From 6a77657da464823c33d841ef146ac229a7c92460 Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Thu, 22 Feb 2024 14:15:44 +0800
Subject: [PATCH 1/9] add comments

---
 server/routes/team.py | 48 +++++++++++++++++++++----------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/server/routes/team.py b/server/routes/team.py
index 5f5803a3..736822b8 100644
--- a/server/routes/team.py
+++ b/server/routes/team.py
@@ -175,29 +175,29 @@ def install_im_application_to_team_by_get_method(team_id, platform):
             )
             app.logger.info("result %r", result)
             events = [
-                "20",
-                "im.message.message_read_v1",
-                "im.message.reaction.created_v1",
-                "im.message.reaction.deleted_v1",
-                "im.message.recalled_v1",
-                "im.message.receive_v1",
+                "20",  # 用户和机器人的会话首次被创建
+                "im.message.message_read_v1",  # 消息已读
+                "im.message.reaction.created_v1",  # 新增消息表情回复
+                "im.message.reaction.deleted_v1",  # 删除消息表情回复
+                "im.message.recalled_v1",  # 撤回消息
+                "im.message.receive_v1",  # 接收消息
             ]
             scope_ids = [
-                "8002",
-                "100032",
-                "6081",
-                "14",
-                "1",
-                "21001",
-                "20001",
-                "20011",
-                "3001",
-                "20012",
-                "20010",
-                "3000",
-                "20008",
-                "1000",
-                "20009",
+                "8002",  # 获取应用信息
+                "100032",  # 获取通讯录基本信息
+                "6081",  # 以应用身份读取通讯录
+                "14",  # 获取用户基本信息
+                "1",  # 获取用户邮箱信息
+                "21001",  # 获取与更新群组信息
+                "20001",  # 获取与发送单聊、群组消息
+                "20011",  # 获取用户在群组中 @ 机器人的消息
+                "3001",  # 接收群聊中 @ 机器人消息事件
+                "20012",  # 获取群组中所有消息
+                "20010",  # 获取用户发给机器人的单聊消息
+                "3000",  # 读取用户发给机器人的单聊消息
+                "20008",  # 获取单聊、群组消息
+                "1000",  # 以应用的身份发消息
+                "20009",  # 获取上传图片或文件资源
             ]
             hook_url = f"{os.environ.get('DOMAIN')}/api/feishu/hook/{app_id}"
             return redirect(
@@ -260,9 +260,9 @@ def get_task_result_by_id(team_id, task_id):
             "data": {
                 "task_id": task.id,
                 "status": task.status,
-                "result": task.result
-                if isinstance(task.result, list)
-                else str(task.result),
+                "result": (
+                    task.result if isinstance(task.result, list) else str(task.result)
+                ),
             },
         }
     )

From 3777e67c343f6d767038ab866baefa6b84592a26 Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Thu, 22 Feb 2024 15:09:19 +0800
Subject: [PATCH 2/9] add replace_images_keys_with_url

---
 server/tasks/lark/chat.py | 30 ++++++++++++++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/server/tasks/lark/chat.py b/server/tasks/lark/chat.py
index e518f167..0d28e9e4 100644
--- a/server/tasks/lark/chat.py
+++ b/server/tasks/lark/chat.py
@@ -1,5 +1,7 @@
 import json
 import logging
+import os
+import re
 from urllib.parse import urlparse
 
 from celery_app import app, celery
@@ -313,14 +315,18 @@ def create_issue(
     )
     assignees = [code_users[openid][1] for openid in users if openid in code_users]
 
-    # 判断 content 中是否有 at
+    # 处理 body
+    # 1. 判断 body 中是否有 at
     if "mentions" in data["event"]["message"]:
-        # 替换 content 中的 im_name 为 code_name
+        # 替换 body 中的 im_name 为 code_name
         body = replace_im_name_to_github_name(
             app_id, message_id, {"text": body}, data, team, *args, **kwargs
         )
         body = body.replace("\n", "\r\n")
 
+    # 2. 处理 body 中的图片
+    body = replace_images_keys_with_url(body, team.id, message_id)
+
     response = github_app.create_issue(
         team.name, repo.name, title, body, assignees, labels
     )
@@ -331,6 +337,26 @@ def create_issue(
     return response
 
 
+def replace_images_keys_with_url(text, team_id, message_id):
+    """
+    replace image_key with image URL.
+    ![](image_key) -> ![](gitmaya.com/api/<team_id>/<message_id>/image/<image_key>)
+    Args:
+        text (str): original text
+
+    Returns:
+        str: replaced text
+    """
+    host = os.environ.get("DOMAIN")
+    replaced_text = re.sub(
+        r"!\[.*?\]\((.*?)\)",
+        lambda match: f"![]({host}/api/{team_id}/{message_id}/image/{match.group(1)})",
+        text,
+    )
+
+    return replaced_text
+
+
 @celery.task()
 def sync_issue(
     issue_id, issue_link, app_id, message_id, content, data, *args, **kwargs

From 04b04547c4034bd4a95e96e8383f7265091c6d8c Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Thu, 22 Feb 2024 15:46:03 +0800
Subject: [PATCH 3/9] add get_image api

---
 server/routes/user.py | 31 ++++++++++++++++++++++++++++++-
 server/utils/utils.py |  8 ++++++++
 2 files changed, 38 insertions(+), 1 deletion(-)

diff --git a/server/routes/user.py b/server/routes/user.py
index 2e148729..7a1f1c60 100644
--- a/server/routes/user.py
+++ b/server/routes/user.py
@@ -1,8 +1,14 @@
 from app import app
 from flask import Blueprint, jsonify, request, session
-from model.team import get_team_list_by_user_id, is_team_admin
+from model.team import (
+    get_application_info_by_team_id,
+    get_team_list_by_user_id,
+    is_team_admin,
+)
 from model.user import get_user_by_id
+from tasks.lark.base import get_bot_by_application_id
 from utils.auth import authenticated
+from utils.utils import download_image
 
 bp = Blueprint("user", __name__, url_prefix="/api")
 
@@ -57,3 +63,26 @@ def set_account():
 
 
 app.register_blueprint(bp)
+
+
+@bp.route("/<team_id>/<message_id>/image/<img_key>", methods=["GET"])
+@authenticated
+def get_image(team_id, message_id, img_key):
+    """
+    1. 用 img_key 下载 image(cache)
+    2. 这个链接需要用户登录信息
+        1. 公开仓库，不校验
+    3. 并且需要多加一层权限管理（只有这个team下面的人 ，才能查看这个图）
+    4. 如果没有登录的时候，这个url返回一张403的图，点击的时候，告诉用户需要登录
+        1. 如果是github上面查看的时候，通过 判断，展示图片
+        2. 如果用户点击图片，直接浏览器打开
+            1. 这个时候rederer是空的，跳转github　oauth登录
+            2. 然后跳转回到这个图片。可以正常查看图片内容
+            3. 这个时候如果刷新github的issue页面，应该是能正常查看图片的
+    """
+    # 必须要登录，才能查看图片，不然ddos分分钟打爆db
+    _, im_application = get_application_info_by_team_id(team_id)
+    bot, _ = get_bot_by_application_id(im_application.id)
+
+    image_content = download_image(img_key, bot)
+    return image_content
diff --git a/server/utils/utils.py b/server/utils/utils.py
index cccb0c13..7e42c19a 100644
--- a/server/utils/utils.py
+++ b/server/utils/utils.py
@@ -30,6 +30,14 @@ def upload_image_binary(img_bin, bot):
     return response["data"]["image_key"]
 
 
+@stalecache(expire=3600, stale=600)
+def download_image(img_key, bot):
+    url = f"{bot.host}/open-apis/im/v1/images/{img_key}"
+
+    response = bot.get(url)
+    return response.content
+
+
 def query_one_page(query, page, size):
     offset = (page - 1) * int(size)
     return (

From 496a09aff8c33c2ddc62a2c6dd23619c58da305d Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Thu, 22 Feb 2024 17:41:08 +0800
Subject: [PATCH 4/9] convert image url

---
 server/routes/user.py      | 14 +++++++-------
 server/tasks/lark/issue.py | 10 +++++-----
 server/utils/utils.py      | 21 +++++++++++++++++----
 3 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/server/routes/user.py b/server/routes/user.py
index 7a1f1c60..f9c789a5 100644
--- a/server/routes/user.py
+++ b/server/routes/user.py
@@ -1,5 +1,5 @@
 from app import app
-from flask import Blueprint, jsonify, request, session
+from flask import Blueprint, Response, jsonify, request, session
 from model.team import (
     get_application_info_by_team_id,
     get_team_list_by_user_id,
@@ -8,7 +8,7 @@
 from model.user import get_user_by_id
 from tasks.lark.base import get_bot_by_application_id
 from utils.auth import authenticated
-from utils.utils import download_image
+from utils.utils import download_file
 
 bp = Blueprint("user", __name__, url_prefix="/api")
 
@@ -62,9 +62,6 @@ def set_account():
     return jsonify({"code": 0, "msg": "success"})
 
 
-app.register_blueprint(bp)
-
-
 @bp.route("/<team_id>/<message_id>/image/<img_key>", methods=["GET"])
 @authenticated
 def get_image(team_id, message_id, img_key):
@@ -84,5 +81,8 @@ def get_image(team_id, message_id, img_key):
     _, im_application = get_application_info_by_team_id(team_id)
     bot, _ = get_bot_by_application_id(im_application.id)
 
-    image_content = download_image(img_key, bot)
-    return image_content
+    image_content = download_file(img_key, message_id, bot, "image")
+    return Response(image_content, mimetype="image/png")
+
+
+app.register_blueprint(bp)
diff --git a/server/tasks/lark/issue.py b/server/tasks/lark/issue.py
index 5c4052f1..abdee5c0 100644
--- a/server/tasks/lark/issue.py
+++ b/server/tasks/lark/issue.py
@@ -21,7 +21,7 @@
 from utils.lark.issue_manual_help import IssueManualHelp, IssueView
 from utils.lark.issue_tip_failed import IssueTipFailed
 from utils.lark.issue_tip_success import IssueTipSuccess
-from utils.utils import upload_image
+from utils.utils import process_image
 
 from .base import (
     get_bot_by_application_id,
@@ -122,12 +122,12 @@ def gen_issue_card_by_issue(bot, issue, repo_url, team, maunal=False):
             tags=tags,
         )
 
-    # 处理 description 中的图片
+    # 处理从 github 创建 Issue 时, description 中的图片
     description = replace_images_with_keys(
         issue.description if issue.description else "", bot
     )
 
-    # 处理 description 中的at
+    # 处理从 github 创建 Issue 时, description 中的 at
     description = replace_code_name_to_im_name(description)
 
     return IssueCard(
@@ -160,7 +160,7 @@ def replace_images_with_keys(text, bot):
     markdown_pattern = r"!\[.*?\]\((.*?)\)"
     replaced_text = re.sub(
         markdown_pattern,
-        lambda match: f"![]({upload_image(match.group(1), bot)})",
+        lambda match: f"![]({process_image(match.group(1), bot)})",
         text,
     )
 
@@ -168,7 +168,7 @@ def replace_images_with_keys(text, bot):
     html_pattern = r"<img.*?src=\"(.*?)\".*?>"
     replaced_text = re.sub(
         html_pattern,
-        lambda match: f"![]({upload_image(match.group(1), bot)})",
+        lambda match: f"![]({process_image(match.group(1), bot)})",
         replaced_text,
     )
 
diff --git a/server/utils/utils.py b/server/utils/utils.py
index 7e42c19a..badc58d4 100644
--- a/server/utils/utils.py
+++ b/server/utils/utils.py
@@ -1,15 +1,24 @@
 import logging
+import os
 
 import httpx
 from utils.redis import stalecache
 
 
+def process_image(url, bot):
+    if (
+        not url
+        or not url.startswith("http")
+        or url.startswith(f"{os.environ.get('DOMAIN')}/api")
+    ):
+        return ""
+    return upload_image(url, bot)
+
+
 # 使用 stalecache 装饰器，以 url 作为缓存键
 @stalecache(expire=3600, stale=600)
 def upload_image(url, bot):
     logging.info("upload image: %s", url)
-    if not url or not url.startswith("http"):
-        return ""
     response = httpx.get(url, follow_redirects=True)
     if response.status_code == 200:
         # 函数返回值: iamg_key 存到缓存中
@@ -31,8 +40,12 @@ def upload_image_binary(img_bin, bot):
 
 
 @stalecache(expire=3600, stale=600)
-def download_image(img_key, bot):
-    url = f"{bot.host}/open-apis/im/v1/images/{img_key}"
+def download_file(file_key, message_id, bot, file_type="image"):
+    """
+    获取消息中的资源文件，包括音频，视频，图片和文件，暂不支持表情包资源下载。当前仅支持 100M 以内的资源文件的下载
+    """
+    # open-apis/im/v1/images/{img_key} 接口只能下载机器人自己上传的图片
+    url = f"{bot.host}/open-apis/im/v1/messages/{message_id}/resources/{file_key}?type={file_type}"
 
     response = bot.get(url)
     return response.content

From 31e031146f904fd7eb2d414ab7477d7944af8538 Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Thu, 22 Feb 2024 18:36:34 +0800
Subject: [PATCH 5/9] convert image url

---
 server/routes/user.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/routes/user.py b/server/routes/user.py
index f9c789a5..d631a507 100644
--- a/server/routes/user.py
+++ b/server/routes/user.py
@@ -63,7 +63,7 @@ def set_account():
 
 
 @bp.route("/<team_id>/<message_id>/image/<img_key>", methods=["GET"])
-@authenticated
+# @authenticated
 def get_image(team_id, message_id, img_key):
     """
     1. 用 img_key 下载 image(cache)

From 3b79d0020bff62f6649a70e95fa9a665ea49f3f4 Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Fri, 23 Feb 2024 16:57:30 +0800
Subject: [PATCH 6/9] fix issue comment

---
 server/tasks/lark/chat.py  | 29 +++++++++++++++++++----------
 server/tasks/lark/issue.py | 12 ++++++------
 2 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/server/tasks/lark/chat.py b/server/tasks/lark/chat.py
index 0d28e9e4..c5bb7fb7 100644
--- a/server/tasks/lark/chat.py
+++ b/server/tasks/lark/chat.py
@@ -316,16 +316,7 @@ def create_issue(
     assignees = [code_users[openid][1] for openid in users if openid in code_users]
 
     # 处理 body
-    # 1. 判断 body 中是否有 at
-    if "mentions" in data["event"]["message"]:
-        # 替换 body 中的 im_name 为 code_name
-        body = replace_im_name_to_github_name(
-            app_id, message_id, {"text": body}, data, team, *args, **kwargs
-        )
-        body = body.replace("\n", "\r\n")
-
-    # 2. 处理 body 中的图片
-    body = replace_images_keys_with_url(body, team.id, message_id)
+    body = process_desc(app_id, message_id, body, data, team, *args, **kwargs)
 
     response = github_app.create_issue(
         team.name, repo.name, title, body, assignees, labels
@@ -337,6 +328,24 @@ def create_issue(
     return response
 
 
+def process_desc(app_id, message_id, desc, data, team, *args, **kwargs):
+    """
+    处理发给 github 的 desc, 转换@、处理图片、换行
+    """
+    # 1. 判断 body 中是否有 at
+    if "mentions" in data["event"]["message"]:
+        # 替换 body 中的 im_name 为 code_name
+        desc = replace_im_name_to_github_name(
+            app_id, message_id, {"text": desc}, data, team, *args, **kwargs
+        )
+
+    # 2. 处理 body 中的图片
+    desc = replace_images_keys_with_url(desc, team.id, message_id)
+
+    # github 只支持 \r\n
+    return desc.replace("\n", "\r\n")
+
+
 def replace_images_keys_with_url(text, team_id, message_id):
     """
     replace image_key with image URL.
diff --git a/server/tasks/lark/issue.py b/server/tasks/lark/issue.py
index abdee5c0..8dfc7602 100644
--- a/server/tasks/lark/issue.py
+++ b/server/tasks/lark/issue.py
@@ -601,12 +601,12 @@ def create_issue_comment(app_id, message_id, content, data, *args, **kwargs):
     )
     comment_text = content["text"]
 
-    # 判断 content 中是否有 at
-    if "mentions" in data["event"]["message"]:
-        # 替换 content 中的 im_name 为 code_name
-        comment_text = replace_im_name_to_github_name(
-            app_id, message_id, content, data, team, *args, **kwargs
-        )
+    from tasks.lark.chat import process_desc
+
+    # 处理 desc
+    comment_text = process_desc(
+        app_id, message_id, comment_text, data, team, *args, **kwargs
+    )
 
     response = github_app.create_issue_comment(
         team.name, repo.name, issue.issue_number, comment_text

From c9b6002921f528326fb929f874f195210bfc1fbb Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Mon, 26 Feb 2024 18:01:47 +0800
Subject: [PATCH 7/9] fix get_image

---
 server/routes/user.py      | 48 +++++++++++++++++++++++---------------
 server/tasks/lark/base.py  |  7 +++++-
 server/tasks/lark/chat.py  | 12 +++++-----
 server/tasks/lark/issue.py |  2 +-
 server/utils/utils.py      |  9 ++++---
 5 files changed, 46 insertions(+), 32 deletions(-)

diff --git a/server/routes/user.py b/server/routes/user.py
index d631a507..0ed29e0a 100644
--- a/server/routes/user.py
+++ b/server/routes/user.py
@@ -1,12 +1,12 @@
 from app import app
-from flask import Blueprint, Response, jsonify, request, session
+from flask import Blueprint, Response, abort, jsonify, request, session
 from model.team import (
     get_application_info_by_team_id,
     get_team_list_by_user_id,
     is_team_admin,
 )
 from model.user import get_user_by_id
-from tasks.lark.base import get_bot_by_application_id
+from tasks.lark.base import get_bot_by_application_id, get_repo_by_repo_id
 from utils.auth import authenticated
 from utils.utils import download_file
 
@@ -62,27 +62,37 @@ def set_account():
     return jsonify({"code": 0, "msg": "success"})
 
 
-@bp.route("/<team_id>/<message_id>/image/<img_key>", methods=["GET"])
-# @authenticated
-def get_image(team_id, message_id, img_key):
+@bp.route("/<team_id>/<message_id>/<repo_id>/image/<img_key>", methods=["GET"])
+def get_image(team_id, message_id, repo_id, img_key):
     """
     1. 用 img_key 下载 image(cache)
-    2. 这个链接需要用户登录信息
-        1. 公开仓库，不校验
-    3. 并且需要多加一层权限管理（只有这个team下面的人 ，才能查看这个图）
-    4. 如果没有登录的时候，这个url返回一张403的图，点击的时候，告诉用户需要登录
-        1. 如果是github上面查看的时候，通过 判断，展示图片
-        2. 如果用户点击图片，直接浏览器打开
-            1. 这个时候rederer是空的，跳转github　oauth登录
-            2. 然后跳转回到这个图片。可以正常查看图片内容
-            3. 这个时候如果刷新github的issue页面，应该是能正常查看图片的
+    2.
     """
-    # 必须要登录，才能查看图片，不然ddos分分钟打爆db
-    _, im_application = get_application_info_by_team_id(team_id)
-    bot, _ = get_bot_by_application_id(im_application.id)
 
-    image_content = download_file(img_key, message_id, bot, "image")
-    return Response(image_content, mimetype="image/png")
+    def download_and_respond():
+        _, im_application = get_application_info_by_team_id(team_id)
+        bot, _ = get_bot_by_application_id(im_application.id)
+        image_content = download_file(img_key, message_id, bot, "image")
+        return Response(image_content, mimetype="image/png")
+
+    # GitHub调用
+    user_agent = request.headers.get("User-Agent")
+    if user_agent and user_agent.startswith("github-camo"):
+        return download_and_respond()
+
+    # TODO 用户调用(弱需求, 通常来讲此接口不会被暴露), 需要进一步校验权限
+    referer = request.headers.get("Referer")
+    if not referer:
+        # 公开仓库不校验
+        repo = get_repo_by_repo_id(repo_id)
+        is_private = repo.extra.get("private", False)
+        app.logger.debug(f"is_private: {is_private}")
+
+        # 私有仓库校验，先登录
+        if is_private:
+            return abort(403)
+
+    return download_and_respond()
 
 
 app.register_blueprint(bp)
diff --git a/server/tasks/lark/base.py b/server/tasks/lark/base.py
index 47b05906..430cf657 100644
--- a/server/tasks/lark/base.py
+++ b/server/tasks/lark/base.py
@@ -24,6 +24,11 @@ def get_chat_group_by_chat_id(chat_id):
 
 
 def get_repo_name_by_repo_id(repo_id):
+    repo = get_repo_by_repo_id(repo_id)
+    return repo.name
+
+
+def get_repo_by_repo_id(repo_id):
     repo = (
         db.session.query(Repo)
         .filter(
@@ -32,7 +37,7 @@ def get_repo_name_by_repo_id(repo_id):
         )
         .first()
     )
-    return repo.name
+    return repo
 
 
 def get_bot_by_application_id(app_id):
diff --git a/server/tasks/lark/chat.py b/server/tasks/lark/chat.py
index c5bb7fb7..cfc179c7 100644
--- a/server/tasks/lark/chat.py
+++ b/server/tasks/lark/chat.py
@@ -316,7 +316,7 @@ def create_issue(
     assignees = [code_users[openid][1] for openid in users if openid in code_users]
 
     # 处理 body
-    body = process_desc(app_id, message_id, body, data, team, *args, **kwargs)
+    body = process_desc(app_id, message_id, repo.id, body, data, team, *args, **kwargs)
 
     response = github_app.create_issue(
         team.name, repo.name, title, body, assignees, labels
@@ -328,7 +328,7 @@ def create_issue(
     return response
 
 
-def process_desc(app_id, message_id, desc, data, team, *args, **kwargs):
+def process_desc(app_id, message_id, repo_id, desc, data, team, *args, **kwargs):
     """
     处理发给 github 的 desc, 转换@、处理图片、换行
     """
@@ -340,16 +340,16 @@ def process_desc(app_id, message_id, desc, data, team, *args, **kwargs):
         )
 
     # 2. 处理 body 中的图片
-    desc = replace_images_keys_with_url(desc, team.id, message_id)
+    desc = replace_images_keys_with_url(desc, team.id, message_id, repo_id)
 
     # github 只支持 \r\n
     return desc.replace("\n", "\r\n")
 
 
-def replace_images_keys_with_url(text, team_id, message_id):
+def replace_images_keys_with_url(text, team_id, message_id, repo_id):
     """
     replace image_key with image URL.
-    ![](image_key) -> ![](gitmaya.com/api/<team_id>/<message_id>/image/<image_key>)
+    ![](image_key) -> ![](gitmaya.com/api/<team_id>/<message_id>/<repo_id>/image/<image_key>)
     Args:
         text (str): original text
 
@@ -359,7 +359,7 @@ def replace_images_keys_with_url(text, team_id, message_id):
     host = os.environ.get("DOMAIN")
     replaced_text = re.sub(
         r"!\[.*?\]\((.*?)\)",
-        lambda match: f"![]({host}/api/{team_id}/{message_id}/image/{match.group(1)})",
+        lambda match: f"![]({host}/api/{team_id}/{message_id}/{repo_id}/image/{match.group(1)})",
         text,
     )
 
diff --git a/server/tasks/lark/issue.py b/server/tasks/lark/issue.py
index 8dfc7602..39aff21f 100644
--- a/server/tasks/lark/issue.py
+++ b/server/tasks/lark/issue.py
@@ -605,7 +605,7 @@ def create_issue_comment(app_id, message_id, content, data, *args, **kwargs):
 
     # 处理 desc
     comment_text = process_desc(
-        app_id, message_id, comment_text, data, team, *args, **kwargs
+        app_id, message_id, repo.id, comment_text, data, team, *args, **kwargs
     )
 
     response = github_app.create_issue_comment(
diff --git a/server/utils/utils.py b/server/utils/utils.py
index badc58d4..0f52b161 100644
--- a/server/utils/utils.py
+++ b/server/utils/utils.py
@@ -6,12 +6,11 @@
 
 
 def process_image(url, bot):
-    if (
-        not url
-        or not url.startswith("http")
-        or url.startswith(f"{os.environ.get('DOMAIN')}/api")
-    ):
+    if not url or not url.startswith("http"):
         return ""
+
+    if url.startswith(f"{os.environ.get('DOMAIN')}/api"):
+        return url.split("/")[-1]
     return upload_image(url, bot)
 
 

From 611cf4c96209e0acc527f1ea2285eea9a5a62ae0 Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Mon, 26 Feb 2024 18:23:43 +0800
Subject: [PATCH 8/9] add comment

---
 server/routes/user.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/routes/user.py b/server/routes/user.py
index 0ed29e0a..471888cd 100644
--- a/server/routes/user.py
+++ b/server/routes/user.py
@@ -65,8 +65,9 @@ def set_account():
 @bp.route("/<team_id>/<message_id>/<repo_id>/image/<img_key>", methods=["GET"])
 def get_image(team_id, message_id, repo_id, img_key):
     """
-    1. 用 img_key 下载 image(cache)
-    2.
+    1. 用 img_key 请求飞书接口下载 image
+    2. 判断请求来源，如果是 GitHub 调用，则直接返回 image
+    3. 用户调用 校验权限
     """
 
     def download_and_respond():

From e84ea0339ed39ab64eefef586b703973e6e34d34 Mon Sep 17 00:00:00 2001
From: freeziyou <80776877@qq.com>
Date: Tue, 27 Feb 2024 13:16:39 +0800
Subject: [PATCH 9/9] change params order

---
 server/routes/user.py     | 2 +-
 server/tasks/lark/chat.py | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/server/routes/user.py b/server/routes/user.py
index 471888cd..ece91c1f 100644
--- a/server/routes/user.py
+++ b/server/routes/user.py
@@ -62,7 +62,7 @@ def set_account():
     return jsonify({"code": 0, "msg": "success"})
 
 
-@bp.route("/<team_id>/<message_id>/<repo_id>/image/<img_key>", methods=["GET"])
+@bp.route("/<team_id>/<repo_id>/<message_id>/image/<img_key>", methods=["GET"])
 def get_image(team_id, message_id, repo_id, img_key):
     """
     1. 用 img_key 请求飞书接口下载 image
diff --git a/server/tasks/lark/chat.py b/server/tasks/lark/chat.py
index cfc179c7..bf499890 100644
--- a/server/tasks/lark/chat.py
+++ b/server/tasks/lark/chat.py
@@ -349,7 +349,7 @@ def process_desc(app_id, message_id, repo_id, desc, data, team, *args, **kwargs)
 def replace_images_keys_with_url(text, team_id, message_id, repo_id):
     """
     replace image_key with image URL.
-    ![](image_key) -> ![](gitmaya.com/api/<team_id>/<message_id>/<repo_id>/image/<image_key>)
+    ![](image_key) -> ![](gitmaya.com/api/<team_id>/<repo_id>/<message_id>/image/<image_key>)
     Args:
         text (str): original text
 
@@ -359,7 +359,7 @@ def replace_images_keys_with_url(text, team_id, message_id, repo_id):
     host = os.environ.get("DOMAIN")
     replaced_text = re.sub(
         r"!\[.*?\]\((.*?)\)",
-        lambda match: f"![]({host}/api/{team_id}/{message_id}/{repo_id}/image/{match.group(1)})",
+        lambda match: f"![]({host}/api/{team_id}/{repo_id}/{message_id}/image/{match.group(1)})",
         text,
     )