feat: 统一 SSL 证书配置并支持用户创建时设置访问权限

- 新增 ssl_utils.py 模块，统一使用 certifi 证书
- 将所有 httpx 客户端的 verify 参数改为使用 get_ssl_context()
- 管理员创建用户时支持设置 allowed_providers/api_formats/models
- 修复 provider_ops 敏感字段列表缺失 session_cookie

src/services/provider_ops/architectures/anyrouter.py

@@ -11,6 +11,7 @@ from typing import Any, Dict, List, Optional, Tuple, Type
 import httpx
 
 from src.core.logger import logger
+from src.utils.ssl_utils import get_ssl_context
 from src.services.provider_ops.actions import AnyrouterBalanceAction, ProviderAction
 from src.services.provider_ops.architectures.base import (
     ProviderArchitecture,
@@ -193,7 +194,7 @@ async def _get_acw_cookie(base_url: str, timeout: float = 10) -> Optional[str]:
         Cookie 字符串 (acw_sc__v2=xxx)，如果不需要或获取失败则返回 None
     """
     try:
-        async with httpx.AsyncClient(timeout=timeout) as client:
+        async with httpx.AsyncClient(timeout=timeout, verify=get_ssl_context()) as client:
             resp = await client.get(
                 base_url,
                 headers={

src/services/provider_ops/architectures/base.py

@@ -11,6 +11,7 @@ from typing import Any, AsyncIterator, Dict, List, Optional, Type
 import httpx
 
 from src.services.provider_ops.actions.base import ProviderAction
+from src.utils.ssl_utils import get_ssl_context
 from src.services.provider_ops.types import (
     ConnectorAuthType,
     ConnectorState,
@@ -125,6 +126,7 @@ class ProviderConnector(ABC):
             timeout=self._timeout,
             transport=transport,
             event_hooks={"request": [self._auth_hook]},
+            verify=get_ssl_context(),
         ) as client:
             yield client
 

src/services/provider_ops/architectures/yescode.py

@@ -20,6 +20,7 @@ from src.services.provider_ops.architectures.base import (
     VerifyResult,
 )
 from src.services.provider_ops.types import ConnectorAuthType, ProviderActionType
+from src.utils.ssl_utils import get_ssl_context
 
 
 def _extract_cookies(cookie_string: str) -> Dict[str, str]:
@@ -197,6 +198,7 @@ class YesCodeArchitecture(ProviderArchitecture):
             async with httpx.AsyncClient(
                 headers={"Cookie": cookie_header},
                 timeout=10.0,
+                verify=get_ssl_context(),
             ) as client:
                 combined_data = await fetch_yescode_combined_data(client, base_url)
                 extra_config["_combined_data"] = combined_data

src/services/provider_ops/service.py

@@ -617,7 +617,7 @@ class ProviderOpsService:
             saved_credentials = self._decrypt_credentials(saved_config.connector_credentials)
             sensitive_fields = [
                 "api_key", "password", "session_token", "cookie_string", "cookies",
-                "token_cookie", "auth_cookie",  # Cookie 认证字段
+                "token_cookie", "auth_cookie", "session_cookie",  # Cookie 认证字段
             ]
 
             for field in sensitive_fields:
@@ -704,6 +704,8 @@ class ProviderOpsService:
         """
         import httpx
 
+        from src.utils.ssl_utils import get_ssl_context
+
         # 移除 base_url 末尾的斜杠
         base_url = base_url.rstrip("/")
 
@@ -726,9 +728,14 @@ class ProviderOpsService:
         )
 
         try:
-            async with httpx.AsyncClient(timeout=30.0) as client:
+            async with httpx.AsyncClient(timeout=30.0, verify=get_ssl_context()) as client:
                 response = await client.get(verify_endpoint, headers=headers)
 
+                logger.debug(
+                    f"验证响应: status={response.status_code}, "
+                    f"content_type={response.headers.get('content-type')}"
+                )
+
                 # 尝试解析 JSON
                 try:
                     data = response.json()