13262a5698
新增功能： - 新增 Sora 账号管理和 OAuth 认证 - 新增 Sora 视频/图片生成 API 网关 - 新增 Sora 任务调度和缓存机制 - 新增 Sora 使用统计和计费支持 - 前端增加 Sora 平台配置界面 安全修复（代码审核）： - [SEC-001] 限制媒体下载响应体大小（图片 20MB、视频 200MB），防止 DoS 攻击 - [SEC-002] 限制 SDK API 响应大小（1MB），防止内存耗尽 - [SEC-003] 修复 SSRF 风险，添加 URL 验证并强制使用代理配置 BUG 修复（代码审核）： - [BUG-001] 修复 for 循环内 defer 累积导致的资源泄漏 - [BUG-002] 修复图片并发槽位获取失败时已持有锁未释放的永久泄漏 性能优化（代码审核）： - [PERF-001] 添加 Sentinel Token 缓存（3 分钟有效期），减少 PoW 计算开销 技术细节： - 使用 io.LimitReader 限制所有外部输入的大小 - 添加 urlvalidator 验证防止 SSRF 攻击 - 使用 sync.Map 实现线程安全的包级缓存 - 优化并发槽位管理，添加 releaseAll 模式防止泄漏 影响范围： - 后端：新增 Sora 相关数据模型、服务、网关和管理接口 - 前端：新增 Sora 平台配置、账号管理和监控界面 - 配置：新增 Sora 相关配置项和环境变量 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
99 lines
3.0 KiB
Go
99 lines
3.0 KiB
Go
package server
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
"path/filepath"
|
|
"strings"
|
|
|
|
"github.com/Wei-Shaw/sub2api/internal/config"
|
|
"github.com/Wei-Shaw/sub2api/internal/handler"
|
|
middleware2 "github.com/Wei-Shaw/sub2api/internal/server/middleware"
|
|
"github.com/Wei-Shaw/sub2api/internal/server/routes"
|
|
"github.com/Wei-Shaw/sub2api/internal/service"
|
|
"github.com/Wei-Shaw/sub2api/internal/web"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/redis/go-redis/v9"
|
|
)
|
|
|
|
// SetupRouter 配置路由器中间件和路由
|
|
func SetupRouter(
|
|
r *gin.Engine,
|
|
handlers *handler.Handlers,
|
|
jwtAuth middleware2.JWTAuthMiddleware,
|
|
adminAuth middleware2.AdminAuthMiddleware,
|
|
apiKeyAuth middleware2.APIKeyAuthMiddleware,
|
|
apiKeyService *service.APIKeyService,
|
|
subscriptionService *service.SubscriptionService,
|
|
opsService *service.OpsService,
|
|
settingService *service.SettingService,
|
|
cfg *config.Config,
|
|
redisClient *redis.Client,
|
|
) *gin.Engine {
|
|
// 应用中间件
|
|
r.Use(middleware2.Logger())
|
|
r.Use(middleware2.CORS(cfg.CORS))
|
|
r.Use(middleware2.SecurityHeaders(cfg.Security.CSP))
|
|
|
|
// Serve embedded frontend with settings injection if available
|
|
if web.HasEmbeddedFrontend() {
|
|
frontendServer, err := web.NewFrontendServer(settingService)
|
|
if err != nil {
|
|
log.Printf("Warning: Failed to create frontend server with settings injection: %v, using legacy mode", err)
|
|
r.Use(web.ServeEmbeddedFrontend())
|
|
} else {
|
|
// Register cache invalidation callback
|
|
settingService.SetOnUpdateCallback(frontendServer.InvalidateCache)
|
|
r.Use(frontendServer.Middleware())
|
|
}
|
|
}
|
|
|
|
// Serve Sora cached videos when enabled
|
|
cacheVideoDir := ""
|
|
cacheEnabled := false
|
|
if settingService != nil {
|
|
soraCfg := settingService.GetSoraConfig(context.Background())
|
|
cacheEnabled = soraCfg.Cache.Enabled
|
|
cacheVideoDir = strings.TrimSpace(soraCfg.Cache.VideoDir)
|
|
} else if cfg != nil {
|
|
cacheEnabled = cfg.Sora.Cache.Enabled
|
|
cacheVideoDir = strings.TrimSpace(cfg.Sora.Cache.VideoDir)
|
|
}
|
|
if cacheEnabled && cacheVideoDir != "" {
|
|
videoDir := filepath.Clean(cacheVideoDir)
|
|
r.Static("/data/video", videoDir)
|
|
}
|
|
|
|
// 注册路由
|
|
registerRoutes(r, handlers, jwtAuth, adminAuth, apiKeyAuth, apiKeyService, subscriptionService, opsService, cfg, redisClient)
|
|
|
|
return r
|
|
}
|
|
|
|
// registerRoutes 注册所有 HTTP 路由
|
|
func registerRoutes(
|
|
r *gin.Engine,
|
|
h *handler.Handlers,
|
|
jwtAuth middleware2.JWTAuthMiddleware,
|
|
adminAuth middleware2.AdminAuthMiddleware,
|
|
apiKeyAuth middleware2.APIKeyAuthMiddleware,
|
|
apiKeyService *service.APIKeyService,
|
|
subscriptionService *service.SubscriptionService,
|
|
opsService *service.OpsService,
|
|
cfg *config.Config,
|
|
redisClient *redis.Client,
|
|
) {
|
|
// 通用路由（健康检查、状态等）
|
|
routes.RegisterCommonRoutes(r)
|
|
|
|
// API v1
|
|
v1 := r.Group("/api/v1")
|
|
|
|
// 注册各模块路由
|
|
routes.RegisterAuthRoutes(v1, h, jwtAuth, redisClient)
|
|
routes.RegisterUserRoutes(v1, h, jwtAuth)
|
|
routes.RegisterAdminRoutes(v1, h, adminAuth)
|
|
routes.RegisterGatewayRoutes(r, h, apiKeyAuth, apiKeyService, subscriptionService, opsService, cfg)
|
|
}
|