fix(avatar): prevent takeover loops and isolate settings

digital-avatar-app/backend/routers/authorizations.py

@@ -2,7 +2,7 @@ from fastapi import APIRouter, Body, Depends, Header, HTTPException
 from sqlalchemy.orm import Session
 
 from database import get_db
-from models import Authorization, TakeoverCursor, TakeoverReplyTask
+from models import Authorization, Avatar, TakeoverCursor, TakeoverReplyTask
 from responses import fail, ok
 from routers.avatars import _require_owned_avatar
 
@@ -14,6 +14,10 @@ ALLOWED_PERMISSIONS = set(PERMISSION_ORDER)
 AVATAR_PERMISSION_ORDER = PERMISSION_ORDER
 AVATAR_PERMISSION_KEY = "authorizationPermissions"
 DEFAULT_AVATAR_PERMISSIONS = ["friend", "chat"]
+TAKEOVER_DELAY_KEY = "takeoverReplyDelaySeconds"
+DEFAULT_TAKEOVER_DELAY_SECONDS = 180
+MIN_TAKEOVER_DELAY_SECONDS = 3
+MAX_TAKEOVER_DELAY_SECONDS = 86_400
 LEGACY_PERMISSION_MAP = {
     "read": "browse",
     "reply": "chat",
@@ -91,9 +95,62 @@ def _permission_settings_payload(avatar) -> dict:
     return {
         "avatarId": avatar.id,
         "permissions": _stored_avatar_permissions(avatar),
+        "takeoverReplyDelaySeconds": _stored_takeover_delay(avatar),
     }
 
 
+def _stored_takeover_delay(avatar) -> int:
+    raw = (avatar.config or {}).get(TAKEOVER_DELAY_KEY, DEFAULT_TAKEOVER_DELAY_SECONDS)
+    if isinstance(raw, bool):
+        return DEFAULT_TAKEOVER_DELAY_SECONDS
+    try:
+        delay = int(raw)
+    except (TypeError, ValueError):
+        return DEFAULT_TAKEOVER_DELAY_SECONDS
+    if not MIN_TAKEOVER_DELAY_SECONDS <= delay <= MAX_TAKEOVER_DELAY_SECONDS:
+        return DEFAULT_TAKEOVER_DELAY_SECONDS
+    return delay
+
+
+def _validate_takeover_delay(value) -> int:
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise ValueError("自动回复等待时间必须是整数秒")
+    if not MIN_TAKEOVER_DELAY_SECONDS <= value <= MAX_TAKEOVER_DELAY_SECONDS:
+        raise ValueError("自动回复等待时间需在 3 秒到 24 小时之间")
+    return value
+
+
+def _disable_other_takeovers(db: Session, avatar) -> list[str]:
+    disabled_ids = []
+    others = (
+        db.query(Avatar)
+        .filter(Avatar.owner_id == avatar.owner_id, Avatar.id != avatar.id)
+        .all()
+    )
+    for other in others:
+        permissions = _stored_avatar_permissions(other)
+        if "takeover" not in permissions:
+            continue
+        other.config = {
+            **(other.config or {}),
+            AVATAR_PERMISSION_KEY: [item for item in permissions if item != "takeover"],
+        }
+        disabled_ids.append(other.id)
+        tasks = (
+            db.query(TakeoverReplyTask)
+            .filter(
+                TakeoverReplyTask.avatar_id == other.id,
+                TakeoverReplyTask.status.in_(("pending", "generating", "ready", "sending")),
+            )
+            .all()
+        )
+        for task in tasks:
+            task.status = "cancelled"
+            task.cancel_reason = "another_avatar_takeover_enabled"
+            task.locked_at = None
+    return disabled_ids
+
+
 def _require_authorization(db: Session, avatar_id: str, authorization_id: str) -> Authorization:
     authorization = (
         db.query(Authorization)
@@ -144,10 +201,19 @@ def update_permission_settings(
     db: Session = Depends(get_db),
 ):
     avatar = _require_owned_avatar(db, avatar_id, authorization)
-    if "permissions" not in payload:
-        return fail("缺少 permissions", 400)
+    if "permissions" not in payload and TAKEOVER_DELAY_KEY not in payload:
+        return fail("缺少授权设置", 400)
     try:
-        permissions = _normalize_avatar_permissions(payload["permissions"])
+        permissions = (
+            _normalize_avatar_permissions(payload["permissions"])
+            if "permissions" in payload
+            else _stored_avatar_permissions(avatar)
+        )
+        takeover_delay = (
+            _validate_takeover_delay(payload[TAKEOVER_DELAY_KEY])
+            if TAKEOVER_DELAY_KEY in payload
+            else _stored_takeover_delay(avatar)
+        )
     except ValueError as exc:
         return fail(str(exc), 400)
 
@@ -155,7 +221,9 @@ def update_permission_settings(
     avatar.config = {
         **(avatar.config or {}),
         AVATAR_PERMISSION_KEY: permissions,
+        TAKEOVER_DELAY_KEY: takeover_delay,
     }
+    disabled_avatar_ids = _disable_other_takeovers(db, avatar) if "takeover" in permissions else []
     cursor = db.query(TakeoverCursor).filter(TakeoverCursor.avatar_id == avatar.id).first()
     if cursor and "takeover" in permissions and "takeover" not in previous_permissions:
         cursor.initialized = False
@@ -179,7 +247,9 @@ def update_permission_settings(
             task.locked_at = None
     db.commit()
     db.refresh(avatar)
-    return ok(_permission_settings_payload(avatar), "授权设置已保存")
+    response = _permission_settings_payload(avatar)
+    response["disabledAvatarIds"] = disabled_avatar_ids
+    return ok(response, "授权设置已保存")
 
 
 @router.get("/avatar/{avatar_id}/authorizations")
@@ -240,7 +310,7 @@ def create_auth(
         status="active",
         takeover_enabled=False,
         takeover_mode="immediate",
-        takeover_delay_seconds=30,
+        takeover_delay_seconds=DEFAULT_TAKEOVER_DELAY_SECONDS,
     )
     db.add(item)
     db.commit()