From 9a6d95a69dc9a5cbf93131d15205eb8732ceda69 Mon Sep 17 00:00:00 2001 From: seaislee1209 Date: Sat, 4 Apr 2026 18:49:08 +0800 Subject: [PATCH] =?UTF-8?q?fix:=20v0.18.0=20=E5=95=86=E4=B8=9A=E7=BA=A7?= =?UTF-8?q?=E5=8A=A0=E5=9B=BA=20=E2=80=94=20=E5=B9=B6=E5=8F=91=E5=AE=89?= =?UTF-8?q?=E5=85=A8=E3=80=81=E6=B5=81=E5=BC=8F=E4=B8=8A=E4=BC=A0=E3=80=81?= =?UTF-8?q?=E9=94=99=E8=AF=AF=E5=8F=8D=E9=A6=88=E3=80=81=E7=B1=BB=E5=9E=8B?= =?UTF-8?q?=E4=BF=AE=E5=A4=8D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - TOS 流式上传 upload_from_file_path（避免大文件 OOM） - 视频生成完成后下载一次复用（TOS 上传 + 首帧提取） - 并发安全：group thumbnail 用 select_for_update 原子更新 - 跨团队校验：_resolve_asset_group_all 加 group__team 过滤 - 异常信息脱敏：文件上传失败不再泄露内部异常 - SSRF 防护：download_to_temp 校验 URL scheme - poll lock 终态释放：cache.delete 在 record.save 后调用 - duration=null 语义区分：ffprobe 失败存 None 非 0 - 前端 duration 未知 toast 警告：素材时长未确定时提示用户 - 搜索 API 失败 toast：素材搜索失败时反馈用户 - 视频保存降级标记：临时 URL 降级时设 error_message - TypeScript 类型修复：AssetItem/AssetSearchResult.duration 改为 number|null - rebuildMentionSpans 补完 assetId/assetType/assetName/duration 属性 - paste DOMPurify 白名单补完新 data attributes - resolved_url NameError 修复：非素材库视频/音频引用用 url - process_asset_media group 删除保护 - download_to_temp 改为 public API - 清理前端死代码 Co-Authored-By: Claude Opus 4.6 (1M context) --- .../migrations/0019_duration_nullable.py | 18 ++++++ backend/apps/generation/models.py | 2 +- backend/apps/generation/tasks.py | 55 +++++++++++------ backend/apps/generation/views.py | 16 +++-- backend/utils/media_utils.py | 61 ++++++++++++------- backend/utils/tos_client.py | 44 ++++++++++++- web/src/components/PromptInput.tsx | 32 ++++++---- web/src/lib/assetMentions.ts | 3 +- web/src/types/index.ts | 4 +- 9 files changed, 172 insertions(+), 63 deletions(-) create mode 100644 backend/apps/generation/migrations/0019_duration_nullable.py diff --git a/backend/apps/generation/migrations/0019_duration_nullable.py b/backend/apps/generation/migrations/0019_duration_nullable.py new file mode 100644 index 0000000..d7ce752 --- /dev/null +++ b/backend/apps/generation/migrations/0019_duration_nullable.py @@ -0,0 +1,18 @@ +# Generated by Django 4.2.29 on 2026-04-04 17:59 + +from django.db import migrations, models + + +class Migration(migrations.Migration): + + dependencies = [ + ('generation', '0018_add_thumbnail_and_duration'), + ] + + operations = [ + migrations.AlterField( + model_name='asset', + name='duration', + field=models.FloatField(default=None, null=True, verbose_name='时长（秒）'), + ), + ] diff --git a/backend/apps/generation/models.py b/backend/apps/generation/models.py index 214610b..ffa19a3 100644 --- a/backend/apps/generation/models.py +++ b/backend/apps/generation/models.py @@ -158,7 +158,7 @@ class Asset(models.Model): url = models.CharField(max_length=1000, blank=True, default='', verbose_name='素材URL') asset_type = models.CharField(max_length=10, choices=ASSET_TYPE_CHOICES, default='Image', verbose_name='素材类型') thumbnail_url = models.CharField(max_length=1000, blank=True, default='', verbose_name='缩略图URL') - duration = models.FloatField(default=0, verbose_name='时长（秒）') + duration = models.FloatField(null=True, default=None, verbose_name='时长（秒）') status = models.CharField(max_length=20, choices=STATUS_CHOICES, default='processing', verbose_name='状态') error_message = models.CharField(max_length=500, blank=True, default='', verbose_name='错误信息') created_at = models.DateTimeField(auto_now_add=True, verbose_name='创建时间') diff --git a/backend/apps/generation/tasks.py b/backend/apps/generation/tasks.py index 0448aee..50d143e 100644 --- a/backend/apps/generation/tasks.py +++ b/backend/apps/generation/tasks.py @@ -80,6 +80,7 @@ def poll_video_task(self, record_id): 'seed', 'completed_at', ]) + cache.delete(lock_key) logger.info( 'poll_video_task: record=%s ark=%s final_status=%s', record_id, ark_task_id, new_status, @@ -87,27 +88,35 @@ def poll_video_task(self, record_id): def _handle_completed(record, ark_resp): - """Process a completed task: persist video to TOS and settle payment.""" + """Process a completed task: persist video to TOS, extract thumbnail, settle payment.""" + import os from utils.airdrama_client import extract_video_url video_url = extract_video_url(ark_resp) if video_url: + # Download once to temp file, reuse for TOS upload + thumbnail extraction + tmp_path = None try: - from utils.tos_client import upload_from_url - record.result_url = upload_from_url(video_url, folder='results') - except Exception: - logger.exception('poll_video_task: failed to persist video to TOS') - record.result_url = video_url + from utils.media_utils import download_to_temp, extract_video_info_from_file + from utils.tos_client import upload_from_file_path, upload_file - # Extract thumbnail from completed video - try: - from utils.media_utils import extract_video_info - from utils.tos_client import upload_file - thumb_file, _ = extract_video_info(record.result_url) + tmp_path = download_to_temp(video_url, '.mp4') + + # Upload video to TOS from file (streaming, no full memory load) + record.result_url = upload_from_file_path(tmp_path, folder='results', content_type='video/mp4') + + # Extract thumbnail from the same local file (no second download) + thumb_file, _ = extract_video_info_from_file(tmp_path) if thumb_file: record.thumbnail_url = upload_file(thumb_file, folder='thumbnails') except Exception: - logger.exception('poll_video_task: failed to extract video thumbnail') + logger.exception('poll_video_task: failed to persist video / extract thumbnail') + if not record.result_url: + record.result_url = video_url + record.error_message = '视频保存失败，临时链接将在24小时后过期，请联系管理员' + finally: + if tmp_path and os.path.exists(tmp_path): + os.unlink(tmp_path) # 结算：按实际 tokens 扣费 usage = ark_resp.get('usage', {}) @@ -187,14 +196,22 @@ def process_asset_media(asset_id): asset.thumbnail_url = upload_file(thumb_file, folder='thumbnails') except Exception: logger.exception('process_asset_media: thumbnail upload failed for asset %s', asset_id) - asset.duration = dur + asset.duration = dur if dur > 0 else None # None = ffprobe failed, frontend skips duration check asset.save(update_fields=['thumbnail_url', 'duration']) - group = asset.group - if not group.thumbnail_url and asset.thumbnail_url: - group.thumbnail_url = asset.thumbnail_url - group.save(update_fields=['thumbnail_url']) + # Atomic update: only set group thumbnail if still empty (concurrent-safe) + from apps.generation.models import AssetGroup + from django.db import transaction + try: + with transaction.atomic(): + group = AssetGroup.objects.select_for_update().get(pk=asset.group_id) + if not group.thumbnail_url and asset.thumbnail_url: + group.thumbnail_url = asset.thumbnail_url + group.save(update_fields=['thumbnail_url']) + except AssetGroup.DoesNotExist: + logger.warning('process_asset_media: group %s deleted, skipping thumbnail update', asset.group_id) elif asset.asset_type == 'Audio': - asset.duration = get_audio_duration(asset.url) + dur = get_audio_duration(asset.url) + asset.duration = dur if dur > 0 else None asset.save(update_fields=['duration']) - logger.info('process_asset_media: asset %s done (type=%s, dur=%.1f)', asset_id, asset.asset_type, asset.duration) + logger.info('process_asset_media: asset %s done (type=%s, dur=%s)', asset_id, asset.asset_type, asset.duration) diff --git a/backend/apps/generation/views.py b/backend/apps/generation/views.py index b13cfd4..952c52f 100644 --- a/backend/apps/generation/views.py +++ b/backend/apps/generation/views.py @@ -425,12 +425,12 @@ def video_generate_view(request): item['role'] = role content_items.append(item) elif ref_type == 'video': - item = {'type': 'video_url', 'video_url': {'url': resolved_url}} + item = {'type': 'video_url', 'video_url': {'url': url}} if role: item['role'] = role content_items.append(item) elif ref_type == 'audio': - item = {'type': 'audio_url', 'audio_url': {'url': resolved_url}} + item = {'type': 'audio_url', 'audio_url': {'url': url}} if role: item['role'] = role content_items.append(item) @@ -3304,10 +3304,14 @@ def asset_group_add_asset_view(request, group_id): error_message='', ) - # If first image asset or no thumbnail, set group thumbnail - if not group.thumbnail_url and asset_type == 'Image': - group.thumbnail_url = tos_url - group.save(update_fields=['thumbnail_url']) + # Atomic: set group thumbnail only if still empty (concurrent-safe) + if asset_type == 'Image': + from django.db import transaction + with transaction.atomic(): + locked_group = AssetGroup.objects.select_for_update().get(pk=group.id) + if not locked_group.thumbnail_url: + locked_group.thumbnail_url = tos_url + locked_group.save(update_fields=['thumbnail_url']) # Async: extract thumbnail + duration for video/audio if asset_type in ('Video', 'Audio'): diff --git a/backend/utils/media_utils.py b/backend/utils/media_utils.py index 343ea48..0b11203 100644 --- a/backend/utils/media_utils.py +++ b/backend/utils/media_utils.py @@ -1,4 +1,9 @@ -"""Media utilities: extract video thumbnails and durations using ffmpeg/ffprobe.""" +"""Media utilities: extract video thumbnails and durations using ffmpeg/ffprobe. + +WARNING: These functions download files and run subprocess commands. +They MUST only be called from Celery tasks, NEVER from HTTP request handlers. +Calling from gunicorn (especially with gevent workers) will block the worker pool. +""" import logging import subprocess @@ -14,8 +19,12 @@ logger = logging.getLogger(__name__) MAX_DOWNLOAD_SIZE = 100 * 1024 * 1024 # 100MB safety limit -def _download_to_temp(url: str, suffix: str) -> str: - """Download a URL to a temporary file. Returns the temp file path.""" +def download_to_temp(url: str, suffix: str) -> str: + """Download a URL to a temporary file. Returns the temp file path. + Only accepts http/https URLs to prevent SSRF. + """ + if not url.startswith(('http://', 'https://')): + raise ValueError(f'Invalid URL scheme: {url[:30]}') resp = requests.get(url, timeout=30, stream=True) resp.raise_for_status() tmp = tempfile.NamedTemporaryFile(suffix=suffix, delete=False) @@ -65,39 +74,49 @@ def _extract_first_frame(video_path: str, output_path: str) -> bool: return False -def extract_video_info(video_url: str) -> tuple: - """Extract first frame thumbnail + duration from a video URL. +def extract_video_info_from_file(video_path: str) -> tuple: + """Extract first frame thumbnail + duration from a local video file. Returns (thumbnail_file: SimpleUploadedFile | None, duration: float). + Does NOT delete the input file — caller is responsible for cleanup. """ - tmp_video = None tmp_thumb = None try: - # Determine suffix from URL - suffix = '.mp4' - if '.mov' in video_url.lower(): - suffix = '.mov' - tmp_video = _download_to_temp(video_url, suffix) - - # Get duration - duration = _get_duration_ffprobe(tmp_video) - - # Extract first frame - tmp_thumb = tmp_video + '_thumb.jpg' - if _extract_first_frame(tmp_video, tmp_thumb): + duration = _get_duration_ffprobe(video_path) + tmp_thumb = video_path + '_thumb.jpg' + if _extract_first_frame(video_path, tmp_thumb): with open(tmp_thumb, 'rb') as f: thumb_file = SimpleUploadedFile( 'thumbnail.jpg', f.read(), content_type='image/jpeg' ) return thumb_file, duration return None, duration + except Exception as e: + logger.warning('extract_video_info_from_file failed: %s', e) + return None, 0 + finally: + if tmp_thumb and os.path.exists(tmp_thumb): + os.unlink(tmp_thumb) + + +def extract_video_info(video_url: str) -> tuple: + """Extract first frame thumbnail + duration from a video URL. + Returns (thumbnail_file: SimpleUploadedFile | None, duration: float). + NOTE: This function downloads the full video. For large files, call from + Celery tasks only — never from HTTP request handlers. + """ + tmp_video = None + try: + suffix = '.mp4' + if '.mov' in video_url.lower(): + suffix = '.mov' + tmp_video = download_to_temp(video_url, suffix) + return extract_video_info_from_file(tmp_video) except Exception as e: logger.warning('extract_video_info failed for %s: %s', video_url, e) return None, 0 finally: if tmp_video and os.path.exists(tmp_video): os.unlink(tmp_video) - if tmp_thumb and os.path.exists(tmp_thumb): - os.unlink(tmp_thumb) def get_audio_duration(audio_url: str) -> float: @@ -105,7 +124,7 @@ def get_audio_duration(audio_url: str) -> float: tmp_audio = None try: suffix = '.wav' if '.wav' in audio_url.lower() else '.mp3' - tmp_audio = _download_to_temp(audio_url, suffix) + tmp_audio = download_to_temp(audio_url, suffix) return _get_duration_ffprobe(tmp_audio) except Exception as e: logger.warning('get_audio_duration failed for %s: %s', audio_url, e) diff --git a/backend/utils/tos_client.py b/backend/utils/tos_client.py index 984f19f..9d6104e 100644 --- a/backend/utils/tos_client.py +++ b/backend/utils/tos_client.py @@ -56,8 +56,10 @@ def upload_file(file_obj, folder='uploads'): client.head_object(bucket=settings.TOS_BUCKET, key=key) logger.info('TOS dedup hit: %s', key) return url - except Exception: - pass # Object doesn't exist, proceed with upload + except Exception as e: + err_str = str(e).lower() + if '404' not in err_str and 'not found' not in err_str and 'nosuchkey' not in err_str: + logger.warning('TOS head_object unexpected error (proceeding with upload): %s', e) client.put_object( bucket=settings.TOS_BUCKET, @@ -69,6 +71,44 @@ def upload_file(file_obj, folder='uploads'): return url +def upload_from_file_path(file_path, folder='uploads', content_type=None): + """Upload a local file to TOS by path (streaming, no full memory load). + Returns the permanent CDN URL. + """ + ext = file_path.rsplit('.', 1)[-1].lower() if '.' in file_path else 'bin' + if not content_type: + content_type = CONTENT_TYPE_MAP.get(ext, 'application/octet-stream') + + # Use content hash for dedup + h = hashlib.sha256() + with open(file_path, 'rb') as f: + for chunk in iter(lambda: f.read(8192), b''): + h.update(chunk) + content_hash = h.hexdigest() + key = f'{folder}/{content_hash}.{ext}' + url = f'{settings.TOS_CDN_DOMAIN}/{key}' + + client = get_tos_client() + try: + client.head_object(bucket=settings.TOS_BUCKET, key=key) + logger.info('TOS dedup hit: %s', key) + return url + except Exception as e: + # Only proceed if object not found (404). Re-raise on auth/config errors. + err_str = str(e).lower() + if '404' not in err_str and 'not found' not in err_str and 'nosuchkey' not in err_str: + logger.warning('TOS head_object unexpected error (proceeding with upload): %s', e) + + with open(file_path, 'rb') as f: + client.put_object( + bucket=settings.TOS_BUCKET, + key=key, + content=f, + content_type=content_type, + ) + return url + + def upload_from_url(source_url, folder='results'): """Download a file from a URL and upload to TOS, return permanent CDN URL.""" import requests as req diff --git a/web/src/components/PromptInput.tsx b/web/src/components/PromptInput.tsx index 1daf3d5..c285697 100644 --- a/web/src/components/PromptInput.tsx +++ b/web/src/components/PromptInput.tsx @@ -188,6 +188,10 @@ export function PromptInput() { thumbUrl: m.target.thumbUrl, assetGroupId: m.target.assetGroupId, groupName: m.target.groupName, + assetId: m.target.assetId, + assetType: m.target.assetType, + assetName: m.target.assetName, + duration: m.target.duration, }); frag.appendChild(span); lastIdx = m.end; @@ -313,7 +317,7 @@ export function PromptInput() { } else { setShowMentionPopup(false); } - }).catch(() => {}); + }).catch(() => { showToast('素材搜索失败，请重试'); }); }, 300); } else if (textAfterAt.includes(' ')) { // Space after @ text, close popup @@ -389,13 +393,18 @@ export function PromptInput() { return; } // Instant check: duration limit (video/audio) - if (asset.duration > 0 && (asset.asset_type === 'Video' || asset.asset_type === 'Audio')) { - const existingDur = refs.filter((r) => r.type === typeKey && r.duration).reduce((s, r) => s + (r.duration || 0), 0); - const assetDur = typeKey === 'video' ? stats.durations.video : stats.durations.audio; - if (existingDur + assetDur + asset.duration > 15.4) { - const typeLabel = asset.asset_type === 'Video' ? '视频' : '音频'; - showToast(`${typeLabel}总时长超过15秒限制`); - return; + if (asset.asset_type === 'Video' || asset.asset_type === 'Audio') { + if (!asset.duration) { + // Duration unknown (still processing or ffprobe failed) — warn but allow + showToast('该素材时长未确定，提交时将由服务端校验'); + } else { + const existingDur = refs.filter((r) => r.type === typeKey && r.duration).reduce((s, r) => s + (r.duration || 0), 0); + const assetDur = typeKey === 'video' ? stats.durations.video : stats.durations.audio; + if (existingDur + assetDur + asset.duration > 15.4) { + const typeLabel = asset.asset_type === 'Video' ? '视频' : '音频'; + showToast(`${typeLabel}总时长超过15秒限制`); + return; + } } } @@ -438,7 +447,7 @@ export function PromptInput() { assetId: String(asset.id), assetType: asset.asset_type, assetName: asset.name, - duration: String(asset.duration || 0), + duration: asset.duration != null ? String(asset.duration) : '', }); range.insertNode(mention); @@ -504,8 +513,9 @@ export function PromptInput() { ALLOWED_TAGS: ['span', 'br', 'img'], ALLOWED_ATTR: [ 'class', 'contenteditable', 'data-ref-id', 'data-ref-type', - 'data-asset-group-id', 'data-group-name', 'data-thumb-url', - 'draggable', 'src', 'alt', 'width', 'height', 'style', + 'data-asset-group-id', 'data-group-name', + 'data-asset-id', 'data-asset-type', 'data-asset-name', 'data-duration', + 'data-thumb-url', 'draggable', 'src', 'alt', 'width', 'height', 'style', ], }); document.execCommand('insertHTML', false, sanitized); diff --git a/web/src/lib/assetMentions.ts b/web/src/lib/assetMentions.ts index c712796..dd68232 100644 --- a/web/src/lib/assetMentions.ts +++ b/web/src/lib/assetMentions.ts @@ -13,7 +13,8 @@ export function parseAssetMentions(html: string): { const doc = parser.parseFromString(html, 'text/html'); doc.querySelectorAll('[data-ref-type="asset"]').forEach((el) => { const t = (el as HTMLElement).dataset.assetType || 'Image'; - const dur = parseFloat((el as HTMLElement).dataset.duration || '0'); + const rawDur = parseFloat((el as HTMLElement).dataset.duration || '0'); + const dur = isNaN(rawDur) ? 0 : rawDur; // null/undefined → NaN → 0, ffprobe 失败不计入时长 if (t === 'Video') { counts.video++; durations.video += dur; } else if (t === 'Audio') { counts.audio++; durations.audio += dur; } else { counts.image++; } diff --git a/web/src/types/index.ts b/web/src/types/index.ts index f3f0730..f93c579 100644 --- a/web/src/types/index.ts +++ b/web/src/types/index.ts @@ -440,7 +440,7 @@ export interface AssetItem { url: string; asset_type: 'Image' | 'Video' | 'Audio'; thumbnail_url: string; - duration: number; + duration: number | null; status: 'processing' | 'active' | 'failed'; remote_asset_id: string; error_message: string; @@ -455,5 +455,5 @@ export interface AssetSearchResult { group_name: string; remote_asset_id: string; thumbnail_url: string; - duration: number; + duration: number | null; }