Fix basepool & 优化 repo

internal/repository/key_crud.go

@@ -23,7 +23,6 @@ func (r *gormKeyRepository) AddKeys(keys []models.APIKey) ([]models.APIKey, erro
 	keyHashes := make([]string, len(keys))
 	keyValueToHashMap := make(map[string]string)
 	for i, k := range keys {
-		// All incoming keys must have plaintext APIKey
 		if k.APIKey == "" {
 			return nil, fmt.Errorf("cannot add key at index %d: plaintext APIKey is empty", i)
 		}
@@ -35,7 +34,6 @@ func (r *gormKeyRepository) AddKeys(keys []models.APIKey) ([]models.APIKey, erro
 	var finalKeys []models.APIKey
 	err := r.db.Transaction(func(tx *gorm.DB) error {
 		var existingKeys []models.APIKey
-		// [MODIFIED] Query by hash to find existing keys.
 		if err := tx.Unscoped().Where("api_key_hash IN ?", keyHashes).Find(&existingKeys).Error; err != nil {
 			return err
 		}
@@ -69,24 +67,20 @@ func (r *gormKeyRepository) AddKeys(keys []models.APIKey) ([]models.APIKey, erro
 			}
 		}
 		if len(keysToCreate) > 0 {
-			// [MODIFIED] Create now only provides encrypted data and hash.
 			if err := tx.Clauses(clause.OnConflict{DoNothing: true}, clause.Returning{}).Create(&keysToCreate).Error; err != nil {
 				return err
 			}
 		}
-		// [MODIFIED] Final select uses hashes to retrieve all relevant keys.
 		if err := tx.Where("api_key_hash IN ?", keyHashes).Find(&finalKeys).Error; err != nil {
 			return err
 		}
-		// [CRITICAL] Decrypt all keys before returning them to the service layer.
+
 		return r.decryptKeys(finalKeys)
 	})
 	return finalKeys, err
 }
 
 func (r *gormKeyRepository) Update(key *models.APIKey) error {
-	// [CRITICAL] Before saving, check if the plaintext APIKey field was populated.
-	// This indicates a potential change that needs to be re-encrypted.
 	if key.APIKey != "" {
 		encryptedKey, err := r.crypto.Encrypt(key.APIKey)
 		if err != nil {
@@ -98,16 +92,16 @@ func (r *gormKeyRepository) Update(key *models.APIKey) error {
 		key.APIKeyHash = hex.EncodeToString(hash[:])
 	}
 	err := r.executeTransactionWithRetry(func(tx *gorm.DB) error {
-		// GORM automatically ignores `key.APIKey` because of the `gorm:"-"` tag.
+
 		return tx.Save(key).Error
 	})
 	if err != nil {
 		return err
 	}
-	// For the cache update, we need the plaintext. Decrypt if it's not already populated.
+
 	if err := r.decryptKey(key); err != nil {
 		r.logger.Warnf("DB updated key ID %d, but decryption for cache failed: %v", key.ID, err)
-		return nil // Continue without cache update if decryption fails.
+		return nil
 	}
 	if err := r.updateStoreCacheForKey(key); err != nil {
 		r.logger.Warnf("DB updated key ID %d, but cache update failed: %v", key.ID, err)
@@ -192,7 +186,6 @@ func (r *gormKeyRepository) GetKeysByIDs(ids []uint) ([]models.APIKey, error) {
 	if err != nil {
 		return nil, err
 	}
-	// [CRITICAL] Decrypt before returning.
 	return keys, r.decryptKeys(keys)
 }