feat: add user token secret management for channels

- Implemented user token secret generation and retrieval in channel service.
- Added ResetUserTokenSecret method to reset the user token secret for channels.
- Updated channel configuration parsing to include user token secret.
- Enhanced WebSocket service to utilize user token secret for external info retrieval.
- Modified dashboard channel edit component to support user token secret display and reset functionality.
- Introduced API endpoint for resetting user token secret.
- Updated IM and SDK configurations to include user token.
- Added tests for user token verification logic.

web/lib/api/admin.ts

@@ -205,6 +205,10 @@ export type UpdateAdminChannelPayload = CreateAdminChannelPayload & {
   id: number
 }
 
+export type ResetChannelUserTokenSecretResult = {
+  userTokenSecret: string
+}
+
 export type AIAgent = {
   id: number
   name: string
@@ -589,6 +593,16 @@ export function updateChannelStatus(id: number, status: number) {
   })
 }
 
+export function resetChannelUserTokenSecret(id: number) {
+  return request<ResetChannelUserTokenSecretResult>(
+    "/api/dashboard/channel/reset_user_token_secret",
+    {
+      method: "POST",
+      body: JSON.stringify({ id }),
+    }
+  )
+}
+
 export function deleteChannel(id: number) {
   return request<void>("/api/dashboard/channel/delete", {
     method: "POST",

web/lib/api/im.ts

@@ -105,6 +105,7 @@ export type ImWidgetConfig = {
   channelId?: string
   channelType?: string
   externalSource?: string
+  userToken?: string
   title?: string
   subtitle?: string
   themeColor?: string
@@ -149,18 +150,23 @@ function getRuntimeImConfig() {
       (widgetConfig.externalSource || OPEN_IM_EXTERNAL_SOURCE).trim() || "web_chat",
     externalId: (widgetConfig.externalId || "").trim(),
     externalName: (widgetConfig.externalName || "").trim(),
+    userToken: (widgetConfig.userToken || "").trim(),
   }
 }
 
 function createImHeaders() {
   const config = getRuntimeImConfig()
   const headers: Record<string, string> = {
-    "X-External-Source": config.externalSource,
-    "X-External-Id": config.externalId || getGuestId(),
     "X-Channel-Id": config.channelId,
   }
-  if (config.externalName) {
-    headers["X-External-Name"] = encodeURIComponent(config.externalName)
+  if (config.userToken) {
+    headers.Authorization = `Bearer ${config.userToken}`
+  } else {
+    headers["X-External-Source"] = config.externalSource
+    headers["X-External-Id"] = config.externalId || getGuestId()
+    if (config.externalName) {
+      headers["X-External-Name"] = encodeURIComponent(config.externalName)
+    }
   }
   return {
     ...headers,
@@ -212,7 +218,7 @@ export function fetchImMessages(
   )
 }
 
-/** 外部身份仅通过 createImHeaders()（X-External-*）传递，无 JSON body */
+/** 外部身份仅通过 createImHeaders()（Authorization 或 X-External-*）传递，无 JSON body */
 export function createOrMatchImConversation() {
   return request<ImConversation>("/api/conversation/create_or_match", {
     ...createRequestOptions({ method: "POST" }),

web/lib/im-realtime.ts

@@ -26,6 +26,12 @@ export function createImRealtimeConnection() {
     (config.externalSource ?? "web_chat").trim() || "web_chat"
   )
   const channelId = encodeURIComponent(config.channelId || "")
+  const userToken = (config.userToken ?? "").trim()
+  if (userToken) {
+    return new WebSocket(
+      `${baseUrl}/api/ws/open?channelId=${channelId}&userToken=${encodeURIComponent(userToken)}`
+    )
+  }
   const externalName = (config.externalName ?? "").trim()
   const nameQuery =
     externalName !== ""

web/lib/kefu-widget-config.ts

@@ -8,6 +8,8 @@ export type KefuWidgetHostConfig = {
   externalId?: string
   /** 访客展示名，随请求以 X-External-Name / WS query externalName 传给后端 */
   externalName?: string
+  /** 业务系统签发的前台用户 JWT */
+  userToken?: string
   title?: string
   subtitle?: string
   position?: "left" | "right"
@@ -52,6 +54,7 @@ export function readKefuWidgetConfig(): KefuWidgetHostConfig {
       undefined,
     externalId: query.get("externalId") ?? undefined,
     externalName: query.get("externalName") ?? undefined,
+    userToken: query.get("userToken") ?? undefined,
     title: query.get("title") ?? undefined,
     subtitle: query.get("subtitle") ?? undefined,
     position: (query.get("position") as "left" | "right" | null) ?? undefined,

web/lib/sdk/cs-ai-agent-sdk.js

@@ -48,6 +48,9 @@
     }
     merged.channelId = String(merged.channelId || "");
     merged.externalSource = String(merged.externalSource || "web_chat");
+    if (merged.userToken) {
+      merged.userToken = String(merged.userToken);
+    }
     return merged;
   }
 
@@ -67,6 +70,7 @@
     if (config.apiBaseUrl) frameUrl.searchParams.set("apiBaseUrl", config.apiBaseUrl);
     if (config.externalSource) frameUrl.searchParams.set("externalSource", config.externalSource);
     if (config.externalName) frameUrl.searchParams.set("externalName", config.externalName);
+    if (config.userToken) frameUrl.searchParams.set("userToken", config.userToken);
     return frameUrl;
   }