优化api密钥

backend/internal/handler/merchant.go

@@ -302,6 +302,16 @@ func (h *MerchantHandler) UpdateAPIClientStatus(c *gin.Context) {
 	response.OK(c, nil)
 }
 
+// DeleteAPIClient DELETE /api/merchant/api-clients/:id
+func (h *MerchantHandler) DeleteAPIClient(c *gin.Context) {
+	id, _ := strconv.ParseUint(c.Param("id"), 10, 64)
+	if err := h.merchantSvc.DeleteAPIClient(middleware.GetMerchantID(c), uint(id), middleware.GetUserID(c)); err != nil {
+		response.BadRequest(c, err.Error())
+		return
+	}
+	response.OK(c, nil)
+}
+
 func (h *MerchantHandler) ListCallbacks(c *gin.Context) {
 	list, err := h.callbackSvc.ListSubscriptions(middleware.GetMerchantID(c))
 	if err != nil {

backend/internal/router/router.go

@@ -113,9 +113,10 @@ func Setup(h *Handlers) *gin.Engine {
 				merchant.GET("/wallet", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureWallet), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator, model.MemberRoleFinance), h.Merchant.GetWallet)
 				merchant.GET("/wallet/ledger", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureWallet), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleFinance), h.Merchant.ListWalletLedger)
 				merchant.POST("/wallet/adjust", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureWallet), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleFinance), h.Merchant.AdjustWallet)
-				merchant.GET("/api-clients", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureAPI), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator), h.Merchant.ListAPIClients)
+				merchant.GET("/api-clients", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureAPI), h.Merchant.ListAPIClients)
 				merchant.POST("/api-clients", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureAPI), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator), h.Merchant.CreateAPIClient)
 				merchant.PATCH("/api-clients/:id/status", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureAPI), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator), h.Merchant.UpdateAPIClientStatus)
+				merchant.DELETE("/api-clients/:id", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureAPI), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator), h.Merchant.DeleteAPIClient)
 				merchant.GET("/callbacks", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureCallbacks), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator), h.Merchant.ListCallbacks)
 				merchant.POST("/callbacks", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureCallbacks), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator), h.Merchant.CreateCallback)
 				merchant.PATCH("/callbacks/:id/status", middleware.RequireMerchantFeature(h.OpenDB, model.MerchantFeatureCallbacks), middleware.RequireMerchantRole(model.MemberRoleOwner, model.MemberRoleOperator), h.Merchant.UpdateCallbackStatus)

backend/internal/service/merchant.go

@@ -506,7 +506,9 @@ func (s *MerchantService) CreateAPIClient(merchantID uint, in CreateAPIClientInp
 			return errors.New("商户不存在或已禁用")
 		}
 		var clientCount int64
-		if err := tx.Model(&model.APIClient{}).Where("merchant_id = ?", merchantID).Count(&clientCount).Error; err != nil {
+		if err := tx.Model(&model.APIClient{}).
+			Where("merchant_id = ? AND status = ?", merchantID, model.APIClientStatusActive).
+			Count(&clientCount).Error; err != nil {
 			return err
 		}
 		if clientCount >= MaxAPIClientsPerMerchant {
@@ -545,6 +547,27 @@ func (s *MerchantService) UpdateAPIClientStatus(merchantID, id uint, status stri
 	})
 }
 
+// DeleteAPIClient 删除商户的 API 密钥（物理删除，不可恢复）。
+// 删除前要求先停用，避免在用的密钥被误删。
+func (s *MerchantService) DeleteAPIClient(merchantID, id uint, actorUserID uint) error {
+	return s.db.Transaction(func(tx *gorm.DB) error {
+		var client model.APIClient
+		if err := tx.Where("id = ? AND merchant_id = ?", id, merchantID).First(&client).Error; err != nil {
+			if errors.Is(err, gorm.ErrRecordNotFound) {
+				return errors.New("API 客户端不存在")
+			}
+			return err
+		}
+		if client.Status == model.APIClientStatusActive {
+			return errors.New("请先停用该密钥再删除")
+		}
+		if err := tx.Delete(&client).Error; err != nil {
+			return err
+		}
+		return writeAudit(tx, &merchantID, &actorUserID, nil, "api_client.delete", "api_client", fmt.Sprint(id), map[string]string{"name": client.Name, "app_key": client.AppKey})
+	})
+}
+
 // ProductCatalogItem 是商品目录（自营商户可售商品）的展示项，供平台管理员分配商品时勾选。
 type ProductCatalogItem struct {
 	ID          uint   `json:"id"`