From 3f91f38a88004821aaea7646d3118f0f6585130a Mon Sep 17 00:00:00 2001
From: seaHi <me@seahi.me>
Date: Mon, 21 Sep 2026 19:40:58 +0800
Subject: [PATCH] =?UTF-8?q?feat:=20=E5=9C=A8=E5=90=8E=E5=8F=B0=E7=AE=A1?=
 =?UTF-8?q?=E7=90=86=E9=9D=A2=E6=9D=BF=E5=A2=9E=E5=8A=A0=20API=20Token=20?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E4=B8=8E=E7=94=9F=E6=88=90=E5=8A=9F=E8=83=BD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/routes/admin/settings/+page.server.ts | 22 +++++++++
 src/routes/admin/settings/+page.svelte    | 54 +++++++++++++++++++++++
 2 files changed, 76 insertions(+)

diff --git a/src/routes/admin/settings/+page.server.ts b/src/routes/admin/settings/+page.server.ts
index f4d4322..024935a 100644
--- a/src/routes/admin/settings/+page.server.ts
+++ b/src/routes/admin/settings/+page.server.ts
@@ -68,6 +68,28 @@ export const actions: Actions = {
 			return fail(500, { error: '保存站点信息失败' });
 		}
 	},
+	updateApiToken: async ({ request, platform }) => {
+		const db = platform?.env?.DB;
+		if (!db) return fail(500, { error: '数据库未连接' });
+
+		const data = await request.formData();
+		const token = data.get('agent_api_token')?.toString() || '';
+
+		try {
+			await db
+				.prepare(
+					`INSERT INTO settings (key, value, updated_at)
+					 VALUES (?, ?, CURRENT_TIMESTAMP) 
+					 ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = CURRENT_TIMESTAMP`
+				)
+				.bind('agent.api_token', token)
+				.run();
+			return { success: true };
+		} catch (err: unknown) {
+			console.error('Failed to update api token', err);
+			return fail(500, { error: '保存 API Token 失败' });
+		}
+	},
 	updateAliases: async ({ request, platform }) => {
 		const db = platform?.env?.DB;
 		if (!db) return fail(500, { error: '数据库未连接' });
diff --git a/src/routes/admin/settings/+page.svelte b/src/routes/admin/settings/+page.svelte
index 5d2424e..74cb473 100644
--- a/src/routes/admin/settings/+page.svelte
+++ b/src/routes/admin/settings/+page.svelte
@@ -16,6 +16,17 @@
 	let avatarEnabled = $state(initialData.settings['site.avatar_enabled'] !== 'false');
 	let avatarUrl = $state(initialData.settings['site.avatar_url'] || '');
 
+	let apiToken = $state(initialData.settings['agent.api_token'] || '');
+	let showApiToken = $state(false);
+
+	function generateApiToken() {
+		const randomPart = Array.from(crypto.getRandomValues(new Uint8Array(16)))
+			.map((b) => b.toString(16).padStart(2, '0'))
+			.join('');
+		apiToken = 'bf_agent_' + randomPart;
+		showApiToken = true;
+	}
+
 	$effect(() => {
 		if (form?.success) {
 			addToast('设置保存成功！', 'success');
@@ -131,6 +142,49 @@
 				<span class="value">Cloudflare Access (Zero Trust)</span>
 			</div>
 		</div>
+
+		<div class="settings-card full-width">
+			<h3>API 与 AI 集成 (Agent/MCP)</h3>
+			<p class="desc">
+				配置允许 AI 或第三方工具直接管理文章的 API 访问令牌 (Token)。请求 API 时请在 HTTP Header
+				中添加 <code>Authorization: Bearer &lt;Token&gt;</code>。
+			</p>
+
+			<form
+				method="POST"
+				action="?/updateApiToken"
+				use:enhance={() => {
+					return async ({ update }) => {
+						update({ reset: false });
+					};
+				}}
+				class="alias-form"
+			>
+				<div class="form-group">
+					<label for="agent_api_token">API Token</label>
+					<div style="display: flex; gap: 10px; align-items: center; width: 100%;">
+						<TextInput
+							type={showApiToken ? 'text' : 'password'}
+							id="agent_api_token"
+							name="agent_api_token"
+							bind:value={apiToken}
+							placeholder="留空则禁用对外 API 访问"
+						/>
+						<Button
+							type="button"
+							variant="secondary"
+							onclick={() => (showApiToken = !showApiToken)}
+						>
+							{showApiToken ? '隐藏' : '显示'}
+						</Button>
+						<Button type="button" variant="secondary" onclick={generateApiToken}>自动生成</Button>
+					</div>
+				</div>
+				<div class="form-actions">
+					<Button type="submit" variant="primary">保存 Token</Button>
+				</div>
+			</form>
+		</div>
 	{/if}
 
 	{#if activeTab === 'appearance'}