✨ feat(ai): 添加AI相关功能，包括小说分镜生成、图像生成、语音合成等模块

[zhangzqs]

No description provided.

[fennoai]

Code Review Summary

This PR introduces solid AI integration functionality but requires attention to several critical issues before merging:

Critical Issues:

• Debug print statement leaking sensitive data in production
• Prompt injection vulnerabilities in LLM input handling
• Context parameter ignored leading to broken cancellation

Key Improvements Needed:

• Input validation across all public APIs
• Security hardening for user inputs
• Documentation for all public APIs

See inline comments for specific recommendations.

[fennoai]

🔴 CRITICAL: Remove debug print statement

This leaks potentially sensitive LLM responses (user content, novel text) to stdout in production. Also creates performance overhead with large payloads.

Security: CWE-532 (Sensitive Information in Logs)

Remove this line before merging.

[fennoai]

🔴 CRITICAL: Handle JSON marshal errors

Silently ignoring errors will cause empty strings in prompts, leading to incorrect AI responses.

Suggested change

	voiceStylesJSON, _ := json.MarshalIndent(input.AvailableVoiceStyles, "", " ")
	voiceStylesJSON, err := json.Marshal(input.AvailableVoiceStyles)
	if err != nil {
	return nil, fmt.Errorf("failed to marshal voice styles: %w", err)
	}

Performance tip: Use Marshal instead of MarshalIndent to reduce token costs (~10-15% savings).

[fennoai]

🔴 CRITICAL: Prompt injection vulnerability

User inputs (NovelTitle, ChapterTitle, Content) are directly interpolated without validation or sanitization. Attackers can manipulate AI behavior through crafted inputs.

Security: OWASP LLM01:2023 (Prompt Injection)

Recommendations:

1. Add input validation with length limits
2. Sanitize special characters
3. Use structured delimiters to separate user content from system instructions

[fennoai]

🟡 Missing input validation

No validation for empty or oversized inputs. This risks API cost explosion and resource exhaustion.

Recommendation:

func (g *GnxAIGC) SummaryChapter(ctx context.Context, input SummaryChapterInput) (*SummaryChapterOutput, error) {
    if input.Content == "" || input.NovelTitle == "" {
        return nil, errors.New("content and title are required")
    }
    if len(input.Content) > 100000 {
        return nil, errors.New("content exceeds maximum length")
    }
    // ... continue
}

[fennoai]

⚡ Performance: Move schema to package constant

This large JSON schema map is rebuilt on every call (~20+ allocations). Since it's constant data, move to package level:

var summaryChapterJSONSchema = map[string]any{
    // schema definition
}

Estimated savings: 2-3KB memory + CPU cycles per call

[fennoai]

🔴 CRITICAL: Context parameter ignored

Function accepts ctx but uses context.TODO(). This breaks timeout/cancellation propagation, causing resource leaks and inability to cancel long-running operations.

Suggested change

	resp, err := g.client.Images.Generate(context.TODO(), openai.ImageGenerateParams{
	resp, err := g.client.Images.Generate(ctx, openai.ImageGenerateParams{

[fennoai]

🟡 Security: Missing size validation before base64 decode

No bounds checking on response size. A malicious API response could cause OOM.

Security: CWE-400 (Resource Exhaustion)

Recommendation:

const MaxImageSize = 50 * 1024 * 1024 // 50MB
if base64.StdEncoding.DecodedLen(len(resp.Data[0].B64JSON)) > MaxImageSize {
    return nil, errors.New("image data exceeds maximum size")
}

[fennoai]

🟡 Extract magic values to constants

Hardcoded model names and URLs make updates difficult.

const (
    DefaultBaseURL       = "https://openai.qiniu.com/v1"
    DefaultImageModel    = "gemini-2.5-flash-image"
    DefaultLanguageModel = "deepseek/deepseek-v3.1-terminus"
)

Security note: Consider validating that BaseURL uses HTTPS to prevent credential leakage.

[fennoai]

🟡 Security: Missing size validation for audio data

Same issue as image generation - no bounds checking before base64 decode.

Apply similar fix:

const MaxAudioSize = 10 * 1024 * 1024 // 10MB
if base64.StdEncoding.DecodedLen(len(ttsResp.Data)) > MaxAudioSize {
    return nil, errors.New("audio data exceeds maximum size")
}

[fennoai]

🟡 Missing input validation

Add validation for text and speed ratio:

func (g *GnxAIGC) TextToSpeechSimple(ctx context.Context, text, voiceType string, ratio float64) ([]byte, error) {
    if text == "" {
        return nil, errors.New("text cannot be empty")
    }
    if ratio <= 0 || ratio > 3.0 {
        return nil, fmt.Errorf("speed ratio must be between 0 and 3.0, got %f", ratio)
    }
    // ...
}

[fennoai]

🔵 Test naming convention

Test name TestSummaryChapter_Test is redundant and unclear. Consider renaming to:

func TestChatCompletionBasic(t *testing.T) {

Or remove if it's just a debug test.