mise en place gestion modele chatbot coté enseignant
This commit is contained in:
nicoboy
455
config/api_key_manager.php
Normal file
455
config/api_key_manager.php
Normal file
@ -0,0 +1,455 @@
|
||||
<?php
|
||||
/**
|
||||
* Gestionnaire de clés API pour le chatbot
|
||||
* Chiffrement AES-256-CBC des clés API
|
||||
*
|
||||
* @author WebVal
|
||||
* @date 2026-01-04
|
||||
*/
|
||||
|
||||
class APIKeyManager {
|
||||
|
||||
private static $encryption_key = null;
|
||||
private static $db = null;
|
||||
|
||||
/**
|
||||
* Initialiser la connexion BDD
|
||||
*/
|
||||
private static function init() {
|
||||
if (self::$db === null) {
|
||||
self::$db = Database::getInstance();
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Récupérer la clé de chiffrement
|
||||
* Ordre de priorité : ENV > Fichier > Génération
|
||||
*/
|
||||
private static function getEncryptionKey() {
|
||||
if (self::$encryption_key !== null) {
|
||||
return self::$encryption_key;
|
||||
}
|
||||
|
||||
// 1. Variable d'environnement
|
||||
$key = getenv('WEBVAL_API_ENCRYPTION_KEY');
|
||||
|
||||
// 2. Fichier externe (hors webroot)
|
||||
if (!$key && file_exists('/etc/webval/encryption.key')) {
|
||||
$key = file_get_contents('/etc/webval/encryption.key');
|
||||
}
|
||||
|
||||
// 3. Fichier dans config (fallback)
|
||||
$keyFile = __DIR__ . '/../config/.encryption_key';
|
||||
if (!$key && file_exists($keyFile)) {
|
||||
$key = file_get_contents($keyFile);
|
||||
}
|
||||
|
||||
// 4. Générer une nouvelle clé si aucune n'existe
|
||||
if (!$key) {
|
||||
$key = bin2hex(random_bytes(32));
|
||||
|
||||
// Essayer de sauvegarder
|
||||
if (is_writable(__DIR__ . '/../config/')) {
|
||||
file_put_contents($keyFile, $key);
|
||||
chmod($keyFile, 0600);
|
||||
}
|
||||
|
||||
error_log("⚠️ Nouvelle clé de chiffrement générée. Sauvegarde recommandée.");
|
||||
}
|
||||
|
||||
self::$encryption_key = $key;
|
||||
return $key;
|
||||
}
|
||||
|
||||
/**
|
||||
* Chiffrer une clé API
|
||||
*
|
||||
* @param string $plaintext Clé API en clair
|
||||
* @return string Clé chiffrée (base64)
|
||||
*/
|
||||
public static function encrypt($plaintext) {
|
||||
if (empty($plaintext)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$key = hash('sha256', self::getEncryptionKey(), true);
|
||||
$iv = random_bytes(16);
|
||||
|
||||
$ciphertext = openssl_encrypt(
|
||||
$plaintext,
|
||||
'AES-256-CBC',
|
||||
$key,
|
||||
OPENSSL_RAW_DATA,
|
||||
$iv
|
||||
);
|
||||
|
||||
if ($ciphertext === false) {
|
||||
throw new Exception("Erreur de chiffrement");
|
||||
}
|
||||
|
||||
// Format: IV (16 bytes) + Ciphertext
|
||||
return base64_encode($iv . $ciphertext);
|
||||
}
|
||||
|
||||
/**
|
||||
* Déchiffrer une clé API
|
||||
*
|
||||
* @param string $encrypted Clé chiffrée (base64)
|
||||
* @return string|null Clé API en clair
|
||||
*/
|
||||
public static function decrypt($encrypted) {
|
||||
if (empty($encrypted)) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$key = hash('sha256', self::getEncryptionKey(), true);
|
||||
$data = base64_decode($encrypted);
|
||||
|
||||
if ($data === false || strlen($data) < 16) {
|
||||
throw new Exception("Données chiffrées invalides");
|
||||
}
|
||||
|
||||
$iv = substr($data, 0, 16);
|
||||
$ciphertext = substr($data, 16);
|
||||
|
||||
$plaintext = openssl_decrypt(
|
||||
$ciphertext,
|
||||
'AES-256-CBC',
|
||||
$key,
|
||||
OPENSSL_RAW_DATA,
|
||||
$iv
|
||||
);
|
||||
|
||||
if ($plaintext === false) {
|
||||
throw new Exception("Erreur de déchiffrement");
|
||||
}
|
||||
|
||||
return $plaintext;
|
||||
}
|
||||
|
||||
/**
|
||||
* Sauvegarder une clé API
|
||||
*
|
||||
* @param int $id_enseignant ID de l'enseignant
|
||||
* @param string $provider Provider (gemini, mistral, etc.)
|
||||
* @param string $api_key Clé API en clair
|
||||
* @param string $model_default Modèle par défaut
|
||||
* @return bool Succès
|
||||
*/
|
||||
public static function saveKey($id_enseignant, $provider, $api_key, $model_default = null) {
|
||||
self::init();
|
||||
|
||||
// Chiffrer la clé
|
||||
$encrypted = self::encrypt($api_key);
|
||||
|
||||
// Upsert (INSERT ... ON DUPLICATE KEY UPDATE)
|
||||
$query = "INSERT INTO api_keys
|
||||
(id_enseignant, provider, api_key_encrypted, model_default, is_active, quota_reset_date)
|
||||
VALUES (?, ?, ?, ?, TRUE, DATE_ADD(CURDATE(), INTERVAL 1 MONTH))
|
||||
ON DUPLICATE KEY UPDATE
|
||||
api_key_encrypted = VALUES(api_key_encrypted),
|
||||
model_default = VALUES(model_default),
|
||||
is_active = TRUE,
|
||||
updated_at = CURRENT_TIMESTAMP";
|
||||
|
||||
return self::$db->query($query, [
|
||||
$id_enseignant,
|
||||
$provider,
|
||||
$encrypted,
|
||||
$model_default
|
||||
]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Récupérer une clé API déchiffrée
|
||||
*
|
||||
* @param int $id_enseignant ID de l'enseignant
|
||||
* @param string $provider Provider
|
||||
* @return array|null ['api_key' => '...', 'model_default' => '...']
|
||||
*/
|
||||
public static function getKey($id_enseignant, $provider) {
|
||||
self::init();
|
||||
|
||||
$result = self::$db->fetchOne(
|
||||
"SELECT api_key_encrypted, model_default, is_active
|
||||
FROM api_keys
|
||||
WHERE id_enseignant = ? AND provider = ?",
|
||||
[$id_enseignant, $provider]
|
||||
);
|
||||
|
||||
if (!$result || !$result['is_active']) {
|
||||
return null;
|
||||
}
|
||||
|
||||
return [
|
||||
'api_key' => self::decrypt($result['api_key_encrypted']),
|
||||
'model_default' => $result['model_default']
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* Supprimer une clé API
|
||||
*
|
||||
* @param int $id_enseignant ID de l'enseignant
|
||||
* @param string $provider Provider
|
||||
* @return bool Succès
|
||||
*/
|
||||
public static function deleteKey($id_enseignant, $provider) {
|
||||
self::init();
|
||||
|
||||
return self::$db->query(
|
||||
"DELETE FROM api_keys WHERE id_enseignant = ? AND provider = ?",
|
||||
[$id_enseignant, $provider]
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Lister toutes les clés d'un enseignant
|
||||
*
|
||||
* @param int $id_enseignant ID de l'enseignant
|
||||
* @return array Liste des clés (sans les clés déchiffrées)
|
||||
*/
|
||||
public static function listKeys($id_enseignant) {
|
||||
self::init();
|
||||
|
||||
return self::$db->fetchAll(
|
||||
"SELECT
|
||||
id,
|
||||
provider,
|
||||
model_default,
|
||||
is_active,
|
||||
quota_max,
|
||||
quota_used,
|
||||
quota_reset_date,
|
||||
last_used,
|
||||
created_at
|
||||
FROM api_keys
|
||||
WHERE id_enseignant = ?
|
||||
ORDER BY provider",
|
||||
[$id_enseignant]
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Incrémenter le quota utilisé
|
||||
*
|
||||
* @param int $id_enseignant ID de l'enseignant
|
||||
* @param string $provider Provider
|
||||
* @param int $tokens_used Nombre de tokens utilisés
|
||||
*/
|
||||
public static function incrementQuota($id_enseignant, $provider, $tokens_used = 1) {
|
||||
self::init();
|
||||
|
||||
// Reset quota si date dépassée
|
||||
self::$db->query(
|
||||
"UPDATE api_keys
|
||||
SET quota_used = 0, quota_reset_date = DATE_ADD(CURDATE(), INTERVAL 1 MONTH)
|
||||
WHERE id_enseignant = ? AND provider = ? AND quota_reset_date < CURDATE()",
|
||||
[$id_enseignant, $provider]
|
||||
);
|
||||
|
||||
// Incrémenter
|
||||
return self::$db->query(
|
||||
"UPDATE api_keys
|
||||
SET quota_used = quota_used + ?, last_used = NOW()
|
||||
WHERE id_enseignant = ? AND provider = ?",
|
||||
[$tokens_used, $id_enseignant, $provider]
|
||||
);
|
||||
}
|
||||
|
||||
/**
|
||||
* Vérifier si le quota est dépassé
|
||||
*
|
||||
* @param int $id_enseignant ID de l'enseignant
|
||||
* @param string $provider Provider
|
||||
* @return bool True si quota OK
|
||||
*/
|
||||
public static function checkQuota($id_enseignant, $provider) {
|
||||
self::init();
|
||||
|
||||
$result = self::$db->fetchOne(
|
||||
"SELECT quota_max, quota_used FROM api_keys
|
||||
WHERE id_enseignant = ? AND provider = ?",
|
||||
[$id_enseignant, $provider]
|
||||
);
|
||||
|
||||
if (!$result || $result['quota_max'] === null) {
|
||||
return true; // Pas de limite
|
||||
}
|
||||
|
||||
return $result['quota_used'] < $result['quota_max'];
|
||||
}
|
||||
|
||||
/**
|
||||
* Tester une connexion API
|
||||
*
|
||||
* @param string $provider Provider à tester
|
||||
* @param string $api_key Clé API
|
||||
* @param string $model Modèle à tester
|
||||
* @return array ['success' => bool, 'message' => string, 'latency_ms' => int]
|
||||
*/
|
||||
public static function testConnection($provider, $api_key, $model = null) {
|
||||
$start = microtime(true);
|
||||
|
||||
try {
|
||||
switch ($provider) {
|
||||
case 'gemini':
|
||||
$result = self::testGemini($api_key, $model ?? 'gemini-2.0-flash-exp');
|
||||
break;
|
||||
|
||||
case 'mistral':
|
||||
$result = self::testMistral($api_key, $model ?? 'ministral-3b-latest');
|
||||
break;
|
||||
|
||||
case 'openai':
|
||||
$result = self::testOpenAI($api_key, $model ?? 'gpt-4o-mini');
|
||||
break;
|
||||
|
||||
case 'ollama':
|
||||
$result = self::testOllama($model ?? 'ministral-3:3b');
|
||||
break;
|
||||
|
||||
default:
|
||||
return ['success' => false, 'message' => 'Provider inconnu'];
|
||||
}
|
||||
|
||||
$latency = round((microtime(true) - $start) * 1000);
|
||||
$result['latency_ms'] = $latency;
|
||||
|
||||
return $result;
|
||||
|
||||
} catch (Exception $e) {
|
||||
return [
|
||||
'success' => false,
|
||||
'message' => 'Erreur: ' . $e->getMessage(),
|
||||
'latency_ms' => 0
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Tester connexion Gemini
|
||||
*/
|
||||
private static function testGemini($api_key, $model) {
|
||||
$url = "https://generativelanguage.googleapis.com/v1beta/models/{$model}:generateContent?key={$api_key}";
|
||||
|
||||
$ch = curl_init($url);
|
||||
curl_setopt_array($ch, [
|
||||
CURLOPT_POST => true,
|
||||
CURLOPT_RETURNTRANSFER => true,
|
||||
CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
|
||||
CURLOPT_TIMEOUT => 10,
|
||||
CURLOPT_POSTFIELDS => json_encode([
|
||||
'contents' => [['parts' => [['text' => 'Test']]]]
|
||||
])
|
||||
]);
|
||||
|
||||
$response = curl_exec($ch);
|
||||
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
curl_close($ch);
|
||||
|
||||
if ($http_code === 200) {
|
||||
return ['success' => true, 'message' => 'Connexion Gemini réussie'];
|
||||
} elseif ($http_code === 400) {
|
||||
return ['success' => false, 'message' => 'Clé API invalide'];
|
||||
} elseif ($http_code === 429) {
|
||||
return ['success' => false, 'message' => 'Quota dépassé'];
|
||||
} else {
|
||||
return ['success' => false, 'message' => "Erreur HTTP $http_code"];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Tester connexion Mistral
|
||||
*/
|
||||
private static function testMistral($api_key, $model) {
|
||||
$ch = curl_init('https://api.mistral.ai/v1/chat/completions');
|
||||
curl_setopt_array($ch, [
|
||||
CURLOPT_POST => true,
|
||||
CURLOPT_RETURNTRANSFER => true,
|
||||
CURLOPT_HTTPHEADER => [
|
||||
'Content-Type: application/json',
|
||||
'Authorization: Bearer ' . $api_key
|
||||
],
|
||||
CURLOPT_TIMEOUT => 10,
|
||||
CURLOPT_POSTFIELDS => json_encode([
|
||||
'model' => $model,
|
||||
'messages' => [['role' => 'user', 'content' => 'Test']],
|
||||
'max_tokens' => 10
|
||||
])
|
||||
]);
|
||||
|
||||
$response = curl_exec($ch);
|
||||
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
curl_close($ch);
|
||||
|
||||
if ($http_code === 200) {
|
||||
return ['success' => true, 'message' => 'Connexion Mistral réussie'];
|
||||
} elseif ($http_code === 401) {
|
||||
return ['success' => false, 'message' => 'Clé API invalide'];
|
||||
} else {
|
||||
return ['success' => false, 'message' => "Erreur HTTP $http_code"];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Tester connexion OpenAI
|
||||
*/
|
||||
private static function testOpenAI($api_key, $model) {
|
||||
$ch = curl_init('https://api.openai.com/v1/chat/completions');
|
||||
curl_setopt_array($ch, [
|
||||
CURLOPT_POST => true,
|
||||
CURLOPT_RETURNTRANSFER => true,
|
||||
CURLOPT_HTTPHEADER => [
|
||||
'Content-Type: application/json',
|
||||
'Authorization: Bearer ' . $api_key
|
||||
],
|
||||
CURLOPT_TIMEOUT => 10,
|
||||
CURLOPT_POSTFIELDS => json_encode([
|
||||
'model' => $model,
|
||||
'messages' => [['role' => 'user', 'content' => 'Test']],
|
||||
'max_tokens' => 10
|
||||
])
|
||||
]);
|
||||
|
||||
$response = curl_exec($ch);
|
||||
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
curl_close($ch);
|
||||
|
||||
if ($http_code === 200) {
|
||||
return ['success' => true, 'message' => 'Connexion OpenAI réussie'];
|
||||
} elseif ($http_code === 401) {
|
||||
return ['success' => false, 'message' => 'Clé API invalide'];
|
||||
} else {
|
||||
return ['success' => false, 'message' => "Erreur HTTP $http_code"];
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Tester connexion Ollama (local)
|
||||
*/
|
||||
private static function testOllama($model) {
|
||||
$ch = curl_init('http://localhost:11434/api/generate');
|
||||
curl_setopt_array($ch, [
|
||||
CURLOPT_POST => true,
|
||||
CURLOPT_RETURNTRANSFER => true,
|
||||
CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
|
||||
CURLOPT_TIMEOUT => 5,
|
||||
CURLOPT_POSTFIELDS => json_encode([
|
||||
'model' => $model,
|
||||
'prompt' => 'Test',
|
||||
'stream' => false
|
||||
])
|
||||
]);
|
||||
|
||||
$response = curl_exec($ch);
|
||||
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
|
||||
curl_close($ch);
|
||||
|
||||
if ($http_code === 200) {
|
||||
return ['success' => true, 'message' => 'Connexion Ollama réussie'];
|
||||
} else {
|
||||
return ['success' => false, 'message' => 'Ollama non disponible'];
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user