Upload app.py

app.py

@@ -1,7 +1,7 @@
 # ⚙️ 后端逻辑/核心服务端.py (Hugging Face Spaces app.py)
 from fastapi import FastAPI, File, UploadFile, Form, Depends, HTTPException
 from fastapi.middleware.cors import CORSMiddleware
-from fastapi.responses import Response, JSONResponse
+from fastapi.responses import Response, JSONResponse, FileResponse # 🟢 新增 FileResponse
 from sqlalchemy.orm import Session
 from pydantic import BaseModel
 from huggingface_hub import hf_hub_download, HfApi
@@ -10,6 +10,7 @@ import urllib.parse
 import urllib.request
 import urllib.error
 import os
+import mimetypes # 🟢 新增，用于识别图片类型
 import 数据库连接 as db
 
 from router_users import router as users_router
@@ -24,9 +25,6 @@ from models_sql import Ownership
 
 app = FastAPI(title="ComfyUI Ranking Community API")
 
-# ==========================================
-# 增加一个根目录健康检查接口，专治 HF Spaces 的 "Restarting" 误判
-# ==========================================
 @app.get("/")
 def health_check():
     return {"status": "ok", "message": "ComfyUI Ranking API is running perfectly!"}
@@ -36,7 +34,6 @@ def on_startup():
     init_sql_db()
     print("关系型数据库加载完毕，金融表同步完成。")
 
-# 🟢 致命 BUG 修复：allow_credentials 必须为 False 才能配合 origins=["*"]
 app.add_middleware(
     CORSMiddleware,
     allow_origins=["*"],
@@ -52,18 +49,60 @@ app.include_router(messages_router)
 app.include_router(wallet_router)
 app.include_router(proxy_router)
 
-# 🟢 性能隐患修复：去掉 async def，改为 def。让 FastAPI 自动分配底层线程，防止上传大文件时全站卡死！
+# ==========================================
+# 🟢 新增：私有图床代理中心 (Image Proxy)
+# 解决 Private 仓库下，本地客户端报 401 Unauthorized 的终极方案
+# ==========================================
+@app.get("/api/image_proxy")
+def proxy_hf_image(url: str = None, path: str = None):
+    """云端图片代理：使用云端的 HF_TOKEN 提取私有图床图片并返回给没有任何权限的本地端"""
+    
+    # 兼容处理：如果本地发来的是已经被污染的老版本 HF 直链，我们自动将其转换为相对路径
+    if url and url.startswith("https://huggingface.co/datasets/"):
+        try:
+            path = url.split("resolve/main/")[-1]
+            path = urllib.parse.unquote(path)
+        except:
+            raise HTTPException(status_code=400, detail="无效的 HF 原链接格式")
+            
+    if not path:
+        raise HTTPException(status_code=400, detail="缺少路径参数")
+        
+    # 🛡️ 绝对的安全红线：限制只能代理下载图片目录，严禁黑客通过此接口下载 users.json 或账本数据！
+    allowed_dirs = ["uploads/", "avatars/", "covers/"]
+    if not any(path.startswith(d) for d in allowed_dirs):
+        raise HTTPException(status_code=403, detail="非法访问：该接口仅允许代理图片资源")
+        
+    hf_token = os.environ.get("HF_TOKEN")
+    dataset_repo_id = db.DATASET_REPO_ID 
+    
+    try:
+        # hf_hub_download 会自动利用云端容器的缓存，只有第一次会去真实请求 Dataset
+        cached_file_path = hf_hub_download(
+            repo_id=dataset_repo_id,
+            repo_type="dataset",
+            filename=path,
+            token=hf_token
+        )
+        # 智能识别文件类型 (image/jpeg, image/png 等)
+        content_type, _ = mimetypes.guess_type(cached_file_path)
+        return FileResponse(cached_file_path, media_type=content_type or "application/octet-stream")
+    except Exception as e:
+        return JSONResponse(content={"error": f"代理获取图片失败: {str(e)}"}, status_code=404)
+
+# ==========================================
+# 上传接口 (将返回的 URL 替换为 Proxy 代理链接)
+# ==========================================
 @app.post("/api/upload")
 def upload_file(file: UploadFile = File(...), file_type: str = Form(...)):
-    # 同步读取文件内容
     content = file.file.read() 
     
-    # 🟢 动态文件大小风控
-    max_size = 10 * 1024 * 1024  # 默认兜底 10MB
+    # 动态文件大小风控
+    max_size = 10 * 1024 * 1024  
     if file_type == "avatar":
-        max_size = 2 * 1024 * 1024   # 头像严格限制为 2MB
+        max_size = 2 * 1024 * 1024   
     elif file_type == "cover":
-        max_size = 5 * 1024 * 1024   # 封面图限制为 5MB
+        max_size = 5 * 1024 * 1024   
         
     if len(content) > max_size:
         raise HTTPException(status_code=400, detail=f"文件过大，{file_type} 类型请限制在 {max_size // (1024*1024)}MB 以内")
@@ -98,7 +137,8 @@ def upload_file(file: UploadFile = File(...), file_type: str = Form(...)):
         if os.path.exists(local_tmp_path):
             os.remove(local_tmp_path)
             
-    permanent_url = f"https://huggingface.co/datasets/{dataset_repo_id}/resolve/main/uploads/{file_type}/{safe_filename}"
+    # 🚀 核心修复：不再返回暴露隐私且报 401 的 HF 直链，而是返回我们刚写好的 Proxy 代理链接
+    permanent_url = f"https://zhiwei666-comfyui-ranking-api.hf.space/api/image_proxy?path=uploads/{file_type}/{safe_filename}"
     return {"status": "success", "url": permanent_url}
 
 
@@ -107,7 +147,6 @@ class ValidateResourceRequest(BaseModel):
     item_id: str
     account: str
 
-# 🟢 性能隐患修复：去掉 async def，防止 urllib.request 阻塞事件循环
 @app.post("/api/validate_resource")
 def validate_resource(req_data: ValidateResourceRequest, sql_db: Session = Depends(get_db)):
     target_url = req_data.url