Files

kdletters 4fecf9c975 fix(auth): tighten refresh session revocation

2026-05-13 15:13:43 +08:00

7.5 KiB

Raw Permalink Blame History

Rust API Server 路由索引（2026-04-23）

更新时间：2026-05-13

2026-04-29 补充：本文件保留为迁移期路由快照。DDD G1 后续并行工作的契约冻结口径以 SERVER_RS_DDD_G1_CONTRACT_AND_ROUTE_MATRIX_2026-04-29.md 为准，尤其是新增的 Big Fish、Puzzle、profile、runtime chat、story facade 和兼容路由删除计划。

2026-04-29 WP-RS 进度：旧 /api/runtime/story/* HTTP compat 路由已从 api-server/src/app.rs 取消挂载，并删除 api-server/src/runtime_story* 兼容实现。当前 Rust api-server 对外 story 主链只保留 /api/story/*、/api/runtime/sessions/{runtime_session_id}/inventory 与 runtime chat 相关路由。

1. 文档目标

本文件记录当前 server-rs/crates/api-server/src/app.rs 中已挂载的 Rust Axum 路由面，用于对照 Node 后端 96 条路由能力基线。

本文件只做路由索引，不替代单个阶段的设计文档；接口字段、权限、错误模型仍以各阶段技术方案和 shared-contracts 为准。

2. 当前统计

当前 Rust api-server 从 app.rs 可抽取到 116 条路由：

管理后台 API：6 条。
内部鉴权调试接口：2 条。
AI task 接口：9 条。
assets / OSS 接口：15 条。
auth 接口：13 条。
custom world / agent 接口：23 条。
match3d creation / runtime 接口：14 条。
llm proxy 接口：1 条。
profile / runtime profile 接口：12 条。
runtime story / story gameplay 接口：15 条。
legacy generated 静态标识：6 类历史路径字符串，直读代理已下线。
health check：1 条。

3. 路由清单

3.1 管理后台 API

POST /admin/api/login
GET /admin/api/me
GET /admin/api/overview
POST /admin/api/debug/http
POST /admin/api/profile/redeem-codes
POST /admin/api/profile/redeem-codes/disable

GET /admin 同源内嵌页面入口已取消挂载，后台 UI 后续由独立前端工程承接。

3.2 内部鉴权调试

GET /_internal/auth/claims
GET /_internal/auth/refresh-cookie

3.3 AI Task

POST /api/ai/tasks
POST /api/ai/tasks/{task_id}/start
POST /api/ai/tasks/{task_id}/cancel
POST /api/ai/tasks/{task_id}/complete
POST /api/ai/tasks/{task_id}/fail
POST /api/ai/tasks/{task_id}/chunks
POST /api/ai/tasks/{task_id}/references
POST /api/ai/tasks/{task_id}/stages/{stage_kind}/start
POST /api/ai/tasks/{task_id}/stages/{stage_kind}/complete

3.4 Assets / OSS

POST /api/assets/direct-upload-tickets
POST /api/assets/sts-upload-credentials
POST /api/assets/objects/confirm
POST /api/assets/objects/bind
GET /api/assets/read-url
POST /api/assets/character-visual/generate
GET /api/assets/character-visual/jobs/{task_id}
POST /api/assets/character-visual/publish
POST /api/assets/character-animation/generate
GET /api/assets/character-animation/jobs/{task_id}
POST /api/assets/character-animation/publish
POST /api/assets/character-animation/import-video
GET /api/assets/character-animation/templates
GET /api/assets/character-workflow-cache/{character_id}
GET / POST /api/assets/character-workflow-cache

3.5 Auth

GET /api/auth/login-options
GET /api/auth/me
POST /api/auth/logout
POST /api/auth/logout-all
GET /api/auth/sessions
POST /api/auth/sessions/{session_id}/revoke
POST /api/auth/refresh
POST /api/auth/phone/send-code
POST /api/auth/phone/login
GET /api/auth/wechat/start
GET /api/auth/wechat/callback
POST /api/auth/wechat/bind-phone
POST /api/auth/entry

3.6 Custom World / Agent

GET /api/runtime/custom-world-library
GET /api/runtime/custom-world-library/{profile_id}
POST /api/runtime/custom-world-library/{profile_id}/publish
POST /api/runtime/custom-world-library/{profile_id}/unpublish
GET /api/runtime/custom-world-gallery
GET /api/runtime/custom-world-gallery/{owner_user_id}/{profile_id}
GET /api/runtime/custom-world/works
POST /api/runtime/custom-world/agent/sessions
GET /api/runtime/custom-world/agent/sessions/{session_id}
POST /api/runtime/custom-world/agent/sessions/{session_id}/messages
GET /api/runtime/custom-world/agent/sessions/{session_id}/messages/stream
GET /api/runtime/custom-world/agent/sessions/{session_id}/operations/{operation_id}
GET /api/runtime/custom-world/agent/sessions/{session_id}/cards/{card_id}
POST /api/runtime/custom-world/agent/sessions/{session_id}/actions
POST /api/custom-world/entity
POST /api/runtime/custom-world/entity
POST /api/custom-world/scene-npc
POST /api/runtime/custom-world/scene-npc
POST /api/custom-world/scene-image
POST /api/custom-world/cover-image
POST /api/custom-world/cover-upload
POST /api/runtime/custom-world/cover-image
POST /api/runtime/custom-world/cover-upload

3.7 LLM Proxy

POST /api/llm/chat/completions

3.8 Match3D Creation / Runtime

POST /api/creation/match3d/sessions
GET /api/creation/match3d/sessions/{session_id}
POST /api/creation/match3d/sessions/{session_id}/messages
POST /api/creation/match3d/sessions/{session_id}/messages/stream
POST /api/creation/match3d/sessions/{session_id}/actions
POST /api/creation/match3d/sessions/{session_id}/compile
GET /api/creation/match3d/works
GET / PATCH / PUT / DELETE /api/creation/match3d/works/{profile_id}
POST /api/creation/match3d/works/{profile_id}/publish
GET /api/runtime/match3d/gallery
POST /api/runtime/match3d/works/{profile_id}/runs
GET /api/runtime/match3d/runs/{run_id}
POST /api/runtime/match3d/runs/{run_id}/click
POST /api/runtime/match3d/runs/{run_id}/stop / restart / time-up

3.9 Profile / Runtime Profile

GET /api/profile/dashboard
GET /api/runtime/profile/dashboard
GET /api/profile/play-stats
GET /api/runtime/profile/play-stats
GET /api/profile/wallet-ledger
GET /api/runtime/profile/wallet-ledger
GET /api/profile/browse-history
GET /api/runtime/profile/browse-history
GET /api/profile/save-archives
GET /api/runtime/profile/save-archives
POST /api/profile/save-archives/{world_key}
POST /api/runtime/profile/save-archives/{world_key}

3.10 Runtime Story / Gameplay

POST /api/runtime/save/snapshot
GET /api/runtime/settings
POST /api/story/sessions
POST /api/story/sessions/continue
GET /api/story/sessions/{story_session_id}/state
POST /api/story/battles
POST /api/story/battles/resolve
GET /api/story/battles/{battle_state_id}
POST /api/story/npc/battle
GET /api/runtime/sessions/{runtime_session_id}/inventory

3.11 Legacy Generated 路径

旧 /generated-* 直读代理已下线。生成资产读取统一走 GET /api/assets/read-url 或 asset object projection；/generated-* 字符串仅作为 legacyPublicPath / OSS object key 兼容标识保留。

3.12 Health

GET /healthz

4. 维护规则

新增、删除或改名 Rust 路由时，必须同步更新本索引。
如果 Rust 后端公开能力面发生变化，必须同时更新本索引、当前后端实现基线与对应阶段任务清单。
任何 breaking route change 都必须先更新阶段设计文档，再改代码。
真实切流前，必须用本索引对照代理层、前端调用面和 smoke 清单，避免只完成编译而遗漏外部可访问路径。

7.5 KiB Raw Permalink Blame History Unescape Escape