fix(provider): 修正媒体请求转换与上游错误透传

按上游协议能力延迟处理媒体资源：OpenAI 兼容平台默认使用 multipart，显式配置后才发送 JSON URL；Gemini 官方协议使用 Files API，兼容协议使用内嵌 Base64，并同步覆盖相关媒体客户端。\n\n安全的上游 400/422 原始错误会作为下游 message 返回，同时保留结构化诊断信息和历史任务兼容。\n\n验证：API 全量无缓存测试、go vet、pnpm lint、pnpm test、pnpm build、pnpm openapi、git diff --check。
2026-08-05 00:40:42 +08:00
parent c79c2a7b44
commit ebdb96e7d7
19 changed files with 1163 additions and 93 deletions
@@ -68,6 +68,36 @@ func TestProviderHTTPErrorDoesNotExposeProviderBody(t *testing.T) {
 	}
 }

+func TestUpstreamParameterErrorPreservesSafeOriginalMessage(t *testing.T) {
+	raw := "Duplicate parameter: 'image'. Use image[]=<value> for multiple values."
+	for _, test := range []struct {
+		code   string
+		status int
+	}{
+		{code: "http_400", status: http.StatusBadRequest},
+		{code: "http_422", status: http.StatusUnprocessableEntity},
+	} {
+		got := FromFields(test.code, raw, test.status, false)
+		upstream, _ := got.Details["upstreamError"].(map[string]any)
+		if got.Message != raw || upstream["message"] != raw || upstream["code"] != test.code || upstream["statusCode"] != test.status {
+			t.Fatalf("%s: safe upstream message was not forwarded: %+v", test.code, got)
+		}
+	}
+}
+
+func TestUpstreamParameterErrorRejectsOpaqueOrSensitiveDetails(t *testing.T) {
+	for _, raw := range []string{
+		`{"error":{"message":"bucket private-a rejected secret-project"}}`,
+		"invalid api_key=sk-private-value",
+		"read tcp 10.42.0.1:1234: connection reset by peer",
+	} {
+		got := FromFields("http_400", raw, http.StatusBadRequest, false)
+		if len(got.Details) != 0 || got.Message == raw {
+			t.Fatalf("unsafe upstream message was exposed for %q: %+v", raw, got)
+		}
+	}
+}
+
 func TestGatewayRateLimitIsDistinctFromUpstreamRateLimit(t *testing.T) {
 	gateway := FromFields("gateway_rate_limited", "concurrency limit is saturated and queueing is disabled", http.StatusTooManyRequests, true)
 	if gateway.Code != "gateway_rate_limited" || gateway.Source != "gateway" || gateway.HTTPStatus != http.StatusTooManyRequests {