Fix secret (#6738)

* fix: nosql inject * fix: nosql * fix: ts * doc * fix: update feedbacksession

Fix secret (#6738)
* fix: nosql inject * fix: nosql * fix: ts * doc * fix: update feedbacksession
fc6953fc · Archer · GitHub · 6173a745 · fc6953fc · fc6953fc
Commit fc6953fc authored Apr 10, 2026 by Archer Committed by GitHub Apr 10, 2026
26 changed files
--- a/.claude/skills/system-pr_review/SKILL.md
+++ b/.claude/skills/system-pr_review/SKILL.md
@@ -142,7 +142,6 @@ FastGPT 项目特定的代码规范和约定:
 - **TypeScript 问题**: any 类型滥用、类型定义不完整、不安全断言
 - **异步错误处理**: 未处理 Promise、错误信息丢失、静默失败
 - **React 性能**: 不必要的重渲染、渲染中创建对象、缺少 memoization
- **工作流节点**: isEntry 未重置、交互历史未清理、白名单遗漏
 - **安全漏洞**: 注入攻击、XSS、文件上传漏洞
 📖 **详细清单**: [common-issues-checklist.md](./common-issues-checklist.md)

--- a/.claude/skills/system-pr_review/common-issues-checklist.md
+++ b/.claude/skills/system-pr_review/common-issues-checklist.md
--- a/document/content/docs/self-host/upgrading/4-14/41411.mdx
+++ b/document/content/docs/self-host/upgrading/4-14/41411.mdx
@@ -14,3 +14,4 @@ description: 'FastGPT V4.14.11 更新说明'
 1. 对话 Agent 模式，模型存在刷新后被重置问题。
 2. 部分接口未正确进行权限校验。
+3. 修复部分接口 nosql 注入分析。
\ No newline at end of file
--- a/document/data/doc-last-modified.json
+++ b/document/data/doc-last-modified.json
@@ -222,7 +222,7 @@
  "document/content/docs/self-host/upgrading/4-14/4141.mdx": "2026-03-03T17:39:47+08:00",
  "document/content/docs/self-host/upgrading/4-14/41410.en.mdx": "2026-03-31T23:15:29+08:00",
  "document/content/docs/self-host/upgrading/4-14/41410.mdx": "2026-04-08T16:15:25+08:00",
-  "document/content/docs/self-host/upgrading/4-14/41411.mdx": "2026-04-07T21:48:43+08:00",
+  "document/content/docs/self-host/upgrading/4-14/41411.mdx": "2026-04-09T15:12:39+08:00",
  "document/content/docs/self-host/upgrading/4-14/4142.en.mdx": "2026-03-03T17:39:47+08:00",
  "document/content/docs/self-host/upgrading/4-14/4142.mdx": "2026-03-03T17:39:47+08:00",
  "document/content/docs/self-host/upgrading/4-14/4143.en.mdx": "2026-03-03T17:39:47+08:00",

--- a/packages/global/core/dataset/type.ts
+++ b/packages/global/core/dataset/type.ts
@@ -21,8 +21,10 @@ import type {
  YuqueServer
 } from './apiDataset/type';
 import type { SourceMemberType } from '../../support/user/type';
-import type { DatasetDataIndexTypeEnum } from './data/constants';
+import { DatasetDataIndexTypeEnum } from './data/constants';
 import type { ParentIdType } from '../../common/parentFolder/type';
+import z from 'zod';
+import { ObjectIdSchema } from '../../common/type/mongo';
 export type ChunkSettingsType = {
  trainingType?: DatasetCollectionDataProcessModeEnum;
@@ -146,35 +148,42 @@ export type DatasetCollectionTagsSchemaType = {
  tag: string;
 };
-export type DatasetDataIndexItemType = {
+export const DatasetDataIndexItemSchema = z.object({
-  type: `${DatasetDataIndexTypeEnum}`;
+  type: z.enum(DatasetDataIndexTypeEnum).meta({ description: '索引类型' }),
-  dataId: string; // pg data id
+  dataId: z.string().meta({ description: 'vectorDB ID' }),
-  text: string;
+  text: z.string().meta({ description: '索引文本' })
-};
+});
+export type DatasetDataIndexItemType = z.infer<typeof DatasetDataIndexItemSchema>;
-export type DatasetDataFieldType = {
-  q: string; // large chunks or question
+export const DatasetDataFieldSchema = z.object({
-  a?: string; // answer or custom content
+  q: z.string().meta({ description: '问题/主文本' }),
-  imageId?: string;
+  a: z.string().optional().meta({ description: '回答/补充文本' }),
-};
+  imageId: z.string().optional().meta({ description: '图片 ID' })
-export type DatasetDataSchemaType = DatasetDataFieldType & {
+});
-  _id: string;
+export type DatasetDataFieldType = z.infer<typeof DatasetDataFieldSchema>;
-  userId: string;
-  teamId: string;
+export const DatasetDataHistorySchema = DatasetDataFieldSchema.extend({
-  tmbId: string;
+  updateTime: z.date().meta({ description: '更新时间' })
-  datasetId: string;
+});
-  collectionId: string;
+export type DatasetDataHistoryType = z.infer<typeof DatasetDataHistorySchema>;
-  chunkIndex: number;
-  updateTime: Date;
+export const DatasetDataSchema = DatasetDataFieldSchema.extend({
-  history?: (DatasetDataFieldType & {
+  _id: ObjectIdSchema.meta({ description: '数据 ID' }),
-    updateTime: Date;
+  userId: ObjectIdSchema.meta({ description: '用户 ID' }),
-  })[];
+  teamId: ObjectIdSchema.meta({ description: '团队 ID' }),
-  forbid?: boolean;
+  tmbId: ObjectIdSchema.meta({ description: '团队成员 ID' }),
-  fullTextToken: string;
+  datasetId: ObjectIdSchema.meta({ description: '数据集 ID' }),
-  indexes: DatasetDataIndexItemType[];
+  collectionId: ObjectIdSchema.meta({ description: '集合 ID' }),
-  rebuilding?: boolean;
+  chunkIndex: z.int().min(0).meta({ description: '块索引' }),
-  imageDescMap?: Record<string, string>;
+  updateTime: z.date().meta({ description: '更新时间' }),
-};
+  history: z.array(DatasetDataHistorySchema).optional().meta({ description: '历史版本' }),
+  forbid: z.boolean().optional().meta({ description: '是否禁用' }),
+  fullTextToken: z.string().meta({ description: '全文 token' }),
+  indexes: z.array(DatasetDataIndexItemSchema).meta({ description: '向量索引' }),
+  rebuilding: z.boolean().optional().meta({ description: '重建中' }),
+  imageDescMap: z.record(z.string(), z.string()).optional().meta({ description: '图片描述映射' })
+});
+export type DatasetDataSchemaType = z.infer<typeof DatasetDataSchema>;
 export type DatasetDataTextSchemaType = {
  _id: string;
@@ -308,13 +317,18 @@ export type SearchDataResponseItemType = Omit<
  // score: number;
 };
-export type DatasetCiteItemType = {
+export const DatasetCiteItemSchema = z
-  _id: string;
+  .object({
-  q: string;
+    _id: ObjectIdSchema.meta({ description: '数据 ID' }),
-  a?: string;
+    q: z.string().meta({ description: '问题/主文本' }),
-  imagePreivewUrl?: string;
+    a: z.string().optional().meta({ description: '回答/补充文本' }),
-  history?: DatasetDataSchemaType['history'];
+    imagePreivewUrl: z.string().optional().meta({ description: '图片预览 URL' }),
-  updateTime: DatasetDataSchemaType['updateTime'];
+    history: DatasetDataSchema.shape.history.optional(),
-  index: DatasetDataSchemaType['chunkIndex'];
+    updateTime: DatasetDataSchema.shape.updateTime,
-  updated?: boolean;
+    index: DatasetDataSchema.shape.chunkIndex,
-};
+    updated: z.boolean().optional().meta({ description: '是否已更新' })
+  })
+  .meta({
+    description: '知识库引用数据列表'
+  });
+export type DatasetCiteItemType = z.infer<typeof DatasetCiteItemSchema>;
--- a/packages/global/openapi/core/ai/agent/api.ts
+++ b/packages/global/openapi/core/ai/agent/api.ts
+import { z } from 'zod';
+import { OutLinkChatAuthSchema } from '../../../../support/permission/chat';
+import { ChatMessageSchema } from '../api';
+/* ============================================================================
+ * API: 创建问题引导
+ * Route: POST /api/core/ai/agent/createQuestionGuide
+ * Method: POST
+ * Description: 根据对话历史生成推荐的引导问题列表
+ * Tags: ['AI', 'Agent', 'Read']
+ * ============================================================================ */
+export const CreateQuestionGuideBodySchema = OutLinkChatAuthSchema.extend({
+  messages: z.array(ChatMessageSchema).meta({
+    description: '对话历史消息列表'
+  })
+});
+export type CreateQuestionGuideBodyType = z.infer<typeof CreateQuestionGuideBodySchema>;
+export const CreateQuestionGuideResponseSchema = z.array(z.string()).meta({
+  example: ['你能帮我做什么？', '如何使用这个功能？'],
+  description: '推荐的引导问题列表'
+});
+export type CreateQuestionGuideResponseType = z.infer<typeof CreateQuestionGuideResponseSchema>;
--- a/packages/global/openapi/core/ai/agent/index.ts
+++ b/packages/global/openapi/core/ai/agent/index.ts
+import type { OpenAPIPath } from '../../../type';
+import { TagsMap } from '../../../tag';
+import { CreateQuestionGuideBodySchema, CreateQuestionGuideResponseSchema } from './api';
+export const AgentPath: OpenAPIPath = {
+  '/core/ai/agent/createQuestionGuide': {
+    post: {
+      summary: '创建问题引导',
+      description: '根据对话历史生成推荐的引导问题列表',
+      tags: [TagsMap.aiCommon],
+      requestBody: {
+        content: {
+          'application/json': {
+            schema: CreateQuestionGuideBodySchema
+          }
+        }
+      },
+      responses: {
+        200: {
+          description: '成功返回推荐的引导问题列表',
+          content: {
+            'application/json': {
+              schema: CreateQuestionGuideResponseSchema
+            }
+          }
+        }
+      }
+    }
+  }
+};
--- a/packages/global/openapi/core/ai/api.ts
+++ b/packages/global/openapi/core/ai/api.ts
@@ -31,3 +31,24 @@ export const LLMRequestRecordSchema = z.object({
 });
 export type LLMRequestRecordSchemaType = z.infer<typeof LLMRequestRecordSchema>;
+/* ============================================================================
+ * 共享 Schema
+ * ============================================================================ */
+export const ChatMessageSchema = z.object({
+  role: z.enum(['user', 'assistant', 'system', 'tool', 'function']).meta({
+    example: 'user',
+    description: '消息角色'
+  }),
+  content: z
+    .union([z.string(), z.array(z.object())])
+    .optional()
+    .meta({
+      example: '你好',
+      description: '消息内容'
+    }),
+  name: z.string().optional().meta({ description: '发送者名称' }),
+  tool_calls: z.array(z.object()).optional().meta({ description: '工具调用' }),
+  tool_call_id: z.string().optional().meta({ description: '工具调用 ID' })
+});
--- a/packages/global/openapi/core/ai/index.ts
+++ b/packages/global/openapi/core/ai/index.ts
@@ -2,9 +2,11 @@ import type { OpenAPIPath } from '../../type';
 import { TagsMap } from '../../tag';
 import { GetLLMRequestRecordParamsSchema, LLMRequestRecordSchema } from './api';
 import { SandboxPath } from './sandbox';
+import { AgentPath } from './agent';
 export const AIPath: OpenAPIPath = {
  ...SandboxPath,
+  ...AgentPath,
  '/core/ai/record/getRecord': {
    get: {

--- a/packages/global/openapi/core/chat/index.ts
+++ b/packages/global/openapi/core/chat/index.ts
@@ -7,6 +7,8 @@ import { GetRecentlyUsedAppsResponseSchema } from './api';
 import { TagsMap } from '../../tag';
 import { ChatControllerPath } from './controler';
 import { HelperBotPath } from './helperBot';
+import { ChatQuotePath } from './quote/index';
+import { ChatInputGuidePath } from './inputGuide/index';
 export const ChatPath: OpenAPIPath = {
  ...ChatSettingPath,
@@ -15,6 +17,8 @@ export const ChatPath: OpenAPIPath = {
  ...ChatHistoryPath,
  ...ChatControllerPath,
  ...HelperBotPath,
+  ...ChatQuotePath,
+  ...ChatInputGuidePath,
  '/core/chat/recentlyUsed': {
    get: {

--- a/packages/global/openapi/core/chat/inputGuide/api.ts
+++ b/packages/global/openapi/core/chat/inputGuide/api.ts
+import { z } from 'zod';
+import { PaginationSchema } from '../../../api';
+import { ObjectIdSchema } from '../../../../common/type/mongo';
+/* ============================================================================
+ * API: 获取对话输入引导列表
+ * Route: POST /api/core/chat/inputGuide/list
+ * Method: POST
+ * Description: 获取指定应用的对话输入引导列表，支持关键词搜索
+ * Tags: ['Chat', 'InputGuide', 'Read']
+ * ============================================================================ */
+export const ChatInputGuideListBodySchema = PaginationSchema.extend({
+  appId: ObjectIdSchema.describe('应用 ID'),
+  searchKey: z.string().max(200).optional().default('').meta({
+    example: '如何使用',
+    description: '搜索关键词，用于模糊匹配引导文本'
+  })
+});
+export type ChatInputGuideListBodyType = z.infer<typeof ChatInputGuideListBodySchema>;
+export const ChatInputGuideItemSchema = z.object({
+  _id: z.coerce.string().meta({ example: '68ad85a7463006c963799a05', description: '引导 ID' }),
+  appId: z.coerce.string().meta({ example: '68ad85a7463006c963799a06', description: '应用 ID' }),
+  text: z.string().meta({ example: '如何开始使用？', description: '引导文本' })
+});
+export const ChatInputGuideListResponseSchema = z.object({
+  list: z.array(ChatInputGuideItemSchema).meta({ description: '引导列表' }),
+  total: z.number().meta({ example: 10, description: '总数' })
+});
+export type ChatInputGuideListResponseType = z.infer<typeof ChatInputGuideListResponseSchema>;
--- a/packages/global/openapi/core/chat/inputGuide/index.ts
+++ b/packages/global/openapi/core/chat/inputGuide/index.ts
+import type { OpenAPIPath } from '../../../type';
+import { TagsMap } from '../../../tag';
+import { ChatInputGuideListBodySchema, ChatInputGuideListResponseSchema } from './api';
+export const ChatInputGuidePath: OpenAPIPath = {
+  '/core/chat/inputGuide/list': {
+    post: {
+      summary: '获取对话输入引导列表',
+      description: '获取指定应用的对话输入引导列表，支持关键词模糊搜索和分页',
+      tags: [TagsMap.chatInputGuide],
+      requestBody: {
+        content: {
+          'application/json': {
+            schema: ChatInputGuideListBodySchema
+          }
+        }
+      },
+      responses: {
+        200: {
+          description: '成功返回输入引导列表',
+          content: {
+            'application/json': {
+              schema: ChatInputGuideListResponseSchema
+            }
+          }
+        }
+      }
+    }
+  }
+};
--- a/packages/global/openapi/core/chat/quote/api.ts
+++ b/packages/global/openapi/core/chat/quote/api.ts
+import { z } from 'zod';
+import { ObjectIdSchema } from '../../../../common/type/mongo';
+import { OutLinkChatAuthSchema } from '../../../../support/permission/chat';
+import { DatasetCiteItemSchema } from '../../../../core/dataset/type';
+/* ============================================================================
+ * API: 获取对话引用数据
+ * Route: POST /api/core/chat/quote/getQuote
+ * Method: POST
+ * Description: 获取指定对话消息的数据集引用列表
+ * Tags: ['Chat', 'Quote', 'Read']
+ * ============================================================================ */
+export const GetQuoteBodySchema = OutLinkChatAuthSchema.extend({
+  appId: ObjectIdSchema.describe('应用 ID'),
+  chatId: z.string().min(1).max(256).meta({
+    example: 'chat_abc123',
+    description: '对话 ID'
+  }),
+  chatItemDataId: z.string().min(1).max(256).meta({
+    example: 'item_abc123',
+    description: '对话消息 dataId'
+  }),
+  datasetDataIdList: z
+    .array(z.string().min(1).max(256))
+    .max(200)
+    .meta({
+      example: ['68ad85a7463006c963799a05'],
+      description: '数据集数据 ID 列表'
+    }),
+  collectionIdList: z
+    .array(z.string().min(1).max(256))
+    .max(200)
+    .meta({
+      example: ['68ad85a7463006c963799a06'],
+      description: '集合 ID 列表'
+    })
+});
+export type GetQuoteBodyType = z.infer<typeof GetQuoteBodySchema>;
+export const GetQuoteResponseSchema = z.array(DatasetCiteItemSchema);
+export type GetQuoteResponseType = z.infer<typeof GetQuoteResponseSchema>;
+/* ============================================================================
+ * API: 获取集合分页引用数据
+ * Route: POST /api/core/chat/quote/getCollectionQuote
+ * Method: POST
+ * Description: 以链式分页方式获取指定集合的引用数据，支持前后翻页
+ * Tags: ['Chat', 'Quote', 'Read']
+ * ============================================================================ */
+export const GetCollectionQuoteBodySchema = OutLinkChatAuthSchema.extend({
+  appId: ObjectIdSchema.describe('应用 ID'),
+  chatId: z.string().min(1).max(256).describe('对话 ID'),
+  chatItemDataId: z.string().min(1).max(256).describe('对话消息 dataId'),
+  collectionId: ObjectIdSchema.describe('集合 ID'),
+  pageSize: z.number().int().min(1).max(30).default(15).describe('每页条数，范围 [1, 30]'),
+  anchor: z.number().optional().describe('当前锚点 chunkIndex'),
+  initialId: z.string().optional().describe('初始定位数据 ID'),
+  nextId: z.string().optional().describe('向后翻页的游标 ID'),
+  prevId: z.string().optional().describe('向前翻页的游标 ID')
+});
+export type GetCollectionQuoteBodyType = z.infer<typeof GetCollectionQuoteBodySchema>;
+export const GetCollectionQuoteResSchema = z.object({
+  list: z.array(
+    DatasetCiteItemSchema.extend({
+      id: z.string().describe('数据 ID（alias _id）'),
+      anchor: z.number().optional().describe('chunk 序号（alias index）')
+    })
+  ),
+  hasMorePrev: z.boolean().describe('是否还有更多前置数据'),
+  hasMoreNext: z.boolean().describe('是否还有更多后置数据')
+});
+export type GetCollectionQuoteResType = z.infer<typeof GetCollectionQuoteResSchema>;
--- a/packages/global/openapi/core/chat/quote/index.ts
+++ b/packages/global/openapi/core/chat/quote/index.ts
+import type { OpenAPIPath } from '../../../type';
+import { TagsMap } from '../../../tag';
+import {
+  GetQuoteBodySchema,
+  GetQuoteResponseSchema,
+  GetCollectionQuoteBodySchema,
+  GetCollectionQuoteResSchema
+} from './api';
+export const ChatQuotePath: OpenAPIPath = {
+  '/core/chat/quote/getQuote': {
+    post: {
+      summary: '获取对话引用数据',
+      description: '获取指定对话消息的数据集引用列表，需要对话访问权限',
+      tags: [TagsMap.chatPage],
+      requestBody: {
+        content: {
+          'application/json': {
+            schema: GetQuoteBodySchema
+          }
+        }
+      },
+      responses: {
+        200: {
+          description: '成功返回引用数据列表',
+          content: {
+            'application/json': {
+              schema: GetQuoteResponseSchema
+            }
+          }
+        }
+      }
+    }
+  },
+  '/core/chat/quote/getCollectionQuote': {
+    post: {
+      summary: '获取集合分页引用数据',
+      description: '以链式分页方式获取指定集合的引用数据，支持前后翻页，需要对话访问权限',
+      tags: [TagsMap.chatPage],
+      requestBody: {
+        content: {
+          'application/json': {
+            schema: GetCollectionQuoteBodySchema
+          }
+        }
+      },
+      responses: {
+        200: {
+          description: '成功返回分页引用数据',
+          content: {
+            'application/json': {
+              schema: GetCollectionQuoteResSchema
+            }
+          }
+        }
+      }
+    }
+  }
+};
--- a/packages/global/openapi/tag.ts
+++ b/packages/global/openapi/tag.ts
@@ -23,6 +23,7 @@ export const TagsMap = {
  chatController: '对话操作',
  chatFeedback: '对话反馈',
  chatSetting: '门户页配置',
+  chatInputGuide: '对话输入引导',
  // Dataset
  datasetCollection: '集合',

--- a/projects/app/src/pageComponents/chat/ChatQuoteList/CollectionQuoteReader.tsx
+++ b/projects/app/src/pageComponents/chat/ChatQuoteList/CollectionQuoteReader.tsx
 import { Box, Flex, HStack } from '@chakra-ui/react';
-import {
+import { type SearchDataResponseItemType } from '@fastgpt/global/core/dataset/type';
-  type DatasetCiteItemType,
-  type SearchDataResponseItemType
-} from '@fastgpt/global/core/dataset/type';
 import { getSourceNameIcon } from '@fastgpt/global/core/dataset/utils';
 import MyIcon from '@fastgpt/web/components/common/Icon';
 import { useRouter } from 'next/router';
@@ -110,7 +107,7 @@ const CollectionReader = ({
  const formatedDataList = useMemo(
    () =>
-      datasetDataList.map((item: DatasetCiteItemType) => {
+      datasetDataList.map((item) => {
        const isCurrentSelected = currentQuoteItem?.id === item._id;
        const quoteIndex = filterResults.findIndex((res) => res.id === item._id);

--- a/projects/app/src/pages/api/core/ai/agent/createQuestionGuide.ts
+++ b/projects/app/src/pages/api/core/ai/agent/createQuestionGuide.ts
 import type { NextApiResponse } from 'next';
-import { jsonRes } from '@fastgpt/service/common/response';
 import { pushQuestionGuideUsage } from '@/service/support/wallet/usage/push';
 import { createQuestionGuide } from '@fastgpt/service/core/ai/functions/createQuestionGuide';
 import { type ApiRequestProps } from '@fastgpt/service/type/next';
 import { NextAPI } from '@/service/middleware/entry';
-import { type OutLinkChatAuthProps } from '@fastgpt/global/support/permission/chat';
-import { type ChatCompletionMessageParam } from '@fastgpt/global/core/ai/type';
 import { type AuthModeType } from '@fastgpt/service/support/permission/type';
 import { AuthUserTypeEnum } from '@fastgpt/global/support/permission/constant';
 import { authOutLinkValid } from '@fastgpt/service/support/permission/publish/authLink';
@@ -17,17 +14,19 @@ import { TeamMemberRoleEnum } from '@fastgpt/global/support/user/team/constant';
 import { ChatErrEnum } from '@fastgpt/global/common/error/code/chat';
 import { authCert } from '@fastgpt/service/support/permission/auth/common';
 import { getDefaultLLMModel } from '@fastgpt/service/core/ai/model';
+import {
+  CreateQuestionGuideBodySchema,
+  CreateQuestionGuideResponseSchema,
+  type CreateQuestionGuideResponseType
+} from '@fastgpt/global/openapi/core/ai/agent/api';
+import { type OutLinkChatAuthProps } from '@fastgpt/global/support/permission/chat';
+import { type ChatCompletionMessageParam } from '@fastgpt/global/core/ai/type';
 async function handler(
-  req: ApiRequestProps<
+  req: ApiRequestProps,
-    OutLinkChatAuthProps & {
+  _res: NextApiResponse
-      messages: ChatCompletionMessageParam[];
+): Promise<CreateQuestionGuideResponseType> {
-    }
+  const { messages } = CreateQuestionGuideBodySchema.parse(req.body);
-  >,
-  res: NextApiResponse<any>
-) {
-  try {
-    const { messages } = req.body;
  const { tmbId, teamId } = await authChatCert({
    req,
@@ -38,14 +37,10 @@ async function handler(
  const qgModel = getDefaultLLMModel();
  const { result, inputTokens, outputTokens } = await createQuestionGuide({
-      messages,
+    messages: messages as ChatCompletionMessageParam[],
    model: qgModel.model
  });
-    jsonRes(res, {
-      data: result
-    });
  pushQuestionGuideUsage({
    model: qgModel.model,
    inputTokens,
@@ -53,12 +48,8 @@ async function handler(
    teamId,
    tmbId
  });
-  } catch (err) {
-    jsonRes(res, {
+  return CreateQuestionGuideResponseSchema.parse(result);
-      code: 500,
-      error: err
-    });
-  }
 }
 export default NextAPI(handler);

--- a/projects/app/src/pages/api/core/chat/feedback/updateUserFeedback.ts
+++ b/projects/app/src/pages/api/core/chat/feedback/updateUserFeedback.ts
@@ -89,8 +89,7 @@ async function handler(
          }
        },
        {
-          sort: { createTime: -1 },
+          sort: { createTime: -1 }
-          session
        }
      );
    }

--- a/projects/app/src/pages/api/core/chat/helperBot/getRecords.ts
+++ b/projects/app/src/pages/api/core/chat/helperBot/getRecords.ts
 import type { ApiRequestProps, ApiResponseType } from '@fastgpt/service/type/next';
 import { NextAPI } from '@/service/middleware/entry';
-import type {
+import {
-  GetHelperBotChatRecordsParamsType,
+  GetHelperBotChatRecordsParamsSchema,
-  GetHelperBotChatRecordsResponseType
+  type GetHelperBotChatRecordsParamsType,
+  type GetHelperBotChatRecordsResponseType
 } from '@fastgpt/global/openapi/core/chat/helperBot/api';
 import { authHelperBotChatCrud } from '@/service/support/permission/auth/chat';
 import { MongoHelperBotChatItem } from '../../../../../../../../packages/service/core/chat/HelperBot/chatItemSchema';
@@ -18,15 +19,15 @@ async function handler(
  req: ApiRequestProps<getRecordsBody, getRecordsQuery>,
  res: ApiResponseType<any>
 ): Promise<getRecordsResponse> {
-  const { type, chatId } = req.query;
+  const { type, chatId } = GetHelperBotChatRecordsParamsSchema.parse(req.query);
-  const { chat, userId } = await authHelperBotChatCrud({
+  const { userId } = await authHelperBotChatCrud({
    type,
    chatId,
    req,
    authToken: true
  });
-  const { offset, pageSize } = parsePaginationRequest(req);
+  const { offset } = parsePaginationRequest(req);
  const [histories, total] = await Promise.all([
    MongoHelperBotChatItem.find({ userId, chatId }).sort({ _id: -1 }).skip(offset).limit(20).lean(),

--- a/projects/app/src/pages/api/core/chat/inputGuide/list.ts
+++ b/projects/app/src/pages/api/core/chat/inputGuide/list.ts
 import type { NextApiResponse } from 'next';
 import { MongoChatInputGuide } from '@fastgpt/service/core/chat/inputGuide/schema';
-import { type PaginationProps, type PaginationResponse } from '@fastgpt/web/common/fetch/type';
 import { NextAPI } from '@/service/middleware/entry';
 import { type ApiRequestProps } from '@fastgpt/service/type/next';
-import { type ChatInputGuideSchemaType } from '@fastgpt/global/core/chat/inputGuide/type';
 import { authApp } from '@fastgpt/service/support/permission/app/auth';
 import { ReadPermissionVal } from '@fastgpt/global/support/permission/constant';
 import { parsePaginationRequest } from '@fastgpt/service/common/api/pagination';
+import { replaceRegChars } from '@fastgpt/global/common/string/tools';
-export type ChatInputGuideProps = PaginationProps<{
+import {
-  appId: string;
+  ChatInputGuideListBodySchema,
-  searchKey: string;
+  ChatInputGuideListResponseSchema,
-}>;
+  type ChatInputGuideListResponseType
-export type ChatInputGuideResponse = PaginationResponse<ChatInputGuideSchemaType>;
+} from '@fastgpt/global/openapi/core/chat/inputGuide/api';
 async function handler(
-  req: ApiRequestProps<ChatInputGuideProps>,
+  req: ApiRequestProps,
  res: NextApiResponse<any>
-): Promise<ChatInputGuideResponse> {
+): Promise<ChatInputGuideListResponseType> {
-  const { appId, searchKey } = req.body;
+  const { appId, searchKey } = ChatInputGuideListBodySchema.parse(req.body);
  const { offset, pageSize } = parsePaginationRequest(req);
  await authApp({ req, appId, authToken: true, per: ReadPermissionVal });
  const params = {
    appId,
-    ...(searchKey && { text: { $regex: new RegExp(searchKey, 'i') } })
+    ...(searchKey && { text: { $regex: replaceRegChars(searchKey), $options: 'i' } })
  };
  const [result, total] = await Promise.all([
@@ -33,10 +31,10 @@ async function handler(
    MongoChatInputGuide.countDocuments(params)
  ]);
-  return {
+  return ChatInputGuideListResponseSchema.parse({
    list: result,
    total
-  };
+  });
 }
 export default NextAPI(handler);
--- a/projects/app/src/pages/api/core/chat/quote/getCollectionQuote.ts
+++ b/projects/app/src/pages/api/core/chat/quote/getCollectionQuote.ts
 import { NextAPI } from '@/service/middleware/entry';
 import { authChatCrud, authCollectionInChat } from '@/service/support/permission/auth/chat';
-import {
+import { type DatasetDataSchemaType } from '@fastgpt/global/core/dataset/type';
-  type DatasetCiteItemType,
-  type DatasetDataSchemaType
-} from '@fastgpt/global/core/dataset/type';
 import { MongoDatasetData } from '@fastgpt/service/core/dataset/data/schema';
 import { type ApiRequestProps } from '@fastgpt/service/type/next';
-import {
-  type LinkedListResponse,
-  type LinkedPaginationProps
-} from '@fastgpt/web/common/fetch/type';
 import { type FilterQuery, Types } from 'mongoose';
 import { quoteDataFieldSelector } from '@/service/core/chat/constants';
 import { processChatTimeFilter } from '@/service/core/chat/utils';
@@ -17,27 +10,14 @@ import { ChatErrEnum } from '@fastgpt/global/common/error/code/chat';
 import { getCollectionWithDataset } from '@fastgpt/service/core/dataset/controller';
 import { getFormatDatasetCiteList } from '@fastgpt/service/core/dataset/data/controller';
 import { MongoChatItem } from '@fastgpt/service/core/chat/chatItemSchema';
+import {
-export type GetCollectionQuoteProps = LinkedPaginationProps<{}, number> & {
+  GetCollectionQuoteBodySchema,
-  chatId: string;
+  type GetCollectionQuoteResType
-  chatItemDataId: string;
+} from '@fastgpt/global/openapi/core/chat/quote/api';
-  collectionId: string;
-  appId: string;
-  shareId?: string;
-  outLinkUid?: string;
-  teamId?: string;
-  teamToken?: string;
-};
-export type GetCollectionQuoteRes = LinkedListResponse<DatasetCiteItemType, number>;
 type BaseMatchType = FilterQuery<DatasetDataSchemaType>;
-async function handler(
+async function handler(req: ApiRequestProps): Promise<GetCollectionQuoteResType> {
-  req: ApiRequestProps<GetCollectionQuoteProps>
-): Promise<GetCollectionQuoteRes> {
  const {
    initialId,
    prevId,
@@ -52,10 +32,10 @@ async function handler(
    outLinkUid,
    teamId,
    teamToken,
-    pageSize = 15
+    pageSize
-  } = req.body;
+  } = GetCollectionQuoteBodySchema.parse(req.body);
-  const limitedPageSize = Math.min(pageSize, 30);
+  const limitedPageSize = pageSize;
  const [collection, { chat, showFullText }, chatItem] = await Promise.all([
    getCollectionWithDataset(collectionId),
@@ -125,7 +105,7 @@ async function handleInitialLoad({
  pageSize: number;
  chatTime: Date;
  baseMatch: BaseMatchType;
-}): Promise<GetCollectionQuoteRes> {
+}): Promise<GetCollectionQuoteResType> {
  const centerNode = await MongoDatasetData.findOne(
    {
      _id: new Types.ObjectId(initialId)
@@ -192,7 +172,7 @@ async function handlePaginatedLoad({
  pageSize: number;
  chatTime: Date;
  baseMatch: BaseMatchType;
-}): Promise<GetCollectionQuoteRes> {
+}): Promise<GetCollectionQuoteResType> {
  const { list, hasMore } = prevId
    ? await getPrevNodes(prevId, nextAnchor, pageSize, baseMatch)
    : await getNextNodes(nextId!, nextAnchor, pageSize, baseMatch);

--- a/projects/app/src/pages/api/core/chat/quote/getQuote.ts
+++ b/projects/app/src/pages/api/core/chat/quote/getQuote.ts
@@ -6,38 +6,25 @@ import { quoteDataFieldSelector } from '@/service/core/chat/constants';
 import { processChatTimeFilter } from '@/service/core/chat/utils';
 import { ChatErrEnum } from '@fastgpt/global/common/error/code/chat';
 import { getFormatDatasetCiteList } from '@fastgpt/service/core/dataset/data/controller';
-import type { DatasetCiteItemType } from '@fastgpt/global/core/dataset/type';
 import { MongoChatItem } from '@fastgpt/service/core/chat/chatItemSchema';
+import {
+  GetQuoteBodySchema,
+  GetQuoteResponseSchema,
+  type GetQuoteResponseType
+} from '@fastgpt/global/openapi/core/chat/quote/api';
-export type GetQuoteProps = {
+async function handler(req: ApiRequestProps): Promise<GetQuoteResponseType> {
-  datasetDataIdList: string[];
-  collectionIdList: string[];
-  chatId: string;
-  chatItemDataId: string;
-  appId: string;
-  shareId?: string;
-  outLinkUid?: string;
-  teamId?: string;
-  teamToken?: string;
-};
-export type GetQuotesRes = DatasetCiteItemType[];
-async function handler(req: ApiRequestProps<GetQuoteProps>): Promise<GetQuotesRes> {
  const {
    appId,
    chatId,
    chatItemDataId,
    shareId,
    outLinkUid,
    teamId,
    teamToken,
    collectionIdList,
    datasetDataIdList
-  } = req.body;
+  } = GetQuoteBodySchema.parse(req.body);
  const [{ chat, showCite }, chatItem] = await Promise.all([
    authChatCrud({
@@ -60,12 +47,10 @@ async function handler(req: ApiRequestProps<GetQuoteProps>): Promise<GetQuotesRe
    quoteDataFieldSelector
  ).lean();
-  // Get image preview url
  const formatPreviewUrlList = getFormatDatasetCiteList(list);
  const quoteList = processChatTimeFilter(formatPreviewUrlList, chatItem.time);
-  return quoteList;
+  return GetQuoteResponseSchema.parse(quoteList);
 }
 export default NextAPI(handler);
--- a/projects/app/src/pages/api/support/outLink/list.ts
+++ b/projects/app/src/pages/api/support/outLink/list.ts
@@ -6,12 +6,6 @@ import { NextAPI } from '@/service/middleware/entry';
 import { type OutLinkSchema } from '@fastgpt/global/support/outLink/type';
 import type { PublishChannelEnum } from '@fastgpt/global/support/outLink/constant';
-export const ApiMetadata = {
-  name: '获取应用内所有 Outlink',
-  author: 'Finley',
-  version: '0.1.0'
-};
 export type OutLinkListQuery = {
  appId: string; // 应用 ID
  type: `${PublishChannelEnum}`;

--- a/projects/app/src/service/core/dataset/data/controller.ts
+++ b/projects/app/src/service/core/dataset/data/controller.ts
@@ -39,7 +39,7 @@ const formatIndexes = async ({
  indexPrefix?: string;
 }): Promise<
  {
-    type: `${DatasetDataIndexTypeEnum}`;
+    type: DatasetDataIndexTypeEnum;
    text: string;
    dataId?: string;
  }[]

--- a/projects/app/src/web/core/chat/api.ts
+++ b/projects/app/src/web/core/chat/api.ts
@@ -12,13 +12,16 @@ import type {
  getChatRecordsBody,
  getChatRecordsResponse
 } from '@/pages/api/core/chat/record/getRecords_v2';
-import type { GetQuoteProps, GetQuotesRes } from '@/pages/api/core/chat/quote/getQuote';
 import type {
-  GetCollectionQuoteProps,
+  GetQuoteBodyType,
-  GetCollectionQuoteRes
+  GetQuoteResponseType
-} from '@/pages/api/core/chat/quote/getCollectionQuote';
+} from '@fastgpt/global/openapi/core/chat/quote/api';
 import type { ChatSettingModelType, ChatSettingType } from '@fastgpt/global/core/chat/setting/type';
 import type {
+  GetCollectionQuoteBodyType,
+  GetCollectionQuoteResType
+} from '@fastgpt/global/openapi/core/chat/quote/api';
+import type {
  GetChatFavouriteListParamsType,
  UpdateFavouriteAppParamsType
 } from '@fastgpt/global/openapi/core/chat/favourite/api';
@@ -57,11 +60,11 @@ export const getChatRecords = (data: getChatRecordsBody) =>
 export const delChatRecordById = (data: DeleteChatItemProps) =>
  POST(`/core/chat/item/delete`, data);
-export const getQuoteDataList = (data: GetQuoteProps) =>
+export const getQuoteDataList = (data: GetQuoteBodyType) =>
-  POST<GetQuotesRes>(`/core/chat/quote/getQuote`, data);
+  POST<GetQuoteResponseType>(`/core/chat/quote/getQuote`, data);
-export const getCollectionQuote = (data: GetCollectionQuoteProps) =>
+export const getCollectionQuote = (data: GetCollectionQuoteBodyType) =>
-  POST<GetCollectionQuoteRes>(`/core/chat/quote/getCollectionQuote`, data);
+  POST<GetCollectionQuoteResType>(`/core/chat/quote/getCollectionQuote`, data);
 /*---------- chat setting ------------*/
 export const getChatSetting = () => GET<ChatSettingType>('/proApi/core/chat/setting/detail');

--- a/projects/app/src/web/core/chat/inputGuide/api.ts
+++ b/projects/app/src/web/core/chat/inputGuide/api.ts
 import { GET, POST, DELETE, PUT } from '@/web/common/api/request';
 import type {
-  ChatInputGuideProps,
+  ChatInputGuideListBodyType,
-  ChatInputGuideResponse
+  ChatInputGuideListResponseType
-} from '@/pages/api/core/chat/inputGuide/list';
+} from '@fastgpt/global/openapi/core/chat/inputGuide/api';
 import type {
  countChatInputGuideTotalQuery,
  countChatInputGuideTotalResponse
@@ -24,8 +24,8 @@ export const getCountChatInputGuideTotal = (data: countChatInputGuideTotalQuery)
 /**
 * Get chat input guide list
 */
-export const getChatInputGuideList = (data: ChatInputGuideProps) =>
+export const getChatInputGuideList = (data: ChatInputGuideListBodyType) =>
-  POST<ChatInputGuideResponse>(`/core/chat/inputGuide/list`, data);
+  POST<ChatInputGuideListResponseType>(`/core/chat/inputGuide/list`, data);
 export const queryChatInputGuideList = (data: QueryChatInputGuideBody, url?: string) => {
  if (url) {