GenarrativeAI/Genarrative
11
0
Fork 0
Code Issues 15 Pull Requests 3 Actions Packages Projects 3 Releases Wiki Activity

AGC对主站的请求添加header #241

Merged
kdletters merged 13 commits from feat/agc_call_header into master 2026-09-02 14:39:02 +08:00
Conversation 3 Commits 13 Files Changed 21
+2911 -173
lhk229 commented 2026-09-02 10:51:05 +08:00
Owner
Copy Link
Copy Source
No description provided.
lhk229 added 5 commits 2026-09-02 10:51:05 +08:00
补充Issue226客户端标记阶段0方案与验收文档 a2896a28a9 
新增AGC客户端主站调用扫描清单

新增主站请求标记两种注入方案对比

新增Issue226实施方案与分阶段验收计划

新增阶段0现状基线与契约冻结验收记录

冻结X-Genarrative-Client标记及#225交接metadata约定
实现Issue226阶段1客户端请求统一标记 8c0af3d8b8 
在fetchClientHttp统一注入X-Genarrative-Client标记

补充Web与Tauri HTTP transport及主站路径定向测试

保留Authorization、响应包络和X-Request-ID等原有Header

同步更新Issue226阶段1实施状态与验收记录
Merge branch 'master' into feat/agc_call_header 1e435190d7
阶段2：新增主站 Client Builder 工厂及验收测试 d78338a9d8 
新增 AGC 主站专用 reqwest Client Builder 工厂。

通过 default_headers 统一注入 X-Genarrative-Client: agc。

保留调用方对 timeout、connect timeout、redirect 和 no_proxy 的配置能力。

验证请求级 Authorization 和 Idempotency-Key 继续生效。

更新 Issue 226 实施方案与分阶段验收计划，明确阶段 3 才迁移业务 Client 创建点。
阶段3：迁移主站请求 Client 并补充边界验收
Project CI / Frontend tests (pull_request) Successful in 5m24s
Details
Project CI / Repository checks (pull_request) Successful in 5m41s
Details
Project CI / Backend tests (pull_request) Successful in 8m52s
Details
Project CI / Native shell tests (pull_request) Failing after 17m16s
Details
221b15064f 
将生产 Rust 主站请求 Client 创建点切换到统一 factory。

覆盖账号态和开发者 Key 态的项目、素材、上传确认、生成、编辑、轮询及换签请求。

保留签名 URL 下载、OSS 上传、Provider、搜索、loopback 和更新下载的独立 Client 边界。

增加画板同步请求捕获测试，验证主站请求带标记且签名媒体下载不带标记。

更新 Issue 226 阶段实施方案与验收计划，明确阶段 3 完成、阶段 4 待开始。
lhk229 added a new dependency 2026-09-02 11:09:21 +08:00
#226 添加客户端特殊标识
lhk229 added 2 commits 2026-09-02 11:12:20 +08:00
Merge remote-tracking branch 'origin/master' into feat/agc_call_header dce703b221
阶段4：隔离第三方请求并补充负向验收
Project CI / Repository checks (pull_request) Successful in 2m59s
Details
Project CI / Frontend tests (pull_request) Successful in 2m50s
Details
Project CI / Backend tests (pull_request) Successful in 6m45s
Details
Project CI / Native shell tests (pull_request) Failing after 17m25s
Details
f9ce08ab2b 
保持 OSS、签名下载、Provider、搜索、loopback 和更新下载使用独立 Client。

为搜索、loopback 和更新下载提取独立构造点，保留原有 no_proxy、timeout 和 redirect 配置。

新增 OSS/签名传输、搜索、loopback 和更新下载的无标记请求捕获测试。

为 Codex Provider 代理转发增加无主站标记断言。

更新 Issue 226 阶段方案与验收计划，记录阶段 4 完成。
lhk229 added 3 commits 2026-09-02 11:48:42 +08:00
阶段5：完成账号态与 External 态语义回归 b4fc28fbbb 
新增账号态主站路径、标记、Bearer、幂等键和异步轮询回归断言。

新增 External Key 态自定义 apiBaseUrl 与 External v1 路径请求捕获测试。

锁定 generationInputs.source、单次提交和结果未知不重试语义。

更新 Issue 226 实施方案与分阶段验收计划，记录阶段 5 完成。
Merge remote-tracking branch 'origin/master' into feat/agc_call_header 8059bbcb54
阶段6：完成Issue226交接与最终门禁
Project CI / Repository checks (pull_request) Has been cancelled
Details
Project CI / Frontend tests (pull_request) Has been cancelled
Details
Project CI / Backend tests (pull_request) Has been cancelled
Details
Project CI / Native shell tests (pull_request) Has been cancelled
Details
b1dbe4f57e 
补充交给Issue225的Header、tracking metadata和认证主体交接契约

新增阶段6验收记录并汇总TS、Rust、正负向及幂等回归结果

更新Issue226实施方案与分阶段计划为已完成并记录发布环境限制
lhk229 added 1 commit 2026-09-02 11:49:47 +08:00
Merge remote-tracking branch 'origin/master' into feat/agc_call_header
Project CI / Repository checks (pull_request) Successful in 3m15s
Details
Project CI / Frontend tests (pull_request) Successful in 3m34s
Details
Project CI / Backend tests (pull_request) Successful in 7m14s
Details
Project CI / Native shell tests (pull_request) Successful in 15m19s
Details
62771c1650
kdletters requested changes 2026-09-02 12:03:44 +08:00
kdletters left a comment
Member
Copy Link
Copy Source

审查 head sha: 62771c1650

发现 1 个明确问题，阻塞合并：AGC marker 会随重定向泄漏到非主站 origin。

审查 head sha: 62771c1650dff859148fa6c37f02fa31276a94c3 发现 1 个明确问题，阻塞合并：AGC marker 会随重定向泄漏到非主站 origin。
apps/ai-game-creator-shell/src-tauri/src/http_client.rs
kdletters commented 2026-09-02 12:03:44 +08:00
Member
Copy Link
Copy Source

问题：这个工厂只设置了 default_headers，没有设置 redirect(Policy::none())，但它在生成/轮询等多个主站客户端中使用；reqwest 默认会跟随重定向。若主站或可控部署返回跨 origin 的 3xx，默认请求头会被复制到重定向请求，导致 X-Genarrative-Client: agc 发送给 OSS/第三方 origin，违反本 PR 约定的“只发当前主站 origin”。风险是来源标记泄漏并污染第三方请求统计。建议在工厂统一禁用重定向，或实现只允许同 origin 的 redirect policy，并补充跨 origin redirect 的请求捕获测试。

问题：这个工厂只设置了 `default_headers`，没有设置 `redirect(Policy::none())`，但它在生成/轮询等多个主站客户端中使用；reqwest 默认会跟随重定向。若主站或可控部署返回跨 origin 的 3xx，默认请求头会被复制到重定向请求，导致 `X-Genarrative-Client: agc` 发送给 OSS/第三方 origin，违反本 PR 约定的“只发当前主站 origin”。风险是来源标记泄漏并污染第三方请求统计。建议在工厂统一禁用重定向，或实现只允许同 origin 的 redirect policy，并补充跨 origin redirect 的请求捕获测试。
lhk229 marked this conversation as resolved
lhk229 commented 2026-09-02 12:20:12 +08:00
Author
Owner
Copy Link
Copy Source

AGC 主站 Client 只允许同 origin 重定向；跨 origin 3xx 不会由客户端继续请求，因此 X-Genarrative-Client: agc 不会被客户端发送到 OSS 或第三方 origin。

AGC 主站 Client 只允许同 origin 重定向；跨 origin 3xx 不会由客户端继续请求，因此 X-Genarrative-Client: agc 不会被客户端发送到 OSS 或第三方 origin。
lhk229 commented 2026-09-02 12:20:20 +08:00
Author
Owner
Copy Link
Copy Source

主站 Client 创建点不得覆盖为允许跨 origin 的 redirect policy；如未来需要类型级不可绕过，再迁移到 AgcMainSiteClient wrapper。

主站 Client 创建点不得覆盖为允许跨 origin 的 redirect policy；如未来需要类型级不可绕过，再迁移到 AgcMainSiteClient wrapper。
lhk229 added 2 commits 2026-09-02 13:34:46 +08:00
修复AGC主站跨Origin重定向标记泄漏 fa448bba59 
主站 Client factory 默认仅跟随同 origin 重定向

跨 origin 3xx 直接停止，避免 AGC 标记发送到 OSS 或第三方

新增同源、跨源、链式重定向和显式 Policy::none() 定向测试

同步 Issue226 实施方案、验收记录和复审修复文档
修复AGC主站同名标记覆盖
Project CI / Repository checks (pull_request) Successful in 3m34s
Details
Project CI / Frontend tests (pull_request) Successful in 3m49s
Details
Project CI / Backend tests (pull_request) Successful in 7m48s
Details
Project CI / Native shell tests (pull_request) Successful in 15m47s
Details
658f8958df 
增加统一请求终结器，覆盖调用方传入的同名客户端标记

补齐账号态、External Key态、生成轮询和资源编辑主站请求

保持OSS、签名下载、Provider、搜索、loopback和更新下载边界不变

补充同名Header覆盖回归测试并同步Issue226方案与验收文档
lhk229 marked the pull request as ready for review 2026-09-02 14:08:16 +08:00
lhk229 requested review from kdletters 2026-09-02 14:08:21 +08:00
kdletters merged commit 65d7a57eb7 into master 2026-09-02 14:39:02 +08:00
kdletters deleted branch feat/agc_call_header 2026-09-02 14:39:02 +08:00
Sign in to join this conversation.
Reviewers
No Reviewers
kdletters
Labels
Clear labels
Compat/Breaking
Breaking change that won't be backward compatible
 Kind/Bug
Something is not working
 Kind/Documentation
Documentation changes
 Kind/Enhancement
Improve existing functionality
 Kind/Feature
New functionality
 Kind/Security
This is security issue
 Kind/Testing
Issue or pull request related to testing
Priority
Critical
1
The priority is critical
Priority
High
2
The priority is high
Priority
Low
4
The priority is low
Priority
Medium
3
The priority is medium
Reviewed
Confirmed
1
Issue has been confirmed
Reviewed
Duplicate
2
This issue or pull request already exists
Reviewed
Invalid
3
Invalid issue
Reviewed
Won't Fix
3
This issue won't be fixed
Status
Abandoned
3
Somebody has started to work on this but abandoned work
Status
Blocked
1
Something is blocking this issue or pull request
Status
Need More Info
2
Feedback is required to reproduce issue or to continue work
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
HuangJiaJia JenkenB k88936 (王德宇) kdletters (段舒康) laura2008 (王乐) lhk229 (孔令弘) Loer (农洛儿) loong suzmii (董羽秦) taobaisu (叶东旭) wuxiangwanzi (王子民) YixuanLiu ziyu
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Blocks
#226 添加客户端特殊标识
GenarrativeAI/Genarrative
Reference: GenarrativeAI/Genarrative#241
Delete Branch "feat/agc_call_header"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?