Separate the admin account from inference API keys

.env.example

@@ -36,13 +36,18 @@ CODEBUDDY2API_AUTH_PATH=./auth
 # 导入目录默认是数据目录下的 imports/；Compose 中请使用容器内路径。
 # CODEBUDDY_IMPORT_DIR=./auth/imports
 
-# Empty locks management; set a random key before exposing inference beyond loopback.
-# 留空即锁定管理；对外暴露推理端口前请设置随机密钥。
-# Native: omit/comment the variable to use the saved default key (first local start displays it once).
-# 原生：省略或注释该变量会使用已保存的默认 key（首次本地启动会显示一次）。
+# Optional external admin inference key; also the initial WebUI password until changed.
+# Empty means no external key, not locked management. It never grants /admin access.
+# 可选的外部管理推理密钥，也是修改密码前的初始 WebUI 密码。
+# 留空表示未设置外部密钥，不会锁定管理；任何 API key 都不能访问 /admin。
+# Without it, startup prints the initial admin password and no inference key is created.
+# 未设置时启动会输出初始管理密码，不会自动创建推理密钥。
 CODEBUDDY2API_KEY=
 # Opt-in for headless/non-loopback no-auth runs; the image and Compose already force it on.
-# 原生后台或非回环免鉴权运行选项；镜像与 Compose 已固定开启。
+# WARNING: with no external or database keys, this anonymously exposes inference AND
+# account-pool billing, with or without a placeholder token. Any key row disables it.
+# 警告：没有任何外部或数据库密钥时，无论是否携带占位 token，都会匿名开放推理及
+# 账号池额度与用量（billing）；只要存在任意密钥记录（含停用或过期），此开关即失效。
 # CODEBUDDY2API_ALLOW_OPEN_NOAUTH=false
 
 # Disabling CSRF checks does not disable authentication; use only on trusted local networks.
@@ -68,6 +73,8 @@ CODEBUDDY2API_ADMIN_CSRF=true
 # Scheduled backups of control.sqlite3 into backups/ (never credentials); only scheduled ones are
 # pruned down to the limit. Unset leaves them configurable under Storage; explicit values lock them.
 # 定时把 control.sqlite3 备份到 backups/（不含凭证），只清理超出上限的自动备份。
+# Backups contain standard API keys in plaintext plus admin-key hashes and sessions; keep them private.
+# 备份包含普通 API key 明文、管理密钥哈希和登录会话，必须按敏感数据保管。
 # 不设置时可在「存储管理」修改；显式设置会锁定。
 # CODEBUDDY2API_BACKUP_AUTO=true
 # CODEBUDDY2API_BACKUP_INTERVAL_HOURS=24

AGENTS.md

@@ -11,7 +11,7 @@ codebuddy2api is a personal gateway that exposes a WorkBuddy / CodeBuddy (Tencen
 The backend is a uv project with `package = false`, so it runs from source without being installed. Install dependencies with `uv sync --locked`, or `pip install --require-hashes -r requirements.txt`.
 
 ```bash
-uv run --locked --no-build converter.py             # serve on 127.0.0.1:8787 (subcommands: serve | login | config migrate|status)
+uv run --locked --no-build converter.py             # serve on 127.0.0.1:8787 (subcommands: serve | login | config migrate|status | admin reset-password)
 uv run --locked --no-build python -B -m preview     # real gateway + simulated upstream + synthetic accounts on :8790, key "preview"
 uv run python -B tests/test_routing_scheduler.py    # one test file (each file is a standalone unittest script)
 uv run python -B tests/test_version.py VersionTests.test_matching_tag   # one test case

README.md

@@ -10,7 +10,7 @@ Use your **WorkBuddy / CodeBuddy (Tencent)** subscription as local **OpenAI- and
 - Automatic multi-account routing across domestic and international sites, with credential refresh.
 - Per-account automation: domestic personal accounts check in and dispatch Buddy travel by default, with independent switches; international check-in is opt-in. The growth center is personal-only: finished tasks are claimed automatically, with per-task switches for behavior chains; enterprise accounts are excluded.
 
-**Live preview:** [codebuddy2api.elaina-love.com](https://codebuddy2api.elaina-love.com/dashboard), key `preview`. It runs the WebUI and APIs against a simulated upstream with synthetic accounts, holds no real credentials and resets every 6 hours; credential import and export, settings changes and log clearing are disabled there. See [Development preview](docs/development.md) to run it locally.
+**Live preview:** [codebuddy2api.elaina-love.com](https://codebuddy2api.elaina-love.com/dashboard). Sign in as `admin` with password `preview`; the inference key is also `preview`. It runs the WebUI and APIs against a simulated upstream with synthetic accounts, holds no real credentials and resets every 6 hours; credential import and export, settings changes and log clearing are disabled there. See [Development preview](docs/development.md) to run it locally.
 
 ## Quick start
 
@@ -22,7 +22,7 @@ cd codebuddy2api
 cp .env.example .env
 ```
 
-Edit `.env`: set `CODEBUDDY2API_KEY` to your own random key. Compose loads the whole file into the container, so every key applies and unknown keys are harmless. Preserve an existing `.env` on upgrades.
+Edit `.env`: set `CODEBUDDY2API_KEY` to your own random key. It is the external admin inference key and the initial WebUI password until you change the password. Compose loads the whole file into the container, so every key applies and unknown keys are harmless. Preserve an existing `.env` on upgrades.
 
 ```bash
 docker compose pull
@@ -33,9 +33,10 @@ Compose pulls `latest` by default (`CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/cod
 
 First use:
 
-1. Open **http://127.0.0.1:8787/dashboard** and sign in with your API key.
+1. Open **http://127.0.0.1:8787/dashboard** and sign in as `admin` with your `CODEBUDDY2API_KEY` password.
 2. In **Credentials**, add a domestic or international account through browser login, import an `.info` file, or paste refresh tokens for a chosen endpoint.
-3. In **Models**, find an available model and use its public ID in your client.
+3. In **Keys**, create an inference key for each client and assign its model, IP, expiry and rate limits.
+4. In **Models**, find an available model and use its public ID in your client.
 
 The template binds to localhost only. Configure HTTPS and restrict network access before allowing remote connections; keep and securely back up the `auth/` data directory. To run current source or log in from a terminal instead, see the [deployment guide](docs/deployment.md).
 
@@ -51,7 +52,7 @@ The template binds to localhost only. Configure HTTPS and restrict network acces
 
 - Media generation is billed per upstream credit and only routes to verified account products; see [Media generation](docs/clients.md#media-generation).
 
-- **API key:** the same key used to sign in to the WebUI.
+- **API key:** use a key created in **Keys**, or the externally configured admin key. The WebUI management Cookie cannot call `/v1/*`.
 - **Model:** a public ID from the WebUI or `GET /v1/models`.
 - All accounts share these URLs; no region parameter is needed. Anthropic SDKs append `/v1/messages` themselves, so leave it out of the Base URL.
 - The search and fetch endpoints never call a model. Declaring Anthropic `web_search_*` / `web_fetch_*` or OpenAI `web_search` server tools makes the gateway execute them itself. See [Web search and fetch](docs/clients.md#web-search-and-fetch).
@@ -90,7 +91,7 @@ The template binds to localhost only. Configure HTTPS and restrict network acces
 ## FAQ
 
 - **WebUI sign-in fails behind an HTTPS domain/reverse proxy?** Trust your public origin via `admin_allowed_origins` — see [Management Origin checks](docs/advanced.md#management-origin--csrf-switch).
-- **No Docker?** After installing dependencies and the WebUI, run `uv run --locked --no-build converter.py` or `python3 converter.py` without `.env`. First local startup saves a default key and displays it once — see [Local Python setup](docs/deployment.md#local-python-setup).
+- **No Docker?** After installing dependencies and the WebUI, run `uv run --locked --no-build converter.py` or `python3 converter.py` without `.env`. First startup prints the initial admin username and random password; no inference key is created until you add one in **Keys** — see [Local Python setup](docs/deployment.md#local-python-setup).
 - **Where is my data?** Everything lives in `auth/` (or `/data/auth` in Docker): credentials, settings and log databases — see [Data and backups](docs/webui.md#data-and-backups).
 - **Which image tag should I use?** `latest` follows stable releases, `edge` follows main, version tags pin one release — see [Published images](docs/deployment.md#use-published-images).
 - **Responses tool output/arguments compressed or need verbatim passthrough?** Set `responses_projection_mode` (default `balanced`, or `passthrough` to disable projection) and `responses_projection_max_bytes` (default `40000`, `0` disables per-item trimming). Balanced trimming keeps the head/tail and reports original bytes, estimated tokens and total lines; client addresses stay unchanged — see [Responses projection](docs/clients.md#responses-projection) and [details](docs/advanced.md#responses-projection).

README.zh-CN.md

@@ -10,7 +10,7 @@
 - 多账号自动选路，兼容国内／国际站，自动刷新凭证。
 - 按账号配置自动任务：国内个人账号默认签到后派 Buddy 旅行，可分别关闭；国际自动签到默认关闭。成长中心仅面向个人账号：已完成任务自动领取积分与能量，行为链按任务开关执行；企业账号不参与。
 
-**在线预览：**[codebuddy2api.elaina-love.com](https://codebuddy2api.elaina-love.com/dashboard)，密钥 `preview`。它让 WebUI 与各个 API 对接模拟上游和合成账号运行，不含任何真实凭证，每 6 小时重置一次；其中已停用凭证导入导出、修改设置和清空日志。在本地运行见[开发预览](docs/development.zh-CN.md)。
+**在线预览：**[codebuddy2api.elaina-love.com](https://codebuddy2api.elaina-love.com/dashboard)，使用账号 `admin`、密码 `preview` 登录，推理密钥也是 `preview`。它让 WebUI 与各个 API 对接模拟上游和合成账号运行，不含任何真实凭证，每 6 小时重置一次；其中已停用凭证导入导出、修改设置和清空日志。在本地运行见[开发预览](docs/development.zh-CN.md)。
 
 ## 快速开始
 
@@ -22,7 +22,7 @@ cd codebuddy2api
 cp .env.example .env
 ```
 
-编辑 `.env`：将 `CODEBUDDY2API_KEY` 设置为自己的随机密钥。Compose 会把整个文件加载进容器，每个键都会生效，无关的键也无影响。升级时保留已有 `.env`。
+编辑 `.env`：将 `CODEBUDDY2API_KEY` 设置为自己的随机密钥。它是外部管理推理密钥，也是修改密码前的初始 WebUI 密码。Compose 会把整个文件加载进容器，每个键都会生效，无关的键也无影响。升级时保留已有 `.env`。
 
 ```bash
 docker compose pull
@@ -33,9 +33,10 @@ Compose 默认拉取 `latest`（`CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/codebu
 
 首次使用：
 
-1. 打开 **http://127.0.0.1:8787/dashboard**，使用刚设置的 API key 登录。
+1. 打开 **http://127.0.0.1:8787/dashboard**，使用账号 `admin` 和 `CODEBUDDY2API_KEY` 对应的初始密码登录。
 2. 在「凭证管理」扫码添加国内或国际账号，也可导入 `.info` 文件，或按端点粘贴刷新令牌批量导入。
-3. 在「模型路由」查看可用模型，将其对外 ID 填入客户端。
+3. 在「密钥管理」为每个客户端创建推理密钥，按需设置模型、IP、有效期和速率限制。
+4. 在「模型路由」查看可用模型，将其对外 ID 填入客户端。
 
 按模板配置时仅允许本机访问。远程访问前请配置 HTTPS 并限制网络访问；保留并妥善备份 `auth/` 数据目录。如需直接运行源码或在终端登录，见[部署指南](docs/deployment.zh-CN.md)。
 
@@ -51,7 +52,7 @@ Compose 默认拉取 `latest`（`CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/codebu
 
 - 媒体生成按上游积分计费，只路由到已实测验证的账号产品；见[媒体生成](docs/clients.zh-CN.md#媒体生成)。
 
-- **API Key**：与 WebUI 登录使用同一个密钥。
+- **API Key**：使用「密钥管理」创建的密钥，或外部配置的管理密钥；WebUI 管理 Cookie 不能调用 `/v1/*`。
 - **模型**：使用 WebUI 中的对外 ID，或查询 `GET /v1/models`。
 - 国内、国际账号共用这些地址，无需额外的地域参数。Anthropic SDK 会自行追加 `/v1/messages`，不要把它写入 Base URL。
 - 搜索与抓取端点不调用模型。在请求里声明 Anthropic `web_search_*`／`web_fetch_*` 或 OpenAI `web_search` 服务端工具时，网关会自行执行，见[联网搜索与抓取](docs/clients.zh-CN.md#联网搜索与抓取)。
@@ -90,7 +91,7 @@ Compose 默认拉取 `latest`（`CODEBUDDY2API_IMAGE=ghcr.io/maiphucgiang/codebu
 ## 常见问题
 
 - **绑定域名后经 HTTPS 反代无法登录 WebUI？** 将对外来源加入 `admin_allowed_origins` 信任列表——见[管理 Origin 校验](docs/advanced.zh-CN.md#管理-origin--csrf-开关)。
-- **没有 Docker？** 准备依赖和 WebUI 后，直接 `uv run --locked --no-build converter.py` 或 `python3 converter.py`，无需 `.env`；首次本地启动保存默认 key 并仅在终端显示一次——见[本地 Python 运行](docs/deployment.zh-CN.md#本地-python-运行)。
+- **没有 Docker？** 准备依赖和 WebUI 后，直接 `uv run --locked --no-build converter.py` 或 `python3 converter.py`，无需 `.env`；首次启动会输出初始管理账号和随机密码，不会自动创建推理密钥，请登录后在「密钥管理」创建——见[本地 Python 运行](docs/deployment.zh-CN.md#本地-python-运行)。
 - **数据在哪里？** 全部位于 `auth/`（Docker 中为 `/data/auth`）：凭证、设置与日志数据库——见[数据与备份](docs/webui.zh-CN.md#数据与备份)。
 - **镜像标签怎么选？** `latest` 跟随稳定版，`edge` 跟随 main，版本标签固定某一发行版——见[使用已发布镜像](docs/deployment.zh-CN.md#使用已发布镜像)。
 - **Responses 工具输出/参数被压缩或需要完全原样？** 设置 `responses_projection_mode`（默认 `balanced`，设 `passthrough` 可完全关闭投影）及 `responses_projection_max_bytes`（默认 `40000`，`0` 禁用单项裁剪）。balanced 裁剪保留头尾并显示原始 bytes、估算 tokens 与总行数，客户端地址不变——见 [Responses 投影](docs/clients.zh-CN.md#responses-投影)及[详细说明](docs/advanced.zh-CN.md#responses-投影)。