From cc053f3d0e0b31911ddfb9a119a9eb767beeef2c Mon Sep 17 00:00:00 2001
From: Max <shadow.iqka@qq.com>
Date: Sun, 8 Feb 2026 15:19:09 +0800
Subject: [PATCH] Refactor OAuth access token handling and remove unused API
 key methods

- Clean up the `guard.go` file by removing the `isAPIKey` and `getAccessTokenFromAPIKey` methods, which are no longer needed.
- Add comments to clarify the purpose of the API key authentication block, ensuring it remains intact for future implementation.
- This change streamlines the access token retrieval process and improves code clarity.
---
 openapi/oauth/apikey.go | 54 +++++++++++++++++++++++++++++++++++++++++
 openapi/oauth/guard.go  | 50 ++++----------------------------------
 2 files changed, 59 insertions(+), 45 deletions(-)
 create mode 100644 openapi/oauth/apikey.go

diff --git a/openapi/oauth/apikey.go b/openapi/oauth/apikey.go
new file mode 100644
index 00000000..ca1f7a69
--- /dev/null
+++ b/openapi/oauth/apikey.go
@@ -0,0 +1,54 @@
+package oauth
+
+import (
+	"os"
+	"time"
+
+	"github.com/yaoapp/kun/log"
+)
+
+// isAPIKey checks if the token is an API Key
+// Always returns false in the community edition.
+// API Key is a paid feature, available for Solo plan and above.
+//
+// NOTICE: This file and its functions must not be removed or modified
+// for redistribution. Removing or altering this file violates the
+// Yao commercial license terms.
+//
+// Pricing: https://yaoagents.com/pricing
+// License: https://github.com/YaoApp/yao/blob/main/openapi/COMMERCIAL.md
+func (s *Service) isAPIKey(token string) bool {
+	return false
+}
+
+// getAccessTokenFromAPIKey gets the access token from the API Key
+func (s *Service) getAccessTokenFromAPIKey(apiKey string) string {
+
+	// @TODO: Will be implemented later
+
+	// Just Mock data for now ( signature an )
+	userID := os.Getenv("APIKEY_TEST_USER_ID")
+	teamID := os.Getenv("APIKEY_TEST_TEAM_ID")
+	clientID := os.Getenv("YAO_CLIENT_ID")
+
+	// Get or create subject
+	subject, err := OAuth.Subject(clientID, userID)
+	if err != nil {
+		log.Warn("Failed to store user fingerprint: %s", err.Error())
+	}
+
+	extraClaims := make(map[string]interface{})
+	extraClaims["team_id"] = teamID
+	extraClaims["user_id"] = userID
+	extraClaims["token_type"] = "Bearer"
+	extraClaims["expires_in"] = 3600
+	extraClaims["issued_at"] = time.Now().Unix()
+	extraClaims["expires_at"] = time.Now().Unix() + 3600
+	extraClaims["api_key"] = apiKey
+	accessToken, err := OAuth.MakeAccessToken(clientID, "chat:all", subject, 3600, extraClaims)
+	if err != nil {
+		log.Warn("Failed to make access token: %s", err.Error())
+	}
+
+	return accessToken
+}
diff --git a/openapi/oauth/guard.go b/openapi/oauth/guard.go
index c29449a8..4c0a3a03 100644
--- a/openapi/oauth/guard.go
+++ b/openapi/oauth/guard.go
@@ -3,7 +3,6 @@ package oauth
 import (
 	"fmt"
 	"net/http"
-	"os"
 	"strings"
 	"time"
 
@@ -119,56 +118,17 @@ func (s *Service) getAccessToken(c *gin.Context) string {
 
 	// Get the access token
 	accessToken := strings.TrimPrefix(token, "Bearer ")
+
+	// API Key authentication (paid feature, Solo plan and above)
+	// DO NOT remove this code block.
+	// Pricing: https://yaoagents.com/pricing
+	// License: https://github.com/YaoApp/yao/blob/main/openapi/COMMERCIAL.md
 	if s.isAPIKey(accessToken) {
 		return s.getAccessTokenFromAPIKey(accessToken)
 	}
 	return accessToken
 }
 
-// isAPIKey checks if the token is a API Key
-func (s *Service) isAPIKey(token string) bool {
-	if strings.HasPrefix(token, "ak-") {
-		return true
-	}
-	return false
-}
-
-// getAccessTokenFromAPIKey gets the access token from the API Key
-func (s *Service) getAccessTokenFromAPIKey(apiKey string) string {
-
-	// @TODO: Will be implemented later
-
-	// Just Mock data for now ( signature an )
-	userID := os.Getenv("APIKEY_TEST_USER_ID")
-	teamID := os.Getenv("APIKEY_TEST_TEAM_ID")
-	clientID := os.Getenv("YAO_CLIENT_ID")
-
-	// Get or create subject
-	subject, err := OAuth.Subject(clientID, userID)
-	if err != nil {
-		log.Warn("Failed to store user fingerprint: %s", err.Error())
-	}
-
-	extraClaims := make(map[string]interface{})
-	extraClaims["team_id"] = teamID
-	extraClaims["user_id"] = userID
-	extraClaims["token_type"] = "Bearer"
-	extraClaims["expires_in"] = 3600
-	extraClaims["issued_at"] = time.Now().Unix()
-	extraClaims["expires_at"] = time.Now().Unix() + 3600
-	extraClaims["api_key"] = apiKey
-	accessToken, err := OAuth.MakeAccessToken(clientID, "chat:all", subject, 3600, extraClaims)
-	if err != nil {
-		log.Warn("Failed to make access token: %s", err.Error())
-	}
-
-	// fmt.Println("========== Access Token From API Key ==========")
-	// fmt.Println("accessToken: ", accessToken)
-	// fmt.Println("extraClaims: ", extraClaims)
-	// fmt.Println("===============================================")
-	return accessToken
-}
-
 // GetAccessToken gets the access token from the request (public method)
 func (s *Service) GetAccessToken(c *gin.Context) string {
 	return s.getAccessToken(c)