chenchenandClaude Opus 4.8
4502d6b5bc
新增 GET /api/heicode/preflight?template_id=&binding_ids=1,2,3 —— agent 启动前的统一 确认层(#29 EPIC 的 #39 缺失项检测 + #40 可读执行摘要): - #39 缺失项检测:必需资源类别(git/sk/project_document/cloud_account)未绑定、budget (余额≤0)、agent_slot(在跑数达 tier 上限)。ready = missing 为空。 - #40 可读执行摘要:agent 角色、脱敏资源视图、高危操作、预算(剩余额度/quota_per_unit/ tier 上限/当前在跑数)、审批策略。 - 红线:resources 只暴露 type/provider/name/status/has_secret(布尔),绝不含 secret_ref/channelId/base_url/price。 - 高危操作固定 enum:production_deploy/db_write/cloud_resource_delete/ production_secret/large_budget,由已绑资源类型推导,均 requires_approval。 判定逻辑抽为纯函数 computePreflight,单测覆盖:全缺失、就绪、槽位满、高危 enum、 敏感字段不泄露(序列化断言)。复用既有 ResourceBinding/模板/GetUserMaxAgents/部署门禁 口径,不改部署/计费逻辑。文档补 §4.1。 #41(confirm + 审计 + 防篡改版本校验)作为后续 POST /preflight/confirm 实现。 Affects: Manager only(新增只读端点)。无 Client/Swarm 代码改动,无计费/审计 schema 改动。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
589 lines
32 KiB
Go
589 lines
32 KiB
Go
package router
|
|
|
|
import (
|
|
"github.com/heicode/manager/controller"
|
|
"github.com/heicode/manager/middleware"
|
|
|
|
// Import oauth package to register providers via init()
|
|
_ "github.com/heicode/manager/oauth"
|
|
|
|
"github.com/gin-contrib/gzip"
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func SetApiRouter(router *gin.Engine) {
|
|
apiRouter := router.Group("/api")
|
|
apiRouter.Use(middleware.RouteTag("api"))
|
|
apiRouter.Use(gzip.Gzip(gzip.DefaultCompression))
|
|
apiRouter.Use(middleware.BodyStorageCleanup()) // 清理请求体存储
|
|
apiRouter.Use(middleware.GlobalAPIRateLimit())
|
|
{
|
|
apiRouter.GET("/setup", controller.GetSetup)
|
|
apiRouter.POST("/setup", controller.PostSetup)
|
|
apiRouter.GET("/status", controller.GetStatus)
|
|
// V2 device-binding: clients fetch the Manager's long-term X25519
|
|
// public key here before they can encrypt request bodies. Public —
|
|
// no auth — because new installs need it before they have any
|
|
// credentials. See controller/server_pubkey.go.
|
|
apiRouter.GET("/server-pubkey", controller.GetServerPubkey)
|
|
apiRouter.GET("/uptime/status", controller.GetUptimeKumaStatus)
|
|
apiRouter.GET("/models", middleware.UserAuth(), controller.DashboardListModels)
|
|
apiRouter.GET("/status/test", middleware.AdminAuth(), controller.TestStatus)
|
|
// Secret-store status snapshot. The handler returns only
|
|
// sanitized Azure Key Vault config/reachability flags and never
|
|
// exposes addresses, tokens, secret names or secret values, so
|
|
// resource binding can read it as an authenticated user.
|
|
apiRouter.GET("/secret-store/status", middleware.UserAuth(), controller.GetSecretStoreStatus)
|
|
apiRouter.GET("/notice", controller.GetNotice)
|
|
apiRouter.GET("/user-agreement", controller.GetUserAgreement)
|
|
apiRouter.GET("/privacy-policy", controller.GetPrivacyPolicy)
|
|
apiRouter.GET("/about", controller.GetAbout)
|
|
//apiRouter.GET("/midjourney", controller.GetMidjourney)
|
|
apiRouter.GET("/home_page_content", controller.GetHomePageContent)
|
|
apiRouter.GET("/pricing", middleware.TryUserAuth(), controller.GetPricing)
|
|
apiRouter.GET("/verification", middleware.EmailVerificationRateLimit(), middleware.TurnstileCheck(), controller.SendEmailVerification)
|
|
apiRouter.GET("/reset_password", middleware.CriticalRateLimit(), middleware.TurnstileCheck(), controller.SendPasswordResetEmail)
|
|
apiRouter.POST("/user/reset", middleware.CriticalRateLimit(), controller.ResetPassword)
|
|
// OAuth routes - specific routes must come before :provider wildcard
|
|
apiRouter.GET("/oauth/state", middleware.CriticalRateLimit(), controller.GenerateOAuthCode)
|
|
apiRouter.POST("/oauth/email/bind", middleware.CriticalRateLimit(), controller.EmailBind)
|
|
// Non-standard OAuth (WeChat, Telegram) - keep original routes
|
|
apiRouter.GET("/oauth/wechat", middleware.CriticalRateLimit(), controller.WeChatAuth)
|
|
apiRouter.POST("/oauth/wechat/bind", middleware.CriticalRateLimit(), controller.WeChatBind)
|
|
apiRouter.GET("/oauth/telegram/login", middleware.CriticalRateLimit(), controller.TelegramLogin)
|
|
apiRouter.GET("/oauth/telegram/bind", middleware.CriticalRateLimit(), controller.TelegramBind)
|
|
// Standard OAuth providers (GitHub, Discord, OIDC, LinuxDO) - unified route
|
|
apiRouter.GET("/oauth/:provider", middleware.CriticalRateLimit(), controller.HandleOAuth)
|
|
apiRouter.GET("/ratio_config", middleware.CriticalRateLimit(), controller.GetRatioConfig)
|
|
|
|
apiRouter.POST("/stripe/webhook", controller.StripeWebhook)
|
|
apiRouter.POST("/creem/webhook", controller.CreemWebhook)
|
|
apiRouter.POST("/waffo/webhook", controller.WaffoWebhook)
|
|
apiRouter.GET("/agent/callbacks/runtime-events/schema", controller.AgentGetRuntimeEventCallbackSchema)
|
|
apiRouter.POST("/agent/callbacks/runtime-events", controller.AgentReceiveRuntimeEventCallback)
|
|
// Client-facing capability discovery (unified spec §6). Catalog data only.
|
|
apiRouter.GET("/heicode/capabilities", controller.HeicodeCapabilities)
|
|
// Client runtime config (#24): telemetry enable/endpoint/kill-switch etc.
|
|
// Pollable within a session so kill switches propagate without re-login.
|
|
apiRouter.GET("/heicode/config", controller.HeicodeConfig)
|
|
apiRouter.POST("/swarms", middleware.UserOrV2DeviceAuth(), controller.AgentCreateUserSwarm)
|
|
//apiRouter.POST("/waffo-pancake/webhook", controller.WaffoPancakeWebhook)
|
|
|
|
// Universal secure verification routes
|
|
apiRouter.POST("/verify", middleware.UserAuth(), middleware.CriticalRateLimit(), controller.UniversalVerify)
|
|
|
|
// Same-origin proxy for Heicode external identity service (APIM).
|
|
// Frontend calls /api/heicode-auth/<path>; controller forwards to
|
|
// ${HEICODE_AUTH_BASE_URL}/<path>. Avoids browser CORS preflight failures
|
|
// when APIM has not added code.xinghanlab.com to its allow-list.
|
|
// Use GlobalAPIRateLimit (180 req / 180s) not CriticalRateLimit (20 req
|
|
// / 20 min). The proxy is hit on every page render for /me /refresh
|
|
// plus the login burst — CriticalRateLimit is for sensitive ops
|
|
// (login, password reset) and trips at ~5 quick page loads, returning
|
|
// 429 to a normal user. Upstream APIM rate-limits itself anyway.
|
|
apiRouter.Any("/heicode-auth/*proxyPath", middleware.GlobalAPIRateLimit(), middleware.OptionalV2DeviceAuth(), controller.HeicodeAuthProxy)
|
|
|
|
userRoute := apiRouter.Group("/user")
|
|
{
|
|
userRoute.POST("/register", middleware.CriticalRateLimit(), middleware.TurnstileCheck(), controller.Register)
|
|
userRoute.POST("/session/from-agent", middleware.CriticalRateLimit(), controller.HeicodeAgentSessionLogin)
|
|
userRoute.POST("/login", middleware.CriticalRateLimit(), middleware.TurnstileCheck(), controller.Login)
|
|
userRoute.POST("/login/2fa", middleware.CriticalRateLimit(), controller.Verify2FALogin)
|
|
userRoute.POST("/passkey/login/begin", middleware.CriticalRateLimit(), controller.PasskeyLoginBegin)
|
|
userRoute.POST("/passkey/login/finish", middleware.CriticalRateLimit(), controller.PasskeyLoginFinish)
|
|
//userRoute.POST("/tokenlog", middleware.CriticalRateLimit(), controller.TokenLog)
|
|
userRoute.GET("/logout", controller.Logout)
|
|
userRoute.POST("/epay/notify", controller.EpayNotify)
|
|
userRoute.GET("/epay/notify", controller.EpayNotify)
|
|
userRoute.GET("/groups", controller.GetUserGroups)
|
|
|
|
// Heicode desktop installer file streaming — uses TokenOrUserAuth so a plain
|
|
// browser <a href> download (cookie only, no New-Api-User header) works.
|
|
// The metadata endpoint stays on selfRoute since the SPA's axios layer
|
|
// already injects the required header.
|
|
userRoute.GET("/desktop-downloads/file/:platform", middleware.TokenOrUserAuth(), controller.DownloadDesktopFile)
|
|
|
|
selfRoute := userRoute.Group("/")
|
|
selfRoute.Use(middleware.UserAuth())
|
|
{
|
|
selfRoute.GET("/self/groups", controller.GetUserGroups)
|
|
selfRoute.GET("/self", controller.GetSelf)
|
|
selfRoute.GET("/models", controller.GetUserModels)
|
|
selfRoute.PUT("/self", controller.UpdateSelf)
|
|
selfRoute.DELETE("/self", controller.DeleteSelf)
|
|
selfRoute.GET("/token", controller.GenerateAccessToken)
|
|
// Heicode desktop client installers metadata (login required)
|
|
selfRoute.GET("/desktop-downloads", controller.GetDesktopDownloads)
|
|
|
|
selfRoute.GET("/passkey", controller.PasskeyStatus)
|
|
selfRoute.POST("/passkey/register/begin", controller.PasskeyRegisterBegin)
|
|
selfRoute.POST("/passkey/register/finish", controller.PasskeyRegisterFinish)
|
|
selfRoute.POST("/passkey/verify/begin", controller.PasskeyVerifyBegin)
|
|
selfRoute.POST("/passkey/verify/finish", controller.PasskeyVerifyFinish)
|
|
selfRoute.DELETE("/passkey", controller.PasskeyDelete)
|
|
selfRoute.GET("/aff", controller.GetAffCode)
|
|
selfRoute.GET("/topup/info", controller.GetTopUpInfo)
|
|
selfRoute.GET("/topup/self", controller.GetUserTopUps)
|
|
selfRoute.POST("/topup", middleware.CriticalRateLimit(), controller.TopUp)
|
|
selfRoute.POST("/pay", middleware.CriticalRateLimit(), controller.RequestEpay)
|
|
selfRoute.POST("/amount", controller.RequestAmount)
|
|
selfRoute.POST("/stripe/pay", middleware.CriticalRateLimit(), controller.RequestStripePay)
|
|
selfRoute.POST("/stripe/amount", controller.RequestStripeAmount)
|
|
selfRoute.POST("/creem/pay", middleware.CriticalRateLimit(), controller.RequestCreemPay)
|
|
selfRoute.POST("/waffo/amount", controller.RequestWaffoAmount)
|
|
selfRoute.POST("/waffo/pay", middleware.CriticalRateLimit(), controller.RequestWaffoPay)
|
|
//selfRoute.POST("/waffo-pancake/amount", controller.RequestWaffoPancakeAmount)
|
|
//selfRoute.POST("/waffo-pancake/pay", middleware.CriticalRateLimit(), controller.RequestWaffoPancakePay)
|
|
selfRoute.POST("/aff_transfer", controller.TransferAffQuota)
|
|
selfRoute.PUT("/setting", controller.UpdateUserSetting)
|
|
|
|
// 2FA routes
|
|
selfRoute.GET("/2fa/status", controller.Get2FAStatus)
|
|
selfRoute.POST("/2fa/setup", controller.Setup2FA)
|
|
selfRoute.POST("/2fa/enable", controller.Enable2FA)
|
|
selfRoute.POST("/2fa/disable", controller.Disable2FA)
|
|
selfRoute.POST("/2fa/backup_codes", controller.RegenerateBackupCodes)
|
|
|
|
// Check-in routes
|
|
selfRoute.GET("/checkin", controller.GetCheckinStatus)
|
|
selfRoute.POST("/checkin", middleware.TurnstileCheck(), controller.DoCheckin)
|
|
|
|
// Custom OAuth bindings
|
|
selfRoute.GET("/oauth/bindings", controller.GetUserOAuthBindings)
|
|
selfRoute.DELETE("/oauth/bindings/:provider_id", controller.UnbindCustomOAuth)
|
|
}
|
|
|
|
adminRoute := userRoute.Group("/")
|
|
adminRoute.Use(middleware.AdminAuth())
|
|
{
|
|
adminRoute.GET("/", controller.GetAllUsers)
|
|
adminRoute.GET("/topup", controller.GetAllTopUps)
|
|
adminRoute.POST("/topup/complete", controller.AdminCompleteTopUp)
|
|
adminRoute.GET("/search", controller.SearchUsers)
|
|
adminRoute.GET("/:id/oauth/bindings", controller.GetUserOAuthBindingsByAdmin)
|
|
adminRoute.DELETE("/:id/oauth/bindings/:provider_id", controller.UnbindCustomOAuthByAdmin)
|
|
adminRoute.DELETE("/:id/bindings/:binding_type", controller.AdminClearUserBinding)
|
|
adminRoute.GET("/:id", controller.GetUser)
|
|
adminRoute.POST("/", controller.CreateUser)
|
|
adminRoute.POST("/manage", controller.ManageUser)
|
|
adminRoute.PUT("/", controller.UpdateUser)
|
|
adminRoute.DELETE("/:id", controller.DeleteUser)
|
|
adminRoute.DELETE("/:id/reset_passkey", controller.AdminResetPasskey)
|
|
|
|
// Admin 2FA routes
|
|
adminRoute.GET("/2fa/stats", controller.Admin2FAStats)
|
|
adminRoute.DELETE("/:id/2fa", controller.AdminDisable2FA)
|
|
}
|
|
}
|
|
|
|
// Subscription billing (plans, purchase, admin management)
|
|
subscriptionRoute := apiRouter.Group("/subscription")
|
|
subscriptionRoute.Use(middleware.UserAuth())
|
|
{
|
|
subscriptionRoute.GET("/plans", controller.GetSubscriptionPlans)
|
|
subscriptionRoute.GET("/self", controller.GetSubscriptionSelf)
|
|
subscriptionRoute.PUT("/self/preference", controller.UpdateSubscriptionPreference)
|
|
subscriptionRoute.POST("/epay/pay", middleware.CriticalRateLimit(), controller.SubscriptionRequestEpay)
|
|
subscriptionRoute.POST("/stripe/pay", middleware.CriticalRateLimit(), controller.SubscriptionRequestStripePay)
|
|
subscriptionRoute.POST("/creem/pay", middleware.CriticalRateLimit(), controller.SubscriptionRequestCreemPay)
|
|
}
|
|
subscriptionAdminRoute := apiRouter.Group("/subscription/admin")
|
|
subscriptionAdminRoute.Use(middleware.AdminAuth())
|
|
{
|
|
subscriptionAdminRoute.GET("/plans", controller.AdminListSubscriptionPlans)
|
|
subscriptionAdminRoute.POST("/plans", controller.AdminCreateSubscriptionPlan)
|
|
subscriptionAdminRoute.PUT("/plans/:id", controller.AdminUpdateSubscriptionPlan)
|
|
subscriptionAdminRoute.PATCH("/plans/:id", controller.AdminUpdateSubscriptionPlanStatus)
|
|
subscriptionAdminRoute.POST("/bind", controller.AdminBindSubscription)
|
|
|
|
// User subscription management (admin)
|
|
subscriptionAdminRoute.GET("/users/:id/subscriptions", controller.AdminListUserSubscriptions)
|
|
subscriptionAdminRoute.POST("/users/:id/subscriptions", controller.AdminCreateUserSubscription)
|
|
subscriptionAdminRoute.POST("/user_subscriptions/:id/invalidate", controller.AdminInvalidateUserSubscription)
|
|
subscriptionAdminRoute.DELETE("/user_subscriptions/:id", controller.AdminDeleteUserSubscription)
|
|
}
|
|
|
|
// Subscription payment callbacks (no auth)
|
|
apiRouter.POST("/subscription/epay/notify", controller.SubscriptionEpayNotify)
|
|
apiRouter.GET("/subscription/epay/notify", controller.SubscriptionEpayNotify)
|
|
apiRouter.GET("/subscription/epay/return", controller.SubscriptionEpayReturn)
|
|
apiRouter.POST("/subscription/epay/return", controller.SubscriptionEpayReturn)
|
|
|
|
gitSourceRoute := apiRouter.Group("/git-sources")
|
|
gitSourceRoute.Use(middleware.UserAuth())
|
|
{
|
|
gitSourceRoute.GET("/", controller.ListGitSources)
|
|
gitSourceRoute.POST("/", controller.CreateGitSource)
|
|
gitSourceRoute.PUT("/:id", controller.UpdateGitSource)
|
|
gitSourceRoute.DELETE("/:id", controller.DeleteGitSource)
|
|
}
|
|
|
|
resourceRoute := apiRouter.Group("/resources")
|
|
resourceRoute.Use(middleware.UserAuth())
|
|
{
|
|
resourceRoute.GET("/", controller.ListResources)
|
|
resourceRoute.POST("/", controller.CreateResource)
|
|
resourceRoute.POST("/:id/secret", controller.UpsertResourceSecret)
|
|
resourceRoute.POST("/:id/azure/discover", controller.DiscoverAzureResources)
|
|
resourceRoute.PUT("/:id", controller.UpdateResource)
|
|
resourceRoute.DELETE("/:id", controller.DeleteResource)
|
|
}
|
|
|
|
resourceGrantRoute := apiRouter.Group("/resource-grants")
|
|
resourceGrantRoute.Use(middleware.UserAuth())
|
|
{
|
|
resourceGrantRoute.GET("/", controller.ListResourceGrants)
|
|
resourceGrantRoute.GET("/manifest", controller.GenerateResourceGrantManifest)
|
|
resourceGrantRoute.POST("/", controller.CreateResourceGrant)
|
|
resourceGrantRoute.PUT("/:id", controller.UpdateResourceGrant)
|
|
resourceGrantRoute.DELETE("/:id", controller.DeleteResourceGrant)
|
|
}
|
|
|
|
optionRoute := apiRouter.Group("/option")
|
|
optionRoute.Use(middleware.RootAuth())
|
|
{
|
|
optionRoute.GET("/", controller.GetOptions)
|
|
optionRoute.PUT("/", controller.UpdateOption)
|
|
optionRoute.GET("/channel_affinity_cache", controller.GetChannelAffinityCacheStats)
|
|
optionRoute.DELETE("/channel_affinity_cache", controller.ClearChannelAffinityCache)
|
|
optionRoute.POST("/rest_model_ratio", controller.ResetModelRatio)
|
|
optionRoute.POST("/migrate_console_setting", controller.MigrateConsoleSetting) // 用于迁移检测的旧键，下个版本会删除
|
|
}
|
|
|
|
// Custom OAuth provider management (root only)
|
|
customOAuthRoute := apiRouter.Group("/custom-oauth-provider")
|
|
customOAuthRoute.Use(middleware.RootAuth())
|
|
{
|
|
customOAuthRoute.POST("/discovery", controller.FetchCustomOAuthDiscovery)
|
|
customOAuthRoute.GET("/", controller.GetCustomOAuthProviders)
|
|
customOAuthRoute.GET("/:id", controller.GetCustomOAuthProvider)
|
|
customOAuthRoute.POST("/", controller.CreateCustomOAuthProvider)
|
|
customOAuthRoute.PUT("/:id", controller.UpdateCustomOAuthProvider)
|
|
customOAuthRoute.DELETE("/:id", controller.DeleteCustomOAuthProvider)
|
|
}
|
|
performanceRoute := apiRouter.Group("/performance")
|
|
performanceRoute.Use(middleware.RootAuth())
|
|
{
|
|
performanceRoute.GET("/stats", controller.GetPerformanceStats)
|
|
performanceRoute.DELETE("/disk_cache", controller.ClearDiskCache)
|
|
performanceRoute.POST("/reset_stats", controller.ResetPerformanceStats)
|
|
performanceRoute.POST("/gc", controller.ForceGC)
|
|
performanceRoute.GET("/logs", controller.GetLogFiles)
|
|
performanceRoute.DELETE("/logs", controller.CleanupLogFiles)
|
|
}
|
|
ratioSyncRoute := apiRouter.Group("/ratio_sync")
|
|
ratioSyncRoute.Use(middleware.RootAuth())
|
|
{
|
|
ratioSyncRoute.GET("/channels", controller.GetSyncableChannels)
|
|
ratioSyncRoute.POST("/fetch", controller.FetchUpstreamRatios)
|
|
}
|
|
channelRoute := apiRouter.Group("/channel")
|
|
channelRoute.Use(middleware.AdminAuth())
|
|
{
|
|
channelRoute.GET("/", controller.GetAllChannels)
|
|
channelRoute.GET("/search", controller.SearchChannels)
|
|
channelRoute.GET("/models", controller.ChannelListModels)
|
|
channelRoute.GET("/models_enabled", controller.EnabledListModels)
|
|
channelRoute.GET("/:id", controller.GetChannel)
|
|
channelRoute.POST("/:id/key", middleware.RootAuth(), middleware.CriticalRateLimit(), middleware.DisableCache(), middleware.SecureVerificationRequired(), controller.GetChannelKey)
|
|
channelRoute.GET("/test", controller.TestAllChannels)
|
|
channelRoute.GET("/test/:id", controller.TestChannel)
|
|
channelRoute.GET("/update_balance", controller.UpdateAllChannelsBalance)
|
|
channelRoute.GET("/update_balance/:id", controller.UpdateChannelBalance)
|
|
channelRoute.POST("/", controller.AddChannel)
|
|
channelRoute.PUT("/", controller.UpdateChannel)
|
|
channelRoute.DELETE("/disabled", controller.DeleteDisabledChannel)
|
|
channelRoute.POST("/tag/disabled", controller.DisableTagChannels)
|
|
channelRoute.POST("/tag/enabled", controller.EnableTagChannels)
|
|
channelRoute.PUT("/tag", controller.EditTagChannels)
|
|
channelRoute.DELETE("/:id", controller.DeleteChannel)
|
|
channelRoute.POST("/batch", controller.DeleteChannelBatch)
|
|
channelRoute.POST("/fix", controller.FixChannelsAbilities)
|
|
channelRoute.GET("/fetch_models/:id", controller.FetchUpstreamModels)
|
|
channelRoute.POST("/fetch_models", middleware.RootAuth(), controller.FetchModels)
|
|
channelRoute.POST("/codex/oauth/start", controller.StartCodexOAuth)
|
|
channelRoute.POST("/codex/oauth/complete", controller.CompleteCodexOAuth)
|
|
channelRoute.POST("/:id/codex/oauth/start", controller.StartCodexOAuthForChannel)
|
|
channelRoute.POST("/:id/codex/oauth/complete", controller.CompleteCodexOAuthForChannel)
|
|
channelRoute.POST("/:id/codex/refresh", controller.RefreshCodexChannelCredential)
|
|
channelRoute.GET("/:id/codex/usage", controller.GetCodexChannelUsage)
|
|
channelRoute.POST("/ollama/pull", controller.OllamaPullModel)
|
|
channelRoute.POST("/ollama/pull/stream", controller.OllamaPullModelStream)
|
|
channelRoute.DELETE("/ollama/delete", controller.OllamaDeleteModel)
|
|
channelRoute.GET("/ollama/version/:id", controller.OllamaVersion)
|
|
channelRoute.POST("/batch/tag", controller.BatchSetChannelTag)
|
|
channelRoute.GET("/tag/models", controller.GetTagModels)
|
|
channelRoute.POST("/copy/:id", controller.CopyChannel)
|
|
channelRoute.POST("/multi_key/manage", controller.ManageMultiKeys)
|
|
channelRoute.POST("/upstream_updates/apply", controller.ApplyChannelUpstreamModelUpdates)
|
|
channelRoute.POST("/upstream_updates/apply_all", controller.ApplyAllChannelUpstreamModelUpdates)
|
|
channelRoute.POST("/upstream_updates/detect", controller.DetectChannelUpstreamModelUpdates)
|
|
channelRoute.POST("/upstream_updates/detect_all", controller.DetectAllChannelUpstreamModelUpdates)
|
|
}
|
|
tokenRoute := apiRouter.Group("/token")
|
|
tokenRoute.Use(middleware.UserAuth())
|
|
{
|
|
tokenRoute.GET("/", controller.GetAllTokens)
|
|
tokenRoute.GET("/search", middleware.SearchRateLimit(), controller.SearchTokens)
|
|
tokenRoute.GET("/:id", controller.GetToken)
|
|
tokenRoute.POST("/:id/key", middleware.CriticalRateLimit(), middleware.DisableCache(), controller.GetTokenKey)
|
|
tokenRoute.POST("/", controller.AddToken)
|
|
tokenRoute.PUT("/", controller.UpdateToken)
|
|
tokenRoute.DELETE("/:id", controller.DeleteToken)
|
|
tokenRoute.POST("/batch", controller.DeleteTokenBatch)
|
|
tokenRoute.POST("/batch/keys", middleware.CriticalRateLimit(), middleware.DisableCache(), controller.GetTokenKeysBatch)
|
|
}
|
|
|
|
// Device-bound tokens (cc-haha desktop client). Lives on a
|
|
// separate route group so the existing token CRUD endpoints
|
|
// continue to operate on the "user-created API key" mental
|
|
// model, and the device-pair flow doesn't accidentally show
|
|
// up in the legacy /api/token UI. CriticalRateLimit on the
|
|
// pair endpoint stops brute-force device-spam from one user.
|
|
// V2 first-launch pairing accepts EITHER a user JWT (credentials
|
|
// login flow) OR a sk- access token (OAuth-redirect flow). The
|
|
// OAuth callback hands cc-haha only a sk-, so the original
|
|
// UserAuth-only path made pair 401 and the device-binding flow
|
|
// failed silently. We split /pair onto its own group with
|
|
// TokenOrUserAuth, while keeping the read/manage routes behind
|
|
// UserAuth (a sk- bearer must NOT be allowed to enumerate or
|
|
// revoke the user's other devices).
|
|
deviceManageRoute := apiRouter.Group("/devices")
|
|
deviceManageRoute.Use(middleware.UserAuth())
|
|
{
|
|
deviceManageRoute.GET("/", controller.ListUserDevices)
|
|
deviceManageRoute.PATCH("/:id", controller.RenameUserDevice)
|
|
deviceManageRoute.DELETE("/:id", controller.RevokeUserDevice)
|
|
}
|
|
devicePairRoute := apiRouter.Group("/devices")
|
|
devicePairRoute.Use(middleware.TokenOrUserAuth())
|
|
{
|
|
devicePairRoute.POST("/pair",
|
|
middleware.CriticalRateLimit(),
|
|
controller.PairDevice,
|
|
)
|
|
}
|
|
// Desktop client logout: a device-signed client revokes its OWN device
|
|
// token (or a session caller passes device_id). V2-device or session auth.
|
|
apiRouter.POST("/devices/logout", middleware.UserOrV2DeviceAuth(), controller.LogoutDevice)
|
|
|
|
// Heicode desktop balance/usage endpoint. The standard
|
|
// /api/user/self lives behind UserAuth (session cookie or JWT)
|
|
// because the web dashboard's axios layer always carries them.
|
|
// The desktop client has neither — it holds a sk- (legacy) or
|
|
// signs requests with its V2 device key. We mount a slim
|
|
// quota/used_quota/request_count view on TokenAuth here so the
|
|
// client's "balance pill" can read the *user-row* counters
|
|
// (which are the real billing numbers) instead of relying on
|
|
// /v1/dashboard/billing/* — those reflect the device token's
|
|
// unlimited-quota flag, not the user's actual balance.
|
|
heicodeSelfRoute := apiRouter.Group("/heicode")
|
|
heicodeSelfRoute.Use(middleware.TokenAuth())
|
|
{
|
|
heicodeSelfRoute.GET("/self", controller.GetHeicodeSelf)
|
|
}
|
|
|
|
usageRoute := apiRouter.Group("/usage")
|
|
usageRoute.Use(middleware.CORS(), middleware.CriticalRateLimit())
|
|
{
|
|
tokenUsageRoute := usageRoute.Group("/token")
|
|
tokenUsageRoute.Use(middleware.TokenAuthReadOnly())
|
|
{
|
|
tokenUsageRoute.GET("/", controller.GetTokenUsage)
|
|
}
|
|
}
|
|
|
|
redemptionRoute := apiRouter.Group("/redemption")
|
|
redemptionRoute.Use(middleware.AdminAuth())
|
|
{
|
|
redemptionRoute.GET("/", controller.GetAllRedemptions)
|
|
redemptionRoute.GET("/search", controller.SearchRedemptions)
|
|
redemptionRoute.GET("/:id", controller.GetRedemption)
|
|
redemptionRoute.POST("/", controller.AddRedemption)
|
|
redemptionRoute.PUT("/", controller.UpdateRedemption)
|
|
redemptionRoute.DELETE("/invalid", controller.DeleteInvalidRedemption)
|
|
redemptionRoute.DELETE("/:id", controller.DeleteRedemption)
|
|
}
|
|
logRoute := apiRouter.Group("/log")
|
|
logRoute.GET("/", middleware.AdminAuth(), controller.GetAllLogs)
|
|
logRoute.DELETE("/", middleware.AdminAuth(), controller.DeleteHistoryLogs)
|
|
logRoute.GET("/stat", middleware.AdminAuth(), controller.GetLogsStat)
|
|
logRoute.GET("/self/stat", middleware.UserAuth(), controller.GetLogsSelfStat)
|
|
logRoute.GET("/channel_affinity_usage_cache", middleware.AdminAuth(), controller.GetChannelAffinityUsageCacheStats)
|
|
logRoute.GET("/search", middleware.AdminAuth(), controller.SearchAllLogs)
|
|
logRoute.GET("/self", middleware.UserAuth(), controller.GetUserLogs)
|
|
logRoute.GET("/self/search", middleware.UserAuth(), middleware.SearchRateLimit(), controller.SearchUserLogs)
|
|
|
|
dataRoute := apiRouter.Group("/data")
|
|
dataRoute.GET("/", middleware.AdminAuth(), controller.GetAllQuotaDates)
|
|
dataRoute.GET("/users", middleware.AdminAuth(), controller.GetQuotaDatesByUser)
|
|
dataRoute.GET("/self", middleware.UserAuth(), controller.GetUserQuotaDates)
|
|
|
|
logRoute.Use(middleware.CORS(), middleware.CriticalRateLimit())
|
|
{
|
|
logRoute.GET("/token", middleware.TokenAuthReadOnly(), controller.GetLogByKey)
|
|
}
|
|
groupRoute := apiRouter.Group("/group")
|
|
groupRoute.Use(middleware.AdminAuth())
|
|
{
|
|
groupRoute.GET("/", controller.GetGroups)
|
|
}
|
|
|
|
prefillGroupRoute := apiRouter.Group("/prefill_group")
|
|
prefillGroupRoute.Use(middleware.AdminAuth())
|
|
{
|
|
prefillGroupRoute.GET("/", controller.GetPrefillGroups)
|
|
prefillGroupRoute.POST("/", controller.CreatePrefillGroup)
|
|
prefillGroupRoute.PUT("/", controller.UpdatePrefillGroup)
|
|
prefillGroupRoute.DELETE("/:id", controller.DeletePrefillGroup)
|
|
}
|
|
|
|
mjRoute := apiRouter.Group("/mj")
|
|
mjRoute.GET("/self", middleware.UserAuth(), controller.GetUserMidjourney)
|
|
mjRoute.GET("/", middleware.AdminAuth(), controller.GetAllMidjourney)
|
|
|
|
taskRoute := apiRouter.Group("/task")
|
|
{
|
|
taskRoute.GET("/self", middleware.UserAuth(), controller.GetUserTask)
|
|
taskRoute.GET("/", middleware.AdminAuth(), controller.GetAllTask)
|
|
}
|
|
|
|
vendorRoute := apiRouter.Group("/vendors")
|
|
vendorRoute.Use(middleware.AdminAuth())
|
|
{
|
|
vendorRoute.GET("/", controller.GetAllVendors)
|
|
vendorRoute.GET("/search", controller.SearchVendors)
|
|
vendorRoute.GET("/:id", controller.GetVendorMeta)
|
|
vendorRoute.POST("/", controller.CreateVendorMeta)
|
|
vendorRoute.PUT("/", controller.UpdateVendorMeta)
|
|
vendorRoute.DELETE("/:id", controller.DeleteVendorMeta)
|
|
}
|
|
|
|
modelsRoute := apiRouter.Group("/models")
|
|
modelsRoute.Use(middleware.AdminAuth())
|
|
{
|
|
modelsRoute.GET("/sync_upstream/preview", controller.SyncUpstreamPreview)
|
|
modelsRoute.POST("/sync_upstream", controller.SyncUpstreamModels)
|
|
modelsRoute.GET("/missing", controller.GetMissingModels)
|
|
modelsRoute.GET("/", controller.GetAllModelsMeta)
|
|
modelsRoute.GET("/search", controller.SearchModelsMeta)
|
|
modelsRoute.GET("/:id", controller.GetModelMeta)
|
|
modelsRoute.POST("/", controller.CreateModelMeta)
|
|
modelsRoute.PUT("/", controller.UpdateModelMeta)
|
|
modelsRoute.DELETE("/:id", controller.DeleteModelMeta)
|
|
}
|
|
|
|
// Deployments (model deployment management)
|
|
deploymentsRoute := apiRouter.Group("/deployments")
|
|
deploymentsRoute.Use(middleware.AdminAuth())
|
|
{
|
|
deploymentsRoute.GET("/settings", controller.GetModelDeploymentSettings)
|
|
deploymentsRoute.POST("/settings/test-connection", controller.TestIoNetConnection)
|
|
deploymentsRoute.GET("/", controller.GetAllDeployments)
|
|
deploymentsRoute.GET("/search", controller.SearchDeployments)
|
|
deploymentsRoute.POST("/test-connection", controller.TestIoNetConnection)
|
|
deploymentsRoute.GET("/hardware-types", controller.GetHardwareTypes)
|
|
deploymentsRoute.GET("/locations", controller.GetLocations)
|
|
deploymentsRoute.GET("/available-replicas", controller.GetAvailableReplicas)
|
|
deploymentsRoute.POST("/price-estimation", controller.GetPriceEstimation)
|
|
deploymentsRoute.GET("/check-name", controller.CheckClusterNameAvailability)
|
|
deploymentsRoute.POST("/", controller.CreateDeployment)
|
|
|
|
deploymentsRoute.GET("/:id", controller.GetDeployment)
|
|
deploymentsRoute.GET("/:id/logs", controller.GetDeploymentLogs)
|
|
deploymentsRoute.GET("/:id/containers", controller.ListDeploymentContainers)
|
|
deploymentsRoute.GET("/:id/containers/:container_id", controller.GetContainerDetails)
|
|
deploymentsRoute.PUT("/:id", controller.UpdateDeployment)
|
|
deploymentsRoute.PUT("/:id/name", controller.UpdateDeploymentName)
|
|
deploymentsRoute.POST("/:id/extend", controller.ExtendDeployment)
|
|
deploymentsRoute.DELETE("/:id", controller.DeleteDeployment)
|
|
}
|
|
|
|
// Agent user approval gates and short-lived credential leases.
|
|
agentApprovalRoute := apiRouter.Group("/agent")
|
|
agentApprovalRoute.Use(middleware.UserOrV2DeviceAuth())
|
|
{
|
|
agentApprovalRoute.GET("/approvals", controller.ListAgentApprovalRequests)
|
|
agentApprovalRoute.POST("/approvals", controller.CreateAgentApprovalRequest)
|
|
agentApprovalRoute.GET("/approvals/:approval_id", controller.GetAgentApprovalRequest)
|
|
agentApprovalRoute.POST("/approvals/:approval_id/approve", controller.ApproveAgentApprovalRequest)
|
|
agentApprovalRoute.POST("/approvals/:approval_id/reject", controller.RejectAgentApprovalRequest)
|
|
agentApprovalRoute.GET("/credential-leases", controller.ListAgentCredentialLeases)
|
|
agentApprovalRoute.POST("/credential-leases/:lease_id/revoke", controller.RevokeAgentCredentialLease)
|
|
agentApprovalRoute.GET("/role-templates", controller.AgentListRoleTemplates)
|
|
agentApprovalRoute.GET("/user/deployments", controller.AgentListUserDeployments)
|
|
agentApprovalRoute.POST("/user/deployments", controller.AgentCreateUserDeployment)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id", controller.AgentGetUserDeployment)
|
|
agentApprovalRoute.POST("/user/deployments/:deployment_id/stop", controller.AgentStopUserDeployment)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/logs", controller.AgentListUserDeploymentLogs)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/metrics", controller.AgentGetUserDeploymentMetrics)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/runtime-diagnostics", controller.AgentGetUserDeploymentRuntimeDiagnostics)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/events", controller.AgentListUserDeploymentEvents)
|
|
agentApprovalRoute.POST("/user/deployments/:deployment_id/simulate-events", controller.AgentSimulateUserDeploymentEvents)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/artifacts", controller.AgentListUserDeploymentArtifacts)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/artifacts/:artifact_id/content", controller.AgentGetUserDeploymentArtifactContent)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/sk-snapshots", controller.AgentListUserSKSnapshots)
|
|
agentApprovalRoute.GET("/user/deployments/:deployment_id/timeline", controller.AgentGetUserDeploymentTimeline)
|
|
agentApprovalRoute.POST("/user/tasks/:task_id/deployment-draft", controller.AgentCreateTaskDeploymentDraft)
|
|
}
|
|
|
|
// Template-agent model (new): deploy a template agent with bound resources
|
|
// injected as env; client reads the agent list and connects to the agent's
|
|
// subdomain directly. Same V2-device / session auth as the task routes.
|
|
heicodeAgentRoute := apiRouter.Group("/heicode")
|
|
heicodeAgentRoute.Use(middleware.UserOrV2DeviceAuth())
|
|
{
|
|
heicodeAgentRoute.GET("/agent-templates", controller.HeicodeListAgentTemplates)
|
|
heicodeAgentRoute.GET("/available-models", controller.HeicodeAvailableModels)
|
|
// Preflight / execution-summary (#39 缺失项检测 + #40 可读摘要).
|
|
heicodeAgentRoute.GET("/preflight", controller.HeicodePreflight)
|
|
heicodeAgentRoute.POST("/agents", controller.HeicodeDeployAgent)
|
|
heicodeAgentRoute.GET("/agents", controller.HeicodeListAgents)
|
|
heicodeAgentRoute.GET("/agents/:deployment_id", controller.HeicodeGetAgent)
|
|
heicodeAgentRoute.GET("/agents/:deployment_id/status", controller.HeicodeGetAgentStatus)
|
|
heicodeAgentRoute.GET("/agents/:deployment_id/usage", controller.HeicodeGetAgentUsage)
|
|
heicodeAgentRoute.POST("/agents/:deployment_id/stop", controller.HeicodeStopAgent)
|
|
heicodeAgentRoute.DELETE("/agents/:deployment_id", controller.HeicodeDeleteAgent)
|
|
// Client error-telemetry ingest (#24). Device-paired; never bills.
|
|
// Gated by HEICODE_TELEMETRY_ENABLED (default off -> 410 kill switch).
|
|
heicodeAgentRoute.POST("/telemetry/events", controller.HeicodeTelemetryEvents)
|
|
}
|
|
|
|
// Client↔agent access control (HM-provided, AM-optional). Called by the
|
|
// agent server-side to confirm the caller's per-agent access_token belongs
|
|
// to this agent's owner, so only that user can drive it. Public on purpose
|
|
// (the agent has no HM user session); it leaks nothing on a token miss and
|
|
// the token itself is the bearer secret. Constant-time compared.
|
|
apiRouter.POST("/heicode/agent-access/verify", controller.HeicodeVerifyAgentAccess)
|
|
|
|
// Agent template library (admin-maintained agent .md definitions; the
|
|
// client list is served by the heicode group above, Chinese display).
|
|
agentTemplateAdminRoute := apiRouter.Group("/agent-templates")
|
|
agentTemplateAdminRoute.Use(middleware.AdminAuth())
|
|
{
|
|
agentTemplateAdminRoute.GET("/", controller.AdminListAgentTemplates)
|
|
agentTemplateAdminRoute.POST("/", controller.AdminCreateAgentTemplate)
|
|
agentTemplateAdminRoute.PUT("/:id", controller.AdminUpdateAgentTemplate)
|
|
agentTemplateAdminRoute.DELETE("/:id", controller.AdminDeleteAgentTemplate)
|
|
}
|
|
|
|
// Agent orchestration control plane (minimal integration endpoints)
|
|
agentRoute := apiRouter.Group("/agent")
|
|
agentRoute.Use(middleware.AdminAuth())
|
|
{
|
|
agentRoute.GET("/deployments", controller.AgentListDeployments)
|
|
agentRoute.POST("/deployments", controller.AgentCreateDeployment)
|
|
agentRoute.GET("/deployments/:deployment_id", controller.AgentGetDeployment)
|
|
agentRoute.POST("/deployments/:deployment_id/stop", controller.AgentStopDeployment)
|
|
agentRoute.GET("/deployments/:deployment_id/logs", controller.AgentListDeploymentLogs)
|
|
agentRoute.GET("/deployments/:deployment_id/metrics", controller.AgentGetDeploymentMetrics)
|
|
agentRoute.GET("/deployments/:deployment_id/events", controller.AgentListDeploymentEvents)
|
|
agentRoute.GET("/deployments/:deployment_id/sk-snapshots", controller.AgentListSKSnapshots)
|
|
agentRoute.POST("/sk-snapshots/resolve", controller.AgentResolveSKSnapshots)
|
|
agentRoute.GET("/runtime/health", controller.AgentRuntimeHealth)
|
|
agentRoute.GET("/projects/:project_id/dashboard-snapshot", controller.AgentProjectDashboardSnapshot)
|
|
agentRoute.GET("/audit-logs", controller.AgentListAuditLogs)
|
|
}
|
|
}
|
|
}
|