Merge pull request #1699 from xinnan-tech/manager-api-mcp

update：优化mcp地址的校验

main/manager-api/src/main/java/xiaozhi/common/utils/HttpSendUtils.java

@@ -1,64 +0,0 @@
-package xiaozhi.common.utils;
-
-import lombok.extern.slf4j.Slf4j;
-import okhttp3.*;
-import org.jetbrains.annotations.Nullable;
-import org.springframework.stereotype.Component;
-import xiaozhi.common.exception.RenException;
-
-import java.io.IOException;
-
-@Slf4j
-@Component
-public class HttpSendUtils {
-    private OkHttpClient client = new OkHttpClient();
-
-    /**
-     * 发送get请求，获取返回的body转换成字符串
-     * @param url get请求地址
-     * @return body内容
-     */
-    public String fetchGetBodyAsString(String url) {
-        Request request = new Request.Builder()
-                .url(url)
-                .build();
-        return getString(url, request);
-    }
-
-    /**
-     * 发送post请求，参数为json格式。取返回的body转换成字符串
-     * @param url post请求地址
-     * @param json json参数
-     * @return body内容
-     */
-    public String fetchJsonPostBodyAsString(String url,String json) {
-        // 创建请求体
-        MediaType JSON = MediaType.get("application/json; charset=utf-8");
-        RequestBody body = RequestBody.create(json, JSON);
-
-        Request request = new Request.Builder()
-                .url(url)
-                .post(body)
-                .build();
-
-        return getString(url, request);
-    }
-
-    private String getString(String url, Request request) {
-        String body = null;
-        try (Response response = client.newCall(request).execute()) {
-            if (response.isSuccessful()) {
-                if (response.body() != null){
-                    body = response.body().string();
-                }
-            } else {
-                throw new RenException("请求失败，错误码："+response.code());
-            }
-        } catch (Exception e) {
-            String method = request.method();
-            log.error("{}请求发送错误地址：{} \n 发送错误信息:{}",method, url,e.getMessage());
-            throw new RenException("请求发送失败");
-        }
-        return body;
-    }
-}

main/manager-api/src/main/java/xiaozhi/modules/sys/controller/SysParamsController.java

@@ -104,6 +104,9 @@ public class SysParamsController {
         // 验证OTA地址
         validateOtaUrl(dto.getParamCode(), dto.getParamValue());
 
+        // 验证MCP地址
+        validateMcpUrl(dto.getParamCode(), dto.getParamValue());
+
         sysParamsService.update(dto);
         configService.getConfig(false);
         return new Result<Void>();
@@ -195,4 +198,33 @@ public class SysParamsController {
             throw new RenException("OTA接口验证失败：" + e.getMessage());
         }
     }
+
+    private void validateMcpUrl(String paramCode, String url) {
+        if (!paramCode.equals(Constant.SERVER_MCP_ENDPOINT)) {
+            return;
+        }
+        if (StringUtils.isBlank(url) || url.equals("null")) {
+            throw new RenException("MCP地址不能为空");
+        }
+        if (url.contains("localhost") || url.contains("127.0.0.1")) {
+            throw new RenException("MCP地址不能使用localhost或127.0.0.1");
+        }
+        if (!url.toLowerCase().contains("key")) {
+            throw new RenException("不是正确的MCP地址");
+        }
+        try {
+            // 发送GET请求
+            ResponseEntity<String> response = restTemplate.getForEntity(url, String.class);
+            if (response.getStatusCode() != HttpStatus.OK) {
+                throw new RenException("MCP接口访问失败，状态码：" + response.getStatusCode());
+            }
+            // 检查响应内容是否包含OTA相关信息
+            String body = response.getBody();
+            if (body == null || !body.contains("success")) {
+                throw new RenException("MCP接口返回内容格式不正确，可能不是一个真实的MCP接口");
+            }
+        } catch (Exception e) {
+            throw new RenException("MCP接口验证失败：" + e.getMessage());
+        }
+    }
 }

main/manager-api/src/main/java/xiaozhi/modules/sys/service/impl/SysParamsServiceImpl.java

@@ -20,7 +20,6 @@ import xiaozhi.common.exception.RenException;
 import xiaozhi.common.page.PageData;
 import xiaozhi.common.service.impl.BaseServiceImpl;
 import xiaozhi.common.utils.ConvertUtils;
-import xiaozhi.common.utils.HttpSendUtils;
 import xiaozhi.common.utils.JsonUtils;
 import xiaozhi.modules.sys.dao.SysParamsDao;
 import xiaozhi.modules.sys.dto.SysParamsDTO;
@@ -35,7 +34,6 @@ import xiaozhi.modules.sys.service.SysParamsService;
 @Service
 public class SysParamsServiceImpl extends BaseServiceImpl<SysParamsDao, SysParamsEntity> implements SysParamsService {
     private final SysParamsRedis sysParamsRedis;
-    private final HttpSendUtils httpSendUtils;
 
     @Override
     public PageData<SysParamsDTO> page(Map<String, Object> params) {
@@ -88,7 +86,6 @@ public class SysParamsServiceImpl extends BaseServiceImpl<SysParamsDao, SysParam
     public void update(SysParamsDTO dto) {
         validateParamValue(dto);
         detectingSMSParameters(dto.getParamCode(), dto.getParamValue());
-        validateMcpParams(dto.getParamCode(), dto.getParamValue());
         SysParamsEntity entity = ConvertUtils.sourceToTarget(dto, SysParamsEntity.class);
         updateById(entity);
 
@@ -247,15 +244,4 @@ public class SysParamsServiceImpl extends BaseServiceImpl<SysParamsDao, SysParam
         }
         return true;
     }
-
-    private void  validateMcpParams(String paramCode, String paramValue){
-        if(!Constant.SERVER_MCP_ENDPOINT.equals(paramCode)){
-            return;
-        }
-        String body  = httpSendUtils.fetchGetBodyAsString(paramValue);
-        if(body.contains("success")){
-            return;
-        };
-        throw new RenException(Constant.SERVER_MCP_ENDPOINT+"的value值不符合要求");
-    }
 }