AskaEth
c7ecc3a249
design/22 §8-1（主人 2026-10-03 拍板）：会话角色在创建时确定、之后不可变，
要换角色必须新开会话。
后端：
- PATCH /api/v1/sessions/{id} 的 personaId 改为 json.RawMessage 判「键出现」，
出现即 400（null/""/未知 id 一律拒），且先于会话存在性检查；错误消息点名 personaId
- 删除 Server.setSessionPersona 与 PATCH 的 501 分支；title/pinned 行为逐字不变
- sessionPersonaWriter 接口与 history.Store.SetSessionPersona 保留（存储能力）
前端：
- 移除会话行「切换角色」入口与面板「挂角色」下拉（含 setSessionPersona action、
lib/sessionPersona.ts）；保留「新建会话选角色」；面板「角色」列改为只读展示
契约：Docs/api-client.md -> v0.46（破坏性：依赖 PATCH 换角色的客户端须改为新建会话）
验证：go build/vet ./... 绿；gateway+history 包测试绿（-count=1）；前端 npm run build
（tsc --noEmit + vite build）绿；9 个前端逻辑测试全绿。
变异验证：改回「静默忽略」/「写绑定」两种反向实现，新断言均 FAIL。
233 lines
10 KiB
Go
233 lines
10 KiB
Go
package gateway
|
||
|
||
import (
|
||
"context"
|
||
"encoding/json"
|
||
"errors"
|
||
"net/http"
|
||
"strings"
|
||
"unicode/utf8"
|
||
|
||
apperr "git.yeij.top/AskaEth/Cyrene_v2/internal/errors"
|
||
"git.yeij.top/AskaEth/Cyrene_v2/internal/runtime/history"
|
||
)
|
||
|
||
// This file owns the session/message write endpoints added for the Android
|
||
// collaboration batch ③a: PATCH /sessions/{id} (A4 rename + D5 pin), PATCH
|
||
// /messages/{id} (D3 edit) and DELETE /messages/{id} (D3 delete). All are owner/admin
|
||
// history writes; the reads and DTOs live in history.go. The D3 edit/delete paths also
|
||
// broadcast their outcome over the WS hub (message_edited / message_deleted, see
|
||
// ws_hub.go) so the account's other browsers stay in sync without a manual re-read.
|
||
|
||
// patchSessionRequest is the PATCH /api/v1/sessions/{id} body. Both fields are
|
||
// pointers so an absent field is distinguishable from an explicit zero value:
|
||
// title renames the session (A4), pinned sets/unets the pin (D5), and at least one
|
||
// must be present.
|
||
//
|
||
// personaId is deliberately NOT a settable field: a session's role is fixed when the
|
||
// session is created (design/22 §8-1), so the key is rejected outright instead of
|
||
// being ignored. It stays in the struct as the raw JSON so the handler can tell
|
||
// "the key is absent" from "the key is present with any value" — `"yuki"`, `""` and
|
||
// `null` are all refused, and only a body without the key is accepted.
|
||
type patchSessionRequest struct {
|
||
Title *string `json:"title"`
|
||
Pinned *bool `json:"pinned"`
|
||
PersonaID json.RawMessage `json:"personaId"`
|
||
}
|
||
|
||
// maxSessionTitleRunes bounds a client-supplied session title so a display row never
|
||
// overflows. It is a display-only bound: identity and permissions never derive from
|
||
// the title (project red line).
|
||
const maxSessionTitleRunes = 80
|
||
|
||
// handlePatchSession updates a persistent session's display metadata — its title
|
||
// (A4) and its pinned flag (D5). Both are metadata: unlike DELETE they are allowed
|
||
// on the fixed main session. A request carrying neither field answers 400, as do an
|
||
// empty/whitespace or over-long title and an unknown session id (404/500 as usual).
|
||
//
|
||
// A body carrying the personaId key answers 400 for EVERY value, and that check runs
|
||
// before the session is looked up: a session's role is fixed at creation (design/22
|
||
// §8-1), so switching the role of an existing conversation — including clearing it —
|
||
// is not a supported operation; create a new session instead. Refusing explicitly
|
||
// (rather than ignoring the key) is what keeps a client from believing a rebind
|
||
// landed. It is owner/admin-gated like the other history writes. The response echoes
|
||
// only the fields that were changed, so a title-only PATCH keeps its pre-D5
|
||
// {id,title} shape.
|
||
func (s *Server) handlePatchSession(w http.ResponseWriter, r *http.Request) {
|
||
if s.history == nil {
|
||
writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
|
||
return
|
||
}
|
||
id := r.PathValue("id")
|
||
if id == "" {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "session id is required"))
|
||
return
|
||
}
|
||
var req patchSessionRequest
|
||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
|
||
return
|
||
}
|
||
if req.PersonaID != nil {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request",
|
||
"personaId cannot be changed: 会话角色在创建时确定，之后不可变，要换角色请新开会话 (design/22 §8-1)"))
|
||
return
|
||
}
|
||
if req.Title == nil && req.Pinned == nil {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title or pinned is required"))
|
||
return
|
||
}
|
||
resp := map[string]any{"id": id}
|
||
if req.Title != nil {
|
||
title := strings.TrimSpace(*req.Title)
|
||
if title == "" {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is required"))
|
||
return
|
||
}
|
||
if utf8.RuneCountInString(title) > maxSessionTitleRunes {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "title is too long (max 80 characters)"))
|
||
return
|
||
}
|
||
if err := s.history.RenameSession(r.Context(), id, title); err != nil {
|
||
s.writeSessionPatchError(w, err, id, "rename session")
|
||
return
|
||
}
|
||
resp["title"] = title
|
||
}
|
||
if req.Pinned != nil {
|
||
if err := s.history.SetPinned(r.Context(), id, *req.Pinned); err != nil {
|
||
s.writeSessionPatchError(w, err, id, "pin session")
|
||
return
|
||
}
|
||
resp["pinned"] = *req.Pinned
|
||
}
|
||
writeJSON(w, http.StatusOK, resp)
|
||
}
|
||
|
||
// writeSessionPatchError maps a RenameSession/SetPinned failure to its response:
|
||
// ErrSessionNotFound → 404, anything else → 500 (logged under op).
|
||
func (s *Server) writeSessionPatchError(w http.ResponseWriter, err error, id, op string) {
|
||
if errors.Is(err, history.ErrSessionNotFound) {
|
||
writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "session %q not found", id))
|
||
return
|
||
}
|
||
s.log.Error(op, "err", err, "session", id)
|
||
writeError(w, apperr.Wrap(apperr.ErrInternal, "session_failed", "failed to update session"))
|
||
}
|
||
|
||
// patchMessageRequest is the PATCH /api/v1/messages/{id} body. Content is a pointer so
|
||
// an absent field is rejected rather than treated as an empty edit.
|
||
type patchMessageRequest struct {
|
||
Content *string `json:"content"`
|
||
}
|
||
|
||
// maxMessageContentRunes bounds an edited message body. It is a storage/display bound
|
||
// on the edit path only; inbound chat messages are not subject to it.
|
||
const maxMessageContentRunes = 4000
|
||
|
||
// handlePatchMessage edits a single message's content (Android collaboration batch ③a,
|
||
// D3). Only content changes — role/timestamp/platform stay as stored — and the response
|
||
// returns the updated message so the client can upsert it by id without a re-read. An
|
||
// empty/whitespace or over-long content answers 400, an unknown id answers 404, and a
|
||
// missing HistoryStore answers 501. It is owner/admin-gated.
|
||
func (s *Server) handlePatchMessage(w http.ResponseWriter, r *http.Request) {
|
||
if s.history == nil {
|
||
writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
|
||
return
|
||
}
|
||
id := r.PathValue("id")
|
||
if id == "" {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
|
||
return
|
||
}
|
||
var req patchMessageRequest
|
||
if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "invalid request body"))
|
||
return
|
||
}
|
||
if req.Content == nil {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
|
||
return
|
||
}
|
||
content := *req.Content
|
||
if strings.TrimSpace(content) == "" {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is required"))
|
||
return
|
||
}
|
||
if utf8.RuneCountInString(content) > maxMessageContentRunes {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "content is too long (max 4000 characters)"))
|
||
return
|
||
}
|
||
msg, err := s.history.UpdateMessage(r.Context(), id, content)
|
||
if err != nil {
|
||
if errors.Is(err, history.ErrMessageNotFound) {
|
||
writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
|
||
return
|
||
}
|
||
s.log.Error("history update message", "err", err, "message", id)
|
||
writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to update message"))
|
||
return
|
||
}
|
||
// Broadcast the edit so every other browser of the account re-renders the same
|
||
// bubble without a refresh (the message_persisted realtime-sync contract, D3 edit
|
||
// path). Thinking is stripped from the frame to match the persisted/replay
|
||
// contract; the REST reply keeps it because the messages routes are owner/admin-only.
|
||
edited := toHistoryMessage(msg)
|
||
edited.Thinking = ""
|
||
s.hub.broadcastMessageEdited(edited)
|
||
writeJSON(w, http.StatusOK, toHistoryMessage(msg))
|
||
}
|
||
|
||
// handleDeleteMessage removes a single message (D3). An unknown id answers 404, a
|
||
// missing HistoryStore 501. It is owner/admin-gated. A successful delete is
|
||
// broadcast as a `message_deleted` frame so every browser of the account drops the
|
||
// row without a refresh; the owning session is read before the row disappears.
|
||
func (s *Server) handleDeleteMessage(w http.ResponseWriter, r *http.Request) {
|
||
if s.history == nil {
|
||
writeError(w, &apperr.AppError{Code: "not_implemented", Message: "会话历史服务未配置（未注入 HistoryStore）", HTTPCode: http.StatusNotImplemented})
|
||
return
|
||
}
|
||
id := r.PathValue("id")
|
||
if id == "" {
|
||
writeError(w, apperr.Wrap(apperr.ErrBadRequest, "bad_request", "message id is required"))
|
||
return
|
||
}
|
||
sessionID := s.messageSession(r.Context(), id)
|
||
if err := s.history.DeleteMessage(r.Context(), id); err != nil {
|
||
if errors.Is(err, history.ErrMessageNotFound) {
|
||
writeError(w, apperr.Wrap(apperr.ErrNotFound, "not_found", "message %q not found", id))
|
||
return
|
||
}
|
||
s.log.Error("history delete message", "err", err, "message", id)
|
||
writeError(w, apperr.Wrap(apperr.ErrInternal, "message_failed", "failed to delete message"))
|
||
return
|
||
}
|
||
s.hub.broadcastMessageDeleted(sessionID, id)
|
||
writeJSON(w, http.StatusOK, map[string]any{"deleted": id})
|
||
}
|
||
|
||
// messageLookup is the optional narrower view of HistoryStore used by DELETE to learn
|
||
// a message's owning session before it is removed (afterwards there is nothing left to
|
||
// ask). *history.Store implements it; a store that does not simply yields an unscoped
|
||
// frame, which the client resolves by the globally unique message id.
|
||
type messageLookup interface {
|
||
GetMessage(ctx context.Context, id string) (history.Message, error)
|
||
}
|
||
|
||
// messageSession returns the session id owning message id, or "" when the store cannot
|
||
// answer (no lookup surface, unknown id, or a read error). A blank session is safe for
|
||
// the broadcast: the message id is globally unique, so a client that falls back to an
|
||
// id-only filter can only ever touch that message's own conversation.
|
||
func (s *Server) messageSession(ctx context.Context, id string) string {
|
||
lookup, ok := s.history.(messageLookup)
|
||
if !ok {
|
||
return ""
|
||
}
|
||
msg, err := lookup.GetMessage(ctx, id)
|
||
if err != nil {
|
||
s.log.Debug("history message session lookup", "err", err, "message", id)
|
||
return ""
|
||
}
|
||
return msg.SessionID
|
||
}
|