{ "version": "API-REQ-0.1", "generated_at": "2026-09-11T20:18:19.609911+00:00", "summary": { "source_commit": "385d2dfd10d821b25c8a6766bd16eea248cb1652", "static_route_count": 381, "host_protocol_route_count": 6, "registered_method_path_count": 387, "openapi_operation_count": 199, "openapi_only_count": 12, "group_counts": { "core-admin": 36, "core-auth": 48, "core-billing": 61, "core-catalog": 26, "core-keys": 16, "core-usage": 16, "core-users": 15, "edge-compat": 49, "edge-media": 18, "edge-models": 18, "gateway-only": 84 }, "gap_counts": { "RESPONSE-SCHEMA-MISSING": 152, "OPENAPI-MISSING": 200, "AUTH-DOC-CONFLICT": 5, "IMPLEMENTATION-STUB": 12 }, "new_proposal_count": 18, "dynamic_plugin_manifest": "not available; variable deployment route set excluded and explicitly tracked", "runtime_verified": false }, "registered_interfaces": [ { "method": "GET", "path": "/api/about", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetAbout" ], "file": "router/api-router.go", "line": 33, "source_kind": "static", "id": "CORE-ADMIN-001", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取关于信息", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAbout", "file": "controller/misc.go", "line": 186 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/about", "operation": { "summary": "获取关于信息", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/audit", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.AuditRead)" ], "handlers": [ "controller.GetAuditLogs" ], "file": "router/api-router.go", "line": 309, "source_kind": "static", "id": "CORE-ADMIN-002", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetAuditLogs", "auth_requirement": "Admin 员工身份；authz.AuditRead", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "username", "in": "query", "source": "controller literal access" }, { "name": "category", "in": "query", "source": "controller literal access" }, { "name": "token_ref", "in": "query", "source": "controller literal access" }, { "name": "exclude_token_ref", "in": "query", "source": "controller literal access" }, { "name": "request_id", "in": "query", "source": "controller literal access" }, { "name": "success", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [ "end_timestamp", "start_timestamp" ], "handler_sources": [ { "symbol": "controller.GetAuditLogs", "file": "controller/access_token.go", "line": 66 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/audit/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetAuditLogs" ], "file": "router/api-router.go", "line": 310, "source_kind": "static", "id": "CORE-ADMIN-003", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetAuditLogs", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "username", "in": "query", "source": "controller literal access" }, { "name": "category", "in": "query", "source": "controller literal access" }, { "name": "token_ref", "in": "query", "source": "controller literal access" }, { "name": "exclude_token_ref", "in": "query", "source": "controller literal access" }, { "name": "request_id", "in": "query", "source": "controller literal access" }, { "name": "success", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [ "end_timestamp", "start_timestamp" ], "handler_sources": [ { "symbol": "controller.GetAuditLogs", "file": "controller/access_token.go", "line": 66 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/authz/catalog", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetPermissionCatalog" ], "file": "router/authz-router.go", "line": 17, "source_kind": "static", "id": "CORE-ADMIN-004", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetPermissionCatalog", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "resources", "roles", "success" ], "handler_sources": [ { "symbol": "controller.GetPermissionCatalog", "file": "controller/authz.go", "line": 15 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/custom-oauth-provider/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetCustomOAuthProviders" ], "file": "router/api-router.go", "line": 229, "source_kind": "static", "id": "CORE-ADMIN-005", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetCustomOAuthProviders", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetCustomOAuthProviders", "file": "controller/custom_oauth.go", "line": 75 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/custom-oauth-provider/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.CreateCustomOAuthProvider" ], "file": "router/api-router.go", "line": 231, "source_kind": "static", "id": "CORE-ADMIN-006", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "CreateCustomOAuthProvider", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.CreateCustomOAuthProviderRequest", "file": "controller/custom_oauth.go", "line": 117, "source": "CreateCustomOAuthProviderRequest struct {\n\tName string `json:\"name\" binding:\"required\"`\n\tSlug string `json:\"slug\" binding:\"required\"`\n\tIcon string `json:\"icon\"`\n\tEnabled bool `json:\"enabled\"`\n\tClientId string `json:\"client_id\" binding:\"required\"`\n\tClientSecret string `json:\"client_secret\" binding:\"required\"`\n\tAuthorizationEndpoint string `json:\"authorization_endpoint\" binding:\"required\"`\n\tTokenEndpoint string `json:\"token_endpoint\" binding:\"required\"`\n\tUserInfoEndpoint string `json:\"user_info_endpoint\" binding:\"required\"`\n\tScopes string `json:\"scopes\"`\n\tUserIdField string `json:\"user_id_field\"`\n\tUsernameField string `json:\"username_field\"`\n\tDisplayNameField string `json:\"display_name_field\"`\n\tEmailField string `json:\"email_field\"`\n\tWellKnown string `json:\"well_known\"`\n\tAuthStyle int `json:\"auth_style\"`\n\tAccessPolicy string `json:\"access_policy\"`\n\tAccessDeniedMessage string `json:\"access_denied_message\"`\n}" } ], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.CreateCustomOAuthProvider", "file": "controller/custom_oauth.go", "line": 216 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/custom-oauth-provider/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.DeleteCustomOAuthProvider" ], "file": "router/api-router.go", "line": 233, "source_kind": "static", "id": "CORE-ADMIN-007", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "DeleteCustomOAuthProvider", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteCustomOAuthProvider", "file": "controller/custom_oauth.go", "line": 405 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/custom-oauth-provider/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetCustomOAuthProvider" ], "file": "router/api-router.go", "line": 230, "source_kind": "static", "id": "CORE-ADMIN-008", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetCustomOAuthProvider", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetCustomOAuthProvider", "file": "controller/custom_oauth.go", "line": 95 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/custom-oauth-provider/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.UpdateCustomOAuthProvider" ], "file": "router/api-router.go", "line": 232, "source_kind": "static", "id": "CORE-ADMIN-009", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "UpdateCustomOAuthProvider", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.UpdateCustomOAuthProviderRequest", "file": "controller/custom_oauth.go", "line": 272, "source": "UpdateCustomOAuthProviderRequest struct {\n\tName string `json:\"name\"`\n\tSlug string `json:\"slug\"`\n\tIcon *string `json:\"icon\"`\n\tEnabled *bool `json:\"enabled\"`\n\tClientId string `json:\"client_id\"`\n\tClientSecret string `json:\"client_secret\"`\n\tAuthorizationEndpoint string `json:\"authorization_endpoint\"`\n\tTokenEndpoint string `json:\"token_endpoint\"`\n\tUserInfoEndpoint string `json:\"user_info_endpoint\"`\n\tScopes string `json:\"scopes\"`\n\tUserIdField string `json:\"user_id_field\"`\n\tUsernameField string `json:\"username_field\"`\n\tDisplayNameField string `json:\"display_name_field\"`\n\tEmailField string `json:\"email_field\"`\n\tWellKnown *string `json:\"well_known\"`\n\tAuthStyle *int `json:\"auth_style\"`\n\tAccessPolicy *string `json:\"access_policy\"`\n\tAccessDeniedMessage *string `json:\"access_denied_message\"`\n}" } ], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.UpdateCustomOAuthProvider", "file": "controller/custom_oauth.go", "line": 294 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/custom-oauth-provider/discovery", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.FetchCustomOAuthDiscovery" ], "file": "router/api-router.go", "line": 228, "source_kind": "static", "id": "CORE-ADMIN-010", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "FetchCustomOAuthDiscovery", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.FetchCustomOAuthDiscoveryRequest", "file": "controller/custom_oauth.go", "line": 138, "source": "FetchCustomOAuthDiscoveryRequest struct {\n\tWellKnownURL string `json:\"well_known_url\"`\n\tIssuerURL string `json:\"issuer_url\"`\n}" } ], "observed_literal_keys": [ "data", "discovery", "message", "success", "well_known_url" ], "handler_sources": [ { "symbol": "controller.FetchCustomOAuthDiscovery", "file": "controller/custom_oauth.go", "line": 144 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/home_page_content", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetHomePageContent" ], "file": "router/api-router.go", "line": 35, "source_kind": "static", "id": "CORE-ADMIN-011", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取首页内容", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetHomePageContent", "file": "controller/misc.go", "line": 212 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/home_page_content", "operation": { "summary": "获取首页内容", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/notice", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetNotice" ], "file": "router/api-router.go", "line": 30, "source_kind": "static", "id": "CORE-ADMIN-012", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取公告", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetNotice", "file": "controller/misc.go", "line": 179 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/notice", "operation": { "summary": "获取公告", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/option/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetOptions" ], "file": "router/api-router.go", "line": 206, "source_kind": "static", "id": "CORE-ADMIN-013", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取系统选项", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetOptions", "file": "controller/option.go", "line": 84 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/option/", "operation": { "summary": "获取系统选项", "deprecated": false, "description": "👑 需要超级管理员权限（Root）。已退役的 theme.frontend 不在列表中返回。", "tags": [ "系统设置" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/option/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.UpdateOption" ], "file": "router/api-router.go", "line": 207, "source_kind": "static", "id": "CORE-ADMIN-014", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新系统选项", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.OptionUpdateRequest", "file": "controller/option.go", "line": 134, "source": "OptionUpdateRequest struct {\n\tKey string `json:\"key\"`\n\tValue any `json:\"value\"`\n}" } ], "observed_literal_keys": [ "AudioCompletionRatio", "AudioRatio", "AutomaticDisableStatusCodes", "AutomaticRetryStatusCodes", "CreateCacheRatio", "EmailDomainRestrictionEnabled", "GitHubOAuthEnabled", "GroupRatio", "ImageRatio", "LinuxDOOAuthEnabled", "ModelRequestRateLimitGroup", "QuotaForInvitee", "TelegramOAuthEnabled", "TurnstileCheckEnabled", "WeChatAuthEnabled", "code", "key", "message", "success" ], "handler_sources": [ { "symbol": "controller.UpdateOption", "file": "controller/option.go", "line": 183 } ], "source_behavior_markers": [ "MsgPaymentComplianceRequired" ], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/option/", "operation": { "summary": "更新系统选项", "deprecated": false, "description": "👑 需要超级管理员权限（Root）。兼容期内 theme.frontend=default 可幂等写入，其他主题值会被拒绝。", "tags": [ "系统设置" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/option/passkey/domains", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.UpdatePasskeyDomains" ], "file": "router/api-router.go", "line": 208, "source_kind": "static", "id": "CORE-ADMIN-015", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "UpdatePasskeyDomains", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "rp_id", "go_type": "*string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "legacy_rp_ids", "go_type": "*string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "origins", "go_type": "*string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "preview", "go_type": "bool", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "removal_confirmation", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.UpdatePasskeyDomains", "file": "controller/option.go", "line": 139 } ], "source_behavior_markers": [ "MsgInvalidParams" ], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/option/rest_model_ratio", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ResetModelRatio" ], "file": "router/api-router.go", "line": 216, "source_kind": "static", "id": "CORE-ADMIN-016", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "重置模型倍率", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.ResetModelRatio", "file": "controller/pricing.go", "line": 79 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/option/rest_model_ratio", "operation": { "summary": "重置模型倍率", "deprecated": false, "description": "👑 需要超级管理员权限（Root）", "tags": [ "系统设置" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/option/waffo-pancake/save", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.SaveWaffoPancake" ], "file": "router/api-router.go", "line": 219, "source_kind": "static", "id": "CORE-ADMIN-017", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SaveWaffoPancake", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.saveWaffoPancakeRequest", "file": "controller/topup_waffo_pancake.go", "line": 109, "source": "saveWaffoPancakeRequest struct {\n\tMerchantID string `json:\"merchant_id\"`\n\tPrivateKey string `json:\"private_key\"`\n\tReturnURL string `json:\"return_url\"`\n\tStoreID string `json:\"store_id\"`\n\tProductID string `json:\"product_id\"`\n}" } ], "observed_literal_keys": [ "data", "message", "product_id", "store_id" ], "handler_sources": [ { "symbol": "controller.SaveWaffoPancake", "file": "controller/topup_waffo_pancake.go", "line": 125 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/performance/disk_cache", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ClearDiskCache" ], "file": "router/api-router.go", "line": 239, "source_kind": "static", "id": "CORE-ADMIN-018", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ClearDiskCache", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.ClearDiskCache", "file": "controller/performance.go", "line": 143 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/performance/gc", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ForceGC" ], "file": "router/api-router.go", "line": 241, "source_kind": "static", "id": "CORE-ADMIN-019", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ForceGC", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.ForceGC", "file": "controller/performance.go", "line": 169 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/performance/logs", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.CleanupLogFiles" ], "file": "router/api-router.go", "line": 243, "source_kind": "static", "id": "CORE-ADMIN-020", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "CleanupLogFiles", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "mode", "in": "query", "source": "controller literal access" }, { "name": "value", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "by_count", "by_days", "data", "deleted_count", "failed_files", "freed_bytes", "message", "success" ], "handler_sources": [ { "symbol": "controller.CleanupLogFiles", "file": "controller/performance.go", "line": 268 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/performance/logs", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetLogFiles" ], "file": "router/api-router.go", "line": 242, "source_kind": "static", "id": "CORE-ADMIN-021", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetLogFiles", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetLogFiles", "file": "controller/performance.go", "line": 232 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/performance/reset_stats", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ResetPerformanceStats" ], "file": "router/api-router.go", "line": 240, "source_kind": "static", "id": "CORE-ADMIN-022", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ResetPerformanceStats", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.ResetPerformanceStats", "file": "controller/performance.go", "line": 159 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/performance/stats", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetPerformanceStats" ], "file": "router/api-router.go", "line": 238, "source_kind": "static", "id": "CORE-ADMIN-023", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetPerformanceStats", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "success" ], "handler_sources": [ { "symbol": "controller.GetPerformanceStats", "file": "controller/performance.go", "line": 83 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/privacy-policy", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetPrivacyPolicy" ], "file": "router/api-router.go", "line": 32, "source_kind": "static", "id": "CORE-ADMIN-024", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取隐私政策", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetPrivacyPolicy", "file": "controller/misc.go", "line": 197 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/privacy-policy", "operation": { "summary": "获取隐私政策", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/setup", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetSetup" ], "file": "router/api-router.go", "line": 24, "source_kind": "static", "id": "CORE-ADMIN-025", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取初始化状态", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "success" ], "handler_sources": [ { "symbol": "controller.GetSetup", "file": "controller/setup.go", "line": 27 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/setup", "operation": { "summary": "获取初始化状态", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/setup", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.PostSetup" ], "file": "router/api-router.go", "line": 25, "source_kind": "static", "id": "CORE-ADMIN-026", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "初始化系统", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [ { "name": "username", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "password", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.SetupRequest", "file": "controller/setup.go", "line": 19, "source": "SetupRequest struct {\n\tUsername string `json:\"username\"`\n\tPassword string `json:\"password\"`\n\tConfirmPassword string `json:\"confirmPassword\"`\n\tSelfUseModeEnabled bool `json:\"SelfUseModeEnabled\"`\n\tDemoSiteEnabled bool `json:\"DemoSiteEnabled\"`\n}" } ], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.PostSetup", "file": "controller/setup.go", "line": 46 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/setup", "operation": { "summary": "初始化系统", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "username": { "type": "string" }, "password": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/status", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetStatus" ], "file": "router/api-router.go", "line": 26, "source_kind": "static", "id": "CORE-ADMIN-027", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取系统状态", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "HeaderNavModules", "SidebarModulesAdmin", "announcements_enabled", "api_info_enabled", "chats", "checkin_enabled", "custom_currency_exchange_rate", "custom_currency_symbol", "data", "data_export_default_time", "default_collapse_sidebar", "default_use_auto_group", "demo_site_enabled", "discord_client_id", "discord_oauth", "display_in_currency", "docs_link", "email_verification", "enable_batch_update", "enable_data_export", "enable_drawing", "enable_task", "faq_enabled", "footer_html", "github_client_id", "github_oauth", "linuxdo_client_id", "linuxdo_minimum_trust_level", "linuxdo_oauth", "logo", "message", "mj_notify_enabled", "oidc_authorization_endpoint", "oidc_client_id", "oidc_display_name", "oidc_enabled", "passkey_allow_insecure", "passkey_attachment", "passkey_display_name", "passkey_login", "passkey_origins", "passkey_rp_id", "passkey_rp_ids", "passkey_user_verification", "password_login_enabled", "password_login_encryption_enabled", "password_register_enabled", "price", "privacy_policy_enabled", "quota_display_type", "quota_per_unit", "register_enabled", "self_use_mode_enabled", "server_address", "setup", "start_time", "stripe_unit_price", "success", "system_name", "telegram_bot_name", "telegram_oauth", "telegram_oauth_configured", "theme", "turnstile_check", "turnstile_site_key", "uptime_kuma_enabled", "usd_exchange_rate", "user_agreement_enabled", "version", "wechat_login", "wechat_qrcode" ], "handler_sources": [ { "symbol": "controller.GetStatus", "file": "controller/misc.go", "line": 44 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/status", "operation": { "summary": "获取系统状态", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/status/test", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.TestStatus" ], "file": "router/api-router.go", "line": 29, "source_kind": "static", "id": "CORE-ADMIN-028", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "测试系统状态", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "http_stats", "message", "success" ], "handler_sources": [ { "symbol": "controller.TestStatus", "file": "controller/misc.go", "line": 25 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/status/test", "operation": { "summary": "测试系统状态", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/system-info/instances", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ListSystemInstances" ], "file": "router/api-router.go", "line": 331, "source_kind": "static", "id": "CORE-ADMIN-029", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ListSystemInstances", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.ListSystemInstances", "file": "controller/system_info.go", "line": 13 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/system-info/instances/:node_name", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.DeleteStaleSystemInstance" ], "file": "router/api-router.go", "line": 333, "source_kind": "static", "id": "CORE-ADMIN-030", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "DeleteStaleSystemInstance", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "node_name", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "deleted_count" ], "handler_sources": [ { "symbol": "controller.DeleteStaleSystemInstance", "file": "controller/system_info.go", "line": 45 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/system-info/stale-instances", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.DeleteStaleSystemInstances" ], "file": "router/api-router.go", "line": 332, "source_kind": "static", "id": "CORE-ADMIN-031", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "DeleteStaleSystemInstances", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "deleted_count" ], "handler_sources": [ { "symbol": "controller.DeleteStaleSystemInstances", "file": "controller/system_info.go", "line": 33 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/system-task/:task_id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetSystemTask" ], "file": "router/api-router.go", "line": 326, "source_kind": "static", "id": "CORE-ADMIN-032", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetSystemTask", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "task_id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetSystemTask", "file": "controller/system_task.go", "line": 89 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/system-task/current", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetCurrentSystemTask" ], "file": "router/api-router.go", "line": 325, "source_kind": "static", "id": "CORE-ADMIN-033", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetCurrentSystemTask", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "type", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetCurrentSystemTask", "file": "controller/system_task.go", "line": 37 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/system-task/list", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ListSystemTasks" ], "file": "router/api-router.go", "line": 324, "source_kind": "static", "id": "CORE-ADMIN-034", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ListSystemTasks", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "limit", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.ListSystemTasks", "file": "controller/system_task.go", "line": 68 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/system-task/log-cleanup", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.CreateLogCleanupSystemTask" ], "file": "router/api-router.go", "line": 323, "source_kind": "static", "id": "CORE-ADMIN-035", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建日志清理任务", "auth_requirement": "Root 管理身份", "parameters": [ { "name": "target_timestamp", "in": "query", "required": true, "schema": { "type": "integer", "format": "int64" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功创建任务或返回参数错误", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "target_timestamp", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.CreateLogCleanupSystemTask", "file": "controller/system_task.go", "line": 14 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/system-task/log-cleanup", "operation": { "summary": "创建日志清理任务", "deprecated": false, "description": "👑 需要超级管理员权限（Root）。使用 target_timestamp 指定需清理的历史日志边界，并返回异步系统任务。", "tags": [ "日志" ], "parameters": [ { "name": "target_timestamp", "in": "query", "required": true, "schema": { "type": "integer", "format": "int64" } } ], "responses": { "200": { "description": "成功创建任务或返回参数错误", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/uptime/status", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetUptimeKumaStatus" ], "file": "router/api-router.go", "line": 27, "source_kind": "static", "id": "CORE-ADMIN-036", "group": "core-admin", "owner": "Core", "phase": "CE-02/04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取Uptime Kuma状态", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetUptimeKumaStatus", "file": "controller/uptime_kuma.go", "line": 131 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/uptime/status", "operation": { "summary": "获取Uptime Kuma状态", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按配置项/操作收敛权限，不能因沿用 /api/option/ 就将全部供应配置交给客户平台。重要变更记录操作者、对象和结果；对现有高权限接口优先保持收敛访问，不凭前端菜单控制权限。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/oauth/:provider", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()", "middleware.TryUserAuth()" ], "handlers": [ "controller.HandleOAuth" ], "file": "router/api-router.go", "line": 59, "source_kind": "static", "id": "CORE-AUTH-001", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "HandleOAuth", "auth_requirement": "可选客户身份，匿名行为按处理器与配置；处理器安全证明用途：VerificationScopeAccountBind", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccountBind" ], "parameters": [ { "name": "provider", "in": "path", "source": "controller literal access" }, { "name": "state", "in": "query", "source": "controller literal access" }, { "name": "error", "in": "query", "source": "controller literal access" }, { "name": "error_description", "in": "query", "source": "controller literal access" }, { "name": "code", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "notification_failed", "provider", "success" ], "handler_sources": [ { "symbol": "controller.HandleOAuth", "file": "controller/oauth.go", "line": 146 } ], "source_behavior_markers": [ "MsgInvalidParams", "MsgOAuthNotEnabled", "MsgOAuthStateInvalid", "MsgOAuthUnknownProvider" ], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/oauth/email/bind", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.UserCriticalRateLimit(\"account-security\")", "middleware.DisableCache()" ], "handlers": [ "controller.EmailBind" ], "file": "router/api-router.go", "line": 51, "source_kind": "static", "id": "CORE-AUTH-002", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "绑定邮箱", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [ { "name": "email", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "format": "email" }, { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.emailBindRequest", "file": "controller/email_binding.go", "line": 13, "source": "emailBindRequest struct {\n\tEmail string `json:\"email\"`\n\tFlowToken string `json:\"flow_token\"`\n\tNewCode string `json:\"new_code\"`\n\tOldCode string `json:\"old_code\"`\n}" } ], "observed_literal_keys": [ "data", "message", "notification_failed", "notification_warning", "provider", "success" ], "handler_sources": [ { "symbol": "controller.EmailBind", "file": "controller/email_binding.go", "line": 82 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/oauth/email/bind", "operation": { "summary": "绑定邮箱", "deprecated": false, "description": "🔐 需要面板 Access Token", "tags": [ "OAuth" ], "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "email", "code" ], "properties": { "email": { "type": "string", "format": "email" }, "code": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "AccessToken1": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/oauth/email/bind/resend", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.UserCriticalRateLimit(\"account-security\")", "middleware.EmailVerificationRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.EmailBindResend" ], "file": "router/api-router.go", "line": 50, "source_kind": "static", "id": "CORE-AUTH-003", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "EmailBindResend", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.emailBindRequest", "file": "controller/email_binding.go", "line": 13, "source": "emailBindRequest struct {\n\tEmail string `json:\"email\"`\n\tFlowToken string `json:\"flow_token\"`\n\tNewCode string `json:\"new_code\"`\n\tOldCode string `json:\"old_code\"`\n}" } ], "observed_literal_keys": [ "success" ], "handler_sources": [ { "symbol": "controller.EmailBindResend", "file": "controller/email_binding.go", "line": 58 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/oauth/email/bind/start", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.UserCriticalRateLimit(\"account-security\")", "middleware.EmailVerificationRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.EmailBindStart" ], "file": "router/api-router.go", "line": 49, "source_kind": "static", "id": "CORE-AUTH-004", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "EmailBindStart", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeAccountBind", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccountBind" ], "parameters": [], "body_types": [ { "type": "controller.emailBindRequest", "file": "controller/email_binding.go", "line": 13, "source": "emailBindRequest struct {\n\tEmail string `json:\"email\"`\n\tFlowToken string `json:\"flow_token\"`\n\tNewCode string `json:\"new_code\"`\n\tOldCode string `json:\"old_code\"`\n}" } ], "observed_literal_keys": [ "notification_failed", "provider", "success" ], "handler_sources": [ { "symbol": "controller.EmailBindStart", "file": "controller/email_binding.go", "line": 20 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/oauth/state", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()", "middleware.TryUserAuth()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.GenerateOAuthCode" ], "file": "router/api-router.go", "line": 48, "source_kind": "static", "id": "CORE-AUTH-005", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "生成OAuth State", "auth_requirement": "可选客户身份，匿名行为按处理器与配置；处理器安全证明用途：VerificationScopeAccountBind", "parameters": [], "request_fields": [ { "name": "provider", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "intent", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "login", "bind" ] }, { "name": "aff", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "仅 login intent 可用的 affiliate code" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccountBind" ], "parameters": [], "body_types": [ { "type": "controller.oauthStateRequest", "file": "controller/oauth.go", "line": 24, "source": "oauthStateRequest struct {\n\tProvider string `json:\"provider\"`\n\tIntent string `json:\"intent\"`\n\tAff string `json:\"aff,omitempty\"`\n\tScope string `json:\"scope,omitempty\"`\n\tContext json.RawMessage `json:\"context,omitempty\"`\n}" } ], "observed_literal_keys": [ "data", "expires_at", "flow_token", "message", "provider", "success" ], "handler_sources": [ { "symbol": "controller.GenerateOAuthCode", "file": "controller/oauth.go", "line": 46 } ], "source_behavior_markers": [ "MsgInvalidParams" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/oauth/state", "operation": { "summary": "生成OAuth State", "deprecated": false, "description": "创建一次性 OAuth AuthFlow。login 无需鉴权；bind 需要面板 Access Token 并绑定当前登录会话", "tags": [ "OAuth" ], "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "provider", "intent" ], "properties": { "provider": { "type": "string" }, "intent": { "type": "string", "enum": [ "login", "bind" ] }, "aff": { "type": "string", "description": "仅 login intent 可用的 affiliate code" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/oauth/telegram/bind/:flow_token", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.TelegramLegacyAuth" ], "file": "router/api-router.go", "line": 57, "source_kind": "static", "id": "CORE-AUTH-006", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "完成 Telegram 绑定", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [ { "name": "flow_token", "in": "path", "required": true, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "302", "description": "重定向到 /oauth/telegram 的绑定结果回调", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "message", "success" ], "handler_sources": [ { "symbol": "controller.TelegramLegacyAuth", "file": "controller/telegram.go", "line": 11 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/oauth/telegram/bind/{flow_token}", "operation": { "summary": "完成 Telegram 绑定", "deprecated": false, "description": "Telegram widget 回调；通过一次性 flow_token 关联并重新校验创建该流程的登录会话。始终以 302 回到 /oauth/telegram：成功携带 telegram_bind=success，失败携带 telegram_bind=error、flow_token 和稳定 error_code（TELEGRAM_BIND_DISABLED、TELEGRAM_BIND_INVALID_REQUEST、TELEGRAM_BIND_FLOW_INVALID、TELEGRAM_BIND_SESSION_INVALID、TELEGRAM_BIND_ALREADY_BOUND、TELEGRAM_BIND_USER_DELETED、TELEGRAM_BIND_USER_DISABLED 或 TELEGRAM_BIND_INTERNAL_ERROR），不会透传底层错误文案。", "tags": [ "OAuth" ], "parameters": [ { "name": "flow_token", "in": "path", "required": true, "schema": { "type": "string" } } ], "responses": { "302": { "description": "重定向到 /oauth/telegram 的绑定结果回调", "headers": {} } }, "security": [] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/oauth/telegram/bind/start", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.TelegramLegacyAuth" ], "file": "router/api-router.go", "line": 56, "source_kind": "static", "id": "CORE-AUTH-007", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建 Telegram 绑定流程", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "message", "success" ], "handler_sources": [ { "symbol": "controller.TelegramLegacyAuth", "file": "controller/telegram.go", "line": 11 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/oauth/telegram/bind/start", "operation": { "summary": "创建 Telegram 绑定流程", "deprecated": false, "description": "🔐 需要面板 Access Token；返回绑定 widget 使用的一次性 flow_token 与 callback_url", "tags": [ "OAuth" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "AccessToken1": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/oauth/telegram/login", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.TelegramLegacyAuth" ], "file": "router/api-router.go", "line": 55, "source_kind": "static", "id": "CORE-AUTH-008", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "Telegram登录", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} }, { "status": "409", "description": "", "content": {} }, { "status": "429", "description": "", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "message", "success" ], "handler_sources": [ { "symbol": "controller.TelegramLegacyAuth", "file": "controller/telegram.go", "line": 11 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/oauth/telegram/login", "operation": { "summary": "Telegram登录", "deprecated": false, "description": "🔓 无需鉴权（OAuth 回调）。创建本地登录 Session 时同样受 AUTH_SESSION_LIMIT 和 AUTH_SESSION_ISSUANCE_LIMIT 约束。", "tags": [ "OAuth" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "$ref": "#/components/responses/AuthSessionLimit" }, "429": { "$ref": "#/components/responses/AuthSessionIssuanceLimit" } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐", "AUTH-DOC-CONFLICT：登录 OpenAPI 的 security 与路由用途不一致，以真实处理器链为准" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/oauth/wechat", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.WeChatAuth" ], "file": "router/api-router.go", "line": 53, "source_kind": "static", "id": "CORE-AUTH-009", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "微信OAuth登录", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} }, { "status": "409", "description": "", "content": {} }, { "status": "429", "description": "", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "code", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.WeChatAuth", "file": "controller/wechat.go", "line": 58 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/oauth/wechat", "operation": { "summary": "微信OAuth登录", "deprecated": false, "description": "🔓 无需鉴权（OAuth 回调）。创建本地登录 Session 时同样受 AUTH_SESSION_LIMIT 和 AUTH_SESSION_ISSUANCE_LIMIT 约束。", "tags": [ "OAuth" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "$ref": "#/components/responses/AuthSessionLimit" }, "429": { "$ref": "#/components/responses/AuthSessionIssuanceLimit" } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/oauth/wechat/bind", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.WeChatBind" ], "file": "router/api-router.go", "line": 54, "source_kind": "static", "id": "CORE-AUTH-010", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "绑定微信", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeAccountBind", "parameters": [], "request_fields": [ { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccountBind" ], "parameters": [], "body_types": [ { "type": "controller.wechatBindRequest", "file": "controller/wechat.go", "line": 127, "source": "wechatBindRequest struct {\n\tCode string `json:\"code\"`\n}" } ], "observed_literal_keys": [ "data", "message", "notification_failed", "notification_warning", "provider", "success" ], "handler_sources": [ { "symbol": "controller.WeChatBind", "file": "controller/wechat.go", "line": 131 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/oauth/wechat/bind", "operation": { "summary": "绑定微信", "deprecated": false, "description": "🔐 需要面板 Access Token", "tags": [ "OAuth" ], "parameters": [], "requestBody": { "required": true, "content": { "application/json": { "schema": { "type": "object", "required": [ "code" ], "properties": { "code": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "AccessToken1": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/reset_password", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.TurnstileCheck()" ], "handlers": [ "controller.SendPasswordResetEmail" ], "file": "router/api-router.go", "line": 45, "source_kind": "static", "id": "CORE-AUTH-011", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "发送密码重置邮件", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [ { "name": "email", "in": "query", "description": "", "required": true, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "email", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.SendPasswordResetEmail", "file": "controller/misc.go", "line": 248 } ], "source_behavior_markers": [ "MsgInvalidParams" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/reset_password", "operation": { "summary": "发送密码重置邮件", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "用户登陆注册" ], "parameters": [ { "name": "email", "in": "query", "description": "", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/2fa/backup_codes", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.RegenerateBackupCodes" ], "file": "router/api-router.go", "line": 133, "source_kind": "static", "id": "CORE-AUTH-012", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "重新生成备用码", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeTwoFABackupCodes", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeTwoFABackupCodes" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.RegenerateBackupCodes", "file": "controller/twofa.go", "line": 126 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/2fa/backup_codes", "operation": { "summary": "重新生成备用码", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "两步验证" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/2fa/disable", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.Disable2FA" ], "file": "router/api-router.go", "line": 132, "source_kind": "static", "id": "CORE-AUTH-013", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "禁用2FA", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeTwoFADisable", "parameters": [], "request_fields": [ { "name": "code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeTwoFADisable" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.Disable2FA", "file": "controller/twofa.go", "line": 63 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/2fa/disable", "operation": { "summary": "禁用2FA", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "两步验证" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "code": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/2fa/enable", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.UserCriticalRateLimit(\"security-verification\")", "middleware.DisableCache()" ], "handlers": [ "controller.Enable2FA" ], "file": "router/api-router.go", "line": 131, "source_kind": "static", "id": "CORE-AUTH-014", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "启用2FA", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [ { "name": "code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.Verify2FARequest", "file": "controller/twofa.go", "line": 18, "source": "Verify2FARequest struct {\n\tCode string `json:\"code\" binding:\"required\"`\n\tFlowToken string `json:\"flow_token,omitempty\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.Enable2FA", "file": "controller/twofa.go", "line": 38 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/2fa/enable", "operation": { "summary": "启用2FA", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "两步验证" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "code": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/2fa/setup", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.UserCriticalRateLimit(\"security-verification\")", "middleware.DisableCache()" ], "handlers": [ "controller.Setup2FA" ], "file": "router/api-router.go", "line": 130, "source_kind": "static", "id": "CORE-AUTH-015", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "设置2FA", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeTwoFASetup", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeTwoFASetup" ], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.Setup2FA", "file": "controller/twofa.go", "line": 23 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/2fa/setup", "operation": { "summary": "设置2FA", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "两步验证" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/2fa/stats", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.Admin2FAStats" ], "file": "router/api-router.go", "line": 162, "source_kind": "static", "id": "CORE-AUTH-016", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取2FA统计", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.Admin2FAStats", "file": "controller/twofa.go", "line": 176 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/2fa/stats", "operation": { "summary": "获取2FA统计", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "两步验证" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/2fa/status", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.Get2FAStatus" ], "file": "router/api-router.go", "line": 129, "source_kind": "static", "id": "CORE-AUTH-017", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取2FA状态", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "enabled", "locked", "message", "success" ], "handler_sources": [ { "symbol": "controller.Get2FAStatus", "file": "controller/twofa.go", "line": 90 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/2fa/status", "operation": { "summary": "获取2FA状态", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "两步验证" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/:id/2fa", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminDisable2FA" ], "file": "router/api-router.go", "line": 163, "source_kind": "static", "id": "CORE-AUTH-018", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "管理员禁用用户2FA", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.AdminDisable2FA", "file": "controller/twofa.go", "line": 191 } ], "source_behavior_markers": [ "MsgUserNotExists" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/{id}/2fa", "operation": { "summary": "管理员禁用用户2FA", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/:id/bindings/:binding_type", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminClearUserBinding" ], "file": "router/api-router.go", "line": 153, "source_kind": "static", "id": "CORE-AUTH-019", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminClearUserBinding", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" }, { "name": "binding_type", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "bindingType", "message", "success", "username" ], "handler_sources": [ { "symbol": "controller.AdminClearUserBinding", "file": "controller/user.go", "line": 718 } ], "source_behavior_markers": [ "MsgInvalidParams", "MsgUserNoPermissionSameLevel" ], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/:id/oauth/bindings", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetUserOAuthBindingsByAdmin" ], "file": "router/api-router.go", "line": 151, "source_kind": "static", "id": "CORE-AUTH-020", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetUserOAuthBindingsByAdmin", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetUserOAuthBindingsByAdmin", "file": "controller/custom_oauth.go", "line": 491 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/:id/oauth/bindings/:provider_id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UnbindCustomOAuthByAdmin" ], "file": "router/api-router.go", "line": 152, "source_kind": "static", "id": "CORE-AUTH-021", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "UnbindCustomOAuthByAdmin", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" }, { "name": "provider_id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.UnbindCustomOAuthByAdmin", "file": "controller/custom_oauth.go", "line": 570 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/:id/reset_passkey", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminResetPasskey" ], "file": "router/api-router.go", "line": 159, "source_kind": "static", "id": "CORE-AUTH-022", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "管理员重置用户Passkey", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "id", "message", "success", "username" ], "handler_sources": [ { "symbol": "controller.AdminResetPasskey", "file": "controller/passkey.go", "line": 443 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/{id}/reset_passkey", "operation": { "summary": "管理员重置用户Passkey", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/auth/logout", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.SessionCookieOriginGuard()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.AuthLogout" ], "file": "router/api-router.go", "line": 76, "source_kind": "static", "id": "CORE-AUTH-023", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "撤销当前登录会话", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验；会话 Cookie 与 Origin 校验", "parameters": [ { "name": "X-Auth-Session", "in": "header", "description": "可选的预期登录会话 SID", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "X-Auth-Session", "in": "header", "source": "controller literal access" }, { "name": "Authorization", "in": "header", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "cookie_cleared", "data", "message", "revoked_sid", "success" ], "handler_sources": [ { "symbol": "controller.AuthLogout", "file": "controller/auth_session.go", "line": 47 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/auth/logout", "operation": { "summary": "撤销当前登录会话", "deprecated": false, "description": "撤销明确的 Bearer/X-Auth-Session 会话；仅当 HttpOnly Refresh Cookie 属于同一 SID 时才撤销并清除 Cookie，避免跨标签页误踢其他账号。SESSION_COOKIE_SECURE=true 时要求同源或可信 Origin，false/未配置时保持本地 HTTP 兼容模式。", "tags": [ "用户登陆注册" ], "parameters": [ { "name": "X-Auth-Session", "in": "header", "description": "可选的预期登录会话 SID", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "Refresh Cookie 或 Authorization 中有效访问凭据，X-Auth-Session 可指定预期 Session；无必填 JSON。", "result": "success/message；访问令牌分支 data.revoked_sid 与 cookie_cleared；无 Cookie 分支清理后仍可成功。不能将退出一个 Session 当退出全部设备。", "checks": "退出当前 Session、Cookie 与预期 SID 冲突、访问令牌分支、无 Cookie 重复退出、其他设备不被误撤销。" } }, { "method": "POST", "path": "/api/user/auth/refresh", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.SessionCookieOriginGuard()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.RefreshAuth" ], "file": "router/api-router.go", "line": 75, "source_kind": "static", "id": "CORE-AUTH-024", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "刷新面板登录", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验；会话 Cookie 与 Origin 校验", "parameters": [ { "name": "X-Auth-Session", "in": "header", "description": "可选的预期登录会话 SID；冷启动时可省略", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} }, { "status": "409", "description": "X-Auth-Session 与 Refresh Cookie 的 SID 不一致；不修改 Cookie 或会话", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "X-Auth-Session", "in": "header", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "access_expires_at", "access_token", "data", "message", "session", "success", "token_type", "user" ], "handler_sources": [ { "symbol": "controller.RefreshAuth", "file": "controller/auth_session.go", "line": 17 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/auth/refresh", "operation": { "summary": "刷新面板登录", "deprecated": false, "description": "使用 HttpOnly Refresh Cookie 轮换刷新令牌并返回新的 AuthBundle；SESSION_COOKIE_SECURE=true 时要求同源或可信 Origin，false/未配置时保持本地 HTTP 兼容模式。已有内存会话时通过 X-Auth-Session 绑定预期 SID，Cookie 不匹配返回 409 AUTH_SESSION_MISMATCH 且不修改 Cookie。", "tags": [ "用户登陆注册" ], "parameters": [ { "name": "X-Auth-Session", "in": "header", "description": "可选的预期登录会话 SID；冷启动时可省略", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "description": "X-Auth-Session 与 Refresh Cookie 的 SID 不一致；不修改 Cookie 或会话", "headers": {} } }, "security": [] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "Refresh Cookie 必需；X-Auth-Session 按原会话校验；无额外必填 JSON。保留 Cookie Origin Guard 与 NoStore。", "result": "success/message/data；data.access_token、token_type、access_expires_at、user、session，写入轮换后的刷新 Cookie。无效或已撤销刷新令牌按原逻辑清 Cookie。", "checks": "正常刷新、缺 Cookie、无效/撤销、Session 不匹配、跨 Origin、轮换与过期，不泄漏刷新令牌到日志。" } }, { "method": "POST", "path": "/api/user/login", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()", "middleware.TurnstileCheck()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.Login" ], "file": "router/api-router.go", "line": 79, "source_kind": "static", "id": "CORE-AUTH-025", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "用户登录", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [ { "name": "username", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "password", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} }, { "status": "409", "description": "该用户的活跃登录 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" }, "fields": [ { "name": "success", "type": "boolean", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ false ] }, { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "AUTH_SESSION_LIMIT", "AUTH_SESSION_ISSUANCE_LIMIT" ] }, { "name": "message", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ] } } }, { "status": "429", "description": "该用户在统计窗口内创建的 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" }, "fields": [ { "name": "success", "type": "boolean", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ false ] }, { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "AUTH_SESSION_LIMIT", "AUTH_SESSION_ISSUANCE_LIMIT" ] }, { "name": "message", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.LoginRequest", "file": "controller/user.go", "line": 29, "source": "LoginRequest struct {\n\tUsername string `json:\"username\"`\n\tPassword string `json:\"password\"`\n\tPasswordEncrypted string `json:\"password_encrypted\"`\n\tEncryptionKeyID string `json:\"encryption_key_id\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.Login", "file": "controller/user.go", "line": 53 } ], "source_behavior_markers": [ "MsgDatabaseError", "MsgInvalidParams", "MsgUserPasswordLoginDisabled", "MsgUserUsernameOrPasswordError" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/login", "operation": { "summary": "用户登录", "deprecated": false, "description": "🔓 无需鉴权。签发新登录 Session 时可能返回 409 AUTH_SESSION_LIMIT 或 429 AUTH_SESSION_ISSUANCE_LIMIT。", "tags": [ "用户登陆注册" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "username": { "type": "string" }, "password": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} }, "409": { "description": "该用户的活跃登录 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" } } } }, "429": { "description": "该用户在统计窗口内创建的 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" } } } } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "AUTH-DOC-CONFLICT：登录 OpenAPI 的 security 与路由用途不一致，以真实处理器链为准" ], "runtime_verified": false, "override": { "input": "JSON：username 必填；password 与 password_encrypted + encryption_key_id 按密码加密配置选择，启用加密时两项加密字段必需。验证码/二次验证沿用原登录流程。", "result": "返回原登录成功/后续验证响应，设置并保护原会话凭据；409 AUTH_SESSION_LIMIT 与 429 AUTH_SESSION_ISSUANCE_LIMIT 不能显示为密码错误。", "checks": "普通/加密登录、缺少字段、错误密码、关闭密码登录、2FA 分支、会话上限、刷新后撤销。" } }, { "method": "POST", "path": "/api/user/login/2fa", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.Verify2FALogin" ], "file": "router/api-router.go", "line": 80, "source_kind": "static", "id": "CORE-AUTH-026", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "两步验证登录", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [ { "name": "code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "flow_token", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "密码校验成功后返回的一次性 2FA 登录流程令牌" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} }, { "status": "409", "description": "该用户的活跃登录 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" }, "fields": [ { "name": "success", "type": "boolean", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ false ] }, { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "AUTH_SESSION_LIMIT", "AUTH_SESSION_ISSUANCE_LIMIT" ] }, { "name": "message", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ] } } }, { "status": "429", "description": "该用户在统计窗口内创建的 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" }, "fields": [ { "name": "success", "type": "boolean", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ false ] }, { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "AUTH_SESSION_LIMIT", "AUTH_SESSION_ISSUANCE_LIMIT" ] }, { "name": "message", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.Verify2FALogin", "file": "controller/twofa.go", "line": 171 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/login/2fa", "operation": { "summary": "两步验证登录", "deprecated": false, "description": "🔓 无需鉴权（登录流程）。签发新登录 Session 时可能返回 409 AUTH_SESSION_LIMIT 或 429 AUTH_SESSION_ISSUANCE_LIMIT。", "tags": [ "用户登陆注册" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "code": { "type": "string" }, "flow_token": { "type": "string", "description": "密码校验成功后返回的一次性 2FA 登录流程令牌" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} }, "409": { "description": "该用户的活跃登录 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" } } } }, "429": { "description": "该用户在统计窗口内创建的 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" } } } } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "AUTH-DOC-CONFLICT：登录 OpenAPI 的 security 与路由用途不一致，以真实处理器链为准" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/login/encryption-key", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.GetPasswordEncryptionKey" ], "file": "router/api-router.go", "line": 78, "source_kind": "static", "id": "CORE-AUTH-027", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetPasswordEncryptionKey", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "enabled", "kid", "public_key" ], "handler_sources": [ { "symbol": "controller.GetPasswordEncryptionKey", "file": "controller/user.go", "line": 36 } ], "source_behavior_markers": [ "MsgDatabaseError" ], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/login/passkey/begin", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.LoginPasskeyBegin" ], "file": "router/api-router.go", "line": 82, "source_kind": "static", "id": "CORE-AUTH-028", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "LoginPasskeyBegin", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "flow_token", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "rp_id", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "expires_at", "flow_token", "options", "rp_ids" ], "handler_sources": [ { "symbol": "controller.LoginPasskeyBegin", "file": "controller/login_verification.go", "line": 41 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/login/passkey/finish", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.LoginPasskeyFinish" ], "file": "router/api-router.go", "line": 83, "source_kind": "static", "id": "CORE-AUTH-029", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "LoginPasskeyFinish", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "flow_token", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "passkey_flow_token", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "credential", "go_type": "json.RawMessage", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.LoginPasskeyFinish", "file": "controller/login_verification.go", "line": 86 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/login/verify", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.VerifyLogin" ], "file": "router/api-router.go", "line": 81, "source_kind": "static", "id": "CORE-AUTH-030", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "VerifyLogin", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "flow_token", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "method", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "code", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.VerifyLogin", "file": "controller/login_verification.go", "line": 16 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": { "input": "JSON：flow_token、code 必填；method 缺省使用上游 2FA 方法且只接受对应方法。", "result": "原二次验证成功响应与会话结果；过期/错用途 flow、错误验证码按原错误流程。", "checks": "缺字段、过期 flow、错误 code、非法 method、同 flow 重放与签发限制。" } }, { "method": "GET", "path": "/api/user/oauth/bindings", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserOAuthBindings" ], "file": "router/api-router.go", "line": 140, "source_kind": "static", "id": "CORE-AUTH-031", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetUserOAuthBindings", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetUserOAuthBindings", "file": "controller/custom_oauth.go", "line": 471 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/oauth/bindings/:provider_id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.UnbindCustomOAuth" ], "file": "router/api-router.go", "line": 141, "source_kind": "static", "id": "CORE-AUTH-032", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "UnbindCustomOAuth", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeAccountUnbind", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccountUnbind" ], "parameters": [ { "name": "provider_id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "notification_failed", "notification_warning", "provider_id", "success" ], "handler_sources": [ { "symbol": "controller.UnbindCustomOAuth", "file": "controller/custom_oauth.go", "line": 525 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/passkey", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.PasskeyDelete" ], "file": "router/api-router.go", "line": 111, "source_kind": "static", "id": "CORE-AUTH-033", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "删除Passkey", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopePasskeyDelete", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopePasskeyDelete" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyDelete", "file": "controller/passkey.go", "line": 216 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/passkey", "operation": { "summary": "删除Passkey", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/passkey", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.PasskeyStatus" ], "file": "router/api-router.go", "line": 106, "source_kind": "static", "id": "CORE-AUTH-034", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取Passkey状态", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "enabled", "last_used_at", "message", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyStatus", "file": "controller/passkey.go", "line": 250 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/passkey", "operation": { "summary": "获取Passkey状态", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/passkey/login/begin", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.PasskeyLoginBegin" ], "file": "router/api-router.go", "line": 84, "source_kind": "static", "id": "CORE-AUTH-035", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "开始Passkey登录", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [ { "name": "rp_id", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "expires_at", "flow_token", "message", "options", "rp_ids", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyLoginBegin", "file": "controller/passkey.go", "line": 285 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/passkey/login/begin", "operation": { "summary": "开始Passkey登录", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "用户登陆注册" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐", "AUTH-DOC-CONFLICT：登录 OpenAPI 的 security 与路由用途不一致，以真实处理器链为准" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/passkey/login/finish", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.PasskeyLoginFinish" ], "file": "router/api-router.go", "line": 85, "source_kind": "static", "id": "CORE-AUTH-036", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "完成Passkey登录", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} }, { "status": "409", "description": "该用户的活跃登录 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" }, "fields": [ { "name": "success", "type": "boolean", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ false ] }, { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "AUTH_SESSION_LIMIT", "AUTH_SESSION_ISSUANCE_LIMIT" ] }, { "name": "message", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ] } } }, { "status": "429", "description": "该用户在统计窗口内创建的 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" }, "fields": [ { "name": "success", "type": "boolean", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ false ] }, { "name": "code", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "AUTH_SESSION_LIMIT", "AUTH_SESSION_ISSUANCE_LIMIT" ] }, { "name": "message", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyLoginFinish", "file": "controller/passkey.go", "line": 337 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/passkey/login/finish", "operation": { "summary": "完成Passkey登录", "deprecated": false, "description": "🔓 无需鉴权。签发新登录 Session 时可能返回 409 AUTH_SESSION_LIMIT 或 429 AUTH_SESSION_ISSUANCE_LIMIT。", "tags": [ "用户登陆注册" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "description": "该用户的活跃登录 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" } } } }, "429": { "description": "该用户在统计窗口内创建的 Session 已达上限", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AuthSessionIssuanceError" } } } } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "AUTH-DOC-CONFLICT：登录 OpenAPI 的 security 与路由用途不一致，以真实处理器链为准" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/passkey/register/begin", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.UserCriticalRateLimit(\"security-verification\")", "middleware.DisableCache()" ], "handlers": [ "controller.PasskeyRegisterBegin" ], "file": "router/api-router.go", "line": 107, "source_kind": "static", "id": "CORE-AUTH-037", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "开始注册Passkey", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopePasskeyRegister", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopePasskeyRegister" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "expires_at", "flow_token", "message", "options", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyRegisterBegin", "file": "controller/passkey.go", "line": 45 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/passkey/register/begin", "operation": { "summary": "开始注册Passkey", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/passkey/register/finish", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.UserCriticalRateLimit(\"security-verification\")", "middleware.DisableCache()" ], "handlers": [ "controller.PasskeyRegisterFinish" ], "file": "router/api-router.go", "line": 108, "source_kind": "static", "id": "CORE-AUTH-038", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "完成注册Passkey", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopePasskeyRegister", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopePasskeyRegister" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyRegisterFinish", "file": "controller/passkey.go", "line": 121 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/passkey/register/finish", "operation": { "summary": "完成注册Passkey", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/passkey/verify/begin", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.UserCriticalRateLimit(\"security-verification\")", "middleware.DisableCache()" ], "handlers": [ "controller.PasskeyVerifyBegin" ], "file": "router/api-router.go", "line": 109, "source_kind": "static", "id": "CORE-AUTH-039", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "开始验证Passkey", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.passkeyVerifyBeginRequest", "file": "controller/passkey.go", "line": 28, "source": "passkeyVerifyBeginRequest struct {\n\tRPID string `json:\"rp_id\"`\n\tScope string `json:\"scope\"`\n\tContext json.RawMessage `json:\"context,omitempty\"`\n}" } ], "observed_literal_keys": [ "data", "expires_at", "flow_token", "message", "options", "rp_ids", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyVerifyBegin", "file": "controller/passkey.go", "line": 492 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/passkey/verify/begin", "operation": { "summary": "开始验证Passkey", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/passkey/verify/finish", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.UserCriticalRateLimit(\"security-verification\")", "middleware.DisableCache()" ], "handlers": [ "controller.PasskeyVerifyFinish" ], "file": "router/api-router.go", "line": 110, "source_kind": "static", "id": "CORE-AUTH-040", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "完成验证Passkey", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "method", "scope", "success" ], "handler_sources": [ { "symbol": "controller.PasskeyVerifyFinish", "file": "controller/passkey.go", "line": 574 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/passkey/verify/finish", "operation": { "summary": "完成验证Passkey", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/register", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()", "middleware.TurnstileCheck()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.Register" ], "file": "router/api-router.go", "line": 77, "source_kind": "static", "id": "CORE-AUTH-041", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "用户注册", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [ { "name": "username", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "password", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "email", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "verification_code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "aff_code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.User", "file": "model/user.go", "line": 79, "source": "User struct {\n\tId int `json:\"id\"`\n\tUsername string `json:\"username\" gorm:\"unique;index\" validate:\"max=20\"`\n\tPassword string `json:\"password\" gorm:\"not null;\" validate:\"min=8,max=128\"`\n\tHasPassword bool `json:\"-\" gorm:\"-:all\"`\n\tOriginalPassword string `json:\"original_password\" gorm:\"-:all\"`\n\tDisplayName string `json:\"display_name\" gorm:\"index\" validate:\"max=20\"`\n\tRole int `json:\"role\" gorm:\"type:int;default:1\"`\n\tStatus int `json:\"status\" gorm:\"type:int;default:1\"`\n\tEmail string `json:\"email\" gorm:\"index\" validate:\"max=50\"`\n\tGitHubId string `json:\"github_id\" gorm:\"column:github_id;index\"`\n\tDiscordId string `json:\"discord_id\" gorm:\"column:discord_id;index\"`\n\tOidcId string `json:\"oidc_id\" gorm:\"column:oidc_id;index\"`\n\tWeChatId string `json:\"wechat_id\" gorm:\"column:wechat_id;index\"`\n\tTelegramId string `json:\"telegram_id\" gorm:\"column:telegram_id;index\"`\n\tVerificationCode string `json:\"verification_code\" gorm:\"-:all\"`\n\tAccessToken *string `json:\"-\" gorm:\"type:char(32);column:access_token;uniqueIndex\"`\n\tAccessTokenCreatedAt *int64 `json:\"-\" gorm:\"type:bigint;column:access_token_created_at\"`\n\tQuota int `json:\"quota\" gorm:\"type:int;default:0\"`\n\tUsedQuota int `json:\"used_quota\" gorm:\"type:int;default:0;column:used_quota\"`\n\tRequestCount int `json:\"request_count\" gorm:\"type:int;default:0;\"`\n\tGroup string `json:\"group\" gorm:\"type:varchar(64);default:'default'\"`\n\tAffCode string `json:\"aff_code\" gorm:\"type:varchar(32);column:aff_code;uniqueIndex\"`\n\tAffCount int `json:\"aff_count\" gorm:\"type:int;default:0;column:aff_count\"`\n\tAffQuota int `json:\"aff_quota\" gorm:\"type:int;default:0;column:aff_quota\"`\n\tAffHistoryQuota int `json:\"aff_history_quota\" gorm:\"type:int;default:0;column:aff_history\"`\n\tInviterId int `json:\"inviter_id\" gorm:\"type:int;column:inviter_id;index\"`\n\tDeletedAt gorm.DeletedAt `gorm:\"index\"`\n\tLinuxDOId string `json:\"linux_do_id\" gorm:\"column:linux_do_id;index\"`\n\tSetting string `json:\"setting\" gorm:\"type:text;column:setting\"`\n\tRemark string `json:\"remark,omitempty\" gorm:\"type:varchar(255)\" validate:\"max=255\"`\n\tStripeCustomer string `json:\"stripe_customer\" gorm:\"type:varchar(64);column:stripe_customer;index\"`\n\tCreatedAt int64 `json:\"created_at\" gorm:\"autoCreateTime;column:created_at\"`\n\tLastLoginAt int64 `json:\"last_login_at\" gorm:\"default:0;column:last_login_at\"`\n\tAuthVersion int64 `json:\"-\" gorm:\"type:bigint;not null;default:1;column:auth_version\"`\n\tAdminPermissions map[string]map[string]bool `json:\"admin_permissions,omitempty\" gorm:\"-:all\"`\n}" } ], "observed_literal_keys": [ "Error", "message", "success" ], "handler_sources": [ { "symbol": "controller.Register", "file": "controller/user.go", "line": 215 } ], "source_behavior_markers": [ "MsgCreateDefaultTokenErr", "MsgDatabaseError", "MsgInvalidParams", "MsgUserDefaultTokenFailed", "MsgUserEmailAlreadyTaken", "MsgUserEmailVerificationRequired", "MsgUserExists", "MsgUserInputInvalid", "MsgUserPasswordRegisterDisabled", "MsgUserRegisterDisabled", "MsgUserRegisterFailed", "MsgUserVerificationCodeError" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/register", "operation": { "summary": "用户注册", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "用户登陆注册" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "username": { "type": "string" }, "password": { "type": "string" }, "email": { "type": "string" }, "verification_code": { "type": "string" }, "aff_code": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/reset", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.ResetPassword" ], "file": "router/api-router.go", "line": 46, "source_kind": "static", "id": "CORE-AUTH-042", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "重置密码", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [ { "name": "email", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "token", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "password", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.ResetPassword", "file": "controller/misc.go", "line": 281 } ], "source_behavior_markers": [ "MsgInvalidParams", "MsgUserPasswordResetLinkInvalid" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/reset", "operation": { "summary": "重置密码", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "用户登陆注册" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "email": { "type": "string" }, "token": { "type": "string" }, "password": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/sessions", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.GetLoginSessions" ], "file": "router/api-router.go", "line": 94, "source_kind": "static", "id": "CORE-AUTH-043", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "查看登录会话", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器额外要求浏览器登录 Session，账户访问令牌/PAT 不等价", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "返回当前鉴权版本的有效登录会话", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": true, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetLoginSessions", "file": "controller/auth_session.go", "line": 97 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/sessions", "operation": { "summary": "查看登录会话", "deprecated": false, "description": "🔐 需要面板 Access Token；PAT 不能管理浏览器登录会话。只返回当前 user_auth_version 的有效会话，当前会话优先，最多 100 条。", "tags": [ "用户登陆注册" ], "parameters": [], "responses": { "200": { "description": "返回当前鉴权版本的有效登录会话", "headers": {} } }, "security": [ { "AccessToken1": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "浏览器 Session 身份必需；账户访问令牌/PAT 不替代该上下文。", "result": "success/message/data；data 为当前用户的登录 Session 列表，来自 ListLoginSessions。", "checks": "当前设备标识、他人会话不可见、PAT 不能绕过 requireBrowserSession。" } }, { "method": "DELETE", "path": "/api/user/sessions/:sid", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.DeleteLoginSession" ], "file": "router/api-router.go", "line": 95, "source_kind": "static", "id": "CORE-AUTH-044", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "撤销指定登录会话", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器额外要求浏览器登录 Session，账户访问令牌/PAT 不等价", "parameters": [ { "name": "sid", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": true, "security_proof_scopes": [], "parameters": [ { "name": "sid", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "code", "current", "data", "message", "revoked_sid", "success" ], "handler_sources": [ { "symbol": "controller.DeleteLoginSession", "file": "controller/auth_session.go", "line": 110 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/sessions/{sid}", "operation": { "summary": "撤销指定登录会话", "deprecated": false, "description": "🔐 需要面板 Access Token，可撤销当前会话", "tags": [ "用户登陆注册" ], "parameters": [ { "name": "sid", "in": "path", "required": true, "schema": { "type": "string", "format": "uuid" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "AccessToken1": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/sessions/revoke-others", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.RevokeOtherLoginSessions" ], "file": "router/api-router.go", "line": 96, "source_kind": "static", "id": "CORE-AUTH-045", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "撤销其他登录会话", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器额外要求浏览器登录 Session，账户访问令牌/PAT 不等价", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": true, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "revoked_count", "success" ], "handler_sources": [ { "symbol": "controller.RevokeOtherLoginSessions", "file": "controller/auth_session.go", "line": 138 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/sessions/revoke-others", "operation": { "summary": "撤销其他登录会话", "deprecated": false, "description": "🔐 保留当前登录会话并撤销该用户的其他会话，包含列表不可见的旧 user_auth_version active 残留行", "tags": [ "用户登陆注册" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "AccessToken1": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "当前浏览器 Session，无必填 JSON；当前用户与 sid 从可信 Session 取得。", "result": "success/message/data.revoked_count；保留当前 Session，撤销该用户其他 Session。", "checks": "一设备/多设备、重复请求结果、其他用户不受影响、被撤销设备后续失效。" } }, { "method": "GET", "path": "/api/verification", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.EmailVerificationRateLimit()", "middleware.TurnstileCheck()" ], "handlers": [ "controller.SendEmailVerification" ], "file": "router/api-router.go", "line": 44, "source_kind": "static", "id": "CORE-AUTH-046", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "发送邮箱验证码", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [ { "name": "email", "in": "query", "description": "", "required": true, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "email", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.SendEmailVerification", "file": "controller/misc.go", "line": 219 } ], "source_behavior_markers": [ "MsgUserEmailAlreadyTaken" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/verification", "operation": { "summary": "发送邮箱验证码", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "用户登陆注册" ], "parameters": [ { "name": "email", "in": "query", "description": "", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/verify", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.UserCriticalRateLimit(\"security-verification\")", "middleware.DisableCache()" ], "handlers": [ "controller.UniversalVerify" ], "file": "router/api-router.go", "line": 71, "source_kind": "static", "id": "CORE-AUTH-047", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "通用安全验证", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "service.VerificationInput", "file": "service/security_verification.go", "line": 404, "source": "VerificationInput struct {\n\tMethod string `json:\"method\"`\n\tScope string `json:\"scope\"`\n\tContext json.RawMessage `json:\"context,omitempty\"`\n\tCode string `json:\"code,omitempty\"`\n\tPassword string `json:\"password,omitempty\"`\n\tPasswordEncrypted string `json:\"password_encrypted,omitempty\"`\n\tEncryptionKeyID string `json:\"encryption_key_id,omitempty\"`\n}" } ], "observed_literal_keys": [ "message", "method", "scope", "success" ], "handler_sources": [ { "symbol": "controller.UniversalVerify", "file": "controller/secure_verification.go", "line": 137 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/verify", "operation": { "summary": "通用安全验证", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "安全验证" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/verify/methods", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.GetVerificationMethods" ], "file": "router/api-router.go", "line": 70, "source_kind": "static", "id": "CORE-AUTH-048", "group": "core-auth", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetVerificationMethods", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "scope", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.GetVerificationMethods", "file": "controller/secure_verification.go", "line": 22 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "签发、刷新、撤销与设备/二次验证必须保持上游生命周期；登录失败不能泄漏账户存在性或凭据。退出/撤销后按声明时限失效；跨子站 SSO 属新增差异，不把已有 OAuth 登录当授权服务器。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/creem/webhook", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.CreemWebhook" ], "file": "router/api-router.go", "line": 63, "source_kind": "static", "id": "CORE-BILL-001", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "Creem Webhook", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.CreemWebhookEvent", "file": "controller/topup_creem.go", "line": 178, "source": "CreemWebhookEvent struct {\n\tId string `json:\"id\"`\n\tEventType string `json:\"eventType\"`\n\tCreatedAt int64 `json:\"created_at\"`\n\tObject struct {\n\t\tId string `json:\"id\"`\n\t\tObject string `json:\"object\"`\n\t\tRequestId string `json:\"request_id\"`\n\t\tOrder struct {\n\t\t\tObject string `json:\"object\"`\n\t\t\tId string `json:\"id\"`\n\t\t\tCustomer string `json:\"customer\"`\n\t\t\tProduct string `json:\"product\"`\n\t\t\tAmount int `json:\"amount\"`\n\t\t\tCurrency string `json:\"currency\"`\n\t\t\tSubTotal int `json:\"sub_total\"`\n\t\t\tTaxAmount int `json:\"tax_amount\"`\n\t\t\tAmountDue int `json:\"amount_due\"`\n\t\t\tAmountPaid int `json:\"amount_paid\"`\n\t\t\tStatus string `json:\"status\"`\n\t\t\tType string `json:\"type\"`\n\t\t\tTransaction string `json:\"transaction\"`\n\t\t\tCreatedAt string `json:\"created_at\"`\n\t\t\tUpdatedAt string `json:\"updated_at\"`\n\t\t\tMode string `json:\"mode\"`\n\t\t} `json:\"order\"`\n\t\tProduct struct {\n\t\t\tId string `json:\"id\"`\n\t\t\tObject string `json:\"object\"`\n\t\t\tName string `json:\"name\"`\n\t\t\tDescription string `json:\"description\"`\n\t\t\tPrice int `json:\"price\"`\n\t\t\tCurrency string `json:\"currency\"`\n\t\t\tBillingType string `json:\"billing_type\"`\n\t\t\tBillingPeriod string `json:\"billing_period\"`\n\t\t\tStatus string `json:\"status\"`\n\t\t\tTaxMode string `json:\"tax_mode\"`\n\t\t\tTaxCategory string `json:\"tax_category\"`\n\t\t\tDefaultSuccessUrl *string `json:\"default_success_url\"`\n\t\t\tCreatedAt string `json:\"created_at\"`\n\t\t\tUpdatedAt string `json:\"updated_at\"`\n\t\t\tMode string `json:\"mode\"`\n\t\t} `json:\"product\"`\n\t\tUnits int `json:\"units\"`\n\t\tCustomer struct {\n\t\t\tId string `json:\"id\"`\n\t\t\tObject string `json:\"object\"`\n\t\t\tEmail string `json:\"email\"`\n\t\t\tName string `json:\"name\"`\n\t\t\tCountry string `json:\"country\"`\n\t\t\tCreatedAt string `json:\"created_at\"`\n\t\t\tUpdatedAt string `json:\"updated_at\"`\n\t\t\tMode string `json:\"mode\"`\n\t\t} `json:\"customer\"`\n\t\tStatus string `json:\"status\"`\n\t\tMetadata map[string]string `json:\"metadata\"`\n\t\tMode string `json:\"mode\"`\n\t} `json:\"object\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.CreemWebhook", "file": "controller/topup_creem.go", "line": 238 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/creem/webhook", "operation": { "summary": "Creem Webhook", "deprecated": false, "description": "🔓 无需鉴权（Webhook回调）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/group/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetGroups" ], "file": "router/api-router.go", "line": 350, "source_kind": "static", "id": "CORE-BILL-002", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有分组", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetGroups", "file": "controller/group.go", "line": 14 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/group/", "operation": { "summary": "获取所有分组", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "分组" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/option/model_pricing", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetModelPricingConfig" ], "file": "router/api-router.go", "line": 209, "source_kind": "static", "id": "CORE-BILL-003", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetModelPricingConfig", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetModelPricingConfig", "file": "controller/model_pricing_config.go", "line": 12 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PATCH", "path": "/api/option/model_pricing", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.UpdateModelPricingConfig" ], "file": "router/api-router.go", "line": 210, "source_kind": "static", "id": "CORE-BILL-004", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "UpdateModelPricingConfig", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "changes", "go_type": "[]model.ModelPricingChange", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "models", "success", "updated_models" ], "handler_sources": [ { "symbol": "controller.UpdateModelPricingConfig", "file": "controller/model_pricing_config.go", "line": 59 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/option/model_pricing/convert", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.PreviewModelPricingConversion" ], "file": "router/api-router.go", "line": 211, "source_kind": "static", "id": "CORE-BILL-005", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "PreviewModelPricingConversion", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "model_name", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "pricing", "go_type": "model.PricingValues", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.PreviewModelPricingConversion", "file": "controller/model_pricing_config.go", "line": 21 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/option/model_pricing/preview", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.PreviewModelPricing" ], "file": "router/api-router.go", "line": 212, "source_kind": "static", "id": "CORE-BILL-006", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "PreviewModelPricing", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "model_name", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "pricing", "go_type": "model.PricingValues", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.PreviewModelPricing", "file": "controller/model_pricing_config.go", "line": 38 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/option/payment_compliance", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ConfirmPaymentCompliance" ], "file": "router/api-router.go", "line": 213, "source_kind": "static", "id": "CORE-BILL-007", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ConfirmPaymentCompliance", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.PaymentComplianceRequest", "file": "controller/payment_compliance.go", "line": 18, "source": "PaymentComplianceRequest struct {\n\tConfirmed bool `json:\"confirmed\"`\n}" } ], "observed_literal_keys": [ "confirmed", "confirmed_at", "confirmed_by", "message", "success", "terms_version" ], "handler_sources": [ { "symbol": "controller.ConfirmPaymentCompliance", "file": "controller/payment_compliance.go", "line": 30 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/option/waffo-pancake/subscription-product", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.CreateWaffoPancakeSubscriptionProduct" ], "file": "router/api-router.go", "line": 220, "source_kind": "static", "id": "CORE-BILL-008", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "CreateWaffoPancakeSubscriptionProduct", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.createWaffoPancakeSubscriptionProductRequest", "file": "controller/topup_waffo_pancake.go", "line": 242, "source": "createWaffoPancakeSubscriptionProductRequest struct {\n\tName string `json:\"name\"`\n\tAmount string `json:\"amount\"`\n}" } ], "observed_literal_keys": [ "data", "message", "product_id", "product_name", "store_id" ], "handler_sources": [ { "symbol": "controller.CreateWaffoPancakeSubscriptionProduct", "file": "controller/topup_waffo_pancake.go", "line": 252 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/option/waffo-pancake/subscription-product-options", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ListWaffoPancakeSubscriptionProductOptions" ], "file": "router/api-router.go", "line": 221, "source_kind": "static", "id": "CORE-BILL-009", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ListWaffoPancakeSubscriptionProductOptions", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "products", "store_id" ], "handler_sources": [ { "symbol": "controller.ListWaffoPancakeSubscriptionProductOptions", "file": "controller/topup_waffo_pancake.go", "line": 304 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/ratio_config", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.GetRatioConfig" ], "file": "router/api-router.go", "line": 60, "source_kind": "static", "id": "CORE-BILL-010", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取倍率配置", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetRatioConfig", "file": "controller/ratio_config.go", "line": 12 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/ratio_config", "operation": { "summary": "获取倍率配置", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/redemption/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllRedemptions" ], "file": "router/api-router.go", "line": 300, "source_kind": "static", "id": "CORE-BILL-011", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有兑换码", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllRedemptions", "file": "controller/redemption.go", "line": 18 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/redemption/", "operation": { "summary": "获取所有兑换码", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "兑换码" ], "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/redemption/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AddRedemption" ], "file": "router/api-router.go", "line": 303, "source_kind": "static", "id": "CORE-BILL-012", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建兑换码", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "key", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "created_time", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "redeemed_time", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.Redemption", "file": "model/redemption.go", "line": 14, "source": "Redemption struct {\n\tId int `json:\"id\"`\n\tUserId int `json:\"user_id\"`\n\tKey string `json:\"key\" gorm:\"type:char(32);uniqueIndex\"`\n\tStatus int `json:\"status\" gorm:\"default:1\"`\n\tName string `json:\"name\" gorm:\"index\"`\n\tQuota int `json:\"quota\" gorm:\"default:100\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tRedeemedTime int64 `json:\"redeemed_time\" gorm:\"bigint\"`\n\tCount int `json:\"count\" gorm:\"-:all\"`\n\tUsedUserId int `json:\"used_user_id\"`\n\tDeletedAt gorm.DeletedAt `gorm:\"index\"`\n\tExpiredTime int64 `json:\"expired_time\" gorm:\"bigint\"`\n}" } ], "observed_literal_keys": [ "count", "data", "message", "name", "quota", "success" ], "handler_sources": [ { "symbol": "controller.AddRedemption", "file": "controller/redemption.go", "line": 65 } ], "source_behavior_markers": [ "MsgPaymentComplianceRequired", "MsgRedemptionCountMax", "MsgRedemptionCountPositive", "MsgRedemptionCreateFailed", "MsgRedemptionNameLength" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/redemption/", "operation": { "summary": "创建兑换码", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "兑换码" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Redemption" } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/redemption/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UpdateRedemption" ], "file": "router/api-router.go", "line": 305, "source_kind": "static", "id": "CORE-BILL-013", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新兑换码", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "key", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "created_time", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "redeemed_time", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "status_only", "in": "query", "source": "controller literal access" } ], "body_types": [ { "type": "model.Redemption", "file": "model/redemption.go", "line": 14, "source": "Redemption struct {\n\tId int `json:\"id\"`\n\tUserId int `json:\"user_id\"`\n\tKey string `json:\"key\" gorm:\"type:char(32);uniqueIndex\"`\n\tStatus int `json:\"status\" gorm:\"default:1\"`\n\tName string `json:\"name\" gorm:\"index\"`\n\tQuota int `json:\"quota\" gorm:\"default:100\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tRedeemedTime int64 `json:\"redeemed_time\" gorm:\"bigint\"`\n\tCount int `json:\"count\" gorm:\"-:all\"`\n\tUsedUserId int `json:\"used_user_id\"`\n\tDeletedAt gorm.DeletedAt `gorm:\"index\"`\n\tExpiredTime int64 `json:\"expired_time\" gorm:\"bigint\"`\n}" } ], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.UpdateRedemption", "file": "controller/redemption.go", "line": 151 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/redemption/", "operation": { "summary": "更新兑换码", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "兑换码" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Redemption" } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/redemption/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeleteRedemption" ], "file": "router/api-router.go", "line": 307, "source_kind": "static", "id": "CORE-BILL-014", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "删除兑换码", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteRedemption", "file": "controller/redemption.go", "line": 137 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/redemption/{id}", "operation": { "summary": "删除兑换码", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "兑换码" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/redemption/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetRedemption" ], "file": "router/api-router.go", "line": 302, "source_kind": "static", "id": "CORE-BILL-015", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取指定兑换码", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetRedemption", "file": "controller/redemption.go", "line": 46 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/redemption/{id}", "operation": { "summary": "获取指定兑换码", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "兑换码" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/redemption/batch", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeleteRedemptionBatch" ], "file": "router/api-router.go", "line": 304, "source_kind": "static", "id": "CORE-BILL-016", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "DeleteRedemptionBatch", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "ids", "go_type": "[]int", "variable": "request", "required_tag": true, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "count", "requested_redemption_ids", "total" ], "handler_sources": [ { "symbol": "controller.DeleteRedemptionBatch", "file": "controller/redemption.go", "line": 219 } ], "source_behavior_markers": [ "MsgInvalidParams" ], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/redemption/invalid", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeleteInvalidRedemption" ], "file": "router/api-router.go", "line": 306, "source_kind": "static", "id": "CORE-BILL-017", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "删除无效兑换码", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteInvalidRedemption", "file": "controller/redemption.go", "line": 198 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/redemption/invalid", "operation": { "summary": "删除无效兑换码", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "兑换码" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/redemption/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SearchRedemptions" ], "file": "router/api-router.go", "line": 301, "source_kind": "static", "id": "CORE-BILL-018", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "搜索兑换码", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SearchRedemptions", "file": "controller/redemption.go", "line": 31 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/redemption/search", "operation": { "summary": "搜索兑换码", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "兑换码" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/stripe/webhook", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.StripeWebhook" ], "file": "router/api-router.go", "line": 62, "source_kind": "static", "id": "CORE-BILL-019", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "Stripe Webhook", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "Stripe-Signature", "in": "header", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.StripeWebhook", "file": "controller/topup_stripe.go", "line": 164 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/stripe/webhook", "operation": { "summary": "Stripe Webhook", "deprecated": false, "description": "🔓 无需鉴权（Webhook回调）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/admin/bind", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminBindSubscription" ], "file": "router/api-router.go", "line": 187, "source_kind": "static", "id": "CORE-BILL-020", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminBindSubscription", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.AdminBindSubscriptionRequest", "file": "controller/subscription.go", "line": 351, "source": "AdminBindSubscriptionRequest struct {\n\tUserId int `json:\"user_id\"`\n\tPlanId int `json:\"plan_id\"`\n}" } ], "observed_literal_keys": [ "message" ], "handler_sources": [ { "symbol": "controller.AdminBindSubscription", "file": "controller/subscription.go", "line": 356 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/subscription/admin/plans", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminListSubscriptionPlans" ], "file": "router/api-router.go", "line": 183, "source_kind": "static", "id": "CORE-BILL-021", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminListSubscriptionPlans", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.AdminListSubscriptionPlans", "file": "controller/subscription.go", "line": 121 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/admin/plans", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminCreateSubscriptionPlan" ], "file": "router/api-router.go", "line": 184, "source_kind": "static", "id": "CORE-BILL-022", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminCreateSubscriptionPlan", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.AdminUpsertSubscriptionPlanRequest", "file": "controller/subscription.go", "line": 137, "source": "AdminUpsertSubscriptionPlanRequest struct {\n\tPlan model.SubscriptionPlan `json:\"plan\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.AdminCreateSubscriptionPlan", "file": "controller/subscription.go", "line": 141 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PATCH", "path": "/api/subscription/admin/plans/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminUpdateSubscriptionPlanStatus" ], "file": "router/api-router.go", "line": 186, "source_kind": "static", "id": "CORE-BILL-023", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminUpdateSubscriptionPlanStatus", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.AdminUpdateSubscriptionPlanStatusRequest", "file": "controller/subscription.go", "line": 324, "source": "AdminUpdateSubscriptionPlanStatusRequest struct {\n\tEnabled *bool `json:\"enabled\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.AdminUpdateSubscriptionPlanStatus", "file": "controller/subscription.go", "line": 328 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/subscription/admin/plans/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminUpdateSubscriptionPlan" ], "file": "router/api-router.go", "line": 185, "source_kind": "static", "id": "CORE-BILL-024", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminUpdateSubscriptionPlan", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.AdminUpsertSubscriptionPlanRequest", "file": "controller/subscription.go", "line": 137, "source": "AdminUpsertSubscriptionPlanRequest struct {\n\tPlan model.SubscriptionPlan `json:\"plan\"`\n}" } ], "observed_literal_keys": [ "creem_product_id", "currency", "custom_seconds", "downgrade_group", "duration_unit", "duration_value", "enabled", "max_purchase_per_user", "price_amount", "quota_reset_custom_seconds", "quota_reset_period", "sort_order", "stripe_price_id", "subtitle", "title", "total_amount", "updated_at", "upgrade_group", "waffo_pancake_product_id" ], "handler_sources": [ { "symbol": "controller.AdminUpdateSubscriptionPlan", "file": "controller/subscription.go", "line": 216 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/admin/plans/:id/subscriptions/reset", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminResetPlanSubscriptions" ], "file": "router/api-router.go", "line": 188, "source_kind": "static", "id": "CORE-BILL-025", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminResetPlanSubscriptions", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.AdminResetSubscriptionRequest", "file": "controller/subscription.go", "line": 398, "source": "AdminResetSubscriptionRequest struct {\n\tPlanId int `json:\"plan_id\"`\n\tAdvanceResetTime *bool `json:\"advance_reset_time\"`\n}" } ], "observed_literal_keys": [ "advance_reset_time", "plan_id", "plan_title", "reset_count", "user_count" ], "handler_sources": [ { "symbol": "controller.AdminResetPlanSubscriptions", "file": "controller/subscription.go", "line": 481 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/subscription/admin/user_subscriptions/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminDeleteUserSubscription" ], "file": "router/api-router.go", "line": 195, "source_kind": "static", "id": "CORE-BILL-026", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminDeleteUserSubscription", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message" ], "handler_sources": [ { "symbol": "controller.AdminDeleteUserSubscription", "file": "controller/subscription.go", "line": 531 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/admin/user_subscriptions/:id/invalidate", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminInvalidateUserSubscription" ], "file": "router/api-router.go", "line": 194, "source_kind": "static", "id": "CORE-BILL-027", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminInvalidateUserSubscription", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message" ], "handler_sources": [ { "symbol": "controller.AdminInvalidateUserSubscription", "file": "controller/subscription.go", "line": 512 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/subscription/admin/users/:id/subscriptions", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminListUserSubscriptions" ], "file": "router/api-router.go", "line": 191, "source_kind": "static", "id": "CORE-BILL-028", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminListUserSubscriptions", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.AdminListUserSubscriptions", "file": "controller/subscription.go", "line": 380 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/admin/users/:id/subscriptions", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminCreateUserSubscription" ], "file": "router/api-router.go", "line": 192, "source_kind": "static", "id": "CORE-BILL-029", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminCreateUserSubscription", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.AdminCreateUserSubscriptionRequest", "file": "controller/subscription.go", "line": 394, "source": "AdminCreateUserSubscriptionRequest struct {\n\tPlanId int `json:\"plan_id\"`\n}" } ], "observed_literal_keys": [ "message" ], "handler_sources": [ { "symbol": "controller.AdminCreateUserSubscription", "file": "controller/subscription.go", "line": 421 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/admin/users/:id/subscriptions/reset", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminResetUserSubscriptionsByPlan" ], "file": "router/api-router.go", "line": 193, "source_kind": "static", "id": "CORE-BILL-030", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "AdminResetUserSubscriptionsByPlan", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.AdminResetSubscriptionRequest", "file": "controller/subscription.go", "line": 398, "source": "AdminResetSubscriptionRequest struct {\n\tPlanId int `json:\"plan_id\"`\n\tAdvanceResetTime *bool `json:\"advance_reset_time\"`\n}" } ], "observed_literal_keys": [ "advance_reset_time", "plan_id", "plan_title", "reset_count", "target_user_id", "user_count" ], "handler_sources": [ { "symbol": "controller.AdminResetUserSubscriptionsByPlan", "file": "controller/subscription.go", "line": 448 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/balance/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.SubscriptionRequestBalancePay" ], "file": "router/api-router.go", "line": 174, "source_kind": "static", "id": "CORE-BILL-031", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionRequestBalancePay", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.SubscriptionBalancePayRequest", "file": "controller/subscription.go", "line": 26, "source": "SubscriptionBalancePayRequest struct {\n\tPlanId int `json:\"plan_id\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SubscriptionRequestBalancePay", "file": "controller/subscription.go", "line": 100 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/creem/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.SubscriptionRequestCreemPay" ], "file": "router/api-router.go", "line": 177, "source_kind": "static", "id": "CORE-BILL-032", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionRequestCreemPay", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.SubscriptionCreemPayRequest", "file": "controller/subscription_payment_creem.go", "line": 19, "source": "SubscriptionCreemPayRequest struct {\n\tPlanId int `json:\"plan_id\"`\n}" } ], "observed_literal_keys": [ "checkout_url", "data", "message", "order_id" ], "handler_sources": [ { "symbol": "controller.SubscriptionRequestCreemPay", "file": "controller/subscription_payment_creem.go", "line": 23 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/subscription/epay/notify", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.SubscriptionEpayNotify" ], "file": "router/api-router.go", "line": 200, "source_kind": "static", "id": "CORE-BILL-033", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionEpayNotify", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SubscriptionEpayNotify", "file": "controller/subscription_payment_epay.go", "line": 118 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/epay/notify", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.SubscriptionEpayNotify" ], "file": "router/api-router.go", "line": 199, "source_kind": "static", "id": "CORE-BILL-034", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionEpayNotify", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SubscriptionEpayNotify", "file": "controller/subscription_payment_epay.go", "line": 118 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/epay/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.SubscriptionRequestEpay" ], "file": "router/api-router.go", "line": 175, "source_kind": "static", "id": "CORE-BILL-035", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionRequestEpay", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.SubscriptionEpayPayRequest", "file": "controller/subscription_payment_epay.go", "line": 19, "source": "SubscriptionEpayPayRequest struct {\n\tPlanId int `json:\"plan_id\"`\n\tPaymentMethod string `json:\"payment_method\"`\n}" } ], "observed_literal_keys": [ "data", "message", "url" ], "handler_sources": [ { "symbol": "controller.SubscriptionRequestEpay", "file": "controller/subscription_payment_epay.go", "line": 24 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/subscription/epay/return", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.SubscriptionEpayReturn" ], "file": "router/api-router.go", "line": 201, "source_kind": "static", "id": "CORE-BILL-036", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionEpayReturn", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SubscriptionEpayReturn", "file": "controller/subscription_payment_epay.go", "line": 173 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/epay/return", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.SubscriptionEpayReturn" ], "file": "router/api-router.go", "line": 202, "source_kind": "static", "id": "CORE-BILL-037", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionEpayReturn", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SubscriptionEpayReturn", "file": "controller/subscription_payment_epay.go", "line": 173 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/subscription/plans", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetSubscriptionPlans" ], "file": "router/api-router.go", "line": 171, "source_kind": "static", "id": "CORE-BILL-038", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetSubscriptionPlans", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetSubscriptionPlans", "file": "controller/subscription.go", "line": 32 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/subscription/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetSubscriptionSelf" ], "file": "router/api-router.go", "line": 172, "source_kind": "static", "id": "CORE-BILL-039", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetSubscriptionSelf", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "all_subscriptions", "billing_preference", "subscriptions" ], "handler_sources": [ { "symbol": "controller.GetSubscriptionSelf", "file": "controller/subscription.go", "line": 53 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/subscription/self/preference", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.UpdateSubscriptionPreference" ], "file": "router/api-router.go", "line": 173, "source_kind": "static", "id": "CORE-BILL-040", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "UpdateSubscriptionPreference", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.BillingPreferenceRequest", "file": "controller/subscription.go", "line": 22, "source": "BillingPreferenceRequest struct {\n\tBillingPreference string `json:\"billing_preference\"`\n}" } ], "observed_literal_keys": [ "billing_preference" ], "handler_sources": [ { "symbol": "controller.UpdateSubscriptionPreference", "file": "controller/subscription.go", "line": 77 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/stripe/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.SubscriptionRequestStripePay" ], "file": "router/api-router.go", "line": 176, "source_kind": "static", "id": "CORE-BILL-041", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionRequestStripePay", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.SubscriptionStripePayRequest", "file": "controller/subscription_payment_stripe.go", "line": 19, "source": "SubscriptionStripePayRequest struct {\n\tPlanId int `json:\"plan_id\"`\n}" } ], "observed_literal_keys": [ "data", "message", "pay_link" ], "handler_sources": [ { "symbol": "controller.SubscriptionRequestStripePay", "file": "controller/subscription_payment_stripe.go", "line": 23 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/subscription/waffo-pancake/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.SubscriptionRequestWaffoPancakePay" ], "file": "router/api-router.go", "line": 178, "source_kind": "static", "id": "CORE-BILL-042", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "SubscriptionRequestWaffoPancakePay", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.SubscriptionWaffoPancakePayRequest", "file": "controller/subscription_payment_waffo_pancake.go", "line": 19, "source": "SubscriptionWaffoPancakePayRequest struct {\n\tPlanId int `json:\"plan_id\"`\n}" } ], "observed_literal_keys": [ "checkout_url", "data", "expires_at", "message", "order_id", "session_id", "token", "token_expires_at" ], "handler_sources": [ { "symbol": "controller.SubscriptionRequestWaffoPancakePay", "file": "controller/subscription_payment_waffo_pancake.go", "line": 23 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/aff_transfer", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.UserCriticalRateLimit(\"aff-transfer\")" ], "handlers": [ "controller.TransferAffQuota" ], "file": "router/api-router.go", "line": 125, "source_kind": "static", "id": "CORE-BILL-043", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "转换邀请额度", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [ { "name": "quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.TransferAffQuotaRequest", "file": "controller/user.go", "line": 409, "source": "TransferAffQuotaRequest struct {\n\tQuota int `json:\"quota\" binding:\"required\"`\n}" } ], "observed_literal_keys": [ "Error" ], "handler_sources": [ { "symbol": "controller.TransferAffQuota", "file": "controller/user.go", "line": 413 } ], "source_behavior_markers": [ "MsgUserTransferFailed", "MsgUserTransferSuccess" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/aff_transfer", "operation": { "summary": "转换邀请额度", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "quota": { "type": "integer" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/amount", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.RequestAmount" ], "file": "router/api-router.go", "line": 117, "source_kind": "static", "id": "CORE-BILL-044", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取支付金额", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.AmountRequest", "file": "controller/topup.go", "line": 132, "source": "AmountRequest struct {\n\tAmount int64 `json:\"amount\"`\n}" } ], "observed_literal_keys": [ "data", "message" ], "handler_sources": [ { "symbol": "controller.RequestAmount", "file": "controller/topup.go", "line": 486 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/amount", "operation": { "summary": "获取支付金额", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/creem/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.RequestCreemPay" ], "file": "router/api-router.go", "line": 120, "source_kind": "static", "id": "CORE-BILL-045", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "发起Creem支付", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.CreemPayRequest", "file": "controller/topup_creem.go", "line": 51, "source": "CreemPayRequest struct {\n\tProductId string `json:\"product_id\"`\n\tPaymentMethod string `json:\"payment_method\"`\n}" } ], "observed_literal_keys": [ "data", "message" ], "handler_sources": [ { "symbol": "controller.RequestCreemPay", "file": "controller/topup_creem.go", "line": 153 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/creem/pay", "operation": { "summary": "发起Creem支付", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/epay/notify", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.EpayNotify" ], "file": "router/api-router.go", "line": 88, "source_kind": "static", "id": "CORE-BILL-046", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "易支付回调", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.EpayNotify", "file": "controller/topup.go", "line": 394 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/epay/notify", "operation": { "summary": "易支付回调", "deprecated": false, "description": "🔓 无需鉴权（支付回调）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/epay/notify", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.EpayNotify" ], "file": "router/api-router.go", "line": 87, "source_kind": "static", "id": "CORE-BILL-047", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "EpayNotify", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.EpayNotify", "file": "controller/topup.go", "line": 394 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.RequestEpay" ], "file": "router/api-router.go", "line": 116, "source_kind": "static", "id": "CORE-BILL-048", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "发起易支付", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.EpayRequest", "file": "controller/topup.go", "line": 127, "source": "EpayRequest struct {\n\tAmount int64 `json:\"amount\"`\n\tPaymentMethod string `json:\"payment_method\"`\n}" } ], "observed_literal_keys": [ "data", "message", "url" ], "handler_sources": [ { "symbol": "controller.RequestEpay", "file": "controller/topup.go", "line": 270 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/pay", "operation": { "summary": "发起易支付", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/stripe/amount", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.RequestStripeAmount" ], "file": "router/api-router.go", "line": 119, "source_kind": "static", "id": "CORE-BILL-049", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取Stripe支付金额", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.StripePayRequest", "file": "controller/topup_stripe.go", "line": 30, "source": "StripePayRequest struct {\n\tAmount int64 `json:\"amount\"`\n\n\tPaymentMethod string `json:\"payment_method\"`\n\n\tSuccessURL string `json:\"success_url,omitempty\"`\n\n\tCancelURL string `json:\"cancel_url,omitempty\"`\n}" } ], "observed_literal_keys": [ "data", "message" ], "handler_sources": [ { "symbol": "controller.RequestStripeAmount", "file": "controller/topup_stripe.go", "line": 144 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/stripe/amount", "operation": { "summary": "获取Stripe支付金额", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/stripe/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.RequestStripePay" ], "file": "router/api-router.go", "line": 118, "source_kind": "static", "id": "CORE-BILL-050", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "发起Stripe支付", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.StripePayRequest", "file": "controller/topup_stripe.go", "line": 30, "source": "StripePayRequest struct {\n\tAmount int64 `json:\"amount\"`\n\n\tPaymentMethod string `json:\"payment_method\"`\n\n\tSuccessURL string `json:\"success_url,omitempty\"`\n\n\tCancelURL string `json:\"cancel_url,omitempty\"`\n}" } ], "observed_literal_keys": [ "data", "message" ], "handler_sources": [ { "symbol": "controller.RequestStripePay", "file": "controller/topup_stripe.go", "line": 154 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/stripe/pay", "operation": { "summary": "发起Stripe支付", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/topup", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllTopUps" ], "file": "router/api-router.go", "line": 148, "source_kind": "static", "id": "CORE-BILL-051", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有充值记录", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllTopUps", "file": "controller/topup.go", "line": 541 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/topup", "operation": { "summary": "获取所有充值记录", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/topup", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.TopUp" ], "file": "router/api-router.go", "line": 115, "source_kind": "static", "id": "CORE-BILL-052", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "TopUp", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.topUpRequest", "file": "controller/user.go", "line": 1190, "source": "topUpRequest struct {\n\tKey string `json:\"key\"`\n}" } ], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.TopUp", "file": "controller/user.go", "line": 1235 } ], "source_behavior_markers": [ "MsgPaymentComplianceRequired", "MsgRedeemFailed", "MsgUserTopUpProcessing" ], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/topup/complete", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.AdminCompleteTopUp" ], "file": "router/api-router.go", "line": 149, "source_kind": "static", "id": "CORE-BILL-053", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "管理员完成充值", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.AdminCompleteTopupRequest", "file": "controller/topup.go", "line": 565, "source": "AdminCompleteTopupRequest struct {\n\tTradeNo string `json:\"trade_no\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.AdminCompleteTopUp", "file": "controller/topup.go", "line": 570 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/topup/complete", "operation": { "summary": "管理员完成充值", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/topup/info", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetTopUpInfo" ], "file": "router/api-router.go", "line": 113, "source_kind": "static", "id": "CORE-BILL-054", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取充值信息", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "amount_options", "color", "creem_products", "discount", "enable_creem_topup", "enable_online_topup", "enable_redemption", "enable_stripe_topup", "enable_waffo_pancake_topup", "enable_waffo_topup", "min_topup", "name", "pay_methods", "payment_compliance_confirmed", "payment_compliance_terms_version", "stripe_min_topup", "topup_link", "type", "waffo_min_topup", "waffo_pancake_min_topup", "waffo_pay_methods" ], "handler_sources": [ { "symbol": "controller.GetTopUpInfo", "file": "controller/topup.go", "line": 25 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/topup/info", "operation": { "summary": "获取充值信息", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/topup/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserTopUps" ], "file": "router/api-router.go", "line": 114, "source_kind": "static", "id": "CORE-BILL-055", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取用户充值记录", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetUserTopUps", "file": "controller/topup.go", "line": 515 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/topup/self", "operation": { "summary": "获取用户充值记录", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "充值" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/waffo-pancake/amount", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.RequestWaffoPancakeAmount" ], "file": "router/api-router.go", "line": 123, "source_kind": "static", "id": "CORE-BILL-056", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "RequestWaffoPancakeAmount", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.WaffoPancakePayRequest", "file": "controller/topup_waffo_pancake.go", "line": 21, "source": "WaffoPancakePayRequest struct {\n\tAmount int64 `json:\"amount\"`\n}" } ], "observed_literal_keys": [ "data", "message" ], "handler_sources": [ { "symbol": "controller.RequestWaffoPancakeAmount", "file": "controller/topup_waffo_pancake.go", "line": 25 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/waffo-pancake/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.RequestWaffoPancakePay" ], "file": "router/api-router.go", "line": 124, "source_kind": "static", "id": "CORE-BILL-057", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "RequestWaffoPancakePay", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.WaffoPancakePayRequest", "file": "controller/topup_waffo_pancake.go", "line": 21, "source": "WaffoPancakePayRequest struct {\n\tAmount int64 `json:\"amount\"`\n}" } ], "observed_literal_keys": [ "checkout_url", "data", "expires_at", "message", "order_id", "session_id", "token", "token_expires_at" ], "handler_sources": [ { "symbol": "controller.RequestWaffoPancakePay", "file": "controller/topup_waffo_pancake.go", "line": 342 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/waffo/amount", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.RequestWaffoAmount" ], "file": "router/api-router.go", "line": 121, "source_kind": "static", "id": "CORE-BILL-058", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "RequestWaffoAmount", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.WaffoPayRequest", "file": "controller/topup_waffo.go", "line": 107, "source": "WaffoPayRequest struct {\n\tAmount int64 `json:\"amount\"`\n\tPayMethodIndex *int `json:\"pay_method_index\"`\n\tPayMethodType string `json:\"pay_method_type\"`\n\tPayMethodName string `json:\"pay_method_name\"`\n}" } ], "observed_literal_keys": [ "data", "message" ], "handler_sources": [ { "symbol": "controller.RequestWaffoAmount", "file": "controller/topup_waffo.go", "line": 114 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/waffo/pay", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()" ], "handlers": [ "controller.RequestWaffoPay" ], "file": "router/api-router.go", "line": 122, "source_kind": "static", "id": "CORE-BILL-059", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "RequestWaffoPay", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.WaffoPayRequest", "file": "controller/topup_waffo.go", "line": 107, "source": "WaffoPayRequest struct {\n\tAmount int64 `json:\"amount\"`\n\tPayMethodIndex *int `json:\"pay_method_index\"`\n\tPayMethodType string `json:\"pay_method_type\"`\n\tPayMethodName string `json:\"pay_method_name\"`\n}" } ], "observed_literal_keys": [ "data", "message", "order_id", "payment_url" ], "handler_sources": [ { "symbol": "controller.RequestWaffoPay", "file": "controller/topup_waffo.go", "line": 147 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/waffo-pancake/webhook/:env", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.WaffoPancakeWebhook" ], "file": "router/api-router.go", "line": 67, "source_kind": "static", "id": "CORE-BILL-060", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "WaffoPancakeWebhook", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "env", "in": "path", "source": "controller literal access" }, { "name": "X-Waffo-Signature", "in": "header", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.WaffoPancakeWebhook", "file": "controller/topup_waffo_pancake.go", "line": 431 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/waffo/webhook", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "anonymousRequestBodyLimit", "controller.WaffoWebhook" ], "file": "router/api-router.go", "line": 64, "source_kind": "static", "id": "CORE-BILL-061", "group": "core-billing", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "WaffoWebhook", "auth_requirement": "支付通知：验签/环境/订单/金额核对，不能以无登录理解为无认证", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "X-SIGNATURE", "in": "header", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.WaffoWebhook", "file": "controller/topup_waffo.go", "line": 336 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "客户充值和消费由 Core 唯一写入；人民币实付、到账积分与赠送分列。先校验身份/订单/价格，支付通知验签并去重；操作价格快照不可随渠道变化；网关内部额度不是客户钱包。", "retry": "以支付事件/交易与订单唯一关联去重；验证金额、币种、环境和状态机，重复成功回调返回同结果，不再次增加积分。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/models", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.DashboardListModels" ], "file": "router/api-router.go", "line": 28, "source_kind": "static", "id": "CORE-MODEL-001", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取模型列表", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "success" ], "handler_sources": [ { "symbol": "controller.DashboardListModels", "file": "controller/model.go", "line": 325 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/models", "operation": { "summary": "获取模型列表", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/models/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllModelsMeta" ], "file": "router/api-router.go", "line": 393, "source_kind": "static", "id": "CORE-MODEL-002", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有模型元数据", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllModelsMeta", "file": "controller/model_meta.go", "line": 16 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/models/", "operation": { "summary": "获取所有模型元数据", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/models/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.CreateModelMeta" ], "file": "router/api-router.go", "line": 396, "source_kind": "static", "id": "CORE-MODEL-003", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建模型元数据", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.Model", "file": "model/model_meta.go", "line": 35, "source": "Model struct {\n\tId int `json:\"id\"`\n\tModelName string `json:\"model_name\" gorm:\"size:128;not null;uniqueIndex:uk_model_name_delete_at,priority:1\"`\n\tDescription string `json:\"description,omitempty\" gorm:\"type:text\"`\n\tIcon string `json:\"icon,omitempty\" gorm:\"type:varchar(128)\"`\n\tTags string `json:\"tags,omitempty\" gorm:\"type:varchar(255)\"`\n\tVendorID int `json:\"vendor_id,omitempty\" gorm:\"index\"`\n\tEndpoints string `json:\"endpoints,omitempty\" gorm:\"type:text\"`\n\tSupportedEndpoints []string `json:\"supported_endpoints,omitempty\" gorm:\"-\"`\n\tStatus int `json:\"status\" gorm:\"default:1\"`\n\tSyncOfficial int `json:\"sync_official\" gorm:\"default:1\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tUpdatedTime int64 `json:\"updated_time\" gorm:\"bigint\"`\n\tDeletedAt gorm.DeletedAt `json:\"-\" gorm:\"index;uniqueIndex:uk_model_name_delete_at,priority:2\"`\n\n\tBoundChannels []BoundChannel `json:\"bound_channels,omitempty\" gorm:\"-\"`\n\tEnableGroups []string `json:\"enable_groups,omitempty\" gorm:\"-\"`\n\tQuotaTypes []int `json:\"quota_types,omitempty\" gorm:\"-\"`\n\tNameRule int `json:\"name_rule\" gorm:\"default:0\"`\n\n\tMatchedModels []string `json:\"matched_models,omitempty\" gorm:\"-\"`\n\tMatchedCount int `json:\"matched_count,omitempty\" gorm:\"-\"`\n\n\tHasMetadata bool `json:\"has_metadata\" gorm:\"-\"`\n\tConfiguredChannelCount int `json:\"configured_channel_count\" gorm:\"-\"`\n\tSquareState ModelSquareState `json:\"square_state\" gorm:\"-\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.CreateModelMeta", "file": "controller/model_meta.go", "line": 107 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/models/", "operation": { "summary": "创建模型元数据", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/models/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UpdateModelMeta" ], "file": "router/api-router.go", "line": 397, "source_kind": "static", "id": "CORE-MODEL-004", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新模型元数据", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "status_only", "in": "query", "source": "controller literal access" } ], "body_types": [ { "type": "model.Model", "file": "model/model_meta.go", "line": 35, "source": "Model struct {\n\tId int `json:\"id\"`\n\tModelName string `json:\"model_name\" gorm:\"size:128;not null;uniqueIndex:uk_model_name_delete_at,priority:1\"`\n\tDescription string `json:\"description,omitempty\" gorm:\"type:text\"`\n\tIcon string `json:\"icon,omitempty\" gorm:\"type:varchar(128)\"`\n\tTags string `json:\"tags,omitempty\" gorm:\"type:varchar(255)\"`\n\tVendorID int `json:\"vendor_id,omitempty\" gorm:\"index\"`\n\tEndpoints string `json:\"endpoints,omitempty\" gorm:\"type:text\"`\n\tSupportedEndpoints []string `json:\"supported_endpoints,omitempty\" gorm:\"-\"`\n\tStatus int `json:\"status\" gorm:\"default:1\"`\n\tSyncOfficial int `json:\"sync_official\" gorm:\"default:1\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tUpdatedTime int64 `json:\"updated_time\" gorm:\"bigint\"`\n\tDeletedAt gorm.DeletedAt `json:\"-\" gorm:\"index;uniqueIndex:uk_model_name_delete_at,priority:2\"`\n\n\tBoundChannels []BoundChannel `json:\"bound_channels,omitempty\" gorm:\"-\"`\n\tEnableGroups []string `json:\"enable_groups,omitempty\" gorm:\"-\"`\n\tQuotaTypes []int `json:\"quota_types,omitempty\" gorm:\"-\"`\n\tNameRule int `json:\"name_rule\" gorm:\"default:0\"`\n\n\tMatchedModels []string `json:\"matched_models,omitempty\" gorm:\"-\"`\n\tMatchedCount int `json:\"matched_count,omitempty\" gorm:\"-\"`\n\n\tHasMetadata bool `json:\"has_metadata\" gorm:\"-\"`\n\tConfiguredChannelCount int `json:\"configured_channel_count\" gorm:\"-\"`\n\tSquareState ModelSquareState `json:\"square_state\" gorm:\"-\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.UpdateModelMeta", "file": "controller/model_meta.go", "line": 140 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/models/", "operation": { "summary": "更新模型元数据", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/models/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeleteModelMeta" ], "file": "router/api-router.go", "line": 398, "source_kind": "static", "id": "CORE-MODEL-005", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "删除模型", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" }, { "name": "remove_from_channels", "in": "query", "source": "controller literal access" }, { "name": "remove_pricing", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "model_ids", "remove_from_channels", "remove_pricing", "success", "updated_channels" ], "handler_sources": [ { "symbol": "controller.DeleteModelMeta", "file": "controller/model_meta.go", "line": 192 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/models/{id}", "operation": { "summary": "删除模型", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/models/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetModelMeta" ], "file": "router/api-router.go", "line": 395, "source_kind": "static", "id": "CORE-MODEL-006", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取指定模型", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetModelMeta", "file": "controller/model_meta.go", "line": 87 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/models/{id}", "operation": { "summary": "获取指定模型", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/models/delete", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.BatchDeleteModelMeta" ], "file": "router/api-router.go", "line": 391, "source_kind": "static", "id": "CORE-MODEL-007", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "BatchDeleteModelMeta", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "model_ids", "go_type": "[]int", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "remove_from_channels", "go_type": "bool", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "remove_pricing", "go_type": "bool", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "model_ids", "remove_from_channels", "remove_pricing", "success", "updated_channels" ], "handler_sources": [ { "symbol": "controller.BatchDeleteModelMeta", "file": "controller/model_meta.go", "line": 222 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/models/missing", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetMissingModels" ], "file": "router/api-router.go", "line": 392, "source_kind": "static", "id": "CORE-MODEL-008", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取缺失模型", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetMissingModels", "file": "controller/missing_models.go", "line": 14 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/models/missing", "operation": { "summary": "获取缺失模型", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/models/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SearchModelsMeta" ], "file": "router/api-router.go", "line": 394, "source_kind": "static", "id": "CORE-MODEL-009", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "搜索模型", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "vendor", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SearchModelsMeta", "file": "controller/model_meta.go", "line": 21 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/models/search", "operation": { "summary": "搜索模型", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/models/sync_upstream", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SyncUpstreamModels" ], "file": "router/api-router.go", "line": 390, "source_kind": "static", "id": "CORE-MODEL-010", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "同步上游模型", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [ { "name": "locale", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "source_version", "go_type": "string", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "selections", "go_type": "[]model.MetadataSyncSelection", "variable": "request", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "created_models", "created_vendors", "message", "success", "updated_models" ], "handler_sources": [ { "symbol": "controller.SyncUpstreamModels", "file": "controller/model_sync.go", "line": 413 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/models/sync_upstream", "operation": { "summary": "同步上游模型", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/models/sync_upstream/preview", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SyncUpstreamPreview" ], "file": "router/api-router.go", "line": 389, "source_kind": "static", "id": "CORE-MODEL-011", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "预览上游模型同步", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "locale", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "candidates", "source" ], "handler_sources": [ { "symbol": "controller.SyncUpstreamPreview", "file": "controller/model_sync.go", "line": 317 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/models/sync_upstream/preview", "operation": { "summary": "预览上游模型同步", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "模型管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/perf-metrics", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.HeaderNavModulePublicOrUserAuth(\"pricing\")" ], "handlers": [ "controller.GetPerfMetrics" ], "file": "router/api-router.go", "line": 41, "source_kind": "static", "id": "CORE-MODEL-012", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetPerfMetrics", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "model", "in": "query", "source": "controller literal access" }, { "name": "hours", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetPerfMetrics", "file": "controller/perf_metrics.go", "line": 38 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/perf-metrics/summary", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.HeaderNavModulePublicOrUserAuth(\"pricing\")" ], "handlers": [ "controller.GetPerfMetricsSummary" ], "file": "router/api-router.go", "line": 40, "source_kind": "static", "id": "CORE-MODEL-013", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetPerfMetricsSummary", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "hours", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetPerfMetricsSummary", "file": "controller/perf_metrics.go", "line": 14 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/pricing", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.HeaderNavModuleAuth(\"pricing\")" ], "handlers": [ "controller.GetPricing" ], "file": "router/api-router.go", "line": 36, "source_kind": "static", "id": "CORE-MODEL-014", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取定价信息", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "auto_groups", "data", "group_ratio", "pricing_version", "success", "supported_endpoint", "usable_group", "vendors" ], "handler_sources": [ { "symbol": "controller.GetPricing", "file": "controller/pricing.go", "line": 38 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/pricing", "operation": { "summary": "获取定价信息", "deprecated": false, "description": "🔓 无需鉴权（可选登录）", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/rankings", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.HeaderNavModuleAuth(\"rankings\")" ], "handlers": [ "controller.GetRankings" ], "file": "router/api-router.go", "line": 43, "source_kind": "static", "id": "CORE-MODEL-015", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetRankings", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "period", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetRankings", "file": "controller/rankings.go", "line": 10 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/groups", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetUserGroups" ], "file": "router/api-router.go", "line": 89, "source_kind": "static", "id": "CORE-MODEL-016", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取用户分组列表", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "desc", "message", "ratio", "success" ], "handler_sources": [ { "symbol": "controller.GetUserGroups", "file": "controller/group.go", "line": 26 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/groups", "operation": { "summary": "获取用户分组列表", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "用户登陆注册" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/models", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserModels" ], "file": "router/api-router.go", "line": 99, "source_kind": "static", "id": "CORE-MODEL-017", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取用户可用模型", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "auto", "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetUserModels", "file": "controller/user.go", "line": 613 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/models", "operation": { "summary": "获取用户可用模型", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/self/groups", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserGroups" ], "file": "router/api-router.go", "line": 97, "source_kind": "static", "id": "CORE-MODEL-018", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取当前用户分组", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "desc", "message", "ratio", "success" ], "handler_sources": [ { "symbol": "controller.GetUserGroups", "file": "controller/group.go", "line": 26 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user/self/groups", "operation": { "summary": "获取当前用户分组", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/vendors/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllVendors" ], "file": "router/api-router.go", "line": 378, "source_kind": "static", "id": "CORE-MODEL-019", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有供应商", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllVendors", "file": "controller/vendor_meta.go", "line": 15 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/vendors/", "operation": { "summary": "获取所有供应商", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "供应商" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/vendors/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.CreateVendorMeta" ], "file": "router/api-router.go", "line": 381, "source_kind": "static", "id": "CORE-MODEL-020", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建供应商", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.Vendor", "file": "model/vendor_meta.go", "line": 15, "source": "Vendor struct {\n\tModelCount int64 `json:\"model_count\" gorm:\"-\"`\n\tVersion string `json:\"version,omitempty\" gorm:\"-\"`\n\tId int `json:\"id\"`\n\tName string `json:\"name\" gorm:\"size:128;not null;uniqueIndex:uk_vendor_name_delete_at,priority:1\"`\n\tDescription string `json:\"description,omitempty\" gorm:\"type:text\"`\n\tIcon string `json:\"icon,omitempty\" gorm:\"type:varchar(128)\"`\n\tStatus int `json:\"status\" gorm:\"default:1\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tUpdatedTime int64 `json:\"updated_time\" gorm:\"bigint\"`\n\tDeletedAt gorm.DeletedAt `json:\"-\" gorm:\"index;uniqueIndex:uk_vendor_name_delete_at,priority:2\"`\n}" } ], "observed_literal_keys": [ "name", "vendor_id" ], "handler_sources": [ { "symbol": "controller.CreateVendorMeta", "file": "controller/vendor_meta.go", "line": 46 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/vendors/", "operation": { "summary": "创建供应商", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "供应商" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/vendors/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UpdateVendorMeta" ], "file": "router/api-router.go", "line": 382, "source_kind": "static", "id": "CORE-MODEL-021", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新供应商", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.Vendor", "file": "model/vendor_meta.go", "line": 15, "source": "Vendor struct {\n\tModelCount int64 `json:\"model_count\" gorm:\"-\"`\n\tVersion string `json:\"version,omitempty\" gorm:\"-\"`\n\tId int `json:\"id\"`\n\tName string `json:\"name\" gorm:\"size:128;not null;uniqueIndex:uk_vendor_name_delete_at,priority:1\"`\n\tDescription string `json:\"description,omitempty\" gorm:\"type:text\"`\n\tIcon string `json:\"icon,omitempty\" gorm:\"type:varchar(128)\"`\n\tStatus int `json:\"status\" gorm:\"default:1\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tUpdatedTime int64 `json:\"updated_time\" gorm:\"bigint\"`\n\tDeletedAt gorm.DeletedAt `json:\"-\" gorm:\"index;uniqueIndex:uk_vendor_name_delete_at,priority:2\"`\n}" } ], "observed_literal_keys": [ "name", "vendor_id" ], "handler_sources": [ { "symbol": "controller.UpdateVendorMeta", "file": "controller/vendor_meta.go", "line": 61 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/vendors/", "operation": { "summary": "更新供应商", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "供应商" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/vendors/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeleteVendorMeta" ], "file": "router/api-router.go", "line": 383, "source_kind": "static", "id": "CORE-MODEL-022", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "删除供应商", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "vendor_id" ], "handler_sources": [ { "symbol": "controller.DeleteVendorMeta", "file": "controller/vendor_meta.go", "line": 80 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/vendors/{id}", "operation": { "summary": "删除供应商", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "供应商" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/vendors/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetVendorMeta" ], "file": "router/api-router.go", "line": 380, "source_kind": "static", "id": "CORE-MODEL-023", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取指定供应商", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetVendorMeta", "file": "controller/vendor_meta.go", "line": 30 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/vendors/{id}", "operation": { "summary": "获取指定供应商", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "供应商" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/vendors/operations", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.ApplyVendorOperation" ], "file": "router/api-router.go", "line": 377, "source_kind": "static", "id": "CORE-MODEL-024", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "ApplyVendorOperation", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.VendorOperation", "file": "model/vendor_management.go", "line": 79, "source": "VendorOperation struct {\n\tAction string `json:\"action\"`\n\tVendorIDs []int `json:\"vendor_ids\"`\n\tModelIDs []int `json:\"model_ids\"`\n\tTargetVendorID int `json:\"target_vendor_id\"`\n\tExpectedVersion string `json:\"expected_version,omitempty\"`\n}" } ], "observed_literal_keys": [ "deleted_vendor_ids", "source_vendor_ids", "target_vendor_id", "updated_model_ids" ], "handler_sources": [ { "symbol": "controller.ApplyVendorOperation", "file": "controller/vendor_meta.go", "line": 125 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/vendors/operations/preview", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.PreviewVendorOperation" ], "file": "router/api-router.go", "line": 376, "source_kind": "static", "id": "CORE-MODEL-025", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "PreviewVendorOperation", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.VendorOperation", "file": "model/vendor_management.go", "line": 79, "source": "VendorOperation struct {\n\tAction string `json:\"action\"`\n\tVendorIDs []int `json:\"vendor_ids\"`\n\tModelIDs []int `json:\"model_ids\"`\n\tTargetVendorID int `json:\"target_vendor_id\"`\n\tExpectedVersion string `json:\"expected_version,omitempty\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.PreviewVendorOperation", "file": "controller/vendor_meta.go", "line": 111 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/vendors/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SearchVendors" ], "file": "router/api-router.go", "line": 379, "source_kind": "static", "id": "CORE-MODEL-026", "group": "core-catalog", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "搜索供应商", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "association", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SearchVendors", "file": "controller/vendor_meta.go", "line": 17 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/vendors/search", "operation": { "summary": "搜索供应商", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "供应商" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "区分公开销售目录、客户可用模型、员工元数据与真实供应配置。公开查询不能暴露内部密钥、渠道或客户协议价。客户价与目录权限由 Core 决定，供应商展示元数据不等于供应凭据管理。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/log/token", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CORS()", "middleware.CriticalRateLimit()", "middleware.TokenAuthReadOnly()" ], "handlers": [ "controller.GetLogByKey" ], "file": "router/api-router.go", "line": 345, "source_kind": "static", "id": "CORE-KEY-001", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "通过令牌获取日志", "auth_requirement": "模型 Key，只读验证", "parameters": [ { "name": "key", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetLogByKey", "file": "controller/log.go", "line": 79 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/log/token", "operation": { "summary": "通过令牌获取日志", "deprecated": false, "description": "🔓 无需鉴权（通过令牌查询）", "tags": [ "日志" ], "parameters": [ { "name": "key", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/token/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()" ], "handlers": [ "controller.GetAllTokens" ], "file": "router/api-router.go", "line": 275, "source_kind": "static", "id": "CORE-KEY-002", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllTokens", "file": "controller/token.go", "line": 130 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/token/", "operation": { "summary": "获取所有令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "令牌管理" ], "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "Query：p、page_size；客户 ID 来自身份上下文，不接受任意账户查询。", "result": "ApiSuccess 包络内分页数据 page/page_size/total/items；items 使用 masked key，并包含解析后的 auto_groups。", "checks": "跨账户隔离、空列表、边界分页、列表不泄漏完整 Key、数量一致。" } }, { "method": "POST", "path": "/api/token/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()" ], "handlers": [ "controller.AddToken" ], "file": "router/api-router.go", "line": 280, "source_kind": "static", "id": "CORE-KEY-003", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "user_id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "key", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "expired_time", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "remain_quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "unlimited_quota", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.tokenRequest", "file": "controller/token.go", "line": 35, "source": "tokenRequest struct {\n\tmodel.Token\n\tAutoGroups tokenAutoGroupsInput `json:\"auto_groups\"`\n}" } ], "observed_literal_keys": [ "Max", "message", "success" ], "handler_sources": [ { "symbol": "controller.AddToken", "file": "controller/token.go", "line": 278 } ], "source_behavior_markers": [ "MsgTokenGenerateFailed", "MsgTokenNameTooLong", "MsgTokenQuotaExceedMax", "MsgTokenQuotaNegative" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/token/", "operation": { "summary": "创建令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "令牌管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Token" } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "JSON 写入白名单：name（最多 50 字符）、expired_time、remain_quota、unlimited_quota、model_limits_enabled、model_limits、allow_ips、group、cross_group_retry、auto_groups。user_id、key、created_time、used_quota 为服务端事实；非无限额度需 0 到源码上限内，auto_groups 需去重、数量及可选组校验。", "result": "现有成功响应为 success=true、message=\"\"，不返回新 ID 或完整 Key。UI 可刷新列表；若增加 ID，记录为兼容扩展，不宣称上游已有。", "checks": "名称超长、负额度、用户 Key 数量上限、无权限分组、重复 auto_groups、客户端伪造 owner/key、创建后列表定位。" } }, { "method": "PUT", "path": "/api/token/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()" ], "handlers": [ "controller.UpdateToken" ], "file": "router/api-router.go", "line": 281, "source_kind": "static", "id": "CORE-KEY-004", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "user_id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "key", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "expired_time", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "remain_quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "unlimited_quota", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "status_only", "in": "query", "source": "controller literal access" } ], "body_types": [ { "type": "controller.tokenRequest", "file": "controller/token.go", "line": 35, "source": "tokenRequest struct {\n\tmodel.Token\n\tAutoGroups tokenAutoGroupsInput `json:\"auto_groups\"`\n}" } ], "observed_literal_keys": [ "Max", "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.UpdateToken", "file": "controller/token.go", "line": 383 } ], "source_behavior_markers": [ "MsgTokenExhaustedCannotEable", "MsgTokenExpiredCannotEnable", "MsgTokenNameTooLong", "MsgTokenQuotaExceedMax", "MsgTokenQuotaNegative" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/token/", "operation": { "summary": "更新令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "令牌管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Token" } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "JSON：id 必须定位本人记录，编辑字段沿用创建白名单；Query status_only 非空时只改 status。启用过期或已耗尽 Key 需满足原校验。auto_groups 只有明确提供时更新，非 auto 清除自动组与跨组重试。", "result": "沿用 UpdateToken 的成功包络与更新后记录；Key/owner/已用额度不能被任意覆盖。", "checks": "本人/他人、非法状态、过期再启用、耗尽再启用、只改状态、auto_groups 缺省与空列表区别。" } }, { "method": "DELETE", "path": "/api/token/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()" ], "handlers": [ "controller.DeleteToken" ], "file": "router/api-router.go", "line": 282, "source_kind": "static", "id": "CORE-KEY-005", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "删除令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteToken", "file": "controller/token.go", "line": 361 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/token/{id}", "operation": { "summary": "删除令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "令牌管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/token/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()" ], "handlers": [ "controller.GetToken" ], "file": "router/api-router.go", "line": 278, "source_kind": "static", "id": "CORE-KEY-006", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取指定令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetToken", "file": "controller/token.go", "line": 161 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/token/{id}", "operation": { "summary": "获取指定令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "令牌管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/token/:id/key", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.GetTokenKey" ], "file": "router/api-router.go", "line": 279, "source_kind": "static", "id": "CORE-KEY-007", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetTokenKey", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "key" ], "handler_sources": [ { "symbol": "controller.GetTokenKey", "file": "controller/token.go", "line": 188 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": { "input": "Path：id，解析为令牌 ID；无额外必填 JSON。必须是当前客户持有的 Key。", "result": "ApiSuccess(data={key: 完整值})；DisableCache；直接供掩码旁复制使用，不新增强制详情或确认。", "checks": "本人成功、他人/不存在/非法 ID 拒绝；缓存与日志不留完整值；重复读取不改变余额。" } }, { "method": "GET", "path": "/api/token/auto-groups", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()" ], "handlers": [ "controller.GetTokenAutoGroups" ], "file": "router/api-router.go", "line": 277, "source_kind": "static", "id": "CORE-KEY-008", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetTokenAutoGroups", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "groups", "max_count" ], "handler_sources": [ { "symbol": "controller.GetTokenAutoGroups", "file": "controller/token.go", "line": 176 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/token/batch", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()" ], "handlers": [ "controller.DeleteTokenBatch" ], "file": "router/api-router.go", "line": 283, "source_kind": "static", "id": "CORE-KEY-009", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "批量删除令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [ { "name": "ids", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.TokenBatch", "file": "controller/token.go", "line": 491, "source": "TokenBatch struct {\n\tIds []int `json:\"ids\"`\n}" } ], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteTokenBatch", "file": "controller/token.go", "line": 495 } ], "source_behavior_markers": [ "MsgInvalidParams" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/token/batch", "operation": { "summary": "批量删除令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "令牌管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "integer" } } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/token/batch/keys", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.GetTokenKeysBatch" ], "file": "router/api-router.go", "line": 284, "source_kind": "static", "id": "CORE-KEY-010", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetTokenKeysBatch", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.TokenBatch", "file": "controller/token.go", "line": 491, "source": "TokenBatch struct {\n\tIds []int `json:\"ids\"`\n}" } ], "observed_literal_keys": [ "Max", "keys" ], "handler_sources": [ { "symbol": "controller.GetTokenKeysBatch", "file": "controller/token.go", "line": 521 } ], "source_behavior_markers": [ "MsgBatchTooMany", "MsgInvalidParams" ], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": { "input": "JSON：ids 数组，非空且最多 100 项；查询强制当前用户归属。", "result": "ApiSuccess data.keys 为 ID 到完整 Key 的映射，只返回查询到的本人记录；不可假设每个请求 ID 都成功。", "checks": "0/1/100/101 项、混入他人或不存在 ID、无缓存、日志不记录完整值。" } }, { "method": "GET", "path": "/api/token/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.TokenOperationAudit()", "middleware.SearchRateLimit()" ], "handlers": [ "controller.SearchTokens" ], "file": "router/api-router.go", "line": 276, "source_kind": "static", "id": "CORE-KEY-011", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "搜索令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "token", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SearchTokens", "file": "controller/token.go", "line": 144 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/token/search", "operation": { "summary": "搜索令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "令牌管理" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/usage/token/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.CORS()", "middleware.CriticalRateLimit()", "middleware.TokenAuthReadOnly()" ], "handlers": [ "controller.GetTokenUsage" ], "file": "router/api-router.go", "line": 293, "source_kind": "static", "id": "CORE-KEY-012", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取令牌使用情况", "auth_requirement": "模型 Key，只读验证", "parameters": [ { "name": "Authorization", "in": "header", "description": "", "required": false, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "Authorization", "in": "header", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "code", "data", "expires_at", "message", "model_limits", "model_limits_enabled", "name", "object", "success", "total_available", "total_granted", "total_used", "unlimited_quota" ], "handler_sources": [ { "symbol": "controller.GetTokenUsage", "file": "controller/token.go", "line": 229 } ], "source_behavior_markers": [ "MsgTokenGetInfoFailed" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/usage/token/", "operation": { "summary": "获取令牌使用情况", "deprecated": false, "description": "🔑 需要令牌认证（TokenAuth）", "tags": [ "令牌管理" ], "parameters": [ { "name": "Authorization", "in": "header", "description": "", "required": false, "example": "", "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/token", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.UserCriticalRateLimit(\"access-token\")", "middleware.DisableCache()" ], "handlers": [ "controller.RevokeAccessToken" ], "file": "router/api-router.go", "line": 105, "source_kind": "static", "id": "CORE-KEY-013", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "RevokeAccessToken", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeAccessTokenRevoke", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccessTokenRevoke" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "token_ref" ], "handler_sources": [ { "symbol": "controller.RevokeAccessToken", "file": "controller/access_token.go", "line": 51 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/token", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.UserCriticalRateLimit(\"access-token\")", "middleware.DisableCache()" ], "handlers": [ "controller.GenerateAccessToken" ], "file": "router/api-router.go", "line": 102, "source_kind": "static", "id": "CORE-KEY-014", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "生成访问令牌", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeAccessTokenGenerate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccessTokenGenerate" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success", "token_ref" ], "handler_sources": [ { "symbol": "controller.GenerateAccessToken", "file": "controller/access_token.go", "line": 24 } ], "source_behavior_markers": [ "MsgUuidDuplicate" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/token", "operation": { "summary": "生成访问令牌", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "UserAuth 与账户访问令牌生成安全证明；没有额外必填 JSON。此 GET 会产生变更，不能当读取自动重试。", "result": "success/message/data 为新账户访问令牌字符串；不是模型调用 Key，生成会更新用户访问令牌。", "checks": "安全证明缺失/用途错误拒绝；只更新本人令牌，缓存和日志不泄密，响应丢失不无条件重新生成。" } }, { "method": "POST", "path": "/api/user/token", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.UserCriticalRateLimit(\"access-token\")", "middleware.DisableCache()" ], "handlers": [ "controller.GenerateAccessToken" ], "file": "router/api-router.go", "line": 104, "source_kind": "static", "id": "CORE-KEY-015", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GenerateAccessToken", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeAccessTokenGenerate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccessTokenGenerate" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success", "token_ref" ], "handler_sources": [ { "symbol": "controller.GenerateAccessToken", "file": "controller/access_token.go", "line": 24 } ], "source_behavior_markers": [ "MsgUuidDuplicate" ], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": { "input": "UserAuth 与账户访问令牌生成安全证明，复用同一个 GenerateAccessToken。", "result": "success/message/data 为新账户访问令牌，替换用户当前访问令牌。", "checks": "验证安全证明、本人归属、重复点击与响应丢失处理、日志与缓存脱敏。" } }, { "method": "GET", "path": "/api/user/token/status", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.GetAccessTokenStatus" ], "file": "router/api-router.go", "line": 103, "source_kind": "static", "id": "CORE-KEY-016", "group": "core-keys", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetAccessTokenStatus", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAccessTokenStatus", "file": "controller/access_token.go", "line": 15 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "模型调用 Key 与账户访问令牌分开。列表掩码、单条取回校验 owner；不要求用户进入详情或再确认。创建不接受客户端自定 user_id/key/used_quota；撤销、有效期、模型范围和额度实时或按明确缓存时限生效。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/data/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllQuotaDates" ], "file": "router/api-router.go", "line": 337, "source_kind": "static", "id": "CORE-USAGE-001", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有额度数据", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "username", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetAllQuotaDates", "file": "controller/usedata.go", "line": 31 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/data/", "operation": { "summary": "获取所有额度数据", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "数据统计" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/data/flow", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllFlowQuotaDates" ], "file": "router/api-router.go", "line": 340, "source_kind": "static", "id": "CORE-USAGE-002", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetAllFlowQuotaDates", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "username", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetAllFlowQuotaDates", "file": "controller/usedata.go", "line": 88 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/data/flow/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserFlowQuotaDates" ], "file": "router/api-router.go", "line": 341, "source_kind": "static", "id": "CORE-USAGE-003", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetUserFlowQuotaDates", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetUserFlowQuotaDates", "file": "controller/usedata.go", "line": 107 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/data/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserQuotaDates" ], "file": "router/api-router.go", "line": 339, "source_kind": "static", "id": "CORE-USAGE-004", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取个人额度数据", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetUserQuotaDates", "file": "controller/usedata.go", "line": 63 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/data/self", "operation": { "summary": "获取个人额度数据", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "数据统计" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/data/users", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetQuotaDatesByUser" ], "file": "router/api-router.go", "line": 338, "source_kind": "static", "id": "CORE-USAGE-005", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetQuotaDatesByUser", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetQuotaDatesByUser", "file": "controller/usedata.go", "line": 48 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/log/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllLogs" ], "file": "router/api-router.go", "line": 312, "source_kind": "static", "id": "CORE-USAGE-006", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有日志", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "type", "in": "query", "source": "controller literal access" }, { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "username", "in": "query", "source": "controller literal access" }, { "name": "token_name", "in": "query", "source": "controller literal access" }, { "name": "model_name", "in": "query", "source": "controller literal access" }, { "name": "channel", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" }, { "name": "request_id", "in": "query", "source": "controller literal access" }, { "name": "upstream_request_id", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllLogs", "file": "controller/log.go", "line": 13 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/log/", "operation": { "summary": "获取所有日志", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "日志" ], "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/log/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SearchAllLogs" ], "file": "router/api-router.go", "line": 316, "source_kind": "static", "id": "CORE-USAGE-007", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "历史/废弃兼容，默认不启用", "summary": "搜索日志", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.SearchAllLogs", "file": "controller/log.go", "line": 64 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/log/search", "operation": { "summary": "搜索日志", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "日志" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/log/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserLogs" ], "file": "router/api-router.go", "line": 317, "source_kind": "static", "id": "CORE-USAGE-008", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取个人日志", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "type", "in": "query", "source": "controller literal access" }, { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "token_name", "in": "query", "source": "controller literal access" }, { "name": "model_name", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" }, { "name": "request_id", "in": "query", "source": "controller literal access" }, { "name": "upstream_request_id", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetUserLogs", "file": "controller/log.go", "line": 41 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/log/self", "operation": { "summary": "获取个人日志", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "日志" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/log/self/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()", "middleware.SearchRateLimit()" ], "handlers": [ "controller.SearchUserLogs" ], "file": "router/api-router.go", "line": 318, "source_kind": "static", "id": "CORE-USAGE-009", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "历史/废弃兼容，默认不启用", "summary": "搜索个人日志", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.SearchUserLogs", "file": "controller/log.go", "line": 72 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/log/self/search", "operation": { "summary": "搜索个人日志", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "日志" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/log/self/stat", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetLogsSelfStat" ], "file": "router/api-router.go", "line": 314, "source_kind": "static", "id": "CORE-USAGE-010", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取个人日志统计", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "type", "in": "query", "source": "controller literal access" }, { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "token_name", "in": "query", "source": "controller literal access" }, { "name": "model_name", "in": "query", "source": "controller literal access" }, { "name": "channel", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "quota", "rpm", "success", "tpm" ], "handler_sources": [ { "symbol": "controller.GetLogsSelfStat", "file": "controller/log.go", "line": 130 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/log/self/stat", "operation": { "summary": "获取个人日志统计", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "日志" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": { "input": "Query：type、start_timestamp、end_timestamp、token_name、model_name、channel、group；username 取身份上下文。当前统计不接 request_id；与列表过滤差异需显式呈现。", "result": "success/message/data；data 为 quota、rpm、tpm。不要将 quota 直接展示成人民币；单位换算按固定积分规则。", "checks": "同条件与明细核对、时间边界、空结果、身份隔离；请求 ID 筛选不得伪装已被统计支持。" } }, { "method": "GET", "path": "/api/log/stat", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetLogsStat" ], "file": "router/api-router.go", "line": 313, "source_kind": "static", "id": "CORE-USAGE-011", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取日志统计", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "type", "in": "query", "source": "controller literal access" }, { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "token_name", "in": "query", "source": "controller literal access" }, { "name": "username", "in": "query", "source": "controller literal access" }, { "name": "model_name", "in": "query", "source": "controller literal access" }, { "name": "channel", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "quota", "rpm", "success", "tpm" ], "handler_sources": [ { "symbol": "controller.GetLogsStat", "file": "controller/log.go", "line": 103 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/log/stat", "operation": { "summary": "获取日志统计", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "日志" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/mj/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllMidjourney" ], "file": "router/api-router.go", "line": 364, "source_kind": "static", "id": "CORE-USAGE-012", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有Midjourney任务", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "channel_id", "in": "query", "source": "controller literal access" }, { "name": "mj_id", "in": "query", "source": "controller literal access" }, { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllMidjourney", "file": "controller/midjourney.go", "line": 281 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/mj/", "operation": { "summary": "获取所有Midjourney任务", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "任务" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/mj/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserMidjourney" ], "file": "router/api-router.go", "line": 363, "source_kind": "static", "id": "CORE-USAGE-013", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取个人Midjourney任务", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "mj_id", "in": "query", "source": "controller literal access" }, { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetUserMidjourney", "file": "controller/midjourney.go", "line": 306 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/mj/self", "operation": { "summary": "获取个人Midjourney任务", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "任务" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/task", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllTask" ], "file": "router/api-router.go", "line": 369, "source_kind": "static", "id": "CORE-USAGE-014", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetAllTask", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "platform", "in": "query", "source": "controller literal access" }, { "name": "task_id", "in": "query", "source": "controller literal access" }, { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "action", "in": "query", "source": "controller literal access" }, { "name": "channel_id", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllTask", "file": "controller/task.go", "line": 374 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/task/:task_id/artifacts", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetDashboardTaskArtifacts" ], "file": "router/api-router.go", "line": 370, "source_kind": "static", "id": "CORE-USAGE-015", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetDashboardTaskArtifacts", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "task_id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetDashboardTaskArtifacts", "file": "controller/task.go", "line": 79 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/task/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.UserAuth()" ], "handlers": [ "controller.GetUserTask" ], "file": "router/api-router.go", "line": 368, "source_kind": "static", "id": "CORE-USAGE-016", "group": "core-usage", "owner": "Core", "phase": "CE-04", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取个人任务", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "start_timestamp", "in": "query", "source": "controller literal access" }, { "name": "end_timestamp", "in": "query", "source": "controller literal access" }, { "name": "platform", "in": "query", "source": "controller literal access" }, { "name": "task_id", "in": "query", "source": "controller literal access" }, { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "action", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetUserTask", "file": "controller/task.go", "line": 385 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/task/self", "operation": { "summary": "获取个人任务", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "任务" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "结果按客户/员工权限过滤，时间、分页、模型与 Key 筛选口径必须注明。执行状态和结算状态独立，缺失用量显示待核对；账单和汇总需可追溯，不能把诊断日志当唯一账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user-agreement", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()" ], "handlers": [ "controller.GetUserAgreement" ], "file": "router/api-router.go", "line": 31, "source_kind": "static", "id": "CORE-USER-001", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取用户协议", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetUserAgreement", "file": "controller/misc.go", "line": 193 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/user-agreement", "operation": { "summary": "获取用户协议", "deprecated": false, "description": "🔓 无需鉴权", "tags": [ "系统" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllUsers" ], "file": "router/api-router.go", "line": 147, "source_kind": "static", "id": "CORE-USER-002", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取所有用户", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "sort_by", "in": "query", "source": "controller literal access" }, { "name": "sort_order", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAllUsers", "file": "controller/user.go", "line": 335 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/", "operation": { "summary": "获取所有用户", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.CreateUser" ], "file": "router/api-router.go", "line": 155, "source_kind": "static", "id": "CORE-USER-003", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建用户", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "username", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "display_name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "role", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "email", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "group", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "used_quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "request_count", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.User", "file": "model/user.go", "line": 79, "source": "User struct {\n\tId int `json:\"id\"`\n\tUsername string `json:\"username\" gorm:\"unique;index\" validate:\"max=20\"`\n\tPassword string `json:\"password\" gorm:\"not null;\" validate:\"min=8,max=128\"`\n\tHasPassword bool `json:\"-\" gorm:\"-:all\"`\n\tOriginalPassword string `json:\"original_password\" gorm:\"-:all\"`\n\tDisplayName string `json:\"display_name\" gorm:\"index\" validate:\"max=20\"`\n\tRole int `json:\"role\" gorm:\"type:int;default:1\"`\n\tStatus int `json:\"status\" gorm:\"type:int;default:1\"`\n\tEmail string `json:\"email\" gorm:\"index\" validate:\"max=50\"`\n\tGitHubId string `json:\"github_id\" gorm:\"column:github_id;index\"`\n\tDiscordId string `json:\"discord_id\" gorm:\"column:discord_id;index\"`\n\tOidcId string `json:\"oidc_id\" gorm:\"column:oidc_id;index\"`\n\tWeChatId string `json:\"wechat_id\" gorm:\"column:wechat_id;index\"`\n\tTelegramId string `json:\"telegram_id\" gorm:\"column:telegram_id;index\"`\n\tVerificationCode string `json:\"verification_code\" gorm:\"-:all\"`\n\tAccessToken *string `json:\"-\" gorm:\"type:char(32);column:access_token;uniqueIndex\"`\n\tAccessTokenCreatedAt *int64 `json:\"-\" gorm:\"type:bigint;column:access_token_created_at\"`\n\tQuota int `json:\"quota\" gorm:\"type:int;default:0\"`\n\tUsedQuota int `json:\"used_quota\" gorm:\"type:int;default:0;column:used_quota\"`\n\tRequestCount int `json:\"request_count\" gorm:\"type:int;default:0;\"`\n\tGroup string `json:\"group\" gorm:\"type:varchar(64);default:'default'\"`\n\tAffCode string `json:\"aff_code\" gorm:\"type:varchar(32);column:aff_code;uniqueIndex\"`\n\tAffCount int `json:\"aff_count\" gorm:\"type:int;default:0;column:aff_count\"`\n\tAffQuota int `json:\"aff_quota\" gorm:\"type:int;default:0;column:aff_quota\"`\n\tAffHistoryQuota int `json:\"aff_history_quota\" gorm:\"type:int;default:0;column:aff_history\"`\n\tInviterId int `json:\"inviter_id\" gorm:\"type:int;column:inviter_id;index\"`\n\tDeletedAt gorm.DeletedAt `gorm:\"index\"`\n\tLinuxDOId string `json:\"linux_do_id\" gorm:\"column:linux_do_id;index\"`\n\tSetting string `json:\"setting\" gorm:\"type:text;column:setting\"`\n\tRemark string `json:\"remark,omitempty\" gorm:\"type:varchar(255)\" validate:\"max=255\"`\n\tStripeCustomer string `json:\"stripe_customer\" gorm:\"type:varchar(64);column:stripe_customer;index\"`\n\tCreatedAt int64 `json:\"created_at\" gorm:\"autoCreateTime;column:created_at\"`\n\tLastLoginAt int64 `json:\"last_login_at\" gorm:\"default:0;column:last_login_at\"`\n\tAuthVersion int64 `json:\"-\" gorm:\"type:bigint;not null;default:1;column:auth_version\"`\n\tAdminPermissions map[string]map[string]bool `json:\"admin_permissions,omitempty\" gorm:\"-:all\"`\n}" } ], "observed_literal_keys": [ "Error", "message", "role", "success", "username" ], "handler_sources": [ { "symbol": "controller.CreateUser", "file": "controller/user.go", "line": 969 } ], "source_behavior_markers": [ "MsgInvalidParams", "MsgUserCannotCreateHigherLevel", "MsgUserInputInvalid" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/", "operation": { "summary": "创建用户", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/user/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UpdateUser" ], "file": "router/api-router.go", "line": 157, "source_kind": "static", "id": "CORE-USER-004", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新用户", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "username", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "display_name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "role", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "email", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "group", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "used_quota", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "request_count", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.User", "file": "model/user.go", "line": 79, "source": "User struct {\n\tId int `json:\"id\"`\n\tUsername string `json:\"username\" gorm:\"unique;index\" validate:\"max=20\"`\n\tPassword string `json:\"password\" gorm:\"not null;\" validate:\"min=8,max=128\"`\n\tHasPassword bool `json:\"-\" gorm:\"-:all\"`\n\tOriginalPassword string `json:\"original_password\" gorm:\"-:all\"`\n\tDisplayName string `json:\"display_name\" gorm:\"index\" validate:\"max=20\"`\n\tRole int `json:\"role\" gorm:\"type:int;default:1\"`\n\tStatus int `json:\"status\" gorm:\"type:int;default:1\"`\n\tEmail string `json:\"email\" gorm:\"index\" validate:\"max=50\"`\n\tGitHubId string `json:\"github_id\" gorm:\"column:github_id;index\"`\n\tDiscordId string `json:\"discord_id\" gorm:\"column:discord_id;index\"`\n\tOidcId string `json:\"oidc_id\" gorm:\"column:oidc_id;index\"`\n\tWeChatId string `json:\"wechat_id\" gorm:\"column:wechat_id;index\"`\n\tTelegramId string `json:\"telegram_id\" gorm:\"column:telegram_id;index\"`\n\tVerificationCode string `json:\"verification_code\" gorm:\"-:all\"`\n\tAccessToken *string `json:\"-\" gorm:\"type:char(32);column:access_token;uniqueIndex\"`\n\tAccessTokenCreatedAt *int64 `json:\"-\" gorm:\"type:bigint;column:access_token_created_at\"`\n\tQuota int `json:\"quota\" gorm:\"type:int;default:0\"`\n\tUsedQuota int `json:\"used_quota\" gorm:\"type:int;default:0;column:used_quota\"`\n\tRequestCount int `json:\"request_count\" gorm:\"type:int;default:0;\"`\n\tGroup string `json:\"group\" gorm:\"type:varchar(64);default:'default'\"`\n\tAffCode string `json:\"aff_code\" gorm:\"type:varchar(32);column:aff_code;uniqueIndex\"`\n\tAffCount int `json:\"aff_count\" gorm:\"type:int;default:0;column:aff_count\"`\n\tAffQuota int `json:\"aff_quota\" gorm:\"type:int;default:0;column:aff_quota\"`\n\tAffHistoryQuota int `json:\"aff_history_quota\" gorm:\"type:int;default:0;column:aff_history\"`\n\tInviterId int `json:\"inviter_id\" gorm:\"type:int;column:inviter_id;index\"`\n\tDeletedAt gorm.DeletedAt `gorm:\"index\"`\n\tLinuxDOId string `json:\"linux_do_id\" gorm:\"column:linux_do_id;index\"`\n\tSetting string `json:\"setting\" gorm:\"type:text;column:setting\"`\n\tRemark string `json:\"remark,omitempty\" gorm:\"type:varchar(255)\" validate:\"max=255\"`\n\tStripeCustomer string `json:\"stripe_customer\" gorm:\"type:varchar(64);column:stripe_customer;index\"`\n\tCreatedAt int64 `json:\"created_at\" gorm:\"autoCreateTime;column:created_at\"`\n\tLastLoginAt int64 `json:\"last_login_at\" gorm:\"default:0;column:last_login_at\"`\n\tAuthVersion int64 `json:\"-\" gorm:\"type:bigint;not null;default:1;column:auth_version\"`\n\tAdminPermissions map[string]map[string]bool `json:\"admin_permissions,omitempty\" gorm:\"-:all\"`\n}" } ], "observed_literal_keys": [ "Error", "id", "message", "success", "username" ], "handler_sources": [ { "symbol": "controller.UpdateUser", "file": "controller/user.go", "line": 647 } ], "source_behavior_markers": [ "MsgInvalidParams", "MsgUserInputInvalid", "MsgUserNoPermissionHigherLevel" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/", "operation": { "summary": "更新用户", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/User" } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeleteUser" ], "file": "router/api-router.go", "line": 158, "source_kind": "static", "id": "CORE-USER-005", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "删除用户", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "id", "message", "success", "username" ], "handler_sources": [ { "symbol": "controller.DeleteUser", "file": "controller/user.go", "line": 910 } ], "source_behavior_markers": [ "MsgUserNoPermissionHigherLevel" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/{id}", "operation": { "summary": "删除用户", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetUser" ], "file": "router/api-router.go", "line": 154, "source_kind": "static", "id": "CORE-USER-006", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取指定用户", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetUser", "file": "controller/user.go", "line": 384 } ], "source_behavior_markers": [ "MsgUserNoPermissionSameLevel" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/{id}", "operation": { "summary": "获取指定用户", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/aff", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetAffCode" ], "file": "router/api-router.go", "line": 112, "source_kind": "static", "id": "CORE-USER-007", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取邀请码", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetAffCode", "file": "controller/user.go", "line": 437 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/aff", "operation": { "summary": "获取邀请码", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/checkin", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetCheckinStatus" ], "file": "router/api-router.go", "line": 136, "source_kind": "static", "id": "CORE-USER-008", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetCheckinStatus", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "month", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "enabled", "max_quota", "message", "min_quota", "stats", "success" ], "handler_sources": [ { "symbol": "controller.GetCheckinStatus", "file": "controller/checkin.go", "line": 16 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/checkin", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.TurnstileCheck()" ], "handlers": [ "controller.DoCheckin" ], "file": "router/api-router.go", "line": 137, "source_kind": "static", "id": "CORE-USER-009", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "DoCheckin", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "checkin_date", "data", "message", "quota_awarded", "success" ], "handler_sources": [ { "symbol": "controller.DoCheckin", "file": "controller/checkin.go", "line": 47 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/user/manage", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.ManageUser" ], "file": "router/api-router.go", "line": 156, "source_kind": "static", "id": "CORE-USER-010", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "管理用户状态", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "action", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "disable", "enable", "delete", "promote", "demote" ] } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.ManageRequest", "file": "controller/user.go", "line": 1043, "source": "ManageRequest struct {\n\tId int `json:\"id\"`\n\tAction string `json:\"action\"`\n\tValue int `json:\"value\"`\n\tMode string `json:\"mode\"`\n}" } ], "observed_literal_keys": [ "action", "data", "delete", "demote", "disable", "enable", "id", "message", "promote", "success", "username" ], "handler_sources": [ { "symbol": "controller.ManageUser", "file": "controller/user.go", "line": 1051 } ], "source_behavior_markers": [ "MsgInvalidParams", "MsgUserAdminCannotPromote", "MsgUserAlreadyAdmin", "MsgUserAlreadyCommon", "MsgUserCannotDeleteRootUser", "MsgUserCannotDemoteRootUser", "MsgUserCannotDisableRootUser", "MsgUserNoPermissionHigherLevel", "MsgUserNotExists" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/manage", "operation": { "summary": "管理用户状态", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "integer" }, "action": { "type": "string", "enum": [ "disable", "enable", "delete", "promote", "demote" ] } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SearchUsers" ], "file": "router/api-router.go", "line": 150, "source_kind": "static", "id": "CORE-USER-011", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "搜索用户", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "group", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" }, { "name": "role", "in": "query", "source": "controller literal access" }, { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "sort_by", "in": "query", "source": "controller literal access" }, { "name": "sort_order", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.SearchUsers", "file": "controller/user.go", "line": 351 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/search", "operation": { "summary": "搜索用户", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "用户管理" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "group", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/user/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.DisableCache()" ], "handlers": [ "controller.DeleteSelf" ], "file": "router/api-router.go", "line": 101, "source_kind": "static", "id": "CORE-USER-012", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "注销当前用户", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopeAccountDelete", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopeAccountDelete" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteSelf", "file": "controller/user.go", "line": 942 } ], "source_behavior_markers": [ "MsgUserCannotDeleteRootUser" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/self", "operation": { "summary": "注销当前用户", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/user/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.GetSelf" ], "file": "router/api-router.go", "line": 98, "source_kind": "static", "id": "CORE-USER-013", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取当前用户信息", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetSelf", "file": "controller/user.go", "line": 462 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/self", "operation": { "summary": "获取当前用户信息", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/user/self", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()", "middleware.CriticalRateLimit()", "middleware.DisableCache()" ], "handlers": [ "controller.UpdateSelf" ], "file": "router/api-router.go", "line": 100, "source_kind": "static", "id": "CORE-USER-014", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新当前用户信息", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）；处理器安全证明用途：VerificationScopePasswordChange, VerificationScopePasswordSet", "parameters": [], "request_fields": [ { "name": "username", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "display_name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "password", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "original_password", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [ "VerificationScopePasswordChange", "VerificationScopePasswordSet" ], "parameters": [], "body_types": [], "observed_literal_keys": [ "access_expires_at", "access_token", "data", "has_password", "message", "notification_failed", "notification_warning", "session", "success", "token_type" ], "handler_sources": [ { "symbol": "controller.UpdateSelf", "file": "controller/user.go", "line": 759 } ], "source_behavior_markers": [ "MsgInvalidInput", "MsgInvalidParams", "MsgUpdateFailed", "MsgUpdateSuccess" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/self", "operation": { "summary": "更新当前用户信息", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "username": { "type": "string" }, "display_name": { "type": "string" }, "password": { "type": "string" }, "original_password": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/user/setting", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.DisableCache()", "middleware.UserAuth()" ], "handlers": [ "controller.UpdateUserSetting" ], "file": "router/api-router.go", "line": 126, "source_kind": "static", "id": "CORE-USER-015", "group": "core-users", "owner": "Core", "phase": "CE-02", "disposition": "优先沿用，迁入/适配后验收", "summary": "更新用户设置", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [ { "name": "notify_type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "quota_warning_threshold", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "webhook_url", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "notification_email", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.UpdateUserSettingRequest", "file": "controller/user.go", "line": 1268, "source": "UpdateUserSettingRequest struct {\n\tQuotaWarningType string `json:\"notify_type\"`\n\tQuotaWarningThreshold float64 `json:\"quota_warning_threshold\"`\n\tWebhookUrl string `json:\"webhook_url,omitempty\"`\n\tWebhookSecret string `json:\"webhook_secret,omitempty\"`\n\tNotificationEmail string `json:\"notification_email,omitempty\"`\n\tBarkUrl string `json:\"bark_url,omitempty\"`\n\tGotifyUrl string `json:\"gotify_url,omitempty\"`\n\tGotifyToken string `json:\"gotify_token,omitempty\"`\n\tGotifyPriority int `json:\"gotify_priority,omitempty\"`\n\tUpstreamModelUpdateNotifyEnabled *bool `json:\"upstream_model_update_notify_enabled,omitempty\"`\n\tAcceptUnsetModelRatioModel bool `json:\"accept_unset_model_ratio_model\"`\n\tRecordIpLog bool `json:\"record_ip_log\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.UpdateUserSetting", "file": "controller/user.go", "line": 1283 } ], "source_behavior_markers": [ "MsgInvalidParams", "MsgQuotaThresholdGtZero", "MsgSettingBarkUrlEmpty", "MsgSettingBarkUrlInvalid", "MsgSettingEmailInvalid", "MsgSettingGotifyTokenEmpty", "MsgSettingGotifyUrlEmpty", "MsgSettingGotifyUrlInvalid", "MsgSettingInvalidType", "MsgSettingSaved", "MsgSettingUrlMustHttp", "MsgSettingWebhookEmpty", "MsgSettingWebhookInvalid", "MsgUpdateFailed" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/user/setting", "operation": { "summary": "更新用户设置", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "用户管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "notify_type": { "type": "string" }, "quota_warning_threshold": { "type": "number" }, "webhook_url": { "type": "string" }, "notification_email": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "自身接口从认证上下文确定用户；员工接口逐项校验角色。禁止请求体覆盖服务端归属、余额和未授权角色；用户禁用/删除需影响后续授权并保留必要账务事实。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/:mode/mj/image/:id", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()" ], "handlers": [ "relay.RelayMidjourneyImage" ], "file": "router/relay-router.go", "line": 198, "source_kind": "static", "id": "EDGE-COMPAT-001", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourneyImage", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "relay.RelayMidjourneyImage", "file": "relay/mjproxy_handler.go", "line": 29 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/insight-face/swap", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 215, "source_kind": "static", "id": "EDGE-COMPAT-002", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/action", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 201, "source_kind": "static", "id": "EDGE-COMPAT-003", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/blend", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 208, "source_kind": "static", "id": "EDGE-COMPAT-004", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/change", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 205, "source_kind": "static", "id": "EDGE-COMPAT-005", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/describe", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 207, "source_kind": "static", "id": "EDGE-COMPAT-006", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/edits", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 209, "source_kind": "static", "id": "EDGE-COMPAT-007", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/imagine", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 204, "source_kind": "static", "id": "EDGE-COMPAT-008", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/modal", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 203, "source_kind": "static", "id": "EDGE-COMPAT-009", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/shorten", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 202, "source_kind": "static", "id": "EDGE-COMPAT-010", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/simple-change", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 206, "source_kind": "static", "id": "EDGE-COMPAT-011", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/upload-discord-images", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 216, "source_kind": "static", "id": "EDGE-COMPAT-012", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/submit/video", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 210, "source_kind": "static", "id": "EDGE-COMPAT-013", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/:mode/mj/task/:id/fetch", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 212, "source_kind": "static", "id": "EDGE-COMPAT-014", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/:mode/mj/task/:id/image-seed", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 213, "source_kind": "static", "id": "EDGE-COMPAT-015", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/:mode/mj/task/list-by-condition", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 214, "source_kind": "static", "id": "EDGE-COMPAT-016", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/dashboard/billing/subscription", "middleware": [ "middleware.RouteTag(\"old_api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.GlobalAPIRateLimit()", "middleware.CORS()", "middleware.TokenAuth()" ], "handlers": [ "controller.GetSubscription" ], "file": "router/dashboard.go", "line": 18, "source_kind": "static", "id": "EDGE-COMPAT-017", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "GetSubscription", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.GetSubscription", "file": "controller/billing.go", "line": 11 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/dashboard/billing/usage", "middleware": [ "middleware.RouteTag(\"old_api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.GlobalAPIRateLimit()", "middleware.CORS()", "middleware.TokenAuth()" ], "handlers": [ "controller.GetUsage" ], "file": "router/dashboard.go", "line": 20, "source_kind": "static", "id": "EDGE-COMPAT-018", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "GetUsage", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.GetUsage", "file": "controller/billing.go", "line": 71 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/mj/image/:id", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()" ], "handlers": [ "relay.RelayMidjourneyImage" ], "file": "router/relay-router.go", "line": 198, "source_kind": "static", "id": "EDGE-COMPAT-019", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourneyImage", "auth_requirement": "未挂 User/Admin/Token 认证；按处理器及配置校验", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "relay.RelayMidjourneyImage", "file": "relay/mjproxy_handler.go", "line": 29 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/insight-face/swap", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 215, "source_kind": "static", "id": "EDGE-COMPAT-020", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/action", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 201, "source_kind": "static", "id": "EDGE-COMPAT-021", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/blend", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 208, "source_kind": "static", "id": "EDGE-COMPAT-022", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/change", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 205, "source_kind": "static", "id": "EDGE-COMPAT-023", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/describe", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 207, "source_kind": "static", "id": "EDGE-COMPAT-024", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/edits", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 209, "source_kind": "static", "id": "EDGE-COMPAT-025", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/imagine", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 204, "source_kind": "static", "id": "EDGE-COMPAT-026", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/modal", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 203, "source_kind": "static", "id": "EDGE-COMPAT-027", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/shorten", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 202, "source_kind": "static", "id": "EDGE-COMPAT-028", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/simple-change", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 206, "source_kind": "static", "id": "EDGE-COMPAT-029", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/upload-discord-images", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 216, "source_kind": "static", "id": "EDGE-COMPAT-030", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/submit/video", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 210, "source_kind": "static", "id": "EDGE-COMPAT-031", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/mj/task/:id/fetch", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 212, "source_kind": "static", "id": "EDGE-COMPAT-032", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/mj/task/:id/image-seed", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 213, "source_kind": "static", "id": "EDGE-COMPAT-033", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/mj/task/list-by-condition", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayMidjourney" ], "file": "router/relay-router.go", "line": 214, "source_kind": "static", "id": "EDGE-COMPAT-034", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "RelayMidjourney", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "description", "type" ], "handler_sources": [ { "symbol": "controller.RelayMidjourney", "file": "controller/relay.go", "line": 433 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/pg/chat/completions", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.UserAuth()", "middleware.Distribute()" ], "handlers": [ "controller.Playground" ], "file": "router/relay-router.go", "line": 67, "source_kind": "static", "id": "EDGE-COMPAT-035", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "Playground", "auth_requirement": "客户登录身份（沿用上游 UserAuth 支持范围）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.Playground", "file": "controller/playground.go", "line": 15 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/dashboard/billing/subscription", "middleware": [ "middleware.RouteTag(\"old_api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.GlobalAPIRateLimit()", "middleware.CORS()", "middleware.TokenAuth()" ], "handlers": [ "controller.GetSubscription" ], "file": "router/dashboard.go", "line": 19, "source_kind": "static", "id": "EDGE-COMPAT-036", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "GetSubscription", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.GetSubscription", "file": "controller/billing.go", "line": 11 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/dashboard/billing/usage", "middleware": [ "middleware.RouteTag(\"old_api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.GlobalAPIRateLimit()", "middleware.CORS()", "middleware.TokenAuth()" ], "handlers": [ "controller.GetUsage" ], "file": "router/dashboard.go", "line": 21, "source_kind": "static", "id": "EDGE-COMPAT-037", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "可选，按客户协议/PG 决定启用", "summary": "GetUsage", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.GetUsage", "file": "controller/billing.go", "line": 71 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/files", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 159, "source_kind": "static", "id": "EDGE-COMPAT-038", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "列出文件 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/files", "operation": { "summary": "列出文件 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "listFiles", "tags": [ "未实现/Files" ], "parameters": [], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/files", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 160, "source_kind": "static", "id": "EDGE-COMPAT-039", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "上传文件 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "file", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "format": "binary" }, { "name": "purpose", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "multipart/form-data" ], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/files", "operation": { "summary": "上传文件 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "createFile", "tags": [ "未实现/Files" ], "parameters": [], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary", "example": "" }, "purpose": { "type": "string", "example": "" } } } } } }, "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/v1/files/:id", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 161, "source_kind": "static", "id": "EDGE-COMPAT-040", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "删除文件 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "file_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/files/{file_id}", "operation": { "summary": "删除文件 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "deleteFile", "tags": [ "未实现/Files" ], "parameters": [ { "name": "file_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/files/:id", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 162, "source_kind": "static", "id": "EDGE-COMPAT-041", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "获取文件信息 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "file_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/files/{file_id}", "operation": { "summary": "获取文件信息 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "retrieveFile", "tags": [ "未实现/Files" ], "parameters": [ { "name": "file_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/files/:id/content", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 163, "source_kind": "static", "id": "EDGE-COMPAT-042", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "获取文件内容 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "file_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/files/{file_id}/content", "operation": { "summary": "获取文件内容 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "downloadFile", "tags": [ "未实现/Files" ], "parameters": [ { "name": "file_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/fine-tunes", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 165, "source_kind": "static", "id": "EDGE-COMPAT-043", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "列出微调任务 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/fine-tunes", "operation": { "summary": "列出微调任务 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "listFineTunes", "tags": [ "未实现/Fine-tunes" ], "parameters": [], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/fine-tunes", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 164, "source_kind": "static", "id": "EDGE-COMPAT-044", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "创建微调任务 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/fine-tunes", "operation": { "summary": "创建微调任务 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "createFineTune", "tags": [ "未实现/Fine-tunes" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": {} } } } }, "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/fine-tunes/:id", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 166, "source_kind": "static", "id": "EDGE-COMPAT-045", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "获取微调任务详情 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "fine_tune_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/fine-tunes/{fine_tune_id}", "operation": { "summary": "获取微调任务详情 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "retrieveFineTune", "tags": [ "未实现/Fine-tunes" ], "parameters": [ { "name": "fine_tune_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/fine-tunes/:id/cancel", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 167, "source_kind": "static", "id": "EDGE-COMPAT-046", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "取消微调任务 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "fine_tune_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/fine-tunes/{fine_tune_id}/cancel", "operation": { "summary": "取消微调任务 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "cancelFineTune", "tags": [ "未实现/Fine-tunes" ], "parameters": [ { "name": "fine_tune_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/fine-tunes/:id/events", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 168, "source_kind": "static", "id": "EDGE-COMPAT-047", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "获取微调任务事件 (未实现)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "fine_tune_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "501", "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/fine-tunes/{fine_tune_id}/events", "operation": { "summary": "获取微调任务事件 (未实现)", "deprecated": false, "description": "此接口尚未实现", "operationId": "listFineTuneEvents", "tags": [ "未实现/Fine-tunes" ], "parameters": [ { "name": "fine_tune_id", "in": "path", "description": "", "required": true, "example": "", "schema": { "type": "string" } } ], "responses": { "501": { "description": "未实现", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/images/variations", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 158, "source_kind": "static", "id": "EDGE-COMPAT-048", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "RelayNotImplemented", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作", "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/v1/models/:model", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayNotImplemented" ], "file": "router/relay-router.go", "line": 169, "source_kind": "static", "id": "EDGE-COMPAT-049", "group": "edge-compat", "owner": "API Edge", "phase": "按需求启用", "disposition": "上游仅占位，默认不启用", "summary": "RelayNotImplemented", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RelayNotImplemented", "file": "controller/relay.go", "line": 476 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "按实际客户兼容需求启用，不把历史路由或 RelayNotImplemented 视作已支持。启用前逐协议验证认证、字段、输出与计量；Playground 去留仍待用户选择。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作", "IMPLEMENTATION-STUB：不能以注册或文档存在计入支持" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/audio/speech", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIAudio)" ], "file": "router/relay-router.go", "line": 135, "source_kind": "static", "id": "EDGE-MEDIA-001", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "文本转语音", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "要转换的文本", "maxLength": 4096 }, { "name": "voice", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "alloy", "echo", "fable", "onyx", "nova", "shimmer" ] }, { "name": "response_format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "mp3", "opus", "aac", "flac", "wav", "pcm" ], "default": "mp3" }, { "name": "speed", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "", "default": 1, "minimum": 0.25, "maximum": 4 } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功生成音频", "content": { "audio/mpeg": { "schema": { "type": "string", "format": "binary" }, "fields": [] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/audio/speech", "operation": { "summary": "文本转语音", "deprecated": false, "description": "将文本转换为音频", "operationId": "createSpeech", "tags": [ "OpenAI音频(Audio)" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/SpeechRequest" } } }, "required": true }, "responses": { "200": { "description": "成功生成音频", "content": { "audio/mpeg": { "schema": { "type": "string", "format": "binary" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/audio/transcriptions", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIAudio)" ], "file": "router/relay-router.go", "line": 129, "source_kind": "static", "id": "EDGE-MEDIA-002", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "音频转录", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "file", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "音频文件", "format": "binary" }, { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "language", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "ISO-639-1 语言代码" }, { "name": "prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "response_format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "json", "text", "srt", "verbose_json", "vtt" ], "default": "json" }, { "name": "temperature", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "timestamp_granularities", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "multipart/form-data" ], "response_contracts": [ { "status": "200", "description": "成功转录", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AudioTranscriptionResponse" }, "fields": [ { "name": "text", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/audio/transcriptions", "operation": { "summary": "音频转录", "deprecated": false, "description": "将音频转换为文本", "operationId": "createTranscription", "tags": [ "OpenAI音频(Audio)" ], "parameters": [], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary", "description": "音频文件", "example": "" }, "model": { "type": "string", "example": "whisper-1" }, "language": { "type": "string", "description": "ISO-639-1 语言代码", "example": "" }, "prompt": { "type": "string", "example": "" }, "response_format": { "type": "string", "enum": [ "json", "text", "srt", "verbose_json", "vtt" ], "default": "json", "example": "json" }, "temperature": { "type": "number", "example": 0 }, "timestamp_granularities": { "type": "array", "items": { "type": "string", "enum": [ "word", "segment" ] }, "example": "" } }, "required": [ "file", "model" ] } } }, "required": true }, "responses": { "200": { "description": "成功转录", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AudioTranscriptionResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/audio/translations", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIAudio)" ], "file": "router/relay-router.go", "line": 132, "source_kind": "static", "id": "EDGE-MEDIA-003", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "音频翻译", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "file", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "format": "binary" }, { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "response_format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "temperature", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "multipart/form-data" ], "response_contracts": [ { "status": "200", "description": "成功翻译", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AudioTranscriptionResponse" }, "fields": [ { "name": "text", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/audio/translations", "operation": { "summary": "音频翻译", "deprecated": false, "description": "将音频翻译为英文文本", "operationId": "createTranslation", "tags": [ "OpenAI音频(Audio)" ], "parameters": [], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "file": { "type": "string", "format": "binary", "example": "" }, "model": { "type": "string", "example": "" }, "prompt": { "type": "string", "example": "" }, "response_format": { "type": "string", "example": "" }, "temperature": { "type": "number", "example": 0 } }, "required": [ "file", "model" ] } } }, "required": true }, "responses": { "200": { "description": "成功翻译", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/AudioTranscriptionResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/edits", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIImage)" ], "file": "router/relay-router.go", "line": 113, "source_kind": "static", "id": "EDGE-MEDIA-004", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "Relay", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/images/edits", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIImage)" ], "file": "router/relay-router.go", "line": 119, "source_kind": "static", "id": "EDGE-MEDIA-005", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "编辑图像(qwen-image-edit)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input", "type": "object", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages", "type": "array", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages[].role", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages[].content", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages[].content[].image", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages[].content[].text", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.n", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.negative_prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.prompt_extend", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.watermark", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.size", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功生成图像", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageResponse" }, "fields": [ { "name": "created", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].url", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].b64_json", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].revised_prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/images/edits", "operation": { "summary": "编辑图像(qwen-image-edit)", "deprecated": false, "description": " 百炼qwen-image系列图片生成", "operationId": "createImage", "tags": [ "图片生成/Qwen千问" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "model": { "type": "string" }, "input": { "type": "object", "properties": { "messages": { "type": "array", "items": { "type": "object", "properties": { "role": { "type": "string" }, "content": { "type": "array", "items": { "type": "object", "properties": { "image": { "type": "string" }, "text": { "type": "string" } } } } } } } }, "required": [ "messages" ] }, "parameters": { "type": "object", "properties": { "n": { "type": "integer" }, "negative_prompt": { "type": "string" }, "prompt_extend": { "type": "boolean" }, "watermark": { "type": "boolean" }, "size": { "type": "string" } } } }, "required": [ "model", "input" ] }, "example": "{\n \"model\": \"qwen-image-edit-plus\",\n \"input\": {\n \"messages\": [\n {\n \"role\": \"user\",\n \"content\": [\n {\n \"image\": \"https://help-static-aliyun-doc.aliyuncs.com/file-manage-files/zh-CN/20250925/fpakfo/image36.webp\"\n },\n {\n \"text\": \"生成一张符合深度图的图像，遵循以下描述：一辆红色的破旧的自行车停在一条泥泞的小路上，背景是茂密的原始森林\"\n }\n ]\n }\n ]\n },\n \"parameters\": {\n \"n\": 2,\n \"negative_prompt\": \" \",\n \"prompt_extend\": true,\n \"watermark\": false\n }" } } }, "responses": { "200": { "description": "成功生成图像", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/images/generations", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIImage)" ], "file": "router/relay-router.go", "line": 116, "source_kind": "static", "id": "EDGE-MEDIA-006", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "生成图像(qwen-image)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input", "type": "object", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages", "type": "array", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages[].role", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages[].content", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "input.messages[].content[].text", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.negative_prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.prompt_extend", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.watermark", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "parameters.size", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功生成图像", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageResponse" }, "fields": [ { "name": "created", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].url", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].b64_json", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].revised_prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/images/generations", "operation": { "summary": "生成图像(qwen-image)", "deprecated": false, "description": " 百炼qwen-image系列图片生成", "operationId": "createImage", "tags": [ "图片生成/Qwen千问" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "model": { "type": "string" }, "input": { "type": "object", "properties": { "messages": { "type": "array", "items": { "type": "object", "properties": { "role": { "type": "string" }, "content": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" } } } } } } } }, "required": [ "messages" ] }, "parameters": { "type": "object", "properties": { "negative_prompt": { "type": "string" }, "prompt_extend": { "type": "boolean" }, "watermark": { "type": "boolean" }, "size": { "type": "string" } } } }, "required": [ "model", "input" ] }, "example": { "model": "qwen-image-plus", "input": { "messages": [ { "role": "user", "content": [ { "text": "一副典雅庄重的对联悬挂于厅堂之中，房间是个安静古典的中式布置，桌子上放着一些青花瓷，对联上左书“义本生知人机同道善思新”，右书“通云赋智乾坤启数高志远”， 横批“智启通义”，字体飘逸，在中间挂着一幅中国风的画作，内容是岳阳楼。" } ] } ] }, "parameters": { "negative_prompt": "", "prompt_extend": true, "watermark": false, "size": "1328*1328" } } } } }, "responses": { "200": { "description": "成功生成图像", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ImageResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/tasks/:key", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.GetTask" ], "file": "router/task-router.go", "line": 24, "source_kind": "static", "id": "EDGE-MEDIA-007", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetTask", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "created_at", "fail_reason", "finished_at", "platform", "progress", "status", "task_id" ], "handler_sources": [ { "symbol": "controller.GetTask", "file": "controller/task.go", "line": 37 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/tasks/:key", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()", "middleware.PrepareTaskPluginSubmit()", "middleware.Distribute()" ], "handlers": [ "controller.RelayTask" ], "file": "router/task-router.go", "line": 18, "source_kind": "static", "id": "EDGE-MEDIA-008", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "RelayTask", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.RelayTask", "file": "controller/relay.go", "line": 553 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/tasks/:key/artifacts", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.GetTaskArtifacts" ], "file": "router/task-router.go", "line": 25, "source_kind": "static", "id": "EDGE-MEDIA-009", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "GetTaskArtifacts", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetTaskArtifacts", "file": "controller/task.go", "line": 66 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/tasks/:key/artifacts/:artifact_key/content", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenOrTaskArtifactAccessAuth(\"key\", \"artifact_key\")" ], "handlers": [ "controller.TaskArtifactContent" ], "file": "router/task-router.go", "line": 34, "source_kind": "static", "id": "EDGE-MEDIA-010", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "TaskArtifactContent", "auth_requirement": "模型 Key 或限定任务产物访问凭据", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" }, { "name": "artifact_key", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.TaskArtifactContent", "file": "controller/task.go", "line": 279 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "HEAD", "path": "/v1/tasks/:key/artifacts/:artifact_key/content", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenOrTaskArtifactAccessAuth(\"key\", \"artifact_key\")" ], "handlers": [ "controller.TaskArtifactContent" ], "file": "router/task-router.go", "line": 35, "source_kind": "static", "id": "EDGE-MEDIA-011", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "TaskArtifactContent", "auth_requirement": "模型 Key 或限定任务产物访问凭据", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" }, { "name": "artifact_key", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.TaskArtifactContent", "file": "controller/task.go", "line": 279 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/video/generations", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()", "middleware.SystemPerformanceCheck()", "middleware.PinTaskPluginEndpoint()", "middleware.TaskPluginEndpointOnly(middleware.ModelRequestRateLimit())", "middleware.PrepareTaskPluginEndpoint()", "middleware.Distribute()" ], "handlers": [ "controller.RelayTaskPluginEndpoint(c, controller.RelayTask)" ], "file": "router/video-router.go", "line": 15, "source_kind": "static", "id": "EDGE-MEDIA-012", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建视频生成任务", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "模型/风格 ID" }, { "name": "prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "文本描述提示词" }, { "name": "image", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "图片输入 (URL 或 Base64)" }, { "name": "duration", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "视频时长（秒）" }, { "name": "width", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "视频宽度" }, { "name": "height", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "视频高度" }, { "name": "fps", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "视频帧率" }, { "name": "seed", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "随机种子" }, { "name": "n", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "生成视频数量" }, { "name": "response_format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "响应格式" }, { "name": "user", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "用户标识" }, { "name": "metadata", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "扩展参数 (如 negative_prompt, style, quality_level 等)" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功创建视频生成任务", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoResponse" }, "fields": [ { "name": "task_id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "任务 ID" }, { "name": "status", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "任务状态" } ] } } }, { "status": "400", "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "error", "message", "type" ], "handler_sources": [ { "symbol": "controller.RelayTaskPluginEndpoint", "file": "controller/relay.go", "line": 508 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/video/generations", "operation": { "summary": "创建视频生成任务", "deprecated": false, "description": "提交视频生成任务，支持文生视频和图生视频。\n\n返回任务 ID，可通过 GET 接口查询任务状态。\n", "operationId": "createVideoGeneration", "tags": [ "视频生成" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoRequest" }, "example": { "model": "kling-v1", "prompt": "宇航员在月球上漫步", "duration": 5, "width": 1280, "height": 720 } } }, "required": true }, "responses": { "200": { "description": "成功创建视频生成任务", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoResponse" } } }, "headers": {} }, "400": { "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/video/generations/:task_id", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayTaskFetch" ], "file": "router/video-router.go", "line": 30, "source_kind": "static", "id": "EDGE-MEDIA-013", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取视频生成任务状态", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "task_id", "in": "path", "description": "任务 ID", "required": true, "example": "abcd1234efgh", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功获取任务状态", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoTaskResponse" }, "fields": [ { "name": "task_id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "任务 ID" }, { "name": "status", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "任务状态", "enum": [ "queued", "in_progress", "completed", "failed" ] }, { "name": "url", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "视频资源 URL（成功时）" }, { "name": "format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "视频格式" }, { "name": "metadata", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "视频任务元数据" }, { "name": "metadata.duration", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "实际生成的视频时长" }, { "name": "metadata.fps", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "实际帧率" }, { "name": "metadata.width", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "实际宽度" }, { "name": "metadata.height", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "实际高度" }, { "name": "metadata.seed", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "使用的随机种子" }, { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "视频任务错误信息" }, { "name": "error.code", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "错误码" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" } ] } } }, { "status": "404", "description": "任务不存在", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.RelayTaskFetch", "file": "controller/relay.go", "line": 532 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/video/generations/{task_id}", "operation": { "summary": "获取视频生成任务状态", "deprecated": false, "description": "查询视频生成任务的状态和结果。\n\n任务状态：\n- `queued`: 排队中\n- `in_progress`: 生成中\n- `completed`: 已完成\n- `failed`: 失败\n", "operationId": "getVideoGeneration", "tags": [ "视频生成" ], "parameters": [ { "name": "task_id", "in": "path", "description": "任务 ID", "required": true, "example": "abcd1234efgh", "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功获取任务状态", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoTaskResponse" } } }, "headers": {} }, "404": { "description": "任务不存在", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/videos", "middleware": [ "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()", "middleware.SystemPerformanceCheck()", "middleware.PinTaskPluginEndpoint()", "middleware.PrepareTaskPluginEndpoint()", "middleware.Distribute()", "middleware.TaskPluginEndpointOnly(middleware.ModelRequestRateLimit())" ], "handlers": [ "controller.RelayTaskPluginEndpoint", "controller.RelayTask" ], "file": "pkg/jsplugin/routing.go", "line": 87, "source_kind": "host_protocol_registry", "protocol": "openai_video.create", "id": "EDGE-MEDIA-014", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建视频 ", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "模型名称" }, { "name": "prompt", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "提示词" }, { "name": "seconds", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "生成秒数" }, { "name": "input_reference", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "参考图片文件", "format": "binary" } ], "request_formats": [ "multipart/form-data" ], "response_contracts": [ { "status": "200", "description": "成功创建视频任务", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "视频 ID" }, "object": { "type": "string", "description": "对象类型" }, "model": { "type": "string", "description": "使用的模型" }, "status": { "type": "string", "description": "任务状态" }, "progress": { "type": "integer", "description": "进度百分比" }, "created_at": { "type": "integer", "description": "创建时间戳" }, "seconds": { "type": "string", "description": "视频时长" }, "completed_at": { "type": "integer", "description": "完成时间戳" }, "expires_at": { "type": "integer", "description": "过期时间戳" }, "size": { "type": "string", "description": "视频尺寸" }, "error": { "$ref": "#/components/schemas/OpenAIVideoError" }, "metadata": { "type": "object", "description": "额外元数据", "additionalProperties": true, "properties": {} } }, "required": [ "id", "object", "model", "status", "progress", "created_at", "seconds" ] }, "fields": [ { "name": "id", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "视频 ID" }, { "name": "object", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "对象类型" }, { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "使用的模型" }, { "name": "status", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "任务状态" }, { "name": "progress", "type": "integer", "required": true, "required_source": "openapi_declaration", "description": "进度百分比" }, { "name": "created_at", "type": "integer", "required": true, "required_source": "openapi_declaration", "description": "创建时间戳" }, { "name": "seconds", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "视频时长" }, { "name": "completed_at", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "完成时间戳" }, { "name": "expires_at", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "过期时间戳" }, { "name": "size", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "视频尺寸" }, { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "OpenAI 视频错误信息" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误码" }, { "name": "metadata", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "额外元数据" } ] } } }, { "status": "400", "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "error", "message", "type" ], "handler_sources": [ { "symbol": "controller.RelayTaskPluginEndpoint", "file": "controller/relay.go", "line": 508 }, { "symbol": "controller.RelayTask", "file": "controller/relay.go", "line": 553 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/videos", "operation": { "summary": "创建视频 ", "deprecated": false, "description": "OpenAI 兼容的视频生成接口。\n\n参考文档: https://platform.openai.com/docs/api-reference/videos/create\n", "operationId": "createVideo", "tags": [ "视频生成/Sora兼容格式" ], "parameters": [], "requestBody": { "content": { "multipart/form-data": { "schema": { "type": "object", "properties": { "model": { "description": "模型名称", "example": "sora-2", "type": "string" }, "prompt": { "description": "提示词", "example": "cute cat dance", "type": "string" }, "seconds": { "description": "生成秒数", "example": "8", "type": "string" }, "input_reference": { "format": "binary", "type": "string", "description": "参考图片文件", "example": "" } } }, "examples": {} } } }, "responses": { "200": { "description": "成功创建视频任务", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string", "description": "视频 ID" }, "object": { "type": "string", "description": "对象类型" }, "model": { "type": "string", "description": "使用的模型" }, "status": { "type": "string", "description": "任务状态" }, "progress": { "type": "integer", "description": "进度百分比" }, "created_at": { "type": "integer", "description": "创建时间戳" }, "seconds": { "type": "string", "description": "视频时长" }, "completed_at": { "type": "integer", "description": "完成时间戳" }, "expires_at": { "type": "integer", "description": "过期时间戳" }, "size": { "type": "string", "description": "视频尺寸" }, "error": { "$ref": "#/components/schemas/OpenAIVideoError" }, "metadata": { "type": "object", "description": "额外元数据", "additionalProperties": true, "properties": {} } }, "required": [ "id", "object", "model", "status", "progress", "created_at", "seconds" ] }, "example": { "id": "sora-2-123456", "object": "video", "model": "sora-2", "status": "queued", "progress": 0, "created_at": 1764347090922, "seconds": "8" } } }, "headers": {} }, "400": { "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/videos/:task_id", "middleware": [ "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayTaskFetch" ], "file": "pkg/jsplugin/routing.go", "line": 88, "source_kind": "host_protocol_registry", "protocol": "openai_video.retrieve", "id": "EDGE-MEDIA-015", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取视频任务状态 ", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "task_id", "in": "path", "description": "视频任务 ID", "required": true, "example": "sora-2-123456", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功获取视频任务状态", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "object": { "type": "string" }, "model": { "type": "string" }, "status": { "type": "string" }, "progress": { "type": "integer" }, "created_at": { "type": "integer" }, "seconds": { "type": "string" } }, "required": [ "id", "object", "model", "status", "progress", "created_at", "seconds" ] }, "fields": [ { "name": "id", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "object", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "progress", "type": "integer", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "created_at", "type": "integer", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "seconds", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" } ] } } }, { "status": "404", "description": "任务不存在", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.RelayTaskFetch", "file": "controller/relay.go", "line": 532 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/videos/{task_id}", "operation": { "summary": "获取视频任务状态 ", "deprecated": false, "description": "OpenAI 兼容的视频任务状态查询接口。\n\n返回视频任务的详细状态信息。\n", "operationId": "getVideo", "tags": [ "视频生成/Sora兼容格式" ], "parameters": [ { "name": "task_id", "in": "path", "description": "视频任务 ID", "required": true, "example": "sora-2-123456", "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功获取视频任务状态", "content": { "application/json": { "schema": { "type": "object", "properties": { "id": { "type": "string" }, "object": { "type": "string" }, "model": { "type": "string" }, "status": { "type": "string" }, "progress": { "type": "integer" }, "created_at": { "type": "integer" }, "seconds": { "type": "string" } }, "required": [ "id", "object", "model", "status", "progress", "created_at", "seconds" ] }, "example": { "id": "sora-2-123456", "object": "video", "model": "sora-2", "status": "queued", "progress": 0, "created_at": 1764347090922, "seconds": "8" } } }, "headers": {} }, "404": { "description": "任务不存在", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/videos/:task_id/content", "middleware": [ "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.VideoProxy" ], "file": "pkg/jsplugin/routing.go", "line": 89, "source_kind": "host_protocol_registry", "protocol": "openai_video.content", "id": "EDGE-MEDIA-016", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取视频内容", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "task_id", "in": "path", "description": "视频任务 ID", "required": true, "example": "video-abc123", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功获取视频内容", "content": { "video/mp4": { "schema": { "type": "string", "format": "binary" }, "fields": [] } } }, { "status": "404", "description": "视频不存在或未完成", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "task_id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.VideoProxy", "file": "controller/video_proxy.go", "line": 62 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/videos/{task_id}/content", "operation": { "summary": "获取视频内容", "deprecated": false, "description": "获取已完成视频任务的视频文件内容。\n\n此接口会代理返回视频文件流。\n", "operationId": "getVideoContent", "tags": [ "视频生成/Sora兼容格式" ], "parameters": [ { "name": "task_id", "in": "path", "description": "视频任务 ID", "required": true, "example": "video-abc123", "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功获取视频内容", "content": { "video/mp4": { "schema": { "type": "string", "format": "binary" } } }, "headers": {} }, "404": { "description": "视频不存在或未完成", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "HEAD", "path": "/v1/videos/:task_id/content", "middleware": [ "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.VideoProxy" ], "file": "pkg/jsplugin/routing.go", "line": 89, "source_kind": "host_protocol_registry", "protocol": "openai_video.content", "id": "EDGE-MEDIA-017", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "VideoProxy", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "task_id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.VideoProxy", "file": "controller/video_proxy.go", "line": 62 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/videos/:video_id/remix", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()", "middleware.Distribute()" ], "handlers": [ "controller.RelayTask" ], "file": "router/video-router.go", "line": 31, "source_kind": "static", "id": "EDGE-MEDIA-018", "group": "edge-media", "owner": "API Edge", "phase": "媒体阶段", "disposition": "优先沿用，迁入/适配后验收", "summary": "RelayTask", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.RelayTask", "file": "controller/relay.go", "line": 553 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "提交、执行、查询、取消意图、结果访问和结算分别定义。JSON/文件上传、大小和产物访问按协议；Core 持久归属与费用，网关负责供应执行。未知提交先查原任务，不能直接重复收费生成。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/alpha/search", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIAlphaSearch)" ], "file": "router/relay-router.go", "line": 108, "source_kind": "static", "id": "EDGE-MODEL-001", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "Relay", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/chat/completions", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAI)" ], "file": "router/relay-router.go", "line": 98, "source_kind": "static", "id": "EDGE-MODEL-002", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建聊天对话", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "模型 ID" }, { "name": "messages", "type": "array", "required": true, "required_source": "openapi_declaration", "description": "对话消息列表" }, { "name": "messages[].role", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "消息角色", "enum": [ "system", "user", "assistant", "tool", "developer" ] }, { "name": "messages[].content", "type": "union", "required": true, "required_source": "openapi_declaration", "description": "消息内容" }, { "name": "messages[].name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "发送者名称" }, { "name": "messages[].tool_calls", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "messages[].tool_calls[].id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "messages[].tool_calls[].type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "messages[].tool_calls[].function", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "messages[].tool_calls[].function.name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "messages[].tool_calls[].function.arguments", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "messages[].tool_call_id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "工具调用 ID（用于 tool 角色消息）" }, { "name": "messages[].reasoning_content", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "推理内容" }, { "name": "temperature", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "采样温度", "default": 1, "minimum": 0, "maximum": 2 }, { "name": "top_p", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "核采样参数", "default": 1, "minimum": 0, "maximum": 1 }, { "name": "n", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "生成数量", "default": 1, "minimum": 1 }, { "name": "stream", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "是否流式响应", "default": false }, { "name": "stream_options", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stream_options.include_usage", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stop", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "停止序列" }, { "name": "max_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "最大生成 Token 数" }, { "name": "max_completion_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "最大补全 Token 数" }, { "name": "presence_penalty", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "", "default": 0, "minimum": -2, "maximum": 2 }, { "name": "frequency_penalty", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "", "default": 0, "minimum": -2, "maximum": 2 }, { "name": "logit_bias", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "user", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].function", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].function.name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].function.description", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].function.parameters", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "JSON Schema 格式的参数定义" }, { "name": "tool_choice", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "response_format", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "response_format.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "text", "json_object", "json_schema" ] }, { "name": "response_format.json_schema", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "JSON Schema 定义" }, { "name": "seed", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "reasoning_effort", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "推理强度 (用于支持推理的模型)", "enum": [ "low", "medium", "high" ] }, { "name": "modalities", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "audio", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "audio.voice", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "audio.format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChatCompletionResponse" }, "fields": [ { "name": "id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "created", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].index", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message.role", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "消息角色", "enum": [ "system", "user", "assistant", "tool", "developer" ] }, { "name": "choices[].message.content", "type": "union", "required": true, "required_source": "openapi_declaration", "description": "消息内容" }, { "name": "choices[].message.name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "发送者名称" }, { "name": "choices[].message.tool_calls", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message.tool_calls[].id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message.tool_calls[].type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message.tool_calls[].function", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message.tool_calls[].function.name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message.tool_calls[].function.arguments", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].message.tool_call_id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "工具调用 ID（用于 tool 角色消息）" }, { "name": "choices[].message.reasoning_content", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "推理内容" }, { "name": "choices[].finish_reason", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "stop", "length", "tool_calls", "content_filter" ] }, { "name": "usage", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "提示词 Token 数" }, { "name": "usage.completion_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "补全 Token 数" }, { "name": "usage.total_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "总 Token 数" }, { "name": "usage.prompt_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.cached_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.image_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.reasoning_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "system_fingerprint", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } }, { "status": "400", "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } }, { "status": "429", "description": "请求频率限制", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/chat/completions", "operation": { "summary": "创建聊天对话", "deprecated": false, "description": "根据对话历史创建模型响应。支持流式和非流式响应。\n\n兼容 OpenAI Chat Completions API。\n", "operationId": "createChatCompletion", "tags": [ "OpenAI格式(Chat)" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChatCompletionRequest" } } }, "required": true }, "responses": { "200": { "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ChatCompletionResponse" } } }, "headers": {} }, "400": { "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} }, "429": { "description": "请求频率限制", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/completions", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAI)" ], "file": "router/relay-router.go", "line": 95, "source_kind": "static", "id": "EDGE-MODEL-003", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建文本补全", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "prompt", "type": "union", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "max_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "temperature", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "top_p", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "n", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stream", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stop", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "suffix", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "echo", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompletionResponse" }, "fields": [ { "name": "id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "created", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].text", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].index", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "choices[].finish_reason", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "提示词 Token 数" }, { "name": "usage.completion_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "补全 Token 数" }, { "name": "usage.total_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "总 Token 数" }, { "name": "usage.prompt_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.cached_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.image_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.reasoning_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/completions", "operation": { "summary": "创建文本补全", "deprecated": false, "description": "基于给定提示创建文本补全", "operationId": "createCompletion", "tags": [ "文本补全(Completions)" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompletionRequest" } } }, "required": true }, "responses": { "200": { "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CompletionResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/embeddings", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatEmbedding)" ], "file": "router/relay-router.go", "line": 124, "source_kind": "static", "id": "EDGE-MODEL-004", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建文本嵌入", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input", "type": "union", "required": true, "required_source": "openapi_declaration", "description": "要嵌入的文本" }, { "name": "encoding_format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "float", "base64" ], "default": "float" }, { "name": "dimensions", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "输出向量维度" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功创建嵌入", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmbeddingResponse" }, "fields": [ { "name": "object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].index", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].embedding", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.total_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/embeddings", "operation": { "summary": "创建文本嵌入", "deprecated": false, "description": "将文本转换为向量嵌入", "operationId": "createEmbedding", "tags": [ "OpenAI格式(Embeddings)" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmbeddingRequest" } } }, "required": true }, "responses": { "200": { "description": "成功创建嵌入", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmbeddingResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/engines/:model/embeddings", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatGemini)" ], "file": "router/relay-router.go", "line": 145, "source_kind": "static", "id": "EDGE-MODEL-005", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "Gemini 嵌入(Embeddings)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "model", "in": "path", "description": "模型/引擎 ID", "required": true, "example": "", "schema": { "type": "string" } } ], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input", "type": "union", "required": true, "required_source": "openapi_declaration", "description": "要嵌入的文本" }, { "name": "encoding_format", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "float", "base64" ], "default": "float" }, { "name": "dimensions", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "输出向量维度" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功创建嵌入", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmbeddingResponse" }, "fields": [ { "name": "object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].index", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].embedding", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.total_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/engines/{model}/embeddings", "operation": { "summary": "Gemini 嵌入(Embeddings)", "deprecated": false, "description": "使用指定引擎/模型创建嵌入", "operationId": "createEngineEmbedding", "tags": [ "Gemini格式" ], "parameters": [ { "name": "model", "in": "path", "description": "模型/引擎 ID", "required": true, "example": "", "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmbeddingRequest" }, "examples": {} } } }, "responses": { "200": { "description": "成功创建嵌入", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/EmbeddingResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/messages", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatClaude)" ], "file": "router/relay-router.go", "line": 90, "source_kind": "static", "id": "EDGE-MODEL-006", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "Claude 聊天", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "anthropic-version", "in": "header", "description": "Anthropic API 版本", "required": true, "example": "", "schema": { "type": "string", "example": "2023-06-01" } }, { "name": "x-api-key", "in": "header", "description": "Anthropic API Key (可选，也可使用 Bearer Token)", "required": false, "example": "", "schema": { "type": "string" } } ], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "messages", "type": "array", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "messages[].role", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "", "enum": [ "user", "assistant" ] }, { "name": "messages[].content", "type": "union", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "system", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "cache_control", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "inference_geo", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "max_tokens", "type": "integer", "required": true, "required_source": "openapi_declaration", "description": "", "minimum": 1 }, { "name": "temperature", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "", "minimum": 0, "maximum": 1 }, { "name": "top_p", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "top_k", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stream", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stop_sequences", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].description", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools[].input_schema", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tool_choice", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "thinking", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "thinking.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "enabled", "disabled" ] }, { "name": "thinking.budget_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "context_management", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output_config", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output_format", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "container", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "mcp_servers", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "metadata", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "metadata.user_id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "speed", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "standard", "fast" ] }, { "name": "service_tier", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "auto", "standard_only" ] } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClaudeResponse" }, "fields": [ { "name": "id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "role", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "content", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "content[].type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "content[].text", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stop_reason", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "end_turn", "max_tokens", "stop_sequence", "tool_use" ] }, { "name": "usage", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.input_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.output_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.cache_creation_input_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.cache_read_input_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/messages", "operation": { "summary": "Claude 聊天", "deprecated": false, "description": "Anthropic Claude Messages API 格式的请求。\n需要在请求头中包含 `anthropic-version`。\n", "operationId": "createMessage", "tags": [ "Claude格式(Messages)" ], "parameters": [ { "name": "anthropic-version", "in": "header", "description": "Anthropic API 版本", "required": true, "example": "", "schema": { "type": "string", "example": "2023-06-01" } }, { "name": "x-api-key", "in": "header", "description": "Anthropic API Key (可选，也可使用 Bearer Token)", "required": false, "example": "", "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClaudeRequest" }, "examples": {} } } }, "responses": { "200": { "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ClaudeResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/models", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.ListModels(c, constant.ChannelTypeAnthropic)", "controller.ListModels(c, constant.ChannelTypeGemini)", "controller.ListModels(c, constant.ChannelTypeOpenAI)" ], "file": "router/relay-router.go", "line": 23, "source_kind": "static", "id": "EDGE-MODEL-007", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "获取模型列表", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "key", "in": "query", "description": "Google API Key (用于 Gemini 格式)", "required": false, "schema": { "type": "string" } }, { "name": "x-api-key", "in": "header", "description": "Anthropic API Key (用于 Claude 格式)", "required": false, "example": "", "schema": { "type": "string" } }, { "name": "anthropic-version", "in": "header", "description": "Anthropic API 版本", "required": false, "example": "", "schema": { "type": "string", "example": "2023-06-01" } }, { "name": "x-goog-api-key", "in": "header", "description": "Google API Key (用于 Gemini 格式)", "required": false, "example": "", "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功获取模型列表", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModelsResponse" }, "fields": [ { "name": "object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "data[].id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "模型 ID" }, { "name": "data[].object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "对象类型" }, { "name": "data[].created", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "创建时间戳" }, { "name": "data[].owned_by", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "模型所有者" } ] } } }, { "status": "401", "description": "认证失败", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "first_id", "has_more", "last_id", "message", "models", "nextPageToken", "object", "success" ], "handler_sources": [ { "symbol": "controller.ListModels", "file": "controller/model.go", "line": 218 }, { "symbol": "controller.ListModels", "file": "controller/model.go", "line": 218 }, { "symbol": "controller.ListModels", "file": "controller/model.go", "line": 218 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/models", "operation": { "summary": "获取模型列表", "deprecated": false, "description": "获取当前可用的模型列表。\n\n根据请求头自动识别返回格式：\n- 包含 `x-api-key` 和 `anthropic-version` 头时返回 Anthropic 格式\n- 包含 `x-goog-api-key` 头或 `key` 查询参数时返回 Gemini 格式\n- 其他情况返回 OpenAI 格式\n", "operationId": "listModels", "tags": [ "获取模型列表" ], "parameters": [ { "name": "key", "in": "query", "description": "Google API Key (用于 Gemini 格式)", "required": false, "schema": { "type": "string" } }, { "name": "x-api-key", "in": "header", "description": "Anthropic API Key (用于 Claude 格式)", "required": false, "example": "", "schema": { "type": "string" } }, { "name": "anthropic-version", "in": "header", "description": "Anthropic API 版本", "required": false, "example": "", "schema": { "type": "string", "example": "2023-06-01" } }, { "name": "x-goog-api-key", "in": "header", "description": "Google API Key (用于 Gemini 格式)", "required": false, "example": "", "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功获取模型列表", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModelsResponse" } } }, "headers": {} }, "401": { "description": "认证失败", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/models/*path", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatGemini)" ], "file": "router/relay-router.go", "line": 148, "source_kind": "static", "id": "EDGE-MODEL-008", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "Relay", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/models/:model", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.RetrieveModel(c, constant.ChannelTypeAnthropic)", "controller.RetrieveModel(c, constant.ChannelTypeOpenAI)" ], "file": "router/relay-router.go", "line": 34, "source_kind": "static", "id": "EDGE-MODEL-009", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "RetrieveModel / RetrieveModel", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "model", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "error" ], "handler_sources": [ { "symbol": "controller.RetrieveModel", "file": "controller/model.go", "line": 348 }, { "symbol": "controller.RetrieveModel", "file": "controller/model.go", "line": 348 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/moderations", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAI)" ], "file": "router/relay-router.go", "line": 153, "source_kind": "static", "id": "EDGE-MODEL-010", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "内容审核", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "input", "type": "union", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功审核", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModerationResponse" }, "fields": [ { "name": "id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results[].flagged", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results[].categories", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results[].category_scores", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/moderations", "operation": { "summary": "内容审核", "deprecated": false, "description": "检查文本内容是否违反使用政策", "operationId": "createModeration", "tags": [ "Moderations" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModerationRequest" } } }, "required": true }, "responses": { "200": { "description": "成功审核", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ModerationResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/realtime", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIRealtime)" ], "file": "router/relay-router.go", "line": 78, "source_kind": "static", "id": "EDGE-MODEL-011", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "实时 WebSocket 连接", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [ { "name": "model", "in": "query", "description": "要使用的模型", "required": false, "schema": { "type": "string", "example": "gpt-4o-realtime-preview" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "101", "description": "WebSocket 协议切换", "content": {} }, { "status": "400", "description": "请求错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" }, "fields": [ { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error.message", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误信息" }, { "name": "error.type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误类型" }, { "name": "error.param", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "相关参数" }, { "name": "error.code", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "错误代码" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/realtime", "operation": { "summary": "实时 WebSocket 连接", "deprecated": false, "description": "建立 WebSocket 连接用于实时对话。\n\n**注意**: 这是一个 WebSocket 端点，需要使用 WebSocket 协议连接。\n\n连接 URL 示例: `wss://api.example.com/v1/realtime?model=gpt-4o-realtime`\n", "operationId": "createRealtimeSession", "tags": [ "Realtime" ], "parameters": [ { "name": "model", "in": "query", "description": "要使用的模型", "required": false, "schema": { "type": "string", "example": "gpt-4o-realtime-preview" } } ], "responses": { "101": { "description": "WebSocket 协议切换", "headers": {} }, "400": { "description": "请求错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/rerank", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatRerank)" ], "file": "router/relay-router.go", "line": 140, "source_kind": "static", "id": "EDGE-MODEL-012", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "文档重排序", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "query", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "查询文本" }, { "name": "documents", "type": "array", "required": true, "required_source": "openapi_declaration", "description": "要重排序的文档列表" }, { "name": "top_n", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "返回前 N 个结果" }, { "name": "return_documents", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "", "default": false } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功重排序", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RerankResponse" }, "fields": [ { "name": "id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results[].index", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results[].relevance_score", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "results[].document", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "meta", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/rerank", "operation": { "summary": "文档重排序", "deprecated": false, "description": "根据查询对文档列表进行相关性重排序", "operationId": "createRerank", "tags": [ "重排序(Rerank)" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RerankRequest" } } }, "required": true }, "responses": { "200": { "description": "成功重排序", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/RerankResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/responses", "middleware": [ "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()", "middleware.SystemPerformanceCheck()", "middleware.PinTaskPluginEndpoint()", "middleware.PrepareTaskPluginEndpoint()", "middleware.Distribute()", "middleware.ModelRequestRateLimit()" ], "handlers": [ "controller.RelayTaskPluginEndpoint", "controller.Relay" ], "file": "pkg/jsplugin/routing.go", "line": 83, "source_kind": "host_protocol_registry", "protocol": "openai_responses.create", "id": "EDGE-MODEL-013", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "创建响应 (OpenAI Responses API)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "输入内容，可以是字符串或消息数组" }, { "name": "instructions", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "max_output_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "temperature", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "top_p", "type": "number", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "stream", "type": "boolean", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tools", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tool_choice", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "reasoning", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "reasoning.effort", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "low", "medium", "high" ] }, { "name": "reasoning.summary", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "previous_response_id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "truncation", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "auto", "disabled" ] } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResponsesResponse" }, "fields": [ { "name": "id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "created_at", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "completed", "failed", "in_progress", "incomplete" ] }, { "name": "model", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output[].type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output[].id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output[].status", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output[].role", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output[].content", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output[].content[].type", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output[].content[].text", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "提示词 Token 数" }, { "name": "usage.completion_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "补全 Token 数" }, { "name": "usage.total_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "总 Token 数" }, { "name": "usage.prompt_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.cached_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.image_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.reasoning_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "code", "error", "message", "type" ], "handler_sources": [ { "symbol": "controller.RelayTaskPluginEndpoint", "file": "controller/relay.go", "line": 508 }, { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/responses", "operation": { "summary": "创建响应 (OpenAI Responses API)", "deprecated": false, "description": "OpenAI Responses API，用于创建模型响应。\n支持多轮对话、工具调用、推理等功能。\n", "operationId": "createResponse", "tags": [ "OpenAI格式(Responses)" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResponsesRequest" } } }, "required": true }, "responses": { "200": { "description": "成功创建响应", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResponsesResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1/responses/:response_id", "middleware": [ "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.RetrieveTaskPluginResponse" ], "file": "pkg/jsplugin/routing.go", "line": 84, "source_kind": "host_protocol_registry", "protocol": "openai_responses.retrieve", "id": "EDGE-MODEL-014", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "RetrieveTaskPluginResponse", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.RetrieveTaskPluginResponse", "file": "controller/plugin_protocol.go", "line": 925 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1/responses/compact", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatOpenAIResponsesCompaction)" ], "file": "router/relay-router.go", "line": 103, "source_kind": "static", "id": "EDGE-MODEL-015", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "压缩对话 (OpenAI Responses API)", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [ { "name": "model", "type": "string", "required": true, "required_source": "openapi_declaration", "description": "" }, { "name": "input", "type": "union", "required": false, "required_source": "openapi_declaration", "description": "输入内容，可以是字符串或消息数组" }, { "name": "instructions", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "previous_response_id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功压缩对话", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResponsesCompactionResponse" }, "fields": [ { "name": "id", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "object", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "created_at", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "output", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "提示词 Token 数" }, { "name": "usage.completion_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "补全 Token 数" }, { "name": "usage.total_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "总 Token 数" }, { "name": "usage.prompt_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.cached_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.prompt_tokens_details.image_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.text_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.audio_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "usage.completion_tokens_details.reasoning_tokens", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "error", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1/responses/compact", "operation": { "summary": "压缩对话 (OpenAI Responses API)", "deprecated": false, "description": "OpenAI Responses API，用于对长对话进行 compaction。", "operationId": "compactResponse", "tags": [ "OpenAI格式(Responses)" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResponsesCompactionRequest" } } }, "required": true }, "responses": { "200": { "description": "成功压缩对话", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResponsesCompactionResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1beta/models", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.ListModels(c, constant.ChannelTypeGemini)" ], "file": "router/relay-router.go", "line": 48, "source_kind": "static", "id": "EDGE-MODEL-016", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "Gemini 格式获取", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功获取模型列表", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GeminiModelsResponse" }, "fields": [ { "name": "models", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models[].name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models[].version", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models[].displayName", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models[].description", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models[].inputTokenLimit", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models[].outputTokenLimit", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models[].supportedGenerationMethods", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" } ] } } } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "first_id", "has_more", "last_id", "message", "models", "nextPageToken", "object", "success" ], "handler_sources": [ { "symbol": "controller.ListModels", "file": "controller/model.go", "line": 218 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "relay.json", "path": "/v1beta/models", "operation": { "summary": "Gemini 格式获取", "deprecated": false, "description": "以 Gemini API 格式返回可用模型列表", "operationId": "listModelsGemini", "tags": [ "获取模型列表" ], "parameters": [], "responses": { "200": { "description": "成功获取模型列表", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GeminiModelsResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/v1beta/models/*path", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.SystemPerformanceCheck()", "middleware.TokenAuth()", "middleware.ModelRequestRateLimit()", "middleware.Distribute()" ], "handlers": [ "controller.Relay(c, types.RelayFormatGemini)" ], "file": "router/relay-router.go", "line": 191, "source_kind": "static", "id": "EDGE-MODEL-017", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "Relay", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "type" ], "handler_sources": [ { "symbol": "controller.Relay", "file": "controller/relay.go", "line": 73 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "已有幂等语义沿用；没有时不能宣称自动去重。Core 操作 ID 绑定账户与请求摘要；结果不明先查询/核对，供应侧重试归网关。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/v1beta/openai/models", "middleware": [ "middleware.CORS()", "middleware.DecompressRequestMiddleware()", "middleware.BodyStorageCleanup()", "middleware.StatsMiddleware()", "middleware.RouteTag(\"relay\")", "middleware.TokenAuth()" ], "handlers": [ "controller.ListModels(c, constant.ChannelTypeOpenAI)" ], "file": "router/relay-router.go", "line": 57, "source_kind": "static", "id": "EDGE-MODEL-018", "group": "edge-models", "owner": "API Edge", "phase": "CE-03/06", "disposition": "优先沿用，迁入/适配后验收", "summary": "ListModels", "auth_requirement": "模型 API Key（协议 Header 与兼容形式沿用）", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "first_id", "has_more", "last_id", "message", "models", "nextPageToken", "object", "success" ], "handler_sources": [ { "symbol": "controller.ListModels", "file": "controller/model.go", "line": 218 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "沿用模型协议及流式事件；Core 授权/价格/预留后才执行，Edge 使用内部凭据访问网关。模型权限和预算不因移除渠道选择而丢失；不得重写未知合法模型参数或强制所有响应返回 202。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.GetAllChannels" ], "file": "router/channel-router.go", "line": 40, "source_kind": "permission_table", "id": "GATEWAY-001", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取所有渠道", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "id_sort", "in": "query", "description": "", "required": false, "schema": { "type": "boolean" } }, { "name": "tag_mode", "in": "query", "description": "", "required": false, "schema": { "type": "boolean" } }, { "name": "status", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "type", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id_sort", "in": "query", "source": "controller literal access" }, { "name": "sort_by", "in": "query", "source": "controller literal access" }, { "name": "sort_order", "in": "query", "source": "controller literal access" }, { "name": "tag_mode", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" }, { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "type", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [ "items", "message", "page", "page_size", "success", "total", "type_counts" ], "handler_sources": [ { "symbol": "controller.GetAllChannels", "file": "controller/channel.go", "line": 102 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/channel/", "operation": { "summary": "获取所有渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "p", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "page_size", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } }, { "name": "id_sort", "in": "query", "description": "", "required": false, "schema": { "type": "boolean" } }, { "name": "tag_mode", "in": "query", "description": "", "required": false, "schema": { "type": "boolean" } }, { "name": "status", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "type", "in": "query", "description": "", "required": false, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.AddChannel" ], "file": "router/channel-router.go", "line": 50, "source_kind": "permission_table", "id": "GATEWAY-002", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "添加渠道", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [ { "name": "mode", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "single", "batch", "multi_to_single" ] }, { "name": "channel", "type": "object", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.type", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.models", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.groups", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.priority", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.weight", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.base_url", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "channel.tag", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.AddChannelRequest", "file": "controller/channel.go", "line": 574, "source": "AddChannelRequest struct {\n\tMode string `json:\"mode\"`\n\tMultiKeyMode constant.MultiKeyMode `json:\"multi_key_mode\"`\n\tBatchAddSetKeyPrefix2Name bool `json:\"batch_add_set_key_prefix_2_name\"`\n\tChannel *model.Channel `json:\"channel\"`\n}" } ], "observed_literal_keys": [ "batch", "count", "message", "multi_to_single", "name", "single", "success", "type" ], "handler_sources": [ { "symbol": "controller.AddChannel", "file": "controller/channel.go", "line": 613 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/", "operation": { "summary": "添加渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "mode": { "type": "string", "enum": [ "single", "batch", "multi_to_single" ] }, "channel": { "$ref": "#/components/schemas/Channel" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/channel/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelWrite)" ], "handlers": [ "controller.UpdateChannel" ], "file": "router/channel-router.go", "line": 51, "source_kind": "permission_table", "id": "GATEWAY-003", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "更新渠道", "auth_requirement": "Admin 员工身份；authz.ChannelWrite", "parameters": [], "request_fields": [ { "name": "id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "name", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "type", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "status", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "models", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "groups", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "priority", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "weight", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "base_url", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tag", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "append", "changed_fields", "data", "id", "message", "name", "replace", "success" ], "handler_sources": [ { "symbol": "controller.UpdateChannel", "file": "controller/channel.go", "line": 962 } ], "source_behavior_markers": [ "MsgAuthInsufficientPrivilege", "MsgInvalidParams" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/", "operation": { "summary": "更新渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Channel" } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/channel/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.DeleteChannel" ], "file": "router/channel-router.go", "line": 58, "source_kind": "permission_table", "id": "GATEWAY-004", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "删除渠道", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "id", "message", "name", "success" ], "handler_sources": [ { "symbol": "controller.DeleteChannel", "file": "controller/channel.go", "line": 733 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/{id}", "operation": { "summary": "删除渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.GetChannel" ], "file": "router/channel-router.go", "line": 45, "source_kind": "permission_table", "id": "GATEWAY-005", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取指定渠道", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetChannel", "file": "controller/channel.go", "line": 393 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/{id}", "operation": { "summary": "获取指定渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/:id/codex/refresh", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.RefreshCodexChannelCredential" ], "file": "router/channel-router.go", "line": 63, "source_kind": "permission_table", "id": "GATEWAY-006", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "RefreshCodexChannelCredential", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "account_id", "channel_id", "channel_name", "channel_type", "data", "email", "expires_at", "last_refresh", "message", "success" ], "handler_sources": [ { "symbol": "controller.RefreshCodexChannelCredential", "file": "controller/channel.go", "line": 542 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/:id/codex/usage", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.GetCodexChannelUsage" ], "file": "router/channel-router.go", "line": 64, "source_kind": "permission_table", "id": "GATEWAY-007", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetCodexChannelUsage", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetCodexChannelUsage", "file": "controller/codex_usage.go", "line": 20 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/:id/codex/usage/reset", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.ResetCodexChannelUsage" ], "file": "router/channel-router.go", "line": 66, "source_kind": "permission_table", "id": "GATEWAY-008", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ResetCodexChannelUsage", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.ResetCodexChannelUsage", "file": "controller/codex_usage.go", "line": 38 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/:id/codex/usage/reset-credits", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.GetCodexChannelRateLimitResetCredits" ], "file": "router/channel-router.go", "line": 65, "source_kind": "permission_table", "id": "GATEWAY-009", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetCodexChannelRateLimitResetCredits", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetCodexChannelRateLimitResetCredits", "file": "controller/codex_usage.go", "line": 29 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/:id/key", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RootAuth()", "middleware.CriticalRateLimit()", "middleware.DisableCache()", "middleware.SecureVerificationRequired()" ], "handlers": [ "controller.GetChannelKey" ], "file": "router/channel-router.go", "line": 23, "source_kind": "static", "id": "GATEWAY-010", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取渠道密钥", "auth_requirement": "Root 管理身份；敏感操作安全验证", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "id", "key", "message", "name", "success" ], "handler_sources": [ { "symbol": "controller.GetChannelKey", "file": "controller/channel.go", "line": 417 } ], "source_behavior_markers": [ "MsgChannelNotExists" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/{id}/key", "operation": { "summary": "获取渠道密钥", "deprecated": false, "description": "👑 需要超级管理员权限（Root）+ 安全验证", "tags": [ "渠道管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/:id/status", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.UpdateChannelStatus" ], "file": "router/channel-router.go", "line": 53, "source_kind": "permission_table", "id": "GATEWAY-011", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "UpdateChannelStatus", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.ChannelStatusRequest", "file": "controller/channel.go", "line": 953, "source": "ChannelStatusRequest struct {\n\tStatus int `json:\"status\"`\n}" } ], "observed_literal_keys": [ "changed", "data", "id", "message", "status", "success" ], "handler_sources": [ { "symbol": "controller.UpdateChannelStatus", "file": "controller/channel.go", "line": 1159 } ], "source_behavior_markers": [ "MsgInvalidParams" ], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/batch", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.DeleteChannelBatch" ], "file": "router/channel-router.go", "line": 59, "source_kind": "permission_table", "id": "GATEWAY-012", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "批量删除渠道", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [ { "name": "ids", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.ChannelBatch", "file": "controller/channel.go", "line": 912, "source": "ChannelBatch struct {\n\tIds []int `json:\"ids\"`\n\tTag *string `json:\"tag\"`\n}" } ], "observed_literal_keys": [ "count", "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteChannelBatch", "file": "controller/channel.go", "line": 917 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/batch", "operation": { "summary": "批量删除渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "integer" } } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/batch/tag", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelWrite)" ], "handlers": [ "controller.BatchSetChannelTag" ], "file": "router/channel-router.go", "line": 71, "source_kind": "permission_table", "id": "GATEWAY-013", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "批量设置渠道标签", "auth_requirement": "Admin 员工身份；authz.ChannelWrite", "parameters": [], "request_fields": [ { "name": "ids", "type": "array", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "tag", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.ChannelBatch", "file": "controller/channel.go", "line": 912, "source": "ChannelBatch struct {\n\tIds []int `json:\"ids\"`\n\tTag *string `json:\"tag\"`\n}" } ], "observed_literal_keys": [ "count", "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.BatchSetChannelTag", "file": "controller/channel.go", "line": 1363 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/batch/tag", "operation": { "summary": "批量设置渠道标签", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "ids": { "type": "array", "items": { "type": "integer" } }, "tag": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/copy/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.CopyChannel" ], "file": "router/channel-router.go", "line": 73, "source_kind": "permission_table", "id": "GATEWAY-014", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "复制渠道", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } }, { "name": "suffix", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "reset_balance", "in": "query", "description": "", "required": false, "schema": { "type": "boolean" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" }, { "name": "suffix", "in": "query", "source": "controller literal access" }, { "name": "reset_balance", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "id", "message", "name", "sourceId", "success" ], "handler_sources": [ { "symbol": "controller.CopyChannel", "file": "controller/channel.go", "line": 1437 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/channel/copy/{id}", "operation": { "summary": "复制渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } }, { "name": "suffix", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "reset_balance", "in": "query", "description": "", "required": false, "schema": { "type": "boolean" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/channel/disabled", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.DeleteDisabledChannel" ], "file": "router/channel-router.go", "line": 54, "source_kind": "permission_table", "id": "GATEWAY-015", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "删除已禁用渠道", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "count", "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteDisabledChannel", "file": "controller/channel.go", "line": 767 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/disabled", "operation": { "summary": "删除已禁用渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/fetch_models", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.FetchModels" ], "file": "router/channel-router.go", "line": 62, "source_kind": "permission_table", "id": "GATEWAY-016", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取模型列表", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [ { "name": "base_url", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "上游基础地址。编辑预览时显式空字符串表示清除已保存值，省略则沿用已保存值；相对上游路径要求非空的完整基础地址。" }, { "name": "type", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "渠道类型。高级自定义渠道为 58。" }, { "name": "key", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "新建渠道预览使用的 API 密钥。提供 channel_id 时忽略此字段，并在服务端使用渠道已保存的单密钥或多密钥配置。" }, { "name": "channel_id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "可选的已保存渠道 ID。用于在不向前端返回密钥的情况下预览尚未保存的高级自定义配置。" }, { "name": "advanced_custom", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "可选的高级自定义配置 JSON 字符串。新建高级自定义渠道时必填；编辑预览时覆盖已保存配置，省略则沿用已保存配置。模型发现仅支持显式的 /v1/models 路由和 OpenAI data[].id 响应。" }, { "name": "header_override", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "可选的全局请求头覆盖 JSON 字符串。编辑预览时覆盖已保存值，显式空字符串表示清除，省略则沿用。" }, { "name": "proxy", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "可选的网络代理。编辑预览时覆盖已保存值，显式空字符串表示清除，省略则沿用。" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.fetchModelsRequest", "file": "controller/channel.go", "line": 1228, "source": "fetchModelsRequest struct {\n\tChannelID int `json:\"channel_id\"`\n\tBaseURL *string `json:\"base_url\"`\n\tType int `json:\"type\"`\n\tKey string `json:\"key\"`\n\tAdvancedCustom *string `json:\"advanced_custom\"`\n\tHeaderOverride *string `json:\"header_override\"`\n\tProxy *string `json:\"proxy\"`\n}" } ], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.FetchModels", "file": "controller/channel.go", "line": 1306 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/channel/fetch_models", "operation": { "summary": "获取模型列表", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "base_url": { "type": "string", "description": "上游基础地址。编辑预览时显式空字符串表示清除已保存值，省略则沿用已保存值；相对上游路径要求非空的完整基础地址。" }, "type": { "type": "integer", "description": "渠道类型。高级自定义渠道为 58。" }, "key": { "type": "string", "description": "新建渠道预览使用的 API 密钥。提供 channel_id 时忽略此字段，并在服务端使用渠道已保存的单密钥或多密钥配置。" }, "channel_id": { "type": "integer", "description": "可选的已保存渠道 ID。用于在不向前端返回密钥的情况下预览尚未保存的高级自定义配置。" }, "advanced_custom": { "type": "string", "description": "可选的高级自定义配置 JSON 字符串。新建高级自定义渠道时必填；编辑预览时覆盖已保存配置，省略则沿用已保存配置。模型发现仅支持显式的 /v1/models 路由和 OpenAI data[].id 响应。" }, "header_override": { "type": "string", "description": "可选的全局请求头覆盖 JSON 字符串。编辑预览时覆盖已保存值，显式空字符串表示清除，省略则沿用。" }, "proxy": { "type": "string", "description": "可选的网络代理。编辑预览时覆盖已保存值，显式空字符串表示清除，省略则沿用。" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/fetch_models/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.FetchUpstreamModels" ], "file": "router/channel-router.go", "line": 61, "source_kind": "permission_table", "id": "GATEWAY-017", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取上游模型列表", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.FetchUpstreamModels", "file": "controller/channel.go", "line": 232 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/fetch_models/{id}", "operation": { "summary": "获取上游模型列表", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/fix", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.FixChannelsAbilities" ], "file": "router/channel-router.go", "line": 60, "source_kind": "permission_table", "id": "GATEWAY-018", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "修复渠道能力", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "fails", "message", "success" ], "handler_sources": [ { "symbol": "controller.FixChannelsAbilities", "file": "controller/channel.go", "line": 261 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/fix", "operation": { "summary": "修复渠道能力", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/models", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.ChannelListModels" ], "file": "router/channel-router.go", "line": 42, "source_kind": "permission_table", "id": "GATEWAY-019", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取渠道模型列表", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "success" ], "handler_sources": [ { "symbol": "controller.ChannelListModels", "file": "controller/model.go", "line": 318 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/channel/models", "operation": { "summary": "获取渠道模型列表", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/models_enabled", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.EnabledListModels" ], "file": "router/channel-router.go", "line": 43, "source_kind": "permission_table", "id": "GATEWAY-020", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取已启用模型列表", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "success" ], "handler_sources": [ { "symbol": "controller.EnabledListModels", "file": "controller/model.go", "line": 341 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/channel/models_enabled", "operation": { "summary": "获取已启用模型列表", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/multi_key/manage", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.ManageMultiKeys" ], "file": "router/channel-router.go", "line": 74, "source_kind": "permission_table", "id": "GATEWAY-021", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "管理多密钥", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [ { "name": "channel_id", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "action", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "", "enum": [ "get_key_status", "disable_key", "enable_key", "delete_key", "delete_disabled_keys", "enable_all_keys", "disable_all_keys" ] }, { "name": "key_index", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.MultiKeyManageRequest", "file": "controller/channel.go", "line": 1500, "source": "MultiKeyManageRequest struct {\n\tChannelId int `json:\"channel_id\"`\n\tAction string `json:\"action\"`\n\tKeyIndex *int `json:\"key_index,omitempty\"`\n\tPage int `json:\"page,omitempty\"`\n\tPageSize int `json:\"page_size,omitempty\"`\n\tStatus *int `json:\"status,omitempty\"`\n}" } ], "observed_literal_keys": [ "action", "data", "delete_disabled_keys", "delete_key", "disable_all_keys", "disable_key", "enable_all_keys", "enable_key", "get_key_status", "id", "message", "success" ], "handler_sources": [ { "symbol": "controller.ManageMultiKeys", "file": "controller/channel.go", "line": 1531 } ], "source_behavior_markers": [ "MsgAuthInsufficientPrivilege" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/multi_key/manage", "operation": { "summary": "管理多密钥", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "channel_id": { "type": "integer" }, "action": { "type": "string", "enum": [ "get_key_status", "disable_key", "enable_key", "delete_key", "delete_disabled_keys", "enable_all_keys", "disable_all_keys" ] }, "key_index": { "type": "integer" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/channel/ollama/delete", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.OllamaDeleteModel" ], "file": "router/channel-router.go", "line": 69, "source_kind": "permission_table", "id": "GATEWAY-022", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "OllamaDeleteModel", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "channel_id", "go_type": "int", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "model_name", "go_type": "string", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.OllamaDeleteModel", "file": "controller/channel.go", "line": 2151 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/ollama/pull", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.OllamaPullModel" ], "file": "router/channel-router.go", "line": 67, "source_kind": "permission_table", "id": "GATEWAY-023", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "OllamaPullModel", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "channel_id", "go_type": "int", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "model_name", "go_type": "string", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.OllamaPullModel", "file": "controller/channel.go", "line": 2006 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/ollama/pull/stream", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.OllamaPullModelStream" ], "file": "router/channel-router.go", "line": 68, "source_kind": "permission_table", "id": "GATEWAY-024", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "OllamaPullModelStream", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "channel_id", "go_type": "int", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "model_name", "go_type": "string", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "error", "message", "success" ], "handler_sources": [ { "symbol": "controller.OllamaPullModelStream", "file": "controller/channel.go", "line": 2069 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/ollama/version/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelSensitiveWrite)" ], "handlers": [ "controller.OllamaVersion" ], "file": "router/channel-router.go", "line": 70, "source_kind": "permission_table", "id": "GATEWAY-025", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "OllamaVersion", "auth_requirement": "Admin 员工身份；authz.ChannelSensitiveWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success", "version" ], "handler_sources": [ { "symbol": "controller.OllamaVersion", "file": "controller/channel.go", "line": 2214 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/ops", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.GetChannelOps" ], "file": "router/channel-router.go", "line": 44, "source_kind": "permission_table", "id": "GATEWAY-026", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetChannelOps", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "retry_times" ], "handler_sources": [ { "symbol": "controller.GetChannelOps", "file": "controller/channel.go", "line": 96 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.SearchChannels" ], "file": "router/channel-router.go", "line": 41, "source_kind": "permission_table", "id": "GATEWAY-027", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "搜索渠道", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "group", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "model", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "group", "in": "query", "source": "controller literal access" }, { "name": "model", "in": "query", "source": "controller literal access" }, { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "id_sort", "in": "query", "source": "controller literal access" }, { "name": "sort_by", "in": "query", "source": "controller literal access" }, { "name": "sort_order", "in": "query", "source": "controller literal access" }, { "name": "tag_mode", "in": "query", "source": "controller literal access" }, { "name": "type", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "controller literal access" }, { "name": "page_size", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "items", "message", "success", "total", "type_counts" ], "handler_sources": [ { "symbol": "controller.SearchChannels", "file": "controller/channel.go", "line": 277 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/channel/search", "operation": { "summary": "搜索渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "keyword", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "group", "in": "query", "description": "", "required": false, "schema": { "type": "string" } }, { "name": "model", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/status/batch", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.BatchUpdateChannelStatus" ], "file": "router/channel-router.go", "line": 52, "source_kind": "permission_table", "id": "GATEWAY-028", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "BatchUpdateChannelStatus", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.ChannelStatusBatchRequest", "file": "controller/channel.go", "line": 957, "source": "ChannelStatusBatchRequest struct {\n\tIds []int `json:\"ids\"`\n\tStatus int `json:\"status\"`\n}" } ], "observed_literal_keys": [ "count", "data", "message", "status", "success", "total" ], "handler_sources": [ { "symbol": "controller.BatchUpdateChannelStatus", "file": "controller/channel.go", "line": 1186 } ], "source_behavior_markers": [ "MsgInvalidParams" ], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/channel/tag", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelWrite)" ], "handlers": [ "controller.EditTagChannels" ], "file": "router/channel-router.go", "line": 57, "source_kind": "permission_table", "id": "GATEWAY-029", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "编辑标签渠道", "auth_requirement": "Admin 员工身份；authz.ChannelWrite", "parameters": [], "request_fields": [ { "name": "tag", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "new_tag", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "priority", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" }, { "name": "weight", "type": "integer", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.ChannelTag", "file": "controller/channel.go", "line": 788, "source": "ChannelTag struct {\n\tTag string `json:\"tag\"`\n\tNewTag *string `json:\"new_tag\"`\n\tPriority *int64 `json:\"priority\"`\n\tWeight *uint `json:\"weight\"`\n\tModelMapping *string `json:\"model_mapping\"`\n\tModels *string `json:\"models\"`\n\tGroups *string `json:\"groups\"`\n\tParamOverride *string `json:\"param_override\"`\n\tHeaderOverride *string `json:\"header_override\"`\n}" } ], "observed_literal_keys": [ "message", "success", "tag" ], "handler_sources": [ { "symbol": "controller.EditTagChannels", "file": "controller/channel.go", "line": 852 } ], "source_behavior_markers": [ "MsgAuthInsufficientPrivilege" ], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/tag", "operation": { "summary": "编辑标签渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "tag": { "type": "string" }, "new_tag": { "type": "string" }, "priority": { "type": "integer" }, "weight": { "type": "integer" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/tag/disabled", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.DisableTagChannels" ], "file": "router/channel-router.go", "line": 55, "source_kind": "permission_table", "id": "GATEWAY-030", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "禁用标签渠道", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [ { "name": "tag", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.ChannelTag", "file": "controller/channel.go", "line": 788, "source": "ChannelTag struct {\n\tTag string `json:\"tag\"`\n\tNewTag *string `json:\"new_tag\"`\n\tPriority *int64 `json:\"priority\"`\n\tWeight *uint `json:\"weight\"`\n\tModelMapping *string `json:\"model_mapping\"`\n\tModels *string `json:\"models\"`\n\tGroups *string `json:\"groups\"`\n\tParamOverride *string `json:\"param_override\"`\n\tHeaderOverride *string `json:\"header_override\"`\n}" } ], "observed_literal_keys": [ "message", "success", "tag" ], "handler_sources": [ { "symbol": "controller.DisableTagChannels", "file": "controller/channel.go", "line": 800 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/tag/disabled", "operation": { "summary": "禁用标签渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "tag": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/tag/enabled", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.EnableTagChannels" ], "file": "router/channel-router.go", "line": 56, "source_kind": "permission_table", "id": "GATEWAY-031", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "启用标签渠道", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [ { "name": "tag", "type": "string", "required": false, "required_source": "openapi_declaration", "description": "" } ], "request_formats": [ "application/json" ], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.ChannelTag", "file": "controller/channel.go", "line": 788, "source": "ChannelTag struct {\n\tTag string `json:\"tag\"`\n\tNewTag *string `json:\"new_tag\"`\n\tPriority *int64 `json:\"priority\"`\n\tWeight *uint `json:\"weight\"`\n\tModelMapping *string `json:\"model_mapping\"`\n\tModels *string `json:\"models\"`\n\tGroups *string `json:\"groups\"`\n\tParamOverride *string `json:\"param_override\"`\n\tHeaderOverride *string `json:\"header_override\"`\n}" } ], "observed_literal_keys": [ "message", "success", "tag" ], "handler_sources": [ { "symbol": "controller.EnableTagChannels", "file": "controller/channel.go", "line": 826 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/tag/enabled", "operation": { "summary": "启用标签渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "tag": { "type": "string" } } } } } }, "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/tag/models", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelRead)" ], "handlers": [ "controller.GetTagModels" ], "file": "router/channel-router.go", "line": 72, "source_kind": "permission_table", "id": "GATEWAY-032", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取标签模型", "auth_requirement": "Admin 员工身份；authz.ChannelRead", "parameters": [ { "name": "tag", "in": "query", "description": "", "required": true, "schema": { "type": "string" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "tag", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetTagModels", "file": "controller/channel.go", "line": 1390 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/channel/tag/models", "operation": { "summary": "获取标签模型", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "tag", "in": "query", "description": "", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/test", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.TestAllChannels" ], "file": "router/channel-router.go", "line": 46, "source_kind": "permission_table", "id": "GATEWAY-033", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "测试所有渠道", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "status", "success", "task_id", "type" ], "handler_sources": [ { "symbol": "controller.TestAllChannels", "file": "controller/channel-test.go", "line": 1131 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/test", "operation": { "summary": "测试所有渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/test/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.TestChannel" ], "file": "router/channel-router.go", "line": 47, "source_kind": "permission_table", "id": "GATEWAY-034", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "测试指定渠道", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" }, { "name": "model", "in": "query", "source": "controller literal access" }, { "name": "endpoint_type", "in": "query", "source": "controller literal access" }, { "name": "stream", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "error_code", "message", "success", "time" ], "handler_sources": [ { "symbol": "controller.TestChannel", "file": "controller/channel-test.go", "line": 845 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/test/{id}", "operation": { "summary": "测试指定渠道", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/update_balance", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.UpdateAllChannelsBalance" ], "file": "router/channel-router.go", "line": 48, "source_kind": "permission_table", "id": "GATEWAY-035", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "更新所有渠道余额", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.UpdateAllChannelsBalance", "file": "controller/channel-billing.go", "line": 599 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/update_balance", "operation": { "summary": "更新所有渠道余额", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/channel/update_balance/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.UpdateChannelBalance" ], "file": "router/channel-router.go", "line": 49, "source_kind": "permission_table", "id": "GATEWAY-036", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "更新指定渠道余额", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "message", "success" ], "handler_sources": [ { "symbol": "controller.UpdateChannelBalance", "file": "controller/channel-billing.go", "line": 530 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/channel/update_balance/{id}", "operation": { "summary": "更新指定渠道余额", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "渠道管理" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "默认读取可重试；但上游存在 GET 执行动作/签发凭据，必须按处理器确认。不得把方法名作为安全重试的唯一依据。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/upstream_updates/apply", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelWrite)" ], "handlers": [ "controller.ApplyChannelUpstreamModelUpdates" ], "file": "router/channel-router.go", "line": 75, "source_kind": "permission_table", "id": "GATEWAY-037", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ApplyChannelUpstreamModelUpdates", "auth_requirement": "Admin 员工身份；authz.ChannelWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.applyChannelUpstreamModelUpdatesRequest", "file": "controller/channel_upstream_update.go", "line": 70, "source": "applyChannelUpstreamModelUpdatesRequest struct {\n\tID int `json:\"id\"`\n\tAddModels []string `json:\"add_models\"`\n\tRemoveModels []string `json:\"remove_models\"`\n\tIgnoreModels []string `json:\"ignore_models\"`\n}" } ], "observed_literal_keys": [ "added_models", "data", "id", "ignored_models", "message", "models", "remaining_models", "remaining_remove_models", "removed_models", "settings", "success" ], "handler_sources": [ { "symbol": "controller.ApplyChannelUpstreamModelUpdates", "file": "controller/channel_upstream_update.go", "line": 858 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/upstream_updates/apply_all", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelWrite)" ], "handlers": [ "controller.ApplyAllChannelUpstreamModelUpdates" ], "file": "router/channel-router.go", "line": 76, "source_kind": "permission_table", "id": "GATEWAY-038", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ApplyAllChannelUpstreamModelUpdates", "auth_requirement": "Admin 员工身份；authz.ChannelWrite", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "added_models", "count", "data", "failed_channel_ids", "message", "processed_channels", "removed_models", "results", "success" ], "handler_sources": [ { "symbol": "controller.ApplyAllChannelUpstreamModelUpdates", "file": "controller/channel_upstream_update.go", "line": 1025 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/upstream_updates/detect", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.DetectChannelUpstreamModelUpdates" ], "file": "router/channel-router.go", "line": 77, "source_kind": "permission_table", "id": "GATEWAY-039", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "DetectChannelUpstreamModelUpdates", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.applyChannelUpstreamModelUpdatesRequest", "file": "controller/channel_upstream_update.go", "line": 70, "source": "applyChannelUpstreamModelUpdatesRequest struct {\n\tID int `json:\"id\"`\n\tAddModels []string `json:\"add_models\"`\n\tRemoveModels []string `json:\"remove_models\"`\n\tIgnoreModels []string `json:\"ignore_models\"`\n}" } ], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.DetectChannelUpstreamModelUpdates", "file": "controller/channel_upstream_update.go", "line": 914 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/channel/upstream_updates/detect_all", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.ChannelOperate)" ], "handlers": [ "controller.DetectAllChannelUpstreamModelUpdates" ], "file": "router/channel-router.go", "line": 78, "source_kind": "permission_table", "id": "GATEWAY-040", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "DetectAllChannelUpstreamModelUpdates", "auth_requirement": "Admin 员工身份；authz.ChannelOperate", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "status", "success", "task_id", "type" ], "handler_sources": [ { "symbol": "controller.DetectAllChannelUpstreamModelUpdates", "file": "controller/channel_upstream_update.go", "line": 1115 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAllDeployments" ], "file": "router/api-router.go", "line": 407, "source_kind": "static", "id": "GATEWAY-041", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetAllDeployments", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [ "items", "page", "page_size", "status_counts", "total" ], "handler_sources": [ { "symbol": "controller.GetAllDeployments", "file": "controller/deployment.go", "line": 206 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/deployments/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.CreateDeployment" ], "file": "router/api-router.go", "line": 415, "source_kind": "static", "id": "GATEWAY-042", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "CreateDeployment", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "ionet.DeploymentRequest", "file": "pkg/ionet/types.go", "line": 35, "source": "DeploymentRequest struct {\n\tResourcePrivateName string `json:\"resource_private_name\"`\n\tDurationHours int `json:\"duration_hours\"`\n\tGPUsPerContainer int `json:\"gpus_per_container\"`\n\tHardwareID int `json:\"hardware_id\"`\n\tLocationIDs []int `json:\"location_ids\"`\n\tContainerConfig ContainerConfig `json:\"container_config\"`\n\tRegistryConfig RegistryConfig `json:\"registry_config\"`\n}" } ], "observed_literal_keys": [ "deployment_id", "message", "status" ], "handler_sources": [ { "symbol": "controller.CreateDeployment", "file": "controller/deployment.go", "line": 494 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/deployments/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeleteDeployment" ], "file": "router/api-router.go", "line": 424, "source_kind": "static", "id": "GATEWAY-043", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "DeleteDeployment", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "deployment_id", "message", "status" ], "handler_sources": [ { "symbol": "controller.DeleteDeployment", "file": "controller/deployment.go", "line": 469 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetDeployment" ], "file": "router/api-router.go", "line": 417, "source_kind": "static", "id": "GATEWAY-044", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetDeployment", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "amount_paid", "brand_name", "completed_percent", "compute_minutes_remaining", "compute_minutes_served", "container_config", "cpu", "created_at", "deployment_name", "description", "gpu", "gpus_per_container", "hardware_id", "hardware_name", "id", "instance_count", "locations", "memory", "model_name", "model_version", "resource_config", "status", "total_containers", "total_gpus", "updated_at" ], "handler_sources": [ { "symbol": "controller.GetDeployment", "file": "controller/deployment.go", "line": 296 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/deployments/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UpdateDeployment" ], "file": "router/api-router.go", "line": 421, "source_kind": "static", "id": "GATEWAY-045", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "UpdateDeployment", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "ionet.UpdateDeploymentRequest", "file": "pkg/ionet/types.go", "line": 232, "source": "UpdateDeploymentRequest struct {\n\tEnvVariables map[string]string `json:\"env_variables,omitempty\"`\n\tSecretEnvVariables map[string]string `json:\"secret_env_variables,omitempty\"`\n\tEntrypoint []string `json:\"entrypoint,omitempty\"`\n\tTrafficPort *int `json:\"traffic_port,omitempty\"`\n\tImageURL string `json:\"image_url,omitempty\"`\n\tRegistryUsername string `json:\"registry_username,omitempty\"`\n\tRegistrySecret string `json:\"registry_secret,omitempty\"`\n\tArgs []string `json:\"args,omitempty\"`\n\tCommand string `json:\"command,omitempty\"`\n}" } ], "observed_literal_keys": [ "deployment_id", "status" ], "handler_sources": [ { "symbol": "controller.UpdateDeployment", "file": "controller/deployment.go", "line": 400 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/:id/containers", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.ListDeploymentContainers" ], "file": "router/api-router.go", "line": 419, "source_kind": "static", "id": "GATEWAY-046", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ListDeploymentContainers", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "brand_name", "container_id", "containers", "created_at", "device_id", "events", "gpus_per_container", "hardware", "message", "public_url", "status", "time", "total", "uptime_percent" ], "handler_sources": [ { "symbol": "controller.ListDeploymentContainers", "file": "controller/deployment.go", "line": 703 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/:id/containers/:container_id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetContainerDetails" ], "file": "router/api-router.go", "line": 420, "source_kind": "static", "id": "GATEWAY-047", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetContainerDetails", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "brand_name", "container_id", "created_at", "deployment_id", "device_id", "events", "gpus_per_container", "hardware", "message", "public_url", "status", "time", "uptime_percent" ], "handler_sources": [ { "symbol": "controller.GetContainerDetails", "file": "controller/deployment.go", "line": 758 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/deployments/:id/extend", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.ExtendDeployment" ], "file": "router/api-router.go", "line": 423, "source_kind": "static", "id": "GATEWAY-048", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ExtendDeployment", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "ionet.ExtendDurationRequest", "file": "pkg/ionet/types.go", "line": 245, "source": "ExtendDurationRequest struct {\n\tDurationHours int `json:\"duration_hours\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.ExtendDeployment", "file": "controller/deployment.go", "line": 430 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/:id/logs", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetDeploymentLogs" ], "file": "router/api-router.go", "line": 418, "source_kind": "static", "id": "GATEWAY-049", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetDeploymentLogs", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "container_id", "in": "query", "source": "controller literal access" }, { "name": "level", "in": "query", "source": "controller literal access" }, { "name": "stream", "in": "query", "source": "controller literal access" }, { "name": "cursor", "in": "query", "source": "controller literal access" }, { "name": "limit", "in": "query", "source": "controller literal access" }, { "name": "follow", "in": "query", "source": "controller literal access" }, { "name": "start_time", "in": "query", "source": "controller literal access" }, { "name": "end_time", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetDeploymentLogs", "file": "controller/deployment.go", "line": 646 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/deployments/:id/name", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UpdateDeploymentName" ], "file": "router/api-router.go", "line": 422, "source_kind": "static", "id": "GATEWAY-050", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "UpdateDeploymentName", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "name", "go_type": "string", "variable": "req", "required_tag": true, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "id", "message", "name", "status" ], "handler_sources": [ { "symbol": "controller.UpdateDeploymentName", "file": "controller/deployment.go", "line": 345 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/available-replicas", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetAvailableReplicas" ], "file": "router/api-router.go", "line": 412, "source_kind": "static", "id": "GATEWAY-051", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetAvailableReplicas", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "hardware_id", "in": "query", "source": "controller literal access" }, { "name": "gpu_count", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetAvailableReplicas", "file": "controller/deployment.go", "line": 564 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/check-name", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.CheckClusterNameAvailability" ], "file": "router/api-router.go", "line": 414, "source_kind": "static", "id": "GATEWAY-052", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "CheckClusterNameAvailability", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "name", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "available", "name" ], "handler_sources": [ { "symbol": "controller.CheckClusterNameAvailability", "file": "controller/deployment.go", "line": 621 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/hardware-types", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetHardwareTypes" ], "file": "router/api-router.go", "line": 410, "source_kind": "static", "id": "GATEWAY-053", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetHardwareTypes", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "hardware_types", "total", "total_available" ], "handler_sources": [ { "symbol": "controller.GetHardwareTypes", "file": "controller/deployment.go", "line": 520 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/locations", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetLocations" ], "file": "router/api-router.go", "line": 411, "source_kind": "static", "id": "GATEWAY-054", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetLocations", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "locations", "total" ], "handler_sources": [ { "symbol": "controller.GetLocations", "file": "controller/deployment.go", "line": 540 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/deployments/price-estimation", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetPriceEstimation" ], "file": "router/api-router.go", "line": 413, "source_kind": "static", "id": "GATEWAY-055", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetPriceEstimation", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "ionet.PriceEstimationRequest", "file": "pkg/ionet/types.go", "line": 186, "source": "PriceEstimationRequest struct {\n\tLocationIDs []int `json:\"location_ids\"`\n\tHardwareID int `json:\"hardware_id\"`\n\tGPUsPerContainer int `json:\"gpus_per_container\"`\n\tDurationHours int `json:\"duration_hours\"`\n\tReplicaCount int `json:\"replica_count\"`\n\tCurrency string `json:\"currency\"`\n\tDurationType string `json:\"duration_type\"`\n\tDurationQty int `json:\"duration_qty\"`\n\tHardwareQty int `json:\"hardware_qty\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetPriceEstimation", "file": "controller/deployment.go", "line": 600 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/search", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.SearchDeployments" ], "file": "router/api-router.go", "line": 408, "source_kind": "static", "id": "GATEWAY-056", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "SearchDeployments", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "status", "in": "query", "source": "controller literal access" }, { "name": "keyword", "in": "query", "source": "controller literal access" }, { "name": "p", "in": "query", "source": "common.GetPageQuery" }, { "name": "page_size", "in": "query", "source": "common.GetPageQuery" } ], "body_types": [], "observed_literal_keys": [ "items", "page", "page_size", "total" ], "handler_sources": [ { "symbol": "controller.SearchDeployments", "file": "controller/deployment.go", "line": 243 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/deployments/settings", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetModelDeploymentSettings" ], "file": "router/api-router.go", "line": 405, "source_kind": "static", "id": "GATEWAY-057", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetModelDeploymentSettings", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "can_connect", "configured", "enabled", "provider" ], "handler_sources": [ { "symbol": "controller.GetModelDeploymentSettings", "file": "controller/deployment.go", "line": 28 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/deployments/settings/test-connection", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.TestIoNetConnection" ], "file": "router/api-router.go", "line": 406, "source_kind": "static", "id": "GATEWAY-058", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "TestIoNetConnection", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "api_key", "go_type": "string", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "hardware_count", "total_available" ], "handler_sources": [ { "symbol": "controller.TestIoNetConnection", "file": "controller/deployment.go", "line": 58 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/deployments/test-connection", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.TestIoNetConnection" ], "file": "router/api-router.go", "line": 409, "source_kind": "static", "id": "GATEWAY-059", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "TestIoNetConnection", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [ { "name": "api_key", "go_type": "string", "variable": "req", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "hardware_count", "total_available" ], "handler_sources": [ { "symbol": "controller.TestIoNetConnection", "file": "controller/deployment.go", "line": 58 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/log/channel_affinity_usage_cache", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetChannelAffinityUsageCacheStats" ], "file": "router/api-router.go", "line": 315, "source_kind": "static", "id": "GATEWAY-060", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetChannelAffinityUsageCacheStats", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "rule_name", "in": "query", "source": "controller literal access" }, { "name": "using_group", "in": "query", "source": "controller literal access" }, { "name": "key_fp", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetChannelAffinityUsageCacheStats", "file": "controller/channel_affinity_cache.go", "line": 62 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/option/channel_affinity_cache", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ClearChannelAffinityCache" ], "file": "router/api-router.go", "line": 215, "source_kind": "static", "id": "GATEWAY-061", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ClearChannelAffinityCache", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "all", "in": "query", "source": "controller literal access" }, { "name": "rule_name", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "deleted", "message", "success" ], "handler_sources": [ { "symbol": "controller.ClearChannelAffinityCache", "file": "controller/channel_affinity_cache.go", "line": 20 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/option/channel_affinity_cache", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetChannelAffinityCacheStats" ], "file": "router/api-router.go", "line": 214, "source_kind": "static", "id": "GATEWAY-062", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetChannelAffinityCacheStats", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetChannelAffinityCacheStats", "file": "controller/channel_affinity_cache.go", "line": 11 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/option/waffo-pancake/catalog", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ListWaffoPancakeCatalog" ], "file": "router/api-router.go", "line": 217, "source_kind": "static", "id": "GATEWAY-063", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ListWaffoPancakeCatalog", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "merchant_id", "in": "query", "source": "controller literal access" }, { "name": "private_key", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "data", "message" ], "handler_sources": [ { "symbol": "controller.ListWaffoPancakeCatalog", "file": "controller/topup_waffo_pancake.go", "line": 221 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/option/waffo-pancake/pair", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.CreateWaffoPancakePair" ], "file": "router/api-router.go", "line": 218, "source_kind": "static", "id": "GATEWAY-064", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "CreateWaffoPancakePair", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.createWaffoPancakePairRequest", "file": "controller/topup_waffo_pancake.go", "line": 117, "source": "createWaffoPancakePairRequest struct {\n\tMerchantID string `json:\"merchant_id\"`\n\tPrivateKey string `json:\"private_key\"`\n\tReturnURL string `json:\"return_url\"`\n}" } ], "observed_literal_keys": [ "data", "error", "message", "product_id", "product_name", "store_id", "store_name" ], "handler_sources": [ { "symbol": "controller.CreateWaffoPancakePair", "file": "controller/topup_waffo_pancake.go", "line": 171 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/plugin/task", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ListTaskPlugins" ], "file": "router/api-router.go", "line": 254, "source_kind": "static", "id": "GATEWAY-065", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ListTaskPlugins", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.ListTaskPlugins", "file": "controller/task_plugin.go", "line": 152 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/plugin/task", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.UploadTaskPlugin" ], "file": "router/api-router.go", "line": 255, "source_kind": "static", "id": "GATEWAY-066", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "UploadTaskPlugin", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.taskPluginUploadRequest", "file": "controller/task_plugin.go", "line": 39, "source": "taskPluginUploadRequest struct {\n\tSource string `json:\"source\" binding:\"required\"`\n\tEnabled *bool `json:\"enabled\"`\n\tRemark string `json:\"remark\"`\n\tForce bool `json:\"force\"`\n\tSourceSha256 string `json:\"sourceSha256\"`\n\n\tIcon string `json:\"icon\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.UploadTaskPlugin", "file": "controller/task_plugin.go", "line": 50 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/plugin/task", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.UploadTaskPlugin" ], "file": "router/api-router.go", "line": 256, "source_kind": "static", "id": "GATEWAY-067", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "UploadTaskPlugin", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "controller.taskPluginUploadRequest", "file": "controller/task_plugin.go", "line": 39, "source": "taskPluginUploadRequest struct {\n\tSource string `json:\"source\" binding:\"required\"`\n\tEnabled *bool `json:\"enabled\"`\n\tRemark string `json:\"remark\"`\n\tForce bool `json:\"force\"`\n\tSourceSha256 string `json:\"sourceSha256\"`\n\n\tIcon string `json:\"icon\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.UploadTaskPlugin", "file": "controller/task_plugin.go", "line": 50 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/plugin/task/:key", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetTaskPlugin" ], "file": "router/api-router.go", "line": 260, "source_kind": "static", "id": "GATEWAY-068", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetTaskPlugin", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" }, { "name": "version", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetTaskPlugin", "file": "controller/task_plugin.go", "line": 341 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/plugin/task/:key/activate", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.ActivateTaskPlugin" ], "file": "router/api-router.go", "line": 263, "source_kind": "static", "id": "GATEWAY-069", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "ActivateTaskPlugin", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.taskPluginActivateRequest", "file": "controller/task_plugin.go", "line": 459, "source": "taskPluginActivateRequest struct {\n\tVersion string `json:\"version\" binding:\"required\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.ActivateTaskPlugin", "file": "controller/task_plugin.go", "line": 463 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/plugin/task/:key/dryrun", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.DryRunTaskPlugin" ], "file": "router/api-router.go", "line": 265, "source_kind": "static", "id": "GATEWAY-070", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "DryRunTaskPlugin", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" } ], "body_types": [ { "type": "controller.taskPluginDryRunRequest", "file": "controller/task_plugin.go", "line": 372, "source": "taskPluginDryRunRequest struct {\n\tHook string `json:\"hook\" binding:\"required\"`\n\tMember string `json:\"member\"`\n\tArgs []json.RawMessage `json:\"args\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.DryRunTaskPlugin", "file": "controller/task_plugin.go", "line": 378 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/plugin/task/:key/icon", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetTaskPluginIcon" ], "file": "router/api-router.go", "line": 261, "source_kind": "static", "id": "GATEWAY-071", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetTaskPluginIcon", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" }, { "name": "version", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetTaskPluginIcon", "file": "controller/task_plugin.go", "line": 313 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/plugin/task/:key/status", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.SetTaskPluginStatus" ], "file": "router/api-router.go", "line": 264, "source_kind": "static", "id": "GATEWAY-072", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "SetTaskPluginStatus", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" }, { "name": "cascade", "in": "query", "source": "controller literal access" }, { "name": "force", "in": "query", "source": "controller literal access" } ], "body_types": [ { "type": "controller.taskPluginStatusRequest", "file": "controller/task_plugin.go", "line": 500, "source": "taskPluginStatusRequest struct {\n\tEnabled *bool `json:\"enabled\" binding:\"required\"`\n}" } ], "observed_literal_keys": [ "channels", "data", "disabled_channels", "in_flight_count", "message", "plugin_enabled", "success" ], "handler_sources": [ { "symbol": "controller.SetTaskPluginStatus", "file": "controller/task_plugin.go", "line": 504 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/plugin/task/:key/versions", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetTaskPluginVersions" ], "file": "router/api-router.go", "line": 262, "source_kind": "static", "id": "GATEWAY-073", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetTaskPluginVersions", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetTaskPluginVersions", "file": "controller/task_plugin.go", "line": 110 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/plugin/task/:key/versions/:version", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.DeleteTaskPluginVersion" ], "file": "router/api-router.go", "line": 266, "source_kind": "static", "id": "GATEWAY-074", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "DeleteTaskPluginVersion", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "key", "in": "path", "source": "controller literal access" }, { "name": "version", "in": "path", "source": "controller literal access" }, { "name": "force", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [ "channels", "data", "in_flight_count", "message", "success" ], "handler_sources": [ { "symbol": "controller.DeleteTaskPluginVersion", "file": "controller/task_plugin.go", "line": 420 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/plugin/task/marketplace/sources", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetTaskPluginMarketplaceSources" ], "file": "router/api-router.go", "line": 258, "source_kind": "static", "id": "GATEWAY-075", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetTaskPluginMarketplaceSources", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetTaskPluginMarketplaceSources", "file": "controller/task_plugin.go", "line": 594 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/plugin/task/marketplace/sources", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.UpdateTaskPluginMarketplaceSources" ], "file": "router/api-router.go", "line": 259, "source_kind": "static", "id": "GATEWAY-076", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "UpdateTaskPluginMarketplaceSources", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.UpdateTaskPluginMarketplaceSources", "file": "controller/task_plugin.go", "line": 598 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/plugin/task/runtime/status", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetTaskPluginRuntime" ], "file": "router/api-router.go", "line": 257, "source_kind": "static", "id": "GATEWAY-077", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetTaskPluginRuntime", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetTaskPluginRuntime", "file": "controller/task_plugin.go", "line": 256 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/prefill_group/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.GetPrefillGroups" ], "file": "router/api-router.go", "line": 356, "source_kind": "static", "id": "GATEWAY-078", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取预填分组", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "type", "in": "query", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.GetPrefillGroups", "file": "controller/prefill_group.go", "line": 13 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/prefill_group/", "operation": { "summary": "获取预填分组", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "分组" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/prefill_group/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.CreatePrefillGroup" ], "file": "router/api-router.go", "line": 357, "source_kind": "static", "id": "GATEWAY-079", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "创建预填分组", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.PrefillGroup", "file": "model/prefill_group.go", "line": 78, "source": "PrefillGroup struct {\n\tId int `json:\"id\"`\n\tName string `json:\"name\" gorm:\"size:64;not null;uniqueIndex:uk_prefill_name,where:deleted_at IS NULL\"`\n\tType string `json:\"type\" gorm:\"size:32;index;not null\"`\n\tItems JSONValue `json:\"items\" gorm:\"type:json\"`\n\tDescription string `json:\"description,omitempty\" gorm:\"type:varchar(255)\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tUpdatedTime int64 `json:\"updated_time\" gorm:\"bigint\"`\n\tDeletedAt gorm.DeletedAt `json:\"-\" gorm:\"index\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.CreatePrefillGroup", "file": "controller/prefill_group.go", "line": 24 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/prefill_group/", "operation": { "summary": "创建预填分组", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "分组" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "PUT", "path": "/api/prefill_group/", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.UpdatePrefillGroup" ], "file": "router/api-router.go", "line": 358, "source_kind": "static", "id": "GATEWAY-080", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "更新预填分组", "auth_requirement": "Admin 员工身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "model.PrefillGroup", "file": "model/prefill_group.go", "line": 78, "source": "PrefillGroup struct {\n\tId int `json:\"id\"`\n\tName string `json:\"name\" gorm:\"size:64;not null;uniqueIndex:uk_prefill_name,where:deleted_at IS NULL\"`\n\tType string `json:\"type\" gorm:\"size:32;index;not null\"`\n\tItems JSONValue `json:\"items\" gorm:\"type:json\"`\n\tDescription string `json:\"description,omitempty\" gorm:\"type:varchar(255)\"`\n\tCreatedTime int64 `json:\"created_time\" gorm:\"bigint\"`\n\tUpdatedTime int64 `json:\"updated_time\" gorm:\"bigint\"`\n\tDeletedAt gorm.DeletedAt `json:\"-\" gorm:\"index\"`\n}" } ], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.UpdatePrefillGroup", "file": "controller/prefill_group.go", "line": 51 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/prefill_group/", "operation": { "summary": "更新预填分组", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "分组" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "DELETE", "path": "/api/prefill_group/:id", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()" ], "handlers": [ "controller.DeletePrefillGroup" ], "file": "router/api-router.go", "line": 359, "source_kind": "static", "id": "GATEWAY-081", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "删除预填分组", "auth_requirement": "Admin 员工身份", "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [ { "name": "id", "in": "path", "source": "controller literal access" } ], "body_types": [], "observed_literal_keys": [], "handler_sources": [ { "symbol": "controller.DeletePrefillGroup", "file": "controller/prefill_group.go", "line": 78 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": true }, "openapi": { "file": "api.json", "path": "/api/prefill_group/{id}", "operation": { "summary": "删除预填分组", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "分组" ], "parameters": [ { "name": "id", "in": "path", "description": "", "required": true, "example": 0, "schema": { "type": "integer" } } ], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/ratio_sync/channels", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.GetSyncableChannels" ], "file": "router/api-router.go", "line": 248, "source_kind": "static", "id": "GATEWAY-082", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取可同步渠道", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "data", "message", "success" ], "handler_sources": [ { "symbol": "controller.GetSyncableChannels", "file": "controller/ratio_sync.go", "line": 1107 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/ratio_sync/channels", "operation": { "summary": "获取可同步渠道", "deprecated": false, "description": "👑 需要超级管理员权限（Root）", "tags": [ "系统设置" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "POST", "path": "/api/ratio_sync/fetch", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.RootAuth()" ], "handlers": [ "controller.FetchUpstreamRatios" ], "file": "router/api-router.go", "line": 249, "source_kind": "static", "id": "GATEWAY-083", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "获取上游倍率", "auth_requirement": "Root 管理身份", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [ { "status": "200", "description": "成功", "content": {} } ], "source_observations": { "inline_request_fields": [ { "name": "success", "go_type": "bool", "variable": "body", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "data", "go_type": "json.RawMessage", "variable": "body", "required_tag": false, "source": "anonymous controller request struct" }, { "name": "message", "go_type": "string", "variable": "body", "required_tag": false, "source": "anonymous controller request struct" } ], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [ { "type": "dto.UpstreamRequest", "file": "relaykit/dto/ratio_sync.go", "line": 10, "source": "UpstreamRequest struct {\n\tChannelIDs []int64 `json:\"channel_ids\"`\n\tUpstreams []UpstreamDTO `json:\"upstreams\"`\n\tTimeout int `json:\"timeout\"`\n}" } ], "observed_literal_keys": [ "data", "differences", "message", "prices", "success", "test_results" ], "handler_sources": [ { "symbol": "controller.FetchUpstreamRatios", "file": "controller/ratio_sync.go", "line": 211 } ], "source_behavior_markers": [], "uses_api_success": false, "uses_api_error": false }, "openapi": { "file": "api.json", "path": "/api/ratio_sync/fetch", "operation": { "summary": "获取上游倍率", "deprecated": false, "description": "👑 需要超级管理员权限（Root）", "tags": [ "系统设置" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "沿用原行为，不擅自要求所有旧接口新增 Idempotency-Key；创建/财务动作必须定义重复点击和响应丢失结果，客户端不得无条件自动重试。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "RESPONSE-SCHEMA-MISSING：上游响应未定义结构；以处理器和兼容用例补齐" ], "runtime_verified": false, "override": null }, { "method": "GET", "path": "/api/task_plugin_options", "middleware": [ "middleware.RouteTag(\"api\")", "gzip.Gzip(gzip.DefaultCompression)", "middleware.AccessTokenAudit()", "middleware.BodyStorageCleanup()", "middleware.GlobalAPIRateLimit()", "middleware.AdminAuth()", "middleware.RequirePermission(authz.TaskPluginBind)" ], "handlers": [ "controller.GetTaskPluginOptions" ], "file": "router/api-router.go", "line": 268, "source_kind": "static", "id": "GATEWAY-084", "group": "gateway-only", "owner": "供应网关", "phase": "网关维护", "disposition": "留在供应网关", "summary": "GetTaskPluginOptions", "auth_requirement": "Admin 员工身份；authz.TaskPluginBind", "parameters": [], "request_fields": [], "request_formats": [], "response_contracts": [], "source_observations": { "inline_request_fields": [], "requires_browser_session": false, "security_proof_scopes": [], "parameters": [], "body_types": [], "observed_literal_keys": [ "baseUrl", "channelTypes", "description", "hasIcon", "icon", "key", "models", "name", "sortPriority", "usageProfiles", "usageSchema", "website" ], "handler_sources": [ { "symbol": "controller.GetTaskPluginOptions", "file": "controller/task_plugin.go", "line": 634 } ], "source_behavior_markers": [], "uses_api_success": true, "uses_api_error": false }, "openapi": null, "requirements": { "business": "只在独立供应网关提供；不加入 OceanWay 客户公开 API。网关内部员工/服务身份和敏感权限沿用，Core/Edge 不直接改网关数据库；需要运营入口时只做受控链接或服务适配。", "retry": "读取可有界重试，不新建调用或扣款；结果为空、权限失败与查询未知分开。", "errors": "保留原 HTTP 状态、业务 success/message 或模型 error 包络，不将所有失败改成同一状态。区分参数、身份、权限、余额、限流、上游与执行未知；敏感栈和供应凭据不返回客户。", "acceptance": "成功与空态；缺失/非法字段；未登录/跨账户/无权限；限流；资源不存在；重试与状态冲突；数据库提交后响应丢失（写操作）；返回字段与既有协议兼容。" }, "gaps": [ "OPENAPI-MISSING：源码已注册，上游 OpenAPI 无匹配操作" ], "runtime_verified": false, "override": null } ], "openapi_only_interfaces": [ { "method": "GET", "file": "api.json", "path": "/api/oauth/github", "operation": { "summary": "GitHub OAuth登录", "deprecated": false, "description": "🔓 无需鉴权（OAuth 回调）。创建本地登录 Session 时同样受 AUTH_SESSION_LIMIT 和 AUTH_SESSION_ISSUANCE_LIMIT 约束。", "tags": [ "OAuth" ], "parameters": [ { "name": "code", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "$ref": "#/components/responses/AuthSessionLimit" }, "429": { "$ref": "#/components/responses/AuthSessionIssuanceLimit" } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, { "method": "GET", "file": "api.json", "path": "/api/oauth/discord", "operation": { "summary": "Discord OAuth登录", "deprecated": false, "description": "🔓 无需鉴权（OAuth 回调）。创建本地登录 Session 时同样受 AUTH_SESSION_LIMIT 和 AUTH_SESSION_ISSUANCE_LIMIT 约束。", "tags": [ "OAuth" ], "parameters": [ { "name": "code", "in": "query", "description": "", "required": false, "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "$ref": "#/components/responses/AuthSessionLimit" }, "429": { "$ref": "#/components/responses/AuthSessionIssuanceLimit" } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, { "method": "GET", "file": "api.json", "path": "/api/oauth/oidc", "operation": { "summary": "OIDC登录", "deprecated": false, "description": "🔓 无需鉴权（OAuth 回调）。创建本地登录 Session 时同样受 AUTH_SESSION_LIMIT 和 AUTH_SESSION_ISSUANCE_LIMIT 约束。", "tags": [ "OAuth" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "$ref": "#/components/responses/AuthSessionLimit" }, "429": { "$ref": "#/components/responses/AuthSessionIssuanceLimit" } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, { "method": "GET", "file": "api.json", "path": "/api/oauth/linuxdo", "operation": { "summary": "LinuxDO OAuth登录", "deprecated": false, "description": "🔓 无需鉴权（OAuth 回调）。创建本地登录 Session 时同样受 AUTH_SESSION_LIMIT 和 AUTH_SESSION_ISSUANCE_LIMIT 约束。", "tags": [ "OAuth" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} }, "409": { "$ref": "#/components/responses/AuthSessionLimit" }, "429": { "$ref": "#/components/responses/AuthSessionIssuanceLimit" } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, { "method": "GET", "file": "api.json", "path": "/api/verify/status", "operation": { "summary": "获取验证状态", "deprecated": false, "description": "🔐 需要登录（User权限）", "tags": [ "安全验证" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, { "method": "GET", "file": "api.json", "path": "/api/task/", "operation": { "summary": "获取所有任务", "deprecated": false, "description": "👨‍💼 需要管理员权限（Admin）", "tags": [ "任务" ], "parameters": [], "responses": { "200": { "description": "成功", "headers": {} } }, "security": [ { "Combination343": [] }, { "Combination1243": [] } ] }, "path_parameters": [] }, { "method": "POST", "file": "relay.json", "path": "/kling/v1/videos/text2video", "operation": { "summary": "Kling 文生视频", "deprecated": false, "description": "使用 Kling 模型从文本描述生成视频。\n\n支持的模型：kling-v1, kling-v1-5 等\n", "operationId": "createKlingText2Video", "tags": [ "视频生成/Kling格式" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoRequest" }, "example": { "model": "kling-v1", "prompt": "宇航员站起身走了", "duration": 5, "width": 1280, "height": 720, "fps": 30 } } } }, "responses": { "200": { "description": "成功创建视频生成任务", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoResponse" } } }, "headers": {} }, "400": { "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, { "method": "GET", "file": "relay.json", "path": "/kling/v1/videos/text2video/{task_id}", "operation": { "summary": "获取 Kling 文生视频任务状态", "deprecated": false, "description": "查询 Kling 文生视频任务的状态和结果。", "operationId": "getKlingText2Video", "tags": [ "视频生成/Kling格式" ], "parameters": [ { "name": "task_id", "in": "path", "description": "任务 ID", "required": true, "example": "task-abc123", "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功获取任务状态", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoTaskResponse" } } }, "headers": {} }, "404": { "description": "任务不存在", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, { "method": "POST", "file": "relay.json", "path": "/kling/v1/videos/image2video", "operation": { "summary": "Kling 图生视频", "deprecated": false, "description": "使用 Kling 模型从图片生成视频。\n\n支持通过 image 参数传入图片 URL 或 Base64 编码的图片数据。\n", "operationId": "createKlingImage2Video", "tags": [ "视频生成/Kling格式" ], "parameters": [], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoRequest" }, "example": { "model": "kling-v1", "prompt": "人物转身走开", "image": "https://example.com/image.jpg", "duration": 5, "width": 1280, "height": 720 } } } }, "responses": { "200": { "description": "成功创建视频生成任务", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoResponse" } } }, "headers": {} }, "400": { "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, { "method": "GET", "file": "relay.json", "path": "/kling/v1/videos/image2video/{task_id}", "operation": { "summary": "获取 Kling 图生视频任务状态", "deprecated": false, "description": "查询 Kling 图生视频任务的状态和结果。", "operationId": "getKlingImage2Video", "tags": [ "视频生成/Kling格式" ], "parameters": [ { "name": "task_id", "in": "path", "description": "任务 ID", "required": true, "example": "task-abc123", "schema": { "type": "string" } } ], "responses": { "200": { "description": "成功获取任务状态", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/VideoTaskResponse" } } }, "headers": {} }, "404": { "description": "任务不存在", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, { "method": "POST", "file": "relay.json", "path": "/jimeng/", "operation": { "summary": "即梦视频生成", "deprecated": false, "description": "即梦官方 API 格式的视频生成接口。\n\n支持通过 Action 参数指定操作类型：\n- `CVSync2AsyncSubmitTask`: 提交视频生成任务\n- `CVSync2AsyncGetResult`: 获取任务结果\n\n需要在查询参数中指定 Action 和 Version。\n", "operationId": "createJimengVideo", "tags": [ "视频生成/即梦格式" ], "parameters": [ { "name": "Action", "in": "query", "description": "API 操作类型", "required": true, "schema": { "type": "string", "enum": [ "CVSync2AsyncSubmitTask", "CVSync2AsyncGetResult" ] } }, { "name": "Version", "in": "query", "description": "API 版本", "required": true, "example": "2022-08-31", "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "description": "即梦官方 API 请求格式", "properties": { "req_key": { "type": "string", "description": "请求类型标识" }, "prompt": { "type": "string", "description": "文本描述" }, "binary_data_base64": { "type": "array", "items": { "type": "string" }, "description": "Base64 编码的图片数据" } } }, "example": { "req_key": "jimeng_video_generation", "prompt": "一只猫在弹钢琴" } } } }, "responses": { "200": { "description": "成功处理请求", "content": { "application/json": { "schema": { "type": "object", "properties": { "code": { "type": "integer", "description": "响应码" }, "message": { "type": "string", "description": "响应消息" }, "data": { "type": "object", "description": "响应数据", "properties": {} } } } } }, "headers": {} }, "400": { "description": "请求参数错误", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ErrorResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] }, { "method": "POST", "file": "relay.json", "path": "/v1beta/models/{model}:generateContent", "operation": { "summary": "Gemini 图片(Nano Banana)", "deprecated": false, "description": "Gemini 图片生成", "operationId": "geminiRelayV1Beta", "tags": [ "Gemini格式" ], "parameters": [ { "name": "model", "in": "path", "description": "模型名称", "required": true, "example": "gemini-3-pro-image-preview", "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "type": "object", "properties": { "contents": { "type": "array", "items": { "type": "object", "properties": { "role": { "type": "string" }, "parts": { "type": "array", "items": { "type": "object", "properties": { "text": { "type": "string" } } } } } } }, "generationConfig": { "type": "object", "properties": { "responseModalities": { "type": "array", "items": { "type": "string" } }, "imageConfig": { "type": "object", "properties": { "aspectRatio": { "type": "string" }, "imageSize": { "type": "string" } } } }, "required": [ "responseModalities" ] } }, "required": [ "contents", "generationConfig" ] }, "example": { "contents": [ { "role": "user", "parts": [ { "text": "draw a cat" } ] } ], "generationConfig": { "responseModalities": [ "TEXT", "IMAGE" ], "imageConfig": { "aspectRatio": "16:9", "imageSize": "4K" } } } } } }, "responses": { "200": { "description": "成功", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/GeminiResponse" } } }, "headers": {} } }, "security": [ { "BearerAuth": [] } ] }, "path_parameters": [] } ], "new_proposals": [ { "id": "INT-01", "method": "POST", "path": "/internal/v1/operations/admit", "owner": "Core", "identity": "Edge/受控产品服务", "request_requirements": "credential 或 Core 可验证委托身份；request_id、idempotency_key、request_digest、model、protocol、usage_limit", "response_requirements": "operation_id、reservation_id、price_version、授权限制、执行许可与过期时间", "business_requirement": "Core 原子校验客户/Key/模型/预算，保存操作和额度预留；同键同摘要返回原操作，异摘要冲突。无可估上界先报价或拒绝，不凭 client account_id 扣款。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-02", "method": "GET", "path": "/internal/v1/operations/:id", "owner": "Core", "identity": "Edge/Worker", "request_requirements": "Path id；服务身份与操作权限", "response_requirements": "执行状态、账务状态、价格依据、reservation、上游关联、结算结果与更新时间", "business_requirement": "读取 Core 持久事实；受理响应丢失后优先查询，不重新执行。仅所属服务/获授权产品可读。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-03", "method": "POST", "path": "/internal/v1/operations/:id/usage", "owner": "Core", "identity": "Edge/Worker", "request_requirements": "attempt_id、event_id、gateway_request_id、计量单位与数值、final 标记、证据摘要、结束原因", "response_requirements": "接收/已存在/冲突、用量版本、是否可结算", "business_requirement": "同事件去重，完整性和可信来源校验；中间量不能冒充最终量，超时无用量标待核对。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-04", "method": "POST", "path": "/internal/v1/operations/:id/settle", "owner": "Core", "identity": "Edge/Worker", "request_requirements": "settlement_key、最终用量版本/摘要、attempt_id；不接受任意客户端金额", "response_requirements": "settlement_id、已扣积分、释放预留、ledger_ref、原结果或冲突", "business_requirement": "按价格快照在 Core 事务中一次结算；重复调用返回同结果，缺失用量或冲突不得默认为免费。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-05", "method": "POST", "path": "/internal/v1/operations/:id/release", "owner": "Core", "identity": "Worker/受控协调服务", "request_requirements": "release_key、原因、未执行/不计费证据与尝试状态", "response_requirements": "已释放/已结算/待核对、ledger_ref", "business_requirement": "仅确认释放条件后执行；断流、超时或租约过期不自动证明未执行。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-06", "method": "POST", "path": "/internal/v1/operations/:id/attempts", "owner": "Core", "identity": "执行服务", "request_requirements": "attempt_id、gateway 标识、上游请求/任务 ID、提交状态、版本", "response_requirements": "已关联/已存在/冲突及最新版本", "business_requirement": "记录确定执行关联；禁止覆盖已完成尝试，结果未知禁止无依据新增重复供应尝试。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-07", "method": "POST", "path": "/internal/v1/tasks", "owner": "Core", "identity": "受控产品服务/Edge", "request_requirements": "受托客户上下文、幂等键、model/plugin、输入引用、产品关联、usage_limit", "response_requirements": "task_id、operation_id、reservation_id、受理状态", "business_requirement": "授权/预留/持久待执行记录原子受理；产品 Workflow 不直接写 Core 库。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-08", "method": "GET", "path": "/internal/v1/tasks/:id", "owner": "Core", "identity": "受控产品服务/Edge", "request_requirements": "Path id；调用身份", "response_requirements": "task/operation 状态、结果引用、费用状态、错误、cancel 状态", "business_requirement": "返回经过归属过滤的任务；隐藏供应密钥及任意内部 URL。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-09", "method": "POST", "path": "/internal/v1/tasks/:id/cancel", "owner": "Core", "identity": "受控产品服务/Edge", "request_requirements": "cancel_key、原因、预期任务版本", "response_requirements": "cancel_requested/confirmed/unsupported/finished，账务状态", "business_requirement": "取消意图与供应确认分开；已产生费用不伪装全额退款，重复取消不重复调用。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "INT-10", "method": "GET", "path": "/internal/v1/access/keys/:id", "owner": "Core", "identity": "Edge 服务", "request_requirements": "Path 非秘密标识；服务身份", "response_requirements": "最小有效状态、客户关联、模型范围、有效期、撤销版本", "business_requirement": "只作为需要时的鉴权缓存能力；不得把可取回完整 Key 的客户接口直接开放为服务批量导出。认证方案若直接由 INT-01 校验，可不启用本接口。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-01", "method": "GET", "path": "/api/oceanway/pricing/self", "owner": "Core", "identity": "客户", "request_requirements": "无可伪造 owner；可选 model", "response_requirements": "生效价格方案、模型计量单价、单位、版本、区间", "business_requirement": "完整展示客户实际价；上游 /api/pricing 无法表达时才补，不泄漏其他客户协议价。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-02", "method": "GET", "path": "/api/oceanway/admin/pricing/accounts/:id", "owner": "Core", "identity": "员工价格权限", "request_requirements": "Path 客户 id", "response_requirements": "当前方案与协议价、生效区间、版本", "business_requirement": "员工限定权限；普通客户不可用。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-03", "method": "PUT", "path": "/api/oceanway/admin/pricing/accounts/:id", "owner": "Core", "identity": "员工价格写权限", "request_requirements": "expected_version、方案引用、模型/计量维度协议价、生效时间、原因", "response_requirements": "新价格版本、审计引用、冲突", "business_requirement": "金额精度、非负、目录存在与有效期检查；不改已开始调用价格，不覆盖并发修改。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-04", "method": "GET", "path": "/api/oceanway/wallet/ledger", "owner": "Core", "identity": "客户", "request_requirements": "p/page_size、起止时间、流水类型、operation_id/order_id", "response_requirements": "流水、入账/扣减/释放、积分单位与关联", "business_requirement": "客户唯一账户过滤；区分实付、赠送、预留与消费，不将 Redis 余额作账单事实。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-05", "method": "GET", "path": "/api/oceanway/operations/:id", "owner": "Core", "identity": "客户", "request_requirements": "Path id", "response_requirements": "本人调用的执行/用量/费用状态和安全错误", "business_requirement": "补充统一调用追踪，禁止枚举他人操作。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-06", "method": "POST", "path": "/api/oceanway/admin/reconciliations/:id/resolve", "owner": "Core", "identity": "员工财务处理权限", "request_requirements": "action、amount/usage_evidence、reason、idempotency_key、expected_version", "response_requirements": "处理记录、账务引用或冲突", "business_requirement": "仅在人工财务范围确定后启用；补扣/退款新增关联流水，不原地篡改原账。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-07", "method": "POST", "path": "/api/oceanway/auth/handoff", "owner": "Core", "identity": "已完成全局认证的用户（含员工；目标权限另校验）", "request_requirements": "已登记 target、state、return_path", "response_requirements": "短期单次 code、失效时间", "business_requirement": "AUTH-G01 已确认：任一平台登录后全平台识别同一身份；此端点为交接实现提案。目标与回调白名单，不在 URL 放长期令牌。", "status": "proposed_not_upstream", "runtime_verified": false }, { "id": "OW-08", "method": "POST", "path": "/internal/v1/auth/handoff/exchange", "owner": "Core", "identity": "目标子站服务", "request_requirements": "code、target、state、服务身份", "response_requirements": "授权用户与可建子站会话的结果", "business_requirement": "code 绑定目标、短时、单次，重放/错目标拒绝；不是把 new-api OAuth 客户端当授权服务器。", "status": "proposed_not_upstream", "runtime_verified": false } ], "scope": "Core and API Edge upstream API requirements; gateway-only management retained as exclusion list; product-specific CRUD not claimed complete", "completeness": "Route enumeration complete for listed fixed entrypoints; many inherited field schemas incomplete, tracked per endpoint; this is not an approved production contract" }