feat: 新增日志中心、功能优化与代码重构

- 新增 log_datasource.go / log_proxy.go / user_api_token.go 后端控制器
- 新增 log_datasource.go model
- 新增 monitor/log-center.ts API 模块
- 新增 LogCenter 前端组件及页面
- 重构 deployment 相关组件 (HPDA/UpdateImageModal/bundle-yaml 等)
- 新增 ResetPasswordDialog / code-snippet-block / copy-button 等 UI 组件
- 重构多个 k8s 相关组件 (TopologyView/ResourceVisualEditor/PodFileBrowser 等)
- 更新多个 API 和工具函数 (auth.ts/monitor/index.ts/request.ts 等)
- 更新静态资源 (index.html + 新 JS/CSS bundle)
- 删除废弃静态资源文件

backend/middleware/auth.go

@@ -10,6 +10,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 	"github.com/golang-jwt/jwt/v5"
+	"golang.org/x/crypto/bcrypt"
+	"gorm.io/gorm"
 )
 
 // JWTClaims JWT声明
@@ -37,64 +39,97 @@ func GenerateToken(user *model.User, cfg *config.JWTConfig) (string, error) {
 	return token.SignedString([]byte(cfg.Secret))
 }
 
-// JWTAuth JWT认证中间件
-func JWTAuth(cfg *config.JWTConfig) gin.HandlerFunc {
+// JWTAuth JWT / API AccessKey 双模式认证中间件 // Logan.Li
+func JWTAuth(cfg *config.JWTConfig, db *gorm.DB) gin.HandlerFunc {
 	return func(c *gin.Context) {
 		authHeader := c.GetHeader("Authorization")
-		// Also allow token via query param for file downloads
 		if authHeader == "" {
 			if token := c.Query("token"); token != "" {
 				authHeader = "Bearer " + token
 			}
 		}
+		// 兼容 CI/CD 脚本直接传 AccessKey 头 // Logan.Li
 		if authHeader == "" {
-			c.JSON(http.StatusUnauthorized, model.Response{
-				Code:    401,
-				Message: "未提供认证令牌",
-			})
+			if key := c.GetHeader("X-AIOps-Access-Key"); key != "" {
+				authHeader = "Bearer " + key
+			}
+		}
+		if authHeader == "" {
+			c.JSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "未提供认证令牌"})
 			c.Abort()
 			return
 		}
 
 		parts := strings.SplitN(authHeader, " ", 2)
 		if !(len(parts) == 2 && parts[0] == "Bearer") {
-			c.JSON(http.StatusUnauthorized, model.Response{
-				Code:    401,
-				Message: "认证令牌格式错误",
-			})
+			c.JSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "认证令牌格式错误"})
 			c.Abort()
 			return
 		}
 
 		tokenString := parts[1]
-		token, err := jwt.ParseWithClaims(tokenString, &JWTClaims{}, func(token *jwt.Token) (interface{}, error) {
-			return []byte(cfg.Secret), nil
-		})
-
-		if err != nil {
-			c.JSON(http.StatusUnauthorized, model.Response{
-				Code:    401,
-				Message: "无效的认证令牌: " + err.Error(),
-			})
-			c.Abort()
+		if tryJWTAuth(c, cfg, tokenString) || tryAPIKeyAuth(c, db, tokenString) {
+			c.Next()
 			return
 		}
 
-		if claims, ok := token.Claims.(*JWTClaims); ok && token.Valid {
-			c.Set("userID", claims.UserID)
-			c.Set("username", claims.Username)
-			c.Set("isAdmin", claims.IsAdmin)
-			c.Next()
-		} else {
-			c.JSON(http.StatusUnauthorized, model.Response{
-				Code:    401,
-				Message: "无效的认证令牌",
-			})
-			c.Abort()
-		}
+		c.JSON(http.StatusUnauthorized, model.Response{Code: 401, Message: "无效或过期的认证令牌"})
+		c.Abort()
 	}
 }
 
+// tryJWTAuth 尝试 JWT 认证 // Logan.Li
+func tryJWTAuth(c *gin.Context, cfg *config.JWTConfig, tokenString string) bool {
+	token, err := jwt.ParseWithClaims(tokenString, &JWTClaims{}, func(token *jwt.Token) (interface{}, error) {
+		return []byte(cfg.Secret), nil
+	})
+	if err != nil {
+		return false
+	}
+	claims, ok := token.Claims.(*JWTClaims)
+	if !ok || !token.Valid {
+		return false
+	}
+	c.Set("userID", claims.UserID)
+	c.Set("username", claims.Username)
+	c.Set("isAdmin", claims.IsAdmin)
+	c.Set("authType", "jwt")
+	return true
+}
+
+// tryAPIKeyAuth 尝试长期 API 访问密钥（prefix.secret 格式）// Logan.Li
+func tryAPIKeyAuth(c *gin.Context, db *gorm.DB, tokenString string) bool {
+	if db == nil {
+		return false
+	}
+	segs := strings.Split(tokenString, ".")
+	if len(segs) != 2 || segs[0] == "" || segs[1] == "" {
+		return false
+	}
+	prefix := segs[0]
+	var user model.User
+	if err := db.Where("api_access_key_prefix = ? AND status = 1", prefix).First(&user).Error; err != nil {
+		return false
+	}
+	if user.ApiAccessKeyHash == "" {
+		return false
+	}
+	if err := bcrypt.CompareHashAndPassword([]byte(user.ApiAccessKeyHash), []byte(tokenString)); err != nil {
+		return false
+	}
+	// 密钥已过期则拒绝 // Logan.Li
+	if user.ApiAccessKeyExpiresAt != nil && user.ApiAccessKeyExpiresAt.Before(time.Now()) {
+		return false
+	}
+	now := time.Now()
+	_ = db.Model(&model.User{}).Where("id = ?", user.ID).Update("api_access_key_last_used_at", now).Error
+	c.Set("userID", user.ID)
+	c.Set("username", user.Username)
+	c.Set("isAdmin", user.IsAdmin)
+	c.Set("authType", "api_key")
+	return true
+}
+
 // AdminAuth 管理员认证中间件
 func AdminAuth() gin.HandlerFunc {
 	return func(c *gin.Context) {
@@ -136,4 +171,4 @@ func GetIsAdmin(c *gin.Context) bool {
 		return false
 	}
 	return isAdmin.(bool)
-}
+}