feat: 添加管理员密码保护 bootstrap 接口

src/routes/index.js

@@ -22,16 +22,20 @@ const initModels = async () => {
 initModels().catch(console.error);
 
 router.post('/keys/bootstrap', async (req, res) => {
-  if (!models) return res.status(500).json({ error: 'Not initialized' });
-  const { APIKey } = models;
+  const { APIKey } = getModels();
   const count = APIKey.count();
   if (count > 0) {
     return res.status(403).json({ error: 'Bootstrap not allowed' });
   }
   
+  const { password, name } = req.body;
+  if (!config.admin.password || password !== config.admin.password) {
+    return res.status(401).json({ error: 'Invalid admin password' });
+  }
+  
   const key = CryptoJS.lib.WordArray.random(16).toString();
-  const name = req.body.name || 'Root';
-  const apiKey = APIKey.create({ key, name, ownerId: 0 });
+  const keyName = name || 'Root';
+  const apiKey = APIKey.create({ key, name: keyName, ownerId: 0 });
   
   const dir = path.join(config.storage.filesDir, 'root');
   if (!fs.existsSync(dir)) {