feat(secrets): encrypt sensitive store fields (AES-GCM, master.key 0600, api_key_env) + fast models-endpoint probing (fix zen backlog + source status) + UI cleanup (drop redundant parens labels, grid models 4/row)

This commit is contained in:
root
2026-08-10 10:33:03 +08:00
parent e0978db150
commit 839f33ba01
8 changed files with 405 additions and 56 deletions

View File

@ -10,6 +10,7 @@ import (
"os"
"path/filepath"
"sort"
"strings"
"time"
"llmsproxy/internal/config"
@ -259,12 +260,27 @@ func (c *Core) mergedSources() []config.Source {
for _, n := range order {
if !seen[n] {
seen[n] = true
out = append(out, byName[n])
out = append(out, c.resolveSourceKey(byName[n]))
}
}
return out
}
// resolveSourceKey applies api_key_env (env var overrides inline api_key) and
// decrypts an inline enc:v1: ciphertext (useful for YAML-sourced keys).
func (c *Core) resolveSourceKey(s config.Source) config.Source {
if s.APIKeyEnv != "" {
if v := os.Getenv(s.APIKeyEnv); v != "" {
s.APIKey = v
}
return s
}
if box := c.store.SecretBox(); box != nil && strings.HasPrefix(s.APIKey, "enc:v1:") {
s.APIKey = box.MustDecrypt(s.APIKey)
}
return s
}
func (c *Core) rebuildRegistry() error {
srcs := c.mergedSources()
providers := make([]*provider.Provider, 0, len(srcs))