Method handleUserCredentials

internal/serverapi/users.go:466–508

(w http.ResponseWriter, r *http.Request, userID string)

}

func (a *userAPI) handleUserCredentials(w http.ResponseWriter, r *http.Request, userID string) {
	user, err := a.users.GetUser(userID)
	if err != nil {
		writeUserError(w, err)
		return
	}
	switch r.Method {
	case http.MethodGet:
		writeJSON(w, http.StatusOK, map[string]any{
			"uuid":   user.UUID,
			"secret": user.Secret,
		})
	case http.MethodPut:
		var req struct {
			UUID   string `json:"uuid"`
			Secret string `json:"secret"`
		}
		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
			writeJSON(w, http.StatusBadRequest, map[string]any{"error": "invalid json"})
			return
		}
		if req.UUID == "" {
			req.UUID = randomUUID()
		} else if !isValidUUID(req.UUID) {
			writeJSON(w, http.StatusBadRequest, map[string]any{"error": "invalid uuid format"})
			return
		}
		if req.Secret == "" {
			req.Secret = randomToken(16)
		}
		if err := a.users.SetCredentials(userID, req.UUID, req.Secret); err != nil {
			internalError(w, r, err)
			return
		}
		// 重新下发所有相关节点配置
		if err := a.triggerUserApply(userID); err != nil {
			log.Printf("warn: re-apply after credentials change user %s: %v", userID, err)
		}
		writeJSON(w, http.StatusOK, map[string]any{"uuid": req.UUID, "secret": req.Secret})
	default:
		writeMethodNotAllowed(w, http.MethodGet+", "+http.MethodPut)
	}
}

// handleAccessApply 将该节点的完整配置重新下发。
func (a *userAPI) handleAccessApply(w http.ResponseWriter, r *http.Request, userID, ibID string) {