From 879a7801670df7f10bdf299de74e6f28b4bc59c0 Mon Sep 17 00:00:00 2001
From: dyhhhhh <63825522+dyhhhhhh@users.noreply.github.com>
Date: Fri, 14 Aug 2026 09:52:01 +0800
Subject: [PATCH] =?UTF-8?q?fix(security):=20=E7=B3=BB=E7=BB=9F=E6=B8=A0?=
 =?UTF-8?q?=E9=81=93=E5=AF=86=E9=92=A5=20-=20=E5=8A=A0=E5=AF=86=E8=90=BD?=
 =?UTF-8?q?=E5=BA=93=E5=B9=B6=E5=9C=A8=E8=BF=90=E8=A1=8C=E6=97=B6=E8=A7=A3?=
 =?UTF-8?q?=E5=AF=86?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: dyhhhhhqwer <1613203335@qq.com>
Original-PR: https://github.com/ddcat-ai/open-ai-canvas/pull/202
---
 backend/internal/service/admin.go          | 57 +++++++++++++++++++++-
 backend/internal/service/channel_models.go |  4 +-
 backend/internal/service/provider.go       |  2 +-
 3 files changed, 59 insertions(+), 4 deletions(-)

diff --git a/backend/internal/service/admin.go b/backend/internal/service/admin.go
index 7313f4a80..52bb84f58 100644
--- a/backend/internal/service/admin.go
+++ b/backend/internal/service/admin.go
@@ -447,7 +447,25 @@ func (s *Service) PublicSystemChannels() ([]PublicModelChannel, error) {
 }
 
 func (s *Service) SystemChannel(id string) (*model.ModelChannel, error) {
-	return s.repo.SystemChannel(id)
+	channel, err := s.repo.SystemChannel(id)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.decryptSystemChannelSecrets(channel); err != nil {
+		return nil, err
+	}
+	return channel, nil
+}
+
+func (s *Service) adminSystemChannel(id string) (*model.ModelChannel, error) {
+	channel, err := s.repo.AdminSystemChannel(id)
+	if err != nil {
+		return nil, err
+	}
+	if err := s.decryptSystemChannelSecrets(channel); err != nil {
+		return nil, err
+	}
+	return channel, nil
 }
 
 func (s *Service) AdminSystemChannelPage(actor *model.User, query AdminListQuery) (*AdminChannelPage, error) {
@@ -488,6 +506,9 @@ func (s *Service) CreateSystemChannel(actor *model.User, req ChannelRequest) (*P
 	if err != nil {
 		return nil, err
 	}
+	if err := s.encryptSystemChannelSecrets(&channel); err != nil {
+		return nil, err
+	}
 	if err := s.repo.Create(&channel); err != nil {
 		return nil, err
 	}
@@ -510,6 +531,9 @@ func (s *Service) UpdateSystemChannel(actor *model.User, id string, req ChannelR
 	if err != nil {
 		return nil, err
 	}
+	if err := s.decryptSystemChannelSecrets(channel); err != nil {
+		return nil, err
+	}
 	req = mergeChannelRequest(req, *channel)
 	next, err := channelFromRequest(req, *channel)
 	if err != nil {
@@ -525,6 +549,9 @@ func (s *Service) UpdateSystemChannel(actor *model.User, id string, req ChannelR
 	if req.SecretKey == "" {
 		next.SecretKey = channel.SecretKey
 	}
+	if err := s.encryptSystemChannelSecrets(&next); err != nil {
+		return nil, err
+	}
 	if err := s.repo.Save(&next); err != nil {
 		return nil, err
 	}
@@ -539,6 +566,34 @@ func (s *Service) UpdateSystemChannel(actor *model.User, id string, req ChannelR
 	return &public, nil
 }
 
+func (s *Service) encryptSystemChannelSecrets(channel *model.ModelChannel) error {
+	apiKey, err := s.encryptSettingSecret(channel.APIKey)
+	if err != nil {
+		return err
+	}
+	secretKey, err := s.encryptSettingSecret(channel.SecretKey)
+	if err != nil {
+		return err
+	}
+	channel.APIKey = apiKey
+	channel.SecretKey = secretKey
+	return nil
+}
+
+func (s *Service) decryptSystemChannelSecrets(channel *model.ModelChannel) error {
+	apiKey, err := s.decryptSettingSecret(channel.APIKey)
+	if err != nil {
+		return err
+	}
+	secretKey, err := s.decryptSettingSecret(channel.SecretKey)
+	if err != nil {
+		return err
+	}
+	channel.APIKey = apiKey
+	channel.SecretKey = secretKey
+	return nil
+}
+
 func (s *Service) DeleteSystemChannel(actor *model.User, id string) error {
 	if err := s.RequireAdmin(actor); err != nil {
 		return err
diff --git a/backend/internal/service/channel_models.go b/backend/internal/service/channel_models.go
index 4dbde0715..adfb7a6c7 100644
--- a/backend/internal/service/channel_models.go
+++ b/backend/internal/service/channel_models.go
@@ -88,7 +88,7 @@ func (s *Service) FetchAdminChannelModels(ctx context.Context, actor *model.User
 	if err := s.RequireAdmin(actor); err != nil {
 		return nil, err
 	}
-	channel, err := s.repo.AdminSystemChannel(channelID)
+	channel, err := s.adminSystemChannel(channelID)
 	if err != nil {
 		return nil, err
 	}
@@ -226,7 +226,7 @@ func (s *Service) TestAdminChannelModel(ctx context.Context, actor *model.User,
 	if err := s.RequireAdmin(actor); err != nil {
 		return nil, err
 	}
-	channel, err := s.repo.AdminSystemChannel(channelID)
+	channel, err := s.adminSystemChannel(channelID)
 	if err != nil {
 		return nil, err
 	}
diff --git a/backend/internal/service/provider.go b/backend/internal/service/provider.go
index 7dc9a794d..6d4d44d80 100644
--- a/backend/internal/service/provider.go
+++ b/backend/internal/service/provider.go
@@ -572,7 +572,7 @@ func (s *Service) resolveProviderConfig(config providerConfig) (providerConfig,
 		}
 		return config, nil
 	}
-	channel, err := s.repo.SystemChannel(channelID)
+	channel, err := s.SystemChannel(channelID)
 	if err != nil {
 		return providerConfig{}, errors.New("系统渠道不存在或已停用")
 	}