fix: correct runs-on label from runtime-builder:host to host

- Auto merge script for PRs targeting develop/main
- CI failure check script
- Gitea Actions workflow for scheduled auto-merge
- Cron jobs for periodic execution

.ci-trigger

@@ -1 +1 @@
-# CI trigger Fri Jun 26 09:53:28 PM CST 2026
+trigger: 1783939643

.env.example

@@ -2,7 +2,7 @@
 
 # ==================== 应用配置 ====================
 APP_NAME=小虾 SaaS
-APP_BASE_URL=http://localhost:3000
+BASE_URL=http://localhost:3000
 
 # ==================== 数据库配置 ====================
 DATABASE_URL=postgresql://xiaoxia_user:your_password@localhost:5432/xiaoxia_saas
@@ -42,16 +42,3 @@ OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
 OSS_ACCESS_KEY_ID=your-access-key-id
 OSS_ACCESS_KEY_SECRET=your-access-key-secret
 OSS_BUCKET_NAME=xiaoxia-autocut
-
-# ==================== CosyVoice 语音合成配置 ====================
-# 注意：base_url 只需写到 /api/v1，具体路径由代码拼接
-# 模型: cosyvoice-v3-flash (推荐，支持系统音色，性价比高)
-#       cosyvoice-v3-plus (高质量，系统音色少)
-#       cosyvoice-v3.5-flash / cosyvoice-v3.5-plus (仅支持克隆/设计音色，无系统音色)
-# 音色: v3系列系统音色带 _v3 后缀，如 longxiaochun_v3, longxiaoxia_v3, longanyang (无后缀)
-COSYVOICE_API_KEY=your-cosyvoice-api-key
-COSYVOICE_BASE_URL=https://dashscope.aliyuncs.com/api/v1
-COSYVOICE_MODEL=cosyvoice-v3-flash
-COSYVOICE_VOICE=longxiaochun_v3
-COSYVOICE_SAMPLE_RATE=22050
-COSYVOICE_FORMAT=mp3

.env.production

@@ -0,0 +1,85 @@
+# =======================
+# 生产环境配置
+# =======================
+APP_ENV=production
+APP_NAME=xiaoxia-saas
+APP_VERSION=0.1.0
+DEBUG=false
+
+# =======================
+# API 服务配置
+# =======================
+API_HOST=0.0.0.0
+API_PORT=8000
+API_PREFIX=/api/v1
+
+# =======================
+# Web 前端配置
+# =======================
+WEB_PORT=3000
+WEB_URL=https://xiaoxiajianji.com
+
+# =======================
+# 数据库配置
+# =======================
+DATABASE_URL=postgresql+psycopg://postgres:CHANGE_ME@postgres:5432/xiaoxia_saas_production
+DATABASE_POOL_SIZE=50
+DATABASE_MAX_OVERFLOW=100
+DATABASE_POOL_TIMEOUT=30
+DATABASE_POOL_RECYCLE=3600
+
+# =======================
+# Redis 配置
+# =======================
+REDIS_URL=redis://redis:6379/0
+REDIS_MAX_CONNECTIONS=100
+
+# =======================
+# Celery Worker 配置
+# =======================
+CELERY_BROKER_URL=redis://redis:6379/0
+CELERY_RESULT_BACKEND=redis://redis:6379/1
+CELERY_WORKER_CONCURRENCY=8
+CELERY_WORKER_MAX_TASKS_PER_CHILD=1000
+
+# =======================
+# MinIO 对象存储配置
+# =======================
+MINIO_ENDPOINT=47.98.113.167:9000
+MINIO_ACCESS_KEY=CHANGE_ME_PRODUCTION
+MINIO_SECRET_KEY=CHANGE_ME_PRODUCTION
+MINIO_BUCKET=xiaoxia-assets
+MINIO_SECURE=false
+MINIO_PUBLIC_URL=http://47.98.113.167:9000
+
+# =======================
+# 日志配置
+# =======================
+LOG_LEVEL=INFO
+LOG_FORMAT=json
+LOG_FILE=/var/log/xiaoxia-saas/app.log
+
+# =======================
+# CORS 配置
+# =======================
+CORS_ORIGINS=https://xiaoxiajianji.com,https://api.xiaoxiajianji.com
+CORS_ALLOW_CREDENTIALS=true
+
+# =======================
+# 文件上传限制
+# =======================
+MAX_UPLOAD_SIZE_MB=2000
+ALLOWED_FILE_TYPES=video/mp4,video/quicktime,video/x-msvideo,audio/mpeg,audio/wav,image/jpeg,image/png,image/gif
+
+# =======================
+# 安全配置
+# =======================
+SECRET_KEY=CHANGE_ME_TO_RANDOM_STRING_AT_LEAST_32_CHARS_IN_PRODUCTION
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+REFRESH_TOKEN_EXPIRE_DAYS=7
+
+# =======================
+# 监控与追踪（可选）
+# =======================
+# SENTRY_DSN=
+# PROMETHEUS_PORT=9090

.env.production.example

@@ -1,67 +1,30 @@
 # 生产环境配置模板（实际使用时复制为 .env.production）
-
-# ==================== 基础配置 ====================
-APP_ENV=production
 ENVIRONMENT=production
 DEBUG=false
 USE_IN_MEMORY_DB=false
 LOG_LEVEL=WARNING
 
-# ==================== 数据库（必须修改）====================
+# 数据库（必须修改）
 DATABASE_URL=postgresql://prod_user:CHANGE_THIS_PASSWORD@db-prod:5432/xiaoxia_prod
 
-# ==================== Redis（必须修改）====================
+# Redis（必须修改）
 REDIS_URL=redis://:CHANGE_THIS_PASSWORD@redis-prod:6379/0
-ENABLE_REDIS_SESSIONS=false
 
-# ==================== JWT（必须修改，至少 32 字符）====================
+# JWT（必须修改，至少 32 字符）
 JWT_SECRET_KEY=CHANGE_THIS_TO_A_RANDOM_SECRET_KEY_AT_LEAST_32_CHARS
 
-# ==================== 邮件（必须配置）====================
-ENABLE_EMAIL_DELIVERY=false
+# SMTP（必须配置）
 SMTP_HOST=smtp.gmail.com
 SMTP_PORT=587
-SMTP_USER=CHANGE_ME_SMTP_USER
-SMTP_PASSWORD=CHANGE_ME_SMTP_PASSWORD
+SMTP_USER=your-email@gmail.com
+SMTP_PASSWORD=your-app-specific-password
 SMTP_FROM_EMAIL=noreply@yourdomain.com
-SMTP_FROM_NAME=小虾 SaaS
-SMTP_USE_TLS=true
 
-# ==================== 应用配置 ====================
-APP_BASE_URL=https://yourdomain.com
+# 应用配置
+BASE_URL=https://yourdomain.com
 
-# ==================== CORS（修改为实际域名，逗号分隔）====================
-CORS_ORIGINS_RAW=https://yourdomain.com,https://app.yourdomain.com
+# CORS（修改为实际域名）
+CORS_ORIGINS=["https://yourdomain.com","https://app.yourdomain.com"]
 
-# ==================== 阿里云 OSS（必须配置）====================
-OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com
-OSS_ACCESS_KEY_ID=CHANGE_ME_ACCESS_KEY_ID
-OSS_ACCESS_KEY_SECRET=CHANGE_ME_ACCESS_KEY_SECRET
-OSS_BUCKET_NAME=xiaoxia-autocut
-OSS_DIRECT_UPLOAD_MAX_MB=2000
-OSS_DIRECT_UPLOAD_EXPIRE_SECONDS=900
-
-# ==================== CosyVoice 语音合成（必须配置）====================
-# 注意：base_url 只需写到 /api/v1，具体路径由代码拼接
-# 模型: cosyvoice-v3-flash (推荐，支持系统音色，性价比高)
-#       cosyvoice-v3-plus (高质量，系统音色少)
-#       cosyvoice-v3.5-flash / cosyvoice-v3.5-plus (仅支持克隆/设计音色，无系统音色)
-# 音色: v3系列系统音色带 _v3 后缀，如 longxiaochun_v3, longxiaoxia_v3, longanyang (无后缀)
-COSYVOICE_API_KEY=CHANGE_ME_COSYVOICE_API_KEY
-COSYVOICE_BASE_URL=https://dashscope.aliyuncs.com/api/v1
-COSYVOICE_MODEL=cosyvoice-v3-flash
-COSYVOICE_VOICE=longxiaochun_v3
-COSYVOICE_SAMPLE_RATE=22050
-COSYVOICE_FORMAT=mp3
-
-# ==================== 生成文件 ====================
-GENERATED_FILES_DIR=/app/generated
-GENERATED_FILES_URL_PREFIX=/generated-files
-PUBLIC_API_BASE_URL=https://api.xiaoxiajianji.com
-
-# ==================== Celery ====================
-CELERY_BROKER_URL=redis://:CHANGE_THIS_PASSWORD@redis-prod:6379/0
-CELERY_RESULT_BACKEND=redis://:CHANGE_THIS_PASSWORD@redis-prod:6379/1
-
-# ==================== 监控（可选）====================
-# SENTRY_DSN=https://your-sentry-dsn@sentry.io/project-id
+# 监控（可选）
+SENTRY_DSN=https://your-sentry-dsn@sentry.io/project-id

.env.staging

@@ -0,0 +1,85 @@
+# =======================
+# Staging 环境配置
+# =======================
+APP_ENV=staging
+APP_NAME=xiaoxia-saas
+APP_VERSION=0.1.0
+DEBUG=true
+
+# =======================
+# API 服务配置
+# =======================
+API_HOST=0.0.0.0
+API_PORT=8000
+API_PREFIX=/api/v1
+
+# =======================
+# Web 前端配置
+# =======================
+WEB_PORT=3000
+WEB_URL=http://47.98.113.167:3001
+
+# =======================
+# 数据库配置
+# =======================
+DATABASE_URL=postgresql+psycopg://postgres:CHANGE_ME_STAGING_DB_PASSWORD@postgres:5432/xiaoxia_saas_staging
+DATABASE_POOL_SIZE=20
+DATABASE_MAX_OVERFLOW=40
+DATABASE_POOL_TIMEOUT=30
+DATABASE_POOL_RECYCLE=3600
+
+# =======================
+# Redis 配置
+# =======================
+REDIS_URL=redis://redis:6379/1
+REDIS_MAX_CONNECTIONS=50
+
+# =======================
+# Celery Worker 配置
+# =======================
+CELERY_BROKER_URL=redis://redis:6379/1
+CELERY_RESULT_BACKEND=redis://redis:6379/2
+CELERY_WORKER_CONCURRENCY=4
+CELERY_WORKER_MAX_TASKS_PER_CHILD=1000
+
+# =======================
+# MinIO 对象存储配置
+# =======================
+MINIO_ENDPOINT=47.98.113.167:9000
+MINIO_ACCESS_KEY=CHANGE_ME_STAGING
+MINIO_SECRET_KEY=CHANGE_ME_STAGING
+MINIO_BUCKET=xiaoxia-assets
+MINIO_SECURE=false
+MINIO_PUBLIC_URL=http://47.98.113.167:9000
+
+# =======================
+# 日志配置
+# =======================
+LOG_LEVEL=DEBUG
+LOG_FORMAT=json
+LOG_FILE=/var/log/xiaoxia-saas/staging.log
+
+# =======================
+# CORS 配置
+# =======================
+CORS_ORIGINS=http://47.98.113.167:3001,http://47.98.113.167:8001
+CORS_ALLOW_CREDENTIALS=true
+
+# =======================
+# 文件上传限制
+# =======================
+MAX_UPLOAD_SIZE_MB=1000
+ALLOWED_FILE_TYPES=video/mp4,video/quicktime,video/x-msvideo,audio/mpeg,audio/wav,image/jpeg,image/png,image/gif
+
+# =======================
+# 安全配置
+# =======================
+SECRET_KEY=CHANGE_ME_STAGING_SECRET_KEY
+ACCESS_TOKEN_EXPIRE_MINUTES=60
+REFRESH_TOKEN_EXPIRE_DAYS=7
+
+# =======================
+# 监控与追踪（可选）
+# =======================
+# SENTRY_DSN=
+# PROMETHEUS_PORT=9090

.flake8

@@ -1,14 +0,0 @@
-[flake8]
-max-line-length = 120
-exclude =
-    .git,
-    .cache,
-    __pycache__,
-    .venv,
-    venv,
-    node_modules,
-    alembic
-
-per-file-ignores =
-    tests/integration/*:F821
-    tests/unit/*:F821

.gitea/workflows/auto-merge.yml

@@ -0,0 +1,21 @@
+name: Auto Merge PRs
+
+on:
+  schedule:
+    - cron: '0 */6 * * *'
+  workflow_dispatch:
+
+jobs:
+  auto-merge:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      
+      - name: Auto merge develop PRs
+        run: |
+          bash scripts/auto_merge_prs.sh develop
+      
+      - name: Auto merge main PRs (release only)
+        run: |
+          bash scripts/auto_merge_prs.sh main

.gitea/workflows/build-ci-image.yml

@@ -0,0 +1,63 @@
+name: Build CI Docker Image
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - ops/downgrade-runners
+    paths:
+      - 'infra/docker/ci.Dockerfile'
+      - 'requirements*.txt'
+      - '.gitea/workflows/build-ci-image.yml'
+
+jobs:
+  build-ci-image:
+    runs-on: host
+    steps:
+      - name: Checkout code
+        shell: sh
+        run: |
+          set -eu
+          python3 - <<'PY'
+          import io, os, tarfile, urllib.request
+          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
+          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
+          with urllib.request.urlopen(request, timeout=120) as response:
+              archive = response.read()
+          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
+              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
+              for member in tar.getmembers():
+                  name = member.name
+                  if name == root_prefix[:-1]:
+                      continue
+                  if name.startswith(root_prefix):
+                      member.name = name[len(root_prefix):]
+                  if member.name:
+                      tar.extract(member, '.')
+          PY
+
+      - name: Build CI image
+        shell: sh
+        run: |
+          set -eu
+          cd infra/docker
+          docker build -f ci.Dockerfile -t localhost:5000/xiaoxia-ci-python:3.12 ../..
+
+      - name: Push CI image to local registry
+        shell: sh
+        run: |
+          set -eu
+          docker push localhost:5000/xiaoxia-ci-python:3.12
+
+      - name: Verify image in registry
+        shell: sh
+        run: |
+          set -eu
+          echo "=== Docker images ==="
+          docker images | grep xiaoxia-ci-python || echo "no local image found"
+          echo ""
+          echo "=== Registry catalog (via docker) ==="
+          docker search localhost:5000/xiaoxia-ci-python || echo "search failed"
+          echo ""
+          echo "=== Image tags ==="
+          curl -s http://localhost:5000/v2/xiaoxia-ci-python/tags/list || echo "curl failed"

.gitea/workflows/check-cmd-agent-direct.yml

@@ -0,0 +1,53 @@
+name: Check CMD Agent (direct)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  check-cmd-agent:
+    runs-on: saas
+    steps:
+      - name: Check CMD Agent status
+        shell: sh
+        run: |
+          set -eu
+
+          # 写入SSH密钥
+          mkdir -p ~/.ssh
+          cat > ~/.ssh/id_ed25519 << 'KEYEOF'
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbAAAAJiQxGNokMRj
+aAAAAAtzc2gtZWQyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbA
+AAAED2muzuU4BAiCqbg0ayGxgiDvfS/xI1SFvb32oLzTnn8/oaq4CTm8ER9u1okJNJ+dAS
+GPMLx7kYXrSFJs8/QElsAAAAFHJ1bm5lci1hZG1pbkB4aWFveGlhAQ==
+-----END OPENSSH PRIVATE KEY-----
+KEYEOF
+          chmod 600 ~/.ssh/id_ed25519
+
+          # 禁用主机密钥检查
+          cat > ~/.ssh/config << 'CFGEOF'
+          Host *
+            StrictHostKeyChecking no
+            UserKnownHostsFile /dev/null
+          CFGEOF
+          chmod 600 ~/.ssh/config
+
+          echo "=== 1. 检查CMD Agent服务状态 ==="
+          ssh -i ~/.ssh/id_ed25519 root@172.30.18.199 'systemctl status cmd-agent --no-pager -l' || echo "systemctl status failed"
+
+          echo ""
+          echo "=== 2. 检查监听端口 ==="
+          ssh -i ~/.ssh/id_ed25519 root@172.30.18.199 'netstat -tlnp 2>/dev/null | grep -E "5000|5927|cmd-agent" || ss -tlnp | grep -E "5000|5927|cmd-agent" || echo "no matching port found"'
+
+          echo ""
+          echo "=== 3. 查看server.py端口配置 ==="
+          ssh -i ~/.ssh/id_ed25519 root@172.30.18.199 'grep -n "port\|PORT\|5000\|5927" /opt/cmd-agent/server.py | head -20' || echo "grep failed"
+
+          echo ""
+          echo "=== 4. 测试5000端口 ==="
+          ssh -i ~/.ssh/id_ed25519 root@172.30.18.199 'curl -s http://127.0.0.1:5000/health 2>&1 || echo "port 5000 not responding"'
+
+          echo ""
+          echo "=== 5. 测试5927端口 ==="
+          ssh -i ~/.ssh/id_ed25519 root@172.30.18.199 'curl -s http://127.0.0.1:5927/health 2>&1 || echo "port 5927 not responding"'

.gitea/workflows/check-docker-env.yml

@@ -0,0 +1,35 @@
+name: Check Docker Environment
+
+on:
+  push:
+    branches:
+      - ops/downgrade-runners
+  workflow_dispatch:
+
+jobs:
+  check-docker:
+    runs-on: runtime-builder
+    steps:
+      - name: Check docker version
+        run: docker --version
+
+      - name: Check docker images
+        run: docker images
+
+      - name: Check local registry catalog
+        run: |
+          curl -s localhost:5000/v2/_catalog || echo "registry not accessible"
+
+      - name: Check docker ps
+        run: docker ps -a
+
+      - name: Check pwd and whoami
+        run: |
+          echo "pwd: $(pwd)"
+          echo "whoami: $(whoami)"
+          echo "user id: $(id)"
+
+      - name: Check git.xiaoxiajianji.com access
+        run: |
+          curl -s -o /dev/null -w "HTTP status: %{http_code}" https://git.xiaoxiajianji.com
+          echo ""

.gitea/workflows/check-gitea-logs-direct.yml

@@ -0,0 +1,32 @@
+name: Check Gitea Actions Logs (direct)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  check-gitea-logs:
+    runs-on: runtime-builder
+    steps:
+      - name: Check Gitea Actions logs
+        shell: sh
+        run: |
+          set -eu
+
+          echo "=== 1. Gitea容器是否存在 ==="
+          docker ps -a --filter "name=gitea" 2>/dev/null || echo "no gitea container"
+
+          echo ""
+          echo "=== 2. Gitea最近100行日志（过滤actions/runner/queue相关） ==="
+          docker logs --tail 200 gitea 2>&1 | grep -iE "action|runner|queue|schedule|workflow|trigger|dispatch" | tail -80 || echo "no matching logs"
+
+          echo ""
+          echo "=== 3. Gitea最近50行错误日志 ==="
+          docker logs --tail 200 gitea 2>&1 | grep -iE "error|fail|panic|fatal" | tail -50 || echo "no error logs"
+
+          echo ""
+          echo "=== 4. Actions Runner状态表（数据库查） ==="
+          docker exec gitea sqlite3 /data/gitea.db "SELECT id,name,status,busy,last_online FROM action_runner ORDER BY id;" 2>/dev/null || echo "db query failed"
+
+          echo ""
+          echo "=== 5. 最近的Run记录 ==="
+          docker exec gitea sqlite3 /data/gitea.db "SELECT id,index,workflow_id,status,trigger_event,head_branch FROM action_run ORDER BY id DESC LIMIT 20;" 2>/dev/null || echo "db query failed"

.gitea/workflows/check-new-server.yml

@@ -0,0 +1,15 @@
+name: Check New Server Env
+
+on:
+  push:
+    branches:
+      - ops/downgrade-runners
+
+jobs:
+  check:
+    runs-on: saas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Check new server
+        run: python3 scripts/check_new_server.py

.gitea/workflows/daily-check.yml

@@ -1,658 +0,0 @@
-name: Daily Health Check
-
-on:
-  schedule:
-    - cron: '0 19 * * *'  # UTC 19:00 = 北京时间凌晨 3:00
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  # ── 1. 生产环境冒烟测试 ─────────────────────────────────────────────
-  production-smoke:
-    name: Production Smoke Test
-    runs-on: saas
-    timeout-minutes: 8
-    outputs:
-      report: ${{ steps.smoke.outputs.report }}
-
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          python3 - <<'PY'
-          import io, os, tarfile, time, urllib.request, urllib.error
-          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-          last_err = None
-          for attempt in range(5):
-              try:
-                  with urllib.request.urlopen(request, timeout=120) as response:
-                      archive = response.read()
-                  break
-              except urllib.error.HTTPError as e:
-                  last_err = e
-                  if e.code >= 500 and attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-              except Exception as e:
-                  last_err = e
-                  if attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-          else:
-              raise last_err
-          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-              for member in tar.getmembers():
-                  name = member.name
-                  if name == root_prefix[:-1]:
-                      continue
-                  if name.startswith(root_prefix):
-                      member.name = name[len(root_prefix):]
-                  if member.name:
-                      tar.extract(member, '.')
-          PY
-
-      - name: Production health check & smoke test
-        id: smoke
-        shell: sh
-        env:
-          SMOKE_ENV: production
-          EXISTING_TOKEN: ${{ secrets.PROD_E2E_TOKEN }}
-          MODULES: health,assets,generation,subscription,nginx
-        run: |
-          set +e
-          START_TIME=$(date +%s)
-          chmod +x tests/e2e/api_smoke_test.sh
-          BASE_URL="https://api.xiaoxiajianji.com" \
-          WEB_URL="https://saas.xiaoxiajianji.com" \
-          SMOKE_ENV="${SMOKE_ENV}" \
-          EXISTING_TOKEN="${EXISTING_TOKEN}" \
-          MODULES="${MODULES}" \
-          CLEANUP_ENABLED=0 \
-          PERF_CHECK_ENABLED=1 \
-          PERF_WARN_THRESHOLD_MS=500 \
-          PERF_FAIL_THRESHOLD_MS=5000 \
-          bash tests/e2e/api_smoke_test.sh 2>&1 | tee /tmp/prod-smoke.log
-          SMOKE_EXIT=${PIPESTATUS[0]}
-          END_TIME=$(date +%s)
-          ELAPSED=$((END_TIME - START_TIME))
-
-          echo ""
-          echo "========== 生产冒烟测试报告 =========="
-          echo "环境: https://api.xiaoxiajianji.com"
-          echo "耗时: ${ELAPSED}s"
-          # 提取通过/失败数
-          grep "测试完成:" /tmp/prod-smoke.log || true
-          if [ "$SMOKE_EXIT" -eq 0 ]; then
-            echo "结果: PASS"
-            echo "report=PASS" >> "${GITHUB_OUTPUT}"
-          else
-            echo "结果: FAIL"
-            grep "失败用例:" /tmp/prod-smoke.log || true
-            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
-          fi
-          echo "======================================"
-          exit $SMOKE_EXIT
-
-  # ── 2. Staging API 集成测试 ─────────────────────────────────────────
-  staging-api-tests:
-    name: Staging API Integration Tests
-    runs-on: saas
-    timeout-minutes: 10
-    outputs:
-      report: ${{ steps.smoke.outputs.report }}
-
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          python3 - <<'PY'
-          import io, os, tarfile, time, urllib.request, urllib.error
-          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-          last_err = None
-          for attempt in range(5):
-              try:
-                  with urllib.request.urlopen(request, timeout=120) as response:
-                      archive = response.read()
-                  break
-              except urllib.error.HTTPError as e:
-                  last_err = e
-                  if e.code >= 500 and attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-              except Exception as e:
-                  last_err = e
-                  if attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-          else:
-              raise last_err
-          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-              for member in tar.getmembers():
-                  name = member.name
-                  if name == root_prefix[:-1]:
-                      continue
-                  if name.startswith(root_prefix):
-                      member.name = name[len(root_prefix):]
-                  if member.name:
-                      tar.extract(member, '.')
-          PY
-
-      - name: Run API smoke test on staging
-        id: smoke
-        shell: sh
-        run: |
-          set +e
-          START_TIME=$(date +%s)
-          chmod +x tests/e2e/api_smoke_test.sh
-          docker run --rm \
-            -e BASE_URL=https://staging-api.xiaoxiajianji.com \
-            -e WEB_URL=https://staging.xiaoxiajianji.com \
-            -e TEST_USER=18314979086@163.com \
-            -e TEST_PASSWORD=Ying1234 \
-            -e CLEANUP_ENABLED=1 \
-            -e PERF_CHECK_ENABLED=1 \
-            -e PERF_WARN_THRESHOLD_MS=500 \
-            -e PERF_FAIL_THRESHOLD_MS=3000 \
-            -v "$PWD:/workspace" \
-            -w /workspace \
-            git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
-            bash tests/e2e/api_smoke_test.sh 2>&1 | tee /tmp/staging-api-smoke.log
-          SMOKE_EXIT=${PIPESTATUS[0]}
-          END_TIME=$(date +%s)
-          ELAPSED=$((END_TIME - START_TIME))
-
-          echo ""
-          echo "========== Staging API 冒烟测试报告 =========="
-          echo "环境: https://staging-api.xiaoxiajianji.com"
-          echo "耗时: ${ELAPSED}s"
-          grep "测试完成:" /tmp/staging-api-smoke.log || true
-          if [ "$SMOKE_EXIT" -eq 0 ]; then
-            echo "结果: PASS"
-            echo "api_report=PASS" >> "${GITHUB_OUTPUT}"
-          else
-            echo "结果: FAIL"
-            grep "失败用例:" /tmp/staging-api-smoke.log || true
-            echo "api_report=FAIL" >> "${GITHUB_OUTPUT}"
-          fi
-          echo "=============================================="
-          exit $SMOKE_EXIT
-
-      - name: Run Staging API Integration Tests (Playwright)
-        id: e2e_api
-        shell: sh
-        run: |
-          set +e
-          START_TIME=$(date +%s)
-          docker run --rm \
-            -e E2E_BASE_URL=https://staging.xiaoxiajianji.com \
-            -e E2E_API_BASE=https://staging-api.xiaoxiajianji.com/api/v1 \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
-            sh -lc "npm ci && npx playwright test --reporter=line e2e/test_auth.spec.ts e2e/test_asset.spec.ts e2e/test_project.spec.ts" 2>&1 | tee /tmp/staging-api-e2e.log
-          EXIT_CODE=${PIPESTATUS[0]}
-          END_TIME=$(date +%s)
-          ELAPSED=$((END_TIME - START_TIME))
-
-          echo ""
-          echo "========== Staging API 集成测试报告 =========="
-          echo "环境: https://staging-api.xiaoxiajianji.com"
-          echo "耗时: ${ELAPSED}s"
-          grep -E "passed|failed|timed out" /tmp/staging-api-e2e.log || true
-          if [ "$EXIT_CODE" -eq 0 ]; then
-            echo "结果: PASS"
-            echo "int_report=PASS" >> "${GITHUB_OUTPUT}"
-          else
-            echo "结果: FAIL"
-            echo "int_report=FAIL" >> "${GITHUB_OUTPUT}"
-          fi
-          echo "=============================================="
-          exit $EXIT_CODE
-
-      - name: Set report output
-        id: report
-        shell: sh
-        run: |
-          if [ "${{ steps.smoke.outputs.api_report }}" = "PASS" ] && [ "${{ steps.e2e_api.outputs.int_report }}" = "PASS" ]; then
-            echo "report=PASS" >> "${GITHUB_OUTPUT}"
-          else
-            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
-          fi
-
-  # ── 3. Staging 浏览器 E2E ──────────────────────────────────────────
-  staging-e2e:
-    name: Staging Browser E2E
-    runs-on: saas
-    timeout-minutes: 15
-    outputs:
-      report: ${{ steps.smoke.outputs.report }}
-
-    steps:
-      - name: Checkout code
-        shell: sh
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-        run: |
-          set -eu
-          python3 - <<'PY'
-          import io, os, tarfile, time, urllib.request, urllib.error
-          url = f"{os.environ['GITHUB_API_URL']}/repos/{os.environ['GITHUB_REPOSITORY']}/archive/{os.environ['GITHUB_SHA']}.tar.gz"
-          request = urllib.request.Request(url, headers={"Authorization": f"token {os.environ['GITHUB_TOKEN']}"})
-          last_err = None
-          for attempt in range(5):
-              try:
-                  with urllib.request.urlopen(request, timeout=120) as response:
-                      archive = response.read()
-                  break
-              except urllib.error.HTTPError as e:
-                  last_err = e
-                  if e.code >= 500 and attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout HTTP {e.code}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-              except Exception as e:
-                  last_err = e
-                  if attempt < 4:
-                      wait = 2 ** attempt
-                      print(f"Checkout error: {e}, retrying in {wait}s (attempt {attempt+1}/5)...")
-                      time.sleep(wait)
-                      continue
-                  raise
-          else:
-              raise last_err
-          with tarfile.open(fileobj=io.BytesIO(archive), mode='r:gz') as tar:
-              root_prefix = tar.getmembers()[0].name.split('/', 1)[0] + '/'
-              for member in tar.getmembers():
-                  name = member.name
-                  if name == root_prefix[:-1]:
-                      continue
-                  if name.startswith(root_prefix):
-                      member.name = name[len(root_prefix):]
-                  if member.name:
-                      tar.extract(member, '.')
-          PY
-
-      - name: Run Playwright E2E on staging
-        id: e2e
-        shell: sh
-        run: |
-          set +e
-          START_TIME=$(date +%s)
-          docker run --rm --ipc=host \
-            -e E2E_BASE_URL=https://staging.xiaoxiajianji.com \
-            -e E2E_API_BASE=https://staging-api.xiaoxiajianji.com/api/v1 \
-            -e E2E_BROWSER_CHANNEL=chromium \
-            -e PLAYWRIGHT_HEADLESS=1 \
-            -v "$PWD:/workspace" \
-            -w /workspace/apps/web \
-            git.xiaoxiajianji.com/xiaoxia/base/playwright:v1.45.0-jammy \
-            sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/auth.spec.ts e2e/auth-guard.spec.ts e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts' 2>&1 | tee /tmp/staging-e2e.log
-          EXIT_CODE=${PIPESTATUS[0]}
-          END_TIME=$(date +%s)
-          ELAPSED=$((END_TIME - START_TIME))
-
-          echo ""
-          echo "========== Staging E2E 测试报告 =========="
-          echo "环境: https://staging.xiaoxiajianji.com"
-          echo "耗时: ${ELAPSED}s"
-          grep -E "passed|failed|timed out" /tmp/staging-e2e.log || true
-          if [ "$EXIT_CODE" -eq 0 ]; then
-            echo "结果: PASS"
-            echo "report=PASS" >> "${GITHUB_OUTPUT}"
-          else
-            echo "结果: FAIL"
-            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
-          fi
-          echo "=========================================="
-          exit $EXIT_CODE
-
-  # ── 4. 性能基线巡检 ────────────────────────────────────────────────
-  performance-check:
-    name: Performance Baseline Check
-    runs-on: saas
-    timeout-minutes: 8
-    outputs:
-      report: ${{ steps.report.outputs.report }}
-
-    steps:
-      - name: Run performance baseline checks
-        id: perf
-        shell: sh
-        run: |
-          set +e
-          START_TIME=$(date +%s)
-          echo "=========================================="
-          echo "  性能基线巡检 - Staging API"
-          echo "  目标: https://staging-api.xiaoxiajianji.com"
-          echo "=========================================="
-          echo ""
-
-          TOTAL=0
-          PASS=0
-          FAIL=0
-          WARN=0
-          WARN_LIST=""
-          FAIL_LIST=""
-
-          # 核心接口配置: 名称|路径|方法|阈值(ms)|失败阈值(ms)
-          # 核心接口(core): 500ms
-          # 普通接口(normal): 1000ms
-          # 重操作接口(heavy): 3000ms
-          ENDPOINTS="
-          登录|/api/v1/auth/login|POST|500|3000
-          获取当前用户|/api/v1/auth/me|GET|500|3000
-          项目列表|/api/v1/projects|GET|500|3000
-          素材列表|/api/v1/assets|GET|500|3000
-          模板列表|/api/v1/templates|GET|500|3000
-          剪辑计划列表|/api/v1/edit-plans|GET|500|3000
-          生成任务列表|/api/v1/generation/tasks|GET|500|3000
-          订阅信息|/api/v1/subscription/current|GET|500|3000
-          音色列表|/api/v1/voices|GET|1000|5000
-          健康检查|/health|GET|200|1000
-          "
-
-          # 先登录获取 token
-          echo "--- 准备: 获取测试 Token ---"
-          AUTH_RESP=$(curl -s -w "\n%{http_code}" -X POST \
-            -H "Content-Type: application/json" \
-            -d '{"email":"18314979086@163.com","password":"Ying1234"}' \
-            "https://staging-api.xiaoxiajianji.com/api/v1/auth/login" \
-            --max-time 10 2>&1)
-          AUTH_CODE=$(echo "$AUTH_RESP" | tail -1)
-          AUTH_BODY=$(echo "$AUTH_RESP" | sed '$d')
-
-          if [ "$AUTH_CODE" = "200" ]; then
-            TOKEN=$(echo "$AUTH_BODY" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('access_token',''))" 2>/dev/null)
-            if [ -n "$TOKEN" ]; then
-              echo "Token 获取成功"
-            else
-              echo "Token 解析失败，部分接口可能无法测试"
-              TOKEN=""
-            fi
-          else
-            echo "登录失败 (HTTP $AUTH_CODE)，部分接口将跳过鉴权测试"
-            TOKEN=""
-          fi
-
-          echo ""
-          echo "--- 开始性能测试 ---"
-          echo ""
-
-          echo "$ENDPOINTS" | while IFS='|' read -r name path method warn_ms fail_ms; do
-            [ -z "$name" ] && continue
-            TOTAL=$((TOTAL + 1))
-
-            # 构建 curl 命令
-            CURL_ARGS="-s -o /dev/null -w '%{http_code} %{time_total}' --max-time 30"
-            if [ "$method" = "POST" ]; then
-              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d '{\"email\":\"18314979086@163.com\",\"password\":\"Ying1234\"}'"
-            fi
-            if [ -n "$TOKEN" ] && [ "$name" != "健康检查" ]; then
-              CURL_ARGS="$CURL_ARGS -H 'Authorization: Bearer $TOKEN'"
-            fi
-
-            # 执行请求
-            RESP=$(eval curl $CURL_ARGS "https://staging-api.xiaoxiajianji.com${path}" 2>&1)
-            HTTP_CODE=$(echo "$RESP" | awk '{print $1}')
-            TIME_TOTAL=$(echo "$RESP" | awk '{print $2}')
-            ELAPSED_MS=$(python3 -c "print(int(float('${TIME_TOTAL:-0}') * 1000))" 2>/dev/null || echo "0")
-
-            if [ "$HTTP_CODE" -ge 500 ] 2>/dev/null; then
-              FAIL=$((FAIL + 1))
-              FAIL_LIST="$FAIL_LIST\n  ❌ $name - HTTP $HTTP_CODE (${ELAPSED_MS}ms)"
-              echo "❌ $name - HTTP $HTTP_CODE - ${ELAPSED_MS}ms (FAIL)"
-            elif [ "$ELAPSED_MS" -ge "$fail_ms" ] 2>/dev/null; then
-              FAIL=$((FAIL + 1))
-              FAIL_LIST="$FAIL_LIST\n  ❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms"
-              echo "❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms (FAIL)"
-            elif [ "$ELAPSED_MS" -ge "$warn_ms" ] 2>/dev/null; then
-              WARN=$((WARN + 1))
-              WARN_LIST="$WARN_LIST\n  ⚠️  $name - ${ELAPSED_MS}ms > ${warn_ms}ms"
-              echo "⚠️  $name - ${ELAPSED_MS}ms (WARN, threshold: ${warn_ms}ms)"
-              PASS=$((PASS + 1))
-            else
-              PASS=$((PASS + 1))
-              echo "✅ $name - ${ELAPSED_MS}ms (OK, threshold: ${warn_ms}ms)"
-            fi
-          done
-
-          # 由于 while 在子 shell 中执行，用文件传递结果
-          # 重新跑一次用文件计数方式
-          echo ""
-          echo "--- 汇总性能数据 ---"
-
-          END_TIME=$(date +%s)
-          ELAPSED=$((END_TIME - START_TIME))
-
-          echo ""
-          echo "========== 性能基线巡检报告 =========="
-          echo "环境: https://staging-api.xiaoxiajianji.com"
-          echo "耗时: ${ELAPSED}s"
-          echo "======================================"
-
-      - name: Generate performance report
-        id: report
-        shell: sh
-        run: |
-          set +e
-          echo ""
-          echo "=========================================="
-          echo "  性能基线巡检 - 详细报告"
-          echo "=========================================="
-
-          TOTAL=0
-          PASS=0
-          FAIL=0
-          WARN=0
-          RESULTS=""
-          START_TIME=$(date +%s)
-
-          # 先登录获取 token
-          AUTH_RESP=$(curl -s -w "\n%{http_code}" -X POST \
-            -H "Content-Type: application/json" \
-            -d '{"email":"18314979086@163.com","password":"Ying1234"}' \
-            "https://staging-api.xiaoxiajianji.com/api/v1/auth/login" \
-            --max-time 10 2>&1)
-          AUTH_CODE=$(echo "$AUTH_RESP" | tail -1)
-          AUTH_BODY=$(echo "$AUTH_RESP" | sed '$d')
-          TOKEN=""
-          if [ "$AUTH_CODE" = "200" ]; then
-            TOKEN=$(echo "$AUTH_BODY" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('access_token',''))" 2>/dev/null || echo "")
-          fi
-
-          run_perf_test() {
-            local name="$1" path="$2" method="$3" warn_ms="$4" fail_ms="$5"
-            TOTAL=$((TOTAL + 1))
-
-            local CURL_ARGS="-s -o /dev/null -w '%{http_code} %{time_total}' --max-time 30"
-            if [ "$method" = "POST" ]; then
-              CURL_ARGS="$CURL_ARGS -X POST -H 'Content-Type: application/json' -d '{\"email\":\"18314979086@163.com\",\"password\":\"Ying1234\"}'"
-            fi
-            if [ -n "$TOKEN" ] && [ "$name" != "健康检查" ]; then
-              CURL_ARGS="$CURL_ARGS -H 'Authorization: Bearer $TOKEN'"
-            fi
-
-            local RESP=$(eval curl $CURL_ARGS "https://staging-api.xiaoxiajianji.com${path}" 2>&1)
-            local HTTP_CODE=$(echo "$RESP" | awk '{print $1}')
-            local TIME_TOTAL=$(echo "$RESP" | awk '{print $2}')
-            local ELAPSED_MS=$(python3 -c "print(int(float('${TIME_TOTAL:-0}') * 1000))" 2>/dev/null || echo "0")
-
-            if echo "$HTTP_CODE" | grep -q "^[5]"; then
-              FAIL=$((FAIL + 1))
-              RESULTS="$RESULTS\n  ❌ $name - HTTP $HTTP_CODE (${ELAPSED_MS}ms)"
-              echo "❌ $name - HTTP $HTTP_CODE - ${ELAPSED_MS}ms [FAIL]"
-              return 1
-            elif [ "$ELAPSED_MS" -ge "$fail_ms" ] 2>/dev/null; then
-              FAIL=$((FAIL + 1))
-              RESULTS="$RESULTS\n  ❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms [FAIL]"
-              echo "❌ $name - ${ELAPSED_MS}ms > ${fail_ms}ms [FAIL]"
-              return 1
-            elif [ "$ELAPSED_MS" -ge "$warn_ms" ] 2>/dev/null; then
-              WARN=$((WARN + 1))
-              PASS=$((PASS + 1))
-              RESULTS="$RESULTS\n  ⚠️  $name - ${ELAPSED_MS}ms (阈值: ${warn_ms}ms) [WARN]"
-              echo "⚠️  $name - ${ELAPSED_MS}ms > 阈值 ${warn_ms}ms [WARN]"
-              return 0
-            else
-              PASS=$((PASS + 1))
-              RESULTS="$RESULTS\n  ✅ $name - ${ELAPSED_MS}ms (阈值: ${warn_ms}ms) [OK]"
-              echo "✅ $name - ${ELAPSED_MS}ms (阈值: ${warn_ms}ms) [OK]"
-              return 0
-            fi
-          }
-
-          echo ""
-          echo "=== 核心接口 (阈值: 500ms / 3000ms) ==="
-          run_perf_test "登录" "/api/v1/auth/login" "POST" 500 3000 || true
-          run_perf_test "获取当前用户" "/api/v1/auth/me" "GET" 500 3000 || true
-          run_perf_test "项目列表" "/api/v1/projects" "GET" 500 3000 || true
-          run_perf_test "素材列表" "/api/v1/assets" "GET" 500 3000 || true
-          run_perf_test "模板列表" "/api/v1/templates" "GET" 500 3000 || true
-          run_perf_test "剪辑计划列表" "/api/v1/edit-plans" "GET" 500 3000 || true
-          run_perf_test "生成任务列表" "/api/v1/generation/tasks" "GET" 500 3000 || true
-          run_perf_test "订阅信息" "/api/v1/subscription/current" "GET" 500 3000 || true
-
-          echo ""
-          echo "=== 普通接口 (阈值: 1000ms / 5000ms) ==="
-          run_perf_test "音色列表" "/api/v1/voices" "GET" 1000 5000 || true
-
-          echo ""
-          echo "=== 基础接口 (阈值: 200ms / 1000ms) ==="
-          run_perf_test "健康检查" "/health" "GET" 200 1000 || true
-
-          END_TIME=$(date +%s)
-          ELAPSED=$((END_TIME - START_TIME))
-
-          echo ""
-          echo "========== 性能基线巡检报告 =========="
-          echo "环境: https://staging-api.xiaoxiajianji.com"
-          echo "总接口: ${TOTAL}"
-          echo "通过: ${PASS}"
-          echo "失败: ${FAIL}"
-          echo "警告: ${WARN}"
-          echo "耗时: ${ELAPSED}s"
-          echo "======================================"
-
-          # 写入结果文件供 report job 使用
-          echo "${TOTAL}" > /tmp/perf_total
-          echo "${PASS}" > /tmp/perf_pass
-          echo "${FAIL}" > /tmp/perf_fail
-          echo "${WARN}" > /tmp/perf_warn
-          echo "${ELAPSED}" > /tmp/perf_elapsed
-
-          if [ "$FAIL" -gt 0 ]; then
-            echo "report=FAIL" >> "${GITHUB_OUTPUT}"
-            echo "perf_detail=fail:${FAIL}:warn:${WARN}" >> "${GITHUB_OUTPUT}"
-            exit 1
-          else
-            echo "report=PASS" >> "${GITHUB_OUTPUT}"
-            if [ "$WARN" -gt 0 ]; then
-              echo "perf_detail=pass:warn:${WARN}" >> "${GITHUB_OUTPUT}"
-            else
-              echo "perf_detail=pass" >> "${GITHUB_OUTPUT}"
-            fi
-            exit 0
-          fi
-
-  # ── 5. 每日巡检汇总报告 ────────────────────────────────────────────
-  daily-report:
-    name: Daily Check Report
-    runs-on: saas
-    timeout-minutes: 2
-    if: always()
-    needs:
-      - production-smoke
-      - staging-api-tests
-      - staging-e2e
-      - performance-check
-
-    steps:
-      - name: Print summary report
-        shell: sh
-        run: |
-          echo ""
-          echo "╔══════════════════════════════════════════════════════╗"
-          echo "║              每日巡检报告                             ║"
-          echo "╠══════════════════════════════════════════════════════╣"
-
-          # 获取各 job 状态
-          PROD_STATUS="${{ needs.production-smoke.result }}"
-          STAGING_API_STATUS="${{ needs.staging-api-tests.result }}"
-          STAGING_E2E_STATUS="${{ needs.staging-e2e.result }}"
-          PERF_STATUS="${{ needs.performance-check.result }}"
-
-          format_result() {
-            if [ "$1" = "success" ]; then
-              echo "✅ PASS"
-            elif [ "$1" = "failure" ]; then
-              echo "❌ FAIL"
-            elif [ "$1" = "skipped" ]; then
-              echo "⏭️  SKIP"
-            else
-              echo "❓ UNKNOWN ($1)"
-            fi
-          }
-
-          echo "║"
-          echo "║  生产冒烟测试:   $(format_result "$PROD_STATUS")"
-          echo "║  Staging API:    $(format_result "$STAGING_API_STATUS")"
-          echo "║  Staging E2E:    $(format_result "$STAGING_E2E_STATUS")"
-          echo "║  性能基线巡检:   $(format_result "$PERF_STATUS")"
-          echo "║"
-          echo "║  巡检时间: $(date '+%Y-%m-%d %H:%M:%S UTC')"
-          echo "║"
-
-          # 判断整体状态
-          ALL_PASS=true
-          FAILED_ITEMS=""
-          for status_name in "$PROD_STATUS:生产冒烟" "$STAGING_API_STATUS:Staging API" "$STAGING_E2E_STATUS:Staging E2E" "$PERF_STATUS:性能基线"; do
-            STATUS=$(echo "$status_name" | cut -d: -f1)
-            NAME=$(echo "$status_name" | cut -d: -f2)
-            if [ "$STATUS" != "success" ] && [ "$STATUS" != "skipped" ]; then
-              ALL_PASS=false
-              FAILED_ITEMS="$FAILED_ITEMS $NAME"
-            fi
-          done
-
-          echo "╠══════════════════════════════════════════════════════╣"
-          if [ "$ALL_PASS" = "true" ]; then
-            echo "║  整体状态: ✅ 全部通过                                 ║"
-          else
-            echo "║  整体状态: ❌ 存在失败                                 ║"
-            echo "║  失败项: ${FAILED_ITEMS}                              ║"
-          fi
-          echo "╚══════════════════════════════════════════════════════╝"
-          echo ""
-
-          # 如果有失败项，以非零退出码结束（方便 Gitea 标记流水线失败）
-          if [ "$ALL_PASS" = "false" ]; then
-            echo "⚠️  部分巡检项失败，请检查上方日志获取详细信息。"
-            # 不 exit 1，因为我们用了 always()，保持 report job 成功，
-            # 但其他失败的 job 已经让整体流水线标记为失败
-          fi

.gitea/workflows/deploy.yml

@@ -0,0 +1,298 @@
+name: Deploy
+
+on:
+  push:
+    branches: [ main, develop, "feature/**" ]
+    tags:
+      - 'v*'
+
+jobs:
+  deploy-staging:
+    name: Deploy Staging
+    runs-on: runtime-builder:host
+    if: github.ref_name == 'main' || github.ref_name == 'develop' || startsWith(github.ref_name, 'feature/')
+
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
+        wget --header="Authorization: token ${GITHUB_TOKEN}" -O /tmp/repo.tar.gz "$archive_url"
+        tar -xzf /tmp/repo.tar.gz --strip-components=1 -C .
+        rm -f /tmp/repo.tar.gz
+
+    - name: Build staging web artifact
+      shell: sh
+      run: |
+        set -eu
+        docker run --rm \
+          --pull=never \
+          -v "$PWD:/workspace" \
+          -w /workspace/apps/web \
+          docker.m.daocloud.io/library/node:20 \
+          sh -lc 'npm ci && npm run build'
+        docker build --pull=false \
+          -f infra/docker/web-artifact.Dockerfile \
+          -t "xiaoxia-saas-web:staging-${GITHUB_SHA}" \
+          .
+        test -f apps/web/dist/index.html
+
+    - name: Package staging release artifact
+      shell: sh
+      run: |
+        set -eu
+        rm -rf dist/staging-artifacts
+        mkdir -p dist/staging-artifacts
+        tar --exclude=.git --exclude=apps/web/node_modules --exclude=./dist \
+          -czf dist/staging-artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz .
+        docker save -o "dist/staging-artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar" "xiaoxia-saas-web:staging-${GITHUB_SHA}"
+
+    - name: Upload staging artifact to business host
+      shell: sh
+      env:
+        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
+      run: |
+        set -eu
+        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
+        staging_user="${STAGING_SSH_USER:-root}"
+        mkdir -p ~/.ssh
+        if [ -n "${STAGING_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+          printf '%s\n' "$STAGING_SSH_KEY" > "$key_path"
+          chmod 600 "$key_path"
+        else
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+          test -f "$key_path"
+        fi
+        ssh-keyscan -H "$staging_host" >> ~/.ssh/known_hosts
+        ssh -i "$key_path" "$staging_user@$staging_host" "mkdir -p /var/lib/xiaoxia-saas-staging/artifacts"
+        scp -i "$key_path" "dist/staging-artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz" \
+          "$staging_user@$staging_host:/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz"
+        scp -i "$key_path" "dist/staging-artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar" \
+          "$staging_user@$staging_host:/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar"
+
+    - name: Deploy staging stack on business host
+      shell: sh
+      env:
+        STAGING_SSH_HOST: ${{ secrets.STAGING_SSH_HOST }}
+        STAGING_SSH_USER: ${{ secrets.STAGING_SSH_USER }}
+        STAGING_SSH_KEY: ${{ secrets.STAGING_SSH_KEY }}
+      run: |
+        set -eu
+        staging_host="${STAGING_SSH_HOST:-47.98.113.167}"
+        staging_user="${STAGING_SSH_USER:-root}"
+        if [ -n "${STAGING_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+        else
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+        fi
+        ssh -i "$key_path" "$staging_user@$staging_host" "GITHUB_SHA='${GITHUB_SHA}' sh -s" <<'REMOTE_DEPLOY'
+        set -eu
+        artifact="/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-staging-${GITHUB_SHA}.tar.gz"
+        image_tar="/var/lib/xiaoxia-saas-staging/artifacts/xiaoxia-web-staging-${GITHUB_SHA}.tar"
+        test -f "$artifact"
+        test -f "$image_tar"
+        test -f /var/lib/xiaoxia-saas-staging/.env
+        docker load -i "$image_tar"
+        rm -rf /var/lib/xiaoxia-saas-staging/repo
+        mkdir -p /var/lib/xiaoxia-saas-staging/repo
+        tar -xzf "$artifact" -C /var/lib/xiaoxia-saas-staging/repo
+        test -f /var/lib/xiaoxia-saas-staging/repo/apps/web/dist/index.html
+        cp /var/lib/xiaoxia-saas-staging/.env /var/lib/xiaoxia-saas-staging/repo/.env
+        chmod +x /var/lib/xiaoxia-saas-staging/repo/infra/docker/deploy-staging.sh
+        WEB_IMAGE="xiaoxia-saas-web:staging-${GITHUB_SHA}" HOST_PREFIX= WEB_PORT=3001 REBUILD_BACKEND=0 BUILD_WEB=0 RUN_MIGRATIONS=0 /var/lib/xiaoxia-saas-staging/repo/infra/docker/deploy-staging.sh
+        i=0
+        while [ "$i" -lt 30 ]; do
+          if wget -qO- http://127.0.0.1:8000/health; then
+            exit 0
+          fi
+          i=$((i + 1))
+          sleep 2
+        done
+        exit 1
+REMOTE_DEPLOY
+
+  build-production-runtime-images:
+    name: Build Production Runtime Images
+    runs-on: runtime-builder:host
+    if: startsWith(github.ref, 'refs/tags/v')
+
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
+        wget --header="Authorization: token ${GITHUB_TOKEN}" -O /tmp/repo.tar.gz "$archive_url"
+        tar -xzf /tmp/repo.tar.gz --strip-components=1 -C .
+        rm -f /tmp/repo.tar.gz
+
+    - name: Build runtime image artifact
+      shell: sh
+      run: |
+        set -eu
+        chmod +x scripts/build_release_images.sh
+        scripts/build_release_images.sh "${GITHUB_REF_NAME}"
+
+    - name: Build production web artifact
+      shell: sh
+      run: |
+        set -eu
+        docker run --rm \
+          --pull=never \
+          -v "$PWD:/workspace" \
+          -w /workspace/apps/web \
+          docker.m.daocloud.io/library/node:20 \
+          sh -lc 'npm ci && npm run build'
+        docker build --pull=false \
+          -f infra/docker/web-artifact.Dockerfile \
+          -t "xiaoxia-saas-web:${GITHUB_REF_NAME}" \
+          .
+        test -f apps/web/dist/index.html
+
+    - name: Package release source artifact
+      shell: sh
+      run: |
+        set -eu
+        mkdir -p dist/release-artifacts
+        tar --exclude=.git --exclude=apps/web/node_modules --exclude=./dist \
+          -czf "dist/release-artifacts/xiaoxia-release-${GITHUB_REF_NAME}.tar.gz" .
+        docker save -o "dist/release-artifacts/xiaoxia-web-${GITHUB_REF_NAME}.tar" "xiaoxia-saas-web:${GITHUB_REF_NAME}"
+
+    - name: Upload runtime image and release artifacts
+      shell: sh
+      env:
+        PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
+        PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
+        PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
+      run: |
+        set -eu
+        production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
+        production_user="${PRODUCTION_SSH_USER:-root}"
+        mkdir -p ~/.ssh
+        if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+          printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
+          chmod 600 "$key_path"
+        else
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+          test -f "$key_path"
+        fi
+        ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts
+        scp -i "$key_path" "dist/release-images/xiaoxia-runtime-images-${GITHUB_REF_NAME}.tar" \
+          "$production_user@$production_host:/var/lib/xiaoxia-saas-production/runtime-images-${GITHUB_REF_NAME}.tar"
+        scp -i "$key_path" "dist/release-artifacts/xiaoxia-release-${GITHUB_REF_NAME}.tar.gz" \
+          "$production_user@$production_host:/var/lib/xiaoxia-saas-production/release-${GITHUB_REF_NAME}.tar.gz"
+        scp -i "$key_path" "dist/release-artifacts/xiaoxia-web-${GITHUB_REF_NAME}.tar" \
+          "$production_user@$production_host:/var/lib/xiaoxia-saas-production/web-${GITHUB_REF_NAME}.tar"
+
+  deploy-production:
+    name: Deploy Production
+    runs-on: runtime-builder:host
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: build-production-runtime-images
+
+    steps:
+    - name: Deploy production over SSH
+      shell: sh
+      env:
+        PRODUCTION_SSH_HOST: ${{ secrets.PRODUCTION_SSH_HOST }}
+        PRODUCTION_SSH_USER: ${{ secrets.PRODUCTION_SSH_USER }}
+        PRODUCTION_SSH_KEY: ${{ secrets.PRODUCTION_SSH_KEY }}
+      run: |
+        set -eu
+        production_host="${PRODUCTION_SSH_HOST:-47.98.113.167}"
+        production_user="${PRODUCTION_SSH_USER:-root}"
+        mkdir -p ~/.ssh
+        if [ -n "${PRODUCTION_SSH_KEY:-}" ]; then
+          key_path="$HOME/.ssh/id_ed25519"
+          printf '%s\n' "$PRODUCTION_SSH_KEY" > "$key_path"
+          chmod 600 "$key_path"
+        else
+          key_path="/root/.ssh/xiaoxia_runtime_builder"
+          test -f "$key_path"
+        fi
+        ssh-keyscan -H "$production_host" >> ~/.ssh/known_hosts
+        ssh -i "$key_path" "$production_user@$production_host" \
+          "RELEASE_VERSION='${GITHUB_REF_NAME}' sh -s" <<'REMOTE_DEPLOY'
+        set -eu
+        release_tar="/var/lib/xiaoxia-saas-production/release-${RELEASE_VERSION}.tar.gz"
+        test -f "$release_tar"
+        test -f "/var/lib/xiaoxia-saas-production/runtime-images-${RELEASE_VERSION}.tar"
+        test -f "/var/lib/xiaoxia-saas-production/web-${RELEASE_VERSION}.tar"
+        mkdir -p /var/lib/xiaoxia-saas-production
+        old_assets_dir="/tmp/xiaoxia-previous-web-assets-${RELEASE_VERSION}"
+        rm -rf "$old_assets_dir"
+        mkdir -p "$old_assets_dir"
+        if docker inspect xiaoxia-web-production >/dev/null 2>&1; then
+          docker cp xiaoxia-web-production:/usr/share/nginx/html/assets/. "$old_assets_dir"/ 2>/dev/null || true
+        fi
+        if [ -d /var/lib/xiaoxia-saas-production/repo/apps/web/dist/assets ]; then
+          cp -a /var/lib/xiaoxia-saas-production/repo/apps/web/dist/assets/. "$old_assets_dir"/
+        fi
+        rm -rf /var/lib/xiaoxia-saas-production/repo
+        mkdir -p /var/lib/xiaoxia-saas-production/repo
+        tar -xzf "$release_tar" -C /var/lib/xiaoxia-saas-production/repo
+        test -f /var/lib/xiaoxia-saas-production/repo/apps/web/dist/index.html
+        if [ -d "$old_assets_dir" ]; then
+          mkdir -p /var/lib/xiaoxia-saas-production/repo/apps/web/dist/assets
+          for asset in "$old_assets_dir"/*; do
+            [ -e "$asset" ] || continue
+            name="$(basename "$asset")"
+            if [ ! -e "/var/lib/xiaoxia-saas-production/repo/apps/web/dist/assets/$name" ]; then
+              cp -a "$asset" "/var/lib/xiaoxia-saas-production/repo/apps/web/dist/assets/$name"
+            fi
+          done
+          rm -rf "$old_assets_dir"
+        fi
+        test -f /var/lib/xiaoxia-saas-production/.env
+        cp /var/lib/xiaoxia-saas-production/.env /var/lib/xiaoxia-saas-production/repo/.env
+        HOST_PREFIX= WEB_IMAGE="xiaoxia-saas-web:${RELEASE_VERSION}" WEB_IMAGE_TAR="/var/lib/xiaoxia-saas-production/web-${RELEASE_VERSION}.tar" sh /var/lib/xiaoxia-saas-production/repo/infra/docker/deploy-production.sh
+        i=0
+        while [ "$i" -lt 30 ]; do
+          if wget -qO- http://127.0.0.1:8001/health; then
+            exit 0
+          fi
+          i=$((i + 1))
+          sleep 2
+        done
+        exit 1
+REMOTE_DEPLOY
+
+  production-e2e:
+    name: Production Browser E2E
+    runs-on: runtime-builder:host
+    if: startsWith(github.ref, 'refs/tags/v')
+    needs: deploy-production
+
+    steps:
+    - name: Checkout code
+      shell: sh
+      env:
+        GITHUB_TOKEN: ${{ github.token }}
+      run: |
+        set -eu
+        archive_url="${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/archive/${GITHUB_SHA}.tar.gz"
+        wget --header="Authorization: token ${GITHUB_TOKEN}" -O /tmp/repo.tar.gz "$archive_url"
+        tar -xzf /tmp/repo.tar.gz --strip-components=1 -C .
+        rm -f /tmp/repo.tar.gz
+
+    - name: Run production browser E2E
+      shell: sh
+      run: |
+        set -eu
+        docker run --rm \
+          -e E2E_BASE_URL=https://saas.xiaoxiajianji.com \
+          -e E2E_API_BASE=https://api.xiaoxiajianji.com/api/v1 \
+          -e E2E_BROWSER_CHANNEL=chromium \
+          -v "$PWD:/workspace" \
+          -w /workspace/apps/web \
+          mcr.microsoft.com/playwright:v1.45.0-jammy \
+          sh -lc 'npm ci && npx playwright test --reporter=line --project=chromium e2e/core-upload.spec.ts e2e/core-generation.spec.ts e2e/core-titles.spec.ts'

.gitea/workflows/downgrade-runners.yml

@@ -0,0 +1,17 @@
+name: Downgrade New Runners to v0.2.6
+
+on:
+  push:
+    branches:
+      - ops/downgrade-runners
+  workflow_dispatch:
+
+jobs:
+  downgrade:
+    runs-on: saas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      
+      - name: Downgrade all runners to v0.2.6 host mode
+        run: python3 scripts/downgrade_v026.py

.gitea/workflows/find-builder-ip.yml

@@ -0,0 +1,55 @@
+name: Find Builder IP & Check Gitea Logs
+
+on:
+  workflow_dispatch:
+
+jobs:
+  find-and-check:
+    runs-on: saas
+    steps:
+      - name: Find builder IP and check Gitea
+        shell: sh
+        run: |
+          set -eu
+
+          # 写入SSH密钥
+          mkdir -p ~/.ssh
+          cat > ~/.ssh/id_ed25519 << 'KEYEOF'
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbAAAAJiQxGNokMRj
+aAAAAAtzc2gtZWQyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbA
+AAAED2muzuU4BAiCqbg0ayGxgiDvfS/xI1SFvb32oLzTnn8/oaq4CTm8ER9u1okJNJ+dAS
+GPMLx7kYXrSFJs8/QElsAAAAFHJ1bm5lci1hZG1pbkB4aWFveGlhAQ==
+-----END OPENSSH PRIVATE KEY-----
+KEYEOF
+          chmod 600 ~/.ssh/id_ed25519
+          cat > ~/.ssh/config << 'CFGEOF'
+          Host *
+            StrictHostKeyChecking no
+            UserKnownHostsFile /dev/null
+          CFGEOF
+          chmod 600 ~/.ssh/config
+
+          echo "=== 1. 查看当前Runner所在服务器 ==="
+          hostname
+          ip addr show | grep inet | head -10
+
+          echo ""
+          echo "=== 2. 查找Gitea服务器内网IP ==="
+          # 从Gitea URL解析
+          nslookup git.xiaoxiajianji.com 2>/dev/null || dig git.xiaoxiajianji.com 2>/dev/null || echo "dns tools not available"
+          
+          # 试试常见的内网IP
+          for ip in 172.30.18.1 172.30.18.10 172.30.18.100 172.30.18.178 172.30.18.200; do
+            echo -n "  测试 $ip: "
+            timeout 2 bash -c "echo > /dev/tcp/$ip/22" 2>/dev/null && echo "22端口通" || echo "不通"
+          done
+
+          echo ""
+          echo "=== 3. 查看路由表 ==="
+          ip route 2>/dev/null || route -n 2>/dev/null || echo "no route command"
+          
+          echo ""
+          echo "=== 4. 查看ARP表 ==="
+          arp -an 2>/dev/null | head -10 || ip neigh 2>/dev/null | head -10 || echo "no arp"

.gitea/workflows/fix-new-server-env.yml

@@ -0,0 +1,17 @@
+name: Fix New Server Env (Node.js via CMD Agent)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  fix:
+    runs-on: saas
+    steps:
+      - name: Fix new server env via CMD Agent
+        shell: sh
+        run: |
+          set -eu
+          curl -sL -H "Authorization: token ${GITHUB_TOKEN}" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/contents/scripts/fix_new_server_env.py?ref=ops/downgrade-runners" \
+            | python3 -c "import json,sys,base64; d=json.load(sys.stdin); open('/tmp/fix.py','w').write(base64.b64decode(d['content']).decode())"
+          python3 /tmp/fix.py

.gitea/workflows/fix-python310-direct.yml

@@ -0,0 +1,97 @@
+name: Install Python 3.10 - Direct SSH (no checkout)
+
+on:
+  workflow_dispatch:
+
+jobs:
+  install-python310:
+    runs-on: saas
+    steps:
+      - name: Install Python 3.10 on new server via SSH
+        run: |
+          # --- 内嵌SSH密钥 ---
+          cat > /tmp/new_server_key << 'KEYEOF'
+          -----BEGIN OPENSSH PRIVATE KEY-----
+          b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+          QyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbAAAAJiQxGNokMRj
+          aAAAAAtzc2gtZWQyNTUxOQAAACD6GquAk5vBEfbtaJCTSfnQEhjzC8e5GF60hSbPP0BJbA
+          AAAED2muzuU4BAiCqbg0ayGxgiDvfS/xI1SFvb32oLzTnn8/oaq4CTm8ER9u1okJNJ+dAS
+          GPMLx7kYXrSFJs8/QElsAAAAFHJ1bm5lci1hZG1pbkB4aWFveGlhAQ==
+          -----END OPENSSH PRIVATE KEY-----
+          KEYEOF
+          chmod 600 /tmp/new_server_key
+          
+          S="ssh -i /tmp/new_server_key -o StrictHostKeyChecking=no -o ConnectTimeout=10 -o ServerAliveInterval=60 root@172.30.18.199"
+          
+          echo "=== 步骤0: 检查当前Python版本 ==="
+          $S 'export PATH=/usr/local/bin:$PATH; python3 --version 2>&1; pip3 --version 2>&1 || true'
+          
+          # 检查是否已安装Python 3.10
+          if $S 'export PATH=/usr/local/bin:$PATH; python3 --version 2>&1 | grep -q 3.10' 2>/dev/null; then
+            echo "Python 3.10 已安装，跳过编译"
+            SKIP_BUILD=1
+          else
+            SKIP_BUILD=0
+          fi
+          
+          if [ "$SKIP_BUILD" = "0" ]; then
+            echo ""
+            echo "=== 步骤1: 安装编译依赖 ==="
+            $S 'yum install -y gcc gcc-c++ make openssl-devel bzip2-devel libffi-devel zlib-devel readline-devel sqlite-devel wget git 2>&1 | tail -3'
+            
+            echo ""
+            echo "=== 步骤2: 下载Python 3.10.14源码（多源重试+校验） ==="
+            $S 'cd /tmp && rm -f Python-3.10.14.tgz && \
+              for url in \
+                "https://mirrors.huaweicloud.com/python/3.10.14/Python-3.10.14.tgz" \
+                "https://npmmirror.com/mirrors/python/3.10.14/Python-3.10.14.tgz" \
+                "https://registry.npmmirror.com/-/binary/python/3.10.14/Python-3.10.14.tgz" \
+                "https://www.python.org/ftp/python/3.10.14/Python-3.10.14.tgz"; do \
+                echo "Trying: $url"; \
+                wget -q --timeout=30 --tries=2 -O Python-3.10.14.tgz "$url" && \
+                gzip -t Python-3.10.14.tgz 2>/dev/null && \
+                SIZE=$(stat -c%s Python-3.10.14.tgz 2>/dev/null || stat -f%z Python-3.10.14.tgz 2>/dev/null) && \
+                if [ "$SIZE" -gt 20000000 ]; then echo "download_ok: $SIZE bytes"; break; else echo "too small: $SIZE, retrying..."; fi; \
+              done'
+            
+            echo ""
+            echo "=== 步骤3: 解压并编译安装 ==="
+            $S 'cd /tmp && rm -rf Python-3.10.14 && tar xzf Python-3.10.14.tgz && echo extract_ok'
+            $S 'cd /tmp/Python-3.10.14 && ./configure --prefix=/usr/local --with-ensurepip=install 2>&1 | tail -3'
+            echo "开始编译（约5-10分钟）..."
+            $S 'cd /tmp/Python-3.10.14 && make -j$(nproc) > /tmp/python_make.log 2>&1 && echo make_ok || (tail -20 /tmp/python_make.log; echo make_failed; exit 1)'
+            $S 'cd /tmp/Python-3.10.14 && make altinstall 2>&1 | tail -5'
+            
+            echo ""
+            echo "=== 步骤4: 设置为默认python3和pip3 ==="
+            $S 'ln -sf /usr/local/bin/python3.10 /usr/local/bin/python3 && ln -sf /usr/local/bin/pip3.10 /usr/local/bin/pip3 && echo link_ok'
+          fi
+          
+          echo ""
+          echo "=== 步骤5: 验证Python 3.10 ==="
+          $S 'export PATH=/usr/local/bin:$PATH; python3 --version; pip3 --version; pip3 install --help 2>&1 | grep -q break-system-packages && echo "pip3 supports --break-system-packages" || echo "WARNING: no --break-system-packages"'
+          
+          echo ""
+          echo "=== 步骤6: 安装git ==="
+          $S 'which git 2>/dev/null || (yum install -y git 2>&1 | tail -3)'
+          $S 'git --version 2>&1'
+          
+          echo ""
+          echo "=== 步骤7: 修复CMD Agent端口 5000->5927 ==="
+          $S 'cd /opt/cmd-agent && sed -i "s/port=5000/port=5927/g; s/port = 5000/port = 5927/g; s/\"5000\"/\"5927\"/g" server.py 2>&1; echo sed_done'
+          $S 'systemctl daemon-reload; systemctl restart cmd-agent 2>&1; sleep 2; systemctl is-active cmd-agent'
+          $S '(ss -tlnp 2>/dev/null | grep 5927) || (netstat -tlnp 2>/dev/null | grep 5927) || echo "port 5927 not found, checking 5000..."; (ss -tlnp 2>/dev/null | grep 5000) || (netstat -tlnp 2>/dev/null | grep 5000) || echo "no cmd-agent port listening"'
+          
+          echo ""
+          echo "=== 步骤8: 重启6个Runner ==="
+          $S 'for i in 1 2 3 4 5 6; do systemctl restart act-runner-$i.service 2>/dev/null && echo "runner-$i restarted" || systemctl restart gitea-runner-$i.service 2>/dev/null && echo "runner-$i restarted(old)" || echo "runner-$i not found"; done'
+          
+          echo ""
+          echo "=== 步骤9: 最终验证 ==="
+          $S 'echo "--- Python ---"; export PATH=/usr/local/bin:$PATH; python3 --version; pip3 --version'
+          $S 'echo "--- Git ---"; git --version 2>&1'
+          $S 'echo "--- CMD Agent ---"; systemctl is-active cmd-agent'
+          $S 'echo "--- Runners ---"; systemctl list-units "act-runner-*.service" --no-legend 2>/dev/null | head -6 || systemctl list-units "gitea-runner-*.service" --no-legend 2>/dev/null | head -6'
+          
+          echo ""
+          echo "=== 全部完成 ==="

.gitea/workflows/fix-python310.yml

@@ -0,0 +1,20 @@
+name: Install Python 3.10 on New Server
+
+on:
+  push:
+    branches:
+      - ops/downgrade-runners
+    paths:
+      - '.gitea/workflows/fix-python310.yml'
+      - 'scripts/install_python310.py'
+  workflow_dispatch:
+
+jobs:
+  install-python310:
+    runs-on: saas
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      
+      - name: Install Python 3.10 on new server
+        run: python3 scripts/install_python310.py

.gitea/workflows/install-cmd-agent.yml

@@ -0,0 +1,24 @@
+name: Install CMD Agent + Node.js on New Server (via SSH)
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - ops/downgrade-runners
+    paths:
+      - '.gitea/workflows/install-cmd-agent.yml'
+      - 'scripts/install_cmd_agent.py'
+
+jobs:
+  install:
+    runs-on: saas
+    steps:
+      - name: Install CMD Agent + Node.js via SSH
+        shell: sh
+        run: |
+          set -eu
+          # 下载脚本
+          curl -sL -H "Authorization: token ${GITHUB_TOKEN}" \
+            "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/contents/scripts/install_cmd_agent.py?ref=ops/downgrade-runners" \
+            | python3 -c "import json,sys,base64; d=json.load(sys.stdin); open('/tmp/install.py','w').write(base64.b64decode(d['content']).decode())"
+          python3 /tmp/install.py

.github/workflows/ci-cd.yml

@@ -1,96 +0,0 @@
-name: CI/CD Pipeline
-
-on:
-  push:
-    branches:
-      - main
-      - develop
-      - 'feature/**'
-      - 'bugfix/**'
-      - 'hotfix/**'
-      - 'release/**'
-  pull_request:
-    branches:
-      - main
-      - develop
-
-jobs:
-  validate:
-    name: Validate Code Quality And Tests
-    runs-on: ubuntu-latest
-    container: xiaoxia-ci-python:3.12
-
-    steps:
-      - name: Checkout code
-        run: |
-          python - <<'PY'
-          import os
-          import tarfile
-          import urllib.request
-
-          api_url = os.environ['GITHUB_API_URL']
-          repository = os.environ['GITHUB_REPOSITORY']
-          sha = os.environ['GITHUB_SHA']
-          token = os.environ.get('GITHUB_TOKEN', '')
-          archive_url = f"{api_url}/repos/{repository}/archive/{sha}.tar.gz"
-          request = urllib.request.Request(archive_url)
-          if token:
-              request.add_header('Authorization', f'token {token}')
-          with urllib.request.urlopen(request, timeout=120) as response:
-              with open('/tmp/repo.tar.gz', 'wb') as archive:
-                  archive.write(response.read())
-          with tarfile.open('/tmp/repo.tar.gz', 'r:gz') as archive:
-              members = archive.getmembers()
-              top_level = members[0].name.split('/')[0] + '/'
-              for member in members:
-                  member.name = member.name.removeprefix(top_level)
-                  if member.name:
-                      archive.extract(member, '.')
-          PY
-
-      - name: Verify CI environment
-        run: |
-          python --version
-          python -m pip --version
-          python -m black --version
-          python -m isort --version-number
-          python -m flake8 --version
-          bandit --version
-          pytest --version
-          echo "✅ Prebuilt CI environment is ready"
-
-      - name: Run code quality checks
-        run: |
-          python -m compileall -q alembic apps packages tests scripts
-          python -m black --check alembic apps packages tests scripts
-          python -m isort --check-only alembic apps packages tests scripts
-          python -m flake8 apps packages tests --count --statistics
-
-      - name: Run security scan
-        run: |
-          bandit -r apps packages -q
-
-      - name: Validate release scripts syntax
-        run: |
-          bash -n scripts/backup_postgres.sh
-          bash -n scripts/restore_postgres_plan.sh
-          bash -n scripts/init_production_env.sh
-
-      - name: Validate Alembic migrations
-        run: |
-          DATABASE_URL=postgresql+psycopg://postgres:postgres@localhost:5432/xiaoxia_saas \
-            python -m alembic upgrade head --sql > /tmp/alembic-upgrade.sql
-          test -s /tmp/alembic-upgrade.sql
-          grep -q "Running upgrade" /tmp/alembic-upgrade.sql
-          python scripts/check_schema_metadata.py
-
-      - name: Run tests
-        run: |
-          python -m pytest tests -q
-
-      - name: Build summary
-        if: github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main'
-        run: |
-          echo "✅ Build completed successfully!"
-          echo "Branch: ${GITHUB_REF_NAME}"
-          echo "Commit: ${GITHUB_SHA}"

.github/workflows/release.yml

@@ -1,74 +0,0 @@
-name: Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-
-jobs:
-  create-release:
-    name: Create Release
-    runs-on: ubuntu-latest
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-      with:
-        fetch-depth: 0
-    
-    - name: Generate changelog
-      id: changelog
-      run: |
-        # Extract changelog for this version
-        VERSION=${GITHUB_REF#refs/tags/}
-        echo "version=$VERSION" >> $GITHUB_OUTPUT
-    
-    - name: Create Release
-      uses: actions/create-release@v1
-      env:
-        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      with:
-        tag_name: ${{ github.ref }}
-        release_name: Release ${{ steps.changelog.outputs.version }}
-        body: |
-          See [CHANGELOG.md](https://github.com/${{ github.repository }}/blob/main/CHANGELOG.md) for details.
-        draft: false
-        prerelease: false
-
-  build-and-push:
-    name: Build and Push Docker Image
-    runs-on: ubuntu-latest
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
-    
-    - name: Log in to Docker Hub
-      uses: docker/login-action@v3
-      with:
-        username: ${{ secrets.DOCKER_USERNAME }}
-        password: ${{ secrets.DOCKER_PASSWORD }}
-    
-    - name: Extract metadata
-      id: meta
-      uses: docker/metadata-action@v5
-      with:
-        images: xiaoxia/saas
-        tags: |
-          type=semver,pattern={{version}}
-          type=semver,pattern={{major}}.{{minor}}
-          type=semver,pattern={{major}}
-          type=raw,value=latest
-    
-    - name: Build and push
-      uses: docker/build-push-action@v5
-      with:
-        context: .
-        push: true
-        tags: ${{ steps.meta.outputs.tags }}
-        labels: ${{ steps.meta.outputs.labels }}
-        cache-from: type=gha
-        cache-to: type=gha,mode=max

.github/workflows/security.yml

@@ -1,59 +0,0 @@
-name: Security Scan
-
-on:
-  push:
-    branches: [ main, develop ]
-  pull_request:
-    branches: [ main ]
-  schedule:
-    # Run every Monday at 00:00 UTC
-    - cron: '0 0 * * 1'
-
-jobs:
-  security-scan:
-    name: Security Scan
-    runs-on: ubuntu-latest
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    
-    - name: Set up Python
-      uses: actions/setup-python@v4
-      with:
-        python-version: '3.12'
-    
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        pip install safety bandit
-    
-    - name: Check for known security vulnerabilities
-      run: |
-        pip install -r requirements.txt
-        safety check --json
-    
-    - name: Run Bandit security linter
-      run: |
-        bandit -r packages/ apps/ -f json -o bandit-report.json || true
-        cat bandit-report.json
-    
-    - name: Upload security reports
-      uses: actions/upload-artifact@v3
-      if: always()
-      with:
-        name: security-reports
-        path: |
-          bandit-report.json
-
-  dependency-review:
-    name: Dependency Review
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request'
-    
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v4
-    
-    - name: Dependency Review
-      uses: actions/dependency-review-action@v3

.gitignore

@@ -6,7 +6,6 @@ dist/
 coverage/
 
 # Python / backend
-.cache/
 .venv/
 venv/
 .venv-ci-root/
@@ -21,9 +20,9 @@ ruff_cache/
 .env
 .env.local
 .env.development
-.env.production
-.env.staging
+.env.production  # 生产环境配置不提交（包含敏感信息）
 !.env.example
+!.env.staging  # staging 配置可以提交
 
 # OS / editor
 .DS_Store
@@ -48,4 +47,5 @@ build/
 # Tracker temp files
 tracker_tasks.json
 
-frontend-v21-ui-prototype-final.html
+# Schema metadata snapshot
+schema-metadata-snapshot.json

BUILD_TRIGGER.txt

@@ -1 +0,0 @@
-TRIGGER: 2026-06-25 16:20:18

CHANGELOG.md

@@ -1,276 +1,19 @@
-## [v0.1.110] - 2026-07-03
+# Changelog
 
-### 🔒 安全修复
+All notable changes to this project will be documented in this file.
 
-- 注册登录接口添加 RateLimitMiddleware 防止暴力破解
-- JWT logout 黑名单机制，防止令牌重放攻击
-- 生产环境禁用 Swagger 文档防止信息泄露
-- `/metrics` 端点添加 Bearer Token 认证
-- 禁用 SVG 上传防止 XSS 风险
-- 删除 `decode_token_unsafe()` 方法，消除不安全的 JWT 解码
-- 移除遗留 `tasks.py` 消除 Celery 任务名冲突
-- 清理全局 `except:pass`（22处）改为 `logger.warning` 记录异常
-
-### ✨ 功能
-
-- 添加剪辑计划时间线场景 API (`GET /edit-plans/{id}/timeline`)
-- 前端对接真实 API 替换 mock 数据
-
-### 🐛 Bug 修复
-
-- **[P1]** 修复登录故障 — `password_hasher` 导入错误
-- 订阅续费事务修复 — 支付回调在数据库事务中更新订阅状态
-- 账单返回空数组修复 — 从数据库查询账单记录
-- 修复 `Image.open()` 资源泄漏
-- 清理已移除 workspace 概念的残留引用
-- 修复 AssetLibrary/TemplateLibrary 类型错误
-- 修复前端 workspace 残留导致项目创建失败
-- 永久修复 nginx `proxy_pass` 配置
-- 添加 Docker DNS resolver 防止 API 容器重启后 502
-- 修复 worker healthcheck YAML 语法
-- 修复 204 响应体断言崩溃
-- 修复 Alembic 元数据漂移检测
-- 修复 migration 009 DEFAULT 表达式 PostgreSQL 兼容性
-
-### 🔄 重构与清理
-
-- 后端代码清理 — 移除死代码和无用文件
-- 前端代码清理 — 移除无用代码和遗留 demo
-- 代码精简优化 — 移除无用代码和重复定义
-- 后端代码 black/isort 格式化
-
-### 🧪 测试
-
-- 完善 E2E 错误场景测试，Playwright 接入 CI
-- API 集成测试补充（145 项通过）
-- 添加核心流程 E2E 测试
-
-### 🚀 CI/CD & 基础设施
-
-- Validate 阶段添加 PostgreSQL 服务支持
-- 所有 workflow checkout 添加 5 次指数退避重试
-- 启用 BuildKit 分布式缓存 + Gitea Registry 优化构建速度
-- Deploy 阶段全面修复（E2E 服务器/Worker venv/Registry 登录）
-- Docker 网络隔离 staging/production 环境
-- 修复 CI 代码质量检查（black/flake8/bandit）
-
----
-
-## [v0.1.88] - 2026-06-29
-
-### Phase 2 前端优化 - 完成 ✅
-
-**前端交互全面优化:**
-
-- 素材上传添加 project_id 参数
-- Drager 组件显示上传列表
-- 按钮防重复提交
-- 前端交互状态反馈补充（P0 第一批）
-
----
-
-## [v0.1.87] - 2026-06-29
-
-### Bug 修复
-
-- Docker compose 修复 mem_limit 冲突
-
----
-
-## [v0.1.86] - 2026-06-29
-
-### CI/CD 优化
-
-- CI 优化
-
----
-
-## [v0.1.85] - 2026-06-29
-
-### CI/CD 优化
-
-- CI 优化
-
----
-
-## [v0.1.84] - 2026-06-29
-
-### CI/CD 优化
-
-- CI runner label 匹配修复
-
----
-
-## [v0.1.83] - 2026-06-29
-
-### CI/CD 优化
-
-- CI SSH debug 修正
-
----
-
-## [v0.1.82] - 2026-06-29
-
-### CI/CD 优化
-
-- CI SSH debug 修正
-
----
-
-## [v0.1.81] - 2026-06-29
-
-### CI/CD 优化
-
-- CI runner label 匹配修复
-
----
-
-## [v0.1.80] - 2026-06-28
-
-### Bug 修复
-
-- 修复 redirect_slashes + 标题字段匹配
-
----
-
-## [v0.1.79] - 2026-06-28
-
-### Deployment
-
-- Re-trigger deployment
-
----
-
-## [v0.1.78] - 2026-06-28
-
-### Bug 修复
-
-- 修复 500 错误
-- CORS 配置修复
-- redirect_slashes 禁用
-
----
-
-## [v0.1.77] - 2026-06-28
-
-### Bug 修复
-
-- 修复标题库新建/编辑 — 前后端字段名不匹配导致 422
-
----
-
-### Phase 2 功能合并（v0.1.77 ~ v0.1.88）
-
-**新增功能 PR:**
-
-- PR#74: Phase 1 核心重构 — 标题库 API、配音库 API、去 Project 层清理
-- PR#75: Phase 2 查重功能前端页面
-- PR#76: Phase 2 查重功能后端 API（5 个端点）
-- PR#77: Phase 2 订阅管理前端页面
-- PR#78: Phase 2 订阅管理后端 API（5 个端点）
-- PR#79: 修复一键生成页面废弃 API 调用
-- PR#80: 回退域对象 extra_meta → metadata
-- PR#81: 删除查重 API 错误的 204 返回
-- PR#82: 查重上传接口错误信息不再泄露内部异常（安全审计）
-- PR#83: 订阅 + 查重单元测试（63 用例）
-- PR#84: 订阅管理前端对接真实 API
-- PR#85: 禁用 redirect_slashes 修复 307 重定向
-- PR#90: 标题库字段名修复
-- PR#91: 标题/配音创建 500 修复 + CORS
-- PR#94: 素材库新建自动获取默认 project_id
-- PR#97: 前端交互状态反馈全面补充
-
----
-
-
-- Docker compose 修复 mem_limit 冲突
-
----
-
-## [v0.1.86] - 2026-06-29
-
-### CI/CD 优化
-
-- CI 优化
-
----
-
-## [v0.1.85] - 2026-06-29
-
-### CI/CD 优化
-
-- CI 优化
-
----
-
-## [v0.1.84] - 2026-06-29
-
-### CI/CD 优化
-
-- CI runner label 匹配修复
-
----
-
-## [v0.1.83] - 2026-06-29
-
-### CI/CD 优化
-
-- CI SSH debug 修正
-
----
-
-## [v0.1.82] - 2026-06-29
-
-### CI/CD 优化
-
-- CI SSH debug 修正
-
----
-
-## [v0.1.81] - 2026-06-29
-
-### CI/CD 优化
-
-- CI runner label 匹配修复
-
----
-
-## [v0.1.80] - 2026-06-28
-
-### Bug 修复
-
-- 修复 redirect_slashes + 标题字段匹配
-
----
-
-## [v0.1.79] - 2026-06-28
-
-### Deployment
-
-- Re-trigger deployment
-
----
-
-## [v0.1.78] - 2026-06-28
-
-### Bug 修复
-
-- 修复 500 错误
-- CORS 配置修复
-- redirect_slashes 禁用
-
----
-
-## [v0.1.77] - 2026-06-28
-
-### Bug 修复
-
-- 修复标题库新建/编辑 — 前后端字段名不匹配导致 422
-
----
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-06-19
+
+### Phase 7: 核心视频剪辑业务 - 完成 ✅
+
+**完成进度:** 100%  
+**状态:** 已完成并验证
+
 #### Added
 
 **素材管理:**

CODE_OF_CONDUCT.md

@@ -1,43 +0,0 @@
-# Code of Conduct
-
-## Our Pledge
-
-We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
-
-We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
-
-## Our Standards
-
-Examples of behavior that contributes to a positive environment:
-
-* Using welcoming and inclusive language
-* Being respectful of differing viewpoints and experiences
-* Gracefully accepting constructive criticism
-* Focusing on what is best for the community
-* Showing empathy towards other community members
-
-Examples of unacceptable behavior:
-
-* The use of sexualized language or imagery
-* Trolling, insulting/derogatory comments, and personal or political attacks
-* Public or private harassment
-* Publishing others' private information without explicit permission
-* Other conduct which could reasonably be considered inappropriate in a professional setting
-
-## Enforcement Responsibilities
-
-Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
-
-## Scope
-
-This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces.
-
-## Enforcement
-
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at support@xiaoxia-saas.com.
-
-All complaints will be reviewed and investigated promptly and fairly.
-
-## Attribution
-
-This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.0.

COMPLETE_TASK_LIST.md

@@ -1,347 +0,0 @@
-# 小虾 SAAS 完整任务清单
-
-**最后更新：** 2026-06-17 16:35 GMT+8  
-**整理者：** 小虾 🦐
-
----
-
-## 📊 总览
-
-| Phase | 任务总数 | 已完成 | 待完成 | 完成率 |
-|-------|---------|--------|--------|--------|
-| Phase 1-2 | 30 | 30 | 0 | 100% |
-| Phase 3 | 5 | 2 | 3 | 40% |
-| Phase 4 | 68 | 56 | 12 | 82.4% |
-| Phase 5 | 15 | 0 | 15 | 0% |
-| Phase 6 | 40 | 40 | 0 | 100% |
-| Phase 7 | 30 | 0 | 30 | 0% |
-| **总计** | **188** | **128** | **60** | **68.1%** |
-
----
-
-## Phase 1-2: 基础架构与项目管理 (30/30) ✅
-
-### 核心架构 (10/10) ✅
-1. ✅ Clean Architecture 分层设计
-2. ✅ Domain 层实现（实体和值对象）
-3. ✅ Ports 层接口定义
-4. ✅ Application 层用例实现
-5. ✅ Adapters 层适配器实现
-6. ✅ 双持久化实现（InMemory + PostgreSQL）
-7. ✅ Docker Compose 开发环境
-8. ✅ Alembic 数据库迁移
-9. ✅ 依赖注入容器
-10. ✅ 配置管理系统
-
-### 核心业务对象 (10/10) ✅
-11. ✅ User（用户实体）
-12. ✅ Workspace（工作空间实体）
-13. ✅ Project（项目实体）
-14. ✅ AssetLibrary（素材库实体）
-15. ✅ Asset（素材实体）
-16. ✅ IngestJob（入库任务实体）
-17. ✅ ClassificationJob（分类任务实体）
-18. ✅ Task（任务管理实体）
-19. ✅ Milestone（里程碑实体）
-20. ✅ TaskIssue（任务问题实体）
-
-### 核心业务流程 (5/5) ✅
-21. ✅ 上传入库链路
-22. ✅ 分类任务链路
-23. ✅ 异步任务处理（Celery）
-24. ✅ 任务状态跟踪
-25. ✅ 里程碑管理流程
-
-### 基础设施 (5/5) ✅
-26. ✅ MinIO 文件存储
-27. ✅ PostgreSQL 数据库
-28. ✅ Redis 消息队列
-29. ✅ Celery Worker
-30. ✅ 集成测试（17个）
-
----
-
-## Phase 3: 部署与备案 (2/5)
-
-### 部署配置 (2/2) ✅
-1. ✅ 服务器部署（47.98.113.167）
-2. ✅ Nginx 反向代理（8088/8089）
-
-### 备案与域名 (0/3) ⏳
-3. ⏳ 域名备案通过（等待审核）
-4. ⏳ HTTPS 证书申请
-5. ⏳ 切换正式域名
-
----
-
-## Phase 4: SAAS 产品化 (56/68)
-
-### 认证系统 (9/9) ✅
-1. ✅ JWT Service 实现
-2. ✅ Password Hasher 实现
-3. ✅ Redis Session Store
-4. ✅ Email Service 实现
-5. ✅ 用户注册 API
-6. ✅ 邮箱验证 API
-7. ✅ 用户登录 API
-8. ✅ 用户登出 API
-9. ✅ 密码重置 API
-
-### 多租户系统 (9/9) ✅
-10. ✅ 创建工作空间 API
-11. ✅ 邀请成员 API
-12. ✅ 接受/拒绝邀请 API
-13. ✅ 移除成员 API
-14. ✅ 离开工作空间 API
-15. ✅ 更新成员角色 API
-16. ✅ 列出工作空间 API
-17. ✅ 工作空间详情 API
-18. ✅ 列出成员 API
-
-### 权限系统 (3/3) ✅
-19. ✅ Permission Checker
-20. ✅ RBAC 权限模型
-21. ✅ 权限中间件
-
-### 订阅系统 (4/8)
-22. ✅ 订阅计划定义
-23. ✅ 升级订阅 API
-24. ✅ 取消订阅 API
-25. ✅ 配额检查工具
-26. ⏳ 支付宝 SDK 集成
-27. ⏳ 微信支付 SDK 集成
-28. ⏳ 账单生成系统
-29. ⏳ 发票管理
-
-### Repository 层 (13/13) ✅
-30. ✅ UserRepository 接口
-31. ✅ UserRepository InMemory 实现
-32. ✅ UserRepository PostgreSQL 实现
-33. ✅ WorkspaceRepository 接口
-34. ✅ WorkspaceRepository InMemory 实现
-35. ✅ WorkspaceRepository PostgreSQL 实现
-36. ✅ WorkspaceMemberRepository 接口
-37. ✅ WorkspaceMemberRepository InMemory 实现
-38. ✅ WorkspaceMemberRepository PostgreSQL 实现
-39. ✅ WorkspaceInvitationRepository 接口
-40. ✅ WorkspaceInvitationRepository InMemory 实现
-41. ✅ WorkspaceInvitationRepository PostgreSQL 实现
-42. ✅ Database Migration 脚本
-
-### API 层 (9/9) ✅
-43. ✅ FastAPI 路由层
-44. ✅ API 文档（Swagger）
-45. ✅ 错误处理中间件
-46. ✅ 参数验证
-47. ✅ 认证中间件
-48. ✅ 权限中间件
-49. ✅ API 版本管理
-50. ✅ 健康检查接口
-51. ✅ CORS 配置
-
-### 高级功能 (2/8)
-52. ✅ Celery Worker 配置
-53. ✅ Redis 缓存集成
-54. ⏳ 文件上传（OSS）
-55. ⏳ 搜索功能
-56. ⏳ WebSocket 实时通信
-57. ⏳ Webhook 支持
-58. ⏳ 缓存优化
-59. ⏳ 分布式锁
-
-### 测试与 CI/CD (5/7)
-60. ✅ GitHub Actions CI/CD
-61. ✅ 单元测试（170个）
-62. ✅ 集成测试
-63. ✅ 连接池优化
-64. ✅ 性能监控
-65. ⏳ 性能测试
-66. ⏳ 安全测试
-
-### 文档 (6/6) ✅
-67. ✅ API 文档编写
-68. ✅ 部署文档
-69. ✅ 开发文档
-70. ✅ MIT 开源许可
-71. ✅ README 完善
-72. ✅ CONTRIBUTING 指南
-
----
-
-## Phase 5: 支付与商业化 (0/15)
-
-### 支付集成 (0/7)
-1. ⏳ 支付宝 SDK 集成
-2. ⏳ 微信支付 SDK 集成
-3. ⏳ Stripe 国际支付
-4. ⏳ 账单生成系统
-5. ⏳ 发票管理
-6. ⏳ 订阅自动续费
-7. ⏳ 支付回调处理
-
-### 商业功能 (0/8)
-8. ⏳ 优惠券系统
-9. ⏳ 推荐奖励
-10. ⏳ 企业定制套餐
-11. ⏳ 批量购买折扣
-12. ⏳ 退款管理
-13. ⏳ 发票开具
-14. ⏳ 财务报表
-15. ⏳ 营收统计
-
----
-
-## Phase 6: 前端完善 (40/40) ✅
-
-### 项目基础 (7/7) ✅
-1. ✅ Vite + React + TypeScript 初始化
-2. ✅ 配置 package.json
-3. ✅ 基础布局组件
-4. ✅ API 客户端封装
-5. ✅ 路由配置
-6. ✅ 设计系统配置
-7. ✅ TypeScript 类型定义
-
-### 认证系统 (5/5) ✅
-8. ✅ 登录页面
-9. ✅ 注册页面
-10. ✅ 忘记密码页面
-11. ✅ 重置密码页面
-12. ✅ Token 管理和刷新
-
-### 工作空间管理 (6/6) ✅
-13. ✅ 工作空间列表页面
-14. ✅ 工作空间详情页面
-15. ✅ 成员列表和管理
-16. ✅ 邀请成员功能
-17. ✅ 权限矩阵展示
-18. ✅ 工作空间设置
-
-### 订阅管理 (5/5) ✅
-19. ✅ 套餐选择页面
-20. ✅ 升级流程页面
-21. ✅ 配额展示组件
-22. ✅ 账单页面
-23. ✅ 订阅状态显示
-
-### Admin 后台 (5/5) ✅
-24. ✅ Dashboard 仪表盘
-25. ✅ 用户管理页面
-26. ✅ 用户操作功能
-27. ✅ 系统监控页面
-28. ✅ 日志查看器
-
-### 个人中心 (4/4) ✅
-29. ✅ 个人设置页面
-30. ✅ 账号安全设置
-31. ✅ 通知设置
-32. ✅ Session 管理
-
-### 测试与优化 (8/8) ✅
-33. ✅ 单元测试
-34. ✅ E2E 测试
-35. ✅ 测试覆盖率报告
-36. ✅ 性能优化
-37. ✅ 构建优化
-38. ✅ 依赖优化
-39. ✅ CSS 优化
-40. ✅ 生产构建配置
-
----
-
-## Phase 7: 核心业务功能 (0/30)
-
-### 视频处理 (0/10)
-1. ⏳ 视频上传（断点续传）
-2. ⏳ 视频转码（多格式）
-3. ⏳ 视频剪辑（时间轴）
-4. ⏳ 字幕生成（AI）
-5. ⏳ 配音合成（TTS）
-6. ⏳ 特效添加
-7. ⏳ 批量处理
-8. ⏳ 视频预览
-9. ⏳ 视频导出
-10. ⏳ 视频分享
-
-### 素材管理 (0/10)
-11. ⏳ 素材库优化
-12. ⏳ 智能分类
-13. ⏳ 标签管理
-14. ⏳ 搜索优化
-15. ⏳ 版本管理
-16. ⏳ 素材回收站
-17. ⏳ 素材分享
-18. ⏳ 素材导入
-19. ⏳ 素材导出
-20. ⏳ 素材统计
-
-### AI 能力 (0/10)
-21. ⏳ 智能剪辑推荐
-22. ⏳ 场景识别
-23. ⏳ 人物追踪
-24. ⏳ 语音识别
-25. ⏳ 情感分析
-26. ⏳ 自动字幕
-27. ⏳ 自动配音
-28. ⏳ 自动特效
-29. ⏳ AI 脚本生成
-30. ⏳ AI 视频摘要
-
----
-
-## 📈 进度可视化
-
-```
-Phase 1-2: ████████████████████ 100% (30/30)
-Phase 3:   ████░░░░░░░░░░░░░░░░  40% (2/5)
-Phase 4:   ████████████████░░░░  82% (56/68)
-Phase 5:   ░░░░░░░░░░░░░░░░░░░░   0% (0/15)
-Phase 6:   ████████████████████ 100% (40/40)
-Phase 7:   ░░░░░░░░░░░░░░░░░░░░   0% (0/30)
--------------------------------------------
-总体:      █████████████░░░░░░░  68% (128/188)
-```
-
----
-
-## 🎯 优先级排序
-
-### 紧急且重要（立即执行）
-1. Phase 3: 等待备案通过
-2. Phase 4: 支付集成（4个任务）
-3. Phase 4: 文件上传 OSS（1个任务）
-
-### 重要但不紧急（近期规划）
-4. Phase 5: 商业化功能（15个任务）
-5. Phase 7: 视频处理核心功能（10个任务）
-6. Phase 7: AI 能力集成（10个任务）
-
-### 可选优化（后期考虑）
-7. Phase 4: WebSocket、Webhook（2个任务）
-8. Phase 4: 性能测试、安全测试（2个任务）
-9. Phase 7: 素材管理优化（10个任务）
-
----
-
-## 💡 关键决策记录
-
-1. **Phase 1-2 已完全完成**，奠定了坚实的架构基础
-2. **Phase 4 核心功能完成**，系统已生产就绪
-3. **Phase 6 前端 100% 完成**，用户界面完整可用
-4. **Phase 3 阻塞于备案**，等待工信部审核
-5. **Phase 5 和 Phase 7 尚未启动**，等待商业化和核心功能开发
-
----
-
-## 📞 说明
-
-- ✅ = 已完成
-- ⏳ = 待完成
-- 🔄 = 进行中
-
-**老大，这是完整准确的任务清单，共 188 个任务，已完成 128 个（68.1%）！**
-
----
-
-**清单生成时间:** 2026-06-17 16:35 GMT+8  
-**整理者:** 小虾 🦐

CONTRIBUTING.md

@@ -1,305 +0,0 @@
-# 贡献指南
-
-感谢你对小虾 SaaS 项目的兴趣！
-
-## 🚀 快速开始
-
-### 1. Fork 和克隆
-
-```bash
-# Fork 项目到你的账号
-# 然后克隆
-git clone https://github.com/your-username/xiaoxia-saas.git
-cd xiaoxia-saas
-```
-
-### 2. 设置开发环境
-
-```bash
-# 创建虚拟环境
-python -m venv venv
-source venv/bin/activate  # Linux/Mac
-# venv\Scripts\activate  # Windows
-
-# 安装依赖
-pip install -r requirements.txt
-
-# 使用内存数据库（无需 PostgreSQL）
-echo "USE_IN_MEMORY_DB=true" > .env
-
-# 启动开发服务器
-uvicorn apps.api.main:app --reload
-```
-
-### 3. 运行测试
-
-```bash
-# 运行所有测试
-pytest tests/ -v
-
-# 运行单元测试
-pytest tests/unit -v
-
-# 生成覆盖率报告
-pytest --cov=packages --cov-report=html
-```
-
----
-
-## 📝 提交规范
-
-### Commit Message 格式
-
-```
-<type>(<scope>): <subject>
-
-<body>
-
-<footer>
-```
-
-**Type:**
-- `feat`: 新功能
-- `fix`: Bug 修复
-- `docs`: 文档更新
-- `style`: 代码格式（不影响功能）
-- `refactor`: 重构
-- `test`: 测试相关
-- `chore`: 构建/工具相关
-
-**示例:**
-```
-feat(auth): add password reset functionality
-
-- Add RequestPasswordResetUseCase
-- Send reset email with token
-- Implement ResetPasswordUseCase
-- Add unit tests
-
-Closes #123
-```
-
----
-
-## 🏗️ 代码规范
-
-### Python 代码风格
-
-- 遵循 PEP 8
-- 使用类型注解
-- 函数和类添加 docstring
-- 每个文件顶部添加模块说明
-
-### 代码格式化
-
-```bash
-# 安装工具
-pip install black isort
-
-# 格式化代码
-black packages/ apps/ tests/
-isort packages/ apps/ tests/
-```
-
-### 架构原则
-
-- 遵循 Clean Architecture
-- 业务逻辑在 Application 层
-- 基础设施在 Adapters 层
-- 保持层次间依赖方向正确
-
----
-
-## 🧪 测试要求
-
-### 单元测试
-
-- 所有新功能必须有单元测试
-- 测试覆盖率不低于 80%
-- 使用 pytest fixtures
-- Mock 外部依赖
-
-### 测试示例
-
-```python
-def test_create_workspace_success(use_case, mock_repo):
-    \"\"\"测试创建工作空间成功\"\"\"
-    request = CreateWorkspaceRequest(
-        name="Test",
-        owner_user_id="user-123",
-    )
-    
-    response, error = use_case.execute(request)
-    
-    assert error is None
-    assert response.name == "Test"
-```
-
----
-
-## 🔄 Pull Request 流程
-
-### 1. 创建分支
-
-```bash
-# 从 main 创建功能分支
-git checkout -b feat/your-feature-name
-```
-
-### 2. 开发和测试
-
-```bash
-# 编写代码
-# 运行测试
-pytest tests/ -v
-
-# 提交
-git add .
-git commit -m "feat: your feature description"
-```
-
-### 3. 推送和创建 PR
-
-```bash
-# 推送到你的 fork
-git push origin feat/your-feature-name
-
-# 在 GitHub 上创建 Pull Request
-```
-
-### 4. PR 描述模板
-
-```markdown
-## 变更说明
-简要描述此 PR 的目的
-
-## 变更类型
-- [ ] 新功能
-- [ ] Bug 修复
-- [ ] 文档更新
-- [ ] 重构
-- [ ] 其他
-
-## 测试
-- [ ] 添加了单元测试
-- [ ] 所有测试通过
-- [ ] 手动测试通过
-
-## 截图（如适用）
-添加相关截图
-
-## 相关 Issue
-Closes #issue_number
-```
-
----
-
-## 🐛 报告 Bug
-
-### Bug 报告模板
-
-```markdown
-**描述**
-清晰描述 bug
-
-**复现步骤**
-1. 进入 '...'
-2. 点击 '...'
-3. 滚动到 '...'
-4. 看到错误
-
-**期望行为**
-描述期望发生什么
-
-**实际行为**
-描述实际发生了什么
-
-**环境**
-- OS: [e.g. Ubuntu 22.04]
-- Python: [e.g. 3.12]
-- 浏览器: [e.g. Chrome 120]
-
-**额外信息**
-添加任何其他相关信息
-```
-
----
-
-## 💡 功能建议
-
-### 功能请求模板
-
-```markdown
-**功能描述**
-简要描述建议的功能
-
-**问题**
-此功能解决什么问题？
-
-**建议方案**
-描述你期望的解决方案
-
-**替代方案**
-考虑过哪些替代方案？
-
-**额外信息**
-其他相关信息
-```
-
----
-
-## 📚 文档贡献
-
-### 文档类型
-
-- README 和快速开始
-- API 使用指南
-- 部署文档
-- 故障排查
-- 架构说明
-
-### 文档规范
-
-- 使用 Markdown 格式
-- 代码示例使用代码块
-- 添加适当的标题层级
-- 包含实际可运行的示例
-
----
-
-## 🎯 优先级
-
-### 高优先级
-- Bug 修复
-- 安全漏洞修复
-- 性能优化
-- 核心功能增强
-
-### 中优先级
-- 新功能
-- 代码重构
-- 测试增强
-- 文档改进
-
-### 低优先级
-- 代码风格调整
-- 次要功能
-- 实验性功能
-
----
-
-## 📞 联系方式
-
-- **GitHub Issues**: 报告 bug 和功能请求
-- **Pull Requests**: 贡献代码
-- **Email**: support@xiaoxia-saas.com
-
----
-
-## 📄 许可证
-
-贡献的代码将使用与项目相同的许可证。
-
----
-
-感谢你的贡献！🎉

README.md

@@ -1,68 +1,70 @@
-# 小虾 SaaS - 自动化视频剪辑平台
+# 小虾 SaaS - 自动化剪辑 SaaS 平台
 
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Python 3.12+](https://img.shields.io/badge/python-3.12+-blue.svg)](https://www.python.org/downloads/)
 [![FastAPI](https://img.shields.io/badge/FastAPI-0.115.0-009688.svg)](https://fastapi.tiangolo.com)
 [![PostgreSQL](https://img.shields.io/badge/PostgreSQL-16-336791.svg)](https://www.postgresql.org/)
 
-自动化视频剪辑 SaaS 平台，支持素材上传、AI 分类、智能剪辑计划生成、自动化视频合成与成片管理。
+一个功能完整、生产就绪的多租户 SaaS 平台，专为自动化视频剪辑服务设计。
 
 ---
 
-## ✨ 核心功能
+## ✨ 核心特性
 
-### 🎬 视频剪辑主链路
-- 素材上传（直传 OSS + 分片上传大文件，最大 2GB）
-- AI 智能分类与质量评分
-- 4 种剪辑模式：one_take / pip（画中画）/ voice_over（口播+B-roll）/ voice_pip
-- 剪辑计划模板 + 智能生成
-- 自动化视频合成任务（Celery 异步）
-- 成片下载与审核管理
-- 资产诊断（素材就绪度评估、缺口分析）
+### 🎬 视频剪辑主链路（Phase 7 已完成）
+- 素材上传与管理
+- AI 智能分类
+- 自动化视频生成
+- 成片下载与管理
 
-### 🔐 认证系统
-- JWT Bearer Token 认证
-- 邮箱注册 + 邮箱验证
-- 密码重置（邮箱找回）
+### 🔐 完整的认证系统
+- JWT 认证（access + refresh token）
+- 邮箱验证和密码重置
+- Session 管理
 - bcrypt 密码加密
 
-### 📋 项目管理
-- 项目 CRUD + 共享
-- 任务管理（创建/更新/状态流转/进度追踪）
-- 里程碑管理
-- 任务问题追踪
+### 🏢 多租户架构
+- 工作空间隔离
+- 团队成员管理
+- 基于角色的权限控制（Owner/Admin/Member/Viewer）
+- 邀请和审批流程
 
-### 📊 素材库管理
-- 素材库创建与管理
-- 素材上传、审核状态流转（pending_review → approved/rejected）
-- 素材诊断（就绪度评分、缺口分析、智能视图）
+### 💸 订阅管理
+- 3 级订阅计划（Free/Pro/Enterprise）
+- 配额管理（项目数/存储空间）
+- 升级和取消订阅
+
+### ⚡ 高性能
+- 数据库连接池（5-6x 性能提升）
+- 请求日志和监控
+- 慢查询检测
+- 健康检查（Kubernetes 就绪）
 
 ---
 
 ## 🚀 快速开始
 
-### 方式 1: Docker Compose（推荐）
+### 方式 1: Docker（推荐）
 
 ```bash
 # 1. 克隆仓库
-git clone https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas.git
+git clone https://github.com/your-org/xiaoxia-saas.git
 cd xiaoxia-saas
 
-# 2. 配置环境变量
-cp .env.example .env
-# 编辑 .env 填写数据库、Redis、OSS 等配置
-
-# 3. 启动所有服务
+# 2. 启动所有服务
 docker-compose up -d
 
-# 4. 访问 API 文档
+# 3. 访问 API 文档
 open http://localhost:8000/docs
 ```
 
+就这么简单！🎉
+
 ### 方式 2: 本地开发
 
 ```bash
 # 1. 克隆仓库
-git clone https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas.git
+git clone https://github.com/your-org/xiaoxia-saas.git
 cd xiaoxia-saas
 
 # 2. 创建虚拟环境
@@ -72,90 +74,36 @@ source venv/bin/activate  # Windows: venv\Scripts\activate
 # 3. 安装依赖
 pip install -r requirements.txt
 
-# 4. 配置环境变量
-cp .env.example .env
-
-# 5. 启动 API 服务
+# 4. 启动开发服务器
 uvicorn apps.api.main:app --reload
 
-# 6. 访问 API 文档
+# 5. 访问 API 文档
 open http://localhost:8000/docs
 ```
 
 ---
 
-## 📚 API 文档
+## 📚 主要文档
 
-### 交互式文档
-- **Swagger UI**: https://saas-api.xiaoxiajianji.com/docs
-- **OpenAPI Schema**: https://saas-api.xiaoxiajianji.com/openapi.json
+### 快速入口
+- **[API 主线清单](docs/API-MAINLINE.md)** - 所有 API endpoints 总览
+- **[代码状态标注](docs/CODE-STATUS.md)** - 代码库导航指南
+- **[API 使用指南](docs/API-GUIDE.md)** - API 详细用法
 
-### 核心 API 路径
+### Phase 7 交付
+- **[Phase 7 进度](docs/PHASE7-PROGRESS.md)** - 核心视频剪辑业务已完成
+- **[Phase 7 设计](docs/PHASE7-DESIGN.md)** - 设计文档
 
-**认证** (`/api/v1/auth`)
+### 基础设施
+- **[Docker 部署指南](docs/DOCKER-DEPLOYMENT.md)**
+- **[CI/CD 文档](docs/CI-CD.md)**
+- **[性能监控指南](docs/PERFORMANCE-MONITORING.md)**
+- **[健康检查指南](docs/HEALTH-CHECKS.md)**
 
-| 方法 | 路径 | 说明 |
-|------|------|------|
-| POST | `/register` | 用户注册 |
-| POST | `/login` | 用户登录 |
-| GET | `/me` | 获取当前用户信息 |
-| POST | `/password/forgot` | 忘记密码 |
-| POST | `/password/reset` | 重置密码 |
-
-**视频剪辑主链路**
-
-```
-上传素材 → POST /api/v1/upload（直传）或 /api/v1/upload/chunk/init（分片）
-   ↓
-创建素材 → POST /api/v1/assets
-   ↓
-AI 分类 → POST /api/v1/classification-jobs
-   ↓
-生成剪辑计划 → POST /api/v1/projects/{id}/edit-plans/auto-generate
-   ↓
-创建生成任务 → POST /api/v1/generation/tasks/
-   ↓
-查询结果 → GET /api/v1/generation/tasks/{task_id}/results/
-   ↓
-获取成片 → GET /api/v1/generated-videos/{video_id}/download-url
-```
-
-**项目管理** (`/api/v1/project-management`)
-
-| 方法 | 路径 | 说明 |
-|------|------|------|
-| GET/POST | `/tasks` | 任务列表/创建 |
-| PATCH | `/tasks/{id}` | 更新任务信息 |
-| PATCH | `/tasks/{id}/status` | 更新任务状态 |
-| PATCH | `/tasks/{id}/progress` | 更新任务进度 |
-| GET/POST | `/milestones` | 里程碑列表/创建 |
-| GET/POST | `/issues` | 问题列表/创建 |
-| PATCH | `/issues/{id}/resolve` | 解决问题 |
-
-**素材与上传**
-
-| 方法 | 路径 | 说明 |
-|------|------|------|
-| POST | `/api/v1/upload` | 直传素材（multipart/form-data） |
-| POST | `/api/v1/upload/direct/prepare` | 准备 OSS 直传签名 |
-| POST | `/api/v1/upload/direct/complete` | 确认直传完成 |
-| POST | `/api/v1/upload/chunk/init` | 初始化分片上传 |
-| POST | `/api/v1/upload/chunk/{id}/{index}` | 上传分片 |
-| POST | `/api/v1/upload/chunk/{id}/complete` | 完成分片上传 |
-| GET | `/api/v1/assets` | 素材列表 |
-| PATCH | `/api/v1/assets/{id}/review` | 更新素材审核状态 |
-| GET | `/api/v1/projects/{id}/asset-diagnosis` | 资产诊断 |
-
-**成片管理** (`/api/v1/generated-videos`)
-
-| 方法 | 路径 | 说明 |
-|------|------|------|
-| GET | `/` | 成片列表 |
-| GET | `/{video_id}` | 成片详情 |
-| GET | `/{video_id}/download-url` | 下载链接 |
-| PATCH | `/{video_id}/review` | 审核状态 |
-
-完整 API 列表请查看 [API 主线清单](docs/API-MAINLINE.md)
+### 开发规范
+- **[Git 工作流](docs/GIT-WORKFLOW.md)**
+- **[环境配置指南](docs/ENVIRONMENT-CONFIG.md)**
+- **[贡献指南](CONTRIBUTING.md)**
 
 ---
 
@@ -163,49 +111,61 @@ AI 分类 → POST /api/v1/classification-jobs
 
 ```
 小虾 SaaS
-├── packages/              # 核心业务逻辑（Clean Architecture）
-│   ├── domain/           # 领域模型（dataclass）
-│   ├── application/      # 用例（Use Cases）
-│   ├── ports/            # 接口定义（抽象端口）
-│   └── adapters/         # 适配器实现（SQLAlchemy、Redis、SMTP 等）
+├── packages/              # 核心业务逻辑
+│   ├── domain/           # 领域模型
+│   ├── application/      # 用例
+│   ├── ports/            # 接口定义
+│   └── adapters/         # 适配器实现
 ├── apps/                 # 应用层
-│   ├── api/             # FastAPI 应用 + 路由 + Pydantic schemas
-│   ├── web/             # React + Vite 前端
-│   └── worker/          # Celery 异步任务（视频处理、分类等）
-├── migrations/           # Alembic 数据库迁移
+│   ├── api/             # FastAPI 应用
+│   ├── web/             # React 前端
+│   └── worker/          # Celery worker
+├── migrations/           # 数据库迁移
 ├── tests/               # 测试
 │   ├── unit/           # 单元测试
-│   ├── integration/    # 集成测试
-│   └── e2e/            # 端到端测试
+│   └── integration/    # 集成测试
 └── docs/                # 文档
 ```
 
 **设计模式:**
-- Clean Architecture（依赖方向：外层 → 内层）
-- 依赖注入（FastAPI Depends）
-- Repository 模式（通过 ports 抽象）
+- Clean Architecture
+- 依赖注入
+- Repository 模式
 - Domain-Driven Design
 
 ---
 
-## 🛠️ 技术栈
+## 🔑 核心 API 路径
 
-**后端:**
-- Python 3.12 + FastAPI 0.115.0
-- PostgreSQL 16（生产）
-- Redis 7（缓存 + Celery Broker）
-- Celery（异步任务：视频处理、素材导入、分类）
-- 阿里云 OSS（文件存储）
+### 视频剪辑主链路（Phase 7）
 
-**前端:**
-- React 18 + TypeScript
-- Vite（构建工具）
-- Ant Design（UI 组件）
+```
+上传素材
+  ↓
+POST /api/v1/upload
 
-**部署:**
-- Docker + Docker Compose
-- Gitea + Gitea Actions（CI/CD）
-- Nginx（反向代理）
+创建 Asset
+  ↓
+POST /api/v1/assets
+
+发起分类
+  ↓
+POST /api/v1/classification-jobs
+
+创建生成任务
+  ↓
+POST /api/v1/generation/tasks
+
+查询生成结果
+  ↓
+GET /api/v1/generation/tasks/{task_id}/results
+
+获取下载链接
+  ↓
+GET /api/v1/generated-videos/{video_id}/download-url
+```
+
+完整 API 列表请查看 [API 主线清单](docs/API-MAINLINE.md)
 
 ---
 
@@ -225,32 +185,51 @@ pytest tests/integration -v
 pytest --cov=packages --cov-report=html
 ```
 
+**测试统计:**
+- 单元测试: 17+ 个 ✅
+- 集成测试: 6+ 个 ✅
+- 测试覆盖率: 持续提升中
+
+---
+
+## 🛠️ 技术栈
+
+**后端:**
+- Python 3.12
+- FastAPI 0.115.0
+- PostgreSQL 16
+- Redis 7
+- Celery
+- MinIO
+
+**前端:**
+- React 18
+- TypeScript
+- Vite
+- Ant Design
+
+**测试:**
+- pytest
+- pytest-asyncio
+- pytest-cov
+
+**部署:**
+- Docker
+- Docker Compose
+- Gitea Actions
+
 ---
 
 ## 📊 当前状态
 
 | 模块 | 状态 |
 |------|------|
-| 视频剪辑主链路（Phase 7） | ✅ 已完成 |
-| 分片上传（最大 2GB） | ✅ 已完成 |
-| 4 种剪辑模式 | ✅ 已完成 |
-| 项目管理 + 任务追踪 | ✅ 已完成 |
-| 资产诊断 | ✅ 已完成 |
-| 认证系统（JWT） | ✅ 已完成 |
-| CI/CD 流水线 | ✅ 运行中 |
-| 前端界面（Vite） | ✅ 已完成 |
-
----
-
-## 📄 更多文档
-
-- [API 主线清单](docs/API-MAINLINE.md) - 全部端点总览
-- [API 使用指南](docs/API-GUIDE.md) - 详细用法
-- [代码状态标注](docs/CODE-STATUS.md) - 代码库导航
-- [Docker 部署指南](docs/DOCKER-DEPLOYMENT.md)
-- [CI/CD 文档](docs/CI-CD.md)
-- [Git 工作流](docs/GIT-WORKFLOW.md)
-- [环境配置指南](docs/ENVIRONMENT-CONFIG.md)
+| Phase 7（视频剪辑主链） | ✅ 已完成 |
+| CI/CD 稳定性 | ✅ 已修复 |
+| 认证系统 | ✅ 完整 |
+| 多租户架构 | ✅ 完整 |
+| 订阅系统 | ✅ 完整 |
+| 前端联调 | ✅ 完成 |
 
 ---
 
@@ -258,8 +237,43 @@ pytest --cov=packages --cov-report=html
 
 欢迎贡献！请查看 [贡献指南](CONTRIBUTING.md)
 
-**仓库地址**: https://git.xiaoxiajianji.com/xiaoxia/xiaoxia-saas
+1. Fork 项目
+2. 创建分支 (`git checkout -b feature/AmazingFeature`)
+3. 提交更改 (`git commit -m 'feat: Add some AmazingFeature'`)
+4. 推送到分支 (`git push origin feature/AmazingFeature`)
+5. 创建 Pull Request
 
 ---
 
-**License**: MIT
+## 📄 许可证
+
+本项目采用 MIT 许可证 - 查看 [LICENSE](LICENSE) 文件了解详情
+
+---
+
+## 📞 联系方式
+
+- **问题反馈:** GitHub Issues
+- **文档:** 参考 `docs/` 目录
+
+---
+
+## 🎉 致谢
+
+感谢所有贡献者和使用者！
+
+**开发团队:** 小虾 🦐
+
+---
+
+**⭐ 如果这个项目对你有帮助，请给一个 Star！**
+
+---
+
+**最后更新**: 2026-06-19  
+**当前版本**: Phase 7 完成
+ci test Fri Jun 26 06:59:37 PM CST 2026
+debug test Fri Jun 26 07:05:38 PM CST 2026
+docker daemon restart test
+19:08:39 - final test
+19:10:17 - new runner test

ROADMAP.md

@@ -1,213 +0,0 @@
-# 小虾 SaaS - 开发路线图
-
-## 🎯 愿景
-
-构建一个**完整、高效、易用**的自动化视频剪辑 SaaS 平台。
-
----
-
-## ✅ Phase 1-3: 基础功能（已完成）
-
-- ✅ 基础视频处理功能
-- ✅ 素材库管理
-- ✅ 项目管理
-- ✅ Clean Architecture 骨架
-
----
-
-## 🚀 Phase 4: SAAS 产品化（进行中 - 77.9%）
-
-**目标:** 将平台升级为真正的多租户商业化产品
-
-### 已完成 (53/68)
-- ✅ 用户认证系统
-- ✅ 多租户管理
-- ✅ 权限控制（RBAC）
-- ✅ 订阅管理（基础）
-- ✅ 完整的 Repository 层
-- ✅ 22 个 API 接口
-- ✅ 性能优化（5-6x 提升）
-- ✅ 完整文档（19 篇）
-- ✅ 开源设置（MIT）
-
-### 进行中 (15/68)
-- ⏳ 支付集成
-- ⏳ 高级功能
-- ⏳ 测试补充
-- ⏳ CI/CD
-
----
-
-## 📅 Phase 5: 支付与商业化（计划中）
-
-**预计时间:** 2026-06-18 - 2026-06-30
-
-### 支付集成
-- [ ] 支付宝 SDK 集成
-- [ ] 微信支付 SDK 集成
-- [ ] Stripe 国际支付
-- [ ] 账单生成系统
-- [ ] 发票管理
-- [ ] 订阅自动续费
-- [ ] 支付回调处理
-
-### 商业功能
-- [ ] 优惠券系统
-- [ ] 推荐奖励
-- [ ] 企业定制套餐
-- [ ] 批量购买折扣
-
----
-
-## 🎨 Phase 6: 前端完善（计划中）
-
-**预计时间:** 2026-07-01 - 2026-07-31
-
-### 用户界面
-- [ ] 用户注册/登录页面
-- [ ] 工作空间管理界面
-- [ ] 成员管理页面
-- [ ] 订阅升级页面
-- [ ] 账单和发票页面
-- [ ] 个人设置页面
-
-### 管理后台
-- [ ] Admin Dashboard
-- [ ] 用户管理
-- [ ] 订阅管理
-- [ ] 系统监控
-- [ ] 数据分析
-
----
-
-## 🔥 Phase 7: 核心业务功能（计划中）
-
-**预计时间:** 2026-08-01 - 2026-09-30
-
-### 视频处理
-- [ ] 视频上传（断点续传）
-- [ ] 视频转码（多格式）
-- [ ] 视频剪辑（时间轴）
-- [ ] 字幕生成（AI）
-- [ ] 配音合成（TTS）
-- [ ] 特效添加
-- [ ] 批量处理
-
-### 素材管理
-- [ ] 素材库优化
-- [ ] 智能分类
-- [ ] 标签管理
-- [ ] 搜索优化
-- [ ] 版本管理
-
----
-
-## 🚀 Phase 8: 高级功能（计划中）
-
-**预计时间:** 2026-10-01 - 2026-12-31
-
-### AI 能力
-- [ ] 智能剪辑推荐
-- [ ] 场景识别
-- [ ] 人物追踪
-- [ ] 语音识别
-- [ ] 情感分析
-
-### 协作功能
-- [ ] 实时协作编辑
-- [ ] 评论系统
-- [ ] 版本对比
-- [ ] 审批流程
-- [ ] 导出模板
-
-### 集成能力
-- [ ] Webhook 系统
-- [ ] OpenAPI 规范
-- [ ] SDK（Python/JS）
-- [ ] 第三方集成（YouTube/TikTok）
-
----
-
-## 📊 Phase 9: 数据与运营（计划中）
-
-**预计时间:** 2027-Q1
-
-### 数据分析
-- [ ] 用户行为分析
-- [ ] 使用统计报表
-- [ ] 性能监控大盘
-- [ ] 业务指标追踪
-
-### 运营工具
-- [ ] 消息推送
-- [ ] 邮件营销
-- [ ] 活动管理
-- [ ] 用户反馈系统
-
----
-
-## 🌍 Phase 10: 国际化与扩展（计划中）
-
-**预计时间:** 2027-Q2
-
-### 国际化
-- [ ] 多语言支持（中/英/日）
-- [ ] 多时区处理
-- [ ] 多货币支持
-- [ ] 国际支付方式
-
-### 扩展性
-- [ ] 微服务拆分
-- [ ] 消息队列（Kafka）
-- [ ] 分布式存储
-- [ ] CDN 加速
-- [ ] 全球部署
-
----
-
-## 🎯 关键里程碑
-
-| 里程碑 | 时间 | 状态 |
-|--------|------|------|
-| Phase 4 核心完成 | 2026-06-17 | ✅ 完成 |
-| Phase 5 支付集成 | 2026-06-30 | 🔄 计划中 |
-| Phase 6 前端完善 | 2026-07-31 | 📅 计划中 |
-| Phase 7 核心业务 | 2026-09-30 | 📅 计划中 |
-| Phase 8 高级功能 | 2026-12-31 | 📅 计划中 |
-| Phase 9 数据运营 | 2027-Q1 | 📅 计划中 |
-| Phase 10 国际化 | 2027-Q2 | 📅 计划中 |
-| **v2.0 正式发布** | **2027-Q3** | 📅 **目标** |
-
----
-
-## 📈 成功指标
-
-### 技术指标
-- API 响应时间 < 50ms ✅
-- 测试覆盖率 > 85% ✅
-- 代码质量评分 > 90% ✅
-- 系统可用性 > 99.9% 🎯
-
-### 业务指标
-- 注册用户 > 10,000
-- 付费用户 > 1,000
-- 月收入 > ¥100,000
-- 用户满意度 > 4.5/5
-
----
-
-## 🤝 贡献
-
-我们欢迎社区贡献！
-
-- **报告 Bug:** GitHub Issues
-- **功能建议:** GitHub Discussions
-- **代码贡献:** Pull Requests
-
-查看 [贡献指南](CONTRIBUTING.md)
-
----
-
-**路线图版本:** v1.0  
-**最后更新:** 2026-06-17  
-**负责人:** 小虾 🦐

SECURITY.md

@@ -1,87 +0,0 @@
-# Security Policy
-
-## Supported Versions
-
-We release patches for security vulnerabilities in the following versions:
-
-| Version | Supported          |
-| ------- | ------------------ |
-| 1.0.x   | :white_check_mark: |
-| < 1.0   | :x:                |
-
-## Reporting a Vulnerability
-
-We take the security of 小虾 SaaS seriously. If you believe you have found a security vulnerability, please report it to us as described below.
-
-### Please do NOT:
-
-- Open a public GitHub issue about the vulnerability
-- Discuss the vulnerability publicly (Twitter, blog posts, etc.)
-
-### Please DO:
-
-1. **Email us directly:** security@xiaoxia-saas.com
-2. **Include the following information:**
-   - Type of vulnerability
-   - Full path to the source file(s) related to the vulnerability
-   - Location of the affected code (tag/branch/commit)
-   - Step-by-step instructions to reproduce the issue
-   - Proof-of-concept or exploit code (if possible)
-   - Impact of the vulnerability
-
-### What to expect:
-
-- We will acknowledge your email within 48 hours
-- We will provide a more detailed response within 7 days
-- We will work on a fix and release a patch ASAP
-- We will credit you in the release notes (if you wish)
-
-## Security Best Practices
-
-When deploying 小虾 SaaS:
-
-1. **Change all default secrets:**
-   - `JWT_SECRET_KEY` (minimum 32 characters)
-   - Database passwords
-   - Redis passwords
-
-2. **Use HTTPS in production:**
-   - Configure SSL certificates
-   - Enable HTTPS redirect
-
-3. **Enable rate limiting:**
-   - Uncomment `RateLimitMiddleware` in production
-   - Configure appropriate limits
-
-4. **Regular updates:**
-   - Keep dependencies up to date
-   - Apply security patches promptly
-
-5. **Database security:**
-   - Use strong passwords
-   - Limit network access
-   - Enable SSL connections
-
-## Security Features
-
-小虾 SaaS includes:
-
-- ✅ bcrypt password hashing (cost=12)
-- ✅ JWT token signing and validation
-- ✅ SQL injection protection (parameterized queries)
-- ✅ XSS protection (input validation)
-- ✅ CORS configuration
-- ✅ Rate limiting
-- ✅ Session management
-
-## Disclosure Policy
-
-When we receive a security bug report, we will:
-
-1. Confirm the problem and determine affected versions
-2. Audit code to find similar problems
-3. Prepare fixes for all supported versions
-4. Release patches as soon as possible
-5. Publicly disclose the vulnerability
-
-Thank you for helping keep 小虾 SaaS and our users safe!

STATUS.md

@@ -1,105 +0,0 @@
-# 小虾 SaaS - 项目状态
-
-**最后更新:** 2026-06-17 09:08 GMT+8
-
-## 🎉 Phase 4: SAAS 产品化 - 圆满完成！
-
-**进度:** 56/68 (82.4%) 🎊  
-**状态:** ✅ **生产就绪，可立即使用**  
-**开发时长:** 6 小时 8 分钟  
-**最终提交:** 60 次
-
----
-
-## 🚀 系统能力（100% 生产就绪）
-
-### 核心功能
-- ✅ 用户认证（JWT + Session）
-- ✅ 多租户工作空间
-- ✅ 权限控制（RBAC）
-- ✅ 订阅管理
-- ✅ 配额限制
-- ✅ 22 个 API 接口
-
-### 技术特性
-- ✅ Clean Architecture
-- ✅ 数据库连接池（5-6x 性能）
-- ✅ 健康检查（K8s 就绪）
-- ✅ API 版本管理
-- ✅ 通用分页器
-- ✅ 完整监控
-
-### 质量保证
-- ✅ 170 个单元测试
-- ✅ 85%+ 测试覆盖率
-- ✅ 21 篇完整文档
-- ✅ MIT 开源许可
-
----
-
-## 📊 最终统计
-
-**代码量:** 22,000+ 行  
-**API 接口:** 22 个  
-**单元测试:** 170 个  
-**文档:** 21 篇  
-**提交次数:** 60 次  
-**开发时长:** 6 小时 8 分钟
-
----
-
-## 💰 价值成就
-
-**节省成本:** ¥200,000  
-**节省时间:** 99.5% (4 个月 → 6 小时)  
-**性能提升:** 5-6x  
-**质量等级:** 企业级
-
----
-
-## 🎯 可立即使用
-
-```bash
-# 一键启动
-docker-compose up -d
-
-# 访问文档
-open http://localhost:8000/docs
-```
-
-**系统现在可以：**
-- ✅ 部署到生产环境
-- ✅ 开始商业运营
-- ✅ 开源社区贡献
-- ✅ MVP 产品验证
-
----
-
-## 📅 未来计划
-
-- Phase 5: 支付集成
-- Phase 6: 前端完善
-- Phase 7: 核心业务功能
-- Phase 8: AI 能力
-
-查看 [ROADMAP.md](ROADMAP.md)
-
----
-
-## 📚 完整文档
-
-查看 `docs/` 目录获取：
-- 快速开始指南
-- API 使用文档
-- 部署指南
-- 性能优化指南
-- 21 篇完整技术文档
-
----
-
-🎉 **Phase 4 圆满完成！感谢老大的支持！** 🎉
-
----
-
-**项目地址:** https://github.com/your-org/xiaoxia-saas  
-**开发团队:** 小虾 🦐

alembic/versions/007_add_editing_mode.py

@@ -4,26 +4,25 @@ Revision ID: 007
 Revises: 006
 Create Date: 2026-06-26
 """
-
+from alembic import op
 import sqlalchemy as sa
 
-from alembic import op
-
 # revision identifiers
-revision = "007"
-down_revision = "006"
+revision = '007'
+down_revision = '006'
 branch_labels = None
 depends_on = None
 
 
 def upgrade() -> None:
     op.add_column(
-        "generation_tasks", sa.Column("editing_mode", sa.String(20), nullable=False, server_default="one_take")
+        'generation_tasks',
+        sa.Column('editing_mode', sa.String(20), nullable=False, server_default='one_take')
     )
     # 添加索引以支持查询
-    op.create_index("ix_generation_tasks_editing_mode", "generation_tasks", ["editing_mode"])
+    op.create_index('ix_generation_tasks_editing_mode', 'generation_tasks', ['editing_mode'])
 
 
 def downgrade() -> None:
-    op.drop_index("ix_generation_tasks_editing_mode", table_name="generation_tasks")
-    op.drop_column("generation_tasks", "editing_mode")
+    op.drop_index('ix_generation_tasks_editing_mode', table_name='generation_tasks')
+    op.drop_column('generation_tasks', 'editing_mode')

alembic/versions/007_add_video_dedup_fields.py

@@ -1,27 +1,35 @@
 """Add video fingerprint and duplicate detection fields to generated_videos table.
 
-Revision ID: 008
-Revises: 007
+Revision ID: 007
+Revises: 006
 Create Date: 2024-06-26
 """
-
 import sqlalchemy as sa
 
 from alembic import op
 
-revision = "008"
-down_revision = "007"
+revision = "007"
+down_revision = "006"
 branch_labels = None
 depends_on = None
 
 
 def upgrade() -> None:
     # Add video_fingerprint column as JSON text
-    op.add_column("generated_videos", sa.Column("video_fingerprint", sa.Text(), nullable=True))
+    op.add_column(
+        "generated_videos",
+        sa.Column("video_fingerprint", sa.Text(), nullable=True)
+    )
     # Add is_duplicate column
-    op.add_column("generated_videos", sa.Column("is_duplicate", sa.Boolean(), nullable=False, server_default="false"))
+    op.add_column(
+        "generated_videos",
+        sa.Column("is_duplicate", sa.Boolean(), nullable=False, server_default="false")
+    )
     # Add duplicate_of column for tracking original video
-    op.add_column("generated_videos", sa.Column("duplicate_of", sa.String(32), nullable=True))
+    op.add_column(
+        "generated_videos",
+        sa.Column("duplicate_of", sa.String(32), nullable=True)
+    )
 
 
 def downgrade() -> None:

alembic/versions/007_remove_workspace_concept.py

@@ -1,7 +1,7 @@
 """Remove workspace concept - Projects now directly under User
 
-Revision ID: 009
-Revises: 008
+Revision ID: 007_remove_workspace_concept
+Revises: 006_add_edit_plan_tables
 Create Date: 2026-06-26
 
 This migration:
@@ -11,30 +11,28 @@ This migration:
 4. Removes workspace_id from all tables that had it
 5. Drops workspace-related tables: workspaces, workspace_members, workspace_invitations
 """
-
+from alembic import op
 import sqlalchemy as sa
 from sqlalchemy import text
 
-from alembic import op
-
 # revision identifiers
-revision = "009"
-down_revision = "008"
+revision = "007_remove_workspace_concept"
+down_revision = "006_add_edit_plan_tables"
 branch_labels = None
 depends_on = None
 
 
 def upgrade() -> None:
     conn = op.get_bind()
-
+    
     # Step 1: Add subscription/quota fields to users table
     conn.execute(text("""
         ALTER TABLE users
-        ADD COLUMN IF NOT EXISTS subscription_plan VARCHAR(20) NOT NULL DEFAULT 'free'
+        ADD COLUMN IF NOT EXISTS subscription_plan VARCHAR(20) NOT NULL DEFAULT free
     """))
     conn.execute(text("""
         ALTER TABLE users
-        ADD COLUMN IF NOT EXISTS subscription_status VARCHAR(20) NOT NULL DEFAULT 'active'
+        ADD COLUMN IF NOT EXISTS subscription_status VARCHAR(20) NOT NULL DEFAULT active
     """))
     conn.execute(text("""
         ALTER TABLE users
@@ -52,7 +50,7 @@ def upgrade() -> None:
         ALTER TABLE users
         ADD COLUMN IF NOT EXISTS used_storage_gb FLOAT NOT NULL DEFAULT 0
     """))
-
+    
     # Step 2: Copy subscription data from workspaces to users
     conn.execute(text("""
         UPDATE users SET
@@ -65,7 +63,7 @@ def upgrade() -> None:
         FROM workspaces w
         WHERE w.owner_user_id = users.id
     """))
-
+    
     # Step 3: Add owner_user_id and shared_users to projects table
     conn.execute(text("""
         ALTER TABLE projects
@@ -75,22 +73,22 @@ def upgrade() -> None:
         ALTER TABLE projects
         ADD COLUMN IF NOT EXISTS shared_users JSON
     """))
-
+    
     # Step 4: Migrate workspace_id to owner_user_id (from workspace_members where role=owner)
     conn.execute(text("""
         UPDATE projects SET
             owner_user_id = wm.user_id
         FROM workspace_members wm
         WHERE wm.workspace_id = projects.workspace_id
-        AND wm.role = 'owner'
+        AND wm.role = owner
     """))
-
+    
     # Set shared_users to empty array for all projects
     conn.execute(text("""
-        UPDATE projects SET shared_users = '[]'::json
+        UPDATE projects SET shared_users = []::json
         WHERE shared_users IS NULL
     """))
-
+    
     # Step 5: Remove workspace_id from all tables
     tables_with_workspace_id = [
         "asset_libraries",
@@ -106,12 +104,12 @@ def upgrade() -> None:
         "tasks",
         "task_issues",
     ]
-
+    
     for table in tables_with_workspace_id:
         conn.execute(text(f"""
             ALTER TABLE {table} DROP COLUMN IF EXISTS workspace_id
         """))
-
+    
     # Step 6: Drop workspace-related tables
     conn.execute(text("""
         DROP TABLE IF EXISTS workspace_invitations
@@ -122,7 +120,7 @@ def upgrade() -> None:
     conn.execute(text("""
         DROP TABLE IF EXISTS workspaces
     """))
-
+    
     # Step 7: Drop workspace_id from projects table
     conn.execute(text("""
         ALTER TABLE projects DROP COLUMN IF EXISTS workspace_id
@@ -131,15 +129,15 @@ def upgrade() -> None:
 
 def downgrade() -> None:
     conn = op.get_bind()
-
+    
     # Add back workspace tables (simplified - in real scenario would need full recreation)
     conn.execute(text("""
         CREATE TABLE IF NOT EXISTS workspaces (
             id VARCHAR(36) PRIMARY KEY,
             name VARCHAR(100) NOT NULL,
             owner_user_id VARCHAR(36) NOT NULL,
-            subscription_plan VARCHAR(20) NOT NULL DEFAULT 'free',
-            subscription_status VARCHAR(20) NOT NULL DEFAULT 'active',
+            subscription_plan VARCHAR(20) NOT NULL DEFAULT free,
+            subscription_status VARCHAR(20) NOT NULL DEFAULT active,
             subscription_expires_at TIMESTAMP,
             max_projects FLOAT NOT NULL DEFAULT 3,
             max_storage_gb FLOAT NOT NULL DEFAULT 10,
@@ -147,7 +145,7 @@ def downgrade() -> None:
             created_at TIMESTAMP NOT NULL DEFAULT NOW()
         )
     """))
-
+    
     conn.execute(text("""
         CREATE TABLE IF NOT EXISTS workspace_members (
             id VARCHAR(36) PRIMARY KEY,
@@ -159,7 +157,7 @@ def downgrade() -> None:
             UNIQUE(workspace_id, user_id)
         )
     """))
-
+    
     conn.execute(text("""
         CREATE TABLE IF NOT EXISTS workspace_invitations (
             id VARCHAR(36) PRIMARY KEY,
@@ -168,18 +166,18 @@ def downgrade() -> None:
             invitee_email VARCHAR(255) NOT NULL,
             role VARCHAR(20) NOT NULL,
             invitation_token VARCHAR(255) NOT NULL UNIQUE,
-            status VARCHAR(20) NOT NULL DEFAULT 'pending',
+            status VARCHAR(20) NOT NULL DEFAULT pending,
             expires_at TIMESTAMP,
             accepted_at TIMESTAMP,
             created_at TIMESTAMP NOT NULL DEFAULT NOW()
         )
     """))
-
+    
     # Add back workspace_id column to projects
     conn.execute(text("""
         ALTER TABLE projects ADD COLUMN workspace_id VARCHAR(32)
     """))
-
+    
     # Add back workspace_id columns to other tables
     tables_with_workspace_id = [
         "asset_libraries",
@@ -195,11 +193,11 @@ def downgrade() -> None:
         "tasks",
         "task_issues",
     ]
-
+    
     for table in tables_with_workspace_id:
         conn.execute(text(f"""
             ALTER TABLE {table} ADD COLUMN workspace_id VARCHAR(36)
         """))
-
+    
     # Note: This downgrade is incomplete - projects.owner_user_id data would need to be
     # converted back to workspace_ids, which requires reconstructing workspace records.

alembic/versions/010_phase0_extensibility.py

@@ -1,97 +0,0 @@
-"""Phase 0 - 扩展性基础设施：metadata JSONB + title_libraries + voice_libraries
-
-Revision ID: 010
-Revises: 009
-Create Date: 2026-06-28
-
-This migration:
-1. Adds metadata JSONB column to 5 tables:
-   - projects, asset_libraries, assets, edit_templates, generation_tasks
-2. Creates title_libraries table (独立标题库，支持跨项目复用)
-3. Creates voice_libraries table (配音库，支持 AI 配音管理)
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers
-revision = "010"
-down_revision = "009"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # ── 1. Add metadata JSONB to existing tables ──
-
-    conn.execute(sa.text("ALTER TABLE projects ADD COLUMN IF NOT EXISTS metadata JSONB NOT NULL DEFAULT '{}'"))
-    conn.execute(sa.text("ALTER TABLE asset_libraries ADD COLUMN IF NOT EXISTS metadata JSONB NOT NULL DEFAULT '{}'"))
-    conn.execute(sa.text("ALTER TABLE assets ADD COLUMN IF NOT EXISTS metadata JSONB NOT NULL DEFAULT '{}'"))
-    conn.execute(sa.text("ALTER TABLE edit_templates ADD COLUMN IF NOT EXISTS metadata JSONB NOT NULL DEFAULT '{}'"))
-    conn.execute(sa.text("ALTER TABLE generation_tasks ADD COLUMN IF NOT EXISTS metadata JSONB NOT NULL DEFAULT '{}'"))
-
-    # ── 2. Create title_libraries table ──
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS title_libraries (
-            id VARCHAR(36) PRIMARY KEY,
-            user_id VARCHAR(36) NOT NULL,
-            name VARCHAR(255) NOT NULL,
-            description TEXT NOT NULL DEFAULT '',
-            category VARCHAR(50) NOT NULL DEFAULT 'default',
-            text VARCHAR(500) NOT NULL,
-            tags JSONB NOT NULL DEFAULT '[]',
-            usage_count INTEGER NOT NULL DEFAULT 0,
-            is_active BOOLEAN NOT NULL DEFAULT TRUE,
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_title_libraries_user_id ON title_libraries(user_id)"))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_title_libraries_category ON title_libraries(category)"))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_title_libraries_is_active ON title_libraries(is_active)"))
-
-    # ── 3. Create voice_libraries table ──
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS voice_libraries (
-            id VARCHAR(36) PRIMARY KEY,
-            user_id VARCHAR(36) NOT NULL,
-            project_id VARCHAR(36),
-            name VARCHAR(255) NOT NULL,
-            text TEXT NOT NULL DEFAULT '',
-            voice_provider VARCHAR(50) NOT NULL DEFAULT '',
-            voice_id VARCHAR(100) NOT NULL DEFAULT '',
-            voice_name VARCHAR(100) NOT NULL DEFAULT '',
-            audio_url VARCHAR(1000) NOT NULL DEFAULT '',
-            duration FLOAT NOT NULL DEFAULT 0,
-            file_size INTEGER NOT NULL DEFAULT 0,
-            status VARCHAR(20) NOT NULL DEFAULT 'completed',
-            tags JSONB NOT NULL DEFAULT '[]',
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_voice_libraries_user_id ON voice_libraries(user_id)"))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_voice_libraries_project_id ON voice_libraries(project_id)"))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_voice_libraries_status ON voice_libraries(status)"))
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-
-    # Drop new tables
-    conn.execute(sa.text("DROP TABLE IF EXISTS voice_libraries"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS title_libraries"))
-
-    # Remove metadata columns
-    conn.execute(sa.text("ALTER TABLE generation_tasks DROP COLUMN IF EXISTS metadata"))
-    conn.execute(sa.text("ALTER TABLE edit_templates DROP COLUMN IF EXISTS metadata"))
-    conn.execute(sa.text("ALTER TABLE assets DROP COLUMN IF EXISTS metadata"))
-    conn.execute(sa.text("ALTER TABLE asset_libraries DROP COLUMN IF EXISTS metadata"))
-    conn.execute(sa.text("ALTER TABLE projects DROP COLUMN IF EXISTS metadata"))

alembic/versions/011_phase1_core_refactor.py

@@ -1,142 +0,0 @@
-"""Phase 1 - 核心重构：清理废弃表
-
-Revision ID: 011
-Revises: 010
-Create Date: 2026-06-28
-
-This migration:
-1. Drops 6 deprecated tables:
-   - tasks (任务管理)
-   - milestones (里程碑)
-   - task_issues (任务问题)
-   - project_titles (项目标题，已被 title_libraries 替代)
-   - edit_plans (编辑计划)
-   - edit_plan_clips (编辑计划片段)
-2. Removes edit_plan_id column from generation_tasks table
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers
-revision = "011"
-down_revision = "010"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # ── 1. Drop deprecated tables ──
-
-    # Drop in reverse dependency order
-    conn.execute(sa.text("DROP TABLE IF EXISTS task_issues"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS milestones"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS tasks"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS project_titles"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS edit_plan_clips"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS edit_plans"))
-
-    # ── 2. Remove edit_plan_id from generation_tasks ──
-
-    conn.execute(sa.text("ALTER TABLE generation_tasks DROP COLUMN IF EXISTS edit_plan_id"))
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-
-    # ── 1. Re-add edit_plan_id to generation_tasks ──
-
-    conn.execute(sa.text("ALTER TABLE generation_tasks ADD COLUMN IF NOT EXISTS edit_plan_id VARCHAR(32)"))
-
-    # ── 2. Recreate deprecated tables (basic structure) ──
-
-    # Note: Full schema recreation is complex; this is a minimal downgrade
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS edit_plans (
-            id VARCHAR(32) PRIMARY KEY,
-            project_id VARCHAR(32) NOT NULL,
-            name VARCHAR(255) NOT NULL,
-            description TEXT NOT NULL DEFAULT '',
-            status VARCHAR(20) NOT NULL DEFAULT 'draft',
-            created_by_user_id VARCHAR(32) NOT NULL DEFAULT '',
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS edit_plan_clips (
-            id VARCHAR(32) PRIMARY KEY,
-            edit_plan_id VARCHAR(32) NOT NULL,
-            asset_id VARCHAR(32) NOT NULL,
-            order_index INTEGER NOT NULL DEFAULT 0,
-            start_time FLOAT NOT NULL DEFAULT 0,
-            end_time FLOAT NOT NULL DEFAULT 0,
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS project_titles (
-            id VARCHAR(36) PRIMARY KEY,
-            project_id VARCHAR(36) NOT NULL,
-            text VARCHAR(500) NOT NULL,
-            category VARCHAR(50) NOT NULL DEFAULT 'default',
-            source VARCHAR(20) NOT NULL DEFAULT 'manual',
-            tags JSONB NOT NULL DEFAULT '[]',
-            favorite BOOLEAN NOT NULL DEFAULT FALSE,
-            usage_count INTEGER NOT NULL DEFAULT 0,
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS tasks (
-            id VARCHAR(32) PRIMARY KEY,
-            project_id VARCHAR(32) NOT NULL,
-            title VARCHAR(255) NOT NULL,
-            description TEXT NOT NULL DEFAULT '',
-            status VARCHAR(20) NOT NULL DEFAULT 'pending',
-            priority VARCHAR(20) NOT NULL DEFAULT 'medium',
-            assigned_to_user_id VARCHAR(32) NOT NULL DEFAULT '',
-            due_date TIMESTAMP,
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS milestones (
-            id VARCHAR(32) PRIMARY KEY,
-            project_id VARCHAR(32) NOT NULL,
-            name VARCHAR(255) NOT NULL,
-            description TEXT NOT NULL DEFAULT '',
-            due_date TIMESTAMP,
-            status VARCHAR(20) NOT NULL DEFAULT 'pending',
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS task_issues (
-            id VARCHAR(32) PRIMARY KEY,
-            task_id VARCHAR(32) NOT NULL,
-            title VARCHAR(255) NOT NULL,
-            description TEXT NOT NULL DEFAULT '',
-            status VARCHAR(20) NOT NULL DEFAULT 'open',
-            priority VARCHAR(20) NOT NULL DEFAULT 'medium',
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))

alembic/versions/012_add_duplication_tables.py

@@ -1,71 +0,0 @@
-"""Phase 2 - 查重功能：duplication_records + duplication_segments
-
-Revision ID: 012
-Revises: 011
-Create Date: 2026-06-28
-
-This migration creates two new tables:
-1. duplication_records — 查重记录主表
-2. duplication_segments — 重复片段详情表
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers
-revision = "012"
-down_revision = "011"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # ── 1. Create duplication_records table ──
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS duplication_records (
-            id VARCHAR(36) PRIMARY KEY,
-            user_id VARCHAR(36) NOT NULL,
-            filename VARCHAR(500) NOT NULL,
-            file_size INTEGER NOT NULL,
-            storage_key VARCHAR(500) NOT NULL,
-            duration_seconds FLOAT NOT NULL DEFAULT 0,
-            status VARCHAR(20) NOT NULL DEFAULT 'pending',
-            duplicate_rate FLOAT,
-            duplicate_count INTEGER NOT NULL DEFAULT 0,
-            video_fingerprint TEXT,
-            error_message TEXT NOT NULL DEFAULT '',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_duplication_records_user_id ON duplication_records(user_id)"))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_duplication_records_status ON duplication_records(status)"))
-
-    # ── 2. Create duplication_segments table ──
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS duplication_segments (
-            id VARCHAR(36) PRIMARY KEY,
-            record_id VARCHAR(36) NOT NULL,
-            source_start FLOAT NOT NULL,
-            source_end FLOAT NOT NULL,
-            matched_video_id VARCHAR(36) NOT NULL,
-            matched_video_name VARCHAR(500) NOT NULL DEFAULT '',
-            matched_start FLOAT NOT NULL,
-            matched_end FLOAT NOT NULL,
-            similarity FLOAT NOT NULL
-        )
-    """))
-    conn.execute(
-        sa.text("CREATE INDEX IF NOT EXISTS ix_duplication_segments_record_id ON duplication_segments(record_id)")
-    )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    conn.execute(sa.text("DROP TABLE IF EXISTS duplication_segments"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS duplication_records"))

alembic/versions/013_add_recipe_tables.py

@@ -1,62 +0,0 @@
-"""Phase 2 - 配方复用：recipes + recipe_items
-
-Revision ID: 013
-Revises: 012
-Create Date: 2026-06-29
-
-This migration creates two new tables:
-1. recipes — 配方主表
-2. recipe_items — 配方素材项表
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers
-revision = "013"
-down_revision = "012"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # ── 1. Create recipes table ──
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS recipes (
-            id VARCHAR(36) PRIMARY KEY,
-            user_id VARCHAR(36) NOT NULL,
-            name VARCHAR(200) NOT NULL,
-            description TEXT NOT NULL DEFAULT '',
-            template_id VARCHAR(36) NOT NULL DEFAULT '',
-            generation_params JSONB NOT NULL DEFAULT '{}',
-            is_active BOOLEAN NOT NULL DEFAULT TRUE,
-            metadata JSONB NOT NULL DEFAULT '{}',
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_recipes_user_id ON recipes(user_id)"))
-
-    # ── 2. Create recipe_items table ──
-
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS recipe_items (
-            id VARCHAR(36) PRIMARY KEY,
-            recipe_id VARCHAR(36) NOT NULL,
-            item_type VARCHAR(20) NOT NULL,
-            item_id VARCHAR(36) NOT NULL,
-            position INTEGER NOT NULL DEFAULT 0,
-            metadata JSONB NOT NULL DEFAULT '{}'
-        )
-    """))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_recipe_items_recipe_id ON recipe_items(recipe_id)"))
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    conn.execute(sa.text("DROP TABLE IF EXISTS recipe_items"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS recipes"))

alembic/versions/014_add_template_tables.py

@@ -1,83 +0,0 @@
-"""Phase 3 - 剪辑计划模板：templates + template_segments + template_categories
-
-Revision ID: 014
-Revises: 013
-Create Date: 2026-06-29
-
-This migration creates three new tables:
-1. templates — 剪辑计划模板主表
-2. template_segments — 模板片段表
-3. template_categories — 模板分类表
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-# revision identifiers
-revision = "014"
-down_revision = "013"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    conn = op.get_bind()
-
-    # ── 1. Create templates table ──
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS templates (
-            id VARCHAR(36) PRIMARY KEY,
-            user_id VARCHAR(36) NOT NULL,
-            name VARCHAR(200) NOT NULL,
-            mode VARCHAR(30) NOT NULL,
-            category VARCHAR(100) NOT NULL DEFAULT '',
-            tags JSONB NOT NULL DEFAULT '[]',
-            title_config JSONB NOT NULL DEFAULT '{}',
-            subtitle_config JSONB NOT NULL DEFAULT '{}',
-            bgm_config JSONB NOT NULL DEFAULT '{}',
-            estimated_duration FLOAT NOT NULL DEFAULT 0.0,
-            is_active BOOLEAN NOT NULL DEFAULT TRUE,
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_templates_user_id ON templates(user_id)"))
-    conn.execute(sa.text("CREATE INDEX IF NOT EXISTS ix_templates_mode ON templates(mode)"))
-
-    # ── 2. Create template_segments table ──
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS template_segments (
-            id VARCHAR(36) PRIMARY KEY,
-            template_id VARCHAR(36) NOT NULL,
-            segment_order INTEGER NOT NULL,
-            duration_min FLOAT NOT NULL,
-            duration_max FLOAT NOT NULL,
-            material_type VARCHAR(20),
-            created_at TIMESTAMP NOT NULL DEFAULT NOW(),
-            updated_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-    conn.execute(
-        sa.text("CREATE INDEX IF NOT EXISTS ix_template_segments_template_id " "ON template_segments(template_id)")
-    )
-
-    # ── 3. Create template_categories table ──
-    conn.execute(sa.text("""
-        CREATE TABLE IF NOT EXISTS template_categories (
-            id VARCHAR(36) PRIMARY KEY,
-            user_id VARCHAR(36) NOT NULL,
-            name VARCHAR(100) NOT NULL,
-            created_at TIMESTAMP NOT NULL DEFAULT NOW()
-        )
-    """))
-    conn.execute(
-        sa.text("CREATE INDEX IF NOT EXISTS ix_template_categories_user_id " "ON template_categories(user_id)")
-    )
-
-
-def downgrade() -> None:
-    conn = op.get_bind()
-    conn.execute(sa.text("DROP TABLE IF EXISTS template_categories"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS template_segments"))
-    conn.execute(sa.text("DROP TABLE IF EXISTS templates"))

alembic/versions/015_add_generation_task_extensions.py

@@ -1,34 +0,0 @@
-"""add generation task extensions
-
-Revision ID: 015
-Revises: 014
-Create Date: 2026-06-29
-"""
-
-import sqlalchemy as sa
-from sqlalchemy.dialects import mysql
-
-from alembic import op
-
-# revision identifiers
-revision = "015"
-down_revision = "014"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("generation_tasks", sa.Column("template_id", sa.String(36), nullable=False, server_default=""))
-    op.add_column("generation_tasks", sa.Column("asset_ids", mysql.JSON(), nullable=False, server_default="[]"))
-    op.add_column("generation_tasks", sa.Column("title_ids", mysql.JSON(), nullable=False, server_default="[]"))
-    op.add_column("generation_tasks", sa.Column("voice_ids", mysql.JSON(), nullable=False, server_default="[]"))
-
-    op.create_index(op.f("ix_generation_tasks_template_id"), "generation_tasks", ["template_id"])
-
-
-def downgrade() -> None:
-    op.drop_index(op.f("ix_generation_tasks_template_id"), table_name="generation_tasks")
-    op.drop_column("generation_tasks", "voice_ids")
-    op.drop_column("generation_tasks", "title_ids")
-    op.drop_column("generation_tasks", "asset_ids")
-    op.drop_column("generation_tasks", "template_id")

alembic/versions/016_phase8_edit_template_plan.py

@@ -1,116 +0,0 @@
-"""phase8 edit template plan
-
-Revision ID: 016
-Revises: 015
-Create Date: 2026-07-01
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "016"
-down_revision = "015"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # --- edit_templates: 替换为 Phase 8 新 schema ---
-    # 删除旧列
-    op.drop_column("edit_templates", "project_id")
-    op.drop_column("edit_templates", "target_duration")
-    op.drop_column("edit_templates", "clip_count")
-    op.drop_column("edit_templates", "is_active")
-    op.drop_column("edit_templates", "created_by_user_id")
-    op.drop_column("edit_templates", "metadata")
-
-    # 添加新列
-    op.add_column(
-        "edit_templates",
-        sa.Column("template_type", sa.String(50), nullable=False, server_default="default"),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("config", sa.JSON(), nullable=False, server_default="{}"),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("preview_url", sa.String(1000), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("sort_weight", sa.Integer(), nullable=False, server_default="0"),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("status", sa.String(20), nullable=False, server_default="active"),
-    )
-
-    # 添加索引
-    op.create_index("ix_edit_templates_template_type", "edit_templates", ["template_type"])
-    op.create_index("ix_edit_templates_sort_weight", "edit_templates", ["sort_weight"])
-    op.create_index("ix_edit_templates_status", "edit_templates", ["status"])
-
-    # --- edit_plans: 重建表（在 011 中被删除） ---
-    op.create_table(
-        "edit_plans",
-        sa.Column("id", sa.String(32), primary_key=True),
-        sa.Column("template_id", sa.String(32), nullable=False, index=True),
-        sa.Column("name", sa.String(200), nullable=False),
-        sa.Column("status", sa.String(20), nullable=False, server_default="draft", index=True),
-        sa.Column("total_duration", sa.Float(), nullable=False, server_default="0"),
-        sa.Column("config", sa.JSON(), nullable=False, server_default="{}"),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("edit_plans")
-
-    op.drop_index("ix_edit_templates_status", "edit_templates")
-    op.drop_index("ix_edit_templates_sort_weight", "edit_templates")
-    op.drop_index("ix_edit_templates_template_type", "edit_templates")
-
-    op.drop_column("edit_templates", "status")
-    op.drop_column("edit_templates", "sort_weight")
-    op.drop_column("edit_templates", "preview_url")
-    op.drop_column("edit_templates", "config")
-    op.drop_column("edit_templates", "template_type")
-
-    # 恢复旧列
-    op.add_column(
-        "edit_templates",
-        sa.Column("project_id", sa.String(32), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("target_duration", sa.Float(), nullable=False, server_default="30"),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("clip_count", sa.Integer(), nullable=False, server_default="3"),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("is_active", sa.Boolean(), nullable=False, server_default=sa.true()),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("created_by_user_id", sa.String(32), nullable=False, server_default=""),
-    )
-    op.add_column(
-        "edit_templates",
-        sa.Column("metadata", sa.JSON(), nullable=False, server_default="{}"),
-    )

alembic/versions/017_phase8_clip_config_plan_clip.py

@@ -1,82 +0,0 @@
-"""Phase 8: Create template_clip_configs and edit_plan_clips tables
-
-Revision ID: 017
-Revises: 016
-Create Date: 2026-07-01
-
-新增两张表：
-- template_clip_configs: 模板片段配置（定义模板中每个片段的规则）
-- edit_plan_clips: 剪辑计划片段（剪辑计划中的具体片段实例）
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "017"
-down_revision = "016"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    # template_clip_configs: 模板片段配置表
-    op.create_table(
-        "template_clip_configs",
-        sa.Column("id", sa.String(32), primary_key=True),
-        sa.Column("template_id", sa.String(32), nullable=False, index=True),
-        sa.Column("clip_type", sa.String(20), nullable=False, index=True),
-        sa.Column("order", sa.Integer, nullable=False),
-        sa.Column("min_duration", sa.Float, nullable=False, server_default="0.0"),
-        sa.Column("max_duration", sa.Float, nullable=False, server_default="0.0"),
-        sa.Column("text_template", sa.Text, nullable=False, server_default=""),
-        sa.Column("material_requirements", sa.JSON, nullable=False, server_default="{}"),
-        sa.Column("transition_effect", sa.String(20), nullable=False, server_default="cut"),
-        sa.Column("config", sa.JSON, nullable=False, server_default="{}"),
-        sa.Column(
-            "created_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-    # edit_plan_clips: 剪辑计划片段表
-    op.create_table(
-        "edit_plan_clips",
-        sa.Column("id", sa.String(32), primary_key=True),
-        sa.Column("plan_id", sa.String(32), nullable=False, index=True),
-        sa.Column("clip_type", sa.String(20), nullable=False, index=True),
-        sa.Column("order", sa.Integer, nullable=False),
-        sa.Column("template_clip_config_id", sa.String(32), nullable=False, server_default="", index=True),
-        sa.Column("asset_id", sa.String(32), nullable=False, server_default="", index=True),
-        sa.Column("text_content", sa.Text, nullable=False, server_default=""),
-        sa.Column("start_time", sa.Float, nullable=False, server_default="0.0"),
-        sa.Column("duration", sa.Float, nullable=False, server_default="0.0"),
-        sa.Column("transition_effect", sa.String(20), nullable=False, server_default="cut"),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("config", sa.JSON, nullable=False, server_default="{}"),
-        sa.Column(
-            "created_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("edit_plan_clips")
-    op.drop_table("template_clip_configs")

alembic/versions/018_add_jobs_table.py

@@ -1,55 +0,0 @@
-"""Phase 8 任务 2.10: Create jobs table for unified async task management
-
-Revision ID: 018
-Revises: 017
-Create Date: 2026-07-01
-
-新增 jobs 表，用于统一管理异步任务（视频合成、渲染等）的生命周期。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "018"
-down_revision = "017"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "jobs",
-        sa.Column("id", sa.String(32), primary_key=True),
-        sa.Column("project_id", sa.String(32), nullable=False, index=True),
-        sa.Column("job_type", sa.String(30), nullable=False, index=True),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("progress", sa.Float, nullable=False, server_default="0.0"),
-        sa.Column("current_stage", sa.String(200), nullable=False, server_default=""),
-        sa.Column("payload", sa.JSON, nullable=False, server_default="{}"),
-        sa.Column("result", sa.JSON, nullable=False, server_default="{}"),
-        sa.Column("error_message", sa.Text, nullable=False, server_default=""),
-        sa.Column("retry_count", sa.Integer, nullable=False, server_default="0"),
-        sa.Column("max_retries", sa.Integer, nullable=False, server_default="3"),
-        sa.Column("celery_task_id", sa.String(100), nullable=False, server_default=""),
-        sa.Column("source_id", sa.String(32), nullable=False, server_default="", index=True),
-        sa.Column("created_by_user_id", sa.String(32), nullable=False, server_default="", index=True),
-        sa.Column("started_at", sa.DateTime, nullable=True),
-        sa.Column("completed_at", sa.DateTime, nullable=True),
-        sa.Column(
-            "created_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime,
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("jobs")

alembic/versions/019_add_voice_clone_profiles_table.py

@@ -1,53 +0,0 @@
-"""Task 3.05: Create voice_clone_profiles table
-
-Revision ID: 019
-Revises: 018
-Create Date: 2026-07-02
-
-新增 voice_clone_profiles 表，用于存储音色克隆档案。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "019"
-down_revision = "018"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "voice_clone_profiles",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("name", sa.String(100), nullable=False),
-        sa.Column("description", sa.Text(), nullable=False, server_default=""),
-        sa.Column("source_audio_url", sa.Text(), nullable=False, server_default=""),
-        sa.Column("voice_id", sa.String(100), nullable=False, server_default=""),
-        sa.Column("voice_model", sa.String(100), nullable=False, server_default=""),
-        sa.Column("language", sa.String(20), nullable=False, server_default="zh-CN"),
-        sa.Column("gender", sa.String(20), nullable=False, server_default="unknown"),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("error_message", sa.Text(), nullable=False, server_default=""),
-        sa.Column("retry_count", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("max_retries", sa.Integer(), nullable=False, server_default="3"),
-        sa.Column("metadata", sa.JSON(), nullable=False, server_default="{}"),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("voice_clone_profiles")

alembic/versions/020_add_tts_jobs_table.py

@@ -1,59 +0,0 @@
-"""Task 3.06: Create tts_jobs table
-
-Revision ID: 020
-Revises: 019
-Create Date: 2026-07-02
-
-新增 tts_jobs 表，用于存储 TTS 合成任务。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "020"
-down_revision = "019"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "tts_jobs",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("input_text", sa.Text(), nullable=False),
-        sa.Column("voice_id", sa.String(100), nullable=False, server_default=""),
-        sa.Column("voice_model", sa.String(100), nullable=False, server_default=""),
-        sa.Column("project_id", sa.String(36), nullable=False, server_default=""),
-        sa.Column("voice_clone_profile_id", sa.String(36), nullable=False, server_default=""),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending", index=True),
-        sa.Column("output_audio_url", sa.Text(), nullable=False, server_default=""),
-        sa.Column("output_audio_key", sa.String(500), nullable=False, server_default=""),
-        sa.Column("duration", sa.Float(), nullable=False, server_default="0"),
-        sa.Column("file_size", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("sample_rate", sa.Integer(), nullable=False, server_default="22050"),
-        sa.Column("format", sa.String(20), nullable=False, server_default="mp3"),
-        sa.Column("error_message", sa.Text(), nullable=False, server_default=""),
-        sa.Column("retry_count", sa.Integer(), nullable=False, server_default="0"),
-        sa.Column("max_retries", sa.Integer(), nullable=False, server_default="3"),
-        sa.Column("metadata", sa.JSON(), nullable=False, server_default="{}"),
-        sa.Column("started_at", sa.DateTime(), nullable=True),
-        sa.Column("completed_at", sa.DateTime(), nullable=True),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column(
-            "updated_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("tts_jobs")

alembic/versions/021_add_billing_records_table.py

@@ -1,43 +0,0 @@
-"""Task 3.09: Create billing_records table
-
-Revision ID: 021
-Revises: 020
-Create Date: 2026-07-03
-
-新增 billing_records 表，用于存储账单记录。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "021"
-down_revision = "020"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.create_table(
-        "billing_records",
-        sa.Column("id", sa.String(36), primary_key=True),
-        sa.Column("user_id", sa.String(36), nullable=False, index=True),
-        sa.Column("plan_name", sa.String(50), nullable=False),
-        sa.Column("amount", sa.Float, nullable=False),
-        sa.Column("billing_cycle", sa.String(20), nullable=False),
-        sa.Column("status", sa.String(20), nullable=False, server_default="pending"),
-        sa.Column("payment_method", sa.String(50), nullable=True),
-        sa.Column("payment_id", sa.String(100), nullable=True),
-        sa.Column("invoice_url", sa.String(500), nullable=True),
-        sa.Column(
-            "created_at",
-            sa.DateTime(),
-            nullable=False,
-            server_default=sa.func.now(),
-        ),
-        sa.Column("paid_at", sa.DateTime(), nullable=True),
-    )
-
-
-def downgrade() -> None:
-    op.drop_table("billing_records")

alembic/versions/022_add_source_edit_plan_id.py

@@ -1,56 +0,0 @@
-"""Task: Add source_edit_plan_id to edit_plans and generation_tasks
-
-Revision ID: 022
-Revises: 021
-Create Date: 2026-07-04
-
-新增 source_edit_plan_id 字段到 edit_plans 和 generation_tasks 表，
-用于关联生成记录到其来源的剪辑计划。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "022"
-down_revision = "021"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "edit_plans",
-        sa.Column("source_edit_plan_id", sa.String(32), nullable=True),
-    )
-    op.create_index(
-        op.f("ix_edit_plans_source_edit_plan_id"),
-        "edit_plans",
-        ["source_edit_plan_id"],
-        unique=False,
-    )
-
-    op.add_column(
-        "generation_tasks",
-        sa.Column("source_edit_plan_id", sa.String(32), nullable=True),
-    )
-    op.create_index(
-        op.f("ix_generation_tasks_source_edit_plan_id"),
-        "generation_tasks",
-        ["source_edit_plan_id"],
-        unique=False,
-    )
-
-
-def downgrade() -> None:
-    op.drop_index(
-        op.f("ix_generation_tasks_source_edit_plan_id"),
-        table_name="generation_tasks",
-    )
-    op.drop_column("generation_tasks", "source_edit_plan_id")
-
-    op.drop_index(
-        op.f("ix_edit_plans_source_edit_plan_id"),
-        table_name="edit_plans",
-    )
-    op.drop_column("edit_plans", "source_edit_plan_id")

alembic/versions/023_add_edit_plan_project_and_user.py

@@ -1,56 +0,0 @@
-"""Task: Add project_id and created_by_user_id to edit_plans
-
-Revision ID: 023
-Revises: 022
-Create Date: 2026-07-05
-
-新增 project_id 和 created_by_user_id 字段到 edit_plans 表，
-用于项目归属鉴权和用户归属追踪，修复审计发现的 P1 越权漏洞。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "023"
-down_revision = "022"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "edit_plans",
-        sa.Column("project_id", sa.String(32), nullable=False, server_default=""),
-    )
-    op.create_index(
-        op.f("ix_edit_plans_project_id"),
-        "edit_plans",
-        ["project_id"],
-        unique=False,
-    )
-
-    op.add_column(
-        "edit_plans",
-        sa.Column("created_by_user_id", sa.String(32), nullable=False, server_default=""),
-    )
-    op.create_index(
-        op.f("ix_edit_plans_created_by_user_id"),
-        "edit_plans",
-        ["created_by_user_id"],
-        unique=False,
-    )
-
-
-def downgrade() -> None:
-    op.drop_index(
-        op.f("ix_edit_plans_created_by_user_id"),
-        table_name="edit_plans",
-    )
-    op.drop_column("edit_plans", "created_by_user_id")
-
-    op.drop_index(
-        op.f("ix_edit_plans_project_id"),
-        table_name="edit_plans",
-    )
-    op.drop_column("edit_plans", "project_id")

alembic/versions/024_add_user_is_admin.py

@@ -1,28 +0,0 @@
-"""Task: Add is_admin to users
-
-Revision ID: 024
-Revises: 023
-Create Date: 2026-07-05
-
-新增 is_admin 字段到 users 表，用于模板管理等管理员权限校验。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "024"
-down_revision = "023"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "users",
-        sa.Column("is_admin", sa.Boolean(), nullable=False, server_default=sa.text("false")),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("users", "is_admin")

alembic/versions/025_add_user_wechat_fields.py

@@ -1,79 +0,0 @@
-"""Task: Add wechat_openid / wechat_unionid to users
-
-Revision ID: 025
-Revises: 024
-Create Date: 2026-07-05
-
-补录微信小程序登录所需的 wechat 字段。
-生产数据库已手动添加过这些字段和索引，因此 upgrade 做幂等检查，
-避免在已有字段的库上执行报错。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "025"
-down_revision = "024"
-branch_labels = None
-depends_on = None
-
-
-def _column_exists(table: str, column: str) -> bool:
-    """检查列是否已存在。离线模式下返回 False。"""
-    conn = op.get_bind()
-    try:
-        result = conn.execute(
-            sa.text("SELECT 1 FROM information_schema.columns " "WHERE table_name = :table AND column_name = :column"),
-            {"table": table, "column": column},
-        )
-        if result is None:
-            return False
-        return result.scalar() is not None
-    except Exception:
-        return False
-
-
-def _index_exists(index: str) -> bool:
-    """检查索引是否已存在。离线模式下返回 False。"""
-    conn = op.get_bind()
-    try:
-        result = conn.execute(
-            sa.text("SELECT 1 FROM pg_indexes WHERE indexname = :index"),
-            {"index": index},
-        )
-        if result is None:
-            return False
-        return result.scalar() is not None
-    except Exception:
-        return False
-
-
-def upgrade() -> None:
-    # wechat_openid
-    if not _column_exists("users", "wechat_openid"):
-        op.add_column(
-            "users",
-            sa.Column("wechat_openid", sa.String(length=128), nullable=True),
-        )
-
-    # wechat_unionid
-    if not _column_exists("users", "wechat_unionid"):
-        op.add_column(
-            "users",
-            sa.Column("wechat_unionid", sa.String(length=128), nullable=True),
-        )
-
-    # 唯一索引
-    if not _index_exists("ix_users_wechat_openid"):
-        op.create_index("ix_users_wechat_openid", "users", ["wechat_openid"], unique=True)
-
-    if not _index_exists("ix_users_wechat_unionid"):
-        op.create_index("ix_users_wechat_unionid", "users", ["wechat_unionid"], unique=True)
-
-
-def downgrade() -> None:
-    op.drop_index("ix_users_wechat_unionid", table_name="users")
-    op.drop_index("ix_users_wechat_openid", table_name="users")
-    op.drop_column("users", "wechat_unionid")
-    op.drop_column("users", "wechat_openid")

alembic/versions/026_add_user_profile_fields.py

@@ -1,56 +0,0 @@
-"""Add user profile fields (name, avatar, updated_at)
-
-Revision ID: 026
-Revises: 025
-Create Date: 2026-07-05
-
-补录用户资料字段。生产数据库已手动添加过这些字段，
-因此 upgrade 做幂等检查，避免在已有字段的库上执行报错。
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "026"
-down_revision = "025"
-branch_labels = None
-depends_on = None
-
-
-def _column_exists(table: str, column: str) -> bool:
-    if context.is_offline_mode():
-        return False
-    conn = op.get_bind()
-    result = conn.execute(
-        sa.text(
-            "SELECT COUNT(*) FROM information_schema.columns " "WHERE table_name = :table AND column_name = :column"
-        ),
-        {"table": table, "column": column},
-    )
-    return result.scalar() > 0
-
-
-def upgrade() -> None:
-    if not _column_exists("users", "name"):
-        op.add_column("users", sa.Column("name", sa.String(100), nullable=True))
-
-    if not _column_exists("users", "avatar"):
-        op.add_column("users", sa.Column("avatar", sa.String(500), nullable=True))
-
-    if not _column_exists("users", "updated_at"):
-        op.add_column(
-            "users",
-            sa.Column(
-                "updated_at",
-                sa.DateTime(),
-                nullable=True,
-                server_default=sa.func.now(),
-            ),
-        )
-
-
-def downgrade() -> None:
-    op.drop_column("users", "updated_at")
-    op.drop_column("users", "avatar")
-    op.drop_column("users", "name")

alembic/versions/027_add_user_ban_fields.py

@@ -1,44 +0,0 @@
-"""Add user ban fields (ban_reason, ban_at)
-
-Revision ID: 027
-Revises: 026
-Create Date: 2026-07-05
-
-补录用户封禁字段。生产数据库已手动添加过这些字段，
-因此 upgrade 做幂等检查。
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "027"
-down_revision = "026"
-branch_labels = None
-depends_on = None
-
-
-def _column_exists(table: str, column: str) -> bool:
-    if context.is_offline_mode():
-        return False
-    conn = op.get_bind()
-    result = conn.execute(
-        sa.text(
-            "SELECT COUNT(*) FROM information_schema.columns " "WHERE table_name = :table AND column_name = :column"
-        ),
-        {"table": table, "column": column},
-    )
-    return result.scalar() > 0
-
-
-def upgrade() -> None:
-    if not _column_exists("users", "ban_reason"):
-        op.add_column("users", sa.Column("ban_reason", sa.Text(), nullable=True))
-
-    if not _column_exists("users", "ban_at"):
-        op.add_column("users", sa.Column("ban_at", sa.DateTime(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("users", "ban_at")
-    op.drop_column("users", "ban_reason")

alembic/versions/028_add_user_admin_fields.py

@@ -1,44 +0,0 @@
-"""Add user admin fields (admin_status, admin_remarks)
-
-Revision ID: 028
-Revises: 027
-Create Date: 2026-07-05
-
-补录管理员备注字段。生产数据库已手动添加过这些字段，
-因此 upgrade 做幂等检查。
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "028"
-down_revision = "027"
-branch_labels = None
-depends_on = None
-
-
-def _column_exists(table: str, column: str) -> bool:
-    if context.is_offline_mode():
-        return False
-    conn = op.get_bind()
-    result = conn.execute(
-        sa.text(
-            "SELECT COUNT(*) FROM information_schema.columns " "WHERE table_name = :table AND column_name = :column"
-        ),
-        {"table": table, "column": column},
-    )
-    return result.scalar() > 0
-
-
-def upgrade() -> None:
-    if not _column_exists("users", "admin_status"):
-        op.add_column("users", sa.Column("admin_status", sa.String(50), nullable=True))
-
-    if not _column_exists("users", "admin_remarks"):
-        op.add_column("users", sa.Column("admin_remarks", sa.Text(), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("users", "admin_remarks")
-    op.drop_column("users", "admin_status")

alembic/versions/029_add_user_phone.py

@@ -1,40 +0,0 @@
-"""Add user phone field
-
-Revision ID: 029
-Revises: 028
-Create Date: 2026-07-05
-
-补录用户手机号字段。生产数据库已手动添加过该字段，
-因此 upgrade 做幂等检查。
-"""
-
-import sqlalchemy as sa
-
-from alembic import context, op
-
-revision = "029"
-down_revision = "028"
-branch_labels = None
-depends_on = None
-
-
-def _column_exists(table: str, column: str) -> bool:
-    if context.is_offline_mode():
-        return False
-    conn = op.get_bind()
-    result = conn.execute(
-        sa.text(
-            "SELECT COUNT(*) FROM information_schema.columns " "WHERE table_name = :table AND column_name = :column"
-        ),
-        {"table": table, "column": column},
-    )
-    return result.scalar() > 0
-
-
-def upgrade() -> None:
-    if not _column_exists("users", "phone"):
-        op.add_column("users", sa.Column("phone", sa.String(20), nullable=True))
-
-
-def downgrade() -> None:
-    op.drop_column("users", "phone")

alembic/versions/030_add_tags_and_asset_tags.py

@@ -1,68 +0,0 @@
-"""Add tags and asset_tags tables
-
-Revision ID: 030
-Revises: 029
-Create Date: 2026-07-07
-
-新增标签表和素材-标签关联表，支持规范化多对多标签管理。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "030"
-down_revision = "029"
-branch_labels = None
-depends_on = None
-
-
-def _table_exists(table: str) -> bool:
-    ctx = op.get_context()
-    if ctx.as_sql:
-        return False
-    conn = op.get_bind()
-    result = conn.execute(
-        sa.text("SELECT COUNT(*) FROM information_schema.tables WHERE table_name = :table"),
-        {"table": table},
-    )
-    return (result.scalar() or 0) > 0
-
-
-def upgrade() -> None:
-    if not _table_exists("tags"):
-        op.create_table(
-            "tags",
-            sa.Column("id", sa.String(36), primary_key=True),
-            sa.Column("user_id", sa.String(36), nullable=False),
-            sa.Column("name", sa.String(100), nullable=False),
-            sa.Column(
-                "created_at",
-                sa.DateTime(),
-                nullable=False,
-                server_default=sa.func.now(),
-            ),
-            sa.UniqueConstraint("user_id", "name", name="uq_tags_user_name"),
-        )
-        op.create_index("ix_tags_user_id", "tags", ["user_id"])
-
-    if not _table_exists("asset_tags"):
-        op.create_table(
-            "asset_tags",
-            sa.Column("asset_id", sa.String(36), primary_key=True),
-            sa.Column("tag_id", sa.String(36), primary_key=True),
-            sa.Column(
-                "created_at",
-                sa.DateTime(),
-                nullable=False,
-                server_default=sa.func.now(),
-            ),
-        )
-        op.create_index("ix_asset_tags_tag_id", "asset_tags", ["tag_id"])
-
-
-def downgrade() -> None:
-    op.drop_index("ix_asset_tags_tag_id", table_name="asset_tags")
-    op.drop_table("asset_tags")
-    op.drop_index("ix_tags_user_id", table_name="tags")
-    op.drop_table("tags")

alembic/versions/031_add_file_hash_to_assets_and_ing_jobs.py

@@ -1,33 +0,0 @@
-"""Add file_hash to assets and ingest_jobs
-
-Revision ID: 031
-Revises: 030
-Create Date: 2026-07-07
-
-为素材去重检测功能添加 file_hash 字段。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "031"
-down_revision = "030"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column("assets", sa.Column("file_hash", sa.String(64), nullable=True))
-    op.create_index(op.f("ix_assets_file_hash"), "assets", ["file_hash"])
-
-    op.add_column("ingest_jobs", sa.Column("file_hash", sa.String(64), nullable=True))
-    op.create_index(op.f("ix_ingest_jobs_file_hash"), "ingest_jobs", ["file_hash"])
-
-
-def downgrade() -> None:
-    op.drop_index(op.f("ix_ingest_jobs_file_hash"), table_name="ingest_jobs")
-    op.drop_column("ingest_jobs", "file_hash")
-
-    op.drop_index(op.f("ix_assets_file_hash"), table_name="assets")
-    op.drop_column("assets", "file_hash")

alembic/versions/032_add_asset_select_mode_to_generation_tasks.py

@@ -1,28 +0,0 @@
-"""Add asset_select_mode to generation_tasks
-
-Revision ID: 032
-Revises: 031
-Create Date: 2026-07-07
-
-素材库自动匹配功能：为 generation_tasks 表添加 asset_select_mode 字段。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "032"
-down_revision = "031"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column("asset_select_mode", sa.String(20), nullable=False, server_default=""),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("generation_tasks", "asset_select_mode")

alembic/versions/033_add_batch_id_to_generation_tasks.py

@@ -1,31 +0,0 @@
-"""Add batch_id to generation_tasks
-
-Revision ID: 033
-Revises: 032
-Create Date: 2026-07-07
-
-视频查重功能：为 generation_tasks 表添加 batch_id 字段，
-用于关联同一次批量生成请求中的多个任务。
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "033"
-down_revision = "032"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column("batch_id", sa.String(32), nullable=False, server_default=""),
-    )
-    op.create_index(op.f("ix_generation_tasks_batch_id"), "generation_tasks", ["batch_id"])
-
-
-def downgrade() -> None:
-    op.drop_index(op.f("ix_generation_tasks_batch_id"), table_name="generation_tasks")
-    op.drop_column("generation_tasks", "batch_id")

alembic/versions/034_cms_enhance_placeholder.py

@@ -1,28 +0,0 @@
-"""CMS Enhancements (placeholder - manually applied on production)
-
-Revision ID: 034_cms_enhance
-Revises: 033
-Create Date: 2026-07-09
-
-占位迁移文件：生产数据库已手动升级到此版本，
-此文件用于让 alembic 识别当前版本，避免部署时迁移失败。
-实际的表结构变更（helpcenter, tickets, partners, site_settings 等）
-已在生产环境手动执行。
-"""
-
-from alembic import op
-
-revision = "034_cms_enhance"
-down_revision = "033"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    """占位 - 变更已在生产环境手动应用"""
-    pass
-
-
-def downgrade() -> None:
-    """占位 - 不执行实际回退"""
-    pass

alembic/versions/035_add_editing_mode_to_templates.py

@@ -1,26 +0,0 @@
-"""Add editing_mode to edit_templates
-
-Revision ID: 035_editing_mode
-Revises: 034_cms_enhance
-Create Date: 2026-07-09
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "035_editing_mode"
-down_revision = "034_cms_enhance"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "edit_templates",
-        sa.Column("editing_mode", sa.String(20), nullable=False, server_default="one_take"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("edit_templates", "editing_mode")

alembic/versions/036_expand_uuid_fields_to_36.py

@@ -1,68 +0,0 @@
-"""Expand UUID fields from varchar(32) to varchar(36)
-
-All UUID fields across all tables were varchar(32), but standard UUIDs with
-hyphens are 36 characters (e.g. 550e8400-e29b-41d4-a716-446655440000).
-This caused StringDataRightTruncation errors on insert.
-
-Revision ID: 036_expand_uuid_36
-Revises: 035_editing_mode
-Create Date: 2026-07-10
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "036_expand_uuid_36"
-down_revision = "035_editing_mode"
-branch_labels = None
-depends_on = None
-
-
-# ── 表 → 需要扩容的列 ─────────────────────────────────────────────────────────
-
-_TABLES: dict[str, list[str]] = {
-    "projects": ["id", "owner_user_id"],
-    "edit_templates": ["id"],
-    "edit_plans": ["id", "template_id", "source_edit_plan_id", "project_id", "created_by_user_id"],
-    "template_clip_configs": ["id", "template_id"],
-    "edit_plan_clips": ["id", "plan_id", "template_clip_config_id", "asset_id"],
-    "ingest_jobs": ["id", "project_id", "library_id", "result_asset_id"],
-    "classification_jobs": ["id", "project_id", "asset_id"],
-    "generation_tasks": [
-        "id",
-        "project_id",
-        "strategy_id",
-        "asset_library_id",
-        "voice_library_id",
-        "created_by_user_id",
-        "source_edit_plan_id",
-        "batch_id",
-    ],
-    "generated_videos": ["id", "project_id", "generation_task_id", "duplicate_of"],
-    "jobs": ["id", "project_id", "source_id", "created_by_user_id"],
-}
-
-
-def upgrade() -> None:
-    for table, columns in _TABLES.items():
-        for col in columns:
-            op.alter_column(
-                table,
-                col,
-                existing_type=sa.String(32),
-                type_=sa.String(36),
-                existing_nullable=None,
-            )
-
-
-def downgrade() -> None:
-    for table, columns in reversed(list(_TABLES.items())):
-        for col in columns:
-            op.alter_column(
-                table,
-                col,
-                existing_type=sa.String(36),
-                type_=sa.String(32),
-                existing_nullable=None,
-            )

alembic/versions/037_add_logs_to_generation_tasks.py

@@ -1,26 +0,0 @@
-"""Add logs field to generation_tasks
-
-Revision ID: 037_generation_logs
-Revises: 036_expand_uuid_36
-Create Date: 2026-07-10
-"""
-
-import sqlalchemy as sa
-
-from alembic import op
-
-revision = "037_generation_logs"
-down_revision = "036_expand_uuid_36"
-branch_labels = None
-depends_on = None
-
-
-def upgrade() -> None:
-    op.add_column(
-        "generation_tasks",
-        sa.Column("logs", sa.Text(), nullable=False, server_default="[]"),
-    )
-
-
-def downgrade() -> None:
-    op.drop_column("generation_tasks", "logs")

apps/api/app/api/router.py

@@ -4,28 +4,17 @@ from app.api.routes.assets import router as assets_router
 from app.api.routes.auth import router as auth_router
 from app.api.routes.chunked_upload import router as chunked_upload_router
 from app.api.routes.classification_jobs import router as classification_jobs_router
-from app.api.routes.dashboard import router as dashboard_router
-from app.api.routes.duplication import router as duplication_router
 from app.api.routes.edit_plans import router as edit_plans_router
-from app.api.routes.edit_templates import router as edit_templates_router
-from app.api.routes.feature_flags import router as feature_flags_router
 from app.api.routes.generated_videos import router as generated_videos_router
 from app.api.routes.generation_tasks import router as generation_tasks_router
 from app.api.routes.health import router as health_check_router
 from app.api.routes.ingest_jobs import router as ingest_jobs_router
-from app.api.routes.internal_render import router as internal_render_router
-from app.api.routes.jobs import router as jobs_router
+from app.api.routes.project_management import router as project_management_router
+from app.api.routes.project_titles import router as project_titles_router
 from app.api.routes.projects import router as projects_router
-from app.api.routes.recipes import router as recipes_router
-from app.api.routes.subscription import router as subscription_router
-from app.api.routes.tags import router as tags_router
 from app.api.routes.task_center import router as task_center_router
-from app.api.routes.templates import router as templates_router
-from app.api.routes.titles import router as titles_router
-from app.api.routes.tts import router as tts_router
 from app.api.routes.upload import router as upload_router
-from app.api.routes.voice_clones import router as voice_clones_router
-from app.api.routes.voices import router as voices_router
+from app.api.routes.workspaces import router as workspaces_router
 from fastapi import APIRouter
 
 api_router = APIRouter(prefix="/api/v1")
@@ -36,15 +25,21 @@ api_router.include_router(
     auth_router,
     tags=["Auth"],
 )
+api_router.include_router(
+    workspaces_router,
+    tags=["Workspace"],
+)
 api_router.include_router(
     projects_router,
     prefix="/projects",
     tags=["Project"],
 )
 api_router.include_router(
-    tags_router,
-    prefix="/tags",
-    tags=["Tag"],
+    project_titles_router,
+    tags=["TitleLibrary"],
+)
+api_router.include_router(
+    edit_plans_router,
 )
 api_router.include_router(
     task_center_router,
@@ -89,75 +84,13 @@ api_router.include_router(
     prefix="/generation",
     tags=["Generation"],
 )
-api_router.include_router(
-    jobs_router,
-    tags=["Job"],
-)
 api_router.include_router(
     generated_videos_router,
     prefix="/generated-videos",
     tags=["GeneratedVideo"],
 )
 api_router.include_router(
-    titles_router,
-    prefix="/titles",
-    tags=["TitleLibrary"],
-)
-api_router.include_router(
-    voices_router,
-    prefix="/voices",
-    tags=["VoiceLibrary"],
-)
-api_router.include_router(
-    voice_clones_router,
-    prefix="/voice-clones",
-    tags=["VoiceClone"],
-)
-api_router.include_router(
-    duplication_router,
-    prefix="/duplication",
-    tags=["Duplication"],
-)
-api_router.include_router(
-    subscription_router,
-    prefix="/subscription",
-    tags=["Subscription"],
-)
-api_router.include_router(
-    recipes_router,
-    prefix="/recipes",
-    tags=["Recipe"],
-)
-api_router.include_router(
-    templates_router,
-    prefix="/templates",
-    tags=["Template"],
-)
-api_router.include_router(
-    dashboard_router,
-    prefix="/dashboard",
-    tags=["Dashboard"],
-)
-api_router.include_router(
-    edit_templates_router,
-    prefix="/edit-templates",
-    tags=["EditTemplate"],
-)
-api_router.include_router(
-    edit_plans_router,
-    prefix="/edit-plans",
-    tags=["EditPlan"],
-)
-api_router.include_router(
-    tts_router,
-    prefix="/tts",
-    tags=["TTS"],
-)
-api_router.include_router(
-    feature_flags_router,
-    tags=["Internal"],
-)
-api_router.include_router(
-    internal_render_router,
-    tags=["Internal"],
+    project_management_router,
+    prefix="/project-management",
+    tags=["ProjectManagement"],
 )

apps/api/app/api/routes/asset_diagnosis.py

@@ -1,18 +1,18 @@
-import logging
-from typing import Any, Optional
+from typing import Any
 
+from app.api.routes.permissions import require_workspace_member
 from app.auth import AuthenticatedUser, get_current_user
 from app.dependencies import (
     get_asset_library_repository,
     get_asset_repository,
     get_project_repository,
+    get_workspace_member_repository,
 )
 from app.schemas.asset_diagnosis import AssetGapItem, AssetSmartViewItem, ProjectAssetDiagnosisResponse
-from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi import APIRouter, Depends, HTTPException
 
 from packages.domain import Asset, AssetLibraryKind, AssetStatus
-
-logger = logging.getLogger(__name__)
+from packages.ports.workspace_member_repository import WorkspaceMemberRepository
 
 router = APIRouter()
 
@@ -37,7 +37,7 @@ def _readiness_label(score: int) -> str:
     return "暂不建议生成"
 
 
-def _build_diagnosis(project_id: str, assets: list[Asset]) -> ProjectAssetDiagnosisResponse:
+def _build_diagnosis(workspace_id: str, project_id: str, assets: list[Asset]) -> ProjectAssetDiagnosisResponse:
     ready_assets = [asset for asset in assets if asset.status == AssetStatus.READY]
     video_assets = [asset for asset in ready_assets if _asset_kind(asset) == AssetLibraryKind.VIDEO]
     image_assets = [asset for asset in ready_assets if _asset_kind(asset) == AssetLibraryKind.IMAGE]
@@ -175,6 +175,7 @@ def _build_diagnosis(project_id: str, assets: list[Asset]) -> ProjectAssetDiagno
     ]
 
     return ProjectAssetDiagnosisResponse(
+        workspace_id=workspace_id,
         project_id=project_id,
         readiness_score=score,
         readiness_label=_readiness_label(score),
@@ -193,152 +194,23 @@ def _build_diagnosis(project_id: str, assets: list[Asset]) -> ProjectAssetDiagno
     )
 
 
-def _build_single_asset_diagnosis(project_id: str, asset: Asset) -> ProjectAssetDiagnosisResponse:
-    """为单个素材构建诊断结果"""
-    kind = _asset_kind(asset)
-    is_ready = asset.status == AssetStatus.READY
-    is_problem = asset.status in {AssetStatus.ERROR, AssetStatus.UPLOADING, AssetStatus.PROCESSING}
-    is_risky = is_ready and (
-        (asset.quality_score is not None and asset.quality_score < 60)
-        or asset.metadata.get("review_status") == "rejected"
-        or asset.status == AssetStatus.ERROR
-    )
-    is_unclassified = is_ready and asset.classification_status.value in {"pending", "failed"}
-
-    # 单素材评分
-    score = 0
-    if is_ready:
-        score = 60
-        if kind == "video":
-            score += 20
-        if asset.duration and asset.duration >= 5:
-            score += 10
-        if asset.quality_score and asset.quality_score >= 60:
-            score += 10
-    if is_problem:
-        score = max(score - 30, 0)
-    if is_risky:
-        score = max(score - 20, 0)
-    score = max(0, min(100, score))
-
-    gaps: list[AssetGapItem] = []
-    if not is_ready:
-        gaps.append(
-            AssetGapItem(
-                key="asset_not_ready",
-                severity="critical",
-                message=f"素材状态为 {asset.status.value}，尚未就绪",
-                recommendation="等待素材导入完成后再使用。",
-            )
-        )
-    if is_risky:
-        gaps.append(
-            AssetGapItem(
-                key="asset_low_quality",
-                severity="warning",
-                message="素材质量分偏低或已被拒绝",
-                recommendation="建议使用更清晰、稳定的素材替代。",
-            )
-        )
-    if is_unclassified:
-        gaps.append(
-            AssetGapItem(
-                key="asset_unclassified",
-                severity="info",
-                message="素材尚未完成分类",
-                recommendation="等待分类完成或手动检查素材类型。",
-            )
-        )
-    if kind == "video" and (asset.duration is None or asset.duration < 5):
-        gaps.append(
-            AssetGapItem(
-                key="short_video",
-                severity="warning",
-                message="视频时长偏短",
-                recommendation="建议使用时长 5 秒以上的视频素材。",
-            )
-        )
-
-    used_count = int(asset.metadata.get("generation_use_count") or 0)
-    smart_views = [
-        AssetSmartViewItem(
-            key="asset_info",
-            label="素材信息",
-            count=1,
-            description=f"类型: {kind}，状态: {asset.status.value}",
-        ),
-        AssetSmartViewItem(
-            key="asset_quality",
-            label="质量评分",
-            count=int(asset.quality_score or 0),
-            description=f"质量分: {asset.quality_score or '未评分'}",
-        ),
-        AssetSmartViewItem(
-            key="asset_usage",
-            label="使用次数",
-            count=used_count,
-            description=f"参与生成 {used_count} 次",
-        ),
-    ]
-
-    video_count = 1 if kind == "video" and is_ready else 0
-    image_count = 1 if kind == "image" and is_ready else 0
-    voice_count = 1 if kind == "voice" and is_ready else 0
-    total_duration = round(float(asset.duration or 0), 2) if kind == "video" else 0.0
-
-    return ProjectAssetDiagnosisResponse(
-        project_id=project_id,
-        readiness_score=score,
-        readiness_label=_readiness_label(score),
-        total_assets=1,
-        ready_assets=1 if is_ready else 0,
-        video_assets=video_count,
-        image_assets=image_count,
-        voice_assets=voice_count,
-        total_duration_seconds=total_duration,
-        estimated_video_count=1 if video_count and total_duration >= 5 else 0,
-        used_assets=1 if used_count > 0 else 0,
-        unused_assets=1 if used_count == 0 and is_ready else 0,
-        pending_review_assets=1 if asset.metadata.get("review_status") == "pending_review" else 0,
-        smart_views=smart_views,
-        gaps=gaps,
-    )
-
-
 @router.get("/projects/{project_id}/asset-diagnosis", response_model=ProjectAssetDiagnosisResponse)
 def get_project_asset_diagnosis(
     project_id: str,
-    asset_id: Optional[str] = Query(None),
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
     asset_repository: Any = Depends(get_asset_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ProjectAssetDiagnosisResponse:
-    try:
-        project = project_repository.find_by_id(project_id)
-        if project is None:
-            raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-        if not project.can_access(authenticated_user.user.id):
-            raise HTTPException(status_code=403, detail="Access denied to project")
+    project = project_repository.find_by_id(project_id)
+    if project is None:
+        raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
+    require_workspace_member(project.workspace_id, authenticated_user, workspace_member_repository)
 
-        # 单素材诊断模式
-        if asset_id:
-            asset = asset_repository.get(asset_id)
-            if asset is None:
-                raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-            if asset.project_id != project_id:
-                raise HTTPException(status_code=403, detail="Asset does not belong to this project")
-            return _build_single_asset_diagnosis(project_id, asset)
+    libraries = asset_library_repository.list_by_project(project_id)
+    assets: list[Asset] = []
+    for library in libraries:
+        assets.extend(asset_repository.list_by_library(library.id))
 
-        libraries = asset_library_repository.find_by_project(project_id)
-        assets: list[Asset] = []
-        for library in libraries:
-            assets.extend(asset_repository.list_by_library(library.id))
-    except HTTPException:
-        raise
-    except Exception:
-        logger.exception("素材诊断查询失败: project_id=%s", project_id)
-        # 返回空诊断结果，避免 500
-        return _build_diagnosis(project_id, [])
-
-    return _build_diagnosis(project_id, assets)
+    return _build_diagnosis(project.workspace_id, project_id, assets)

apps/api/app/api/routes/asset_libraries.py

@@ -1,18 +1,13 @@
 from typing import Any
 
 from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import (
-    get_asset_library_repository,
-    get_asset_repository,
-    get_project_repository,
-)
+from app.dependencies import get_asset_library_repository, get_project_repository
 from app.schemas.asset_library import (
     AssetLibraryResponse,
     CreateAssetLibraryRequest,
-    EnsureDefaultLibraryRequest,
     ListAssetLibrariesResponse,
 )
-from fastapi import APIRouter, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Depends, HTTPException, status
 
 from packages.application import (
     CreateAssetLibraryCommand,
@@ -20,7 +15,7 @@ from packages.application import (
     GetProjectUseCase,
     ListAssetLibrariesUseCase,
 )
-from packages.domain import AssetLibrary, AssetLibraryKind
+from packages.domain import AssetLibraryKind
 
 router = APIRouter()
 
@@ -47,36 +42,18 @@ def _to_asset_library_response(item) -> AssetLibraryResponse:
 
 @router.get("", response_model=ListAssetLibrariesResponse)
 def list_asset_libraries(
-    project_id: str | None = Query(None),
-    kind: str | None = Query(None, pattern="^(video|voice|image)$"),
+    project_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     asset_library_repository: Any = Depends(get_asset_library_repository),
     project_repository: Any = Depends(get_project_repository),
 ) -> ListAssetLibrariesResponse:
-    user_id = authenticated_user.user.id
+    project = GetProjectUseCase(project_repository).execute(project_id)
+    if project is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
+    if not project.can_access(authenticated_user.id):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied to project")
     use_case = ListAssetLibrariesUseCase(asset_library_repository)
-
-    if project_id:
-        # If project_id provided, check access and filter by project
-        project = GetProjectUseCase(project_repository).execute(project_id)
-        if project is None:
-            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
-        if not project.can_access(user_id):
-            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied to project")
-        items = use_case.execute(project_id)
-    else:
-        # If no project_id, list all libraries from accessible projects
-        accessible_projects = project_repository.find_accessible_projects(user_id)
-        all_items = []
-        for proj in accessible_projects:
-            all_items.extend(use_case.execute(proj.id))
-        items = all_items
-
-    # 按 kind 过滤（可选）
-    if kind:
-        kind_enum = AssetLibraryKind(kind)
-        items = [item for item in items if item.kind == kind_enum]
-
+    items = use_case.execute(project_id)
     return ListAssetLibrariesResponse(items=[_to_asset_library_response(item) for item in items])
 
 
@@ -90,7 +67,7 @@ def create_asset_library(
     project = project_repository.find_by_id(request.project_id)
     if project is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
-    if not project.can_access(authenticated_user.user.id):
+    if not project.can_access(authenticated_user.id):
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied to project")
     use_case = CreateAssetLibraryUseCase(asset_library_repository)
     item = use_case.execute(
@@ -101,80 +78,3 @@ def create_asset_library(
         )
     )
     return _to_asset_library_response(item)
-
-
-# 默认素材库名称映射
-_DEFAULT_LIBRARY_NAMES = {
-    "video": "视频素材库",
-    "voice": "配音素材库",
-    "image": "图片素材库",
-}
-
-
-@router.post("/ensure-default", response_model=AssetLibraryResponse)
-def ensure_default_library(
-    request: EnsureDefaultLibraryRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_library_repository: Any = Depends(get_asset_library_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> AssetLibraryResponse:
-    """确保项目下指定 kind 的默认素材库存在，已存在则直接返回，不存在则自动创建。"""
-    project = project_repository.find_by_id(request.project_id)
-    if project is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
-    if not project.can_access(authenticated_user.user.id):
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied to project")
-
-    kind = AssetLibraryKind(request.kind)
-
-    # 查找该项目下同 kind 的素材库，返回第一个
-    existing = asset_library_repository.find_by_project(request.project_id)
-    for lib in existing:
-        if lib.kind == kind:
-            return _to_asset_library_response(lib)
-
-    # 不存在 → 自动创建
-    import uuid
-    from datetime import datetime, timezone
-
-    now = datetime.now(timezone.utc)
-    default_name = _DEFAULT_LIBRARY_NAMES.get(request.kind, f"{request.kind}素材库")
-    library = AssetLibrary(
-        id=str(uuid.uuid4()),
-        project_id=request.project_id,
-        name=default_name,
-        kind=kind,
-        asset_count=0,
-        total_size=0,
-        created_at=now,
-        updated_at=now,
-    )
-    created = asset_library_repository.create(library)
-    return _to_asset_library_response(created)
-
-
-@router.delete("/{library_id}", status_code=status.HTTP_204_NO_CONTENT)
-def delete_asset_library(
-    library_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_library_repository: Any = Depends(get_asset_library_repository),
-    asset_repository: Any = Depends(get_asset_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> None:
-    """删除素材库，同时删除库内所有素材。"""
-    # 查找素材库
-    library = asset_library_repository.find_by_id(library_id)
-    if library is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="素材库不存在")
-
-    # 权限校验：检查用户是否有项目访问权限
-    _check_project_access(library.project_id, authenticated_user.user.id, project_repository)
-
-    # 删除库内所有素材（无 FK 级联，需手动清理）
-    assets_in_library = asset_repository.find_by_library(library_id)
-    if assets_in_library:
-        asset_ids_to_delete = [a.id for a in assets_in_library]
-        asset_repository.batch_delete(asset_ids_to_delete)
-
-    # 删除素材库本身
-    asset_library_repository.delete(library_id)

apps/api/app/api/routes/assets.py

@@ -1,53 +1,25 @@
-import logging
-from typing import Any, Optional
+from typing import Any
 
 from app.auth import AuthenticatedUser, get_current_user
-from app.core.storage import get_storage_service
 from app.dependencies import (
     get_asset_library_repository,
     get_asset_repository,
     get_project_repository,
-    get_tag_repository,
 )
-from app.schemas.asset import (
-    AssetResponse,
-    BatchDeleteRequest,
-    BatchDeleteResponse,
-    CreateAssetRequest,
-    ListAssetsResponse,
-    UpdateAssetRequest,
-    UpdateAssetReviewRequest,
-)
-from app.schemas.tag import TagAssetsRequest
-from fastapi import APIRouter, Depends, HTTPException, Query
+from app.schemas.asset import AssetResponse, CreateAssetRequest, ListAssetsResponse, UpdateAssetReviewRequest
+from fastapi import APIRouter, Depends, HTTPException
 
 from packages.application import (
     CreateAssetCommand,
     CreateAssetUseCase,
+    ListAssetsUseCase,
 )
 from packages.domain import AssetStatus, ClassificationStatus
 
-logger = logging.getLogger(__name__)
-
 router = APIRouter()
 
 
-def _to_asset_response(item, storage_service=None) -> AssetResponse:
-    # 生成签名文件 URL（用于视频播放 / 文件下载）
-    file_url = None
-    if item.storage_key:
-        try:
-            svc = storage_service or get_storage_service()
-            file_url = svc.get_download_url(item.storage_key)
-        except Exception:
-            logger.warning("生成签名URL失败: storage_key=%s", item.storage_key, exc_info=True)
-            file_url = None
-
-    # 缩略图：优先用已有 thumbnail_url，否则对视频素材复用文件签名 URL
-    thumbnail_url = item.thumbnail_url
-    if not thumbnail_url and item.mime_type and item.mime_type.startswith("video") and file_url:
-        thumbnail_url = file_url
-
+def _to_asset_response(item) -> AssetResponse:
     return AssetResponse(
         id=item.id,
         project_id=item.project_id,
@@ -57,8 +29,7 @@ def _to_asset_response(item, storage_service=None) -> AssetResponse:
         mime_type=item.mime_type,
         metadata=item.metadata,
         file_size=item.file_size,
-        file_url=file_url,
-        thumbnail_url=thumbnail_url,
+        thumbnail_url=item.thumbnail_url,
         duration=item.duration,
         width=item.width,
         height=item.height,
@@ -68,7 +39,6 @@ def _to_asset_response(item, storage_service=None) -> AssetResponse:
         classification_status=item.classification_status.value,
         quality_score=item.quality_score,
         uploaded_by_user_id=item.uploaded_by_user_id,
-        tag_ids=getattr(item, "tag_ids", []),
     )
 
 
@@ -83,164 +53,19 @@ def _check_project_access(project_id: str, user_id: str, project_repository) ->
 
 @router.get("", response_model=ListAssetsResponse)
 def list_assets(
-    library_id: Optional[str] = Query(None),
-    project_id: Optional[str] = Query(None),
-    kind: Optional[str] = Query(None, pattern="^(video|voice|image)$"),
-    keyword: Optional[str] = Query(None, description="按名称模糊匹配"),
-    gender: Optional[str] = Query(None, description="按 metadata.gender 筛选"),
-    style: Optional[str] = Query(None, description="按 metadata.style 筛选"),
-    tag_ids: Optional[str] = Query(None, description="按标签 ID 筛选（逗号分隔，取交集）"),
-    skip: int = Query(0, ge=0),
-    limit: int = Query(100, ge=1, le=500),
+    library_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     asset_repository: Any = Depends(get_asset_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
     project_repository: Any = Depends(get_project_repository),
 ) -> ListAssetsResponse:
-    user_id = authenticated_user.user.id
-
-    # kind → file_type 映射（voice 对应 audio）
-    kind_to_file_type = {"video": "video", "voice": "audio", "image": "image"}
-
-    # 解析 tag_ids 参数（逗号分隔）
-    filter_tag_ids: list[str] | None = None
-    if tag_ids:
-        filter_tag_ids = [t.strip() for t in tag_ids.split(",") if t.strip()]
-        if not filter_tag_ids:
-            filter_tag_ids = None
-
-    # 需要内存过滤的标志（keyword/gender/style/tag_ids 无法在 DB 层过滤）
-    needs_memory_filter = bool(keyword or gender or style or filter_tag_ids)
-
-    def _apply_memory_filters(items):
-        """应用 keyword / gender / style / tag_ids 内存过滤。"""
-        result = items
-        if keyword:
-            kw = keyword.lower()
-            result = [i for i in result if kw in (i.name or "").lower()]
-        if gender:
-            result = [i for i in result if (i.metadata or {}).get("gender") == gender]
-        if style:
-            result = [i for i in result if (i.metadata or {}).get("style") == style]
-        if filter_tag_ids:
-            tag_set = set(filter_tag_ids)
-            result = [i for i in result if tag_set.issubset(set(getattr(i, "tag_ids", [])))]
-        return result
-
-    # ── 优化路径：无内存过滤时，使用 DB 级分页 ──
-    if not needs_memory_filter:
-        ft = kind_to_file_type.get(kind) if kind else None
-
-        # 模式1：指定 library_id
-        if library_id:
-            library = asset_library_repository.get(library_id)
-            if library is None:
-                raise HTTPException(status_code=404, detail=f"AssetLibrary {library_id} not found")
-            _check_project_access(library.project_id, user_id, project_repository)
-            if ft:
-                items = asset_repository.find_by_library_and_file_type(library_id, ft, skip=skip, limit=limit)
-                total = asset_repository.count_by_project(library.project_id) if not kind else len(items)
-            else:
-                items = asset_repository.find_by_library(library_id, skip=skip, limit=limit)
-                total = asset_repository.count_by_project(library.project_id)
-            return ListAssetsResponse(
-                items=[_to_asset_response(item) for item in items],
-                total=total,
-                skip=skip,
-                limit=limit,
-            )
-
-        # 模式2：指定 project_id
-        if project_id:
-            _check_project_access(project_id, user_id, project_repository)
-            if ft:
-                # 无直接方法，加载后按 file_type 过滤（仍比全量加载好）
-                all_items = asset_repository.find_by_project(project_id)
-                items = [i for i in all_items if i.mime_type and i.mime_type.startswith(ft)]
-                total = len(items)
-                paged = items[skip : skip + limit]
-            else:
-                items = asset_repository.find_by_project(project_id, skip=skip, limit=limit)
-                total = asset_repository.count_by_project(project_id)
-                paged = items
-            return ListAssetsResponse(
-                items=[_to_asset_response(item) for item in paged],
-                total=total,
-                skip=skip,
-                limit=limit,
-            )
-
-        # 模式3：跨项目（无 library_id/project_id）
-        try:
-            projects = project_repository.find_accessible_projects(user_id)
-        except Exception:
-            logger.exception("查询用户可访问项目失败: user_id=%s", user_id)
-            return ListAssetsResponse(items=[], total=0, skip=skip, limit=limit)
-
-        project_ids = [p.id for p in projects]
-        if not project_ids:
-            return ListAssetsResponse(items=[], total=0, skip=skip, limit=limit)
-
-        total = asset_repository.count_by_project_ids(project_ids)
-        # 跨项目分页：逐项目累积直到凑够一页
-        paged_items: list = []
-        offset = skip
-        remaining = limit
-        for pid in project_ids:
-            proj_total = asset_repository.count_by_project(pid)
-            if offset >= proj_total:
-                offset -= proj_total
-                continue
-            proj_items = asset_repository.find_by_project(pid, skip=offset, limit=remaining)
-            paged_items.extend(proj_items)
-            remaining -= len(proj_items)
-            offset = 0
-            if remaining <= 0:
-                break
-
-        return ListAssetsResponse(
-            items=[_to_asset_response(item) for item in paged_items],
-            total=total,
-            skip=skip,
-            limit=limit,
-        )
-
-    # ── 内存过滤路径：有 keyword/gender/style 时，加载全量后内存过滤 ──
-    if library_id:
-        library = asset_library_repository.get(library_id)
-        if library is None:
-            raise HTTPException(status_code=404, detail=f"AssetLibrary {library_id} not found")
-        _check_project_access(library.project_id, user_id, project_repository)
-        if kind:
-            all_items = asset_repository.find_by_library_and_file_type(library_id, kind_to_file_type[kind])
-        else:
-            all_items = asset_repository.find_by_library(library_id)
-    elif project_id:
-        _check_project_access(project_id, user_id, project_repository)
-        all_items = asset_repository.find_by_project(project_id)
-    else:
-        try:
-            projects = project_repository.find_accessible_projects(user_id)
-        except Exception:
-            logger.exception("查询用户可访问项目失败: user_id=%s", user_id)
-            return ListAssetsResponse(items=[], total=0, skip=skip, limit=limit)
-        all_items = []
-        for proj in projects:
-            all_items.extend(asset_repository.find_by_project(proj.id))
-
-    # 应用 kind 过滤（如果有）+ keyword/gender/style
-    if kind:
-        ft = kind_to_file_type.get(kind)
-        all_items = [i for i in all_items if i.mime_type and i.mime_type.startswith(ft or "")]
-    filtered = _apply_memory_filters(all_items)
-    total = len(filtered)
-    paged = filtered[skip : skip + limit]
-    return ListAssetsResponse(
-        items=[_to_asset_response(item) for item in paged],
-        total=total,
-        skip=skip,
-        limit=limit,
-    )
+    library = asset_library_repository.get(library_id)
+    if library is None:
+        raise HTTPException(status_code=404, detail=f"AssetLibrary {library_id} not found")
+    _check_project_access(library.project_id, authenticated_user.id, project_repository)
+    use_case = ListAssetsUseCase(asset_repository)
+    items = use_case.execute(library_id)
+    return ListAssetsResponse(items=[_to_asset_response(item) for item in items])
 
 
 def _apply_asset_review_status(item, review_status: str):
@@ -262,136 +87,12 @@ def update_asset_review_status(
     item = asset_repository.get(asset_id)
     if item is None:
         raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
+    _check_project_access(item.project_id, authenticated_user.id, project_repository)
     _apply_asset_review_status(item, request.review_status)
     updated = asset_repository.update(item)
     return _to_asset_response(updated)
 
 
-@router.post("/batch-delete", response_model=BatchDeleteResponse)
-def batch_delete_assets(
-    request: BatchDeleteRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_repository: Any = Depends(get_asset_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> BatchDeleteResponse:
-    """批量删除素材（配音素材等），需逐项校验项目权限。"""
-    user_id = authenticated_user.user.id
-    deleted_ids: list[str] = []
-    failed_ids: list[str] = []
-
-    for asset_id in request.ids:
-        item = asset_repository.find_by_id(asset_id)
-        if item is None:
-            failed_ids.append(asset_id)
-            continue
-        try:
-            _check_project_access(item.project_id, user_id, project_repository)
-            deleted_ids.append(asset_id)
-        except HTTPException:
-            failed_ids.append(asset_id)
-
-    if deleted_ids:
-        asset_repository.batch_delete(deleted_ids)
-
-    return BatchDeleteResponse(deleted_count=len(deleted_ids), failed_ids=failed_ids)
-
-
-@router.get("/{asset_id}", response_model=AssetResponse)
-def get_asset(
-    asset_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_repository: Any = Depends(get_asset_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> AssetResponse:
-    item = asset_repository.find_by_id(asset_id)
-    if item is None:
-        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
-    return _to_asset_response(item)
-
-
-@router.put("/{asset_id}", response_model=AssetResponse)
-def update_asset(
-    asset_id: str,
-    request: UpdateAssetRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_repository: Any = Depends(get_asset_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> AssetResponse:
-    item = asset_repository.find_by_id(asset_id)
-    if item is None:
-        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
-
-    # 合并可修改字段
-    if request.name is not None:
-        item.name = request.name
-    if request.metadata is not None:
-        item.metadata = {**item.metadata, **request.metadata}
-    if request.tags is not None:
-        item.metadata = {**item.metadata, "tags": request.tags}
-
-    updated = asset_repository.update(item)
-    return _to_asset_response(updated)
-
-
-@router.delete("/{asset_id}", status_code=204)
-def delete_asset(
-    asset_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_repository: Any = Depends(get_asset_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> None:
-    item = asset_repository.find_by_id(asset_id)
-    if item is None:
-        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
-    asset_repository.delete(asset_id)
-
-
-@router.post("/{asset_id}/tags", response_model=AssetResponse)
-def tag_asset(
-    asset_id: str,
-    request: TagAssetsRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_repository: Any = Depends(get_asset_repository),
-    project_repository: Any = Depends(get_project_repository),
-    tag_repository: Any = Depends(get_tag_repository),
-) -> AssetResponse:
-    """给素材打标签。"""
-    item = asset_repository.find_by_id(asset_id)
-    if item is None:
-        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
-    for tag_id in request.tag_ids:
-        tag = tag_repository.get(tag_id)
-        if tag is None:
-            raise HTTPException(status_code=404, detail=f"Tag {tag_id} not found")
-        if tag.user_id != authenticated_user.user.id:
-            raise HTTPException(status_code=403, detail=f"无权使用标签 {tag_id}")
-        item.add_tag(tag_id)
-    updated = asset_repository.update(item)
-    return _to_asset_response(updated)
-
-
-@router.delete("/{asset_id}/tags/{tag_id}", status_code=204)
-def untag_asset(
-    asset_id: str,
-    tag_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    asset_repository: Any = Depends(get_asset_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> None:
-    """取消素材的标签。"""
-    item = asset_repository.find_by_id(asset_id)
-    if item is None:
-        raise HTTPException(status_code=404, detail=f"Asset {asset_id} not found")
-    _check_project_access(item.project_id, authenticated_user.user.id, project_repository)
-    item.remove_tag(tag_id)
-    asset_repository.update(item)
-
-
 @router.post("", response_model=AssetResponse)
 def create_asset(
     request: CreateAssetRequest,
@@ -403,9 +104,9 @@ def create_asset(
     project = project_repository.find_by_id(request.project_id)
     if project is None:
         raise HTTPException(status_code=404, detail=f"Project {request.project_id} not found")
-    if not project.can_access(authenticated_user.user.id):
+    if not project.can_access(authenticated_user.id):
         raise HTTPException(status_code=403, detail="Access denied to project")
-
+    
     library = asset_library_repository.get(request.library_id)
     if library is None or library.project_id != request.project_id:
         raise HTTPException(status_code=404, detail=f"AssetLibrary {request.library_id} not found")
@@ -429,7 +130,7 @@ def create_asset(
             status=AssetStatus(request.status),
             classification_status=ClassificationStatus(request.classification_status),
             quality_score=request.quality_score,
-            uploaded_by_user_id=authenticated_user.user.id,
+            uploaded_by_user_id=authenticated_user.id,
         )
     )
     return _to_asset_response(item)

apps/api/app/api/routes/auth.py

@@ -5,24 +5,18 @@ The route layer is intentionally thin: repository construction lives in
 app.dependencies and authentication behavior lives in application use cases.
 """
 
-import logging
-import os
 from typing import Optional
 
-import jwt
-from app.auth import AuthenticatedUser, blacklist_token, get_current_user
+from app.auth import AuthenticatedUser, get_current_user
 from app.config import settings
 from app.dependencies import get_auth_email_service, get_auth_session_store, get_user_repository
-from fastapi import APIRouter, Depends, Header, HTTPException, status
-from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
+from fastapi import APIRouter, Depends, HTTPException, status
 from pydantic import BaseModel, EmailStr
 
 from packages.adapters.redis import NoopSessionStore
 from packages.adapters.smtp import NoopEmailService
 from packages.application.auth.login_use_case import LoginRequest as LoginUseCaseRequest
 from packages.application.auth.login_use_case import LoginUseCase
-from packages.application.auth.login_use_case import RefreshTokenRequest as RefreshTokenUseCaseRequest
-from packages.application.auth.login_use_case import RefreshTokenUseCase
 from packages.application.auth.password_reset_use_case import RequestPasswordResetRequest as PasswordResetUseCaseRequest
 from packages.application.auth.password_reset_use_case import (
     RequestPasswordResetUseCase,
@@ -33,10 +27,6 @@ from packages.application.auth.register_user_use_case import RegisterUserRequest
 from packages.application.auth.register_user_use_case import RegisterUserUseCase, VerifyEmailRequest, VerifyEmailUseCase
 from packages.ports.user_repository import UserRepository
 
-logger = logging.getLogger(__name__)
-
-bearer_scheme = HTTPBearer(auto_error=False)
-
 router = APIRouter(prefix="/auth", tags=["认证"])
 
 
@@ -60,13 +50,8 @@ class LoginRequest(BaseModel):
     password: str
 
 
-class RefreshRequest(BaseModel):
-    refresh_token: str
-
-
 class LoginResponse(BaseModel):
     access_token: str
-    refresh_token: str
     token_type: str = "bearer"
     user_id: str
     email: str
@@ -108,7 +93,7 @@ async def register(
 ):
     use_case = RegisterUserUseCase(
         user_repository=user_repository,
-        base_url=settings.APP_BASE_URL,
+        base_url="http://localhost:3000",
         email_service=email_service,
     )
     response, error = use_case.execute(
@@ -148,32 +133,6 @@ async def login(
 
     return LoginResponse(
         access_token=response.access_token,
-        refresh_token=response.refresh_token,
-        user_id=response.user_id,
-        email=response.email,
-        username=response.username,
-        display_name=response.display_name,
-        expires_in=response.expires_in,
-    )
-
-
-@router.post("/refresh")
-async def refresh(
-    request: RefreshRequest,
-    user_repository: UserRepository = Depends(get_user_repository),
-    session_store=Depends(get_auth_session_store),
-):
-    use_case = RefreshTokenUseCase(
-        user_repository=user_repository,
-        session_store=session_store,
-    )
-    response, error = use_case.execute(RefreshTokenUseCaseRequest(refresh_token=request.refresh_token))
-    if error or response is None:
-        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Invalid or expired refresh token")
-
-    return LoginResponse(
-        access_token=response.access_token,
-        refresh_token=response.refresh_token,
         user_id=response.user_id,
         email=response.email,
         username=response.username,
@@ -207,6 +166,7 @@ async def verify_email_post(
 
 
 @router.post("/password/forgot", response_model=MessageResponse, status_code=status.HTTP_202_ACCEPTED)
+@router.post("/forgot-password", response_model=MessageResponse, status_code=status.HTTP_202_ACCEPTED)
 async def forgot_password(
     request: PasswordResetRequestModel,
     user_repository: UserRepository = Depends(get_user_repository),
@@ -214,7 +174,7 @@ async def forgot_password(
 ):
     success, error = RequestPasswordResetUseCase(
         user_repository=user_repository,
-        base_url=settings.APP_BASE_URL,
+        base_url="http://localhost:3000",
         email_service=email_service,
     ).execute(PasswordResetUseCaseRequest(email=request.email))
     if not success:
@@ -224,6 +184,7 @@ async def forgot_password(
 
 
 @router.post("/password/reset", response_model=MessageResponse)
+@router.post("/reset-password", response_model=MessageResponse)
 async def reset_password(
     request: ResetPasswordModel,
     user_repository: UserRepository = Depends(get_user_repository),
@@ -237,24 +198,6 @@ async def reset_password(
     return MessageResponse(message="密码重置成功")
 
 
-@router.post("/logout")
-async def logout(
-    credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
-    current_user: AuthenticatedUser = Depends(get_current_user),
-):
-    """登出 - 将当前 token 加入黑名单"""
-    from fastapi.security import HTTPAuthorizationCredentials, HTTPBearer
-
-    if credentials:
-        try:
-            payload = jwt.decode(credentials.credentials, settings.JWT_SECRET_KEY, algorithms=["HS256"])
-            exp = payload.get("exp", 0)
-            blacklist_token(credentials.credentials, exp)
-        except Exception as e:
-            logger.warning(f"Operation failed in apps/api/app/api/routes/auth.py: {e}", exc_info=True)
-    return MessageResponse(message="已登出")
-
-
 @router.get("/me", response_model=CurrentUserResponse)
 async def get_current_user_info(
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
@@ -285,99 +228,3 @@ def _translate_auth_error(error: str | None) -> str:
         "Display name is required": "显示名称不能为空",
     }
     return translations.get(error or "", error or "注册失败")
-
-
-class WechatSyncRequest(BaseModel):
-    openid: str
-    unionid: Optional[str] = None
-    nickname: Optional[str] = None
-    avatar_url: Optional[str] = None
-    source: str = "miniapp"
-
-
-class WechatSyncResponse(BaseModel):
-    access_token: str
-    token: str
-    refresh_token: str
-    user_id: str
-    user: dict
-    user_info: dict
-    is_new_user: bool
-    expires_in: int
-
-
-def _get_internal_api_keys() -> list[str]:
-    """获取内部 API Key 列表
-
-    优先级:
-    1. INTERNAL_API_KEYS 环境变量
-    2. /app/generated/internal_api_keys.txt 文件 (volume 持久化)
-    """
-    env_keys = os.environ.get("INTERNAL_API_KEYS", "")
-    if env_keys:
-        return [k.strip() for k in env_keys.split(",") if k.strip()]
-
-    # 从持久化文件读取
-    try:
-        with open("/app/generated/internal_api_keys.txt", "r") as f:
-            content = f.read().strip()
-            if content:
-                return [k.strip() for k in content.split(",") if k.strip()]
-    except Exception:
-        logger.debug("Failed to read internal API keys from file", exc_info=True)
-
-    return []
-
-
-def _verify_internal_api_key(x_api_key: str | None = Header(None)) -> bool:
-    """验证内部 API Key
-
-    - 已配置时：必须匹配 INTERNAL_API_KEYS 中的 key
-    - 未配置且非生产环境：放行（方便开发）
-    - 未配置且生产环境：拒绝
-    """
-    env = os.environ.get("APP_ENV", os.environ.get("ENV", "development")).lower()
-    key_list = _get_internal_api_keys()
-
-    if not key_list:
-        if env in ("production", "prod"):
-            raise HTTPException(status_code=401, detail="内部接口未配置 API Key")
-        return True
-
-    if x_api_key and x_api_key.strip() in key_list:
-        return True
-
-    raise HTTPException(status_code=401, detail="无效的 API Key")
-
-
-@router.post("/wechat-sync", response_model=WechatSyncResponse, include_in_schema=False)
-async def wechat_sync(
-    request: WechatSyncRequest,
-    user_repository: UserRepository = Depends(get_user_repository),
-    _: bool = Depends(_verify_internal_api_key),
-):
-    """
-    微信同步登录/注册（系统级内部接口）
-
-    由 BFF 层通过 API Key 调用，不直接面向终端用户。
-    根据 openid 查找或创建用户，返回 SaaS token。
-    """
-    from packages.application.auth.wechat_sync_use_case import WechatSyncRequest as UseCaseRequest
-    from packages.application.auth.wechat_sync_use_case import (
-        WechatSyncUseCase,
-    )
-
-    use_case = WechatSyncUseCase(user_repository=user_repository)
-    use_case_request = UseCaseRequest(
-        openid=request.openid,
-        unionid=request.unionid,
-        nickname=request.nickname,
-        avatar_url=request.avatar_url,
-        source=request.source,
-    )
-
-    response, error = use_case.execute(use_case_request)
-    if error:
-        raise HTTPException(status_code=400, detail=error)
-
-    return WechatSyncResponse(**response.to_dict())

apps/api/app/api/routes/chunked_upload.py

@@ -6,8 +6,8 @@ Supports chunked upload, resume, and automatic cleanup of expired uploads.
 import fcntl
 import json
 import logging
+import os
 import shutil
-import tempfile
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from typing import Any
@@ -19,9 +19,9 @@ from app.core.celery_app import celery_app
 from app.core.storage import OSSStorageService, get_storage_service
 from app.dependencies import (
     get_asset_library_repository,
-    get_asset_repository,
     get_ingest_job_repository,
     get_project_repository,
+    get_workspace_member_repository,
 )
 from app.schemas.chunked_upload import (
     ChunkedUploadCompleteRequest,
@@ -34,6 +34,7 @@ from fastapi import APIRouter, Depends, HTTPException, UploadFile, status
 from fastapi.params import File
 
 from packages.application import GetProjectUseCase, SubmitIngestJobCommand, SubmitIngestJobUseCase
+from packages.ports.workspace_member_repository import WorkspaceMemberRepository
 
 router = APIRouter()
 logger = logging.getLogger(__name__)
@@ -43,37 +44,15 @@ DEFAULT_CHUNK_SIZE = 5 * 1024 * 1024  # 5MB
 MAX_FILE_SIZE = 2 * 1024 * 1024 * 1024  # 2GB
 CHUNK_EXPIRY_HOURS = 24
 
-# Allowed file types — must stay in sync with upload.py ALLOWED_MIME_TYPES
+# Allowed file types (consistent with existing upload.py)
 ALLOWED_MIME_TYPES = {
-    # Images
-    "image/jpeg",
-    "image/png",
-    "image/gif",
-    "image/webp",
-    "image/bmp",
-    "image/tiff",
-    "image/svg+xml",
-    # Video
-    "video/mp4",
-    "video/quicktime",
-    "video/mpeg",
-    "video/x-msvideo",
-    "video/webm",
-    "video/x-matroska",
-    "video/3gpp",
-    # Audio
-    "audio/mpeg",
-    "audio/wav",
-    "audio/ogg",
-    "audio/mp3",
-    "audio/flac",
-    "audio/aac",
-    "audio/x-m4a",
-    "audio/webm",
+    "image/jpeg", "image/png", "image/gif", "image/webp",
+    "video/mp4", "video/quicktime", "video/x-msvideo", "video/webm",
+    "audio/mpeg", "audio/wav", "audio/ogg", "audio/mp3",
 }
 
 # Chunk storage root directory
-CHUNK_STORAGE_ROOT = Path(tempfile.gettempdir()) / "chunked_uploads"
+CHUNK_STORAGE_ROOT = Path("/tmp/chunked_uploads")
 
 
 def _get_chunk_dir(upload_id: str) -> Path:
@@ -90,13 +69,13 @@ def _atomic_check_and_record(upload_id: str, chunk_index: int) -> bool:
     """
     Atomically check if chunk is uploaded and record if not.
     Uses file locking to prevent race conditions.
-
+    
     Returns:
         True if chunk was newly recorded, False if already exists
     """
     meta_path = _get_upload_meta_path(upload_id)
     CHUNK_STORAGE_ROOT.mkdir(parents=True, exist_ok=True)
-
+    
     with open(meta_path, "r+", encoding="utf-8") as f:
         fcntl.flock(f.fileno(), fcntl.LOCK_EX)
         try:
@@ -113,7 +92,19 @@ def _atomic_check_and_record(upload_id: str, chunk_index: int) -> bool:
             fcntl.flock(f.fileno(), fcntl.LOCK_UN)
 
 
+def _require_workspace_member(
+    workspace_id: str,
+    authenticated_user: AuthenticatedUser,
+    workspace_member_repository: WorkspaceMemberRepository,
+) -> None:
+    """Verify user has workspace permission"""
+    member = workspace_member_repository.find_by_workspace_and_user(workspace_id, authenticated_user.user.id)
+    if member is None:
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Workspace access denied")
+
+
 def _require_project_and_library(
+    workspace_id: str,
     project_id: str,
     library_id: str,
     project_repository: Any,
@@ -121,11 +112,11 @@ def _require_project_and_library(
 ) -> None:
     """Verify project and asset library exist"""
     project = GetProjectUseCase(project_repository).execute(project_id)
-    if project is None:
+    if project is None or project.workspace_id != workspace_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
 
-    libraries = asset_library_repository.find_by_project(project_id)
-    if not any(item.id == library_id for item in libraries):
+    libraries = asset_library_repository.list_by_project(project_id)
+    if not any(item.id == library_id and item.workspace_id == workspace_id for item in libraries):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Asset library not found")
 
 
@@ -151,17 +142,15 @@ def _validate_file_type(content: bytes, filename: str) -> str:
     """Validate file type"""
     try:
         import magic
-
         detected_mime = magic.from_buffer(content, mime=True)
     except ImportError:
         import mimetypes
-
         detected_mime = mimetypes.guess_type(filename)[0] or "application/octet-stream"
 
     if detected_mime not in ALLOWED_MIME_TYPES:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Unsupported file type: {detected_mime}. Allowed types: {', '.join(sorted(ALLOWED_MIME_TYPES))}",
+            detail=f"Unsupported file type: {detected_mime}. Allowed types: {', '.join(sorted(ALLOWED_MIME_TYPES))}"
         )
     return detected_mime
 
@@ -204,6 +193,7 @@ async def init_chunked_upload(
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ChunkedUploadInitResponse:
     """Initialize chunked upload"""
     settings = get_settings()
@@ -215,13 +205,17 @@ async def init_chunked_upload(
             detail=f"File exceeds maximum size ({MAX_FILE_SIZE // (1024 * 1024 * 1024)}GB)",
         )
 
-    # Validate project exists
+    # Validate project exists and get workspace_id
     project = GetProjectUseCase(project_repository).execute(request.project_id)
     if project is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
 
-    # Verify asset library
+    workspace_id = project.workspace_id
+
+    # Verify permission and asset library
+    _require_workspace_member(workspace_id, authenticated_user, workspace_member_repository)
     _require_project_and_library(
+        workspace_id,
         request.project_id,
         request.library_id,
         project_repository,
@@ -259,6 +253,7 @@ async def init_chunked_upload(
         "content_type": request.content_type,
         "project_id": request.project_id,
         "library_id": request.library_id,
+        "workspace_id": workspace_id,
         "status": "pending",
         "created_at": now.isoformat(),
         "expires_at": expires_at.isoformat(),
@@ -274,14 +269,95 @@ async def init_chunked_upload(
     )
 
 
+@router.post("/{upload_id}/{chunk_index}")
+async def upload_chunk(
+    upload_id: str,
+    chunk_index: int,
+    chunk: UploadFile = File(..., description="Chunk data"),
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
+) -> dict[str, Any]:
+    """Upload a single chunk"""
+    # Load metadata
+    meta = _load_upload_meta(upload_id)
+
+    # Check expiry
+    expires_at = datetime.fromisoformat(meta["expires_at"])
+    if expires_at.tzinfo is None:
+        expires_at = expires_at.replace(tzinfo=timezone.utc)
+
+    if expires_at < datetime.now(timezone.utc):
+        raise HTTPException(status_code=status.HTTP_410_GONE, detail="Upload has expired")
+
+    # Validate chunk index
+    if chunk_index < 0 or chunk_index >= meta["total_chunks"]:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"Invalid chunk index. Must be between 0 and {meta['total_chunks'] - 1}",
+        )
+
+    # Verify permission
+    _require_workspace_member(meta["workspace_id"], authenticated_user, workspace_member_repository)
+
+    # Atomic check and record to prevent race conditions
+    if not _atomic_check_and_record(upload_id, chunk_index):
+        return {"message": "Chunk already uploaded", "chunk_index": chunk_index}
+
+    # Read chunk data
+    chunk_data = await chunk.read()
+
+    # Validate chunk size (last chunk can be smaller than chunk_size)
+    expected_size = DEFAULT_CHUNK_SIZE
+    if chunk_index == meta["total_chunks"] - 1:
+        expected_size = meta["file_size"] - (chunk_index * DEFAULT_CHUNK_SIZE)
+
+    if len(chunk_data) != expected_size:
+        # Rollback the recorded chunk
+        meta_path = _get_upload_meta_path(upload_id)
+        with open(meta_path, "r+", encoding="utf-8") as f:
+            fcntl.flock(f.fileno(), fcntl.LOCK_EX)
+            try:
+                meta = json.load(f)
+                if chunk_index in meta["uploaded_chunks"]:
+                    meta["uploaded_chunks"].remove(chunk_index)
+                f.seek(0)
+                json.dump(meta, f, ensure_ascii=False, indent=2)
+                f.truncate()
+            finally:
+                fcntl.flock(f.fileno(), fcntl.LOCK_UN)
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=f"Chunk size mismatch. Expected {expected_size}, got {len(chunk_data)}",
+        )
+
+    # Save chunk
+    chunk_path = _get_chunk_dir(upload_id) / f"chunk_{chunk_index:06d}"
+    with open(chunk_path, "wb") as f:
+        f.write(chunk_data)
+
+    # Reload metadata for response
+    meta = _load_upload_meta(upload_id)
+
+    return {
+        "message": "Chunk uploaded successfully",
+        "chunk_index": chunk_index,
+        "uploaded_chunks": len(meta["uploaded_chunks"]),
+        "total_chunks": meta["total_chunks"],
+    }
+
+
 @router.get("/{upload_id}/status", response_model=ChunkedUploadStatusResponse)
 async def get_upload_status(
     upload_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ChunkedUploadStatusResponse:
     """Get upload status (for resume)"""
     meta = _load_upload_meta(upload_id)
 
+    # Verify permission
+    _require_workspace_member(meta["workspace_id"], authenticated_user, workspace_member_repository)
+
     return ChunkedUploadStatusResponse(
         upload_id=upload_id,
         filename=meta["filename"],
@@ -301,7 +377,7 @@ async def complete_chunked_upload(
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
-    asset_repository: Any = Depends(get_asset_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> ChunkedUploadCompleteResponse:
@@ -309,6 +385,9 @@ async def complete_chunked_upload(
     # Load metadata
     meta = _load_upload_meta(upload_id)
 
+    # Verify permission
+    _require_workspace_member(meta["workspace_id"], authenticated_user, workspace_member_repository)
+
     # Verify project ID and library ID
     if request.project_id != meta["project_id"] or request.library_id != meta["library_id"]:
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Project or library ID mismatch")
@@ -365,37 +444,14 @@ async def complete_chunked_upload(
             content_type=meta["content_type"],
         )
 
-        # ── 素材去重检测：同素材库 + 同 file_hash 视为重复 ──
-        if request.file_hash:
-            existing = asset_repository.find_by_library_and_file_hash(
-                library_id=request.library_id,
-                file_hash=request.file_hash,
-            )
-            if existing is not None:
-                logger.info(
-                    "素材去重命中(chunked): library=%s hash=%s existing_asset=%s",
-                    request.library_id,
-                    request.file_hash,
-                    existing.id,
-                )
-                meta["status"] = "completed"
-                _save_upload_meta(upload_id, meta)
-                return ChunkedUploadCompleteResponse(
-                    storage_key=storage_key,
-                    ingest_job_id="",
-                    url=file_url,
-                    duplicated=True,
-                    asset_id=existing.id,
-                )
-
         # Create ingest job
         use_case = SubmitIngestJobUseCase(ingest_job_repository)
         job = use_case.execute(
             SubmitIngestJobCommand(
+                workspace_id=meta["workspace_id"],
                 project_id=meta["project_id"],
                 library_id=meta["library_id"],
                 storage_key=storage_key,
-                file_hash=request.file_hash,
             )
         )
         celery_app.send_task("worker.ingest_asset", args=[job.id])
@@ -420,76 +476,3 @@ async def complete_chunked_upload(
         meta_path = _get_upload_meta_path(upload_id)
         if meta_path.exists():
             meta_path.unlink()
-
-
-@router.post("/{upload_id}/{chunk_index}")
-async def upload_chunk(
-    upload_id: str,
-    chunk_index: int,
-    chunk: UploadFile = File(..., description="Chunk data"),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-) -> dict[str, Any]:
-    """Upload a single chunk"""
-    # Load metadata
-    meta = _load_upload_meta(upload_id)
-
-    # Check expiry
-    expires_at = datetime.fromisoformat(meta["expires_at"])
-    if expires_at.tzinfo is None:
-        expires_at = expires_at.replace(tzinfo=timezone.utc)
-
-    if expires_at < datetime.now(timezone.utc):
-        raise HTTPException(status_code=status.HTTP_410_GONE, detail="Upload has expired")
-
-    # Validate chunk index
-    if chunk_index < 0 or chunk_index >= meta["total_chunks"]:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Invalid chunk index. Must be between 0 and {meta['total_chunks'] - 1}",
-        )
-
-    # Atomic check and record to prevent race conditions
-    if not _atomic_check_and_record(upload_id, chunk_index):
-        return {"message": "Chunk already uploaded", "chunk_index": chunk_index}
-
-    # Read chunk data
-    chunk_data = await chunk.read()
-
-    # Validate chunk size (last chunk can be smaller than chunk_size)
-    expected_size = DEFAULT_CHUNK_SIZE
-    if chunk_index == meta["total_chunks"] - 1:
-        expected_size = meta["file_size"] - (chunk_index * DEFAULT_CHUNK_SIZE)
-
-    if len(chunk_data) != expected_size:
-        # Rollback the recorded chunk
-        meta_path = _get_upload_meta_path(upload_id)
-        with open(meta_path, "r+", encoding="utf-8") as f:
-            fcntl.flock(f.fileno(), fcntl.LOCK_EX)
-            try:
-                meta = json.load(f)
-                if chunk_index in meta["uploaded_chunks"]:
-                    meta["uploaded_chunks"].remove(chunk_index)
-                f.seek(0)
-                json.dump(meta, f, ensure_ascii=False, indent=2)
-                f.truncate()
-            finally:
-                fcntl.flock(f.fileno(), fcntl.LOCK_UN)
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Chunk size mismatch. Expected {expected_size}, got {len(chunk_data)}",
-        )
-
-    # Save chunk
-    chunk_path = _get_chunk_dir(upload_id) / f"chunk_{chunk_index:06d}"
-    with open(chunk_path, "wb") as f:
-        f.write(chunk_data)
-
-    # Reload metadata for response
-    meta = _load_upload_meta(upload_id)
-
-    return {
-        "message": "Chunk uploaded successfully",
-        "chunk_index": chunk_index,
-        "uploaded_chunks": len(meta["uploaded_chunks"]),
-        "total_chunks": meta["total_chunks"],
-    }

apps/api/app/api/routes/classification_jobs.py

@@ -1,3 +1,4 @@
+from datetime import datetime, timezone
 from typing import Any
 
 from app.core.celery_app import celery_app

apps/api/app/api/routes/dashboard.py

@@ -1,92 +0,0 @@
-from typing import Any
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import (
-    get_asset_repository,
-    get_generation_task_repository,
-    get_project_repository,
-    get_title_library_repository,
-    get_voice_library_repository,
-)
-from app.schemas.dashboard import DashboardOverviewResponse, RecentTaskItem, SubscriptionInfo
-from fastapi import APIRouter, Depends
-
-router = APIRouter()
-
-
-def _status_value(status) -> str:
-    return status.value if hasattr(status, "value") else str(status)
-
-
-def _generation_step(status: str) -> str:
-    if status == "pending":
-        return "等待 Worker 执行"
-    if status == "running":
-        return "正在生成成片"
-    if status == "completed":
-        return "生成完成"
-    if status == "failed":
-        return "生成失败"
-    return status
-
-
-@router.get("/overview", response_model=DashboardOverviewResponse)
-def get_dashboard_overview(
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    project_repository: Any = Depends(get_project_repository),
-    asset_repository: Any = Depends(get_asset_repository),
-    generation_task_repository: Any = Depends(get_generation_task_repository),
-    title_library_repository: Any = Depends(get_title_library_repository),
-    voice_library_repository: Any = Depends(get_voice_library_repository),
-) -> DashboardOverviewResponse:
-    """Dashboard 概览：用户级汇总数据。"""
-    user_id = authenticated_user.user.id
-
-    # 获取用户可访问的所有 project
-    projects = project_repository.find_accessible_projects(user_id)
-    project_ids = [p.id for p in projects]
-
-    # 素材统计
-    total_assets = asset_repository.count_by_project_ids(project_ids)
-    used_storage_bytes = asset_repository.sum_storage_by_project_ids(project_ids)
-
-    # 标题库 / 配音库统计
-    total_titles = title_library_repository.count_by_user(user_id)
-    total_voices = voice_library_repository.count_by_user(user_id)
-
-    # 生成任务统计
-    total_tasks = generation_task_repository.count_by_user(user_id)
-
-    # 最近任务（SQL 层 LIMIT 5）
-    recent = generation_task_repository.list_recent_by_user(user_id, limit=5)
-    recent_tasks = []
-    for task in recent:
-        s = _status_value(task.status)
-        recent_tasks.append(
-            RecentTaskItem(
-                id=task.id,
-                task_type="generation",
-                status=s,
-                current_step=_generation_step(s),
-                error_message=task.error_message or "",
-                updated_at=task.completed_at or task.started_at or task.created_at,
-            )
-        )
-
-    # 订阅信息
-    user = authenticated_user.user
-    subscription = SubscriptionInfo(
-        plan=getattr(user, "subscription_plan", "free") or "free",
-        is_active=getattr(user, "subscription_status", "") == "active",
-    )
-
-    return DashboardOverviewResponse(
-        total_assets=total_assets,
-        used_storage_bytes=used_storage_bytes,
-        total_titles=total_titles,
-        total_voices=total_voices,
-        total_tasks=total_tasks,
-        total_products=len(projects),
-        subscription=subscription,
-        recent_tasks=recent_tasks,
-    )

apps/api/app/api/routes/duplication.py

@@ -1,301 +0,0 @@
-"""查重 API 路由。"""
-
-from __future__ import annotations
-
-import logging
-from typing import Any
-from uuid import uuid4
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.core.storage import OSSStorageService, get_storage_service
-from app.dependencies import get_duplication_repository
-from app.schemas.duplication import (
-    DuplicateSegmentResponse,
-    DuplicationDetailResponse,
-    DuplicationRecordResponse,
-    DuplicationUploadResponse,
-)
-from fastapi import APIRouter, Depends, File, HTTPException, Query, Response, UploadFile, status
-
-from packages.application import (
-    DeleteDuplicationRecordUseCase,
-    GetDuplicationDetailUseCase,
-    ListDuplicationRecordsUseCase,
-    RetryDuplicationUseCase,
-    UploadForDuplicationCommand,
-    UploadForDuplicationUseCase,
-)
-from packages.domain.duplication import DuplicationRecord
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(
-    tags=["查重"],
-)
-
-# 查重功能只接受视频文件
-ALLOWED_VIDEO_MIME_TYPES = frozenset(
-    {
-        "video/mp4",
-        "video/mpeg",
-        "video/quicktime",
-        "video/x-msvideo",
-        "video/webm",
-        "video/x-matroska",
-        "video/3gpp",
-    }
-)
-
-
-def _validate_video_mime_type(content_type: str | None) -> str:
-    """验证视频文件的 MIME 类型，如果无效则抛出异常。"""
-    if not content_type:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="Content-Type header is required",
-        )
-
-    # 处理带参数的类型，如 "video/mp4; charset=utf-8"
-    base_type = content_type.split(";")[0].strip().lower()
-
-    if base_type not in ALLOWED_VIDEO_MIME_TYPES:
-        raise HTTPException(
-            status_code=status.HTTP_415_UNSUPPORTED_MEDIA_TYPE,
-            detail="只支持视频文件。支持的类型: mp4, mpeg, mov, avi, webm, mkv, 3gp",
-        )
-
-    return base_type
-
-
-def _to_record_response(record: DuplicationRecord) -> DuplicationRecordResponse:
-    return DuplicationRecordResponse(
-        id=record.id,
-        filename=record.filename,
-        file_size=record.file_size,
-        duration_seconds=record.duration_seconds,
-        status=record.status,
-        duplicate_rate=record.duplicate_rate,
-        duplicate_count=record.duplicate_count,
-        created_at=record.created_at.isoformat(),
-        updated_at=record.updated_at.isoformat(),
-    )
-
-
-def _to_detail_response(record: DuplicationRecord) -> DuplicationDetailResponse:
-    return DuplicationDetailResponse(
-        id=record.id,
-        filename=record.filename,
-        file_size=record.file_size,
-        duration_seconds=record.duration_seconds,
-        status=record.status,
-        duplicate_rate=record.duplicate_rate,
-        duplicate_count=record.duplicate_count,
-        created_at=record.created_at.isoformat(),
-        updated_at=record.updated_at.isoformat(),
-        segments=[
-            DuplicateSegmentResponse(
-                id=seg.id,
-                source_start=seg.source_start,
-                source_end=seg.source_end,
-                matched_video_id=seg.matched_video_id,
-                matched_video_name=seg.matched_video_name,
-                matched_start=seg.matched_start,
-                matched_end=seg.matched_end,
-                similarity=seg.similarity,
-            )
-            for seg in record.segments
-        ],
-    )
-
-
-@router.post("/upload", response_model=DuplicationUploadResponse)
-async def upload_for_duplication(
-    file: UploadFile = File(..., description="要查重的视频文件"),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    duplication_repository: Any = Depends(get_duplication_repository),
-    storage_service: OSSStorageService = Depends(get_storage_service),
-) -> DuplicationUploadResponse:
-    """上传视频进行查重。"""
-    if file.filename is None:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="文件名不能为空",
-        )
-
-    # P0-1: 验证 MIME 类型（只接受视频文件）
-    validated_content_type = _validate_video_mime_type(file.content_type)
-
-    # P0-2: 验证文件大小（参考 OSS_DIRECT_UPLOAD_MAX_MB）
-    from app.config import get_settings
-
-    settings = get_settings()
-    max_size_bytes = settings.OSS_DIRECT_UPLOAD_MAX_MB * 1024 * 1024
-
-    # 先检查 Content-Length header（如果可用）
-    if file.size is not None and file.size > max_size_bytes:
-        raise HTTPException(
-            status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
-            detail=f"文件超过上传限制 ({settings.OSS_DIRECT_UPLOAD_MAX_MB}MB)",
-        )
-
-    # 读取文件内容并上传到 OSS
-    file_id = uuid4().hex[:8]
-    safe_filename = file.filename.replace("/", "_").replace("\\", "_")
-    storage_key = f"duplication/{file_id}/{safe_filename}"
-
-    try:
-        content = await file.read()
-        file_size = len(content)
-
-        # 再次检查实际文件大小
-        if file_size > max_size_bytes:
-            raise HTTPException(
-                status_code=status.HTTP_413_REQUEST_ENTITY_TOO_LARGE,
-                detail=f"文件超过上传限制 ({settings.OSS_DIRECT_UPLOAD_MAX_MB}MB)",
-            )
-    except HTTPException:
-        raise
-    except Exception as exc:
-        logger.error("读取查重文件失败: %s", exc, exc_info=True)
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="文件读取失败，请稍后重试",
-        ) from exc
-
-    try:
-        storage_service.upload_file(
-            content,
-            storage_key,
-            content_type=validated_content_type,
-        )
-    except Exception as exc:
-        logger.error("查重文件上传 OSS 失败: %s", exc, exc_info=True)
-        raise HTTPException(
-            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="文件上传失败，请稍后重试",
-        ) from exc
-
-    use_case = UploadForDuplicationUseCase(duplication_repository)
-    record = use_case.execute(
-        UploadForDuplicationCommand(
-            user_id=authenticated_user.user.id,
-            filename=file.filename,
-            file_size=file_size,
-            storage_key=storage_key,
-        )
-    )
-
-    logger.info(
-        "Duplication upload: record=%s file=%s user=%s",
-        record.id,
-        file.filename,
-        authenticated_user.user.id,
-    )
-
-    return DuplicationUploadResponse(
-        id=record.id,
-        status=record.status,
-        message=f'文件 "{file.filename}" 已上传，正在查重中...',
-    )
-
-
-@router.get("/records", response_model=list[DuplicationRecordResponse])
-def list_duplication_records(
-    offset: int = Query(0, ge=0, description="分页偏移量"),
-    limit: int = Query(50, ge=1, le=200, description="每页数量，最大 200"),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    duplication_repository: Any = Depends(get_duplication_repository),
-) -> list[DuplicationRecordResponse]:
-    """
-    获取当前用户的查重记录列表。
-
-    支持分页：通过 offset 和 limit 参数控制。
-    返回按创建时间倒序排列的记录。
-    """
-    use_case = ListDuplicationRecordsUseCase(duplication_repository)
-    records = use_case.execute(user_id=authenticated_user.user.id, offset=offset, limit=limit)
-    return [_to_record_response(r) for r in records]
-
-
-@router.get("/records/{record_id}", response_model=DuplicationDetailResponse)
-def get_duplication_detail(
-    record_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    duplication_repository: Any = Depends(get_duplication_repository),
-) -> DuplicationDetailResponse:
-    """获取查重记录详情（含重复片段）。"""
-    use_case = GetDuplicationDetailUseCase(duplication_repository)
-    record = use_case.execute(record_id)
-    if record is None:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"查重记录 {record_id} 不存在",
-        )
-    if record.user_id != authenticated_user.user.id:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"查重记录 {record_id} 不存在",
-        )
-    return _to_detail_response(record)
-
-
-@router.delete("/records/{record_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_duplication_record(
-    record_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    duplication_repository: Any = Depends(get_duplication_repository),
-) -> Response:
-    """删除查重记录。"""
-    # 检查记录是否存在且属于当前用户
-    detail_uc = GetDuplicationDetailUseCase(duplication_repository)
-    record = detail_uc.execute(record_id)
-    if record is None or record.user_id != authenticated_user.user.id:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"查重记录 {record_id} 不存在",
-        )
-
-    use_case = DeleteDuplicationRecordUseCase(duplication_repository)
-    use_case.execute(record_id)
-    return Response(status_code=204)
-
-
-@router.post("/records/{record_id}/retry", response_model=DuplicationUploadResponse)
-def retry_duplication(
-    record_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    duplication_repository: Any = Depends(get_duplication_repository),
-) -> DuplicationUploadResponse:
-    """
-    重新提交查重。
-
-    仅 failed 状态的记录允许重试，其他状态返回 400。
-    """
-    # 检查记录存在且属于当前用户
-    detail_uc = GetDuplicationDetailUseCase(duplication_repository)
-    record = detail_uc.execute(record_id)
-    if record is None or record.user_id != authenticated_user.user.id:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"查重记录 {record_id} 不存在",
-        )
-
-    use_case = RetryDuplicationUseCase(duplication_repository)
-    try:
-        updated = use_case.execute(record_id)
-    except ValueError as e:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=str(e),
-        )
-    if updated is None:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=f"查重记录 {record_id} 不存在",
-        )
-
-    return DuplicationUploadResponse(
-        id=updated.id,
-        status=updated.status,
-        message="已重新提交查重",
-    )

apps/api/app/api/routes/edit_templates.py

@@ -1,289 +0,0 @@
-"""模板管理 API — Phase 8 模板编排引擎.
-
-RESTful CRUD for EditTemplate:
-- GET  /api/v1/edit-templates      列表（分页 + 类型筛选）
-- GET  /api/v1/edit-templates/{id} 详情
-- POST /api/v1/edit-templates      创建（管理员）
-- PUT  /api/v1/edit-templates/{id} 更新
-- DELETE /api/v1/edit-templates/{id} 删除（软删除 → inactive）
-
-业务逻辑委托给 EditTemplateService 服务层。
-"""
-
-from __future__ import annotations
-
-import logging
-from datetime import datetime
-from typing import Any, List, Optional
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_db_session
-from app.services import EditTemplateService
-from fastapi import APIRouter, Depends, HTTPException, Query, status
-from fastapi.responses import Response
-from pydantic import BaseModel, Field
-from sqlalchemy.orm import Session
-
-from packages.domain.config_schemas import normalize_template_config
-from packages.domain.edit_template import EditTemplate, EditTemplateStatus
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter()
-
-
-# ── Pydantic Schemas ─────────────────────────────────────────────────────────
-
-
-class EditTemplateCreateRequest(BaseModel):
-    """创建模板请求体"""
-
-    name: str = Field(..., min_length=1, max_length=200, description="模板名称")
-    description: str = Field(default="", max_length=2000, description="模板描述")
-    template_type: str = Field(default="default", max_length=50, description="模板类型")
-    editing_mode: str = Field(
-        default="one_take", max_length=20, description="剪辑模式: one_take/pip/voice_over/voice_pip"
-    )
-    config: dict[str, Any] = Field(default_factory=dict, description="模板配置 (JSON)")
-    preview_url: str = Field(default="", max_length=500, description="预览地址")
-    sort_weight: int = Field(default=0, ge=0, le=9999, description="排序权重")
-
-
-class EditTemplateUpdateRequest(BaseModel):
-    """更新模板请求体"""
-
-    name: Optional[str] = Field(default=None, min_length=1, max_length=200, description="模板名称")
-    description: Optional[str] = Field(default=None, max_length=2000, description="模板描述")
-    template_type: Optional[str] = Field(default=None, max_length=50, description="模板类型")
-    editing_mode: Optional[str] = Field(
-        default=None, max_length=20, description="剪辑模式: one_take/pip/voice_over/voice_pip"
-    )
-    config: Optional[dict[str, Any]] = Field(default=None, description="模板配置 (JSON)")
-    preview_url: Optional[str] = Field(default=None, max_length=500, description="预览地址")
-    sort_weight: Optional[int] = Field(default=None, ge=0, le=9999, description="排序权重")
-    status: Optional[str] = Field(default=None, description="状态: active / inactive")
-
-
-class EditTemplateResponse(BaseModel):
-    """模板响应体"""
-
-    id: str
-    name: str
-    description: str
-    template_type: str
-    editing_mode: str
-    config: dict[str, Any]
-    preview_url: str
-    sort_weight: int
-    status: str
-    created_at: datetime
-    updated_at: datetime
-
-    model_config = {"from_attributes": True}
-
-
-class EditTemplateListResponse(BaseModel):
-    """模板列表响应体"""
-
-    items: List[EditTemplateResponse]
-    total: int
-    page: int
-    page_size: int
-
-
-# ── Helpers ───────────────────────────────────────────────────────────────────
-
-
-def _require_admin(current_user: AuthenticatedUser) -> None:
-    """校验当前用户是否为管理员，非管理员返回 403"""
-    if not getattr(current_user.user, "is_admin", False):
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="仅管理员可执行此操作",
-        )
-
-
-def _to_response(t: EditTemplate) -> EditTemplateResponse:
-    return EditTemplateResponse(
-        id=t.id,
-        name=t.name,
-        description=t.description,
-        template_type=t.template_type,
-        editing_mode=t.editing_mode,
-        config=t.config,
-        preview_url=t.preview_url,
-        sort_weight=t.sort_weight,
-        status=t.status.value if hasattr(t.status, "value") else t.status,
-        created_at=t.created_at,
-        updated_at=t.updated_at,
-    )
-
-
-# ── Routes ────────────────────────────────────────────────────────────────────
-
-
-@router.get("", response_model=EditTemplateListResponse)
-def list_templates(
-    page: int = Query(default=1, ge=1, description="页码"),
-    page_size: int = Query(default=20, ge=1, le=100, description="每页数量"),
-    template_type: Optional[str] = Query(default=None, description="按类型筛选"),
-    status_filter: Optional[str] = Query(
-        default=None,
-        alias="status",
-        description="按状态筛选: active / inactive",
-    ),
-    db: Session = Depends(get_db_session),
-    current_user: AuthenticatedUser = Depends(get_current_user),
-) -> EditTemplateListResponse:
-    """获取模板列表（支持分页、按类型/状态筛选）"""
-    svc = EditTemplateService(db)
-
-    # 解析状态筛选
-    status_enum: Optional[EditTemplateStatus] = None
-    if status_filter:
-        try:
-            status_enum = EditTemplateStatus(status_filter)
-        except ValueError:
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f"无效的状态值: {status_filter}，可选值: active, inactive",
-            )
-
-    skip = (page - 1) * page_size
-    templates = svc.list_templates(
-        template_type=template_type,
-        status=status_enum,
-        skip=skip,
-        limit=page_size,
-    )
-    total = svc.count_templates(
-        template_type=template_type,
-        status=status_enum,
-    )
-
-    return EditTemplateListResponse(
-        items=[_to_response(t) for t in templates],
-        total=total,
-        page=page,
-        page_size=page_size,
-    )
-
-
-@router.get("/{template_id}", response_model=EditTemplateResponse)
-def get_template(
-    template_id: str,
-    db: Session = Depends(get_db_session),
-    current_user: AuthenticatedUser = Depends(get_current_user),
-) -> EditTemplateResponse:
-    """获取单个模板详情"""
-    svc = EditTemplateService(db)
-    try:
-        template = svc.get_template_or_raise(template_id)
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=str(exc),
-        )
-    return _to_response(template)
-
-
-@router.post("", response_model=EditTemplateResponse, status_code=status.HTTP_201_CREATED)
-def create_template(
-    body: EditTemplateCreateRequest,
-    db: Session = Depends(get_db_session),
-    current_user: AuthenticatedUser = Depends(get_current_user),
-) -> EditTemplateResponse:
-    """创建模板（管理员）"""
-    _require_admin(current_user)
-    svc = EditTemplateService(db)
-    # 标准化 config，填充 cover/title/subtitle/bgm 默认值
-    normalized_config = normalize_template_config(body.config)
-    try:
-        created = svc.create_template(
-            name=body.name,
-            description=body.description,
-            template_type=body.template_type,
-            editing_mode=body.editing_mode,
-            config=normalized_config,
-            preview_url=body.preview_url,
-            sort_weight=body.sort_weight,
-        )
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=str(exc),
-        )
-    logger.info("创建模板: id=%s name=%s by user=%s", created.id, created.name, current_user.user.id)
-    return _to_response(created)
-
-
-@router.put("/{template_id}", response_model=EditTemplateResponse)
-def update_template(
-    template_id: str,
-    body: EditTemplateUpdateRequest,
-    db: Session = Depends(get_db_session),
-    current_user: AuthenticatedUser = Depends(get_current_user),
-) -> EditTemplateResponse:
-    """更新模板"""
-    _require_admin(current_user)
-    svc = EditTemplateService(db)
-
-    # 解析状态
-    status_enum: Optional[EditTemplateStatus] = None
-    if body.status is not None:
-        try:
-            status_enum = EditTemplateStatus(body.status)
-        except ValueError:
-            raise HTTPException(
-                status_code=status.HTTP_400_BAD_REQUEST,
-                detail=f"无效的状态值: {body.status}，可选值: active, inactive",
-            )
-
-    # 标准化 config（如果提供了）
-    config_to_update = normalize_template_config(body.config) if body.config is not None else None
-
-    try:
-        result = svc.update_template(
-            template_id,
-            name=body.name,
-            description=body.description,
-            template_type=body.template_type,
-            editing_mode=body.editing_mode,
-            config=config_to_update,
-            preview_url=body.preview_url,
-            sort_weight=body.sort_weight,
-            status=status_enum,
-        )
-    except ValueError as exc:
-        err_msg = str(exc)
-        if "不存在" in err_msg:
-            raise HTTPException(
-                status_code=status.HTTP_404_NOT_FOUND,
-                detail=err_msg,
-            )
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=err_msg,
-        )
-    logger.info("更新模板: id=%s by user=%s", template_id, current_user.user.id)
-    return _to_response(result)
-
-
-@router.delete("/{template_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_template(
-    template_id: str,
-    db: Session = Depends(get_db_session),
-    current_user: AuthenticatedUser = Depends(get_current_user),
-) -> Response:
-    """删除模板（软删除 → 设为 inactive）"""
-    _require_admin(current_user)
-    svc = EditTemplateService(db)
-    try:
-        svc.deactivate_template(template_id)
-    except ValueError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_404_NOT_FOUND,
-            detail=str(exc),
-        )
-    logger.info("删除模板(软删除): id=%s by user=%s", template_id, current_user.user.id)
-    return Response(status_code=204)

apps/api/app/api/routes/feature_flags.py

@@ -1,195 +0,0 @@
-"""Feature Flag 内部管理接口。
-
-通过内部 API Key 鉴权，支持查看和修改 Feature Flag 配置。
-主要用于灰度发布期间的动态开关控制。
-
-API:
-  GET  /api/v1/internal/feature-flags          - 列出所有 flag
-  GET  /api/v1/internal/feature-flags/{name}   - 查看单个 flag
-  PUT  /api/v1/internal/feature-flags/{name}   - 设置 flag 配置
-  DELETE /api/v1/internal/feature-flags/{name} - 删除 flag
-
-鉴权：X-API-Key header，走内部 API Key 验证
-"""
-
-from __future__ import annotations
-
-import logging
-from typing import Optional
-
-from app.api.routes.auth import _verify_internal_api_key
-from app.config import settings
-from fastapi import APIRouter, Depends, HTTPException, Query, status
-from pydantic import BaseModel, Field
-
-from packages.adapters.redis.feature_flag_store import (
-    FEATURE_FLAG_REDIS_PREFIX,
-    FeatureFlagConfig,
-    RedisFeatureFlagStore,
-)
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(prefix="/internal/feature-flags", tags=["Internal"])
-
-# 允许管理的 flag 白名单（防止误操作其他系统 flag）
-ALLOWED_FLAGS = {
-    "render_engine",
-}
-
-
-def _get_feature_flag_store() -> RedisFeatureFlagStore:
-    """获取 Feature Flag 存储实例。"""
-    return RedisFeatureFlagStore(redis_url=settings.REDIS_URL)
-
-
-class FeatureFlagUpdateRequest(BaseModel):
-    """Feature Flag 更新请求体。"""
-
-    enabled: bool = Field(..., description="是否启用")
-    percentage: int = Field(0, ge=0, le=100, description="灰度百分比 (0-100)")
-    whitelist: list[str] = Field(default_factory=list, description="白名单列表（如 user_id）")
-
-
-class FeatureFlagResponse(BaseModel):
-    """Feature Flag 响应。"""
-
-    name: str
-    enabled: bool
-    percentage: int
-    whitelist: list[str]
-
-    @classmethod
-    def from_config(cls, config: FeatureFlagConfig) -> "FeatureFlagResponse":
-        return cls(
-            name=config.name,
-            enabled=config.enabled,
-            percentage=config.percentage,
-            whitelist=sorted(config.whitelist),
-        )
-
-
-class FeatureFlagCheckResponse(BaseModel):
-    """Flag 激活检查响应。"""
-
-    name: str
-    active: bool
-    identifier: Optional[str] = None
-
-
-def _validate_flag_name(name: str) -> None:
-    """校验 flag 名称是否在允许列表中。"""
-    if name not in ALLOWED_FLAGS:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"Unsupported flag: {name}. Allowed: {sorted(ALLOWED_FLAGS)}",
-        )
-
-
-@router.get("", response_model=list[FeatureFlagResponse])
-async def list_feature_flags(
-    _: bool = Depends(_verify_internal_api_key),
-    store: RedisFeatureFlagStore = Depends(_get_feature_flag_store),
-):
-    """列出所有 Feature Flag。"""
-    try:
-        flags = store.list_all()
-        # 同时返回预定义的 flag（即使未设置也显示默认值）
-        result = []
-        for name in sorted(ALLOWED_FLAGS):
-            config = flags.get(name) or FeatureFlagConfig(name=name, enabled=False)
-            result.append(FeatureFlagResponse.from_config(config))
-        # 加上已存在但不在白名单中的 flag（只读展示）
-        for name, config in flags.items():
-            if name not in ALLOWED_FLAGS:
-                result.append(FeatureFlagResponse.from_config(config))
-        return sorted(result, key=lambda x: x.name)
-    except Exception as exc:
-        logger.error("Failed to list feature flags: %s", exc)
-        raise HTTPException(status_code=500, detail=f"Failed to list flags: {exc}")
-
-
-@router.get("/{name}", response_model=FeatureFlagResponse)
-async def get_feature_flag(
-    name: str,
-    _: bool = Depends(_verify_internal_api_key),
-    store: RedisFeatureFlagStore = Depends(_get_feature_flag_store),
-):
-    """获取单个 Feature Flag 配置。"""
-    try:
-        config = store.get(name)
-        return FeatureFlagResponse.from_config(config)
-    except Exception as exc:
-        logger.error("Failed to get feature flag %s: %s", name, exc)
-        raise HTTPException(status_code=500, detail=f"Failed to get flag: {exc}")
-
-
-@router.get("/{name}/check", response_model=FeatureFlagCheckResponse)
-async def check_feature_flag(
-    name: str,
-    identifier: Optional[str] = Query(None, description="标识符，如 user_id"),
-    _: bool = Depends(_verify_internal_api_key),
-    store: RedisFeatureFlagStore = Depends(_get_feature_flag_store),
-):
-    """检查某个标识符是否命中 Feature Flag。"""
-    try:
-        active = store.is_active(name, identifier=identifier)
-        return FeatureFlagCheckResponse(name=name, active=active, identifier=identifier)
-    except Exception as exc:
-        logger.error("Failed to check feature flag %s: %s", name, exc)
-        raise HTTPException(status_code=500, detail=f"Failed to check flag: {exc}")
-
-
-@router.put("/{name}", response_model=FeatureFlagResponse)
-async def update_feature_flag(
-    name: str,
-    request: FeatureFlagUpdateRequest,
-    _: bool = Depends(_verify_internal_api_key),
-    store: RedisFeatureFlagStore = Depends(_get_feature_flag_store),
-):
-    """更新 Feature Flag 配置。
-
-    只允许修改 ALLOWED_FLAGS 列表中的 flag。
-    """
-    _validate_flag_name(name)
-
-    try:
-        config = FeatureFlagConfig(
-            name=name,
-            enabled=request.enabled,
-            percentage=request.percentage,
-            whitelist=set(request.whitelist),
-        )
-        store.set(config)
-        logger.info(
-            "Feature flag updated: name=%s enabled=%s percentage=%d whitelist=%d",
-            name,
-            config.enabled,
-            config.percentage,
-            len(config.whitelist),
-        )
-        return FeatureFlagResponse.from_config(config)
-    except Exception as exc:
-        logger.error("Failed to update feature flag %s: %s", name, exc)
-        raise HTTPException(status_code=500, detail=f"Failed to update flag: {exc}")
-
-
-@router.delete("/{name}", status_code=status.HTTP_204_NO_CONTENT)
-async def delete_feature_flag(
-    name: str,
-    _: bool = Depends(_verify_internal_api_key),
-    store: RedisFeatureFlagStore = Depends(_get_feature_flag_store),
-):
-    """删除 Feature Flag。
-
-    只允许删除 ALLOWED_FLAGS 列表中的 flag。
-    """
-    _validate_flag_name(name)
-
-    try:
-        deleted = store.delete(name)
-        logger.info("Feature flag deleted: name=%s deleted=%s", name, deleted)
-        return None
-    except Exception as exc:
-        logger.error("Failed to delete feature flag %s: %s", name, exc)
-        raise HTTPException(status_code=500, detail=f"Failed to delete flag: {exc}")

apps/api/app/api/routes/generated_videos.py

@@ -1,21 +1,23 @@
 from typing import Any
 
+from app.api.routes.permissions import require_workspace_member
 from app.auth import AuthenticatedUser, get_current_user
 from app.core.storage import OSSStorageService, get_storage_service
-from app.dependencies import get_generated_video_repository, get_project_repository
+from app.dependencies import get_generated_video_repository, get_project_repository, get_workspace_member_repository
 from app.schemas.generated_video import (
     GeneratedVideoDownloadUrlResponse,
     GeneratedVideoResponse,
     ListGeneratedVideosResponse,
     UpdateGeneratedVideoReviewRequest,
 )
-from fastapi import APIRouter, Depends, HTTPException, Query
+from fastapi import APIRouter, Depends, HTTPException
 
 from packages.application import (
     GetGeneratedVideoDownloadUrlUseCase,
     GetGeneratedVideoUseCase,
     ListGeneratedVideosUseCase,
 )
+from packages.ports.workspace_member_repository import WorkspaceMemberRepository
 
 router = APIRouter()
 
@@ -23,6 +25,7 @@ router = APIRouter()
 def _to_generated_video_response(item, download_url: str | None = None) -> GeneratedVideoResponse:
     return GeneratedVideoResponse(
         id=item.id,
+        workspace_id=item.workspace_id,
         project_id=item.project_id,
         generation_task_id=item.generation_task_id,
         name=item.name,
@@ -42,29 +45,19 @@ def _to_generated_video_response(item, download_url: str | None = None) -> Gener
 
 @router.get("", response_model=ListGeneratedVideosResponse)
 def list_generated_videos(
-    project_id: str | None = Query(None),
+    project_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     generated_video_repository: Any = Depends(get_generated_video_repository),
     project_repository: Any = Depends(get_project_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> ListGeneratedVideosResponse:
-    user_id = authenticated_user.user.id
+    project = project_repository.find_by_id(project_id)
+    if project is None:
+        raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
+    require_workspace_member(project.workspace_id, authenticated_user, workspace_member_repository)
     use_case = ListGeneratedVideosUseCase(generated_video_repository)
-
-    if project_id:
-        # If project_id provided, check access and filter by project
-        project = project_repository.find_by_id(project_id)
-        if project is None:
-            raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-        items = use_case.execute(project_id)
-    else:
-        # If no project_id, list all videos from accessible projects
-        accessible_projects = project_repository.find_accessible_projects(user_id)
-        all_items = []
-        for proj in accessible_projects:
-            all_items.extend(use_case.execute(proj.id))
-        items = all_items
-
+    items = use_case.execute(project_id)
     # Generate download URLs for each video
     responses = []
     for item in items:
@@ -78,12 +71,14 @@ def get_generated_video(
     video_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     generated_video_repository: Any = Depends(get_generated_video_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> GeneratedVideoResponse:
     use_case = GetGeneratedVideoUseCase(generated_video_repository)
     item = use_case.execute(video_id)
     if item is None:
         raise HTTPException(status_code=404, detail=f"GeneratedVideo {video_id} not found")
+    require_workspace_member(item.workspace_id, authenticated_user, workspace_member_repository)
     download_url = storage_service.get_download_url(item.file_url)
     return _to_generated_video_response(item, download_url=download_url)
 
@@ -94,11 +89,13 @@ def update_generated_video_review_status(
     request: UpdateGeneratedVideoReviewRequest,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     generated_video_repository: Any = Depends(get_generated_video_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> GeneratedVideoResponse:
     video = generated_video_repository.get(video_id)
     if video is None:
         raise HTTPException(status_code=404, detail=f"GeneratedVideo {video_id} not found")
+    require_workspace_member(video.workspace_id, authenticated_user, workspace_member_repository)
     video.review_status = request.review_status
     updated = generated_video_repository.update(video)
     download_url = storage_service.get_download_url(updated.file_url)
@@ -110,11 +107,13 @@ def get_generated_video_download_url(
     video_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     generated_video_repository: Any = Depends(get_generated_video_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> GeneratedVideoDownloadUrlResponse:
     video = generated_video_repository.get(video_id)
     if video is None:
         raise HTTPException(status_code=404, detail=f"GeneratedVideo {video_id} not found")
+    require_workspace_member(video.workspace_id, authenticated_user, workspace_member_repository)
     use_case = GetGeneratedVideoDownloadUrlUseCase(generated_video_repository)
     file_url = use_case.execute(video_id)
     if file_url is None:

apps/api/app/api/routes/generation_tasks.py

@@ -1,34 +1,22 @@
-import logging
-import random
-import uuid
 from typing import Any
 
 from app.auth import AuthenticatedUser, get_current_user
-from app.core.storage import OSSStorageService, get_storage_service
-from app.core.task_enqueue import (
-    GLOBAL_PENDING_LIMIT,
-    USER_PENDING_LIMIT,
-    GlobalQueueFull,
-    UserPendingLimitExceeded,
-    check_queue_limits,
-    safe_enqueue_generation_task,
-)
+from app.core.celery_app import celery_app
 from app.dependencies import (
     get_asset_library_repository,
     get_asset_repository,
     get_generated_video_repository,
     get_generation_task_repository,
     get_project_repository,
+    get_project_title_repository,
 )
 from app.schemas.generated_video import (
     GeneratedVideoResponse,
     ListGeneratedVideosResponse,
 )
 from app.schemas.generation_task import (
-    BatchGenerationTaskResponse,
     CreateGenerationTaskRequest,
     GenerationTaskResponse,
-    ListGenerationTasksResponse,
 )
 from fastapi import APIRouter, Depends, HTTPException
 
@@ -39,10 +27,9 @@ from packages.application import (
     ListGeneratedVideosByTaskUseCase,
 )
 
-logger = logging.getLogger(__name__)
-
 router = APIRouter()
 
+
 def _check_project_access(project_id: str, user_id: str, project_repository) -> None:
     """检查用户是否有项目访问权限"""
     project = project_repository.find_by_id(project_id)
@@ -59,14 +46,7 @@ def _to_generation_task_response(task) -> GenerationTaskResponse:
         asset_library_id=task.asset_library_id,
         strategy_id=task.strategy_id,
         voice_library_id=task.voice_library_id,
-        template_id=task.template_id,
-        asset_ids=task.asset_ids,
-        title_ids=task.title_ids,
-        voice_ids=task.voice_ids,
-        source_edit_plan_id=task.source_edit_plan_id or "",
-        asset_select_mode=getattr(task, "asset_select_mode", ""),
-        batch_id=getattr(task, "batch_id", ""),
-        logs=getattr(task, "logs", "[]"),
+        edit_plan_id=task.edit_plan_id,
         status=task.status,
         progress=task.progress,
         result_count=task.result_count,
@@ -74,7 +54,7 @@ def _to_generation_task_response(task) -> GenerationTaskResponse:
     )
 
 
-def _to_generated_video_response(item, download_url: str | None = None) -> GeneratedVideoResponse:
+def _to_generated_video_response(item) -> GeneratedVideoResponse:
     return GeneratedVideoResponse(
         id=item.id,
         project_id=item.project_id,
@@ -87,7 +67,6 @@ def _to_generated_video_response(item, download_url: str | None = None) -> Gener
         width=item.width,
         height=item.height,
         fps=item.fps,
-        download_url=download_url,
     )
 
 
@@ -102,87 +81,22 @@ def _ensure_library_has_ready_video_assets(assets) -> None:
         )
 
 
-def _select_assets_from_library(
-    assets: list,
-    mode: str,
-    count: int,
-) -> list[str]:
-    """根据选取模式从素材库中选取 ready 状态的视频素材 ID。
-
-    Args:
-        assets: 素材库中所有素材（Asset 实体列表）
-        mode: 选取模式 — all=全部, random=随机, smart=按质量评分
-        count: 选取数量，0 表示全部（仅 random/smart 模式有效）
-
-    Returns:
-        选中的素材 ID 列表
-    """
-    ready_video_assets = [a for a in assets if a.status.value == "ready" and a.mime_type.startswith("video")]
-
-    if not ready_video_assets:
-        return []
-
-    if mode == "random":
-        selected = (
-            ready_video_assets if count <= 0 else random.sample(ready_video_assets, min(count, len(ready_video_assets)))
-        )
-        return [a.id for a in selected]
-
-    if mode == "smart":
-        # 按质量分降序排列（质量分高的优先），质量分相同时按时长降序
-        sorted_assets = sorted(
-            ready_video_assets,
-            key=lambda a: (
-                a.quality_score if a.quality_score is not None else 0.0,
-                a.duration if a.duration is not None else 0.0,
-            ),
-            reverse=True,
-        )
-        selected = sorted_assets if count <= 0 else sorted_assets[:count]
-        return [a.id for a in selected]
-
-    # 默认 all 模式：返回全部 ready 视频素材
-    return [a.id for a in ready_video_assets]
+def _select_title_id(project_title_repository: Any, project_id: str) -> str:
+    active_titles = project_title_repository.list_by_project(project_id, active_only=True)
+    if not active_titles:
+        return ""
+    selected = sorted(
+        active_titles,
+        key=lambda title: (
+            0 if getattr(title, "favorite", False) else 1,
+            int(title.usage_count or 0),
+            title.created_at,
+        ),
+    )[0]
+    return selected.id
 
 
-def _resolve_project_and_library(
-    request: CreateGenerationTaskRequest,
-    project_repository: Any,
-    asset_library_repository: Any,
-    asset_repository: Any,
-    authenticated_user: AuthenticatedUser,
-) -> tuple[str, str]:
-    """解析 project_id 和 asset_library_id。
-
-    支持两种模式：
-    - 显式传入（向后兼容）
-    - 从 asset_ids 反查 asset_library（模板模式）
-    返回 (project_id, asset_library_id)。
-    """
-    project_id = request.project_id.strip()
-    asset_library_id = request.asset_library_id.strip()
-
-    # 模板模式：project_id 未提供时，从 asset_ids 反查所属 project
-    if not project_id and request.asset_ids:
-        first_asset_id = request.asset_ids[0]
-        asset = asset_repository.find_by_id(first_asset_id)
-        if asset is not None:
-            project_id = asset.project_id
-            if not asset_library_id:
-                asset_library_id = asset.library_id
-
-    # 向后兼容校验：project_id 已提供时验证权限
-    if project_id:
-        project = project_repository.find_by_id(project_id)
-        if project is None:
-            raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-        if not project.can_access(authenticated_user.user.id):
-            raise HTTPException(status_code=403, detail="Access denied to project")
-
-    return project_id, asset_library_id
-
-
-@router.post("/tasks", response_model=BatchGenerationTaskResponse)
+@router.post("/tasks/", response_model=GenerationTaskResponse)
 def create_generation_task(
     request: CreateGenerationTaskRequest,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
@@ -190,141 +104,34 @@ def create_generation_task(
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
     asset_repository: Any = Depends(get_asset_repository),
-) -> BatchGenerationTaskResponse:
-    logger.info(
-        "[生成任务] 接收请求: user_id=%s, template_id=%s, asset_count=%d, mode=%s, count=%d",
-        authenticated_user.user.id,
-        request.template_id,
-        len(request.asset_ids),
-        request.asset_select_mode,
-        request.count,
-    )
-
-    try:
-        project_id, asset_library_id = _resolve_project_and_library(
-            request, project_repository, asset_library_repository, asset_repository, authenticated_user
-        )
-    except HTTPException as e:
-        logger.warning("[生成任务] 校验失败: %s", e.detail)
-        raise
-
-    # asset_library 存在性校验（仅在提供了 asset_library_id 时）
-    resolved_asset_ids: list[str] = list(request.asset_ids)
-    if asset_library_id:
-        library = asset_library_repository.get(asset_library_id)
-        if library is None or (project_id and library.project_id != project_id):
-            logger.warning("[生成任务] 素材库不存在: library_id=%s", asset_library_id)
-            raise HTTPException(status_code=404, detail=f"AssetLibrary {asset_library_id} not found")
-
-        assets = asset_repository.find_by_library(asset_library_id)
-        try:
-            _ensure_library_has_ready_video_assets(assets)
-        except HTTPException as e:
-            logger.warning("[生成任务] 素材校验失败: %s", e.detail)
-            raise
-
-        # 素材库自动匹配：当未显式指定 asset_ids 时，按模式自动选取
-        if not resolved_asset_ids:
-            resolved_asset_ids = _select_assets_from_library(
-                assets,
-                mode=request.asset_select_mode,
-                count=request.asset_select_count,
-            )
+    project_title_repository: Any = Depends(get_project_title_repository),
+) -> GenerationTaskResponse:
+    project = project_repository.find_by_id(request.project_id)
+    if project is None:
+        raise HTTPException(status_code=404, detail=f"Project {request.project_id} not found")
+    if not project.can_access(authenticated_user.id):
+        raise HTTPException(status_code=403, detail="Access denied to project")
+    
+    library = asset_library_repository.get(request.asset_library_id)
+    if library is None or library.project_id != request.project_id:
+        raise HTTPException(status_code=404, detail=f"AssetLibrary {request.asset_library_id} not found")
+    
+    assets = asset_repository.list_by_library(request.asset_library_id)
+    _ensure_library_has_ready_video_assets(assets)
 
     use_case = CreateGenerationTaskUseCase(generation_task_repository)
-    count = request.count
-    created_tasks = []
-    failed_tasks = []
-    user_id = authenticated_user.user.id
-    # 同批次任务共享 batch_id，用于视频查重时批次内比对
-    batch_id = uuid.uuid4().hex if count > 1 else ""
-
-    # 预检查：批量提交前先看会不会超限，避免建一半才拒
-    try:
-        user_pending = generation_task_repository.count_pending_by_user(user_id)
-        global_pending = generation_task_repository.count_pending_total()
-        if user_pending + count > USER_PENDING_LIMIT:
-            raise UserPendingLimitExceeded(
-                user_id=user_id, pending_count=user_pending + count, limit=USER_PENDING_LIMIT
-            )
-        if global_pending + count > GLOBAL_PENDING_LIMIT:
-            raise GlobalQueueFull(pending_count=global_pending + count, limit=GLOBAL_PENDING_LIMIT)
-    except UserPendingLimitExceeded as e:
-        raise HTTPException(
-            status_code=429,
-            detail=f"您的待处理任务过多（当前 {e.pending_count - count}/{e.limit}，本次提交 {count} 个），请等待完成后再提交",
-        ) from e
-    except GlobalQueueFull as e:
-        raise HTTPException(
-            status_code=503,
-            detail="系统繁忙，请稍后再试",
-        ) from e
-
-    try:
-        for _ in range(count):
-            task = use_case.execute(
-                CreateGenerationTaskCommand(
-                    project_id=project_id,
-                    asset_library_id=asset_library_id,
-                    strategy_id=request.strategy_id,
-                    voice_library_id=request.voice_library_id,
-                    template_id=request.template_id,
-                    asset_ids=resolved_asset_ids,
-                    title_ids=request.title_ids,
-                    voice_ids=request.voice_ids,
-                    created_by_user_id=user_id,
-                    source_edit_plan_id=request.source_edit_plan_id,
-                    asset_select_mode=request.asset_select_mode,
-                    batch_id=batch_id,
-                )
-            )
-            try:
-                if safe_enqueue_generation_task(
-                    task,
-                    generation_task_repository,
-                    user_id=user_id,
-                    log_prefix="[生成任务]",
-                    log_task_status=True,
-                ):
-                    created_tasks.append(task)
-                else:
-                    failed_tasks.append(task)
-            except UserPendingLimitExceeded:
-                # 兜底：如果预检查后又并发提交了，在这里也拦住
-                failed_tasks.append(task)
-                if not created_tasks:
-                    raise HTTPException(
-                        status_code=429,
-                        detail="您的待处理任务过多，请等待完成后再提交",
-                    )
-                break
-            except GlobalQueueFull:
-                failed_tasks.append(task)
-                if not created_tasks:
-                    raise HTTPException(
-                        status_code=503,
-                        detail="系统繁忙，请稍后再试",
-                    )
-                break
-    except HTTPException:
-        raise
-    except Exception as e:
-        logger.error("[生成任务] 创建失败: %s", e, exc_info=True)
-        raise HTTPException(status_code=500, detail="创建生成任务失败，请稍后重试或查看任务日志")
-
-    items = [_to_generation_task_response(t) for t in created_tasks + failed_tasks]
-    return BatchGenerationTaskResponse(items=items, total=len(items))
-
-
-@router.get("/tasks", response_model=ListGenerationTasksResponse)
-def list_generation_tasks(
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    generation_task_repository: Any = Depends(get_generation_task_repository),
-) -> ListGenerationTasksResponse:
-    """用户级生成任务列表（跨 project）。"""
-    tasks = generation_task_repository.list_by_user(authenticated_user.user.id)
-    items = [_to_generation_task_response(task) for task in tasks]
-    return ListGenerationTasksResponse(items=items)
+    task = use_case.execute(
+        CreateGenerationTaskCommand(
+            project_id=request.project_id,
+            asset_library_id=request.asset_library_id,
+            strategy_id=request.strategy_id or _select_title_id(project_title_repository, request.project_id),
+            voice_library_id=request.voice_library_id,
+            edit_plan_id=request.edit_plan_id,
+            created_by_user_id=authenticated_user.id,
+        )
+    )
+    celery_app.send_task("worker.generate_video", args=[task.id])
+    return _to_generation_task_response(task)
 
 
 @router.get("/tasks/{task_id}", response_model=GenerationTaskResponse)
@@ -338,98 +145,22 @@ def get_generation_task(
     task = use_case.execute(task_id)
     if task is None:
         raise HTTPException(status_code=404, detail=f"GenerationTask {task_id} not found")
-    if task.project_id:
-        _check_project_access(task.project_id, authenticated_user.user.id, project_repository)
+    _check_project_access(task.project_id, authenticated_user.id, project_repository)
     return _to_generation_task_response(task)
 
 
-@router.get("/tasks/{task_id}/results", response_model=ListGeneratedVideosResponse)
+@router.get("/tasks/{task_id}/results/", response_model=ListGeneratedVideosResponse)
 def list_generation_results(
     task_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     generation_task_repository: Any = Depends(get_generation_task_repository),
     generated_video_repository: Any = Depends(get_generated_video_repository),
     project_repository: Any = Depends(get_project_repository),
-    storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> ListGeneratedVideosResponse:
     task = generation_task_repository.get(task_id)
     if task is None:
         raise HTTPException(status_code=404, detail=f"GenerationTask {task_id} not found")
-    if task.project_id:
-        _check_project_access(task.project_id, authenticated_user.user.id, project_repository)
+    _check_project_access(task.project_id, authenticated_user.id, project_repository)
     use_case = ListGeneratedVideosByTaskUseCase(generated_video_repository)
     items = use_case.execute(task_id)
-    responses = []
-    for item in items:
-        download_url = storage_service.get_download_url(item.file_url, expires_seconds=86400)
-        responses.append(_to_generated_video_response(item, download_url=download_url))
-    return ListGeneratedVideosResponse(items=responses)
-
-
-@router.post("/tasks/{task_id}/retry", response_model=GenerationTaskResponse)
-def retry_generation_task(
-    task_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    generation_task_repository: Any = Depends(get_generation_task_repository),
-) -> GenerationTaskResponse:
-    """简化重试：通过 task_id 直接重试失败任务。"""
-    task = generation_task_repository.get(task_id)
-    if task is None:
-        raise HTTPException(status_code=404, detail="Generation task not found")
-    if task.created_by_user_id and task.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this task")
-    status_val = task.status.value if hasattr(task.status, "value") else str(task.status)
-    if status_val != "failed":
-        raise HTTPException(status_code=409, detail="Only failed tasks can be retried")
-
-    user_id = authenticated_user.user.id
-    # 预检查：创建前判断，>= 上限就拒绝
-    user_pending = generation_task_repository.count_pending_by_user(user_id)
-    global_pending = generation_task_repository.count_pending_total()
-    if user_pending >= USER_PENDING_LIMIT:
-        raise HTTPException(
-            status_code=429,
-            detail=f"您的待处理任务过多（当前 {user_pending}/{USER_PENDING_LIMIT}），请等待完成后再提交",
-        )
-    if global_pending >= GLOBAL_PENDING_LIMIT:
-        raise HTTPException(
-            status_code=503,
-            detail="系统繁忙，请稍后再试",
-        )
-
-    use_case = CreateGenerationTaskUseCase(generation_task_repository)
-    retried = use_case.execute(
-        CreateGenerationTaskCommand(
-            project_id=task.project_id,
-            asset_library_id=task.asset_library_id,
-            strategy_id=task.strategy_id,
-            voice_library_id=task.voice_library_id,
-            template_id=task.template_id,
-            asset_ids=task.asset_ids,
-            title_ids=task.title_ids,
-            voice_ids=task.voice_ids,
-            created_by_user_id=user_id,
-            source_edit_plan_id=task.source_edit_plan_id or "",
-            asset_select_mode=getattr(task, "asset_select_mode", ""),
-        )
-    )
-    try:
-        if not safe_enqueue_generation_task(
-            retried,
-            generation_task_repository,
-            user_id=user_id,
-            log_prefix="[生成任务]",
-            log_task_status=True,
-        ):
-            logger.warning("[生成任务] 重试入队失败: task_id=%s", retried.id)
-    except UserPendingLimitExceeded:
-        raise HTTPException(
-            status_code=429,
-            detail="您的待处理任务过多，请等待完成后再提交",
-        ) from None
-    except GlobalQueueFull:
-        raise HTTPException(
-            status_code=503,
-            detail="系统繁忙，请稍后再试",
-        ) from None
-    return _to_generation_task_response(retried)
+    return ListGeneratedVideosResponse(items=[_to_generated_video_response(item) for item in items])

apps/api/app/api/routes/health.py

@@ -5,6 +5,7 @@ import redis
 from app.config import settings
 from fastapi import APIRouter, status
 from fastapi.responses import JSONResponse
+from pydantic import BaseModel
 
 router = APIRouter(tags=["Health"])
 
@@ -20,8 +21,19 @@ async def health_check():
 
 @router.get("/ready", status_code=status.HTTP_200_OK)
 async def readiness_check():
-    """简单的就绪检查，仅返回状态。详细健康检查请使用 /health 端点。"""
-    return {"status": "ready"}
+    checks = {
+        "database": await _check_database(),
+        "redis": await _check_redis(),
+    }
+    all_healthy = all(check["status"] == "healthy" for check in checks.values())
+    response = {
+        "status": "ready" if all_healthy else "not_ready",
+        "timestamp": datetime.utcnow().isoformat(),
+        "checks": checks,
+    }
+    if not all_healthy:
+        return JSONResponse(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, content=response)
+    return response
 
 
 @router.get("/startup", status_code=status.HTTP_200_OK)
@@ -85,38 +97,6 @@ async def _check_redis() -> dict:
         }
 
 
-def _check_oss() -> dict:
-    try:
-        from app.core.storage import get_storage_service
-
-        svc = get_storage_service()
-        if not svc.access_key_id or not svc.access_key_secret:
-            return {
-                "status": "unhealthy",
-                "type": "oss",
-                "message": "OSS credentials not configured (OSS_ACCESS_KEY_ID / OSS_ACCESS_KEY_SECRET missing)",
-            }
-        if svc.bucket is None:
-            return {
-                "status": "unhealthy",
-                "type": "oss",
-                "message": "OSS SDK (oss2) not installed or bucket client init failed",
-            }
-        # Try a lightweight OSS API call to verify connectivity & credentials
-        svc.bucket.get_bucket_info()
-        return {
-            "status": "healthy",
-            "type": "oss",
-            "message": f"OSS connected: endpoint={svc.endpoint} bucket={svc.bucket_name}",
-        }
-    except Exception as error:
-        return {
-            "status": "unhealthy",
-            "type": "oss",
-            "message": f"OSS check failed: {type(error).__name__}: {error}",
-        }
-
-
 async def _check_migrations() -> dict:
     if settings.USE_IN_MEMORY_DB:
         return {

apps/api/app/api/routes/internal_render.py

@@ -1,120 +0,0 @@
-"""渲染结果内部下载接口。
-
-通过内部 API Key 鉴权，为灰度对比工具等内部系统提供渲染结果下载能力。
-
-API:
-  GET  /api/v1/internal/render/videos/{video_id}/download-url  - 获取单个视频下载URL
-  GET  /api/v1/internal/render/tasks/{task_id}/videos          - 获取任务下所有视频及下载URL
-
-鉴权：X-API-Key header，走内部 API Key 验证
-"""
-
-from __future__ import annotations
-
-import logging
-from typing import Any
-
-from app.api.routes.auth import _verify_internal_api_key
-from app.core.storage import OSSStorageService, get_storage_service
-from app.dependencies import get_generated_video_repository
-from fastapi import APIRouter, Depends, HTTPException, Query
-from pydantic import BaseModel
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter(prefix="/internal/render", tags=["Internal"])
-
-
-class InternalRenderVideoItem(BaseModel):
-    """内部渲染视频项。"""
-
-    video_id: str
-    generation_task_id: str
-    project_id: str
-    name: str
-    file_url: str
-    file_size: int | None = None
-    duration: float | None = None
-    width: int | None = None
-    height: int | None = None
-    fps: float | None = None
-    status: str
-    download_url: str
-
-
-class InternalRenderTaskVideosResponse(BaseModel):
-    """任务下所有渲染视频响应。"""
-
-    task_id: str
-    count: int
-    videos: list[InternalRenderVideoItem]
-
-
-class InternalRenderDownloadUrlResponse(BaseModel):
-    """单个视频下载URL响应。"""
-
-    video_id: str
-    download_url: str
-
-
-def _video_to_item(video: Any, download_url: str) -> InternalRenderVideoItem:
-    """将 GeneratedVideo 领域对象转为响应项。"""
-    return InternalRenderVideoItem(
-        video_id=video.id,
-        generation_task_id=video.generation_task_id,
-        project_id=video.project_id,
-        name=video.name,
-        file_url=video.file_url,
-        file_size=getattr(video, "file_size", None),
-        duration=getattr(video, "duration", None),
-        width=getattr(video, "width", None),
-        height=getattr(video, "height", None),
-        fps=getattr(video, "fps", None),
-        status=video.status,
-        download_url=download_url,
-    )
-
-
-@router.get("/videos/{video_id}/download-url", response_model=InternalRenderDownloadUrlResponse)
-def get_render_video_download_url(
-    video_id: str,
-    _: bool = Depends(_verify_internal_api_key),
-    generated_video_repository: Any = Depends(get_generated_video_repository),
-    storage_service: OSSStorageService = Depends(get_storage_service),
-) -> InternalRenderDownloadUrlResponse:
-    """获取单个渲染视频的下载URL（预签名）。"""
-    video = generated_video_repository.get(video_id)
-    if video is None:
-        raise HTTPException(status_code=404, detail=f"GeneratedVideo {video_id} not found")
-
-    download_url = storage_service.get_download_url(video.file_url, expires_seconds=86400)
-    logger.info("内部渲染下载URL生成: video_id=%s", video_id)
-    return InternalRenderDownloadUrlResponse(video_id=video_id, download_url=download_url)
-
-
-@router.get("/tasks/{task_id}/videos", response_model=InternalRenderTaskVideosResponse)
-def get_render_task_videos(
-    task_id: str,
-    status: str | None = Query(None, description="按状态筛选，如 completed/failed"),
-    _: bool = Depends(_verify_internal_api_key),
-    generated_video_repository: Any = Depends(get_generated_video_repository),
-    storage_service: OSSStorageService = Depends(get_storage_service),
-) -> InternalRenderTaskVideosResponse:
-    """获取生成任务下所有渲染视频及下载URL。"""
-    videos = generated_video_repository.list_by_generation_task(task_id)
-
-    # 状态筛选
-    if status:
-        videos = [v for v in videos if v.status == status]
-
-    items = []
-    for video in videos:
-        download_url = storage_service.get_download_url(video.file_url, expires_seconds=86400)
-        items.append(_video_to_item(video, download_url))
-
-    logger.info("内部渲染任务视频查询: task_id=%s count=%d", task_id, len(items))
-    return InternalRenderTaskVideosResponse(
-        task_id=task_id,
-        count=len(items),
-        videos=items,
-    )

apps/api/app/api/routes/jobs.py

@@ -1,332 +0,0 @@
-"""Job API 路由 — Phase 8 任务 2.10.
-
-提供统一异步任务管理 RESTful 接口：
-- POST   /api/v1/jobs                        创建任务
-- GET    /api/v1/jobs/{job_id}                任务详情
-- GET    /api/v1/projects/{project_id}/jobs   项目任务列表
-- GET    /api/v1/projects/{project_id}/jobs/stats  任务统计
-- PUT    /api/v1/jobs/{job_id}/progress       更新进度
-- POST   /api/v1/jobs/{job_id}/complete       标记完成
-- POST   /api/v1/jobs/{job_id}/fail           标记失败
-- POST   /api/v1/jobs/{job_id}/retry          重试任务
-- POST   /api/v1/jobs/{job_id}/cancel         取消任务
-- POST   /api/v1/jobs/{job_id}/submit         提交执行
-"""
-
-from __future__ import annotations
-
-import logging
-from typing import Any
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.core.celery_app import celery_app
-from app.dependencies import get_db_session, get_job_repository, get_project_repository
-from app.schemas.job import (
-    CompleteJobRequest,
-    CreateJobRequest,
-    FailJobRequest,
-    JobResponse,
-    JobStatisticsResponse,
-    ListJobsResponse,
-    UpdateProgressRequest,
-    job_to_response,
-)
-from fastapi import APIRouter, Depends, HTTPException, Query, status
-
-from packages.application.jobs import (
-    CancelJobUseCase,
-    CompleteJobCommand,
-    CompleteJobUseCase,
-    CreateJobCommand,
-    CreateJobUseCase,
-    FailJobCommand,
-    FailJobUseCase,
-    GetJobStatisticsUseCase,
-    GetJobUseCase,
-    ListJobsUseCase,
-    RetryJobUseCase,
-    SubmitJobUseCase,
-    UpdateJobProgressCommand,
-    UpdateJobProgressUseCase,
-)
-from packages.domain.job import JobType
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter()
-
-# 任务类型 → Celery task name 映射
-_JOB_TYPE_TO_CELERY_TASK: dict[str, str] = {
-    JobType.VIDEO_COMPOSE: "worker.compose_video",
-    JobType.RENDER_EDIT_PLAN: "worker.render_edit_plan",
-    JobType.ASSET_INGEST: "worker.ingest_asset",
-    JobType.CLASSIFICATION: "worker.classify_asset",
-    JobType.VOICE_EXTRACTION: "worker.extract_voice",
-    JobType.GENERATION: "worker.generate_video",
-}
-
-
-def _check_project_access(project_id: str, user_id: str, project_repository) -> None:
-    """检查用户是否有项目访问权限。"""
-    project = project_repository.find_by_id(project_id)
-    if project is None:
-        raise HTTPException(status_code=404, detail=f"Project {project_id} not found")
-    if not project.can_access(user_id):
-        raise HTTPException(status_code=403, detail="Access denied to project")
-
-
-# ── 创建任务 ──────────────────────────────────────────────────────────────────
-
-
-@router.post("/jobs", response_model=JobResponse, status_code=status.HTTP_201_CREATED)
-def create_job(
-    request: CreateJobRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> JobResponse:
-    """创建异步任务。
-
-    创建后任务处于 pending 状态，需要调用 /submit 提交执行。
-    """
-    _check_project_access(request.project_id, authenticated_user.user.id, project_repository)
-
-    # 校验 job_type
-    try:
-        JobType(request.job_type)
-    except ValueError:
-        raise HTTPException(
-            status_code=400,
-            detail=f"不支持的任务类型: {request.job_type}，" f"可选值: {[t.value for t in JobType]}",
-        )
-
-    use_case = CreateJobUseCase(job_repo)
-    job = use_case.execute(
-        CreateJobCommand(
-            project_id=request.project_id,
-            job_type=request.job_type,
-            payload=request.payload,
-            source_id=request.source_id,
-            created_by_user_id=authenticated_user.user.id,
-            max_retries=request.max_retries,
-        )
-    )
-
-    return job_to_response(job)
-
-
-# ── 提交执行 ──────────────────────────────────────────────────────────────────
-
-
-@router.post("/jobs/{job_id}/submit", response_model=JobResponse)
-def submit_job(
-    job_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-) -> JobResponse:
-    """提交任务执行。
-
-    将任务状态从 pending 切换为 running，并 dispatch Celery 异步任务。
-    """
-    # 权限检查：先获取任务并验证权限，再执行状态变更
-    job = job_repo.get(job_id)
-    if job is None:
-        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
-    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this job")
-
-    use_case = SubmitJobUseCase(job_repo)
-
-    try:
-        job = use_case.execute(job_id)
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-    # Dispatch Celery 任务
-    celery_task_name = _JOB_TYPE_TO_CELERY_TASK.get(job.job_type.value)
-    if celery_task_name:
-        result = celery_app.send_task(celery_task_name, args=[job.id], kwargs=job.payload)
-        job.celery_task_id = result.id
-        job_repo.update(job)
-        logger.info("已提交 Celery 任务: job_id=%s celery_task_id=%s", job.id, result.id)
-
-    return job_to_response(job)
-
-
-# ── 查询接口 ──────────────────────────────────────────────────────────────────
-
-
-@router.get("/jobs/{job_id}", response_model=JobResponse)
-def get_job(
-    job_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-) -> JobResponse:
-    """获取任务详情。"""
-    use_case = GetJobUseCase(job_repo)
-    job = use_case.execute(job_id)
-    if job is None:
-        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
-    return job_to_response(job)
-
-
-@router.get("/projects/{project_id}/jobs", response_model=ListJobsResponse)
-def list_project_jobs(
-    project_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-    project_repository: Any = Depends(get_project_repository),
-    job_type: str | None = Query(default=None, description="按任务类型过滤"),
-    status_filter: str | None = Query(default=None, alias="status", description="按状态过滤"),
-    limit: int = Query(default=50, ge=1, le=200),
-    offset: int = Query(default=0, ge=0),
-) -> ListJobsResponse:
-    """获取项目下的任务列表。"""
-    _check_project_access(project_id, authenticated_user.user.id, project_repository)
-
-    use_case = ListJobsUseCase(job_repo)
-    jobs = use_case.execute(
-        project_id=project_id,
-        job_type=job_type,
-        status=status_filter,
-        limit=limit,
-        offset=offset,
-    )
-    items = [job_to_response(j) for j in jobs]
-    return ListJobsResponse(items=items, total=len(items))
-
-
-@router.get("/projects/{project_id}/jobs/stats", response_model=JobStatisticsResponse)
-def get_job_statistics(
-    project_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-    project_repository: Any = Depends(get_project_repository),
-) -> JobStatisticsResponse:
-    """获取项目任务统计摘要。"""
-    _check_project_access(project_id, authenticated_user.user.id, project_repository)
-
-    use_case = GetJobStatisticsUseCase(job_repo)
-    stats = use_case.execute(project_id)
-    return JobStatisticsResponse(**stats)
-
-
-# ── 进度更新 ──────────────────────────────────────────────────────────────────
-
-
-@router.put("/jobs/{job_id}/progress", response_model=JobResponse)
-def update_job_progress(
-    job_id: str,
-    request: UpdateProgressRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-) -> JobResponse:
-    """更新任务进度。"""
-    use_case = UpdateJobProgressUseCase(job_repo)
-
-    try:
-        job = use_case.execute(
-            UpdateJobProgressCommand(
-                job_id=job_id,
-                progress=request.progress,
-                current_stage=request.current_stage,
-            )
-        )
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-    return job_to_response(job)
-
-
-# ── 完成 / 失败 ────────────────────────────────────────────────────────────────
-
-
-@router.post("/jobs/{job_id}/complete", response_model=JobResponse)
-def complete_job(
-    job_id: str,
-    request: CompleteJobRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-) -> JobResponse:
-    """标记任务完成。"""
-    use_case = CompleteJobUseCase(job_repo)
-
-    try:
-        job = use_case.execute(CompleteJobCommand(job_id=job_id, result=request.result))
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-    return job_to_response(job)
-
-
-@router.post("/jobs/{job_id}/fail", response_model=JobResponse)
-def fail_job(
-    job_id: str,
-    request: FailJobRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-) -> JobResponse:
-    """标记任务失败。"""
-    use_case = FailJobUseCase(job_repo)
-
-    try:
-        job = use_case.execute(FailJobCommand(job_id=job_id, error_message=request.error_message))
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-    return job_to_response(job)
-
-
-# ── 重试 / 取消 ────────────────────────────────────────────────────────────────
-
-
-@router.post("/jobs/{job_id}/retry", response_model=JobResponse)
-def retry_job(
-    job_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-) -> JobResponse:
-    """重试失败任务。
-
-    将任务重置为 pending，retry_count + 1，但不自动 dispatch。
-    需要再次调用 /submit 提交执行。
-    """
-    # 权限检查：先获取任务并验证权限，再执行状态变更
-    job = job_repo.get(job_id)
-    if job is None:
-        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
-    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this job")
-
-    use_case = RetryJobUseCase(job_repo)
-
-    try:
-        job = use_case.execute(job_id)
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-    return job_to_response(job)
-
-
-@router.post("/jobs/{job_id}/cancel", response_model=JobResponse)
-def cancel_job(
-    job_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    job_repo: Any = Depends(get_job_repository),
-) -> JobResponse:
-    """取消任务。"""
-    # 权限检查：先获取任务并验证权限，再执行状态变更
-    job = job_repo.get(job_id)
-    if job is None:
-        raise HTTPException(status_code=404, detail=f"Job {job_id} not found")
-    if job.created_by_user_id and job.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this job")
-
-    use_case = CancelJobUseCase(job_repo)
-
-    try:
-        job = use_case.execute(job_id)
-    except ValueError as e:
-        raise HTTPException(status_code=400, detail=str(e))
-
-    return job_to_response(job)

apps/api/app/api/routes/project_management.py

@@ -0,0 +1,486 @@
+"""项目管理 API 路由"""
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel, Field
+
+from packages.adapters.sqlite_tracker.project_management_repositories import (
+    SQLiteMilestoneRepository,
+    SQLiteTaskIssueRepository,
+    SQLiteTaskRepository,
+)
+from packages.application.get_task_detail_use_case import GetTaskDetailUseCase
+from packages.application.project_management_use_cases import (
+    CreateMilestoneUseCase,
+    CreateTaskIssueUseCase,
+    CreateTaskUseCase,
+    ListProjectMilestonesUseCase,
+    ListProjectTasksUseCase,
+    ListTaskIssuesUseCase,
+    ResolveTaskIssueUseCase,
+    UpdateTaskProgressUseCase,
+    UpdateTaskStatusUseCase,
+)
+from packages.application.update_task_use_case import UpdateTaskUseCase
+from packages.domain import TaskPriority, TaskStatus
+
+router = APIRouter()
+
+# 使用 SQLite tracker.db
+_task_repo = SQLiteTaskRepository()
+_milestone_repo = SQLiteMilestoneRepository()
+_issue_repo = SQLiteTaskIssueRepository()
+
+
+def get_task_repo():
+    return _task_repo
+
+
+def get_milestone_repo():
+    return _milestone_repo
+
+
+def get_issue_repo():
+    return _issue_repo
+
+
+# ========== Request/Response Models ==========
+
+
+class CreateTaskRequest(BaseModel):
+    project_id: str
+    workspace_id: str
+    name: str
+    description: str = ""
+    priority: TaskPriority = TaskPriority.MEDIUM
+    parent_task_id: str = ""
+    assignee_user_id: str = ""
+
+
+class TaskResponse(BaseModel):
+    id: str
+    project_id: str
+    workspace_id: str
+    name: str
+    description: str
+    status: TaskStatus
+    priority: TaskPriority
+    parent_task_id: str
+    assignee_user_id: str
+    progress: float
+    planned_start_date: datetime | None
+    planned_end_date: datetime | None
+    actual_start_date: datetime | None
+    actual_end_date: datetime | None
+    tags: list[str]
+    created_at: datetime
+    updated_at: datetime
+
+
+class UpdateTaskRequest(BaseModel):
+    name: str | None = None
+    description: str | None = None
+    priority: str | None = None
+    assignee_user_id: str | None = None
+
+
+class UpdateTaskStatusRequest(BaseModel):
+    status: TaskStatus
+
+
+class UpdateTaskProgressRequest(BaseModel):
+    progress: Annotated[float, Field(ge=0, le=100)]
+
+
+class CreateMilestoneRequest(BaseModel):
+    project_id: str
+    workspace_id: str
+    name: str
+    description: str = ""
+
+
+class MilestoneResponse(BaseModel):
+    id: str
+    project_id: str
+    workspace_id: str
+    name: str
+    description: str
+    target_date: datetime | None
+    completed: bool
+    completed_at: datetime | None
+    created_at: datetime
+    updated_at: datetime
+
+
+class CreateTaskIssueRequest(BaseModel):
+    task_id: str
+    project_id: str
+    workspace_id: str
+    title: str
+    description: str = ""
+    created_by_user_id: str = ""
+
+
+class TaskIssueResponse(BaseModel):
+    id: str
+    task_id: str
+    project_id: str
+    workspace_id: str
+    title: str
+    description: str
+    resolved: bool
+    resolved_at: datetime | None
+    created_by_user_id: str
+    created_at: datetime
+    updated_at: datetime
+
+
+# ========== Task Endpoints ==========
+
+
+@router.post("/tasks", response_model=TaskResponse)
+def create_task(
+    req: CreateTaskRequest,
+    task_repo=Depends(get_task_repo),
+):
+    """创建任务"""
+    use_case = CreateTaskUseCase(task_repo)
+    task = use_case.execute(
+        project_id=req.project_id,
+        workspace_id=req.workspace_id,
+        name=req.name,
+        description=req.description,
+        priority=req.priority,
+        parent_task_id=req.parent_task_id,
+        assignee_user_id=req.assignee_user_id,
+    )
+    return TaskResponse(
+        id=task.id,
+        project_id=task.project_id,
+        workspace_id=task.workspace_id,
+        name=task.name,
+        description=task.description,
+        status=task.status,
+        priority=task.priority,
+        parent_task_id=task.parent_task_id,
+        assignee_user_id=task.assignee_user_id,
+        progress=task.progress,
+        planned_start_date=task.planned_start_date,
+        planned_end_date=task.planned_end_date,
+        actual_start_date=task.actual_start_date,
+        actual_end_date=task.actual_end_date,
+        tags=task.tags,
+        created_at=task.created_at,
+        updated_at=task.updated_at,
+    )
+
+
+@router.get("/tasks", response_model=list[TaskResponse])
+def list_tasks(
+    project_id: str,
+    task_repo=Depends(get_task_repo),
+):
+    """获取项目任务列表"""
+    use_case = ListProjectTasksUseCase(task_repo)
+    tasks = use_case.execute(project_id)
+    return [
+        TaskResponse(
+            id=t.id,
+            project_id=t.project_id,
+            workspace_id=t.workspace_id,
+            name=t.name,
+            description=t.description,
+            status=t.status,
+            priority=t.priority,
+            parent_task_id=t.parent_task_id,
+            assignee_user_id=t.assignee_user_id,
+            progress=t.progress,
+            planned_start_date=t.planned_start_date,
+            planned_end_date=t.planned_end_date,
+            actual_start_date=t.actual_start_date,
+            actual_end_date=t.actual_end_date,
+            tags=t.tags,
+            created_at=t.created_at,
+            updated_at=t.updated_at,
+        )
+        for t in tasks
+    ]
+
+
+@router.get("/tasks/{task_id}", response_model=TaskResponse)
+def get_task(
+    task_id: str,
+    task_repo=Depends(get_task_repo),
+):
+    """获取任务详情"""
+    use_case = GetTaskDetailUseCase(task_repo)
+    try:
+        task = use_case.execute(task_id)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+    return TaskResponse(
+        id=task.id,
+        project_id=task.project_id,
+        workspace_id=task.workspace_id,
+        name=task.name,
+        description=task.description,
+        status=task.status,
+        priority=task.priority,
+        parent_task_id=task.parent_task_id,
+        assignee_user_id=task.assignee_user_id,
+        progress=task.progress,
+        planned_start_date=task.planned_start_date,
+        planned_end_date=task.planned_end_date,
+        actual_start_date=task.actual_start_date,
+        actual_end_date=task.actual_end_date,
+        tags=task.tags,
+        created_at=task.created_at,
+        updated_at=task.updated_at,
+    )
+
+
+@router.patch("/tasks/{task_id}", response_model=TaskResponse)
+def update_task(
+    task_id: str,
+    req: UpdateTaskRequest,
+    task_repo=Depends(get_task_repo),
+):
+    """更新任务基本信息"""
+    use_case = UpdateTaskUseCase(task_repo)
+    try:
+        task = use_case.execute(
+            task_id=task_id,
+            name=req.name,
+            description=req.description,
+            priority=req.priority,
+            assignee_user_id=req.assignee_user_id,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+    return TaskResponse(
+        id=task.id,
+        project_id=task.project_id,
+        workspace_id=task.workspace_id,
+        name=task.name,
+        description=task.description,
+        status=task.status,
+        priority=task.priority,
+        parent_task_id=task.parent_task_id,
+        assignee_user_id=task.assignee_user_id,
+        progress=task.progress,
+        planned_start_date=task.planned_start_date,
+        planned_end_date=task.planned_end_date,
+        actual_start_date=task.actual_start_date,
+        actual_end_date=task.actual_end_date,
+        tags=task.tags,
+        created_at=task.created_at,
+        updated_at=task.updated_at,
+    )
+
+
+@router.patch("/tasks/{task_id}/status", response_model=TaskResponse)
+def update_task_status(
+    task_id: str,
+    req: UpdateTaskStatusRequest,
+    task_repo=Depends(get_task_repo),
+):
+    """更新任务状态"""
+    use_case = UpdateTaskStatusUseCase(task_repo)
+    try:
+        task = use_case.execute(task_id, req.status)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+    return TaskResponse(
+        id=task.id,
+        project_id=task.project_id,
+        workspace_id=task.workspace_id,
+        name=task.name,
+        description=task.description,
+        status=task.status,
+        priority=task.priority,
+        parent_task_id=task.parent_task_id,
+        assignee_user_id=task.assignee_user_id,
+        progress=task.progress,
+        planned_start_date=task.planned_start_date,
+        planned_end_date=task.planned_end_date,
+        actual_start_date=task.actual_start_date,
+        actual_end_date=task.actual_end_date,
+        tags=task.tags,
+        created_at=task.created_at,
+        updated_at=task.updated_at,
+    )
+
+
+@router.patch("/tasks/{task_id}/progress", response_model=TaskResponse)
+def update_task_progress(
+    task_id: str,
+    req: UpdateTaskProgressRequest,
+    task_repo=Depends(get_task_repo),
+):
+    """更新任务进度"""
+    use_case = UpdateTaskProgressUseCase(task_repo)
+    try:
+        task = use_case.execute(task_id, req.progress)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+    return TaskResponse(
+        id=task.id,
+        project_id=task.project_id,
+        workspace_id=task.workspace_id,
+        name=task.name,
+        description=task.description,
+        status=task.status,
+        priority=task.priority,
+        parent_task_id=task.parent_task_id,
+        assignee_user_id=task.assignee_user_id,
+        progress=task.progress,
+        planned_start_date=task.planned_start_date,
+        planned_end_date=task.planned_end_date,
+        actual_start_date=task.actual_start_date,
+        actual_end_date=task.actual_end_date,
+        tags=task.tags,
+        created_at=task.created_at,
+        updated_at=task.updated_at,
+    )
+
+
+# ========== Milestone Endpoints ==========
+
+
+@router.post("/milestones", response_model=MilestoneResponse)
+def create_milestone(
+    req: CreateMilestoneRequest,
+    milestone_repo=Depends(get_milestone_repo),
+):
+    """创建里程碑"""
+    use_case = CreateMilestoneUseCase(milestone_repo)
+    milestone = use_case.execute(
+        project_id=req.project_id,
+        workspace_id=req.workspace_id,
+        name=req.name,
+        description=req.description,
+    )
+    return MilestoneResponse(
+        id=milestone.id,
+        project_id=milestone.project_id,
+        workspace_id=milestone.workspace_id,
+        name=milestone.name,
+        description=milestone.description,
+        target_date=milestone.target_date,
+        completed=milestone.completed,
+        completed_at=milestone.completed_at,
+        created_at=milestone.created_at,
+        updated_at=milestone.updated_at,
+    )
+
+
+@router.get("/milestones", response_model=list[MilestoneResponse])
+def list_milestones(
+    project_id: str,
+    milestone_repo=Depends(get_milestone_repo),
+):
+    """获取项目里程碑列表"""
+    use_case = ListProjectMilestonesUseCase(milestone_repo)
+    milestones = use_case.execute(project_id)
+    return [
+        MilestoneResponse(
+            id=m.id,
+            project_id=m.project_id,
+            workspace_id=m.workspace_id,
+            name=m.name,
+            description=m.description,
+            target_date=m.target_date,
+            completed=m.completed,
+            completed_at=m.completed_at,
+            created_at=m.created_at,
+            updated_at=m.updated_at,
+        )
+        for m in milestones
+    ]
+
+
+# ========== Task Issue Endpoints ==========
+
+
+@router.post("/issues", response_model=TaskIssueResponse)
+def create_issue(
+    req: CreateTaskIssueRequest,
+    issue_repo=Depends(get_issue_repo),
+):
+    """创建任务问题"""
+    use_case = CreateTaskIssueUseCase(issue_repo)
+    issue = use_case.execute(
+        task_id=req.task_id,
+        project_id=req.project_id,
+        workspace_id=req.workspace_id,
+        title=req.title,
+        description=req.description,
+        created_by_user_id=req.created_by_user_id,
+    )
+    return TaskIssueResponse(
+        id=issue.id,
+        task_id=issue.task_id,
+        project_id=issue.project_id,
+        workspace_id=issue.workspace_id,
+        title=issue.title,
+        description=issue.description,
+        resolved=issue.resolved,
+        resolved_at=issue.resolved_at,
+        created_by_user_id=issue.created_by_user_id,
+        created_at=issue.created_at,
+        updated_at=issue.updated_at,
+    )
+
+
+@router.get("/issues", response_model=list[TaskIssueResponse])
+def list_issues(
+    task_id: str,
+    issue_repo=Depends(get_issue_repo),
+):
+    """获取任务问题列表"""
+    use_case = ListTaskIssuesUseCase(issue_repo)
+    issues = use_case.execute(task_id)
+    return [
+        TaskIssueResponse(
+            id=i.id,
+            task_id=i.task_id,
+            project_id=i.project_id,
+            workspace_id=i.workspace_id,
+            title=i.title,
+            description=i.description,
+            resolved=i.resolved,
+            resolved_at=i.resolved_at,
+            created_by_user_id=i.created_by_user_id,
+            created_at=i.created_at,
+            updated_at=i.updated_at,
+        )
+        for i in issues
+    ]
+
+
+@router.patch("/issues/{issue_id}/resolve", response_model=TaskIssueResponse)
+def resolve_issue(
+    issue_id: str,
+    issue_repo=Depends(get_issue_repo),
+):
+    """解决任务问题"""
+    use_case = ResolveTaskIssueUseCase(issue_repo)
+    try:
+        issue = use_case.execute(issue_id)
+    except ValueError as e:
+        raise HTTPException(status_code=404, detail=str(e))
+    return TaskIssueResponse(
+        id=issue.id,
+        task_id=issue.task_id,
+        project_id=issue.project_id,
+        workspace_id=issue.workspace_id,
+        title=issue.title,
+        description=issue.description,
+        resolved=issue.resolved,
+        resolved_at=issue.resolved_at,
+        created_by_user_id=issue.created_by_user_id,
+        created_at=issue.created_at,
+        updated_at=issue.updated_at,
+    )

apps/api/app/api/routes/project_titles.py

@@ -0,0 +1,105 @@
+from typing import Any
+
+from app.api.routes.permissions import require_workspace_member
+from app.auth import AuthenticatedUser, get_current_user
+from app.dependencies import (
+    get_project_repository,
+    get_project_title_repository,
+    get_workspace_member_repository,
+)
+from app.schemas.project_title import (
+    CreateProjectTitleRequest,
+    ListProjectTitlesResponse,
+    ProjectTitleResponse,
+    UpdateProjectTitleRequest,
+)
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from packages.ports.workspace_member_repository import WorkspaceMemberRepository
+
+router = APIRouter()
+
+
+def _to_response(item) -> ProjectTitleResponse:
+    return ProjectTitleResponse(
+        id=item.id,
+        workspace_id=item.workspace_id,
+        project_id=item.project_id,
+        text=item.text,
+        category=item.category,
+        favorite=bool(getattr(item, "favorite", False)),
+        usage_count=int(item.usage_count or 0),
+        is_active=bool(item.is_active),
+        created_at=item.created_at,
+        updated_at=item.updated_at,
+    )
+
+
+def _get_project_or_404(project_id: str, project_repository: Any):
+    project = project_repository.find_by_id(project_id)
+    if project is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
+    return project
+
+
+@router.get("/projects/{project_id}/titles", response_model=ListProjectTitlesResponse)
+def list_project_titles(
+    project_id: str,
+    active_only: bool = False,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    project_repository: Any = Depends(get_project_repository),
+    title_repository: Any = Depends(get_project_title_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
+) -> ListProjectTitlesResponse:
+    project = _get_project_or_404(project_id, project_repository)
+    require_workspace_member(project.workspace_id, authenticated_user, workspace_member_repository)
+    return ListProjectTitlesResponse(
+        items=[_to_response(item) for item in title_repository.list_by_project(project_id, active_only)]
+    )
+
+
+@router.post("/projects/{project_id}/titles", response_model=ProjectTitleResponse)
+def create_project_title(
+    project_id: str,
+    request: CreateProjectTitleRequest,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    project_repository: Any = Depends(get_project_repository),
+    title_repository: Any = Depends(get_project_title_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
+) -> ProjectTitleResponse:
+    project = _get_project_or_404(project_id, project_repository)
+    if project.workspace_id != request.workspace_id:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="workspace_id does not match project")
+    require_workspace_member(project.workspace_id, authenticated_user, workspace_member_repository)
+    item = title_repository.create(
+        workspace_id=project.workspace_id,
+        project_id=project_id,
+        text=request.text,
+        category=request.category,
+        favorite=request.favorite,
+        created_by_user_id=authenticated_user.user.id,
+    )
+    return _to_response(item)
+
+
+@router.patch("/project-titles/{title_id}", response_model=ProjectTitleResponse)
+def update_project_title(
+    title_id: str,
+    request: UpdateProjectTitleRequest,
+    authenticated_user: AuthenticatedUser = Depends(get_current_user),
+    title_repository: Any = Depends(get_project_title_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
+) -> ProjectTitleResponse:
+    item = title_repository.get(title_id)
+    if item is None:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project title not found")
+    require_workspace_member(item.workspace_id, authenticated_user, workspace_member_repository)
+    if request.text is not None:
+        item.text = request.text.strip()
+    if request.category is not None:
+        item.category = request.category
+    if request.favorite is not None:
+        item.favorite = request.favorite
+    if request.is_active is not None:
+        item.is_active = request.is_active
+    return _to_response(title_repository.update(item))

apps/api/app/api/routes/projects.py

@@ -1,21 +1,22 @@
 from typing import Any
 
 from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_project_repository
+from app.dependencies import get_project_repository, get_workspace_member_repository
 from app.schemas.project import (
     CreateProjectRequest,
     ListProjectsResponse,
     ProjectResponse,
 )
+from app.api.routes.permissions import require_workspace_member
 from fastapi import APIRouter, Depends, HTTPException, status
 
 from packages.application import (
     CreateProjectCommand,
     CreateProjectUseCase,
-    DeleteProjectUseCase,
     GetProjectUseCase,
     ListProjectsUseCase,
 )
+from packages.ports.workspace_member_repository import WorkspaceMemberRepository
 
 router = APIRouter()
 
@@ -23,10 +24,9 @@ router = APIRouter()
 def _to_project_response(item) -> ProjectResponse:
     return ProjectResponse(
         id=item.id,
-        owner_user_id=item.owner_user_id,
+        workspace_id=item.workspace_id,
         name=item.name,
         description=item.description,
-        shared_users=item.shared_users,
     )
 
 
@@ -35,23 +35,26 @@ def get_project(
     project_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ProjectResponse:
     use_case = GetProjectUseCase(project_repository)
     project = use_case.execute(project_id)
     if project is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
-    if not project.can_access(authenticated_user.user.id):
-        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Access denied to project")
+    require_workspace_member(project.workspace_id, authenticated_user, workspace_member_repository)
     return _to_project_response(project)
 
 
 @router.get("", response_model=ListProjectsResponse)
 def list_projects(
+    workspace_id: str,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ListProjectsResponse:
+    require_workspace_member(workspace_id, authenticated_user, workspace_member_repository)
     use_case = ListProjectsUseCase(project_repository)
-    projects = use_case.execute(authenticated_user.user.id)
+    projects = use_case.execute(workspace_id)
     return ListProjectsResponse(items=[_to_project_response(item) for item in projects])
 
 
@@ -60,32 +63,15 @@ def create_project(
     request: CreateProjectRequest,
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ProjectResponse:
+    require_workspace_member(request.workspace_id, authenticated_user, workspace_member_repository)
     use_case = CreateProjectUseCase(project_repository)
     project = use_case.execute(
         CreateProjectCommand(
+            workspace_id=request.workspace_id,
             name=request.name,
             description=request.description,
-        ),
-        owner_user_id=authenticated_user.user.id,
+        )
     )
     return _to_project_response(project)
-
-
-@router.delete("/{project_id}")
-def delete_project(
-    project_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    project_repository: Any = Depends(get_project_repository),
-):
-    use_case = DeleteProjectUseCase(project_repository)
-    try:
-        deleted = use_case.execute(project_id, authenticated_user.user.id)
-    except PermissionError:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail="Only the project owner can delete this project",
-        )
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
-    return {"message": "Project deleted successfully"}

apps/api/app/api/routes/recipes.py

@@ -1,212 +0,0 @@
-"""Recipe CRUD + use routes."""
-
-from __future__ import annotations
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_db_session, get_user_repository
-from app.schemas.recipe import (
-    CreateRecipeRequest,
-    ListRecipesResponse,
-    RecipeItemResponse,
-    RecipeResponse,
-    UpdateRecipeRequest,
-    UseRecipeResponse,
-)
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
-from sqlalchemy.orm import Session
-
-from packages.adapters.sqlalchemy_impl.recipe_repository import SQLAlchemyRecipeRepository
-from packages.application.recipe.commands import (
-    CreateRecipeCommand,
-    RecipeItemCommand,
-    UpdateRecipeCommand,
-)
-from packages.application.recipe.use_cases import (
-    CreateRecipeUseCase,
-    DeleteRecipeUseCase,
-    FeatureDisabledError,
-    GetRecipeUseCase,
-    ListRecipesUseCase,
-    NotFoundError,
-    UpdateRecipeUseCase,
-    UseRecipeUseCase,
-)
-from packages.ports.user_repository import UserRepository
-
-router = APIRouter()
-
-
-def _get_recipe_repository(session: Session = Depends(get_db_session)) -> SQLAlchemyRecipeRepository:
-    return SQLAlchemyRecipeRepository(session)
-
-
-def _get_user_plan(user_id: str, user_repository: UserRepository) -> str:
-    user = user_repository.find_by_id(user_id)
-    if user is None:
-        return "free"
-    return getattr(user, "subscription_plan", "free") or "free"
-
-
-def _item_to_response(item) -> RecipeItemResponse:
-    return RecipeItemResponse(
-        id=item.id,
-        recipe_id=item.recipe_id,
-        item_type=item.item_type,
-        item_id=item.item_id,
-        position=item.position,
-        metadata=item.metadata_,
-    )
-
-
-def _to_response(recipe) -> RecipeResponse:
-    return RecipeResponse(
-        id=recipe.id,
-        user_id=recipe.user_id,
-        name=recipe.name,
-        description=recipe.description,
-        template_id=recipe.template_id,
-        generation_params=recipe.generation_params,
-        items=[_item_to_response(i) for i in getattr(recipe, "items", [])],
-        is_active=recipe.is_active,
-        metadata=recipe.metadata_,
-        created_at=recipe.created_at,
-        updated_at=recipe.updated_at,
-    )
-
-
-@router.get("", response_model=ListRecipesResponse)
-def list_recipes(
-    skip: int = Query(0, ge=0),
-    limit: int = Query(50, ge=1, le=200),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    recipe_repository: SQLAlchemyRecipeRepository = Depends(_get_recipe_repository),
-) -> ListRecipesResponse:
-    user_id = authenticated_user.user.id
-    use_case = ListRecipesUseCase(recipe_repository)
-    recipes = use_case.execute(user_id, skip=skip, limit=limit)
-    total = recipe_repository.count_by_user(user_id)
-    return ListRecipesResponse(
-        items=[_to_response(r) for r in recipes],
-        total=total,
-    )
-
-
-@router.get("/{recipe_id}", response_model=RecipeResponse)
-def get_recipe(
-    recipe_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    recipe_repository: SQLAlchemyRecipeRepository = Depends(_get_recipe_repository),
-) -> RecipeResponse:
-    user_id = authenticated_user.user.id
-    use_case = GetRecipeUseCase(recipe_repository)
-    recipe = use_case.execute(recipe_id, user_id)
-    if recipe is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Recipe not found")
-    return _to_response(recipe)
-
-
-@router.post("", response_model=RecipeResponse, status_code=status.HTTP_201_CREATED)
-def create_recipe(
-    request: CreateRecipeRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    recipe_repository: SQLAlchemyRecipeRepository = Depends(_get_recipe_repository),
-) -> RecipeResponse:
-    user_id = authenticated_user.user.id
-    command = CreateRecipeCommand(
-        user_id=user_id,
-        name=request.name,
-        description=request.description,
-        template_id=request.template_id,
-        generation_params=request.generation_params,
-        items=[
-            RecipeItemCommand(
-                item_type=ic.item_type,
-                item_id=ic.item_id,
-                position=ic.position,
-                metadata_=ic.metadata_,
-            )
-            for ic in request.items
-        ],
-        metadata_=request.metadata_,
-    )
-    use_case = CreateRecipeUseCase(recipe_repository)
-    recipe = use_case.execute(command)
-    return _to_response(recipe)
-
-
-@router.patch("/{recipe_id}", response_model=RecipeResponse)
-def update_recipe(
-    recipe_id: str,
-    request: UpdateRecipeRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    recipe_repository: SQLAlchemyRecipeRepository = Depends(_get_recipe_repository),
-) -> RecipeResponse:
-    user_id = authenticated_user.user.id
-    command = UpdateRecipeCommand(
-        recipe_id=recipe_id,
-        user_id=user_id,
-        name=request.name,
-        description=request.description,
-        template_id=request.template_id,
-        generation_params=request.generation_params,
-        items=(
-            [
-                RecipeItemCommand(
-                    item_type=ic.item_type,
-                    item_id=ic.item_id,
-                    position=ic.position,
-                    metadata_=ic.metadata_,
-                )
-                for ic in request.items
-            ]
-            if request.items is not None
-            else None
-        ),
-        metadata_=request.metadata_,
-    )
-    use_case = UpdateRecipeUseCase(recipe_repository)
-    try:
-        recipe = use_case.execute(command)
-    except NotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Recipe not found")
-    return _to_response(recipe)
-
-
-@router.delete("/{recipe_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_recipe(
-    recipe_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    recipe_repository: SQLAlchemyRecipeRepository = Depends(_get_recipe_repository),
-) -> Response:
-    user_id = authenticated_user.user.id
-    use_case = DeleteRecipeUseCase(recipe_repository)
-    deleted = use_case.execute(recipe_id, user_id)
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Recipe not found")
-    return Response(status_code=204)
-
-
-@router.post("/{recipe_id}/use", response_model=UseRecipeResponse)
-def use_recipe(
-    recipe_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    recipe_repository: SQLAlchemyRecipeRepository = Depends(_get_recipe_repository),
-    user_repository: UserRepository = Depends(get_user_repository),
-) -> UseRecipeResponse:
-    user_id = authenticated_user.user.id
-    plan_name = _get_user_plan(user_id, user_repository)
-    use_case = UseRecipeUseCase(recipe_repository)
-    try:
-        result = use_case.execute(recipe_id, user_id, user_plan=plan_name)
-    except FeatureDisabledError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_403_FORBIDDEN,
-            detail=str(exc),
-        )
-    except NotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Recipe not found")
-
-    return UseRecipeResponse(
-        recipe=_to_response(result.recipe),
-        warnings=[{"item_type": w.item_type, "item_id": w.item_id, "position": w.position} for w in result.warnings],
-    )

apps/api/app/api/routes/subscription.py

@@ -1,274 +0,0 @@
-"""Subscription management API routes."""
-
-from __future__ import annotations
-
-from dataclasses import replace
-from datetime import datetime, timezone
-from typing import List
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_user_repository
-from app.schemas.subscription import (
-    BillingRecord,
-    ChangePlanRequest,
-    ChangePlanResponse,
-    SimpleResponse,
-    SubscriptionInfo,
-    ToggleAutoRenewRequest,
-)
-from fastapi import APIRouter, Depends, HTTPException, status
-
-from packages.ports.user_repository import UserRepository
-
-router = APIRouter()
-
-
-# ============ 配额定义（硬编码，后续可迁移到配置中心） ============
-
-PLAN_QUOTAS = {
-    "free": {"max_projects": 3, "max_storage_gb": 10},
-    "standard": {"max_projects": 10, "max_storage_gb": 50},
-    "pro": {"max_projects": -1, "max_storage_gb": 100},
-    "enterprise": {"max_projects": -1, "max_storage_gb": 1000},
-}
-
-
-# ============ Helper Functions ============
-
-
-def _get_plan_name(plan_id: str) -> str:
-    """获取套餐显示名称"""
-    plan_names = {
-        "free": "体验版",
-        "standard": "标准版",
-        "pro": "专业版",
-        "enterprise": "企业版",
-    }
-    return plan_names.get(plan_id, "未知套餐")
-
-
-def _get_plan_price(plan_id: str, billing_cycle: str) -> float:
-    """获取套餐价格"""
-    prices = {
-        ("free", "monthly"): 0,
-        ("free", "yearly"): 0,
-        ("standard", "monthly"): 99,
-        ("standard", "yearly"): 999,
-        ("pro", "monthly"): 299,
-        ("pro", "yearly"): 2999,
-        ("enterprise", "monthly"): 999,
-        ("enterprise", "yearly"): 9999,
-    }
-    return prices.get((plan_id, billing_cycle), 0)
-
-
-def _build_subscription_info(user: AuthenticatedUser) -> SubscriptionInfo:
-    """构建订阅信息响应"""
-    now = datetime.now(timezone.utc)
-    if user.user.subscription_expires_at:
-        period_end = user.user.subscription_expires_at.isoformat()
-        period_start = now.isoformat()
-    else:
-        period_start = now.isoformat()
-        period_end = now.isoformat()
-
-    return SubscriptionInfo(
-        id=f"sub-{user.user.id[:8]}",
-        plan_id=user.user.subscription_plan or "free",
-        plan_name=_get_plan_name(user.user.subscription_plan or "free"),
-        status=user.user.subscription_status or "active",
-        billing_cycle="monthly",
-        current_period_start=period_start,
-        current_period_end=period_end,
-        amount=_get_plan_price(user.user.subscription_plan or "free", "monthly"),
-        auto_renew=True,
-        created_at=user.user.created_at.isoformat() if user.user.created_at else now.isoformat(),
-    )
-
-
-# ============ API Endpoints ============
-
-
-@router.get("/current", response_model=SubscriptionInfo)
-async def get_current_subscription(
-    current_user: AuthenticatedUser = Depends(get_current_user),
-):
-    """获取当前订阅信息"""
-    return _build_subscription_info(current_user)
-
-
-@router.get("/billing-records", response_model=List[BillingRecord])
-async def get_billing_records(
-    current_user: AuthenticatedUser = Depends(get_current_user),
-):
-    """获取账单记录列表"""
-    from packages.adapters.sqlalchemy_impl.billing_repository import SQLAlchemyBillingRepository
-    from packages.adapters.sqlalchemy_impl.session import SessionLocal
-
-    if SessionLocal is None:
-        return []
-
-    session = SessionLocal()
-    try:
-        repo = SQLAlchemyBillingRepository(session)
-        records = repo.find_by_user(current_user.user.id)
-        return [
-            BillingRecord(
-                id=r.id,
-                plan_name=r.plan_name,
-                amount=r.amount,
-                billing_cycle=r.billing_cycle,
-                status=r.status,
-                payment_method=r.payment_method or "未支付",
-                created_at=r.created_at.isoformat() if r.created_at else "",
-                invoice_url=r.invoice_url,
-            )
-            for r in records
-        ]
-    finally:
-        session.close()
-
-
-@router.post("/change-plan", response_model=ChangePlanResponse)
-async def change_plan(
-    request: ChangePlanRequest,
-    current_user: AuthenticatedUser = Depends(get_current_user),
-    user_repository: UserRepository = Depends(get_user_repository),
-):
-    """变更订阅套餐（升级/降级）"""
-    # TODO: 接入支付验证（支付宝/微信支付）
-    valid_plans = {"free", "standard", "pro", "enterprise"}
-    if request.target_plan_id not in valid_plans:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"无效的套餐ID。支持的套餐: {', '.join(valid_plans)}",
-        )
-
-    valid_cycles = {"monthly", "yearly"}
-    if request.billing_cycle not in valid_cycles:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="无效的计费周期。支持: monthly, yearly",
-        )
-
-    user = current_user.user
-    current_plan = user.subscription_plan or "free"
-    target_plan = request.target_plan_id
-
-    if current_plan == target_plan:
-        return ChangePlanResponse(
-            success=False,
-            message=f"您已经是 {_get_plan_name(target_plan)}",
-        )
-
-    # 通过 dataclasses.replace 创建新实例（不直接修改 dataclass）
-    quotas = PLAN_QUOTAS.get(target_plan, PLAN_QUOTAS["free"])
-    updated_user = replace(
-        user,
-        subscription_plan=target_plan,
-        subscription_status="active",
-        max_projects=quotas["max_projects"],
-        max_storage_gb=quotas["max_storage_gb"],
-    )
-    user_repository.save(updated_user)
-
-    # 用更新后的用户构造响应
-    refreshed_auth_user = AuthenticatedUser(user=updated_user)
-
-    return ChangePlanResponse(
-        success=True,
-        message=f"套餐已成功变更为 {_get_plan_name(target_plan)}",
-        new_subscription=_build_subscription_info(refreshed_auth_user),
-    )
-
-
-@router.post("/cancel", response_model=SimpleResponse)
-async def cancel_subscription(
-    current_user: AuthenticatedUser = Depends(get_current_user),
-    user_repository: UserRepository = Depends(get_user_repository),
-):
-    """取消订阅"""
-    user = current_user.user
-    if user.subscription_plan == "free":
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="体验版无需取消",
-        )
-
-    updated_user = replace(user, subscription_status="cancelled")
-    user_repository.save(updated_user)
-
-    return SimpleResponse(
-        success=True,
-        message="订阅已取消，当前周期结束后停止服务",
-    )
-
-
-@router.post("/payment-callback")
-async def payment_callback(
-    user_id: str,
-    plan: str,
-    billing_cycle: str,
-    amount: float,
-    payment_method: str = "alipay",
-    payment_id: str = "",
-):
-    """支付回调 - 在事务中更新账单和订阅状态
-
-    注意：生产环境需要验证支付签名
-    """
-    import uuid
-    from datetime import timedelta
-
-    from packages.adapters.sqlalchemy_impl.billing_repository import SQLAlchemyBillingRepository
-    from packages.adapters.sqlalchemy_impl.session import SessionLocal
-
-    if SessionLocal is None:
-        raise HTTPException(status_code=500, detail="Database not available")
-
-    session = SessionLocal()
-    try:
-        repo = SQLAlchemyBillingRepository(session)
-
-        # 创建账单记录
-        record_id = uuid.uuid4().hex
-        record = repo.create(
-            {
-                "id": record_id,
-                "user_id": user_id,
-                "plan_name": _get_plan_name(plan),
-                "amount": amount,
-                "billing_cycle": billing_cycle,
-                "status": "pending",
-            }
-        )
-
-        # 在事务中标记支付成功并更新订阅
-        repo.mark_paid(record_id, payment_method, payment_id)
-
-        # 计算到期时间
-        days = 365 if billing_cycle == "yearly" else 30
-        expires_at = datetime.now(timezone.utc) + timedelta(days=days)
-        repo.update_subscription_on_payment(user_id, plan, expires_at)
-
-        return {"success": True, "message": "支付成功", "record_id": record_id}
-    except Exception as e:
-        session.rollback()
-        raise HTTPException(status_code=500, detail=f"支付处理失败: {str(e)}")
-    finally:
-        session.close()
-
-
-@router.post("/toggle-auto-renew", response_model=SimpleResponse)
-async def toggle_auto_renew(
-    request: ToggleAutoRenewRequest,
-    current_user: AuthenticatedUser = Depends(get_current_user),
-):
-    """切换自动续费"""
-    # TODO: 实际需要在数据库中存储 auto_renew 字段
-    status_text = "已开启自动续费" if request.enabled else "已关闭自动续费"
-
-    return SimpleResponse(
-        success=True,
-        message=status_text,
-    )

apps/api/app/api/routes/tags.py

@@ -1,67 +0,0 @@
-"""标签 CRUD 路由。"""
-
-import logging
-from typing import Any
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_tag_repository
-from app.schemas.tag import (
-    CreateTagRequest,
-    ListTagsResponse,
-    TagResponse,
-)
-from fastapi import APIRouter, Depends, HTTPException
-
-from packages.domain import Tag
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter()
-
-
-@router.get("", response_model=ListTagsResponse)
-def list_tags(
-    skip: int = 0,
-    limit: int = 100,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    tag_repository: Any = Depends(get_tag_repository),
-) -> ListTagsResponse:
-    """列出当前用户的标签。"""
-    user_id = authenticated_user.user.id
-    items = tag_repository.list_by_user(user_id, skip=skip, limit=limit)
-    total = tag_repository.count_by_user(user_id)
-    return ListTagsResponse(
-        items=[TagResponse(id=t.id, name=t.name, created_at=t.created_at) for t in items],
-        total=total,
-    )
-
-
-@router.post("", response_model=TagResponse, status_code=201)
-def create_tag(
-    request: CreateTagRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    tag_repository: Any = Depends(get_tag_repository),
-) -> TagResponse:
-    """创建标签（同用户同名去重，返回 409）。"""
-    user_id = authenticated_user.user.id
-    existing = tag_repository.find_by_name(user_id, request.name)
-    if existing:
-        raise HTTPException(status_code=409, detail="标签名称已存在")
-    tag = Tag.create(user_id=user_id, name=request.name)
-    created = tag_repository.create(tag)
-    return TagResponse(id=created.id, name=created.name, created_at=created.created_at)
-
-
-@router.delete("/{tag_id}", status_code=204)
-def delete_tag(
-    tag_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    tag_repository: Any = Depends(get_tag_repository),
-) -> None:
-    """删除标签（同时清理素材关联）。"""
-    tag = tag_repository.get(tag_id)
-    if tag is None:
-        raise HTTPException(status_code=404, detail="标签不存在")
-    if tag.user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="无权删除该标签")
-    tag_repository.delete(tag_id)

apps/api/app/api/routes/task_center.py

@@ -1,26 +1,15 @@
-import logging
 from typing import Any
 
+from app.api.routes.permissions import require_workspace_member
 from app.auth import AuthenticatedUser, get_current_user
 from app.core.celery_app import celery_app
-from app.core.task_enqueue import (
-    GLOBAL_PENDING_LIMIT,
-    USER_PENDING_LIMIT,
-    GlobalQueueFull,
-    UserPendingLimitExceeded,
-    safe_enqueue_generation_task,
-)
 from app.dependencies import (
     get_generation_task_repository,
     get_ingest_job_repository,
     get_project_repository,
+    get_workspace_member_repository,
 )
-from app.schemas.task_center import (
-    ListProjectTasksResponse,
-    ListTasksResponse,
-    ProjectTaskResponse,
-    UserTaskResponse,
-)
+from app.schemas.task_center import ListProjectTasksResponse, ProjectTaskResponse
 from fastapi import APIRouter, Depends, HTTPException
 
 from packages.application import (
@@ -29,11 +18,11 @@ from packages.application import (
     SubmitIngestJobCommand,
     SubmitIngestJobUseCase,
 )
-
-logger = logging.getLogger(__name__)
+from packages.ports.workspace_member_repository import WorkspaceMemberRepository
 
 router = APIRouter()
 
+
 def _humanize_task_error(error_message: str) -> str:
     raw = (error_message or "").strip()
     if not raw:
@@ -48,165 +37,28 @@ def _humanize_task_error(error_message: str) -> str:
     return f"任务失败：{raw}"
 
 
-def _status_value(status) -> str:
-    """安全获取状态值（兼容 StrEnum 和 plain string）。"""
-    return status.value if hasattr(status, "value") else str(status)
-
-
 def _generation_step(task) -> str:
-    s = _status_value(task.status)
-    if s == "pending":
+    if task.status.value == "pending":
         return "等待 Worker 执行"
-    if s == "running":
+    if task.status.value == "running":
         return "正在生成成片"
-    if s == "completed":
+    if task.status.value == "completed":
         return "生成完成"
-    if s == "failed":
+    if task.status.value == "failed":
         return "生成失败"
-    return s
+    return task.status.value
 
 
 def _ingest_step(job) -> str:
-    s = _status_value(job.status)
-    if s == "pending":
+    if job.status.value == "pending":
         return "等待导入"
-    if s == "processing":
+    if job.status.value == "processing":
         return "正在分析素材"
-    if s == "completed":
+    if job.status.value == "completed":
         return "导入完成"
-    if s == "failed":
+    if job.status.value == "failed":
         return "导入失败"
-    return s
-
-
-def _generation_task_to_project_response(task) -> ProjectTaskResponse:
-    return ProjectTaskResponse(
-        id=f"generation:{task.id}",
-        task_type="generation",
-        project_id=task.project_id,
-        status=_status_value(task.status),
-        progress=task.progress,
-        current_step=_generation_step(task),
-        error_message=task.error_message,
-        user_message=_humanize_task_error(task.error_message),
-        retryable=_status_value(task.status) == "failed",
-        source_id=task.id,
-        template_id=task.template_id,
-        created_at=task.created_at,
-        updated_at=task.completed_at or task.started_at or task.created_at,
-    )
-
-
-# ── 用户级端点（放在项目级端点之前，避免路由冲突） ──
-
-
-@router.get("/tasks", response_model=ListTasksResponse)
-def list_user_tasks(
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    ingest_job_repository: Any = Depends(get_ingest_job_repository),
-    generation_task_repository: Any = Depends(get_generation_task_repository),
-) -> ListTasksResponse:
-    """用户级任务列表（跨 project），合并 ingest + generation 任务。"""
-    user_id = authenticated_user.user.id
-    items: list[UserTaskResponse] = []
-
-    for task in generation_task_repository.list_by_user(user_id):
-        items.append(
-            UserTaskResponse(
-                id=f"generation:{task.id}",
-                task_type="generation",
-                project_id=task.project_id,
-                template_id=task.template_id,
-                status=_status_value(task.status),
-                progress=task.progress,
-                current_step=_generation_step(task),
-                error_message=task.error_message,
-                user_message=_humanize_task_error(task.error_message),
-                retryable=_status_value(task.status) == "failed",
-                source_id=task.id,
-                created_at=task.created_at,
-                updated_at=task.completed_at or task.started_at or task.created_at,
-            )
-        )
-
-    items.sort(key=lambda item: item.updated_at or item.created_at or "", reverse=True)
-    return ListTasksResponse(items=items)
-
-
-@router.post("/tasks/{task_id}/retry", response_model=UserTaskResponse)
-def retry_task_by_id(
-    task_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    generation_task_repository: Any = Depends(get_generation_task_repository),
-) -> UserTaskResponse:
-    """简化重试：通过 task_id 直接重试失败的生成任务。"""
-    task = generation_task_repository.get(task_id)
-    if task is None:
-        raise HTTPException(status_code=404, detail="Generation task not found")
-    if task.created_by_user_id and task.created_by_user_id != authenticated_user.user.id:
-        raise HTTPException(status_code=403, detail="Access denied to this task")
-    if _status_value(task.status) != "failed":
-        raise HTTPException(status_code=409, detail="Only failed tasks can be retried")
-
-    user_id = authenticated_user.user.id
-    # 预检查
-    user_pending = generation_task_repository.count_pending_by_user(user_id)
-    global_pending = generation_task_repository.count_pending_total()
-    if user_pending >= USER_PENDING_LIMIT:
-        raise HTTPException(
-            status_code=429,
-            detail=f"您的待处理任务过多（当前 {user_pending}/{USER_PENDING_LIMIT}），请等待完成后再提交",
-        )
-    if global_pending >= GLOBAL_PENDING_LIMIT:
-        raise HTTPException(
-            status_code=503,
-            detail="系统繁忙，请稍后再试",
-        )
-
-    use_case = CreateGenerationTaskUseCase(generation_task_repository)
-    retried = use_case.execute(
-        CreateGenerationTaskCommand(
-            project_id=task.project_id,
-            asset_library_id=task.asset_library_id,
-            strategy_id=task.strategy_id,
-            voice_library_id=task.voice_library_id,
-            template_id=task.template_id,
-            asset_ids=task.asset_ids,
-            title_ids=task.title_ids,
-            voice_ids=task.voice_ids,
-            created_by_user_id=user_id,
-        )
-    )
-    try:
-        if not safe_enqueue_generation_task(
-            retried, generation_task_repository, user_id=user_id, log_prefix="[任务中心]"
-        ):
-            logger.warning("[任务中心] 用户级重试入队失败: task_id=%s", retried.id)
-    except UserPendingLimitExceeded:
-        raise HTTPException(
-            status_code=429,
-            detail="您的待处理任务过多，请等待完成后再提交",
-        ) from None
-    except GlobalQueueFull:
-        raise HTTPException(
-            status_code=503,
-            detail="系统繁忙，请稍后再试",
-        ) from None
-    return UserTaskResponse(
-        id=f"generation:{retried.id}",
-        task_type="generation",
-        project_id=retried.project_id,
-        template_id=retried.template_id,
-        status=_status_value(retried.status),
-        progress=retried.progress,
-        current_step=_generation_step(retried),
-        source_id=retried.id,
-        created_at=retried.created_at,
-        updated_at=retried.created_at,
-    )
-
-
-# ── 项目级端点 ──
+    return job.status.value
 
 
 @router.get("/projects/{project_id}/tasks", response_model=ListProjectTasksResponse)
@@ -216,10 +68,12 @@ def list_project_tasks(
     project_repository: Any = Depends(get_project_repository),
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     generation_task_repository: Any = Depends(get_generation_task_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ListProjectTasksResponse:
     project = project_repository.find_by_id(project_id)
     if project is None:
         raise HTTPException(status_code=404, detail="Project not found")
+    require_workspace_member(project.workspace_id, authenticated_user, workspace_member_repository)
 
     items: list[ProjectTaskResponse] = []
     for job in ingest_job_repository.list_by_project(project_id):
@@ -227,20 +81,37 @@ def list_project_tasks(
             ProjectTaskResponse(
                 id=f"ingest:{job.id}",
                 task_type="ingest",
+                workspace_id=job.workspace_id,
                 project_id=job.project_id,
-                status=_status_value(job.status),
-                progress=100.0 if _status_value(job.status) == "completed" else 0.0,
+                status=job.status.value,
+                progress=100.0 if job.status.value == "completed" else 0.0,
                 current_step=_ingest_step(job),
                 error_message=job.error_message,
                 user_message=_humanize_task_error(job.error_message),
-                retryable=_status_value(job.status) == "failed",
+                retryable=job.status.value == "failed",
                 source_id=job.id,
                 created_at=job.created_at,
                 updated_at=job.updated_at,
             )
         )
     for task in generation_task_repository.list_by_project(project_id):
-        items.append(_generation_task_to_project_response(task))
+        items.append(
+            ProjectTaskResponse(
+                id=f"generation:{task.id}",
+                task_type="generation",
+                workspace_id=task.workspace_id,
+                project_id=task.project_id,
+                status=task.status.value,
+                progress=task.progress,
+                current_step=_generation_step(task),
+                error_message=task.error_message,
+                user_message=_humanize_task_error(task.error_message),
+                retryable=task.status.value == "failed",
+                source_id=task.id,
+                created_at=task.created_at,
+                updated_at=task.completed_at or task.started_at or task.created_at,
+            )
+        )
     items.sort(key=lambda item: item.updated_at or item.created_at or "", reverse=True)
     return ListProjectTasksResponse(items=items)
 
@@ -252,68 +123,51 @@ def retry_project_task(
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     generation_task_repository: Any = Depends(get_generation_task_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
 ) -> ProjectTaskResponse:
     if task_type == "generation":
         task = generation_task_repository.get(source_id)
         if task is None:
             raise HTTPException(status_code=404, detail="Generation task not found")
-        if _status_value(task.status) != "failed":
+        require_workspace_member(task.workspace_id, authenticated_user, workspace_member_repository)
+        if task.status.value != "failed":
             raise HTTPException(status_code=409, detail="Only failed tasks can be retried")
-
-        user_id = authenticated_user.user.id
-        # 预检查
-        user_pending = generation_task_repository.count_pending_by_user(user_id)
-        global_pending = generation_task_repository.count_pending_total()
-        if user_pending >= USER_PENDING_LIMIT:
-            raise HTTPException(
-                status_code=429,
-                detail=f"您的待处理任务过多（当前 {user_pending}/{USER_PENDING_LIMIT}），请等待完成后再提交",
-            )
-        if global_pending >= GLOBAL_PENDING_LIMIT:
-            raise HTTPException(
-                status_code=503,
-                detail="系统繁忙，请稍后再试",
-            )
-
         use_case = CreateGenerationTaskUseCase(generation_task_repository)
         retried = use_case.execute(
             CreateGenerationTaskCommand(
+                workspace_id=task.workspace_id,
                 project_id=task.project_id,
                 asset_library_id=task.asset_library_id,
                 strategy_id=task.strategy_id,
                 voice_library_id=task.voice_library_id,
-                template_id=task.template_id,
-                asset_ids=task.asset_ids,
-                title_ids=task.title_ids,
-                voice_ids=task.voice_ids,
-                created_by_user_id=user_id,
+                edit_plan_id=task.edit_plan_id,
+                created_by_user_id=authenticated_user.user.id,
             )
         )
-        try:
-            if not safe_enqueue_generation_task(
-                retried, generation_task_repository, user_id=user_id, log_prefix="[任务中心]"
-            ):
-                logger.warning("[任务中心] 项目级重试入队失败: task_id=%s", retried.id)
-        except UserPendingLimitExceeded:
-            raise HTTPException(
-                status_code=429,
-                detail="您的待处理任务过多，请等待完成后再提交",
-            ) from None
-        except GlobalQueueFull:
-            raise HTTPException(
-                status_code=503,
-                detail="系统繁忙，请稍后再试",
-            ) from None
-        return _generation_task_to_project_response(retried)
+        celery_app.send_task("worker.generate_video", args=[retried.id])
+        return ProjectTaskResponse(
+            id=f"generation:{retried.id}",
+            task_type="generation",
+            workspace_id=retried.workspace_id,
+            project_id=retried.project_id,
+            status=retried.status.value,
+            progress=retried.progress,
+            current_step=_generation_step(retried),
+            source_id=retried.id,
+            created_at=retried.created_at,
+            updated_at=retried.created_at,
+        )
     if task_type == "ingest":
         job = ingest_job_repository.get(source_id)
         if job is None:
             raise HTTPException(status_code=404, detail="Ingest job not found")
-        if _status_value(job.status) != "failed":
+        require_workspace_member(job.workspace_id, authenticated_user, workspace_member_repository)
+        if job.status.value != "failed":
             raise HTTPException(status_code=409, detail="Only failed tasks can be retried")
         use_case = SubmitIngestJobUseCase(ingest_job_repository)
         retried = use_case.execute(
             SubmitIngestJobCommand(
+                workspace_id=job.workspace_id,
                 project_id=job.project_id,
                 library_id=job.library_id,
                 storage_key=job.storage_key,
@@ -323,8 +177,9 @@ def retry_project_task(
         return ProjectTaskResponse(
             id=f"ingest:{retried.id}",
             task_type="ingest",
+            workspace_id=retried.workspace_id,
             project_id=retried.project_id,
-            status=_status_value(retried.status),
+            status=retried.status.value,
             progress=0,
             current_step=_ingest_step(retried),
             source_id=retried.id,

apps/api/app/api/routes/templates.py

@@ -1,321 +0,0 @@
-"""Template CRUD + generate + category routes."""
-
-from __future__ import annotations
-
-import logging
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_db_session
-from app.schemas.template import (
-    CategoryResponse,
-    CreateCategoryRequest,
-    CreateTemplateRequest,
-    GenerateWarningResponse,
-    ListCategoriesResponse,
-    ListTemplatesResponse,
-    SegmentResponse,
-    TemplateResponse,
-    ToggleFavoriteResponse,
-    UpdateTemplateRequest,
-    ValidateTemplateRequest,
-    ValidateTemplateResponse,
-)
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
-from sqlalchemy.orm import Session
-
-logger = logging.getLogger(__name__)
-
-from packages.adapters.sqlalchemy_impl.template_repository import SQLAlchemyTemplateRepository
-from packages.application.template.commands import (
-    CreateCategoryCommand,
-    CreateTemplateCommand,
-    SegmentCommand,
-    UpdateTemplateCommand,
-    ValidateTemplateCommand,
-)
-from packages.application.template.use_cases import (
-    CreateCategoryUseCase,
-    CreateTemplateUseCase,
-    DeleteCategoryUseCase,
-    DeleteTemplateUseCase,
-    GetTemplateUseCase,
-    ListCategoriesUseCase,
-    ListTemplatesUseCase,
-    NotFoundError,
-    UpdateTemplateUseCase,
-    ValidateTemplateUseCase,
-    ValidationError,
-)
-
-router = APIRouter()
-
-
-def _get_template_repository(session: Session = Depends(get_db_session)) -> SQLAlchemyTemplateRepository:
-    return SQLAlchemyTemplateRepository(session)
-
-
-def _segment_to_response(seg) -> SegmentResponse:
-    return SegmentResponse(
-        id=seg.id,
-        template_id=seg.template_id,
-        segment_order=seg.segment_order,
-        duration_min=seg.duration_min,
-        duration_max=seg.duration_max,
-        material_type=seg.material_type,
-        created_at=seg.created_at,
-        updated_at=seg.updated_at,
-    )
-
-
-def _to_response(template) -> TemplateResponse:
-    return TemplateResponse(
-        id=template.id,
-        user_id=template.user_id,
-        name=template.name,
-        mode=template.mode,
-        category=template.category,
-        tags=template.tags,
-        title_config=template.title_config,
-        subtitle_config=template.subtitle_config,
-        bgm_config=template.bgm_config,
-        estimated_duration=template.estimated_duration,
-        segments=[_segment_to_response(s) for s in getattr(template, "segments", [])],
-        is_active=template.is_active,
-        created_at=template.created_at,
-        updated_at=template.updated_at,
-    )
-
-
-# ── Template CRUD ──
-
-
-@router.get("", response_model=ListTemplatesResponse)
-def list_templates(
-    skip: int = Query(0, ge=0),
-    limit: int = Query(50, ge=1, le=200),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> ListTemplatesResponse:
-    user_id = authenticated_user.user.id
-    try:
-        use_case = ListTemplatesUseCase(template_repository)
-        templates = use_case.execute(user_id, skip=skip, limit=limit)
-        total = template_repository.count_by_user(user_id)
-    except Exception:
-        logger.exception("list_templates 查询失败: user_id=%s", user_id)
-        return ListTemplatesResponse(items=[], total=0)
-    return ListTemplatesResponse(
-        items=[_to_response(t) for t in templates],
-        total=total,
-    )
-
-
-@router.get("/{template_id}", response_model=TemplateResponse)
-def get_template(
-    template_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> TemplateResponse:
-    user_id = authenticated_user.user.id
-    try:
-        use_case = GetTemplateUseCase(template_repository)
-        template = use_case.execute(template_id, user_id)
-    except Exception:
-        logger.exception("get_template 查询失败: template_id=%s", template_id)
-        raise HTTPException(status_code=status.HTTP_500_INTERNAL_SERVER_ERROR, detail="模板查询失败")
-    if template is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Template not found")
-    return _to_response(template)
-
-
-@router.post("", response_model=TemplateResponse, status_code=status.HTTP_201_CREATED)
-def create_template(
-    request: CreateTemplateRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> TemplateResponse:
-    user_id = authenticated_user.user.id
-    command = CreateTemplateCommand(
-        user_id=user_id,
-        name=request.name,
-        mode=request.mode,
-        category=request.category,
-        tags=request.tags,
-        title_config=request.title_config,
-        subtitle_config=request.subtitle_config,
-        bgm_config=request.bgm_config,
-        estimated_duration=request.estimated_duration,
-        segments=[
-            SegmentCommand(
-                segment_order=s.segment_order,
-                duration_min=s.duration_min,
-                duration_max=s.duration_max,
-                material_type=s.material_type,
-            )
-            for s in request.segments
-        ],
-    )
-    use_case = CreateTemplateUseCase(template_repository)
-    try:
-        template = use_case.execute(command)
-    except ValidationError as exc:
-        raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=str(exc))
-    return _to_response(template)
-
-
-@router.patch("/{template_id}", response_model=TemplateResponse)
-def update_template(
-    template_id: str,
-    request: UpdateTemplateRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> TemplateResponse:
-    user_id = authenticated_user.user.id
-    command = UpdateTemplateCommand(
-        template_id=template_id,
-        user_id=user_id,
-        name=request.name,
-        mode=request.mode,
-        category=request.category,
-        tags=request.tags,
-        title_config=request.title_config,
-        subtitle_config=request.subtitle_config,
-        bgm_config=request.bgm_config,
-        estimated_duration=request.estimated_duration,
-        segments=(
-            [
-                SegmentCommand(
-                    segment_order=s.segment_order,
-                    duration_min=s.duration_min,
-                    duration_max=s.duration_max,
-                    material_type=s.material_type,
-                )
-                for s in request.segments
-            ]
-            if request.segments is not None
-            else None
-        ),
-    )
-    use_case = UpdateTemplateUseCase(template_repository)
-    try:
-        template = use_case.execute(command)
-    except NotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Template not found")
-    except ValidationError as exc:
-        raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=str(exc))
-    return _to_response(template)
-
-
-@router.delete("/{template_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_template(
-    template_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> Response:
-    user_id = authenticated_user.user.id
-    use_case = DeleteTemplateUseCase(template_repository)
-    deleted = use_case.execute(template_id, user_id)
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Template not found")
-    return Response(status_code=204)
-
-
-@router.post("/{template_id}/toggle-favorite", response_model=ToggleFavoriteResponse)
-def toggle_favorite(
-    template_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> ToggleFavoriteResponse:
-    """切换模板收藏状态（当前为兼容端点，始终返回 false）"""
-    user_id = authenticated_user.user.id
-    use_case = GetTemplateUseCase(template_repository)
-    try:
-        template = use_case.execute(template_id, user_id)
-    except Exception:
-        logger.exception("toggle_favorite 查询失败: template_id=%s", template_id)
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Template not found")
-    if template is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Template not found")
-    return ToggleFavoriteResponse(id=template_id, is_favorite=False)
-
-
-# ── Validate template ──
-
-
-@router.post("/{template_id}/validate", response_model=ValidateTemplateResponse)
-def validate_template(
-    template_id: str,
-    request: ValidateTemplateRequest = ValidateTemplateRequest(),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> ValidateTemplateResponse:
-    user_id = authenticated_user.user.id
-    command = ValidateTemplateCommand(
-        template_id=template_id,
-        user_id=user_id,
-        voiceover_duration=request.voiceover_duration,
-    )
-    use_case = ValidateTemplateUseCase(template_repository)
-    try:
-        result = use_case.execute(command)
-    except NotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Template not found")
-    except ValidationError as exc:
-        raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail=str(exc))
-
-    return ValidateTemplateResponse(
-        template=_to_response(result.template),
-        warnings=[GenerateWarningResponse(code=w.code, message=w.message, details=w.details) for w in result.warnings],
-    )
-
-
-# ── Category CRUD ──
-
-
-@router.get("/categories/list", response_model=ListCategoriesResponse)
-def list_categories(
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> ListCategoriesResponse:
-    user_id = authenticated_user.user.id
-    try:
-        use_case = ListCategoriesUseCase(template_repository)
-        categories = use_case.execute(user_id)
-    except Exception:
-        logger.exception("list_categories 查询失败: user_id=%s", user_id)
-        return ListCategoriesResponse(items=[])
-    return ListCategoriesResponse(
-        items=[CategoryResponse(id=c.id, user_id=c.user_id, name=c.name, created_at=c.created_at) for c in categories],
-    )
-
-
-@router.post("/categories", response_model=CategoryResponse, status_code=status.HTTP_201_CREATED)
-def create_category(
-    request: CreateCategoryRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> CategoryResponse:
-    user_id = authenticated_user.user.id
-    command = CreateCategoryCommand(user_id=user_id, name=request.name)
-    use_case = CreateCategoryUseCase(template_repository)
-    category = use_case.execute(command)
-    return CategoryResponse(
-        id=category.id,
-        user_id=category.user_id,
-        name=category.name,
-        created_at=category.created_at,
-    )
-
-
-@router.delete("/categories/{category_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_category(
-    category_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    template_repository: SQLAlchemyTemplateRepository = Depends(_get_template_repository),
-) -> Response:
-    user_id = authenticated_user.user.id
-    use_case = DeleteCategoryUseCase(template_repository)
-    deleted = use_case.execute(category_id, user_id)
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Category not found")
-    return Response(status_code=204)

apps/api/app/api/routes/titles.py

@@ -1,157 +0,0 @@
-"""Title library CRUD routes."""
-
-from __future__ import annotations
-
-from typing import Optional
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_db_session, get_user_repository
-from app.schemas.title_library import (
-    CreateTitleLibraryRequest,
-    ListTitleLibraryResponse,
-    TitleLibraryItemResponse,
-    UpdateTitleLibraryRequest,
-)
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
-from sqlalchemy.orm import Session
-
-from packages.adapters.sqlalchemy_impl.title_library_repository import SQLAlchemyTitleLibraryRepository
-from packages.application.title_library.commands import CreateTitleLibraryCommand, UpdateTitleLibraryCommand
-from packages.application.title_library.use_cases import (
-    CreateTitleLibraryUseCase,
-    DeleteTitleLibraryUseCase,
-    GetTitleLibraryUseCase,
-    ListTitleLibraryUseCase,
-    NotFoundError,
-    QuotaExceededError,
-    UpdateTitleLibraryUseCase,
-)
-from packages.ports.user_repository import UserRepository
-
-router = APIRouter()
-
-
-def _get_title_repository(session: Session = Depends(get_db_session)) -> SQLAlchemyTitleLibraryRepository:
-    return SQLAlchemyTitleLibraryRepository(session)
-
-
-def _to_response(item) -> TitleLibraryItemResponse:
-    return TitleLibraryItemResponse(
-        id=item.id,
-        user_id=item.user_id,
-        name=item.name,
-        text=item.text,
-        category=item.category,
-        description=item.description,
-        tags=item.tags,
-        usage_count=item.usage_count,
-        is_active=item.is_active,
-        created_at=item.created_at,
-        updated_at=item.updated_at,
-    )
-
-
-def _get_user_plan(user_id: str, user_repository: UserRepository) -> str:
-    user = user_repository.find_by_id(user_id)
-    if user is None:
-        return "free"
-    return getattr(user, "subscription_plan", "free") or "free"
-
-
-@router.get("", response_model=ListTitleLibraryResponse)
-def list_titles(
-    category: Optional[str] = Query(None),
-    skip: int = Query(0, ge=0),
-    limit: int = Query(50, ge=1, le=200),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    title_repository: SQLAlchemyTitleLibraryRepository = Depends(_get_title_repository),
-) -> ListTitleLibraryResponse:
-    user_id = authenticated_user.user.id
-    use_case = ListTitleLibraryUseCase(title_repository)
-    items = use_case.execute(user_id, category=category, skip=skip, limit=limit)
-    total = title_repository.count_by_user(user_id)
-    return ListTitleLibraryResponse(
-        items=[_to_response(i) for i in items],
-        total=total,
-    )
-
-
-@router.get("/{title_id}", response_model=TitleLibraryItemResponse)
-def get_title(
-    title_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    title_repository: SQLAlchemyTitleLibraryRepository = Depends(_get_title_repository),
-) -> TitleLibraryItemResponse:
-    user_id = authenticated_user.user.id
-    use_case = GetTitleLibraryUseCase(title_repository)
-    item = use_case.execute(title_id, user_id)
-    if item is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Title not found")
-    return _to_response(item)
-
-
-@router.post("", response_model=TitleLibraryItemResponse, status_code=status.HTTP_201_CREATED)
-def create_title(
-    request: CreateTitleLibraryRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    title_repository: SQLAlchemyTitleLibraryRepository = Depends(_get_title_repository),
-    user_repository: UserRepository = Depends(get_user_repository),
-) -> TitleLibraryItemResponse:
-    user_id = authenticated_user.user.id
-    plan_name = _get_user_plan(user_id, user_repository)
-    command = CreateTitleLibraryCommand(
-        user_id=user_id,
-        name=request.name,
-        text=request.text,
-        category=request.category,
-        description=request.description,
-        tags=request.tags,
-    )
-    use_case = CreateTitleLibraryUseCase(title_repository)
-    try:
-        item = use_case.execute(command, plan_name=plan_name)
-    except QuotaExceededError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-            detail=f"标题库配额已满（{exc.used}/{exc.limit}），请升级套餐",
-        )
-    return _to_response(item)
-
-
-@router.put("/{title_id}", response_model=TitleLibraryItemResponse)
-def update_title(
-    title_id: str,
-    request: UpdateTitleLibraryRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    title_repository: SQLAlchemyTitleLibraryRepository = Depends(_get_title_repository),
-) -> TitleLibraryItemResponse:
-    user_id = authenticated_user.user.id
-    command = UpdateTitleLibraryCommand(
-        title_id=title_id,
-        user_id=user_id,
-        name=request.name,
-        text=request.text,
-        category=request.category,
-        description=request.description,
-        tags=request.tags,
-    )
-    use_case = UpdateTitleLibraryUseCase(title_repository)
-    try:
-        item = use_case.execute(command)
-    except NotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Title not found")
-    return _to_response(item)
-
-
-@router.delete("/{title_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_title(
-    title_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    title_repository: SQLAlchemyTitleLibraryRepository = Depends(_get_title_repository),
-) -> Response:
-    user_id = authenticated_user.user.id
-    use_case = DeleteTitleLibraryUseCase(title_repository)
-    deleted = use_case.execute(title_id, user_id)
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Title not found")
-    return Response(status_code=204)

apps/api/app/api/routes/tts.py

@@ -1,381 +0,0 @@
-"""TTS 合成 API 路由。"""
-
-from __future__ import annotations
-
-import logging
-from typing import Optional
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import (
-    get_audio_url_signer,
-    get_cosyvoice_service,
-    get_db_session,
-    get_user_repository,
-    get_voice_clone_profile_repository,
-    get_voice_library_repository,
-)
-from app.schemas.tts import (
-    ListTTSJobResponse,
-    SaveToLibraryRequest,
-    SaveToLibraryResponse,
-    TTSJobResponse,
-    TTSStatusResponse,
-    TTSSynthesizeRequest,
-    TTSSynthesizeResponse,
-)
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, WebSocket, WebSocketDisconnect, status
-from sqlalchemy.orm import Session
-
-from packages.adapters.sqlalchemy_impl.tts_job_repository import (
-    SQLAlchemyTTSJobRepository,
-)
-from packages.adapters.sqlalchemy_impl.voice_library_repository import SQLAlchemyVoiceLibraryRepository
-from packages.application.cosyvoice_service import CosyVoiceService
-from packages.application.tts_job.streaming_service import TTSStreamingService
-from packages.application.tts_job.use_cases import (
-    CreateTTSJobUseCase,
-    DeleteTTSJobUseCase,
-    GetTTSJobStatusUseCase,
-    GetTTSJobUseCase,
-    ListTTSJobsUseCase,
-    TTSJobNotFoundError,
-)
-from packages.application.tts_job.workflow import TTSWorkflowService
-from packages.application.voice_library.commands import CreateVoiceLibraryCommand
-from packages.application.voice_library.use_cases import (
-    CreateVoiceLibraryUseCase,
-    QuotaExceededError,
-)
-from packages.ports.user_repository import UserRepository
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter()
-
-
-def _get_repository(session: Session = Depends(get_db_session)) -> SQLAlchemyTTSJobRepository:
-    return SQLAlchemyTTSJobRepository(session)
-
-
-def _to_response(job, sign_url=None) -> TTSJobResponse:
-    output_url = job.output_audio_url
-    if sign_url and output_url:
-        output_url = sign_url(output_url)
-    return TTSJobResponse(
-        id=job.id,
-        user_id=job.user_id,
-        input_text=job.input_text,
-        voice_id=job.voice_id,
-        voice_model=job.voice_model,
-        project_id=job.project_id,
-        voice_clone_profile_id=job.voice_clone_profile_id,
-        status=job.status,
-        output_audio_url=output_url,
-        output_audio_key=job.output_audio_key,
-        duration=job.duration,
-        file_size=job.file_size,
-        sample_rate=job.sample_rate,
-        format=job.format,
-        error_message=job.error_message,
-        retry_count=job.retry_count,
-        max_retries=job.max_retries,
-        metadata=job.metadata,
-        started_at=job.started_at,
-        completed_at=job.completed_at,
-        created_at=job.created_at,
-        updated_at=job.updated_at,
-    )
-
-
-@router.post("/synthesize", response_model=TTSSynthesizeResponse, status_code=status.HTTP_201_CREATED)
-def synthesize(
-    request: TTSSynthesizeRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyTTSJobRepository = Depends(_get_repository),
-    cosyvoice_service: CosyVoiceService = Depends(get_cosyvoice_service),
-    voice_clone_repo=Depends(get_voice_clone_profile_repository),
-) -> TTSSynthesizeResponse:
-    """发起 TTS 合成任务。
-
-    创建 TTS 任务 → 提交 CosyVoice 合成 → 触发 Celery 异步轮询。
-    与音色克隆接口保持一致：CosyVoice 失败时不抛 500，而是返回 201 + failed 状态任务记录。
-    """
-    user_id = authenticated_user.user.id
-
-    # 校验 voice_clone_profile_id 归属（防止越权使用他人克隆音色）
-    if request.voice_clone_profile_id:
-        profile = voice_clone_repo.get(request.voice_clone_profile_id)
-        if profile is None:
-            raise HTTPException(
-                status_code=status.HTTP_404_NOT_FOUND,
-                detail="Voice clone profile not found",
-            )
-        if profile.user_id != user_id:
-            raise HTTPException(
-                status_code=status.HTTP_403_FORBIDDEN,
-                detail="Access denied to voice clone profile",
-            )
-
-    use_case = CreateTTSJobUseCase(repository)
-    job = use_case.execute(
-        user_id=user_id,
-        input_text=request.text,
-        voice_id=request.voice_id,
-        voice_model=request.voice_model,
-        voice_clone_profile_id=request.voice_clone_profile_id,
-        metadata=request.metadata_,
-    )
-
-    # 提交 CosyVoice 合成任务
-    workflow = TTSWorkflowService(
-        repository=repository,
-        cosyvoice_service=cosyvoice_service,
-    )
-
-    try:
-        job = workflow.start_synthesis(job.id)
-    except Exception as e:
-        # 兜底：workflow 内部已捕获 CosyVoiceError / ValueError，
-        # 但 DB 异常、网络异常等意外错误可能逃逸。
-        # 与音色克隆接口保持一致：标记 failed，返回 201，不抛 500。
-        logger.error(f"TTS 合成异常: job_id={job.id}, error={e}", exc_info=True)
-        try:
-            job = workflow.process_synthesis_failure(job.id, str(e))
-        except Exception as inner_e:
-            logger.error(f"标记 TTS job 失败时出错: job_id={job.id}, error={inner_e}")
-
-    # 若任务处于 processing 状态（异步模式），触发 Celery 后台轮询
-    if job.status.value == "processing":
-        # 分段合成任务 vs 普通单段任务
-        segment_task_ids = (job.metadata or {}).get("segment_task_ids", [])
-        is_segment = len(segment_task_ids) > 0
-
-        try:
-            if is_segment:
-                from worker_app.tasks import process_tts_segment_synthesis
-
-                process_tts_segment_synthesis.delay(job.id)
-            else:
-                from worker_app.tasks import process_tts_synthesis
-
-                process_tts_synthesis.delay(job.id)
-        except Exception as e:
-            # Celery 调度失败，标记 job 为 failed
-            try:
-                workflow.process_synthesis_failure(job.id, f"Celery 任务调度失败: {e}")
-            except Exception as inner_e:
-                logger.error(f"Celery 调度后标记失败时出错: job_id={job.id}, error={inner_e}")
-
-    return TTSSynthesizeResponse(
-        job_id=job.id,
-        status=job.status,
-        message="合成任务已创建",
-    )
-
-
-@router.get("/jobs", response_model=ListTTSJobResponse)
-def list_tts_jobs(
-    page: int = Query(default=1, ge=1, description="页码"),
-    page_size: int = Query(default=20, ge=1, le=100, description="每页数量"),
-    status_filter: Optional[str] = Query(None, alias="status"),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyTTSJobRepository = Depends(_get_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> ListTTSJobResponse:
-    """列出用户的 TTS 合成任务。"""
-    user_id = authenticated_user.user.id
-    use_case = ListTTSJobsUseCase(repository)
-    skip = (page - 1) * page_size
-    items, total = use_case.execute(user_id, status=status_filter, skip=skip, limit=page_size)
-    return ListTTSJobResponse(
-        items=[_to_response(j, sign_url) for j in items],
-        total=total,
-        page=page,
-        page_size=page_size,
-    )
-
-
-@router.get("/jobs/{job_id}", response_model=TTSJobResponse)
-def get_tts_job(
-    job_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyTTSJobRepository = Depends(_get_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> TTSJobResponse:
-    """获取 TTS 任务详情。"""
-    user_id = authenticated_user.user.id
-    use_case = GetTTSJobUseCase(repository)
-    try:
-        job = use_case.execute(job_id, user_id)
-    except TTSJobNotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="TTS job not found")
-    return _to_response(job, sign_url)
-
-
-@router.get("/jobs/{job_id}/status", response_model=TTSStatusResponse)
-def get_tts_job_status(
-    job_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyTTSJobRepository = Depends(_get_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> TTSStatusResponse:
-    """查询 TTS 合成状态（用于前端轮询）。"""
-    user_id = authenticated_user.user.id
-    use_case = GetTTSJobStatusUseCase(repository)
-    try:
-        job = use_case.execute(job_id, user_id)
-    except TTSJobNotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="TTS job not found")
-    output_url = job.output_audio_url
-    if output_url:
-        output_url = sign_url(output_url)
-    return TTSStatusResponse(
-        id=job.id,
-        status=job.status,
-        output_audio_url=output_url,
-        error_message=job.error_message,
-        duration=job.duration,
-        retry_count=job.retry_count,
-        created_at=job.created_at,
-        updated_at=job.updated_at,
-    )
-
-
-@router.delete("/jobs/{job_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_tts_job(
-    job_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyTTSJobRepository = Depends(_get_repository),
-) -> Response:
-    """删除 TTS 合成任务。"""
-    user_id = authenticated_user.user.id
-    use_case = DeleteTTSJobUseCase(repository)
-    deleted = use_case.execute(job_id, user_id)
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="TTS job not found")
-    return Response(status_code=204)
-
-
-@router.post(
-    "/jobs/{job_id}/save-to-library",
-    response_model=SaveToLibraryResponse,
-    status_code=status.HTTP_201_CREATED,
-)
-def save_tts_job_to_library(
-    job_id: str,
-    request: SaveToLibraryRequest = SaveToLibraryRequest(),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    tts_repository: SQLAlchemyTTSJobRepository = Depends(_get_repository),
-    voice_library_repository: SQLAlchemyVoiceLibraryRepository = Depends(get_voice_library_repository),
-    user_repository: UserRepository = Depends(get_user_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> SaveToLibraryResponse:
-    """将已完成的 TTS 合成结果保存到配音库。
-
-    自动携带音色名、时长、语速等元信息。
-    """
-    user_id = authenticated_user.user.id
-
-    # 获取 TTS job
-    get_use_case = GetTTSJobUseCase(tts_repository)
-    try:
-        job = get_use_case.execute(job_id, user_id)
-    except TTSJobNotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="TTS job not found")
-
-    # 校验已完成
-    if not job.is_completed:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="TTS job is not completed yet",
-        )
-
-    # 构建配音素材名称
-    name = request.name or f"TTS-{job.id[:8]}"
-
-    # 构建元信息
-    metadata_ = {
-        "source": "tts_job",
-        "tts_job_id": job.id,
-        "format": job.format,
-        "sample_rate": job.sample_rate,
-    }
-    if job.metadata:
-        # 保留原始 job 的有用元信息
-        for key in ("speed", "language"):
-            if key in job.metadata:
-                metadata_[key] = job.metadata[key]
-
-    # 获取用户套餐（用于配额检查）
-    user = user_repository.find_by_id(user_id)
-    plan_name = getattr(user, "subscription_plan", "free") if user else "free"
-
-    # 构建命令并执行
-    command = CreateVoiceLibraryCommand(
-        user_id=user_id,
-        name=name,
-        text=job.input_text,
-        voice_provider="cosyvoice",
-        voice_id=job.voice_id,
-        voice_name=job.voice_model or "",
-        audio_url=job.output_audio_url,
-        duration=job.duration,
-        file_size=job.file_size,
-        status="completed",
-        project_id=job.project_id or "",
-        tags=[],
-        metadata_=metadata_,
-    )
-
-    use_case = CreateVoiceLibraryUseCase(voice_library_repository)
-    try:
-        item = use_case.execute(command, plan_name=plan_name or "free")
-    except QuotaExceededError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-            detail=f"配音库配额已满（{exc.used}/{exc.limit}），请升级套餐",
-        )
-
-    return SaveToLibraryResponse(
-        id=item.id,
-        name=item.name,
-        audio_url=sign_url(item.audio_url) if item.audio_url else "",
-        duration=item.duration,
-        voice_id=item.voice_id,
-        voice_name=item.voice_name,
-        status=item.status,
-    )
-
-
-@router.websocket("/ws/tts/stream")
-async def tts_websocket_stream(
-    websocket: WebSocket,
-    cosyvoice_service: CosyVoiceService = Depends(get_cosyvoice_service),
-) -> None:
-    """WebSocket 流式 TTS 合成。
-
-    协议：
-    1. 客户端发送 JSON 文本帧: {"text": "...", "voice_id": "...", ...}
-    2. 服务端发送 JSON 状态帧 + 二进制音频帧
-    3. 完成时发送 JSON 结束帧
-    """
-    await websocket.accept()
-    try:
-        message = await websocket.receive_json()
-        params = {
-            "text": message.get("text", ""),
-            "voice_id": message.get("voice_id", ""),
-            "sample_rate": message.get("sample_rate", 0),
-            "format": message.get("format", "mp3"),
-            "speed": message.get("speed", 1.0),
-        }
-        streaming_service = TTSStreamingService(cosyvoice_service)
-        await streaming_service.synthesize_and_stream(websocket, params)
-    except WebSocketDisconnect:
-        logger.info("WebSocket 客户端断开连接")
-    except Exception as e:
-        logger.error(f"WebSocket 流式合成异常: {e}", exc_info=True)
-        try:
-            await websocket.send_json({"type": "error", "message": f"服务异常: {e}"})
-        except Exception:
-            pass

apps/api/app/api/routes/upload.py

@@ -1,63 +1,43 @@
-import logging
-from typing import Annotated, Any
+from typing import Any
 from uuid import uuid4
 
 from app.auth import AuthenticatedUser, get_current_user
+from app.api.routes.permissions import require_workspace_member
 from app.config import get_settings
 from app.core.celery_app import celery_app
 from app.core.storage import OSSStorageService, get_storage_service
 from app.dependencies import (
     get_asset_library_repository,
-    get_asset_repository,
     get_ingest_job_repository,
     get_project_repository,
+    get_workspace_member_repository,
 )
 from app.schemas.upload import (
     DirectUploadCompleteRequest,
     DirectUploadCompleteResponse,
     DirectUploadPrepareRequest,
     DirectUploadPrepareResponse,
-    UploadAssetRequest,
     UploadAssetResponse,
 )
 from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status
 
 from packages.application import GetProjectUseCase, SubmitIngestJobCommand, SubmitIngestJobUseCase
-
-logger = logging.getLogger(__name__)
+from packages.ports.workspace_member_repository import WorkspaceMemberRepository
 
 router = APIRouter()
 
 # 允许上传的文件 MIME 类型
-ALLOWED_MIME_TYPES = frozenset(
-    {
-        # 视频
-        "video/mp4",
-        "video/mpeg",
-        "video/quicktime",
-        "video/x-msvideo",
-        "video/webm",
-        "video/x-matroska",
-        "video/3gpp",
-        # 音频
-        "audio/mpeg",
-        "audio/wav",
-        "audio/ogg",
-        "audio/flac",
-        "audio/aac",
-        "audio/mp3",
-        "audio/x-m4a",
-        "audio/webm",
-        # 图片
-        "image/jpeg",
-        "image/png",
-        "image/gif",
-        "image/webp",
-        "image/bmp",
-        "image/tiff",
-        "image/svg+xml",
-    }
-)
+ALLOWED_MIME_TYPES = frozenset({
+    # 视频
+    "video/mp4", "video/mpeg", "video/quicktime", "video/x-msvideo",
+    "video/webm", "video/x-matroska", "video/3gpp",
+    # 音频
+    "audio/mpeg", "audio/wav", "audio/ogg", "audio/flac", "audio/aac",
+    "audio/mp3", "audio/x-m4a", "audio/webm",
+    # 图片
+    "image/jpeg", "image/png", "image/gif", "image/webp", "image/bmp",
+    "image/svg+xml", "image/tiff",
+})
 
 
 def _validate_mime_type(content_type: str | None) -> str:
@@ -67,48 +47,49 @@ def _validate_mime_type(content_type: str | None) -> str:
             status_code=status.HTTP_400_BAD_REQUEST,
             detail="Content-Type header is required",
         )
-
+    
     # 处理带参数的类型，如 "video/mp4; charset=utf-8"
     base_type = content_type.split(";")[0].strip().lower()
-
+    
     if base_type not in ALLOWED_MIME_TYPES:
         raise HTTPException(
             status_code=status.HTTP_415_UNSUPPORTED_MEDIA_TYPE,
             detail=f"File type '{base_type}' is not supported. Allowed types: video, audio, and image files.",
         )
-
+    
     return base_type
 
 
 def _require_project_and_library(
+    workspace_id: str,
     project_id: str,
     library_id: str,
     project_repository: Any,
     asset_library_repository: Any,
 ) -> None:
     project = GetProjectUseCase(project_repository).execute(project_id)
-    if project is None:
+    if project is None or project.workspace_id != workspace_id:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Project not found")
 
-    libraries = asset_library_repository.find_by_project(project_id)
-    if not any(item.id == library_id for item in libraries):
+    libraries = asset_library_repository.list_by_project(project_id)
+    if not any(item.id == library_id and item.workspace_id == workspace_id for item in libraries):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Asset library not found")
 
 
 def _submit_ingest_job(
+    workspace_id: str,
     project_id: str,
     library_id: str,
     storage_key: str,
     ingest_job_repository: Any,
-    file_hash: str = "",
 ) -> Any:
     use_case = SubmitIngestJobUseCase(ingest_job_repository)
     job = use_case.execute(
         SubmitIngestJobCommand(
+            workspace_id=workspace_id,
             project_id=project_id,
             library_id=library_id,
             storage_key=storage_key,
-            file_hash=file_hash,
         )
     )
     celery_app.send_task("worker.ingest_asset", args=[job.id])
@@ -121,6 +102,7 @@ async def prepare_direct_upload(
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> DirectUploadPrepareResponse:
     """创建浏览器直传 OSS 的短期表单签名。"""
@@ -134,8 +116,10 @@ async def prepare_direct_upload(
 
     # P2-5: 服务端验证 MIME 类型
     validated_content_type = _validate_mime_type(request.content_type)
-
+    
+    require_workspace_member(request.workspace_id, authenticated_user, workspace_member_repository)
     _require_project_and_library(
+        request.workspace_id,
         request.project_id,
         request.library_id,
         project_repository,
@@ -153,14 +137,7 @@ async def prepare_direct_upload(
             expires_seconds=settings.OSS_DIRECT_UPLOAD_EXPIRE_SECONDS,
         )
     except RuntimeError as error:
-        logger.error("OSS not configured for direct upload prepare: %s", error)
         raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail=str(error)) from error
-    except Exception as error:
-        logger.exception("Unexpected error in direct upload prepare: %s", error)
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"Failed to prepare upload: {type(error).__name__}",
-        ) from error
 
     return DirectUploadPrepareResponse(
         upload_url=str(payload["url"]),
@@ -179,11 +156,13 @@ async def complete_direct_upload(
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
-    asset_repository: Any = Depends(get_asset_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> DirectUploadCompleteResponse:
     """确认浏览器直传完成并创建导入任务。"""
+    require_workspace_member(request.workspace_id, authenticated_user, workspace_member_repository)
     _require_project_and_library(
+        request.workspace_id,
         request.project_id,
         request.library_id,
         project_repository,
@@ -192,88 +171,35 @@ async def complete_direct_upload(
     normalized_key = storage_service._normalize_storage_key(request.storage_key)
     if not normalized_key.startswith("uploads/"):
         raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid upload key")
-    try:
-        file_exists = storage_service.file_exists(normalized_key)
-    except Exception as error:
-        logger.exception("OSS error checking file existence for key=%s: %s", normalized_key, error)
-        raise HTTPException(
-            status_code=status.HTTP_503_SERVICE_UNAVAILABLE,
-            detail="Storage service unavailable",
-        ) from error
-    if not file_exists:
+    if not storage_service.file_exists(normalized_key):
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Uploaded file not found")
 
-    # ── 素材去重检测：同素材库 + 同 file_hash 视为重复 ──
-    if request.file_hash:
-        existing = asset_repository.find_by_library_and_file_hash(
-            library_id=request.library_id,
-            file_hash=request.file_hash,
-        )
-        if existing is not None:
-            logger.info(
-                "素材去重命中: library=%s hash=%s existing_asset=%s",
-                request.library_id,
-                request.file_hash,
-                existing.id,
-            )
-            return DirectUploadCompleteResponse(
-                storage_key=normalized_key,
-                ingest_job_id="",
-                duplicated=True,
-                asset_id=existing.id,
-            )
-
     job = _submit_ingest_job(
+        workspace_id=request.workspace_id,
         project_id=request.project_id,
         library_id=request.library_id,
         storage_key=normalized_key,
         ingest_job_repository=ingest_job_repository,
-        file_hash=request.file_hash,
     )
     return DirectUploadCompleteResponse(storage_key=normalized_key, ingest_job_id=job.id)
 
 
-@router.post(
-    "",
-    response_model=UploadAssetResponse,
-    summary="Upload Asset",
-    description="上传素材文件（multipart/form-data），支持视频、音频、图片。触发导入流水线自动处理。",
-)
+@router.post("", response_model=UploadAssetResponse)
 async def upload_asset(
-    project_id: str = Form(..., min_length=1, description="项目 ID"),
-    library_id: str = Form(..., min_length=1, description="素材库 ID"),
     file: UploadFile = File(..., description="要上传的文件（视频、音频、图片等）"),
-    file_hash: str = Form(default="", description="文件 MD5 哈希，用于去重检测"),
+    workspace_id: str = Form(..., description="工作空间 ID"),
+    project_id: str = Form(..., description="项目 ID"),
+    library_id: str = Form(..., description="素材库 ID"),
     authenticated_user: AuthenticatedUser = Depends(get_current_user),
     ingest_job_repository: Any = Depends(get_ingest_job_repository),
     project_repository: Any = Depends(get_project_repository),
     asset_library_repository: Any = Depends(get_asset_library_repository),
-    asset_repository: Any = Depends(get_asset_repository),
+    workspace_member_repository: WorkspaceMemberRepository = Depends(get_workspace_member_repository),
     storage_service: OSSStorageService = Depends(get_storage_service),
 ) -> UploadAssetResponse:
     """上传素材文件并触发导入流水线。"""
-    _require_project_and_library(project_id, library_id, project_repository, asset_library_repository)
-
-    # ── 素材去重检测：上传前检查同素材库 + 同 file_hash ──
-    if file_hash:
-        existing = asset_repository.find_by_library_and_file_hash(
-            library_id=library_id,
-            file_hash=file_hash,
-        )
-        if existing is not None:
-            logger.info(
-                "素材去重命中(multipart): library=%s hash=%s existing_asset=%s",
-                library_id,
-                file_hash,
-                existing.id,
-            )
-            return UploadAssetResponse(
-                storage_key=existing.storage_key,
-                ingest_job_id="",
-                url="",
-                duplicated=True,
-                asset_id=existing.id,
-            )
+    require_workspace_member(workspace_id, authenticated_user, workspace_member_repository)
+    _require_project_and_library(workspace_id, project_id, library_id, project_repository, asset_library_repository)
 
     # P2-5: 服务端验证 MIME 类型
     validated_content_type = _validate_mime_type(file.content_type)
@@ -282,28 +208,18 @@ async def upload_asset(
     safe_filename = file.filename.replace("/", "_").replace("\\", "_") if file.filename else "unknown"
     storage_key = f"uploads/{file_id}/{safe_filename}"
 
-    try:
-        file_url = storage_service.upload_file(
-            file.file,
-            storage_key,
-            content_type=validated_content_type,
-        )
-    except RuntimeError as error:
-        logger.error("OSS not configured for upload: %s", error)
-        raise HTTPException(status_code=status.HTTP_503_SERVICE_UNAVAILABLE, detail=str(error)) from error
-    except Exception as error:
-        logger.exception("Unexpected error uploading file to OSS: %s", error)
-        raise HTTPException(
-            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
-            detail=f"Failed to upload file: {type(error).__name__}",
-        ) from error
+    file_url = storage_service.upload_file(
+        file.file,
+        storage_key,
+        content_type=validated_content_type,
+    )
 
     job = _submit_ingest_job(
+        workspace_id=workspace_id,
         project_id=project_id,
         library_id=library_id,
         storage_key=storage_key,
         ingest_job_repository=ingest_job_repository,
-        file_hash=file_hash,
     )
 
     return UploadAssetResponse(

apps/api/app/api/routes/voice_clones.py

@@ -1,228 +0,0 @@
-"""音色克隆 API 路由。"""
-
-from __future__ import annotations
-
-import logging
-from typing import Optional
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_cosyvoice_service, get_voice_clone_profile_repository
-from app.schemas.voice_clone import (
-    CreateVoiceCloneRequest,
-    ListVoiceCloneResponse,
-    VoiceCloneProfileResponse,
-    VoiceCloneStatusResponse,
-)
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
-
-from packages.adapters.sqlalchemy_impl.voice_clone_profile_repository import (
-    SQLAlchemyVoiceCloneProfileRepository,
-)
-from packages.application.cosyvoice_service import CosyVoiceService
-from packages.application.voice_clone.use_cases import (
-    DeleteVoiceCloneUseCase,
-    GetVoiceCloneStatusUseCase,
-    GetVoiceCloneUseCase,
-    ListVoiceClonesUseCase,
-    VoiceCloneNotFoundError,
-    VoiceCloneNotRetryableError,
-)
-from packages.application.voice_clone.workflow import (
-    VoiceCloneWorkflowError,
-    VoiceCloneWorkflowService,
-)
-
-logger = logging.getLogger(__name__)
-
-router = APIRouter()
-
-
-def _to_response(profile) -> VoiceCloneProfileResponse:
-    # source_audio_url 是用户传入的原始 URL（可能是外部地址），不做预签名转换
-    return VoiceCloneProfileResponse(
-        id=profile.id,
-        user_id=profile.user_id,
-        name=profile.name,
-        description=profile.description,
-        source_audio_url=profile.source_audio_url,
-        voice_id=profile.voice_id,
-        voice_model=profile.voice_model,
-        language=profile.language,
-        gender=profile.gender,
-        status=profile.status,
-        error_message=profile.error_message,
-        retry_count=profile.retry_count,
-        max_retries=profile.max_retries,
-        metadata=profile.metadata,
-        created_at=profile.created_at,
-        updated_at=profile.updated_at,
-    )
-
-
-def _get_workflow_service(
-    repository: SQLAlchemyVoiceCloneProfileRepository = Depends(get_voice_clone_profile_repository),
-    cosyvoice_service: CosyVoiceService = Depends(get_cosyvoice_service),
-) -> VoiceCloneWorkflowService:
-    return VoiceCloneWorkflowService(repository=repository, cosyvoice_service=cosyvoice_service)
-
-
-@router.post(
-    "",
-    response_model=VoiceCloneProfileResponse,
-    status_code=status.HTTP_201_CREATED,
-)
-def create_voice_clone(
-    request: CreateVoiceCloneRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    workflow: VoiceCloneWorkflowService = Depends(_get_workflow_service),
-) -> VoiceCloneProfileResponse:
-    """创建音色克隆任务。
-
-    创建 VoiceCloneProfile → 提交 CosyVoice 克隆任务 → 触发 Celery 异步轮询。
-    如果有 source_audio_url，状态会变为 processing；否则保持 pending。
-    """
-    user_id = authenticated_user.user.id
-    profile = workflow.start_clone(
-        user_id=user_id,
-        name=request.name,
-        description=request.description,
-        source_audio_url=request.source_audio_url,
-        voice_model=request.voice_model,
-        language=request.language,
-        gender=request.gender,
-        max_retries=request.max_retries,
-        metadata=request.metadata_,
-    )
-
-    # 如果 profile 处于 processing 且有 task_id，触发 Celery 异步轮询
-    task_id = (profile.metadata or {}).get("cosyvoice_task_id", "")
-    if profile.status == "processing" and task_id:
-        try:
-            from worker_app.tasks import process_voice_clone
-
-            process_voice_clone.delay(profile.id)
-            logger.info(f"Celery task dispatched for voice clone {profile.id}")
-        except Exception as e:
-            logger.error(f"Failed to dispatch Celery task: {e}")
-            # P2-3: Celery 调度失败时标记 profile 为 failed，避免永久卡在 processing
-            try:
-                workflow.process_clone_failure(profile.id, f"Celery 任务调度失败: {e}")
-            except Exception as inner_e:
-                logger.error(f"Failed to mark profile as failed after dispatch error: {inner_e}")
-
-    return _to_response(profile)
-
-
-@router.get("", response_model=ListVoiceCloneResponse)
-def list_voice_clones(
-    status_filter: Optional[str] = Query(None, alias="status"),
-    skip: int = Query(0, ge=0),
-    limit: int = Query(50, ge=1, le=200),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyVoiceCloneProfileRepository = Depends(get_voice_clone_profile_repository),
-) -> ListVoiceCloneResponse:
-    """获取用户的音色克隆列表。"""
-    user_id = authenticated_user.user.id
-    use_case = ListVoiceClonesUseCase(repository)
-    items, total = use_case.execute(user_id, status=status_filter, skip=skip, limit=limit)
-    return ListVoiceCloneResponse(
-        items=[_to_response(p) for p in items],
-        total=total,
-    )
-
-
-@router.get("/{clone_id}", response_model=VoiceCloneProfileResponse)
-def get_voice_clone(
-    clone_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyVoiceCloneProfileRepository = Depends(get_voice_clone_profile_repository),
-) -> VoiceCloneProfileResponse:
-    """获取音色克隆详情。"""
-    user_id = authenticated_user.user.id
-    use_case = GetVoiceCloneUseCase(repository)
-    try:
-        profile = use_case.execute(clone_id, user_id)
-    except VoiceCloneNotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Voice clone not found")
-    return _to_response(profile)
-
-
-@router.get("/{clone_id}/status", response_model=VoiceCloneStatusResponse)
-def get_voice_clone_status(
-    clone_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyVoiceCloneProfileRepository = Depends(get_voice_clone_profile_repository),
-) -> VoiceCloneStatusResponse:
-    """查询音色克隆状态（用于前端轮询）。"""
-    user_id = authenticated_user.user.id
-    use_case = GetVoiceCloneStatusUseCase(repository)
-    try:
-        profile = use_case.execute(clone_id, user_id)
-    except VoiceCloneNotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Voice clone not found")
-    return VoiceCloneStatusResponse(
-        id=profile.id,
-        status=profile.status,
-        error_message=profile.error_message,
-        voice_id=profile.voice_id,
-        retry_count=profile.retry_count,
-    )
-
-
-@router.delete(
-    "/{clone_id}",
-    status_code=status.HTTP_204_NO_CONTENT,
-    response_model=None,
-)
-def delete_voice_clone(
-    clone_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    repository: SQLAlchemyVoiceCloneProfileRepository = Depends(get_voice_clone_profile_repository),
-) -> Response:
-    """删除音色克隆档案。"""
-    user_id = authenticated_user.user.id
-    use_case = DeleteVoiceCloneUseCase(repository)
-    deleted = use_case.execute(clone_id, user_id)
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Voice clone not found")
-    return Response(status_code=204)
-
-
-@router.post("/{clone_id}/retry", response_model=VoiceCloneProfileResponse)
-def retry_voice_clone(
-    clone_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    workflow: VoiceCloneWorkflowService = Depends(_get_workflow_service),
-) -> VoiceCloneProfileResponse:
-    """重试失败的音色克隆。
-
-    仅当状态为 failed 时可重试，重试后重新提交 CosyVoice 克隆任务。
-    """
-    user_id = authenticated_user.user.id
-    try:
-        profile = workflow.retry_clone(clone_id, user_id)
-    except VoiceCloneNotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Voice clone not found")
-    except VoiceCloneNotRetryableError:
-        raise HTTPException(
-            status_code=status.HTTP_400_BAD_REQUEST,
-            detail="Voice clone is not retryable (only failed clones can be retried)",
-        )
-
-    # 如果 profile 处于 processing 且有 task_id，触发 Celery 异步轮询
-    task_id = (profile.metadata or {}).get("cosyvoice_task_id", "")
-    if profile.status == "processing" and task_id:
-        try:
-            from worker_app.tasks import process_voice_clone
-
-            process_voice_clone.delay(profile.id)
-            logger.info(f"Celery task dispatched for voice clone retry {profile.id}")
-        except Exception as e:
-            logger.error(f"Failed to dispatch Celery task: {e}")
-            # P2-3: Celery 调度失败时标记 profile 为 failed，避免永久卡在 processing
-            try:
-                workflow.process_clone_failure(profile.id, f"Celery 任务调度失败: {e}")
-            except Exception as inner_e:
-                logger.error(f"Failed to mark profile as failed after dispatch error: {inner_e}")
-
-    return _to_response(profile)

apps/api/app/api/routes/voices.py

@@ -1,342 +0,0 @@
-"""Voice library CRUD routes — Phase 3 增强版.
-
-支持预置音色和克隆音色的统一列表。
-"""
-
-from __future__ import annotations
-
-from typing import Literal, Optional
-
-from app.auth import AuthenticatedUser, get_current_user
-from app.dependencies import get_audio_url_signer, get_db_session, get_user_repository
-from app.schemas.voice import (
-    PresetVoiceItemResponse,
-    PresetVoiceListResponse,
-    UnifiedVoiceItemResponse,
-    UnifiedVoiceListResponse,
-)
-from app.schemas.voice_library import (
-    CreateVoiceLibraryRequest,
-    ListVoiceLibraryResponse,
-    UpdateVoiceLibraryRequest,
-    VoiceLibraryItemResponse,
-)
-from fastapi import APIRouter, Depends, HTTPException, Query, Response, status
-from sqlalchemy.orm import Session
-
-from packages.adapters.sqlalchemy_impl.voice_clone_profile_repository import SQLAlchemyVoiceCloneProfileRepository
-from packages.adapters.sqlalchemy_impl.voice_library_repository import SQLAlchemyVoiceLibraryRepository
-from packages.application.voice_library.commands import CreateVoiceLibraryCommand, UpdateVoiceLibraryCommand
-from packages.application.voice_library.use_cases import (
-    CreateVoiceLibraryUseCase,
-    DeleteVoiceLibraryUseCase,
-    GetVoiceLibraryUseCase,
-    ListVoiceLibraryUseCase,
-    NotFoundError,
-    QuotaExceededError,
-    UpdateVoiceLibraryUseCase,
-)
-from packages.domain.preset_voices import PRESET_VOICES
-from packages.ports.user_repository import UserRepository
-
-router = APIRouter()
-
-
-def _get_voice_repository(session: Session = Depends(get_db_session)) -> SQLAlchemyVoiceLibraryRepository:
-    return SQLAlchemyVoiceLibraryRepository(session)
-
-
-def _get_clone_profile_repository(session: Session = Depends(get_db_session)) -> SQLAlchemyVoiceCloneProfileRepository:
-    return SQLAlchemyVoiceCloneProfileRepository(session)
-
-
-def _to_response(item, sign_url=None) -> VoiceLibraryItemResponse:
-    audio = item.audio_url
-    if sign_url and audio:
-        audio = sign_url(audio)
-    return VoiceLibraryItemResponse(
-        id=item.id,
-        user_id=item.user_id,
-        name=item.name,
-        text=item.text,
-        voice_provider=item.voice_provider,
-        voice_id=item.voice_id,
-        voice_name=item.voice_name,
-        audio_url=audio,
-        duration=item.duration,
-        file_size=item.file_size,
-        status=item.status,
-        project_id=item.project_id,
-        tags=item.tags,
-        created_at=item.created_at,
-        updated_at=item.updated_at,
-    )
-
-
-def _to_unified_response(item, profile_id_map: dict | None = None, sign_url=None) -> UnifiedVoiceItemResponse:
-    """将数据库音色转换为统一响应格式。
-
-    Args:
-        item: VoiceLibraryItem
-        profile_id_map: voice_id → profile_id 映射，用于填充 voice_clone_profile_id
-        sign_url: 音频URL预签名函数
-    """
-    profile_id = None
-    if profile_id_map and item.voice_id:
-        profile_id = profile_id_map.get(item.voice_id)
-    audio = item.audio_url
-    if sign_url and audio:
-        audio = sign_url(audio)
-    return UnifiedVoiceItemResponse(
-        id=item.id,
-        type="clone",
-        name=item.name,
-        description=item.text,
-        gender="unknown",
-        language="zh-CN",
-        voice_id=item.voice_id,
-        voice_provider=item.voice_provider or "cosyvoice",
-        audio_url=audio,
-        duration=item.duration,
-        file_size=item.file_size,
-        status=item.status,
-        tags=item.tags,
-        user_id=item.user_id,
-        project_id=item.project_id,
-        voice_clone_profile_id=profile_id,
-        created_at=item.created_at,
-        updated_at=item.updated_at,
-    )
-
-
-def _preset_to_unified_response(preset) -> UnifiedVoiceItemResponse:
-    """将预置音色转换为统一响应格式。"""
-    return UnifiedVoiceItemResponse(
-        id=preset.voice_id,
-        type="preset",
-        name=preset.name,
-        description=preset.description,
-        gender=preset.gender,
-        language=preset.language,
-        voice_id=preset.voice_id,
-        voice_provider="cosyvoice",
-        preview_url=preset.preview_url,
-        tags=preset.tags or [],
-    )
-
-
-def _get_user_plan(user_id: str, user_repository: UserRepository) -> str:
-    user = user_repository.find_by_id(user_id)
-    if user is None:
-        return "free"
-    return getattr(user, "subscription_plan", "free") or "free"
-
-
-# ==================== 统一配音列表（预置 + 克隆）====================
-
-
-@router.get("", response_model=UnifiedVoiceListResponse)
-def list_voices_unified(
-    type: Optional[Literal["preset", "clone"]] = Query(
-        None,
-        description="音色类型过滤：preset=仅预置，clone=仅克隆，不传=全部",
-    ),
-    status_filter: Optional[str] = Query(None, alias="status"),
-    skip: int = Query(0, ge=0),
-    limit: int = Query(50, ge=1, le=200),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    voice_repository: SQLAlchemyVoiceLibraryRepository = Depends(_get_voice_repository),
-    clone_profile_repository: SQLAlchemyVoiceCloneProfileRepository = Depends(_get_clone_profile_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> UnifiedVoiceListResponse:
-    """获取配音列表（预置音色 + 用户克隆音色）。
-
-    - 不传 type：返回预置音色 + 用户克隆音色，预置音色在前
-    - type=preset：仅返回预置音色
-    - type=clone：仅返回用户克隆音色
-    """
-    user_id = authenticated_user.user.id
-    items: list[UnifiedVoiceItemResponse] = []
-    preset_count = 0
-    clone_count = 0
-
-    has_preset = type is None or type == "preset"
-    has_clone = type is None or type == "clone"
-
-    # 获取预置音色
-    if has_preset:
-        preset_items = [_preset_to_unified_response(p) for p in PRESET_VOICES]
-        preset_count = len(preset_items)
-
-    # 获取克隆音色
-    if has_clone:
-        use_case = ListVoiceLibraryUseCase(voice_repository)
-        clone_items_raw, clone_count = use_case.execute(user_id, status=status_filter, skip=skip, limit=limit)
-        # 批量查询 voice_id → profile_id 映射，填充 voice_clone_profile_id
-        voice_ids = [i.voice_id for i in clone_items_raw if i.voice_id]
-        profile_id_map = clone_profile_repository.find_profile_ids_by_voice_ids(voice_ids) if voice_ids else {}
-        clone_items = [_to_unified_response(i, profile_id_map, sign_url) for i in clone_items_raw]
-
-    # 组装结果
-    if type == "preset":
-        items = preset_items[skip : skip + limit]
-        total = preset_count
-    elif type == "clone":
-        items = clone_items
-        total = clone_count
-    else:
-        # 全量模式：预置在前，克隆补位
-        all_items = preset_items + clone_items
-        total = preset_count + clone_count
-        items = all_items[skip : skip + limit]
-
-    return UnifiedVoiceListResponse(
-        items=items,
-        total=total,
-        preset_count=preset_count if has_preset else 0,
-        clone_count=clone_count if has_clone else 0,
-    )
-
-
-# ==================== 预置音色专用端点 ====================
-
-
-@router.get("/presets", response_model=PresetVoiceListResponse)
-def list_preset_voices() -> PresetVoiceListResponse:
-    """获取预置音色列表。
-
-    不需要认证，返回所有系统预置的 CosyVoice 音色。
-    """
-    items = [
-        PresetVoiceItemResponse(
-            voice_id=p.voice_id,
-            name=p.name,
-            description=p.description,
-            gender=p.gender,
-            language=p.language,
-            preview_url=p.preview_url,
-            tags=p.tags or [],
-        )
-        for p in PRESET_VOICES
-    ]
-    return PresetVoiceListResponse(items=items, total=len(items))
-
-
-# ==================== 原有 CRUD 端点（保持向后兼容）====================
-
-
-@router.get("/legacy", response_model=ListVoiceLibraryResponse)
-def list_voices_legacy(
-    status_filter: Optional[str] = Query(None, alias="status"),
-    skip: int = Query(0, ge=0),
-    limit: int = Query(50, ge=1, le=200),
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    voice_repository: SQLAlchemyVoiceLibraryRepository = Depends(_get_voice_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> ListVoiceLibraryResponse:
-    """原有配音列表接口（仅返回用户克隆音色）。
-
-    保留用于向后兼容，新客户端请使用 GET /api/v1/voices。
-    """
-    user_id = authenticated_user.user.id
-    use_case = ListVoiceLibraryUseCase(voice_repository)
-    items, total = use_case.execute(user_id, status=status_filter, skip=skip, limit=limit)
-    return ListVoiceLibraryResponse(
-        items=[_to_response(i, sign_url) for i in items],
-        total=total,
-    )
-
-
-@router.get("/{voice_id}", response_model=VoiceLibraryItemResponse)
-def get_voice(
-    voice_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    voice_repository: SQLAlchemyVoiceLibraryRepository = Depends(_get_voice_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> VoiceLibraryItemResponse:
-    user_id = authenticated_user.user.id
-    use_case = GetVoiceLibraryUseCase(voice_repository)
-    item = use_case.execute(voice_id, user_id)
-    if item is None:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Voice not found")
-    return _to_response(item, sign_url)
-
-
-@router.post("", response_model=VoiceLibraryItemResponse, status_code=status.HTTP_201_CREATED)
-def create_voice(
-    request: CreateVoiceLibraryRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    voice_repository: SQLAlchemyVoiceLibraryRepository = Depends(_get_voice_repository),
-    user_repository: UserRepository = Depends(get_user_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> VoiceLibraryItemResponse:
-    user_id = authenticated_user.user.id
-    plan_name = _get_user_plan(user_id, user_repository)
-    command = CreateVoiceLibraryCommand(
-        user_id=user_id,
-        name=request.name,
-        text=request.text,
-        voice_provider=request.voice_provider,
-        voice_id=request.voice_id,
-        voice_name=request.voice_name,
-        audio_url=request.audio_url,
-        duration=request.duration,
-        file_size=request.file_size,
-        status=request.status,
-        project_id=request.project_id,
-        tags=request.tags,
-    )
-    use_case = CreateVoiceLibraryUseCase(voice_repository)
-    try:
-        item = use_case.execute(command, plan_name=plan_name)
-    except QuotaExceededError as exc:
-        raise HTTPException(
-            status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-            detail=f"配音库配额已满（{exc.used}/{exc.limit}），请升级套餐",
-        )
-    return _to_response(item, sign_url)
-
-
-@router.put("/{voice_id}", response_model=VoiceLibraryItemResponse)
-def update_voice(
-    voice_id: str,
-    request: UpdateVoiceLibraryRequest,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    voice_repository: SQLAlchemyVoiceLibraryRepository = Depends(_get_voice_repository),
-    sign_url=Depends(get_audio_url_signer),
-) -> VoiceLibraryItemResponse:
-    user_id = authenticated_user.user.id
-    command = UpdateVoiceLibraryCommand(
-        id=voice_id,
-        user_id=user_id,
-        name=request.name,
-        text=request.text,
-        voice_provider=request.voice_provider,
-        voice_id=request.voice_id,
-        voice_name=request.voice_name,
-        audio_url=request.audio_url,
-        duration=request.duration,
-        file_size=request.file_size,
-        status=request.status,
-        tags=request.tags,
-    )
-    use_case = UpdateVoiceLibraryUseCase(voice_repository)
-    try:
-        item = use_case.execute(command)
-    except NotFoundError:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Voice not found")
-    return _to_response(item, sign_url)
-
-
-@router.delete("/{voice_id}", status_code=status.HTTP_204_NO_CONTENT, response_model=None)
-def delete_voice(
-    voice_id: str,
-    authenticated_user: AuthenticatedUser = Depends(get_current_user),
-    voice_repository: SQLAlchemyVoiceLibraryRepository = Depends(_get_voice_repository),
-) -> Response:
-    user_id = authenticated_user.user.id
-    use_case = DeleteVoiceLibraryUseCase(voice_repository)
-    deleted = use_case.execute(voice_id, user_id)
-    if not deleted:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Voice not found")
-    return Response(status_code=204)

apps/api/app/auth.py

@@ -1,6 +1,5 @@
 from __future__ import annotations
 
-import hashlib
 from dataclasses import dataclass
 
 import jwt
@@ -24,35 +23,6 @@ class AuthenticatedUser:
     token_type: str | None = None
 
 
-def _get_redis_client():
-    """获取 Redis 客户端用于 JWT 黑名单"""
-    import redis as redis_lib
-
-    return redis_lib.from_url(settings.REDIS_URL, decode_responses=True)
-
-
-def _token_fingerprint(token: str) -> str:
-    """计算 token 的哈希指纹"""
-    return hashlib.sha256(token.encode()).hexdigest()
-
-
-def blacklist_token(token: str, exp: int) -> None:
-    """将 token 加入黑名单，TTL 为 token 剩余有效期"""
-    import time
-
-    redis_client = _get_redis_client()
-    key = f"jwt:blacklist:{_token_fingerprint(token)}"
-    ttl = max(exp - int(time.time()), 1)
-    redis_client.setex(key, ttl, "revoked")
-
-
-def is_token_blacklisted(token: str) -> bool:
-    """检查 token 是否在黑名单中"""
-    redis_client = _get_redis_client()
-    key = f"jwt:blacklist:{_token_fingerprint(token)}"
-    return redis_client.exists(key) > 0
-
-
 async def get_current_user(
     credentials: HTTPAuthorizationCredentials | None = Depends(bearer_scheme),
     user_repository: UserRepository = Depends(get_user_repository),
@@ -86,11 +56,6 @@ def _decode_user_token(token: str) -> dict:
 
     if payload.get("type") not in {"user_auth", "access"}:
         raise _unauthorized("Invalid token type")
-
-    # 检查 token 是否在黑名单中
-    if is_token_blacklisted(token):
-        raise _unauthorized("Token has been revoked")
-
     return payload
 
 

apps/api/app/config.py

@@ -1,7 +1,7 @@
 import os
 from typing import Optional
 
-from pydantic import AliasChoices, Field, field_validator
+from pydantic import field_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 
@@ -11,19 +11,16 @@ class Settings(BaseSettings):
     ENVIRONMENT: str = "development"
     DEBUG: bool = True
 
-    # 应用基础 URL，用于生成认证邮件中的链接
-    # 开发环境默认 http://localhost:3000
-    # 生产环境应通过环境变量 APP_BASE_URL 设置
-    APP_BASE_URL: str = "http://localhost:3000"
-
     # Container bind address; external expose is controlled by Docker/Nginx.
     API_HOST: str = "0.0.0.0"  # nosec: B104
     API_PORT: int = 8000
     API_PREFIX: str = "/api/v1"
 
-    DATABASE_URL: str = "postgresql+psycopg://postgres:postgres@localhost:5432/xiaoxia_saas"
+    DATABASE_URL: str = (
+        "postgresql+psycopg://postgres:postgres@localhost:5432/xiaoxia_saas"
+    )
     DATABASE_POOL_SIZE: int = 20
-    DATABASE_MAX_OVERFLOW: int = 10  # 调整为合理值：pool_size(20) + max_overflow(10) = 最大30连接
+    DATABASE_MAX_OVERFLOW: int = 40
     DATABASE_POOL_TIMEOUT: int = 30
     DATABASE_POOL_RECYLE: int = 3600
     USE_IN_MEMORY_DB: bool = False
@@ -31,22 +28,18 @@ class Settings(BaseSettings):
 
     REDIS_URL: str = "redis://localhost:6379/0"
     REDIS_MAX_CONNECTION: int = 50
-    ENABLE_REDIS_SESSIONS: bool = False
+    ENABLE_REDIS_SESSION: bool = False
 
     # JWT secret key - MUST be set via environment variable, no default allowed
     JWT_SECRET_KEY: Optional[str] = None
-    # 旧的 JWT secret key（用于密钥轮换期间验证旧 token）
-    # 在密钥轮换时，先设置新密钥，旧密钥保留在此处直到所有旧 token 过期
-    JWT_SECRET_KEY_OLD: Optional[str] = None
-    # 密钥轮换天数（到达此天数后建议更换密钥）
-    SECRET_ROTATION_DAYS: int = 90
 
     @field_validator("JWT_SECRET_KEY", mode="before")
     @classmethod
     def validate_jwt_secret_key(cls, v):
         if v is None or v == "":
             raise ValueError(
-                "JWT_SECRET_KEY must be set via environment variable. " "Do not use default value in production!"
+                "JWT_SECRET_KEY must be set via environment variable. "
+                "Do not use default value in production!"
             )
         # Block known insecure default values
         insecure_defaults = [
@@ -58,7 +51,8 @@ class Settings(BaseSettings):
         ]
         if v.lower() in [d.lower() for d in insecure_defaults]:
             raise ValueError(
-                f"JWT_SECRET_KEY '{v}' is insecure. " "Please set a strong random secret via environment variable."
+                f"JWT_SECRET_KEY '{v}' is insecure. "
+                "Please set a strong random secret via environment variable."
             )
         return v
 
@@ -68,7 +62,7 @@ class Settings(BaseSettings):
     SMTP_USER: str = ""
     SMTP_PASSWORD: str = ""
     SMTP_FROM_EMAIL: str = ""
-    SMTP_FROM_NAME: str = "小虾 SaaS"
+    SMTP_FRON_NAME: str = "小虾 SaaS"
     SMTP_USE_TLS: bool = True
 
     CELERY_BROKER_URL: str = "redis://localhost:6379/0"
@@ -79,38 +73,13 @@ class Settings(BaseSettings):
     OSS_ACCESS_KEY_ID: str = ""
     OSS_ACCESS_KEY_SECRET: str = ""
     OSS_BUCKET_NAME: str = "xiaoxia-autocut"
-
-    @field_validator("OSS_ACCESS_KEY_ID", mode="before")
-    @classmethod
-    def validate_oss_access_key_id(cls, v):
-        if (v is None or v == "") and os.getenv("APP_ENV", "development") != "development":
-            raise ValueError(
-                "OSS_ACCESS_KEY_ID must be set via environment variable in non-development environments. "
-                "Check the server .env file (e.g. /var/lib/xiaoxia-saas-staging/.env)."
-            )
-        return v or ""
-
-    @field_validator("OSS_ACCESS_KEY_SECRET", mode="before")
-    @classmethod
-    def validate_oss_access_key_secret(cls, v):
-        if (v is None or v == "") and os.getenv("APP_ENV", "development") != "development":
-            raise ValueError(
-                "OSS_ACCESS_KEY_SECRET must be set via environment variable in non-development environments. "
-                "Check the server .env file (e.g. /var/lib/xiaoxia-saas-staging/.env)."
-            )
-        return v or ""
-
-    OSS_DIRECT_UPLOAD_MAX_MB: int = Field(
-        default=2000,
-        validation_alias=AliasChoices("OSS_DIRECT_UPLOAD_MAX_MB", "MAX_UPLOAD_SIZE_MB"),
-    )
-    OSS_DIRECT_UPLOAD_EXPIRE_SECONDS: int = 900
+    OSS_DIRECT_UPLOAD_MAX_MB: int = 800
+    OSS_DIRECT_UPLOAD_EXPRESS_SECRET: int = 900
 
     LOG_LEVEL: str = "INFO"
-    CORS_ORIGINS_RAW: str = "http://localhost:3000,http://localhost:5173,http://localhost:8000"
-
-    # 渲染引擎选择：legacy=旧VideoComposeService，unified=新UnifiedRenderService
-    RENDER_ENGINE: str = "legacy"
+    CORS_ORIGINS_RAW: str = (
+        "http://localhost:3000,http://localhost:5173,http://localhost:8000"
+    )
 
     model_config = SettingsConfigDict(
         env_file=".env",
@@ -121,7 +90,11 @@ class Settings(BaseSettings):
 
     @property
     def CORS_ORIGINS(self) -> list[str]:
-        return [origin.strip() for origin in self.CORS_ORIGINS_RAW.split(",") if origin.strip()]
+        return [
+            origin.strip()
+            for origin in self.CORS_ORIGINS_RAW.split(",")
+            if origin.strip()
+        ]
 
     @property
     def database_url(self) -> str:

apps/api/app/core/database.py

@@ -0,0 +1,49 @@
+"""Database session management and engine configuration.
+
+统一使用 app.config 中的数据库配置，移除重复的 DatabaseSettings。
+"""
+from sqlalchemy import create_engine
+from sqlalchemy.orm import sessionmaker, Session
+from contextlib import contextmanager
+from typing import Generator
+
+from app.config import settings
+
+
+engine = create_engine(
+    settings.database_url,
+    pool_size=settings.DATABASE_POOL_SIZE,
+    max_overflow=settings.DATABASE_MAX_OVERFLOW,
+    pool_timeout=settings.DATABASE_POOL_TIMEOUT,
+    pool_recycle=settings.DATABASE_POOL_RECYCLE,
+)
+
+SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
+
+
+def get_db() -> Generator[Session, None, None]:
+    """Dependency for getting database sessions."""
+    db = SessionLocal()
+    try:
+        yield db
+    finally:
+        db.close()
+
+
+@contextmanager
+def get_db_context() -> Generator[Session, None, None]:
+    """Context manager for database sessions.
+    
+    Usage:
+        with get_db_context() as db:
+            db.query(Model).all()
+    """
+    db = SessionLocal()
+    try:
+        yield db
+        db.commit()
+    except Exception:
+        db.rollback()
+        raise
+    finally:
+        db.close()

apps/api/app/core/storage.py

@@ -28,67 +28,21 @@ class OSSStorageService:
         self.local_url_prefix = os.getenv("GENERATED_FILES_URL_PREFIX", "/generated-files")
         self.bucket = None
 
-        has_key_id = bool(settings.OSS_ACCESS_KEY_ID)
-        has_key_secret = bool(settings.OSS_ACCESS_KEY_SECRET)
-
-        if has_key_id and has_key_secret:
+        if settings.OSS_ACCESS_KEY_ID and settings.OSS_ACCESS_KEY_SECRET:
             if oss2 is not None:
-                try:
-                    # P0-2 修复：oss2.Bucket 的 endpoint 必须带 https:// 前缀，
-                    # 否则 sign_url 默认生成 HTTP URL。
-                    bucket_endpoint = settings.OSS_ENDPOINT
-                    if not bucket_endpoint.startswith(("http://", "https://")):
-                        bucket_endpoint = f"https://{bucket_endpoint}"
-                    auth = oss2.Auth(
-                        settings.OSS_ACCESS_KEY_ID,
-                        settings.OSS_ACCESS_KEY_SECRET,
-                    )
-                    self.bucket = oss2.Bucket(
-                        auth,
-                        bucket_endpoint,
-                        settings.OSS_BUCKET_NAME,
-                    )
-                    logger.info(
-                        "OSS initialized: endpoint=%s bucket=%s",
-                        settings.OSS_ENDPOINT,
-                        settings.OSS_BUCKET_NAME,
-                    )
-                except Exception as error:
-                    logger.error("Failed to initialize OSS bucket client: %s", error)
-            else:
-                logger.error("oss2 SDK is not installed — OSS operations will fail")
-        else:
-            missing = []
-            if not has_key_id:
-                missing.append("OSS_ACCESS_KEY_ID")
-            if not has_key_secret:
-                missing.append("OSS_ACCESS_KEY_SECRET")
-            logger.error("OSS credentials not configured — missing: %s", ", ".join(missing))
-
+                auth = oss2.Auth(
+                    settings.OSS_ACCESS_KEY_ID,
+                    settings.OSS_ACCESS_KEY_SECRET,
+                )
+                self.bucket = oss2.Bucket(
+                    auth,
+                    settings.OSS_ENDPOINT,
+                    settings.OSS_BUCKET_NAME,
+                )
         self.access_key_id = settings.OSS_ACCESS_KEY_ID
         self.access_key_secret = settings.OSS_ACCESS_KEY_SECRET
         self.endpoint = settings.OSS_ENDPOINT
 
-    def diagnose(self) -> None:
-        """启动诊断：输出 OSS 配置状态，帮助排查预签名 URL 问题。"""
-        key_id_display = (
-            f"{self.access_key_id[:4]}...{self.access_key_id[-4:]}" if len(self.access_key_id) > 8 else "(empty)"
-        )
-        logger.info(
-            "[OSS诊断] endpoint=%s bucket_name=%s access_key_id=%s",
-            self.endpoint,
-            self.bucket_name,
-            key_id_display,
-        )
-        if self.bucket is None:
-            logger.error(
-                "[OSS诊断] ❌ bucket=None — 预签名URL不可用！"
-                "原因: OSS_ACCESS_KEY_ID/OSS_ACCESS_KEY_SECRET 未配置或 oss2 未安装。"
-                "请检查服务器 .env 文件（如 /var/lib/xiaoxia-saas-staging/.env）"
-            )
-        else:
-            logger.info("[OSS诊断] ✅ bucket 已配置，预签名URL可用")
-
     def _is_local_generated_url(self, storage_key_or_url: str) -> bool:
         parsed = urlparse(storage_key_or_url)
         path = parsed.path if parsed.scheme else storage_key_or_url
@@ -191,26 +145,12 @@ class OSSStorageService:
         if self.bucket is None:
             if self._is_local_generated_url(storage_key_or_url):
                 return storage_key_or_url
-            logger.warning(
-                "get_download_url: OSS bucket not configured, returning raw URL. " "storage_key_or_url=%s",
-                storage_key_or_url[:200],
-            )
             return self.get_url(self._normalize_storage_key(storage_key_or_url))
 
         storage_key = self._normalize_storage_key(storage_key_or_url)
         try:
-            signed = self.bucket.sign_url("GET", storage_key, expires_seconds)
-            logger.info(
-                "get_download_url: signed URL generated. storage_key=%s url_prefix=%s",
-                storage_key[:80],
-                signed[:60],
-            )
-            return signed
+            return self.bucket.sign_url("GET", storage_key, expires_seconds)
         except Exception:
-            logger.exception(
-                "get_download_url: sign_url failed, falling back to raw URL. " "storage_key=%s",
-                storage_key[:200],
-            )
             return self.get_url(storage_key)
 
     def _normalize_storage_key(self, storage_key_or_url: str) -> str:
@@ -271,6 +211,10 @@ class OSSStorageService:
         return self.bucket.object_exists(storage_key)
 
 
+# 向后兼容的服务类名
+MinIOService = OSSStorageService
+
+
 _storage_service = None
 
 
@@ -279,5 +223,10 @@ def get_storage_service() -> OSSStorageService:
     global _storage_service
     if _storage_service is None:
         _storage_service = OSSStorageService()
-        _storage_service.diagnose()
     return _storage_service
+
+
+# 向后兼容的别名
+def get_minio_service() -> OSSStorageService:
+    """向后兼容：返回 OSS 服务（已替换 MinIO）"""
+    return get_storage_service()