YueGuobin bbe57f34b9 feat(llm): hide api_key from all API responses and document max_tokens as reserved ...

Security Enhancement:
   - API keys are now always filtered to null in all LLM config API responses
   - Created LLMModelConfigDataWithoutSecret schema for response validation
   - Added _filter_api_key_from_config() helper in API routes
   - Modified repository to always hide api_key in get_user_effective_configs()
   - Update/create operations still accept and store api_key securely

   Documentation Updates:
   - Updated API key visibility section to reflect new security policy
   - Updated all response examples to show api_key as null
   - Marked max_tokens field as reserved for future use
   - Added "Reserved Fields" section explaining unused fields

   This defense-in-depth approach prevents API keys from being leaked through
   logs, browser devtools, or network monitoring.

2026-03-14 13:12:22 +08:00

..

models

feat(db): replace PostgreSQL-specific JSONB with cross-database JSON type

2026-03-03 18:03:16 +08:00

repositories

feat(llm): hide api_key from all API responses and document max_tokens as reserved

2026-03-14 13:12:22 +08:00

__init__.py

Fix tests.

2020-11-19 15:27:33 +10:30

tasks.py

feat(agent): refactor LLM configuration handling to use centralized config

2026-03-04 13:13:54 +08:00