用户 API Key 管理:增删查、启用签名凭据;升级 SDK

internal/oci/tenantuser.go

@@ -760,6 +760,66 @@ func (c *RealClient) DeleteTenantUserApiKeys(ctx context.Context, cred Credentia
 	return deleted, nil
 }
 
+// TenantUserApiKey 是用户名下的一把 API 签名 key。
+type TenantUserApiKey struct {
+	Fingerprint string     `json:"fingerprint"`
+	TimeCreated *time.Time `json:"timeCreated"`
+	// IsCurrent 表示该 key 正被当前配置用于签名请求
+	IsCurrent bool `json:"isCurrent"`
+}
+
+// ListTenantUserApiKeys 实现 Client：列出用户的 API 签名 key。
+func (c *RealClient) ListTenantUserApiKeys(ctx context.Context, cred Credentials, homeRegion, userID string) ([]TenantUserApiKey, error) {
+	ic, err := c.identityClientAt(cred, homeRegion)
+	if err != nil {
+		return nil, err
+	}
+	resp, err := ic.ListApiKeys(ctx, identity.ListApiKeysRequest{UserId: &userID})
+	if err != nil {
+		return nil, fmt.Errorf("list api keys: %w", err)
+	}
+	keys := make([]TenantUserApiKey, 0, len(resp.Items))
+	for _, item := range resp.Items {
+		k := TenantUserApiKey{Fingerprint: deref(item.Fingerprint)}
+		if item.TimeCreated != nil {
+			t := item.TimeCreated.Time
+			k.TimeCreated = &t
+		}
+		k.IsCurrent = userID == cred.UserOCID && k.Fingerprint == cred.Fingerprint
+		keys = append(keys, k)
+	}
+	return keys, nil
+}
+
+// UploadTenantUserApiKey 实现 Client：为用户上传 RSA 公钥，返回 OCI 回填的指纹。
+func (c *RealClient) UploadTenantUserApiKey(ctx context.Context, cred Credentials, homeRegion, userID, publicKeyPEM string) (string, error) {
+	ic, err := c.identityClientAt(cred, homeRegion)
+	if err != nil {
+		return "", err
+	}
+	resp, err := ic.UploadApiKey(ctx, identity.UploadApiKeyRequest{
+		UserId:              &userID,
+		CreateApiKeyDetails: identity.CreateApiKeyDetails{Key: &publicKeyPEM},
+	})
+	if err != nil {
+		return "", fmt.Errorf("upload api key: %w", err)
+	}
+	return deref(resp.Fingerprint), nil
+}
+
+// DeleteTenantUserApiKey 实现 Client：按指纹删除用户的单把 API key。
+func (c *RealClient) DeleteTenantUserApiKey(ctx context.Context, cred Credentials, homeRegion, userID, fingerprint string) error {
+	ic, err := c.identityClientAt(cred, homeRegion)
+	if err != nil {
+		return err
+	}
+	_, err = ic.DeleteApiKey(ctx, identity.DeleteApiKeyRequest{UserId: &userID, Fingerprint: &fingerprint})
+	if err != nil {
+		return fmt.Errorf("delete api key %s: %w", fingerprint, err)
+	}
+	return nil
+}
+
 // scimUserID 用经典 OCID 在 Identity Domain 中解析 SCIM 用户 ID。
 func scimUserID(ctx context.Context, dc identitydomains.IdentityDomainsClient, classicOCID string) (string, error) {
 	u, found, err := domainUserByOcid(ctx, dc, classicOCID)