From cf70fb1b4e62d28e911d474a40326526c1c17a3e Mon Sep 17 00:00:00 2001
From: QTom <qt@truesightai.com>
Date: Thu, 2 Apr 2026 20:44:22 +0800
Subject: [PATCH] =?UTF-8?q?fix(openai):=20Mobile=20RT=20=E8=B4=A6=E5=8F=B7?=
 =?UTF-8?q?=E9=9A=90=E7=A7=81=E8=AE=BE=E7=BD=AE=E5=A4=B1=E8=B4=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. CreateAccount 补齐 OpenAI OAuth 隐私入口（与 BatchCreate 对齐）
2. disableOpenAITraining 请求头修正：覆盖 ImpersonateChrome() 的
   浏览器导航默认头（accept: text/html, sec-fetch-mode: navigate），
   改为 API 请求语义（Accept: application/json, sec-fetch-mode: cors），
   避免 Cloudflare 将 PATCH API 请求误判为异常导航流量而拦截

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 backend/internal/service/admin_service.go     | 31 +++++++++++++------
 .../service/openai_privacy_service.go         |  4 +++
 2 files changed, 26 insertions(+), 9 deletions(-)

diff --git a/backend/internal/service/admin_service.go b/backend/internal/service/admin_service.go
index 0620d7ca..ee7e1895 100644
--- a/backend/internal/service/admin_service.go
+++ b/backend/internal/service/admin_service.go
@@ -1642,16 +1642,29 @@ func (s *adminServiceImpl) CreateAccount(ctx context.Context, input *CreateAccou
 		}
 	}
 
-	// Antigravity OAuth 账号：创建后异步设置隐私
-	if account.Platform == PlatformAntigravity && account.Type == AccountTypeOAuth {
-		go func() {
-			defer func() {
-				if r := recover(); r != nil {
-					slog.Error("create_account_antigravity_privacy_panic", "account_id", account.ID, "recover", r)
-				}
+	// OAuth 账号：创建后异步设置隐私。
+	// 使用 Ensure（幂等）而非 Force：新建账号 Extra 为空时效果相同，但更安全。
+	if account.Type == AccountTypeOAuth {
+		switch account.Platform {
+		case PlatformOpenAI:
+			go func() {
+				defer func() {
+					if r := recover(); r != nil {
+						slog.Error("create_account_openai_privacy_panic", "account_id", account.ID, "recover", r)
+					}
+				}()
+				s.EnsureOpenAIPrivacy(context.Background(), account)
 			}()
-			s.EnsureAntigravityPrivacy(context.Background(), account)
-		}()
+		case PlatformAntigravity:
+			go func() {
+				defer func() {
+					if r := recover(); r != nil {
+						slog.Error("create_account_antigravity_privacy_panic", "account_id", account.ID, "recover", r)
+					}
+				}()
+				s.EnsureAntigravityPrivacy(context.Background(), account)
+			}()
+		}
 	}
 
 	return account, nil
diff --git a/backend/internal/service/openai_privacy_service.go b/backend/internal/service/openai_privacy_service.go
index 6bc71ab9..b34c1da2 100644
--- a/backend/internal/service/openai_privacy_service.go
+++ b/backend/internal/service/openai_privacy_service.go
@@ -56,6 +56,10 @@ func disableOpenAITraining(ctx context.Context, clientFactory PrivacyClientFacto
 		SetHeader("Authorization", "Bearer "+accessToken).
 		SetHeader("Origin", "https://chatgpt.com").
 		SetHeader("Referer", "https://chatgpt.com/").
+		SetHeader("Accept", "application/json").
+		SetHeader("sec-fetch-mode", "cors").
+		SetHeader("sec-fetch-site", "same-origin").
+		SetHeader("sec-fetch-dest", "empty").
 		SetQueryParam("feature", "training_allowed").
 		SetQueryParam("value", "false").
 		Patch(openAISettingsURL)