feat(manager): add resource and provider management APIs (#21)

* feat(manager): add platform resource APIs with version snapshots (#7)

Enable admin CRUD and authenticated listing for platform resources, and persist config snapshots on create/update to support versioned resource management.

* feat(manager): secure resource access keys and add provider templates (#7)

Remove credential_ref from manager resource contracts, encrypt access_key at rest, and require password re-auth for reveal to tighten sensitive data handling.

Add provider_templates CRUD with field schema validation so providers can define dynamic config templates without mixing base_url/access_key into config.

Author: LiusCraft

cmd/manager/main.go

@@ -15,7 +15,11 @@ import (
 	"github.com/liuscraft/orion-x/internal/logging"
 	"github.com/liuscraft/orion-x/internal/manager/app"
 	"github.com/liuscraft/orion-x/internal/manager/auth"
+	"github.com/liuscraft/orion-x/internal/manager/contracts"
 	"github.com/liuscraft/orion-x/internal/manager/httpapi"
+	"github.com/liuscraft/orion-x/internal/manager/platformresource"
+	"github.com/liuscraft/orion-x/internal/manager/providertemplate"
+	"github.com/liuscraft/orion-x/internal/manager/security"
 	"github.com/liuscraft/orion-x/internal/manager/storage"
 )
 
@@ -64,13 +68,41 @@ func main() {
 	authService := auth.NewService(userRepository, authTokenManager)
 	authHandler := httpapi.NewAuthHandler(authService)
 	authMiddleware := httpapi.NewAuthMiddleware(authService)
+	accessKeyCipher, err := security.NewAESCipher(appConfig.Security.AccessKeyCipherSecret)
+	if err != nil {
+		logging.Fatalf("Init manager access key cipher failed: %v", err)
+	}
+	platformResourceRepository := storage.NewPlatformResourceRepository(store.DB())
+	platformResourceService := platformresource.NewService(platformResourceRepository, accessKeyCipher)
+	platformResourceHandler := httpapi.NewPlatformResourceHandler(platformResourceService, authService)
+	providerTemplateRepository := storage.NewProviderTemplateRepository(store.DB())
+	providerTemplateService := providertemplate.NewService(providerTemplateRepository)
+	providerTemplateHandler := httpapi.NewProviderTemplateHandler(providerTemplateService)
 
 	router := http.NewServeMux()
 	router.Handle(appConfig.Server.HealthPath, healthHandler)
 	router.Handle("/api/v1/auth/register", http.HandlerFunc(authHandler.Register))
 	router.Handle("/api/v1/auth/login", http.HandlerFunc(authHandler.Login))
 	router.Handle("/api/v1/auth/refresh", http.HandlerFunc(authHandler.Refresh))
 	router.Handle("/api/v1/auth/logout", authMiddleware.RequireAuth(http.HandlerFunc(authHandler.Logout)))
+	router.Handle(
+		"/api/v1/admin/platform-resources",
+		authMiddleware.RequireAuth(authMiddleware.RequireRole(contracts.RoleAdmin)(http.HandlerFunc(platformResourceHandler.Create))),
+	)
+	router.Handle(
+		"/api/v1/admin/platform-resources/",
+		authMiddleware.RequireAuth(authMiddleware.RequireRole(contracts.RoleAdmin)(http.HandlerFunc(platformResourceHandler.ByID))),
+	)
+	router.Handle("/api/v1/platform-resources", authMiddleware.RequireAuth(http.HandlerFunc(platformResourceHandler.List)))
+	router.Handle(
+		"/api/v1/admin/provider-templates",
+		authMiddleware.RequireAuth(authMiddleware.RequireRole(contracts.RoleAdmin)(http.HandlerFunc(providerTemplateHandler.Create))),
+	)
+	router.Handle(
+		"/api/v1/admin/provider-templates/",
+		authMiddleware.RequireAuth(authMiddleware.RequireRole(contracts.RoleAdmin)(http.HandlerFunc(providerTemplateHandler.ByID))),
+	)
+	router.Handle("/api/v1/provider-templates", authMiddleware.RequireAuth(http.HandlerFunc(providerTemplateHandler.List)))
 
 	server := httpapi.NewServer(appConfig.Server, router)
 	lifecycle := app.NewLifecycle(appConfig.Migration.AutoMigrateOnStartup, migrator, server)

docs/manager-api-types.md

@@ -128,9 +128,10 @@ const (
 | resource_key | text unique | 资源唯一标识 |
 | name | text | 展示名 |
 | schema_version | int | 配置 schema 版本 |
+| base_url | text | 资源请求基地址 |
+| access_key | text | 访问密钥密文（数据库不存明文） |
 | capabilities | jsonb | 能力标签 |
 | config | jsonb | 非敏感配置 |
-| credential_ref | text | 密钥引用 |
 | status | text | `active/inactive` |
 | created_by | uuid | 创建人 |
 | created_at | timestamptz | 创建时间 |
@@ -148,8 +149,9 @@ const (
 | id | uuid pk | 主键 |
 | entry_id | uuid | 关联 `platform_resources.id` |
 | version | int | 版本号（从 1 递增） |
+| base_url_snapshot | text | `base_url` 快照 |
+| access_key_snapshot | text | `access_key` 密文快照 |
 | config_snapshot | jsonb | 配置快照 |
-| credential_ref_snapshot | text | 凭据引用快照 |
 | published_at | timestamptz | 发布时间 |
 
 ### 4.4 `tool_market_items`
@@ -287,8 +289,16 @@ const (
 - `GET /api/v1/platform-resources?category=...&provider=...&status=...`
 - `PATCH /api/v1/admin/platform-resources/:id`
 - `DELETE /api/v1/admin/platform-resources/:id`
+- `POST /api/v1/admin/platform-resources/:id/access-key/reveal`
 
-### 5.3 工具市场 + 开通 + 用户工具仓库
+### 5.3 provider 模板（admin 写，用户读）
+
+- `POST /api/v1/admin/provider-templates`
+- `GET /api/v1/provider-templates?category=...&provider=...&status=...`
+- `PATCH /api/v1/admin/provider-templates/:id`
+- `DELETE /api/v1/admin/provider-templates/:id`
+
+### 5.4 工具市场 + 开通 + 用户工具仓库
 
 - `POST /api/v1/admin/tool-market/items`
 - `GET /api/v1/tool-market/items`
@@ -301,7 +311,7 @@ const (
 - `GET /api/v1/me/tool-repo/:entitlement_id/usage`
 - `POST /api/v1/admin/tool-entitlements/grant`
 
-### 5.4 voicebot + 设备
+### 5.5 voicebot + 设备
 
 - `POST /api/v1/voicebots`
 - `GET /api/v1/voicebots`
@@ -313,7 +323,7 @@ const (
 - `PATCH /api/v1/devices/:id`
 - `PUT /api/v1/devices/:device_id/binding`
 
-### 5.5 ws-server 内部解析
+### 5.6 ws-server 内部解析
 
 - `GET /internal/v1/devices/:device_id/resolve`
 
@@ -328,12 +338,12 @@ const (
   "resource_key": "llm-zhipu-prod",
   "name": "Zhipu Production",
   "schema_version": 1,
+  "base_url": "https://open.bigmodel.cn/api/coding/paas/v4",
+  "access_key": "sk-prod-xxx",
   "capabilities": {"stream": true},
   "config": {
-    "base_url": "https://open.bigmodel.cn/api/coding/paas/v4",
     "model": "glm-4-flash"
-  },
-  "credential_ref": "secret://manager/llm/zhipu/prod"
+  }
 }
 ```
 

docs/voicebot-todo.md

@@ -181,7 +181,9 @@
   - [x] GORM + PostgreSQL 基础接入（连接、迁移、健康检查）
   - [x] users/auth 模块（注册 + JWT 登录/刷新 + RBAC）
   - [x] web-ui 管理后台骨架（登录态、鉴权拦截、RBAC 菜单）
-  - [ ] platform_resources 模块（LLM/ASR/TTS 资源管理）
+  - [x] platform_resources 模块（LLM/ASR/TTS 资源管理）
+  - [x] provider_templates 模块（模板字段定义 + CRUD）
+  - [x] platform_resources 安全改造（移除 credential_ref、access_key 加密存储、reveal 二次认证）
   - [ ] tool_market 模块（市场、offer、entitlement、tool repo）
   - [ ] voicebots/devices/device_bindings 模块
   - [ ] internal resolve API（`/internal/v1/devices/:device_id/resolve`）

internal/config/manager_config.go

@@ -16,6 +16,7 @@ type ManagerAppConfig struct {
 	Logging   LoggingConfig          `json:"logging"`
 	Server    ManagerServerConfig    `json:"server"`
 	Database  ManagerDatabaseConfig  `json:"database"`
+	Security  ManagerSecurityConfig  `json:"security"`
 	Auth      ManagerAuthConfig      `json:"auth"`
 	Migration ManagerMigrationConfig `json:"migration"`
 }
@@ -40,6 +41,10 @@ type ManagerMigrationConfig struct {
 	AutoMigrateOnStartup bool `json:"auto_migrate_on_startup"`
 }
 
+type ManagerSecurityConfig struct {
+	AccessKeyCipherSecret string `json:"access_key_cipher_secret"`
+}
+
 type ManagerAuthConfig struct {
 	JWTSecret              string `json:"jwt_secret"`
 	Issuer                 string `json:"issuer"`
@@ -64,6 +69,9 @@ func DefaultManagerConfig() *ManagerAppConfig {
 			ConnMaxIdleTimeMs: 120000,
 			PingTimeoutMs:     2000,
 		},
+		Security: ManagerSecurityConfig{
+			AccessKeyCipherSecret: "manager-dev-access-key-cipher-secret",
+		},
 		Auth: ManagerAuthConfig{
 			JWTSecret:              "manager-dev-jwt-secret",
 			Issuer:                 "orion-x-manager",
@@ -144,6 +152,10 @@ func (c *ManagerAppConfig) ApplyEnv() {
 		}
 	}
 
+	if secret := strings.TrimSpace(os.Getenv("MANAGER_ACCESS_KEY_CIPHER_SECRET")); secret != "" {
+		c.Security.AccessKeyCipherSecret = secret
+	}
+
 	if secret := strings.TrimSpace(os.Getenv("MANAGER_AUTH_JWT_SECRET")); secret != "" {
 		c.Auth.JWTSecret = secret
 	}
@@ -201,6 +213,10 @@ func (c *ManagerAppConfig) Validate() error {
 		return errors.New("database.ping_timeout_ms must be > 0")
 	}
 
+	if strings.TrimSpace(c.Security.AccessKeyCipherSecret) == "" {
+		return errors.New("security.access_key_cipher_secret must not be empty")
+	}
+
 	if strings.TrimSpace(c.Auth.JWTSecret) == "" {
 		return errors.New("auth.jwt_secret must not be empty")
 	}

internal/config/manager_config_test.go

@@ -21,6 +21,7 @@ func TestLoadManager_MergesDefaultsAndEnv(t *testing.T) {
 	t.Setenv("MANAGER_SERVER_ADDRESS", "127.0.0.1:9100")
 	t.Setenv("MANAGER_DB_DSN", "host=127.0.0.1 user=postgres password=postgres dbname=override port=5432 sslmode=disable")
 	t.Setenv("MANAGER_DB_MAX_OPEN_CONNS", "25")
+	t.Setenv("MANAGER_ACCESS_KEY_CIPHER_SECRET", "cipher-secret")
 	t.Setenv("MANAGER_AUTH_JWT_SECRET", "test-secret")
 	t.Setenv("MANAGER_AUTH_ACCESS_TOKEN_TTL_SECONDS", "120")
 
@@ -41,6 +42,9 @@ func TestLoadManager_MergesDefaultsAndEnv(t *testing.T) {
 	if cfg.Database.MaxOpenConns != 25 {
 		t.Fatalf("expected MANAGER_DB_MAX_OPEN_CONNS override, got %d", cfg.Database.MaxOpenConns)
 	}
+	if cfg.Security.AccessKeyCipherSecret != "cipher-secret" {
+		t.Fatalf("expected MANAGER_ACCESS_KEY_CIPHER_SECRET override, got %q", cfg.Security.AccessKeyCipherSecret)
+	}
 	if cfg.Server.HealthPath != "/health" {
 		t.Fatalf("expected health path from file, got %q", cfg.Server.HealthPath)
 	}
@@ -79,6 +83,9 @@ func TestLoadManager_DefaultFallback(t *testing.T) {
 	if cfg.Database.DSN == "" {
 		t.Fatalf("expected default database dsn")
 	}
+	if cfg.Security.AccessKeyCipherSecret == "" {
+		t.Fatalf("expected default access key cipher secret")
+	}
 	if cfg.Auth.JWTSecret == "" {
 		t.Fatalf("expected default auth jwt secret")
 	}
@@ -91,3 +98,11 @@ func TestManagerConfigValidate_AuthSecretRequired(t *testing.T) {
 		t.Fatalf("expected missing auth.jwt_secret error")
 	}
 }
+
+func TestManagerConfigValidate_AccessKeyCipherSecretRequired(t *testing.T) {
+	cfg := DefaultManagerConfig()
+	cfg.Security.AccessKeyCipherSecret = ""
+	if err := cfg.Validate(); err == nil {
+		t.Fatalf("expected missing security.access_key_cipher_secret error")
+	}
+}

internal/manager/auth/service.go

@@ -188,6 +188,35 @@ func (s *Service) Authenticate(ctx context.Context, accessToken string) (Princip
 	}, nil
 }
 
+func (s *Service) Reauthenticate(ctx context.Context, userID uuid.UUID, password string) error {
+	if err := s.validateReady(); err != nil {
+		return err
+	}
+	if userID == uuid.Nil || strings.TrimSpace(password) == "" {
+		return fmt.Errorf("%w: user_id and password are required", ErrInvalidArgument)
+	}
+
+	user, err := s.users.GetByID(ctx, userID)
+	if err != nil {
+		if errors.Is(err, ErrUserNotFound) {
+			return ErrUnauthorized
+		}
+		return fmt.Errorf("load user by id: %w", err)
+	}
+
+	if !isSupportedRole(user.Role) || !isSupportedStatus(user.Status) {
+		return ErrUnauthorized
+	}
+	if user.Status != contracts.UserStatusActive {
+		return ErrForbidden
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.PasswordHash), []byte(password)); err != nil {
+		return ErrInvalidCredentials
+	}
+
+	return nil
+}
+
 func HashPassword(password string) (string, error) {
 	if strings.TrimSpace(password) == "" {
 		return "", fmt.Errorf("%w: password is required", ErrInvalidArgument)

internal/manager/auth/service_test.go

@@ -342,3 +342,43 @@ func TestService_RegisterConflict(t *testing.T) {
 		t.Fatalf("expected ErrConflict, got %v", err)
 	}
 }
+
+func TestService_Reauthenticate(t *testing.T) {
+	passwordHash, err := HashPassword("P@ssw0rd")
+	if err != nil {
+		t.Fatalf("HashPassword() error = %v", err)
+	}
+
+	userID := uuid.New()
+	user := User{
+		ID:           userID,
+		Email:        "reauth@example.com",
+		PasswordHash: passwordHash,
+		Role:         contracts.RoleAdmin,
+		Status:       contracts.UserStatusActive,
+	}
+
+	repo := &fakeUserRepository{
+		byID:    map[uuid.UUID]User{userID: user},
+		byEmail: map[string]User{"reauth@example.com": user},
+	}
+	tokens, err := NewJWTManager(JWTManagerConfig{
+		Secret:     "unit-test-secret",
+		Issuer:     "unit-test",
+		AccessTTL:  5 * time.Minute,
+		RefreshTTL: 30 * time.Minute,
+	})
+	if err != nil {
+		t.Fatalf("NewJWTManager() error = %v", err)
+	}
+
+	service := NewService(repo, tokens)
+
+	if err := service.Reauthenticate(context.Background(), userID, "P@ssw0rd"); err != nil {
+		t.Fatalf("Reauthenticate() error = %v", err)
+	}
+
+	if err := service.Reauthenticate(context.Background(), userID, "bad-password"); !errors.Is(err, ErrInvalidCredentials) {
+		t.Fatalf("expected ErrInvalidCredentials, got %v", err)
+	}
+}