feat(oauth): 账号封禁前置 OAuth 验证、抽取 provider_context、完善账号状态分类

- 新增 verify_oauth_before_account_block：在标记账号封禁前先尝试刷新 token，区分 OAuth 过期与真正的账号级封禁，避免误标 - 抽取 provider_context.py 统一解析 provider_type，解决 ORM detached 访问问题 - account_state 新增 workspace_deactivated 分类和 auto-removable 状态集合，补充中文验证关键词匹配 - OAuth refresh 成功后仅清除可恢复的 token 错误，不再自动清除账号级 block - deploy.sh 依赖指纹改用纯 shell 实现，移除对 Python tomllib 的依赖 - 前端 Pool 管理页面新增筛选和批量操作优化 - 补充对应测试用例
2026-09-02 01:10:23 +08:00 · 2026-03-20 16:50:59 +08:00
parent aa83b4a7a7
commit 25d38ae632
44 changed files with 1527 additions and 370 deletions
--- a/frontend/src/api/endpoints/pool.ts
+++ b/frontend/src/api/endpoints/pool.ts
@@ -106,6 +106,12 @@ export interface PoolKeyDetail {
  oauth_account_user_id?: string | null
  oauth_account_name?: string | null
  oauth_organizations?: OAuthOrganizationInfo[] | null
+  account_status_code?: string | null
+  account_status_label?: string | null
+  account_status_reason?: string | null
+  account_status_blocked?: boolean
+  account_status_recoverable?: boolean
+  account_status_source?: string | null
  quota_updated_at?: number | null
  health_score?: number
  circuit_breaker_open?: boolean
--- a/frontend/src/api/endpoints/provider_oauth.ts
+++ b/frontend/src/api/endpoints/provider_oauth.ts
@@ -18,6 +18,8 @@ export interface ProviderOAuthCompleteResponse {
  expires_at?: number | null
  has_refresh_token: boolean
  email?: string | null
+  account_state_recheck_attempted?: boolean
+  account_state_recheck_error?: string | null
 }

 export interface ProviderOAuthCompleteResponseWithKey {
--- a/frontend/src/features/pool/components/PoolAccountBatchDialog.vue
+++ b/frontend/src/features/pool/components/PoolAccountBatchDialog.vue
@@ -107,15 +107,15 @@
            <div class="flex items-center gap-1.5">
              <span class="text-xs font-medium truncate">{{ key.key_name || '未命名' }}</span>
              <Badge
-                v-if="isOAuthInvalid(key)"
-                variant="destructive"
-                class="text-[10px] px-1 py-0 h-4 shrink-0"
-              >OAuth失效</Badge>
-              <Badge
-                v-else
                variant="outline"
                class="text-[10px] px-1 py-0 h-4 shrink-0"
              >{{ normalizeAuthTypeLabel(key.auth_type) }}</Badge>
+              <Badge
+                v-if="getStatusBadgeLabel(key)"
+                variant="destructive"
+                class="text-[10px] px-1 py-0 h-4 shrink-0"
+                :title="getStatusBadgeTitle(key)"
+              >{{ getStatusBadgeLabel(key) }}</Badge>
              <Badge
                v-if="key.oauth_plan_type"
                variant="outline"
@@ -127,11 +127,6 @@
                class="text-[10px] px-1 py-0 h-4 shrink-0"
                :title="getOAuthOrgBadge(key)?.title"
              >{{ getOAuthOrgBadge(key)?.label }}</Badge>
-              <Badge
-                v-if="isBannedKey(key)"
-                variant="destructive"
-                class="text-[10px] px-1 py-0 h-4 shrink-0"
-              >封号</Badge>
            </div>
            <div class="flex items-center gap-1.5 mt-0.5 text-[11px] text-muted-foreground flex-wrap">
              <span :class="key.is_active ? '' : 'text-destructive'">{{ key.is_active ? '启用' : '禁用' }}</span>
@@ -283,6 +278,7 @@ import {
 import { exportKey, refreshProviderQuota } from '@/api/endpoints/keys'
 import { refreshProviderOAuth } from '@/api/endpoints/provider_oauth'
 import { useProxyNodesStore } from '@/stores/proxy-nodes'
+import { classifyAccountBlockLabel, cleanAccountBlockReason, isAccountLevelBlockReason, isRefreshFailedReason } from '@/utils/accountBlock'
 import { getOAuthOrgBadge } from '@/utils/oauthIdentity'

 type QuickSelectorValue =
@@ -321,12 +317,12 @@ const emit = defineEmits<{
 }>()

 const QUICK_SELECT_OPTIONS: Array<{ value: QuickSelectorValue; label: string }> = [
-  { value: 'banned', label: '已封号' },
+  { value: 'banned', label: '账号异常' },
  { value: 'no_5h_limit', label: '无5H限额' },
  { value: 'no_weekly_limit', label: '无周限额' },
  { value: 'plan_free', label: '全部 Free' },
  { value: 'plan_team', label: '全部 Team' },
-  { value: 'oauth_invalid', label: 'OAuth 失效' },
+  { value: 'oauth_invalid', label: 'Token 异常' },
  { value: 'proxy_unset', label: '未配置代理' },
  { value: 'proxy_set', label: '已配置独立代理' },
  { value: 'disabled', label: '已禁用' },
@@ -426,25 +422,43 @@ function normalizeAuthTypeLabel(authType: string): string {
  return 'API Key'
 }

-function isBannedKey(key: PoolKeyDetail): boolean {
-  const reason = normalizeText(key.oauth_invalid_reason)
-  if (reason && /(banned|forbidden|blocked|suspend|封|禁|受限)/.test(reason)) return true
-  if (Array.isArray(key.scheduling_reasons)) {
-    return key.scheduling_reasons.some((item) => {
-      const code = normalizeText(item.code)
-      return code === 'account_banned' || code === 'account_forbidden' || code === 'account_blocked'
-    })
+function getStatusBadgeLabel(key: PoolKeyDetail): string | null {
+  const explicitLabel = String(key.account_status_label || '').trim()
+  if (explicitLabel) return explicitLabel
+
+  const reason = String(key.oauth_invalid_reason || '').trim()
+  if (isAccountLevelBlockReason(reason)) {
+    const cleaned = cleanAccountBlockReason(reason)
+    return classifyAccountBlockLabel(cleaned || reason)
  }
-  return false
+
+  if (normalizeText(key.auth_type) !== 'oauth') return null
+  if (isRefreshFailedReason(reason)) return '续期失败'
+  if (key.oauth_invalid_at != null || normalizeText(reason)) return 'Token 失效'
+  if (typeof key.oauth_expires_at === 'number' && key.oauth_expires_at > 0) {
+    return key.oauth_expires_at * 1000 <= Date.now() ? 'Token 过期' : null
+  }
+  return null
 }

-function isOAuthInvalid(key: PoolKeyDetail): boolean {
-  if (normalizeText(key.auth_type) !== 'oauth') return false
-  if (key.oauth_invalid_at != null || normalizeText(key.oauth_invalid_reason)) return true
-  if (typeof key.oauth_expires_at === 'number' && key.oauth_expires_at > 0) {
-    return key.oauth_expires_at * 1000 <= Date.now()
+function getStatusBadgeTitle(key: PoolKeyDetail): string {
+  const label = getStatusBadgeLabel(key)
+  if (!label) return ''
+
+  const explicitReason = String(key.account_status_reason || '').trim()
+  if (explicitReason) return `${label}: ${explicitReason}`
+
+  const reason = String(key.oauth_invalid_reason || '').trim()
+  if (!reason) return label
+  if (isAccountLevelBlockReason(reason)) {
+    const cleaned = cleanAccountBlockReason(reason)
+    return cleaned ? `${label}: ${cleaned}` : label
  }
-  return false
+  if (isRefreshFailedReason(reason)) {
+    const cleaned = reason.replace(/^\[REFRESH_FAILED\]\s*/i, '').trim()
+    return cleaned ? `${label}: ${cleaned}` : label
+  }
+  return `${label}: ${reason}`
 }

 function formatRelativeTime(value: string): string {
--- a/frontend/src/features/pool/components/PoolAdvancedDialog.vue
+++ b/frontend/src/features/pool/components/PoolAdvancedDialog.vue
@@ -28,7 +28,7 @@
          <div class="space-y-0.5">
            <span class="text-sm font-medium">主动探测</span>
            <p class="text-xs text-muted-foreground">
-              定期检查 Key 可用性，提前发现异常
+              按固定间隔主动刷新 Key 的账号状态与额度
            </p>
          </div>
          <Switch
@@ -57,9 +57,9 @@
        </div>
        <div class="flex items-center justify-between p-3 border rounded-lg bg-muted/50">
          <div class="space-y-0.5">
-            <span class="text-sm font-medium">封号自动清除</span>
+            <span class="text-sm font-medium">异常自动清除</span>
            <p class="text-xs text-muted-foreground">
-              检测到账号被封禁时自动从号池中移除
+              仅在检测到不可恢复的账号异常时自动从号池中移除，不处理纯 Token 失效
            </p>
          </div>
          <Switch
--- a/frontend/src/features/providers/components/ProviderDetailDrawer.vue
+++ b/frontend/src/features/providers/components/ProviderDetailDrawer.vue
@@ -1158,7 +1158,7 @@ const emit = defineEmits<{
  (e: 'refresh'): void
 }>()

-const { error: showError, success: showSuccess } = useToast()
+const { error: showError, success: showSuccess, warning: showWarning } = useToast()
 const { confirm } = useConfirm()
 const { copyToClipboard } = useClipboard()
 const { tick: countdownTick, start: startCountdownTimer, stop: stopCountdownTimer } = useCountdownTimer()
@@ -1643,7 +1643,15 @@ async function handleRefreshOAuth(key: EndpointAPIKey) {
  refreshingOAuthKeyId.value = key.id
  try {
    const result = await refreshProviderOAuth(key.id)
-    showSuccess('Token 刷新成功')
+    if (result.account_state_recheck_attempted) {
+      if (result.account_state_recheck_error) {
+        showWarning('Token 刷新成功，但账号状态复检失败')
+      } else {
+        showSuccess('Token 刷新成功，已复检账号状态')
+      }
+    } else {
+      showSuccess('Token 刷新成功')
+    }
    // 更新本地数据
    const keyInList = providerKeys.value.find(k => k.id === key.id)
    if (keyInList) {
@@ -1678,7 +1686,7 @@ async function handleClearOAuthInvalid(key: EndpointAPIKey) {

  const confirmed = await confirm({
    title: '清除账号异常标记',
-    message: `确认账号 "${key.name || key.id.slice(0, 8)}" 已手动完成验证？清除后该 Key 将恢复正常调度。`,
+    message: `确认账号 "${key.name || key.id.slice(0, 8)}" 已手动完成验证？清除后系统会按当前手动开关和调度状态重新评估该 Key。`,
    confirmText: '确认清除',
    variant: 'default',
  })
@@ -1687,13 +1695,12 @@ async function handleClearOAuthInvalid(key: EndpointAPIKey) {
  clearingOAuthInvalidKeyId.value = key.id
  try {
    await clearOAuthInvalid(key.id)
-    showSuccess('已清除 OAuth 异常标记，Key 已自动启用')
+    showSuccess('已清除 OAuth 异常标记')
    // 更新本地数据
    const keyInList = providerKeys.value.find(k => k.id === key.id)
    if (keyInList) {
      keyInList.oauth_invalid_at = null
      keyInList.oauth_invalid_reason = null
-      keyInList.is_active = true
    }
    await loadEndpoints()
  } catch (err: unknown) {
--- a/frontend/src/utils/accountBlock.ts
+++ b/frontend/src/utils/accountBlock.ts
@@ -37,6 +37,9 @@ const KEYWORDS_TOKEN_INVALID = [
 const KEYWORDS_VERIFICATION = [
  'validation_required',
  'verify your account',
+  '需要验证',
+  '验证账号',
+  '验证身份',
 ]

 // 合并的完整列表
--- a/frontend/src/views/admin/PoolManagement.vue
+++ b/frontend/src/views/admin/PoolManagement.vue
@@ -127,7 +127,7 @@
                  全部
                </SelectItem>
                <SelectItem value="active">
-                  活跃
+                  可调度
                </SelectItem>
                <SelectItem value="cooldown">
                  冷却中
@@ -213,7 +213,7 @@
                  全部状态
                </SelectItem>
                <SelectItem value="active">
-                  活跃
+                  可调度
                </SelectItem>
                <SelectItem value="cooldown">
                  冷却中
@@ -2006,10 +2006,16 @@ async function handleRefreshOAuth(key: PoolKeyDetail) {
    const target = keyPage.value.keys.find(k => k.key_id === key.key_id)
    if (target) {
      target.oauth_expires_at = result.expires_at ?? null
-      target.oauth_invalid_at = null
-      target.oauth_invalid_reason = null
    }
-    success('Token 刷新成功')
+    if (result.account_state_recheck_attempted) {
+      if (result.account_state_recheck_error) {
+        showWarning('Token 刷新成功，但账号状态复检失败')
+      } else {
+        success('Token 刷新成功，已复检账号状态')
+      }
+    } else {
+      success('Token 刷新成功')
+    }
    await loadKeys()
  } catch (err) {
    showError(parseApiError(err, 'Token 刷新失败'))
@@ -2359,6 +2365,11 @@ function getOAuthStatusTitle(key: PoolKeyDetail): string {
  const status = getKeyOAuthExpires(key)
  if (!status) return ''
  if (status.isInvalid) {
+    const accountLabel = String(key.account_status_label || '').trim()
+    const accountReason = String(key.account_status_reason || '').trim()
+    if (accountLabel) {
+      return accountReason ? `${accountLabel}: ${accountReason}` : accountLabel
+    }
    const cleaned = status.invalidReason && isAccountLevelBlockReason(status.invalidReason)
      ? cleanAccountBlockReason(status.invalidReason)
      : status.invalidReason
@@ -2377,11 +2388,15 @@ function getAccountAlertLabel(key: PoolKeyDetail): string | null {
  if (cached !== undefined) return cached

  let result: string | null = null
+  const explicitLabel = String(key.account_status_label || '').trim()
+  if (key.account_status_blocked && explicitLabel) {
+    result = explicitLabel
+  }
  const quotaText = String(key.account_quota || '').trim()
  // 后端 _build_account_quota 返回的确切文本: "账号已封禁" / "访问受限"
-  if (quotaText === '账号已封禁' || quotaText === '封禁') result = '账号封禁'
-  else if (quotaText === '访问受限') result = '访问受限'
-  else if (isAccountLevelBlockReason(key.oauth_invalid_reason)) {
+  if (!result && (quotaText === '账号已封禁' || quotaText === '封禁')) result = '账号封禁'
+  else if (!result && quotaText === '访问受限') result = '访问受限'
+  else if (!result && isAccountLevelBlockReason(key.oauth_invalid_reason)) {
    const reason = String(key.oauth_invalid_reason || '').trim()
    const cleaned = cleanAccountBlockReason(reason)
    result = classifyAccountBlockLabel(cleaned || reason)
@@ -2395,6 +2410,9 @@ function getAccountAlertTitle(key: PoolKeyDetail): string {
  const label = getAccountAlertLabel(key)
  if (!label) return ''

+  const explicitReason = String(key.account_status_reason || '').trim()
+  if (explicitReason) return `${label}: ${explicitReason}`
+
  const reason = String(key.oauth_invalid_reason || '').trim()
  if (reason) {
    if (isAccountLevelBlockReason(reason)) {