@@ -139,6 +209,8 @@
let whitelistControlEnabled = initialWhitelistControlEnabled;
let chatWhitelistSaving = false;
let users = [];
+ let availableModels = [];
+ let selectedUserIds = new Set();
let editingUserId = null;
let currentPage = 1;
let pageSize = 50;
@@ -148,13 +220,49 @@
let currentSearchKeyword = '';
let activeCustomSelect = null;
let editModalInstance = null;
+ let permissionModalInstance = null;
+ let permissionDetailModalInstance = null;
let pendingDeleteUserId = null;
let deletingUserId = null;
+ let permissionTargetUserIds = [];
+ let permissionModalMode = 'single';
+ let permissionDraftMode = 'all';
+ let permissionDraftSelectedModels = new Set();
+ let permissionDraftMixedSource = false;
+ let permissionSaving = false;
+ let activePermissionDetailUser = null;
+ let activeUsersHelpTrigger = null;
+ let activeUsersHelpTopic = null;
let usersSortState = {
key: 'total_tokens',
direction: 'desc',
type: 'number'
};
+ const usersHelpTopics = {
+ whitelist: {
+ title: 'Chat 白名单',
+ html: `
+
启用后会按 IP 校验白名单，只允许已登记用户访问 Chat。
+
同时会继续按用户模型权限控制 Chat 请求和 /v1/models 返回结果。
+ `
+ },
+ permission_allow_all: {
+ title: '允许全部模型',
+ html: `
+
启用后会用 * 表示当前用户可访问全部模型。
+
同时会自动继承当前和后续新增的模型，不需要逐个勾选。
+ `
+ }
+ };
+
+ function escapeHtml(value) {
+ return String(value ?? '')
+ .replace(/&/g, '&')
+ .replace(//g, '>')
+ .replace(/"/g, '"')
+ .replace(/'/g, ''');
+ }
function closeAllCustomSelects() {
document.querySelectorAll('.custom-select.open').forEach(select => {
@@ -175,8 +283,7 @@
}
function formatNumberDisplay(value) {
- const n = normalizeNumber(value);
- return n.toLocaleString();
+ return normalizeNumber(value).toLocaleString();
}
function renderNumber(value) {
@@ -185,19 +292,186 @@
return `
${display}`;
}
+ function getAvailableModelCount() {
+ return Array.isArray(availableModels) ? availableModels.length : 0;
+ }
+
+ function normalizeUserPermissionState(user) {
+ if (!user || user.model_permissions === '*' || user.model_permissions_mode === 'all') {
+ return { mode: 'all', models: [] };
+ }
+ const models = Array.isArray(user.model_permissions)
+ ? user.model_permissions.filter(item => typeof item === 'string' && item.trim())
+ : [];
+ return { mode: 'selected', models: Array.from(new Set(models)) };
+ }
+
+ function getPermissionSignature(user) {
+ const state = normalizeUserPermissionState(user);
+ return state.mode === 'all'
+ ? 'all:*'
+ : `selected:${state.models.slice().sort().join('|')}`;
+ }
+
+ function getSortedSelectedPermissionModels() {
+ const selection = permissionDraftSelectedModels;
+ return availableModels.filter(modelName => selection.has(modelName));
+ }
+
+ function getPermissionPreview(models, limit = 2) {
+ const items = Array.isArray(models) ? models : [];
+ const visible = items.slice(0, limit);
+ return {
+ visible: visible,
+ hiddenCount: Math.max(items.length - visible.length, 0),
+ total: items.length
+ };
+ }
+
+ function updateBatchToolbar() {
+ const controls = document.getElementById('usersBatchControls');
+ const summary = document.getElementById('selectedUsersSummary');
+ const batchButton = document.getElementById('batchSetModelPermissionsBtn');
+ if (!controls || !summary || !batchButton) return;
+
+ const selectedCount = selectedUserIds.size;
+ controls.hidden = !whitelistControlEnabled;
+ summary.textContent = String(selectedCount);
+ batchButton.disabled = selectedCount === 0;
+ }
+
+ function clearUserSelections(shouldRender = true) {
+ selectedUserIds = new Set();
+ if (shouldRender) {
+ renderUsers();
+ } else {
+ updateBatchToolbar();
+ }
+ }
+
+ function syncUserSelectionsToCurrentPage() {
+ const currentUserIds = new Set(users.map(user => Number(user.id)));
+ selectedUserIds = new Set(
+ Array.from(selectedUserIds).filter(userId => currentUserIds.has(Number(userId)))
+ );
+ }
+
+ function areAllCurrentUsersSelected() {
+ if (!users.length) return false;
+ return users.every(user => selectedUserIds.has(Number(user.id)));
+ }
+
+ function toggleSelectAllUsers(checked) {
+ if (!whitelistControlEnabled) return;
+ if (checked) {
+ selectedUserIds = new Set(users.map(user => Number(user.id)));
+ } else {
+ selectedUserIds = new Set();
+ }
+ renderUsers();
+ }
+
+ function toggleUserSelection(userId, checked) {
+ const normalizedUserId = Number(userId);
+ if (!whitelistControlEnabled || !Number.isFinite(normalizedUserId)) return;
+
+ const nextSelection = new Set(selectedUserIds);
+ if (checked) {
+ nextSelection.add(normalizedUserId);
+ } else {
+ nextSelection.delete(normalizedUserId);
+ }
+ selectedUserIds = nextSelection;
+ updateBatchToolbar();
+ const selectAllToggle = document.getElementById('selectAllUsersToggle');
+ if (selectAllToggle) {
+ selectAllToggle.checked = areAllCurrentUsersSelected();
+ }
+ }
+
function updateChatWhitelistUi() {
const card = document.getElementById('chatWhitelistCard');
- const status = document.getElementById('chatWhitelistStatus');
const toggle = document.getElementById('chatWhitelistToggle');
- if (!card || !status || !toggle) return;
+ if (!card || !toggle) return;
card.dataset.enabled = whitelistControlEnabled ? 'true' : 'false';
card.dataset.saving = chatWhitelistSaving ? 'true' : 'false';
toggle.checked = !!whitelistControlEnabled;
toggle.disabled = !!chatWhitelistSaving;
- status.textContent = chatWhitelistSaving
+ toggle.title = chatWhitelistSaving
? '保存中...'
- : (whitelistControlEnabled ? '已启用' : '已禁用');
+ : (whitelistControlEnabled ? 'Chat 白名单已启用' : 'Chat 白名单已禁用');
+ updateBatchToolbar();
+ }
+
+ function getUsersHelpPopoverElement() {
+ return document.getElementById('usersHelpPopover');
+ }
+
+ function hideUsersHelpPopover() {
+ const popover = getUsersHelpPopoverElement();
+ if (!popover) return;
+ popover.hidden = true;
+ popover.style.removeProperty('top');
+ popover.style.removeProperty('left');
+ popover.style.removeProperty('--popover-arrow-left');
+ popover.dataset.placement = 'bottom';
+ activeUsersHelpTrigger = null;
+ activeUsersHelpTopic = null;
+ }
+
+ function syncUsersHelpPopover() {
+ const popover = getUsersHelpPopoverElement();
+ const titleElement = document.getElementById('usersHelpPopoverTitle');
+ const bodyElement = document.getElementById('usersHelpPopoverBody');
+ const topic = activeUsersHelpTopic ? usersHelpTopics[activeUsersHelpTopic] : null;
+ if (!popover || !titleElement || !bodyElement || !activeUsersHelpTrigger || !topic) return;
+
+ titleElement.textContent = topic.title;
+ bodyElement.innerHTML = topic.html;
+
+ popover.hidden = false;
+
+ const triggerRect = activeUsersHelpTrigger.getBoundingClientRect();
+ const popoverRect = popover.getBoundingClientRect();
+ const offset = 12;
+ const viewportPadding = 12;
+ const canPlaceBottom = triggerRect.bottom + offset + popoverRect.height <= window.innerHeight - viewportPadding;
+ const shouldPlaceBottom = canPlaceBottom || triggerRect.top < popoverRect.height + viewportPadding + offset;
+ const top = shouldPlaceBottom
+ ? Math.min(window.innerHeight - popoverRect.height - viewportPadding, triggerRect.bottom + offset)
+ : Math.max(viewportPadding, triggerRect.top - popoverRect.height - offset);
+ const left = Math.min(
+ window.innerWidth - popoverRect.width - viewportPadding,
+ Math.max(viewportPadding, triggerRect.left + ((triggerRect.width - popoverRect.width) / 2))
+ );
+ const arrowLeft = Math.min(
+ popoverRect.width - 18,
+ Math.max(18, (triggerRect.left + (triggerRect.width / 2)) - left)
+ );
+
+ popover.dataset.placement = shouldPlaceBottom ? 'bottom' : 'top';
+ popover.style.top = `${top}px`;
+ popover.style.left = `${left}px`;
+ popover.style.setProperty('--popover-arrow-left', `${arrowLeft}px`);
+ }
+
+ function toggleUsersHelp(topic, event) {
+ event?.preventDefault();
+ event?.stopPropagation();
+
+ const normalizedTopic = String(topic || '').trim();
+ const trigger = event?.currentTarget || document.querySelector(`[data-users-help-topic="${normalizedTopic}"]`);
+ if (!trigger || !usersHelpTopics[normalizedTopic]) return;
+
+ if (activeUsersHelpTrigger === trigger && activeUsersHelpTopic === normalizedTopic) {
+ hideUsersHelpPopover();
+ return;
+ }
+
+ activeUsersHelpTrigger = trigger;
+ activeUsersHelpTopic = normalizedTopic;
+ syncUsersHelpPopover();
}
async function toggleChatWhitelist(enabled) {
@@ -205,6 +479,10 @@
whitelistControlEnabled = !!enabled;
chatWhitelistSaving = true;
updateChatWhitelistUi();
+ if (!whitelistControlEnabled) {
+ clearUserSelections(false);
+ closePermissionModal();
+ }
renderUsers();
try {
@@ -218,6 +496,10 @@
throw new Error(result.error || '更新 Chat 白名单失败');
}
whitelistControlEnabled = !!result.enabled;
+ if (!whitelistControlEnabled) {
+ clearUserSelections(false);
+ closePermissionModal();
+ }
showMessage(`Chat 白名单已${whitelistControlEnabled ? '启用' : '禁用'}`, 'success');
} catch (error) {
console.error('更新 Chat 白名单失败:', error);
@@ -321,7 +603,6 @@
renderCustomSelectOptions(selectId);
}
- // 页面加载时初始化
document.addEventListener('DOMContentLoaded', function() {
initThemeToggle();
updateChatWhitelistUi();
@@ -330,6 +611,7 @@
loadUsers();
document.getElementById('pageSizeSelect').value = pageSize;
syncCustomSelectValue('pageSizeSelect');
+
const editModalElement = document.getElementById('editModal');
if (editModalElement && window.bootstrap) {
editModalInstance = new bootstrap.Modal(editModalElement);
@@ -337,6 +619,37 @@
editingUserId = null;
});
}
+
+ const permissionModalElement = document.getElementById('permissionModal');
+ if (permissionModalElement && window.bootstrap) {
+ permissionModalInstance = new bootstrap.Modal(permissionModalElement);
+ permissionModalElement.addEventListener('hidden.bs.modal', function() {
+ permissionTargetUserIds = [];
+ permissionModalMode = 'single';
+ permissionDraftMode = 'all';
+ permissionDraftSelectedModels = new Set();
+ permissionDraftMixedSource = false;
+ permissionSaving = false;
+ hideUsersHelpPopover();
+ });
+ }
+
+ const permissionDetailModalElement = document.getElementById('permissionDetailModal');
+ if (permissionDetailModalElement && window.bootstrap) {
+ permissionDetailModalInstance = new bootstrap.Modal(permissionDetailModalElement);
+ permissionDetailModalElement.addEventListener('hidden.bs.modal', function() {
+ activePermissionDetailUser = null;
+ const searchInput = document.getElementById('permissionDetailSearchInput');
+ if (searchInput) {
+ searchInput.value = '';
+ }
+ const listElement = document.getElementById('permissionDetailList');
+ if (listElement) {
+ listElement.innerHTML = '';
+ }
+ });
+ }
+
const pageJumpInput = document.getElementById('pageJumpInput');
pageJumpInput.addEventListener('keydown', function(e) {
if (e.key === 'Enter') {
@@ -349,9 +662,16 @@
pageJumpInput.addEventListener('input', function() {
clearTimeout(jumpDebounceTimer);
jumpDebounceTimer = setTimeout(function() {
- jumpToPage(false);
+ jumpToPage(false);
}, 450);
});
+
+ const permissionDetailSearchInput = document.getElementById('permissionDetailSearchInput');
+ if (permissionDetailSearchInput) {
+ permissionDetailSearchInput.addEventListener('input', function() {
+ renderPermissionDetailList();
+ });
+ }
});
function initUserSearch() {
@@ -415,21 +735,27 @@
if (!event.target.closest('.inline-confirm-wrap') && !event.target.closest('#userDeletePopover')) {
closeDeleteUserConfirm();
}
+ if (!event.target.closest('[data-users-help-topic]') && !event.target.closest('#usersHelpPopover')) {
+ hideUsersHelpPopover();
+ }
});
document.addEventListener('keydown', function(event) {
if (event.key === 'Escape') {
closeAllCustomSelects();
closeDeleteUserConfirm();
+ hideUsersHelpPopover();
}
});
window.addEventListener('resize', function() {
closeDeleteUserConfirm(false);
+ hideUsersHelpPopover();
});
window.addEventListener('scroll', function() {
closeDeleteUserConfirm(false);
+ hideUsersHelpPopover();
}, true);
function getUserDeletePopoverElement() {
@@ -498,12 +824,12 @@
popover.style.setProperty('--popover-arrow-left', `${arrowLeft}px`);
}
- // 加载用户列表
async function loadUsers() {
try {
pendingDeleteUserId = null;
deletingUserId = null;
hideUserDeletePopover();
+
const params = new URLSearchParams({
page: currentPage,
page_size: pageSize
@@ -520,7 +846,10 @@
} else {
users = data.users || [];
totalUsers = data.total || users.length;
+ availableModels = Array.isArray(data.available_models) ? data.available_models : [];
}
+
+ syncUserSelectionsToCurrentPage();
applyUsersSort();
updateUserSearchUi();
renderUsers();
@@ -530,6 +859,7 @@
document.getElementById('usersTableContainer').innerHTML =
'
加载用户数据失败
';
document.getElementById('tableFooter').style.display = 'none';
+ updateBatchToolbar();
}
}
@@ -633,12 +963,89 @@
renderUsers();
}
+ function renderModelPermissionSummary(user) {
+ const permissionState = normalizeUserPermissionState(user);
+ if (permissionState.mode === 'all') {
+ return `
+
+ *
+
+ `;
+ }
+
+ if (!permissionState.models.length) {
+ return `
+
+ 未授权模型
+
+ `;
+ }
+
+ const preview = getPermissionPreview(permissionState.models, 2);
+ const chips = preview.visible
+ .map(modelName => `
${escapeHtml(modelName)}`)
+ .join('');
+ const encodedUserId = Number(user.id);
+ const summaryBar = preview.hiddenCount > 0
+ ? `
+
+
+
+
+ `
+ : '';
+ return `
${chips}${summaryBar}
`;
+ }
+
+ function renderPermissionDetailList() {
+ const listElement = document.getElementById('permissionDetailList');
+ const summaryElement = document.getElementById('permissionDetailSummary');
+ const searchInput = document.getElementById('permissionDetailSearchInput');
+ if (!listElement || !summaryElement) return;
+
+ const permissionState = normalizeUserPermissionState(activePermissionDetailUser);
+ const allModels = permissionState.mode === 'all'
+ ? availableModels.slice()
+ : permissionState.models.slice();
+ const query = (searchInput?.value || '').trim().toLowerCase();
+ const filteredModels = query
+ ? allModels.filter(modelName => String(modelName).toLowerCase().includes(query))
+ : allModels;
+
+ summaryElement.textContent = query
+ ? `共 ${allModels.length} 个模型，筛选后 ${filteredModels.length} 个`
+ : `共 ${allModels.length} 个模型`;
+
+ if (!filteredModels.length) {
+ listElement.innerHTML = '
没有匹配的模型
';
+ return;
+ }
+
+ listElement.innerHTML = filteredModels
+ .map(modelName => `
${escapeHtml(modelName)}`)
+ .join('');
+ }
+
+ function openPermissionDetail(userId) {
+ const user = users.find(item => Number(item.id) === Number(userId));
+ if (!user || !permissionDetailModalInstance) return;
+
+ activePermissionDetailUser = user;
+ const identity = [user.username, user.ip_address].filter(Boolean).join(' · ');
+ document.getElementById('permissionDetailTitle').textContent = `${identity} - 模型列表`;
+ document.getElementById('permissionDetailSearchInput').value = '';
+ renderPermissionDetailList();
+ permissionDetailModalInstance.show();
+ }
+
function renderUsers() {
const container = document.getElementById('usersTableContainer');
+ const showPermissionControls = whitelistControlEnabled;
if (users.length === 0) {
container.innerHTML = `
${currentSearchKeyword ? '未找到匹配的用户' : '暂无用户数据'}
`;
document.getElementById('tableFooter').style.display = 'none';
+ updateBatchToolbar();
return;
}
@@ -646,6 +1053,17 @@
+ ${showPermissionControls ? `
+ |
+
+ | ` : ''}
|
+ ${showPermissionControls ? `
+
+
+ | ` : ''}
|
- ${whitelistControlEnabled ? `
+ ${showPermissionControls ? `
+ |
@@ -686,7 +1111,7 @@
创建时间 ${getSortIndicator(usersSortState.key, usersSortState.direction, 'created_at')}
|
- 操作 |
+ 操作 |
@@ -695,32 +1120,45 @@
users.forEach(user => {
const whitelistEnabled = !!user.whitelist_access_enabled;
const isDeletePending = pendingDeleteUserId === user.id;
+ const isSelected = selectedUserIds.has(Number(user.id));
html += `
- | ${user.username} |
- ${user.ip_address} |
+ ${showPermissionControls ? `
+
+
+ | ` : ''}
+ ${escapeHtml(user.username)} |
+ ${escapeHtml(user.ip_address)} |
+ ${showPermissionControls ? `${renderModelPermissionSummary(user)} | ` : ''}
${renderNumber(user.prompt_tokens || 0)} |
${renderNumber(user.completion_tokens || 0)} |
${renderNumber(user.total_tokens || 0)} |
${renderNumber(user.total_request_count || 0)} |
- ${whitelistControlEnabled ? `
+ ${showPermissionControls ? `
| ` : ''}
${formatDateTime(user.created_at)} |
-
+ |
@@ -732,9 +1170,9 @@
html += ' |
';
container.innerHTML = html;
syncDeleteUserPopover();
+ updateBatchToolbar();
}
- // 更新分页
function updatePagination() {
const totalPages = Math.ceil(totalUsers / pageSize) || 1;
currentTotalPages = totalPages;
@@ -767,23 +1205,20 @@
loadUsers();
}
- // 上一页
function prevPage() {
if (currentPage <= 1) return;
currentPage--;
loadUsers();
}
- // 下一页
function nextPage() {
if (currentPage >= currentTotalPages) return;
currentPage++;
loadUsers();
}
- // 更改每页大小
function changePageSize() {
- const newPageSize = parseInt(document.getElementById('pageSizeSelect').value);
+ const newPageSize = parseInt(document.getElementById('pageSizeSelect').value, 10);
if (newPageSize !== pageSize) {
pageSize = newPageSize;
currentPage = 1;
@@ -791,7 +1226,6 @@
}
}
- // 创建用户
async function createUser() {
const username = document.getElementById('newUsername').value.trim();
const ipAddress = document.getElementById('newIpAddress').value.trim();
@@ -832,12 +1266,11 @@
}
}
- // 打开编辑模态框
function openEditModal(userId) {
- const user = users.find(u => u.id === userId);
+ const user = users.find(item => Number(item.id) === Number(userId));
if (!user) return;
- editingUserId = userId;
+ editingUserId = Number(userId);
document.getElementById('editUsername').value = user.username;
document.getElementById('editIpAddress').value = user.ip_address;
@@ -846,7 +1279,6 @@
}
}
- // 关闭编辑模态框
function closeEditModal() {
if (editModalInstance) {
editModalInstance.hide();
@@ -854,7 +1286,6 @@
editingUserId = null;
}
- // 保存用户修改
async function saveUser() {
if (!editingUserId) return;
@@ -896,7 +1327,6 @@
}
}
- // 切换用户状态
async function toggleUser(userId) {
try {
const response = await fetch(`/api/users/${userId}/toggle`, {
@@ -916,7 +1346,318 @@
}
}
- // 删除用户
+ function renderPermissionModalBody() {
+ const body = document.getElementById('permissionModalBody');
+ if (!body) return;
+
+ const selectedCount = permissionDraftMode === 'all'
+ ? getAvailableModelCount()
+ : permissionDraftSelectedModels.size;
+ const bodyHtml = `
+
+
+
+
+ 允许全部模型
+
+
+
+
+ ${permissionDraftMode === 'all'
+ ? '开启后自动继承当前与后续新增模型，无需单独维护。'
+ : '关闭后，仅允许访问下方勾选的模型，可通过搜索与快捷操作快速调整。'}
+
+
+
+
+
+
0 ? 'hidden' : ''}>当前还没有可配置模型，请先到 Provider 管理里配置模型列表。
+ `;
+ body.innerHTML = bodyHtml;
+ const searchInput = document.getElementById('permissionModelSearchInput');
+ if (searchInput) {
+ searchInput.addEventListener('input', function() {
+ renderPermissionModelOptions();
+ });
+ }
+ updatePermissionPickerActionLabels();
+ renderPermissionModelOptions();
+ }
+
+ function closePermissionModal() {
+ if (permissionModalInstance) {
+ permissionModalInstance.hide();
+ }
+ }
+
+ function openPermissionModalForUser(userId) {
+ if (!whitelistControlEnabled) {
+ showMessage('请先启用 Chat 白名单，再设置模型权限', 'error');
+ return;
+ }
+
+ const user = users.find(item => Number(item.id) === Number(userId));
+ if (!user) return;
+
+ permissionModalMode = 'single';
+ permissionTargetUserIds = [Number(userId)];
+ permissionDraftMixedSource = false;
+ const currentState = normalizeUserPermissionState(user);
+ permissionDraftMode = currentState.mode;
+ permissionDraftSelectedModels = new Set(currentState.models);
+ updatePermissionModalUi();
+ if (permissionModalInstance) {
+ permissionModalInstance.show();
+ }
+ }
+
+ function openPermissionModalForBatch() {
+ if (!whitelistControlEnabled) {
+ showMessage('请先启用 Chat 白名单，再设置模型权限', 'error');
+ return;
+ }
+
+ const selectedIds = Array.from(selectedUserIds);
+ if (!selectedIds.length) {
+ showMessage('请先选择需要批量设置的用户', 'error');
+ return;
+ }
+
+ const selectedUsers = users.filter(user => selectedUserIds.has(Number(user.id)));
+ const signatures = selectedUsers.map(getPermissionSignature);
+ const allSame = signatures.length > 0 && signatures.every(signature => signature === signatures[0]);
+ const seedState = allSame
+ ? normalizeUserPermissionState(selectedUsers[0])
+ : { mode: 'all', models: [] };
+
+ permissionModalMode = 'batch';
+ permissionTargetUserIds = selectedIds;
+ permissionDraftMixedSource = !allSame;
+ permissionDraftMode = seedState.mode;
+ permissionDraftSelectedModels = new Set(seedState.models);
+ updatePermissionModalUi();
+ if (permissionModalInstance) {
+ permissionModalInstance.show();
+ }
+ }
+
+ function togglePermissionMode(allowAll) {
+ permissionDraftMode = allowAll ? 'all' : 'selected';
+ updatePermissionModalUi();
+ }
+
+ function getFilteredPermissionModels() {
+ const searchInput = document.getElementById('permissionModelSearchInput');
+ const keyword = searchInput ? searchInput.value.trim().toLowerCase() : '';
+ if (!keyword) return availableModels.slice();
+ return availableModels.filter(modelName => modelName.toLowerCase().includes(keyword));
+ }
+
+ function renderPermissionModelOptions() {
+ const listElement = document.getElementById('permissionModelList');
+ const selectedCountLabel = document.getElementById('permissionSelectedCount');
+ if (!listElement) return;
+
+ const visibleModels = getFilteredPermissionModels();
+ const selectedCount = permissionDraftMode === 'all'
+ ? getAvailableModelCount()
+ : permissionDraftSelectedModels.size;
+ if (selectedCountLabel) {
+ selectedCountLabel.textContent = String(selectedCount);
+ }
+ updatePermissionPickerActionLabels();
+
+ if (!visibleModels.length) {
+ listElement.innerHTML = '
没有匹配的模型
';
+ return;
+ }
+
+ listElement.innerHTML = visibleModels.map(modelName => {
+ const isSelected = permissionDraftSelectedModels.has(modelName);
+ const optionClassName = [
+ 'permission-model-option',
+ isSelected ? 'is-selected' : '',
+ permissionDraftMode === 'all' ? 'is-disabled' : ''
+ ].filter(Boolean).join(' ');
+ return `
+
+ `;
+ }).join('');
+ }
+
+ function updatePermissionPickerActionLabels() {
+ const searchInput = document.getElementById('permissionModelSearchInput');
+ const selectButton = document.getElementById('selectPermissionModelsBtn');
+ const clearButton = document.getElementById('clearPermissionModelsBtn');
+ if (!selectButton || !clearButton) return;
+
+ const hasKeyword = Boolean(searchInput && searchInput.value.trim());
+ selectButton.textContent = hasKeyword ? '选中搜索结果' : '全部选中';
+ clearButton.textContent = hasKeyword ? '取消结果选中' : '全部取消';
+ }
+
+ function updatePermissionModalUi() {
+ const title = document.getElementById('permissionModalLabel');
+ const subtitle = document.getElementById('permissionModalSubtitle');
+ const saveButton = document.getElementById('savePermissionBtn');
+
+ if (title) {
+ title.textContent = permissionModalMode === 'batch' ? '批量设置模型权限' : '模型权限';
+ }
+ if (subtitle) {
+ if (permissionModalMode === 'batch') {
+ subtitle.textContent = permissionDraftMixedSource
+ ? `已选择 ${permissionTargetUserIds.length} 个用户，当前权限不一致，保存后将统一覆盖。`
+ : `已选择 ${permissionTargetUserIds.length} 个用户，将统一应用下方权限。`;
+ } else {
+ subtitle.textContent = '设置该用户可访问的模型。';
+ }
+ }
+ if (saveButton) {
+ saveButton.disabled = permissionSaving;
+ saveButton.textContent = permissionSaving ? '保存中...' : '保存';
+ }
+
+ renderPermissionModalBody();
+ }
+
+ function togglePermissionModelSelection(modelName, checked) {
+ const normalizedModelName = String(modelName || '').trim();
+ if (!normalizedModelName) return;
+
+ if (checked) {
+ permissionDraftSelectedModels.add(normalizedModelName);
+ } else {
+ permissionDraftSelectedModels.delete(normalizedModelName);
+ }
+ renderPermissionModelOptions();
+ }
+
+ function selectVisiblePermissionModels(checked) {
+ if (permissionDraftMode === 'all') {
+ return;
+ }
+
+ const visibleModels = getFilteredPermissionModels();
+ visibleModels.forEach(modelName => {
+ if (checked) {
+ permissionDraftSelectedModels.add(modelName);
+ } else {
+ permissionDraftSelectedModels.delete(modelName);
+ }
+ });
+ renderPermissionModelOptions();
+ }
+
+ async function savePermissionSettings() {
+ if (!permissionTargetUserIds.length || permissionSaving) return;
+
+ const payload = permissionDraftMode === 'all'
+ ? '*'
+ : getSortedSelectedPermissionModels();
+
+ permissionSaving = true;
+ updatePermissionModalUi();
+
+ try {
+ let response;
+ if (permissionModalMode === 'batch') {
+ response = await fetch('/api/users/batch', {
+ method: 'POST',
+ headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify({
+ action: 'set_model_permissions',
+ user_ids: permissionTargetUserIds,
+ model_permissions: payload
+ })
+ });
+ } else {
+ response = await fetch(`/api/users/${permissionTargetUserIds[0]}`, {
+ method: 'PUT',
+ headers: { 'Content-Type': 'application/json' },
+ body: JSON.stringify({
+ model_permissions: payload
+ })
+ });
+ }
+
+ const result = await response.json();
+ if (!response.ok) {
+ throw new Error(result.error || '保存模型权限失败');
+ }
+
+ showMessage(
+ permissionModalMode === 'batch'
+ ? `已批量更新 ${permissionTargetUserIds.length} 个用户的模型权限`
+ : '模型权限更新成功',
+ 'success'
+ );
+ if (permissionModalMode === 'batch') {
+ clearUserSelections(false);
+ }
+ closePermissionModal();
+ await loadUsers();
+ } catch (error) {
+ console.error('保存模型权限失败:', error);
+ showActionError(
+ permissionModalMode === 'batch' ? '批量设置模型权限' : '更新模型权限',
+ error,
+ { fallback: permissionModalMode === 'batch' ? '批量设置模型权限失败' : '更新模型权限失败' }
+ );
+ } finally {
+ permissionSaving = false;
+ updatePermissionModalUi();
+ }
+ }
+
function toggleDeleteUserConfirm(userId, event) {
event?.stopPropagation();
if (deletingUserId !== null) return;
@@ -969,6 +1710,7 @@
pendingDeleteUserId = null;
deletingUserId = null;
hideUserDeletePopover();
+ selectedUserIds.delete(Number(userId));
showMessage('用户删除成功', 'success');
await loadUsers();
} else {
@@ -1000,6 +1742,5 @@
second: '2-digit'
});
}
-
{% endblock %}
diff --git a/src/presentation/user_controller.py b/src/presentation/user_controller.py
index 52d5b4c..4666f71 100644
--- a/src/presentation/user_controller.py
+++ b/src/presentation/user_controller.py
@@ -28,6 +28,7 @@ class UserController:
self._app.route('/api/users', methods=['GET'])(auth(self.get_users))
self._app.route('/api/users', methods=['POST'])(auth(self.create_user))
+ self._app.route('/api/users/batch', methods=['POST'])(auth(self.batch_users))
self._app.route('/api/users/
', methods=['GET'])(auth(self.get_user))
self._app.route('/api/users/', methods=['PUT'])(auth(self.update_user))
self._app.route('/api/users/', methods=['DELETE'])(auth(self.delete_user))
@@ -56,6 +57,7 @@ class UserController:
'page_size': page_size,
'total_pages': (total + page_size - 1) // page_size,
'keyword': keyword,
+ 'available_models': self._user_service.get_available_models(),
})
except Exception as exc:
self._logger.error(f'Error getting users: {exc}')
@@ -114,6 +116,8 @@ class UserController:
username = data.get('username')
ip_address = data.get('ip_address')
whitelist_access_enabled = data.get('whitelist_access_enabled')
+ model_permissions_provided = 'model_permissions' in data
+ model_permissions = data.get('model_permissions')
normalized_ip = None
if ip_address is not None:
@@ -127,6 +131,8 @@ class UserController:
username,
normalized_ip,
whitelist_access_enabled,
+ model_permissions_provided=model_permissions_provided,
+ model_permissions=model_permissions,
)
if not success:
self._logger.warning(f"Update user failed: user_id={user_id}")
@@ -134,10 +140,38 @@ class UserController:
self._logger.info(f"Update user succeeded: user_id={user_id}")
return jsonify({'message': 'User updated successfully'})
+ except ValueError as exc:
+ return jsonify({'error': str(exc)}), 400
except Exception as exc:
self._logger.error(f'Error updating user: {exc}')
return jsonify({'error': str(exc)}), 500
+ def batch_users(self) -> Response:
+ """执行用户批量操作。"""
+ try:
+ payload = request.get_json(silent=True) or {}
+ action = str(payload.get('action') or '').strip().lower()
+ if action != 'set_model_permissions':
+ raise ValueError(f'Unsupported user batch action: {action or ""}')
+
+ result = self._user_service.batch_update_model_permissions(
+ payload.get('user_ids'),
+ payload.get('model_permissions'),
+ )
+ self._logger.info(
+ 'User batch action completed: action=%s count=%s',
+ action,
+ result.get('count', 0),
+ )
+ return jsonify(result)
+ except ValueError as exc:
+ message = str(exc)
+ status_code = 404 if 'not found' in message.lower() else 400
+ return jsonify({'error': message}), status_code
+ except Exception as exc:
+ self._logger.error(f'Error applying user batch action: {exc}')
+ return jsonify({'error': str(exc)}), 500
+
def delete_user(self, user_id: int) -> Response:
"""删除用户。"""
try:
diff --git a/src/repositories/user_repository.py b/src/repositories/user_repository.py
index bb0a25d..5bbc4e9 100644
--- a/src/repositories/user_repository.py
+++ b/src/repositories/user_repository.py
@@ -11,6 +11,8 @@ from ..utils.local_time import now_local_datetime_text
class UserRepository:
"""负责 users 表的数据访问。"""
+ MODEL_PERMISSIONS_ALL = "*"
+
def __init__(self, get_connection: ConnectionFactory):
self._get_connection = get_connection
self._ensure_table()
@@ -26,15 +28,29 @@ class UserRepository:
username TEXT NOT NULL,
ip_address TEXT NOT NULL UNIQUE,
whitelist_access_enabled INTEGER DEFAULT 1,
+ model_permissions TEXT NOT NULL DEFAULT '*',
created_at TEXT NOT NULL,
updated_at TEXT NOT NULL
)
"""
)
+ columns = {
+ str(row["name"]).strip()
+ for row in cursor.execute("PRAGMA table_info(users)").fetchall()
+ }
+ if "model_permissions" not in columns:
+ cursor.execute(
+ "ALTER TABLE users ADD COLUMN model_permissions TEXT NOT NULL DEFAULT '*'"
+ )
cursor.execute("CREATE INDEX IF NOT EXISTS idx_users_ip ON users(ip_address)")
cursor.execute("CREATE INDEX IF NOT EXISTS idx_users_username ON users(username)")
- def create(self, username: str, ip_address: str) -> Optional[int]:
+ def create(
+ self,
+ username: str,
+ ip_address: str,
+ model_permissions: str = MODEL_PERMISSIONS_ALL,
+ ) -> Optional[int]:
"""创建用户记录。"""
now_text = now_local_datetime_text()
with self._get_connection() as conn:
@@ -42,11 +58,11 @@ class UserRepository:
cursor.execute(
"""
INSERT INTO users (
- username, ip_address, whitelist_access_enabled, created_at, updated_at
+ username, ip_address, whitelist_access_enabled, model_permissions, created_at, updated_at
)
- VALUES (?, ?, ?, ?, ?)
+ VALUES (?, ?, ?, ?, ?, ?)
""",
- (username, ip_address, 1, now_text, now_text),
+ (username, ip_address, 1, model_permissions, now_text, now_text),
)
return cursor.lastrowid
@@ -56,7 +72,7 @@ class UserRepository:
cursor = conn.cursor()
cursor.execute(
"""
- SELECT id, username, ip_address, whitelist_access_enabled, created_at, updated_at
+ SELECT id, username, ip_address, whitelist_access_enabled, model_permissions, created_at, updated_at
FROM users
WHERE id = ?
""",
@@ -90,6 +106,7 @@ class UserRepository:
u.username,
u.ip_address,
u.whitelist_access_enabled,
+ u.model_permissions,
u.created_at,
u.updated_at,
COALESCE(s.total_request_count, 0) AS total_request_count,
@@ -136,6 +153,7 @@ class UserRepository:
username: Optional[str] = None,
ip_address: Optional[str] = None,
whitelist_access_enabled: Optional[bool] = None,
+ model_permissions: Optional[str] = None,
) -> bool:
"""更新用户记录。"""
updates = []
@@ -150,6 +168,9 @@ class UserRepository:
if whitelist_access_enabled is not None:
updates.append("whitelist_access_enabled = ?")
params.append(1 if whitelist_access_enabled else 0)
+ if model_permissions is not None:
+ updates.append("model_permissions = ?")
+ params.append(model_permissions)
if not updates:
return False
@@ -176,7 +197,7 @@ class UserRepository:
cursor = conn.cursor()
cursor.execute(
"""
- SELECT id, username, ip_address, whitelist_access_enabled, created_at, updated_at
+ SELECT id, username, ip_address, whitelist_access_enabled, model_permissions, created_at, updated_at
FROM users
WHERE ip_address = ?
""",
@@ -184,3 +205,54 @@ class UserRepository:
)
row = cursor.fetchone()
return dict(row) if row else None
+
+ def get_by_ids(self, user_ids: List[int]) -> List[Dict[str, Any]]:
+ """按 ID 列表查询用户。"""
+ normalized_user_ids = [int(user_id) for user_id in user_ids]
+ if not normalized_user_ids:
+ return []
+
+ placeholders = ", ".join("?" for _ in normalized_user_ids)
+ with self._get_connection() as conn:
+ cursor = conn.cursor()
+ cursor.execute(
+ f"""
+ SELECT id, username, ip_address, whitelist_access_enabled, model_permissions, created_at, updated_at
+ FROM users
+ WHERE id IN ({placeholders})
+ """,
+ normalized_user_ids,
+ )
+ return [dict(row) for row in cursor.fetchall()]
+
+ def list_all(self) -> List[Dict[str, Any]]:
+ """查询全部用户，用于权限同步与批量设置。"""
+ with self._get_connection() as conn:
+ cursor = conn.cursor()
+ cursor.execute(
+ """
+ SELECT id, username, ip_address, whitelist_access_enabled, model_permissions, created_at, updated_at
+ FROM users
+ ORDER BY id ASC
+ """
+ )
+ return [dict(row) for row in cursor.fetchall()]
+
+ def batch_update_model_permissions(self, user_ids: List[int], model_permissions: str) -> int:
+ """批量更新用户模型权限。"""
+ normalized_user_ids = [int(user_id) for user_id in user_ids]
+ if not normalized_user_ids:
+ return 0
+
+ placeholders = ", ".join("?" for _ in normalized_user_ids)
+ with self._get_connection() as conn:
+ cursor = conn.cursor()
+ cursor.execute(
+ f"""
+ UPDATE users
+ SET model_permissions = ?, updated_at = ?
+ WHERE id IN ({placeholders})
+ """,
+ [model_permissions, now_local_datetime_text(), *normalized_user_ids],
+ )
+ return cursor.rowcount
diff --git a/src/services/user_service.py b/src/services/user_service.py
index 99ffd7b..8d870e8 100644
--- a/src/services/user_service.py
+++ b/src/services/user_service.py
@@ -2,10 +2,12 @@
# -*- coding: utf-8 -*-
"""用户服务。"""
+import json
import threading
-from typing import Any, Dict, List, Optional
+from typing import Any, Dict, Iterable, List, Optional, Sequence
from ..application.app_context import AppContext
+from ..config.provider_config import normalize_model_list
from ..repositories import UserRepository
from ..utils import is_valid_ip
from ..utils.local_time import normalize_local_datetime_text
@@ -14,9 +16,12 @@ from ..utils.local_time import normalize_local_datetime_text
class UserService:
"""封装用户管理业务逻辑。"""
+ MODEL_PERMISSIONS_ALL = UserRepository.MODEL_PERMISSIONS_ALL
+
def __init__(self, ctx: AppContext, repository: UserRepository):
self._ctx = ctx
self._logger = ctx.logger
+ self._config_manager = getattr(ctx, "config_manager", None)
self._repository = repository
self._cache_lock = threading.RLock()
self._user_by_ip_cache: Dict[str, Optional[Dict[str, Any]]] = {}
@@ -51,49 +56,193 @@ class UserService:
normalized["updated_at"] = normalize_local_datetime_text(normalized.get("updated_at"))
return normalized
+ @staticmethod
+ def _dedupe_models(model_names: Iterable[Any]) -> List[str]:
+ seen_models: set[str] = set()
+ normalized_models: List[str] = []
+ for item in model_names:
+ model_name = str(item or "").strip()
+ if not model_name or model_name in seen_models:
+ continue
+ seen_models.add(model_name)
+ normalized_models.append(model_name)
+ return normalized_models
+
+ def _get_available_model_names(self) -> tuple[str, ...]:
+ """读取配置中声明的模型列表，包含已禁用 Provider 的模型。"""
+ if self._config_manager is None:
+ return ()
+
+ try:
+ config = self._config_manager.get_raw_config()
+ except Exception as exc:
+ self._logger.error("Failed to load config model catalog: %s", exc)
+ return ()
+
+ raw_providers = config.get("providers", [])
+ if raw_providers is None or not isinstance(raw_providers, list):
+ return ()
+
+ model_names: List[str] = []
+ seen_models: set[str] = set()
+ for raw_provider in raw_providers:
+ if not isinstance(raw_provider, dict):
+ continue
+
+ provider_name = str(raw_provider.get("name") or "").strip()
+ if not provider_name:
+ continue
+
+ try:
+ provider_models = normalize_model_list(raw_provider.get("model_list"))
+ except ValueError:
+ continue
+
+ for provider_model in provider_models:
+ model_key = f"{provider_name}/{provider_model}"
+ if model_key in seen_models:
+ continue
+ seen_models.add(model_key)
+ model_names.append(model_key)
+
+ return tuple(sorted(model_names))
+
+ @classmethod
+ def _deserialize_model_permissions(cls, raw_value: Any) -> Optional[tuple[str, ...]]:
+ """反序列化模型权限；返回 None 表示通配全模型。"""
+ normalized_text = str(raw_value or "").strip()
+ if not normalized_text or normalized_text == cls.MODEL_PERMISSIONS_ALL:
+ return None
+
+ try:
+ payload = json.loads(normalized_text)
+ except (TypeError, ValueError, json.JSONDecodeError):
+ payload = normalized_text.replace(",", "\n").splitlines()
+
+ if isinstance(payload, str):
+ payload = [payload]
+ if not isinstance(payload, list):
+ return ()
+
+ normalized_models = cls._dedupe_models(payload)
+ if cls.MODEL_PERMISSIONS_ALL in normalized_models:
+ return None
+ return tuple(normalized_models)
+
+ def _serialize_model_permissions(self, value: Any) -> str:
+ """标准化模型权限存储格式。"""
+ if isinstance(value, str):
+ normalized_text = value.strip()
+ if normalized_text == self.MODEL_PERMISSIONS_ALL:
+ return self.MODEL_PERMISSIONS_ALL
+ raw_items: Sequence[Any] = normalized_text.replace(",", "\n").splitlines()
+ elif isinstance(value, (list, tuple, set)):
+ raw_items = list(value)
+ else:
+ raise ValueError('model_permissions must be "*" or a list of model names')
+
+ normalized_models = self._dedupe_models(raw_items)
+ if self.MODEL_PERMISSIONS_ALL in normalized_models:
+ return self.MODEL_PERMISSIONS_ALL
+
+ available_models = set(self._get_available_model_names())
+ unknown_models = [model for model in normalized_models if model not in available_models]
+ if unknown_models:
+ raise ValueError(f"Unknown model permission(s): {', '.join(unknown_models)}")
+
+ return json.dumps(normalized_models, ensure_ascii=True)
+
+ def _decorate_user(
+ self,
+ user: Optional[Dict[str, Any]],
+ *,
+ available_models: Optional[Sequence[str]] = None,
+ ) -> Optional[Dict[str, Any]]:
+ """补充模型权限字段并标准化时间格式。"""
+ normalized = self._normalize_user_timestamps(user)
+ if not normalized:
+ return normalized
+
+ resolved_available_models = tuple(
+ self._get_available_model_names()
+ if available_models is None
+ else available_models
+ )
+ available_model_set = set(resolved_available_models)
+ parsed_permissions = self._deserialize_model_permissions(normalized.get("model_permissions"))
+
+ if parsed_permissions is None:
+ normalized["model_permissions"] = self.MODEL_PERMISSIONS_ALL
+ normalized["model_permissions_mode"] = "all"
+ normalized["allowed_models_count"] = len(resolved_available_models)
+ else:
+ filtered_permissions = [
+ model_name
+ for model_name in parsed_permissions
+ if not available_model_set or model_name in available_model_set
+ ]
+ normalized["model_permissions"] = filtered_permissions
+ normalized["model_permissions_mode"] = "selected"
+ normalized["allowed_models_count"] = len(filtered_permissions)
+
+ normalized["available_models_count"] = len(resolved_available_models)
+ return normalized
+
+ def get_available_models(self) -> List[str]:
+ """返回当前配置中可选的模型列表。"""
+ return list(self._get_available_model_names())
+
def create_user(self, username: str, ip_address: str) -> Optional[int]:
"""创建用户。"""
try:
if not is_valid_ip(ip_address):
- self._logger.error(f'Invalid IP address: {ip_address}')
+ self._logger.error(f"Invalid IP address: {ip_address}")
return None
existing_ip = self._repository.get_by_ip(ip_address)
if existing_ip:
- self._logger.error(f'IP address already in use: {ip_address}')
+ self._logger.error(f"IP address already in use: {ip_address}")
return None
- user_id = self._repository.create(username, ip_address)
+ user_id = self._repository.create(
+ username,
+ ip_address,
+ model_permissions=self.MODEL_PERMISSIONS_ALL,
+ )
self._invalidate_ip_cache(ip_address)
self._logger.info(f"User created: user_id={user_id}, username={username!r}, ip={ip_address}")
return user_id
- except Exception as e:
- self._logger.error(f'Failed to create user: {e}')
+ except Exception as exc:
+ self._logger.error(f"Failed to create user: {exc}")
return None
def get_user_by_id(self, user_id: int) -> Optional[Dict[str, Any]]:
"""按 ID 查询用户。"""
try:
- return self._normalize_user_timestamps(self._repository.get_by_id(user_id))
- except Exception as e:
- self._logger.error(f'Failed to get user: {e}')
+ return self._decorate_user(self._repository.get_by_id(user_id))
+ except Exception as exc:
+ self._logger.error(f"Failed to get user: {exc}")
return None
def get_users(self, page: int = 1, page_size: int = 50, keyword: Optional[str] = None) -> List[Dict[str, Any]]:
"""分页查询用户列表。"""
try:
+ available_models = self._get_available_model_names()
users = self._repository.get(page=page, page_size=page_size, keyword=keyword)
- return [self._normalize_user_timestamps(user) for user in users]
- except Exception as e:
- self._logger.error(f'Failed to get users: {e}')
+ return [
+ self._decorate_user(user, available_models=available_models)
+ for user in users
+ ]
+ except Exception as exc:
+ self._logger.error(f"Failed to get users: {exc}")
return []
def get_total_users_count(self, keyword: Optional[str] = None) -> int:
"""查询用户总数。"""
try:
return self._repository.get_count(keyword=keyword)
- except Exception as e:
- self._logger.error(f'Failed to get users count: {e}')
+ except Exception as exc:
+ self._logger.error(f"Failed to get users count: {exc}")
return 0
def update_user(
@@ -102,6 +251,9 @@ class UserService:
username: Optional[str] = None,
ip_address: Optional[str] = None,
whitelist_access_enabled: Optional[bool] = None,
+ *,
+ model_permissions_provided: bool = False,
+ model_permissions: Any = None,
) -> bool:
"""更新用户信息。"""
try:
@@ -111,35 +263,72 @@ class UserService:
if ip_address:
existing = self._repository.get_by_ip(ip_address)
- if existing and existing['id'] != user_id:
- self._logger.error(f'IP address already in use: {ip_address}')
+ if existing and existing["id"] != user_id:
+ self._logger.error(f"IP address already in use: {ip_address}")
return False
+ serialized_model_permissions: Optional[str] = None
+ if model_permissions_provided:
+ serialized_model_permissions = self._serialize_model_permissions(model_permissions)
+
updated = self._repository.update(
user_id,
username,
ip_address,
whitelist_access_enabled,
+ serialized_model_permissions,
)
if updated:
- self._invalidate_ip_cache(existing_user.get('ip_address'), ip_address)
+ self._invalidate_ip_cache(existing_user.get("ip_address"), ip_address)
self._logger.info(f"User updated: user_id={user_id}")
return updated
- except Exception as e:
- self._logger.error(f'Failed to update user: {e}')
+ except ValueError:
+ raise
+ except Exception as exc:
+ self._logger.error(f"Failed to update user: {exc}")
return False
+ def batch_update_model_permissions(self, user_ids: Any, model_permissions: Any) -> Dict[str, Any]:
+ """批量统一设置用户模型权限。"""
+ normalized_user_ids = self._normalize_user_ids(user_ids)
+ existing_users = self._repository.get_by_ids(normalized_user_ids)
+ existing_users_by_id = {int(user["id"]): user for user in existing_users}
+ missing_user_ids = [user_id for user_id in normalized_user_ids if user_id not in existing_users_by_id]
+ if missing_user_ids:
+ if len(missing_user_ids) == 1:
+ raise ValueError(f"User not found: {missing_user_ids[0]}")
+ raise ValueError(f"Users not found: {', '.join(str(user_id) for user_id in missing_user_ids)}")
+
+ serialized_model_permissions = self._serialize_model_permissions(model_permissions)
+ self._repository.batch_update_model_permissions(normalized_user_ids, serialized_model_permissions)
+ self._invalidate_ip_cache(*(user.get("ip_address") for user in existing_users))
+
+ payload: Any = self.MODEL_PERMISSIONS_ALL
+ if serialized_model_permissions != self.MODEL_PERMISSIONS_ALL:
+ payload = json.loads(serialized_model_permissions)
+
+ self._logger.info(
+ "User model permissions batch updated: count=%s mode=%s",
+ len(normalized_user_ids),
+ "all" if payload == self.MODEL_PERMISSIONS_ALL else "selected",
+ )
+ return {
+ "count": len(normalized_user_ids),
+ "user_ids": normalized_user_ids,
+ "model_permissions": payload,
+ }
+
def delete_user(self, user_id: int) -> bool:
"""删除用户。"""
try:
existing_user = self._repository.get_by_id(user_id)
deleted = self._repository.delete(user_id)
if deleted and existing_user:
- self._invalidate_ip_cache(existing_user.get('ip_address'))
+ self._invalidate_ip_cache(existing_user.get("ip_address"))
self._logger.info(f"User deleted: user_id={user_id}")
return deleted
- except Exception as e:
- self._logger.error(f'Failed to delete user: {e}')
+ except Exception as exc:
+ self._logger.error(f"Failed to delete user: {exc}")
return False
def toggle_user_status(self, user_id: int) -> bool:
@@ -150,16 +339,16 @@ class UserService:
return False
updated = self._repository.update(
user_id,
- whitelist_access_enabled=not bool(user['whitelist_access_enabled']),
+ whitelist_access_enabled=not bool(user["whitelist_access_enabled"]),
)
if updated:
- self._invalidate_ip_cache(user.get('ip_address'))
+ self._invalidate_ip_cache(user.get("ip_address"))
self._logger.info(
f"User whitelist toggled: user_id={user_id}, enabled={not bool(user['whitelist_access_enabled'])}"
)
return updated
- except Exception as e:
- self._logger.error(f'Failed to toggle user status: {e}')
+ except Exception as exc:
+ self._logger.error(f"Failed to toggle user status: {exc}")
return False
def get_user_by_ip(
@@ -179,9 +368,117 @@ class UserService:
if not cached_user:
return None
- if require_whitelist_access and not bool(cached_user.get('whitelist_access_enabled')):
+ if require_whitelist_access and not bool(cached_user.get("whitelist_access_enabled")):
return None
- return self._normalize_user_timestamps(cached_user)
- except Exception as e:
- self._logger.error(f'Failed to get user by IP: {e}')
+ return self._decorate_user(cached_user)
+ except Exception as exc:
+ self._logger.error(f"Failed to get user by IP: {exc}")
return None
+
+ def get_accessible_models_for_user(
+ self,
+ user: Optional[Dict[str, Any]],
+ available_models: Optional[Sequence[str]] = None,
+ ) -> List[str]:
+ """返回用户在给定模型集合内可访问的模型。"""
+ if not user:
+ return []
+
+ resolved_available_models = list(
+ self._get_available_model_names()
+ if available_models is None
+ else available_models
+ )
+ permissions = user.get("model_permissions")
+ if permissions == self.MODEL_PERMISSIONS_ALL or user.get("model_permissions_mode") == "all":
+ return resolved_available_models
+
+ if isinstance(permissions, list):
+ explicit_models = self._dedupe_models(permissions)
+ else:
+ parsed_permissions = self._deserialize_model_permissions(permissions)
+ if parsed_permissions is None:
+ return resolved_available_models
+ explicit_models = list(parsed_permissions)
+
+ if not resolved_available_models:
+ return explicit_models
+
+ available_model_set = set(resolved_available_models)
+ return [model_name for model_name in explicit_models if model_name in available_model_set]
+
+ def can_user_access_model(
+ self,
+ user: Optional[Dict[str, Any]],
+ model_name: str,
+ available_models: Optional[Sequence[str]] = None,
+ ) -> bool:
+ """判断用户是否可访问指定模型。"""
+ normalized_model_name = str(model_name or "").strip()
+ if not normalized_model_name or not user:
+ return False
+
+ permissions = user.get("model_permissions")
+ if (
+ permissions == self.MODEL_PERMISSIONS_ALL
+ or user.get("model_permissions_mode") == "all"
+ ) and available_models is None:
+ return True
+
+ return normalized_model_name in set(
+ self.get_accessible_models_for_user(user, available_models=available_models)
+ )
+
+ def sync_model_permissions(self) -> int:
+ """同步并清理已删除模型对应的显式授权。"""
+ try:
+ available_models = set(self._get_available_model_names())
+ updated_count = 0
+ for user in self._repository.list_all():
+ current_raw = str(user.get("model_permissions") or "").strip() or self.MODEL_PERMISSIONS_ALL
+ parsed_permissions = self._deserialize_model_permissions(current_raw)
+ if parsed_permissions is None:
+ expected_raw = self.MODEL_PERMISSIONS_ALL
+ else:
+ filtered_permissions = [
+ model_name
+ for model_name in parsed_permissions
+ if model_name in available_models
+ ]
+ expected_raw = json.dumps(filtered_permissions, ensure_ascii=True)
+
+ if current_raw == expected_raw:
+ continue
+
+ if self._repository.update(int(user["id"]), model_permissions=expected_raw):
+ updated_count += 1
+ self._invalidate_ip_cache(user.get("ip_address"))
+
+ if updated_count:
+ self._logger.info("User model permissions synced: updated=%s", updated_count)
+ return updated_count
+ except Exception as exc:
+ self._logger.error("Failed to sync user model permissions: %s", exc)
+ return 0
+
+ @staticmethod
+ def _normalize_user_ids(user_ids: Any) -> List[int]:
+ """标准化批量操作中的用户 ID 列表。"""
+ if not isinstance(user_ids, list):
+ raise ValueError("User ids must be a non-empty list")
+
+ normalized_user_ids: List[int] = []
+ seen_user_ids: set[int] = set()
+ for raw_user_id in user_ids:
+ try:
+ user_id = int(raw_user_id)
+ except (TypeError, ValueError) as exc:
+ raise ValueError("User ids must be integers") from exc
+ if user_id <= 0 or user_id in seen_user_ids:
+ continue
+ seen_user_ids.add(user_id)
+ normalized_user_ids.append(user_id)
+
+ if not normalized_user_ids:
+ raise ValueError("User ids must be a non-empty list")
+ return normalized_user_ids
diff --git a/tests/test_proxy_error_handling.py b/tests/test_proxy_error_handling.py
index 49c0ea5..463d102 100644
--- a/tests/test_proxy_error_handling.py
+++ b/tests/test_proxy_error_handling.py
@@ -42,16 +42,38 @@ class FakeLogger:
class FakeConfigManager:
- @staticmethod
- def is_chat_whitelist_enabled() -> bool:
- return False
+ def __init__(self, whitelist_enabled: bool = False) -> None:
+ self._whitelist_enabled = whitelist_enabled
+
+ def is_chat_whitelist_enabled(self) -> bool:
+ return self._whitelist_enabled
class FakeUserService:
- @staticmethod
- def get_user_by_ip(ip_address: str, require_whitelist_access: bool = True):
+ _UNSET = object()
+
+ def __init__(self, *, user=_UNSET, accessible_models=None) -> None:
+ self._user = {"username": "tester", "model_permissions": "*"} if user is self._UNSET else user
+ self._accessible_models = None if accessible_models is None else list(accessible_models)
+
+ def get_user_by_ip(self, ip_address: str, require_whitelist_access: bool = True):
del ip_address, require_whitelist_access
- return {"username": "tester"}
+ return self._user
+
+ def can_user_access_model(self, user, model_name: str, available_models=None) -> bool:
+ del user
+ if self._accessible_models is None:
+ return True
+ return model_name in set(self._accessible_models)
+
+ def get_accessible_models_for_user(self, user, available_models=None):
+ del user
+ if self._accessible_models is None:
+ return list(available_models or [])
+ if available_models is None:
+ return list(self._accessible_models)
+ available_set = set(available_models)
+ return [model_name for model_name in self._accessible_models if model_name in available_set]
class FakeLogService:
@@ -154,6 +176,93 @@ class ProxyControllerErrorFormatTests(unittest.TestCase):
response.get_json(),
)
+ def test_list_models_filters_to_models_allowed_for_whitelisted_user(self) -> None:
+ provider = LLMProvider(
+ name="demo",
+ api="https://example.com/v1/chat/completions",
+ model_list=("gpt-4.1", "gpt-4.1-mini"),
+ )
+ app = Flask(__name__)
+ ctx = AppContext(
+ logger=FakeLogger(),
+ config_manager=FakeConfigManager(whitelist_enabled=True),
+ root_path=Path(__file__).resolve().parents[1],
+ flask_app=app,
+ )
+ ProxyController(
+ ctx,
+ StubProxyService((None, 200, None)),
+ FakeUserService(accessible_models=["demo/gpt-4.1-mini"]),
+ FakeLogService(),
+ FakeProviderManager(provider),
+ )
+
+ response = app.test_client().get("/v1/models", environ_base={"REMOTE_ADDR": "127.0.0.1"})
+
+ self.assertEqual(200, response.status_code)
+ payload = response.get_json()
+ self.assertEqual(["demo/gpt-4.1-mini"], [item["id"] for item in payload["data"]])
+
+ def test_list_models_rejects_non_whitelisted_ip_when_whitelist_enabled(self) -> None:
+ provider = LLMProvider(
+ name="demo",
+ api="https://example.com/v1/chat/completions",
+ model_list=("gpt-4.1",),
+ )
+ app = Flask(__name__)
+ ctx = AppContext(
+ logger=FakeLogger(),
+ config_manager=FakeConfigManager(whitelist_enabled=True),
+ root_path=Path(__file__).resolve().parents[1],
+ flask_app=app,
+ )
+ ProxyController(
+ ctx,
+ StubProxyService((None, 200, None)),
+ FakeUserService(user=None),
+ FakeLogService(),
+ FakeProviderManager(provider),
+ )
+
+ response = app.test_client().get("/v1/models", environ_base={"REMOTE_ADDR": "127.0.0.1"})
+
+ self.assertEqual(403, response.status_code)
+ self.assertEqual("ip_not_whitelisted", response.get_json()["error"]["code"])
+
+ def test_chat_completions_rejects_model_not_allowed_for_whitelisted_user(self) -> None:
+ provider = LLMProvider(
+ name="demo",
+ api="https://example.com/v1/chat/completions",
+ model_list=("gpt-4.1", "gpt-4.1-mini"),
+ )
+ logger = FakeLogger()
+ app = Flask(__name__)
+ ctx = AppContext(
+ logger=logger,
+ config_manager=FakeConfigManager(whitelist_enabled=True),
+ root_path=Path(__file__).resolve().parents[1],
+ flask_app=app,
+ )
+ ProxyController(
+ ctx,
+ StubProxyService((None, 200, None)),
+ FakeUserService(accessible_models=["demo/gpt-4.1-mini"]),
+ FakeLogService(),
+ FakeProviderManager(provider),
+ )
+
+ response = app.test_client().post(
+ "/v1/chat/completions",
+ json={"model": "demo/gpt-4.1", "messages": [{"role": "user", "content": "hi"}]},
+ environ_base={"REMOTE_ADDR": "127.0.0.1"},
+ )
+
+ self.assertEqual(403, response.status_code)
+ self.assertEqual("model_not_allowed", response.get_json()["error"]["code"])
+ self.assertTrue(
+ any("is not allowed to access model=demo/gpt-4.1" in msg for msg in logger.messages("warning"))
+ )
+
def test_chat_completions_returns_openai_style_error_payload_for_upstream_failures(self) -> None:
provider = LLMProvider(
name="demo",
diff --git a/tests/test_proxy_transport.py b/tests/test_proxy_transport.py
index d57652d..bb700f6 100644
--- a/tests/test_proxy_transport.py
+++ b/tests/test_proxy_transport.py
@@ -409,28 +409,19 @@ class ProviderTemplateTransportTests(unittest.TestCase):
self.assertIn("id=\"selectedProviderCount\"", html)
self.assertIn("id=\"enableSelectedProvidersBtn\"", html)
self.assertIn("id=\"disableSelectedProvidersBtn\"", html)
- self.assertIn("id=\"deleteSelectedProvidersBtn\"", html)
- self.assertIn("id=\"clearSelectedProvidersBtn\"", html)
+ self.assertNotIn("id=\"deleteSelectedProvidersBtn\"", html)
+ self.assertNotIn("id=\"clearSelectedProvidersBtn\"", html)
self.assertIn("function updateProviderSelectionUi()", html)
self.assertIn("function toggleProviderSelection(name, checked)", html)
self.assertIn("function toggleAllProvidersSelection(checked)", html)
self.assertIn("function clearSelectedProviders()", html)
self.assertIn("function setProviderEnabled(name, enabled)", html)
self.assertIn("function runProviderBatchAction(action)", html)
- self.assertIn("function openProviderBatchDeleteModal(names)", html)
- self.assertIn("function confirmProviderBatchDelete()", html)
- self.assertIn("function syncProviderBatchDeleteModal()", html)
self.assertIn("/api/providers/batch", html)
self.assertIn("/api/providers/${encodeURIComponent(normalizedName)}/${enabled ? 'enable' : 'disable'}", html)
self.assertIn('id="providerSelectAllCheckbox"', html)
- self.assertIn('id="providerBatchDeleteModal"', html)
- self.assertIn('id="providerBatchDeleteMessage"', html)
- self.assertIn('id="confirmProviderBatchDeleteBtn"', html)
- self.assertIn('class="modal-dialog modal-dialog-centered provider-batch-delete-modal-dialog"', html)
self.assertIn('data-provider-row-checkbox="${encodedProviderName}"', html)
self.assertIn("class=\"btn-action ${isEnabled ? 'btn-delete' : 'btn-edit'}\"", html)
- self.assertIn("providerBatchDeleteModalInstance = new bootstrap.Modal(providerBatchDeleteModalElement);", html)
- self.assertNotIn('id="providerBatchDeleteModal" tabindex="-1" data-bs-backdrop="static" data-bs-keyboard="false"', html)
self.assertNotIn("window.confirm(`确认批量删除已选中的 ${selectedNames.length} 个 Provider？`)", html)
self.assertNotIn("setupCustomSelect('providerFormat');", html)
self.assertNotIn("setupCustomSelect('providerStreamFormat');", html)
@@ -511,7 +502,7 @@ class ProviderTemplateTransportTests(unittest.TestCase):
self.assertIn(".providers-page .provider-help-popover {", css)
self.assertIn(".providers-page .provider-batch-summary {", css)
- self.assertIn(".providers-page .provider-batch-delete-modal-dialog {", css)
+ self.assertNotIn(".providers-page .provider-batch-delete-modal-dialog {", css)
self.assertIn(".providers-page .provider-table-checkbox {", css)
self.assertIn(".providers-page .field-label-with-help {", css)
self.assertIn(".providers-page .entry-import-editor {", css)
diff --git a/tests/test_user_model_permissions.py b/tests/test_user_model_permissions.py
new file mode 100644
index 0000000..ae637b7
--- /dev/null
+++ b/tests/test_user_model_permissions.py
@@ -0,0 +1,117 @@
+import sys
+import tempfile
+import unittest
+from copy import deepcopy
+from pathlib import Path
+from types import SimpleNamespace
+
+sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
+
+from src.repositories import UserRepository
+from src.services import UserService
+from src.utils.database import create_connection_factory
+
+
+class DummyLogger:
+ def info(self, *args, **kwargs):
+ return None
+
+ def error(self, *args, **kwargs):
+ return None
+
+ def warning(self, *args, **kwargs):
+ return None
+
+ def debug(self, *args, **kwargs):
+ return None
+
+
+class FakeConfigManager:
+ def __init__(self, payload):
+ self.payload = payload
+
+ def get_raw_config(self):
+ return deepcopy(self.payload)
+
+
+class UserModelPermissionTests(unittest.TestCase):
+ def setUp(self) -> None:
+ self._tempdir = tempfile.TemporaryDirectory()
+ self._db_path = Path(self._tempdir.name) / "requests.db"
+ self._get_connection = create_connection_factory(self._db_path)
+ self._config = {
+ "providers": [
+ {
+ "name": "demo",
+ "api": "https://example.com/v1/chat/completions",
+ "api_key": "sk-demo",
+ "model_list": ["gpt-4.1", "gpt-4.1-mini"],
+ }
+ ]
+ }
+ self._ctx = SimpleNamespace(
+ logger=DummyLogger(),
+ config_manager=FakeConfigManager(self._config),
+ )
+ self._repository = UserRepository(self._get_connection)
+ self._service = UserService(self._ctx, self._repository)
+
+ def tearDown(self) -> None:
+ self._tempdir.cleanup()
+
+ def test_user_repository_defaults_model_permissions_to_wildcard(self) -> None:
+ user_id = self._repository.create("alice", "127.0.0.1")
+
+ user = self._repository.get_by_id(user_id)
+
+ self.assertEqual("*", user["model_permissions"])
+
+ def test_update_user_model_permissions_supports_explicit_models(self) -> None:
+ user_id = self._repository.create("alice", "127.0.0.1")
+
+ updated = self._service.update_user(
+ user_id,
+ model_permissions_provided=True,
+ model_permissions=["demo/gpt-4.1-mini"],
+ )
+ user = self._service.get_user_by_id(user_id)
+
+ self.assertTrue(updated)
+ self.assertEqual(["demo/gpt-4.1-mini"], user["model_permissions"])
+ self.assertFalse(self._service.can_user_access_model(user, "demo/gpt-4.1"))
+ self.assertTrue(self._service.can_user_access_model(user, "demo/gpt-4.1-mini"))
+
+ def test_sync_model_permissions_prunes_deleted_models_from_explicit_users(self) -> None:
+ user_id = self._repository.create("alice", "127.0.0.1")
+ self._service.update_user(
+ user_id,
+ model_permissions_provided=True,
+ model_permissions=["demo/gpt-4.1", "demo/gpt-4.1-mini"],
+ )
+
+ self._config["providers"][0]["model_list"] = ["gpt-4.1"]
+ updated_count = self._service.sync_model_permissions()
+ user = self._service.get_user_by_id(user_id)
+
+ self.assertEqual(1, updated_count)
+ self.assertEqual(["demo/gpt-4.1"], user["model_permissions"])
+
+ def test_batch_update_model_permissions_updates_multiple_users(self) -> None:
+ alice_id = self._repository.create("alice", "127.0.0.1")
+ bob_id = self._repository.create("bob", "127.0.0.2")
+
+ result = self._service.batch_update_model_permissions(
+ [alice_id, bob_id],
+ ["demo/gpt-4.1-mini"],
+ )
+
+ alice = self._service.get_user_by_id(alice_id)
+ bob = self._service.get_user_by_id(bob_id)
+ self.assertEqual(2, result["count"])
+ self.assertEqual(["demo/gpt-4.1-mini"], result["model_permissions"])
+ self.assertEqual(["demo/gpt-4.1-mini"], alice["model_permissions"])
+ self.assertEqual(["demo/gpt-4.1-mini"], bob["model_permissions"])
+
+
+if __name__ == "__main__":
+ unittest.main()