fix: 统一 CLI/API 路径安全检查为 is_path_within_workspace

src/server/app.py

@@ -10,7 +10,7 @@ from fastapi.middleware.cors import CORSMiddleware
 from fastapi.responses import RedirectResponse
 from pydantic import BaseModel, Field, model_validator
 
-from src.core.security import is_safe_path
+from src.core.security import is_path_within_workspace
 from src.server.auth import verify_api_key, rate_limiter
 from src.server.deps import get_state, AppState
 
@@ -117,17 +117,9 @@ def ingest_document(
     ingestor = state.get_ingestor(req.collection)
     try:
         if req.file_path:
-            if not is_safe_path(req.file_path):
+            if not is_path_within_workspace(req.file_path):
                 raise HTTPException(status_code=400, detail="不允许的路径")
             path = Path(req.file_path).resolve()
-            cwd = Path.cwd().resolve()
-            # 用 commonpath 替代字符串 startswith 比较 (Windows 大小写安全)
-            try:
-                common = Path(os.path.commonpath([str(path), str(cwd)]))
-            except ValueError:
-                raise HTTPException(status_code=400, detail="不允许访问当前目录外的路径")
-            if common != cwd:
-                raise HTTPException(status_code=400, detail="不允许访问当前目录外的路径")
             if not path.exists():
                 raise HTTPException(status_code=404, detail=f"文件不存在: {path.name}")
             count = ingestor.ingest_file(str(path))