refactor: 大规模模块拆分与代码精简，新增 ai-pipeline/data-contracts 独立 crate

- 新增 aether-ai-pipeline 和 aether-data-contracts crate，将 pipeline 逻辑与数据契约从 gateway 中解耦 - 重构 admin handlers：拆分单体模块为 auth/billing/endpoint/features/model/observability/provider/system 等独立子模块 - 合并 chat/cli 重复代码路径：精简 conversion、finalize、planner 中的 sync/chat/cli 分支 - 重构 scheduler/executor/data 层，引入 facade 模式降低模块间耦合 - 移除冗余的 intent 模块，将 plan_fallback/policy/stream_path/sync_path 迁移至 executor - 前端适配：调整 admin API 调用和 provider 模型测试对话框
2026-10-10 03:09:50 +08:00 · 2026-04-07 02:50:19 +08:00
parent 763ff03a7b
commit 5d96d6673b
732 changed files with 28589 additions and 20662 deletions
@@ -0,0 +1,173 @@
+use super::super::provider_oauth_refresh::build_internal_control_error_response;
+use super::super::provider_oauth_state::{
+    admin_provider_oauth_template, build_provider_oauth_start_response,
+    generate_provider_oauth_pkce_verifier, is_fixed_provider_type_for_provider_oauth,
+    provider_oauth_pkce_s256, save_provider_oauth_state,
+};
+use crate::control::GatewayPublicRequestContext;
+use crate::handlers::admin::provider::shared::{
+    admin_provider_oauth_start_key_id, admin_provider_oauth_start_provider_id,
+};
+use crate::{AppState, GatewayError};
+use axum::{
+    body::Body,
+    http,
+    response::{IntoResponse, Response},
+    Json,
+};
+
+pub(super) async fn handle_admin_provider_oauth_start_key(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Response<Body>, GatewayError> {
+    let Some(key_id) = admin_provider_oauth_start_key_id(&request_context.request_path) else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Key 不存在",
+        ));
+    };
+    let key = state
+        .read_provider_catalog_keys_by_ids(std::slice::from_ref(&key_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(key) = key else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Key 不存在",
+        ));
+    };
+    if !key.auth_type.eq_ignore_ascii_case("oauth") {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Key 不是 oauth 认证类型",
+        ));
+    }
+
+    let provider_id = key.provider_id.clone();
+    let provider = state
+        .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(provider) = provider else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider_type = provider.provider_type.trim().to_ascii_lowercase();
+    if !is_fixed_provider_type_for_provider_oauth(&provider_type) {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不是固定类型，无法使用 provider-oauth",
+        ));
+    }
+    let Some(template) = admin_provider_oauth_template(&provider_type) else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不支持 OAuth 授权",
+        ));
+    };
+
+    let pkce_verifier = template
+        .use_pkce
+        .then(generate_provider_oauth_pkce_verifier);
+    let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
+    let nonce = match save_provider_oauth_state(
+        state,
+        &key_id,
+        &provider_id,
+        &provider_type,
+        pkce_verifier.as_deref(),
+    )
+    .await
+    {
+        Ok(nonce) => nonce,
+        Err(_) => {
+            return Ok(build_internal_control_error_response(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "provider oauth redis unavailable",
+            ));
+        }
+    };
+
+    Ok(Json(build_provider_oauth_start_response(
+        template,
+        &nonce,
+        code_challenge.as_deref(),
+    ))
+    .into_response())
+}
+
+pub(super) async fn handle_admin_provider_oauth_start_provider(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Response<Body>, GatewayError> {
+    let Some(provider_id) = admin_provider_oauth_start_provider_id(&request_context.request_path)
+    else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider = state
+        .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(provider) = provider else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider_type = provider.provider_type.trim().to_ascii_lowercase();
+    if !is_fixed_provider_type_for_provider_oauth(&provider_type) {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不是固定类型，无法使用 provider-oauth",
+        ));
+    }
+    if provider_type == "kiro" {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "Kiro 不支持 OAuth 授权，请使用导入授权。",
+        ));
+    }
+    let Some(template) = admin_provider_oauth_template(&provider_type) else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不支持 OAuth 授权",
+        ));
+    };
+
+    let pkce_verifier = template
+        .use_pkce
+        .then(generate_provider_oauth_pkce_verifier);
+    let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
+    let nonce = match save_provider_oauth_state(
+        state,
+        "",
+        &provider_id,
+        &provider_type,
+        pkce_verifier.as_deref(),
+    )
+    .await
+    {
+        Ok(nonce) => nonce,
+        Err(_) => {
+            return Ok(build_internal_control_error_response(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "provider oauth redis unavailable",
+            ));
+        }
+    };
+
+    Ok(Json(build_provider_oauth_start_response(
+        template,
+        &nonce,
+        code_challenge.as_deref(),
+    ))
+    .into_response())
+}