From 3c1fff24916893f9977e22ea87706b9e16fbeb6a Mon Sep 17 00:00:00 2001
From: liumangmang <a362165265@qq.com>
Date: Thu, 2 Jul 2026 15:47:34 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BC=98=E5=8C=96=E4=B8=8A=E6=B8=B8?=
 =?UTF-8?q?=E6=A8=A1=E5=9E=8B=E5=90=8C=E6=AD=A5=E7=9A=84=E5=86=99=E5=9B=9E?=
 =?UTF-8?q?=E9=80=BB=E8=BE=91=EF=BC=8C=E9=87=87=E7=94=A8=E5=A2=9E=E9=87=8F?=
 =?UTF-8?q?=20JSONB=20merge=EF=BC=8C=E9=81=BF=E5=85=8D=E8=84=B1=E6=95=8F?=
 =?UTF-8?q?=E7=9A=84=20credentials=20=E8=A6=86=E7=9B=96=E6=88=96=E4=B8=A2?=
 =?UTF-8?q?=E5=A4=B1=E5=8E=9F=E6=9C=89=E6=95=8F=E6=84=9F=E5=AD=97=E6=AE=B5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/app/routers/websites.py      | 9 ++-------
 backend/test_sync_upstream_models.py | 4 ++--
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/backend/app/routers/websites.py b/backend/app/routers/websites.py
index f7f48c7..f38a213 100644
--- a/backend/app/routers/websites.py
+++ b/backend/app/routers/websites.py
@@ -1393,13 +1393,8 @@ def sync_website_accounts_upstream_models(
                 # 构造 model_mapping
                 model_mapping = {m: m for m in valid_models}
 
-                # 优先读取账号现有的 credentials 并 merge，以防覆盖掉 api_key/base_url 等其他配置
-                current_creds = remote_acc.get("credentials") or {}
-                updated_creds = dict(current_creds)
-                updated_creds["model_mapping"] = model_mapping
-
-                # 调用更新接口
-                c.update_account(aid, {"credentials": updated_creds})
+                # 直接发送增量字段进行更新，依赖远端的 JSONB merge 逻辑，避免覆盖/丢失敏感 credentials
+                c.update_account(aid, {"credentials": {"model_mapping": model_mapping}})
 
                 items.append(SyncUpstreamModelsItem(
                     account_id=aid,
diff --git a/backend/test_sync_upstream_models.py b/backend/test_sync_upstream_models.py
index bea411b..37f3a4c 100644
--- a/backend/test_sync_upstream_models.py
+++ b/backend/test_sync_upstream_models.py
@@ -172,10 +172,10 @@ def test_sync_upstream_models_workflow(db_session, monkeypatch):
     assert item_1001.model_count == 2
     assert item_1001.models == ["gpt-3.5-turbo", "gpt-4"]
 
-    # 1001 的 update 应当 merge credentials
+    # 1001 的 update 应当只传递增量的 model_mapping，防止敏感字段丢失
     assert len(update_calls) == 1
     assert update_calls[0][0] == "1001"
-    assert update_calls[0][1]["credentials"]["api_key"] == "k1"
+    assert "api_key" not in update_calls[0][1]["credentials"]
     assert update_calls[0][1]["credentials"]["model_mapping"] == {
         "gpt-3.5-turbo": "gpt-3.5-turbo",
         "gpt-4": "gpt-4"