From 4416e278aa8bc159c4c905d8e49f5f9f3f3ec81e Mon Sep 17 00:00:00 2001
From: LIN student <86354789+MiCat-S@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:01:22 +0800
Subject: [PATCH] =?UTF-8?q?fix(message):=20=E5=9B=9E=E8=B0=83=E9=AA=8C?=
 =?UTF-8?q?=E8=AF=81=E6=97=A5=E5=BF=97=E4=B8=8D=E5=86=8D=E8=BE=93=E5=87=BA?=
 =?UTF-8?q?=20token?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

消息回调验证入口 GET /api/v1/message/ 以 INFO 级别记录请求参数，其中的
token 就是 verify_apitoken 校验用的 API_TOKEN。日志经常被直接贴出来排查
问题，因此去掉这个字段，其余排查用参数保持不变。

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 app/api/endpoints/message.py        |  2 +-
 tests/test_message_notifications.py | 15 +++++++++++++++
 2 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/api/endpoints/message.py b/app/api/endpoints/message.py
index 8353f0a29..af2b5840a 100644
--- a/app/api/endpoints/message.py
+++ b/app/api/endpoints/message.py
@@ -337,7 +337,7 @@ def incoming_verify(
     微信/VoceChat等验证响应
     """
     logger.info(
-        f"收到验证请求: token={token}, echostr={echostr}, "
+        f"收到验证请求: echostr={echostr}, "
         f"msg_signature={msg_signature}, timestamp={timestamp}, nonce={nonce}"
     )
     if echostr and msg_signature and timestamp and nonce:
diff --git a/tests/test_message_notifications.py b/tests/test_message_notifications.py
index 9143e7209..07a364e1b 100644
--- a/tests/test_message_notifications.py
+++ b/tests/test_message_notifications.py
@@ -2,6 +2,7 @@ import asyncio
 import json
 from unittest.mock import Mock
 
+from app.api.endpoints import message as message_endpoint
 from app.api.endpoints.message import clear_notification_message, get_notification_message
 from app.api.endpoints.system import get_message
 from app.chain.base import ChainBase
@@ -212,6 +213,20 @@ def test_sse_endpoint_flushes_backlog_in_one_tick() -> None:
     assert helper.get() is None
 
 
+def test_incoming_verify_log_omits_token(monkeypatch) -> None:
+    """
+    回调验证日志只记录排查所需的参数，不输出 token。
+    """
+    logged: list[str] = []
+    monkeypatch.setattr(message_endpoint.logger, "info", lambda msg, *args, **kwargs: logged.append(str(msg)))
+
+    result = message_endpoint.incoming_verify(token="callback-token-value", source="vocechat")
+
+    assert result == {"status": "OK"}
+    assert logged
+    assert all("callback-token-value" not in line for line in logged)
+
+
 def test_agent_helper_message_does_not_enter_sse_queue() -> None:
     """
     智能体消息不进入前端 SSE 队列。