feat: 实现 sub2api 审计请求转换服务

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.github
+__pycache__
+*.py[cod]
+.pytest_cache
+.venv
+venv
+data
+.env

.env.example

@@ -0,0 +1,21 @@
+# 对外映射端口
+AUDITER_PORT=8080
+
+# 管理网页/API 的可选访问令牌；生产环境强烈建议设置
+ADMIN_TOKEN=replace-with-a-long-random-admin-token
+
+# sub2api 调用本适配器时使用的可选 Bearer Token
+# 设置后，请把同一值填入 sub2api 审计节点的 Token 字段
+AUDITER_TOKEN=replace-with-a-long-random-auditer-token
+
+LOG_LEVEL=info
+MAX_REQUEST_BODY_BYTES=2097152
+MAX_INPUT_CHARS=200000
+
+# 也可以通过环境变量提供首次启动默认值；网页保存后以 /data/config.json 为准
+# UPSTREAM_BASE_URL=https://api.example.com/v1
+# UPSTREAM_API_KEY=sk-xxxxxxxx
+# UPSTREAM_MODEL=gpt-4.1-mini
+# UPSTREAM_TIMEOUT_SECONDS=20
+# UPSTREAM_MAX_TOKENS=256
+# AUDIT_PROMPT=你是内容安全审核器……

.github/workflows/test.yml

@@ -0,0 +1,34 @@
+name: test
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  pytest:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+          cache: pip
+      - run: python -m pip install -e '.[test]'
+      - run: pytest -q
+
+  docker-build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: docker/setup-buildx-action@v3
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: false

.gitignore

@@ -1,145 +1,37 @@
-# Byte-compiled / optimized / DLL files
-log.txt
+# Python
 __pycache__/
 *.py[cod]
-*$py.class
-
-# C extensions
 *.so
-
-# Distribution / packaging
-.Python
+*.egg-info/
 build/
-develop-eggs/
 dist/
-downloads/
-eggs/
-.eggs/
-lib/
-lib64/
-parts/
-sdist/
-var/
-wheels/
-pip-wheel-metadata/
-share/python-wheels/
-*.egg-info/
-.installed.cfg
-*.egg
-MANIFEST
 
-# PyInstaller
-*.manifest
-*.spec
-
-# Installer logs
-pip-log.txt
-pip-delete-this-directory.txt
-
-# Unit test / coverage reports
-htmlcov/
-.tox/
-.nox/
-.coverage
-.coverage.*
-.cache
-nosetests.xml
-coverage.xml
-*.cover
-*.py,cover
-.hypothesis/
+# Tests and tooling
 .pytest_cache/
+.coverage
+htmlcov/
+.mypy_cache/
+.ruff_cache/
 
-# Translations
-*.mo
-*.pot
-
-# Django stuff:
-*.log
-local_settings.py
-db.sqlite3
-db.sqlite3
-
-# Flask stuff:
-instance/
-.webassets-cache
-
-# Scrapy stuff:
-.scrapy
-
-# Sphinx documentation
-docs/_build/
-
-# PyBuilder
-target/
-
-# Jupyter Notebook
-.ipynb_checkpoints
-
-# IPython
-profile_default/
-ipython_config.py
-
-# pyenv
-.python-version
-
-# pipenv
-Pipfile.lock
-
-# PEP 582
-__pypackages__/
-
-# Celery stuff
-celerybeat-schedule
-celerybeat.pid
-
-# SageMath parsed files
-*.sage.py
-
-# Environments
+# Virtual environments and local secrets
 .env
-.venv
-env/
+.venv/
 venv/
-ENV/
-env.bak/
-venv.bak/
-
-# Spyder project settings
-.spyderproject
-.spyproject
-
-# Rope project settings
-.ropeproject
-
-# mkdocs documentation
-/site
-
-# mypy
-.mypy_cache/
-.dmypy.json
-dmypy.json
+env/
+.direnv/
 
-# Pyre type checker
-.pyre/
+# Sub2apiAuditer runtime configuration (contains the upstream API key)
+/data/
+config.json
 
-# IDEs
+# IDE / OS
 .vscode/
 .idea/
 *.swp
 *.swo
 *~
 .DS_Store
 
-# PetSitter specific
+# Logs
 *.log
-petsitter.egg-info/
-/harness/models/*/
-!/harness/models/.gitkeep
-
-# direnv local environments
-.direnv/
-
-# swapharness clones the prompt repo here on first use
-system-prompts-and-models-of-ai-tools/
-
+log.txt

Dockerfile

@@ -0,0 +1,28 @@
+FROM python:3.12-slim AS runtime
+
+ENV PYTHONUNBUFFERED=1 \
+    PYTHONDONTWRITEBYTECODE=1 \
+    PIP_DISABLE_PIP_VERSION_CHECK=1 \
+    CONFIG_PATH=/data/config.json \
+    HOST=0.0.0.0 \
+    PORT=8080
+
+WORKDIR /app
+
+COPY pyproject.toml README.md LICENSE.MIT ./
+RUN mkdir -p ./src
+COPY src/sub2api_auditer ./src/sub2api_auditer
+
+RUN pip install --no-cache-dir . \
+    && useradd --system --uid 10001 --create-home --home-dir /home/auditer auditer \
+    && mkdir -p /data \
+    && chown -R auditer:auditer /data /home/auditer
+
+USER auditer
+EXPOSE 8080
+VOLUME ["/data"]
+
+HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
+  CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:8080/healthz', timeout=2)" || exit 1
+
+CMD ["sub2api-auditer", "--host", "0.0.0.0", "--port", "8080"]