From 69e825d0e2f3686cfe18fef31718dd3e4e8fd84c Mon Sep 17 00:00:00 2001
From: jiaguangqi <52811251+jiaguangqi@users.noreply.github.com>
Date: Mon, 10 Aug 2026 22:29:40 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=8F=91=E5=B8=83=20API=20Hub=20v2.1.0?=
 =?UTF-8?q?=20=E6=B5=81=E5=BC=8F=E4=B8=8E=E6=99=BA=E8=83=BD=E4=BD=93?=
 =?UTF-8?q?=E6=94=AF=E6=8C=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ARCHITECTURE.md |   4 +-
 CHANGELOG.md    |  34 ++++++
 README.md       |   1 +
 README_zh.md    |   1 +
 database.sql    |  24 +----
 index.html      |  55 ++++++----
 package.json    |  11 ++
 server.js       | 271 ++++++++++++++++++++++++++++++++++++++++--------
 8 files changed, 311 insertions(+), 90 deletions(-)
 create mode 100644 CHANGELOG.md

diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 0739efb..dc66259 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -99,7 +99,7 @@ API 请求
 
 ```bash
 # .env 文件
-JWT_SECRET=api-hub-v2-jiaguangqi-jwt-secret-2025
+JWT_SECRET=<使用 openssl rand -hex 32 生成的独立密钥>
 ```
 
 ⚠️ **重要**: JWT_SECRET 必须固定，否则服务器重启后所有 token 失效
@@ -305,7 +305,7 @@ npm install
 
 # 3. 配置环境变量
 cat > .env << 'EOF'
-JWT_SECRET=your-fixed-secret-key
+JWT_SECRET=<使用 openssl rand -hex 32 生成的独立密钥>
 EOF
 
 # 4. 启动后端服务
diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..eafba3c
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,34 @@
+# Changelog
+
+本项目的重要变更均记录在此文件中。
+
+## 2.1.0 - 2026-08-10
+
+### 新增
+
+- 支持 OpenAI 兼容的 SSE 流式对话转发。
+- 完整透传 `tools`、`tool_choice`、`response_format`、采样参数和 token 限制等智能体参数。
+- 客户端中断流式请求时，同步取消上游请求。
+
+### 优化
+
+- 新增渠道时强制校验渠道名称、上游地址和 API Key。
+- 新增或修改模型时，校验关联渠道处于启用状态且已配置 API Key。
+- 渠道 Key 读取兼容 `key`、`keys` 和 `secret_key` 字段。
+- 模型弹窗打开时重置上次选中的渠道，避免错误绑定。
+
+### 修复
+
+- 修复 `stream: true` 时将 SSE 当作 JSON 解析而返回 HTTP 500 的问题。
+- 修复上游非 2xx 状态被错误包装为 HTTP 200 的问题。
+- 移除模型测试时随机尝试无关渠道的回退逻辑。
+
+### 安全
+
+- 清理 `database.sql` 中的运行数据与凭据，仅保留数据库结构。
+- 将架构文档中的固定 JWT 密钥替换为安全生成指引。
+
+### 部署
+
+- 版本号设置为 `2.1.0`。
+- 本版本不需要数据库迁移，不新增环境变量。
diff --git a/README.md b/README.md
index 7c34948..6721be3 100644
--- a/README.md
+++ b/README.md
@@ -12,6 +12,7 @@ English | [简体中文](./README_zh.md)
 - ✅ **API Key Management** - Personal API keys for users
 - ✅ **Model Playground** - Online testing experience center
 - ✅ **OpenAI-compatible API** - Drop-in replacement for OpenAI API
+- ✅ **Streaming & Agent Tools** - SSE streaming plus `tools` / `tool_choice` passthrough
 - ✅ **Dynamic IP Configuration** - Auto-detect server IP during deployment
 
 ## 🏗️ Architecture
diff --git a/README_zh.md b/README_zh.md
index 0dc9fe5..73fc059 100644
--- a/README_zh.md
+++ b/README_zh.md
@@ -12,6 +12,7 @@
 - ✅ **API Key 管理** - 为用户提供个人 API Key
 - ✅ **模型广场** - 在线体验中心，可直接测试模型
 - ✅ **OpenAI 兼容接口** - 完美兼容 OpenAI API 格式
+- ✅ **流式与智能体工具** - 支持 SSE 流式输出及 `tools` / `tool_choice` 透传
 - ✅ **动态 IP 配置** - 部署时自动检测服务器 IP
 
 ## 🏗️ 技术架构
diff --git a/database.sql b/database.sql
index a5b44e8..2dc6fac 100644
--- a/database.sql
+++ b/database.sql
@@ -1,5 +1,6 @@
 PRAGMA foreign_keys=OFF;
 BEGIN TRANSACTION;
+-- Schema-only bootstrap: runtime data, user records and credentials are intentionally excluded.
 CREATE TABLE inf_users (
       id TEXT PRIMARY KEY,
       account TEXT UNIQUE NOT NULL,
@@ -18,8 +19,6 @@ CREATE TABLE inf_users (
       invite_code TEXT,
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     , balance REAL DEFAULT 0);
-INSERT INTO inf_users VALUES('d2dd171f-bccc-4eba-af92-ed8f7a1ba06d','admin','系统管理员',NULL,'$2b$10$oCtxdm3WEUY4DAELIhtmaOCSGVav79Xy7Z.6AJnDvUbrte5ARjoCK','inf_admin_default',NULL,NULL,'SUCCESS','admin','ENABLED','default',0,0,NULL,'2026-02-11 07:03:53',0.0);
-INSERT INTO inf_users VALUES('ba4f6618-45f5-4b12-b003-02c29e37ffa3','test1','test1','test1@qq.com','$2b$10$q6tBzOKSVWuTMezfmxdgHuNteCzcDqB/gYp9.y24oCQNu0SLpc85q','inf_f6242314-8875-4778-b37a-25d1b1a6299a',NULL,NULL,'SUCCESS','user','ENABLED','default',10000,0,NULL,'2026-02-11 08:57:16',0.0);
 CREATE TABLE inf_channels (
       id TEXT PRIMARY KEY,
       name TEXT NOT NULL,
@@ -44,7 +43,6 @@ CREATE TABLE inf_channels (
       auto_ban INTEGER DEFAULT 1,
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
-INSERT INTO inf_channels VALUES('86a4fd64-e77a-437e-989f-1774bdc5ad7d','云雾',1,'sk-5x6EJaCNn5ROlCvnPoPVQ39iXSchWHQKCmdMFc0YqCVyOIFs','sk-5x6EJaCNn5ROlCvnPoPVQ39iXSchWHQKCmdMFc0YqCVyOIFs','OPENAI_COMPATIBLE','https://yunwu.ai/v1','sk-5x6EJaCNn5ROlCvnPoPVQ39iXSchWHQKCmdMFc0YqCVyOIFs','SYNC',1,10,100,1802,0.0,0,'云雾AI API 提供国内外知名模型',NULL,'default',NULL,1770799105,1,'2026-02-11 07:05:00');
 CREATE TABLE inf_abilities (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       channel_id TEXT NOT NULL,
@@ -54,7 +52,6 @@ CREATE TABLE inf_abilities (
       weight INTEGER DEFAULT 1,
       UNIQUE(channel_id, model)
     );
-INSERT INTO inf_abilities VALUES(5,'86a4fd64-e77a-437e-989f-1774bdc5ad7d','云雾AI API 提供国内外知名模型',1,0,1);
 CREATE TABLE inf_models (
       id TEXT PRIMARY KEY,
       model_id TEXT UNIQUE NOT NULL,
@@ -67,9 +64,6 @@ CREATE TABLE inf_models (
       enabled_status TEXT DEFAULT 'ENABLED',
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP
     , tags TEXT);
-INSERT INTO inf_models VALUES('b3385c11-25df-467e-a699-43f7c9959da2','gemini-3-flash-preview','gemini-3-flash-preview','云雾','TEXT',NULL,0.0,0.0,'ENABLED','2026-02-11 08:32:57','文本,多模态,语音');
-INSERT INTO inf_models VALUES('01301ea0-d025-41d0-8f11-2f99ef0d6fcc','claude-sonnet-4-20250514','claude-sonnet-4-20250514','云雾','TEXT',NULL,0.0,0.0,'ENABLED','2026-02-11 08:32:57','文本,文生图');
-INSERT INTO inf_models VALUES('8e32d917-cc45-4be3-93a0-bb3fb4fa4a32','gpt-4o-mini-2024-07-18','gpt-4o-mini-2024-07-18','云雾','TEXT',NULL,0.0,0.0,'ENABLED','2026-02-11 08:32:57','文本,多模态,语音');
 CREATE TABLE inf_logs (
       id INTEGER PRIMARY KEY AUTOINCREMENT,
       channel_id TEXT,
@@ -96,7 +90,6 @@ CREATE TABLE inf_settings (
       value TEXT NOT NULL,
       updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
-INSERT INTO inf_settings VALUES('smtp','{"smtp_account":"hpcadmin@163.com","smtp_password":"YAnESUx2YTvCdJnX","smtp_server":"smtp.163.com","smtp_port":"465","pop3_server":"pop.163.com","imap_server":"imap.163.com","smtp_from_name":"AI_API_HUB"}','2026-02-11 10:45:51');
 CREATE TABLE inf_payment_settings (
       id INTEGER PRIMARY KEY CHECK (id = 1),
       yipay_url TEXT,
@@ -121,7 +114,6 @@ CREATE TABLE inf_topup_orders (
       created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
       paid_at DATETIME
     );
-INSERT INTO inf_topup_orders VALUES('e0864e2f-68ec-4559-9dd9-afd4c276394c','d2dd171f-bccc-4eba-af92-ed8f7a1ba06d',50.0,50.0,'alipay','PENDING','TOPUP1770901834099HA3X6S','2026-02-12 13:10:34',NULL);
 CREATE TABLE inf_site_settings (
       id INTEGER PRIMARY KEY CHECK (id = 1),
       site_name TEXT DEFAULT 'AI API Hub',
@@ -133,14 +125,8 @@ CREATE TABLE inf_site_settings (
       email_verify INTEGER DEFAULT 0,
       updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
     );
-INSERT INTO inf_site_settings VALUES(1,'OGAI API Hub','大模型 API 管理平台','','','© 2024 AI API Hub. All rights reserved.',1,0,'2026-02-11 12:22:43');
 CREATE TABLE user_api_keys (id TEXT PRIMARY KEY, user_id TEXT NOT NULL, name TEXT NOT NULL, api_key TEXT UNIQUE NOT NULL, api_key_masked TEXT NOT NULL, status TEXT DEFAULT "ENABLED", usage_count INTEGER DEFAULT 0, created_at DATETIME DEFAULT CURRENT_TIMESTAMP, last_used_at DATETIME, quota INTEGER DEFAULT 100, used_quota INTEGER DEFAULT 0, expires_at DATETIME, allowed_models TEXT DEFAULT "all");
-INSERT INTO user_api_keys VALUES('139f0ac2-3184-4673-ab2f-00f092fb6207','d2dd171f-bccc-4eba-af92-ed8f7a1ba06d','test1','sk-8f5e061c4f2c0124a17ebb3d88ba67afcad4bf1079a0f599','sk-8f5e061******f599','ENABLED',0,'2026-02-12 06:36:43',NULL,100,0,'2027-02-12T06:36:43.335Z','all');
 CREATE TABLE api_key_usage_logs (id INTEGER PRIMARY KEY AUTOINCREMENT, api_key_id INTEGER, api_key_masked TEXT, user_id INTEGER, model_id TEXT, input_tokens INTEGER, output_tokens INTEGER, total_tokens INTEGER, cost REAL, request_type TEXT, note TEXT, created_at DATETIME DEFAULT CURRENT_TIMESTAMP);
-INSERT INTO api_key_usage_logs VALUES(1,1,'sk-8f5e061******f599',1,'gpt-4o-mini-2024-07-18',1500,800,2300,0.050000000000000002775,NULL,'正常调用','2026-02-12 08:35:21');
-INSERT INTO api_key_usage_logs VALUES(2,1,'sk-8f5e061******f599',1,'claude-sonnet-4-20250514',2500,1200,3700,0.080000000000000001665,NULL,'代码生成','2026-02-12 08:35:21');
-INSERT INTO api_key_usage_logs VALUES(3,1,'sk-8f5e061******f599',1,'gemini-3-flash-preview',2000,500,2500,0.029999999999999998889,NULL,'数据分析','2026-02-12 08:35:21');
-INSERT INTO api_key_usage_logs VALUES(4,1,'sk-8f5e061******f599',1,'gpt-4o-mini-2024-07-18',500,300,800,0.020000000000000000416,NULL,'简单查询','2026-02-12 08:35:21');
 CREATE TABLE user_bills (
     id INTEGER PRIMARY KEY AUTOINCREMENT,
     user_id TEXT NOT NULL,
@@ -154,14 +140,6 @@ CREATE TABLE user_bills (
     created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
     FOREIGN KEY (user_id) REFERENCES inf_users(id)
 );
-INSERT INTO user_bills VALUES(1,'1','consumption','USAGE1',-0.050000000000000002775,0.0,0.0,'API调用 gpt-4o-mini-2024-07-18','1','2026-02-12 08:35:21');
-INSERT INTO user_bills VALUES(2,'1','consumption','USAGE2',-0.080000000000000001665,0.0,0.0,'API调用 claude-sonnet-4-20250514','2','2026-02-12 08:35:21');
-INSERT INTO user_bills VALUES(3,'1','consumption','USAGE3',-0.029999999999999998889,0.0,0.0,'API调用 gemini-3-flash-preview','3','2026-02-12 08:35:21');
-INSERT INTO user_bills VALUES(4,'1','consumption','USAGE4',-0.020000000000000000416,0.0,0.0,'API调用 gpt-4o-mini-2024-07-18','4','2026-02-12 08:35:21');
-DELETE FROM sqlite_sequence;
-INSERT INTO sqlite_sequence VALUES('inf_abilities',5);
-INSERT INTO sqlite_sequence VALUES('api_key_usage_logs',4);
-INSERT INTO sqlite_sequence VALUES('user_bills',4);
 CREATE INDEX idx_usage_user ON api_key_usage_logs(user_id);
 CREATE INDEX idx_bills_user ON user_bills(user_id);
 CREATE INDEX idx_bills_type ON user_bills(bill_type);
diff --git a/index.html b/index.html
index 41104da..1bad0c3 100644
--- a/index.html
+++ b/index.html
@@ -942,12 +942,7 @@ <h3 class="text-xl font-medium mb-6">安全设置</h3>
     </div>
 
     <script>
-        // API_URL 配置：优先使用 window.API_HUB_CONFIG，否则自动推断
-        const API_URL = (typeof window.API_HUB_CONFIG !== 'undefined' && window.API_HUB_CONFIG.apiUrl) 
-            ? window.API_HUB_CONFIG.apiUrl 
-            : (window.location.hostname === 'localhost' 
-                ? 'http://localhost:8080' 
-                : `http://${window.location.hostname}:8080`);
+        const API_URL = window.location.protocol + '//' + window.location.hostname + ':8080';
         let token = localStorage.getItem('token') || '';
         let currentModal = null;
 
@@ -2221,8 +2216,8 @@ <h3 class="text-xl font-bold text-green-600">✓ API Key 创建成功</h3>
             document.querySelectorAll('[id^="tab-"]').forEach(el => {
                 el.classList.remove('border-[#0055FF]', 'bg-[#F4F5F7]');
                 el.classList.add('border-transparent');
-                el.querySelector('.font-mono').classList.remove('text-[#0055FF]');
-                el.querySelector('.font-mono').classList.add('text-[#1A1D21]/60');
+                const fontMono1 = el.querySelector('.font-mono'); if (fontMono1) fontMono1.classList.remove('text-[#0055FF]');
+                const fontMono2 = el.querySelector('.font-mono'); if (fontMono2) fontMono2.classList.add('text-[#1A1D21]/60');
             });
             
             // Show selected tab
@@ -2230,8 +2225,8 @@ <h3 class="text-xl font-bold text-green-600">✓ API Key 创建成功</h3>
             const tabEl = document.getElementById('tab-' + tab);
             tabEl.classList.add('border-[#0055FF]', 'bg-[#F4F5F7]');
             tabEl.classList.remove('border-transparent');
-            tabEl.querySelector('.font-mono').classList.add('text-[#0055FF]');
-            tabEl.querySelector('.font-mono').classList.remove('text-[#1A1D21]/60');
+            const tabFontMono1 = tabEl.querySelector('.font-mono'); if (tabFontMono1) tabFontMono1.classList.add('text-[#0055FF]');
+            const tabFontMono2 = tabEl.querySelector('.font-mono'); if (tabFontMono2) tabFontMono2.classList.remove('text-[#1A1D21]/60');
             
             // Load settings when switching to specific tabs
             if (tab === 'basic') {
@@ -2571,15 +2566,15 @@ <h3 class="text-xl font-bold text-green-600">✓ API Key 创建成功</h3>
                 <div class="space-y-4">
                     <div>
                         <label class="font-mono text-xs uppercase text-[#1A1D21]/60">渠道名称</label>
-                        <input type="text" id="chName" class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
+                        <input type="text" id="chName" required class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
                     </div>
                     <div>
                         <label class="font-mono text-xs uppercase text-[#1A1D21]/60">Base URL</label>
-                        <input type="text" id="chUrl" class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
+                        <input type="url" id="chUrl" required class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
                     </div>
                     <div>
                         <label class="font-mono text-xs uppercase text-[#1A1D21]/60">API Key</label>
-                        <input type="text" id="chKey" class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
+                        <input type="password" id="chKey" required autocomplete="new-password" placeholder="请输入上游 API Key" class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
                     </div>
                     <div>
                         <label class="font-mono text-xs uppercase text-[#1A1D21]/60">渠道描述</label>
@@ -2612,6 +2607,7 @@ <h3 class="text-xl font-bold text-green-600">✓ API Key 创建成功</h3>
         let currentSourceChannel = null;
 
         async function showModelModal() {
+            currentSourceChannel = null;
             document.getElementById('modalTitle').textContent = '新建模型';
             document.getElementById('modalBody').innerHTML = `
                 <div class="space-y-4">
@@ -2667,7 +2663,9 @@ <h3 class="text-xl font-bold text-green-600">✓ API Key 创建成功</h3>
                     headers: { 'Authorization': 'Bearer ' + token }
                 });
                 const data = await res.json();
-                modelChannelCache = (data.data || []).filter(c => c.response_time > 0);
+                modelChannelCache = (data.data || []).filter(c =>
+                    c.response_time > 0 && (c.key_list?.some(key => key.trim()) || String(c.key || '').trim())
+                );
                 
                 const select = document.getElementById('modelChannelSelect');
                 select.innerHTML = '<option value="">-- 选择已测试通过的渠道 --</option>' + 
@@ -2756,25 +2754,44 @@ <h3 class="text-xl font-bold text-green-600">✓ API Key 创建成功</h3>
         async function saveModal() {
             if (currentModal === 'channel' || currentModal === 'channel-edit') {
                 const data = {
-                    name: document.getElementById('chName').value,
-                    base_url: document.getElementById('chUrl').value,
-                    key: document.getElementById('chKey').value,
+                    name: document.getElementById('chName').value.trim(),
+                    base_url: document.getElementById('chUrl').value.trim(),
+                    key: document.getElementById('chKey').value.trim(),
                     models: document.getElementById('chDesc').value,
                     weight: parseInt(document.getElementById('chWeight').value) || 1,
                     rate: parseFloat(document.getElementById('chRate').value) || 1.0
                 };
+                if (!data.name || !data.base_url || !data.key) {
+                    alert('渠道名称、Base URL 和 API Key 均为必填项');
+                    return;
+                }
+                try {
+                    new URL(data.base_url);
+                } catch {
+                    alert('Base URL 格式不正确');
+                    return;
+                }
                 const url = currentModal === 'channel-edit' ? `${API_URL}/api/admin/channels/${currentChannelId}` : `${API_URL}/api/admin/channels`;
                 const method = currentModal === 'channel-edit' ? 'PUT' : 'POST';
-                await fetch(url, {
+                const response = await fetch(url, {
                     method: method,
                     headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer ' + token },
                     body: JSON.stringify(data)
                 });
+                const result = await response.json();
+                if (!response.ok) {
+                    alert(result.error || '保存渠道失败');
+                    return;
+                }
                 closeModal();
                 loadChannels();
             } else if (currentModal === 'model') {
                 // Batch publish selected models from channel
                 if (selectedModelIndices.size > 0 && fetchedModels.length > 0) {
+                    if (!currentSourceChannel || !(currentSourceChannel.key_list?.some(key => key.trim()) || String(currentSourceChannel.key || '').trim())) {
+                        alert('请选择已配置 API Key 的可用渠道');
+                        return;
+                    }
                     const inputPrice = parseFloat(document.getElementById('mIn').value) || 0;
                     const outputPrice = parseFloat(document.getElementById('mOut').value) || 0;
                     const sourceChannelName = currentSourceChannel ? currentSourceChannel.name : 'Manual';
@@ -2893,7 +2910,7 @@ <h3 class="text-xl font-bold text-green-600">✓ API Key 创建成功</h3>
                     </div>
                     <div>
                         <label class="font-mono text-xs uppercase text-[#1A1D21]/60">API Key</label>
-                        <input type="text" id="chKey" value="${channel.key}" class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
+                        <input type="password" id="chKey" required autocomplete="current-password" value="${channel.key}" class="w-full bg-white border border-[#D1D5DB] px-3 py-2 mt-1 focus:outline-none focus:border-[#0055FF]">
                     </div>
                     <div>
                         <label class="font-mono text-xs uppercase text-[#1A1D21]/60">渠道描述</label>
diff --git a/package.json b/package.json
index 79ae39e..96ff6da 100644
--- a/package.json
+++ b/package.json
@@ -1,4 +1,15 @@
 {
+  "name": "api-hub-v2",
+  "version": "2.1.0",
+  "description": "OpenAI-compatible API hub with channel, model and API key management",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js",
+    "check": "node --check server.js"
+  },
+  "engines": {
+    "node": ">=18"
+  },
   "dependencies": {
     "bcryptjs": "^3.0.3",
     "cors": "^2.8.6",
diff --git a/server.js b/server.js
index b418478..a36d577 100644
--- a/server.js
+++ b/server.js
@@ -6,29 +6,17 @@ const jwt = require('jsonwebtoken');
 const sqlite3 = require('sqlite3').verbose();
 const { open } = require('sqlite');
 const { v4: uuidv4 } = require('uuid');
+const { Readable } = require('stream');
 
 const app = express();
 const PORT = process.env.PORT || 8080;
 const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';
-const SERVER_IP = process.env.SERVER_IP || 'localhost';
-const FRONTEND_PORT = process.env.FRONTEND_PORT || '3000';
-
-// Middleware - 动态CORS配置
-const allowedOrigins = [
-  `http://localhost:${FRONTEND_PORT}`,
-  `http://127.0.0.1:${FRONTEND_PORT}`,
-  `http://${SERVER_IP}:${FRONTEND_PORT}`
-];
 
+// Middleware
 app.use(cors({ 
   origin: function(origin, callback) {
-    // 允许无origin的请求（如curl/Postman）
     if (!origin) return callback(null, true);
-    if (allowedOrigins.indexOf(origin) !== -1 || SERVER_IP === '*') {
-      callback(null, true);
-    } else {
-      callback(new Error('Not allowed by CORS'));
-    }
+    callback(null, true);
   },
   methods: ["GET", "POST", "PUT", "DELETE", "OPTIONS"], 
   allowedHeaders: ["Content-Type", "Authorization"], 
@@ -41,7 +29,7 @@ let db;
 
 async function initDB() {
   db = await open({
-    filename: '/tmp/api-hub-v2.db',
+    filename: '/var/lib/api-hub-v2/data.db',
     driver: sqlite3.Database
   });
 
@@ -348,7 +336,7 @@ app.post('/api/auth/login', async (req, res) => {
     const ip = req.headers["x-forwarded-for"] || req.socket.remoteAddress || "";
     await db.run("INSERT INTO login_logs (user_id, account, ip, message, status) VALUES (?, ?, ?, ?, ?)", 
       [user.id, account, ip, "登录成功", "SUCCESS"]).catch(e => console.error("Login log error:", e));
-    
+
     res.json({ token, user: { id: user.id, account: user.account, name: user.name, role_code: user.role_code, status: user.status, binding_status: user.binding_status }});
   } catch (err) {
     res.status(500).json({ error: 'Server error' });
@@ -397,18 +385,38 @@ app.get('/api/admin/channels', authMiddleware, adminMiddleware, async (req, res)
 app.post('/api/admin/channels', authMiddleware, adminMiddleware, async (req, res) => {
   try {
     const { name, type = 0, key, keys, protocol_type, base_url, secret_key, weight = 1, priority = 0, models = '', group_name = 'default', test_model, rate = 1.0 } = req.body;
-    
-    // Validate and set defaults for NOT NULL fields
-    const safeBaseUrl = base_url || '';
+
+    const safeName = String(name || '').trim();
+    const safeBaseUrl = String(base_url || '').trim();
     const safeSecretKey = secret_key || '';
+    const keyString = String(keys || key || '')
+      .split(/\r?\n/)
+      .map(item => item.trim())
+      .filter(Boolean)
+      .join('\n');
+    const primaryKey = keyString.split('\n')[0] || '';
+
+    if (!safeName) {
+      return res.status(400).json({ error: '渠道名称不能为空' });
+    }
+    if (!safeBaseUrl) {
+      return res.status(400).json({ error: 'Base URL 不能为空' });
+    }
+    try {
+      new URL(safeBaseUrl);
+    } catch {
+      return res.status(400).json({ error: 'Base URL 格式不正确' });
+    }
+    if (!primaryKey) {
+      return res.status(400).json({ error: 'API Key 不能为空，请先配置上游渠道密钥' });
+    }
     
     const id = uuidv4();
-    const keyString = keys || key;
     
     await db.run(`
       INSERT INTO inf_channels (id, name, type, key, keys, protocol_type, base_url, secret_key, weight, priority, models, group_name, test_model, status, rate)
       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 1, ?)
-    `, [id, name, type, key, keyString, protocol_type, safeBaseUrl, safeSecretKey, weight, priority, models, group_name, test_model, rate]);
+    `, [id, safeName, type, primaryKey, keyString, protocol_type || 'OPENAI_COMPATIBLE', safeBaseUrl, safeSecretKey, weight, priority, models, group_name, test_model, rate]);
     
     // Create abilities
     if (models) {
@@ -433,13 +441,35 @@ app.put('/api/admin/channels/:id', authMiddleware, adminMiddleware, async (req,
     
     const updates = [];
     const params = [];
+
+    if (key !== undefined || keys !== undefined) {
+      const keyString = String(keys || key || '')
+        .split(/\r?\n/)
+        .map(item => item.trim())
+        .filter(Boolean)
+        .join('\n');
+      const primaryKey = keyString.split('\n')[0] || '';
+      if (!primaryKey) {
+        return res.status(400).json({ error: 'API Key 不能为空，请保留或填写有效密钥' });
+      }
+      updates.push('key = ?', 'keys = ?');
+      params.push(primaryKey, keyString);
+    }
+
+    if (base_url !== undefined) {
+      const safeBaseUrl = String(base_url || '').trim();
+      try {
+        new URL(safeBaseUrl);
+      } catch {
+        return res.status(400).json({ error: 'Base URL 格式不正确' });
+      }
+      updates.push('base_url = ?');
+      params.push(safeBaseUrl);
+    }
     
     if (name !== undefined) { updates.push('name = ?'); params.push(name); }
     if (type !== undefined) { updates.push('type = ?'); params.push(type); }
-    if (key !== undefined) { updates.push('key = ?'); params.push(key); }
-    if (keys !== undefined) { updates.push('keys = ?'); params.push(keys); }
     if (protocol_type !== undefined) { updates.push('protocol_type = ?'); params.push(protocol_type); }
-    if (base_url !== undefined) { updates.push('base_url = ?'); params.push(base_url); }
     if (secret_key !== undefined) { updates.push('secret_key = ?'); params.push(secret_key); }
     if (weight !== undefined) { updates.push('weight = ?'); params.push(weight); }
     if (priority !== undefined) { updates.push('priority = ?'); params.push(priority); }
@@ -658,10 +688,32 @@ app.get('/api/models', async (req, res) => {
 app.post('/api/admin/models', authMiddleware, adminMiddleware, async (req, res) => {
   try {
     const { model_id, name, type = 'TEXT', tags, description, input_price = 0, output_price = 0, source_channel = 'Manual' } = req.body;
+    const safeModelId = String(model_id || '').trim();
+    const safeName = String(name || safeModelId).trim();
+    const safeSourceChannel = String(source_channel || '').trim();
+
+    if (!safeModelId || !safeName) {
+      return res.status(400).json({ error: '模型 ID 和名称不能为空' });
+    }
+    if (!safeSourceChannel || safeSourceChannel === 'Manual') {
+      return res.status(400).json({ error: '必须选择一个已配置 API Key 的可用渠道' });
+    }
+
+    const sourceChannel = await db.get(
+      'SELECT * FROM inf_channels WHERE name = ? AND status = 1',
+      [safeSourceChannel]
+    );
+    if (!sourceChannel) {
+      return res.status(400).json({ error: '所选渠道不存在或未启用' });
+    }
+    if (!getChannelApiKey(sourceChannel)) {
+      return res.status(400).json({ error: '所选渠道未配置 API Key' });
+    }
+
     const id = uuidv4();
     const tagsStr = Array.isArray(tags) ? tags.join(',') : (tags || '');
     await db.run(`INSERT INTO inf_models (id, model_id, name, source_channel, type, tags, description, input_price, output_price) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, 
-      [id, model_id, name, source_channel, type, tagsStr, description, input_price, output_price]);
+      [id, safeModelId, safeName, safeSourceChannel, type, tagsStr, description, input_price, output_price]);
     const model = await db.get('SELECT * FROM inf_models WHERE id = ?', [id]);
     res.status(201).json(model);
   } catch (err) {
@@ -676,7 +728,18 @@ app.put('/api/admin/models/:id', authMiddleware, adminMiddleware, async (req, re
     const updates = [];
     const params = [];
     
-    ['name', 'description', 'input_price', 'output_price', 'enabled_status'].forEach(field => {
+    if (req.body.source_channel !== undefined) {
+      const safeSourceChannel = String(req.body.source_channel || '').trim();
+      const sourceChannel = await db.get(
+        'SELECT * FROM inf_channels WHERE name = ? AND status = 1',
+        [safeSourceChannel]
+      );
+      if (!sourceChannel || !getChannelApiKey(sourceChannel)) {
+        return res.status(400).json({ error: '必须选择一个已配置 API Key 的可用渠道' });
+      }
+    }
+
+    ['model_id', 'name', 'description', 'input_price', 'output_price', 'enabled_status', 'source_channel'].forEach(field => {
       if (req.body[field] !== undefined) {
         updates.push(`${field} = ?`);
         params.push(req.body[field]);
@@ -749,17 +812,8 @@ app.post('/api/admin/models/:id/test', authMiddleware, adminMiddleware, async (r
       }
     }
     
-    // Method 4: Last resort - try any tested channel
-    if (!channel) {
-      channel = await db.get('SELECT * FROM inf_channels WHERE status = 1 AND response_time > 0 ORDER BY response_time ASC LIMIT 1');
-    }
-    
     if (!channel) {
-      return res.json({ success: false, error: 'No available channel found', response_time: 0 });
-    }
-    
-    if (!channel) {
-      return res.json({ success: false, error: 'Channel not available', response_time: 0 });
+      return res.json({ success: false, error: '模型未关联可用渠道，请先选择并测试渠道', response_time: 0 });
     }
     
     const startTime = Date.now();
@@ -771,7 +825,10 @@ app.post('/api/admin/models/:id/test', authMiddleware, adminMiddleware, async (r
       const testUrl = new URL('/v1/models', channel.base_url);
       const client = testUrl.protocol === 'https:' ? https : http;
       
-      const key = channel.keys ? channel.keys.split('\n')[0] : channel.key;
+      const key = getChannelApiKey(channel);
+      if (!key) {
+        return res.json({ success: false, error: '关联渠道未配置 API Key', response_time: 0 });
+      }
       
       const options = {
         hostname: testUrl.hostname,
@@ -960,6 +1017,17 @@ function buildUpstreamUrl(baseUrl, path) {
   return url + path;
 }
 
+function getChannelApiKey(channel) {
+  if (!channel) return '';
+
+  const candidates = [];
+  if (channel.keys) candidates.push(...String(channel.keys).split(/\r?\n/));
+  if (channel.key) candidates.push(channel.key);
+  if (channel.secret_key) candidates.push(channel.secret_key);
+
+  return candidates.map(item => String(item).trim()).find(Boolean) || '';
+}
+
 // Validate API key or JWT token middleware
 const validateApiKeyOrToken = async (req, res, next) => {
   const authHeader = req.headers.authorization;
@@ -1019,8 +1087,18 @@ app.get('/v1/models', validateApiKeyOrToken, async (req, res) => {
 
 // Chat completions proxy
 app.post('/v1/chat/completions', validateApiKeyOrToken, async (req, res) => {
+  const upstreamController = new AbortController();
+  const abortUpstream = () => upstreamController.abort();
+  req.once('aborted', abortUpstream);
+
   try {
     const { model, messages, stream = false } = req.body;
+
+    if (!model || !Array.isArray(messages)) {
+      return res.status(400).json({
+        error: { message: 'model 和 messages 为必填参数', type: 'invalid_request_error' }
+      });
+    }
     
     // First check inf_models to get source_channel (case-insensitive match)
     let modelInfo = await db.get('SELECT * FROM inf_models WHERE model_id = ? AND enabled_status = ?', [model, 'ENABLED']);
@@ -1042,18 +1120,63 @@ app.post('/v1/chat/completions', validateApiKeyOrToken, async (req, res) => {
     if (!channel) {
       return res.status(404).json({ error: { message: 'Channel not available for this model', type: 'invalid_request_error' } });
     }
+
+    const upstreamApiKey = getChannelApiKey(channel);
+    if (!upstreamApiKey) {
+      return res.status(502).json({ error: { message: '模型关联渠道未配置 API Key', type: 'upstream_configuration_error' } });
+    }
     
-    // Forward request to upstream
+    // Forward the complete OpenAI-compatible request body. This preserves
+    // tools, tool_choice, response_format, sampling and token-limit options.
+    const upstreamBody = { ...req.body, model: modelInfo.model_id, stream: Boolean(stream) };
     const response = await fetch(buildUpstreamUrl(channel.base_url, '/v1/chat/completions'), {
       method: 'POST',
       headers: {
         'Content-Type': 'application/json',
-        'Authorization': 'Bearer ' + channel.key
+        'Authorization': 'Bearer ' + upstreamApiKey
       },
-      body: JSON.stringify({ model, messages, stream })
+      body: JSON.stringify(upstreamBody),
+      signal: upstreamController.signal
     });
-    
-    const data = await response.json();
+
+    if (stream) {
+      res.status(response.status);
+      res.setHeader('Content-Type', response.headers.get('content-type') || 'text/event-stream; charset=utf-8');
+      res.setHeader('Cache-Control', response.headers.get('cache-control') || 'no-cache');
+      res.setHeader('Connection', 'keep-alive');
+      res.setHeader('X-Accel-Buffering', 'no');
+      res.flushHeaders();
+
+      if (!response.body) {
+        return res.end();
+      }
+
+      const upstreamStream = Readable.fromWeb(response.body);
+      upstreamStream.on('error', (error) => {
+        if (!res.writableEnded) res.destroy(error);
+      });
+      res.once('close', () => {
+        if (!res.writableEnded) abortUpstream();
+      });
+      upstreamStream.pipe(res);
+      return;
+    }
+
+    const responseText = await response.text();
+    let data;
+    try {
+      data = JSON.parse(responseText);
+    } catch {
+      if (!response.ok) {
+        return res.status(response.status).json({
+          error: {
+            message: responseText.slice(0, 500) || `上游服务返回 HTTP ${response.status}`,
+            type: 'upstream_error'
+          }
+        });
+      }
+      return res.status(response.status).send(responseText);
+    }
     
     // Record usage if successful
     if (data.usage) {
@@ -1077,9 +1200,18 @@ app.post('/v1/chat/completions', validateApiKeyOrToken, async (req, res) => {
       );
     }
     
-    res.json(data);
+    res.status(response.status).json(data);
   } catch (err) {
-    res.status(500).json({ error: { message: err.message, type: 'server_error' } });
+    if (res.headersSent || res.writableEnded) return;
+    const aborted = err.name === 'AbortError';
+    res.status(aborted ? 499 : 502).json({
+      error: {
+        message: aborted ? '请求已取消' : `上游模型服务请求失败: ${err.message}`,
+        type: aborted ? 'request_cancelled' : 'upstream_error'
+      }
+    });
+  } finally {
+    req.off('aborted', abortUpstream);
   }
 });
 
@@ -1508,7 +1640,54 @@ app.post('/api/user/topup', authMiddleware, async (req, res) => {
 // ==================== Start Server ====================
 
 initDB().then(() => {
-  app.listen(PORT, () => {
+
+
+// ==================== Logs Routes (Added 2026-03-01) ====================
+
+// Get login logs
+app.get("/api/logs/login", authMiddleware, adminMiddleware, async (req, res) => {
+  try {
+    const { page = 1, pageSize = 50, startDate, endDate } = req.query;
+    const offset = (page - 1) * pageSize;
+
+    let whereClause = "WHERE 1=1";
+    const params = [];
+
+    if (startDate) { whereClause += " AND DATE(created_at) >= ?"; params.push(startDate); }
+    if (endDate) { whereClause += " AND DATE(created_at) <= ?"; params.push(endDate); }
+
+    const total = await db.get(`SELECT COUNT(*) as count FROM login_logs ${whereClause}`, params);
+    const logs = await db.all(`SELECT * FROM login_logs ${whereClause} ORDER BY created_at DESC LIMIT ? OFFSET ?`, [...params, parseInt(pageSize), offset]);
+
+    res.json({ data: logs, total: total.count, page: parseInt(page), pageSize: parseInt(pageSize) });
+  } catch (err) {
+    console.error("Get login logs error:", err);
+    res.status(500).json({ error: "Failed to get login logs" });
+  }
+});
+
+// Get operation logs
+app.get("/api/logs/operation", authMiddleware, adminMiddleware, async (req, res) => {
+  try {
+    const { page = 1, pageSize = 50, operationType } = req.query;
+    const offset = (page - 1) * pageSize;
+
+    let whereClause = "WHERE 1=1";
+    const params = [];
+
+    if (operationType) { whereClause += " AND operation_type = ?"; params.push(operationType); }
+
+    const total = await db.get(`SELECT COUNT(*) as count FROM operation_logs ${whereClause}`, params);
+    const logs = await db.all(`SELECT * FROM operation_logs ${whereClause} ORDER BY operation_time DESC LIMIT ? OFFSET ?`, [...params, parseInt(pageSize), offset]);
+
+    res.json({ data: logs, total: total.count, page: parseInt(page), pageSize: parseInt(pageSize) });
+  } catch (err) {
+    console.error("Get operation logs error:", err);
+    res.status(500).json({ error: "Failed to get operation logs" });
+  }
+});
+
+app.listen(PORT, () => {
     console.log(`AI API Hub V2 running on port ${PORT}`);
     console.log(`Health check: http://localhost:${PORT}/health`);
   });