Files
Agent-System/internal/server/chat_turn_api.go
T
weichenandCursor d2903a1662 fix(server): enforce principal identity and docgov project access (H1-H3)
- H1: log legacy test-principal fallback (path/method/remote_addr) via
  slog.Warn so silent unauthenticated access is observable
- H2: AddComment/Claim now derive actor ID/Name/Role from the auth
  principal and server-side doc duty resolution (resolveDocGovRole),
  never from request body; GetDocument/ListComments/ListAuditLogs now
  require project membership via requireDocGovDocAccess
- H3: handleGetChatTurn asserts session ownership; handleListChatSessions
  and handleGetUserContext reject cross-user user_id (403) and stop
  defaulting to user id=1

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-09-19 05:33:38 +00:00

55 lines
1.4 KiB
Go

package server
import (
"encoding/json"
"errors"
"net/http"
"chat-agent-system/internal/ctxmgr"
)
// handleGetChatTurn 查询回合状态(断线续接)
func (s *Server) handleGetChatTurn(w http.ResponseWriter, r *http.Request) {
user, ok := s.requirePrincipal(w, r)
if !ok {
return
}
clientTurnID := r.PathValue("client_turn_id")
sessionID := r.URL.Query().Get("session_id")
if clientTurnID == "" || sessionID == "" {
writeSafeError(w, r, http.StatusBadRequest, "client_turn_id and session_id required")
return
}
ctxMgr := s.ctxMgr
if ctxMgr == nil {
writeSafeError(w, r, http.StatusServiceUnavailable, "context manager unavailable")
return
}
// 归属校验:只允许查询本人会话的回合状态
if !s.assertSessionOwnedByUser(w, r, sessionID, user.ID) {
return
}
rec, err := ctxMgr.GetChatTurn(r.Context(), sessionID, clientTurnID)
if errors.Is(err, ctxmgr.ErrChatTurnNotFound) {
writeSafeError(w, r, http.StatusNotFound, "turn not found")
return
}
if err != nil {
writeSafeError(w, r, http.StatusInternalServerError, err.Error())
return
}
w.Header().Set("Content-Type", "application/json")
_ = json.NewEncoder(w).Encode(map[string]any{
"session_id": rec.SessionID,
"client_turn_id": rec.ClientTurnID,
"status": rec.Status,
"user_message_id": rec.UserMessageID,
"assistant_message_id": rec.AssistantMessageID,
"attempt_count": rec.AttemptCount,
})
}