AI绘画问题，Error [TRPCError]: Failed to fetch cover image

[ChinaBurn]

📦 部署环境

Docker

📦 部署模式

服务端模式(lobe-chat-database 镜像)

📌 软件版本

1.104.0

💻 系统环境

Other Linux

🌐 浏览器

Edge

🐛 问题描述

Error [TRPCError]: Failed to fetch cover image from https:///lobe/generations/images/_1024x1024_20250725_015615_thumb.webp: 403 Forbidden
at GenerationService.createCoverFromUrl (.next/server/chunks/91242.js:1527:23)

在miniIO里面可以看到生成的图片，但是预览失败，显示这个报错。

📷 复现步骤

No response

🚦 期望结果

No response

📝 补充信息

No response

[lobehubbot]

👀 @ChinaBurn

Thank you for raising an issue. We will investigate into the matter and get back to you as soon as possible.
Please make sure you have given us as much context as possible.
非常感谢您提交 issue。我们会尽快调查此事，并尽快回复您。 请确保您已经提供了尽可能多的背景信息。

[dosubot]

Hi @ChinaBurn! I'm Dosu and I’m helping the lobe-chat team.

你遇到的 403 Forbidden 报错，绝大多数情况下是 MinIO 存储桶权限或 S3 相关环境变量配置导致的。可以按以下步骤排查和解决：

1. 在 .env 或 docker-compose 中添加 S3_SET_ACL=0，这样即使 bucket 是 private，也能正常预览和下载图片，无需将 bucket 设置为 public（推荐做法）参考。
2. 确认 MinIO bucket policy 至少包含 s3:GetObject 权限，例如：

   {
     "Effect": "Allow",
     "Principal": {"AWS": ["*"]},
     "Action": ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"],
     "Resource": ["arn:aws:s3:::lobe/files/**"]
   }

   参考
3. 检查 MINIO_API_CORS_ALLOW_ORIGIN 是否设置为 *，否则前端请求可能被 CORS 拦截参考。
4. 确认 S3 相关环境变量（如 S3_ACCESS_KEY_ID、S3_SECRET_ACCESS_KEY、S3_BUCKET 等）填写正确，否则后端无法生成有效的预签名 URL，导致 403。
5. 排查网络和防火墙，确保 Docker 容器能正常访问 MinIO 服务，DNS 配置正确，端口未被阻断参考。

如果以上都没问题，建议查看 Lobe Chat 和 MinIO 的服务端日志，定位更详细的错误信息。近期有修复 AI 绘图相关 bug 的更新（如 #8490、#8432、#8448），如有需要可尝试升级到最新版参考。

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}    

[ChinaBurn]

Hi @ChinaBurn! I'm Dosu and I’m helping the lobe-chat team.

你遇到的 403 Forbidden 报错，绝大多数情况下是 MinIO 存储桶权限或 S3 相关环境变量配置导致的。可以按以下步骤排查和解决：

1. 在 .env 或 docker-compose 中添加 S3_SET_ACL=0，这样即使 bucket 是 private，也能正常预览和下载图片，无需将 bucket 设置为 public（推荐做法）参考。

2. 确认 MinIO bucket policy 至少包含 s3:GetObject 权限，例如：
   {
   "Effect": "Allow",
   "Principal": {"AWS": ["*"]},
   "Action": ["s3:PutObject", "s3:DeleteObject", "s3:GetObject"],
   "Resource": ["arn:aws:s3:::lobe/files/**"]
   }

   参考

3. 检查 MINIO_API_CORS_ALLOW_ORIGIN 是否设置为 *，否则前端请求可能被 CORS 拦截参考。

4. 确认 S3 相关环境变量（如 S3_ACCESS_KEY_ID、S3_SECRET_ACCESS_KEY、S3_BUCKET 等）填写正确，否则后端无法生成有效的预签名 URL，导致 403。

5. 排查网络和防火墙，确保 Docker 容器能正常访问 MinIO 服务，DNS 配置正确，端口未被阻断参考。

如果以上都没问题，建议查看 Lobe Chat 和 MinIO 的服务端日志，定位更详细的错误信息。近期有修复 AI 绘图相关 bug 的更新（如 #8490、#8432、#8448），如有需要可尝试升级到最新版参考。

To reply, just mention @dosu.

How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other    

我确认不是s3权限的问题，我在miniIO里面都可以看到生成的图片。
这是lobechat的日志：

Route: [openai] InvalidProviderAPIKey: { error: undefined, errorType: 'InvalidProviderAPIKey' }
{"level":30,"time":1753408540913,"pid":30,"hostname":"LobeChat","msg":"Error in tRPC handler (lambda) on path: generationTopic.updateTopicCover, type: mutation"}
Error [TRPCError]: Failed to fetch cover image from https://XXXXXXXX/lobe/generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp: 403 Forbidden
    at GenerationService.createCoverFromUrl (.next/server/chunks/91242.js:1527:23)
    at async (.next/server/chunks/27920.js:2262:29)
    at async resolveMiddleware (.next/server/chunks/2936.js:1418:17)
    at async callRecursive (.next/server/chunks/2936.js:1453:18)
    at async callRecursive (.next/server/chunks/2936.js:1453:18)
    at async callRecursive (.next/server/chunks/2936.js:1453:18)
    at async callRecursive (.next/server/chunks/2936.js:1453:18)
    at async callRecursive (.next/server/chunks/2936.js:1453:18)
    at async callRecursive (.next/server/chunks/2936.js:1453:18) {
  code: 'INTERNAL_SERVER_ERROR',
  [cause]: Error: Failed to fetch cover image from https://XXXXXXXX/lobe/generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp: 403 Forbidden
      at GenerationService.createCoverFromUrl (.next/server/chunks/91242.js:1527:23)
      at async (.next/server/chunks/27920.js:2262:29)
      at async resolveMiddleware (.next/server/chunks/2936.js:1418:17)
      at async callRecursive (.next/server/chunks/2936.js:1453:18)
      at async callRecursive (.next/server/chunks/2936.js:1453:18)
      at async callRecursive (.next/server/chunks/2936.js:1453:18)
      at async callRecursive (.next/server/chunks/2936.js:1453:18)
      at async callRecursive (.next/server/chunks/2936.js:1453:18)
      at async callRecursive (.next/server/chunks/2936.js:1453:18)
}

[tjx666]

@ChinaBurn

1. 你是说能看到图片已经上传到 miniIO 的路径 generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp 位置？
2. 你浏览器直接访问 https://XXXXXXXX/lobe/generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp，可以访问吗？
3. 你部署的时候环境变量 S3_SET_ACL 和 S3_ENABLE_PATH_STYLE 的值分别是多少？

[lobehubbot]

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

@ChinaBurn

1. You mean you can see the path where the image has been uploaded to miniIO generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp location?
2. You can access https://XXXXXXX/lobe/generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp directly in your browser. Can you access it?
3. What are the values of the environment variables S3_SET_ACL and S3_ENABLE_PATH_STYLE when you deploy?

[ChinaBurn]

@ChinaBurn

1. 你是说能看到图片已经上传到 miniIO 的路径 generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp 位置？
2. 你浏览器直接访问 https://XXXXXXXX/lobe/generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp，可以访问吗？
3. 你部署的时候环境变量 S3_SET_ACL 和 S3_ENABLE_PATH_STYLE 的值分别是多少？

解决了，确实是权限问题，但是应该和lobechat的图片生成路径有关系，因为前期搭建S3，权限只给了lobe下的files文件夹，并没有给到generations这个新的文件夹。所以才会导致这个问题。我重新给了权限就好了。

[lobehubbot]

Bot detected the issue body's language is not English, translate it automatically. 👯👭🏻🧑‍🤝‍🧑👫🧑🏿‍🤝‍🧑🏻👩🏾‍🤝‍👨🏿👬🏿

---

@ChinaBurn

1. Are you saying that you can see the path where the image has been uploaded to miniIO generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp location?
2. You can access https://XXXXXXX/lobe/generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp directly in your browser. Can you access it?
3. What are the values of the environment variables S3_SET_ACL and S3_ENABLE_PATH_STYLE when you deploy?

It was solved, and it was indeed a permission problem, but it should be related to the image generation path of lobechat. Because S3 was built in the early stage, permissions were only given to the files folder under lobe, and the new folder of generations was not given to the generations. That's why this problem is caused. I just gave the permission again.

[tjx666]

@ChinaBurn

1. 你是说能看到图片已经上传到 miniIO 的路径 generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp 位置？
2. 你浏览器直接访问 https://XXXXXXXX/lobe/generations/images/IfMEIkwHi7ugZi_KsZDOA_1024x1024_20250725_015538_thumb.webp，可以访问吗？
3. 你部署的时候环境变量 S3_SET_ACL 和 S3_ENABLE_PATH_STYLE 的值分别是多少？

解决了，确实是权限问题，但是应该和lobechat的图片生成路径有关系，因为前期搭建S3，权限只给了lobe下的files文件夹，并没有给到generations这个新的文件夹。所以才会导致这个问题。我重新给了权限就好了。

Ok, 问题解决了就好