buff/backend/app/api/admin/keys.py

"""
密钥管理接口
"""
from fastapi import APIRouter, Depends
from sqlalchemy.orm import Session
from fastapi import Body
from app.database import get_db
from app.api.deps import get_current_admin
from app.models.api_key import APIKey
from app.models.key_rotation_config import KeyRotationConfig
from app.core.encrypt import encryptor
from datetime import datetime, timedelta
from app.config import settings

router = APIRouter()

@router.get("/current")
async def get_current_key(
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """获取当前密钥"""
    key = db.query(APIKey).filter(APIKey.is_active == 1).order_by(APIKey.key_version.desc()).first()
    
    if not key:
        return {"code": 404, "msg": "未找到激活的密钥"}
    
    return {
        "code": 200,
        "msg": "成功",
        "data": {
            "public_key": key.public_key,
            "private_key": key.private_key,
            "key_version": key.key_version,
            "expire_at": key.expire_at.isoformat() if key.expire_at else None
        }
    }

@router.get("/history")
async def get_key_history(
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """获取历史密钥"""
    keys = db.query(APIKey).order_by(APIKey.key_version.desc()).all()
    
    return {
        "code": 200,
        "msg": "成功",
        "data": [
            {
                "id": k.id,
                "key_version": k.key_version,
                "is_active": bool(k.is_active),
                "created_at": k.created_at.isoformat() if k.created_at else None,
                "expire_at": k.expire_at.isoformat() if k.expire_at else None
            }
            for k in keys
        ]
    }

@router.post("/rotate")
async def rotate_key(
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """立即更新密钥"""
    # 获取当前激活的密钥
    current_key = db.query(APIKey).filter(APIKey.is_active == 1).order_by(APIKey.key_version.desc()).first()
    
    # 生成新密钥
    new_key_pair = encryptor.generate_key_pair()
    new_version = (current_key.key_version + 1) if current_key else 1
    
    # 获取配置，确定过期时间
    config = db.query(KeyRotationConfig).first()
    rotation_days = config.rotation_days if config else settings.KEY_ROTATION_DAYS
    expire_at = datetime.now() + timedelta(days=rotation_days)
    
    # 禁用旧密钥
    if current_key:
        current_key.is_active = 0
        current_key.updated_at = datetime.now()
    
    # 创建新密钥
    new_key = APIKey(
        public_key=new_key_pair['public_key'],
        private_key=new_key_pair['private_key'],
        key_version=new_version,
        is_active=1,
        expire_at=expire_at,
        created_at=datetime.now(),
        updated_at=datetime.now()
    )
    db.add(new_key)
    db.commit()
    
    return {
        "code": 200,
        "msg": "密钥更新成功",
        "data": {
            "public_key": new_key.public_key,
            "private_key": new_key.private_key,
            "key_version": new_key.key_version,
            "expire_at": new_key.expire_at.isoformat() if new_key.expire_at else None
        }
    }

@router.put("/cycle")
async def update_key_cycle(
    req: dict = Body(...),
    db: Session = Depends(get_db),
    current_admin = Depends(get_current_admin)
):
    """更新密钥轮换周期"""
    rotation_days = req.get("rotation_days")
    if not rotation_days or rotation_days < 1:
        return {"code": 400, "msg": "轮换周期必须大于0"}
    
    # 获取或创建配置
    config = db.query(KeyRotationConfig).first()
    if not config:
        config = KeyRotationConfig(
            rotation_days=rotation_days,
            is_auto_rotate=1,
            updated_at=datetime.now()
        )
        db.add(config)
    else:
        config.rotation_days = rotation_days
        config.updated_at = datetime.now()
    
    db.commit()
    return {"code": 200, "msg": "更新成功"}