Extension Openai Skill 安全审计

146147  // Per-user OpenAI keys. Never iterated except by the calling principal.148  let openAIKeys : Map.Map<Principal, Text>;149  include MixinOpenAIChat(openAIKeys);150};

186187  public shared ({ caller }) func setMyOpenAIApiKey(key : Text) : async () {188    if (caller.isAnonymous()) {189      Runtime.trap("Sign in to use this feature");190    };191    openAIKeys.add(caller, key);192  };193

261- **Anonymous callers must not store keys.** `caller.isAnonymous()` short-circuits before any `openAIKeys.add` — otherwise everyone reading the canister via `2vxsx-fae` shares one key slot.262- **`stable var` / migration.** The `Map<Principal, Text>` lives in stable memory like any other actor field; on upgrade, decide whether to preserve, rotate, or drop the keys. The default (preserve) is correct for almost all apps. If you ever rotate, drop the whole map — never partially.263

490491- The chat UI itself is trivial and identical across variants: a textarea, a submit button, a list of messages bound to the backend's chat endpoint. No client-side OpenAI SDK, no key handling, no streaming-protocol logic — the canister mediates everything.492- **Sign-in is required for variants A and B, skipped for variant C.** For A and B, wire the chat and settings routes through `extension-authorization`'s auth guard (`useInternetIdentity` + a redirect when `!isAuthenticated`); anonymous callers must hit a "please sign in" wall before the chat or settings UI renders, otherwise every backend call traps. For C, no guard is needed because there is no auth model.493- The frontend never persists the key in localStorage / IndexedDB / cookies. It travels into the canister via the typed setter and is never read back.494

44hand-rolled JSON serialisation on a language with weak JSON support.45Any build spec that mentions LLM / GPT / OpenAI features MUST name46`openai-client` as a dependency and reference this skill — propagate47that explicitly so the backend agent cannot silently fall back to48hand-rolled HTTP.49

7273Use the mops tool, not manual file edits:7475```bash76mops add openai-client@0.2.577```7879This updates `mops.toml` (adds `openai-client = "0.2.5"` to `[dependencies]`) and rewrites `mops.lock` in one step. **Requires Mops ≥ 2.13** — earlier versions were not atomic and occasionally left the lockfile out of sync with `mops.toml`.80

2728For an LLM **inside a Caffeine app** with no user-pasted OpenAI key, use29[`extension-inference`](../extension-inference/SKILL.md)30(`caffeineai-inference-client`, credentials provided by the platform). This31skill is **only** for calling `api.openai.com` with a user- or admin-pasted32`sk-...`.33

371372  public shared ({ caller }) func chat(prompt : Text) : async Text {373    if (not AccessControl.hasPermission(accessControlState, caller, #user)) {374      Runtime.trap("Unauthorized");375    };376    let ?key = openAIApiKey.value else Runtime.trap("OpenAI is not configured");377    await* OpenAI.runChatCompletion(OpenAI.configForKey(key), prompt);378  };

390391Use this **only** when the spec explicitly states there is no login at all (single-user demo, intra-team tool, throwaway sandbox). Mechanically identical to §9 — single `?Text` key, no getter, `isOpenAIConfigured` query — but with the auth import / `#admin` gate removed; any visitor may overwrite the key.392

416417  ```418  public func setOpenAIApiKey(key : Text) : async () {419    openAIApiKey.value := ?key;420  };421  ```422423- Drop the `#user` permission check at the top of `chat`. `chat`, `isOpenAIConfigured`, and the `OpenAI.configForKey(...)` call are otherwise identical to §9.424

417  ```418  public func setOpenAIApiKey(key : Text) : async () {419    openAIApiKey.value := ?key;420  };421  ```422423- Drop the `#user` permission check at the top of `chat`. `chat`, `isOpenAIConfigured`, and the `OpenAI.configForKey(...)` call are otherwise identical to §9.424

424425### Anonymous-specific invariants426427- **No `extension-authorization` import.** This variant skips it entirely.428- **The key is shared and replaceable by anyone.** That is the explicit trade-off of the variant; pick it only when the spec accepts that.429- **Same no-getter / no-log rules apply.** `openAIApiKey` is read only inside `chat` (then passed to `OpenAI.configForKey`), never returned by any endpoint.430- **Build a fresh `Config` per call** — same reasoning as §9.