update：

1、把ota_auth内容合并到auth.py
2、精简auth密钥，简化部署

main/xiaozhi-server/core/api/ota_handler.py

@@ -5,7 +5,7 @@ import hashlib
 import hmac
 from aiohttp import web
 
-from core.ota_auth import AuthManager
+from core.auth import AuthManager
 from core.utils.util import get_local_ip
 from core.api.base_handler import BaseHandler
 
@@ -18,27 +18,27 @@ class OTAHandler(BaseHandler):
         auth_config = config["server"].get("auth", {})
         self.auth_enable = auth_config.get("enabled", False)
         # 设备白名单
-        self.allowed_devices = set(
-            auth_config.get("allowed_devices", [])
-        )
-        secret_key = auth_config.get("signature_key", "")
+        self.allowed_devices = set(auth_config.get("allowed_devices", []))
+        secret_key = config["server"]["auth_key"]
         expire_seconds = auth_config.get("expire_seconds")
         self.auth = AuthManager(secret_key=secret_key, expire_seconds=expire_seconds)
-        
+
     def generate_password_signature(self, content: str, secret_key: str) -> str:
         """生成MQTT密码签名
-        
+
         Args:
             content: 签名内容 (clientId + '|' + username)
             secret_key: 密钥
-            
+
         Returns:
             str: Base64编码的HMAC-SHA256签名
         """
         try:
-            hmac_obj = hmac.new(secret_key.encode('utf-8'), content.encode('utf-8'), hashlib.sha256)
+            hmac_obj = hmac.new(
+                secret_key.encode("utf-8"), content.encode("utf-8"), hashlib.sha256
+            )
             signature = hmac_obj.digest()
-            return base64.b64encode(signature).decode('utf-8')
+            return base64.b64encode(signature).decode("utf-8")
         except Exception as e:
             self.logger.bind(tag=TAG).error(f"生成MQTT密码签名失败: {e}")
             return ""
@@ -97,10 +97,9 @@ class OTAHandler(BaseHandler):
                     "url": "",
                 },
             }
-            
 
             mqtt_gateway_endpoint = server_config.get("mqtt_gateway")
-            
+
             if mqtt_gateway_endpoint:  # 如果配置了非空字符串
                 # 尝试从请求数据中获取设备型号
                 device_model = "default"
@@ -118,12 +117,12 @@ class OTAHandler(BaseHandler):
                 mqtt_client_id = f"{group_id}@@@{mac_address_safe}@@@{mac_address_safe}"
 
                 # 构建用户数据
-                user_data = {
-                    "ip": "unknown"
-                }
+                user_data = {"ip": "unknown"}
                 try:
                     user_data_json = json.dumps(user_data)
-                    username = base64.b64encode(user_data_json.encode('utf-8')).decode('utf-8')
+                    username = base64.b64encode(user_data_json.encode("utf-8")).decode(
+                        "utf-8"
+                    )
                 except Exception as e:
                     self.logger.bind(tag=TAG).error(f"生成用户名失败: {e}")
                     username = ""
@@ -132,7 +131,9 @@ class OTAHandler(BaseHandler):
                 password = ""
                 signature_key = server_config.get("mqtt_signature_key", "")
                 if signature_key:
-                    password = self.generate_password_signature(mqtt_client_id + "|" + username, signature_key)
+                    password = self.generate_password_signature(
+                        mqtt_client_id + "|" + username, signature_key
+                    )
                     if not password:
                         password = ""  # 签名失败则留空，由设备决定是否允许无密码
                 else:
@@ -145,27 +146,28 @@ class OTAHandler(BaseHandler):
                     "username": username,
                     "password": password,
                     "publish_topic": "device-server",
-                    "subscribe_topic": f"devices/p2p/{mac_address_safe}"
+                    "subscribe_topic": f"devices/p2p/{mac_address_safe}",
                 }
                 self.logger.bind(tag=TAG).info(f"为设备 {device_id} 下发MQTT网关配置")
-                
-                
+
             else:  # 未配置 mqtt_gateway，下发 WebSocket
                 # 如果开启了认证，则进行认证校验
                 token = ""
                 if self.auth_enable:
                     if self.allowed_devices:
-                        if device_id in self.allowed_devices:
+                        if device_id not in self.allowed_devices:
                             token = self.auth.generate_token(client_id, device_id)
                     else:
                         token = self.auth.generate_token(client_id, device_id)
                 return_json["websocket"] = {
                     "url": self._get_websocket_url(local_ip, port),
-                    "token": token
+                    "token": token,
                 }
-                self.logger.bind(tag=TAG).info(f"未配置MQTT网关，为设备 {device_id} 下发WebSocket配置")
+                self.logger.bind(tag=TAG).info(
+                    f"未配置MQTT网关，为设备 {device_id} 下发WebSocket配置"
+                )
                 self.logger.bind(tag=TAG).info(f"{return_json}")
-            
+
             response = web.Response(
                 text=json.dumps(return_json, separators=(",", ":")),
                 content_type="application/json",
@@ -194,4 +196,4 @@ class OTAHandler(BaseHandler):
             response = web.Response(text="OTA接口异常", content_type="text/plain")
         finally:
             self._add_cors_headers(response)
-            return response
+            return response