feat: add user token secret management for channels

- Implemented user token secret generation and retrieval in channel service.
- Added ResetUserTokenSecret method to reset the user token secret for channels.
- Updated channel configuration parsing to include user token secret.
- Enhanced WebSocket service to utilize user token secret for external info retrieval.
- Modified dashboard channel edit component to support user token secret display and reset functionality.
- Introduced API endpoint for resetting user token secret.
- Updated IM and SDK configurations to include user token.
- Added tests for user token verification logic.

go.mod

@@ -6,6 +6,7 @@ require (
 	github.com/aliyun/aliyun-oss-go-sdk v3.0.2+incompatible
 	github.com/cloudwego/eino v0.8.7
 	github.com/glebarez/sqlite v1.11.0
+	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/gomarkdown/markdown v0.0.0-20240328165702-4d01890c35c0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/websocket v1.5.1

go.sum

@@ -116,8 +116,8 @@ github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6Wezm
 github.com/gobwas/ws v1.3.2 h1:zlnbNHxumkRvfPWgfXu8RBwyNR1x8wh9cf5PTOCqs9Q=
 github.com/gobwas/ws v1.3.2/go.mod h1:hRKAFb8wOxFROYNsT1bqfWnhX+b5MFeJM9r2ZSwg/KY=
 github.com/gofrs/uuid v3.2.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
-github.com/golang-jwt/jwt/v5 v5.3.0 h1:pv4AsKCKKZuqlgs5sUmn4x8UlGa0kEVt/puTpKx9vvo=
-github.com/golang-jwt/jwt/v5 v5.3.0/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
+github.com/golang-jwt/jwt/v5 v5.3.1 h1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=
+github.com/golang-jwt/jwt/v5 v5.3.1/go.mod h1:fxCRLWMO43lRc8nhHWY6LGqRcf+1gQWArsqaEUEa5bE=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
 github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
 github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=

internal/controllers/dashboard/channel_controller.go

@@ -102,6 +102,22 @@ func (c *ChannelController) PostUpdate_status() *web.JsonResult {
 	return web.JsonSuccess()
 }
 
+func (c *ChannelController) PostReset_user_token_secret() *web.JsonResult {
+	operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionChannelUpdate)
+	if err != nil {
+		return web.JsonError(err)
+	}
+	req := request.ResetChannelUserTokenSecretRequest{}
+	if err := params.ReadJSON(c.Ctx, &req); err != nil {
+		return web.JsonError(err)
+	}
+	secret, err := services.ChannelService.ResetUserTokenSecret(req.ID, operator)
+	if err != nil {
+		return web.JsonError(err)
+	}
+	return web.JsonData(map[string]string{"userTokenSecret": secret})
+}
+
 func (c *ChannelController) PostDelete() *web.JsonResult {
 	operator, err := services.AuthService.RequirePermission(c.Ctx, constants.PermissionChannelDelete)
 	if err != nil {

internal/middleware/chat_middleware.go

@@ -3,13 +3,19 @@ package middleware
 import (
 	"cs-agent/internal/pkg/irisx"
 	"cs-agent/internal/pkg/openidentity"
+	"cs-agent/internal/services"
 
 	"github.com/kataras/iris/v12"
 	"github.com/mlogclub/simple/web"
 )
 
 func ExternalInfoMiddleware(ctx iris.Context) {
-	ext, err := openidentity.GetExternalInfo(ctx)
+	channel := services.ChannelService.GetEnabledChannel(ctx)
+	var userTokenSecret string
+	if channel != nil {
+		userTokenSecret = services.ChannelService.GetUserTokenSecret(channel)
+	}
+	ext, err := openidentity.GetExternalInfoWithUserTokenSecret(ctx, userTokenSecret)
 	if err != nil {
 		ctx.StopExecution()
 		_ = ctx.JSON(web.JsonError(err))

internal/pkg/dto/dto.go

@@ -17,15 +17,17 @@ type WxWorkKFChannelConfig struct {
 }
 
 type WebChannelConfig struct {
-	Title      string `json:"title"`
-	Subtitle   string `json:"subtitle"`
-	ThemeColor string `json:"themeColor"`
-	Position   string `json:"position"`
-	Width      string `json:"width"`
+	Title           string `json:"title"`
+	Subtitle        string `json:"subtitle"`
+	ThemeColor      string `json:"themeColor"`
+	Position        string `json:"position"`
+	Width           string `json:"width"`
+	UserTokenSecret string `json:"userTokenSecret,omitempty"`
 }
 
 type WechatMPChannelConfig struct {
-	Title      string `json:"title"`
-	Subtitle   string `json:"subtitle"`
-	ThemeColor string `json:"themeColor"`
+	Title           string `json:"title"`
+	Subtitle        string `json:"subtitle"`
+	ThemeColor      string `json:"themeColor"`
+	UserTokenSecret string `json:"userTokenSecret,omitempty"`
 }

internal/pkg/dto/request/channel_request.go

@@ -22,3 +22,7 @@ type UpdateChannelStatusRequest struct {
 type DeleteChannelRequest struct {
 	ID int64 `json:"id"`
 }
+
+type ResetChannelUserTokenSecretRequest struct {
+	ID int64 `json:"id"`
+}

internal/pkg/enums/external_identity.go

@@ -27,7 +27,7 @@ func GetExternalSourceLabel(v ExternalSource) string {
 // IsAllowedOpenImExternalSource 开放 IM 入口允许的外部来源（闭集校验）。
 func IsAllowedOpenImExternalSource(s ExternalSource) bool {
 	switch s {
-	case ExternalSourceGuest:
+	case ExternalSourceGuest, ExternalSourceUser:
 		return true
 	default:
 		return false

internal/pkg/openidentity/openidentity.go

@@ -4,9 +4,11 @@ package openidentity
 import (
 	"cs-agent/internal/pkg/enums"
 	"cs-agent/internal/pkg/errorsx"
+	"errors"
 	"net/url"
 	"strings"
 
+	"github.com/golang-jwt/jwt/v5"
 	"github.com/kataras/iris/v12"
 	"github.com/mlogclub/simple/common/strs"
 	"github.com/mlogclub/simple/web/params"
@@ -19,8 +21,36 @@ type ExternalInfo struct {
 	ExternalName   string               `json:"externalName"`
 }
 
+type UserTokenClaims struct {
+	UserID string `json:"userId"`
+	Name   string `json:"name"`
+	Exp    int64  `json:"exp"`
+	Iat    int64  `json:"iat"`
+}
+
+type userTokenJWTClaims struct {
+	UserID string `json:"userId"`
+	Name   string `json:"name"`
+	jwt.RegisteredClaims
+}
+
 // GetExternalInfo 从 Header（X-External-*）或 query（externalSource、externalId、externalName）解析身份。
 func GetExternalInfo(ctx iris.Context) (*ExternalInfo, error) {
+	return GetExternalInfoWithUserTokenSecret(ctx, "")
+}
+
+func GetExternalInfoWithUserTokenSecret(ctx iris.Context, userTokenSecret string) (*ExternalInfo, error) {
+	if userToken := parseUserToken(ctx); userToken != "" {
+		claims, err := VerifyUserToken(userToken, userTokenSecret)
+		if err != nil {
+			return nil, err
+		}
+		return &ExternalInfo{
+			ExternalSource: enums.ExternalSourceUser,
+			ExternalID:     claims.UserID,
+			ExternalName:   claims.Name,
+		}, nil
+	}
 	externalSource, err := parseExternalSource(ctx)
 	if err != nil {
 		return nil, err
@@ -28,6 +58,9 @@ func GetExternalInfo(ctx iris.Context) (*ExternalInfo, error) {
 	if !enums.IsAllowedOpenImExternalSource(externalSource) {
 		return nil, errorsx.InvalidParam("不支持的外部来源")
 	}
+	if externalSource == enums.ExternalSourceUser {
+		return nil, errorsx.Unauthorized("用户身份不能为空")
+	}
 	externalID, err := parseExternalID(ctx)
 	if err != nil {
 		return nil, err
@@ -40,6 +73,71 @@ func GetExternalInfo(ctx iris.Context) (*ExternalInfo, error) {
 	}, nil
 }
 
+func VerifyUserToken(userToken, secret string) (*UserTokenClaims, error) {
+	userToken = strings.TrimSpace(userToken)
+	secret = strings.TrimSpace(secret)
+	if userToken == "" {
+		return nil, errorsx.Unauthorized("用户身份不能为空")
+	}
+	if secret == "" {
+		return nil, errorsx.Unauthorized("用户身份校验未配置")
+	}
+
+	claims := &userTokenJWTClaims{}
+	token, err := jwt.ParseWithClaims(userToken, claims, func(token *jwt.Token) (any, error) {
+		if _, ok := token.Method.(*jwt.SigningMethodHMAC); !ok {
+			return nil, errors.New("unsupported signing method")
+		}
+		return []byte(secret), nil
+	}, jwt.WithExpirationRequired(), jwt.WithValidMethods([]string{
+		jwt.SigningMethodHS256.Alg(),
+		jwt.SigningMethodHS384.Alg(),
+		jwt.SigningMethodHS512.Alg(),
+	}))
+	if err != nil {
+		if errors.Is(err, jwt.ErrTokenExpired) {
+			return nil, errorsx.Unauthorized("用户身份已过期")
+		}
+		return nil, errorsx.Unauthorized("用户身份校验失败")
+	}
+	if token == nil || !token.Valid {
+		return nil, errorsx.Unauthorized("用户身份校验失败")
+	}
+
+	userID := strings.TrimSpace(claims.UserID)
+	name := strings.TrimSpace(claims.Name)
+	if userID == "" {
+		return nil, errorsx.Unauthorized("用户标识不能为空")
+	}
+	if name == "" {
+		return nil, errorsx.Unauthorized("用户名称不能为空")
+	}
+	if claims.ExpiresAt == nil {
+		return nil, errorsx.Unauthorized("用户身份已过期")
+	}
+
+	result := &UserTokenClaims{
+		UserID: userID,
+		Name:   name,
+		Exp:    claims.ExpiresAt.Unix(),
+	}
+	if claims.IssuedAt != nil {
+		result.Iat = claims.IssuedAt.Unix()
+	}
+	return result, nil
+}
+
+func parseUserToken(ctx iris.Context) string {
+	auth := strings.TrimSpace(ctx.GetHeader("Authorization"))
+	if len(auth) > 7 && strings.EqualFold(auth[:7], "Bearer ") {
+		if token := strings.TrimSpace(auth[7:]); token != "" {
+			return token
+		}
+	}
+	userToken, _ := params.Get(ctx, "userToken")
+	return strings.TrimSpace(userToken)
+}
+
 func parseExternalSource(ctx iris.Context) (enums.ExternalSource, error) {
 	externalSource := ctx.GetHeader("X-External-Source")
 	if strs.IsBlank(externalSource) {

internal/pkg/openidentity/openidentity_test.go

@@ -0,0 +1,86 @@
+package openidentity
+
+import (
+	"testing"
+	"time"
+
+	"github.com/golang-jwt/jwt/v5"
+)
+
+func TestVerifyUserTokenOK(t *testing.T) {
+	token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
+		"userId": "u_10001",
+		"name":   "张三",
+		"exp":    time.Now().Add(time.Hour).Unix(),
+	}, "secret")
+
+	claims, err := VerifyUserToken(token, "secret")
+	if err != nil {
+		t.Fatalf("expected token to verify: %v", err)
+	}
+	if claims.UserID != "u_10001" || claims.Name != "张三" {
+		t.Fatalf("unexpected claims: %#v", claims)
+	}
+}
+
+func TestVerifyUserTokenUsesJWTHeaderAlgorithm(t *testing.T) {
+	token := signTestUserToken(t, jwt.SigningMethodHS384, map[string]any{
+		"userId": "u_10001",
+		"name":   "张三",
+		"exp":    time.Now().Add(time.Hour).Unix(),
+	}, "secret")
+
+	claims, err := VerifyUserToken(token, "secret")
+	if err != nil {
+		t.Fatalf("expected HS384 token to verify from JWT header: %v", err)
+	}
+	if claims.UserID != "u_10001" || claims.Name != "张三" {
+		t.Fatalf("unexpected claims: %#v", claims)
+	}
+}
+
+func TestVerifyUserTokenRejectsInvalidSignature(t *testing.T) {
+	token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
+		"userId": "u_10001",
+		"name":   "张三",
+		"exp":    time.Now().Add(time.Hour).Unix(),
+	}, "secret")
+
+	if _, err := VerifyUserToken(token, "other-secret"); err == nil {
+		t.Fatalf("expected invalid signature to fail")
+	}
+}
+
+func TestVerifyUserTokenRejectsExpiredToken(t *testing.T) {
+	token := signTestUserToken(t, jwt.SigningMethodHS256, map[string]any{
+		"userId": "u_10001",
+		"name":   "张三",
+		"exp":    time.Now().Add(-time.Minute).Unix(),
+	}, "secret")
+
+	if _, err := VerifyUserToken(token, "secret"); err == nil {
+		t.Fatalf("expected expired token to fail")
+	}
+}
+
+func TestVerifyUserTokenRequiresUserIDAndName(t *testing.T) {
+	tests := []map[string]any{
+		{"name": "张三", "exp": time.Now().Add(time.Hour).Unix()},
+		{"userId": "u_10001", "exp": time.Now().Add(time.Hour).Unix()},
+	}
+	for _, payload := range tests {
+		token := signTestUserToken(t, jwt.SigningMethodHS256, payload, "secret")
+		if _, err := VerifyUserToken(token, "secret"); err == nil {
+			t.Fatalf("expected payload %#v to fail", payload)
+		}
+	}
+}
+
+func signTestUserToken(t *testing.T, method jwt.SigningMethod, payload map[string]any, secret string) string {
+	t.Helper()
+	token, err := jwt.NewWithClaims(method, jwt.MapClaims(payload)).SignedString([]byte(secret))
+	if err != nil {
+		t.Fatal(err)
+	}
+	return token
+}

internal/services/channel_service.go

@@ -1,6 +1,7 @@
 package services
 
 import (
+	"crypto/rand"
 	"cs-agent/internal/models"
 	"cs-agent/internal/pkg/dto"
 	"cs-agent/internal/pkg/dto/request"
@@ -11,6 +12,7 @@ import (
 	"cs-agent/internal/pkg/utils"
 	"cs-agent/internal/repositories"
 	"cs-agent/internal/wxwork"
+	"encoding/base64"
 	"encoding/json"
 	"strings"
 	"time"
@@ -236,6 +238,7 @@ func (s *channelService) ParseWebChannelConfig(raw string) (*dto.WebChannelConfi
 	if cfg.Width == "" {
 		cfg.Width = "380px"
 	}
+	cfg.UserTokenSecret = strings.TrimSpace(cfg.UserTokenSecret)
 	return cfg, nil
 }
 
@@ -260,9 +263,91 @@ func (s *channelService) ParseWechatMPChannelConfig(raw string) (*dto.WechatMPCh
 	if cfg.ThemeColor == "" {
 		cfg.ThemeColor = "#2563eb"
 	}
+	cfg.UserTokenSecret = strings.TrimSpace(cfg.UserTokenSecret)
 	return cfg, nil
 }
 
+func (s *channelService) GetUserTokenSecret(channel *models.Channel) string {
+	if channel == nil {
+		return ""
+	}
+	switch channel.ChannelType {
+	case enums.ChannelTypeWeb:
+		cfg, err := s.ParseWebChannelConfig(channel.ConfigJSON)
+		if err != nil {
+			return ""
+		}
+		return strings.TrimSpace(cfg.UserTokenSecret)
+	case enums.ChannelTypeWechatMP:
+		cfg, err := s.ParseWechatMPChannelConfig(channel.ConfigJSON)
+		if err != nil {
+			return ""
+		}
+		return strings.TrimSpace(cfg.UserTokenSecret)
+	default:
+		return ""
+	}
+}
+
+func (s *channelService) ResetUserTokenSecret(channelID int64, operator *dto.AuthPrincipal) (string, error) {
+	if operator == nil {
+		return "", errorsx.Unauthorized("未登录或登录已过期")
+	}
+	channel := s.Get(channelID)
+	if channel == nil || channel.Status == enums.StatusDeleted {
+		return "", errorsx.InvalidParam("接入渠道不存在")
+	}
+	if channel.ChannelType != enums.ChannelTypeWeb && channel.ChannelType != enums.ChannelTypeWechatMP {
+		return "", errorsx.InvalidParam("当前渠道不支持用户 JWT Secret")
+	}
+	secret, err := generateUserTokenSecret()
+	if err != nil {
+		return "", err
+	}
+	var configJSON string
+	switch channel.ChannelType {
+	case enums.ChannelTypeWeb:
+		cfg, err := s.ParseWebChannelConfig(channel.ConfigJSON)
+		if err != nil {
+			return "", err
+		}
+		cfg.UserTokenSecret = secret
+		raw, err := json.Marshal(cfg)
+		if err != nil {
+			return "", err
+		}
+		configJSON = string(raw)
+	case enums.ChannelTypeWechatMP:
+		cfg, err := s.ParseWechatMPChannelConfig(channel.ConfigJSON)
+		if err != nil {
+			return "", err
+		}
+		cfg.UserTokenSecret = secret
+		raw, err := json.Marshal(cfg)
+		if err != nil {
+			return "", err
+		}
+		configJSON = string(raw)
+	}
+	if err := repositories.ChannelRepository.Updates(sqls.DB(), channelID, map[string]any{
+		"config_json":      configJSON,
+		"update_user_id":   operator.UserID,
+		"update_user_name": operator.Username,
+		"updated_at":       time.Now(),
+	}); err != nil {
+		return "", err
+	}
+	return secret, nil
+}
+
+func generateUserTokenSecret() (string, error) {
+	buf := make([]byte, 32)
+	if _, err := rand.Read(buf); err != nil {
+		return "", err
+	}
+	return base64.RawURLEncoding.EncodeToString(buf), nil
+}
+
 func (s *channelService) GetEnabledWxWorkKFChannelByOpenKfID(openKfID string) *models.Channel {
 	openKfID = strings.TrimSpace(openKfID)
 	if openKfID == "" {
@@ -341,6 +426,13 @@ func (s *channelService) buildChannelModel(id int64, req request.CreateChannelRe
 		if err != nil {
 			return nil, errorsx.InvalidParam("Web渠道配置不合法")
 		}
+		if strings.TrimSpace(cfg.UserTokenSecret) == "" {
+			secret, err := generateUserTokenSecret()
+			if err != nil {
+				return nil, err
+			}
+			cfg.UserTokenSecret = secret
+		}
 		configBytes, err := json.Marshal(cfg)
 		if err != nil {
 			return nil, err
@@ -357,6 +449,13 @@ func (s *channelService) buildChannelModel(id int64, req request.CreateChannelRe
 		if err != nil {
 			return nil, errorsx.InvalidParam("微信公众号渠道配置不合法")
 		}
+		if strings.TrimSpace(cfg.UserTokenSecret) == "" {
+			secret, err := generateUserTokenSecret()
+			if err != nil {
+				return nil, err
+			}
+			cfg.UserTokenSecret = secret
+		}
 		configBytes, err := json.Marshal(cfg)
 		if err != nil {
 			return nil, err

internal/services/ws_service.go

@@ -66,7 +66,7 @@ func (s *wsService) HandleOpenWS(ctx iris.Context) {
 		external  *openidentity.ExternalInfo
 	)
 	if principal == nil {
-		ext, err := openidentity.GetExternalInfo(ctx)
+		ext, err := openidentity.GetExternalInfoWithUserTokenSecret(ctx, ChannelService.GetUserTokenSecret(channel))
 		if err != nil {
 			_ = ctx.StopWithJSON(iris.StatusUnauthorized, web.JsonError(err))
 			return

web/app/dashboard/channels/_components/edit.tsx

@@ -26,6 +26,7 @@ import {
   fetchAIAgentsAll,
   fetchChannel,
   fetchWxWorkKFAccounts,
+  resetChannelUserTokenSecret,
 } from "@/lib/api/admin"
 
 type ChannelFormDialogProps = {
@@ -53,12 +54,14 @@ type WebChannelConfig = {
   themeColor?: string
   position?: "left" | "right"
   width?: string
+  userTokenSecret?: string
 }
 
 type WechatMPChannelConfig = {
   title?: string
   subtitle?: string
   themeColor?: string
+  userTokenSecret?: string
 }
 
 const defaultWebChannelConfig: Required<WebChannelConfig> = {
@@ -67,6 +70,7 @@ const defaultWebChannelConfig: Required<WebChannelConfig> = {
   themeColor: "#2563eb",
   position: "right",
   width: "380px",
+  userTokenSecret: "",
 }
 
 const schema = z
@@ -80,6 +84,7 @@ const schema = z
     widgetThemeColor: z.string().trim(),
     widgetPosition: z.enum(["left", "right"]),
     widgetWidth: z.string().trim(),
+    userTokenSecret: z.string().trim(),
     remark: z.string().trim(),
   })
   .superRefine((values, ctx) => {
@@ -110,6 +115,7 @@ const emptyForm: EditForm = {
   widgetThemeColor: defaultWebChannelConfig.themeColor,
   widgetPosition: defaultWebChannelConfig.position,
   widgetWidth: defaultWebChannelConfig.width,
+  userTokenSecret: "",
   remark: "",
 }
 
@@ -139,6 +145,7 @@ function parseWebChannelConfig(configJson: string): Required<WebChannelConfig> {
         parsed.themeColor?.trim() || defaultWebChannelConfig.themeColor,
       position,
       width: parsed.width?.trim() || defaultWebChannelConfig.width,
+      userTokenSecret: parsed.userTokenSecret?.trim() || "",
     }
   } catch {
     return defaultWebChannelConfig
@@ -150,6 +157,7 @@ function parseWechatMPChannelConfig(configJson: string): Required<WechatMPChanne
     title: "公众号客服",
     subtitle: defaultWebChannelConfig.subtitle,
     themeColor: defaultWebChannelConfig.themeColor,
+    userTokenSecret: "",
   }
   if (!configJson.trim()) {
     return fallback
@@ -161,6 +169,7 @@ function parseWechatMPChannelConfig(configJson: string): Required<WechatMPChanne
       subtitle: parsed.subtitle?.trim() ?? fallback.subtitle,
       themeColor:
         parsed.themeColor?.trim() || defaultWebChannelConfig.themeColor,
+      userTokenSecret: parsed.userTokenSecret?.trim() || "",
     }
   } catch {
     return fallback
@@ -191,6 +200,7 @@ function buildForm(item: AdminChannel | null): EditForm {
     widgetThemeColor: wechatConfig?.themeColor ?? webConfig.themeColor,
     widgetPosition: webConfig.position,
     widgetWidth: webConfig.width,
+    userTokenSecret: wechatConfig?.userTokenSecret ?? webConfig.userTokenSecret,
     remark: item.remark || "",
   }
 }
@@ -204,6 +214,7 @@ function buildPayload(form: EditForm, status: number): CreateAdminChannelPayload
     subtitle: form.widgetSubtitle.trim(),
     themeColor:
       form.widgetThemeColor.trim() || defaultWebChannelConfig.themeColor,
+    userTokenSecret: form.userTokenSecret.trim(),
   }
   const configJson =
     channelType === "wxwork_kf"
@@ -214,6 +225,7 @@ function buildPayload(form: EditForm, status: number): CreateAdminChannelPayload
             ...webLikeConfig,
             position: form.widgetPosition || defaultWebChannelConfig.position,
             width: form.widgetWidth.trim() || defaultWebChannelConfig.width,
+            userTokenSecret: form.userTokenSecret.trim(),
           })
   return {
     channelType,
@@ -276,10 +288,12 @@ function ChannelFormBody({
     handleSubmit,
     register,
     reset,
+    setValue,
     formState: { errors },
   } = form
   const channelType = useWatch({ control, name: "channelType" })
   const openKfId = useWatch({ control, name: "openKfId" })
+  const userTokenSecret = useWatch({ control, name: "userTokenSecret" })
 
   useEffect(() => {
     async function loadAIAgents() {
@@ -371,6 +385,44 @@ function ChannelFormBody({
     await onSubmit(buildPayload(values, currentStatus))
   }
 
+  async function handleResetUserTokenSecret() {
+    if (!itemId) {
+      return
+    }
+    if (!window.confirm("重置后旧 userToken 将在过期后失效，确认重置？")) {
+      return
+    }
+    try {
+      const result = await resetChannelUserTokenSecret(itemId)
+      setValue("userTokenSecret", result.userTokenSecret, {
+        shouldDirty: true,
+      })
+      if (channelDetail) {
+        const parsed = JSON.parse(channelDetail.configJson || "{}") as Record<string, unknown>
+        parsed.userTokenSecret = result.userTokenSecret
+        setChannelDetail({
+          ...channelDetail,
+          configJson: JSON.stringify(parsed),
+        })
+      }
+      toast.success("已重置用户 JWT Secret")
+    } catch (error) {
+      toast.error(error instanceof Error ? error.message : "重置用户 JWT Secret 失败")
+    }
+  }
+
+  async function copyUserTokenSecret() {
+    if (!userTokenSecret) {
+      return
+    }
+    try {
+      await navigator.clipboard.writeText(userTokenSecret)
+      toast.success("已复制用户 JWT Secret")
+    } catch {
+      toast.error("复制失败")
+    }
+  }
+
   return (
     <ProjectDialog
       open={true}
@@ -558,6 +610,52 @@ function ChannelFormBody({
                     </>
                   ) : null}
                 </div>
+                <div className="space-y-3 rounded-md border p-3">
+                  <div>
+                    <div className="text-sm font-medium">用户 JWT Secret</div>
+                    <div className="text-xs text-muted-foreground">
+                      业务系统使用该 secret 签发 userToken。重置后请同步更新业务系统配置。
+                    </div>
+                  </div>
+                  {!itemId ? (
+                    <div className="rounded-md bg-muted px-3 py-2 text-sm text-muted-foreground">
+                      保存渠道后可生成用户 JWT Secret。
+                    </div>
+                  ) : (
+                    <Field data-invalid={!!errors.userTokenSecret}>
+                      <FieldLabel htmlFor="channel-user-token-secret">Secret</FieldLabel>
+                      <FieldContent>
+                        <div className="flex flex-col gap-2 sm:flex-row">
+                          <Input
+                            id="channel-user-token-secret"
+                            readOnly
+                            className="font-mono text-xs"
+                            {...register("userTokenSecret")}
+                          />
+                          <div className="flex gap-2">
+                            <Button
+                              type="button"
+                              variant="outline"
+                              onClick={copyUserTokenSecret}
+                              disabled={!userTokenSecret}
+                            >
+                              <CopyIcon className="size-4" />
+                              复制
+                            </Button>
+                            <Button
+                              type="button"
+                              variant="outline"
+                              onClick={() => void handleResetUserTokenSecret()}
+                            >
+                              重置
+                            </Button>
+                          </div>
+                        </div>
+                        <FieldError errors={[errors.userTokenSecret]} />
+                      </FieldContent>
+                    </Field>
+                  )}
+                </div>
                 {channelType === "wechat_mp" ? (
                   <WechatMPAccessGuide channelId={channelDetail?.channelId || ""} />
                 ) : (

web/lib/api/admin.ts

@@ -205,6 +205,10 @@ export type UpdateAdminChannelPayload = CreateAdminChannelPayload & {
   id: number
 }
 
+export type ResetChannelUserTokenSecretResult = {
+  userTokenSecret: string
+}
+
 export type AIAgent = {
   id: number
   name: string
@@ -589,6 +593,16 @@ export function updateChannelStatus(id: number, status: number) {
   })
 }
 
+export function resetChannelUserTokenSecret(id: number) {
+  return request<ResetChannelUserTokenSecretResult>(
+    "/api/dashboard/channel/reset_user_token_secret",
+    {
+      method: "POST",
+      body: JSON.stringify({ id }),
+    }
+  )
+}
+
 export function deleteChannel(id: number) {
   return request<void>("/api/dashboard/channel/delete", {
     method: "POST",

web/lib/api/im.ts

@@ -105,6 +105,7 @@ export type ImWidgetConfig = {
   channelId?: string
   channelType?: string
   externalSource?: string
+  userToken?: string
   title?: string
   subtitle?: string
   themeColor?: string
@@ -149,18 +150,23 @@ function getRuntimeImConfig() {
       (widgetConfig.externalSource || OPEN_IM_EXTERNAL_SOURCE).trim() || "web_chat",
     externalId: (widgetConfig.externalId || "").trim(),
     externalName: (widgetConfig.externalName || "").trim(),
+    userToken: (widgetConfig.userToken || "").trim(),
   }
 }
 
 function createImHeaders() {
   const config = getRuntimeImConfig()
   const headers: Record<string, string> = {
-    "X-External-Source": config.externalSource,
-    "X-External-Id": config.externalId || getGuestId(),
     "X-Channel-Id": config.channelId,
   }
-  if (config.externalName) {
-    headers["X-External-Name"] = encodeURIComponent(config.externalName)
+  if (config.userToken) {
+    headers.Authorization = `Bearer ${config.userToken}`
+  } else {
+    headers["X-External-Source"] = config.externalSource
+    headers["X-External-Id"] = config.externalId || getGuestId()
+    if (config.externalName) {
+      headers["X-External-Name"] = encodeURIComponent(config.externalName)
+    }
   }
   return {
     ...headers,
@@ -212,7 +218,7 @@ export function fetchImMessages(
   )
 }
 
-/** 外部身份仅通过 createImHeaders()（X-External-*）传递，无 JSON body */
+/** 外部身份仅通过 createImHeaders()（Authorization 或 X-External-*）传递，无 JSON body */
 export function createOrMatchImConversation() {
   return request<ImConversation>("/api/conversation/create_or_match", {
     ...createRequestOptions({ method: "POST" }),

web/lib/im-realtime.ts

@@ -26,6 +26,12 @@ export function createImRealtimeConnection() {
     (config.externalSource ?? "web_chat").trim() || "web_chat"
   )
   const channelId = encodeURIComponent(config.channelId || "")
+  const userToken = (config.userToken ?? "").trim()
+  if (userToken) {
+    return new WebSocket(
+      `${baseUrl}/api/ws/open?channelId=${channelId}&userToken=${encodeURIComponent(userToken)}`
+    )
+  }
   const externalName = (config.externalName ?? "").trim()
   const nameQuery =
     externalName !== ""

web/lib/kefu-widget-config.ts

@@ -8,6 +8,8 @@ export type KefuWidgetHostConfig = {
   externalId?: string
   /** 访客展示名，随请求以 X-External-Name / WS query externalName 传给后端 */
   externalName?: string
+  /** 业务系统签发的前台用户 JWT */
+  userToken?: string
   title?: string
   subtitle?: string
   position?: "left" | "right"
@@ -52,6 +54,7 @@ export function readKefuWidgetConfig(): KefuWidgetHostConfig {
       undefined,
     externalId: query.get("externalId") ?? undefined,
     externalName: query.get("externalName") ?? undefined,
+    userToken: query.get("userToken") ?? undefined,
     title: query.get("title") ?? undefined,
     subtitle: query.get("subtitle") ?? undefined,
     position: (query.get("position") as "left" | "right" | null) ?? undefined,

web/lib/sdk/cs-ai-agent-sdk.js

@@ -48,6 +48,9 @@
     }
     merged.channelId = String(merged.channelId || "");
     merged.externalSource = String(merged.externalSource || "web_chat");
+    if (merged.userToken) {
+      merged.userToken = String(merged.userToken);
+    }
     return merged;
   }
 
@@ -67,6 +70,7 @@
     if (config.apiBaseUrl) frameUrl.searchParams.set("apiBaseUrl", config.apiBaseUrl);
     if (config.externalSource) frameUrl.searchParams.set("externalSource", config.externalSource);
     if (config.externalName) frameUrl.searchParams.set("externalName", config.externalName);
+    if (config.userToken) frameUrl.searchParams.set("userToken", config.userToken);
     return frameUrl;
   }
 

web/public/sdk/cs-agent-widget.js

@@ -43,6 +43,9 @@
     merged.apiBaseUrl = String(merged.apiBaseUrl || merged.baseUrl).replace(/\/$/, "");
     merged.channelId = String(merged.channelId || "");
     merged.externalSource = String(merged.externalSource || "web_chat");
+    if (merged.userToken) {
+      merged.userToken = String(merged.userToken);
+    }
     return merged;
   }
 
@@ -67,6 +70,7 @@
     if (config.themeColor) frameUrl.searchParams.set("themeColor", config.themeColor);
     if (config.width) frameUrl.searchParams.set("width", config.width);
     if (config.externalName) frameUrl.searchParams.set("externalName", config.externalName);
+    if (config.userToken) frameUrl.searchParams.set("userToken", config.userToken);
     return frameUrl;
   }