Support allowed IPs in admin user key endpoints

apps/aether-gateway/src/handlers/admin/users/api_keys/helpers.rs

@@ -44,6 +44,7 @@ pub(super) fn build_admin_user_api_key_detail_payload(
         "total_cost_usd": record.total_cost_usd,
         "rate_limit": record.rate_limit,
         "concurrent_limit": record.concurrent_limit,
+        "allowed_ips": record.allowed_ips,
         "feature_settings": record.feature_settings,
         "expires_at": format_optional_unix_secs_iso8601(record.expires_at_unix_secs),
         "last_used_at": format_optional_unix_secs_iso8601(record.last_used_at_unix_secs),

apps/aether-gateway/src/handlers/admin/users/api_keys/responses/create.rs

@@ -1,7 +1,7 @@
 use super::super::super::{
     build_admin_users_bad_request_response, build_admin_users_data_unavailable_response,
     build_admin_users_read_only_response, normalize_admin_feature_settings,
-    AdminCreateUserApiKeyRequest,
+    normalize_admin_user_allowed_ips, AdminCreateUserApiKeyRequest,
 };
 use super::super::helpers::{
     attach_audit_response, default_admin_user_api_key_name, format_optional_unix_secs_iso8601,
@@ -71,7 +71,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
     {
         return Ok((
             http::StatusCode::BAD_REQUEST,
-            Json(json!({ "detail": "当前仅支持 name、rate_limit、concurrent_limit、allowed_providers 字段" })),
+            Json(json!({ "detail": "当前仅支持 name、rate_limit、concurrent_limit、allowed_providers、allowed_ips 字段" })),
         )
             .into_response());
     }
@@ -107,6 +107,16 @@ pub(crate) async fn build_admin_create_user_api_key_response(
                 .into_response());
         }
     };
+    let allowed_ips = match normalize_admin_user_allowed_ips(payload.allowed_ips) {
+        Ok(value) => value,
+        Err(detail) => {
+            return Ok((
+                http::StatusCode::BAD_REQUEST,
+                Json(json!({ "detail": detail })),
+            )
+                .into_response());
+        }
+    };
     let rate_limit = payload.rate_limit.unwrap_or(0);
     if rate_limit < 0 {
         return Ok((
@@ -146,6 +156,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
             allowed_providers: None,
             allowed_api_formats: None,
             allowed_models: None,
+            allowed_ips,
             rate_limit,
             concurrent_limit,
             force_capabilities: None,
@@ -196,6 +207,7 @@ pub(crate) async fn build_admin_create_user_api_key_response(
             "key_display": masked_user_api_key_display(state, created.key_encrypted.as_deref()),
             "rate_limit": created.rate_limit,
             "concurrent_limit": created.concurrent_limit,
+            "allowed_ips": created.allowed_ips,
             "expires_at": format_optional_unix_secs_iso8601(created.expires_at_unix_secs),
             "last_used_at": format_optional_unix_secs_iso8601(created.last_used_at_unix_secs),
             "created_at": format_optional_unix_secs_iso8601(created.created_at_unix_secs),

apps/aether-gateway/src/handlers/admin/users/api_keys/responses/update.rs

@@ -1,6 +1,6 @@
 use super::super::super::{
     build_admin_users_bad_request_response, build_admin_users_read_only_response,
-    normalize_admin_feature_settings, AdminUpdateUserApiKeyRequest,
+    normalize_admin_feature_settings, normalize_admin_user_allowed_ips, AdminUpdateUserApiKeyRequest,
 };
 use super::super::helpers::{
     attach_audit_response, build_admin_user_api_key_detail_payload,
@@ -94,6 +94,19 @@ pub(crate) async fn build_admin_update_user_api_key_response(
                     .into_response());
             }
         };
+    let allowed_ips = match payload.allowed_ips {
+        Some(value) => match normalize_admin_user_allowed_ips(value) {
+            Ok(value) => Some(value),
+            Err(detail) => {
+                return Ok((
+                    http::StatusCode::BAD_REQUEST,
+                    Json(json!({ "detail": detail })),
+                )
+                    .into_response());
+            }
+        },
+        None => None,
+    };
 
     let Some(updated) = state
         .update_user_api_key_basic(aether_data::repository::auth::UpdateUserApiKeyBasicRecord {
@@ -102,6 +115,7 @@ pub(crate) async fn build_admin_update_user_api_key_response(
             name,
             rate_limit: payload.rate_limit,
             concurrent_limit,
+            allowed_ips,
         })
         .await?
     else {

apps/aether-gateway/src/handlers/admin/users/mod.rs

@@ -56,7 +56,7 @@ use self::shared::{
 };
 pub(crate) use self::shared::{
     normalize_admin_list_policy_mode, normalize_admin_rate_limit_policy_mode,
-    normalize_admin_user_api_formats, normalize_admin_user_string_list,
+    normalize_admin_user_allowed_ips, normalize_admin_user_api_formats, normalize_admin_user_string_list,
 };
 pub(crate) use crate::handlers::shared::normalize_feature_settings as normalize_admin_feature_settings;
 

apps/aether-gateway/src/handlers/admin/users/shared.rs

@@ -20,6 +20,8 @@ pub(super) struct AdminCreateUserApiKeyRequest {
     #[serde(default)]
     pub(super) allowed_models: Option<Vec<String>>,
     #[serde(default)]
+    pub(super) allowed_ips: Option<Vec<String>>,
+    #[serde(default)]
     pub(super) rate_limit: Option<i32>,
     #[serde(default)]
     pub(super) concurrent_limit: Option<i32>,
@@ -49,6 +51,8 @@ pub(super) struct AdminUpdateUserApiKeyRequest {
     pub(super) concurrent_limit: Option<i32>,
     #[serde(default)]
     pub(super) feature_settings: Option<Option<Value>>,
+    #[serde(default)]
+    pub(super) allowed_ips: Option<Option<Vec<String>>>,
 }
 
 #[derive(Debug, serde::Deserialize)]
@@ -280,6 +284,52 @@ pub(crate) fn normalize_admin_user_api_formats(
     Ok(Some(normalized))
 }
 
+pub(crate) fn normalize_admin_user_allowed_ips(
+    value: Option<Vec<String>>,
+) -> Result<Option<Vec<String>>, String> {
+    let Some(values) = value else {
+        return Ok(None);
+    };
+    if values.is_empty() {
+        return Err("IP 白名单不能为空列表，如需取消限制请不提供此字段".to_string());
+    }
+    let mut normalized = Vec::with_capacity(values.len());
+    for (index, raw) in values.into_iter().enumerate() {
+        let trimmed = raw.trim();
+        if trimmed.is_empty() {
+            return Err(format!("IP 白名单第 {} 项为空", index + 1));
+        }
+        if !validate_admin_user_ip_or_cidr(trimmed) {
+            return Err(format!("无效的 IP 地址或 CIDR: {raw}"));
+        }
+        normalized.push(trimmed.to_string());
+    }
+    Ok(Some(normalized))
+}
+
+fn validate_admin_user_ip_or_cidr(value: &str) -> bool {
+    let value = value.trim();
+    if value.is_empty() {
+        return false;
+    }
+    if value.parse::<std::net::IpAddr>().is_ok() {
+        return true;
+    }
+    let Some((host, prefix)) = value.split_once('/') else {
+        return false;
+    };
+    let Ok(ip) = host.trim().parse::<std::net::IpAddr>() else {
+        return false;
+    };
+    let Ok(prefix) = prefix.trim().parse::<u8>() else {
+        return false;
+    };
+    match ip {
+        std::net::IpAddr::V4(_) => prefix <= 32,
+        std::net::IpAddr::V6(_) => prefix <= 128,
+    }
+}
+
 pub(crate) fn normalize_admin_list_policy_mode(value: &str) -> Result<String, String> {
     match value.trim().to_ascii_lowercase().as_str() {
         "inherit" | "unrestricted" | "specific" | "deny_all" => {