From acbb93658598beefab08d97892005d79daa39c93 Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Fri, 4 Sep 2026 19:40:29 +0800
Subject: [PATCH] =?UTF-8?q?tmp:=20kb=5Fdiag2=E8=AF=8A=E6=96=ADBearer?=
 =?UTF-8?q?=E8=AE=A4=E8=AF=81=E9=93=BE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 wwwroot/api/kb_diag2.dspy | 48 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 wwwroot/api/kb_diag2.dspy

diff --git a/wwwroot/api/kb_diag2.dspy b/wwwroot/api/kb_diag2.dspy
new file mode 100644
index 0000000..8baed13
--- /dev/null
+++ b/wwwroot/api/kb_diag2.dspy
@@ -0,0 +1,48 @@
+# kb_diag2.dspy - 深挖 Bearer key 401：dapi 查询匹配 + 注册表 + rbac 认证链
+import json as _j
+
+uid = await get_user()
+if not uid:
+    return _j.dumps({"ok": False, "error": "未登录"}, ensure_ascii=False)
+
+out = {}
+try:
+    from pipeline_service.rag_client import resolve_project_owner, get_owner_apikey
+    pid = "d9jE6l8vx-yHO6-_pIWnY"
+    owner, _e = await resolve_project_owner(pid)
+    key, err = await get_owner_apikey(owner)
+    out["key_len"] = len(key or "")
+    out["key_prefix"] = (key or "")[:10]
+
+    dbname = get_module_dbname('pipeline-sdlc')
+    async with DBPools().sqlorContext(dbname) as sor:
+        # 1. 库里 downapikey 存储值
+        recs = await sor.sqlExe(
+            "SELECT id, dappid, apikey FROM downapikey WHERE userid=${u}$", {"u": owner})
+        await sor.sqlExe("COMMIT", {})
+        out["stored"] = [{"id": r.id, "dappid": r.dappid, "enc_len": len(r.apikey or ""),
+                          "enc_prefix": (r.apikey or "")[:10]} for r in (recs or [])]
+
+        # 2. password_encode 对称性：编码明文 key 是否 == 存储值
+        from ahserver.serverenv import get_serverenv
+        enc_fn = get_serverenv('password_encode')
+        encoded = enc_fn(key) if key else ""
+        stored_enc = (recs[0].apikey if recs else "") or ""
+        out["encode_symmetric"] = (encoded == stored_enc)
+        out["encoded_len"] = len(encoded)
+
+        # 3. dapi 的 get_apikey_user 能否查到（传入明文，内部会 encode 再查）
+        from dapi.dapi import get_apikey_user
+        u = await get_apikey_user(sor, key, "127.0.0.1")
+        out["get_apikey_user"] = str(getattr(u, 'id', None)) if u else "NONE"
+
+        # 4. register_auth_method 注册表
+        from rbac import check_perm
+        for an in ('AUTH_METHODS', 'auth_methods', '_auth_methods', 'AUTHS', '_AUTH_METHODS'):
+            if hasattr(check_perm, an):
+                v = getattr(check_perm, an)
+                out["auth_methods_" + an] = list(v.keys()) if isinstance(v, dict) else str(type(v))
+except Exception as e:
+    import traceback
+    out["traceback"] = traceback.format_exc()[-700:]
+return _j.dumps(out, ensure_ascii=False, default=str)