feat: 增加 Git 标签清单策略和接口

app/api/router.py

@@ -14,6 +14,7 @@ from app.api.routes import (
     client_update,
     crash_api,
     frontend,
+    git_tags,
 )
 
 
@@ -31,5 +32,6 @@ def include_api_routes(app: FastAPI):
     app.include_router(admin_logs.router)
     app.include_router(admin_crash_report.router)
     app.include_router(admin_device.router)
+    app.include_router(git_tags.router)
     app.include_router(client_update.router)
     app.include_router(crash_api.router)

app/api/routes/admin_policy.py

@@ -43,6 +43,7 @@ def admin_save_policy(body: PolicySaveRequest, auth=Depends(require_permission("
         valid_until,
         body.min_supported_version.strip(),
         json.dumps(disabled, ensure_ascii=False),
+        bool(body.git_tags_enabled),
         body.message.strip(),
     )
     if result == "channel_not_found":

app/api/routes/client_update.py

@@ -149,6 +149,7 @@ async def check_update(request: Request, body: CheckUpdateRequest = Body(...)):
         "latest_version": latest_ver,
         "min_supported_version": settings["min_supported_version"],
         "disabled_versions": settings["disabled_versions"],
+        "git_tags_enabled": settings["git_tags_enabled"],
         "message": message,
         "signature_alg": "RSA-2048-SHA256",
         "key_id": SIGNING_KEY_ID,

app/api/routes/git_tags.py

@@ -0,0 +1,46 @@
+from fastapi import APIRouter, Body, Depends, HTTPException, Query, Request
+
+from app.core.security import require_permission
+from app.repositories import policy_repository
+from app.schemas.client_update import GitTagsRequest
+from app.services.common_service import policy_row_to_dict
+from app.services.git_tags_service import load_git_tags
+
+
+router = APIRouter(tags=["git-tags"])
+
+
+@router.get("/admin/git/tags")
+def admin_git_tags(
+    force_refresh: bool = Query(False),
+    auth=Depends(require_permission("policy:view")),
+):
+    try:
+        return load_git_tags(force_refresh=force_refresh)
+    except Exception as exc:
+        raise HTTPException(status_code=502, detail=f"获取 Git 标签失败：{exc}") from exc
+
+
+@router.post("/api/v1/git/tags")
+def client_git_tags(request: Request, body: GitTagsRequest = Body(...)):
+    identity = request.state.device_identity
+    if identity["app_id"] != body.app_id or identity["channel"] != body.channel:
+        raise HTTPException(status_code=403, detail="设备凭证与应用/渠道不匹配")
+
+    policy = policy_row_to_dict(policy_repository.get_policy(body.app_id, body.channel))
+    if not policy["git_tags_enabled"]:
+        raise HTTPException(
+            status_code=403,
+            detail={"error": "git_tags_disabled", "msg": "当前策略未允许生成 Git 标签清单"},
+        )
+
+    try:
+        payload = load_git_tags(force_refresh=False)
+        return {
+            "generated_at": payload["generated_at"],
+            "repo_count": payload["repo_count"],
+            "tag_count": payload["tag_count"],
+            "tags_text": payload["tags_text"],
+        }
+    except Exception as exc:
+        raise HTTPException(status_code=502, detail=f"获取 Git 标签失败：{exc}") from exc