fix: keep speech retries stable across proxy and mobile IP changes

Bind secret random retry capabilities to request content rather than peer IP while retaining observed-peer and global rate limits. Use 192-bit reader tokens and wait for restored voice options before enabling playback.

README.md

@@ -69,7 +69,7 @@ short_description: 马列毛一言api，支持跨域，句子参数请看README.
 分段模式为可选字段，旧客户端无需改动：
 
 ```json
-{"text":"这是一篇长文，校长文章写得很好。我得亲自处理后面的内容。","progressive":true,"request_id":"client-retry-token-000001"}
+{"text":"这是一篇长文，校长文章写得很好。我得亲自处理后面的内容。","progressive":true}
 ```
 
 轮询 `/tts/jobs/{id}` 时，`progress.parts` 是已成功原子发布的有序列表，每项包含
@@ -83,9 +83,11 @@ short_description: 马列毛一言api，支持跨域，句子参数请看README.
 长文客户端可附加 `context_before/context_after`，各最多 32 个字符，只供多音字判断，
 **不会朗读或计入正文位置**；上下文和分段模式都参与音频缓存身份。
 试听页按原文自动携带相邻批的上下文，不靠替换正文修读音。
-可选 `request_id` 是 20–64 位字母、数字、`_`、`-` 的重试标识：同一客户端、同一
-正文与选项，在任务保留期内重试返回同一个任务 ID，避免响应丢失时重复占用订阅。
-不得把一个标识用于不同请求。此机制不替代鉴权或长期任务存储。
+可选 `request_id` 是 32–64 位字母、数字、`_`、`-` 的**秘密重试标识**：同一正文与
+选项在任务保留期内返回同一个任务 ID，即使代理／移动网络 IP 改变，避免响应丢失时
+重复占用订阅。请用密码学随机数生成器创建至少 128 位随机值；试听页使用 192 位。
+持有标识并知道原请求即可恢复该任务，因此与临时音频链接一样不可公开，不能用可猜的
+常量或为不同请求重复使用。此机制不替代登录鉴权或长期任务存储，也不信任任意转发 IP。
 
 停止后可点击“从进度继续”。默认正文和进度仅留在当前页面内存；勾选“在本机保存”
 才写入本站浏览器存储，刷新后不会自动提交或播放，必须主动点击继续。

static/tts.js

@@ -4,6 +4,7 @@ const audio = $("#audio");
 const preloader = new Audio();
 preloader.preload = "auto";
 let ready = false;
+let voicesReady = false;
 let healthTimer;
 let session = null;
 let bookmark = null;
@@ -32,9 +33,9 @@ async function jsonRequest(path, options = {}, owner = null) {
 }
 
 function controls() {
-  $("#generate").disabled = !ready || !!session;
+  $("#generate").disabled = !ready || !voicesReady || !!session;
   $("#stop").disabled = !session;
-  $("#resume").disabled = !ready || !!session || !bookmark || bookmark.text !== $("#speech-text").value;
+  $("#resume").disabled = !ready || !voicesReady || !!session || !bookmark || bookmark.text !== $("#speech-text").value;
 }
 
 async function health() {
@@ -100,7 +101,7 @@ function stop({ keepalive = false, message = "已停止，可从刚才的位置
 }
 
 function nonce() {
-  const bytes = crypto.getRandomValues(new Uint8Array(16));
+  const bytes = crypto.getRandomValues(new Uint8Array(24));
   return Array.from(bytes, (value) => value.toString(16).padStart(2, "0")).join("");
 }
 
@@ -398,5 +399,7 @@ if (bookmark) {
 jsonRequest("/tts/voices").then((data) => {
   $("#voice").replaceChildren(...data.voices.map((voice) => new Option(voice.name, voice.id)));
   if (bookmark) $("#voice").value = bookmark.voice;
-}).catch(() => { $("#status").textContent = "音色列表加载失败，请刷新重试"; });
+  voicesReady = true;
+  controls();
+}).catch(() => { $("#status").textContent = "音色列表加载失败，请刷新重试"; controls(); });
 health();

tests/test_service.py

@@ -246,6 +246,9 @@ class ServiceTests(unittest.IsolatedAsyncioTestCase):
         first = service.submit("长文", "zf_001", 1, "a", **options)
         again = service.submit("长文", "zf_001", 1, "a", **options)
         self.assertEqual(first["id"], again["id"])
+        migrated = service.submit("长文", "zf_001", 1, "different-proxy-or-mobile-peer", **options)
+        self.assertEqual(first["id"], migrated["id"])
+        self.assertEqual(len(service.jobs), 1)
         with self.assertRaises(SpeechError) as caught:
             service.submit("校长", "zf_001", 1, "a", **options)
         self.assertEqual(caught.exception.code, "request_conflict")

tts/api.py

@@ -97,7 +97,7 @@ class SynthesisRequest(BaseModel):
     progressive: bool = False
     context_before: str = Field(default="", max_length=MAX_CONTEXT)
     context_after: str = Field(default="", max_length=MAX_CONTEXT)
-    request_id: str | None = Field(default=None, min_length=20, max_length=64, pattern=r"^[A-Za-z0-9_-]+$")
+    request_id: str | None = Field(default=None, min_length=32, max_length=64, pattern=r"^[A-Za-z0-9_-]+$")
 
 
 class LeasedAudio(FileResponse):

tts/service.py

@@ -203,7 +203,7 @@ class Service:
         validate_context(context_after)
         if not isinstance(progressive, bool):
             raise SpeechError("invalid_options", "分段播放选项无效")
-        if request_id is not None and (not isinstance(request_id, str) or not re.fullmatch(r"[A-Za-z0-9_-]{20,64}", request_id)):
+        if request_id is not None and (not isinstance(request_id, str) or not re.fullmatch(r"[A-Za-z0-9_-]{32,64}", request_id)):
             raise SpeechError("invalid_request_id", "请求重试标识无效")
         if voice not in VOICES or not 0.7 <= speed <= 1.4:
             raise SpeechError("invalid_options", "请选择支持的音色和 0.7–1.4 倍合成语速")
@@ -220,7 +220,11 @@ class Service:
             raise SpeechError("cancel_pending", "上一音频仍在传输，请稍后重试", 429)
         if request_id:
             for job in self.jobs.values():
-                if job.client == client and job.request_id == request_id:
+                # This unguessable retry capability is deliberately independent
+                # of peer IP: HF proxy hops and mobile networks can change it
+                # between an accepted POST and a lost-response retry. Rate
+                # accounting still uses the observed peer, never arbitrary XFF.
+                if job.request_id == request_id:
                     if job.key != key:
                         raise SpeechError("request_conflict", "重试标识不能用于不同的正文或选项", 409)
                     return self.describe(job.id)