From b021ffbc08c082491f60f29251495acd45f0aa8c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E7=8E=8B=E5=BE=B7=E5=AE=87?= <kvtodev@outlook.com>
Date: Wed, 15 Jul 2026 18:15:29 +0800
Subject: [PATCH] validate editor agent message request

---
 .../crates/api-server/src/editor_agent/api.rs | 57 ++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/server-rs/crates/api-server/src/editor_agent/api.rs b/server-rs/crates/api-server/src/editor_agent/api.rs
index d7aa6724f..25d122955 100644
--- a/server-rs/crates/api-server/src/editor_agent/api.rs
+++ b/server-rs/crates/api-server/src/editor_agent/api.rs
@@ -2,7 +2,7 @@ use axum::extract::{Path, State};
 use axum::{Extension, Json};
 use module_editor_agent::{
     EDITOR_AGENT_CONVERSATION_ID_PREFIX, EDITOR_AGENT_DEFAULT_CONVERSATION_TITLE,
-    derive_conversation_title, editor_agent_messages_object_key,
+    derive_conversation_title, editor_agent_messages_object_key, validate_user_message,
 };
 use platform_editor_agent::framework::agent_builder::AgentBuilder;
 use platform_editor_agent::framework::error::PromptError;
@@ -85,6 +85,7 @@ pub async fn editor_agent_message(
 ) -> Result<Json<EditorAgentMessageResponse>, AppError> {
     let owner_user_id = authenticated.claims().user_id().to_string();
     require_editor_agent_sidebar_enabled(&state, owner_user_id.as_str()).await?;
+    validate_editor_agent_message_request(&payload)?;
     // Load conversation & attachments
     let conversation = state
         .spacetime_client()
@@ -238,6 +239,60 @@ pub async fn editor_agent_message(
         }
     }
 }
+
+fn validate_editor_agent_message_request(
+    payload: &EditorAgentMessageRequest,
+) -> Result<(), AppError> {
+    let attachment_reference_ids = payload
+        .attachments
+        .iter()
+        .map(|attachment| attachment.reference_id.clone())
+        .collect::<Vec<_>>();
+    validate_user_message(payload.text.as_str(), attachment_reference_ids.as_slice())
+        .map_err(|error| editor_agent_bad_request(error.to_string()))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use shared_contracts::editor_agent::{EditorAgentAttachmentRef, EditorAgentAttachmentSource};
+
+    fn attachment(reference_id: impl Into<String>) -> EditorAgentAttachmentRef {
+        EditorAgentAttachmentRef {
+            source: EditorAgentAttachmentSource::CanvasResource,
+            reference_id: reference_id.into(),
+            object_key: None,
+            image_src: "/generated/test.png".to_string(),
+            thumbnail_src: None,
+            label: None,
+            width: None,
+            height: None,
+        }
+    }
+
+    #[test]
+    fn validates_editor_agent_message_before_normalizing_attachments() {
+        let empty_payload = EditorAgentMessageRequest {
+            text: "   ".to_string(),
+            attachments: Vec::new(),
+        };
+        assert!(validate_editor_agent_message_request(&empty_payload).is_err());
+
+        let too_many_payload = EditorAgentMessageRequest {
+            text: "生成一张图".to_string(),
+            attachments: (0..10)
+                .map(|index| attachment(format!("res-{index}")))
+                .collect(),
+        };
+        assert!(validate_editor_agent_message_request(&too_many_payload).is_err());
+
+        let attachment_only_payload = EditorAgentMessageRequest {
+            text: String::new(),
+            attachments: vec![attachment("res-1")],
+        };
+        assert!(validate_editor_agent_message_request(&attachment_only_payload).is_ok());
+    }
+}
 fn editor_agent_system_prompt() -> &'static str {
     r#"
 你是 Genarrative 图片画布 Agent，只负责帮助用户理解、规划和触发画布生成工具。