From 401c413a7714d75e198384a70ffcb414c0035c88 Mon Sep 17 00:00:00 2001
From: matevip <matevip@mate.vip>
Date: Sun, 17 May 2026 17:55:21 +0800
Subject: [PATCH] fix(chat): return 403 not 500 for conversation access
 failures

---
 .../controller/ConversationController.java     | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/ConversationController.java b/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/ConversationController.java
index d55d24ba..9f24519a 100644
--- a/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/ConversationController.java
+++ b/mateclaw-server/src/main/java/vip/mate/workspace/conversation/controller/ConversationController.java
@@ -56,7 +56,7 @@ public class ConversationController {
                              Authentication auth) {
         String username = auth != null ? auth.getName() : "anonymous";
         if (!conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权访问该会话");
+            return R.fail(403, "无权访问该会话");
         }
 
         // 向后兼容：不传 limit 则返回全部消息（旧前端行为）
@@ -101,7 +101,7 @@ public class ConversationController {
     public R<Void> delete(@PathVariable String conversationId, Authentication auth) {
         String username = auth != null ? auth.getName() : "anonymous";
         if (!conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权操作该会话");
+            return R.fail(403, "无权操作该会话");
         }
         conversationService.deleteConversation(conversationId);
         return R.ok();
@@ -115,7 +115,7 @@ public class ConversationController {
     public R<Void> rename(@PathVariable String conversationId, @RequestBody Map<String, String> body, Authentication auth) {
         String username = auth != null ? auth.getName() : "anonymous";
         if (!conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权操作该会话");
+            return R.fail(403, "无权操作该会话");
         }
         String title = body.getOrDefault("title", "").trim();
         if (title.isEmpty() || title.length() > 100) {
@@ -135,7 +135,7 @@ public class ConversationController {
                              Authentication auth) {
         String username = auth != null ? auth.getName() : "anonymous";
         if (!conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权操作该会话");
+            return R.fail(403, "无权操作该会话");
         }
         conversationService.setPinned(conversationId, Boolean.TRUE.equals(body.get("pinned")));
         return R.ok();
@@ -174,7 +174,7 @@ public class ConversationController {
     public R<Void> clearMessages(@PathVariable String conversationId, Authentication auth) {
         String username = auth != null ? auth.getName() : "anonymous";
         if (!conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权操作该会话");
+            return R.fail(403, "无权操作该会话");
         }
         conversationService.clearMessages(conversationId);
         return R.ok();
@@ -188,8 +188,14 @@ public class ConversationController {
     @GetMapping("/{conversationId}/status")
     public R<Map<String, String>> getStreamStatus(@PathVariable String conversationId, Authentication auth) {
         String username = auth != null ? auth.getName() : "anonymous";
+        // A freshly opened chat uses a client-generated id that is not persisted
+        // until the first message lands. The console polls this endpoint on an
+        // interval, so report idle for an unknown conversation instead of failing.
+        if (!conversationService.conversationExists(conversationId)) {
+            return R.ok(Map.of("streamStatus", "idle"));
+        }
         if (!conversationService.isConversationOwner(conversationId, username)) {
-            return R.fail("无权访问该会话");
+            return R.fail(403, "无权访问该会话");
         }
         if (streamTracker.isRunning(conversationId)) {
             return R.ok(Map.of("streamStatus", "running"));