Files
new-api/common/body_storage.go
T
LucasandClaude Fable 5 d6b5ce99de fix(relay): set Request.GetBody so the HTTP/2 transport can transparently retry after an upstream stream reset (#6249)
* fix(relay): set Request.GetBody so the HTTP/2 transport can transparently retry after an upstream stream reset

The outbound request body is a type-erased io.Reader over BodyStorage, so
net/http cannot derive Request.GetBody (it only does so for *bytes.Reader,
*bytes.Buffer and *strings.Reader). With GetBody nil, the HTTP/2 transport
cannot transparently retry a request once the body has been written and the
upstream resets the stream with a retryable error (REFUSED_STREAM, or a
connection-level GOAWAY); the relay request then fails with:

    http2: Transport: cannot retry err [...] after Request.Body was written;
    define Request.GetBody to avoid this error

This affects every relay path that goes through DoApiRequest (chat, claude,
gemini, responses, embedding, image, rerank).

BodyStorage (memory and disk) already implements io.Seeker, so replay support
only needed wiring:

- NewOutboundJSONBody additionally returns a getBody that rewinds the storage
  and hands out a fresh non-closing reader. The transport only calls GetBody
  after the previous attempt's body has been abandoned, so the rewind cannot
  race an in-flight read.
- RelayInfo carries it in the new UpstreamRequestGetBody field, set alongside
  UpstreamRequestBodySize by the handlers that build storage-backed bodies.
- applyUpstreamGetBody (symmetric with applyUpstreamContentLength) wires it
  into DoApiRequest/DoFormRequest/DoTaskApiRequest, only when req.GetBody is
  still nil.

Also remove the hand-rolled GetBody override in DoTaskApiRequest: it returned
the same already-consumed reader, so any transport-level replay would have
silently sent an empty body, and it clobbered the correct snapshot-based
GetBody that net/http derives from the *bytes.Reader bodies the task adaptors
pass in. For non-replayable bodies GetBody now stays nil, so a retry fails
loudly instead of corrupting the request.

Covered by unit tests plus an end-to-end raw-frame HTTP/2 test that resets
the first stream with REFUSED_STREAM after the body is written and asserts
the transport transparently retries with the complete body.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(relay): hand out independent readers from GetBody (address review)

Per the http.Request.GetBody contract ("returns a new copy of Body"),
each call must yield a reader with its own cursor. The previous
implementation rewound and reused the shared BodyStorage, so two
consecutive GetBody readers would interfere with each other, and a
replay could disturb the primary body's offset under extreme transport
timing (e.g. attempt N's body write not yet fully abandoned when the
transport builds attempt N+1).

Instead of snapshotting the payload (an extra copy), add
BodyStorage.NewReader, which returns an independent zero-copy reader:

- memory mode: a fresh bytes.Reader over the same immutable backing
  array;
- disk mode: a separate file descriptor over the cache file, so the
  transport closing a replayed body only closes that descriptor.

NewOutboundJSONBody's getBody now simply hands out storage.NewReader,
and once the handler releases the storage, GetBody fails with
ErrStorageClosed instead of replaying stale data.

Tests: interleaved reads across two replay readers and the primary
body each observe exactly their own byte stream, for both the memory
and the disk-backed storage; the existing GetBody and HTTP/2 retry
suites still pass (h2 e2e tests flake-free with -count=20).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(relay): bind replayable metadata on pass-through requests

* fix(relay): reset upstream body metadata between channels

* test(relay): cover replay across retries and channel attempts

* fix(relay): stop following upstream redirects

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-06 15:56:38 +08:00

353 lines
8.5 KiB
Go

package common
import (
"bytes"
"fmt"
"io"
"os"
"sync"
"sync/atomic"
"time"
)
// BodyStorage 请求体存储接口
type BodyStorage interface {
io.ReadSeeker
io.Closer
// Bytes 获取全部内容
Bytes() ([]byte, error)
// Size 获取数据大小
Size() int64
// IsDisk 是否是磁盘存储
IsDisk() bool
// NewReader returns an independent reader positioned at the start of the
// stored payload. Each call returns a reader with its own cursor, so
// callers (e.g. http.Request.GetBody) can replay the body concurrently
// with, or after, other readers without sharing seek state. Closing the
// returned reader releases only that reader, never the storage itself;
// after the storage has been closed, NewReader returns ErrStorageClosed.
NewReader() (io.ReadCloser, error)
}
// ErrStorageClosed 存储已关闭错误
var ErrStorageClosed = fmt.Errorf("body storage is closed")
// memoryStorage 内存存储实现
type memoryStorage struct {
data []byte
reader *bytes.Reader
size int64
closed int32
mu sync.Mutex
}
func newMemoryStorage(data []byte) *memoryStorage {
size := int64(len(data))
IncrementMemoryBuffers(size)
return &memoryStorage{
data: data,
reader: bytes.NewReader(data),
size: size,
}
}
func (m *memoryStorage) Read(p []byte) (n int, err error) {
m.mu.Lock()
defer m.mu.Unlock()
if atomic.LoadInt32(&m.closed) == 1 {
return 0, ErrStorageClosed
}
return m.reader.Read(p)
}
func (m *memoryStorage) Seek(offset int64, whence int) (int64, error) {
m.mu.Lock()
defer m.mu.Unlock()
if atomic.LoadInt32(&m.closed) == 1 {
return 0, ErrStorageClosed
}
return m.reader.Seek(offset, whence)
}
func (m *memoryStorage) Close() error {
m.mu.Lock()
defer m.mu.Unlock()
if atomic.CompareAndSwapInt32(&m.closed, 0, 1) {
DecrementMemoryBuffers(m.size)
}
return nil
}
func (m *memoryStorage) Bytes() ([]byte, error) {
m.mu.Lock()
defer m.mu.Unlock()
if atomic.LoadInt32(&m.closed) == 1 {
return nil, ErrStorageClosed
}
return m.data, nil
}
func (m *memoryStorage) NewReader() (io.ReadCloser, error) {
m.mu.Lock()
defer m.mu.Unlock()
if atomic.LoadInt32(&m.closed) == 1 {
return nil, ErrStorageClosed
}
// A fresh bytes.Reader over the shared immutable backing array: an
// independent cursor at zero copy cost. NopCloser keeps Close a no-op, so
// the storage lifecycle stays owned by whoever holds the storage itself.
return io.NopCloser(bytes.NewReader(m.data)), nil
}
func (m *memoryStorage) Size() int64 {
return m.size
}
func (m *memoryStorage) IsDisk() bool {
return false
}
// diskStorage 磁盘存储实现
type diskStorage struct {
file *os.File
filePath string
size int64
closed int32
mu sync.Mutex
}
func newDiskStorage(data []byte, cachePath string) (*diskStorage, error) {
// 使用统一的缓存目录管理
filePath, file, err := CreateDiskCacheFile(DiskCacheTypeBody)
if err != nil {
return nil, err
}
// 写入数据
n, err := file.Write(data)
if err != nil {
file.Close()
os.Remove(filePath)
return nil, fmt.Errorf("failed to write to temp file: %w", err)
}
// 重置文件指针
if _, err := file.Seek(0, io.SeekStart); err != nil {
file.Close()
os.Remove(filePath)
return nil, fmt.Errorf("failed to seek temp file: %w", err)
}
size := int64(n)
IncrementDiskFiles(size)
return &diskStorage{
file: file,
filePath: filePath,
size: size,
}, nil
}
func newDiskStorageFromReader(reader io.Reader, maxBytes int64, cachePath string) (*diskStorage, error) {
// 使用统一的缓存目录管理
filePath, file, err := CreateDiskCacheFile(DiskCacheTypeBody)
if err != nil {
return nil, err
}
// 从 reader 读取并写入文件
written, err := io.Copy(file, io.LimitReader(reader, maxBytes+1))
if err != nil {
file.Close()
os.Remove(filePath)
return nil, fmt.Errorf("failed to write to temp file: %w", err)
}
if written > maxBytes {
file.Close()
os.Remove(filePath)
return nil, ErrRequestBodyTooLarge
}
// 重置文件指针
if _, err := file.Seek(0, io.SeekStart); err != nil {
file.Close()
os.Remove(filePath)
return nil, fmt.Errorf("failed to seek temp file: %w", err)
}
IncrementDiskFiles(written)
return &diskStorage{
file: file,
filePath: filePath,
size: written,
}, nil
}
func (d *diskStorage) Read(p []byte) (n int, err error) {
d.mu.Lock()
defer d.mu.Unlock()
if atomic.LoadInt32(&d.closed) == 1 {
return 0, ErrStorageClosed
}
return d.file.Read(p)
}
func (d *diskStorage) Seek(offset int64, whence int) (int64, error) {
d.mu.Lock()
defer d.mu.Unlock()
if atomic.LoadInt32(&d.closed) == 1 {
return 0, ErrStorageClosed
}
return d.file.Seek(offset, whence)
}
func (d *diskStorage) Close() error {
d.mu.Lock()
defer d.mu.Unlock()
if atomic.CompareAndSwapInt32(&d.closed, 0, 1) {
d.file.Close()
os.Remove(d.filePath)
DecrementDiskFiles(d.size)
}
return nil
}
func (d *diskStorage) Bytes() ([]byte, error) {
d.mu.Lock()
defer d.mu.Unlock()
if atomic.LoadInt32(&d.closed) == 1 {
return nil, ErrStorageClosed
}
// 保存当前位置
currentPos, err := d.file.Seek(0, io.SeekCurrent)
if err != nil {
return nil, err
}
// 移动到开头
if _, err := d.file.Seek(0, io.SeekStart); err != nil {
return nil, err
}
// 读取全部内容
data := make([]byte, d.size)
_, err = io.ReadFull(d.file, data)
if err != nil {
return nil, err
}
// 恢复位置
if _, err := d.file.Seek(currentPos, io.SeekStart); err != nil {
return nil, err
}
return data, nil
}
func (d *diskStorage) NewReader() (io.ReadCloser, error) {
d.mu.Lock()
defer d.mu.Unlock()
if atomic.LoadInt32(&d.closed) == 1 {
return nil, ErrStorageClosed
}
// A separate file descriptor over the same cache file: an independent
// cursor at zero copy cost. Closing the returned reader closes only that
// descriptor; the storage keeps owning the primary descriptor and the
// file's lifetime. Readers opened before Close stay usable even after the
// file is unlinked, as the descriptor keeps the inode alive.
file, err := os.Open(d.filePath)
if err != nil {
return nil, fmt.Errorf("failed to open body cache file for replay: %w", err)
}
return file, nil
}
func (d *diskStorage) Size() int64 {
return d.size
}
func (d *diskStorage) IsDisk() bool {
return true
}
// CreateBodyStorage 根据数据大小创建合适的存储
func CreateBodyStorage(data []byte) (BodyStorage, error) {
size := int64(len(data))
threshold := GetDiskCacheThresholdBytes()
// 检查是否应该使用磁盘缓存
if IsDiskCacheEnabled() &&
size >= threshold &&
IsDiskCacheAvailable(size) {
storage, err := newDiskStorage(data, GetDiskCachePath())
if err != nil {
// 如果磁盘存储失败,回退到内存存储
SysError(fmt.Sprintf("failed to create disk storage, falling back to memory: %v", err))
return newMemoryStorage(data), nil
}
return storage, nil
}
return newMemoryStorage(data), nil
}
// CreateBodyStorageFromReader 从 Reader 创建存储(用于大请求的流式处理)
func CreateBodyStorageFromReader(reader io.Reader, contentLength int64, maxBytes int64) (BodyStorage, error) {
threshold := GetDiskCacheThresholdBytes()
// 如果启用了磁盘缓存且内容长度超过阈值,直接使用磁盘存储
if IsDiskCacheEnabled() &&
contentLength > 0 &&
contentLength >= threshold &&
IsDiskCacheAvailable(contentLength) {
storage, err := newDiskStorageFromReader(reader, maxBytes, GetDiskCachePath())
if err != nil {
if IsRequestBodyTooLargeError(err) {
return nil, err
}
// 磁盘存储失败,reader 已被消费,无法安全回退
// 直接返回错误而非尝试回退(因为 reader 数据已丢失)
return nil, fmt.Errorf("disk storage creation failed: %w", err)
}
IncrementDiskCacheHits()
return storage, nil
}
// 使用内存读取
data, err := io.ReadAll(io.LimitReader(reader, maxBytes+1))
if err != nil {
return nil, err
}
if int64(len(data)) > maxBytes {
return nil, ErrRequestBodyTooLarge
}
storage, err := CreateBodyStorage(data)
if err != nil {
return nil, err
}
// 如果最终使用内存存储,记录内存缓存命中
if !storage.IsDisk() {
IncrementMemoryCacheHits()
} else {
IncrementDiskCacheHits()
}
return storage, nil
}
// ReaderOnly wraps an io.Reader to hide io.Closer, preventing http.NewRequest
// from type-asserting io.ReadCloser and closing the underlying BodyStorage.
func ReaderOnly(r io.Reader) io.Reader {
return struct{ io.Reader }{r}
}
// CleanupOldCacheFiles 清理旧的缓存文件(用于启动时清理残留)
func CleanupOldCacheFiles() {
// 使用统一的缓存管理
CleanupOldDiskCacheFiles(5 * time.Minute)
}