GenarrativeAI/Genarrative
11
0
Fork 0
Code Issues 39 Pull Requests 11 Actions Packages Projects 1 Releases Wiki Activity

Merge remote-tracking branch 'origin/master' into feat/game-fork
Project CI / Backend tests (pull_request) Failing after 34s
Details
Project CI / AI game creator shell Rust lane 1/2 (pull_request) Successful in 7m27s
Details
Project CI / Native shell tests (pull_request) Failing after 2m46s
Details
Project CI / AI game creator shell Rust lane 2/2 (pull_request) Successful in 5m58s
Details
Project CI / AI game creator shell Rust crates (pull_request) Successful in 4m23s
Details
Project CI / AI game creator shell web tests (pull_request) Failing after 45s
Details
Project CI / Frontend tests (pull_request) Successful in 2m24s
Details
Project CI / Repository checks (pull_request) Failing after 1m1s
Details

Browse Source 
# Conflicts:
#	apps/ai-game-creator-shell/src-tauri/src/game_distribution_publish.rs
#	apps/ai-game-creator-shell/src/components/game-distribution/GameDistributionPublishPanel.tsx
#	apps/ai-game-creator-shell/tests/gameDistributionPublishPanel.test.tsx
#	docs/【后端架构】server-rs与SpacetimeDB数据契约-2026-05-15.md
#	package.json
#	packages/shared/src/contracts/gameDistribution.ts
#	scripts/check-game-distribution-dto-parity.mjs
#	server-rs/crates/api-server/src/modules/game_distribution.rs
#	server-rs/crates/module-game-distribution/src/errors.rs
#	server-rs/crates/module-game-distribution/src/lib.rs
#	server-rs/crates/shared-contracts/src/game_distribution.rs
#	server-rs/crates/spacetime-client/src/active.rs
#	server-rs/crates/spacetime-client/src/active/mapper.rs
#	server-rs/crates/spacetime-client/src/active/mapper/game_distribution.rs
#	server-rs/crates/spacetime-client/src/game_distribution.rs
#	server-rs/crates/spacetime-client/src/module_bindings.rs
#	server-rs/crates/spacetime-client/src/module_bindings/game_distribution_game_snapshot_type.rs
#	server-rs/crates/spacetime-client/src/module_bindings/game_distribution_game_type.rs
#	server-rs/crates/spacetime-module/src/game_distribution.rs
#	server-rs/crates/spacetime-module/src/migration.rs
#	src/components/game-distribution/GameDetailPage.tsx
#	src/components/game-distribution/GameDistributionPages.test.tsx
#	src/components/game-distribution/GamePlayPage.tsx
#	src/components/platform-entry/PlatformEntryActiveFlowShell.tsx
#	src/services/gameDistributionClient.test.ts
#	src/services/gameDistributionClient.ts
This commit is contained in:
董羽秦
2026-10-06 16:10:52 +08:00
parent 6cea0a8cd9 9f4c7d7639
commit eeb101458a
314 changed files with 13094 additions and 2427 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/container/nginx.conf
+26
View File
@@ -88,6 +88,32 @@ http {
}
# 平台付费游戏播放会话入口：`/api/game-distribution/play-sessions/<token>/…` 是 sandbox iframe
# 的 src，包内相对资源沿同一前缀解析。它与通用 `/api` 同口径代理到 api-server，唯一差别是
# 清空 Cookie：播放会话不读账号凭证，而 api-server 播放网关对带平台 refresh Cookie 的请求返回 403。
# 前缀 location 必须写 `^~`：不加时正则 location `~ ^/api(?:/|$)` 会先命中，Cookie 又会被转发。
location ^~ /api/game-distribution/play-sessions/ {
default_type application/json;
client_max_body_size 210m;
limit_conn genarrative_api_conn 64;
limit_req zone=genarrative_api_rps burst=64 nodelay;
proxy_pass http://genarrative_api;
proxy_http_version 1.1;
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
add_header X-Accel-Buffering no always;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Request-Id $request_id;
proxy_set_header Cookie "";
}
location ~ ^/api(?:/|$) {
default_type application/json;
# 中文注释：创作接口会携带参考图 Data URL，游戏发行包 PUT 更大，Nginx 只负责放行到 api-server；
deploy/nginx/README.md
+8
View File
@@ -110,3 +110,11 @@ curl -sSI -H 'Accept-Encoding: br' \
- 隔离靠 iframe 沙箱而不是独立来源：游戏文档跑在 `sandbox="allow-scripts"` 的不透明来源里，读不到主站 Cookie、storage 与 DOM，离开页面即随 iframe 卸载。
- 审核通过时 `api-server` 按 gameId 派生同源路径 `/games/<gameId>/` 作为 `entryUrl` 写入公开投影，部署侧不再需要配置发行域名。换版本或下架只改变后端公开投影，边缘不需要改配置。
- 门禁：`npm run check:nginx-spa-routes` 校验三份模板的 SPA allowlist（含 `/creators`、`/creators/connections`、`/games`、`/games/detail`、`/games/play`、`/games/mine`、`/games/publish`、`/pay`、`/profile/payment`）与收银台深链前缀路由 `location ~* "^/pay/[^/]+/?$"`（`/pay/<checkoutToken>` 只放行「前缀 + 恰好一个路径段」；只放行裸前缀会让真实收银台链接落到默认 location 变 404），脚本自带正/反用例。历史上的独立来源模板与专属门禁已随同源方案上线删除。
## 付费游戏播放会话前缀（`/api/game-distribution/play-sessions/`）
- 付费游戏的可玩入口是 `POST /api/game-distribution/games/<gameId>/play-session` 换到的 `/api/game-distribution/play-sessions/<token>/`，直接作为 sandbox iframe 的 `src`；包内相对资源沿同一前缀解析。该前缀落在 `/api/*` 上，而通用 `/api` location 必须转发 Cookie（`/api/auth/*` 依赖 refresh cookie），Cookie 一旦被转发到 `api-server` 播放网关就会命中它的 403 纵深防御，iframe 与包内每个资源都不可用。
- 因此三份常驻模板（`genarrative.conf`、`genarrative-dev-http.conf`、容器 `deploy/container/nginx.conf`）都在通用 `/api` location 之前内联 `location ^~ /api/game-distribution/play-sessions/`，代理头、`client_max_body_size 210m`、`limit_conn` / `limit_req`、超时与维护判断都与通用 `/api` location 一致，只多一条 `proxy_set_header Cookie ""`。
- `^~` 不能省：不加时 nginx 会先命中正则 location `~ ^/api(?:/|$)`，Cookie 又被转发回去。前缀末尾的斜杠只影响裸前缀 `/api/game-distribution/play-sessions`（无 token）：该形态继续走通用 `/api`，而 api-server 在这个前缀下只注册了 GET 入口与包内资源，创建会话是 `POST /api/game-distribution/games/<gameId>/play-session`，不在此前缀下，因此不存在「带账号凭证却落在清 Cookie 前缀里」的请求；`/play-sessions/<token>` 与 `/play-sessions/<token>/…` 都落在该前缀内、都会被清 Cookie。
- 本地 dev 由 `vite.config.ts` 里排在 `/api/game-distribution` 之前的同名前缀规则做同一件事（`proxyReq.removeHeader('cookie')`）；`api-server` 播放网关的 403 纵深防御不放宽，只保证边缘/dev 转发时不带 Cookie。
- 门禁：`npm run check:nginx-spa-routes` 对三份模板断言该 `^~` 前缀 location 存在、清空 Cookie、代理头齐全且排在通用 `/api` location 之前；`npm run check:pingora-route-parity` 断言矩阵里的 `play_sessions_gateway` 用例（以及 Pingora 的 `RouteDecision::PlaySessionGateway`）指向独立的清 Cookie 转发，不会被合并回通用 `/api` 规则。
deploy/nginx/genarrative-dev-http.conf
+34
View File
@@ -116,6 +116,40 @@ server {
}
# 平台付费游戏播放会话入口：`/api/game-distribution/play-sessions/<token>/…` 是 sandbox iframe
# 的 src，包内相对资源沿同一前缀解析。它与通用 `/api` 同口径代理到 api-server（大小上限、
# 限流、超时、维护判断都保持一致），唯一差别是清空 Cookie：播放会话不读账号凭证，而
# api-server 播放网关对带平台 refresh Cookie 的请求返回 403（纵深防御保留）。
# 前缀 location 必须写 `^~`：不加时正则 location `~ ^/api(?:/|$)` 会先命中，Cookie 又会被转发。
# 只匹配带尾斜杠的前缀：`/play-sessions/<token>` 与 `/play-sessions/<token>/…` 都落在该前缀内，
# 裸 `/api/game-distribution/play-sessions` 仍走通用 `/api`。该前缀下 api-server 只注册 GET
# 入口与包内资源；创建会话是 `POST /api/game-distribution/games/<gameId>/play-session`，不在此前缀下。
location ^~ /api/game-distribution/play-sessions/ {
default_type application/json;
client_max_body_size 210m;
limit_conn genarrative_api_conn 64;
limit_req zone=genarrative_api_rps burst=64 nodelay;
if ($genarrative_maintenance) {
return 503 '{"ok":false,"error":{"code":"MAINTENANCE","message":"服务维护中"}}';
}
proxy_pass http://genarrative_api;
proxy_http_version 1.1;
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
add_header X-Accel-Buffering no always;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Request-Id $request_id;
proxy_set_header Cookie "";
}
# 临时兼容主站仍在使用的 /api/* HTTP facade；前端完成 SpacetimeDB SDK 迁移后删除。
location ~ ^/api(?:/|$) {
default_type application/json;
deploy/nginx/genarrative.conf
+34
View File
@@ -144,6 +144,40 @@ server {
include /etc/nginx/snippets/genarrative-host-extras.conf;
# 平台付费游戏播放会话入口：`/api/game-distribution/play-sessions/<token>/…` 是 sandbox iframe
# 的 src，包内相对资源沿同一前缀解析。它与通用 `/api` 同口径代理到 api-server（大小上限、
# 限流、超时、维护判断都保持一致），唯一差别是清空 Cookie：播放会话不读账号凭证，而
# api-server 播放网关对带平台 refresh Cookie 的请求返回 403（纵深防御保留）。
# 前缀 location 必须写 `^~`：不加时正则 location `~ ^/api(?:/|$)` 会先命中，Cookie 又会被转发。
# 只匹配带尾斜杠的前缀：`/play-sessions/<token>` 与 `/play-sessions/<token>/…` 都落在该前缀内，
# 裸 `/api/game-distribution/play-sessions` 仍走通用 `/api`。该前缀下 api-server 只注册 GET
# 入口与包内资源；创建会话是 `POST /api/game-distribution/games/<gameId>/play-session`，不在此前缀下。
location ^~ /api/game-distribution/play-sessions/ {
default_type application/json;
client_max_body_size 210m;
limit_conn genarrative_api_conn 64;
limit_req zone=genarrative_api_rps burst=64 nodelay;
if ($genarrative_maintenance) {
return 503 '{"ok":false,"error":{"code":"MAINTENANCE","message":"服务维护中"}}';
}
proxy_pass http://genarrative_api;
proxy_http_version 1.1;
proxy_buffering off;
proxy_read_timeout 3600s;
proxy_send_timeout 3600s;
add_header X-Accel-Buffering no always;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Request-Id $request_id;
proxy_set_header Cookie "";
}
# 临时兼容主站仍在使用的 /api/* HTTP facade；前端完成 SpacetimeDB SDK 迁移后删除。
location ~ ^/api(?:/|$) {
default_type application/json;
deploy/pingora/nginx-route-parity.matrix.json
+21
View File
@@ -366,6 +366,27 @@
},
"docs": ["/games/game_<32 位十六进制 id>/…", "平台同源发行入口"]
},
{
"id": "play_sessions_gateway",
"samplePath": "/api/game-distribution/play-sessions/token_1/index.html",
"expect": {
"kind": "play_session_gateway",
"protectionClass": "api"
},
"nginx": {
"production": [
"location ^~ /api/game-distribution/play-sessions/",
"proxy_set_header Cookie \"\";",
"proxy_pass http://genarrative_api;"
],
"development": [
"location ^~ /api/game-distribution/play-sessions/",
"proxy_set_header Cookie \"\";",
"proxy_pass http://genarrative_api;"
]
},
"docs": ["平台付费游戏播放会话入口", "/api/game-distribution/play-sessions/<token>/…"]
},
{
"id": "web_spa_case_trailing_slash",
"samplePath": "/PROJECT/",