Aska
518bd0a230
批次A admin 端点（原本 404 变 200 真实数据）：
- GET /admin/llm：读 s.cfg.LLM 组 openai+anthropic 两 provider（enabled=当前 Provider、multimodal=配 VisionModel），APIKey 不进 wire 零泄露。
- GET /admin/automations：*automations.Service.List()（reminders+event rules+cron schedules，cron 加只读登记）。
- GET /admin/users：cfg.AdminUser + *auth.APIKey.List()（密钥掩码）；无用户存储，恒先返回当前 admin 账号。
- GET /admin/backthink：*backthink.Backthink.List(ctx,50)。均只读、owner/admin RBAC、{data} 信封。
批次B 视觉真推理 + 语音：
- rest.go chatRequest 加 Image?；流式 publishChatStream 带 image；userChatMessages 构造 ImageMessage(model.go:71)。
- loop/vision.go：ImageResolver 可注入（MVP 先看图再对话）；run.go Run 开头 resolveImages，无 resolver 透传直交主模型。
- vision/resolver.go：MessageResolver 调 vision.Router.Route——KindMain 保留图片交主模型多模态、KindVisionTool/OCRTool 经 dispatcher.Invoke 折叠成 [图片内容] 文本、KindUnsupported 记日志保留原图不崩。
- gateway/voice.go：VoiceService 接口 + SetVoice 注入点 + handleVoiceInput（未注入回 error 不崩）+ runVoiceTurn 异步 STT→loop chat→TTS→定向 voice_output 帧。
- ws_hub/ws_route：voice_input 接 handleVoiceInput；前端 ws.ts decodeBase64/playVoiceAudio/case voice_output。
第3步 wire.go 收口（唯一碰 wire.go 的一步）：
- Deps 补传 Automations:a.automation / Backthink:a.backthink / Users:auth.NewAPIKey(a.cfg.Auth)（*auth.APIKey 原生满足 UserStore，避免 admin 重复的复合类型）。
- gw.SetVoice(a.voice)；loop.Options.Vision = vision.NewMessageResolver(router, info, dispatcher.Invoke)（router=NewRouter(WithVisionTool/WithOCRTool)、info=cfg.LLM.VisionModel）。
实机验证：四 admin 端点 200 真实数据（llm 双 provider 脱敏、users=admin,yeij0942,owner）；WS 握手正常。go build/vet/test 全绿 + 前端 tsc。wire.go 557 行。
97 lines
2.7 KiB
Go
97 lines
2.7 KiB
Go
package auth
|
|
|
|
import (
|
|
"crypto/rand"
|
|
"encoding/base64"
|
|
"fmt"
|
|
"log/slog"
|
|
"sync"
|
|
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/config"
|
|
"git.yeij.top/AskaEth/Cyrene_v2/internal/logger"
|
|
)
|
|
|
|
// APIKey manages a bounded, in-memory constant table of API keys, each bound to
|
|
// a Role so keys can be minted for admin/owner to reach administrative
|
|
// endpoints. Keys are generated with crypto/rand and stored by their string
|
|
// form. This suits the current single-binary milestone; production should
|
|
// persist keys (e.g. hashed) and support revocation.
|
|
type APIKey struct {
|
|
mu sync.RWMutex
|
|
cfg config.AuthConfig
|
|
keys map[string]Role
|
|
log *slog.Logger
|
|
}
|
|
|
|
// NewAPIKey returns an empty key manager. cfg is accepted for constructor
|
|
// parity and future persistence settings; keys are runtime-generated.
|
|
func NewAPIKey(cfg config.AuthConfig) *APIKey {
|
|
return &APIKey{
|
|
cfg: cfg,
|
|
keys: make(map[string]Role),
|
|
log: logger.WithSource(slog.Default(), source),
|
|
}
|
|
}
|
|
|
|
// Generate mints a new random key bound to role and stores it. Returns the
|
|
// plaintext key exactly once; it must not be logged.
|
|
func (k *APIKey) Generate(role Role) (string, error) {
|
|
if !role.Valid() {
|
|
return "", fmt.Errorf("%w: %q", ErrInvalidRole, role)
|
|
}
|
|
raw := make([]byte, keyLength)
|
|
if _, err := rand.Read(raw); err != nil {
|
|
return "", fmt.Errorf("auth: generate api key: %w", err)
|
|
}
|
|
key := base64.RawURLEncoding.EncodeToString(raw)
|
|
|
|
k.mu.Lock()
|
|
k.keys[key] = role
|
|
k.mu.Unlock()
|
|
return key, nil
|
|
}
|
|
|
|
// Verify reports whether key is a known, unrevoked API key.
|
|
func (k *APIKey) Verify(key string) bool {
|
|
_, ok := k.Lookup(key)
|
|
return ok
|
|
}
|
|
|
|
// Lookup returns the role bound to key.
|
|
func (k *APIKey) Lookup(key string) (Role, bool) {
|
|
k.mu.RLock()
|
|
defer k.mu.RUnlock()
|
|
role, ok := k.keys[key]
|
|
return role, ok
|
|
}
|
|
|
|
// Revoke removes key from the constant table.
|
|
func (k *APIKey) Revoke(key string) {
|
|
k.mu.Lock()
|
|
defer k.mu.Unlock()
|
|
delete(k.keys, key)
|
|
}
|
|
|
|
// List returns a summary of every currently registered API key for the admin
|
|
// panel. Key material is never returned; each identifier is masked so the panel
|
|
// can tell keys apart without exposing the secret. The in-memory store keeps no
|
|
// creation time, so CreatedAt is nil for every entry.
|
|
func (k *APIKey) List() []UserSummary {
|
|
k.mu.RLock()
|
|
defer k.mu.RUnlock()
|
|
out := make([]UserSummary, 0, len(k.keys))
|
|
for key, role := range k.keys {
|
|
out = append(out, UserSummary{ID: maskKey(key), Username: "apikey", Role: role})
|
|
}
|
|
return out
|
|
}
|
|
|
|
// maskKey renders a key's leading and trailing groups so the panel can identify
|
|
// an entry without revealing the secret. Short keys are fully hidden.
|
|
func maskKey(key string) string {
|
|
if len(key) <= 8 {
|
|
return "••••"
|
|
}
|
|
return key[:4] + "••••" + key[len(key)-4:]
|
|
}
|