refactor(api-server): narrow puzzle state surface

server-rs/crates/api-server/src/puzzle/tests.rs

@@ -41,6 +41,7 @@ fn puzzle_vector_engine_generation_fallback_includes_reference_image() {
         mime_type: "image/png".to_string(),
         bytes_len: cursor.get_ref().len(),
         bytes: cursor.into_inner(),
+        signed_read_url: None,
     };
 
     let body = build_puzzle_vector_engine_image_request_body(
@@ -64,6 +65,33 @@ fn puzzle_vector_engine_generation_fallback_includes_reference_image() {
     );
 }
 
+#[test]
+fn puzzle_vector_engine_generation_prefers_signed_reference_url() {
+    let reference_image = PuzzleResolvedReferenceImage {
+        mime_type: "image/png".to_string(),
+        bytes_len: 4,
+        bytes: b"test".to_vec(),
+        signed_read_url: Some(
+            "https://oss.example/generated-puzzle-assets/reference.png?x-oss-signature=abc"
+                .to_string(),
+        ),
+    };
+
+    let body = build_puzzle_vector_engine_image_request_body(
+        PuzzleImageModel::GptImage2,
+        "参考图里的小猫做成拼图主图。",
+        PUZZLE_DEFAULT_NEGATIVE_PROMPT,
+        PUZZLE_VECTOR_ENGINE_GENERATED_IMAGE_SIZE,
+        1,
+        Some(&reference_image),
+    );
+
+    assert_eq!(
+        body["image"][0],
+        "https://oss.example/generated-puzzle-assets/reference.png?x-oss-signature=abc"
+    );
+}
+
 #[test]
 fn puzzle_vector_engine_edit_url_uses_images_edits_endpoint() {
     let settings = PuzzleVectorEngineSettings {
@@ -131,6 +159,8 @@ fn puzzle_reference_image_sources_are_deduped_and_limited() {
             "data:image/png;base64,e".to_string(),
             "data:image/png;base64,f".to_string(),
         ],
+        None,
+        &[],
     );
 
     assert_eq!(sources.len(), 5);
@@ -139,6 +169,62 @@ fn puzzle_reference_image_sources_are_deduped_and_limited() {
     assert!(!sources.contains(&"data:image/png;base64,f".to_string()));
 }
 
+#[test]
+fn puzzle_reference_image_sources_prefer_asset_object_ids() {
+    let sources = collect_puzzle_reference_image_sources(
+        Some("data:image/png;base64,legacy"),
+        &["/generated-puzzle-assets/legacy.png".to_string()],
+        Some("asset-main-1"),
+        &[
+            "asset-main-1".to_string(),
+            "asset-prompt-1".to_string(),
+            "asset-prompt-2".to_string(),
+        ],
+    );
+
+    assert_eq!(
+        sources,
+        vec![
+            "asset-object:asset-main-1".to_string(),
+            "asset-object:asset-prompt-1".to_string(),
+            "asset-object:asset-prompt-2".to_string(),
+            "data:image/png;base64,legacy".to_string(),
+            "/generated-puzzle-assets/legacy.png".to_string(),
+        ]
+    );
+}
+
+#[test]
+fn puzzle_asset_object_reference_requires_matching_owner() {
+    let asset_object = module_assets::AssetObjectRecord {
+        asset_object_id: "assetobj_reference_1".to_string(),
+        bucket: "genarrative-assets".to_string(),
+        object_key: "generated-puzzle-assets/reference/image.png".to_string(),
+        access_policy: module_assets::AssetObjectAccessPolicy::Private,
+        content_type: Some("image/png".to_string()),
+        content_length: 1024,
+        content_hash: None,
+        version: 1,
+        source_job_id: None,
+        owner_user_id: Some("user-other".to_string()),
+        profile_id: None,
+        entity_id: None,
+        asset_kind: "puzzle_cover_image".to_string(),
+        created_at: "2026-05-21T00:00:00Z".to_string(),
+        updated_at: "2026-05-21T00:00:00Z".to_string(),
+    };
+
+    let error = validate_puzzle_reference_asset_object(
+        &asset_object,
+        Some("user-current"),
+        "genarrative-assets",
+    )
+    .expect_err("其他账号的参考图资产应被拒绝");
+
+    assert_eq!(error.status_code(), StatusCode::FORBIDDEN);
+    assert!(error.body_text().contains("不属于当前账号"));
+}
+
 #[test]
 fn puzzle_vector_engine_timeout_maps_to_gateway_timeout() {
     let error = map_puzzle_vector_engine_request_error(
@@ -250,6 +336,8 @@ fn puzzle_image_generation_builds_fallback_session_from_levels_snapshot() {
         prompt_text: None,
         reference_image_src: None,
         reference_image_srcs: Vec::new(),
+        reference_image_asset_object_id: None,
+        reference_image_asset_object_ids: Vec::new(),
         image_model: Some(PUZZLE_IMAGE_MODEL_GPT_IMAGE_2.to_string()),
         ai_redraw: None,
         candidate_count: Some(1),
@@ -383,6 +471,7 @@ fn puzzle_uploaded_cover_can_reuse_resolved_history_image() {
         mime_type: "image/png".to_string(),
         bytes_len: 8,
         bytes: b"pngbytes".to_vec(),
+        signed_read_url: None,
     };
 
     let downloaded = PuzzleDownloadedImage::from_resolved_reference_image(resolved);
@@ -410,6 +499,8 @@ fn puzzle_first_level_name_snapshot_defaults_work_title() {
         prompt_text: None,
         reference_image_src: None,
         reference_image_srcs: Vec::new(),
+        reference_image_asset_object_id: None,
+        reference_image_asset_object_ids: Vec::new(),
         image_model: Some(PUZZLE_IMAGE_MODEL_GPT_IMAGE_2.to_string()),
         ai_redraw: None,
         candidate_count: Some(1),
@@ -614,7 +705,9 @@ fn puzzle_ui_background_fields_roundtrip_between_response_and_module_json() {
 
 #[test]
 fn puzzle_work_summary_response_keeps_levels_for_shelf_cover() {
-    let state = AppState::new(crate::config::AppConfig::default()).expect("state should build");
+    let app_state = crate::state::AppState::new(crate::config::AppConfig::default())
+        .expect("state should build");
+    let state: PuzzleApiState = axum::extract::FromRef::from_ref(&app_state);
     let level = PuzzleDraftLevelRecord {
         level_id: "puzzle-level-1".to_string(),
         level_name: "雨夜猫街".to_string(),