i/Aether
1
0
Fork 0
mirror of https://github.com/fawney19/Aether.git synced 2026-09-02 17:30:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

Fix OAuth token import and table filters

Browse Source
This commit is contained in:
fawney19
2026-05-01 02:14:49 +08:00
parent 9570e5c2c1
commit 4fc7cecf30
54 changed files with 3160 additions and 727 deletions
Download Patch File Download Diff File Expand all files Collapse all files

143
apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/batch/execution.rs
View File

@@ -1,3 +1,4 @@
use super::super::token_import::build_codex_access_token_import_auth_config;
use super::kiro_import::execute_admin_provider_oauth_kiro_batch_import;
use super::parse::{
apply_admin_provider_oauth_batch_import_hints, extract_admin_provider_oauth_batch_error_detail,
@@ -22,12 +23,19 @@ use crate::handlers::admin::provider::oauth::state::{
admin_provider_oauth_template, exchange_admin_provider_oauth_refresh_token,
};
use crate::handlers::admin::provider::shared::support::ADMIN_PROVIDER_OAUTH_DATA_UNAVAILABLE_DETAIL;
use crate::handlers::admin::request::AdminAppState;
use crate::handlers::admin::request::{AdminAppState, AdminProviderOAuthTemplate};
use crate::GatewayError;
use aether_admin::provider::oauth::parse_admin_provider_oauth_kiro_batch_import_entries;
use serde_json::json;
use aether_contracts::ProxySnapshot;
use serde_json::{json, Map, Value};
use std::time::{SystemTime, UNIX_EPOCH};
struct AdminProviderOAuthResolvedBatchImport {
access_token: String,
auth_config: Map<String, Value>,
expires_at: Option<u64>,
}
pub(super) fn estimate_admin_provider_oauth_batch_import_total(
provider_type: &str,
raw_credentials: &str,
@@ -70,6 +78,90 @@ pub(super) async fn execute_admin_provider_oauth_batch_import_for_provider_type(
}
}
async fn resolve_admin_provider_oauth_batch_import_tokens(
state: &AdminAppState<'_>,
template: AdminProviderOAuthTemplate,
provider_type: &str,
entry: &AdminProviderOAuthBatchImportEntry,
request_proxy: Option<ProxySnapshot>,
) -> Result<AdminProviderOAuthResolvedBatchImport, String> {
let refresh_token = entry
.refresh_token
.as_deref()
.map(str::trim)
.filter(|value| !value.is_empty());
let access_token = entry
.access_token
.as_deref()
.map(str::trim)
.filter(|value| !value.is_empty());
if let Some(refresh_token) = refresh_token {
let token_payload = match exchange_admin_provider_oauth_refresh_token(
state,
template,
refresh_token,
request_proxy.clone(),
)
.await
{
Ok(payload) => payload,
Err(response) => {
let detail = extract_admin_provider_oauth_batch_error_detail(response).await;
if provider_type.eq_ignore_ascii_case("codex") {
if let Some(access_token) = access_token {
let (auth_config, expires_at) = build_codex_access_token_import_auth_config(
access_token,
Some(refresh_token),
entry.expires_at,
Some(detail.as_str()),
);
return Ok(AdminProviderOAuthResolvedBatchImport {
access_token: access_token.to_string(),
auth_config,
expires_at,
});
}
}
return Err(format!("Token 验证失败: {detail}"));
}
};
let (mut auth_config, access_token, returned_refresh_token, expires_at) =
build_provider_oauth_auth_config_from_token_payload(provider_type, &token_payload);
let Some(access_token) = access_token else {
return Err("Token 刷新返回缺少 access_token".to_string());
};
let refresh_token = returned_refresh_token
.or_else(|| Some(refresh_token.to_string()))
.filter(|value| !value.trim().is_empty());
if let Some(refresh_token) = refresh_token.as_ref() {
auth_config.insert("refresh_token".to_string(), json!(refresh_token));
}
return Ok(AdminProviderOAuthResolvedBatchImport {
access_token,
auth_config,
expires_at,
});
}
if let Some(access_token) = access_token {
if !provider_type.eq_ignore_ascii_case("codex") {
return Err("Access Token 导入仅支持 Codex Provider".to_string());
}
let (auth_config, expires_at) =
build_codex_access_token_import_auth_config(access_token, None, entry.expires_at, None);
return Ok(AdminProviderOAuthResolvedBatchImport {
access_token: access_token.to_string(),
auth_config,
expires_at,
});
}
Err("Refresh Token 或 Access Token 不能为空".to_string())
}
pub(super) async fn execute_admin_provider_oauth_batch_import(
state: &AdminAppState<'_>,
provider_id: &str,
@@ -145,24 +237,22 @@ pub(super) async fn execute_admin_provider_oauth_batch_import(
let mut failed = 0usize;
for (index, entry) in entries.iter().enumerate() {
let token_payload = match exchange_admin_provider_oauth_refresh_token(
let resolved_import = match resolve_admin_provider_oauth_batch_import_tokens(
state,
template,
entry.refresh_token.as_str(),
provider_type,
entry,
request_proxy.clone(),
)
.await
{
Ok(payload) => payload,
Err(response) => {
Ok(value) => value,
Err(error) => {
failed += 1;
results.push(json!({
"index": index,
"status": "error",
"error": format!(
"Token 验证失败: {}",
extract_admin_provider_oauth_batch_error_detail(response).await
),
"error": error,
"replaced": false,
}));
maybe_report_admin_provider_oauth_batch_import_progress(
@@ -176,34 +266,11 @@ pub(super) async fn execute_admin_provider_oauth_batch_import(
continue;
}
};
let (mut auth_config, access_token, returned_refresh_token, expires_at) =
build_provider_oauth_auth_config_from_token_payload(provider_type, &token_payload);
let Some(access_token) = access_token else {
failed += 1;
results.push(json!({
"index": index,
"status": "error",
"error": "Token 刷新返回缺少 access_token",
"replaced": false,
}));
maybe_report_admin_provider_oauth_batch_import_progress(
&mut progress,
entries.len(),
success,
failed,
&results,
)
.await;
continue;
};
let refresh_token = returned_refresh_token
.or_else(|| Some(entry.refresh_token.clone()))
.filter(|value| !value.trim().is_empty());
if let Some(refresh_token) = refresh_token.as_ref() {
auth_config.insert("refresh_token".to_string(), json!(refresh_token));
}
let AdminProviderOAuthResolvedBatchImport {
access_token,
mut auth_config,
expires_at,
} = resolved_import;
apply_admin_provider_oauth_batch_import_hints(provider_type, entry, &mut auth_config);
let duplicate =

91
apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/batch/parse.rs
View File

@@ -1,5 +1,6 @@
use super::super::token_import::{import_tokens_from_raw_token, normalize_single_import_tokens};
use crate::handlers::admin::provider::oauth::errors::build_internal_control_error_response;
use crate::handlers::admin::provider::oauth::state::current_unix_secs;
use crate::handlers::admin::provider::oauth::state::{current_unix_secs, json_u64_value};
use axum::{
body::{to_bytes, Body, Bytes},
http,
@@ -18,7 +19,9 @@ pub(super) struct AdminProviderOAuthBatchImportRequest {
#[derive(Debug, Clone)]
pub(super) struct AdminProviderOAuthBatchImportEntry {
pub refresh_token: String,
pub refresh_token: Option<String>,
pub access_token: Option<String>,
pub expires_at: Option<u64>,
pub account_id: Option<String>,
pub account_user_id: Option<String>,
pub plan_type: Option<String>,
@@ -73,8 +76,11 @@ fn extract_admin_provider_oauth_batch_import_entry(
if refresh_token.is_empty() {
None
} else {
let (refresh_token, access_token) = import_tokens_from_raw_token(refresh_token);
Some(AdminProviderOAuthBatchImportEntry {
refresh_token: refresh_token.to_string(),
refresh_token,
access_token,
expires_at: None,
account_id: None,
account_user_id: None,
plan_type: None,
@@ -88,7 +94,19 @@ fn extract_admin_provider_oauth_batch_import_entry(
object
.get("refresh_token")
.or_else(|| object.get("refreshToken")),
)?;
);
let access_token = coerce_admin_provider_oauth_import_str(
object
.get("access_token")
.or_else(|| object.get("accessToken")),
);
let (refresh_token, access_token) =
normalize_single_import_tokens(refresh_token.as_deref(), access_token.as_deref());
if refresh_token.is_none() && access_token.is_none() {
return None;
}
let expires_at =
json_u64_value(object.get("expires_at").or_else(|| object.get("expiresAt")));
let account_id = coerce_admin_provider_oauth_import_str(
object
.get("account_id")
@@ -121,6 +139,8 @@ fn extract_admin_provider_oauth_batch_import_entry(
let email = coerce_admin_provider_oauth_import_str(object.get("email"));
Some(AdminProviderOAuthBatchImportEntry {
refresh_token,
access_token,
expires_at,
account_id,
account_user_id,
plan_type,
@@ -163,13 +183,18 @@ pub(super) fn parse_admin_provider_oauth_batch_import_entries(
raw.lines()
.map(str::trim)
.filter(|line| !line.is_empty() && !line.starts_with('#'))
.map(|refresh_token| AdminProviderOAuthBatchImportEntry {
refresh_token: refresh_token.to_string(),
account_id: None,
account_user_id: None,
plan_type: None,
user_id: None,
email: None,
.map(|token| {
let (refresh_token, access_token) = import_tokens_from_raw_token(token);
AdminProviderOAuthBatchImportEntry {
refresh_token,
access_token,
expires_at: None,
account_id: None,
account_user_id: None,
plan_type: None,
user_id: None,
email: None,
}
})
.collect()
}
@@ -291,3 +316,47 @@ pub(super) fn build_admin_provider_oauth_batch_task_state(
"updated_at": updated_at,
})
}
#[cfg(test)]
mod tests {
use super::parse_admin_provider_oauth_batch_import_entries;
use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
use serde_json::json;
fn unsigned_jwt(payload: serde_json::Value) -> String {
let header = json!({"alg": "none", "typ": "JWT"});
let encode = |value: serde_json::Value| {
URL_SAFE_NO_PAD.encode(serde_json::to_vec(&value).expect("jwt json should serialize"))
};
format!("{}.{}.signature", encode(header), encode(payload))
}
#[test]
fn parses_access_token_only_entry() {
let entries = parse_admin_provider_oauth_batch_import_entries(
r#"[{"accessToken":"at_1","expiresAt":2100000000,"accountId":"acc-1","email":"u@example.com"}]"#,
);
assert_eq!(entries.len(), 1);
assert_eq!(entries[0].refresh_token, None);
assert_eq!(entries[0].access_token.as_deref(), Some("at_1"));
assert_eq!(entries[0].expires_at, Some(2_100_000_000));
assert_eq!(entries[0].account_id.as_deref(), Some("acc-1"));
assert_eq!(entries[0].email.as_deref(), Some("u@example.com"));
}
#[test]
fn parses_plain_jwt_line_as_access_token() {
let token = unsigned_jwt(json!({
"iss": "https://auth.openai.com",
"aud": ["https://api.openai.com/v1"],
"exp": 2_000_000_000u64,
}));
let entries = parse_admin_provider_oauth_batch_import_entries(&token);
assert_eq!(entries.len(), 1);
assert_eq!(entries[0].refresh_token, None);
assert_eq!(entries[0].access_token.as_deref(), Some(token.as_str()));
}
}

7
apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/complete/key.rs
View File

@@ -1,9 +1,10 @@
use super::super::super::errors::build_internal_control_error_response;
use super::super::super::provisioning::provider_oauth_token_payload_expires_at_unix_secs;
use super::super::super::quota::codex::refresh_codex_provider_quota_locally;
use super::super::super::runtime::provider_oauth_runtime_endpoint_for_provider;
use super::super::super::state::{
admin_provider_oauth_template, enrich_admin_provider_oauth_auth_config,
is_fixed_provider_type_for_provider_oauth, json_non_empty_string, json_u64_value,
is_fixed_provider_type_for_provider_oauth, json_non_empty_string,
};
use super::shared::{
parse_admin_provider_oauth_complete_callback, parse_admin_provider_oauth_complete_request_body,
@@ -168,8 +169,8 @@ pub(super) async fn handle_admin_provider_oauth_complete_key(
.ok()
.map(|duration| duration.as_secs())
.unwrap_or(0);
let expires_at = json_u64_value(token_payload.get("expires_in"))
.map(|expires_in| now_unix_secs.saturating_add(expires_in));
let expires_at =
provider_oauth_token_payload_expires_at_unix_secs(&token_payload, now_unix_secs);
let mut auth_config = serde_json::Map::new();
auth_config.insert("provider_type".to_string(), json!(provider_type.clone()));

196
apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/import.rs
View File

@@ -12,10 +12,17 @@ use super::super::runtime::{
use super::super::state::{
admin_provider_oauth_template, build_admin_provider_oauth_backend_unavailable_response,
exchange_admin_provider_oauth_refresh_token, is_fixed_provider_type_for_provider_oauth,
json_u64_value,
};
use super::token_import::{
build_codex_access_token_import_auth_config, normalize_single_import_tokens,
};
use crate::handlers::admin::provider::shared::paths::admin_provider_oauth_import_provider_id;
use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
use crate::handlers::admin::request::{
AdminAppState, AdminProviderOAuthTemplate, AdminRequestContext,
};
use crate::GatewayError;
use aether_contracts::ProxySnapshot;
use axum::{
body::Body,
http,
@@ -25,6 +32,125 @@ use axum::{
use serde_json::json;
use std::time::{SystemTime, UNIX_EPOCH};
struct AdminProviderOAuthSingleImportTokens {
access_token: String,
auth_config: serde_json::Map<String, serde_json::Value>,
expires_at: Option<u64>,
}
fn import_payload_string(
payload: &serde_json::Map<String, serde_json::Value>,
snake_case: &str,
camel_case: &str,
) -> Option<String> {
payload
.get(snake_case)
.or_else(|| payload.get(camel_case))
.and_then(serde_json::Value::as_str)
.map(str::trim)
.filter(|value| !value.is_empty())
.map(ToOwned::to_owned)
}
fn import_payload_u64(
payload: &serde_json::Map<String, serde_json::Value>,
snake_case: &str,
camel_case: &str,
) -> Option<u64> {
json_u64_value(payload.get(snake_case).or_else(|| payload.get(camel_case)))
}
async fn resolve_admin_provider_oauth_single_import_tokens(
state: &AdminAppState<'_>,
template: AdminProviderOAuthTemplate,
provider_type: &str,
refresh_token: Option<&str>,
access_token: Option<&str>,
imported_expires_at: Option<u64>,
request_proxy: Option<ProxySnapshot>,
) -> Result<AdminProviderOAuthSingleImportTokens, Response<Body>> {
if let Some(refresh_token) = refresh_token
.map(str::trim)
.filter(|value| !value.is_empty())
{
let token_payload = match state
.exchange_admin_provider_oauth_refresh_token(
template,
refresh_token,
request_proxy.clone(),
)
.await
{
Ok(payload) => payload,
Err(response) => {
if provider_type.eq_ignore_ascii_case("codex") {
if let Some(access_token) = access_token
.map(str::trim)
.filter(|value| !value.is_empty())
{
let (auth_config, expires_at) = build_codex_access_token_import_auth_config(
access_token,
Some(refresh_token),
imported_expires_at,
Some("Refresh Token 验证失败，已回退为 Access Token 导入"),
);
return Ok(AdminProviderOAuthSingleImportTokens {
access_token: access_token.to_string(),
auth_config,
expires_at,
});
}
}
return Err(response);
}
};
let (mut auth_config, access_token, returned_refresh_token, expires_at) =
build_provider_oauth_auth_config_from_token_payload(provider_type, &token_payload);
let Some(access_token) = access_token else {
return Err(build_internal_control_error_response(
http::StatusCode::BAD_REQUEST,
"token refresh 返回缺少 access_token",
));
};
let refresh_token = returned_refresh_token
.or_else(|| Some(refresh_token.to_string()))
.filter(|value| !value.trim().is_empty());
if let Some(refresh_token) = refresh_token.as_ref() {
auth_config.insert("refresh_token".to_string(), json!(refresh_token));
}
return Ok(AdminProviderOAuthSingleImportTokens {
access_token,
auth_config,
expires_at,
});
}
let Some(access_token) = access_token
.map(str::trim)
.filter(|value| !value.is_empty())
else {
return Err(build_internal_control_error_response(
http::StatusCode::BAD_REQUEST,
"Refresh Token 或 Access Token 不能为空",
));
};
if !provider_type.eq_ignore_ascii_case("codex") {
return Err(build_internal_control_error_response(
http::StatusCode::BAD_REQUEST,
"Access Token 导入仅支持 Codex Provider",
));
}
let (auth_config, expires_at) =
build_codex_access_token_import_auth_config(access_token, None, imported_expires_at, None);
Ok(AdminProviderOAuthSingleImportTokens {
access_token: access_token.to_string(),
auth_config,
expires_at,
})
}
pub(super) async fn handle_admin_provider_oauth_import_refresh_token(
state: &AdminAppState<'_>,
request_context: &AdminRequestContext<'_>,
@@ -54,17 +180,19 @@ pub(super) async fn handle_admin_provider_oauth_import_refresh_token(
));
}
};
let Some(refresh_token_input) = raw_payload
.get("refresh_token")
.and_then(serde_json::Value::as_str)
.map(str::trim)
.filter(|value| !value.is_empty())
else {
let refresh_token_input = import_payload_string(&raw_payload, "refresh_token", "refreshToken");
let access_token_input = import_payload_string(&raw_payload, "access_token", "accessToken");
let imported_expires_at = import_payload_u64(&raw_payload, "expires_at", "expiresAt");
let (refresh_token_input, access_token_input) = normalize_single_import_tokens(
refresh_token_input.as_deref(),
access_token_input.as_deref(),
);
if refresh_token_input.is_none() && access_token_input.is_none() {
return Ok(build_internal_control_error_response(
http::StatusCode::BAD_REQUEST,
"Refresh Token 不能为空",
"Refresh Token 或 Access Token 不能为空",
));
};
}
let name = raw_payload
.get("name")
.and_then(serde_json::Value::as_str)
@@ -122,32 +250,30 @@ pub(super) async fn handle_admin_provider_oauth_import_refresh_token(
.await;
let key_proxy = provider_oauth_key_proxy_value(proxy_node_id.as_deref());
let token_payload = match state
.exchange_admin_provider_oauth_refresh_token(
template,
refresh_token_input,
request_proxy.clone(),
)
.await
let resolved_import = match resolve_admin_provider_oauth_single_import_tokens(
state,
template,
&provider_type,
refresh_token_input.as_deref(),
access_token_input.as_deref(),
imported_expires_at,
request_proxy.clone(),
)
.await
{
Ok(payload) => payload,
Ok(value) => value,
Err(response) => return Ok(response),
};
let (mut auth_config, access_token, returned_refresh_token, expires_at) =
build_provider_oauth_auth_config_from_token_payload(&provider_type, &token_payload);
let Some(access_token) = access_token else {
return Ok(build_internal_control_error_response(
http::StatusCode::BAD_REQUEST,
"token refresh 返回缺少 access_token",
));
};
let refresh_token = returned_refresh_token
.or_else(|| Some(refresh_token_input.to_string()))
.filter(|value| !value.trim().is_empty());
if let Some(refresh_token) = refresh_token.as_ref() {
auth_config.insert("refresh_token".to_string(), json!(refresh_token));
}
let AdminProviderOAuthSingleImportTokens {
access_token,
auth_config,
expires_at,
} = resolved_import;
let has_refresh_token = auth_config
.get("refresh_token")
.and_then(serde_json::Value::as_str)
.map(str::trim)
.is_some_and(|value| !value.is_empty());
let api_formats = provider_oauth_active_api_formats(&endpoints);
let duplicate = match state
@@ -239,7 +365,11 @@ pub(super) async fn handle_admin_provider_oauth_import_refresh_token(
"key_id": persisted_key.id,
"provider_type": provider_type,
"expires_at": expires_at,
"has_refresh_token": refresh_token.is_some(),
"has_refresh_token": has_refresh_token,
"temporary": auth_config
.get("access_token_import_temporary")
.and_then(serde_json::Value::as_bool)
.unwrap_or(false),
"email": auth_config.get("email").cloned().unwrap_or(serde_json::Value::Null),
"replaced": replaced,
}))

1
apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/mod.rs
View File

@@ -27,6 +27,7 @@ mod kiro;
mod refresh;
mod start;
mod tasks;
mod token_import;
pub(crate) async fn maybe_build_local_admin_provider_oauth_response(
state: &AdminAppState<'_>,

209
apps/aether-gateway/src/handlers/admin/provider/oauth/dispatch/token_import.rs Normal file
View File

@@ -0,0 +1,209 @@
use super::super::provisioning::build_provider_oauth_auth_config_from_token_payload;
use super::super::state::json_u64_value;
use base64::{
engine::general_purpose::{URL_SAFE, URL_SAFE_NO_PAD},
Engine as _,
};
use serde_json::{json, Map, Value};
fn decode_base64_url_part(value: &str) -> Option<Vec<u8>> {
URL_SAFE_NO_PAD
.decode(value.as_bytes())
.or_else(|_| URL_SAFE.decode(value.as_bytes()))
.or_else(|_| {
let mut padded = value.to_string();
let remainder = padded.len() % 4;
if remainder != 0 {
padded.extend(std::iter::repeat_n('=', 4 - remainder));
}
URL_SAFE.decode(padded.as_bytes())
})
.ok()
}
fn decode_unverified_jwt_json_part(part: &str) -> Option<Map<String, Value>> {
let bytes = decode_base64_url_part(part)?;
serde_json::from_slice::<Value>(&bytes)
.ok()?
.as_object()
.cloned()
}
pub(super) fn looks_like_access_token(token: &str) -> bool {
let parts = token.trim().split('.').collect::<Vec<_>>();
if parts.len() != 3 || parts.iter().any(|part| part.is_empty()) {
return false;
}
let Some(header) = decode_unverified_jwt_json_part(parts[0]) else {
return false;
};
let Some(payload) = decode_unverified_jwt_json_part(parts[1]) else {
return false;
};
let token_type = header
.get("typ")
.and_then(Value::as_str)
.map(str::trim)
.unwrap_or_default()
.to_ascii_lowercase();
if !token_type.is_empty() && token_type != "jwt" && token_type != "at+jwt" {
return false;
}
["exp", "aud", "iss", "scope", "scp"]
.iter()
.any(|field| payload.contains_key(*field))
}
pub(super) fn normalize_single_import_tokens(
refresh_token: Option<&str>,
access_token: Option<&str>,
) -> (Option<String>, Option<String>) {
let mut refresh_token = refresh_token
.map(str::trim)
.filter(|value| !value.is_empty())
.map(ToOwned::to_owned);
let mut access_token = access_token
.map(str::trim)
.filter(|value| !value.is_empty())
.map(ToOwned::to_owned);
if access_token.is_none()
&& refresh_token
.as_deref()
.is_some_and(looks_like_access_token)
{
access_token = refresh_token.take();
}
(refresh_token, access_token)
}
pub(super) fn import_tokens_from_raw_token(token: &str) -> (Option<String>, Option<String>) {
if looks_like_access_token(token) {
(None, Some(token.trim().to_string()))
} else {
(Some(token.trim().to_string()), None)
}
}
pub(super) fn decode_access_token_expires_at(access_token: &str) -> Option<u64> {
let payload = access_token.trim().split('.').nth(1)?;
let claims = decode_unverified_jwt_json_part(payload)?;
json_u64_value(claims.get("exp"))
}
pub(super) fn build_codex_access_token_import_auth_config(
access_token: &str,
refresh_token: Option<&str>,
imported_expires_at: Option<u64>,
refresh_error: Option<&str>,
) -> (Map<String, Value>, Option<u64>) {
let token_payload = json!({
"access_token": access_token,
"token_type": "Bearer",
});
let (mut auth_config, _, _, _) =
build_provider_oauth_auth_config_from_token_payload("codex", &token_payload);
let refresh_token = refresh_token
.map(str::trim)
.filter(|value| !value.is_empty());
if let Some(refresh_token) = refresh_token {
auth_config.insert("refresh_token".to_string(), json!(refresh_token));
}
auth_config.insert(
"access_token_import_temporary".to_string(),
json!(refresh_token.is_none()),
);
if let Some(expires_at) = decode_access_token_expires_at(access_token).or(imported_expires_at) {
auth_config.insert("expires_at".to_string(), json!(expires_at));
}
if let Some(refresh_error) = refresh_error
.map(str::trim)
.filter(|value| !value.is_empty())
{
auth_config.insert(
"refresh_token_import_error".to_string(),
json!(refresh_error),
);
}
let expires_at = auth_config.get("expires_at").and_then(Value::as_u64);
(auth_config, expires_at)
}
#[cfg(test)]
mod tests {
use super::{
build_codex_access_token_import_auth_config, decode_access_token_expires_at,
looks_like_access_token, normalize_single_import_tokens,
};
use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
use serde_json::json;
fn unsigned_jwt(payload: serde_json::Value) -> String {
let header = json!({"alg": "none", "typ": "JWT"});
let encode = |value: serde_json::Value| {
URL_SAFE_NO_PAD.encode(serde_json::to_vec(&value).expect("jwt json should serialize"))
};
format!("{}.{}.signature", encode(header), encode(payload))
}
#[test]
fn detects_plain_jwt_access_token() {
let token = unsigned_jwt(json!({
"iss": "https://auth.openai.com",
"aud": ["https://api.openai.com/v1"],
"exp": 2_000_000_000u64,
}));
assert!(looks_like_access_token(&token));
let (refresh_token, access_token) = normalize_single_import_tokens(Some(&token), None);
assert!(refresh_token.is_none());
assert_eq!(access_token.as_deref(), Some(token.as_str()));
}
#[test]
fn builds_codex_temporary_auth_config_from_access_token() {
let token = unsigned_jwt(json!({
"exp": 2_000_000_000u64,
"https://api.openai.com/profile": {
"email": "u@example.com"
},
}));
let (auth_config, expires_at) =
build_codex_access_token_import_auth_config(&token, None, None, None);
assert_eq!(expires_at, Some(2_000_000_000));
assert_eq!(decode_access_token_expires_at(&token), Some(2_000_000_000));
assert_eq!(auth_config.get("email"), Some(&json!("u@example.com")));
assert_eq!(
auth_config.get("access_token_import_temporary"),
Some(&json!(true))
);
assert!(auth_config.get("refresh_token").is_none());
}
#[test]
fn builds_codex_auth_config_with_imported_expires_at_when_token_has_no_exp() {
let token = unsigned_jwt(json!({
"iss": "https://auth.openai.com",
"aud": ["https://api.openai.com/v1"]
}));
let (auth_config, expires_at) =
build_codex_access_token_import_auth_config(&token, None, Some(2_100_000_000), None);
assert_eq!(expires_at, Some(2_100_000_000));
assert_eq!(
auth_config.get("expires_at"),
Some(&json!(2_100_000_000u64))
);
}
}

44
apps/aether-gateway/src/handlers/admin/provider/oauth/errors.rs
View File

@@ -9,6 +9,17 @@ use axum::{
};
use serde_json::json;
fn oauth_invalid_reason_is_account_level_block(reason: Option<&str>) -> bool {
let Some(reason) = reason.map(str::trim).filter(|value| !value.is_empty()) else {
return false;
};
if reason.starts_with(OAUTH_ACCOUNT_BLOCK_PREFIX) {
return true;
}
aether_admin::provider::status::resolve_account_status_snapshot(None, None, Some(reason))
.blocked
}
pub(crate) fn build_internal_control_error_response(
status: http::StatusCode,
message: impl Into<String>,
@@ -133,22 +144,17 @@ pub(crate) fn merge_provider_oauth_refresh_failure_reason(
if current_reason.starts_with(OAUTH_EXPIRED_PREFIX) {
return None;
}
if current_reason.starts_with(OAUTH_ACCOUNT_BLOCK_PREFIX) {
if let Some((head, _)) = current_reason.split_once("[REFRESH_FAILED]") {
return Some(
format!("{}\n{}", head.trim_end(), refresh_reason)
.trim()
.to_string(),
);
}
return Some(format!("{current_reason}\n{refresh_reason}"));
if oauth_invalid_reason_is_account_level_block(Some(current_reason)) {
return None;
}
Some(refresh_reason.to_string())
}
#[cfg(test)]
mod tests {
use super::normalize_provider_oauth_refresh_error_message;
use super::{
merge_provider_oauth_refresh_failure_reason, normalize_provider_oauth_refresh_error_message,
};
#[test]
fn normalizes_openai_refresh_token_expired_response() {
@@ -159,4 +165,22 @@ mod tests {
"refresh_token 无效、已过期或已撤销，请重新登录授权"
);
}
#[test]
fn refresh_failure_does_not_replace_account_level_block() {
assert_eq!(
merge_provider_oauth_refresh_failure_reason(
Some("[ACCOUNT_BLOCK] account has been deactivated"),
"[REFRESH_FAILED] Token 续期失败 (401): refresh_token 无效",
),
None,
);
assert_eq!(
merge_provider_oauth_refresh_failure_reason(
Some("account_banned"),
"[REFRESH_FAILED] Token 续期失败 (401): refresh_token 无效",
),
None,
);
}
}

87
apps/aether-gateway/src/handlers/admin/provider/oauth/provisioning.rs
View File

@@ -1,5 +1,6 @@
use super::state::{
enrich_admin_provider_oauth_auth_config, json_non_empty_string, json_u64_value,
decode_jwt_claims, enrich_admin_provider_oauth_auth_config, json_non_empty_string,
json_u64_value,
};
use crate::handlers::admin::request::AdminAppState;
use crate::provider_key_auth::provider_active_api_formats;
@@ -27,6 +28,32 @@ pub(crate) fn provider_oauth_active_api_formats(
provider_active_api_formats(endpoints)
}
pub(crate) fn provider_oauth_token_payload_expires_at_unix_secs(
token_payload: &serde_json::Value,
now_unix_secs: u64,
) -> Option<u64> {
json_u64_value(
token_payload
.get("expires_in")
.or_else(|| token_payload.get("expiresIn")),
)
.map(|expires_in| now_unix_secs.saturating_add(expires_in))
.or_else(|| {
json_u64_value(
token_payload
.get("expires_at")
.or_else(|| token_payload.get("expiresAt"))
.or_else(|| token_payload.get("expiry"))
.or_else(|| token_payload.get("exp")),
)
})
.or_else(|| {
let access_token = json_non_empty_string(token_payload.get("access_token"))?;
let claims = decode_jwt_claims(&access_token)?;
json_u64_value(claims.get("exp"))
})
}
pub(crate) fn build_provider_oauth_auth_config_from_token_payload(
provider_type: &str,
token_payload: &serde_json::Value,
@@ -43,8 +70,8 @@ pub(crate) fn build_provider_oauth_auth_config_from_token_payload(
.ok()
.map(|duration| duration.as_secs())
.unwrap_or(0);
let expires_at = json_u64_value(token_payload.get("expires_in"))
.map(|expires_in| now_unix_secs.saturating_add(expires_in));
let expires_at =
provider_oauth_token_payload_expires_at_unix_secs(token_payload, now_unix_secs);
let mut auth_config = serde_json::Map::new();
auth_config.insert("provider_type".to_string(), json!(provider_type));
@@ -193,3 +220,57 @@ fn provider_oauth_catalog_key_api_formats(
Some(json!(api_formats))
}
}
#[cfg(test)]
mod tests {
use super::provider_oauth_token_payload_expires_at_unix_secs;
use base64::{engine::general_purpose::URL_SAFE_NO_PAD, Engine as _};
use serde_json::json;
fn sample_unsigned_jwt(payload: serde_json::Value) -> String {
let header = URL_SAFE_NO_PAD.encode(r#"{"alg":"none","typ":"JWT"}"#);
let payload = URL_SAFE_NO_PAD.encode(payload.to_string());
format!("{header}.{payload}.sig")
}
#[test]
fn token_payload_expiry_uses_relative_expires_in_aliases() {
let payload = json!({
"access_token": "opaque-token",
"expiresIn": 120,
});
assert_eq!(
provider_oauth_token_payload_expires_at_unix_secs(&payload, 1_000),
Some(1_120)
);
}
#[test]
fn token_payload_expiry_uses_absolute_expires_at_aliases() {
let payload = json!({
"access_token": "opaque-token",
"expiresAt": 4_102_444_800u64,
});
assert_eq!(
provider_oauth_token_payload_expires_at_unix_secs(&payload, 1_000),
Some(4_102_444_800)
);
}
#[test]
fn token_payload_expiry_falls_back_to_access_token_exp_claim() {
let access_token = sample_unsigned_jwt(json!({
"exp": 2_000_000_000u64,
}));
let payload = json!({
"access_token": access_token,
});
assert_eq!(
provider_oauth_token_payload_expires_at_unix_secs(&payload, 1_000),
Some(2_000_000_000)
);
}
}

28
apps/aether-gateway/src/handlers/admin/provider/oauth/quota/codex/mod.rs
View File

@@ -28,6 +28,22 @@ use aether_data_contracts::repository::provider_catalog::{
use serde_json::json;
use std::time::{SystemTime, UNIX_EPOCH};
fn merge_codex_quota_metadata(
header_metadata: Option<&serde_json::Value>,
body_metadata: &serde_json::Value,
) -> serde_json::Value {
let mut merged = header_metadata
.and_then(serde_json::Value::as_object)
.cloned()
.unwrap_or_default();
if let Some(body_object) = body_metadata.as_object() {
for (key, value) in body_object {
merged.insert(key.clone(), value.clone());
}
}
serde_json::Value::Object(merged)
}
pub(crate) async fn refresh_codex_provider_quota_locally(
state: &AdminAppState<'_>,
provider: &StoredProviderCatalogProvider,
@@ -103,7 +119,9 @@ pub(crate) async fn refresh_codex_provider_quota_locally(
.map(|duration| duration.as_secs())
.unwrap_or(0);
let mut metadata_update = parse_codex_usage_headers(&result.headers, now_unix_secs)
let header_metadata = parse_codex_usage_headers(&result.headers, now_unix_secs);
let mut metadata_update = header_metadata
.as_ref()
.map(|metadata| json!({ "codex": metadata }));
let (mut oauth_invalid_at_unix_secs, mut oauth_invalid_reason) = (None, None);
let mut status = "error".to_string();
@@ -117,7 +135,13 @@ pub(crate) async fn refresh_codex_provider_quota_locally(
.and_then(|body| body.json_body.as_ref())
{
if let Some(parsed) = parse_codex_wham_usage_response(body_json, now_unix_secs) {
metadata_update = Some(json!({ "codex": parsed }));
metadata_update = Some(json!({
"codex": merge_codex_quota_metadata(header_metadata.as_ref(), &parsed)
}));
(oauth_invalid_at_unix_secs, oauth_invalid_reason) =
quota_refresh_success_invalid_state(&key);
status = "success".to_string();
} else if metadata_update.is_some() {
(oauth_invalid_at_unix_secs, oauth_invalid_reason) =
quota_refresh_success_invalid_state(&key);
status = "success".to_string();

25
apps/aether-gateway/src/handlers/admin/provider/oauth/state/auth_config.rs
View File

@@ -74,4 +74,29 @@ mod tests {
assert_eq!(auth_config.get("plan_type"), Some(&json!("plus")));
assert_eq!(auth_config.get("user_id"), Some(&json!("user-2")));
}
#[test]
fn codex_enrichment_extracts_profile_email_from_claims() {
let access_token = sample_unsigned_jwt(json!({
"https://api.openai.com/profile": {
"email": "profile@example.com",
"email_verified": true,
},
"https://api.openai.com/auth": {
"chatgpt_account_id": "acc-profile",
},
}));
let token_payload = json!({
"access_token": access_token,
});
let mut auth_config = serde_json::Map::new();
enrich_admin_provider_oauth_auth_config("codex", &mut auth_config, &token_payload);
assert_eq!(
auth_config.get("email"),
Some(&json!("profile@example.com"))
);
assert_eq!(auth_config.get("account_id"), Some(&json!("acc-profile")));
}
}

8
apps/aether-gateway/src/handlers/admin/provider/pool_admin/mod.rs
View File

@@ -34,9 +34,11 @@ pub(crate) use self::batch_shared::{
AdminPoolBatchImportRequest,
};
pub(crate) use self::support::{
admin_pool_provider_id_from_path, parse_admin_pool_page, parse_admin_pool_page_size,
parse_admin_pool_quick_selectors, parse_admin_pool_search, parse_admin_pool_status_filter,
AdminPoolResolveSelectionRequest, ADMIN_POOL_BANNED_KEY_CLEANUP_EMPTY_MESSAGE,
admin_pool_provider_id_from_path, parse_admin_pool_key_sort, parse_admin_pool_page,
parse_admin_pool_page_size, parse_admin_pool_quick_selectors, parse_admin_pool_search,
parse_admin_pool_status_filter, AdminPoolKeySort, AdminPoolKeySortDirection,
AdminPoolKeySortField, AdminPoolResolveSelectionRequest,
ADMIN_POOL_BANNED_KEY_CLEANUP_EMPTY_MESSAGE,
ADMIN_POOL_PROVIDER_CATALOG_READER_UNAVAILABLE_DETAIL,
ADMIN_POOL_PROVIDER_CATALOG_WRITER_UNAVAILABLE_DETAIL,
};

58
apps/aether-gateway/src/handlers/admin/provider/pool_admin/payloads.rs
View File

@@ -305,17 +305,17 @@ fn admin_pool_quota_window_reset_seconds(
window: &serde_json::Map<String, serde_json::Value>,
now_unix_secs: u64,
) -> Option<f64> {
if let Some(reset_at) = admin_pool_json_to_u64(window.get("reset_at")) {
return Some(reset_at.saturating_sub(now_unix_secs) as f64);
if let Some(remaining) = admin_pool_json_to_f64(window.get("reset_seconds")) {
let observed_at_unix_secs = admin_pool_json_to_u64(quota_snapshot.get("observed_at"))
.or_else(|| admin_pool_json_to_u64(quota_snapshot.get("updated_at")));
let elapsed = observed_at_unix_secs
.map(|observed_at| now_unix_secs.saturating_sub(observed_at) as f64)
.unwrap_or(0.0);
return Some((remaining - elapsed).max(0.0));
}
let remaining = admin_pool_json_to_f64(window.get("reset_seconds"))?;
let observed_at_unix_secs = admin_pool_json_to_u64(quota_snapshot.get("observed_at"))
.or_else(|| admin_pool_json_to_u64(quota_snapshot.get("updated_at")));
let elapsed = observed_at_unix_secs
.map(|observed_at| now_unix_secs.saturating_sub(observed_at) as f64)
.unwrap_or(0.0);
Some((remaining - elapsed).max(0.0))
admin_pool_json_to_u64(window.get("reset_at"))
.map(|reset_at| reset_at.saturating_sub(now_unix_secs) as f64)
}
fn admin_pool_codex_quota_part_from_window(
@@ -323,6 +323,7 @@ fn admin_pool_codex_quota_part_from_window(
window_code: &str,
label: &str,
now_unix_secs: u64,
show_reset_without_consumption: bool,
) -> Option<String> {
let window = admin_pool_quota_window(quota_snapshot, window_code)?;
let used_percent = admin_pool_quota_window_used_percent(window)?;
@@ -338,7 +339,9 @@ fn admin_pool_codex_quota_part_from_window(
"{label}剩余 {}",
admin_pool_format_percent(100.0 - effective_used_percent)
);
if admin_pool_has_quota_consumption(Some(effective_used_percent)) {
if show_reset_without_consumption
|| admin_pool_has_quota_consumption(Some(effective_used_percent))
{
if let Some(reset_text) = reset_seconds.and_then(admin_pool_format_reset_after) {
part.push_str(&format!(" ({reset_text})"));
}
@@ -351,15 +354,27 @@ fn admin_pool_build_codex_account_quota_from_snapshot(
) -> Option<String> {
let now_unix_secs = chrono::Utc::now().timestamp().max(0) as u64;
let mut parts = Vec::new();
let exhausted = quota_snapshot
.get("exhausted")
.and_then(admin_provider_quota_pure::coerce_json_bool)
.unwrap_or(false);
if let Some(part) =
admin_pool_codex_quota_part_from_window(quota_snapshot, "weekly", "周", now_unix_secs)
{
if let Some(part) = admin_pool_codex_quota_part_from_window(
quota_snapshot,
"weekly",
"周",
now_unix_secs,
exhausted,
) {
parts.push(part);
}
if let Some(part) =
admin_pool_codex_quota_part_from_window(quota_snapshot, "5h", "5H", now_unix_secs)
{
if let Some(part) = admin_pool_codex_quota_part_from_window(
quota_snapshot,
"5h",
"5H",
now_unix_secs,
exhausted,
) {
parts.push(part);
}
@@ -798,6 +813,12 @@ pub(super) fn build_admin_pool_key_payload(
} else {
Vec::new()
};
let oauth_temporary = auth_semantics.can_show_oauth_metadata()
&& auth_config
.as_ref()
.and_then(|config| config.get("access_token_import_temporary"))
.and_then(serde_json::Value::as_bool)
.unwrap_or(false);
let account_status_code = admin_pool_trimmed_string_from_map(account_snapshot, "code");
let account_status_label =
admin_pool_trimmed_string(account_snapshot.and_then(|item| item.get("label")));
@@ -879,6 +900,7 @@ pub(super) fn build_admin_pool_key_payload(
"oauth_organizations".to_string(),
serde_json::Value::Array(oauth_organizations),
);
payload.insert("oauth_temporary".to_string(), json!(oauth_temporary));
payload.insert(
"account_status_code".to_string(),
json!(account_status_code),
@@ -1011,6 +1033,10 @@ pub(super) fn build_admin_pool_key_payload(
"created_at".to_string(),
json!(key.created_at_unix_ms.and_then(unix_secs_to_rfc3339)),
);
payload.insert(
"imported_at".to_string(),
json!(key.created_at_unix_ms.and_then(unix_secs_to_rfc3339)),
);
payload.insert(
"last_used_at".to_string(),
json!(key.last_used_at_unix_secs.and_then(unix_secs_to_rfc3339)),

72
apps/aether-gateway/src/handlers/admin/provider/pool_admin/read_routes/keys.rs
View File

@@ -1,14 +1,16 @@
use super::{
admin_pool_provider_id_from_path, admin_provider_pool_config, build_admin_pool_error_response,
parse_admin_pool_page, parse_admin_pool_page_size, parse_admin_pool_quick_selectors,
parse_admin_pool_search, parse_admin_pool_status_filter, pool_payloads, pool_selection,
read_admin_provider_pool_cooldown_key_ids, read_admin_provider_pool_runtime_state,
AdminProviderPoolRuntimeState, ProviderCatalogKeyListOrder, ProviderCatalogKeyListQuery,
ADMIN_POOL_PROVIDER_CATALOG_READER_UNAVAILABLE_DETAIL,
parse_admin_pool_key_sort, parse_admin_pool_page, parse_admin_pool_page_size,
parse_admin_pool_quick_selectors, parse_admin_pool_search, parse_admin_pool_status_filter,
pool_payloads, pool_selection, read_admin_provider_pool_cooldown_key_ids,
read_admin_provider_pool_runtime_state, AdminPoolKeySort, AdminPoolKeySortDirection,
AdminPoolKeySortField, AdminProviderPoolRuntimeState, ProviderCatalogKeyListOrder,
ProviderCatalogKeyListQuery, ADMIN_POOL_PROVIDER_CATALOG_READER_UNAVAILABLE_DETAIL,
};
use crate::handlers::admin::request::{AdminAppState, AdminRequestContext};
use crate::GatewayError;
use aether_admin::provider::pool as admin_provider_pool_pure;
use aether_data_contracts::repository::provider_catalog::StoredProviderCatalogKey;
use axum::{
body::Body,
http,
@@ -16,6 +18,51 @@ use axum::{
Json,
};
use serde_json::json;
use std::cmp::Ordering;
fn admin_pool_compare_optional_unix_secs(
left: Option<u64>,
right: Option<u64>,
direction: AdminPoolKeySortDirection,
) -> Ordering {
match (left, right) {
(Some(left), Some(right)) => match direction {
AdminPoolKeySortDirection::Asc => left.cmp(&right),
AdminPoolKeySortDirection::Desc => right.cmp(&left),
},
(Some(_), None) => Ordering::Less,
(None, Some(_)) => Ordering::Greater,
(None, None) => Ordering::Equal,
}
}
fn admin_pool_sort_keys_for_request(keys: &mut [StoredProviderCatalogKey], sort: AdminPoolKeySort) {
match sort.field {
AdminPoolKeySortField::Default => pool_selection::admin_pool_sort_keys(keys),
AdminPoolKeySortField::ImportedAt => {
keys.sort_by(|left, right| {
admin_pool_compare_optional_unix_secs(
left.created_at_unix_ms,
right.created_at_unix_ms,
sort.direction,
)
.then(left.name.cmp(&right.name))
.then(left.id.cmp(&right.id))
});
}
AdminPoolKeySortField::LastUsedAt => {
keys.sort_by(|left, right| {
admin_pool_compare_optional_unix_secs(
left.last_used_at_unix_secs,
right.last_used_at_unix_secs,
sort.direction,
)
.then(left.name.cmp(&right.name))
.then(left.id.cmp(&right.id))
});
}
}
}
pub(super) async fn build_admin_pool_list_keys_response(
state: &AdminAppState<'_>,
@@ -66,6 +113,15 @@ pub(super) async fn build_admin_pool_list_keys_response(
));
}
};
let sort = match parse_admin_pool_key_sort(query) {
Ok(value) => value,
Err(detail) => {
return Ok(build_admin_pool_error_response(
http::StatusCode::BAD_REQUEST,
detail,
));
}
};
let Some(provider) = state
.read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
@@ -117,7 +173,7 @@ pub(super) async fn build_admin_pool_list_keys_response(
})
});
}
pool_selection::admin_pool_sort_keys(&mut keys);
admin_pool_sort_keys_for_request(&mut keys, sort);
let total = keys.len();
let keys = keys
.into_iter()
@@ -125,7 +181,7 @@ pub(super) async fn build_admin_pool_list_keys_response(
.take(page_size)
.collect::<Vec<_>>();
(keys, total)
} else if !quick_selectors.is_empty() {
} else if !quick_selectors.is_empty() || sort.field != AdminPoolKeySortField::Default {
let mut keys = state
.list_provider_catalog_keys_by_provider_ids(std::slice::from_ref(&provider.id))
.await?
@@ -154,7 +210,7 @@ pub(super) async fn build_admin_pool_list_keys_response(
})
})
.collect::<Vec<_>>();
pool_selection::admin_pool_sort_keys(&mut keys);
admin_pool_sort_keys_for_request(&mut keys, sort);
let total = keys.len();
let keys = keys
.into_iter()

53
apps/aether-gateway/src/handlers/admin/provider/pool_admin/support.rs
View File

@@ -15,6 +15,34 @@ pub(crate) const ADMIN_POOL_PROVIDER_CATALOG_WRITER_UNAVAILABLE_DETAIL: &str =
"Admin pool cleanup requires provider catalog writer";
pub(crate) const ADMIN_POOL_BANNED_KEY_CLEANUP_EMPTY_MESSAGE: &str = "未发现可清理的异常账号";
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub(crate) enum AdminPoolKeySortField {
Default,
ImportedAt,
LastUsedAt,
}
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub(crate) enum AdminPoolKeySortDirection {
Asc,
Desc,
}
#[derive(Clone, Copy, Debug, PartialEq, Eq)]
pub(crate) struct AdminPoolKeySort {
pub field: AdminPoolKeySortField,
pub direction: AdminPoolKeySortDirection,
}
impl Default for AdminPoolKeySort {
fn default() -> Self {
Self {
field: AdminPoolKeySortField::Default,
direction: AdminPoolKeySortDirection::Desc,
}
}
}
pub(crate) fn build_admin_pool_error_response(
status: http::StatusCode,
detail: impl Into<String>,
@@ -83,6 +111,31 @@ pub(crate) fn parse_admin_pool_status_filter(query: Option<&str>) -> Result<Stri
}
}
pub(crate) fn parse_admin_pool_key_sort(query: Option<&str>) -> Result<AdminPoolKeySort, String> {
let field = match query_param_value(query, "sort_by")
.map(|value| value.trim().to_ascii_lowercase())
.filter(|value| !value.is_empty())
.as_deref()
{
None | Some("default") | Some("name") => AdminPoolKeySortField::Default,
Some("imported_at") | Some("created_at") => AdminPoolKeySortField::ImportedAt,
Some("last_used_at") | Some("last_used") => AdminPoolKeySortField::LastUsedAt,
Some(_) => {
return Err("sort_by must be one of: name, imported_at, last_used_at".to_string());
}
};
let direction = match query_param_value(query, "sort_order")
.map(|value| value.trim().to_ascii_lowercase())
.filter(|value| !value.is_empty())
.as_deref()
{
None | Some("desc") => AdminPoolKeySortDirection::Desc,
Some("asc") => AdminPoolKeySortDirection::Asc,
Some(_) => return Err("sort_order must be one of: asc, desc".to_string()),
};
Ok(AdminPoolKeySort { field, direction })
}
pub(crate) fn admin_pool_provider_id_from_path(request_path: &str) -> Option<String> {
let raw = request_path.strip_prefix("/api/admin/pool/")?;
let mut segments = raw.split('/');

54
apps/aether-gateway/src/handlers/admin/provider/write/reveal.rs
View File

@@ -79,28 +79,28 @@ fn provider_oauth_export_payload(
provider_type: &str,
auth_config: &serde_json::Map<String, serde_json::Value>,
upstream_metadata: Option<&serde_json::Value>,
fallback_access_token: Option<&str>,
) -> serde_json::Map<String, serde_json::Value> {
let normalized_provider_type = provider_type.trim().to_ascii_lowercase();
let skip_keys: &[&str] = match normalized_provider_type.as_str() {
"kiro" => &["access_token", "expires_at", "updated_at"],
_ => &[
"access_token",
"expires_at",
"updated_at",
"token_type",
"scope",
],
};
let skip_keys = ["updated_at", "updatedAt"];
let mut payload = serde_json::Map::new();
for (key, value) in auth_config {
if skip_keys.contains(&key.as_str()) {
continue;
}
if value.is_null() || value.as_str().is_some_and(str::is_empty) {
if value.is_null() || value.as_str().is_some_and(|inner| inner.trim().is_empty()) {
continue;
}
payload.insert(key.clone(), value.clone());
}
if !json_map_has_non_empty_string(&payload, &["access_token", "accessToken"]) {
if let Some(access_token) = fallback_access_token
.map(str::trim)
.filter(|value| !value.is_empty() && *value != "__placeholder__")
{
payload.insert("access_token".to_string(), json!(access_token));
}
}
if normalized_provider_type == "kiro" && !payload.contains_key("email") {
if let Some(email) = upstream_metadata
.and_then(serde_json::Value::as_object)
@@ -116,6 +116,17 @@ fn provider_oauth_export_payload(
payload
}
fn json_map_has_non_empty_string(
map: &serde_json::Map<String, serde_json::Value>,
keys: &[&str],
) -> bool {
keys.iter().any(|key| {
map.get(*key)
.and_then(serde_json::Value::as_str)
.is_some_and(|value| !value.trim().is_empty())
})
}
pub(crate) async fn build_admin_export_key_payload(
state: &AdminAppState<'_>,
key: &StoredProviderCatalogKey,
@@ -133,13 +144,6 @@ pub(crate) async fn build_admin_export_key_payload(
.ok()
.and_then(|value| value.as_object().cloned())
.ok_or_else(|| "无法解密认证配置".to_string())?;
if !auth_config
.get("refresh_token")
.and_then(serde_json::Value::as_str)
.is_some_and(|value| !value.trim().is_empty())
{
return Err("缺少 refresh_token，无法导出".to_string());
}
let provider_type_from_config = auth_config
.get("provider_type")
@@ -163,8 +167,18 @@ pub(crate) async fn build_admin_export_key_payload(
return Err("仅 OAuth 管理账号支持导出".to_string());
}
let mut payload =
provider_oauth_export_payload(&provider_type, &auth_config, key.upstream_metadata.as_ref());
let fallback_access_token = key
.encrypted_api_key
.as_deref()
.map(str::trim)
.filter(|value| !value.is_empty())
.and_then(|ciphertext| state.decrypt_catalog_secret_with_fallbacks(ciphertext));
let mut payload = provider_oauth_export_payload(
&provider_type,
&auth_config,
key.upstream_metadata.as_ref(),
fallback_access_token.as_deref(),
);
payload.insert("name".to_string(), json!(key.name));
payload.insert(
"exported_at".to_string(),

66
apps/aether-gateway/src/handlers/shared/catalog.rs
View File

@@ -477,6 +477,15 @@ fn quota_windows_min_reset_seconds(windows: &[Value]) -> Option<u64> {
.min()
}
fn quota_windows_min_reset_at(windows: &[Value]) -> Option<u64> {
windows
.iter()
.filter_map(Value::as_object)
.filter_map(|window| window.get("reset_at"))
.filter_map(|value| provider_quota_timestamp_unix_secs(Some(value)))
.min()
}
fn quota_windows_all_exhausted(windows: &[Value]) -> bool {
let mut total = 0usize;
let mut exhausted = 0usize;
@@ -515,7 +524,7 @@ fn codex_quota_window_snapshot(
let used_percent = metadata
.get(&used_percent_key)
.and_then(admin_provider_quota_pure::coerce_json_f64);
let reset_at = metadata
let explicit_reset_at = metadata
.get(&reset_at_key)
.and_then(admin_provider_quota_pure::coerce_json_u64);
let reset_seconds = metadata
@@ -528,9 +537,14 @@ fn codex_quota_window_snapshot(
})
.or_else(|| {
observed_at_unix_secs
.zip(reset_at)
.zip(explicit_reset_at)
.map(|(observed_at, reset_at)| reset_at.saturating_sub(observed_at))
});
let reset_at = explicit_reset_at.or_else(|| {
observed_at_unix_secs
.zip(reset_seconds)
.map(|(observed_at, reset_seconds)| observed_at.saturating_add(reset_seconds))
});
let window_minutes = metadata
.get(&window_minutes_key)
.and_then(admin_provider_quota_pure::coerce_json_u64);
@@ -611,6 +625,7 @@ fn build_codex_quota_status_snapshot(
.filter_map(|window| window.get("reset_seconds"))
.filter_map(admin_provider_quota_pure::coerce_json_u64)
.min();
let reset_at = quota_windows_min_reset_at(&windows);
let exhausted_by_credits =
credits_unlimited != Some(true) && credits_has_credits == Some(false);
let exhausted_by_window = usage_ratio.is_some_and(|value| value >= 1.0 - 1e-6);
@@ -647,6 +662,7 @@ fn build_codex_quota_status_snapshot(
"exhausted": exhausted,
"usage_ratio": usage_ratio,
"updated_at": observed_at_unix_secs,
"reset_at": reset_at,
"reset_seconds": reset_seconds,
"plan_type": plan_type,
"credits": if credits.is_empty() {
@@ -767,6 +783,7 @@ fn build_kiro_quota_status_snapshot(
"exhausted": exhausted,
"usage_ratio": usage_ratio,
"updated_at": observed_at_unix_secs,
"reset_at": next_reset_at,
"reset_seconds": reset_seconds,
"plan_type": plan_type,
"windows": windows,
@@ -810,6 +827,7 @@ fn build_antigravity_quota_status_snapshot(
let usage_ratio = quota_windows_usage_ratio(&windows);
let reset_seconds = quota_windows_min_reset_seconds(&windows);
let reset_at = quota_windows_min_reset_at(&windows);
let exhausted = !is_forbidden && quota_windows_all_exhausted(&windows);
let reason = if is_forbidden {
forbidden_reason
@@ -845,6 +863,7 @@ fn build_antigravity_quota_status_snapshot(
"exhausted": exhausted,
"usage_ratio": usage_ratio,
"updated_at": observed_at_unix_secs,
"reset_at": reset_at,
"reset_seconds": reset_seconds,
"plan_type": serde_json::Value::Null,
"windows": windows,
@@ -906,6 +925,11 @@ fn build_gemini_cli_quota_status_snapshot(
} else {
None
};
let reset_at = if cooling {
quota_windows_min_reset_at(&windows)
} else {
None
};
Some(json!({
"version": 2,
@@ -929,6 +953,7 @@ fn build_gemini_cli_quota_status_snapshot(
"exhausted": exhausted,
"usage_ratio": usage_ratio,
"updated_at": observed_at_unix_secs,
"reset_at": reset_at,
"reset_seconds": reset_seconds,
"plan_type": serde_json::Value::Null,
"windows": windows,
@@ -1235,6 +1260,12 @@ pub(crate) fn build_admin_provider_key_response(
} else {
Vec::new()
};
let oauth_temporary = auth_semantics.can_show_oauth_metadata()
&& auth_config
.as_ref()
.and_then(|config| config.get("access_token_import_temporary"))
.and_then(serde_json::Value::as_bool)
.unwrap_or(false);
let oauth_plan_type = derive_catalog_oauth_plan_type(key, provider_type, auth_config.as_ref());
let (
health_score,
@@ -1386,6 +1417,7 @@ pub(crate) fn build_admin_provider_key_response(
"oauth_organizations".to_string(),
serde_json::Value::Array(oauth_organizations),
);
payload.insert("oauth_temporary".to_string(), json!(oauth_temporary));
payload.insert(
"oauth_invalid_at".to_string(),
json!(auth_semantics
@@ -1609,6 +1641,7 @@ mod tests {
assert_eq!(quota.get("provider_type"), Some(&json!("codex")));
assert_eq!(quota.get("plan_type"), Some(&json!("plus")));
assert_eq!(quota.get("updated_at"), Some(&json!(1_775_553_285u64)));
assert_eq!(quota.get("reset_at"), Some(&json!(1_900_000_000u64)));
assert_eq!(
quota
.get("credits")
@@ -1622,6 +1655,35 @@ mod tests {
);
}
#[test]
fn provider_key_status_snapshot_payload_derives_codex_reset_at_from_countdown() {
let mut key = sample_catalog_key();
key.upstream_metadata = Some(json!({
"codex": {
"updated_at": 1_775_553_285u64,
"primary_used_percent": 55.0,
"primary_reset_after_seconds": 3_600u64
}
}));
let payload = provider_key_status_snapshot_payload(&key, "codex");
let quota = payload
.get("quota")
.and_then(Value::as_object)
.expect("quota snapshot should be object");
let window = quota
.get("windows")
.and_then(Value::as_array)
.and_then(|windows| windows.first())
.and_then(Value::as_object)
.expect("quota window should exist");
assert_eq!(quota.get("reset_at"), Some(&json!(1_775_556_885u64)));
assert_eq!(quota.get("reset_seconds"), Some(&json!(3_600u64)));
assert_eq!(window.get("reset_at"), Some(&json!(1_775_556_885u64)));
assert_eq!(window.get("reset_seconds"), Some(&json!(3_600u64)));
}
#[test]
fn provider_key_status_snapshot_payload_preserves_existing_materialized_quota_snapshot() {
let mut key = sample_catalog_key();