用户 API Key 管理:增删查、启用签名凭据;升级 SDK

docs/swagger.yaml

@@ -820,6 +820,13 @@ definitions:
       usedBy:
         type: integer
     type: object
+  internal_api.userApiKeysResponse:
+    properties:
+      items:
+        items:
+          $ref: '#/definitions/oci-portal_internal_service.UserApiKeyInfo'
+        type: array
+    type: object
   internal_api.webConsoleSessionResponse:
     properties:
       sessionId:
@@ -2619,6 +2626,15 @@ definitions:
       tenancyOcid:
         type: string
     type: object
+  oci-portal_internal_service.CreatedApiKey:
+    properties:
+      configIni:
+        type: string
+      fingerprint:
+        type: string
+      privateKey:
+        type: string
+    type: object
   oci-portal_internal_service.ImportFail:
     properties:
       line:
@@ -3006,6 +3022,18 @@ definitions:
       oidcIssuer:
         type: string
     type: object
+  oci-portal_internal_service.UserApiKeyInfo:
+    properties:
+      configIni:
+        type: string
+      fingerprint:
+        type: string
+      isCurrent:
+        description: IsCurrent 表示该 key 正被当前配置用于签名请求
+        type: boolean
+      timeCreated:
+        type: string
+    type: object
 info:
   contact: {}
   description: '自托管 OCI 多租户管理面板 API。业务接口用 JWT(Bearer);AI 网关端点(/ai/v1/*)用独立网关密钥(Authorization:
@@ -3964,6 +3992,29 @@ paths:
       summary: 更新租户配置
       tags:
       - 租户配置
+  /api/v1/oci-configs/{id}/activate-api-key:
+    post:
+      description: 将刚创建的 key 设为本配置签名凭据:验证可用后落库,不删除旧 key;私钥为创建时下发的那份回传。
+      parameters:
+      - description: 配置 ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: 请求体:fingerprint 与 privateKey
+        in: body
+        name: body
+        required: true
+        schema:
+          type: object
+      responses:
+        "204":
+          description: 无内容
+      security:
+      - BearerAuth: []
+      summary: 启用 API Key 为面板签名凭据
+      tags:
+      - 租户 IAM
   /api/v1/oci-configs/{id}/audit-events:
     get:
       parameters:
@@ -6631,6 +6682,78 @@ paths:
       summary: 清除用户全部 API Key
       tags:
       - 租户 IAM
+    get:
+      parameters:
+      - description: 配置 ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: userId
+        in: path
+        name: userId
+        required: true
+        type: string
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/internal_api.userApiKeysResponse'
+      security:
+      - BearerAuth: []
+      summary: 列出用户 API Key
+      tags:
+      - 租户 IAM
+    post:
+      description: 后端生成 RSA-2048 密钥对并上传公钥;私钥仅本次响应返回,不落库。
+      parameters:
+      - description: 配置 ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: userId
+        in: path
+        name: userId
+        required: true
+        type: string
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/oci-portal_internal_service.CreatedApiKey'
+      security:
+      - BearerAuth: []
+      summary: 为用户新增 API Key
+      tags:
+      - 租户 IAM
+  /api/v1/oci-configs/{id}/users/{userId}/api-keys/{fingerprint}:
+    delete:
+      description: 当前配置正在使用的 key 拒删(409),避免面板失联。
+      parameters:
+      - description: 配置 ID
+        in: path
+        name: id
+        required: true
+        type: integer
+      - description: userId
+        in: path
+        name: userId
+        required: true
+        type: string
+      - description: key 指纹
+        in: path
+        name: fingerprint
+        required: true
+        type: string
+      responses:
+        "204":
+          description: 无内容
+      security:
+      - BearerAuth: []
+      summary: 删除用户单把 API Key
+      tags:
+      - 租户 IAM
   /api/v1/oci-configs/{id}/users/{userId}/mfa-devices:
     delete:
       parameters: