feat: add API key modification, account deletion, password protection

account_manager.py

@@ -11,6 +11,7 @@ from models import Account, OAuthToken, AccountStats
 # 数据文件路径 (HF Spaces 持久化目录)
 DATA_DIR = os.environ.get("DATA_DIR", "./data")
 ACCOUNTS_FILE = os.path.join(DATA_DIR, "accounts.json")
+CONFIG_FILE = os.path.join(DATA_DIR, "config.json")
 
 # Google OAuth 配置 (Antigravity 使用的 Client ID)
 OAUTH_CLIENT_ID = "595848968694-r5ng3t6qb9elhe1u1h1hqgq4j2r3hgvk.apps.googleusercontent.com"
@@ -189,5 +190,51 @@ class AccountManager:
         )
 
 
+class ConfigManager:
+    """配置管理器 - 管理 API Key 等可变配置"""
+    
+    def __init__(self):
+        self._config = {
+            "api_key": "sk-antigravity"
+        }
+        self._ensure_data_dir()
+        self._load_config()
+    
+    def _ensure_data_dir(self):
+        """确保数据目录存在"""
+        os.makedirs(DATA_DIR, exist_ok=True)
+    
+    def _load_config(self):
+        """从文件加载配置"""
+        if os.path.exists(CONFIG_FILE):
+            try:
+                with open(CONFIG_FILE, "r", encoding="utf-8") as f:
+                    self._config.update(json.load(f))
+            except Exception as e:
+                print(f"加载配置失败: {e}")
+    
+    def _save_config(self):
+        """保存配置到文件"""
+        try:
+            with open(CONFIG_FILE, "w", encoding="utf-8") as f:
+                json.dump(self._config, f, ensure_ascii=False, indent=2)
+        except Exception as e:
+            print(f"保存配置失败: {e}")
+    
+    def get_api_key(self) -> str:
+        """获取 API Key"""
+        return self._config.get("api_key", "sk-antigravity")
+    
+    def set_api_key(self, api_key: str) -> bool:
+        """设置 API Key"""
+        if not api_key or len(api_key.strip()) == 0:
+            return False
+        self._config["api_key"] = api_key.strip()
+        self._save_config()
+        return True
+
+
 # 全局单例
 account_manager = AccountManager()
+config_manager = ConfigManager()
+

app.py

@@ -11,13 +11,17 @@ from fastapi.middleware.cors import CORSMiddleware
 from contextlib import asynccontextmanager
 
 from models import OpenAIChatRequest, OpenAIMessage, SUPPORTED_MODELS, ServiceConfig
-from account_manager import account_manager
+from account_manager import account_manager, config_manager
 from load_balancer import load_balancer
 from proxy_service import stream_chat_completion, chat_completion
 
 # ============ 服务配置 ============
 config = ServiceConfig()
 
+# 从环境变量获取管理员凭据
+ADMIN_USERNAME = os.environ.get("ADMIN_USERNAME", "admin")
+ADMIN_PASSWORD = os.environ.get("ADMIN_PASSWORD", "antigravity")
+
 
 # ============ FastAPI 应用 ============
 @asynccontextmanager
@@ -74,6 +78,12 @@ async def chat_completions(request: Request):
     if not auth_header.startswith("Bearer "):
         raise HTTPException(status_code=401, detail="Missing API key")
     
+    # 验证 API Key 是否匹配
+    provided_key = auth_header[7:]  # 去掉 "Bearer " 前缀
+    expected_key = config_manager.get_api_key()
+    if provided_key != expected_key:
+        raise HTTPException(status_code=401, detail="Invalid API key")
+    
     # 获取请求体
     body = await request.json()
     
@@ -128,10 +138,11 @@ def get_accounts_table():
     """获取账号列表表格数据"""
     accounts = account_manager.get_all_accounts()
     if not accounts:
-        return [["暂无账号", "-", "-", "-", "-"]]
+        return [["暂无账号", "-", "-", "-", "-", "-"]]
     
     return [
         [
+            acc.id,
             acc.email,
             "✅ 正常" if acc.is_available() else "❌ 冷却中",
             str(acc.total_requests),
@@ -159,9 +170,54 @@ def add_account(email: str, access_token: str, refresh_token: str, project_id: s
         return f"❌ 添加失败: {e}", get_accounts_table()
 
 
+def delete_account(email_to_delete: str):
+    """删除账号"""
+    if not email_to_delete or email_to_delete == "暂无账号":
+        return "❌ 请选择要删除的账号", get_accounts_table()
+    
+    # 查找账号 ID
+    accounts = account_manager.get_all_accounts()
+    target_account = None
+    for acc in accounts:
+        if acc.email == email_to_delete:
+            target_account = acc
+            break
+    
+    if not target_account:
+        return f"❌ 账号 {email_to_delete} 不存在", get_accounts_table()
+    
+    try:
+        if account_manager.remove_account(target_account.id):
+            return f"✅ 账号 {email_to_delete} 已删除", get_accounts_table()
+        else:
+            return f"❌ 删除账号 {email_to_delete} 失败", get_accounts_table()
+    except Exception as e:
+        return f"❌ 删除失败: {e}", get_accounts_table()
+
+
+def get_account_emails():
+    """获取所有账号邮箱列表"""
+    accounts = account_manager.get_all_accounts()
+    if not accounts:
+        return ["暂无账号"]
+    return [acc.email for acc in accounts]
+
+
+def update_api_key(new_api_key: str):
+    """更新 API Key"""
+    if not new_api_key or len(new_api_key.strip()) < 3:
+        return "❌ API Key 不能为空且至少需要 3 个字符", config_manager.get_api_key()
+    
+    if config_manager.set_api_key(new_api_key.strip()):
+        return f"✅ API Key 已更新为: {new_api_key.strip()}", new_api_key.strip()
+    else:
+        return "❌ 更新 API Key 失败", config_manager.get_api_key()
+
+
 def get_service_info():
     """获取服务信息"""
     stats = account_manager.get_stats()
+    current_api_key = config_manager.get_api_key()
     
     # 获取当前 Space URL
     space_url = os.environ.get("SPACE_HOST", "localhost:7860")
@@ -173,7 +229,7 @@ def get_service_info():
 
 **Base URL:** `{space_url}/v1`
 
-**API Key:** `{config.api_key}` (或任意非空字符串)
+**API Key:** `{current_api_key}`
 
 **支持的模型:**
 - `gemini-2.5-pro` / `gemini-2.5-flash` / `gemini-2.5-flash-lite`
@@ -199,7 +255,7 @@ def get_service_info():
 ```bash
 curl {space_url}/v1/chat/completions \\
   -H "Content-Type: application/json" \\
-  -H "Authorization: Bearer sk-antigravity" \\
+  -H "Authorization: Bearer {current_api_key}" \\
   -d '{{
     "model": "gemini-2.5-flash",
     "messages": [{{"role": "user", "content": "Hello"}}],
@@ -210,7 +266,7 @@ curl {space_url}/v1/chat/completions \\
 ### NextChat / Cherry Studio 配置
 1. API 类型: OpenAI
 2. Base URL: `{space_url}/v1`
-3. API Key: `sk-antigravity`
+3. API Key: `{current_api_key}`
 """
 
 
@@ -224,6 +280,7 @@ with gr.Blocks(
     css="""
     .container { max-width: 1200px; margin: auto; }
     .logo { font-size: 2em; font-weight: bold; }
+    .danger-btn { background-color: #dc3545 !important; }
     """
 ) as demo:
     gr.Markdown(
@@ -252,7 +309,7 @@ with gr.Blocks(
             
             access_token_input = gr.Textbox(
                 label="Access Token", 
-                placeholder="ya29.xxx...",
+                placeholder="ya29.xxx... 或填 pending",
                 lines=2
             )
             refresh_token_input = gr.Textbox(
@@ -264,34 +321,86 @@ with gr.Blocks(
             add_btn = gr.Button("➕ 添加账号", variant="primary")
             result_text = gr.Textbox(label="结果", interactive=False)
             
+            gr.Markdown("---")
             gr.Markdown("### 账号列表")
             accounts_table = gr.Dataframe(
-                headers=["邮箱", "状态", "请求数", "成功率", "最后使用"],
+                headers=["ID", "邮箱", "状态", "请求数", "成功率", "最后使用"],
                 value=get_accounts_table,
                 interactive=False
             )
             
+            gr.Markdown("### 删除账号")
+            with gr.Row():
+                delete_email_dropdown = gr.Dropdown(
+                    label="选择要删除的账号",
+                    choices=get_account_emails,
+                    interactive=True
+                )
+                delete_btn = gr.Button("🗑️ 删除账号", variant="stop")
+            delete_result = gr.Textbox(label="删除结果", interactive=False)
+            
+            # 绑定事件
             add_btn.click(
                 fn=add_account,
                 inputs=[email_input, access_token_input, refresh_token_input, project_id_input],
                 outputs=[result_text, accounts_table]
+            ).then(
+                fn=get_account_emails,
+                outputs=delete_email_dropdown
+            )
+            
+            delete_btn.click(
+                fn=delete_account,
+                inputs=[delete_email_dropdown],
+                outputs=[delete_result, accounts_table]
+            ).then(
+                fn=get_account_emails,
+                outputs=delete_email_dropdown
             )
         
         # 设置
         with gr.Tab("⚙️ 设置"):
-            gr.Markdown("### 服务配置")
+            gr.Markdown("### API Key 配置")
+            gr.Markdown("> 修改后，所有 API 请求需要使用新的 API Key")
+            
+            with gr.Row():
+                api_key_input = gr.Textbox(
+                    label="当前 API Key",
+                    value=config_manager.get_api_key,
+                    placeholder="输入新的 API Key",
+                    interactive=True
+                )
+                save_api_key_btn = gr.Button("💾 保存 API Key", variant="primary")
+            
+            api_key_result = gr.Textbox(label="结果", interactive=False)
+            
+            save_api_key_btn.click(
+                fn=update_api_key,
+                inputs=[api_key_input],
+                outputs=[api_key_result, api_key_input]
+            )
+            
+            gr.Markdown("---")
+            gr.Markdown("### 环境变量配置")
             gr.Markdown("""
-            > 以下配置在 HF Spaces 环境下通过环境变量设置
+            > 以下配置在 HF Spaces 环境下通过 Secrets 设置
             
             | 配置项 | 环境变量 | 默认值 |
             |--------|----------|--------|
             | 数据目录 | `DATA_DIR` | `./data` |
-            | API Key | - | `sk-antigravity` |
+            | 管理员用户名 | `ADMIN_USERNAME` | `admin` |
+            | 管理员密码 | `ADMIN_PASSWORD` | `antigravity` |
             """)
 
 
-# 挂载 Gradio 到 FastAPI
-app = gr.mount_gradio_app(app, demo, path="/")
+# 挂载 Gradio 到 FastAPI (带密码保护)
+app = gr.mount_gradio_app(
+    app, 
+    demo, 
+    path="/",
+    auth=(ADMIN_USERNAME, ADMIN_PASSWORD),
+    auth_message="🔐 请输入管理员凭据登录 Antigravity API Proxy"
+)
 
 
 if __name__ == "__main__":

models.py

@@ -64,6 +64,8 @@ class AccountStats(BaseModel):
 class ServiceConfig(BaseModel):
     """服务配置"""
     api_key: str = "sk-antigravity"
+    admin_username: str = "admin"
+    admin_password: str = "antigravity"
     port: int = 7860
     enable_cors: bool = True
     max_retries: int = 3