Improve user key management with editing capabilities and validation

api/accounts.py

@@ -31,6 +31,7 @@ class UserKeyCreateRequest(BaseModel):
 class UserKeyUpdateRequest(BaseModel):
     name: str | None = None
     enabled: bool | None = None
+    key: str | None = None
 
 
 class AccountCreateRequest(BaseModel):
@@ -116,12 +117,16 @@ def create_router() -> APIRouter:
             for key, value in {
                 "name": body.name,
                 "enabled": body.enabled,
+                "key": body.key,
             }.items()
             if value is not None
         }
         if not updates:
             raise HTTPException(status_code=400, detail={"error": "no updates provided"})
-        item = auth_service.update_key(key_id, updates, role="user")
+        try:
+            item = auth_service.update_key(key_id, updates, role="user")
+        except ValueError as exc:
+            raise HTTPException(status_code=400, detail={"error": str(exc)}) from exc
         if item is None:
             raise HTTPException(status_code=404, detail={"error": "user key not found"})
         return {"item": item, "items": auth_service.list_keys(role="user")}

services/auth_service.py

@@ -33,6 +33,10 @@ class AuthService:
     def _clean(value: object) -> str:
         return str(value or "").strip()
 
+    @staticmethod
+    def _default_name(role: object) -> str:
+        return "管理员密钥" if str(role or "").strip().lower() == "admin" else "普通用户"
+
     def _normalize_item(self, raw: object) -> dict[str, object] | None:
         if not isinstance(raw, dict):
             return None
@@ -43,7 +47,7 @@ class AuthService:
         if not key_hash:
             return None
         item_id = self._clean(raw.get("id")) or uuid.uuid4().hex[:12]
-        name = self._clean(raw.get("name")) or ("管理员密钥" if role == "admin" else "普通用户")
+        name = self._clean(raw.get("name")) or self._default_name(role)
         created_at = self._clean(raw.get("created_at")) or _now_iso()
         last_used_at = self._clean(raw.get("last_used_at")) or None
         return {
@@ -68,6 +72,9 @@ class AuthService:
     def _save(self) -> None:
         self.storage.save_auth_keys(self._items)
 
+    def _reload_locked(self) -> None:
+        self._items = self._load()
+
     @staticmethod
     def _public_item(item: dict[str, object]) -> dict[str, object]:
         return {
@@ -81,22 +88,52 @@ class AuthService:
 
     def list_keys(self, role: AuthRole | None = None) -> list[dict[str, object]]:
         with self._lock:
+            self._reload_locked()
             items = [item for item in self._items if role is None or item.get("role") == role]
             return [self._public_item(item) for item in items]
 
+    def _has_key_hash_locked(self, key_hash: str, *, exclude_id: str = "") -> bool:
+        for item in self._items:
+            item_id = self._clean(item.get("id"))
+            if exclude_id and item_id == exclude_id:
+                continue
+            stored_hash = self._clean(item.get("key_hash"))
+            if stored_hash and hmac.compare_digest(stored_hash, key_hash):
+                return True
+        return False
+
+    def _build_key_hash_locked(self, raw_key: str, *, exclude_id: str = "") -> str:
+        candidate = self._clean(raw_key)
+        if not candidate:
+            raise ValueError("key is required")
+        admin_key = self._clean(config.auth_key)
+        if admin_key and hmac.compare_digest(candidate, admin_key):
+            raise ValueError("key conflicts with admin auth key")
+        key_hash = _hash_key(candidate)
+        if self._has_key_hash_locked(key_hash, exclude_id=exclude_id):
+            raise ValueError("key already exists")
+        return key_hash
+
     def create_key(self, *, role: AuthRole, name: str = "") -> tuple[dict[str, object], str]:
-        normalized_name = self._clean(name) or ("管理员密钥" if role == "admin" else "普通用户")
-        raw_key = f"sk-{secrets.token_urlsafe(24)}"
-        item = {
-            "id": uuid.uuid4().hex[:12],
-            "name": normalized_name,
-            "role": role,
-            "key_hash": _hash_key(raw_key),
-            "enabled": True,
-            "created_at": _now_iso(),
-            "last_used_at": None,
-        }
+        normalized_name = self._clean(name) or self._default_name(role)
         with self._lock:
+            self._reload_locked()
+            while True:
+                raw_key = f"sk-{secrets.token_urlsafe(24)}"
+                try:
+                    key_hash = self._build_key_hash_locked(raw_key)
+                    break
+                except ValueError:
+                    continue
+            item = {
+                "id": uuid.uuid4().hex[:12],
+                "name": normalized_name,
+                "role": role,
+                "key_hash": key_hash,
+                "enabled": True,
+                "created_at": _now_iso(),
+                "last_used_at": None,
+            }
             self._items.append(item)
             self._save()
             return self._public_item(item), raw_key
@@ -112,6 +149,7 @@ class AuthService:
         if not normalized_id:
             return None
         with self._lock:
+            self._reload_locked()
             for index, item in enumerate(self._items):
                 if item.get("id") != normalized_id:
                     continue
@@ -119,9 +157,11 @@ class AuthService:
                     return None
                 next_item = dict(item)
                 if "name" in updates and updates.get("name") is not None:
-                    next_item["name"] = self._clean(updates.get("name")) or next_item.get("name") or "普通用户"
+                    next_item["name"] = self._clean(updates.get("name")) or self._default_name(next_item.get("role"))
                 if "enabled" in updates and updates.get("enabled") is not None:
                     next_item["enabled"] = bool(updates.get("enabled"))
+                if "key" in updates and updates.get("key") is not None:
+                    next_item["key_hash"] = self._build_key_hash_locked(str(updates.get("key") or ""), exclude_id=normalized_id)
                 self._items[index] = next_item
                 self._save()
                 return self._public_item(next_item)
@@ -132,6 +172,7 @@ class AuthService:
         if not normalized_id:
             return False
         with self._lock:
+            self._reload_locked()
             before = len(self._items)
             self._items = [
                 item
@@ -149,6 +190,7 @@ class AuthService:
             return None
         candidate_hash = _hash_key(candidate)
         with self._lock:
+            self._reload_locked()
             for index, item in enumerate(self._items):
                 if not bool(item.get("enabled", True)):
                     continue

test/test_account_image_capabilities.py

@@ -119,6 +119,20 @@ class AuthServiceTests(unittest.TestCase):
             self.assertEqual(authed["id"], item["id"])
             self.assertIsNotNone(authed["last_used_at"])
 
+    def test_update_user_key_replaces_raw_key(self) -> None:
+        with tempfile.TemporaryDirectory() as tmp_dir:
+            service = AuthService(JSONStorageBackend(Path(tmp_dir) / "accounts.json", Path(tmp_dir) / "auth_keys.json"))
+            item, raw_key = service.create_key(role="user", name="Alice")
+
+            updated = service.update_key(item["id"], {"key": "sk-user-custom-key"}, role="user")
+
+            self.assertIsNotNone(updated)
+            self.assertIsNone(service.authenticate(raw_key))
+
+            authed = service.authenticate("sk-user-custom-key")
+            self.assertIsNotNone(authed)
+            self.assertEqual(authed["id"], item["id"])
+
 
 if __name__ == "__main__":
     unittest.main()

web/src/app/page.tsx

@@ -3,7 +3,8 @@
 import { useEffect } from "react";
 import { useRouter } from "next/navigation";
 
-import { getDefaultRouteForRole, getStoredAuthSession } from "@/store/auth";
+import { getValidatedAuthSession } from "@/lib/auth-session";
+import { getDefaultRouteForRole } from "@/store/auth";
 
 export default function HomePage() {
   const router = useRouter();
@@ -12,7 +13,7 @@ export default function HomePage() {
     let active = true;
 
     const redirect = async () => {
-      const session = await getStoredAuthSession();
+      const session = await getValidatedAuthSession();
       if (!active) {
         return;
       }

web/src/app/settings/components/user-keys-card.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useEffect, useRef, useState } from "react";
-import { Ban, CheckCircle2, Copy, KeyRound, LoaderCircle, Plus, Trash2 } from "lucide-react";
+import { Ban, CheckCircle2, Copy, KeyRound, LoaderCircle, Pencil, Plus, Trash2 } from "lucide-react";
 import { toast } from "sonner";
 
 import { Badge } from "@/components/ui/badge";
@@ -45,6 +45,9 @@ export function UserKeysCard() {
   const [pendingIds, setPendingIds] = useState<Set<string>>(() => new Set());
   const [revealedKey, setRevealedKey] = useState("");
   const [deletingItem, setDeletingItem] = useState<UserKey | null>(null);
+  const [editingItem, setEditingItem] = useState<UserKey | null>(null);
+  const [editName, setEditName] = useState("");
+  const [editKey, setEditKey] = useState("");
 
   const load = async () => {
     setIsLoading(true);
@@ -125,6 +128,40 @@ export function UserKeysCard() {
     }
   };
 
+  const openEditDialog = (item: UserKey) => {
+    setEditingItem(item);
+    setEditName(item.name);
+    setEditKey("");
+  };
+
+  const handleEdit = async () => {
+    if (!editingItem) {
+      return;
+    }
+    const item = editingItem;
+    const trimmedName = editName.trim();
+    const trimmedKey = editKey.trim();
+    if (trimmedName === item.name && !trimmedKey) {
+      setEditingItem(null);
+      return;
+    }
+    setItemPending(item.id, true);
+    try {
+      const data = await updateUserKey(item.id, {
+        ...(trimmedName !== item.name ? { name: trimmedName } : {}),
+        ...(trimmedKey ? { key: trimmedKey } : {}),
+      });
+      setItems(data.items);
+      setEditingItem(null);
+      setEditKey("");
+      toast.success(trimmedKey ? "用户密钥已更新" : "用户名称已更新");
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "更新用户密钥失败");
+    } finally {
+      setItemPending(item.id, false);
+    }
+  };
+
   const handleCopy = async (value: string) => {
     try {
       await navigator.clipboard.writeText(value);
@@ -200,6 +237,16 @@ export function UserKeysCard() {
                     </div>
 
                     <div className="flex items-center gap-2">
+                      <Button
+                        type="button"
+                        variant="outline"
+                        className="h-9 rounded-xl border-stone-200 bg-white px-4 text-stone-700"
+                        onClick={() => openEditDialog(item)}
+                        disabled={isPending}
+                      >
+                        {isPending ? <LoaderCircle className="size-4 animate-spin" /> : <Pencil className="size-4" />}
+                        编辑
+                      </Button>
                       <Button
                         type="button"
                         variant="outline"
@@ -305,6 +352,71 @@ export function UserKeysCard() {
           </DialogFooter>
         </DialogContent>
       </Dialog>
+
+      <Dialog
+        open={Boolean(editingItem)}
+        onOpenChange={(open) => {
+          if (!open) {
+            setEditingItem(null);
+            setEditKey("");
+          }
+        }}
+      >
+        <DialogContent className="rounded-2xl p-6">
+          <DialogHeader className="gap-2">
+            <DialogTitle>编辑用户密钥</DialogTitle>
+            <DialogDescription className="text-sm leading-6">
+              可以修改备注名称；如需更换专用密钥，直接填写新的原始密钥即可。留空则保持当前密钥不变。
+            </DialogDescription>
+          </DialogHeader>
+          <div className="space-y-4">
+            <div className="space-y-2">
+              <label className="text-sm font-medium text-stone-700">名称</label>
+              <Input
+                value={editName}
+                onChange={(event) => setEditName(event.target.value)}
+                placeholder="例如：设计同学 A、运营临时账号"
+                className="h-11 rounded-xl border-stone-200 bg-white"
+              />
+            </div>
+            <div className="space-y-2">
+              <label className="text-sm font-medium text-stone-700">新的专用密钥（可选）</label>
+              <Input
+                value={editKey}
+                onChange={(event) => setEditKey(event.target.value)}
+                placeholder="例如：sk-your-custom-user-key"
+                className="h-11 rounded-xl border-stone-200 bg-white font-mono"
+              />
+              <p className="text-xs leading-5 text-stone-500">
+                保存后旧密钥会立即失效，新密钥生效。系统仍只保存哈希，不会回显当前密钥。
+              </p>
+            </div>
+          </div>
+          <DialogFooter>
+            <Button
+              type="button"
+              variant="secondary"
+              className="h-10 rounded-xl bg-stone-100 px-5 text-stone-700 hover:bg-stone-200"
+              onClick={() => {
+                setEditingItem(null);
+                setEditKey("");
+              }}
+              disabled={editingItem ? pendingIds.has(editingItem.id) : false}
+            >
+              取消
+            </Button>
+            <Button
+              type="button"
+              className="h-10 rounded-xl bg-stone-950 px-5 text-white hover:bg-stone-800"
+              onClick={() => void handleEdit()}
+              disabled={editingItem ? pendingIds.has(editingItem.id) : false}
+            >
+              {editingItem && pendingIds.has(editingItem.id) ? <LoaderCircle className="size-4 animate-spin" /> : <Pencil className="size-4" />}
+              保存
+            </Button>
+          </DialogFooter>
+        </DialogContent>
+      </Dialog>
     </>
   );
 }

web/src/components/top-nav.tsx

@@ -6,8 +6,9 @@ import { Github } from "lucide-react";
 import { usePathname, useRouter } from "next/navigation";
 
 import webConfig from "@/constants/common-env";
-import { clearStoredAuthSession, getStoredAuthSession, type StoredAuthSession } from "@/store/auth";
+import { getValidatedAuthSession } from "@/lib/auth-session";
 import { cn } from "@/lib/utils";
+import { clearStoredAuthSession, type StoredAuthSession } from "@/store/auth";
 
 const adminNavItems = [
   { href: "/image", label: "画图" },
@@ -37,7 +38,7 @@ export function TopNav() {
         return;
       }
 
-      const storedSession = await getStoredAuthSession();
+      const storedSession = await getValidatedAuthSession();
       if (!active) {
         return;
       }

web/src/lib/api.ts

@@ -341,7 +341,7 @@ export async function createUserKey(name: string) {
   });
 }
 
-export async function updateUserKey(keyId: string, updates: { enabled?: boolean; name?: string }) {
+export async function updateUserKey(keyId: string, updates: { enabled?: boolean; name?: string; key?: string }) {
   return httpRequest<{ item: UserKey; items: UserKey[] }>(`/api/auth/users/${keyId}`, {
     method: "POST",
     body: updates,

web/src/lib/auth-session.ts

@@ -0,0 +1,26 @@
+"use client";
+
+import { login } from "@/lib/api";
+import { clearStoredAuthSession, getStoredAuthSession, setStoredAuthSession, type StoredAuthSession } from "@/store/auth";
+
+export async function getValidatedAuthSession(): Promise<StoredAuthSession | null> {
+  const storedSession = await getStoredAuthSession();
+  if (!storedSession) {
+    return null;
+  }
+
+  try {
+    const data = await login(storedSession.key);
+    const nextSession: StoredAuthSession = {
+      key: storedSession.key,
+      role: data.role,
+      subjectId: data.subject_id,
+      name: data.name,
+    };
+    await setStoredAuthSession(nextSession);
+    return nextSession;
+  } catch {
+    await clearStoredAuthSession();
+    return null;
+  }
+}

web/src/lib/use-auth-guard.ts

@@ -3,9 +3,9 @@
 import { useEffect, useState } from "react";
 import { useRouter } from "next/navigation";
 
+import { getValidatedAuthSession } from "@/lib/auth-session";
 import {
   getDefaultRouteForRole,
-  getStoredAuthSession,
   type AuthRole,
   type StoredAuthSession,
 } from "@/store/auth";
@@ -26,7 +26,7 @@ export function useAuthGuard(allowedRoles?: AuthRole[]): UseAuthGuardResult {
 
     const load = async () => {
       const roleList = allowedRolesKey ? (allowedRolesKey.split(",") as AuthRole[]) : [];
-      const storedSession = await getStoredAuthSession();
+      const storedSession = await getValidatedAuthSession();
       if (!active) {
         return;
       }
@@ -66,7 +66,7 @@ export function useRedirectIfAuthenticated() {
     let active = true;
 
     const load = async () => {
-      const storedSession = await getStoredAuthSession();
+      const storedSession = await getValidatedAuthSession();
       if (!active) {
         return;
       }