feat(provider): 原生接入 Windsurf provider

2026-10-04 00:17:45 +08:00 · 2026-05-21 01:02:02 +08:00
parent 923515ab28
commit 0226e14251
51 changed files with 7470 additions and 157 deletions
@@ -216,6 +216,23 @@ fn codex_quota_execution_result(request_id: &str) -> serde_json::Value {
    })
 }

+fn windsurf_register_user_execution_result(request_id: &str) -> serde_json::Value {
+    json!({
+        "request_id": request_id,
+        "status_code": 200,
+        "headers": {
+            "content-type": "application/json"
+        },
+        "body": {
+            "json_body": {
+                "apiKey": "devin-session-token$registered",
+                "name": "Windsurf User",
+                "apiServerUrl": "https://server.codeium.com"
+            }
+        }
+    })
+}
+
 fn assert_single_provider_oauth_refresh_token_plan<'a>(
    plans: &'a [ExecutionPlan],
 ) -> &'a ExecutionPlan {
@@ -281,18 +298,404 @@ async fn gateway_handles_admin_provider_oauth_supported_types_locally_with_trust
    assert_eq!(response.status(), StatusCode::OK);
    let payload: serde_json::Value = response.json().await.expect("json body should parse");
    let items = payload.as_array().expect("items should be array");
-    assert_eq!(items.len(), 5);
+    assert_eq!(items.len(), 6);
    assert_eq!(items[0]["provider_type"], "claude_code");
    assert_eq!(items[1]["provider_type"], "codex");
    assert_eq!(items[2]["provider_type"], "chatgpt_web");
    assert_eq!(items[3]["provider_type"], "gemini_cli");
    assert_eq!(items[4]["provider_type"], "antigravity");
+    assert_eq!(items[5]["provider_type"], "windsurf");
    assert_eq!(*upstream_hits.lock().expect("mutex should lock"), 0);

    gateway_handle.abort();
    upstream_handle.abort();
 }

+#[tokio::test]
+async fn gateway_handles_admin_provider_oauth_device_authorize_for_windsurf_browser() {
+    let mut provider = sample_provider("provider-windsurf", "windsurf", 10);
+    provider.provider_type = "windsurf".to_string();
+    let endpoint = sample_endpoint(
+        "endpoint-windsurf-chat",
+        "provider-windsurf",
+        "openai:chat",
+        "https://server.codeium.com",
+    );
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![endpoint],
+        vec![],
+    ));
+    let state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+            provider_catalog_repository,
+        ));
+
+    let response = local_admin_provider_oauth_response(
+        &state,
+        http::Method::POST,
+        "/api/admin/provider-oauth/providers/provider-windsurf/device-authorize",
+        Some(json!({
+            "auth_type": "browser",
+            "login_option": "github",
+            "proxy_node_id": "proxy-node-windsurf"
+        })),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("body should read");
+    let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
+    let session_id = payload["session_id"]
+        .as_str()
+        .expect("session_id should exist");
+    assert_eq!(payload["auth_type"], "browser");
+    assert_eq!(payload["login_option"], "github");
+    assert_eq!(payload["redirect_uri"], "show-auth-token");
+    assert_eq!(payload["callback_required"], true);
+
+    let authorization_url = payload["verification_uri_complete"]
+        .as_str()
+        .expect("authorization url should exist");
+    let parsed = url::Url::parse(authorization_url).expect("authorization url should parse");
+    let params = parsed
+        .query_pairs()
+        .into_owned()
+        .collect::<std::collections::BTreeMap<_, _>>();
+    assert_eq!(
+        parsed.as_str().split('?').next(),
+        Some("https://windsurf.com/windsurf/signin")
+    );
+    assert_eq!(
+        params.get("response_type").map(String::as_str),
+        Some("token")
+    );
+    assert_eq!(params.get("state").map(String::as_str), Some(session_id));
+    assert_eq!(
+        params.get("redirect_uri").map(String::as_str),
+        Some("show-auth-token")
+    );
+    assert_eq!(
+        params.get("redirect_parameters_type").map(String::as_str),
+        Some("query")
+    );
+
+    let stored = state
+        .load_provider_oauth_device_session_for_tests(&format!("device_auth_session:{session_id}"))
+        .expect("device session should be stored");
+    let stored: serde_json::Value =
+        serde_json::from_str(&stored).expect("device session json should parse");
+    assert_eq!(stored["provider_id"], "provider-windsurf");
+    assert_eq!(stored["auth_type"], "browser");
+    assert_eq!(stored["social_provider"], "github");
+    assert_eq!(stored["redirect_uri"], "show-auth-token");
+    assert_eq!(stored["proxy_node_id"], "proxy-node-windsurf");
+    assert_eq!(stored["status"], "pending");
+}
+
+#[tokio::test]
+async fn gateway_rejects_generic_oauth_start_for_windsurf_provider() {
+    let mut provider = sample_provider("provider-windsurf", "windsurf", 10);
+    provider.provider_type = "windsurf".to_string();
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![],
+        vec![],
+    ));
+    let state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+            provider_catalog_repository,
+        ));
+
+    let response = local_admin_provider_oauth_response(
+        &state,
+        http::Method::POST,
+        "/api/admin/provider-oauth/providers/provider-windsurf/start",
+        None,
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::BAD_REQUEST);
+    let body = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("body should read");
+    let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
+    assert!(
+        payload["detail"]
+            .as_str()
+            .is_some_and(|detail| detail.contains("浏览器登录")),
+        "payload={payload}"
+    );
+}
+
+#[tokio::test]
+async fn gateway_handles_admin_provider_oauth_device_poll_for_windsurf_callback_token() {
+    let execution_plans = Arc::new(Mutex::new(Vec::<ExecutionPlan>::new()));
+    let execution_plans_clone = Arc::clone(&execution_plans);
+    let execution_runtime = Router::new().route(
+        "/v1/execute/sync",
+        any(move |Json(plan): Json<ExecutionPlan>| {
+            let execution_plans_inner = Arc::clone(&execution_plans_clone);
+            async move {
+                execution_plans_inner
+                    .lock()
+                    .expect("mutex should lock")
+                    .push(plan.clone());
+                if plan.request_id == "provider-oauth:windsurf-register:new" {
+                    return Json(windsurf_register_user_execution_result(&plan.request_id));
+                }
+                Json(json!({
+                    "request_id": plan.request_id,
+                    "status_code": 200,
+                    "headers": {
+                        "content-type": "application/json"
+                    },
+                    "body": {
+                        "json_body": {}
+                    }
+                }))
+            }
+        }),
+    );
+
+    let mut provider = sample_provider("provider-windsurf", "windsurf", 10);
+    provider.provider_type = "windsurf".to_string();
+    let endpoint = sample_endpoint(
+        "endpoint-windsurf-chat",
+        "provider-windsurf",
+        "openai:chat",
+        "https://server.codeium.com",
+    );
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![endpoint],
+        vec![],
+    ));
+    let mut proxy_node = sample_proxy_node("proxy-node-windsurf");
+    proxy_node.status = "online".to_string();
+    proxy_node.is_manual = true;
+    proxy_node.tunnel_mode = false;
+    proxy_node.tunnel_connected = false;
+    proxy_node.proxy_url = Some("http://proxy.example:8080".to_string());
+    let proxy_node_repository = Arc::new(InMemoryProxyNodeRepository::seed(vec![proxy_node]));
+
+    let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await;
+    let state = build_state_with_execution_runtime_override(execution_runtime_url)
+        .with_data_state_for_tests(
+            GatewayDataState::with_provider_catalog_repository_for_tests(
+                provider_catalog_repository.clone(),
+            )
+            .with_encryption_key_for_tests(DEVELOPMENT_ENCRYPTION_KEY)
+            .attach_proxy_node_repository_for_tests(proxy_node_repository),
+        )
+        .with_provider_oauth_device_session_entry_for_tests(
+            "session-windsurf",
+            json!({
+                "provider_id": "provider-windsurf",
+                "region": "",
+                "client_id": "",
+                "client_secret": "",
+                "device_code": "",
+                "auth_type": "browser",
+                "social_provider": "google",
+                "code_verifier": null,
+                "redirect_uri": "show-auth-token",
+                "machine_id": "123e4567-e89b-12d3-a456-426614174000",
+                "interval": 5,
+                "expires_at_unix_secs": 4_102_444_800u64,
+                "status": "pending",
+                "proxy_node_id": "proxy-node-windsurf",
+                "created_at_unix_ms": 1_711_000_000u64,
+                "key_id": null,
+                "email": null,
+                "replaced": false,
+                "error_msg": null,
+            }),
+        );
+
+    let response = local_admin_provider_oauth_response(
+        &state,
+        http::Method::POST,
+        "/api/admin/provider-oauth/providers/provider-windsurf/device-poll",
+        Some(json!({
+            "session_id": "session-windsurf",
+            "callback_url": "https://windsurf.com/show-auth-token?token=firebase-id-token&state=session-windsurf&provider=google"
+        })),
+    )
+    .await;
+    let status = response.status();
+    let body = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("body should read");
+    let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
+    assert_eq!(status, StatusCode::OK, "payload={payload}");
+    assert_eq!(payload["status"], "authorized");
+    assert_eq!(payload["replaced"], false);
+
+    let stored = state
+        .load_provider_oauth_device_session_for_tests("device_auth_session:session-windsurf")
+        .expect("device session should persist");
+    let stored: serde_json::Value =
+        serde_json::from_str(&stored).expect("device session json should parse");
+    assert_eq!(stored["status"], "authorized");
+    let key_id = stored["key_id"]
+        .as_str()
+        .expect("key_id should be stored")
+        .to_string();
+    assert_eq!(payload["key_id"], key_id);
+
+    let persisted = provider_catalog_repository
+        .list_keys_by_ids(std::slice::from_ref(&key_id))
+        .await
+        .expect("keys should load")
+        .into_iter()
+        .next()
+        .expect("persisted key should exist");
+    assert_eq!(persisted.auth_type, "oauth");
+    assert_eq!(
+        persisted.proxy,
+        Some(json!({"node_id": "proxy-node-windsurf", "enabled": true}))
+    );
+    let decrypted_api_key = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_api_key
+            .as_deref()
+            .expect("api key should be present"),
+    )
+    .expect("api key should decrypt");
+    assert_eq!(decrypted_api_key, "devin-session-token$registered");
+    let decrypted_auth_config = decrypt_python_fernet_ciphertext(
+        DEVELOPMENT_ENCRYPTION_KEY,
+        persisted
+            .encrypted_auth_config
+            .as_deref()
+            .expect("auth config should exist"),
+    )
+    .expect("auth config should decrypt");
+    let auth_config: serde_json::Value =
+        serde_json::from_str(&decrypted_auth_config).expect("auth config should parse");
+    assert_eq!(auth_config["provider_type"], "windsurf");
+    assert_eq!(auth_config["auth_method"], "browser");
+    assert_eq!(auth_config["register_source"], "new");
+    assert_eq!(auth_config["social_provider"], "google");
+
+    {
+        let plans = execution_plans.lock().expect("mutex should lock");
+        let register_plan = plans
+            .iter()
+            .find(|plan| plan.request_id == "provider-oauth:windsurf-register:new")
+            .expect("register plan should execute");
+        assert_eq!(register_plan.method, "POST");
+        assert_eq!(
+            register_plan
+                .body
+                .json_body
+                .as_ref()
+                .and_then(|body| body.get("firebase_id_token"))
+                .and_then(serde_json::Value::as_str),
+            Some("firebase-id-token")
+        );
+        assert_eq!(
+            register_plan
+                .proxy
+                .as_ref()
+                .and_then(|proxy| proxy.node_id.as_deref()),
+            Some("proxy-node-windsurf")
+        );
+    }
+
+    execution_runtime_handle.abort();
+}
+
+#[tokio::test]
+async fn gateway_rejects_windsurf_callback_state_mismatch_and_missing_token() {
+    let mut provider = sample_provider("provider-windsurf", "windsurf", 10);
+    provider.provider_type = "windsurf".to_string();
+    let endpoint = sample_endpoint(
+        "endpoint-windsurf-chat",
+        "provider-windsurf",
+        "openai:chat",
+        "https://server.codeium.com",
+    );
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![endpoint],
+        vec![],
+    ));
+    let state = AppState::new()
+        .expect("gateway should build")
+        .with_data_state_for_tests(GatewayDataState::with_provider_catalog_reader_for_tests(
+            provider_catalog_repository,
+        ))
+        .with_provider_oauth_device_session_entry_for_tests(
+            "session-windsurf",
+            json!({
+                "provider_id": "provider-windsurf",
+                "region": "",
+                "client_id": "",
+                "client_secret": "",
+                "device_code": "",
+                "auth_type": "browser",
+                "social_provider": "google",
+                "code_verifier": null,
+                "redirect_uri": "show-auth-token",
+                "machine_id": "123e4567-e89b-12d3-a456-426614174000",
+                "interval": 5,
+                "expires_at_unix_secs": 4_102_444_800u64,
+                "status": "pending",
+                "proxy_node_id": null,
+                "created_at_unix_ms": 1_711_000_000u64,
+                "key_id": null,
+                "email": null,
+                "replaced": false,
+                "error_msg": null,
+            }),
+        );
+
+    let response = local_admin_provider_oauth_response(
+        &state,
+        http::Method::POST,
+        "/api/admin/provider-oauth/providers/provider-windsurf/device-poll",
+        Some(json!({
+            "session_id": "session-windsurf",
+            "callback_url": "https://windsurf.com/show-auth-token?token=firebase-id-token&state=wrong-state"
+        })),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("body should read");
+    let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
+    assert_eq!(payload["status"], "error");
+    assert!(payload["error"]
+        .as_str()
+        .is_some_and(|error| error.contains("state")));
+
+    let response = local_admin_provider_oauth_response(
+        &state,
+        http::Method::POST,
+        "/api/admin/provider-oauth/providers/provider-windsurf/device-poll",
+        Some(json!({
+            "session_id": "session-windsurf",
+            "callback_url": "https://windsurf.com/show-auth-token?state=session-windsurf"
+        })),
+    )
+    .await;
+    assert_eq!(response.status(), StatusCode::OK);
+    let body = to_bytes(response.into_body(), usize::MAX)
+        .await
+        .expect("body should read");
+    let payload: serde_json::Value = serde_json::from_slice(&body).expect("json body should parse");
+    assert_eq!(payload["status"], "error");
+    assert!(payload["error"]
+        .as_str()
+        .is_some_and(|error| error.contains("token")));
+}
+
 #[tokio::test]
 async fn gateway_handles_admin_provider_oauth_device_authorize_locally_with_trusted_admin_principal(
 ) {