# SOME DESCRIPTIVE TITLE.
# Copyright (C) 2026, XINFERENCE HOLDINGS PTE. LTD.
# This file is distributed under the same license as the Xinference package.
# FIRST AUTHOR <EMAIL@ADDRESS>, 2026.
#
msgid ""
msgstr ""
"Project-Id-Version: Xinference \n"
"Report-Msgid-Bugs-To: \n"
"POT-Creation-Date: 2026-07-17 15:37+0800\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
"Language: zh_CN\n"
"Language-Team: zh_CN <LL@li.org>\n"
"Plural-Forms: nplurals=1; plural=0;\n"
"MIME-Version: 1.0\n"
"Content-Type: text/plain; charset=utf-8\n"
"Content-Transfer-Encoding: 8bit\n"
"Generated-By: Babel 2.18.0\n"

#: ../../source/user_guide/audit_security.rst:5
msgid "Audit Logging and Security"
msgstr "审计日志与安全"

#: ../../source/user_guide/audit_security.rst:7
msgid ""
"When the database-backed authentication system is enabled (the default, "
"see :ref:`user_guide_auth_system`), Xinference records an audit trail of "
"API activity and protects the API against brute-force attacks. "
"Administrators can inspect both from the web UI."
msgstr ""
"启用基于数据库的身份验证系统后（默认启用，参见 :ref:`user_guide_auth_system`），Xinference 会记录 API"
" 活动的审计日志，并保护 API 免受暴力破解攻击。管理员可以在 Web UI 中查看这两项内容。"

#: ../../source/user_guide/audit_security.rst:13
msgid "Audit logging"
msgstr "审计日志"

#: ../../source/user_guide/audit_security.rst:15
msgid ""
"Protected and authenticated API activity is recorded as JSON lines in "
"``<XINFERENCE_LOG_DIR>/audit.log`` (``<XINFERENCE_HOME>/logs`` by default). "
"Files rotate daily (and by size) and are kept for "
"``XINFERENCE_AUDIT_LOG_RETENTION_DAYS`` days (default 90)."
msgstr ""
"受保护且经过身份验证的 API 活动会以 JSON 行记录到 ``<XINFERENCE_LOG_DIR>/audit.log``"
"（默认位于 ``<XINFERENCE_HOME>/logs``）。日志文件按天（以及按大小）轮转，保留 "
"``XINFERENCE_AUDIT_LOG_RETENTION_DAYS`` 天（默认 90 天）。"

msgid ""
"This is an authentication and security audit trail, not a complete HTTP "
"access log. Xinference intentionally excludes ``/v1/audit/*``, "
"``/v1/cluster/auth``, ``/v1/cluster/ui_config``, ``/status``, and "
"``/v1/address``; public or bootstrap routes that do not pass through the "
"authenticated audit path may also be absent."
msgstr ""
"这是身份验证与安全审计记录，并非完整的 HTTP 访问日志。Xinference 有意排除 "
"``/v1/audit/*``、``/v1/cluster/auth``、``/v1/cluster/ui_config``、``/status`` 和 "
"``/v1/address``；未经过身份验证审计路径的公共或初始化接口也可能不会被记录。"

#: ../../source/user_guide/audit_security.rst:20
msgid "Each entry contains, among others:"
msgstr "每条记录包含以下字段（部分列举）："

#: ../../source/user_guide/audit_security.rst:22
msgid ""
"``category``: ``inference`` (model calls such as ``/v1/chat/...``, "
"``/v1/embeddings``), ``auth`` (login/token endpoints), or ``admin`` "
"(everything else)."
msgstr ""
"``category``： ``inference`` （模型调用，如 ``/v1/chat/...``、 "
"``/v1/embeddings``）、 ``auth`` （登录/令牌接口）或 ``admin`` （其余所有接口）。"

#: ../../source/user_guide/audit_security.rst:25
msgid ""
"``user``, ``auth_type``, ``api_key_name`` / ``api_key_prefix``: who made "
"the call and how it was authenticated."
msgstr ""
"``user``、 ``auth_type``、 ``api_key_name`` / "
"``api_key_prefix``：调用者是谁以及使用了哪种鉴权方式。"

#: ../../source/user_guide/audit_security.rst:27
msgid ""
"``model_id`` / ``model_name`` / ``model_type``: the model involved, if "
"any."
msgstr "``model_id`` / ``model_name`` / ``model_type``：涉及的模型（如有）。"

#: ../../source/user_guide/audit_security.rst:28
msgid ""
"``endpoint``, ``status``, ``latency_ms``, ``client_ip``, ``node``, "
"``address``: what was called, the outcome, and where it ran."
msgstr ""
"``endpoint``、 ``status``、 ``latency_ms``、 ``client_ip``、 ``node``、 "
"``address``：调用了什么、结果如何以及在哪里执行。"

#: ../../source/user_guide/audit_security.rst:32
msgid "Audit Center"
msgstr "审计中心"

#: ../../source/user_guide/audit_security.rst:34
msgid ""
"The **Audit Center** page of the web UI lets administrators search and "
"filter the audit trail (by time range, user, API key, model, category, "
"status, and client IP). It is backed by ``GET /v1/audit/search``, which "
"requires the ``admin`` permission."
msgstr ""
"Web UI 的 **审计中心** 页面允许管理员搜索和过滤审计记录（按时间范围、用户、API Key、模型、类别、状态和客户端 "
"IP）。其背后的接口是 ``GET /v1/audit/search``，需要 ``admin`` 权限。"

#: ../../source/user_guide/audit_security.rst:39
msgid ""
"By default the search reads the local ``audit.log``. If the "
"``XINFERENCE_ES_URL`` environment variable points at an Elasticsearch "
"cluster (e.g. with the audit log shipped by Filebeat), the search queries"
" Elasticsearch instead, using the index pattern from "
"``XINFERENCE_AUDIT_ES_INDEX`` (default ``xinference-audit-*``)."
msgstr ""
"默认情况下，搜索读取本地的 ``audit.log``。如果 ``XINFERENCE_ES_URL`` 环境变量指向一个 "
"Elasticsearch 集群（例如通过 Filebeat 传送审计日志），则搜索会改为查询 Elasticsearch，并使用 "
"``XINFERENCE_AUDIT_ES_INDEX`` 指定的索引模式（默认 ``xinference-audit-*``）。"

#: ../../source/user_guide/audit_security.rst:46
msgid "Brute-force protection"
msgstr "防暴力破解"

#: ../../source/user_guide/audit_security.rst:48
msgid "Failed API-key authentication attempts are rate-limited on two levels:"
msgstr "API Key 鉴权失败会在两个层面上进行频率限制："

#: ../../source/user_guide/audit_security.rst:50
msgid ""
"**Per IP**: an IP presenting invalid API keys is banned after "
"``XINFERENCE_RATE_LIMIT_IP_MAX_FAILURES`` failures (default 10) within "
"``XINFERENCE_RATE_LIMIT_IP_WINDOW_SECONDS`` (default 300), for "
"``XINFERENCE_RATE_LIMIT_IP_BAN_SECONDS`` (default 3600). Requests from a "
"banned IP are rejected with ``429 Too Many Requests``."
msgstr ""
"**按 IP**：某个 IP 在 ``XINFERENCE_RATE_LIMIT_IP_WINDOW_SECONDS`` （默认 "
"300）秒内使用无效 API Key 失败达到 ``XINFERENCE_RATE_LIMIT_IP_MAX_FAILURES`` 次（默认 "
"10）后，将被封禁 ``XINFERENCE_RATE_LIMIT_IP_BAN_SECONDS`` 秒（默认 3600）。来自被封禁 IP "
"的请求会被拒绝并返回 ``429 Too Many Requests``。"

#: ../../source/user_guide/audit_security.rst:55
msgid ""
"**Per (IP, API key)**: repeated failures with one specific key from one "
"IP ban that combination after ``XINFERENCE_RATE_LIMIT_KEY_MAX_FAILURES`` "
"failures (default 5) within ``XINFERENCE_RATE_LIMIT_KEY_WINDOW_SECONDS`` "
"(default 300), for ``XINFERENCE_RATE_LIMIT_KEY_BAN_SECONDS`` (default "
"3600)."
msgstr ""
"**按（IP、API Key）组合**：同一 IP 使用同一个 Key 在 "
"``XINFERENCE_RATE_LIMIT_KEY_WINDOW_SECONDS`` （默认 300）秒内失败达到 "
"``XINFERENCE_RATE_LIMIT_KEY_MAX_FAILURES`` 次（默认 5）后，该组合将被封禁 "
"``XINFERENCE_RATE_LIMIT_KEY_BAN_SECONDS`` 秒（默认 3600）。"

#: ../../source/user_guide/audit_security.rst:61
msgid ""
"Individual API keys can override the key-level limits with the "
"``rate_limit_max_failures`` / ``rate_limit_window_seconds`` / "
"``rate_limit_ban_seconds`` fields when creating or updating the key."
msgstr ""
"单个 API Key 可以在创建或更新时通过 ``rate_limit_max_failures`` / "
"``rate_limit_window_seconds`` / ``rate_limit_ban_seconds`` 字段覆盖 Key "
"级别的限制。"

#: ../../source/user_guide/audit_security.rst:66
msgid "Security Settings"
msgstr "安全设置"

#: ../../source/user_guide/audit_security.rst:68
msgid "The **Security Settings** page of the web UI lets administrators:"
msgstr "Web UI 的 **安全设置** 页面允许管理员："

#: ../../source/user_guide/audit_security.rst:70
msgid "view and tune the rate-limit configuration at runtime,"
msgstr "在运行时查看和调整频率限制配置，"

#: ../../source/user_guide/audit_security.rst:71
msgid "list currently banned IPs and (IP, key) pairs,"
msgstr "列出当前被封禁的 IP 以及（IP、Key）组合，"

#: ../../source/user_guide/audit_security.rst:72
msgid "lift bans individually or all at once."
msgstr "逐个或一次性解除封禁。"

#: ../../source/user_guide/audit_security.rst:74
msgid ""
"The equivalent REST endpoints live under ``/v1/admin/security/*`` (e.g. "
"``GET``/``PUT /v1/admin/security/rate-limit``, ``GET /v1/admin/security"
"/banned-ips``, ``POST /v1/admin/security/unban-ip``) and require the "
"``admin`` permission."
msgstr ""
"对应的 REST 接口位于 ``/v1/admin/security/*`` 下（例如 ``GET``/``PUT "
"/v1/admin/security/rate-limit``、 ``GET /v1/admin/security/banned-ips``、 "
"``POST /v1/admin/security/unban-ip``），需要 ``admin`` 权限。"
