Merge pull request #702 from MMEXA/fix/reconcile-auth-channel-mismatch-formats

fix(gateway): 修复批量更新 API 格式时的认证通道状态冲突

apps/aether-gateway/src/handlers/admin/provider/write/keys/update.rs

@@ -2,7 +2,8 @@ use crate::handlers::admin::provider::shared::payloads::AdminProviderKeyUpdatePa
 use crate::handlers::admin::provider::write::normalize::{
     normalize_allow_auth_channel_mismatch_formats, normalize_api_format_json_object_keys,
     normalize_api_format_list, normalize_auth_type, normalize_auth_type_by_format,
-    normalize_max_probe_interval_minutes, normalize_rate_multipliers, validate_vertex_api_formats,
+    normalize_max_probe_interval_minutes, normalize_rate_multipliers,
+    reconcile_allow_auth_channel_mismatch_formats, validate_vertex_api_formats,
 };
 use crate::handlers::admin::request::AdminAppState;
 use crate::handlers::admin::shared::{
@@ -256,7 +257,7 @@ pub(crate) fn build_admin_update_provider_key_record_with_existing_keys(
                 "allow_auth_channel_mismatch_formats",
                 &effective_api_formats,
             )?;
-    } else if fields.contains("api_formats") {
+    } else if fields.contains("api_formats") && !managed_fixed_oauth_key {
         let existing = updated
             .allow_auth_channel_mismatch_formats
             .as_ref()
@@ -269,11 +270,7 @@ pub(crate) fn build_admin_update_provider_key_record_with_existing_keys(
                     .collect::<Vec<_>>()
             });
         updated.allow_auth_channel_mismatch_formats =
-            normalize_allow_auth_channel_mismatch_formats(
-                existing,
-                "allow_auth_channel_mismatch_formats",
-                &effective_api_formats,
-            )?;
+            reconcile_allow_auth_channel_mismatch_formats(existing, &effective_api_formats);
     }
 
     updated.auth_type = target_auth_type;

apps/aether-gateway/src/handlers/admin/provider/write/normalize.rs

@@ -111,25 +111,49 @@ pub(crate) fn normalize_allow_auth_channel_mismatch_formats(
     field_name: &str,
     api_formats: &[String],
 ) -> Result<Option<serde_json::Value>, String> {
-    let Some(values) = values else {
+    let Some(values) = canonical_allow_auth_channel_mismatch_formats(values) else {
         return Ok(None);
     };
     let allowed = api_formats.iter().cloned().collect::<BTreeSet<_>>();
-    let mut seen = BTreeSet::new();
-    let mut normalized = Vec::new();
-    for value in values {
-        let canonical = crate::ai_serving::normalize_api_format_alias(&value);
-        if canonical.is_empty() {
-            continue;
-        }
-        if !allowed.is_empty() && !allowed.contains(&canonical) {
-            return Err(format!("{field_name} 包含未选择的 API 格式: {canonical}"));
-        }
-        if seen.insert(canonical.clone()) {
-            normalized.push(serde_json::Value::String(canonical));
+    for value in &values {
+        if !allowed.is_empty() && !allowed.contains(value) {
+            return Err(format!("{field_name} 包含未选择的 API 格式: {value}"));
         }
     }
-    Ok(Some(serde_json::Value::Array(normalized)))
+    Ok(Some(json_string_array(values)))
+}
+
+pub(crate) fn reconcile_allow_auth_channel_mismatch_formats(
+    values: Option<Vec<String>>,
+    api_formats: &[String],
+) -> Option<serde_json::Value> {
+    let values = canonical_allow_auth_channel_mismatch_formats(values)?;
+    let allowed = api_formats.iter().cloned().collect::<BTreeSet<_>>();
+    Some(json_string_array(
+        values
+            .into_iter()
+            .filter(|value| allowed.contains(value))
+            .collect(),
+    ))
+}
+
+fn canonical_allow_auth_channel_mismatch_formats(
+    values: Option<Vec<String>>,
+) -> Option<Vec<String>> {
+    let values = values?;
+    let mut seen = BTreeSet::new();
+    Some(
+        values
+            .into_iter()
+            .map(|value| crate::ai_serving::normalize_api_format_alias(&value))
+            .filter(|value| !value.is_empty())
+            .filter(|value| seen.insert(value.clone()))
+            .collect(),
+    )
+}
+
+fn json_string_array(values: Vec<String>) -> serde_json::Value {
+    serde_json::Value::Array(values.into_iter().map(serde_json::Value::String).collect())
 }
 
 pub(crate) fn normalize_auth_type(value: Option<&str>) -> Result<String, String> {
@@ -233,7 +257,8 @@ mod tests {
         normalize_allow_auth_channel_mismatch_formats, normalize_api_format_json_object_keys,
         normalize_api_format_list, normalize_auth_type, normalize_auth_type_by_format,
         normalize_chat_pii_redaction_config, normalize_pool_advanced_config,
-        normalize_provider_type_input, normalize_rate_multipliers, validate_vertex_api_formats,
+        normalize_provider_type_input, normalize_rate_multipliers,
+        reconcile_allow_auth_channel_mismatch_formats, validate_vertex_api_formats,
     };
     use serde_json::json;
 
@@ -405,6 +430,28 @@ mod tests {
         );
     }
 
+    #[test]
+    fn reconcile_allow_auth_channel_mismatch_formats_keeps_only_selected_formats() {
+        assert_eq!(
+            reconcile_allow_auth_channel_mismatch_formats(
+                Some(vec![
+                    "OPENAI:EMBEDDING".to_string(),
+                    "gemini:generate_content".to_string(),
+                    " GEMINI:GENERATE_CONTENT ".to_string(),
+                ]),
+                &["gemini:generate_content".to_string()],
+            ),
+            Some(json!(["gemini:generate_content"]))
+        );
+        assert_eq!(
+            reconcile_allow_auth_channel_mismatch_formats(
+                Some(vec!["openai:embedding".to_string()]),
+                &["gemini:generate_content".to_string()],
+            ),
+            Some(json!([]))
+        );
+    }
+
     #[test]
     fn validate_vertex_api_formats_rejects_unimplemented_anthropic_transport() {
         assert!(validate_vertex_api_formats(