Merge pull request #432 from RWDai/fix/cli-install-copy

Add admin API key CLI install sessions

apps/aether-gateway/src/handlers/admin/auth/api_keys/install_routes.rs

@@ -0,0 +1,87 @@
+use super::shared::{
+    admin_api_key_install_session_id_from_path, build_admin_api_keys_bad_request_response,
+    build_admin_api_keys_data_unavailable_response, build_admin_api_keys_not_found_response,
+};
+use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
+use crate::handlers::admin::shared::attach_admin_audit_response;
+use crate::handlers::public::{
+    build_api_key_install_session_response, CreateApiKeyInstallSessionRequest,
+};
+use crate::GatewayError;
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+};
+
+pub(super) async fn build_admin_create_api_key_install_session_response(
+    state: &AdminAppState<'_>,
+    request_context: &AdminRequestContext<'_>,
+    request_headers: &http::HeaderMap,
+    request_body: Option<&axum::body::Bytes>,
+) -> Result<Response<Body>, GatewayError> {
+    if !state.has_auth_api_key_data_reader() {
+        return Ok(build_admin_api_keys_data_unavailable_response());
+    }
+
+    let Some(api_key_id) = admin_api_key_install_session_id_from_path(request_context.path())
+    else {
+        return Ok(build_admin_api_keys_data_unavailable_response());
+    };
+    let Some(request_body) = request_body else {
+        return Ok(build_admin_api_keys_bad_request_response(
+            "请求数据验证失败",
+        ));
+    };
+    let payload = match serde_json::from_slice::<CreateApiKeyInstallSessionRequest>(request_body) {
+        Ok(value) => value,
+        Err(_) => {
+            return Ok(build_admin_api_keys_bad_request_response(
+                "请求数据验证失败",
+            ))
+        }
+    };
+
+    let Some(record) = state
+        .find_auth_api_key_export_standalone_record_by_id(&api_key_id)
+        .await?
+    else {
+        return Ok(build_admin_api_keys_not_found_response());
+    };
+    let Some(ciphertext) = record
+        .key_encrypted
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+    else {
+        return Ok(build_admin_api_keys_bad_request_response(
+            "该密钥没有存储完整密钥信息",
+        ));
+    };
+    let Some(api_key) = state.decrypt_catalog_secret_with_fallbacks(ciphertext) else {
+        return Ok((
+            http::StatusCode::INTERNAL_SERVER_ERROR,
+            axum::Json(serde_json::json!({ "detail": "解密密钥失败" })),
+        )
+            .into_response());
+    };
+
+    let response = build_api_key_install_session_response(
+        state.app(),
+        request_context.public(),
+        request_headers,
+        record.api_key_id.clone(),
+        record.name.unwrap_or_else(|| "API Key".to_string()),
+        api_key,
+        payload,
+    )
+    .await;
+
+    Ok(attach_admin_audit_response(
+        response,
+        "admin_standalone_api_key_install_session_created",
+        "create_standalone_api_key_install_session",
+        "api_key",
+        &api_key_id,
+    ))
+}

apps/aether-gateway/src/handlers/admin/auth/api_keys/mod.rs

@@ -18,11 +18,13 @@ use axum::{
 };
 use serde_json::json;
 
+mod install_routes;
 mod mutation_routes;
 mod read_routes;
 mod routes;
 mod shared;
 
+use self::install_routes::build_admin_create_api_key_install_session_response;
 use self::mutation_routes::{
     build_admin_create_api_key_response, build_admin_delete_api_key_response,
     build_admin_toggle_api_key_response, build_admin_update_api_key_response,
@@ -39,8 +41,14 @@ use self::shared::{
 pub(crate) async fn maybe_build_local_admin_api_keys_response(
     state: &AdminAppState<'_>,
     request_context: &AdminRequestContext<'_>,
+    request_headers: &http::HeaderMap,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
-    routes::maybe_build_local_admin_api_keys_routes_response(state, request_context, request_body)
-        .await
+    routes::maybe_build_local_admin_api_keys_routes_response(
+        state,
+        request_context,
+        request_headers,
+        request_body,
+    )
+    .await
 }

apps/aether-gateway/src/handlers/admin/auth/api_keys/routes.rs

@@ -1,3 +1,4 @@
+use super::install_routes::build_admin_create_api_key_install_session_response;
 use super::mutation_routes::{
     build_admin_create_api_key_response, build_admin_delete_api_key_response,
     build_admin_toggle_api_key_response, build_admin_update_api_key_response,
@@ -11,6 +12,7 @@ use axum::{body::Body, http, response::Response};
 pub(super) async fn maybe_build_local_admin_api_keys_routes_response(
     state: &AdminAppState<'_>,
     request_context: &AdminRequestContext<'_>,
+    request_headers: &http::HeaderMap,
     request_body: Option<&axum::body::Bytes>,
 ) -> Result<Option<Response<Body>>, GatewayError> {
     let Some(decision) = request_context.decision() else {
@@ -22,8 +24,10 @@ pub(super) async fn maybe_build_local_admin_api_keys_routes_response(
     }
 
     let path = request_context.path();
+    let path_no_trailing = path.trim_end_matches('/');
     let is_api_keys_route = matches!(path, "/api/admin/api-keys" | "/api/admin/api-keys/")
-        || (path.starts_with("/api/admin/api-keys/") && path.matches('/').count() == 4);
+        || (path_no_trailing.starts_with("/api/admin/api-keys/")
+            && matches!(path_no_trailing.matches('/').count(), 4 | 5));
 
     if !is_api_keys_route {
         return Ok(None);
@@ -54,6 +58,21 @@ pub(super) async fn maybe_build_local_admin_api_keys_routes_response(
                 build_admin_create_api_key_response(state, request_context, request_body).await?,
             ))
         }
+        Some("create_api_key_install_session")
+            if request_context.method() == http::Method::POST
+                && path_no_trailing.starts_with("/api/admin/api-keys/")
+                && path_no_trailing.ends_with("/install-sessions") =>
+        {
+            Ok(Some(
+                build_admin_create_api_key_install_session_response(
+                    state,
+                    request_context,
+                    request_headers,
+                    request_body,
+                )
+                .await?,
+            ))
+        }
         Some("update_api_key")
             if request_context.method() == http::Method::PUT
                 && path.starts_with("/api/admin/api-keys/") =>

apps/aether-gateway/src/handlers/admin/auth/api_keys/shared.rs

@@ -91,6 +91,17 @@ pub(super) fn admin_api_keys_id_from_path(request_path: &str) -> Option<String>
     }
 }
 
+pub(super) fn admin_api_key_install_session_id_from_path(request_path: &str) -> Option<String> {
+    let raw = request_path
+        .strip_prefix("/api/admin/api-keys/")?
+        .trim()
+        .trim_matches('/');
+    let mut segments = raw.split('/').map(str::trim);
+    let api_key_id = segments.next()?.to_string();
+    let suffix = segments.next()?;
+    (suffix == "install-sessions" && segments.next().is_none()).then_some(api_key_id)
+}
+
 pub(super) fn admin_api_keys_operator_id(
     request_context: &AdminRequestContext<'_>,
 ) -> Option<String> {

apps/aether-gateway/src/handlers/admin/auth/routes.rs

@@ -17,6 +17,7 @@ pub(crate) async fn maybe_build_local_admin_auth_response(
     if let Some(response) = api_keys::maybe_build_local_admin_api_keys_response(
         &request.state(),
         &request.request_context(),
+        request.request_headers(),
         request.request_body(),
     )
     .await?

apps/aether-gateway/src/handlers/admin/request/route_request.rs

@@ -1,7 +1,7 @@
 use super::{AdminAppState, AdminRequestContext};
 use crate::{AppState, GatewayError};
 use axum::body::{Body, Bytes};
-use axum::http::Response;
+use axum::http::{HeaderMap, Response};
 
 pub(crate) enum AdminCancelVideoTaskError {
     NotFound,
@@ -14,6 +14,7 @@ pub(crate) enum AdminCancelVideoTaskError {
 pub(crate) struct AdminRouteRequest<'a> {
     state: AdminAppState<'a>,
     request_context: AdminRequestContext<'a>,
+    request_headers: &'a HeaderMap,
     request_body: Option<&'a Bytes>,
 }
 
@@ -21,11 +22,13 @@ impl<'a> AdminRouteRequest<'a> {
     pub(crate) fn new(
         state: &'a AppState,
         request_context: &'a crate::control::GatewayPublicRequestContext,
+        request_headers: &'a HeaderMap,
         request_body: Option<&'a Bytes>,
     ) -> Self {
         Self {
             state: AdminAppState::new(state),
             request_context: AdminRequestContext::new(request_context),
+            request_headers,
             request_body,
         }
     }
@@ -38,6 +41,10 @@ impl<'a> AdminRouteRequest<'a> {
         self.request_context
     }
 
+    pub(crate) fn request_headers(self) -> &'a HeaderMap {
+        self.request_headers
+    }
+
     pub(crate) fn request_body(self) -> Option<&'a Bytes> {
         self.request_body
     }