fix: replace local_group_id with vendor_group_id in all client-facing APIs

- rl_upload_user: accept vendor_group_id instead of group_id,
  validate directly via rl_org_group(org_id, vendor_group_id)
- rl_query_groups: remove local_group_id from response, only return
  vendor_group_id, vendor, status, create_time
- rl_handle_callback: remove local_group_id from return value
- rl_upload.dspy: rename param group_id -> vendor_group_id
- docs/api_downapp.md: update all examples and descriptions

docs/api_downapp.md

@@ -71,7 +71,7 @@ Content-Type: application/json
 ### 请求参数
 | 参数 | 必填 | 说明 |
 |------|------|------|
-| `group_id` | 是 | 真人认证成功后获取的本地组合 ID |
+| `vendor_group_id` | 是 | 认证成功后获得的供应商组合 ID（通过 `rl_query_groups` 查询） |
 | `source_url` | 是 | 素材的公网可访问 URL |
 | `asset_type` | 否 | 素材类型：`Image` (默认) 或 `Video` |
 | `name` | 否 | 素材名称 |
@@ -85,7 +85,7 @@ Authorization: Bearer <your_api_key>
 Content-Type: application/json
 
 {
-  "group_id": "local_group_id_xxx",
+  "vendor_group_id": "volc-asset-group-xxx",
   "source_url": "https://bucket.oss.com/photo.jpg",
   "asset_type": "Image",
   "name": "模特A"
@@ -163,8 +163,7 @@ Authorization: Bearer <your_api_key>
   "success": true,
   "groups": [
     {
-      "local_group_id": "local_group_id_xxx",
-      "vendor_group_id": "vendor_group_xxx",
+      "vendor_group_id": "volc-asset-group-xxx",
       "vendor": "volcengine",
       "status": "active",
       "create_time": "2026-05-28 15:30:00"
@@ -196,7 +195,7 @@ Authorization: Bearer <your_api_key>
 |----------|------|----------|
 | `供应商配置不存在` | 营运人员未配置 AK/SK | 联系管理员配置 `rl_vendor_config` |
 | `供应商服务已停用` | 供应商配置状态非 active | 联系管理员激活配置 |
-| `无效的素材组合ID或无权访问` | `group_id` 不属于当前机构 | 确认是否已完成认证并使用正确的 ID |
+| `无效的素材组合ID或无权访问` | `vendor_group_id` 不属于当前机构 | 确认是否已完成认证并使用正确的 ID |
 | `素材不存在或无权访问` | `asset_id` 无效或归属错误 | 检查 ID 是否正确 |
 | `未找到对应的认证会话` | `BytedToken` 无效 | 检查回调参数 |
 | `尚未完成认证或认证失败` | 认证未完成 | 等待用户完成 H5 认证 |

reallife_asset/init.py

@@ -519,25 +519,22 @@ async def rl_check_validate_and_map(local_group_id, project_name="default"):
     return {"success": True, "vendor_group_id": vendor_group_id}
 
 
-async def rl_upload_user(org_id, group_id, source_url, asset_type, name, user_id):
+async def rl_upload_user(org_id, vendor_group_id, source_url, asset_type, name, user_id):
     """User proxy: Validate Org-Group mapping -> Get Keys -> Upload."""
-    # 1. Validate Group Ownership
+    # 1. Validate: vendor_group_id belongs to this org
     dbname = _get_dbname()
     db = DBPools()
     
     async with db.sqlorContext(dbname) as sor:
-        # Check rl_org_group
-        recs = await sor.R("rl_org_group", {"org_id": org_id}) # Get all groups for org
-        valid = False
-        vendor_group_id = ""
-        for r in recs:
-            if r.local_group_id == group_id:
-                valid = True
-                vendor_group_id = r.vendor_group_id
-                break
-        
-        if not valid:
+        recs = await sor.R("rl_org_group", {
+            "org_id": org_id,
+            "vendor_group_id": vendor_group_id,
+        })
+        if not recs:
             return {"success": False, "message": "无效的素材组合ID或无权访问"}
+        
+        # Get local_group_id for asset record
+        local_group_id = recs[0].local_group_id
 
     # 2. Get Keys
     keys = await _get_vendor_keys()
@@ -564,7 +561,7 @@ async def rl_upload_user(org_id, group_id, source_url, asset_type, name, user_id
         await sor.I("rl_asset", {
             "id": asset_id,
             "org_id": org_id,
-            "group_id": group_id,
+            "group_id": local_group_id,
             "vendor": "volcengine",
             "vendor_asset_id": vendor_asset_id,
             "asset_type": asset_type,
@@ -717,15 +714,13 @@ async def rl_handle_callback(byted_token, project_name="default"):
           f"vendor_group={vendor_group_id}")
     return {
         "success": True,
-        "local_group_id": local_group_id,
         "vendor_group_id": vendor_group_id,
     }
 
 
 async def rl_query_groups(org_id):
     """
-    Client API: Query authenticated group_ids for an org.
-    Returns list of (local_group_id, vendor_group_id, status) mappings.
+    Client API: Query authenticated vendor_group_ids for an org.
     """
     dbname = _get_dbname()
     db = DBPools()
@@ -738,7 +733,6 @@ async def rl_query_groups(org_id):
         groups = []
         for r in recs:
             groups.append({
-                "local_group_id": r.local_group_id,
                 "vendor_group_id": r.vendor_group_id,
                 "vendor": r.vendor,
                 "status": r.status,

wwwroot/api/rl_upload.dspy

@@ -1,10 +1,10 @@
-group_id = params_kw.get('group_id', '')
+vendor_group_id = params_kw.get('vendor_group_id', '')
 source_url = params_kw.get('source_url', '')
 asset_type = params_kw.get('asset_type', 'Image')
 name = params_kw.get('name', '')
 
-if not group_id or not source_url:
+if not vendor_group_id or not source_url:
     return {"success": False, "message": "参数缺失"}
 
-result = await rl_upload_user((await get_userorgid()) or '0', group_id, source_url, asset_type, name, (await get_user()))
+result = await rl_upload_user((await get_userorgid()) or '0', vendor_group_id, source_url, asset_type, name, (await get_user()))
 return result