feat: support real browser auth import

backend/test_upstream_key_sync.py

@@ -590,3 +590,106 @@ def test_sync_removes_deleted_remote_key(db_session):
 
     remaining = db_session.query(UpstreamGeneratedKey).all()
     assert len(remaining) == 0
+
+
+def test_new_api_create_token_fetches_plaintext_key(monkeypatch):
+    """New-API 创建 token 后需按 id 再取一次明文 key。"""
+    from app.services.upstream_client import UpstreamClient
+
+    client = UpstreamClient(
+        base_url="http://newapi.local",
+        api_prefix="",
+        auth_type="cookie",
+        auth_config={"cookie_string": "session=abc", "new_api_user": "7"},
+    )
+    created_bodies = []
+
+    def fake_request(method, path, body=None, auth=True):
+        if method == "GET" and path == "/api/status":
+            return {"success": True, "data": {"quota_per_unit": 500000}}
+        if method == "POST" and path == "/api/token/":
+            created_bodies.append(body)
+            return {"success": True, "message": ""}
+        if method == "POST" and path == "/api/token/123/key":
+            return {"success": True, "data": {"key": "new-api-plain-key"}}
+        raise AssertionError(f"unexpected request {method} {path}")
+
+    monkeypatch.setattr(client, "_request", fake_request)
+    monkeypatch.setattr(
+        client,
+        "_list_new_api_tokens",
+        lambda search="", group_id=None: [{"id": 123, "name": search, "group": group_id, "key": "new-****-key"}],
+    )
+
+    result = client.create_api_key(
+        "SmartUp-1-VIP-vip",
+        "vip",
+        quota=2,
+        expires_in_days=3,
+        endpoint="/api/token",
+    )
+
+    assert result["id"] == "123"
+    assert result["key"] == "new-api-plain-key"
+    assert created_bodies[0]["group"] == "vip"
+    assert created_bodies[0]["remain_quota"] == 1000000
+    assert created_bodies[0]["unlimited_quota"] is False
+    assert created_bodies[0]["expired_time"] > 0
+
+
+def test_generate_keys_allows_new_api_user_upstream(db_session, monkeypatch):
+    """New-API 普通账号上游应允许按分组生成 token。"""
+    from app.routers import upstreams as upstreams_router
+    from app.schemas.upstream import GenerateKeysByGroupsRequest
+
+    upstream = Upstream(
+        name="NewAPI",
+        base_url="http://newapi.local",
+        api_prefix="",
+        auth_type="cookie",
+        auth_config_json=json.dumps({"cookie_string": "session=abc", "new_api_user": "7"}),
+        groups_endpoint="/api/user/self/groups",
+        rate_endpoint="/api/user/self/groups",
+    )
+    db_session.add(upstream)
+    db_session.commit()
+    db_session.refresh(upstream)
+
+    monkeypatch.setattr(upstreams_router.website_sync, "reconcile_upstream_keys_full", lambda db, uid: True)
+
+    class FakeClient:
+        def __init__(self, **kwargs):
+            self.kwargs = kwargs
+
+        def __enter__(self):
+            return self
+
+        def __exit__(self, *args):
+            return None
+
+        def login(self):
+            return None
+
+        def get_available_groups(self, endpoint):
+            assert endpoint == "/api/user/self/groups"
+            return [{"id": "vip", "name": "VIP"}]
+
+        def find_smartup_group_key(self, gid, expected_name, prefix):
+            return None
+
+        def create_api_key(self, name, group_id, **kwargs):
+            assert kwargs["endpoint"] == "/api/token"
+            return {"id": "123", "key": "new-api-plain-key", "masked_key": "new-****-key", "raw": {"id": 123}}
+
+    monkeypatch.setattr(upstreams_router, "UpstreamClient", FakeClient)
+
+    response = upstreams_router.generate_keys_by_groups(
+        upstream.id,
+        GenerateKeysByGroupsRequest(group_ids=["vip"], endpoint="/api/token"),
+        db_session,
+        object(),
+    )
+
+    assert response.success is True
+    assert response.items[0].status == "created"
+    assert response.items[0].key_value == "new-api-plain-key"