fix(console): detect Ollama from host/port only, not URL path

Avoid reclassifying OpenAI-compat endpoints with /ollama in the path as
Ollama, which disabled private-IP SSRF blocking. Infer Ollama only from
explicit provider, hostname containing "ollama", or port 11434.

Author: arimu1

console/backend/toolkit/src/main/java/com/iflytek/astron/console/toolkit/service/model/ModelService.java

@@ -417,17 +417,28 @@ private static boolean looksLikeOllamaEndpoint(String endpoint) {
             return false;
         }
         String trimmed = endpoint.trim();
-        String lower = trimmed.toLowerCase(Locale.ROOT);
-        if (lower.contains("ollama")) {
-            return true;
-        }
         try {
             URL url = new URL(trimmed.contains("://") ? trimmed : "http://" + trimmed);
+            String host = url.getHost();
+            if (host != null && host.toLowerCase(Locale.ROOT).contains("ollama")) {
+                return true;
+            }
             int port = url.getPort();
-            return port == OLLAMA_DEFAULT_PORT
-                    || (port == -1 && lower.matches(".*:11434(?:/|$).*"));
+            if (port == OLLAMA_DEFAULT_PORT) {
+                return true;
+            }
+            if (port == -1) {
+                String authority = url.getAuthority();
+                return authority != null && authority.endsWith(":" + OLLAMA_DEFAULT_PORT);
+            }
+            return false;
         } catch (MalformedURLException e) {
-            return lower.matches(".*:11434(?:/|$).*");
+            String authority = trimmed.split("/", 2)[0];
+            String lowerAuthority = authority.toLowerCase(Locale.ROOT);
+            if (lowerAuthority.contains("ollama")) {
+                return true;
+            }
+            return lowerAuthority.matches(".*:" + OLLAMA_DEFAULT_PORT + "$");
         }
     }
 

console/backend/toolkit/src/test/java/com/iflytek/astron/console/toolkit/service/model/ModelServiceTest.java

@@ -828,6 +828,43 @@ void buildModelApiUrlRejectsPrivateIpWhenBlacklistIsEmpty() {
                 "local-model"));
     }
 
+    @Test
+    void resolveValidationProvider_doesNotInferOllamaFromPathSegment() {
+        String provider = ReflectionTestUtils.invokeMethod(
+                modelService,
+                "resolveValidationProvider",
+                "openai",
+                "http://192.168.60.12/v1/ollama/chat");
+        assertEquals("openai", provider);
+    }
+
+    @Test
+    void looksLikeOllamaEndpoint_detectsHostAndPortOnly() {
+        assertTrue(ReflectionTestUtils.invokeMethod(
+                ModelService.class, "looksLikeOllamaEndpoint", "http://127.0.0.1:11434"));
+        assertTrue(ReflectionTestUtils.invokeMethod(
+                ModelService.class, "looksLikeOllamaEndpoint", "http://ollama.local"));
+        assertFalse(ReflectionTestUtils.invokeMethod(
+                ModelService.class, "looksLikeOllamaEndpoint", "http://192.168.60.12/v1/ollama/chat"));
+    }
+
+    @Test
+    void buildModelApiUrlRejectsPrivateIpWhenPathContainsOllama() {
+        ConfigInfo emptyConfig = new ConfigInfo();
+        emptyConfig.setValue("");
+        when(configInfoMapper.getListByCategory("NETWORK_SEGMENT_BLACK_LIST"))
+                .thenReturn(List.of(emptyConfig));
+        when(configInfoMapper.getListByCategory("IP_WHITE_LIST"))
+                .thenReturn(List.of(emptyConfig));
+
+        assertThrows(BusinessException.class, () -> ReflectionTestUtils.invokeMethod(
+                modelService,
+                "buildModelApiUrlNew",
+                "http://192.168.60.12/v1/ollama/chat",
+                "openai",
+                "local-model"));
+    }
+
     @Test
     void buildModelApiUrlAllowsPrivateIpForOllamaEndpoint() {
         ConfigInfo emptyConfig = new ConfigInfo();