sun
3b3aa3b708
VUL-003 修复期间意外发现项目遗留一批死代码,本次一并清掉:
- middleware/ratelimit_middleware.go(37 行,物理删除)
文件内 RateLimit / ConcurrencyLimit 函数从 977e9cc 创建后
从未被引用,370a217 commit 用 ratelimit_instrumented.go
(带 metrics 埋点 + 路径过滤)取代了它。占用包体,清。
- middleware/auth.go:InitAPIKeys(6 行)
注释说"已在 setting.InitAuthConfig 中完成",无 op。
- middleware/cors.go:InitCORSConfig(6 行)
同上,setting.InitCORSConfig 已做实际工作。
- dto/tts.go:ByteDanceTTSConfig 类型(7 行)
完整的配置走 setting.TTSOptions + adapter/volcano.Options,
此类型从未被任何代码实例化。
- setting/config.go: var _ = dto.ByteDanceTTSConfig{} 占位(3 行)
配合上方类型删除,移除 dto import。
- controller/tts.go:resolveClientFormat
合并 if reqFmt == "" 与 default 分支(都返回
setting.TTSOptions.Format),2 行简化。
- common/constants.go: MaxResponseTimes / MaxErrors
定义后从未被任何文件引用。
- middleware/ratelimit_instrumented.go 顶部注释
移除对"原 ratelimit_middleware.go"的悬空引用,
改为描述本文件相对路由使用实现的两个增强点。
影响:
- 包体减少约 30 行
- 降低新人接手时的代码理解成本
- 零功能变更,24 个现有测试用例全过
95 lines
2.4 KiB
Go
95 lines
2.4 KiB
Go
package middleware
|
|
|
|
import (
|
|
"log"
|
|
"net/http"
|
|
"strings"
|
|
|
|
"github.com/volcano-tts/tts-api/common"
|
|
"github.com/volcano-tts/tts-api/setting"
|
|
)
|
|
|
|
var (
|
|
corsMaxAgeHeader = "86400"
|
|
)
|
|
|
|
func isValidOrigin(origin string) bool {
|
|
if origin == "" || origin == "null" || origin == "nil" {
|
|
return false
|
|
}
|
|
lowerOrigin := strings.ToLower(origin)
|
|
if !strings.HasPrefix(lowerOrigin, "http://") && !strings.HasPrefix(lowerOrigin, "https://") {
|
|
return false
|
|
}
|
|
return true
|
|
}
|
|
|
|
func matchOrigin(origin string) (string, bool) {
|
|
if !isValidOrigin(origin) {
|
|
return "", false
|
|
}
|
|
if setting.CORS.AllowAll {
|
|
return "*", true
|
|
}
|
|
normalized := strings.ToLower(strings.TrimRight(strings.TrimSpace(origin), "/"))
|
|
for _, allowed := range setting.CORS.Origins {
|
|
if allowed == normalized {
|
|
return origin, true
|
|
}
|
|
}
|
|
return "", false
|
|
}
|
|
|
|
func CORS(next http.Handler) http.Handler {
|
|
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
origin := r.Header.Get("Origin")
|
|
|
|
// 无 Origin 头:非跨域请求,跳过 CORS 处理
|
|
if origin == "" {
|
|
next.ServeHTTP(w, r)
|
|
return
|
|
}
|
|
|
|
// 有 Origin 头时,响应必须携带 Vary: Origin 防止 CDN 缓存污染
|
|
vary := w.Header().Get("Vary")
|
|
if vary == "" {
|
|
w.Header().Set("Vary", "Origin")
|
|
} else if !strings.Contains(vary, "Origin") {
|
|
w.Header().Set("Vary", vary+", Origin")
|
|
}
|
|
|
|
isPreflight := r.Method == http.MethodOptions
|
|
|
|
allowOrigin, matched := matchOrigin(origin)
|
|
if !matched {
|
|
// Origin 不在白名单:拒绝请求(预检和非预检均拒绝),
|
|
// 防止不匹配的请求穿透到后端浪费 TTS 资源
|
|
if common.DebugLog {
|
|
log.Printf("CORS拦截: 来源=%q 路径=%s 方法=%s 客户端=%s",
|
|
origin, r.URL.Path, r.Method, GetClientIP(r))
|
|
}
|
|
w.WriteHeader(http.StatusForbidden)
|
|
return
|
|
}
|
|
|
|
// Origin 匹配:设置 CORS 响应头
|
|
w.Header().Set("Access-Control-Allow-Origin", allowOrigin)
|
|
w.Header().Set("Access-Control-Allow-Methods", "GET, POST, OPTIONS")
|
|
w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
|
|
w.Header().Set("Access-Control-Expose-Headers", "X-Request-Id")
|
|
w.Header().Set("Access-Control-Max-Age", corsMaxAgeHeader)
|
|
if allowOrigin != "*" {
|
|
w.Header().Set("Access-Control-Allow-Credentials", "true")
|
|
}
|
|
|
|
// 预检请求:直接返回 204,不进入内层中间件链,
|
|
// 避免消耗速率限制配额和并发槽位
|
|
if isPreflight {
|
|
w.WriteHeader(http.StatusNoContent)
|
|
return
|
|
}
|
|
|
|
next.ServeHTTP(w, r)
|
|
})
|
|
}
|