fix: 修复markdown渲染脚本问题

新增 Token 的 IsEnableLog 字段，贯穿领域、应用与 DTO；在 OpenApiService 中根据 Token 配置异步记录请求日志，包含请求体、模型与接口类型，用于后续审计与分析。

Yi.Abp.Net8/module/ai-hub/Yi.Framework.AiHub.Application.Contracts/Dtos/Token/TokenGetListOutputDto.cs

@@ -40,6 +40,11 @@ public class TokenGetListOutputDto
     /// </summary>
     public bool IsDisabled { get; set; }
 
+    /// <summary>
+    /// 是否启用请求日志记录
+    /// </summary>
+    public bool IsEnableLog { get; set; }
+
     /// <summary>
     /// 创建时间
     /// </summary>

Yi.Abp.Net8/module/ai-hub/Yi.Framework.AiHub.Application/Services/Chat/TokenService.cs

@@ -83,6 +83,7 @@ public class TokenService : ApplicationService
                 PremiumQuotaLimit = t.PremiumQuotaLimit,
                 PremiumUsedQuota = usedQuota,
                 IsDisabled = t.IsDisabled,
+                IsEnableLog = t.IsEnableLog,
                 CreationTime = t.CreationTime
             };
         }).ToList();
@@ -158,6 +159,7 @@ public class TokenService : ApplicationService
             PremiumQuotaLimit = token.PremiumQuotaLimit,
             PremiumUsedQuota = 0,
             IsDisabled = token.IsDisabled,
+            IsEnableLog = token.IsEnableLog,
             CreationTime = token.CreationTime
         };
     }

Yi.Abp.Net8/module/ai-hub/Yi.Framework.AiHub.Application/Services/OpenApiService.cs

@@ -1,12 +1,15 @@
 using System.Text.Json;
 using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
 using Volo.Abp.Application.Services;
+using Volo.Abp.Uow;
 using Volo.Abp.Users;
 using Yi.Framework.AiHub.Domain.Entities;
 using Yi.Framework.AiHub.Domain.Entities.Chat;
 using Yi.Framework.AiHub.Domain.Entities.Model;
+using Yi.Framework.AiHub.Domain.Entities.OpenApi;
 using Yi.Framework.AiHub.Domain.Extensions;
 using Yi.Framework.AiHub.Domain.Managers;
 using Yi.Framework.AiHub.Domain.Shared.Consts;
@@ -33,10 +36,12 @@ public class OpenApiService : ApplicationService
     private readonly PremiumPackageManager _premiumPackageManager;
     private readonly ISqlSugarRepository<ImageStoreTaskAggregateRoot> _imageStoreRepository;
     private readonly ISqlSugarRepository<AiModelEntity> _aiModelRepository;
+    private readonly IServiceScopeFactory _serviceScopeFactory;
     public OpenApiService(IHttpContextAccessor httpContextAccessor, ILogger<OpenApiService> logger,
         TokenManager tokenManager, AiGateWayManager aiGateWayManager,
         ModelManager modelManager, AiBlacklistManager aiBlacklistManager,
-        IAccountService accountService, PremiumPackageManager premiumPackageManager, ISqlSugarRepository<ImageStoreTaskAggregateRoot> imageStoreRepository, ISqlSugarRepository<AiModelEntity> aiModelRepository)
+        IAccountService accountService, PremiumPackageManager premiumPackageManager, ISqlSugarRepository<ImageStoreTaskAggregateRoot> imageStoreRepository, ISqlSugarRepository<AiModelEntity> aiModelRepository,
+        IServiceScopeFactory serviceScopeFactory)
     {
         _httpContextAccessor = httpContextAccessor;
         _logger = logger;
@@ -48,6 +53,7 @@ public class OpenApiService : ApplicationService
         _premiumPackageManager = premiumPackageManager;
         _imageStoreRepository = imageStoreRepository;
         _aiModelRepository = aiModelRepository;
+        _serviceScopeFactory = serviceScopeFactory;
     }
 
     /// <summary>
@@ -91,6 +97,12 @@ public class OpenApiService : ApplicationService
                 null, tokenId,
                 CancellationToken.None);
         }
+
+        // 记录请求日志
+        if (tokenValidation.IsEnableLog)
+        {
+            FireAndForgetMessageLog(JsonSerializer.Serialize(input), tokenValidation.Token, tokenValidation.TokenName, input.Model, ModelApiTypeEnum.Completions);
+        }
     }
 
 
@@ -206,6 +218,12 @@ public class OpenApiService : ApplicationService
                 null, tokenId,
                 CancellationToken.None);
         }
+
+        // 记录请求日志
+        if (tokenValidation.IsEnableLog)
+        {
+            FireAndForgetMessageLog(JsonSerializer.Serialize(input), tokenValidation.Token, tokenValidation.TokenName, input.Model, ModelApiTypeEnum.Messages);
+        }
     }
 
 
@@ -258,6 +276,12 @@ public class OpenApiService : ApplicationService
                 null, tokenId,
                 CancellationToken.None);
         }
+
+        // 记录请求日志
+        if (tokenValidation.IsEnableLog)
+        {
+            FireAndForgetMessageLog(JsonSerializer.Serialize(input), tokenValidation.Token, tokenValidation.TokenName, input.Model, ModelApiTypeEnum.Responses);
+        }
     }
 
 
@@ -318,6 +342,12 @@ public class OpenApiService : ApplicationService
                 null, tokenId,
                 CancellationToken.None);
         }
+
+        // 记录请求日志
+        if (tokenValidation.IsEnableLog)
+        {
+            FireAndForgetMessageLog(input.GetRawText(), tokenValidation.Token, tokenValidation.TokenName, modelId, ModelApiTypeEnum.GenerateContent);
+        }
     }
 
     #region 私有
@@ -357,5 +387,25 @@ public class OpenApiService : ApplicationService
         }
     }
 
+    private void FireAndForgetMessageLog(string requestBody, string apiKey, string apiKeyName, string modelId, ModelApiTypeEnum apiType)
+    {
+        _ = Task.Run(async () =>
+        {
+            try
+            {
+                using var scope = _serviceScopeFactory.CreateScope();
+                var uowManager = scope.ServiceProvider.GetRequiredService<IUnitOfWorkManager>();
+                var manager = scope.ServiceProvider.GetRequiredService<MessageLogManager>();
+                using var uow = uowManager.Begin(requiresNew: true);
+                await manager.CreateAsync(requestBody, apiKey, apiKeyName, modelId, apiType);
+                await uow.CompleteAsync();
+            }
+            catch (Exception ex)
+            {
+                _logger.LogError(ex, "记录消息日志失败, 请求体长度: {RequestBodyLength}", requestBody?.Length ?? 0);
+            }
+        });
+    }
+
     #endregion
 }

Yi.Abp.Net8/module/ai-hub/Yi.Framework.AiHub.Domain/Entities/OpenApi/MessageLogAggregateRoot.cs

@@ -0,0 +1,49 @@
+using SqlSugar;
+using Volo.Abp.Domain.Entities;
+using Yi.Framework.AiHub.Domain.Shared.Enums;
+
+namespace Yi.Framework.AiHub.Domain.Entities.OpenApi;
+
+[SugarTable("Ai_Message_Log")]
+public class MessageLogAggregateRoot : Entity<Guid>
+{
+    /// <summary>
+    /// 请求内容（httpbody）
+    /// </summary>
+    [SugarColumn(ColumnDataType = "text")]
+    public string? RequestBody { get; set; }
+
+    /// <summary>
+    /// 请求apikey
+    /// </summary>
+    [SugarColumn(Length = 255)]
+    public string ApiKey { get; set; }
+
+    /// <summary>
+    /// 请求apikey名称
+    /// </summary>
+    [SugarColumn(Length = 255)]
+    public string ApiKeyName { get; set; }
+
+    /// <summary>
+    /// 创建时间
+    /// </summary>
+    public DateTime CreationTime { get; set; }
+
+    /// <summary>
+    /// 模型id
+    /// </summary>
+    [SugarColumn(Length = 64)]
+    public string ModelId { get; set; }
+
+    /// <summary>
+    /// api类型
+    /// </summary>
+    public ModelApiTypeEnum ApiType { get; set; }
+
+    /// <summary>
+    /// api类型名称
+    /// </summary>
+    [SugarColumn(Length = 16)]
+    public string ApiTypeName { get; set; }
+}

Yi.Abp.Net8/module/ai-hub/Yi.Framework.AiHub.Domain/Entities/OpenApi/TokenAggregateRoot.cs

@@ -51,6 +51,11 @@ public class TokenAggregateRoot : FullAuditedAggregateRoot<Guid>
     /// </summary>
     public bool IsDisabled { get; set; }
 
+    /// <summary>
+    /// 是否启用请求日志记录（仅数据库手动修改）
+    /// </summary>
+    public bool IsEnableLog { get; set; }
+
     /// <summary>
     /// 检查Token是否可用
     /// </summary>

Yi.Abp.Net8/module/ai-hub/Yi.Framework.AiHub.Domain/Managers/MessageLogManager.cs

@@ -0,0 +1,34 @@
+using Volo.Abp.Domain.Services;
+using Yi.Framework.AiHub.Domain.Entities.OpenApi;
+using Yi.Framework.AiHub.Domain.Shared.Enums;
+using Yi.Framework.SqlSugarCore.Abstractions;
+
+namespace Yi.Framework.AiHub.Domain.Managers;
+
+public class MessageLogManager : DomainService
+{
+    private readonly ISqlSugarRepository<MessageLogAggregateRoot> _repository;
+
+    public MessageLogManager(ISqlSugarRepository<MessageLogAggregateRoot> repository)
+    {
+        _repository = repository;
+    }
+
+    /// <summary>
+    /// 创建消息日志
+    /// </summary>
+    public async Task CreateAsync(string requestBody, string apiKey, string apiKeyName, string modelId, ModelApiTypeEnum apiType)
+    {
+        var entity = new MessageLogAggregateRoot
+        {
+            RequestBody = requestBody,
+            ApiKey = apiKey,
+            ApiKeyName = apiKeyName,
+            ModelId = modelId,
+            ApiType = apiType,
+            ApiTypeName = apiType.ToString(),
+            CreationTime = DateTime.Now
+        };
+        await _repository.InsertAsync(entity);
+    }
+}

Yi.Abp.Net8/module/ai-hub/Yi.Framework.AiHub.Domain/Managers/TokenManager.cs

@@ -27,6 +27,16 @@ public class TokenValidationResult
     /// token
     /// </summary>
     public string Token { get; set; }
+
+    /// <summary>
+    /// Token名称
+    /// </summary>
+    public string TokenName { get; set; }
+
+    /// <summary>
+    /// 是否启用请求日志记录
+    /// </summary>
+    public bool IsEnableLog { get; set; }
 }
 
 public class TokenManager : DomainService
@@ -117,7 +127,9 @@ public class TokenManager : DomainService
         {
             UserId = entity.UserId,
             TokenId = entity.Id,
-            Token = entity.Token
+            Token = entity.Token,
+            TokenName = entity.Name,
+            IsEnableLog = entity.IsEnableLog
         };
     }
 

Yi.Abp.Net8/src/Yi.Abp.Web/Program.cs

@@ -17,6 +17,8 @@ Log.Logger = new LoggerConfiguration()
     .MinimumLevel.Override("Microsoft.AspNetCore.Authorization.DefaultAuthorizationService", LogEventLevel.Warning)
     .MinimumLevel.Override("Microsoft.AspNetCore.Routing.EndpointMiddleware", LogEventLevel.Warning)
     .MinimumLevel.Override("Hangfire.Server.ServerHeartbeatProcess", LogEventLevel.Warning)
+    .MinimumLevel.Override("Hangfire.Redis.StackExchange.FetchedJobsWatcher", LogEventLevel.Warning)
+    .MinimumLevel.Override("Hangfire.Processing.BackgroundExecution", LogEventLevel.Warning)
     .Enrich.FromLogContext()
     .WriteTo.Async(c => c.File("logs/all/log-.txt", rollingInterval: RollingInterval.Day, restrictedToMinimumLevel: LogEventLevel.Debug,outputTemplate:outputTemplate))
     .WriteTo.Async(c => c.File("logs/error/errorlog-.txt", rollingInterval: RollingInterval.Day, restrictedToMinimumLevel: LogEventLevel.Error,outputTemplate:outputTemplate))

Yi.Abp.Net8/src/Yi.Abp.Web/YiAbpWebModule.cs

@@ -361,7 +361,7 @@ namespace Yi.Abp.Web
             var app = context.GetApplicationBuilder();
             app.UseRouting();
 
-            // app.ApplicationServices.GetRequiredService<ISqlSugarDbContext>().SqlSugarClient.CodeFirst.InitTables<RankingItemAggregateRoot>();
+            //app.ApplicationServices.GetRequiredService<ISqlSugarDbContext>().SqlSugarClient.CodeFirst.InitTables<MessageLogAggregateRoot>();
             // app.ApplicationServices.GetRequiredService<ISqlSugarDbContext>().SqlSugarClient.CodeFirst.InitTables<ActivationCodeRecordAggregateRoot>();
             // app.ApplicationServices.GetRequiredService<ISqlSugarDbContext>().SqlSugarClient.CodeFirst.InitTables<UsageStatisticsAggregateRoot>();
 

Yi.Ai.Vue3/.claude/settings.local.json

@@ -10,7 +10,9 @@
       "Bash(npm install marked --save)",
       "Bash(pnpm add marked)",
       "Bash(pnpm lint:*)",
-      "Bash(pnpm list:*)"
+      "Bash(pnpm list:*)",
+      "Bash(pnpm vue-tsc:*)",
+      "Bash(pnpm build:*)"
     ],
     "deny": [],
     "ask": []

Yi.Ai.Vue3/src/components/MarkedMarkdown/index.vue

@@ -10,11 +10,13 @@ import { useDesignStore } from '@/stores';
 interface Props {
   content: string;
   theme?: 'light' | 'dark' | 'auto';
+  sanitize?: boolean;
 }
 
 const props = withDefaults(defineProps<Props>(), {
   content: '',
   theme: 'auto',
+  sanitize: true,
 });
 
 const designStore = useDesignStore();
@@ -94,7 +96,12 @@ const renderer = {
 
   // 行内代码
   codespan(token: { text: string }) {
-    return `<code class="inline-code">${token.text}</code>`;
+    // 转义 HTML 标签，防止 <script> 等标签被浏览器解析
+    const escapedText = token.text
+      .replace(/&/g, '&amp;')
+      .replace(/</g, '&lt;')
+      .replace(/>/g, '&gt;');
+    return `<code class="inline-code">${escapedText}</code>`;
   },
 
   // 链接
@@ -148,11 +155,23 @@ async function renderContent(content: string) {
     // 包装表格，添加 table-wrapper 以支持横向滚动
     rawHtml = rawHtml.replace(/<table>/g, '<div class="table-wrapper"><table>');
     rawHtml = rawHtml.replace(/<\/table>/g, '</table></div>');
-    // 使用 DOMPurify 清理 HTML，防止 XSS
+    // 转义 script 标签，防止浏览器将其当作真实脚本解析
+    // 使用字符串拼接避免在源码中出现 script 标签字面量
+    const scriptStart = '<' + 'script';
+    const scriptEnd = '<' + '/script' + '>';
+    rawHtml = rawHtml.replace(new RegExp(scriptStart + '(.*?)>', 'gi'), '&lt;script$1&gt;');
+    rawHtml = rawHtml.replace(new RegExp(scriptEnd.replace('/', '\\/'), 'gi'), '&lt;/script&gt;');
+
+    // 使用 DOMPurify 清理 HTML，防止 XSS（可通过 sanitize 属性禁用）
+    if (props.sanitize) {
       renderedHtml.value = DOMPurify.sanitize(rawHtml, {
         ADD_TAGS: ['iframe'],
         ADD_ATTR: ['target', 'data-code', 'data-html'],
       });
+    }
+    else {
+      renderedHtml.value = rawHtml;
+    }
 
     // 渲染后绑定按钮事件
     nextTick(() => {

Yi.Ai.Vue3/src/components/userPersonalCenter/components/TokenFormDialog.vue

@@ -8,6 +8,7 @@ interface TokenFormData {
   expireTime: string;
   premiumQuotaLimit: number | null;
   quotaUnit: string;
+  isEnableLog?: boolean;
 }
 
 interface Props {
@@ -42,6 +43,7 @@ const localFormData = ref<TokenFormData>({
 const submitting = ref(false);
 const neverExpire = ref(false); // 永不过期开关
 const unlimitedQuota = ref(false); // 无限制额度开关
+const isEnableLog = ref(false); // 是否启用请求日志（只读）
 
 // 移动端检测
 const isMobile = ref(false);
@@ -107,6 +109,9 @@ watch(() => props.visible, (newVal) => {
       // 判断是否永不过期
       neverExpire.value = !props.formData.expireTime;
 
+      // 读取是否启用请求日志（只读字段）
+      isEnableLog.value = props.formData.isEnableLog || false;
+
       localFormData.value = {
         ...props.formData,
         premiumQuotaLimit: displayValue,
@@ -196,13 +201,13 @@ const dialogTitle = computed(() => props.mode === 'create' ? '新增 API密钥'
   <el-dialog
     :model-value="visible"
     :title="dialogTitle"
-    :width="isMobile ? '95%' : '540px'"
+    :width="isMobile ? '95%' : '640px'"
     :fullscreen="isMobile"
     :close-on-click-modal="false"
     :show-close="!submitting"
     @close="handleClose"
   >
-    <el-form :model="localFormData" :label-width="isMobile ? '100%' : '110px'" :label-position="isMobile ? 'top' : 'right'">
+    <el-form :model="localFormData" :label-width="isMobile ? '100%' : '150px'" :label-position="isMobile ? 'top' : 'right'">
       <el-form-item label="API密钥名称" required>
         <el-input
           v-model="localFormData.name"
@@ -288,6 +293,21 @@ const dialogTitle = computed(() => props.mode === 'create' ? '新增 API密钥'
           超出配额后API密钥将无法继续使用
         </div>
       </el-form-item>
+
+      <!-- 仅编辑模式显示：请求日志开关（只读） -->
+      <el-form-item v-if="mode === 'edit'" label="请求日志存储">
+        <div class="form-item-inline">
+          <el-switch
+            v-model="isEnableLog"
+            disabled
+          />
+          <span class="switch-status-text">{{ isEnableLog ? '已开启' : '已关闭' }}</span>
+        </div>
+        <div class="form-hint warning-hint">
+          <el-icon><i-ep-warning-filled /></el-icon>
+          此临时存储功能仅面向企业套餐用户，仅用于企业内部审计
+        </div>
+      </el-form-item>
     </el-form>
 
     <template #footer>
@@ -356,6 +376,15 @@ const dialogTitle = computed(() => props.mode === 'create' ? '新增 API密钥'
     color: #409eff;
     flex-shrink: 0;
   }
+
+  &.warning-hint {
+    background: #fdf6ec;
+    border-left-color: #e6a23c;
+
+    .el-icon {
+      color: #e6a23c;
+    }
+  }
 }
 
 .dialog-footer {
@@ -364,6 +393,18 @@ const dialogTitle = computed(() => props.mode === 'create' ? '新增 API密钥'
   gap: 12px;
 }
 
+.switch-status-text {
+  font-size: 14px;
+  color: #606266;
+  margin-left: 8px;
+}
+
+.form-item-inline {
+  display: flex;
+  align-items: center;
+  gap: 8px;
+}
+
 :deep(.el-form-item__label) {
   font-weight: 600;
   color: #303133;