knowledge-governance/internal/httpapi/qa_ai.go

package httpapi

import (
	"errors"
	"knowledge-governance/internal/qaopsai"
	"net"
	"net/http"
	"net/url"
	"strings"
)

func qaAIError(w http.ResponseWriter, err error) {
	status, code, message := 503, "qa_ai_unavailable", "问答AI存储或安全配置不可用，请检查独立模型配置与执行器；未将失败伪装为成功或空结果"
	switch {
	case errors.Is(err, qaopsai.ErrInvalid):
		status, code, message = 400, "qa_ai_invalid_request", "参数、正式标签或模型输出校验未通过；更换API地址时须重新录入密钥，不能把旧密钥发送到新地址"
	case errors.Is(err, qaopsai.ErrConflict):
		status, code, message = 409, "qa_ai_version_conflict", "配置、输入、人工复核或预览已变化，请刷新；现有结论未被覆盖"
	default:
		var remote *qaopsai.RemoteError
		if errors.As(err, &remote) {
			status, code, message = 422, "qa_ai_"+remote.Code, "模型服务明确拒绝或未返回合格结果，配置未启用；请核对密钥、模型与JSON输出支持"
		}
	}
	writeJSON(w, status, map[string]string{"error": message, "code": code})
}
func qaAIReady(w http.ResponseWriter, r *http.Request, c Config) bool {
	if !authorizeQAOps(w, r) {
		return false
	}
	if r.Method != "GET" && !authorizeQAIntent(w, r, "qa-ai") {
		return false
	}
	if c.QAAI == nil {
		qaAIError(w, qaopsai.ErrUnavailable)
		return false
	}
	if r.URL.RawQuery != "" {
		qaAIError(w, qaopsai.ErrInvalid)
		return false
	}
	return true
}
func qaAISecretTransport(r *http.Request, c Config) bool {
	if r.TLS != nil {
		return true
	}
	host := r.Host
	if parsed, _, err := net.SplitHostPort(host); err == nil {
		host = parsed
	}
	if strings.EqualFold(host, "localhost") {
		return true
	}
	if ip := net.ParseIP(host); ip != nil && ip.IsLoopback() {
		return true
	}
	if c.QAAITrustTLSProxy && r.Header.Get("X-Forwarded-Proto") == "https" && r.Header.Get("Sec-Fetch-Site") == "same-origin" {
		origin, err := url.Parse(r.Header.Get("Origin"))
		return err == nil && origin.Scheme == "https"
	}
	return false
}
func registerQAAIRoutes(mux *http.ServeMux, c Config) {
	mux.HandleFunc("GET /api/v1/qa-ops/ai/settings", func(w http.ResponseWriter, r *http.Request) {
		if !qaAIReady(w, r, c) {
			return
		}
		data, err := c.QAAI.GetSettings(r.Context())
		if err != nil {
			qaAIError(w, err)
			return
		}
		writeJSON(w, 200, map[string]any{"data": data})
	})
	for _, test := range []bool{false, true} {
		path := "POST /api/v1/qa-ops/ai/settings"
		if test {
			path += "/test"
		}
		mux.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
			if !qaAIReady(w, r, c) {
				return
			}
			var input qaopsai.SaveSettings
			if decodeQualityJSON(w, r, &input, "base_revision", "base_url", "model", "key_action") != nil {
				qaAIError(w, qaopsai.ErrInvalid)
				return
			}
			if input.APIKey != "" && !qaAISecretTransport(r, c) {
				writeJSON(w, 400, map[string]string{"code": "qa_ai_secure_transport_required", "error": "密钥仅可通过有效HTTPS或本机回环地址录入；未保存、未发送密钥"})
				return
			}
			identity, _ := sessionFrom(r.Context())
			var data qaopsai.Settings
			var err error
			if test {
				data, err = c.QAAI.TestSettings(r.Context(), input)
			} else {
				data, err = c.QAAI.SaveSettings(r.Context(), input, identity.Username)
			}
			if err != nil {
				qaAIError(w, err)
				return
			}
			writeJSON(w, 200, map[string]any{"data": data})
		})
	}
	mux.HandleFunc("POST /api/v1/qa-ops/ai/automation", func(w http.ResponseWriter, r *http.Request) {
		if !qaAIReady(w, r, c) {
			return
		}
		var input struct {
			Kind    string `json:"kind"`
			Enabled bool   `json:"enabled"`
		}
		if decodeQualityJSON(w, r, &input, "kind", "enabled") != nil {
			qaAIError(w, qaopsai.ErrInvalid)
			return
		}
		identity, _ := sessionFrom(r.Context())
		data, err := c.QAAI.SetAutomation(r.Context(), input.Kind, input.Enabled, identity.Username)
		if err != nil {
			qaAIError(w, err)
			return
		}
		writeJSON(w, 200, map[string]any{"data": data})
	})
	mux.HandleFunc("POST /api/v1/qa-ops/ai/previews", func(w http.ResponseWriter, r *http.Request) {
		if !qaAIReady(w, r, c) {
			return
		}
		var input qaopsai.Scope
		if decodeQualityJSON(w, r, &input, "kind") != nil {
			qaAIError(w, qaopsai.ErrInvalid)
			return
		}
		identity, _ := sessionFrom(r.Context())
		data, err := c.QAAI.Preview(r.Context(), input, identity.Username)
		if err != nil {
			qaAIError(w, err)
			return
		}
		writeJSON(w, 200, map[string]any{"data": data})
	})
	mux.HandleFunc("POST /api/v1/qa-ops/ai/batches", func(w http.ResponseWriter, r *http.Request) {
		if !qaAIReady(w, r, c) {
			return
		}
		var input struct {
			PreviewID string `json:"preview_id"`
			Nonce     string `json:"nonce"`
		}
		if decodeQualityJSON(w, r, &input, "preview_id", "nonce") != nil {
			qaAIError(w, qaopsai.ErrInvalid)
			return
		}
		identity, _ := sessionFrom(r.Context())
		data, err := c.QAAI.Start(r.Context(), input.PreviewID, input.Nonce, identity.Username)
		if err != nil {
			qaAIError(w, err)
			return
		}
		writeJSON(w, 202, map[string]any{"data": data})
	})
	mux.HandleFunc("POST /api/v1/qa-ops/ai/batches/{id}/actions", func(w http.ResponseWriter, r *http.Request) {
		if !qaAIReady(w, r, c) {
			return
		}
		var input struct {
			Action string `json:"action"`
			Nonce  string `json:"nonce"`
		}
		if decodeQualityJSON(w, r, &input, "action", "nonce") != nil || r.Header.Get("Idempotency-Key") != input.Nonce {
			qaAIError(w, qaopsai.ErrInvalid)
			return
		}
		identity, _ := sessionFrom(r.Context())
		data, err := c.QAAI.ManageBatch(r.Context(), r.PathValue("id"), input.Action, input.Nonce, identity.Username)
		if err != nil {
			qaAIError(w, err)
			return
		}
		writeJSON(w, 200, map[string]any{"data": data})
	})
	mux.HandleFunc("GET /api/v1/qa-ops/ai/status", func(w http.ResponseWriter, r *http.Request) {
		if !qaAIReady(w, r, c) {
			return
		}
		data, err := c.QAAI.GetStatus(r.Context())
		if err != nil {
			qaAIError(w, err)
			return
		}
		writeJSON(w, 200, map[string]any{"data": data})
	})
	mux.HandleFunc("GET /api/v1/qa-ops/ai/records/{id}", func(w http.ResponseWriter, r *http.Request) {
		if !qaAIReady(w, r, c) {
			return
		}
		data, err := c.QAAI.RecordEvidence(r.Context(), r.PathValue("id"))
		if err != nil {
			qaAIError(w, err)
			return
		}
		writeJSON(w, 200, map[string]any{"data": data})
	})
}