feat: add file-based admin settings panel at /admin (#866)

* feat: add file-based admin settings panel at /admin Settings saved in the panel are written to data/settings.json and overlaid onto process.env, taking precedence over environment variables and applying immediately without restart. Enable by setting ADMIN_PASSWORD; on serverless platforms without persistent disk the panel degrades to read-only. * polish: admin panel UI improvements - Provider logos in credential rows (shared ProviderLogo component, extracted from model-config-dialog) - Scroll-spy active state in the sidebar nav - Green success state in the save bar that clears after a few seconds - Wider content column (max-w-6xl) for less wasted space on desktop * polish: admin panel section toggles and reorder - Move Quota & Rate Limits to the end of the settings page - Add enable switches to Observability and Quota sections; default off with fields grayed out, auto-on when any field is already configured * polish: make section enable switch more visible Wrap the switch in a labeled pill ('Enabled'/'Disabled') with border and background so the off state is clearly visible. * refactor: derive admin registry from PROVIDER_INFO, simplify page state - Provider options, labels, and base-URL placeholders now come from PROVIDER_INFO instead of hand-copied lists (fixes SiliconFlow .com/.cn placeholder drift; panel names now match the model-config dialog) - Replace free-text subgroup strings + SUBGROUP_PROVIDERS reverse map with a typed provider field on SettingDef - Precompute SETTINGS_BY_GROUP and PROVIDER_SUBGROUPS at module level - Merge justSaved into saveMessage, drop unused mainRef, hoist fetchSettings out of the component, dedupe savedText logic - Serialize from SETTINGS_REGISTRY directly; json validators in a map instead of a hardcoded key check - Make allowPrivateUrls a function so ALLOW_PRIVATE_URLS edits in the admin panel apply without restart * feat: graphical model management in admin panel Replace the provider credential fields and raw AI_MODELS_CONFIG JSON textarea with a Models section mirroring the in-app model settings UI: provider instance list with logos, credential fields per provider type, model add/remove with suggestions, per-model connectivity test, and a default-provider star. On save the server derives everything the runtime needs into settings.json: credential env vars (with _2 suffixes for multiple instances of one provider), AI_MODELS_CONFIG, and AI_PROVIDER/AI_MODEL for the default. Secrets round-trip as masked markers and are never sent back to the browser. The general settings registry now only covers non-provider settings (generation, access, features, observability, quota). * fix: allow testing unsaved providers in admin panel The test button previously looked up credentials by providerId in the saved settings, so testing a newly added (unsaved) provider failed with 'Unknown provider or model'. The test endpoint now accepts the client's current provider state; newly typed secrets are used as-is and masked markers are resolved against the stored values, so testing works both before and after saving. * fix: merge env AI_MODELS_CONFIG with admin panel providers Previously, saving in the admin panel wrote a complete AI_MODELS_CONFIG into settings.json, which (by overlay precedence) replaced any config from .env or ai-models.json — admins lost their env-configured models. The panel no longer writes AI_MODELS_CONFIG. Instead its providers are merged with the env baseline at read time in loadRawServerModelsConfig, and panel credentials go to ADMIN_-prefixed env vars wired up via apiKeyEnv/baseUrlEnv so they never shadow standard vars. Env-based providers now appear read-only in the panel, name clashes are rejected, and a panel default overrides the env default. data/ is now gitignored. * fix: block global-credential providers already managed via env Bedrock, Vertex AI, and Ollama credentials live in fixed env vars with no apiKeyEnv redirection, so a panel instance of one of these would silently override the credentials that env-configured models rely on. The API now rejects saving such a provider when the env config already uses that type, and the Add Provider dropdown disables it with a 'managed via env' note. * fix: address admin panel review findings - Security: test-model no longer resolves a stored secret when the request's baseUrl/provider differs from the stored entry, closing a path where a tampered baseUrl could exfiltrate a saved key - Save failures are now visible: the save bar shows the error in red (was masked by the persistent 'Unsaved changes' text), and per-field validation errors from the settings API are surfaced under each field - The Observability/Quota enable switch is now real: toggling off stages deletion of the group's saved values, and the toggle no longer snaps back to Enabled after saving - Env provider's default star is hidden when a panel provider is the active default (no more double star) - Clearing a credential field reverts to the stored value instead of silently deleting it; an explicit X button removes a stored secret - Form inputs are disabled during an in-flight save * refactor(admin): split 1549-line admin page into focused modules Extract admin-shared.ts (types + fetch helper), setting-field.tsx (registry-driven fields), and models-section.tsx (provider/model manager) from page.tsx. Pure mechanical move, no behavior change. * feat(admin): share credential fields with user dialog and localize panel Extract ProviderCredentialsFields (display name + per-provider credential inputs) used by both the user ModelConfigDialog and the admin Models panel; secret input passed via renderSecret (plaintext vs masked), test button via footer slot. Add full i18n for the admin panel across en/zh/ja/zh-Hant, reusing modelConfig.* for shared parts. * fix(admin): address Copilot review findings - Reflect built-in defaults for boolean settings (ALLOW_PRIVATE_URLS defaults on) and allow clearing a saved boolean back to default, so the SSRF toggle matches actual runtime behavior. - Harden JSON loading: filter settings values to strings only, and schema-validate stored ADMIN_PROVIDERS entries, dropping malformed ones instead of letting them reach runtime code. - Set beforeunload returnValue so the unsaved-changes prompt shows in all browsers; reject non-finite numbers in settings validation. - Fix README/CN/JA docs that claimed the panel auto-generates AI_MODELS_CONFIG (providers are merged at read time, not written). - Add unit tests for corrupted-file value filtering and provider schema validation. * docs: move admin panel details to dedicated docs/{en,cn,ja}/admin-panel.md The READMEs now carry a short blurb + link, matching the existing per-topic docs (docker.md, ai-providers.md, ...). Removes the ~22-line inline section and the duplicated data/settings.json mentions. * fix(admin): address follow-up Copilot findings on the prior fixes - loadAdminProviders now validates against a stored-shape schema where secrets are plain strings, so a hand-edited ADMIN_PROVIDERS holding an {isSet} marker is dropped instead of later crashing maskSecret(). - loadSettings guards against array values (typeof [] === 'object'), which would otherwise overlay numeric keys onto process.env. - Admin SecretInput uses the bare id so the shared component's <Label htmlFor> stays associated (only one ProviderDetail mounts). - Add tests: marker-secret rejection, array-values guard, bedrock multi-secret round-trip.
2026-09-02 01:20:23 +08:00 · 2026-06-15 00:40:35 +09:00
parent 54ff8d982c
commit 449e4c4e26
37 changed files with 4343 additions and 725 deletions
--- a/lib/admin/providers.ts
+++ b/lib/admin/providers.ts
@@ -0,0 +1,303 @@
+import { z } from "zod"
+import {
+    ProviderNameSchema,
+    type ServerModelsConfig,
+} from "@/lib/server-model-config"
+import {
+    FIXED_CRED_PROVIDERS,
+    PROVIDER_INFO,
+    type ProviderName,
+} from "@/lib/types/model-config"
+import { type MaskedSecret, maskSecret } from "./auth"
+import { loadSettings } from "./settings"
+
+// Admin-configured providers, mirroring the user ModelConfigDialog's data
+// model but stored server-side (settings.json, ADMIN_PROVIDERS key).
+//
+// They COEXIST with an env-based AI_MODELS_CONFIG / ai-models.json:
+// loadRawServerModelsConfig() merges the env baseline with the panel's
+// providers at read time, so .env stays authoritative for its own entries.
+// Panel credentials are written to ADMIN_-prefixed env vars (wired up via
+// apiKeyEnv/baseUrlEnv) so they never shadow standard vars like
+// OPENAI_API_KEY that env-based entries may rely on.
+
+export const ADMIN_PROVIDERS_KEY = "ADMIN_PROVIDERS"
+
+// A secret field in transit: plaintext string (new value) or an
+// {isSet} marker meaning "keep the stored value".
+const SecretInputSchema = z
+    .union([z.string(), z.object({ isSet: z.literal(true), hint: z.string() })])
+    .optional()
+
+export const AdminProviderSchema = z.object({
+    id: z.string().min(1),
+    provider: ProviderNameSchema,
+    name: z.string().optional(),
+    apiKey: SecretInputSchema,
+    baseUrl: z.string().optional(),
+    awsAccessKeyId: SecretInputSchema,
+    awsSecretAccessKey: SecretInputSchema,
+    awsRegion: z.string().optional(),
+    vertexApiKey: SecretInputSchema,
+    models: z.array(z.string().min(1)),
+    isDefault: z.boolean().optional(),
+})
+
+export const AdminProvidersSchema = z.array(AdminProviderSchema)
+
+// Stored shape: secrets are plain strings (never {isSet} markers, which
+// only exist in transit). Used to validate ADMIN_PROVIDERS on load so a
+// hand-edited/corrupted value can't slip a marker object past maskSecret.
+const StoredAdminProviderSchema = AdminProviderSchema.extend({
+    apiKey: z.string().optional(),
+    awsAccessKeyId: z.string().optional(),
+    awsSecretAccessKey: z.string().optional(),
+    vertexApiKey: z.string().optional(),
+})
+
+export type AdminProviderInput = z.infer<typeof AdminProviderSchema>
+
+// Stored form: secrets are plain strings
+export interface StoredAdminProvider {
+    id: string
+    provider: ProviderName
+    name?: string
+    apiKey?: string
+    baseUrl?: string
+    awsAccessKeyId?: string
+    awsSecretAccessKey?: string
+    awsRegion?: string
+    vertexApiKey?: string
+    models: string[]
+    isDefault?: boolean
+}
+
+const SECRET_FIELDS = [
+    "apiKey",
+    "awsAccessKeyId",
+    "awsSecretAccessKey",
+    "vertexApiKey",
+] as const
+
+// ADMIN_-prefixed env var names for instance `index` (0-based) of a provider
+function credEnvNames(
+    provider: ProviderName,
+    index: number,
+): { key?: string; url?: string } {
+    if (FIXED_CRED_PROVIDERS.includes(provider) || provider === "edgeone") {
+        return {}
+    }
+    const prefix =
+        provider === "gateway" ? "AI_GATEWAY" : provider.toUpperCase()
+    const suffix = index === 0 ? "" : `_${index + 1}`
+    return {
+        key: `ADMIN_${prefix}_API_KEY${suffix}`,
+        url: `ADMIN_${prefix}_BASE_URL${suffix}`,
+    }
+}
+
+export function loadAdminProviders(): StoredAdminProvider[] {
+    const raw = loadSettings()[ADMIN_PROVIDERS_KEY]
+    if (!raw) return []
+    try {
+        const parsed = JSON.parse(raw)
+        if (!Array.isArray(parsed)) return []
+        // Validate each entry's shape — a malformed/hand-edited value must
+        // not reach runtime code that assumes provider/models exist.
+        return parsed.flatMap((entry) => {
+            const result = StoredAdminProviderSchema.safeParse(entry)
+            return result.success ? [result.data as StoredAdminProvider] : []
+        })
+    } catch {
+        console.error("[admin-providers] Failed to parse stored providers")
+        return []
+    }
+}
+
+export type MaskedAdminProvider = Omit<
+    StoredAdminProvider,
+    (typeof SECRET_FIELDS)[number]
+> & {
+    apiKey?: MaskedSecret
+    awsAccessKeyId?: MaskedSecret
+    awsSecretAccessKey?: MaskedSecret
+    vertexApiKey?: MaskedSecret
+}
+
+export function maskAdminProviders(
+    list: StoredAdminProvider[],
+): MaskedAdminProvider[] {
+    return list.map((p) => {
+        const masked: MaskedAdminProvider = { ...p } as MaskedAdminProvider
+        for (const field of SECRET_FIELDS) {
+            const value = p[field]
+            masked[field] = value ? maskSecret(value) : undefined
+        }
+        return masked
+    })
+}
+
+// Resolve {isSet} markers in incoming secrets against the stored list
+export function mergeSecrets(
+    incoming: AdminProviderInput[],
+    stored: StoredAdminProvider[],
+): StoredAdminProvider[] {
+    const storedById = new Map(stored.map((p) => [p.id, p]))
+    return incoming.map((p) => {
+        const prev = storedById.get(p.id)
+        const merged = { ...p } as StoredAdminProvider
+        for (const field of SECRET_FIELDS) {
+            const value = p[field]
+            if (typeof value === "string") {
+                merged[field] = value || undefined
+            } else if (value?.isSet) {
+                merged[field] = prev?.[field]
+            } else {
+                merged[field] = undefined
+            }
+        }
+        return merged
+    })
+}
+
+function displayName(p: StoredAdminProvider): string {
+    return p.name?.trim() || PROVIDER_INFO[p.provider].label
+}
+
+export function validateAdminProviders(
+    list: StoredAdminProvider[],
+    envConfig: ServerModelsConfig | null = null,
+): string | null {
+    const envProviders = envConfig?.providers ?? []
+    for (const single of FIXED_CRED_PROVIDERS) {
+        if (list.filter((p) => p.provider === single).length > 1) {
+            return `Only one ${PROVIDER_INFO[single].label} provider is supported (its credentials use fixed environment variables).`
+        }
+        // Its credentials are global; a panel instance would silently
+        // override the credentials env-configured models rely on
+        if (
+            list.some((p) => p.provider === single) &&
+            envProviders.some((p) => p.provider === single)
+        ) {
+            return `${PROVIDER_INFO[single].label} is already configured in AI_MODELS_CONFIG / ai-models.json and shares global credentials. Manage it via the environment configuration instead.`
+        }
+    }
+    const names = list.map((p) => displayName(p))
+    if (new Set(names).size !== names.length) {
+        return "Provider display names must be unique."
+    }
+    const envNames = new Set(envProviders.map((p) => p.name))
+    const clash = names.find((n) => envNames.has(n))
+    if (clash) {
+        return `"${clash}" is already defined in AI_MODELS_CONFIG / ai-models.json. Use a different display name.`
+    }
+    if (list.filter((p) => p.isDefault).length > 1) {
+        return "Only one provider can be the default."
+    }
+    return null
+}
+
+// The panel's contribution to the server models config, derived at read
+// time and merged with the env baseline by loadRawServerModelsConfig().
+export function adminProvidersToConfig(
+    list: StoredAdminProvider[],
+): ServerModelsConfig {
+    const config: ServerModelsConfig = { providers: [] }
+    const indexByProvider = new Map<ProviderName, number>()
+    for (const p of list) {
+        const index = indexByProvider.get(p.provider) ?? 0
+        indexByProvider.set(p.provider, index + 1)
+        if (p.models.length === 0) continue
+        const env = credEnvNames(p.provider, index)
+        config.providers.push({
+            name: displayName(p),
+            provider: p.provider,
+            models: p.models,
+            ...(env.key && p.apiKey ? { apiKeyEnv: env.key } : {}),
+            ...(env.url && p.baseUrl ? { baseUrlEnv: env.url } : {}),
+            ...(p.isDefault ? { default: true } : {}),
+        })
+    }
+    return config
+}
+
+// Settings updates derived from the provider list: credential env vars,
+// the stored list itself, and AI_PROVIDER/AI_MODEL when a default is set.
+// Keys derived from `previous` but absent now are set to null (removed,
+// falling back to the environment).
+export function deriveEnvUpdates(
+    list: StoredAdminProvider[],
+    previous: StoredAdminProvider[],
+): Record<string, string | null> {
+    const updates: Record<string, string | null> = {}
+
+    // Clear everything the previous list owned, then overwrite below
+    for (const key of derivedEnvKeys(previous)) updates[key] = null
+
+    const indexByProvider = new Map<ProviderName, number>()
+    for (const p of list) {
+        const index = indexByProvider.get(p.provider) ?? 0
+        indexByProvider.set(p.provider, index + 1)
+
+        if (p.provider === "bedrock") {
+            if (p.awsAccessKeyId) updates.AWS_ACCESS_KEY_ID = p.awsAccessKeyId
+            if (p.awsSecretAccessKey)
+                updates.AWS_SECRET_ACCESS_KEY = p.awsSecretAccessKey
+            if (p.awsRegion) updates.AWS_REGION = p.awsRegion
+        } else if (p.provider === "vertexai") {
+            if (p.vertexApiKey) updates.GOOGLE_VERTEX_API_KEY = p.vertexApiKey
+            if (p.baseUrl) updates.GOOGLE_VERTEX_BASE_URL = p.baseUrl
+        } else if (p.provider === "ollama") {
+            if (p.apiKey) updates.OLLAMA_API_KEY = p.apiKey
+            if (p.baseUrl) updates.OLLAMA_BASE_URL = p.baseUrl
+        } else {
+            const env = credEnvNames(p.provider, index)
+            if (env.key && p.apiKey) updates[env.key] = p.apiKey
+            if (env.url && p.baseUrl) updates[env.url] = p.baseUrl
+        }
+    }
+
+    updates[ADMIN_PROVIDERS_KEY] = list.length > 0 ? JSON.stringify(list) : null
+
+    // The panel's default also becomes the server-wide default model;
+    // without one, the env-configured default applies.
+    const defaultEntry = list.find((p) => p.isDefault && p.models.length > 0)
+    if (defaultEntry) {
+        updates.AI_PROVIDER = defaultEntry.provider
+        updates.AI_MODEL = defaultEntry.models[0]
+    }
+
+    return updates
+}
+
+// Every settings key the panel may have written for a given list.
+// AI_MODELS_CONFIG is included to clean up values written by older
+// versions of the panel (it is no longer written).
+function derivedEnvKeys(list: StoredAdminProvider[]): string[] {
+    const keys = new Set<string>([
+        "AI_MODELS_CONFIG",
+        "AI_PROVIDER",
+        "AI_MODEL",
+    ])
+    const indexByProvider = new Map<ProviderName, number>()
+    for (const p of list) {
+        const index = indexByProvider.get(p.provider) ?? 0
+        indexByProvider.set(p.provider, index + 1)
+        if (p.provider === "bedrock") {
+            keys.add("AWS_ACCESS_KEY_ID")
+            keys.add("AWS_SECRET_ACCESS_KEY")
+            keys.add("AWS_REGION")
+        } else if (p.provider === "vertexai") {
+            keys.add("GOOGLE_VERTEX_API_KEY")
+            keys.add("GOOGLE_VERTEX_BASE_URL")
+        } else if (p.provider === "ollama") {
+            keys.add("OLLAMA_API_KEY")
+            keys.add("OLLAMA_BASE_URL")
+        } else {
+            const env = credEnvNames(p.provider, index)
+            if (env.key) keys.add(env.key)
+            if (env.url) keys.add(env.url)
+        }
+    }
+    return [...keys]
+}