Agent-System-Backend/internal/settings/secrets.go

package settings

import (
	"encoding/json"
	"log"
	"strings"
	"time"
)

type secretSpec struct {
	path    string
	service string
}

var secretSpecs = []secretSpec{
	{"models.chat.apiKey", "models.chat"},
	{"models.lightweight.apiKey", "models.lightweight"},
	{"models.embedding.apiKey", "models.embedding"},
	{"models.rerank.apiKey", "models.rerank"},
	{"tools.tavily.apiKeys", "tools.tavily"},
}

// SnapshotAndMigrateSecrets 先为每个已存 scope 留快照，再把明文密钥迁入独立表并从表单设置里清掉。
// 没有生效密钥时迁入。生效密钥与明文相同则只清明文。两边不同则留下明文并告警，不覆盖生效密钥。
// 掩码占位符不迁。
func (s *Service) SnapshotAndMigrateSecrets() error {
	refs, err := s.st.ListSettingsScopes()
	if err != nil {
		return err
	}
	for _, ref := range refs {
		cur, err := s.st.GetSettingsScope(ref.Owner, ref.Scope)
		if err != nil {
			return err
		}
		raw, err := json.Marshal(cur)
		if err != nil {
			return err
		}
		if _, err := s.st.SaveSnapshotIfChanged(ref.Owner, ref.Scope, string(raw), "startup"); err != nil {
			return err
		}
		for _, spec := range secretSpecs {
			val, ok := lookupString(cur, spec.path)
			if !ok || val == MaskPlaceholder {
				continue
			}
			active, hasActive := s.st.ActiveSecret(ref.Owner, spec.service)
			if hasActive && active != val {
				// 生效密钥优先于明文。两边不同就留下明文并告警，避免静默丢掉新 key。
				log.Printf("settings: active secret %s for owner %q differs from stored plaintext; keeping plaintext", spec.service, ref.Owner)
				continue
			}
			if !hasActive {
				if _, err := s.st.AddSecret(ref.Owner, spec.service, "迁入", val); err != nil {
					return err
				}
			}
			path := spec.path
			if err := s.st.UpdateSettingsScope(ref.Owner, ref.Scope, func(cur map[string]any) (map[string]any, error) {
				next := cloneMap(cur)
				deletePath(next, path)
				return next, nil
			}); err != nil {
				return err
			}
		}
	}
	return nil
}

func (s *Service) snapshotThrottled(owner, scope string) {
	if at, ok := s.st.LatestSnapshotAt(owner, scope); ok && time.Since(at) < 10*time.Minute {
		return
	}
	cur, err := s.st.GetSettingsScope(owner, scope)
	if err != nil {
		return
	}
	raw, err := json.Marshal(cur)
	if err != nil {
		return
	}
	_, _ = s.st.SaveSnapshotIfChanged(owner, scope, string(raw), "save")
}

// snapshotThrottledAccountChecked keeps the best-effort snapshot behavior of
// settings writes while fencing its separate final insert transaction. A
// disable between the settings commit and this snapshot can omit the snapshot.
func (s *Service) snapshotThrottledAccountChecked(actor, owner, scope string, allowImplicitDefault bool) {
	if at, ok := s.st.LatestSnapshotAt(owner, scope); ok && time.Since(at) < 10*time.Minute {
		return
	}
	cur, err := s.st.GetSettingsScope(owner, scope)
	if err != nil {
		return
	}
	raw, err := json.Marshal(cur)
	if err != nil {
		return
	}
	_, _ = s.st.SaveSnapshotIfChangedAccountChecked(actor, owner, scope, string(raw), "save", allowImplicitDefault)
}

// adoptSystemSecrets 把系统层写入里的明文密钥同步成该服务的生效密钥。
// 与当前生效值相同则不追加行。掩码占位符在 prepareWrite 时已经丢掉。
func (s *Service) adoptSystemSecrets(owner, scope string, incoming map[string]any) error {
	if scope != ScopeSystem || owner != OwnerSystemRow {
		return nil
	}
	for _, spec := range secretSpecs {
		val, ok := lookupString(incoming, spec.path)
		if !ok || val == MaskPlaceholder {
			continue
		}
		if cur, ok := s.st.ActiveSecret(owner, spec.service); ok && cur == val {
			continue
		}
		if _, err := s.st.AddSecret(owner, spec.service, "播种", val); err != nil {
			return err
		}
	}
	return nil
}

// cloneMap 复制一份设置 map。就地删除后再和原 map 比较会被判定为没变化，写不进库。
func cloneMap(m map[string]any) map[string]any {
	raw, err := json.Marshal(m)
	if err != nil {
		return map[string]any{}
	}
	var out map[string]any
	if err := json.Unmarshal(raw, &out); err != nil || out == nil {
		return map[string]any{}
	}
	return out
}

func lookupString(m map[string]any, path string) (string, bool) {
	var cur any = m
	for _, p := range strings.Split(path, ".") {
		obj, ok := cur.(map[string]any)
		if !ok {
			return "", false
		}
		cur, ok = obj[p]
		if !ok {
			return "", false
		}
	}
	s, ok := cur.(string)
	if !ok || strings.TrimSpace(s) == "" {
		return "", false
	}
	return s, true
}

func deletePath(m map[string]any, path string) {
	parts := strings.Split(path, ".")
	cur := m
	for i, p := range parts {
		if i == len(parts)-1 {
			delete(cur, p)
			return
		}
		next, ok := cur[p].(map[string]any)
		if !ok {
			return
		}
		cur = next
	}
}