merge capture requests branch to upstream follow

backend/ent/runtime/runtime.go

@@ -28,6 +28,7 @@ import (
 	"github.com/Wei-Shaw/sub2api/ent/promocodeusage"
 	"github.com/Wei-Shaw/sub2api/ent/proxy"
 	"github.com/Wei-Shaw/sub2api/ent/redeemcode"
+	"github.com/Wei-Shaw/sub2api/ent/requestcapturelog"
 	"github.com/Wei-Shaw/sub2api/ent/schema"
 	"github.com/Wei-Shaw/sub2api/ent/securitysecret"
 	"github.com/Wei-Shaw/sub2api/ent/setting"
@@ -140,6 +141,10 @@ func init() {
 	apikeyDescUsage7d := apikeyFields[16].Descriptor()
 	// apikey.DefaultUsage7d holds the default value on creation for the usage_7d field.
 	apikey.DefaultUsage7d = apikeyDescUsage7d.Default.(float64)
+	// apikeyDescCaptureRequests is the schema descriptor for capture_requests field.
+	apikeyDescCaptureRequests := apikeyFields[20].Descriptor()
+	// apikey.DefaultCaptureRequests holds the default value on creation for the capture_requests field.
+	apikey.DefaultCaptureRequests = apikeyDescCaptureRequests.Default.(bool)
 	accountMixin := schema.Account{}.Mixin()
 	accountMixinHooks1 := accountMixin[1].Hooks()
 	account.Hooks[0] = accountMixinHooks1[0]
@@ -1377,6 +1382,32 @@ func init() {
 	redeemcodeDescValidityDays := redeemcodeFields[9].Descriptor()
 	// redeemcode.DefaultValidityDays holds the default value on creation for the validity_days field.
 	redeemcode.DefaultValidityDays = redeemcodeDescValidityDays.Default.(int)
+	requestcapturelogFields := schema.RequestCaptureLog{}.Fields()
+	_ = requestcapturelogFields
+	// requestcapturelogDescRequestID is the schema descriptor for request_id field.
+	requestcapturelogDescRequestID := requestcapturelogFields[2].Descriptor()
+	// requestcapturelog.RequestIDValidator is a validator for the "request_id" field. It is called by the builders before save.
+	requestcapturelog.RequestIDValidator = requestcapturelogDescRequestID.Validators[0].(func(string) error)
+	// requestcapturelogDescPath is the schema descriptor for path field.
+	requestcapturelogDescPath := requestcapturelogFields[3].Descriptor()
+	// requestcapturelog.PathValidator is a validator for the "path" field. It is called by the builders before save.
+	requestcapturelog.PathValidator = requestcapturelogDescPath.Validators[0].(func(string) error)
+	// requestcapturelogDescMethod is the schema descriptor for method field.
+	requestcapturelogDescMethod := requestcapturelogFields[4].Descriptor()
+	// requestcapturelog.MethodValidator is a validator for the "method" field. It is called by the builders before save.
+	requestcapturelog.MethodValidator = requestcapturelogDescMethod.Validators[0].(func(string) error)
+	// requestcapturelogDescIPAddress is the schema descriptor for ip_address field.
+	requestcapturelogDescIPAddress := requestcapturelogFields[5].Descriptor()
+	// requestcapturelog.IPAddressValidator is a validator for the "ip_address" field. It is called by the builders before save.
+	requestcapturelog.IPAddressValidator = requestcapturelogDescIPAddress.Validators[0].(func(string) error)
+	// requestcapturelogDescNfsFilePath is the schema descriptor for nfs_file_path field.
+	requestcapturelogDescNfsFilePath := requestcapturelogFields[8].Descriptor()
+	// requestcapturelog.NfsFilePathValidator is a validator for the "nfs_file_path" field. It is called by the builders before save.
+	requestcapturelog.NfsFilePathValidator = requestcapturelogDescNfsFilePath.Validators[0].(func(string) error)
+	// requestcapturelogDescCreatedAt is the schema descriptor for created_at field.
+	requestcapturelogDescCreatedAt := requestcapturelogFields[9].Descriptor()
+	// requestcapturelog.DefaultCreatedAt holds the default value on creation for the created_at field.
+	requestcapturelog.DefaultCreatedAt = requestcapturelogDescCreatedAt.Default.(func() time.Time)
 	securitysecretMixin := schema.SecuritySecret{}.Mixin()
 	securitysecretMixinFields0 := securitysecretMixin[0].Fields()
 	_ = securitysecretMixinFields0

backend/ent/schema/api_key.go

@@ -115,6 +115,11 @@ func (APIKey) Fields() []ent.Field {
 			Optional().
 			Nillable().
 			Comment("Start time of the current 7d rate limit window"),
+
+		// ========== Request capture ==========
+		field.Bool("capture_requests").
+			Default(false).
+			Comment("是否对该 API Key 的请求体进行存储捕获"),
 	}
 }
 

backend/ent/schema/request_capture_log.go

+package schema
+
+import (
+	"time"
+
+	"entgo.io/ent"
+	"entgo.io/ent/dialect"
+	"entgo.io/ent/dialect/entsql"
+	"entgo.io/ent/schema"
+	"entgo.io/ent/schema/field"
+	"entgo.io/ent/schema/index"
+)
+
+// RequestCaptureLog 记录指定 API Key 的请求体，用于审计和分析。
+// 只追加，不支持更新/删除（同 PaymentAuditLog 模式）。
+type RequestCaptureLog struct {
+	ent.Schema
+}
+
+func (RequestCaptureLog) Annotations() []schema.Annotation {
+	return []schema.Annotation{
+		entsql.Annotation{Table: "request_capture_logs"},
+	}
+}
+
+func (RequestCaptureLog) Fields() []ent.Field {
+	return []ent.Field{
+		field.Int64("api_key_id"),
+		field.Int64("user_id"),
+		field.String("request_id").
+			MaxLen(64).
+			Optional().
+			Nillable(),
+		field.String("path").
+			MaxLen(100).
+			Optional().
+			Nillable(),
+		field.String("method").
+			MaxLen(10).
+			Optional().
+			Nillable(),
+		field.String("ip_address").
+			MaxLen(45).
+			Optional().
+			Nillable(),
+		// request_body 存原始 JSON 文本，不加索引，避免影响查询计划
+		field.Text("request_body").
+			Optional().
+			Nillable(),
+		// response_body 存响应文本（非 streaming 为完整 JSON，streaming 为拼接的 assistant text）
+		field.Text("response_body").
+			Optional().
+			Nillable(),
+		// nfs_file_path NFS 文件路径快照，方便核查
+		field.String("nfs_file_path").
+			MaxLen(500).
+			Optional().
+			Nillable(),
+		field.Time("created_at").
+			Default(time.Now).
+			Immutable().
+			SchemaType(map[string]string{dialect.Postgres: "timestamptz"}),
+	}
+}
+
+func (RequestCaptureLog) Edges() []ent.Edge {
+	return nil
+}
+
+func (RequestCaptureLog) Indexes() []ent.Index {
+	return []ent.Index{
+		index.Fields("api_key_id", "created_at"),
+		index.Fields("user_id"),
+	}
+}

backend/ent/tx.go

@@ -60,6 +60,8 @@ type Tx struct {
 	Proxy *ProxyClient
 	// RedeemCode is the client for interacting with the RedeemCode builders.
 	RedeemCode *RedeemCodeClient
+	// RequestCaptureLog is the client for interacting with the RequestCaptureLog builders.
+	RequestCaptureLog *RequestCaptureLogClient
 	// SecuritySecret is the client for interacting with the SecuritySecret builders.
 	SecuritySecret *SecuritySecretClient
 	// Setting is the client for interacting with the Setting builders.
@@ -236,6 +238,7 @@ func (tx *Tx) init() {
 	tx.PromoCodeUsage = NewPromoCodeUsageClient(tx.config)
 	tx.Proxy = NewProxyClient(tx.config)
 	tx.RedeemCode = NewRedeemCodeClient(tx.config)
+	tx.RequestCaptureLog = NewRequestCaptureLogClient(tx.config)
 	tx.SecuritySecret = NewSecuritySecretClient(tx.config)
 	tx.Setting = NewSettingClient(tx.config)
 	tx.SubscriptionPlan = NewSubscriptionPlanClient(tx.config)

backend/internal/config/config.go

@@ -89,6 +89,16 @@ type Config struct {
 	Gemini                  GeminiConfig                  `mapstructure:"gemini"`
 	Update                  UpdateConfig                  `mapstructure:"update"`
 	Idempotency             IdempotencyConfig             `mapstructure:"idempotency"`
+	RequestCapture          RequestCaptureConfig          `mapstructure:"request_capture"`
+}
+
+// RequestCaptureConfig 配置请求体捕获功能
+type RequestCaptureConfig struct {
+	// NFSPath 为本地挂载的 NFS 根目录（例如 /mnt/nfs/requests）。
+	// 留空则跳过文件写入，只写数据库。
+	NFSPath string `mapstructure:"nfs_path"`
+	// WorkerTimeoutSeconds 单次异步写入的超时时间（秒），默认 5。
+	WorkerTimeoutSeconds int `mapstructure:"worker_timeout_seconds"`
 }
 
 type LogConfig struct {

backend/internal/handler/admin/admin_service_stub_test.go

@@ -565,6 +565,17 @@ func (s *stubAdminService) AdminUpdateAPIKeyGroupID(ctx context.Context, keyID i
 	return nil, service.ErrAPIKeyNotFound
 }
 
+func (s *stubAdminService) AdminSetCaptureRequests(ctx context.Context, keyID int64, enabled bool) (*service.APIKey, error) {
+	for i := range s.apiKeys {
+		if s.apiKeys[i].ID == keyID {
+			s.apiKeys[i].CaptureRequests = enabled
+			k := s.apiKeys[i]
+			return &k, nil
+		}
+	}
+	return nil, service.ErrAPIKeyNotFound
+}
+
 func (s *stubAdminService) ResetAccountQuota(ctx context.Context, id int64) error {
 	return nil
 }

backend/internal/handler/admin/apikey_handler.go

@@ -10,6 +10,11 @@ import (
 	"github.com/gin-gonic/gin"
 )
 
+// AdminSetCaptureRequestsRequest 请求体：设置/清除 capture_requests
+type AdminSetCaptureRequestsRequest struct {
+	Enabled bool `json:"enabled"`
+}
+
 // AdminAPIKeyHandler handles admin API key management
 type AdminAPIKeyHandler struct {
 	adminService service.AdminService
@@ -27,6 +32,33 @@ type AdminUpdateAPIKeyGroupRequest struct {
 	GroupID *int64 `json:"group_id"` // nil=不修改, 0=解绑, >0=绑定到目标分组
 }
 
+// SetCaptureRequests 开启或关闭指定 API Key 的请求体捕获，并立即失效认证缓存。
+// PUT /api/v1/admin/api-keys/:id/capture-requests
+func (h *AdminAPIKeyHandler) SetCaptureRequests(c *gin.Context) {
+	keyID, err := strconv.ParseInt(c.Param("id"), 10, 64)
+	if err != nil {
+		response.BadRequest(c, "Invalid API key ID")
+		return
+	}
+
+	var req AdminSetCaptureRequestsRequest
+	if err := c.ShouldBindJSON(&req); err != nil {
+		response.BadRequest(c, "Invalid request: "+err.Error())
+		return
+	}
+
+	apiKey, err := h.adminService.AdminSetCaptureRequests(c.Request.Context(), keyID, req.Enabled)
+	if err != nil {
+		response.ErrorFrom(c, err)
+		return
+	}
+
+	response.Success(c, gin.H{
+		"id":               apiKey.ID,
+		"capture_requests": apiKey.CaptureRequests,
+	})
+}
+
 // UpdateGroup handles updating an API key's group binding
 // PUT /api/v1/admin/api-keys/:id
 func (h *AdminAPIKeyHandler) UpdateGroup(c *gin.Context) {

backend/internal/pkg/ctxkey/ctxkey.go

@@ -55,4 +55,8 @@ const (
 
 	// ClaudeCodeVersion stores the extracted Claude Code version from User-Agent (e.g. "2.1.22")
 	ClaudeCodeVersion Key = "ctx_claude_code_version"
+
+	// ResponseCaptureBuffer 用于在 streaming 响应中收集 assistant 文本，供 request_capture 功能使用。
+	// 值类型为 *strings.Builder，由 handler 层注入，service 层只负责追加文本。
+	ResponseCaptureBuffer Key = "ctx_response_capture_buffer"
 )

backend/internal/repository/wire.go

@@ -92,6 +92,7 @@ var ProviderSet = wire.NewSet(
 	NewChannelMonitorRepository,
 	NewChannelMonitorRequestTemplateRepository,
 	NewAffiliateRepository,
+	NewRequestCaptureLogRepository,
 
 	// Cache implementations
 	NewGatewayCache,

backend/internal/server/routes/admin.go

@@ -101,6 +101,7 @@ func registerAdminAPIKeyRoutes(admin *gin.RouterGroup, h *handler.Handlers) {
 	apiKeys := admin.Group("/api-keys")
 	{
 		apiKeys.PUT("/:id", h.Admin.APIKey.UpdateGroup)
+		apiKeys.PUT("/:id/capture-requests", h.Admin.APIKey.SetCaptureRequests)
 	}
 }