fix(sites): integrate shared download access and register synced adapters

apps/server/test/site-fetch-credentials.test.ts

@@ -0,0 +1,22 @@
+import { expect, it, vi } from "vitest";
+import { SourcesRuntime } from "../src/modules/sources-identity/runtime.ts";
+
+it("签名下载的 credentials omit 不复用账号或浏览器Cookie", async () => {
+  let sent = new Headers();
+  const rt = new SourcesRuntime({} as never, {
+    fetch: async (_input, init) => {
+      sent = new Headers(init?.headers);
+      return new Response("subtitle bytes");
+    },
+  });
+  const browser = vi.spyOn(rt.cloudflare, "handle");
+  const fetch = rt.siteFetch({ id: "original-site", proxy: false }, undefined, "Site User Agent");
+  const headers = { cookie: "account-cookie", authorization: "account-token" };
+  const url = "https://signed-cdn.example/file?credential=ephemeral";
+  const response = await fetch(url, { headers, credentials: "omit" });
+  expect(await response.text()).toBe("subtitle bytes");
+  expect(sent.has("cookie")).toBe(false);
+  expect(sent.has("authorization")).toBe(false);
+  expect(sent.get("user-agent")).toBe("Site User Agent");
+  expect(browser).not.toHaveBeenCalled();
+});

apps/server/test/sources-identity/mteam-tasks.test.ts

@@ -1,6 +1,7 @@
 import { TaskRegistry } from "@umt/tasks";
 import { createMockMteamApi, type MockMteamApi } from "@umt/testkit";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
+import { createPorts } from "../../src/modules/acquisition-organize/ports.ts";
 import { snapshotSite } from "../../src/modules/sources-identity/service/snapshot.ts";
 import { createHarness, type Harness, pgAvailable } from "./harness.ts";
 
@@ -50,6 +51,27 @@ describe.skipIf(!up)("M-Team 快照与任务注册", () => {
     expect(JSON.stringify(rows)).not.toContain(api.apiKey);
   });
 
+  it("下载种子沿用配置的 API 基址，并与站点访问共用 PG 限流桶", async () => {
+    const site = await h.db
+      .updateTable("site")
+      .set({ rate_limit: JSON.stringify({ minIntervalMs: 10, burst: 1 }) })
+      .where("id", "=", siteId)
+      .returningAll()
+      .executeTakeFirstOrThrow();
+    const release = await h.db
+      .selectFrom("source_release")
+      .selectAll()
+      .where("site_id", "=", siteId)
+      .executeTakeFirstOrThrow();
+    const before = api.issuedTokens;
+    const source = await createPorts(h.ctx).torrentSource({ release, site });
+    expect(source.kind).toBe("file");
+    expect(api.issuedTokens).toBe(before + 1);
+    expect(
+      await h.db.selectFrom("rate_limit_bucket").select("key").where("key", "=", `site:${siteId}`).executeTakeFirst(),
+    ).toBeTruthy();
+  });
+
   it("key 失效:账号标失效 + 待处理,快照结果 failed", async () => {
     api.setFailMode("banned_key");
     const r = await snapshotSite(h.rt, { siteId, kind: "manual" });