feat(grok): add admin oauth and quota support

apps/aether-gateway/src/tests/control/admin/provider_query.rs

@@ -1967,6 +1967,144 @@ async fn gateway_streams_codex_openai_responses_upstream_for_admin_pool_model_te
     execution_runtime_handle.abort();
 }
 
+#[tokio::test]
+async fn gateway_routes_grok_responses_admin_pool_model_test_through_grok_runtime() {
+    let execution_runtime = Router::new().route(
+        "/v1/execute/sync",
+        any(move |Json(plan): Json<ExecutionPlan>| async move {
+            assert_eq!(plan.provider_id, "provider-grok");
+            assert_eq!(plan.endpoint_id, "endpoint-grok-responses");
+            assert_eq!(plan.key_id, "key-grok-oauth");
+            assert_eq!(plan.client_api_format, "openai:responses");
+            assert_eq!(plan.provider_api_format, "openai:responses");
+            assert_eq!(plan.url, "https://grok.com/rest/app-chat/conversations/new");
+            assert_eq!(plan.model_name.as_deref(), Some("grok-4.20-fast"));
+            assert!(plan.stream, "Grok model test should request a stream");
+            assert_eq!(
+                plan.headers
+                    .get(aether_provider_transport::GROK_INTERNAL_HEADER)
+                    .map(String::as_str),
+                Some("1")
+            );
+            assert_eq!(
+                plan.headers.get("cookie").map(String::as_str),
+                Some("sso=grok-sso; sso-rw=grok-rw")
+            );
+            let body = plan.body.json_body.as_ref().expect("json body");
+            assert_eq!(body["model"], json!("grok-4.20-fast"));
+            assert_eq!(body["input"], json!("Hello! This is a test message."));
+            assert_eq!(
+                body["messages"][0]["content"],
+                json!("stale chat-shaped frontend body")
+            );
+            Json(json!({
+                "request_id": plan.request_id,
+                "candidate_id": plan.candidate_id,
+                "status_code": 200,
+                "headers": {
+                    "content-type": "application/json"
+                },
+                "body": {
+                    "json_body": {
+                        "id": "resp-grok-model-test",
+                        "model": "grok-4.20-fast",
+                        "output_text": "ok"
+                    }
+                },
+                "telemetry": {
+                    "elapsed_ms": 18
+                }
+            }))
+        }),
+    );
+
+    let (execution_runtime_url, execution_runtime_handle) = start_server(execution_runtime).await;
+    let mut provider = sample_provider("provider-grok", "Grok", 10);
+    provider.provider_type = "grok".to_string();
+    provider.config = Some(json!({"pool_advanced": {}}));
+    let mut key = sample_key(
+        "key-grok-oauth",
+        "provider-grok",
+        "openai:responses",
+        "__placeholder__",
+    );
+    key.auth_type = "oauth".to_string();
+    key.encrypted_auth_config = Some(
+        aether_crypto::encrypt_python_fernet_plaintext(
+            DEVELOPMENT_ENCRYPTION_KEY,
+            r#"{
+                "provider_type":"grok",
+                "sso_token":"grok-sso",
+                "sso_rw_token":"grok-rw"
+            }"#,
+        )
+        .expect("auth config should encrypt"),
+    );
+    let provider_catalog_repository = Arc::new(InMemoryProviderCatalogReadRepository::seed(
+        vec![provider],
+        vec![sample_endpoint(
+            "endpoint-grok-responses",
+            "provider-grok",
+            "openai:responses",
+            "https://grok.com",
+        )],
+        vec![key],
+    ));
+
+    let gateway = build_router_with_state(
+        build_state_with_execution_runtime_override(execution_runtime_url)
+            .with_data_state_for_tests(GatewayDataState::with_provider_transport_reader_for_tests(
+                provider_catalog_repository,
+                DEVELOPMENT_ENCRYPTION_KEY.to_string(),
+            )),
+    );
+    let (gateway_url, gateway_handle) = start_server(gateway).await;
+
+    let response = reqwest::Client::new()
+        .post(format!(
+            "{gateway_url}/api/admin/provider-query/test-model-failover"
+        ))
+        .header(GATEWAY_HEADER, "rust-phase3b")
+        .header(TRUSTED_ADMIN_USER_ID_HEADER, "admin-user-123")
+        .header(TRUSTED_ADMIN_USER_ROLE_HEADER, "admin")
+        .header(TRUSTED_ADMIN_SESSION_ID_HEADER, "session-123")
+        .json(&json!({
+            "provider_id": "provider-grok",
+            "mode": "pool",
+            "model": "grok-4.20-fast",
+            "failover_models": ["grok-4.20-fast"],
+            "api_format": "openai:responses",
+            "endpoint_id": "endpoint-grok-responses",
+            "request_body": {
+                "model": "grok-4.20-fast",
+                "messages": [{
+                    "role": "user",
+                    "content": "stale chat-shaped frontend body"
+                }],
+                "stream": true
+            }
+        }))
+        .send()
+        .await
+        .expect("request should succeed");
+
+    assert_eq!(response.status(), StatusCode::OK);
+    let payload: serde_json::Value = response.json().await.expect("json body should parse");
+    assert_eq!(payload["success"], json!(true));
+    assert_eq!(payload["attempts"][0]["status"], json!("success"));
+    assert_eq!(
+        payload["attempts"][0]["request_body"]["message"],
+        json!("Hello! This is a test message.")
+    );
+    assert_eq!(
+        payload["attempts"][0]["request_headers"][aether_provider_transport::GROK_INTERNAL_HEADER],
+        json!("1")
+    );
+
+    gateway_handle.abort();
+    execution_runtime_handle.abort();
+}
+
 #[tokio::test]
 async fn gateway_uses_pool_scheduler_order_for_admin_pool_model_test() {
     let execution_runtime = Router::new().route(