From 13d0d7707a67e6eb2f55daff4afd88ed2a9d2fb4 Mon Sep 17 00:00:00 2001
From: Yaosanqi137 <zxc18023571263@outlook.com>
Date: Mon, 6 Apr 2026 14:28:37 +0800
Subject: [PATCH] fix(ai-public): hide public pool endpoint from users

---
 apps/api/src/ai/ai.service.ts        |  2 --
 apps/api/test/ai.spec.ts             | 24 ++++++++++++++++++++++++
 apps/web/src/pages/settings-page.tsx |  6 ------
 apps/web/src/services/ai-api.ts      |  1 -
 4 files changed, 24 insertions(+), 9 deletions(-)

diff --git a/apps/api/src/ai/ai.service.ts b/apps/api/src/ai/ai.service.ts
index 8dae914..8b57109 100644
--- a/apps/api/src/ai/ai.service.ts
+++ b/apps/api/src/ai/ai.service.ts
@@ -51,7 +51,6 @@ export type ListAiBindingsResponse = {
     enabled: boolean;
     providerName: string | null;
     model: string | null;
-    endpoint: string | null;
     hasApiKey: boolean;
   } | null;
 };
@@ -122,7 +121,6 @@ export class AiService {
             enabled: publicPool.enabled,
             providerName: publicPool.providerName,
             model: publicPool.model,
-            endpoint: publicPool.endpoint,
             hasApiKey: Boolean(publicPool.encryptedApiKey)
           }
         : null
diff --git a/apps/api/test/ai.spec.ts b/apps/api/test/ai.spec.ts
index d344a9e..6bc9cce 100644
--- a/apps/api/test/ai.spec.ts
+++ b/apps/api/test/ai.spec.ts
@@ -468,6 +468,30 @@ describe("AiController (integration)", () => {
     });
   });
 
+  it("should hide public pool endpoint from user bindings response", async () => {
+    prismaService.seedPublicPool({
+      enabled: true,
+      providerName: "public-openai",
+      model: "gpt-4o-mini",
+      encryptedApiKey: "sk-public",
+      endpoint: "https://internal.example.com/v1",
+      rpmLimit: 60,
+      dailyTokenLimit: 100000
+    });
+
+    const response = await request(app.getHttpServer())
+      .get("/ai/bindings")
+      .set("x-user-id", "user_1")
+      .expect(200);
+
+    expect(response.body.publicPool).toEqual({
+      enabled: true,
+      providerName: "public-openai",
+      model: "gpt-4o-mini",
+      hasApiKey: true
+    });
+  });
+
   it("should upsert one binding per user channel", async () => {
     await request(app.getHttpServer())
       .post("/ai/bindings")
diff --git a/apps/web/src/pages/settings-page.tsx b/apps/web/src/pages/settings-page.tsx
index b5145ad..bfe3aa0 100644
--- a/apps/web/src/pages/settings-page.tsx
+++ b/apps/web/src/pages/settings-page.tsx
@@ -450,12 +450,6 @@ export function SettingsPage({ session }: SettingsPageProps) {
                     {bindingsResponse?.publicPool?.model || "未设置"}
                   </span>
                 </div>
-                <div>
-                  接口地址：
-                  <span className="ml-2 break-all text-foreground">
-                    {bindingsResponse?.publicPool?.endpoint || "未设置"}
-                  </span>
-                </div>
               </div>
             </section>
           </div>
diff --git a/apps/web/src/services/ai-api.ts b/apps/web/src/services/ai-api.ts
index 813edb7..5fd6a9f 100644
--- a/apps/web/src/services/ai-api.ts
+++ b/apps/web/src/services/ai-api.ts
@@ -32,7 +32,6 @@ export type WebAiBindingsResponse = {
     enabled: boolean;
     providerName: string | null;
     model: string | null;
-    endpoint: string | null;
     hasApiKey: boolean;
   } | null;
 };