修复画布素材导出跨域读取

导出读取改走同源 read-bytes 接口

readAssetBytes 支持 objectKey 直读

补充对象素材导出不触发 OSS 跨域请求的回归测试

更新画布素材导出文档的 CORS 边界

src/services/assetReadUrlService.test.ts

@@ -522,6 +522,34 @@ describe('assetReadUrlService', () => {
     );
   });
 
+  test('readAssetBytes reads object-key resources through same-origin bytes endpoint', async () => {
+    vi.spyOn(globalThis, 'fetch').mockResolvedValue(
+      new Response(new Uint8Array([1, 2, 3]), {
+        status: 200,
+        headers: {
+          'Content-Type': 'image/png',
+        },
+      }),
+    );
+
+    const response = await readAssetBytes('/generated-editor-images/image.png', {
+      objectKey: 'generated-editor-images/project/image.png',
+      expireSeconds: 300,
+    });
+    const bytes = new Uint8Array(await response.arrayBuffer());
+
+    expect(Array.from(bytes)).toEqual([1, 2, 3]);
+    expect(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[0])).toContain(
+      '/api/assets/read-bytes?',
+    );
+    expect(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[0])).toContain(
+      'objectKey=generated-editor-images%2Fproject%2Fimage.png',
+    );
+    expect(String(vi.mocked(globalThis.fetch).mock.calls[0]?.[0])).not.toContain(
+      'legacyPublicPath=',
+    );
+  });
+
   test('readAssetBytes normalizes full OSS generated urls through bytes endpoint', async () => {
     vi.spyOn(globalThis, 'fetch').mockResolvedValue(
       new Response(new Uint8Array([1, 2, 3]), {

src/services/assetReadUrlService.ts

@@ -31,6 +31,7 @@ type AssetReadUrlResolveOptions = {
 type AssetReadBytesOptions = {
   signal?: AbortSignal;
   expireSeconds?: number;
+  objectKey?: string | null;
 };
 
 export type AssetReadUrlResponse = {
@@ -534,21 +535,23 @@ export async function readAssetBytes(
     throw new Error('资源路径不能为空');
   }
 
+  const objectKey = options.objectKey?.trim().replace(/^\/+/u, '') ?? '';
   const legacyPath = isGeneratedLegacyPath(value)
     ? value
     : resolveGeneratedLegacyPathFromUrl(value);
 
-  if (!legacyPath) {
+  if (!objectKey && !legacyPath) {
     const response = await fetch(value, { signal: options.signal });
     if (!response.ok) {
-      throw new Error('读取资源内容失败');
+      throw new Error(`读取资源内容失败(HTTP ${response.status})`);
     }
     return response;
   }
 
   // 中文注释：这里要拿图片字节转 Data URL，不能直接 fetch OSS 签名 URL，否则浏览器会受 bucket CORS 限制。
   const searchParams = buildAssetReadSearchParams({
-    legacyPublicPath: legacyPath,
+    objectKey,
+    legacyPublicPath: objectKey ? undefined : legacyPath,
     expireSeconds: options.expireSeconds,
   });
   const response = await fetchWithApiAuth(