用户 API Key 管理:增删查、启用签名凭据;升级 SDK

internal/api/routes_oci.go

@@ -160,6 +160,10 @@ func registerOciTenantIAM(g *gin.RouterGroup, h *ociConfigHandler) {
 	g.POST("/oci-configs/:id/users/:userId/reset-password", h.resetTenantUserPassword)
 	g.DELETE("/oci-configs/:id/users/:userId/mfa-devices", h.deleteTenantUserMfa)
 	g.DELETE("/oci-configs/:id/users/:userId/api-keys", h.deleteTenantUserApiKeys)
+	g.GET("/oci-configs/:id/users/:userId/api-keys", h.listTenantUserApiKeys)
+	g.POST("/oci-configs/:id/users/:userId/api-keys", h.addTenantUserApiKey)
+	g.DELETE("/oci-configs/:id/users/:userId/api-keys/:fingerprint", h.deleteTenantUserApiKey)
+	g.POST("/oci-configs/:id/activate-api-key", h.activateApiKey)
 	g.GET("/oci-configs/:id/notification-recipients", h.getNotificationRecipients)
 	g.PUT("/oci-configs/:id/notification-recipients", h.updateNotificationRecipients)
 	g.GET("/oci-configs/:id/password-policies", h.listPasswordPolicies)

internal/api/swagger_resp.go

@@ -157,6 +157,11 @@ type deletedApiKeysResponse struct {
 	DeletedApiKeys int `json:"deletedApiKeys"`
 }
 
+// userApiKeysResponse 是用户 API 签名 key 列表。
+type userApiKeysResponse struct {
+	Items []service.UserApiKeyInfo `json:"items"`
+}
+
 // createInstancesResponse 是批量创建实例结果;部分成功仍 201,errors 为逐台失败信息。
 type createInstancesResponse struct {
 	Instances []oci.Instance `json:"instances"`

internal/api/tenant.go

@@ -371,6 +371,101 @@ func (h *ociConfigHandler) deleteTenantUserApiKeys(c *gin.Context) {
 	c.JSON(http.StatusOK, gin.H{"deletedApiKeys": deleted})
 }
 
+// @Summary  列出用户 API Key
+// @Tags     租户 IAM
+// @Param    id path int true "配置 ID"
+// @Param    userId path string true "userId"
+// @Success  200 {object} userApiKeysResponse
+// @Security BearerAuth
+// @Router   /api/v1/oci-configs/{id}/users/{userId}/api-keys [get]
+func (h *ociConfigHandler) listTenantUserApiKeys(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	keys, err := h.svc.TenantUserApiKeys(c.Request.Context(), id, c.Param("userId"))
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"items": keys})
+}
+
+// @Summary  为用户新增 API Key
+// @Description  后端生成 RSA-2048 密钥对并上传公钥;私钥仅本次响应返回,不落库。
+// @Tags     租户 IAM
+// @Param    id path int true "配置 ID"
+// @Param    userId path string true "userId"
+// @Success  200 {object} service.CreatedApiKey
+// @Security BearerAuth
+// @Router   /api/v1/oci-configs/{id}/users/{userId}/api-keys [post]
+func (h *ociConfigHandler) addTenantUserApiKey(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	created, err := h.svc.AddTenantUserApiKey(c.Request.Context(), id, c.Param("userId"))
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, created)
+}
+
+// @Summary  删除用户单把 API Key
+// @Description  当前配置正在使用的 key 拒删(409),避免面板失联。
+// @Tags     租户 IAM
+// @Param    id path int true "配置 ID"
+// @Param    userId path string true "userId"
+// @Param    fingerprint path string true "key 指纹"
+// @Success  204 "无内容"
+// @Security BearerAuth
+// @Router   /api/v1/oci-configs/{id}/users/{userId}/api-keys/{fingerprint} [delete]
+func (h *ociConfigHandler) deleteTenantUserApiKey(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	err := h.svc.DeleteTenantUserApiKey(c.Request.Context(), id, c.Param("userId"), c.Param("fingerprint"))
+	if errors.Is(err, service.ErrCurrentApiKey) {
+		c.JSON(http.StatusConflict, gin.H{"error": err.Error()})
+		return
+	}
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+// @Summary  启用 API Key 为面板签名凭据
+// @Description  将刚创建的 key 设为本配置签名凭据:验证可用后落库,不删除旧 key;私钥为创建时下发的那份回传。
+// @Tags     租户 IAM
+// @Param    id path int true "配置 ID"
+// @Param    body body object true "请求体:fingerprint 与 privateKey"
+// @Success  204 "无内容"
+// @Security BearerAuth
+// @Router   /api/v1/oci-configs/{id}/activate-api-key [post]
+func (h *ociConfigHandler) activateApiKey(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	var req struct {
+		Fingerprint string `json:"fingerprint"`
+		PrivateKey  string `json:"privateKey"`
+	}
+	if err := c.ShouldBindJSON(&req); err != nil || req.Fingerprint == "" || req.PrivateKey == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "fingerprint 与 privateKey 必填"})
+		return
+	}
+	if err := h.svc.ActivateApiKey(c.Request.Context(), id, req.Fingerprint, req.PrivateKey); err != nil {
+		respondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
 // ---- 域通知收件人与密码策略 ----
 
 // @Summary  ---- 域通知收件人与密码策略 ----