From 969ff6bb682f6993449224507a6a16b9564c45a2 Mon Sep 17 00:00:00 2001
From: hkfires <10558748+hkfires@users.noreply.github.com>
Date: Thu, 4 Dec 2025 19:32:44 +0800
Subject: [PATCH] fix(amp): update explicit API key on config change

---
 internal/api/modules/amp/amp.go    |  1 +
 internal/api/modules/amp/secret.go | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/internal/api/modules/amp/amp.go b/internal/api/modules/amp/amp.go
index 78e7aa50..2bd83865 100644
--- a/internal/api/modules/amp/amp.go
+++ b/internal/api/modules/amp/amp.go
@@ -190,6 +190,7 @@ func (m *AmpModule) OnConfigUpdated(cfg *config.Config) error {
 	// If API key changed, invalidate the cache
 	if m.secretSource != nil {
 		if ms, ok := m.secretSource.(*MultiSourceSecret); ok {
+			ms.UpdateExplicitKey(settings.UpstreamAPIKey)
 			ms.InvalidateCache()
 			log.Debug("amp secret cache invalidated due to config update")
 		}
diff --git a/internal/api/modules/amp/secret.go b/internal/api/modules/amp/secret.go
index a4af1414..a7ebf3cb 100644
--- a/internal/api/modules/amp/secret.go
+++ b/internal/api/modules/amp/secret.go
@@ -139,6 +139,17 @@ func (s *MultiSourceSecret) InvalidateCache() {
 	s.cache = nil
 }
 
+// UpdateExplicitKey refreshes the config-provided key and clears cache.
+func (s *MultiSourceSecret) UpdateExplicitKey(key string) {
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	s.explicitKey = strings.TrimSpace(key)
+	s.cache = nil
+	s.mu.Unlock()
+}
+
 // StaticSecretSource returns a fixed API key (for testing)
 type StaticSecretSource struct {
 	key string