提出 #1036006: https://github.com/chenyme/grok2api/issues/1066 grok2api v3.1.6 (commit 906b9493b099d192381c698d4e320fafeccb851c) Incorrect Authorization

Video job retry bypasses client key account scope (provider/tier restrictions)

Affected versions: confirmed present in the latest tagged release, `v3.1.6` (commit `906b9493b099d192381c698d4e320fafeccb851c`, published 2026-09-16), and on the default branch `main` at commit `7c889a960e2638341b4dae9a5c81af0e0f38c87f` (2026-09-30).

## Summary

Every account-selection path for client-facing requests (text chat, image generation, voice, voice websocket) scopes the account pool to the requesting client key's `AccountScope` (its configured provider and tier restrictions) via `Selector.beginSelectionSessionForKey`. The video generation job's background retry worker uses the unscoped `Selector.beginSelectionSession` instead, so once a video job's originally selected account fails, the fallback search for a replacement account ignores the client key's restrictions entirely.

## Details

`beginSelectionSessionForKey` takes a `requestedScope clientkey.AccountScope` parameter and filters candidate accounts by it. Every request-time account-selection call site uses it:

```go
// image.go, voice.go, voice_ws.go, service.go (x3)
selection, err = s.selector.beginSelectionSessionForKey(ctx, route.Provider, route.ID, route.UpstreamModel, quotaMode, "", excluded, false, key.AccountScope())
```

The video job's retry/recovery worker (`runVideoJob` in `backend/internal/application/gateway/video.go`) does not:

```go
if lease == nil {
if selection == nil {
selection, err = s.selector.beginSelectionSession(ctx, route.Provider, route.ID, route.UpstreamModel, quotaMode, "", excluded, false)
}
...
```

`media.Job` already stores `ClientKeyID`, so the information needed to re-apply the scope is available at this call site; it is simply not used.

## POC

(available upon request)

## Impact

A client key restricted to a specific provider (Build/Web/Console) or tier (Free/Super) can end up consuming an account outside that restriction, purely because the account the video job was originally assigned to hits a transient failure (rate limit, auth error, upstream error) and the retry path falls back to the entire unscoped account pool. This silently widens a client key's effective access beyond what its operator configured it for, and lets a lower-tier or wrong-provider key consume quota from accounts it should never be able to reach.

• ソース: ⚠️ https://github.com/chenyme/grok2api/issues/1066
• ユーザー: carfeii (UID 97470)
• 送信: 2026年10月15日 15:15 (24 日 ago)
• モデレーション: 2026年11月08日 17:53 (24 days later)
• ステータス: 承諾済み
• VulDBエントリ: 432920 [chenyme grok2api 迄 3.1.6 Video Job Retry video.go beginSelectionSession 特権昇格]
• ポイント: 20