Upload app.py

app.py

@@ -97,24 +97,20 @@ def _is_origin_allowed(request: Request) -> bool:
     
     print(f"請求來源檢查 - Origin: {origin}, Referer: {referer}, User-Agent: {user_agent}")
     
-    # 檢查 Origin 標頭
-    if origin:
-        for allowed_origin in ALLOWED_ORIGINS:
-            if origin.startswith(allowed_origin):
-                print(f"✅ Origin 匹配: {origin} 匹配 {allowed_origin}")
-                return True
-    
-    # 檢查 Referer 標頭（備用檢查）
-    if referer:
-        for allowed_origin in ALLOWED_ORIGINS:
-            if referer.startswith(allowed_origin):
-                print(f"✅ Referer 匹配: {referer} 匹配 {allowed_origin}")
-                return True
-    
-    # 檢查是否為 GAS 沙箱環境（沒有 Origin/Referer 但有標準瀏覽器 User-Agent）
-    if not origin and not referer and "mozilla" in user_agent.lower():
+    # 檢查是否為 GAS 環境（有 script.googleusercontent.com 的 Origin/Referer）
+    is_gas_request = False
+    if origin and "script.googleusercontent.com" in origin:
+        is_gas_request = True
+        print("✅ 檢測到 Google Apps Script Origin")
+    elif referer and "script.googleusercontent.com" in referer:
+        is_gas_request = True
+        print("✅ 檢測到 Google Apps Script Referer")
+    elif not origin and not referer and "mozilla" in user_agent.lower():
+        is_gas_request = True
         print("⚠️ 檢測到可能的 GAS 沙箱請求")
-        
+    
+    # 如果是 GAS 請求，檢查驗證標頭
+    if is_gas_request:
         # 檢查是否有組織標識標頭
         org_header = request.headers.get("x-organization")
         if org_header:
@@ -131,10 +127,23 @@ def _is_origin_allowed(request: Request) -> bool:
             print("✅ 自定義驗證標頭通過")
             return True
         
-        print("⚠️ 沒有組織驗證標頭，暫時允許請求")
+        print("⚠️ GAS 請求但沒有驗證標頭，暫時允許請求")
         print("⚠️ 建議在 GAS 中添加 'x-organization' 或 'x-dfes-verified' 標頭")
         return True
     
+    # 檢查其他允許的來源（一般網頁）
+    if origin:
+        for allowed_origin in ALLOWED_ORIGINS:
+            if origin.startswith(allowed_origin):
+                print(f"✅ Origin 匹配: {origin} 匹配 {allowed_origin}")
+                return True
+    
+    if referer:
+        for allowed_origin in ALLOWED_ORIGINS:
+            if referer.startswith(allowed_origin):
+                print(f"✅ Referer 匹配: {referer} 匹配 {allowed_origin}")
+                return True
+    
     # 允許來自 Hugging Face Spaces 的直接調用
     if "huggingface" in user_agent.lower():
         print("✅ 檢測到 Hugging Face Spaces 環境")