feat(secrets-mcp): Web 条目编辑 API 与 Notes 列表展示优化（0.3.6）

- secrets-core: EntryWriteRow；按 id 更新/删除（含并发冲突与唯一键）
- Web: PATCH/DELETE /api/entries/{id}；列表编辑/删除与错误映射
- entries 模板：Notes 限高滚动；空 Notes 不显示占位框
- 版本 0.3.5 → 0.3.6，同步 Cargo.lock

Made-with: Cursor

crates/secrets-mcp/src/web.rs

@@ -8,9 +8,10 @@ use axum::{
     extract::{ConnectInfo, Path, Query, State},
     http::{HeaderMap, StatusCode, header},
     response::{Html, IntoResponse, Redirect, Response},
-    routing::{get, post},
+    routing::{get, patch, post},
 };
 use serde::{Deserialize, Serialize};
+use serde_json::json;
 use tower_sessions::Session;
 use uuid::Uuid;
 
@@ -19,7 +20,9 @@ use secrets_core::crypto::hex;
 use secrets_core::service::{
     api_key::{ensure_api_key, regenerate_api_key},
     audit_log::list_for_user,
+    delete::delete_by_id,
     search::{SearchParams, count_entries, list_entries},
+    update::{UpdateEntryFieldsByIdParams, update_fields_by_id},
     user::{
         OAuthProfile, bind_oauth_account, find_or_create_user, get_user_by_id,
         unbind_oauth_account, update_user_key_setup,
@@ -95,6 +98,7 @@ struct EntriesPageTemplate {
 
 /// Non-sensitive fields only (no `secrets` / ciphertext).
 struct EntryListItemView {
+    id: String,
     folder: String,
     entry_type: String,
     name: String,
@@ -199,6 +203,10 @@ pub fn web_router() -> Router<AppState> {
         .route("/api/key-setup", post(api_key_setup))
         .route("/api/apikey", get(api_apikey_get))
         .route("/api/apikey/regenerate", post(api_apikey_regenerate))
+        .route(
+            "/api/entries/{id}",
+            patch(api_entry_patch).delete(api_entry_delete),
+        )
 }
 
 fn text_asset_response(content: &'static str, content_type: &'static str) -> Response {
@@ -573,6 +581,7 @@ async fn entries_page(
     let entries = rows
         .into_iter()
         .map(|e| EntryListItemView {
+            id: e.id.to_string(),
             folder: e.folder,
             entry_type: e.entry_type,
             name: e.name,
@@ -872,6 +881,122 @@ async fn api_apikey_regenerate(
     Ok(Json(ApiKeyResponse { api_key }))
 }
 
+// ── Entry management (Web UI, non-sensitive fields only) ───────────────────────
+
+#[derive(Deserialize)]
+struct EntryPatchBody {
+    folder: String,
+    #[serde(rename = "type")]
+    entry_type: String,
+    name: String,
+    notes: String,
+    tags: Vec<String>,
+    metadata: serde_json::Value,
+}
+
+type EntryApiError = (StatusCode, Json<serde_json::Value>);
+
+fn map_entry_mutation_err(e: anyhow::Error) -> EntryApiError {
+    let msg = e.to_string();
+    if msg.contains("Entry not found") {
+        return (
+            StatusCode::NOT_FOUND,
+            Json(json!({ "error": "条目不存在或无权访问" })),
+        );
+    }
+    if msg.contains("already exists") {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "该账号下已存在相同 folder + name 的条目" })),
+        );
+    }
+    if msg.contains("Concurrent modification") {
+        return (
+            StatusCode::CONFLICT,
+            Json(json!({ "error": "条目已被修改，请刷新后重试" })),
+        );
+    }
+    if msg.contains("must be at most") {
+        return (StatusCode::BAD_REQUEST, Json(json!({ "error": msg })));
+    }
+    tracing::error!(error = %e, "entry mutation failed");
+    (
+        StatusCode::INTERNAL_SERVER_ERROR,
+        Json(json!({ "error": "操作失败，请稍后重试" })),
+    )
+}
+
+async fn api_entry_patch(
+    State(state): State<AppState>,
+    session: Session,
+    Path(entry_id): Path<Uuid>,
+    Json(body): Json<EntryPatchBody>,
+) -> Result<Json<serde_json::Value>, EntryApiError> {
+    let user_id = current_user_id(&session)
+        .await
+        .ok_or((StatusCode::UNAUTHORIZED, Json(json!({ "error": "未登录" }))))?;
+
+    let folder = body.folder.trim();
+    let entry_type = body.entry_type.trim();
+    let name = body.name.trim();
+    let notes = body.notes.trim();
+
+    if name.is_empty() {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            Json(json!({ "error": "name 不能为空" })),
+        ));
+    }
+
+    let tags: Vec<String> = body
+        .tags
+        .into_iter()
+        .map(|t| t.trim().to_string())
+        .filter(|t| !t.is_empty())
+        .collect();
+
+    if !body.metadata.is_object() {
+        return Err((
+            StatusCode::BAD_REQUEST,
+            Json(json!({ "error": "metadata 必须是 JSON 对象" })),
+        ));
+    }
+
+    update_fields_by_id(
+        &state.pool,
+        entry_id,
+        user_id,
+        UpdateEntryFieldsByIdParams {
+            folder,
+            entry_type,
+            name,
+            notes,
+            tags: &tags,
+            metadata: &body.metadata,
+        },
+    )
+    .await
+    .map_err(map_entry_mutation_err)?;
+
+    Ok(Json(json!({ "ok": true })))
+}
+
+async fn api_entry_delete(
+    State(state): State<AppState>,
+    session: Session,
+    Path(entry_id): Path<Uuid>,
+) -> Result<Json<serde_json::Value>, EntryApiError> {
+    let user_id = current_user_id(&session)
+        .await
+        .ok_or((StatusCode::UNAUTHORIZED, Json(json!({ "error": "未登录" }))))?;
+
+    delete_by_id(&state.pool, entry_id, user_id)
+        .await
+        .map_err(map_entry_mutation_err)?;
+
+    Ok(Json(json!({ "ok": true })))
+}
+
 // ── OAuth / Well-known ────────────────────────────────────────────────────────
 
 /// RFC 9728 — OAuth 2.0 Protected Resource Metadata.