kdletters
187d7735b9
将模型定价改为 SpacetimeDB 强类型持久化并兼容旧配置种子迁移 修复快速编辑支付弹窗期间框选显示和交互冻结 补齐后台图片放大以及视频音频资源预览 收紧主站和 External 资源换签授权并记录管理员跨用户审计 固化外部生成入队价格、attempt 钱包结算和最终 lease 失败收口 加固运行时身份轮换、bootstrap secret 与生产构建发布门禁 同步生成绑定、定向测试、运维脚本和项目文档
82 lines
2.6 KiB
Rust
82 lines
2.6 KiB
Rust
use axum::{
|
|
Json,
|
|
extract::{Extension, Query, State},
|
|
http::StatusCode,
|
|
};
|
|
use serde_json::{Value, json};
|
|
use shared_contracts::assets::{
|
|
ConfirmAssetObjectRequest, CreateDirectUploadTicketRequest, GetReadUrlQuery,
|
|
};
|
|
|
|
use crate::{
|
|
assets::{
|
|
AssetReadAuthorization, confirm_asset_object_for_owner,
|
|
create_direct_upload_ticket_for_owner, get_asset_read_url_with_query,
|
|
},
|
|
external_api_auth::ExternalApiPrincipal,
|
|
http_error::AppError,
|
|
request_context::RequestContext,
|
|
state::AppState,
|
|
};
|
|
|
|
const SCOPE_EDITOR_ASSET: &str = "editor:asset";
|
|
const EXTERNAL_ASSET_PROVIDER: &str = "external-assets-api";
|
|
|
|
pub async fn create_external_direct_upload_ticket(
|
|
State(state): State<AppState>,
|
|
Extension(request_context): Extension<RequestContext>,
|
|
Extension(principal): Extension<ExternalApiPrincipal>,
|
|
Json(payload): Json<CreateDirectUploadTicketRequest>,
|
|
) -> Result<Json<Value>, AppError> {
|
|
require_scope(&principal, SCOPE_EDITOR_ASSET)?;
|
|
create_direct_upload_ticket_for_owner(
|
|
&state,
|
|
&request_context,
|
|
principal.owner_user_id(),
|
|
payload,
|
|
)
|
|
.await
|
|
}
|
|
|
|
pub async fn confirm_external_asset_object(
|
|
State(state): State<AppState>,
|
|
Extension(request_context): Extension<RequestContext>,
|
|
Extension(principal): Extension<ExternalApiPrincipal>,
|
|
Json(mut payload): Json<ConfirmAssetObjectRequest>,
|
|
) -> Result<Json<Value>, AppError> {
|
|
require_scope(&principal, SCOPE_EDITOR_ASSET)?;
|
|
payload.owner_user_id = Some(principal.owner_user_id().to_string());
|
|
confirm_asset_object_for_owner(&state, &request_context, principal.owner_user_id(), payload)
|
|
.await
|
|
}
|
|
|
|
pub async fn get_external_asset_read_url(
|
|
State(state): State<AppState>,
|
|
Extension(request_context): Extension<RequestContext>,
|
|
Extension(principal): Extension<ExternalApiPrincipal>,
|
|
Query(query): Query<GetReadUrlQuery>,
|
|
) -> Result<Json<Value>, AppError> {
|
|
require_scope(&principal, SCOPE_EDITOR_ASSET)?;
|
|
get_asset_read_url_with_query(
|
|
&state,
|
|
&request_context,
|
|
query,
|
|
AssetReadAuthorization::Owner(principal.owner_user_id().to_string()),
|
|
)
|
|
.await
|
|
}
|
|
|
|
fn require_scope(principal: &ExternalApiPrincipal, scope: &str) -> Result<(), AppError> {
|
|
if principal.has_scope(scope) {
|
|
return Ok(());
|
|
}
|
|
Err(
|
|
AppError::from_status(StatusCode::FORBIDDEN).with_details(json!({
|
|
"provider": EXTERNAL_ASSET_PROVIDER,
|
|
"keyId": principal.key_id(),
|
|
"scope": scope,
|
|
"message": "API Key 缺少所需权限",
|
|
})),
|
|
)
|
|
}
|