36b69d300d
Codex 审计发现 124 个问题，修复 59 个 P0-P2 级别问题： P0 (CRITICAL): - TOCTOU 竞态: TransientRateStore/SseConcurrencyGuard 改用 wp_cache_add 原子锁 - REST 路由: __return_true → check_bearer_present 轻量鉴权 - Schema 验证: messages/tools/tool_choice 添加完整 validate_callback - SQL 列名不匹配: upsert 查询对齐 SchemaManager 定义 - SQL 表名插值: 统一使用 %i 占位符 P1 (HIGH): - IP hash 加盐 (HMAC) + IP 解析统一 (context 共享) - Header 注入防护 (X-Request-Id/响应头 \r\n 过滤) - 数值参数范围校验 (temperature/top_p/penalties/max_tokens) - insert_key 错误处理 + revoke_key 审计日志 - Pipeline finally 保护 + RateLimiter rollback 双 store - wp_unslash 补全 + strtotime 返回值检查 - RedisRateStore $rid 冒号验证 - UpstreamStreamClient catch \Throwable P2 (MEDIUM): - AuditLogRepository DRY (提取 build_where_clause) - Token 估算 CJK 优化 (mb_strlen) - ResponseTransformMiddleware null 检查 - 嵌入响应 usage 数据修复 - SchemaManager autoload 优化 25 files changed, ~530 insertions, ~190 deletions Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
84 lines
2.3 KiB
PHP
84 lines
2.3 KiB
PHP
<?php
|
|
/**
|
|
* Gateway Pipeline
|
|
*
|
|
* Orchestrates the 8-stage middleware pipeline for API requests.
|
|
*
|
|
* @package WPMind\Modules\ApiGateway\Pipeline
|
|
* @since 1.0.0
|
|
*/
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace WPMind\Modules\ApiGateway\Pipeline;
|
|
|
|
/**
|
|
* Class GatewayPipeline
|
|
*
|
|
* Runs a request through: auth -> budget -> quota ->
|
|
* request_transform -> route -> response_transform -> error -> log.
|
|
*
|
|
* The error and log stages always execute (finally semantics).
|
|
*/
|
|
final class GatewayPipeline {
|
|
|
|
public function __construct(
|
|
private GatewayStageInterface $auth,
|
|
private GatewayStageInterface $budget,
|
|
private GatewayStageInterface $quota,
|
|
private GatewayStageInterface $request_transform,
|
|
private GatewayStageInterface $route,
|
|
private GatewayStageInterface $response_transform,
|
|
private GatewayStageInterface $error,
|
|
private GatewayStageInterface $log
|
|
) {}
|
|
|
|
/**
|
|
* Handle an API gateway request through the full pipeline.
|
|
*
|
|
* @param string $operation Operation type (e.g. 'chat.completions').
|
|
* @param \WP_REST_Request $request WordPress REST request.
|
|
* @return \WP_REST_Response
|
|
*/
|
|
public function handle( string $operation, \WP_REST_Request $request ): \WP_REST_Response {
|
|
$context = GatewayRequestContext::from_rest_request( $operation, $request );
|
|
|
|
try {
|
|
$this->auth->process( $context );
|
|
|
|
if ( ! $context->has_error() ) {
|
|
$this->budget->process( $context );
|
|
}
|
|
if ( ! $context->has_error() ) {
|
|
$this->quota->process( $context );
|
|
}
|
|
if ( ! $context->has_error() ) {
|
|
$this->request_transform->process( $context );
|
|
}
|
|
if ( ! $context->has_error() ) {
|
|
$this->route->process( $context );
|
|
}
|
|
if ( ! $context->has_error() ) {
|
|
$this->response_transform->process( $context );
|
|
}
|
|
} catch ( \Throwable $e ) {
|
|
$context->set_exception( $e );
|
|
}
|
|
|
|
// Error and log stages always execute (finally semantics).
|
|
try {
|
|
$this->error->process( $context );
|
|
} catch ( \Throwable $e ) {
|
|
// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
|
|
error_log( '[WPMind GW] Error stage failed: ' . $e->getMessage() );
|
|
}
|
|
try {
|
|
$this->log->process( $context );
|
|
} catch ( \Throwable $e ) {
|
|
// phpcs:ignore WordPress.PHP.DevelopmentFunctions.error_log_error_log
|
|
error_log( '[WPMind GW] Log stage failed: ' . $e->getMessage() );
|
|
}
|
|
|
|
return $context->to_rest_response();
|
|
}
|
|
}
|
