fix(worker): 保持旧关键点契约并验证内部鉴权

docs/接口文档.md

@@ -476,6 +476,8 @@ GPU worker的所有动态接口均启用IP限制：允许本机及`ip_access.jso
 
 Worker 直连时图片字段使用 `_base64` 后缀。检测不到人脸返回 `1001`，非正面或标注所需点位无法取得时返回 `1003`，图片无法解码返回 `1008`。
 
+对外 42、52、72 的客户端登录、令牌验证和刷新均由 `main` 分支的网关处理。网关将 52 和 72 转发至本分支的 worker，worker 仍校验来源 IP 和网关注入的 `X-Internal-Token`。对外测试请使用网关同源的测试页。
+
 ---
 
 ## 42号接口-加两个特征点

face_analysis/face_ratios.py

@@ -65,10 +65,15 @@ def detect_framed_ratio_points(image):
 def _detect_ratio_points(image, landmarks):
     from hairline.face_landmarks import to_landmark_list
 
+    from .calibration import normalized_to_pixel
     from .special_points import detect_special_points
 
-    data = detect_special_points(image, landmarks_override=to_landmark_list(landmarks))
+    override = to_landmark_list(landmarks)
+    data = detect_special_points(image, landmarks_override=override)
     points = data["points"]
+    height, width = image.shape[:2]
+    x, y = normalized_to_pixel(override.landmark[454], width, height)
+    points["face_edge_454"] = {"x": round(x), "y": round(y)}
     data["ft_original_points"] = {key: points[key] for key in FT_POINTS}
     a, b = (points[key] for key in FT_POINTS)
     if a is not None and b is not None:

face_analysis/special_points.py

@@ -30,7 +30,7 @@ GROUPS = {
     "mouth": [0, 37, 40, 67, 91, 84, 17, 405, 375, 409, 269],
     "nose_midline": [9, 168, 197, 5, 4, 194, 278, 48, 437, 217],
     "cheek": [101, 117, 123, 187, 205, 50, 330, 346, 352, 280, 425],
-    "face_edge": [162, 234, 58, 136, 149, 152, 378, 365, 288, 401, 366, 389, 251, 454],
+    "face_edge": [162, 234, 58, 136, 149, 152, 378, 365, 288, 401, 366, 389, 251],
 }
 
 # 发际线点定义：字段名 → 参与计算的 (起点ID, 方向点ID) 射线组；单射线直接取交点，

tests/test_ip_access.py

@@ -99,3 +99,22 @@ def test_gateway_does_not_apply_worker_ip_policy(policy, monkeypatch):
     assert client.post('/api/v1/hair/grow').json()['code'] == 0
     assert client.get('/static/test_interface52.html').status_code == 200
     assert calls == ['/api/v1/hairline/generate', '/api/v1/hair/grow']
+
+
+@pytest.mark.parametrize(("path", "expected_code"), [
+    ("/api/v1/hairline/generate-52", 1004),
+    ("/api/v1/face/b-end-points", 1007),
+])
+def test_52_and_72_use_worker_transport_auth_not_client_bearer(policy, monkeypatch, path, expected_code):
+    import app as worker
+
+    policy.write_text('{"allowed_ips": ["49.232.51.171"]}')
+    monkeypatch.setattr(worker, "ACCEPT_PASSWORDS", ["access-test"])
+    client = TestClient(worker.app, client=("49.232.51.171", 50000))
+    try:
+        denied = client.post(path, headers={"Authorization": "Bearer client-access-token"})
+        assert denied.status_code == 401 and denied.json()["code"] == 1009
+        accepted = client.post(path, headers={"X-Internal-Token": "access-test"})
+        assert accepted.status_code == 200 and accepted.json()["code"] == expected_code
+    finally:
+        client.close()