增加github密匙支持

models.py

@@ -64,6 +64,7 @@ class ItemCreate(BaseModel):
     coverUrl: Optional[str] = None
     author: str 
     price: int = 0
+    github_token: Optional[str] = None
 
 class FollowToggle(BaseModel):
     user_id: str
@@ -88,6 +89,7 @@ class ItemUpdate(BaseModel):
     link: Optional[str] = None
     coverUrl: Optional[str] = None
     price: Optional[int] = None
+    github_token: Optional[str] = None
 
 class RechargeRequest(BaseModel):
     account: str

router_items.py

@@ -35,6 +35,10 @@ async def get_items(type: str = "tool", sort: str = "time", limit: int = 50): #
         item["commentsData"] = comments_db.get(item["id"], [])
         item["comments"] = len(item["commentsData"])
         
+        # 🔴 【绝对核心防线】：在下发给前端前，强行在内存中抹除创作者的 Token！
+        # 这样即使资源是公开展示的，普通用户也绝对抓不到源仓库的密钥。
+        item.pop("github_token", None)
+        
     if sort == "likes": filtered_items.sort(key=lambda x: x.get("likes", 0), reverse=True)
     elif sort == "favorites": filtered_items.sort(key=lambda x: x.get("favorites", 0), reverse=True)
     elif sort == "downloads": filtered_items.sort(key=lambda x: x.get("uses", 0), reverse=True)
@@ -105,6 +109,7 @@ async def create_item(item: ItemCreate):
     new_item = {
         "id": f"{item.type}_{int(time.time())}_{uuid.uuid4().hex[:6]}", "type": item.type, "title": item.title, "author": item.author,
         "shortDesc": item.shortDesc, "fullDesc": item.fullDesc, "link": item.link, "coverUrl": item.coverUrl, "price": item.price, 
+        "github_token": item.github_token, # 【新增】保存密钥到云端 JSON
         "likes": 0, "favorites": 0, "comments": 0, "uses": 0, "use_history": {}, "created_at": int(time.time()), "liked_by": [], "favorited_by": []
     }
     items_db.insert(0, new_item)
@@ -130,6 +135,7 @@ async def update_item(item_id: str, update_data: ItemUpdate, author: str):
             if update_data.link is not None: item["link"] = update_data.link
             if update_data.coverUrl is not None: item["coverUrl"] = update_data.coverUrl
             if update_data.price is not None: item["price"] = update_data.price
+            if update_data.github_token is not None: item["github_token"] = update_data.github_token # 【新增】允许更新密钥
             
             db.save_data("items.json", items_db)
             return {"status": "success"}

router_proxy.py

@@ -42,14 +42,19 @@ async def proxy_github_zip(req_data: ProxyGithubZipRequest, db: Session = Depend
     # GitHub 官方提供的打包下载 API
     github_zip_api = f"https://api.github.com/repos/{owner}/{repo}/zipball/main"
     
-    # 获取云端私密环境变量中的 GitHub Token
-    github_token = os.environ.get("GITHUB_PAT") 
+    # 【核心修改】：优先读取该资源在数据库中绑定的专属创作者 Token
+    creator_token = item.get("github_token")
+    # 如果没填，尝试使用官方全局兜底的 PAT
+    fallback_token = os.environ.get("GITHUB_PAT") 
+    
+    active_token = creator_token if creator_token else fallback_token
+
     headers = {
         "Accept": "application/vnd.github.v3+json",
         "User-Agent": "ComfyUI-Ranking-SaaS"
     }
-    if github_token:
-        headers["Authorization"] = f"Bearer {github_token}"
+    if active_token:
+        headers["Authorization"] = f"Bearer {active_token}"
 
     # 3. 异步请求 GitHub API 并以流形式透传回客户端 (防内存打爆)
     async def stream_generator():