支持禁止用户输入API Key

app/api/config/route.ts

@@ -8,6 +8,7 @@ const serverConfig = getServerSideConfig();
 // 警告！不要在这里写入任何敏感信息！
 const DANGER_CONFIG = {
   needCode: serverConfig.needCode,
+  disableUserToken: serverConfig.disableUserToken,
 };
 
 declare global {
@@ -17,5 +18,6 @@ declare global {
 export async function POST(req: NextRequest) {
   return NextResponse.json({
     needCode: serverConfig.needCode,
+    disableUserToken: serverConfig.disableUserToken,
   });
 }

app/components/settings.tsx

@@ -215,8 +215,8 @@ export function Settings() {
   }
 
   const accessStore = useAccessStore();
-  const enabledAccessControl = useMemo(
+  const accessControl = useMemo(
-    () => accessStore.enabledAccessControl(),
+    () => accessStore.accessControl(),
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [],
   );
@@ -450,7 +450,7 @@ export function Settings() {
         </List>
 
         <List>
-          {enabledAccessControl ? (
+          {accessControl.needCode ? (
             <SettingItem
               title={Locale.Settings.AccessCode.Title}
               subTitle={Locale.Settings.AccessCode.SubTitle}
@@ -468,6 +468,7 @@ export function Settings() {
             <></>
           )}
 
+          {!accessControl.disableUserToken ? (
             <SettingItem
               title={Locale.Settings.Token.Title}
               subTitle={Locale.Settings.Token.SubTitle}
@@ -481,6 +482,9 @@ export function Settings() {
                 }}
               />
             </SettingItem>
+          ) : (
+            <></>
+          )}
 
           <SettingItem
             title={Locale.Settings.Usage.Title}

app/config/server.ts

@@ -36,6 +36,7 @@ export const getServerSideConfig = () => {
     code: process.env.CODE,
     codes: ACCESS_CODES,
     needCode: ACCESS_CODES.size > 0,
+    disableUserToken: process.env.DISABLE_USER_TOKEN === "true",
     proxyUrl: process.env.PROXY_URL,
     isVercel: !!process.env.VERCEL,
   };

app/requests.ts

@@ -50,11 +50,16 @@ function getHeaders() {
   const accessStore = useAccessStore.getState();
   let headers: Record<string, string> = {};
 
-  if (accessStore.enabledAccessControl()) {
+  const accessControl = accessStore.accessControl();
+  if (accessControl.needCode) {
     headers["access-code"] = accessStore.accessCode;
   }
 
-  if (accessStore.token && accessStore.token.length > 0) {
+  if (
+    !accessControl.disableUserToken &&
+    accessStore.token &&
+    accessStore.token.length > 0
+  ) {
     headers["token"] = accessStore.token;
   }
 

app/store/access.ts

@@ -6,10 +6,14 @@ export interface AccessControlStore {
   token: string;
 
   needCode: boolean;
+  disableUserToken: boolean;
 
   updateToken: (_: string) => void;
   updateCode: (_: string) => void;
-  enabledAccessControl: () => boolean;
+  accessControl: () => {
+    needCode: boolean;
+    disableUserToken: boolean;
+  };
   isAuthorized: () => boolean;
   fetch: () => void;
 }
@@ -24,10 +28,14 @@ export const useAccessStore = create<AccessControlStore>()(
       token: "",
       accessCode: "",
       needCode: true,
-      enabledAccessControl() {
+      disableUserToken: false,
+      accessControl() {
         get().fetch();
 
-        return get().needCode;
+        return {
+          needCode: get().needCode,
+          disableUserToken: get().disableUserToken,
+        };
       },
       updateCode(code: string) {
         set((state) => ({ accessCode: code }));
@@ -37,8 +45,11 @@ export const useAccessStore = create<AccessControlStore>()(
       },
       isAuthorized() {
         // has token or has code or disabled access control
+        const accessControl = get().accessControl();
         return (
-          !!get().token || !!get().accessCode || !get().enabledAccessControl()
+          !accessControl.needCode ||
+          !!get().accessCode ||
+          (!!get().token && !accessControl.disableUserToken)
         );
       },
       fetch() {

middleware.ts

@@ -30,7 +30,7 @@ export function middleware(req: NextRequest) {
   console.log("[User IP] ", getIP(req));
   console.log("[Time] ", new Date().toLocaleString());
 
-  if (serverConfig.needCode && !serverConfig.codes.has(hashedCode) && !token) {
+  if (serverConfig.needCode && !serverConfig.codes.has(hashedCode) && (!token || serverConfig.disableUserToken)) {
     return NextResponse.json(
       {
         error: true,
@@ -44,7 +44,7 @@ export function middleware(req: NextRequest) {
   }
 
   // inject api key
-  if (!token) {
+  if (!token || serverConfig.disableUserToken) {
     const apiKey = serverConfig.apiKey;
     if (apiKey) {
       console.log("[Auth] set system token");