更新

backend/main.py

@@ -1314,6 +1314,10 @@ class ConversationResponse(BaseModel):
 class SendMessageRequest(BaseModel):
     conversation_id: str
     content: str = ""
+    # 调用方认定的收件人 UID。会话归属校验只保证会话属于本账号，保证不了
+    # 「这个人就是用户点选的那个人」——消息页按昵称兜底匹配会话时可能选中
+    # 同名的另一个人。带上它，发送链路会在写出去之前核对收件人。
+    peer_uid: Optional[str] = None
     message_type: Optional[str] = None  # text | image | sticker
     media_url: Optional[str] = None
     sticker_url: Optional[str] = None
@@ -3102,6 +3106,9 @@ async def send_account_message(
         raise HTTPException(status_code=400, detail="消息内容不能为空")
     if not body.conversation_id:
         raise HTTPException(status_code=400, detail="conversation_id 不能为空")
+    expected_peer_uid = str(body.peer_uid or "").strip()
+    if expected_peer_uid and not expected_peer_uid.isdigit():
+        raise HTTPException(status_code=400, detail="peer_uid 必须是数字用户 ID")
 
     worker = manager.workers.get(account_id)
     session = _build_account_im_session(account)
@@ -3113,13 +3120,21 @@ async def send_account_message(
     async def _do_send() -> bool:
         nonlocal last_error
         if worker and worker._im_service:
-            ok = await worker._im_service.send_message(body.conversation_id, content)
+            ok = await worker._im_service.send_message(
+                body.conversation_id,
+                content,
+                expected_peer_uid=expected_peer_uid,
+            )
             last_error = worker._im_service.last_error or ""
             if ok:
                 await _persist_im_session_data(account_id, worker._im_service.session, db)
             return ok
         async with DouyinImHttpClient(session, account_id=account_id) as http:
-            ok = await http.send_text_message(body.conversation_id, content)
+            ok = await http.send_text_message(
+                body.conversation_id,
+                content,
+                expected_peer_uid=expected_peer_uid,
+            )
             last_error = http.last_error or ""
             if ok:
                 session.conv_meta = http.session.conv_meta