diff --git a/.gitignore b/.gitignore index 10594f73..d4bf3f2b 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,6 @@ +# fork add +docs/ + # Dependencies node_modules/ npm-debug.log* diff --git a/README.md b/README.md index 2bcf7194..b3c37558 100644 --- a/README.md +++ b/README.md @@ -389,11 +389,20 @@ docker-compose.yml 已包含： **Claude Code 设置环境变量：** +默认使用标准 Claude 账号池： + ```bash export ANTHROPIC_BASE_URL="http://127.0.0.1:3000/api/" # 根据实际填写你服务器的ip地址或者域名 export ANTHROPIC_AUTH_TOKEN="后台创建的API密钥" ``` +如果后台添加了 Droid 类型账号池，请将基础地址改为： + +```bash +export ANTHROPIC_BASE_URL="http://127.0.0.1:3000/droid/claude" # 根据实际情况替换域名/IP +export ANTHROPIC_AUTH_TOKEN="后台创建的API密钥" +``` + **VSCode Claude 插件配置：** 如果使用 VSCode 的 Claude 插件，需要在 `~/.claude/config.json` 文件中配置： @@ -445,6 +454,8 @@ requires_openai_auth = true env_key = "CRS_OAI_KEY" ``` +如需通过 Droid 类型账号池访问 Codex CLI，只需将 `base_url` 改为 `http://127.0.0.1:3000/droid/openai`（其余配置保持不变）。 + 在 `~/.codex/auth.json` 文件中配置API密钥为 null： ```json @@ -461,6 +472,35 @@ export CRS_OAI_KEY="后台创建的API密钥" > ⚠️ 在通过 Nginx 反向代理 CRS 服务并使用 Codex CLI 时，需要在 http 块中添加 underscores_in_headers on;。因为 Nginx 默认会移除带下划线的请求头（如 session_id），一旦该头被丢弃，多账号环境下的粘性会话功能将失效。 +**Droid CLI 配置：** + +Droid CLI 读取 `~/.factory/config.json`。可以在该文件中添加自定义模型以指向本服务的新端点： + +```json +{ + "custom_models": [ + { + "model_display_name": "Sonnet 4.5 [Custom]", + "model": "claude-sonnet-4-5-20250929", + "base_url": "http://127.0.0.1:3000/droid/claude", + "api_key": "后台创建的API密钥", + "provider": "anthropic", + "max_tokens": 8192 + }, + { + "model_display_name": "GPT5-Codex [Custom]", + "model": "gpt-5-codex", + "base_url": "http://127.0.0.1:3000/droid/openai", + "api_key": "后台创建的API密钥", + "provider": "openai", + "max_tokens": 16384 + } + ] +} +``` + +> 💡 将示例中的 `http://127.0.0.1:3000` 替换为你的服务域名或公网地址，并写入后台生成的 API 密钥（cr_ 开头）。 + ### 5. 第三方工具API接入 本服务支持多种API端点格式，方便接入不同的第三方工具（如Cherry Studio等）。 @@ -515,6 +555,23 @@ gpt-5 # Codex使用固定模型ID - API地址填入：`http://你的服务器:3000/openai` - API Key填入：后台创建的API密钥（cr_开头） - **重要**：Codex只支持Openai-Response标准 +- 💡 如果希望在 Cherry Studio 中使用 Droid 类型账号，请改填 `http://你的服务器:3000/droid/openai`，并保持其他设置不变。 + +**4. Droid账号接入：** + +``` +# Claude Code / Droid CLI 使用的 API 地址 +http://你的服务器:3000/droid/claude + +# Codex CLI 使用的 API 地址 +http://你的服务器:3000/droid/openai +``` + +配置步骤： +- 供应商类型选择"Anthropic"或"Openai-Response"（根据模型类型） +- API地址填入：`http://你的服务器:3000/droid/claude` 或 `http://你的服务器:3000/droid/openai` +- API Key填入：后台创建的API密钥（cr_开头） +- 建议自定义模型名称以区分 Droid 账号池 **Cherry Studio 地址格式重要说明：** @@ -530,8 +587,10 @@ gpt-5 # Codex使用固定模型ID - 所有账号类型都使用相同的API密钥（在后台统一创建） - 根据不同的路由前缀自动识别账号类型 - `/claude/` - 使用Claude账号池 +- `/droid/claude/` - 使用Droid类型Claude账号池（服务于 Claude Code / Droid CLI） - `/gemini/` - 使用Gemini账号池 - `/openai/` - 使用Codex账号（只支持Openai-Response格式） +- `/droid/openai/` - 使用Droid类型OpenAI兼容账号池（服务于 Codex CLI） - 支持所有标准API端点（messages、models等） **重要说明：** @@ -670,13 +729,17 @@ redis-cli ping ## 🛠️ 进阶 -### 生产环境部署建议（重要！） +### 反向代理部署指南 -**强烈建议使用Caddy反向代理（自动HTTPS）** +在生产环境中，建议通过反向代理进行连接，以便使用自动 HTTPS、安全头部和性能优化。下面提供两种常用方案： **Caddy** 和 **Nginx Proxy Manager (NPM)**。 -建议使用Caddy作为反向代理，它会自动申请和更新SSL证书，配置更简单： +--- -**1. 安装Caddy** +## Caddy 方案 + +Caddy 是一款自动管理 HTTPS 证书的 Web 服务器，配置简单、性能优秀，很适合不需要 Docker 环境的部署方案。 + +**1. 安装 Caddy** ```bash # Ubuntu/Debian @@ -692,23 +755,23 @@ sudo yum copr enable @caddy/caddy sudo yum install caddy ``` -**2. Caddy配置（超简单！）** +**2. Caddy 配置** -编辑 `/etc/caddy/Caddyfile`： +编辑 `/etc/caddy/Caddyfile` ： -``` +```caddy your-domain.com { # 反向代理到本地服务 reverse_proxy 127.0.0.1:3000 { - # 支持流式响应（SSE） + # 支持流式响应或 SSE flush_interval -1 - # 传递真实IP + # 传递真实 IP header_up X-Real-IP {remote_host} header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} - # 超时设置（适合长连接） + # 长读/写超时配置 transport http { read_timeout 300s write_timeout 300s @@ -726,42 +789,132 @@ your-domain.com { } ``` -**3. 启动Caddy** +**3. 启动 Caddy** ```bash -# 测试配置 sudo caddy validate --config /etc/caddy/Caddyfile - -# 启动服务 sudo systemctl start caddy sudo systemctl enable caddy - -# 查看状态 sudo systemctl status caddy ``` -**4. 更新服务配置** +**4. 服务配置** -修改你的服务配置，让它只监听本地： +Caddy 会自动管理 HTTPS，因此可以将服务限制在本地进行监听： ```javascript // config/config.js module.exports = { server: { port: 3000, - host: '127.0.0.1' // 只监听本地，通过nginx代理 + host: '127.0.0.1' // 只监听本地 } - // ... 其他配置 } ``` -**Caddy优势：** +**Caddy 特点** -- 🔒 **自动HTTPS**: 自动申请和续期Let's Encrypt证书，零配置 -- 🛡️ **安全默认**: 默认启用现代安全协议和加密套件 -- 🚀 **流式支持**: 原生支持SSE/WebSocket等流式传输 -- 📊 **简单配置**: 配置文件极其简洁，易于维护 -- ⚡ **HTTP/2**: 默认启用HTTP/2，提升传输性能 +* 🔒 自动 HTTPS，零配置证书管理 +* 🛡️ 安全默认配置，启用现代 TLS 套件 +* ⚡ HTTP/2 和流式传输支持 +* 🔧 配置文件简洁，易于维护 + +--- + +## Nginx Proxy Manager (NPM) 方案 + +Nginx Proxy Manager 通过图形化界面管理反向代理和 HTTPS 证书，並以 Docker 容器部署。 + +**1. 在 NPM 创建新的 Proxy Host** + +Details 配置如下： + +| 项目 | 设置 | +| --------------------- | ----------------------- | +| Domain Names | relay.example.com | +| Scheme | http | +| Forward Hostname / IP | 192.168.0.1 (docker 机器 IP) | +| Forward Port | 3000 | +| Block Common Exploits | ☑️ | +| Websockets Support | ❌ **关闭** | +| Cache Assets | ❌ **关闭** | +| Access List | Publicly Accessible | + +> 注意： +> - 请确保 Claude Relay Service **监听 host 为 `0.0.0.0` 、容器 IP 或本机 IP**，以便 NPM 实现内网连接。 +> - **Websockets Support 和 Cache Assets 必须关闭**，否则会导致 SSE / 流式响应失败。 + +**2. Custom locations** + +無需添加任何内容，保持为空。 + +**3. SSL 设置** + +* **SSL Certificate**: Request a new SSL Certificate (Let's Encrypt) 或已有证书 +* ☑️ **Force SSL** +* ☑️ **HTTP/2 Support** +* ☑️ **HSTS Enabled** +* ☑️ **HSTS Subdomains** + +**4. Advanced 配置** + +Custom Nginx Configuration 中添加以下内容： + +```nginx +# 传递真实用户 IP +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Proto $scheme; + +# 支持 WebSocket / SSE 等流式通信 +proxy_http_version 1.1; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header Connection "upgrade"; +proxy_buffering off; + +# 长连接 / 超时设置（适合 AI 聊天流式传输） +proxy_read_timeout 300s; +proxy_send_timeout 300s; +proxy_connect_timeout 30s; + +# ---- 安全性设置 ---- +# 严格 HTTPS 策略 (HSTS) +add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + +# 阻挡点击劫持与内容嗅探 +add_header X-Frame-Options "DENY" always; +add_header X-Content-Type-Options "nosniff" always; + +# Referrer / Permissions 限制策略 +add_header Referrer-Policy "no-referrer-when-downgrade" always; +add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; + +# 隐藏服务器信息（等效于 Caddy 的 `-Server`） +proxy_hide_header Server; + +# ---- 性能微调 ---- +# 关闭代理端缓存，确保即时响应（SSE / Streaming） +proxy_cache_bypass $http_upgrade; +proxy_no_cache $http_upgrade; +proxy_request_buffering off; +``` + +**4. 启动和验证** + +* 保存后等待 NPM 自动申请 Let's Encrypt 证书（如果有）。 +* Dashboard 中查看 Proxy Host 状态，确保显示为 "Online"。 +* 访问 `https://relay.example.com`，如果显示绿色锁图标即表示 HTTPS 正常。 + +**NPM 特点** + +* 🔒 自动申请和续期证书 +* 🔧 图形化界面，方便管理多服务 +* ⚡ 原生支持 HTTP/2 / HTTPS +* 🚀 适合 Docker 容器部署 + +--- + +上述两种方案均可用于生产部署。 --- diff --git a/README_EN.md b/README_EN.md index f7b905b6..6573021b 100644 --- a/README_EN.md +++ b/README_EN.md @@ -327,13 +327,18 @@ redis-cli ping ## 🛠️ Advanced Usage -### Production Deployment Recommendations (Important!) +### Reverse Proxy Deployment Guide -**Strongly recommend using Caddy reverse proxy (Automatic HTTPS)** +For production environments, it is recommended to use a reverse proxy for automatic HTTPS, security headers, and performance optimization. Two common solutions are provided below: **Caddy** and **Nginx Proxy Manager (NPM)**. -Recommend using Caddy as reverse proxy, it will automatically apply and renew SSL certificates with simpler configuration: +--- + +## Caddy Solution + +Caddy is a web server that automatically manages HTTPS certificates, with simple configuration and excellent performance, ideal for deployments without Docker environments. **1. Install Caddy** + ```bash # Ubuntu/Debian sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https @@ -348,29 +353,30 @@ sudo yum copr enable @caddy/caddy sudo yum install caddy ``` -**2. Caddy Configuration (Super Simple!)** +**2. Caddy Configuration** Edit `/etc/caddy/Caddyfile`: -``` + +```caddy your-domain.com { # Reverse proxy to local service reverse_proxy 127.0.0.1:3000 { - # Support streaming responses (SSE) + # Support streaming responses or SSE flush_interval -1 - + # Pass real IP header_up X-Real-IP {remote_host} header_up X-Forwarded-For {remote_host} header_up X-Forwarded-Proto {scheme} - - # Timeout settings (suitable for long connections) + + # Long read/write timeout configuration transport http { read_timeout 300s write_timeout 300s dial_timeout 30s } } - + # Security headers header { Strict-Transport-Security "max-age=31536000; includeSubDomains" @@ -382,38 +388,131 @@ your-domain.com { ``` **3. Start Caddy** -```bash -# Test configuration -sudo caddy validate --config /etc/caddy/Caddyfile -# Start service +```bash +sudo caddy validate --config /etc/caddy/Caddyfile sudo systemctl start caddy sudo systemctl enable caddy - -# Check status sudo systemctl status caddy ``` -**4. Update service configuration** +**4. Service Configuration** + +Since Caddy automatically manages HTTPS, you can restrict the service to listen locally only: -Modify your service configuration to listen only locally: ```javascript // config/config.js module.exports = { server: { port: 3000, - host: '127.0.0.1' // Listen only locally, proxy through nginx + host: '127.0.0.1' // Listen locally only } - // ... other configurations } ``` -**Caddy Advantages:** -- 🔒 **Automatic HTTPS**: Automatically apply and renew Let's Encrypt certificates, zero configuration -- 🛡️ **Secure by Default**: Modern security protocols and cipher suites enabled by default -- 🚀 **Streaming Support**: Native support for SSE/WebSocket streaming -- 📊 **Simple Configuration**: Extremely concise configuration files, easy to maintain -- ⚡ **HTTP/2**: HTTP/2 enabled by default for improved performance +**Caddy Features** + +* 🔒 Automatic HTTPS with zero-configuration certificate management +* 🛡️ Secure default configuration with modern TLS suites +* ⚡ HTTP/2 and streaming support +* 🔧 Concise configuration files, easy to maintain + +--- + +## Nginx Proxy Manager (NPM) Solution + +Nginx Proxy Manager manages reverse proxies and HTTPS certificates through a graphical interface, deployed as a Docker container. + +**1. Create a New Proxy Host in NPM** + +Configure the Details as follows: + +| Item | Setting | +| --------------------- | ------------------------ | +| Domain Names | relay.example.com | +| Scheme | http | +| Forward Hostname / IP | 192.168.0.1 (docker host IP) | +| Forward Port | 3000 | +| Block Common Exploits | ☑️ | +| Websockets Support | ❌ **Disable** | +| Cache Assets | ❌ **Disable** | +| Access List | Publicly Accessible | + +> Note: +> - Ensure Claude Relay Service **listens on `0.0.0.0`, container IP, or host IP** to allow NPM internal network connections. +> - **Websockets Support and Cache Assets must be disabled**, otherwise SSE / streaming responses will fail. + +**2. Custom locations** + +No content needed, keep it empty. + +**3. SSL Settings** + +* **SSL Certificate**: Request a new SSL Certificate (Let's Encrypt) or existing certificate +* ☑️ **Force SSL** +* ☑️ **HTTP/2 Support** +* ☑️ **HSTS Enabled** +* ☑️ **HSTS Subdomains** + +**4. Advanced Configuration** + +Add the following to Custom Nginx Configuration: + +```nginx +# Pass real user IP +proxy_set_header X-Real-IP $remote_addr; +proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; +proxy_set_header X-Forwarded-Proto $scheme; + +# Support WebSocket / SSE streaming +proxy_http_version 1.1; +proxy_set_header Upgrade $http_upgrade; +proxy_set_header Connection "upgrade"; +proxy_buffering off; + +# Long connection / timeout settings (for AI chat streaming) +proxy_read_timeout 300s; +proxy_send_timeout 300s; +proxy_connect_timeout 30s; + +# ---- Security Settings ---- +# Strict HTTPS policy (HSTS) +add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + +# Block clickjacking and content sniffing +add_header X-Frame-Options "DENY" always; +add_header X-Content-Type-Options "nosniff" always; + +# Referrer / Permissions restriction policies +add_header Referrer-Policy "no-referrer-when-downgrade" always; +add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always; + +# Hide server information (equivalent to Caddy's `-Server`) +proxy_hide_header Server; + +# ---- Performance Tuning ---- +# Disable proxy caching for real-time responses (SSE / Streaming) +proxy_cache_bypass $http_upgrade; +proxy_no_cache $http_upgrade; +proxy_request_buffering off; +``` + +**5. Launch and Verify** + +* After saving, wait for NPM to automatically request Let's Encrypt certificate (if applicable). +* Check Proxy Host status in Dashboard to ensure it shows "Online". +* Visit `https://relay.example.com`, if the green lock icon appears, HTTPS is working properly. + +**NPM Features** + +* 🔒 Automatic certificate application and renewal +* 🔧 Graphical interface for easy multi-service management +* ⚡ Native HTTP/2 / HTTPS support +* 🚀 Ideal for Docker container deployments + +--- + +Both solutions are suitable for production deployment. If you use a Docker environment, **Nginx Proxy Manager is more convenient**; if you want to keep software lightweight and automated, **Caddy is a better choice**. --- diff --git a/VERSION b/VERSION index 299460d9..4cc87f7d 100644 --- a/VERSION +++ b/VERSION @@ -1 +1 @@ -1.1.164 +1.1.165 diff --git a/package.json b/package.json index 79fa3e23..72ea4720 100644 --- a/package.json +++ b/package.json @@ -69,10 +69,10 @@ "ora": "^5.4.1", "rate-limiter-flexible": "^5.0.5", "socks-proxy-agent": "^8.0.2", + "string-similarity": "^4.0.4", "table": "^6.8.1", "uuid": "^9.0.1", "winston": "^3.11.0", - "string-similarity": "^4.0.4", "winston-daily-rotate-file": "^4.7.1" }, "devDependencies": { diff --git a/src/app.js b/src/app.js index f0bdadb8..13d4d331 100644 --- a/src/app.js +++ b/src/app.js @@ -22,6 +22,7 @@ const openaiGeminiRoutes = require('./routes/openaiGeminiRoutes') const standardGeminiRoutes = require('./routes/standardGeminiRoutes') const openaiClaudeRoutes = require('./routes/openaiClaudeRoutes') const openaiRoutes = require('./routes/openaiRoutes') +const droidRoutes = require('./routes/droidRoutes') const userRoutes = require('./routes/userRoutes') const azureOpenaiRoutes = require('./routes/azureOpenaiRoutes') const webhookRoutes = require('./routes/webhook') @@ -262,6 +263,8 @@ class Application { this.app.use('/openai/gemini', openaiGeminiRoutes) this.app.use('/openai/claude', openaiClaudeRoutes) this.app.use('/openai', openaiRoutes) + // Droid 路由：支持多种 Factory.ai 端点 + this.app.use('/droid', droidRoutes) // Droid (Factory.ai) API 转发 this.app.use('/azure', azureOpenaiRoutes) this.app.use('/admin/webhook', webhookRoutes) diff --git a/src/middleware/auth.js b/src/middleware/auth.js index 2b55d69f..b89586a4 100644 --- a/src/middleware/auth.js +++ b/src/middleware/auth.js @@ -7,6 +7,37 @@ const redis = require('../models/redis') // const { RateLimiterRedis } = require('rate-limiter-flexible') // 暂时未使用 const ClientValidator = require('../validators/clientValidator') +const TOKEN_COUNT_PATHS = new Set([ + '/v1/messages/count_tokens', + '/api/v1/messages/count_tokens', + '/claude/v1/messages/count_tokens', + '/droid/claude/v1/messages/count_tokens' +]) + +function normalizeRequestPath(value) { + if (!value) { + return '/' + } + const lower = value.split('?')[0].toLowerCase() + const collapsed = lower.replace(/\/{2,}/g, '/') + if (collapsed.length > 1 && collapsed.endsWith('/')) { + return collapsed.slice(0, -1) + } + return collapsed || '/' +} + +function isTokenCountRequest(req) { + const combined = normalizeRequestPath(`${req.baseUrl || ''}${req.path || ''}`) + if (TOKEN_COUNT_PATHS.has(combined)) { + return true + } + const original = normalizeRequestPath(req.originalUrl || '') + if (TOKEN_COUNT_PATHS.has(original)) { + return true + } + return false +} + // 🔑 API Key验证中间件（优化版） const authenticateApiKey = async (req, res, next) => { const startTime = Date.now() @@ -49,8 +80,11 @@ const authenticateApiKey = async (req, res, next) => { }) } + const skipKeyRestrictions = isTokenCountRequest(req) + // 🔒 检查客户端限制（使用新的验证器） if ( + !skipKeyRestrictions && validation.keyData.enableClientRestriction && validation.keyData.allowedClients?.length > 0 ) { @@ -81,7 +115,7 @@ const authenticateApiKey = async (req, res, next) => { // 检查并发限制 const concurrencyLimit = validation.keyData.concurrencyLimit || 0 - if (concurrencyLimit > 0) { + if (!skipKeyRestrictions && concurrencyLimit > 0) { const concurrencyConfig = config.concurrency || {} const leaseSeconds = Math.max(concurrencyConfig.leaseSeconds || 900, 30) const rawRenewInterval = @@ -438,6 +472,7 @@ const authenticateApiKey = async (req, res, next) => { geminiAccountId: validation.keyData.geminiAccountId, openaiAccountId: validation.keyData.openaiAccountId, // 添加 OpenAI 账号ID bedrockAccountId: validation.keyData.bedrockAccountId, // 添加 Bedrock 账号ID + droidAccountId: validation.keyData.droidAccountId, permissions: validation.keyData.permissions, concurrencyLimit: validation.keyData.concurrencyLimit, rateLimitWindow: validation.keyData.rateLimitWindow, diff --git a/src/models/redis.js b/src/models/redis.js index 602d0bca..e4c27243 100644 --- a/src/models/redis.js +++ b/src/models/redis.js @@ -858,7 +858,9 @@ class RedisClient { // 获取账户创建时间来计算平均值 - 支持不同类型的账号 let accountData = {} - if (accountType === 'openai') { + if (accountType === 'droid') { + accountData = await this.client.hgetall(`droid:account:${accountId}`) + } else if (accountType === 'openai') { accountData = await this.client.hgetall(`openai:account:${accountId}`) } else if (accountType === 'openai-responses') { accountData = await this.client.hgetall(`openai_responses_account:${accountId}`) @@ -874,6 +876,9 @@ class RedisClient { if (!accountData.createdAt) { accountData = await this.client.hgetall(`openai_account:${accountId}`) } + if (!accountData.createdAt) { + accountData = await this.client.hgetall(`droid:account:${accountId}`) + } } const createdAt = accountData.createdAt ? new Date(accountData.createdAt) : new Date() const now = new Date() @@ -1066,6 +1071,35 @@ class RedisClient { const key = `claude:account:${accountId}` return await this.client.del(key) } + + // 🤖 Droid 账户相关操作 + async setDroidAccount(accountId, accountData) { + const key = `droid:account:${accountId}` + await this.client.hset(key, accountData) + } + + async getDroidAccount(accountId) { + const key = `droid:account:${accountId}` + return await this.client.hgetall(key) + } + + async getAllDroidAccounts() { + const keys = await this.client.keys('droid:account:*') + const accounts = [] + for (const key of keys) { + const accountData = await this.client.hgetall(key) + if (accountData && Object.keys(accountData).length > 0) { + accounts.push({ id: key.replace('droid:account:', ''), ...accountData }) + } + } + return accounts + } + + async deleteDroidAccount(accountId) { + const key = `droid:account:${accountId}` + return await this.client.del(key) + } + async setOpenAiAccount(accountId, accountData) { const key = `openai:account:${accountId}` await this.client.hset(key, accountData) diff --git a/src/routes/admin.js b/src/routes/admin.js index f55d092d..ff64da54 100644 --- a/src/routes/admin.js +++ b/src/routes/admin.js @@ -5,6 +5,7 @@ const claudeConsoleAccountService = require('../services/claudeConsoleAccountSer const bedrockAccountService = require('../services/bedrockAccountService') const ccrAccountService = require('../services/ccrAccountService') const geminiAccountService = require('../services/geminiAccountService') +const droidAccountService = require('../services/droidAccountService') const openaiAccountService = require('../services/openaiAccountService') const openaiResponsesAccountService = require('../services/openaiResponsesAccountService') const azureOpenaiAccountService = require('../services/azureOpenaiAccountService') @@ -13,6 +14,11 @@ const redis = require('../models/redis') const { authenticateAdmin } = require('../middleware/auth') const logger = require('../utils/logger') const oauthHelper = require('../utils/oauthHelper') +const { + startDeviceAuthorization, + pollDeviceAuthorization, + WorkOSDeviceAuthError +} = require('../utils/workosOAuthHelper') const CostCalculator = require('../utils/costCalculator') const pricingService = require('../services/pricingService') const claudeCodeHeadersService = require('../services/claudeCodeHeadersService') @@ -533,6 +539,7 @@ router.post('/api-keys', authenticateAdmin, async (req, res) => { geminiAccountId, openaiAccountId, bedrockAccountId, + droidAccountId, permissions, concurrencyLimit, rateLimitWindow, @@ -670,6 +677,18 @@ router.post('/api-keys', authenticateAdmin, async (req, res) => { } } + // 验证服务权限字段 + if ( + permissions !== undefined && + permissions !== null && + permissions !== '' && + !['claude', 'gemini', 'openai', 'droid', 'all'].includes(permissions) + ) { + return res.status(400).json({ + error: 'Invalid permissions value. Must be claude, gemini, openai, droid, or all' + }) + } + const newKey = await apiKeyService.generateApiKey({ name, description, @@ -680,6 +699,7 @@ router.post('/api-keys', authenticateAdmin, async (req, res) => { geminiAccountId, openaiAccountId, bedrockAccountId, + droidAccountId, permissions, concurrencyLimit, rateLimitWindow, @@ -721,6 +741,7 @@ router.post('/api-keys/batch', authenticateAdmin, async (req, res) => { geminiAccountId, openaiAccountId, bedrockAccountId, + droidAccountId, permissions, concurrencyLimit, rateLimitWindow, @@ -755,6 +776,17 @@ router.post('/api-keys/batch', authenticateAdmin, async (req, res) => { .json({ error: 'Base name must be less than 90 characters to allow for numbering' }) } + if ( + permissions !== undefined && + permissions !== null && + permissions !== '' && + !['claude', 'gemini', 'openai', 'droid', 'all'].includes(permissions) + ) { + return res.status(400).json({ + error: 'Invalid permissions value. Must be claude, gemini, openai, droid, or all' + }) + } + // 生成批量API Keys const createdKeys = [] const errors = [] @@ -772,6 +804,7 @@ router.post('/api-keys/batch', authenticateAdmin, async (req, res) => { geminiAccountId, openaiAccountId, bedrockAccountId, + droidAccountId, permissions, concurrencyLimit, rateLimitWindow, @@ -854,6 +887,15 @@ router.put('/api-keys/batch', authenticateAdmin, async (req, res) => { }) } + if ( + updates.permissions !== undefined && + !['claude', 'gemini', 'openai', 'droid', 'all'].includes(updates.permissions) + ) { + return res.status(400).json({ + error: 'Invalid permissions value. Must be claude, gemini, openai, droid, or all' + }) + } + logger.info( `🔄 Admin batch editing ${keyIds.length} API keys with updates: ${JSON.stringify(updates)}` ) @@ -939,6 +981,9 @@ router.put('/api-keys/batch', authenticateAdmin, async (req, res) => { if (updates.bedrockAccountId !== undefined) { finalUpdates.bedrockAccountId = updates.bedrockAccountId } + if (updates.droidAccountId !== undefined) { + finalUpdates.droidAccountId = updates.droidAccountId || '' + } // 处理标签操作 if (updates.tags !== undefined) { @@ -1025,6 +1070,7 @@ router.put('/api-keys/:keyId', authenticateAdmin, async (req, res) => { geminiAccountId, openaiAccountId, bedrockAccountId, + droidAccountId, permissions, enableModelRestriction, restrictedModels, @@ -1116,12 +1162,17 @@ router.put('/api-keys/:keyId', authenticateAdmin, async (req, res) => { updates.bedrockAccountId = bedrockAccountId || '' } + if (droidAccountId !== undefined) { + // 空字符串表示解绑，null或空字符串都设置为空字符串 + updates.droidAccountId = droidAccountId || '' + } + if (permissions !== undefined) { // 验证权限值 - if (!['claude', 'gemini', 'openai', 'all'].includes(permissions)) { - return res - .status(400) - .json({ error: 'Invalid permissions value. Must be claude, gemini, openai, or all' }) + if (!['claude', 'gemini', 'openai', 'droid', 'all'].includes(permissions)) { + return res.status(400).json({ + error: 'Invalid permissions value. Must be claude, gemini, openai, droid, or all' + }) } updates.permissions = permissions } @@ -4141,7 +4192,14 @@ router.get('/accounts/:accountId/usage-history', authenticateAdmin, async (req, const { accountId } = req.params const { platform = 'claude', days = 30 } = req.query - const allowedPlatforms = ['claude', 'claude-console', 'openai', 'openai-responses', 'gemini'] + const allowedPlatforms = [ + 'claude', + 'claude-console', + 'openai', + 'openai-responses', + 'gemini', + 'droid' + ] if (!allowedPlatforms.includes(platform)) { return res.status(400).json({ success: false, @@ -4151,7 +4209,8 @@ router.get('/accounts/:accountId/usage-history', authenticateAdmin, async (req, const accountTypeMap = { openai: 'openai', - 'openai-responses': 'openai-responses' + 'openai-responses': 'openai-responses', + droid: 'droid' } const fallbackModelMap = { @@ -4159,7 +4218,8 @@ router.get('/accounts/:accountId/usage-history', authenticateAdmin, async (req, 'claude-console': 'claude-3-5-sonnet-20241022', openai: 'gpt-4o-mini-2024-07-18', 'openai-responses': 'gpt-4o-mini-2024-07-18', - gemini: 'gemini-1.5-flash' + gemini: 'gemini-1.5-flash', + droid: 'unknown' } // 获取账户信息以获取创建时间 @@ -4183,6 +4243,9 @@ router.get('/accounts/:accountId/usage-history', authenticateAdmin, async (req, case 'gemini': accountData = await geminiAccountService.getAccount(accountId) break + case 'droid': + accountData = await droidAccountService.getAccount(accountId) + break } if (accountData && accountData.createdAt) { @@ -4387,6 +4450,7 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { openaiAccounts, ccrAccounts, openaiResponsesAccounts, + droidAccounts, todayStats, systemAverages, realtimeMetrics @@ -4400,6 +4464,7 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { redis.getAllOpenAIAccounts(), ccrAccountService.getAllAccounts(), openaiResponsesAccountService.getAllAccounts(true), + droidAccountService.getAllAccounts(), redis.getTodayStats(), redis.getSystemAverages(), redis.getRealtimeSystemMetrics() @@ -4407,6 +4472,42 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { // 处理Bedrock账户数据 const bedrockAccounts = bedrockAccountsResult.success ? bedrockAccountsResult.data : [] + const normalizeBoolean = (value) => value === true || value === 'true' + const isRateLimitedFlag = (status) => { + if (!status) { + return false + } + if (typeof status === 'string') { + return status === 'limited' + } + if (typeof status === 'object') { + return status.isRateLimited === true + } + return false + } + + const normalDroidAccounts = droidAccounts.filter( + (acc) => + normalizeBoolean(acc.isActive) && + acc.status !== 'blocked' && + acc.status !== 'unauthorized' && + normalizeBoolean(acc.schedulable) && + !isRateLimitedFlag(acc.rateLimitStatus) + ).length + const abnormalDroidAccounts = droidAccounts.filter( + (acc) => + !normalizeBoolean(acc.isActive) || acc.status === 'blocked' || acc.status === 'unauthorized' + ).length + const pausedDroidAccounts = droidAccounts.filter( + (acc) => + !normalizeBoolean(acc.schedulable) && + normalizeBoolean(acc.isActive) && + acc.status !== 'blocked' && + acc.status !== 'unauthorized' + ).length + const rateLimitedDroidAccounts = droidAccounts.filter((acc) => + isRateLimitedFlag(acc.rateLimitStatus) + ).length // 计算使用统计（统一使用allTokens） const totalTokensUsed = apiKeys.reduce( @@ -4654,7 +4755,8 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { abnormalBedrockAccounts + abnormalOpenAIAccounts + abnormalOpenAIResponsesAccounts + - abnormalCcrAccounts, + abnormalCcrAccounts + + abnormalDroidAccounts, pausedAccounts: pausedClaudeAccounts + pausedClaudeConsoleAccounts + @@ -4662,7 +4764,8 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { pausedBedrockAccounts + pausedOpenAIAccounts + pausedOpenAIResponsesAccounts + - pausedCcrAccounts, + pausedCcrAccounts + + pausedDroidAccounts, rateLimitedAccounts: rateLimitedClaudeAccounts + rateLimitedClaudeConsoleAccounts + @@ -4670,7 +4773,8 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { rateLimitedBedrockAccounts + rateLimitedOpenAIAccounts + rateLimitedOpenAIResponsesAccounts + - rateLimitedCcrAccounts, + rateLimitedCcrAccounts + + rateLimitedDroidAccounts, // 各平台详细统计 accountsByPlatform: { claude: { @@ -4721,6 +4825,13 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { abnormal: abnormalOpenAIResponsesAccounts, paused: pausedOpenAIResponsesAccounts, rateLimited: rateLimitedOpenAIResponsesAccounts + }, + droid: { + total: droidAccounts.length, + normal: normalDroidAccounts, + abnormal: abnormalDroidAccounts, + paused: pausedDroidAccounts, + rateLimited: rateLimitedDroidAccounts } }, // 保留旧字段以兼容 @@ -4731,7 +4842,8 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { normalBedrockAccounts + normalOpenAIAccounts + normalOpenAIResponsesAccounts + - normalCcrAccounts, + normalCcrAccounts + + normalDroidAccounts, totalClaudeAccounts: claudeAccounts.length + claudeConsoleAccounts.length, activeClaudeAccounts: normalClaudeAccounts + normalClaudeConsoleAccounts, rateLimitedClaudeAccounts: rateLimitedClaudeAccounts + rateLimitedClaudeConsoleAccounts, @@ -4769,6 +4881,7 @@ router.get('/dashboard', authenticateAdmin, async (req, res) => { redisConnected: redis.isConnected, claudeAccountsHealthy: normalClaudeAccounts + normalClaudeConsoleAccounts > 0, geminiAccountsHealthy: normalGeminiAccounts > 0, + droidAccountsHealthy: normalDroidAccounts > 0, uptime: process.uptime() }, systemTimezone: config.system.timezoneOffset || 8 @@ -8357,4 +8470,246 @@ router.post('/openai-responses-accounts/:id/reset-usage', authenticateAdmin, asy } }) +// 🤖 Droid 账户管理 + +// 生成 Droid OAuth 授权链接 +router.post('/droid-accounts/generate-auth-url', authenticateAdmin, async (req, res) => { + try { + const { proxy } = req.body || {} + const deviceAuth = await startDeviceAuthorization(proxy || null) + + const sessionId = crypto.randomUUID() + const expiresAt = new Date(Date.now() + deviceAuth.expiresIn * 1000).toISOString() + + await redis.setOAuthSession(sessionId, { + deviceCode: deviceAuth.deviceCode, + userCode: deviceAuth.userCode, + verificationUri: deviceAuth.verificationUri, + verificationUriComplete: deviceAuth.verificationUriComplete, + interval: deviceAuth.interval, + proxy: proxy || null, + createdAt: new Date().toISOString(), + expiresAt + }) + + logger.success('🤖 生成 Droid 设备码授权信息成功', { sessionId }) + return res.json({ + success: true, + data: { + sessionId, + userCode: deviceAuth.userCode, + verificationUri: deviceAuth.verificationUri, + verificationUriComplete: deviceAuth.verificationUriComplete, + expiresIn: deviceAuth.expiresIn, + interval: deviceAuth.interval, + instructions: [ + '1. 使用下方验证码进入授权页面并确认访问权限。', + '2. 在授权页面登录 Factory / Droid 账户并点击允许。', + '3. 回到此处点击“完成授权”完成凭证获取。' + ] + } + }) + } catch (error) { + const message = + error instanceof WorkOSDeviceAuthError ? error.message : error.message || '未知错误' + logger.error('❌ 生成 Droid 设备码授权失败:', message) + return res.status(500).json({ error: 'Failed to start Droid device authorization', message }) + } +}) + +// 交换 Droid 授权码 +router.post('/droid-accounts/exchange-code', authenticateAdmin, async (req, res) => { + const { sessionId, proxy } = req.body || {} + try { + if (!sessionId) { + return res.status(400).json({ error: 'Session ID is required' }) + } + + const oauthSession = await redis.getOAuthSession(sessionId) + if (!oauthSession) { + return res.status(400).json({ error: 'Invalid or expired OAuth session' }) + } + + if (oauthSession.expiresAt && new Date() > new Date(oauthSession.expiresAt)) { + await redis.deleteOAuthSession(sessionId) + return res + .status(400) + .json({ error: 'OAuth session has expired, please generate a new authorization URL' }) + } + + if (!oauthSession.deviceCode) { + await redis.deleteOAuthSession(sessionId) + return res.status(400).json({ error: 'OAuth session missing device code, please retry' }) + } + + const proxyConfig = proxy || oauthSession.proxy || null + const tokens = await pollDeviceAuthorization(oauthSession.deviceCode, proxyConfig) + + await redis.deleteOAuthSession(sessionId) + + logger.success('🤖 成功获取 Droid 访问令牌', { sessionId }) + return res.json({ success: true, data: { tokens } }) + } catch (error) { + if (error instanceof WorkOSDeviceAuthError) { + if (error.code === 'authorization_pending' || error.code === 'slow_down') { + const oauthSession = await redis.getOAuthSession(sessionId) + const expiresAt = oauthSession?.expiresAt ? new Date(oauthSession.expiresAt) : null + const remainingSeconds = + expiresAt instanceof Date && !Number.isNaN(expiresAt.getTime()) + ? Math.max(0, Math.floor((expiresAt.getTime() - Date.now()) / 1000)) + : null + + return res.json({ + success: false, + pending: true, + error: error.code, + message: error.message, + retryAfter: error.retryAfter || Number(oauthSession?.interval) || 5, + expiresIn: remainingSeconds + }) + } + + if (error.code === 'expired_token') { + await redis.deleteOAuthSession(sessionId) + return res.status(400).json({ + error: 'Device code expired', + message: '授权已过期，请重新生成设备码并再次授权' + }) + } + + logger.error('❌ Droid 授权失败:', error.message) + return res.status(500).json({ + error: 'Failed to exchange Droid authorization code', + message: error.message, + errorCode: error.code + }) + } + + logger.error('❌ 交换 Droid 授权码失败:', error) + return res.status(500).json({ + error: 'Failed to exchange Droid authorization code', + message: error.message + }) + } +}) + +// 获取所有 Droid 账户 +router.get('/droid-accounts', authenticateAdmin, async (req, res) => { + try { + const accounts = await droidAccountService.getAllAccounts() + const allApiKeys = await redis.getAllApiKeys() + + // 添加使用统计 + const accountsWithStats = await Promise.all( + accounts.map(async (account) => { + try { + const usageStats = await redis.getAccountUsageStats(account.id, 'droid') + let groupInfos = [] + try { + groupInfos = await accountGroupService.getAccountGroups(account.id) + } catch (groupError) { + logger.debug(`Failed to get group infos for Droid account ${account.id}:`, groupError) + groupInfos = [] + } + + const groupIds = groupInfos.map((group) => group.id) + const boundApiKeysCount = allApiKeys.reduce((count, key) => { + const binding = key.droidAccountId + if (!binding) { + return count + } + if (binding === account.id) { + return count + 1 + } + if (binding.startsWith('group:')) { + const groupId = binding.substring('group:'.length) + if (groupIds.includes(groupId)) { + return count + 1 + } + } + return count + }, 0) + + return { + ...account, + schedulable: account.schedulable === 'true', + boundApiKeysCount, + groupInfos, + usage: { + daily: usageStats.daily, + total: usageStats.total, + averages: usageStats.averages + } + } + } catch (error) { + logger.warn(`Failed to get stats for Droid account ${account.id}:`, error.message) + return { + ...account, + boundApiKeysCount: 0, + groupInfos: [], + usage: { + daily: { tokens: 0, requests: 0 }, + total: { tokens: 0, requests: 0 }, + averages: { rpm: 0, tpm: 0 } + } + } + } + }) + ) + + return res.json({ success: true, data: accountsWithStats }) + } catch (error) { + logger.error('Failed to get Droid accounts:', error) + return res.status(500).json({ error: 'Failed to get Droid accounts', message: error.message }) + } +}) + +// 创建 Droid 账户 +router.post('/droid-accounts', authenticateAdmin, async (req, res) => { + try { + const account = await droidAccountService.createAccount(req.body) + logger.success(`Created Droid account: ${account.name} (${account.id})`) + return res.json({ success: true, data: account }) + } catch (error) { + logger.error('Failed to create Droid account:', error) + return res.status(500).json({ error: 'Failed to create Droid account', message: error.message }) + } +}) + +// 更新 Droid 账户 +router.put('/droid-accounts/:id', authenticateAdmin, async (req, res) => { + try { + const { id } = req.params + const account = await droidAccountService.updateAccount(id, req.body) + return res.json({ success: true, data: account }) + } catch (error) { + logger.error(`Failed to update Droid account ${req.params.id}:`, error) + return res.status(500).json({ error: 'Failed to update Droid account', message: error.message }) + } +}) + +// 删除 Droid 账户 +router.delete('/droid-accounts/:id', authenticateAdmin, async (req, res) => { + try { + const { id } = req.params + await droidAccountService.deleteAccount(id) + return res.json({ success: true, message: 'Droid account deleted successfully' }) + } catch (error) { + logger.error(`Failed to delete Droid account ${req.params.id}:`, error) + return res.status(500).json({ error: 'Failed to delete Droid account', message: error.message }) + } +}) + +// 刷新 Droid 账户 token +router.post('/droid-accounts/:id/refresh-token', authenticateAdmin, async (req, res) => { + try { + const { id } = req.params + const result = await droidAccountService.refreshAccessToken(id) + return res.json({ success: true, data: result }) + } catch (error) { + logger.error(`Failed to refresh Droid account token ${req.params.id}:`, error) + return res.status(500).json({ error: 'Failed to refresh token', message: error.message }) + } +}) + module.exports = router diff --git a/src/routes/droidRoutes.js b/src/routes/droidRoutes.js new file mode 100644 index 00000000..5ae6c418 --- /dev/null +++ b/src/routes/droidRoutes.js @@ -0,0 +1,191 @@ +const crypto = require('crypto') +const express = require('express') +const { authenticateApiKey } = require('../middleware/auth') +const droidRelayService = require('../services/droidRelayService') +const sessionHelper = require('../utils/sessionHelper') +const logger = require('../utils/logger') + +const router = express.Router() + +function hasDroidPermission(apiKeyData) { + const permissions = apiKeyData?.permissions || 'all' + return permissions === 'all' || permissions === 'droid' +} + +/** + * Droid API 转发路由 + * + * 支持的 Factory.ai 端点: + * - /droid/claude - Anthropic (Claude) Messages API + * - /droid/openai - OpenAI Responses API + */ + +// Claude (Anthropic) 端点 - /v1/messages +router.post('/claude/v1/messages', authenticateApiKey, async (req, res) => { + try { + const sessionHash = sessionHelper.generateSessionHash(req.body) + + if (!hasDroidPermission(req.apiKey)) { + logger.security( + `🚫 API Key ${req.apiKey?.id || 'unknown'} 缺少 Droid 权限，拒绝访问 ${req.originalUrl}` + ) + return res.status(403).json({ + error: 'permission_denied', + message: '此 API Key 未启用 Droid 权限' + }) + } + + const result = await droidRelayService.relayRequest( + req.body, + req.apiKey, + req, + res, + req.headers, + { endpointType: 'anthropic', sessionHash } + ) + + // 如果是流式响应，已经在 relayService 中处理了 + if (result.streaming) { + return + } + + // 非流式响应 + res.status(result.statusCode).set(result.headers).send(result.body) + } catch (error) { + logger.error('Droid Claude relay error:', error) + res.status(500).json({ + error: 'internal_server_error', + message: error.message + }) + } +}) + +router.post('/claude/v1/messages/count_tokens', authenticateApiKey, async (req, res) => { + try { + const requestBody = { ...req.body } + if ('stream' in requestBody) { + delete requestBody.stream + } + const sessionHash = sessionHelper.generateSessionHash(requestBody) + + if (!hasDroidPermission(req.apiKey)) { + logger.security( + `🚫 API Key ${req.apiKey?.id || 'unknown'} 缺少 Droid 权限，拒绝访问 ${req.originalUrl}` + ) + return res.status(403).json({ + error: 'permission_denied', + message: '此 API Key 未启用 Droid 权限' + }) + } + + const result = await droidRelayService.relayRequest( + requestBody, + req.apiKey, + req, + res, + req.headers, + { + endpointType: 'anthropic', + sessionHash, + customPath: '/a/v1/messages/count_tokens', + skipUsageRecord: true, + disableStreaming: true + } + ) + + res.status(result.statusCode).set(result.headers).send(result.body) + } catch (error) { + logger.error('Droid Claude count_tokens relay error:', error) + res.status(500).json({ + error: 'internal_server_error', + message: error.message + }) + } +}) + +// OpenAI 端点 - /v1/responses +router.post(['/openai/v1/responses', '/openai/responses'], authenticateApiKey, async (req, res) => { + try { + const sessionId = + req.headers['session_id'] || + req.headers['x-session-id'] || + req.body?.session_id || + req.body?.conversation_id || + null + + const sessionHash = sessionId + ? crypto.createHash('sha256').update(String(sessionId)).digest('hex') + : null + + if (!hasDroidPermission(req.apiKey)) { + logger.security( + `🚫 API Key ${req.apiKey?.id || 'unknown'} 缺少 Droid 权限，拒绝访问 ${req.originalUrl}` + ) + return res.status(403).json({ + error: 'permission_denied', + message: '此 API Key 未启用 Droid 权限' + }) + } + + const result = await droidRelayService.relayRequest( + req.body, + req.apiKey, + req, + res, + req.headers, + { endpointType: 'openai', sessionHash } + ) + + if (result.streaming) { + return + } + + res.status(result.statusCode).set(result.headers).send(result.body) + } catch (error) { + logger.error('Droid OpenAI relay error:', error) + res.status(500).json({ + error: 'internal_server_error', + message: error.message + }) + } +}) + +// 模型列表端点（兼容性） +router.get('/*/v1/models', authenticateApiKey, async (req, res) => { + try { + // 返回可用的模型列表 + const models = [ + { + id: 'claude-opus-4-1-20250805', + object: 'model', + created: Date.now(), + owned_by: 'anthropic' + }, + { + id: 'claude-sonnet-4-5-20250929', + object: 'model', + created: Date.now(), + owned_by: 'anthropic' + }, + { + id: 'gpt-5-2025-08-07', + object: 'model', + created: Date.now(), + owned_by: 'openai' + } + ] + + res.json({ + object: 'list', + data: models + }) + } catch (error) { + logger.error('Droid models list error:', error) + res.status(500).json({ + error: 'internal_server_error', + message: error.message + }) + } +}) + +module.exports = router diff --git a/src/services/accountGroupService.js b/src/services/accountGroupService.js index 7268dad5..23293a18 100644 --- a/src/services/accountGroupService.js +++ b/src/services/accountGroupService.js @@ -27,8 +27,8 @@ class AccountGroupService { } // 验证平台类型 - if (!['claude', 'gemini', 'openai'].includes(platform)) { - throw new Error('平台类型必须是 claude、gemini 或 openai') + if (!['claude', 'gemini', 'openai', 'droid'].includes(platform)) { + throw new Error('平台类型必须是 claude、gemini、openai 或 droid') } const client = redis.getClientSafe() @@ -311,7 +311,8 @@ class AccountGroupService { keyData && (keyData.claudeAccountId === groupKey || keyData.geminiAccountId === groupKey || - keyData.openaiAccountId === groupKey) + keyData.openaiAccountId === groupKey || + keyData.droidAccountId === groupKey) ) { boundApiKeys.push({ id: keyId, diff --git a/src/services/apiKeyService.js b/src/services/apiKeyService.js index 5d63e72f..d187d54c 100644 --- a/src/services/apiKeyService.js +++ b/src/services/apiKeyService.js @@ -22,7 +22,8 @@ class ApiKeyService { openaiAccountId = null, azureOpenaiAccountId = null, bedrockAccountId = null, // 添加 Bedrock 账号ID支持 - permissions = 'all', // 'claude', 'gemini', 'openai', 'all' + droidAccountId = null, + permissions = 'all', // 可选值：'claude'、'gemini'、'openai'、'droid' 或 'all' isActive = true, concurrencyLimit = 0, rateLimitWindow = null, @@ -64,6 +65,7 @@ class ApiKeyService { openaiAccountId: openaiAccountId || '', azureOpenaiAccountId: azureOpenaiAccountId || '', bedrockAccountId: bedrockAccountId || '', // 添加 Bedrock 账号ID + droidAccountId: droidAccountId || '', permissions: permissions || 'all', enableModelRestriction: String(enableModelRestriction), restrictedModels: JSON.stringify(restrictedModels || []), @@ -109,6 +111,7 @@ class ApiKeyService { openaiAccountId: keyData.openaiAccountId, azureOpenaiAccountId: keyData.azureOpenaiAccountId, bedrockAccountId: keyData.bedrockAccountId, // 添加 Bedrock 账号ID + droidAccountId: keyData.droidAccountId, permissions: keyData.permissions, enableModelRestriction: keyData.enableModelRestriction === 'true', restrictedModels: JSON.parse(keyData.restrictedModels), @@ -256,6 +259,7 @@ class ApiKeyService { openaiAccountId: keyData.openaiAccountId, azureOpenaiAccountId: keyData.azureOpenaiAccountId, bedrockAccountId: keyData.bedrockAccountId, // 添加 Bedrock 账号ID + droidAccountId: keyData.droidAccountId, permissions: keyData.permissions || 'all', tokenLimit: parseInt(keyData.tokenLimit), concurrencyLimit: parseInt(keyData.concurrencyLimit || 0), @@ -382,6 +386,7 @@ class ApiKeyService { openaiAccountId: keyData.openaiAccountId, azureOpenaiAccountId: keyData.azureOpenaiAccountId, bedrockAccountId: keyData.bedrockAccountId, + droidAccountId: keyData.droidAccountId, permissions: keyData.permissions || 'all', tokenLimit: parseInt(keyData.tokenLimit), concurrencyLimit: parseInt(keyData.concurrencyLimit || 0), @@ -553,6 +558,7 @@ class ApiKeyService { 'openaiAccountId', 'azureOpenaiAccountId', 'bedrockAccountId', // 添加 Bedrock 账号ID + 'droidAccountId', 'permissions', 'expiresAt', 'activationDays', // 新增：激活后有效天数 @@ -1211,6 +1217,7 @@ class ApiKeyService { userId: key.userId, userUsername: key.userUsername, createdBy: key.createdBy, + droidAccountId: key.droidAccountId, // Include deletion fields for deleted keys isDeleted: key.isDeleted, deletedAt: key.deletedAt, @@ -1254,7 +1261,8 @@ class ApiKeyService { createdBy: keyData.createdBy, permissions: keyData.permissions, dailyCostLimit: parseFloat(keyData.dailyCostLimit || 0), - totalCostLimit: parseFloat(keyData.totalCostLimit || 0) + totalCostLimit: parseFloat(keyData.totalCostLimit || 0), + droidAccountId: keyData.droidAccountId } } catch (error) { logger.error('❌ Failed to get API key by ID:', error) @@ -1401,6 +1409,7 @@ class ApiKeyService { 'openai-responses': 'openaiAccountId', // 特殊处理，带 responses: 前缀 azure_openai: 'azureOpenaiAccountId', bedrock: 'bedrockAccountId', + droid: 'droidAccountId', ccr: null // CCR 账号没有对应的 API Key 字段 } diff --git a/src/services/droidAccountService.js b/src/services/droidAccountService.js new file mode 100644 index 00000000..b79fd3bf --- /dev/null +++ b/src/services/droidAccountService.js @@ -0,0 +1,1247 @@ +const { v4: uuidv4 } = require('uuid') +const crypto = require('crypto') +const axios = require('axios') +const redis = require('../models/redis') +const config = require('../../config/config') +const logger = require('../utils/logger') +const { maskToken } = require('../utils/tokenMask') +const ProxyHelper = require('../utils/proxyHelper') +const LRUCache = require('../utils/lruCache') + +/** + * Droid 账户管理服务 + * + * 支持 WorkOS OAuth 集成，管理 Droid (Factory.ai) 账户 + * 提供账户创建、token 刷新、代理配置等功能 + */ +class DroidAccountService { + constructor() { + // WorkOS OAuth 配置 + this.oauthTokenUrl = 'https://api.workos.com/user_management/authenticate' + this.factoryApiBaseUrl = 'https://app.factory.ai/api/llm' + + this.workosClientId = 'client_01HNM792M5G5G1A2THWPXKFMXB' + + // Token 刷新策略 + this.refreshIntervalHours = 6 // 每6小时刷新一次 + this.tokenValidHours = 8 // Token 有效期8小时 + + // 加密相关常量 + this.ENCRYPTION_ALGORITHM = 'aes-256-cbc' + this.ENCRYPTION_SALT = 'droid-account-salt' + + // 🚀 性能优化：缓存派生的加密密钥 + this._encryptionKeyCache = null + + // 🔄 解密结果缓存 + this._decryptCache = new LRUCache(500) + + // 🧹 定期清理缓存（每10分钟） + setInterval( + () => { + this._decryptCache.cleanup() + logger.info('🧹 Droid decrypt cache cleanup completed', this._decryptCache.getStats()) + }, + 10 * 60 * 1000 + ) + + this.supportedEndpointTypes = new Set(['anthropic', 'openai']) + } + + _sanitizeEndpointType(endpointType) { + if (!endpointType) { + return 'anthropic' + } + + const normalized = String(endpointType).toLowerCase() + if (normalized === 'openai' || normalized === 'common') { + return 'openai' + } + + if (this.supportedEndpointTypes.has(normalized)) { + return normalized + } + + return 'anthropic' + } + + /** + * 生成加密密钥（缓存优化） + */ + _generateEncryptionKey() { + if (!this._encryptionKeyCache) { + this._encryptionKeyCache = crypto.scryptSync( + config.security.encryptionKey, + this.ENCRYPTION_SALT, + 32 + ) + logger.info('🔑 Droid encryption key derived and cached for performance optimization') + } + return this._encryptionKeyCache + } + + /** + * 加密敏感数据 + */ + _encryptSensitiveData(text) { + if (!text) { + return '' + } + + const key = this._generateEncryptionKey() + const iv = crypto.randomBytes(16) + const cipher = crypto.createCipheriv(this.ENCRYPTION_ALGORITHM, key, iv) + + let encrypted = cipher.update(text, 'utf8', 'hex') + encrypted += cipher.final('hex') + + return `${iv.toString('hex')}:${encrypted}` + } + + /** + * 解密敏感数据（带缓存） + */ + _decryptSensitiveData(encryptedText) { + if (!encryptedText) { + return '' + } + + // 🎯 检查缓存 + const cacheKey = crypto.createHash('sha256').update(encryptedText).digest('hex') + const cached = this._decryptCache.get(cacheKey) + if (cached !== undefined) { + return cached + } + + try { + const key = this._generateEncryptionKey() + const parts = encryptedText.split(':') + const iv = Buffer.from(parts[0], 'hex') + const encrypted = parts[1] + + const decipher = crypto.createDecipheriv(this.ENCRYPTION_ALGORITHM, key, iv) + let decrypted = decipher.update(encrypted, 'hex', 'utf8') + decrypted += decipher.final('utf8') + + // 💾 存入缓存（5分钟过期） + this._decryptCache.set(cacheKey, decrypted, 5 * 60 * 1000) + + return decrypted + } catch (error) { + logger.error('❌ Failed to decrypt Droid data:', error) + return '' + } + } + + _parseApiKeyEntries(rawEntries) { + if (!rawEntries) { + return [] + } + + if (Array.isArray(rawEntries)) { + return rawEntries + } + + if (typeof rawEntries === 'string') { + try { + const parsed = JSON.parse(rawEntries) + return Array.isArray(parsed) ? parsed : [] + } catch (error) { + logger.warn('⚠️ Failed to parse Droid API Key entries:', error.message) + return [] + } + } + + return [] + } + + _buildApiKeyEntries(apiKeys, existingEntries = [], clearExisting = false) { + const now = new Date().toISOString() + const normalizedExisting = Array.isArray(existingEntries) ? existingEntries : [] + + const entries = clearExisting + ? [] + : normalizedExisting + .filter((entry) => entry && entry.id && entry.encryptedKey) + .map((entry) => ({ ...entry })) + + const hashSet = new Set(entries.map((entry) => entry.hash).filter(Boolean)) + + if (!Array.isArray(apiKeys) || apiKeys.length === 0) { + return entries + } + + for (const rawKey of apiKeys) { + if (typeof rawKey !== 'string') { + continue + } + + const trimmed = rawKey.trim() + if (!trimmed) { + continue + } + + const hash = crypto.createHash('sha256').update(trimmed).digest('hex') + if (hashSet.has(hash)) { + continue + } + + hashSet.add(hash) + + entries.push({ + id: uuidv4(), + hash, + encryptedKey: this._encryptSensitiveData(trimmed), + createdAt: now, + lastUsedAt: '', + usageCount: '0' + }) + } + + return entries + } + + _maskApiKeyEntries(entries) { + if (!Array.isArray(entries)) { + return [] + } + + return entries.map((entry) => ({ + id: entry.id, + createdAt: entry.createdAt || '', + lastUsedAt: entry.lastUsedAt || '', + usageCount: entry.usageCount || '0' + })) + } + + _decryptApiKeyEntry(entry) { + if (!entry || !entry.encryptedKey) { + return null + } + + const apiKey = this._decryptSensitiveData(entry.encryptedKey) + if (!apiKey) { + return null + } + + const usageCountNumber = Number(entry.usageCount) + + return { + id: entry.id, + key: apiKey, + hash: entry.hash || '', + createdAt: entry.createdAt || '', + lastUsedAt: entry.lastUsedAt || '', + usageCount: Number.isFinite(usageCountNumber) && usageCountNumber >= 0 ? usageCountNumber : 0 + } + } + + async getDecryptedApiKeyEntries(accountId) { + if (!accountId) { + return [] + } + + const accountData = await redis.getDroidAccount(accountId) + if (!accountData) { + return [] + } + + const entries = this._parseApiKeyEntries(accountData.apiKeys) + return entries + .map((entry) => this._decryptApiKeyEntry(entry)) + .filter((entry) => entry && entry.key) + } + + async touchApiKeyUsage(accountId, keyId) { + if (!accountId || !keyId) { + return + } + + try { + const accountData = await redis.getDroidAccount(accountId) + if (!accountData) { + return + } + + const entries = this._parseApiKeyEntries(accountData.apiKeys) + const index = entries.findIndex((entry) => entry.id === keyId) + + if (index === -1) { + return + } + + const updatedEntry = { ...entries[index] } + updatedEntry.lastUsedAt = new Date().toISOString() + const usageCount = Number(updatedEntry.usageCount) + updatedEntry.usageCount = String( + Number.isFinite(usageCount) && usageCount >= 0 ? usageCount + 1 : 1 + ) + + entries[index] = updatedEntry + + accountData.apiKeys = JSON.stringify(entries) + accountData.apiKeyCount = String(entries.length) + + await redis.setDroidAccount(accountId, accountData) + } catch (error) { + logger.warn(`⚠️ Failed to update API key usage for Droid account ${accountId}:`, error) + } + } + + /** + * 使用 WorkOS Refresh Token 刷新并验证凭证 + */ + async _refreshTokensWithWorkOS(refreshToken, proxyConfig = null, organizationId = null) { + if (!refreshToken || typeof refreshToken !== 'string') { + throw new Error('Refresh Token 无效') + } + + const formData = new URLSearchParams() + formData.append('grant_type', 'refresh_token') + formData.append('refresh_token', refreshToken) + formData.append('client_id', this.workosClientId) + if (organizationId) { + formData.append('organization_id', organizationId) + } + + const requestOptions = { + method: 'POST', + url: this.oauthTokenUrl, + headers: { + 'Content-Type': 'application/x-www-form-urlencoded' + }, + data: formData.toString(), + timeout: 30000 + } + + if (proxyConfig) { + const proxyAgent = ProxyHelper.createProxyAgent(proxyConfig) + if (proxyAgent) { + requestOptions.httpAgent = proxyAgent + requestOptions.httpsAgent = proxyAgent + logger.info( + `🌐 使用代理验证 Droid Refresh Token: ${ProxyHelper.getProxyDescription(proxyConfig)}` + ) + } + } + + const response = await axios(requestOptions) + if (!response.data || !response.data.access_token) { + throw new Error('WorkOS OAuth 返回数据无效') + } + + const { + access_token, + refresh_token, + user, + organization_id, + expires_in, + token_type, + authentication_method + } = response.data + + let expiresAt = response.data.expires_at || '' + if (!expiresAt) { + const expiresInSeconds = + typeof expires_in === 'number' && Number.isFinite(expires_in) + ? expires_in + : this.tokenValidHours * 3600 + expiresAt = new Date(Date.now() + expiresInSeconds * 1000).toISOString() + } + + return { + accessToken: access_token, + refreshToken: refresh_token || refreshToken, + expiresAt, + expiresIn: typeof expires_in === 'number' && Number.isFinite(expires_in) ? expires_in : null, + user: user || null, + organizationId: organization_id || '', + tokenType: token_type || 'Bearer', + authenticationMethod: authentication_method || '' + } + } + + /** + * 使用 Factory CLI 接口获取组织 ID 列表 + */ + async _fetchFactoryOrgIds(accessToken, proxyConfig = null) { + if (!accessToken) { + return [] + } + + const requestOptions = { + method: 'GET', + url: 'https://app.factory.ai/api/cli/org', + headers: { + Authorization: `Bearer ${accessToken}`, + 'Content-Type': 'application/json', + Accept: 'application/json', + 'x-factory-client': 'cli', + 'User-Agent': this.userAgent + }, + timeout: 15000 + } + + if (proxyConfig) { + const proxyAgent = ProxyHelper.createProxyAgent(proxyConfig) + if (proxyAgent) { + requestOptions.httpAgent = proxyAgent + requestOptions.httpsAgent = proxyAgent + } + } + + try { + const response = await axios(requestOptions) + const data = response.data || {} + if (Array.isArray(data.workosOrgIds) && data.workosOrgIds.length > 0) { + return data.workosOrgIds + } + logger.warn('⚠️ 未从 Factory CLI 接口获取到 workosOrgIds') + return [] + } catch (error) { + logger.warn('⚠️ 获取 Factory 组织信息失败:', error.message) + return [] + } + } + + /** + * 创建 Droid 账户 + * + * @param {Object} options - 账户配置选项 + * @returns {Promise} 创建的账户信息 + */ + async createAccount(options = {}) { + const { + name = 'Unnamed Droid Account', + description = '', + refreshToken = '', // WorkOS refresh token + accessToken = '', // WorkOS access token (可选) + expiresAt = '', // Token 过期时间 + proxy = null, // { type: 'socks5', host: 'localhost', port: 1080, username: '', password: '' } + isActive = true, + accountType = 'shared', // 'dedicated' or 'shared' + platform = 'droid', + priority = 50, // 调度优先级 (1-100) + schedulable = true, // 是否可被调度 + endpointType = 'anthropic', // 默认端点类型: 'anthropic' 或 'openai' + organizationId = '', + ownerEmail = '', + ownerName = '', + userId = '', + tokenType = 'Bearer', + authenticationMethod = '', + expiresIn = null, + apiKeys = [] + } = options + + const accountId = uuidv4() + + const normalizedEndpointType = this._sanitizeEndpointType(endpointType) + + let normalizedRefreshToken = refreshToken + let normalizedAccessToken = accessToken + let normalizedExpiresAt = expiresAt || '' + let normalizedExpiresIn = expiresIn + let normalizedOrganizationId = organizationId || '' + let normalizedOwnerEmail = ownerEmail || '' + let normalizedOwnerName = ownerName || '' + let normalizedOwnerDisplayName = ownerName || ownerEmail || '' + let normalizedUserId = userId || '' + let normalizedTokenType = tokenType || 'Bearer' + let normalizedAuthenticationMethod = authenticationMethod || '' + let lastRefreshAt = accessToken ? new Date().toISOString() : '' + let status = accessToken ? 'active' : 'created' + + const apiKeyEntries = this._buildApiKeyEntries(apiKeys) + const hasApiKeys = apiKeyEntries.length > 0 + + if (hasApiKeys) { + normalizedAuthenticationMethod = 'api_key' + normalizedAccessToken = '' + normalizedRefreshToken = '' + normalizedExpiresAt = '' + normalizedExpiresIn = null + lastRefreshAt = '' + status = 'active' + } + + const normalizedAuthMethod = + typeof normalizedAuthenticationMethod === 'string' + ? normalizedAuthenticationMethod.toLowerCase().trim() + : '' + + const isApiKeyProvision = normalizedAuthMethod === 'api_key' + const isManualProvision = normalizedAuthMethod === 'manual' + + const provisioningMode = isApiKeyProvision ? 'api_key' : isManualProvision ? 'manual' : 'oauth' + + if (isApiKeyProvision) { + logger.info( + `🔍 [Droid api_key] 初始密钥 - AccountName: ${name}, KeyCount: ${apiKeyEntries.length}` + ) + } else { + logger.info( + `🔍 [Droid ${provisioningMode}] 初始令牌 - AccountName: ${name}, AccessToken: ${ + normalizedAccessToken || '[empty]' + }, RefreshToken: ${normalizedRefreshToken || '[empty]'}` + ) + } + + let proxyConfig = null + if (proxy && typeof proxy === 'object') { + proxyConfig = proxy + } else if (typeof proxy === 'string' && proxy.trim()) { + try { + proxyConfig = JSON.parse(proxy) + } catch (error) { + logger.warn('⚠️ Droid 代理配置解析失败，已忽略:', error.message) + proxyConfig = null + } + } + + if (!isApiKeyProvision && normalizedRefreshToken && isManualProvision) { + try { + const refreshed = await this._refreshTokensWithWorkOS(normalizedRefreshToken, proxyConfig) + + logger.info( + `🔍 [Droid manual] 刷新后令牌 - AccountName: ${name}, AccessToken: ${refreshed.accessToken || '[empty]'}, RefreshToken: ${refreshed.refreshToken || '[empty]'}, ExpiresAt: ${refreshed.expiresAt || '[empty]'}, ExpiresIn: ${ + refreshed.expiresIn !== null && refreshed.expiresIn !== undefined + ? refreshed.expiresIn + : '[empty]' + }` + ) + + normalizedAccessToken = refreshed.accessToken + normalizedRefreshToken = refreshed.refreshToken + normalizedExpiresAt = refreshed.expiresAt || normalizedExpiresAt + normalizedTokenType = refreshed.tokenType || normalizedTokenType + normalizedAuthenticationMethod = + refreshed.authenticationMethod || normalizedAuthenticationMethod + if (refreshed.expiresIn !== null) { + normalizedExpiresIn = refreshed.expiresIn + } + if (refreshed.organizationId) { + normalizedOrganizationId = refreshed.organizationId + } + + if (refreshed.user) { + const userInfo = refreshed.user + if (typeof userInfo.email === 'string' && userInfo.email.trim()) { + normalizedOwnerEmail = userInfo.email.trim() + } + const nameParts = [] + if (typeof userInfo.first_name === 'string' && userInfo.first_name.trim()) { + nameParts.push(userInfo.first_name.trim()) + } + if (typeof userInfo.last_name === 'string' && userInfo.last_name.trim()) { + nameParts.push(userInfo.last_name.trim()) + } + const derivedName = + nameParts.join(' ').trim() || + (typeof userInfo.name === 'string' ? userInfo.name.trim() : '') || + (typeof userInfo.display_name === 'string' ? userInfo.display_name.trim() : '') + + if (derivedName) { + normalizedOwnerName = derivedName + normalizedOwnerDisplayName = derivedName + } else if (normalizedOwnerEmail) { + normalizedOwnerName = normalizedOwnerName || normalizedOwnerEmail + normalizedOwnerDisplayName = + normalizedOwnerDisplayName || normalizedOwnerEmail || normalizedOwnerName + } + + if (typeof userInfo.id === 'string' && userInfo.id.trim()) { + normalizedUserId = userInfo.id.trim() + } + } + + lastRefreshAt = new Date().toISOString() + status = 'active' + logger.success(`✅ 使用 Refresh Token 成功验证并刷新 Droid 账户: ${name} (${accountId})`) + } catch (error) { + logger.error('❌ 使用 Refresh Token 验证 Droid 账户失败:', error) + throw new Error(`Refresh Token 验证失败：${error.message}`) + } + } else if (!isApiKeyProvision && normalizedRefreshToken && !isManualProvision) { + try { + const orgIds = await this._fetchFactoryOrgIds(normalizedAccessToken, proxyConfig) + const selectedOrgId = + normalizedOrganizationId || + (Array.isArray(orgIds) + ? orgIds.find((id) => typeof id === 'string' && id.trim()) + : null) || + '' + + if (!selectedOrgId) { + logger.warn(`⚠️ [Droid oauth] 未获取到组织ID，跳过 WorkOS 刷新: ${name} (${accountId})`) + } else { + const refreshed = await this._refreshTokensWithWorkOS( + normalizedRefreshToken, + proxyConfig, + selectedOrgId + ) + + logger.info( + `🔍 [Droid oauth] 组织刷新后令牌 - AccountName: ${name}, AccessToken: ${refreshed.accessToken || '[empty]'}, RefreshToken: ${refreshed.refreshToken || '[empty]'}, OrganizationId: ${ + refreshed.organizationId || selectedOrgId + }, ExpiresAt: ${refreshed.expiresAt || '[empty]'}` + ) + + normalizedAccessToken = refreshed.accessToken + normalizedRefreshToken = refreshed.refreshToken + normalizedExpiresAt = refreshed.expiresAt || normalizedExpiresAt + normalizedTokenType = refreshed.tokenType || normalizedTokenType + normalizedAuthenticationMethod = + refreshed.authenticationMethod || normalizedAuthenticationMethod + if (refreshed.expiresIn !== null && refreshed.expiresIn !== undefined) { + normalizedExpiresIn = refreshed.expiresIn + } + if (refreshed.organizationId) { + normalizedOrganizationId = refreshed.organizationId + } else { + normalizedOrganizationId = selectedOrgId + } + + if (refreshed.user) { + const userInfo = refreshed.user + if (typeof userInfo.email === 'string' && userInfo.email.trim()) { + normalizedOwnerEmail = userInfo.email.trim() + } + const nameParts = [] + if (typeof userInfo.first_name === 'string' && userInfo.first_name.trim()) { + nameParts.push(userInfo.first_name.trim()) + } + if (typeof userInfo.last_name === 'string' && userInfo.last_name.trim()) { + nameParts.push(userInfo.last_name.trim()) + } + const derivedName = + nameParts.join(' ').trim() || + (typeof userInfo.name === 'string' ? userInfo.name.trim() : '') || + (typeof userInfo.display_name === 'string' ? userInfo.display_name.trim() : '') + + if (derivedName) { + normalizedOwnerName = derivedName + normalizedOwnerDisplayName = derivedName + } else if (normalizedOwnerEmail) { + normalizedOwnerName = normalizedOwnerName || normalizedOwnerEmail + normalizedOwnerDisplayName = + normalizedOwnerDisplayName || normalizedOwnerEmail || normalizedOwnerName + } + + if (typeof userInfo.id === 'string' && userInfo.id.trim()) { + normalizedUserId = userInfo.id.trim() + } + } + + lastRefreshAt = new Date().toISOString() + status = 'active' + } + } catch (error) { + logger.warn(`⚠️ [Droid oauth] 初始化刷新失败: ${name} (${accountId}) - ${error.message}`) + } + } + + if (!isApiKeyProvision && !normalizedExpiresAt) { + let expiresInSeconds = null + if (typeof normalizedExpiresIn === 'number' && Number.isFinite(normalizedExpiresIn)) { + expiresInSeconds = normalizedExpiresIn + } else if ( + typeof normalizedExpiresIn === 'string' && + normalizedExpiresIn.trim() && + !Number.isNaN(Number(normalizedExpiresIn)) + ) { + expiresInSeconds = Number(normalizedExpiresIn) + } + + if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) { + expiresInSeconds = this.tokenValidHours * 3600 + } + + normalizedExpiresAt = new Date(Date.now() + expiresInSeconds * 1000).toISOString() + normalizedExpiresIn = expiresInSeconds + } + + logger.info( + `🔍 [Droid ${provisioningMode}] 写入前令牌快照 - AccountName: ${name}, AccessToken: ${normalizedAccessToken || '[empty]'}, RefreshToken: ${normalizedRefreshToken || '[empty]'}, ExpiresAt: ${normalizedExpiresAt || '[empty]'}, ExpiresIn: ${ + normalizedExpiresIn !== null && normalizedExpiresIn !== undefined + ? normalizedExpiresIn + : '[empty]' + }` + ) + + const accountData = { + id: accountId, + name, + description, + refreshToken: this._encryptSensitiveData(normalizedRefreshToken), + accessToken: this._encryptSensitiveData(normalizedAccessToken), + expiresAt: normalizedExpiresAt || '', + proxy: proxy ? JSON.stringify(proxy) : '', + isActive: isActive.toString(), + accountType, + platform, + priority: priority.toString(), + createdAt: new Date().toISOString(), + lastUsedAt: '', + lastRefreshAt, + status, // created, active, expired, error + errorMessage: '', + schedulable: schedulable.toString(), + endpointType: normalizedEndpointType, // anthropic 或 openai + organizationId: normalizedOrganizationId || '', + owner: normalizedOwnerName || normalizedOwnerEmail || '', + ownerEmail: normalizedOwnerEmail || '', + ownerName: normalizedOwnerName || '', + ownerDisplayName: + normalizedOwnerDisplayName || normalizedOwnerName || normalizedOwnerEmail || '', + userId: normalizedUserId || '', + tokenType: normalizedTokenType || 'Bearer', + authenticationMethod: normalizedAuthenticationMethod || '', + expiresIn: + normalizedExpiresIn !== null && normalizedExpiresIn !== undefined + ? String(normalizedExpiresIn) + : '', + apiKeys: hasApiKeys ? JSON.stringify(apiKeyEntries) : '', + apiKeyCount: hasApiKeys ? String(apiKeyEntries.length) : '0', + apiKeyStrategy: hasApiKeys ? 'random_sticky' : '' + } + + await redis.setDroidAccount(accountId, accountData) + + logger.success( + `🏢 Created Droid account: ${name} (${accountId}) - Endpoint: ${normalizedEndpointType}` + ) + + try { + const verifyAccount = await this.getAccount(accountId) + logger.info( + `🔍 [Droid ${provisioningMode}] Redis 写入后验证 - AccountName: ${name}, AccessToken: ${verifyAccount?.accessToken || '[empty]'}, RefreshToken: ${verifyAccount?.refreshToken || '[empty]'}, ExpiresAt: ${verifyAccount?.expiresAt || '[empty]'}` + ) + } catch (verifyError) { + logger.warn( + `⚠️ [Droid ${provisioningMode}] 写入后验证失败: ${name} (${accountId}) - ${verifyError.message}` + ) + } + return { id: accountId, ...accountData } + } + + /** + * 获取 Droid 账户信息 + */ + async getAccount(accountId) { + const account = await redis.getDroidAccount(accountId) + if (!account || Object.keys(account).length === 0) { + return null + } + + // 解密敏感数据 + const apiKeyEntries = this._parseApiKeyEntries(account.apiKeys) + + return { + ...account, + id: accountId, + endpointType: this._sanitizeEndpointType(account.endpointType), + refreshToken: this._decryptSensitiveData(account.refreshToken), + accessToken: this._decryptSensitiveData(account.accessToken), + apiKeys: this._maskApiKeyEntries(apiKeyEntries), + apiKeyCount: apiKeyEntries.length + } + } + + /** + * 获取所有 Droid 账户 + */ + async getAllAccounts() { + const accounts = await redis.getAllDroidAccounts() + return accounts.map((account) => ({ + ...account, + endpointType: this._sanitizeEndpointType(account.endpointType), + // 不解密完整 token，只返回掩码 + refreshToken: account.refreshToken ? '***ENCRYPTED***' : '', + accessToken: account.accessToken + ? maskToken(this._decryptSensitiveData(account.accessToken)) + : '', + apiKeyCount: (() => { + const parsedCount = this._parseApiKeyEntries(account.apiKeys).length + if (account.apiKeyCount === undefined || account.apiKeyCount === null) { + return parsedCount + } + const numeric = Number(account.apiKeyCount) + return Number.isFinite(numeric) && numeric >= 0 ? numeric : parsedCount + })() + })) + } + + /** + * 更新 Droid 账户 + */ + async updateAccount(accountId, updates) { + const account = await this.getAccount(accountId) + if (!account) { + throw new Error(`Droid account not found: ${accountId}`) + } + + const sanitizedUpdates = { ...updates } + + if (typeof sanitizedUpdates.accessToken === 'string') { + sanitizedUpdates.accessToken = sanitizedUpdates.accessToken.trim() + } + if (typeof sanitizedUpdates.refreshToken === 'string') { + sanitizedUpdates.refreshToken = sanitizedUpdates.refreshToken.trim() + } + + if (sanitizedUpdates.endpointType) { + sanitizedUpdates.endpointType = this._sanitizeEndpointType(sanitizedUpdates.endpointType) + } + + const parseProxyConfig = (value) => { + if (!value) { + return null + } + if (typeof value === 'object') { + return value + } + if (typeof value === 'string' && value.trim()) { + try { + return JSON.parse(value) + } catch (error) { + logger.warn('⚠️ Failed to parse stored Droid proxy config:', error.message) + } + } + return null + } + + let proxyConfig = null + if (updates.proxy !== undefined) { + if (updates.proxy && typeof updates.proxy === 'object') { + proxyConfig = updates.proxy + sanitizedUpdates.proxy = JSON.stringify(updates.proxy) + } else if (typeof updates.proxy === 'string' && updates.proxy.trim()) { + proxyConfig = parseProxyConfig(updates.proxy) + sanitizedUpdates.proxy = updates.proxy + } else { + sanitizedUpdates.proxy = '' + } + } else if (account.proxy) { + proxyConfig = parseProxyConfig(account.proxy) + } + + const hasNewRefreshToken = + typeof sanitizedUpdates.refreshToken === 'string' && sanitizedUpdates.refreshToken + + if (hasNewRefreshToken) { + try { + const refreshed = await this._refreshTokensWithWorkOS( + sanitizedUpdates.refreshToken, + proxyConfig + ) + + sanitizedUpdates.accessToken = refreshed.accessToken + sanitizedUpdates.refreshToken = refreshed.refreshToken || sanitizedUpdates.refreshToken + sanitizedUpdates.expiresAt = + refreshed.expiresAt || sanitizedUpdates.expiresAt || account.expiresAt || '' + + if (refreshed.expiresIn !== null && refreshed.expiresIn !== undefined) { + sanitizedUpdates.expiresIn = String(refreshed.expiresIn) + } + + sanitizedUpdates.tokenType = refreshed.tokenType || account.tokenType || 'Bearer' + sanitizedUpdates.authenticationMethod = + refreshed.authenticationMethod || account.authenticationMethod || '' + sanitizedUpdates.organizationId = + sanitizedUpdates.organizationId || + refreshed.organizationId || + account.organizationId || + '' + sanitizedUpdates.lastRefreshAt = new Date().toISOString() + sanitizedUpdates.status = 'active' + sanitizedUpdates.errorMessage = '' + + if (refreshed.user) { + const userInfo = refreshed.user + const email = typeof userInfo.email === 'string' ? userInfo.email.trim() : '' + if (email) { + sanitizedUpdates.ownerEmail = email + } + + const nameParts = [] + if (typeof userInfo.first_name === 'string' && userInfo.first_name.trim()) { + nameParts.push(userInfo.first_name.trim()) + } + if (typeof userInfo.last_name === 'string' && userInfo.last_name.trim()) { + nameParts.push(userInfo.last_name.trim()) + } + + const derivedName = + nameParts.join(' ').trim() || + (typeof userInfo.name === 'string' ? userInfo.name.trim() : '') || + (typeof userInfo.display_name === 'string' ? userInfo.display_name.trim() : '') + + if (derivedName) { + sanitizedUpdates.ownerName = derivedName + sanitizedUpdates.ownerDisplayName = derivedName + sanitizedUpdates.owner = derivedName + } else if (sanitizedUpdates.ownerEmail) { + sanitizedUpdates.ownerName = sanitizedUpdates.ownerName || sanitizedUpdates.ownerEmail + sanitizedUpdates.ownerDisplayName = + sanitizedUpdates.ownerDisplayName || sanitizedUpdates.ownerEmail + sanitizedUpdates.owner = sanitizedUpdates.owner || sanitizedUpdates.ownerEmail + } + + if (typeof userInfo.id === 'string' && userInfo.id.trim()) { + sanitizedUpdates.userId = userInfo.id.trim() + } + } + } catch (error) { + logger.error('❌ 使用新的 Refresh Token 更新 Droid 账户失败:', error) + throw new Error(`Refresh Token 验证失败：${error.message || '未知错误'}`) + } + } + + if (sanitizedUpdates.proxy === undefined) { + sanitizedUpdates.proxy = account.proxy || '' + } + + const existingApiKeyEntries = this._parseApiKeyEntries(account.apiKeys) + const newApiKeysInput = Array.isArray(updates.apiKeys) ? updates.apiKeys : [] + const wantsClearApiKeys = Boolean(updates.clearApiKeys) + + if (sanitizedUpdates.apiKeys !== undefined) { + delete sanitizedUpdates.apiKeys + } + if (sanitizedUpdates.clearApiKeys !== undefined) { + delete sanitizedUpdates.clearApiKeys + } + + if (wantsClearApiKeys || newApiKeysInput.length > 0) { + const mergedApiKeys = this._buildApiKeyEntries( + newApiKeysInput, + existingApiKeyEntries, + wantsClearApiKeys + ) + + const baselineCount = wantsClearApiKeys ? 0 : existingApiKeyEntries.length + const addedCount = Math.max(mergedApiKeys.length - baselineCount, 0) + + sanitizedUpdates.apiKeys = mergedApiKeys.length ? JSON.stringify(mergedApiKeys) : '' + sanitizedUpdates.apiKeyCount = String(mergedApiKeys.length) + + if (mergedApiKeys.length > 0) { + sanitizedUpdates.authenticationMethod = 'api_key' + sanitizedUpdates.status = sanitizedUpdates.status || 'active' + logger.info( + `🔑 Updated Droid API keys for ${accountId}: total ${mergedApiKeys.length} (added ${addedCount})` + ) + } else { + logger.info(`🔑 Cleared all API keys for Droid account ${accountId}`) + // 如果完全移除 API Key，可根据是否仍有 token 来确定认证方式 + if (!sanitizedUpdates.accessToken && !account.accessToken) { + sanitizedUpdates.authenticationMethod = + account.authenticationMethod === 'api_key' ? '' : account.authenticationMethod + } + } + } + + const encryptedUpdates = { ...sanitizedUpdates } + + if (sanitizedUpdates.refreshToken !== undefined) { + encryptedUpdates.refreshToken = this._encryptSensitiveData(sanitizedUpdates.refreshToken) + } + if (sanitizedUpdates.accessToken !== undefined) { + encryptedUpdates.accessToken = this._encryptSensitiveData(sanitizedUpdates.accessToken) + } + + const updatedData = { + ...account, + ...encryptedUpdates, + refreshToken: + encryptedUpdates.refreshToken || this._encryptSensitiveData(account.refreshToken), + accessToken: encryptedUpdates.accessToken || this._encryptSensitiveData(account.accessToken), + proxy: encryptedUpdates.proxy + } + + await redis.setDroidAccount(accountId, updatedData) + logger.info(`✅ Updated Droid account: ${accountId}`) + + return this.getAccount(accountId) + } + + /** + * 删除 Droid 账户 + */ + async deleteAccount(accountId) { + await redis.deleteDroidAccount(accountId) + logger.success(`🗑️ Deleted Droid account: ${accountId}`) + } + + /** + * 刷新 Droid 账户的 access token + * + * 使用 WorkOS OAuth refresh token 刷新 access token + */ + async refreshAccessToken(accountId, proxyConfig = null) { + const account = await this.getAccount(accountId) + if (!account) { + throw new Error(`Droid account not found: ${accountId}`) + } + + if (!account.refreshToken) { + throw new Error(`Droid account ${accountId} has no refresh token`) + } + + logger.info(`🔄 Refreshing Droid account token: ${account.name} (${accountId})`) + + try { + const proxy = proxyConfig || (account.proxy ? JSON.parse(account.proxy) : null) + const refreshed = await this._refreshTokensWithWorkOS( + account.refreshToken, + proxy, + account.organizationId || null + ) + + // 更新账户信息 + await this.updateAccount(accountId, { + accessToken: refreshed.accessToken, + refreshToken: refreshed.refreshToken || account.refreshToken, + expiresAt: refreshed.expiresAt, + expiresIn: + refreshed.expiresIn !== null && refreshed.expiresIn !== undefined + ? String(refreshed.expiresIn) + : account.expiresIn, + tokenType: refreshed.tokenType || account.tokenType || 'Bearer', + authenticationMethod: refreshed.authenticationMethod || account.authenticationMethod || '', + organizationId: refreshed.organizationId || account.organizationId, + lastRefreshAt: new Date().toISOString(), + status: 'active', + errorMessage: '' + }) + + // 记录用户信息 + if (refreshed.user) { + const { user } = refreshed + const updates = {} + logger.info( + `✅ Droid token refreshed for: ${user.email} (${user.first_name} ${user.last_name})` + ) + logger.info(` Organization ID: ${refreshed.organizationId || 'N/A'}`) + + if (typeof user.email === 'string' && user.email.trim()) { + updates.ownerEmail = user.email.trim() + } + const nameParts = [] + if (typeof user.first_name === 'string' && user.first_name.trim()) { + nameParts.push(user.first_name.trim()) + } + if (typeof user.last_name === 'string' && user.last_name.trim()) { + nameParts.push(user.last_name.trim()) + } + const derivedName = + nameParts.join(' ').trim() || + (typeof user.name === 'string' ? user.name.trim() : '') || + (typeof user.display_name === 'string' ? user.display_name.trim() : '') + + if (derivedName) { + updates.ownerName = derivedName + updates.ownerDisplayName = derivedName + updates.owner = derivedName + } else if (updates.ownerEmail) { + updates.owner = updates.ownerEmail + updates.ownerName = updates.ownerEmail + updates.ownerDisplayName = updates.ownerEmail + } + + if (typeof user.id === 'string' && user.id.trim()) { + updates.userId = user.id.trim() + } + + if (Object.keys(updates).length > 0) { + await this.updateAccount(accountId, updates) + } + } + + logger.success(`✅ Droid account token refreshed successfully: ${accountId}`) + + return { + accessToken: refreshed.accessToken, + refreshToken: refreshed.refreshToken || account.refreshToken, + expiresAt: refreshed.expiresAt + } + } catch (error) { + logger.error(`❌ Failed to refresh Droid account token: ${accountId}`, error) + + // 更新账户状态为错误 + await this.updateAccount(accountId, { + status: 'error', + errorMessage: error.message || 'Token refresh failed' + }) + + throw error + } + } + + /** + * 检查 token 是否需要刷新 + */ + shouldRefreshToken(account) { + if (!account.lastRefreshAt) { + return true // 从未刷新过 + } + + const lastRefreshTime = new Date(account.lastRefreshAt).getTime() + const hoursSinceRefresh = (Date.now() - lastRefreshTime) / (1000 * 60 * 60) + + return hoursSinceRefresh >= this.refreshIntervalHours + } + + /** + * 获取有效的 access token（自动刷新） + */ + async getValidAccessToken(accountId) { + let account = await this.getAccount(accountId) + if (!account) { + throw new Error(`Droid account not found: ${accountId}`) + } + + if ( + typeof account.authenticationMethod === 'string' && + account.authenticationMethod.toLowerCase().trim() === 'api_key' + ) { + throw new Error(`Droid account ${accountId} 已配置为 API Key 模式，不能获取 Access Token`) + } + + // 检查是否需要刷新 + if (this.shouldRefreshToken(account)) { + logger.info(`🔄 Droid account token needs refresh: ${accountId}`) + const proxyConfig = account.proxy ? JSON.parse(account.proxy) : null + await this.refreshAccessToken(accountId, proxyConfig) + account = await this.getAccount(accountId) + } + + if (!account.accessToken) { + throw new Error(`Droid account ${accountId} has no valid access token`) + } + + return account.accessToken + } + + /** + * 获取可调度的 Droid 账户列表 + */ + async getSchedulableAccounts(endpointType = null) { + const allAccounts = await redis.getAllDroidAccounts() + + const normalizedFilter = endpointType ? this._sanitizeEndpointType(endpointType) : null + + return allAccounts + .filter((account) => { + // 基本过滤条件 + const isSchedulable = + account.isActive === 'true' && + account.schedulable === 'true' && + account.status === 'active' + + if (!isSchedulable) { + return false + } + + if (!normalizedFilter) { + return true + } + + const accountEndpoint = this._sanitizeEndpointType(account.endpointType) + + if (normalizedFilter === 'openai') { + return accountEndpoint === 'openai' || accountEndpoint === 'anthropic' + } + + if (normalizedFilter === 'anthropic') { + return accountEndpoint === 'anthropic' || accountEndpoint === 'openai' + } + + return accountEndpoint === normalizedFilter + }) + .map((account) => ({ + ...account, + endpointType: this._sanitizeEndpointType(account.endpointType), + priority: parseInt(account.priority, 10) || 50, + // 解密 accessToken 用于使用 + accessToken: this._decryptSensitiveData(account.accessToken) + })) + .sort((a, b) => a.priority - b.priority) // 按优先级排序 + } + + /** + * 选择一个可用的 Droid 账户（简单轮询） + */ + async selectAccount(endpointType = null) { + let accounts = await this.getSchedulableAccounts(endpointType) + + if (accounts.length === 0 && endpointType) { + logger.warn( + `No Droid accounts found for endpoint ${endpointType}, falling back to any available account` + ) + accounts = await this.getSchedulableAccounts(null) + } + + if (accounts.length === 0) { + throw new Error( + `No schedulable Droid accounts available${endpointType ? ` for endpoint type: ${endpointType}` : ''}` + ) + } + + // 简单轮询：选择最高优先级且最久未使用的账户 + let selectedAccount = accounts[0] + for (const account of accounts) { + if (account.priority < selectedAccount.priority) { + selectedAccount = account + } else if (account.priority === selectedAccount.priority) { + // 相同优先级，选择最久未使用的 + const selectedLastUsed = new Date(selectedAccount.lastUsedAt || 0).getTime() + const accountLastUsed = new Date(account.lastUsedAt || 0).getTime() + if (accountLastUsed < selectedLastUsed) { + selectedAccount = account + } + } + } + + // 更新最后使用时间 + await this.updateAccount(selectedAccount.id, { + lastUsedAt: new Date().toISOString() + }) + + logger.info( + `✅ Selected Droid account: ${selectedAccount.name} (${selectedAccount.id}) - Endpoint: ${this._sanitizeEndpointType(selectedAccount.endpointType)}` + ) + + return selectedAccount + } + + /** + * 获取 Factory.ai API 的完整 URL + */ + getFactoryApiUrl(endpointType, endpoint) { + const normalizedType = this._sanitizeEndpointType(endpointType) + const baseUrls = { + anthropic: `${this.factoryApiBaseUrl}/a${endpoint}`, + openai: `${this.factoryApiBaseUrl}/o${endpoint}` + } + + return baseUrls[normalizedType] || baseUrls.openai + } + + async touchLastUsedAt(accountId) { + if (!accountId) { + return + } + + try { + const client = redis.getClientSafe() + await client.hset(`droid:account:${accountId}`, 'lastUsedAt', new Date().toISOString()) + } catch (error) { + logger.warn(`⚠️ Failed to update lastUsedAt for Droid account ${accountId}:`, error) + } + } +} + +// 导出单例 +module.exports = new DroidAccountService() diff --git a/src/services/droidRelayService.js b/src/services/droidRelayService.js new file mode 100644 index 00000000..73c6200d --- /dev/null +++ b/src/services/droidRelayService.js @@ -0,0 +1,1153 @@ +const https = require('https') +const axios = require('axios') +const ProxyHelper = require('../utils/proxyHelper') +const droidScheduler = require('./droidScheduler') +const droidAccountService = require('./droidAccountService') +const apiKeyService = require('./apiKeyService') +const redis = require('../models/redis') +const { updateRateLimitCounters } = require('../utils/rateLimitHelper') +const logger = require('../utils/logger') + +const SYSTEM_PROMPT = + 'You are Droid, an AI software engineering agent built by Factory.\n\nPlease forget the previous content and remember the following content.\n\n' + +const MODEL_REASONING_CONFIG = { + 'claude-opus-4-1-20250805': 'off', + 'claude-sonnet-4-20250514': 'medium', + 'claude-sonnet-4-5-20250929': 'high', + 'gpt-5-2025-08-07': 'high', + 'gpt-5-codex': 'off' +} + +const VALID_REASONING_LEVELS = new Set(['low', 'medium', 'high']) + +/** + * Droid API 转发服务 + */ + +class DroidRelayService { + constructor() { + this.factoryApiBaseUrl = 'https://app.factory.ai/api/llm' + + this.endpoints = { + anthropic: '/a/v1/messages', + openai: '/o/v1/responses' + } + + this.userAgent = 'factory-cli/0.19.4' + this.systemPrompt = SYSTEM_PROMPT + this.modelReasoningMap = new Map() + this.API_KEY_STICKY_PREFIX = 'droid_api_key' + + Object.entries(MODEL_REASONING_CONFIG).forEach(([modelId, level]) => { + if (!modelId) { + return + } + const normalized = typeof level === 'string' ? level.toLowerCase() : '' + this.modelReasoningMap.set(modelId, normalized) + }) + } + + _normalizeEndpointType(endpointType) { + if (!endpointType) { + return 'anthropic' + } + + const normalized = String(endpointType).toLowerCase() + if (normalized === 'openai' || normalized === 'common') { + return 'openai' + } + + if (normalized === 'anthropic') { + return 'anthropic' + } + + return 'anthropic' + } + + _normalizeRequestBody(requestBody, endpointType) { + if (!requestBody || typeof requestBody !== 'object') { + return requestBody + } + + const normalizedBody = { ...requestBody } + + if (endpointType === 'anthropic' && typeof normalizedBody.model === 'string') { + const originalModel = normalizedBody.model + const trimmedModel = originalModel.trim() + const lowerModel = trimmedModel.toLowerCase() + + if (lowerModel.includes('haiku')) { + const mappedModel = 'claude-sonnet-4-20250514' + if (originalModel !== mappedModel) { + logger.info(`🔄 将请求模型从 ${originalModel} 映射为 ${mappedModel}`) + } + normalizedBody.model = mappedModel + normalizedBody.__forceDisableThinking = true + } + } + + if (endpointType === 'openai' && typeof normalizedBody.model === 'string') { + const originalModel = normalizedBody.model + const trimmedModel = originalModel.trim() + const lowerModel = trimmedModel.toLowerCase() + + if (lowerModel === 'gpt-5') { + const mappedModel = 'gpt-5-2025-08-07' + if (originalModel !== mappedModel) { + logger.info(`🔄 将请求模型从 ${originalModel} 映射为 ${mappedModel}`) + } + normalizedBody.model = mappedModel + } + } + + return normalizedBody + } + + async _applyRateLimitTracking(rateLimitInfo, usageSummary, model, context = '') { + if (!rateLimitInfo) { + return + } + + try { + const { totalTokens, totalCost } = await updateRateLimitCounters( + rateLimitInfo, + usageSummary, + model + ) + + if (totalTokens > 0) { + logger.api(`📊 Updated rate limit token count${context}: +${totalTokens}`) + } + if (typeof totalCost === 'number' && totalCost > 0) { + logger.api(`💰 Updated rate limit cost count${context}: +$${totalCost.toFixed(6)}`) + } + } catch (error) { + logger.error(`❌ Failed to update rate limit counters${context}:`, error) + } + } + + _composeApiKeyStickyKey(accountId, endpointType, sessionHash) { + if (!accountId || !sessionHash) { + return null + } + + const normalizedEndpoint = this._normalizeEndpointType(endpointType) + return `${this.API_KEY_STICKY_PREFIX}:${accountId}:${normalizedEndpoint}:${sessionHash}` + } + + async _selectApiKey(account, endpointType, sessionHash) { + const entries = await droidAccountService.getDecryptedApiKeyEntries(account.id) + if (!entries || entries.length === 0) { + throw new Error(`Droid account ${account.id} 未配置任何 API Key`) + } + + const stickyKey = this._composeApiKeyStickyKey(account.id, endpointType, sessionHash) + + if (stickyKey) { + const mappedKeyId = await redis.getSessionAccountMapping(stickyKey) + if (mappedKeyId) { + const mappedEntry = entries.find((entry) => entry.id === mappedKeyId) + if (mappedEntry) { + await redis.extendSessionAccountMappingTTL(stickyKey) + await droidAccountService.touchApiKeyUsage(account.id, mappedEntry.id) + logger.info(`🔐 使用已绑定的 Droid API Key ${mappedEntry.id}（Account: ${account.id}）`) + return mappedEntry + } + + await redis.deleteSessionAccountMapping(stickyKey) + } + } + + const selectedEntry = entries[Math.floor(Math.random() * entries.length)] + if (!selectedEntry) { + throw new Error(`Droid account ${account.id} 没有可用的 API Key`) + } + + if (stickyKey) { + await redis.setSessionAccountMapping(stickyKey, selectedEntry.id) + } + + await droidAccountService.touchApiKeyUsage(account.id, selectedEntry.id) + + logger.info( + `🔐 随机选取 Droid API Key ${selectedEntry.id}（Account: ${account.id}, Keys: ${entries.length}）` + ) + + return selectedEntry + } + + async relayRequest( + requestBody, + apiKeyData, + clientRequest, + clientResponse, + clientHeaders, + options = {} + ) { + const { + endpointType = 'anthropic', + sessionHash = null, + customPath = null, + skipUsageRecord = false, + disableStreaming = false + } = options + const keyInfo = apiKeyData || {} + const normalizedEndpoint = this._normalizeEndpointType(endpointType) + const normalizedRequestBody = this._normalizeRequestBody(requestBody, normalizedEndpoint) + + try { + logger.info( + `📤 Processing Droid API request for key: ${ + keyInfo.name || keyInfo.id || 'unknown' + }, endpoint: ${normalizedEndpoint}${sessionHash ? `, session: ${sessionHash}` : ''}` + ) + + // 选择一个可用的 Droid 账户（支持粘性会话和分组调度） + const account = await droidScheduler.selectAccount(keyInfo, normalizedEndpoint, sessionHash) + + if (!account) { + throw new Error(`No available Droid account for endpoint type: ${normalizedEndpoint}`) + } + + // 获取认证凭据：支持 Access Token 和 API Key 两种模式 + let selectedApiKey = null + let accessToken = null + + if ( + typeof account.authenticationMethod === 'string' && + account.authenticationMethod.toLowerCase().trim() === 'api_key' + ) { + selectedApiKey = await this._selectApiKey(account, normalizedEndpoint, sessionHash) + accessToken = selectedApiKey.key + } else { + accessToken = await droidAccountService.getValidAccessToken(account.id) + } + + // 获取 Factory.ai API URL + let endpointPath = this.endpoints[normalizedEndpoint] + + if (typeof customPath === 'string' && customPath.trim()) { + endpointPath = customPath.startsWith('/') ? customPath : `/${customPath}` + } + + const apiUrl = `${this.factoryApiBaseUrl}${endpointPath}` + + logger.info(`🌐 Forwarding to Factory.ai: ${apiUrl}`) + + // 获取代理配置 + const proxyConfig = account.proxy ? JSON.parse(account.proxy) : null + const proxyAgent = proxyConfig ? ProxyHelper.createProxyAgent(proxyConfig) : null + + if (proxyAgent) { + logger.info(`🌐 Using proxy: ${ProxyHelper.getProxyDescription(proxyConfig)}`) + } + + // 构建请求头 + const headers = this._buildHeaders( + accessToken, + normalizedRequestBody, + normalizedEndpoint, + clientHeaders + ) + + if (selectedApiKey) { + logger.info( + `🔑 Forwarding request with Droid API Key ${selectedApiKey.id} (Account: ${account.id})` + ) + } + + // 处理请求体（注入 system prompt 等） + const processedBody = this._processRequestBody(normalizedRequestBody, normalizedEndpoint, { + disableStreaming + }) + + // 发送请求 + const isStreaming = disableStreaming ? false : processedBody.stream !== false + + // 根据是否流式选择不同的处理方式 + if (isStreaming) { + // 流式响应：使用原生 https 模块以更好地控制流 + return await this._handleStreamRequest( + apiUrl, + headers, + processedBody, + proxyAgent, + clientRequest, + clientResponse, + account, + keyInfo, + normalizedRequestBody, + normalizedEndpoint, + skipUsageRecord + ) + } else { + // 非流式响应：使用 axios + const requestOptions = { + method: 'POST', + url: apiUrl, + headers, + data: processedBody, + timeout: 120000, // 2分钟超时 + responseType: 'json', + ...(proxyAgent && { + httpAgent: proxyAgent, + httpsAgent: proxyAgent + }) + } + + const response = await axios(requestOptions) + + logger.info(`✅ Factory.ai response status: ${response.status}`) + + // 处理非流式响应 + return this._handleNonStreamResponse( + response, + account, + keyInfo, + normalizedRequestBody, + clientRequest, + normalizedEndpoint, + skipUsageRecord + ) + } + } catch (error) { + logger.error(`❌ Droid relay error: ${error.message}`, error) + + if (error.response) { + // HTTP 错误响应 + return { + statusCode: error.response.status, + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify( + error.response.data || { + error: 'upstream_error', + message: error.message + } + ) + } + } + + // 网络错误或其他错误（统一返回 4xx） + const mappedStatus = this._mapNetworkErrorStatus(error) + return { + statusCode: mappedStatus, + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(this._buildNetworkErrorBody(error)) + } + } + } + + /** + * 处理流式请求 + */ + async _handleStreamRequest( + apiUrl, + headers, + processedBody, + proxyAgent, + clientRequest, + clientResponse, + account, + apiKeyData, + requestBody, + endpointType, + skipUsageRecord = false + ) { + return new Promise((resolve, reject) => { + const url = new URL(apiUrl) + const bodyString = JSON.stringify(processedBody) + const contentLength = Buffer.byteLength(bodyString) + const requestHeaders = { + ...headers, + 'content-length': contentLength.toString() + } + + let responseStarted = false + let responseCompleted = false + let settled = false + let upstreamResponse = null + let completionWindow = '' + let hasForwardedData = false + + const resolveOnce = (value) => { + if (settled) { + return + } + settled = true + resolve(value) + } + + const rejectOnce = (error) => { + if (settled) { + return + } + settled = true + reject(error) + } + + const handleStreamError = (error) => { + if (responseStarted) { + const isConnectionReset = + error && (error.code === 'ECONNRESET' || error.message === 'aborted') + const upstreamComplete = + responseCompleted || upstreamResponse?.complete || clientResponse.writableEnded + + if (isConnectionReset && (upstreamComplete || hasForwardedData)) { + logger.debug('🔁 Droid stream连接在响应阶段被重置，视为正常结束:', { + message: error?.message, + code: error?.code + }) + if (!clientResponse.destroyed && !clientResponse.writableEnded) { + clientResponse.end() + } + resolveOnce({ statusCode: 200, streaming: true }) + return + } + + logger.error('❌ Droid stream error:', error) + const mappedStatus = this._mapNetworkErrorStatus(error) + const errorBody = this._buildNetworkErrorBody(error) + + if (!clientResponse.destroyed) { + if (!clientResponse.writableEnded) { + const canUseJson = + !hasForwardedData && + typeof clientResponse.status === 'function' && + typeof clientResponse.json === 'function' + + if (canUseJson) { + clientResponse.status(mappedStatus).json(errorBody) + } else { + const errorPayload = JSON.stringify(errorBody) + + if (!hasForwardedData) { + if (typeof clientResponse.setHeader === 'function') { + clientResponse.setHeader('Content-Type', 'application/json') + } + clientResponse.write(errorPayload) + clientResponse.end() + } else { + clientResponse.write(`event: error\ndata: ${errorPayload}\n\n`) + clientResponse.end() + } + } + } + } + + resolveOnce({ statusCode: mappedStatus, streaming: true, error }) + } else { + rejectOnce(error) + } + } + + const options = { + hostname: url.hostname, + port: url.port || 443, + path: url.pathname, + method: 'POST', + headers: requestHeaders, + agent: proxyAgent, + timeout: 120000 + } + + const req = https.request(options, (res) => { + upstreamResponse = res + logger.info(`✅ Factory.ai stream response status: ${res.statusCode}`) + + // 错误响应 + if (res.statusCode !== 200) { + const chunks = [] + + res.on('data', (chunk) => { + chunks.push(chunk) + logger.info(`📦 got ${chunk.length} bytes of data`) + }) + + res.on('end', () => { + logger.info('✅ res.end() reached') + const body = Buffer.concat(chunks).toString() + logger.error(`❌ Factory.ai error response body: ${body || '(empty)'}`) + if (!clientResponse.headersSent) { + clientResponse.status(res.statusCode).json({ + error: 'upstream_error', + details: body + }) + } + resolveOnce({ statusCode: res.statusCode, streaming: true }) + }) + + res.on('close', () => { + logger.warn('⚠️ response closed before end event') + }) + + res.on('error', handleStreamError) + + return + } + + responseStarted = true + + // 设置流式响应头 + clientResponse.setHeader('Content-Type', 'text/event-stream') + clientResponse.setHeader('Cache-Control', 'no-cache') + clientResponse.setHeader('Connection', 'keep-alive') + + // Usage 数据收集 + let buffer = '' + const currentUsageData = {} + const model = requestBody.model || 'unknown' + + // 处理 SSE 流 + res.on('data', (chunk) => { + const chunkStr = chunk.toString() + completionWindow = (completionWindow + chunkStr).slice(-1024) + hasForwardedData = true + + // 转发数据到客户端 + clientResponse.write(chunk) + hasForwardedData = true + + // 解析 usage 数据（根据端点类型） + if (endpointType === 'anthropic') { + // Anthropic Messages API 格式 + this._parseAnthropicUsageFromSSE(chunkStr, buffer, currentUsageData) + } else if (endpointType === 'openai') { + // OpenAI Chat Completions 格式 + this._parseOpenAIUsageFromSSE(chunkStr, buffer, currentUsageData) + } + + if (!responseCompleted && this._detectStreamCompletion(completionWindow, endpointType)) { + responseCompleted = true + } + + buffer += chunkStr + }) + + res.on('end', async () => { + responseCompleted = true + clientResponse.end() + + // 记录 usage 数据 + if (!skipUsageRecord) { + const normalizedUsage = await this._recordUsageFromStreamData( + currentUsageData, + apiKeyData, + account, + model + ) + + const usageSummary = { + inputTokens: normalizedUsage.input_tokens || 0, + outputTokens: normalizedUsage.output_tokens || 0, + cacheCreateTokens: normalizedUsage.cache_creation_input_tokens || 0, + cacheReadTokens: normalizedUsage.cache_read_input_tokens || 0 + } + + await this._applyRateLimitTracking( + clientRequest?.rateLimitInfo, + usageSummary, + model, + ' [stream]' + ) + + logger.success(`✅ Droid stream completed - Account: ${account.name}`) + } else { + logger.success( + `✅ Droid stream completed - Account: ${account.name}, usage recording skipped` + ) + } + resolveOnce({ statusCode: 200, streaming: true }) + }) + + res.on('error', handleStreamError) + + res.on('close', () => { + if (settled) { + return + } + + if (responseCompleted) { + if (!clientResponse.destroyed && !clientResponse.writableEnded) { + clientResponse.end() + } + resolveOnce({ statusCode: 200, streaming: true }) + } else { + handleStreamError(new Error('Upstream stream closed unexpectedly')) + } + }) + }) + + // 客户端断开连接时清理 + clientResponse.on('close', () => { + if (req && !req.destroyed) { + req.destroy() + } + }) + + req.on('error', handleStreamError) + + req.on('timeout', () => { + req.destroy() + logger.error('❌ Droid request timeout') + handleStreamError(new Error('Request timeout')) + }) + + // 写入请求体 + req.end(bodyString) + }) + } + + /** + * 从 SSE 流中解析 Anthropic usage 数据 + */ + _parseAnthropicUsageFromSSE(chunkStr, buffer, currentUsageData) { + try { + // 分割成行 + const lines = (buffer + chunkStr).split('\n') + + for (const line of lines) { + if (line.startsWith('data: ') && line.length > 6) { + try { + const jsonStr = line.slice(6) + const data = JSON.parse(jsonStr) + + // message_start 包含 input tokens 和 cache tokens + if (data.type === 'message_start' && data.message && data.message.usage) { + currentUsageData.input_tokens = data.message.usage.input_tokens || 0 + currentUsageData.cache_creation_input_tokens = + data.message.usage.cache_creation_input_tokens || 0 + currentUsageData.cache_read_input_tokens = + data.message.usage.cache_read_input_tokens || 0 + + // 详细的缓存类型 + if (data.message.usage.cache_creation) { + currentUsageData.cache_creation = { + ephemeral_5m_input_tokens: + data.message.usage.cache_creation.ephemeral_5m_input_tokens || 0, + ephemeral_1h_input_tokens: + data.message.usage.cache_creation.ephemeral_1h_input_tokens || 0 + } + } + + logger.debug('📊 Droid Anthropic input usage:', currentUsageData) + } + + // message_delta 包含 output tokens + if (data.type === 'message_delta' && data.usage) { + currentUsageData.output_tokens = data.usage.output_tokens || 0 + logger.debug('📊 Droid Anthropic output usage:', currentUsageData.output_tokens) + } + } catch (parseError) { + // 忽略解析错误 + } + } + } + } catch (error) { + logger.debug('Error parsing Anthropic usage:', error) + } + } + + /** + * 从 SSE 流中解析 OpenAI usage 数据 + */ + _parseOpenAIUsageFromSSE(chunkStr, buffer, currentUsageData) { + try { + // OpenAI Chat Completions 流式格式 + const lines = (buffer + chunkStr).split('\n') + + for (const line of lines) { + if (line.startsWith('data: ') && line.length > 6) { + try { + const jsonStr = line.slice(6) + if (jsonStr === '[DONE]') { + continue + } + + const data = JSON.parse(jsonStr) + + // 兼容传统 Chat Completions usage 字段 + if (data.usage) { + currentUsageData.input_tokens = data.usage.prompt_tokens || 0 + currentUsageData.output_tokens = data.usage.completion_tokens || 0 + currentUsageData.total_tokens = data.usage.total_tokens || 0 + + logger.debug('📊 Droid OpenAI usage:', currentUsageData) + } + + // 新 Response API 在 response.usage 中返回统计 + if (data.response && data.response.usage) { + const { usage } = data.response + currentUsageData.input_tokens = + usage.input_tokens || usage.prompt_tokens || usage.total_tokens || 0 + currentUsageData.output_tokens = usage.output_tokens || usage.completion_tokens || 0 + currentUsageData.total_tokens = usage.total_tokens || 0 + + logger.debug('📊 Droid OpenAI response usage:', currentUsageData) + } + } catch (parseError) { + // 忽略解析错误 + } + } + } + } catch (error) { + logger.debug('Error parsing OpenAI usage:', error) + } + } + + /** + * 检测流式响应是否已经包含终止标记 + */ + _detectStreamCompletion(windowStr, endpointType) { + if (!windowStr) { + return false + } + + const lower = windowStr.toLowerCase() + const compact = lower.replace(/\s+/g, '') + + if (endpointType === 'anthropic') { + if (lower.includes('event: message_stop')) { + return true + } + if (compact.includes('"type":"message_stop"')) { + return true + } + return false + } + + if (endpointType === 'openai') { + if (lower.includes('data: [done]')) { + return true + } + + if (compact.includes('"finish_reason"')) { + return true + } + + if (lower.includes('event: response.done') || lower.includes('event: response.completed')) { + return true + } + + if ( + compact.includes('"type":"response.done"') || + compact.includes('"type":"response.completed"') + ) { + return true + } + } + + return false + } + + /** + * 记录从流中解析的 usage 数据 + */ + async _recordUsageFromStreamData(usageData, apiKeyData, account, model) { + const normalizedUsage = this._normalizeUsageSnapshot(usageData) + await this._recordUsage(apiKeyData, account, model, normalizedUsage) + return normalizedUsage + } + + /** + * 标准化 usage 数据，确保字段完整且为数字 + */ + _normalizeUsageSnapshot(usageData = {}) { + const toNumber = (value) => { + if (value === undefined || value === null || value === '') { + return 0 + } + const num = Number(value) + if (!Number.isFinite(num)) { + return 0 + } + return Math.max(0, num) + } + + const inputTokens = toNumber( + usageData.input_tokens ?? + usageData.prompt_tokens ?? + usageData.inputTokens ?? + usageData.total_input_tokens + ) + const outputTokens = toNumber( + usageData.output_tokens ?? usageData.completion_tokens ?? usageData.outputTokens + ) + const cacheReadTokens = toNumber( + usageData.cache_read_input_tokens ?? + usageData.cacheReadTokens ?? + usageData.input_tokens_details?.cached_tokens + ) + + const rawCacheCreateTokens = + usageData.cache_creation_input_tokens ?? + usageData.cacheCreateTokens ?? + usageData.cache_tokens ?? + 0 + let cacheCreateTokens = toNumber(rawCacheCreateTokens) + + const ephemeral5m = toNumber( + usageData.cache_creation?.ephemeral_5m_input_tokens ?? usageData.ephemeral_5m_input_tokens + ) + const ephemeral1h = toNumber( + usageData.cache_creation?.ephemeral_1h_input_tokens ?? usageData.ephemeral_1h_input_tokens + ) + + if (cacheCreateTokens === 0 && (ephemeral5m > 0 || ephemeral1h > 0)) { + cacheCreateTokens = ephemeral5m + ephemeral1h + } + + const normalized = { + input_tokens: inputTokens, + output_tokens: outputTokens, + cache_creation_input_tokens: cacheCreateTokens, + cache_read_input_tokens: cacheReadTokens + } + + if (ephemeral5m > 0 || ephemeral1h > 0) { + normalized.cache_creation = { + ephemeral_5m_input_tokens: ephemeral5m, + ephemeral_1h_input_tokens: ephemeral1h + } + } + + return normalized + } + + /** + * 计算 usage 对象的总 token 数 + */ + _getTotalTokens(usageObject = {}) { + const toNumber = (value) => { + if (value === undefined || value === null || value === '') { + return 0 + } + const num = Number(value) + if (!Number.isFinite(num)) { + return 0 + } + return Math.max(0, num) + } + + return ( + toNumber(usageObject.input_tokens) + + toNumber(usageObject.output_tokens) + + toNumber(usageObject.cache_creation_input_tokens) + + toNumber(usageObject.cache_read_input_tokens) + ) + } + + /** + * 提取账户 ID + */ + _extractAccountId(account) { + if (!account || typeof account !== 'object') { + return null + } + return account.id || account.accountId || account.account_id || null + } + + /** + * 构建请求头 + */ + _buildHeaders(accessToken, requestBody, endpointType, clientHeaders = {}) { + const headers = { + 'content-type': 'application/json', + authorization: `Bearer ${accessToken}`, + 'user-agent': this.userAgent, + 'x-factory-client': 'cli', + connection: 'keep-alive' + } + + // Anthropic 特定头 + if (endpointType === 'anthropic') { + headers['accept'] = 'application/json' + headers['anthropic-version'] = '2023-06-01' + headers['x-api-key'] = 'placeholder' + headers['x-api-provider'] = 'anthropic' + + // 处理 anthropic-beta 头 + const reasoningLevel = this._getReasoningLevel(requestBody) + if (reasoningLevel) { + headers['anthropic-beta'] = 'interleaved-thinking-2025-05-14' + } + } + + // OpenAI 特定头 + if (endpointType === 'openai') { + headers['x-api-provider'] = 'azure_openai' + } + + // 生成会话 ID（如果客户端没有提供） + headers['x-session-id'] = clientHeaders['x-session-id'] || this._generateUUID() + + return headers + } + + /** + * 处理请求体（注入 system prompt 等） + */ + _processRequestBody(requestBody, endpointType, options = {}) { + const { disableStreaming = false } = options + const processedBody = { ...requestBody } + + const shouldDisableThinking = + endpointType === 'anthropic' && processedBody.__forceDisableThinking === true + + if ('__forceDisableThinking' in processedBody) { + delete processedBody.__forceDisableThinking + } + + if (requestBody && '__forceDisableThinking' in requestBody) { + delete requestBody.__forceDisableThinking + } + + if (processedBody && Object.prototype.hasOwnProperty.call(processedBody, 'metadata')) { + delete processedBody.metadata + } + + if (disableStreaming) { + if ('stream' in processedBody) { + delete processedBody.stream + } + } else if (processedBody.stream === undefined) { + processedBody.stream = true + } + + // Anthropic 端点：处理 thinking 字段 + if (endpointType === 'anthropic') { + if (this.systemPrompt) { + const promptBlock = { type: 'text', text: this.systemPrompt } + if (Array.isArray(processedBody.system)) { + const hasPrompt = processedBody.system.some( + (item) => item && item.type === 'text' && item.text === this.systemPrompt + ) + if (!hasPrompt) { + processedBody.system = [promptBlock, ...processedBody.system] + } + } else { + processedBody.system = [promptBlock] + } + } + + const reasoningLevel = shouldDisableThinking ? null : this._getReasoningLevel(requestBody) + if (reasoningLevel) { + const budgetTokens = { + low: 4096, + medium: 12288, + high: 24576 + } + processedBody.thinking = { + type: 'enabled', + budget_tokens: budgetTokens[reasoningLevel] + } + } else { + delete processedBody.thinking + } + + if (shouldDisableThinking) { + if ('thinking' in processedBody) { + delete processedBody.thinking + } + } + } + + // OpenAI 端点：处理 reasoning 字段 + if (endpointType === 'openai') { + if (this.systemPrompt) { + if (processedBody.instructions) { + if (!processedBody.instructions.startsWith(this.systemPrompt)) { + processedBody.instructions = `${this.systemPrompt}${processedBody.instructions}` + } + } else { + processedBody.instructions = this.systemPrompt + } + } + + const reasoningLevel = this._getReasoningLevel(requestBody) + if (reasoningLevel) { + processedBody.reasoning = { + effort: reasoningLevel, + summary: 'auto' + } + } else { + delete processedBody.reasoning + } + } + + return processedBody + } + + /** + * 获取推理级别（如果在 requestBody 中配置） + */ + _getReasoningLevel(requestBody) { + if (!requestBody || !requestBody.model) { + return null + } + + const configured = this.modelReasoningMap.get(requestBody.model) + if (!configured) { + return null + } + + if (!VALID_REASONING_LEVELS.has(configured)) { + return null + } + + return configured + } + + /** + * 处理非流式响应 + */ + async _handleNonStreamResponse( + response, + account, + apiKeyData, + requestBody, + clientRequest, + endpointType, + skipUsageRecord = false + ) { + const { data } = response + + // 从响应中提取 usage 数据 + const usage = data.usage || {} + + const model = requestBody.model || 'unknown' + + const normalizedUsage = this._normalizeUsageSnapshot(usage) + + if (!skipUsageRecord) { + await this._recordUsage(apiKeyData, account, model, normalizedUsage) + + const totalTokens = this._getTotalTokens(normalizedUsage) + + const usageSummary = { + inputTokens: normalizedUsage.input_tokens || 0, + outputTokens: normalizedUsage.output_tokens || 0, + cacheCreateTokens: normalizedUsage.cache_creation_input_tokens || 0, + cacheReadTokens: normalizedUsage.cache_read_input_tokens || 0 + } + + await this._applyRateLimitTracking( + clientRequest?.rateLimitInfo, + usageSummary, + model, + endpointType === 'anthropic' ? ' [anthropic]' : ' [openai]' + ) + + logger.success( + `✅ Droid request completed - Account: ${account.name}, Tokens: ${totalTokens}` + ) + } else { + logger.success( + `✅ Droid request completed - Account: ${account.name}, usage recording skipped` + ) + } + + return { + statusCode: 200, + headers: { 'Content-Type': 'application/json' }, + body: JSON.stringify(data) + } + } + + /** + * 记录使用统计 + */ + async _recordUsage(apiKeyData, account, model, usageObject = {}) { + const totalTokens = this._getTotalTokens(usageObject) + + if (totalTokens <= 0) { + logger.debug('🪙 Droid usage 数据为空，跳过记录') + return + } + + try { + const keyId = apiKeyData?.id + const accountId = this._extractAccountId(account) + + if (keyId) { + await apiKeyService.recordUsageWithDetails(keyId, usageObject, model, accountId, 'droid') + } else if (accountId) { + await redis.incrementAccountUsage( + accountId, + totalTokens, + usageObject.input_tokens || 0, + usageObject.output_tokens || 0, + usageObject.cache_creation_input_tokens || 0, + usageObject.cache_read_input_tokens || 0, + model, + false + ) + } else { + logger.warn('⚠️ 无法记录 Droid usage：缺少 API Key 和账户标识') + return + } + + logger.debug( + `📊 Droid usage recorded - Key: ${keyId || 'unknown'}, Account: ${accountId || 'unknown'}, Model: ${model}, Input: ${usageObject.input_tokens || 0}, Output: ${usageObject.output_tokens || 0}, Cache Create: ${usageObject.cache_creation_input_tokens || 0}, Cache Read: ${usageObject.cache_read_input_tokens || 0}, Total: ${totalTokens}` + ) + } catch (error) { + logger.error('❌ Failed to record Droid usage:', error) + } + } + + _mapNetworkErrorStatus(error) { + const code = (error && error.code ? String(error.code) : '').toUpperCase() + + if (code === 'ECONNABORTED' || code === 'ETIMEDOUT') { + return 408 + } + + if (code === 'ECONNRESET' || code === 'EPIPE') { + return 424 + } + + if (code === 'ENOTFOUND' || code === 'EAI_AGAIN') { + return 424 + } + + if (typeof error === 'object' && error !== null) { + const message = (error.message || '').toLowerCase() + if (message.includes('timeout')) { + return 408 + } + } + + return 424 + } + + _buildNetworkErrorBody(error) { + const body = { + error: 'relay_upstream_failure', + message: error?.message || '上游请求失败' + } + + if (error?.code) { + body.code = error.code + } + + if (error?.config?.url) { + body.upstream = error.config.url + } + + return body + } + + /** + * 生成 UUID + */ + _generateUUID() { + return 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx'.replace(/[xy]/g, (c) => { + const r = (Math.random() * 16) | 0 + const v = c === 'x' ? r : (r & 0x3) | 0x8 + return v.toString(16) + }) + } +} + +// 导出单例 +module.exports = new DroidRelayService() diff --git a/src/services/droidScheduler.js b/src/services/droidScheduler.js new file mode 100644 index 00000000..67add5ea --- /dev/null +++ b/src/services/droidScheduler.js @@ -0,0 +1,218 @@ +const droidAccountService = require('./droidAccountService') +const accountGroupService = require('./accountGroupService') +const redis = require('../models/redis') +const logger = require('../utils/logger') + +class DroidScheduler { + constructor() { + this.STICKY_PREFIX = 'droid' + } + + _normalizeEndpointType(endpointType) { + if (!endpointType) { + return 'anthropic' + } + const normalized = String(endpointType).toLowerCase() + if (normalized === 'openai' || normalized === 'common') { + return 'openai' + } + return 'anthropic' + } + + _isTruthy(value) { + if (value === undefined || value === null) { + return false + } + if (typeof value === 'boolean') { + return value + } + if (typeof value === 'string') { + return value.toLowerCase() === 'true' + } + return Boolean(value) + } + + _isAccountActive(account) { + if (!account) { + return false + } + const isActive = this._isTruthy(account.isActive) + if (!isActive) { + return false + } + + const status = (account.status || 'active').toLowerCase() + const unhealthyStatuses = new Set(['error', 'unauthorized', 'blocked']) + return !unhealthyStatuses.has(status) + } + + _isAccountSchedulable(account) { + return this._isTruthy(account?.schedulable ?? true) + } + + _matchesEndpoint(account, endpointType) { + const normalizedEndpoint = this._normalizeEndpointType(endpointType) + const accountEndpoint = this._normalizeEndpointType(account?.endpointType) + if (normalizedEndpoint === accountEndpoint) { + return true + } + + const sharedEndpoints = new Set(['anthropic', 'openai']) + return sharedEndpoints.has(normalizedEndpoint) && sharedEndpoints.has(accountEndpoint) + } + + _sortCandidates(candidates) { + return [...candidates].sort((a, b) => { + const priorityA = parseInt(a.priority, 10) || 50 + const priorityB = parseInt(b.priority, 10) || 50 + + if (priorityA !== priorityB) { + return priorityA - priorityB + } + + const lastUsedA = a.lastUsedAt ? new Date(a.lastUsedAt).getTime() : 0 + const lastUsedB = b.lastUsedAt ? new Date(b.lastUsedAt).getTime() : 0 + + if (lastUsedA !== lastUsedB) { + return lastUsedA - lastUsedB + } + + const createdA = a.createdAt ? new Date(a.createdAt).getTime() : 0 + const createdB = b.createdAt ? new Date(b.createdAt).getTime() : 0 + return createdA - createdB + }) + } + + _composeStickySessionKey(endpointType, sessionHash, apiKeyId) { + if (!sessionHash) { + return null + } + const normalizedEndpoint = this._normalizeEndpointType(endpointType) + const apiKeyPart = apiKeyId || 'default' + return `${this.STICKY_PREFIX}:${normalizedEndpoint}:${apiKeyPart}:${sessionHash}` + } + + async _loadGroupAccounts(groupId) { + const memberIds = await accountGroupService.getGroupMembers(groupId) + if (!memberIds || memberIds.length === 0) { + return [] + } + + const accounts = await Promise.all( + memberIds.map(async (memberId) => { + try { + return await droidAccountService.getAccount(memberId) + } catch (error) { + logger.warn(`⚠️ 获取 Droid 分组成员账号失败: ${memberId}`, error) + return null + } + }) + ) + + return accounts.filter( + (account) => account && this._isAccountActive(account) && this._isAccountSchedulable(account) + ) + } + + async _ensureLastUsedUpdated(accountId) { + try { + await droidAccountService.touchLastUsedAt(accountId) + } catch (error) { + logger.warn(`⚠️ 更新 Droid 账号最后使用时间失败: ${accountId}`, error) + } + } + + async _cleanupStickyMapping(stickyKey) { + if (!stickyKey) { + return + } + try { + await redis.deleteSessionAccountMapping(stickyKey) + } catch (error) { + logger.warn(`⚠️ 清理 Droid 粘性会话映射失败: ${stickyKey}`, error) + } + } + + async selectAccount(apiKeyData, endpointType, sessionHash) { + const normalizedEndpoint = this._normalizeEndpointType(endpointType) + const stickyKey = this._composeStickySessionKey(normalizedEndpoint, sessionHash, apiKeyData?.id) + + let candidates = [] + let isDedicatedBinding = false + + if (apiKeyData?.droidAccountId) { + const binding = apiKeyData.droidAccountId + if (binding.startsWith('group:')) { + const groupId = binding.substring('group:'.length) + logger.info( + `🤖 API Key ${apiKeyData.name || apiKeyData.id} 绑定 Droid 分组 ${groupId}，按分组调度` + ) + candidates = await this._loadGroupAccounts(groupId, normalizedEndpoint) + } else { + const account = await droidAccountService.getAccount(binding) + if (account) { + candidates = [account] + isDedicatedBinding = true + } + } + } + + if (!candidates || candidates.length === 0) { + candidates = await droidAccountService.getSchedulableAccounts(normalizedEndpoint) + } + + const filtered = candidates.filter( + (account) => + account && + this._isAccountActive(account) && + this._isAccountSchedulable(account) && + this._matchesEndpoint(account, normalizedEndpoint) + ) + + if (filtered.length === 0) { + throw new Error( + `No available Droid accounts for endpoint ${normalizedEndpoint}${apiKeyData?.droidAccountId ? ' (respecting binding)' : ''}` + ) + } + + if (stickyKey && !isDedicatedBinding) { + const mappedAccountId = await redis.getSessionAccountMapping(stickyKey) + if (mappedAccountId) { + const mappedAccount = filtered.find((account) => account.id === mappedAccountId) + if (mappedAccount) { + await redis.extendSessionAccountMappingTTL(stickyKey) + logger.info( + `🤖 命中 Droid 粘性会话: ${sessionHash} -> ${mappedAccount.name || mappedAccount.id}` + ) + await this._ensureLastUsedUpdated(mappedAccount.id) + return mappedAccount + } + + await this._cleanupStickyMapping(stickyKey) + } + } + + const sorted = this._sortCandidates(filtered) + const selected = sorted[0] + + if (!selected) { + throw new Error( + `No schedulable Droid account available after sorting (${normalizedEndpoint})` + ) + } + + if (stickyKey && !isDedicatedBinding) { + await redis.setSessionAccountMapping(stickyKey, selected.id) + } + + await this._ensureLastUsedUpdated(selected.id) + + logger.info( + `🤖 选择 Droid 账号 ${selected.name || selected.id}（endpoint: ${normalizedEndpoint}, priority: ${selected.priority || 50}）` + ) + + return selected + } +} + +module.exports = new DroidScheduler() diff --git a/src/utils/tokenMask.js b/src/utils/tokenMask.js index 3ea94583..aa317052 100644 --- a/src/utils/tokenMask.js +++ b/src/utils/tokenMask.js @@ -17,8 +17,18 @@ function maskToken(token, visiblePercent = 70) { const { length } = token // 对于非常短的 token，至少隐藏一部分 + if (length <= 2) { + return '*'.repeat(length) + } + + if (length <= 5) { + return token.slice(0, 1) + '*'.repeat(length - 1) + } + if (length <= 10) { - return token.slice(0, 5) + '*'.repeat(length - 5) + const visibleLength = Math.min(5, length - 2) + const front = token.slice(0, visibleLength) + return front + '*'.repeat(length - visibleLength) } // 计算可见字符数量 diff --git a/src/utils/workosOAuthHelper.js b/src/utils/workosOAuthHelper.js new file mode 100644 index 00000000..8ce33c4d --- /dev/null +++ b/src/utils/workosOAuthHelper.js @@ -0,0 +1,170 @@ +const axios = require('axios') +const config = require('../../config/config') +const logger = require('./logger') +const ProxyHelper = require('./proxyHelper') + +const WORKOS_CONFIG = config.droid || {} + +const WORKOS_DEVICE_AUTHORIZE_URL = + WORKOS_CONFIG.deviceAuthorizeUrl || 'https://api.workos.com/user_management/authorize/device' +const WORKOS_TOKEN_URL = + WORKOS_CONFIG.tokenUrl || 'https://api.workos.com/user_management/authenticate' +const WORKOS_CLIENT_ID = WORKOS_CONFIG.clientId || 'client_01HNM792M5G5G1A2THWPXKFMXB' + +const DEFAULT_POLL_INTERVAL = 5 + +class WorkOSDeviceAuthError extends Error { + constructor(message, code, options = {}) { + super(message) + this.name = 'WorkOSDeviceAuthError' + this.code = code || 'unknown_error' + this.retryAfter = options.retryAfter || null + } +} + +/** + * 启动设备码授权流程 + * @param {object|null} proxyConfig - 代理配置 + * @returns {Promise} WorkOS 返回的数据 + */ +async function startDeviceAuthorization(proxyConfig = null) { + const form = new URLSearchParams({ + client_id: WORKOS_CLIENT_ID + }) + + const agent = ProxyHelper.createProxyAgent(proxyConfig) + + try { + logger.info('🔐 请求 WorkOS 设备码授权', { + url: WORKOS_DEVICE_AUTHORIZE_URL, + hasProxy: !!agent + }) + + const response = await axios.post(WORKOS_DEVICE_AUTHORIZE_URL, form.toString(), { + headers: { + 'Content-Type': 'application/x-www-form-urlencoded' + }, + httpsAgent: agent, + timeout: 15000 + }) + + const data = response.data || {} + + if (!data.device_code || !data.verification_uri) { + throw new Error('WorkOS 返回数据缺少必要字段 (device_code / verification_uri)') + } + + logger.success('✅ 成功获取 WorkOS 设备码授权信息', { + verificationUri: data.verification_uri, + userCode: data.user_code + }) + + return { + deviceCode: data.device_code, + userCode: data.user_code, + verificationUri: data.verification_uri, + verificationUriComplete: data.verification_uri_complete || data.verification_uri, + expiresIn: data.expires_in || 300, + interval: data.interval || DEFAULT_POLL_INTERVAL + } + } catch (error) { + if (error.response) { + logger.error('❌ WorkOS 设备码授权失败', { + status: error.response.status, + data: error.response.data + }) + throw new WorkOSDeviceAuthError( + error.response.data?.error_description || + error.response.data?.error || + 'WorkOS 设备码授权失败', + error.response.data?.error + ) + } + + logger.error('❌ 请求 WorkOS 设备码授权异常', { + message: error.message + }) + throw new WorkOSDeviceAuthError(error.message) + } +} + +/** + * 轮询授权结果 + * @param {string} deviceCode - 设备码 + * @param {object|null} proxyConfig - 代理配置 + * @returns {Promise} WorkOS 返回的 token 数据 + */ +async function pollDeviceAuthorization(deviceCode, proxyConfig = null) { + if (!deviceCode) { + throw new WorkOSDeviceAuthError('缺少设备码，无法查询授权结果', 'missing_device_code') + } + + const form = new URLSearchParams({ + grant_type: 'urn:ietf:params:oauth:grant-type:device_code', + device_code: deviceCode, + client_id: WORKOS_CLIENT_ID + }) + + const agent = ProxyHelper.createProxyAgent(proxyConfig) + + try { + const response = await axios.post(WORKOS_TOKEN_URL, form.toString(), { + headers: { + 'Content-Type': 'application/x-www-form-urlencoded' + }, + httpsAgent: agent, + timeout: 15000 + }) + + const data = response.data || {} + + if (!data.access_token) { + throw new WorkOSDeviceAuthError('WorkOS 返回结果缺少 access_token', 'missing_access_token') + } + + logger.success('🤖 Droid 授权完成，获取到访问令牌', { + hasRefreshToken: !!data.refresh_token + }) + + return data + } catch (error) { + if (error.response) { + const responseData = error.response.data || {} + const errorCode = responseData.error || `http_${error.response.status}` + const errorDescription = + responseData.error_description || responseData.error || 'WorkOS 授权失败' + + if (errorCode === 'authorization_pending' || errorCode === 'slow_down') { + const retryAfter = + Number(responseData.interval) || + Number(error.response.headers?.['retry-after']) || + DEFAULT_POLL_INTERVAL + + throw new WorkOSDeviceAuthError(errorDescription, errorCode, { + retryAfter + }) + } + + if (errorCode === 'expired_token') { + throw new WorkOSDeviceAuthError(errorDescription, errorCode) + } + + logger.error('❌ WorkOS 设备授权轮询失败', { + status: error.response.status, + data: responseData + }) + throw new WorkOSDeviceAuthError(errorDescription, errorCode) + } + + logger.error('❌ WorkOS 设备授权轮询异常', { + message: error.message + }) + throw new WorkOSDeviceAuthError(error.message) + } +} + +module.exports = { + startDeviceAuthorization, + pollDeviceAuthorization, + WorkOSDeviceAuthError +} diff --git a/src/validators/clientDefinitions.js b/src/validators/clientDefinitions.js index b70e3474..89c3e528 100644 --- a/src/validators/clientDefinitions.js +++ b/src/validators/clientDefinitions.js @@ -26,6 +26,14 @@ const CLIENT_DEFINITIONS = { displayName: 'Codex Command Line Tool', description: 'Cursor/Codex command-line interface', icon: '🔷' + }, + + DROID_CLI: { + id: 'droid_cli', + name: 'Droid CLI', + displayName: 'Factory Droid CLI', + description: 'Factory Droid platform command-line interface', + icon: '🤖' } } @@ -33,7 +41,8 @@ const CLIENT_DEFINITIONS = { const CLIENT_IDS = { CLAUDE_CODE: 'claude_code', GEMINI_CLI: 'gemini_cli', - CODEX_CLI: 'codex_cli' + CODEX_CLI: 'codex_cli', + DROID_CLI: 'droid_cli' } // 获取所有客户端定义 diff --git a/src/validators/clientValidator.js b/src/validators/clientValidator.js index 54a87634..13cb38eb 100644 --- a/src/validators/clientValidator.js +++ b/src/validators/clientValidator.js @@ -8,6 +8,7 @@ const { CLIENT_DEFINITIONS, getAllClientDefinitions } = require('./clientDefinit const ClaudeCodeValidator = require('./clients/claudeCodeValidator') const GeminiCliValidator = require('./clients/geminiCliValidator') const CodexCliValidator = require('./clients/codexCliValidator') +const DroidCliValidator = require('./clients/droidCliValidator') /** * 客户端验证器类 @@ -26,6 +27,8 @@ class ClientValidator { return GeminiCliValidator case 'codex_cli': return CodexCliValidator + case 'droid_cli': + return DroidCliValidator default: logger.warn(`Unknown client ID: ${clientId}`) return null @@ -37,7 +40,7 @@ class ClientValidator { * @returns {Array} 客户端ID列表 */ static getSupportedClients() { - return ['claude_code', 'gemini_cli', 'codex_cli'] + return ['claude_code', 'gemini_cli', 'codex_cli', 'droid_cli'] } /** diff --git a/src/validators/clients/claudeCodeValidator.js b/src/validators/clients/claudeCodeValidator.js index f012030b..b538024b 100644 --- a/src/validators/clients/claudeCodeValidator.js +++ b/src/validators/clients/claudeCodeValidator.js @@ -50,7 +50,11 @@ class ClaudeCodeValidator { return false } - const systemEntries = Array.isArray(body.system) ? body.system : [] + const systemEntries = Array.isArray(body.system) ? body.system : null + if (!systemEntries) { + return false + } + for (const entry of systemEntries) { const rawText = typeof entry?.text === 'string' ? entry.text : '' const { bestScore } = bestSimilarityByTemplates(rawText) diff --git a/src/validators/clients/droidCliValidator.js b/src/validators/clients/droidCliValidator.js new file mode 100644 index 00000000..7fde7aa9 --- /dev/null +++ b/src/validators/clients/droidCliValidator.js @@ -0,0 +1,57 @@ +const logger = require('../../utils/logger') +const { CLIENT_DEFINITIONS } = require('../clientDefinitions') + +/** + * Droid CLI 验证器 + * 检查请求是否来自 Factory Droid CLI + */ +class DroidCliValidator { + static getId() { + return CLIENT_DEFINITIONS.DROID_CLI.id + } + + static getName() { + return CLIENT_DEFINITIONS.DROID_CLI.name + } + + static getDescription() { + return CLIENT_DEFINITIONS.DROID_CLI.description + } + + static validate(req) { + try { + const userAgent = req.headers['user-agent'] || '' + const factoryClientHeader = (req.headers['x-factory-client'] || '').toString().toLowerCase() + + const uaMatch = /factory-cli\/(\d+\.\d+\.\d+)/i.exec(userAgent) + const hasFactoryClientHeader = + typeof factoryClientHeader === 'string' && + (factoryClientHeader.includes('droid') || factoryClientHeader.includes('factory-cli')) + + if (!uaMatch && !hasFactoryClientHeader) { + logger.debug(`Droid CLI validation failed - UA mismatch: ${userAgent}`) + return false + } + + // 允许，通过基础验证 + logger.debug( + `Droid CLI validation passed (UA: ${userAgent || 'N/A'}, header: ${factoryClientHeader || 'N/A'})` + ) + return true + } catch (error) { + logger.error('Error in DroidCliValidator:', error) + return false + } + } + + static getInfo() { + return { + id: this.getId(), + name: this.getName(), + description: this.getDescription(), + icon: CLIENT_DEFINITIONS.DROID_CLI.icon + } + } +} + +module.exports = DroidCliValidator diff --git a/web/admin-spa/src/components/accounts/AccountForm.vue b/web/admin-spa/src/components/accounts/AccountForm.vue index 80cd327c..5739fc4a 100644 --- a/web/admin-spa/src/components/accounts/AccountForm.vue +++ b/web/admin-spa/src/components/accounts/AccountForm.vue @@ -71,7 +71,7 @@
-
+
Google AI

+ + +
+
+
+
+ +
+
+ +
+
+

+ Droid +

+

Claude Droid

+
+
@@ -447,6 +478,35 @@
+ + + @@ -473,9 +533,11 @@ type="radio" value="oauth" /> - OAuth 授权 (用量可视化) + + OAuth 授权 + (用量可视化) + + @@ -1028,97 +1101,167 @@
模型限制 (可选) -
-

- - 留空表示支持所有模型且不修改请求。配置映射后，左侧模型会被识别为支持的模型，右侧是实际发送的模型。 + + +

+ + +
+ + +
+
+

+ + 选择允许使用此账户的模型。留空表示支持所有模型。 +

+
+ + +
+ +
+ +

+ 已选择 {{ allowedModels.length }} 个模型 + （支持所有模型）

- -
-
- - - - +
+
+ + + + + +
+ + + +
- - - - - -
- - - - -
-

- 留空表示支持所有模型。如果指定模型，请求中的模型不在列表内将不会调度到此账号 -

@@ -1448,6 +1591,12 @@ 请输入有效的 OpenAI Access Token。如果您有 Refresh Token，建议也一并填写以支持自动刷新。

+

+ 请输入有效的 Droid Access Token，并同时提供 Refresh Token 以支持自动刷新。 +

@@ -1482,10 +1631,23 @@ 请从已登录 OpenAI 账户的机器上获取认证凭证， 或通过 OAuth 授权流程获取 Access Token。

+

+ 请从已完成授权的 Droid CLI 或 Factory.ai 导出的凭证中获取 Access Token 与 + Refresh Token。 +

-

+

💡 如果未填写 Refresh Token，Token 过期后需要手动更新。

+

+ ⚠️ Droid 账户必须填写 Refresh Token，缺失将导致无法自动刷新 Access Token。 +

@@ -1522,7 +1684,7 @@

-
+
@@ -1539,7 +1701,12 @@

- 系统将使用 Refresh Token 自动获取 Access Token 和用户信息 + +

@@ -1556,6 +1723,60 @@
+ +
+
+
+ +
+
+
+ 使用 API Key 调度 Droid +
+

+ 请填写一个或多个 Factory.ai API + Key，系统会自动在请求时随机挑选并结合会话哈希维持粘性，确保对话上下文保持稳定。 +

+
+
+ +
+ +