feat: reveal encrypted config secrets on demand

ai_knowledge_base_v2/apps/backend/app/api/admin_settings.py

@@ -30,6 +30,7 @@ from app.services.agent_debug_service import AgentDebugService
 from app.services.feishu_service import FeishuKnowledgeService
 from app.services.knowledge_service import KnowledgeScope
 from app.services.model_service import ModelClientService
+from app.services.admin_permission_service import require_permission
 from app.services.reasoning_policy_service import ReasoningPolicyService
 from app.services.response_style_service import ResponseStyleService
 from app.services.secret_service import MASKED_SECRET, SENSITIVE_CONFIG_KEYS, SecretService
@@ -446,6 +447,30 @@ def list_config(db: Session = Depends(get_db), current_admin: Admin = Depends(ge
     return api_success([_config_dict(config) for config in configs])
 
 
+@router.get("/config/{config_key}/secret")
+def reveal_config_secret(
+    config_key: str,
+    db: Session = Depends(get_db),
+    current_admin: Admin = Depends(get_current_admin),
+) -> dict:
+    require_permission(current_admin, "configs.view")
+    if config_key not in SENSITIVE_CONFIG_KEYS:
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="该配置不是可查看的敏感配置")
+    config = db.scalar(select(SystemConfig).where(SystemConfig.config_key == config_key))
+    if config is None or not config.config_value:
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="该配置尚未填写")
+    value = SecretService.decrypt(config.config_value)
+    OperationLogService.write(
+        db,
+        admin_id=current_admin.id,
+        module="config",
+        action="reveal_secret",
+        target_id=config.id,
+    )
+    db.commit()
+    return api_success({"configKey": config_key, "configValue": value})
+
+
 @router.put("/config")
 def save_config(
     payload: SystemConfigSaveRequest,