AIGateway

type Role string
const (
    RoleOwner    Role = "owner"
    RoleOperator Role = "operator"
    RoleSales    Role = "sales"
    RoleFinance  Role = "finance"
    RoleTech     Role = "tech"
    RoleUser     Role = "user"
)

type TenantType string
const (
    TenantPlatform TenantType = "platform"   // 平台主站
    TenantReseller TenantType = "reseller"   // 代理商
)

// 各租户类型可分配的角色
var AvailableRoles = map[TenantType][]Role{
    TenantPlatform: {RoleOwner, RoleOperator, RoleSales, RoleFinance, RoleTech, RoleUser},
    TenantReseller: {RoleOwner, RoleSales, RoleFinance, RoleUser},
}

func RequireRoles(roles ...Role) gin.HandlerFunc {
    return func(c *gin.Context) {
        userRoles := auth.RolesFromContext(c)
        for _, required := range roles {
            if userRoles.Has(required) {
                c.Next()
                return
            }
        }
        c.AbortWithStatus(403)
    }
}

// 使用示例
r.GET("/api/customers",  RequireRoles(RoleOwner, RoleSales, RoleOperator))
r.POST("/api/pricing",   RequireRoles(RoleOwner, RoleFinance))
r.POST("/api/settle",    RequireRoles(RoleOwner, RoleFinance))
r.GET("/api/channels",   RequireRoles(RoleOwner, RoleTech))  // 仅平台租户有效

func (s *UsageService) ListBySales(ctx context.Context, salesID int64) ([]Usage, error) {
    // 1. 查出该销售名下的客户 ID 列表
    customerIDs := s.bindingRepo.GetCustomerIDs(ctx, salesID)
    // 2. 只查这些客户的用量（数据隔离）
    return s.usageRepo.ListByCustomers(ctx, customerIDs)
}

// TenantScope 所有查询自动带 tenant_id
func DB(ctx context.Context) *gorm.DB {
    tenantID := tenant.FromContext(ctx)
    if tenantID == "" {
        panic("missing tenant_id in context") // 开发阶段直接 panic 暴露问题
    }
    return db.Where("tenant_id = ?", tenantID)
}

// AdminDB 平台管理员跨租户操作（仅 platform_admin 可用）
func AdminDB(ctx context.Context) *gorm.DB {
    if !rbac.IsPlatformAdmin(ctx) {
        panic("AdminDB requires platform_admin role")
    }
    return db
}

CREATE TABLE tenants (
    id          BIGINT PRIMARY KEY AUTO_INCREMENT,
    slug        VARCHAR(64) UNIQUE NOT NULL,      -- 唯一标识 (url-safe)
    name        VARCHAR(128) NOT NULL,             -- 显示名称
    type        VARCHAR(16) DEFAULT 'reseller',    -- platform=平台主站 / reseller=代理商
    domain      VARCHAR(255) UNIQUE,               -- 自定义域名
    parent_id   BIGINT DEFAULT NULL,               -- 上级代理商 (NULL=平台直管)
    logo_url    VARCHAR(512),                      -- 登录页 Logo
    theme_color VARCHAR(7) DEFAULT '#6c8cff',      -- 主题色
    config      JSON,                              -- 功能开关等配置
    status      TINYINT DEFAULT 1,                 -- 1=active 0=disabled
    created_at  DATETIME DEFAULT CURRENT_TIMESTAMP,
    updated_at  DATETIME DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
    INDEX idx_parent (parent_id),
    INDEX idx_domain (domain)
);

CREATE TABLE users (
    id          BIGINT PRIMARY KEY AUTO_INCREMENT,
    tenant_id   BIGINT NOT NULL,
    username    VARCHAR(64) NOT NULL,
    email       VARCHAR(255),
    phone       VARCHAR(20),
    password    VARCHAR(255),                      -- bcrypt hash
    status      TINYINT DEFAULT 1,
    created_at  DATETIME DEFAULT CURRENT_TIMESTAMP,
    UNIQUE KEY uk_tenant_user (tenant_id, username),
    INDEX idx_tenant (tenant_id)
);

CREATE TABLE user_roles (
    user_id     BIGINT NOT NULL,
    tenant_id   BIGINT NOT NULL,
    role        VARCHAR(32) NOT NULL,              -- owner/operator/sales/finance/tech/user
    created_at  DATETIME DEFAULT CURRENT_TIMESTAMP,
    PRIMARY KEY (user_id, tenant_id, role),
    INDEX idx_tenant (tenant_id)
);

CREATE TABLE customer_bindings (
    id          BIGINT PRIMARY KEY AUTO_INCREMENT,
    tenant_id   BIGINT NOT NULL,
    customer_id BIGINT NOT NULL,                   -- 终端用户 ID
    sales_id    BIGINT NOT NULL,                   -- 所属销售
    created_at  DATETIME DEFAULT CURRENT_TIMESTAMP,
    UNIQUE KEY uk_customer (tenant_id, customer_id),
    INDEX idx_sales (tenant_id, sales_id)
);
-- 销售查用量时，只能看到自己名下客户的数据

CREATE TABLE channels (
    id              BIGINT PRIMARY KEY AUTO_INCREMENT,
    name            VARCHAR(128) NOT NULL,             -- "OpenAI 主力", "Claude 备用"
    provider        VARCHAR(32) NOT NULL,              -- openai / claude / gemini / ...
    api_key_enc     VARBINARY(1024) NOT NULL,          -- AES 加密存储
    base_url        VARCHAR(512),                      -- 自定义 endpoint
    models          JSON NOT NULL,                     -- ["gpt-4o","gpt-4o-mini",...]
    priority        INT DEFAULT 0,                     -- 越大越优先
    weight          INT DEFAULT 100,                   -- 负载均衡权重
    status          TINYINT DEFAULT 1,
    max_retry       INT DEFAULT 2,
    created_at      DATETIME DEFAULT CURRENT_TIMESTAMP
    -- 注意：无 tenant_id，渠道是平台级资源
);

CREATE TABLE tokens (
    id              BIGINT PRIMARY KEY AUTO_INCREMENT,
    tenant_id       BIGINT NOT NULL,
    user_id         BIGINT NOT NULL,
    name            VARCHAR(64),                       -- "生产环境 Key"
    key_hash        VARCHAR(64) NOT NULL UNIQUE,       -- SHA256(sk-xxx)，只存 hash
    key_prefix      VARCHAR(12) NOT NULL,              -- "sk-abc1" 用于展示
    models          JSON,                              -- 允许的模型列表，NULL=全部
    quota           BIGINT DEFAULT -1,                 -- 总额度(token数)，-1=不限
    used_quota      BIGINT DEFAULT 0,
    rate_limit      INT DEFAULT 60,                    -- RPM
    expires_at      DATETIME,
    status          TINYINT DEFAULT 1,
    created_at      DATETIME DEFAULT CURRENT_TIMESTAMP,
    INDEX idx_tenant (tenant_id),
    INDEX idx_hash (key_hash)
);

CREATE TABLE pricing (
    id              BIGINT PRIMARY KEY AUTO_INCREMENT,
    tenant_id       BIGINT DEFAULT 0,                  -- 0=平台默认价，其他=租户自定义
    model           VARCHAR(64) NOT NULL,              -- "gpt-4o"
    input_price     DECIMAL(12,6) NOT NULL,            -- 每百万 input token 价格
    output_price    DECIMAL(12,6) NOT NULL,             -- 每百万 output token 价格
    currency        VARCHAR(3) DEFAULT 'CNY',
    UNIQUE KEY uk_tenant_model (tenant_id, model)
);

CREATE TABLE usage_logs (
    id              UUID DEFAULT generateUUIDv4(),
    trace_id        String,
    tenant_id       UInt64,
    user_id         UInt64,
    token_id        UInt64,
    channel_id      UInt64,
    model           String,
    prompt_tokens   UInt32,
    completion_tokens UInt32,
    total_tokens    UInt32,
    cost            Decimal(12,6),                     -- 向用户收费
    upstream_cost   Decimal(12,6),                     -- 上游成本
    latency_ms      UInt32,
    status          String,                            -- success / error
    error_msg       String DEFAULT '',
    created_at      DateTime DEFAULT now()
) ENGINE = MergeTree()
ORDER BY (tenant_id, created_at)
PARTITION BY toYYYYMM(created_at)
TTL created_at + INTERVAL 6 MONTH;

{
  "ts": "2026-03-18T10:00:00.123Z",
  "level": "info",
  "svc": "billing",
  "trace_id": "a1b2c3d4e5f6",
  "tenant_id": "t_001",
  "user_id": "u_456",
  "action": "quota.deduct",
  "model": "gpt-4o",
  "tokens": 230,
  "cost": 0.0046,
  "remaining_quota": 987654,
  "msg": "quota deducted successfully"
}

# 外部流量通过 LoadBalancer Service 进入 Higress
# Higress 按 Host + Path 分发到后端服务

# AI API 请求 —— Higress 自己处理（ai-proxy 插件）
# api.代理商.com/v1/chat/completions → Higress ai-proxy → 上游模型

# 管理 API —— 转发到 Core
# api.代理商.com/api/* → core-svc.aigateway.svc.cluster.local:8081

# 认证 —— 转发到 Auth
# auth.平台.com/* → auth-svc.aigateway.svc.cluster.local:8080

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: higress-gateway
  namespace: higress-system
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: higress-gateway
  minReplicas: 2
  maxReplicas: 20
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 60      # CPU 60% 开始扩
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 70

# 需要配合 KEDA (Kubernetes Event-Driven Autoscaling)
apiVersion: keda.sh/v1alpha1
kind: ScaledObject
metadata:
  name: billing-svc-scaler
  namespace: aigateway
spec:
  scaleTargetRef:
    name: billing-svc
  minReplicaCount: 1
  maxReplicaCount: 10
  triggers:
  - type: kafka
    metadata:
      bootstrapServers: kafka.middleware.svc.cluster.local:9092
      consumerGroup: billing-consumer
      topic: usage.events
      lagThreshold: "1000"          # lag > 1000 开始扩

# 1. 新机器上执行 (加入集群)
kubeadm join <master-ip>:6443 --token <token> --discovery-token-ca-cert-hash sha256:<hash>

# 2. Master 上打标签 (指定节点池)
kubectl label node new-node-1 node-pool=gateway        # 网关池
# 或
kubectl label node new-node-1 node-pool=app             # 业务池
# 或
kubectl label node new-node-1 node-pool=database        # 数据库池

# 3. 如果是数据库池，加 taint 防止业务 Pod 调度上来
kubectl taint nodes new-node-1 dedicated=database:NoSchedule

# 4. 完事。HPA 会自动利用新节点的资源扩展 Pod

name: CI/CD
on:
  push:
    branches: [main]
    tags: ['v*']

jobs:
  lint-test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with: { go-version: '1.22' }
      - run: golangci-lint run ./...
      - run: go test ./... -race -coverprofile=coverage.out

  build-push:
    needs: lint-test
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [auth, core, billing, syncer]
    steps:
      - uses: actions/checkout@v4
      - uses: docker/build-push-action@v5
        with:
          file: deploy/docker/Dockerfile.${{ matrix.service }}
          tags: harbor.内部域名/aigateway/${{ matrix.service }}:${{ github.ref_name }}
          push: true

  # Wasm 插件单独构建
  build-wasm:
    needs: lint-test
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-go@v5
        with: { go-version: '1.24' }
      - run: |
          cd plugin/usage-reporter
          GOOS=wasip1 GOARCH=wasm go build -o main.wasm
      - run: |   # 打成 OCI 镜像推到 Harbor
          docker build -t harbor.内部域名/aigateway/usage-reporter:${{ github.ref_name }} plugin/usage-reporter
          docker push harbor.内部域名/aigateway/usage-reporter:${{ github.ref_name }}

aigateway/
├── api/
│   ├── proto/                        # gRPC 接口定义
│   │   ├── auth/auth.proto
│   │   ├── core/core.proto
│   │   ├── billing/billing.proto
│   │   └── common/common.proto
│   └── openapi/gateway.yaml          # REST API 定义
│
├── cmd/                              # 服务入口 (每个服务一个 main.go)
│   ├── auth/main.go
│   ├── core/main.go
│   ├── billing/main.go
│   └── syncer/main.go
│
├── internal/
│   ├── auth/                         # 认证服务
│   │   ├── server.go                 # gRPC server
│   │   ├── handler/                  # HTTP handler
│   │   ├── service/                  # 业务逻辑 (sso/jwt/rbac)
│   │   └── repo/                     # 数据访问
│   │
│   ├── core/                         # 核心业务
│   │   ├── server.go
│   │   ├── handler/
│   │   ├── service/                  # tenant/reseller/channel/token/model
│   │   └── repo/
│   │
│   ├── billing/                      # 计费服务
│   │   ├── server.go
│   │   ├── consumer/                 # Kafka consumer
│   │   ├── service/                  # metering/quota/pricing/settlement
│   │   └── repo/
│   │
│   ├── syncer/                       # 配置同步
│   │   ├── syncer.go
│   │   ├── consumer/
│   │   ├── higress/                  # Higress API client
│   │   └── reconciler.go
│   │
│   └── pkg/                          # 内部共享包
│       ├── tenant/context.go
│       ├── database/                 # mysql/redis/clickhouse/migrate
│       ├── mq/                      # kafka producer/consumer
│       ├── otel/init.go             # OpenTelemetry 初始化
│       ├── jwt/jwt.go
│       └── config/config.go
│
├── plugin/                           # Higress Wasm 插件 (独立 go.mod)
│   └── usage-reporter/
│       ├── main.go
│       ├── go.mod
│       └── Dockerfile
│
├── web/                              # 前端 (后期)
│   ├── admin/                        # 平台管理后台
│   └── console/                      # 代理商控制台
│
├── deploy/
│   ├── docker/                       # Dockerfile × 4
│   ├── k8s/
│   │   ├── base/                     # Kustomize base (deployment/svc/hpa per service)
│   │   └── overlays/                 # dev / prod 环境差异
│   └── infra/                        # 中间件 yaml (mysql/redis/kafka/clickhouse/o11y)
│
├── scripts/
│   ├── gen-proto.sh
│   └── migrate.sh
│
├── go.mod
├── Makefile
└── .github/workflows/
    ├── ci.yaml
    └── cd.yaml