fix(access): 统一 API Key 模型权限与列表契约

将全局启用、用户组基线、API Key 专属或排除规则及 scope 按固定顺序求值，避免 Key 越过所属用户组权限，并让运行时候选与模型列表共用同一权限链。

新增 Key 级可分配模型与失效规则诊断接口、OpenAI 兼容 /v1/models 及 rich 列表迁移路径；前端权限弹窗改为按当前 Key 实时加载并支持清理失效规则。

验证：Go 全量测试与 go vet 通过；Web 22 个测试文件共 142 项通过；pnpm lint、pnpm openapi、pnpm build、Compose 配置、gofmt、ShellCheck 和 git diff --check 通过；独立 PostgreSQL 真实配置验收通过。

apps/api/docs/swagger.json

@@ -5726,6 +5726,7 @@
                     "api-keys"
                 ],
                 "summary": "列出 API Key 可分配模型",
+                "deprecated": true,
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -5809,6 +5810,64 @@
                 }
             }
         },
+        "/api/v1/api-keys/{apiKeyID}/assignable-models": {
+            "get": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "返回指定 API Key 所属用户组允许、全局启用且符合 KEY scope 的平台来源，并附带已有规则有效性诊断。",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "api-keys"
+                ],
+                "summary": "列出指定 API Key 可分配模型",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "API Key ID",
+                        "name": "apiKeyID",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.APIKeyAssignableModelsResponse"
+                        }
+                    },
+                    "401": {
+                        "description": "Unauthorized",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "404": {
+                        "description": "Not Found",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "503": {
+                        "description": "Service Unavailable",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    }
+                }
+            }
+        },
         "/api/v1/api-keys/{apiKeyID}/disable": {
             "patch": {
                 "security": [
@@ -7318,26 +7377,15 @@
                         "BearerAuth": []
                     }
                 ],
-                "description": "按当前用户权限返回可用于 Playground 或 API 调用的模型列表。",
+                "description": "兼容期 rich 平台来源明细；新客户端应改用 /api/v1/platform-models，OpenAI 客户端使用 /v1/models。",
                 "produces": [
                     "application/json"
                 ],
                 "tags": [
                     "playground"
                 ],
-                "summary": "列出可调用模型",
-                "parameters": [
-                    {
-                        "enum": [
-                            "canvas_model_node",
-                            "desktop"
-                        ],
-                        "type": "string",
-                        "description": "模型可选场景；不传时保持原有行为",
-                        "name": "usage_scene",
-                        "in": "query"
-                    }
-                ],
+                "summary": "列出可调用平台模型（已弃用）",
+                "deprecated": true,
                 "responses": {
                     "200": {
                         "description": "OK",
@@ -7345,12 +7393,6 @@
                             "$ref": "#/definitions/httpapi.PlatformModelListResponse"
                         }
                     },
-                    "400": {
-                        "description": "Bad Request",
-                        "schema": {
-                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
-                        }
-                    },
                     "401": {
                         "description": "Unauthorized",
                         "schema": {
@@ -7362,12 +7404,6 @@
                         "schema": {
                             "$ref": "#/definitions/httpapi.ErrorEnvelope"
                         }
-                    },
-                    "502": {
-                        "description": "Bad Gateway",
-                        "schema": {
-                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
-                        }
                     }
                 }
             }
@@ -7682,6 +7718,67 @@
                 }
             }
         },
+        "/api/v1/platform-models": {
+            "get": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "按当前用户权限返回可用于 Playground 或 API 调用的模型列表。",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "playground"
+                ],
+                "summary": "列出可调用模型",
+                "parameters": [
+                    {
+                        "enum": [
+                            "canvas_model_node",
+                            "desktop"
+                        ],
+                        "type": "string",
+                        "description": "模型可选场景；不传时保持原有行为",
+                        "name": "usage_scene",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.PlatformModelListResponse"
+                        }
+                    },
+                    "400": {
+                        "description": "Bad Request",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "401": {
+                        "description": "Unauthorized",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "502": {
+                        "description": "Bad Gateway",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    }
+                }
+            }
+        },
         "/api/v1/platforms": {
             "get": {
                 "security": [
@@ -10240,6 +10337,43 @@
                     }
                 }
             }
+        },
+        "/v1/models": {
+            "get": {
+                "security": [
+                    {
+                        "BearerAuth": []
+                    }
+                ],
+                "description": "按当前身份、API Key 访问规则及 scope 返回去重后的逻辑模型列表。",
+                "produces": [
+                    "application/json"
+                ],
+                "tags": [
+                    "openai-compatible"
+                ],
+                "summary": "列出 OpenAI 兼容模型",
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.OpenAIModelListResponse"
+                        }
+                    },
+                    "401": {
+                        "description": "Unauthorized",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    },
+                    "500": {
+                        "description": "Internal Server Error",
+                        "schema": {
+                            "$ref": "#/definitions/httpapi.ErrorEnvelope"
+                        }
+                    }
+                }
+            }
         }
     },
     "definitions": {
@@ -10314,6 +10448,23 @@
                 }
             }
         },
+        "httpapi.APIKeyAssignableModelsResponse": {
+            "type": "object",
+            "properties": {
+                "items": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/store.PlatformModel"
+                    }
+                },
+                "ruleDiagnostics": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/store.APIKeyAccessRuleDiagnostic"
+                    }
+                }
+            }
+        },
         "httpapi.APIKeyListResponse": {
             "type": "object",
             "properties": {
@@ -11674,6 +11825,42 @@
                 }
             }
         },
+        "httpapi.OpenAIModel": {
+            "type": "object",
+            "properties": {
+                "created": {
+                    "type": "integer",
+                    "example": 1710000000
+                },
+                "id": {
+                    "type": "string",
+                    "example": "gpt-4o-mini"
+                },
+                "object": {
+                    "type": "string",
+                    "example": "model"
+                },
+                "owned_by": {
+                    "type": "string",
+                    "example": "easyai"
+                }
+            }
+        },
+        "httpapi.OpenAIModelListResponse": {
+            "type": "object",
+            "properties": {
+                "data": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/httpapi.OpenAIModel"
+                    }
+                },
+                "object": {
+                    "type": "string",
+                    "example": "list"
+                }
+            }
+        },
         "httpapi.PlatformListResponse": {
             "type": "object",
             "properties": {
@@ -13123,6 +13310,37 @@
                 }
             }
         },
+        "store.APIKeyAccessRuleDiagnostic": {
+            "type": "object",
+            "properties": {
+                "effect": {
+                    "type": "string"
+                },
+                "effective": {
+                    "type": "boolean"
+                },
+                "reason": {
+                    "type": "string",
+                    "enum": [
+                        "resource_unavailable",
+                        "owner_access_revoked",
+                        "scope_not_allowed"
+                    ]
+                },
+                "resourceId": {
+                    "type": "string"
+                },
+                "resourceName": {
+                    "type": "string"
+                },
+                "resourceType": {
+                    "type": "string"
+                },
+                "ruleId": {
+                    "type": "string"
+                }
+            }
+        },
         "store.AcceptanceRun": {
             "type": "object",
             "properties": {

apps/api/docs/swagger.yaml

@@ -47,6 +47,17 @@ definitions:
       username:
         type: string
     type: object
+  httpapi.APIKeyAssignableModelsResponse:
+    properties:
+      items:
+        items:
+          $ref: '#/definitions/store.PlatformModel'
+        type: array
+      ruleDiagnostics:
+        items:
+          $ref: '#/definitions/store.APIKeyAccessRuleDiagnostic'
+        type: array
+    type: object
   httpapi.APIKeyListResponse:
     properties:
       items:
@@ -989,6 +1000,31 @@ definitions:
           $ref: '#/definitions/httpapi.OpenAIImageData'
         type: array
     type: object
+  httpapi.OpenAIModel:
+    properties:
+      created:
+        example: 1710000000
+        type: integer
+      id:
+        example: gpt-4o-mini
+        type: string
+      object:
+        example: model
+        type: string
+      owned_by:
+        example: easyai
+        type: string
+    type: object
+  httpapi.OpenAIModelListResponse:
+    properties:
+      data:
+        items:
+          $ref: '#/definitions/httpapi.OpenAIModel'
+        type: array
+      object:
+        example: list
+        type: string
+    type: object
   httpapi.PlatformListResponse:
     properties:
       items:
@@ -1999,6 +2035,27 @@ definitions:
       userId:
         type: string
     type: object
+  store.APIKeyAccessRuleDiagnostic:
+    properties:
+      effect:
+        type: string
+      effective:
+        type: boolean
+      reason:
+        enum:
+        - resource_unavailable
+        - owner_access_revoked
+        - scope_not_allowed
+        type: string
+      resourceId:
+        type: string
+      resourceName:
+        type: string
+      resourceType:
+        type: string
+      ruleId:
+        type: string
+    type: object
   store.AcceptanceRun:
     properties:
       apiImageDigest:
@@ -7879,6 +7936,43 @@ paths:
       summary: 删除 API Key
       tags:
       - api-keys
+  /api/v1/api-keys/{apiKeyID}/assignable-models:
+    get:
+      description: 返回指定 API Key 所属用户组允许、全局启用且符合 KEY scope 的平台来源，并附带已有规则有效性诊断。
+      parameters:
+      - description: API Key ID
+        in: path
+        name: apiKeyID
+        required: true
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/httpapi.APIKeyAssignableModelsResponse'
+        "401":
+          description: Unauthorized
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "404":
+          description: Not Found
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "503":
+          description: Service Unavailable
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      security:
+      - BearerAuth: []
+      summary: 列出指定 API Key 可分配模型
+      tags:
+      - api-keys
   /api/v1/api-keys/{apiKeyID}/disable:
     patch:
       description: 禁用当前用户拥有的 API Key，保留记录但不再允许调用。
@@ -8038,6 +8132,7 @@ paths:
       - api-keys
   /api/v1/api-keys/assignable-models:
     get:
+      deprecated: true
       description: 按当前用户自身的用户、租户和用户组权限返回可分配给 API Key 的启用模型，不受任何 API Key 权限规则影响。
       produces:
       - application/json
@@ -8954,15 +9049,8 @@ paths:
       - model-catalog
   /api/v1/models:
     get:
-      description: 按当前用户权限返回可用于 Playground 或 API 调用的模型列表。
-      parameters:
-      - description: 模型可选场景；不传时保持原有行为
-        enum:
-        - canvas_model_node
-        - desktop
-        in: query
-        name: usage_scene
-        type: string
+      deprecated: true
+      description: 兼容期 rich 平台来源明细；新客户端应改用 /api/v1/platform-models，OpenAI 客户端使用 /v1/models。
       produces:
       - application/json
       responses:
@@ -8970,10 +9058,6 @@ paths:
           description: OK
           schema:
             $ref: '#/definitions/httpapi.PlatformModelListResponse'
-        "400":
-          description: Bad Request
-          schema:
-            $ref: '#/definitions/httpapi.ErrorEnvelope'
         "401":
           description: Unauthorized
           schema:
@@ -8982,13 +9066,9 @@ paths:
           description: Internal Server Error
           schema:
             $ref: '#/definitions/httpapi.ErrorEnvelope'
-        "502":
-          description: Bad Gateway
-          schema:
-            $ref: '#/definitions/httpapi.ErrorEnvelope'
       security:
       - BearerAuth: []
-      summary: 列出可调用模型
+      summary: 列出可调用平台模型（已弃用）
       tags:
       - playground
   /api/v1/models/{model}:generateContent:
@@ -9195,6 +9275,45 @@ paths:
       summary: 获取 AI Gateway Swagger YAML
       tags:
       - agent-resources
+  /api/v1/platform-models:
+    get:
+      description: 按当前用户权限返回可用于 Playground 或 API 调用的模型列表。
+      parameters:
+      - description: 模型可选场景；不传时保持原有行为
+        enum:
+        - canvas_model_node
+        - desktop
+        in: query
+        name: usage_scene
+        type: string
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/httpapi.PlatformModelListResponse'
+        "400":
+          description: Bad Request
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "401":
+          description: Unauthorized
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "502":
+          description: Bad Gateway
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      security:
+      - BearerAuth: []
+      summary: 列出可调用模型
+      tags:
+      - playground
   /api/v1/platforms:
     get:
       description: 按当前用户可访问模型过滤平台，仅返回启用且存在可访问模型的平台。
@@ -10853,6 +10972,29 @@ paths:
       summary: 获取本地上传资源
       tags:
       - static
+  /v1/models:
+    get:
+      description: 按当前身份、API Key 访问规则及 scope 返回去重后的逻辑模型列表。
+      produces:
+      - application/json
+      responses:
+        "200":
+          description: OK
+          schema:
+            $ref: '#/definitions/httpapi.OpenAIModelListResponse'
+        "401":
+          description: Unauthorized
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+        "500":
+          description: Internal Server Error
+          schema:
+            $ref: '#/definitions/httpapi.ErrorEnvelope'
+      security:
+      - BearerAuth: []
+      summary: 列出 OpenAI 兼容模型
+      tags:
+      - openai-compatible
 schemes:
 - http
 - https

apps/api/internal/httpapi/access_rule_handlers.go

@@ -64,12 +64,14 @@ func (s *Server) listAPIKeyAccessRules(w http.ResponseWriter, r *http.Request) {
 // @Tags api-keys
 // @Produce json
 // @Security BearerAuth
+// @Deprecated
 // @Success 200 {object} PlatformModelListResponse
 // @Failure 401 {object} ErrorEnvelope
 // @Failure 503 {object} ErrorEnvelope
 // @Failure 500 {object} ErrorEnvelope
 // @Router /api/v1/api-keys/assignable-models [get]
 func (s *Server) listAPIKeyAssignableModels(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Deprecation", "true")
 	user, _ := auth.UserFromContext(r.Context())
 	models, err := s.store.ListAPIKeyAssignablePlatformModels(r.Context(), user)
 	if err != nil {
@@ -84,6 +86,41 @@ func (s *Server) listAPIKeyAssignableModels(w http.ResponseWriter, r *http.Reque
 	writeJSON(w, http.StatusOK, map[string]any{"items": s.platformModelResponses(r.Context(), models)})
 }
 
+// listAPIKeyAssignableModelsForKey godoc
+// @Summary 列出指定 API Key 可分配模型
+// @Description 返回指定 API Key 所属用户组允许、全局启用且符合 KEY scope 的平台来源，并附带已有规则有效性诊断。
+// @Tags api-keys
+// @Produce json
+// @Security BearerAuth
+// @Param apiKeyID path string true "API Key ID"
+// @Success 200 {object} APIKeyAssignableModelsResponse
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 404 {object} ErrorEnvelope
+// @Failure 503 {object} ErrorEnvelope
+// @Failure 500 {object} ErrorEnvelope
+// @Router /api/v1/api-keys/{apiKeyID}/assignable-models [get]
+func (s *Server) listAPIKeyAssignableModelsForKey(w http.ResponseWriter, r *http.Request) {
+	user, _ := auth.UserFromContext(r.Context())
+	models, diagnostics, err := s.store.ListAPIKeyAssignablePlatformModelsForKey(r.Context(), user, r.PathValue("apiKeyID"))
+	if err != nil {
+		if errors.Is(err, store.ErrLocalUserRequired) {
+			writeLocalUserRequired(w)
+			return
+		}
+		if store.IsNotFound(err) {
+			writeError(w, http.StatusNotFound, "api key not found")
+			return
+		}
+		s.logger.Error("list api key assignable models failed", "error", err)
+		writeError(w, http.StatusInternalServerError, "list api key assignable models failed")
+		return
+	}
+	writeJSON(w, http.StatusOK, APIKeyAssignableModelsResponse{
+		Items:           s.platformModelResponses(r.Context(), models),
+		RuleDiagnostics: diagnostics,
+	})
+}
+
 // createAccessRule godoc
 // @Summary 创建访问规则
 // @Description 管理端创建一条访问控制规则。
@@ -192,7 +229,7 @@ func (s *Server) batchAPIKeyAccessRules(w http.ResponseWriter, r *http.Request)
 			return
 		}
 		if errors.Is(err, store.ErrAccessRuleResourceDenied) {
-			writeError(w, http.StatusForbidden, "resource is not available for current user group")
+			writeError(w, http.StatusForbidden, "resource is not available for current user group or API key scope")
 			return
 		}
 		s.logger.Error("batch api key access rules failed", "error", err)

apps/api/internal/httpapi/api_key_model_access_integration_test.go

@@ -0,0 +1,457 @@
+package httpapi
+
+import (
+	"context"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/config"
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+type modelAccessFixture struct {
+	ID        string   `json:"id"`
+	ModelName string   `json:"modelName"`
+	ModelType []string `json:"modelType"`
+}
+
+type modelAccessRuleDiagnostic struct {
+	RuleID     string `json:"ruleId"`
+	ResourceID string `json:"resourceId"`
+	Effective  bool   `json:"effective"`
+	Reason     string `json:"reason"`
+}
+
+type modelAccessAssignableResponse struct {
+	Items           []modelAccessFixture        `json:"items"`
+	RuleDiagnostics []modelAccessRuleDiagnostic `json:"ruleDiagnostics"`
+}
+
+func TestAPIKeyModelAccessUsesGroupKeyAndScopeLayers(t *testing.T) {
+	databaseURL := strings.TrimSpace(os.Getenv("AI_GATEWAY_TEST_DATABASE_URL"))
+	if databaseURL == "" {
+		t.Skip("set AI_GATEWAY_TEST_DATABASE_URL to run the API key model access integration flow")
+	}
+	ctx := context.Background()
+	applyMigration(t, ctx, databaseURL)
+	db, err := store.Connect(ctx, databaseURL)
+	if err != nil {
+		t.Fatalf("connect store: %v", err)
+	}
+	defer db.Close()
+
+	serverCtx, cancelServer := context.WithCancel(ctx)
+	defer cancelServer()
+	server := httptest.NewServer(NewServerWithContext(serverCtx, config.Config{
+		AppEnv:            "test",
+		HTTPAddr:          ":0",
+		DatabaseURL:       databaseURL,
+		IdentityMode:      "hybrid",
+		JWTSecret:         "test-secret",
+		CORSAllowedOrigin: "*",
+	}, db, slog.New(slog.NewTextHandler(io.Discard, nil))))
+	defer server.Close()
+
+	pool, err := pgxpool.New(ctx, databaseURL)
+	if err != nil {
+		t.Fatalf("connect test pool: %v", err)
+	}
+	defer pool.Close()
+
+	suffix := strconv.FormatInt(time.Now().UnixNano(), 10)
+	register := func(prefix string) (string, string) {
+		t.Helper()
+		username := prefix + "_" + suffix
+		password := "password123"
+		var registered struct {
+			AccessToken string `json:"accessToken"`
+		}
+		doJSON(t, server.URL, http.MethodPost, "/api/v1/auth/register", "", map[string]any{
+			"username": username,
+			"email":    username + "@example.com",
+			"password": password,
+		}, http.StatusCreated, &registered)
+		return username, password
+	}
+	login := func(username string, password string) string {
+		t.Helper()
+		var response struct {
+			AccessToken string `json:"accessToken"`
+		}
+		doJSON(t, server.URL, http.MethodPost, "/api/v1/auth/login", "", map[string]any{
+			"account": username, "password": password,
+		}, http.StatusOK, &response)
+		return response.AccessToken
+	}
+	adminName, adminPassword := register("layered_admin")
+	userBName, userBPassword := register("layered_user_b")
+	if _, err := pool.Exec(ctx, `UPDATE gateway_users SET roles = '["admin"]'::jsonb WHERE username = $1`, adminName); err != nil {
+		t.Fatalf("promote admin: %v", err)
+	}
+	adminToken := login(adminName, adminPassword)
+
+	createGroup := func(key string) string {
+		t.Helper()
+		var group struct {
+			ID string `json:"id"`
+		}
+		doJSON(t, server.URL, http.MethodPost, "/api/admin/user-groups", adminToken, map[string]any{
+			"groupKey": key + "-" + suffix,
+			"name":     key,
+			"source":   "gateway",
+			"status":   "active",
+		}, http.StatusCreated, &group)
+		return group.ID
+	}
+	groupAID := createGroup("layered-group-a")
+	groupBID := createGroup("layered-group-b")
+	if _, err := pool.Exec(ctx, `UPDATE gateway_users SET default_user_group_id = $1::uuid WHERE username = $2`, groupAID, adminName); err != nil {
+		t.Fatalf("assign group A: %v", err)
+	}
+	if _, err := pool.Exec(ctx, `UPDATE gateway_users SET default_user_group_id = $1::uuid WHERE username = $2`, groupBID, userBName); err != nil {
+		t.Fatalf("assign group B: %v", err)
+	}
+	adminToken = login(adminName, adminPassword)
+	userBToken := login(userBName, userBPassword)
+
+	createKey := func(token string, name string, scopes []string) (string, string) {
+		t.Helper()
+		var created struct {
+			APIKey struct {
+				ID string `json:"id"`
+			} `json:"apiKey"`
+			Secret string `json:"secret"`
+		}
+		doJSON(t, server.URL, http.MethodPost, "/api/v1/api-keys", token, map[string]any{
+			"name": name, "scopes": scopes,
+		}, http.StatusCreated, &created)
+		return created.APIKey.ID, created.Secret
+	}
+	keyAID, keyASecret := createKey(adminToken, "group A image key", []string{"image"})
+	keyAInheritedID, keyAInheritedSecret := createKey(adminToken, "group A inherited image key", []string{"image"})
+	keyMultiID, keyMultiSecret := createKey(adminToken, "group A multi-source image key", []string{"image"})
+	keyScopeID, _ := createKey(adminToken, "group A narrowed scope key", []string{"all"})
+	keyLegacyID, _ := createKey(adminToken, "group A narrowed group key", []string{"all"})
+	keyBID, keyBSecret := createKey(userBToken, "group B chat key", []string{"chat"})
+	keyBImageID, keyBImageSecret := createKey(userBToken, "group B image key", []string{"image"})
+
+	createSimulationBaseModel(t, server.URL, adminToken, "layered-text-"+suffix, []string{"text_generate"})
+	createSimulationBaseModel(t, server.URL, adminToken, "layered-image-"+suffix, []string{"image_generate"})
+	createSimulationBaseModel(t, server.URL, adminToken, "layered-multi-"+suffix, []string{"text_generate", "image_generate"})
+	createSimulationBaseModel(t, server.URL, adminToken, "layered-key-deny-image-"+suffix, []string{"image_generate"})
+	createSimulationBaseModel(t, server.URL, adminToken, "layered-group-b-image-"+suffix, []string{"image_generate"})
+	createSimulationBaseModel(t, server.URL, adminToken, "layered-scope-text-"+suffix, []string{"text_generate"})
+	createSimulationBaseModel(t, server.URL, adminToken, "layered-legacy-text-"+suffix, []string{"text_generate"})
+
+	createPlatform := func(key string, status string) string {
+		t.Helper()
+		var platform struct {
+			ID string `json:"id"`
+		}
+		doJSON(t, server.URL, http.MethodPost, "/api/admin/platforms", adminToken, map[string]any{
+			"provider":    "openai",
+			"platformKey": key + "-" + suffix,
+			"name":        key,
+			"baseUrl":     "https://api.openai.com/v1",
+			"authType":    "bearer",
+			"credentials": map[string]any{"mode": "simulation"},
+			"config":      map[string]any{"testMode": true},
+			"status":      status,
+		}, http.StatusCreated, &platform)
+		return platform.ID
+	}
+	enabledPlatformID := createPlatform("layered-enabled", "enabled")
+	secondPlatformID := createPlatform("layered-second", "enabled")
+	disabledPlatformID := createPlatform("layered-disabled", "disabled")
+
+	createModel := func(platformID string, modelName string, modelTypes []string) modelAccessFixture {
+		t.Helper()
+		var model modelAccessFixture
+		doJSON(t, server.URL, http.MethodPost, "/api/admin/platforms/"+platformID+"/models", adminToken, map[string]any{
+			"canonicalModelKey": "openai:" + modelName,
+			"modelName":         modelName,
+			"modelAlias":        modelName,
+			"modelType":         modelTypes,
+			"displayName":       modelName,
+		}, http.StatusCreated, &model)
+		return model
+	}
+	textName := "layered-text-" + suffix
+	imageName := "layered-image-" + suffix
+	multiName := "layered-multi-" + suffix
+	keyDenyImageName := "layered-key-deny-image-" + suffix
+	groupBImageName := "layered-group-b-image-" + suffix
+	scopeTextName := "layered-scope-text-" + suffix
+	legacyTextName := "layered-legacy-text-" + suffix
+	textModel := createModel(enabledPlatformID, textName, []string{"text_generate"})
+	imageModel := createModel(enabledPlatformID, imageName, []string{"image_generate"})
+	multiModel := createModel(enabledPlatformID, multiName, []string{"text_generate", "image_generate"})
+	multiSecondModel := createModel(secondPlatformID, multiName, []string{"text_generate", "image_generate"})
+	disabledImageModel := createModel(disabledPlatformID, imageName, []string{"image_generate"})
+	keyDenyImageModel := createModel(enabledPlatformID, keyDenyImageName, []string{"image_generate"})
+	groupBImageModel := createModel(enabledPlatformID, groupBImageName, []string{"image_generate"})
+	scopeTextModel := createModel(enabledPlatformID, scopeTextName, []string{"text_generate"})
+	legacyTextModel := createModel(enabledPlatformID, legacyTextName, []string{"text_generate"})
+
+	createRule := func(subjectType string, subjectID string, resourceID string, effect string) {
+		t.Helper()
+		doJSON(t, server.URL, http.MethodPost, "/api/admin/access-rules", adminToken, map[string]any{
+			"subjectType": subjectType, "subjectId": subjectID,
+			"resourceType": "platform_model", "resourceId": resourceID,
+			"effect": effect, "priority": 10, "status": "active",
+		}, http.StatusCreated, nil)
+	}
+	batchKeyRule := func(ownerToken string, keyID string, resourceID string, effect string, expectedStatus int) {
+		t.Helper()
+		doJSON(t, server.URL, http.MethodPost, "/api/v1/api-keys/access-rules/batch", ownerToken, map[string]any{
+			"subjectType": "api_key", "subjectId": keyID, "effect": effect,
+			"upsertResources": []map[string]any{{"resourceType": "platform_model", "resourceId": resourceID, "status": "active"}},
+			"deleteResources": []map[string]any{},
+		}, expectedStatus, nil)
+	}
+	// Create valid legacy rules first, then narrow the group or scope. The rows
+	// must remain for diagnostics while becoming ineffective globally.
+	batchKeyRule(adminToken, keyLegacyID, legacyTextModel.ID, "allow", http.StatusOK)
+	batchKeyRule(adminToken, keyScopeID, scopeTextModel.ID, "allow", http.StatusOK)
+	createRule("user_group", groupAID, imageModel.ID, "allow")
+	createRule("user_group", groupAID, textModel.ID, "deny")
+	createRule("user_group", groupAID, legacyTextModel.ID, "deny")
+	createRule("user_group", groupBID, groupBImageModel.ID, "allow")
+	doJSON(t, server.URL, http.MethodPatch, "/api/v1/api-keys/"+keyScopeID+"/scopes", adminToken, map[string]any{
+		"scopes": []string{"image"},
+	}, http.StatusOK, nil)
+	// Admin-created historical rules can refer to resources that are no longer
+	// assignable. They are retained but cannot expand or reserve the resource.
+	createRule("api_key", keyAID, textModel.ID, "allow")
+	createRule("api_key", keyScopeID, disabledImageModel.ID, "allow")
+	batchKeyRule(adminToken, keyAID, imageModel.ID, "allow", http.StatusOK)
+	batchKeyRule(adminToken, keyAID, keyDenyImageModel.ID, "deny", http.StatusOK)
+
+	loadAssignable := func(token string, keyID string) modelAccessAssignableResponse {
+		t.Helper()
+		var response modelAccessAssignableResponse
+		doJSON(t, server.URL, http.MethodGet, "/api/v1/api-keys/"+keyID+"/assignable-models", token, nil, http.StatusOK, &response)
+		return response
+	}
+	assignable := loadAssignable(adminToken, keyAID)
+	if containsModelID(assignable.Items, textModel.ID) {
+		t.Fatalf("group-denied text model leaked into key candidates: %+v", assignable.Items)
+	}
+	if !containsModelID(assignable.Items, imageModel.ID) || !containsModelID(assignable.Items, multiModel.ID) {
+		t.Fatalf("image-scope key candidates missing allowed models: %+v", assignable.Items)
+	}
+	if !containsModelID(assignable.Items, keyDenyImageModel.ID) {
+		t.Fatalf("key rules incorrectly removed a model from the assignable set: %+v", assignable.Items)
+	}
+	if containsModelID(assignable.Items, disabledImageModel.ID) || containsModelID(assignable.Items, groupBImageModel.ID) {
+		t.Fatalf("disabled or another-group-exclusive source leaked into assignable models: %+v", assignable.Items)
+	}
+	for _, model := range assignable.Items {
+		if model.ID == multiModel.ID && (len(model.ModelType) != 1 || model.ModelType[0] != "image_generate") {
+			t.Fatalf("multi-capability model was not scope-pruned: %+v", model)
+		}
+	}
+	foundRevoked := false
+	for _, diagnostic := range assignable.RuleDiagnostics {
+		if !diagnostic.Effective && diagnostic.Reason == "owner_access_revoked" {
+			foundRevoked = true
+		}
+	}
+	if !foundRevoked {
+		t.Fatalf("stale key rule diagnostic missing: %+v", assignable.RuleDiagnostics)
+	}
+	scopeDiagnostics := loadAssignable(adminToken, keyScopeID).RuleDiagnostics
+	if !containsDiagnosticReason(scopeDiagnostics, "scope_not_allowed") || !containsDiagnosticReason(scopeDiagnostics, "resource_unavailable") {
+		t.Fatalf("scope/resource diagnostics missing after narrowing: %+v", scopeDiagnostics)
+	}
+	legacyDiagnostics := loadAssignable(adminToken, keyLegacyID).RuleDiagnostics
+	if !containsDiagnosticReason(legacyDiagnostics, "owner_access_revoked") {
+		t.Fatalf("group-narrowed rule diagnostic missing: %+v", legacyDiagnostics)
+	}
+	t.Logf("候选与诊断：keyA=%d models, diagnostics=%d; scope=%v; legacy=%v", len(assignable.Items), len(assignable.RuleDiagnostics), diagnosticReasons(scopeDiagnostics), diagnosticReasons(legacyDiagnostics))
+
+	// The regular key rule endpoint must reject the same group-denied resource.
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/api-keys/access-rules/batch", adminToken, map[string]any{
+		"subjectType": "api_key", "subjectId": keyAID, "effect": "allow",
+		"upsertResources": []map[string]any{{"resourceType": "platform_model", "resourceId": textModel.ID, "status": "active"}},
+		"deleteResources": []map[string]any{},
+	}, http.StatusForbidden, nil)
+
+	var platformModels struct {
+		Items []modelAccessFixture `json:"items"`
+	}
+	doJSON(t, server.URL, http.MethodGet, "/api/v1/platform-models", keyASecret, nil, http.StatusOK, &platformModels)
+	if containsModelID(platformModels.Items, textModel.ID) {
+		t.Fatalf("group-denied text model leaked into key model list: %+v", platformModels.Items)
+	}
+	if !containsModelID(platformModels.Items, imageModel.ID) || containsModelID(platformModels.Items, keyDenyImageModel.ID) || containsModelID(platformModels.Items, disabledImageModel.ID) {
+		t.Fatalf("key allow/deny or global availability was not reflected in rich list: %+v", platformModels.Items)
+	}
+	if !containsModelID(loadAssignable(adminToken, keyAInheritedID).Items, imageModel.ID) {
+		t.Fatalf("assignable list must ignore another key's exclusive rule")
+	}
+	var inheritedPlatformModels struct {
+		Items []modelAccessFixture `json:"items"`
+	}
+	doJSON(t, server.URL, http.MethodGet, "/api/v1/platform-models", keyAInheritedSecret, nil, http.StatusOK, &inheritedPlatformModels)
+	if containsModelID(inheritedPlatformModels.Items, imageModel.ID) || !containsModelID(inheritedPlatformModels.Items, keyDenyImageModel.ID) {
+		t.Fatalf("key exclusive/deny isolation mismatch for sibling key: %+v", inheritedPlatformModels.Items)
+	}
+	groupBAssignable := loadAssignable(userBToken, keyBImageID)
+	if containsModelID(groupBAssignable.Items, imageModel.ID) || !containsModelID(groupBAssignable.Items, groupBImageModel.ID) {
+		t.Fatalf("group exclusive rules were not applied to key candidates: %+v", groupBAssignable.Items)
+	}
+	var groupBChatModels struct {
+		Items []modelAccessFixture `json:"items"`
+	}
+	doJSON(t, server.URL, http.MethodGet, "/api/v1/platform-models", keyBSecret, nil, http.StatusOK, &groupBChatModels)
+	for _, model := range []modelAccessFixture{textModel, scopeTextModel, legacyTextModel} {
+		if !containsModelID(groupBChatModels.Items, model.ID) {
+			t.Fatalf("stale key/group-A rule blocked group B model %s: %+v", model.ID, groupBChatModels.Items)
+		}
+	}
+	t.Logf("用户组与 KEY 隔离：keyA rich=%d, sibling rich=%d, groupB image candidates=%d", len(platformModels.Items), len(inheritedPlatformModels.Items), len(groupBAssignable.Items))
+
+	var openAIList struct {
+		Object string `json:"object"`
+		Data   []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	doJSON(t, server.URL, http.MethodGet, "/v1/models", keyASecret, nil, http.StatusOK, &openAIList)
+	if openAIList.Object != "list" || countOpenAIModel(openAIList.Data, multiName) != 1 {
+		t.Fatalf("openai model list is not deduplicated: %+v", openAIList)
+	}
+	legacyHeaders := doJSONWithHeaders(t, server.URL, http.MethodGet, "/api/v1/models", keyASecret, nil, nil, http.StatusOK, &platformModels)
+	if legacyHeaders.Get("Deprecation") != "true" || !strings.Contains(legacyHeaders.Get("Link"), "/api/v1/platform-models") {
+		t.Fatalf("legacy model list deprecation headers missing: %+v", legacyHeaders)
+	}
+
+	// Two sources with the same logical name collapse to one OpenAI model. A
+	// source-level deny removes only that source until the final source is gone.
+	var multiRich struct {
+		Items []modelAccessFixture `json:"items"`
+	}
+	doJSON(t, server.URL, http.MethodGet, "/api/v1/platform-models", keyMultiSecret, nil, http.StatusOK, &multiRich)
+	if countRichModel(multiRich.Items, multiName) != 2 {
+		t.Fatalf("expected two initial rich sources for %s: %+v", multiName, multiRich.Items)
+	}
+	batchKeyRule(adminToken, keyMultiID, multiModel.ID, "deny", http.StatusOK)
+	doJSON(t, server.URL, http.MethodGet, "/api/v1/platform-models", keyMultiSecret, nil, http.StatusOK, &multiRich)
+	if countRichModel(multiRich.Items, multiName) != 1 || containsModelID(multiRich.Items, multiModel.ID) || !containsModelID(multiRich.Items, multiSecondModel.ID) {
+		t.Fatalf("first source deny did not leave exactly the second source: %+v", multiRich.Items)
+	}
+	var multiOpenAI struct {
+		Object string `json:"object"`
+		Data   []struct {
+			ID string `json:"id"`
+		} `json:"data"`
+	}
+	doJSON(t, server.URL, http.MethodGet, "/v1/models", keyMultiSecret, nil, http.StatusOK, &multiOpenAI)
+	if countOpenAIModel(multiOpenAI.Data, multiName) != 1 {
+		t.Fatalf("logical model disappeared while one source remained: %+v", multiOpenAI.Data)
+	}
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/images/generations", keyMultiSecret, map[string]any{
+		"model": multiName, "prompt": "layered multi source", "runMode": "simulation", "simulation": true,
+	}, http.StatusOK, nil)
+	batchKeyRule(adminToken, keyMultiID, multiSecondModel.ID, "deny", http.StatusOK)
+	doJSON(t, server.URL, http.MethodGet, "/v1/models", keyMultiSecret, nil, http.StatusOK, &multiOpenAI)
+	if countOpenAIModel(multiOpenAI.Data, multiName) != 0 {
+		t.Fatalf("logical model remained after all sources were denied: %+v", multiOpenAI.Data)
+	}
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/images/generations", keyMultiSecret, map[string]any{
+		"model": multiName, "prompt": "no sources", "runMode": "simulation", "simulation": true,
+	}, http.StatusNotFound, nil)
+	t.Logf("多来源模型：初始来源=2，排除一个后 OpenAI 逻辑模型=1，全部排除后=0；调用状态=200/404")
+
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/images/generations", keyASecret, map[string]any{
+		"model": imageName, "prompt": "exclusive key", "runMode": "simulation", "simulation": true,
+	}, http.StatusOK, nil)
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/images/generations", keyAInheritedSecret, map[string]any{
+		"model": imageName, "prompt": "sibling key", "runMode": "simulation", "simulation": true,
+	}, http.StatusNotFound, nil)
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/images/generations", keyASecret, map[string]any{
+		"model": keyDenyImageName, "prompt": "key deny", "runMode": "simulation", "simulation": true,
+	}, http.StatusNotFound, nil)
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/images/generations", keyBImageSecret, map[string]any{
+		"model": groupBImageName, "prompt": "group B exclusive", "runMode": "simulation", "simulation": true,
+	}, http.StatusOK, nil)
+	t.Logf("实际调用：KEY 专属 200，兄弟 KEY 404，KEY 排除 404，组 B 专属 200")
+
+	// Group B can still use text: stale allows whose owners lost group access or
+	// scope are removed from the global exclusive set.
+	if !containsModelID(loadAssignable(userBToken, keyBID).Items, textModel.ID) {
+		t.Fatalf("group B chat key candidate list lost the group-A denied model")
+	}
+	for _, modelName := range []string{textName, scopeTextName, legacyTextName} {
+		doJSON(t, server.URL, http.MethodPost, "/api/v1/chat/completions", keyBSecret, map[string]any{
+			"model": modelName, "messages": []map[string]any{{"role": "user", "content": "layered access"}},
+			"runMode": "simulation", "simulation": true,
+		}, http.StatusOK, nil)
+	}
+	t.Logf("失效旧规则：组 B 对 3 个文本模型的 simulation 调用均为 200")
+
+	// The image-only key is rejected before candidate selection for chat.
+	doJSON(t, server.URL, http.MethodPost, "/api/v1/chat/completions", keyASecret, map[string]any{
+		"model": multiName, "messages": []map[string]any{{"role": "user", "content": "scope denial"}},
+	}, http.StatusForbidden, nil)
+	t.Logf("scope：image KEY 的多能力候选仅保留 image_generate；图像调用 200，文本调用 403")
+}
+
+func containsModelID(items []modelAccessFixture, id string) bool {
+	for _, item := range items {
+		if item.ID == id {
+			return true
+		}
+	}
+	return false
+}
+
+func countRichModel(items []modelAccessFixture, modelName string) int {
+	count := 0
+	for _, item := range items {
+		if item.ModelName == modelName {
+			count++
+		}
+	}
+	return count
+}
+
+func containsDiagnosticReason(items []modelAccessRuleDiagnostic, reason string) bool {
+	for _, item := range items {
+		if !item.Effective && item.Reason == reason {
+			return true
+		}
+	}
+	return false
+}
+
+func diagnosticReasons(items []modelAccessRuleDiagnostic) []string {
+	reasons := make([]string, 0, len(items))
+	for _, item := range items {
+		if !item.Effective {
+			reasons = append(reasons, item.Reason)
+		}
+	}
+	return reasons
+}
+
+func countOpenAIModel(items []struct {
+	ID string `json:"id"`
+}, id string) int {
+	count := 0
+	for _, item := range items {
+		if item.ID == id {
+			count++
+		}
+	}
+	return count
+}

apps/api/internal/httpapi/handlers.go

@@ -13,6 +13,7 @@ import (
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/clients"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/identity"
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/modelaccess"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/netproxy"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/runner"
 	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
@@ -641,7 +642,7 @@ func (s *Server) listModels(w http.ResponseWriter, r *http.Request) {
 // @Failure 401 {object} ErrorEnvelope
 // @Failure 502 {object} ErrorEnvelope
 // @Failure 500 {object} ErrorEnvelope
-// @Router /api/v1/models [get]
+// @Router /api/v1/platform-models [get]
 // @Router /api/v1/playground/models [get]
 func (s *Server) listPlayableModels(w http.ResponseWriter, r *http.Request) {
 	usageScene, err := parseModelUsageSceneQuery(r.URL.Query())
@@ -1610,41 +1611,10 @@ func writeTaskAccepted(w http.ResponseWriter, task store.GatewayTask) {
 }
 
 func apiKeyScopeAllowed(user *auth.User, kind string) bool {
-	if user == nil || strings.TrimSpace(user.APIKeyID) == "" || len(user.APIKeyScopes) == 0 {
+	if user == nil || strings.TrimSpace(user.APIKeyID) == "" {
 		return true
 	}
-	required := scopeForTaskKind(kind)
-	for _, scope := range user.APIKeyScopes {
-		scope = strings.TrimSpace(strings.ToLower(scope))
-		if scope == "*" || scope == "all" || scope == required {
-			return true
-		}
-		if required == "chat" && (scope == "text" || scope == "text_generate") {
-			return true
-		}
-		if required == "embedding" && scope == "text_embedding" {
-			return true
-		}
-		if required == "rerank" && scope == "text_rerank" {
-			return true
-		}
-		if required == "music" && (scope == "audio_generate" || scope == "music_generate" || scope == "song") {
-			return true
-		}
-		if required == "audio" && (scope == "text_to_speech" || scope == "speech" || scope == "tts") {
-			return true
-		}
-		if required == "voice_clone" && (scope == "audio" || scope == "text_to_speech" || scope == "speech" || scope == "tts") {
-			return true
-		}
-		if required == "image_vectorize" && (scope == "image" || scope == "vectorize") {
-			return true
-		}
-		if required == "video_enhance" && (scope == "video" || scope == "video_upscale" || scope == "upscale") {
-			return true
-		}
-	}
-	return false
+	return modelaccess.ScopeAllowsTask(user.APIKeyScopes, kind)
 }
 
 func requestModelName(body map[string]any) string {
@@ -1687,33 +1657,6 @@ func modelNameFromValue(value any) string {
 	return ""
 }
 
-func scopeForTaskKind(kind string) string {
-	switch kind {
-	case "chat.completions", "responses":
-		return "chat"
-	case "embeddings":
-		return "embedding"
-	case "reranks":
-		return "rerank"
-	case "images.generations", "images.edits":
-		return "image"
-	case "images.vectorize":
-		return "image_vectorize"
-	case "videos.generations":
-		return "video"
-	case "videos.upscales":
-		return "video_enhance"
-	case "song.generations", "music.generations":
-		return "music"
-	case "speech.generations":
-		return "audio"
-	case "voice.clone":
-		return "voice_clone"
-	default:
-		return kind
-	}
-}
-
 func statusFromRunError(err error) int {
 	switch {
 	case clients.ErrorCode(err) == "binary_result_expired":

apps/api/internal/httpapi/model_list_handlers.go

@@ -0,0 +1,63 @@
+package httpapi
+
+import (
+	"net/http"
+	"sort"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
+)
+
+// listLegacyPlayableModels godoc
+// @Summary 列出可调用平台模型（已弃用）
+// @Description 兼容期 rich 平台来源明细；新客户端应改用 /api/v1/platform-models，OpenAI 客户端使用 /v1/models。
+// @Tags playground
+// @Produce json
+// @Security BearerAuth
+// @Deprecated
+// @Success 200 {object} PlatformModelListResponse
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 500 {object} ErrorEnvelope
+// @Router /api/v1/models [get]
+func (s *Server) listLegacyPlayableModels(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Deprecation", "true")
+	w.Header().Set("Link", "</api/v1/platform-models>; rel=\"successor-version\"")
+	s.listPlayableModels(w, r)
+}
+
+// listOpenAIModels godoc
+// @Summary 列出 OpenAI 兼容模型
+// @Description 按当前身份、API Key 访问规则及 scope 返回去重后的逻辑模型列表。
+// @Tags openai-compatible
+// @Produce json
+// @Security BearerAuth
+// @Success 200 {object} OpenAIModelListResponse
+// @Failure 401 {object} ErrorEnvelope
+// @Failure 500 {object} ErrorEnvelope
+// @Router /v1/models [get]
+func (s *Server) listOpenAIModels(w http.ResponseWriter, r *http.Request) {
+	user, _ := auth.UserFromContext(r.Context())
+	models, err := s.store.ListAccessiblePlatformModels(r.Context(), user)
+	if err != nil {
+		s.logger.Error("list openai models failed", "error", err)
+		writeError(w, http.StatusInternalServerError, "list models failed")
+		return
+	}
+	byID := map[string]OpenAIModel{}
+	for _, model := range models {
+		id := model.ModelName
+		if id == "" {
+			continue
+		}
+		created := model.CreatedAt.Unix()
+		current, exists := byID[id]
+		if !exists || created < current.Created {
+			byID[id] = OpenAIModel{ID: id, Object: "model", Created: created, OwnedBy: "easyai"}
+		}
+	}
+	data := make([]OpenAIModel, 0, len(byID))
+	for _, model := range byID {
+		data = append(data, model)
+	}
+	sort.Slice(data, func(i, j int) bool { return data[i].ID < data[j].ID })
+	writeJSON(w, http.StatusOK, OpenAIModelListResponse{Object: "list", Data: data})
+}

apps/api/internal/httpapi/openapi_models.go

@@ -107,6 +107,23 @@ type PlatformModelListResponse struct {
 	Items []store.PlatformModel `json:"items"`
 }
 
+type APIKeyAssignableModelsResponse struct {
+	Items           []store.PlatformModel              `json:"items"`
+	RuleDiagnostics []store.APIKeyAccessRuleDiagnostic `json:"ruleDiagnostics"`
+}
+
+type OpenAIModel struct {
+	ID      string `json:"id" example:"gpt-4o-mini"`
+	Object  string `json:"object" example:"model"`
+	Created int64  `json:"created" example:"1710000000"`
+	OwnedBy string `json:"owned_by" example:"easyai"`
+}
+
+type OpenAIModelListResponse struct {
+	Object string        `json:"object" example:"list"`
+	Data   []OpenAIModel `json:"data"`
+}
+
 type CatalogProviderListResponse struct {
 	Items []store.CatalogProvider `json:"items"`
 }

apps/api/internal/httpapi/public_api_prefix_test.go

@@ -44,6 +44,9 @@ func TestOpenAPIPublicRoutesUseCanonicalV1Prefix(t *testing.T) {
 			t.Errorf("legacy public route must not be advertised in OpenAPI: %s", route)
 		}
 		for _, prefix := range legacyPrefixes {
+			if route == "/v1/models" {
+				continue
+			}
 			if strings.HasPrefix(route, prefix) {
 				t.Errorf("legacy public route must not be advertised in OpenAPI: %s", route)
 			}
@@ -61,6 +64,7 @@ func TestOpenAPIPublicRoutesUseCanonicalV1Prefix(t *testing.T) {
 		"/api/v1/videos/generations",
 		"/api/v1/videos/upscales",
 		"/api/v1/pricing/estimate",
+		"/v1/models",
 		"/api/workspace/token-usage/daily",
 		"/api/v1/models/{model}:generateContent",
 		"/api/v1/videos/omni-video",

apps/api/internal/httpapi/server.go

@@ -219,6 +219,7 @@ func NewServerWithStores(
 	mux.Handle("GET /api/v1/api-keys/access-rules", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listAPIKeyAccessRules)))
 	mux.Handle("POST /api/v1/api-keys/access-rules/batch", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.batchAPIKeyAccessRules)))
 	mux.Handle("GET /api/v1/api-keys/assignable-models", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listAPIKeyAssignableModels)))
+	mux.Handle("GET /api/v1/api-keys/{apiKeyID}/assignable-models", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listAPIKeyAssignableModelsForKey)))
 	mux.Handle("PATCH /api/v1/api-keys/{apiKeyID}/scopes", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.updateAPIKeyScopes)))
 	mux.Handle("PATCH /api/v1/api-keys/{apiKeyID}/disable", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.disableAPIKey)))
 	mux.Handle("DELETE /api/v1/api-keys/{apiKeyID}", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.deleteAPIKey)))
@@ -296,8 +297,10 @@ func NewServerWithStores(
 	mux.Handle("GET /api/admin/models", server.requireAdmin(auth.PermissionPower, http.HandlerFunc(server.listModels)))
 	mux.Handle("GET /api/v1/model-catalog", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listModelCatalog)))
 	mux.Handle("GET /api/v1/platforms", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listPlayablePlatforms)))
-	mux.Handle("GET /api/v1/models", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listPlayableModels)))
+	mux.Handle("GET /api/v1/platform-models", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listPlayableModels)))
+	mux.Handle("GET /api/v1/models", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listLegacyPlayableModels)))
 	mux.Handle("GET /api/v1/playground/models", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listPlayableModels)))
+	mux.Handle("GET /v1/models", server.requireUser(auth.PermissionBasic, http.HandlerFunc(server.listOpenAIModels)))
 	mux.Handle("GET /api/admin/runtime/rate-limit-windows", server.requireAdmin(auth.PermissionPower, http.HandlerFunc(server.listRateLimitWindows)))
 	mux.Handle("GET /api/admin/runtime/model-rate-limits", server.requireAdmin(auth.PermissionPower, http.HandlerFunc(server.listModelRateLimitStatuses)))
 	mux.Handle("POST /api/v1/chat/completions", server.requireProtocolUser(clients.ProtocolOpenAIChatCompletions, server.createAPIV1ChatCompletions()))

apps/api/internal/modelaccess/scopes.go

@@ -0,0 +1,166 @@
+package modelaccess
+
+import "strings"
+
+// ScopeAllowsTask reports whether scopes authorize one public task kind.
+// Empty scopes retain the legacy unrestricted behavior for old API keys.
+func ScopeAllowsTask(scopes []string, kind string) bool {
+	if len(scopes) == 0 {
+		return true
+	}
+	return scopeAllowsCapability(scopes, capabilityForTaskKind(kind))
+}
+
+// ScopeAllowsModelType reports whether scopes authorize one runtime model type.
+// Unknown model types are deny-by-default unless the key has all or an exact
+// custom scope matching that model type.
+func ScopeAllowsModelType(scopes []string, modelType string) bool {
+	if len(scopes) == 0 {
+		return true
+	}
+	modelType = normalize(modelType)
+	if modelType == "" {
+		return false
+	}
+	capability := capabilityForModelType(modelType)
+	if capability == "" {
+		return hasScope(scopes, modelType)
+	}
+	return scopeAllowsCapability(scopes, capability)
+}
+
+// FilterModelTypes keeps the declared order while removing model types that
+// the key cannot invoke.
+func FilterModelTypes(scopes []string, modelTypes []string) []string {
+	if len(modelTypes) == 0 {
+		return nil
+	}
+	filtered := make([]string, 0, len(modelTypes))
+	seen := map[string]bool{}
+	for _, modelType := range modelTypes {
+		normalized := normalize(modelType)
+		if normalized == "" || seen[normalized] || !ScopeAllowsModelType(scopes, normalized) {
+			continue
+		}
+		seen[normalized] = true
+		filtered = append(filtered, normalized)
+	}
+	return filtered
+}
+
+func capabilityForTaskKind(kind string) string {
+	switch normalize(kind) {
+	case "chat.completions", "responses":
+		return "chat"
+	case "embeddings":
+		return "embedding"
+	case "reranks":
+		return "rerank"
+	case "images.generations", "images.edits":
+		return "image"
+	case "images.vectorize":
+		return "image_vectorize"
+	case "videos.generations":
+		return "video"
+	case "videos.upscales":
+		return "video_enhance"
+	case "song.generations", "music.generations":
+		return "music"
+	case "speech.generations":
+		return "audio"
+	case "voice.clone":
+		return "voice_clone"
+	default:
+		return normalize(kind)
+	}
+}
+
+func capabilityForModelType(modelType string) string {
+	switch normalize(modelType) {
+	case "text_generate", "tools_call":
+		return "chat"
+	case "text_embedding":
+		return "embedding"
+	case "text_rerank":
+		return "rerank"
+	case "image_generate", "image_edit", "image_analysis":
+		return "image"
+	case "image_vectorize":
+		return "image_vectorize"
+	case "video_generate", "image_to_video", "text_to_video", "video_edit", "video_reference", "video_first_last_frame", "video_understanding", "omni_video", "omni":
+		return "video"
+	case "video_enhance":
+		return "video_enhance"
+	case "audio_generate", "music_generate":
+		return "music"
+	case "text_to_speech", "audio_understanding":
+		return "audio"
+	case "voice_clone":
+		return "voice_clone"
+	default:
+		return ""
+	}
+}
+
+func scopeAllowsCapability(scopes []string, capability string) bool {
+	capability = normalize(capability)
+	if capability == "" {
+		return false
+	}
+	for _, scope := range scopes {
+		scope = normalize(scope)
+		if scope == "*" || scope == "all" || scope == capability {
+			return true
+		}
+		switch capability {
+		case "chat":
+			if scope == "text" || scope == "text_generate" {
+				return true
+			}
+		case "embedding":
+			if scope == "text_embedding" {
+				return true
+			}
+		case "rerank":
+			if scope == "text_rerank" {
+				return true
+			}
+		case "music":
+			if scope == "audio_generate" || scope == "music_generate" || scope == "song" {
+				return true
+			}
+		case "audio":
+			if scope == "text_to_speech" || scope == "speech" || scope == "tts" {
+				return true
+			}
+		case "voice_clone":
+			if scope == "audio" || scope == "text_to_speech" || scope == "speech" || scope == "tts" {
+				return true
+			}
+		case "image_vectorize":
+			if scope == "image" || scope == "vectorize" {
+				return true
+			}
+		case "video_enhance":
+			if scope == "video" || scope == "video_upscale" || scope == "upscale" {
+				return true
+			}
+		}
+	}
+	return false
+}
+
+func hasScope(scopes []string, want string) bool {
+	want = normalize(want)
+	for _, scope := range scopes {
+		scope = normalize(scope)
+		if scope == "*" || scope == "all" || scope == want {
+			return true
+		}
+	}
+	return false
+}
+
+func normalize(value string) string {
+	return strings.ReplaceAll(strings.ToLower(strings.TrimSpace(value)), "-", "_")
+}

apps/api/internal/modelaccess/scopes_test.go

@@ -0,0 +1,122 @@
+package modelaccess
+
+import (
+	"reflect"
+	"testing"
+)
+
+func TestScopeAllowsTaskPreservesAliases(t *testing.T) {
+	tests := []struct {
+		scopes  []string
+		kind    string
+		allowed bool
+	}{
+		{[]string{"chat"}, "responses", true},
+		{[]string{"text_generate"}, "chat.completions", true},
+		{[]string{"image"}, "images.vectorize", true},
+		{[]string{"video"}, "videos.upscales", true},
+		{[]string{"audio_generate"}, "music.generations", true},
+		{[]string{"text_to_speech"}, "speech.generations", true},
+		{[]string{"image"}, "chat.completions", false},
+		{nil, "chat.completions", true},
+	}
+	for _, test := range tests {
+		if got := ScopeAllowsTask(test.scopes, test.kind); got != test.allowed {
+			t.Fatalf("ScopeAllowsTask(%v, %q) = %v, want %v", test.scopes, test.kind, got, test.allowed)
+		}
+	}
+}
+
+func TestFilterModelTypesUsesCapabilityScopes(t *testing.T) {
+	tests := []struct {
+		name   string
+		scopes []string
+		types  []string
+		want   []string
+	}{
+		{"image", []string{"image"}, []string{"text_generate", "image_generate", "image_edit"}, []string{"image_generate", "image_edit"}},
+		{"video alias", []string{"video"}, []string{"image_to_video", "video_enhance", "text_generate"}, []string{"image_to_video", "video_enhance"}},
+		{"custom exact", []string{"custom_type"}, []string{"custom_type", "other_type"}, []string{"custom_type"}},
+		{"all", []string{"all"}, []string{"text_generate", "unknown"}, []string{"text_generate", "unknown"}},
+		{"legacy empty", nil, []string{"text_generate", "unknown"}, []string{"text_generate", "unknown"}},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			if got := FilterModelTypes(test.scopes, test.types); !reflect.DeepEqual(got, test.want) {
+				t.Fatalf("FilterModelTypes(%v, %v) = %v, want %v", test.scopes, test.types, got, test.want)
+			}
+		})
+	}
+}
+
+func TestKnownTaskKindsUseExpectedScopes(t *testing.T) {
+	tests := []struct {
+		kind  string
+		scope string
+	}{
+		{"chat.completions", "chat"},
+		{"responses", "text_generate"},
+		{"embeddings", "text_embedding"},
+		{"reranks", "text_rerank"},
+		{"images.generations", "image"},
+		{"images.edits", "image"},
+		{"images.vectorize", "vectorize"},
+		{"videos.generations", "video"},
+		{"videos.upscales", "video_upscale"},
+		{"song.generations", "song"},
+		{"music.generations", "music_generate"},
+		{"speech.generations", "tts"},
+		{"voice.clone", "audio"},
+	}
+	for _, test := range tests {
+		t.Run(test.kind, func(t *testing.T) {
+			if !ScopeAllowsTask([]string{test.scope}, test.kind) {
+				t.Fatalf("scope %q should allow task %q", test.scope, test.kind)
+			}
+			if ScopeAllowsTask([]string{"unrelated"}, test.kind) {
+				t.Fatalf("unrelated scope allowed task %q", test.kind)
+			}
+		})
+	}
+}
+
+func TestKnownModelTypesUseExpectedScopes(t *testing.T) {
+	tests := []struct {
+		modelType string
+		scope     string
+	}{
+		{"text_generate", "chat"},
+		{"tools_call", "text"},
+		{"text_embedding", "embedding"},
+		{"text_rerank", "rerank"},
+		{"image_generate", "image"},
+		{"image_edit", "image"},
+		{"image_analysis", "image"},
+		{"image_vectorize", "vectorize"},
+		{"video_generate", "video"},
+		{"image_to_video", "video"},
+		{"text_to_video", "video"},
+		{"video_edit", "video"},
+		{"video_reference", "video"},
+		{"video_first_last_frame", "video"},
+		{"video_understanding", "video"},
+		{"omni_video", "video"},
+		{"omni", "video"},
+		{"video_enhance", "upscale"},
+		{"audio_generate", "music"},
+		{"music_generate", "song"},
+		{"text_to_speech", "speech"},
+		{"audio_understanding", "audio"},
+		{"voice_clone", "tts"},
+	}
+	for _, test := range tests {
+		t.Run(test.modelType, func(t *testing.T) {
+			if !ScopeAllowsModelType([]string{test.scope}, test.modelType) {
+				t.Fatalf("scope %q should allow model type %q", test.scope, test.modelType)
+			}
+			if ScopeAllowsModelType([]string{"unrelated"}, test.modelType) {
+				t.Fatalf("unrelated scope allowed model type %q", test.modelType)
+			}
+		})
+	}
+}

apps/api/internal/store/access_policy.go

@@ -0,0 +1,507 @@
+package store
+
+import (
+	"context"
+	"strings"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/modelaccess"
+)
+
+type APIKeyAccessRuleDiagnostic struct {
+	RuleID       string `json:"ruleId"`
+	ResourceType string `json:"resourceType"`
+	ResourceID   string `json:"resourceId"`
+	ResourceName string `json:"resourceName,omitempty"`
+	Effect       string `json:"effect"`
+	Effective    bool   `json:"effective"`
+	Reason       string `json:"reason,omitempty" enums:"resource_unavailable,owner_access_revoked,scope_not_allowed"`
+}
+
+func (s *Store) enabledPlatformModels(ctx context.Context) ([]PlatformModel, []Platform, error) {
+	models, err := s.ListModels(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	platforms, err := s.ListPlatforms(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	enabledPlatforms := map[string]bool{}
+	for _, platform := range platforms {
+		if platform.Status == "enabled" {
+			enabledPlatforms[platform.ID] = true
+		}
+	}
+	enabled := make([]PlatformModel, 0, len(models))
+	for _, model := range models {
+		if model.Enabled && enabledPlatforms[model.PlatformID] {
+			enabled = append(enabled, model)
+		}
+	}
+	return enabled, platforms, nil
+}
+
+func (s *Store) filterPlatformModelsByLayeredAccess(ctx context.Context, user *auth.User, models []PlatformModel) ([]PlatformModel, error) {
+	rules, err := s.listActiveAccessRulesForResources(ctx, platformModelAccessResources(models))
+	if err != nil {
+		return nil, err
+	}
+	baselineRules, apiKeyRules := splitLayeredAccessRules(rules)
+	baseline := filterPlatformModelsByRuleSet(models, baselineRules, baselineAccessRuleSubjects(user), permissionLevel(user))
+	if user == nil || strings.TrimSpace(user.APIKeyID) == "" {
+		return baseline, nil
+	}
+	apiKeyUsers, err := s.apiKeyAccessRuleUsers(ctx, apiKeyRules)
+	if err != nil {
+		return nil, err
+	}
+	return filterPlatformModelsByLayeredRuleSet(user, baseline, baselineRules, apiKeyRules, apiKeyUsers), nil
+}
+
+func filterPlatformModelsByLayeredRuleSet(user *auth.User, baseline []PlatformModel, baselineRules []AccessRule, apiKeyRules []AccessRule, apiKeyUsers map[string]*auth.User) []PlatformModel {
+	if user == nil || strings.TrimSpace(user.APIKeyID) == "" {
+		return baseline
+	}
+	keyFiltered := make([]PlatformModel, 0, len(baseline))
+	for _, model := range baseline {
+		effectiveRules := effectiveAPIKeyRulesForPlatformModel(apiKeyRules, baselineRules, apiKeyUsers, model)
+		if platformModelAllowedByAccessRules(model, effectiveRules, apiKeyAccessRuleSubjects(user), permissionLevel(user)) {
+			keyFiltered = append(keyFiltered, model)
+		}
+	}
+	return filterPlatformModelsByAPIKeyScopes(keyFiltered, user.APIKeyScopes)
+}
+
+func (s *Store) filterPlatformModelsByBaselineAccess(ctx context.Context, user *auth.User, models []PlatformModel) ([]PlatformModel, error) {
+	rules, err := s.listActiveAccessRulesForResources(ctx, platformModelAccessResources(models))
+	if err != nil {
+		return nil, err
+	}
+	baselineRules, _ := splitLayeredAccessRules(rules)
+	return filterPlatformModelsByRuleSet(models, baselineRules, baselineAccessRuleSubjects(user), permissionLevel(user)), nil
+}
+
+func (s *Store) filterRuntimeCandidatesByLayeredAccess(ctx context.Context, user *auth.User, candidates []RuntimeModelCandidate) ([]RuntimeModelCandidate, error) {
+	if len(candidates) == 0 {
+		return candidates, nil
+	}
+	accessUser, err := s.resolveCurrentAccessUser(ctx, user)
+	if err != nil {
+		return nil, err
+	}
+	rules, err := s.listActiveAccessRulesForResources(ctx, candidateAccessResources(candidates))
+	if err != nil {
+		return nil, err
+	}
+	baselineRules, apiKeyRules := splitLayeredAccessRules(rules)
+	baseline := filterCandidatesByRuleSet(candidates, baselineRules, baselineAccessRuleSubjects(accessUser), permissionLevel(accessUser))
+	if accessUser == nil || strings.TrimSpace(accessUser.APIKeyID) == "" {
+		return baseline, nil
+	}
+	apiKeyUsers, err := s.apiKeyAccessRuleUsers(ctx, apiKeyRules)
+	if err != nil {
+		return nil, err
+	}
+	keyFiltered := make([]RuntimeModelCandidate, 0, len(baseline))
+	for _, candidate := range baseline {
+		effectiveRules := effectiveAPIKeyRulesForCandidate(apiKeyRules, baselineRules, apiKeyUsers, candidate)
+		if candidateAllowedByAccessRules(candidate, effectiveRules, apiKeyAccessRuleSubjects(accessUser), permissionLevel(accessUser)) {
+			keyFiltered = append(keyFiltered, candidate)
+		}
+	}
+	filtered := make([]RuntimeModelCandidate, 0, len(keyFiltered))
+	for _, candidate := range keyFiltered {
+		if modelaccess.ScopeAllowsModelType(accessUser.APIKeyScopes, candidate.ModelType) {
+			filtered = append(filtered, candidate)
+		}
+	}
+	return filtered, nil
+}
+
+func (s *Store) ListAPIKeyAssignablePlatformModelsForKey(ctx context.Context, user *auth.User, apiKeyID string) ([]PlatformModel, []APIKeyAccessRuleDiagnostic, error) {
+	if localGatewayUserID(user) == "" {
+		return nil, nil, ErrLocalUserRequired
+	}
+	accessUser, err := s.resolveOwnedAPIKeyAccessUser(ctx, user, apiKeyID)
+	if err != nil {
+		return nil, nil, err
+	}
+	allModels, err := s.ListModels(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	enabledModels, platforms, err := s.enabledPlatformModels(ctx)
+	if err != nil {
+		return nil, nil, err
+	}
+	rules, err := s.listActiveAccessRulesForResources(ctx, platformModelAccessResources(enabledModels))
+	if err != nil {
+		return nil, nil, err
+	}
+	baselineRules, _ := splitLayeredAccessRules(rules)
+	baseline := filterPlatformModelsByRuleSet(enabledModels, baselineRules, baselineAccessRuleSubjects(accessUser), permissionLevel(accessUser))
+	scoped := filterPlatformModelsByAPIKeyScopes(baseline, accessUser.APIKeyScopes)
+	ownedRules, err := s.ListAPIKeyAccessRules(ctx, user)
+	if err != nil {
+		return nil, nil, err
+	}
+	diagnostics := diagnoseAPIKeyRules(apiKeyID, ownedRules, allModels, enabledModels, baseline, scoped, platforms)
+	return scoped, diagnostics, nil
+}
+
+func (s *Store) resolveOwnedAPIKeyAccessUser(ctx context.Context, user *auth.User, apiKeyID string) (*auth.User, error) {
+	if user == nil {
+		return nil, ErrLocalUserRequired
+	}
+	gatewayUserID := localGatewayUserID(user)
+	if gatewayUserID == "" {
+		return nil, ErrLocalUserRequired
+	}
+	var scopesBytes []byte
+	var userGroupID string
+	var userGroupKey string
+	err := s.pool.QueryRow(ctx, `
+SELECT k.scopes, COALESCE(k.user_group_id::text, u.default_user_group_id::text, ''), COALESCE(g.group_key, '')
+FROM gateway_api_keys k
+JOIN gateway_users u ON u.id = k.gateway_user_id
+LEFT JOIN gateway_user_groups g ON g.id = COALESCE(k.user_group_id, u.default_user_group_id)
+WHERE k.id = $1::uuid
+  AND k.gateway_user_id = $2::uuid
+  AND k.deleted_at IS NULL
+  AND u.deleted_at IS NULL`, strings.TrimSpace(apiKeyID), gatewayUserID).Scan(&scopesBytes, &userGroupID, &userGroupKey)
+	if err != nil {
+		return nil, err
+	}
+	next := *user
+	next.APIKeyID = strings.TrimSpace(apiKeyID)
+	next.APIKeyScopes = decodeStringArray(scopesBytes)
+	next.UserGroupID = userGroupID
+	next.UserGroupKey = userGroupKey
+	next.UserGroupKeys = nil
+	if userGroupKey != "" {
+		next.UserGroupKeys = []string{userGroupKey}
+	}
+	return &next, nil
+}
+
+func effectiveAPIKeyRulesForPlatformModel(rules []AccessRule, baselineRules []AccessRule, users map[string]*auth.User, model PlatformModel) []AccessRule {
+	effective := make([]AccessRule, 0, len(rules))
+	for _, rule := range rules {
+		accessUser := users[rule.SubjectID]
+		if accessUser == nil || !accessRuleMatchesPlatformModel(rule, model) ||
+			!platformModelAllowedByAccessRules(model, baselineRules, baselineAccessRuleSubjects(accessUser), permissionLevel(accessUser)) ||
+			len(modelaccess.FilterModelTypes(accessUser.APIKeyScopes, model.ModelType)) == 0 {
+			continue
+		}
+		effective = append(effective, rule)
+	}
+	return effective
+}
+
+func effectiveAPIKeyRulesForCandidate(rules []AccessRule, baselineRules []AccessRule, users map[string]*auth.User, candidate RuntimeModelCandidate) []AccessRule {
+	effective := make([]AccessRule, 0, len(rules))
+	for _, rule := range rules {
+		accessUser := users[rule.SubjectID]
+		if accessUser == nil || !accessRuleMatchesCandidate(rule, candidate) ||
+			!candidateAllowedByAccessRules(candidate, baselineRules, baselineAccessRuleSubjects(accessUser), permissionLevel(accessUser)) ||
+			!modelaccess.ScopeAllowsModelType(accessUser.APIKeyScopes, candidate.ModelType) {
+			continue
+		}
+		effective = append(effective, rule)
+	}
+	return effective
+}
+
+func (s *Store) apiKeyAccessRuleUsers(ctx context.Context, rules []AccessRule) (map[string]*auth.User, error) {
+	ids := make([]string, 0, len(rules))
+	seen := map[string]bool{}
+	for _, rule := range rules {
+		if rule.SubjectType != "api_key" || rule.SubjectID == "" || seen[rule.SubjectID] {
+			continue
+		}
+		seen[rule.SubjectID] = true
+		ids = append(ids, rule.SubjectID)
+	}
+	if len(ids) == 0 {
+		return map[string]*auth.User{}, nil
+	}
+	rows, err := s.pool.Query(ctx, `
+SELECT k.id::text, k.scopes, u.id::text,
+       COALESCE(u.gateway_tenant_id::text, ''), COALESCE(u.tenant_id, ''), COALESCE(u.tenant_key, ''),
+       u.roles, COALESCE(k.user_group_id::text, u.default_user_group_id::text, ''), COALESCE(g.group_key, '')
+FROM gateway_api_keys k
+JOIN gateway_users u ON u.id = k.gateway_user_id
+LEFT JOIN gateway_user_groups g ON g.id = COALESCE(k.user_group_id, u.default_user_group_id)
+WHERE k.id = ANY($1::uuid[])
+  AND k.status = 'active'
+  AND k.deleted_at IS NULL
+  AND (k.expires_at IS NULL OR k.expires_at > now())
+  AND u.status = 'active'
+  AND u.deleted_at IS NULL`, ids)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	users := map[string]*auth.User{}
+	for rows.Next() {
+		var apiKeyID string
+		var scopesBytes []byte
+		var rolesBytes []byte
+		var gatewayUserID string
+		var gatewayTenantID string
+		var tenantID string
+		var tenantKey string
+		var userGroupID string
+		var userGroupKey string
+		if err := rows.Scan(&apiKeyID, &scopesBytes, &gatewayUserID, &gatewayTenantID, &tenantID, &tenantKey, &rolesBytes, &userGroupID, &userGroupKey); err != nil {
+			return nil, err
+		}
+		groupKeys := []string(nil)
+		if userGroupKey != "" {
+			groupKeys = []string{userGroupKey}
+		}
+		users[apiKeyID] = &auth.User{
+			GatewayUserID:   gatewayUserID,
+			GatewayTenantID: gatewayTenantID,
+			TenantID:        tenantID,
+			TenantKey:       tenantKey,
+			Roles:           decodeStringArray(rolesBytes),
+			UserGroupID:     userGroupID,
+			UserGroupKey:    userGroupKey,
+			UserGroupKeys:   groupKeys,
+			APIKeyID:        apiKeyID,
+			APIKeyScopes:    decodeStringArray(scopesBytes),
+		}
+	}
+	return users, rows.Err()
+}
+
+func splitLayeredAccessRules(rules []AccessRule) ([]AccessRule, []AccessRule) {
+	baseline := make([]AccessRule, 0, len(rules))
+	apiKeys := make([]AccessRule, 0, len(rules))
+	for _, rule := range rules {
+		if rule.SubjectType == "api_key" {
+			apiKeys = append(apiKeys, rule)
+		} else {
+			baseline = append(baseline, rule)
+		}
+	}
+	return baseline, apiKeys
+}
+
+func filterPlatformModelsByRuleSet(models []PlatformModel, rules []AccessRule, subjects map[string]bool, level int) []PlatformModel {
+	filtered := make([]PlatformModel, 0, len(models))
+	for _, model := range models {
+		if platformModelAllowedByAccessRules(model, rules, subjects, level) {
+			filtered = append(filtered, model)
+		}
+	}
+	return filtered
+}
+
+func filterCandidatesByRuleSet(candidates []RuntimeModelCandidate, rules []AccessRule, subjects map[string]bool, level int) []RuntimeModelCandidate {
+	filtered := make([]RuntimeModelCandidate, 0, len(candidates))
+	for _, candidate := range candidates {
+		if candidateAllowedByAccessRules(candidate, rules, subjects, level) {
+			filtered = append(filtered, candidate)
+		}
+	}
+	return filtered
+}
+
+func filterPlatformModelsByAPIKeyScopes(models []PlatformModel, scopes []string) []PlatformModel {
+	filtered := make([]PlatformModel, 0, len(models))
+	for _, model := range models {
+		declaredTypes := append(StringList(nil), model.ModelType...)
+		allowedTypes := modelaccess.FilterModelTypes(scopes, model.ModelType)
+		if len(allowedTypes) == 0 {
+			continue
+		}
+		model.ModelType = StringList(allowedTypes)
+		model.Capabilities = filterPlatformModelTypeConfig(model.Capabilities, allowedTypes, declaredTypes)
+		model.BaseCapabilities = filterPlatformModelTypeConfig(model.BaseCapabilities, allowedTypes, declaredTypes)
+		model.CapabilityOverride = filterPlatformModelTypeConfig(model.CapabilityOverride, allowedTypes, declaredTypes)
+		filtered = append(filtered, model)
+	}
+	return filtered
+}
+
+func filterPlatformModelTypeConfig(config map[string]any, allowedTypes []string, declaredTypes []string) map[string]any {
+	if len(config) == 0 {
+		return config
+	}
+	allowed := map[string]bool{}
+	for _, modelType := range allowedTypes {
+		allowed[modelType] = true
+	}
+	declared := map[string]bool{}
+	for _, modelType := range declaredTypes {
+		declared[modelType] = true
+	}
+	out := make(map[string]any, len(config))
+	for key, value := range config {
+		if key == "originalTypes" {
+			original := stringValues(value)
+			kept := make([]string, 0, len(original))
+			for _, modelType := range original {
+				if allowed[modelType] {
+					kept = append(kept, modelType)
+				}
+			}
+			if len(kept) > 0 {
+				out[key] = kept
+			}
+			continue
+		}
+		if (declared[key] || knownPlatformModelType(key)) && !allowed[key] {
+			continue
+		}
+		out[key] = value
+	}
+	return out
+}
+
+func knownPlatformModelType(value string) bool {
+	switch value {
+	case "text_generate", "text_embedding", "text_rerank", "tools_call",
+		"image_generate", "image_edit", "image_analysis", "image_vectorize",
+		"video_generate", "video_enhance", "image_to_video", "text_to_video", "video_edit", "video_reference", "video_first_last_frame", "video_understanding", "omni_video", "omni",
+		"audio_generate", "music_generate", "audio_understanding", "text_to_speech", "voice_clone":
+		return true
+	default:
+		return false
+	}
+}
+
+func stringValues(value any) []string {
+	switch values := value.(type) {
+	case []string:
+		return values
+	case StringList:
+		return []string(values)
+	case []any:
+		out := make([]string, 0, len(values))
+		for _, value := range values {
+			if text, ok := value.(string); ok && text != "" {
+				out = append(out, text)
+			}
+		}
+		return out
+	default:
+		return nil
+	}
+}
+
+func baselineAccessRuleSubjects(user *auth.User) map[string]bool {
+	subjects := accessRuleSubjects(user)
+	if user != nil && user.APIKeyID != "" {
+		delete(subjects, "api_key:"+user.APIKeyID)
+	}
+	return subjects
+}
+
+func apiKeyAccessRuleSubjects(user *auth.User) map[string]bool {
+	subjects := map[string]bool{}
+	if user != nil && strings.TrimSpace(user.APIKeyID) != "" {
+		subjects["api_key:"+strings.TrimSpace(user.APIKeyID)] = true
+	}
+	return subjects
+}
+
+func permissionLevel(user *auth.User) int {
+	if user == nil {
+		return 0
+	}
+	return auth.PermissionLevel(user.Roles)
+}
+
+func accessRuleMatchesPlatformModel(rule AccessRule, model PlatformModel) bool {
+	switch rule.ResourceType {
+	case "platform":
+		return rule.ResourceID == model.PlatformID
+	case "platform_model":
+		return rule.ResourceID == model.ID
+	case "base_model":
+		return rule.ResourceID != "" && rule.ResourceID == model.BaseModelID
+	default:
+		return false
+	}
+}
+
+func accessRuleMatchesCandidate(rule AccessRule, candidate RuntimeModelCandidate) bool {
+	switch rule.ResourceType {
+	case "platform":
+		return rule.ResourceID == candidate.PlatformID
+	case "platform_model":
+		return rule.ResourceID == candidate.PlatformModelID
+	case "base_model":
+		return rule.ResourceID != "" && rule.ResourceID == candidate.BaseModelID
+	default:
+		return false
+	}
+}
+
+func diagnoseAPIKeyRules(apiKeyID string, rules []AccessRule, allModels []PlatformModel, enabledModels []PlatformModel, baselineModels []PlatformModel, scopedModels []PlatformModel, platforms []Platform) []APIKeyAccessRuleDiagnostic {
+	platformNames := map[string]string{}
+	for _, platform := range platforms {
+		platformNames[platform.ID] = firstNonEmpty(platform.InternalName, platform.Name, platform.PlatformKey)
+	}
+	modelNames := map[string]string{}
+	baseModelNames := map[string]string{}
+	for _, model := range allModels {
+		modelNames[model.ID] = firstNonEmpty(model.DisplayName, model.ModelName, model.ID)
+		if model.BaseModelID != "" && baseModelNames[model.BaseModelID] == "" {
+			baseModelNames[model.BaseModelID] = firstNonEmpty(model.DisplayName, model.ModelName, model.BaseModelID)
+		}
+	}
+	diagnostics := make([]APIKeyAccessRuleDiagnostic, 0)
+	for _, rule := range rules {
+		if rule.SubjectType != "api_key" || rule.SubjectID != apiKeyID || rule.Status != "active" {
+			continue
+		}
+		diagnostic := APIKeyAccessRuleDiagnostic{
+			RuleID:       rule.ID,
+			ResourceType: rule.ResourceType,
+			ResourceID:   rule.ResourceID,
+			ResourceName: accessRuleResourceName(rule, platformNames, modelNames, baseModelNames),
+			Effect:       rule.Effect,
+			Effective:    true,
+		}
+		switch {
+		case !accessRuleMatchesAnyPlatformModel(rule, allModels) || !accessRuleMatchesAnyPlatformModel(rule, enabledModels):
+			diagnostic.Effective = false
+			diagnostic.Reason = "resource_unavailable"
+		case !accessRuleMatchesAnyPlatformModel(rule, baselineModels):
+			diagnostic.Effective = false
+			diagnostic.Reason = "owner_access_revoked"
+		case !accessRuleMatchesAnyPlatformModel(rule, scopedModels):
+			diagnostic.Effective = false
+			diagnostic.Reason = "scope_not_allowed"
+		}
+		diagnostics = append(diagnostics, diagnostic)
+	}
+	return diagnostics
+}
+
+func accessRuleMatchesAnyPlatformModel(rule AccessRule, models []PlatformModel) bool {
+	for _, model := range models {
+		if accessRuleMatchesPlatformModel(rule, model) {
+			return true
+		}
+	}
+	return false
+}
+
+func accessRuleResourceName(rule AccessRule, platformNames map[string]string, modelNames map[string]string, baseModelNames map[string]string) string {
+	switch rule.ResourceType {
+	case "platform":
+		return firstNonEmpty(platformNames[rule.ResourceID], rule.ResourceID)
+	case "platform_model":
+		return firstNonEmpty(modelNames[rule.ResourceID], rule.ResourceID)
+	case "base_model":
+		return firstNonEmpty(baseModelNames[rule.ResourceID], rule.ResourceID)
+	default:
+		return rule.ResourceID
+	}
+}

apps/api/internal/store/access_policy_test.go

@@ -0,0 +1,150 @@
+package store
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/easyai/easyai-ai-gateway/apps/api/internal/auth"
+)
+
+func TestLayeredAccessDoesNotLetAPIKeyExpandBaseline(t *testing.T) {
+	model := PlatformModel{ID: "model-1", PlatformID: "platform-1", BaseModelID: "base-1"}
+	groupUser := &auth.User{GatewayUserID: "user-1", UserGroupID: "group-1", APIKeyID: "key-1"}
+	baselineRules := []AccessRule{{
+		SubjectType: "user_group", SubjectID: "group-1", ResourceType: "platform_model", ResourceID: "model-1", Effect: "deny",
+	}}
+	keyRules := []AccessRule{{
+		SubjectType: "api_key", SubjectID: "key-1", ResourceType: "platform_model", ResourceID: "model-1", Effect: "allow",
+	}}
+	baseline := filterPlatformModelsByRuleSet([]PlatformModel{model}, baselineRules, baselineAccessRuleSubjects(groupUser), 0)
+	actual := filterPlatformModelsByRuleSet(baseline, keyRules, apiKeyAccessRuleSubjects(groupUser), 0)
+	if len(actual) != 0 {
+		t.Fatalf("api key allow expanded denied baseline: %+v", actual)
+	}
+}
+
+func TestAPIKeyAllowControlsOnlyMatchingKeys(t *testing.T) {
+	model := PlatformModel{ID: "model-1", PlatformID: "platform-1"}
+	rules := []AccessRule{{
+		SubjectType: "api_key", SubjectID: "key-a", ResourceType: "platform_model", ResourceID: "model-1", Effect: "allow",
+	}}
+	for _, test := range []struct {
+		keyID string
+		want  int
+	}{{"key-a", 1}, {"key-b", 0}} {
+		user := &auth.User{APIKeyID: test.keyID}
+		actual := filterPlatformModelsByRuleSet([]PlatformModel{model}, rules, apiKeyAccessRuleSubjects(user), 0)
+		if len(actual) != test.want {
+			t.Fatalf("key %s received %d models, want %d", test.keyID, len(actual), test.want)
+		}
+	}
+}
+
+func TestLayeredAccessDenyWinsAndNoRulesInherit(t *testing.T) {
+	model := PlatformModel{ID: "model-1", PlatformID: "platform-1", ModelType: StringList{"text_generate"}}
+	keyUser := &auth.User{APIKeyID: "key-a", APIKeyScopes: []string{"chat"}}
+	keyUsers := map[string]*auth.User{"key-a": keyUser}
+	if got := filterPlatformModelsByLayeredRuleSet(keyUser, []PlatformModel{model}, nil, nil, keyUsers); len(got) != 1 {
+		t.Fatalf("key without rules did not inherit baseline: %+v", got)
+	}
+	rules := []AccessRule{
+		{SubjectType: "api_key", SubjectID: "key-a", ResourceType: "platform_model", ResourceID: "model-1", Effect: "allow"},
+		{SubjectType: "api_key", SubjectID: "key-a", ResourceType: "platform_model", ResourceID: "model-1", Effect: "deny"},
+	}
+	if got := filterPlatformModelsByLayeredRuleSet(keyUser, []PlatformModel{model}, nil, rules, keyUsers); len(got) != 0 {
+		t.Fatalf("matching deny did not override allow: %+v", got)
+	}
+}
+
+func TestDirectUserIgnoresAPIKeyRules(t *testing.T) {
+	model := PlatformModel{ID: "model-1", PlatformID: "platform-1", ModelType: StringList{"text_generate"}}
+	rules := []AccessRule{{
+		SubjectType: "api_key", SubjectID: "key-a", ResourceType: "platform_model", ResourceID: "model-1", Effect: "allow",
+	}}
+	keyUsers := map[string]*auth.User{"key-a": {APIKeyID: "key-a", APIKeyScopes: []string{"chat"}}}
+	if got := filterPlatformModelsByLayeredRuleSet(&auth.User{GatewayUserID: "user-1"}, []PlatformModel{model}, nil, rules, keyUsers); len(got) != 1 {
+		t.Fatalf("direct user was constrained by API key exclusive rule: %+v", got)
+	}
+}
+
+func TestIneffectiveAPIKeyRuleDoesNotControlAnotherKey(t *testing.T) {
+	model := PlatformModel{ID: "model-1", PlatformID: "platform-1", ModelType: StringList{"text_generate"}}
+	staleRule := AccessRule{SubjectType: "api_key", SubjectID: "key-a", ResourceType: "platform_model", ResourceID: "model-1", Effect: "allow"}
+	groupDeny := AccessRule{SubjectType: "user_group", SubjectID: "group-a", ResourceType: "platform_model", ResourceID: "model-1", Effect: "deny"}
+	keyUsers := map[string]*auth.User{
+		"key-a": {APIKeyID: "key-a", UserGroupID: "group-a", APIKeyScopes: []string{"chat"}},
+	}
+	keyB := &auth.User{APIKeyID: "key-b", UserGroupID: "group-b", APIKeyScopes: []string{"chat"}}
+	if got := filterPlatformModelsByLayeredRuleSet(keyB, []PlatformModel{model}, []AccessRule{groupDeny}, []AccessRule{staleRule}, keyUsers); len(got) != 1 {
+		t.Fatalf("stale key-a rule blocked authorized key-b: %+v", got)
+	}
+}
+
+func TestPlatformRuleOnlyControlsModelsItsKeyCanAccess(t *testing.T) {
+	allowed := PlatformModel{ID: "allowed", PlatformID: "platform-1", ModelType: StringList{"image_generate"}}
+	denied := PlatformModel{ID: "denied", PlatformID: "platform-1", ModelType: StringList{"text_generate"}}
+	rule := AccessRule{SubjectType: "api_key", SubjectID: "key-a", ResourceType: "platform", ResourceID: "platform-1", Effect: "allow"}
+	groupDeny := AccessRule{SubjectType: "user_group", SubjectID: "group-a", ResourceType: "platform_model", ResourceID: "denied", Effect: "deny"}
+	ruleUser := &auth.User{APIKeyID: "key-a", UserGroupID: "group-a", APIKeyScopes: []string{"image"}}
+	users := map[string]*auth.User{"key-a": ruleUser}
+	if got := effectiveAPIKeyRulesForPlatformModel([]AccessRule{rule}, []AccessRule{groupDeny}, users, allowed); len(got) != 1 {
+		t.Fatalf("platform rule should control the allowed image model: %+v", got)
+	}
+	if got := effectiveAPIKeyRulesForPlatformModel([]AccessRule{rule}, []AccessRule{groupDeny}, users, denied); len(got) != 0 {
+		t.Fatalf("platform rule controlled a group-denied or scope-denied model: %+v", got)
+	}
+}
+
+func TestFilterPlatformModelsByAPIKeyScopesPrunesCapabilities(t *testing.T) {
+	models := []PlatformModel{{
+		ID:        "model-1",
+		ModelType: StringList{"text_generate", "image_generate"},
+		Capabilities: map[string]any{
+			"text_generate":  map[string]any{"max_context_tokens": 128000},
+			"image_generate": map[string]any{"aspect_ratio_allowed": []any{"1:1"}},
+			"originalTypes":  []any{"text_generate", "image_generate"},
+			"shared":         true,
+		},
+	}}
+	actual := filterPlatformModelsByAPIKeyScopes(models, []string{"image"})
+	if len(actual) != 1 || !reflect.DeepEqual(actual[0].ModelType, StringList{"image_generate"}) {
+		t.Fatalf("scope-filtered models = %+v", actual)
+	}
+	if _, exists := actual[0].Capabilities["text_generate"]; exists {
+		t.Fatalf("text capability leaked into image scope: %+v", actual[0].Capabilities)
+	}
+	if _, exists := actual[0].Capabilities["image_generate"]; !exists {
+		t.Fatalf("image capability was removed: %+v", actual[0].Capabilities)
+	}
+	if !reflect.DeepEqual(actual[0].Capabilities["originalTypes"], []string{"image_generate"}) {
+		t.Fatalf("originalTypes not pruned: %+v", actual[0].Capabilities["originalTypes"])
+	}
+	if actual[0].Capabilities["shared"] != true {
+		t.Fatalf("shared capability metadata was removed: %+v", actual[0].Capabilities)
+	}
+}
+
+func TestDiagnoseAPIKeyRulesExplainsEachInactiveLayer(t *testing.T) {
+	rules := []AccessRule{
+		{ID: "gone", SubjectType: "api_key", SubjectID: "key-1", ResourceType: "platform_model", ResourceID: "gone", Effect: "allow", Status: "active"},
+		{ID: "revoked", SubjectType: "api_key", SubjectID: "key-1", ResourceType: "platform_model", ResourceID: "revoked", Effect: "allow", Status: "active"},
+		{ID: "scope", SubjectType: "api_key", SubjectID: "key-1", ResourceType: "platform_model", ResourceID: "scope", Effect: "deny", Status: "active"},
+		{ID: "effective", SubjectType: "api_key", SubjectID: "key-1", ResourceType: "platform_model", ResourceID: "effective", Effect: "allow", Status: "active"},
+	}
+	all := []PlatformModel{{ID: "revoked"}, {ID: "scope"}, {ID: "effective"}}
+	enabled := append([]PlatformModel(nil), all...)
+	baseline := []PlatformModel{{ID: "scope"}, {ID: "effective"}}
+	scoped := []PlatformModel{{ID: "effective"}}
+	diagnostics := diagnoseAPIKeyRules("key-1", rules, all, enabled, baseline, scoped, nil)
+	want := map[string]string{
+		"gone": "resource_unavailable", "revoked": "owner_access_revoked", "scope": "scope_not_allowed", "effective": "",
+	}
+	for _, diagnostic := range diagnostics {
+		if diagnostic.Reason != want[diagnostic.RuleID] {
+			t.Fatalf("diagnostic %s reason = %q, want %q", diagnostic.RuleID, diagnostic.Reason, want[diagnostic.RuleID])
+		}
+		if diagnostic.Effective != (diagnostic.RuleID == "effective") {
+			t.Fatalf("diagnostic %s effective = %v", diagnostic.RuleID, diagnostic.Effective)
+		}
+	}
+}

apps/api/internal/store/access_rules.go

@@ -244,7 +244,7 @@ SELECT EXISTS (
 	if !exists {
 		return nil, pgx.ErrNoRows
 	}
-	if err := s.ensureAPIKeyAccessRuleResourcesAllowed(ctx, user, input.UpsertResources); err != nil {
+	if err := s.ensureAPIKeyAccessRuleResourcesAllowed(ctx, user, input.SubjectID, input.UpsertResources); err != nil {
 		return nil, err
 	}
 	if _, err := s.BatchAccessRules(ctx, input); err != nil {
@@ -254,32 +254,7 @@ SELECT EXISTS (
 }
 
 func (s *Store) filterCandidatesByAccessRules(ctx context.Context, user *auth.User, candidates []RuntimeModelCandidate) ([]RuntimeModelCandidate, error) {
-	if len(candidates) == 0 {
-		return candidates, nil
-	}
-	resources := candidateAccessResources(candidates)
-	if len(resources) == 0 {
-		return candidates, nil
-	}
-	rules, err := s.listActiveAccessRulesForResources(ctx, resources)
-	if err != nil {
-		return nil, err
-	}
-	if len(rules) == 0 {
-		return candidates, nil
-	}
-	subjects := accessRuleSubjects(user)
-	level := 0
-	if user != nil {
-		level = auth.PermissionLevel(user.Roles)
-	}
-	filtered := candidates[:0]
-	for _, candidate := range candidates {
-		if candidateAllowedByAccessRules(candidate, rules, subjects, level) {
-			filtered = append(filtered, candidate)
-		}
-	}
-	return filtered, nil
+	return s.filterRuntimeCandidatesByLayeredAccess(ctx, user, candidates)
 }
 
 func (s *Store) ListAccessiblePlatformModels(ctx context.Context, user *auth.User) ([]PlatformModel, error) {
@@ -302,35 +277,22 @@ func (s *Store) listPlatformModelsForAccessRules(ctx context.Context, user *auth
 	if err != nil {
 		return nil, err
 	}
-	models, err := s.ListModels(ctx)
+	models, _, err := s.enabledPlatformModels(ctx)
 	if err != nil {
 		return nil, err
 	}
-	platforms, err := s.ListPlatforms(ctx)
-	if err != nil {
-		return nil, err
+	if excludedSubjectTypes["api_key"] {
+		return s.filterPlatformModelsByBaselineAccess(ctx, accessUser, models)
 	}
-	enabledPlatforms := map[string]bool{}
-	for _, platform := range platforms {
-		if platform.Status == "enabled" {
-			enabledPlatforms[platform.ID] = true
-		}
-	}
-	enabled := make([]PlatformModel, 0, len(models))
-	for _, model := range models {
-		if model.Enabled && enabledPlatforms[model.PlatformID] {
-			enabled = append(enabled, model)
-		}
-	}
-	return s.filterPlatformModelsByAccessRules(ctx, accessUser, enabled, excludedSubjectTypes)
+	return s.filterPlatformModelsByLayeredAccess(ctx, accessUser, models)
 }
 
-func (s *Store) ensureAPIKeyAccessRuleResourcesAllowed(ctx context.Context, user *auth.User, resources []AccessRuleResourceInput) error {
+func (s *Store) ensureAPIKeyAccessRuleResourcesAllowed(ctx context.Context, user *auth.User, apiKeyID string, resources []AccessRuleResourceInput) error {
 	resources = dedupeAccessRuleResources(resources)
 	if len(resources) == 0 {
 		return nil
 	}
-	allowed, err := s.accessibleAccessRuleResources(ctx, user)
+	allowed, err := s.accessibleAccessRuleResources(ctx, user, apiKeyID)
 	if err != nil {
 		return err
 	}
@@ -342,8 +304,8 @@ func (s *Store) ensureAPIKeyAccessRuleResourcesAllowed(ctx context.Context, user
 	return nil
 }
 
-func (s *Store) accessibleAccessRuleResources(ctx context.Context, user *auth.User) (map[string]bool, error) {
-	models, err := s.ListAPIKeyAssignablePlatformModels(ctx, user)
+func (s *Store) accessibleAccessRuleResources(ctx context.Context, user *auth.User, apiKeyID string) (map[string]bool, error) {
+	models, _, err := s.ListAPIKeyAssignablePlatformModelsForKey(ctx, user, apiKeyID)
 	if err != nil {
 		return nil, err
 	}
@@ -368,25 +330,28 @@ func (s *Store) resolveCurrentAccessUser(ctx context.Context, user *auth.User) (
 	}
 	next := *user
 	var userGroupID string
+	var userGroupKey string
 	var err error
 	if strings.TrimSpace(user.APIKeyID) != "" {
 		err = s.pool.QueryRow(ctx, `
-SELECT COALESCE(k.user_group_id::text, u.default_user_group_id::text, '')
+SELECT COALESCE(k.user_group_id::text, u.default_user_group_id::text, ''), COALESCE(g.group_key, '')
 FROM gateway_users u
 JOIN gateway_api_keys k ON k.gateway_user_id = u.id
+LEFT JOIN gateway_user_groups g ON g.id = COALESCE(k.user_group_id, u.default_user_group_id)
 WHERE u.id = $1::uuid
   AND k.id = $2::uuid
   AND u.status = 'active'
   AND u.deleted_at IS NULL
   AND k.status = 'active'
-  AND k.deleted_at IS NULL`, gatewayUserID, user.APIKeyID).Scan(&userGroupID)
+	  AND k.deleted_at IS NULL`, gatewayUserID, user.APIKeyID).Scan(&userGroupID, &userGroupKey)
 	} else {
 		err = s.pool.QueryRow(ctx, `
-SELECT COALESCE(default_user_group_id::text, '')
-FROM gateway_users
-WHERE id = $1::uuid
-  AND status = 'active'
-  AND deleted_at IS NULL`, gatewayUserID).Scan(&userGroupID)
+SELECT COALESCE(u.default_user_group_id::text, ''), COALESCE(g.group_key, '')
+FROM gateway_users u
+LEFT JOIN gateway_user_groups g ON g.id = u.default_user_group_id
+WHERE u.id = $1::uuid
+  AND u.status = 'active'
+  AND u.deleted_at IS NULL`, gatewayUserID).Scan(&userGroupID, &userGroupKey)
 	}
 	if err != nil {
 		if errors.Is(err, pgx.ErrNoRows) {
@@ -395,6 +360,11 @@ WHERE id = $1::uuid
 		return nil, err
 	}
 	next.UserGroupID = userGroupID
+	next.UserGroupKey = userGroupKey
+	next.UserGroupKeys = nil
+	if userGroupKey != "" {
+		next.UserGroupKeys = []string{userGroupKey}
+	}
 	return &next, nil
 }
 

apps/web/src/App.tsx

@@ -73,7 +73,6 @@ import {
   listAdminTasks,
   listAuditLogs,
   listApiKeyAccessRules,
-  listApiKeyAssignableModels,
   listApiKeys,
   listBaseModels,
   listCatalogProviders,
@@ -186,7 +185,6 @@ type DataKey =
   | 'publicCatalog'
   | 'playgroundApiKeys'
   | 'playgroundModels'
-  | 'apiKeyPolicyModels'
   | 'modelCatalog'
   | 'networkProxyConfig'
   | 'clientCustomizationSettings'
@@ -241,7 +239,6 @@ export function App() {
     summary: { modelCount: 0, sourceCount: 0 },
   });
   const [playgroundModels, setPlaygroundModels] = useState<PlatformModel[]>([]);
-  const [apiKeyPolicyModels, setApiKeyPolicyModels] = useState<PlatformModel[]>([]);
   const [networkProxyConfig, setNetworkProxyConfig] = useState<GatewayNetworkProxyConfig | null>(null);
   const [clientCustomizationSettings, setClientCustomizationSettings] = useState<ClientCustomizationSettings | null>(null);
   const [fileStorageChannels, setFileStorageChannels] = useState<FileStorageChannel[]>([]);
@@ -563,9 +560,6 @@ export function App() {
       case 'playgroundModels':
         setPlaygroundModels((await listPlayableModels(nextToken)).items);
         return;
-      case 'apiKeyPolicyModels':
-        setApiKeyPolicyModels((await listApiKeyAssignableModels(nextToken)).items);
-        return;
       case 'playgroundApiKeys': {
         const response = await listPlayableApiKeys(nextToken);
         setApiKeys(response.items);
@@ -717,7 +711,7 @@ export function App() {
     try {
       const response = await createApiKey(token, {
         name: apiKeyForm.name,
-        scopes: ['chat', 'embedding', 'rerank', 'image', 'video', 'music', 'audio'],
+        scopes: ['chat', 'embedding', 'rerank', 'image', 'image_vectorize', 'video', 'video_enhance', 'music', 'audio', 'voice_clone'],
         expiresAt: apiKeyForm.expiresAt ? new Date(apiKeyForm.expiresAt).toISOString() : undefined,
       });
       setApiKeySecret(response.secret);
@@ -750,7 +744,7 @@ export function App() {
       const modelsResponse = await replacePlatformModels(token, platform.id, modelBindings);
       setPlatforms((current) => [platformForState, ...current.filter((item) => item.id !== platform.id)]);
       setModels((current) => [...current.filter((model) => model.platformId !== platform.id), ...modelsResponse.items]);
-      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'playgroundModels');
       setCoreState('ready');
       setCoreMessage(input.platformId
         ? `平台已更新，当前绑定 ${input.models.length} 个模型。`
@@ -770,7 +764,7 @@ export function App() {
       const updated = await updatePlatform(token, platform.id, input);
       const platformForState = withCredentialPreviewFallback(updated, input, platform);
       setPlatforms((current) => current.map((item) => item.id === platform.id ? platformForState : item));
-      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'playgroundModels');
       setCoreState('ready');
       setCoreMessage(status === 'enabled' ? '平台已启用。' : '平台已禁用。');
     } catch (err) {
@@ -802,7 +796,7 @@ export function App() {
             platformPriority: state.priority,
           }
         : status));
-      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'platforms', 'playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'platforms', 'playgroundModels');
       setCoreState('ready');
       setCoreMessage(input.reset ? '平台动态优先级已重置。' : '平台动态优先级已更新。');
     } catch (err) {
@@ -846,7 +840,7 @@ export function App() {
             cooldownUntil: undefined,
           }
         : model));
-      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'models', 'platforms', 'playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'models', 'platforms', 'playgroundModels');
       setCoreState('ready');
       setCoreMessage('模型运行状态已恢复。');
     } catch (err) {
@@ -863,7 +857,7 @@ export function App() {
       await deletePlatform(token, platformId);
       setPlatforms((current) => current.filter((item) => item.id !== platformId));
       setModels((current) => current.filter((item) => item.platformId !== platformId));
-      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('modelCatalog', 'modelRateLimits', 'playgroundModels');
       setCoreState('ready');
       setCoreMessage('平台已删除。');
     } catch (err) {
@@ -879,7 +873,7 @@ export function App() {
     try {
       const item = tenantId ? await updateTenant(token, tenantId, input) : await createTenant(token, input);
       setTenants((current) => [item, ...current.filter((tenant) => tenant.id !== item.id)]);
-      invalidateDataKeys('playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('playgroundModels');
       setCoreState('ready');
       setCoreMessage(tenantId ? '租户已更新。' : '租户已创建。');
     } catch (err) {
@@ -895,7 +889,7 @@ export function App() {
     try {
       await deleteTenant(token, tenantId);
       setTenants((current) => current.filter((tenant) => tenant.id !== tenantId));
-      invalidateDataKeys('playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('playgroundModels');
       setCoreState('ready');
       setCoreMessage('租户已删除。');
     } catch (err) {
@@ -911,7 +905,7 @@ export function App() {
     try {
       const item = userId ? await updateGatewayUser(token, userId, input) : await createGatewayUser(token, input);
       setUsers((current) => [item, ...current.filter((user) => user.id !== item.id)]);
-      invalidateDataKeys('playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('playgroundModels');
       setCoreState('ready');
       setCoreMessage(userId ? '用户已更新。' : '用户已创建。');
     } catch (err) {
@@ -967,7 +961,7 @@ export function App() {
     try {
       const item = groupId ? await updateUserGroup(token, groupId, input) : await createUserGroup(token, input);
       setUserGroups((current) => [item, ...current.filter((group) => group.id !== item.id)]);
-      invalidateDataKeys('modelCatalog', 'playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('modelCatalog', 'playgroundModels');
       setCoreState('ready');
       setCoreMessage(groupId ? '用户组已更新。' : '用户组已创建。');
     } catch (err) {
@@ -985,7 +979,7 @@ export function App() {
       setUserGroups((current) => current.filter((group) => group.id !== groupId));
       setTenants((current) => current.map((tenant) => tenant.defaultUserGroupId === groupId ? { ...tenant, defaultUserGroupId: undefined } : tenant));
       setUsers((current) => current.map((user) => user.defaultUserGroupId === groupId ? { ...user, defaultUserGroupId: undefined } : user));
-      invalidateDataKeys('modelCatalog', 'playgroundModels', 'apiKeyPolicyModels');
+      invalidateDataKeys('modelCatalog', 'playgroundModels');
       setCoreState('ready');
       setCoreMessage('用户组已删除。');
     } catch (err) {
@@ -1039,7 +1033,7 @@ export function App() {
     try {
       const item = ruleId ? await updateAccessRule(token, ruleId, input) : await createAccessRule(token, input);
       setAccessRules((current) => [item, ...current.filter((rule) => rule.id !== item.id)]);
-      invalidateDataKeys('playgroundModels', 'apiKeyPolicyModels', 'modelCatalog');
+      invalidateDataKeys('playgroundModels', 'modelCatalog');
       setCoreState('ready');
       setCoreMessage(ruleId ? '访问权限规则已更新。' : '访问权限规则已创建。');
     } catch (err) {
@@ -1055,7 +1049,7 @@ export function App() {
     try {
       await deleteAccessRule(token, ruleId);
       setAccessRules((current) => current.filter((rule) => rule.id !== ruleId));
-      invalidateDataKeys('playgroundModels', 'apiKeyPolicyModels', 'modelCatalog');
+      invalidateDataKeys('playgroundModels', 'modelCatalog');
       setCoreState('ready');
       setCoreMessage('访问权限规则已删除。');
     } catch (err) {
@@ -1071,7 +1065,7 @@ export function App() {
     try {
       const response = await batchAccessRules(token, input);
       setAccessRules(response.items);
-      invalidateDataKeys('playgroundModels', 'apiKeyPolicyModels', 'modelCatalog');
+      invalidateDataKeys('playgroundModels', 'modelCatalog');
       setCoreState('ready');
       setCoreMessage('访问权限已更新。');
     } catch (err) {
@@ -1459,7 +1453,6 @@ export function App() {
             apiKeyForm={apiKeyForm}
             apiKeySecret={apiKeySecret}
             apiKeySecretsById={apiKeySecretsById}
-            apiKeyPolicyModels={apiKeyPolicyModels}
             data={data}
             message={coreMessage}
             section={workspaceSection}
@@ -1733,7 +1726,7 @@ function dataKeysForRoute(
   if (activePage === 'workspace') {
     if (workspaceSection === 'overview') return ['currentUser', 'currentUserGroups', 'apiKeys'];
     if (workspaceSection === 'billing') return ['wallet'];
-    if (workspaceSection === 'apiKeys') return ['apiKeys', 'accessRules', 'apiKeyPolicyModels'];
+    if (workspaceSection === 'apiKeys') return ['apiKeys', 'accessRules'];
     if (workspaceSection === 'tasks') return ['tasks'];
     if (workspaceSection === 'transactions') return ['wallet', 'walletTransactions'];
     return [];

apps/web/src/api.test.ts

@@ -238,17 +238,17 @@ describe('API Key permission resources', () => {
     vi.unstubAllGlobals();
   });
 
-  it('loads the user-owned resource pool independently from playable models', async () => {
-    const fetchMock = vi.fn().mockResolvedValue(new Response(JSON.stringify({ items: [] }), {
+  it('loads the key-scoped resource pool independently from playable models', async () => {
+	const fetchMock = vi.fn().mockResolvedValue(new Response(JSON.stringify({ items: [], ruleDiagnostics: [] }), {
       status: 200,
       headers: { 'Content-Type': 'application/json' },
     }));
     vi.stubGlobal('fetch', fetchMock);
 
-    await listApiKeyAssignableModels('user-token');
+	await listApiKeyAssignableModels('user-token', 'key-1');
 
     const [url, init] = fetchMock.mock.calls[0] as [string, RequestInit];
-    expect(url).toContain('/api/v1/api-keys/assignable-models');
+	expect(url).toContain('/api/v1/api-keys/key-1/assignable-models');
     expect(new Headers(init.headers).get('Authorization')).toBe('Bearer user-token');
   });
 });

apps/web/src/api.ts

@@ -18,6 +18,7 @@ import type {
   GatewayAccessRuleBatchRequest,
   GatewayAccessRule,
   GatewayAccessRuleUpsertRequest,
+  GatewayAPIKeyAssignableModelsResponse,
   GatewayApiKey,
   GatewayApiKeyScopeUpdateRequest,
   GatewayAuditLog,
@@ -159,7 +160,7 @@ export async function listModels(token: string): Promise<ListResponse<PlatformMo
 }
 
 export async function listPlayableModels(token: string): Promise<ListResponse<PlatformModel>> {
-  return request<ListResponse<PlatformModel>>('/api/v1/models', { token });
+  return request<ListResponse<PlatformModel>>('/api/v1/platform-models', { token });
 }
 
 export async function listModelCatalog(token: string): Promise<ModelCatalogResponse> {
@@ -461,8 +462,8 @@ export async function listApiKeyAccessRules(token: string): Promise<ListResponse
   return request<ListResponse<GatewayAccessRule>>('/api/v1/api-keys/access-rules', { token });
 }
 
-export async function listApiKeyAssignableModels(token: string): Promise<ListResponse<PlatformModel>> {
-  return request<ListResponse<PlatformModel>>('/api/v1/api-keys/assignable-models', { token });
+export async function listApiKeyAssignableModels(token: string, apiKeyId: string): Promise<GatewayAPIKeyAssignableModelsResponse> {
+  return request<GatewayAPIKeyAssignableModelsResponse>(`/api/v1/api-keys/${apiKeyId}/assignable-models`, { token });
 }
 
 export async function createAccessRule(token: string, input: GatewayAccessRuleUpsertRequest): Promise<GatewayAccessRule> {

apps/web/src/pages/ApiDocsPage.test.tsx

@@ -8,10 +8,10 @@ describe('ApiDocsPage extended task documentation', () => {
   it('separates the complete public catalog into common and compatibility interfaces', () => {
     const endpoints = publicApiCatalogGroups.flatMap((group) => group.endpoints);
 
-    expect(publicApiEndpointCount()).toBe(71);
-    expect(publicApiEndpointCount('open')).toBe(54);
+    expect(publicApiEndpointCount()).toBe(73);
+    expect(publicApiEndpointCount('open')).toBe(56);
     expect(publicApiEndpointCount('compatibility')).toBe(17);
-    expect(endpoints.every((endpoint) => endpoint.path.startsWith('/api/v1/'))).toBe(true);
+    expect(endpoints.every((endpoint) => endpoint.path.startsWith('/api/v1/') || endpoint.path === '/v1/models')).toBe(true);
   });
 
   it('renders the common open API catalog as a complete onboarding page', () => {
@@ -21,7 +21,7 @@ describe('ApiDocsPage extended task documentation', () => {
     expect(html).toContain('兼容接口');
     expect(html).toContain('https://ai.51easyai.com/api/v1');
     expect(html).toContain('接口数量');
-    expect(html).toContain('>54<');
+    expect(html).toContain('>56<');
     expect(html).toContain('/api/v1/videos/generations');
     expect(html).toContain('/api/v1/resource/material');
     expect(html).toContain('不要求调用方显式传入');

apps/web/src/pages/WorkspacePage.tsx

@@ -1,13 +1,13 @@
 import { useEffect, useMemo, useRef, useState, type FormEvent, type ReactNode } from 'react';
 import { Popover as AntPopover } from 'antd';
 import { ChevronLeft, ChevronRight, Copy, CreditCard, Eye, KeyRound, ListChecks, Plus, ReceiptText, RotateCcw, Search, ShieldCheck, SlidersHorizontal, Trash2, UserRound } from 'lucide-react';
-import type { AdminGatewayTask, GatewayAccessRuleBatchRequest, GatewayApiKey, GatewayApiKeyScopeUpdateRequest, GatewayTask, GatewayTaskParamPreprocessingLog, GatewayWalletAccount, GatewayWalletTransaction, IntegrationPlatform, PlatformModel } from '@easyai-ai-gateway/contracts';
+import type { AdminGatewayTask, GatewayAccessRuleBatchRequest, GatewayAPIKeyAccessRuleDiagnostic, GatewayApiKey, GatewayApiKeyScopeUpdateRequest, GatewayTask, GatewayTaskParamPreprocessingLog, GatewayWalletAccount, GatewayWalletTransaction, IntegrationPlatform, PlatformModel } from '@easyai-ai-gateway/contracts';
 import type { ConsoleData } from '../app-state';
 import { EntityTable } from '../components/EntityTable';
 import { Badge, Button, Card, CardContent, CardHeader, CardTitle, Checkbox, ConfirmDialog, DateTimePicker, DateTimeRangePicker, FormDialog, Input, Label, Select, Table, TableCell, TableFooter, TableHead, TablePageActions, TableRow, TableToolbar, TableViewportLayout, Tabs } from '../components/ui';
 import { AccessPermissionEditor, countAccessPermissionRules } from './admin/AccessPermissionEditor';
 import type { ApiKeyForm, LoadState, WorkspaceSection, WorkspaceTaskQuery, WorkspaceTransactionQuery } from '../types';
-import { listTaskParamPreprocessing } from '../api';
+import { listApiKeyAssignableModels, listTaskParamPreprocessing } from '../api';
 
 const tabs = [
   { value: 'overview', label: '个人总览', icon: <UserRound size={15} /> },
@@ -24,9 +24,12 @@ const apiKeyScopeOptions = [
   { value: 'embedding', label: '向量', description: 'Embeddings' },
   { value: 'rerank', label: '重排', description: 'Reranks' },
   { value: 'image', label: '图像', description: 'Images' },
+  { value: 'image_vectorize', label: '图像向量化', description: 'Image Vectorize' },
   { value: 'video', label: '视频', description: 'Videos' },
+  { value: 'video_enhance', label: '视频增强', description: 'Video Upscale / Enhance' },
   { value: 'music', label: '音乐生成', description: 'Song / Music' },
   { value: 'audio', label: '语音合成', description: 'Speech / TTS' },
+  { value: 'voice_clone', label: '声音克隆', description: 'Voice Clone' },
   { value: 'all', label: '全部能力', description: '不按接口能力限制' },
 ] as const;
 
@@ -36,7 +39,6 @@ export function WorkspacePage(props: {
   apiKeyForm: ApiKeyForm;
   apiKeySecret: string;
   apiKeySecretsById: Record<string, string>;
-  apiKeyPolicyModels: PlatformModel[];
   data: ConsoleData;
   message: string;
   section: WorkspaceSection;
@@ -389,10 +391,10 @@ function ApiKeyPanel(props: {
   apiKeyForm: ApiKeyForm;
   apiKeySecret: string;
   apiKeySecretsById: Record<string, string>;
-  apiKeyPolicyModels: PlatformModel[];
   data: ConsoleData;
   message: string;
   state: LoadState;
+  token: string;
   onBatchAccessRules: (input: GatewayAccessRuleBatchRequest) => Promise<void>;
   onDeleteApiKey: (apiKeyId: string) => Promise<void>;
   onApiKeyFormChange: (value: ApiKeyForm) => void;
@@ -407,6 +409,10 @@ function ApiKeyPanel(props: {
   const [scopeError, setScopeError] = useState('');
   const [pendingDelete, setPendingDelete] = useState<GatewayApiKey | null>(null);
   const [localMessage, setLocalMessage] = useState('');
+  const [policyModels, setPolicyModels] = useState<PlatformModel[]>([]);
+  const [policyDiagnostics, setPolicyDiagnostics] = useState<GatewayAPIKeyAccessRuleDiagnostic[]>([]);
+  const [policyState, setPolicyState] = useState<LoadState>('idle');
+  const [policyError, setPolicyError] = useState('');
   const selectedPolicyKey = useMemo(
     () => props.data.apiKeys.find((item) => item.id === policyApiKeyId),
     [policyApiKeyId, props.data.apiKeys],
@@ -415,7 +421,44 @@ function ApiKeyPanel(props: {
     () => props.data.apiKeys.find((item) => item.id === scopeApiKeyId),
     [scopeApiKeyId, props.data.apiKeys],
   );
-  const permissionPlatforms = useMemo(() => platformsForPermissionTree(props.apiKeyPolicyModels), [props.apiKeyPolicyModels]);
+  const permissionPlatforms = useMemo(() => platformsForPermissionTree(policyModels), [policyModels]);
+
+  useEffect(() => {
+    if (!policyApiKeyId) {
+      setPolicyModels([]);
+      setPolicyDiagnostics([]);
+      setPolicyState('idle');
+      setPolicyError('');
+      return;
+    }
+    let cancelled = false;
+    setPolicyState('loading');
+    setPolicyError('');
+    void listApiKeyAssignableModels(props.token, policyApiKeyId).then((response) => {
+      if (cancelled) return;
+      setPolicyModels(response.items);
+      setPolicyDiagnostics(response.ruleDiagnostics);
+      setPolicyState('ready');
+    }).catch((error) => {
+      if (cancelled) return;
+      setPolicyModels([]);
+      setPolicyDiagnostics([]);
+      setPolicyState('error');
+      setPolicyError(error instanceof Error ? error.message : 'API Key 可分配模型加载失败');
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [policyApiKeyId, props.token]);
+
+  async function savePolicyRules(input: GatewayAccessRuleBatchRequest) {
+    await props.onBatchAccessRules(input);
+    if (!policyApiKeyId) return;
+    const response = await listApiKeyAssignableModels(props.token, policyApiKeyId);
+    setPolicyModels(response.items);
+    setPolicyDiagnostics(response.ruleDiagnostics);
+    setPolicyState('ready');
+  }
 
   async function copyApiKey(item: GatewayApiKey) {
     const secret = apiKeySecretFor(item, props.apiKeySecretsById);
@@ -620,15 +663,17 @@ function ApiKeyPanel(props: {
         onClose={() => setPolicyApiKeyId('')}
         onSubmit={(event) => event.preventDefault()}
       >
+        {policyError && <p className="formMessage error">{policyError}</p>}
         <AccessPermissionEditor
           accessRules={props.data.accessRules}
           metadataMode="api_key_permission_tree"
-          platformModels={props.apiKeyPolicyModels}
+          platformModels={policyModels}
           platforms={permissionPlatforms}
-          state={props.state}
+          ruleDiagnostics={policyDiagnostics}
+          state={policyState}
           subjectId={selectedPolicyKey?.id ?? ''}
           subjectType="api_key"
-          onBatchAccessRules={props.onBatchAccessRules}
+          onBatchAccessRules={savePolicyRules}
         />
       </FormDialog>
 

apps/web/src/pages/admin/AccessPermissionEditor.test.tsx

@@ -0,0 +1,63 @@
+import { renderToStaticMarkup } from 'react-dom/server';
+import { describe, expect, it, vi } from 'vitest';
+import type { IntegrationPlatform, PlatformModel } from '@easyai-ai-gateway/contracts';
+import { AccessPermissionEditor } from './AccessPermissionEditor';
+
+describe('AccessPermissionEditor API Key diagnostics', () => {
+  it('shows retained ineffective rules and only the scope-pruned model capabilities', () => {
+    const platform = {
+      id: 'platform-1',
+      provider: 'openai',
+      platformKey: 'scope-test',
+      name: 'Scope Test',
+      authType: 'bearer',
+      status: 'enabled',
+      priority: 0,
+      effectivePriority: 0,
+      defaultPricingMode: 'inherit',
+      defaultDiscountFactor: 1,
+      createdAt: '2026-08-03T00:00:00Z',
+      updatedAt: '2026-08-03T00:00:00Z',
+    } satisfies IntegrationPlatform;
+    const model = {
+      id: 'model-1',
+      platformId: platform.id,
+      modelName: 'multi-model',
+      modelType: ['image_generate'],
+      displayName: 'Multi Model',
+      pricingMode: 'inherit',
+      rateLimitPolicyMode: 'inherit',
+      enabled: true,
+      createdAt: '2026-08-03T00:00:00Z',
+      updatedAt: '2026-08-03T00:00:00Z',
+    } satisfies PlatformModel;
+
+    const html = renderToStaticMarkup(
+      <AccessPermissionEditor
+        accessRules={[]}
+        platformModels={[model]}
+        platforms={[platform]}
+        ruleDiagnostics={[{
+          ruleId: 'rule-1',
+          resourceType: 'platform_model',
+          resourceId: 'text-model',
+          resourceName: 'Text Model',
+          effect: 'allow',
+          effective: false,
+          reason: 'scope_not_allowed',
+        }]}
+        state="ready"
+        subjectId="key-1"
+        subjectType="api_key"
+        onBatchAccessRules={vi.fn()}
+      />,
+    );
+
+    expect(html).toContain('1 条规则当前不生效');
+    expect(html).toContain('Text Model');
+    expect(html).toContain('不在当前 API Key 的能力范围内');
+    expect(html).toContain('移除规则');
+    expect(html).toContain('image_generate');
+    expect(html).not.toContain('text_generate');
+  });
+});

apps/web/src/pages/admin/AccessPermissionEditor.tsx

@@ -2,6 +2,7 @@ import { useEffect, useMemo, useState } from 'react';
 import { ChevronDown, ChevronRight } from 'lucide-react';
 import type {
   GatewayAccessEffect,
+  GatewayAPIKeyAccessRuleDiagnostic,
   GatewayAccessRule,
   GatewayAccessRuleBatchRequest,
   GatewayAccessRuleResourceRequest,
@@ -14,7 +15,7 @@ import { Badge, Button, Card, CardContent, CardHeader, CardTitle, Checkbox, Inpu
 import type { LoadState } from '../../types';
 
 type Effect = Extract<GatewayAccessEffect, 'allow' | 'deny'>;
-type ResourceType = Extract<GatewayAccessResourceType, 'platform' | 'platform_model'>;
+type ResourceType = GatewayAccessResourceType;
 type ResourceKey = `${ResourceType}:${string}`;
 
 type PlatformNode = {
@@ -34,6 +35,7 @@ export function AccessPermissionEditor(props: {
   metadataMode?: string;
   platformModels: PlatformModel[];
   platforms: IntegrationPlatform[];
+  ruleDiagnostics?: GatewayAPIKeyAccessRuleDiagnostic[];
   state: LoadState;
   subjectId: string;
   subjectType: Extract<GatewayAccessSubjectType, 'user_group' | 'api_key'>;
@@ -51,6 +53,10 @@ export function AccessPermissionEditor(props: {
     [props.accessRules, props.subjectId, props.subjectType],
   );
   const ruleByEffectAndResource = useMemo(() => buildRuleIndex(subjectRules), [subjectRules]);
+  const ineffectiveRules = useMemo(
+    () => (props.ruleDiagnostics ?? []).filter((diagnostic) => !diagnostic.effective),
+    [props.ruleDiagnostics],
+  );
   const allowTree = useMemo(() => filterTree(platformTree, allowSearch), [allowSearch, platformTree]);
   const denyTree = useMemo(() => filterTree(platformTree, denySearch), [denySearch, platformTree]);
 
@@ -65,19 +71,20 @@ export function AccessPermissionEditor(props: {
   }
 
   async function setPlatformPermission(effect: Effect, platform: PlatformNode, enabled: boolean) {
-    const keys = [
-      makeResourceKey('platform', platform.id),
-      ...platform.models.map((model) => makeResourceKey('platform_model', model.id)),
-    ];
-    await batchApply(effect, keys, enabled);
+    const modelKeys = platform.models.map((model) => makeResourceKey('platform_model', model.id));
+    if (enabled && props.subjectType === 'api_key') {
+      await batchApply(effect, modelKeys, true);
+      return;
+    }
+    await batchApply(effect, [makeResourceKey('platform', platform.id), ...modelKeys], enabled);
   }
 
   async function selectAll(effect: Effect, nodes: PlatformNode[]) {
-    await batchApply(effect, visibleResourceKeys(nodes), true);
+    await batchApply(effect, visibleResourceKeys(nodes, props.subjectType !== 'api_key'), true);
   }
 
   async function reverseVisible(effect: Effect, nodes: PlatformNode[]) {
-    const keys = visibleResourceKeys(nodes);
+    const keys = visibleResourceKeys(nodes, props.subjectType !== 'api_key');
     const upsertKeys: ResourceKey[] = [];
     const deleteKeys: ResourceKey[] = [];
     for (const key of keys) {
@@ -88,6 +95,16 @@ export function AccessPermissionEditor(props: {
     await applyPermissionBatch(effect, upsertKeys, deleteKeys);
   }
 
+  async function removeIneffectiveRule(diagnostic: GatewayAPIKeyAccessRuleDiagnostic) {
+    if (diagnostic.effect !== 'allow' && diagnostic.effect !== 'deny') return;
+    await applyPermissionBatch(
+      diagnostic.effect,
+      [],
+      [makeResourceKey(diagnostic.resourceType as ResourceType, diagnostic.resourceId)],
+      '失效规则移除失败',
+    );
+  }
+
   async function clearEffect(effect: Effect) {
     const keys = subjectRules
       .filter((rule) => rule.effect === effect)
@@ -138,11 +155,32 @@ export function AccessPermissionEditor(props: {
   return (
     <div className="accessEditorStack">
       {localError && <p className="formMessage">{localError}</p>}
+      {ineffectiveRules.length > 0 && (
+        <section className="accessRuleDiagnostics" aria-label="失效 API Key 权限规则">
+          <div>
+            <strong>{ineffectiveRules.length} 条规则当前不生效</strong>
+            <span>规则已保留，不会扩大权限或阻断其他 API Key。</span>
+          </div>
+          {ineffectiveRules.map((diagnostic) => (
+            <div className="accessRuleDiagnosticRow" key={diagnostic.ruleId}>
+              <span>
+                <Badge variant="outline">{diagnostic.effect === 'allow' ? '专属' : '排除'}</Badge>
+                <strong>{diagnostic.resourceName || diagnostic.resourceId}</strong>
+                <small>{accessRuleDiagnosticReason(diagnostic.reason)}</small>
+              </span>
+              <Button type="button" variant="outline" size="sm" disabled={props.state === 'loading'} onClick={() => void removeIneffectiveRule(diagnostic)}>
+                移除规则
+              </Button>
+            </div>
+          ))}
+        </section>
+      )}
       <section className="accessPermissionGrid">
         <PermissionTreePanel
           emptyText="暂无可维护的平台模型"
           effect="allow"
           expanded={allowExpanded}
+          modelOnlySelection={props.subjectType === 'api_key'}
           rules={ruleByEffectAndResource}
           search={allowSearch}
           state={props.state}
@@ -163,6 +201,7 @@ export function AccessPermissionEditor(props: {
           emptyText="暂无可维护的平台模型"
           effect="deny"
           expanded={denyExpanded}
+          modelOnlySelection={props.subjectType === 'api_key'}
           rules={ruleByEffectAndResource}
           search={denySearch}
           state={props.state}
@@ -188,6 +227,7 @@ function PermissionTreePanel(props: {
   effect: Effect;
   emptyText: string;
   expanded: Set<string>;
+  modelOnlySelection: boolean;
   rules: Map<string, GatewayAccessRule>;
   search: string;
   state: LoadState;
@@ -229,6 +269,7 @@ function PermissionTreePanel(props: {
               key={platform.id}
               platform={platform}
               rules={props.rules}
+              modelOnlySelection={props.modelOnlySelection}
               onToggleExpanded={props.onToggleExpanded}
               onTogglePlatformPermission={props.onTogglePlatformPermission}
               onTogglePermission={props.onTogglePermission}
@@ -245,6 +286,7 @@ function PlatformPermissionNode(props: {
   expanded: boolean;
   platform: PlatformNode;
   rules: Map<string, GatewayAccessRule>;
+  modelOnlySelection: boolean;
   onToggleExpanded: (platformId: string) => void;
   onTogglePlatformPermission: (effect: Effect, platform: PlatformNode, enabled: boolean) => void;
   onTogglePermission: (effect: Effect, resourceType: ResourceType, resourceId: string, enabled: boolean) => void;
@@ -252,7 +294,17 @@ function PlatformPermissionNode(props: {
   const platformRuleKey = `${props.effect}:${makeResourceKey('platform', props.platform.id)}`;
   const checkedModels = props.platform.models.filter((model) => props.rules.has(`${props.effect}:${makeResourceKey('platform_model', model.id)}`)).length;
   const platformChecked = props.rules.has(platformRuleKey);
-  const platformState = platformChecked ? true : checkedModels > 0 ? 'indeterminate' : false;
+  const platformState = props.modelOnlySelection
+    ? checkedModels > 0 && checkedModels === props.platform.models.length
+      ? true
+      : checkedModels > 0 || platformChecked
+        ? 'indeterminate'
+        : false
+    : platformChecked
+      ? true
+      : checkedModels > 0
+        ? 'indeterminate'
+        : false;
   return (
     <div className="accessTreeNode">
       <div className="accessTreeRow">
@@ -352,9 +404,9 @@ function countEffectRules(rules: GatewayAccessRule[], effect: Effect) {
   }, { platforms: 0, models: 0 });
 }
 
-function visibleResourceKeys(nodes: PlatformNode[]): ResourceKey[] {
+function visibleResourceKeys(nodes: PlatformNode[], includePlatforms: boolean): ResourceKey[] {
   return nodes.flatMap((platform) => [
-    makeResourceKey('platform', platform.id),
+    ...(includePlatforms ? [makeResourceKey('platform', platform.id)] : []),
     ...platform.models.map((model) => makeResourceKey('platform_model', model.id)),
   ]);
 }
@@ -382,10 +434,23 @@ function resourceRequestFromKey(resourceKey: ResourceKey): GatewayAccessRuleReso
 }
 
 function resourceKeyFromRule(rule: GatewayAccessRule): ResourceKey | undefined {
-  if (rule.resourceType !== 'platform' && rule.resourceType !== 'platform_model') return undefined;
+  if (rule.resourceType !== 'platform' && rule.resourceType !== 'platform_model' && rule.resourceType !== 'base_model') return undefined;
   return makeResourceKey(rule.resourceType, rule.resourceId);
 }
 
+function accessRuleDiagnosticReason(reason?: string) {
+  switch (reason) {
+    case 'resource_unavailable':
+      return '平台或模型当前未启用';
+    case 'owner_access_revoked':
+      return '已被用户组、租户或用户权限收回';
+    case 'scope_not_allowed':
+      return '不在当前 API Key 的能力范围内';
+    default:
+      return '当前规则不生效';
+  }
+}
+
 function dedupeResourceKeys(keys: ResourceKey[]) {
   return Array.from(new Set(keys.filter(Boolean)));
 }

apps/web/src/pages/api-docs-catalog.ts

@@ -63,7 +63,7 @@ export const publicApiCatalogGroups: PublicApiCatalogGroup[] = [
       { method: 'POST', path: '/api/v1/api-keys', description: '创建 API Key' },
       { method: 'GET', path: '/api/v1/api-keys/access-rules', description: '查询 Key 访问规则' },
       { method: 'POST', path: '/api/v1/api-keys/access-rules/batch', description: '批量设置 Key 访问规则' },
-      { method: 'GET', path: '/api/v1/api-keys/assignable-models', description: '查询可分配模型' },
+      { method: 'GET', path: '/api/v1/api-keys/{apiKeyID}/assignable-models', description: '查询指定 Key 可分配模型与失效规则' },
       { method: 'PATCH', path: '/api/v1/api-keys/{apiKeyID}/scopes', description: '更新 Key 权限范围' },
       { method: 'PATCH', path: '/api/v1/api-keys/{apiKeyID}/disable', description: '禁用 Key' },
       { method: 'DELETE', path: '/api/v1/api-keys/{apiKeyID}', description: '删除 Key' },
@@ -77,7 +77,9 @@ export const publicApiCatalogGroups: PublicApiCatalogGroup[] = [
     endpoints: [
       { method: 'GET', path: '/api/v1/model-catalog', description: '模型能力目录' },
       { method: 'GET', path: '/api/v1/platforms', description: '当前用户可用平台' },
-      { method: 'GET', path: '/api/v1/models', description: '当前用户可用模型' },
+      { method: 'GET', path: '/api/v1/platform-models', description: '当前身份可用的平台模型来源明细' },
+      { method: 'GET', path: '/v1/models', description: 'OpenAI 兼容逻辑模型列表' },
+      { method: 'GET', path: '/api/v1/models', description: '已弃用的平台模型来源明细' },
       { method: 'GET', path: '/api/v1/playground/models', description: 'Playground 可用模型' },
       { method: 'POST', path: '/api/v1/pricing/estimate', description: '请求价格预估' },
     ],

apps/web/src/styles/pages.css

@@ -467,6 +467,48 @@
   gap: 12px;
 }
 
+.accessRuleDiagnostics {
+  display: grid;
+  gap: 0.625rem;
+  padding: 0.75rem;
+  border: 1px solid var(--warning-border, var(--border-subtle));
+  border-radius: var(--radius-md);
+  background: var(--surface-subtle);
+}
+
+.accessRuleDiagnostics > div:first-child,
+.accessRuleDiagnosticRow,
+.accessRuleDiagnosticRow > span {
+  display: flex;
+  align-items: center;
+  gap: 0.5rem;
+}
+
+.accessRuleDiagnostics > div:first-child {
+  flex-wrap: wrap;
+  color: var(--muted-foreground);
+  font-size: var(--font-size-sm);
+}
+
+.accessRuleDiagnostics > div:first-child strong {
+  color: var(--foreground);
+}
+
+.accessRuleDiagnosticRow {
+  justify-content: space-between;
+  padding-top: 0.625rem;
+  border-top: 1px solid var(--border-subtle);
+}
+
+.accessRuleDiagnosticRow > span {
+  min-width: 0;
+  flex-wrap: wrap;
+}
+
+.accessRuleDiagnosticRow small {
+  color: var(--muted-foreground);
+}
+
 .accessPermissionPanel .shCardContent {
   display: grid;
   gap: 12px;