修复画布素材导出跨域读取

导出读取改走同源 read-bytes 接口

readAssetBytes 支持 objectKey 直读

补充对象素材导出不触发 OSS 跨域请求的回归测试

更新画布素材导出文档的 CORS 边界

src/components/image-editor/ImageCanvasExportModel.test.ts

@@ -169,26 +169,10 @@ describe('ImageCanvasExportModel', () => {
     });
   });
 
-  it('reads private object-key assets through signed URLs before exporting', async () => {
+  it('reads private object-key assets through same-origin bytes before exporting', async () => {
     const originalFetch = globalThis.fetch;
     const fetchMock = vi.fn(async (url: string) => {
-      if (url.startsWith('/api/assets/read-url?')) {
-        return new Response(
-          JSON.stringify({
-            ok: true,
-            data: {
-              read: {
-                objectKey: 'generated/video.mp4',
-                signedUrl: 'https://oss.example.com/generated/video.mp4?x-oss-signature=1',
-                expiresAt: '2026-06-20T00:00:00.000Z',
-              },
-            },
-            error: null,
-            meta: { apiVersion: '2026-06-16' },
-          }),
-        );
-      }
-      if (url === 'https://oss.example.com/generated/video.mp4?x-oss-signature=1') {
+      if (url.startsWith('/api/assets/read-bytes?')) {
         return new Response(new Blob(['video'], { type: 'video/mp4' }));
       }
       return new Response(null, { status: 404 });
@@ -206,40 +190,22 @@ describe('ImageCanvasExportModel', () => {
 
       expect(blob.type).toBe('video/mp4');
       expect(fetchMock).toHaveBeenCalledWith(
-        expect.stringContaining('/api/assets/read-url?objectKey=generated%2Fvideo.mp4'),
+        expect.stringContaining('/api/assets/read-bytes?objectKey=generated%2Fvideo.mp4'),
         expect.any(Object),
       );
-      expect(fetchMock).toHaveBeenCalledWith(
-        'https://oss.example.com/generated/video.mp4?x-oss-signature=1',
+      expect(fetchMock).not.toHaveBeenCalledWith(
+        expect.stringContaining('x-oss-signature'),
+        expect.anything(),
       );
     } finally {
       globalThis.fetch = originalFetch;
     }
   });
 
-  it('reads private image-sequence frame object keys through signed URLs', async () => {
+  it('reads private image-sequence frame object keys through same-origin bytes', async () => {
     const originalFetch = globalThis.fetch;
     const fetchMock = vi.fn(async (url: string) => {
-      if (url.startsWith('/api/assets/read-url?')) {
-        return new Response(
-          JSON.stringify({
-            ok: true,
-            data: {
-              read: {
-                objectKey: 'generated/frame-1.png',
-                signedUrl:
-                  'https://oss.example.com/generated/frame-1.png?x-oss-signature=1',
-                expiresAt: '2026-06-20T00:00:00.000Z',
-              },
-            },
-            error: null,
-            meta: { apiVersion: '2026-06-16' },
-          }),
-        );
-      }
-      if (
-        url === 'https://oss.example.com/generated/frame-1.png?x-oss-signature=1'
-      ) {
+      if (url.startsWith('/api/assets/read-bytes?')) {
         return new Response(new Blob(['frame'], { type: 'image/png' }));
       }
       return new Response(null, { status: 404 });
@@ -272,7 +238,7 @@ describe('ImageCanvasExportModel', () => {
       expect(blob).toBeTruthy();
       expect(fetchMock).toHaveBeenCalledWith(
         expect.stringContaining(
-          '/api/assets/read-url?objectKey=generated%2Fframe-1.png',
+          '/api/assets/read-bytes?objectKey=generated%2Fframe-1.png',
         ),
         expect.any(Object),
       );

src/components/image-editor/ImageCanvasExportModel.ts

@@ -1,3 +1,4 @@
+import { readAssetBytes } from '../../services/assetReadUrlService';
 import type {
   CanvasAssetExportMetadata,
   CanvasGenerationInputField,
@@ -11,10 +12,6 @@ import {
   UI_DESIGN_ASSET_EXTRACTION_PROMPT,
 } from './ImageCanvasGenerationModel';
 import { formatCanvasDurationMetric } from './ImageCanvasMediaModel';
-import {
-  getSignedAssetReadUrl,
-  resolveAssetReadUrl,
-} from '../../services/assetReadUrlService';
 
 export function sanitizeExportFilePart(value: string, fallback: string) {
   const safeValue = value
@@ -153,7 +150,6 @@ export function dataUrlToBlob(dataUrl: string) {
 export async function readAssetSourceBlob({
   source,
   objectKey,
-  refreshKey,
 }: {
   source: string;
   objectKey?: string | null;
@@ -162,15 +158,7 @@ export async function readAssetSourceBlob({
   if (source.startsWith('data:')) {
     return dataUrlToBlob(source);
   }
-  const resolvedSource = objectKey
-    ? await getSignedAssetReadUrl({ objectKey }, undefined, {
-        cacheVersion: refreshKey,
-      })
-    : await resolveAssetReadUrl(source, { refreshKey });
-  const response = await fetch(resolvedSource);
-  if (!response.ok) {
-    throw new Error(`HTTP ${response.status}`);
-  }
+  const response = await readAssetBytes(source, { objectKey });
   return response.blob();
 }
 

src/components/image-editor/useImageCanvasAssetExportWorkflow.test.tsx

@@ -302,26 +302,7 @@ describe('useImageCanvasAssetExportWorkflow', () => {
   it('reports empty exports and supports direct layer image downloads', async () => {
     const originalFetch = globalThis.fetch;
     const fetchMock = vi.fn(async (url: string) => {
-      if (url.startsWith('/api/assets/read-url?')) {
-        return new Response(
-          JSON.stringify({
-            ok: true,
-            data: {
-              read: {
-                objectKey: 'generated/private.png',
-                signedUrl:
-                  'https://oss.example.com/generated/private.png?x-oss-signature=1',
-                expiresAt: '2026-06-20T00:00:00.000Z',
-              },
-            },
-            error: null,
-            meta: { apiVersion: '2026-06-16' },
-          }),
-        );
-      }
-      if (
-        url === 'https://oss.example.com/generated/private.png?x-oss-signature=1'
-      ) {
+      if (url.startsWith('/api/assets/read-bytes?')) {
         return new Response(new Blob(['private'], { type: 'image/png' }));
       }
       if (url.startsWith('/generated/video.webm?token=1')) {
@@ -373,10 +354,15 @@ describe('useImageCanvasAssetExportWorkflow', () => {
       expect(downloadedBlob).toBeTruthy();
       expect(fetchMock).toHaveBeenCalledWith(
         expect.stringContaining(
-          '/api/assets/read-url?objectKey=generated%2Fprivate.png',
+          '/api/assets/read-bytes?objectKey=generated%2Fprivate.png',
         ),
         expect.any(Object),
       );
+      expect(
+        fetchMock.mock.calls.some(([url]) =>
+          String(url).includes('x-oss-signature'),
+        ),
+      ).toBe(false);
 
       render(
         <ExportWorkflowHarness