Harden auth/vault path sanitization and clean WeKnora docs

rust/crates/mnote-web/src/routes/bridge.rs

@@ -53,6 +53,16 @@ fn ok_response(context: &RequestContext, result: Value) -> (StatusCode, Json<Val
     )
 }
 
+/// Cap bridge overview page size to avoid unbounded fan-out / memory pressure.
+const BRIDGE_WORKSPACE_LIMIT_MAX: u32 = 200;
+const BRIDGE_WORKSPACE_LIMIT_DEFAULT: u32 = 50;
+
+fn clamped_bridge_limit(limit: Option<u32>) -> u32 {
+    limit
+        .unwrap_or(BRIDGE_WORKSPACE_LIMIT_DEFAULT)
+        .clamp(1, BRIDGE_WORKSPACE_LIMIT_MAX)
+}
+
 fn workspace_query_payload(
     workspace_id: &str,
     query: &BridgeWorkspaceQuery,
@@ -61,7 +71,7 @@ fn workspace_query_payload(
         name: "bridge.workspace.overview".into(),
         payload: json!({
             "workspaceId": workspace_id,
-            "limit": query.limit.unwrap_or(50),
+            "limit": clamped_bridge_limit(query.limit),
             "cursor": query.cursor,
             "commandStatus": query.command_status,
             "eventStatus": query.event_status,
@@ -82,14 +92,27 @@ async fn execute_bridge_query(
     execute_runtime_query_via_legacy_cloud(config, context, Some(workspace_id), query).await
 }
 
+fn require_resolved_workspace_id(
+    context: &RequestContext,
+    query_workspace_id: Option<&str>,
+) -> Result<String, WebError> {
+    resolve_effective_workspace_id(context, query_workspace_id, true)?.ok_or_else(|| {
+        WebError::bad_request_code(
+            "workspace_required",
+            "缺少 workspaceId，请在 query 或请求头中提供有效工作区",
+        )
+        .with_context(context)
+        .with_header("x-error-phase", "workspace_resolve")
+    })
+}
+
 pub async fn workspace(
     State(state): State<AppState>,
     Extension(context): Extension<RequestContext>,
     Query(query): Query<BridgeWorkspaceQuery>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let effective_workspace_id =
-        resolve_effective_workspace_id(&context, query.workspace_id.as_deref(), true)?
-            .expect("workspace_required 已确保存在");
+        require_resolved_workspace_id(&context, query.workspace_id.as_deref())?;
     let result = execute_bridge_query(
         state.config(),
         &context,
@@ -106,8 +129,7 @@ pub async fn request(
     Query(query): Query<BridgeRequestQuery>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let effective_workspace_id =
-        resolve_effective_workspace_id(&context, query.workspace_id.as_deref(), true)?
-            .expect("workspace_required 已确保存在");
+        require_resolved_workspace_id(&context, query.workspace_id.as_deref())?;
     let result = execute_bridge_query(
         state.config(),
         &context,
@@ -131,8 +153,7 @@ pub async fn trace(
     Query(query): Query<BridgeTraceQuery>,
 ) -> Result<(StatusCode, Json<Value>), WebError> {
     let effective_workspace_id =
-        resolve_effective_workspace_id(&context, query.workspace_id.as_deref(), true)?
-            .expect("workspace_required 已确保存在");
+        require_resolved_workspace_id(&context, query.workspace_id.as_deref())?;
     let result = execute_bridge_query(
         state.config(),
         &context,
@@ -177,6 +198,7 @@ mod tests {
             dev_user_id: "dev-user".into(),
             dev_user_name: "开发用户".into(),
             dev_user_email: "dev@mnote.local".into(),
+            environment: "dev".into(),
         }))
     }