Nexus/docs/audit/2026-06-21-server-file-transfer.md

审计 — 2026-06-21 跨服务器文件传输

Changelog: docs/changelog/2026-06-21-server-file-transfer.md、docs/changelog/2026-06-21-server-file-transfer-audit-fixes.md

Step 3 规则扫描

文件	规则	结论
server_file_transfer_service.py	路径 shlex.quote、直传 500MB 上限、deliver 失败回滚	PASS
transfer-download	token Redis TTL；JWT 前缀白名单	PASS（已知：前缀对所有 method 生效）
useFilesActions.ts	模式推荐基于 transferItems；relay/deliver 分路径缓存	PASS
test_server_file_transfer.py	deliver 成功/回滚/超限、relay、store	PASS

Closure

项	状态	说明
deliver 失败泄漏归档/token	FIXED	rollback cleanup
deliver 成功 token 残留	FIXED	delete_package_meta
右键传输模式误判	FIXED	transferItems
直传多项中途失败无回滚	ACCEPT	v1 文档化

文件清单

• server/application/services/server_file_transfer_service.py
• server/infrastructure/redis/transfer_package_store.py
• server/api/sync_v2.py
• server/api/schemas.py
• server/api/auth_jwt.py
• frontend/src/composables/files/useFilesActions.ts
• frontend/src/composables/files/useFilesPage.ts
• frontend/src/components/files/FilesDialogs.vue
• frontend/src/components/files/FilesList.vue
• frontend/src/components/files/FilesToolbar.vue
• frontend/src/utils/auditLabels.ts
• tests/test_server_file_transfer.py
• docs/design/specs/2026-06-21-server-file-transfer-design.md
• docs/design/plans/2026-06-21-server-file-transfer.md
• docs/changelog/2026-06-21-server-file-transfer.md
• docs/changelog/2026-06-21-server-file-transfer-audit-fixes.md

DoD

• 直传 + 打包投递 API 与前端对话框
• pytest tests/test_server_file_transfer.py 18 passed
• changelog ≥10 行