重构: 后端 df-ai/commands 拆分+df-nodes/workflow 改造+P0 bug 修复
- df-ai: context 历史中毒三档自愈 sanitize_messages(AC3)+anthropic_compat tool_use_id None 跳过(AC1/AC2)+删 router/stream 死码
- df-core: events 加 select_type+decisions 多选审批契约(F-260615-01)
- df-execute: shell run_command 工具复用(F-260615-05)
- df-nodes: human_node 多选校验+2 端到端测(F-01)+取消跳 set_failed(B-03b-R1/R2/R8)
- df-workflow: executor/dag/state cancel 闭环(B-06/07/03a/b)+provider approve options(R-PD-5)
- df-storage: find_path_conflict 抽公共(R-PD-11)+COLS 常量断言
- df-ideas: 删 IdeaPromoter/PromotionPolicy 死码(R-PD-14)
- src-tauri/commands/ai: secret keyring 迁移(FR-S1/R-PD-4)+GeneratingGuard RAII+disarm(B-09/26)+newConversation 软复位(B-10)+stream 心跳/stop select/空回复判错(B-02/04/05/15)+run_command(F-05)+mask audit(AR-3)
- src-tauri/commands/{project,task,workflow,mod,lib,state}: task detail IPC(F-02)+approve decisions+task list 联动(B-29)
- Cargo.lock+Cargo.toml 依赖同步
This commit is contained in:
@@ -0,0 +1,228 @@
|
||||
//! FR-S1 api_key 密钥管理 — 真实密钥存 OS keyring,DB `api_key` 列迁移后存空串
|
||||
//!
|
||||
//! 设计:
|
||||
//! - keyring entry: service=`devflow-ai-provider`, username=provider_id
|
||||
//! - DB `api_key` 列恒空(迁移后/新建均空),真实密钥唯一源 = OS keyring
|
||||
//! - 启动一次性迁移:`migrate_secrets_to_keyring` 读老明文 → keyring → DB 置空(失败保留明文下次重试)
|
||||
//! - 消费点(build_provider)经 `resolve_provider_secret` 取:keyring 优先,fallback DB(兼容未迁移)
|
||||
//! - 跨平台:Windows Credential Manager / macOS Keychain / Linux Secret Service
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::fs;
|
||||
use std::path::PathBuf;
|
||||
|
||||
use df_storage::crud::AiProviderRepo;
|
||||
use df_storage::models::AiProviderRecord;
|
||||
use keyring::Entry;
|
||||
|
||||
const KEYRING_SERVICE: &str = "devflow-ai-provider";
|
||||
|
||||
/// 迁移失败计数器阈值:同一 provider 累计失败到此次数 → 升级为 warn 提示明文密钥长期滞留风险。
|
||||
/// 跨启动持久化(sidecar 文件),计数仅用于告警,不影响兼容时序(不强制迁移、不删明文)。
|
||||
const MIGRATION_FAIL_THRESHOLD: u32 = 3;
|
||||
|
||||
/// 迁移失败计数 sidecar 文件(<cwd>/.devflow-keyring-failcount):逐行 `provider_id=count`。
|
||||
/// cwd 未必是稳定路径,但 R-PD-4 目标仅是「检测到反复失败/滞留时告警」,误读为 0 即按未达阈值处理,无副作用。
|
||||
fn failcount_path() -> PathBuf {
|
||||
std::env::current_dir()
|
||||
.unwrap_or_else(|_| PathBuf::from("."))
|
||||
.join(".devflow-keyring-failcount")
|
||||
}
|
||||
|
||||
/// 读取全部失败计数(id → count)。文件缺失/损坏 → 空 map(按未达阈值处理)。
|
||||
fn read_failcounts() -> HashMap<String, u32> {
|
||||
let mut map = HashMap::new();
|
||||
if let Ok(text) = fs::read_to_string(failcount_path()) {
|
||||
for line in text.lines() {
|
||||
let mut parts = line.splitn(2, '=');
|
||||
let id = parts.next().unwrap_or("").trim();
|
||||
let cnt = parts.next().and_then(|s| s.trim().parse::<u32>().ok());
|
||||
if !id.is_empty() {
|
||||
if let Some(c) = cnt {
|
||||
map.insert(id.to_string(), c);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
map
|
||||
}
|
||||
|
||||
/// 持久化全部失败计数。写入失败仅 log,不阻断迁移主流程。
|
||||
fn write_failcounts(map: &HashMap<String, u32>) {
|
||||
let mut text = String::new();
|
||||
let mut entries: Vec<_> = map.iter().collect();
|
||||
entries.sort_by(|a, b| a.0.cmp(b.0)); // 稳定顺序,减少无谓 diff
|
||||
for (id, cnt) in entries {
|
||||
text.push_str(id);
|
||||
text.push('=');
|
||||
text.push_str(&cnt.to_string());
|
||||
text.push('\n');
|
||||
}
|
||||
if let Err(e) = fs::write(failcount_path(), text) {
|
||||
tracing::debug!("[FR-S1] 迁移失败计数文件写入失败(忽略): {}", e);
|
||||
}
|
||||
}
|
||||
|
||||
/// 记录一次迁移失败并返回累计失败次数。持久化失败也不影响返回值(仍递增内存计数用于本次告警)。
|
||||
fn record_migration_fail(id: &str) -> u32 {
|
||||
let mut map = read_failcounts();
|
||||
let next = map.get(id).copied().unwrap_or(0).saturating_add(1);
|
||||
map.insert(id.to_string(), next);
|
||||
write_failcounts(&map);
|
||||
next
|
||||
}
|
||||
|
||||
/// 清零某 provider 的失败计数(迁移成功后调用,避免历史失败在后续再触发误告警)。
|
||||
fn clear_migration_failcount(id: &str) {
|
||||
let mut map = read_failcounts();
|
||||
if map.remove(id).is_some() {
|
||||
write_failcounts(&map);
|
||||
}
|
||||
}
|
||||
|
||||
fn entry_for(id: &str) -> anyhow::Result<Entry> {
|
||||
Entry::new(KEYRING_SERVICE, id).map_err(|e| anyhow::anyhow!("keyring entry 创建失败: {}", e))
|
||||
}
|
||||
|
||||
/// 读取 provider 密钥(优先 keyring;无则 None)
|
||||
pub fn get_provider_secret(id: &str) -> Option<String> {
|
||||
let entry = entry_for(id).ok()?;
|
||||
match entry.get_password() {
|
||||
Ok(s) if !s.is_empty() => Some(s),
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
/// 消费点用:解析 provider 真实密钥 — keyring 优先,fallback DB.api_key(兼容未迁移老库)
|
||||
pub fn resolve_provider_secret(record: &AiProviderRecord) -> String {
|
||||
if !record.api_key.is_empty() {
|
||||
return record.api_key.clone();
|
||||
}
|
||||
get_provider_secret(&record.id).unwrap_or_default()
|
||||
}
|
||||
|
||||
/// 写入密钥到 keyring(覆盖)
|
||||
pub fn set_provider_secret(id: &str, key: &str) -> anyhow::Result<()> {
|
||||
let entry = entry_for(id)?;
|
||||
entry.set_password(key).map_err(|e| anyhow::anyhow!("keyring 写入失败: {}", e))
|
||||
}
|
||||
|
||||
/// 删除 keyring 密钥(provider 删除时清理)
|
||||
pub fn delete_provider_secret(id: &str) -> anyhow::Result<()> {
|
||||
let entry = entry_for(id)?;
|
||||
entry.delete_credential().map_err(|e| anyhow::anyhow!("keyring 删除失败: {}", e))
|
||||
}
|
||||
|
||||
/// 启动一次性迁移:DB 明文 → keyring → DB 置空(失败保留明文下次重试,非阻断)
|
||||
pub async fn migrate_secrets_to_keyring(repo: &AiProviderRepo) -> anyhow::Result<usize> {
|
||||
let providers = repo.list_all().await?;
|
||||
let mut migrated = 0;
|
||||
for mut p in providers {
|
||||
if p.api_key.is_empty() {
|
||||
continue; // 已迁移或无密钥
|
||||
}
|
||||
if let Err(e) = set_provider_secret(&p.id, &p.api_key) {
|
||||
// 累计失败次数:达阈值(默认 3)升级告警,提示明文密钥长期滞留 SQLite(无加密)风险。
|
||||
// 计数仅告警用,不改兼容时序——仍保留明文下次重试,不强制迁移、不删明文。
|
||||
let n = record_migration_fail(&p.id);
|
||||
if n >= MIGRATION_FAIL_THRESHOLD {
|
||||
tracing::warn!(
|
||||
"[FR-S1] provider {} keyring 迁移已连续失败 {} 次,明文 api_key 长期滞留 SQLite 文件(无加密)。\
|
||||
建议:1) 确认 OS 钥匙串可用(Win Credential Manager / macOS Keychain);\
|
||||
2) keyring 后端异常时排查对应平台后端;3) 必要时手动在设置中重新保存密钥触发写入",
|
||||
p.id, n
|
||||
);
|
||||
} else {
|
||||
tracing::warn!(
|
||||
"[FR-S1] keyring 迁移失败 {} (累计 {}/{},保留明文下次重试): {}",
|
||||
p.id, n, MIGRATION_FAIL_THRESHOLD, e
|
||||
);
|
||||
}
|
||||
continue;
|
||||
}
|
||||
let pid = p.id.clone();
|
||||
p.api_key.clear();
|
||||
if let Err(e) = repo.insert(p).await {
|
||||
tracing::warn!("[FR-S1] 迁移后清空 DB api_key 失败 {}: {}", pid, e);
|
||||
}
|
||||
// 迁移成功 → 清零该 provider 的失败计数(下次若再出现失败从 1 重新累计)
|
||||
clear_migration_failcount(&pid);
|
||||
migrated += 1;
|
||||
}
|
||||
if migrated > 0 {
|
||||
tracing::info!("[FR-S1] {} 条 provider 密钥迁移至 OS keyring", migrated);
|
||||
}
|
||||
Ok(migrated)
|
||||
}
|
||||
|
||||
/// 消费点统一入口:resolve_provider_secret → ensure_resolved_key → build_provider 三步打包。
|
||||
///
|
||||
/// 替代散落各处的「resolve + build_provider」二件套复制(漏 ensure_resolved_key → keyring 读不到时
|
||||
/// 空 key 照发请求吃 401,用户看「key 已保存」反复重试无解)。返 Result 让调用方按场景处理:
|
||||
/// - 主链(agentic loop):空 key 早失败 emit AiError
|
||||
/// - 后台 task(title/knowledge 提炼/embedding):Err 上层降级/记 log
|
||||
pub fn build_provider_for(
|
||||
record: &AiProviderRecord,
|
||||
) -> Result<Box<dyn df_ai::provider::LlmProvider>, String> {
|
||||
let api_key = resolve_provider_secret(record);
|
||||
ensure_resolved_key(&record.name, &api_key)?;
|
||||
Ok(df_ai::build_provider(
|
||||
&record.provider_type,
|
||||
&record.base_url,
|
||||
&api_key,
|
||||
&record.default_model,
|
||||
))
|
||||
}
|
||||
|
||||
/// 校验已解析的密钥是否可用:空(含纯空白)→明确错误信息,非空→Ok。
|
||||
/// 用于消费点(build_provider 前)早失败,避免空 key 发请求吃 401,错误伪装成"API Key 无效"。
|
||||
pub fn ensure_resolved_key(provider_name: &str, resolved: &str) -> Result<(), String> {
|
||||
if resolved.trim().is_empty() {
|
||||
Err(format!(
|
||||
"未读取到「{}」的 API 密钥(系统钥匙串无记录或已损坏),请在设置中重新填写并保存",
|
||||
provider_name
|
||||
))
|
||||
} else {
|
||||
Ok(())
|
||||
}
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn ensure_resolved_key_rejects_empty() {
|
||||
assert!(ensure_resolved_key("GLM", "").is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ensure_resolved_key_rejects_whitespace() {
|
||||
// 纯空白也视为无密钥(防粘贴时只有空格)
|
||||
assert!(ensure_resolved_key("GLM", " ").is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ensure_resolved_key_accepts_nonempty() {
|
||||
assert!(ensure_resolved_key("GLM", "sk-abc").is_ok());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn ensure_resolved_key_error_mentions_provider_name() {
|
||||
let err = ensure_resolved_key("我的提供商", "").unwrap_err();
|
||||
assert!(err.contains("我的提供商"), "错误信息应含 provider 名便于定位");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn resolve_prefers_db_when_non_empty() {
|
||||
// DB api_key 非空 → 直接返回 DB 值,不触发 keyring(FR-S1 兼容未迁移老库)
|
||||
use df_storage::models::AiProviderRecord;
|
||||
let rec = AiProviderRecord {
|
||||
id: "t1".into(), name: "t".into(), provider_type: "openai_compat".into(),
|
||||
api_key: "sk-db-fallback".into(), base_url: "https://x".into(),
|
||||
default_model: "m".into(), models: None, is_default: false,
|
||||
config: None, created_at: "0".into(), updated_at: "0".into(),
|
||||
};
|
||||
assert_eq!(resolve_provider_secret(&rec), "sk-db-fallback");
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user