From 6c2a67ecb460970a5abd7dfaa0730537898703a2 Mon Sep 17 00:00:00 2001
From: ymq <ymq@opencomputing.net>
Date: Fri, 18 Sep 2026 14:36:28 +0800
Subject: [PATCH] =?UTF-8?q?feat(secret=5Fvault):=20update=5Fsecret=5Fmeta(?=
 =?UTF-8?q?=E6=94=B9=E6=A0=87=E7=AD=BE/=E5=A4=87=E6=B3=A8,=E4=BB=85?=
 =?UTF-8?q?=E6=9C=AC=E4=BA=BA+=E5=AE=A1=E8=AE=A1;=E5=80=BC=E4=B8=8D?=
 =?UTF-8?q?=E5=8F=AF=E6=94=B9=E8=B5=B0=E5=88=A0=E9=99=A4=E9=87=8D=E5=AD=98?=
 =?UTF-8?q?)=E2=80=94=E2=80=94=E7=AE=A1=E7=90=86=E9=A1=B5=E8=A1=8C?=
 =?UTF-8?q?=E5=86=85=E7=BC=96=E8=BE=91=E7=94=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pipeline_service/secret_vault.py | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pipeline_service/secret_vault.py b/pipeline_service/secret_vault.py
index 26faf77..dacbfca 100644
--- a/pipeline_service/secret_vault.py
+++ b/pipeline_service/secret_vault.py
@@ -604,6 +604,28 @@ async def delete_secret(sor, *, name: str = "", secret_id: str = "",
     return {"ok": True, "message": "已删除 " + row.get("name", "")}
 
 
+async def update_secret_meta(sor, *, name: str, label: str = "", remark: str = "",
+                             org_id: str = "", user_id: str = "", who: str = "") -> Dict:
+    """改标签/备注（**仅本人条目**；值不可改——改值走删除重存，避免指纹/审计歧义）。
+
+    管理页（2026-09-18）用；与 set_secret_status 同款 own_only + _assert_own 双防线。
+    """
+    from .audit import record_audit
+    row = await get_secret_row(sor, name=name, org_id=org_id, user_id=user_id,
+                               own_only=True)
+    if not row or not _assert_own(row, user_id):
+        return {"ok": False, "message": "FAIL: 找不到该敏感信息（或不属于你本人）"}
+    await sor.sqlExe(
+        "UPDATE " + TABLE + " SET label=${l}$, remark=${r}$, updated_at=NOW() WHERE id=${i}$",
+        {"l": label or "", "r": remark or "", "i": row["id"]})
+    try:
+        await record_audit(org_id or user_id or "", TABLE, row["id"], "secret_meta_update",
+                           who=who or user_id or "agent", detail="name=" + name)
+    except Exception:
+        pass
+    return {"ok": True, "message": name + " 元数据已更新"}
+
+
 async def set_secret_status(sor, *, name: str, status: str, org_id: str = "",
                             user_id: str = "", who: str = "") -> Dict:
     """启用/停用（active / disabled）。停用后不再注入执行环境。"""