feat(配置): 更新环境变量配置，添加开发和生产环境的API代理支持，增强安全性

feat(聊天面板): 添加下载链接验证，确保文档地址安全
feat(AI服务): 根据环境配置选择API URL和密钥，优化错误处理
feat(错误处理): 限制错误消息长度，避免过长信息影响用户体验
feat(编辑器): 添加块序列化功能，优化保存逻辑

.env.example

@@ -13,24 +13,13 @@ VITE_APP_TITLE=AX Document Editor
 # Enable debug mode for development
 # Default: false
 VITE_DEBUG=false
+
+# Development-only direct AI endpoints. Never ship these keys in a production build.
 VITE_AI_API_URL=
 VITE_AI_API_KEY=
 VITE_WORKFLOW_API_URL=
 VITE_WORKFLOW_API_KEY=
 
-# AI Chat API Configuration
-# AI Platform API URL for chat completions (v1 - regular chat)
-VITE_AI_API_URL=http://114.242.25.27:3000/api/v1/chat/completions
-
-# AI Platform API Key
-# Get this from: 发布渠道 → API 访问 → 创建新 Key
-VITE_AI_API_KEY=your_api_key_here
-
-# Workflow API Configuration
-# Workflow API URL for document generation (v2 - with workflow)
-# This workflow connects to local backend export records API
-VITE_WORKFLOW_API_URL=http://114.242.25.27:3000/api/v2/chat/completions
-
-# Workflow API Key
-# Use the XAgent API key provided by the platform
-VITE_WORKFLOW_API_KEY=your_workflow_api_key_here
+# Production same-origin proxy endpoints. The proxy stores the upstream API keys server-side.
+VITE_AI_PROXY_URL=/api/v1/ai/chat
+VITE_WORKFLOW_PROXY_URL=/api/v1/ai/workflow

src/components/ChatPanel/MessageItem.tsx

@@ -17,7 +17,11 @@ import { formatDate } from '../../utils/formatDate';
 import type { ChatMessage } from '../../types/chat';
 import { useDocumentStore } from '../../stores/documentStore';
 import { useChatStore } from '../../stores/chatStore';
-import { downloadBlob, getFileNameFromContentDisposition } from '../../utils/download';
+import {
+  downloadBlob,
+  getFileNameFromContentDisposition,
+  isAllowedHttpUrl,
+} from '../../utils/download';
 
 const { Text } = Typography;
 
@@ -154,6 +158,10 @@ const MessageItem: React.FC<MessageItemProps> = memo(
      */
     const handlePreviewClick = useCallback(async () => {
       if (!exportRecord || !onPreviewDocument || isCreatingDocument) return;
+      if (!isAllowedHttpUrl(exportRecord.downloadUrl)) {
+        antdMessage.error('文档地址不受信任，无法打开');
+        return;
+      }
 
       try {
         setIsCreatingDocument(true);
@@ -223,6 +231,10 @@ const MessageItem: React.FC<MessageItemProps> = memo(
       async (e: React.MouseEvent) => {
         e.stopPropagation(); // Prevent card click
         if (!exportRecord?.downloadUrl) return;
+        if (!isAllowedHttpUrl(exportRecord.downloadUrl)) {
+          antdMessage.error('文档地址不受信任，无法下载');
+          return;
+        }
         
         try {
           // Extract recordId from downloadUrl

src/services/aiChatService.ts

@@ -78,12 +78,19 @@ interface AIChatConfig {
  * Get AI Chat configuration from environment variables
  */
 const getAIChatConfig = (): AIChatConfig => {
+  const isDevelopment = import.meta.env.DEV;
   return {
-    apiUrl: import.meta.env.VITE_AI_API_URL,
-    apiKey: import.meta.env.VITE_AI_API_KEY,
+    apiUrl: isDevelopment
+      ? import.meta.env.VITE_AI_API_URL
+      : import.meta.env.VITE_AI_PROXY_URL,
+    apiKey: isDevelopment ? import.meta.env.VITE_AI_API_KEY : '',
   };
 };
 
+const getAuthorizationHeaders = (apiKey: string): Record<string, string> => (
+  apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+);
+
 /**
  * Send a chat completion request to AI platform
  *
@@ -97,7 +104,10 @@ export const sendChatCompletion = async (
   try {
     const config = getAIChatConfig();
 
-    if (!config.apiUrl || !config.apiKey) {
+    if (!config.apiUrl) {
+      if (import.meta.env.PROD) {
+        throw new Error('AI 服务未配置，请先配置服务端代理');
+      }
       return mockChatCompletion(request);
     }
 
@@ -105,7 +115,7 @@ export const sendChatCompletion = async (
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${config.apiKey}`,
+        ...getAuthorizationHeaders(config.apiKey),
       },
       body: JSON.stringify({
         chatId: request.chatId,
@@ -154,7 +164,10 @@ export const sendStreamingChatCompletion = async (
   try {
     const config = getAIChatConfig();
 
-    if (!config.apiUrl || !config.apiKey) {
+    if (!config.apiUrl) {
+      if (import.meta.env.PROD) {
+        throw new Error('AI 服务未配置，请先配置服务端代理');
+      }
       const mockResponse = await mockChatCompletion(request);
       for (const chunk of mockResponse.content.split(' ')) {
         await new Promise((resolve) => setTimeout(resolve, 50));
@@ -167,7 +180,7 @@ export const sendStreamingChatCompletion = async (
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${config.apiKey}`,
+        ...getAuthorizationHeaders(config.apiKey),
       },
       body: JSON.stringify({
         ...request,

src/services/api.ts

@@ -59,6 +59,14 @@ const getBaseURL = (): string => {
  * Default request timeout in milliseconds (30 seconds)
  */
 const DEFAULT_TIMEOUT = 30000;
+const MAX_ERROR_MESSAGE_LENGTH = 500;
+
+const limitErrorMessage = (value: string): string => {
+  const normalized = value.trim();
+  return normalized.length > MAX_ERROR_MESSAGE_LENGTH
+    ? `${normalized.slice(0, MAX_ERROR_MESSAGE_LENGTH)}...`
+    : normalized;
+};
 
 /**
  * Create and configure axios instance
@@ -184,15 +192,15 @@ export const normalizeAxiosError = (error: AxiosError): ApiError => {
 
     // Extract error message from response
     if (apiData?.message) {
-      message = apiData.message;
+      message = limitErrorMessage(apiData.message);
     } else if (typeof data === 'string') {
-      message = data;
+      message = limitErrorMessage(data);
     }
 
     // Specific client error messages
     switch (status) {
       case 400:
-        message = apiData?.message || '请求参数错误';
+        message = apiData?.message ? limitErrorMessage(apiData.message) : '请求参数错误';
         break;
       case 401:
         message = '未授权，请先登录';
@@ -204,7 +212,7 @@ export const normalizeAxiosError = (error: AxiosError): ApiError => {
         message = '请求的资源不存在';
         break;
       case 422:
-        message = apiData?.message || '数据验证失败';
+        message = apiData?.message ? limitErrorMessage(apiData.message) : '数据验证失败';
         break;
     }
 
@@ -219,7 +227,9 @@ export const normalizeAxiosError = (error: AxiosError): ApiError => {
 
   // Server errors (5xx)
   if (status >= 500) {
-    const message = apiData?.message || '服务器错误，请稍后重试'
+    const message = apiData?.message
+      ? limitErrorMessage(apiData.message)
+      : '服务器错误，请稍后重试';
 
     return {
       type: 'server',

src/services/workflowService.ts

@@ -81,12 +81,19 @@ interface WorkflowConfig {
  * Get Workflow configuration from environment variables
  */
 const getWorkflowConfig = (): WorkflowConfig => {
+  const isDevelopment = import.meta.env.DEV;
   return {
-    apiUrl: import.meta.env.VITE_WORKFLOW_API_URL,
-    apiKey: import.meta.env.VITE_WORKFLOW_API_KEY,
+    apiUrl: isDevelopment
+      ? import.meta.env.VITE_WORKFLOW_API_URL
+      : import.meta.env.VITE_WORKFLOW_PROXY_URL,
+    apiKey: isDevelopment ? import.meta.env.VITE_WORKFLOW_API_KEY : '',
   };
 };
 
+const getAuthorizationHeaders = (apiKey: string): Record<string, string> => (
+  apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+);
+
 /**
  * Check if user input should trigger document generation workflow
  *
@@ -170,7 +177,7 @@ export const triggerDocumentWorkflow = async (
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        Authorization: `Bearer ${config.apiKey}`,
+        ...getAuthorizationHeaders(config.apiKey),
       },
       body: JSON.stringify({
         chatId: uniqueChatId, // 带时间戳的唯一ID，避免工作流缓存

src/stores/chatStore.ts

@@ -79,7 +79,7 @@ const loadSessionsFromStorage = (): ChatSession[] => {
         messages: session.messages.slice(-MAX_MESSAGES_PER_SESSION),
       }));
     // Sort by updatedAt descending (most recent first)
-    return sessions.sort((a, b) => b.updatedAt - a.updatedAt);
+    return sessions.sort((a, b) => b.updatedAt - a.updatedAt).slice(0, MAX_SESSIONS);
   } catch (error) {
     console.warn('读取本地会话失败，将使用空会话列表', error);
     return [];

src/stores/editorStore.ts

@@ -82,6 +82,35 @@ function isCanceledRequest(error: unknown): boolean {
   );
 }
 
+function serializeBlockForSave(block: DocumentBlock): Pick<BlockUpdate, 'content' | 'style'> {
+  if (block.type === 'table') {
+    const serializedTable = serializeTableBlock(block as TableBlock);
+    return {
+      content: serializedTable.content,
+      style: block.style,
+    };
+  }
+
+  if ((block.type === 'heading' || block.type === 'paragraph') && Array.isArray(block.content)) {
+    const firstStyle = block.content[0]?.style;
+    const allSameStyle = !!firstStyle && block.content.every((segment) =>
+      JSON.stringify(segment.style) === JSON.stringify(firstStyle),
+    );
+
+    return {
+      content: block.content.map((segment) => segment.text).join(''),
+      style: allSameStyle && Object.keys(firstStyle).length > 0
+        ? { ...block.style, ...firstStyle }
+        : block.style,
+    };
+  }
+
+  return {
+    content: block.content,
+    style: block.style,
+  };
+}
+
 // ══════════════════════════════════════════════════════════════════════════════
 // Store State Interface
 // ══════════════════════════════════════════════════════════════════════════════
@@ -582,34 +611,7 @@ export const useEditorStore = create<EditorStore>((set, get) => {
             // 获取该块的重试次数
             const attempts = retryAttempts.get(block.id) || 0;
             
-            // 序列化块内容（将富文本数组转为纯字符串，并提取样式到style字段）
-            let contentToSave = block.content;
-            let styleToSave = block.style;
-            
-            if (block.type === 'table') {
-              const serializedTable = serializeTableBlock(block as TableBlock);
-              contentToSave = serializedTable.content;
-            } else if (block.type === 'heading' || block.type === 'paragraph') {
-              // 对于标题和段落块，如果content是富文本数组，需要序列化
-              if (Array.isArray(block.content)) {
-                // 提取纯文本
-                contentToSave = block.content.map(seg => seg.text).join('');
-                
-                // 如果所有片段的样式一致，提取到块级style
-                const allSegments = block.content;
-                if (allSegments.length > 0) {
-                  const firstStyle = allSegments[0].style;
-                  const allSameStyle = allSegments.every(seg => 
-                    JSON.stringify(seg.style) === JSON.stringify(firstStyle)
-                  );
-                  
-                  if (allSameStyle && Object.keys(firstStyle).length > 0) {
-                    // 所有片段样式一致，合并到块级style
-                    styleToSave = { ...block.style, ...firstStyle };
-                  }
-                }
-              }
-            }
+            const { content: contentToSave, style: styleToSave } = serializeBlockForSave(block);
             
             try {
               const result = await blockService.updateBlock(
@@ -825,6 +827,9 @@ export const useEditorStore = create<EditorStore>((set, get) => {
         const blocksToRetry = blocks.filter(block => 
           failedBlocks.includes(block.id)
         );
+        const savedHashes = new Map(
+          blocksToRetry.map((block) => [block.id, computeBlockHash(block)]),
+        );
         
         const totalBlocks = blocksToRetry.length;
         
@@ -837,34 +842,7 @@ export const useEditorStore = create<EditorStore>((set, get) => {
         // 使用并发限制器重试保存
         const tasks = blocksToRetry.map(block => 
           saveConcurrencyLimit(() => {
-            // 序列化块内容（将富文本数组转为纯字符串，并提取样式到style字段）
-            let contentToSave = block.content;
-            let styleToSave = block.style;
-            
-            if (block.type === 'table') {
-              const serializedTable = serializeTableBlock(block as TableBlock);
-              contentToSave = serializedTable.content;
-            } else if (block.type === 'heading' || block.type === 'paragraph') {
-              // 对于标题和段落块，如果content是富文本数组，需要序列化
-              if (Array.isArray(block.content)) {
-                // 提取纯文本
-                contentToSave = block.content.map(seg => seg.text).join('');
-                
-                // 如果所有片段的样式一致，提取到块级style
-                const allSegments = block.content;
-                if (allSegments.length > 0) {
-                  const firstStyle = allSegments[0].style;
-                  const allSameStyle = allSegments.every(seg => 
-                    JSON.stringify(seg.style) === JSON.stringify(firstStyle)
-                  );
-                  
-                  if (allSameStyle && Object.keys(firstStyle).length > 0) {
-                    // 所有片段样式一致，合并到块级style
-                    styleToSave = { ...block.style, ...firstStyle };
-                  }
-                }
-              }
-            }
+            const { content: contentToSave, style: styleToSave } = serializeBlockForSave(block);
             
             return blockService.updateBlock(
               documentId, 
@@ -901,23 +879,20 @@ export const useEditorStore = create<EditorStore>((set, get) => {
           }
         });
         
-        // 从脏块集合中移除成功的块
-        const { dirtyBlocks } = get();
-        const newDirtyBlocks = new Set(dirtyBlocks);
-        successIds.forEach(id => newDirtyBlocks.delete(id));
+        const latestState = get();
+        const newDirtyBlocks = new Set(latestState.dirtyBlocks);
+        const newBlockHashes = new Map(latestState.blockHashes);
+        successIds.forEach(id => {
+          const latestBlock = latestState.blocks.find((block) => block.id === id);
+          const savedHash = savedHashes.get(id);
+          if (latestBlock && savedHash === computeBlockHash(latestBlock)) {
+            newDirtyBlocks.delete(id);
+            newBlockHashes.set(id, savedHash);
+          }
+        });
         
         if (stillFailedIds.length > 0) {
           // 仍有块保存失败
-          
-          // 更新成功保存的块的哈希值
-          const newBlockHashes = new Map(get().blockHashes);
-          successIds.forEach(id => {
-            const block = blocks.find(b => b.id === id);
-            if (block) {
-              newBlockHashes.set(id, computeBlockHash(block));
-            }
-          });
-          
           set({ 
             isSaving: false,
             failedBlocks: stillFailedIds,
@@ -932,28 +907,23 @@ export const useEditorStore = create<EditorStore>((set, get) => {
           throw new Error(`${stillFailedIds.length} 个块保存失败`);
         } else {
           // 全部重试成功
-          const snapshot = JSON.stringify(blocks);
-          
-          // 更新所有成功保存的块的哈希值
-          const newBlockHashes = new Map(get().blockHashes);
-          successIds.forEach(id => {
-            const block = blocks.find(b => b.id === id);
-            if (block) {
-              newBlockHashes.set(id, computeBlockHash(block));
+          const latestBlocks = get().blocks;
+          const snapshots = newDirtyBlocks.size === 0
+            ? {
+              originalBlocksSnapshot: JSON.stringify(latestBlocks),
+              lastSavedSnapshot: JSON.stringify(latestBlocks),
             }
-          });
-          
+            : {};
           set({ 
             isSaving: false,
             hasModified: newDirtyBlocks.size > 0,
-            originalBlocksSnapshot: snapshot,
-            lastSavedSnapshot: snapshot,
             failedBlocks: [],
             dirtyBlocks: newDirtyBlocks,
-            blockHashes: newBlockHashes, // 更新哈希表
+            blockHashes: newBlockHashes,
             currentSavePromise: null,
             saveAbortController: null,
             savingProgress: null,
+            ...snapshots,
           });
         }
       } catch (error: unknown) {
@@ -1183,14 +1153,14 @@ export const useEditorStore = create<EditorStore>((set, get) => {
       return;
     }
 
-    set({ pendingStructuralOperations: pendingStructuralOperations + 1 });
-    
     // 找到要删除的块
     const blockToDelete = blocks.find(b => b.id === id);
     if (!blockToDelete) {
       return;
     }
 
+    set({ pendingStructuralOperations: pendingStructuralOperations + 1 });
+
     const wasDirty = dirtyBlocks.has(id);
     
     // 先从本地状态删除（乐观更新）
@@ -1475,20 +1445,16 @@ export const useEditorStore = create<EditorStore>((set, get) => {
     }
     
     set({ isSaving: true, error: null });
+    const savedHash = currentHash;
     
     try {
-      // 序列化表格块的content（将富文本数组转为纯字符串）
-      let contentToSave = block.content;
-      if (block.type === 'table') {
-        const serializedTable = serializeTableBlock(block as TableBlock);
-        contentToSave = serializedTable.content;
-      }
+      const { content: contentToSave, style: styleToSave } = serializeBlockForSave(block);
       
       await blockService.updateBlock(documentId, id, {
         type: block.type,
         level: block.level,
         content: contentToSave,
-        style: block.style,
+        style: styleToSave,
         word_style: block.word_style,
         metadata: block.metadata,
         block_order: block.block_order,
@@ -1500,13 +1466,17 @@ export const useEditorStore = create<EditorStore>((set, get) => {
       const latestBlock = latestBlocks.find(b => b.id === id);
       
       if (latestBlock) {
-        // 保存成功后，从脏块集合中移除该块
+        const latestHash = computeBlockHash(latestBlock);
+        if (latestHash !== savedHash) {
+          set({ isSaving: false });
+          return;
+        }
+
         const newDirtyBlocks = new Set(latestDirtyBlocks);
         newDirtyBlocks.delete(id);
         
-        // **关键修复**: 使用保存成功时的块内容计算哈希值
         const newBlockHashes = new Map(latestBlockHashes);
-        newBlockHashes.set(id, computeBlockHash(latestBlock));
+        newBlockHashes.set(id, savedHash);
         
         set({ 
           isSaving: false,

src/utils/download.ts

@@ -1,5 +1,23 @@
 const UNSAFE_FILE_NAME_CHARS = /[\\/:*?"<>|]/g;
 
+export function isAllowedHttpUrl(value: string): boolean {
+  try {
+    const url = new URL(value, window.location.origin);
+    if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password) {
+      return false;
+    }
+
+    if (!/^(https?:)?\/\//i.test(value)) {
+      return true;
+    }
+
+    const configuredBaseUrl = import.meta.env.VITE_API_BASE_URL || 'http://localhost:8000';
+    return url.origin === new URL(configuredBaseUrl).origin;
+  } catch {
+    return false;
+  }
+}
+
 export function safeFileName(fileName: string, fallback = 'download'): string {
   const normalized = Array.from(fileName, (character) =>
     character.charCodeAt(0) < 32 ? '_' : character