xiaoxia/xiaoxia-saas
1
0
Fork 0
Code Issues 24 Pull Requests 3 Actions Packages Projects Releases 7 Wiki Activity

fix(lipsync): 私有桶 OSS 媒体 URL 重签修复对口型 403 (#1839) #1837

Merged
auto-approve-bot merged 1 commits from fix/lipsync-oss-presign-403-1839 into develop 2026-09-10 13:05:28 +08:00
Conversation 2 Commits 1 Files Changed 2
+147 -1
xiaoxia commented 2026-09-10 12:59:40 +08:00
Owner
Copy Link
Copy Source

根因（实证非推测）

bucket xiaoxia-autocut 是私有桶：匿名 GET 返回 403 AccessDenied: You have no right to access this object because of bucket acl。

对口型 process failed code=29000 ... storageGW error: 403 Forbidden 的链路根因：

  • TTS 直生音频、输出成片走 storage.upload_file()，返回不带签名的裸 public_url；私有桶下 MediaKit GPU worker（terminator→storageGW）拉取即 403。
  • 前端传入的数字人视频 video_url 多为素材接口 get_download_url() 生成的 1 小时短预签名，MediaKit 排队后拉取也可能过期 403。

修复（仅对口型相关，不动其他功能/UI）

  • 新增 LipsyncService._sign_media_url()：自家 OSS 桶 host 的 URL（裸 URL / 将过期短预签名）统一重签为 7 天长有效期；外部临时 URL（CosyVoice/MediaKit）原样透传；签名异常降级原 URL 不阻断。
  • create_job 提交 MediaKit 前对 video_url/audio_url 统一重签。
  • _persist_output_video 返回成片前同样重签，私有桶播放成片不再 403。

测试

  • 新增 6 个单测（重签/已过期重签/外部透传/空值/异常降级/端到端提交），lipsync 相关 46 测试全过。
  • 无 DB 结构变更，不需迁移。

合并后自动触发 CI + staging 部署。

## 根因（实证非推测） bucket `xiaoxia-autocut` 是**私有桶**：匿名 GET 返回 `403 AccessDenied: You have no right to access this object because of bucket acl`。 对口型 `process failed code=29000 ... storageGW error: 403 Forbidden` 的链路根因： - TTS 直生音频、输出成片走 `storage.upload_file()`，返回**不带签名的裸 public_url**；私有桶下 MediaKit GPU worker（terminator→storageGW）拉取即 403。 - 前端传入的数字人视频 `video_url` 多为素材接口 `get_download_url()` 生成的 **1 小时短预签名**，MediaKit 排队后拉取也可能过期 403。 ## 修复（仅对口型相关，不动其他功能/UI） - 新增 `LipsyncService._sign_media_url()`：自家 OSS 桶 host 的 URL（裸 URL / 将过期短预签名）统一重签为 **7 天长有效期**；外部临时 URL（CosyVoice/MediaKit）原样透传；签名异常降级原 URL 不阻断。 - `create_job` 提交 MediaKit 前对 `video_url`/`audio_url` 统一重签。 - `_persist_output_video` 返回成片前同样重签，私有桶播放成片不再 403。 ## 测试 - 新增 6 个单测（重签/已过期重签/外部透传/空值/异常降级/端到端提交），lipsync 相关 46 测试全过。 - 无 DB 结构变更，不需迁移。 合并后自动触发 CI + staging 部署。
xiaoxia added 1 commit 2026-09-10 12:59:40 +08:00
fix(lipsync): 私有桶 OSS 媒体 URL 提交 MediaKit 前统一重签 7 天，修复对口型 403 (#1839)
CI/CD Pipeline / Check push changed paths (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Check if frontend-only change (pull_request) Successful in 2s
Details
CI/CD Pipeline / Build Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Dedup Check - skip PR tests when covered by push pipeline (pull_request) Successful in 2s
Details
CI/CD Pipeline / Frontend Unit Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Frontend Lint (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Retag skipped Staging Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Staging (Watchtower auto-deploy) (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging E2E Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / Staging API Integration Tests (pull_request) Has been skipped
Details
CI/CD Pipeline / ACR Image Cleanup (pull_request) Has been skipped
Details
CI/CD Pipeline / PR Build API Image (pull_request) Successful in 25s
Details
CI/CD Pipeline / PR Build Worker Image (pull_request) Successful in 25s
Details
CI/CD Pipeline / Unit Tests (pull_request) Successful in 1m12s
Details
CI/CD Pipeline / Validate - Python (mypy + alembic) (pull_request) Successful in 1m32s
Details
CI/CD Pipeline / Integration Tests (pull_request) Successful in 1m32s
Details
Preview Deploy / Deploy Preview Environment (pull_request) Successful in 1m42s
Details
CI/CD Pipeline / Validate - Style (pull_request) Successful in 1m44s
Details
PR Automation / Auto Approve on CI Green (pull_request) Successful in 2m43s
Details
CI/CD Pipeline / Validate - Security (pull_request) Successful in 4m58s
Details
CI/CD Pipeline / Build Production API Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Web Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Build Production Worker Image (pull_request) Has been skipped
Details
CI/CD Pipeline / Canary Release to Production (pull_request) Has been skipped
Details
CI/CD Pipeline / Deploy Production (pull_request) Has been skipped
Details
CI/CD Pipeline / CI Gate (pull_request) Successful in 1s
Details
CI/CD Pipeline / Production Browser E2E (pull_request) Has been skipped
Details
PR Automation / Auto Merge on CI Green + Approved (pull_request) Successful in 2m57s
Details
ACR Cleanup / ACR Image Cleanup (pull_request_target) Successful in 9s
Details
Preview Cleanup / Cleanup Preview Environment (pull_request) Successful in 21s
Details
AI Code Review / AI Code Review (pull_request) Successful in 6m18s
Details
09fcc39e4f 
根因：bucket xiaoxia-autocut 为私有桶（匿名 GET 返回 403 AccessDenied）。
TTS 直生音频/输出成片经 storage.upload_file 返回不带签名的裸 public_url，
MediaKit GPU worker(terminator→storageGW) 拉取时 403 Forbidden；
前端传入的 1h 短预签名 video_url 排队后也可能过期。

修复（仅改对口型相关）：
- 新增 LipsyncService._sign_media_url()：自家 OSS 桶 host 的 URL（裸的/
  将过期的短预签名）统一重签为 7 天长有效期；外部临时 URL（CosyVoice/
  MediaKit）原样透传；异常降级原 URL 不阻断。
- create_job 提交 MediaKit 前对 video_url/audio_url 统一重签。
- _persist_output_video 返回成片前同样重签，私有桶播放不再 403。
- 6 个新单测覆盖重签/透传/降级/端到端；lipsync 相关 46 测试全过。
gitea-actions bot commented 2026-09-10 13:01:24 +08:00
Copy Link
Copy Source

🚀 预览环境已部署

项目 详情
PR号 #1837
预览链接 https://pr-1837.preview.xiaoxiajianji.com
API环境 staging

💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。

🔄 每次提交新代码后预览环境会自动更新。

🗑️ PR 关闭或合并后，预览环境会自动清理。

🚀 **预览环境已部署** | 项目 | 详情 | |------|------| | PR号 | #1837 | | 预览链接 | [https://pr-1837.preview.xiaoxiajianji.com](https://pr-1837.preview.xiaoxiajianji.com) | | API环境 | staging | > 💡 预览环境使用 staging API 数据，请勿在预览环境中操作重要数据。 > > 🔄 每次提交新代码后预览环境会自动更新。 > > 🗑️ PR 关闭或合并后，预览环境会自动清理。
auto-approve-bot merged commit 6c77b066de into develop 2026-09-10 13:05:28 +08:00
auto-approve-bot deleted branch fix/lipsync-oss-presign-403-1839 2026-09-10 13:05:29 +08:00
gitea-actions bot commented 2026-09-10 13:05:49 +08:00
Copy Link
Copy Source

🗑️ 预览环境已清理

PR #1837 已关闭或合并，对应的预览环境已被清理。

如有需要，可以重新打开 PR 来重新生成预览环境。

🗑️ **预览环境已清理** PR #1837 已关闭或合并，对应的预览环境已被清理。 > 如有需要，可以重新打开 PR 来重新生成预览环境。
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
P0
阻塞性，必须立即处理
 P1
高优先级
 P2
中优先级
 P3
低优先级/后考虑
 architecture
架构设计
 backend
后端相关
 blocked
阻塞中
 bug
Bug修复
 ci-bug
CI本身的bug
 ci-optimization
CI优化类任务
 ci-pipeline
CI流水线/workflow相关
 cleanup
代码清理
 devops
运维/部署/CI
 documentation
文档相关
 feature
新功能
 frontend
前端相关
 question
需要讨论确认
 ready
PR CI通过，可合并
 refactor
代码重构
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
auto-approve-bot frontend-dev xiaoxia
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: xiaoxia/xiaoxia-saas#1837
Delete Branch "fix/lipsync-oss-presign-403-1839"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?