feat: 配置版本历史/对比/回滚、国内 IM 通知渠道、阈值告警与 API Token（v1.2.9）

- 配置版本：fsutil 版本化备份（内容相同自动去重），主 nginx.conf 与 VPS vhost 的版本列表/逐行差异/一键回滚，回滚先校验语法与 nginx -t 再写回

- agent 0.12.2：写 vhost 前留版本；nginx -t 校验失败改为恢复上一个可用版本（此前直接删文件），新增域名 vhost 版本端点，双架构二进制已重编

- 通知：补企业微信 / 钉钉 / 飞书机器人，切换预设时服务地址跟随该预设默认值

- 阈值告警：新增 internal/monitor 巡检（CPU/内存/磁盘持续超阈值、隧道连续 N 次未注册），默认关闭，带静默期与恢复通知

- API Token：api_tokens 表 + Authorization Bearer 认证，只读/读写两种范围；令牌管理与改密/退出仅限登录会话

internal/api/frpmulti_handler.go

@@ -398,38 +398,105 @@ func (h *FRPMultiHandler) AgentRoutes(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, details)
 }
 
-// AgentRouteConf 返回指定穿透规则（首个域名）当前反代配置内容。
-func (h *FRPMultiHandler) AgentRouteConf(w http.ResponseWriter, r *http.Request) {
-	id, err := parseID(r.PathValue("id"))
+// agentRouteTarget 解析服务端与规则归属，返回该规则用于公网反代的首个域名。
+// status 非 0 表示校验失败，调用方直接把 status 与 errMsg 写回响应。
+func (h *FRPMultiHandler) agentRouteTarget(r *http.Request, serverIDRaw, proxyIDRaw string) (serverID, proxyID int64, domain string, status int, errMsg string) {
+	serverID, err := parseID(serverIDRaw)
 	if err != nil {
-		writeError(r, w, http.StatusBadRequest, "FRP 服务端 ID 无效")
-		return
+		return 0, 0, "", http.StatusBadRequest, "FRP 服务端 ID 无效"
 	}
-	proxyID, err := parseID(r.PathValue("proxyID"))
+	proxyID, err = parseID(proxyIDRaw)
 	if err != nil {
-		writeError(r, w, http.StatusBadRequest, "FRP 规则 ID 无效")
-		return
+		return 0, 0, "", http.StatusBadRequest, "FRP 规则 ID 无效"
 	}
 	proxy, err := h.svc.GetProxy(r.Context(), proxyID)
-	if err != nil || proxy.ServerID != id {
-		writeError(r, w, http.StatusNotFound, "FRP 规则不存在")
-		return
+	if err != nil || proxy.ServerID != serverID {
+		return 0, 0, "", http.StatusNotFound, "FRP 规则不存在"
 	}
 	if len(proxy.CustomDomains) == 0 {
-		writeError(r, w, http.StatusBadRequest, "该规则没有自定义域名")
+		return 0, 0, "", http.StatusBadRequest, "该规则没有自定义域名"
+	}
+	return serverID, proxyID, proxy.CustomDomains[0], 0, ""
+}
+
+// AgentRouteConf 返回指定穿透规则（首个域名）当前反代配置内容。
+func (h *FRPMultiHandler) AgentRouteConf(w http.ResponseWriter, r *http.Request) {
+	serverID, proxyID, domain, status, msg := h.agentRouteTarget(r, r.PathValue("id"), r.PathValue("proxyID"))
+	if status != 0 {
+		writeError(r, w, status, msg)
 		return
 	}
-	client, ok := h.svc.AgentClient(r.Context(), id)
+	client, ok := h.svc.AgentClient(r.Context(), serverID)
 	if !ok {
 		writeError(r, w, http.StatusBadGateway, "公网 agent 未配置或 Token 未保存")
 		return
 	}
-	content, err := client.RouteConf(r.Context(), proxy.CustomDomains[0])
+	content, err := client.RouteConf(r.Context(), domain)
 	if err != nil {
 		writeError(r, w, http.StatusBadGateway, err.Error())
 		return
 	}
-	writeJSON(w, http.StatusOK, map[string]any{"proxy_id": proxyID, "domain": proxy.CustomDomains[0], "content": content})
+	writeJSON(w, http.StatusOK, map[string]any{"proxy_id": proxyID, "domain": domain, "content": content})
+}
+
+// AgentRouteVersions 返回规则首个域名在 VPS 上的当前 vhost 与历史版本，供差异对比与回滚。
+func (h *FRPMultiHandler) AgentRouteVersions(w http.ResponseWriter, r *http.Request) {
+	serverID, _, domain, status, msg := h.agentRouteTarget(r, r.PathValue("id"), r.PathValue("proxyID"))
+	if status != 0 {
+		writeError(r, w, status, msg)
+		return
+	}
+	client, ok := h.svc.AgentClient(r.Context(), serverID)
+	if !ok {
+		writeError(r, w, http.StatusBadGateway, "公网 agent 未配置或 Token 未保存")
+		return
+	}
+	result, err := client.RouteVersions(r.Context(), domain)
+	if err != nil {
+		writeError(r, w, http.StatusBadGateway, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, result)
+}
+
+// AgentRouteVersion 读取某个历史版本的内容（与当前 vhost 对比用）。
+func (h *FRPMultiHandler) AgentRouteVersion(w http.ResponseWriter, r *http.Request) {
+	serverID, _, domain, status, msg := h.agentRouteTarget(r, r.PathValue("id"), r.PathValue("proxyID"))
+	if status != 0 {
+		writeError(r, w, status, msg)
+		return
+	}
+	client, ok := h.svc.AgentClient(r.Context(), serverID)
+	if !ok {
+		writeError(r, w, http.StatusBadGateway, "公网 agent 未配置或 Token 未保存")
+		return
+	}
+	result, err := client.RouteVersion(r.Context(), domain, r.PathValue("name"))
+	if err != nil {
+		writeError(r, w, http.StatusBadGateway, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, result)
+}
+
+// AgentRollbackRouteVersion 让 VPS 上的 vhost 回退到指定版本（agent 侧校验不过会保持当前配置）。
+func (h *FRPMultiHandler) AgentRollbackRouteVersion(w http.ResponseWriter, r *http.Request) {
+	serverID, _, domain, status, msg := h.agentRouteTarget(r, r.PathValue("id"), r.PathValue("proxyID"))
+	if status != 0 {
+		writeError(r, w, status, msg)
+		return
+	}
+	client, ok := h.svc.AgentClient(r.Context(), serverID)
+	if !ok {
+		writeError(r, w, http.StatusBadGateway, "公网 agent 未配置或 Token 未保存")
+		return
+	}
+	result, err := client.RollbackRouteVersion(r.Context(), domain, r.PathValue("name"))
+	if err != nil {
+		writeError(r, w, http.StatusBadGateway, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, result)
 }
 
 // AgentInstallNginx 触发 VPS 上一键安装 Nginx（需 agent 以 root 运行）。

internal/api/middleware.go

@@ -3,6 +3,7 @@ package api
 import (
 	"context"
 	"net/http"
+	"strings"
 
 	"github.com/fonu/fonu/internal/auth"
 )
@@ -24,9 +25,30 @@ func SessionMiddleware(authSvc *auth.Service) func(http.Handler) http.Handler {
 	}
 }
 
+// RequireAuth 接受两种凭据：浏览器的会话 cookie，以及 Authorization: Bearer <api token>。
+// 令牌分读写两种范围：read 只允许 GET/HEAD，write 与会话同权。
 func RequireAuth(authSvc *auth.Service) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if token := bearerToken(r); token != "" {
+				scope, err := authSvc.ValidateAPIToken(r.Context(), token)
+				if err != nil {
+					writeError(r, w, http.StatusUnauthorized, "API Token 无效或已过期")
+					return
+				}
+				// 账号与令牌管理只允许浏览器会话：否则一个 write 令牌可以自己给自己提权
+				if tokenDeniedPath(r.URL.Path) {
+					writeError(r, w, http.StatusForbidden, "该操作需要使用登录会话")
+					return
+				}
+				if scope != auth.TokenScopeWrite && r.Method != http.MethodGet && r.Method != http.MethodHead {
+					writeError(r, w, http.StatusForbidden, "该 Token 只读，不能执行写操作")
+					return
+				}
+				next.ServeHTTP(w, r)
+				return
+			}
+
 			sessionID, _ := r.Context().Value(sessionContextKey).(string)
 			if err := authSvc.ValidateSession(r.Context(), sessionID); err != nil {
 				writeError(r, w, http.StatusUnauthorized, "未登录或会话已过期")
@@ -37,6 +59,24 @@ func RequireAuth(authSvc *auth.Service) func(http.Handler) http.Handler {
 	}
 }
 
+// bearerToken 取出 Authorization: Bearer 里的明文令牌；没有或格式不对返回空串。
+func bearerToken(r *http.Request) string {
+	header := strings.TrimSpace(r.Header.Get("Authorization"))
+	const prefix = "Bearer "
+	if len(header) <= len(prefix) || !strings.EqualFold(header[:len(prefix)], prefix) {
+		return ""
+	}
+	return strings.TrimSpace(header[len(prefix):])
+}
+
+// tokenDeniedPath 是只允许浏览器会话的路径（账号与令牌管理）。
+func tokenDeniedPath(path string) bool {
+	if path == "/api/auth/password" || path == "/api/auth/logout" {
+		return true
+	}
+	return strings.HasPrefix(path, "/api/settings/tokens")
+}
+
 func sessionIDFromContext(ctx context.Context) string {
 	v, _ := ctx.Value(sessionContextKey).(string)
 	return v

internal/api/middleware_test.go

@@ -0,0 +1,130 @@
+package api
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+	"time"
+
+	"github.com/fonu/fonu/internal/auth"
+	"github.com/fonu/fonu/internal/db"
+)
+
+func newTokenTestAuth(t *testing.T, scope string) (*auth.Service, string) {
+	t.Helper()
+	conn, err := db.Open(filepath.Join(t.TempDir(), "fonu.db"))
+	if err != nil {
+		t.Fatalf("open db: %v", err)
+	}
+	t.Cleanup(func() { _ = conn.Close() })
+	if err := db.Migrate(context.Background(), conn, filepath.Join("..", "..", "migrations")); err != nil {
+		t.Fatalf("migrate: %v", err)
+	}
+	svc := auth.New(conn)
+	created, err := svc.CreateAPIToken(context.Background(), "test", scope, time.Time{})
+	if err != nil {
+		t.Fatalf("create token: %v", err)
+	}
+	return svc, created.Token
+}
+
+func okTokenHandler() http.HandlerFunc {
+	return func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusOK) }
+}
+
+func TestRequireAuthAcceptsReadTokenForGet(t *testing.T) {
+	svc, plain := newTokenTestAuth(t, auth.TokenScopeRead)
+	handler := RequireAuth(svc)(okTokenHandler())
+
+	req := httptest.NewRequest(http.MethodGet, "/api/status", nil)
+	req.Header.Set("Authorization", "Bearer "+plain)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("只读令牌应能读，实际 %d", rec.Code)
+	}
+}
+
+func TestRequireAuthBlocksWriteForReadToken(t *testing.T) {
+	svc, plain := newTokenTestAuth(t, auth.TokenScopeRead)
+	handler := RequireAuth(svc)(okTokenHandler())
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/proxies/1", nil)
+	req.Header.Set("Authorization", "Bearer "+plain)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("只读令牌不应能写，实际 %d", rec.Code)
+	}
+}
+
+func TestRequireAuthAllowsWriteForWriteToken(t *testing.T) {
+	svc, plain := newTokenTestAuth(t, auth.TokenScopeWrite)
+	handler := RequireAuth(svc)(okTokenHandler())
+
+	req := httptest.NewRequest(http.MethodPost, "/api/proxies", nil)
+	req.Header.Set("Authorization", "Bearer "+plain)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("写令牌应能写，实际 %d", rec.Code)
+	}
+}
+
+func TestRequireAuthTokenCannotManageTokens(t *testing.T) {
+	// 写令牌也不能管理令牌：否则等于拿令牌给自己提权或无限续期
+	svc, plain := newTokenTestAuth(t, auth.TokenScopeWrite)
+	handler := RequireAuth(svc)(okTokenHandler())
+
+	req := httptest.NewRequest(http.MethodGet, "/api/settings/tokens", nil)
+	req.Header.Set("Authorization", "Bearer "+plain)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("令牌管理应只允许登录会话，实际 %d", rec.Code)
+	}
+}
+
+func TestRequireAuthRejectsBadCredentials(t *testing.T) {
+	svc, _ := newTokenTestAuth(t, auth.TokenScopeRead)
+	handler := RequireAuth(svc)(okTokenHandler())
+
+	cases := map[string]string{
+		"未知令牌": "Bearer deadbeef",
+		"错误前缀": "Token abc",
+		"没有凭据": "",
+	}
+	for name, header := range cases {
+		req := httptest.NewRequest(http.MethodGet, "/api/status", nil)
+		if header != "" {
+			req.Header.Set("Authorization", header)
+		}
+		rec := httptest.NewRecorder()
+		handler.ServeHTTP(rec, req)
+		if rec.Code != http.StatusUnauthorized {
+			t.Fatalf("%s 应返回 401，实际 %d", name, rec.Code)
+		}
+	}
+}
+
+func TestBearerTokenParsing(t *testing.T) {
+	cases := map[string]string{
+		"Bearer abc":  "abc",
+		"bearer abc":  "abc",
+		"Bearer  abc": "abc",
+		"Basic abc":   "",
+		"Bearer ":     "",
+		"":            "",
+	}
+	for header, want := range cases {
+		req := httptest.NewRequest(http.MethodGet, "/", nil)
+		if header != "" {
+			req.Header.Set("Authorization", header)
+		}
+		if got := bearerToken(req); got != want {
+			t.Fatalf("Authorization %q 解析为 %q，期望 %q", header, got, want)
+		}
+	}
+}

internal/api/nginx_handler.go

@@ -123,6 +123,33 @@ func (h *NginxHandler) RollbackGlobal(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, view)
 }
 
+func (h *NginxHandler) GetConfigVersions(w http.ResponseWriter, r *http.Request) {
+	view, err := h.proxy.GetNginxConfigVersions()
+	if err != nil {
+		writeServiceError(r, w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, view)
+}
+
+func (h *NginxHandler) GetConfigVersion(w http.ResponseWriter, r *http.Request) {
+	view, err := h.proxy.ReadNginxConfigVersion(r.PathValue("name"))
+	if err != nil {
+		writeServiceError(r, w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, view)
+}
+
+func (h *NginxHandler) RollbackConfigVersion(w http.ResponseWriter, r *http.Request) {
+	view, err := h.proxy.RollbackNginxConfigVersion(r.Context(), r.PathValue("name"))
+	if err != nil {
+		writeServiceError(r, w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, view)
+}
+
 func writeServiceError(r *http.Request, w http.ResponseWriter, err error) {
 	if err == nil {
 		return

internal/api/router.go

@@ -41,6 +41,9 @@ func NewRouter(deps Deps) http.Handler {
 	}
 
 	protect("POST /api/auth/password", r.authHandler.ChangePassword)
+	protect("GET /api/settings/tokens", r.authHandler.ListTokens)
+	protect("POST /api/settings/tokens", r.authHandler.CreateToken)
+	protect("DELETE /api/settings/tokens/{id}", r.authHandler.DeleteToken)
 	protect("GET /api/status", r.statusHandler.Get)
 	protect("GET /api/proxies", r.proxyHandler.List)
 	protect("GET /api/proxies/traffic", r.proxyHandler.Traffic)
@@ -56,6 +59,9 @@ func NewRouter(deps Deps) http.Handler {
 	protect("GET /api/settings/nginx/global", r.nginxHandler.GetGlobal)
 	protect("PUT /api/settings/nginx/global", r.nginxHandler.PutGlobal)
 	protect("POST /api/settings/nginx/global/rollback", r.nginxHandler.RollbackGlobal)
+	protect("GET /api/settings/nginx/config/versions", r.nginxHandler.GetConfigVersions)
+	protect("GET /api/settings/nginx/config/versions/{name}", r.nginxHandler.GetConfigVersion)
+	protect("POST /api/settings/nginx/config/versions/{name}/rollback", r.nginxHandler.RollbackConfigVersion)
 	protect("GET /api/ddns", r.ddnsHandler.List)
 	protect("POST /api/ddns", r.ddnsHandler.Create)
 	protect("PUT /api/ddns/{id}", r.ddnsHandler.Update)
@@ -125,6 +131,9 @@ func NewRouter(deps Deps) http.Handler {
 		protect("POST /api/frpmulti/servers/{id}/agent/nginx/reload", frpHandler.AgentNginxReload)
 		protect("POST /api/frpmulti/servers/{id}/agent/nginx/install", frpHandler.AgentInstallNginx)
 		protect("GET /api/frpmulti/servers/{id}/agent/routes/{proxyID}/conf", frpHandler.AgentRouteConf)
+		protect("GET /api/frpmulti/servers/{id}/agent/routes/{proxyID}/versions", frpHandler.AgentRouteVersions)
+		protect("GET /api/frpmulti/servers/{id}/agent/routes/{proxyID}/versions/{name}", frpHandler.AgentRouteVersion)
+		protect("POST /api/frpmulti/servers/{id}/agent/routes/{proxyID}/versions/{name}/rollback", frpHandler.AgentRollbackRouteVersion)
 		protect("GET /api/frpmulti/servers/{id}/agent/route-candidates", frpHandler.AgentRouteCandidates)
 		protect("POST /api/frpmulti/servers/{id}/agent/routes/{proxyID}", frpHandler.DeployAgentRoute)
 		protect("DELETE /api/frpmulti/servers/{id}/agent/routes/{proxyID}", frpHandler.RemoveAgentRoute)

internal/api/settings_handler.go

@@ -39,25 +39,25 @@ func (h *SettingsHandler) Put(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	allowed := map[string]bool{
-		settings.KeyTheme:                 true,
-		settings.KeyTimezone:              true,
-		settings.KeyLogRetentionDays:      true,
-		settings.KeyDDNSCheckInterval:     true,
-		settings.KeyCertRenewThreshold:    true,
-		settings.KeyRootDomain:            true,
-		settings.KeyACMEEmail:             true,
-		settings.KeyACMECA:                true,
-		settings.KeyZeroSSLAPIKey:         true,
-		settings.KeyNotifyWebhookURL:      true,
-		settings.KeyNotifyType:            true,
-		settings.KeyNotifyEmailJSON:       true,
-		settings.KeyNotifySMTPPassword:    true,
-		settings.KeyNotifyWebhookJSON:     true,
-		settings.KeyNotifyWebhookSecret:   true,
-		settings.KeyNotifyTelegramJSON:    true,
-		settings.KeyNotifyTelegramToken:   true,
-		settings.KeyNotifyOnDDNSIPChange:      true,
-		settings.KeyNotifyOnDDNSFailure:       true,
+		settings.KeyTheme:                       true,
+		settings.KeyTimezone:                    true,
+		settings.KeyLogRetentionDays:            true,
+		settings.KeyDDNSCheckInterval:           true,
+		settings.KeyCertRenewThreshold:          true,
+		settings.KeyRootDomain:                  true,
+		settings.KeyACMEEmail:                   true,
+		settings.KeyACMECA:                      true,
+		settings.KeyZeroSSLAPIKey:               true,
+		settings.KeyNotifyWebhookURL:            true,
+		settings.KeyNotifyType:                  true,
+		settings.KeyNotifyEmailJSON:             true,
+		settings.KeyNotifySMTPPassword:          true,
+		settings.KeyNotifyWebhookJSON:           true,
+		settings.KeyNotifyWebhookSecret:         true,
+		settings.KeyNotifyTelegramJSON:          true,
+		settings.KeyNotifyTelegramToken:         true,
+		settings.KeyNotifyOnDDNSIPChange:        true,
+		settings.KeyNotifyOnDDNSFailure:         true,
 		settings.KeyNotifyOnCertExpiry:          true,
 		settings.KeyNotifyOnCertRenewSuccess:    true,
 		settings.KeyNotifyOnIPFrequentAccess:    true,
@@ -68,12 +68,18 @@ func (h *SettingsHandler) Put(w http.ResponseWriter, r *http.Request) {
 		settings.KeyNotifyIPFrequentWindowSec:   true,
 		settings.KeyNotifyLoginFailureThreshold: true,
 		settings.KeyNotifyLoginFailureWindowSec: true,
-		settings.KeyTrustedProxy:          true,
-		settings.KeyGlobalIPBlacklist:     true,
-		settings.KeyGlobalIPWhitelist:     true,
-		settings.KeyChinaCIDRUpdateHours:  true,
-		settings.KeyChinaCIDRSourceV4:     true,
-		settings.KeyChinaCIDRSourceV6:     true,
+		settings.KeyNotifyOnResourceThreshold:   true,
+		settings.KeyNotifyOnTunnelDown:          true,
+		settings.KeyNotifyCPUThreshold:          true,
+		settings.KeyNotifyMemoryThreshold:       true,
+		settings.KeyNotifyDiskThreshold:         true,
+		settings.KeyNotifyTunnelFailThreshold:   true,
+		settings.KeyTrustedProxy:                true,
+		settings.KeyGlobalIPBlacklist:           true,
+		settings.KeyGlobalIPWhitelist:           true,
+		settings.KeyChinaCIDRUpdateHours:        true,
+		settings.KeyChinaCIDRSourceV4:           true,
+		settings.KeyChinaCIDRSourceV6:           true,
 	}
 	filtered := map[string]string{}
 	for key, value := range req {
@@ -139,6 +145,12 @@ func isNotifySettingKey(key string) bool {
 		settings.KeyNotifyIPFrequentWindowSec,
 		settings.KeyNotifyLoginFailureThreshold,
 		settings.KeyNotifyLoginFailureWindowSec,
+		settings.KeyNotifyOnResourceThreshold,
+		settings.KeyNotifyOnTunnelDown,
+		settings.KeyNotifyCPUThreshold,
+		settings.KeyNotifyMemoryThreshold,
+		settings.KeyNotifyDiskThreshold,
+		settings.KeyNotifyTunnelFailThreshold,
 		settings.KeyNotifyWebhookURL:
 		return true
 	default:

internal/api/token_handler.go

@@ -0,0 +1,72 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"strings"
+	"time"
+
+	"github.com/fonu/fonu/internal/auth"
+)
+
+// 令牌管理挂在 AuthHandler 上：它已经持有 auth.Service，不必再加一层 handler。
+const maxTokenExpiryDays = 3650
+
+type createTokenRequest struct {
+	Name          string `json:"name"`
+	Scope         string `json:"scope"`
+	ExpiresInDays int    `json:"expires_in_days"`
+}
+
+func (h *AuthHandler) ListTokens(w http.ResponseWriter, r *http.Request) {
+	tokens, err := h.auth.ListAPITokens(r.Context())
+	if err != nil {
+		writeError(r, w, http.StatusInternalServerError, "读取令牌失败", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"tokens": tokens})
+}
+
+// CreateToken 新建令牌；明文只在这一个响应里返回，之后无法再取回。
+func (h *AuthHandler) CreateToken(w http.ResponseWriter, r *http.Request) {
+	var req createTokenRequest
+	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+		writeError(r, w, http.StatusBadRequest, "请求格式无效")
+		return
+	}
+	scope := strings.TrimSpace(req.Scope)
+	if scope == "" {
+		scope = auth.TokenScopeRead
+	}
+	var expiresAt time.Time
+	if req.ExpiresInDays > 0 {
+		if req.ExpiresInDays > maxTokenExpiryDays {
+			writeError(r, w, http.StatusBadRequest, "有效期最长 3650 天")
+			return
+		}
+		expiresAt = time.Now().AddDate(0, 0, req.ExpiresInDays)
+	}
+	token, err := h.auth.CreateAPIToken(r.Context(), req.Name, scope, expiresAt)
+	if err != nil {
+		writeError(r, w, http.StatusBadRequest, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusCreated, token)
+}
+
+func (h *AuthHandler) DeleteToken(w http.ResponseWriter, r *http.Request) {
+	id, err := parseID(r.PathValue("id"))
+	if err != nil {
+		writeError(r, w, http.StatusBadRequest, "无效的令牌 ID")
+		return
+	}
+	if err := h.auth.DeleteAPIToken(r.Context(), id); err != nil {
+		if err.Error() == "令牌不存在" {
+			writeError(r, w, http.StatusNotFound, err.Error())
+			return
+		}
+		writeError(r, w, http.StatusInternalServerError, "删除令牌失败", err)
+		return
+	}
+	writeJSON(w, http.StatusOK, map[string]any{"ok": true})
+}