@pippit-dev/cli 1.0.17 → 1.0.18

package/internal/canvas/upload.go

@@ -0,0 +1,250 @@
+package canvas
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"mime"
+	"os"
+	"path/filepath"
+	"strings"
+	"time"
+
+	"github.com/Pippit-dev/pippit-cli/internal/common"
+)
+
+const defaultUploadPollInterval = time.Second
+
+var uploadContentTypeFallbacks = map[string]string{
+	".jpeg": "image/jpeg",
+	".jpg":  "image/jpeg",
+	".png":  "image/png",
+	".webp": "image/webp",
+	".mp3":  "audio/mpeg",
+	".wav":  "audio/wav",
+	".mp4":  "video/mp4",
+	".mov":  "video/quicktime",
+}
+
+type UploadOptions struct {
+	Path         string
+	PollInterval time.Duration
+	WaitTimeout  time.Duration
+}
+
+// AssetLocator reports the durable Pippit ID and optional observed media
+// locations. URLs may be signed or short lived and must not be persisted into
+// Canvas patches; callers should persist PippitAssetID instead.
+type AssetLocator struct {
+	PippitAssetID string `json:"pippit_asset_id"`
+	SourceID      string `json:"source_id,omitempty"`
+	DownloadURL   string `json:"download_url,omitempty"`
+	InternalURL   string `json:"internal_url,omitempty"`
+	CoverURL      string `json:"cover_url,omitempty"`
+	VID           string `json:"vid,omitempty"`
+}
+
+type UploadResult struct {
+	State         string          `json:"state"`
+	AssetID       string          `json:"asset_id,omitempty"`
+	PippitAssetID string          `json:"pippit_asset_id"`
+	Locator       AssetLocator    `json:"locator"`
+	Asset         json.RawMessage `json:"asset,omitempty"`
+	LogID         string          `json:"log_id,omitempty"`
+	QueryLogID    string          `json:"query_log_id,omitempty"`
+	PollAttempts  int             `json:"poll_attempts"`
+	Warning       string          `json:"warning,omitempty"`
+}
+
+func Upload(ctx context.Context, opts UploadOptions, runner *common.Runner) (*UploadResult, error) {
+	client, err := runnerClient(runner, "canvas upload")
+	if err != nil {
+		return nil, err
+	}
+	if opts.PollInterval < 0 || opts.WaitTimeout < 0 {
+		return nil, fmt.Errorf("canvas upload polling durations must not be negative")
+	}
+	path := strings.TrimSpace(opts.Path)
+	if path == "" {
+		return nil, fmt.Errorf("canvas upload path is required")
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		return nil, fmt.Errorf("inspect canvas upload file: %w", err)
+	}
+	if !info.Mode().IsRegular() {
+		return nil, fmt.Errorf("canvas upload path %q is not a regular file", path)
+	}
+	fileName := filepath.Base(path)
+	extension := strings.ToLower(filepath.Ext(fileName))
+	contentType := mime.TypeByExtension(extension)
+	if contentType == "" {
+		contentType = uploadContentTypeFallbacks[extension]
+	}
+	if contentType == "" {
+		contentType = "application/octet-stream"
+	}
+
+	var envelope responseEnvelope
+	if err := client.SendMultipartRequest(ctx, UploadPath, nil, common.MultipartFile{
+		FieldName:   "file",
+		Path:        path,
+		FileName:    fileName,
+		ContentType: contentType,
+	}, &envelope); err != nil {
+		return nil, fmt.Errorf("canvas upload request failed; outcome may be ambiguous, check assets before retrying: %w", err)
+	}
+	if err := envelope.validate("canvas upload"); err != nil {
+		return nil, err
+	}
+	assetID, pippitAssetID, err := parseUploadData(envelope.Data)
+	if err != nil {
+		return nil, common.NewLogIDError(fmt.Sprintf("canvas upload returned invalid data: %v", err), envelope.LogID)
+	}
+	result := &UploadResult{
+		State:         StateProcessing,
+		AssetID:       assetID,
+		PippitAssetID: pippitAssetID,
+		Locator:       AssetLocator{PippitAssetID: pippitAssetID},
+		LogID:         strings.TrimSpace(envelope.LogID),
+	}
+
+	asset, queryLogID, attempts, err := waitForUploadedAsset(ctx, pippitAssetID, opts.PollInterval, opts.WaitTimeout, runner)
+	result.PollAttempts = attempts
+	if err != nil {
+		// The upload response already returned a durable Pippit asset ID. Keep
+		// it machine-readable so callers can resume querying without uploading
+		// the same bytes again.
+		result.Warning = err.Error()
+		return result, nil
+	}
+	result.State = StateReady
+	result.Locator = locatorFromAsset(asset, pippitAssetID)
+	result.Asset = asset
+	result.QueryLogID = queryLogID
+	return result, nil
+}
+
+func parseUploadData(raw json.RawMessage) (string, string, error) {
+	var data map[string]json.RawMessage
+	if err := json.Unmarshal(raw, &data); err != nil {
+		return "", "", err
+	}
+	assetID, err := optionalStringField(data, "asset_id", "AssetId", "assetId")
+	if err != nil {
+		return "", "", err
+	}
+	pippitAssetID, err := optionalStringField(data, "pippit_asset_id", "PippitAssetID", "pippitAssetId")
+	if err != nil {
+		return "", "", err
+	}
+	if pippitAssetID == "" {
+		return "", "", fmt.Errorf("data.pippit_asset_id is missing")
+	}
+	return assetID, pippitAssetID, nil
+}
+
+func optionalStringField(values map[string]json.RawMessage, keys ...string) (string, error) {
+	raw, ok := rawField(values, keys...)
+	if !ok || string(raw) == "null" {
+		return "", nil
+	}
+	var value string
+	if err := json.Unmarshal(raw, &value); err != nil {
+		return "", fmt.Errorf("%s must be a JSON string", keys[0])
+	}
+	return strings.TrimSpace(value), nil
+}
+
+func waitForUploadedAsset(
+	ctx context.Context,
+	assetID string,
+	pollInterval, waitTimeout time.Duration,
+	runner *common.Runner,
+) (json.RawMessage, string, int, error) {
+	if pollInterval <= 0 {
+		pollInterval = defaultUploadPollInterval
+	}
+	if waitTimeout <= 0 {
+		waitTimeout = 2 * time.Minute
+	}
+	waitCtx, cancel := context.WithTimeout(ctx, waitTimeout)
+	defer cancel()
+	for attempts := 1; ; attempts++ {
+		result, err := queryAssets(waitCtx, []string{assetID}, false, runner)
+		if err != nil {
+			if waitCtx.Err() != nil {
+				return nil, "", attempts, uploadWaitError(waitCtx.Err(), assetID, waitTimeout)
+			}
+			return nil, "", attempts, fmt.Errorf("query uploaded canvas asset: %w", err)
+		}
+		if len(result.Assets) == 1 {
+			return result.Assets[0], result.LogID, attempts, nil
+		}
+
+		timer := time.NewTimer(pollInterval)
+		select {
+		case <-waitCtx.Done():
+			timer.Stop()
+			return nil, result.LogID, attempts, uploadWaitError(waitCtx.Err(), assetID, waitTimeout)
+		case <-timer.C:
+		}
+	}
+}
+
+func uploadWaitError(err error, assetID string, timeout time.Duration) error {
+	if errors.Is(err, context.DeadlineExceeded) {
+		return fmt.Errorf("uploaded canvas asset %q was not queryable within %s", assetID, timeout)
+	}
+	return fmt.Errorf("wait for uploaded canvas asset %q canceled: %w", assetID, err)
+}
+
+func locatorFromAsset(raw json.RawMessage, pippitAssetID string) AssetLocator {
+	var value any
+	_ = json.Unmarshal(raw, &value)
+	return AssetLocator{
+		PippitAssetID: pippitAssetID,
+		SourceID:      findFirstString(value, "SourceID", "source_id", "sourceId"),
+		DownloadURL:   findFirstString(value, "DownloadUrl", "DownloadURL", "download_url", "downloadUrl"),
+		InternalURL:   findFirstString(value, "InternalUrl", "InternalURL", "internal_url", "internalUrl"),
+		CoverURL:      findFirstString(value, "CoverUrl", "CoverURL", "cover_url", "coverUrl"),
+		VID:           findFirstString(value, "VID", "vid"),
+	}
+}
+
+func findFirstString(value any, keys ...string) string {
+	keySet := make(map[string]struct{}, len(keys))
+	for _, key := range keys {
+		keySet[key] = struct{}{}
+	}
+	return walkFirstString(value, keySet, 0)
+}
+
+func walkFirstString(value any, keys map[string]struct{}, depth int) string {
+	if depth > 10 {
+		return ""
+	}
+	switch typed := value.(type) {
+	case map[string]any:
+		for key, candidate := range typed {
+			if _, ok := keys[key]; ok {
+				if text, ok := candidate.(string); ok && strings.TrimSpace(text) != "" {
+					return strings.TrimSpace(text)
+				}
+			}
+		}
+		for _, candidate := range typed {
+			if found := walkFirstString(candidate, keys, depth+1); found != "" {
+				return found
+			}
+		}
+	case []any:
+		for _, candidate := range typed {
+			if found := walkFirstString(candidate, keys, depth+1); found != "" {
+				return found
+			}
+		}
+	}
+	return ""
+}

package/internal/common/access_key.go

@@ -2,30 +2,66 @@ package common
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"net/http"
 	"strings"
 
+	internal_auth "github.com/Pippit-dev/pippit-cli/internal/auth"
 	"github.com/Pippit-dev/pippit-cli/internal/config"
 )
 
 type accessKeyAuthorizer struct {
-	accessKey string
+	accessKey func(context.Context) (string, error)
 }
 
 func NewAccessKeyAuthorizer(accessKey string) RequestAuthorizer {
-	return &accessKeyAuthorizer{accessKey: strings.TrimSpace(accessKey)}
+	trimmed := strings.TrimSpace(accessKey)
+	return NewAccessKeyProviderAuthorizer(func() string { return trimmed })
+}
+
+// NewAccessKeyProviderAuthorizer resolves the Access Key immediately before
+// each request. This lets interactive commands update their in-memory runtime
+// configuration without rebuilding the shared HTTP client.
+func NewAccessKeyProviderAuthorizer(accessKey func() string) RequestAuthorizer {
+	if accessKey == nil {
+		accessKey = func() string { return "" }
+	}
+	return NewAccessKeyContextProviderAuthorizer(func(context.Context) (string, error) {
+		return accessKey(), nil
+	})
+}
+
+// NewAccessKeyContextProviderAuthorizer resolves a credential lazily for each
+// request. This keeps keychain access out of --help and lets a browser login in
+// the same process authorize the next request without rebuilding the client.
+func NewAccessKeyContextProviderAuthorizer(accessKey func(context.Context) (string, error)) RequestAuthorizer {
+	if accessKey == nil {
+		accessKey = func(context.Context) (string, error) { return "", nil }
+	}
+	return &accessKeyAuthorizer{accessKey: accessKey}
 }
 
 func (a *accessKeyAuthorizer) Inject(ctx context.Context, req *http.Request) error {
 	if err := ctx.Err(); err != nil {
 		return err
 	}
-	if a.accessKey == "" && req.Method == http.MethodPost {
-		return fmt.Errorf("%s 缺失. 请前往小云雀官网个人设置页创建 Access Key，地址：https://xyq.jianying.com/home?tab_name=home\n配置后重试：\n  export %s=\"<your-access-key>\"", config.EnvXYQAccessKey, config.EnvXYQAccessKey)
+	accessKey := ""
+	if a != nil && a.accessKey != nil {
+		resolved, err := a.accessKey(ctx)
+		if err != nil && req.Method == http.MethodPost {
+			if errors.Is(err, internal_auth.ErrCredentialNotFound) || errors.Is(err, internal_auth.ErrCredentialExpired) {
+				return fmt.Errorf("未找到可用的小云雀登录凭证；请先运行 pippit-tool-cli login: %w", err)
+			}
+			return fmt.Errorf("读取小云雀 CLI 安全登录凭证失败；请检查本机凭证库后重试: %w", err)
+		}
+		accessKey = strings.TrimSpace(resolved)
+	}
+	if accessKey == "" && req.Method == http.MethodPost {
+		return fmt.Errorf("未登录小云雀 CLI；请先运行 pippit-tool-cli login（CI 仍可设置 %s）", config.EnvXYQAccessKey)
 	}
-	if a.accessKey != "" {
-		req.Header.Set("Authorization", "Bearer "+a.accessKey)
+	if accessKey != "" {
+		req.Header.Set("Authorization", "Bearer "+accessKey)
 	}
 	return nil
 }

package/internal/common/access_key_test.go

@@ -0,0 +1,113 @@
+package common
+
+import (
+	"context"
+	"errors"
+	"net/http"
+	"strings"
+	"testing"
+
+	internal_auth "github.com/Pippit-dev/pippit-cli/internal/auth"
+)
+
+func TestAccessKeyProviderAuthorizerReadsLatestValue(t *testing.T) {
+	accessKey := " first-key "
+	authorizer := NewAccessKeyProviderAuthorizer(func() string { return accessKey })
+
+	first := newAccessKeyTestRequest(t, http.MethodPost)
+	if err := authorizer.Inject(context.Background(), first); err != nil {
+		t.Fatalf("Inject(first) error = %v", err)
+	}
+	if got := first.Header.Get("Authorization"); got != "Bearer first-key" {
+		t.Fatalf("first Authorization = %q, want latest first key", got)
+	}
+
+	accessKey = "second-key"
+	second := newAccessKeyTestRequest(t, http.MethodPost)
+	if err := authorizer.Inject(context.Background(), second); err != nil {
+		t.Fatalf("Inject(second) error = %v", err)
+	}
+	if got := second.Header.Get("Authorization"); got != "Bearer second-key" {
+		t.Fatalf("second Authorization = %q, want updated key", got)
+	}
+}
+
+func TestAccessKeyProviderAuthorizerRejectsMissingKeyWithoutLeakingPriorValue(t *testing.T) {
+	accessKey := "prior-secret"
+	authorizer := NewAccessKeyProviderAuthorizer(func() string { return accessKey })
+	accessKey = "  "
+
+	err := authorizer.Inject(context.Background(), newAccessKeyTestRequest(t, http.MethodPost))
+	if err == nil || !strings.Contains(err.Error(), "pippit-tool-cli login") {
+		t.Fatalf("Inject() error = %v, want missing Access Key guidance", err)
+	}
+	if strings.Contains(err.Error(), "prior-secret") {
+		t.Fatalf("Inject() error leaks a previous Access Key: %v", err)
+	}
+}
+
+func TestAccessKeyContextProviderAuthorizerLoadsSavedCredentialLazily(t *testing.T) {
+	called := 0
+	authorizer := NewAccessKeyContextProviderAuthorizer(func(ctx context.Context) (string, error) {
+		called++
+		if err := ctx.Err(); err != nil {
+			return "", err
+		}
+		return " saved-browser-key ", nil
+	})
+	request := newAccessKeyTestRequest(t, http.MethodPost)
+	if called != 0 {
+		t.Fatal("credential provider was called before request authorization")
+	}
+	if err := authorizer.Inject(context.Background(), request); err != nil {
+		t.Fatalf("Inject() error = %v", err)
+	}
+	if called != 1 || request.Header.Get("Authorization") != "Bearer saved-browser-key" {
+		t.Fatalf("called=%d Authorization=%q", called, request.Header.Get("Authorization"))
+	}
+}
+
+func TestAccessKeyContextProviderAuthorizerPreservesCredentialStateErrors(t *testing.T) {
+	for _, cause := range []error{internal_auth.ErrCredentialNotFound, internal_auth.ErrCredentialExpired} {
+		authorizer := NewAccessKeyContextProviderAuthorizer(func(context.Context) (string, error) {
+			return "", cause
+		})
+		err := authorizer.Inject(context.Background(), newAccessKeyTestRequest(t, http.MethodPost))
+		if !errors.Is(err, cause) || !strings.Contains(err.Error(), "pippit-tool-cli login") {
+			t.Fatalf("Inject() error = %v, want wrapped %v", err, cause)
+		}
+	}
+}
+
+func TestAccessKeyProviderAuthorizerAllowsUnauthenticatedRead(t *testing.T) {
+	authorizer := NewAccessKeyProviderAuthorizer(nil)
+	request := newAccessKeyTestRequest(t, http.MethodGet)
+
+	if err := authorizer.Inject(context.Background(), request); err != nil {
+		t.Fatalf("Inject() error = %v", err)
+	}
+	if got := request.Header.Get("Authorization"); got != "" {
+		t.Fatalf("Authorization = %q, want empty", got)
+	}
+}
+
+func TestAccessKeyAuthorizerKeepsConstantAPIBehavior(t *testing.T) {
+	authorizer := NewAccessKeyAuthorizer(" constant-key ")
+	request := newAccessKeyTestRequest(t, http.MethodPost)
+
+	if err := authorizer.Inject(context.Background(), request); err != nil {
+		t.Fatalf("Inject() error = %v", err)
+	}
+	if got := request.Header.Get("Authorization"); got != "Bearer constant-key" {
+		t.Fatalf("Authorization = %q, want trimmed constant key", got)
+	}
+}
+
+func newAccessKeyTestRequest(t *testing.T, method string) *http.Request {
+	t.Helper()
+	request, err := http.NewRequest(method, "https://example.test/api", nil)
+	if err != nil {
+		t.Fatalf("NewRequest() error = %v", err)
+	}
+	return request
+}

package/internal/common/client.go

@@ -43,14 +43,20 @@ type httpClient struct {
 }
 
 func NewHTTPClient(baseURL string, timeout time.Duration, authorizer RequestAuthorizer) Client {
-	return &httpClient{
-		baseURL: strings.TrimRight(baseURL, "/"),
-		httpClient: &http.Client{
-			Timeout: timeout,
-		},
+	return newHTTPClient(baseURL, timeout, authorizer)
+}
+
+func newHTTPClient(baseURL string, timeout time.Duration, authorizer RequestAuthorizer) Client {
+	client := &httpClient{
+		baseURL:    strings.TrimRight(baseURL, "/"),
 		headers:    make(http.Header),
 		authorizer: authorizer,
 	}
+	client.httpClient = &http.Client{
+		Timeout:       timeout,
+		CheckRedirect: client.checkRedirect,
+	}
+	return client
 }
 
 func (c *httpClient) SendRequest(ctx context.Context, path string, body any, out any) error {
@@ -85,15 +91,10 @@ func (c *httpClient) SendRequestWithHeaders(ctx context.Context, path string, bo
 		req.Header.Set("Content-Type", "application/json")
 	}
 
-	if c.authorizer == nil {
-		return fmt.Errorf("授权请求缺少认证器")
-	}
-	if err := c.authorizer.Inject(ctx, req); err != nil {
-		return fmt.Errorf("写入认证请求头失败: %w", err)
+	if err := c.prepareRequest(ctx, req, headers); err != nil {
+		return err
 	}
 
-	c.injectHeaders(req, headers)
-
 	// If out is **http.Response, return the raw response for streaming (e.g. file download).
 	if out != nil {
 		if rv := reflect.ValueOf(out); rv.Kind() == reflect.Ptr && rv.Elem().Kind() == reflect.Ptr {
@@ -143,17 +144,11 @@ func (c *httpClient) SendMultipartRequest(ctx context.Context, path string, fiel
 	req.Header.Set("Content-Type", writer.FormDataContentType())
 	req.Header.Set("Accept", "application/json")
 
-	if c.authorizer == nil {
-		_ = pr.Close()
-		_ = pw.Close()
-		return fmt.Errorf("授权请求缺少认证器")
-	}
-	if err := c.authorizer.Inject(ctx, req); err != nil {
+	if err := c.prepareRequest(ctx, req, nil); err != nil {
 		_ = pr.Close()
 		_ = pw.Close()
-		return fmt.Errorf("写入认证请求头失败: %w", err)
+		return err
 	}
-	c.injectHeaders(req, nil)
 
 	go func() {
 		err := writeMultipartBody(writer, fields, file)
@@ -212,6 +207,102 @@ func (c *httpClient) injectHeaders(req *http.Request, headers map[string]string)
 	}
 }
 
+func (c *httpClient) prepareRequest(ctx context.Context, req *http.Request, headers map[string]string) error {
+	trusted, err := c.isBaseURLOrigin(req.URL)
+	if err != nil {
+		return err
+	}
+
+	c.injectHeaders(req, headers)
+	// Authentication is protected. Neither the client's generic headers nor a
+	// caller-provided map may set it; Authorization is rebuilt below only for
+	// the configured API origin.
+	req.Header.Del("Authorization")
+	if !trusted {
+		// Absolute third-party URLs are used for result downloads. Authorization
+		// remains empty outside the API origin.
+		return nil
+	}
+	if c.authorizer == nil {
+		return fmt.Errorf("授权请求缺少认证器")
+	}
+	if err := c.authorizer.Inject(ctx, req); err != nil {
+		return fmt.Errorf("写入认证请求头失败: %w", err)
+	}
+	return nil
+}
+
+func (c *httpClient) isBaseURLOrigin(target *url.URL) (bool, error) {
+	if c.baseURL == "" {
+		return false, nil
+	}
+	base, err := url.Parse(c.baseURL)
+	if err != nil || base.Scheme == "" || base.Host == "" {
+		return false, fmt.Errorf("解析 base URL %q 失败", c.baseURL)
+	}
+	return sameOrigin(base, target), nil
+}
+
+func (c *httpClient) checkRedirect(req *http.Request, via []*http.Request) error {
+	if len(via) >= 10 {
+		return fmt.Errorf("停止重定向：已达到 10 次上限")
+	}
+	trusted, err := c.isBaseURLOrigin(req.URL)
+	if err != nil {
+		return err
+	}
+	initialTrusted, err := c.isBaseURLOrigin(via[0].URL)
+	if err != nil {
+		return err
+	}
+	if initialTrusted && !trusted {
+		// API requests may contain unreleased canvas data or upload metadata.
+		// Stripping credentials is insufficient because Go can preserve the
+		// method and body for 307/308 redirects. API calls have no valid reason
+		// to leave the configured origin, so reject the redirect entirely.
+		return fmt.Errorf("拒绝 Pippit API 跨域重定向到 %s", req.URL.Redacted())
+	}
+	if trusted {
+		// net/http may rebuild redirect headers from the original request. Once a
+		// chain has crossed an untrusted origin, never restore protected headers
+		// even if a later hop points back at the API origin.
+		for _, previous := range via {
+			previousTrusted, err := c.isBaseURLOrigin(previous.URL)
+			if err != nil {
+				return err
+			}
+			if !previousTrusted {
+				trusted = false
+				break
+			}
+		}
+	}
+	if !trusted {
+		req.Header.Del("Authorization")
+	}
+	return nil
+}
+
+func sameOrigin(a, b *url.URL) bool {
+	return strings.EqualFold(a.Scheme, b.Scheme) &&
+		strings.EqualFold(a.Hostname(), b.Hostname()) &&
+		effectivePort(a) == effectivePort(b)
+}
+
+func effectivePort(u *url.URL) string {
+	if port := u.Port(); port != "" {
+		return port
+	}
+	switch strings.ToLower(u.Scheme) {
+	case "http":
+		return "80"
+	case "https":
+		return "443"
+	default:
+		return ""
+	}
+}
+
 func (c *httpClient) do(req *http.Request, out any) error {
 	resp, err := c.httpClient.Do(req)
 	if err != nil {
@@ -240,7 +331,14 @@ func (c *httpClient) do(req *http.Request, out any) error {
 }
 
 func (c *httpClient) resolveURL(path string, query map[string]string) (string, error) {
-	if strings.HasPrefix(path, "http://") || strings.HasPrefix(path, "https://") {
+	parsed, err := url.Parse(path)
+	if err != nil {
+		return "", fmt.Errorf("解析 URL 失败: %w", err)
+	}
+	if parsed.IsAbs() {
+		if parsed.Host == "" || (parsed.Scheme != "http" && parsed.Scheme != "https") {
+			return "", fmt.Errorf("仅支持 http 或 https URL: %q", path)
+		}
 		return appendQuery(path, query)
 	}
 	if c.baseURL == "" {