初始提交：OCI 面板后端（含 GenAI 网关一期）

2026-07-09 15:31:04 +08:00
commit b9a3e97e84
168 changed files with 31794 additions and 0 deletions
@@ -0,0 +1,238 @@
+package api
+
+import (
+	"errors"
+	"net/http"
+	"strconv"
+
+	"github.com/gin-gonic/gin"
+	"github.com/oracle/oci-go-sdk/v65/common"
+	"gorm.io/gorm"
+
+	"oci-portal/internal/oci"
+	"oci-portal/internal/service"
+)
+
+type ociConfigHandler struct {
+	svc *service.OciConfigService
+}
+
+// importRequest 中 configIni 与显式字段二选一，私钥内容必填。
+type importRequest struct {
+	Alias            string `json:"alias" binding:"required"`
+	Group            string `json:"group"` // 面板内自定义分组，可空
+	ConfigINI        string `json:"configIni"`
+	TenancyOCID      string `json:"tenancyOcid"`
+	UserOCID         string `json:"userOcid"`
+	Region           string `json:"region"`
+	Fingerprint      string `json:"fingerprint"`
+	PrivateKey       string `json:"privateKey" binding:"required"`
+	Passphrase       string `json:"passphrase"`
+	MultiRegion      bool   `json:"multiRegion"`      // 开启后订阅区域入库缓存
+	MultiCompartment bool   `json:"multiCompartment"` // 开启后 compartment 入库缓存
+	ProxyID          *uint  `json:"proxyId"`          // 关联出站代理,null 直连
+}
+
+func (h *ociConfigHandler) create(c *gin.Context) {
+	var req importRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	cfg, err := h.svc.Import(c.Request.Context(), service.ImportInput{
+		Alias:            req.Alias,
+		Group:            req.Group,
+		ConfigINI:        req.ConfigINI,
+		TenancyOCID:      req.TenancyOCID,
+		UserOCID:         req.UserOCID,
+		Region:           req.Region,
+		Fingerprint:      req.Fingerprint,
+		PrivateKey:       req.PrivateKey,
+		Passphrase:       req.Passphrase,
+		MultiRegion:      req.MultiRegion,
+		MultiCompartment: req.MultiCompartment,
+		ProxyID:          req.ProxyID,
+	})
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusCreated, cfg)
+}
+
+func (h *ociConfigHandler) list(c *gin.Context) {
+	items, err := h.svc.List(c.Request.Context())
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	c.JSON(http.StatusOK, items)
+}
+
+func (h *ociConfigHandler) get(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	cfg, err := h.svc.Get(c.Request.Context(), id)
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, cfg)
+}
+
+func (h *ociConfigHandler) verify(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	cfg, changes, err := h.svc.Verify(c.Request.Context(), id)
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"config": cfg, "changes": changes})
+}
+
+// updateConfigRequest 空字段不变更；替换私钥须同时给新指纹；
+// passphrase / group 一经提供整体覆盖（空串分别表示清除口令 / 取消分组）。
+type updateConfigRequest struct {
+	Alias            string  `json:"alias"`
+	Group            *string `json:"group"`
+	Region           string  `json:"region"`
+	Fingerprint      string  `json:"fingerprint"`
+	PrivateKey       string  `json:"privateKey"`
+	Passphrase       *string `json:"passphrase"`
+	MultiRegion      *bool   `json:"multiRegion"`      // 非 null 时切换多区域支持
+	MultiCompartment *bool   `json:"multiCompartment"` // 非 null 时切换多区间支持
+	ProxyID          *uint   `json:"proxyId"`          // 非 null 切换代理:0 解除,>0 关联
+}
+
+func (h *ociConfigHandler) update(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	var req updateConfigRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+	cfg, changes, err := h.svc.Update(c.Request.Context(), id, service.UpdateInput{
+		Alias:            req.Alias,
+		Group:            req.Group,
+		Region:           req.Region,
+		Fingerprint:      req.Fingerprint,
+		PrivateKey:       req.PrivateKey,
+		Passphrase:       req.Passphrase,
+		MultiRegion:      req.MultiRegion,
+		MultiCompartment: req.MultiCompartment,
+		ProxyID:          req.ProxyID,
+	})
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"config": cfg, "changes": changes})
+}
+
+func (h *ociConfigHandler) remove(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	if err := h.svc.Delete(c.Request.Context(), id); err != nil {
+		respondError(c, err)
+		return
+	}
+	c.Status(http.StatusNoContent)
+}
+
+// compartments 列出租户下全部 ACTIVE compartment（不含租户根）。
+func (h *ociConfigHandler) compartments(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	items, err := h.svc.Compartments(c.Request.Context(), id)
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, items)
+}
+
+// cachedRegions 返回筛选器用区域列表：未开多区域支持只含默认区域；
+// 缓存存在非 READY 时实时刷新。
+func (h *ociConfigHandler) cachedRegions(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	items, err := h.svc.CachedRegions(c.Request.Context(), id)
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, items)
+}
+
+// cachedCompartments 返回筛选器用区间列表：未开多区间支持返回空数组。
+func (h *ociConfigHandler) cachedCompartments(c *gin.Context) {
+	id, ok := pathID(c)
+	if !ok {
+		return
+	}
+	items, err := h.svc.CachedCompartments(c.Request.Context(), id)
+	if err != nil {
+		respondError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, items)
+}
+
+func pathID(c *gin.Context) (uint, bool) {
+	id, err := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid id"})
+		return 0, false
+	}
+	return uint(id), true
+}
+
+func respondError(c *gin.Context, err error) {
+	status := http.StatusInternalServerError
+	if errors.Is(err, gorm.ErrRecordNotFound) {
+		status = http.StatusNotFound
+	}
+	var svcErr common.ServiceError
+	if errors.As(err, &svcErr) {
+		respondOCIError(c, err, svcErr)
+		return
+	}
+	c.JSON(status, gin.H{"error": err.Error()})
+}
+
+// respondOCIError 提炼 OCI 服务错误：透传 HTTP 状态码，
+// error 只保留操作前缀 + 错误码 + 服务端消息（oci.CompactError）。
+func respondOCIError(c *gin.Context, err error, svcErr common.ServiceError) {
+	status := svcErr.GetHTTPStatusCode()
+	if status < http.StatusBadRequest {
+		status = http.StatusBadGateway
+	}
+	// 面板的 401 专属本地 JWT 失效（前端收到即登出）；
+	// 上游 OCI 的 401 是代理调用被拒，改用 502 透出
+	if status == http.StatusUnauthorized {
+		status = http.StatusBadGateway
+	}
+	body := gin.H{
+		"error":        oci.CompactError(err),
+		"ociCode":      svcErr.GetCode(),
+		"opcRequestId": svcErr.GetOpcRequestID(),
+	}
+	if hint := oci.ErrorHint(err); hint != "" {
+		body["hint"] = hint
+	}
+	c.JSON(status, body)
+}