API Key 管理

sk-{32 位十六进制字符}

curl -H "Authorization: Bearer sk-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-3-5-sonnet",
    "messages": [{"role": "user", "content": "Hello"}]
  }' \
  http://localhost:23000/v1/chat/completions

curl -H "x-api-key: sk-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-3-5-sonnet",
    "messages": [{"role": "user", "content": "Hello"}]
  }' \
  http://localhost:23000/v1/chat/completions

# Header 方式
curl -H "x-goog-api-key: sk-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-3-5-sonnet",
    "messages": [{"role": "user", "content": "Hello"}]
  }' \
  http://localhost:23000/v1/chat/completions

# Query 参数方式
curl "http://localhost:23000/v1/chat/completions?key=sk-your-api-key" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-3-5-sonnet",
    "messages": [{"role": "user", "content": "Hello"}]
  }'

// Cookie 配置
name: "auth-token"
httpOnly: true
secure: 取决于 ENABLE_SECURE_COOKIES 环境变量
sameSite: "lax"
maxAge: 7 天
path: "/"

// 登录后跳转逻辑
if (user.role === "admin") {
  return "/dashboard";
}
if (key.canLoginWebUi) {
  return "/dashboard";
}
return "/my-usage";  // 只读页面

日限额: $50.00
日重置模式: 固定
日重置时间: 00:00

Layer 1 - 永久硬限制（最先检查）
  1. Key 总消费限额
  2. User 总消费限额

Layer 2 - 资源/频率保护
  3. Key 并发会话数
  4. User 并发会话数
  5. User RPM 限制

Layer 3 - 短期周期限制
  6. Key 5 小时限额
  7. User 5 小时限额
  8. Key 日限额
  9. User 日限额

Layer 4 - 中长期周期限制
  10. Key 周限额
  11. User 周限额
  12. Key 月限额
  13. User 月限额

如果 User 日限额 = $100
则 Key 日限额 ≤ $100

interface BatchUpdateKeysParams {
  keyIds: number[];
  updates: {
    providerGroup?: string | null;
    limit5hUsd?: number | null;
    limitDailyUsd?: number | null;
    limitWeeklyUsd?: number | null;
    limitMonthlyUsd?: number | null;
    canLoginWebUi?: boolean;
    isEnabled?: boolean;
  };
}

日限额: $50.00 / $100.00 (50%)
周限额: $180.00 / $500.00 (36%)
月限额: $450.00 / $1000.00 (45%)

ADMIN_TOKEN=your-admin-token

export const keys = pgTable('keys', {
  id: serial('id').primaryKey(),
  userId: integer('user_id').notNull(),
  key: varchar('key').notNull(),
  name: varchar('name').notNull(),
  isEnabled: boolean('is_enabled').default(true),
  expiresAt: timestamp('expires_at', { withTimezone: true }),
  
  // Web UI 登录权限
  canLoginWebUi: boolean('can_login_web_ui').default(false),
  
  // 配额限制
  limit5hUsd: numeric('limit_5h_usd', { precision: 10, scale: 2 }),
  limitDailyUsd: numeric('limit_daily_usd', { precision: 10, scale: 2 }),
  dailyResetMode: dailyResetModeEnum('daily_reset_mode').default('fixed').notNull(),
  dailyResetTime: varchar('daily_reset_time', { length: 5 }).default('00:00').notNull(),
  limitWeeklyUsd: numeric('limit_weekly_usd', { precision: 10, scale: 2 }),
  limitMonthlyUsd: numeric('limit_monthly_usd', { precision: 10, scale: 2 }),
  limitTotalUsd: numeric('limit_total_usd', { precision: 10, scale: 2 }),
  limitConcurrentSessions: integer('limit_concurrent_sessions').default(0),
  
  // 供应商分组和缓存偏好
  providerGroup: varchar('provider_group', { length: 200 }).default('default'),
  cacheTtlPreference: varchar('cache_ttl_preference', { length: 10 }),
  
  // 时间戳
  createdAt: timestamp('created_at', { withTimezone: true }).defaultNow(),
  updatedAt: timestamp('updated_at', { withTimezone: true }).defaultNow(),
  deletedAt: timestamp('deleted_at', { withTimezone: true }),
});

(table) => ({
  keysUserIdIdx: index('idx_keys_user_id').on(table.userId),
  keysCreatedAtIdx: index('idx_keys_created_at').on(table.createdAt),
  keysDeletedAtIdx: index('idx_keys_deleted_at').on(table.deletedAt),
})

export const KeyFormSchema = z.object({
  name: z.string()
    .min(1, "密钥名称不能为空")
    .max(64, "密钥名称不能超过64个字符"),
  expiresAt: z.string()
    .optional()
    .default("")
    .transform((val) => (val === "" ? undefined : val)),
  canLoginWebUi: z.boolean()
    .optional()
    .default(true),
  limit5hUsd: z.coerce.number()
    .min(0)
    .max(10000)
    .nullable()
    .optional(),
  limitDailyUsd: z.coerce.number()
    .min(0)
    .max(10000)
    .nullable()
    .optional(),
  dailyResetMode: z.enum(["fixed", "rolling"])
    .optional()
    .default("fixed"),
  dailyResetTime: z.string()
    .regex(/^([01]?[0-9]|2[0-3]):[0-5][0-9]$/)
    .optional()
    .default("00:00"),
  limitWeeklyUsd: z.coerce.number()
    .min(0)
    .max(50000)
    .nullable()
    .optional(),
  limitMonthlyUsd: z.coerce.number()
    .min(0)
    .max(200000)
    .nullable()
    .optional(),
  limitTotalUsd: z.coerce.number()
    .min(0)
    .max(10000000)
    .nullable()
    .optional(),
  limitConcurrentSessions: z.coerce.number()
    .int()
    .min(0)
    .max(1000)
    .optional()
    .default(0),
  providerGroup: z.string()
    .max(200)
    .nullable()
    .optional()
    .default(""),
  cacheTtlPreference: z.enum(["inherit", "5m", "1h"])
    .optional()
    .default("inherit"),
});

// Key CRUD 操作
export async function addKey(data: CreateKeyData): Promise<ActionResult<{ generatedKey: string; name: string }>>
export async function editKey(keyId: number, data: UpdateKeyData): Promise<ActionResult>
export async function removeKey(keyId: number): Promise<ActionResult>
export async function getKeys(userId: number): Promise<ActionResult<Key[]>>

// Key 状态管理
export async function toggleKeyEnabled(keyId: number, enabled: boolean): Promise<ActionResult>
export async function renewKeyExpiresAt(keyId: number, data: { expiresAt: string; enableKey?: boolean }): Promise<ActionResult>

// 批量操作（管理员）
export async function batchUpdateKeys(params: BatchUpdateKeysParams): Promise<ActionResult<BatchUpdateResult>>

// 统计信息
export async function getKeysWithStatistics(userId: number): Promise<ActionResult<KeyStatistics[]>>
export async function getKeyLimitUsage(keyId: number): Promise<ActionResult<KeyLimitUsage>>

function validateNonAdminProviderGroup(
  userProviderGroup: string,
  requestedProviderGroup: string,
  options: { hasDefaultKey: boolean },
  tError: TranslationFunction
): string {
  const userGroups = parseProviderGroups(userProviderGroup);
  const requestedGroups = parseProviderGroups(requestedProviderGroup);

  // 如果用户拥有全局访问权限，允许任何分组
  if (userGroups.includes(PROVIDER_GROUP.ALL)) {
    return requestedProviderGroup;
  }

  const userGroupSet = new Set(userGroups);
  
  // 检查默认分组权限
  if (requestedGroups.includes(PROVIDER_GROUP.DEFAULT) && !options.hasDefaultKey) {
    throw new Error(tError("NO_DEFAULT_GROUP_PERMISSION"));
  }

  // 检查是否有权限访问所有请求的分组
  const invalidGroups = requestedGroups.filter((g) => !userGroupSet.has(g));
  if (invalidGroups.length > 0) {
    throw new Error(tError("NO_GROUP_PERMISSION", { 
      groups: invalidGroups.join(", ") 
    }));
  }

  return requestedProviderGroup;
}

export const PROVIDER_GROUP = {
  /** 默认分组标识符 */
  DEFAULT: "default",
  /** 全局访问标识符（管理员专用） */
  ALL: "*",
} as const;

用户有效分组 = Key1分组 ∪ Key2分组 ∪ ... ∪ KeyN分组