fix(proxy): route Path-extractor rejections through the reject chokepoint

crates/aisix-proxy/src/a2a.rs

@@ -24,12 +24,13 @@ use std::time::{Duration, Instant};
 use aisix_a2a::{upstream_from_a2a_agent, A2aBridge, A2aError, HttpBridge};
 use aisix_obs::{AccessLog, RequestOutcome, UsageEvent};
 use axum::body::to_bytes;
-use axum::extract::{Path, Request, State};
+use axum::extract::{Request, State};
 use axum::http::{header, HeaderMap, StatusCode};
 use axum::response::{IntoResponse, Response};
 use serde::Deserialize;
 
 use crate::auth::AuthenticatedKey;
+use crate::reject::AisixPath;
 use crate::request_id::new_request_id;
 use crate::state::ProxyState;
 
@@ -52,7 +53,7 @@ struct JsonRpcPeek {
 /// emitted either way.
 pub async fn a2a_endpoint(
     auth: AuthenticatedKey,
-    Path(agent): Path<String>,
+    AisixPath(agent): AisixPath<String>,
     State(state): State<ProxyState>,
     request: Request,
 ) -> Response {
@@ -216,7 +217,7 @@ async fn dispatch(
 /// callers discover the agent through `/a2a/<agent>`.
 pub async fn a2a_agent_card(
     auth: AuthenticatedKey,
-    Path(agent): Path<String>,
+    AisixPath(agent): AisixPath<String>,
     State(state): State<ProxyState>,
     headers: HeaderMap,
 ) -> Response {

crates/aisix-proxy/src/audio.rs

@@ -86,12 +86,31 @@ pub async fn transcriptions(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    multipart: Multipart,
+    multipart: Result<Multipart, axum::extract::multipart::MultipartRejection>,
 ) -> Response {
     let started = Instant::now();
     let request_id = client.request_id.clone();
     let api_key_id = auth.entry.id.clone();
 
+    // Same silent class as the body-extractor rejections #863 collected: a
+    // non-multipart content-type answered axum's bare 400 with no access
+    // log, metrics, or envelope.
+    let multipart = match multipart {
+        Ok(multipart) => multipart,
+        Err(_) => {
+            return crate::reject::reject_before_dispatch(
+                &state,
+                "POST",
+                "/v1/audio/transcriptions",
+                &request_id,
+                Some(&api_key_id),
+                started,
+                crate::reject::Envelope::OpenAi,
+                ProxyError::InvalidRequest("invalid multipart form data".into()),
+            );
+        }
+    };
+
     match multipart_dispatch(
         &state,
         &auth,
@@ -186,12 +205,29 @@ pub async fn translations(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    multipart: Multipart,
+    multipart: Result<Multipart, axum::extract::multipart::MultipartRejection>,
 ) -> Response {
     let started = Instant::now();
     let request_id = client.request_id.clone();
     let api_key_id = auth.entry.id.clone();
 
+    // See `transcriptions`: the rejection is recorded, not silently bare.
+    let multipart = match multipart {
+        Ok(multipart) => multipart,
+        Err(_) => {
+            return crate::reject::reject_before_dispatch(
+                &state,
+                "POST",
+                "/v1/audio/translations",
+                &request_id,
+                Some(&api_key_id),
+                started,
+                crate::reject::Envelope::OpenAi,
+                ProxyError::InvalidRequest("invalid multipart form data".into()),
+            );
+        }
+    };
+
     match multipart_dispatch(
         &state,
         &auth,

crates/aisix-proxy/src/jobs.rs

@@ -55,7 +55,7 @@ use aisix_core::resource::ResourceEntry;
 use aisix_core::{Model, ProviderKey};
 use aisix_obs::{AccessLog, RequestOutcome, UsageEvent};
 use axum::body::Body;
-use axum::extract::{Multipart, Path, Query, State};
+use axum::extract::{Multipart, Query, State};
 use axum::http::{header, HeaderMap, HeaderValue, Method, StatusCode};
 use axum::response::{IntoResponse, Response};
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
@@ -66,6 +66,7 @@ use serde_json::Value;
 use crate::auth::AuthenticatedKey;
 use crate::client_ip::ClientContext;
 use crate::error::ProxyError;
+use crate::reject::AisixPath;
 use crate::state::ProxyState;
 
 /// Marker prefix for gateway-minted routed ids.
@@ -776,10 +777,29 @@ pub(crate) async fn create_file(
     client: ClientContext,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
-    mut multipart: Multipart,
+    multipart: Result<Multipart, axum::extract::multipart::MultipartRejection>,
 ) -> Response {
     let started = Instant::now();
     let request_id = client.request_id.clone();
+
+    // Same silent class as the body-extractor rejections #863 collected: a
+    // non-multipart content-type answered axum's bare 400 with no access
+    // log, metrics, or envelope.
+    let mut multipart = match multipart {
+        Ok(multipart) => multipart,
+        Err(_) => {
+            return crate::reject::reject_before_dispatch(
+                &state,
+                "POST",
+                "/v1/files",
+                &request_id,
+                Some(&auth.entry.id),
+                started,
+                crate::reject::Envelope::OpenAi,
+                ProxyError::InvalidRequest("invalid multipart form data".into()),
+            );
+        }
+    };
     let mut monitor_hits: Vec<aisix_core::GuardrailMonitorHit> = Vec::new();
 
     let result = async {
@@ -928,7 +948,7 @@ pub(crate) async fn get_file(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    Path(id): Path<String>,
+    AisixPath(id): AisixPath<String>,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Response {
@@ -958,7 +978,7 @@ pub(crate) async fn delete_file(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    Path(id): Path<String>,
+    AisixPath(id): AisixPath<String>,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Response {
@@ -988,7 +1008,7 @@ pub(crate) async fn file_content(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    Path(id): Path<String>,
+    AisixPath(id): AisixPath<String>,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Response {
@@ -1135,7 +1155,7 @@ pub(crate) async fn get_batch(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    Path(id): Path<String>,
+    AisixPath(id): AisixPath<String>,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Response {
@@ -1205,7 +1225,7 @@ pub(crate) async fn cancel_batch(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    Path(id): Path<String>,
+    AisixPath(id): AisixPath<String>,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Response {
@@ -1378,7 +1398,7 @@ pub(crate) async fn get_ft_job(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    Path(id): Path<String>,
+    AisixPath(id): AisixPath<String>,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Response {
@@ -1408,7 +1428,7 @@ pub(crate) async fn cancel_ft_job(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: ClientContext,
-    Path(id): Path<String>,
+    AisixPath(id): AisixPath<String>,
     Query(params): Query<HashMap<String, String>>,
     headers: HeaderMap,
 ) -> Response {

crates/aisix-proxy/src/mcp.rs

@@ -78,7 +78,7 @@ pub async fn mcp_endpoint(
 /// nothing about which servers exist).
 pub async fn mcp_scoped_endpoint(
     auth: AuthenticatedKey,
-    axum::extract::Path(server): axum::extract::Path<String>,
+    crate::reject::AisixPath(server): crate::reject::AisixPath<String>,
     State(state): State<ProxyState>,
     request: Request,
 ) -> Response {

crates/aisix-proxy/src/passthrough.rs

@@ -24,14 +24,15 @@
 
 use aisix_obs::{AccessLog, RequestOutcome};
 use axum::body::Body;
-use axum::extract::{Path, Request, State};
+use axum::extract::{Request, State};
 use axum::http::{header, HeaderMap, HeaderValue, Method};
 use axum::response::{IntoResponse, Response};
 use bytes::Bytes;
 use std::time::{Duration, Instant};
 
 use crate::auth::AuthenticatedKey;
 use crate::error::ProxyError;
+use crate::reject::AisixPath;
 use crate::state::ProxyState;
 
 /// Bounded `model` metric label for passthrough requests. The wildcard
@@ -131,7 +132,7 @@ pub async fn passthrough(
     State(state): State<ProxyState>,
     auth: AuthenticatedKey,
     client: crate::client_ip::ClientContext,
-    Path((provider, rest)): Path<(String, String)>,
+    AisixPath((provider, rest)): AisixPath<(String, String)>,
     req: Request,
 ) -> Response {
     let started = Instant::now();