提出 #1033606: https://github.com/chenyme/ grok2api v3.1.6 Improper Enforcement of Behavioral Workflow

STT billing is bypassed when a client disconnects after receiving a completed transcription

Affected versions: confirmed present in the latest tagged release, v3.1.6, and on the default branch `main` at commit `7c889a960e2638341b4dae9a5c81af0e0f38c87f`.

## Summary

A client with a valid STT-capable API key can open a streaming speech-to-text WebSocket, receive a completed transcription, and then terminate the connection abnormally rather than closing it cleanly. The gateway records the transport error in its audit log but omits the already-confirmed transcription cost, so the client key's spending counter is never advanced for that usage, even though the upstream service already performed and returned the work.

## Details

`backend/internal/transport/http/inference/voice_ws_handler.go` records the duration from a `transcript.done` event as soon as it is observed, then separately maps an abnormal client-side close to `client_stream_interrupted`. `backend/internal/application/gateway/voice_ws.go`'s finalizer:

```go
successful := strings.TrimSpace(outcome.ErrorCode) == ""
...
if successful && operation == audit.OperationSTT {
if pricing, priced := audit.EstimateOfficialSTTCost(outcome.AudioDurationSeconds, true); priced {
record.EstimatedCostInUSDTicks = pricing.CostInUSDTicks
...
}
}
```

Pricing only happens when `successful` is true, i.e. when `ErrorCode` is empty. An abnormal client disconnect after a confirmed duration sets `ErrorCode` to `client_stream_interrupted`, which makes `successful` false and skips pricing entirely, discarding an already-confirmed positive duration. `backend/internal/infra/persistence/relational/audit_repository.go` only advances billed usage when `EstimatedCostInUSDTicks` is positive, so this record contributes nothing to the key's spending.

## POC

(available upon request)

## Impact

Any client with a valid STT-capable API key can avoid being billed for confirmed transcription usage simply by not closing the connection cleanly after receiving the result. Repeated across many requests, this understates the key's recorded spending against its configured `BillingLimitUSDTicks`, with the operator absorbing the upstream cost. This is a billing-accounting gap on the client's own key usage, not a cross-tenant issue: it does not expose another user's data or credentials, and it does not bypass authentication, model authorization, or concurrency limits.

Suggested fix: price confirmed STT usage based on whether a valid positive duration was received, independent of how the downstream transport later ended. A fix implementing exactly this, with a regression test, is included in the linked pull request.

• ソース: ⚠️ https://github.com/chenyme/grok2api/issues/1072
• ユーザー: carfeii (UID 97470)
• 送信: 2026年10月14日 14:59 (23 日 ago)
• モデレーション: 2026年11月06日 15:44 (23 days later)
• ステータス: 承諾済み
• VulDBエントリ: 431934 [chenyme grok2api 迄 3.1.6 STT Billing voice_ws_handler.go 特権昇格]
• ポイント: 20