{reportEntryVisible && activeSession && (
diff --git a/frontend/src/components/personal-report/generate-personal-report-button.tsx b/frontend/src/components/personal-report/generate-personal-report-button.tsx
index b3dba1fe..ffc4d4e4 100644
--- a/frontend/src/components/personal-report/generate-personal-report-button.tsx
+++ b/frontend/src/components/personal-report/generate-personal-report-button.tsx
@@ -21,6 +21,7 @@ import { useRef, useState } from "react";
import { useRouter } from "next/navigation";
import { FileText } from "lucide-react";
+import { toast } from "sonner";
export const DEFAULT_REPORT_THEMES = ["career", "marriage", "wealth", "timing"] as const;
@@ -155,7 +156,6 @@ export function GeneratePersonalReportButton({
}: GeneratePersonalReportButtonProps) {
const router = useRouter();
const [submitting, setSubmitting] = useState(false);
- const [notice, setNotice] = useState
(null);
const inFlight = useRef(false);
async function handleGenerate() {
@@ -164,11 +164,10 @@ export function GeneratePersonalReportButton({
}
inFlight.current = true;
setSubmitting(true);
- setNotice(null);
try {
const requestId = createReportRequestId();
if (requestId === null) {
- setNotice("请使用支持安全请求标识的现代浏览器。");
+ toast.error("请使用支持安全请求标识的现代浏览器。");
return;
}
const body = buildPersonalReportCreateRequest(requestId, sessionId);
@@ -189,9 +188,9 @@ export function GeneratePersonalReportButton({
router.push(`/reports/${encodeURIComponent(outcome.reportId)}`);
return;
}
- setNotice(outcome.message);
+ toast.error(outcome.message);
} catch {
- setNotice("网络异常，请检查连接后重试。");
+ toast.error("网络异常，请检查连接后重试。");
} finally {
inFlight.current = false;
setSubmitting(false);
@@ -203,31 +202,15 @@ export function GeneratePersonalReportButton({
: "生成个人报告；服务端将校验本次咨询是否存在可用证据，无证据时会提示。";
return (
-
-
- {notice !== null ? (
-
- {notice}
-
- ) : evidenceState === "unknown" ? (
-
- 服务端将校验本次咨询证据。
-
- ) : (
-
- 本次对话包含工作流证据记录，最终以服务端校验为准。
-
- )}
-
+
);
}
diff --git a/frontend/src/lib/personal-report-entitlement.ts b/frontend/src/lib/personal-report-entitlement.ts
index 99c304b0..c06b7e89 100644
--- a/frontend/src/lib/personal-report-entitlement.ts
+++ b/frontend/src/lib/personal-report-entitlement.ts
@@ -1,3 +1,5 @@
+import { normalizeIdentityHost } from "@/modules/identity/host";
+
/**
* Personal report export entitlement — independent from the "spend 1 credit"
* consultation RPC. Capability key: report.export.personal.
@@ -45,17 +47,46 @@ export type SameOriginDecision = Readonly<
{ ok: true } | { ok: false; code: "cross_origin_forbidden" }
>;
+type HeaderReader = Pick;
+
+function singleForwardedValue(value: string | null): string | null {
+ const normalized = value?.trim();
+ return normalized && !normalized.includes(",") ? normalized : null;
+}
+
+function matchesForwardedOrigin(origin: string, headers?: HeaderReader): boolean {
+ if (!headers?.has("x-forwarded-host") || !headers.has("x-forwarded-proto")) return false;
+
+ const host = normalizeIdentityHost(headers.get("host"));
+ const forwardedHost = normalizeIdentityHost(singleForwardedValue(headers.get("x-forwarded-host")));
+ const forwardedProto = singleForwardedValue(headers.get("x-forwarded-proto"))?.toLowerCase();
+ if (!host || !forwardedHost || host !== forwardedHost
+ || (forwardedProto !== "http" && forwardedProto !== "https")) {
+ return false;
+ }
+
+ try {
+ const originUrl = new URL(origin);
+ return origin === originUrl.origin
+ && originUrl.host.toLowerCase() === forwardedHost
+ && originUrl.protocol === `${forwardedProto}:`;
+ } catch {
+ return false;
+ }
+}
+
/**
* Same-origin check for report APIs. An absent Origin header (curl, server
* tests, same-origin fetch from the browser never sends Origin for GET but
* does for POST) is accepted; a matching request origin is accepted; a
- * configured trusted-proxy/test allowlist is accepted; anything else is
- * rejected.
+ * configured allowlist or consistent trusted-proxy host/protocol is accepted;
+ * anything else is rejected.
*/
export function checkSameOrigin(
requestUrl: string | URL,
originHeader: string | null,
allowedOrigins: readonly string[],
+ requestHeaders?: HeaderReader,
): SameOriginDecision {
const origin = originHeader?.trim();
if (!origin) return { ok: true };
@@ -67,6 +98,7 @@ export function checkSameOrigin(
}
if (origin === requestOrigin) return { ok: true };
if (allowedOrigins.includes(origin)) return { ok: true };
+ if (matchesForwardedOrigin(origin, requestHeaders)) return { ok: true };
return { ok: false, code: "cross_origin_forbidden" };
}
diff --git a/frontend/src/lib/personal-report-route-core.ts b/frontend/src/lib/personal-report-route-core.ts
index cbb1962c..9023143b 100644
--- a/frontend/src/lib/personal-report-route-core.ts
+++ b/frontend/src/lib/personal-report-route-core.ts
@@ -144,6 +144,7 @@ export type ReportCreateCoreDeps = Readonly<{
requestUrl: string;
origin: string | null;
allowedOrigins: readonly string[];
+ requestHeaders?: Pick;
userId: string | null;
rawBody: unknown;
profile: unknown | null;
@@ -165,7 +166,7 @@ export type ReportCreateCoreDeps = Readonly<{
export async function resolveReportCreate(deps: ReportCreateCoreDeps): Promise {
// Same-origin gate first (CSRF), then auth.
- const originDecision = checkSameOrigin(deps.requestUrl, deps.origin, deps.allowedOrigins);
+ const originDecision = checkSameOrigin(deps.requestUrl, deps.origin, deps.allowedOrigins, deps.requestHeaders);
if (!originDecision.ok) {
return {
status: 403,
@@ -416,6 +417,7 @@ export type ReportReadCoreDeps = Readonly<{
requestUrl: string;
origin: string | null;
allowedOrigins: readonly string[];
+ requestHeaders?: Pick;
userId: string | null;
reportId: string;
persistence: Pick;
@@ -430,7 +432,7 @@ export type ReportReadCoreDeps = Readonly<{
}>;
export async function resolveReportRead(deps: ReportReadCoreDeps): Promise {
- const originDecision = checkSameOrigin(deps.requestUrl, deps.origin, deps.allowedOrigins);
+ const originDecision = checkSameOrigin(deps.requestUrl, deps.origin, deps.allowedOrigins, deps.requestHeaders);
if (!originDecision.ok) {
return {
status: 403,
@@ -474,13 +476,14 @@ export type ReportDeleteCoreDeps = Readonly<{
requestUrl: string;
origin: string | null;
allowedOrigins: readonly string[];
+ requestHeaders?: Pick;
userId: string | null;
reportId: string;
persistence: Pick;
}>;
export async function resolveReportDelete(deps: ReportDeleteCoreDeps): Promise {
- const originDecision = checkSameOrigin(deps.requestUrl, deps.origin, deps.allowedOrigins);
+ const originDecision = checkSameOrigin(deps.requestUrl, deps.origin, deps.allowedOrigins, deps.requestHeaders);
if (!originDecision.ok) {
return {
status: 403,
diff --git a/frontend/tests/personal-report-api.test.ts b/frontend/tests/personal-report-api.test.ts
index b1ebbf7e..8de4effa 100644
--- a/frontend/tests/personal-report-api.test.ts
+++ b/frontend/tests/personal-report-api.test.ts
@@ -270,6 +270,23 @@ test("core create: 403 on cross-origin", async () => {
assert.equal(response.body.code, "report_resource_forbidden");
});
+test("core create: accepts staging same-origin POST behind the trusted reverse proxy", async () => {
+ const response = await resolveReportCreate({
+ ...baseDeps({
+ requestUrl: "http://staging.jyotisha.chat/api/reports",
+ origin: "https://staging.jyotisha.chat",
+ }),
+ requestHeaders: new Headers({
+ host: "staging.jyotisha.chat",
+ "x-forwarded-host": "staging.jyotisha.chat",
+ "x-forwarded-proto": "https",
+ }),
+ });
+
+ assert.equal(response.status, 201);
+ assert.equal(response.body.report && typeof response.body.report, "object");
+});
+
test("core create: 400 on invalid payload", async () => {
const response = await resolveReportCreate(baseDeps({ rawBody: { requestId: "not-a-uuid" } }));
assert.equal(response.status, 400);
@@ -742,6 +759,8 @@ test("GET/DELETE use the authenticated client (least privilege) and the core han
test("route core enforces same-origin and never leaks raw exception text", () => {
assert.match(coreSource, /checkSameOrigin/);
assert.match(coreSource, /REPORT_STABLE_CODES\.resourceForbidden/);
+ assert.match(createRoute, /requestHeaders:\s*request\.headers/);
+ assert.match(itemRoute, /requestHeaders:\s*request\.headers/);
assert.doesNotMatch(createRoute, /error\.message\)/);
assert.doesNotMatch(itemRoute, /error\.message\)/);
assert.doesNotMatch(createRoute, /\.stack/);
diff --git a/frontend/tests/personal-report-entitlement.test.ts b/frontend/tests/personal-report-entitlement.test.ts
index 0f3baf36..9b2008ea 100644
--- a/frontend/tests/personal-report-entitlement.test.ts
+++ b/frontend/tests/personal-report-entitlement.test.ts
@@ -61,6 +61,59 @@ test("same-origin check rejects cross-origin and accepts a trusted allowlist", (
);
});
+test("same-origin check trusts only consistent forwarded host and protocol", () => {
+ const headers = new Headers({
+ host: "staging.jyotisha.chat",
+ "x-forwarded-host": "staging.jyotisha.chat",
+ "x-forwarded-proto": "https",
+ });
+
+ assert.deepEqual(
+ checkSameOrigin(
+ "http://staging.jyotisha.chat/api/reports",
+ "https://staging.jyotisha.chat",
+ [],
+ headers,
+ ),
+ { ok: true },
+ );
+ assert.deepEqual(
+ checkSameOrigin(
+ "http://staging.jyotisha.chat/api/reports",
+ "https://evil.example",
+ [],
+ headers,
+ ),
+ { ok: false, code: "cross_origin_forbidden" },
+ );
+ assert.deepEqual(
+ checkSameOrigin(
+ "http://staging.jyotisha.chat/api/reports",
+ "https://staging.jyotisha.chat",
+ [],
+ new Headers({
+ host: "staging.jyotisha.chat",
+ "x-forwarded-host": "evil.example",
+ "x-forwarded-proto": "https",
+ }),
+ ),
+ { ok: false, code: "cross_origin_forbidden" },
+ );
+ assert.deepEqual(
+ checkSameOrigin(
+ "http://staging.jyotisha.chat/api/reports",
+ "https://staging.jyotisha.chat",
+ [],
+ new Headers({
+ host: "staging.jyotisha.chat",
+ "x-forwarded-host": "staging.jyotisha.chat",
+ "x-forwarded-proto": "https, http",
+ }),
+ ),
+ { ok: false, code: "cross_origin_forbidden" },
+ );
+});
+
test("entitlement blocks when the feature is disabled", async () => {
const result = await checkPersonalReportEntitlement({
userId: "u1",
diff --git a/frontend/tests/personal-report-entry.test.ts b/frontend/tests/personal-report-entry.test.ts
index b153fde8..352e901f 100644
--- a/frontend/tests/personal-report-entry.test.ts
+++ b/frontend/tests/personal-report-entry.test.ts
@@ -18,6 +18,7 @@ const componentSource = readFileSync(
"utf8",
);
const pageSource = readFileSync(new URL("../src/app/page.tsx", import.meta.url), "utf8");
+const globalStyles = readFileSync(new URL("../src/app/globals.css", import.meta.url), "utf8");
test("request shape: POST /api/reports body carries only report identity fields", () => {
const body = buildPersonalReportCreateRequest("request-id-1", "session-id-1");
@@ -144,6 +145,16 @@ test("repeat clicks are guarded while a request is in flight", () => {
assert.match(componentSource, /正在生成/);
});
+test("entry stays on one line and sends failures to the existing toast", () => {
+ assert.match(componentSource, /shrink-0/);
+ assert.match(componentSource, /whitespace-nowrap/);
+ assert.match(componentSource, /toast\.error\(outcome\.message\)/);
+ assert.match(componentSource, /toast\.error\("网络异常，请检查连接后重试。"\)/);
+ assert.doesNotMatch(componentSource, /personal-report-entry-note/);
+ assert.doesNotMatch(componentSource, /flex-wrap/);
+ assert.match(globalStyles, /\.chat-header-actions \{[^}]*min-width: max-content;[^}]*display: flex;[^}]*white-space: nowrap;/);
+});
+
test("entry never requests a server PDF and never prints directly", () => {
assert.doesNotMatch(componentSource, /api\/report_artifact/);
assert.doesNotMatch(componentSource, /window\.print/);
diff --git a/frontend/tests/sidebar-contract.test.ts b/frontend/tests/sidebar-contract.test.ts
index 2a912ff2..d03903e2 100644
--- a/frontend/tests/sidebar-contract.test.ts
+++ b/frontend/tests/sidebar-contract.test.ts
@@ -253,9 +253,14 @@ test("changes sidebar state without transition frames", () => {
});
test("keeps the chat title in the flexible left-aligned header column", () => {
+ const page = readProjectFile("src/app/page.tsx");
+ const header = page.slice(page.indexOf('", page.indexOf('')));
+
assert.match(cssBlock(".chat-header"), /grid-template-columns:\s*auto\s+minmax\(0,\s*1fr\)\s+auto/);
assert.match(cssBlock(".chat-header"), /text-align:\s*left/);
assert.doesNotMatch(cssBlock(".chat-header"), /justify-content:\s*space-between/);
+ assert.match(header, /\{activeSession\?\.title \|\| "新对话"\}<\/strong>/);
+ assert.doesNotMatch(header, /status-loading|基于星盘证据回答|回答一般占星知识|正在校正出生时间/);
});
test("anchors the account footer to the bottom edge without trailing sidebar padding", () => {
diff --git a/frontend/tests/starter-questions.test.ts b/frontend/tests/starter-questions.test.ts
index a06266b5..02e02e5d 100644
--- a/frontend/tests/starter-questions.test.ts
+++ b/frontend/tests/starter-questions.test.ts
@@ -62,7 +62,7 @@ test("profiles without a usable birth minute only receive general-knowledge home
"印度占星中的时间推运通常会看哪些因素？",
]);
assert.match(pageSource, /const starterThemes = personalChartAvailable \? themes : generalGuidedJyotishTopics/);
- assert.match(pageSource, /personalChartAvailable[\s\S]*?回答一般占星知识/);
+ assert.doesNotMatch(pageSource, /回答一般占星知识/);
assert.match(pageSource, /完成生时校正后，再讨论个人星盘结论/);
assert.match(pageSource, /personalChartAvailable \? "daily_starlanguage" : null/);
});