门禁兼容修复

internal/app/app.go

@@ -41,6 +41,9 @@ func New(ctx context.Context, cfg config.Config) (*Application, error) {
 		if !cfg.SuperAgent.Enabled {
 			return nil, fmt.Errorf("initialize chat: SuperAgent must be enabled")
 		}
+		if cfg.Chat.AllowLegacyShortToken {
+			log.Printf("security warning: legacy short chat auth token compatibility is enabled")
+		}
 		superAgentClient, err := superagent.NewHTTPClient(superagent.Config{
 			Enabled:                cfg.SuperAgent.Enabled,
 			BaseURL:                cfg.SuperAgent.BaseURL,
@@ -67,11 +70,12 @@ func New(ctx context.Context, cfg config.Config) (*Application, error) {
 			return nil, fmt.Errorf("initialize chat service: %w", err)
 		}
 		chatHandler, err := handler.NewChatHandler(chatService, handler.ChatOptions{
-			AuthToken:      cfg.Chat.AuthToken,
-			AllowedOrigins: cfg.Chat.AllowedOrigins,
-			MaxBodyBytes:   cfg.Chat.MaxBodyBytes,
-			RunTimeout:     cfg.Chat.RunTimeout,
-			Logger:         log.Default(),
+			AuthToken:             cfg.Chat.AuthToken,
+			AllowLegacyShortToken: cfg.Chat.AllowLegacyShortToken,
+			AllowedOrigins:        cfg.Chat.AllowedOrigins,
+			MaxBodyBytes:          cfg.Chat.MaxBodyBytes,
+			RunTimeout:            cfg.Chat.RunTimeout,
+			Logger:                log.Default(),
 		})
 		if err != nil {
 			return nil, fmt.Errorf("initialize chat handler: %w", err)
@@ -79,12 +83,13 @@ func New(ctx context.Context, cfg config.Config) (*Application, error) {
 		routerOptions.Chat = chatHandler
 		if cfg.Chat.CompatAppID != "" {
 			dashScopeChatHandler, err := handler.NewDashScopeChatHandler(chatService, handler.DashScopeChatOptions{
-				AppID:          cfg.Chat.CompatAppID,
-				AuthToken:      cfg.Chat.AuthToken,
-				AllowedOrigins: cfg.Chat.AllowedOrigins,
-				MaxBodyBytes:   cfg.Chat.MaxBodyBytes,
-				RunTimeout:     cfg.Chat.RunTimeout,
-				Logger:         log.Default(),
+				AppID:                 cfg.Chat.CompatAppID,
+				AuthToken:             cfg.Chat.AuthToken,
+				AllowLegacyShortToken: cfg.Chat.AllowLegacyShortToken,
+				AllowedOrigins:        cfg.Chat.AllowedOrigins,
+				MaxBodyBytes:          cfg.Chat.MaxBodyBytes,
+				RunTimeout:            cfg.Chat.RunTimeout,
+				Logger:                log.Default(),
 			})
 			if err != nil {
 				return nil, fmt.Errorf("initialize DashScope-compatible chat handler: %w", err)

internal/app/app_test.go

@@ -1,8 +1,10 @@
 package app
 
 import (
+	"bytes"
 	"context"
 	"fmt"
+	"log"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -43,6 +45,11 @@ func TestNewKeepsExternalIntegrationsDisabledByDefault(t *testing.T) {
 }
 
 func TestNewWiresChatAPIToSuperAgent(t *testing.T) {
+	var applicationLogs bytes.Buffer
+	originalLogOutput := log.Writer()
+	log.SetOutput(&applicationLogs)
+	t.Cleanup(func() { log.SetOutput(originalLogOutput) })
+
 	provider := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.Header.Get("Authorization") != "Bearer provider-open-api-key" {
 			t.Errorf("provider Authorization = %q", r.Header.Get("Authorization"))
@@ -77,14 +84,15 @@ func TestNewWiresChatAPIToSuperAgent(t *testing.T) {
 			MaxMessageBytes:        4096,
 		},
 		Chat: config.ChatConfig{
-			Enabled:      true,
-			AuthToken:    "0123456789abcdef0123456789abcdef",
-			SubjectID:    "app-chat-test-subject",
-			CompatAppID:  "fire-safety-app",
-			MaxBodyBytes: 4096,
-			RunTimeout:   time.Minute,
-			SessionTTL:   time.Minute,
-			MaxSessions:  10,
+			Enabled:               true,
+			AuthToken:             "delivered-key",
+			AllowLegacyShortToken: true,
+			SubjectID:             "app-chat-test-subject",
+			CompatAppID:           "fire-safety-app",
+			MaxBodyBytes:          4096,
+			RunTimeout:            time.Minute,
+			SessionTTL:            time.Minute,
+			MaxSessions:           10,
 		},
 	})
 	if err != nil {
@@ -93,7 +101,7 @@ func TestNewWiresChatAPIToSuperAgent(t *testing.T) {
 	defer application.close()
 
 	request := httptest.NewRequest(http.MethodPost, "/api/chat", strings.NewReader(`{"message":"你好"}`))
-	request.Header.Set("Authorization", "Bearer 0123456789abcdef0123456789abcdef")
+	request.Header.Set("Authorization", "Bearer delivered-key")
 	request.Header.Set("Content-Type", "application/json")
 	request.Header.Set("Accept", "text/event-stream")
 	response := httptest.NewRecorder()
@@ -105,7 +113,7 @@ func TestNewWiresChatAPIToSuperAgent(t *testing.T) {
 	}
 
 	compatRequest := httptest.NewRequest(http.MethodPost, "/api/v1/apps/fire-safety-app/completion", strings.NewReader(`{"input":{"prompt":"你好"},"parameters":{}}`))
-	compatRequest.Header.Set("xtoken", "0123456789abcdef0123456789abcdef")
+	compatRequest.Header.Set("xtoken", "delivered-key")
 	compatRequest.Header.Set("Content-Type", "application/json")
 	compatResponse := httptest.NewRecorder()
 	application.server.Handler.ServeHTTP(compatResponse, compatRequest)
@@ -113,4 +121,10 @@ func TestNewWiresChatAPIToSuperAgent(t *testing.T) {
 		!strings.Contains(compatResponse.Body.String(), `"finish_reason":"stop"`) || !strings.Contains(compatResponse.Body.String(), "测试回答") {
 		t.Fatalf("compat chat status=%d body=%s", compatResponse.Code, compatResponse.Body.String())
 	}
+	if !strings.Contains(applicationLogs.String(), "legacy short chat auth token compatibility is enabled") {
+		t.Fatalf("application logs did not contain legacy compatibility warning: %s", applicationLogs.String())
+	}
+	if strings.Contains(applicationLogs.String(), "delivered-key") {
+		t.Fatal("application logs leaked the chat auth token")
+	}
 }