fix(feishu): persist hosted document images

Author: NewSunH

docs/.vitepress/data/generated/feishu.json

@@ -90,7 +90,7 @@
         "order": 2,
         "documentId": "H5x1dK6LzoVFmuxUzDicmuQ1nbb",
         "objectType": "docx",
-        "revisionId": 36
+        "revisionId": 42
       }
     ]
   }

docs/public/feishu/wiki/WHFXw13vEiD8Hikfp3ScU33JnXe/174c92ca95639c69ea4b7e8d.png

@@ -12,6 +12,8 @@ lastUpdated: false
   <h1>Session 01｜GPU Programming Model</h1>
 </header>
 
+![](/feishu/wiki/WHFXw13vEiD8Hikfp3ScU33JnXe/174c92ca95639c69ea4b7e8d.png)
+
 为什么 GPU 上的一个线程不比 CPU 更快，却能完成更大规模的并行计算？
 
 CUDA 为何要把线程组织成 Thread、Block 和 Grid？Warp 又是什么？

docs/wiki/WHFXw13vEiD8Hikfp3ScU33JnXe.md

@@ -1,6 +1,11 @@
 import { once } from 'node:events'
+import { Readable } from 'node:stream'
 import * as lark from '@larksuiteoapi/node-sdk'
 
+const FEISHU_MEDIA_HOSTS = new Set([
+  'internal-api-drive-stream.feishu.cn'
+])
+
 const silentLogger = {
   error() {},
   warn() {},
@@ -163,6 +168,53 @@ export async function downloadDocumentMedia(client, fileToken) {
   }
 }
 
+export async function downloadFeishuMediaUrl(sourceUrl) {
+  let url
+  try {
+    url = new URL(sourceUrl)
+  } catch {
+    throw new Error('Download hosted Feishu media failed: invalid URL')
+  }
+  if (
+    url.protocol !== 'https:' ||
+    url.username ||
+    url.password ||
+    !FEISHU_MEDIA_HOSTS.has(url.hostname)
+  ) {
+    throw new Error('Download hosted Feishu media failed: untrusted URL')
+  }
+
+  let response
+  try {
+    response = await fetch(url, {
+      redirect: 'error',
+      signal: AbortSignal.timeout(30_000)
+    })
+  } catch (error) {
+    throw new Error(
+      `Download hosted Feishu media failed: ${error?.message || 'request failed'}`
+    )
+  }
+  if (!response.ok) {
+    throw new Error(
+      `Download hosted Feishu media failed (${response.status}): HTTP error`
+    )
+  }
+  if (!response.body) {
+    throw new Error('Download hosted Feishu media failed: empty response')
+  }
+
+  return {
+    buffer: await streamToBuffer(Readable.fromWeb(response.body)),
+    contentType: String(
+      response.headers.get('content-type') ?? 'application/octet-stream'
+    ),
+    contentDisposition: String(
+      response.headers.get('content-disposition') ?? ''
+    )
+  }
+}
+
 export async function listCalendars(client) {
   const calendars = []
   let pageToken

scripts/feishu/client.mjs

@@ -1,6 +1,9 @@
 import assert from 'node:assert/strict'
 import test from 'node:test'
-import { listCalendars } from './client.mjs'
+import {
+  downloadFeishuMediaUrl,
+  listCalendars
+} from './client.mjs'
 
 test('sanitizes SDK request failures without leaking authorization headers', async () => {
   const sdkError = new Error('Request failed with status code 400')
@@ -36,3 +39,33 @@ test('sanitizes SDK request failures without leaking authorization headers', asy
     return true
   })
 })
+
+test('downloads only allowlisted hosted Feishu media URLs', async () => {
+  const originalFetch = globalThis.fetch
+  globalThis.fetch = async (url, options) => {
+    assert.equal(url.hostname, 'internal-api-drive-stream.feishu.cn')
+    assert.equal(options.redirect, 'error')
+    return new Response(new Uint8Array([137, 80, 78, 71]), {
+      status: 200,
+      headers: {
+        'content-type': 'image/png',
+        'content-length': '4'
+      }
+    })
+  }
+
+  try {
+    const media = await downloadFeishuMediaUrl(
+      'https://internal-api-drive-stream.feishu.cn/space/image?code=test'
+    )
+    assert.deepEqual(media.buffer, Buffer.from([137, 80, 78, 71]))
+    assert.equal(media.contentType, 'image/png')
+
+    await assert.rejects(
+      downloadFeishuMediaUrl('https://example.com/image.png'),
+      /untrusted URL/
+    )
+  } finally {
+    globalThis.fetch = originalFetch
+  }
+})

scripts/feishu/client.test.mjs

@@ -8,6 +8,11 @@ const SUB_PAGE_LIST_PATTERN =
 const SUB_PAGE_ENTRY_PATTERN = /<sub-page\b[^>]*\/\s*>/gi
 const CITE_PATTERN = /<cite\b([^>]*)>\s*<\/cite>/gi
 const TABLE_PATTERN = /<table\b[^>]*>[\s\S]*?<\/table>/gi
+const MARKDOWN_IMAGE_PATTERN =
+  /!\[([^\]\n]*)\]\((https:\/\/[^)\s]+)\)/g
+const FEISHU_MEDIA_HOSTS = new Set([
+  'internal-api-drive-stream.feishu.cn'
+])
 const TABLE_TAG_PATTERN =
   /<\s*(\/?)\s*([A-Za-z][A-Za-z0-9_-]*)(?=[\s/>])([^>]*)>/g
 const TABLE_TAGS = new Set([
@@ -65,6 +70,10 @@ export async function normalizeFeishuMarkdown(
     context,
     downloadAsset
   })
+  markdown = await replaceHostedFeishuImages(markdown, {
+    context,
+    downloadAsset
+  })
   const protectedTables = protectSafeTables(markdown, context)
   markdown = protectedTables.markdown
   markdown = convertSupportedXml(markdown, { context, renderSubPageList })
@@ -143,6 +152,46 @@ async function replaceMediaTags(markdown, options) {
   return output + markdown.slice(cursor)
 }
 
+async function replaceHostedFeishuImages(markdown, options) {
+  const matches = [...markdown.matchAll(MARKDOWN_IMAGE_PATTERN)].filter(
+    (match) => isHostedFeishuMediaUrl(match[2])
+  )
+  if (matches.length === 0) return markdown
+  if (typeof options.downloadAsset !== 'function') {
+    throw new Error(`${options.context} contains media but no downloader`)
+  }
+
+  let output = ''
+  let cursor = 0
+  for (const match of matches) {
+    output += markdown.slice(cursor, match.index)
+    const label = match[1]
+    const asset = await options.downloadAsset({
+      sourceUrl: match[2],
+      name: label || undefined,
+      kind: 'img'
+    })
+    output += `![${label}](${asset.publicPath})`
+    cursor = match.index + match[0].length
+  }
+
+  return output + markdown.slice(cursor)
+}
+
+function isHostedFeishuMediaUrl(value) {
+  try {
+    const url = new URL(value)
+    return (
+      url.protocol === 'https:' &&
+      !url.username &&
+      !url.password &&
+      FEISHU_MEDIA_HOSTS.has(url.hostname)
+    )
+  } catch {
+    return false
+  }
+}
+
 function parseAttributes(source) {
   const attributes = {}
   for (const match of source.matchAll(ATTRIBUTE_PATTERN)) {

scripts/feishu/markdown.mjs

@@ -87,6 +87,35 @@ test('downloads Feishu image tags and turns them into local Markdown assets', as
   assert.equal(output, '![架构图](/feishu/01/abc.png)\n')
 })
 
+test('downloads hosted Feishu Markdown images and leaves other remote images alone', async () => {
+  const calls = []
+  const sourceUrl =
+    'https://internal-api-drive-stream.feishu.cn/space/api/box/stream/download/authcode/?code=temporary_code'
+  const output = await normalizeFeishuMarkdown(
+    `# Title\n\n![架构图](${sourceUrl})\n\n![](https://example.com/public.png)\n`,
+    {
+      sessionId: '01',
+      wikiRoutes: new Map(),
+      async downloadAsset(input) {
+        calls.push(input)
+        return { publicPath: '/feishu/01/hosted.png' }
+      }
+    }
+  )
+
+  assert.deepEqual(calls, [
+    {
+      sourceUrl,
+      name: '架构图',
+      kind: 'img'
+    }
+  ])
+  assert.equal(
+    output,
+    '![架构图](/feishu/01/hosted.png)\n\n![](https://example.com/public.png)\n'
+  )
+})
+
 test('converts common Feishu extension blocks', async () => {
   const output = await normalizeFeishuMarkdown(
     '# Title\n\n<callout emoji="💡"><p>重点</p></callout>\n' +

scripts/feishu/markdown.test.mjs

@@ -16,6 +16,7 @@ import { fileURLToPath } from 'node:url'
 import {
   createFeishuClient,
   downloadDocumentMedia,
+  downloadFeishuMediaUrl,
   fetchWikiMarkdown,
   listCalendarEvents,
   listWikiNodes,
@@ -474,15 +475,27 @@ function createMediaDownloader({
   const mediaCache = new Map()
   let lastMediaRequest = 0
 
-  return async function downloadAsset({ token, name, kind }) {
-    if (mediaCache.has(token)) return mediaCache.get(token)
+  return async function downloadAsset({ token, sourceUrl, name, kind }) {
+    const mediaKey = token ? `token:${token}` : sourceUrl ? `url:${sourceUrl}` : ''
+    if (!mediaKey) {
+      throw new Error(`${contextLabel} contains media without a download source`)
+    }
+    if (mediaCache.has(mediaKey)) return mediaCache.get(mediaKey)
 
     const elapsed = Date.now() - lastMediaRequest
     if (elapsed < 220) await delay(220 - elapsed)
-    const media = await downloadDocumentMedia(client, token)
+    const media = sourceUrl
+      ? await downloadFeishuMediaUrl(sourceUrl)
+      : await downloadDocumentMedia(client, token)
     lastMediaRequest = Date.now()
 
-    if (media.contentType.split(';', 1)[0].trim() === 'image/svg+xml') {
+    const mediaType = media.contentType.split(';', 1)[0].trim().toLowerCase()
+    if (kind === 'img' && !mediaType.startsWith('image/')) {
+      throw new Error(
+        `${contextLabel} image download returned ${mediaType || 'an unknown content type'}`
+      )
+    }
+    if (mediaType === 'image/svg+xml') {
       throw new Error(
         `${contextLabel} contains an SVG asset; convert it to PNG ` +
           'before publishing to avoid active content'
@@ -497,7 +510,7 @@ function createMediaDownloader({
     const result = {
       publicPath: `${publicBasePath}/${fileName}`
     }
-    mediaCache.set(token, result)
+    mediaCache.set(mediaKey, result)
     return result
   }
 }