From 86ce5babd1af2be71d5c5c8d230cc4144542bcbf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 25 Mar 2026 02:46:22 +0000
Subject: [PATCH] Address code review: add proxy startup warning, session
 expiration cleanup

Co-authored-by: qinfendebingshuo <207279273+qinfendebingshuo@users.noreply.github.com>
Agent-Logs-Url: https://github.com/qinfendebingshuo/guanghulab/sessions/dd3872e9-4f8f-4c5f-ad59-1fc55166d46d
---
 persona-studio/backend/routes/auth.js  | 11 +++++++++++
 persona-studio/backend/routes/proxy.js |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/persona-studio/backend/routes/auth.js b/persona-studio/backend/routes/auth.js
index 76080001..b31810a4 100644
--- a/persona-studio/backend/routes/auth.js
+++ b/persona-studio/backend/routes/auth.js
@@ -19,6 +19,17 @@ const USERS_DB_PATH = path.join(__dirname, '..', '..', '..', 'data', 'users.json
 
 // In-memory session store (server restart clears sessions)
 const sessions = new Map();
+const SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
+
+// Periodic session cleanup (every hour)
+setInterval(() => {
+  const now = Date.now();
+  for (const [token, session] of sessions) {
+    if (now - new Date(session.created_at).getTime() > SESSION_TTL_MS) {
+      sessions.delete(token);
+    }
+  }
+}, 60 * 60 * 1000);
 
 function loadHumanRegistry() {
   try {
diff --git a/persona-studio/backend/routes/proxy.js b/persona-studio/backend/routes/proxy.js
index 5e0a5eb6..258156d8 100644
--- a/persona-studio/backend/routes/proxy.js
+++ b/persona-studio/backend/routes/proxy.js
@@ -19,6 +19,10 @@ const MODEL_API_KEY = process.env.MODEL_API_KEY || process.env.YUNWU_API_KEY ||
 const MODEL_API_BASE = process.env.MODEL_API_BASE || 'https://api.yunwu.ai/v1';
 const DEFAULT_MODEL = process.env.DEFAULT_MODEL || 'gemini-2.0-flash';
 
+if (!MODEL_API_KEY) {
+  console.warn('[Proxy] ⚠️ MODEL_API_KEY / YUNWU_API_KEY 未配置，服务器代理模式不可用。用户需使用自有 API 密钥。');
+}
+
 /**
  * 检查服务器端代理是否可用
  * GET /api/ps/proxy/status