From a8445627dd4e963ee586eb6ba22a47d0c987e318 Mon Sep 17 00:00:00 2001
From: Your Name <your.email@example.com>
Date: Sat, 7 Feb 2026 20:25:04 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DAI=E6=8F=90=E4=BE=9B=E5=95=86?=
 =?UTF-8?q?=E5=88=9B=E5=BB=BA=E6=97=A5=E5=BF=97=E6=B3=84=E9=9C=B2API=20Key?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 app/api/admin/ai-providers/route.ts | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/app/api/admin/ai-providers/route.ts b/app/api/admin/ai-providers/route.ts
index 98b11b5..0e53d69 100644
--- a/app/api/admin/ai-providers/route.ts
+++ b/app/api/admin/ai-providers/route.ts
@@ -26,6 +26,21 @@ const updateProviderSchema = z.object({
   isEnabled: z.boolean().optional(),
 });
 
+function maskApiKey(apiKey?: string) {
+  if (!apiKey) return undefined;
+  if (apiKey.length <= 8) return "****";
+  return `${apiKey.slice(0, 4)}****${apiKey.slice(-4)}`;
+}
+
+function sanitizeProviderPayload(payload: unknown) {
+  if (!payload || typeof payload !== "object") return payload;
+  const cloned = { ...(payload as Record<string, unknown>) };
+  if (typeof cloned.apiKey === "string") {
+    cloned.apiKey = maskApiKey(cloned.apiKey);
+  }
+  return cloned;
+}
+
 export async function GET(request: Request) {
   try {
     await requireAdmin();
@@ -68,7 +83,7 @@ export async function POST(request: Request) {
     const session = await requireAdmin();
 
     const body = await request.json();
-    console.log("[Admin API] Create provider request body:", JSON.stringify(body));
+    console.log("[Admin API] Create provider request body:", JSON.stringify(sanitizeProviderPayload(body)));
     
     const data = createProviderSchema.parse(body);
     console.log("[Admin API] Validation passed, creating provider...");