refactor: 移除独立 hub/proxy/executor/gateway crate，统一为 gateway tunnel 架构

- 删除 aether-hub、aether-proxy 独立项目及其 Dockerfile/配置 - 删除 crates/aether-executor 和 crates/aether-gateway 全部模块 - 新增 apps/ 目录作为应用入口 - 将 hub 概念重构为 gateway tunnel transport - 将 executor 重构为 execution runtime - 新增 tunnel.rs 合约定义和 testkit tunnel/execution_runtime 模块 - 更新 Python 服务层和测试适配新架构命名
2026-10-10 19:29:50 +08:00 · 2026-04-03 14:59:58 +08:00
parent ddf18fed9a
commit 8f26e1a31f
983 changed files with 103097 additions and 105836 deletions
@@ -0,0 +1,157 @@
+use super::*;
+
+pub(super) async fn handle_admin_provider_oauth_start_key(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Response<Body>, GatewayError> {
+    let Some(key_id) = admin_provider_oauth_start_key_id(&request_context.request_path) else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Key 不存在",
+        ));
+    };
+    let key = state
+        .read_provider_catalog_keys_by_ids(std::slice::from_ref(&key_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(key) = key else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Key 不存在",
+        ));
+    };
+    if !key.auth_type.eq_ignore_ascii_case("oauth") {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Key 不是 oauth 认证类型",
+        ));
+    }
+
+    let provider_id = key.provider_id.clone();
+    let provider = state
+        .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(provider) = provider else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider_type = provider.provider_type.trim().to_ascii_lowercase();
+    if !is_fixed_provider_type_for_provider_oauth(&provider_type) {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不是固定类型，无法使用 provider-oauth",
+        ));
+    }
+    let Some(template) = admin_provider_oauth_template(&provider_type) else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不支持 OAuth 授权",
+        ));
+    };
+
+    let pkce_verifier = template
+        .use_pkce
+        .then(generate_provider_oauth_pkce_verifier);
+    let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
+    let nonce = match save_provider_oauth_state(
+        state,
+        &key_id,
+        &provider_id,
+        &provider_type,
+        pkce_verifier.as_deref(),
+    )
+    .await
+    {
+        Ok(nonce) => nonce,
+        Err(_) => {
+            return Ok(build_internal_control_error_response(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "provider oauth redis unavailable",
+            ));
+        }
+    };
+
+    Ok(Json(build_provider_oauth_start_response(
+        template,
+        &nonce,
+        code_challenge.as_deref(),
+    ))
+    .into_response())
+}
+
+pub(super) async fn handle_admin_provider_oauth_start_provider(
+    state: &AppState,
+    request_context: &GatewayPublicRequestContext,
+) -> Result<Response<Body>, GatewayError> {
+    let Some(provider_id) = admin_provider_oauth_start_provider_id(&request_context.request_path)
+    else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider = state
+        .read_provider_catalog_providers_by_ids(std::slice::from_ref(&provider_id))
+        .await?
+        .into_iter()
+        .next();
+    let Some(provider) = provider else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::NOT_FOUND,
+            "Provider 不存在",
+        ));
+    };
+    let provider_type = provider.provider_type.trim().to_ascii_lowercase();
+    if !is_fixed_provider_type_for_provider_oauth(&provider_type) {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不是固定类型，无法使用 provider-oauth",
+        ));
+    }
+    if provider_type == "kiro" {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "Kiro 不支持 OAuth 授权，请使用导入授权。",
+        ));
+    }
+    let Some(template) = admin_provider_oauth_template(&provider_type) else {
+        return Ok(build_internal_control_error_response(
+            http::StatusCode::BAD_REQUEST,
+            "该 Provider 不支持 OAuth 授权",
+        ));
+    };
+
+    let pkce_verifier = template
+        .use_pkce
+        .then(generate_provider_oauth_pkce_verifier);
+    let code_challenge = pkce_verifier.as_deref().map(provider_oauth_pkce_s256);
+    let nonce = match save_provider_oauth_state(
+        state,
+        "",
+        &provider_id,
+        &provider_type,
+        pkce_verifier.as_deref(),
+    )
+    .await
+    {
+        Ok(nonce) => nonce,
+        Err(_) => {
+            return Ok(build_internal_control_error_response(
+                http::StatusCode::SERVICE_UNAVAILABLE,
+                "provider oauth redis unavailable",
+            ));
+        }
+    };
+
+    Ok(Json(build_provider_oauth_start_response(
+        template,
+        &nonce,
+        code_challenge.as_deref(),
+    ))
+    .into_response())
+}