Add secure admin AI provider configuration

apps/api/app/ai_research.py

@@ -10,6 +10,7 @@ from __future__ import annotations
 import json
 import os
 import re
+import sqlite3
 from urllib.parse import urlparse
 from urllib.request import Request, urlopen
 
@@ -43,7 +44,26 @@ def _safe_endpoint(value: str, allowed: set[str]) -> str:
     return value.rstrip("/")
 
 
+_DB_PATH = ""
+_DB_ORG = "demo-tenant"
+
+
+def configure_db(path: str, organization_id: str = "demo-tenant") -> None:
+    global _DB_PATH, _DB_ORG
+    _DB_PATH, _DB_ORG = path, organization_id
+
+
 def _config():
+    if _DB_PATH:
+        try:
+            db = sqlite3.connect(_DB_PATH); db.row_factory = sqlite3.Row
+            row = db.execute("SELECT * FROM ai_remote_provider_configs WHERE organization_id=?", (_DB_ORG,)).fetchone(); db.close()
+            if row:
+                from .provider_config import decrypt
+                credentials = json.loads(decrypt(row["credentials_ciphertext"])) if row["credentials_ciphertext"] else {}
+                return {"provider": row["provider"], "model": row["model"], "nous_url": row["nous_base_url"], "nous_allowed": {urlparse(row["nous_base_url"]).hostname}, "nous_key": credentials.get("nous_api_key", ""), "firecrawl_url": row["firecrawl_base_url"], "firecrawl_allowed": {urlparse(row["firecrawl_base_url"]).hostname}, "firecrawl_key": credentials.get("firecrawl_api_key", "")}
+        except Exception:
+            return {"provider": "", "model": "", "endpoint": "", "allowed": set(), "api_key": ""}
     provider = os.environ.get("AI_RESEARCH_PROVIDER", "").strip().lower()
     # Nous uses its conventional key directly; no gateway or key translation is needed.
     nous_key = os.environ.get("NOUS_API_KEY", "").strip()