href="../loginPage.action">先去登录</a>
+                <a class="link-btn" href="../index.action">返回门户</a>
+            </div>
+        </s:if>
+        <s:else>
+            <div class="note">
+                <strong>这一页采集什么</strong>
+                <p style="margin-top: 8px;">主文件名、内容类型和总文件数量。不会真实保存上传文件。</p>
+            </div>
+
+            <s:if test="hasActionErrors()">
+                <div class="action-error"><s:property value="actionErrors[0]"/></div>
+            </s:if>
+
+            <form action="<s:url action='upload' namespace='/'/>" method="post" enctype="multipart/form-data">
+                <div class="field">
+                    <label for="upload">主文件</label>
+                    <input id="upload" type="file" name="upload"/>
+                </div>
+
+                <div class="field">
+                    <label for="uploads">附加文件</label>
+                    <input id="uploads" type="file" name="uploads" multiple="multiple"/>
+                </div>
+
+                <button type="submit">提交并查看上传元数据</button>
+            </form>
+
+            <div class="links">
+                <a class="link-btn" href="../dashboard.action">返回仪表盘</a>
+                <a class="link-btn" href="../index.action">回到门户</a>
+            </div>
+        </s:else>
+    </div>
+</body>
+</html>

web/WEB-INF/views/upload/success.jsp

@@ -0,0 +1,92 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>上传元数据结果 - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #0ea5e9 0%, #38bdf8 55%, #dff4ff 100%);
+        }
+        .card {
+            width: min(760px, 100%);
+            background: rgba(255,255,255,0.95);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.18);
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #0284c7;
+            font-weight: 800;
+        }
+        h1 { margin: 10px 0 12px; }
+        p { margin: 0; color: #53677b; line-height: 1.85; }
+        .stats {
+            display: grid;
+            grid-template-columns: repeat(3, minmax(0, 1fr));
+            gap: 12px;
+            margin-top: 18px;
+        }
+        .stat {
+            padding: 16px;
+            border-radius: 18px;
+            background: #f5fbff;
+            border: 1px solid #d8ebf8;
+        }
+        .stat span { display: block; font-size: 12px; color: #62809d; margin-bottom: 6px; }
+        .stat strong { font-size: 20px; }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .link-btn {
+            display: inline-flex;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: #edf7ff;
+            color: #0284c7;
+            text-decoration: none;
+            font-weight: 700;
+        }
+        @media (max-width: 720px) {
+            .stats { grid-template-columns: 1fr; }
+        }
+    </style>
+</head>
+<body>
+    <div class="card">
+        <div class="eyebrow">上传结果</div>
+        <h1>上传元数据已经被 Action 成功接收</h1>
+        <p>这个实验只记录元数据，不真正保存文件。重点是理解 Struts2 对 multipart 表单字段的接收方式。</p>
+
+        <div class="stats">
+            <div class="stat">
+                <span>文件数量</span>
+                <strong><s:property value="fileCount" default="0"/></strong>
+            </div>
+            <div class="stat">
+                <span>主文件名</span>
+                <strong><s:property value="uploadFileName" default="未提供"/></strong>
+            </div>
+            <div class="stat">
+                <span>内容类型</span>
+                <strong><s:property value="uploadContentType" default="未知"/></strong>
+            </div>
+        </div>
+
+        <div class="links">
+            <a class="link-btn" href="../uploadPage.action">再做一次上传实验</a>
+            <a class="link-btn" href="../dashboard.action">返回仪表盘</a>
+        </div>
+    </div>
+</body>
+</html>

web/WEB-INF/views/user/dashboard.jsp

@@ -0,0 +1,341 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>登录后仪表盘 - Struts2 学习实验台</title>
+    <style>
+        :root {
+            --bg: #eff7f5;
+            --panel: rgba(255,255,255,0.95);
+            --line: #d5ebe3;
+            --text: #123028;
+            --muted: #4a655c;
+            --brand: #0d8f7c;
+            --soft: #e8f8f2;
+            --shadow: 0 24px 60px rgba(0,0,0,0.18);
+        }
+        body {
+            margin: 0;
+            min-height: 100vh;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background:
+                radial-gradient(circle at top right, rgba(13, 143, 124, 0.15), transparent 24%),
+                radial-gradient(circle at bottom left, rgba(49, 196, 141, 0.12), transparent 22%),
+                var(--bg);
+            color: var(--text);
+        }
+        .shell {
+            max-width: 1320px;
+            margin: 0 auto;
+            display: flex;
+            flex-direction: column;
+            gap: 18px;
+        }
+        .card {
+            background: var(--panel);
+            border: 1px solid var(--line);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: var(--shadow);
+        }
+        .hero-head {
+            display: flex;
+            justify-content: space-between;
+            gap: 16px;
+            align-items: flex-start;
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: var(--brand);
+            font-weight: 800;
+        }
+        h1, h2, h3 { margin: 10px 0 12px; }
+        p { margin: 0; color: var(--muted); line-height: 1.85; }
+        .actions, .links {
+            display: flex;
+            gap: 10px;
+            flex-wrap: wrap;
+        }
+        .btn, .btn-soft, .btn-ghost, .link-btn {
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            padding: 10px 14px;
+            border-radius: 999px;
+            font-weight: 700;
+            border: 1px solid var(--line);
+            text-decoration: none;
+            cursor: pointer;
+        }
+        .btn { background: linear-gradient(135deg, var(--brand), #31c48d); color: white; border: 0; }
+        .btn-soft { background: var(--soft); color: var(--brand); }
+        .btn-ghost, .link-btn { background: white; color: var(--text); }
+        .stats, .grid, .steps {
+            display: grid;
+            gap: 14px;
+            margin-top: 18px;
+        }
+        .stats { grid-template-columns: repeat(3, minmax(0, 1fr)); }
+        .grid { grid-template-columns: repeat(2, minmax(0, 1fr)); }
+        .steps { grid-template-columns: repeat(4, minmax(0, 1fr)); }
+        .stat, .panel, .step {
+            padding: 16px;
+            border-radius: 20px;
+            border: 1px solid var(--line);
+            background: rgba(255,255,255,0.68);
+        }
+        .stat span { display: block; font-size: 12px; color: var(--muted); margin-bottom: 6px; }
+        .stat strong { font-size: 22px; }
+        .tag-list {
+            display: flex;
+            gap: 8px;
+            flex-wrap: wrap;
+            margin-bottom: 12px;
+        }
+        .tag {
+            display: inline-flex;
+            padding: 6px 10px;
+            border-radius: 999px;
+            background: var(--soft);
+            color: var(--brand);
+            font-size: 12px;
+            font-weight: 700;
+        }
+        .panel ul {
+            margin: 0;
+            padding-left: 18px;
+            color: var(--muted);
+            line-height: 1.85;
+        }
+        .step strong {
+            display: block;
+            margin-bottom: 8px;
+        }
+        .step p { margin: 0; }
+        @media (max-width: 960px) {
+            .stats, .grid, .steps { grid-template-columns: 1fr; }
+            .hero-head { flex-direction: column; }
+        }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <section class="card">
+            <div class="hero-head">
+                <div>
+                    <div class="eyebrow" id="heroEyebrow">登录后仪表盘</div>
+                    <h1 id="heroTitle">Session 已建立，后续实验页现在通过拦截器受保护</h1>
+                    <p id="heroText">这一页的作用不是展示“登录成功”四个字，而是把你接下来的学习路线展开：继续看用户表单、校验、上传，或者回到门户解释这条 Session 鉴权链路是如何工作的。</p>
+                </div>
+                <div class="actions">
+                    <button class="btn-ghost" type="button" id="languageBtn">EN</button>
+                    <a class="btn" href="../userFormPage.action" id="primaryAction">进入用户表单</a>
+                    <a class="btn-soft" href="../logout.action" id="logoutAction">退出登录</a>
+                </div>
+            </div>
+
+            <div class="stats">
+                <div class="stat">
+                    <span id="statUserLabel">当前用户</span>
+                    <strong><s:property value="displayName"/></strong>
+                </div>
+                <div class="stat">
+                    <span id="statRoleLabel">当前角色</span>
+                    <strong id="roleValue" data-role-code="<s:property value='role'/>"><s:property value="role"/></strong>
+                </div>
+                <div class="stat">
+                    <span id="statTimeLabel">登录时间</span>
+                    <strong><s:property value="loginTime"/></strong>
+                </div>
+            </div>
+        </section>
+
+        <section class="card">
+            <div class="eyebrow" id="secureEyebrow">受保护实验</div>
+            <h2 id="secureTitle">现在你可以进入这些需要登录的页面</h2>
+            <div class="grid">
+                <article class="panel">
+                    <div class="tag-list">
+                        <span class="tag" id="tagUser">字段绑定</span>
+                        <span class="tag" id="tagUserSecure">受保护</span>
+                    </div>
+                    <h3 id="panelUserTitle">用户资料表单</h3>
+                    <p id="panelUserText">继续看请求参数如何绑定到 Action 属性，并在成功页生成一份汇总结果。</p>
+                    <div class="links" style="margin-top: 14px;">
+                        <a class="link-btn" href="../userFormPage.action" id="panelUserLink">打开用户表单</a>
+                    </div>
+                </article>
+
+                <article class="panel">
+                    <div class="tag-list">
+                        <span class="tag" id="tagValidation">validate()</span>
+                        <span class="tag" id="tagValidationSecure">受保护</span>
+                    </div>
+                    <h3 id="panelValidationTitle">字段校验页</h3>
+                    <p id="panelValidationText">对比校验失败和成功状态，理解为什么 Struts2 会在业务逻辑前先执行校验方法。</p>
+                    <div class="links" style="margin-top: 14px;">
+                        <a class="link-btn" href="../validationPage.action" id="panelValidationLink">打开校验页</a>
+                    </div>
+                </article>
+
+                <article class="panel">
+                    <div class="tag-list">
+                        <span class="tag" id="tagUpload">multipart</span>
+                        <span class="tag" id="tagUploadSecure">受保护</span>
+                    </div>
+                    <h3 id="panelUploadTitle">上传元数据页</h3>
+                    <p id="panelUploadText">这里保留文件上传的教学价值，但不把文件真正写入磁盘，适合安全演示。</p>
+                    <div class="links" style="margin-top: 14px;">
+                        <a class="link-btn" href="../uploadPage.action" id="panelUploadLink">打开上传页</a>
+                    </div>
+                </article>
+
+                <article class="panel">
+                    <div class="tag-list">
+                        <span class="tag" id="tagPortal">解释链路</span>
+                        <span class="tag" id="tagPortalTrace">回看入口</span>
+                    </div>
+                    <h3 id="panelPortalTitle">回门户讲完整链路</h3>
+                    <p id="panelPortalText">回到入口页，可以从公开入口、登录动作、Session 写入、拦截器保护这条路线整体复盘。</p>
+                    <div class="links" style="margin-top: 14px;">
+                        <a class="link-btn" href="../index.action" id="panelPortalLink">返回门户</a>
+                    </div>
+                </article>
+            </div>
+        </section>
+
+        <section class="card">
+            <div class="eyebrow" id="flowEyebrow">鉴权流程</div>
+            <h2 id="flowTitle">这次你实际走过的 Struts2 登录链路</h2>
+            <div class="steps">
+                <div class="step">
+                    <strong id="flowStep1Title">1. 表单提交到 login Action</strong>
+                    <p id="flowStep1Text">用户名和密码先进入 Action，校验失败会直接回到登录页。</p>
+                </div>
+                <div class="step">
+                    <strong id="flowStep2Title">2. Action 写入 Session</strong>
+                    <p id="flowStep2Text">账号通过后，用户、角色和登录时间被放进 Session。</p>
+                </div>
+                <div class="step">
+                    <strong id="flowStep3Title">3. 拦截器保护页面动作</strong>
+                    <p id="flowStep3Text">用户表单、校验页、上传页和仪表盘都先经过 AuthInterceptor。</p>
+                </div>
+                <div class="step">
+                    <strong id="flowStep4Title">4. 未登录会被打回登录页</strong>
+                    <p id="flowStep4Text">如果没有 Session，安全动作不会继续执行，而是直接跳回登录入口。</p>
+                </div>
+            </div>
+        </section>
+    </div>
+
+    <script src="../assets/struts-lab.js"></script>
+    <script>
+        strutsLab.mount({
+            messages: {
+                zh: {
+                    pageTitle: "登录后仪表盘 - Struts2 学习实验台",
+                    text: {
+                        heroEyebrow: "登录后仪表盘",
+                        heroTitle: "Session 已建立，后续实验页现在通过拦截器受保护",
+                        heroText: "这一页的作用不是展示“登录成功”四个字，而是把你接下来的学习路线展开：继续看用户表单、校验、上传，或者回到门户解释这条 Session 鉴权链路是如何工作的。",
+                        primaryAction: "进入用户表单",
+                        logoutAction: "退出登录",
+                        statUserLabel: "当前用户",
+                        statRoleLabel: "当前角色",
+                        statTimeLabel: "登录时间",
+                        secureEyebrow: "受保护实验",
+                        secureTitle: "现在你可以进入这些需要登录的页面",
+                        tagUser: "字段绑定",
+                        tagUserSecure: "受保护",
+                        panelUserTitle: "用户资料表单",
+                        panelUserText: "继续看请求参数如何绑定到 Action 属性，并在成功页生成一份汇总结果。",
+                        panelUserLink: "打开用户表单",
+                        tagValidation: "validate()",
+                        tagValidationSecure: "受保护",
+                        panelValidationTitle: "字段校验页",
+                        panelValidationText: "对比校验失败和成功状态，理解为什么 Struts2 会在业务逻辑前先执行校验方法。",
+                        panelValidationLink: "打开校验页",
+                        tagUpload: "multipart",
+                        tagUploadSecure: "受保护",
+                        panelUploadTitle: "上传元数据页",
+                        panelUploadText: "这里保留文件上传的教学价值，但不把文件真正写入磁盘，适合安全演示。",
+                        panelUploadLink: "打开上传页",
+                        tagPortal: "解释链路",
+                        tagPortalTrace: "回看入口",
+                        panelPortalTitle: "回门户讲完整链路",
+                        panelPortalText: "回到入口页，可以从公开入口、登录动作、Session 写入、拦截器保护这条路线整体复盘。",
+                        panelPortalLink: "返回门户",
+                        flowEyebrow: "鉴权流程",
+                        flowTitle: "这次你实际走过的 Struts2 登录链路",
+                        flowStep1Title: "1. 表单提交到 login Action",
+                        flowStep1Text: "用户名和密码先进入 Action，校验失败会直接回到登录页。",
+                        flowStep2Title: "2. Action 写入 Session",
+                        flowStep2Text: "账号通过后，用户、角色和登录时间被放进 Session。",
+                        flowStep3Title: "3. 拦截器保护页面动作",
+                        flowStep3Text: "用户表单、校验页、上传页和仪表盘都先经过 AuthInterceptor。",
+                        flowStep4Title: "4. 未登录会被打回登录页",
+                        flowStep4Text: "如果没有 Session，安全动作不会继续执行，而是直接跳回登录入口。"
+                    }
+                },
+                en: {
+                    pageTitle: "Post-login Dashboard - Struts2 Learning Lab",
+                    text: {
+                        heroEyebrow: "Post-login dashboard",
+                        heroTitle: "A session now exists, and later lab pages are protected by an interceptor",
+                        heroText: "This page is not just a success notice. It expands the next learning route: continue to user forms, validation, and upload, or go back to the portal and explain the full session-auth path.",
+                        primaryAction: "Open user form",
+                        logoutAction: "Log out",
+                        statUserLabel: "Current user",
+                        statRoleLabel: "Current role",
+                        statTimeLabel: "Login time",
+                        secureEyebrow: "Protected labs",
+                        secureTitle: "These pages now require a valid login session",
+                        tagUser: "Binding",
+                        tagUserSecure: "Protected",
+                        panelUserTitle: "User profile form",
+                        panelUserText: "Continue with request parameter binding into action properties and a structured success summary.",
+                        panelUserLink: "Open user form",
+                        tagValidation: "validate()",
+                        tagValidationSecure: "Protected",
+                        panelValidationTitle: "Validation page",
+                        panelValidationText: "Compare invalid and successful states and explain why Struts2 runs validate() before business output.",
+                        panelValidationLink: "Open validation page",
+                        tagUpload: "multipart",
+                        tagUploadSecure: "Protected",
+                        panelUploadTitle: "Upload metadata page",
+                        panelUploadText: "Keeps the teaching value of file upload while avoiding real disk writes, which is safer for demo environments.",
+                        panelUploadLink: "Open upload page",
+                        tagPortal: "Trace the path",
+                        tagPortalTrace: "Back to entry",
+                        panelPortalTitle: "Return to the portal",
+                        panelPortalText: "Go back and explain the full route from public entry to login action, session write, and interceptor protection.",
+                        panelPortalLink: "Back to portal",
+                        flowEyebrow: "Auth flow",
+                        flowTitle: "The Struts2 login path you just completed",
+                        flowStep1Title: "1. Form submits to the login action",
+                        flowStep1Text: "Username and password reach the action first; validation failure returns to the login page.",
+                        flowStep2Title: "2. The action writes into session",
+                        flowStep2Text: "After success, user, role, and login time are stored in session.",
+                        flowStep3Title: "3. The interceptor protects page actions",
+                        flowStep3Text: "The user form, validation page, upload page, and dashboard all pass through AuthInterceptor first.",
+                        flowStep4Title: "4. Unauthenticated access goes back to login",
+                        flowStep4Text: "If no session exists, secure actions stop immediately and redirect to the login entry."
+                    }
+                }
+            },
+            render: function (ui) {
+                const roleNode = document.getElementById("roleValue");
+                if (roleNode && roleNode.dataset.roleCode === "admin") {
+                    roleNode.textContent = ui.language === "zh" ? "演示管理员" : "Demo administrator";
+                }
+            }
+        });
+    </script>
+</body>
+</html>

web/WEB-INF/views/user/form.jsp

@@ -0,0 +1,132 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>用户资料表单 - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #f97316 0%, #fb923c 50%, #ffedd5 100%);
+        }
+        .shell {
+            max-width: 880px;
+            margin: 0 auto;
+            background: rgba(255,255,255,0.96);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.18);
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #ea580c;
+            font-weight: 800;
+        }
+        h1 { margin: 10px 0 12px; }
+        p { margin: 0; color: #6c5545; line-height: 1.85; }
+        .field { margin-top: 16px; }
+        label { display: block; margin-bottom: 8px; font-weight: 700; color: #4c3422; }
+        input {
+            width: 100%;
+            padding: 13px 14px;
+            border-radius: 14px;
+            border: 1px solid #ead8ca;
+            font: inherit;
+        }
+        button {
+            width: 100%;
+            margin-top: 18px;
+            padding: 14px;
+            border: 0;
+            border-radius: 14px;
+            background: linear-gradient(135deg, #ea580c, #fb923c);
+            color: white;
+            font-size: 16px;
+            font-weight: 800;
+            cursor: pointer;
+        }
+        .error { color: #c2410c; font-size: 13px; margin-top: 6px; }
+        .note {
+            margin-top: 18px;
+            padding: 16px;
+            border-radius: 18px;
+            background: #fff5ef;
+            border: 1px solid #f2d9ca;
+        }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .link-btn {
+            display: inline-flex;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: #fff1e8;
+            color: #c2410c;
+            text-decoration: none;
+            font-weight: 700;
+        }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <div class="eyebrow">受保护表单</div>
+        <h1>通过 Action 属性绑定提交一份用户资料</h1>
+        <p>这个页面现在放在登录保护链路里。重点不是字段本身，而是观察请求参数如何进入 Action，再在成功页汇总成一份结构化结果。</p>
+
+        <s:if test="#session.demoUser == null">
+            <div class="note">
+                <strong>当前未登录</strong>
+                <p style="margin-top: 8px;">这个实验页已经接入 Session 保护。请先登录，再回来看字段绑定和错误回显。</p>
+            </div>
+            <div class="links">
+                <a class="link-btn" href="../loginPage.action">先去登录</a>
+                <a class="link-btn" href="../index.action">返回门户</a>
+            </div>
+        </s:if>
+        <s:else>
+            <div class="note">
+                <strong>建议观察点</strong>
+                <p style="margin-top: 8px;">依次观察：字段名如何对应 Action 属性、校验错误如何回显、成功页如何读取 Action 结果。</p>
+            </div>
+
+            <form action="<s:url action='submitUser' namespace='/'/>" method="post">
+                <div class="field">
+                    <label for="username">用户名</label>
+                    <input id="username" name="username" placeholder="platform-owner" value='<s:property value="username"/>'/>
+                    <s:if test="fieldErrors['username'] != null">
+                        <div class="error"><s:property value="fieldErrors['username'][0]"/></div>
+                    </s:if>
+                </div>
+
+                <div class="field">
+                    <label for="email">邮箱</label>
+                    <input id="email" name="email" placeholder="platform@example.com" value='<s:property value="email"/>'/>
+                    <s:if test="fieldErrors['email'] != null">
+                        <div class="error"><s:property value="fieldErrors['email'][0]"/></div>
+                    </s:if>
+                </div>
+
+                <div class="field">
+                    <label for="phone">手机号</label>
+                    <input id="phone" name="phone" placeholder="13800000000" value='<s:property value="phone"/>'/>
+                    <s:if test="fieldErrors['phone'] != null">
+                        <div class="error"><s:property value="fieldErrors['phone'][0]"/></div>
+                    </s:if>
+                </div>
+
+                <button type="submit">提交资料并生成汇总页</button>
+            </form>
+
+            <div class="links">
+                <a class="link-btn" href="../dashboard.action">返回仪表盘</a>
+                <a class="link-btn" href="../validationPage.action">下一步看校验页</a>
+            </div>
+        </s:else>
+    </div>
+</body>
+</html>

web/WEB-INF/views/user/login.jsp

@@ -0,0 +1,278 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Session 登录实验 - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #122c63 0%, #1464c7 52%, #4db5ff 100%);
+        }
+        .shell {
+            width: min(1120px, 100%);
+            display: grid;
+            grid-template-columns: 1fr 430px;
+            gap: 18px;
+        }
+        .panel {
+            background: rgba(255,255,255,0.95);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.22);
+        }
+        .top-actions {
+            display: flex;
+            justify-content: space-between;
+            gap: 12px;
+            align-items: center;
+            margin-bottom: 14px;
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #1464c7;
+            font-weight: 800;
+        }
+        h1, h2 { margin: 10px 0 12px; }
+        p { margin: 0; color: #566a80; line-height: 1.85; }
+        .btn-ghost, .link-btn {
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            padding: 10px 14px;
+            border-radius: 999px;
+            border: 1px solid #d7e5f7;
+            background: #ffffff;
+            color: #1464c7;
+            text-decoration: none;
+            font-weight: 700;
+            cursor: pointer;
+        }
+        .note {
+            margin-top: 18px;
+            padding: 16px;
+            border-radius: 18px;
+            background: #edf5ff;
+            border: 1px solid #d7e5f7;
+        }
+        .stats {
+            display: grid;
+            grid-template-columns: repeat(2, minmax(0, 1fr));
+            gap: 12px;
+            margin-top: 18px;
+        }
+        .stat {
+            padding: 14px;
+            border-radius: 18px;
+            border: 1px solid #d7e5f7;
+            background: #f8fbff;
+        }
+        .stat strong { display: block; margin-bottom: 6px; }
+        .field {
+            margin-bottom: 16px;
+        }
+        label {
+            display: block;
+            margin-bottom: 8px;
+            font-weight: 700;
+            color: #1f3650;
+        }
+        input {
+            width: 100%;
+            padding: 13px 14px;
+            border-radius: 14px;
+            border: 1px solid #d6e1ed;
+            font: inherit;
+        }
+        button.submit-btn {
+            width: 100%;
+            padding: 14px;
+            border: 0;
+            border-radius: 14px;
+            background: linear-gradient(135deg, #1464c7, #3d8ef6);
+            color: white;
+            font-size: 16px;
+            font-weight: 800;
+            cursor: pointer;
+        }
+        .error {
+            color: #c53d3d;
+            font-size: 13px;
+            margin-top: 6px;
+        }
+        .action-error {
+            margin: 0 0 16px;
+            padding: 14px;
+            border-radius: 14px;
+            background: #fff1f1;
+            color: #b63a3a;
+            border: 1px solid #f1c4c4;
+        }
+        .links {
+            display: flex;
+            gap: 10px;
+            flex-wrap: wrap;
+            margin-top: 18px;
+        }
+        @media (max-width: 860px) {
+            .shell { grid-template-columns: 1fr; }
+        }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <section class="panel">
+            <div class="top-actions">
+                <div class="eyebrow" id="leftEyebrow">Session 登录章节</div>
+                <button class="btn-ghost" type="button" id="languageBtn">EN</button>
+            </div>
+            <h1 id="leftTitle">用最经典的 Struts2 Session 登录，把后续实验页保护起来</h1>
+            <p id="leftText">这个页面不只是演示登录表单，而是把 Action 校验、写入 Session、拦截器校验和登录后仪表盘串成一个完整章节，适合你系统掌握老项目最常见的鉴权思路。</p>
+
+            <div class="note">
+                <strong id="credentialTitle">演示账号</strong>
+                <p id="credentialBody" style="margin-top: 8px;">用户名：<code>admin</code><br/>密码：<code>123456</code></p>
+            </div>
+
+            <div class="stats">
+                <div class="stat">
+                    <strong id="statOneTitle">这一页讲什么</strong>
+                    <span id="statOneText">Action 校验、错误回显、Session 写入、登录后跳转。</span>
+                </div>
+                <div class="stat">
+                    <strong id="statTwoTitle">下一步看什么</strong>
+                    <span id="statTwoText">登录成功后会先回到学习门户，再进入仪表盘、用户表单、校验页和上传页。</span>
+                </div>
+            </div>
+
+            <div class="links">
+                <a class="link-btn" href="../index.action" id="backPortalLink">返回门户</a>
+                <s:if test="#session.demoUser != null">
+                    <a class="link-btn" href="../index.action" id="dashboardLink">进入学习门户</a>
+                    <a class="link-btn" href="../logout.action" id="logoutLink">退出登录</a>
+                </s:if>
+                <s:else>
+                    <a class="link-btn" href="../hello.action?name=Team" id="helloLink">运行 Hello Action</a>
+                </s:else>
+            </div>
+        </section>
+
+        <section class="panel">
+            <div class="eyebrow" id="formEyebrow">登录表单</div>
+            <h2 id="formTitle">输入演示账号</h2>
+
+            <s:if test="#session.demoUser != null">
+                <div class="note">
+                    <strong id="loggedInTitle">当前已登录</strong>
+                    <p id="loggedInText" style="margin-top: 8px;">你已经拥有可访问的 Session，可以先进入学习门户总览全部模块，也可以退出后重新体验登录过程。</p>
+                </div>
+                <div class="links">
+                    <a class="link-btn" href="../index.action" id="loggedInDashboardLink">打开学习门户</a>
+                    <a class="link-btn" href="../logout.action" id="loggedInLogoutLink">退出后重试</a>
+                </div>
+            </s:if>
+            <s:else>
+                <s:if test="hasActionErrors()">
+                    <div class="action-error"><s:property value="actionErrors[0]"/></div>
+                </s:if>
+
+                <form action="<s:url action='login' namespace='/'/>" method="post">
+                    <div class="field">
+                        <label for="username" id="usernameLabel">用户名</label>
+                        <input id="username" name="username" placeholder="admin" autocomplete="username" value='<s:property value="username"/>'/>
+                        <s:if test="fieldErrors['username'] != null">
+                            <div class="error"><s:property value="fieldErrors['username'][0]"/></div>
+                        </s:if>
+                    </div>
+
+                    <div class="field">
+                        <label for="password" id="passwordLabel">密码</label>
+                        <input id="password" name="password" type="password" placeholder="123456" autocomplete="current-password"/>
+                        <s:if test="fieldErrors['password'] != null">
+                            <div class="error"><s:property value="fieldErrors['password'][0]"/></div>
+                        </s:if>
+                    </div>
+
+                    <button class="submit-btn" type="submit" id="submitBtn">写入 Session 并进入学习门户</button>
+                </form>
+            </s:else>
+        </section>
+    </div>
+
+    <script src="../assets/struts-lab.js"></script>
+    <script>
+        strutsLab.mount({
+            messages: {
+                zh: {
+                    pageTitle: "Session 登录实验 - Struts2 学习实验台",
+                    text: {
+                        leftEyebrow: "Session 登录章节",
+                        leftTitle: "用最经典的 Struts2 Session 登录，把后续实验页保护起来",
+                        leftText: "这个页面不只是演示登录表单，而是把 Action 校验、写入 Session、拦截器校验和登录后仪表盘串成一个完整章节，适合你系统掌握老项目最常见的鉴权思路。",
+                        credentialTitle: "演示账号",
+                        statOneTitle: "这一页讲什么",
+                        statOneText: "Action 校验、错误回显、Session 写入、登录后跳转。",
+                        statTwoTitle: "下一步看什么",
+                        statTwoText: "登录成功后会先回到学习门户，再进入仪表盘、用户表单、校验页和上传页。",
+                        backPortalLink: "返回门户",
+                        dashboardLink: "进入学习门户",
+                        logoutLink: "退出登录",
+                        formEyebrow: "登录表单",
+                        formTitle: "输入演示账号",
+                        loggedInTitle: "当前已登录",
+                        loggedInText: "你已经拥有可访问的 Session，可以先进入学习门户总览全部模块，也可以退出后重新体验登录过程。",
+                        loggedInDashboardLink: "打开学习门户",
+                        loggedInLogoutLink: "退出后重试",
+                        helloLink: "运行 Hello Action",
+                        usernameLabel: "用户名",
+                        passwordLabel: "密码",
+                        submitBtn: "写入 Session 并进入学习门户"
+                    },
+                    html: {
+                        credentialBody: "用户名：<code>admin</code><br/>密码：<code>123456</code>"
+                    }
+                },
+                en: {
+                    pageTitle: "Session Login Lab - Struts2 Learning Lab",
+                    text: {
+                        leftEyebrow: "Session login chapter",
+                        leftTitle: "Use the classic Struts2 session login pattern to protect later lab pages",
+                        leftText: "This page is not just a login form. It connects action validation, session writes, interceptor checks, and a post-login dashboard into one complete learning chapter.",
+                        credentialTitle: "Demo credentials",
+                        statOneTitle: "What this page teaches",
+                        statOneText: "Action validation, error echoing, session writes, and post-login routing.",
+                        statTwoTitle: "What to open next",
+                        statTwoText: "After login, return to the learning portal first, then continue to the dashboard, user form, validation page, and upload page.",
+                        backPortalLink: "Back to portal",
+                        dashboardLink: "Open learning portal",
+                        logoutLink: "Log out",
+                        formEyebrow: "Login form",
+                        formTitle: "Enter the demo account",
+                        loggedInTitle: "Already logged in",
+                        loggedInText: "A valid session already exists. Open the learning portal for the full overview or log out and replay the login flow.",
+                        loggedInDashboardLink: "Open learning portal",
+                        loggedInLogoutLink: "Log out and retry",
+                        helloLink: "Run hello action",
+                        usernameLabel: "Username",
+                        passwordLabel: "Password",
+                        submitBtn: "Write session and enter learning portal"
+                    },
+                    html: {
+                        credentialBody: "Username: <code>admin</code><br/>Password: <code>123456</code>"
+                    }
+                }
+            }
+        });
+    </script>
+</body>
+</html>

web/WEB-INF/views/user/success.jsp

@@ -0,0 +1,132 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>用户资料汇总 - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #0d8f7c 0%, #31c48d 55%, #d4f7e7 100%);
+            color: #123028;
+        }
+        .shell {
+            max-width: 1080px;
+            margin: 0 auto;
+            display: flex;
+            flex-direction: column;
+            gap: 18px;
+        }
+        .card {
+            background: rgba(255,255,255,0.94);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.18);
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #0d8f7c;
+            font-weight: 800;
+        }
+        h1, h2 { margin: 10px 0 12px; }
+        p { margin: 0; color: #446056; line-height: 1.85; }
+        .stats {
+            display: grid;
+            grid-template-columns: repeat(3, minmax(0, 1fr));
+            gap: 12px;
+            margin-top: 18px;
+        }
+        .stat {
+            padding: 16px;
+            border-radius: 18px;
+            border: 1px solid #d7eee6;
+            background: #f7fcfa;
+        }
+        .stat span { display: block; color: #5f7f75; font-size: 12px; margin-bottom: 6px; }
+        .stat strong { font-size: 22px; }
+        .links {
+            display: flex;
+            gap: 10px;
+            flex-wrap: wrap;
+            margin-top: 18px;
+        }
+        .link-btn {
+            display: inline-flex;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: #e8f8f2;
+            color: #0d8f7c;
+            text-decoration: none;
+            font-weight: 700;
+        }
+        @media (max-width: 760px) {
+            .stats { grid-template-columns: 1fr; }
+        }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <section class="card">
+            <div class="eyebrow">提交成功</div>
+            <h1>用户资料已经通过 Action 处理并汇总完成</h1>
+            <p>这页现在只负责展示用户资料提交的结果，不再和登录成功页面混用，便于你单独理解“表单提交成功页”这一类经典 Struts2 结果页。</p>
+        </section>
+
+        <section class="card">
+            <div class="eyebrow">当前提交</div>
+            <h2><s:property value="username"/></h2>
+            <p>
+                <s:if test="profileReady">
+                    这份资料已经达到“可继续演示”的状态，可以继续进入校验页或上传页。
+                </s:if>
+                <s:else>
+                    资料已经提交成功，但手机号仍偏弱。你可以回表单页再试一次，观察不同输入对结果的影响。
+                </s:else>
+            </p>
+
+            <div class="stats">
+                <div class="stat">
+                    <span>用户名</span>
+                    <strong><s:property value="username"/></strong>
+                </div>
+                <div class="stat">
+                    <span>邮箱</span>
+                    <strong><s:property value="email"/></strong>
+                </div>
+                <div class="stat">
+                    <span>手机号</span>
+                    <strong><s:property value="phone"/></strong>
+                </div>
+                <div class="stat">
+                    <span>资料状态</span>
+                    <strong>
+                        <s:if test="profileReady">可继续实验</s:if>
+                        <s:else>建议复查</s:else>
+                    </strong>
+                </div>
+                <div class="stat">
+                    <span>提交时间</span>
+                    <strong><s:property value="submittedAt"/></strong>
+                </div>
+                <div class="stat">
+                    <span>结果类型</span>
+                    <strong>/WEB-INF/views/user/success.jsp</strong>
+                </div>
+            </div>
+
+            <div class="links">
+                <a class="link-btn" href="../userFormPage.action">再试一次</a>
+                <a class="link-btn" href="../dashboard.action">返回仪表盘</a>
+                <a class="link-btn" href="../validationPage.action">继续看校验页</a>
+            </div>
+        </section>
+    </div>
+</body>
+</html>

web/WEB-INF/views/validation/form.jsp

@@ -0,0 +1,141 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>字段校验实验 - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #db2777 0%, #f472b6 55%, #ffe4f1 100%);
+        }
+        .shell {
+            max-width: 900px;
+            margin: 0 auto;
+            background: rgba(255,255,255,0.95);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.18);
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #db2777;
+            font-weight: 800;
+        }
+        h1 { margin: 10px 0 12px; }
+        p { margin: 0; color: #6e5565; line-height: 1.85; }
+        .field { margin-top: 16px; }
+        label { display: block; margin-bottom: 8px; font-weight: 700; color: #4a223b; }
+        input, textarea {
+            width: 100%;
+            padding: 13px 14px;
+            border-radius: 14px;
+            border: 1px solid #ecd6e0;
+            font: inherit;
+        }
+        textarea { resize: vertical; min-height: 120px; }
+        button {
+            width: 100%;
+            margin-top: 18px;
+            padding: 14px;
+            border: 0;
+            border-radius: 14px;
+            background: linear-gradient(135deg, #db2777, #f472b6);
+            color: white;
+            font-size: 16px;
+            font-weight: 800;
+            cursor: pointer;
+        }
+        .error { color: #c0265d; font-size: 13px; margin-top: 6px; }
+        .note {
+            margin-top: 18px;
+            padding: 16px;
+            border-radius: 18px;
+            background: #fff3f8;
+            border: 1px solid #f3d8e6;
+        }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .link-btn {
+            display: inline-flex;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: #fff0f7;
+            color: #db2777;
+            text-decoration: none;
+            font-weight: 700;
+        }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <div class="eyebrow">受保护校验页</div>
+        <h1>在业务执行前，先把输入规则讲清楚</h1>
+        <p>这个实验页专门用来讲 Struts2 的 <code>validate()</code>。你可以故意输错，再看字段错误如何被带回到原页面。</p>
+
+        <s:if test="#session.demoUser == null">
+            <div class="note">
+                <strong>当前未登录</strong>
+                <p style="margin-top: 8px;">校验页也已经接入 Session 保护。请先登录，再体验校验失败和成功两种状态。</p>
+            </div>
+            <div class="links">
+                <a class="link-btn" href="../loginPage.action">先去登录</a>
+                <a class="link-btn" href="../index.action">返回门户</a>
+            </div>
+        </s:if>
+        <s:else>
+            <div class="note">
+                <strong>建议观察点</strong>
+                <p style="margin-top: 8px;">先故意输入一个短用户名、错误邮箱和超范围年龄，再修正后重新提交，对比两次页面反馈。</p>
+            </div>
+
+            <form action="<s:url action='validate' namespace='/'/>" method="post">
+                <div class="field">
+                    <label for="username">用户名（3 到 20 字符）</label>
+                    <input id="username" name="username" placeholder="release-manager" value='<s:property value="username"/>'/>
+                    <s:if test="fieldErrors['username'] != null">
+                        <div class="error"><s:property value="fieldErrors['username'][0]"/></div>
+                    </s:if>
+                </div>
+
+                <div class="field">
+                    <label for="email">邮箱</label>
+                    <input id="email" name="email" placeholder="release@example.com" value='<s:property value="email"/>'/>
+                    <s:if test="fieldErrors['email'] != null">
+                        <div class="error"><s:property value="fieldErrors['email'][0]"/></div>
+                    </s:if>
+                </div>
+
+                <div class="field">
+                    <label for="age">年龄（18 到 60）</label>
+                    <input id="age" name="age" placeholder="30" value='<s:property value="age"/>'/>
+                    <s:if test="fieldErrors['age'] != null">
+                        <div class="error"><s:property value="fieldErrors['age'][0]"/></div>
+                    </s:if>
+                </div>
+
+                <div class="field">
+                    <label for="bio">简介</label>
+                    <textarea id="bio" name="bio" placeholder="描述角色、经验或当前负责的平台方向。"><s:property value="bio"/></textarea>
+                    <s:if test="fieldErrors['bio'] != null">
+                        <div class="error"><s:property value="fieldErrors['bio'][0]"/></div>
+                    </s:if>
+                </div>
+
+                <button type="submit">提交并查看校验结果</button>
+            </form>
+
+            <div class="links">
+                <a class="link-btn" href="../dashboard.action">返回仪表盘</a>
+                <a class="link-btn" href="../uploadPage.action">继续看上传页</a>
+            </div>
+        </s:else>
+    </div>
+</body>
+</html>

web/WEB-INF/views/validation/success.jsp

@@ -0,0 +1,102 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>校验结果汇总 - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 24px;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #db2777 0%, #f472b6 55%, #ffe4f1 100%);
+        }
+        .card {
+            width: min(860px, 100%);
+            background: rgba(255,255,255,0.95);
+            border-radius: 28px;
+            padding: 28px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.18);
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #db2777;
+            font-weight: 800;
+        }
+        h1 { margin: 10px 0 12px; }
+        p { margin: 0; color: #6a5060; line-height: 1.85; }
+        .stats {
+            display: grid;
+            grid-template-columns: repeat(2, minmax(0, 1fr));
+            gap: 12px;
+            margin-top: 18px;
+        }
+        .stat {
+            padding: 16px;
+            border-radius: 18px;
+            background: #fff5fa;
+            border: 1px solid #f1d8e5;
+        }
+        .stat span { display: block; font-size: 12px; color: #8a697b; margin-bottom: 6px; }
+        .stat strong { font-size: 18px; }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .link-btn {
+            display: inline-flex;
+            padding: 10px 14px;
+            border-radius: 999px;
+            background: #fff0f7;
+            color: #db2777;
+            text-decoration: none;
+            font-weight: 700;
+        }
+        @media (max-width: 720px) {
+            .stats { grid-template-columns: 1fr; }
+        }
+    </style>
+</head>
+<body>
+    <div class="card">
+        <div class="eyebrow">校验通过</div>
+        <h1>所有输入都满足当前 Action 的校验规则</h1>
+        <p>这页的价值在于把字段校验和业务执行分开解释。只有当所有字段都通过时，Action 才会进入成功结果页。</p>
+
+        <div class="stats">
+            <div class="stat"><span>用户名</span><strong><s:property value="username"/></strong></div>
+            <div class="stat"><span>邮箱</span><strong><s:property value="email"/></strong></div>
+            <div class="stat"><span>年龄</span><strong><s:property value="age"/></strong></div>
+            <div class="stat">
+                <span>阶段判断</span>
+                <strong><s:if test="seniorTrack">中阶段运维画像</s:if><s:else>早阶段运维画像</s:else></strong>
+            </div>
+            <div class="stat"><span>提交时间</span><strong><s:property value="submittedAt"/></strong></div>
+            <div class="stat"><span>简介</span><strong><s:property value="bio" default="未填写简介"/></strong></div>
+        </div>
+
+        <div class="links">
+            <a class="link-btn" href="../validationPage.action">重新做一次校验</a>
+            <a class="link-btn" href="../dashboard.action">返回仪表盘</a>
+        </div>
+
+        <div class="stats">
+            <div class="stat">
+                <span>规则入口</span>
+                <strong>validate()</strong>
+                先校验，再决定是否允许执行 <code>execute()</code>。
+            </div>
+            <div class="stat">
+                <span>教学重点</span>
+                <strong>输入先于业务</strong>
+                这正是传统 Struts2 表单页面里最值得讲清楚的部分。
+            </div>
+        </div>
+    </div>
+</body>
+</html>

web/WEB-INF/web.xml

@@ -1,11 +1,32 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<web-app>
+<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee
+         http://xmlns.jcp.org/xml/ns/javaee/web-app_4_0.xsd"
+         version="4.0">
+
+    <display-name>Struts2 Demo Lab</display-name>
+
     <filter>
         <filter-name>struts2</filter-name>
         <filter-class>org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter</filter-class>
     </filter>
+
     <filter-mapping>
         <filter-name>struts2</filter-name>
         <url-pattern>/*</url-pattern>
     </filter-mapping>
+
+    <welcome-file-list>
+        <welcome-file>index.jsp</welcome-file>
+    </welcome-file-list>
+
+    <error-page>
+        <error-code>404</error-code>
+        <location>/error/404.jsp</location>
+    </error-page>
+    <error-page>
+        <error-code>500</error-code>
+        <location>/error/500.jsp</location>
+    </error-page>
 </web-app>

web/assets/struts-lab.js

@@ -0,0 +1,92 @@
+(function () {
+    const LANGUAGE_KEY = "struts_lab_language";
+
+    function getLanguage() {
+        return localStorage.getItem(LANGUAGE_KEY) === "en" ? "en" : "zh";
+    }
+
+    function setLanguage(language) {
+        const resolved = language === "en" ? "en" : "zh";
+        localStorage.setItem(LANGUAGE_KEY, resolved);
+        document.documentElement.lang = resolved === "zh" ? "zh-CN" : "en";
+        return resolved;
+    }
+
+    function applyText(values) {
+        Object.entries(values || {}).forEach(([id, value]) => {
+            const node = document.getElementById(id);
+            if (node) {
+                node.textContent = value;
+            }
+        });
+    }
+
+    function applyHtml(values) {
+        Object.entries(values || {}).forEach(([id, value]) => {
+            const node = document.getElementById(id);
+            if (node) {
+                node.innerHTML = value;
+            }
+        });
+    }
+
+    function applyPlaceholders(values) {
+        Object.entries(values || {}).forEach(([id, value]) => {
+            const node = document.getElementById(id);
+            if (node) {
+                node.setAttribute("placeholder", value);
+            }
+        });
+    }
+
+    function mount(config) {
+        const state = {
+            language: setLanguage(getLanguage())
+        };
+        const button = document.getElementById(config.buttonId || "languageBtn");
+
+        function messages() {
+            return config.messages[state.language] || config.messages.zh || {};
+        }
+
+        function render() {
+            const current = messages();
+            if (current.pageTitle) {
+                document.title = current.pageTitle;
+            }
+            applyText(current.text);
+            applyHtml(current.html);
+            applyPlaceholders(current.placeholders);
+            if (button) {
+                button.textContent = state.language === "zh" ? "EN" : "中文";
+            }
+            if (typeof config.render === "function") {
+                config.render({
+                    language: state.language,
+                    messages: current,
+                    setLanguage
+                });
+            }
+        }
+
+        if (button) {
+            button.addEventListener("click", function () {
+                state.language = setLanguage(state.language === "zh" ? "en" : "zh");
+                render();
+            });
+        }
+
+        render();
+        return {
+            getLanguage: function () {
+                return state.language;
+            }
+        };
+    }
+
+    window.strutsLab = {
+        mount: mount,
+        getLanguage: getLanguage,
+        setLanguage: setLanguage
+    };
+})();

web/demo/ajax/index.jsp

@@ -0,0 +1,51 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>AJAX and JSON Guide</title>
+    <style>
+        body { margin: 0; padding: 24px; font-family: "Aptos", "Segoe UI", sans-serif; background: linear-gradient(135deg, #122c63, #1464c7); }
+        .shell { max-width: 980px; margin: 0 auto; background: rgba(255,255,255,0.96); border-radius: 28px; padding: 28px; box-shadow: 0 24px 60px rgba(0,0,0,0.18); }
+        .eyebrow { font-size: 12px; text-transform: uppercase; letter-spacing: 0.12em; color: #1464c7; font-weight: 800; }
+        h1, h2 { margin: 10px 0 12px; }
+        p, li { color: #53667d; line-height: 1.9; }
+        pre { background: #101827; color: #d9e7ff; padding: 18px; border-radius: 18px; overflow-x: auto; }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .btn { display: inline-flex; padding: 10px 14px; border-radius: 999px; text-decoration: none; font-weight: 700; background: #e8f2ff; color: #1464c7; }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <div class="eyebrow">Guide</div>
+        <h1>Returning JSON from Struts2 actions</h1>
+        <p>The demo now includes both an action-level JSON response and a REST-style JSON route. That makes it easier to compare MVC pages with lightweight API payloads.</p>
+
+        <h2>What the action returns</h2>
+        <ul>
+            <li>A <code>success</code> flag.</li>
+            <li>A short message describing the payload.</li>
+            <li>Sample user records that can be consumed by AJAX.</li>
+        </ul>
+
+        <pre>public class AjaxAction extends ActionSupport {
+    private boolean success;
+    private String message;
+    private List&lt;User&gt; users;
+
+    public String execute() {
+        success = true;
+        message = "Mock AJAX response";
+        return SUCCESS;
+    }
+}</pre>
+
+        <div class="links">
+            <a class="btn" href="../../ajax.action">Open action JSON</a>
+            <a class="btn" href="../../api/users.action">Open REST JSON</a>
+            <a class="btn" href="../../index.jsp">Back to portal</a>
+        </div>
+    </div>
+</body>
+</html>

web/demo/hello/index.jsp

@@ -0,0 +1,53 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Hello Action Guide</title>
+    <style>
+        body { margin: 0; padding: 24px; font-family: "Aptos", "Segoe UI", sans-serif; background: linear-gradient(135deg, #1464c7, #3a8dff); }
+        .shell { max-width: 980px; margin: 0 auto; background: rgba(255,255,255,0.96); border-radius: 28px; padding: 28px; box-shadow: 0 24px 60px rgba(0,0,0,0.18); }
+        .eyebrow { font-size: 12px; text-transform: uppercase; letter-spacing: 0.12em; color: #1464c7; font-weight: 800; }
+        h1, h2 { margin: 10px 0 12px; }
+        p, li { color: #53667d; line-height: 1.9; }
+        pre { background: #101827; color: #d9e7ff; padding: 18px; border-radius: 18px; overflow-x: auto; }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .btn { display: inline-flex; padding: 10px 14px; border-radius: 999px; text-decoration: none; font-weight: 700; background: #e8f2ff; color: #1464c7; }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <div class="eyebrow">Guide</div>
+        <h1>Hello action walkthrough</h1>
+        <p>The hello demo is still the best first stop for explaining how Struts2 maps a request to an action and then routes to a JSP result.</p>
+
+        <h2>Flow</h2>
+        <ul>
+            <li>The browser requests <code>/hello</code> or <code>/hello?name=Team</code>.</li>
+            <li>Struts populates the <code>name</code> property on <code>HelloAction</code>.</li>
+            <li><code>execute()</code> builds a view message and returns <code>SUCCESS</code>.</li>
+            <li>The framework resolves the success result to <code>/hello.jsp</code>.</li>
+        </ul>
+
+        <h2>Minimal action shape</h2>
+        <pre>public class HelloAction extends ActionSupport {
+    private String name;
+    private String message;
+
+    public String execute() {
+        if (name == null || name.trim().isEmpty()) {
+            name = "World";
+        }
+        message = "Hello, " + name + "!";
+        return SUCCESS;
+    }
+}</pre>
+
+        <div class="links">
+            <a class="btn" href="../../hello.action?name=Platform%20Team">Run hello action</a>
+            <a class="btn" href="../../index.jsp">Back to portal</a>
+        </div>
+    </div>
+</body>
+</html>

web/demo/model/index.jsp

@@ -0,0 +1,54 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>模型绑定指南</title>
+    <style>
+        body { margin: 0; padding: 24px; font-family: "Aptos", "Segoe UI", sans-serif; background: linear-gradient(135deg, #7c3aed, #a855f7); }
+        .shell { max-width: 980px; margin: 0 auto; background: rgba(255,255,255,0.96); border-radius: 28px; padding: 28px; box-shadow: 0 24px 60px rgba(0,0,0,0.18); }
+        .eyebrow { font-size: 12px; text-transform: uppercase; letter-spacing: 0.12em; color: #7c3aed; font-weight: 800; }
+        h1, h2 { margin: 10px 0 12px; }
+        p, li { color: #5e5570; line-height: 1.9; }
+        pre { background: #101827; color: #d9e7ff; padding: 18px; border-radius: 18px; overflow-x: auto; }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .btn { display: inline-flex; padding: 10px 14px; border-radius: 999px; text-decoration: none; font-weight: 700; background: #f0e9ff; color: #7c3aed; }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <div class="eyebrow">指南</div>
+        <h1>属性绑定与 ModelDriven 绑定怎么理解</h1>
+        <p>这页用来解释 Struts2 如何把请求参数装配进 Action。建议配合用户资料表单和字段校验实验一起看。</p>
+
+        <h2>属性驱动绑定</h2>
+        <ul>
+            <li>直接在 Action 上定义简单字段。</li>
+            <li>为表单字段提供对应的 setter / getter。</li>
+            <li>适合短流程 Demo 和小型表单。</li>
+        </ul>
+
+        <h2>ModelDriven 绑定</h2>
+        <ul>
+            <li>通过 <code>getModel()</code> 返回一个独立模型对象。</li>
+            <li>把请求数据和 Action 编排逻辑拆开。</li>
+            <li>更适合复杂表单和嵌套对象。</li>
+        </ul>
+
+        <pre>public class UserAction extends ActionSupport implements ModelDriven&lt;User&gt; {
+    private final User user = new User();
+
+    @Override
+    public User getModel() {
+        return user;
+    }
+}</pre>
+
+        <div class="links">
+            <a class="btn" href="../../userFormPage.action">打开用户表单实验</a>
+            <a class="btn" href="../../index.action">返回门户</a>
+        </div>
+    </div>
+</body>
+</html>

web/demo/upload/index.jsp

@@ -0,0 +1,50 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>上传实验指南</title>
+    <style>
+        body { margin: 0; padding: 24px; font-family: "Aptos", "Segoe UI", sans-serif; background: linear-gradient(135deg, #0ea5e9, #38bdf8); }
+        .shell { max-width: 980px; margin: 0 auto; background: rgba(255,255,255,0.96); border-radius: 28px; padding: 28px; box-shadow: 0 24px 60px rgba(0,0,0,0.18); }
+        .eyebrow { font-size: 12px; text-transform: uppercase; letter-spacing: 0.12em; color: #0284c7; font-weight: 800; }
+        h1, h2 { margin: 10px 0 12px; }
+        p, li { color: #53667d; line-height: 1.9; }
+        pre { background: #101827; color: #d9e7ff; padding: 18px; border-radius: 18px; overflow-x: auto; }
+        .links { display: flex; gap: 10px; flex-wrap: wrap; margin-top: 18px; }
+        .btn { display: inline-flex; padding: 10px 14px; border-radius: 999px; text-decoration: none; font-weight: 700; background: #edf7ff; color: #0284c7; }
+    </style>
+</head>
+<body>
+    <div class="shell">
+        <div class="eyebrow">指南</div>
+        <h1>上传实验怎么讲</h1>
+        <p>现在这条上传链路故意做成“只采集元数据，不真实落盘”的安全版，更适合本地和 VPS 演示环境。</p>
+
+        <h2>核心绑定字段</h2>
+        <ul>
+            <li><code>File upload</code> 负责接收主文件对象。</li>
+            <li><code>String uploadFileName</code> 负责接收原始文件名。</li>
+            <li><code>String uploadContentType</code> 负责接收 MIME 类型。</li>
+            <li>多个文件时还可以再接文件列表。</li>
+        </ul>
+
+        <pre>public class FileUploadAction extends ActionSupport {
+    private File upload;
+    private String uploadFileName;
+    private String uploadContentType;
+
+    public String execute() {
+        // demo keeps metadata only
+        return SUCCESS;
+    }
+}</pre>
+
+        <div class="links">
+            <a class="btn" href="../../uploadPage.action">打开上传实验</a>
+            <a class="btn" href="../../index.action">返回门户</a>
+        </div>
+    </div>
+</body>
+</html>

web/demo/validation/index.jsp

@@ -0,0 +1,227 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>表单验证 - Struts2 学习</title>
+    <style>
+        body { font-family: 'Segoe UI', 'PingFang SC', sans-serif; background: linear-gradient(135deg, #667eea, #764ba2); min-height: 100vh; margin: 0; padding: 20px; }
+        .container { max-width: 1200px; margin: 0 auto; }
+        .breadcrumb { background: white; padding: 15px 25px; border-radius: 10px; margin-bottom: 20px; }
+        .breadcrumb a { color: #667eea; text-decoration: none; }
+        .content { background: white; border-radius: 20px; padding: 40px; box-shadow: 0 10px 40px rgba(0,0,0,0.2); }
+        h1 { color: #667eea; border-bottom: 3px solid #667eea; padding-bottom: 15px; }
+        h2 { color: #764ba2; margin-top: 30px; }
+        .section { margin: 25px 0; padding: 20px; background: #f8f9fa; border-radius: 10px; }
+        pre { background: #1e1e1e; color: #d4d4d4; padding: 20px; border-radius: 10px; overflow-x: auto; font-size: 0.9em; }
+        .keyword { color: #569cd6; }
+        .string { color: #ce9178; }
+        .comment { color: #6a9955; }
+        .btn { display: inline-block; padding: 12px 30px; background: #667eea; color: white; text-decoration: none; border-radius: 25px; margin-right: 10px; }
+        .note { background: #fff3e0; border-left: 4px solid #ff9800; padding: 15px; margin: 20px 0; border-radius: 0 10px 10px 0; }
+        .tip { background: #e3f2fd; border-left: 4px solid #2196f3; padding: 15px; margin: 20px 0; border-radius: 0 10px 10px 0; }
+    </style>
+</head>
+<body>
+    <div class="container">
+        <div class="breadcrumb">
+            <a href="/">🏠 首页</a> / 表单验证
+        </div>
+        
+        <div class="content">
+            <h1>✅ 表单验证</h1>
+            
+            <div class="note">
+                <strong>📝 本节要点：</strong> 掌握 Struts2 的两种验证方式：编程式验证和声明式验证
+            </div>
+            
+            <h2>1. 验证方式概览</h2>
+            <div class="section">
+                <table style="width:100%; border-collapse: collapse;">
+                    <tr style="background:#667eea; color:white;">
+                        <th style="padding:10px; text-align:left;">方式</th>
+                        <th style="padding:10px; text-align:left;">实现方式</th>
+                        <th style="padding:10px; text-align:left;">适用场景</th>
+                    </tr>
+                    <tr style="background:#f8f9fa;">
+                        <td style="padding:10px;">编程式</td>
+                        <td style="padding:10px;">重写 validate() 方法</td>
+                        <td style="padding:10px;">简单验证，逻辑复杂</td>
+                    </tr>
+                    <tr>
+                        <td style="padding:10px;">声明式 - 方法级</td>
+                        <td style="padding:10px;">validateXxx() 方法</td>
+                        <td style="padding:10px;">特定方法的验证</td>
+                    </tr>
+                    <tr style="background:#f8f9fa;">
+                        <td style="padding:10px;">声明式 - XML</td>
+                        <td style="padding:10px;">XxxAction-validation.xml</td>
+                        <td style="padding:10px;">可复用，团队协作</td>
+                    </tr>
+                </table>
+            </div>
+            
+            <h2>2. 方式一：编程式验证 (validate)</h2>
+            <div class="section">
+                <pre><span class="keyword">public class</span> LoginAction <span class="keyword">extends</span> ActionSupport {
+    
+    <span class="keyword">private</span> String username;
+    <span class="keyword">private</span> String password;
+    
+    <span class="annotation">@Override</span>
+    <span class="keyword">public</span> String execute() {
+        <span class="comment">// 登录逻辑...</span>
+        <span class="keyword">return</span> SUCCESS;
+    }
+    
+    <span class="comment">/**
+     * 验证方法 - 对所有 execute 方法都生效
+     */</span>
+    <span class="annotation">@Override</span>
+    <span class="keyword">public void</span> validate() {
+        <span class="comment">// 用户名验证</span>
+        <span class="keyword">if</span> (username == <span class="keyword">null</span> || username.trim().length() < 3) {
+            addFieldError(<span class="string">"username"</span>, <span class="string">"用户名至少3个字符"</span>);
+        }
+        
+        <span class="comment">// 密码验证</span>
+        <span class="keyword">if</span> (password == <span class="keyword">null</span> || password.length() < 6) {
+            addFieldError(<span class="string">"password"</span>, <span class="string">"密码至少6个字符"</span>);
+        }
+    }
+    
+    <span class="comment">// getter/setter...</span>
+}</pre>
+            </div>
+            
+            <h2>3. 方式二：方法级验证 (validateXxx)</h2>
+            <div class="section">
+                <pre><span class="comment">/**
+ * 只验证 register 方法，不验证 login 方法
+ */</span>
+<span class="keyword">public void</span> validateRegister() {
+    <span class="keyword">if</span> (email == <span class="keyword">null</span> || !email.contains(<span class="string">"@"</span>)) {
+        addFieldError(<span class="string">"email"</span>, <span class="string">"邮箱格式不正确"</span>);
+    }
+}</pre>
+            </div>
+            
+            <h2>4. 方式三：XML 声明式验证</h2>
+            <div class="tip">
+                <strong>优点：</strong> 验证规则与代码分离，团队协作更清晰，可复用
+            </div>
+            
+            <h3>4.1 创建验证文件</h3>
+            <div class="section">
+                <p>文件名格式：<code>ActionName-validation.xml</code></p>
+                <p>位置：<code>WEB-INF/classes/com/demo/action/</code></p>
+                <pre><span class="comment">&lt;?xml version="1.0" encoding="UTF-8"?&gt;</span>
+<span class="keyword">&lt;!DOCTYPE validators PUBLIC</span>
+    <span class="string">"-//OpenSymphony Group//XWork Validator 1.0.3//EN"</span>
+    <span class="string">"http://www.opensymphony.com/xwork/xwork-validator-1.0.3.dtd"</span><span class="keyword">&gt;</span>
+
+<span class="keyword">&lt;validators&gt;</span>
+    <span class="comment">&lt;!-- 字段验证 --&gt;</span>
+    <span class="keyword">&lt;field</span> name=<span class="string">"username"</span><span class="keyword">&gt;</span>
+        <span class="keyword">&lt;field-validator</span> type=<span class="string">"requiredstring"</span><span class="keyword">&gt;</span>
+            <span class="keyword">&lt;message&gt;</span>用户名不能为空<span class="keyword">&lt;/message&gt;</span>
+        <span class="keyword">&lt;/field-validator&gt;</span>
+        <span class="keyword">&lt;field-validator</span> type=<span class="string">"stringlength"</span><span class="keyword">&gt;</span>
+            <span class="keyword">&lt;param</span> name=<span class="string">"minLength"</span><span class="keyword">&gt;</span>3<span class="keyword">&lt;/param&gt;</span>
+            <span class="keyword">&lt;param</span> name=<span class="string">"maxLength"</span><span class="keyword">&gt;</span>20<span class="keyword">&lt;/param&gt;</span>
+            <span class="keyword">&lt;message&gt;</span>用户名长度3-20字符<span class="keyword">&lt;/message&gt;</span>
+        <span class="keyword">&lt;/field-validator&gt;</span>
+    <span class="keyword">&lt;/field&gt;</span>
+    
+    <span class="comment">&lt;!-- 字段验证：email --&gt;</span>
+    <span class="keyword">&lt;field</span> name=<span class="string">"email"</span><span class="keyword">&gt;</span>
+        <span class="keyword">&lt;field-validator</span> type=<span class="string">"email"</span><span class="keyword">&gt;</span>
+            <span class="keyword">&lt;message&gt;</span>邮箱格式不正确<span class="keyword">&lt;/message&gt;</span>
+        <span class="keyword">&lt;/field-validator&gt;</span>
+    <span class="keyword">&lt;/field&gt;</span>
+    
+    <span class="comment">&lt;!-- 非字段验证 --&gt;</span>
+    <span class="keyword">&lt;validator</span> type=<span class="string">"expression"</span><span class="keyword">&gt;</span>
+        <span class="keyword">&lt;param</span> name=<span class="string">"expression"</span><span class="keyword">&gt;</span>password==confirmPassword<span class="keyword">&lt;/param&gt;</span>
+        <span class="keyword">&lt;message&gt;</span>两次密码不一致<span class="keyword">&lt;/message&gt;</span>
+    <span class="keyword">&lt;/validator&gt;</span>
+<span class="keyword">&lt;/validators&gt;</span></pre>
+            </div>
+            
+            <h2>5. 常用验证器类型</h2>
+            <div class="section">
+                <table style="width:100%; border-collapse: collapse;">
+                    <tr style="background:#667eea; color:white;">
+                        <th style="padding:10px; text-align:left;">验证器</th>
+                        <th style="padding:10px; text-align:left;">说明</th>
+                        <th style="padding:10px; text-align:left;">示例</th>
+                    </tr>
+                    <tr style="background:#f8f9fa;">
+                        <td style="padding:10px;">required</td>
+                        <td style="padding:10px;">必填</td>
+                        <td style="padding:10px;">username 不能为空</td>
+                    </tr>
+                    <tr>
+                        <td style="padding:10px;">requiredstring</td>
+                        <td style="padding:10px;">字符串必填</td>
+                        <td style="padding:10px;">不能为空字符串</td>
+                    </tr>
+                    <tr style="background:#f8f9fa;">
+                        <td style="padding:10px;">stringlength</td>
+                        <td style="padding:10px;">字符串长度</td>
+                        <td style="padding:10px;">minLength, maxLength</td>
+                    </tr>
+                    <tr>
+                        <td style="padding:10px;">email</td>
+                        <td style="padding:10px;">邮箱格式</td>
+                        <td style="padding:10px;">xxx@xxx.com</td>
+                    </tr>
+                    <tr style="background:#f8f9fa;">
+                        <td style="padding:10px;">regex</td>
+                        <td style="padding:10px;">正则表达式</td>
+                        <td style="padding:10px;">手机号、身份证等</td>
+                    </tr>
+                    <tr>
+                        <td style="padding:10px;">int</td>
+                        <td style="padding:10px;">整数范围</td>
+                        <td style="padding:10px;">min, max</td>
+                    </tr>
+                    <tr style="background:#f8f9fa;">
+                        <td style="padding:10px;">url</td>
+                        <td style="padding:10px;">URL 格式</td>
+                        <td style="padding:10px;">http://xxx.com</td>
+                    </tr>
+                    <tr>
+                        <td style="padding:10px;">date</td>
+                        <td style="padding:10px;">日期范围</td>
+                        <td style="padding:10px;">min, max</td>
+                    </tr>
+                </table>
+            </div>
+            
+            <h2>6. 在 JSP 中显示错误</h2>
+            <div class="section">
+                <pre><span class="comment">&lt;%@ taglib prefix="s" uri="/struts-tags" %&gt;</span>
+
+<span class="comment">&lt;!-- 显示特定字段的错误 --&gt;</span>
+<span class="keyword">&lt;s:fielderror</span> fieldName=<span class="string">"username"</span>/&gt;
+
+<span class="comment">&lt;!-- 显示所有字段错误 --&gt;</span>
+<span class="keyword">&lt;s:fielderror</span>/&gt;
+
+<span class="comment">&lt;!-- 显示 Action 级别错误 --&gt;</span>
+<span class="keyword">&lt;s:actionerror</span>/&gt;
+
+<span class="comment">&lt;!-- 显示 Action 级别消息 --&gt;</span>
+<span class="keyword">&lt;s:actionmessage</span>/&gt;</pre>
+            </div>
+            
+            <div style="margin-top: 30px;">
+                <a href="/demo/model" class="btn">下一节：数据封装 →</a>
+                <a href="/" class="btn" style="background: #764ba2;">← 返回首页</a>
+            </div>
+        </div>
+    </div>
+</body>
+</html>

web/error/404.jsp

@@ -0,0 +1,47 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>404 - Struts2 Demo Lab</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #122c63 0%, #1464c7 52%, #f68b1f 100%);
+        }
+        .card {
+            width: min(680px, calc(100vw - 32px));
+            background: rgba(255,255,255,0.95);
+            border-radius: 28px;
+            padding: 28px;
+            text-align: center;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.22);
+        }
+        h1 { margin: 0 0 12px; font-size: 52px; color: #1464c7; }
+        p { margin: 0; color: #56697f; line-height: 1.85; }
+        a {
+            display: inline-flex;
+            margin-top: 20px;
+            padding: 12px 18px;
+            border-radius: 999px;
+            background: #e8f2ff;
+            color: #1464c7;
+            text-decoration: none;
+            font-weight: 700;
+        }
+    </style>
+</head>
+<body>
+    <div class="card">
+        <h1>404</h1>
+        <p>The requested demo page was not found. Use the portal to jump back into the working Struts2 examples.</p>
+        <a href="../index.jsp">Back to portal</a>
+    </div>
+</body>
+</html>

web/error/500.jsp

@@ -0,0 +1,47 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>500 - Struts2 Demo Lab</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #7f1d1d 0%, #dc2626 55%, #fee2e2 100%);
+        }
+        .card {
+            width: min(700px, calc(100vw - 32px));
+            background: rgba(255,255,255,0.95);
+            border-radius: 28px;
+            padding: 28px;
+            text-align: center;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.22);
+        }
+        h1 { margin: 0 0 12px; font-size: 52px; color: #b91c1c; }
+        p { margin: 0; color: #6d4b4b; line-height: 1.85; }
+        a {
+            display: inline-flex;
+            margin-top: 20px;
+            padding: 12px 18px;
+            border-radius: 999px;
+            background: #fee2e2;
+            color: #b91c1c;
+            text-decoration: none;
+            font-weight: 700;
+        }
+    </style>
+</head>
+<body>
+    <div class="card">
+        <h1>500</h1>
+        <p>The demo hit an internal error. Return to the portal and try one of the working examples again.</p>
+        <a href="../index.jsp">Back to portal</a>
+    </div>
+</body>
+</html>

web/hello.jsp

@@ -0,0 +1,124 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%@ taglib prefix="s" uri="/struts-tags" %>
+<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Hello Action - Struts2 学习实验台</title>
+    <style>
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            font-family: "Aptos", "Segoe UI", "Microsoft YaHei", sans-serif;
+            background: linear-gradient(135deg, #1464c7 0%, #3f8df7 52%, #f68b1f 100%);
+            color: #122033;
+        }
+        .card {
+            width: min(860px, calc(100vw - 32px));
+            background: rgba(255,255,255,0.94);
+            border: 1px solid rgba(255,255,255,0.45);
+            border-radius: 30px;
+            padding: 30px;
+            box-shadow: 0 24px 60px rgba(0,0,0,0.24);
+        }
+        .eyebrow {
+            font-size: 12px;
+            letter-spacing: 0.12em;
+            text-transform: uppercase;
+            color: #1464c7;
+            font-weight: 800;
+        }
+        h1 {
+            margin: 12px 0;
+            font-size: 42px;
+            line-height: 1.12;
+        }
+        p {
+            margin: 0;
+            color: #53667d;
+            line-height: 1.9;
+        }
+        .grid {
+            display: grid;
+            grid-template-columns: repeat(2, minmax(0, 1fr));
+            gap: 14px;
+            margin-top: 20px;
+        }
+        .panel {
+            padding: 18px;
+            border-radius: 20px;
+            background: #f6f9fd;
+            border: 1px solid #dbe5f0;
+        }
+        .panel h3 {
+            margin: 0 0 8px;
+            font-size: 18px;
+        }
+        .panel code {
+            display: inline-block;
+            margin-top: 8px;
+            padding: 4px 8px;
+            border-radius: 10px;
+            background: #e8f2ff;
+            color: #1464c7;
+        }
+        .actions {
+            display: flex;
+            gap: 10px;
+            flex-wrap: wrap;
+            margin-top: 24px;
+        }
+        .btn {
+            display: inline-flex;
+            align-items: center;
+            justify-content: center;
+            padding: 12px 18px;
+            border-radius: 999px;
+            text-decoration: none;
+            font-weight: 700;
+        }
+        .btn-primary { background: #1464c7; color: #fff; }
+        .btn-soft { background: #e8f2ff; color: #1464c7; }
+        @media (max-width: 720px) {
+            .grid { grid-template-columns: 1fr; }
+        }
+    </style>
+</head>
+<body>
+    <div class="card">
+        <div class="eyebrow">Hello Action</div>
+        <h1><s:property value="message" default="Hello from Struts2!"/></h1>
+        <p>这个页面用最短路径演示经典的 request -> action -> result 流程。你传入一个 name 参数，Action 处理后再交给 JSP 结果页渲染。</p>
+
+        <div class="grid">
+            <section class="panel">
+                <h3>刚刚发生了什么</h3>
+                <p><s:property value="tip" default="The action populated a few view properties before returning SUCCESS."/></p>
+            </section>
+            <section class="panel">
+                <h3>建议下一步</h3>
+                <p><s:property value="nextStep" default="Open the login flow next."/></p>
+            </section>
+            <section class="panel">
+                <h3>再试一个请求</h3>
+                <p>你可以换一个查询参数，观察问候语如何跟着变化。</p>
+                <code><s:property value="requestSample" default="/hello?name=Platform%20Team"/></code>
+            </section>
+            <section class="panel">
+                <h3>当前输入</h3>
+                <p>name 参数值：<strong><s:property value="name" default="World"/></strong></p>
+            </section>
+        </div>
+
+        <div class="actions">
+            <a class="btn btn-primary" href="hello.action?name=Platform%20Team">用示例参数再运行一次</a>
+            <a class="btn btn-soft" href="loginPage.action">进入登录实验</a>
+            <a class="btn btn-soft" href="index.action">返回门户</a>
+        </div>
+    </div>
+</body>
+</html>

web/index.jsp

@@ -0,0 +1,4 @@
+<%@ page contentType="text/html;charset=UTF-8" language="java" %>
+<%
+    response.sendRedirect(request.getContextPath() + "/index.action");
+%>