Sakurasan
ef3025dd80
Major rewrite of the Go backend to support:
- Three API format imports: openai, anthropic, compatible
- Three protocol conversions: Chat Completions, Responses, Messages
- Hub-and-spoke architecture with Chat as intermediate format
Deleted:
- opencat.go (old entry)
- store/, team/, pkg/team/, pkg/store/ (old data layer)
- internal/model/, internal/consts/ (old types)
- internal/service/team/, internal/controller/team/ (old handlers)
- llm/ (removed LLM client library, pure proxy mode)
- dist/, assets/ (old build artifacts)
Added:
- internal/store/ — 9 GORM models + multi-DB support
- internal/pkg/ — crypto (AES-GCM), apikey, jwt, ratelimit, resp, tokenizer
- internal/channel/ — channel selection, weighted LB, health checks
- internal/proxy/convert/ — 6 protocol conversion functions + SSE streaming
- internal/proxy/ — gateway with request dispatch and upstream selection
- internal/usage/ — async usage recorder with batch writes
- internal/api/ — management API (auth, users, keys, channels, models)
- Makefile for build/test/deploy
Fixed API to match frontend expectations:
- Login response wraps token in { data: { token } }
- GET /api/profile route added
- Profile response wraps user in { code, data }
- Role returned as number (10=admin, 1=user)
106 lines
2.4 KiB
Go
106 lines
2.4 KiB
Go
package crypto
|
|
|
|
import (
|
|
"crypto/aes"
|
|
"crypto/cipher"
|
|
"crypto/rand"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"encoding/hex"
|
|
"errors"
|
|
"io"
|
|
"os"
|
|
)
|
|
|
|
func defaultKey() []byte {
|
|
key := os.Getenv("ENCRYPT_KEY")
|
|
if key == "" {
|
|
key = "opencatd-default-key-change-me"
|
|
}
|
|
h := sha256.Sum256([]byte(key))
|
|
return h[:] // 32 bytes
|
|
}
|
|
|
|
// Encrypt encrypts plaintext using AES-GCM with the default key
|
|
func Encrypt(plaintext string) (string, error) {
|
|
enc, err := NewEncryptor(defaultKey())
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return enc.Encrypt(plaintext)
|
|
}
|
|
|
|
// Decrypt decrypts ciphertext using AES-GCM with the default key
|
|
func Decrypt(encoded string) (string, error) {
|
|
enc, err := NewEncryptor(defaultKey())
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return enc.Decrypt(encoded)
|
|
}
|
|
|
|
// Sha256Hex is a convenience wrapper for SHA-256 hex hashing
|
|
func Sha256Hex(data string) string {
|
|
h := sha256.Sum256([]byte(data))
|
|
return hex.EncodeToString(h[:])
|
|
}
|
|
|
|
// Encryptor AES-GCM 加密器
|
|
type Encryptor struct {
|
|
key []byte
|
|
}
|
|
|
|
// NewEncryptor 创建加密器（key 为 16/24/32 字节）
|
|
func NewEncryptor(key []byte) (*Encryptor, error) {
|
|
switch len(key) {
|
|
case 16, 24, 32:
|
|
default:
|
|
return nil, errors.New("crypto: invalid key length, must be 16, 24, or 32 bytes")
|
|
}
|
|
return &Encryptor{key: key}, nil
|
|
}
|
|
|
|
// Encrypt AES-GCM 加密，返回 base64 编码的密文
|
|
func (e *Encryptor) Encrypt(plaintext string) (string, error) {
|
|
block, err := aes.NewCipher(e.key)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
gcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
nonce := make([]byte, gcm.NonceSize())
|
|
if _, err := io.ReadFull(rand.Reader, nonce); err != nil {
|
|
return "", err
|
|
}
|
|
ciphertext := gcm.Seal(nonce, nonce, []byte(plaintext), nil)
|
|
return base64.StdEncoding.EncodeToString(ciphertext), nil
|
|
}
|
|
|
|
// Decrypt AES-GCM 解密
|
|
func (e *Encryptor) Decrypt(encoded string) (string, error) {
|
|
data, err := base64.StdEncoding.DecodeString(encoded)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
block, err := aes.NewCipher(e.key)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
gcm, err := cipher.NewGCM(block)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
nonceSize := gcm.NonceSize()
|
|
if len(data) < nonceSize {
|
|
return "", errors.New("ciphertext too short")
|
|
}
|
|
nonce, ciphertext := data[:nonceSize], data[nonceSize:]
|
|
plaintext, err := gcm.Open(nil, nonce, ciphertext, nil)
|
|
if err != nil {
|
|
return "", err
|
|
}
|
|
return string(plaintext), nil
|
|
}
|