@allbluecn/web-app 0.22.4 → 0.23.1

package/src/routes/_nav/settings/-settings-tabs.tsx

@@ -15,9 +15,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program. If not, see <https://www.gnu.org/licenses/>.
 
-import { Link, useLocation } from '@tanstack/react-router'
+import { Link } from '@tanstack/react-router'
 import { User, Users, Bot, Settings, CreditCard, Plug, ShieldCheck, Bell, Server, type LucideIcon } from 'lucide-react'
-import { cn } from '@/lib/utils'
 import { mergeSettingsGroups } from '@/components/plugin-slots/plugin-settings-tabs'
 import { m } from '@/paraglide/messages.js'
 
@@ -70,7 +69,6 @@ const desktopGroups: SettingsGroup[] = [
 ]
 
 export function SettingsTabs() {
-  const location = useLocation()
   const isDesktop = import.meta.env.VITE_DEPLOY_TARGET === 'desktop'
   const allGroups = isDesktop ? [...desktopGroups, ...groups] : groups
 
@@ -83,19 +81,18 @@ export function SettingsTabs() {
           </h2>
           {group.tabs.map((tab) => {
             const Icon = tab.icon
-            // 前缀匹配：子路由（如 /settings/ai/providers/xxx）也保持所属 tab 高亮；
-            // 本组各 tab 路径互非前缀，无最长匹配歧义
-            const isActive = location.pathname === tab.path || location.pathname.startsWith(`${tab.path}/`)
+            // 激活态由 Link 自身判定：默认模糊匹配 = 段边界前缀
+            // （子路由如 /settings/ai/providers/xxx 保持所属 tab 高亮，/settings/aix 不误伤），
+            // 等价原「pathname === tab.path || startsWith(`${tab.path}/`)」；
+            // includeSearch:false 保持纯 pathname 口径（否则带查询串的 URL 不命中激活态）
             return (
               <Link
                 key={tab.path}
                 to={tab.path}
-                className={cn(
-                  'flex items-center gap-2 rounded-md px-3 py-2 text-sm font-medium transition-colors hover:bg-muted hover:text-primary',
-                  isActive
-                    ? 'bg-muted text-primary'
-                    : 'text-muted-foreground',
-                )}
+                className="flex items-center gap-2 rounded-md px-3 py-2 text-sm font-medium transition-colors hover:bg-muted hover:text-primary"
+                activeProps={{ className: 'bg-muted text-primary' }}
+                inactiveProps={{ className: 'text-muted-foreground' }}
+                activeOptions={{ includeSearch: false }}
               >
                 <Icon className="size-4" />
                 {tab.label()}

package/src/routes/api/generate/__tests__/media.test.ts

@@ -0,0 +1,378 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// /api/generate/media SSE 路由集成测试。
+//
+// mock streamVideoForUser 的流式产物（官方 generateVideo stream 模式的事件序列），
+// 断言：
+// 1. 官方 toServerSentEventsResponse 编码的 AG-UI 事件序列
+//    RUN_STARTED → CUSTOM(video:job:created) → CUSTOM(video:status)* →
+//    CUSTOM(generation:result) → RUN_FINISHED
+// 2. useGenerateVideo 客户端信封（generationParamsFromRequest）解析：
+//    forwardedProps 里的 prompt/referenceImage 传入媒体管线，runId/threadId 透传
+// 3. request.signal.abort() → 编码器 abort → 上游 generator finally 执行
+// 4. 鉴权/权益/配额/限流/线程归属/AI key 的拒绝面（401/400/404/429/403）
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import type { StreamChunk } from '@tanstack/ai'
+
+const mocks = vi.hoisted(() => ({
+  session: vi.fn(),
+  feature: vi.fn(async () => undefined),
+  resource: vi.fn(async () => undefined),
+  rateLimit: vi.fn(async () => undefined),
+  resolveAiConfig: vi.fn<() => Promise<{ provider: string; apiKey: string; model: string; baseUrl?: string } | null>>(async () => ({ provider: 'openai', apiKey: 'test', model: 'sora-2' })),
+  thread: vi.fn<() => Promise<{ id: string } | null>>(async () => ({ id: 'thread-1' })),
+  streamVideo: vi.fn(),
+}))
+
+vi.mock('@/lib/session', () => ({
+  getCurrentSession: () => mocks.session(),
+}))
+vi.mock('@/server/entitlements', () => ({
+  requireFeature: mocks.feature,
+  FeatureUnavailableError: class FeatureUnavailableError extends Error {
+    constructor(feature: string) {
+      super(`feature ${feature} unavailable`)
+      this.name = 'FeatureUnavailableError'
+    }
+  },
+  FeatureForbiddenError: class FeatureForbiddenError extends Error {
+    constructor(feature: string) {
+      super(`feature ${feature} forbidden`)
+      this.name = 'FeatureForbiddenError'
+    }
+  },
+}))
+vi.mock('@/server/resources', () => ({ requireResource: mocks.resource }))
+vi.mock('@/server/middlewares/rate-limit-server-fn', () => ({
+  checkAiRateLimit: mocks.rateLimit,
+  RateLimitExceededError: class RateLimitExceededError extends Error {
+    constructor(
+      public readonly retryAfterMs: number,
+      public readonly endpoint: string,
+    ) {
+      super(`Rate limit exceeded for ${endpoint}`)
+      this.name = 'RateLimitExceededError'
+    }
+  },
+}))
+vi.mock('@/server/ai-gateway/adapter', () => ({ resolveAiConfig: mocks.resolveAiConfig }))
+vi.mock('@/server/ai-gateway/media', () => ({ streamVideoForUser: mocks.streamVideo }))
+vi.mock('@allbluecn/database/get-prisma', () => ({
+  getPrisma: async () => ({ chatThread: { findFirst: mocks.thread } }),
+}))
+
+import { Route } from '../media'
+
+type MediaRouteServerOptions = {
+  handlers?: {
+    POST?: (ctx: { request: Request }) => Promise<Response>
+  }
+}
+
+const serverOptions = Route.options.server as MediaRouteServerOptions | undefined
+const post: (ctx: { request: Request }) => Promise<Response> =
+  serverOptions?.handlers?.POST ??
+  (async () => {
+    throw new Error('POST handler is not configured')
+  })
+
+// ===== mock 流式产物 =====
+
+function runStarted(): StreamChunk {
+  return { type: 'RUN_STARTED', runId: 'run-1', threadId: 'thread-1', timestamp: Date.now() } as StreamChunk
+}
+function custom(name: string, value: unknown): StreamChunk {
+  return { type: 'CUSTOM', name, value, timestamp: Date.now() } as StreamChunk
+}
+function runFinished(): StreamChunk {
+  return { type: 'RUN_FINISHED', runId: 'run-1', threadId: 'thread-1', finishReason: 'stop', timestamp: Date.now() } as StreamChunk
+}
+
+let streamCancelled = false
+
+/** 官方 generateVideo stream 模式的完整事件序列（create → poll → result） */
+async function* videoLifecycleStream(): AsyncGenerator<StreamChunk> {
+  try {
+    yield runStarted()
+    yield custom('video:job:created', { jobId: 'job-9' })
+    yield custom('video:status', { jobId: 'job-9', status: 'pending', progress: 0 })
+    yield custom('video:status', { jobId: 'job-9', status: 'processing', progress: 55 })
+    yield custom('generation:result', { jobId: 'job-9', status: 'completed', url: 'data:video/mp4;base64,AAAA' })
+    yield runFinished()
+  } finally {
+    streamCancelled = true
+  }
+}
+
+/** 首个事件后暂停：abort 传播测试用 */
+async function* pausingStream(): AsyncGenerator<StreamChunk> {
+  try {
+    yield runStarted()
+    yield custom('video:job:created', { jobId: 'job-9' })
+    await new Promise((resolve) => setTimeout(resolve, 80))
+    yield runFinished()
+  } finally {
+    streamCancelled = true
+  }
+}
+
+// ===== 请求/断言工具 =====
+
+/** useGenerateVideo（fetchServerSentEvents）发出的 AG-UI RunAgentInput 信封 */
+function generateRequest(forwardedProps: unknown, signal?: AbortSignal): Request {
+  return new Request('http://localhost/api/generate/media', {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      threadId: 'thread-1',
+      runId: 'run-1',
+      messages: [],
+      state: {},
+      tools: [],
+      context: [],
+      forwardedProps,
+    }),
+    ...(signal ? { signal } : {}),
+  })
+}
+
+async function readSseEvents(res: Response): Promise<Array<Record<string, unknown>>> {
+  const text = await res.text()
+  return text
+    .split('\n\n')
+    .filter((block) => block.trim().length > 0)
+    .map((block) => {
+      const dataLine = block.split('\n').find((line) => line.startsWith('data: '))
+      expect(dataLine, `SSE 帧缺少 data 行: ${block}`).toBeDefined()
+      return JSON.parse((dataLine as string).slice('data: '.length)) as Record<string, unknown>
+    })
+}
+
+function eventsOf(events: Array<Record<string, unknown>>, name: string) {
+  return events.filter((event) => event.type === 'CUSTOM' && event.name === name)
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  streamCancelled = false
+  mocks.session.mockResolvedValue({ user: { id: 'u1' } })
+  mocks.resolveAiConfig.mockResolvedValue({ provider: 'openai', apiKey: 'test', model: 'sora-2' })
+  mocks.thread.mockResolvedValue({ id: 'thread-1' })
+})
+
+afterEach(() => {
+  vi.restoreAllMocks()
+})
+
+describe('/api/generate/media 流式视频生成', () => {
+  it('下发官方事件序列 job:created → video:status → generation:result → RUN_FINISHED', async () => {
+    mocks.streamVideo.mockResolvedValueOnce(videoLifecycleStream())
+
+    const res = await post({ request: generateRequest({ prompt: '城市延时摄影' }) })
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('content-type')).toContain('text/event-stream')
+
+    const events = await readSseEvents(res)
+    const jobCreated = eventsOf(events, 'video:job:created')
+    expect(jobCreated).toHaveLength(1)
+    expect((jobCreated[0].value as { jobId: string }).jobId).toBe('job-9')
+
+    const statuses = eventsOf(events, 'video:status')
+    expect(statuses).toHaveLength(2)
+    expect((statuses[0].value as { status: string; progress?: number })).toMatchObject({ status: 'pending', progress: 0 })
+    expect((statuses[1].value as { status: string; progress?: number })).toMatchObject({ status: 'processing', progress: 55 })
+
+    const results = eventsOf(events, 'generation:result')
+    expect(results).toHaveLength(1)
+    expect((results[0].value as { url: string }).url).toContain('data:video/mp4')
+
+    expect(events.some((event) => event.type === 'RUN_STARTED')).toBe(true)
+    expect(events.some((event) => event.type === 'RUN_FINISHED')).toBe(true)
+  })
+
+  it('透传 runId/threadId/prompt 与解析出的 AI 配置给媒体管线', async () => {
+    mocks.streamVideo.mockResolvedValueOnce(videoLifecycleStream())
+
+    await post({ request: generateRequest({ prompt: '海边日落', duration: 5 }) })
+
+    expect(mocks.streamVideo).toHaveBeenCalledTimes(1)
+    expect(mocks.streamVideo).toHaveBeenCalledWith(expect.objectContaining({
+      userId: 'u1',
+      threadId: 'thread-1',
+      runId: 'run-1',
+      prompt: '海边日落',
+      duration: 5,
+      adapterKind: 'openai',
+      apiKey: 'test',
+      model: 'sora-2',
+    }))
+  })
+
+  it('prompt 为 MediaPrompt 分片时原样透传（参考帧由管线归一）', async () => {
+    mocks.streamVideo.mockResolvedValueOnce(videoLifecycleStream())
+    const parts = [
+      { type: 'text', content: '推进镜头' },
+      { type: 'image', source: { type: 'url', value: 'data:image/png;base64,QQ==' }, metadata: { role: 'start_frame' } },
+    ]
+    await post({ request: generateRequest({ prompt: parts }) })
+    expect(mocks.streamVideo).toHaveBeenCalledWith(expect.objectContaining({ prompt: parts }))
+  })
+
+  it('request.signal.abort() → 编码器 abort，上游 generator finally 执行', async () => {
+    const controller = new AbortController()
+    mocks.streamVideo.mockResolvedValueOnce(pausingStream())
+
+    const res = await post({ request: generateRequest({ prompt: '一个长镜头' }, controller.signal) })
+    expect(res.status).toBe(200)
+
+    const reader = res.body?.getReader()
+    expect(reader).toBeDefined()
+    // 消费到 job:created 帧（编码器按批下发，首帧可能只有 RUN_STARTED）
+    const decoder = new TextDecoder()
+    let head = ''
+    for (;;) {
+      const chunk = await reader!.read()
+      if (chunk.done) break
+      head += decoder.decode(chunk.value)
+      if (head.includes('video:job:created')) break
+    }
+    expect(head).toContain('video:job:created')
+
+    controller.abort()
+
+    let closed = false
+    try {
+      for (;;) {
+        const chunk = await reader!.read()
+        if (chunk.done) {
+          closed = true
+          break
+        }
+      }
+    } catch {
+      closed = true
+    }
+    expect(closed).toBe(true)
+
+    await vi.waitFor(() => expect(streamCancelled).toBe(true), { timeout: 2000 })
+  })
+
+  it('鉴权失败返回 401，且不进入权益与媒体管线', async () => {
+    mocks.session.mockResolvedValueOnce(null)
+
+    const res = await post({ request: generateRequest({ prompt: 'p' }) })
+
+    expect(res.status).toBe(401)
+    expect(mocks.feature).not.toHaveBeenCalled()
+    expect(mocks.streamVideo).not.toHaveBeenCalled()
+  })
+
+  it('权益拒绝映射：feature forbidden → 403、unavailable → 501、资源超限 → 429、限流 → 429', async () => {
+    const { FeatureForbiddenError, FeatureUnavailableError } = await import('@/server/entitlements')
+    const { ResourceLimitError } = await import('@/lib/resource-errors')
+    const { RateLimitExceededError } = await import('@/server/middlewares/rate-limit-server-fn')
+
+    mocks.feature.mockRejectedValueOnce(new FeatureForbiddenError('mediaGeneration'))
+    expect((await post({ request: generateRequest({ prompt: 'p' }) })).status).toBe(403)
+
+    mocks.feature.mockRejectedValueOnce(new FeatureUnavailableError('mediaGeneration'))
+    expect((await post({ request: generateRequest({ prompt: 'p' }) })).status).toBe(501)
+
+    mocks.resource.mockRejectedValueOnce(new ResourceLimitError('mediaGenerationsMonthly', 10, 10))
+    expect((await post({ request: generateRequest({ prompt: 'p' }) })).status).toBe(429)
+
+    mocks.rateLimit.mockRejectedValueOnce(new RateLimitExceededError(30_000, 'mediaVideo'))
+    const limited = await post({ request: generateRequest({ prompt: 'p' }) })
+    expect(limited.status).toBe(429)
+    expect(limited.headers.get('Retry-After')).toBe('30')
+    expect(mocks.streamVideo).not.toHaveBeenCalled()
+  })
+
+  it('请求体缺 threadId/runId/forwardedProps → 400，媒体管线未调用', async () => {
+    for (const body of [
+      JSON.stringify({ runId: 'run-1', forwardedProps: { prompt: 'p' } }),
+      JSON.stringify({ threadId: 'thread-1', forwardedProps: { prompt: 'p' } }),
+      JSON.stringify({ threadId: 'thread-1', runId: 'run-1' }),
+    ]) {
+      const res = await post({
+        request: new Request('http://localhost/api/generate/media', { method: 'POST', headers: { 'content-type': 'application/json' }, body }),
+      })
+      expect(res.status).toBe(400)
+    }
+    expect(mocks.streamVideo).not.toHaveBeenCalled()
+  })
+
+  it('prompt 非字符串/分片形态 → 400', async () => {
+    const res = await post({ request: generateRequest({ prompt: 42 }) })
+    expect(res.status).toBe(400)
+    expect(mocks.streamVideo).not.toHaveBeenCalled()
+  })
+
+  it('线程不属于请求用户 → 404', async () => {
+    mocks.thread.mockResolvedValueOnce(null)
+
+    const res = await post({ request: generateRequest({ prompt: 'p' }) })
+
+    expect(res.status).toBe(404)
+    expect(mocks.streamVideo).not.toHaveBeenCalled()
+  })
+
+  it('AI key 未配置 → 400', async () => {
+    mocks.resolveAiConfig.mockResolvedValueOnce(null)
+    const res = await post({ request: generateRequest({ prompt: 'p' }) })
+
+    expect(res.status).toBe(400)
+    expect(mocks.streamVideo).not.toHaveBeenCalled()
+  })
+
+  it('参考帧/prompt 图片分片的管线侧错误映射 400（任务 15 审查 ②）', async () => {
+    const { FetchGuardError } = await import('@/server/fetch-guard')
+
+    // SSRF 守卫拒绝（私网/元数据目标）
+    mocks.streamVideo.mockRejectedValueOnce(new FetchGuardError('http://169.254.169.254/latest/meta-data', 'private/metadata address'))
+    const guarded = await post({ request: generateRequest({ prompt: 'p' }) })
+    expect(guarded.status).toBe(400)
+    expect(((await guarded.json()) as { error: string }).error).toBe('unfetchable_reference_image')
+
+    // imageDataUrl 格式/大小校验错误
+    mocks.streamVideo.mockRejectedValueOnce(new Error('Image too large'))
+    const oversized = await post({ request: generateRequest({ prompt: 'p' }) })
+    expect(oversized.status).toBe(400)
+    expect(((await oversized.json()) as { error: string }).error).toBe('invalid_media_input')
+
+    // adapter 无视频能力（模板字符串，前缀匹配）
+    mocks.streamVideo.mockRejectedValueOnce(new Error('Video generation is not available for adapter kind: openai'))
+    const unavailable = await post({ request: generateRequest({ prompt: 'p' }) })
+    expect(unavailable.status).toBe(400)
+  })
+
+  it('管线侧未知异常保持上抛（500 语义，不误映射 400）', async () => {
+    mocks.streamVideo.mockRejectedValueOnce(new Error('connection refused'))
+
+    await expect(post({ request: generateRequest({ prompt: 'p' }) })).rejects.toThrow('connection refused')
+  })
+
+  it('媒体管线拒绝（线程归属复核）→ 404', async () => {
+    mocks.streamVideo.mockRejectedValueOnce(new Error('Thread not found'))
+
+    const res = await post({ request: generateRequest({ prompt: 'p' }) })
+
+    expect(res.status).toBe(404)
+  })
+})

package/src/routes/api/generate/media.ts

@@ -0,0 +1,179 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// AllBlue - 理想之海
+// Copyright (C) 2026 AllBlue Contributors
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program. If not, see <https://www.gnu.org/licenses/>.
+
+// 媒体生成 SSE 进度通道（任务 15）：官方 generateVideo stream 模式（服务端内部
+// create → poll → complete 全生命周期）→ 官方 toServerSentEventsResponse 编码下发，
+// 事件序列 RUN_STARTED → CUSTOM(video:job:created) → CUSTOM(video:status)* →
+// CUSTOM(generation:result) → RUN_FINISHED（失败 RUN_ERROR），与
+// useGenerateVideo 客户端逐事件对应。请求体为 @tanstack/ai-react 生成 hooks 的
+// AG-UI RunAgentInput 信封（业务字段在 forwardedProps），经官方
+// generationParamsFromRequest('video', request) 解析。
+// 鉴权/权益/配额/限流口径沿用被替换的 startVideoFn（轮询面随任务 15 删除）；
+// abort 语义：request.signal → AbortController 传入官方编码器，客户端断开即停。
+
+import { createFileRoute } from "@tanstack/react-router"
+import { generationParamsFromRequest, toServerSentEventsResponse } from "@tanstack/ai"
+import { z } from "zod"
+import { getCurrentSession } from "@/lib/session"
+import {
+  checkAiRateLimit,
+  RateLimitExceededError,
+} from "@/server/middlewares/rate-limit-server-fn"
+import { requireFeature, FeatureUnavailableError, FeatureForbiddenError } from "@/server/entitlements"
+import { requireResource } from "@/server/resources"
+import { ResourceLimitError } from "@/lib/resource-errors"
+import { FetchGuardError } from "@/server/fetch-guard"
+import { resolveAiConfig } from "@/server/ai-gateway/adapter"
+import { streamVideoForUser } from "@/server/ai-gateway/media"
+import { getPrisma } from "@allbluecn/database/get-prisma"
+
+// referenceImage 为用户可控 URL/数据 URL，媒体管线（imageDataUrl）内做 SSRF 守卫
+// （assertFetchableUrl + redirect:error + 超时）与 20MB 上限；prompt 的 url source
+// 同样在管线内归一，此处仅限输入长度。
+const textPartSchema = z.object({ type: z.literal("text"), content: z.string().min(1).max(4000) })
+const imagePartSchema = z.object({
+  type: z.literal("image"),
+  source: z.object({ type: z.literal("url"), value: z.string().min(1).max(16_000_000) }),
+  // 与官方 MediaInputRole 对齐（z.enum 产出窄化类型，供 streamVideoForUser 的 MediaPrompt 形参直接消费）
+  metadata: z.object({ role: z.enum(["reference", "mask", "control", "start_frame", "end_frame", "character"]) }).optional(),
+})
+const promptSchema = z.union([
+  z.string().min(1).max(4000),
+  z.array(z.union([textPartSchema, imagePartSchema])).min(1).max(8),
+])
+const videoInputSchema = z.object({
+  prompt: promptSchema,
+  duration: z.number().optional(),
+  size: z.string().max(40).optional(),
+  referenceImage: z.string().max(16_000_000).optional(),
+})
+
+// 管线内请求侧校验错误（imageDataUrl 格式/大小/下载 + adapter 无视频能力）——
+// 与 zod 拒绝面同属 400；不在集合内的异常（如 prisma 故障）保持 500 语义上抛
+const MEDIA_REQUEST_ERRORS: ReadonlySet<string> = new Set([
+  "Invalid image data",
+  "Image too large",
+  "Image download failed",
+  "Invalid image content type",
+  "Empty image",
+])
+
+function jsonResponse(error: string, status: number, init?: { headers?: HeadersInit; detail?: string }): Response {
+  // detail 走 JSON body 而非响应头：错误信息含中文（FetchGuardError 文案），
+  // HTTP 头值必须是 ByteString，非 ASCII 会抛 TypeError
+  return new Response(JSON.stringify(init?.detail ? { error, detail: init.detail } : { error }), {
+    status,
+    headers: { "Content-Type": "application/json", ...init?.headers },
+  })
+}
+
+async function authorize(request: Request, userId: string): Promise<Response | undefined> {
+  try {
+    await requireFeature(request, "mediaGeneration")
+    await requireResource(request, "mediaGenerationsMonthly")
+    await checkAiRateLimit(userId, "mediaVideo")
+    return undefined
+  } catch (err) {
+    if (err instanceof RateLimitExceededError) {
+      return jsonResponse("rate_limit_exceeded", 429, { headers: { "Retry-After": String(Math.ceil(err.retryAfterMs / 1000)) } })
+    }
+    if (err instanceof FeatureUnavailableError) return jsonResponse("feature_unavailable", 501)
+    if (err instanceof FeatureForbiddenError) return jsonResponse("feature_forbidden", 403)
+    if (err instanceof ResourceLimitError) return jsonResponse("resource_limit_exceeded", 429)
+    throw err
+  }
+}
+
+export const Route = createFileRoute("/api/generate/media")({
+  server: {
+    handlers: {
+      POST: async ({ request }) => {
+        const session = await getCurrentSession(request)
+        if (!session?.user?.id) {
+          return new Response("Unauthorized", { status: 401 })
+        }
+        const userId = session.user.id
+
+        const denied = await authorize(request, userId)
+        if (denied) return denied
+
+        let params: { input: Record<string, unknown>; threadId: string; runId: string }
+        try {
+          params = await generationParamsFromRequest("video", request)
+        } catch (err) {
+          return jsonResponse("invalid_request_body", 400, {
+            detail: err instanceof Error ? err.message : "unknown",
+          })
+        }
+        const parsed = videoInputSchema.safeParse(params.input)
+        if (!parsed.success) return jsonResponse("invalid_media_input", 400)
+        const input = parsed.data
+
+        const prisma = await getPrisma()
+        const thread = await prisma.chatThread.findFirst({
+          where: { id: params.threadId, userId }, select: { id: true },
+        })
+        if (!thread) return jsonResponse("thread_not_found", 404)
+
+        const aiConfig = await resolveAiConfig(userId)
+        if (!aiConfig) return jsonResponse("ai_key_not_configured", 400)
+
+        let stream: Awaited<ReturnType<typeof streamVideoForUser>>
+        try {
+          stream = await streamVideoForUser({
+            userId,
+            threadId: params.threadId,
+            runId: params.runId,
+            prompt: input.prompt,
+            duration: input.duration,
+            size: input.size,
+            referenceImage: input.referenceImage,
+            adapterKind: aiConfig.provider,
+            apiKey: aiConfig.apiKey,
+            model: aiConfig.model,
+            ...(aiConfig.baseUrl ? { baseURL: aiConfig.baseUrl } : {}),
+          })
+        } catch (err) {
+          if (err instanceof Error && err.message === "Thread not found") {
+            return jsonResponse("thread_not_found", 404)
+          }
+          // 参考帧/prompt 图片分片在管线内做 SSRF 守卫（FetchGuardError）与
+          // 格式/大小校验（imageDataUrl 抛普通 Error），adapter 未配置视频能力
+          // 同属请求侧问题——统一 400 而非未映射 500（任务 15 审查 ②）
+          if (err instanceof FetchGuardError) {
+            return jsonResponse("unfetchable_reference_image", 400, { detail: err.message })
+          }
+          if (err instanceof Error && (MEDIA_REQUEST_ERRORS.has(err.message) || err.message.startsWith("Video generation is not available for adapter kind"))) {
+            return jsonResponse("invalid_media_input", 400, { detail: err.message })
+          }
+          throw err
+        }
+
+        const abortController = new AbortController()
+        request.signal.addEventListener("abort", () => abortController.abort())
+        return toServerSentEventsResponse(stream, {
+          abortController,
+          headers: {
+            "Cache-Control": "no-cache",
+            Connection: "keep-alive",
+            "X-Accel-Buffering": "no",
+          },
+        })
+      },
+    },
+  },
+})

package/src/server/__tests__/agent-client-graph.test.ts

@@ -31,7 +31,6 @@ const CLIENT_SAFE_SPECIFIERS = new Set([
   'date-fns/locale',
   '@allbluecn/kernel',
   '@/components/shared-kit',
-  '@/lib/desktop-detect',
   '@/server/ai-gateway/tools',
   '@/plugins/modules.gen',
 ])

package/src/server/__tests__/agent-crud.test.ts

@@ -32,24 +32,57 @@ const mocks = vi.hoisted(() => ({
 }))
 
 vi.mock('@tanstack/react-start', () => ({
+  // 迁移后经 .middleware([authContextMiddleware]) 注入 context.user：
+  // mock 依序执行 middleware 的 server 段（复现框架 executeMiddleware 的
+  // context 合并语义），真实鉴权链由被 mock 的 auth-helpers/getRequest 承接
   createServerFn: (config: any) => {
     let validator: any = undefined
-    return {
+    const api: any = {
       _method: config.method,
+      _middlewares: [] as any[],
+      middleware(mws: any[]) {
+        api._middlewares.push(...mws)
+        return api
+      },
       validator(schema: any) {
         validator = schema
-        return this
+        return api
       },
       handler(fn: Function) {
-        return function fn2(args: any = {}) {
+        return async function fn2(args: any = {}) {
           let data = args?.data
           if (validator && data !== undefined) {
             data = validator.parse ? validator.parse(data) : data
           }
-          return fn({ data, request: args?.request })
+          let context: any = {}
+          for (const mw of api._middlewares) {
+            const serverFn = mw?.options?.server
+            if (!serverFn) continue
+            const result = await serverFn({
+              data,
+              context,
+              method: 'POST',
+              serverFnMeta: {},
+              signal: new AbortController().signal,
+              next: async (inner: any) => ({ context: { ...context, ...(inner?.context ?? {}) } }),
+            })
+            context = result.context
+          }
+          return fn({ data, context })
         }
       },
     }
+    return api
+  },
+  // auth-context.ts 依赖 createMiddleware({ type: 'function' }).server(fn)：
+  // mock 产出与真实 middleware 同构的 { options: { server } } 形状
+  createMiddleware: (opts: any) => {
+    const mw: any = { options: { type: opts?.type } }
+    mw.server = (fn: Function) => {
+      mw.options.server = fn
+      return mw
+    }
+    return mw
   },
 }))