1、图片生成同步接口超时风险

2、图片返回的 URL 是本地路径
3、视频生成中媒体文件重复下载
4、幂等性检查无数据库唯一约束
5、幂等键冲突返回 409 改为返回已有任务信息
6、虚拟素材库配额校验 TOCTOU
7、项目级联删除与独立素材删除任务并发冲突

video-gen-api/app/services/api_v3/generation_service.py

@@ -1,6 +1,7 @@
 import asyncio
 import json
 import logging
+import os
 import time
 from datetime import datetime, timezone
 from sqlalchemy.ext.asyncio import AsyncSession
@@ -16,6 +17,26 @@ from app.services.api_v3.logging_service import log_model_request
 logger = logging.getLogger("videogen")
 
 
+def _make_image_url(local_path: str) -> str:
+    """将本地图片路径转为完整可访问 URL。"""
+    if not local_path:
+        return local_path
+    # 如果已经是完整 URL，直接返回
+    if local_path.startswith(("http://", "https://")):
+        return local_path
+    from app.config import settings
+    from app.services.resource_signed_url_service import build_resource_signed_url
+    # 生成签名 URL
+    signed = build_resource_signed_url(local_path)
+    if signed and not signed.startswith(("http://", "https://")):
+        base = settings.BASE_URL.rstrip("/")
+        if signed.startswith("/"):
+            signed = f"{base}{signed}"
+        else:
+            signed = f"{base}/{signed}"
+    return signed or local_path
+
+
 async def submit_video_generation(
     db: AsyncSession,
     key: ApiKey,
@@ -379,10 +400,12 @@ async def generate_image_sync(
         logger.error("Failed to record usage on image submit: %s", log_exc)
 
     try:
+        # 设置总体超时（120秒，防止同步请求长时间挂起）
+        _IMAGE_GEN_TIMEOUT = 120
+
         # 3. 调用 Volcano Ark SDK（同步函数，在线程中执行）
         from app.services.image_gen import submit_image_task, download_image
         from app.config import settings
-        import os
 
         # 构建 media_references，下载图片到本地
         from app.services.api_v3.file_service import process_media_url
@@ -402,14 +425,17 @@ async def generate_image_sync(
         task.image_size = req.size or "2K"
         await db.flush()
 
-        # 在线程中执行同步 SDK 调用
-        result = await asyncio.to_thread(
-            submit_image_task,
-            db,
-            engine,
-            task,
-            True,  # include_media_references
-            req.generation_count or 1,
+        # 在线程中执行同步 SDK 调用（带超时保护）
+        result = await asyncio.wait_for(
+            asyncio.to_thread(
+                submit_image_task,
+                db,
+                engine,
+                task,
+                True,  # include_media_references
+                req.generation_count or 1,
+            ),
+            timeout=_IMAGE_GEN_TIMEOUT,
         )
 
         # 4. 下载图片
@@ -425,12 +451,19 @@ async def generate_image_sync(
                 os.makedirs(dest_dir, exist_ok=True)
                 dest_path = os.path.join(dest_dir, f"{task.id}_{item.get('generation_index', 1)}.png")
                 try:
-                    await download_image(url, dest_path)
+                    await asyncio.wait_for(
+                        download_image(url, dest_path),
+                        timeout=30,
+                    )
+                except asyncio.TimeoutError:
+                    logger.warning("Image download timeout: %s", url[:80])
                 except Exception as dl_err:
                     logger.warning("Image download failed: %s", dl_err)
 
+                # 将本地路径转为完整 URL
+                image_url = _make_image_url(dest_path)
                 downloaded_items.append(ApiImageGenerateDataItem(
-                    url=dest_path,  # 使用本地路径
+                    url=image_url,
                     size=item.get("size"),
                     output_format=item.get("output_format"),
                 ))
@@ -459,6 +492,21 @@ async def generate_image_sync(
             model=result.get("model", req.model),
         )
 
+    except asyncio.TimeoutError:
+        from fastapi import HTTPException, status
+        logger.exception("API image generation timed out (task_id=%s)", task.id)
+        # 超时：退回预扣配额
+        if estimated_price > 0:
+            key.quota_used = round(max(0, (key.quota_used or 0.0) - estimated_price), 2)
+        task.status = "failed"
+        task.error_message = "图片生成超时（超过120秒）"
+        task.credits_cost = 0
+        await db.commit()
+        raise HTTPException(
+            status_code=504,
+            detail="图片生成超时，请稍后重试",
+        )
+
     except Exception as exc:
         # 失败：退回预扣配额
         if estimated_price > 0:

video-gen-api/app/services/api_v3/task_service.py

@@ -28,17 +28,17 @@ async def create_video_task(
     idempotency_key: str | None = None,
     local_media_refs: list[dict] | None = None,
 ) -> ApiGenerationTask:
-    """创建视频生成任务记录。"""
+    """创建视频生成任务记录。
+
+    如果调用方已下载好媒体文件（local_media_refs），则直接复用，避免重复下载。
+    """
     # 提取文本提示词
     text_parts = [p.get("text", "") for p in content if p.get("type") == "text"]
     original_prompt = " ".join(text_parts) if text_parts else content[0].get("text", "") if content else ""
 
     # 构建 media_references（扁平格式，便于外部读取）
     # 构建 local_media_json（嵌套格式，与 Volcano SDK 兼容）
-    from app.services.api_v3.file_service import process_media_url
-
     media_refs = []  # 扁平格式: {"type": "image", "url": "...", "role": "..."}
-    local_media_refs = []  # 本地下载路径（嵌套格式）
 
     for p in content:
         ptype = p.get("type", "")
@@ -62,19 +62,37 @@ async def create_video_task(
             "role": p.get("role"),
         })
 
-        # 下载文件到本地
-        try:
-            local_path = await process_media_url(original_url, media_type)
-        except Exception as exc:
-            logger.warning("Failed to download media %s: %s", original_url[:80], exc)
-            local_path = original_url
+    # 如果调用方已传入 local_media_refs（已下载），直接使用，不再重复下载
+    if local_media_refs is None:
+        from app.services.api_v3.file_service import process_media_url
 
-        # 本地路径使用嵌套格式（与 Volcano SDK 兼容）
-        local_media_refs.append({
-            "type": ptype,
-            ptype: {"url": local_path},
-            "role": p.get("role"),
-        })
+        local_media_refs = []  # 本地下载路径（嵌套格式）
+        for p in content:
+            ptype = p.get("type", "")
+            if ptype == "text":
+                continue
+
+            original_url = ""
+            if ptype == "image_url" and p.get("image_url"):
+                original_url = p["image_url"].get("url", "")
+            elif ptype == "video_url" and p.get("video_url"):
+                original_url = p["video_url"].get("url", "")
+            elif ptype == "audio_url" and p.get("audio_url"):
+                original_url = p["audio_url"].get("url", "")
+
+            # 下载文件到本地
+            try:
+                local_path = await process_media_url(original_url, ptype.replace("_url", ""))
+            except Exception as exc:
+                logger.warning("Failed to download media %s: %s", original_url[:80], exc)
+                local_path = original_url
+
+            # 本地路径使用嵌套格式（与 Volcano SDK 兼容）
+            local_media_refs.append({
+                "type": ptype,
+                ptype: {"url": local_path},
+                "role": p.get("role"),
+            })
 
     media_references_json = json.dumps(media_refs, ensure_ascii=False) if media_refs else None
     local_media_json = json.dumps(local_media_refs, ensure_ascii=False) if local_media_refs else None