API Keys created by users have all permissions by default

2026-01-23 21:17:30 +00:00 · 2025-09-09 12:52:34 +08:00
parent ca79e08c81
commit 4ee9e0b546
1 changed files with 2 additions and 1 deletions
--- a/src/routes/userRoutes.js
+++ b/src/routes/userRoutes.js
@@ -315,7 +315,8 @@ router.post('/api-keys', authenticateUser, async (req, res) => {
      expiresAt: expiresAt || null,
      dailyCostLimit: dailyCostLimit || null,
      createdBy: 'user',
-      permissions: ['messages'] // 用户创建的API Key默认只有messages权限
+      // 设置服务权限为全部服务，确保前端显示“服务权限”为“全部服务”且具备完整访问权限
+      permissions: 'all'
    }

    const newApiKey = await apiKeyService.createApiKey(apiKeyData)