mirror of
https://github.com/fawney19/Aether.git
synced 2026-09-02 09:20:22 +08:00
1d9c77522a
- 删除全部 Python 源码 (src/) 及 Alembic 迁移脚本，归档至 _deprecated_py_src/ - 重构 Rust gateway ai_pipeline: 拆分 planner/finalize 模块，新增 contracts/adaptation 层 - 重组 handlers 模块为 admin/public/proxy/internal/shared 子模块结构 - 新增 executor 模块，引入 Rust 原生数据库迁移 (aether-data/migrations) - 简化 CI/Docker 构建流程，移除 base image 二级构建，统一为单一 app image - 移除 Python 相关基础设施文件 (entrypoint.sh, gunicorn_conf.py, Dockerfile.base)
100 lines
3.2 KiB
Python
100 lines
3.2 KiB
Python
"""
|
|
API Key认证插件
|
|
支持从header中提取API Key进行认证
|
|
"""
|
|
|
|
from __future__ import annotations
|
|
|
|
from fastapi import Request
|
|
from sqlalchemy.orm import Session
|
|
|
|
from src.core.logger import logger
|
|
from src.services.auth.service import AuthService
|
|
from src.services.usage.service import UsageService
|
|
from src.services.wallet import WalletService
|
|
|
|
from .base import AuthContext, AuthPlugin
|
|
|
|
|
|
class ApiKeyAuthPlugin(AuthPlugin):
|
|
"""
|
|
API Key认证插件
|
|
支持从x-api-key header或Authorization Bearer token中提取API Key
|
|
"""
|
|
|
|
def __init__(self) -> None:
|
|
super().__init__(name="api_key", priority=10)
|
|
|
|
def get_credentials(self, request: Request) -> str | None:
|
|
"""
|
|
从请求头中提取API Key
|
|
|
|
支持两种方式：
|
|
1. x-api-key: <key>
|
|
2. Authorization: Bearer <key>
|
|
"""
|
|
# 尝试从x-api-key header获取
|
|
api_key = request.headers.get("x-api-key")
|
|
if api_key:
|
|
return api_key
|
|
|
|
# 尝试从Authorization header获取
|
|
auth_header = request.headers.get("authorization")
|
|
if auth_header and auth_header.startswith("Bearer "):
|
|
return auth_header.replace("Bearer ", "")
|
|
|
|
return None
|
|
|
|
async def authenticate(self, request: Request, db: Session) -> AuthContext | None:
|
|
"""
|
|
使用API Key进行认证
|
|
"""
|
|
# 提取API Key
|
|
api_key = self.get_credentials(request)
|
|
if not api_key:
|
|
logger.debug("未找到API Key凭据")
|
|
return None
|
|
|
|
# 认证API Key
|
|
auth_result = AuthService.authenticate_api_key(db, api_key)
|
|
if not auth_result:
|
|
logger.warning("API Key认证失败")
|
|
return None
|
|
|
|
user, api_key_obj = auth_result
|
|
|
|
# 检查用户或独立 Key 的钱包余额可用性
|
|
access_ok, message = UsageService.check_request_balance(db, user, api_key=api_key_obj)
|
|
billing_wallet = (
|
|
WalletService.get_wallet(db, api_key_id=api_key_obj.id)
|
|
if api_key_obj.is_standalone
|
|
else WalletService.get_wallet(db, user_id=user.id)
|
|
)
|
|
|
|
# 创建认证上下文
|
|
auth_context = AuthContext(
|
|
user_id=user.id,
|
|
user_name=user.username,
|
|
api_key_id=api_key_obj.id,
|
|
api_key_name=api_key_obj.name if hasattr(api_key_obj, "name") else None,
|
|
permissions={
|
|
"can_use_api": access_ok,
|
|
"is_admin": user.is_admin if hasattr(user, "is_admin") else False,
|
|
"is_standalone_key": api_key_obj.is_standalone, # 标记是否为独立余额Key
|
|
},
|
|
billing_info={
|
|
"billing": WalletService.serialize_wallet_summary(billing_wallet),
|
|
"balance_ok": access_ok,
|
|
"message": message,
|
|
},
|
|
metadata={
|
|
"auth_method": "api_key",
|
|
"client_ip": request.client.host if request.client else "unknown",
|
|
"is_standalone": api_key_obj.is_standalone, # 在metadata中也保存一份
|
|
},
|
|
)
|
|
|
|
logger.info("API Key认证成功")
|
|
|
|
return auth_context
|