兼容开放导入未签名请求

backend/internal/modules/listing/handler_external.go

@@ -47,24 +47,26 @@ func (h *Handler) ImportExternalUpload(c *gin.Context) {
 }
 
 var (
-	errExternalUploadSecretMissing = errors.New("external upload secret missing")
-	errExternalUploadForbiddenIP   = errors.New("external upload forbidden ip")
-	errExternalUploadTimestamp     = errors.New("external upload timestamp invalid")
-	errExternalUploadSignature     = errors.New("external upload signature invalid")
+	errExternalUploadForbiddenIP = errors.New("external upload forbidden ip")
+	errExternalUploadTimestamp   = errors.New("external upload timestamp invalid")
+	errExternalUploadSignature   = errors.New("external upload signature invalid")
 )
 
 const externalUploadMaxClockSkew = 5 * time.Minute
 
 func (h *Handler) verifyExternalUpload(c *gin.Context, raw []byte) error {
-	secret := strings.TrimSpace(h.externalUploadSecret)
-	if secret == "" {
-		return errExternalUploadSecretMissing
-	}
 	if !externalUploadIPAllowed(c.ClientIP(), h.externalUploadAllowedIPs) {
 		return errExternalUploadForbiddenIP
 	}
+	secret := strings.TrimSpace(h.externalUploadSecret)
+	if secret == "" {
+		return nil
+	}
 	timestamp := strings.TrimSpace(c.GetHeader("X-HFB-Timestamp"))
 	signature := strings.TrimSpace(c.GetHeader("X-HFB-Signature"))
+	if timestamp == "" && signature == "" {
+		return nil
+	}
 	if timestamp == "" || signature == "" {
 		return errExternalUploadSignature
 	}
@@ -111,8 +113,6 @@ func externalUploadIPAllowed(clientIP string, allowed []string) bool {
 
 func writeExternalUploadAuthError(c *gin.Context, err error) {
 	switch err {
-	case errExternalUploadSecretMissing:
-		response.ServiceUnavailable(c, "开放导入签名密钥未配置")
 	case errExternalUploadForbiddenIP:
 		response.Error(c, http.StatusForbidden, "forbidden", "来源 IP 不允许访问")
 	case errExternalUploadTimestamp:

backend/internal/modules/listing/handler_external_test.go

@@ -30,6 +30,28 @@ func TestVerifyExternalUploadSignature(t *testing.T) {
 	}
 }
 
+func TestVerifyExternalUploadAllowsUnsignedRequest(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest("POST", "/api/open/listing-uploads", nil)
+
+	handler := &Handler{}
+	if err := handler.verifyExternalUpload(c, []byte(`{}`)); err != nil {
+		t.Fatalf("verifyExternalUpload() error = %v", err)
+	}
+}
+
+func TestVerifyExternalUploadAllowsUnsignedRequestWithSecret(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	c, _ := gin.CreateTestContext(httptest.NewRecorder())
+	c.Request = httptest.NewRequest("POST", "/api/open/listing-uploads", nil)
+
+	handler := &Handler{externalUploadSecret: "test-upload-secret"}
+	if err := handler.verifyExternalUpload(c, []byte(`{}`)); err != nil {
+		t.Fatalf("verifyExternalUpload() error = %v", err)
+	}
+}
+
 func TestVerifyExternalUploadRejectsBadSignature(t *testing.T) {
 	gin.SetMode(gin.TestMode)
 	c, _ := gin.CreateTestContext(httptest.NewRecorder())