feat(context): verify product session scope

2026-09-22 10:43:36 +08:00
parent 88b41ba04c
commit 9faed59f23
12 changed files with 358 additions and 56 deletions
@@ -197,8 +197,8 @@ export const registerChatStreamRoute = (
      const projectId = authContext.projectId;
      const traceId = req.header("x-trace-id") ?? undefined;
      const userId = authContext.userId;
-      const actorKey = toActorKey(userId);
-      const projectKey = toProjectKey(projectId);
+      const actorKey = authContext.actorKey;
+      const projectKey = authContext.projectKey;
      const requestUiMessages = toUiMessages(parsed.data.messages);
      const promptText =
        parsed.data.message?.trim() || readLatestUserText(requestUiMessages);
@@ -219,6 +219,10 @@ export const registerChatStreamRoute = (
            requestedSessionId,
          )
        : null;
+      if (requestedSessionId && !existingSessionRecord) {
+        res.status(404).json({ message: "session not found" });
+        return;
+      }
      const hadExistingRuntimeSession = Boolean(existingSessionRecord);

      const { binding, requestContext, created } = await sessionBridge.resolve({
@@ -227,6 +231,8 @@ export const registerChatStreamRoute = (
        projectId,
        traceId,
        userId,
+        actorKey,
+        projectKey,
      });
      setRuntimeSessionContext({
        ...(getRuntimeSessionContext(binding.sessionId)!),